diff --git a/.github/workflows/cultmesh-portability.yml b/.github/workflows/cultmesh-portability.yml
new file mode 100644
index 00000000..ce361fc8
--- /dev/null
+++ b/.github/workflows/cultmesh-portability.yml
@@ -0,0 +1,97 @@
+name: CultMesh portability and performance
+
+on:
+  push:
+    branches:
+      - main
+      - "codex/**"
+  pull_request:
+  workflow_dispatch:
+
+jobs:
+  getting-started:
+    name: ${{ matrix.os }} one-command multiplayer onboarding
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 30
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [windows-latest, ubuntu-latest]
+
+    steps:
+      - name: Check out CultLib
+        uses: actions/checkout@v4
+        with:
+          path: CultLib
+
+      - name: Check out the matching Eve contract
+        uses: actions/checkout@v4
+        with:
+          repository: GameCult/Eve
+          # Eve main is the contract this sample is written against; the codex
+          # branch this used to pin was never merged and stopped on 2026-08-25.
+          ref: ${{ vars.EVE_INTEGRATION_REF || 'main' }}
+          path: Eve
+
+      - name: Set up .NET
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: 10.0.x
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 24
+
+      - name: Run the documented one-command checkpoint
+        shell: pwsh
+        run: ./CultLib/scripts/verify-eve-getting-started.ps1 -EveRoot ./Eve
+
+  reactive-and-resource-lifetime:
+    name: ${{ matrix.os }} reactive semantics and leases
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 30
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [windows-latest, ubuntu-latest]
+
+    steps:
+      - name: Check out CultLib
+        uses: actions/checkout@v4
+
+      - name: Set up .NET
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: 10.0.x
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 24
+          cache: npm
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Install TypeScript workspace dependencies
+        run: npm install --no-package-lock
+
+      - name: Install Python CultLib packages
+        run: python -m pip install -e packages/cultcache-py -e packages/cultnet-py -e packages/cultmesh-py
+
+      - name: Verify explicit reactive scheduling across runtimes
+        shell: pwsh
+        run: ./scripts/verify-reactive-document-scaling.ps1
+
+      - name: Measure representative reactive workload
+        shell: pwsh
+        run: ./scripts/measure-reactive-document-performance.ps1 -Quick -SkipRuntimeBuild
+
+      - name: Churn 100,000 distinct document leases
+        run: >-
+          dotnet test tests/GameCult.Mesh.Tests/GameCult.Mesh.Tests.csproj
+          --filter FullyQualifiedName~Document_OneHundredThousandDistinctLeaseCyclesLeaveNoResourcesOrCallbacks
+          --logger "console;verbosity=minimal"
diff --git a/.github/workflows/cultnet-interop.yml b/.github/workflows/cultnet-interop.yml
index 1bde67ef..6876a76a 100644
--- a/.github/workflows/cultnet-interop.yml
+++ b/.github/workflows/cultnet-interop.yml
@@ -33,10 +33,6 @@ jobs:
         uses: actions/setup-node@v4
         with:
           node-version: 24
-          cache: npm
-          cache-dependency-path: |
-            packages/cultcache-ts/package-lock.json
-            packages/cultnet-ts/package-lock.json
 
       - name: Set up Python
         uses: actions/setup-python@v5
@@ -73,7 +69,7 @@ jobs:
         run: npm install --no-package-lock
 
       - name: Install Python package dependencies
-        run: python -m pip install -e packages/cultcache-py
+        run: python -m pip install -e packages/cultcache-py -e packages/cultnet-py -e packages/cultmesh-py
 
       - name: Build TypeScript workspace dependencies
         run: npm run build --workspace packages/cultcache-ts
@@ -87,6 +83,24 @@ jobs:
           npm run build --workspace packages/cultnet-ts
           npx tsc -p packages/cultnet-ts/tsconfig.test.json --pretty false
 
+      - name: Verify TypeScript RUDP reliability
+        run: npm test --workspace packages/cultnet-ts
+
+      - name: Verify Python RUDP reliability
+        run: |
+          python -m unittest discover -s packages/cultcache-py/tests
+          python -m unittest discover -s packages/cultnet-py/tests
+          python -m unittest discover -s packages/cultmesh-py/tests
+
+      - name: Verify Rust RUDP reliability
+        run: cargo test --manifest-path packages/cultnet-rs/Cargo.toml rudp
+
+      - name: Verify Rust CultMesh runtime-local surface
+        run: cargo test --manifest-path packages/cultmesh-rs/Cargo.toml
+
+      - name: Verify C# RUDP reliability
+        run: dotnet test tests/GameCult.Networking.Tests/GameCult.Networking.Tests.csproj --filter "FullyQualifiedName~Rudp"
+
       - name: Interop RUDP Python lane
         timeout-minutes: 8
         run: node --test --test-name-pattern "TypeScript and Python|Python and TypeScript" packages/cultnet-ts/dist-test/test/interop/cultnet-interop.test.js
diff --git a/.github/workflows/publish-packages.yml b/.github/workflows/publish-packages.yml
new file mode 100644
index 00000000..6061ca7a
--- /dev/null
+++ b/.github/workflows/publish-packages.yml
@@ -0,0 +1,146 @@
+name: Publish packages
+
+# Non-Rust consumers cannot take a package from a subdirectory of a git repo the
+# way cargo can, which is why they ended up vendoring forks instead. This gives
+# them a versioned artifact to depend on so CultLib stays the only source.
+#
+# Rust needs nothing here: cargo git dependencies pin a CultLib revision
+# directly, which is already how Ghostlight, Epiphany, CodexConnector and Odin
+# consume the core stack.
+#
+# Tag a release to publish, for example `cultcache-ts-v0.13.6` or
+# `cultnet-py-v0.1.0`. The tag's version must match the version in the package
+# manifest; the workflow refuses the publish otherwise rather than shipping a
+# mislabelled artifact.
+
+on:
+  push:
+    tags:
+      - "cultcache-ts-v*"
+      - "cultcache-py-v*"
+      - "cultnet-py-v*"
+      - "cultmesh-py-v*"
+  workflow_dispatch:
+    inputs:
+      package:
+        description: Package to build and test (publishes nothing on manual runs)
+        required: true
+        type: choice
+        options:
+          - cultcache-ts
+          - cultcache-py
+          - cultnet-py
+          - cultmesh-py
+
+permissions:
+  contents: read
+
+jobs:
+  cultcache-ts:
+    name: "@gamecult/cultcache-ts to npm"
+    if: startsWith(github.ref, 'refs/tags/cultcache-ts-v') || inputs.package == 'cultcache-ts'
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - name: Check out CultLib
+        uses: actions/checkout@v4
+
+      - name: Set up Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: 24.x
+          registry-url: https://registry.npmjs.org
+
+      - name: Install workspace dependencies
+        run: npm ci
+
+      - name: Verify the tag matches the manifest version
+        if: startsWith(github.ref, 'refs/tags/cultcache-ts-v')
+        run: |
+          manifest="$(node -p "require('./packages/cultcache-ts/package.json').version")"
+          tagged="${GITHUB_REF_NAME#cultcache-ts-v}"
+          if [ "$manifest" != "$tagged" ]; then
+            echo "tag $GITHUB_REF_NAME does not match manifest version $manifest" >&2
+            exit 1
+          fi
+
+      - name: Build and test
+        working-directory: packages/cultcache-ts
+        run: npm test
+
+      # Scoped packages default to restricted even on public npm, and this is
+      # MIT like the rest of the repo, so say public explicitly.
+      - name: Publish
+        if: startsWith(github.ref, 'refs/tags/cultcache-ts-v')
+        working-directory: packages/cultcache-ts
+        run: npm publish --access public
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+
+  # The three Python packages layer cultcache-py < cultnet-py < cultmesh-py, the
+  # same way the Rust crates and npm packages do. One job shape serves all
+  # three; the matrix entry names the package and the tag prefix that releases it.
+  python:
+    name: ${{ matrix.package }} to PyPI
+    if: startsWith(github.ref, 'refs/tags/cultcache-py-v') || startsWith(github.ref, 'refs/tags/cultnet-py-v') || startsWith(github.ref, 'refs/tags/cultmesh-py-v') || endsWith(inputs.package, '-py')
+    strategy:
+      fail-fast: false
+      matrix:
+        package: [cultcache-py, cultnet-py, cultmesh-py]
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    environment: pypi
+    permissions:
+      contents: read
+      # PyPI trusted publishing exchanges this for a short-lived token, so no
+      # long-lived API token is stored in the repository.
+      id-token: write
+    steps:
+      - name: Skip packages this run does not name
+        id: selected
+        run: |
+          if [ "${GITHUB_REF_NAME#${{ matrix.package }}-v}" != "$GITHUB_REF_NAME" ] || [ "${{ inputs.package }}" = "${{ matrix.package }}" ]; then
+            echo "run=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "run=false" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Check out CultLib
+        if: steps.selected.outputs.run == 'true'
+        uses: actions/checkout@v4
+
+      - name: Set up Python
+        if: steps.selected.outputs.run == 'true'
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Verify the tag matches the manifest version
+        if: steps.selected.outputs.run == 'true' && startsWith(github.ref, 'refs/tags/')
+        run: |
+          manifest="$(python -c "import tomllib,pathlib;print(tomllib.loads(pathlib.Path('packages/${{ matrix.package }}/pyproject.toml').read_text())['project']['version'])")"
+          tagged="${GITHUB_REF_NAME#${{ matrix.package }}-v}"
+          if [ "$manifest" != "$tagged" ]; then
+            echo "tag $GITHUB_REF_NAME does not match manifest version $manifest" >&2
+            exit 1
+          fi
+
+      # Lower layers install from source so a release of one package is tested
+      # against the sibling revision it was cut with, not whatever PyPI has.
+      - name: Install and test
+        if: steps.selected.outputs.run == 'true'
+        run: |
+          python -m pip install -e packages/cultcache-py -e packages/cultnet-py -e packages/cultmesh-py
+          python -m unittest discover -s packages/${{ matrix.package }}/tests
+
+      - name: Build sdist and wheel
+        if: steps.selected.outputs.run == 'true'
+        run: |
+          python -m pip install --upgrade build
+          python -m build packages/${{ matrix.package }}
+
+      - name: Publish
+        if: steps.selected.outputs.run == 'true' && startsWith(github.ref, 'refs/tags/')
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          packages-dir: packages/${{ matrix.package }}/dist
diff --git a/.gitignore b/.gitignore
index d639c709..e4661501 100644
--- a/.gitignore
+++ b/.gitignore
@@ -303,10 +303,22 @@ node_modules/
 !packages/cultmesh-ts/**
 !packages/cultcache-py/
 !packages/cultcache-py/**
+!packages/cultnet-py/
+!packages/cultnet-py/**
+!packages/cultmesh-py/
+!packages/cultmesh-py/**
 !packages/cultcache-rs/
 !packages/cultcache-rs/**
 !packages/cultnet-rs/
 !packages/cultnet-rs/**
+!packages/cultmesh-rs/
+!packages/cultmesh-rs/**
+!packages/cultmath/
+!packages/cultmath/**
+!packages/cultmesh-browser/
+!packages/cultmesh-browser/**
+!packages/cultmesh-kotlin/
+!packages/cultmesh-kotlin/**
 packages/**/node_modules/
 packages/**/dist/
 packages/**/dist-test/
@@ -504,3 +516,7 @@ $RECYCLE.BIN/
 
 # Vim temporary swap files
 *.swp
+
+# Python package build output
+packages/*-py/build/
+*.egg-info/
diff --git a/.voidbot/status/void-memory-maintenance.json b/.voidbot/status/void-memory-maintenance.json
deleted file mode 100644
index 0d0b876a..00000000
--- a/.voidbot/status/void-memory-maintenance.json
+++ /dev/null
@@ -1,7 +0,0 @@
-{
-  "status": "starting",
-  "startedAt": "2026-06-14T19:46:12.715Z",
-  "stateFile": "E:\\Projects\\CultLib\\.voidbot\\state\\libby.cc",
-  "launcher": "repo_face_heartbeat",
-  "reason": "repo_face_stale_short_term_memory"
-}
diff --git a/CLAUDE.md b/CLAUDE.md
new file mode 100644
index 00000000..640c1a14
--- /dev/null
+++ b/CLAUDE.md
@@ -0,0 +1,3 @@
+Repository doctrine for this project lives in AGENTS.md, shared with Codex.
+
+@AGENTS.md
diff --git a/CultLib.sln b/CultLib.sln
index f6ae25e9..fbc20922 100644
--- a/CultLib.sln
+++ b/CultLib.sln
@@ -11,10 +11,6 @@ Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "GameCult.Caching", "src\Gam
 EndProject
 Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "GameCult.Caching.MessagePack", "src\GameCult.Caching.MessagePack\GameCult.Caching.MessagePack.csproj", "{26EE4C38-F06E-4E7A-A89C-908318BCB0DB}"
 EndProject
-Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "GameCult.Caching.MessagePack.Generator", "src\GameCult.Caching.MessagePack.Generator\GameCult.Caching.MessagePack.Generator.csproj", "{0E990C96-3808-450E-9349-A0C3262195ED}"
-EndProject
-Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "GameCult.Caching.MessagePack.Analyzers", "src\GameCult.Caching.MessagePack.Analyzers\GameCult.Caching.MessagePack.Analyzers.csproj", "{DBE06954-EC85-4034-9049-72C7D27556DF}"
-EndProject
 Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "GameCult.Networking", "src\GameCult.Networking\GameCult.Networking.csproj", "{67383F6C-C9C3-4C5B-95D4-5C50C20EDD4F}"
 EndProject
 Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "GameCult.Mesh", "src\GameCult.Mesh\GameCult.Mesh.csproj", "{8D1B01A7-BF9E-44E6-88E1-B17255728B42}"
@@ -31,6 +27,28 @@ Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "GameCult.Geometry.Tests", "
 EndProject
 Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "GameCult.Mesh.Tests", "tests\GameCult.Mesh.Tests\GameCult.Mesh.Tests.csproj", "{F8A5060A-FB0B-4B8B-AE06-5147BB4CA127}"
 EndProject
+Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "GameCult.Mesh.Quic", "src\GameCult.Mesh.Quic\GameCult.Mesh.Quic.csproj", "{B67042B8-1135-4E54-B1EB-D45342C720D7}"
+EndProject
+Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "GameCult.Mesh.Quic.Tests", "tests\GameCult.Mesh.Quic.Tests\GameCult.Mesh.Quic.Tests.csproj", "{21F26329-2119-4037-93CC-DD1801A1AB78}"
+EndProject
+Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "GameCult.Networking.WebSockets", "src\GameCult.Networking.WebSockets\GameCult.Networking.WebSockets.csproj", "{7F32D96B-AB5D-4A72-9217-B5DCCFEFC7E5}"
+EndProject
+Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "GameCult.Networking.WebSockets.Tests", "tests\GameCult.Networking.WebSockets.Tests\GameCult.Networking.WebSockets.Tests.csproj", "{B9A441EC-DADE-4500-B092-C635F3EB296A}"
+EndProject
+Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "samples", "samples", "{5D20AA90-6969-D8BD-9DCD-8634F4692FDA}"
+EndProject
+Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "EveBrowserNetworkSample", "samples\eve-browser-network\EveBrowserNetworkSample.csproj", "{5FA81CC7-87B2-4585-9D8E-9BBEC0AD85FB}"
+EndProject
+Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "packages", "packages", "{809F86A1-1C4C-B159-0CD4-DF9D33D876CE}"
+EndProject
+Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "cultmath", "cultmath", "{B48EAE30-152F-01E3-6E31-82B350494D3C}"
+EndProject
+Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "CultMath", "packages\cultmath\src\CultMath\CultMath.csproj", "{54D543F7-8EB7-4A11-977E-22D3EE2D8C3F}"
+EndProject
+Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "CultMath.Tests", "packages\cultmath\tests\CultMath.Tests\CultMath.Tests.csproj", "{FEF9DA88-2177-4FD0-885D-7096ACFA8A9D}"
+EndProject
+Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "GameCult.Caching.ConsumerBuild", "tests\GameCult.Caching.ConsumerBuild\GameCult.Caching.ConsumerBuild.csproj", "{D3138F3C-9531-4906-A5D3-74BD857D0685}"
+EndProject
 Global
 	GlobalSection(SolutionConfigurationPlatforms) = preSolution
 		Debug|Any CPU = Debug|Any CPU
@@ -77,30 +95,6 @@ Global
 		{26EE4C38-F06E-4E7A-A89C-908318BCB0DB}.Release|x64.Build.0 = Release|Any CPU
 		{26EE4C38-F06E-4E7A-A89C-908318BCB0DB}.Release|x86.ActiveCfg = Release|Any CPU
 		{26EE4C38-F06E-4E7A-A89C-908318BCB0DB}.Release|x86.Build.0 = Release|Any CPU
-		{0E990C96-3808-450E-9349-A0C3262195ED}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
-		{0E990C96-3808-450E-9349-A0C3262195ED}.Debug|Any CPU.Build.0 = Debug|Any CPU
-		{0E990C96-3808-450E-9349-A0C3262195ED}.Debug|x64.ActiveCfg = Debug|Any CPU
-		{0E990C96-3808-450E-9349-A0C3262195ED}.Debug|x64.Build.0 = Debug|Any CPU
-		{0E990C96-3808-450E-9349-A0C3262195ED}.Debug|x86.ActiveCfg = Debug|Any CPU
-		{0E990C96-3808-450E-9349-A0C3262195ED}.Debug|x86.Build.0 = Debug|Any CPU
-		{0E990C96-3808-450E-9349-A0C3262195ED}.Release|Any CPU.ActiveCfg = Release|Any CPU
-		{0E990C96-3808-450E-9349-A0C3262195ED}.Release|Any CPU.Build.0 = Release|Any CPU
-		{0E990C96-3808-450E-9349-A0C3262195ED}.Release|x64.ActiveCfg = Release|Any CPU
-		{0E990C96-3808-450E-9349-A0C3262195ED}.Release|x64.Build.0 = Release|Any CPU
-		{0E990C96-3808-450E-9349-A0C3262195ED}.Release|x86.ActiveCfg = Release|Any CPU
-		{0E990C96-3808-450E-9349-A0C3262195ED}.Release|x86.Build.0 = Release|Any CPU
-		{DBE06954-EC85-4034-9049-72C7D27556DF}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
-		{DBE06954-EC85-4034-9049-72C7D27556DF}.Debug|Any CPU.Build.0 = Debug|Any CPU
-		{DBE06954-EC85-4034-9049-72C7D27556DF}.Debug|x64.ActiveCfg = Debug|Any CPU
-		{DBE06954-EC85-4034-9049-72C7D27556DF}.Debug|x64.Build.0 = Debug|Any CPU
-		{DBE06954-EC85-4034-9049-72C7D27556DF}.Debug|x86.ActiveCfg = Debug|Any CPU
-		{DBE06954-EC85-4034-9049-72C7D27556DF}.Debug|x86.Build.0 = Debug|Any CPU
-		{DBE06954-EC85-4034-9049-72C7D27556DF}.Release|Any CPU.ActiveCfg = Release|Any CPU
-		{DBE06954-EC85-4034-9049-72C7D27556DF}.Release|Any CPU.Build.0 = Release|Any CPU
-		{DBE06954-EC85-4034-9049-72C7D27556DF}.Release|x64.ActiveCfg = Release|Any CPU
-		{DBE06954-EC85-4034-9049-72C7D27556DF}.Release|x64.Build.0 = Release|Any CPU
-		{DBE06954-EC85-4034-9049-72C7D27556DF}.Release|x86.ActiveCfg = Release|Any CPU
-		{DBE06954-EC85-4034-9049-72C7D27556DF}.Release|x86.Build.0 = Release|Any CPU
 		{67383F6C-C9C3-4C5B-95D4-5C50C20EDD4F}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
 		{67383F6C-C9C3-4C5B-95D4-5C50C20EDD4F}.Debug|Any CPU.Build.0 = Debug|Any CPU
 		{67383F6C-C9C3-4C5B-95D4-5C50C20EDD4F}.Debug|x64.ActiveCfg = Debug|Any CPU
@@ -185,6 +179,102 @@ Global
 		{F8A5060A-FB0B-4B8B-AE06-5147BB4CA127}.Release|x64.Build.0 = Release|Any CPU
 		{F8A5060A-FB0B-4B8B-AE06-5147BB4CA127}.Release|x86.ActiveCfg = Release|Any CPU
 		{F8A5060A-FB0B-4B8B-AE06-5147BB4CA127}.Release|x86.Build.0 = Release|Any CPU
+		{B67042B8-1135-4E54-B1EB-D45342C720D7}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+		{B67042B8-1135-4E54-B1EB-D45342C720D7}.Debug|Any CPU.Build.0 = Debug|Any CPU
+		{B67042B8-1135-4E54-B1EB-D45342C720D7}.Debug|x64.ActiveCfg = Debug|Any CPU
+		{B67042B8-1135-4E54-B1EB-D45342C720D7}.Debug|x64.Build.0 = Debug|Any CPU
+		{B67042B8-1135-4E54-B1EB-D45342C720D7}.Debug|x86.ActiveCfg = Debug|Any CPU
+		{B67042B8-1135-4E54-B1EB-D45342C720D7}.Debug|x86.Build.0 = Debug|Any CPU
+		{B67042B8-1135-4E54-B1EB-D45342C720D7}.Release|Any CPU.ActiveCfg = Release|Any CPU
+		{B67042B8-1135-4E54-B1EB-D45342C720D7}.Release|Any CPU.Build.0 = Release|Any CPU
+		{B67042B8-1135-4E54-B1EB-D45342C720D7}.Release|x64.ActiveCfg = Release|Any CPU
+		{B67042B8-1135-4E54-B1EB-D45342C720D7}.Release|x64.Build.0 = Release|Any CPU
+		{B67042B8-1135-4E54-B1EB-D45342C720D7}.Release|x86.ActiveCfg = Release|Any CPU
+		{B67042B8-1135-4E54-B1EB-D45342C720D7}.Release|x86.Build.0 = Release|Any CPU
+		{21F26329-2119-4037-93CC-DD1801A1AB78}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+		{21F26329-2119-4037-93CC-DD1801A1AB78}.Debug|Any CPU.Build.0 = Debug|Any CPU
+		{21F26329-2119-4037-93CC-DD1801A1AB78}.Debug|x64.ActiveCfg = Debug|Any CPU
+		{21F26329-2119-4037-93CC-DD1801A1AB78}.Debug|x64.Build.0 = Debug|Any CPU
+		{21F26329-2119-4037-93CC-DD1801A1AB78}.Debug|x86.ActiveCfg = Debug|Any CPU
+		{21F26329-2119-4037-93CC-DD1801A1AB78}.Debug|x86.Build.0 = Debug|Any CPU
+		{21F26329-2119-4037-93CC-DD1801A1AB78}.Release|Any CPU.ActiveCfg = Release|Any CPU
+		{21F26329-2119-4037-93CC-DD1801A1AB78}.Release|Any CPU.Build.0 = Release|Any CPU
+		{21F26329-2119-4037-93CC-DD1801A1AB78}.Release|x64.ActiveCfg = Release|Any CPU
+		{21F26329-2119-4037-93CC-DD1801A1AB78}.Release|x64.Build.0 = Release|Any CPU
+		{21F26329-2119-4037-93CC-DD1801A1AB78}.Release|x86.ActiveCfg = Release|Any CPU
+		{21F26329-2119-4037-93CC-DD1801A1AB78}.Release|x86.Build.0 = Release|Any CPU
+		{7F32D96B-AB5D-4A72-9217-B5DCCFEFC7E5}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+		{7F32D96B-AB5D-4A72-9217-B5DCCFEFC7E5}.Debug|Any CPU.Build.0 = Debug|Any CPU
+		{7F32D96B-AB5D-4A72-9217-B5DCCFEFC7E5}.Debug|x64.ActiveCfg = Debug|Any CPU
+		{7F32D96B-AB5D-4A72-9217-B5DCCFEFC7E5}.Debug|x64.Build.0 = Debug|Any CPU
+		{7F32D96B-AB5D-4A72-9217-B5DCCFEFC7E5}.Debug|x86.ActiveCfg = Debug|Any CPU
+		{7F32D96B-AB5D-4A72-9217-B5DCCFEFC7E5}.Debug|x86.Build.0 = Debug|Any CPU
+		{7F32D96B-AB5D-4A72-9217-B5DCCFEFC7E5}.Release|Any CPU.ActiveCfg = Release|Any CPU
+		{7F32D96B-AB5D-4A72-9217-B5DCCFEFC7E5}.Release|Any CPU.Build.0 = Release|Any CPU
+		{7F32D96B-AB5D-4A72-9217-B5DCCFEFC7E5}.Release|x64.ActiveCfg = Release|Any CPU
+		{7F32D96B-AB5D-4A72-9217-B5DCCFEFC7E5}.Release|x64.Build.0 = Release|Any CPU
+		{7F32D96B-AB5D-4A72-9217-B5DCCFEFC7E5}.Release|x86.ActiveCfg = Release|Any CPU
+		{7F32D96B-AB5D-4A72-9217-B5DCCFEFC7E5}.Release|x86.Build.0 = Release|Any CPU
+		{B9A441EC-DADE-4500-B092-C635F3EB296A}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+		{B9A441EC-DADE-4500-B092-C635F3EB296A}.Debug|Any CPU.Build.0 = Debug|Any CPU
+		{B9A441EC-DADE-4500-B092-C635F3EB296A}.Debug|x64.ActiveCfg = Debug|Any CPU
+		{B9A441EC-DADE-4500-B092-C635F3EB296A}.Debug|x64.Build.0 = Debug|Any CPU
+		{B9A441EC-DADE-4500-B092-C635F3EB296A}.Debug|x86.ActiveCfg = Debug|Any CPU
+		{B9A441EC-DADE-4500-B092-C635F3EB296A}.Debug|x86.Build.0 = Debug|Any CPU
+		{B9A441EC-DADE-4500-B092-C635F3EB296A}.Release|Any CPU.ActiveCfg = Release|Any CPU
+		{B9A441EC-DADE-4500-B092-C635F3EB296A}.Release|Any CPU.Build.0 = Release|Any CPU
+		{B9A441EC-DADE-4500-B092-C635F3EB296A}.Release|x64.ActiveCfg = Release|Any CPU
+		{B9A441EC-DADE-4500-B092-C635F3EB296A}.Release|x64.Build.0 = Release|Any CPU
+		{B9A441EC-DADE-4500-B092-C635F3EB296A}.Release|x86.ActiveCfg = Release|Any CPU
+		{B9A441EC-DADE-4500-B092-C635F3EB296A}.Release|x86.Build.0 = Release|Any CPU
+		{5FA81CC7-87B2-4585-9D8E-9BBEC0AD85FB}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+		{5FA81CC7-87B2-4585-9D8E-9BBEC0AD85FB}.Debug|Any CPU.Build.0 = Debug|Any CPU
+		{5FA81CC7-87B2-4585-9D8E-9BBEC0AD85FB}.Debug|x64.ActiveCfg = Debug|Any CPU
+		{5FA81CC7-87B2-4585-9D8E-9BBEC0AD85FB}.Debug|x64.Build.0 = Debug|Any CPU
+		{5FA81CC7-87B2-4585-9D8E-9BBEC0AD85FB}.Debug|x86.ActiveCfg = Debug|Any CPU
+		{5FA81CC7-87B2-4585-9D8E-9BBEC0AD85FB}.Debug|x86.Build.0 = Debug|Any CPU
+		{5FA81CC7-87B2-4585-9D8E-9BBEC0AD85FB}.Release|Any CPU.ActiveCfg = Release|Any CPU
+		{5FA81CC7-87B2-4585-9D8E-9BBEC0AD85FB}.Release|Any CPU.Build.0 = Release|Any CPU
+		{5FA81CC7-87B2-4585-9D8E-9BBEC0AD85FB}.Release|x64.ActiveCfg = Release|Any CPU
+		{5FA81CC7-87B2-4585-9D8E-9BBEC0AD85FB}.Release|x64.Build.0 = Release|Any CPU
+		{5FA81CC7-87B2-4585-9D8E-9BBEC0AD85FB}.Release|x86.ActiveCfg = Release|Any CPU
+		{5FA81CC7-87B2-4585-9D8E-9BBEC0AD85FB}.Release|x86.Build.0 = Release|Any CPU
+		{54D543F7-8EB7-4A11-977E-22D3EE2D8C3F}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+		{54D543F7-8EB7-4A11-977E-22D3EE2D8C3F}.Debug|Any CPU.Build.0 = Debug|Any CPU
+		{54D543F7-8EB7-4A11-977E-22D3EE2D8C3F}.Debug|x64.ActiveCfg = Debug|Any CPU
+		{54D543F7-8EB7-4A11-977E-22D3EE2D8C3F}.Debug|x64.Build.0 = Debug|Any CPU
+		{54D543F7-8EB7-4A11-977E-22D3EE2D8C3F}.Debug|x86.ActiveCfg = Debug|Any CPU
+		{54D543F7-8EB7-4A11-977E-22D3EE2D8C3F}.Debug|x86.Build.0 = Debug|Any CPU
+		{54D543F7-8EB7-4A11-977E-22D3EE2D8C3F}.Release|Any CPU.ActiveCfg = Release|Any CPU
+		{54D543F7-8EB7-4A11-977E-22D3EE2D8C3F}.Release|Any CPU.Build.0 = Release|Any CPU
+		{54D543F7-8EB7-4A11-977E-22D3EE2D8C3F}.Release|x64.ActiveCfg = Release|Any CPU
+		{54D543F7-8EB7-4A11-977E-22D3EE2D8C3F}.Release|x64.Build.0 = Release|Any CPU
+		{54D543F7-8EB7-4A11-977E-22D3EE2D8C3F}.Release|x86.ActiveCfg = Release|Any CPU
+		{54D543F7-8EB7-4A11-977E-22D3EE2D8C3F}.Release|x86.Build.0 = Release|Any CPU
+		{FEF9DA88-2177-4FD0-885D-7096ACFA8A9D}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+		{FEF9DA88-2177-4FD0-885D-7096ACFA8A9D}.Debug|Any CPU.Build.0 = Debug|Any CPU
+		{FEF9DA88-2177-4FD0-885D-7096ACFA8A9D}.Debug|x64.ActiveCfg = Debug|Any CPU
+		{FEF9DA88-2177-4FD0-885D-7096ACFA8A9D}.Debug|x64.Build.0 = Debug|Any CPU
+		{FEF9DA88-2177-4FD0-885D-7096ACFA8A9D}.Debug|x86.ActiveCfg = Debug|Any CPU
+		{FEF9DA88-2177-4FD0-885D-7096ACFA8A9D}.Debug|x86.Build.0 = Debug|Any CPU
+		{FEF9DA88-2177-4FD0-885D-7096ACFA8A9D}.Release|Any CPU.ActiveCfg = Release|Any CPU
+		{FEF9DA88-2177-4FD0-885D-7096ACFA8A9D}.Release|Any CPU.Build.0 = Release|Any CPU
+		{FEF9DA88-2177-4FD0-885D-7096ACFA8A9D}.Release|x64.ActiveCfg = Release|Any CPU
+		{FEF9DA88-2177-4FD0-885D-7096ACFA8A9D}.Release|x64.Build.0 = Release|Any CPU
+		{FEF9DA88-2177-4FD0-885D-7096ACFA8A9D}.Release|x86.ActiveCfg = Release|Any CPU
+		{FEF9DA88-2177-4FD0-885D-7096ACFA8A9D}.Release|x86.Build.0 = Release|Any CPU
+		{D3138F3C-9531-4906-A5D3-74BD857D0685}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+		{D3138F3C-9531-4906-A5D3-74BD857D0685}.Debug|Any CPU.Build.0 = Debug|Any CPU
+		{D3138F3C-9531-4906-A5D3-74BD857D0685}.Debug|x64.ActiveCfg = Debug|Any CPU
+		{D3138F3C-9531-4906-A5D3-74BD857D0685}.Debug|x64.Build.0 = Debug|Any CPU
+		{D3138F3C-9531-4906-A5D3-74BD857D0685}.Debug|x86.ActiveCfg = Debug|Any CPU
+		{D3138F3C-9531-4906-A5D3-74BD857D0685}.Debug|x86.Build.0 = Debug|Any CPU
+		{D3138F3C-9531-4906-A5D3-74BD857D0685}.Release|Any CPU.ActiveCfg = Release|Any CPU
+		{D3138F3C-9531-4906-A5D3-74BD857D0685}.Release|Any CPU.Build.0 = Release|Any CPU
+		{D3138F3C-9531-4906-A5D3-74BD857D0685}.Release|x64.ActiveCfg = Release|Any CPU
+		{D3138F3C-9531-4906-A5D3-74BD857D0685}.Release|x64.Build.0 = Release|Any CPU
+		{D3138F3C-9531-4906-A5D3-74BD857D0685}.Release|x86.ActiveCfg = Release|Any CPU
+		{D3138F3C-9531-4906-A5D3-74BD857D0685}.Release|x86.Build.0 = Release|Any CPU
 	EndGlobalSection
 	GlobalSection(SolutionProperties) = preSolution
 		HideSolutionNode = FALSE
@@ -193,8 +283,6 @@ Global
 		{72AEDD42-E881-4EB7-99A8-FD3B9667189C} = {E733CBFF-42AE-4B6A-B5B9-0071ECFB45F1}
 		{9DDA917D-B4DB-4AC1-9B9A-4ECF06A5ABA1} = {E733CBFF-42AE-4B6A-B5B9-0071ECFB45F1}
 		{26EE4C38-F06E-4E7A-A89C-908318BCB0DB} = {E733CBFF-42AE-4B6A-B5B9-0071ECFB45F1}
-		{0E990C96-3808-450E-9349-A0C3262195ED} = {E733CBFF-42AE-4B6A-B5B9-0071ECFB45F1}
-		{DBE06954-EC85-4034-9049-72C7D27556DF} = {E733CBFF-42AE-4B6A-B5B9-0071ECFB45F1}
 		{67383F6C-C9C3-4C5B-95D4-5C50C20EDD4F} = {E733CBFF-42AE-4B6A-B5B9-0071ECFB45F1}
 		{8D1B01A7-BF9E-44E6-88E1-B17255728B42} = {E733CBFF-42AE-4B6A-B5B9-0071ECFB45F1}
 		{E2DC8FF6-D39E-4FCA-9549-1F7681F0AA81} = {39D316AB-ABB5-49A2-8E83-CAF4C75B48F4}
@@ -202,5 +290,14 @@ Global
 		{94C086DA-3359-424B-9688-29A198806481} = {E733CBFF-42AE-4B6A-B5B9-0071ECFB45F1}
 		{C95A9A21-34FA-4D82-BE5B-88FBDA836D31} = {39D316AB-ABB5-49A2-8E83-CAF4C75B48F4}
 		{F8A5060A-FB0B-4B8B-AE06-5147BB4CA127} = {39D316AB-ABB5-49A2-8E83-CAF4C75B48F4}
+		{B67042B8-1135-4E54-B1EB-D45342C720D7} = {E733CBFF-42AE-4B6A-B5B9-0071ECFB45F1}
+		{21F26329-2119-4037-93CC-DD1801A1AB78} = {39D316AB-ABB5-49A2-8E83-CAF4C75B48F4}
+		{7F32D96B-AB5D-4A72-9217-B5DCCFEFC7E5} = {E733CBFF-42AE-4B6A-B5B9-0071ECFB45F1}
+		{B9A441EC-DADE-4500-B092-C635F3EB296A} = {39D316AB-ABB5-49A2-8E83-CAF4C75B48F4}
+		{5FA81CC7-87B2-4585-9D8E-9BBEC0AD85FB} = {5D20AA90-6969-D8BD-9DCD-8634F4692FDA}
+		{B48EAE30-152F-01E3-6E31-82B350494D3C} = {809F86A1-1C4C-B159-0CD4-DF9D33D876CE}
+		{54D543F7-8EB7-4A11-977E-22D3EE2D8C3F} = {B48EAE30-152F-01E3-6E31-82B350494D3C}
+		{FEF9DA88-2177-4FD0-885D-7096ACFA8A9D} = {B48EAE30-152F-01E3-6E31-82B350494D3C}
+		{D3138F3C-9531-4906-A5D3-74BD857D0685} = {39D316AB-ABB5-49A2-8E83-CAF4C75B48F4}
 	EndGlobalSection
 EndGlobal
diff --git a/CultLib.txt b/CultLib.txt
deleted file mode 100644
index 4755ac07..00000000
--- a/CultLib.txt
+++ /dev/null
@@ -1,132 +0,0 @@
-
-
-// E:\Projects\CultLib\src\GameCult.Caching\GameCult.Caching.csproj
-
-<Project Sdk="Microsoft.NET.Sdk">
-  <PropertyGroup>
-    <Description>CultCache: Concurrent polymorphic cache with modular backing stores for .NET</Description>
-  </PropertyGroup>
-  
-  <ItemGroup>
-    <ProjectReference Include="..\GameCult.Logging\GameCult.Logging.csproj" />
-    <PackageReference Include="R3" Version="1.3.0" />
-    <PackageReference Include="MessagePack" Version="3.1.4" />
-    <PackageReference Include="ConcurrentHashSet " Version="1.3.0" />
-  </ItemGroup>
-</Project>
-
-// E:\Projects\CultLib\src\GameCult.Caching.MessagePack\GameCult.Caching.MessagePack.csproj
-
-<Project Sdk="Microsoft.NET.Sdk">
-  <PropertyGroup>
-    <Description>File-based MessagePack backing store for CultCache</Description>
-  </PropertyGroup>
-  
-  <ItemGroup>
-    <ProjectReference Include="..\GameCult.Caching\GameCult.Caching.csproj" />
-	<ProjectReference Include="..\GameCult.Caching.MessagePack.Generator\GameCult.Caching.MessagePack.Generator.csproj"
-                  OutputItemType="Analyzer"
-                  ReferenceOutputAssembly="false" />
-    <PackageReference Include="MessagePack" Version="3.1.4" />
-  </ItemGroup>
-</Project>
-
-// E:\Projects\CultLib\src\GameCult.Caching.MessagePack.Generator\GameCult.Caching.MessagePack.Generator.csproj
-
-<Project Sdk="Microsoft.NET.Sdk">
-
-  <PropertyGroup>
-    <!-- This tells MSBuild we are producing an analyzer -->
-    <IsRoslynComponent>true</IsRoslynComponent>
-    <Nullable>enable</Nullable>
-    <EnforceExtendedAnalyzerRules>true</EnforceExtendedAnalyzerRules>
-    <IncludeBuildOutput>false</IncludeBuildOutput>
-
-    <!-- Optional: Pack this as a NuGet analyzer -->
-    <Description>Source generator that emits MessagePack formatters for DatabaseEntry subclasses.</Description>
-    <PackageTags>MessagePack;SourceGenerator;DatabaseEntry</PackageTags>
-  </PropertyGroup>
-
-  <ItemGroup>
-    <!-- Core Roslyn packages for incremental generators -->
-    <PackageReference Include="Microsoft.CodeAnalysis.Analyzers" Version="3.3.4" PrivateAssets="all" />
-    <PackageReference Include="Microsoft.CodeAnalysis.CSharp" Version="4.10.0" PrivateAssets="all" />
-    <PackageReference Include="Microsoft.CodeAnalysis.CSharp.Workspaces" Version="4.10.0" PrivateAssets="all" />
-  </ItemGroup>
-
-  <ItemGroup>
-    <!-- Mark this output as an analyzer -->
-    <None Include="$(OutputPath)\$(AssemblyName).dll" Pack="true" PackagePath="analyzers/dotnet/cs" Visible="false" />
-  </ItemGroup>
-
-</Project>
-
-// E:\Projects\CultLib\src\GameCult.Logging\GameCult.Logging.csproj
-
-<Project Sdk="Microsoft.NET.Sdk">
-  <PropertyGroup>
-    <Description>Simple pluggable logging interface for CultLib</Description>
-  </PropertyGroup>
-</Project>
-
-// E:\Projects\CultLib\src\GameCult.Logging.Unity\GameCult.Logging.Unity.csproj
-
-<Project Sdk="Microsoft.NET.Sdk">
-  <PropertyGroup>
-    <Description>Unity integration for GameCult.Logging</Description>
-  </PropertyGroup>
-  
-  <ItemGroup>
-    <ProjectReference Include="..\GameCult.Logging\GameCult.Logging.csproj" />
-    <PackageReference Include="R3" Version="1.3.0" />
-  </ItemGroup>
-</Project>
-
-// E:\Projects\CultLib\src\GameCult.Networking\GameCult.Networking.csproj
-
-<Project Sdk="Microsoft.NET.Sdk">
-  <PropertyGroup>
-    <Description>CultNet: Secure, high-performance messaging for games/servers</Description>
-  </PropertyGroup>
-  
-  <ItemGroup>
-    <ProjectReference Include="..\GameCult.Caching.MessagePack\GameCult.Caching.MessagePack.csproj" />
-    <ProjectReference Include="..\GameCult.Logging\GameCult.Logging.csproj" />
-    <ProjectReference Include="..\GameCult.Caching\GameCult.Caching.csproj" />
-    <PackageReference Include="MessagePack" Version="3.1.4" />
-    <PackageReference Include="R3" Version="1.3.0" />
-    <PackageReference Include="LiteNetLib" Version="1.3.1" />
-    <PackageReference Include="Isopoh.Cryptography.Argon2" Version="2.0.0" />
-  </ItemGroup>
-</Project>
-
-// E:\Projects\CultLib\tests\GameCult.Networking.Tests\GameCult.Networking.Tests.csproj
-
-<Project Sdk="Microsoft.NET.Sdk">
-
-  <PropertyGroup>
-    <TargetFramework>net8.0</TargetFramework>
-    <IsPackable>false</IsPackable>
-    <RootNamespace>GameCult.Networking.Tests</RootNamespace>
-  </PropertyGroup>
-
-  <ItemGroup>
-    <ProjectReference Include="..\..\src\GameCult.Networking\GameCult.Networking.csproj" />
-  </ItemGroup>
-
-  <ItemGroup>
-    <!-- NUnit framework -->
-    <PackageReference Include="coverlet.msbuild" Version="6.0.4">
-      <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
-      <PrivateAssets>all</PrivateAssets>
-    </PackageReference>
-    <PackageReference Include="NUnit" Version="4.*" />
-    <PackageReference Include="NUnit3TestAdapter" Version="4.*" />
-    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.*" />
-    <PackageReference Include="FluentAssertions" Version="6.*" />
-    <PackageReference Include="coverlet.collector" Version="6.*">
-      <PrivateAssets>all</PrivateAssets>
-    </PackageReference>
-  </ItemGroup>
-
-</Project>
diff --git a/Directory.Build.props b/Directory.Build.props
index 519e7a93..10c8d749 100644
--- a/Directory.Build.props
+++ b/Directory.Build.props
@@ -14,7 +14,8 @@
     <PackageLicenseExpression>MIT</PackageLicenseExpression>
     <Copyright>© Meta Vens and contributors</Copyright>
     <PublishRepositoryUrl>true</PublishRepositoryUrl>
-	<Version>1.0.3</Version>
+	<Version>1.0.35</Version>
+	<Version Condition="'$(CultLibPackageVersion)' != ''">$(CultLibPackageVersion)</Version>
 
     <!-- Symbols/debugging -->
     <EmbedUntrackedSources>true</EmbedUntrackedSources>
diff --git a/README.md b/README.md
index d6e3778c..4977a02a 100644
--- a/README.md
+++ b/README.md
@@ -11,8 +11,9 @@ The stack is less a single product than a set of capabilities:
 
 - logging primitives and implementations
 - CultCache typed documents, `.cc` persistence, and SoA memory access
-- CultNet schema-v0 messages over TCP, WebSocket, LiteNetLib adapters, and
-  CultLib's native cross-runtime RUDP pipe
+- CultNet schema-v0 messages over TCP and LiteNetLib adapters, a bounded
+  ASP.NET Core WebSocket host adapter, and CultLib's native cross-runtime RUDP
+  pipe
 - CultMesh distributed realtime database, Verse discovery, authority leases,
   shard replication, and witness-authoritative simulation consensus
 - typed geometry domain/chunk documents for distributed CSG and LOD streaming
@@ -37,8 +38,9 @@ and pretending the label makes it furniture.
 | Job | Start With | Owns | Use When | Do Not Use It For |
 | --- | --- | --- | --- | --- |
 | Local typed state | `GameCult.Caching` / CultCache | Document identity, schema compatibility, record keys, indexes, globals, and local persistence | You need a typed cache, file-compatible save data, local reactive reads, or a stable domain document model | Peer discovery, transport security, shard routing, or mesh consensus |
-| Procedural geometry state | `GameCult.Geometry` | CultCache-native domain trees, LOD build requests, selected-cut diagnostics, and chunk artifact payloads | Rust, Unity, or remote workers need to share CSG/LOD geometry and graph metadata as typed state | Transport policy, peer discovery, or gameplay authority |
-| Network transport and database plumbing | `GameCult.Networking` / CultNet | Native RUDP sessions, LiteNetLib/TCP/WebSocket adapters, authentication, schema-v0 wire contracts, shard authority, raw document replication, snapshots, and subscriptions | You need a client/server pipe, login/session flow, schema discovery, reliable UDP, or a low-level distributed CultCache lane | Gameplay-facing mesh ergonomics, Verse policy, mod branches, or simulation consensus composition |
+| Portable math | `GameCult.Math` / CultMath | Shader-shaped numeric primitives, deterministic random, noise, and CPU/GPU parity helpers | Shared simulation and geometry code must not depend on an engine's math or RNG types | Domain-specific geometry, rendering, or world authority |
+| Procedural geometry | `GameCult.Geometry` / CultGeometry | Isosurface extraction plus CultCache-native domains, LOD requests, selected cuts, and mesh artifacts | C#, Rust, Godot, or remote workers need shared geometry algorithms and typed results | Transport policy, peer discovery, or gameplay authority |
+| Network transport and database plumbing | `GameCult.Networking` / CultNet | Native RUDP sessions, LiteNetLib/TCP adapters, an authenticated WebSocket host adapter, schema-v0 wire contracts, shard authority, raw document replication, snapshots, and subscriptions | You need a client/server pipe, login/session flow, schema discovery, reliable UDP, or a low-level distributed CultCache lane | Gameplay-facing mesh ergonomics, Verse policy, mod branches, or simulation consensus composition |
 | Distributed realtime gameplay state | `GameCult.Mesh` / CultMesh | Public mesh entrypoints, Verse discovery, peer exchange, shard replication defaults, authority leases, client prediction, and witness consensus | You want the game to treat clients and servers as one reactive database for persistent state, input state, and simulation facts | A tiny local-only tool, a bare transport client, or a storage format contract |
 | Realtime media/frame streams | `GameCult.Mesh` / CultMesh streaming mode | Stream identity, authority, clock metadata, body transport negotiation, frame cursors, and backpressure state | Audio/video/tensor frames need to move between runtimes through shared memory, GPU handles, platform buffers, or CultCache page refs | Durable document mutation, mesh consensus facts, or pretending inline bytes are zero-copy |
 | Daemon-published UI | Eve / CultUI | Typed operator and user-facing surfaces over CultMesh state | A daemon should expose controls, inspection, or workflow UI that can lower into GUI, TUI, web, native, overlay, or agent clients | One-off vendor dashboards, untyped debug panels, or runtime-local UI that cannot travel with the daemon |
@@ -46,8 +48,10 @@ and pretending the label makes it furniture.
 Quick rule:
 
 - Choose CultCache when the problem is "how do I model and persist typed state?"
-- Choose GameCult.Geometry when the problem is "how do geometry workers share
-  domain trees, LOD build requests, and mesh chunks as typed state?"
+- Choose GameCult.Math when the problem is "which portable numeric and random
+  semantics do these runtimes share?"
+- Choose GameCult.Geometry when the problem is "how do geometry workers build
+  and share engine-neutral geometry?"
 - Choose CultNet when the problem is "how do peers exchange authenticated,
   schema-aware database messages?"
 - Choose CultMesh when the problem is "how does a game join a Verse and share
@@ -62,8 +66,25 @@ the stack. If a design needs another peer-to-peer category, first check whether
 it is really Verse policy, peer exchange, or shard authority wearing a fake
 mustache.
 
-If you want the smallest durable "open node -> put typed doc -> get typed doc"
-path, start with
+If you want to build an application rather than tour the component drawer,
+start with the maintained
+[`CultMesh And Eve Getting Started`](src/GameCult.Mesh/docs/getting-started/README.md)
+series. Its first executable package-consumer checkpoint is
+[`samples/eve-two-runtime`](samples/eve-two-runtime/README.md).
+The real-process browser continuation is
+[`samples/eve-browser-network`](samples/eve-browser-network/README.md).
+One documented command runs both layers:
+
+```powershell
+pwsh -File ./scripts/verify-eve-getting-started.ps1
+```
+
+The implemented browser client boundary and remaining deployed-infrastructure
+gates are mapped explicitly in
+[`browser-verse-transport.md`](src/GameCult.Mesh/docs/browser-verse-transport.md).
+
+If you want only the smallest durable "open node -> put typed doc -> get typed doc"
+path, use
 [`src/GameCult.Mesh/docs/durable-node-quickstart.md`](src/GameCult.Mesh/docs/durable-node-quickstart.md).
 If you want the lower-level "typed local document -> raw wire document ->
 mesh/runtime watch surface" handoff, follow it with
@@ -77,10 +98,10 @@ The solution includes:
 - `GameCult.Caching`: `DatabaseEntry`-based cache, indexes, global entries, and backing-store abstractions
 - `GameCult.Caching.MessagePack`: MessagePack-backed persistence for the cache
 - `GameCult.Caching.NewtonsoftJson`: Newtonsoft.Json-backed persistence for the cache
-- `GameCult.Caching.MessagePack.Generator`: source generator for MessagePack formatters for cache models
-- `GameCult.Caching.MessagePack.Analyzers`: packaging project that delivers the generator to consuming projects
-- `GameCult.Geometry`: CultCache-native geometry domain, selected-cut, and chunk artifact documents for VibeGeometry/Fensalir-style pipelines
+- `GameCult.Math` / CultMath: portable numeric primitives, deterministic random, noise, and shader-parity helpers
+- `GameCult.Geometry` / CultGeometry: engine-neutral geometry algorithms plus CultCache-native domain, selected-cut, and mesh artifact documents
 - `GameCult.Networking`: encrypted login/register/verify flows, schema-v0 contracts, transport adapters, and native RUDP sessions
+- `GameCult.Networking.WebSockets`: bounded ASP.NET Core binary WebSocket host adapter for browser CultMesh clients
 - `GameCult.Mesh`: CultMesh package home for distributed realtime database, shard replication, client prediction, Verse discovery, and mesh witness consensus
 - `GameCult.Caching.Tests`: NUnit tests for cache and backing-store behavior
 - `GameCult.Networking.Tests`: NUnit tests for networking behavior
@@ -88,7 +109,10 @@ The solution includes:
 - `packages/cultcache-ts`: TypeScript CultCache with MessagePack persistence and inspector tooling
 - `packages/cultnet-ts`: TypeScript CultNet schema-v0 contracts, framing, discovery, raw document replication, and interop tests
 - `packages/cultmesh-ts`: TypeScript CultMesh local node and mesh catalog surface for local runtimes such as VoidBot
-- `packages/cultcache-py`: Python CultCache/CultNet/CultMesh package with CultCache v1 wire parity
+- `packages/cultmesh-browser`: browser-safe, read-only CultMesh document leases and typed operations over an Odin-resolved WebSocket route
+- `packages/cultcache-py`: Python CultCache with CultCache v1 wire parity
+- `packages/cultnet-py`: Python CultNet contracts, framing, RUDP transport, replication, and interop peer
+- `packages/cultmesh-py`: Python CultMesh local node, discovery, sessions, local server, and daemon
 - `packages/cultcache-rs`: Rust CultCache and derive macro
 - `packages/cultnet-rs`: Rust CultNet contracts, framing, discovery, and interop peer
 - `packages/cultmesh-kotlin`: Kotlin/JVM CultMesh and CultNet surface for Android-adjacent runtimes
@@ -102,10 +126,9 @@ src/
   GameCult.Caching/
   GameCult.Caching.MessagePack/
   GameCult.Caching.NewtonsoftJson/
-  GameCult.Caching.MessagePack.Generator/
-  GameCult.Caching.MessagePack.Analyzers/
   GameCult.Geometry/
   GameCult.Networking/
+  GameCult.Networking.WebSockets/
   GameCult.Mesh/
   GameCult.Unity/
 tests/
@@ -113,11 +136,15 @@ tests/
   GameCult.Geometry.Tests/
   GameCult.Networking.Tests/
 packages/
+  cultmath/
   cultcache-ts/
   cultnet-ts/
   cultmesh-ts/
+  cultmesh-browser/
   cultmesh-kotlin/
   cultcache-py/
+  cultnet-py/
+  cultmesh-py/
   cultcache-rs/
   cultnet-rs/
 ```
@@ -141,8 +168,22 @@ npm test --workspace packages/cultcache-ts
 npm test --workspace packages/cultnet-ts
 npm run test:interop --workspace packages/cultnet-ts
 npm test --workspace packages/cultmesh-ts
+npm test --workspace packages/cultmesh-browser
 ```
 
+Measured reactive, retained-session, and shared-memory hot-body gates:
+
+```powershell
+pwsh -File ./scripts/measure-reactive-document-performance.ps1 -Quick
+pwsh -File ./scripts/verify-eve-getting-started.ps1
+```
+
+The first command measures the same 16 KiB document workload in C#,
+TypeScript, and Python and includes a mapped hot-body probe with explicit copy
+telemetry on Windows named maps and Unix file-backed maps. The second includes
+10,000 real WebSocket operations on one retained
+identity-owned C# session after provider route replacement.
+
 Rust package tests:
 
 ```powershell
@@ -192,41 +233,23 @@ public class ItemData : DatabaseEntry, INamedEntry
 - backing stores are persistence adapters
 - indexes and name maps are maintained inside the cache, not inside the store
 
-### Important: Multiple Backing Stores
+### Multiple Backing Stores
 
-When multiple backing stores are added, behavior depends on how they are registered.
-
-If a store is added with domain types:
+Every document type has exactly one home store. There are no mirrors.
 
 ```csharp
-cache.AddBackingStore(playerStore, typeof(PlayerData));
-cache.AddBackingStore(settingsStore, typeof(AppSettings));
+cache.AddBackingStore(catalogStore, typeof(ItemData), typeof(Faction));
+cache.AddBackingStore(runStore, typeof(SavedGame));
 ```
 
-then that store becomes the direct persistence target for those types.
+- the home is chosen by the document's runtime type: the most derived routed type wins, otherwise the untyped store
+- at most one untyped store; a type claimed by two stores is an error
+- a write with no home is an error once any store is attached
+- attaching a store reads it; attach routed stores first and the untyped store (if any) last, because a record's home cannot move after it is loaded
+- loading never writes: opening and flushing without a mutation leaves every file byte-identical
+- a read-only store refuses writes and is skipped by flush
 
-If a store is added without domain types:
-
-```csharp
-cache.AddBackingStore(primaryStore);
-cache.AddBackingStore(mirrorStore);
-```
-
-then the first generic store acts as the primary writable store for non-domain-specific entries. Additional generic stores subscribe to the existing stores and mirror their change events.
-
-Implications:
-
-- order matters for generic stores
-- `AddAsync` writes to the type-specific store when one exists
-- otherwise `AddAsync` writes to the first generic store
-- later generic stores do not become co-primaries; they mirror earlier stores
-- `PullAllBackingStoresAsync` pulls from every registered store
-
-Recommended patterns:
-
-- use one generic primary store if you want simple persistence
-- use domain-specific stores when different entry types belong in different persistence layers
-- treat additional generic stores as mirrors or downstream replicas, not independent write targets
+The contract is `src/GameCult.Caching/Contracts/cultcache-store-composition.md`. Until the C# cache implements it, `AddBackingStore` takes no home types and every attached store receives every record; attach one store per cache.
 
 ## Example: Cache + Networking
 
@@ -322,8 +345,6 @@ Each subproject has a local README with package-specific detail:
 - [GameCult.Caching](src/GameCult.Caching/README.md)
 - [GameCult.Caching.MessagePack](src/GameCult.Caching.MessagePack/README.md)
 - [GameCult.Caching.NewtonsoftJson](src/GameCult.Caching.NewtonsoftJson/README.md)
-- [GameCult.Caching.MessagePack.Generator](src/GameCult.Caching.MessagePack.Generator/README.md)
-- [GameCult.Caching.MessagePack.Analyzers](src/GameCult.Caching.MessagePack.Analyzers/README.md)
 - [GameCult.Geometry](src/GameCult.Geometry/README.md)
 - [GameCult.Networking](src/GameCult.Networking/README.md)
 - [GameCult.Mesh](src/GameCult.Mesh/README.md)
diff --git a/docs/cultmesh-provider-session.md b/docs/cultmesh-provider-session.md
new file mode 100644
index 00000000..3e45c799
--- /dev/null
+++ b/docs/cultmesh-provider-session.md
@@ -0,0 +1,61 @@
+# CultMesh Provider Session
+
+## Authority map
+
+- Owner: the provider-session broker owns registration, active lease fencing,
+  accepted publication membership, command retention, receipt acceptance, and
+  withdrawal.
+- Inputs: a physical CultNet session, an explicit registration-authorization
+  decision, correlated typed operations, the broker clock, provider commands,
+  and persistence callbacks. The current RUDP adapter does not itself provide
+  an authenticated claim.
+- Outputs: leases, application acceptances, accepted raw documents, pushed
+  typed commands, persisted receipts, and deterministic removals.
+- Derived state: socket sessions, retry schedules, connection health, and
+  provider projections are observations. They do not authorize publications.
+- Forbidden writers: RUDP packet acknowledgements, source addresses, direct raw
+  document callbacks, renderer-owned catalogs, and arrival-time freshness maps
+  cannot create accepted provider truth.
+- Shared paths: initial connect and reconnect use `provider.register`; initial,
+  replayed, and live documents use `provider.publication.put`; explicit
+  withdrawal and lease expiry remove the broker-owned publication set; command
+  retry ends only when `provider.receipt.put` is accepted.
+- Cut line: a receiver must stop accepting unleased provider raw puts before it
+  claims this protocol as its ingress authority.
+
+## Wire contract
+
+Provider lifecycle operations use the reliable ordered CultNet schema channel
+and the existing `cultnet.operation_request.v0` / `cultnet.operation_response.v0`
+envelopes with service id `gamecult.mesh.provider_session`. Inner payloads are
+camel-case MessagePack maps encoded as `messagepack-base64`.
+
+The v1 operations are:
+
+| Operation | Request payload | Successful payload |
+| --- | --- | --- |
+| `provider.register` | `gamecult.mesh.provider_registration.v1` | `gamecult.mesh.provider_lease.v1` |
+| `provider.renew` | `gamecult.mesh.provider_lease_renewal.v1` | `gamecult.mesh.provider_lease.v1` |
+| `provider.publication.put` | `gamecult.mesh.provider_publication_put.v1` | `gamecult.mesh.provider_mutation_acceptance.v1` |
+| `provider.publication.delete` | `gamecult.mesh.provider_publication_delete.v1` | `gamecult.mesh.provider_mutation_acceptance.v1` |
+| `provider.receipt.put` | `gamecult.mesh.provider_receipt_put.v1` | `gamecult.mesh.provider_mutation_acceptance.v1` |
+| `provider.withdraw` | `gamecult.mesh.provider_withdrawal.v1` | `gamecult.mesh.provider_mutation_acceptance.v1` |
+
+Broker-to-provider commands are raw typed documents using
+`gamecult.mesh.provider_command.v1`. Asset bodies do not travel inside these
+operation payloads.
+
+Responses use `ok`, `conflict`, `expired`, `denied`, or `invalid`. A transport
+ACK is never an application acceptance. Renewal issues a new lease id and
+immediately fences the previous id. The broker derives the set removed by full
+withdrawal; a provider cannot use a supplied list to hide owned publications.
+
+Public deployment additionally requires a CultNet authentication claim that
+authorizes the provider identity. Until that claim is wired and checked, the
+TypeScript RUDP adapter is a private-development transport.
+
+`CultMeshProviderSessionBroker` is an in-memory reference broker and socket
+proof. Its command and receipt retention does not survive process restart.
+Production receivers must persist that control-plane state atomically with
+accepted publication ownership; Odin must not substitute these volatile maps
+for its durable broker authority.
diff --git a/docs/cultnet-transport-parity.md b/docs/cultnet-transport-parity.md
index 5f0fec91..d0779196 100644
--- a/docs/cultnet-transport-parity.md
+++ b/docs/cultnet-transport-parity.md
@@ -31,7 +31,7 @@ CultNet owns cross-runtime transport semantics:
 | C# interop peer | Schema-v0 MessagePack over TCP-framed or shared RUDP transport | UDP multicast probe/announce with TCP and RUDP transport profiles | Test harness transport parity |
 | TypeScript `cultnet-ts` | `CultNetPeer` over any Node `Duplex`, TCP-framed transport, or single-peer RUDP socket transport; interop uses TCP | UDP multicast probe/announce in the interop peer | First UDP socket binding for the shared RUDP reliability owner |
 | Rust `cultnet-rs` | Interop example serves and dials schema-v0 MessagePack over TCP-framed or shared RUDP transport; single-peer RUDP socket transport exists in the library | UDP multicast probe/announce with TCP and RUDP transport profiles | UDP socket binding for the shared RUDP reliability owner |
-| Python `cultcache-py` | TCP sockets with 4-byte length-prefixed MessagePack frames for local CultMesh/CultNet server and client; single-peer RUDP socket transport exists in the library | Endpoint lists and CultMesh peer/Verse catalogs | UDP socket binding for the shared RUDP reliability owner |
+| Python `cultnet-py` | TCP sockets with 4-byte length-prefixed MessagePack frames for local CultMesh/CultNet server and client; single-peer RUDP socket transport exists in the library | Endpoint lists and CultMesh peer/Verse catalogs | UDP socket binding for the shared RUDP reliability owner |
 | Kotlin `cultmesh-kotlin` | Channel-aware WebSocket transport connection for reliable ordered `schema` frames; single-peer RUDP socket transport exists in the library; interop CLI serves and dials schema-v0 MessagePack over TCP-framed or shared RUDP transport | CultMesh Verse and peer catalogs, plus endpoint lists carried in schema-v0 catalog messages | WebSocket/TCP adapters plus UDP socket binding for the shared RUDP reliability owner, with build-script and TypeScript harness proof |
 
 The live split is therefore: payload language and the native RUDP packet/session
@@ -258,11 +258,19 @@ Current progress:
   echo against C#/Kotlin/Python/Rust UDP peers; local runtime tests prove timeout
   state transitions.
 - TypeScript, C#, Rust, Python, and Kotlin now share bounded reliable-send
-  backpressure for RUDP sessions. `maxPendingReliablePackets` is advertised on
-  RUDP transport-profile channels and enforced by the session before reliable
-  connect, accept, single-packet sends, or fragmented sends enqueue anything;
-  TCP-framed profiles do not publish the field because they do not own the RUDP
-  pending-reliable queue.
+  backpressure for RUDP sessions. At most 32 reliable packets are admitted to
+  the wire at once; later fragments remain in a session-owned FIFO and
+  acknowledgements promote the next packets. Receivers emit a cumulative ACK
+  for packets inside the 32-sequence ACK horizon and an exact ACK for an older
+  retransmit, so unrelated unreliable traffic cannot strand reliable work.
+  This keeps the send frontier well
+  inside the 4,096-sequence receive history instead of blasting an entire large
+  document and hoping the UDP buffers impersonate flow control.
+  `maxPendingReliablePackets` bounds both queued and in-flight packets before a
+  reliable frame is accepted. Socket transports expose an explicit reliable
+  flush where the runtime supports one, so callers that require confirmed
+  transport delivery do not substitute a fixed sleep. TCP-framed profiles do
+  not publish the field because they do not own the RUDP pending-reliable queue.
 - TypeScript, C#, Rust, Python, and Kotlin now share a portable
   `cultnet.reconnect_policy.v0` document and deterministic exponential delay
   helper, and RUDP transport profiles advertise that policy under
diff --git a/docs/nuget-packaging.md b/docs/nuget-packaging.md
new file mode 100644
index 00000000..afc94570
--- /dev/null
+++ b/docs/nuget-packaging.md
@@ -0,0 +1,23 @@
+# NuGet Packaging
+
+CultLib publishes the managed dependency graph as separate packages. The leaf
+package is `GameCult.Mesh`; its NuGet dependencies preserve the CultMesh,
+CultNet, and CultCache ownership boundaries.
+
+```powershell
+powershell -ExecutionPolicy Bypass -File .\scripts\pack-nuget.ps1
+```
+
+The command creates a local feed under `artifacts/nuget`, verifies that every
+internal dependency package exists at the same version, then restores and runs
+a clean .NET consumer using only `PackageReference Include="GameCult.Mesh"`.
+
+The Unity distribution remains `org.gamecult.cultlib`, built by
+`scripts/build-unity-package.ps1`, because Unity consumes the managed assembly
+closure through UPM rather than NuGet restore.
+
+Install the Unity package from the immutable release tag:
+
+```text
+https://github.com/GameCult/CultLib.git?path=/unity/org.gamecult.cultlib#cultlib-unity-v1.0.46
+```
diff --git a/docs/parked-features.md b/docs/parked-features.md
new file mode 100644
index 00000000..aa65294b
--- /dev/null
+++ b/docs/parked-features.md
@@ -0,0 +1,32 @@
+# Parked Features
+
+A parked feature was built for a stated reason, has no consumer, and was
+removed from the tree. Its last working form lives at an annotated tag so it
+can be restored instead of reinvented.
+
+## CultCache SoA table
+
+- Tag: `parked/cultcache-soa`
+- Intent: ECS-style structure-of-arrays columns over cached documents, for
+  hot-loop performance without giving up POCO document ergonomics.
+- Span at the tag: `src/GameCult.Caching/CultManagedDocument.cs:133-414`
+  (`CultSoaTable<T>`, `CultSoaColumn<T>`, `CultCacheSoaStore`,
+  `CultCacheSoaTypeTable`, `CultCacheSoaMember`); `CultCache.Soa<T>()` and the
+  `_soa` field with its upsert/remove hooks in `CultCache.cs`; the SoA tests in
+  `tests/GameCult.Caching.Tests/BackingStoreTests.cs` and
+  `tests/GameCult.Mesh.Tests/CultMeshStreamingTests.cs`.
+- Managed document: `CultManagedDocument<T>` (`CultManagedDocument.cs:72-131` at
+  the tag) with `CultCache.Document<T>` and `CultNetDatabase.Document<T>`, the
+  reactive POCO handle added with the SoA storage in 5428870 "Make SoA
+  cache-managed document storage". Same tag, same intent: the document stays a
+  POCO while the cache owns its columnar storage.
+- Tag message correction: the `parked/cultcache-soa` tag message says
+  `CultManagedDocument<T>` was "deleted separately, not parked". This note
+  supersedes it: `CultManagedDocument<T>` is parked under the same tag and is
+  restored alongside SoA. The tag itself is left as written.
+- Consumers when parked: none outside tests.
+- Restore: `git show parked/cultcache-soa:src/GameCult.Caching/CultManagedDocument.cs`,
+  take the SoA types and `CultManagedDocument<T>`, restore both `Document<T>`
+  openers from `CultCache.cs` and `CultNetDatabase.cs` at the tag, and re-hook a
+  `CultCacheSoaStore` into the cache's single
+  admission and eviction paths (`Admit`/`Evict`).
diff --git a/docs/persisted-record-encoding.md b/docs/persisted-record-encoding.md
new file mode 100644
index 00000000..b8e13f8a
--- /dev/null
+++ b/docs/persisted-record-encoding.md
@@ -0,0 +1,68 @@
+# The encoding of a persisted CultCache record is part of its contract
+
+Changing how a stored record serializes is never a flag flip in this estate.
+Consumers verify canonicality by **re-encoding what they decoded and comparing
+bytes**, so a record that reads back correctly but re-encodes differently is
+refused — and the refusal happens on live data, at startup or on the next read.
+
+Three guards, three separate stores, one idiom:
+
+| store | guard | refusal |
+|---|---|---|
+| Idunn runtime projection | `Idunn/src/drivers.rs:3611` | `service trust-anchor projection is noncanonical` |
+| Idunn deployment brake | `Idunn/src/control_plane.rs` (`read_deployment_brake`) | `deployment brake is noncanonical or keyed by another authority` |
+| Idunn trust bindings | `Idunn/src/provisioning.rs:546`, `:630` | `trust store contains a noncanonical or mismatched binding` |
+
+Idunn's control store applies the same rule to its own transactions. Assume the
+guard exists and go looking for it before changing any persisted record's
+serialization; three independent instances is a house pattern, not a
+coincidence.
+
+## What this means for `#[cultcache(key = N, bytes)]`
+
+The attribute switches a `Vec<u8>` slot from a MessagePack array-of-integers
+(serde's default) to a real `bin`. Measured, not assumed
+(`packages/cultnet-rs/tests/byte_slot_migration.rs`):
+
+- **Reading stays compatible in both directions.** `serde_bytes::ByteBuf`
+  accepts an array marker, and a plain `Vec<u8>` accepts `bin`. No dual-read
+  path is needed, and reverting a binary is survivable.
+- **Reproduction does not.** A record written before the flip can be read but
+  can never re-encode to the bytes it was stored as, and its `canonical_sha256`
+  moves with it.
+
+So the cost lands entirely on the guards above, not on readability. A field with
+persisted records must flip the attribute **and** rewrite its store in the same
+change, one target at a time, and never during a deployment — the projection
+store is what the observer reads, and refusing it takes the observer down.
+
+A field with no live producer is free. Check for one before assuming a
+migration: `IdunnAuthenticatedProviderHealthProjectionRecord` is constructed
+only inside a test module, so its byte field costs nothing to convert.
+
+Size, for whether it is worth doing at all: 406 bytes as an array against 278 as
+`bin` for a 256-byte payload, and 1234 against 851 for an 848-byte one. About
+1.45x on every byte, which matters on a media path and is noise on a control
+record.
+
+## `Option<Vec<u8>>` cannot take the attribute yet
+
+The derive emits `serde_bytes::Bytes::new(&self.field)`, which needs `&[u8]`,
+and builds the field via `.into_vec()`, which yields `Vec<u8>`. Both are type
+errors against an `Option<Vec<u8>>`, so the derive fails loudly rather than
+collapsing "absent slot" into "unsigned". `IdunnDeploymentBrakeRecord.signature`
+needs an `Option`-aware path in `cultcache-rs-derive` before it can move.
+
+## Fields validated for shape and produced by nothing
+
+`trust_binding_sha256` is declared on two records with different schemas
+(`idunn.authenticated_provider_health_projection.v1` in cultnet-rs,
+`idunn.authenticated_daemon_health_admission.v1` in odin-core), shape-validated
+in both, and computed by nothing in CultLib, Idunn or Odin.
+
+Do not assume that means "omission". It may be a fossil — a contract whose
+producer was deleted. The estate has form: Muninn's receiver runs a Reed-Solomon
+audio FEC path against parity shards the Rust sender has never emitted, while an
+acceptance ledger describes that FEC as having worked. Settling which requires
+reading history, not source, and the answer changes whether the right move is to
+implement the field or delete it.
diff --git a/packages/cultcache-py/PARITY.md b/docs/python-runtime-parity.md
similarity index 96%
rename from packages/cultcache-py/PARITY.md
rename to docs/python-runtime-parity.md
index 18607d87..1cc222b7 100644
--- a/packages/cultcache-py/PARITY.md
+++ b/docs/python-runtime-parity.md
@@ -1,7 +1,7 @@
 # Python Runtime Parity Map
 
-This file is the current audit map for `cultcache-py` as a Python runtime for
-CultCache, CultNet, and CultMesh. It is evidence, not confetti.
+This file is the current audit map for the Python runtime packages
+`cultcache-py`, `cultnet-py`, and `cultmesh-py`. It is evidence, not confetti.
 
 ## Proven Surfaces
 
@@ -255,14 +255,14 @@ CultCache, CultNet, and CultMesh. It is evidence, not confetti.
   individual discovery, peer exchange, or simulation surfaces unserved without
   advertising disabled capabilities.
 - Python package health:
-  `cultcache-py-verify --json` checks the public CultCache/CultNet/CultMesh
+  `cultmesh-py-verify --json` checks the public CultCache/CultNet/CultMesh
   export surface declared by each package `__all__`, `py.typed` markers, a live
   local CultMesh framed-wire smoke over hello/schema/snapshot/shard
   catalog/shard log, typed peer-error export availability, peer-advertised
   mutation contracts, payload schema wire contracts, simulation capability
   truth, and benchmark sanity for Python-owned hot paths.
 - Python/C# public cache baseline:
-  `cultcache_py.compare_csharp` runs Python and C# `CultCache` upsert/get
+  `cultnet_py.compare_csharp` runs Python and C# `CultCache` upsert/get
   benchmarks with the same operation names and reports median Python-to-C# ratios
   from three samples by default. It also emits per-metric threshold checks and an
   overall parity status so performance claims have an explicit evidence gate.
@@ -275,12 +275,14 @@ CultCache, CultNet, and CultMesh. It is evidence, not confetti.
 ## Local Python Gates
 
 ```powershell
-$env:PYTHONPATH="$PWD\packages\cultcache-py\src"
+$env:PYTHONPATH="$PWD\packages\cultcache-py\src;$PWD\packages\cultnet-py\src;$PWD\packages\cultmesh-py\src"
 python -m unittest discover -s packages\cultcache-py\tests
-python -m cultcache_py.verify --json
-python -m cultcache_py.benchmark --records 1000 --json
-python -m cultcache_py.compare_csharp --records 1000 --samples 3 --json
-python -m pip wheel --no-deps -w $env:TEMP packages\cultcache-py
+python -m unittest discover -s packages\cultnet-py\tests
+python -m unittest discover -s packages\cultmesh-py\tests
+python -m cultmesh_py.verify --json
+python -m cultnet_py.benchmark --records 1000 --json
+python -m cultnet_py.compare_csharp --records 1000 --samples 3 --json
+python -m pip wheel --no-deps -w $env:TEMP packages\cultcache-py packages\cultnet-py packages\cultmesh-py
 ```
 
 ## Cross-Runtime Gate
diff --git a/docs/runtime-parity-scope.md b/docs/runtime-parity-scope.md
index dc8f5fe9..44715c7c 100644
--- a/docs/runtime-parity-scope.md
+++ b/docs/runtime-parity-scope.md
@@ -21,20 +21,23 @@ Cross-runtime parity has three layers:
   transport helpers instead of assembling raw maps and channel strings.
 
 SoA performance parity is deliberately not a cross-runtime requirement. C#
-owns the CPU-local SoA table and shared-memory streaming body path. Other
-runtimes may add native hot paths when their runtime role earns them, but they
-do not need to mimic Unity/C# memory layout to speak CultNet or participate in
-CultMesh.
+owns the shared-memory streaming body path. The C# CultCache SoA table (ECS-style
+structure-of-arrays columns over cached documents) is parked at the tag
+`parked/cultcache-soa`: it was built for hot-loop performance, had no consumer
+outside tests, and is restorable from that tag (`docs/parked-features.md`).
+It is not a supported surface in the current tree. Other runtimes may add native hot paths when their
+runtime role earns them, but they do not need to mimic Unity/C# memory layout
+to speak CultNet or participate in CultMesh.
 
 ## Current Targeted Runtimes
 
 | Runtime | Role | Claimed parity | Not claimed |
 | --- | --- | --- | --- |
-| C# | Reference implementation and production game/server substrate | CultCache typed documents and SoA, CultNet schema-v0, LiteNetLib production path with adapter profile, shared transport profiles, shared RUDP socket transport, C# multi-peer RUDP listener and schema service host, C# interop RUDP serve/dial path, connected RUDP CultMesh client helpers, RUDP-backed schema-client selection for `rudp://` service endpoints, RUDP reconnect policy/controller and reconnect-loop helper, LiteNetLib client reconnect-controller adoption, schema-client transport port for service request/response clients, CultMesh node/session/catalog/stream/simulation/RUDP surfaces, authorized peer lookup | No need to abandon LiteNetLib before the CultNet adapter fully owns production service adoption |
+| C# | Reference implementation and production game/server substrate | CultCache typed documents, CultNet schema-v0, LiteNetLib production path with adapter profile, shared transport profiles, shared RUDP socket transport, C# multi-peer RUDP listener and schema service host, C# interop RUDP serve/dial path, connected RUDP CultMesh client helpers, RUDP-backed schema-client selection for `rudp://` service endpoints, RUDP reconnect policy/controller and reconnect-loop helper, LiteNetLib client reconnect-controller adoption, schema-client transport port for service request/response clients, CultMesh node/session/catalog/stream/simulation/RUDP surfaces, authorized peer lookup | No need to abandon LiteNetLib before the CultNet adapter fully owns production service adoption |
 | Python | Package runtime, local daemon endpoint, raw interop peer, typed state participant | CultCache/CultNet/CultMesh package surface, branded CultMesh node/schema/shard/Verse/peer/authority/stream/RUDP ergonomics, authorized peer lookup, shard catalogs/logs, schema-transport factory for raw client request/subscription flows, local TCP and RUDP CultMesh server listeners, Python interop RUDP serve/dial path, session/prediction/simulation fact helpers, RUDP codec/session/socket transport, RUDP reconnect policy/controller and reconnect-loop helper, schema-v0 MessagePack over RUDP evidence, benchmark evidence against C# cache paths | Universal C# throughput, full C# daemon/server stack, and RUDP as the only public service pipe |
 | TypeScript | Node/browser-adjacent projection and interop runtime | CultCache parity tests, CultNet schema-v0 peer, advertised schema/shard catalog wire contracts plus request/sync helpers, transport profiles, TCP-framed transport port and peer helper, shared RUDP socket transport, RUDP interop serve/dial path, RUDP reconnect policy/controller, RUDP reconnect-loop helper, branded CultMesh node/schema/shard/Verse/peer/authority/stream/RUDP ergonomics, authorized peer lookup | Full C# game session/server stack |
-| Rust | Low-level cache/transport/runtime substrate | CultCache/CultNet interop lane, schema and shard catalog helpers, transport profiles, TCP-framed port, shared RUDP codec/session/socket transport, Rust interop RUDP serve/dial path, connected RUDP CultMesh client helpers, RUDP reconnect policy/controller and reconnect-loop helper, schema-v0 MessagePack over RUDP evidence, small CultMesh facade for schema registry, shard catalog, peer cards, authority leases, authorized peer lookup, RUDP endpoint parsing, and peer-card/authorized-peer RUDP client construction | Full CultMesh game-session/server facade, stream catalog, or production game-session server |
-| Kotlin | JVM/Android client substrate | Typed MessagePack cache, built-in schema catalog advertisement, schema/shard catalogs with shared schema-message transport fetch/sync helpers, authority leases, authorized peer lookup, stream catalog, branded `CultMesh` facade, WebSocket transport profile/connection helper, RUDP client/server sugar, connected RUDP CultMesh client helpers, Kotlin interop RUDP serve/dial path, RUDP reconnect policy/controller and reconnect-loop helper, schema-v0 MessagePack over RUDP evidence | C# SoA store, full C# server daemon, or Unity hot-loop memory layout |
+| Rust | Low-level cache/transport/runtime substrate | CultCache/CultNet interop lane, schema and shard catalog helpers, typed same-schema alias hydration from raw snapshots, transport profiles, TCP-framed port, shared RUDP codec/session/socket transport, Rust interop RUDP serve/dial path, connected RUDP CultMesh client helpers, RUDP reconnect policy/controller and reconnect-loop helper, schema-v0 MessagePack over RUDP evidence, small CultMesh facade for schema registry, shard catalog, peer cards, authority leases, authorized peer lookup, RUDP endpoint parsing, and peer-card/authorized-peer RUDP client construction | Full CultMesh game-session/server facade or production game-session server. `packages/cultmesh-rs` now holds a Rust stream and session surface -- node, document sets, RUDP document publication, stream descriptors, negotiation, stream catalog, and shared-memory frame rings -- but no interop lane exercises it, so it carries no cross-runtime parity claim |
+| Kotlin | JVM/Android client substrate | Typed MessagePack cache, one-call typed snapshot document sync through local same-schema aliases, built-in schema catalog advertisement, schema/shard catalogs with shared schema-message transport fetch/sync helpers, authority leases, authorized peer lookup, stream catalog, branded `CultMesh` facade, WebSocket transport profile/connection helper, RUDP client/server sugar, connected RUDP CultMesh client helpers, Kotlin interop RUDP serve/dial path, RUDP reconnect policy/controller and reconnect-loop helper, schema-v0 MessagePack over RUDP evidence | C# SoA store (parked at `parked/cultcache-soa`), full C# server daemon, or Unity hot-loop memory layout |
 
 ## Evidence Gates
 
@@ -52,7 +55,7 @@ CultMesh.
   `reconnectPolicy` profile field from C#, Rust, Python, and Kotlin peers.
   Runtime-local tests cover the deterministic delay helper and reconnect
   controller in C#, TypeScript, Rust, Python, and Kotlin.
-- `packages/cultcache-py/PARITY.md` is the Python-specific audit ledger. Its
+- `docs/python-runtime-parity.md` is the Python-specific audit ledger. Its
   "Still Not Claimed" section is part of the contract, not an apology.
 - `docs/cultnet-transport-parity.md` is the transport ownership map. It tracks
   the remaining work to lower older LiteNetLib/WebSocket bodies behind the
@@ -85,6 +88,16 @@ server body, is deliberately not made.
   backfilling C# server responsibilities it should not own. Kotlin WebSocket
   and RUDP adapters now share one `CultNetSchemaMessageTransport` helper shape
   for schema/shard catalog request and sync flows.
+- Bring `packages/cultmesh-rs` under the wire claim. It arrived from a consumer repo where it grew
+  outside any conformance harness, and its stream, negotiation, and shared-memory frame-ring
+  surfaces have never been checked against the browser, Kotlin, and TypeScript CultMesh bodies
+  they must interoperate with. Runtime-local tests pass; that is not a parity claim.
+- Carry the RUDP receive-path bounds to the other runtimes. Rust now caps tracked ordered
+  and sequenced channels, caps the out-of-order hold buffer by frames and bytes, refuses a
+  packet far ahead of the highest received so a forged sequence cannot starve a session, and
+  reports reliable sequence exhaustion instead of aborting. C#, TypeScript, Python and Kotlin
+  still accept all of it. These are refusals rather than wire-format changes, so the interop
+  lanes stay green either way -- which is exactly why the gap will not announce itself.
 - Keep performance claims evidence-bound: C# owns SoA; Python has benchmark
   comparison gates; other runtimes should advertise measured native hot paths
   only when those paths exist.
diff --git a/native/GameCult.Mesh.Quic.Native/CMakeLists.txt b/native/GameCult.Mesh.Quic.Native/CMakeLists.txt
new file mode 100644
index 00000000..2850951d
--- /dev/null
+++ b/native/GameCult.Mesh.Quic.Native/CMakeLists.txt
@@ -0,0 +1,20 @@
+cmake_minimum_required(VERSION 3.24)
+project(gamecult_mesh_quic_native LANGUAGES CXX)
+
+if(NOT WIN32)
+  message(FATAL_ERROR "The current CultMesh native QUIC connector supports Windows desktop only")
+endif()
+if(NOT DEFINED MSQUIC_ROOT)
+  message(FATAL_ERROR "MSQUIC_ROOT must point at the extracted Microsoft.Native.Quic.MsQuic.Schannel package build/native directory")
+endif()
+
+add_library(gamecult_mesh_quic_native SHARED cultmesh_quic_native.cpp)
+target_compile_features(gamecult_mesh_quic_native PRIVATE cxx_std_20)
+target_compile_definitions(gamecult_mesh_quic_native PRIVATE GAMECULT_MESH_QUIC_NATIVE_EXPORTS WIN32_LEAN_AND_MEAN NOMINMAX)
+target_include_directories(gamecult_mesh_quic_native PRIVATE "${MSQUIC_ROOT}/include")
+target_link_directories(gamecult_mesh_quic_native PRIVATE "${MSQUIC_ROOT}/lib/x64")
+target_link_libraries(gamecult_mesh_quic_native PRIVATE msquic crypt32 bcrypt)
+
+set_target_properties(gamecult_mesh_quic_native PROPERTIES
+  OUTPUT_NAME "gamecult_mesh_quic_native"
+  RUNTIME_OUTPUT_DIRECTORY "${CMAKE_BINARY_DIR}/bin")
diff --git a/native/GameCult.Mesh.Quic.Native/README.md b/native/GameCult.Mesh.Quic.Native/README.md
new file mode 100644
index 00000000..875ebb3b
--- /dev/null
+++ b/native/GameCult.Mesh.Quic.Native/README.md
@@ -0,0 +1,10 @@
+# GameCult.Mesh.Quic.Native
+
+This Windows desktop bridge keeps MsQuic's callback-heavy C API below the
+managed runtime boundary. It accepts a discovery-authorized SHA-256 certificate
+pin, negotiates `cultmesh-state-v1`, and emits complete CultMesh realtime frame
+payloads. It owns transport only; frame meaning remains in `GameCult.Mesh`.
+
+The build consumes Microsoft's pinned
+`Microsoft.Native.Quic.MsQuic.Schannel` package. It does not contain
+Aetheria-specific code.
diff --git a/native/GameCult.Mesh.Quic.Native/cultmesh_quic_native.cpp b/native/GameCult.Mesh.Quic.Native/cultmesh_quic_native.cpp
new file mode 100644
index 00000000..bbb6e193
--- /dev/null
+++ b/native/GameCult.Mesh.Quic.Native/cultmesh_quic_native.cpp
@@ -0,0 +1,440 @@
+#include <windows.h>
+#include <wincrypt.h>
+#include <bcrypt.h>
+#include <msquic.h>
+
+#include <array>
+#include <atomic>
+#include <condition_variable>
+#include <cstdint>
+#include <cstring>
+#include <deque>
+#include <memory>
+#include <mutex>
+#include <sstream>
+#include <string>
+#include <vector>
+
+#if defined(GAMECULT_MESH_QUIC_NATIVE_EXPORTS)
+#define CULTMESH_API extern "C" __declspec(dllexport)
+#else
+#define CULTMESH_API extern "C" __declspec(dllimport)
+#endif
+
+namespace {
+
+constexpr uint32_t kApiVersion = 2;
+constexpr uint64_t kConnectionCloseCode = 0x43554c54;
+constexpr uint64_t kStreamAbortCode = 0x53544154;
+constexpr uint8_t kReliableStream = 1;
+constexpr uint8_t kLatestOnlyStream = 2;
+constexpr uint32_t kMaximumEncodedFrameBytes = (64u * 1024u * 1024u) + 37u + (3u * 65535u);
+constexpr char kAlpn[] = "cultmesh-state-v1";
+
+enum class ClientState : int32_t {
+    Connecting = 0,
+    Connected = 1,
+    Failed = 2,
+    Closed = 3,
+};
+
+struct Client;
+
+struct StreamContext {
+    explicit StreamContext(Client* client) : owner(client) {}
+    Client* owner;
+    std::vector<uint8_t> buffered;
+    uint8_t kind = 0;
+    bool has_kind = false;
+};
+
+struct Client {
+    const QUIC_API_TABLE* api = nullptr;
+    HQUIC registration = nullptr;
+    HQUIC configuration = nullptr;
+    HQUIC connection = nullptr;
+    std::array<uint8_t, 32> certificate_pin{};
+    std::atomic<ClientState> state{ClientState::Connecting};
+    std::atomic<bool> closing{false};
+    std::mutex gate;
+    std::deque<std::vector<uint8_t>> received;
+    std::string error;
+    std::string trace;
+};
+
+void AppendTrace(Client* client, const std::string& event) {
+    if (client == nullptr || client->state.load() == ClientState::Connected) return;
+    std::lock_guard<std::mutex> lock(client->gate);
+    if (!client->trace.empty()) client->trace += ",";
+    client->trace += event;
+}
+
+std::string TraceSnapshot(Client* client) {
+    if (client == nullptr) return "none";
+    std::lock_guard<std::mutex> lock(client->gate);
+    return client->trace.empty() ? "none" : client->trace;
+}
+
+void SetFailure(Client* client, const std::string& message) {
+    if (client == nullptr || client->closing.load()) return;
+    {
+        std::lock_guard<std::mutex> lock(client->gate);
+        if (client->error.empty()) client->error = message;
+    }
+    client->state.store(ClientState::Failed);
+}
+
+bool ParseHexNibble(char value, uint8_t& nibble) {
+    if (value >= '0' && value <= '9') nibble = static_cast<uint8_t>(value - '0');
+    else if (value >= 'a' && value <= 'f') nibble = static_cast<uint8_t>(value - 'a' + 10);
+    else if (value >= 'A' && value <= 'F') nibble = static_cast<uint8_t>(value - 'A' + 10);
+    else return false;
+    return true;
+}
+
+bool ParsePin(const char* value, std::array<uint8_t, 32>& pin) {
+    if (value == nullptr || std::strlen(value) != 64) return false;
+    for (size_t index = 0; index < pin.size(); ++index) {
+        uint8_t high = 0;
+        uint8_t low = 0;
+        if (!ParseHexNibble(value[index * 2], high) || !ParseHexNibble(value[(index * 2) + 1], low))
+            return false;
+        pin[index] = static_cast<uint8_t>((high << 4) | low);
+    }
+    return true;
+}
+
+uint32_t ReadUInt32LittleEndian(const uint8_t* value) {
+    return static_cast<uint32_t>(value[0]) |
+        (static_cast<uint32_t>(value[1]) << 8) |
+        (static_cast<uint32_t>(value[2]) << 16) |
+        (static_cast<uint32_t>(value[3]) << 24);
+}
+
+void FailStream(StreamContext* stream, const char* message) {
+    SetFailure(stream->owner, message);
+    if (stream->owner != nullptr && stream->owner->api != nullptr && stream->owner->connection != nullptr)
+        stream->owner->api->ConnectionShutdown(
+            stream->owner->connection,
+            QUIC_CONNECTION_SHUTDOWN_FLAG_SILENT,
+            kStreamAbortCode);
+}
+
+bool ConsumeFrames(StreamContext* stream) {
+    auto& bytes = stream->buffered;
+    if (!stream->has_kind) {
+        if (bytes.empty()) return true;
+        stream->kind = bytes.front();
+        bytes.erase(bytes.begin());
+        stream->has_kind = true;
+        if (stream->kind != kReliableStream && stream->kind != kLatestOnlyStream) {
+            FailStream(stream, "CultMesh QUIC stream kind is invalid.");
+            return false;
+        }
+    }
+
+    while (bytes.size() >= sizeof(uint32_t)) {
+        const uint32_t length = ReadUInt32LittleEndian(bytes.data());
+        if (length == 0 || length > kMaximumEncodedFrameBytes) {
+            FailStream(stream, "CultMesh QUIC frame length is invalid.");
+            return false;
+        }
+        const size_t framed_length = sizeof(uint32_t) + static_cast<size_t>(length);
+        if (bytes.size() < framed_length) return true;
+        std::vector<uint8_t> frame(length);
+        std::memcpy(frame.data(), bytes.data() + sizeof(uint32_t), length);
+        {
+            std::lock_guard<std::mutex> lock(stream->owner->gate);
+            stream->owner->received.emplace_back(std::move(frame));
+        }
+        bytes.erase(bytes.begin(), bytes.begin() + static_cast<std::ptrdiff_t>(framed_length));
+        if (stream->kind == kLatestOnlyStream && !bytes.empty()) {
+            FailStream(stream, "CultMesh latest-only QUIC stream carried multiple frames.");
+            return false;
+        }
+    }
+    return true;
+}
+
+QUIC_STATUS QUIC_API StreamCallback(HQUIC stream_handle, void* context, QUIC_STREAM_EVENT* event) {
+    auto* stream = static_cast<StreamContext*>(context);
+    switch (event->Type) {
+    case QUIC_STREAM_EVENT_RECEIVE:
+        for (uint32_t index = 0; index < event->RECEIVE.BufferCount; ++index) {
+            const auto& buffer = event->RECEIVE.Buffers[index];
+            stream->buffered.insert(stream->buffered.end(), buffer.Buffer, buffer.Buffer + buffer.Length);
+        }
+        ConsumeFrames(stream);
+        break;
+    case QUIC_STREAM_EVENT_PEER_SEND_SHUTDOWN:
+        if (!stream->buffered.empty())
+            FailStream(stream, "CultMesh QUIC stream ended with a truncated frame.");
+        break;
+    case QUIC_STREAM_EVENT_SHUTDOWN_COMPLETE:
+        if (!event->SHUTDOWN_COMPLETE.AppCloseInProgress)
+            stream->owner->api->StreamClose(stream_handle);
+        delete stream;
+        break;
+    default:
+        break;
+    }
+    return QUIC_STATUS_SUCCESS;
+}
+
+bool CertificateMatchesPin(Client* client, QUIC_CERTIFICATE* certificate) {
+    if (certificate == nullptr) return false;
+    const auto* encoded = reinterpret_cast<const QUIC_BUFFER*>(certificate);
+    if (encoded->Buffer == nullptr || encoded->Length == 0) return false;
+    BYTE digest[32]{};
+    DWORD digest_length = sizeof(digest);
+    if (!CryptHashCertificate2(
+            BCRYPT_SHA256_ALGORITHM,
+            0,
+            nullptr,
+            encoded->Buffer,
+            encoded->Length,
+            digest,
+            &digest_length) || digest_length != sizeof(digest))
+        return false;
+    return std::memcmp(digest, client->certificate_pin.data(), sizeof(digest)) == 0;
+}
+
+std::string Hex(uint64_t value) {
+    std::ostringstream text;
+    text << "0x" << std::hex << std::uppercase << value;
+    return text.str();
+}
+
+std::string LoadedMsQuicPath() {
+    const auto module = GetModuleHandleW(L"msquic.dll");
+    if (module == nullptr) return "unresolved";
+    std::array<wchar_t, 32768> path{};
+    const auto length = GetModuleFileNameW(module, path.data(), static_cast<DWORD>(path.size()));
+    if (length == 0 || length >= path.size()) return "unresolved";
+    const auto required = WideCharToMultiByte(
+        CP_UTF8, 0, path.data(), static_cast<int>(length), nullptr, 0, nullptr, nullptr);
+    if (required <= 0) return "unresolved";
+    std::string utf8(static_cast<size_t>(required), '\0');
+    WideCharToMultiByte(
+        CP_UTF8, 0, path.data(), static_cast<int>(length), utf8.data(), required, nullptr, nullptr);
+    return utf8;
+}
+
+QUIC_STATUS QUIC_API ConnectionCallback(HQUIC connection, void* context, QUIC_CONNECTION_EVENT* event) {
+    auto* client = static_cast<Client*>(context);
+    AppendTrace(client, "event=" + std::to_string(static_cast<int>(event->Type)));
+    switch (event->Type) {
+    case QUIC_CONNECTION_EVENT_CONNECTED:
+        client->state.store(ClientState::Connected);
+        break;
+    case QUIC_CONNECTION_EVENT_PEER_STREAM_STARTED: {
+        auto* stream = new (std::nothrow) StreamContext(client);
+        if (stream == nullptr) return QUIC_STATUS_OUT_OF_MEMORY;
+        client->api->SetCallbackHandler(
+            event->PEER_STREAM_STARTED.Stream,
+            reinterpret_cast<void*>(StreamCallback),
+            stream);
+        break;
+    }
+    case QUIC_CONNECTION_EVENT_PEER_CERTIFICATE_RECEIVED:
+    {
+        AppendTrace(
+            client,
+            "certificate-status=" +
+            Hex(static_cast<uint64_t>(event->PEER_CERTIFICATE_RECEIVED.DeferredStatus)));
+        const auto matches = CertificateMatchesPin(
+            client,
+            event->PEER_CERTIFICATE_RECEIVED.Certificate);
+        if (!matches) {
+            SetFailure(client, "CultMesh QUIC provider certificate does not match the advertised SHA-256 pin.");
+        }
+        const auto completion = client->api->ConnectionCertificateValidationComplete(
+            connection,
+            matches ? TRUE : FALSE,
+            matches ? QUIC_TLS_ALERT_CODE_SUCCESS : QUIC_TLS_ALERT_CODE_BAD_CERTIFICATE);
+        if (QUIC_FAILED(completion)) {
+            SetFailure(
+                client,
+                "CultMesh QUIC certificate validation completion failed (status=" +
+                Hex(static_cast<uint64_t>(completion)) + ").");
+            return completion;
+        }
+        return QUIC_STATUS_PENDING;
+    }
+    case QUIC_CONNECTION_EVENT_SHUTDOWN_INITIATED_BY_TRANSPORT:
+        if (!client->closing.load()) {
+            SetFailure(
+                client,
+                "CultMesh QUIC connection was shut down by the transport "
+                "(status=" + Hex(static_cast<uint64_t>(event->SHUTDOWN_INITIATED_BY_TRANSPORT.Status)) +
+                ", error=" + Hex(event->SHUTDOWN_INITIATED_BY_TRANSPORT.ErrorCode) +
+                ", msquic=" + LoadedMsQuicPath() +
+                ", events=" + TraceSnapshot(client) + ").");
+        }
+        break;
+    case QUIC_CONNECTION_EVENT_SHUTDOWN_INITIATED_BY_PEER:
+        if (!client->closing.load())
+            SetFailure(client, "CultMesh QUIC connection was shut down by the provider.");
+        break;
+    case QUIC_CONNECTION_EVENT_SHUTDOWN_COMPLETE:
+        if (client->closing.load()) client->state.store(ClientState::Closed);
+        break;
+    default:
+        break;
+    }
+    return QUIC_STATUS_SUCCESS;
+}
+
+void CloseHandles(Client* client) {
+    if (client->connection != nullptr) {
+        client->api->ConnectionClose(client->connection);
+        client->connection = nullptr;
+    }
+    if (client->configuration != nullptr) {
+        client->api->ConfigurationClose(client->configuration);
+        client->configuration = nullptr;
+    }
+    if (client->registration != nullptr) {
+        client->api->RegistrationClose(client->registration);
+        client->registration = nullptr;
+    }
+    if (client->api != nullptr) {
+        MsQuicClose(client->api);
+        client->api = nullptr;
+    }
+}
+
+} // namespace
+
+CULTMESH_API int32_t cultmesh_quic_open(
+    const char* host,
+    uint16_t port,
+    const char* certificate_sha256,
+    Client** result) {
+    if (host == nullptr || *host == '\0' || port == 0 || result == nullptr) return -1;
+    *result = nullptr;
+    auto client = std::make_unique<Client>();
+    if (!ParsePin(certificate_sha256, client->certificate_pin)) return -2;
+
+    QUIC_STATUS status = MsQuicOpenVersion(
+        kApiVersion,
+        reinterpret_cast<const void**>(&client->api));
+    if (QUIC_FAILED(status)) return status;
+
+    const QUIC_REGISTRATION_CONFIG registration_config = {
+        "GameCult.Mesh.Quic.Native",
+        QUIC_EXECUTION_PROFILE_TYPE_REAL_TIME
+    };
+    status = client->api->RegistrationOpen(&registration_config, &client->registration);
+    if (QUIC_FAILED(status)) {
+        CloseHandles(client.get());
+        return status;
+    }
+
+    QUIC_SETTINGS settings{};
+    settings.IdleTimeoutMs = 30000;
+    settings.IsSet.IdleTimeoutMs = TRUE;
+    settings.KeepAliveIntervalMs = 5000;
+    settings.IsSet.KeepAliveIntervalMs = TRUE;
+    settings.PeerUnidiStreamCount = 1024;
+    settings.IsSet.PeerUnidiStreamCount = TRUE;
+    const QUIC_BUFFER alpn = {
+        static_cast<uint32_t>(sizeof(kAlpn) - 1),
+        reinterpret_cast<uint8_t*>(const_cast<char*>(kAlpn))
+    };
+    status = client->api->ConfigurationOpen(
+        client->registration,
+        &alpn,
+        1,
+        &settings,
+        sizeof(settings),
+        nullptr,
+        &client->configuration);
+    if (QUIC_FAILED(status)) {
+        CloseHandles(client.get());
+        return status;
+    }
+
+    QUIC_CREDENTIAL_CONFIG credentials{};
+    credentials.Type = QUIC_CREDENTIAL_TYPE_NONE;
+    credentials.Flags = static_cast<QUIC_CREDENTIAL_FLAGS>(
+        QUIC_CREDENTIAL_FLAG_CLIENT |
+        QUIC_CREDENTIAL_FLAG_INDICATE_CERTIFICATE_RECEIVED |
+        QUIC_CREDENTIAL_FLAG_DEFER_CERTIFICATE_VALIDATION |
+        QUIC_CREDENTIAL_FLAG_USE_PORTABLE_CERTIFICATES);
+    status = client->api->ConfigurationLoadCredential(client->configuration, &credentials);
+    if (QUIC_FAILED(status)) {
+        CloseHandles(client.get());
+        return status;
+    }
+
+    status = client->api->ConnectionOpen(
+        client->registration,
+        ConnectionCallback,
+        client.get(),
+        &client->connection);
+    if (QUIC_FAILED(status)) {
+        CloseHandles(client.get());
+        return status;
+    }
+    status = client->api->ConnectionStart(
+        client->connection,
+        client->configuration,
+        QUIC_ADDRESS_FAMILY_UNSPEC,
+        host,
+        port);
+    if (QUIC_FAILED(status)) {
+        CloseHandles(client.get());
+        return status;
+    }
+
+    *result = client.release();
+    return 0;
+}
+
+CULTMESH_API int32_t cultmesh_quic_state(Client* client) {
+    if (client == nullptr) return static_cast<int32_t>(ClientState::Failed);
+    return static_cast<int32_t>(client->state.load());
+}
+
+CULTMESH_API int32_t cultmesh_quic_poll(
+    Client* client,
+    uint8_t* destination,
+    int32_t destination_length,
+    int32_t* required_length) {
+    if (client == nullptr || required_length == nullptr || destination_length < 0) return -1;
+    std::lock_guard<std::mutex> lock(client->gate);
+    if (client->received.empty()) {
+        *required_length = 0;
+        return client->state.load() == ClientState::Failed ? -2 : 0;
+    }
+    const auto& frame = client->received.front();
+    if (frame.size() > static_cast<size_t>(INT32_MAX)) return -3;
+    *required_length = static_cast<int32_t>(frame.size());
+    if (destination == nullptr || destination_length < *required_length) return 2;
+    std::memcpy(destination, frame.data(), frame.size());
+    client->received.pop_front();
+    return 1;
+}
+
+CULTMESH_API int32_t cultmesh_quic_error(
+    Client* client,
+    char* destination,
+    int32_t destination_length) {
+    if (client == nullptr || destination == nullptr || destination_length <= 0) return -1;
+    std::lock_guard<std::mutex> lock(client->gate);
+    const size_t count = (std::min)(client->error.size(), static_cast<size_t>(destination_length - 1));
+    std::memcpy(destination, client->error.data(), count);
+    destination[count] = '\0';
+    return static_cast<int32_t>(count);
+}
+
+CULTMESH_API void cultmesh_quic_close(Client* client) {
+    if (client == nullptr) return;
+    client->closing.store(true);
+    if (client->connection != nullptr && client->api != nullptr)
+        client->api->ConnectionShutdown(client->connection, QUIC_CONNECTION_SHUTDOWN_FLAG_SILENT, kConnectionCloseCode);
+    CloseHandles(client);
+    client->state.store(ClientState::Closed);
+    delete client;
+}
diff --git a/package-lock.json b/package-lock.json
index 37c13662..f027ecd5 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -8,8 +8,15 @@
       "workspaces": [
         "packages/cultcache-ts",
         "packages/cultnet-ts",
-        "packages/cultmesh-ts"
-      ]
+        "packages/cultmesh-ts",
+        "packages/cultmesh-browser"
+      ],
+      "devDependencies": {
+        "esbuild": "^0.28.1",
+        "fast-uri": "3.1.5",
+        "js-yaml": "4.3.1",
+        "playwright-core": "^1.62.1"
+      }
     },
     "node_modules/@apidevtools/json-schema-ref-parser": {
       "version": "11.9.3",
@@ -29,6 +36,452 @@
         "url": "https://github.com/sponsors/philsturgeon"
       }
     },
+    "node_modules/@esbuild/aix-ppc64": {
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/aix-ppc64/-/aix-ppc64-0.28.1.tgz",
+      "integrity": "sha512-Svl7tq8k/08+p6CXPpRjQ1fKX+1odH/BQbb48fV6fj3CWHhsoIOoY87w1oHXm0qEpkIK3ZfVgp0hed3XBXzXMQ==",
+      "cpu": [
+        "ppc64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "aix"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/android-arm": {
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/android-arm/-/android-arm-0.28.1.tgz",
+      "integrity": "sha512-0k2F129Xdio1TdJfzJ8sy1Q47vUD2NnwdhiAf7drUN1EBTfPf4hsFCtmMgu/6m8JSzsBrlmVjudMBQqOfG8usQ==",
+      "cpu": [
+        "arm"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/android-arm64": {
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/android-arm64/-/android-arm64-0.28.1.tgz",
+      "integrity": "sha512-34EGEbCIAgosYz6goLcopX6Mo7NyGv9tfwEM2/7Ce2VcVRk568iSvniGWcUXIy7wEDR1wzolcxcriFVrWYcwBg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/android-x64": {
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/android-x64/-/android-x64-0.28.1.tgz",
+      "integrity": "sha512-dbwY7ltSMDWsRatcRpCnES4F+im88OCUgGZjy52shC7GqHRE/cYlxNbB4Z4UpJswpcc4Qxd2oE/ufM0p61IKng==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/darwin-arm64": {
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/darwin-arm64/-/darwin-arm64-0.28.1.tgz",
+      "integrity": "sha512-TZbWkQY7kvTAXbXUT7uVACR5cMHsDiSz9z7ZKAX/RTq/WJEk3QyRr0wZpNhBDX+/0CtdqUIJlOiodQcta6tY3Q==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/darwin-x64": {
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/darwin-x64/-/darwin-x64-0.28.1.tgz",
+      "integrity": "sha512-zfdzgK9ACBNZLI/CyHTOx81SyNbM6YXn7rxSgX97VjyiPl9W1i4Ka4fgKECEoFCKGpvBj5qArWIGgQjOwkgskQ==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/freebsd-arm64": {
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-arm64/-/freebsd-arm64-0.28.1.tgz",
+      "integrity": "sha512-wG2EA8ENdEI0qhkSZMjfqrdY+ziCYCPMmtZjjIwOmXFjmyzEHn+UUxk5of+SYsjtfs3VpnlC7QLzSI5hY/rOAw==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "freebsd"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/freebsd-x64": {
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-x64/-/freebsd-x64-0.28.1.tgz",
+      "integrity": "sha512-i7dZ9vQgnvSCzi/rYCXNgtF/U+eKZNJBzu3eTQbRgHnM7tNSizLOkRFAl3qzVc/Op/u5YkHHa4pf/3DOYHthLQ==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "freebsd"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-arm": {
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm/-/linux-arm-0.28.1.tgz",
+      "integrity": "sha512-qVXBOHQS+d5Y722GwJzJUtOLlX7km3CraOaGormF1pDtPd2C/l1SHRPgjLunLGe51Sh5YYWKMFDyV4SxgMQYTQ==",
+      "cpu": [
+        "arm"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-arm64": {
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm64/-/linux-arm64-0.28.1.tgz",
+      "integrity": "sha512-yHs+0uc8+nvEAfAfxrWQKK5peSNzBc4PegcMO0EJ2hT71uA7vB8Ihg2e77R2P7SG5uYjPbHlLLmve4LLLRCf0g==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-ia32": {
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-ia32/-/linux-ia32-0.28.1.tgz",
+      "integrity": "sha512-d1z4ZuP0ajrfz/FhGT4vv278rX8KnPPJx8i5+AtK7TYbx9Le9F1hyzurZpkEyjkGa9dUGhQow4C1NmeGvqxN2w==",
+      "cpu": [
+        "ia32"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-loong64": {
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-loong64/-/linux-loong64-0.28.1.tgz",
+      "integrity": "sha512-M5sRjUVZrkm1OAPR3dlOYzNmN+loZKGVi1VUQGrwuqLcbR6qeAz+famMhjASeH3YVKvZz+zT1jlh/keC3Rj/lg==",
+      "cpu": [
+        "loong64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-mips64el": {
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-mips64el/-/linux-mips64el-0.28.1.tgz",
+      "integrity": "sha512-mRObBZeHh2OxcBFPWE/FjylkRgZdYuiTR3vaTozquCGOH14iP9oN4x4Ge81CoIDYQrXmIxpFumJBu5MtZpnQJQ==",
+      "cpu": [
+        "mips64el"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-ppc64": {
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-ppc64/-/linux-ppc64-0.28.1.tgz",
+      "integrity": "sha512-slScBsMAb3GFDcdrCgLwZtPYRoH2H/youv10QiZyRjmsP48fznoveWytSgCI/R0ZcUgpc0ZhIUEx6LHts8yrfQ==",
+      "cpu": [
+        "ppc64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-riscv64": {
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-riscv64/-/linux-riscv64-0.28.1.tgz",
+      "integrity": "sha512-kw0owk1o0GFETUJyW0jc0G4Yzs0BHZn0JDZ8JRT088vjJYX777BAs1fDGxAC+q831qOs2DTC96mNsG2opdfyyQ==",
+      "cpu": [
+        "riscv64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-s390x": {
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-s390x/-/linux-s390x-0.28.1.tgz",
+      "integrity": "sha512-/lAIjX8aYFRByhh6L5rYtPEDRqa9de/4V/juOXcta5frjvzXO4/sqEtyytse0g3zZFuWu5cDN0MkLz2qRDD2Ag==",
+      "cpu": [
+        "s390x"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-x64": {
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-x64/-/linux-x64-0.28.1.tgz",
+      "integrity": "sha512-u/anNYF2mmVOEDwLtnQ1wOr3EZ9sTNGLWrsYGYwHWzGA3Si84IOkHXlbWTD1NB+9/1lcnweYKO54uhxZydNzfA==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/netbsd-arm64": {
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-arm64/-/netbsd-arm64-0.28.1.tgz",
+      "integrity": "sha512-oks0DYbLwWMmaakTsCb+zL4E+aHRVLom9IJZOAthMQEPiQmydXHkziYEsGYRx0uNV/IjEKGAV941JzH02pflqw==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "netbsd"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/netbsd-x64": {
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-x64/-/netbsd-x64-0.28.1.tgz",
+      "integrity": "sha512-aeL6lAnN89Hz43Mlh1G8ARasbuoYvSITDEx0tHh5b7jJnHcssqgjy9Yx430GDpmCa6OyrKoS0aNRjKundRizGg==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "netbsd"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/openbsd-arm64": {
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-arm64/-/openbsd-arm64-0.28.1.tgz",
+      "integrity": "sha512-MEFJe5C3R8pwXdZ5Y21oo6m7ePiS0d9pWucn99O/wvyJZChoIQKrQDxKrGeW8F5+T0okTHesAmDeiHDTIq0V/Q==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "openbsd"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/openbsd-x64": {
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-x64/-/openbsd-x64-0.28.1.tgz",
+      "integrity": "sha512-i/ZLIOafE0Z8cI/XANJAixoJL/uRAoS2xOA3rb0xN+KK0K177cMAsQYkzHtBrtMXAKuAc7HGgcWiZ/sRC1Nxgw==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "openbsd"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/openharmony-arm64": {
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/openharmony-arm64/-/openharmony-arm64-0.28.1.tgz",
+      "integrity": "sha512-ge+Z7EXFNt2BO1oAMsVpiQ8EwndV9i1xXerAeTIK7AtPs3bKFXQM7nlRxDSIUIMeueR1CNXxqztLzdNeReKBJg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "openharmony"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/sunos-x64": {
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/sunos-x64/-/sunos-x64-0.28.1.tgz",
+      "integrity": "sha512-BEjgtECkL3vY+SaSQ6nzVfiALUeFxpawyp8Jmf5PtYhf1Ug40N1h/hxlhts+f1FvSvarEigdxS3BlSMI2PJLcQ==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "sunos"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/win32-arm64": {
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/win32-arm64/-/win32-arm64-0.28.1.tgz",
+      "integrity": "sha512-lCv9eK/H6ZJWbE7bh2nw54CZ9M2nupBxJcTsdk/QQnWkdSjKGuxmmH8/GWrlT1eMmZfn4dGcCjRte397WqfQXA==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/win32-ia32": {
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/win32-ia32/-/win32-ia32-0.28.1.tgz",
+      "integrity": "sha512-zvb/mB2bSCoJOpoCBgYKKpX6YM6mJBlBUVUtVj41DlZJVEB6/0CKlRYxP5wWl1C1ILiCoAU5wZZ4q1P3qeS6Eg==",
+      "cpu": [
+        "ia32"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/win32-x64": {
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/win32-x64/-/win32-x64-0.28.1.tgz",
+      "integrity": "sha512-bm4Mowrv+GXMlpWX++EcXw/iLyd1o3+bJkC2DkWXYVvgZCqD/bSj9ctZeAMC3cIxgjRVR2Dufaiu4YPxr5gW1A==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@gamecult/cultcache-ts": {
+      "resolved": "packages/cultcache-ts",
+      "link": true
+    },
     "node_modules/@jsdevtools/ono": {
       "version": "7.1.3",
       "resolved": "https://registry.npmjs.org/@jsdevtools/ono/-/ono-7.1.3.tgz",
@@ -92,8 +545,8 @@
       "dev": true,
       "license": "Python-2.0"
     },
-    "node_modules/cultcache-ts": {
-      "resolved": "packages/cultcache-ts",
+    "node_modules/cultmesh-browser": {
+      "resolved": "packages/cultmesh-browser",
       "link": true
     },
     "node_modules/cultmesh-ts": {
@@ -104,6 +557,48 @@
       "resolved": "packages/cultnet-ts",
       "link": true
     },
+    "node_modules/esbuild": {
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/esbuild/-/esbuild-0.28.1.tgz",
+      "integrity": "sha512-HrJrvZv5ayxBzPfwphOoNzkzOIIlifzk0KJrGK2c8R4+LKpMtpYLQeUdjnwjWv/LZlkH2laZk+4w78pi99D4Vw==",
+      "dev": true,
+      "hasInstallScript": true,
+      "license": "MIT",
+      "bin": {
+        "esbuild": "bin/esbuild"
+      },
+      "engines": {
+        "node": ">=18"
+      },
+      "optionalDependencies": {
+        "@esbuild/aix-ppc64": "0.28.1",
+        "@esbuild/android-arm": "0.28.1",
+        "@esbuild/android-arm64": "0.28.1",
+        "@esbuild/android-x64": "0.28.1",
+        "@esbuild/darwin-arm64": "0.28.1",
+        "@esbuild/darwin-x64": "0.28.1",
+        "@esbuild/freebsd-arm64": "0.28.1",
+        "@esbuild/freebsd-x64": "0.28.1",
+        "@esbuild/linux-arm": "0.28.1",
+        "@esbuild/linux-arm64": "0.28.1",
+        "@esbuild/linux-ia32": "0.28.1",
+        "@esbuild/linux-loong64": "0.28.1",
+        "@esbuild/linux-mips64el": "0.28.1",
+        "@esbuild/linux-ppc64": "0.28.1",
+        "@esbuild/linux-riscv64": "0.28.1",
+        "@esbuild/linux-s390x": "0.28.1",
+        "@esbuild/linux-x64": "0.28.1",
+        "@esbuild/netbsd-arm64": "0.28.1",
+        "@esbuild/netbsd-x64": "0.28.1",
+        "@esbuild/openbsd-arm64": "0.28.1",
+        "@esbuild/openbsd-x64": "0.28.1",
+        "@esbuild/openharmony-arm64": "0.28.1",
+        "@esbuild/sunos-x64": "0.28.1",
+        "@esbuild/win32-arm64": "0.28.1",
+        "@esbuild/win32-ia32": "0.28.1",
+        "@esbuild/win32-x64": "0.28.1"
+      }
+    },
     "node_modules/fast-deep-equal": {
       "version": "3.1.3",
       "resolved": "https://registry.npmjs.org/fast-deep-equal/-/fast-deep-equal-3.1.3.tgz",
@@ -111,9 +606,9 @@
       "license": "MIT"
     },
     "node_modules/fast-uri": {
-      "version": "3.1.3",
-      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.3.tgz",
-      "integrity": "sha512-i70LwGWUduXqzicKXWshooq+sWL1K3WUU5rKZNG/0i3a1OSoX3HqhH5WbWwTmqWfor4urUakGPiRQcleRZTwOg==",
+      "version": "3.1.5",
+      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.5.tgz",
+      "integrity": "sha512-gHwA1O9LDIcKunMKhObS/HimwtehO1nPUECKAu5TpKgaO19fcWEl4bliWe1jWxVFvIXztJjjQ4L8XQ1EU9f7Jw==",
       "funding": [
         {
           "type": "github",
@@ -168,9 +663,9 @@
       }
     },
     "node_modules/js-yaml": {
-      "version": "4.3.0",
-      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.0.tgz",
-      "integrity": "sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==",
+      "version": "4.3.1",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.1.tgz",
+      "integrity": "sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==",
       "dev": true,
       "funding": [
         {
@@ -250,6 +745,19 @@
         "url": "https://github.com/sponsors/jonschlinkert"
       }
     },
+    "node_modules/playwright-core": {
+      "version": "1.62.1",
+      "resolved": "https://registry.npmjs.org/playwright-core/-/playwright-core-1.62.1.tgz",
+      "integrity": "sha512-wPYSwEBJY9GHraISXqyqtx0na0LpO3XEX7jNDhntbex7tzUS7kLnZsOlFruFJB4Hi/rhDMjXGqHewDZ68nYZVw==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "bin": {
+        "playwright-core": "cli.js"
+      },
+      "engines": {
+        "node": ">=20"
+      }
+    },
     "node_modules/prettier": {
       "version": "3.9.5",
       "resolved": "https://registry.npmjs.org/prettier/-/prettier-3.9.5.tgz",
@@ -323,7 +831,8 @@
       }
     },
     "packages/cultcache-ts": {
-      "version": "0.13.5",
+      "name": "@gamecult/cultcache-ts",
+      "version": "0.14.0",
       "license": "MIT",
       "dependencies": {
         "@msgpack/msgpack": "^3.1.3",
@@ -332,35 +841,59 @@
       "devDependencies": {
         "@types/node": "^24.0.0",
         "typescript": "^5.9.0"
+      },
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "packages/cultmesh-browser": {
+      "version": "0.3.0",
+      "license": "MIT",
+      "dependencies": {
+        "@msgpack/msgpack": "^3.1.3",
+        "cultnet-ts": "^0.2.0"
+      },
+      "devDependencies": {
+        "@types/node": "^24.0.0",
+        "typescript": "^5.9.0"
+      },
+      "engines": {
+        "node": ">=18"
       }
     },
     "packages/cultmesh-ts": {
-      "version": "0.1.0",
+      "version": "0.1.1",
       "license": "MIT",
       "dependencies": {
+        "@gamecult/cultcache-ts": "^0.14.0",
         "@msgpack/msgpack": "^3.1.2",
-        "cultcache-ts": "file:../cultcache-ts",
-        "cultnet-ts": "file:../cultnet-ts"
+        "cultnet-ts": "^0.2.0"
       },
       "devDependencies": {
         "@types/node": "^24.0.0",
         "typescript": "^5.9.0",
         "zod": "^3.25.76"
+      },
+      "engines": {
+        "node": ">=18"
       }
     },
     "packages/cultnet-ts": {
-      "version": "0.1.0",
+      "version": "0.2.0",
       "license": "MIT",
       "dependencies": {
+        "@gamecult/cultcache-ts": "^0.14.0",
         "@msgpack/msgpack": "^3.1.3",
-        "ajv": "^8.17.1",
-        "cultcache-ts": "file:../cultcache-ts"
+        "ajv": "^8.17.1"
       },
       "devDependencies": {
         "@types/node": "^24.0.0",
         "json-schema-to-typescript": "^15.0.4",
         "typescript": "^5.9.0",
         "zod": "^3.25.76"
+      },
+      "engines": {
+        "node": ">=18"
       }
     }
   }
diff --git a/package.json b/package.json
index f1b995a2..c9b79e47 100644
--- a/package.json
+++ b/package.json
@@ -4,10 +4,19 @@
   "workspaces": [
     "packages/cultcache-ts",
     "packages/cultnet-ts",
-    "packages/cultmesh-ts"
+    "packages/cultmesh-ts",
+    "packages/cultmesh-browser"
   ],
   "scripts": {
-    "build:ts": "npm --workspaces run build",
-    "test:ts": "npm --workspaces run test"
+    "build:ts": "node scripts/run-typescript-workspaces.mjs build",
+    "test:ts": "node scripts/run-typescript-workspaces.mjs test",
+    "test:pack:ts": "node scripts/test-typescript-package-closure.mjs",
+    "test:eve-browser-network": "node scripts/verify-eve-browser-network.mjs"
+  },
+  "devDependencies": {
+    "esbuild": "^0.28.1",
+    "fast-uri": "3.1.5",
+    "js-yaml": "4.3.1",
+    "playwright-core": "^1.62.1"
   }
 }
diff --git a/packages/cultcache-py/README.md b/packages/cultcache-py/README.md
index 265eecb7..23effdbd 100644
--- a/packages/cultcache-py/README.md
+++ b/packages/cultcache-py/README.md
@@ -1,12 +1,16 @@
-# cultcache-py
+# cultcache-py
 
-`cultcache-py` is the Python runtime package for CultCache, CultNet, and
-CultMesh. Callers work with registered domain documents while the cache owns
-schema identity, routing, globals, name lookups, indexes, and backing-store
-envelopes.
+`cultcache-py` is the Python CultCache runtime. Callers work with registered
+domain documents while the cache owns schema identity, routing, globals, name
+lookups, indexes, and backing-store envelopes.
 
 It is intentionally small. It is not an ORM, a database, or distributed consensus wearing rented authority.
 
+It is the bottom of the Python CultLib stack and depends only on `msgpack`.
+`cultnet-py` (transport and wire contracts) and `cultmesh-py` (nodes,
+discovery, sessions, local server) build on it, mirroring `cultcache-rs` /
+`cultnet-rs` / `cultmesh-rs` and the npm packages.
+
 ## Current Shape
 
 - document types are registered explicitly
@@ -17,14 +21,14 @@ It is intentionally small. It is not an ORM, a database, or distributed consensu
 - payloads decode only through the registered document definition for that type
 - unknown persisted types fail closed
 - global documents are singleton-style per type
-- type-specific backing stores beat generic backing stores
+- one home store per document type: a store added with `add_backing_store`
+  owns its types, otherwise the generic store is the home; a type claimed by a
+  second store, or a second generic store, raises `CultCacheError`; a write
+  touches exactly one store and nothing is mirrored; once any store is
+  attached, a write whose type has no home raises
 - the JSONL store uses only the Python standard library for bootstrap consumers
 - `define_database_entry_type(...)` emits Rust/C#-style slot-indexed
   MessagePack array payloads for cross-runtime `DatabaseEntry` contracts
-- `cultnet_py` exposes schema-v0 MessagePack helpers and 4-byte big-endian
-  frame helpers for raw document state, subscriptions, shard catch-up,
-  simulation observations, and witness artifact bundles
-- `cultmesh_py` exposes a cache-backed local node surface for Python tools
 
 ## Example
 
@@ -144,336 +148,28 @@ That matches the Rust `#[derive(DatabaseEntry)]` formatter shape and the C#
 `[Key(n)]` intent: schema evolution comes from stable field slots, not source
 member order.
 
-## CultNet And CultMesh
-
-`cultnet_py` provides the Python schema-v0 wire helpers and an interop peer:
-
-```python
-from datetime import UTC, datetime
-
-from cultnet_py import (
-    CultNetSecret,
-    CultNetServerSecurityOptions,
-    CultNetRawClient,
-    CultNetSimulationObservation,
-    CultNetWitnessArtifactBundle,
-    apply_raw_snapshot,
-    apply_shard_log_response,
-    compute_simulation_claim_hash,
-    database_subscribe,
-    decode_frame,
-    encode_frame,
-    hello,
-    parse_message,
-    shard_catalog_request,
-    simulation_observation,
-    witness_artifact_bundle,
-)
-from cultmesh_py import CultMesh
-
-payload = hello(runtime_id="python-runtime").to_bytes()
-message = parse_message(decode_frame(encode_frame(payload)))
-
-client = CultNetRawClient("127.0.0.1", 3075)
-catalog = client.fetch_schema_catalog(kinds=["wire_message"])
-snapshot = client.fetch_snapshot_response(schema_ids=["cultnet.interop-note"])
-shard_catalog = client.fetch_shard_catalog(schema_ids=["cultnet.interop-note"])
-# With a local CultCache and the matching registered document definitions:
-# applied = apply_raw_snapshot(cache, [note_doc], snapshot)
-
-subscription = database_subscribe(subscription_id="ui", schema_ids=["cultnet.interop-note"])
-shard_request = shard_catalog_request(message_id="shards", schema_ids=["cultnet.interop-note"])
-shard_log = client.fetch_shard_log_response(shard_id="interop", shard_epoch=1, after_sequence=0)
-# log_changes = apply_shard_log_response(cache, [note_doc], shard_log)
-with client.subscribe_database(subscription_id="ui", schema_ids=["cultnet.interop-note"]) as live:
-    initial_snapshot = live.read_next_snapshot_response()
-
-# The same raw-client request surface can ride RUDP when the peer advertises a
-# rudp:// endpoint and shares the connection id for that lane.
-rudp_client = CultMesh.create_client(
-    endpoint="rudp://127.0.0.1:3076",
-    connection_id=0x43554C54,
-)
-rudp_catalog = rudp_client.fetch_schema_catalog(kinds=["wire_message"])
-
-claim_hash = compute_simulation_claim_hash("frame:42", "subject:player-1", "hit")
-observation = simulation_observation(
-    message_id="obs-1",
-    witness_runtime_id="python-runtime",
-    shard_id="interop",
-    shard_epoch=1,
-    frame=42,
-    subject_id="player-1",
-    claim_kind="hit",
-    claim_hash=claim_hash,
-)
-typed_observation = CultNetSimulationObservation.from_wire(observation.to_wire())
-witness = witness_artifact_bundle(
-    bundle_id="bundle-1",
-    witness_kind="interop-proof",
-    captured_at="2026-06-13T00:00:00Z",
-    subject={"documentType": "cultnet.interop-note", "subjectId": "note:python"},
-    contracts=[{"role": "payload", "schemaId": "cultnet.interop-note"}],
-    artifacts=[{"role": "log", "uri": "cultcache://bundle-1/log", "mediaType": "text/plain"}],
-    provenance={"pipelineId": "interop", "runId": "run-1", "runtimeId": "python-runtime"},
-)
-typed_witness = CultNetWitnessArtifactBundle.from_wire(witness)
-witness_payload = typed_witness.to_payload()
-
-security = CultNetServerSecurityOptions.development()
-token = CultNetSecret.create_session_token(
-    "318fb4b6-ff5e-4c4f-b911-d81807de53a8",
-    datetime(2035, 1, 1, tzinfo=UTC),
-    security,
-    session_version=1,
-)
-session = CultNetSecret.try_validate_session_token(token, security)
-```
-
-AES-GCM string/byte encryption helpers are available through the same
-`CultNetSecret` surface when the optional `crypto` extra is installed.
-
-The peer can serve, dial, and probe the same raw-state interop lane used by the
-TypeScript, Rust, and C# test peers:
-
-```powershell
-python -m cultnet_py.interop_peer serve --runtime-id python-peer --runtime-kind python --display-name "Python Peer" --agent-id python-agent --advertise-host 127.0.0.1 --tcp-port 3075 --discovery-port 4075 --discovery-group 239.77.44.11 --schema-path ..\cultnet-ts\integration\contracts\cultnet.interop-note.schema.json
-python -m cultnet_py.interop_peer dial --runtime-id python-client --runtime-kind python --display-name "Python Client" --agent-id python-client --target-host 127.0.0.1 --target-port 3075 --schema-path ..\cultnet-ts\integration\contracts\cultnet.interop-note.schema.json
-python -m cultnet_py.interop_peer probe --runtime-id python-prober --discovery-port 4075 --discovery-group 239.77.44.11
-```
-
-`cultmesh_py` includes a local cache-backed node, schema-v0 helpers for the
-CultMesh Verse catalog and peer exchange wire messages, local and verified
-authority lease checks, stream transport negotiation, committed simulation fact
-documents, and local prediction reconciliation:
-
-```python
-from datetime import UTC, datetime, timedelta
-
-from cultcache_py import define_database_entry_type
-from cultnet_py import (
-    CultNetClientAuthorityScope,
-    CultNetFileShardReplicaCursorStore,
-    CultNetRawClient,
-    CultNetSchemaShardLogFetcher,
-    CultNetSchemaShardSnapshotFetcher,
-    CultNetShardDescriptor,
-    CultNetShardReplicator,
-    CultNetShardReplicatorOptions,
-)
-from cultmesh_py import (
-    CultMesh,
-    CultMeshAuthorityLease,
-    CultMeshGameSessionOptions,
-    CultMeshHmacAuthorityLeaseVerifier,
-    CultMeshNodeOptions,
-    peer_exchange_request,
-)
-
-note_doc = define_database_entry_type(
-    "mesh.note",
-    [("body", 0), ("name", 1), ("kind", 2)],
-    name="name",
-    indexes={"kind": "kind"},
-)
-node = CultMesh.start_node(
-    "mesh.cc",
-    runtime_id="python-runtime",
-    options=CultMeshNodeOptions(enable_durable_shard_logs=True),
-)
-node.database.register_document(note_doc)
-unsubscribe = node.database.watch_record(note_doc, "note:1", lambda change: print(change.change_kind))
-unsubscribe_named = node.database.watch_by_name(note_doc, "intro", lambda change: print(change.record_key))
-unsubscribe_kind = node.database.watch_by_index(note_doc, "kind", "guide", lambda change: print(change.record_key))
-node.database.put(note_doc, "note:1", {"body": "hello", "name": "intro", "kind": "guide"})
-live_note = node.database.get_required(note_doc, "note:1")
-put_message = node.database.put_raw_message(
-    note_doc,
-    "note:2",
-    {"body": "wire me", "name": "wire", "kind": "interop"},
-    shard_id="interop",
-    shard_epoch=1,
-)
-snapshot_response = node.database.build_snapshot_response(schema_ids=[note_doc.catalog_entry().schema_id])
-snapshot_wire = node.database.create_snapshot_response(schema_ids=[note_doc.catalog_entry().schema_id])
-delete_message = node.database.delete_raw_message(note_doc, "note:2", shard_id="interop", shard_epoch=1)
-shard_log_response = node.database.build_shard_log_response(shard_id="interop", shard_epoch=1)
-shard_log_wire = node.database.create_shard_log_response(shard_id="interop", shard_epoch=1)
-
-peers = CultMesh.create_peer_catalog()
-response = peers.create_response(peer_exchange_request("pex-1", verse_id="local"))
-lease_verifier = CultMeshHmacAuthorityLeaseVerifier({"odin": b"shared-lease-key"})
-lease_catalog = CultMesh.create_authority_lease_catalog(
-    signature_verifier=lease_verifier.verify,
-    require_verified_signatures=True,
-)
-lease_valid_from = datetime.now(UTC)
-lease = lease_verifier.issue(CultMeshAuthorityLease(
-    lease_id="lease:python-runtime",
-    verse_id="local",
-    peer_id="python-runtime",
-    roles=("shard-primary",),
-    valid_from=lease_valid_from,
-    expires_at=lease_valid_from + timedelta(minutes=5),
-    shard_ids=("interop",),
-    issuer_runtime_id="odin",
-))
-lease_catalog.upsert(lease)
-session = CultMesh.create_game_session(
-    node,
-    CultMeshGameSessionOptions(
-        client_authority_scopes=(
-            CultNetClientAuthorityScope("python-runtime", schema_ids=(note_doc.catalog_entry().schema_id,), key_prefix="input:python"),
-        ),
-    ),
-)
-server = CultMesh.serve_node(
-    node,
-    peer_catalog=peers,
-    observation_hub=session.observation_hub,
-    port=3075,
-    max_snapshot_documents=1000,
-    max_snapshot_bytes=4 * 1024 * 1024,
-)
-```
-
-The same local server can be launched as a package daemon when another runtime
-or operator process needs a CultNet endpoint without embedding Python glue:
-
-```powershell
-python -m cultmesh_py.daemon --runtime-id python-runtime --display-name "Python Runtime" --host 127.0.0.1 --port 3075 --cache-file mesh.cc --enable-durable-shard-logs --seed-interop-note --seed-shard-id interop --verse-id local --role shard-primary --ready-file mesh.ready.json
-```
-
-The ready file and stdout line are process readiness hints. The served state and
-capability truth still live on the framed CultNet/CultMesh endpoint. Use
-`--register-interop-note` to expose the package interop-note schema without
-seeding a note, or `--seed-interop-note` to register it and publish one local
-record for wire probes. Seeded records are committed through the raw mutation
-path, so peers can read them through both snapshot and shard-log catch-up. Add
-`--verse-id` and one or more `--role` values to publish the launched endpoint in
-its own Verse and peer catalogs for discovery clients. When the daemon is
-launched with `--cache-file`, `--enable-durable-shard-logs`, and
-`--shard-log-file`, a later daemon process can rehydrate and serve the persisted
-snapshot and shard log without reseeding.
-
-`CultMeshPeerHealthMonitor` probes peer-card endpoints with `cultnet.hello.v0`
-and preserves the runtime id, display name, document types, message versions,
-and mutation contracts reported by the peer.
-
-```python
-
-client = CultMesh.create_verse_discovery_client("127.0.0.1", 3075)
-verses = client.fetch_verses(transport_version="cultmesh.v0")
-mesh_peers = client.fetch_peers(verse_id="python-interop", roles=["read-replica"])
-client.sync_peer_catalog(peers, verse_id="python-interop", roles=["read-replica"])
-client.fanout_peer_catalog(peers, verse_id="python-interop", roles=["read-replica"])
-
-raw_client = CultNetRawClient("127.0.0.1", 3075)
-node.database.sync_snapshot(raw_client, schema_ids=[note_doc.catalog_entry().schema_id])
-node.database.sync_shard_log(raw_client, shard_id="interop", shard_epoch=1)
-replicator = CultNetShardReplicator(
-    node.database,
-    CultNetShardReplicatorOptions(
-        fetcher=CultNetSchemaShardLogFetcher(),
-        snapshot_fetcher=CultNetSchemaShardSnapshotFetcher(),
-        cursor_store=CultNetFileShardReplicaCursorStore("mesh.replica-cursors.msgpack"),
-        poll_interval_seconds=1.0,
-        on_error=lambda error: print(error),
-    ),
-)
-replica_shard = CultNetShardDescriptor(
-    shard_id="interop",
-    owner_runtime_id="primary-runtime",
-    epoch=1,
-    schema_ids=(note_doc.catalog_entry().schema_id,),
-    primary_endpoints=("cultnet://127.0.0.1:3075",),
-)
-replicator.pull_once(replica_shard)
-replicator.start([replica_shard])
-replicator.stop()
-server.stop()
-
-streams = CultMesh.create_stream_catalog()
-
-claim_hash = "accepted-claim-hash"
-facts = CultMesh.create_simulation_fact_committer(node)
-committed = facts.commit({
-    "shardId": "arena",
-    "shardEpoch": 4,
-    "frame": 100,
-    "subjectId": "bob",
-    "claimKind": "hit",
-    "claimHash": claim_hash,
-    "witnessCount": 2,
-    "supportWeight": 2.0,
-    "totalWeight": 2.0,
-    "confidence": 1.0,
-    "hasQuorum": True,
-})
-session_commits = session.submit_and_commit(typed_observation)
-prediction = session.predict(note_doc, "input:python:move", {"body": "predicted input"})
-unsubscribe()
-```
-
 ## Wire Parity
 
-See [PARITY.md](PARITY.md) for the current evidence map, gates, and things this
-package still does not claim.
+See [docs/python-runtime-parity.md](../../docs/python-runtime-parity.md) for
+the evidence map across the three Python packages.
 
-The Python interop peer is `cultcache_py.interop`:
+The store interop peer is `cultcache_py.interop`:
 
 ```powershell
 python -m cultcache_py.interop write --file cache.cc --runtime-id python
 python -m cultcache_py.interop read --file cache.cc
 ```
 
-Current receipts:
+`packages/cultcache-ts/test/cult-cache.test.ts` includes Python in the shared
+CultCache v1 parity matrix with TypeScript, Rust, and C#. `cultcache_py` ships
+a `py.typed` marker so downstream type checkers can inspect the package surface.
 
-- `packages/cultcache-ts/test/cult-cache.test.ts` includes Python in the shared
-  CultCache v1 parity matrix with TypeScript, Rust, and C#.
-- `packages/cultnet-ts/test/interop/cultnet-interop.test.ts` includes Python in
-  the live TS/Rust/C#/Python schema-v0 peer ring: discovery, hello, schema
-  catalog, wire-message catalog discovery, raw snapshot, raw document
-  put/delete, mutation receipt, fire-command receipt, database subscription
-  changes, shard catalog, shard log catch-up, simulation consensus candidates,
-  committed simulation fact snapshots, Python session prediction reconciliation,
-  and witness artifact bundle round-trips. The same test asks the Python peer
-  for CultMesh Verse catalog and peer exchange responses over the CultNet pipe,
-  then verifies the public `CultMeshDiscoveryClient` can fetch typed Python
-  Verse and peer descriptors from that live endpoint. It also verifies
-  `CultNetRawClient` can fetch the live Python peer's schema catalog, raw
-  snapshot, and shard catalog.
-- `packages/cultcache-py/tests/test_cultcache.py` covers Python CultMesh
-  Verse catalog, peer exchange, authority lease, stream negotiation, CultNet
-  helper shapes, raw snapshot/shard-log application, simulation claim hashing,
-  consensus aggregation, game-session fact commits, local prediction
-  reconciliation, committed simulation fact payload slots, the local CultMesh
-  server's TCP and RUDP schema request paths, and witness artifact bundle
-  payload slots.
-- `cultcache_py`, `cultnet_py`, and `cultmesh_py` ship `py.typed` markers so
-  downstream type checkers can inspect the package surface instead of treating
-  the runtime as an untyped xenos swamp.
-
-## Performance Baseline
-
-The package ships a lightweight benchmark for Python-owned hot paths. In a
-CultLib source checkout, it can also run the C# reference benchmark beside it:
+## Tests
 
 ```powershell
-python -m cultcache_py.benchmark --records 1000 --json
-python -m cultcache_py.compare_csharp --records 1000 --json
-python -m cultcache_py.verify --json
+$env:PYTHONPATH="$PWD\packages\cultcache-py\src"
+python -m unittest discover -s packages\cultcache-py\tests
 ```
 
-It reports slot-indexed `DatabaseEntry` encode/decode throughput, framed
-CultNet MessagePack parse throughput, raw snapshot application into a
-registered cache, and public `CultCache` upsert/get throughput. The C# compare
-command also runs `packages/cultcache-py/tools/GameCult.Caching.Benchmark` and
-reports median Python-to-C# ratios for the shared public cache operations. It
-uses three samples by default; pass `--samples` when you need a different
-evidence shape. Both runtimes precompute record keys before measured cache
-upsert/get loops so the comparison is about public cache access, not string
-construction noise. The public in-memory cache owner stores records in
-type-partitioned dictionaries so hot `get(...)` calls avoid per-call
-composite-key allocation. Treat the benchmark numbers as a local baseline, not
-a claim that Python matches the C# reference in every workload.
+The suite runs with only this package on the path. If a test here needs
+`cultnet_py` or `cultmesh_py`, it belongs in that package.
diff --git a/packages/cultcache-py/pyproject.toml b/packages/cultcache-py/pyproject.toml
index 93ebf849..6c46d102 100644
--- a/packages/cultcache-py/pyproject.toml
+++ b/packages/cultcache-py/pyproject.toml
@@ -4,11 +4,11 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "cultcache-py"
-version = "0.1.0"
-description = "Python CultCache, CultNet, and CultMesh runtime package for GameCult typed state."
+version = "0.3.0"
+description = "Python CultCache runtime for GameCult typed state."
 readme = "README.md"
 requires-python = ">=3.10"
-license = { text = "Private GameCult infrastructure" }
+license = "MIT"
 authors = [{ name = "GameCult" }]
 classifiers = [
   "Programming Language :: Python :: 3",
@@ -17,23 +17,11 @@ classifiers = [
   "Programming Language :: Python :: 3.12",
 ]
 dependencies = ["msgpack>=1.0"]
-
-[project.optional-dependencies]
-msgpack = ["msgpack>=1.0"]
-crypto = ["cryptography>=42"]
-
 [project.scripts]
 cultcache-py-interop = "cultcache_py.interop:main"
-cultnet-py-interop = "cultnet_py.interop_peer:main"
-cultcache-py-benchmark = "cultcache_py.benchmark:main"
-cultcache-py-compare-csharp = "cultcache_py.compare_csharp:main"
-cultcache-py-verify = "cultcache_py.verify:main"
-cultmesh-py-daemon = "cultmesh_py.daemon:main"
 
 [tool.setuptools.packages.find]
 where = ["src"]
 
 [tool.setuptools.package-data]
 cultcache_py = ["py.typed"]
-cultnet_py = ["py.typed"]
-cultmesh_py = ["py.typed"]
diff --git a/packages/cultcache-py/src/cultcache_py/cache.py b/packages/cultcache-py/src/cultcache_py/cache.py
index 0ffdd18a..0da2c04a 100644
--- a/packages/cultcache-py/src/cultcache_py/cache.py
+++ b/packages/cultcache-py/src/cultcache_py/cache.py
@@ -1,15 +1,52 @@
 from __future__ import annotations
 
-from dataclasses import dataclass, field
-from typing import Any, Generic, TypeVar
+import functools
+import threading
+from dataclasses import dataclass, field, replace
+from typing import Any, Callable, Generic, TypeVar
 
 from .backing_store import BackingStore, CultCacheEnvelope
 from .documents import DocumentDefinition, extract_value
 
 T = TypeVar("T")
+F = TypeVar("F", bound=Callable[..., Any])
 GLOBAL_KEY = "__global__"
 
 
+def _locked(method: F) -> F:
+    """Runs a read holding the cache's lock. Reads are reentrant and may run inside a mutation."""
+
+    @functools.wraps(method)
+    def wrapper(self: "CultCache", *args: Any, **kwargs: Any) -> Any:
+        with self._lock:
+            return method(self, *args, **kwargs)
+
+    return wrapper  # type: ignore[return-value]
+
+
+def _mutating(method: F) -> F:
+    """Runs an attach, pull, registration, write or delete holding the cache's lock, so its validation,
+    store I/O and apply cannot interleave with another thread's. One started on a thread that is already
+    inside a mutation of this cache (from a store call, decoder, encoder, extractor or updater) raises
+    before touching anything."""
+
+    @functools.wraps(method)
+    def wrapper(self: "CultCache", *args: Any, **kwargs: Any) -> Any:
+        if self._mutating_thread == threading.get_ident():
+            raise CultCacheError(
+                f"CultCache refuses a re-entrant {method.__name__}: a mutation cannot start from inside a store call, "
+                "decoder, encoder, extractor or updater of another mutation on the same cache"
+            )
+        with self._lock:
+            self._mutating_thread = threading.get_ident()
+            try:
+                return method(self, *args, **kwargs)
+            finally:
+                self._mutating_thread = None
+
+    return wrapper  # type: ignore[return-value]
+
+
 class CultCacheError(RuntimeError):
     pass
 
@@ -17,14 +54,34 @@ class CultCacheError(RuntimeError):
 @dataclass
 class _State:
     documents: dict[str, DocumentDefinition[Any]] = field(default_factory=dict)
+    documents_by_schema_name: dict[str, DocumentDefinition[Any]] = field(default_factory=dict)
     values: dict[str, dict[str, Any]] = field(default_factory=dict)
     envelopes: dict[str, dict[str, CultCacheEnvelope]] = field(default_factory=dict)
-    stores_by_type: dict[str, list[BackingStore]] = field(default_factory=dict)
-    generic_stores: list[BackingStore] = field(default_factory=list)
+    stores_by_type: dict[str, BackingStore] = field(default_factory=dict)
+    generic_store: BackingStore | None = None
     name_extractors: dict[str, str | Any] = field(default_factory=dict)
     index_extractors: dict[str, dict[str, str | Any]] = field(default_factory=dict)
     names: dict[tuple[str, str], str] = field(default_factory=dict)
     indexes: dict[tuple[str, str, str], str] = field(default_factory=dict)
+    # The name and index values each held record produced when it was admitted. Removing a
+    # record reads these and runs no extractor, so removal has no fallible step.
+    lookup_keys: dict[str, dict[str, "_LookupKeys"]] = field(default_factory=dict)
+    # Load compatibility shim: a global persisted under a key other than GLOBAL_KEY is held as that
+    # type's global under GLOBAL_KEY, and its persisted key is kept here so the first write or delete
+    # of that global removes it from the home store. Remove once no store holds a global under a key
+    # other than GLOBAL_KEY.
+    legacy_global_keys: dict[str, str] = field(default_factory=dict)
+
+
+@dataclass(frozen=True)
+class _LookupKeys:
+    name: str | None
+    indexes: dict[str, str]
+
+
+_Names = dict[tuple[str, str], str]
+_Indexes = dict[tuple[str, str, str], str]
+_LookupKeysByType = dict[str, dict[str, _LookupKeys]]
 
 
 class CultCacheBuilder:
@@ -68,54 +125,176 @@ class CultCache:
 
     def __init__(self) -> None:
         self._state = _State()
+        # Mutations hold this lock and refuse to start on the thread already inside one (see _mutating).
+        # It is reentrant so a mutation's extractors, decoders and updaters may still read the cache.
+        # Single-structure reads (get, get_all, get_envelope, key lookups) stay unlocked. The guarantee is
+        # per call: each reads one dict under the GIL and sees it wholly before or after a write's install.
+        # Two unlocked calls can straddle a write or pull, and see different states.
+        self._lock = threading.RLock()
+        self._mutating_thread: int | None = None
 
+    @_mutating
     def register_document_type(self, document: DocumentDefinition[Any]) -> None:
+        self._register_document_type(document)
+
+    def _register_document_type(self, document: DocumentDefinition[Any]) -> None:
         if document.type in self._state.documents:
             raise CultCacheError(f"Document type already registered: {document.type}")
-        self._state.documents[document.type] = document
+        schema_name = document.catalog_entry().schema_name
+        if schema_name in self._state.documents_by_schema_name:
+            raise CultCacheError(f"Document schema name already registered: {schema_name}")
+        name_extractors = dict(self._state.name_extractors)
+        index_extractors = {type: dict(indexes) for type, indexes in self._state.index_extractors.items()}
         if document.name is not None:
-            self.register_name_lookup(document, document.name)
-        for index, extractor in document.indexes.items():
-            self.register_index(document, index, extractor)
+            name_extractors[document.type] = document.name
+        if document.indexes:
+            index_extractors.setdefault(document.type, {}).update(document.indexes)
+        self._install_lookups(name_extractors, index_extractors)
+        self._state.documents[document.type] = document
+        self._state.documents_by_schema_name[schema_name] = document
 
+    @_mutating
     def register_registry(self, documents: list[DocumentDefinition[Any]] | tuple[DocumentDefinition[Any], ...]) -> None:
         for document in documents:
-            self.register_document_type(document)
+            self._register_document_type(document)
 
+    @_mutating
     def register_name_lookup(self, document: DocumentDefinition[Any], extractor: str | Any) -> None:
         self._assert_registered(document)
-        self._state.name_extractors[document.type] = extractor
-        self._rebuild_indexes()
+        name_extractors = dict(self._state.name_extractors)
+        name_extractors[document.type] = extractor
+        self._install_lookups(name_extractors, self._state.index_extractors)
 
+    @_mutating
     def register_index(self, document: DocumentDefinition[Any], index: str, extractor: str | Any) -> None:
         self._assert_registered(document)
-        self._state.index_extractors.setdefault(document.type, {})[index] = extractor
-        self._rebuild_indexes()
+        index_extractors = {type: dict(indexes) for type, indexes in self._state.index_extractors.items()}
+        index_extractors.setdefault(document.type, {})[index] = extractor
+        self._install_lookups(self._state.name_extractors, index_extractors)
 
+    def _install_lookups(
+        self, name_extractors: dict[str, str | Any], index_extractors: dict[str, dict[str, str | Any]]
+    ) -> None:
+        """Derives every lookup under the candidate extractors, then installs extractors and lookups
+        together. An extractor that raises on a held value installs nothing."""
+        names, indexes, lookup_keys = self._derive_lookups(self._state.values, name_extractors, index_extractors)
+        (
+            self._state.name_extractors,
+            self._state.index_extractors,
+            self._state.names,
+            self._state.indexes,
+            self._state.lookup_keys,
+        ) = (name_extractors, index_extractors, names, indexes, lookup_keys)
+
+    @_mutating
     def add_backing_store(self, store: BackingStore, types: list[str] | tuple[str, ...] | set[str]) -> None:
+        """Makes the store home to the given types, or the generic store when there are none.
+
+        A type has exactly one home store, and attaching cannot move the home of a record the cache holds.
+        """
+        types = list(types)
+        if not types:
+            self._add_generic_store(store)
+            return
         for type in types:
-            self._state.stores_by_type.setdefault(type, []).append(store)
+            if type in self._state.stores_by_type:
+                raise CultCacheError(
+                    f"Document type {type} is already routed to another backing store; it cannot also route to this one"
+                )
+        routes = dict(self._state.stores_by_type)
+        routes.update({type: store for type in types})
+        self._refuse_home_moves(routes, self._state.generic_store)
+        self._state.stores_by_type = routes
 
+    @_mutating
     def add_generic_store(self, store: BackingStore) -> None:
-        self._state.generic_stores.append(store)
+        """Makes the store home to every type no other store claims. A cache has at most one."""
+        self._add_generic_store(store)
 
+    def _add_generic_store(self, store: BackingStore) -> None:
+        if self._state.generic_store is not None:
+            raise CultCacheError(
+                "Backing store would be a second generic store; name the types it is home to"
+            )
+        self._refuse_home_moves(self._state.stores_by_type, store)
+        self._state.generic_store = store
+
+    def _refuse_home_moves(self, routes: dict[str, BackingStore], generic: BackingStore | None) -> None:
+        for type, values in self._state.values.items():
+            if not values:
+                continue
+            before = self._state.stores_by_type.get(type, self._state.generic_store)
+            after = routes.get(type, generic)
+            if before is not after:
+                raise CultCacheError(
+                    f"Attaching this backing store would move {type} from {self._describe(before, routes, generic)} "
+                    f"to {self._describe(after, routes, generic)}; attach routed stores before the generic store"
+                )
+
+    @staticmethod
+    def _describe(store: BackingStore | None, routes: dict[str, BackingStore], generic: BackingStore | None) -> str:
+        if store is None:
+            return "memory"
+        if store is generic:
+            return "the generic store"
+        return "the store routed to " + ", ".join(sorted(type for type, routed in routes.items() if routed is store))
+
+    @_mutating
     def pull_all_backing_stores(self) -> None:
-        self._state.values.clear()
-        self._state.envelopes.clear()
+        """Builds the complete next state (values, envelopes, name and index lookups) in local
+        structures, running every check and every user extractor; the cache's state is replaced
+        only once that build finishes, so a refused load admits nothing."""
+        loaded_values: dict[str, dict[str, Any]] = {}
+        loaded_envelopes: dict[str, dict[str, CultCacheEnvelope]] = {}
+        loaded_legacy_global_keys: dict[str, str] = {}
+        routes, generic = self._state.stores_by_type, self._state.generic_store
         seen_globals: set[str] = set()
-        for store in [*self._all_specific_stores(), *self._state.generic_stores]:
+        stores: list[BackingStore] = []
+        for candidate in [*self._state.stores_by_type.values(), self._state.generic_store]:
+            if candidate is not None and all(candidate is not store for store in stores):
+                stores.append(candidate)
+        for store in stores:
             for envelope in store.pull_all():
-                document = self._state.documents.get(envelope.type)
+                document = self._resolve_document_for_envelope(envelope)
                 if document is None:
                     raise CultCacheError(f"Unknown persisted document type: {envelope.type}")
+                if envelope.type != document.type:
+                    envelope = CultCacheEnvelope(
+                        key=envelope.key,
+                        type=document.type,
+                        payload=envelope.payload,
+                        stored_at=envelope.stored_at,
+                        schema_id=envelope.schema_id,
+                        catalog_entry=envelope.catalog_entry,
+                    )
+                home = routes.get(envelope.type, generic)
+                if home is not store:
+                    raise CultCacheError(
+                        f"{envelope.type} record {envelope.key} was loaded from {self._describe(store, routes, generic)}, "
+                        f"but its home is {self._describe(home, routes, generic)}"
+                    )
                 if document.global_document:
-                    if envelope.type in seen_globals and envelope.key == GLOBAL_KEY:
+                    if envelope.type in seen_globals:
                         raise CultCacheError(f"Duplicate global document for type: {envelope.type}")
                     seen_globals.add(envelope.type)
+                    if envelope.key != GLOBAL_KEY:
+                        loaded_legacy_global_keys[envelope.type] = envelope.key
+                        envelope = replace(envelope, key=GLOBAL_KEY)
                 value = document.decode_payload(envelope.payload)
-                self._state.values.setdefault(envelope.type, {})[envelope.key] = value
-                self._state.envelopes.setdefault(envelope.type, {})[envelope.key] = envelope
-        self._rebuild_indexes()
+                loaded_values.setdefault(envelope.type, {})[envelope.key] = value
+                loaded_envelopes.setdefault(envelope.type, {})[envelope.key] = envelope
+        loaded_names, loaded_indexes, loaded_lookup_keys = self._derive_lookups(
+            loaded_values, self._state.name_extractors, self._state.index_extractors
+        )
+        # Plain attribute assignments: nothing fallible runs once the swap begins.
+        (
+            self._state.values,
+            self._state.envelopes,
+            self._state.names,
+            self._state.indexes,
+            self._state.lookup_keys,
+            self._state.legacy_global_keys,
+        ) = (loaded_values, loaded_envelopes, loaded_names, loaded_indexes, loaded_lookup_keys, loaded_legacy_global_keys)
 
     def get(self, document: DocumentDefinition[T], key: str) -> T | None:
         self._assert_registered(document)
@@ -155,6 +334,9 @@ class CultCache:
         self._assert_registered(document)
         return self._state.names.get((document.type, name))
 
+    # Name and index resolution read the lookup and then the values, two structures a pull swaps and a
+    # write updates in sequence, so they hold the lock to resolve a key and its value from one state.
+    @_locked
     def get_by_name(self, document: DocumentDefinition[T], name: str) -> T | None:
         key = self.get_key_by_name(document, name)
         return None if key is None else self.get(document, key)
@@ -163,17 +345,19 @@ class CultCache:
         self._assert_registered(document)
         return self._state.indexes.get((document.type, index, value))
 
+    @_locked
     def get_by_index(self, document: DocumentDefinition[T], index: str, value: str) -> T | None:
         key = self.get_key_by_index(document, index, value)
         return None if key is None else self.get(document, key)
 
+    @_mutating
     def put(self, document: DocumentDefinition[T], key: str, value: T) -> None:
+        self._put(document, key, value)
+
+    def _put(self, document: DocumentDefinition[T], key: str, value: T) -> None:
         self._assert_registered(document)
         if document.global_document and key != GLOBAL_KEY:
             raise CultCacheError(f"Global document {document.type} must use key {GLOBAL_KEY}")
-        values = self._state.values.setdefault(document.type, {})
-        envelopes = self._state.envelopes.setdefault(document.type, {})
-        old_value = values.get(key)
         catalog_entry = document.catalog_entry()
         envelope = CultCacheEnvelope.create(
             key=key,
@@ -182,100 +366,139 @@ class CultCache:
             schema_id=catalog_entry.schema_id,
             catalog_entry=catalog_entry,
         )
-        stores = self._stores_for_type(document.type)
-        for store in stores:
-            store.push(envelope)
-        if old_value is not None:
-            self._remove_value_indexes(document.type, key, old_value)
-        values[key] = value
-        envelopes[key] = envelope
-        self._add_value_indexes(document.type, key, value)
+        self._write(document, [(envelope, value)], batch=False)
 
+    @_mutating
     def put_envelope(self, document: DocumentDefinition[T], envelope: CultCacheEnvelope) -> T:
         self._assert_registered(document)
-        if envelope.type != document.type:
-            raise CultCacheError(
-                f"Envelope type {envelope.type} does not match document type {document.type}"
-            )
-        values = self._state.values.setdefault(document.type, {})
-        envelopes = self._state.envelopes.setdefault(document.type, {})
-        old_value = values.get(envelope.key)
+        self._check_envelope(document, envelope)
         value = document.decode_payload(envelope.payload)
-        for store in self._stores_for_type(document.type):
-            store.push(envelope)
-        if old_value is not None:
-            self._remove_value_indexes(document.type, envelope.key, old_value)
-        values[envelope.key] = value
-        envelopes[envelope.key] = envelope
-        self._add_value_indexes(document.type, envelope.key, value)
+        self._write(document, [(envelope, value)], batch=False)
         return value
 
+    @_mutating
     def put_envelopes(self, document: DocumentDefinition[T], envelopes: list[CultCacheEnvelope]) -> list[T]:
         self._assert_registered(document)
         values: list[T] = []
         for envelope in envelopes:
-            if envelope.type != document.type:
-                raise CultCacheError(
-                    f"Envelope type {envelope.type} does not match document type {document.type}"
-                )
-            if document.global_document and envelope.key != GLOBAL_KEY:
-                raise CultCacheError(f"Global document {document.type} must use key {GLOBAL_KEY}")
+            self._check_envelope(document, envelope)
             values.append(document.decode_payload(envelope.payload))
-
-        stores = self._stores_for_type(document.type)
-        for store in stores:
-            store.push_all(envelopes)
-        values_by_key = self._state.values.setdefault(document.type, {})
-        envelopes_by_key = self._state.envelopes.setdefault(document.type, {})
-        for envelope, value in zip(envelopes, values):
-            old_value = values_by_key.get(envelope.key)
-            if old_value is not None:
-                self._remove_value_indexes(document.type, envelope.key, old_value)
-            values_by_key[envelope.key] = value
-            envelopes_by_key[envelope.key] = envelope
-            self._add_value_indexes(document.type, envelope.key, value)
+        self._write(document, list(zip(envelopes, values)), batch=True)
         return values
 
+    @staticmethod
+    def _check_envelope(document: DocumentDefinition[Any], envelope: CultCacheEnvelope) -> None:
+        if envelope.type != document.type:
+            raise CultCacheError(
+                f"Envelope type {envelope.type} does not match document type {document.type}"
+            )
+        if not envelope.key or not envelope.key.strip():
+            raise CultCacheError(f"Envelope key for document type {document.type} must be non-empty")
+        if document.global_document and envelope.key != GLOBAL_KEY:
+            raise CultCacheError(f"Global document {document.type} must use key {GLOBAL_KEY}")
+
+    def _write(
+        self, document: DocumentDefinition[Any], records: list[tuple[CultCacheEnvelope, Any]], *, batch: bool
+    ) -> None:
+        """Validates every record (home and name and index extractors included) before the store is
+        touched; once the store accepts, applying to the cache has no fallible step."""
+        type = document.type
+        name_extractor = self._state.name_extractors.get(type)
+        index_extractors = self._state.index_extractors.get(type, {})
+        admitted = [
+            (envelope, value, self._lookup_keys_for(value, name_extractor, index_extractors))
+            for envelope, value in records
+        ]
+        store = self._store_for_type(type)
+        legacy_key = self._state.legacy_global_keys.get(type)
+        if store is not None:
+            if batch:
+                store.push_all([envelope for envelope, _ in records])
+            else:
+                store.push(records[0][0])
+            if legacy_key is not None:
+                self._retire_legacy_global(store, type, legacy_key)
+        self._state.legacy_global_keys.pop(type, None)
+        values = self._state.values.setdefault(type, {})
+        envelopes = self._state.envelopes.setdefault(type, {})
+        lookup_keys = self._state.lookup_keys.setdefault(type, {})
+        for envelope, value, keys in admitted:
+            self._remove_lookups(type, envelope.key)
+            values[envelope.key] = value
+            envelopes[envelope.key] = envelope
+            lookup_keys[envelope.key] = keys
+            if keys.name is not None:
+                self._state.names[(type, keys.name)] = envelope.key
+            for index, index_value in keys.indexes.items():
+                self._state.indexes[(type, index, index_value)] = envelope.key
+
+    @staticmethod
+    def _retire_legacy_global(store: BackingStore, type: str, legacy_key: str) -> None:
+        """The first write of a global loaded from a legacy key removes that record in the same write. If
+        the removal fails, the new record is taken back out, so the store keeps only the legacy record."""
+        try:
+            store.delete(type, legacy_key)
+        except BaseException:
+            try:
+                store.delete(type, GLOBAL_KEY)
+            except Exception:  # noqa: BLE001 - the removal failure is the error reported
+                pass
+            raise
+
+    @_mutating
     def put_global(self, document: DocumentDefinition[T], value: T) -> None:
         self._assert_global(document)
-        self.put(document, GLOBAL_KEY, value)
+        self._put(document, GLOBAL_KEY, value)
 
+    @_mutating
     def update(self, document: DocumentDefinition[T], key: str, updater: Any) -> T:
+        return self._update(document, key, updater)
+
+    def _update(self, document: DocumentDefinition[T], key: str, updater: Any) -> T:
         current = self.get_required(document, key)
         updated = updater(current)
-        self.put(document, key, updated)
+        self._put(document, key, updated)
         return updated
 
+    @_mutating
     def update_global(self, document: DocumentDefinition[T], updater: Any) -> T:
         self._assert_global(document)
-        return self.update(document, GLOBAL_KEY, updater)
+        return self._update(document, GLOBAL_KEY, updater)
 
+    @_mutating
     def delete(self, document: DocumentDefinition[Any], key: str) -> None:
-        self._assert_registered(document)
-        for store in self._stores_for_type(document.type):
-            store.delete(document.type, key)
-        values = self._state.values.get(document.type)
-        old_value = None if values is None else values.pop(key, None)
-        if values == {}:
-            self._state.values.pop(document.type, None)
-        envelopes = self._state.envelopes.get(document.type)
-        if envelopes is not None:
-            envelopes.pop(key, None)
-            if envelopes == {}:
-                self._state.envelopes.pop(document.type, None)
-        if old_value is not None:
-            self._remove_value_indexes(document.type, key, old_value)
+        self._delete(document, key)
 
+    def _delete(self, document: DocumentDefinition[Any], key: str) -> None:
+        self._assert_registered(document)
+        store = self._store_for_type(document.type)
+        legacy_key = self._state.legacy_global_keys.get(document.type) if key == GLOBAL_KEY else None
+        if store is not None:
+            store.delete(document.type, key if legacy_key is None else legacy_key)
+        if legacy_key is not None:
+            del self._state.legacy_global_keys[document.type]
+        self._remove_lookups(document.type, key)
+        for by_type in (self._state.values, self._state.envelopes, self._state.lookup_keys):
+            held = by_type.get(document.type)
+            if held is not None:
+                held.pop(key, None)
+                if not held:
+                    by_type.pop(document.type, None)
+
+    @_mutating
     def delete_global(self, document: DocumentDefinition[Any]) -> None:
         self._assert_global(document)
-        self.delete(document, GLOBAL_KEY)
+        self._delete(document, GLOBAL_KEY)
 
+    # Snapshots iterate dicts a concurrent write would resize mid-iteration, so they hold the lock.
+    @_locked
     def snapshot(self) -> dict[str, dict[str, Any]]:
         out: dict[str, dict[str, Any]] = {}
         for type, values in self._state.values.items():
             out[type] = dict(values)
         return out
 
+    @_locked
     def snapshot_envelopes(self) -> list[CultCacheEnvelope]:
         return [
             envelope
@@ -283,75 +506,70 @@ class CultCache:
             for envelope in envelopes.values()
         ]
 
-    def _stores_for_type(self, type: str) -> list[BackingStore]:
-        specific = self._state.stores_by_type.get(type)
-        return specific if specific else self._state.generic_stores
+    def _store_for_type(self, type: str) -> BackingStore | None:
+        """The store that claims the type, else the generic store.
 
-    def _all_specific_stores(self) -> list[BackingStore]:
-        stores: list[BackingStore] = []
-        seen: set[int] = set()
-        for routed in self._state.stores_by_type.values():
-            for store in routed:
-                marker = id(store)
-                if marker not in seen:
-                    stores.append(store)
-                    seen.add(marker)
-        return stores
+        Returns None only for a cache with no stores, which is an in-memory cache.
+        """
+        store = self._state.stores_by_type.get(type, self._state.generic_store)
+        if store is None and self._state.stores_by_type:
+            raise CultCacheError(f"No backing store is home to document type: {type}")
+        return store
 
-    def _rebuild_indexes(self) -> None:
-        self._state.names.clear()
-        self._state.indexes.clear()
-        for type, values in self._state.values.items():
+    @staticmethod
+    def _lookup_keys_for(
+        value: Any, name_extractor: str | Any | None, index_extractors: dict[str, str | Any]
+    ) -> _LookupKeys:
+        name = None if name_extractor is None else extract_value(value, name_extractor)
+        indexes: dict[str, str] = {}
+        for index, extractor in index_extractors.items():
+            index_value = extract_value(value, extractor)
+            if index_value is not None:
+                indexes[index] = str(index_value)
+        return _LookupKeys(None if name is None else str(name), indexes)
+
+    def _derive_lookups(
+        self,
+        values_by_type: dict[str, dict[str, Any]],
+        name_extractors: dict[str, str | Any],
+        index_extractors: dict[str, dict[str, str | Any]],
+    ) -> tuple[_Names, _Indexes, _LookupKeysByType]:
+        """Builds name and index lookups for the given values in fresh dicts, touching no cache state."""
+        names: _Names = {}
+        indexes: _Indexes = {}
+        lookup_keys: _LookupKeysByType = {}
+        for type, values in values_by_type.items():
+            name_extractor = name_extractors.get(type)
+            type_index_extractors = index_extractors.get(type, {})
             for key, value in values.items():
-                self._add_value_indexes(type, key, value)
+                keys = self._lookup_keys_for(value, name_extractor, type_index_extractors)
+                lookup_keys.setdefault(type, {})[key] = keys
+                if keys.name is not None:
+                    names[(type, keys.name)] = key
+                for index, index_value in keys.indexes.items():
+                    indexes[(type, index, index_value)] = key
+        return names, indexes, lookup_keys
 
-    def _add_value_indexes(self, type: str, key: str, value: Any) -> None:
-        name_extractor = self._state.name_extractors.get(type)
-        if name_extractor is not None:
-            name = extract_value(value, name_extractor)
-            if name is not None:
-                self._state.names[(type, str(name))] = key
-        for index, extractor in self._state.index_extractors.get(type, {}).items():
-            index_value = extract_value(value, extractor)
-            if index_value is not None:
-                self._state.indexes[(type, index, str(index_value))] = key
-
-    def _remove_value_indexes(self, type: str, key: str, value: Any) -> None:
-        name_extractor = self._state.name_extractors.get(type)
-        if name_extractor is not None:
-            name = extract_value(value, name_extractor)
-            if name is not None:
-                self._remove_name_index(type, key, str(name))
-        for index, extractor in self._state.index_extractors.get(type, {}).items():
-            index_value = extract_value(value, extractor)
-            if index_value is not None:
-                self._remove_secondary_index(type, key, index, str(index_value))
-
-    def _remove_name_index(self, type: str, key: str, name: str) -> None:
-        lookup_key = (type, name)
-        if self._state.names.get(lookup_key) != key:
+    def _remove_lookups(self, type: str, key: str) -> None:
+        """Removes the lookups the held record produced at admission, handing a name or index value to
+        another held record that produced it too. Reads stored lookup keys only; runs no extractor."""
+        held = self._state.lookup_keys.get(type, {})
+        keys = held.get(key)
+        if keys is None:
             return
-        self._state.names.pop(lookup_key, None)
-        name_extractor = self._state.name_extractors.get(type)
-        if name_extractor is None:
-            return
-        for candidate_key, candidate in self._state.values.get(type, {}).items():
-            candidate_name = extract_value(candidate, name_extractor)
-            if candidate_key != key and candidate_name is not None and str(candidate_name) == name:
-                self._state.names[lookup_key] = candidate_key
-
-    def _remove_secondary_index(self, type: str, key: str, index: str, value: str) -> None:
-        lookup_key = (type, index, value)
-        if self._state.indexes.get(lookup_key) != key:
-            return
-        self._state.indexes.pop(lookup_key, None)
-        extractor = self._state.index_extractors.get(type, {}).get(index)
-        if extractor is None:
-            return
-        for candidate_key, candidate in self._state.values.get(type, {}).items():
-            candidate_value = extract_value(candidate, extractor)
-            if candidate_key != key and candidate_value is not None and str(candidate_value) == value:
-                self._state.indexes[lookup_key] = candidate_key
+        if keys.name is not None and self._state.names.get((type, keys.name)) == key:
+            del self._state.names[(type, keys.name)]
+            for candidate_key, candidate in held.items():
+                if candidate_key != key and candidate.name == keys.name:
+                    self._state.names[(type, keys.name)] = candidate_key
+        for index, index_value in keys.indexes.items():
+            lookup_key = (type, index, index_value)
+            if self._state.indexes.get(lookup_key) != key:
+                continue
+            del self._state.indexes[lookup_key]
+            for candidate_key, candidate in held.items():
+                if candidate_key != key and candidate.indexes.get(index) == index_value:
+                    self._state.indexes[lookup_key] = candidate_key
 
     def _assert_registered(self, document: DocumentDefinition[Any]) -> None:
         if self._state.documents.get(document.type) is not document:
@@ -361,3 +579,9 @@ class CultCache:
         self._assert_registered(document)
         if not document.global_document:
             raise CultCacheError(f"Document type is not global: {document.type}")
+
+    def _resolve_document_for_envelope(self, envelope: CultCacheEnvelope) -> DocumentDefinition[Any] | None:
+        document = self._state.documents.get(envelope.type)
+        if document is not None:
+            return document
+        return self._state.documents_by_schema_name.get(envelope.type)
diff --git a/packages/cultcache-py/src/cultcache_py/stores.py b/packages/cultcache-py/src/cultcache_py/stores.py
index 3587e717..697882e0 100644
--- a/packages/cultcache-py/src/cultcache_py/stores.py
+++ b/packages/cultcache-py/src/cultcache_py/stores.py
@@ -178,12 +178,25 @@ def _decode_v1_snapshot(decoded: Any) -> list[CultCacheEnvelope] | None:
             raise ValueError("CultCache persisted records must declare storedAt")
         catalog_entry = catalog_by_schema_id.get(schema_id)
         if catalog_entry is None:
-            raise ValueError(f'CultCache persisted record "{key}" references missing schema id "{schema_id}"')
+            schema_version = _infer_schema_version_from_payload(_normalize_payload(payload))
+            schema_name = _infer_schema_name(schema_version) if schema_version is not None else None
+            if schema_name is None:
+                raise ValueError(f'CultCache persisted record "{key}" references missing schema id "{schema_id}"')
+            catalog_entry = CultCacheSchemaCatalogEntry(
+                schema_id=schema_id,
+                schema_name=schema_name,
+                schema_version=schema_version,
+                content_hash=schema_id,
+                canonical_schema_json="",
+                compatible_schema_ids=(),
+                members=(),
+            )
+        normalized_payload = _normalize_payload(payload)
         envelopes.append(
             CultCacheEnvelope(
                 key=key,
                 type=catalog_entry.schema_name,
-                payload=_normalize_payload(payload),
+                payload=normalized_payload,
                 stored_at=stored_at,
                 schema_id=schema_id,
                 catalog_entry=catalog_entry,
@@ -316,3 +329,27 @@ def _normalize_payload(payload: Any) -> bytes:
     if isinstance(payload, list) and all(isinstance(item, int) and 0 <= item <= 255 for item in payload):
         return bytes(payload)
     raise ValueError("CultCache record payload must be binary MessagePack bytes")
+
+
+def _infer_schema_version_from_payload(payload: bytes) -> str | None:
+    try:
+        msgpack = SingleFileMessagePackBackingStore._msgpack()
+        decoded = msgpack.unpackb(payload, raw=False)
+    except Exception:
+        return None
+    if isinstance(decoded, list) and decoded and isinstance(decoded[0], str):
+        return decoded[0]
+    if isinstance(decoded, dict):
+        value = decoded.get("schemaVersion", decoded.get("schema_version"))
+        return value if isinstance(value, str) else None
+    return None
+
+
+def _infer_schema_name(schema_version: str) -> str | None:
+    marker = schema_version.rfind(".v")
+    if marker <= 0:
+        return None
+    version = schema_version[marker + 2:]
+    if not version or not version.isdigit():
+        return None
+    return schema_version[:marker]
diff --git a/packages/cultcache-py/src/cultmesh_py/simulation.py b/packages/cultcache-py/src/cultmesh_py/simulation.py
deleted file mode 100644
index 4b727fd5..00000000
--- a/packages/cultcache-py/src/cultmesh_py/simulation.py
+++ /dev/null
@@ -1,135 +0,0 @@
-from __future__ import annotations
-
-from dataclasses import dataclass
-from datetime import UTC, datetime
-import hashlib
-from typing import Any
-
-from cultcache_py import define_database_entry_type
-from cultcache_py.documents import DocumentDefinition
-
-from .node import CultMeshNode
-
-SIMULATION_FACT_DOCUMENT_TYPE = "gamecult.mesh.simulation_fact"
-SIMULATION_FACT_SCHEMA_VERSION = "gamecult.mesh.simulation_fact.v1"
-
-
-@dataclass(frozen=True)
-class CultMeshSimulationFact:
-    fact_id: str
-    shard_id: str
-    shard_epoch: int
-    frame: int
-    subject_id: str
-    claim_kind: str
-    claim_hash: str
-    claim_summary: str | None
-    witness_count: int
-    support_weight: float
-    total_weight: float
-    confidence: float
-    committed_at: str
-
-    @staticmethod
-    def compute_fact_id(candidate: dict[str, Any]) -> str:
-        canonical = "\x1f".join([
-            _candidate_string(candidate, "shardId", "shard_id"),
-            str(_candidate_int(candidate, "shardEpoch", "shard_epoch")),
-            str(_candidate_int(candidate, "frame", "frame")),
-            _candidate_string(candidate, "subjectId", "subject_id"),
-            _candidate_string(candidate, "claimKind", "claim_kind"),
-        ])
-        return hashlib.sha256(canonical.encode("utf-8")).hexdigest()
-
-    @staticmethod
-    def create_record_key(candidate: dict[str, Any]) -> str:
-        return f"simulation:{CultMeshSimulationFact.compute_fact_id(candidate)}"
-
-    @staticmethod
-    def from_candidate(candidate: dict[str, Any], *, committed_at: str | None = None) -> "CultMeshSimulationFact":
-        return CultMeshSimulationFact(
-            fact_id=CultMeshSimulationFact.compute_fact_id(candidate),
-            shard_id=_candidate_string(candidate, "shardId", "shard_id"),
-            shard_epoch=_candidate_int(candidate, "shardEpoch", "shard_epoch"),
-            frame=_candidate_int(candidate, "frame", "frame"),
-            subject_id=_candidate_string(candidate, "subjectId", "subject_id"),
-            claim_kind=_candidate_string(candidate, "claimKind", "claim_kind"),
-            claim_hash=_candidate_string(candidate, "claimHash", "claim_hash"),
-            claim_summary=_candidate_optional_string(candidate, "claimSummary", "claim_summary"),
-            witness_count=_candidate_int(candidate, "witnessCount", "witness_count"),
-            support_weight=_candidate_float(candidate, "supportWeight", "support_weight"),
-            total_weight=_candidate_float(candidate, "totalWeight", "total_weight"),
-            confidence=_candidate_float(candidate, "confidence", "confidence"),
-            committed_at=committed_at or datetime.now(UTC).isoformat(),
-        )
-
-
-simulation_fact_document: DocumentDefinition[CultMeshSimulationFact] = define_database_entry_type(
-    SIMULATION_FACT_DOCUMENT_TYPE,
-    [
-        ("fact_id", 0),
-        ("shard_id", 1),
-        ("shard_epoch", 2),
-        ("frame", 3),
-        ("subject_id", 4),
-        ("claim_kind", 5),
-        ("claim_hash", 6),
-        ("claim_summary", 7, None),
-        ("witness_count", 8),
-        ("support_weight", 9),
-        ("total_weight", 10),
-        ("confidence", 11),
-        ("committed_at", 12),
-    ],
-    cls=CultMeshSimulationFact,
-    name="fact_id",
-    indexes={"shard": "shard_id", "frame": "frame", "subject": "subject_id", "claim_kind": "claim_kind"},
-    schema_name=SIMULATION_FACT_DOCUMENT_TYPE,
-    schema_version=SIMULATION_FACT_SCHEMA_VERSION,
-)
-
-
-@dataclass(frozen=True)
-class CultMeshSimulationFactCommit:
-    key: str
-    fact: CultMeshSimulationFact
-
-
-@dataclass
-class CultMeshSimulationFactCommitter:
-    node: CultMeshNode
-    document: DocumentDefinition[CultMeshSimulationFact] = simulation_fact_document
-
-    def __post_init__(self) -> None:
-        if all(document.type != self.document.type for document in self.node.documents):
-            self.node.register_document(self.document)
-
-    def commit(self, candidate: dict[str, Any], *, committed_at: str | None = None) -> CultMeshSimulationFactCommit:
-        if not bool(candidate.get("hasQuorum") if "hasQuorum" in candidate else candidate.get("has_quorum")):
-            raise ValueError("Simulation candidate cannot be committed before quorum")
-        key = CultMeshSimulationFact.create_record_key(candidate)
-        fact = CultMeshSimulationFact.from_candidate(candidate, committed_at=committed_at)
-        self.node.put(self.document, key, fact)
-        return CultMeshSimulationFactCommit(key=key, fact=fact)
-
-
-def _candidate_string(candidate: dict[str, Any], camel: str, snake: str) -> str:
-    value = candidate.get(camel, candidate.get(snake, ""))
-    if value is None:
-        return ""
-    return str(value)
-
-
-def _candidate_optional_string(candidate: dict[str, Any], camel: str, snake: str) -> str | None:
-    value = candidate.get(camel, candidate.get(snake))
-    if value is None:
-        return None
-    return str(value)
-
-
-def _candidate_int(candidate: dict[str, Any], camel: str, snake: str) -> int:
-    return int(candidate.get(camel, candidate.get(snake, 0)))
-
-
-def _candidate_float(candidate: dict[str, Any], camel: str, snake: str) -> float:
-    return float(candidate.get(camel, candidate.get(snake, 0.0)))
diff --git a/packages/cultcache-py/tests/test_cultcache.py b/packages/cultcache-py/tests/test_cultcache.py
index 16d72d98..ac81cc6d 100644
--- a/packages/cultcache-py/tests/test_cultcache.py
+++ b/packages/cultcache-py/tests/test_cultcache.py
@@ -1,23 +1,12 @@
-from __future__ import annotations
+from __future__ import annotations
 
-import json
-import os
-import socket
-import subprocess
-import sys
 import tempfile
 import threading
-import time
 import unittest
-import hashlib
-import hmac
-import io
-from dataclasses import asdict, dataclass
-from datetime import UTC, datetime, timedelta
+from dataclasses import asdict, dataclass, replace
 from pathlib import Path
-from typing import Callable
-from uuid import uuid4
-
+from cultcache_py.backing_store import CultCacheEnvelope
+from cultcache_py.cache import CultCacheError
 from cultcache_py import (
     CultCache,
     JsonLinesBackingStore,
@@ -25,154 +14,7 @@ from cultcache_py import (
     define_database_entry_type,
     define_document_type,
 )
-from cultcache_py.benchmark import run_benchmark
-from cultcache_py.compare_csharp import (
-    DEFAULT_PARITY_THRESHOLD,
-    DEFAULT_SAMPLE_COUNT,
-    _compare_common_metrics,
-    _median_result,
-    _parity_status,
-)
-from cultcache_py.interop import INTEROP_SCHEMA_VERSION, interop_note_document, read_note, write_note
-from cultcache_py.verify import verify
-from cultnet_py.interop_peer import append_shard_log_put, build_state, raw_snapshot_response
-from cultnet_py import (
-    compute_simulation_claim_hash,
-    CultNetDatabaseChange,
-    CultNetClientAuthorityScope,
-    CultNetRawClient,
-    CultNetRawDocumentRecord,
-    CultNetRawSnapshotResponse,
-    CultNetSchemaCatalog,
-    CultNetSchemaDescriptor,
-    CultNetShardCatalog,
-    CultNetShardDescriptor,
-    CultNetShardLogEntry,
-    CultNetShardLogResponse,
-    CultNetFileShardReplicaCursorStore,
-    CultNetFileShardMutationLogStore,
-    CultNetInMemoryShardReplicaCursorStore,
-    CultNetSchemaWriteForwarder,
-    CultNetSchemaShardLogFetcher,
-    CultNetSchemaShardSnapshotFetcher,
-    CultNetPeerError,
-    CultNetClientSecurityOptions,
-    CultNetSecret,
-    CultNetServerSecurityOptions,
-    CultNetShardReplicator,
-    CultNetShardReplicatorOptions,
-    CultNetShardMutationLogStore,
-    CultNetShardWriteForwarder,
-    CultNetSimulationConsensusOptions,
-    CultNetSimulationConsensusCandidate,
-    CultNetSimulationObservation,
-    CultNetSimulationObservationHub,
-    CultNetRudpPacket,
-    CultNetRudpPacketType,
-    CultNetRudpSendOptions,
-    CultNetRudpSession,
-    CultNetRudpSessionOptions,
-    CultNetRudpSocketMode,
-    CultNetRudpReconnectLoop,
-    CultNetRudpSocketTransportConnection,
-    CultNetRudpSocketTransportOptions,
-    TcpFramedTransportConnection,
-    CultNetWitnessArtifactBundle,
-    apply_raw_document_record,
-    apply_raw_snapshot,
-    apply_shard_log_response,
-    create_rudp_transport_profile,
-    create_tcp_framed_transport_profile,
-    create_reconnect_policy,
-    CultNetReconnectController,
-    database_subscribe,
-    database_unsubscribe,
-    decode_frame,
-    decode_rudp_packet,
-    decode_witness_artifact_bundle_payload,
-    document_delete,
-    document_put_raw,
-    encode_frame,
-    encode_rudp_packet,
-    encode_witness_artifact_bundle_payload,
-    hello,
-    login,
-    login_success,
-    parse_message,
-    register,
-    schema_catalog_request,
-    schema_document_map,
-    shard_catalog_request,
-    shard_log_request,
-    simulation_observation,
-    snapshot_request,
-    verify_session,
-    wire_message_schema_catalog,
-    wire_message_schema_descriptors,
-    witness_artifact_bundle,
-    compute_reconnect_delay_ms,
-)
-from cultmesh_py import create_node
-from cultmesh_py import (
-    CultMesh,
-    CultMeshDatabase,
-    CultMeshDatabaseChange,
-    CultMeshGameSessionOptions,
-    CultMeshNodeOptions,
-    CultMeshPeerCard,
-    CultMeshPeerCatalog,
-    CultMeshSimulationFact,
-    CultMeshAuthorityLease,
-    CultMeshAuthorityLeaseCatalog,
-    CultMeshHmacAuthorityLeaseVerifier,
-    CultMeshDiscoveryClient,
-    CultMeshPeerExchangeClient,
-    CultMeshPeerHealthMonitor,
-    CultMeshSimulationObservationFanout,
-    CultMeshSnapshotFanout,
-    CultMeshStreamCatalog,
-    CultMeshStreamConsumerProfile,
-    CultMeshStreamDescriptor,
-    CultMeshStreamFrameHandle,
-    CultMeshVerseCatalog,
-    CultMeshVerseCompatibility,
-    CultMeshVerseDescriptor,
-    CultMeshVerseDiscoveryClient,
-    READY_SCHEMA_VERSION,
-    peer_exchange_request,
-    simulation_fact_document,
-    verse_catalog_request,
-)
-
-
-def bind_udp_socket() -> socket.socket:
-    sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
-    sock.bind(("127.0.0.1", 0))
-    sock.settimeout(0.02)
-    return sock
-
-
-def pump_rudp_handshake(
-    client: CultNetRudpSocketTransportConnection,
-    server: CultNetRudpSocketTransportConnection,
-) -> None:
-    for _ in range(20):
-        server.receive_once()
-        client.receive_once()
-        server.receive_once()
-        if client.connected and server.connected:
-            return
-        time.sleep(0.005)
-    raise AssertionError("RUDP socket handshake did not complete")
-
-
-def receive_rudp_frame(transport: CultNetRudpSocketTransportConnection):
-    for _ in range(20):
-        frame = transport.receive_once()
-        if frame is not None:
-            return frame
-        time.sleep(0.005)
-    raise AssertionError("RUDP socket frame was not delivered")
+from cultcache_py.interop import read_note, write_note
 
 
 @dataclass
@@ -193,14 +35,6 @@ def item_doc():
 
 
 class CultCacheTests(unittest.TestCase):
-    def _wait_until(self, predicate: Callable[[], bool], *, timeout_seconds: float = 2.0) -> None:
-        deadline = time.monotonic() + timeout_seconds
-        while time.monotonic() < deadline:
-            if predicate():
-                return
-            time.sleep(0.01)
-        self.fail("Timed out waiting for condition")
-
     def test_round_trips_registered_documents(self) -> None:
         with tempfile.TemporaryDirectory() as tmp:
             document = item_doc()
@@ -351,6 +185,53 @@ class CultCacheTests(unittest.TestCase):
             self.assertEqual(raw[2][0][0], "app")
             self.assertEqual(raw[2][0][1], "settings")
 
+    def test_messagepack_store_recovers_schema_stamped_record_missing_catalog_entry(self) -> None:
+        try:
+            import msgpack  # type: ignore
+        except ModuleNotFoundError:
+            self.skipTest("msgpack optional dependency is not installed")
+
+        with tempfile.TemporaryDirectory() as tmp:
+            document = define_database_entry_type(
+                "runtime-policy",
+                [
+                    ("schema_version", 0),
+                    ("name", 1),
+                    ("value", 2),
+                ],
+                schema_id="schema-current",
+                schema_name="tests.schema_stamped_entry",
+                schema_version="tests.schema_stamped_entry.v1",
+            )
+            store_path = Path(tmp) / "missing-catalog.msgpack"
+            store_path.write_bytes(msgpack.packb([
+                "cultcache.store.v1",
+                [],
+                [[
+                    "record-1",
+                    "sha256:stale-schema-id-from-cold-record",
+                    "2026-06-25T12:00:00Z",
+                    msgpack.packb([
+                        "tests.schema_stamped_entry.v1",
+                        "schema-stamped",
+                        "still readable",
+                    ], use_bin_type=True),
+                ]],
+            ], use_bin_type=True))
+
+            cache = (
+                CultCache.builder()
+                .register_document_type(document)
+                .add_generic_store(SingleFileMessagePackBackingStore(store_path))
+                .build()
+            )
+
+            cache.pull_all_backing_stores()
+            self.assertEqual(cache.get_required(document, "record-1")["value"], "still readable")
+            envelope = cache.get_required_envelope(document, "record-1")
+            self.assertEqual(envelope.type, "runtime-policy")
+            self.assertEqual(envelope.schema_id, "sha256:stale-schema-id-from-cold-record")
+
     def test_interop_cli_helpers_round_trip_v1_store(self) -> None:
         with tempfile.TemporaryDirectory() as tmp:
             store_path = str(Path(tmp) / "cache.msgpack")
@@ -360,100 +241,549 @@ class CultCacheTests(unittest.TestCase):
             self.assertEqual(loaded["authorRuntimeId"], "python-test")
             self.assertIn("interop", loaded["tags"])
 
-    def test_benchmark_reports_core_hot_path_metrics(self) -> None:
-        result = run_benchmark(8)
-        metric_names = {metric["name"] for metric in result["metrics"]}
-        self.assertEqual(result["records"], 8)
-        self.assertEqual(result["wireMessageCount"], 8)
-        self.assertEqual(metric_names, {
-            "database_entry_encode",
-            "database_entry_decode",
-            "cultnet_frame_parse",
-            "raw_snapshot_apply",
-            "cache_upsert",
-            "cache_get",
-        })
-        self.assertTrue(all(metric["opsPerSecond"] > 0 for metric in result["metrics"]))
+    def test_second_generic_store_rejected(self) -> None:
+        with tempfile.TemporaryDirectory() as tmp:
+            cache = CultCache()
+            cache.add_generic_store(SingleFileMessagePackBackingStore(Path(tmp) / "a.cc"))
+            with self.assertRaisesRegex(CultCacheError, "second generic store"):
+                cache.add_generic_store(SingleFileMessagePackBackingStore(Path(tmp) / "b.cc"))
 
-    def test_compare_csharp_median_result_summarizes_samples(self) -> None:
-        self.assertEqual(DEFAULT_SAMPLE_COUNT, 3)
-        self.assertEqual(DEFAULT_PARITY_THRESHOLD, 0.90)
-        samples = [
-            {
-                "runtime": "python",
-                "records": 3,
-                "metrics": [
-                    {"name": "cache_get", "operations": 3, "elapsedMs": 30.0, "opsPerSecond": 100.0},
-                    {"name": "cache_upsert", "operations": 3, "elapsedMs": 60.0, "opsPerSecond": 50.0},
-                ],
-            },
-            {
-                "runtime": "python",
-                "records": 3,
-                "metrics": [
-                    {"name": "cache_get", "operations": 3, "elapsedMs": 10.0, "opsPerSecond": 300.0},
-                    {"name": "cache_upsert", "operations": 3, "elapsedMs": 20.0, "opsPerSecond": 150.0},
-                ],
-            },
-            {
-                "runtime": "python",
-                "records": 3,
-                "metrics": [
-                    {"name": "cache_get", "operations": 3, "elapsedMs": 20.0, "opsPerSecond": 200.0},
-                    {"name": "cache_upsert", "operations": 3, "elapsedMs": 40.0, "opsPerSecond": 75.0},
-                ],
-            },
-        ]
+    def test_type_claimed_twice_rejected(self) -> None:
+        with tempfile.TemporaryDirectory() as tmp:
+            cache = CultCache()
+            cache.add_backing_store(SingleFileMessagePackBackingStore(Path(tmp) / "a.cc"), ["item"])
+            with self.assertRaisesRegex(CultCacheError, "already routed"):
+                cache.add_backing_store(SingleFileMessagePackBackingStore(Path(tmp) / "b.cc"), ["settings", "item"])
+            # A refused registration claims nothing, so "settings" is still free.
+            cache.add_backing_store(SingleFileMessagePackBackingStore(Path(tmp) / "c.cc"), ["settings"])
 
-        summarized = _median_result(samples)
+    def test_types_route_to_home_store(self) -> None:
+        with tempfile.TemporaryDirectory() as tmp:
+            item = item_doc()
+            settings = define_database_entry_type("settings", [("theme", 0)])
+            generic_path = Path(tmp) / "generic.cc"
+            settings_path = Path(tmp) / "settings.cc"
 
-        self.assertEqual(summarized["sampleCount"], 3)
-        self.assertEqual(summarized["metrics"][0]["name"], "cache_get")
-        self.assertEqual(summarized["metrics"][0]["elapsedMs"], 20.0)
-        self.assertEqual(summarized["metrics"][0]["opsPerSecond"], 200.0)
-        self.assertEqual(summarized["metrics"][1]["opsPerSecond"], 75.0)
+            def build() -> CultCache:
+                return (
+                    CultCache.builder()
+                    .register_document_type(item)
+                    .register_document_type(settings)
+                    .add_backing_store(SingleFileMessagePackBackingStore(settings_path), ["settings"])
+                    .add_generic_store(SingleFileMessagePackBackingStore(generic_path))
+                    .build()
+                )
 
-    def test_compare_csharp_marks_threshold_status_per_metric(self) -> None:
-        python_result = {
-            "metrics": [
-                {"name": "cache_get", "operations": 3, "elapsedMs": 2.0, "opsPerSecond": 50.0},
-                {"name": "cache_upsert", "operations": 3, "elapsedMs": 1.0, "opsPerSecond": 95.0},
-            ],
-        }
-        csharp_result = {
-            "metrics": [
-                {"name": "cache_get", "operations": 3, "elapsedMs": 1.0, "opsPerSecond": 100.0},
-                {"name": "cache_upsert", "operations": 3, "elapsedMs": 1.0, "opsPerSecond": 100.0},
-            ],
-        }
+            cache = build()
+            cache.put(item, "item:potion", Item(name="Potion", category="Consumable", value=50))
+            cache.put(settings, "app", {"theme": "ash"})
 
-        comparison = _compare_common_metrics(python_result, csharp_result, parity_threshold=0.90)
-        by_name = {item["name"]: item for item in comparison}
+            generic = SingleFileMessagePackBackingStore(generic_path).pull_all()
+            routed = SingleFileMessagePackBackingStore(settings_path).pull_all()
+            self.assertEqual([(e.key, e.type) for e in generic], [("item:potion", "item")])
+            self.assertEqual([(e.key, e.type) for e in routed], [("app", "settings")])
 
-        self.assertFalse(by_name["cache_get"]["meetsParityThreshold"])
-        self.assertTrue(by_name["cache_upsert"]["meetsParityThreshold"])
-        self.assertEqual(_parity_status(comparison, "ok"), "below-threshold")
-        self.assertEqual(_parity_status([by_name["cache_upsert"]], "ok"), "meets-threshold")
-        self.assertEqual(_parity_status(comparison, "failed"), "unknown")
+            cache.delete(settings, "app")
+            self.assertEqual(SingleFileMessagePackBackingStore(settings_path).pull_all(), [])
+            self.assertEqual(len(SingleFileMessagePackBackingStore(generic_path).pull_all()), 1)
 
-    def test_compare_csharp_marks_meets_threshold_when_all_common_metrics_pass(self) -> None:
-        comparison = _compare_common_metrics(
-            {
-                "metrics": [
-                    {"name": "cache_get", "operations": 3, "elapsedMs": 1.0, "opsPerSecond": 95.0},
-                    {"name": "cache_upsert", "operations": 3, "elapsedMs": 1.0, "opsPerSecond": 120.0},
-                ],
-            },
-            {
-                "metrics": [
-                    {"name": "cache_get", "operations": 3, "elapsedMs": 1.0, "opsPerSecond": 100.0},
-                    {"name": "cache_upsert", "operations": 3, "elapsedMs": 1.0, "opsPerSecond": 100.0},
-                ],
-            },
-            parity_threshold=0.90,
+            reloaded = build()
+            reloaded.pull_all_backing_stores()
+            self.assertEqual(reloaded.get_required(item, "item:potion").value, 50)
+            self.assertIsNone(reloaded.get(settings, "app"))
+
+    def test_attach_that_would_move_a_held_record_home_is_refused(self) -> None:
+        with tempfile.TemporaryDirectory() as tmp:
+            settings = define_database_entry_type("settings", [("theme", 0)])
+            generic_path = Path(tmp) / "generic.cc"
+            settings_path = Path(tmp) / "settings.cc"
+            cache = (
+                CultCache.builder()
+                .register_document_type(settings)
+                .add_generic_store(SingleFileMessagePackBackingStore(generic_path))
+                .build()
+            )
+            cache.put(settings, "app", {"theme": "v1-generic"})
+
+            with self.assertRaisesRegex(
+                CultCacheError, "would move settings from the generic store to the store routed to settings"
+            ):
+                cache.add_backing_store(SingleFileMessagePackBackingStore(settings_path), ["settings"])
+            # Nothing attached: the next write still lands in the generic store.
+            cache.put(settings, "app", {"theme": "v2-generic"})
+            generic = SingleFileMessagePackBackingStore(generic_path).pull_all()
+            self.assertEqual([(e.key, e.type) for e in generic], [("app", "settings")])
+            self.assertFalse(settings_path.exists())
+
+    def test_load_from_a_store_that_is_not_the_record_home_is_refused(self) -> None:
+        with tempfile.TemporaryDirectory() as tmp:
+            settings = define_database_entry_type("settings", [("theme", 0)])
+            generic_path = Path(tmp) / "generic.cc"
+            settings_path = Path(tmp) / "settings.cc"
+            writer = CultCache.builder().register_document_type(settings).add_generic_store(
+                SingleFileMessagePackBackingStore(generic_path)
+            ).build()
+            writer.put(settings, "app", {"theme": "stray"})
+            generic_bytes = generic_path.read_bytes()
+
+            cache = (
+                CultCache.builder()
+                .register_document_type(settings)
+                .add_backing_store(SingleFileMessagePackBackingStore(settings_path), ["settings"])
+                .add_generic_store(SingleFileMessagePackBackingStore(generic_path))
+                .build()
+            )
+            # The cache already holds a record, in its home store, before the refused load.
+            cache.put(settings, "held", {"theme": "home"})
+            before = cache.snapshot_envelopes()
+            settings_bytes = settings_path.read_bytes()
+            with self.assertRaisesRegex(
+                CultCacheError,
+                "settings record app was loaded from the generic store, but its home is the store routed to settings",
+            ):
+                cache.pull_all_backing_stores()
+            self.assertIsNone(cache.get(settings, "app"))
+            self.assertEqual(cache.snapshot_envelopes(), before)
+            self.assertEqual(cache.get_required(settings, "held"), {"theme": "home"})
+            self.assertEqual(generic_path.read_bytes(), generic_bytes)
+            self.assertEqual(settings_path.read_bytes(), settings_bytes)
+
+    def test_pull_with_duplicate_global_leaves_cache_unchanged(self) -> None:
+        with tempfile.TemporaryDirectory() as tmp:
+            item = item_doc()
+            settings = define_document_type("settings", global_document=True)
+            store_path = Path(tmp) / "generic.cc"
+            cache = (
+                CultCache.builder()
+                .register_document_type(item)
+                .register_document_type(settings)
+                .add_generic_store(SingleFileMessagePackBackingStore(store_path))
+                .build()
+            )
+            cache.put(item, "item:potion", Item(name="Potion", category="Consumable", value=50))
+            cache.put_global(settings, {"theme": "ash"})
+            before = cache.snapshot_envelopes()
+
+            # A second record of the global type lands in the store file behind the cache's back.
+            stray = replace(cache.get_required_envelope(settings, CultCache.GLOBAL_KEY), key="stray")
+            SingleFileMessagePackBackingStore(store_path).push(stray)
+
+            with self.assertRaisesRegex(CultCacheError, "Duplicate global document for type: settings"):
+                cache.pull_all_backing_stores()
+            self.assertEqual(cache.snapshot_envelopes(), before)
+            self.assertEqual(cache.get_required(item, "item:potion").value, 50)
+            self.assertEqual(cache.get_key_by_name(item, "Potion"), "item:potion")
+            self.assertEqual(cache.get_required_global(settings)["theme"], "ash")
+
+    def test_pull_with_throwing_index_accessor_leaves_cache_unchanged(self) -> None:
+        def category(item: Item) -> str:
+            if item.name == "Bomb":
+                raise ValueError("category accessor refuses Bomb")
+            return item.category
+
+        with tempfile.TemporaryDirectory() as tmp:
+            item = define_document_type(
+                "item",
+                encode=lambda value: asdict(value),
+                decode=lambda raw: Item(**raw),
+                name="name",
+                indexes={"category": category},
+            )
+            settings = define_document_type("settings", global_document=True)
+            store_path = Path(tmp) / "generic.cc"
+            cache = (
+                CultCache.builder()
+                .register_document_type(item)
+                .register_document_type(settings)
+                .add_generic_store(SingleFileMessagePackBackingStore(store_path))
+                .build()
+            )
+            cache.put(item, "item:potion", Item(name="Potion", category="Consumable", value=50))
+            cache.put_global(settings, {"theme": "ash"})
+            before_envelopes = cache.snapshot_envelopes()
+            before_values = cache.snapshot()
+
+            # A record whose index accessor throws lands in the store file behind the cache's back.
+            bomb = replace(
+                cache.get_required_envelope(item, "item:potion"),
+                key="item:bomb",
+                payload=item.encode_payload(Item(name="Bomb", category="Explosive", value=1)),
+            )
+            SingleFileMessagePackBackingStore(store_path).push(bomb)
+
+            with self.assertRaisesRegex(ValueError, "category accessor refuses Bomb"):
+                cache.pull_all_backing_stores()
+            self.assertEqual(cache.snapshot_envelopes(), before_envelopes)
+            self.assertEqual(cache.snapshot(), before_values)
+            self.assertEqual(cache.get_required(item, "item:potion").value, 50)
+            self.assertIsNone(cache.get(item, "item:bomb"))
+            self.assertEqual(cache.get_key_by_name(item, "Potion"), "item:potion")
+            self.assertIsNone(cache.get_key_by_name(item, "Bomb"))
+            self.assertEqual(cache.get_key_by_index(item, "category", "Consumable"), "item:potion")
+            self.assertEqual(cache.get_required_global(settings)["theme"], "ash")
+
+    def _store_state(self, path: Path) -> list[tuple[str, str, bytes]]:
+        return sorted((e.type, e.key, e.payload) for e in SingleFileMessagePackBackingStore(path).pull_all())
+
+    def test_put_with_throwing_name_extractor_changes_neither_store_nor_cache(self) -> None:
+        def name(value: dict) -> str:
+            if value["n"] == "bad":
+                raise ValueError("extractor refuses bad")
+            return value["n"]
+
+        with tempfile.TemporaryDirectory() as tmp:
+            item = define_document_type("item", name=name)
+            path = Path(tmp) / "generic.cc"
+            cache = CultCache.builder().register_document_type(item).add_generic_store(
+                SingleFileMessagePackBackingStore(path)
+            ).build()
+            cache.put(item, "k", {"n": "good"})
+            store_before, cache_before = self._store_state(path), cache.snapshot_envelopes()
+
+            with self.assertRaisesRegex(ValueError, "extractor refuses bad"):
+                cache.put(item, "k", {"n": "bad"})
+            self.assertEqual(self._store_state(path), store_before)
+            self.assertEqual(cache.snapshot_envelopes(), cache_before)
+            self.assertEqual(cache.get_required(item, "k"), {"n": "good"})
+            self.assertEqual(cache.get_key_by_name(item, "good"), "k")
+
+    def test_overwrite_under_a_registered_extractor_that_now_raises_changes_neither_store_nor_cache(self) -> None:
+        refusing = {"on": False}
+
+        def category(value: dict) -> str:
+            if refusing["on"]:
+                raise ValueError("extractor refuses now")
+            return value["c"]
+
+        with tempfile.TemporaryDirectory() as tmp:
+            item = define_document_type("item")
+            path = Path(tmp) / "generic.cc"
+            cache = CultCache.builder().register_document_type(item).add_generic_store(
+                SingleFileMessagePackBackingStore(path)
+            ).build()
+            cache.put(item, "k", {"c": "old"})
+            cache.register_index(item, "category", category)
+            refusing["on"] = True
+            store_before, cache_before = self._store_state(path), cache.snapshot_envelopes()
+
+            with self.assertRaisesRegex(ValueError, "extractor refuses now"):
+                cache.put(item, "k", {"c": "new"})
+            self.assertEqual(self._store_state(path), store_before)
+            self.assertEqual(cache.snapshot_envelopes(), cache_before)
+            self.assertEqual(cache.get_key_by_index(item, "category", "old"), "k")
+            # Deleting runs no extractor: it uses the lookup keys stored when the record was admitted.
+            cache.delete(item, "k")
+            self.assertIsNone(cache.get_key_by_index(item, "category", "old"))
+
+    def test_registering_an_extractor_that_raises_on_a_held_value_installs_nothing(self) -> None:
+        def name(value: dict) -> str:
+            if value["n"] == "bad":
+                raise ValueError("extractor refuses bad")
+            return value["n"]
+
+        with tempfile.TemporaryDirectory() as tmp:
+            item = define_document_type("item")
+            path = Path(tmp) / "generic.cc"
+            cache = CultCache.builder().register_document_type(item).add_generic_store(
+                SingleFileMessagePackBackingStore(path)
+            ).build()
+            cache.put(item, "old", {"n": "bad"})
+            with self.assertRaisesRegex(ValueError, "extractor refuses bad"):
+                cache.register_name_lookup(item, name)
+            cache.put(item, "old", {"n": "fine"})
+            self.assertEqual(cache.get_required(item, "old"), {"n": "fine"})
+            self.assertIsNone(cache.get_key_by_name(item, "fine"))
+            self.assertEqual([item.decode_payload(e.payload) for e in SingleFileMessagePackBackingStore(path).pull_all()], [{"n": "fine"}])
+
+    def test_put_envelopes_with_throwing_extractor_changes_neither_store_nor_cache(self) -> None:
+        def name(value: dict) -> str:
+            if value["n"] == "bad":
+                raise ValueError("extractor refuses bad")
+            return value["n"]
+
+        with tempfile.TemporaryDirectory() as tmp:
+            item = define_document_type("item", name=name)
+            path = Path(tmp) / "generic.cc"
+            cache = CultCache.builder().register_document_type(item).add_generic_store(
+                SingleFileMessagePackBackingStore(path)
+            ).build()
+            cache.put(item, "seed", {"n": "seed"})
+            seed = cache.get_required_envelope(item, "seed")
+            first = replace(seed, key="a", payload=item.encode_payload({"n": "a"}))
+            second = replace(seed, key="b", payload=item.encode_payload({"n": "bad"}))
+            store_before, cache_before = self._store_state(path), cache.snapshot_envelopes()
+
+            with self.assertRaisesRegex(ValueError, "extractor refuses bad"):
+                cache.put_envelopes(item, [first, second])
+            self.assertEqual(self._store_state(path), store_before)
+            self.assertEqual(cache.snapshot_envelopes(), cache_before)
+            self.assertIsNone(cache.get_key_by_name(item, "a"))
+
+    def test_global_replace_with_failing_store_push_keeps_old_global(self) -> None:
+        class FailingPushStore(SingleFileMessagePackBackingStore):
+            fail = False
+
+            def push(self, envelope):
+                if self.fail:
+                    raise OSError("disk full")
+                super().push(envelope)
+
+        with tempfile.TemporaryDirectory() as tmp:
+            settings = define_document_type("settings", global_document=True)
+            path = Path(tmp) / "generic.cc"
+            store = FailingPushStore(path)
+            cache = CultCache.builder().register_document_type(settings).add_generic_store(store).build()
+            cache.put_global(settings, {"theme": "base"})
+            store_before, cache_before = self._store_state(path), cache.snapshot_envelopes()
+            store.fail = True
+
+            with self.assertRaisesRegex(OSError, "disk full"):
+                cache.put_global(settings, {"theme": "new"})
+            with self.assertRaisesRegex(CultCacheError, "must use key __global__"):
+                cache.put(settings, "other", {"theme": "new"})
+            self.assertEqual(self._store_state(path), store_before)
+            self.assertEqual(cache.snapshot_envelopes(), cache_before)
+            self.assertEqual(cache.get_required_global(settings), {"theme": "base"})
+
+    @staticmethod
+    def _pausing_store(path: Path, barrier: threading.Barrier, resume: threading.Event):
+        """A store whose first push writes, meets the other thread at the barrier, then waits until that
+        thread's call has returned (or a timeout: a locked cache makes the other thread wait on us)."""
+
+        class PausingStore(SingleFileMessagePackBackingStore):
+            pushes = 0
+            paused = False
+            other_reached_store_while_paused = False
+
+            def push(self, envelope):
+                self.other_reached_store_while_paused |= self.paused
+                self.pushes += 1
+                super().push(envelope)
+                if self.pushes == 1:
+                    self.paused = True
+                    barrier.wait(timeout=5)
+                    resume.wait(timeout=0.5)
+                    self.paused = False
+
+        return PausingStore(path)
+
+    @staticmethod
+    def _run_racing(first, second, resume: threading.Event) -> list[BaseException]:
+        errors: list[BaseException] = []
+
+        def run(action, signal):
+            try:
+                action()
+            except BaseException as error:  # noqa: BLE001 - reported to the test
+                errors.append(error)
+            finally:
+                if signal:
+                    resume.set()
+
+        threads = [threading.Thread(target=run, args=(first, False)), threading.Thread(target=run, args=(second, True))]
+        for thread in threads:
+            thread.start()
+        for thread in threads:
+            thread.join(timeout=10)
+        return errors
+
+    def test_concurrent_put_and_attach_cannot_land_record_in_non_home_store(self) -> None:
+        with tempfile.TemporaryDirectory() as tmp:
+            settings = define_database_entry_type("settings", [("theme", 0)])
+            generic_path, settings_path = Path(tmp) / "generic.cc", Path(tmp) / "settings.cc"
+            barrier, resume = threading.Barrier(2), threading.Event()
+            generic = self._pausing_store(generic_path, barrier, resume)
+            cache = CultCache.builder().register_document_type(settings).add_generic_store(generic).build()
+
+            def attach() -> None:
+                barrier.wait(timeout=5)
+                cache.add_backing_store(SingleFileMessagePackBackingStore(settings_path), ["settings"])
+
+            errors = self._run_racing(lambda: cache.put(settings, "app", {"theme": "t"}), attach, resume)
+
+            # Either the attach was refused (the record is held, so its home cannot move) or it won;
+            # in every case each held record must be in the store that is its home.
+            home = SingleFileMessagePackBackingStore(generic_path if errors else settings_path)
+            self.assertEqual([(e.key, e.type) for e in home.pull_all()], [("app", "settings")])
+            self.assertTrue(all(isinstance(error, CultCacheError) for error in errors), errors)
+
+    def test_concurrent_global_puts_cannot_both_reach_disk(self) -> None:
+        with tempfile.TemporaryDirectory() as tmp:
+            settings = define_document_type("settings", global_document=True)
+            path = Path(tmp) / "generic.cc"
+            barrier, resume = threading.Barrier(2), threading.Event()
+            store = self._pausing_store(path, barrier, resume)
+            cache = CultCache.builder().register_document_type(settings).add_generic_store(store).build()
+
+            def second() -> None:
+                barrier.wait(timeout=5)
+                cache.put_global(settings, {"theme": "second"})
+
+            errors = self._run_racing(lambda: cache.put_global(settings, {"theme": "first"}), second, resume)
+
+            self.assertEqual(errors, [])
+            # While the first write was between its store push and its apply, the second never reached disk.
+            self.assertFalse(store.other_reached_store_while_paused)
+            on_disk = SingleFileMessagePackBackingStore(path).pull_all()
+            self.assertEqual(len(on_disk), 1)
+            self.assertEqual(on_disk[0].payload, cache.get_required_envelope(settings, CultCache.GLOBAL_KEY).payload)
+            self.assertEqual(cache.get_required_global(settings), {"theme": "second"})
+
+    @staticmethod
+    def _envelope(document, key: str, value) -> CultCacheEnvelope:
+        catalog_entry = document.catalog_entry()
+        return CultCacheEnvelope.create(
+            key=key,
+            type=document.type,
+            payload=document.encode_payload(value),
+            schema_id=catalog_entry.schema_id,
+            catalog_entry=catalog_entry,
         )
 
-        self.assertEqual(_parity_status(comparison, "ok"), "meets-threshold")
+    def test_legacy_key_global_loads_without_writing_and_first_write_leaves_one_global(self) -> None:
+        with tempfile.TemporaryDirectory() as tmp:
+            settings = define_document_type("settings", global_document=True)
+            path = Path(tmp) / "generic.cc"
+
+            def build() -> CultCache:
+                return CultCache.builder().register_document_type(settings).add_generic_store(
+                    SingleFileMessagePackBackingStore(path)
+                ).build()
+
+            SingleFileMessagePackBackingStore(path).push(self._envelope(settings, "legacy", {"theme": "old"}))
+            stored_bytes = path.read_bytes()
+
+            cache = build()
+            cache.pull_all_backing_stores()
+            self.assertEqual(cache.get_global(settings), {"theme": "old"})
+            self.assertEqual(cache.get(settings, CultCache.GLOBAL_KEY), {"theme": "old"})
+            self.assertEqual(path.read_bytes(), stored_bytes)
+
+            cache.put_global(settings, {"theme": "new"})
+            self.assertEqual([e.key for e in SingleFileMessagePackBackingStore(path).pull_all()], [CultCache.GLOBAL_KEY])
+            reloaded = build()
+            reloaded.pull_all_backing_stores()
+            self.assertEqual(reloaded.get_required_global(settings), {"theme": "new"})
+
+    def test_deleting_a_legacy_key_global_removes_the_legacy_record(self) -> None:
+        with tempfile.TemporaryDirectory() as tmp:
+            settings = define_document_type("settings", global_document=True)
+            path = Path(tmp) / "generic.cc"
+            SingleFileMessagePackBackingStore(path).push(self._envelope(settings, "legacy", {"theme": "old"}))
+            cache = CultCache.builder().register_document_type(settings).add_generic_store(
+                SingleFileMessagePackBackingStore(path)
+            ).build()
+            cache.pull_all_backing_stores()
+
+            cache.delete_global(settings)
+            self.assertEqual(SingleFileMessagePackBackingStore(path).pull_all(), [])
+            self.assertIsNone(cache.get_global(settings))
+
+    def test_two_globals_of_one_type_on_disk_are_refused_under_any_keys(self) -> None:
+        with tempfile.TemporaryDirectory() as tmp:
+            settings = define_document_type("settings", global_document=True)
+            for keys in (["one", "two"], ["legacy", CultCache.GLOBAL_KEY]):
+                path = Path(tmp) / f"{keys[0]}.cc"
+                store = SingleFileMessagePackBackingStore(path)
+                store.push_all([self._envelope(settings, key, {"theme": key}) for key in keys])
+                cache = CultCache.builder().register_document_type(settings).add_generic_store(store).build()
+                with self.assertRaisesRegex(CultCacheError, "Duplicate global document for type: settings"):
+                    cache.pull_all_backing_stores()
+                self.assertIsNone(cache.get_global(settings))
+
+    def test_decoder_writing_during_pull_raises_and_changes_neither_store_nor_cache(self) -> None:
+        with tempfile.TemporaryDirectory() as tmp:
+            path = Path(tmp) / "generic.cc"
+            holder: dict[str, CultCache] = {}
+
+            def decode(raw):
+                holder["cache"].put(item, "side", {"name": "side"})
+                return raw
+
+            item = define_document_type("item", decode=decode, encode=lambda value: value)
+            store = SingleFileMessagePackBackingStore(path)
+            store.push(self._envelope(item, "a", {"name": "a"}))
+            stored_bytes = path.read_bytes()
+            cache = holder["cache"] = CultCache.builder().register_document_type(item).add_generic_store(store).build()
+
+            with self.assertRaisesRegex(CultCacheError, "re-entrant put"):
+                cache.pull_all_backing_stores()
+            self.assertEqual(path.read_bytes(), stored_bytes)
+            self.assertEqual(cache.snapshot_envelopes(), [])
+            self.assertIsNone(cache.get(item, "side"))
+            # The refusal released the cache: an ordinary write still works.
+            cache.put(item, "b", {"name": "b"})
+            self.assertEqual(cache.get(item, "b"), {"name": "b"})
+
+    def test_index_extractor_writing_during_register_index_raises_and_installs_nothing(self) -> None:
+        thing = define_document_type("thing")
+        cache = CultCache.builder().register_document_type(thing).build()
+        cache.put(thing, "k1", {"n": "one", "cat": "x"})
+
+        def category(value: dict) -> str:
+            cache.put(thing, "k2", {"n": "two", "cat": "y"})
+            return value["cat"]
+
+        with self.assertRaisesRegex(CultCacheError, "re-entrant put"):
+            cache.register_index(thing, "cat", category)
+        self.assertIsNone(cache.get(thing, "k2"))
+        self.assertNotIn("thing", cache._state.index_extractors)
+        self.assertIsNone(cache.get_key_by_index(thing, "cat", "x"))
+
+    def test_put_envelope_refuses_a_global_under_another_key(self) -> None:
+        with tempfile.TemporaryDirectory() as tmp:
+            settings = define_document_type("settings", global_document=True)
+            path = Path(tmp) / "generic.cc"
+            cache = CultCache.builder().register_document_type(settings).add_generic_store(
+                SingleFileMessagePackBackingStore(path)
+            ).build()
+            cache.put_global(settings, {"theme": "base"})
+            store_before, cache_before = self._store_state(path), cache.snapshot_envelopes()
+            stray = replace(cache.get_required_envelope(settings, CultCache.GLOBAL_KEY), key="stray")
+
+            with self.assertRaisesRegex(CultCacheError, "must use key __global__"):
+                cache.put_envelope(settings, stray)
+            with self.assertRaisesRegex(CultCacheError, "must be non-empty"):
+                cache.put_envelope(settings, replace(stray, key=""))
+            self.assertEqual(self._store_state(path), store_before)
+            self.assertEqual(cache.snapshot_envelopes(), cache_before)
+
+    def test_refused_put_leaves_no_empty_type_entry(self) -> None:
+        def refuse(value: dict) -> dict:
+            raise ValueError("encode refuses")
+
+        with tempfile.TemporaryDirectory() as tmp:
+            other = define_document_type("other", encode=refuse)
+            path = Path(tmp) / "generic.cc"
+            cache = CultCache.builder().register_document_type(other).add_generic_store(
+                SingleFileMessagePackBackingStore(path)
+            ).build()
+            with self.assertRaisesRegex(ValueError, "encode refuses"):
+                cache.put(other, "x", {"a": 1})
+            self.assertEqual(cache.snapshot(), {})
+            self.assertFalse(path.exists())
+
+    def test_attach_with_empty_type_list_is_the_generic_store(self) -> None:
+        with tempfile.TemporaryDirectory() as tmp:
+            settings = define_database_entry_type("settings", [("theme", 0)])
+            store_path = Path(tmp) / "generic.cc"
+            cache = CultCache.builder().register_document_type(settings).build()
+            cache.add_backing_store(SingleFileMessagePackBackingStore(store_path), [])
+            cache.put(settings, "y", {"theme": "t"})
+            self.assertEqual(
+                [(e.key, e.type) for e in SingleFileMessagePackBackingStore(store_path).pull_all()],
+                [("y", "settings")],
+            )
+            with self.assertRaisesRegex(CultCacheError, "second generic store"):
+                cache.add_backing_store(SingleFileMessagePackBackingStore(Path(tmp) / "b.cc"), [])
+
+    def test_zero_store_cache_writes_and_deletes_in_memory(self) -> None:
+        settings = define_database_entry_type("settings", [("theme", 0)])
+        cache = CultCache.builder().register_document_type(settings).build()
+        cache.put(settings, "x", {"theme": "mem"})
+        self.assertEqual(cache.get_required(settings, "x"), {"theme": "mem"})
+        cache.delete(settings, "x")
+        self.assertIsNone(cache.get(settings, "x"))
 
     def test_cache_put_without_backing_store_keeps_in_memory_value(self) -> None:
         document = define_database_entry_type(
@@ -471,4768 +801,6 @@ class CultCacheTests(unittest.TestCase):
         self.assertEqual(cache.get(document, "item:one"), {"name": "one", "value": 1})
         self.assertEqual(cache.get_required_envelope(document, "item:one").key, "item:one")
 
-    def test_verify_reports_python_runtime_surface_health(self) -> None:
-        result = verify(records=4)
-
-        self.assertEqual(result["status"], "ok")
-        self.assertEqual(
-            {check["name"] for check in result["checks"]},
-            {
-                "public_exports",
-                "typed_markers",
-                "local_cultmesh_wire_smoke",
-                "cultmesh_capability_truth",
-                "benchmark_sanity",
-            },
-        )
-        by_name = {check["name"]: check for check in result["checks"]}
-        self.assertEqual(by_name["public_exports"]["missing"], {})
-        self.assertEqual(by_name["cultmesh_capability_truth"]["failures"], [])
-
-    def test_cultnet_security_options_match_cultlib_defaults_and_environment_rules(self) -> None:
-        client = CultNetClientSecurityOptions.development()
-        server = CultNetServerSecurityOptions.development()
-
-        self.assertEqual(client.connection_key, "gamecult-dev-connection-key")
-        self.assertEqual(server.connection_key, "gamecult-dev-connection-key")
-        self.assertTrue(server.is_development)
-        self.assertEqual(server.to_client_options().connection_key, client.connection_key)
-        self.assertEqual(client.encryption_key(), hashlib.sha256(b"gamecult-dev-connection-key").digest())
-        self.assertEqual(server.session_signing_key(), hashlib.sha256(b"gamecult-dev-session-signing-secret").digest())
-        self.assertEqual(
-            CultNetServerSecurityOptions.from_environment({}, allow_development_defaults=True),
-            server,
-        )
-        with self.assertRaisesRegex(ValueError, "not configured"):
-            CultNetServerSecurityOptions.from_environment({})
-        with self.assertRaisesRegex(ValueError, "GAMECULT_SESSION_SIGNING_SECRET"):
-            CultNetServerSecurityOptions.from_environment({"GAMECULT_CONNECTION_KEY": "key"})
-        configured = CultNetServerSecurityOptions.from_environment({
-            "GAMECULT_CONNECTION_KEY": "prod-key",
-            "GAMECULT_SESSION_SIGNING_SECRET": "prod-secret",
-        })
-        self.assertEqual(configured.connection_key, "prod-key")
-        self.assertFalse(configured.is_development)
-
-    def test_cultnet_secret_helpers_validate_csharp_versioned_session_tokens(self) -> None:
-        security = CultNetServerSecurityOptions("connection-key", "session-secret")
-        user_id = uuid4()
-        expires = datetime(2035, 1, 2, 3, 4, 5, tzinfo=UTC)
-
-        token = CultNetSecret.create_session_token(user_id, expires, security, session_version=7)
-        payload_b64, signature_b64 = token.split(".")
-        self.assertEqual(
-            CultNetSecret.from_base64url(payload_b64).decode("utf-8"),
-            f"{user_id.hex}|{int(expires.timestamp())}|7",
-        )
-        self.assertEqual(
-            CultNetSecret.from_base64url(signature_b64),
-            hmac.new(
-                hashlib.sha256(b"session-secret").digest(),
-                CultNetSecret.from_base64url(payload_b64),
-                hashlib.sha256,
-            ).digest(),
-        )
-
-        validated = CultNetSecret.try_validate_session_token(
-            token,
-            security,
-            now_utc=datetime(2035, 1, 2, 3, 4, 4, tzinfo=UTC),
-        )
-        self.assertIsNotNone(validated)
-        assert validated is not None
-        self.assertEqual(validated.user_id, user_id)
-        self.assertEqual(validated.expires_at_utc, expires)
-        self.assertEqual(validated.session_version, 7)
-
-        tampered_payload = CultNetSecret.to_base64url(CultNetSecret.from_base64url(payload_b64) + b"tamper")
-        tampered = f"{tampered_payload}.{signature_b64}"
-        self.assertIsNone(CultNetSecret.try_validate_session_token(tampered, security))
-        self.assertIsNone(CultNetSecret.try_validate_session_token(token, security, now_utc=expires))
-
-    def test_cultnet_secret_helpers_validate_legacy_two_field_session_tokens(self) -> None:
-        security = CultNetServerSecurityOptions.development()
-        user_id = uuid4()
-        expires_at_seconds = int(datetime(2036, 1, 1, tzinfo=UTC).timestamp())
-        payload = f"{user_id.hex}|{expires_at_seconds}".encode("utf-8")
-        signature = hmac.new(security.session_signing_key(), payload, hashlib.sha256).digest()
-        token = f"{CultNetSecret.to_base64url(payload)}.{CultNetSecret.to_base64url(signature)}"
-
-        validated = CultNetSecret.try_validate_session_token(
-            token,
-            security,
-            now_utc=datetime(2035, 12, 31, tzinfo=UTC),
-        )
-
-        self.assertIsNotNone(validated)
-        assert validated is not None
-        self.assertEqual(validated.user_id, user_id)
-        self.assertEqual(validated.session_version, 0)
-
-    def test_cultnet_secret_encryption_helpers_are_optional_without_crypto_dependency(self) -> None:
-        nonce = b"123456789012"
-        security = CultNetServerSecurityOptions.development()
-        try:
-            encrypted = CultNetSecret.encrypt_string("hello", nonce, security.to_client_options())
-        except ImportError as exc:
-            self.assertIn("cryptography", str(exc))
-            return
-        self.assertEqual(CultNetSecret.decrypt_string(encrypted, nonce, security), "hello")
-
-    def test_cultnet_schema_message_frame_round_trip(self) -> None:
-        message = hello(
-            runtime_id="python-test",
-            supported_schema_versions=["cultnet.hello.v0"],
-            transport_profiles=[
-                {
-                    "schemaVersion": "cultnet.transport_profile.v0",
-                    "runtimeId": "python-test",
-                    "transports": [
-                        {
-                            "transportId": "test",
-                            "protocol": "tcp_framed",
-                            "channels": [{"channelId": "schema", "delivery": "reliable", "ordering": "ordered"}],
-                        }
-                    ],
-                }
-            ],
-        )
-        parsed = parse_message(decode_frame(encode_frame(message.to_bytes())))
-        self.assertEqual(parsed.schema_version, "cultnet.hello.v0")
-        self.assertEqual(parsed.body["runtimeId"], "python-test")
-        self.assertEqual(parsed.body["transportProfiles"][0]["transports"][0]["protocol"], "tcp_framed")
-
-    def test_cultnet_tcp_framed_transport_carries_schema_payloads_with_stats(self) -> None:
-        payload = b"cultnet-payload"
-        output = io.BytesIO()
-        sender = TcpFramedTransportConnection(
-            output,
-            profile=create_tcp_framed_transport_profile("sender", transport_id="test-tcp"),
-        )
-        sender.send("schema", payload)
-        self.assertEqual(sender.stats.frames_sent, 1)
-        self.assertEqual(sender.stats.bytes_sent, len(payload) + 4)
-        with self.assertRaisesRegex(ValueError, "only supports the schema channel"):
-            sender.send("unreliable", b"")
-
-        receiver = TcpFramedTransportConnection(
-            io.BytesIO(output.getvalue()),
-            profile=create_tcp_framed_transport_profile("receiver", transport_id="test-tcp"),
-        )
-        frame = receiver.receive()
-        self.assertEqual(frame.channel_id, "schema")
-        self.assertEqual(frame.payload, payload)
-        self.assertEqual(receiver.stats.frames_received, 1)
-        self.assertEqual(receiver.stats.bytes_received, len(payload) + 4)
-        self.assertEqual(receiver.profile["transports"][0]["protocol"], "tcp_framed")
-
-    def test_cultnet_raw_client_uses_schema_transport_factory(self) -> None:
-        import msgpack  # type: ignore
-
-        sent_messages: list[dict[str, object]] = []
-        test_case = self
-
-        class FakeSchemaTransport:
-            profile = create_tcp_framed_transport_profile("fake-client")
-
-            def __enter__(self) -> "FakeSchemaTransport":
-                return self
-
-            def __exit__(self, exc_type: object, exc: object, traceback: object) -> None:
-                self.close()
-
-            def send(self, channel_id: str, payload: bytes) -> None:
-                test_case.assertEqual(channel_id, "schema")
-                sent_messages.append(msgpack.unpackb(payload, raw=False))
-
-            def receive(self) -> object:
-                response = {
-                    "schemaVersion": "cultnet.schema_catalog_response.v0",
-                    "messageId": "transport-factory",
-                    "schemas": [],
-                }
-                return type("Frame", (), {"channel_id": "schema", "payload": msgpack.packb(response, use_bin_type=True)})()
-
-            def close(self) -> None:
-                pass
-
-        client = CultNetRawClient(
-            "unused.example.test",
-            1,
-            create_transport=FakeSchemaTransport,
-        )
-
-        response = client.fetch_schema_catalog(message_id="transport-factory")
-
-        self.assertEqual(response["schemaVersion"], "cultnet.schema_catalog_response.v0")
-        self.assertEqual(sent_messages[0]["schemaVersion"], "cultnet.schema_catalog_request.v0")
-        self.assertEqual(sent_messages[0]["messageId"], "transport-factory")
-
-    def test_cultmesh_client_uses_rudp_schema_transport_endpoint(self) -> None:
-        import msgpack  # type: ignore
-
-        server_socket = bind_udp_socket()
-        server_host, server_port = server_socket.getsockname()[:2]
-        connection_id = 0x43554C54
-        server = CultNetRudpSocketTransportConnection(
-            CultNetRudpSocketTransportOptions(
-                runtime_id="python-rudp-schema-server",
-                socket=server_socket,
-                mode=CultNetRudpSocketMode.SERVER,
-                connection_id=connection_id,
-                initial_sequence=100,
-                resend_delay_ms=25,
-            )
-        )
-        received_messages: list[dict[str, object]] = []
-
-        def serve_once() -> None:
-            deadline = time.monotonic() + 2.0
-            try:
-                while time.monotonic() < deadline:
-                    frame = server.receive_once()
-                    server.poll_resends()
-                    if frame is None:
-                        time.sleep(0.005)
-                        continue
-                    received = msgpack.unpackb(frame.payload, raw=False)
-                    received_messages.append(received)
-                    response = {
-                        "schemaVersion": "cultnet.schema_catalog_response.v0",
-                        "messageId": received["messageId"],
-                        "schemas": [],
-                    }
-                    server.send("schema", msgpack.packb(response, use_bin_type=True))
-                    return
-                raise AssertionError("RUDP schema server did not receive a request")
-            finally:
-                server.close()
-
-        server_thread = threading.Thread(target=serve_once, daemon=True)
-        server_thread.start()
-        client = CultMesh.create_client(
-            endpoint=f"rudp://{server_host}:{server_port}",
-            timeout_seconds=2.0,
-            connection_id=connection_id,
-            runtime_id="python-rudp-schema-client",
-        )
-
-        response = client.fetch_schema_catalog(message_id="rudp-transport-factory")
-        server_thread.join(timeout=2.0)
-
-        self.assertFalse(server_thread.is_alive())
-        self.assertEqual(response["schemaVersion"], "cultnet.schema_catalog_response.v0")
-        self.assertEqual(response["messageId"], "rudp-transport-factory")
-        self.assertEqual(received_messages[0]["schemaVersion"], "cultnet.schema_catalog_request.v0")
-        self.assertEqual(received_messages[0]["messageId"], "rudp-transport-factory")
-
-    def test_cultnet_rudp_packet_codec_uses_deterministic_reliable_ordered_fixture(self) -> None:
-        encoded = encode_rudp_packet(
-            CultNetRudpPacket(
-                packet_type=CultNetRudpPacketType.DATA,
-                connection_id=0x01020304,
-                sequence=0x0000002A,
-                ack=0x00000029,
-                ack_mask=0x80000001,
-                channel_id="schema",
-                reliable=True,
-                ordered=True,
-                fragment_id=7,
-                fragment_index=1,
-                fragment_count=3,
-                payload=b"hello",
-            )
-        )
-
-        self.assertEqual(
-            encoded.hex(),
-            "434e523000030b2a010203040000002a0000002980000001000700010003000000050600736368656d6168656c6c6f",
-        )
-
-        decoded = decode_rudp_packet(encoded)
-        self.assertEqual(decoded.packet_type, CultNetRudpPacketType.DATA)
-        self.assertEqual(decoded.connection_id, 0x01020304)
-        self.assertEqual(decoded.sequence, 0x0000002A)
-        self.assertEqual(decoded.ack, 0x00000029)
-        self.assertEqual(decoded.ack_mask, 0x80000001)
-        self.assertEqual(decoded.channel_id, "schema")
-        self.assertTrue(decoded.reliable)
-        self.assertTrue(decoded.ordered)
-        self.assertFalse(decoded.sequenced)
-        self.assertEqual(decoded.fragment_id, 7)
-        self.assertEqual(decoded.fragment_index, 1)
-        self.assertEqual(decoded.fragment_count, 3)
-        self.assertEqual(decoded.payload, b"hello")
-
-    def test_cultnet_rudp_transport_profile_advertises_state_and_realtime_channels(self) -> None:
-        profile = create_rudp_transport_profile(
-            "python-rudp",
-            transport_id="public-rudp",
-            host="127.0.0.1",
-            port=7777,
-            max_payload_bytes=1200,
-            max_fragment_bytes=1000,
-        )
-
-        self.assertEqual(profile["transports"][0]["protocol"], "rudp")
-        self.assertEqual(profile["transports"][0]["reconnectPolicy"]["schemaVersion"], "cultnet.reconnect_policy.v0")
-        self.assertEqual(profile["transports"][0]["reconnectPolicy"]["baseDelayMs"], 1_000)
-        self.assertEqual(
-            [
-                (channel["channelId"], channel["delivery"], channel["ordering"])
-                for channel in profile["transports"][0]["channels"]
-            ],
-            [
-                ("schema", "reliable", "ordered"),
-                ("latest", "unreliable", "sequenced"),
-                ("realtime", "unreliable", "unordered"),
-            ],
-        )
-
-    def test_cultnet_reconnect_policy_exposes_portable_delay_contract(self) -> None:
-        policy = create_reconnect_policy(policy_id="rudp-default", max_attempts=8)
-
-        self.assertEqual(policy.schema_version, "cultnet.reconnect_policy.v0")
-        self.assertEqual(policy.policy_id, "rudp-default")
-        self.assertEqual(policy.max_attempts, 8)
-        self.assertEqual(policy.to_wire()["policyId"], "rudp-default")
-        self.assertEqual(policy.to_wire()["maxAttempts"], 8)
-        self.assertEqual(compute_reconnect_delay_ms(policy, 1), 1_000)
-        self.assertEqual(compute_reconnect_delay_ms(policy, 3, 17), 4_017)
-        self.assertEqual(compute_reconnect_delay_ms(policy, 9, 999), 30_250)
-        self.assertEqual(compute_reconnect_delay_ms(policy, 0, -5), 1_000)
-
-    def test_cultnet_reconnect_controller_schedules_attempts_and_reset(self) -> None:
-        controller = CultNetReconnectController(create_reconnect_policy(max_attempts=2))
-
-        first = controller.record_failure(10_000)
-        self.assertEqual(first.attempt, 1)
-        self.assertTrue(first.should_retry)
-        self.assertEqual(first.delay_ms, 1_000)
-        self.assertEqual(first.next_attempt_at_ms, 11_000)
-        self.assertFalse(first.exhausted)
-        self.assertFalse(controller.can_attempt(10_999))
-        self.assertTrue(controller.can_attempt(11_000))
-
-        second = controller.record_failure(11_000, 17)
-        self.assertEqual(second.attempt, 2)
-        self.assertEqual(second.delay_ms, 2_017)
-        self.assertEqual(second.next_attempt_at_ms, 13_017)
-        self.assertTrue(second.should_retry)
-
-        exhausted = controller.record_failure(13_017)
-        self.assertEqual(exhausted.attempt, 2)
-        self.assertFalse(exhausted.should_retry)
-        self.assertEqual(exhausted.delay_ms, 0)
-        self.assertIsNone(exhausted.next_attempt_at_ms)
-        self.assertTrue(exhausted.exhausted)
-        self.assertFalse(controller.can_attempt(99_000))
-
-        controller.reset()
-        self.assertEqual(controller.attempt, 0)
-        self.assertIsNone(controller.next_attempt_at_ms)
-        self.assertFalse(controller.exhausted)
-        self.assertTrue(controller.can_attempt(99_000))
-
-    def test_cultnet_rudp_reconnect_loop_consumes_shared_controller(self) -> None:
-        class FakeRudpReconnectTransport:
-            def __init__(self) -> None:
-                self.connect_calls = 0
-                self.close_calls = 0
-                self.last_payload: bytes | None = None
-
-            def connect(self, payload: bytes = b"") -> None:
-                self.connect_calls += 1
-                self.last_payload = bytes(payload)
-
-            def close(self) -> None:
-                self.close_calls += 1
-
-        now_ms = 10_000
-        captured_callback: list[Callable[[], None]] = []
-        transports: list[FakeRudpReconnectTransport] = []
-
-        def create_transport() -> FakeRudpReconnectTransport:
-            transport = FakeRudpReconnectTransport()
-            transports.append(transport)
-            return transport
-
-        def scheduler(delay_ms: int, callback: Callable[[], None]) -> Callable[[], None]:
-            self.assertEqual(delay_ms, 1_017)
-            captured_callback[:] = [callback]
-
-            def cancel() -> None:
-                captured_callback.clear()
-
-            return cancel
-
-        loop = CultNetRudpReconnectLoop(
-            create_transport,
-            reconnect_policy=create_reconnect_policy(max_attempts=2),
-            connect_payload=b"join",
-            now_ms=lambda: now_ms,
-            jitter_ms=lambda: 17,
-            scheduler=scheduler,
-        )
-
-        first = loop.start()
-        self.assertEqual(first.connect_calls, 1)
-        self.assertEqual(first.last_payload, b"join")
-        self.assertIs(loop.transport, first)
-
-        decision = loop.handle_closed()
-        self.assertIsNotNone(decision)
-        self.assertEqual(decision.attempt, 1)
-        self.assertTrue(decision.should_retry)
-        self.assertEqual(decision.delay_ms, 1_017)
-        self.assertEqual(decision.next_attempt_at_ms, 11_017)
-        self.assertEqual(loop.reconnect_controller.attempt, 1)
-        self.assertEqual(loop.reconnect_controller.next_attempt_at_ms, 11_017)
-        self.assertEqual(len(captured_callback), 1)
-
-        now_ms = 11_017
-        captured_callback[0]()
-        self.assertEqual(len(transports), 2)
-        self.assertEqual(transports[1].connect_calls, 1)
-        self.assertIs(loop.transport, transports[1])
-
-        loop.mark_connected()
-        self.assertEqual(loop.reconnect_controller.attempt, 0)
-
-        loop.stop()
-        self.assertEqual(transports[1].close_calls, 1)
-        self.assertIsNone(loop.transport)
-
-    def test_cultnet_rudp_session_handshake_acks_reliable_connect_and_accept_packets(self) -> None:
-        client = CultNetRudpSession(
-            CultNetRudpSessionOptions(connection_id=0x0A0B0C0D, initial_sequence=1, resend_delay_ms=50)
-        )
-        server = CultNetRudpSession(
-            CultNetRudpSessionOptions(connection_id=0x0A0B0C0D, initial_sequence=100, resend_delay_ms=50)
-        )
-
-        connect = client.create_connect(0, b"join")
-        self.assertEqual(connect.packet_type, CultNetRudpPacketType.CONNECT)
-        self.assertEqual(connect.sequence, 1)
-        self.assertEqual(client.pending_reliable_sequences, (1,))
-
-        accept = server.accept_connect(connect, 10, b"ok")
-        self.assertEqual(accept.packet_type, CultNetRudpPacketType.ACCEPT)
-        self.assertEqual(accept.ack, 1)
-        self.assertTrue(server.connected)
-        self.assertEqual(server.pending_reliable_sequences, (100,))
-
-        client.receive(accept, 20)
-        self.assertTrue(client.connected)
-        self.assertEqual(client.pending_reliable_sequences, ())
-
-        ack = client.create_ack()
-        self.assertEqual(ack.ack, 100)
-        server.receive(ack, 30)
-        self.assertEqual(server.pending_reliable_sequences, ())
-
-    def test_cultnet_rudp_session_computes_ack_masks_and_clears_pending_reliable_packets(self) -> None:
-        sender = CultNetRudpSession(CultNetRudpSessionOptions(connection_id=7, initial_sequence=10, resend_delay_ms=100))
-        receiver = CultNetRudpSession(
-            CultNetRudpSessionOptions(connection_id=7, initial_sequence=200, resend_delay_ms=100)
-        )
-        sender.receive(
-            CultNetRudpPacket(CultNetRudpPacketType.ACCEPT, 7, 1, 0, 0, "control")
-        )
-        receiver.receive(
-            CultNetRudpPacket(CultNetRudpPacketType.ACCEPT, 7, 2, 0, 0, "control")
-        )
-
-        first = sender.send(
-            "schema",
-            b"first",
-            CultNetRudpSendOptions(reliable=True, ordered=True, now_ms=0),
-        )
-        second = sender.send(
-            "schema",
-            b"second",
-            CultNetRudpSendOptions(reliable=True, ordered=True, now_ms=0),
-        )
-        third = sender.send(
-            "schema",
-            b"third",
-            CultNetRudpSendOptions(reliable=True, ordered=True, now_ms=0),
-        )
-        self.assertEqual(sender.pending_reliable_sequences, (10, 11, 12))
-
-        receiver.receive(first)
-        receiver.receive(third)
-        ack_with_gap = receiver.create_ack()
-        self.assertEqual(ack_with_gap.ack, 12)
-        self.assertEqual(ack_with_gap.ack_mask, 0b10 | (1 << 9))
-        sender.receive(ack_with_gap)
-        self.assertEqual(sender.pending_reliable_sequences, (11,))
-
-        receiver.receive(second)
-        full_ack = receiver.create_ack()
-        self.assertEqual(full_ack.ack, 12)
-        self.assertEqual(full_ack.ack_mask, 0b11 | (1 << 9))
-        sender.receive(full_ack)
-        self.assertEqual(sender.pending_reliable_sequences, ())
-
-    def test_cultnet_rudp_session_schedules_reliable_resends_until_acked(self) -> None:
-        session = CultNetRudpSession(CultNetRudpSessionOptions(connection_id=99, initial_sequence=1, resend_delay_ms=100))
-        session.receive(
-            CultNetRudpPacket(CultNetRudpPacketType.ACCEPT, 99, 50, 0, 0, "control")
-        )
-        sent = session.send(
-            "schema",
-            b"payload",
-            CultNetRudpSendOptions(reliable=True, ordered=True, now_ms=10),
-        )
-
-        self.assertEqual(session.due_resends(90), ())
-        self.assertEqual(tuple(packet.sequence for packet in session.due_resends(110)), (sent.sequence,))
-        self.assertEqual(session.due_resends(150), ())
-
-        session.receive(
-            CultNetRudpPacket(CultNetRudpPacketType.ACK, 99, 51, sent.sequence, 0, "control")
-        )
-        self.assertEqual(session.due_resends(250), ())
-
-    def test_cultnet_rudp_session_pings_and_detects_receive_timeout(self) -> None:
-        client = CultNetRudpSession(CultNetRudpSessionOptions(connection_id=101, initial_sequence=1))
-        server = CultNetRudpSession(CultNetRudpSessionOptions(connection_id=101, initial_sequence=100))
-        connect = client.create_connect(0, b"join")
-        accept = server.accept_connect(connect, 10)
-        client.receive(accept, 20)
-
-        ping = client.create_ping(b"pulse")
-        ping_result = server.receive(ping, 30)
-        self.assertIsNotNone(ping_result.reply)
-        self.assertEqual(ping_result.reply.packet_type, CultNetRudpPacketType.PONG)
-        self.assertEqual(ping_result.reply.payload, b"pulse")
-
-        pong_result = client.receive(ping_result.reply, 40)
-        self.assertTrue(pong_result.pong)
-        self.assertEqual(pong_result.pong_payload, b"pulse")
-        self.assertFalse(client.check_timeout(90, 50))
-        self.assertTrue(client.check_timeout(91, 50))
-        self.assertFalse(client.connected)
-
-    def test_cultnet_rudp_session_bounds_pending_reliable_packets_before_enqueue(self) -> None:
-        session = CultNetRudpSession(
-            CultNetRudpSessionOptions(connection_id=102, initial_sequence=1, max_pending_reliable_packets=2)
-        )
-        session.receive(CultNetRudpPacket(CultNetRudpPacketType.ACCEPT, 102, 50, 0, 0, "control"))
-        session.send("schema", b"first", CultNetRudpSendOptions(reliable=True, ordered=True))
-        session.send("schema", b"second", CultNetRudpSendOptions(reliable=True, ordered=True))
-        with self.assertRaisesRegex(ValueError, "reliable send queue is full"):
-            session.send("schema", b"third", CultNetRudpSendOptions(reliable=True, ordered=True))
-        self.assertEqual(session.pending_reliable_sequences, (1, 2))
-
-        fragmented = CultNetRudpSession(
-            CultNetRudpSessionOptions(connection_id=103, initial_sequence=1, max_pending_reliable_packets=3)
-        )
-        fragmented.receive(CultNetRudpPacket(CultNetRudpPacketType.ACCEPT, 103, 50, 0, 0, "control"))
-        with self.assertRaisesRegex(ValueError, "reliable send queue is full"):
-            fragmented.send_many(
-                "schema",
-                b"fragment-me",
-                CultNetRudpSendOptions(reliable=True, ordered=True),
-                max_fragment_bytes=3,
-            )
-        self.assertEqual(fragmented.pending_reliable_sequences, ())
-
-    def test_cultnet_rudp_session_suppresses_duplicates_and_delivers_reliable_ordered_payloads(self) -> None:
-        sender = CultNetRudpSession(CultNetRudpSessionOptions(connection_id=123, initial_sequence=1))
-        receiver = CultNetRudpSession(CultNetRudpSessionOptions(connection_id=123, initial_sequence=100))
-        sender.receive(
-            CultNetRudpPacket(CultNetRudpPacketType.ACCEPT, 123, 90, 0, 0, "control")
-        )
-        receiver.receive(
-            CultNetRudpPacket(CultNetRudpPacketType.ACCEPT, 123, 91, 0, 0, "control")
-        )
-
-        first = sender.send("schema", b"first", CultNetRudpSendOptions(reliable=True, ordered=True))
-        second = sender.send("schema", b"second", CultNetRudpSendOptions(reliable=True, ordered=True))
-        third = sender.send("schema", b"third", CultNetRudpSendOptions(reliable=True, ordered=True))
-
-        self.assertEqual([frame.payload.decode("utf-8") for frame in receiver.receive(first).delivered], ["first"])
-        self.assertEqual(receiver.receive(third).delivered, ())
-        self.assertEqual(receiver.receive(first).delivered, ())
-        self.assertEqual(
-            [frame.payload.decode("utf-8") for frame in receiver.receive(second).delivered],
-            ["second", "third"],
-        )
-
-    def test_cultnet_rudp_session_skips_control_packets_while_ordering_schema_payloads(self) -> None:
-        sender = CultNetRudpSession(CultNetRudpSessionOptions(connection_id=124, initial_sequence=1))
-        receiver = CultNetRudpSession(CultNetRudpSessionOptions(connection_id=124, initial_sequence=100))
-        sender.receive(
-            CultNetRudpPacket(CultNetRudpPacketType.ACCEPT, 124, 90, 0, 0, "control")
-        )
-        receiver.receive(
-            CultNetRudpPacket(CultNetRudpPacketType.ACCEPT, 124, 91, 0, 0, "control")
-        )
-
-        first = sender.send("schema", b"first", CultNetRudpSendOptions(reliable=True, ordered=True))
-        control = sender.create_ack()
-        second = sender.send("schema", b"second", CultNetRudpSendOptions(reliable=True, ordered=True))
-
-        self.assertEqual([frame.payload.decode("utf-8") for frame in receiver.receive(first).delivered], ["first"])
-        self.assertEqual(receiver.receive(control).delivered, ())
-        self.assertEqual([frame.payload.decode("utf-8") for frame in receiver.receive(second).delivered], ["second"])
-
-    def test_cultnet_rudp_session_fragments_and_reassembles_reliable_ordered_payloads(self) -> None:
-        sender = CultNetRudpSession(CultNetRudpSessionOptions(connection_id=456, initial_sequence=1))
-        receiver = CultNetRudpSession(CultNetRudpSessionOptions(connection_id=456, initial_sequence=100))
-        sender.receive(
-            CultNetRudpPacket(CultNetRudpPacketType.ACCEPT, 456, 90, 0, 0, "control")
-        )
-        receiver.receive(
-            CultNetRudpPacket(CultNetRudpPacketType.ACCEPT, 456, 91, 0, 0, "control")
-        )
-
-        packets = sender.send_many(
-            "schema",
-            b"fragment-me-please",
-            CultNetRudpSendOptions(reliable=True, ordered=True, now_ms=10),
-            max_fragment_bytes=5,
-        )
-        self.assertEqual(len(packets), 4)
-        self.assertEqual(tuple(packet.fragment_count for packet in packets), (4, 4, 4, 4))
-        self.assertEqual(tuple(packet.fragment_index for packet in packets), (0, 1, 2, 3))
-        self.assertTrue(all(packet.fragment_id == packets[0].fragment_id for packet in packets))
-
-        self.assertEqual(receiver.receive(packets[0]).delivered, ())
-        self.assertEqual(receiver.receive(packets[1]).delivered, ())
-        self.assertEqual(receiver.receive(packets[2]).delivered, ())
-        delivered = receiver.receive(packets[3]).delivered
-        self.assertEqual(len(delivered), 1)
-        self.assertEqual(delivered[0].payload, b"fragment-me-please")
-        self.assertEqual(delivered[0].sequence, packets[0].sequence)
-
-    def test_cultnet_rudp_socket_transport_handshakes_and_carries_reliable_ordered_schema_frames(self) -> None:
-        server_socket = bind_udp_socket()
-        client_socket = bind_udp_socket()
-        connection_id = 0x10203040
-        server = CultNetRudpSocketTransportConnection(
-            CultNetRudpSocketTransportOptions(
-                runtime_id="python-rudp-server",
-                socket=server_socket,
-                mode=CultNetRudpSocketMode.SERVER,
-                connection_id=connection_id,
-                initial_sequence=100,
-                resend_delay_ms=25,
-            )
-        )
-        client = CultNetRudpSocketTransportConnection(
-            CultNetRudpSocketTransportOptions(
-                runtime_id="python-rudp-client",
-                socket=client_socket,
-                mode=CultNetRudpSocketMode.CLIENT,
-                remote_addr=server_socket.getsockname(),
-                connection_id=connection_id,
-                initial_sequence=1,
-                resend_delay_ms=25,
-            )
-        )
-
-        try:
-            client.connect(b"join")
-            pump_rudp_handshake(client, server)
-            self.assertTrue(client.connected)
-            self.assertTrue(server.connected)
-
-            client.send("schema", b"client-state")
-            server_frame = receive_rudp_frame(server)
-            self.assertEqual(server_frame.channel_id, "schema")
-            self.assertEqual(server_frame.payload, b"client-state")
-
-            server.send("schema", b"server-state")
-            client_frame = receive_rudp_frame(client)
-            self.assertEqual(client_frame.channel_id, "schema")
-            self.assertEqual(client_frame.payload, b"server-state")
-            self.assertEqual(server.profile["transports"][0]["protocol"], "rudp")
-            self.assertEqual(client.stats.frames_sent, 1)
-            self.assertEqual(server.stats.frames_received, 1)
-        finally:
-            client.close()
-            server.close()
-
-    def test_cultnet_rudp_socket_transport_carries_fragmented_reliable_ordered_schema_frames(self) -> None:
-        server_socket = bind_udp_socket()
-        client_socket = bind_udp_socket()
-        connection_id = 0x10203041
-        server = CultNetRudpSocketTransportConnection(
-            CultNetRudpSocketTransportOptions(
-                runtime_id="python-rudp-fragment-server",
-                socket=server_socket,
-                mode=CultNetRudpSocketMode.SERVER,
-                connection_id=connection_id,
-                initial_sequence=100,
-                resend_delay_ms=25,
-                max_fragment_bytes=8,
-            )
-        )
-        client = CultNetRudpSocketTransportConnection(
-            CultNetRudpSocketTransportOptions(
-                runtime_id="python-rudp-fragment-client",
-                socket=client_socket,
-                mode=CultNetRudpSocketMode.CLIENT,
-                remote_addr=server_socket.getsockname(),
-                connection_id=connection_id,
-                initial_sequence=1,
-                resend_delay_ms=25,
-                max_fragment_bytes=8,
-            )
-        )
-
-        try:
-            payload = b"this-schema-frame-is-larger-than-one-rudp-fragment"
-            client.connect(b"join")
-            pump_rudp_handshake(client, server)
-            client.send("schema", payload)
-            server_frame = receive_rudp_frame(server)
-            self.assertEqual(server_frame.channel_id, "schema")
-            self.assertEqual(server_frame.payload, payload)
-            self.assertEqual(client.stats.frames_sent, 1)
-            self.assertEqual(server.stats.frames_received, 1)
-        finally:
-            client.close()
-            server.close()
-
-    def test_cultmesh_facade_creates_rudp_client_from_peer_endpoint(self) -> None:
-        connection_id = 0x10203042
-        server = CultMesh.create_rudp_server(
-            "python-cultmesh-rudp-server",
-            connection_id,
-            initial_sequence=100,
-            resend_delay_ms=25,
-            max_fragment_bytes=1024,
-            max_pending_reliable_packets=16,
-        )
-        server_host, server_port = server.socket.getsockname()[:2]
-        endpoint = CultMesh.parse_rudp_endpoint(f"rudp://{server_host}:{server_port}")
-        self.assertEqual(endpoint.host, server_host)
-        self.assertEqual(endpoint.port, server_port)
-        peer = CultMeshPeerCard(
-            peer_id="python-cultmesh-rudp-server",
-            verse_id="local",
-            endpoints=(endpoint.uri,),
-            roles=("schema",),
-            authority_lease_id="lease:python-cultmesh-rudp-server",
-        )
-        peers = CultMesh.create_peer_catalog()
-        leases = CultMesh.create_authority_lease_catalog()
-        peers.upsert(peer)
-        with self.assertRaisesRegex(ValueError, "No authorized RUDP peer"):
-            CultMesh.create_rudp_client_for_authorized_peer(
-                "python-cultmesh-rudp-client",
-                connection_id,
-                peers,
-                leases,
-                "local",
-                "schema",
-                resend_delay_ms=25,
-                max_fragment_bytes=1024,
-                max_pending_reliable_packets=16,
-            )
-        leases.upsert(
-            CultMeshAuthorityLease(
-                lease_id="lease:python-cultmesh-rudp-server",
-                verse_id="local",
-                peer_id="python-cultmesh-rudp-server",
-                roles=("schema",),
-                valid_from=datetime.now(UTC) - timedelta(seconds=1),
-                expires_at=datetime.now(UTC) + timedelta(seconds=30),
-                issuer_runtime_id="python-authority",
-            )
-        )
-        client = CultMesh.create_rudp_client_for_authorized_peer(
-            "python-cultmesh-rudp-client",
-            connection_id,
-            peers,
-            leases,
-            "local",
-            "schema",
-            resend_delay_ms=25,
-            max_fragment_bytes=1024,
-            max_pending_reliable_packets=16,
-        )
-
-        try:
-            client.connect(b"join")
-            pump_rudp_handshake(client, server)
-            self.assertTrue(client.connected)
-            self.assertTrue(server.connected)
-
-            client.send("schema", b"client-state")
-            server_frame = receive_rudp_frame(server)
-            self.assertEqual(server_frame.channel_id, "schema")
-            self.assertEqual(server_frame.payload, b"client-state")
-            self.assertEqual(server.profile["transports"][0]["protocol"], "rudp")
-            self.assertEqual(client.profile["transports"][0]["protocol"], "rudp")
-        finally:
-            client.close()
-            server.close()
-
-    def test_cultnet_database_subscription_helpers_match_schema_v0_shape(self) -> None:
-        subscribe = database_subscribe(
-            message_id="sub-message",
-            subscription_id="sub-1",
-            schema_ids=["schema-a"],
-            record_keys=["record-a"],
-            include_snapshot=False,
-        ).to_wire()
-        self.assertEqual(subscribe["schemaVersion"], "cultnet.database_subscribe.v0")
-        self.assertEqual(subscribe["messageId"], "sub-message")
-        self.assertEqual(subscribe["subscriptionId"], "sub-1")
-        self.assertEqual(subscribe["schemaIds"], ["schema-a"])
-        self.assertEqual(subscribe["recordKeys"], ["record-a"])
-        self.assertFalse(subscribe["includeSnapshot"])
-
-        unsubscribe = database_unsubscribe(message_id="unsub-message", subscription_id="sub-1").to_wire()
-        self.assertEqual(unsubscribe["schemaVersion"], "cultnet.database_unsubscribe.v0")
-        self.assertEqual(unsubscribe["messageId"], "unsub-message")
-        self.assertEqual(unsubscribe["subscriptionId"], "sub-1")
-
-    def test_cultnet_database_change_parses_put_and_delete_shapes(self) -> None:
-        put_change = CultNetDatabaseChange.from_wire({
-            "schemaVersion": "cultnet.database_change_raw.v0",
-            "messageId": "change-put",
-            "subscriptionId": "sub-1",
-            "changeKind": "added",
-            "document": {
-                "schemaId": "schema-note",
-                "recordKey": "note:1",
-                "payload": b"payload",
-            },
-        })
-        self.assertEqual(put_change.schema_id, "schema-note")
-        self.assertEqual(put_change.record_key, "note:1")
-        self.assertIsInstance(put_change.raw_document, CultNetRawDocumentRecord)
-        self.assertEqual(put_change.raw_document.payload, b"payload")
-        self.assertEqual(put_change.to_wire()["document"]["recordKey"], "note:1")
-
-        delete_change = CultNetDatabaseChange.from_wire({
-            "schemaVersion": "cultnet.database_change_raw.v0",
-            "messageId": "change-delete",
-            "subscriptionId": "sub-1",
-            "changeKind": "removed",
-            "schemaId": "schema-note",
-            "recordKey": "note:1",
-        })
-        self.assertIsNone(delete_change.document)
-        self.assertIsNone(delete_change.raw_document)
-        self.assertEqual(delete_change.schema_id, "schema-note")
-        self.assertEqual(delete_change.to_wire()["recordKey"], "note:1")
-
-    def test_cultnet_raw_put_helper_carries_message_id(self) -> None:
-        put = document_put_raw(
-            message_id="put-1",
-            key="record-a",
-            schema_id="schema-a",
-            stored_at="2026-06-13T00:00:00Z",
-            payload=b"payload",
-            source_runtime_id="python-test",
-            shard_id="interop",
-            shard_epoch=1,
-        ).to_wire()
-        self.assertEqual(put["schemaVersion"], "cultnet.document_put_raw.v0")
-        self.assertEqual(put["messageId"], "put-1")
-        self.assertEqual(put["document"]["recordKey"], "record-a")
-        self.assertEqual(put["document"]["sourceRuntimeId"], "python-test")
-        self.assertEqual(put["shardId"], "interop")
-        self.assertEqual(put["shardEpoch"], 1)
-
-    def test_cultnet_catalog_and_snapshot_helpers_accept_filters(self) -> None:
-        catalog = schema_catalog_request(
-            message_id="catalog-1",
-            include_schema_json=True,
-            schema_ids=["schema-a"],
-            kinds=["wire_message"],
-        ).to_wire()
-        self.assertEqual(catalog["schemaVersion"], "cultnet.schema_catalog_request.v0")
-        self.assertEqual(catalog["messageId"], "catalog-1")
-        self.assertTrue(catalog["includeSchemaJson"])
-        self.assertEqual(catalog["schemaIds"], ["schema-a"])
-        self.assertEqual(catalog["kinds"], ["wire_message"])
-
-        snapshot = snapshot_request(
-            message_id="snapshot-1",
-            schema_ids=["schema-a"],
-            record_keys=["record-a"],
-            shard_id="interop",
-            shard_epoch=1,
-        ).to_wire()
-        self.assertEqual(snapshot["schemaVersion"], "cultnet.snapshot_request.v0")
-        self.assertEqual(snapshot["messageId"], "snapshot-1")
-        self.assertEqual(snapshot["schemaIds"], ["schema-a"])
-        self.assertEqual(snapshot["recordKeys"], ["record-a"])
-        self.assertEqual(snapshot["shardId"], "interop")
-        self.assertEqual(snapshot["shardEpoch"], 1)
-
-    def test_cultnet_raw_snapshot_response_filters_and_roundtrips_records(self) -> None:
-        response = CultNetRawSnapshotResponse.from_wire({
-            "schemaVersion": "cultnet.snapshot_response_raw.v0",
-            "messageId": "snapshot-1",
-            "shardId": "notes",
-            "shardEpoch": 3,
-            "shardLogSequence": 8,
-            "documents": [
-                CultNetRawDocumentRecord(
-                    schema_id="schema-note",
-                    record_key="note:1",
-                    stored_at="2026-06-14T00:00:00Z",
-                    payload=b"note",
-                    source_runtime_id="python-test",
-                    tags=("snapshot",),
-                ).to_wire(),
-                {
-                    "schemaId": "schema-fact",
-                    "recordKey": "fact:1",
-                    "payloadEncoding": "messagepack",
-                    "payload": b"fact",
-                },
-            ],
-        })
-        self.assertEqual(response.shard_id, "notes")
-        self.assertEqual(response.shard_epoch, 3)
-        self.assertEqual(response.shard_log_sequence, 8)
-        self.assertEqual(response.documents[0].source_runtime_id, "python-test")
-        self.assertEqual(response.filter(schema_ids=["schema-note"])[0].record_key, "note:1")
-        self.assertEqual(response.filter(record_keys=["fact:1"])[0].schema_id, "schema-fact")
-        self.assertEqual(response.to_wire()["documents"][0]["tags"], ["snapshot"])
-
-    def test_cultnet_raw_client_fetches_schema_snapshot_and_shard_reads(self) -> None:
-        import msgpack  # type: ignore
-        from cultnet_py import read_frame, write_frame
-
-        received_versions: list[str] = []
-        ready = threading.Event()
-        server_error: list[BaseException] = []
-        port_holder: list[int] = []
-
-        def serve_requests() -> None:
-            try:
-                with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as server:
-                    server.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
-                    server.bind(("127.0.0.1", 0))
-                    port_holder.append(server.getsockname()[1])
-                    server.listen(4)
-                    ready.set()
-                    for _ in range(4):
-                        connection, _ = server.accept()
-                        with connection:
-                            stream = connection.makefile("rwb")
-                            request = msgpack.unpackb(read_frame(stream), raw=False)
-                            received_versions.append(request["schemaVersion"])
-                            if request["schemaVersion"] == "cultnet.schema_catalog_request.v0":
-                                self.assertEqual(request["kinds"], ["wire_message"])
-                                response = {"schemaVersion": "cultnet.schema_catalog_response.v0", "messageId": request["messageId"], "schemas": []}
-                            elif request["schemaVersion"] == "cultnet.snapshot_request.v0":
-                                self.assertEqual(request["shardId"], "interop")
-                                response = {"schemaVersion": "cultnet.snapshot_response_raw.v0", "messageId": request["messageId"], "documents": []}
-                            elif request["schemaVersion"] == "cultnet.shard_catalog_request.v0":
-                                response = {
-                                    "schemaVersion": "cultnet.shard_catalog_response.v0",
-                                    "messageId": request["messageId"],
-                                    "shards": [{
-                                        "shardId": "interop",
-                                        "ownerRuntimeId": "socket-test",
-                                        "epoch": 1,
-                                        "schemaIds": request["schemaIds"],
-                                        "keyPrefix": "record-",
-                                        "primaryEndpoints": ["cultnet://127.0.0.1:1"],
-                                    }],
-                                }
-                            elif request["schemaVersion"] == "cultnet.shard_log_request.v0":
-                                self.assertEqual(request["afterSequence"], 7)
-                                response = {
-                                    "schemaVersion": "cultnet.shard_log_response.v0",
-                                    "messageId": request["messageId"],
-                                    "shardId": request["shardId"],
-                                    "shardEpoch": request["shardEpoch"],
-                                    "entries": [],
-                                    "resyncRequired": False,
-                                }
-                            else:
-                                raise AssertionError(f"unexpected request {request['schemaVersion']}")
-                            write_frame(stream, msgpack.packb(response, use_bin_type=True))
-                            stream.flush()
-            except BaseException as error:
-                server_error.append(error)
-                ready.set()
-
-        thread = threading.Thread(target=serve_requests, daemon=True)
-        thread.start()
-        self.assertTrue(ready.wait(2.0))
-        self.assertFalse(server_error)
-
-        client = CultNetRawClient("127.0.0.1", port_holder[0], timeout_seconds=2.0)
-        self.assertEqual(client.fetch_schema_catalog(kinds=["wire_message"])["schemaVersion"], "cultnet.schema_catalog_response.v0")
-        typed_snapshot = client.fetch_snapshot_response(shard_id="interop", shard_epoch=1)
-        self.assertEqual(typed_snapshot.shard_id, None)
-        self.assertEqual(typed_snapshot.documents, ())
-        shard_catalog = CultNetShardCatalog()
-        synced_shards = client.sync_shard_catalog(shard_catalog, schema_ids=["schema-a"])
-        self.assertEqual(synced_shards[0].shard_id, "interop")
-        self.assertEqual(shard_catalog.get("interop"), synced_shards[0])
-        shard_log = client.fetch_shard_log_response(shard_id="interop", shard_epoch=1, after_sequence=7)
-        self.assertEqual(shard_log.shard_id, "interop")
-        self.assertFalse(shard_log.resync_required)
-        self.assertEqual(shard_log.last_sequence, 0)
-
-        thread.join(2.0)
-        self.assertFalse(server_error)
-        self.assertEqual(received_versions, [
-            "cultnet.schema_catalog_request.v0",
-            "cultnet.snapshot_request.v0",
-            "cultnet.shard_catalog_request.v0",
-            "cultnet.shard_log_request.v0",
-        ])
-
-    def test_cultnet_raw_client_raises_typed_peer_error_response(self) -> None:
-        import msgpack  # type: ignore
-        from cultnet_py import read_frame, write_frame
-
-        ready = threading.Event()
-        port_holder: list[int] = []
-
-        def serve_error() -> None:
-            with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as server:
-                server.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
-                server.bind(("127.0.0.1", 0))
-                port_holder.append(server.getsockname()[1])
-                server.listen(1)
-                ready.set()
-                connection, _ = server.accept()
-                with connection:
-                    stream = connection.makefile("rwb")
-                    read_frame(stream)
-                    write_frame(stream, msgpack.packb({
-                        "schemaVersion": "cultnet.error.v0",
-                        "messageId": "error-1",
-                        "error": "Snapshot document limit exceeded",
-                    }, use_bin_type=True))
-                    stream.flush()
-
-        thread = threading.Thread(target=serve_error, daemon=True)
-        thread.start()
-        self.assertTrue(ready.wait(2.0))
-
-        client = CultNetRawClient("127.0.0.1", port_holder[0], timeout_seconds=2.0)
-        with self.assertRaisesRegex(CultNetPeerError, "Snapshot document limit exceeded") as raised:
-            client.fetch_snapshot()
-
-        self.assertEqual(raised.exception.peer_error, "Snapshot document limit exceeded")
-        self.assertEqual(raised.exception.response["schemaVersion"], "cultnet.error.v0")
-        thread.join(2.0)
-
-    def test_cultnet_database_subscription_reads_snapshot_and_change(self) -> None:
-        import msgpack  # type: ignore
-        from cultnet_py import read_frame, write_frame
-
-        document = define_database_entry_type(
-            "sub.item",
-            [
-                ("name", 0),
-                ("category", 1),
-                ("value", 2, 0),
-            ],
-            cls=Item,
-        )
-        schema_id = document.catalog_entry().schema_id
-        ready = threading.Event()
-        server_error: list[BaseException] = []
-        port_holder: list[int] = []
-        received_versions: list[str] = []
-
-        def serve_subscription() -> None:
-            try:
-                with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as server:
-                    server.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
-                    server.bind(("127.0.0.1", 0))
-                    port_holder.append(server.getsockname()[1])
-                    server.listen(1)
-                    ready.set()
-                    connection, _ = server.accept()
-                    with connection:
-                        stream = connection.makefile("rwb")
-                        subscribe = msgpack.unpackb(read_frame(stream), raw=False)
-                        received_versions.append(subscribe["schemaVersion"])
-                        self.assertEqual(subscribe["subscriptionId"], "sub-1")
-                        snapshot = {
-                            "schemaVersion": "cultnet.snapshot_response_raw.v0",
-                            "messageId": subscribe["messageId"],
-                            "documents": [],
-                        }
-                        write_frame(stream, msgpack.packb(snapshot, use_bin_type=True))
-                        stream.flush()
-
-                        put = msgpack.unpackb(read_frame(stream), raw=False)
-                        received_versions.append(put["schemaVersion"])
-                        change = {
-                            "schemaVersion": "cultnet.database_change_raw.v0",
-                            "messageId": "change-1",
-                            "subscriptionId": "sub-1",
-                            "changeKind": "added",
-                            "document": put["document"],
-                        }
-                        write_frame(stream, msgpack.packb(change, use_bin_type=True))
-                        stream.flush()
-
-                        unsubscribe = msgpack.unpackb(read_frame(stream), raw=False)
-                        received_versions.append(unsubscribe["schemaVersion"])
-            except BaseException as error:
-                server_error.append(error)
-                ready.set()
-
-        thread = threading.Thread(target=serve_subscription, daemon=True)
-        thread.start()
-        self.assertTrue(ready.wait(2.0))
-        self.assertFalse(server_error)
-
-        client = CultNetRawClient("127.0.0.1", port_holder[0], timeout_seconds=2.0)
-        put = document_put_raw(
-            message_id="put-sub",
-            key="item:sub",
-            schema_id=schema_id,
-            stored_at="2026-06-14T00:00:00Z",
-            payload=document.encode_payload(Item("orb", "gear", 8)),
-        )
-        with client.subscribe_database(subscription_id="sub-1", schema_ids=[schema_id]) as subscription:
-            snapshot = subscription.read_next_snapshot_response()
-            subscription.send(put)
-            change = subscription.read_next_change()
-
-        thread.join(2.0)
-        self.assertFalse(server_error)
-        self.assertIsInstance(snapshot, CultNetRawSnapshotResponse)
-        self.assertEqual(snapshot.message_id, "cultnet-python-subscribe")
-        self.assertEqual(snapshot.to_wire()["schemaVersion"], "cultnet.snapshot_response_raw.v0")
-        self.assertEqual(change.change_kind, "added")
-        self.assertEqual(change.record_key, "item:sub")
-        self.assertIsInstance(change.raw_document, CultNetRawDocumentRecord)
-        self.assertEqual(change.raw_document.record_key, "item:sub")
-        self.assertEqual(received_versions, [
-            "cultnet.database_subscribe.v0",
-            "cultnet.document_put_raw.v0",
-            "cultnet.database_unsubscribe.v0",
-        ])
-
-    def test_cultnet_database_subscription_raises_typed_peer_error(self) -> None:
-        import msgpack  # type: ignore
-        from cultnet_py import read_frame, write_frame
-
-        ready = threading.Event()
-        port_holder: list[int] = []
-
-        def serve_subscription_error() -> None:
-            with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as server:
-                server.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
-                server.bind(("127.0.0.1", 0))
-                port_holder.append(server.getsockname()[1])
-                server.listen(1)
-                ready.set()
-                connection, _ = server.accept()
-                with connection:
-                    stream = connection.makefile("rwb")
-                    read_frame(stream)
-                    write_frame(stream, msgpack.packb({
-                        "schemaVersion": "cultnet.error.v0",
-                        "messageId": "subscription-error",
-                        "error": "subscription rejected",
-                    }, use_bin_type=True))
-                    stream.flush()
-
-        thread = threading.Thread(target=serve_subscription_error, daemon=True)
-        thread.start()
-        self.assertTrue(ready.wait(2.0))
-
-        client = CultNetRawClient("127.0.0.1", port_holder[0], timeout_seconds=2.0)
-        with client.subscribe_database(subscription_id="sub-error") as subscription:
-            with self.assertRaisesRegex(CultNetPeerError, "subscription rejected") as raised:
-                subscription.read_next()
-        self.assertEqual(raised.exception.response["messageId"], "subscription-error")
-        thread.join(2.0)
-
-    def test_cultnet_replication_helpers_apply_raw_snapshot_and_shard_log(self) -> None:
-        document = define_database_entry_type(
-            "replica.item",
-            [
-                ("name", 0),
-                ("category", 1),
-                ("value", 2, 0),
-            ],
-            cls=Item,
-        )
-        cache = CultCache()
-        cache.register_document_type(document)
-        schema_id = document.catalog_entry().schema_id
-
-        snapshot = {
-            "schemaVersion": "cultnet.snapshot_response_raw.v0",
-            "messageId": "snapshot-1",
-            "documents": [
-                {
-                    "schemaId": schema_id,
-                    "recordKey": "item:1",
-                    "storedAt": "2026-06-13T00:00:00Z",
-                    "payloadEncoding": "messagepack",
-                    "payload": document.encode_payload(Item("sword", "gear", 3)),
-                }
-            ],
-        }
-        applied_snapshot = apply_raw_snapshot(cache, [document], snapshot)
-        self.assertEqual(applied_snapshot[0].record_key, "item:1")
-        self.assertEqual(cache.get_required(document, "item:1").value, 3)
-        typed_snapshot = CultNetRawSnapshotResponse.from_wire(snapshot)
-        direct_applied = apply_raw_document_record(cache, schema_document_map([document]), typed_snapshot.documents[0])
-        self.assertEqual(direct_applied.schema_id, schema_id)
-        self.assertEqual(direct_applied.record_key, "item:1")
-        typed_snapshot_applied = apply_raw_snapshot(cache, [document], typed_snapshot)
-        self.assertEqual(typed_snapshot_applied[0].record_key, "item:1")
-
-        shard_log = {
-            "schemaVersion": "cultnet.shard_log_response.v0",
-            "messageId": "log-1",
-            "shardId": "interop",
-            "shardEpoch": 1,
-            "resyncRequired": False,
-            "entries": [
-                {
-                    "sequence": 0,
-                    "changeKind": "updated",
-                    "put": {
-                        "schemaVersion": "cultnet.document_put_raw.v0",
-                        "messageId": "put-unknown",
-                        "document": {
-                            "schemaId": "replica.unknown.v1",
-                            "recordKey": "unknown:1",
-                            "storedAt": "2026-06-13T00:00:01Z",
-                            "payloadEncoding": "messagepack",
-                            "payload": document.encode_payload(Item("ignored", "unknown", 0)),
-                        },
-                        "shardId": "interop",
-                        "shardEpoch": 1,
-                    },
-                },
-                {
-                    "sequence": 1,
-                    "changeKind": "updated",
-                    "put": {
-                        "schemaVersion": "cultnet.document_put_raw.v0",
-                        "messageId": "put-1",
-                        "document": {
-                            "schemaId": schema_id,
-                            "recordKey": "item:1",
-                            "storedAt": "2026-06-13T00:00:01Z",
-                            "payloadEncoding": "messagepack",
-                            "payload": document.encode_payload(Item("sword", "gear", 12)),
-                        },
-                        "shardId": "interop",
-                        "shardEpoch": 1,
-                    },
-                },
-                {
-                    "sequence": 2,
-                    "changeKind": "removed",
-                    "delete": {
-                        "schemaVersion": "cultnet.document_delete.v0",
-                        "messageId": "delete-1",
-                        "schemaId": schema_id,
-                        "recordKey": "item:1",
-                        "shardId": "interop",
-                        "shardEpoch": 1,
-                    },
-                },
-            ],
-        }
-        applied_log = apply_shard_log_response(cache, [document], shard_log)
-        self.assertEqual([change.change_kind for change in applied_log], ["updated", "removed"])
-        self.assertIsNone(cache.get(document, "item:1"))
-
-        cache.put(document, "item:1", Item("sword", "gear", 3))
-        typed_shard_log = CultNetShardLogResponse.from_wire({
-            **shard_log,
-            "entries": shard_log["entries"][1:],
-        })
-        typed_applied_log = apply_shard_log_response(cache, [document], typed_shard_log)
-        self.assertEqual([change.change_kind for change in typed_applied_log], ["updated", "removed"])
-        self.assertIsNone(cache.get(document, "item:1"))
-
-    def test_cultmesh_node_syncs_snapshot_and_shard_log_through_cultnet_client(self) -> None:
-        import msgpack  # type: ignore
-        from cultnet_py import read_frame, write_frame
-
-        document = define_database_entry_type(
-            "mesh.sync_item",
-            [
-                ("name", 0),
-                ("category", 1),
-                ("value", 2, 0),
-            ],
-            cls=Item,
-        )
-        node = create_node(runtime_id="python-node")
-        node.register_document(document)
-        schema_id = document.catalog_entry().schema_id
-        ready = threading.Event()
-        server_error: list[BaseException] = []
-        port_holder: list[int] = []
-
-        def serve_requests() -> None:
-            try:
-                with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as server:
-                    server.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
-                    server.bind(("127.0.0.1", 0))
-                    port_holder.append(server.getsockname()[1])
-                    server.listen(2)
-                    ready.set()
-                    for _ in range(2):
-                        connection, _ = server.accept()
-                        with connection:
-                            stream = connection.makefile("rwb")
-                            request = msgpack.unpackb(read_frame(stream), raw=False)
-                            if request["schemaVersion"] == "cultnet.snapshot_request.v0":
-                                response = {
-                                    "schemaVersion": "cultnet.snapshot_response_raw.v0",
-                                    "messageId": request["messageId"],
-                                    "documents": [
-                                        {
-                                            "schemaId": schema_id,
-                                            "recordKey": "item:node",
-                                            "storedAt": "2026-06-13T00:00:00Z",
-                                            "payloadEncoding": "messagepack",
-                                            "payload": document.encode_payload(Item("node", "mesh", 1)),
-                                        }
-                                    ],
-                                }
-                            elif request["schemaVersion"] == "cultnet.shard_log_request.v0":
-                                response = {
-                                    "schemaVersion": "cultnet.shard_log_response.v0",
-                                    "messageId": request["messageId"],
-                                    "shardId": request["shardId"],
-                                    "shardEpoch": request["shardEpoch"],
-                                    "resyncRequired": False,
-                                    "entries": [
-                                        {
-                                            "sequence": 1,
-                                            "changeKind": "updated",
-                                            "put": {
-                                                "schemaVersion": "cultnet.document_put_raw.v0",
-                                                "messageId": "put-node",
-                                                "document": {
-                                                    "schemaId": schema_id,
-                                                    "recordKey": "item:node",
-                                                    "storedAt": "2026-06-13T00:00:01Z",
-                                                    "payloadEncoding": "messagepack",
-                                                    "payload": document.encode_payload(Item("node", "mesh", 9)),
-                                                },
-                                                "shardId": request["shardId"],
-                                                "shardEpoch": request["shardEpoch"],
-                                            },
-                                        }
-                                    ],
-                                }
-                            else:
-                                raise AssertionError(f"unexpected request {request['schemaVersion']}")
-                            write_frame(stream, msgpack.packb(response, use_bin_type=True))
-                            stream.flush()
-            except BaseException as error:
-                server_error.append(error)
-                ready.set()
-
-        thread = threading.Thread(target=serve_requests, daemon=True)
-        thread.start()
-        self.assertTrue(ready.wait(2.0))
-        self.assertFalse(server_error)
-
-        client = CultNetRawClient("127.0.0.1", port_holder[0], timeout_seconds=2.0)
-        snapshot_changes = node.sync_snapshot(client, schema_ids=[schema_id])
-        log_changes = node.sync_shard_log(client, shard_id="mesh", shard_epoch=1)
-
-        thread.join(2.0)
-        self.assertFalse(server_error)
-        self.assertEqual(snapshot_changes[0].record_key, "item:node")
-        self.assertEqual(log_changes[0].change_kind, "updated")
-        self.assertEqual(node.get_required(document, "item:node").value, 9)
-
-    def test_cultmesh_node_emits_raw_put_and_delete_messages_for_local_writes(self) -> None:
-        document = define_database_entry_type(
-            "mesh.emit_item",
-            [
-                ("name", 0),
-                ("category", 1),
-                ("value", 2, 0),
-            ],
-            cls=Item,
-        )
-        node = create_node(runtime_id="python-node")
-        node.register_document(document)
-
-        put = node.put_raw_message(
-            document,
-            "item:emit",
-            Item("wand", "gear", 4),
-            message_id="put-emit",
-            shard_id="mesh",
-            shard_epoch=1,
-        ).to_wire()
-        self.assertEqual(node.get_required(document, "item:emit").name, "wand")
-        self.assertEqual(put["schemaVersion"], "cultnet.document_put_raw.v0")
-        self.assertEqual(put["messageId"], "put-emit")
-        self.assertEqual(put["document"]["schemaId"], document.catalog_entry().schema_id)
-        self.assertEqual(put["document"]["recordKey"], "item:emit")
-        self.assertEqual(put["document"]["sourceRuntimeId"], "python-node")
-        self.assertEqual(put["shardId"], "mesh")
-        self.assertEqual(put["shardEpoch"], 1)
-
-        delete = node.delete_raw_message(
-            document,
-            "item:emit",
-            message_id="delete-emit",
-            shard_id="mesh",
-            shard_epoch=1,
-        ).to_wire()
-        self.assertIsNone(node.get(document, "item:emit"))
-        self.assertEqual(delete["schemaVersion"], "cultnet.document_delete.v0")
-        self.assertEqual(delete["messageId"], "delete-emit")
-        self.assertEqual(delete["schemaId"], document.catalog_entry().schema_id)
-        self.assertEqual(delete["recordKey"], "item:emit")
-        self.assertEqual(delete["shardId"], "mesh")
-        self.assertEqual(delete["shardEpoch"], 1)
-
-    def test_cultnet_document_delete_helper_matches_schema_v0_shape(self) -> None:
-        message = document_delete(
-            message_id="delete-1",
-            schema_id="schema-a",
-            record_key="record-a",
-            shard_id="interop",
-            shard_epoch=1,
-        ).to_wire()
-        self.assertEqual(message["schemaVersion"], "cultnet.document_delete.v0")
-        self.assertEqual(message["messageId"], "delete-1")
-        self.assertEqual(message["schemaId"], "schema-a")
-        self.assertEqual(message["recordKey"], "record-a")
-        self.assertEqual(message["shardId"], "interop")
-        self.assertEqual(message["shardEpoch"], 1)
-
-    def test_cultnet_auth_session_helpers_match_schema_v0_shape(self) -> None:
-        self.assertEqual(
-            login(nonce="nonce", auth="encrypted-auth", password="encrypted-password").to_wire(),
-            {
-                "schemaVersion": "cultnet.login.v0",
-                "nonce": "nonce",
-                "auth": "encrypted-auth",
-                "password": "encrypted-password",
-            },
-        )
-        self.assertEqual(
-            register(
-                nonce="nonce",
-                email="encrypted-email",
-                password="encrypted-password",
-                name="encrypted-name",
-            ).to_wire(),
-            {
-                "schemaVersion": "cultnet.register.v0",
-                "nonce": "nonce",
-                "email": "encrypted-email",
-                "password": "encrypted-password",
-                "name": "encrypted-name",
-            },
-        )
-        self.assertEqual(
-            verify_session(nonce="nonce", session="encrypted-session").to_wire(),
-            {
-                "schemaVersion": "cultnet.verify.v0",
-                "nonce": "nonce",
-                "session": "encrypted-session",
-            },
-        )
-        self.assertEqual(
-            login_success(nonce="nonce", session="encrypted-session").to_wire(),
-            {
-                "schemaVersion": "cultnet.login_success.v0",
-                "nonce": "nonce",
-                "session": "encrypted-session",
-            },
-        )
-
-    def test_cultnet_wire_catalog_describes_python_handled_messages(self) -> None:
-        descriptors = wire_message_schema_descriptors(include_schema_json=True)
-        by_version = {descriptor["schemaVersion"]: descriptor for descriptor in descriptors}
-        for schema_version in [
-            "cultnet.error.v0",
-            "cultnet.login.v0",
-            "cultnet.register.v0",
-            "cultnet.verify.v0",
-            "cultnet.login_success.v0",
-            "cultnet.transport_profile.v0",
-            "cultnet.document_delete.v0",
-            "cultnet.database_change_raw.v0",
-            "cultnet.shard_log_response.v0",
-            "cultnet.simulation_consensus_candidate.v0",
-            "cultmesh.peer_exchange_response.v0",
-        ]:
-            self.assertIn(schema_version, by_version)
-            expected_kind = "shared_contract" if schema_version == "cultnet.transport_profile.v0" else "wire_message"
-            self.assertEqual(by_version[schema_version]["kind"], expected_kind)
-            self.assertIn("cultnet.schema.v0", by_version[schema_version]["wireContracts"])
-            self.assertIn(schema_version, by_version[schema_version]["schemaJson"])
-            self.assertEqual(len(by_version[schema_version]["contentHash"]), 64)
-
-        delete_schema = json.loads(by_version["cultnet.document_delete.v0"]["schemaJson"])
-        self.assertEqual(
-            delete_schema["required"],
-            ["schemaVersion", "messageId", "schemaId", "recordKey"],
-        )
-        self.assertEqual(delete_schema["properties"]["recordKey"]["type"], "string")
-
-        error_schema = json.loads(by_version["cultnet.error.v0"]["schemaJson"])
-        self.assertEqual(error_schema["required"], ["schemaVersion", "error"])
-        self.assertEqual(error_schema["properties"]["error"]["type"], "string")
-        self.assertIn("details", error_schema["properties"])
-
-        login_schema = json.loads(by_version["cultnet.login.v0"]["schemaJson"])
-        self.assertEqual(login_schema["required"], ["schemaVersion", "nonce", "auth", "password"])
-        self.assertEqual(login_schema["properties"]["auth"]["type"], "string")
-
-        register_schema = json.loads(by_version["cultnet.register.v0"]["schemaJson"])
-        self.assertEqual(register_schema["required"], ["schemaVersion", "nonce", "email", "password", "name"])
-        self.assertEqual(register_schema["properties"]["email"]["type"], "string")
-
-        verify_schema = json.loads(by_version["cultnet.verify.v0"]["schemaJson"])
-        self.assertEqual(verify_schema["required"], ["schemaVersion", "nonce", "session"])
-        self.assertEqual(verify_schema["properties"]["session"]["type"], "string")
-
-        success_schema = json.loads(by_version["cultnet.login_success.v0"]["schemaJson"])
-        self.assertEqual(success_schema["required"], ["schemaVersion", "nonce", "session"])
-
-        transport_profile_schema = json.loads(by_version["cultnet.transport_profile.v0"]["schemaJson"])
-        self.assertEqual(transport_profile_schema["required"], ["schemaVersion", "runtimeId", "transports"])
-        transport = transport_profile_schema["properties"]["transports"]["items"]
-        self.assertEqual(transport["properties"]["protocol"]["enum"], ["tcp_framed", "litenetlib", "websocket", "rudp"])
-        self.assertEqual(
-            transport["properties"]["reconnectPolicy"]["properties"]["schemaVersion"]["const"],
-            "cultnet.reconnect_policy.v0",
-        )
-        channel = transport["properties"]["channels"]["items"]
-        self.assertEqual(channel["properties"]["ordering"]["enum"], ["ordered", "unordered", "sequenced"])
-
-        change_schema = json.loads(by_version["cultnet.database_change_raw.v0"]["schemaJson"])
-        self.assertEqual(change_schema["properties"]["changeKind"]["enum"], ["added", "updated", "removed"])
-        self.assertIn("document", change_schema["properties"])
-        self.assertIn("schemaId", change_schema["properties"])
-        self.assertIn("recordKey", change_schema["properties"])
-
-        log_schema = json.loads(by_version["cultnet.shard_log_response.v0"]["schemaJson"])
-        self.assertIn("entries", log_schema["required"])
-        self.assertIn("resyncRequired", log_schema["required"])
-        self.assertIn("compactedThrough", log_schema["properties"])
-
-        hello_schema = json.loads(by_version["cultnet.hello.v0"]["schemaJson"])
-        mutation_contract = hello_schema["properties"]["supportedMutationContracts"]["items"]
-        self.assertEqual(mutation_contract["type"], "object")
-        self.assertIn("operations", mutation_contract["properties"])
-        self.assertEqual(
-            hello_schema["properties"]["transportProfiles"]["items"]["$ref"],
-            "https://github.com/GameCult/cultnet-ts/contracts/cultnet.transport-profile.schema.json",
-        )
-
-        consensus_schema = json.loads(by_version["cultnet.simulation_consensus_candidate.v0"]["schemaJson"])
-        for required_field in ["witnessCount", "supportWeight", "totalWeight", "hasQuorum", "confidence"]:
-            self.assertIn(required_field, consensus_schema["required"])
-
-    def test_cultnet_schema_catalog_applies_filters_and_responses(self) -> None:
-        catalog = wire_message_schema_catalog(include_schema_json=True)
-        descriptor = catalog.get("https://github.com/GameCult/cultnet-ts/contracts/cultnet.document-put-raw.schema.json")
-        self.assertIsNotNone(descriptor)
-        assert descriptor is not None
-        self.assertEqual(descriptor.kind, "wire_message")
-        self.assertEqual(descriptor.schema_version, "cultnet.document_put_raw.v0")
-        self.assertIsNotNone(descriptor.schema_json)
-
-        filtered = catalog.list(kinds=["wire_message"], schema_ids=[descriptor.schema_id])
-        self.assertEqual(filtered, [descriptor])
-
-        response = catalog.create_response(
-            message_id="catalog-response",
-            include_schema_json=False,
-            schema_ids=[descriptor.schema_id],
-            kinds=["wire_message"],
-        )
-        self.assertEqual(response["schemaVersion"], "cultnet.schema_catalog_response.v0")
-        self.assertNotIn("schemaJson", response["schemas"][0])
-
-        remote = CultNetSchemaCatalog()
-        applied = remote.apply_response({
-            "schemaVersion": "cultnet.schema_catalog_response.v0",
-            "messageId": "remote",
-            "schemas": [
-                CultNetSchemaDescriptor(
-                    schema_id="schema:custom",
-                    kind="shared_contract",
-                    schema_version="custom.v0",
-                    wire_contracts=("cultnet.schema.v0",),
-                    content_hash="hash",
-                    schema_json="{}",
-                ).to_wire()
-            ],
-        })
-        self.assertEqual(applied[0].schema_id, "schema:custom")
-        self.assertEqual(remote.get("schema:custom"), applied[0])
-
-    def test_cultnet_shard_helpers_match_schema_v0_shape(self) -> None:
-        catalog = shard_catalog_request(
-            message_id="catalog-1",
-            schema_ids=["schema-a"],
-            record_keys=["record-a"],
-        ).to_wire()
-        self.assertEqual(catalog["schemaVersion"], "cultnet.shard_catalog_request.v0")
-        self.assertEqual(catalog["messageId"], "catalog-1")
-        self.assertEqual(catalog["schemaIds"], ["schema-a"])
-        self.assertEqual(catalog["recordKeys"], ["record-a"])
-
-        log = shard_log_request(
-            message_id="log-1",
-            shard_id="interop",
-            shard_epoch=7,
-            after_sequence=3,
-            limit=2,
-        ).to_wire()
-        self.assertEqual(log["schemaVersion"], "cultnet.shard_log_request.v0")
-        self.assertEqual(log["messageId"], "log-1")
-        self.assertEqual(log["shardId"], "interop")
-        self.assertEqual(log["shardEpoch"], 7)
-        self.assertEqual(log["afterSequence"], 3)
-        self.assertEqual(log["limit"], 2)
-
-    def test_cultnet_shard_catalog_applies_filters_and_responses(self) -> None:
-        catalog = CultNetShardCatalog()
-        primary = catalog.upsert(CultNetShardDescriptor(
-            shard_id="notes",
-            owner_runtime_id="python-runtime",
-            epoch=2,
-            is_primary=True,
-            schema_ids=("schema-note",),
-            key_prefix="note:",
-            primary_endpoints=("cultnet://127.0.0.1:3075",),
-            read_replica_endpoints=("cultnet://127.0.0.1:3075",),
-            region="local",
-        ))
-        catalog.upsert({
-            "shardId": "facts",
-            "ownerRuntimeId": "python-runtime",
-            "epoch": 1,
-            "schemaIds": ["schema-fact"],
-            "keyPrefix": "fact:",
-            "primaryEndpoints": ["cultnet://127.0.0.1:3076"],
-        })
-
-        self.assertTrue(primary.serves(schema_id="schema-note", record_key="note:1"))
-        self.assertFalse(primary.serves(schema_id="schema-note", record_key="fact:1"))
-        self.assertEqual(catalog.list(schema_ids=["schema-note"]), [primary])
-        self.assertEqual(catalog.list(record_keys=["note:1"]), [primary])
-
-        response = catalog.create_response(
-            message_id="shards",
-            schema_ids=["schema-note"],
-            record_keys=["note:1"],
-        )
-        self.assertEqual(response["schemaVersion"], "cultnet.shard_catalog_response.v0")
-        self.assertEqual(response["shards"][0]["shardId"], "notes")
-        self.assertEqual(response["shards"][0]["ownerRuntimeId"], "python-runtime")
-
-        remote = CultNetShardCatalog()
-        applied = remote.apply_response(response)
-        self.assertEqual(applied[0].shard_id, "notes")
-        self.assertEqual(remote.get("notes"), applied[0])
-
-    def test_cultnet_shard_log_response_tracks_cursor_and_resync_state(self) -> None:
-        response = CultNetShardLogResponse.from_wire({
-            "schemaVersion": "cultnet.shard_log_response.v0",
-            "messageId": "log",
-            "shardId": "notes",
-            "shardEpoch": 2,
-            "entries": [
-                CultNetShardLogEntry(
-                    sequence=2,
-                    change_kind="updated",
-                    put={"schemaVersion": "cultnet.document_put_raw.v0", "messageId": "put", "document": {"schemaId": "schema-note", "recordKey": "note:1", "payload": b"p"}},
-                    committed_at="2026-06-14T00:00:00Z",
-                ).to_wire(),
-                {"sequence": 3, "changeKind": "removed", "delete": {"schemaId": "schema-note", "recordKey": "note:1"}},
-            ],
-            "resyncRequired": False,
-        })
-        self.assertEqual(response.last_sequence, 3)
-        self.assertFalse(response.resync_required)
-        self.assertEqual(response.entries[0].put["document"]["recordKey"], "note:1")
-        self.assertIsInstance(response.entries[0].raw_document, CultNetRawDocumentRecord)
-        self.assertEqual(response.entries[0].raw_document.record_key, "note:1")
-        self.assertEqual(response.entries[1].delete_schema_id, "schema-note")
-        self.assertEqual(response.entries[1].delete_record_key, "note:1")
-        self.assertEqual(response.to_wire()["entries"][1]["delete"]["recordKey"], "note:1")
-        self.assertIs(response.require_usable(), response)
-
-        resync = CultNetShardLogResponse.from_wire({
-            "schemaVersion": "cultnet.shard_log_response.v0",
-            "messageId": "log-resync",
-            "shardId": "notes",
-            "shardEpoch": 2,
-            "entries": [],
-            "resyncRequired": True,
-            "reason": "compacted",
-            "compactedThrough": 12,
-        })
-        self.assertEqual(resync.last_sequence, 12)
-        with self.assertRaisesRegex(ValueError, "compacted"):
-            resync.require_usable()
-
-    def test_cultnet_simulation_observation_helper_matches_schema_v0_shape(self) -> None:
-        claim_hash = compute_simulation_claim_hash("frame:42", "subject:player-1", "hit")
-        self.assertEqual(len(claim_hash), 64)
-        message = simulation_observation(
-            message_id="obs-1",
-            witness_runtime_id="python-test",
-            shard_id="interop",
-            shard_epoch=1,
-            frame=42,
-            subject_id="player-1",
-            claim_kind="hit",
-            claim_hash=claim_hash,
-            claim_summary="player-1 hit target-a",
-            observed_at="2026-06-13T00:00:02Z",
-        ).to_wire()
-        self.assertEqual(message["schemaVersion"], "cultnet.simulation_observation.v0")
-        self.assertEqual(message["messageId"], "obs-1")
-        self.assertEqual(message["observation"]["witnessRuntimeId"], "python-test")
-        self.assertEqual(message["observation"]["claimHash"], claim_hash)
-        self.assertEqual(message["observation"]["weight"], 1.0)
-        observation = CultNetSimulationObservation.from_wire(message)
-        self.assertEqual(observation.witness_runtime_id, "python-test")
-        self.assertEqual(observation.claim_summary, "player-1 hit target-a")
-        self.assertEqual(observation.to_message_wire(message_id="obs-2")["observation"], message["observation"])
-
-    def test_cultnet_witness_artifact_bundle_uses_csharp_slot_order(self) -> None:
-        import msgpack  # type: ignore
-
-        bundle = witness_artifact_bundle(
-            bundle_id="bundle-1",
-            witness_kind="interop-proof",
-            captured_at="2026-06-13T00:00:03Z",
-            subject={"documentType": "cultnet.interop-note", "subjectId": "note:python"},
-            contracts=[{"role": "payload", "schemaId": "schema-a"}],
-            artifacts=[{"role": "log", "uri": "cultcache://bundle-1/log", "mediaType": "text/plain"}],
-            timing_witnesses=[{"stage": "roundtrip", "startedAt": "2026-06-13T00:00:03Z", "completedAt": "2026-06-13T00:00:04Z", "latencyMs": 1.0}],
-            provenance={"pipelineId": "interop", "runId": "run-1", "runtimeId": "python-test"},
-        )
-        payload = encode_witness_artifact_bundle_payload(bundle)
-        decoded = decode_witness_artifact_bundle_payload(payload)
-        typed = CultNetWitnessArtifactBundle.from_wire(bundle)
-        typed_payload = typed.to_payload()
-        typed_decoded = CultNetWitnessArtifactBundle.from_payload(typed_payload)
-        slots = msgpack.unpackb(payload, raw=False)
-
-        self.assertEqual(payload, typed_payload)
-        self.assertEqual(slots[0], "bundle-1")
-        self.assertEqual(slots[1], "interop-proof")
-        self.assertEqual(slots[2], "2026-06-13T00:00:03Z")
-        self.assertEqual(slots[3]["subjectId"], "note:python")
-        self.assertEqual(slots[4][0]["schemaId"], "schema-a")
-        self.assertEqual(slots[5][0]["uri"], "cultcache://bundle-1/log")
-        self.assertEqual(slots[6][0]["latencyMs"], 1.0)
-        self.assertEqual(slots[7]["runtimeId"], "python-test")
-        self.assertEqual(decoded["bundleId"], "bundle-1")
-        self.assertEqual(decoded["witnessKind"], "interop-proof")
-        self.assertEqual(decoded["subject"]["subjectId"], "note:python")
-        self.assertEqual(decoded["contracts"][0]["schemaId"], "schema-a")
-        self.assertEqual(decoded["artifacts"][0]["mediaType"], "text/plain")
-        self.assertEqual(decoded["provenance"]["runtimeId"], "python-test")
-        self.assertEqual(typed.bundle_id, "bundle-1")
-        self.assertEqual(typed_decoded.to_wire(), bundle)
-
-    def test_cultmesh_node_uses_cultcache_store(self) -> None:
-        with tempfile.TemporaryDirectory() as tmp:
-            document = define_database_entry_type("mesh.note", [("body", 0)])
-            store_path = Path(tmp) / "mesh.cc"
-            node = create_node(store_path, runtime_id="mesh-test")
-            self.assertIsInstance(node.database, CultMeshDatabase)
-            node.database.register_document(document)
-            node.database.put(document, "note:1", {"body": "hello"})
-            self.assertEqual(node.get_required(document, "note:1")["body"], "hello")
-
-            reopened = create_node(store_path, runtime_id="mesh-test")
-            reopened.database.register_document(document)
-            reopened.database.pull()
-            self.assertEqual(reopened.database.get(document, "note:1")["body"], "hello")
-
-    def test_cultmesh_node_options_attach_default_durable_shard_log_store(self) -> None:
-        with tempfile.TemporaryDirectory() as tmp:
-            document = define_database_entry_type(
-                "mesh.durable_option_note",
-                [("body", 0)],
-                schema_id="mesh.durable_option_note.v1",
-            )
-            cache_path = Path(tmp) / "world.cc"
-            node = CultMesh.create_node(
-                cache_path,
-                runtime_id="durable-option-primary",
-                options=CultMeshNodeOptions(enable_durable_shard_logs=True),
-            )
-            node.database.register_document(document)
-            node.database.put_raw_message(document, "note:1", {"body": "stored"}, shard_id="notes", shard_epoch=5)
-
-            log_path = Path(tmp) / "world.cultmesh" / "shard-logs"
-            self.assertTrue(log_path.exists())
-
-            reopened = CultMesh.start_node(
-                cache_path,
-                runtime_id="durable-option-primary",
-                enable_durable_shard_logs=True,
-            )
-            reopened.database.register_document(document)
-            response = reopened.database.build_shard_log_response(shard_id="notes", shard_epoch=5)
-
-            self.assertEqual(reopened.database.shard_ids(), ["notes"])
-            self.assertEqual([entry.sequence for entry in response.entries], [1])
-            self.assertEqual(response.entries[0].raw_document.record_key, "note:1")
-
-    def test_cultmesh_database_watchers_observe_local_changes_and_unsubscribe(self) -> None:
-        document = define_database_entry_type("mesh.watch", [("body", 0)])
-        node = CultMesh.create_node(runtime_id="mesh-watch")
-        node.database.register_document(document)
-        changes: list[CultMeshDatabaseChange] = []
-        all_changes: list[CultMeshDatabaseChange] = []
-
-        unsubscribe_record = node.database.watch_record(document, "note:1", changes.append)
-        unsubscribe_all = node.database.watch(all_changes.append, document=document)
-
-        node.database.put(document, "note:1", {"body": "hello"})
-        node.database.put(document, "note:2", {"body": "skip"})
-        node.database.put(document, "note:1", {"body": "updated"})
-        node.database.delete(document, "note:1")
-        unsubscribe_record()
-        node.database.put(document, "note:1", {"body": "after-unsubscribe"})
-        unsubscribe_all()
-
-        self.assertEqual([change.change_kind for change in changes], ["added", "updated", "removed"])
-        self.assertEqual([change.record_key for change in changes], ["note:1", "note:1", "note:1"])
-        self.assertEqual(changes[1].previous_value, {"body": "hello"})
-        self.assertIsNone(changes[2].value)
-        self.assertEqual([change.record_key for change in all_changes], ["note:1", "note:2", "note:1", "note:1", "note:1"])
-
-    def test_cultmesh_database_register_document_is_idempotent(self) -> None:
-        document = define_database_entry_type("mesh.idempotent", [("body", 0)])
-        conflicting = define_database_entry_type("mesh.idempotent", [("title", 0)])
-        node = CultMesh.create_node(runtime_id="mesh-idempotent")
-
-        node.database.register_document(document)
-        node.database.register_document(document)
-        node.database.put(document, "note:1", {"body": "still registered once"})
-
-        self.assertEqual(node.database.get_required(document, "note:1")["body"], "still registered once")
-        self.assertEqual([registered.type for registered in node.documents], ["mesh.idempotent"])
-        with self.assertRaises(ValueError):
-            node.database.register_document(conflicting)
-
-    def test_cultmesh_database_global_document_facade_uses_singleton_key_and_watchers(self) -> None:
-        document = define_database_entry_type(
-            "mesh.global_settings",
-            [("theme", 0)],
-            global_document=True,
-        )
-        node = CultMesh.create_node(runtime_id="mesh-global")
-        node.database.register_document(document)
-        changes: list[CultMeshDatabaseChange] = []
-
-        node.database.watch_global(document, changes.append)
-        node.database.put_global(document, {"theme": "ash"})
-        node.put_global(document, {"theme": "ember"})
-        node.delete_global(document)
-
-        self.assertIsNone(node.database.get_global(document))
-        self.assertEqual([change.record_key for change in changes], [node.cache.GLOBAL_KEY] * 3)
-        self.assertEqual([change.change_kind for change in changes], ["added", "updated", "removed"])
-        self.assertEqual(changes[1].previous_value, {"theme": "ash"})
-        self.assertEqual(changes[2].previous_value, {"theme": "ember"})
-        with self.assertRaises(Exception):
-            node.database.put(document, "settings:wrong", {"theme": "bad"})
-
-    def test_cultmesh_database_creates_raw_snapshot_response_from_envelopes(self) -> None:
-        document = define_database_entry_type(
-            "mesh.snapshot_note",
-            [("body", 0)],
-            schema_id="mesh.snapshot_note.v1",
-        )
-        source = CultMesh.create_node(runtime_id="mesh-snapshot-source")
-        source.database.register_document(document)
-        source.database.put(document, "note:1", {"body": "include"})
-        source.database.put(document, "note:2", {"body": "skip"})
-
-        typed_response = source.database.build_snapshot_response(
-            message_id="snapshot-1",
-            schema_ids=["mesh.snapshot_note.v1"],
-            record_keys=["note:1"],
-            shard_id="notes",
-            shard_epoch=4,
-            shard_log_sequence=7,
-        )
-        response = source.database.create_snapshot_response(
-            message_id="snapshot-1",
-            schema_ids=["mesh.snapshot_note.v1"],
-            record_keys=["note:1"],
-            shard_id="notes",
-            shard_epoch=4,
-            shard_log_sequence=7,
-        )
-
-        self.assertIsInstance(typed_response, CultNetRawSnapshotResponse)
-        self.assertEqual(typed_response.message_id, "snapshot-1")
-        self.assertEqual(typed_response.documents[0].record_key, "note:1")
-        self.assertEqual(typed_response.to_wire(), response)
-        self.assertEqual(source.build_snapshot_response(schema_ids=["mesh.snapshot_note.v1"]).documents[0].record_key, "note:1")
-        self.assertEqual(response["schemaVersion"], "cultnet.snapshot_response_raw.v0")
-        self.assertEqual(response["messageId"], "snapshot-1")
-        self.assertEqual(response["shardId"], "notes")
-        self.assertEqual(response["shardEpoch"], 4)
-        self.assertEqual(response["shardLogSequence"], 7)
-        self.assertEqual([record["recordKey"] for record in response["documents"]], ["note:1"])
-        self.assertEqual(response["documents"][0]["schemaId"], "mesh.snapshot_note.v1")
-        self.assertEqual(response["documents"][0]["payloadEncoding"], "messagepack")
-
-        target = CultMesh.create_node(runtime_id="mesh-snapshot-target")
-        target.database.register_document(document)
-        applied = target.database.apply_snapshot_response(response)
-        self.assertEqual([(record.schema_id, record.record_key) for record in applied], [("mesh.snapshot_note.v1", "note:1")])
-        self.assertEqual(target.database.get_required(document, "note:1"), {"body": "include"})
-        self.assertIsNone(target.database.get(document, "note:2"))
-
-        typed_target = CultMesh.create_node(runtime_id="mesh-snapshot-typed-target")
-        typed_target.database.register_document(document)
-        typed_applied = typed_target.database.apply_snapshot_response(typed_response)
-        self.assertEqual([(record.schema_id, record.record_key) for record in typed_applied], [("mesh.snapshot_note.v1", "note:1")])
-        self.assertEqual(typed_target.database.get_required(document, "note:1"), {"body": "include"})
-
-    def test_cultmesh_database_filters_snapshot_by_logged_shard_membership(self) -> None:
-        document = define_database_entry_type(
-            "mesh.sharded_snapshot_note",
-            [("body", 0)],
-            schema_id="mesh.sharded_snapshot_note.v1",
-        )
-        source = CultMesh.create_node(runtime_id="mesh-sharded-snapshot-source")
-        source.database.register_document(document)
-        source.database.put_raw_message(document, "note:notes", {"body": "include"}, shard_id="notes", shard_epoch=2)
-        source.database.put_raw_message(document, "note:other", {"body": "skip"}, shard_id="other", shard_epoch=1)
-
-        response = source.database.build_snapshot_response(
-            schema_ids=["mesh.sharded_snapshot_note.v1"],
-            shard_id="notes",
-            shard_epoch=2,
-        )
-
-        self.assertEqual(response.shard_id, "notes")
-        self.assertEqual(response.shard_epoch, 2)
-        self.assertEqual([record.record_key for record in response.documents], ["note:notes"])
-
-    def test_python_interop_peer_filters_shard_snapshot_by_logged_membership(self) -> None:
-        runtime_id = f"python-interop-test-{uuid4().hex}"
-        state = build_state(
-            runtime_id=runtime_id,
-            runtime_kind="python",
-            display_name="Python Interop Test",
-            agent_id="python-interop-test-agent",
-            schema_path=str(Path("packages/cultnet-ts/integration/contracts/cultnet.interop-note.schema.json")),
-        )
-        binding = state.bindings["note"]
-        logged_value = {
-            "schemaVersion": "cultnet.interop_note.v0",
-            "documentId": "note:logged",
-            "authorRuntimeId": runtime_id,
-            "title": "Logged",
-            "body": "This record belongs to the shard log.",
-            "tags": ["interop", "logged"],
-        }
-        unlogged_value = {
-            **logged_value,
-            "documentId": "note:unlogged",
-            "title": "Unlogged",
-            "body": "This record is in cache but not in the shard log.",
-        }
-        state.cache.put(binding.document, "note:logged", logged_value)
-        state.cache.put(binding.document, "note:unlogged", unlogged_value)
-        logged_record = {
-            "schemaId": state.note_schema_id,
-            "recordKey": "note:logged",
-            "storedAt": "2026-06-14T00:00:00Z",
-            "payloadEncoding": "messagepack",
-            "payload": binding.document.encode_payload(logged_value),
-        }
-        append_shard_log_put(
-            state,
-            {"messageId": "logged-put"},
-            logged_record,
-        )
-
-        response = raw_snapshot_response(
-            state,
-            {
-                "schemaVersion": "cultnet.snapshot_request.v0",
-                "messageId": "interop-shard-snapshot",
-                "schemaIds": [state.note_schema_id],
-                "shardId": state.shard_id,
-            },
-        )
-
-        self.assertEqual(response["shardId"], state.shard_id)
-        self.assertEqual(response["shardLogSequence"], 1)
-        self.assertEqual([record["recordKey"] for record in response["documents"]], ["note:logged"])
-
-    def test_cultmesh_database_creates_shard_log_response_from_raw_mutations(self) -> None:
-        document = define_database_entry_type(
-            "mesh.log_note",
-            [("body", 0)],
-            schema_id="mesh.log_note.v1",
-        )
-        source = CultMesh.create_node(runtime_id="mesh-log-source")
-        source.database.register_document(document)
-        source.database.put_raw_message(document, "note:1", {"body": "first"}, shard_id="notes", shard_epoch=3)
-        source.database.put_raw_message(document, "note:1", {"body": "second"}, shard_id="notes", shard_epoch=3)
-        source.database.put_raw_message(document, "note:2", {"body": "other"}, shard_id="other", shard_epoch=1)
-        source.database.delete_raw_message(document, "note:1", shard_id="notes", shard_epoch=3)
-
-        self.assertEqual(source.database.shard_ids(), ["notes", "other"])
-        self.assertEqual(source.database.shard_schema_ids("notes"), ["mesh.log_note.v1"])
-
-        typed_response = source.database.build_shard_log_response(
-            message_id="log-1",
-            shard_id="notes",
-            shard_epoch=3,
-            after_sequence=1,
-            limit=2,
-        )
-        response = source.database.create_shard_log_response(
-            message_id="log-1",
-            shard_id="notes",
-            shard_epoch=3,
-            after_sequence=1,
-            limit=2,
-        )
-
-        self.assertIsInstance(typed_response, CultNetShardLogResponse)
-        self.assertEqual(typed_response.message_id, "log-1")
-        self.assertEqual([entry.sequence for entry in typed_response.entries], [2, 3])
-        self.assertEqual(typed_response.to_wire(), response)
-        self.assertEqual([entry.sequence for entry in source.build_shard_log_response(shard_id="notes").entries], [1, 2, 3])
-        self.assertEqual(response["schemaVersion"], "cultnet.shard_log_response.v0")
-        self.assertEqual(response["messageId"], "log-1")
-        self.assertEqual(response["shardId"], "notes")
-        self.assertEqual(response["shardEpoch"], 3)
-        self.assertFalse(response["resyncRequired"])
-        self.assertEqual([entry["sequence"] for entry in response["entries"]], [2, 3])
-        self.assertEqual([entry["changeKind"] for entry in response["entries"]], ["updated", "removed"])
-        self.assertEqual(response["entries"][0]["put"]["document"]["recordKey"], "note:1")
-        self.assertEqual(response["entries"][1]["delete"]["recordKey"], "note:1")
-        empty = source.database.create_shard_log_response(shard_id="missing")
-        self.assertEqual(empty["shardEpoch"], 0)
-        self.assertEqual(empty["entries"], [])
-        self.assertTrue(empty["resyncRequired"])
-        self.assertEqual(empty["reason"], "unknown_shard")
-        stale = source.database.create_shard_log_response(shard_id="notes", shard_epoch=2)
-        self.assertEqual(stale["shardEpoch"], 3)
-        self.assertEqual(stale["entries"], [])
-        self.assertTrue(stale["resyncRequired"])
-        self.assertEqual(stale["reason"], "stale_epoch")
-        with self.assertRaises(ValueError):
-            source.database.create_shard_log_response(shard_id="notes", after_sequence=-1)
-        with self.assertRaises(ValueError):
-            source.database.create_shard_log_response(shard_id="notes", limit=-1)
-
-        target = CultMesh.create_node(runtime_id="mesh-log-target")
-        target.database.register_document(document)
-        target.database.put(document, "note:1", {"body": "first"})
-        applied = target.database.apply_shard_log_response(response)
-        self.assertEqual([record.change_kind for record in applied], ["updated", "removed"])
-        self.assertIsNone(target.database.get(document, "note:1"))
-        self.assertIsNone(target.database.get(document, "note:2"))
-
-        typed_target = CultMesh.create_node(runtime_id="mesh-log-typed-target")
-        typed_target.database.register_document(document)
-        typed_target.database.put(document, "note:1", {"body": "first"})
-        typed_applied = typed_target.database.apply_shard_log_response(typed_response)
-        self.assertEqual([record.change_kind for record in typed_applied], ["updated", "removed"])
-        self.assertIsNone(typed_target.database.get(document, "note:1"))
-
-    def test_cultnet_file_shard_mutation_log_store_persists_authoritative_entries(self) -> None:
-        document = define_database_entry_type(
-            "mesh.durable_log_note",
-            [("body", 0)],
-            schema_id="mesh.durable_log_note.v1",
-        )
-        with tempfile.TemporaryDirectory() as tmp:
-            store: CultNetShardMutationLogStore = CultNetFileShardMutationLogStore(Path(tmp) / "logs")
-            source = CultMesh.create_node(runtime_id="durable-primary")
-            source.database.register_document(document)
-            source.database.use_shard_mutation_log_store(store)
-            source.database.put_raw_message(document, "note:1", {"body": "first"}, shard_id="durable", shard_epoch=4)
-            source.database.put_raw_message(document, "note:2", {"body": "second"}, shard_id="durable", shard_epoch=4)
-
-            reopened = CultMesh.create_node(runtime_id="durable-primary")
-            reopened.database.register_document(document)
-            reopened.database.use_shard_mutation_log_store(CultNetFileShardMutationLogStore(Path(tmp) / "logs"))
-            response = reopened.database.build_shard_log_response(shard_id="durable", shard_epoch=4)
-            self.assertEqual(reopened.database.shard_ids(), ["durable"])
-            self.assertEqual(reopened.database.shard_schema_ids("durable"), ["mesh.durable_log_note.v1"])
-            self.assertEqual([entry.sequence for entry in response.entries], [1, 2])
-            self.assertEqual(response.entries[0].raw_document.record_key, "note:1")
-
-            store.compact_through("durable", 1)
-            compacted = reopened.database.build_shard_log_response(shard_id="durable", shard_epoch=4, after_sequence=0)
-            retained = reopened.database.build_shard_log_response(shard_id="durable", shard_epoch=4, after_sequence=1)
-            self.assertTrue(compacted.resync_required)
-            self.assertEqual(compacted.reason, "compacted_history")
-            self.assertEqual(compacted.compacted_through, 1)
-            self.assertEqual([entry.sequence for entry in retained.entries], [2])
-
-    def test_cultnet_shard_replicator_pulls_logs_and_resyncs_from_snapshot(self) -> None:
-        document = define_database_entry_type(
-            "mesh.replica_note",
-            [("body", 0)],
-            schema_id="mesh.replica_note.v1",
-        )
-        source = CultMesh.create_node(runtime_id="primary")
-        source.database.register_document(document)
-        source.database.put_raw_message(document, "note:1", {"body": "one"}, shard_id="notes", shard_epoch=3)
-        source.database.put_raw_message(document, "note:2", {"body": "two"}, shard_id="notes", shard_epoch=3)
-        with tempfile.TemporaryDirectory() as tmp:
-            cursor_path = Path(tmp) / "replica-cursors.msgpack"
-            server = CultMesh.serve_node(source)
-            try:
-                shard = CultNetShardDescriptor(
-                    shard_id="notes",
-                    owner_runtime_id="primary",
-                    epoch=3,
-                    is_primary=False,
-                    schema_ids=("mesh.replica_note.v1",),
-                    primary_endpoints=(f"cultnet://127.0.0.1:{server.port}",),
-                )
-                target = CultMesh.create_node(runtime_id="replica")
-                target.database.register_document(document)
-                cursor_store = CultNetFileShardReplicaCursorStore(cursor_path)
-                replicator = CultNetShardReplicator(
-                    target.database,
-                    CultNetShardReplicatorOptions(
-                        fetcher=CultNetSchemaShardLogFetcher(timeout_seconds=2.0),
-                        snapshot_fetcher=CultNetSchemaShardSnapshotFetcher(timeout_seconds=2.0),
-                        cursor_store=cursor_store,
-                        batch_size=16,
-                    ),
-                )
-
-                first_sequence = replicator.pull_once(shard)
-                restarted_replicator = CultNetShardReplicator(
-                    target.database,
-                    CultNetShardReplicatorOptions(
-                        fetcher=CultNetSchemaShardLogFetcher(timeout_seconds=2.0),
-                        snapshot_fetcher=CultNetSchemaShardSnapshotFetcher(timeout_seconds=2.0),
-                        cursor_store=CultNetFileShardReplicaCursorStore(cursor_path),
-                        batch_size=16,
-                    ),
-                )
-                second_sequence = restarted_replicator.pull_once(shard)
-
-                self.assertEqual(first_sequence, 2)
-                self.assertEqual(second_sequence, 2)
-                self.assertEqual(target.get_required(document, "note:1")["body"], "one")
-                self.assertEqual(target.get_required(document, "note:2")["body"], "two")
-                cursor = CultNetFileShardReplicaCursorStore(cursor_path).read("notes")
-                self.assertIsNotNone(cursor)
-                assert cursor is not None
-                self.assertEqual(cursor.last_applied_sequence, 2)
-                self.assertEqual(cursor.shard_epoch, 3)
-            finally:
-                server.stop()
-
-        resync_target = CultMesh.create_node(runtime_id="resync-replica")
-        resync_target.database.register_document(document)
-        snapshot = source.database.build_snapshot_response(shard_id="notes", shard_epoch=3, shard_log_sequence=2)
-
-        class CompactingFetcher:
-            def fetch(self, shard: CultNetShardDescriptor, *, after_sequence: int, limit: int | None = None) -> CultNetShardLogResponse:
-                return CultNetShardLogResponse(
-                    message_id="compact",
-                    shard_id=shard.shard_id,
-                    shard_epoch=shard.epoch,
-                    entries=(),
-                    resync_required=True,
-                    reason="compacted_history",
-                    compacted_through=after_sequence,
-                )
-
-        class SnapshotFetcher:
-            def fetch(self, shard: CultNetShardDescriptor) -> CultNetRawSnapshotResponse:
-                return snapshot
-
-        resync_replicator = CultNetShardReplicator(
-            resync_target.database,
-            CultNetShardReplicatorOptions(
-                fetcher=CompactingFetcher(),
-                snapshot_fetcher=SnapshotFetcher(),
-                cursor_store=CultNetInMemoryShardReplicaCursorStore(),
-            ),
-        )
-        resync_sequence = resync_replicator.pull_once(CultNetShardDescriptor(
-            shard_id="notes",
-            owner_runtime_id="primary",
-            epoch=3,
-            is_primary=False,
-            schema_ids=("mesh.replica_note.v1",),
-            primary_endpoints=("cultnet://primary:3075",),
-        ))
-
-        self.assertEqual(resync_sequence, 2)
-        self.assertEqual(resync_target.get_required(document, "note:1")["body"], "one")
-
-    def test_cultnet_shard_replicator_background_loop_polls_non_primary_shards(self) -> None:
-        document = define_database_entry_type(
-            "mesh.background_replica_note",
-            [("body", 0)],
-            schema_id="mesh.background_replica_note.v1",
-        )
-        source = CultMesh.create_node(runtime_id="background-primary")
-        source.database.register_document(document)
-        target = CultMesh.create_node(runtime_id="background-replica")
-        target.database.register_document(document)
-        cursor_store = CultNetInMemoryShardReplicaCursorStore()
-        errors: list[Exception] = []
-
-        class FlakySourceFetcher:
-            def __init__(self) -> None:
-                self.calls = 0
-
-            def fetch(self, shard: CultNetShardDescriptor, *, after_sequence: int, limit: int | None = None) -> CultNetShardLogResponse:
-                self.calls += 1
-                if self.calls == 1:
-                    raise RuntimeError("transient fetch failure")
-                return source.database.build_shard_log_response(
-                    shard_id=shard.shard_id,
-                    shard_epoch=shard.epoch,
-                    after_sequence=after_sequence,
-                    limit=limit,
-                )
-
-        fetcher = FlakySourceFetcher()
-        shard = CultNetShardDescriptor(
-            shard_id="background",
-            owner_runtime_id="background-primary",
-            epoch=7,
-            is_primary=False,
-            schema_ids=("mesh.background_replica_note.v1",),
-            primary_endpoints=("cultnet://127.0.0.1:3075",),
-        )
-        replicator = CultNetShardReplicator(
-            target.database,
-            CultNetShardReplicatorOptions(
-                fetcher=fetcher,
-                cursor_store=cursor_store,
-                batch_size=1,
-                poll_interval_seconds=0.01,
-                on_error=errors.append,
-            ),
-        )
-        try:
-            source.database.put_raw_message(document, "note:1", {"body": "one"}, shard_id="background", shard_epoch=7)
-            replicator.start([shard])
-            self._wait_until(lambda: target.database.get(document, "note:1") is not None)
-            source.database.put_raw_message(document, "note:2", {"body": "two"}, shard_id="background", shard_epoch=7)
-            self._wait_until(lambda: target.database.get(document, "note:2") is not None)
-        finally:
-            replicator.stop()
-
-        cursor = cursor_store.read("background")
-        self.assertEqual(target.get_required(document, "note:1")["body"], "one")
-        self.assertEqual(target.get_required(document, "note:2")["body"], "two")
-        self.assertIsNotNone(cursor)
-        assert cursor is not None
-        self.assertEqual(cursor.last_applied_sequence, 2)
-        self.assertEqual(cursor.shard_epoch, 7)
-        self.assertEqual(len(errors), 1)
-        self.assertEqual(str(errors[0]), "transient fetch failure")
-
-    def test_cultnet_schema_write_forwarder_sends_raw_writes_to_primary(self) -> None:
-        document = define_database_entry_type(
-            "mesh.forward_note",
-            [("body", 0)],
-            schema_id="mesh.forward_note.v1",
-        )
-        primary = CultMesh.create_node(runtime_id="forward-primary")
-        primary.database.register_document(document)
-        server = CultMesh.serve_node(primary)
-        try:
-            shard = CultNetShardDescriptor(
-                shard_id="forward",
-                owner_runtime_id="forward-primary",
-                epoch=9,
-                is_primary=False,
-                schema_ids=("mesh.forward_note.v1",),
-                primary_endpoints=(f"cultnet://127.0.0.1:{server.port}",),
-            )
-            forwarder: CultNetShardWriteForwarder = CultNetSchemaWriteForwarder(timeout_seconds=2.0)
-            put = document_put_raw(
-                message_id="forward-put",
-                key="note:forward",
-                schema_id=document.catalog_entry().schema_id,
-                stored_at="2026-06-14T00:00:00Z",
-                payload=document.encode_payload({"body": "forwarded"}),
-            ).to_wire()
-            delete = document_delete(
-                message_id="forward-delete",
-                schema_id=document.catalog_entry().schema_id,
-                record_key="note:forward",
-            ).to_wire()
-
-            forwarder.forward_put(shard, put)
-            self._eventually(lambda: primary.database.get(document, "note:forward") is not None)
-            self.assertEqual(primary.database.get_required(document, "note:forward")["body"], "forwarded")
-            forwarder.forward_delete(shard, delete)
-            self._eventually(lambda: primary.database.get(document, "note:forward") is None)
-
-            log = primary.database.build_shard_log_response(shard_id="forward", shard_epoch=9)
-            self.assertIsNone(primary.database.get(document, "note:forward"))
-            self.assertEqual([entry.change_kind for entry in log.entries], ["added", "removed"])
-            self.assertEqual(log.entries[0].put["shardId"], "forward")
-            self.assertEqual(log.entries[1].delete["shardEpoch"], 9)
-        finally:
-            server.stop()
-
-    def _eventually(self, predicate: Callable[[], bool], *, timeout_seconds: float = 2.0) -> None:
-        deadline = time.monotonic() + timeout_seconds
-        while time.monotonic() < deadline:
-            if predicate():
-                return
-            time.sleep(0.01)
-        self.assertTrue(predicate())
-
-    def test_cultmesh_database_watchers_observe_name_and_index_changes(self) -> None:
-        document = define_database_entry_type(
-            "mesh.named_watch",
-            [("name", 0), ("kind", 1)],
-            name="name",
-            indexes={"kind": "kind"},
-        )
-        node = CultMesh.create_node(runtime_id="mesh-named-watch")
-        node.database.register_document(document)
-        name_changes: list[CultMeshDatabaseChange] = []
-        index_changes: list[CultMeshDatabaseChange] = []
-
-        node.database.watch_by_name(document, "Potion", name_changes.append)
-        node.database.watch_by_index(document, "kind", "consumable", index_changes.append)
-
-        node.database.put(document, "item:1", {"name": "Potion", "kind": "consumable"})
-        node.database.put(document, "item:2", {"name": "Sword", "kind": "weapon"})
-        node.database.put(document, "item:1", {"name": "Elixir", "kind": "rare"})
-        node.database.delete(document, "item:1")
-
-        self.assertEqual([change.change_kind for change in name_changes], ["added", "updated"])
-        self.assertEqual([change.record_key for change in name_changes], ["item:1", "item:1"])
-        self.assertEqual(name_changes[1].previous_value, {"name": "Potion", "kind": "consumable"})
-        self.assertEqual([change.change_kind for change in index_changes], ["added", "updated"])
-        self.assertEqual([change.record_key for change in index_changes], ["item:1", "item:1"])
-        self.assertEqual(index_changes[1].value, {"name": "Elixir", "kind": "rare"})
-
-    def test_cultmesh_database_watch_by_name_and_index_validate_lookup_shape(self) -> None:
-        document = define_database_entry_type("mesh.unnamed_watch", [("body", 0)])
-        node = CultMesh.create_node(runtime_id="mesh-watch-validation")
-        node.database.register_document(document)
-
-        with self.assertRaises(ValueError):
-            node.database.watch_by_name(document, "missing", lambda _: None)
-        with self.assertRaises(ValueError):
-            node.database.watch_by_index(document, "missing", "value", lambda _: None)
-        with self.assertRaises(ValueError):
-            node.database.watch_by_index(document, "", "value", lambda _: None)
-        with self.assertRaises(ValueError):
-            node.database.watch_by_index(document, "missing", "", lambda _: None)
-
-    def test_cultmesh_facade_matches_peer_runtime_entrypoints(self) -> None:
-        with tempfile.TemporaryDirectory() as tmp:
-            store_path = Path(tmp) / "mesh.cc"
-            node = CultMesh.start_node(store_path, runtime_id="mesh-facade")
-
-            self.assertEqual(node.runtime_id, "mesh-facade")
-            self.assertIsInstance(CultMesh.create_node(), type(node))
-            self.assertIsInstance(CultMesh.create_verse_catalog(), CultMeshVerseCatalog)
-            self.assertIsInstance(CultMesh.create_peer_catalog(), CultMeshPeerCatalog)
-            self.assertIsInstance(CultMesh.create_authority_lease_catalog(), CultMeshAuthorityLeaseCatalog)
-            self.assertIsInstance(CultMesh.create_stream_catalog(), CultMeshStreamCatalog)
-            self.assertIsInstance(CultMesh.create_schema_catalog(), CultNetSchemaCatalog)
-            self.assertIsInstance(CultMesh.create_builtin_schema_catalog(), CultNetSchemaCatalog)
-            self.assertIsInstance(CultMesh.create_shard_catalog(), CultNetShardCatalog)
-            builtins = CultMesh.create_builtin_schema_catalog(
-                include_schema_json=False,
-                kinds=["shared_contract"],
-            )
-            self.assertEqual(
-                builtins.list()[0].schema_id,
-                "https://github.com/GameCult/cultnet-ts/contracts/cultnet.transport-profile.schema.json",
-            )
-            self.assertIsNone(builtins.list()[0].schema_json)
-            peer_exchange_schema_id = (
-                "https://github.com/GameCult/cultnet-ts/contracts/cultmesh.peer-exchange-request.schema.json"
-            )
-            filtered_builtin = CultMesh.create_builtin_schema_catalog(
-                include_schema_json=True,
-                schema_ids=[peer_exchange_schema_id],
-            )
-            self.assertEqual(
-                filtered_builtin.list()[0].schema_version,
-                "cultmesh.peer_exchange_request.v0",
-            )
-            self.assertIn(
-                "cultmesh.peer_exchange_request.v0",
-                filtered_builtin.list()[0].schema_json or "",
-            )
-            shard_catalog = CultMesh.create_shard_catalog()
-            shard_catalog.upsert(
-                CultNetShardDescriptor(
-                    shard_id="python-notes-a",
-                    owner_runtime_id="mesh-facade",
-                    epoch=7,
-                    is_primary=True,
-                    schema_ids=("python.note.v1",),
-                    key_prefix="note:",
-                )
-            )
-            self.assertEqual(
-                [
-                    shard.shard_id
-                    for shard in shard_catalog.list(schema_ids=["python.note.v1"], record_keys=["note:1"])
-                ],
-                ["python-notes-a"],
-            )
-            verse_client = CultMesh.create_verse_discovery_client("127.0.0.1", 4010, timeout_seconds=1.5)
-            peer_client = CultMesh.create_peer_exchange_client("127.0.0.1", 4011, timeout_seconds=1.5)
-            raw_client = CultMesh.create_client("127.0.0.1", 4012, timeout_seconds=1.5)
-            connected_client = CultMesh.connect_client("127.0.0.1", 4013, timeout_seconds=1.5)
-            self.assertIsInstance(verse_client, CultMeshVerseDiscoveryClient)
-            self.assertIsInstance(peer_client, CultMeshPeerExchangeClient)
-            self.assertIsInstance(verse_client, CultMeshDiscoveryClient)
-            self.assertIsInstance(peer_client, CultMeshDiscoveryClient)
-            self.assertIsInstance(raw_client, CultNetRawClient)
-            self.assertIsInstance(connected_client, CultNetRawClient)
-            self.assertEqual((verse_client.host, verse_client.port, verse_client.timeout_seconds), ("127.0.0.1", 4010, 1.5))
-            self.assertEqual((peer_client.host, peer_client.port, peer_client.timeout_seconds), ("127.0.0.1", 4011, 1.5))
-            self.assertEqual((raw_client.host, raw_client.port, raw_client.timeout_seconds), ("127.0.0.1", 4012, 1.5))
-            self.assertEqual((connected_client.host, connected_client.port, connected_client.timeout_seconds), ("127.0.0.1", 4013, 1.5))
-
-    def test_cultmesh_simulation_fact_uses_csharp_slot_contract(self) -> None:
-        import msgpack  # type: ignore
-
-        candidate = {
-            "shardId": "arena",
-            "shardEpoch": 4,
-            "frame": 100,
-            "subjectId": "bob",
-            "claimKind": "hit",
-            "claimHash": compute_simulation_claim_hash("hit", "alice", "bob", "frame:100"),
-            "claimSummary": "alice shot bob first",
-            "witnessCount": 2,
-            "supportWeight": 2.0,
-            "totalWeight": 2.0,
-            "confidence": 1.0,
-            "hasQuorum": True,
-        }
-
-        fact = CultMeshSimulationFact.from_candidate(candidate, committed_at="2026-06-13T00:00:00Z")
-        payload = simulation_fact_document.encode_payload(fact)
-        slots = msgpack.unpackb(payload, raw=False)
-
-        self.assertEqual(CultMeshSimulationFact.create_record_key(candidate), f"simulation:{fact.fact_id}")
-        self.assertEqual(slots[0], fact.fact_id)
-        self.assertEqual(slots[1], "arena")
-        self.assertEqual(slots[2], 4)
-        self.assertEqual(slots[3], 100)
-        self.assertEqual(slots[4], "bob")
-        self.assertEqual(slots[5], "hit")
-        self.assertEqual(slots[6], candidate["claimHash"])
-        self.assertEqual(slots[7], "alice shot bob first")
-        self.assertEqual(slots[8], 2)
-        self.assertEqual(slots[9], 2.0)
-        self.assertEqual(slots[10], 2.0)
-        self.assertEqual(slots[11], 1.0)
-        self.assertEqual(slots[12], "2026-06-13T00:00:00Z")
-
-    def test_cultmesh_simulation_fact_committer_rejects_without_quorum_and_stores_fact(self) -> None:
-        candidate = {
-            "shardId": "arena",
-            "shardEpoch": 4,
-            "frame": 100,
-            "subjectId": "bob",
-            "claimKind": "hit",
-            "claimHash": compute_simulation_claim_hash("hit", "alice", "bob", "frame:100"),
-            "claimSummary": "alice shot bob first",
-            "witnessCount": 2,
-            "supportWeight": 2.0,
-            "totalWeight": 2.0,
-            "confidence": 1.0,
-            "hasQuorum": True,
-        }
-
-        with tempfile.TemporaryDirectory() as tmp:
-            node = CultMesh.create_node(Path(tmp) / "facts.cc", runtime_id="mesh-facts")
-            committer = CultMesh.create_simulation_fact_committer(node)
-
-            rejected = dict(candidate)
-            rejected["hasQuorum"] = False
-            with self.assertRaisesRegex(ValueError, "before quorum"):
-                committer.commit(rejected)
-
-            committed = committer.commit(candidate, committed_at="2026-06-13T00:00:00Z")
-            stored = node.get_required(simulation_fact_document, committed.key)
-
-            self.assertEqual(stored.claim_hash, candidate["claimHash"])
-            self.assertEqual(stored.committed_at, "2026-06-13T00:00:00Z")
-            self.assertEqual(committed.fact.fact_id, stored.fact_id)
-
-    def test_cultnet_simulation_consensus_dedupes_witnesses_and_requires_quorum(self) -> None:
-        from cultnet_py import CultNetSimulationConsensus
-
-        consensus = CultNetSimulationConsensus(
-            CultNetSimulationConsensusOptions(minimum_witnesses=2, quorum_ratio=1.0)
-        )
-        claim_hash = compute_simulation_claim_hash("hit", "alice", "bob", "frame:100")
-        observations = [
-            {
-                "witnessRuntimeId": "watcher-1",
-                "shardId": "arena",
-                "shardEpoch": 4,
-                "frame": 100,
-                "subjectId": "bob",
-                "claimKind": "hit",
-                "claimHash": claim_hash,
-                "claimSummary": "alice shot bob first",
-                "weight": 1.0,
-            },
-            {
-                "witnessRuntimeId": "watcher-1",
-                "shardId": "arena",
-                "shardEpoch": 4,
-                "frame": 100,
-                "subjectId": "bob",
-                "claimKind": "hit",
-                "claimHash": "stale-duplicate",
-                "weight": 0.5,
-            },
-            {
-                "witnessRuntimeId": "watcher-2",
-                "shardId": "arena",
-                "shardEpoch": 4,
-                "frame": 100,
-                "subjectId": "bob",
-                "claimKind": "hit",
-                "claimHash": claim_hash,
-                "weight": 1.0,
-            },
-        ]
-
-        candidates = consensus.build_candidates(observations)
-        typed_candidates = consensus.build_candidate_objects([
-            CultNetSimulationObservation.from_wire(observation)
-            for observation in observations
-        ])
-
-        self.assertEqual(len(candidates), 1)
-        self.assertEqual(candidates[0]["claimHash"], claim_hash)
-        self.assertEqual(candidates[0]["witnessCount"], 2)
-        self.assertEqual(candidates[0]["supportWeight"], 2.0)
-        self.assertTrue(candidates[0]["hasQuorum"])
-        self.assertEqual(len(typed_candidates), 1)
-        self.assertIsInstance(typed_candidates[0], CultNetSimulationConsensusCandidate)
-        self.assertEqual(typed_candidates[0].claim_hash, claim_hash)
-        self.assertEqual(typed_candidates[0].to_wire(), candidates[0])
-        self.assertEqual(CultNetSimulationConsensusCandidate.from_wire(candidates[0]), typed_candidates[0])
-
-    def test_cultmesh_game_session_submits_observations_and_commits_quorum_once(self) -> None:
-        claim_hash = compute_simulation_claim_hash("hit", "alice", "bob", "frame:100")
-        first = simulation_observation(
-            message_id="obs-1",
-            witness_runtime_id="watcher-1",
-            shard_id="arena",
-            shard_epoch=4,
-            frame=100,
-            subject_id="bob",
-            claim_kind="hit",
-            claim_hash=claim_hash,
-            claim_summary="alice shot bob first",
-        ).to_wire()
-        second = simulation_observation(
-            message_id="obs-2",
-            witness_runtime_id="watcher-2",
-            shard_id="arena",
-            shard_epoch=4,
-            frame=100,
-            subject_id="bob",
-            claim_kind="hit",
-            claim_hash=claim_hash,
-            claim_summary="alice shot bob first",
-        ).to_wire()
-
-        with tempfile.TemporaryDirectory() as tmp:
-            node = CultMesh.create_node(Path(tmp) / "session.cc", runtime_id="mesh-session")
-            session = CultMesh.create_game_session(
-                node,
-                CultMeshGameSessionOptions(
-                    consensus_options=CultNetSimulationConsensusOptions(minimum_witnesses=2, quorum_ratio=1.0)
-                ),
-            )
-            seen_candidates: list[CultNetSimulationConsensusCandidate] = []
-            seen_facts: list[CultMeshDatabaseChange] = []
-            unsubscribe_candidates = session.watch_candidates(seen_candidates.append)
-            unsubscribe_facts = session.watch_simulation_facts(seen_facts.append)
-
-            self.assertEqual(session.submit_and_commit(CultNetSimulationObservation.from_wire(first)), [])
-            typed_candidates = session.submit_observation_candidates(CultNetSimulationObservation.from_wire(second))
-            commits = session.commit_quorum_candidate_objects(typed_candidates)
-            replay = session.commit_quorum_candidates(session.submit_observation(second))
-            unsubscribe_candidates()
-            unsubscribe_facts()
-
-            self.assertEqual(len(typed_candidates), 1)
-            self.assertTrue(typed_candidates[0].has_quorum)
-            self.assertEqual(len(commits), 1)
-            self.assertEqual(replay, [])
-            self.assertEqual([candidate.claim_hash for candidate in seen_candidates], [claim_hash, claim_hash, claim_hash])
-            self.assertEqual(len(seen_facts), 1)
-            self.assertEqual(seen_facts[0].change_kind, "added")
-            self.assertEqual(seen_facts[0].value.claim_hash, claim_hash)
-            stored = node.get_required(simulation_fact_document, commits[0].key)
-            self.assertEqual(stored.claim_hash, claim_hash)
-            self.assertEqual(stored.witness_count, 2)
-
-    def test_cultmesh_game_session_serves_catalogs_and_observations_over_wire(self) -> None:
-        verse_catalog = CultMeshVerseCatalog()
-        peer_catalog = CultMeshPeerCatalog()
-        verse_catalog.upsert(CultMeshVerseDescriptor(
-            verse_id="session-verse",
-            display_name="Session Verse",
-            authority_model="local",
-            compatibility=CultMeshVerseCompatibility("cultmesh.v0", "session-rules"),
-        ))
-        peer_catalog.upsert(CultMeshPeerCard(
-            peer_id="session-peer",
-            verse_id="session-verse",
-            endpoints=("cultnet://127.0.0.1:0",),
-            roles=("simulation-observer", "read-replica"),
-            shard_ids=("arena",),
-        ))
-        session = CultMesh.create_game_session(
-            CultMesh.create_node(runtime_id="session-peer"),
-            CultMeshGameSessionOptions(
-                verse_catalog=verse_catalog,
-                peer_catalog=peer_catalog,
-                consensus_options=CultNetSimulationConsensusOptions(minimum_witnesses=2, quorum_ratio=1.0),
-            ),
-        )
-        server = session.serve(display_name="Session Peer")
-        try:
-            raw_client = CultMesh.create_client("127.0.0.1", server.port, timeout_seconds=2.0)
-            hello_response = raw_client.request(
-                hello(runtime_id="session-prober"),
-                expected_schema_version="cultnet.hello.v0",
-            )
-            discovery_client = CultMesh.create_verse_discovery_client("127.0.0.1", server.port, timeout_seconds=2.0)
-            verses = discovery_client.fetch_verses(transport_version="cultmesh.v0")
-            peers = discovery_client.fetch_peers(verse_id="session-verse", roles=["simulation-observer"])
-            claim_hash = compute_simulation_claim_hash("hit", "alice", "bob", "frame:100")
-            first = raw_client.request(
-                simulation_observation(
-                    message_id="session-wire-1",
-                    witness_runtime_id="watcher-1",
-                    shard_id="arena",
-                    shard_epoch=4,
-                    frame=100,
-                    subject_id="bob",
-                    claim_kind="hit",
-                    claim_hash=claim_hash,
-                    claim_summary="alice shot bob first",
-                ),
-                expected_schema_version="cultnet.simulation_consensus_candidate.v0",
-            )
-            second = raw_client.request(
-                simulation_observation(
-                    message_id="session-wire-2",
-                    witness_runtime_id="watcher-2",
-                    shard_id="arena",
-                    shard_epoch=4,
-                    frame=100,
-                    subject_id="bob",
-                    claim_kind="hit",
-                    claim_hash=claim_hash,
-                    claim_summary="alice shot bob first",
-                ),
-                expected_schema_version="cultnet.simulation_consensus_candidate.v0",
-            )
-        finally:
-            server.stop()
-
-        self.assertIn("cultnet.simulation_observation.v0", hello_response["supportedMessageVersions"])
-        self.assertEqual(verses[0].verse_id, "session-verse")
-        self.assertEqual(peers[0].peer_id, "session-peer")
-        self.assertIn("simulation-observer", peers[0].roles)
-        self.assertFalse(first["hasQuorum"])
-        self.assertEqual(first["witnessCount"], 1)
-        self.assertTrue(second["hasQuorum"])
-        self.assertEqual(second["witnessCount"], 2)
-
-    def test_cultmesh_game_session_can_disable_served_simulation_observations(self) -> None:
-        verse_catalog = CultMeshVerseCatalog()
-        verse_catalog.upsert(CultMeshVerseDescriptor(
-            verse_id="session-quiet",
-            display_name="Quiet Session",
-            authority_model="local",
-            compatibility=CultMeshVerseCompatibility("cultmesh.v0", "quiet-rules"),
-        ))
-        session = CultMesh.create_game_session(
-            CultMesh.create_node(runtime_id="quiet-session-peer"),
-            CultMeshGameSessionOptions(
-                verse_catalog=verse_catalog,
-                serve_simulation_observations=False,
-            ),
-        )
-        server = session.serve(display_name="Quiet Session Peer")
-        try:
-            raw_client = CultMesh.create_client("127.0.0.1", server.port, timeout_seconds=2.0)
-            hello_response = raw_client.request(
-                hello(runtime_id="quiet-session-prober"),
-                expected_schema_version="cultnet.hello.v0",
-            )
-            discovery_client = CultMesh.create_verse_discovery_client("127.0.0.1", server.port, timeout_seconds=2.0)
-            verses = discovery_client.fetch_verses(transport_version="cultmesh.v0")
-            with self.assertRaisesRegex(CultNetPeerError, "Simulation observations are not enabled") as raised:
-                raw_client.request(
-                    simulation_observation(
-                        message_id="quiet-session-sim",
-                        witness_runtime_id="watcher-1",
-                        shard_id="arena",
-                        shard_epoch=4,
-                        frame=100,
-                        subject_id="bob",
-                        claim_kind="hit",
-                        claim_hash=compute_simulation_claim_hash("hit", "alice", "bob", "frame:100"),
-                    ),
-                    expected_schema_version="cultnet.simulation_consensus_candidate.v0",
-                )
-        finally:
-            server.stop()
-
-        self.assertNotIn("cultnet.simulation_observation.v0", hello_response["supportedMessageVersions"])
-        self.assertEqual(verses[0].verse_id, "session-quiet")
-        self.assertEqual(raised.exception.response["code"], "simulation_observations_disabled")
-
-    def test_cultmesh_game_session_prediction_requires_scope_and_reconciles_shard_log(self) -> None:
-        note_doc = define_database_entry_type(
-            "mesh.input",
-            [("body", 0)],
-            schema_id="mesh.input.v1",
-        )
-        with tempfile.TemporaryDirectory() as tmp:
-            node = CultMesh.create_node(Path(tmp) / "prediction.cc", runtime_id="client-a")
-            node.register_document(note_doc)
-            session = CultMesh.create_game_session(
-                node,
-                CultMeshGameSessionOptions(
-                    client_authority_scopes=(
-                        CultNetClientAuthorityScope(
-                            "client-a",
-                            schema_ids=("mesh.input.v1",),
-                            key_prefix="input:client-a",
-                        ),
-                    )
-                ),
-            )
-
-            with self.assertRaisesRegex(ValueError, "does not have client prediction authority"):
-                session.predict(note_doc, "input:other", {"body": "nope"})
-
-            prediction = session.predict(note_doc, "input:client-a:move", {"body": "predicted"})
-            put = document_put_raw(
-                message_id="authoritative",
-                key=prediction.key,
-                schema_id=prediction.schema_id,
-                stored_at="2026-06-13T00:00:00Z",
-                payload=note_doc.encode_payload({"body": "authoritative"}),
-                shard_id="inputs",
-                shard_epoch=1,
-            )
-            authoritative_response = {
-                "schemaVersion": "cultnet.shard_log_response.v0",
-                "messageId": "inputs-log",
-                "shardId": "inputs",
-                "shardEpoch": 1,
-                "entries": [
-                    {
-                        "sequence": 1,
-                        "committedAt": "2026-06-13T00:00:00Z",
-                        "changeKind": "updated",
-                        "put": put.to_wire(),
-                    }
-                ],
-                "resyncRequired": False,
-            }
-            changes = session.apply_shard_log_response(CultNetShardLogResponse.from_wire(authoritative_response))
-
-            self.assertEqual(changes[0].change_kind, "reconciled")
-            self.assertEqual(node.get_required(note_doc, prediction.key)["body"], "authoritative")
-            self.assertEqual(session.pending_predictions(), ())
-            self.assertEqual(session.resimulation_inputs(), ())
-
-    def test_cultmesh_game_session_rolls_back_pending_predictions(self) -> None:
-        note_doc = define_database_entry_type(
-            "mesh.rollback_input",
-            [("body", 0)],
-            schema_id="mesh.rollback_input.v1",
-        )
-        node = CultMesh.create_node(runtime_id="client-rollback")
-        node.register_document(note_doc)
-        node.put(note_doc, "input:client-rollback:existing", {"body": "previous"})
-        session = CultMesh.create_game_session(
-            node,
-            CultMeshGameSessionOptions(
-                client_authority_scopes=(
-                    CultNetClientAuthorityScope(
-                        "client-rollback",
-                        schema_ids=("mesh.rollback_input.v1",),
-                        key_prefix="input:client-rollback",
-                    ),
-                )
-            ),
-        )
-
-        existing = session.predict(note_doc, "input:client-rollback:existing", {"body": "predicted-existing"})
-        created = session.predict(note_doc, "input:client-rollback:new", {"body": "predicted-new"})
-        self.assertEqual(
-            [prediction.key for prediction in session.pending_predictions()],
-            ["input:client-rollback:existing", "input:client-rollback:new"],
-        )
-        self.assertEqual([prediction.key for prediction in session.resimulation_inputs()], [
-            "input:client-rollback:existing",
-            "input:client-rollback:new",
-        ])
-
-        restored = session.rollback_prediction(existing)
-        self.assertIsNotNone(restored)
-        assert restored is not None
-        self.assertEqual(restored.change_kind, "rolled_back")
-        self.assertEqual(restored.value, {"body": "previous"})
-        self.assertEqual(node.get_required(note_doc, "input:client-rollback:existing")["body"], "previous")
-
-        rolled_back = session.rollback_predictions()
-        self.assertEqual([(change.change_kind, change.record_key, change.value) for change in rolled_back], [
-            ("rolled_back", created.key, None),
-        ])
-        self.assertIsNone(node.get(note_doc, created.key))
-        self.assertEqual(session.pending_predictions(), ())
-
-    def test_cultmesh_game_session_authoritative_delete_rolls_back_prediction(self) -> None:
-        note_doc = define_database_entry_type(
-            "mesh.deleted_input",
-            [("body", 0)],
-            schema_id="mesh.deleted_input.v1",
-        )
-        node = CultMesh.create_node(runtime_id="client-delete")
-        node.register_document(note_doc)
-        session = CultMesh.create_game_session(
-            node,
-            CultMeshGameSessionOptions(
-                client_authority_scopes=(
-                    CultNetClientAuthorityScope(
-                        "client-delete",
-                        schema_ids=("mesh.deleted_input.v1",),
-                        key_prefix="input:client-delete",
-                    ),
-                )
-            ),
-        )
-
-        prediction = session.predict(note_doc, "input:client-delete:move", {"body": "predicted"})
-        delete = document_delete(
-            message_id="authoritative-delete",
-            schema_id=prediction.schema_id,
-            record_key=prediction.key,
-            shard_id="inputs",
-            shard_epoch=1,
-        )
-        changes = session.apply_shard_log_response({
-            "schemaVersion": "cultnet.shard_log_response.v0",
-            "messageId": "inputs-delete-log",
-            "shardId": "inputs",
-            "shardEpoch": 1,
-            "entries": [
-                {
-                    "sequence": 1,
-                    "committedAt": "2026-06-13T00:00:00Z",
-                    "changeKind": "removed",
-                    "delete": delete.to_wire(),
-                }
-            ],
-            "resyncRequired": False,
-        })
-
-        self.assertEqual(changes[0].change_kind, "rolled_back")
-        self.assertIsNone(node.get(note_doc, prediction.key))
-        self.assertEqual(session.pending_predictions(), ())
-
-    def test_cultmesh_database_watchers_observe_authoritative_shard_log_reconciliation(self) -> None:
-        note_doc = define_database_entry_type(
-            "mesh.watched_input",
-            [("body", 0)],
-            schema_id="mesh.watched_input.v1",
-        )
-        node = CultMesh.create_node(runtime_id="client-watch")
-        node.database.register_document(note_doc)
-        seen: list[CultMeshDatabaseChange] = []
-        node.database.watch_record(note_doc, "input:client-watch:move", seen.append)
-        session = CultMesh.create_game_session(
-            node,
-            CultMeshGameSessionOptions(
-                client_authority_scopes=(
-                    CultNetClientAuthorityScope(
-                        "client-watch",
-                        schema_ids=("mesh.watched_input.v1",),
-                        key_prefix="input:client-watch",
-                    ),
-                )
-            ),
-        )
-
-        prediction = session.predict(note_doc, "input:client-watch:move", {"body": "predicted"})
-        put = document_put_raw(
-            message_id="authoritative-watch",
-            key=prediction.key,
-            schema_id=prediction.schema_id,
-            stored_at="2026-06-13T00:00:00Z",
-            payload=note_doc.encode_payload({"body": "authoritative"}),
-            shard_id="inputs",
-            shard_epoch=1,
-        )
-        session_changes = session.apply_shard_log_response({
-            "schemaVersion": "cultnet.shard_log_response.v0",
-            "messageId": "inputs-watch-log",
-            "shardId": "inputs",
-            "shardEpoch": 1,
-            "entries": [
-                {
-                    "sequence": 1,
-                    "committedAt": "2026-06-13T00:00:00Z",
-                    "changeKind": "updated",
-                    "put": put.to_wire(),
-                }
-            ],
-            "resyncRequired": False,
-        })
-
-        self.assertEqual([change.change_kind for change in seen], ["added", "updated"])
-        self.assertEqual(seen[1].value, {"body": "authoritative"})
-        self.assertEqual(seen[1].previous_value, {"body": "predicted"})
-        self.assertEqual(session_changes[0].change_kind, "reconciled")
-
-    def test_cultmesh_verse_catalog_response_matches_schema_v0_wire_shape(self) -> None:
-        import msgpack  # type: ignore
-
-        catalog = CultMeshVerseCatalog()
-        catalog.upsert(
-            CultMeshVerseDescriptor(
-                verse_id="aetheria-main",
-                display_name="Aetheria",
-                authority_model="OperatorCluster",
-                compatibility=CultMeshVerseCompatibility(
-                    transport_version="cultmesh.v0",
-                    rules_hash="rules",
-                    compatible_verse_ids=("aetheria-modded",),
-                    required_plugin_ids=("core",),
-                    optional_plugin_ids=("skylands",),
-                ),
-                discovery_endpoints=("cultmesh://aetheria.example.test:3075",),
-                authority_runtime_ids=("runtime-a",),
-                description="main branch",
-            )
-        )
-
-        response = catalog.create_response(verse_catalog_request("verses-1"))
-        decoded = msgpack.unpackb(msgpack.packb(response, use_bin_type=True), raw=False)
-        self.assertEqual(decoded["schemaVersion"], "cultmesh.verse_catalog_response.v0")
-        self.assertEqual(decoded["messageId"], "verses-1")
-        self.assertEqual(decoded["verses"][0]["verseId"], "aetheria-main")
-        self.assertEqual(decoded["verses"][0]["compatibility"]["requiredPluginIds"], ["core"])
-
-    def test_cultmesh_verse_catalog_watches_updates_and_finds_transfer_targets(self) -> None:
-        source = CultMeshVerseDescriptor(
-            verse_id="aetheria-main",
-            display_name="Aetheria",
-            authority_model="federated",
-            compatibility=CultMeshVerseCompatibility(
-                transport_version="cultmesh.v0",
-                rules_hash="rules-main",
-            ),
-        )
-        compatible = CultMeshVerseDescriptor(
-            verse_id="aetheria-modded",
-            display_name="Aetheria Modded",
-            authority_model="federated",
-            compatibility=CultMeshVerseCompatibility(
-                transport_version="cultmesh.v0",
-                rules_hash="rules-modded",
-                compatible_verse_ids=("aetheria-main",),
-            ),
-        )
-        incompatible = CultMeshVerseDescriptor(
-            verse_id="old-world",
-            display_name="Old World",
-            authority_model="solo",
-            compatibility=CultMeshVerseCompatibility(
-                transport_version="cultmesh.v0",
-                rules_hash="rules-old",
-            ),
-        )
-        catalog = CultMeshVerseCatalog()
-        seen: list[str] = []
-        unsubscribe = catalog.watch(lambda verse: seen.append(verse.verse_id))
-
-        catalog.upsert(source)
-        catalog.apply_response({
-            "schemaVersion": "cultmesh.verse_catalog_response.v0",
-            "messageId": "verses-watch",
-            "verses": [compatible.to_wire(), incompatible.to_wire()],
-        })
-        unsubscribe()
-        catalog.upsert(CultMeshVerseDescriptor(
-            verse_id="after-unsubscribe",
-            display_name="After",
-            authority_model="none",
-            compatibility=CultMeshVerseCompatibility("cultmesh.v0", "rules-after"),
-        ))
-
-        self.assertEqual(seen, ["aetheria-main", "aetheria-modded", "old-world"])
-        self.assertEqual([verse.verse_id for verse in catalog.verses], ["aetheria-main", "aetheria-modded", "after-unsubscribe", "old-world"])
-        self.assertEqual(catalog.get("aetheria-modded"), compatible)
-        self.assertEqual([verse.verse_id for verse in catalog.find_transfer_targets(source)], ["aetheria-modded"])
-
-    def test_cultmesh_peer_exchange_response_matches_schema_v0_wire_shape(self) -> None:
-        import msgpack  # type: ignore
-
-        catalog = CultMeshPeerCatalog()
-        catalog.upsert(
-            CultMeshPeerCard(
-                peer_id="peer-a",
-                verse_id="aetheria-main",
-                endpoints=("cultnet://peer-a.example.test:3075",),
-                roles=("discovery", "read-replica"),
-                shard_ids=("players",),
-                region="eu-west",
-                authority_lease_id="lease-1",
-                expires_at="2026-05-20T12:00:00.0000000Z",
-                signature="sig",
-            )
-        )
-
-        response = catalog.create_response(
-            peer_exchange_request("pex-1", verse_id="aetheria-main", roles=["read-replica"])
-        )
-        decoded = msgpack.unpackb(msgpack.packb(response, use_bin_type=True), raw=False)
-        self.assertEqual(decoded["schemaVersion"], "cultmesh.peer_exchange_response.v0")
-        self.assertEqual(decoded["messageId"], "pex-1")
-        self.assertEqual(decoded["peers"][0]["peerId"], "peer-a")
-        self.assertIn("read-replica", decoded["peers"][0]["roles"])
-        self.assertEqual(decoded["peers"][0]["authorityLeaseId"], "lease-1")
-
-    def test_cultmesh_peer_catalog_watches_updates_and_gets_peers(self) -> None:
-        first = CultMeshPeerCard(
-            peer_id="peer-a",
-            verse_id="aetheria-main",
-            endpoints=("cultnet://peer-a.example.test:3075",),
-            roles=("discovery", "read-replica"),
-        )
-        second = CultMeshPeerCard(
-            peer_id="peer-b",
-            verse_id="aetheria-main",
-            endpoints=("cultnet://peer-b.example.test:3075",),
-            roles=("shard-primary",),
-        )
-        catalog = CultMeshPeerCatalog()
-        seen: list[str] = []
-        unsubscribe = catalog.watch(lambda peer: seen.append(peer.peer_id))
-
-        catalog.upsert(first)
-        catalog.apply_response({
-            "schemaVersion": "cultmesh.peer_exchange_response.v0",
-            "messageId": "peers-watch",
-            "peers": [second.to_wire()],
-        })
-        unsubscribe()
-        catalog.upsert(CultMeshPeerCard(
-            peer_id="peer-c",
-            verse_id="aetheria-main",
-            endpoints=("cultnet://peer-c.example.test:3075",),
-            roles=("read-replica",),
-        ))
-
-        self.assertEqual(seen, ["peer-a", "peer-b"])
-        self.assertTrue(first.has_role("read-replica"))
-        self.assertEqual([peer.peer_id for peer in catalog.peers], ["peer-a", "peer-b", "peer-c"])
-        self.assertEqual(catalog.get("peer-b"), second)
-        self.assertEqual([peer.peer_id for peer in catalog.find("aetheria-main", role="read-replica")], ["peer-a", "peer-c"])
-
-    def test_cultmesh_discovery_client_fetches_typed_catalogs_over_cultnet_frames(self) -> None:
-        import msgpack  # type: ignore
-        from cultnet_py import read_frame, write_frame
-
-        verses = CultMeshVerseCatalog()
-        verses.upsert(
-            CultMeshVerseDescriptor(
-                verse_id="aetheria-main",
-                display_name="Aetheria",
-                authority_model="federated",
-                compatibility=CultMeshVerseCompatibility(
-                    transport_version="cultmesh.v0",
-                    rules_hash="rules-1",
-                    required_plugin_ids=("core",),
-                ),
-                discovery_endpoints=("cultmesh://aetheria.example.test:3075",),
-                authority_runtime_ids=("runtime-a",),
-            )
-        )
-        peers = CultMeshPeerCatalog()
-        peers.upsert(
-            CultMeshPeerCard(
-                peer_id="peer-a",
-                verse_id="aetheria-main",
-                endpoints=("cultnet://peer-a.example.test:3075",),
-                roles=("read-replica",),
-                shard_ids=("players",),
-            )
-        )
-
-        ready = threading.Event()
-        server_error: list[BaseException] = []
-
-        def serve_requests() -> None:
-            try:
-                with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as server:
-                    server.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
-                    server.bind(("127.0.0.1", 0))
-                    port_holder.append(server.getsockname()[1])
-                    server.listen(8)
-                    ready.set()
-                    for _ in range(8):
-                        connection, _ = server.accept()
-                        with connection:
-                            stream = connection.makefile("rwb")
-                            request = msgpack.unpackb(read_frame(stream), raw=False)
-                            if request["schemaVersion"] == "cultmesh.verse_catalog_request.v0":
-                                response = verses.create_response(request)
-                            elif request["schemaVersion"] == "cultmesh.peer_exchange_request.v0":
-                                response = peers.create_response(request)
-                            else:
-                                raise AssertionError(f"unexpected request {request['schemaVersion']}")
-                            write_frame(stream, msgpack.packb(response, use_bin_type=True))
-                            stream.flush()
-            except BaseException as error:
-                server_error.append(error)
-                ready.set()
-
-        port_holder: list[int] = []
-        thread = threading.Thread(target=serve_requests, daemon=True)
-        thread.start()
-        self.assertTrue(ready.wait(2.0))
-        self.assertFalse(server_error)
-
-        client = CultMeshDiscoveryClient("127.0.0.1", port_holder[0], timeout_seconds=2.0)
-        fetched_verses = client.fetch_verses(transport_version="cultmesh.v0")
-        fetched_peers = client.fetch_peers(verse_id="aetheria-main", roles=["read-replica"])
-        local_verses = CultMeshVerseCatalog()
-        local_peers = CultMeshPeerCatalog()
-        synced_verses = client.sync_verse_catalog(local_verses, transport_version="cultmesh.v0")
-        synced_peers = client.sync_peer_catalog(local_peers, verse_id="aetheria-main", roles=["read-replica"])
-        discovered_verses = CultMeshVerseCatalog()
-        discovered_peers = CultMeshPeerCatalog()
-        endpoint = f"cultnet://127.0.0.1:{port_holder[0]}"
-        verse_discovery = CultMeshVerseDiscoveryClient.from_endpoint(endpoint, timeout_seconds=2.0)
-        peer_discovery = CultMeshPeerExchangeClient.from_endpoint(endpoint, timeout_seconds=2.0)
-        discovered_verse_count = verse_discovery.discover(
-            discovered_verses,
-            endpoints=[endpoint, endpoint, ""],
-            transport_version="cultmesh.v0",
-        )
-        discovered_peer_count = peer_discovery.discover(
-            discovered_peers,
-            verse_id="aetheria-main",
-            endpoints=[endpoint, endpoint, ""],
-            roles=["read-replica"],
-        )
-        fanout_verses = CultMeshVerseCatalog()
-        fanout_verses.upsert(
-            CultMeshVerseDescriptor(
-                verse_id="aetheria-main",
-                display_name="Known Aetheria",
-                authority_model="federated",
-                compatibility=CultMeshVerseCompatibility("cultmesh.v0", "rules-1"),
-                discovery_endpoints=(endpoint, endpoint, ""),
-            )
-        )
-        fanout_peers = CultMeshPeerCatalog()
-        fanout_peers.upsert(
-            CultMeshPeerCard(
-                peer_id="known-peer",
-                verse_id="aetheria-main",
-                endpoints=(endpoint, endpoint, ""),
-                roles=("read-replica",),
-            )
-        )
-        fanout_verse_count = verse_discovery.fanout(fanout_verses, transport_version="cultmesh.v0")
-        fanout_peer_count = peer_discovery.fanout(
-            fanout_peers,
-            verse_id="aetheria-main",
-            roles=["read-replica"],
-        )
-
-        thread.join(2.0)
-        self.assertFalse(server_error)
-        self.assertEqual(fetched_verses[0].verse_id, "aetheria-main")
-        self.assertEqual(fetched_verses[0].compatibility.required_plugin_ids, ("core",))
-        self.assertEqual(fetched_peers[0].peer_id, "peer-a")
-        self.assertEqual(fetched_peers[0].shard_ids, ("players",))
-        self.assertEqual(synced_verses[0].verse_id, "aetheria-main")
-        self.assertEqual(local_peers.find("aetheria-main", role="read-replica")[0].peer_id, "peer-a")
-        self.assertEqual(synced_peers[0].roles, ("read-replica",))
-        self.assertEqual(discovered_verse_count, 1)
-        self.assertEqual(discovered_peer_count, 1)
-        self.assertEqual(discovered_verses.get("aetheria-main").display_name, "Aetheria")
-        self.assertEqual(discovered_peers.find("aetheria-main", role="read-replica")[0].peer_id, "peer-a")
-        self.assertEqual(fanout_verse_count, 1)
-        self.assertEqual(fanout_peer_count, 1)
-        self.assertEqual(fanout_verses.get("aetheria-main").display_name, "Aetheria")
-        self.assertIn(
-            "peer-a",
-            {peer.peer_id for peer in fanout_peers.find("aetheria-main", role="read-replica")},
-        )
-
-    def test_cultmesh_discovery_client_fans_out_simulation_observations_to_peers(self) -> None:
-        first_hub = CultNetSimulationObservationHub(
-            CultNetSimulationConsensusOptions(minimum_witnesses=1, quorum_ratio=1.0)
-        )
-        second_hub = CultNetSimulationObservationHub(
-            CultNetSimulationConsensusOptions(minimum_witnesses=1, quorum_ratio=1.0)
-        )
-        first_server = CultMesh.serve_node(
-            CultMesh.create_node(runtime_id="sim-peer-a"),
-            observation_hub=first_hub,
-        )
-        second_server = CultMesh.serve_node(
-            CultMesh.create_node(runtime_id="sim-peer-b"),
-            observation_hub=second_hub,
-        )
-        try:
-            peers = CultMeshPeerCatalog()
-            peers.upsert(CultMeshPeerCard(
-                peer_id="sim-peer-a",
-                verse_id="arena",
-                endpoints=(f"cultnet://127.0.0.1:{first_server.port}",),
-                roles=("simulation-witness",),
-            ))
-            peers.upsert(CultMeshPeerCard(
-                peer_id="sim-peer-b",
-                verse_id="arena",
-                endpoints=(f"cultnet://127.0.0.1:{second_server.port}",),
-                roles=("simulation-witness",),
-            ))
-            claim_hash = compute_simulation_claim_hash("hit", "alice", "bob", "frame:200")
-            message = simulation_observation(
-                message_id="fanout-observation",
-                witness_runtime_id="python-fanout",
-                shard_id="arena",
-                shard_epoch=1,
-                frame=200,
-                subject_id="bob",
-                claim_kind="hit",
-                claim_hash=claim_hash,
-                claim_summary="alice hit bob",
-            ).to_wire()
-
-            client = CultMeshDiscoveryClient("127.0.0.1", first_server.port, timeout_seconds=2.0)
-            candidates = client.fanout_simulation_observation(
-                peers,
-                message,
-                verse_id="arena",
-                roles=["simulation-witness"],
-            )
-        finally:
-            first_server.stop()
-            second_server.stop()
-
-        self.assertEqual([candidate["schemaVersion"] for candidate in candidates], [
-            "cultnet.simulation_consensus_candidate.v0",
-            "cultnet.simulation_consensus_candidate.v0",
-        ])
-        self.assertEqual({candidate["claimHash"] for candidate in candidates}, {claim_hash})
-        self.assertEqual({candidate["messageId"] for candidate in candidates}, {"fanout-observation"})
-        self.assertEqual({candidate["hasQuorum"] for candidate in candidates}, {True})
-
-    def test_cultmesh_simulation_observation_fanout_flushes_queued_messages(self) -> None:
-        hub = CultNetSimulationObservationHub(
-            CultNetSimulationConsensusOptions(minimum_witnesses=1, quorum_ratio=1.0)
-        )
-        server = CultMesh.serve_node(CultMesh.create_node(runtime_id="sim-flush-peer"), observation_hub=hub)
-        try:
-            peers = CultMeshPeerCatalog()
-            peers.upsert(CultMeshPeerCard(
-                peer_id="sim-flush-peer",
-                verse_id="arena",
-                endpoints=(f"cultnet://127.0.0.1:{server.port}",),
-                roles=("simulation-witness",),
-            ))
-            claim_hash = compute_simulation_claim_hash("hit", "alice", "bob", "frame:210")
-            seen_candidates: list[dict[str, object]] = []
-            fanout = CultMeshSimulationObservationFanout(
-                CultMeshDiscoveryClient("127.0.0.1", server.port, timeout_seconds=2.0),
-                peers,
-                verse_id="arena",
-                roles=["simulation-witness"],
-                on_candidate=seen_candidates.append,
-            )
-            fanout.enqueue(simulation_observation(
-                message_id="queued-observation",
-                witness_runtime_id="python-fanout",
-                shard_id="arena",
-                shard_epoch=1,
-                frame=210,
-                subject_id="bob",
-                claim_kind="hit",
-                claim_hash=claim_hash,
-                claim_summary="alice hit bob",
-            ).to_wire())
-
-            candidates = fanout.flush()
-        finally:
-            server.stop()
-
-        self.assertEqual(fanout.pending_count(), 0)
-        self.assertEqual([candidate["claimHash"] for candidate in candidates], [claim_hash])
-        self.assertEqual(seen_candidates[0]["messageId"], "queued-observation")
-
-    def test_cultmesh_simulation_observation_fanout_keeps_failed_messages_pending(self) -> None:
-        closed_socket = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
-        closed_socket.bind(("127.0.0.1", 0))
-        closed_port = closed_socket.getsockname()[1]
-        closed_socket.close()
-        peers = CultMeshPeerCatalog()
-        peers.upsert(CultMeshPeerCard(
-            peer_id="closed-simulation-peer",
-            verse_id="arena",
-            endpoints=(f"cultnet://127.0.0.1:{closed_port}",),
-            roles=("simulation-witness",),
-        ))
-        errors: list[tuple[str, str]] = []
-        fanout = CultMeshSimulationObservationFanout(
-            CultMeshDiscoveryClient("127.0.0.1", closed_port, timeout_seconds=0.2),
-            peers,
-            verse_id="arena",
-            roles=["simulation-witness"],
-            on_error=lambda endpoint, error: errors.append((endpoint, str(error))),
-        )
-        fanout.enqueue(simulation_observation(
-            message_id="retry-observation",
-            witness_runtime_id="python-fanout",
-            shard_id="arena",
-            shard_epoch=1,
-            frame=212,
-            subject_id="bob",
-            claim_kind="miss",
-            claim_hash=compute_simulation_claim_hash("miss", "alice", "bob", "frame:212"),
-            claim_summary="alice missed bob",
-        ).to_wire())
-
-        candidates = fanout.flush()
-
-        self.assertEqual(candidates, [])
-        self.assertEqual(fanout.pending_count(), 1)
-        self.assertEqual(len(errors), 1)
-        self.assertIn(f"127.0.0.1:{closed_port}", errors[0][0])
-
-    def test_cultmesh_simulation_observation_fanout_runs_background_loop(self) -> None:
-        hub = CultNetSimulationObservationHub(
-            CultNetSimulationConsensusOptions(minimum_witnesses=1, quorum_ratio=1.0)
-        )
-        server = CultMesh.serve_node(CultMesh.create_node(runtime_id="sim-loop-peer"), observation_hub=hub)
-        try:
-            peers = CultMeshPeerCatalog()
-            peers.upsert(CultMeshPeerCard(
-                peer_id="sim-loop-peer",
-                verse_id="arena",
-                endpoints=(f"cultnet://127.0.0.1:{server.port}",),
-                roles=("simulation-witness",),
-            ))
-            claim_hash = compute_simulation_claim_hash("block", "dana", "eve", "frame:211")
-            seen_candidates: list[dict[str, object]] = []
-            fanout = CultMeshSimulationObservationFanout(
-                CultMeshDiscoveryClient("127.0.0.1", server.port, timeout_seconds=2.0),
-                peers,
-                verse_id="arena",
-                roles=["simulation-witness"],
-                interval_seconds=0.05,
-                on_candidate=seen_candidates.append,
-            )
-            fanout.start()
-            fanout.enqueue(simulation_observation(
-                message_id="loop-observation",
-                witness_runtime_id="python-fanout",
-                shard_id="arena",
-                shard_epoch=1,
-                frame=211,
-                subject_id="eve",
-                claim_kind="block",
-                claim_hash=claim_hash,
-                claim_summary="dana blocked eve",
-            ).to_wire())
-            deadline = time.monotonic() + 2.0
-            while not seen_candidates and time.monotonic() < deadline:
-                time.sleep(0.01)
-            fanout.stop()
-        finally:
-            server.stop()
-
-        self.assertEqual(fanout.pending_count(), 0)
-        self.assertTrue(seen_candidates)
-        self.assertEqual(seen_candidates[0]["claimHash"], claim_hash)
-        self.assertEqual(seen_candidates[0]["messageId"], "loop-observation")
-
-    def test_cultmesh_discovery_client_fans_out_snapshots_to_peers(self) -> None:
-        document = define_database_entry_type(
-            "mesh.snapshot_fanout_note",
-            [("body", 0)],
-            schema_id="mesh.snapshot_fanout_note.v1",
-        )
-        first = CultMesh.create_node(runtime_id="snapshot-peer-a")
-        first.database.register_document(document)
-        first.database.put_raw_message(document, "note:a", {"body": "from-a"}, shard_id="notes", shard_epoch=1)
-        second = CultMesh.create_node(runtime_id="snapshot-peer-b")
-        second.database.register_document(document)
-        second.database.put_raw_message(document, "note:b", {"body": "from-b"}, shard_id="notes", shard_epoch=1)
-        target = CultMesh.create_node(runtime_id="snapshot-target")
-        target.database.register_document(document)
-        first_server = CultMesh.serve_node(first)
-        second_server = CultMesh.serve_node(second)
-        try:
-            peers = CultMeshPeerCatalog()
-            peers.upsert(CultMeshPeerCard(
-                peer_id="snapshot-peer-a",
-                verse_id="mesh",
-                endpoints=(f"cultnet://127.0.0.1:{first_server.port}", f"cultnet://127.0.0.1:{first_server.port}"),
-                roles=("read-replica",),
-            ))
-            peers.upsert(CultMeshPeerCard(
-                peer_id="snapshot-peer-b",
-                verse_id="mesh",
-                endpoints=(f"cultnet://127.0.0.1:{second_server.port}",),
-                roles=("read-replica",),
-            ))
-
-            client = CultMeshDiscoveryClient("127.0.0.1", first_server.port, timeout_seconds=2.0)
-            responses = client.fanout_snapshot_responses(
-                peers,
-                verse_id="mesh",
-                roles=["read-replica"],
-                schema_ids=["mesh.snapshot_fanout_note.v1"],
-            )
-            applied = client.sync_snapshots(
-                target.database,
-                peers,
-                verse_id="mesh",
-                roles=["read-replica"],
-                schema_ids=["mesh.snapshot_fanout_note.v1"],
-            )
-        finally:
-            first_server.stop()
-            second_server.stop()
-
-        self.assertEqual(len(responses), 2)
-        self.assertTrue(all(isinstance(response, CultNetRawSnapshotResponse) for response in responses))
-        self.assertEqual(
-            sorted(record.record_key for response in responses for record in response.documents),
-            ["note:a", "note:b"],
-        )
-        self.assertEqual(sorted(record.record_key for record in applied), ["note:a", "note:b"])
-        self.assertEqual(target.database.get_required(document, "note:a")["body"], "from-a")
-        self.assertEqual(target.database.get_required(document, "note:b")["body"], "from-b")
-
-    def test_cultmesh_snapshot_fanout_syncs_once_and_reports_applied_records(self) -> None:
-        document = define_database_entry_type(
-            "mesh.snapshot_loop_note",
-            [("body", 0)],
-            schema_id="mesh.snapshot_loop_note.v1",
-        )
-        source = CultMesh.create_node(runtime_id="snapshot-loop-source")
-        source.database.register_document(document)
-        source.database.put_raw_message(document, "note:sync-once", {"body": "from-source"})
-        target = CultMesh.create_node(runtime_id="snapshot-loop-target")
-        target.database.register_document(document)
-        server = CultMesh.serve_node(source)
-        try:
-            peers = CultMeshPeerCatalog()
-            peers.upsert(CultMeshPeerCard(
-                peer_id="snapshot-loop-source",
-                verse_id="mesh",
-                endpoints=(f"cultnet://127.0.0.1:{server.port}",),
-                roles=("read-replica",),
-            ))
-            seen: list[str] = []
-            fanout = CultMeshSnapshotFanout(
-                CultMeshDiscoveryClient("127.0.0.1", server.port, timeout_seconds=2.0),
-                target.database,
-                peers,
-                verse_id="mesh",
-                roles=["read-replica"],
-                schema_ids=["mesh.snapshot_loop_note.v1"],
-                on_applied=lambda record: seen.append(record.record_key),
-            )
-
-            applied = fanout.sync_once()
-        finally:
-            server.stop()
-
-        self.assertEqual([record.record_key for record in applied], ["note:sync-once"])
-        self.assertEqual(seen, ["note:sync-once"])
-        self.assertEqual(target.database.get_required(document, "note:sync-once")["body"], "from-source")
-
-    def test_cultmesh_snapshot_fanout_runs_background_loop(self) -> None:
-        document = define_database_entry_type(
-            "mesh.snapshot_background_note",
-            [("body", 0)],
-            schema_id="mesh.snapshot_background_note.v1",
-        )
-        source = CultMesh.create_node(runtime_id="snapshot-background-source")
-        source.database.register_document(document)
-        source.database.put_raw_message(document, "note:background", {"body": "from-background"})
-        target = CultMesh.create_node(runtime_id="snapshot-background-target")
-        target.database.register_document(document)
-        server = CultMesh.serve_node(source)
-        try:
-            peers = CultMeshPeerCatalog()
-            peers.upsert(CultMeshPeerCard(
-                peer_id="snapshot-background-source",
-                verse_id="mesh",
-                endpoints=(f"cultnet://127.0.0.1:{server.port}",),
-                roles=("read-replica",),
-            ))
-            seen: list[str] = []
-            fanout = CultMeshSnapshotFanout(
-                CultMeshDiscoveryClient("127.0.0.1", server.port, timeout_seconds=2.0),
-                target.database,
-                peers,
-                verse_id="mesh",
-                roles=["read-replica"],
-                schema_ids=["mesh.snapshot_background_note.v1"],
-                interval_seconds=0.05,
-                on_applied=lambda record: seen.append(record.record_key),
-            )
-            fanout.start()
-            deadline = time.monotonic() + 2.0
-            while not seen and time.monotonic() < deadline:
-                time.sleep(0.01)
-            fanout.stop()
-        finally:
-            server.stop()
-
-        self.assertTrue(seen)
-        self.assertEqual(target.database.get_required(document, "note:background")["body"], "from-background")
-
-    def test_cultmesh_peer_health_monitor_probes_reachable_and_failed_endpoints(self) -> None:
-        document = define_database_entry_type(
-            "mesh.health_note",
-            [("body", 0)],
-            schema_id="mesh.health_note.v1",
-        )
-        node = CultMesh.create_node(runtime_id="health-peer")
-        node.database.register_document(document)
-        server = CultMesh.serve_node(node)
-        closed_socket = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
-        closed_socket.bind(("127.0.0.1", 0))
-        closed_port = closed_socket.getsockname()[1]
-        closed_socket.close()
-        try:
-            peers = CultMeshPeerCatalog()
-            peers.upsert(CultMeshPeerCard(
-                peer_id="health-peer",
-                verse_id="mesh",
-                endpoints=(f"cultnet://127.0.0.1:{server.port}",),
-                roles=("read-replica",),
-            ))
-            peers.upsert(CultMeshPeerCard(
-                peer_id="closed-peer",
-                verse_id="mesh",
-                endpoints=(f"cultnet://127.0.0.1:{closed_port}",),
-                roles=("read-replica",),
-            ))
-            seen: list[tuple[str, bool]] = []
-            monitor = CultMeshPeerHealthMonitor(
-                runtime_id="health-prober",
-                timeout_seconds=0.2,
-                on_update=lambda health: seen.append((health.peer_id, health.is_reachable)),
-            )
-
-            results = monitor.probe_catalog(peers, verse_id="mesh", roles=["read-replica"])
-        finally:
-            server.stop()
-
-        by_peer = {result.peer_id: result for result in results}
-        self.assertTrue(by_peer["health-peer"].is_reachable)
-        self.assertEqual(by_peer["health-peer"].runtime_id, "health-peer")
-        self.assertEqual(by_peer["health-peer"].runtime_kind, "python")
-        self.assertEqual(by_peer["health-peer"].display_name, "health-peer")
-        self.assertEqual(by_peer["health-peer"].supported_document_types, ("mesh.health_note",))
-        self.assertIn("cultnet.hello.v0", by_peer["health-peer"].supported_message_versions)
-        self.assertIn("cultnet.error.v0", by_peer["health-peer"].supported_message_versions)
-        self.assertEqual(by_peer["health-peer"].supported_mutation_contracts[0]["documentType"], "mesh.health_note")
-        self.assertIn("shardLog", by_peer["health-peer"].supported_mutation_contracts[0]["operations"])
-        self.assertFalse(by_peer["closed-peer"].is_reachable)
-        self.assertIsNone(by_peer["closed-peer"].runtime_kind)
-        self.assertEqual(by_peer["closed-peer"].supported_document_types, ())
-        self.assertEqual(by_peer["closed-peer"].supported_message_versions, ())
-        self.assertEqual(by_peer["closed-peer"].supported_mutation_contracts, ())
-        self.assertTrue(by_peer["closed-peer"].error)
-        self.assertEqual({peer_id for peer_id, _ in seen}, {"health-peer", "closed-peer"})
-        self.assertEqual(len(monitor.latest()), 2)
-
-    def test_cultmesh_peer_health_monitor_runs_background_probe_loop(self) -> None:
-        server = CultMesh.serve_node(CultMesh.create_node(runtime_id="health-loop-peer"))
-        try:
-            peers = CultMeshPeerCatalog()
-            peers.upsert(CultMeshPeerCard(
-                peer_id="health-loop-peer",
-                verse_id="mesh",
-                endpoints=(f"cultnet://127.0.0.1:{server.port}",),
-                roles=("read-replica",),
-            ))
-            seen: list[str] = []
-            monitor = CultMeshPeerHealthMonitor(
-                runtime_id="health-loop-prober",
-                timeout_seconds=0.2,
-                interval_seconds=0.05,
-                on_update=lambda health: seen.append(health.peer_id),
-            )
-            monitor.start(peers, verse_id="mesh", roles=["read-replica"])
-            deadline = time.monotonic() + 2.0
-            while time.monotonic() < deadline:
-                latest = monitor.latest()
-                if latest and latest[0].is_reachable:
-                    break
-                time.sleep(0.01)
-            monitor.stop()
-        finally:
-            server.stop()
-
-        self.assertTrue(seen)
-        latest = monitor.latest()
-        self.assertEqual(latest[0].peer_id, "health-loop-peer")
-        self.assertTrue(latest[0].is_reachable)
-
-    def test_cultmesh_daemon_entrypoint_serves_framed_cultnet_hello(self) -> None:
-        with tempfile.TemporaryDirectory() as temp:
-            ready_path = Path(temp) / "ready.json"
-            package_src = Path(__file__).resolve().parents[1] / "src"
-            env = dict(os.environ)
-            existing_pythonpath = env.get("PYTHONPATH")
-            env["PYTHONPATH"] = (
-                str(package_src)
-                if not existing_pythonpath
-                else f"{package_src}{os.pathsep}{existing_pythonpath}"
-            )
-            process = subprocess.Popen(
-                [
-                    sys.executable,
-                    "-m",
-                    "cultmesh_py.daemon",
-                    "--runtime-id",
-                    "daemon-test-peer",
-                    "--display-name",
-                    "Daemon Test Peer",
-                    "--port",
-                    "0",
-                    "--ready-file",
-                    str(ready_path),
-                    "--seed-interop-note",
-                    "--seed-shard-id",
-                    "daemon-interop",
-                    "--verse-id",
-                    "daemon-verse",
-                    "--verse-display-name",
-                    "Daemon Verse",
-                    "--role",
-                    "shard-primary",
-                ],
-                stdout=subprocess.PIPE,
-                stderr=subprocess.PIPE,
-                text=True,
-                env=env,
-            )
-            try:
-                deadline = time.monotonic() + 5.0
-                while not ready_path.exists() and time.monotonic() < deadline:
-                    if process.poll() is not None:
-                        break
-                    time.sleep(0.05)
-                if not ready_path.exists():
-                    _, stderr = process.communicate(timeout=2.0)
-                    self.fail(f"cultmesh daemon did not publish readiness: {stderr}")
-                ready = json.loads(ready_path.read_text(encoding="utf-8"))
-                self.assertEqual(ready["schemaVersion"], READY_SCHEMA_VERSION)
-                self.assertEqual(ready["runtimeId"], "daemon-test-peer")
-                self.assertEqual(ready["runtimeKind"], "python")
-                self.assertEqual(ready["displayName"], "Daemon Test Peer")
-                self.assertEqual(ready["endpoint"], f"cultnet://127.0.0.1:{ready['port']}")
-                self.assertEqual(ready["shardIds"], ["daemon-interop"])
-                self.assertEqual(ready["supportedDocumentTypes"], ["cultcache.interop-note"])
-                self.assertIn("cultnet.hello.v0", ready["supportedMessageVersions"])
-                self.assertIn("cultnet.document_put_raw.v0", ready["supportedMessageVersions"])
-                self.assertNotIn("cultnet.simulation_observation.v0", ready["supportedMessageVersions"])
-                self.assertEqual(ready["supportedMutationContracts"][0]["documentType"], "cultcache.interop-note")
-                self.assertIn("shardLog", ready["supportedMutationContracts"][0]["operations"])
-                self.assertEqual(ready["snapshotLimits"], {"maxSnapshotBytes": None, "maxSnapshotDocuments": None})
-                self.assertEqual(ready["verses"][0]["verseId"], "daemon-verse")
-                self.assertEqual(ready["verses"][0]["displayName"], "Daemon Verse")
-                self.assertEqual(ready["verses"][0]["discoveryEndpoints"], [ready["endpoint"]])
-                self.assertEqual(ready["verses"][0]["authorityRuntimeIds"], ["daemon-test-peer"])
-                self.assertEqual(ready["peers"][0]["peerId"], "daemon-test-peer")
-                self.assertEqual(ready["peers"][0]["endpoints"], [ready["endpoint"]])
-                self.assertEqual(ready["peers"][0]["roles"], ["shard-primary"])
-                self.assertEqual(ready["peers"][0]["shardIds"], ["daemon-interop"])
-
-                client = CultMesh.create_client("127.0.0.1", int(ready["port"]), timeout_seconds=2.0)
-                hello_response = client.request(
-                    hello(runtime_id="daemon-test-prober"),
-                    expected_schema_version="cultnet.hello.v0",
-                )
-
-                self.assertEqual(hello_response["runtimeId"], "daemon-test-peer")
-                self.assertEqual(hello_response["displayName"], "Daemon Test Peer")
-                self.assertIn("cultnet.hello.v0", hello_response["supportedMessageVersions"])
-                self.assertIn("cultnet.schema_catalog_request.v0", hello_response["supportedMessageVersions"])
-                self.assertNotIn("cultnet.simulation_observation.v0", hello_response["supportedMessageVersions"])
-                self.assertEqual(hello_response["supportedDocumentTypes"], ["cultcache.interop-note"])
-                self.assertEqual(hello_response["transportProfiles"][0]["transports"][0]["protocol"], "tcp_framed")
-                self.assertEqual(hello_response["transportProfiles"][0]["transports"][0]["port"], int(ready["port"]))
-                self.assertEqual(ready["supportedMessageVersions"], hello_response["supportedMessageVersions"])
-                self.assertEqual(ready["supportedMutationContracts"], hello_response["supportedMutationContracts"])
-                self.assertEqual(ready["transportProfiles"], hello_response["transportProfiles"])
-
-                schema_response = client.fetch_schema_catalog(schema_ids=["cultcache.interop-note"], include_schema_json=True)
-                self.assertEqual(schema_response["schemas"][0]["schemaVersion"], INTEROP_SCHEMA_VERSION)
-                self.assertEqual(schema_response["schemas"][0]["documentType"], "cultcache.interop-note")
-
-                snapshot_response = client.fetch_snapshot_response(schema_ids=["cultcache.interop-note"])
-                self.assertEqual(snapshot_response.documents[0].record_key, "note:daemon-test-peer")
-                note = interop_note_document.decode_payload(snapshot_response.documents[0].payload)
-                self.assertEqual(note["authorRuntimeId"], "daemon-test-peer")
-                self.assertIn("daemon", note["tags"])
-
-                shard_catalog = client.fetch_shard_catalog(schema_ids=["cultcache.interop-note"])
-                self.assertEqual(shard_catalog["shards"][0]["shardId"], "daemon-interop")
-                self.assertEqual(shard_catalog["shards"][0]["schemaIds"], ["cultcache.interop-note"])
-
-                shard_log = client.fetch_shard_log_response(shard_id="daemon-interop", shard_epoch=1)
-                self.assertFalse(shard_log.resync_required)
-                self.assertEqual(shard_log.entries[0].sequence, 1)
-                self.assertEqual(shard_log.entries[0].change_kind, "added")
-                self.assertIsNotNone(shard_log.entries[0].raw_document)
-                assert shard_log.entries[0].raw_document is not None
-                self.assertEqual(shard_log.entries[0].raw_document.record_key, "note:daemon-test-peer")
-
-                discovery_client = CultMesh.create_verse_discovery_client("127.0.0.1", int(ready["port"]), timeout_seconds=2.0)
-                verses = discovery_client.fetch_verses(transport_version="cultmesh.v0")
-                self.assertEqual(verses[0].verse_id, "daemon-verse")
-                self.assertEqual(verses[0].display_name, "Daemon Verse")
-                self.assertEqual(verses[0].discovery_endpoints, (ready["endpoint"],))
-                self.assertEqual(verses[0].authority_runtime_ids, ("daemon-test-peer",))
-                self.assertEqual([verse.to_wire() for verse in verses], ready["verses"])
-
-                peers = discovery_client.fetch_peers(verse_id="daemon-verse", roles=["shard-primary"])
-                self.assertEqual(peers[0].peer_id, "daemon-test-peer")
-                self.assertEqual(peers[0].endpoints, (ready["endpoint"],))
-                self.assertEqual(peers[0].roles, ("shard-primary",))
-                self.assertEqual(peers[0].shard_ids, ("daemon-interop",))
-                self.assertEqual([peer.to_wire() for peer in peers], ready["peers"])
-
-                monitor = CultMeshPeerHealthMonitor(runtime_id="daemon-health-prober", timeout_seconds=2.0)
-                health = monitor.probe_peer(peers[0])[0]
-                self.assertTrue(health.is_reachable)
-                self.assertEqual(health.runtime_id, "daemon-test-peer")
-                self.assertEqual(health.supported_document_types, ("cultcache.interop-note",))
-                self.assertEqual(health.supported_mutation_contracts[0]["documentType"], "cultcache.interop-note")
-            finally:
-                process.terminate()
-                try:
-                    process.communicate(timeout=5.0)
-                except subprocess.TimeoutExpired:
-                    process.kill()
-                    process.communicate(timeout=5.0)
-
-    def test_cultmesh_daemon_restarts_with_persisted_cache_and_shard_log(self) -> None:
-        with tempfile.TemporaryDirectory() as temp:
-            root = Path(temp)
-            cache_path = root / "mesh.cc"
-            shard_log_path = root / "shard-log"
-            env = dict(os.environ)
-            package_src = Path(__file__).resolve().parents[1] / "src"
-            existing_pythonpath = env.get("PYTHONPATH")
-            env["PYTHONPATH"] = (
-                str(package_src)
-                if not existing_pythonpath
-                else f"{package_src}{os.pathsep}{existing_pythonpath}"
-            )
-
-            first_ready = root / "first-ready.json"
-            first = subprocess.Popen(
-                [
-                    sys.executable,
-                    "-m",
-                    "cultmesh_py.daemon",
-                    "--runtime-id",
-                    "durable-daemon-peer",
-                    "--port",
-                    "0",
-                    "--cache-file",
-                    str(cache_path),
-                    "--enable-durable-shard-logs",
-                    "--shard-log-file",
-                    str(shard_log_path),
-                    "--seed-interop-note",
-                    "--seed-shard-id",
-                    "durable-interop",
-                    "--ready-file",
-                    str(first_ready),
-                ],
-                stdout=subprocess.PIPE,
-                stderr=subprocess.PIPE,
-                text=True,
-                env=env,
-            )
-            try:
-                self._wait_for_ready_file(first, first_ready)
-            finally:
-                self._terminate_process(first)
-
-            second_ready = root / "second-ready.json"
-            second = subprocess.Popen(
-                [
-                    sys.executable,
-                    "-m",
-                    "cultmesh_py.daemon",
-                    "--runtime-id",
-                    "durable-daemon-peer",
-                    "--port",
-                    "0",
-                    "--cache-file",
-                    str(cache_path),
-                    "--enable-durable-shard-logs",
-                    "--shard-log-file",
-                    str(shard_log_path),
-                    "--register-interop-note",
-                    "--verse-id",
-                    "durable-verse",
-                    "--role",
-                    "shard-primary",
-                    "--ready-file",
-                    str(second_ready),
-                ],
-                stdout=subprocess.PIPE,
-                stderr=subprocess.PIPE,
-                text=True,
-                env=env,
-            )
-            try:
-                ready = self._wait_for_ready_file(second, second_ready)
-                client = CultMesh.create_client("127.0.0.1", int(ready["port"]), timeout_seconds=2.0)
-
-                snapshot_response = client.fetch_snapshot_response(schema_ids=["cultcache.interop-note"])
-                self.assertEqual(snapshot_response.documents[0].record_key, "note:durable-daemon-peer")
-                note = interop_note_document.decode_payload(snapshot_response.documents[0].payload)
-                self.assertEqual(note["authorRuntimeId"], "durable-daemon-peer")
-
-                shard_log = client.fetch_shard_log_response(shard_id="durable-interop", shard_epoch=1)
-                self.assertFalse(shard_log.resync_required)
-                self.assertEqual(shard_log.entries[0].sequence, 1)
-                self.assertIsNotNone(shard_log.entries[0].raw_document)
-                assert shard_log.entries[0].raw_document is not None
-                self.assertEqual(shard_log.entries[0].raw_document.record_key, "note:durable-daemon-peer")
-
-                discovery_client = CultMesh.create_verse_discovery_client("127.0.0.1", int(ready["port"]), timeout_seconds=2.0)
-                peers = discovery_client.fetch_peers(verse_id="durable-verse", roles=["shard-primary"])
-                self.assertEqual(peers[0].shard_ids, ("durable-interop",))
-            finally:
-                self._terminate_process(second)
-
-    def test_cultmesh_daemon_serves_live_database_subscription_mutations(self) -> None:
-        with tempfile.TemporaryDirectory() as temp:
-            ready_path = Path(temp) / "ready.json"
-            package_src = Path(__file__).resolve().parents[1] / "src"
-            env = dict(os.environ)
-            existing_pythonpath = env.get("PYTHONPATH")
-            env["PYTHONPATH"] = (
-                str(package_src)
-                if not existing_pythonpath
-                else f"{package_src}{os.pathsep}{existing_pythonpath}"
-            )
-            process = subprocess.Popen(
-                [
-                    sys.executable,
-                    "-m",
-                    "cultmesh_py.daemon",
-                    "--runtime-id",
-                    "live-daemon-peer",
-                    "--port",
-                    "0",
-                    "--seed-interop-note",
-                    "--seed-shard-id",
-                    "live-interop",
-                    "--ready-file",
-                    str(ready_path),
-                ],
-                stdout=subprocess.PIPE,
-                stderr=subprocess.PIPE,
-                text=True,
-                env=env,
-            )
-            try:
-                ready = self._wait_for_ready_file(process, ready_path)
-                client = CultMesh.create_client("127.0.0.1", int(ready["port"]), timeout_seconds=2.0)
-                live_note = {
-                    "schemaVersion": INTEROP_SCHEMA_VERSION,
-                    "documentId": "note:daemon-live",
-                    "authorRuntimeId": "daemon-live-client",
-                    "title": "daemon live subscription note",
-                    "body": "live subscription put from Python daemon smoke",
-                    "tags": ["daemon", "subscription", "interop"],
-                }
-
-                with client.subscribe_database(
-                    subscription_id="daemon-live-sub",
-                    schema_ids=["cultcache.interop-note"],
-                ) as subscription:
-                    snapshot = subscription.read_next_snapshot_response()
-                    subscription.send(document_put_raw(
-                        message_id="daemon-live-put",
-                        key="note:daemon-live",
-                        schema_id="cultcache.interop-note",
-                        stored_at="2026-06-14T00:00:00Z",
-                        payload=interop_note_document.encode_payload(live_note),
-                        source_runtime_id="daemon-live-client",
-                        shard_id="live-interop",
-                        shard_epoch=1,
-                    ))
-                    change = subscription.read_next_change()
-
-                self.assertEqual(snapshot.documents[0].record_key, "note:live-daemon-peer")
-                self.assertEqual(change.change_kind, "added")
-                self.assertEqual(change.record_key, "note:daemon-live")
-                self.assertIsNotNone(change.raw_document)
-                assert change.raw_document is not None
-                self.assertEqual(
-                    interop_note_document.decode_payload(change.raw_document.payload),
-                    live_note,
-                )
-
-                shard_log = client.fetch_shard_log_response(shard_id="live-interop", shard_epoch=1)
-                self.assertFalse(shard_log.resync_required)
-                self.assertEqual([entry.sequence for entry in shard_log.entries], [1, 2])
-                self.assertEqual(shard_log.entries[1].change_kind, "added")
-                self.assertIsNotNone(shard_log.entries[1].raw_document)
-                assert shard_log.entries[1].raw_document is not None
-                self.assertEqual(shard_log.entries[1].raw_document.record_key, "note:daemon-live")
-            finally:
-                self._terminate_process(process)
-
-    def test_cultmesh_daemon_serves_compacted_shard_log_resync_boundary(self) -> None:
-        with tempfile.TemporaryDirectory() as temp:
-            root = Path(temp)
-            cache_path = root / "mesh.cc"
-            shard_log_path = root / "shard-log"
-            store = CultNetFileShardMutationLogStore(shard_log_path)
-            node = CultMesh.create_node(
-                cache_path,
-                runtime_id="compacted-daemon-peer",
-                enable_durable_shard_logs=True,
-                shard_log_path=shard_log_path,
-            )
-            node.database.register_document(interop_note_document)
-            node.database.put_raw_message(
-                interop_note_document,
-                "note:compacted-one",
-                {
-                    "schemaVersion": INTEROP_SCHEMA_VERSION,
-                    "documentId": "note:compacted-one",
-                    "authorRuntimeId": "compacted-daemon-peer",
-                    "title": "compacted daemon note one",
-                    "body": "first retained cache value",
-                    "tags": ["daemon", "compaction"],
-                },
-                message_id="compacted-put-1",
-                shard_id="compacted-interop",
-                shard_epoch=7,
-            )
-            node.database.put_raw_message(
-                interop_note_document,
-                "note:compacted-two",
-                {
-                    "schemaVersion": INTEROP_SCHEMA_VERSION,
-                    "documentId": "note:compacted-two",
-                    "authorRuntimeId": "compacted-daemon-peer",
-                    "title": "compacted daemon note two",
-                    "body": "second retained cache value",
-                    "tags": ["daemon", "compaction"],
-                },
-                message_id="compacted-put-2",
-                shard_id="compacted-interop",
-                shard_epoch=7,
-            )
-            store.compact_through("compacted-interop", 1)
-
-            ready_path = root / "ready.json"
-            package_src = Path(__file__).resolve().parents[1] / "src"
-            env = dict(os.environ)
-            existing_pythonpath = env.get("PYTHONPATH")
-            env["PYTHONPATH"] = (
-                str(package_src)
-                if not existing_pythonpath
-                else f"{package_src}{os.pathsep}{existing_pythonpath}"
-            )
-            process = subprocess.Popen(
-                [
-                    sys.executable,
-                    "-m",
-                    "cultmesh_py.daemon",
-                    "--runtime-id",
-                    "compacted-daemon-peer",
-                    "--port",
-                    "0",
-                    "--cache-file",
-                    str(cache_path),
-                    "--enable-durable-shard-logs",
-                    "--shard-log-file",
-                    str(shard_log_path),
-                    "--register-interop-note",
-                    "--ready-file",
-                    str(ready_path),
-                ],
-                stdout=subprocess.PIPE,
-                stderr=subprocess.PIPE,
-                text=True,
-                env=env,
-            )
-            try:
-                ready = self._wait_for_ready_file(process, ready_path)
-                client = CultMesh.create_client("127.0.0.1", int(ready["port"]), timeout_seconds=2.0)
-
-                snapshot_response = client.fetch_snapshot_response(schema_ids=["cultcache.interop-note"])
-                self.assertEqual(
-                    {document.record_key for document in snapshot_response.documents},
-                    {"note:compacted-one", "note:compacted-two"},
-                )
-
-                compacted = client.fetch_shard_log_response(
-                    shard_id="compacted-interop",
-                    shard_epoch=7,
-                    after_sequence=0,
-                )
-                retained = client.fetch_shard_log_response(
-                    shard_id="compacted-interop",
-                    shard_epoch=7,
-                    after_sequence=1,
-                )
-
-                self.assertTrue(compacted.resync_required)
-                self.assertEqual(compacted.reason, "compacted_history")
-                self.assertEqual(compacted.compacted_through, 1)
-                self.assertEqual(compacted.entries, ())
-                self.assertFalse(retained.resync_required)
-                self.assertEqual([entry.sequence for entry in retained.entries], [2])
-                self.assertIsNotNone(retained.entries[0].raw_document)
-                assert retained.entries[0].raw_document is not None
-                self.assertEqual(retained.entries[0].raw_document.record_key, "note:compacted-two")
-            finally:
-                self._terminate_process(process)
-
-    def test_cultmesh_daemon_accepts_schema_write_forwarder_mutations(self) -> None:
-        with tempfile.TemporaryDirectory() as temp:
-            ready_path = Path(temp) / "ready.json"
-            package_src = Path(__file__).resolve().parents[1] / "src"
-            env = dict(os.environ)
-            existing_pythonpath = env.get("PYTHONPATH")
-            env["PYTHONPATH"] = (
-                str(package_src)
-                if not existing_pythonpath
-                else f"{package_src}{os.pathsep}{existing_pythonpath}"
-            )
-            process = subprocess.Popen(
-                [
-                    sys.executable,
-                    "-m",
-                    "cultmesh_py.daemon",
-                    "--runtime-id",
-                    "forwarder-daemon-peer",
-                    "--port",
-                    "0",
-                    "--register-interop-note",
-                    "--ready-file",
-                    str(ready_path),
-                ],
-                stdout=subprocess.PIPE,
-                stderr=subprocess.PIPE,
-                text=True,
-                env=env,
-            )
-            try:
-                ready = self._wait_for_ready_file(process, ready_path)
-                endpoint = f"cultnet://127.0.0.1:{ready['port']}"
-                shard = CultNetShardDescriptor(
-                    shard_id="forwarded-interop",
-                    owner_runtime_id="forwarder-daemon-peer",
-                    epoch=3,
-                    is_primary=False,
-                    schema_ids=("cultcache.interop-note",),
-                    primary_endpoints=(endpoint,),
-                )
-                forwarder: CultNetShardWriteForwarder = CultNetSchemaWriteForwarder(timeout_seconds=2.0)
-                note = {
-                    "schemaVersion": INTEROP_SCHEMA_VERSION,
-                    "documentId": "note:forwarded-daemon",
-                    "authorRuntimeId": "forwarding-client",
-                    "title": "forwarded daemon note",
-                    "body": "forwarded through the schema write-forwarder",
-                    "tags": ["daemon", "forwarded"],
-                }
-
-                forwarder.forward_put(shard, document_put_raw(
-                    message_id="forwarded-daemon-put",
-                    key="note:forwarded-daemon",
-                    schema_id="cultcache.interop-note",
-                    stored_at="2026-06-14T00:00:00Z",
-                    payload=interop_note_document.encode_payload(note),
-                    source_runtime_id="forwarding-client",
-                ).to_wire())
-
-                client = CultMesh.create_client("127.0.0.1", int(ready["port"]), timeout_seconds=2.0)
-                self._eventually(lambda: bool(client.fetch_snapshot_response(
-                    schema_ids=["cultcache.interop-note"],
-                    record_keys=["note:forwarded-daemon"],
-                ).documents))
-                snapshot = client.fetch_snapshot_response(
-                    schema_ids=["cultcache.interop-note"],
-                    record_keys=["note:forwarded-daemon"],
-                )
-                self.assertEqual(
-                    interop_note_document.decode_payload(snapshot.documents[0].payload),
-                    note,
-                )
-
-                forwarder.forward_delete(shard, document_delete(
-                    message_id="forwarded-daemon-delete",
-                    schema_id="cultcache.interop-note",
-                    record_key="note:forwarded-daemon",
-                ).to_wire())
-                self._eventually(lambda: not client.fetch_snapshot_response(
-                    schema_ids=["cultcache.interop-note"],
-                    record_keys=["note:forwarded-daemon"],
-                ).documents)
-
-                shard_log = client.fetch_shard_log_response(shard_id="forwarded-interop", shard_epoch=3)
-                self.assertEqual([entry.change_kind for entry in shard_log.entries], ["added", "removed"])
-                self.assertEqual(shard_log.entries[0].put["shardId"], "forwarded-interop")
-                self.assertEqual(shard_log.entries[0].put["shardEpoch"], 3)
-                self.assertEqual(shard_log.entries[1].delete["shardId"], "forwarded-interop")
-                self.assertEqual(shard_log.entries[1].delete["shardEpoch"], 3)
-            finally:
-                self._terminate_process(process)
-
-    def test_cultmesh_daemon_enforces_snapshot_document_limit_as_peer_error(self) -> None:
-        with tempfile.TemporaryDirectory() as temp:
-            ready_path = Path(temp) / "ready.json"
-            package_src = Path(__file__).resolve().parents[1] / "src"
-            env = dict(os.environ)
-            existing_pythonpath = env.get("PYTHONPATH")
-            env["PYTHONPATH"] = (
-                str(package_src)
-                if not existing_pythonpath
-                else f"{package_src}{os.pathsep}{existing_pythonpath}"
-            )
-            process = subprocess.Popen(
-                [
-                    sys.executable,
-                    "-m",
-                    "cultmesh_py.daemon",
-                    "--runtime-id",
-                    "limited-daemon-peer",
-                    "--port",
-                    "0",
-                    "--seed-interop-note",
-                    "--max-snapshot-documents",
-                    "0",
-                    "--ready-file",
-                    str(ready_path),
-                ],
-                stdout=subprocess.PIPE,
-                stderr=subprocess.PIPE,
-                text=True,
-                env=env,
-            )
-            try:
-                ready = self._wait_for_ready_file(process, ready_path)
-                self.assertEqual(ready["snapshotLimits"], {"maxSnapshotBytes": None, "maxSnapshotDocuments": 0})
-                client = CultMesh.create_client("127.0.0.1", int(ready["port"]), timeout_seconds=2.0)
-
-                with self.assertRaisesRegex(CultNetPeerError, "Snapshot document limit exceeded") as raised:
-                    client.fetch_snapshot_response(schema_ids=["cultcache.interop-note"])
-
-                self.assertEqual(raised.exception.response["schemaVersion"], "cultnet.error.v0")
-                self.assertEqual(raised.exception.response["code"], "snapshot_document_limit_exceeded")
-                self.assertEqual(raised.exception.response["details"]["documentCount"], 1)
-                self.assertEqual(raised.exception.response["details"]["maxSnapshotDocuments"], 0)
-            finally:
-                self._terminate_process(process)
-
-    def test_cultmesh_daemon_serves_opt_in_simulation_observations(self) -> None:
-        with tempfile.TemporaryDirectory() as temp:
-            ready_path = Path(temp) / "ready.json"
-            package_src = Path(__file__).resolve().parents[1] / "src"
-            env = dict(os.environ)
-            existing_pythonpath = env.get("PYTHONPATH")
-            env["PYTHONPATH"] = (
-                str(package_src)
-                if not existing_pythonpath
-                else f"{package_src}{os.pathsep}{existing_pythonpath}"
-            )
-            process = subprocess.Popen(
-                [
-                    sys.executable,
-                    "-m",
-                    "cultmesh_py.daemon",
-                    "--runtime-id",
-                    "simulation-daemon-peer",
-                    "--port",
-                    "0",
-                    "--enable-simulation-observations",
-                    "--simulation-minimum-witnesses",
-                    "2",
-                    "--simulation-quorum-ratio",
-                    "1.0",
-                    "--verse-id",
-                    "simulation-verse",
-                    "--ready-file",
-                    str(ready_path),
-                ],
-                stdout=subprocess.PIPE,
-                stderr=subprocess.PIPE,
-                text=True,
-                env=env,
-            )
-            try:
-                ready = self._wait_for_ready_file(process, ready_path)
-                self.assertIn("cultnet.simulation_observation.v0", ready["supportedMessageVersions"])
-                self.assertIn("cultnet.simulation_consensus_candidate.v0", ready["supportedMessageVersions"])
-                client = CultMesh.create_client("127.0.0.1", int(ready["port"]), timeout_seconds=2.0)
-                hello_response = client.request(
-                    hello(runtime_id="simulation-daemon-prober"),
-                    expected_schema_version="cultnet.hello.v0",
-                )
-                self.assertEqual(ready["supportedMessageVersions"], hello_response["supportedMessageVersions"])
-                discovery_client = CultMesh.create_verse_discovery_client("127.0.0.1", int(ready["port"]), timeout_seconds=2.0)
-                peers = discovery_client.fetch_peers(verse_id="simulation-verse", roles=["simulation-observer"])
-                self.assertEqual(peers[0].peer_id, "simulation-daemon-peer")
-                self.assertIn("simulation-observer", peers[0].roles)
-                self.assertIn("read-replica", peers[0].roles)
-
-                claim_hash = compute_simulation_claim_hash("hit", "alice", "bob", "frame:100")
-                first = client.request(
-                    simulation_observation(
-                        message_id="daemon-sim-1",
-                        witness_runtime_id="watcher-1",
-                        shard_id="arena",
-                        shard_epoch=4,
-                        frame=100,
-                        subject_id="bob",
-                        claim_kind="hit",
-                        claim_hash=claim_hash,
-                        claim_summary="alice shot bob first",
-                    ),
-                    expected_schema_version="cultnet.simulation_consensus_candidate.v0",
-                )
-                second = client.request(
-                    simulation_observation(
-                        message_id="daemon-sim-2",
-                        witness_runtime_id="watcher-2",
-                        shard_id="arena",
-                        shard_epoch=4,
-                        frame=100,
-                        subject_id="bob",
-                        claim_kind="hit",
-                        claim_hash=claim_hash,
-                        claim_summary="alice shot bob first",
-                    ),
-                    expected_schema_version="cultnet.simulation_consensus_candidate.v0",
-                )
-
-                self.assertEqual(first["messageId"], "daemon-sim-1")
-                self.assertFalse(first["hasQuorum"])
-                self.assertEqual(first["witnessCount"], 1)
-                self.assertEqual(second["messageId"], "daemon-sim-2")
-                self.assertTrue(second["hasQuorum"])
-                self.assertEqual(second["witnessCount"], 2)
-                self.assertEqual(second["claimHash"], claim_hash)
-            finally:
-                self._terminate_process(process)
-
-    def _wait_for_ready_file(self, process: subprocess.Popen[str], ready_path: Path) -> dict[str, object]:
-        deadline = time.monotonic() + 5.0
-        while not ready_path.exists() and time.monotonic() < deadline:
-            if process.poll() is not None:
-                break
-            time.sleep(0.05)
-        if not ready_path.exists():
-            _, stderr = process.communicate(timeout=2.0)
-            self.fail(f"cultmesh daemon did not publish readiness: {stderr}")
-        return json.loads(ready_path.read_text(encoding="utf-8"))
-
-    def _terminate_process(self, process: subprocess.Popen[str]) -> None:
-        process.terminate()
-        try:
-            process.communicate(timeout=5.0)
-        except subprocess.TimeoutExpired:
-            process.kill()
-            process.communicate(timeout=5.0)
-
-    def test_cultmesh_local_server_serves_node_and_catalogs_over_clients(self) -> None:
-        document = define_database_entry_type(
-            "mesh.server_note",
-            [("body", 0)],
-            schema_id="mesh.server_note.v1",
-        )
-        node = CultMesh.create_node(runtime_id="mesh-server")
-        node.database.register_document(document)
-        node.database.put_raw_message(document, "note:1", {"body": "served"}, shard_id="notes", shard_epoch=1)
-        observation_hub = CultNetSimulationObservationHub(
-            CultNetSimulationConsensusOptions(minimum_witnesses=2, quorum_ratio=1.0)
-        )
-        seen_candidates: list[CultNetSimulationConsensusCandidate] = []
-        unsubscribe_candidates = observation_hub.watch_candidates(seen_candidates.append)
-        claim_hash = compute_simulation_claim_hash("hit", "alice", "bob", "frame:100")
-        verses = CultMeshVerseCatalog()
-        verses.upsert(
-            CultMeshVerseDescriptor(
-                verse_id="server-verse",
-                display_name="Server Verse",
-                authority_model="local",
-                compatibility=CultMeshVerseCompatibility("cultmesh.v0", "rules"),
-            )
-        )
-        peers = CultMeshPeerCatalog()
-        peers.upsert(
-            CultMeshPeerCard(
-                peer_id="mesh-server",
-                verse_id="server-verse",
-                endpoints=("cultnet://127.0.0.1:0",),
-                roles=("read-replica",),
-            )
-        )
-
-        server = CultMesh.serve_node(
-            node,
-            verse_catalog=verses,
-            peer_catalog=peers,
-            observation_hub=observation_hub,
-            display_name="Mesh Server",
-        )
-        try:
-            raw_client = CultMesh.create_client("127.0.0.1", server.port, timeout_seconds=2.0)
-            hello_response = raw_client.request(hello(runtime_id="probe"), expected_schema_version="cultnet.hello.v0")
-            schema_response = raw_client.fetch_schema_catalog(schema_ids=["mesh.server_note.v1"], include_schema_json=True)
-            rudp_client = CultMesh.create_client(
-                endpoint=f"rudp://127.0.0.1:{server.port}",
-                timeout_seconds=2.0,
-                connection_id=server.rudp_connection_id,
-                runtime_id="rudp-probe",
-            )
-            rudp_hello_response = rudp_client.request(
-                hello(runtime_id="rudp-probe"),
-                expected_schema_version="cultnet.hello.v0",
-            )
-            rudp_schema_response = rudp_client.fetch_schema_catalog(
-                schema_ids=["mesh.server_note.v1"],
-                include_schema_json=True,
-            )
-            wire_schema_response = raw_client.fetch_schema_catalog(kinds=["wire_message"], include_schema_json=True)
-            synced_schema_catalog = CultNetSchemaCatalog()
-            synced_wire_descriptors = raw_client.sync_schema_catalog(
-                synced_schema_catalog,
-                kinds=["wire_message"],
-                include_schema_json=True,
-            )
-            snapshot_response = raw_client.fetch_snapshot(schema_ids=["mesh.server_note.v1"])
-            typed_snapshot_response = raw_client.fetch_snapshot_response(schema_ids=["mesh.server_note.v1"])
-            shard_catalog = raw_client.fetch_shard_catalog(schema_ids=["mesh.server_note.v1"])
-            synced_shard_catalog = CultNetShardCatalog()
-            synced_shards = raw_client.sync_shard_catalog(synced_shard_catalog, schema_ids=["mesh.server_note.v1"])
-            shard_log = raw_client.fetch_shard_log(shard_id="notes", shard_epoch=1)
-            typed_shard_log = raw_client.fetch_shard_log_response(shard_id="notes", shard_epoch=1)
-            self.assertEqual(hello_response["transportProfiles"][0]["transports"][0]["protocol"], "tcp_framed")
-            self.assertEqual(hello_response["transportProfiles"][0]["transports"][0]["port"], server.port)
-            stale_shard_log = raw_client.fetch_shard_log(shard_id="notes", shard_epoch=0)
-            discovery_client = CultMesh.create_verse_discovery_client("127.0.0.1", server.port, timeout_seconds=2.0)
-            fetched_verses = discovery_client.fetch_verses(transport_version="cultmesh.v0")
-            fetched_peers = discovery_client.fetch_peers(verse_id="server-verse", roles=["read-replica"])
-            first_candidate = raw_client.request(
-                simulation_observation(
-                    message_id="obs-1",
-                    witness_runtime_id="watcher-1",
-                    shard_id="arena",
-                    shard_epoch=4,
-                    frame=100,
-                    subject_id="bob",
-                    claim_kind="hit",
-                    claim_hash=claim_hash,
-                    claim_summary="alice shot bob first",
-                ),
-                expected_schema_version="cultnet.simulation_consensus_candidate.v0",
-            )
-            quorum_candidate = raw_client.request(
-                simulation_observation(
-                    message_id="obs-2",
-                    witness_runtime_id="watcher-2",
-                    shard_id="arena",
-                    shard_epoch=4,
-                    frame=100,
-                    subject_id="bob",
-                    claim_kind="hit",
-                    claim_hash=claim_hash,
-                    claim_summary="alice shot bob first",
-                ),
-                expected_schema_version="cultnet.simulation_consensus_candidate.v0",
-            )
-            with raw_client.subscribe_database(subscription_id="sub-server", schema_ids=["mesh.server_note.v1"]) as subscription:
-                subscription_snapshot = subscription.read_next_snapshot_response()
-                subscription.send(document_put_raw(
-                    message_id="server-put",
-                    key="note:2",
-                    schema_id="mesh.server_note.v1",
-                    stored_at="2026-06-14T00:00:00Z",
-                    payload=document.encode_payload({"body": "subscribed"}),
-                    shard_id="primary",
-                    shard_epoch=1,
-                ))
-                subscription_change = subscription.read_next_change()
-                subscription.send(document_delete(
-                    message_id="server-delete",
-                    schema_id="mesh.server_note.v1",
-                    record_key="note:2",
-                    shard_id="primary",
-                    shard_epoch=1,
-                ))
-                subscription_delete = subscription.read_next_change()
-        finally:
-            unsubscribe_candidates()
-            server.stop()
-
-        self.assertEqual(hello_response["runtimeId"], "mesh-server")
-        self.assertEqual(hello_response["displayName"], "Mesh Server")
-        self.assertIn("cultnet.database_subscribe.v0", hello_response["supportedMessageVersions"])
-        self.assertIn("cultnet.error.v0", hello_response["supportedMessageVersions"])
-        self.assertIn("cultnet.document_put_raw.v0", hello_response["supportedMessageVersions"])
-        self.assertIn("cultnet.simulation_observation.v0", hello_response["supportedMessageVersions"])
-        self.assertEqual(hello_response["supportedMutationContracts"][0]["documentType"], "mesh.server_note")
-        self.assertIn("documentDelete", hello_response["supportedMutationContracts"][0]["operations"])
-        self.assertIn("shardLog", hello_response["supportedMutationContracts"][0]["operations"])
-        advertised_transports = {
-            transport["protocol"]: transport
-            for profile in hello_response["transportProfiles"]
-            for transport in profile["transports"]
-        }
-        self.assertEqual(advertised_transports["tcp_framed"]["port"], server.port)
-        self.assertEqual(advertised_transports["rudp"]["port"], server.port)
-        self.assertEqual(rudp_hello_response["runtimeId"], "mesh-server")
-        self.assertEqual(rudp_schema_response["schemas"][0]["schemaId"], "mesh.server_note.v1")
-        self.assertEqual(schema_response["schemas"][0]["schemaId"], "mesh.server_note.v1")
-        self.assertIn("schemaJson", schema_response["schemas"][0])
-        self.assertIn("cultnet.document_delete.v0", schema_response["schemas"][0]["wireContracts"])
-        self.assertIn("cultnet.shard_log_response.v0", schema_response["schemas"][0]["wireContracts"])
-        wire_descriptors = {schema["schemaVersion"]: schema for schema in wire_schema_response["schemas"]}
-        self.assertEqual(wire_descriptors["cultnet.error.v0"]["kind"], "wire_message")
-        self.assertEqual(wire_descriptors["cultnet.document_put_raw.v0"]["kind"], "wire_message")
-        self.assertIn("schemaJson", wire_descriptors["cultnet.document_put_raw.v0"])
-        self.assertIn("cultmesh.peer_exchange_response.v0", wire_descriptors)
-        self.assertIn("cultnet.error.v0", {descriptor.schema_version for descriptor in synced_wire_descriptors})
-        self.assertIn("cultnet.document_put_raw.v0", {descriptor.schema_version for descriptor in synced_wire_descriptors})
-        self.assertIsNotNone(synced_schema_catalog.get("https://github.com/GameCult/cultnet-ts/contracts/cultnet.document-put-raw.schema.json"))
-        self.assertEqual(snapshot_response["documents"][0]["recordKey"], "note:1")
-        self.assertEqual(typed_snapshot_response.documents[0].record_key, "note:1")
-        self.assertEqual(typed_snapshot_response.documents[0].schema_id, "mesh.server_note.v1")
-        self.assertEqual(shard_catalog["shards"][0]["schemaIds"], ["mesh.server_note.v1"])
-        self.assertEqual(shard_catalog["shards"][0]["epoch"], 1)
-        self.assertEqual(shard_catalog["shards"][0]["shardId"], "notes")
-        self.assertEqual(synced_shards[0].shard_id, "notes")
-        self.assertEqual(synced_shards[0].epoch, 1)
-        self.assertEqual(synced_shard_catalog.get("notes"), synced_shards[0])
-        self.assertEqual(shard_log["entries"][0]["changeKind"], "added")
-        self.assertTrue(stale_shard_log["resyncRequired"])
-        self.assertEqual(stale_shard_log["reason"], "stale_epoch")
-        self.assertEqual(stale_shard_log["shardEpoch"], 1)
-        self.assertEqual(stale_shard_log["entries"], [])
-        self.assertEqual(typed_shard_log.last_sequence, 1)
-        self.assertEqual(typed_shard_log.entries[0].put["document"]["recordKey"], "note:1")
-        self.assertIsInstance(typed_shard_log.entries[0].raw_document, CultNetRawDocumentRecord)
-        self.assertEqual(typed_shard_log.entries[0].raw_document.record_key, "note:1")
-        self.assertEqual(fetched_verses[0].verse_id, "server-verse")
-        self.assertEqual(fetched_peers[0].peer_id, "mesh-server")
-        self.assertEqual(first_candidate["messageId"], "obs-1")
-        self.assertFalse(first_candidate["hasQuorum"])
-        self.assertEqual(quorum_candidate["messageId"], "obs-2")
-        self.assertEqual(quorum_candidate["claimHash"], claim_hash)
-        self.assertTrue(quorum_candidate["hasQuorum"])
-        self.assertEqual(quorum_candidate["witnessCount"], 2)
-        self.assertEqual([candidate.claim_hash for candidate in seen_candidates], [claim_hash, claim_hash])
-        self.assertIsInstance(subscription_snapshot, CultNetRawSnapshotResponse)
-        self.assertEqual(subscription_snapshot.to_wire()["schemaVersion"], "cultnet.snapshot_response_raw.v0")
-        self.assertEqual(subscription_change.change_kind, "added")
-        self.assertEqual(subscription_change.record_key, "note:2")
-        self.assertEqual(subscription_change.document["recordKey"], "note:2")
-        self.assertIsInstance(subscription_change.raw_document, CultNetRawDocumentRecord)
-        self.assertEqual(subscription_change.raw_document.schema_id, "mesh.server_note.v1")
-        self.assertEqual(subscription_delete.change_kind, "removed")
-        self.assertEqual(subscription_delete.record_key, "note:2")
-        self.assertIsNone(subscription_delete.raw_document)
-        self.assertIsNone(node.database.get(document, "note:2"))
-
-    def test_cultmesh_local_server_rejects_oversized_snapshot_responses(self) -> None:
-        document = define_database_entry_type(
-            "mesh.snapshot_limit_note",
-            [("body", 0)],
-            schema_id="mesh.snapshot_limit_note.v1",
-        )
-        node = CultMesh.create_node(runtime_id="mesh-snapshot-limits")
-        node.database.register_document(document)
-        node.database.put_raw_message(document, "note:1", {"body": "first"})
-        node.database.put_raw_message(document, "note:2", {"body": "second"})
-
-        server = CultMesh.serve_node(node, max_snapshot_documents=1)
-        try:
-            raw_client = CultMesh.create_client("127.0.0.1", server.port, timeout_seconds=2.0)
-            filtered_snapshot = raw_client.fetch_snapshot(record_keys=["note:1"])
-            error = raw_client.request(
-                snapshot_request(schema_ids=["mesh.snapshot_limit_note.v1"]),
-                expected_schema_version="cultnet.error.v0",
-            )
-            with self.assertRaisesRegex(CultNetPeerError, "Snapshot document limit exceeded"):
-                raw_client.fetch_snapshot(schema_ids=["mesh.snapshot_limit_note.v1"])
-        finally:
-            server.stop()
-
-        self.assertEqual(filtered_snapshot["schemaVersion"], "cultnet.snapshot_response_raw.v0")
-        self.assertEqual([document["recordKey"] for document in filtered_snapshot["documents"]], ["note:1"])
-        self.assertEqual(error["schemaVersion"], "cultnet.error.v0")
-        self.assertIn("Snapshot document limit exceeded", error["error"])
-        self.assertEqual(error["code"], "snapshot_document_limit_exceeded")
-        self.assertEqual(error["details"]["documentCount"], 2)
-        self.assertEqual(error["details"]["maxSnapshotDocuments"], 1)
-
-    def test_cultmesh_local_server_returns_errors_for_bad_requests(self) -> None:
-        document = define_database_entry_type(
-            "mesh.error_note",
-            [("body", 0)],
-            schema_id="mesh.error_note.v1",
-        )
-        node = CultMesh.create_node(runtime_id="mesh-error-server")
-        node.database.register_document(document)
-
-        server = CultMesh.serve_node(node)
-        try:
-            raw_client = CultMesh.create_client("127.0.0.1", server.port, timeout_seconds=2.0)
-            unsupported = raw_client.request(
-                {"schemaVersion": "cultnet.nope.v0", "messageId": "bad-schema"},
-                expected_schema_version="cultnet.error.v0",
-            )
-            malformed_put = raw_client.request(
-                {"schemaVersion": "cultnet.document_put_raw.v0", "messageId": "bad-put"},
-                expected_schema_version="cultnet.error.v0",
-            )
-            malformed_delete = raw_client.request(
-                {"schemaVersion": "cultnet.document_delete.v0", "messageId": "bad-delete", "schemaId": "mesh.error_note.v1"},
-                expected_schema_version="cultnet.error.v0",
-            )
-        finally:
-            server.stop()
-
-        self.assertEqual(unsupported["messageId"], "bad-schema")
-        self.assertEqual(unsupported["code"], "unsupported_schema_version")
-        self.assertEqual(unsupported["details"]["schemaVersion"], "cultnet.nope.v0")
-        self.assertIn("Unsupported CultNet message schema", unsupported["error"])
-        self.assertEqual(malformed_put["messageId"], "bad-put")
-        self.assertEqual(malformed_put["code"], "malformed_document_put")
-        self.assertEqual(malformed_delete["messageId"], "bad-delete")
-        self.assertEqual(malformed_delete["code"], "malformed_document_delete")
-
-    def test_cultmesh_authority_lease_requires_live_matching_lease(self) -> None:
-        peer = CultMeshPeerCard(
-            peer_id="voidbot-local",
-            verse_id="local",
-            endpoints=("cultmesh://localhost",),
-            roles=("shard-primary",),
-            authority_lease_id="lease:voidbot-local",
-        )
-        leases = CultMeshAuthorityLeaseCatalog()
-        peers = CultMeshPeerCatalog()
-        peers.upsert(peer)
-        now = datetime.now(UTC)
-        self.assertFalse(leases.is_authorized(peer, "shard-primary", at=now))
-        self.assertEqual(peers.find_authorized("local", "shard-primary", leases, at=now), [])
-
-        leases.upsert(
-            CultMeshAuthorityLease(
-                lease_id="lease:voidbot-local",
-                verse_id="local",
-                peer_id="voidbot-local",
-                roles=("shard-primary", "shard-primary", ""),
-                valid_from=now - timedelta(seconds=1),
-                expires_at=now + timedelta(seconds=1),
-                shard_ids=("shard-a",),
-                issuer_runtime_id="odin",
-                signature="signed",
-            )
-        )
-
-        lease = leases.get("lease:voidbot-local")
-        self.assertIsNotNone(lease)
-        assert lease is not None
-        self.assertEqual(leases.leases, (lease,))
-        self.assertEqual(lease.roles, ("shard-primary",))
-        self.assertEqual(lease.issuer_runtime_id, "odin")
-        self.assertEqual(lease.signature, "signed")
-        self.assertTrue(lease.is_valid_at(now))
-        self.assertTrue(lease.covers(peer, "shard-primary", shard_id="shard-a", at=now))
-        self.assertFalse(lease.covers(peer, "shard-primary", shard_id="shard-b", at=now))
-        self.assertTrue(leases.is_authorized(peer, "shard-primary", shard_id="shard-a", at=now))
-        self.assertEqual(
-            peers.find_authorized("local", "shard-primary", leases, shard_id="shard-a", at=now),
-            [peer],
-        )
-        self.assertEqual(
-            peers.first_authorized("local", "shard-primary", leases, shard_id="shard-a", at=now),
-            peer,
-        )
-        self.assertIsNone(peers.first_authorized("local", "read-replica", leases, at=now))
-        self.assertFalse(leases.is_authorized(peer, "shard-primary", shard_id="shard-b", at=now))
-        self.assertFalse(leases.is_authorized(peer, "read-replica", at=now))
-        self.assertIsNone(leases.get("missing"))
-
-    def test_cultmesh_authority_lease_catalog_can_require_verified_signatures(self) -> None:
-        peer = CultMeshPeerCard(
-            peer_id="voidbot-local",
-            verse_id="local",
-            endpoints=("cultmesh://localhost",),
-            roles=("shard-primary",),
-            shard_ids=("shard-a",),
-            authority_lease_id="lease:voidbot-local",
-        )
-        now = datetime.now(UTC)
-        unsigned = CultMeshAuthorityLease(
-            lease_id="lease:voidbot-local",
-            verse_id="local",
-            peer_id="voidbot-local",
-            roles=("shard-primary",),
-            valid_from=now - timedelta(seconds=1),
-            expires_at=now + timedelta(seconds=30),
-            shard_ids=("shard-a",),
-            issuer_runtime_id="odin",
-        )
-        verifier = CultMeshHmacAuthorityLeaseVerifier({"odin": b"lease-secret"})
-        signed = verifier.issue(unsigned)
-        strict_leases = CultMesh.create_authority_lease_catalog(
-            signature_verifier=verifier.verify,
-            require_verified_signatures=True,
-        )
-        strict_leases.upsert(unsigned)
-        self.assertFalse(strict_leases.is_verified(unsigned.lease_id))
-        self.assertFalse(strict_leases.is_authorized(peer, "shard-primary", shard_id="shard-a", at=now))
-
-        strict_leases.upsert(signed)
-        self.assertTrue(strict_leases.is_verified(signed.lease_id))
-        self.assertTrue(strict_leases.is_authorized(peer, "shard-primary", shard_id="shard-a", at=now))
-
-        wrong_key = CultMesh.create_authority_lease_catalog(
-            signature_verifier=CultMeshHmacAuthorityLeaseVerifier({"odin": b"wrong-secret"}).verify,
-            require_verified_signatures=True,
-        )
-        wrong_key.upsert(signed)
-        self.assertFalse(wrong_key.is_verified(signed.lease_id))
-        self.assertFalse(wrong_key.is_authorized(peer, "shard-primary", shard_id="shard-a", at=now))
-
-        tampered = CultMeshAuthorityLease(
-            lease_id=signed.lease_id,
-            verse_id=signed.verse_id,
-            peer_id=signed.peer_id,
-            roles=("shard-primary", "read-replica"),
-            valid_from=signed.valid_from,
-            expires_at=signed.expires_at,
-            shard_ids=signed.shard_ids,
-            issuer_runtime_id=signed.issuer_runtime_id,
-            signature=signed.signature,
-        )
-        strict_leases.upsert(tampered)
-        self.assertFalse(strict_leases.is_verified(tampered.lease_id))
-        self.assertFalse(strict_leases.is_authorized(peer, "shard-primary", shard_id="shard-a", at=now))
-
-    def test_cultmesh_stream_catalog_negotiates_transport_and_latest_frame(self) -> None:
-        streams = CultMeshStreamCatalog()
-        streams.declare(
-            CultMeshStreamDescriptor(
-                stream_id="mimir:kiyo-pro",
-                verse_id="studio",
-                owner_peer_id="starfire",
-                kind="video",
-                label="Kiyo Pro",
-                clock={"clockDomainId": "starfire-qpc", "confidence": 0.25},
-                video={"width": 1920, "height": 1080, "pixelFormat": "YUY2", "framesPerSecond": 30},
-                preferred_transports=("shared-d3d12-texture", "shared-memory", "cultcache-page"),
-                max_in_flight_frames=3,
-            )
-        )
-
-        negotiation = streams.negotiate(
-            "mimir:kiyo-pro",
-            CultMeshStreamConsumerProfile(
-                peer_id="fensalir",
-                verse_id="studio",
-                supported_transports=("shared-d3d12-texture", "cultcache-page"),
-                accepted_kinds=("video",),
-                can_import_gpu_handles=True,
-                max_in_flight_frames=2,
-            ),
-        )
-
-        self.assertEqual(negotiation.transport, "shared-d3d12-texture")
-        self.assertEqual(negotiation.max_in_flight_frames, 2)
-        self.assertEqual(negotiation.copy_budget, "zero-copy-target")
-
-        streams.publish_frame(
-            CultMeshStreamFrameHandle(
-                stream_id="mimir:kiyo-pro",
-                sequence=42,
-                timestamp_ns=1_000_000_000,
-                duration_ns=33_333_334,
-                transport="shared-d3d12-texture",
-                native_handle="0xfeed",
-                fence_handle="0xbeef",
-                fence_value=7,
-                unavoidable_copy_count=0,
-            )
-        )
-        self.assertEqual(streams.latest_frame("mimir:kiyo-pro").sequence, 42)
-
 
 if __name__ == "__main__":
     unittest.main()
diff --git a/packages/cultcache-rs/Cargo.toml b/packages/cultcache-rs/Cargo.toml
index b11a909e..23d53801 100644
--- a/packages/cultcache-rs/Cargo.toml
+++ b/packages/cultcache-rs/Cargo.toml
@@ -1,7 +1,8 @@
 [package]
 name = "cultcache-rs"
-version = "0.1.0"
+version = "0.2.0"
 edition = "2024"
+license = "MIT"
 publish = false
 
 [workspace]
@@ -17,6 +18,7 @@ chrono = { version = "0.4", features = ["serde"] }
 cultcache-rs-derive = { path = "cultcache-rs-derive" }
 fs2 = "0.4"
 rmp-serde = "1.3"
+redb = "4.1.0"
 serde = { version = "1", features = ["derive"] }
 serde_bytes = "0.11"
 serde_json = "1"
@@ -25,3 +27,6 @@ uuid = { version = "1", features = ["v4"] }
 [dev-dependencies]
 pretty_assertions = "1.4"
 tempfile = "3"
+
+[target.'cfg(windows)'.dependencies]
+windows-sys = { version = "0.59", features = ["Win32_Foundation", "Win32_Storage_FileSystem"] }
diff --git a/packages/cultcache-rs/README.md b/packages/cultcache-rs/README.md
index 2d75d94e..1ad01eb0 100644
--- a/packages/cultcache-rs/README.md
+++ b/packages/cultcache-rs/README.md
@@ -53,7 +53,7 @@ struct Settings {
 
 let mut cache = CultCache::new();
 cache.register_entry_type::<Settings>()?;
-cache.add_generic_backing_store(SingleFileMessagePackBackingStore::new("cache.msgpack"));
+cache.add_generic_backing_store(SingleFileMessagePackBackingStore::new("cache.cc"));
 cache.pull_all_backing_stores()?;
 
 cache.put("app", &Settings {
@@ -136,7 +136,7 @@ pub struct PlayerData {
 
 let mut cache = CultCache::builder()
     .with_generated_entries(game_entries())
-    .with_generic_store(SingleFileMessagePackBackingStore::new("cache.msgpack"))
+    .with_generic_store(SingleFileMessagePackBackingStore::new("cache.cc"))
     .build()?;
 
 cache.pull_all_backing_stores()?;
@@ -173,39 +173,71 @@ without pretending Rust has runtime reflection hiding under the floorboards.
 - `get_envelope::<T>`
 - `get_required_envelope::<T>`
 - `get_all::<T>`
+- `get_all_with_keys::<T>`
+- `soa::<T>`
 - `put::<T>`
 - `put_envelope::<T>`
 - `update::<T>`
 - `delete::<T>`
 - `snapshot`
+- `snapshot_soa`
+- `load_soa`
 - `SingleFileMessagePackBackingStore`
 
+## Structure Of Arrays
+
+The C# CultCache hot path exposes CPU-local SoA scans as:
+
+```csharp
+Span<float> x = cache.Soa<PlayerTransform>()
+    .Column<float>(nameof(PlayerTransform.PositionX))
+    .Span;
+```
+
+Rust cannot discover those columns through runtime reflection, so each domain
+type declares its column extractors explicitly with `SoaDocument` or the
+`cultcache_soa!` helper:
+
+```rust
+cultcache_soa!(PlayerTransform {
+    "position_x" => |row: &PlayerTransform| row.position_x,
+    "health" => |row: &PlayerTransform| row.health,
+});
+
+let table = cache.soa::<PlayerTransform>()?;
+let health = table.column::<i32>("health")?;
+```
+
+This is the same public shape as the C# rite: callers ask the cache for a typed
+table, then pull contiguous typed columns by name. The Rust version is explicit
+about the extractor table because the closed-world schema boundary is a virtue,
+not a missing reflection party trick.
+
 ## Backing Store Routing
 
 Generic store:
 
 ```rust
-cache.add_generic_backing_store(SingleFileMessagePackBackingStore::new("cache.msgpack"));
+cache.add_generic_backing_store(SingleFileMessagePackBackingStore::new("cache.cc"))?;
 ```
 
 Type-specific store:
 
 ```rust
 cache.add_backing_store(
-    SingleFileMessagePackBackingStore::new("players.msgpack"),
+    SingleFileMessagePackBackingStore::new("players.cc"),
     ["player"],
-);
+)?;
 ```
 
-When writing a `PlayerData`, the cache checks type-specific stores first. If none
-match, it writes to the first generic store. Later matching stores are mirrors.
+The contract, shared with every runtime, is one home store per document type
+(`src/GameCult.Caching/Contracts/cultcache-store-composition.md` in CultLib):
 
-This mirrors the C# behavior:
-
-- specific domain stores own their domain
-- the first generic store is the primary generic write target
-- later generic stores mirror writes
-- this is not multi-master
+- a type-specific store owns its types; otherwise the generic store is the home
+- a second generic store is an error, and so is a type claimed by a second
+  store; both registrations return `Err` and attach nothing
+- a write touches exactly one store; there are no mirrors
+- a write whose type has no home store is an error
 
 ## Persistence Semantics
 
diff --git a/packages/cultcache-rs/cultcache-rs-derive/src/lib.rs b/packages/cultcache-rs/cultcache-rs-derive/src/lib.rs
index f05a23f3..7d613194 100644
--- a/packages/cultcache-rs/cultcache-rs-derive/src/lib.rs
+++ b/packages/cultcache-rs/cultcache-rs-derive/src/lib.rs
@@ -75,6 +75,7 @@ pub fn derive_database_entry(input: TokenStream) -> TokenStream {
         };
         let mut key: Option<usize> = None;
         let mut default = false;
+        let mut bytes = false;
         for attribute in field
             .attrs
             .iter()
@@ -88,6 +89,9 @@ pub fn derive_database_entry(input: TokenStream) -> TokenStream {
                 } else if meta.path.is_ident("default") {
                     default = true;
                     Ok(())
+                } else if meta.path.is_ident("bytes") {
+                    bytes = true;
+                    Ok(())
                 } else {
                     Err(meta.error("unsupported field cultcache attribute"))
                 }
@@ -117,6 +121,7 @@ pub fn derive_database_entry(input: TokenStream) -> TokenStream {
             ident: field_ident,
             ty: field.ty,
             default,
+            bytes,
         });
     }
     slots.sort_by_key(|slot| slot.key);
@@ -125,8 +130,14 @@ pub fn derive_database_entry(input: TokenStream) -> TokenStream {
     let serialize_elements = (0..=max_slot).map(|slot| {
         if let Some(field) = slots.iter().find(|field| field.key == slot) {
             let field_ident = &field.ident;
-            quote! {
-                tuple.serialize_element(&self.#field_ident)?;
+            if field.bytes {
+                quote! {
+                    tuple.serialize_element(::serde_bytes::Bytes::new(&self.#field_ident))?;
+                }
+            } else {
+                quote! {
+                    tuple.serialize_element(&self.#field_ident)?;
+                }
             }
         } else {
             quote! {
@@ -138,8 +149,14 @@ pub fn derive_database_entry(input: TokenStream) -> TokenStream {
     let option_declarations = slots.iter().map(|field| {
         let variable = format_ident!("slot_{}", field.key);
         let ty = &field.ty;
-        quote! {
-            let mut #variable: ::std::option::Option<#ty> = ::std::option::Option::None;
+        if field.bytes {
+            quote! {
+                let mut #variable: ::std::option::Option<::serde_bytes::ByteBuf> = ::std::option::Option::None;
+            }
+        } else {
+            quote! {
+                let mut #variable: ::std::option::Option<#ty> = ::std::option::Option::None;
+            }
         }
     });
 
@@ -147,9 +164,17 @@ pub fn derive_database_entry(input: TokenStream) -> TokenStream {
         if let Some(field) = slots.iter().find(|field| field.key == slot) {
             let variable = format_ident!("slot_{}", field.key);
             let ty = &field.ty;
-            quote! {
-                #slot => {
-                    #variable = seq.next_element::<#ty>()?;
+            if field.bytes {
+                quote! {
+                    #slot => {
+                        #variable = seq.next_element::<::serde_bytes::ByteBuf>()?;
+                    }
+                }
+            } else {
+                quote! {
+                    #slot => {
+                        #variable = seq.next_element::<#ty>()?;
+                    }
                 }
             }
         } else {
@@ -164,7 +189,16 @@ pub fn derive_database_entry(input: TokenStream) -> TokenStream {
     let build_fields = slots.iter().map(|field| {
         let field_ident = &field.ident;
         let variable = format_ident!("slot_{}", field.key);
-        if field.default {
+        if field.bytes && field.default {
+            quote! {
+                #field_ident: #variable.unwrap_or_default().into_vec()
+            }
+        } else if field.bytes {
+            let field_name = field_ident.to_string();
+            quote! {
+                #field_ident: #variable.ok_or_else(|| ::serde::de::Error::missing_field(#field_name))?.into_vec()
+            }
+        } else if field.default {
             quote! {
                 #field_ident: #variable.unwrap_or_default()
             }
@@ -240,4 +274,5 @@ struct CultCacheSlot {
     ident: syn::Ident,
     ty: Type,
     default: bool,
+    bytes: bool,
 }
diff --git a/packages/cultcache-rs/examples/cultcache_interop.rs b/packages/cultcache-rs/examples/cultcache_interop.rs
index 4049acf8..e625db9e 100644
--- a/packages/cultcache-rs/examples/cultcache_interop.rs
+++ b/packages/cultcache-rs/examples/cultcache_interop.rs
@@ -74,7 +74,7 @@ fn read_note(file: &str) -> Result<()> {
 fn build_cache(file: &str) -> Result<CultCache> {
     let mut cache = CultCache::new();
     cache.register_entry_type::<CultCacheInteropNote>()?;
-    cache.add_generic_backing_store(SingleFileMessagePackBackingStore::new(file));
+    cache.add_generic_backing_store(SingleFileMessagePackBackingStore::new(file))?;
     Ok(cache)
 }
 
diff --git a/packages/cultcache-rs/src/lib.rs b/packages/cultcache-rs/src/lib.rs
index cb56b8a8..ed9cae32 100644
--- a/packages/cultcache-rs/src/lib.rs
+++ b/packages/cultcache-rs/src/lib.rs
@@ -1,15 +1,22 @@
 use anyhow::Context;
 use anyhow::Result;
 use anyhow::anyhow;
+use anyhow::bail;
+use anyhow::ensure;
 use serde::Serialize;
 use serde::de::DeserializeOwned;
+use std::any::Any;
 use std::collections::BTreeMap;
 use std::collections::BTreeSet;
 use std::fs;
 use std::fs::File;
 use std::fs::OpenOptions;
+use std::marker::PhantomData;
 use std::path::Path;
 use std::path::PathBuf;
+use std::sync::Arc;
+
+use redb::{Database, ReadableDatabase, ReadableTable, TableDefinition};
 
 extern crate self as cultcache_rs;
 
@@ -24,6 +31,83 @@ pub trait CultCacheRegistry {
     fn register_entries(&self, cache: &mut CultCache) -> Result<()>;
 }
 
+pub trait SoaDocument: DatabaseEntry {
+    fn soa_columns(rows: &[Self]) -> BTreeMap<&'static str, CultSoaColumnValues>;
+}
+
+pub struct CultSoaColumnValues {
+    type_name: &'static str,
+    values: Box<dyn Any + Send>,
+}
+
+impl CultSoaColumnValues {
+    pub fn new<TValue: Clone + Send + 'static>(values: Vec<TValue>) -> Self {
+        Self {
+            type_name: std::any::type_name::<TValue>(),
+            values: Box::new(values),
+        }
+    }
+}
+
+#[derive(Clone, Debug, PartialEq)]
+pub struct CultSoaColumn<TValue> {
+    name: String,
+    values: Vec<TValue>,
+}
+
+impl<TValue> CultSoaColumn<TValue> {
+    pub fn name(&self) -> &str {
+        &self.name
+    }
+
+    pub fn values(&self) -> &[TValue] {
+        &self.values
+    }
+}
+
+pub struct CultSoaTable<TDocument> {
+    keys: Vec<String>,
+    documents: Vec<TDocument>,
+    columns: BTreeMap<String, CultSoaColumnValues>,
+    _document: PhantomData<TDocument>,
+}
+
+impl<TDocument> CultSoaTable<TDocument> {
+    pub fn keys(&self) -> &[String] {
+        &self.keys
+    }
+
+    pub fn documents(&self) -> &[TDocument] {
+        &self.documents
+    }
+
+    pub fn len(&self) -> usize {
+        self.keys.len()
+    }
+
+    pub fn is_empty(&self) -> bool {
+        self.keys.is_empty()
+    }
+
+    pub fn column<TValue: Clone + 'static>(&self, name: &str) -> Result<CultSoaColumn<TValue>> {
+        let Some(column) = self.columns.get(name) else {
+            return Err(anyhow!("SoA table has no column {name:?}"));
+        };
+        let Some(values) = column.values.downcast_ref::<Vec<TValue>>() else {
+            return Err(anyhow!(
+                "SoA table column {:?} stores {}, not {}",
+                name,
+                column.type_name,
+                std::any::type_name::<TValue>()
+            ));
+        };
+        Ok(CultSoaColumn {
+            name: name.to_string(),
+            values: values.clone(),
+        })
+    }
+}
+
 #[macro_export]
 macro_rules! cultcache_registry {
     ($name:ident { $($entry:ty),* $(,)? }) => {
@@ -41,6 +125,22 @@ macro_rules! cultcache_registry {
     };
 }
 
+#[macro_export]
+macro_rules! cultcache_soa {
+    ($entry:ty { $($column:literal => $extractor:expr),* $(,)? }) => {
+        impl $crate::SoaDocument for $entry {
+            fn soa_columns(rows: &[Self]) -> ::std::collections::BTreeMap<&'static str, $crate::CultSoaColumnValues> {
+                let mut columns = ::std::collections::BTreeMap::new();
+                $(
+                    let values = rows.iter().map($extractor).collect::<Vec<_>>();
+                    columns.insert($column, $crate::CultSoaColumnValues::new(values));
+                )*
+                columns
+            }
+        }
+    };
+}
+
 #[derive(Clone, Debug, PartialEq, serde::Serialize, serde::Deserialize)]
 #[serde(rename_all = "camelCase")]
 pub struct CultCacheEnvelope {
@@ -54,6 +154,93 @@ pub struct CultCacheEnvelope {
     pub schema_id: Option<String>,
 }
 
+#[derive(Clone, Debug, Default, PartialEq, serde::Serialize, serde::Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct CultCacheSoaTable {
+    pub keys: Vec<String>,
+    pub types: Vec<String>,
+    pub payloads: Vec<Vec<u8>>,
+    pub stored_ats: Vec<String>,
+    pub schema_ids: Vec<Option<String>>,
+}
+
+impl CultCacheSoaTable {
+    pub fn from_envelopes(entries: impl IntoIterator<Item = CultCacheEnvelope>) -> Self {
+        let mut table = Self::default();
+        for entry in entries {
+            table.keys.push(entry.key);
+            table.types.push(entry.r#type);
+            table.payloads.push(entry.payload);
+            table.stored_ats.push(entry.stored_at);
+            table.schema_ids.push(entry.schema_id);
+        }
+        table
+    }
+
+    pub fn len(&self) -> usize {
+        self.keys.len()
+    }
+
+    pub fn is_empty(&self) -> bool {
+        self.keys.is_empty()
+    }
+
+    pub fn validate(&self) -> Result<()> {
+        let len = self.keys.len();
+        for (name, candidate) in [
+            ("types", self.types.len()),
+            ("payloads", self.payloads.len()),
+            ("storedAts", self.stored_ats.len()),
+            ("schemaIds", self.schema_ids.len()),
+        ] {
+            if candidate != len {
+                return Err(anyhow!(
+                    "CultCache SoA column {name} has length {candidate}, expected {len}"
+                ));
+            }
+        }
+        for (index, key) in self.keys.iter().enumerate() {
+            if key.trim().is_empty() {
+                return Err(anyhow!("CultCache SoA row {index} has an empty key"));
+            }
+            if self.types[index].trim().is_empty() {
+                return Err(anyhow!("CultCache SoA row {index} has an empty type"));
+            }
+            if self.stored_ats[index].trim().is_empty() {
+                return Err(anyhow!("CultCache SoA row {index} has an empty stored_at"));
+            }
+        }
+        Ok(())
+    }
+
+    pub fn into_envelopes(self) -> Result<Vec<CultCacheEnvelope>> {
+        self.validate()?;
+        let Self {
+            keys,
+            types,
+            payloads,
+            stored_ats,
+            schema_ids,
+        } = self;
+        Ok(keys
+            .into_iter()
+            .zip(types)
+            .zip(payloads)
+            .zip(stored_ats)
+            .zip(schema_ids)
+            .map(
+                |((((key, r#type), payload), stored_at), schema_id)| CultCacheEnvelope {
+                    key,
+                    r#type,
+                    payload,
+                    stored_at,
+                    schema_id,
+                },
+            )
+            .collect())
+    }
+}
+
 #[derive(Clone, Debug, serde::Serialize, serde::Deserialize)]
 struct PersistedStoreSnapshot(
     String,
@@ -97,21 +284,56 @@ pub struct PushAllOptions {
     pub soft: bool,
 }
 
+/// One per-entry expectation for [`SingleFileMessagePackBackingStore::compare_exchange`].
+/// `current` is the envelope the caller believes is stored, or `None` when it
+/// believes the identity is absent.
+#[derive(Clone, Debug, PartialEq)]
+pub struct CultCacheExpectedEnvelope {
+    pub key: String,
+    pub r#type: String,
+    pub current: Option<CultCacheEnvelope>,
+}
+
+/// Result of one nonblocking whole-snapshot compare-and-exchange. Contention is
+/// reported rather than waited on, so the caller keeps retry and scheduling
+/// authority instead of blocking inside the store.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum TryCompareExchangeSnapshotOutcome {
+    Exchanged,
+    Mismatch,
+    LockContended,
+}
+
 pub trait CacheBackingStore: Send {
     fn pull_all(&self) -> Result<Vec<CultCacheEnvelope>>;
     fn push(&mut self, entry: &CultCacheEnvelope) -> Result<()>;
     fn delete(&mut self, entry: &CultCacheEnvelope) -> Result<()>;
 
-    fn push_all(&mut self, entries: &[CultCacheEnvelope], _options: PushAllOptions) -> Result<()> {
-        let existing = self.pull_all()?;
-        for entry in existing {
-            self.delete(&entry)?;
-        }
-        for entry in entries {
-            self.push(entry)?;
-        }
-        Ok(())
-    }
+    /// Replaces everything the store holds with `entries` in one atomic step:
+    /// on `Err` the store still holds exactly what it held before. A cache
+    /// batch (`put_prepared_batch`) is all-or-nothing only through this. There
+    /// is no default, because a replace assembled from `delete` and `push`
+    /// calls leaves the store emptied or partial when one of them fails; a
+    /// store without an atomic replace does not compile:
+    ///
+    /// ```compile_fail,E0046
+    /// use cultcache_rs::{CacheBackingStore, CultCacheEnvelope};
+    ///
+    /// struct PerRecordStore;
+    ///
+    /// impl CacheBackingStore for PerRecordStore {
+    ///     fn pull_all(&self) -> anyhow::Result<Vec<CultCacheEnvelope>> {
+    ///         Ok(Vec::new())
+    ///     }
+    ///     fn push(&mut self, _entry: &CultCacheEnvelope) -> anyhow::Result<()> {
+    ///         Ok(())
+    ///     }
+    ///     fn delete(&mut self, _entry: &CultCacheEnvelope) -> anyhow::Result<()> {
+    ///         Ok(())
+    ///     }
+    /// }
+    /// ```
+    fn push_all(&mut self, entries: &[CultCacheEnvelope], options: PushAllOptions) -> Result<()>;
 }
 
 #[derive(Clone, Debug, PartialEq, Eq)]
@@ -128,6 +350,305 @@ impl SingleFileMessagePackBackingStore {
         &self.path
     }
 
+    /// Holds the pre-created sibling lock shared while a read-only consumer
+    /// evaluates and acts on one snapshot. The reader never creates or writes
+    /// either file. Writers using the sibling lock cannot replace the snapshot
+    /// until `action` returns.
+    ///
+    /// Releasing the lock is RAII cleanup. A release failure therefore cannot
+    /// rewrite the completed action's result; consumers that need to observe
+    /// that cleanup failure can use
+    /// [`Self::with_read_only_shared_snapshot_and_unlock_diagnostic`].
+    pub fn with_read_only_shared_snapshot<T>(
+        &self,
+        action: impl FnOnce(Vec<CultCacheEnvelope>) -> Result<T>,
+    ) -> Result<T> {
+        self.with_read_only_shared_snapshot_and_unlock_diagnostic(action, |_| {})
+    }
+
+    /// The diagnostic-bearing form of
+    /// [`Self::with_read_only_shared_snapshot`]. `on_unlock_failure` observes a
+    /// cleanup failure separately and never changes the action result.
+    pub fn with_read_only_shared_snapshot_and_unlock_diagnostic<T>(
+        &self,
+        action: impl FnOnce(Vec<CultCacheEnvelope>) -> Result<T>,
+        on_unlock_failure: impl FnOnce(anyhow::Error),
+    ) -> Result<T> {
+        self.with_read_only_shared_snapshot_using(
+            action,
+            |lock| {
+                fs2::FileExt::unlock(lock)
+                    .with_context(|| format!("failed to unlock {}", self.lock_path().display()))
+            },
+            on_unlock_failure,
+        )
+    }
+
+    fn with_read_only_shared_snapshot_using<T, U, D>(
+        &self,
+        action: impl FnOnce(Vec<CultCacheEnvelope>) -> Result<T>,
+        unlock: U,
+        on_unlock_failure: D,
+    ) -> Result<T>
+    where
+        U: FnOnce(&File) -> Result<()>,
+        D: FnOnce(anyhow::Error),
+    {
+        let lock_path = self.lock_path();
+        let lock = OpenOptions::new()
+            .read(true)
+            .open(&lock_path)
+            .with_context(|| format!("failed to open pre-created {}", lock_path.display()))?;
+        fs2::FileExt::lock_shared(&lock)
+            .with_context(|| format!("failed to lock {}", lock_path.display()))?;
+        let guard = ReadOnlySharedLockGuard::new(lock, unlock, on_unlock_failure);
+        let result = self.read_all_unlocked().and_then(action);
+        drop(guard);
+        result
+    }
+
+    /// Replaces one exact envelope under the store's cross-process exclusive
+    /// lock. A changed or missing expected envelope returns false without a write.
+    pub fn compare_and_swap_entry(
+        &self,
+        expected: &CultCacheEnvelope,
+        replacement: CultCacheEnvelope,
+    ) -> Result<bool> {
+        self.with_exclusive_lock(|| {
+            let mut entries = self.read_all_unlocked()?;
+            let Some(index) = entries
+                .iter()
+                .position(|candidate| entry_id(candidate) == entry_id(expected))
+            else {
+                return Ok(false);
+            };
+            if entries[index] != *expected {
+                return Ok(false);
+            }
+            entries[index] = replacement;
+            entries.sort_by_key(entry_id);
+            self.write_all_unlocked(&entries)?;
+            Ok(true)
+        })
+    }
+
+    /// Inserts one envelope only when its polymorphic type/key identity is
+    /// absent, under the same cross-process lock used by all single-file writes.
+    pub fn insert_entry_if_absent(&self, entry: CultCacheEnvelope) -> Result<bool> {
+        self.with_exclusive_lock(|| {
+            let mut entries = self.read_all_unlocked()?;
+            if entries
+                .iter()
+                .any(|candidate| entry_id(candidate) == entry_id(&entry))
+            {
+                return Ok(false);
+            }
+            entries.push(entry);
+            entries.sort_by_key(entry_id);
+            self.write_all_unlocked(&entries)?;
+            Ok(true)
+        })
+    }
+
+    /// Atomically replaces an exact set of existing envelopes and inserts any
+    /// additional companion envelopes. Every precondition is checked beneath
+    /// the same cross-process lock as the single snapshot write.
+    pub fn compare_and_swap_batch(
+        &self,
+        expected: &[CultCacheEnvelope],
+        replacements: Vec<CultCacheEnvelope>,
+    ) -> Result<bool> {
+        if replacements.is_empty() {
+            return Err(anyhow!(
+                "conditional batch requires a non-empty replacement set"
+            ));
+        }
+        let expected_ids = unique_batch_ids(expected, "expected")?;
+        let replacement_ids = unique_batch_ids(&replacements, "replacement")?;
+        if !expected_ids.is_subset(&replacement_ids) {
+            return Err(anyhow!(
+                "conditional batch must replace every expected identity"
+            ));
+        }
+
+        self.with_exclusive_lock(|| {
+            let mut entries = self.read_all_unlocked()?;
+            for expected_entry in expected {
+                let Some(current) = entries
+                    .iter()
+                    .find(|candidate| entry_id(candidate) == entry_id(expected_entry))
+                else {
+                    return Ok(false);
+                };
+                if current != expected_entry {
+                    return Ok(false);
+                }
+            }
+            for replacement in &replacements {
+                let identity = entry_id(replacement);
+                if !expected_ids.contains(&identity)
+                    && entries
+                        .iter()
+                        .any(|candidate| entry_id(candidate) == identity)
+                {
+                    return Ok(false);
+                }
+            }
+
+            entries.retain(|candidate| !expected_ids.contains(&entry_id(candidate)));
+            entries.extend(replacements);
+            entries.sort_by_key(entry_id);
+            self.write_all_unlocked(&entries)?;
+            Ok(true)
+        })
+    }
+
+    /// Atomically appends companions only when the complete backing-store
+    /// snapshot is byte-for-byte unchanged. Unlike identity-scoped CAS, this
+    /// fences predicate cardinality: a concurrently inserted unknown identity
+    /// makes the expected snapshot stale.
+    pub fn append_if_snapshot_unchanged(
+        &self,
+        expected_snapshot: &[CultCacheEnvelope],
+        additions: Vec<CultCacheEnvelope>,
+    ) -> Result<bool> {
+        if additions.is_empty() {
+            return Err(anyhow!("conditional snapshot append requires additions"));
+        }
+        unique_batch_ids(expected_snapshot, "expected snapshot")?;
+        let addition_ids = unique_batch_ids(&additions, "snapshot additions")?;
+        self.with_exclusive_lock(|| {
+            let mut current = self.read_all_unlocked()?;
+            let mut expected = expected_snapshot.to_vec();
+            current.sort_by_key(entry_id);
+            expected.sort_by_key(entry_id);
+            if current != expected {
+                return Ok(false);
+            }
+            if current
+                .iter()
+                .any(|row| addition_ids.contains(&entry_id(row)))
+            {
+                return Ok(false);
+            }
+            current.extend(additions);
+            current.sort_by_key(entry_id);
+            self.write_all_unlocked(&current)?;
+            Ok(true)
+        })
+    }
+
+    /// Atomically deletes an exact set of envelopes. Any changed or missing
+    /// member refuses the entire deletion without a partial write.
+    pub fn delete_batch_if_unchanged(&self, expected: &[CultCacheEnvelope]) -> Result<bool> {
+        if expected.is_empty() {
+            return Err(anyhow!(
+                "conditional delete requires a non-empty expected set"
+            ));
+        }
+        let expected_ids = unique_batch_ids(expected, "delete expected")?;
+        self.with_exclusive_lock(|| {
+            let mut entries = self.read_all_unlocked()?;
+            for expected_entry in expected {
+                let Some(current) = entries
+                    .iter()
+                    .find(|candidate| entry_id(candidate) == entry_id(expected_entry))
+                else {
+                    return Ok(false);
+                };
+                if current != expected_entry {
+                    return Ok(false);
+                }
+            }
+            entries.retain(|candidate| !expected_ids.contains(&entry_id(candidate)));
+            self.write_all_unlocked(&entries)?;
+            Ok(true)
+        })
+    }
+
+    /// Atomically replaces existing rows and appends companion rows only while
+    /// the complete backing-store snapshot remains byte-exact.
+    pub fn replace_and_append_if_snapshot_unchanged(
+        &self,
+        expected_snapshot: &[CultCacheEnvelope],
+        replacements: Vec<CultCacheEnvelope>,
+    ) -> Result<bool> {
+        if replacements.is_empty() {
+            return Err(anyhow!(
+                "conditional snapshot replacement requires replacements"
+            ));
+        }
+        unique_batch_ids(expected_snapshot, "expected snapshot")?;
+        let replacement_ids = unique_batch_ids(&replacements, "snapshot replacements")?;
+        self.with_exclusive_lock(|| {
+            let mut current = self.read_all_unlocked()?;
+            let mut expected = expected_snapshot.to_vec();
+            current.sort_by_key(entry_id);
+            expected.sort_by_key(entry_id);
+            if current != expected {
+                return Ok(false);
+            }
+            current.retain(|row| !replacement_ids.contains(&entry_id(row)));
+            current.extend(replacements);
+            current.sort_by_key(entry_id);
+            self.write_all_unlocked(&current)?;
+            Ok(true)
+        })
+    }
+
+    /// Atomically replaces and deletes rows only while the complete store
+    /// snapshot remains byte-exact. This is the single-file compaction
+    /// primitive: summary publication and history deletion share one write.
+    pub fn replace_and_delete_if_snapshot_unchanged(
+        &self,
+        expected_snapshot: &[CultCacheEnvelope],
+        replacements: Vec<CultCacheEnvelope>,
+        deletions: &[CultCacheEnvelope],
+    ) -> Result<bool> {
+        if replacements.is_empty() || deletions.is_empty() {
+            return Err(anyhow!(
+                "conditional compaction requires replacements and deletions"
+            ));
+        }
+        let expected_ids = unique_batch_ids(expected_snapshot, "expected snapshot")?;
+        let replacement_ids = unique_batch_ids(&replacements, "replacement")?;
+        let deletion_ids = unique_batch_ids(deletions, "deletion")?;
+        if !deletion_ids.is_subset(&expected_ids) {
+            return Err(anyhow!(
+                "compaction deletion is absent from expected snapshot"
+            ));
+        }
+        if !deletion_ids.is_disjoint(&replacement_ids) {
+            return Err(anyhow!("compaction cannot replace and delete one identity"));
+        }
+        self.with_exclusive_lock(|| {
+            let mut current = self.read_all_unlocked()?;
+            let mut expected = expected_snapshot.to_vec();
+            current.sort_by_key(entry_id);
+            expected.sort_by_key(entry_id);
+            if current != expected {
+                return Ok(false);
+            }
+            for row in &replacements {
+                if !expected_ids.contains(&entry_id(row))
+                    && current
+                        .iter()
+                        .any(|candidate| entry_id(candidate) == entry_id(row))
+                {
+                    return Ok(false);
+                }
+            }
+            current.retain(|row| !deletion_ids.contains(&entry_id(row)));
+            for row in replacements {
+                current.retain(|candidate| entry_id(candidate) != entry_id(&row));
+                current.push(row);
+            }
+            current.sort_by_key(entry_id);
+            self.write_all_unlocked(&current)?;
+            Ok(true)
+        })
+    }
+
     fn read_all_unlocked(&self) -> Result<Vec<CultCacheEnvelope>> {
         if !self.path.exists() {
             return Ok(Vec::new());
@@ -137,10 +658,21 @@ impl SingleFileMessagePackBackingStore {
         if bytes.is_empty() {
             return Ok(Vec::new());
         }
-        decode_store_snapshot(&bytes).or_else(|_| {
-            rmp_serde::from_slice(&bytes)
-                .with_context(|| format!("failed to decode MessagePack {}", self.path.display()))
-        })
+        decode_store_snapshot(&bytes)
+            .or_else(|_| rmp_serde::from_slice(&bytes))
+            .with_context(|| format!("failed to decode MessagePack {}", self.path.display()))
+    }
+
+    /// Reads one filesystem snapshot without creating or opening the sibling
+    /// CultCache lock file.
+    ///
+    /// This is deliberately narrower than `pull_all`: use it only at a
+    /// provider-owned, read-only crossing where the producer replaces the
+    /// complete file atomically and the consumer has no authority to mutate
+    /// the provider directory. An absent file is an empty snapshot. Writers
+    /// and locally owned stores must continue to use the locked APIs.
+    pub fn pull_all_read_only_snapshot(&self) -> Result<Vec<CultCacheEnvelope>> {
+        self.read_all_unlocked()
     }
 
     fn write_all_unlocked(&self, entries: &[CultCacheEnvelope]) -> Result<()> {
@@ -148,22 +680,25 @@ impl SingleFileMessagePackBackingStore {
             fs::create_dir_all(parent)
                 .with_context(|| format!("failed to create {}", parent.display()))?;
         }
-        let bytes = rmp_serde::to_vec(&encode_store_snapshot(entries))
+        remove_abandoned_staging_files(&self.path)?;
+        let bytes = rmp_serde::to_vec(&encode_store_snapshot(entries)?)
             .context("failed to encode MessagePack")?;
         let tmp_path = temporary_path_for(&self.path);
-        fs::write(&tmp_path, bytes)
+        let mut staged = OpenOptions::new()
+            .create_new(true)
+            .write(true)
+            .open(&tmp_path)
+            .with_context(|| format!("failed to create {}", tmp_path.display()))?;
+        use std::io::Write;
+        staged
+            .write_all(&bytes)
             .with_context(|| format!("failed to write {}", tmp_path.display()))?;
-        if self.path.exists() {
-            fs::remove_file(&self.path)
-                .with_context(|| format!("failed to replace {}", self.path.display()))?;
-        }
-        fs::rename(&tmp_path, &self.path).with_context(|| {
-            format!(
-                "failed to move {} to {}",
-                tmp_path.display(),
-                self.path.display()
-            )
-        })?;
+        staged
+            .sync_all()
+            .with_context(|| format!("failed to sync {}", tmp_path.display()))?;
+        drop(staged);
+        replace_file_atomically(&tmp_path, &self.path)?;
+        sync_parent_directory(&self.path)?;
         Ok(())
     }
 
@@ -187,6 +722,126 @@ impl SingleFileMessagePackBackingStore {
         result
     }
 
+    /// Replaces the named entries only if each still matches its expectation.
+    /// Unlike the snapshot form this constrains only the identities named, so
+    /// unrelated concurrent writes do not lose the race.
+    pub fn compare_exchange(
+        &self,
+        expected: &[CultCacheExpectedEnvelope],
+        replacements: &[CultCacheEnvelope],
+    ) -> Result<bool> {
+        self.with_exclusive_lock(|| {
+            let mut entries = self.read_all_unlocked()?;
+            for condition in expected {
+                let current = entries
+                    .iter()
+                    .find(|entry| entry.r#type == condition.r#type && entry.key == condition.key);
+                if current != condition.current.as_ref() {
+                    return Ok(false);
+                }
+                if let Some(envelope) = condition.current.as_ref()
+                    && (envelope.r#type != condition.r#type || envelope.key != condition.key)
+                {
+                    return Err(anyhow!(
+                        "CultCache compare-exchange expectation identity differs from its envelope"
+                    ));
+                }
+            }
+            let mut replacement_ids = BTreeSet::new();
+            for replacement in replacements {
+                if replacement.key.trim().is_empty() || replacement.r#type.trim().is_empty() {
+                    return Err(anyhow!(
+                        "CultCache compare-exchange replacement identity is empty"
+                    ));
+                }
+                if !replacement_ids.insert(entry_id(replacement)) {
+                    return Err(anyhow!(
+                        "CultCache compare-exchange contains a duplicate replacement"
+                    ));
+                }
+            }
+            entries.retain(|entry| !replacement_ids.contains(&entry_id(entry)));
+            entries.extend_from_slice(replacements);
+            entries.sort_by_key(entry_id);
+            self.write_all_unlocked(&entries)?;
+            Ok(true)
+        })
+    }
+
+    /// Replaces the whole snapshot only if it still equals `expected`, waiting
+    /// for the exclusive lock. Returns false when another writer has moved the
+    /// snapshot on, which is a lost race rather than an error.
+    pub fn compare_exchange_snapshot(
+        &self,
+        expected: &[CultCacheEnvelope],
+        replacements: &[CultCacheEnvelope],
+    ) -> Result<bool> {
+        self.with_exclusive_lock(|| self.compare_exchange_snapshot_unlocked(expected, replacements))
+    }
+
+    /// Makes one nonblocking attempt at the same exchange. Once the lock is
+    /// held, comparison, validation, ordering and persistence are identical to
+    /// [`Self::compare_exchange_snapshot`].
+    pub fn try_compare_exchange_snapshot(
+        &self,
+        expected: &[CultCacheEnvelope],
+        replacements: &[CultCacheEnvelope],
+    ) -> Result<TryCompareExchangeSnapshotOutcome> {
+        let Some(exchanged) = self.try_with_exclusive_lock(|| {
+            self.compare_exchange_snapshot_unlocked(expected, replacements)
+        })?
+        else {
+            return Ok(TryCompareExchangeSnapshotOutcome::LockContended);
+        };
+        Ok(if exchanged {
+            TryCompareExchangeSnapshotOutcome::Exchanged
+        } else {
+            TryCompareExchangeSnapshotOutcome::Mismatch
+        })
+    }
+
+    fn compare_exchange_snapshot_unlocked(
+        &self,
+        expected: &[CultCacheEnvelope],
+        replacements: &[CultCacheEnvelope],
+    ) -> Result<bool> {
+        let current = self.read_all_unlocked()?;
+        if current != expected {
+            return Ok(false);
+        }
+        let mut replacement_ids = BTreeSet::new();
+        for replacement in replacements {
+            if replacement.key.trim().is_empty() || replacement.r#type.trim().is_empty() {
+                return Err(anyhow!("CultCache snapshot replacement identity is empty"));
+            }
+            if !replacement_ids.insert(entry_id(replacement)) {
+                return Err(anyhow!(
+                    "CultCache snapshot replacement contains a duplicate identity"
+                ));
+            }
+        }
+        let mut ordered = replacements.to_vec();
+        ordered.sort_by_key(entry_id);
+        self.write_all_unlocked(&ordered)?;
+        Ok(true)
+    }
+
+    fn try_with_exclusive_lock<T>(&self, action: impl FnOnce() -> Result<T>) -> Result<Option<T>> {
+        let lock = self.open_lock_file()?;
+        match fs2::FileExt::try_lock_exclusive(&lock) {
+            Ok(()) => {}
+            Err(error) if error.kind() == std::io::ErrorKind::WouldBlock => return Ok(None),
+            Err(error) => {
+                return Err(error)
+                    .with_context(|| format!("failed to lock {}", self.lock_path().display()));
+            }
+        }
+        let result = action();
+        fs2::FileExt::unlock(&lock)
+            .with_context(|| format!("failed to unlock {}", self.lock_path().display()))?;
+        result.map(Some)
+    }
+
     fn open_lock_file(&self) -> Result<File> {
         let lock_path = self.lock_path();
         if let Some(parent) = lock_path.parent() {
@@ -207,14 +862,71 @@ impl SingleFileMessagePackBackingStore {
             .path
             .file_name()
             .map(|value| value.to_os_string())
-            .unwrap_or_else(|| "cultcache.msgpack".into());
+            .unwrap_or_else(|| "cultcache.cc".into());
         lock_name.push(".lock");
         self.path.with_file_name(lock_name)
     }
 }
 
+struct ReadOnlySharedLockGuard<U, D>
+where
+    U: FnOnce(&File) -> Result<()>,
+    D: FnOnce(anyhow::Error),
+{
+    lock: Option<File>,
+    unlock: Option<U>,
+    on_unlock_failure: Option<D>,
+}
+
+impl<U, D> ReadOnlySharedLockGuard<U, D>
+where
+    U: FnOnce(&File) -> Result<()>,
+    D: FnOnce(anyhow::Error),
+{
+    fn new(lock: File, unlock: U, on_unlock_failure: D) -> Self {
+        Self {
+            lock: Some(lock),
+            unlock: Some(unlock),
+            on_unlock_failure: Some(on_unlock_failure),
+        }
+    }
+}
+
+impl<U, D> Drop for ReadOnlySharedLockGuard<U, D>
+where
+    U: FnOnce(&File) -> Result<()>,
+    D: FnOnce(anyhow::Error),
+{
+    fn drop(&mut self) {
+        let (Some(lock), Some(unlock)) = (self.lock.as_ref(), self.unlock.take()) else {
+            return;
+        };
+        if let Err(error) = unlock(lock)
+            && let Some(on_unlock_failure) = self.on_unlock_failure.take()
+        {
+            on_unlock_failure(error);
+        }
+    }
+}
+
+fn unique_batch_ids(
+    entries: &[CultCacheEnvelope],
+    label: &str,
+) -> Result<BTreeSet<(String, String)>> {
+    let ids = entries.iter().map(entry_id).collect::<BTreeSet<_>>();
+    if ids.len() != entries.len() {
+        return Err(anyhow!(
+            "conditional batch {label} set contains duplicate identities"
+        ));
+    }
+    Ok(ids)
+}
+
 impl CacheBackingStore for SingleFileMessagePackBackingStore {
     fn pull_all(&self) -> Result<Vec<CultCacheEnvelope>> {
+        if !self.path.exists() && !self.lock_path().exists() {
+            return Ok(Vec::new());
+        }
         self.with_shared_lock(|| self.read_all_unlocked())
     }
 
@@ -245,6 +957,947 @@ impl CacheBackingStore for SingleFileMessagePackBackingStore {
     }
 }
 
+const REDB_ENVELOPES: TableDefinition<&[u8], &[u8]> = TableDefinition::new("cultcache_envelopes");
+
+/// Transactional keyed CultCache storage. Each polymorphic `(type, key)`
+/// identity is an independent redb row whose value is the exact MessagePack
+/// serialization of its `CultCacheEnvelope`.
+#[derive(Clone)]
+pub struct RedbMessagePackBackingStore {
+    path: PathBuf,
+}
+
+impl std::fmt::Debug for RedbMessagePackBackingStore {
+    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        formatter
+            .debug_struct("RedbMessagePackBackingStore")
+            .field("path", &self.path)
+            .finish_non_exhaustive()
+    }
+}
+
+impl RedbMessagePackBackingStore {
+    pub fn new(path: impl Into<PathBuf>) -> Result<Self> {
+        let path = path.into();
+        if let Some(parent) = path
+            .parent()
+            .filter(|parent| !parent.as_os_str().is_empty())
+        {
+            fs::create_dir_all(parent)
+                .with_context(|| format!("failed to create {}", parent.display()))?;
+        }
+        let store = Self { path };
+        store.with_database(|database| {
+            let write = database.begin_write()?;
+            {
+                write.open_table(REDB_ENVELOPES)?;
+            }
+            write.commit()?;
+            Ok(())
+        })?;
+        Ok(store)
+    }
+
+    pub fn path(&self) -> &Path {
+        &self.path
+    }
+
+    fn open_database(&self) -> Result<Database> {
+        Database::create(&self.path)
+            .with_context(|| format!("failed to open redb CultCache {}", self.path.display()))
+    }
+
+    /// redb permits one open writable database handle per path. The external
+    /// CultCache lock therefore owns the complete open/transaction/close
+    /// interval, preserving the fresh-handle and cross-process construction
+    /// model used by the other backing store.
+    fn with_database<T>(&self, action: impl FnOnce(&Database) -> Result<T>) -> Result<T> {
+        let lock_path = self.lock_path();
+        if let Some(parent) = lock_path
+            .parent()
+            .filter(|parent| !parent.as_os_str().is_empty())
+        {
+            fs::create_dir_all(parent)
+                .with_context(|| format!("failed to create {}", parent.display()))?;
+        }
+        let lock = OpenOptions::new()
+            .create(true)
+            .read(true)
+            .truncate(false)
+            .write(true)
+            .open(&lock_path)
+            .with_context(|| format!("failed to open {}", lock_path.display()))?;
+        fs2::FileExt::lock_exclusive(&lock)
+            .with_context(|| format!("failed to lock {}", lock_path.display()))?;
+        let result = self.open_database().and_then(|database| action(&database));
+        fs2::FileExt::unlock(&lock)
+            .with_context(|| format!("failed to unlock {}", lock_path.display()))?;
+        result
+    }
+
+    fn lock_path(&self) -> PathBuf {
+        let mut lock_name = self
+            .path
+            .file_name()
+            .map(|value| value.to_os_string())
+            .unwrap_or_else(|| "cultcache.cc".into());
+        lock_name.push(".lock");
+        self.path.with_file_name(lock_name)
+    }
+
+    pub fn compare_and_swap_entry(
+        &self,
+        expected: &CultCacheEnvelope,
+        replacement: CultCacheEnvelope,
+    ) -> Result<bool> {
+        if entry_id(expected) != entry_id(&replacement) {
+            return Err(anyhow!("entry CAS replacement must preserve identity"));
+        }
+        self.with_database(|database| {
+            let write = database.begin_write()?;
+            let matched = {
+                let mut table = write.open_table(REDB_ENVELOPES)?;
+                if read_redb_entry(&table, expected)? != Some(expected.clone()) {
+                    false
+                } else {
+                    insert_redb_entry(&mut table, &replacement)?;
+                    true
+                }
+            };
+            if matched {
+                write.commit()?;
+            } else {
+                write.abort()?;
+            }
+            Ok(matched)
+        })
+    }
+
+    pub fn insert_entry_if_absent(&self, entry: CultCacheEnvelope) -> Result<bool> {
+        self.with_database(|database| {
+            let write = database.begin_write()?;
+            let inserted = {
+                let mut table = write.open_table(REDB_ENVELOPES)?;
+                let key = redb_identity(&entry)?;
+                if table.get(key.as_slice())?.is_some() {
+                    false
+                } else {
+                    insert_redb_entry(&mut table, &entry)?;
+                    true
+                }
+            };
+            if inserted {
+                write.commit()?;
+            } else {
+                write.abort()?;
+            }
+            Ok(inserted)
+        })
+    }
+
+    pub fn compare_and_swap_batch(
+        &self,
+        expected: &[CultCacheEnvelope],
+        replacements: Vec<CultCacheEnvelope>,
+    ) -> Result<bool> {
+        if replacements.is_empty() {
+            return Err(anyhow!(
+                "conditional batch requires a non-empty replacement set"
+            ));
+        }
+        let expected_ids = unique_batch_ids(expected, "expected")?;
+        let replacement_ids = unique_batch_ids(&replacements, "replacement")?;
+        if !expected_ids.is_subset(&replacement_ids) {
+            return Err(anyhow!(
+                "conditional batch must replace every expected identity"
+            ));
+        }
+        self.with_database(|database| {
+            let write = database.begin_write()?;
+            let matched = {
+                let mut table = write.open_table(REDB_ENVELOPES)?;
+                let mut valid = true;
+                for row in expected {
+                    if read_redb_entry(&table, row)? != Some(row.clone()) {
+                        valid = false;
+                        break;
+                    }
+                }
+                if valid {
+                    for row in &replacements {
+                        if !expected_ids.contains(&entry_id(row))
+                            && read_redb_entry(&table, row)?.is_some()
+                        {
+                            valid = false;
+                            break;
+                        }
+                    }
+                }
+                if valid {
+                    for row in &replacements {
+                        insert_redb_entry(&mut table, row)?;
+                    }
+                }
+                valid
+            };
+            if matched {
+                write.commit()?;
+            } else {
+                write.abort()?;
+            }
+            Ok(matched)
+        })
+    }
+
+    pub fn append_if_snapshot_unchanged(
+        &self,
+        expected_snapshot: &[CultCacheEnvelope],
+        additions: Vec<CultCacheEnvelope>,
+    ) -> Result<bool> {
+        if additions.is_empty() {
+            return Err(anyhow!("conditional snapshot append requires additions"));
+        }
+        unique_batch_ids(expected_snapshot, "expected snapshot")?;
+        let addition_ids = unique_batch_ids(&additions, "snapshot additions")?;
+        self.with_database(|database| {
+            let write = database.begin_write()?;
+            let matched = {
+                let mut table = write.open_table(REDB_ENVELOPES)?;
+                let mut current = read_all_redb(&table)?;
+                let mut expected = expected_snapshot.to_vec();
+                current.sort_by_key(entry_id);
+                expected.sort_by_key(entry_id);
+                let valid = current == expected
+                    && !current
+                        .iter()
+                        .any(|row| addition_ids.contains(&entry_id(row)));
+                if valid {
+                    for row in &additions {
+                        insert_redb_entry(&mut table, row)?;
+                    }
+                }
+                valid
+            };
+            if matched {
+                write.commit()?;
+            } else {
+                write.abort()?;
+            }
+            Ok(matched)
+        })
+    }
+
+    pub fn replace_and_append_if_snapshot_unchanged(
+        &self,
+        expected_snapshot: &[CultCacheEnvelope],
+        replacements: Vec<CultCacheEnvelope>,
+    ) -> Result<bool> {
+        if replacements.is_empty() {
+            return Err(anyhow!(
+                "conditional snapshot replacement requires replacements"
+            ));
+        }
+        unique_batch_ids(expected_snapshot, "expected snapshot")?;
+        unique_batch_ids(&replacements, "snapshot replacements")?;
+        self.with_database(|database| {
+            let write = database.begin_write()?;
+            let matched = {
+                let mut table = write.open_table(REDB_ENVELOPES)?;
+                let mut current = read_all_redb(&table)?;
+                let mut expected = expected_snapshot.to_vec();
+                current.sort_by_key(entry_id);
+                expected.sort_by_key(entry_id);
+                let valid = current == expected;
+                if valid {
+                    for row in &replacements {
+                        insert_redb_entry(&mut table, row)?;
+                    }
+                }
+                valid
+            };
+            if matched {
+                write.commit()?;
+            } else {
+                write.abort()?;
+            }
+            Ok(matched)
+        })
+    }
+
+    /// Atomically replaces and deletes rows only while the complete store
+    /// snapshot remains byte-exact. This is the compaction primitive for a
+    /// non-owning keyed handle: a stale reader cannot summarize one history
+    /// while deleting another.
+    pub fn replace_and_delete_if_snapshot_unchanged(
+        &self,
+        expected_snapshot: &[CultCacheEnvelope],
+        replacements: Vec<CultCacheEnvelope>,
+        deletions: &[CultCacheEnvelope],
+    ) -> Result<bool> {
+        if replacements.is_empty() || deletions.is_empty() {
+            return Err(anyhow!(
+                "conditional compaction requires replacements and deletions"
+            ));
+        }
+        let expected_ids = unique_batch_ids(expected_snapshot, "expected snapshot")?;
+        let replacement_ids = unique_batch_ids(&replacements, "replacement")?;
+        let deletion_ids = unique_batch_ids(deletions, "deletion")?;
+        if !deletion_ids.is_subset(&expected_ids) {
+            return Err(anyhow!(
+                "compaction deletion is absent from expected snapshot"
+            ));
+        }
+        if !deletion_ids.is_disjoint(&replacement_ids) {
+            return Err(anyhow!("compaction cannot replace and delete one identity"));
+        }
+        self.with_database(|database| {
+            let write = database.begin_write()?;
+            let matched = {
+                let mut table = write.open_table(REDB_ENVELOPES)?;
+                let mut current = read_all_redb(&table)?;
+                let mut expected = expected_snapshot.to_vec();
+                current.sort_by_key(entry_id);
+                expected.sort_by_key(entry_id);
+                let mut valid = current == expected;
+                if valid {
+                    for row in &replacements {
+                        if !expected_ids.contains(&entry_id(row))
+                            && read_redb_entry(&table, row)?.is_some()
+                        {
+                            valid = false;
+                            break;
+                        }
+                    }
+                }
+                if valid {
+                    for identity in deletion_ids {
+                        let key = rmp_serde::to_vec(&identity)
+                            .context("failed to encode CultCache identity")?;
+                        table.remove(key.as_slice())?;
+                    }
+                    for row in &replacements {
+                        insert_redb_entry(&mut table, row)?;
+                    }
+                }
+                valid
+            };
+            if matched {
+                write.commit()?;
+            } else {
+                write.abort()?;
+            }
+            Ok(matched)
+        })
+    }
+
+    pub fn delete_batch_if_unchanged(&self, expected: &[CultCacheEnvelope]) -> Result<bool> {
+        if expected.is_empty() {
+            return Err(anyhow!(
+                "conditional delete requires a non-empty expected set"
+            ));
+        }
+        unique_batch_ids(expected, "delete expected")?;
+        self.with_database(|database| {
+            let write = database.begin_write()?;
+            let matched = {
+                let mut table = write.open_table(REDB_ENVELOPES)?;
+                let mut valid = true;
+                for row in expected {
+                    if read_redb_entry(&table, row)? != Some(row.clone()) {
+                        valid = false;
+                        break;
+                    }
+                }
+                if valid {
+                    for row in expected {
+                        let key = redb_identity(row)?;
+                        table.remove(key.as_slice())?;
+                    }
+                }
+                valid
+            };
+            if matched {
+                write.commit()?;
+            } else {
+                write.abort()?;
+            }
+            Ok(matched)
+        })
+    }
+}
+
+struct OwnedRedbInner {
+    database: Database,
+    _owner_lock: File,
+    file_identity: String,
+}
+
+/// A pinned redb store for one long-lived service owner. Unlike the transient
+/// redb store, this handle holds the CultCache external lock, an open file
+/// handle, and the redb database for its entire lifetime. Clones share that
+/// exact ownership authority.
+#[derive(Clone)]
+pub struct OwnedRedbMessagePackBackingStore {
+    path: PathBuf,
+    inner: Arc<OwnedRedbInner>,
+}
+
+impl std::fmt::Debug for OwnedRedbMessagePackBackingStore {
+    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        formatter
+            .debug_struct("OwnedRedbMessagePackBackingStore")
+            .field("path", &self.path)
+            .field("file_identity", &self.inner.file_identity)
+            .finish_non_exhaustive()
+    }
+}
+
+impl OwnedRedbMessagePackBackingStore {
+    pub fn new(path: impl Into<PathBuf>) -> Result<Self> {
+        let path = path.into();
+        if let Some(parent) = path
+            .parent()
+            .filter(|parent| !parent.as_os_str().is_empty())
+        {
+            fs::create_dir_all(parent)
+                .with_context(|| format!("failed to create {}", parent.display()))?;
+        }
+        let lock_path = redb_lock_path(&path);
+        let owner_lock = OpenOptions::new()
+            .create(true)
+            .read(true)
+            .truncate(false)
+            .write(true)
+            .open(&lock_path)
+            .with_context(|| format!("failed to open {}", lock_path.display()))?;
+        fs2::FileExt::try_lock_exclusive(&owner_lock).with_context(|| {
+            format!(
+                "redb CultCache {} already has an active owner",
+                path.display()
+            )
+        })?;
+
+        // Give redb ownership of the already pinned file, structurally closing
+        // path substitution during database creation. The post-open identity
+        // comparison separately verifies that the pathname still names it.
+        let database_file = OpenOptions::new()
+            .create(true)
+            .read(true)
+            .truncate(false)
+            .write(true)
+            .open(&path)
+            .with_context(|| format!("failed to pin redb CultCache {}", path.display()))?;
+        let held_identity = file_identity_from_file(&database_file)?;
+        let database = Database::builder()
+            .create_file(database_file)
+            .with_context(|| format!("failed to open redb CultCache {}", path.display()))?;
+        let path_identity_file = File::open(&path)?;
+        let path_identity = file_identity_from_file(&path_identity_file)?;
+        if held_identity != path_identity {
+            bail!(
+                "redb CultCache path identity changed while opening: held {held_identity}, path {path_identity}"
+            );
+        }
+        let write = database.begin_write()?;
+        {
+            write.open_table(REDB_ENVELOPES)?;
+        }
+        write.commit()?;
+        Ok(Self {
+            path,
+            inner: Arc::new(OwnedRedbInner {
+                database,
+                _owner_lock: owner_lock,
+                file_identity: held_identity,
+            }),
+        })
+    }
+
+    pub fn path(&self) -> &Path {
+        &self.path
+    }
+
+    pub fn file_identity(&self) -> &str {
+        &self.inner.file_identity
+    }
+
+    pub fn require_file_identity(&self, expected: &str) -> Result<()> {
+        if expected != self.file_identity() {
+            bail!(
+                "redb CultCache file identity mismatch: expected {expected}, owned {}",
+                self.file_identity()
+            );
+        }
+        Ok(())
+    }
+
+    pub fn validate_path_identity(&self) -> Result<()> {
+        let current_file = File::open(&self.path)
+            .with_context(|| format!("owned redb path {} is missing", self.path.display()))?;
+        let current = file_identity_from_file(&current_file)?;
+        self.require_file_identity(&current).with_context(|| {
+            format!(
+                "owned redb path {} no longer names the pinned file",
+                self.path.display()
+            )
+        })
+    }
+
+    pub fn compare_and_swap_entry(
+        &self,
+        expected: &CultCacheEnvelope,
+        replacement: CultCacheEnvelope,
+    ) -> Result<bool> {
+        if entry_id(expected) != entry_id(&replacement) {
+            return Err(anyhow!("entry CAS replacement must preserve identity"));
+        }
+        let write = self.inner.database.begin_write()?;
+        let matched = {
+            let mut table = write.open_table(REDB_ENVELOPES)?;
+            if read_redb_entry(&table, expected)? != Some(expected.clone()) {
+                false
+            } else {
+                insert_redb_entry(&mut table, &replacement)?;
+                true
+            }
+        };
+        if matched {
+            write.commit()?;
+        } else {
+            write.abort()?;
+        }
+        Ok(matched)
+    }
+
+    pub fn insert_entry_if_absent(&self, entry: CultCacheEnvelope) -> Result<bool> {
+        let write = self.inner.database.begin_write()?;
+        let inserted = {
+            let mut table = write.open_table(REDB_ENVELOPES)?;
+            let key = redb_identity(&entry)?;
+            if table.get(key.as_slice())?.is_some() {
+                false
+            } else {
+                insert_redb_entry(&mut table, &entry)?;
+                true
+            }
+        };
+        if inserted {
+            write.commit()?;
+        } else {
+            write.abort()?;
+        }
+        Ok(inserted)
+    }
+
+    pub fn compare_and_swap_batch(
+        &self,
+        expected: &[CultCacheEnvelope],
+        replacements: Vec<CultCacheEnvelope>,
+    ) -> Result<bool> {
+        if replacements.is_empty() {
+            return Err(anyhow!(
+                "conditional batch requires a non-empty replacement set"
+            ));
+        }
+        let expected_ids = unique_batch_ids(expected, "expected")?;
+        let replacement_ids = unique_batch_ids(&replacements, "replacement")?;
+        if !expected_ids.is_subset(&replacement_ids) {
+            return Err(anyhow!(
+                "conditional batch must replace every expected identity"
+            ));
+        }
+        let write = self.inner.database.begin_write()?;
+        let matched = {
+            let mut table = write.open_table(REDB_ENVELOPES)?;
+            let mut valid = true;
+            for row in expected {
+                if read_redb_entry(&table, row)? != Some(row.clone()) {
+                    valid = false;
+                    break;
+                }
+            }
+            if valid {
+                for row in &replacements {
+                    if !expected_ids.contains(&entry_id(row))
+                        && read_redb_entry(&table, row)?.is_some()
+                    {
+                        valid = false;
+                        break;
+                    }
+                }
+            }
+            if valid {
+                for row in &replacements {
+                    insert_redb_entry(&mut table, row)?;
+                }
+            }
+            valid
+        };
+        if matched {
+            write.commit()?;
+        } else {
+            write.abort()?;
+        }
+        Ok(matched)
+    }
+
+    pub fn append_if_snapshot_unchanged(
+        &self,
+        expected_snapshot: &[CultCacheEnvelope],
+        additions: Vec<CultCacheEnvelope>,
+    ) -> Result<bool> {
+        if additions.is_empty() {
+            return Err(anyhow!("conditional snapshot append requires additions"));
+        }
+        unique_batch_ids(expected_snapshot, "expected snapshot")?;
+        let addition_ids = unique_batch_ids(&additions, "snapshot additions")?;
+        let write = self.inner.database.begin_write()?;
+        let matched = {
+            let mut table = write.open_table(REDB_ENVELOPES)?;
+            let mut current = read_all_redb(&table)?;
+            let mut expected = expected_snapshot.to_vec();
+            current.sort_by_key(entry_id);
+            expected.sort_by_key(entry_id);
+            let valid = current == expected
+                && !current
+                    .iter()
+                    .any(|row| addition_ids.contains(&entry_id(row)));
+            if valid {
+                for row in &additions {
+                    insert_redb_entry(&mut table, row)?;
+                }
+            }
+            valid
+        };
+        if matched {
+            write.commit()?;
+        } else {
+            write.abort()?;
+        }
+        Ok(matched)
+    }
+
+    pub fn replace_and_append_if_snapshot_unchanged(
+        &self,
+        expected_snapshot: &[CultCacheEnvelope],
+        replacements: Vec<CultCacheEnvelope>,
+    ) -> Result<bool> {
+        if replacements.is_empty() {
+            return Err(anyhow!(
+                "conditional snapshot replacement requires replacements"
+            ));
+        }
+        unique_batch_ids(expected_snapshot, "expected snapshot")?;
+        unique_batch_ids(&replacements, "snapshot replacements")?;
+        let write = self.inner.database.begin_write()?;
+        let matched = {
+            let mut table = write.open_table(REDB_ENVELOPES)?;
+            let mut current = read_all_redb(&table)?;
+            let mut expected = expected_snapshot.to_vec();
+            current.sort_by_key(entry_id);
+            expected.sort_by_key(entry_id);
+            let valid = current == expected;
+            if valid {
+                for row in &replacements {
+                    insert_redb_entry(&mut table, row)?;
+                }
+            }
+            valid
+        };
+        if matched {
+            write.commit()?;
+        } else {
+            write.abort()?;
+        }
+        Ok(matched)
+    }
+
+    pub fn delete_batch_if_unchanged(&self, expected: &[CultCacheEnvelope]) -> Result<bool> {
+        if expected.is_empty() {
+            return Err(anyhow!(
+                "conditional delete requires a non-empty expected set"
+            ));
+        }
+        let expected_ids = unique_batch_ids(expected, "delete expected")?;
+        let write = self.inner.database.begin_write()?;
+        let matched = {
+            let mut table = write.open_table(REDB_ENVELOPES)?;
+            let mut valid = true;
+            for row in expected {
+                if read_redb_entry(&table, row)? != Some(row.clone()) {
+                    valid = false;
+                    break;
+                }
+            }
+            if valid {
+                for identity in expected_ids {
+                    let key = rmp_serde::to_vec(&identity)
+                        .context("failed to encode CultCache identity")?;
+                    table.remove(key.as_slice())?;
+                }
+            }
+            valid
+        };
+        if matched {
+            write.commit()?;
+        } else {
+            write.abort()?;
+        }
+        Ok(matched)
+    }
+
+    /// Atomically replaces and deletes rows only while the complete store
+    /// snapshot remains byte-exact. This is the compaction primitive: a stale
+    /// reader cannot summarize one history while deleting another.
+    pub fn replace_and_delete_if_snapshot_unchanged(
+        &self,
+        expected_snapshot: &[CultCacheEnvelope],
+        replacements: Vec<CultCacheEnvelope>,
+        deletions: &[CultCacheEnvelope],
+    ) -> Result<bool> {
+        if replacements.is_empty() || deletions.is_empty() {
+            return Err(anyhow!(
+                "conditional compaction requires replacements and deletions"
+            ));
+        }
+        let expected_ids = unique_batch_ids(expected_snapshot, "expected snapshot")?;
+        let replacement_ids = unique_batch_ids(&replacements, "replacement")?;
+        let deletion_ids = unique_batch_ids(deletions, "deletion")?;
+        if !deletion_ids.is_subset(&expected_ids) {
+            return Err(anyhow!(
+                "compaction deletion is absent from expected snapshot"
+            ));
+        }
+        if !deletion_ids.is_disjoint(&replacement_ids) {
+            return Err(anyhow!("compaction cannot replace and delete one identity"));
+        }
+        let write = self.inner.database.begin_write()?;
+        let matched = {
+            let mut table = write.open_table(REDB_ENVELOPES)?;
+            let mut current = read_all_redb(&table)?;
+            let mut expected = expected_snapshot.to_vec();
+            current.sort_by_key(entry_id);
+            expected.sort_by_key(entry_id);
+            let mut valid = current == expected;
+            if valid {
+                for row in &replacements {
+                    if !expected_ids.contains(&entry_id(row))
+                        && read_redb_entry(&table, row)?.is_some()
+                    {
+                        valid = false;
+                        break;
+                    }
+                }
+            }
+            if valid {
+                for identity in deletion_ids {
+                    let key = rmp_serde::to_vec(&identity)
+                        .context("failed to encode CultCache identity")?;
+                    table.remove(key.as_slice())?;
+                }
+                for row in &replacements {
+                    insert_redb_entry(&mut table, row)?;
+                }
+            }
+            valid
+        };
+        if matched {
+            write.commit()?;
+        } else {
+            write.abort()?;
+        }
+        Ok(matched)
+    }
+}
+
+impl CacheBackingStore for OwnedRedbMessagePackBackingStore {
+    fn pull_all(&self) -> Result<Vec<CultCacheEnvelope>> {
+        let read = self.inner.database.begin_read()?;
+        let table = read.open_table(REDB_ENVELOPES)?;
+        read_all_redb(&table)
+    }
+
+    fn push(&mut self, entry: &CultCacheEnvelope) -> Result<()> {
+        let write = self.inner.database.begin_write()?;
+        {
+            let mut table = write.open_table(REDB_ENVELOPES)?;
+            insert_redb_entry(&mut table, entry)?;
+        }
+        write.commit()?;
+        Ok(())
+    }
+
+    fn delete(&mut self, entry: &CultCacheEnvelope) -> Result<()> {
+        let write = self.inner.database.begin_write()?;
+        {
+            let mut table = write.open_table(REDB_ENVELOPES)?;
+            let key = redb_identity(entry)?;
+            table.remove(key.as_slice())?;
+        }
+        write.commit()?;
+        Ok(())
+    }
+
+    fn push_all(&mut self, entries: &[CultCacheEnvelope], _options: PushAllOptions) -> Result<()> {
+        unique_batch_ids(entries, "push all")?;
+        let write = self.inner.database.begin_write()?;
+        {
+            let mut table = write.open_table(REDB_ENVELOPES)?;
+            let keys = table
+                .iter()?
+                .map(|row| Ok(row?.0.value().to_vec()))
+                .collect::<Result<Vec<_>>>()?;
+            for key in keys {
+                table.remove(key.as_slice())?;
+            }
+            for entry in entries {
+                insert_redb_entry(&mut table, entry)?;
+            }
+        }
+        write.commit()?;
+        Ok(())
+    }
+}
+
+fn redb_lock_path(path: &Path) -> PathBuf {
+    let mut lock_name = path
+        .file_name()
+        .map(|value| value.to_os_string())
+        .unwrap_or_else(|| "cultcache.cc".into());
+    lock_name.push(".lock");
+    path.with_file_name(lock_name)
+}
+
+#[cfg(unix)]
+fn file_identity_from_file(file: &File) -> Result<String> {
+    use std::os::unix::fs::MetadataExt;
+    let metadata = file.metadata()?;
+    Ok(format!(
+        "unix:{:016x}:{:016x}",
+        metadata.dev(),
+        metadata.ino()
+    ))
+}
+
+#[cfg(windows)]
+fn file_identity_from_file(file: &File) -> Result<String> {
+    use std::mem::zeroed;
+    use std::os::windows::io::AsRawHandle;
+    use windows_sys::Win32::Storage::FileSystem::{
+        BY_HANDLE_FILE_INFORMATION, GetFileInformationByHandle,
+    };
+    let mut information: BY_HANDLE_FILE_INFORMATION = unsafe { zeroed() };
+    let success =
+        unsafe { GetFileInformationByHandle(file.as_raw_handle() as _, &mut information) };
+    if success == 0 {
+        return Err(std::io::Error::last_os_error())
+            .context("failed to read Windows file identity");
+    }
+    let index = ((information.nFileIndexHigh as u64) << 32) | information.nFileIndexLow as u64;
+    Ok(format!(
+        "windows:{:08x}:{index:016x}",
+        information.dwVolumeSerialNumber
+    ))
+}
+
+fn redb_identity(entry: &CultCacheEnvelope) -> Result<Vec<u8>> {
+    rmp_serde::to_vec(&entry_id(entry)).context("failed to encode CultCache identity")
+}
+
+fn read_redb_entry(
+    table: &impl ReadableTable<&'static [u8], &'static [u8]>,
+    identity: &CultCacheEnvelope,
+) -> Result<Option<CultCacheEnvelope>> {
+    let key = redb_identity(identity)?;
+    table
+        .get(key.as_slice())?
+        .map(|value| {
+            rmp_serde::from_slice(value.value()).context("failed to decode redb CultCache envelope")
+        })
+        .transpose()
+}
+
+fn insert_redb_entry(
+    table: &mut redb::Table<&[u8], &[u8]>,
+    entry: &CultCacheEnvelope,
+) -> Result<()> {
+    let key = redb_identity(entry)?;
+    let value = rmp_serde::to_vec(entry).context("failed to encode redb CultCache envelope")?;
+    table.insert(key.as_slice(), value.as_slice())?;
+    Ok(())
+}
+
+fn read_all_redb(
+    table: &impl ReadableTable<&'static [u8], &'static [u8]>,
+) -> Result<Vec<CultCacheEnvelope>> {
+    let mut entries = table
+        .iter()?
+        .map(|row| {
+            let (_, value) = row?;
+            rmp_serde::from_slice(value.value()).context("failed to decode redb CultCache envelope")
+        })
+        .collect::<Result<Vec<_>>>()?;
+    entries.sort_by_key(entry_id);
+    Ok(entries)
+}
+
+impl CacheBackingStore for RedbMessagePackBackingStore {
+    fn pull_all(&self) -> Result<Vec<CultCacheEnvelope>> {
+        self.with_database(|database| {
+            let read = database.begin_read()?;
+            let table = read.open_table(REDB_ENVELOPES)?;
+            read_all_redb(&table)
+        })
+    }
+
+    fn push(&mut self, entry: &CultCacheEnvelope) -> Result<()> {
+        self.with_database(|database| {
+            let write = database.begin_write()?;
+            {
+                let mut table = write.open_table(REDB_ENVELOPES)?;
+                insert_redb_entry(&mut table, entry)?;
+            }
+            write.commit()?;
+            Ok(())
+        })
+    }
+
+    fn delete(&mut self, entry: &CultCacheEnvelope) -> Result<()> {
+        self.with_database(|database| {
+            let write = database.begin_write()?;
+            {
+                let mut table = write.open_table(REDB_ENVELOPES)?;
+                let key = redb_identity(entry)?;
+                table.remove(key.as_slice())?;
+            }
+            write.commit()?;
+            Ok(())
+        })
+    }
+
+    fn push_all(&mut self, entries: &[CultCacheEnvelope], _options: PushAllOptions) -> Result<()> {
+        unique_batch_ids(entries, "push all")?;
+        self.with_database(|database| {
+            let write = database.begin_write()?;
+            {
+                let mut table = write.open_table(REDB_ENVELOPES)?;
+                let keys = table
+                    .iter()?
+                    .map(|row| Ok(row?.0.value().to_vec()))
+                    .collect::<Result<Vec<_>>>()?;
+                for key in keys {
+                    table.remove(key.as_slice())?;
+                }
+                for entry in entries {
+                    insert_redb_entry(&mut table, entry)?;
+                }
+            }
+            write.commit()?;
+            Ok(())
+        })
+    }
+}
+
 struct CultCacheStoreRegistration {
     store: Box<dyn CacheBackingStore>,
     types: BTreeSet<String>,
@@ -252,7 +1905,8 @@ struct CultCacheStoreRegistration {
 
 pub struct CultCache {
     definitions: BTreeMap<String, &'static str>,
-    entries: BTreeMap<String, CultCacheEnvelope>,
+    schema_name_definitions: BTreeMap<String, String>,
+    entries: BTreeMap<(String, String), CultCacheEnvelope>,
     stores: Vec<CultCacheStoreRegistration>,
 }
 
@@ -260,6 +1914,7 @@ impl CultCache {
     pub fn new() -> Self {
         Self {
             definitions: BTreeMap::new(),
+            schema_name_definitions: BTreeMap::new(),
             entries: BTreeMap::new(),
             stores: Vec::new(),
         }
@@ -279,7 +1934,18 @@ impl CultCache {
                 T::TYPE
             ));
         }
+        if let Some(existing_type) = self.schema_name_definitions.get(T::SCHEMA_NAME)
+            && existing_type != T::TYPE
+        {
+            return Err(anyhow!(
+                "CultCache schema name {:?} is already registered for type {:?}",
+                T::SCHEMA_NAME,
+                existing_type
+            ));
+        }
         self.definitions.insert(T::TYPE.to_string(), T::SCHEMA_NAME);
+        self.schema_name_definitions
+            .insert(T::SCHEMA_NAME.to_string(), T::TYPE.to_string());
         Ok(())
     }
 
@@ -287,43 +1953,113 @@ impl CultCache {
         self.register_entry_type::<T>()
     }
 
+    pub fn registered_entry_types(&self) -> Vec<String> {
+        self.definitions.keys().cloned().collect()
+    }
+
     pub fn register_registry<R: CultCacheRegistry>(&mut self, registry: R) -> Result<&mut Self> {
         registry.register_entries(self)?;
         Ok(self)
     }
 
+    /// Makes the store home to `types`, or the generic store when `types` is
+    /// empty. A type has exactly one home store: a second generic store or a
+    /// type already claimed by another store is an error and attaches nothing.
     pub fn add_backing_store(
         &mut self,
         store: impl CacheBackingStore + 'static,
         types: impl IntoIterator<Item = impl Into<String>>,
-    ) {
+    ) -> Result<()> {
+        let types: BTreeSet<String> = types.into_iter().map(Into::into).collect();
+        if types.is_empty() && self.stores.iter().any(|registration| registration.types.is_empty()) {
+            return Err(anyhow!(
+                "Backing store would be a second generic store; name the types it is home to"
+            ));
+        }
+        if let Some(claimed) = types
+            .iter()
+            .find(|type_id| self.stores.iter().any(|registration| registration.types.contains(*type_id)))
+        {
+            return Err(anyhow!(
+                "CultCache type {:?} is already routed to another backing store; it cannot also route to this one",
+                claimed
+            ));
+        }
         self.stores.push(CultCacheStoreRegistration {
             store: Box::new(store),
-            types: types.into_iter().map(Into::into).collect(),
+            types,
         });
+        // A record's home cannot change after it is admitted.
+        let candidate = self.stores.len() - 1;
+        let held: BTreeSet<String> = self.entries.keys().map(|(type_id, _)| type_id.clone()).collect();
+        for type_id in &held {
+            let type_id = type_id.as_str();
+            let after = self.resolve_route_index(type_id);
+            let before = self.stores[..candidate]
+                .iter()
+                .position(|registration| registration.types.contains(type_id))
+                .or_else(|| self.stores[..candidate].iter().position(|registration| registration.types.is_empty()));
+            if before != after {
+                let error = anyhow!(
+                    "Attaching this backing store would move {:?} from {} to {}; attach routed stores before the generic store",
+                    type_id,
+                    self.describe_store(before),
+                    self.describe_store(after)
+                );
+                self.stores.pop();
+                return Err(error);
+            }
+        }
+        Ok(())
     }
 
-    pub fn add_generic_backing_store(&mut self, store: impl CacheBackingStore + 'static) {
-        self.add_backing_store(store, Vec::<String>::new());
+    pub fn add_generic_backing_store(&mut self, store: impl CacheBackingStore + 'static) -> Result<()> {
+        self.add_backing_store(store, Vec::<String>::new())
     }
 
+    /// Reads every store into a staged image and replaces the cache's view
+    /// only when all of them loaded, so a refused load admits nothing.
     pub fn pull_all_backing_stores(&mut self) -> Result<()> {
-        self.entries.clear();
+        let mut loaded = BTreeMap::new();
         let known_types: BTreeSet<String> = self.definitions.keys().cloned().collect();
-        for registration in &mut self.stores {
-            for entry in registration.store.pull_all()? {
-                if !known_types.contains(&entry.r#type) {
+        let schema_name_definitions = self.schema_name_definitions.clone();
+        for (index, registration) in self.stores.iter().enumerate() {
+            for mut entry in registration.store.pull_all()? {
+                let Some(canonical_type) = resolve_registered_type(
+                    &known_types,
+                    &schema_name_definitions,
+                    &entry.r#type,
+                ) else {
                     return Err(anyhow!(
                         "No schema is registered for persisted entry type {:?}",
                         entry.r#type
                     ));
+                };
+                let home = self.resolve_route_index(&canonical_type);
+                if home != Some(index) {
+                    return Err(anyhow!(
+                        "CultCache {:?} record {:?} was loaded from {}, but its home is {}",
+                        canonical_type,
+                        entry.key,
+                        self.describe_store(Some(index)),
+                        self.describe_store(home)
+                    ));
                 }
-                self.entries.insert(entry_id(&entry), entry);
+                entry.r#type = canonical_type;
+                loaded.insert(entry_id(&entry), entry);
             }
         }
+        self.entries = loaded;
         Ok(())
     }
 
+    /// Returns the exact envelopes in the currently loaded cache image.
+    /// Callers that need optimistic concurrency can validate typed documents
+    /// and capture CAS expectations from one coherent read.
+    pub fn snapshot_envelopes(&self) -> Vec<CultCacheEnvelope> {
+        self.entries.values().cloned().collect()
+    }
+
     pub fn get<T: DatabaseEntry>(&self, key: &str) -> Result<Option<T>> {
         self.require_entry_type::<T>()?;
         let Some(entry) = self.entries.get(&entry_id_parts(T::TYPE, key)) else {
@@ -374,7 +2110,57 @@ impl CultCache {
         Ok(values)
     }
 
+    pub fn get_all_with_keys<T: DatabaseEntry>(&self) -> Result<Vec<(String, T)>> {
+        self.require_entry_type::<T>()?;
+        let mut values = Vec::new();
+        for entry in self.entries.values() {
+            if entry.r#type != T::TYPE {
+                continue;
+            }
+            values.push((
+                entry.key.clone(),
+                rmp_serde::from_slice(&entry.payload).with_context(|| {
+                    format!(
+                        "failed to decode CultCache entry {:?} at key {:?} as {}",
+                        T::TYPE,
+                        entry.key,
+                        T::SCHEMA_NAME
+                    )
+                })?,
+            ));
+        }
+        Ok(values)
+    }
+
+    pub fn soa<T: SoaDocument>(&self) -> Result<CultSoaTable<T>> {
+        let keyed_rows = self.get_all_with_keys::<T>()?;
+        let (keys, documents): (Vec<_>, Vec<_>) = keyed_rows.into_iter().unzip();
+        let columns = T::soa_columns(&documents)
+            .into_iter()
+            .map(|(name, values)| (name.to_string(), values))
+            .collect();
+        Ok(CultSoaTable {
+            keys,
+            documents,
+            columns,
+            _document: PhantomData,
+        })
+    }
+
     pub fn put<T: DatabaseEntry>(&mut self, key: impl Into<String>, value: &T) -> Result<T> {
+        let (entry, parsed) = self.prepare_entry(key, value)?;
+        if let Some(home) = self.home_index(T::TYPE)? {
+            self.stores[home].store.push(&entry)?;
+        }
+        self.entries.insert(entry_id(&entry), entry);
+        Ok(parsed)
+    }
+
+    pub fn prepare_entry<T: DatabaseEntry>(
+        &self,
+        key: impl Into<String>,
+        value: &T,
+    ) -> Result<(CultCacheEnvelope, T)> {
         self.require_entry_type::<T>()?;
         let key = key.into();
         let payload = rmp_serde::to_vec(value).with_context(|| {
@@ -385,6 +2171,36 @@ impl CultCache {
                 T::SCHEMA_NAME
             )
         })?;
+        self.finish_prepared_entry::<T>(key, payload)
+    }
+
+    /// Prepares a typed entry while encoding ordinary nested structs as
+    /// MessagePack maps. DatabaseEntry itself remains the stable numeric-slot
+    /// tuple; named nested fields prevent serde's omitted optional fields from
+    /// shifting later values into the wrong positions.
+    pub fn prepare_entry_named<T: DatabaseEntry>(
+        &self,
+        key: impl Into<String>,
+        value: &T,
+    ) -> Result<(CultCacheEnvelope, T)> {
+        self.require_entry_type::<T>()?;
+        let key = key.into();
+        let payload = rmp_serde::to_vec_named(value).with_context(|| {
+            format!(
+                "failed to encode named CultCache entry {:?} at key {:?} as {}",
+                T::TYPE,
+                key,
+                T::SCHEMA_NAME
+            )
+        })?;
+        self.finish_prepared_entry::<T>(key, payload)
+    }
+
+    fn finish_prepared_entry<T: DatabaseEntry>(
+        &self,
+        key: String,
+        payload: Vec<u8>,
+    ) -> Result<(CultCacheEnvelope, T)> {
         let parsed: T = rmp_serde::from_slice(&payload).with_context(|| {
             format!(
                 "failed to validate CultCache entry {:?} at key {:?} as {}",
@@ -400,22 +2216,106 @@ impl CultCache {
             stored_at: now_utc_second(),
             schema_id: Some(T::TYPE.to_string()),
         };
-        let route = self.resolve_route_indices(T::TYPE);
-        let Some(primary_index) = route.first().copied() else {
-            return Err(anyhow!(
-                "No backing store is registered for entry type {:?}",
-                T::TYPE
-            ));
-        };
-        self.stores[primary_index].store.push(&entry)?;
-        for mirror_index in route.iter().skip(1).copied() {
-            self.stores[mirror_index].store.push(&entry)?;
+        Ok((entry, parsed))
+    }
+
+    pub fn put_prepared_batch(&mut self, staged: Vec<CultCacheEnvelope>) -> Result<()> {
+        if staged.is_empty() {
+            return Err(anyhow!("CultCache batch must contain at least one entry"));
+        }
+        // Validate every staged record before any store is touched.
+        let mut store_index = None;
+        for entry in &staged {
+            if !self.definitions.contains_key(&entry.r#type) {
+                return Err(anyhow!(
+                    "CultCache batch entry type {:?} is not registered",
+                    entry.r#type
+                ));
+            }
+            if entry.key.trim().is_empty() {
+                return Err(anyhow!(
+                    "CultCache envelope keys for type {:?} must be non-empty",
+                    entry.r#type
+                ));
+            }
+            if entry.stored_at.trim().is_empty() {
+                return Err(anyhow!(
+                    "CultCache envelope stored_at for type {:?} must be non-empty",
+                    entry.r#type
+                ));
+            }
+            let Some(home) = self.home_index(&entry.r#type)? else {
+                continue;
+            };
+            match store_index {
+                Some(expected) if expected != home => {
+                    return Err(anyhow!("CultCache atomic batch cannot span backing stores"));
+                }
+                None => store_index = Some(home),
+                _ => {}
+            }
+        }
+        let mut next = self.entries.clone();
+        for entry in &staged {
+            next.insert(entry_id(entry), entry.clone());
+        }
+        if let Some(store_index) = store_index {
+            // The home store receives its own records only: those it already
+            // holds in this cache plus the staged ones.
+            let snapshot: Vec<_> = next
+                .values()
+                .filter(|entry| self.resolve_route_index(&entry.r#type) == Some(store_index))
+                .cloned()
+                .collect();
+            self.stores[store_index]
+                .store
+                .push_all(&snapshot, PushAllOptions::default())?;
+        }
+        self.entries = next;
+        Ok(())
+    }
+
+    pub fn put_envelope<T: DatabaseEntry>(&mut self, entry: CultCacheEnvelope) -> Result<T> {
+        let parsed = self.validate_envelope::<T>(&entry)?;
+        if let Some(home) = self.home_index(T::TYPE)? {
+            self.stores[home].store.push(&entry)?;
         }
         self.entries.insert(entry_id(&entry), entry);
         Ok(parsed)
     }
 
-    pub fn put_envelope<T: DatabaseEntry>(&mut self, entry: CultCacheEnvelope) -> Result<T> {
+    /// Publishes an envelope for a registered dynamic document type without
+    /// claiming compile-time knowledge of its payload schema. This is the
+    /// CultMesh/schema-registry boundary: callers own payload validation before
+    /// admission; CultCache still enforces registered type, identity, timestamp,
+    /// routing, and persistence.
+    pub fn put_raw_envelope(&mut self, entry: CultCacheEnvelope) -> Result<()> {
+        if !self.definitions.contains_key(&entry.r#type) {
+            return Err(anyhow!(
+                "No entry type registered for CultCache envelope type {:?}",
+                entry.r#type
+            ));
+        }
+        if entry.key.trim().is_empty() {
+            return Err(anyhow!(
+                "CultCache envelope keys for type {:?} must be non-empty",
+                entry.r#type
+            ));
+        }
+        if entry.stored_at.trim().is_empty() {
+            return Err(anyhow!(
+                "CultCache envelope stored_at for type {:?} must be non-empty",
+                entry.r#type
+            ));
+        }
+        if let Some(home) = self.home_index(&entry.r#type)? {
+            self.stores[home].store.push(&entry)?;
+        }
+        self.entries.insert(entry_id(&entry), entry);
+        Ok(())
+    }
+
+    fn validate_envelope<T: DatabaseEntry>(&self, entry: &CultCacheEnvelope) -> Result<T> {
         self.require_entry_type::<T>()?;
         if entry.r#type != T::TYPE {
             return Err(anyhow!(
@@ -437,27 +2337,14 @@ impl CultCache {
             ));
         }
 
-        let parsed: T = rmp_serde::from_slice(&entry.payload).with_context(|| {
+        rmp_serde::from_slice(&entry.payload).with_context(|| {
             format!(
                 "failed to validate CultCache envelope {:?} at key {:?} as {}",
                 T::TYPE,
                 entry.key,
                 T::SCHEMA_NAME
             )
-        })?;
-        let route = self.resolve_route_indices(T::TYPE);
-        let Some(primary_index) = route.first().copied() else {
-            return Err(anyhow!(
-                "No backing store is registered for entry type {:?}",
-                T::TYPE
-            ));
-        };
-        self.stores[primary_index].store.push(&entry)?;
-        for mirror_index in route.iter().skip(1).copied() {
-            self.stores[mirror_index].store.push(&entry)?;
-        }
-        self.entries.insert(entry_id(&entry), entry);
-        Ok(parsed)
+        })
     }
 
     pub fn update<T, F>(&mut self, key: &str, updater: F) -> Result<T>
@@ -475,16 +2362,8 @@ impl CultCache {
         let Some(entry) = self.entries.get(&id).cloned() else {
             return Ok(false);
         };
-        let route = self.resolve_route_indices(T::TYPE);
-        let Some(primary_index) = route.first().copied() else {
-            return Err(anyhow!(
-                "No backing store is registered for entry type {:?}",
-                T::TYPE
-            ));
-        };
-        self.stores[primary_index].store.delete(&entry)?;
-        for mirror_index in route.iter().skip(1).copied() {
-            self.stores[mirror_index].store.delete(&entry)?;
+        if let Some(home) = self.home_index(T::TYPE)? {
+            self.stores[home].store.delete(&entry)?;
         }
         self.entries.remove(&id);
         Ok(true)
@@ -494,6 +2373,30 @@ impl CultCache {
         self.entries.values().cloned().collect()
     }
 
+    pub fn snapshot_soa(&self) -> CultCacheSoaTable {
+        CultCacheSoaTable::from_envelopes(self.snapshot())
+    }
+
+    /// Replaces the cache's view with the table's records. Every record is
+    /// checked (registered type, and a home store once any store is attached)
+    /// into a local image first, so a refused load admits nothing and leaves
+    /// the prior view intact. Loading writes no store.
+    pub fn load_soa(&mut self, table: CultCacheSoaTable) -> Result<()> {
+        let mut loaded = BTreeMap::new();
+        for entry in table.into_envelopes()? {
+            if !self.definitions.contains_key(&entry.r#type) {
+                return Err(anyhow!(
+                    "No schema is registered for SoA entry type {:?}",
+                    entry.r#type
+                ));
+            }
+            self.home_index(&entry.r#type)?;
+            loaded.insert(entry_id(&entry), entry);
+        }
+        self.entries = loaded;
+        Ok(())
+    }
+
     fn require_entry_type<T: DatabaseEntry>(&self) -> Result<()> {
         match self.definitions.get(T::TYPE) {
             Some(schema_name) if *schema_name == T::SCHEMA_NAME => Ok(()),
@@ -504,23 +2407,39 @@ impl CultCache {
         }
     }
 
-    fn resolve_route_indices(&self, type_id: &str) -> Vec<usize> {
-        let type_specific: Vec<usize> = self
-            .stores
-            .iter()
-            .enumerate()
-            .filter_map(|(index, registration)| {
-                registration.types.contains(type_id).then_some(index)
-            })
-            .collect();
-        if !type_specific.is_empty() {
-            return type_specific;
-        }
+    /// The store that claims the type, else the generic store. Registration
+    /// guarantees at most one of each.
+    fn resolve_route_index(&self, type_id: &str) -> Option<usize> {
         self.stores
             .iter()
-            .enumerate()
-            .filter_map(|(index, registration)| registration.types.is_empty().then_some(index))
-            .collect()
+            .position(|registration| registration.types.contains(type_id))
+            .or_else(|| {
+                self.stores
+                    .iter()
+                    .position(|registration| registration.types.is_empty())
+            })
+    }
+
+    /// `None` for a cache with no stores, which is in memory. Once any store
+    /// is attached, a type with no home store is an error.
+    fn home_index(&self, type_id: &str) -> Result<Option<usize>> {
+        if self.stores.is_empty() {
+            return Ok(None);
+        }
+        self.resolve_route_index(type_id)
+            .map(Some)
+            .ok_or_else(|| anyhow!("No backing store is registered for entry type {:?}", type_id))
+    }
+
+    fn describe_store(&self, index: Option<usize>) -> String {
+        match index {
+            None => "memory".to_string(),
+            Some(index) if self.stores[index].types.is_empty() => "the generic store".to_string(),
+            Some(index) => format!(
+                "the store routed to {:?}",
+                self.stores[index].types.iter().collect::<Vec<_>>()
+            ),
+        }
     }
 }
 
@@ -530,35 +2449,40 @@ impl Default for CultCache {
     }
 }
 
-fn entry_id(entry: &CultCacheEnvelope) -> String {
+fn entry_id(entry: &CultCacheEnvelope) -> (String, String) {
     entry_id_parts(&entry.r#type, &entry.key)
 }
 
-fn entry_id_parts(r#type: &str, key: &str) -> String {
-    format!("{type}::{key}", type = r#type)
+fn entry_id_parts(r#type: &str, key: &str) -> (String, String) {
+    (r#type.to_string(), key.to_string())
 }
 
 fn now_utc_second() -> String {
     chrono::Utc::now().to_rfc3339_opts(chrono::SecondsFormat::Secs, true)
 }
 
-fn encode_store_snapshot(entries: &[CultCacheEnvelope]) -> PersistedStoreSnapshot {
-    let mut schema_names = BTreeSet::<String>::new();
+fn encode_store_snapshot(entries: &[CultCacheEnvelope]) -> Result<PersistedStoreSnapshot> {
+    let mut schema_types = BTreeMap::<String, String>::new();
     for entry in entries {
-        schema_names.insert(
-            entry
-                .schema_id
-                .clone()
-                .unwrap_or_else(|| entry.r#type.clone()),
-        );
+        let schema_id = entry
+            .schema_id
+            .clone()
+            .unwrap_or_else(|| entry.r#type.clone());
+        if let Some(existing_type) = schema_types.insert(schema_id.clone(), entry.r#type.clone()) {
+            ensure!(
+                existing_type == entry.r#type,
+                "CultCache schema {schema_id:?} cannot identify both {existing_type:?} and {:?}",
+                entry.r#type
+            );
+        }
     }
 
-    let catalog = schema_names
+    let catalog = schema_types
         .into_iter()
-        .map(|schema_id| {
+        .map(|(schema_id, document_type)| {
             PersistedSchemaCatalogEntry(
                 schema_id.clone(),
-                schema_id.clone(),
+                document_type,
                 format!("{schema_id}.v1"),
                 schema_id.clone(),
                 format!(
@@ -586,7 +2510,11 @@ fn encode_store_snapshot(entries: &[CultCacheEnvelope]) -> PersistedStoreSnapsho
         })
         .collect();
 
-    PersistedStoreSnapshot("cultcache.store.v1".to_string(), catalog, records)
+    Ok(PersistedStoreSnapshot(
+        "cultcache.store.v1".to_string(),
+        catalog,
+        records,
+    ))
 }
 
 fn decode_store_snapshot(bytes: &[u8]) -> Result<Vec<CultCacheEnvelope>> {
@@ -605,13 +2533,32 @@ fn decode_store_snapshot(bytes: &[u8]) -> Result<Vec<CultCacheEnvelope>> {
         .2
         .into_iter()
         .map(|record| {
-            let r#type = catalog.get(&record.1).cloned().ok_or_else(|| {
-                anyhow!(
-                    "CultCache record {:?} references missing schema {:?}",
-                    record.0,
-                    record.1
-                )
-            })?;
+            let r#type = match catalog.get(&record.1) {
+                Some(schema_name) => schema_name.clone(),
+                None => {
+                    // A record can outlive its catalog entry when another runtime
+                    // wrote it, or when the record is older than the catalog it
+                    // was stamped against. The payload is a MessagePack array
+                    // whose first field is the schema version, so the type can be
+                    // recovered from the record itself rather than failing the
+                    // whole snapshot.
+                    let schema_version =
+                        infer_schema_version_from_payload(&record.3).ok_or_else(|| {
+                            anyhow!(
+                                "CultCache record {:?} references missing schema {:?}",
+                                record.0,
+                                record.1
+                            )
+                        })?;
+                    infer_schema_name(&schema_version).ok_or_else(|| {
+                        anyhow!(
+                            "CultCache record {:?} references missing schema {:?}",
+                            record.0,
+                            record.1
+                        )
+                    })?
+                }
+            };
             Ok(CultCacheEnvelope {
                 key: record.0,
                 r#type,
@@ -623,6 +2570,83 @@ fn decode_store_snapshot(bytes: &[u8]) -> Result<Vec<CultCacheEnvelope>> {
         .collect()
 }
 
+/// A record recovered from its payload carries a schema name, while the
+/// registry is keyed by entry type. Accept either, so a snapshot whose catalog
+/// entry is gone still resolves to the registered definition.
+fn resolve_registered_type(
+    known_types: &BTreeSet<String>,
+    schema_name_definitions: &BTreeMap<String, String>,
+    persisted_type: &str,
+) -> Option<String> {
+    if known_types.contains(persisted_type) {
+        return Some(persisted_type.to_string());
+    }
+
+    schema_name_definitions.get(persisted_type).cloned()
+}
+
+fn infer_schema_version_from_payload(payload: &[u8]) -> Option<String> {
+    let mut offset = 0usize;
+    read_array_header(payload, &mut offset)?;
+    read_string(payload, &mut offset)
+}
+
+fn read_array_header(payload: &[u8], offset: &mut usize) -> Option<u32> {
+    let marker = *payload.get(*offset)?;
+    *offset += 1;
+    match marker {
+        0x90..=0x9f => Some((marker & 0x0f) as u32),
+        0xdc => {
+            let bytes = payload.get(*offset..(*offset + 2))?;
+            *offset += 2;
+            Some(u16::from_be_bytes([bytes[0], bytes[1]]) as u32)
+        }
+        0xdd => {
+            let bytes = payload.get(*offset..(*offset + 4))?;
+            *offset += 4;
+            Some(u32::from_be_bytes([bytes[0], bytes[1], bytes[2], bytes[3]]))
+        }
+        _ => None,
+    }
+}
+
+fn read_string(payload: &[u8], offset: &mut usize) -> Option<String> {
+    let marker = *payload.get(*offset)?;
+    *offset += 1;
+    let length = match marker {
+        0xa0..=0xbf => (marker & 0x1f) as usize,
+        0xd9 => {
+            let length = *payload.get(*offset)? as usize;
+            *offset += 1;
+            length
+        }
+        0xda => {
+            let bytes = payload.get(*offset..(*offset + 2))?;
+            *offset += 2;
+            u16::from_be_bytes([bytes[0], bytes[1]]) as usize
+        }
+        0xdb => {
+            let bytes = payload.get(*offset..(*offset + 4))?;
+            *offset += 4;
+            u32::from_be_bytes([bytes[0], bytes[1], bytes[2], bytes[3]]) as usize
+        }
+        _ => return None,
+    };
+
+    let bytes = payload.get(*offset..(*offset + length))?;
+    std::str::from_utf8(bytes).ok().map(str::to_string)
+}
+
+fn infer_schema_name(schema_version: &str) -> Option<String> {
+    let marker = schema_version.rfind(".v")?;
+    let version = schema_version.get((marker + 2)..)?;
+    if marker == 0 || version.is_empty() || !version.bytes().all(|value| value.is_ascii_digit()) {
+        return None;
+    }
+
+    Some(schema_version[..marker].to_string())
+}
+
 fn escape_json_string(value: &str) -> String {
     value.replace('\\', "\\\\").replace('"', "\\\"")
 }
@@ -631,15 +2655,200 @@ fn temporary_path_for(path: &Path) -> PathBuf {
     let mut file_name = path
         .file_name()
         .map(|value| value.to_os_string())
-        .unwrap_or_else(|| "cultcache.msgpack".into());
+        .unwrap_or_else(|| "cultcache.cc".into());
     file_name.push(format!(".{}.tmp", uuid::Uuid::new_v4()));
     path.with_file_name(file_name)
 }
 
+fn remove_abandoned_staging_files(destination: &Path) -> Result<()> {
+    let Some(parent) = destination.parent() else {
+        return Ok(());
+    };
+    let Some(destination_name) = destination.file_name().and_then(|value| value.to_str()) else {
+        return Ok(());
+    };
+    let prefix = format!("{destination_name}.");
+    for entry in fs::read_dir(parent).with_context(|| {
+        format!(
+            "failed to inspect {} for abandoned staging files",
+            parent.display()
+        )
+    })? {
+        let entry = entry?;
+        let Some(name) = entry.file_name().to_str().map(str::to_owned) else {
+            continue;
+        };
+        let Some(candidate) = name
+            .strip_prefix(&prefix)
+            .and_then(|value| value.strip_suffix(".tmp"))
+        else {
+            continue;
+        };
+        if uuid::Uuid::parse_str(candidate).is_err() || !entry.file_type()?.is_file() {
+            continue;
+        }
+        fs::remove_file(entry.path()).with_context(|| {
+            format!(
+                "failed to remove abandoned staging file {}",
+                entry.path().display()
+            )
+        })?;
+    }
+    Ok(())
+}
+
+#[cfg(unix)]
+fn replace_file_atomically(staged: &Path, destination: &Path) -> Result<()> {
+    fs::rename(staged, destination).with_context(|| {
+        format!(
+            "failed to atomically replace {} with {}",
+            destination.display(),
+            staged.display()
+        )
+    })
+}
+
+#[cfg(windows)]
+fn replace_file_atomically(staged: &Path, destination: &Path) -> Result<()> {
+    use std::os::windows::ffi::OsStrExt;
+    use windows_sys::Win32::Storage::FileSystem::{
+        MOVEFILE_REPLACE_EXISTING, MOVEFILE_WRITE_THROUGH, MoveFileExW,
+    };
+
+    let staged_wide = staged
+        .as_os_str()
+        .encode_wide()
+        .chain(std::iter::once(0))
+        .collect::<Vec<_>>();
+    let destination_wide = destination
+        .as_os_str()
+        .encode_wide()
+        .chain(std::iter::once(0))
+        .collect::<Vec<_>>();
+    // A concurrent reader of the destination (another process opening the
+    // store, an indexer, an antivirus scan) makes the replace fail with a
+    // sharing or access error for as long as it holds the handle. That is
+    // transient by construction; a daemon that treats it as fatal dies on
+    // the first overlap (Muninn serve did, 2026-09-11). Retry briefly.
+    const ERROR_ACCESS_DENIED: i32 = 5;
+    const ERROR_SHARING_VIOLATION: i32 = 32;
+    const ERROR_LOCK_VIOLATION: i32 = 33;
+    const ATTEMPTS: u32 = 25;
+    const BACKOFF: std::time::Duration = std::time::Duration::from_millis(20);
+    let mut attempt = 0;
+    loop {
+        let success = unsafe {
+            MoveFileExW(
+                staged_wide.as_ptr(),
+                destination_wide.as_ptr(),
+                MOVEFILE_REPLACE_EXISTING | MOVEFILE_WRITE_THROUGH,
+            )
+        };
+        if success != 0 {
+            return Ok(());
+        }
+        let error = std::io::Error::last_os_error();
+        attempt += 1;
+        let transient = matches!(
+            error.raw_os_error(),
+            Some(ERROR_ACCESS_DENIED | ERROR_SHARING_VIOLATION | ERROR_LOCK_VIOLATION)
+        );
+        if !transient || attempt >= ATTEMPTS {
+            return Err(error).with_context(|| {
+                format!(
+                    "failed to atomically replace {} with {} after {attempt} attempt(s)",
+                    destination.display(),
+                    staged.display()
+                )
+            });
+        }
+        std::thread::sleep(BACKOFF);
+    }
+}
+
+#[cfg(all(test, windows))]
+mod windows_replace_tests {
+    use super::replace_file_atomically;
+    use std::os::windows::fs::OpenOptionsExt;
+
+    /// A reader holding the destination open with no sharing makes the
+    /// replace fail for as long as it holds on; it must succeed once the
+    /// reader lets go, not report the first refusal as the outcome.
+    #[test]
+    fn a_replace_waits_out_a_reader_that_holds_the_destination() {
+        let dir = std::env::temp_dir().join(format!("cultcache-replace-{}", std::process::id()));
+        std::fs::create_dir_all(&dir).unwrap();
+        let destination = dir.join("store.cc");
+        let staged = dir.join("store.cc.tmp");
+        std::fs::write(&destination, b"old").unwrap();
+        std::fs::write(&staged, b"new").unwrap();
+        let held = std::fs::OpenOptions::new()
+            .read(true)
+            .share_mode(0)
+            .open(&destination)
+            .unwrap();
+        let releaser = std::thread::spawn(move || {
+            std::thread::sleep(std::time::Duration::from_millis(120));
+            drop(held);
+        });
+        replace_file_atomically(&staged, &destination).expect("the replace outlasts the reader");
+        releaser.join().unwrap();
+        assert_eq!(std::fs::read(&destination).unwrap(), b"new");
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+}
+
+#[cfg(unix)]
+fn sync_parent_directory(path: &Path) -> Result<()> {
+    let Some(parent) = path.parent() else {
+        return Ok(());
+    };
+    File::open(parent)
+        .and_then(|directory| directory.sync_all())
+        .with_context(|| format!("failed to sync {}", parent.display()))
+}
+
+#[cfg(windows)]
+fn sync_parent_directory(_path: &Path) -> Result<()> {
+    // MoveFileExW with MOVEFILE_WRITE_THROUGH owns publication durability.
+    Ok(())
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
     use pretty_assertions::assert_eq;
+    use std::sync::Arc;
+    use std::sync::atomic::{AtomicBool, Ordering};
+    use std::sync::mpsc;
+    use std::time::Duration;
+
+    struct RefusingBatchStore {
+        inner: SingleFileMessagePackBackingStore,
+        refuse_batch: Arc<AtomicBool>,
+    }
+
+    impl CacheBackingStore for RefusingBatchStore {
+        fn pull_all(&self) -> Result<Vec<CultCacheEnvelope>> {
+            self.inner.pull_all()
+        }
+        fn push(&mut self, entry: &CultCacheEnvelope) -> Result<()> {
+            self.inner.push(entry)
+        }
+        fn delete(&mut self, entry: &CultCacheEnvelope) -> Result<()> {
+            self.inner.delete(entry)
+        }
+        fn push_all(
+            &mut self,
+            entries: &[CultCacheEnvelope],
+            options: PushAllOptions,
+        ) -> Result<()> {
+            if self.refuse_batch.load(Ordering::SeqCst) {
+                return Err(anyhow!("injected batch refusal"));
+            }
+            self.inner.push_all(entries, options)
+        }
+    }
 
     #[derive(Clone, Debug, PartialEq, Eq, DatabaseEntry)]
     #[cultcache(type = "settings")]
@@ -659,12 +2868,123 @@ mod tests {
         body: String,
     }
 
+    #[derive(Clone, Debug, PartialEq, Eq, DatabaseEntry)]
+    #[cultcache(type = "binary-record")]
+    struct BinaryRecord {
+        #[cultcache(key = 0, bytes)]
+        required: Vec<u8>,
+        #[cultcache(key = 1, bytes, default)]
+        optional: Vec<u8>,
+    }
+
+    #[derive(Clone, Debug, PartialEq, Eq, serde::Serialize, serde::Deserialize)]
+    struct NestedOptionalValue {
+        label: String,
+        #[serde(default, skip_serializing_if = "Option::is_none")]
+        count: Option<u32>,
+        #[serde(default, skip_serializing_if = "Option::is_none")]
+        symbol: Option<String>,
+    }
+
+    #[derive(Clone, Debug, PartialEq, Eq, DatabaseEntry)]
+    #[cultcache(type = "runtime-policy", schema = "tests.schema_stamped_entry")]
+    struct SchemaStamped {
+        #[cultcache(key = 0)]
+        schema_version: String,
+        #[cultcache(key = 1)]
+        name: String,
+        #[cultcache(key = 2)]
+        value: String,
+    }
+
+    #[derive(Clone, Debug, PartialEq, Eq, DatabaseEntry)]
+    #[cultcache(type = "nested-note")]
+    struct NestedNote {
+        #[cultcache(key = 0)]
+        value: NestedOptionalValue,
+    }
+
+    cultcache_soa!(Settings {
+        "theme" => |row: &Settings| row.theme.clone(),
+        "retries" => |row: &Settings| row.retries,
+    });
+
     cultcache_registry!(TestEntries { Settings, Note });
 
+    #[test]
+    fn captured_snapshot_cannot_outlive_a_shared_consequence_gate() -> Result<()> {
+        let temp = tempfile::tempdir()?;
+        let store_path = temp.path().join("authority.cc");
+        let mut store = SingleFileMessagePackBackingStore::new(&store_path);
+        let released = CultCacheEnvelope {
+            key: "brake".into(),
+            r#type: "brake".into(),
+            payload: b"released".to_vec(),
+            stored_at: "2026-07-20T00:00:00Z".into(),
+            schema_id: Some("brake".into()),
+        };
+        store.push(&released)?;
+
+        let writer_path = store_path.clone();
+        let (started_tx, started_rx) = mpsc::channel();
+        let (finished_tx, finished_rx) = mpsc::channel();
+        store.with_read_only_shared_snapshot(|captured| {
+            assert_eq!(captured, vec![released.clone()]);
+            std::thread::spawn(move || {
+                started_tx.send(()).unwrap();
+                let engaged = CultCacheEnvelope {
+                    payload: b"engaged".to_vec(),
+                    ..released
+                };
+                let mut writer = SingleFileMessagePackBackingStore::new(writer_path);
+                writer.push(&engaged).unwrap();
+                finished_tx.send(()).unwrap();
+            });
+            started_rx.recv_timeout(Duration::from_secs(1))?;
+            assert!(
+                finished_rx
+                    .recv_timeout(Duration::from_millis(100))
+                    .is_err()
+            );
+            Ok(())
+        })?;
+        finished_rx.recv_timeout(Duration::from_secs(1))?;
+        assert_eq!(store.pull_all()?[0].payload, b"engaged");
+        Ok(())
+    }
+
+    #[test]
+    fn post_action_unlock_failure_is_diagnostic_not_action_result() -> Result<()> {
+        let temp = tempfile::tempdir()?;
+        let store_path = temp.path().join("authority.cc");
+        let mut store = SingleFileMessagePackBackingStore::new(&store_path);
+        store.push(&CultCacheEnvelope {
+            key: "brake".into(),
+            r#type: "brake".into(),
+            payload: b"released".to_vec(),
+            stored_at: "2026-07-20T00:00:00Z".into(),
+            schema_id: Some("brake".into()),
+        })?;
+
+        let mut diagnostic = None;
+        let result = store.with_read_only_shared_snapshot_using(
+            |_| Ok(42),
+            |_| Err(anyhow!("injected post-action unlock failure")),
+            |error| diagnostic = Some(error.to_string()),
+        );
+
+        assert_eq!(result?, 42);
+        assert_eq!(
+            diagnostic.as_deref(),
+            Some("injected post-action unlock failure")
+        );
+        Ok(())
+    }
+
     #[test]
     fn familiar_cultcache_flow_persists_and_reloads_typed_documents() -> Result<()> {
         let temp = tempfile::tempdir()?;
-        let store_path = temp.path().join("cache.msgpack");
+        let store_path = temp.path().join("cache.cc");
         let settings = Settings {
             theme: "ash".to_string(),
             retries: 3,
@@ -672,14 +2992,14 @@ mod tests {
 
         let mut cache = CultCache::new();
         cache.register_entry_type::<Settings>()?;
-        cache.add_generic_backing_store(SingleFileMessagePackBackingStore::new(&store_path));
+        cache.add_generic_backing_store(SingleFileMessagePackBackingStore::new(&store_path))?;
         cache.pull_all_backing_stores()?;
         cache.put("app", &settings)?;
         assert_eq!(cache.get_required::<Settings>("app")?, settings);
 
         let mut reloaded = CultCache::new();
         reloaded.register_entry_type::<Settings>()?;
-        reloaded.add_generic_backing_store(SingleFileMessagePackBackingStore::new(&store_path));
+        reloaded.add_generic_backing_store(SingleFileMessagePackBackingStore::new(&store_path))?;
         reloaded.pull_all_backing_stores()?;
         assert_eq!(reloaded.get_required::<Settings>("app")?, settings);
         Ok(())
@@ -688,10 +3008,10 @@ mod tests {
     #[test]
     fn entry_identity_is_polymorphic_by_type_and_key() -> Result<()> {
         let temp = tempfile::tempdir()?;
-        let store_path = temp.path().join("cache.msgpack");
+        let store_path = temp.path().join("cache.cc");
         let mut cache = CultCache::new();
         cache.register_registry(TestEntries)?;
-        cache.add_generic_backing_store(SingleFileMessagePackBackingStore::new(&store_path));
+        cache.add_generic_backing_store(SingleFileMessagePackBackingStore::new(&store_path))?;
 
         cache.put(
             "shared",
@@ -714,19 +3034,759 @@ mod tests {
         Ok(())
     }
 
+    #[test]
+    fn prepared_batch_publishes_heterogeneous_entries_in_one_snapshot() -> Result<()> {
+        let temp = tempfile::tempdir()?;
+        let store_path = temp.path().join("batch.cc");
+        let mut cache = CultCache::new();
+        cache.register_registry(TestEntries)?;
+        cache.add_generic_backing_store(SingleFileMessagePackBackingStore::new(&store_path))?;
+
+        let (settings, _) = cache.prepare_entry(
+            "app",
+            &Settings {
+                theme: "iron".to_string(),
+                retries: 4,
+            },
+        )?;
+        let (note, _) = cache.prepare_entry(
+            "receipt",
+            &Note {
+                title: "committed".to_string(),
+                body: "same snapshot".to_string(),
+            },
+        )?;
+        cache.put_prepared_batch(vec![settings, note])?;
+
+        let mut reloaded = CultCache::new();
+        reloaded.register_registry(TestEntries)?;
+        reloaded.add_generic_backing_store(SingleFileMessagePackBackingStore::new(&store_path))?;
+        reloaded.pull_all_backing_stores()?;
+        assert_eq!(reloaded.get_required::<Settings>("app")?.theme, "iron");
+        assert_eq!(reloaded.get_required::<Note>("receipt")?.title, "committed");
+        Ok(())
+    }
+
+    #[test]
+    fn named_preparation_preserves_omitted_nested_optional_slots() -> Result<()> {
+        let temp = tempfile::tempdir()?;
+        let store_path = temp.path().join("named.cc");
+        let mut cache = CultCache::new();
+        cache.register_entry_type::<NestedNote>()?;
+        cache.add_generic_backing_store(SingleFileMessagePackBackingStore::new(&store_path))?;
+        cache.pull_all_backing_stores()?;
+        let note = NestedNote {
+            value: NestedOptionalValue {
+                label: "nested".into(),
+                count: None,
+                symbol: Some("kept-in-its-own-field".into()),
+            },
+        };
+        assert!(cache.prepare_entry("compact", &note).is_err());
+        let (entry, parsed) = cache.prepare_entry_named("named", &note)?;
+        assert_eq!(parsed, note);
+        cache.put_prepared_batch(vec![entry])?;
+        assert_eq!(cache.get_required::<NestedNote>("named")?, note);
+        Ok(())
+    }
+
+    #[test]
+    fn pulling_an_absent_store_does_not_create_its_parent_or_lock() -> Result<()> {
+        let temp = tempfile::tempdir()?;
+        let missing_parent = temp.path().join("missing-body");
+        let store_path = missing_parent.join("cache.cc");
+        let store = SingleFileMessagePackBackingStore::new(&store_path);
+
+        assert!(store.pull_all()?.is_empty());
+        assert!(!missing_parent.exists());
+        assert!(!store_path.with_file_name("cache.cc.lock").exists());
+        Ok(())
+    }
+
+    #[test]
+    fn provider_snapshot_read_does_not_create_or_open_a_lock() -> Result<()> {
+        let temp = tempfile::tempdir()?;
+        let store_path = temp.path().join("provider.cc");
+        let lock_path = temp.path().join("provider.cc.lock");
+        let mut store = SingleFileMessagePackBackingStore::new(&store_path);
+        let expected = test_envelope("provider.delivery", "one", b"payload");
+        store.push(&expected)?;
+        std::fs::remove_file(&lock_path)?;
+
+        assert_eq!(store.pull_all_read_only_snapshot()?, vec![expected]);
+        assert!(!lock_path.exists());
+        Ok(())
+    }
+
+    #[test]
+    fn next_exclusive_write_removes_only_exact_abandoned_staging_files() -> Result<()> {
+        let temp = tempfile::tempdir()?;
+        let store_path = temp.path().join("cache.cc");
+        let abandoned = temporary_path_for(&store_path);
+        let unknown = temp.path().join("cache.cc.not-a-uuid.tmp");
+        let foreign = temp
+            .path()
+            .join("other.cc.00000000-0000-0000-0000-000000000000.tmp");
+        fs::write(&abandoned, b"partial staging bytes")?;
+        fs::write(&unknown, b"operator-owned unknown file")?;
+        fs::write(&foreign, b"foreign store staging")?;
+
+        let mut store = SingleFileMessagePackBackingStore::new(&store_path);
+        let expected = test_envelope("model", "current", b"one");
+        store.push(&expected)?;
+
+        assert!(!abandoned.exists());
+        assert_eq!(fs::read(&unknown)?, b"operator-owned unknown file");
+        assert_eq!(fs::read(&foreign)?, b"foreign store staging");
+        assert_eq!(store.pull_all()?, vec![expected]);
+        Ok(())
+    }
+
+    #[test]
+    fn failed_snapshot_publication_preserves_the_committed_destination() -> Result<()> {
+        let temp = tempfile::tempdir()?;
+        let destination = temp.path().join("cache.cc");
+        let absent_staging = temp.path().join("absent.tmp");
+        let committed = b"committed snapshot";
+        fs::write(&destination, committed)?;
+
+        assert!(replace_file_atomically(&absent_staging, &destination).is_err());
+        assert_eq!(fs::read(&destination)?, committed);
+        Ok(())
+    }
+
+    #[test]
+    fn snapshot_publication_atomically_replaces_an_existing_destination() -> Result<()> {
+        let temp = tempfile::tempdir()?;
+        let destination = temp.path().join("cache.cc");
+        let staged = temp.path().join("cache.cc.staged");
+        fs::write(&destination, b"old snapshot")?;
+        fs::write(&staged, b"new snapshot")?;
+
+        replace_file_atomically(&staged, &destination)?;
+
+        assert_eq!(fs::read(&destination)?, b"new snapshot");
+        assert!(!staged.exists());
+        Ok(())
+    }
+
+    #[test]
+    #[ignore = "operator SIGKILL probe; requires CULTCACHE_INTERRUPTION_STORE"]
+    fn snapshot_publication_interruption_probe_writer() -> Result<()> {
+        let store_path = std::env::var_os("CULTCACHE_INTERRUPTION_STORE")
+            .map(PathBuf::from)
+            .ok_or_else(|| anyhow!("CULTCACHE_INTERRUPTION_STORE is required"))?;
+        let marker_path = std::env::var_os("CULTCACHE_INTERRUPTION_MARKER")
+            .map(PathBuf::from)
+            .ok_or_else(|| anyhow!("CULTCACHE_INTERRUPTION_MARKER is required"))?;
+        let mut store = SingleFileMessagePackBackingStore::new(store_path);
+        for sequence in 0_u64.. {
+            store.push(&test_envelope(
+                "interruption.probe",
+                "current",
+                &rmp_serde::to_vec(&sequence)?,
+            ))?;
+            fs::write(&marker_path, sequence.to_string())?;
+        }
+        unreachable!("the interruption writer is stopped by the operator")
+    }
+
+    #[test]
+    #[ignore = "operator SIGKILL probe; requires CULTCACHE_INTERRUPTION_STORE"]
+    fn snapshot_publication_interruption_probe_reader() -> Result<()> {
+        let store_path = std::env::var_os("CULTCACHE_INTERRUPTION_STORE")
+            .map(PathBuf::from)
+            .ok_or_else(|| anyhow!("CULTCACHE_INTERRUPTION_STORE is required"))?;
+        let rows = SingleFileMessagePackBackingStore::new(store_path).pull_all()?;
+        assert_eq!(rows.len(), 1);
+        assert_eq!(rows[0].r#type, "interruption.probe");
+        assert_eq!(rows[0].key, "current");
+        let _: u64 = rmp_serde::from_slice(&rows[0].payload)?;
+        Ok(())
+    }
+
+    fn test_envelope(r#type: &str, key: &str, payload: &[u8]) -> CultCacheEnvelope {
+        CultCacheEnvelope {
+            key: key.to_string(),
+            r#type: r#type.to_string(),
+            payload: payload.to_vec(),
+            stored_at: "2026-07-13T00:00:00Z".to_string(),
+            schema_id: Some(r#type.to_string()),
+        }
+    }
+
+    #[test]
+    fn redb_store_crud_and_reopen_preserve_polymorphic_rows() -> Result<()> {
+        let temp = tempfile::tempdir()?;
+        let path = temp.path().join("keyed.cc");
+        let model = test_envelope("model", "shared", b"one");
+        let receipt = test_envelope("receipt", "shared", b"two");
+        {
+            let mut store = RedbMessagePackBackingStore::new(&path)?;
+            store.push(&model)?;
+            store.push(&receipt)?;
+            assert_eq!(store.pull_all()?.len(), 2);
+            store.delete(&receipt)?;
+        }
+        let reopened = RedbMessagePackBackingStore::new(&path)?;
+        assert_eq!(reopened.pull_all()?, vec![model]);
+        Ok(())
+    }
+
+    #[test]
+    fn redb_exact_cas_refuses_stale_value_without_mutation() -> Result<()> {
+        let temp = tempfile::tempdir()?;
+        let mut store = RedbMessagePackBackingStore::new(temp.path().join("cas.cc"))?;
+        let current = test_envelope("model", "current", b"one");
+        store.push(&current)?;
+        let stale = test_envelope("model", "current", b"stale");
+        let replacement = test_envelope("model", "current", b"two");
+        assert!(!store.compare_and_swap_entry(&stale, replacement.clone())?);
+        assert_eq!(store.pull_all()?, vec![current.clone()]);
+        assert!(store.compare_and_swap_entry(&current, replacement.clone())?);
+        assert_eq!(store.pull_all()?, vec![replacement]);
+        Ok(())
+    }
+
+    #[test]
+    fn redb_batch_is_atomic_and_stale_member_refuses_every_write() -> Result<()> {
+        let temp = tempfile::tempdir()?;
+        let mut store = RedbMessagePackBackingStore::new(temp.path().join("batch.cc"))?;
+        let first = test_envelope("model", "first", b"one");
+        let second = test_envelope("model", "second", b"one");
+        store.push(&first)?;
+        store.push(&second)?;
+        let stale_second = test_envelope("model", "second", b"stale");
+        let first_two = test_envelope("model", "first", b"two");
+        let second_two = test_envelope("model", "second", b"two");
+        let receipt = test_envelope("receipt", "batch", b"committed");
+        assert!(!store.compare_and_swap_batch(
+            &[first.clone(), stale_second],
+            vec![first_two.clone(), second_two.clone(), receipt.clone()],
+        )?);
+        assert_eq!(store.pull_all()?, vec![first.clone(), second.clone()]);
+        assert!(store.compare_and_swap_batch(
+            &[first, second],
+            vec![first_two.clone(), second_two.clone(), receipt.clone()],
+        )?);
+        assert_eq!(store.pull_all()?, vec![first_two, second_two, receipt]);
+        Ok(())
+    }
+
+    #[test]
+    fn redb_compaction_refuses_stale_snapshot_and_atomically_replaces_and_deletes() -> Result<()> {
+        let temp = tempfile::tempdir()?;
+        let mut store = RedbMessagePackBackingStore::new(temp.path().join("compact.cc"))?;
+        let old_head = test_envelope("retention", "current", b"one");
+        let retired = test_envelope("receipt", "old", b"terminal");
+        store.push(&old_head)?;
+        store.push(&retired)?;
+        let stale = store.pull_all()?;
+        let concurrent = test_envelope("receipt", "running", b"active");
+        assert!(store.insert_entry_if_absent(concurrent.clone())?);
+        let new_head = test_envelope("retention", "current", b"two");
+        assert!(!store.replace_and_delete_if_snapshot_unchanged(
+            &stale,
+            vec![new_head.clone()],
+            std::slice::from_ref(&retired),
+        )?);
+        assert!(store.pull_all()?.contains(&retired));
+        let exact = store.pull_all()?;
+        assert!(store.replace_and_delete_if_snapshot_unchanged(
+            &exact,
+            vec![new_head.clone()],
+            &[retired],
+        )?);
+        assert_eq!(store.pull_all()?, vec![concurrent, new_head]);
+        Ok(())
+    }
+
+    #[test]
+    fn redb_entry_cas_does_not_depend_on_unrelated_snapshot_changes() -> Result<()> {
+        let temp = tempfile::tempdir()?;
+        let store = RedbMessagePackBackingStore::new(temp.path().join("independent.cc"))?;
+        let current = test_envelope("model", "current", b"one");
+        assert!(store.insert_entry_if_absent(current.clone())?);
+        let unrelated = test_envelope("event", "later", b"noise");
+        assert!(store.insert_entry_if_absent(unrelated.clone())?);
+        let replacement = test_envelope("model", "current", b"two");
+        assert!(store.compare_and_swap_entry(&current, replacement.clone())?);
+        assert_eq!(store.pull_all()?, vec![unrelated, replacement]);
+        Ok(())
+    }
+
+    #[test]
+    fn redb_fresh_handles_share_one_database_for_the_same_cultcache_path() -> Result<()> {
+        let temp = tempfile::tempdir()?;
+        let path = temp.path().join("shared.cc");
+        let mut first = RedbMessagePackBackingStore::new(&path)?;
+        let second = RedbMessagePackBackingStore::new(&path)?;
+        let initial = test_envelope("model", "current", b"one");
+        first.push(&initial)?;
+        assert_eq!(second.pull_all()?, vec![initial.clone()]);
+        let replacement = test_envelope("model", "current", b"two");
+        assert!(second.compare_and_swap_entry(&initial, replacement.clone())?);
+        assert_eq!(first.pull_all()?, vec![replacement]);
+        Ok(())
+    }
+
+    #[test]
+    fn owned_redb_clones_share_authority_and_fresh_owner_is_refused() -> Result<()> {
+        let temp = tempfile::tempdir()?;
+        let path = temp.path().join("owned.cc");
+        let owner = OwnedRedbMessagePackBackingStore::new(&path)?;
+        let clone = owner.clone();
+        assert_eq!(owner.file_identity(), clone.file_identity());
+        assert!(OwnedRedbMessagePackBackingStore::new(&path).is_err());
+        drop(owner);
+        assert!(OwnedRedbMessagePackBackingStore::new(&path).is_err());
+        drop(clone);
+        assert!(OwnedRedbMessagePackBackingStore::new(&path).is_ok());
+        Ok(())
+    }
+
+    #[test]
+    fn owned_redb_file_identity_is_stable_across_writes_and_reopen() -> Result<()> {
+        let temp = tempfile::tempdir()?;
+        let path = temp.path().join("identity.cc");
+        let identity = {
+            let mut owner = OwnedRedbMessagePackBackingStore::new(&path)?;
+            let identity = owner.file_identity().to_string();
+            owner.push(&test_envelope("model", "current", b"one"))?;
+            owner.validate_path_identity()?;
+            owner.require_file_identity(&identity)?;
+            identity
+        };
+        let reopened = OwnedRedbMessagePackBackingStore::new(&path)?;
+        assert_eq!(reopened.file_identity(), identity);
+        assert_eq!(reopened.pull_all()?.len(), 1);
+        Ok(())
+    }
+
+    #[test]
+    fn owned_redb_identity_helper_refuses_mismatch() -> Result<()> {
+        let temp = tempfile::tempdir()?;
+        let owner = OwnedRedbMessagePackBackingStore::new(temp.path().join("mismatch.cc"))?;
+        assert!(owner.require_file_identity("not-the-owned-file").is_err());
+        owner.require_file_identity(owner.file_identity())?;
+        Ok(())
+    }
+
+    #[test]
+    fn owned_redb_batch_refuses_stale_member_and_commits_success_atomically() -> Result<()> {
+        let temp = tempfile::tempdir()?;
+        let mut owner = OwnedRedbMessagePackBackingStore::new(temp.path().join("batch-owned.cc"))?;
+        let first = test_envelope("model", "first", b"one");
+        let second = test_envelope("model", "second", b"one");
+        owner.push(&first)?;
+        owner.push(&second)?;
+        let first_two = test_envelope("model", "first", b"two");
+        let second_two = test_envelope("model", "second", b"two");
+        let companion = test_envelope("receipt", "batch", b"committed");
+        let stale_second = test_envelope("model", "second", b"stale");
+        assert!(!owner.compare_and_swap_batch(
+            &[first.clone(), stale_second],
+            vec![first_two.clone(), second_two.clone(), companion.clone()],
+        )?);
+        assert_eq!(owner.pull_all()?, vec![first.clone(), second.clone()]);
+        assert!(owner.compare_and_swap_batch(
+            &[first, second],
+            vec![first_two.clone(), second_two.clone(), companion.clone()],
+        )?);
+        assert_eq!(owner.pull_all()?, vec![first_two, second_two, companion]);
+        Ok(())
+    }
+
+    #[test]
+    fn owned_redb_compaction_refuses_stale_snapshot_and_atomically_replaces_and_deletes()
+    -> Result<()> {
+        let temp = tempfile::tempdir()?;
+        let mut owner =
+            OwnedRedbMessagePackBackingStore::new(temp.path().join("compact-owned.cc"))?;
+        let old_head = test_envelope("retention", "current", b"one");
+        let retired_a = test_envelope("claim", "a", b"terminal");
+        let retired_b = test_envelope("receipt", "a", b"terminal");
+        owner.push(&old_head)?;
+        owner.push(&retired_a)?;
+        owner.push(&retired_b)?;
+        let stale = owner.pull_all()?;
+        let concurrent = test_envelope("claim", "concurrent", b"running");
+        assert!(owner.insert_entry_if_absent(concurrent.clone())?);
+        let new_head = test_envelope("retention", "current", b"two");
+        assert!(!owner.replace_and_delete_if_snapshot_unchanged(
+            &stale,
+            vec![new_head.clone()],
+            &[retired_a.clone(), retired_b.clone()],
+        )?);
+        assert!(owner.pull_all()?.contains(&retired_a));
+        let exact = owner.pull_all()?;
+        assert!(owner.replace_and_delete_if_snapshot_unchanged(
+            &exact,
+            vec![new_head.clone()],
+            &[retired_a, retired_b],
+        )?);
+        assert_eq!(owner.pull_all()?, vec![concurrent, new_head]);
+        Ok(())
+    }
+
+    #[test]
+    fn owned_redb_path_replacement_cannot_redirect_pinned_authority() -> Result<()> {
+        let temp = tempfile::tempdir()?;
+        let path = temp.path().join("pinned.cc");
+        let displaced = temp.path().join("displaced.cc");
+        let mut owner = OwnedRedbMessagePackBackingStore::new(&path)?;
+        let identity = owner.file_identity().to_string();
+        owner.push(&test_envelope("model", "before", b"one"))?;
+        fs::rename(&path, &displaced)?;
+        File::create(&path)?;
+        assert!(owner.validate_path_identity().is_err());
+        assert_eq!(owner.file_identity(), identity);
+        owner.push(&test_envelope("model", "after", b"two"))?;
+        assert_eq!(owner.pull_all()?.len(), 2);
+        assert_ne!(
+            file_identity_from_file(&File::open(&path)?)?,
+            owner.file_identity()
+        );
+        Ok(())
+    }
+
+    #[test]
+    fn redb_overlapping_fresh_handles_serialize_the_database_open_interval() -> Result<()> {
+        let temp = tempfile::tempdir()?;
+        let path = temp.path().join("contended.cc");
+        let first = RedbMessagePackBackingStore::new(&path)?;
+        let second = RedbMessagePackBackingStore::new(&path)?;
+        let barrier = std::sync::Arc::new(std::sync::Barrier::new(3));
+        let first_barrier = barrier.clone();
+        let first_thread = std::thread::spawn(move || -> Result<()> {
+            first_barrier.wait();
+            for index in 0..32 {
+                first.insert_entry_if_absent(test_envelope(
+                    "event",
+                    &format!("first-{index}"),
+                    b"first",
+                ))?;
+            }
+            Ok(())
+        });
+        let second_barrier = barrier.clone();
+        let second_thread = std::thread::spawn(move || -> Result<()> {
+            second_barrier.wait();
+            for index in 0..32 {
+                second.insert_entry_if_absent(test_envelope(
+                    "event",
+                    &format!("second-{index}"),
+                    b"second",
+                ))?;
+            }
+            Ok(())
+        });
+        barrier.wait();
+        first_thread.join().expect("first redb writer")?;
+        second_thread.join().expect("second redb writer")?;
+        assert_eq!(
+            RedbMessagePackBackingStore::new(path)?.pull_all()?.len(),
+            64
+        );
+        Ok(())
+    }
+
+    #[test]
+    fn redb_accepts_a_bare_relative_cultcache_path() -> Result<()> {
+        let name = format!("cultcache-redb-relative-{}.cc", uuid::Uuid::new_v4());
+        let path = PathBuf::from(&name);
+        let lock_path = PathBuf::from(format!("{name}.lock"));
+        let store = RedbMessagePackBackingStore::new(&path)?;
+        assert!(store.insert_entry_if_absent(test_envelope("model", "current", b"one"))?);
+        assert_eq!(store.pull_all()?.len(), 1);
+        fs::remove_file(path)?;
+        fs::remove_file(lock_path)?;
+        Ok(())
+    }
+
+    #[test]
+    fn conditional_batch_replaces_expected_and_inserts_companion_atomically() -> Result<()> {
+        let temp = tempfile::tempdir()?;
+        let store_path = temp.path().join("conditional-batch.cc");
+        let mut store = SingleFileMessagePackBackingStore::new(&store_path);
+        let current = test_envelope("model", "current", b"revision-1");
+        store.push(&current)?;
+        let replacement = test_envelope("model", "current", b"revision-2");
+        let companion = test_envelope("receipt", "migration-1", b"applied");
+
+        assert!(store.compare_and_swap_batch(
+            std::slice::from_ref(&current),
+            vec![replacement.clone(), companion.clone()],
+        )?);
+        assert_eq!(store.pull_all()?, vec![replacement, companion]);
+        Ok(())
+    }
+
+    #[test]
+    fn conditional_batch_allows_atomic_first_import_when_identities_are_absent() -> Result<()> {
+        let temp = tempfile::tempdir()?;
+        let store_path = temp.path().join("conditional-import.cc");
+        let store = SingleFileMessagePackBackingStore::new(&store_path);
+        let model = test_envelope("model", "current", b"revision-1");
+        let receipt = test_envelope("receipt", "migration-1", b"applied");
+
+        assert!(store.compare_and_swap_batch(&[], vec![model.clone(), receipt.clone()])?);
+        assert_eq!(store.pull_all()?, vec![model, receipt]);
+        Ok(())
+    }
+
+    #[test]
+    fn conditional_batch_stale_expected_and_companion_collision_preserve_exact_bytes() -> Result<()>
+    {
+        let temp = tempfile::tempdir()?;
+        let store_path = temp.path().join("conditional-refusal.cc");
+        let mut store = SingleFileMessagePackBackingStore::new(&store_path);
+        let current = test_envelope("model", "current", b"revision-1");
+        let occupied = test_envelope("receipt", "migration-1", b"someone-else");
+        store.push(&current)?;
+        store.push(&occupied)?;
+        let before = fs::read(&store_path)?;
+
+        let stale = test_envelope("model", "current", b"stale-copy");
+        let replacement = test_envelope("model", "current", b"revision-2");
+        let fresh_companion = test_envelope("receipt", "migration-2", b"applied");
+        assert!(
+            !store.compare_and_swap_batch(&[stale], vec![replacement.clone(), fresh_companion],)?
+        );
+        assert_eq!(fs::read(&store_path)?, before);
+
+        assert!(!store.compare_and_swap_batch(
+            &[current],
+            vec![
+                replacement,
+                test_envelope("receipt", "migration-1", b"collision")
+            ],
+        )?);
+        assert_eq!(fs::read(&store_path)?, before);
+        Ok(())
+    }
+
+    #[test]
+    fn conditional_batch_rejects_empty_replacements_and_duplicate_identities() -> Result<()> {
+        let temp = tempfile::tempdir()?;
+        let store = SingleFileMessagePackBackingStore::new(temp.path().join("invalid-batch.cc"));
+        let entry = test_envelope("model", "current", b"one");
+
+        assert!(
+            store
+                .compare_and_swap_batch(&[entry.clone()], Vec::new())
+                .is_err()
+        );
+        assert!(
+            store
+                .compare_and_swap_batch(&[], vec![entry.clone(), entry.clone()])
+                .is_err()
+        );
+        assert!(
+            store
+                .compare_and_swap_batch(
+                    &[entry.clone(), entry.clone()],
+                    vec![test_envelope("model", "current", b"two")],
+                )
+                .is_err()
+        );
+        assert!(!store.path().exists());
+        Ok(())
+    }
+
+    #[test]
+    fn full_snapshot_replacement_and_append_refuses_concurrent_rows() -> Result<()> {
+        let temp = tempfile::tempdir()?;
+        let snapshot_path = temp.path().join("snapshot-replace-append.cc");
+        let mut snapshot_store = SingleFileMessagePackBackingStore::new(&snapshot_path);
+        let current = test_envelope("session", "current", b"active");
+        snapshot_store.push(&current)?;
+        let stale_snapshot = snapshot_store.pull_all()?;
+        let concurrent = test_envelope("event", "concurrent", b"live");
+        snapshot_store.push(&concurrent)?;
+        let completed = test_envelope("session", "current", b"completed");
+        let receipt = test_envelope("receipt", "terminal", b"done");
+        assert!(!snapshot_store.replace_and_append_if_snapshot_unchanged(
+            &stale_snapshot,
+            vec![completed.clone(), receipt.clone()],
+        )?);
+        assert_eq!(
+            snapshot_store.pull_all()?,
+            vec![concurrent.clone(), current.clone()]
+        );
+        let exact_snapshot = snapshot_store.pull_all()?;
+        assert!(snapshot_store.replace_and_append_if_snapshot_unchanged(
+            &exact_snapshot,
+            vec![completed.clone(), receipt.clone()],
+        )?);
+        assert_eq!(
+            snapshot_store.pull_all()?,
+            vec![concurrent.clone(), receipt.clone(), completed.clone()]
+        );
+
+        let keyed_path = temp.path().join("keyed-replace-append.redb");
+        let mut keyed_store = RedbMessagePackBackingStore::new(&keyed_path)?;
+        keyed_store.push(&current)?;
+        let stale_snapshot = keyed_store.pull_all()?;
+        keyed_store.push(&concurrent)?;
+        assert!(!keyed_store.replace_and_append_if_snapshot_unchanged(
+            &stale_snapshot,
+            vec![completed.clone(), receipt.clone()],
+        )?);
+        let exact_snapshot = keyed_store.pull_all()?;
+        assert!(keyed_store.replace_and_append_if_snapshot_unchanged(
+            &exact_snapshot,
+            vec![completed.clone(), receipt.clone()],
+        )?);
+        assert_eq!(
+            keyed_store.pull_all()?,
+            vec![concurrent, receipt, completed]
+        );
+        Ok(())
+    }
+
+    #[test]
+    fn single_file_compaction_atomically_replaces_summary_and_deletes_history() -> Result<()> {
+        let temp = tempfile::tempdir()?;
+        let store_path = temp.path().join("conditional-compaction.cc");
+        let mut store = SingleFileMessagePackBackingStore::new(&store_path);
+        let history = test_envelope("history", "old", b"closed");
+        let head = test_envelope("retention", "head", b"revision-1");
+        store.push(&history)?;
+        store.push(&head)?;
+        let snapshot = store.pull_all()?;
+        let next_head = test_envelope("retention", "head", b"revision-2");
+
+        assert!(store.replace_and_delete_if_snapshot_unchanged(
+            &snapshot,
+            vec![next_head.clone()],
+            std::slice::from_ref(&history),
+        )?);
+        assert_eq!(store.pull_all()?, vec![next_head]);
+
+        let before = fs::read(&store_path)?;
+        assert!(!store.replace_and_delete_if_snapshot_unchanged(
+            &snapshot,
+            vec![test_envelope("retention", "head", b"revision-3")],
+            std::slice::from_ref(&history),
+        )?);
+        assert_eq!(fs::read(&store_path)?, before);
+        Ok(())
+    }
+
+    #[test]
+    fn snapshot_append_fences_concurrent_unknown_identity() -> Result<()> {
+        let temp = tempfile::tempdir()?;
+        let store_path = temp.path().join("snapshot-append.cc");
+        let mut store = SingleFileMessagePackBackingStore::new(&store_path);
+        let model = test_envelope("model", "current", b"revision-1");
+        store.push(&model)?;
+        let expected = store.pull_all()?;
+        let duplicate_admission = test_envelope("admission", "unexpected", b"also-current");
+        store.push(&duplicate_admission)?;
+        let before = fs::read(&store_path)?;
+
+        assert!(!store.append_if_snapshot_unchanged(
+            &expected,
+            vec![test_envelope("readiness", "proof", b"ready")],
+        )?);
+        assert_eq!(fs::read(&store_path)?, before);
+        Ok(())
+    }
+
+    #[test]
+    fn snapshot_append_is_order_insensitive_and_refuses_collisions() -> Result<()> {
+        let temp = tempfile::tempdir()?;
+        let store_path = temp.path().join("snapshot-order.cc");
+        let mut store = SingleFileMessagePackBackingStore::new(&store_path);
+        let a = test_envelope("a", "one", b"1");
+        let b = test_envelope("b", "two", b"2");
+        store.push(&a)?;
+        store.push(&b)?;
+        assert!(store.append_if_snapshot_unchanged(
+            &[b.clone(), a.clone()],
+            vec![test_envelope("proof", "three", b"3")],
+        )?);
+        let current = store.pull_all()?;
+        assert!(!store.append_if_snapshot_unchanged(
+            &current,
+            vec![test_envelope("a", "one", b"collision")],
+        )?);
+        assert!(
+            store
+                .append_if_snapshot_unchanged(&current, Vec::new())
+                .is_err()
+        );
+        Ok(())
+    }
+
+    #[test]
+    fn type_and_key_identity_is_not_delimiter_ambiguous() -> Result<()> {
+        let temp = tempfile::tempdir()?;
+        let store_path = temp.path().join("delimiter-identity.cc");
+        let mut store = SingleFileMessagePackBackingStore::new(&store_path);
+        let left = test_envelope("a::b", "c", b"left");
+        let right = test_envelope("a", "b::c", b"right");
+        store.push(&left)?;
+        store.push(&right)?;
+        let rows = store.pull_all()?;
+        assert_eq!(rows.len(), 2);
+        assert!(rows.contains(&left));
+        assert!(rows.contains(&right));
+        Ok(())
+    }
+
+    #[test]
+    fn refused_batch_preserves_prior_snapshot() -> Result<()> {
+        let temp = tempfile::tempdir()?;
+        let store_path = temp.path().join("refused-batch.cc");
+        let refusal = Arc::new(AtomicBool::new(false));
+        let mut cache = CultCache::new();
+        cache.register_registry(TestEntries)?;
+        cache.add_generic_backing_store(RefusingBatchStore {
+            inner: SingleFileMessagePackBackingStore::new(&store_path),
+            refuse_batch: refusal.clone(),
+        })?;
+        cache.put(
+            "app",
+            &Settings {
+                theme: "before".to_string(),
+                retries: 1,
+            },
+        )?;
+        let (note, _) = cache.prepare_entry(
+            "receipt",
+            &Note {
+                title: "after".to_string(),
+                body: "must not land".to_string(),
+            },
+        )?;
+        refusal.store(true, Ordering::SeqCst);
+        assert!(cache.put_prepared_batch(vec![note]).is_err());
+        assert!(cache.get::<Note>("receipt")?.is_none());
+
+        let mut reloaded = CultCache::new();
+        reloaded.register_registry(TestEntries)?;
+        reloaded.add_generic_backing_store(SingleFileMessagePackBackingStore::new(&store_path))?;
+        reloaded.pull_all_backing_stores()?;
+        assert_eq!(reloaded.get_required::<Settings>("app")?.theme, "before");
+        assert!(reloaded.get::<Note>("receipt")?.is_none());
+        Ok(())
+    }
+
     #[test]
     fn type_specific_store_routes_before_generic_store() -> Result<()> {
         let temp = tempfile::tempdir()?;
-        let generic_path = temp.path().join("generic.msgpack");
-        let settings_path = temp.path().join("settings.msgpack");
+        let generic_path = temp.path().join("generic.cc");
+        let settings_path = temp.path().join("settings.cc");
         let mut cache = CultCache::new();
         cache.register_entry_type::<Settings>()?;
         cache.register_entry_type::<Note>()?;
-        cache.add_generic_backing_store(SingleFileMessagePackBackingStore::new(&generic_path));
         cache.add_backing_store(
             SingleFileMessagePackBackingStore::new(&settings_path),
             ["settings"],
-        );
+        )?;
+        cache.add_generic_backing_store(SingleFileMessagePackBackingStore::new(&generic_path))?;
 
         cache.put(
             "app",
@@ -751,12 +3811,231 @@ mod tests {
     }
 
     #[test]
-    fn update_and_delete_follow_the_cache_api() -> Result<()> {
+    fn second_generic_store_is_rejected() -> Result<()> {
         let temp = tempfile::tempdir()?;
-        let store_path = temp.path().join("cache.msgpack");
+        let mut cache = CultCache::new();
+        cache.add_generic_backing_store(SingleFileMessagePackBackingStore::new(temp.path().join("a.cc")))?;
+        let error = cache
+            .add_generic_backing_store(SingleFileMessagePackBackingStore::new(temp.path().join("b.cc")))
+            .unwrap_err();
+        assert!(error.to_string().contains("second generic store"), "{error}");
+        assert_eq!(cache.stores.len(), 1);
+        Ok(())
+    }
+
+    #[test]
+    fn type_claimed_twice_is_rejected() -> Result<()> {
+        let temp = tempfile::tempdir()?;
+        let mut cache = CultCache::new();
+        cache.add_backing_store(SingleFileMessagePackBackingStore::new(temp.path().join("a.cc")), ["settings"])?;
+        let error = cache
+            .add_backing_store(
+                SingleFileMessagePackBackingStore::new(temp.path().join("b.cc")),
+                ["note", "settings"],
+            )
+            .unwrap_err();
+        assert!(error.to_string().contains("already routed"), "{error}");
+        // A refused registration claims nothing, so "note" is still free.
+        cache.add_backing_store(SingleFileMessagePackBackingStore::new(temp.path().join("c.cc")), ["note"])?;
+        assert_eq!(cache.stores.len(), 2);
+        Ok(())
+    }
+
+    #[test]
+    fn attach_that_would_move_a_held_record_home_is_refused() -> Result<()> {
+        let temp = tempfile::tempdir()?;
+        let generic_path = temp.path().join("generic.cc");
+        let settings_path = temp.path().join("settings.cc");
         let mut cache = CultCache::new();
         cache.register_entry_type::<Settings>()?;
-        cache.add_generic_backing_store(SingleFileMessagePackBackingStore::new(&store_path));
+        cache.add_generic_backing_store(SingleFileMessagePackBackingStore::new(&generic_path))?;
+        cache.put("app", &Settings { theme: "v1-generic".to_string(), retries: 1 })?;
+
+        let error = cache
+            .add_backing_store(SingleFileMessagePackBackingStore::new(&settings_path), ["settings"])
+            .unwrap_err();
+        assert!(
+            error
+                .to_string()
+                .contains("would move \"settings\" from the generic store to the store routed to [\"settings\"]"),
+            "{error}"
+        );
+        assert_eq!(cache.stores.len(), 1);
+        // Nothing attached: the next write still lands in the generic store.
+        cache.put("app", &Settings { theme: "v2-generic".to_string(), retries: 2 })?;
+        let generic_entries = SingleFileMessagePackBackingStore::new(&generic_path).pull_all()?;
+        assert_eq!(generic_entries.len(), 1);
+        assert_eq!(generic_entries[0].r#type, "settings");
+        assert!(!settings_path.exists());
+        Ok(())
+    }
+
+    #[test]
+    fn load_from_a_store_that_is_not_the_record_home_is_refused() -> Result<()> {
+        let temp = tempfile::tempdir()?;
+        let generic_path = temp.path().join("generic.cc");
+        let settings_path = temp.path().join("settings.cc");
+        let mut writer = CultCache::new();
+        writer.register_entry_type::<Settings>()?;
+        writer.add_generic_backing_store(SingleFileMessagePackBackingStore::new(&generic_path))?;
+        writer.put("app", &Settings { theme: "stray".to_string(), retries: 0 })?;
+        let generic_bytes = fs::read(&generic_path)?;
+
+        let mut cache = CultCache::new();
+        cache.register_entry_type::<Settings>()?;
+        cache.add_backing_store(SingleFileMessagePackBackingStore::new(&settings_path), ["settings"])?;
+        cache.add_generic_backing_store(SingleFileMessagePackBackingStore::new(&generic_path))?;
+        // The cache already holds a record, in its home store, before the refused load.
+        cache.put("held", &Settings { theme: "home".to_string(), retries: 0 })?;
+        let before = cache.snapshot();
+        let settings_bytes = fs::read(&settings_path)?;
+        let error = cache.pull_all_backing_stores().unwrap_err();
+        assert!(
+            error.to_string().contains(
+                "\"settings\" record \"app\" was loaded from the generic store, but its home is the store routed to [\"settings\"]"
+            ),
+            "{error}"
+        );
+        assert_eq!(cache.snapshot(), before);
+        assert_eq!(cache.get_required::<Settings>("held")?.theme, "home");
+        assert_eq!(fs::read(&generic_path)?, generic_bytes);
+        assert_eq!(fs::read(&settings_path)?, settings_bytes);
+        Ok(())
+    }
+
+    #[test]
+    fn refused_pull_leaves_prior_view_intact() -> Result<()> {
+        let temp = tempfile::tempdir()?;
+        let store_path = temp.path().join("generic.cc");
+        let mut cache = CultCache::new();
+        cache.register_entry_type::<Settings>()?;
+        cache.add_generic_backing_store(SingleFileMessagePackBackingStore::new(&store_path))?;
+        cache.put("app", &Settings { theme: "before".to_string(), retries: 1 })?;
+        let before = cache.snapshot();
+
+        // A record of a type this cache never registered lands in the store behind its back.
+        SingleFileMessagePackBackingStore::new(&store_path).push(&CultCacheEnvelope {
+            key: "stray".into(),
+            r#type: "unregistered".into(),
+            payload: rmp_serde::to_vec(&("x",))?,
+            stored_at: "2026-09-14T00:00:00Z".into(),
+            schema_id: Some("unregistered".into()),
+        })?;
+        let error = cache.pull_all_backing_stores().unwrap_err();
+        assert!(error.to_string().contains("\"unregistered\""), "{error}");
+        assert_eq!(cache.snapshot(), before);
+        assert_eq!(cache.get_required::<Settings>("app")?.theme, "before");
+        Ok(())
+    }
+
+    #[test]
+    fn refused_soa_load_leaves_prior_view_intact() -> Result<()> {
+        let mut source = CultCache::new();
+        source.register_registry(TestEntries)?;
+        source.put("app", &Settings { theme: "ash".to_string(), retries: 3 })?;
+        source.put("memo", &Note { title: "machine".to_string(), body: "awake".to_string() })?;
+        let table = source.snapshot_soa();
+
+        // A type with no registration.
+        let mut unregistered = CultCache::new();
+        unregistered.register_entry_type::<Settings>()?;
+        unregistered.put("held", &Settings { theme: "held".to_string(), retries: 0 })?;
+        let before = unregistered.snapshot();
+        let error = unregistered.load_soa(table.clone()).unwrap_err();
+        assert!(error.to_string().contains("\"note\""), "{error}");
+        assert_eq!(unregistered.snapshot(), before);
+
+        // A registered type with no home once a store is attached.
+        let temp = tempfile::tempdir()?;
+        let mut homeless = CultCache::new();
+        homeless.register_registry(TestEntries)?;
+        homeless.add_backing_store(SingleFileMessagePackBackingStore::new(temp.path().join("settings.cc")), ["settings"])?;
+        homeless.put("held", &Settings { theme: "held".to_string(), retries: 0 })?;
+        let before = homeless.snapshot();
+        let error = homeless.load_soa(table).unwrap_err();
+        assert!(error.to_string().contains("No backing store is registered for entry type \"note\""), "{error}");
+        assert_eq!(homeless.snapshot(), before);
+        Ok(())
+    }
+
+    #[test]
+    fn single_home_batch_is_not_refused_by_other_homes_records() -> Result<()> {
+        let temp = tempfile::tempdir()?;
+        let generic_path = temp.path().join("generic.cc");
+        let settings_path = temp.path().join("settings.cc");
+        let mut cache = CultCache::new();
+        cache.register_registry(TestEntries)?;
+        cache.add_backing_store(SingleFileMessagePackBackingStore::new(&settings_path), ["settings"])?;
+        cache.add_generic_backing_store(SingleFileMessagePackBackingStore::new(&generic_path))?;
+        cache.put("memo", &Note { title: "generic".to_string(), body: "home".to_string() })?;
+        cache.put("old", &Settings { theme: "kept".to_string(), retries: 0 })?;
+
+        let (staged, _) = cache.prepare_entry("app", &Settings { theme: "batch".to_string(), retries: 1 })?;
+        cache.put_prepared_batch(vec![staged])?;
+
+        let mut settings_keys: Vec<_> = SingleFileMessagePackBackingStore::new(&settings_path)
+            .pull_all()?
+            .into_iter()
+            .map(|entry| format!("{}:{}", entry.r#type, entry.key))
+            .collect();
+        settings_keys.sort();
+        assert_eq!(settings_keys, vec!["settings:app".to_string(), "settings:old".to_string()]);
+        let generic_keys: Vec<_> = SingleFileMessagePackBackingStore::new(&generic_path)
+            .pull_all()?
+            .into_iter()
+            .map(|entry| format!("{}:{}", entry.r#type, entry.key))
+            .collect();
+        assert_eq!(generic_keys, vec!["note:memo".to_string()]);
+        assert_eq!(cache.get_required::<Settings>("app")?.theme, "batch");
+        Ok(())
+    }
+
+    #[test]
+    fn batch_with_empty_key_or_stored_at_is_refused_before_any_store() -> Result<()> {
+        let temp = tempfile::tempdir()?;
+        let store_path = temp.path().join("generic.cc");
+        let mut cache = CultCache::new();
+        cache.register_registry(TestEntries)?;
+        cache.add_generic_backing_store(SingleFileMessagePackBackingStore::new(&store_path))?;
+        cache.put("app", &Settings { theme: "before".to_string(), retries: 1 })?;
+        let before = cache.snapshot();
+        let store_bytes = fs::read(&store_path)?;
+
+        let (empty_key, _) = cache.prepare_entry("", &Note { title: "t".to_string(), body: "b".to_string() })?;
+        let error = cache.put_prepared_batch(vec![empty_key]).unwrap_err();
+        assert!(error.to_string().contains("keys for type \"note\" must be non-empty"), "{error}");
+
+        let (mut empty_stored_at, _) = cache.prepare_entry("n", &Note { title: "t".to_string(), body: "b".to_string() })?;
+        empty_stored_at.stored_at = " ".to_string();
+        let error = cache.put_prepared_batch(vec![empty_stored_at]).unwrap_err();
+        assert!(error.to_string().contains("stored_at for type \"note\" must be non-empty"), "{error}");
+
+        assert_eq!(cache.snapshot(), before);
+        assert_eq!(fs::read(&store_path)?, store_bytes);
+        Ok(())
+    }
+
+    #[test]
+    fn zero_store_cache_writes_and_deletes_in_memory() -> Result<()> {
+        let mut cache = CultCache::new();
+        cache.register_entry_type::<Settings>()?;
+        cache.put("x", &Settings { theme: "mem".to_string(), retries: 0 })?;
+        assert_eq!(cache.get_required::<Settings>("x")?.theme, "mem");
+        let (staged, _) = cache.prepare_entry("y", &Settings { theme: "batch".to_string(), retries: 0 })?;
+        cache.put_prepared_batch(vec![staged])?;
+        assert_eq!(cache.get_required::<Settings>("y")?.theme, "batch");
+        assert!(cache.delete::<Settings>("x")?);
+        assert!(cache.get::<Settings>("x")?.is_none());
+        Ok(())
+    }
+
+    #[test]
+    fn update_and_delete_follow_the_cache_api() -> Result<()> {
+        let temp = tempfile::tempdir()?;
+        let store_path = temp.path().join("cache.cc");
+        let mut cache = CultCache::new();
+        cache.register_entry_type::<Settings>()?;
+        cache.add_generic_backing_store(SingleFileMessagePackBackingStore::new(&store_path))?;
 
         let updated = cache.update::<Settings, _>("app", |current| {
             let mut current = current.unwrap_or(Settings {
@@ -775,7 +4054,7 @@ mod tests {
     #[test]
     fn pull_rejects_unregistered_persisted_entry_type() -> Result<()> {
         let temp = tempfile::tempdir()?;
-        let store_path = temp.path().join("cache.msgpack");
+        let store_path = temp.path().join("cache.cc");
         let mut store = SingleFileMessagePackBackingStore::new(&store_path);
         store.push(&CultCacheEnvelope {
             key: "unknown".to_string(),
@@ -786,7 +4065,7 @@ mod tests {
         })?;
 
         let mut cache = CultCache::new();
-        cache.add_generic_backing_store(SingleFileMessagePackBackingStore::new(&store_path));
+        cache.add_generic_backing_store(SingleFileMessagePackBackingStore::new(&store_path))?;
         let error = cache.pull_all_backing_stores().unwrap_err();
         assert!(
             error
@@ -799,10 +4078,10 @@ mod tests {
     #[test]
     fn payload_is_binary_messagepack_not_json_value() -> Result<()> {
         let temp = tempfile::tempdir()?;
-        let store_path = temp.path().join("cache.msgpack");
+        let store_path = temp.path().join("cache.cc");
         let mut cache = CultCache::new();
         cache.register_entry_type::<Settings>()?;
-        cache.add_generic_backing_store(SingleFileMessagePackBackingStore::new(&store_path));
+        cache.add_generic_backing_store(SingleFileMessagePackBackingStore::new(&store_path))?;
         cache.put(
             "app",
             &Settings {
@@ -818,10 +4097,23 @@ mod tests {
         Ok(())
     }
 
+    #[test]
+    fn byte_slots_use_messagepack_binary_and_round_trip() -> Result<()> {
+        let record = BinaryRecord {
+            required: vec![1, 2, 3],
+            optional: Vec::new(),
+        };
+
+        let payload = rmp_serde::to_vec(&record)?;
+        assert_eq!(payload, vec![0x92, 0xc4, 3, 1, 2, 3, 0xc4, 0]);
+        assert_eq!(rmp_serde::from_slice::<BinaryRecord>(&payload)?, record);
+        Ok(())
+    }
+
     #[test]
     fn corrupted_payload_fails_during_typed_retrieval() -> Result<()> {
         let temp = tempfile::tempdir()?;
-        let store_path = temp.path().join("cache.msgpack");
+        let store_path = temp.path().join("cache.cc");
         let mut store = SingleFileMessagePackBackingStore::new(&store_path);
         store.push(&CultCacheEnvelope {
             key: "app".to_string(),
@@ -833,7 +4125,7 @@ mod tests {
 
         let mut cache = CultCache::new();
         cache.register_entry_type::<Settings>()?;
-        cache.add_generic_backing_store(SingleFileMessagePackBackingStore::new(&store_path));
+        cache.add_generic_backing_store(SingleFileMessagePackBackingStore::new(&store_path))?;
         cache.pull_all_backing_stores()?;
         let error = cache.get_required::<Settings>("app").unwrap_err();
         assert!(
@@ -847,12 +4139,12 @@ mod tests {
     #[test]
     fn put_envelope_reuses_existing_messagepack_payload() -> Result<()> {
         let temp = tempfile::tempdir()?;
-        let origin_store = temp.path().join("origin.msgpack");
-        let target_store = temp.path().join("target.msgpack");
+        let origin_store = temp.path().join("origin.cc");
+        let target_store = temp.path().join("target.cc");
 
         let mut origin = CultCache::new();
         origin.register_entry_type::<Settings>()?;
-        origin.add_generic_backing_store(SingleFileMessagePackBackingStore::new(&origin_store));
+        origin.add_generic_backing_store(SingleFileMessagePackBackingStore::new(&origin_store))?;
         origin.put(
             "app",
             &Settings {
@@ -865,7 +4157,7 @@ mod tests {
 
         let mut target = CultCache::new();
         target.register_entry_type::<Settings>()?;
-        target.add_generic_backing_store(SingleFileMessagePackBackingStore::new(&target_store));
+        target.add_generic_backing_store(SingleFileMessagePackBackingStore::new(&target_store))?;
         let applied = target.put_envelope::<Settings>(envelope.clone())?;
 
         assert_eq!(
@@ -882,4 +4174,403 @@ mod tests {
         );
         Ok(())
     }
+
+    #[test]
+    fn raw_envelope_path_preserves_a_registered_dynamic_payload() -> Result<()> {
+        let temp = tempfile::tempdir()?;
+        let store_path = temp.path().join("dynamic.cc");
+        let envelope = CultCacheEnvelope {
+            key: "app".to_string(),
+            r#type: Settings::TYPE.to_string(),
+            payload: vec![0xc1],
+            stored_at: now_utc_second(),
+            schema_id: Some("dynamic.settings.v1".to_string()),
+        };
+
+        let mut cache = CultCache::new();
+        cache.register_entry_type::<Settings>()?;
+        cache.register_entry_type::<Note>()?;
+        cache.add_generic_backing_store(SingleFileMessagePackBackingStore::new(&store_path))?;
+        cache.put_raw_envelope(envelope.clone())?;
+
+        assert_eq!(cache.snapshot(), vec![envelope.clone()]);
+        assert_eq!(
+            SingleFileMessagePackBackingStore::new(&store_path).pull_all()?,
+            vec![envelope]
+        );
+        assert!(cache.get_required::<Settings>("app").is_err());
+        let before_collision = fs::read(&store_path)?;
+        assert!(
+            cache
+                .put_raw_envelope(CultCacheEnvelope {
+                    key: "note".to_string(),
+                    r#type: Note::TYPE.to_string(),
+                    payload: Vec::new(),
+                    stored_at: now_utc_second(),
+                    schema_id: Some("dynamic.settings.v1".to_string()),
+                })
+                .is_err()
+        );
+        assert_eq!(fs::read(&store_path)?, before_collision);
+        assert!(
+            cache
+                .put_raw_envelope(CultCacheEnvelope {
+                    key: "foreign".to_string(),
+                    r#type: "unregistered".to_string(),
+                    payload: Vec::new(),
+                    stored_at: now_utc_second(),
+                    schema_id: None,
+                })
+                .is_err()
+        );
+        Ok(())
+    }
+
+    #[test]
+    fn soa_snapshot_round_trips_registered_entries() -> Result<()> {
+        let temp = tempfile::tempdir()?;
+        let store_path = temp.path().join("cache.cc");
+        let mut cache = CultCache::new();
+        cache.register_registry(TestEntries)?;
+        cache.add_generic_backing_store(SingleFileMessagePackBackingStore::new(&store_path))?;
+        cache.put(
+            "app",
+            &Settings {
+                theme: "ash".to_string(),
+                retries: 3,
+            },
+        )?;
+        cache.put(
+            "memo",
+            &Note {
+                title: "machine".to_string(),
+                body: "awake".to_string(),
+            },
+        )?;
+
+        let soa = cache.snapshot_soa();
+        assert_eq!(soa.len(), 2);
+        assert_eq!(soa.keys.len(), soa.payloads.len());
+
+        let mut restored = CultCache::new();
+        restored.register_registry(TestEntries)?;
+        restored.add_generic_backing_store(SingleFileMessagePackBackingStore::new(
+            temp.path().join("restored.cc"),
+        ))?;
+        restored.load_soa(soa)?;
+        assert_eq!(restored.get_required::<Settings>("app")?.theme, "ash");
+        assert_eq!(restored.get_required::<Note>("memo")?.body, "awake");
+        Ok(())
+    }
+
+    #[test]
+    fn typed_soa_columns_match_csharp_cache_ergonomics() -> Result<()> {
+        let temp = tempfile::tempdir()?;
+        let store_path = temp.path().join("cache.cc");
+        let mut cache = CultCache::new();
+        cache.register_registry(TestEntries)?;
+        cache.add_generic_backing_store(SingleFileMessagePackBackingStore::new(&store_path))?;
+        cache.put(
+            "settings:a",
+            &Settings {
+                theme: "ash".to_string(),
+                retries: 3,
+            },
+        )?;
+        cache.put(
+            "settings:b",
+            &Settings {
+                theme: "bone".to_string(),
+                retries: 5,
+            },
+        )?;
+
+        let table = cache.soa::<Settings>()?;
+        assert_eq!(
+            table.keys(),
+            &["settings:a".to_string(), "settings:b".to_string()]
+        );
+        assert_eq!(
+            table.column::<String>("theme")?.values(),
+            &["ash".to_string(), "bone".to_string()]
+        );
+        assert_eq!(table.column::<u32>("retries")?.values(), &[3, 5]);
+
+        let error = table.column::<String>("retries").unwrap_err();
+        assert!(error.to_string().contains("not alloc::string::String"));
+        Ok(())
+    }
+
+    #[test]
+    fn soa_rejects_column_length_drift() {
+        let table = CultCacheSoaTable {
+            keys: vec!["app".to_string()],
+            types: Vec::new(),
+            payloads: Vec::new(),
+            stored_ats: Vec::new(),
+            schema_ids: Vec::new(),
+        };
+        let error = table.validate().unwrap_err();
+        assert!(error.to_string().contains("column types has length 0"));
+    }
+
+    #[test]
+    fn messagepack_store_recovers_schema_stamped_records_missing_catalog_entries() -> Result<()> {
+        let temp = tempfile::tempdir()?;
+        let store_path = temp.path().join("missing-catalog.msgpack");
+        let expected = SchemaStamped {
+            schema_version: "tests.schema_stamped_entry.v1".to_string(),
+            name: "schema-stamped".to_string(),
+            value: "still readable".to_string(),
+        };
+        // An empty catalog with a stale schema id is what a record written by
+        // another runtime, or one older than its catalog, looks like on disk.
+        let snapshot = PersistedStoreSnapshot(
+            "cultcache.store.v1".to_string(),
+            Vec::new(),
+            vec![PersistedRecord(
+                "record-1".to_string(),
+                "sha256:stale-schema-id-from-cold-record".to_string(),
+                "2026-06-25T12:00:00Z".to_string(),
+                rmp_serde::to_vec(&expected)?,
+            )],
+        );
+        std::fs::write(&store_path, rmp_serde::to_vec(&snapshot)?)?;
+
+        let mut cache = CultCache::new();
+        cache.register_entry_type::<SchemaStamped>()?;
+        cache.add_generic_backing_store(SingleFileMessagePackBackingStore::new(&store_path))?;
+        cache.pull_all_backing_stores()?;
+
+        assert_eq!(cache.get_required::<SchemaStamped>("record-1")?, expected);
+        assert_eq!(
+            cache
+                .get_required_envelope::<SchemaStamped>("record-1")?
+                .schema_id,
+            Some("sha256:stale-schema-id-from-cold-record".to_string())
+        );
+        Ok(())
+    }
+
+    #[test]
+    fn abandoned_staging_cleanup_removes_only_canonical_candidates() -> Result<()> {
+        let temp = tempfile::tempdir()?;
+        let store_path = temp.path().join("store.cc");
+        let mut cache = CultCache::new();
+        cache.register_entry_type::<Settings>()?;
+        cache.add_generic_backing_store(SingleFileMessagePackBackingStore::new(&store_path))?;
+        cache.put(
+            "primary",
+            &Settings {
+                theme: "dark".to_string(),
+                retries: 2,
+            },
+        )?;
+
+        // A crashed writer leaves a canonically named candidate behind.
+        let abandoned = temp
+            .path()
+            .join(format!("store.cc.{}.tmp", uuid::Uuid::new_v4()));
+        std::fs::write(&abandoned, b"partial snapshot")?;
+        // These only look like candidates. Cleanup must not touch them: the
+        // staging name is the store's own file name plus a canonical UUID, and
+        // anything else is somebody's file.
+        let lookalike = temp.path().join("store.cc.not-a-uuid.tmp");
+        std::fs::write(&lookalike, b"keep me")?;
+        let bare_suffix = temp.path().join("store.cc.tmp");
+        std::fs::write(&bare_suffix, b"keep me too")?;
+        let neighbour = temp.path().join("other.cc.00000000-0000-0000-0000-000000000000.tmp");
+        std::fs::write(&neighbour, b"not this store")?;
+
+        cache.put(
+            "primary",
+            &Settings {
+                theme: "light".to_string(),
+                retries: 3,
+            },
+        )?;
+
+        assert!(!abandoned.exists(), "canonical abandoned candidate survived");
+        assert!(lookalike.exists(), "non-UUID lookalike was deleted");
+        assert!(bare_suffix.exists(), "bare .tmp suffix was deleted");
+        assert!(neighbour.exists(), "another store's candidate was deleted");
+
+        let mut reloaded = CultCache::new();
+        reloaded.register_entry_type::<Settings>()?;
+        reloaded.add_generic_backing_store(SingleFileMessagePackBackingStore::new(&store_path))?;
+        reloaded.pull_all_backing_stores()?;
+        assert_eq!(reloaded.get_required::<Settings>("primary")?.theme, "light");
+        Ok(())
+    }
+
+    fn snapshot_envelope(key: &str, payload: &[u8]) -> CultCacheEnvelope {
+        CultCacheEnvelope {
+            key: key.to_string(),
+            r#type: "snapshot.record".to_string(),
+            payload: payload.to_vec(),
+            stored_at: "2026-01-01T00:00:00Z".to_string(),
+            // The store stamps the schema id from the type on write, so a
+            // fixture that omits it would not survive its own round trip.
+            schema_id: Some("snapshot.record".to_string()),
+        }
+    }
+
+    #[test]
+    fn snapshot_exchange_commits_only_against_the_observed_snapshot() -> Result<()> {
+        let temp = tempfile::tempdir()?;
+        let store = SingleFileMessagePackBackingStore::new(temp.path().join("generation.cc"));
+
+        let first = vec![snapshot_envelope("admitted", b"one")];
+        assert!(store.compare_exchange_snapshot(&[], &first)?);
+        assert_eq!(store.pull_all_read_only_snapshot()?, first);
+
+        // A writer holding a stale view loses the race instead of clobbering it.
+        let stale = vec![snapshot_envelope("admitted", b"stale")];
+        assert!(!store.compare_exchange_snapshot(&[], &stale)?);
+        assert_eq!(store.pull_all_read_only_snapshot()?, first);
+
+        let second = vec![snapshot_envelope("admitted", b"two")];
+        assert!(store.compare_exchange_snapshot(&first, &second)?);
+        assert_eq!(store.pull_all_read_only_snapshot()?, second);
+        Ok(())
+    }
+
+    #[test]
+    fn try_snapshot_exchange_separates_a_lost_race_from_a_commit() -> Result<()> {
+        let temp = tempfile::tempdir()?;
+        let store = SingleFileMessagePackBackingStore::new(temp.path().join("generation.cc"));
+
+        let first = vec![snapshot_envelope("admitted", b"one")];
+        assert_eq!(
+            store.try_compare_exchange_snapshot(&[], &first)?,
+            TryCompareExchangeSnapshotOutcome::Exchanged
+        );
+        assert_eq!(
+            store.try_compare_exchange_snapshot(&[], &first)?,
+            TryCompareExchangeSnapshotOutcome::Mismatch,
+            "a stale expectation is a lost race, not contention"
+        );
+        assert_eq!(store.pull_all_read_only_snapshot()?, first);
+        Ok(())
+    }
+
+    #[test]
+    fn snapshot_exchange_refuses_replacements_that_cannot_be_addressed() -> Result<()> {
+        let temp = tempfile::tempdir()?;
+        let store = SingleFileMessagePackBackingStore::new(temp.path().join("generation.cc"));
+
+        assert!(
+            store
+                .compare_exchange_snapshot(&[], &[snapshot_envelope("   ", b"one")])
+                .is_err(),
+            "an unaddressable record must not reach the store"
+        );
+        assert!(
+            store
+                .compare_exchange_snapshot(
+                    &[],
+                    &[
+                        snapshot_envelope("admitted", b"one"),
+                        snapshot_envelope("admitted", b"two"),
+                    ],
+                )
+                .is_err(),
+            "a duplicate identity would make the snapshot ambiguous"
+        );
+        assert_eq!(store.pull_all_read_only_snapshot()?, Vec::new());
+        Ok(())
+    }
+
+    #[test]
+    fn per_entry_exchange_constrains_only_the_identities_it_names() -> Result<()> {
+        let temp = tempfile::tempdir()?;
+        let store = SingleFileMessagePackBackingStore::new(temp.path().join("generation.cc"));
+
+        let admitted = snapshot_envelope("admitted", b"one");
+        let unrelated = snapshot_envelope("unrelated", b"other");
+        assert!(store.compare_exchange(
+            &[
+                CultCacheExpectedEnvelope {
+                    key: "admitted".into(),
+                    r#type: "snapshot.record".into(),
+                    current: None,
+                },
+                CultCacheExpectedEnvelope {
+                    key: "unrelated".into(),
+                    r#type: "snapshot.record".into(),
+                    current: None,
+                },
+            ],
+            &[admitted.clone(), unrelated.clone()],
+        )?);
+
+        // The snapshot moved, but an expectation naming only `admitted` still
+        // holds. A whole-snapshot exchange would have lost this race.
+        let next = snapshot_envelope("admitted", b"two");
+        assert!(store.compare_exchange(
+            &[CultCacheExpectedEnvelope {
+                key: "admitted".into(),
+                r#type: "snapshot.record".into(),
+                current: Some(admitted.clone()),
+            }],
+            &[next.clone()],
+        )?);
+        assert_eq!(
+            store.pull_all_read_only_snapshot()?,
+            vec![next.clone(), unrelated.clone()]
+        );
+
+        // A stale expectation for that identity now loses.
+        assert!(!store.compare_exchange(
+            &[CultCacheExpectedEnvelope {
+                key: "admitted".into(),
+                r#type: "snapshot.record".into(),
+                current: Some(admitted),
+            }],
+            &[snapshot_envelope("admitted", b"three")],
+        )?);
+        assert_eq!(store.pull_all_read_only_snapshot()?, vec![next, unrelated]);
+        Ok(())
+    }
+
+    #[test]
+    fn per_entry_exchange_distinguishes_absent_from_stored() -> Result<()> {
+        let temp = tempfile::tempdir()?;
+        let store = SingleFileMessagePackBackingStore::new(temp.path().join("generation.cc"));
+        let admitted = snapshot_envelope("admitted", b"one");
+
+        // Expecting a stored value where nothing is stored must not commit.
+        assert!(!store.compare_exchange(
+            &[CultCacheExpectedEnvelope {
+                key: "admitted".into(),
+                r#type: "snapshot.record".into(),
+                current: Some(admitted.clone()),
+            }],
+            &[admitted.clone()],
+        )?);
+        assert_eq!(store.pull_all_read_only_snapshot()?, Vec::new());
+
+        // Expecting absence commits the first writer.
+        assert!(store.compare_exchange(
+            &[CultCacheExpectedEnvelope {
+                key: "admitted".into(),
+                r#type: "snapshot.record".into(),
+                current: None,
+            }],
+            &[admitted.clone()],
+        )?);
+
+        // And the second writer expecting absence now loses, which is what
+        // makes this usable as a create-once claim.
+        assert!(!store.compare_exchange(
+            &[CultCacheExpectedEnvelope {
+                key: "admitted".into(),
+                r#type: "snapshot.record".into(),
+                current: None,
+            }],
+            &[snapshot_envelope("admitted", b"two")],
+        )?);
+        assert_eq!(store.pull_all_read_only_snapshot()?, vec![admitted]);
+        Ok(())
+    }
 }
diff --git a/packages/cultcache-ts/README.md b/packages/cultcache-ts/README.md
index 064cc91b..d1730958 100644
--- a/packages/cultcache-ts/README.md
+++ b/packages/cultcache-ts/README.md
@@ -53,7 +53,7 @@ import {
   SingleFileMessagePackBackingStore,
   defineDocumentRegistry,
   defineDocumentType,
-} from "cultcache-ts";
+} from "@gamecult/cultcache-ts";
 
 const itemDocument = defineDocumentType({
   type: "item",
@@ -142,6 +142,25 @@ Document definitions may also carry persistence metadata for cross-language
 stores: `schemaId`, `schemaName`, `schemaVersion`, `contentHash`,
 `canonicalSchemaJson`, `compatibleSchemaIds`, and slot `members`.
 
+## Backing Store Routing
+
+```ts
+const cache = CultCache.builder()
+  .withRegistry(registry)
+  .withBackingStore(new SingleFileMessagePackBackingStore("settings.cc"), settingsDocument)
+  .withGenericStore(new SingleFileMessagePackBackingStore("cache.cc"))
+  .build();
+```
+
+A document type has exactly one home store
+(`src/GameCult.Caching/Contracts/cultcache-store-composition.md` in CultLib):
+
+- a store added with types owns those types; otherwise the generic store is the home
+- a second generic store throws, and so does a type claimed by a second store;
+  a refused registration attaches nothing
+- `put`, `putEnvelope` and `delete` touch exactly one store; nothing is mirrored
+- a write whose type has no home store throws
+
 ## Name, Index, and Global Semantics
 
 `name` and `indexes` can be declared on the document definition:
@@ -161,11 +180,19 @@ const playerDocument = defineDocumentType({
 You can also register them later if you feel like changing the machine after boot:
 
 ```ts
-cache.registerNameLookup(playerDocument, "displayName");
-cache.registerIndex(playerDocument, "faction", "faction");
+await cache.registerNameLookup(playerDocument, "displayName");
+await cache.registerIndex(playerDocument, "faction", "faction");
 ```
 
-Global documents are singleton-style per type:
+Registration, `addBackingStore`, `pullAllBackingStores` and every write and
+delete run one at a time through a per-cache queue and return promises; reads
+are synchronous. A write validates the whole record (home store, global key,
+name and index accessors) before any store is touched, so a refused write
+changes neither store nor cache. Registering an accessor that throws on a held
+record installs nothing.
+
+Global documents are singleton-style per type, always stored under
+`CultCache.GLOBAL_KEY` (`__global__`); writing one under any other key throws:
 
 ```ts
 await cache.putGlobal(settingsDocument, { theme: "ash", retries: 3 });
diff --git a/packages/cultcache-ts/package-lock.json b/packages/cultcache-ts/package-lock.json
deleted file mode 100644
index 4b3cf3f6..00000000
--- a/packages/cultcache-ts/package-lock.json
+++ /dev/null
@@ -1,70 +0,0 @@
-{
-  "name": "cultcache-ts",
-  "version": "0.13.5",
-  "lockfileVersion": 3,
-  "requires": true,
-  "packages": {
-    "": {
-      "name": "cultcache-ts",
-      "version": "0.13.5",
-      "license": "MIT",
-      "dependencies": {
-        "@msgpack/msgpack": "^3.1.3",
-        "zod": "^3.25.76"
-      },
-      "devDependencies": {
-        "@types/node": "^24.0.0",
-        "typescript": "^5.9.0"
-      }
-    },
-    "node_modules/@msgpack/msgpack": {
-      "version": "3.1.3",
-      "resolved": "https://registry.npmjs.org/@msgpack/msgpack/-/msgpack-3.1.3.tgz",
-      "integrity": "sha512-47XIizs9XZXvuJgoaJUIE2lFoID8ugvc0jzSHP+Ptfk8nTbnR8g788wv48N03Kx0UkAv559HWRQ3yzOgzlRNUA==",
-      "license": "ISC",
-      "engines": {
-        "node": ">= 18"
-      }
-    },
-    "node_modules/@types/node": {
-      "version": "24.12.2",
-      "resolved": "https://registry.npmjs.org/@types/node/-/node-24.12.2.tgz",
-      "integrity": "sha512-A1sre26ke7HDIuY/M23nd9gfB+nrmhtYyMINbjI1zHJxYteKR6qSMX56FsmjMcDb3SMcjJg5BiRRgOCC/yBD0g==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "undici-types": "~7.16.0"
-      }
-    },
-    "node_modules/typescript": {
-      "version": "5.9.3",
-      "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.9.3.tgz",
-      "integrity": "sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw==",
-      "dev": true,
-      "license": "Apache-2.0",
-      "bin": {
-        "tsc": "bin/tsc",
-        "tsserver": "bin/tsserver"
-      },
-      "engines": {
-        "node": ">=14.17"
-      }
-    },
-    "node_modules/undici-types": {
-      "version": "7.16.0",
-      "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-7.16.0.tgz",
-      "integrity": "sha512-Zz+aZWSj8LE6zoxD+xrjh4VfkIG8Ya6LvYkZqtUQGJPZjYl53ypCaUwWqo7eI0x66KBGeRo+mlBEkMSeSZ38Nw==",
-      "dev": true,
-      "license": "MIT"
-    },
-    "node_modules/zod": {
-      "version": "3.25.76",
-      "resolved": "https://registry.npmjs.org/zod/-/zod-3.25.76.tgz",
-      "integrity": "sha512-gzUt/qt81nXsFGKIFcC3YnfEAx5NkunCfnDlvuBSSFS02bcXu4Lmea0AFIUwbLWxWPx3d9p8S5QoaujKcNQxcQ==",
-      "license": "MIT",
-      "funding": {
-        "url": "https://github.com/sponsors/colinhacks"
-      }
-    }
-  }
-}
diff --git a/packages/cultcache-ts/package.json b/packages/cultcache-ts/package.json
index 60731b8f..67f8d5ed 100644
--- a/packages/cultcache-ts/package.json
+++ b/packages/cultcache-ts/package.json
@@ -1,6 +1,6 @@
 {
-  "name": "cultcache-ts",
-  "version": "0.13.5",
+  "name": "@gamecult/cultcache-ts",
+  "version": "0.14.0",
   "description": "CultCache-style typed persistence for TypeScript with schema-backed polymorphic MessagePack storage.",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -20,9 +20,10 @@
     "dist"
   ],
   "scripts": {
-    "build": "tsc -p tsconfig.json",
-    "typecheck": "tsc -p tsconfig.json --pretty false",
-    "test": "npm run build && tsc -p tsconfig.test.json && node --test dist-test/test/cult-cache.test.js"
+    "build": "node ../../node_modules/typescript/bin/tsc -p tsconfig.json",
+    "prepack": "node ../../node_modules/typescript/bin/tsc -p tsconfig.json",
+    "typecheck": "node ../../node_modules/typescript/bin/tsc -p tsconfig.json --pretty false",
+    "test": "node ../../node_modules/typescript/bin/tsc -p tsconfig.json && node ../../node_modules/typescript/bin/tsc -p tsconfig.test.json && node --test dist-test/test/cult-cache.test.js"
   },
   "keywords": [
     "messagepack",
@@ -34,6 +35,18 @@
   ],
   "author": "metacratic",
   "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/GameCult/CultLib.git",
+    "directory": "packages/cultcache-ts"
+  },
+  "bugs": {
+    "url": "https://github.com/GameCult/CultLib/issues"
+  },
+  "homepage": "https://github.com/GameCult/CultLib/tree/main/packages/cultcache-ts#readme",
+  "engines": {
+    "node": ">=18"
+  },
   "dependencies": {
     "@msgpack/msgpack": "^3.1.3",
     "zod": "^3.25.76"
diff --git a/packages/cultcache-ts/src/cult-cache-inspector.ts b/packages/cultcache-ts/src/cult-cache-inspector.ts
index da91da41..1301fe47 100644
--- a/packages/cultcache-ts/src/cult-cache-inspector.ts
+++ b/packages/cultcache-ts/src/cult-cache-inspector.ts
@@ -74,13 +74,31 @@ function inspectV1Snapshot(filePath: string, fileSizeBytes: number, decoded: unk
       catalogBySchemaId.set(compatibleSchemaId, entry);
     }
   }
+  const records = recordsRaw.map((record) => decodeV1Record(record, catalogBySchemaId));
+  for (const record of records) {
+    if (!catalog.some((entry) => entry.schemaId === record.schemaId)) {
+      const schemaVersion = inferSchemaVersionFromPayloadPreview(record.payloadPreview);
+      const schemaName = schemaVersion ? inferSchemaName(schemaVersion) : undefined;
+      if (schemaName) {
+        catalog.push({
+          schemaId: record.schemaId,
+          schemaName,
+          schemaVersion: schemaVersion!,
+          contentHash: record.schemaId,
+          canonicalSchemaJson: "",
+          compatibleSchemaIds: [],
+          members: [],
+        });
+      }
+    }
+  }
 
   return {
     filePath,
     fileSizeBytes,
     format: STORE_FORMAT_VERSION,
     catalog,
-    records: recordsRaw.map((record) => decodeV1Record(record, catalogBySchemaId)),
+    records,
   };
 }
 
@@ -184,8 +202,8 @@ function decodeV1Record(value: unknown, catalogBySchemaId: Map<string, Inspected
     throw new Error("CultCache persisted records must declare key, schemaId, and storedAt.");
   }
 
-  const catalogEntry = catalogBySchemaId.get(schemaId);
   const payloadBytes = normalizePayloadBytes(payload);
+  const catalogEntry = catalogBySchemaId.get(schemaId) ?? recoverCatalogEntry(schemaId, payloadBytes);
   return {
     key,
     schemaId,
@@ -196,6 +214,53 @@ function decodeV1Record(value: unknown, catalogBySchemaId: Map<string, Inspected
   };
 }
 
+function recoverCatalogEntry(schemaId: string, payload: Uint8Array): InspectedCatalogEntry | undefined {
+  let payloadPreview: unknown;
+  try {
+    payloadPreview = decode(payload);
+  } catch {
+    return undefined;
+  }
+
+  const schemaVersion = inferSchemaVersionFromPayloadPreview(payloadPreview);
+  if (!schemaVersion) {
+    return undefined;
+  }
+
+  const schemaName = inferSchemaName(schemaVersion);
+  if (!schemaName) {
+    return undefined;
+  }
+
+  return {
+    schemaId,
+    schemaName,
+    schemaVersion,
+    contentHash: schemaId,
+    canonicalSchemaJson: "",
+    compatibleSchemaIds: [],
+    members: [],
+  };
+}
+
+function inferSchemaVersionFromPayloadPreview(payloadPreview: unknown): string | undefined {
+  if (Array.isArray(payloadPreview) && typeof payloadPreview[0] === "string") {
+    return payloadPreview[0];
+  }
+
+  if (isRecord(payloadPreview)) {
+    const schemaVersion = payloadPreview.schemaVersion ?? payloadPreview.schema_version;
+    return typeof schemaVersion === "string" ? schemaVersion : undefined;
+  }
+
+  return undefined;
+}
+
+function inferSchemaName(schemaVersion: string): string | undefined {
+  const match = /^(.*)\.v\d+$/.exec(schemaVersion);
+  return match?.[1];
+}
+
 function decodeLegacyEnvelope(value: unknown): InspectedRecord {
   if (!isRecord(value)) {
     throw new Error("CultCache legacy envelopes must be MessagePack maps.");
diff --git a/packages/cultcache-ts/src/cult-cache.ts b/packages/cultcache-ts/src/cult-cache.ts
index d9f5e592..57766be9 100644
--- a/packages/cultcache-ts/src/cult-cache.ts
+++ b/packages/cultcache-ts/src/cult-cache.ts
@@ -13,32 +13,84 @@ import type {
   CultCacheStoreRegistration,
 } from "./types";
 
-type StoreRoute = {
-  primary?: CacheBackingStore;
-  mirrors: CacheBackingStore[];
-};
+type Accessor = (value: unknown) => string | undefined;
 
 type RegisteredDefinition = {
   readonly definition: AnyCultCacheDocumentDefinition;
   readonly global: boolean;
   readonly formatter: CultCacheDocumentFormatter<unknown>;
   readonly catalogEntry: CultCacheSchemaCatalogEntry;
-  nameAccessor?: (value: unknown) => string | undefined;
-  readonly indexAccessors: Map<string, (value: unknown) => string | undefined>;
+  nameAccessor?: Accessor;
+  indexAccessors: ReadonlyMap<string, Accessor>;
+};
+
+// The name and index values a record produced when it was admitted. Removing the record
+// reads these and runs no accessor, so removal has no fallible step.
+type EntryLookups = {
+  readonly name?: string;
+  readonly indexes: ReadonlyMap<string, string>;
 };
 
 type HydratedEntry = CultCacheEnvelope & {
   value: unknown;
+  lookups: EntryLookups;
 };
 
+// Everything a pull replaces. Built whole, then swapped in with one assignment.
+type HydratedState = {
+  readonly entries: Map<string, HydratedEntry>;
+  readonly typeEntryIds: Map<string, Set<string>>;
+  readonly nameToKeyMaps: Map<string, Map<string, string>>;
+  readonly indexToKeyMaps: Map<string, Map<string, string>>;
+  readonly globalKeys: Map<string, string>;
+  // Load compatibility shim: a global persisted under a key other than GLOBAL_KEY is held as that
+  // type's global under GLOBAL_KEY, and its persisted envelope is kept here so the first write or
+  // delete of that global removes it from the home store. Remove once no store holds a global under
+  // a key other than GLOBAL_KEY.
+  readonly legacyGlobals: Map<string, CultCacheEnvelope>;
+};
+
+// Lookups for every held record of one type under candidate accessors, derived before anything is installed.
+type DerivedTypeLookups = {
+  readonly entryLookups: Array<[HydratedEntry, EntryLookups]>;
+  readonly nameMap?: Map<string, string>;
+  readonly indexMaps: Map<string, Map<string, string>>;
+};
+
+function emptyHydratedState(): HydratedState {
+  return {
+    entries: new Map(),
+    typeEntryIds: new Map(),
+    nameToKeyMaps: new Map(),
+    indexToKeyMaps: new Map(),
+    globalKeys: new Map(),
+    legacyGlobals: new Map(),
+  };
+}
+
+function getOrCreate<K, V>(map: Map<K, V>, key: K, create: () => V): V {
+  let value = map.get(key);
+  if (value === undefined) {
+    value = create();
+    map.set(key, value);
+  }
+  return value;
+}
+
 type BackingStoreTypeReference = string | AnyCultCacheDocumentDefinition;
 type AccessorInput = string | ((value: any) => unknown);
 
+// Assigned in CultCache's static block. The builder's cache is unreachable until build(), so no
+// queued operation can be in flight and registration and attach may run synchronously.
+let registerNow!: (cache: CultCache, definition: AnyCultCacheDocumentDefinition) => void;
+let attachNow!: (cache: CultCache, store: CacheBackingStore, types: BackingStoreTypeReference[]) => void;
+
 export class CultCacheBuilder {
   readonly #cache = new CultCache();
+  #built = false;
 
   withDocumentType<TDefinition extends AnyCultCacheDocumentDefinition>(definition: TDefinition): this {
-    this.#cache.registerDocumentType(definition);
+    registerNow(this.#unbuilt(), definition);
     return this;
   }
 
@@ -47,7 +99,10 @@ export class CultCacheBuilder {
       | CultCacheDocumentRegistry
       | Iterable<AnyCultCacheDocumentDefinition>,
   ): this {
-    this.#cache.registerRegistry(registry);
+    const cache = this.#unbuilt();
+    for (const definition of registryDefinitions(registry)) {
+      registerNow(cache, definition);
+    }
     return this;
   }
 
@@ -55,158 +110,193 @@ export class CultCacheBuilder {
     store: CacheBackingStore,
     ...types: BackingStoreTypeReference[]
   ): this {
-    this.#cache.addBackingStore(store, ...types);
+    attachNow(this.#unbuilt(), store, types);
     return this;
   }
 
   withGenericStore(store: CacheBackingStore): this {
-    this.#cache.addGenericBackingStore(store);
+    attachNow(this.#unbuilt(), store, []);
     return this;
   }
 
   build(): CultCache {
+    this.#built = true;
     return this.#cache;
   }
+
+  #unbuilt(): CultCache {
+    if (this.#built) {
+      throw new Error("CultCacheBuilder has already built its cache; configure the cache through its own methods.");
+    }
+    return this.#cache;
+  }
+}
+
+function registryDefinitions(
+  registry: CultCacheDocumentRegistry | Iterable<AnyCultCacheDocumentDefinition>,
+): Iterable<AnyCultCacheDocumentDefinition> {
+  return Symbol.iterator in Object(registry) && !("definitions" in Object(registry))
+    ? registry as Iterable<AnyCultCacheDocumentDefinition>
+    : (registry as CultCacheDocumentRegistry).definitions;
 }
 
 export class CultCache {
   static readonly GLOBAL_KEY = "__global__";
 
+  static {
+    registerNow = (cache, definition) => cache.#registerNow(definition);
+    attachNow = (cache, store, types) => cache.#attachNow(store, types);
+  }
+
   readonly #definitions = new Map<string, RegisteredDefinition>();
   readonly #schemaIdDefinitions = new Map<string, RegisteredDefinition>();
-  readonly #entries = new Map<string, HydratedEntry>();
-  readonly #typeEntryIds = new Map<string, Set<string>>();
-  readonly #nameToKeyMaps = new Map<string, Map<string, string>>();
-  readonly #indexToKeyMaps = new Map<string, Map<string, string>>();
-  readonly #globalKeys = new Map<string, string>();
+  readonly #schemaNameDefinitions = new Map<string, RegisteredDefinition>();
+  #hydrated = emptyHydratedState();
   readonly #stores: CultCacheStoreRegistration[] = [];
+  #tail: Promise<void> = Promise.resolve();
 
   static builder(): CultCacheBuilder {
     return new CultCacheBuilder();
   }
 
+  // Attach, pull, registration and every write and delete run one at a time through this chain,
+  // so validation, the store call and applying to the cache never interleave with another
+  // mutation of this cache. Reads are not queued. Observer delivery is not scheduled here.
+  // The chain advances on its own promise; the caller gets the operation's promise, untouched, so
+  // an unawaited failure is still an unhandled rejection. A call made from inside an operation
+  // queues behind it; a store call that waits for that call waits on itself and never finishes.
+  #serial<T>(operation: () => T | Promise<T>): Promise<T> {
+    let advance!: () => void;
+    const previous = this.#tail;
+    this.#tail = new Promise<void>((resolve) => {
+      advance = resolve;
+    });
+    return previous.then(async () => {
+      try {
+        return await operation();
+      } finally {
+        advance();
+      }
+    });
+  }
+
   registerDocumentType<TDefinition extends AnyCultCacheDocumentDefinition>(
     definition: TDefinition,
-  ): TDefinition {
-    const existing = this.#definitions.get(definition.type);
-    if (existing && existing.definition !== definition) {
-      throw new Error(`CultCache already has a different definition registered for type "${definition.type}".`);
-    }
-
-    const registered = existing ?? {
-      definition,
-      global: definition.global === true,
-      formatter: this.#createFormatter(definition),
-      catalogEntry: this.#createCatalogEntry(definition),
-      nameAccessor: undefined,
-      indexAccessors: new Map<string, (value: unknown) => string | undefined>(),
-    };
-
-    registered.nameAccessor = definition.name
-      ? this.#compileAccessor(definition.type, "name", definition.name)
-      : undefined;
-    registered.indexAccessors.clear();
-    for (const [indexName, accessor] of this.#enumerateDefinitionIndexes(definition)) {
-      registered.indexAccessors.set(
-        indexName,
-        this.#compileAccessor(definition.type, `index "${indexName}"`, accessor),
-      );
-    }
-
-    this.#definitions.set(definition.type, registered);
-    for (const schemaId of registered.catalogEntry.compatibleSchemaIds ?? [registered.catalogEntry.schemaId]) {
-      const existingBySchema = this.#schemaIdDefinitions.get(schemaId);
-      if (existingBySchema && existingBySchema !== registered) {
-        throw new Error(`CultCache schema id "${schemaId}" is already registered for type "${existingBySchema.definition.type}".`);
-      }
-      this.#schemaIdDefinitions.set(schemaId, registered);
-    }
-    this.#rebuildDefinitionLookups(registered);
-    return definition;
+  ): Promise<TDefinition> {
+    return this.#serial(() => {
+      this.#registerNow(definition);
+      return definition;
+    });
   }
 
   registerRegistry(
     registry:
       | CultCacheDocumentRegistry
       | Iterable<AnyCultCacheDocumentDefinition>,
-  ): this {
-    const definitions = Symbol.iterator in Object(registry) && !("definitions" in Object(registry))
-      ? registry as Iterable<AnyCultCacheDocumentDefinition>
-      : (registry as CultCacheDocumentRegistry).definitions;
-
-    for (const definition of definitions) {
-      this.registerDocumentType(definition);
-    }
-
-    return this;
+  ): Promise<void> {
+    return this.#serial(() => {
+      for (const definition of registryDefinitions(registry)) {
+        this.#registerNow(definition);
+      }
+    });
   }
 
   registerNameLookup<TDefinition extends AnyCultCacheDocumentDefinition>(
     definition: TDefinition,
     accessor: CultCacheDocumentAccessor<CultCacheDocumentValue<TDefinition>>,
-  ): TDefinition {
-    const registered = this.#requireDefinition(definition);
-    registered.nameAccessor = this.#compileAccessor(definition.type, "name", accessor);
-    this.#rebuildNameLookup(registered);
-    return definition;
+  ): Promise<TDefinition> {
+    return this.#serial(() => {
+      const registered = this.#requireDefinition(definition);
+      const nameAccessor = this.#compileAccessor(definition.type, "name", accessor);
+      const derived = this.#deriveTypeLookups(definition.type, nameAccessor, registered.indexAccessors);
+      this.#installAccessors(registered, nameAccessor, registered.indexAccessors, derived);
+      return definition;
+    });
   }
 
   registerIndex<TDefinition extends AnyCultCacheDocumentDefinition>(
     definition: TDefinition,
     indexName: string,
     accessor: CultCacheDocumentAccessor<CultCacheDocumentValue<TDefinition>>,
-  ): TDefinition {
-    if (!indexName || indexName.trim().length === 0) {
-      throw new Error(`CultCache index names for type "${definition.type}" must be non-empty.`);
-    }
+  ): Promise<TDefinition> {
+    return this.#serial(() => {
+      if (!indexName || indexName.trim().length === 0) {
+        throw new Error(`CultCache index names for type "${definition.type}" must be non-empty.`);
+      }
 
-    const registered = this.#requireDefinition(definition);
-    registered.indexAccessors.set(
-      indexName,
-      this.#compileAccessor(definition.type, `index "${indexName}"`, accessor),
-    );
-    this.#rebuildIndexLookup(registered, indexName);
-    return definition;
+      const registered = this.#requireDefinition(definition);
+      const indexAccessors = new Map(registered.indexAccessors);
+      indexAccessors.set(indexName, this.#compileAccessor(definition.type, `index "${indexName}"`, accessor));
+      const derived = this.#deriveTypeLookups(definition.type, registered.nameAccessor, indexAccessors);
+      this.#installAccessors(registered, registered.nameAccessor, indexAccessors, derived);
+      return definition;
+    });
   }
 
   addBackingStore(
     store: CacheBackingStore,
     ...types: BackingStoreTypeReference[]
-  ): void {
-    this.#stores.push({
-      store,
-      types: [...new Set(types.map((value) => (typeof value === "string" ? value : value.type)))],
-    });
+  ): Promise<void> {
+    return this.#serial(() => this.#attachNow(store, types));
   }
 
-  addGenericBackingStore(store: CacheBackingStore): void {
-    this.addBackingStore(store);
+  addGenericBackingStore(store: CacheBackingStore): Promise<void> {
+    return this.addBackingStore(store);
   }
 
-  async pullAllBackingStores(): Promise<void> {
-    this.#resetHydratedState();
+  // The complete next state (entries, globals, name and index lookups) is built into a fresh
+  // HydratedState, running every check and every user accessor, and replaces the cache's state
+  // in one assignment only once the build finishes. A refused load admits nothing.
+  pullAllBackingStores(): Promise<void> {
+    return this.#serial(async () => {
+      const next = emptyHydratedState();
+      const persistedGlobalKeys = new Map<string, string>();
 
-    for (const registration of this.#stores) {
-      const entries = await registration.store.pullAll();
+      for (const registration of this.#stores) {
+        const entries = await registration.store.pullAll();
 
-      for (const entry of entries) {
-        const registered = this.#resolveDefinitionForEnvelope(entry);
-        if (!registered) {
-          throw new Error(
-            entry.schemaId
-              ? `No schema is registered for persisted schema id "${entry.schemaId}".`
-              : `No schema is registered for persisted document type "${entry.type}".`,
-          );
+        for (const entry of entries) {
+          const registered = this.#resolveDefinitionForEnvelope(entry);
+          if (!registered) {
+            throw new Error(
+              entry.schemaId
+                ? `No schema is registered for persisted schema id "${entry.schemaId}".`
+                : `No schema is registered for persisted document type "${entry.type}".`,
+            );
+          }
+
+          const type = registered.definition.type;
+          const home = this.#resolveRegistration(type);
+          if (home?.store !== registration.store) {
+            throw new Error(
+              `CultCache "${type}" record "${entry.key}" was loaded from ${this.#describe(registration)}, ` +
+                `but its home is ${this.#describe(home)}.`,
+            );
+          }
+
+          const payload = this.#cloneBytes(entry.payload);
+          const value = registered.formatter.decode(payload);
+          let admitted: CultCacheEnvelope = { ...entry, type, payload };
+          if (registered.global) {
+            const persistedKey = persistedGlobalKeys.get(type);
+            if (persistedKey !== undefined) {
+              throw new Error(
+                `CultCache global document type "${type}" has multiple persisted entries: "${persistedKey}" and "${entry.key}".`,
+              );
+            }
+            persistedGlobalKeys.set(type, entry.key);
+            if (entry.key !== CultCache.GLOBAL_KEY) {
+              next.legacyGlobals.set(type, admitted);
+              admitted = { ...admitted, key: CultCache.GLOBAL_KEY };
+            }
+          }
+          const hydrated = this.#admitEntry(next, registered, admitted, value);
+          this.#installEntry(next, registered, hydrated);
         }
-
-        const payload = this.#cloneBytes(entry.payload);
-        const value = registered.formatter.decode(payload);
-        this.#applyHydratedEntry(registered, {
-          ...entry,
-          payload,
-        }, value, "pull");
       }
-    }
+
+      this.#hydrated = next;
+    });
   }
 
   get<TDefinition extends AnyCultCacheDocumentDefinition>(
@@ -214,7 +304,7 @@ export class CultCache {
     key: string,
   ): CultCacheDocumentValue<TDefinition> | undefined {
     this.#requireDefinition(definition);
-    const entry = this.#entries.get(this.#entryId(definition.type, key));
+    const entry = this.#hydrated.entries.get(this.#entryId(definition.type, key));
     return entry ? (entry.value as CultCacheDocumentValue<TDefinition>) : undefined;
   }
 
@@ -235,7 +325,7 @@ export class CultCache {
     key: string,
   ): CultCacheEnvelope | undefined {
     this.#requireDefinition(definition);
-    const entry = this.#entries.get(this.#entryId(definition.type, key));
+    const entry = this.#hydrated.entries.get(this.#entryId(definition.type, key));
     return entry ? this.#toEnvelope(entry) : undefined;
   }
 
@@ -254,12 +344,8 @@ export class CultCache {
   getGlobal<TDefinition extends AnyCultCacheDocumentDefinition>(
     definition: TDefinition,
   ): CultCacheDocumentValue<TDefinition> | undefined {
-    const registered = this.#requireDefinition(definition);
-    if (!registered.global) {
-      throw new Error(`CultCache document type "${definition.type}" is not marked as global.`);
-    }
-
-    const globalKey = this.#globalKeys.get(definition.type);
+    this.#requireGlobal(definition);
+    const globalKey = this.#hydrated.globalKeys.get(definition.type);
     return globalKey ? this.get(definition, globalKey) : undefined;
   }
 
@@ -277,12 +363,8 @@ export class CultCache {
   getGlobalEnvelope<TDefinition extends AnyCultCacheDocumentDefinition>(
     definition: TDefinition,
   ): CultCacheEnvelope | undefined {
-    const registered = this.#requireDefinition(definition);
-    if (!registered.global) {
-      throw new Error(`CultCache document type "${definition.type}" is not marked as global.`);
-    }
-
-    const globalKey = this.#globalKeys.get(definition.type);
+    this.#requireGlobal(definition);
+    const globalKey = this.#hydrated.globalKeys.get(definition.type);
     return globalKey ? this.getEnvelope(definition, globalKey) : undefined;
   }
 
@@ -290,21 +372,7 @@ export class CultCache {
     definition: TDefinition,
   ): CultCacheDocumentValue<TDefinition>[] {
     this.#requireDefinition(definition);
-    const values: CultCacheDocumentValue<TDefinition>[] = [];
-    const entryIds = this.#typeEntryIds.get(definition.type);
-
-    if (!entryIds) {
-      return values;
-    }
-
-    for (const entryId of entryIds) {
-      const entry = this.#entries.get(entryId);
-      if (entry) {
-        values.push(entry.value as CultCacheDocumentValue<TDefinition>);
-      }
-    }
-
-    return values;
+    return this.#entriesForType(definition.type).map((entry) => entry.value as CultCacheDocumentValue<TDefinition>);
   }
 
   getKeyByName<TDefinition extends AnyCultCacheDocumentDefinition>(
@@ -316,7 +384,7 @@ export class CultCache {
       return undefined;
     }
 
-    return this.#nameToKeyMaps.get(definition.type)?.get(name);
+    return this.#hydrated.nameToKeyMaps.get(definition.type)?.get(name);
   }
 
   getIdByName<TDefinition extends AnyCultCacheDocumentDefinition>(
@@ -340,7 +408,7 @@ export class CultCache {
     value: string,
   ): string | undefined {
     this.#requireDefinition(definition);
-    return this.#indexToKeyMaps.get(this.#indexId(definition.type, indexName))?.get(value);
+    return this.#hydrated.indexToKeyMaps.get(this.#indexId(definition.type, indexName))?.get(value);
   }
 
   getIdByIndex<TDefinition extends AnyCultCacheDocumentDefinition>(
@@ -360,12 +428,180 @@ export class CultCache {
     return key ? this.get(definition, key) : undefined;
   }
 
-  async put<TDefinition extends AnyCultCacheDocumentDefinition>(
+  put<TDefinition extends AnyCultCacheDocumentDefinition>(
+    definition: TDefinition,
+    key: string,
+    value: CultCacheDocumentValue<TDefinition>,
+  ): Promise<CultCacheDocumentValue<TDefinition>> {
+    return this.#serial(() => this.#putNow(definition, key, value));
+  }
+
+  putEnvelope<TDefinition extends AnyCultCacheDocumentDefinition>(
+    definition: TDefinition,
+    envelope: CultCacheEnvelope,
+  ): Promise<CultCacheDocumentValue<TDefinition>> {
+    return this.#serial(async () => {
+      const registered = this.#requireDefinition(definition);
+      if (envelope.type !== definition.type) {
+        throw new Error(
+          `CultCache envelope type "${envelope.type}" does not match definition "${definition.type}".`,
+        );
+      }
+      if (!envelope.key || envelope.key.trim().length === 0) {
+        throw new Error(`CultCache envelope key for type "${definition.type}" must be non-empty.`);
+      }
+      if (!envelope.storedAt || envelope.storedAt.trim().length === 0) {
+        throw new Error(`CultCache envelope storedAt for type "${definition.type}" must be non-empty.`);
+      }
+      this.#requireGlobalKey(registered, envelope.key);
+
+      const payload = this.#cloneBytes(envelope.payload);
+      const parsed = registered.formatter.decode(payload) as CultCacheDocumentValue<TDefinition>;
+      const entry: CultCacheEnvelope = {
+        key: envelope.key,
+        type: envelope.type,
+        payload,
+        storedAt: envelope.storedAt,
+        schemaId: envelope.schemaId ?? registered.catalogEntry.schemaId,
+        catalogEntry: envelope.catalogEntry ?? registered.catalogEntry,
+      };
+      await this.#writeNow(registered, entry, parsed);
+      return parsed;
+    });
+  }
+
+  putGlobal<TDefinition extends AnyCultCacheDocumentDefinition>(
+    definition: TDefinition,
+    value: CultCacheDocumentValue<TDefinition>,
+  ): Promise<CultCacheDocumentValue<TDefinition>> {
+    return this.#serial(() => {
+      this.#requireGlobal(definition);
+      return this.#putNow(definition, CultCache.GLOBAL_KEY, value);
+    });
+  }
+
+  update<TDefinition extends AnyCultCacheDocumentDefinition>(
+    definition: TDefinition,
+    key: string,
+    updater: (
+      current: CultCacheDocumentValue<TDefinition> | undefined,
+    ) => CultCacheDocumentValue<TDefinition>,
+  ): Promise<CultCacheDocumentValue<TDefinition>> {
+    return this.#serial(() => this.#putNow(definition, key, updater(this.get(definition, key))));
+  }
+
+  updateGlobal<TDefinition extends AnyCultCacheDocumentDefinition>(
+    definition: TDefinition,
+    updater: (
+      current: CultCacheDocumentValue<TDefinition> | undefined,
+    ) => CultCacheDocumentValue<TDefinition>,
+  ): Promise<CultCacheDocumentValue<TDefinition>> {
+    return this.#serial(() =>
+      this.#putNow(definition, CultCache.GLOBAL_KEY, updater(this.getGlobal(definition))),
+    );
+  }
+
+  delete<TDefinition extends AnyCultCacheDocumentDefinition>(
+    definition: TDefinition,
+    key: string,
+  ): Promise<boolean> {
+    return this.#serial(() => this.#deleteNow(definition, key));
+  }
+
+  deleteGlobal<TDefinition extends AnyCultCacheDocumentDefinition>(
+    definition: TDefinition,
+  ): Promise<boolean> {
+    return this.#serial(async () => {
+      this.#requireGlobal(definition);
+      const globalKey = this.#hydrated.globalKeys.get(definition.type);
+      return globalKey ? this.#deleteNow(definition, globalKey) : false;
+    });
+  }
+
+  snapshot(): CultCacheEnvelope[] {
+    return [...this.#hydrated.entries.values()].map((entry) => this.#toEnvelope(entry));
+  }
+
+  #registerNow(definition: AnyCultCacheDocumentDefinition): void {
+    const existing = this.#definitions.get(definition.type);
+    if (existing && existing.definition !== definition) {
+      throw new Error(`CultCache already has a different definition registered for type "${definition.type}".`);
+    }
+
+    const registered: RegisteredDefinition = existing ?? {
+      definition,
+      global: definition.global === true,
+      formatter: this.#createFormatter(definition),
+      catalogEntry: this.#createCatalogEntry(definition),
+      nameAccessor: undefined,
+      indexAccessors: new Map<string, Accessor>(),
+    };
+
+    const nameAccessor = definition.name
+      ? this.#compileAccessor(definition.type, "name", definition.name)
+      : undefined;
+    const indexAccessors = new Map<string, Accessor>();
+    for (const [indexName, accessor] of this.#enumerateDefinitionIndexes(definition)) {
+      indexAccessors.set(indexName, this.#compileAccessor(definition.type, `index "${indexName}"`, accessor));
+    }
+
+    const schemaIds = registered.catalogEntry.compatibleSchemaIds ?? [registered.catalogEntry.schemaId];
+    for (const schemaId of schemaIds) {
+      const existingBySchema = this.#schemaIdDefinitions.get(schemaId);
+      if (existingBySchema && existingBySchema !== registered) {
+        throw new Error(`CultCache schema id "${schemaId}" is already registered for type "${existingBySchema.definition.type}".`);
+      }
+    }
+    const existingBySchemaName = this.#schemaNameDefinitions.get(registered.catalogEntry.schemaName);
+    if (existingBySchemaName && existingBySchemaName !== registered) {
+      throw new Error(
+        `CultCache schema name "${registered.catalogEntry.schemaName}" is already registered for type "${existingBySchemaName.definition.type}".`,
+      );
+    }
+    const derived = this.#deriveTypeLookups(definition.type, nameAccessor, indexAccessors);
+
+    // Every check and accessor has run; install.
+    this.#definitions.set(definition.type, registered);
+    for (const schemaId of schemaIds) {
+      this.#schemaIdDefinitions.set(schemaId, registered);
+    }
+    this.#schemaNameDefinitions.set(registered.catalogEntry.schemaName, registered);
+    this.#installAccessors(registered, nameAccessor, indexAccessors, derived);
+  }
+
+  #attachNow(store: CacheBackingStore, types: BackingStoreTypeReference[]): void {
+    const claimed = [...new Set(types.map((value) => (typeof value === "string" ? value : value.type)))];
+    if (claimed.length === 0 && this.#stores.some((registration) => registration.types.length === 0)) {
+      throw new Error("Backing store would be a second generic store; name the types it is home to.");
+    }
+    for (const type of claimed) {
+      if (this.#stores.some((registration) => registration.types.includes(type))) {
+        throw new Error(`CultCache type "${type}" is already routed to another backing store; it cannot also route to this one.`);
+      }
+    }
+    const candidate: CultCacheStoreRegistration = { store, types: claimed };
+    for (const type of this.#hydrated.typeEntryIds.keys()) {
+      const before = this.#resolveRegistration(type);
+      this.#stores.push(candidate);
+      const after = this.#resolveRegistration(type);
+      this.#stores.pop();
+      if (before !== after) {
+        throw new Error(
+          `Attaching this backing store would move "${type}" from ${this.#describe(before)} to ${this.#describe(after)}; ` +
+            "attach routed stores before the generic store.",
+        );
+      }
+    }
+    this.#stores.push(candidate);
+  }
+
+  async #putNow<TDefinition extends AnyCultCacheDocumentDefinition>(
     definition: TDefinition,
     key: string,
     value: CultCacheDocumentValue<TDefinition>,
   ): Promise<CultCacheDocumentValue<TDefinition>> {
     const registered = this.#requireDefinition(definition);
+    this.#requireGlobalKey(registered, key);
     const payload = registered.formatter.encode(value);
     const parsed = registered.formatter.decode(payload) as CultCacheDocumentValue<TDefinition>;
     const entry: CultCacheEnvelope = {
@@ -376,140 +612,67 @@ export class CultCache {
       schemaId: registered.catalogEntry.schemaId,
       catalogEntry: registered.catalogEntry,
     };
-
-    const route = this.#resolveRoute(definition.type);
-    if (!route.primary) {
-      throw new Error(`No backing store is registered for document type "${definition.type}".`);
-    }
-
-    if (registered.global) {
-      const existingGlobalKey = this.#globalKeys.get(definition.type);
-      if (existingGlobalKey && existingGlobalKey !== key) {
-        await this.delete(definition, existingGlobalKey);
-      }
-    }
-
-    await route.primary.push(entry);
-    await Promise.all(route.mirrors.map(async (mirror) => mirror.push(entry)));
-    this.#applyHydratedEntry(registered, entry, parsed, "put");
+    await this.#writeNow(registered, entry, parsed);
     return parsed;
   }
 
-  async putEnvelope<TDefinition extends AnyCultCacheDocumentDefinition>(
-    definition: TDefinition,
-    envelope: CultCacheEnvelope,
-  ): Promise<CultCacheDocumentValue<TDefinition>> {
-    const registered = this.#requireDefinition(definition);
-    if (envelope.type !== definition.type) {
-      throw new Error(
-        `CultCache envelope type "${envelope.type}" does not match definition "${definition.type}".`,
-      );
+  // Validates the whole write (home, global singleton, name and index accessors) before the store
+  // is touched; once the store accepts, applying to the cache has no fallible step.
+  async #writeNow(registered: RegisteredDefinition, entry: CultCacheEnvelope, value: unknown): Promise<void> {
+    const home = this.#homeStore(entry.type);
+    const hydrated = this.#admitEntry(this.#hydrated, registered, entry, value);
+    const legacy = this.#hydrated.legacyGlobals.get(entry.type);
+    await home?.push(entry);
+    if (home && legacy) {
+      await this.#retireLegacyGlobal(home, legacy, entry);
     }
-    if (!envelope.key || envelope.key.trim().length === 0) {
-      throw new Error(`CultCache envelope key for type "${definition.type}" must be non-empty.`);
-    }
-    if (!envelope.storedAt || envelope.storedAt.trim().length === 0) {
-      throw new Error(`CultCache envelope storedAt for type "${definition.type}" must be non-empty.`);
-    }
-
-    const payload = this.#cloneBytes(envelope.payload);
-    const parsed = registered.formatter.decode(payload) as CultCacheDocumentValue<TDefinition>;
-    const entry: CultCacheEnvelope = {
-      key: envelope.key,
-      type: envelope.type,
-      payload,
-      storedAt: envelope.storedAt,
-      schemaId: envelope.schemaId ?? registered.catalogEntry.schemaId,
-      catalogEntry: envelope.catalogEntry ?? registered.catalogEntry,
-    };
-
-    const route = this.#resolveRoute(definition.type);
-    if (!route.primary) {
-      throw new Error(`No backing store is registered for document type "${definition.type}".`);
-    }
-
-    if (registered.global) {
-      const existingGlobalKey = this.#globalKeys.get(definition.type);
-      if (existingGlobalKey && existingGlobalKey !== entry.key) {
-        await this.delete(definition, existingGlobalKey);
-      }
-    }
-
-    await route.primary.push(entry);
-    await Promise.all(route.mirrors.map(async (mirror) => mirror.push(entry)));
-    this.#applyHydratedEntry(registered, entry, parsed, "put");
-    return parsed;
+    this.#hydrated.legacyGlobals.delete(entry.type);
+    this.#installEntry(this.#hydrated, registered, hydrated);
   }
 
-  async putGlobal<TDefinition extends AnyCultCacheDocumentDefinition>(
-    definition: TDefinition,
-    value: CultCacheDocumentValue<TDefinition>,
-  ): Promise<CultCacheDocumentValue<TDefinition>> {
-    const registered = this.#requireDefinition(definition);
-    if (!registered.global) {
-      throw new Error(`CultCache document type "${definition.type}" is not marked as global.`);
+  // The first write of a global loaded from a legacy key removes that record in the same write. If the
+  // removal fails, the new record is taken back out, so the store keeps only the legacy record.
+  async #retireLegacyGlobal(home: CacheBackingStore, legacy: CultCacheEnvelope, written: CultCacheEnvelope): Promise<void> {
+    try {
+      await home.delete(legacy);
+    } catch (error) {
+      await home.delete(written).catch(() => undefined);
+      throw error;
     }
-
-    return this.put(definition, CultCache.GLOBAL_KEY, value);
   }
 
-  async update<TDefinition extends AnyCultCacheDocumentDefinition>(
-    definition: TDefinition,
-    key: string,
-    updater: (
-      current: CultCacheDocumentValue<TDefinition> | undefined,
-    ) => CultCacheDocumentValue<TDefinition>,
-  ): Promise<CultCacheDocumentValue<TDefinition>> {
-    const current = this.get(definition, key);
-    return this.put(definition, key, updater(current));
-  }
-
-  async updateGlobal<TDefinition extends AnyCultCacheDocumentDefinition>(
-    definition: TDefinition,
-    updater: (
-      current: CultCacheDocumentValue<TDefinition> | undefined,
-    ) => CultCacheDocumentValue<TDefinition>,
-  ): Promise<CultCacheDocumentValue<TDefinition>> {
-    const current = this.getGlobal(definition);
-    return this.putGlobal(definition, updater(current));
-  }
-
-  async delete<TDefinition extends AnyCultCacheDocumentDefinition>(
+  async #deleteNow<TDefinition extends AnyCultCacheDocumentDefinition>(
     definition: TDefinition,
     key: string,
   ): Promise<boolean> {
     const registered = this.#requireDefinition(definition);
-    const entry = this.#entries.get(this.#entryId(definition.type, key));
+    const entry = this.#hydrated.entries.get(this.#entryId(definition.type, key));
     if (!entry) {
       return false;
     }
 
-    const route = this.#resolveRoute(definition.type);
-    if (!route.primary) {
-      throw new Error(`No backing store is registered for document type "${definition.type}".`);
-    }
-
-    const envelope = this.#toEnvelope(entry);
-    await route.primary.delete(envelope);
-    await Promise.all(route.mirrors.map(async (mirror) => mirror.delete(envelope)));
-    this.#removeHydratedEntry(registered, entry);
+    const home = this.#homeStore(definition.type);
+    await home?.delete(this.#hydrated.legacyGlobals.get(definition.type) ?? this.#toEnvelope(entry));
+    this.#hydrated.legacyGlobals.delete(definition.type);
+    this.#removeEntry(this.#hydrated, registered, entry);
     return true;
   }
 
-  async deleteGlobal<TDefinition extends AnyCultCacheDocumentDefinition>(
-    definition: TDefinition,
-  ): Promise<boolean> {
+  #requireGlobal(definition: AnyCultCacheDocumentDefinition): RegisteredDefinition {
     const registered = this.#requireDefinition(definition);
     if (!registered.global) {
       throw new Error(`CultCache document type "${definition.type}" is not marked as global.`);
     }
-
-    const globalKey = this.#globalKeys.get(definition.type);
-    return globalKey ? this.delete(definition, globalKey) : false;
+    return registered;
   }
 
-  snapshot(): CultCacheEnvelope[] {
-    return [...this.#entries.values()].map((entry) => this.#toEnvelope(entry));
+  // A global is only ever stored under GLOBAL_KEY; any other key is refused before a store is touched.
+  #requireGlobalKey(registered: RegisteredDefinition, key: string): void {
+    if (registered.global && key !== CultCache.GLOBAL_KEY) {
+      throw new Error(
+        `CultCache global document type "${registered.definition.type}" must use key "${CultCache.GLOBAL_KEY}", not "${key}".`,
+      );
+    }
   }
 
   #createFormatter(definition: AnyCultCacheDocumentDefinition): CultCacheDocumentFormatter<unknown> {
@@ -594,7 +757,7 @@ export class CultCache {
     type: string,
     label: string,
     accessor: AccessorInput,
-  ): (value: unknown) => string | undefined {
+  ): Accessor {
     if (typeof accessor === "function") {
       return (value: unknown) => this.#normalizeIndexValue(type, label, accessor(value));
     }
@@ -643,165 +806,203 @@ export class CultCache {
 
   #resolveDefinitionForEnvelope(entry: CultCacheEnvelope): RegisteredDefinition | undefined {
     if (entry.schemaId) {
-      return this.#schemaIdDefinitions.get(entry.schemaId) ?? this.#definitions.get(entry.type);
+      return this.#schemaIdDefinitions.get(entry.schemaId)
+        ?? this.#schemaNameDefinitions.get(entry.type)
+        ?? this.#definitions.get(entry.type);
     }
 
-    return this.#definitions.get(entry.type);
+    return this.#schemaNameDefinitions.get(entry.type) ?? this.#definitions.get(entry.type);
   }
 
-  #resolveRoute(type: string): StoreRoute {
-    const typeSpecific = this.#stores.filter((registration) => registration.types.includes(type));
-    if (typeSpecific.length > 0) {
-      return {
-        primary: typeSpecific[0]?.store,
-        mirrors: typeSpecific.slice(1).map((registration) => registration.store),
-      };
+  // The registration that claims the type, else the generic one. Registration guarantees at most one of each.
+  #resolveRegistration(type: string): CultCacheStoreRegistration | undefined {
+    return this.#stores.find((registration) => registration.types.includes(type))
+      ?? this.#stores.find((registration) => registration.types.length === 0);
+  }
+
+  // A cache with no stores is in memory: undefined. Once any store is attached, a type with no home is an error.
+  #homeStore(type: string): CacheBackingStore | undefined {
+    if (this.#stores.length === 0) {
+      return undefined;
     }
-
-    const generic = this.#stores.filter((registration) => registration.types.length === 0);
-    return {
-      primary: generic[0]?.store,
-      mirrors: generic.slice(1).map((registration) => registration.store),
-    };
+    const home = this.#resolveRegistration(type);
+    if (!home) {
+      throw new Error(`No backing store is registered for document type "${type}".`);
+    }
+    return home.store;
   }
 
-  #applyHydratedEntry(
+  #describe(registration: CultCacheStoreRegistration | undefined): string {
+    if (!registration) {
+      return "memory";
+    }
+    return registration.types.length === 0
+      ? "the generic store"
+      : `the store routed to ${registration.types.join(", ")}`;
+  }
+
+  #lookupsFor(
+    nameAccessor: Accessor | undefined,
+    indexAccessors: ReadonlyMap<string, Accessor>,
+    value: unknown,
+  ): EntryLookups {
+    const name = nameAccessor?.(value);
+    const indexes = new Map<string, string>();
+    for (const [indexName, accessor] of indexAccessors) {
+      const indexValue = accessor(value);
+      if (indexValue !== undefined) {
+        indexes.set(indexName, indexValue);
+      }
+    }
+    return { name, indexes };
+  }
+
+  // Fallible half of admission: the global singleton check and every user accessor. Touches no state.
+  #admitEntry(
+    state: HydratedState,
     registered: RegisteredDefinition,
     entry: CultCacheEnvelope,
     value: unknown,
-    source: "pull" | "put",
-  ): void {
-    const entryId = this.#entryId(entry.type, entry.key);
-    const existing = this.#entries.get(entryId);
-    if (existing) {
-      this.#removeHydratedEntry(registered, existing);
-    }
-
+  ): HydratedEntry {
     if (registered.global) {
-      const currentGlobalKey = this.#globalKeys.get(entry.type);
-      if (currentGlobalKey && currentGlobalKey !== entry.key) {
+      const currentGlobalKey = state.globalKeys.get(entry.type);
+      if (currentGlobalKey !== undefined && currentGlobalKey !== entry.key) {
         throw new Error(
-          source === "pull"
-            ? `CultCache global document type "${entry.type}" has multiple persisted entries.`
-            : `CultCache global document type "${entry.type}" already has a different key "${currentGlobalKey}".`,
+          `CultCache global document type "${entry.type}" has multiple persisted entries: "${currentGlobalKey}" and "${entry.key}".`,
         );
       }
     }
 
-    const hydrated: HydratedEntry = {
+    return {
       ...entry,
       payload: this.#cloneBytes(entry.payload),
       schemaId: entry.schemaId ?? registered.catalogEntry.schemaId,
       catalogEntry: entry.catalogEntry ?? registered.catalogEntry,
       value,
+      lookups: this.#lookupsFor(registered.nameAccessor, registered.indexAccessors, value),
     };
-    this.#entries.set(entryId, hydrated);
-    this.#getOrCreateTypeEntrySet(entry.type).add(entryId);
+  }
 
+  // Infallible half of admission: replaces any held record at the same key and installs the admitted one.
+  #installEntry(state: HydratedState, registered: RegisteredDefinition, hydrated: HydratedEntry): void {
+    const entryId = this.#entryId(hydrated.type, hydrated.key);
+    const existing = state.entries.get(entryId);
+    if (existing) {
+      this.#removeEntry(state, registered, existing);
+    }
+
+    state.entries.set(entryId, hydrated);
+    getOrCreate(state.typeEntryIds, hydrated.type, () => new Set<string>()).add(entryId);
     if (registered.global) {
-      this.#globalKeys.set(entry.type, entry.key);
+      state.globalKeys.set(hydrated.type, hydrated.key);
     }
-
-    if (registered.nameAccessor) {
-      const name = registered.nameAccessor(value);
-      if (name !== undefined) {
-        this.#getOrCreateNameMap(entry.type).set(name, entry.key);
-      }
+    if (hydrated.lookups.name !== undefined) {
+      getOrCreate(state.nameToKeyMaps, hydrated.type, () => new Map<string, string>()).set(hydrated.lookups.name, hydrated.key);
     }
-
-    for (const [indexName, accessor] of registered.indexAccessors) {
-      const indexValue = accessor(value);
-      if (indexValue !== undefined) {
-        this.#getOrCreateIndexMap(entry.type, indexName).set(indexValue, entry.key);
-      }
+    for (const [indexName, indexValue] of hydrated.lookups.indexes) {
+      getOrCreate(state.indexToKeyMaps, this.#indexId(hydrated.type, indexName), () => new Map<string, string>())
+        .set(indexValue, hydrated.key);
     }
   }
 
-  #removeHydratedEntry(
+  // Reads the lookups stored at admission; runs no accessor.
+  #removeEntry(
+    state: HydratedState,
     registered: RegisteredDefinition,
     entry: HydratedEntry,
   ): void {
     const entryId = this.#entryId(entry.type, entry.key);
-    this.#entries.delete(entryId);
+    state.entries.delete(entryId);
 
-    const typeEntryIds = this.#typeEntryIds.get(entry.type);
+    const typeEntryIds = state.typeEntryIds.get(entry.type);
     if (typeEntryIds) {
       typeEntryIds.delete(entryId);
       if (typeEntryIds.size === 0) {
-        this.#typeEntryIds.delete(entry.type);
+        state.typeEntryIds.delete(entry.type);
       }
     }
 
-    if (registered.global && this.#globalKeys.get(entry.type) === entry.key) {
-      this.#globalKeys.delete(entry.type);
+    if (registered.global && state.globalKeys.get(entry.type) === entry.key) {
+      state.globalKeys.delete(entry.type);
     }
 
-    if (registered.nameAccessor) {
-      const name = registered.nameAccessor(entry.value);
-      if (name !== undefined) {
-        this.#nameToKeyMaps.get(entry.type)?.delete(name);
+    if (entry.lookups.name !== undefined) {
+      const names = state.nameToKeyMaps.get(entry.type);
+      if (names?.get(entry.lookups.name) === entry.key) {
+        names.delete(entry.lookups.name);
       }
     }
-
-    for (const [indexName, accessor] of registered.indexAccessors) {
-      const value = accessor(entry.value);
-      if (value !== undefined) {
-        this.#indexToKeyMaps.get(this.#indexId(entry.type, indexName))?.delete(value);
+    for (const [indexName, indexValue] of entry.lookups.indexes) {
+      const index = state.indexToKeyMaps.get(this.#indexId(entry.type, indexName));
+      if (index?.get(indexValue) === entry.key) {
+        index.delete(indexValue);
       }
     }
   }
 
-  #rebuildDefinitionLookups(registered: RegisteredDefinition): void {
-    this.#rebuildNameLookup(registered);
+  // Runs the candidate accessors over every held record of the type into local maps.
+  #deriveTypeLookups(
+    type: string,
+    nameAccessor: Accessor | undefined,
+    indexAccessors: ReadonlyMap<string, Accessor>,
+  ): DerivedTypeLookups {
+    const entryLookups: Array<[HydratedEntry, EntryLookups]> = [];
+    const nameMap = nameAccessor ? new Map<string, string>() : undefined;
+    const indexMaps = new Map<string, Map<string, string>>();
+    for (const indexName of indexAccessors.keys()) {
+      indexMaps.set(indexName, new Map());
+    }
 
+    for (const entry of this.#entriesForType(type)) {
+      const lookups = this.#lookupsFor(nameAccessor, indexAccessors, entry.value);
+      entryLookups.push([entry, lookups]);
+      if (lookups.name !== undefined) {
+        nameMap?.set(lookups.name, entry.key);
+      }
+      for (const [indexName, indexValue] of lookups.indexes) {
+        indexMaps.get(indexName)?.set(indexValue, entry.key);
+      }
+    }
+
+    return { entryLookups, nameMap, indexMaps };
+  }
+
+  // Installs accessors and their derived lookups together. Nothing here can throw.
+  #installAccessors(
+    registered: RegisteredDefinition,
+    nameAccessor: Accessor | undefined,
+    indexAccessors: ReadonlyMap<string, Accessor>,
+    derived: DerivedTypeLookups,
+  ): void {
+    const type = registered.definition.type;
     for (const indexName of registered.indexAccessors.keys()) {
-      this.#rebuildIndexLookup(registered, indexName);
-    }
-  }
-
-  #rebuildNameLookup(registered: RegisteredDefinition): void {
-    this.#nameToKeyMaps.delete(registered.definition.type);
-
-    if (!registered.nameAccessor) {
-      return;
+      this.#hydrated.indexToKeyMaps.delete(this.#indexId(type, indexName));
     }
 
-    const map = this.#getOrCreateNameMap(registered.definition.type);
-    for (const entry of this.#entriesForType(registered.definition.type)) {
-      const name = registered.nameAccessor(entry.value);
-      if (name !== undefined) {
-        map.set(name, entry.key);
-      }
+    registered.nameAccessor = nameAccessor;
+    registered.indexAccessors = indexAccessors;
+    for (const [entry, lookups] of derived.entryLookups) {
+      entry.lookups = lookups;
     }
-  }
-
-  #rebuildIndexLookup(registered: RegisteredDefinition, indexName: string): void {
-    const lookupId = this.#indexId(registered.definition.type, indexName);
-    this.#indexToKeyMaps.delete(lookupId);
-
-    const accessor = registered.indexAccessors.get(indexName);
-    if (!accessor) {
-      return;
+    if (derived.nameMap) {
+      this.#hydrated.nameToKeyMaps.set(type, derived.nameMap);
+    } else {
+      this.#hydrated.nameToKeyMaps.delete(type);
     }
-
-    const map = this.#getOrCreateIndexMap(registered.definition.type, indexName);
-    for (const entry of this.#entriesForType(registered.definition.type)) {
-      const value = accessor(entry.value);
-      if (value !== undefined) {
-        map.set(value, entry.key);
-      }
+    for (const [indexName, map] of derived.indexMaps) {
+      this.#hydrated.indexToKeyMaps.set(this.#indexId(type, indexName), map);
     }
   }
 
   #entriesForType(type: string): HydratedEntry[] {
-    const entryIds = this.#typeEntryIds.get(type);
+    const entryIds = this.#hydrated.typeEntryIds.get(type);
     if (!entryIds) {
       return [];
     }
 
     const entries: HydratedEntry[] = [];
     for (const entryId of entryIds) {
-      const entry = this.#entries.get(entryId);
+      const entry = this.#hydrated.entries.get(entryId);
       if (entry) {
         entries.push(entry);
       }
@@ -810,34 +1011,6 @@ export class CultCache {
     return entries;
   }
 
-  #getOrCreateTypeEntrySet(type: string): Set<string> {
-    let set = this.#typeEntryIds.get(type);
-    if (!set) {
-      set = new Set<string>();
-      this.#typeEntryIds.set(type, set);
-    }
-    return set;
-  }
-
-  #getOrCreateNameMap(type: string): Map<string, string> {
-    let map = this.#nameToKeyMaps.get(type);
-    if (!map) {
-      map = new Map<string, string>();
-      this.#nameToKeyMaps.set(type, map);
-    }
-    return map;
-  }
-
-  #getOrCreateIndexMap(type: string, indexName: string): Map<string, string> {
-    const lookupId = this.#indexId(type, indexName);
-    let map = this.#indexToKeyMaps.get(lookupId);
-    if (!map) {
-      map = new Map<string, string>();
-      this.#indexToKeyMaps.set(lookupId, map);
-    }
-    return map;
-  }
-
   #toEnvelope(entry: HydratedEntry): CultCacheEnvelope {
     return {
       key: entry.key,
@@ -849,14 +1022,6 @@ export class CultCache {
     };
   }
 
-  #resetHydratedState(): void {
-    this.#entries.clear();
-    this.#typeEntryIds.clear();
-    this.#nameToKeyMaps.clear();
-    this.#indexToKeyMaps.clear();
-    this.#globalKeys.clear();
-  }
-
   #entryId(type: string, key: string): string {
     return `${type}::${key}`;
   }
diff --git a/packages/cultcache-ts/src/index.ts b/packages/cultcache-ts/src/index.ts
index 97687de8..92f7b481 100644
--- a/packages/cultcache-ts/src/index.ts
+++ b/packages/cultcache-ts/src/index.ts
@@ -27,3 +27,8 @@ export type {
   InspectedCatalogMember,
   InspectedRecord,
 } from "./cult-cache-inspector";
+export {
+  defineSwarmDocuments,
+  type DefineDocumentType,
+  type SwarmDocumentCatalog,
+} from "./swarm-documents";
diff --git a/packages/cultcache-ts/src/single-file-messagepack-backing-store.ts b/packages/cultcache-ts/src/single-file-messagepack-backing-store.ts
index 3ed89214..4d2bb4f9 100644
--- a/packages/cultcache-ts/src/single-file-messagepack-backing-store.ts
+++ b/packages/cultcache-ts/src/single-file-messagepack-backing-store.ts
@@ -52,7 +52,7 @@ export class SingleFileMessagePackBackingStore implements CacheBackingStore {
       const snapshot = decodeSnapshot(decoded);
       if (snapshot) {
         return snapshot.records.map((record) => {
-          const catalogEntry = snapshot.catalogBySchemaId.get(record.schemaId);
+          const catalogEntry = resolveCatalogEntryForRecord(record, snapshot.catalogBySchemaId);
           if (!catalogEntry) {
             throw new Error(`CultCache persisted record "${record.key}" references missing schema id "${record.schemaId}".`);
           }
@@ -166,7 +166,7 @@ export class SingleFileMessagePackBackingStore implements CacheBackingStore {
 
     try {
       await writeFile(tempPath, encode(encodeSnapshot(entries)));
-      await rename(tempPath, this.filePath);
+      await renameWithRetry(tempPath, this.filePath);
     } catch (error) {
       await rm(tempPath, { force: true }).catch(() => undefined);
       throw error;
@@ -174,6 +174,32 @@ export class SingleFileMessagePackBackingStore implements CacheBackingStore {
   }
 }
 
+async function renameWithRetry(source: string, destination: string): Promise<void> {
+  let delayMs = 10;
+  let lastError: unknown;
+  for (let attempt = 0; attempt < 10; attempt++) {
+    try {
+      await rename(source, destination);
+      return;
+    } catch (error) {
+      const code = (error as NodeJS.ErrnoException).code;
+      if (code !== "EPERM" && code !== "EBUSY" && code !== "EACCES") {
+        throw error;
+      }
+
+      lastError = error;
+      await delay(delayMs);
+      delayMs *= 2;
+    }
+  }
+
+  throw lastError;
+}
+
+function delay(milliseconds: number): Promise<void> {
+  return new Promise((resolve) => setTimeout(resolve, milliseconds));
+}
+
 type PersistedRecord = {
   key: string;
   schemaId: string;
@@ -282,6 +308,59 @@ function decodeSnapshot(decoded: unknown): DecodedSnapshot | undefined {
   return { catalogBySchemaId, records };
 }
 
+function resolveCatalogEntryForRecord(
+  record: PersistedRecord,
+  catalogBySchemaId: Map<string, CultCacheSchemaCatalogEntry>,
+): CultCacheSchemaCatalogEntry | undefined {
+  const existing = catalogBySchemaId.get(record.schemaId);
+  if (existing) {
+    return existing;
+  }
+
+  const schemaVersion = inferSchemaVersionFromPayload(record.payload);
+  if (!schemaVersion) {
+    return undefined;
+  }
+
+  const schemaName = inferSchemaName(schemaVersion);
+  if (!schemaName) {
+    return undefined;
+  }
+
+  return {
+    schemaId: record.schemaId,
+    schemaName,
+    schemaVersion,
+    contentHash: record.schemaId,
+    canonicalSchemaJson: "",
+    compatibleSchemaIds: [],
+    members: [],
+  };
+}
+
+function inferSchemaVersionFromPayload(payload: Uint8Array): string | undefined {
+  try {
+    const decoded = decode(payload);
+    if (Array.isArray(decoded) && typeof decoded[0] === "string") {
+      return decoded[0];
+    }
+
+    if (isObject(decoded)) {
+      const schemaVersion = decoded.schemaVersion ?? decoded.schema_version;
+      return typeof schemaVersion === "string" ? schemaVersion : undefined;
+    }
+
+    return undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+function inferSchemaName(schemaVersion: string): string | undefined {
+  const match = /^(.*)\.v\d+$/.exec(schemaVersion);
+  return match?.[1];
+}
+
 function decodeCatalogEntry(value: unknown): CultCacheSchemaCatalogEntry {
   if (!Array.isArray(value)) {
     throw new Error("CultCache schema catalog entries must be MessagePack arrays.");
diff --git a/packages/cultcache-ts/src/swarm-documents.ts b/packages/cultcache-ts/src/swarm-documents.ts
new file mode 100644
index 00000000..b1c0b40d
--- /dev/null
+++ b/packages/cultcache-ts/src/swarm-documents.ts
@@ -0,0 +1,561 @@
+// GameCult swarm document-type catalog.
+//
+// These are CultCache document definitions for documents that cross service
+// boundaries: Eve surfaces and provider advertisements, Ghostlight, Heimdall,
+// Idunn, Muninn, Sleipnir, Aetheria, VoidBot, Stonks. The catalog lived in Odin
+// because Odin was written first, not because Odin owns it; every service that
+// decodes another service documents needs the same definitions, and a second
+// copy would be a second definition of one wire format.
+//
+// defineDocumentType is injected rather than imported. That is how it worked in
+// Odin, it keeps this file clear of the generic signature in ./document, and it
+// lets a caller supply a runtime other than this package.
+
+/** An undecoded document payload. These definitions predate typing and name fields defensively. */
+export type DocumentValue = any;
+
+export type DefineDocumentType = (definition: Record<string, unknown>) => unknown;
+export type SwarmDocumentCatalog = Record<string, unknown>;
+
+function parseObjectDocument(label: string) {
+  return {
+    parse(value: unknown) {
+      if (!value || typeof value !== "object") {
+        throw new Error(`${label} must be an object`);
+      }
+      return value;
+    },
+  };
+}
+
+export function defineSwarmDocuments(defineDocumentType?: DefineDocumentType | null): SwarmDocumentCatalog {
+  if (!defineDocumentType) {
+    return {
+      interfaceBindingDefinition: null,
+      evePluginAdvertisementDefinition: null,
+      ghostlightSchemaCatalogDefinition: null,
+      heimdallCommandBoundaryDefinition: null,
+      heimdallTransportProfileDefinition: null,
+      idunnCommandBoundaryDefinition: null,
+      idunnDaemonHealthDefinition: null,
+      idunnTransportProfileDefinition: null,
+      interfaceLayoutDefinition: null,
+      muninnCaptureStreamCommandDefinition: null,
+      muninnCaptureStreamDefinition: null,
+      muninnCommandBoundaryDefinition: null,
+      muninnMediaAudioPacketDefinition: null,
+      muninnMediaReceiverFeedbackDefinition: null,
+      muninnMediaVideoAccessUnitDefinition: null,
+      muninnHidControllerStateDefinition: null,
+      muninnMoveControllerStateDefinition: null,
+      muninnMoveIdentityDefinition: null,
+      muninnMoveLightCommandDefinition: null,
+      muninnMoveMarkerCandidateDefinition: null,
+      muninnObsStreamCatalogDefinition: null,
+      muninnQuestAccessDefinition: null,
+      muninnTelemetrySurfaceDefinition: null,
+      muninnTransportProfileDefinition: null,
+      SleipnirInputMappingDefinition: null,
+      aetheriaAssetManifestDefinition: null,
+      aetheriaGravityViewportDefinition: null,
+      aetheriaObjectsViewportDefinition: null,
+      aetheriaRenderSplatsViewportDefinition: null,
+      operatorStateDefinition: null,
+      providerAdvertisementDefinition: null,
+      voidbotProviderCatalogDefinition: null,
+      stonksCommandBoundaryDefinition: null,
+      stonksMarketSnapshotDefinition: null,
+      stonksRequestEventDefinition: null,
+      stonksTransportProfileDefinition: null,
+      streamPixelsCommandBoundaryDefinition: null,
+      streamPixelsTransportProfileDefinition: null,
+      surfaceDefinition: null,
+      viliCommandBoundaryDefinition: null,
+      viliTransportProfileDefinition: null,
+      weksaCommandBoundaryDefinition: null,
+      weksaOperatorStateDefinition: null,
+      weksaTransportProfileDefinition: null,
+      voidbotSwarmSnapshotDefinition: null,
+    };
+  }
+
+  const surfaceDefinition = defineDocumentType({
+    type: "gamecult.eve.surface_state",
+    schemaName: "gamecult.eve.surface_state",
+    schemaId: "gamecult.eve.surface_state.v1",
+    schemaVersion: "gamecult.eve.surface_state.v1",
+    global: false,
+    name: (value: DocumentValue) => value?.providerId || "surface",
+    schema: { parse: (value: DocumentValue) => value },
+    members: [
+      { slot: 0, memberName: "providerId", typeName: "string", isName: true },
+      { slot: 1, memberName: "title", typeName: "string" },
+      { slot: 2, memberName: "version", typeName: "long" },
+      { slot: 3, memberName: "updatedAt", typeName: "string" },
+      { slot: 4, memberName: "surface", typeName: "object" },
+    ],
+  });
+  const interfaceBindingDefinition = defineDocumentType({
+    type: "gamecult.eve.interface_binding",
+    schemaName: "gamecult.eve.interface_binding",
+    schemaId: "gamecult.eve.interface_binding.v1",
+    schemaVersion: "gamecult.eve.interface_binding.v1",
+    global: false,
+    name: (value: DocumentValue) => value?.bindingId || value?.providerId || "interface",
+    schema: parseObjectDocument("Eve interface binding"),
+  });
+  const providerAdvertisementDefinition = defineDocumentType({
+    type: "gamecult.eve.provider_advertisement",
+    schemaName: "gamecult.eve.provider_advertisement",
+    schemaId: "gamecult.eve.provider_advertisement.v1",
+    schemaVersion: "gamecult.eve.provider_advertisement.v1",
+    global: false,
+    name: (value: DocumentValue) => value?.providerId || value?.provider?.id || "provider",
+    schema: parseObjectDocument("Eve provider advertisement"),
+  });
+  const evePluginAdvertisementDefinition = defineDocumentType({
+    type: "gamecult.eve.plugin_advertisement",
+    schemaName: "gamecult.eve.plugin_advertisement",
+    schemaId: "gamecult.eve.plugin_advertisement.v1",
+    schemaVersion: "gamecult.eve.plugin_advertisement.v1",
+    global: false,
+    name: (value: DocumentValue) => value?.pluginId || value?.plugin?.id || "plugin",
+    schema: parseObjectDocument("Eve plugin advertisement"),
+  });
+  const ghostlightSchemaCatalogDefinition = defineDocumentType({
+    type: "ghostlight.schema_catalog",
+    schemaName: "ghostlight.schema_catalog",
+    schemaId: "ghostlight.schema_catalog.v1",
+    schemaVersion: "ghostlight.schema_catalog.v1",
+    global: false,
+    name: (value: DocumentValue) => value?.providerId || "gamecult.ghostlight.dungeon",
+    schema: parseObjectDocument("Ghostlight public schema catalog"),
+  });
+  const heimdallCommandBoundaryDefinition = defineDocumentType({
+    type: "heimdall.command_boundary",
+    schemaName: "heimdall.command_boundary",
+    schemaId: "heimdall.command_boundary.v1",
+    schemaVersion: "heimdall.command_boundary.v1",
+    global: false,
+    name: (value: DocumentValue) => value?.boundaryId || value?.daemonId || "heimdall",
+    schema: parseObjectDocument("Heimdall command boundary"),
+  });
+  const heimdallTransportProfileDefinition = defineDocumentType({
+    type: "heimdall.transport_profile",
+    schemaName: "heimdall.transport_profile",
+    schemaId: "heimdall.transport_profile.v1",
+    schemaVersion: "heimdall.transport_profile.v1",
+    global: false,
+    name: (value: DocumentValue) => value?.profileId || value?.daemonId || "heimdall",
+    schema: parseObjectDocument("Heimdall transport profile"),
+  });
+  const interfaceLayoutDefinition = defineDocumentType({
+    type: "odin.interface_layout",
+    schemaName: "odin.interface_layout",
+    schemaId: "odin.interface_layout.v1",
+    schemaVersion: "odin.interface_layout.v1",
+    global: false,
+    name: (value: DocumentValue) => value?.layoutId || value?.providerId || "odin.providers",
+    schema: parseObjectDocument("Odin interface layout"),
+    members: [
+      { slot: 0, memberName: "layoutId", typeName: "string", isName: true },
+      { slot: 1, memberName: "updatedAt", typeName: "string" },
+      { slot: 2, memberName: "tiles", typeName: "object" },
+    ],
+  });
+  const idunnDaemonHealthDefinition = defineDocumentType({
+    type: "idunn.daemon_health",
+    schemaName: "idunn.daemon_health",
+    schemaId: "idunn.daemon_health",
+    schemaVersion: "idunn.daemon_health.v1",
+    global: false,
+    name: (value: DocumentValue) => value?.daemonId || value?.daemon_id || "daemon",
+    schema: parseObjectDocument("Idunn daemon health"),
+  });
+  const idunnCommandBoundaryDefinition = defineDocumentType({
+    type: "idunn.command_boundary",
+    schemaName: "idunn.command_boundary",
+    schemaId: "idunn.command_boundary.v1",
+    schemaVersion: "idunn.command_boundary.v1",
+    global: false,
+    name: (value: DocumentValue) => value?.boundary_id || value?.boundaryId || value?.daemon_id || value?.daemonId || "daemon",
+    schema: parseObjectDocument("Idunn command boundary"),
+  });
+  const idunnTransportProfileDefinition = defineDocumentType({
+    type: "idunn.daemon_transport_profile",
+    schemaName: "idunn.daemon_transport_profile",
+    schemaId: "idunn.daemon_transport_profile.v1",
+    schemaVersion: "idunn.daemon_transport_profile.v1",
+    global: false,
+    name: (value: DocumentValue) => value?.profile_id || value?.profileId || value?.daemon_id || value?.daemonId || "daemon",
+    schema: parseObjectDocument("Idunn daemon transport profile"),
+  });
+  const muninnCaptureStreamDefinition = defineDocumentType({
+    type: "muninn.capture_stream",
+    schemaName: "muninn.capture_stream",
+    schemaId: "muninn.capture_stream.v1",
+    schemaVersion: "muninn.capture_stream.v1",
+    global: false,
+    name: (value: DocumentValue) => value?.stream_id || value?.streamId || "capture-stream",
+    schema: parseObjectDocument("Muninn capture stream"),
+  });
+  const muninnCaptureStreamCommandDefinition = defineDocumentType({
+    type: "muninn.capture_stream_command",
+    schemaName: "muninn.capture_stream_command",
+    schemaId: "muninn.capture_stream_command.v1",
+    schemaVersion: "muninn.capture_stream_command.v1",
+    global: false,
+    name: (value: DocumentValue) => value?.command_id || value?.commandId || value?.stream_id || value?.streamId || "capture-stream-command",
+    schema: parseObjectDocument("Muninn capture stream command"),
+  });
+  const muninnCommandBoundaryDefinition = defineDocumentType({
+    type: "muninn.command_boundary",
+    schemaName: "muninn.command_boundary",
+    schemaId: "muninn.command_boundary.v1",
+    schemaVersion: "muninn.command_boundary.v1",
+    global: false,
+    name: (value: DocumentValue) => value?.boundary_id || value?.boundaryId || value?.daemon_id || value?.daemonId || "muninn",
+    schema: parseObjectDocument("Muninn command boundary"),
+  });
+  const muninnMediaVideoAccessUnitDefinition = defineDocumentType({
+    type: "muninn.media_video_access_unit",
+    schemaName: "muninn.media_video_access_unit",
+    schemaId: "muninn.media_video_access_unit.v1",
+    schemaVersion: "muninn.media_video_access_unit.v1",
+    global: false,
+    name: (value: DocumentValue) => {
+      const streamId = value?.stream_id || value?.streamId || "stream";
+      const sessionId = value?.session_id || value?.sessionId || "session";
+      const frameId = value?.frame_id ?? value?.frameId ?? "frame";
+      const chunkIndex = value?.chunk_index ?? value?.chunkIndex ?? "chunk";
+      return `${streamId}:${sessionId}:video:${frameId}:${chunkIndex}`;
+    },
+    schema: parseObjectDocument("Muninn media video access unit"),
+  });
+  const muninnMediaAudioPacketDefinition = defineDocumentType({
+    type: "muninn.media_audio_packet",
+    schemaName: "muninn.media_audio_packet",
+    schemaId: "muninn.media_audio_packet.v1",
+    schemaVersion: "muninn.media_audio_packet.v1",
+    global: false,
+    name: (value: DocumentValue) => {
+      const streamId = value?.stream_id || value?.streamId || "stream";
+      const sessionId = value?.session_id || value?.sessionId || "session";
+      const packetId = value?.packet_id ?? value?.packetId ?? "packet";
+      return `${streamId}:${sessionId}:audio:${packetId}`;
+    },
+    schema: parseObjectDocument("Muninn media audio packet"),
+  });
+  const muninnMediaReceiverFeedbackDefinition = defineDocumentType({
+    type: "muninn.media_receiver_feedback",
+    schemaName: "muninn.media_receiver_feedback",
+    schemaId: "muninn.media_receiver_feedback.v1",
+    schemaVersion: "muninn.media_receiver_feedback.v1",
+    global: false,
+    name: (value: DocumentValue) => {
+      const streamId = value?.stream_id || value?.streamId || "stream";
+      const sessionId = value?.session_id || value?.sessionId || "session";
+      const receiverId = value?.receiver_id || value?.receiverId || "receiver";
+      return `${streamId}:${sessionId}:feedback:${receiverId}`;
+    },
+    schema: parseObjectDocument("Muninn media receiver feedback"),
+  });
+  const muninnMoveControllerStateDefinition = defineDocumentType({
+    type: "muninn.move_controller_state",
+    schemaName: "muninn.move_controller_state",
+    schemaId: "muninn.move_controller_state.v1",
+    schemaVersion: "muninn.move_controller_state.v1",
+    global: false,
+    name: (value: DocumentValue) => value?.stream_id || value?.streamId || value?.move_id || value?.moveId || "move-controller-state",
+    schema: parseObjectDocument("Muninn Move controller state"),
+  });
+  const muninnHidControllerStateDefinition = defineDocumentType({
+    type: "muninn.hid_controller_state",
+    schemaName: "muninn.hid_controller_state",
+    schemaId: "muninn.hid_controller_state.v1",
+    schemaVersion: "muninn.hid_controller_state.v1",
+    global: false,
+    name: (value: DocumentValue) => value?.stream_id || value?.streamId || value?.device_id || value?.deviceId || "hid-controller-state",
+    schema: parseObjectDocument("Muninn HID controller state"),
+  });
+  const muninnMoveIdentityDefinition = defineDocumentType({
+    type: "muninn.move_identity",
+    schemaName: "muninn.move_identity",
+    schemaId: "muninn.move_identity.v1",
+    schemaVersion: "muninn.move_identity.v1",
+    global: false,
+    name: (value: DocumentValue) => value?.identity_id || value?.identityId || value?.move_id || value?.moveId || "move-identity",
+    schema: parseObjectDocument("Muninn Move identity"),
+  });
+  const muninnMoveLightCommandDefinition = defineDocumentType({
+    type: "muninn.move_light_command",
+    schemaName: "muninn.move_light_command",
+    schemaId: "muninn.move_light_command.v1",
+    schemaVersion: "muninn.move_light_command.v1",
+    global: false,
+    name: (value: DocumentValue) => value?.command_id || value?.commandId || value?.move_id || value?.moveId || "move-light-command",
+    schema: parseObjectDocument("Muninn Move light command"),
+  });
+  const muninnMoveMarkerCandidateDefinition = defineDocumentType({
+    type: "muninn.move_marker_candidate",
+    schemaName: "muninn.move_marker_candidate",
+    schemaId: "muninn.move_marker_candidate.v1",
+    schemaVersion: "muninn.move_marker_candidate.v1",
+    global: false,
+    name: (value: DocumentValue) => value?.stream_id || value?.streamId || value?.camera_id || value?.cameraId || "move-marker-candidate",
+    schema: parseObjectDocument("Muninn Move marker candidate"),
+  });
+  const muninnObsStreamCatalogDefinition = defineDocumentType({
+    type: "muninn.obs_stream_catalog",
+    schemaName: "muninn.obs_stream_catalog",
+    schemaId: "muninn.obs_stream_catalog.v1",
+    schemaVersion: "muninn.obs_stream_catalog.v1",
+    global: false,
+    name: (value: DocumentValue) => value?.catalog_id || value?.catalogId || value?.host_id || value?.hostId || "muninn",
+    schema: parseObjectDocument("Muninn OBS stream catalog"),
+  });
+  const muninnQuestAccessDefinition = defineDocumentType({
+    type: "muninn.quest_access",
+    schemaName: "muninn.quest_access",
+    schemaId: "muninn.quest_access.v1",
+    schemaVersion: "muninn.quest_access.v1",
+    global: false,
+    name: (value: DocumentValue) => value?.access_id || value?.accessId || value?.serial || "quest-access",
+    schema: parseObjectDocument("Muninn Quest access"),
+  });
+  const muninnTelemetrySurfaceDefinition = defineDocumentType({
+    type: "muninn.telemetry_surface",
+    schemaName: "muninn.telemetry_surface",
+    schemaId: "muninn.telemetry_surface.v1",
+    schemaVersion: "muninn.telemetry_surface.v1",
+    global: false,
+    name: (value: DocumentValue) => value?.surface_id || value?.surfaceId || value?.host_id || value?.hostId || "muninn-telemetry",
+    schema: parseObjectDocument("Muninn telemetry surface"),
+  });
+  const muninnTransportProfileDefinition = defineDocumentType({
+    type: "muninn.transport_profile",
+    schemaName: "muninn.transport_profile",
+    schemaId: "muninn.transport_profile.v1",
+    schemaVersion: "muninn.transport_profile.v1",
+    global: false,
+    name: (value: DocumentValue) => value?.profile_id || value?.profileId || value?.daemon_id || value?.daemonId || "muninn",
+    schema: parseObjectDocument("Muninn transport profile"),
+  });
+  const SleipnirInputMappingDefinition = defineDocumentType({
+    type: "sleipnir.input_mapping",
+    schemaName: "sleipnir.input_mapping",
+    schemaId: "sleipnir.input_mapping.v1",
+    schemaVersion: "sleipnir.input_mapping.v1",
+    global: false,
+    name: (value: DocumentValue) => value?.providerId || value?.provider_id || "sleipnir",
+    schema: parseObjectDocument("Sleipnir input mapping"),
+  });
+  const aetheriaAssetManifestDefinition = defineDocumentType({
+    type: "gamecult.aetheria.asset_manifest",
+    schemaName: "gamecult.aetheria.asset_manifest",
+    schemaId: "gamecult.aetheria.asset_manifest.v1",
+    schemaVersion: "gamecult.aetheria.asset_manifest.v1",
+    global: false,
+    name: (value: DocumentValue) => value?.runId || value?.run_id || "aetheria-assets",
+    schema: parseObjectDocument("Aetheria asset manifest"),
+  });
+  const aetheriaGravityViewportDefinition = defineDocumentType({
+    type: "gamecult.fields.gravity",
+    schemaName: "gamecult.fields.gravity",
+    schemaId: "gamecult.fields.gravity.v1",
+    schemaVersion: "gamecult.fields.gravity.v1",
+    global: false,
+    name: (value: DocumentValue) => value?.viewportId || value?.viewport_id || "aetheria-gravity",
+    schema: parseObjectDocument("Aetheria gravity viewport"),
+  });
+  const aetheriaObjectsViewportDefinition = defineDocumentType({
+    type: "gamecult.fields.objects",
+    schemaName: "gamecult.fields.objects",
+    schemaId: "gamecult.fields.objects.v1",
+    schemaVersion: "gamecult.fields.objects.v1",
+    global: false,
+    name: (value: DocumentValue) => value?.viewportId || value?.viewport_id || "aetheria-objects",
+    schema: parseObjectDocument("Aetheria objects viewport"),
+  });
+  const aetheriaRenderSplatsViewportDefinition = defineDocumentType({
+    type: "gamecult.fields.splats",
+    schemaName: "gamecult.fields.splats",
+    schemaId: "gamecult.fields.splats.v1",
+    schemaVersion: "gamecult.fields.splats.v1",
+    global: false,
+    name: (value: DocumentValue) => value?.viewportId || value?.viewport_id || "aetheria-render-splats",
+    schema: parseObjectDocument("Aetheria render splats viewport"),
+  });
+  const operatorStateDefinition = defineDocumentType({
+    type: "gamecult.vili.operator_state",
+    schemaName: "gamecult.vili.operator_state",
+    schemaId: "gamecult.vili.operator_state.v1",
+    schemaVersion: "gamecult.vili.operator_state.v1",
+    global: false,
+    name: (value: DocumentValue) => value?.service || value?.providerId || "operator",
+    schema: parseObjectDocument("Vili operator state"),
+  });
+  const viliCommandBoundaryDefinition = defineDocumentType({
+    type: "gamecult.vili.command_boundary",
+    schemaName: "gamecult.vili.command_boundary",
+    schemaId: "gamecult.vili.command_boundary.v1",
+    schemaVersion: "gamecult.vili.command_boundary.v1",
+    global: false,
+    name: (value: DocumentValue) => value?.boundaryId || value?.daemonId || "vili",
+    schema: parseObjectDocument("Vili command boundary"),
+  });
+  const viliTransportProfileDefinition = defineDocumentType({
+    type: "gamecult.vili.transport_profile",
+    schemaName: "gamecult.vili.transport_profile",
+    schemaId: "gamecult.vili.transport_profile.v1",
+    schemaVersion: "gamecult.vili.transport_profile.v1",
+    global: false,
+    name: (value: DocumentValue) => value?.profileId || value?.daemonId || "vili",
+    schema: parseObjectDocument("Vili transport profile"),
+  });
+  const weksaOperatorStateDefinition = defineDocumentType({
+    type: "weksa.operator_state",
+    schemaName: "weksa.operator_state",
+    schemaId: "weksa.operator_state.v0",
+    schemaVersion: "weksa.operator_state.v0",
+    global: false,
+    name: (value: DocumentValue) => value?.daemon_id || value?.daemonId || value?.provider_id || value?.providerId || "weksa",
+    schema: parseObjectDocument("Weksa operator state"),
+  });
+  const weksaCommandBoundaryDefinition = defineDocumentType({
+    type: "weksa.command_boundary",
+    schemaName: "weksa.command_boundary",
+    schemaId: "weksa.command_boundary.v1",
+    schemaVersion: "weksa.command_boundary.v1",
+    global: false,
+    name: (value: DocumentValue) => value?.boundary_id || value?.boundaryId || value?.daemon_id || value?.daemonId || "weksa",
+    schema: parseObjectDocument("Weksa command boundary"),
+  });
+  const weksaTransportProfileDefinition = defineDocumentType({
+    type: "weksa.transport_profile",
+    schemaName: "weksa.transport_profile",
+    schemaId: "weksa.transport_profile.v1",
+    schemaVersion: "weksa.transport_profile.v1",
+    global: false,
+    name: (value: DocumentValue) => value?.profile_id || value?.profileId || value?.daemon_id || value?.daemonId || "weksa",
+    schema: parseObjectDocument("Weksa transport profile"),
+  });
+  const stonksRequestEventDefinition = defineDocumentType({
+    type: "stonks.request_event",
+    schemaName: "stonks.request_event",
+    schemaId: "stonks.request_event.v1",
+    schemaVersion: "stonks.request_event.v1",
+    global: false,
+    name: (value: DocumentValue) => value?.id || "request",
+    schema: parseObjectDocument("Stonks request event"),
+  });
+  const stonksMarketSnapshotDefinition = defineDocumentType({
+    type: "stonks.market_snapshot",
+    schemaName: "stonks.market_snapshot",
+    schemaId: "stonks.market_snapshot.v1",
+    schemaVersion: "stonks.market_snapshot.v1",
+    global: true,
+    schema: parseObjectDocument("Stonks market snapshot"),
+  });
+  const stonksCommandBoundaryDefinition = defineDocumentType({
+    type: "stonks.command_boundary",
+    schemaName: "stonks.command_boundary",
+    schemaId: "stonks.command_boundary.v1",
+    schemaVersion: "stonks.command_boundary.v1",
+    global: false,
+    name: (value: DocumentValue) => value?.boundaryId || value?.daemonId || "stonks",
+    schema: parseObjectDocument("Stonks command boundary"),
+  });
+  const stonksTransportProfileDefinition = defineDocumentType({
+    type: "stonks.transport_profile",
+    schemaName: "stonks.transport_profile",
+    schemaId: "stonks.transport_profile.v1",
+    schemaVersion: "stonks.transport_profile.v1",
+    global: false,
+    name: (value: DocumentValue) => value?.profileId || value?.daemonId || "stonks",
+    schema: parseObjectDocument("Stonks transport profile"),
+  });
+  const streamPixelsCommandBoundaryDefinition = defineDocumentType({
+    type: "streampixels.command_boundary",
+    schemaName: "streampixels.command_boundary",
+    schemaId: "streampixels.command_boundary.v1",
+    schemaVersion: "streampixels.command_boundary.v1",
+    global: false,
+    name: (value: DocumentValue) => value?.boundaryId || value?.daemonId || "streampixels",
+    schema: parseObjectDocument("StreamPixels command boundary"),
+  });
+  const streamPixelsTransportProfileDefinition = defineDocumentType({
+    type: "streampixels.transport_profile",
+    schemaName: "streampixels.transport_profile",
+    schemaId: "streampixels.transport_profile.v1",
+    schemaVersion: "streampixels.transport_profile.v1",
+    global: false,
+    name: (value: DocumentValue) => value?.profileId || value?.daemonId || "streampixels",
+    schema: parseObjectDocument("StreamPixels transport profile"),
+  });
+  const voidbotSwarmSnapshotDefinition = defineDocumentType({
+    type: "voidbot.swarm_state_snapshot",
+    schemaName: "voidbot.swarm_state_snapshot",
+    schemaId: "voidbot.swarm_state_snapshot.v1",
+    schemaVersion: "voidbot.swarm_state_snapshot.v1",
+    global: true,
+    schema: parseObjectDocument("VoidBot swarm snapshot"),
+  });
+  const voidbotProviderCatalogDefinition = defineDocumentType({
+    type: "voidbot.provider_advertisement_catalog",
+    schemaName: "voidbot.provider_advertisement_catalog",
+    schemaId: "voidbot.provider_advertisement_catalog.v0",
+    schemaVersion: "voidbot.provider_advertisement_catalog.v0",
+    global: true,
+    schema: parseObjectDocument("VoidBot provider advertisement catalog"),
+  });
+
+  return {
+    interfaceBindingDefinition,
+    evePluginAdvertisementDefinition,
+    ghostlightSchemaCatalogDefinition,
+    heimdallCommandBoundaryDefinition,
+    heimdallTransportProfileDefinition,
+    interfaceLayoutDefinition,
+    idunnCommandBoundaryDefinition,
+    idunnDaemonHealthDefinition,
+    idunnTransportProfileDefinition,
+    muninnCaptureStreamCommandDefinition,
+    muninnCaptureStreamDefinition,
+    muninnCommandBoundaryDefinition,
+    muninnMediaAudioPacketDefinition,
+    muninnMediaReceiverFeedbackDefinition,
+    muninnMediaVideoAccessUnitDefinition,
+    muninnHidControllerStateDefinition,
+    muninnMoveControllerStateDefinition,
+    muninnMoveIdentityDefinition,
+    muninnMoveLightCommandDefinition,
+    muninnMoveMarkerCandidateDefinition,
+    muninnObsStreamCatalogDefinition,
+    muninnQuestAccessDefinition,
+    muninnTelemetrySurfaceDefinition,
+    muninnTransportProfileDefinition,
+    SleipnirInputMappingDefinition,
+    aetheriaAssetManifestDefinition,
+    aetheriaGravityViewportDefinition,
+    aetheriaObjectsViewportDefinition,
+    aetheriaRenderSplatsViewportDefinition,
+    operatorStateDefinition,
+    providerAdvertisementDefinition,
+    stonksCommandBoundaryDefinition,
+    stonksMarketSnapshotDefinition,
+    stonksRequestEventDefinition,
+    stonksTransportProfileDefinition,
+    streamPixelsCommandBoundaryDefinition,
+    streamPixelsTransportProfileDefinition,
+    surfaceDefinition,
+    viliCommandBoundaryDefinition,
+    viliTransportProfileDefinition,
+    weksaCommandBoundaryDefinition,
+    weksaOperatorStateDefinition,
+    weksaTransportProfileDefinition,
+    voidbotProviderCatalogDefinition,
+    voidbotSwarmSnapshotDefinition,
+  };
+}
+
diff --git a/packages/cultcache-ts/test/cult-cache.test.ts b/packages/cultcache-ts/test/cult-cache.test.ts
index 1067eecd..5932b2f8 100644
--- a/packages/cultcache-ts/test/cult-cache.test.ts
+++ b/packages/cultcache-ts/test/cult-cache.test.ts
@@ -1,9 +1,10 @@
 import assert from "node:assert/strict";
 import { exec, execFile } from "node:child_process";
+import { EventEmitter } from "node:events";
 import { existsSync } from "node:fs";
 import { access, mkdtemp, readFile, writeFile } from "node:fs/promises";
 import { homedir, tmpdir } from "node:os";
-import { dirname, join, resolve } from "node:path";
+import { dirname, join, resolve, delimiter } from "node:path";
 import { test } from "node:test";
 import { promisify } from "node:util";
 
@@ -24,7 +25,9 @@ const pythonCommand = process.env.PYTHON ?? "python";
 const cultCacheTsRoot = resolve(__dirname, "../..");
 const cultLibRoot = findAncestor(cultCacheTsRoot, "CultLib.sln") ?? resolve(cultCacheTsRoot, "..", "CultLib");
 const cultcachePyRoot = resolve(cultLibRoot, "packages", "cultcache-py");
-const cultcachePySrc = resolve(cultcachePyRoot, "src");
+const cultcachePySrc = ["cultcache-py", "cultnet-py", "cultmesh-py"]
+  .map((name) => resolve(cultLibRoot, "packages", name, "src"))
+  .join(delimiter);
 const cultcacheRsRoot = existsSync(resolve(cultLibRoot, "packages", "cultcache-rs"))
   ? resolve(cultLibRoot, "packages", "cultcache-rs")
   : resolve(cultCacheTsRoot, "..", "cultcache-rs");
@@ -161,8 +164,8 @@ test("CultCache can register name and index lookups after entries already exist"
     body: "world",
   });
 
-  cache.registerNameLookup(noteDocument, "title");
-  cache.registerIndex(noteDocument, "author", "author");
+  await cache.registerNameLookup(noteDocument, "title");
+  await cache.registerIndex(noteDocument, "author", "author");
 
   assert.equal(cache.getIdByName(noteDocument, "Hello"), "note:hello");
   assert.equal(cache.getIdByIndex(noteDocument, "author", "ari"), "note:hello");
@@ -437,6 +440,58 @@ test("SingleFileMessagePackBackingStore reads CultCache v1 snapshots by schema i
   assert.equal(cache.getRequiredEnvelope(noteDocument, "record-1").schemaId, "schema-1");
 });
 
+test("SingleFileMessagePackBackingStore recovers schema-stamped records missing catalog entries", async () => {
+  const stampedDocument = defineDocumentType({
+    type: "runtime-policy",
+    schema: z.tuple([
+      z.literal("tests.schema_stamped_entry.v1"),
+      z.string(),
+      z.string(),
+    ]),
+    schemaId: "schema-current",
+    schemaName: "tests.schema_stamped_entry",
+    schemaVersion: "tests.schema_stamped_entry.v1",
+    compatibleSchemaIds: ["schema-current"],
+  });
+
+  const storePath = join(await mkdtemp(join(tmpdir(), "cultcache-ts-")), "missing-catalog.msgpack");
+  await writeFile(
+    storePath,
+    encode([
+      "cultcache.store.v1",
+      [],
+      [
+        [
+          "record-1",
+          "sha256:stale-schema-id-from-cold-record",
+          "2026-06-25T12:00:00Z",
+          encode([
+            "tests.schema_stamped_entry.v1",
+            "schema-stamped",
+            "still readable",
+          ]),
+        ],
+      ],
+    ]),
+  );
+
+  const cache = CultCache.builder()
+    .withDocumentType(stampedDocument)
+    .withGenericStore(new SingleFileMessagePackBackingStore(storePath))
+    .build();
+
+  await cache.pullAllBackingStores();
+  assert.deepEqual(cache.getRequired(stampedDocument, "record-1"), [
+    "tests.schema_stamped_entry.v1",
+    "schema-stamped",
+    "still readable",
+  ]);
+  assert.equal(
+    cache.getRequiredEnvelope(stampedDocument, "record-1").schemaId,
+    "sha256:stale-schema-id-from-cold-record",
+  );
+});
+
 test("SingleFileMessagePackBackingStore heals legacy envelopes whose payload was persisted as an object", async () => {
   const noteDocument = defineDocumentType({
     type: "note",
@@ -479,6 +534,536 @@ test("SingleFileMessagePackBackingStore heals legacy envelopes whose payload was
   assert.ok(records[0]?.[3] instanceof Uint8Array);
 });
 
+test("CultCache rejects a second generic backing store", async () => {
+  const cache = new CultCache();
+  await cache.addGenericBackingStore(new SingleFileMessagePackBackingStore(join(tmpdir(), "unused-a.cc")));
+  await assert.rejects(
+    cache.addGenericBackingStore(new SingleFileMessagePackBackingStore(join(tmpdir(), "unused-b.cc"))),
+    /second generic store/u,
+  );
+});
+
+test("CultCache rejects a type registered to two stores", async () => {
+  const cache = new CultCache();
+  await cache.addBackingStore(new SingleFileMessagePackBackingStore(join(tmpdir(), "unused-a.cc")), "item");
+  await assert.rejects(
+    cache.addBackingStore(new SingleFileMessagePackBackingStore(join(tmpdir(), "unused-b.cc")), "settings", "item"),
+    /"item" is already routed/u,
+  );
+  // A refused registration claims nothing, so "settings" is still free.
+  await cache.addBackingStore(new SingleFileMessagePackBackingStore(join(tmpdir(), "unused-c.cc")), "settings");
+});
+
+test("CultCache routes each type to its home store", async () => {
+  const itemDocument = defineDocumentType({
+    type: "item",
+    schema: z.object({ name: z.string() }),
+  });
+  const settingsDocument = defineDocumentType({
+    type: "settings",
+    schema: z.object({ theme: z.string() }),
+  });
+  const tempDir = await mkdtemp(join(tmpdir(), "cultcache-routes-"));
+  const genericPath = join(tempDir, "generic.cc");
+  const settingsPath = join(tempDir, "settings.cc");
+  const build = () => CultCache.builder()
+    .withRegistry(defineDocumentRegistry(itemDocument, settingsDocument))
+    .withBackingStore(new SingleFileMessagePackBackingStore(settingsPath), settingsDocument)
+    .withGenericStore(new SingleFileMessagePackBackingStore(genericPath))
+    .build();
+  const keysIn = async (path: string) =>
+    (await new SingleFileMessagePackBackingStore(path).pullAll()).map((entry) => `${entry.type}:${entry.key}`);
+
+  const cache = build();
+  await cache.put(itemDocument, "potion", { name: "Potion" });
+  await cache.put(settingsDocument, "app", { theme: "ash" });
+  assert.deepEqual(await keysIn(genericPath), ["item:potion"]);
+  assert.deepEqual(await keysIn(settingsPath), ["settings:app"]);
+
+  await cache.delete(settingsDocument, "app");
+  assert.deepEqual(await keysIn(settingsPath), []);
+  assert.deepEqual(await keysIn(genericPath), ["item:potion"]);
+
+  const reloaded = build();
+  await reloaded.pullAllBackingStores();
+  assert.deepEqual(reloaded.getRequired(itemDocument, "potion"), { name: "Potion" });
+  assert.equal(reloaded.get(settingsDocument, "app"), undefined);
+});
+
+test("CultCache refuses an attach that would move a held record's home", async () => {
+  const settingsDocument = defineDocumentType({ type: "settings", schema: z.object({ theme: z.string() }) });
+  const tempDir = await mkdtemp(join(tmpdir(), "cultcache-home-move-"));
+  const genericPath = join(tempDir, "generic.cc");
+  const settingsPath = join(tempDir, "settings.cc");
+  const cache = CultCache.builder()
+    .withRegistry(defineDocumentRegistry(settingsDocument))
+    .withGenericStore(new SingleFileMessagePackBackingStore(genericPath))
+    .build();
+  await cache.put(settingsDocument, "app", { theme: "v1-generic" });
+
+  await assert.rejects(
+    async () => cache.addBackingStore(new SingleFileMessagePackBackingStore(settingsPath), settingsDocument),
+    /would move "settings" from the generic store to the store routed to settings/u,
+  );
+  // Nothing attached: the next write still lands in the generic store, and the refused store stays untouched.
+  await cache.put(settingsDocument, "app", { theme: "v2-generic" });
+  const keysIn = async (path: string) =>
+    (await new SingleFileMessagePackBackingStore(path).pullAll()).map((entry) => `${entry.type}:${entry.key}`);
+  assert.deepEqual(await keysIn(genericPath), ["settings:app"]);
+  assert.equal(existsSync(settingsPath), false);
+});
+
+test("CultCache refuses at load a record delivered by a store that is not its home", async () => {
+  const settingsDocument = defineDocumentType({ type: "settings", schema: z.object({ theme: z.string() }) });
+  const tempDir = await mkdtemp(join(tmpdir(), "cultcache-load-home-"));
+  const genericPath = join(tempDir, "generic.cc");
+  const settingsPath = join(tempDir, "settings.cc");
+  const writer = CultCache.builder()
+    .withRegistry(defineDocumentRegistry(settingsDocument))
+    .withGenericStore(new SingleFileMessagePackBackingStore(genericPath))
+    .build();
+  await writer.put(settingsDocument, "app", { theme: "stray" });
+  const genericBytes = await readFile(genericPath);
+
+  const cache = CultCache.builder()
+    .withRegistry(defineDocumentRegistry(settingsDocument))
+    .withBackingStore(new SingleFileMessagePackBackingStore(settingsPath), settingsDocument)
+    .withGenericStore(new SingleFileMessagePackBackingStore(genericPath))
+    .build();
+  // The cache already holds a record, in its home store, before the refused load.
+  await cache.put(settingsDocument, "held", { theme: "home" });
+  const before = cache.snapshot();
+  const settingsBytes = await readFile(settingsPath);
+  await assert.rejects(
+    cache.pullAllBackingStores(),
+    /"settings" record "app" was loaded from the generic store, but its home is the store routed to settings/u,
+  );
+  assert.equal(cache.get(settingsDocument, "app"), undefined);
+  assert.deepEqual(cache.snapshot(), before);
+  assert.deepEqual(cache.getRequired(settingsDocument, "held"), { theme: "home" });
+  assert.deepEqual(await readFile(genericPath), genericBytes);
+  assert.deepEqual(await readFile(settingsPath), settingsBytes);
+});
+
+async function storeState(path: string): Promise<string[]> {
+  if (!existsSync(path)) {
+    return [];
+  }
+  return (await new SingleFileMessagePackBackingStore(path).pullAll())
+    .map((entry) => `${entry.type}:${entry.key}:${Buffer.from(entry.payload).toString("hex")}`)
+    .sort();
+}
+
+test("putWithThrowingAccessorChangesNeitherStoreNorCache", async () => {
+  const itemDocument = defineDocumentType({
+    type: "item",
+    schema: z.object({ n: z.string() }),
+    name: (value: { n: string }) => {
+      if (value.n === "bad") {
+        throw new Error("accessor refuses bad");
+      }
+      return value.n;
+    },
+  });
+  const storePath = join(await mkdtemp(join(tmpdir(), "cultcache-put-accessor-")), "generic.cc");
+  const cache = CultCache.builder()
+    .withRegistry(defineDocumentRegistry(itemDocument))
+    .withGenericStore(new SingleFileMessagePackBackingStore(storePath))
+    .build();
+  await cache.put(itemDocument, "k", { n: "good" });
+  const storeBefore = await storeState(storePath);
+  const cacheBefore = cache.snapshot();
+
+  await assert.rejects(cache.put(itemDocument, "k", { n: "bad" }), /accessor refuses bad/u);
+  assert.deepEqual(await storeState(storePath), storeBefore);
+  assert.deepEqual(cache.snapshot(), cacheBefore);
+  assert.deepEqual(cache.getRequired(itemDocument, "k"), { n: "good" });
+  assert.equal(cache.getKeyByName(itemDocument, "good"), "k");
+});
+
+test("overwriteUnderRegisteredAccessorThatNowThrowsChangesNeitherStoreNorCache", async () => {
+  const itemDocument = defineDocumentType({ type: "item", schema: z.object({ c: z.string() }) });
+  const storePath = join(await mkdtemp(join(tmpdir(), "cultcache-overwrite-accessor-")), "generic.cc");
+  const cache = CultCache.builder()
+    .withRegistry(defineDocumentRegistry(itemDocument))
+    .withGenericStore(new SingleFileMessagePackBackingStore(storePath))
+    .build();
+  await cache.put(itemDocument, "k", { c: "old" });
+  let refusing = false;
+  await cache.registerIndex(itemDocument, "category", (value: { c: string }) => {
+    if (refusing) {
+      throw new Error("accessor refuses now");
+    }
+    return value.c;
+  });
+  refusing = true;
+  const storeBefore = await storeState(storePath);
+  const cacheBefore = cache.snapshot();
+
+  await assert.rejects(cache.put(itemDocument, "k", { c: "new" }), /accessor refuses now/u);
+  assert.deepEqual(await storeState(storePath), storeBefore);
+  assert.deepEqual(cache.snapshot(), cacheBefore);
+  assert.equal(cache.getKeyByIndex(itemDocument, "category", "old"), "k");
+  // Deleting runs no accessor: it uses the lookup values stored when the record was admitted.
+  assert.equal(await cache.delete(itemDocument, "k"), true);
+  assert.equal(cache.getKeyByIndex(itemDocument, "category", "old"), undefined);
+});
+
+test("registeringAccessorThatThrowsOnHeldRecordInstallsNothing", async () => {
+  const itemDocument = defineDocumentType({ type: "item", schema: z.object({ n: z.string() }) });
+  const storePath = join(await mkdtemp(join(tmpdir(), "cultcache-register-accessor-")), "generic.cc");
+  const cache = CultCache.builder()
+    .withRegistry(defineDocumentRegistry(itemDocument))
+    .withGenericStore(new SingleFileMessagePackBackingStore(storePath))
+    .build();
+  await cache.put(itemDocument, "old", { n: "bad" });
+  await assert.rejects(
+    async () => cache.registerIndex(itemDocument, "i", (value: { n: string }) => {
+      if (value.n === "bad") {
+        throw new Error("index refuses bad");
+      }
+      return value.n;
+    }),
+    /index refuses bad/u,
+  );
+  await cache.put(itemDocument, "old", { n: "fine" });
+  assert.deepEqual(cache.getRequired(itemDocument, "old"), { n: "fine" });
+  assert.equal(cache.getKeyByIndex(itemDocument, "i", "fine"), undefined);
+});
+
+test("globalReplaceWithFailingStorePushKeepsOldGlobal", async () => {
+  const settingsDocument = defineDocumentType({
+    type: "settings",
+    schema: z.object({ t: z.string() }),
+    global: true,
+  });
+  const storePath = join(await mkdtemp(join(tmpdir(), "cultcache-global-push-")), "generic.cc");
+  const inner = new SingleFileMessagePackBackingStore(storePath);
+  let failPush = false;
+  const store: CacheBackingStore = {
+    pullAll: () => inner.pullAll(),
+    delete: (entry) => inner.delete(entry),
+    pushAll: (entries, options) => inner.pushAll(entries, options),
+    push: async (entry) => {
+      if (failPush) {
+        throw new Error("disk full");
+      }
+      return inner.push(entry);
+    },
+  };
+  const cache = CultCache.builder()
+    .withRegistry(defineDocumentRegistry(settingsDocument))
+    .withGenericStore(store)
+    .build();
+  await cache.putGlobal(settingsDocument, { t: "base" });
+  const storeBefore = await storeState(storePath);
+  const cacheBefore = cache.snapshot();
+  failPush = true;
+
+  await assert.rejects(cache.putGlobal(settingsDocument, { t: "new" }), /disk full/u);
+  await assert.rejects(cache.put(settingsDocument, "other", { t: "new" }), /must use key "__global__"/u);
+  assert.deepEqual(await storeState(storePath), storeBefore);
+  assert.deepEqual(cache.snapshot(), cacheBefore);
+  assert.deepEqual(cache.getRequiredGlobal(settingsDocument), { t: "base" });
+});
+
+test("concurrentGlobalPutsCannotBothReachDisk", async () => {
+  const settingsDocument = defineDocumentType({
+    type: "settings",
+    schema: z.object({ t: z.string() }),
+    global: true,
+  });
+  const storePath = join(await mkdtemp(join(tmpdir(), "cultcache-global-race-")), "generic.cc");
+  const inner = new SingleFileMessagePackBackingStore(storePath);
+  // The first push after arming writes, then pauses until released. A second write that reaches the
+  // store during that pause is recorded: serialized writes cannot.
+  let armed = false;
+  let paused = false;
+  let reachedStoreWhilePaused = false;
+  let release!: () => void;
+  let reportPaused!: () => void;
+  const pausedSignal = new Promise<void>((resolve) => {
+    reportPaused = resolve;
+  });
+  const store: CacheBackingStore = {
+    pullAll: () => inner.pullAll(),
+    delete: (entry) => inner.delete(entry),
+    push: async (entry) => {
+      reachedStoreWhilePaused ||= paused;
+      await inner.push(entry);
+      if (armed) {
+        armed = false;
+        paused = true;
+        await new Promise<void>((resolve) => {
+          release = resolve;
+          reportPaused();
+        });
+        paused = false;
+      }
+    },
+  };
+  const build = (backing: CacheBackingStore) => CultCache.builder()
+    .withRegistry(defineDocumentRegistry(settingsDocument))
+    .withGenericStore(backing)
+    .build();
+  const cache = build(store);
+  await cache.putGlobal(settingsDocument, { t: "base" });
+
+  armed = true;
+  const first = cache.putGlobal(settingsDocument, { t: "first" });
+  await pausedSignal;
+  const second = cache.putGlobal(settingsDocument, { t: "second" });
+  await new Promise((resolve) => setTimeout(resolve, 50));
+  release();
+  await Promise.all([first, second]);
+
+  assert.equal(reachedStoreWhilePaused, false);
+  const onDisk = await inner.pullAll();
+  assert.deepEqual(onDisk.map((entry) => entry.key), [CultCache.GLOBAL_KEY]);
+  assert.deepEqual(
+    Buffer.from(onDisk[0].payload),
+    Buffer.from(cache.getRequiredEnvelope(settingsDocument, CultCache.GLOBAL_KEY).payload),
+  );
+  assert.deepEqual(cache.getRequiredGlobal(settingsDocument), { t: "second" });
+  const reloaded = build(new SingleFileMessagePackBackingStore(storePath));
+  await reloaded.pullAllBackingStores();
+  assert.deepEqual(reloaded.getRequiredGlobal(settingsDocument), { t: "second" });
+});
+
+test("unawaitedFailingPutIsAnUnhandledRejection", async () => {
+  const itemDocument = defineDocumentType({ type: "item", schema: z.object({ n: z.string() }) });
+  const store: CacheBackingStore = {
+    pullAll: async () => [],
+    push: async () => {
+      throw new Error("disk full");
+    },
+    delete: async () => undefined,
+  };
+  const cache = CultCache.builder()
+    .withRegistry(defineDocumentRegistry(itemDocument))
+    .withGenericStore(store)
+    .build();
+
+  const runnerListeners = process.listeners("unhandledRejection");
+  process.removeAllListeners("unhandledRejection");
+  const unhandled: unknown[] = [];
+  const listener = (reason: unknown) => {
+    unhandled.push(reason);
+  };
+  process.on("unhandledRejection", listener);
+  try {
+    void cache.put(itemDocument, "k", { n: "x" });
+    await new Promise((resolve) => setTimeout(resolve, 50));
+  } finally {
+    process.off("unhandledRejection", listener);
+    for (const runnerListener of runnerListeners) {
+      process.on("unhandledRejection", runnerListener);
+    }
+  }
+
+  assert.equal(unhandled.length, 1);
+  assert.match(String((unhandled[0] as Error).message), /disk full/u);
+  // The chain survived the rejection: the next operation still runs.
+  await assert.rejects(cache.put(itemDocument, "k", { n: "y" }), /disk full/u);
+});
+
+test("storeChangeHandlerWritingBackQueuesAfterTheOperation", async () => {
+  const itemDocument = defineDocumentType({ type: "item", schema: z.object({ n: z.string() }) });
+  const storePath = join(await mkdtemp(join(tmpdir(), "cultcache-writeback-")), "generic.cc");
+  const inner = new SingleFileMessagePackBackingStore(storePath);
+  const changes = new EventEmitter();
+  const pushed: string[] = [];
+  const store: CacheBackingStore = {
+    pullAll: () => inner.pullAll(),
+    delete: (entry) => inner.delete(entry),
+    push: async (entry) => {
+      await inner.push(entry);
+      pushed.push(entry.key);
+      changes.emit("pushed", entry.key);
+    },
+  };
+  const cache = CultCache.builder()
+    .withRegistry(defineDocumentRegistry(itemDocument))
+    .withGenericStore(store)
+    .build();
+  // The handler writes back and the store does not wait for it: that write queues behind the put.
+  const writeBacks: Promise<unknown>[] = [];
+  changes.on("pushed", (key: string) => {
+    if (key === "k") {
+      writeBacks.push(cache.put(itemDocument, "side", { n: "side" }));
+    }
+  });
+
+  await cache.put(itemDocument, "k", { n: "x" });
+  await Promise.all(writeBacks);
+
+  assert.equal(writeBacks.length, 1);
+  assert.deepEqual(pushed, ["k", "side"]);
+  assert.deepEqual(cache.get(itemDocument, "k"), { n: "x" });
+  assert.deepEqual(cache.get(itemDocument, "side"), { n: "side" });
+  assert.deepEqual(
+    (await inner.pullAll()).map((entry) => entry.key).sort(),
+    cache.snapshot().map((entry) => entry.key).sort(),
+  );
+});
+
+test("legacyKeyGlobalLoadsWithoutWritingAndFirstWriteLeavesOneGlobal", async () => {
+  const settingsDocument = defineDocumentType({
+    type: "settings",
+    schema: z.object({ t: z.string() }),
+    global: true,
+  });
+  const storePath = join(await mkdtemp(join(tmpdir(), "cultcache-legacy-global-")), "generic.cc");
+  const build = () => CultCache.builder()
+    .withRegistry(defineDocumentRegistry(settingsDocument))
+    .withGenericStore(new SingleFileMessagePackBackingStore(storePath))
+    .build();
+  const seed = CultCache.builder().withRegistry(defineDocumentRegistry(settingsDocument)).build();
+  await seed.putGlobal(settingsDocument, { t: "old" });
+  const legacy = { ...seed.getRequiredEnvelope(settingsDocument, CultCache.GLOBAL_KEY), key: "legacy" };
+  await new SingleFileMessagePackBackingStore(storePath).push(legacy);
+  const bytes = await readFile(storePath);
+
+  const cache = build();
+  await cache.pullAllBackingStores();
+  assert.deepEqual(cache.getRequiredGlobal(settingsDocument), { t: "old" });
+  assert.deepEqual(cache.get(settingsDocument, CultCache.GLOBAL_KEY), { t: "old" });
+  assert.deepEqual(await readFile(storePath), bytes);
+
+  await cache.putGlobal(settingsDocument, { t: "new" });
+  assert.deepEqual(
+    (await new SingleFileMessagePackBackingStore(storePath).pullAll()).map((entry) => entry.key),
+    [CultCache.GLOBAL_KEY],
+  );
+  const reloaded = build();
+  await reloaded.pullAllBackingStores();
+  assert.deepEqual(reloaded.getRequiredGlobal(settingsDocument), { t: "new" });
+
+  // Deleting an adopted global removes the legacy record.
+  await new SingleFileMessagePackBackingStore(storePath).pushAll([legacy]);
+  const deleting = build();
+  await deleting.pullAllBackingStores();
+  assert.equal(await deleting.deleteGlobal(settingsDocument), true);
+  assert.deepEqual(await new SingleFileMessagePackBackingStore(storePath).pullAll(), []);
+
+  // Two globals of one type on disk, under any keys, are refused.
+  await new SingleFileMessagePackBackingStore(storePath).pushAll([legacy, { ...legacy, key: CultCache.GLOBAL_KEY }]);
+  await assert.rejects(build().pullAllBackingStores(), /has multiple persisted entries/u);
+});
+
+test("concurrentPutAndAttachCannotLandRecordInNonHomeStore", async () => {
+  const settingsDocument = defineDocumentType({ type: "settings", schema: z.object({ t: z.string() }) });
+  const tempDir = await mkdtemp(join(tmpdir(), "cultcache-put-attach-race-"));
+  const genericPath = join(tempDir, "generic.cc");
+  const settingsPath = join(tempDir, "settings.cc");
+  const cache = CultCache.builder()
+    .withRegistry(defineDocumentRegistry(settingsDocument))
+    .withGenericStore(new SingleFileMessagePackBackingStore(genericPath))
+    .build();
+
+  const pending = cache.put(settingsDocument, "app", { t: "x" });
+  const attach = Promise.resolve().then(() =>
+    cache.addBackingStore(new SingleFileMessagePackBackingStore(settingsPath), settingsDocument),
+  );
+  await pending;
+  await assert.rejects(attach, /would move "settings" from the generic store/u);
+
+  assert.deepEqual(
+    (await new SingleFileMessagePackBackingStore(genericPath).pullAll()).map((entry) => entry.key),
+    ["app"],
+  );
+  assert.equal(existsSync(settingsPath), false);
+  const reloaded = CultCache.builder()
+    .withRegistry(defineDocumentRegistry(settingsDocument))
+    .withGenericStore(new SingleFileMessagePackBackingStore(genericPath))
+    .build();
+  await reloaded.pullAllBackingStores();
+  assert.deepEqual(reloaded.getRequired(settingsDocument, "app"), { t: "x" });
+});
+
+test("pullWithDuplicateGlobalLeavesCacheUnchanged", async () => {
+  const itemDocument = defineDocumentType({ type: "item", schema: z.object({ name: z.string() }) });
+  const settingsDocument = defineDocumentType({
+    type: "settings",
+    schema: z.object({ theme: z.string() }),
+    global: true,
+  });
+  const tempDir = await mkdtemp(join(tmpdir(), "cultcache-duplicate-global-"));
+  const storePath = join(tempDir, "generic.cc");
+  const cache = CultCache.builder()
+    .withRegistry(defineDocumentRegistry(itemDocument, settingsDocument))
+    .withGenericStore(new SingleFileMessagePackBackingStore(storePath))
+    .build();
+  await cache.put(itemDocument, "potion", { name: "Potion" });
+  await cache.putGlobal(settingsDocument, { theme: "ash" });
+  const before = cache.snapshot();
+
+  // A second record of the global type lands in the store file behind the cache's back.
+  const stray = cache.getRequiredEnvelope(settingsDocument, CultCache.GLOBAL_KEY);
+  await new SingleFileMessagePackBackingStore(storePath).push({ ...stray, key: "stray" });
+
+  await assert.rejects(cache.pullAllBackingStores(), /has multiple persisted entries/u);
+  assert.deepEqual(cache.snapshot(), before);
+  assert.deepEqual(cache.getRequired(itemDocument, "potion"), { name: "Potion" });
+  assert.deepEqual(cache.getRequiredGlobal(settingsDocument), { theme: "ash" });
+});
+
+test("pullWithThrowingIndexAccessorLeavesCacheUnchanged", async () => {
+  const itemDocument = defineDocumentType({
+    type: "item",
+    schema: z.object({ name: z.string(), category: z.string() }),
+    name: "name",
+    indexes: {
+      category: (item: { name: string; category: string }) => {
+        if (item.name === "Bomb") {
+          throw new Error("category accessor refuses Bomb");
+        }
+        return item.category;
+      },
+    },
+  });
+  const settingsDocument = defineDocumentType({
+    type: "settings",
+    schema: z.object({ theme: z.string() }),
+    global: true,
+  });
+  const tempDir = await mkdtemp(join(tmpdir(), "cultcache-throwing-accessor-"));
+  const storePath = join(tempDir, "generic.cc");
+  const cache = CultCache.builder()
+    .withRegistry(defineDocumentRegistry(itemDocument, settingsDocument))
+    .withGenericStore(new SingleFileMessagePackBackingStore(storePath))
+    .build();
+  await cache.put(itemDocument, "potion", { name: "Potion", category: "consumable" });
+  await cache.putGlobal(settingsDocument, { theme: "ash" });
+  const before = cache.snapshot();
+
+  // A record whose index accessor throws lands in the store file behind the cache's back.
+  const potion = cache.getRequiredEnvelope(itemDocument, "potion");
+  await new SingleFileMessagePackBackingStore(storePath).push({
+    ...potion,
+    key: "bomb",
+    payload: encode({ name: "Bomb", category: "explosive" }),
+  });
+
+  await assert.rejects(cache.pullAllBackingStores(), /category accessor refuses Bomb/u);
+  assert.deepEqual(cache.snapshot(), before);
+  assert.deepEqual(cache.getRequired(itemDocument, "potion"), { name: "Potion", category: "consumable" });
+  assert.equal(cache.get(itemDocument, "bomb"), undefined);
+  assert.equal(cache.getKeyByName(itemDocument, "Potion"), "potion");
+  assert.equal(cache.getKeyByName(itemDocument, "Bomb"), undefined);
+  assert.equal(cache.getKeyByIndex(itemDocument, "category", "consumable"), "potion");
+  assert.deepEqual(cache.getRequiredGlobal(settingsDocument), { theme: "ash" });
+});
+
+test("CultCache with zero stores writes and deletes in memory", async () => {
+  const settingsDocument = defineDocumentType({ type: "settings", schema: z.object({ theme: z.string() }) });
+  const cache = CultCache.builder().withRegistry(defineDocumentRegistry(settingsDocument)).build();
+  await cache.put(settingsDocument, "x", { theme: "mem" });
+  assert.deepEqual(cache.getRequired(settingsDocument, "x"), { theme: "mem" });
+  assert.equal(await cache.delete(settingsDocument, "x"), true);
+  assert.equal(cache.get(settingsDocument, "x"), undefined);
+});
+
 test("CultCache v1 MessagePack stores are readable across TS, Rust, C#, and Python", async () => {
   await buildInteropPeers();
   const tempDir = await mkdtemp(join(tmpdir(), "cultcache-interop-"));
@@ -560,6 +1145,32 @@ test("CultCache v1 MessagePack stores are readable across TS, Rust, C#, and Pyth
       assert.ok(read.tags.includes("interop"));
     }
   }
+
+  // C# write-routed attaches one home store per type: each file is a complete v1 snapshot holding only its own records.
+  const catalogFile = join(tempDir, "catalog.cc");
+  const runFile = join(tempDir, "run.cc");
+  const routed = await runJsonCommand("csharp-write-routed", dotnetCommand, [
+    csharpInteropDll,
+    "write-routed",
+    catalogFile,
+    runFile,
+  ], cultLibRoot);
+  const recordsIn = async (file: string) => {
+    const decoded = decode(await readFile(file)) as unknown[];
+    assert.equal(decoded[0], "cultcache.store.v1");
+    assert.ok(Array.isArray(decoded[1]), `${file} has no schema catalog`);
+    return (decoded[2] as unknown[][]).map((record) => ({ schemaId: record[1], key: record[0] }));
+  };
+  const catalogRecords = await recordsIn(catalogFile);
+  const runRecords = await recordsIn(runFile);
+  assert.deepEqual(catalogRecords.map((record) => record.key), ["note:csharp-routed"]);
+  assert.deepEqual(runRecords.map((record) => record.key), ["run-note:csharp-routed"]);
+  assert.notEqual(catalogRecords[0]?.schemaId, runRecords[0]?.schemaId);
+  for (const reader of readers) {
+    const read = await reader.read(catalogFile);
+    assert.equal(read.documentId, routed.documentId, `${reader.name} failed to read the routed catalog store`);
+    assert.equal(read.body, "One home store per document type.");
+  }
 });
 
 test("CultCache interop reader accepts missing compatible trailing slots and rejects mismatched slots", async () => {
@@ -604,6 +1215,42 @@ test("CultCache inspector decodes v1 store catalog and record payloads from byte
   ]);
 });
 
+test("CultCache inspector recovers schema-stamped records missing catalog entries", async () => {
+  const tempDir = await mkdtemp(join(tmpdir(), "cultcache-inspector-"));
+  const file = join(tempDir, "missing-catalog.cc");
+
+  await writeFile(
+    file,
+    encode([
+      "cultcache.store.v1",
+      [],
+      [
+        [
+          "record-1",
+          "sha256:stale-schema-id-from-cold-record",
+          "2026-06-25T12:00:00Z",
+          encode([
+            "tests.schema_stamped_entry.v1",
+            "schema-stamped",
+            "still readable",
+          ]),
+        ],
+      ],
+    ]),
+  );
+
+  const inspection = inspectCultCacheBytes(file, await readFile(file));
+  assert.equal(inspection.catalog.length, 1);
+  assert.equal(inspection.catalog[0]?.schemaId, "sha256:stale-schema-id-from-cold-record");
+  assert.equal(inspection.catalog[0]?.schemaName, "tests.schema_stamped_entry");
+  assert.equal(inspection.records[0]?.schemaName, "tests.schema_stamped_entry");
+  assert.deepEqual(inspection.records[0]?.payloadPreview, [
+    "tests.schema_stamped_entry.v1",
+    "schema-stamped",
+    "still readable",
+  ]);
+});
+
 interface InteropNote {
   schemaVersion: "cultcache.interop_note.v1";
   documentId: string;
diff --git a/packages/cultmath/.gitignore b/packages/cultmath/.gitignore
new file mode 100644
index 00000000..c9b141d0
--- /dev/null
+++ b/packages/cultmath/.gitignore
@@ -0,0 +1,9 @@
+bin/
+obj/
+**/bin/
+**/obj/
+target/
+**/target/
+/native/cultmath-core/target.meta
+.tools/
+/artifacts/
diff --git a/packages/cultmath/README.md b/packages/cultmath/README.md
new file mode 100644
index 00000000..0be46738
--- /dev/null
+++ b/packages/cultmath/README.md
@@ -0,0 +1,136 @@
+# CultMath
+
+CultMath is the project name. Its clean .NET package identity is
+`GameCult.Math`, owned and released from the CultLib monorepo.
+
+Clean-room math shaped for people who think in HLSL.
+
+CultMath provides lowercase vector types, shader-style intrinsics, and native
+hot-path kernels so math-heavy renderer code can move between C#, Rust, and HLSL
+without turning every line into a translation exercise. It is not a
+Unity.Mathematics clone. It is a small, Aquarium-born library built from public
+shader semantics.
+
+## Current Surface
+
+- `float2`, `float3`, `float4`
+- component-wise arithmetic
+- scalar-to-vector splats
+- every HLSL swizzle (`xyzw` and `rgba`, repeats readable, non-repeating
+  masks writable) and every HLSL mixed constructor, generated by
+  `tools/generate-swizzles.ps1`
+- conversions to and from `System.Numerics`
+- `Random`, a compact deterministic XORShift stream with scalar and vector draws
+- `BatchMath` SoA kernels over `Span<float>` / `ReadOnlySpan<float>` using
+  `System.Numerics.Vector<float>` when available, including radial falloff
+  acceleration and semi-implicit Euler integration
+- `math` intrinsics: `radians`, `degrees`, `abs`, `floor`, `ceil`, `frac`,
+  `min`, `max`, `clamp`, `saturate`, `lerp`, `step`, `smoothstep`, `dot`,
+  `cross`, `length`, `distance`, `normalize`, `reflect`, `csum`, exponential
+  `decay`/`damp`, intercept/segment helpers, Catmull-Rom, Bezier curves, and
+  deterministic value-noise primitives
+- `shaders/CultMath.hlsl`, a canonical HLSL mirror include for shader-side
+  parity. HLSL already owns `float2`, `float3`, and `float4`; the include
+  exposes `cultmath_*` functions for shared semantics, including CultMath's
+  safe `normalize` contract.
+- `Voronoi.SampleTones`, a C# batch surface that calls the Rust
+  `cultmath-core` native kernel when `cultmath_core` is available and falls back
+  to the managed parity path otherwise.
+
+## Native Core
+
+The canonical hot-path body lives in `native/cultmath-core`. It exports a C ABI
+for batch kernels such as `cultmath_apollonian_voronoi_tones`.
+
+Runtime wrappers own syntax and integration. Rust owns optimized primitive
+kernel behavior and parity fixtures.
+
+## Example
+
+```csharp
+using CultMath;
+
+float3 normal = math.normalize(new float3(0.25f, 1.0f, -0.1f));
+float rim = math.saturate(1.0f - math.dot(normal, new float3(0.0f, 0.0f, -1.0f)));
+float glow = math.smoothstep(0.2f, 1.0f, rim);
+float grain = math.value_noise_bicubic(math.float2(12.0f, 3.5f));
+```
+
+```hlsl
+#include "CultMath.hlsl"
+
+float3 normal = cultmath_normalize(float3(0.25, 1.0, -0.1));
+float rim = cultmath_saturate(1.0 - dot(normal, float3(0.0, 0.0, -1.0)));
+float glow = cultmath_smoothstep(0.2, 1.0, rim);
+float grain = cultmath_value_noise_bicubic(float2(12.0, 3.5));
+```
+
+## Provenance
+
+The small spline, damping, and pursuit helpers were promoted from Aetheria's
+local `AetheriaMath` surface. The value-noise family follows public shader
+literature from Inigo Quilez's noise and mini-spline articles, expressed in
+CultMath names with tests instead of copied project-local helper drift.
+
+## Build
+
+```powershell
+dotnet build packages/cultmath/src/CultMath/CultMath.csproj
+dotnet test packages/cultmath/tests/CultMath.Tests/CultMath.Tests.csproj
+cargo test --manifest-path packages/cultmath/native/cultmath-core/Cargo.toml
+cargo build --release --manifest-path packages/cultmath/native/cultmath-core/Cargo.toml
+.\packages\cultmath\scripts\build-unity-package.ps1
+```
+
+## Unity package
+
+CultMath's Unity 2021.3 surface is the tracked precompiled package at
+`packages/cultmath/unity/org.gamecult.cultmath`. Unity consumes `CultMath.dll` and the numeric
+`CultMath.hlsl`; it does not compile the repository's current-language C# source
+tree and does not require a consumer `csc.rsp` workaround.
+
+```json
+"org.gamecult.cultmath": "https://github.com/GameCult/CultLib.git?path=/packages/cultmath/unity/org.gamecult.cultmath"
+```
+
+The repository root is not a Unity package. Build the tracked package with
+`packages/cultmath/scripts/build-unity-package.ps1`; the script fresh-builds the netstandard2.1
+assembly and rejects stale binaries, missing metadata, unexpected assemblies,
+or leaked C# source.
+
+## Shader Tooling
+
+CultMath keeps portable DXC outside git under `packages/cultmath/.tools/`:
+
+```powershell
+.\packages\cultmath\tools\get-dxc.ps1
+.\packages\cultmath\tools\get-spirv-cross.ps1
+.\packages\cultmath\tools\compile-hlsl-spirv.ps1 `
+  -ShaderPath E:\Projects\Odin\crates\muninn-move-tracker\shaders\MoveSphereCandidate.comp.hlsl `
+  -OutputPath E:\Projects\Odin\crates\muninn-move-tracker\artifacts\shader\MoveSphereCandidate.comp.spv `
+  -IncludePath E:\Projects\CultLib\packages\cultmath\shaders
+.\packages\cultmath\tools\compile-spirv-metal.ps1 `
+  -SpirvPath E:\Projects\Odin\crates\muninn-move-tracker\artifacts\shader\MoveSphereCandidate.comp.spv `
+  -OutputPath E:\Projects\Odin\crates\muninn-move-tracker\artifacts\shader\MoveSphereCandidate.comp.metal
+```
+
+DXC emits Vulkan SPIR-V with `-spirv`. `-TargetEnv vulkan1.2` is exposed by the
+script, but the current Windows DXC release compiled this shader successfully
+with DXC's default Vulkan target while rejecting the dotted target-env value.
+The SPIR-V script applies default Vulkan register shifts for cbuffers, textures,
+UAVs, and samplers so cross-compiled Metal buffers do not alias by resource
+class. SPIRV-Cross emits Metal Shading Language from SPIR-V on Windows; building
+an iPad-ready `.metallib` still belongs to Apple's Metal compiler on an Apple
+toolchain.
+
+## Doctrine
+
+The goal is mechanical sympathy between CPU-side authoring, native kernels, and
+GPU-side shader math. If an intrinsic exists here, it should behave like the
+shader concept unless a runtime's numeric rules make that impossible. Weird
+deviations get tests and documentation, not folklore.
+
+CultMath is still not a shader generator. Projects should include
+`shaders/CultMath.hlsl` directly or add that directory to their shader include
+path. If a shared operation needs CPU/GPU parity, put the primitive here and
+test it here before copying local math helpers into a renderer or daemon.
diff --git a/packages/cultmath/README.md.meta b/packages/cultmath/README.md.meta
new file mode 100644
index 00000000..4411da72
--- /dev/null
+++ b/packages/cultmath/README.md.meta
@@ -0,0 +1,7 @@
+fileFormatVersion: 2
+guid: 867daebafe0ce48479cf043461ee6bdf
+TextScriptImporter:
+  externalObjects: {}
+  userData: 
+  assetBundleName: 
+  assetBundleVariant: 
diff --git a/packages/cultmath/THIRD-PARTY-NOTICES.md b/packages/cultmath/THIRD-PARTY-NOTICES.md
new file mode 100644
index 00000000..06ebb6c3
--- /dev/null
+++ b/packages/cultmath/THIRD-PARTY-NOTICES.md
@@ -0,0 +1,11 @@
+# Third-Party Notices
+
+## 2D and 3D Simplex Noise
+
+`math.snoise` and `cultmath_snoise` port the textureless 2D and 3D
+simplex-noise functions by Ian McEwan and Ashima Arts, as distributed by Stefan
+Gustavson's `webgl-noise` project and Unity Mathematics.
+
+- Copyright 2011 Ashima Arts.
+- Upstream: <https://github.com/ashima/webgl-noise>
+- License: MIT.
diff --git a/packages/cultmath/THIRD-PARTY-NOTICES.md.meta b/packages/cultmath/THIRD-PARTY-NOTICES.md.meta
new file mode 100644
index 00000000..4b43ddaa
--- /dev/null
+++ b/packages/cultmath/THIRD-PARTY-NOTICES.md.meta
@@ -0,0 +1,7 @@
+fileFormatVersion: 2
+guid: 7c28c8631c7d4054eb751d7ce952df33
+TextScriptImporter:
+  externalObjects: {}
+  userData: 
+  assetBundleName: 
+  assetBundleVariant: 
diff --git a/packages/cultmath/docs.meta b/packages/cultmath/docs.meta
new file mode 100644
index 00000000..ee5fab29
--- /dev/null
+++ b/packages/cultmath/docs.meta
@@ -0,0 +1,8 @@
+fileFormatVersion: 2
+guid: de535b89253410b41b5989f712b80af4
+folderAsset: yes
+DefaultImporter:
+  externalObjects: {}
+  userData: 
+  assetBundleName: 
+  assetBundleVariant: 
diff --git a/packages/cultmath/docs/design.md b/packages/cultmath/docs/design.md
new file mode 100644
index 00000000..de09ee26
--- /dev/null
+++ b/packages/cultmath/docs/design.md
@@ -0,0 +1,143 @@
+# Design
+
+CultMath exists to make renderer math readable in every place it needs to live:
+Rust hot kernels, C# host code, and HLSL shader code.
+
+## Parity Target: HLSL
+
+HLSL is the semantic authority for every type and intrinsic HLSL defines. The
+goal is source compatibility: HLSL-shaped math compiles as C# under
+`using static CultMath.math;`. C# forces float literal suffixes (`0.5f`); the
+rest of the spelling should survive the move.
+
+That makes these HLSL rules, not options:
+
+- Every swizzle exists. `float2/3/4`, `int2/3/4`, and `bool2/3/4` expose every
+  read swizzle of length 2 to 4, repeats included (`v.wwxy`), in both `xyzw` and
+  `rgba` naming (never mixed), plus single-component `r/g/b/a`. `double2/3` get
+  lengths 2 and 3 only, because there is no `double4`. Components and swizzles are
+  writable: `v.xz = f2;`, `c.rgb *= 0.5f;`, and `v[1] = s;` work. Setters exist
+  only for non-repeating masks, because HLSL rejects `v.xx = ...`.
+- Every HLSL mixed constructor exists, as a struct constructor and as a `math`
+  function: `float4(float2, float2)`, `float4(float, float2, float)`,
+  `float3(float, float2)`, the copy form `float3(float3)`, and the rest, for the
+  float, int, and bool families (double gets constructors only; a `math.double3`
+  function would hide the `double3` type name).
+- Swizzles and mixed constructors are generated. `tools/generate-swizzles.ps1`
+  writes the checked-in `src/CultMath/Swizzles.g.cs` (partial structs plus a
+  partial `math`). Edit the generator, rerun it, and commit both; never edit the
+  output by hand.
+- Comparison operators (`<`, `>`, `<=`, `>=`, `==`, `!=`) are component-wise and
+  return `bool2`/`bool3`/`bool4`. Reduce them with `any` and `all`.
+  `Equals`/`GetHashCode` stay value-based so vectors still work as dictionary
+  keys.
+- `select(condition, whenTrue, whenFalse)` uses HLSL's argument order.
+- Matrices are row-major: constructors take rows, `m[i]` returns a reference to
+  row i (so `m[1][2] = s;` writes one element), `_mRC` is row R column C, and
+  products go through `mul` (`mul(m, v)` treats `v` as a column, `mul(v, m)` as a
+  row). `*` on matrices would be component-wise in HLSL, so CultMath does not
+  define it.
+- `m[r][c] = v` writes through locals, array elements, fields of classes, and
+  ref locals. Through a readonly field, an `in` parameter, a property
+  (auto-properties included), or a static readonly value such as
+  `float3x3.identity`, C# takes a defensive copy: the write compiles and is
+  silently lost. Copy the matrix to a local, write to it, and assign it back.
+- Scalar/vector arithmetic and comparisons have explicit overloads on both
+  sides rather than leaning on implicit scalar splat.
+- Intrinsics return HLSL's types and edge cases: `sign` returns `int`/`intN`
+  (NaN gives 0); `step(y, x)` is `x < y ? 0 : 1` (NaN gives 1), which is how dxc
+  lowers it, in C# and in the HLSL mirror; float and double `min` and `max`, and
+  float `clamp` and `saturate`, follow the DXIL `FMin`/`FMax`/`Saturate` operations dxc emits for
+  them: `min(a, b)` is `a < b ? a : b`, `max(a, b)` is `a >= b ? a : b`, a NaN
+  operand returns the other (so `saturate(NaN)` is 0), `clamp(x, a, b)` is
+  `min(max(x, a), b)`, and `saturate(x)` is `min(1, max(0, x))`, which maps -0
+  to +0; `any`/`all` accept numeric vectors (a component is true when it is
+  not 0); `min`, `max`, and `abs` on int vectors return int vectors.
+
+dxc marks float arithmetic and compares `fast` (no NaNs) unless a value is
+`precise`, so drivers may optimize NaN handling away and NaN results on real
+GPUs are not guaranteed. CultMath defines the CPU result by dxc's lowering and
+the DXIL operation spec (DirectXShaderCompiler `docs/DXIL.rst`).
+
+NaN does not reliably propagate through CultMath, just as it does not on the
+GPU. Because `min`, `max`, and `saturate` return the non-NaN operand, some
+functions turn NaN or infinity into numbers: `smoothstep(a, a, a)` is 0;
+infinite inputs to `smoothstep` and the intercept helpers give numbers; the
+bezier, `smoothstep01`, and `smootherstep` functions return finite values for
+NaN input; and `normalize((NaN, 2.41))` is `(NaN, 2.41e20)`, because the NaN
+length is clamped to the epsilon and the other component is divided by it.
+Callers that must detect bad data should check `isnan` before calling these
+functions.
+
+Deferred until a consumer needs them: `float4x4`, `transpose`, `determinant`,
+and HLSL's one-based `_11`..`_33` element names.
+
+### HLSL Target: Source Transformations
+
+`HlslSourceCompatibilityTests` compiles the real `shaders/CultMath.hlsl` with
+Roslyn against CultMath. These transformations are the complete list; if a body
+needs anything else, the test fails:
+
+1. Include guards (`#ifndef`/`#define`/`#endif`) are dropped.
+2. Functions taking `Texture2D`/`SamplerState` are dropped; GPU resources have
+   no CultMath analog.
+3. File-scope `static const` becomes `const`.
+4. Floating literals gain `f` (`0.5` becomes `0.5f`).
+5. The file body is wrapped in a class, since C# has no free functions; HLSL
+   functions become private instance methods.
+
+HLSL constructs that stay outside the target and must not appear in the mirror:
+`const` locals of vector type (C# `const` is primitives only; write a plain
+local) and writes through a swizzle component (`v.xy.x = s`, which C# rejects as
+modifying a temporary).
+
+The HLSL side is checked too: `tools/get-dxc.ps1` fetches Microsoft's
+DirectXShaderCompiler, and
+`dxc -T lib_6_3 -HV 2021 shaders/CultMath.hlsl` must compile cleanly.
+
+The mirror test compares bit patterns (any NaN equals any NaN; -0 differs from
+0). It proves the text of `CultMath.hlsl` computes the same float32 results as
+C# `math` on the CPU, not that a GPU agrees: driver `sin` precision alone makes
+`cultmath_hash` and value noise differ bit for bit on hardware. The mirror is
+compiled under `using static CultMath.math;`, so its intrinsics are C# `math`
+itself: the test proves the composition in the text, not the intrinsic rules,
+which only `HlslSemanticsTests` pins.
+
+Where HLSL is silent, CultMath keeps its own decisions and does not defer to
+Unity.Mathematics: `normalize` is safe (divides by `max(length, 1e-20)`),
+`hash` returns float, and `Random` is CultMath's own xorshift32. Engine-shaped
+helpers that HLSL lacks (`float2x2.Rotate`, `float3x3.Euler`, `quaternion`,
+`snoise`) enter only when a consumer needs them, with their semantics stated in
+code.
+
+Known C# friction: under `using static CultMath.math;` the constructor
+functions (`float3(...)`, `float3x3(...)`) hide the type names in member access,
+so static members need a qualified type (`CultMath.float3x3.Euler(...)`).
+
+## Rules
+
+- Keep type names HLSL-shaped: `float2`, `float3`, `float4`, `float3x3`, and `math`.
+- Keep Rust as the owner of native hot-path kernels and parity fixtures.
+- Keep C#, shader, and scripting surfaces as runtime wrappers, not competing
+  math authorities.
+- Keep `shaders/CultMath.hlsl` as the canonical shader mirror for shared
+  CultMath functions HLSL does not already provide (HLSL intrinsics such as
+  `mul`, `any`, and `log` need no mirror). Project-local shader helpers should
+  move here once more than one organ needs them or once CPU/GPU parity matters.
+- Implement public shader semantics directly; do not copy Unity.Mathematics.
+- Prefer plain mutable value types with public component fields, as HLSL does.
+- Prefer component-wise overloads over clever generic machinery until the API
+  earns that complexity.
+- Keep the surface boring and exact. Fill what a consumer uses, guided by HLSL
+  semantics; noise primitives, matrices, quaternions, and packing helpers need an
+  owner before they enter.
+- Keep the core assembly engine-free. Unity conversions live in the Unity
+  package's `CultMath.UnityBridge` assembly.
+
+## Non-Goals
+
+- Compiling C# to shaders.
+- Generating HLSL from Rust or Rust from HLSL.
+- Replacing `System.Numerics` for general .NET work.
+- Recreating every Unity.Mathematics type because a spreadsheet somewhere says
+  “coverage.” That way lies decorative obesity.
diff --git a/packages/cultmath/docs/design.md.meta b/packages/cultmath/docs/design.md.meta
new file mode 100644
index 00000000..0d31ca6a
--- /dev/null
+++ b/packages/cultmath/docs/design.md.meta
@@ -0,0 +1,7 @@
+fileFormatVersion: 2
+guid: 07021a8be816e3448a9490c10845b0aa
+TextScriptImporter:
+  externalObjects: {}
+  userData: 
+  assetBundleName: 
+  assetBundleVariant: 
diff --git a/packages/cultmath/native.meta b/packages/cultmath/native.meta
new file mode 100644
index 00000000..f4135336
--- /dev/null
+++ b/packages/cultmath/native.meta
@@ -0,0 +1,8 @@
+fileFormatVersion: 2
+guid: 9d1cb2ac88c530b4d9da456523115e12
+folderAsset: yes
+DefaultImporter:
+  externalObjects: {}
+  userData: 
+  assetBundleName: 
+  assetBundleVariant: 
diff --git a/packages/cultmath/native/cultmath-core.meta b/packages/cultmath/native/cultmath-core.meta
new file mode 100644
index 00000000..48a2ef76
--- /dev/null
+++ b/packages/cultmath/native/cultmath-core.meta
@@ -0,0 +1,8 @@
+fileFormatVersion: 2
+guid: a42d65478346c354c8b4f353c5581b49
+folderAsset: yes
+DefaultImporter:
+  externalObjects: {}
+  userData: 
+  assetBundleName: 
+  assetBundleVariant: 
diff --git a/packages/cultmath/native/cultmath-core/Cargo.lock b/packages/cultmath/native/cultmath-core/Cargo.lock
new file mode 100644
index 00000000..09598b97
--- /dev/null
+++ b/packages/cultmath/native/cultmath-core/Cargo.lock
@@ -0,0 +1,7 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 4
+
+[[package]]
+name = "cultmath-core"
+version = "0.1.0"
diff --git a/packages/cultmath/native/cultmath-core/Cargo.lock.meta b/packages/cultmath/native/cultmath-core/Cargo.lock.meta
new file mode 100644
index 00000000..9ca3ec60
--- /dev/null
+++ b/packages/cultmath/native/cultmath-core/Cargo.lock.meta
@@ -0,0 +1,7 @@
+fileFormatVersion: 2
+guid: f1c365f7eead2684ba621124e653bdab
+DefaultImporter:
+  externalObjects: {}
+  userData: 
+  assetBundleName: 
+  assetBundleVariant: 
diff --git a/packages/cultmath/native/cultmath-core/Cargo.toml b/packages/cultmath/native/cultmath-core/Cargo.toml
new file mode 100644
index 00000000..cf7819a0
--- /dev/null
+++ b/packages/cultmath/native/cultmath-core/Cargo.toml
@@ -0,0 +1,13 @@
+[package]
+name = "cultmath-core"
+version = "0.1.0"
+edition = "2021"
+
+[lib]
+name = "cultmath_core"
+crate-type = ["cdylib", "staticlib"]
+
+[profile.release]
+lto = "thin"
+codegen-units = 1
+panic = "abort"
diff --git a/packages/cultmath/native/cultmath-core/Cargo.toml.meta b/packages/cultmath/native/cultmath-core/Cargo.toml.meta
new file mode 100644
index 00000000..8875de09
--- /dev/null
+++ b/packages/cultmath/native/cultmath-core/Cargo.toml.meta
@@ -0,0 +1,7 @@
+fileFormatVersion: 2
+guid: cdd2d4eab053b764b9a06d36b080e43e
+DefaultImporter:
+  externalObjects: {}
+  userData: 
+  assetBundleName: 
+  assetBundleVariant: 
diff --git a/packages/cultmath/native/cultmath-core/src.meta b/packages/cultmath/native/cultmath-core/src.meta
new file mode 100644
index 00000000..8e5232db
--- /dev/null
+++ b/packages/cultmath/native/cultmath-core/src.meta
@@ -0,0 +1,8 @@
+fileFormatVersion: 2
+guid: 7de448b7e258d2c448bb7391051cc628
+folderAsset: yes
+DefaultImporter:
+  externalObjects: {}
+  userData: 
+  assetBundleName: 
+  assetBundleVariant: 
diff --git a/packages/cultmath/native/cultmath-core/src/lib.rs b/packages/cultmath/native/cultmath-core/src/lib.rs
new file mode 100644
index 00000000..46e7ced6
--- /dev/null
+++ b/packages/cultmath/native/cultmath-core/src/lib.rs
@@ -0,0 +1,213 @@
+#[repr(C)]
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq)]
+pub struct CultMathColor32 {
+    pub r: u8,
+    pub g: u8,
+    pub b: u8,
+    pub a: u8,
+}
+
+#[no_mangle]
+pub unsafe extern "C" fn cultmath_apollonian_voronoi_tones(
+    xs: *const f32,
+    ys: *const f32,
+    tones: *const u8,
+    spans: *const f32,
+    count: usize,
+    resolution_y: f32,
+    frame_index: i32,
+    out_colors: *mut CultMathColor32,
+) -> i32 {
+    if xs.is_null() || ys.is_null() || tones.is_null() || spans.is_null() || out_colors.is_null() {
+        return -1;
+    }
+
+    let xs = unsafe { std::slice::from_raw_parts(xs, count) };
+    let ys = unsafe { std::slice::from_raw_parts(ys, count) };
+    let tones = unsafe { std::slice::from_raw_parts(tones, count) };
+    let spans = unsafe { std::slice::from_raw_parts(spans, count) };
+    let out_colors = unsafe { std::slice::from_raw_parts_mut(out_colors, count) };
+    for index in 0..count {
+        out_colors[index] = tone_color(
+            xs[index],
+            ys[index],
+            resolution_y,
+            frame_index,
+            tones[index],
+            spans[index],
+        );
+    }
+
+    0
+}
+
+fn tone_color(px: f32, py: f32, resolution_y: f32, frame_index: i32, tone: u8, span: f32) -> CultMathColor32 {
+    let sample = stable_sample(px, py, resolution_y, frame_index, tone, span);
+    let luminance = saturate(sample.0 * 0.299 + sample.1 * 0.587 + sample.2 * 0.114);
+    match tone {
+        3 => {
+            let glow = 0.62 + luminance * 0.38;
+            color(255.0 * glow, 96.0 * glow, 14.0 * glow)
+        }
+        4 => {
+            let glow = 0.68 + luminance * 0.32;
+            color(245.0 * glow, 248.0 * glow, 252.0 * glow)
+        }
+        _ => {
+            let (gain, lift) = match tone {
+                1 => (0.42, 14.0),
+                2 => (1.05, 24.0),
+                _ => (0.24, 4.0),
+            };
+            color(
+                lift + sample.0 * 255.0 * gain,
+                lift + sample.1 * 255.0 * gain,
+                lift + sample.2 * 255.0 * gain,
+            )
+        }
+    }
+}
+
+fn stable_sample(px: f32, py: f32, resolution_y: f32, frame_index: i32, tone: u8, span: f32) -> (f32, f32, f32) {
+    let seed = px * 12.9898 + py * 78.233 + hash1((tone as f32 + 1.0) * 19.19);
+    let jitter_x = (hash1(seed) - 0.5) * span;
+    let jitter_y = (hash1(seed + 37.17) - 0.5) * span;
+    voronoi(px + jitter_x, py + jitter_y, resolution_y, frame_index)
+}
+
+fn voronoi(px: f32, py: f32, resolution_y: f32, frame_index: i32) -> (f32, f32, f32) {
+    let time = frame_index as f32 / 120.0;
+    let scale = 6.0;
+    let x = scale * px / resolution_y.max(1.0);
+    let y = scale * py / resolution_y.max(1.0);
+    let nx = x.floor();
+    let ny = y.floor();
+    let fx = frac(x);
+    let fy = frac(y);
+    let mut distance = 8.0;
+    let mut red = 0.0;
+    let mut green = 0.0;
+    let mut blue = 0.0;
+    let smoothness = 0.005;
+
+    for j in -2..=2 {
+        for i in -2..=2 {
+            let gx = i as f32;
+            let gy = j as f32;
+            let (mut ox, mut oy) = hash2(nx + gx, ny + gy);
+            let weight = ox * 0.5 + 0.5;
+            ox = 0.5 + 0.5 * (time + 6.2831 * ox).sin();
+            oy = 0.5 + 0.5 * (time + 6.2831 * oy).sin();
+            let dx = (gx - fx + ox).abs();
+            let dy = (gy - fy + oy).abs();
+            let d = dx.max(dy) * weight;
+            let seed = hash1((nx + gx) * 7.0 + (ny + gy) * 113.0);
+            let hue = frac((nx + gx) * 0.173 + (ny + gy) * 0.379 + seed * 0.431);
+            let (candidate_red, candidate_green, candidate_blue) = pastel_spectrum(hue);
+            let h = smoothstep(0.0, 1.0, 0.5 + 0.5 * (distance - d) / smoothness);
+            let correction = h * (1.0 - h) * smoothness / (1.0 + 3.0 * smoothness);
+            distance = lerp(distance, d, h) - correction;
+            red = lerp(red, candidate_red, h) - correction;
+            green = lerp(green, candidate_green, h) - correction;
+            blue = lerp(blue, candidate_blue, h) - correction;
+        }
+    }
+
+    let edge_dimming = 1.0 - 0.1 * smoothstep(0.04, 0.05, distance);
+    (
+        (red * edge_dimming).max(0.0),
+        (green * edge_dimming).max(0.0),
+        (blue * edge_dimming).max(0.0),
+    )
+}
+
+fn hash1(value: f32) -> f32 {
+    frac(value.sin() * 43758.5453)
+}
+
+fn hash2(x: f32, y: f32) -> (f32, f32) {
+    (
+        frac((x * 127.1 + y * 311.7).sin() * 43758.5453),
+        frac((x * 269.5 + y * 183.3).sin() * 43758.5453),
+    )
+}
+
+fn frac(value: f32) -> f32 {
+    value - value.floor()
+}
+
+fn saturate(value: f32) -> f32 {
+    value.clamp(0.0, 1.0)
+}
+
+fn smoothstep(edge0: f32, edge1: f32, value: f32) -> f32 {
+    let t = saturate((value - edge0) / (edge1 - edge0));
+    t * t * (3.0 - 2.0 * t)
+}
+
+fn lerp(start: f32, end: f32, amount: f32) -> f32 {
+    start + (end - start) * amount
+}
+
+fn pastel_spectrum(hue: f32) -> (f32, f32, f32) {
+    hsv_to_rgb(hue, 0.52, 0.98)
+}
+
+fn hsv_to_rgb(hue: f32, saturation: f32, value: f32) -> (f32, f32, f32) {
+    let h = frac(hue) * 6.0;
+    let c = value * saturation;
+    let x = c * (1.0 - ((h % 2.0) - 1.0).abs());
+    let m = value - c;
+    let (r, g, b) = if h < 1.0 {
+        (c, x, 0.0)
+    } else if h < 2.0 {
+        (x, c, 0.0)
+    } else if h < 3.0 {
+        (0.0, c, x)
+    } else if h < 4.0 {
+        (0.0, x, c)
+    } else if h < 5.0 {
+        (x, 0.0, c)
+    } else {
+        (c, 0.0, x)
+    };
+
+    (r + m, g + m, b + m)
+}
+
+fn color(r: f32, g: f32, b: f32) -> CultMathColor32 {
+    CultMathColor32 {
+        r: r.clamp(0.0, 255.0) as u8,
+        g: g.clamp(0.0, 255.0) as u8,
+        b: b.clamp(0.0, 255.0) as u8,
+        a: 255,
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn batch_sampler_writes_colors() {
+        let xs = [0.0, 20.0, 100.0];
+        let ys = [0.0, 30.0, 140.0];
+        let tones = [0, 3, 4];
+        let spans = [1920.0, 8.0, 8.0];
+        let mut out = [CultMathColor32::default(); 3];
+        let rc = unsafe {
+            cultmath_apollonian_voronoi_tones(
+                xs.as_ptr(),
+                ys.as_ptr(),
+                tones.as_ptr(),
+                spans.as_ptr(),
+                xs.len(),
+                1080.0,
+                12,
+                out.as_mut_ptr(),
+            )
+        };
+        assert_eq!(rc, 0);
+        assert!(out.iter().any(|color| color.r != 0 || color.g != 0 || color.b != 0));
+    }
+}
diff --git a/packages/cultmath/native/cultmath-core/src/lib.rs.meta b/packages/cultmath/native/cultmath-core/src/lib.rs.meta
new file mode 100644
index 00000000..2fa8aee8
--- /dev/null
+++ b/packages/cultmath/native/cultmath-core/src/lib.rs.meta
@@ -0,0 +1,7 @@
+fileFormatVersion: 2
+guid: b06c69c432a633f4584830d6b28d4473
+DefaultImporter:
+  externalObjects: {}
+  userData: 
+  assetBundleName: 
+  assetBundleVariant: 
diff --git a/packages/cultmath/scripts.meta b/packages/cultmath/scripts.meta
new file mode 100644
index 00000000..6f03c566
--- /dev/null
+++ b/packages/cultmath/scripts.meta
@@ -0,0 +1,8 @@
+fileFormatVersion: 2
+guid: 0ddff5b782cf14e43ae5cda048e040d8
+folderAsset: yes
+DefaultImporter:
+  externalObjects: {}
+  userData: 
+  assetBundleName: 
+  assetBundleVariant: 
diff --git a/packages/cultmath/scripts/build-unity-package.ps1 b/packages/cultmath/scripts/build-unity-package.ps1
new file mode 100644
index 00000000..b64e9446
--- /dev/null
+++ b/packages/cultmath/scripts/build-unity-package.ps1
@@ -0,0 +1,159 @@
+param(
+  [string] $Configuration = "Release",
+  [string] $OutputDirectory = "artifacts\unity\org.gamecult.cultmath"
+)
+
+$ErrorActionPreference = "Stop"
+
+$repoRoot = Split-Path -Parent $PSScriptRoot
+$projectPath = Join-Path $repoRoot "src\CultMath\CultMath.csproj"
+$templateRoot = Join-Path $repoRoot "unity\org.gamecult.cultmath"
+$buildRoot = Join-Path $repoRoot "artifacts\cultmath-unity-build"
+$outputRoot = if ([System.IO.Path]::IsPathRooted($OutputDirectory)) {
+  $OutputDirectory
+} else {
+  Join-Path $repoRoot $OutputDirectory
+}
+$freshAssembly = Join-Path $buildRoot "CultMath.dll"
+$freshSymbols = Join-Path $buildRoot "CultMath.pdb"
+$trackedPluginRoot = Join-Path $templateRoot "Runtime\Plugins"
+$trackedAssembly = Join-Path $trackedPluginRoot "CultMath.dll"
+$trackedSymbols = Join-Path $trackedPluginRoot "CultMath.pdb"
+
+if (Test-Path -LiteralPath $buildRoot) {
+  Remove-Item -LiteralPath $buildRoot -Recurse -Force
+}
+if (Test-Path -LiteralPath $outputRoot) {
+  Remove-Item -LiteralPath $outputRoot -Recurse -Force
+}
+
+# The tracked DLL and pdb are committed beside their source, so neither may name a commit: Source Link
+# writes the commit SHA into the pdb, and the DLL carries that pdb's content id.
+dotnet build $projectPath -c $Configuration -f netstandard2.1 -o $buildRoot --no-incremental `
+  --disable-build-servers -p:UseSharedCompilation=false -p:ContinuousIntegrationBuild=true -p:EnableSourceLink=false -m:1
+if ($LASTEXITCODE -ne 0) {
+  throw "CultMath Unity assembly build failed with exit code $LASTEXITCODE"
+}
+
+foreach ($path in @($freshAssembly, $freshSymbols)) {
+  if (-not (Test-Path -LiteralPath $path -PathType Leaf)) {
+    throw "CultMath Unity build is missing $path"
+  }
+}
+
+$requiredTemplateFiles = @(
+  "LICENSE.md",
+  "LICENSE.md.meta",
+  "README.md",
+  "README.md.meta",
+  "THIRD-PARTY-NOTICES.md",
+  "THIRD-PARTY-NOTICES.md.meta",
+  "package.json",
+  "package.json.meta",
+  "Runtime\Plugins\CultMath.dll",
+  "Runtime\Plugins\CultMath.dll.meta",
+  "Runtime\Plugins\CultMath.pdb",
+  "Runtime\Plugins\CultMath.pdb.meta",
+  "Runtime\UnityBridge\CultMath.UnityBridge.asmdef",
+  "Runtime\UnityBridge\CultMath.UnityBridge.asmdef.meta",
+  "Runtime\UnityBridge\UnityConversions.cs",
+  "Runtime\UnityBridge\UnityConversions.cs.meta",
+  "Shaders\CultMath.hlsl",
+  "Shaders\CultMath.hlsl.meta"
+)
+foreach ($relativePath in $requiredTemplateFiles) {
+  if (-not (Test-Path -LiteralPath (Join-Path $templateRoot $relativePath) -PathType Leaf)) {
+    throw "Tracked CultMath Unity package is incomplete: missing $relativePath"
+  }
+}
+
+$unityAssetFiles = @(Get-ChildItem -LiteralPath $templateRoot -Recurse -File | Where-Object {
+  $_.Extension -in @(".asmdef", ".cs", ".dll", ".pdb", ".hlsl")
+})
+$missingAssetMetas = @($unityAssetFiles | Where-Object { -not (Test-Path -LiteralPath ($_.FullName + ".meta")) })
+$missingDirectoryMetas = @(Get-ChildItem -LiteralPath $templateRoot -Recurse -Directory | Where-Object {
+  -not (Test-Path -LiteralPath ($_.FullName + ".meta"))
+})
+if ($missingAssetMetas.Count -ne 0 -or $missingDirectoryMetas.Count -ne 0) {
+  $missing = @($missingAssetMetas.FullName) + @($missingDirectoryMetas.FullName)
+  throw "Tracked CultMath Unity package has assets without stable .meta files: $($missing -join ', ')"
+}
+
+$manifest = Get-Content -LiteralPath (Join-Path $templateRoot "package.json") -Raw | ConvertFrom-Json
+$pluginMeta = Get-Content -LiteralPath ($trackedAssembly + ".meta") -Raw
+if ($pluginMeta -notmatch '(?m)^\s*isExplicitlyReferenced:\s*0\s*$') {
+  throw "CultMath.dll must be auto-referenced; explicit-only plugins do not reach dependent Unity asmdefs"
+}
+# The precompiled DLL is the only authority for CultMath's numeric types. The one
+# compiled assembly allowed beside it is the UnityEngine conversion bridge, which
+# references that DLL and must not re-declare core sources.
+$bridgeRoot = Join-Path $templateRoot "Runtime\UnityBridge"
+$bridgeDefinition = Join-Path $bridgeRoot "CultMath.UnityBridge.asmdef"
+$definitions = @(Get-ChildItem -LiteralPath $templateRoot -Recurse -File -Filter "*.asmdef")
+if ($definitions.Count -ne 1 -or $definitions[0].FullName -ne $bridgeDefinition) {
+  throw "CultMath's Unity package may define only the Runtime\UnityBridge assembly; found: $($definitions.FullName -join ', ')"
+}
+$bridge = Get-Content -LiteralPath $bridgeDefinition -Raw | ConvertFrom-Json
+if ($bridge.noEngineReferences -or -not $bridge.overrideReferences -or @($bridge.precompiledReferences) -notcontains "CultMath.dll") {
+  throw "CultMath.UnityBridge must reference UnityEngine and the precompiled CultMath.dll"
+}
+$expectedFileVersion = "$($manifest.version).0"
+$trackedFileVersion = [Diagnostics.FileVersionInfo]::GetVersionInfo($trackedAssembly).FileVersion
+$freshFileVersion = [Diagnostics.FileVersionInfo]::GetVersionInfo($freshAssembly).FileVersion
+if ($trackedFileVersion -ne $expectedFileVersion -or $freshFileVersion -ne $expectedFileVersion) {
+  throw "CultMath Unity assemblies must match package version $expectedFileVersion; tracked=$trackedFileVersion fresh=$freshFileVersion"
+}
+
+foreach ($pair in @(@($freshAssembly, $trackedAssembly), @($freshSymbols, $trackedSymbols))) {
+  $freshHash = (Get-FileHash -LiteralPath $pair[0] -Algorithm SHA256).Hash
+  $trackedHash = (Get-FileHash -LiteralPath $pair[1] -Algorithm SHA256).Hash
+  if ($freshHash -ne $trackedHash) {
+    throw "Tracked Unity artifact is stale: $($pair[1]) differs from a fresh deterministic build"
+  }
+}
+
+$trackedSourceFiles = @(Get-ChildItem -LiteralPath $templateRoot -Recurse -File -Filter "*.cs")
+$straySources = @($trackedSourceFiles | Where-Object { $_.DirectoryName -ne $bridgeRoot })
+if ($trackedSourceFiles.Count -eq 0 -or $straySources.Count -ne 0) {
+  throw "CultMath Unity package may compile only bridge sources under Runtime\UnityBridge: $($straySources.FullName -join ', ')"
+}
+
+# Check what the bridge declares, not what its files are called: it may declare types only in
+# CultMath.UnityBridge and never a type name the core CultMath sources declare.
+$declarationPattern = '\b(?:struct|class|enum|interface|record|delegate\s+[\w<>.,\s]+?)\s+(\w+)'
+function Get-CodeWithoutComments([string]$path) {
+  $text = Get-Content -LiteralPath $path -Raw
+  return [regex]::Replace($text, '(?s)/\*.*?\*/|//[^\r\n]*', '')
+}
+$coreTypeNames = @(Get-ChildItem -LiteralPath (Join-Path $repoRoot "src\CultMath") -File -Filter "*.cs" | ForEach-Object {
+  [regex]::Matches((Get-CodeWithoutComments $_.FullName), $declarationPattern) | ForEach-Object { $_.Groups[1].Value }
+} | Sort-Object -Unique)
+if ($coreTypeNames -notcontains "float3" -or $coreTypeNames -notcontains "math") {
+  throw "Could not read CultMath core type declarations; the bridge check would be vacuous"
+}
+foreach ($source in $trackedSourceFiles) {
+  $code = Get-CodeWithoutComments $source.FullName
+  $redeclared = @([regex]::Matches($code, $declarationPattern) | ForEach-Object { $_.Groups[1].Value } | Where-Object { $coreTypeNames -contains $_ })
+  $foreignNamespaces = @([regex]::Matches($code, '\bnamespace\s+([\w.]+)') | ForEach-Object { $_.Groups[1].Value } | Where-Object { $_ -ne "CultMath.UnityBridge" })
+  if ($redeclared.Count -ne 0 -or $foreignNamespaces.Count -ne 0) {
+    throw "CultMath.UnityBridge source $($source.Name) re-declares core types [$($redeclared -join ', ')] or uses namespaces [$($foreignNamespaces -join ', ')]; the precompiled DLL owns CultMath's types"
+  }
+}
+
+New-Item -ItemType Directory -Force -Path $outputRoot | Out-Null
+Copy-Item -Path (Join-Path $templateRoot "*") -Destination $outputRoot -Recurse -Force
+
+$stagedAssemblies = @(Get-ChildItem -LiteralPath (Join-Path $outputRoot "Runtime\Plugins") -Filter "*.dll")
+$stagedBridgeRoot = Join-Path $outputRoot "Runtime\UnityBridge"
+$stagedSources = @(Get-ChildItem -LiteralPath $outputRoot -Recurse -File -Filter "*.cs")
+$stagedDefinitions = @(Get-ChildItem -LiteralPath $outputRoot -Recurse -File -Filter "*.asmdef")
+$stagedStraySources = @($stagedSources | Where-Object { $_.DirectoryName -ne $stagedBridgeRoot })
+if ($stagedAssemblies.Count -ne 1 -or $stagedAssemblies[0].Name -ne "CultMath.dll" -or $stagedStraySources.Count -ne 0 -or $stagedDefinitions.Count -ne 1) {
+  throw "CultMath package must contain one owned auto-referenced DLL and only the UnityBridge assembly as source"
+}
+
+Write-Host "CultMath Unity package: $outputRoot"
+Write-Host "Package: $($manifest.name)@$($manifest.version)"
+Write-Host "Managed assemblies: $($stagedAssemblies.Count)"
+Write-Host "Bridge C# source files: $($stagedSources.Count)"
+Write-Host "Asmdef definitions: $($stagedDefinitions.Count)"
diff --git a/packages/cultmath/shaders.meta b/packages/cultmath/shaders.meta
new file mode 100644
index 00000000..46f9d445
--- /dev/null
+++ b/packages/cultmath/shaders.meta
@@ -0,0 +1,8 @@
+fileFormatVersion: 2
+guid: 3bed74ebcba445543800218dbe185034
+folderAsset: yes
+DefaultImporter:
+  externalObjects: {}
+  userData: 
+  assetBundleName: 
+  assetBundleVariant: 
diff --git a/packages/cultmath/shaders/CultMath.hlsl b/packages/cultmath/shaders/CultMath.hlsl
new file mode 100644
index 00000000..365705f5
--- /dev/null
+++ b/packages/cultmath/shaders/CultMath.hlsl
@@ -0,0 +1,356 @@
+#ifndef CULTMATH_HLSL
+#define CULTMATH_HLSL
+
+// CultMath HLSL mirror.
+//
+// HLSL already owns the float2/float3/float4 type names and most primitive
+// intrinsics. This include names the CultMath semantic surface explicitly so
+// shader code, C# wrappers, and Rust/native parity fixtures can share the same
+// small vocabulary without local helper drift.
+
+static const float CULTMATH_PI = 3.14159265358979323846;
+static const float CULTMATH_TAU = 6.28318530717958647692;
+static const float CULTMATH_HALF_PI = 1.57079632679489661923;
+static const float CULTMATH_NORMALIZE_EPSILON = 1.0e-20;
+
+float cultmath_radians(float degrees_value) { return degrees_value * (CULTMATH_PI / 180.0); }
+float cultmath_degrees(float radians_value) { return radians_value * (180.0 / CULTMATH_PI); }
+
+float cultmath_frac(float value) { return value - floor(value); }
+float2 cultmath_frac(float2 value) { return value - floor(value); }
+float3 cultmath_frac(float3 value) { return value - floor(value); }
+float4 cultmath_frac(float4 value) { return value - floor(value); }
+
+float cultmath_clamp(float value, float minimum, float maximum) { return min(max(value, minimum), maximum); }
+float2 cultmath_clamp(float2 value, float2 minimum, float2 maximum) { return min(max(value, minimum), maximum); }
+float3 cultmath_clamp(float3 value, float3 minimum, float3 maximum) { return min(max(value, minimum), maximum); }
+float4 cultmath_clamp(float4 value, float4 minimum, float4 maximum) { return min(max(value, minimum), maximum); }
+
+// DXIL Saturate is FMin(1, FMax(0, x)); dxc lowers min/max to the same FMin/FMax, NaN rules included.
+float cultmath_saturate(float value) { return min(1.0, max(0.0, value)); }
+float2 cultmath_saturate(float2 value) { return min(float2(1.0, 1.0), max(float2(0.0, 0.0), value)); }
+float3 cultmath_saturate(float3 value) { return min(float3(1.0, 1.0, 1.0), max(float3(0.0, 0.0, 0.0), value)); }
+float4 cultmath_saturate(float4 value) { return min(float4(1.0, 1.0, 1.0, 1.0), max(float4(0.0, 0.0, 0.0, 0.0), value)); }
+
+float cultmath_lerp(float start, float end, float amount) { return start + (end - start) * amount; }
+float2 cultmath_lerp(float2 start, float2 end, float2 amount) { return start + (end - start) * amount; }
+float3 cultmath_lerp(float3 start, float3 end, float3 amount) { return start + (end - start) * amount; }
+float4 cultmath_lerp(float4 start, float4 end, float4 amount) { return start + (end - start) * amount; }
+
+float cultmath_step(float edge, float value) { return value < edge ? 0.0 : 1.0; }
+float2 cultmath_step(float2 edge, float2 value) { return float2(cultmath_step(edge.x, value.x), cultmath_step(edge.y, value.y)); }
+float3 cultmath_step(float3 edge, float3 value) { return float3(cultmath_step(edge.x, value.x), cultmath_step(edge.y, value.y), cultmath_step(edge.z, value.z)); }
+float4 cultmath_step(float4 edge, float4 value) { return float4(cultmath_step(edge.x, value.x), cultmath_step(edge.y, value.y), cultmath_step(edge.z, value.z), cultmath_step(edge.w, value.w)); }
+
+float cultmath_smoothstep(float minimum, float maximum, float value)
+{
+    float t = cultmath_saturate((value - minimum) / (maximum - minimum));
+    return t * t * (3.0 - 2.0 * t);
+}
+
+float2 cultmath_smoothstep(float2 minimum, float2 maximum, float2 value)
+{
+    float2 t = cultmath_saturate((value - minimum) / (maximum - minimum));
+    return t * t * (float2(3.0, 3.0) - float2(2.0, 2.0) * t);
+}
+
+float3 cultmath_smoothstep(float3 minimum, float3 maximum, float3 value)
+{
+    float3 t = cultmath_saturate((value - minimum) / (maximum - minimum));
+    return t * t * (float3(3.0, 3.0, 3.0) - float3(2.0, 2.0, 2.0) * t);
+}
+
+float4 cultmath_smoothstep(float4 minimum, float4 maximum, float4 value)
+{
+    float4 t = cultmath_saturate((value - minimum) / (maximum - minimum));
+    return t * t * (float4(3.0, 3.0, 3.0, 3.0) - float4(2.0, 2.0, 2.0, 2.0) * t);
+}
+
+float cultmath_smoothstep01(float value) { return cultmath_smoothstep(0.0, 1.0, value); }
+
+float cultmath_smootherstep(float value)
+{
+    value = cultmath_saturate(value);
+    return value * value * value * (value * (value * 6.0 - 15.0) + 10.0);
+}
+
+float2 cultmath_snoise_mod289(float2 value) { return value - floor(value * (1.0 / 289.0)) * 289.0; }
+float3 cultmath_snoise_mod289(float3 value) { return value - floor(value * (1.0 / 289.0)) * 289.0; }
+float4 cultmath_snoise_mod289(float4 value) { return value - floor(value * (1.0 / 289.0)) * 289.0; }
+float3 cultmath_snoise_permute(float3 value) { return cultmath_snoise_mod289(((value * 34.0) + 1.0) * value); }
+float4 cultmath_snoise_permute(float4 value) { return cultmath_snoise_mod289(((value * 34.0) + 1.0) * value); }
+
+// Ashima Arts / Ian McEwan 3D simplex noise (MIT), same float32 evaluation
+// order as the C# math.snoise(float3) mirror.
+float cultmath_snoise(float3 value)
+{
+    float2 c = float2(1.0 / 6.0, 1.0 / 3.0);
+    float3 i = floor(value + dot(value, c.yyy));
+    float3 x0 = value - i + dot(i, c.xxx);
+    float3 g = step(x0.yzx, x0.xyz);
+    float3 l = 1.0 - g;
+    float3 i1 = min(g.xyz, l.zxy);
+    float3 i2 = max(g.xyz, l.zxy);
+    float3 x1 = x0 - i1 + c.xxx;
+    float3 x2 = x0 - i2 + c.yyy;
+    float3 x3 = x0 - 0.5;
+
+    i = cultmath_snoise_mod289(i);
+    float4 p = cultmath_snoise_permute(cultmath_snoise_permute(cultmath_snoise_permute(
+        i.z + float4(0.0, i1.z, i2.z, 1.0)) + i.y + float4(0.0, i1.y, i2.y, 1.0)) + i.x + float4(0.0, i1.x, i2.x, 1.0));
+
+    const float n_ = 0.142857142857;
+    float3 ns = float3(2.0 * n_, 0.5 * n_ - 1.0, n_);
+    float4 j = p - 49.0 * floor(p * ns.z * ns.z);
+    float4 x_ = floor(j * ns.z);
+    float4 y_ = floor(j - 7.0 * x_);
+    float4 x = x_ * ns.x + ns.yyyy;
+    float4 y = y_ * ns.x + ns.yyyy;
+    float4 h = 1.0 - abs(x) - abs(y);
+
+    float4 b0 = float4(x.xy, y.xy);
+    float4 b1 = float4(x.zw, y.zw);
+    float4 s0 = floor(b0) * 2.0 + 1.0;
+    float4 s1 = floor(b1) * 2.0 + 1.0;
+    float4 sh = -step(h, 0.0);
+    float4 a0 = b0.xzyw + s0.xzyw * sh.xxyy;
+    float4 a1 = b1.xzyw + s1.xzyw * sh.zzww;
+
+    float3 p0 = float3(a0.xy, h.x);
+    float3 p1 = float3(a0.zw, h.y);
+    float3 p2 = float3(a1.xy, h.z);
+    float3 p3 = float3(a1.zw, h.w);
+    float4 norm = 1.79284291400159 - 0.85373472095314 * float4(dot(p0, p0), dot(p1, p1), dot(p2, p2), dot(p3, p3));
+    p0 *= norm.x;
+    p1 *= norm.y;
+    p2 *= norm.z;
+    p3 *= norm.w;
+
+    float4 m = max(0.6 - float4(dot(x0, x0), dot(x1, x1), dot(x2, x2), dot(x3, x3)), 0.0);
+    m = m * m;
+    return 42.0 * dot(m * m, float4(dot(p0, x0), dot(p1, x1), dot(p2, x2), dot(p3, x3)));
+}
+
+float cultmath_snoise(float2 value)
+{
+    float4 c = float4(
+        0.211324865405187,
+        0.366025403784439,
+        -0.577350269189626,
+        0.024390243902439);
+    float2 i = floor(value + dot(value, c.yy));
+    float2 x0 = value - i + dot(i, c.xx);
+    float2 i1 = x0.x > x0.y ? float2(1.0, 0.0) : float2(0.0, 1.0);
+    float4 x12 = float4(x0.x + c.x - i1.x, x0.y + c.x - i1.y, x0.x + c.z, x0.y + c.z);
+
+    i = cultmath_snoise_mod289(i);
+    float3 p = cultmath_snoise_permute(
+        cultmath_snoise_permute(i.y + float3(0.0, i1.y, 1.0)) + i.x + float3(0.0, i1.x, 1.0));
+    float3 m = max(0.5 - float3(dot(x0, x0), dot(x12.xy, x12.xy), dot(x12.zw, x12.zw)), 0.0);
+    m *= m;
+    m *= m;
+
+    float3 x = 2.0 * frac(p * c.w) - 1.0;
+    float3 h = abs(x) - 0.5;
+    float3 ox = floor(x + 0.5);
+    float3 a0 = x - ox;
+    m *= 1.79284291400159 - 0.85373472095314 * (a0 * a0 + h * h);
+
+    float3 g = float3(
+        a0.x * x0.x + h.x * x0.y,
+        a0.y * x12.x + h.y * x12.y,
+        a0.z * x12.z + h.z * x12.w);
+    return 130.0 * dot(m, g);
+}
+
+float cultmath_lengthsq(float2 value) { return dot(value, value); }
+float cultmath_lengthsq(float3 value) { return dot(value, value); }
+float cultmath_lengthsq(float4 value) { return dot(value, value); }
+
+float cultmath_distance(float2 left, float2 right) { return length(left - right); }
+float cultmath_distance(float3 left, float3 right) { return length(left - right); }
+float cultmath_distance(float4 left, float4 right) { return length(left - right); }
+
+float2 cultmath_normalize(float2 value) { return value / max(length(value), CULTMATH_NORMALIZE_EPSILON); }
+float3 cultmath_normalize(float3 value) { return value / max(length(value), CULTMATH_NORMALIZE_EPSILON); }
+float4 cultmath_normalize(float4 value) { return value / max(length(value), CULTMATH_NORMALIZE_EPSILON); }
+
+float2 cultmath_reflect(float2 incident, float2 normal_value)
+{
+    return incident - 2.0 * dot(normal_value, incident) * normal_value;
+}
+
+float3 cultmath_reflect(float3 incident, float3 normal_value)
+{
+    return incident - 2.0 * dot(normal_value, incident) * normal_value;
+}
+
+float2 cultmath_rotate(float2 value, float radians_value)
+{
+    float s = sin(radians_value);
+    float c = cos(radians_value);
+    return float2(value.x * c - value.y * s, value.x * s + value.y * c);
+}
+
+float2 cultmath_rotate_degrees(float2 value, float degrees_value)
+{
+    return cultmath_rotate(value, cultmath_radians(degrees_value));
+}
+
+float cultmath_csum(float2 value) { return value.x + value.y; }
+float cultmath_csum(float3 value) { return value.x + value.y + value.z; }
+float cultmath_csum(float4 value) { return value.x + value.y + value.z + value.w; }
+
+float cultmath_decay(float source, float lambda_value, float dt) { return source * exp(-lambda_value * dt); }
+float2 cultmath_decay(float2 source, float lambda_value, float dt) { return source * exp(-lambda_value * dt); }
+float3 cultmath_decay(float3 source, float lambda_value, float dt) { return source * exp(-lambda_value * dt); }
+float4 cultmath_decay(float4 source, float lambda_value, float dt) { return source * exp(-lambda_value * dt); }
+
+float cultmath_damp(float start, float end, float lambda_value, float dt)
+{
+    return cultmath_lerp(start, end, 1.0 - exp(-lambda_value * dt));
+}
+
+float2 cultmath_damp(float2 start, float2 end, float lambda_value, float dt)
+{
+    return cultmath_lerp(start, end, 1.0 - exp(-lambda_value * dt));
+}
+
+float3 cultmath_damp(float3 start, float3 end, float lambda_value, float dt)
+{
+    return cultmath_lerp(start, end, 1.0 - exp(-lambda_value * dt));
+}
+
+float4 cultmath_damp(float4 start, float4 end, float lambda_value, float dt)
+{
+    return cultmath_lerp(start, end, 1.0 - exp(-lambda_value * dt));
+}
+
+float cultmath_catmullrom(float p0, float p1, float p2, float p3, float t)
+{
+    float t2 = t * t;
+    float t3 = t2 * t;
+    return 0.5 * ((2.0 * p1) + (p2 - p0) * t + (2.0 * p0 - 5.0 * p1 + 4.0 * p2 - p3) * t2 + (-p0 + 3.0 * p1 - 3.0 * p2 + p3) * t3);
+}
+
+float2 cultmath_catmullrom(float2 p0, float2 p1, float2 p2, float2 p3, float t)
+{
+    float t2 = t * t;
+    float t3 = t2 * t;
+    return 0.5 * ((2.0 * p1) + (p2 - p0) * t + (2.0 * p0 - 5.0 * p1 + 4.0 * p2 - p3) * t2 + (-p0 + 3.0 * p1 - 3.0 * p2 + p3) * t3);
+}
+
+float3 cultmath_catmullrom(float3 p0, float3 p1, float3 p2, float3 p3, float t)
+{
+    float t2 = t * t;
+    float t3 = t2 * t;
+    return 0.5 * ((2.0 * p1) + (p2 - p0) * t + (2.0 * p0 - 5.0 * p1 + 4.0 * p2 - p3) * t2 + (-p0 + 3.0 * p1 - 3.0 * p2 + p3) * t3);
+}
+
+float4 cultmath_catmullrom(float4 p0, float4 p1, float4 p2, float4 p3, float t)
+{
+    float t2 = t * t;
+    float t3 = t2 * t;
+    return 0.5 * ((2.0 * p1) + (p2 - p0) * t + (2.0 * p0 - 5.0 * p1 + 4.0 * p2 - p3) * t2 + (-p0 + 3.0 * p1 - 3.0 * p2 + p3) * t3);
+}
+
+float cultmath_quadratic_bezier(float p0, float p1, float p2, float t)
+{
+    t = cultmath_saturate(t);
+    float inv = 1.0 - t;
+    return inv * inv * p0 + 2.0 * inv * t * p1 + t * t * p2;
+}
+
+float3 cultmath_quadratic_bezier(float3 p0, float3 p1, float3 p2, float t)
+{
+    t = cultmath_saturate(t);
+    float inv = 1.0 - t;
+    return inv * inv * p0 + 2.0 * inv * t * p1 + t * t * p2;
+}
+
+float cultmath_cubic_bezier(float p0, float p1, float p2, float p3, float t)
+{
+    t = cultmath_saturate(t);
+    float inv = 1.0 - t;
+    return inv * inv * inv * p0 + 3.0 * inv * inv * t * p1 + 3.0 * inv * t * t * p2 + t * t * t * p3;
+}
+
+float3 cultmath_cubic_bezier(float3 p0, float3 p1, float3 p2, float3 p3, float t)
+{
+    t = cultmath_saturate(t);
+    float inv = 1.0 - t;
+    return inv * inv * inv * p0 + 3.0 * inv * inv * t * p1 + 3.0 * inv * t * t * p2 + t * t * t * p3;
+}
+
+float cultmath_hash(float value) { return cultmath_frac(sin(value) * 43758.5453); }
+float cultmath_hash(float2 value) { return cultmath_hash(dot(value, float2(127.1, 311.7))); }
+float cultmath_hash(float3 value) { return cultmath_hash(dot(value, float3(127.1, 311.7, 74.7))); }
+
+float cultmath_value_noise(float2 position)
+{
+    float2 cell = floor(position);
+    float2 local = cultmath_frac(position);
+    float2 u = local * local * (float2(3.0, 3.0) - float2(2.0, 2.0) * local);
+
+    float a = cultmath_hash(cell);
+    float b = cultmath_hash(cell + float2(1.0, 0.0));
+    float c = cultmath_hash(cell + float2(0.0, 1.0));
+    float d = cultmath_hash(cell + float2(1.0, 1.0));
+
+    return cultmath_lerp(cultmath_lerp(a, b, u.x), cultmath_lerp(c, d, u.x), u.y);
+}
+
+float cultmath_value_noise_bicubic(float2 position)
+{
+    float2 cell = floor(position);
+    float2 local = cultmath_frac(position);
+
+    float y0 = cultmath_catmullrom(cultmath_hash(cell + float2(-1.0, -1.0)), cultmath_hash(cell + float2(0.0, -1.0)), cultmath_hash(cell + float2(1.0, -1.0)), cultmath_hash(cell + float2(2.0, -1.0)), local.x);
+    float y1 = cultmath_catmullrom(cultmath_hash(cell + float2(-1.0, 0.0)), cultmath_hash(cell + float2(0.0, 0.0)), cultmath_hash(cell + float2(1.0, 0.0)), cultmath_hash(cell + float2(2.0, 0.0)), local.x);
+    float y2 = cultmath_catmullrom(cultmath_hash(cell + float2(-1.0, 1.0)), cultmath_hash(cell + float2(0.0, 1.0)), cultmath_hash(cell + float2(1.0, 1.0)), cultmath_hash(cell + float2(2.0, 1.0)), local.x);
+    float y3 = cultmath_catmullrom(cultmath_hash(cell + float2(-1.0, 2.0)), cultmath_hash(cell + float2(0.0, 2.0)), cultmath_hash(cell + float2(1.0, 2.0)), cultmath_hash(cell + float2(2.0, 2.0)), local.x);
+
+    return cultmath_catmullrom(y0, y1, y2, y3, local.y);
+}
+
+float cultmath_value_noise_texture(Texture2D<float> noise_texture, SamplerState noise_sampler, float2 uv, float scale)
+{
+    return noise_texture.SampleLevel(noise_sampler, uv * scale, 0.0).r;
+}
+
+float cultmath_value_noise_texture_bicubic(Texture2D<float> noise_texture, SamplerState noise_sampler, float2 uv, float scale, float2 texel_size)
+{
+    float2 position = uv * scale;
+    float2 cell = floor(position);
+    float2 local = cultmath_frac(position);
+    float2 base_uv = cell / scale;
+
+    float row0 = cultmath_catmullrom(
+        noise_texture.SampleLevel(noise_sampler, base_uv + texel_size * float2(-1.0, -1.0), 0.0).r,
+        noise_texture.SampleLevel(noise_sampler, base_uv + texel_size * float2(0.0, -1.0), 0.0).r,
+        noise_texture.SampleLevel(noise_sampler, base_uv + texel_size * float2(1.0, -1.0), 0.0).r,
+        noise_texture.SampleLevel(noise_sampler, base_uv + texel_size * float2(2.0, -1.0), 0.0).r,
+        local.x);
+    float row1 = cultmath_catmullrom(
+        noise_texture.SampleLevel(noise_sampler, base_uv + texel_size * float2(-1.0, 0.0), 0.0).r,
+        noise_texture.SampleLevel(noise_sampler, base_uv + texel_size * float2(0.0, 0.0), 0.0).r,
+        noise_texture.SampleLevel(noise_sampler, base_uv + texel_size * float2(1.0, 0.0), 0.0).r,
+        noise_texture.SampleLevel(noise_sampler, base_uv + texel_size * float2(2.0, 0.0), 0.0).r,
+        local.x);
+    float row2 = cultmath_catmullrom(
+        noise_texture.SampleLevel(noise_sampler, base_uv + texel_size * float2(-1.0, 1.0), 0.0).r,
+        noise_texture.SampleLevel(noise_sampler, base_uv + texel_size * float2(0.0, 1.0), 0.0).r,
+        noise_texture.SampleLevel(noise_sampler, base_uv + texel_size * float2(1.0, 1.0), 0.0).r,
+        noise_texture.SampleLevel(noise_sampler, base_uv + texel_size * float2(2.0, 1.0), 0.0).r,
+        local.x);
+    float row3 = cultmath_catmullrom(
+        noise_texture.SampleLevel(noise_sampler, base_uv + texel_size * float2(-1.0, 2.0), 0.0).r,
+        noise_texture.SampleLevel(noise_sampler, base_uv + texel_size * float2(0.0, 2.0), 0.0).r,
+        noise_texture.SampleLevel(noise_sampler, base_uv + texel_size * float2(1.0, 2.0), 0.0).r,
+        noise_texture.SampleLevel(noise_sampler, base_uv + texel_size * float2(2.0, 2.0), 0.0).r,
+        local.x);
+
+    return cultmath_catmullrom(row0, row1, row2, row3, local.y);
+}
+
+#endif
diff --git a/packages/cultmath/shaders/CultMath.hlsl.meta b/packages/cultmath/shaders/CultMath.hlsl.meta
new file mode 100644
index 00000000..d6b8542e
--- /dev/null
+++ b/packages/cultmath/shaders/CultMath.hlsl.meta
@@ -0,0 +1,7 @@
+fileFormatVersion: 2
+guid: 33174674795143c4a905408718f956f8
+ShaderIncludeImporter:
+  externalObjects: {}
+  userData: 
+  assetBundleName: 
+  assetBundleVariant: 
diff --git a/packages/cultmath/src.meta b/packages/cultmath/src.meta
new file mode 100644
index 00000000..3e88fcb9
--- /dev/null
+++ b/packages/cultmath/src.meta
@@ -0,0 +1,8 @@
+fileFormatVersion: 2
+guid: 64f48d0cae0810e4ba9903e9094fe4c6
+folderAsset: yes
+DefaultImporter:
+  externalObjects: {}
+  userData: 
+  assetBundleName: 
+  assetBundleVariant: 
diff --git a/packages/cultmath/src/CultMath.meta b/packages/cultmath/src/CultMath.meta
new file mode 100644
index 00000000..381b726d
--- /dev/null
+++ b/packages/cultmath/src/CultMath.meta
@@ -0,0 +1,8 @@
+fileFormatVersion: 2
+guid: e857b457b93397d4fb4ad8481cb72e4c
+folderAsset: yes
+DefaultImporter:
+  externalObjects: {}
+  userData: 
+  assetBundleName: 
+  assetBundleVariant: 
diff --git a/packages/cultmath/src/CultMath/BatchMath.cs b/packages/cultmath/src/CultMath/BatchMath.cs
new file mode 100644
index 00000000..04c042d9
--- /dev/null
+++ b/packages/cultmath/src/CultMath/BatchMath.cs
@@ -0,0 +1,245 @@
+using System;
+using System.Numerics;
+
+namespace CultMath;
+
+public static class BatchMath
+{
+    private const float MinimumDistanceSquared = 1.0e-8f;
+
+    public static int LaneCount => Vector<float>.Count;
+
+    public static bool IsHardwareAccelerated => Vector.IsHardwareAccelerated;
+
+    public static void Clear(Span<float> values) => values.Clear();
+
+    public static void AddRadialFalloffAcceleration2D(
+        ReadOnlySpan<float> positionX,
+        ReadOnlySpan<float> positionY,
+        float centerX,
+        float centerY,
+        float strength,
+        float radius,
+        Span<float> accelerationX,
+        Span<float> accelerationY)
+    {
+        ValidateEqualLengths(positionX.Length, positionY.Length, accelerationX.Length, accelerationY.Length);
+
+        if (radius <= 0.0f || strength == 0.0f || positionX.Length == 0)
+        {
+            return;
+        }
+
+        var radiusVector = new Vector<float>(radius);
+        var centerXVector = new Vector<float>(centerX);
+        var centerYVector = new Vector<float>(centerY);
+        var strengthVector = new Vector<float>(strength);
+        var one = Vector<float>.One;
+        var zero = Vector<float>.Zero;
+        var minimumDistanceSquared = new Vector<float>(MinimumDistanceSquared);
+
+        var i = 0;
+        var lanes = Vector<float>.Count;
+        var pxBuffer = new float[lanes];
+        var pyBuffer = new float[lanes];
+        var axBuffer = new float[lanes];
+        var ayBuffer = new float[lanes];
+        for (; i <= positionX.Length - lanes; i += lanes)
+        {
+            CopySpanToArray(positionX.Slice(i, lanes), pxBuffer);
+            CopySpanToArray(positionY.Slice(i, lanes), pyBuffer);
+            CopySpanToArray(accelerationX.Slice(i, lanes), axBuffer);
+            CopySpanToArray(accelerationY.Slice(i, lanes), ayBuffer);
+
+            var px = new Vector<float>(pxBuffer);
+            var py = new Vector<float>(pyBuffer);
+            var dx = centerXVector - px;
+            var dy = centerYVector - py;
+            var distanceSquared = Vector.Max(dx * dx + dy * dy, minimumDistanceSquared);
+            var distance = Vector.SquareRoot(distanceSquared);
+            var inRange = Vector.LessThanOrEqual(distance, radiusVector);
+            var falloff = Vector.Max(zero, one - distance / radiusVector);
+            var magnitude = strengthVector * falloff;
+            var ax = Vector.ConditionalSelect(inRange, dx / distance * magnitude, zero);
+            var ay = Vector.ConditionalSelect(inRange, dy / distance * magnitude, zero);
+
+            (new Vector<float>(axBuffer) + ax).CopyTo(axBuffer);
+            (new Vector<float>(ayBuffer) + ay).CopyTo(ayBuffer);
+            CopyArrayToSpan(axBuffer, accelerationX.Slice(i, lanes));
+            CopyArrayToSpan(ayBuffer, accelerationY.Slice(i, lanes));
+        }
+
+        for (; i < positionX.Length; i++)
+        {
+            var dx = centerX - positionX[i];
+            var dy = centerY - positionY[i];
+            var distanceSquared = MathF.Max(dx * dx + dy * dy, MinimumDistanceSquared);
+            var distance = MathF.Sqrt(distanceSquared);
+            if (distance > radius)
+            {
+                continue;
+            }
+
+            var falloff = MathF.Max(0.0f, 1.0f - distance / radius);
+            var magnitude = strength * falloff;
+            accelerationX[i] += dx / distance * magnitude;
+            accelerationY[i] += dy / distance * magnitude;
+        }
+    }
+
+    public static void AddRadialFalloffAcceleration2D(
+        ReadOnlySpan<float2> positions,
+        float2 center,
+        float strength,
+        float radius,
+        Span<float2> acceleration)
+    {
+        ValidateEqualLengths(positions.Length, acceleration.Length);
+
+        if (radius <= 0.0f || strength == 0.0f || positions.Length == 0)
+        {
+            return;
+        }
+
+        for (var i = 0; i < positions.Length; i++)
+        {
+            var delta = center - positions[i];
+            var distanceSquared = MathF.Max(delta.x * delta.x + delta.y * delta.y, MinimumDistanceSquared);
+            var distance = MathF.Sqrt(distanceSquared);
+            if (distance > radius)
+            {
+                continue;
+            }
+
+            var falloff = MathF.Max(0.0f, 1.0f - distance / radius);
+            acceleration[i] += delta / distance * (strength * falloff);
+        }
+    }
+
+    public static void IntegrateSemiImplicitEuler2D(
+        float deltaTime,
+        ReadOnlySpan<float> dynamicMask,
+        Span<float> positionX,
+        Span<float> positionY,
+        Span<float> velocityX,
+        Span<float> velocityY,
+        ReadOnlySpan<float> accelerationX,
+        ReadOnlySpan<float> accelerationY)
+    {
+        if (deltaTime <= 0.0f)
+        {
+            throw new ArgumentOutOfRangeException(nameof(deltaTime), "Delta time must be positive.");
+        }
+
+        ValidateEqualLengths(
+            dynamicMask.Length,
+            positionX.Length,
+            positionY.Length,
+            velocityX.Length,
+            velocityY.Length,
+            accelerationX.Length,
+            accelerationY.Length);
+
+        var delta = new Vector<float>(deltaTime);
+        var i = 0;
+        var lanes = Vector<float>.Count;
+        var maskBuffer = new float[lanes];
+        var pxBuffer = new float[lanes];
+        var pyBuffer = new float[lanes];
+        var vxBuffer = new float[lanes];
+        var vyBuffer = new float[lanes];
+        var axBuffer = new float[lanes];
+        var ayBuffer = new float[lanes];
+        for (; i <= positionX.Length - lanes; i += lanes)
+        {
+            CopySpanToArray(dynamicMask.Slice(i, lanes), maskBuffer);
+            CopySpanToArray(velocityX.Slice(i, lanes), vxBuffer);
+            CopySpanToArray(velocityY.Slice(i, lanes), vyBuffer);
+            CopySpanToArray(positionX.Slice(i, lanes), pxBuffer);
+            CopySpanToArray(positionY.Slice(i, lanes), pyBuffer);
+            CopySpanToArray(accelerationX.Slice(i, lanes), axBuffer);
+            CopySpanToArray(accelerationY.Slice(i, lanes), ayBuffer);
+
+            var mask = new Vector<float>(maskBuffer);
+            var vx = new Vector<float>(vxBuffer);
+            var vy = new Vector<float>(vyBuffer);
+            var px = new Vector<float>(pxBuffer);
+            var py = new Vector<float>(pyBuffer);
+            var ax = new Vector<float>(axBuffer);
+            var ay = new Vector<float>(ayBuffer);
+
+            vx += ax * delta * mask;
+            vy += ay * delta * mask;
+            px += vx * delta * mask;
+            py += vy * delta * mask;
+
+            vx.CopyTo(vxBuffer);
+            vy.CopyTo(vyBuffer);
+            px.CopyTo(pxBuffer);
+            py.CopyTo(pyBuffer);
+            CopyArrayToSpan(vxBuffer, velocityX.Slice(i, lanes));
+            CopyArrayToSpan(vyBuffer, velocityY.Slice(i, lanes));
+            CopyArrayToSpan(pxBuffer, positionX.Slice(i, lanes));
+            CopyArrayToSpan(pyBuffer, positionY.Slice(i, lanes));
+        }
+
+        for (; i < positionX.Length; i++)
+        {
+            var mask = dynamicMask[i];
+            velocityX[i] += accelerationX[i] * deltaTime * mask;
+            velocityY[i] += accelerationY[i] * deltaTime * mask;
+            positionX[i] += velocityX[i] * deltaTime * mask;
+            positionY[i] += velocityY[i] * deltaTime * mask;
+        }
+    }
+
+    public static void IntegrateSemiImplicitEuler2D(
+        float deltaTime,
+        ReadOnlySpan<float> dynamicMask,
+        Span<float2> position,
+        Span<float2> velocity,
+        ReadOnlySpan<float2> acceleration)
+    {
+        if (deltaTime <= 0.0f)
+        {
+            throw new ArgumentOutOfRangeException(nameof(deltaTime), "Delta time must be positive.");
+        }
+
+        ValidateEqualLengths(dynamicMask.Length, position.Length, velocity.Length, acceleration.Length);
+
+        for (var i = 0; i < position.Length; i++)
+        {
+            var mask = dynamicMask[i];
+            velocity[i] += acceleration[i] * deltaTime * mask;
+            position[i] += velocity[i] * deltaTime * mask;
+        }
+    }
+
+    private static void ValidateEqualLengths(params int[] lengths)
+    {
+        var length = lengths[0];
+        for (var i = 1; i < lengths.Length; i++)
+        {
+            if (lengths[i] != length)
+            {
+                throw new ArgumentException("CultMath batch spans must have equal length.");
+            }
+        }
+    }
+
+    private static void CopySpanToArray(ReadOnlySpan<float> source, float[] destination)
+    {
+        for (var i = 0; i < source.Length; i++)
+        {
+            destination[i] = source[i];
+        }
+    }
+
+    private static void CopyArrayToSpan(float[] source, Span<float> destination)
+    {
+        for (var i = 0; i < destination.Length; i++)
+        {
+            destination[i] = source[i];
+        }
+    }
+}
diff --git a/packages/cultmath/src/CultMath/BatchMath.cs.meta b/packages/cultmath/src/CultMath/BatchMath.cs.meta
new file mode 100644
index 00000000..fe7c6033
--- /dev/null
+++ b/packages/cultmath/src/CultMath/BatchMath.cs.meta
@@ -0,0 +1,2 @@
+fileFormatVersion: 2
+guid: d4771320e190bdd408dd296c293a9d0e
\ No newline at end of file
diff --git a/packages/cultmath/src/CultMath/Color32.cs b/packages/cultmath/src/CultMath/Color32.cs
new file mode 100644
index 00000000..e9a2b481
--- /dev/null
+++ b/packages/cultmath/src/CultMath/Color32.cs
@@ -0,0 +1,4 @@
+namespace CultMath;
+
+[System.Runtime.InteropServices.StructLayout(System.Runtime.InteropServices.LayoutKind.Sequential)]
+public readonly record struct Color32(byte r, byte g, byte b, byte a = 255);
diff --git a/packages/cultmath/src/CultMath/Color32.cs.meta b/packages/cultmath/src/CultMath/Color32.cs.meta
new file mode 100644
index 00000000..71e1ba55
--- /dev/null
+++ b/packages/cultmath/src/CultMath/Color32.cs.meta
@@ -0,0 +1,2 @@
+fileFormatVersion: 2
+guid: bfa14a9aacb8ac4448761568643f2bc6
\ No newline at end of file
diff --git a/packages/cultmath/src/CultMath/CultMath.asmdef b/packages/cultmath/src/CultMath/CultMath.asmdef
new file mode 100644
index 00000000..449549f6
--- /dev/null
+++ b/packages/cultmath/src/CultMath/CultMath.asmdef
@@ -0,0 +1,14 @@
+{
+  "name": "CultMath",
+  "rootNamespace": "CultMath",
+  "references": [],
+  "includePlatforms": [],
+  "excludePlatforms": [],
+  "allowUnsafeCode": true,
+  "overrideReferences": false,
+  "precompiledReferences": [],
+  "autoReferenced": true,
+  "defineConstraints": [],
+  "versionDefines": [],
+  "noEngineReferences": true
+}
diff --git a/packages/cultmath/src/CultMath/CultMath.asmdef.meta b/packages/cultmath/src/CultMath/CultMath.asmdef.meta
new file mode 100644
index 00000000..5a26d2c5
--- /dev/null
+++ b/packages/cultmath/src/CultMath/CultMath.asmdef.meta
@@ -0,0 +1,7 @@
+fileFormatVersion: 2
+guid: f0b66b909d13e18468f7aa56221531e9
+AssemblyDefinitionImporter:
+  externalObjects: {}
+  userData: 
+  assetBundleName: 
+  assetBundleVariant: 
diff --git a/packages/cultmath/src/CultMath/CultMath.csproj b/packages/cultmath/src/CultMath/CultMath.csproj
new file mode 100644
index 00000000..7c567105
--- /dev/null
+++ b/packages/cultmath/src/CultMath/CultMath.csproj
@@ -0,0 +1,26 @@
+<Project Sdk="Microsoft.NET.Sdk">
+
+  <PropertyGroup>
+    <TargetFrameworks>net8.0;netstandard2.1</TargetFrameworks>
+    <ImplicitUsings>enable</ImplicitUsings>
+    <Nullable>enable</Nullable>
+    <LangVersion>latest</LangVersion>
+    <RootNamespace>CultMath</RootNamespace>
+    <AssemblyName>CultMath</AssemblyName>
+    <PackageId>GameCult.Math</PackageId>
+    <Version>0.2.0</Version>
+    <Description>Clean-room C# math shaped for HLSL-style renderer code.</Description>
+    <Authors>GameCult</Authors>
+    <PackageReadmeFile>README.md</PackageReadmeFile>
+    <NoWarn>$(NoWarn);CS8981</NoWarn>
+    <AllowUnsafeBlocks>true</AllowUnsafeBlocks>
+    <!-- The Unity DLL is committed beside its source, so its bytes must not name a commit. -->
+    <IncludeSourceRevisionInInformationalVersion>false</IncludeSourceRevisionInInformationalVersion>
+  </PropertyGroup>
+
+  <ItemGroup>
+    <None Include="..\..\README.md" Pack="true" PackagePath="\" />
+    <None Include="..\..\shaders\CultMath.hlsl" Pack="true" PackagePath="contentFiles\any\any\shaders\CultMath.hlsl" CopyToOutputDirectory="PreserveNewest" />
+  </ItemGroup>
+
+</Project>
diff --git a/packages/cultmath/src/CultMath/CultMath.csproj.meta b/packages/cultmath/src/CultMath/CultMath.csproj.meta
new file mode 100644
index 00000000..78fc304d
--- /dev/null
+++ b/packages/cultmath/src/CultMath/CultMath.csproj.meta
@@ -0,0 +1,7 @@
+fileFormatVersion: 2
+guid: 77e1a0a2512910f41885650a7d0d6f60
+DefaultImporter:
+  externalObjects: {}
+  userData: 
+  assetBundleName: 
+  assetBundleVariant: 
diff --git a/packages/cultmath/src/CultMath/CultMathTone.cs b/packages/cultmath/src/CultMath/CultMathTone.cs
new file mode 100644
index 00000000..25dfffeb
--- /dev/null
+++ b/packages/cultmath/src/CultMath/CultMathTone.cs
@@ -0,0 +1,10 @@
+namespace CultMath;
+
+public enum CultMathTone : byte
+{
+    Background = 0,
+    Panel = 1,
+    Edge = 2,
+    Header = 3,
+    Body = 4,
+}
diff --git a/packages/cultmath/src/CultMath/CultMathTone.cs.meta b/packages/cultmath/src/CultMath/CultMathTone.cs.meta
new file mode 100644
index 00000000..f41d1475
--- /dev/null
+++ b/packages/cultmath/src/CultMath/CultMathTone.cs.meta
@@ -0,0 +1,2 @@
+fileFormatVersion: 2
+guid: d4bfc66f9f7e992448f884c2c338d50a
\ No newline at end of file
diff --git a/packages/cultmath/src/CultMath/IsExternalInit.cs b/packages/cultmath/src/CultMath/IsExternalInit.cs
new file mode 100644
index 00000000..b05eb4a1
--- /dev/null
+++ b/packages/cultmath/src/CultMath/IsExternalInit.cs
@@ -0,0 +1,5 @@
+namespace System.Runtime.CompilerServices;
+
+internal static class IsExternalInit
+{
+}
diff --git a/packages/cultmath/src/CultMath/IsExternalInit.cs.meta b/packages/cultmath/src/CultMath/IsExternalInit.cs.meta
new file mode 100644
index 00000000..ca761bcb
--- /dev/null
+++ b/packages/cultmath/src/CultMath/IsExternalInit.cs.meta
@@ -0,0 +1,2 @@
+fileFormatVersion: 2
+guid: de2b3c3e7f03c354aa2b84fbbc55b497
\ No newline at end of file
diff --git a/packages/cultmath/src/CultMath/Random.cs b/packages/cultmath/src/CultMath/Random.cs
new file mode 100644
index 00000000..6892e20c
--- /dev/null
+++ b/packages/cultmath/src/CultMath/Random.cs
@@ -0,0 +1,66 @@
+namespace CultMath;
+
+public struct Random
+{
+    private const uint DefaultSeed = 0x6E624EB7u;
+
+    public uint state;
+
+    public Random(uint seed)
+    {
+        state = seed == 0 ? DefaultSeed : seed;
+    }
+
+    public static Random CreateFromIndex(uint index) => new(index + DefaultSeed);
+
+    public void InitState(uint seed)
+    {
+        state = seed == 0 ? DefaultSeed : seed;
+    }
+
+    public uint NextUInt()
+    {
+        var x = state == 0 ? DefaultSeed : state;
+        x ^= x << 13;
+        x ^= x >> 17;
+        x ^= x << 5;
+        state = x == 0 ? DefaultSeed : x;
+        return state;
+    }
+
+    public int NextInt(int max) => NextInt(0, max);
+
+    public int NextInt(int min, int max)
+    {
+        if (max <= min)
+        {
+            return min;
+        }
+
+        return min + (int)(NextUInt() % (uint)(max - min));
+    }
+
+    public float NextFloat() => (NextUInt() >> 8) * (1.0f / 16777216.0f);
+
+    public float NextFloat(float max) => NextFloat() * max;
+
+    public float NextFloat(float min, float max) => min + NextFloat() * (max - min);
+
+    public float2 NextFloat2() => new(NextFloat(), NextFloat());
+
+    public float2 NextFloat2(float min, float max) => new(NextFloat(min, max), NextFloat(min, max));
+
+    public float2 NextFloat2(float2 min, float2 max) => min + NextFloat2() * (max - min);
+
+    public float2 NextFloat2Direction()
+    {
+        var angle = NextFloat(0.0f, math.TAU);
+        return new float2(math.cos(angle), math.sin(angle));
+    }
+
+    public float3 NextFloat3() => new(NextFloat(), NextFloat(), NextFloat());
+
+    public float3 NextFloat3(float3 max) => NextFloat3() * max;
+
+    public float3 NextFloat3(float3 min, float3 max) => min + NextFloat3() * (max - min);
+}
diff --git a/packages/cultmath/src/CultMath/Random.cs.meta b/packages/cultmath/src/CultMath/Random.cs.meta
new file mode 100644
index 00000000..55032ded
--- /dev/null
+++ b/packages/cultmath/src/CultMath/Random.cs.meta
@@ -0,0 +1,2 @@
+fileFormatVersion: 2
+guid: 7c1a557259026da4ca20b54264852c13
\ No newline at end of file
diff --git a/packages/cultmath/src/CultMath/Swizzles.g.cs b/packages/cultmath/src/CultMath/Swizzles.g.cs
new file mode 100644
index 00000000..ce84bbc4
--- /dev/null
+++ b/packages/cultmath/src/CultMath/Swizzles.g.cs
@@ -0,0 +1,3137 @@
+// <auto-generated>
+// Generated by tools/generate-swizzles.ps1. Do not edit by hand.
+// </auto-generated>
+
+namespace CultMath;
+
+public partial struct float2
+{
+    public float2(float2 xy) : this(xy.x, xy.y) { }
+    public float r { readonly get => x; set => x = value; }
+    public float g { readonly get => y; set => y = value; }
+    public readonly float2 xx => new(x, x);
+    public float2 xy { readonly get => new(x, y); set { x = value.x; y = value.y; } }
+    public float2 yx { readonly get => new(y, x); set { y = value.x; x = value.y; } }
+    public readonly float2 yy => new(y, y);
+    public readonly float3 xxx => new(x, x, x);
+    public readonly float3 xxy => new(x, x, y);
+    public readonly float3 xyx => new(x, y, x);
+    public readonly float3 xyy => new(x, y, y);
+    public readonly float3 yxx => new(y, x, x);
+    public readonly float3 yxy => new(y, x, y);
+    public readonly float3 yyx => new(y, y, x);
+    public readonly float3 yyy => new(y, y, y);
+    public readonly float4 xxxx => new(x, x, x, x);
+    public readonly float4 xxxy => new(x, x, x, y);
+    public readonly float4 xxyx => new(x, x, y, x);
+    public readonly float4 xxyy => new(x, x, y, y);
+    public readonly float4 xyxx => new(x, y, x, x);
+    public readonly float4 xyxy => new(x, y, x, y);
+    public readonly float4 xyyx => new(x, y, y, x);
+    public readonly float4 xyyy => new(x, y, y, y);
+    public readonly float4 yxxx => new(y, x, x, x);
+    public readonly float4 yxxy => new(y, x, x, y);
+    public readonly float4 yxyx => new(y, x, y, x);
+    public readonly float4 yxyy => new(y, x, y, y);
+    public readonly float4 yyxx => new(y, y, x, x);
+    public readonly float4 yyxy => new(y, y, x, y);
+    public readonly float4 yyyx => new(y, y, y, x);
+    public readonly float4 yyyy => new(y, y, y, y);
+    public readonly float2 rr => new(x, x);
+    public float2 rg { readonly get => new(x, y); set { x = value.x; y = value.y; } }
+    public float2 gr { readonly get => new(y, x); set { y = value.x; x = value.y; } }
+    public readonly float2 gg => new(y, y);
+    public readonly float3 rrr => new(x, x, x);
+    public readonly float3 rrg => new(x, x, y);
+    public readonly float3 rgr => new(x, y, x);
+    public readonly float3 rgg => new(x, y, y);
+    public readonly float3 grr => new(y, x, x);
+    public readonly float3 grg => new(y, x, y);
+    public readonly float3 ggr => new(y, y, x);
+    public readonly float3 ggg => new(y, y, y);
+    public readonly float4 rrrr => new(x, x, x, x);
+    public readonly float4 rrrg => new(x, x, x, y);
+    public readonly float4 rrgr => new(x, x, y, x);
+    public readonly float4 rrgg => new(x, x, y, y);
+    public readonly float4 rgrr => new(x, y, x, x);
+    public readonly float4 rgrg => new(x, y, x, y);
+    public readonly float4 rggr => new(x, y, y, x);
+    public readonly float4 rggg => new(x, y, y, y);
+    public readonly float4 grrr => new(y, x, x, x);
+    public readonly float4 grrg => new(y, x, x, y);
+    public readonly float4 grgr => new(y, x, y, x);
+    public readonly float4 grgg => new(y, x, y, y);
+    public readonly float4 ggrr => new(y, y, x, x);
+    public readonly float4 ggrg => new(y, y, x, y);
+    public readonly float4 gggr => new(y, y, y, x);
+    public readonly float4 gggg => new(y, y, y, y);
+}
+
+public partial struct float3
+{
+    public float3(float x, float2 yz) : this(x, yz.x, yz.y) { }
+    public float3(float2 xy, float z) : this(xy.x, xy.y, z) { }
+    public float3(float3 xyz) : this(xyz.x, xyz.y, xyz.z) { }
+    public float r { readonly get => x; set => x = value; }
+    public float g { readonly get => y; set => y = value; }
+    public float b { readonly get => z; set => z = value; }
+    public readonly float2 xx => new(x, x);
+    public float2 xy { readonly get => new(x, y); set { x = value.x; y = value.y; } }
+    public float2 xz { readonly get => new(x, z); set { x = value.x; z = value.y; } }
+    public float2 yx { readonly get => new(y, x); set { y = value.x; x = value.y; } }
+    public readonly float2 yy => new(y, y);
+    public float2 yz { readonly get => new(y, z); set { y = value.x; z = value.y; } }
+    public float2 zx { readonly get => new(z, x); set { z = value.x; x = value.y; } }
+    public float2 zy { readonly get => new(z, y); set { z = value.x; y = value.y; } }
+    public readonly float2 zz => new(z, z);
+    public readonly float3 xxx => new(x, x, x);
+    public readonly float3 xxy => new(x, x, y);
+    public readonly float3 xxz => new(x, x, z);
+    public readonly float3 xyx => new(x, y, x);
+    public readonly float3 xyy => new(x, y, y);
+    public float3 xyz { readonly get => new(x, y, z); set { x = value.x; y = value.y; z = value.z; } }
+    public readonly float3 xzx => new(x, z, x);
+    public float3 xzy { readonly get => new(x, z, y); set { x = value.x; z = value.y; y = value.z; } }
+    public readonly float3 xzz => new(x, z, z);
+    public readonly float3 yxx => new(y, x, x);
+    public readonly float3 yxy => new(y, x, y);
+    public float3 yxz { readonly get => new(y, x, z); set { y = value.x; x = value.y; z = value.z; } }
+    public readonly float3 yyx => new(y, y, x);
+    public readonly float3 yyy => new(y, y, y);
+    public readonly float3 yyz => new(y, y, z);
+    public float3 yzx { readonly get => new(y, z, x); set { y = value.x; z = value.y; x = value.z; } }
+    public readonly float3 yzy => new(y, z, y);
+    public readonly float3 yzz => new(y, z, z);
+    public readonly float3 zxx => new(z, x, x);
+    public float3 zxy { readonly get => new(z, x, y); set { z = value.x; x = value.y; y = value.z; } }
+    public readonly float3 zxz => new(z, x, z);
+    public float3 zyx { readonly get => new(z, y, x); set { z = value.x; y = value.y; x = value.z; } }
+    public readonly float3 zyy => new(z, y, y);
+    public readonly float3 zyz => new(z, y, z);
+    public readonly float3 zzx => new(z, z, x);
+    public readonly float3 zzy => new(z, z, y);
+    public readonly float3 zzz => new(z, z, z);
+    public readonly float4 xxxx => new(x, x, x, x);
+    public readonly float4 xxxy => new(x, x, x, y);
+    public readonly float4 xxxz => new(x, x, x, z);
+    public readonly float4 xxyx => new(x, x, y, x);
+    public readonly float4 xxyy => new(x, x, y, y);
+    public readonly float4 xxyz => new(x, x, y, z);
+    public readonly float4 xxzx => new(x, x, z, x);
+    public readonly float4 xxzy => new(x, x, z, y);
+    public readonly float4 xxzz => new(x, x, z, z);
+    public readonly float4 xyxx => new(x, y, x, x);
+    public readonly float4 xyxy => new(x, y, x, y);
+    public readonly float4 xyxz => new(x, y, x, z);
+    public readonly float4 xyyx => new(x, y, y, x);
+    public readonly float4 xyyy => new(x, y, y, y);
+    public readonly float4 xyyz => new(x, y, y, z);
+    public readonly float4 xyzx => new(x, y, z, x);
+    public readonly float4 xyzy => new(x, y, z, y);
+    public readonly float4 xyzz => new(x, y, z, z);
+    public readonly float4 xzxx => new(x, z, x, x);
+    public readonly float4 xzxy => new(x, z, x, y);
+    public readonly float4 xzxz => new(x, z, x, z);
+    public readonly float4 xzyx => new(x, z, y, x);
+    public readonly float4 xzyy => new(x, z, y, y);
+    public readonly float4 xzyz => new(x, z, y, z);
+    public readonly float4 xzzx => new(x, z, z, x);
+    public readonly float4 xzzy => new(x, z, z, y);
+    public readonly float4 xzzz => new(x, z, z, z);
+    public readonly float4 yxxx => new(y, x, x, x);
+    public readonly float4 yxxy => new(y, x, x, y);
+    public readonly float4 yxxz => new(y, x, x, z);
+    public readonly float4 yxyx => new(y, x, y, x);
+    public readonly float4 yxyy => new(y, x, y, y);
+    public readonly float4 yxyz => new(y, x, y, z);
+    public readonly float4 yxzx => new(y, x, z, x);
+    public readonly float4 yxzy => new(y, x, z, y);
+    public readonly float4 yxzz => new(y, x, z, z);
+    public readonly float4 yyxx => new(y, y, x, x);
+    public readonly float4 yyxy => new(y, y, x, y);
+    public readonly float4 yyxz => new(y, y, x, z);
+    public readonly float4 yyyx => new(y, y, y, x);
+    public readonly float4 yyyy => new(y, y, y, y);
+    public readonly float4 yyyz => new(y, y, y, z);
+    public readonly float4 yyzx => new(y, y, z, x);
+    public readonly float4 yyzy => new(y, y, z, y);
+    public readonly float4 yyzz => new(y, y, z, z);
+    public readonly float4 yzxx => new(y, z, x, x);
+    public readonly float4 yzxy => new(y, z, x, y);
+    public readonly float4 yzxz => new(y, z, x, z);
+    public readonly float4 yzyx => new(y, z, y, x);
+    public readonly float4 yzyy => new(y, z, y, y);
+    public readonly float4 yzyz => new(y, z, y, z);
+    public readonly float4 yzzx => new(y, z, z, x);
+    public readonly float4 yzzy => new(y, z, z, y);
+    public readonly float4 yzzz => new(y, z, z, z);
+    public readonly float4 zxxx => new(z, x, x, x);
+    public readonly float4 zxxy => new(z, x, x, y);
+    public readonly float4 zxxz => new(z, x, x, z);
+    public readonly float4 zxyx => new(z, x, y, x);
+    public readonly float4 zxyy => new(z, x, y, y);
+    public readonly float4 zxyz => new(z, x, y, z);
+    public readonly float4 zxzx => new(z, x, z, x);
+    public readonly float4 zxzy => new(z, x, z, y);
+    public readonly float4 zxzz => new(z, x, z, z);
+    public readonly float4 zyxx => new(z, y, x, x);
+    public readonly float4 zyxy => new(z, y, x, y);
+    public readonly float4 zyxz => new(z, y, x, z);
+    public readonly float4 zyyx => new(z, y, y, x);
+    public readonly float4 zyyy => new(z, y, y, y);
+    public readonly float4 zyyz => new(z, y, y, z);
+    public readonly float4 zyzx => new(z, y, z, x);
+    public readonly float4 zyzy => new(z, y, z, y);
+    public readonly float4 zyzz => new(z, y, z, z);
+    public readonly float4 zzxx => new(z, z, x, x);
+    public readonly float4 zzxy => new(z, z, x, y);
+    public readonly float4 zzxz => new(z, z, x, z);
+    public readonly float4 zzyx => new(z, z, y, x);
+    public readonly float4 zzyy => new(z, z, y, y);
+    public readonly float4 zzyz => new(z, z, y, z);
+    public readonly float4 zzzx => new(z, z, z, x);
+    public readonly float4 zzzy => new(z, z, z, y);
+    public readonly float4 zzzz => new(z, z, z, z);
+    public readonly float2 rr => new(x, x);
+    public float2 rg { readonly get => new(x, y); set { x = value.x; y = value.y; } }
+    public float2 rb { readonly get => new(x, z); set { x = value.x; z = value.y; } }
+    public float2 gr { readonly get => new(y, x); set { y = value.x; x = value.y; } }
+    public readonly float2 gg => new(y, y);
+    public float2 gb { readonly get => new(y, z); set { y = value.x; z = value.y; } }
+    public float2 br { readonly get => new(z, x); set { z = value.x; x = value.y; } }
+    public float2 bg { readonly get => new(z, y); set { z = value.x; y = value.y; } }
+    public readonly float2 bb => new(z, z);
+    public readonly float3 rrr => new(x, x, x);
+    public readonly float3 rrg => new(x, x, y);
+    public readonly float3 rrb => new(x, x, z);
+    public readonly float3 rgr => new(x, y, x);
+    public readonly float3 rgg => new(x, y, y);
+    public float3 rgb { readonly get => new(x, y, z); set { x = value.x; y = value.y; z = value.z; } }
+    public readonly float3 rbr => new(x, z, x);
+    public float3 rbg { readonly get => new(x, z, y); set { x = value.x; z = value.y; y = value.z; } }
+    public readonly float3 rbb => new(x, z, z);
+    public readonly float3 grr => new(y, x, x);
+    public readonly float3 grg => new(y, x, y);
+    public float3 grb { readonly get => new(y, x, z); set { y = value.x; x = value.y; z = value.z; } }
+    public readonly float3 ggr => new(y, y, x);
+    public readonly float3 ggg => new(y, y, y);
+    public readonly float3 ggb => new(y, y, z);
+    public float3 gbr { readonly get => new(y, z, x); set { y = value.x; z = value.y; x = value.z; } }
+    public readonly float3 gbg => new(y, z, y);
+    public readonly float3 gbb => new(y, z, z);
+    public readonly float3 brr => new(z, x, x);
+    public float3 brg { readonly get => new(z, x, y); set { z = value.x; x = value.y; y = value.z; } }
+    public readonly float3 brb => new(z, x, z);
+    public float3 bgr { readonly get => new(z, y, x); set { z = value.x; y = value.y; x = value.z; } }
+    public readonly float3 bgg => new(z, y, y);
+    public readonly float3 bgb => new(z, y, z);
+    public readonly float3 bbr => new(z, z, x);
+    public readonly float3 bbg => new(z, z, y);
+    public readonly float3 bbb => new(z, z, z);
+    public readonly float4 rrrr => new(x, x, x, x);
+    public readonly float4 rrrg => new(x, x, x, y);
+    public readonly float4 rrrb => new(x, x, x, z);
+    public readonly float4 rrgr => new(x, x, y, x);
+    public readonly float4 rrgg => new(x, x, y, y);
+    public readonly float4 rrgb => new(x, x, y, z);
+    public readonly float4 rrbr => new(x, x, z, x);
+    public readonly float4 rrbg => new(x, x, z, y);
+    public readonly float4 rrbb => new(x, x, z, z);
+    public readonly float4 rgrr => new(x, y, x, x);
+    public readonly float4 rgrg => new(x, y, x, y);
+    public readonly float4 rgrb => new(x, y, x, z);
+    public readonly float4 rggr => new(x, y, y, x);
+    public readonly float4 rggg => new(x, y, y, y);
+    public readonly float4 rggb => new(x, y, y, z);
+    public readonly float4 rgbr => new(x, y, z, x);
+    public readonly float4 rgbg => new(x, y, z, y);
+    public readonly float4 rgbb => new(x, y, z, z);
+    public readonly float4 rbrr => new(x, z, x, x);
+    public readonly float4 rbrg => new(x, z, x, y);
+    public readonly float4 rbrb => new(x, z, x, z);
+    public readonly float4 rbgr => new(x, z, y, x);
+    public readonly float4 rbgg => new(x, z, y, y);
+    public readonly float4 rbgb => new(x, z, y, z);
+    public readonly float4 rbbr => new(x, z, z, x);
+    public readonly float4 rbbg => new(x, z, z, y);
+    public readonly float4 rbbb => new(x, z, z, z);
+    public readonly float4 grrr => new(y, x, x, x);
+    public readonly float4 grrg => new(y, x, x, y);
+    public readonly float4 grrb => new(y, x, x, z);
+    public readonly float4 grgr => new(y, x, y, x);
+    public readonly float4 grgg => new(y, x, y, y);
+    public readonly float4 grgb => new(y, x, y, z);
+    public readonly float4 grbr => new(y, x, z, x);
+    public readonly float4 grbg => new(y, x, z, y);
+    public readonly float4 grbb => new(y, x, z, z);
+    public readonly float4 ggrr => new(y, y, x, x);
+    public readonly float4 ggrg => new(y, y, x, y);
+    public readonly float4 ggrb => new(y, y, x, z);
+    public readonly float4 gggr => new(y, y, y, x);
+    public readonly float4 gggg => new(y, y, y, y);
+    public readonly float4 gggb => new(y, y, y, z);
+    public readonly float4 ggbr => new(y, y, z, x);
+    public readonly float4 ggbg => new(y, y, z, y);
+    public readonly float4 ggbb => new(y, y, z, z);
+    public readonly float4 gbrr => new(y, z, x, x);
+    public readonly float4 gbrg => new(y, z, x, y);
+    public readonly float4 gbrb => new(y, z, x, z);
+    public readonly float4 gbgr => new(y, z, y, x);
+    public readonly float4 gbgg => new(y, z, y, y);
+    public readonly float4 gbgb => new(y, z, y, z);
+    public readonly float4 gbbr => new(y, z, z, x);
+    public readonly float4 gbbg => new(y, z, z, y);
+    public readonly float4 gbbb => new(y, z, z, z);
+    public readonly float4 brrr => new(z, x, x, x);
+    public readonly float4 brrg => new(z, x, x, y);
+    public readonly float4 brrb => new(z, x, x, z);
+    public readonly float4 brgr => new(z, x, y, x);
+    public readonly float4 brgg => new(z, x, y, y);
+    public readonly float4 brgb => new(z, x, y, z);
+    public readonly float4 brbr => new(z, x, z, x);
+    public readonly float4 brbg => new(z, x, z, y);
+    public readonly float4 brbb => new(z, x, z, z);
+    public readonly float4 bgrr => new(z, y, x, x);
+    public readonly float4 bgrg => new(z, y, x, y);
+    public readonly float4 bgrb => new(z, y, x, z);
+    public readonly float4 bggr => new(z, y, y, x);
+    public readonly float4 bggg => new(z, y, y, y);
+    public readonly float4 bggb => new(z, y, y, z);
+    public readonly float4 bgbr => new(z, y, z, x);
+    public readonly float4 bgbg => new(z, y, z, y);
+    public readonly float4 bgbb => new(z, y, z, z);
+    public readonly float4 bbrr => new(z, z, x, x);
+    public readonly float4 bbrg => new(z, z, x, y);
+    public readonly float4 bbrb => new(z, z, x, z);
+    public readonly float4 bbgr => new(z, z, y, x);
+    public readonly float4 bbgg => new(z, z, y, y);
+    public readonly float4 bbgb => new(z, z, y, z);
+    public readonly float4 bbbr => new(z, z, z, x);
+    public readonly float4 bbbg => new(z, z, z, y);
+    public readonly float4 bbbb => new(z, z, z, z);
+}
+
+public partial struct float4
+{
+    public float4(float x, float y, float2 zw) : this(x, y, zw.x, zw.y) { }
+    public float4(float x, float2 yz, float w) : this(x, yz.x, yz.y, w) { }
+    public float4(float x, float3 yzw) : this(x, yzw.x, yzw.y, yzw.z) { }
+    public float4(float2 xy, float z, float w) : this(xy.x, xy.y, z, w) { }
+    public float4(float2 xy, float2 zw) : this(xy.x, xy.y, zw.x, zw.y) { }
+    public float4(float3 xyz, float w) : this(xyz.x, xyz.y, xyz.z, w) { }
+    public float4(float4 xyzw) : this(xyzw.x, xyzw.y, xyzw.z, xyzw.w) { }
+    public float r { readonly get => x; set => x = value; }
+    public float g { readonly get => y; set => y = value; }
+    public float b { readonly get => z; set => z = value; }
+    public float a { readonly get => w; set => w = value; }
+    public readonly float2 xx => new(x, x);
+    public float2 xy { readonly get => new(x, y); set { x = value.x; y = value.y; } }
+    public float2 xz { readonly get => new(x, z); set { x = value.x; z = value.y; } }
+    public float2 xw { readonly get => new(x, w); set { x = value.x; w = value.y; } }
+    public float2 yx { readonly get => new(y, x); set { y = value.x; x = value.y; } }
+    public readonly float2 yy => new(y, y);
+    public float2 yz { readonly get => new(y, z); set { y = value.x; z = value.y; } }
+    public float2 yw { readonly get => new(y, w); set { y = value.x; w = value.y; } }
+    public float2 zx { readonly get => new(z, x); set { z = value.x; x = value.y; } }
+    public float2 zy { readonly get => new(z, y); set { z = value.x; y = value.y; } }
+    public readonly float2 zz => new(z, z);
+    public float2 zw { readonly get => new(z, w); set { z = value.x; w = value.y; } }
+    public float2 wx { readonly get => new(w, x); set { w = value.x; x = value.y; } }
+    public float2 wy { readonly get => new(w, y); set { w = value.x; y = value.y; } }
+    public float2 wz { readonly get => new(w, z); set { w = value.x; z = value.y; } }
+    public readonly float2 ww => new(w, w);
+    public readonly float3 xxx => new(x, x, x);
+    public readonly float3 xxy => new(x, x, y);
+    public readonly float3 xxz => new(x, x, z);
+    public readonly float3 xxw => new(x, x, w);
+    public readonly float3 xyx => new(x, y, x);
+    public readonly float3 xyy => new(x, y, y);
+    public float3 xyz { readonly get => new(x, y, z); set { x = value.x; y = value.y; z = value.z; } }
+    public float3 xyw { readonly get => new(x, y, w); set { x = value.x; y = value.y; w = value.z; } }
+    public readonly float3 xzx => new(x, z, x);
+    public float3 xzy { readonly get => new(x, z, y); set { x = value.x; z = value.y; y = value.z; } }
+    public readonly float3 xzz => new(x, z, z);
+    public float3 xzw { readonly get => new(x, z, w); set { x = value.x; z = value.y; w = value.z; } }
+    public readonly float3 xwx => new(x, w, x);
+    public float3 xwy { readonly get => new(x, w, y); set { x = value.x; w = value.y; y = value.z; } }
+    public float3 xwz { readonly get => new(x, w, z); set { x = value.x; w = value.y; z = value.z; } }
+    public readonly float3 xww => new(x, w, w);
+    public readonly float3 yxx => new(y, x, x);
+    public readonly float3 yxy => new(y, x, y);
+    public float3 yxz { readonly get => new(y, x, z); set { y = value.x; x = value.y; z = value.z; } }
+    public float3 yxw { readonly get => new(y, x, w); set { y = value.x; x = value.y; w = value.z; } }
+    public readonly float3 yyx => new(y, y, x);
+    public readonly float3 yyy => new(y, y, y);
+    public readonly float3 yyz => new(y, y, z);
+    public readonly float3 yyw => new(y, y, w);
+    public float3 yzx { readonly get => new(y, z, x); set { y = value.x; z = value.y; x = value.z; } }
+    public readonly float3 yzy => new(y, z, y);
+    public readonly float3 yzz => new(y, z, z);
+    public float3 yzw { readonly get => new(y, z, w); set { y = value.x; z = value.y; w = value.z; } }
+    public float3 ywx { readonly get => new(y, w, x); set { y = value.x; w = value.y; x = value.z; } }
+    public readonly float3 ywy => new(y, w, y);
+    public float3 ywz { readonly get => new(y, w, z); set { y = value.x; w = value.y; z = value.z; } }
+    public readonly float3 yww => new(y, w, w);
+    public readonly float3 zxx => new(z, x, x);
+    public float3 zxy { readonly get => new(z, x, y); set { z = value.x; x = value.y; y = value.z; } }
+    public readonly float3 zxz => new(z, x, z);
+    public float3 zxw { readonly get => new(z, x, w); set { z = value.x; x = value.y; w = value.z; } }
+    public float3 zyx { readonly get => new(z, y, x); set { z = value.x; y = value.y; x = value.z; } }
+    public readonly float3 zyy => new(z, y, y);
+    public readonly float3 zyz => new(z, y, z);
+    public float3 zyw { readonly get => new(z, y, w); set { z = value.x; y = value.y; w = value.z; } }
+    public readonly float3 zzx => new(z, z, x);
+    public readonly float3 zzy => new(z, z, y);
+    public readonly float3 zzz => new(z, z, z);
+    public readonly float3 zzw => new(z, z, w);
+    public float3 zwx { readonly get => new(z, w, x); set { z = value.x; w = value.y; x = value.z; } }
+    public float3 zwy { readonly get => new(z, w, y); set { z = value.x; w = value.y; y = value.z; } }
+    public readonly float3 zwz => new(z, w, z);
+    public readonly float3 zww => new(z, w, w);
+    public readonly float3 wxx => new(w, x, x);
+    public float3 wxy { readonly get => new(w, x, y); set { w = value.x; x = value.y; y = value.z; } }
+    public float3 wxz { readonly get => new(w, x, z); set { w = value.x; x = value.y; z = value.z; } }
+    public readonly float3 wxw => new(w, x, w);
+    public float3 wyx { readonly get => new(w, y, x); set { w = value.x; y = value.y; x = value.z; } }
+    public readonly float3 wyy => new(w, y, y);
+    public float3 wyz { readonly get => new(w, y, z); set { w = value.x; y = value.y; z = value.z; } }
+    public readonly float3 wyw => new(w, y, w);
+    public float3 wzx { readonly get => new(w, z, x); set { w = value.x; z = value.y; x = value.z; } }
+    public float3 wzy { readonly get => new(w, z, y); set { w = value.x; z = value.y; y = value.z; } }
+    public readonly float3 wzz => new(w, z, z);
+    public readonly float3 wzw => new(w, z, w);
+    public readonly float3 wwx => new(w, w, x);
+    public readonly float3 wwy => new(w, w, y);
+    public readonly float3 wwz => new(w, w, z);
+    public readonly float3 www => new(w, w, w);
+    public readonly float4 xxxx => new(x, x, x, x);
+    public readonly float4 xxxy => new(x, x, x, y);
+    public readonly float4 xxxz => new(x, x, x, z);
+    public readonly float4 xxxw => new(x, x, x, w);
+    public readonly float4 xxyx => new(x, x, y, x);
+    public readonly float4 xxyy => new(x, x, y, y);
+    public readonly float4 xxyz => new(x, x, y, z);
+    public readonly float4 xxyw => new(x, x, y, w);
+    public readonly float4 xxzx => new(x, x, z, x);
+    public readonly float4 xxzy => new(x, x, z, y);
+    public readonly float4 xxzz => new(x, x, z, z);
+    public readonly float4 xxzw => new(x, x, z, w);
+    public readonly float4 xxwx => new(x, x, w, x);
+    public readonly float4 xxwy => new(x, x, w, y);
+    public readonly float4 xxwz => new(x, x, w, z);
+    public readonly float4 xxww => new(x, x, w, w);
+    public readonly float4 xyxx => new(x, y, x, x);
+    public readonly float4 xyxy => new(x, y, x, y);
+    public readonly float4 xyxz => new(x, y, x, z);
+    public readonly float4 xyxw => new(x, y, x, w);
+    public readonly float4 xyyx => new(x, y, y, x);
+    public readonly float4 xyyy => new(x, y, y, y);
+    public readonly float4 xyyz => new(x, y, y, z);
+    public readonly float4 xyyw => new(x, y, y, w);
+    public readonly float4 xyzx => new(x, y, z, x);
+    public readonly float4 xyzy => new(x, y, z, y);
+    public readonly float4 xyzz => new(x, y, z, z);
+    public float4 xyzw { readonly get => new(x, y, z, w); set { x = value.x; y = value.y; z = value.z; w = value.w; } }
+    public readonly float4 xywx => new(x, y, w, x);
+    public readonly float4 xywy => new(x, y, w, y);
+    public float4 xywz { readonly get => new(x, y, w, z); set { x = value.x; y = value.y; w = value.z; z = value.w; } }
+    public readonly float4 xyww => new(x, y, w, w);
+    public readonly float4 xzxx => new(x, z, x, x);
+    public readonly float4 xzxy => new(x, z, x, y);
+    public readonly float4 xzxz => new(x, z, x, z);
+    public readonly float4 xzxw => new(x, z, x, w);
+    public readonly float4 xzyx => new(x, z, y, x);
+    public readonly float4 xzyy => new(x, z, y, y);
+    public readonly float4 xzyz => new(x, z, y, z);
+    public float4 xzyw { readonly get => new(x, z, y, w); set { x = value.x; z = value.y; y = value.z; w = value.w; } }
+    public readonly float4 xzzx => new(x, z, z, x);
+    public readonly float4 xzzy => new(x, z, z, y);
+    public readonly float4 xzzz => new(x, z, z, z);
+    public readonly float4 xzzw => new(x, z, z, w);
+    public readonly float4 xzwx => new(x, z, w, x);
+    public float4 xzwy { readonly get => new(x, z, w, y); set { x = value.x; z = value.y; w = value.z; y = value.w; } }
+    public readonly float4 xzwz => new(x, z, w, z);
+    public readonly float4 xzww => new(x, z, w, w);
+    public readonly float4 xwxx => new(x, w, x, x);
+    public readonly float4 xwxy => new(x, w, x, y);
+    public readonly float4 xwxz => new(x, w, x, z);
+    public readonly float4 xwxw => new(x, w, x, w);
+    public readonly float4 xwyx => new(x, w, y, x);
+    public readonly float4 xwyy => new(x, w, y, y);
+    public float4 xwyz { readonly get => new(x, w, y, z); set { x = value.x; w = value.y; y = value.z; z = value.w; } }
+    public readonly float4 xwyw => new(x, w, y, w);
+    public readonly float4 xwzx => new(x, w, z, x);
+    public float4 xwzy { readonly get => new(x, w, z, y); set { x = value.x; w = value.y; z = value.z; y = value.w; } }
+    public readonly float4 xwzz => new(x, w, z, z);
+    public readonly float4 xwzw => new(x, w, z, w);
+    public readonly float4 xwwx => new(x, w, w, x);
+    public readonly float4 xwwy => new(x, w, w, y);
+    public readonly float4 xwwz => new(x, w, w, z);
+    public readonly float4 xwww => new(x, w, w, w);
+    public readonly float4 yxxx => new(y, x, x, x);
+    public readonly float4 yxxy => new(y, x, x, y);
+    public readonly float4 yxxz => new(y, x, x, z);
+    public readonly float4 yxxw => new(y, x, x, w);
+    public readonly float4 yxyx => new(y, x, y, x);
+    public readonly float4 yxyy => new(y, x, y, y);
+    public readonly float4 yxyz => new(y, x, y, z);
+    public readonly float4 yxyw => new(y, x, y, w);
+    public readonly float4 yxzx => new(y, x, z, x);
+    public readonly float4 yxzy => new(y, x, z, y);
+    public readonly float4 yxzz => new(y, x, z, z);
+    public float4 yxzw { readonly get => new(y, x, z, w); set { y = value.x; x = value.y; z = value.z; w = value.w; } }
+    public readonly float4 yxwx => new(y, x, w, x);
+    public readonly float4 yxwy => new(y, x, w, y);
+    public float4 yxwz { readonly get => new(y, x, w, z); set { y = value.x; x = value.y; w = value.z; z = value.w; } }
+    public readonly float4 yxww => new(y, x, w, w);
+    public readonly float4 yyxx => new(y, y, x, x);
+    public readonly float4 yyxy => new(y, y, x, y);
+    public readonly float4 yyxz => new(y, y, x, z);
+    public readonly float4 yyxw => new(y, y, x, w);
+    public readonly float4 yyyx => new(y, y, y, x);
+    public readonly float4 yyyy => new(y, y, y, y);
+    public readonly float4 yyyz => new(y, y, y, z);
+    public readonly float4 yyyw => new(y, y, y, w);
+    public readonly float4 yyzx => new(y, y, z, x);
+    public readonly float4 yyzy => new(y, y, z, y);
+    public readonly float4 yyzz => new(y, y, z, z);
+    public readonly float4 yyzw => new(y, y, z, w);
+    public readonly float4 yywx => new(y, y, w, x);
+    public readonly float4 yywy => new(y, y, w, y);
+    public readonly float4 yywz => new(y, y, w, z);
+    public readonly float4 yyww => new(y, y, w, w);
+    public readonly float4 yzxx => new(y, z, x, x);
+    public readonly float4 yzxy => new(y, z, x, y);
+    public readonly float4 yzxz => new(y, z, x, z);
+    public float4 yzxw { readonly get => new(y, z, x, w); set { y = value.x; z = value.y; x = value.z; w = value.w; } }
+    public readonly float4 yzyx => new(y, z, y, x);
+    public readonly float4 yzyy => new(y, z, y, y);
+    public readonly float4 yzyz => new(y, z, y, z);
+    public readonly float4 yzyw => new(y, z, y, w);
+    public readonly float4 yzzx => new(y, z, z, x);
+    public readonly float4 yzzy => new(y, z, z, y);
+    public readonly float4 yzzz => new(y, z, z, z);
+    public readonly float4 yzzw => new(y, z, z, w);
+    public float4 yzwx { readonly get => new(y, z, w, x); set { y = value.x; z = value.y; w = value.z; x = value.w; } }
+    public readonly float4 yzwy => new(y, z, w, y);
+    public readonly float4 yzwz => new(y, z, w, z);
+    public readonly float4 yzww => new(y, z, w, w);
+    public readonly float4 ywxx => new(y, w, x, x);
+    public readonly float4 ywxy => new(y, w, x, y);
+    public float4 ywxz { readonly get => new(y, w, x, z); set { y = value.x; w = value.y; x = value.z; z = value.w; } }
+    public readonly float4 ywxw => new(y, w, x, w);
+    public readonly float4 ywyx => new(y, w, y, x);
+    public readonly float4 ywyy => new(y, w, y, y);
+    public readonly float4 ywyz => new(y, w, y, z);
+    public readonly float4 ywyw => new(y, w, y, w);
+    public float4 ywzx { readonly get => new(y, w, z, x); set { y = value.x; w = value.y; z = value.z; x = value.w; } }
+    public readonly float4 ywzy => new(y, w, z, y);
+    public readonly float4 ywzz => new(y, w, z, z);
+    public readonly float4 ywzw => new(y, w, z, w);
+    public readonly float4 ywwx => new(y, w, w, x);
+    public readonly float4 ywwy => new(y, w, w, y);
+    public readonly float4 ywwz => new(y, w, w, z);
+    public readonly float4 ywww => new(y, w, w, w);
+    public readonly float4 zxxx => new(z, x, x, x);
+    public readonly float4 zxxy => new(z, x, x, y);
+    public readonly float4 zxxz => new(z, x, x, z);
+    public readonly float4 zxxw => new(z, x, x, w);
+    public readonly float4 zxyx => new(z, x, y, x);
+    public readonly float4 zxyy => new(z, x, y, y);
+    public readonly float4 zxyz => new(z, x, y, z);
+    public float4 zxyw { readonly get => new(z, x, y, w); set { z = value.x; x = value.y; y = value.z; w = value.w; } }
+    public readonly float4 zxzx => new(z, x, z, x);
+    public readonly float4 zxzy => new(z, x, z, y);
+    public readonly float4 zxzz => new(z, x, z, z);
+    public readonly float4 zxzw => new(z, x, z, w);
+    public readonly float4 zxwx => new(z, x, w, x);
+    public float4 zxwy { readonly get => new(z, x, w, y); set { z = value.x; x = value.y; w = value.z; y = value.w; } }
+    public readonly float4 zxwz => new(z, x, w, z);
+    public readonly float4 zxww => new(z, x, w, w);
+    public readonly float4 zyxx => new(z, y, x, x);
+    public readonly float4 zyxy => new(z, y, x, y);
+    public readonly float4 zyxz => new(z, y, x, z);
+    public float4 zyxw { readonly get => new(z, y, x, w); set { z = value.x; y = value.y; x = value.z; w = value.w; } }
+    public readonly float4 zyyx => new(z, y, y, x);
+    public readonly float4 zyyy => new(z, y, y, y);
+    public readonly float4 zyyz => new(z, y, y, z);
+    public readonly float4 zyyw => new(z, y, y, w);
+    public readonly float4 zyzx => new(z, y, z, x);
+    public readonly float4 zyzy => new(z, y, z, y);
+    public readonly float4 zyzz => new(z, y, z, z);
+    public readonly float4 zyzw => new(z, y, z, w);
+    public float4 zywx { readonly get => new(z, y, w, x); set { z = value.x; y = value.y; w = value.z; x = value.w; } }
+    public readonly float4 zywy => new(z, y, w, y);
+    public readonly float4 zywz => new(z, y, w, z);
+    public readonly float4 zyww => new(z, y, w, w);
+    public readonly float4 zzxx => new(z, z, x, x);
+    public readonly float4 zzxy => new(z, z, x, y);
+    public readonly float4 zzxz => new(z, z, x, z);
+    public readonly float4 zzxw => new(z, z, x, w);
+    public readonly float4 zzyx => new(z, z, y, x);
+    public readonly float4 zzyy => new(z, z, y, y);
+    public readonly float4 zzyz => new(z, z, y, z);
+    public readonly float4 zzyw => new(z, z, y, w);
+    public readonly float4 zzzx => new(z, z, z, x);
+    public readonly float4 zzzy => new(z, z, z, y);
+    public readonly float4 zzzz => new(z, z, z, z);
+    public readonly float4 zzzw => new(z, z, z, w);
+    public readonly float4 zzwx => new(z, z, w, x);
+    public readonly float4 zzwy => new(z, z, w, y);
+    public readonly float4 zzwz => new(z, z, w, z);
+    public readonly float4 zzww => new(z, z, w, w);
+    public readonly float4 zwxx => new(z, w, x, x);
+    public float4 zwxy { readonly get => new(z, w, x, y); set { z = value.x; w = value.y; x = value.z; y = value.w; } }
+    public readonly float4 zwxz => new(z, w, x, z);
+    public readonly float4 zwxw => new(z, w, x, w);
+    public float4 zwyx { readonly get => new(z, w, y, x); set { z = value.x; w = value.y; y = value.z; x = value.w; } }
+    public readonly float4 zwyy => new(z, w, y, y);
+    public readonly float4 zwyz => new(z, w, y, z);
+    public readonly float4 zwyw => new(z, w, y, w);
+    public readonly float4 zwzx => new(z, w, z, x);
+    public readonly float4 zwzy => new(z, w, z, y);
+    public readonly float4 zwzz => new(z, w, z, z);
+    public readonly float4 zwzw => new(z, w, z, w);
+    public readonly float4 zwwx => new(z, w, w, x);
+    public readonly float4 zwwy => new(z, w, w, y);
+    public readonly float4 zwwz => new(z, w, w, z);
+    public readonly float4 zwww => new(z, w, w, w);
+    public readonly float4 wxxx => new(w, x, x, x);
+    public readonly float4 wxxy => new(w, x, x, y);
+    public readonly float4 wxxz => new(w, x, x, z);
+    public readonly float4 wxxw => new(w, x, x, w);
+    public readonly float4 wxyx => new(w, x, y, x);
+    public readonly float4 wxyy => new(w, x, y, y);
+    public float4 wxyz { readonly get => new(w, x, y, z); set { w = value.x; x = value.y; y = value.z; z = value.w; } }
+    public readonly float4 wxyw => new(w, x, y, w);
+    public readonly float4 wxzx => new(w, x, z, x);
+    public float4 wxzy { readonly get => new(w, x, z, y); set { w = value.x; x = value.y; z = value.z; y = value.w; } }
+    public readonly float4 wxzz => new(w, x, z, z);
+    public readonly float4 wxzw => new(w, x, z, w);
+    public readonly float4 wxwx => new(w, x, w, x);
+    public readonly float4 wxwy => new(w, x, w, y);
+    public readonly float4 wxwz => new(w, x, w, z);
+    public readonly float4 wxww => new(w, x, w, w);
+    public readonly float4 wyxx => new(w, y, x, x);
+    public readonly float4 wyxy => new(w, y, x, y);
+    public float4 wyxz { readonly get => new(w, y, x, z); set { w = value.x; y = value.y; x = value.z; z = value.w; } }
+    public readonly float4 wyxw => new(w, y, x, w);
+    public readonly float4 wyyx => new(w, y, y, x);
+    public readonly float4 wyyy => new(w, y, y, y);
+    public readonly float4 wyyz => new(w, y, y, z);
+    public readonly float4 wyyw => new(w, y, y, w);
+    public float4 wyzx { readonly get => new(w, y, z, x); set { w = value.x; y = value.y; z = value.z; x = value.w; } }
+    public readonly float4 wyzy => new(w, y, z, y);
+    public readonly float4 wyzz => new(w, y, z, z);
+    public readonly float4 wyzw => new(w, y, z, w);
+    public readonly float4 wywx => new(w, y, w, x);
+    public readonly float4 wywy => new(w, y, w, y);
+    public readonly float4 wywz => new(w, y, w, z);
+    public readonly float4 wyww => new(w, y, w, w);
+    public readonly float4 wzxx => new(w, z, x, x);
+    public float4 wzxy { readonly get => new(w, z, x, y); set { w = value.x; z = value.y; x = value.z; y = value.w; } }
+    public readonly float4 wzxz => new(w, z, x, z);
+    public readonly float4 wzxw => new(w, z, x, w);
+    public float4 wzyx { readonly get => new(w, z, y, x); set { w = value.x; z = value.y; y = value.z; x = value.w; } }
+    public readonly float4 wzyy => new(w, z, y, y);
+    public readonly float4 wzyz => new(w, z, y, z);
+    public readonly float4 wzyw => new(w, z, y, w);
+    public readonly float4 wzzx => new(w, z, z, x);
+    public readonly float4 wzzy => new(w, z, z, y);
+    public readonly float4 wzzz => new(w, z, z, z);
+    public readonly float4 wzzw => new(w, z, z, w);
+    public readonly float4 wzwx => new(w, z, w, x);
+    public readonly float4 wzwy => new(w, z, w, y);
+    public readonly float4 wzwz => new(w, z, w, z);
+    public readonly float4 wzww => new(w, z, w, w);
+    public readonly float4 wwxx => new(w, w, x, x);
+    public readonly float4 wwxy => new(w, w, x, y);
+    public readonly float4 wwxz => new(w, w, x, z);
+    public readonly float4 wwxw => new(w, w, x, w);
+    public readonly float4 wwyx => new(w, w, y, x);
+    public readonly float4 wwyy => new(w, w, y, y);
+    public readonly float4 wwyz => new(w, w, y, z);
+    public readonly float4 wwyw => new(w, w, y, w);
+    public readonly float4 wwzx => new(w, w, z, x);
+    public readonly float4 wwzy => new(w, w, z, y);
+    public readonly float4 wwzz => new(w, w, z, z);
+    public readonly float4 wwzw => new(w, w, z, w);
+    public readonly float4 wwwx => new(w, w, w, x);
+    public readonly float4 wwwy => new(w, w, w, y);
+    public readonly float4 wwwz => new(w, w, w, z);
+    public readonly float4 wwww => new(w, w, w, w);
+    public readonly float2 rr => new(x, x);
+    public float2 rg { readonly get => new(x, y); set { x = value.x; y = value.y; } }
+    public float2 rb { readonly get => new(x, z); set { x = value.x; z = value.y; } }
+    public float2 ra { readonly get => new(x, w); set { x = value.x; w = value.y; } }
+    public float2 gr { readonly get => new(y, x); set { y = value.x; x = value.y; } }
+    public readonly float2 gg => new(y, y);
+    public float2 gb { readonly get => new(y, z); set { y = value.x; z = value.y; } }
+    public float2 ga { readonly get => new(y, w); set { y = value.x; w = value.y; } }
+    public float2 br { readonly get => new(z, x); set { z = value.x; x = value.y; } }
+    public float2 bg { readonly get => new(z, y); set { z = value.x; y = value.y; } }
+    public readonly float2 bb => new(z, z);
+    public float2 ba { readonly get => new(z, w); set { z = value.x; w = value.y; } }
+    public float2 ar { readonly get => new(w, x); set { w = value.x; x = value.y; } }
+    public float2 ag { readonly get => new(w, y); set { w = value.x; y = value.y; } }
+    public float2 ab { readonly get => new(w, z); set { w = value.x; z = value.y; } }
+    public readonly float2 aa => new(w, w);
+    public readonly float3 rrr => new(x, x, x);
+    public readonly float3 rrg => new(x, x, y);
+    public readonly float3 rrb => new(x, x, z);
+    public readonly float3 rra => new(x, x, w);
+    public readonly float3 rgr => new(x, y, x);
+    public readonly float3 rgg => new(x, y, y);
+    public float3 rgb { readonly get => new(x, y, z); set { x = value.x; y = value.y; z = value.z; } }
+    public float3 rga { readonly get => new(x, y, w); set { x = value.x; y = value.y; w = value.z; } }
+    public readonly float3 rbr => new(x, z, x);
+    public float3 rbg { readonly get => new(x, z, y); set { x = value.x; z = value.y; y = value.z; } }
+    public readonly float3 rbb => new(x, z, z);
+    public float3 rba { readonly get => new(x, z, w); set { x = value.x; z = value.y; w = value.z; } }
+    public readonly float3 rar => new(x, w, x);
+    public float3 rag { readonly get => new(x, w, y); set { x = value.x; w = value.y; y = value.z; } }
+    public float3 rab { readonly get => new(x, w, z); set { x = value.x; w = value.y; z = value.z; } }
+    public readonly float3 raa => new(x, w, w);
+    public readonly float3 grr => new(y, x, x);
+    public readonly float3 grg => new(y, x, y);
+    public float3 grb { readonly get => new(y, x, z); set { y = value.x; x = value.y; z = value.z; } }
+    public float3 gra { readonly get => new(y, x, w); set { y = value.x; x = value.y; w = value.z; } }
+    public readonly float3 ggr => new(y, y, x);
+    public readonly float3 ggg => new(y, y, y);
+    public readonly float3 ggb => new(y, y, z);
+    public readonly float3 gga => new(y, y, w);
+    public float3 gbr { readonly get => new(y, z, x); set { y = value.x; z = value.y; x = value.z; } }
+    public readonly float3 gbg => new(y, z, y);
+    public readonly float3 gbb => new(y, z, z);
+    public float3 gba { readonly get => new(y, z, w); set { y = value.x; z = value.y; w = value.z; } }
+    public float3 gar { readonly get => new(y, w, x); set { y = value.x; w = value.y; x = value.z; } }
+    public readonly float3 gag => new(y, w, y);
+    public float3 gab { readonly get => new(y, w, z); set { y = value.x; w = value.y; z = value.z; } }
+    public readonly float3 gaa => new(y, w, w);
+    public readonly float3 brr => new(z, x, x);
+    public float3 brg { readonly get => new(z, x, y); set { z = value.x; x = value.y; y = value.z; } }
+    public readonly float3 brb => new(z, x, z);
+    public float3 bra { readonly get => new(z, x, w); set { z = value.x; x = value.y; w = value.z; } }
+    public float3 bgr { readonly get => new(z, y, x); set { z = value.x; y = value.y; x = value.z; } }
+    public readonly float3 bgg => new(z, y, y);
+    public readonly float3 bgb => new(z, y, z);
+    public float3 bga { readonly get => new(z, y, w); set { z = value.x; y = value.y; w = value.z; } }
+    public readonly float3 bbr => new(z, z, x);
+    public readonly float3 bbg => new(z, z, y);
+    public readonly float3 bbb => new(z, z, z);
+    public readonly float3 bba => new(z, z, w);
+    public float3 bar { readonly get => new(z, w, x); set { z = value.x; w = value.y; x = value.z; } }
+    public float3 bag { readonly get => new(z, w, y); set { z = value.x; w = value.y; y = value.z; } }
+    public readonly float3 bab => new(z, w, z);
+    public readonly float3 baa => new(z, w, w);
+    public readonly float3 arr => new(w, x, x);
+    public float3 arg { readonly get => new(w, x, y); set { w = value.x; x = value.y; y = value.z; } }
+    public float3 arb { readonly get => new(w, x, z); set { w = value.x; x = value.y; z = value.z; } }
+    public readonly float3 ara => new(w, x, w);
+    public float3 agr { readonly get => new(w, y, x); set { w = value.x; y = value.y; x = value.z; } }
+    public readonly float3 agg => new(w, y, y);
+    public float3 agb { readonly get => new(w, y, z); set { w = value.x; y = value.y; z = value.z; } }
+    public readonly float3 aga => new(w, y, w);
+    public float3 abr { readonly get => new(w, z, x); set { w = value.x; z = value.y; x = value.z; } }
+    public float3 abg { readonly get => new(w, z, y); set { w = value.x; z = value.y; y = value.z; } }
+    public readonly float3 abb => new(w, z, z);
+    public readonly float3 aba => new(w, z, w);
+    public readonly float3 aar => new(w, w, x);
+    public readonly float3 aag => new(w, w, y);
+    public readonly float3 aab => new(w, w, z);
+    public readonly float3 aaa => new(w, w, w);
+    public readonly float4 rrrr => new(x, x, x, x);
+    public readonly float4 rrrg => new(x, x, x, y);
+    public readonly float4 rrrb => new(x, x, x, z);
+    public readonly float4 rrra => new(x, x, x, w);
+    public readonly float4 rrgr => new(x, x, y, x);
+    public readonly float4 rrgg => new(x, x, y, y);
+    public readonly float4 rrgb => new(x, x, y, z);
+    public readonly float4 rrga => new(x, x, y, w);
+    public readonly float4 rrbr => new(x, x, z, x);
+    public readonly float4 rrbg => new(x, x, z, y);
+    public readonly float4 rrbb => new(x, x, z, z);
+    public readonly float4 rrba => new(x, x, z, w);
+    public readonly float4 rrar => new(x, x, w, x);
+    public readonly float4 rrag => new(x, x, w, y);
+    public readonly float4 rrab => new(x, x, w, z);
+    public readonly float4 rraa => new(x, x, w, w);
+    public readonly float4 rgrr => new(x, y, x, x);
+    public readonly float4 rgrg => new(x, y, x, y);
+    public readonly float4 rgrb => new(x, y, x, z);
+    public readonly float4 rgra => new(x, y, x, w);
+    public readonly float4 rggr => new(x, y, y, x);
+    public readonly float4 rggg => new(x, y, y, y);
+    public readonly float4 rggb => new(x, y, y, z);
+    public readonly float4 rgga => new(x, y, y, w);
+    public readonly float4 rgbr => new(x, y, z, x);
+    public readonly float4 rgbg => new(x, y, z, y);
+    public readonly float4 rgbb => new(x, y, z, z);
+    public float4 rgba { readonly get => new(x, y, z, w); set { x = value.x; y = value.y; z = value.z; w = value.w; } }
+    public readonly float4 rgar => new(x, y, w, x);
+    public readonly float4 rgag => new(x, y, w, y);
+    public float4 rgab { readonly get => new(x, y, w, z); set { x = value.x; y = value.y; w = value.z; z = value.w; } }
+    public readonly float4 rgaa => new(x, y, w, w);
+    public readonly float4 rbrr => new(x, z, x, x);
+    public readonly float4 rbrg => new(x, z, x, y);
+    public readonly float4 rbrb => new(x, z, x, z);
+    public readonly float4 rbra => new(x, z, x, w);
+    public readonly float4 rbgr => new(x, z, y, x);
+    public readonly float4 rbgg => new(x, z, y, y);
+    public readonly float4 rbgb => new(x, z, y, z);
+    public float4 rbga { readonly get => new(x, z, y, w); set { x = value.x; z = value.y; y = value.z; w = value.w; } }
+    public readonly float4 rbbr => new(x, z, z, x);
+    public readonly float4 rbbg => new(x, z, z, y);
+    public readonly float4 rbbb => new(x, z, z, z);
+    public readonly float4 rbba => new(x, z, z, w);
+    public readonly float4 rbar => new(x, z, w, x);
+    public float4 rbag { readonly get => new(x, z, w, y); set { x = value.x; z = value.y; w = value.z; y = value.w; } }
+    public readonly float4 rbab => new(x, z, w, z);
+    public readonly float4 rbaa => new(x, z, w, w);
+    public readonly float4 rarr => new(x, w, x, x);
+    public readonly float4 rarg => new(x, w, x, y);
+    public readonly float4 rarb => new(x, w, x, z);
+    public readonly float4 rara => new(x, w, x, w);
+    public readonly float4 ragr => new(x, w, y, x);
+    public readonly float4 ragg => new(x, w, y, y);
+    public float4 ragb { readonly get => new(x, w, y, z); set { x = value.x; w = value.y; y = value.z; z = value.w; } }
+    public readonly float4 raga => new(x, w, y, w);
+    public readonly float4 rabr => new(x, w, z, x);
+    public float4 rabg { readonly get => new(x, w, z, y); set { x = value.x; w = value.y; z = value.z; y = value.w; } }
+    public readonly float4 rabb => new(x, w, z, z);
+    public readonly float4 raba => new(x, w, z, w);
+    public readonly float4 raar => new(x, w, w, x);
+    public readonly float4 raag => new(x, w, w, y);
+    public readonly float4 raab => new(x, w, w, z);
+    public readonly float4 raaa => new(x, w, w, w);
+    public readonly float4 grrr => new(y, x, x, x);
+    public readonly float4 grrg => new(y, x, x, y);
+    public readonly float4 grrb => new(y, x, x, z);
+    public readonly float4 grra => new(y, x, x, w);
+    public readonly float4 grgr => new(y, x, y, x);
+    public readonly float4 grgg => new(y, x, y, y);
+    public readonly float4 grgb => new(y, x, y, z);
+    public readonly float4 grga => new(y, x, y, w);
+    public readonly float4 grbr => new(y, x, z, x);
+    public readonly float4 grbg => new(y, x, z, y);
+    public readonly float4 grbb => new(y, x, z, z);
+    public float4 grba { readonly get => new(y, x, z, w); set { y = value.x; x = value.y; z = value.z; w = value.w; } }
+    public readonly float4 grar => new(y, x, w, x);
+    public readonly float4 grag => new(y, x, w, y);
+    public float4 grab { readonly get => new(y, x, w, z); set { y = value.x; x = value.y; w = value.z; z = value.w; } }
+    public readonly float4 graa => new(y, x, w, w);
+    public readonly float4 ggrr => new(y, y, x, x);
+    public readonly float4 ggrg => new(y, y, x, y);
+    public readonly float4 ggrb => new(y, y, x, z);
+    public readonly float4 ggra => new(y, y, x, w);
+    public readonly float4 gggr => new(y, y, y, x);
+    public readonly float4 gggg => new(y, y, y, y);
+    public readonly float4 gggb => new(y, y, y, z);
+    public readonly float4 ggga => new(y, y, y, w);
+    public readonly float4 ggbr => new(y, y, z, x);
+    public readonly float4 ggbg => new(y, y, z, y);
+    public readonly float4 ggbb => new(y, y, z, z);
+    public readonly float4 ggba => new(y, y, z, w);
+    public readonly float4 ggar => new(y, y, w, x);
+    public readonly float4 ggag => new(y, y, w, y);
+    public readonly float4 ggab => new(y, y, w, z);
+    public readonly float4 ggaa => new(y, y, w, w);
+    public readonly float4 gbrr => new(y, z, x, x);
+    public readonly float4 gbrg => new(y, z, x, y);
+    public readonly float4 gbrb => new(y, z, x, z);
+    public float4 gbra { readonly get => new(y, z, x, w); set { y = value.x; z = value.y; x = value.z; w = value.w; } }
+    public readonly float4 gbgr => new(y, z, y, x);
+    public readonly float4 gbgg => new(y, z, y, y);
+    public readonly float4 gbgb => new(y, z, y, z);
+    public readonly float4 gbga => new(y, z, y, w);
+    public readonly float4 gbbr => new(y, z, z, x);
+    public readonly float4 gbbg => new(y, z, z, y);
+    public readonly float4 gbbb => new(y, z, z, z);
+    public readonly float4 gbba => new(y, z, z, w);
+    public float4 gbar { readonly get => new(y, z, w, x); set { y = value.x; z = value.y; w = value.z; x = value.w; } }
+    public readonly float4 gbag => new(y, z, w, y);
+    public readonly float4 gbab => new(y, z, w, z);
+    public readonly float4 gbaa => new(y, z, w, w);
+    public readonly float4 garr => new(y, w, x, x);
+    public readonly float4 garg => new(y, w, x, y);
+    public float4 garb { readonly get => new(y, w, x, z); set { y = value.x; w = value.y; x = value.z; z = value.w; } }
+    public readonly float4 gara => new(y, w, x, w);
+    public readonly float4 gagr => new(y, w, y, x);
+    public readonly float4 gagg => new(y, w, y, y);
+    public readonly float4 gagb => new(y, w, y, z);
+    public readonly float4 gaga => new(y, w, y, w);
+    public float4 gabr { readonly get => new(y, w, z, x); set { y = value.x; w = value.y; z = value.z; x = value.w; } }
+    public readonly float4 gabg => new(y, w, z, y);
+    public readonly float4 gabb => new(y, w, z, z);
+    public readonly float4 gaba => new(y, w, z, w);
+    public readonly float4 gaar => new(y, w, w, x);
+    public readonly float4 gaag => new(y, w, w, y);
+    public readonly float4 gaab => new(y, w, w, z);
+    public readonly float4 gaaa => new(y, w, w, w);
+    public readonly float4 brrr => new(z, x, x, x);
+    public readonly float4 brrg => new(z, x, x, y);
+    public readonly float4 brrb => new(z, x, x, z);
+    public readonly float4 brra => new(z, x, x, w);
+    public readonly float4 brgr => new(z, x, y, x);
+    public readonly float4 brgg => new(z, x, y, y);
+    public readonly float4 brgb => new(z, x, y, z);
+    public float4 brga { readonly get => new(z, x, y, w); set { z = value.x; x = value.y; y = value.z; w = value.w; } }
+    public readonly float4 brbr => new(z, x, z, x);
+    public readonly float4 brbg => new(z, x, z, y);
+    public readonly float4 brbb => new(z, x, z, z);
+    public readonly float4 brba => new(z, x, z, w);
+    public readonly float4 brar => new(z, x, w, x);
+    public float4 brag { readonly get => new(z, x, w, y); set { z = value.x; x = value.y; w = value.z; y = value.w; } }
+    public readonly float4 brab => new(z, x, w, z);
+    public readonly float4 braa => new(z, x, w, w);
+    public readonly float4 bgrr => new(z, y, x, x);
+    public readonly float4 bgrg => new(z, y, x, y);
+    public readonly float4 bgrb => new(z, y, x, z);
+    public float4 bgra { readonly get => new(z, y, x, w); set { z = value.x; y = value.y; x = value.z; w = value.w; } }
+    public readonly float4 bggr => new(z, y, y, x);
+    public readonly float4 bggg => new(z, y, y, y);
+    public readonly float4 bggb => new(z, y, y, z);
+    public readonly float4 bgga => new(z, y, y, w);
+    public readonly float4 bgbr => new(z, y, z, x);
+    public readonly float4 bgbg => new(z, y, z, y);
+    public readonly float4 bgbb => new(z, y, z, z);
+    public readonly float4 bgba => new(z, y, z, w);
+    public float4 bgar { readonly get => new(z, y, w, x); set { z = value.x; y = value.y; w = value.z; x = value.w; } }
+    public readonly float4 bgag => new(z, y, w, y);
+    public readonly float4 bgab => new(z, y, w, z);
+    public readonly float4 bgaa => new(z, y, w, w);
+    public readonly float4 bbrr => new(z, z, x, x);
+    public readonly float4 bbrg => new(z, z, x, y);
+    public readonly float4 bbrb => new(z, z, x, z);
+    public readonly float4 bbra => new(z, z, x, w);
+    public readonly float4 bbgr => new(z, z, y, x);
+    public readonly float4 bbgg => new(z, z, y, y);
+    public readonly float4 bbgb => new(z, z, y, z);
+    public readonly float4 bbga => new(z, z, y, w);
+    public readonly float4 bbbr => new(z, z, z, x);
+    public readonly float4 bbbg => new(z, z, z, y);
+    public readonly float4 bbbb => new(z, z, z, z);
+    public readonly float4 bbba => new(z, z, z, w);
+    public readonly float4 bbar => new(z, z, w, x);
+    public readonly float4 bbag => new(z, z, w, y);
+    public readonly float4 bbab => new(z, z, w, z);
+    public readonly float4 bbaa => new(z, z, w, w);
+    public readonly float4 barr => new(z, w, x, x);
+    public float4 barg { readonly get => new(z, w, x, y); set { z = value.x; w = value.y; x = value.z; y = value.w; } }
+    public readonly float4 barb => new(z, w, x, z);
+    public readonly float4 bara => new(z, w, x, w);
+    public float4 bagr { readonly get => new(z, w, y, x); set { z = value.x; w = value.y; y = value.z; x = value.w; } }
+    public readonly float4 bagg => new(z, w, y, y);
+    public readonly float4 bagb => new(z, w, y, z);
+    public readonly float4 baga => new(z, w, y, w);
+    public readonly float4 babr => new(z, w, z, x);
+    public readonly float4 babg => new(z, w, z, y);
+    public readonly float4 babb => new(z, w, z, z);
+    public readonly float4 baba => new(z, w, z, w);
+    public readonly float4 baar => new(z, w, w, x);
+    public readonly float4 baag => new(z, w, w, y);
+    public readonly float4 baab => new(z, w, w, z);
+    public readonly float4 baaa => new(z, w, w, w);
+    public readonly float4 arrr => new(w, x, x, x);
+    public readonly float4 arrg => new(w, x, x, y);
+    public readonly float4 arrb => new(w, x, x, z);
+    public readonly float4 arra => new(w, x, x, w);
+    public readonly float4 argr => new(w, x, y, x);
+    public readonly float4 argg => new(w, x, y, y);
+    public float4 argb { readonly get => new(w, x, y, z); set { w = value.x; x = value.y; y = value.z; z = value.w; } }
+    public readonly float4 arga => new(w, x, y, w);
+    public readonly float4 arbr => new(w, x, z, x);
+    public float4 arbg { readonly get => new(w, x, z, y); set { w = value.x; x = value.y; z = value.z; y = value.w; } }
+    public readonly float4 arbb => new(w, x, z, z);
+    public readonly float4 arba => new(w, x, z, w);
+    public readonly float4 arar => new(w, x, w, x);
+    public readonly float4 arag => new(w, x, w, y);
+    public readonly float4 arab => new(w, x, w, z);
+    public readonly float4 araa => new(w, x, w, w);
+    public readonly float4 agrr => new(w, y, x, x);
+    public readonly float4 agrg => new(w, y, x, y);
+    public float4 agrb { readonly get => new(w, y, x, z); set { w = value.x; y = value.y; x = value.z; z = value.w; } }
+    public readonly float4 agra => new(w, y, x, w);
+    public readonly float4 aggr => new(w, y, y, x);
+    public readonly float4 aggg => new(w, y, y, y);
+    public readonly float4 aggb => new(w, y, y, z);
+    public readonly float4 agga => new(w, y, y, w);
+    public float4 agbr { readonly get => new(w, y, z, x); set { w = value.x; y = value.y; z = value.z; x = value.w; } }
+    public readonly float4 agbg => new(w, y, z, y);
+    public readonly float4 agbb => new(w, y, z, z);
+    public readonly float4 agba => new(w, y, z, w);
+    public readonly float4 agar => new(w, y, w, x);
+    public readonly float4 agag => new(w, y, w, y);
+    public readonly float4 agab => new(w, y, w, z);
+    public readonly float4 agaa => new(w, y, w, w);
+    public readonly float4 abrr => new(w, z, x, x);
+    public float4 abrg { readonly get => new(w, z, x, y); set { w = value.x; z = value.y; x = value.z; y = value.w; } }
+    public readonly float4 abrb => new(w, z, x, z);
+    public readonly float4 abra => new(w, z, x, w);
+    public float4 abgr { readonly get => new(w, z, y, x); set { w = value.x; z = value.y; y = value.z; x = value.w; } }
+    public readonly float4 abgg => new(w, z, y, y);
+    public readonly float4 abgb => new(w, z, y, z);
+    public readonly float4 abga => new(w, z, y, w);
+    public readonly float4 abbr => new(w, z, z, x);
+    public readonly float4 abbg => new(w, z, z, y);
+    public readonly float4 abbb => new(w, z, z, z);
+    public readonly float4 abba => new(w, z, z, w);
+    public readonly float4 abar => new(w, z, w, x);
+    public readonly float4 abag => new(w, z, w, y);
+    public readonly float4 abab => new(w, z, w, z);
+    public readonly float4 abaa => new(w, z, w, w);
+    public readonly float4 aarr => new(w, w, x, x);
+    public readonly float4 aarg => new(w, w, x, y);
+    public readonly float4 aarb => new(w, w, x, z);
+    public readonly float4 aara => new(w, w, x, w);
+    public readonly float4 aagr => new(w, w, y, x);
+    public readonly float4 aagg => new(w, w, y, y);
+    public readonly float4 aagb => new(w, w, y, z);
+    public readonly float4 aaga => new(w, w, y, w);
+    public readonly float4 aabr => new(w, w, z, x);
+    public readonly float4 aabg => new(w, w, z, y);
+    public readonly float4 aabb => new(w, w, z, z);
+    public readonly float4 aaba => new(w, w, z, w);
+    public readonly float4 aaar => new(w, w, w, x);
+    public readonly float4 aaag => new(w, w, w, y);
+    public readonly float4 aaab => new(w, w, w, z);
+    public readonly float4 aaaa => new(w, w, w, w);
+}
+
+public partial struct int2
+{
+    public int2(int2 xy) : this(xy.x, xy.y) { }
+    public int r { readonly get => x; set => x = value; }
+    public int g { readonly get => y; set => y = value; }
+    public readonly int2 xx => new(x, x);
+    public int2 xy { readonly get => new(x, y); set { x = value.x; y = value.y; } }
+    public int2 yx { readonly get => new(y, x); set { y = value.x; x = value.y; } }
+    public readonly int2 yy => new(y, y);
+    public readonly int3 xxx => new(x, x, x);
+    public readonly int3 xxy => new(x, x, y);
+    public readonly int3 xyx => new(x, y, x);
+    public readonly int3 xyy => new(x, y, y);
+    public readonly int3 yxx => new(y, x, x);
+    public readonly int3 yxy => new(y, x, y);
+    public readonly int3 yyx => new(y, y, x);
+    public readonly int3 yyy => new(y, y, y);
+    public readonly int4 xxxx => new(x, x, x, x);
+    public readonly int4 xxxy => new(x, x, x, y);
+    public readonly int4 xxyx => new(x, x, y, x);
+    public readonly int4 xxyy => new(x, x, y, y);
+    public readonly int4 xyxx => new(x, y, x, x);
+    public readonly int4 xyxy => new(x, y, x, y);
+    public readonly int4 xyyx => new(x, y, y, x);
+    public readonly int4 xyyy => new(x, y, y, y);
+    public readonly int4 yxxx => new(y, x, x, x);
+    public readonly int4 yxxy => new(y, x, x, y);
+    public readonly int4 yxyx => new(y, x, y, x);
+    public readonly int4 yxyy => new(y, x, y, y);
+    public readonly int4 yyxx => new(y, y, x, x);
+    public readonly int4 yyxy => new(y, y, x, y);
+    public readonly int4 yyyx => new(y, y, y, x);
+    public readonly int4 yyyy => new(y, y, y, y);
+    public readonly int2 rr => new(x, x);
+    public int2 rg { readonly get => new(x, y); set { x = value.x; y = value.y; } }
+    public int2 gr { readonly get => new(y, x); set { y = value.x; x = value.y; } }
+    public readonly int2 gg => new(y, y);
+    public readonly int3 rrr => new(x, x, x);
+    public readonly int3 rrg => new(x, x, y);
+    public readonly int3 rgr => new(x, y, x);
+    public readonly int3 rgg => new(x, y, y);
+    public readonly int3 grr => new(y, x, x);
+    public readonly int3 grg => new(y, x, y);
+    public readonly int3 ggr => new(y, y, x);
+    public readonly int3 ggg => new(y, y, y);
+    public readonly int4 rrrr => new(x, x, x, x);
+    public readonly int4 rrrg => new(x, x, x, y);
+    public readonly int4 rrgr => new(x, x, y, x);
+    public readonly int4 rrgg => new(x, x, y, y);
+    public readonly int4 rgrr => new(x, y, x, x);
+    public readonly int4 rgrg => new(x, y, x, y);
+    public readonly int4 rggr => new(x, y, y, x);
+    public readonly int4 rggg => new(x, y, y, y);
+    public readonly int4 grrr => new(y, x, x, x);
+    public readonly int4 grrg => new(y, x, x, y);
+    public readonly int4 grgr => new(y, x, y, x);
+    public readonly int4 grgg => new(y, x, y, y);
+    public readonly int4 ggrr => new(y, y, x, x);
+    public readonly int4 ggrg => new(y, y, x, y);
+    public readonly int4 gggr => new(y, y, y, x);
+    public readonly int4 gggg => new(y, y, y, y);
+}
+
+public partial struct int3
+{
+    public int3(int x, int2 yz) : this(x, yz.x, yz.y) { }
+    public int3(int2 xy, int z) : this(xy.x, xy.y, z) { }
+    public int3(int3 xyz) : this(xyz.x, xyz.y, xyz.z) { }
+    public int r { readonly get => x; set => x = value; }
+    public int g { readonly get => y; set => y = value; }
+    public int b { readonly get => z; set => z = value; }
+    public readonly int2 xx => new(x, x);
+    public int2 xy { readonly get => new(x, y); set { x = value.x; y = value.y; } }
+    public int2 xz { readonly get => new(x, z); set { x = value.x; z = value.y; } }
+    public int2 yx { readonly get => new(y, x); set { y = value.x; x = value.y; } }
+    public readonly int2 yy => new(y, y);
+    public int2 yz { readonly get => new(y, z); set { y = value.x; z = value.y; } }
+    public int2 zx { readonly get => new(z, x); set { z = value.x; x = value.y; } }
+    public int2 zy { readonly get => new(z, y); set { z = value.x; y = value.y; } }
+    public readonly int2 zz => new(z, z);
+    public readonly int3 xxx => new(x, x, x);
+    public readonly int3 xxy => new(x, x, y);
+    public readonly int3 xxz => new(x, x, z);
+    public readonly int3 xyx => new(x, y, x);
+    public readonly int3 xyy => new(x, y, y);
+    public int3 xyz { readonly get => new(x, y, z); set { x = value.x; y = value.y; z = value.z; } }
+    public readonly int3 xzx => new(x, z, x);
+    public int3 xzy { readonly get => new(x, z, y); set { x = value.x; z = value.y; y = value.z; } }
+    public readonly int3 xzz => new(x, z, z);
+    public readonly int3 yxx => new(y, x, x);
+    public readonly int3 yxy => new(y, x, y);
+    public int3 yxz { readonly get => new(y, x, z); set { y = value.x; x = value.y; z = value.z; } }
+    public readonly int3 yyx => new(y, y, x);
+    public readonly int3 yyy => new(y, y, y);
+    public readonly int3 yyz => new(y, y, z);
+    public int3 yzx { readonly get => new(y, z, x); set { y = value.x; z = value.y; x = value.z; } }
+    public readonly int3 yzy => new(y, z, y);
+    public readonly int3 yzz => new(y, z, z);
+    public readonly int3 zxx => new(z, x, x);
+    public int3 zxy { readonly get => new(z, x, y); set { z = value.x; x = value.y; y = value.z; } }
+    public readonly int3 zxz => new(z, x, z);
+    public int3 zyx { readonly get => new(z, y, x); set { z = value.x; y = value.y; x = value.z; } }
+    public readonly int3 zyy => new(z, y, y);
+    public readonly int3 zyz => new(z, y, z);
+    public readonly int3 zzx => new(z, z, x);
+    public readonly int3 zzy => new(z, z, y);
+    public readonly int3 zzz => new(z, z, z);
+    public readonly int4 xxxx => new(x, x, x, x);
+    public readonly int4 xxxy => new(x, x, x, y);
+    public readonly int4 xxxz => new(x, x, x, z);
+    public readonly int4 xxyx => new(x, x, y, x);
+    public readonly int4 xxyy => new(x, x, y, y);
+    public readonly int4 xxyz => new(x, x, y, z);
+    public readonly int4 xxzx => new(x, x, z, x);
+    public readonly int4 xxzy => new(x, x, z, y);
+    public readonly int4 xxzz => new(x, x, z, z);
+    public readonly int4 xyxx => new(x, y, x, x);
+    public readonly int4 xyxy => new(x, y, x, y);
+    public readonly int4 xyxz => new(x, y, x, z);
+    public readonly int4 xyyx => new(x, y, y, x);
+    public readonly int4 xyyy => new(x, y, y, y);
+    public readonly int4 xyyz => new(x, y, y, z);
+    public readonly int4 xyzx => new(x, y, z, x);
+    public readonly int4 xyzy => new(x, y, z, y);
+    public readonly int4 xyzz => new(x, y, z, z);
+    public readonly int4 xzxx => new(x, z, x, x);
+    public readonly int4 xzxy => new(x, z, x, y);
+    public readonly int4 xzxz => new(x, z, x, z);
+    public readonly int4 xzyx => new(x, z, y, x);
+    public readonly int4 xzyy => new(x, z, y, y);
+    public readonly int4 xzyz => new(x, z, y, z);
+    public readonly int4 xzzx => new(x, z, z, x);
+    public readonly int4 xzzy => new(x, z, z, y);
+    public readonly int4 xzzz => new(x, z, z, z);
+    public readonly int4 yxxx => new(y, x, x, x);
+    public readonly int4 yxxy => new(y, x, x, y);
+    public readonly int4 yxxz => new(y, x, x, z);
+    public readonly int4 yxyx => new(y, x, y, x);
+    public readonly int4 yxyy => new(y, x, y, y);
+    public readonly int4 yxyz => new(y, x, y, z);
+    public readonly int4 yxzx => new(y, x, z, x);
+    public readonly int4 yxzy => new(y, x, z, y);
+    public readonly int4 yxzz => new(y, x, z, z);
+    public readonly int4 yyxx => new(y, y, x, x);
+    public readonly int4 yyxy => new(y, y, x, y);
+    public readonly int4 yyxz => new(y, y, x, z);
+    public readonly int4 yyyx => new(y, y, y, x);
+    public readonly int4 yyyy => new(y, y, y, y);
+    public readonly int4 yyyz => new(y, y, y, z);
+    public readonly int4 yyzx => new(y, y, z, x);
+    public readonly int4 yyzy => new(y, y, z, y);
+    public readonly int4 yyzz => new(y, y, z, z);
+    public readonly int4 yzxx => new(y, z, x, x);
+    public readonly int4 yzxy => new(y, z, x, y);
+    public readonly int4 yzxz => new(y, z, x, z);
+    public readonly int4 yzyx => new(y, z, y, x);
+    public readonly int4 yzyy => new(y, z, y, y);
+    public readonly int4 yzyz => new(y, z, y, z);
+    public readonly int4 yzzx => new(y, z, z, x);
+    public readonly int4 yzzy => new(y, z, z, y);
+    public readonly int4 yzzz => new(y, z, z, z);
+    public readonly int4 zxxx => new(z, x, x, x);
+    public readonly int4 zxxy => new(z, x, x, y);
+    public readonly int4 zxxz => new(z, x, x, z);
+    public readonly int4 zxyx => new(z, x, y, x);
+    public readonly int4 zxyy => new(z, x, y, y);
+    public readonly int4 zxyz => new(z, x, y, z);
+    public readonly int4 zxzx => new(z, x, z, x);
+    public readonly int4 zxzy => new(z, x, z, y);
+    public readonly int4 zxzz => new(z, x, z, z);
+    public readonly int4 zyxx => new(z, y, x, x);
+    public readonly int4 zyxy => new(z, y, x, y);
+    public readonly int4 zyxz => new(z, y, x, z);
+    public readonly int4 zyyx => new(z, y, y, x);
+    public readonly int4 zyyy => new(z, y, y, y);
+    public readonly int4 zyyz => new(z, y, y, z);
+    public readonly int4 zyzx => new(z, y, z, x);
+    public readonly int4 zyzy => new(z, y, z, y);
+    public readonly int4 zyzz => new(z, y, z, z);
+    public readonly int4 zzxx => new(z, z, x, x);
+    public readonly int4 zzxy => new(z, z, x, y);
+    public readonly int4 zzxz => new(z, z, x, z);
+    public readonly int4 zzyx => new(z, z, y, x);
+    public readonly int4 zzyy => new(z, z, y, y);
+    public readonly int4 zzyz => new(z, z, y, z);
+    public readonly int4 zzzx => new(z, z, z, x);
+    public readonly int4 zzzy => new(z, z, z, y);
+    public readonly int4 zzzz => new(z, z, z, z);
+    public readonly int2 rr => new(x, x);
+    public int2 rg { readonly get => new(x, y); set { x = value.x; y = value.y; } }
+    public int2 rb { readonly get => new(x, z); set { x = value.x; z = value.y; } }
+    public int2 gr { readonly get => new(y, x); set { y = value.x; x = value.y; } }
+    public readonly int2 gg => new(y, y);
+    public int2 gb { readonly get => new(y, z); set { y = value.x; z = value.y; } }
+    public int2 br { readonly get => new(z, x); set { z = value.x; x = value.y; } }
+    public int2 bg { readonly get => new(z, y); set { z = value.x; y = value.y; } }
+    public readonly int2 bb => new(z, z);
+    public readonly int3 rrr => new(x, x, x);
+    public readonly int3 rrg => new(x, x, y);
+    public readonly int3 rrb => new(x, x, z);
+    public readonly int3 rgr => new(x, y, x);
+    public readonly int3 rgg => new(x, y, y);
+    public int3 rgb { readonly get => new(x, y, z); set { x = value.x; y = value.y; z = value.z; } }
+    public readonly int3 rbr => new(x, z, x);
+    public int3 rbg { readonly get => new(x, z, y); set { x = value.x; z = value.y; y = value.z; } }
+    public readonly int3 rbb => new(x, z, z);
+    public readonly int3 grr => new(y, x, x);
+    public readonly int3 grg => new(y, x, y);
+    public int3 grb { readonly get => new(y, x, z); set { y = value.x; x = value.y; z = value.z; } }
+    public readonly int3 ggr => new(y, y, x);
+    public readonly int3 ggg => new(y, y, y);
+    public readonly int3 ggb => new(y, y, z);
+    public int3 gbr { readonly get => new(y, z, x); set { y = value.x; z = value.y; x = value.z; } }
+    public readonly int3 gbg => new(y, z, y);
+    public readonly int3 gbb => new(y, z, z);
+    public readonly int3 brr => new(z, x, x);
+    public int3 brg { readonly get => new(z, x, y); set { z = value.x; x = value.y; y = value.z; } }
+    public readonly int3 brb => new(z, x, z);
+    public int3 bgr { readonly get => new(z, y, x); set { z = value.x; y = value.y; x = value.z; } }
+    public readonly int3 bgg => new(z, y, y);
+    public readonly int3 bgb => new(z, y, z);
+    public readonly int3 bbr => new(z, z, x);
+    public readonly int3 bbg => new(z, z, y);
+    public readonly int3 bbb => new(z, z, z);
+    public readonly int4 rrrr => new(x, x, x, x);
+    public readonly int4 rrrg => new(x, x, x, y);
+    public readonly int4 rrrb => new(x, x, x, z);
+    public readonly int4 rrgr => new(x, x, y, x);
+    public readonly int4 rrgg => new(x, x, y, y);
+    public readonly int4 rrgb => new(x, x, y, z);
+    public readonly int4 rrbr => new(x, x, z, x);
+    public readonly int4 rrbg => new(x, x, z, y);
+    public readonly int4 rrbb => new(x, x, z, z);
+    public readonly int4 rgrr => new(x, y, x, x);
+    public readonly int4 rgrg => new(x, y, x, y);
+    public readonly int4 rgrb => new(x, y, x, z);
+    public readonly int4 rggr => new(x, y, y, x);
+    public readonly int4 rggg => new(x, y, y, y);
+    public readonly int4 rggb => new(x, y, y, z);
+    public readonly int4 rgbr => new(x, y, z, x);
+    public readonly int4 rgbg => new(x, y, z, y);
+    public readonly int4 rgbb => new(x, y, z, z);
+    public readonly int4 rbrr => new(x, z, x, x);
+    public readonly int4 rbrg => new(x, z, x, y);
+    public readonly int4 rbrb => new(x, z, x, z);
+    public readonly int4 rbgr => new(x, z, y, x);
+    public readonly int4 rbgg => new(x, z, y, y);
+    public readonly int4 rbgb => new(x, z, y, z);
+    public readonly int4 rbbr => new(x, z, z, x);
+    public readonly int4 rbbg => new(x, z, z, y);
+    public readonly int4 rbbb => new(x, z, z, z);
+    public readonly int4 grrr => new(y, x, x, x);
+    public readonly int4 grrg => new(y, x, x, y);
+    public readonly int4 grrb => new(y, x, x, z);
+    public readonly int4 grgr => new(y, x, y, x);
+    public readonly int4 grgg => new(y, x, y, y);
+    public readonly int4 grgb => new(y, x, y, z);
+    public readonly int4 grbr => new(y, x, z, x);
+    public readonly int4 grbg => new(y, x, z, y);
+    public readonly int4 grbb => new(y, x, z, z);
+    public readonly int4 ggrr => new(y, y, x, x);
+    public readonly int4 ggrg => new(y, y, x, y);
+    public readonly int4 ggrb => new(y, y, x, z);
+    public readonly int4 gggr => new(y, y, y, x);
+    public readonly int4 gggg => new(y, y, y, y);
+    public readonly int4 gggb => new(y, y, y, z);
+    public readonly int4 ggbr => new(y, y, z, x);
+    public readonly int4 ggbg => new(y, y, z, y);
+    public readonly int4 ggbb => new(y, y, z, z);
+    public readonly int4 gbrr => new(y, z, x, x);
+    public readonly int4 gbrg => new(y, z, x, y);
+    public readonly int4 gbrb => new(y, z, x, z);
+    public readonly int4 gbgr => new(y, z, y, x);
+    public readonly int4 gbgg => new(y, z, y, y);
+    public readonly int4 gbgb => new(y, z, y, z);
+    public readonly int4 gbbr => new(y, z, z, x);
+    public readonly int4 gbbg => new(y, z, z, y);
+    public readonly int4 gbbb => new(y, z, z, z);
+    public readonly int4 brrr => new(z, x, x, x);
+    public readonly int4 brrg => new(z, x, x, y);
+    public readonly int4 brrb => new(z, x, x, z);
+    public readonly int4 brgr => new(z, x, y, x);
+    public readonly int4 brgg => new(z, x, y, y);
+    public readonly int4 brgb => new(z, x, y, z);
+    public readonly int4 brbr => new(z, x, z, x);
+    public readonly int4 brbg => new(z, x, z, y);
+    public readonly int4 brbb => new(z, x, z, z);
+    public readonly int4 bgrr => new(z, y, x, x);
+    public readonly int4 bgrg => new(z, y, x, y);
+    public readonly int4 bgrb => new(z, y, x, z);
+    public readonly int4 bggr => new(z, y, y, x);
+    public readonly int4 bggg => new(z, y, y, y);
+    public readonly int4 bggb => new(z, y, y, z);
+    public readonly int4 bgbr => new(z, y, z, x);
+    public readonly int4 bgbg => new(z, y, z, y);
+    public readonly int4 bgbb => new(z, y, z, z);
+    public readonly int4 bbrr => new(z, z, x, x);
+    public readonly int4 bbrg => new(z, z, x, y);
+    public readonly int4 bbrb => new(z, z, x, z);
+    public readonly int4 bbgr => new(z, z, y, x);
+    public readonly int4 bbgg => new(z, z, y, y);
+    public readonly int4 bbgb => new(z, z, y, z);
+    public readonly int4 bbbr => new(z, z, z, x);
+    public readonly int4 bbbg => new(z, z, z, y);
+    public readonly int4 bbbb => new(z, z, z, z);
+}
+
+public partial struct int4
+{
+    public int4(int x, int y, int2 zw) : this(x, y, zw.x, zw.y) { }
+    public int4(int x, int2 yz, int w) : this(x, yz.x, yz.y, w) { }
+    public int4(int x, int3 yzw) : this(x, yzw.x, yzw.y, yzw.z) { }
+    public int4(int2 xy, int z, int w) : this(xy.x, xy.y, z, w) { }
+    public int4(int2 xy, int2 zw) : this(xy.x, xy.y, zw.x, zw.y) { }
+    public int4(int3 xyz, int w) : this(xyz.x, xyz.y, xyz.z, w) { }
+    public int4(int4 xyzw) : this(xyzw.x, xyzw.y, xyzw.z, xyzw.w) { }
+    public int r { readonly get => x; set => x = value; }
+    public int g { readonly get => y; set => y = value; }
+    public int b { readonly get => z; set => z = value; }
+    public int a { readonly get => w; set => w = value; }
+    public readonly int2 xx => new(x, x);
+    public int2 xy { readonly get => new(x, y); set { x = value.x; y = value.y; } }
+    public int2 xz { readonly get => new(x, z); set { x = value.x; z = value.y; } }
+    public int2 xw { readonly get => new(x, w); set { x = value.x; w = value.y; } }
+    public int2 yx { readonly get => new(y, x); set { y = value.x; x = value.y; } }
+    public readonly int2 yy => new(y, y);
+    public int2 yz { readonly get => new(y, z); set { y = value.x; z = value.y; } }
+    public int2 yw { readonly get => new(y, w); set { y = value.x; w = value.y; } }
+    public int2 zx { readonly get => new(z, x); set { z = value.x; x = value.y; } }
+    public int2 zy { readonly get => new(z, y); set { z = value.x; y = value.y; } }
+    public readonly int2 zz => new(z, z);
+    public int2 zw { readonly get => new(z, w); set { z = value.x; w = value.y; } }
+    public int2 wx { readonly get => new(w, x); set { w = value.x; x = value.y; } }
+    public int2 wy { readonly get => new(w, y); set { w = value.x; y = value.y; } }
+    public int2 wz { readonly get => new(w, z); set { w = value.x; z = value.y; } }
+    public readonly int2 ww => new(w, w);
+    public readonly int3 xxx => new(x, x, x);
+    public readonly int3 xxy => new(x, x, y);
+    public readonly int3 xxz => new(x, x, z);
+    public readonly int3 xxw => new(x, x, w);
+    public readonly int3 xyx => new(x, y, x);
+    public readonly int3 xyy => new(x, y, y);
+    public int3 xyz { readonly get => new(x, y, z); set { x = value.x; y = value.y; z = value.z; } }
+    public int3 xyw { readonly get => new(x, y, w); set { x = value.x; y = value.y; w = value.z; } }
+    public readonly int3 xzx => new(x, z, x);
+    public int3 xzy { readonly get => new(x, z, y); set { x = value.x; z = value.y; y = value.z; } }
+    public readonly int3 xzz => new(x, z, z);
+    public int3 xzw { readonly get => new(x, z, w); set { x = value.x; z = value.y; w = value.z; } }
+    public readonly int3 xwx => new(x, w, x);
+    public int3 xwy { readonly get => new(x, w, y); set { x = value.x; w = value.y; y = value.z; } }
+    public int3 xwz { readonly get => new(x, w, z); set { x = value.x; w = value.y; z = value.z; } }
+    public readonly int3 xww => new(x, w, w);
+    public readonly int3 yxx => new(y, x, x);
+    public readonly int3 yxy => new(y, x, y);
+    public int3 yxz { readonly get => new(y, x, z); set { y = value.x; x = value.y; z = value.z; } }
+    public int3 yxw { readonly get => new(y, x, w); set { y = value.x; x = value.y; w = value.z; } }
+    public readonly int3 yyx => new(y, y, x);
+    public readonly int3 yyy => new(y, y, y);
+    public readonly int3 yyz => new(y, y, z);
+    public readonly int3 yyw => new(y, y, w);
+    public int3 yzx { readonly get => new(y, z, x); set { y = value.x; z = value.y; x = value.z; } }
+    public readonly int3 yzy => new(y, z, y);
+    public readonly int3 yzz => new(y, z, z);
+    public int3 yzw { readonly get => new(y, z, w); set { y = value.x; z = value.y; w = value.z; } }
+    public int3 ywx { readonly get => new(y, w, x); set { y = value.x; w = value.y; x = value.z; } }
+    public readonly int3 ywy => new(y, w, y);
+    public int3 ywz { readonly get => new(y, w, z); set { y = value.x; w = value.y; z = value.z; } }
+    public readonly int3 yww => new(y, w, w);
+    public readonly int3 zxx => new(z, x, x);
+    public int3 zxy { readonly get => new(z, x, y); set { z = value.x; x = value.y; y = value.z; } }
+    public readonly int3 zxz => new(z, x, z);
+    public int3 zxw { readonly get => new(z, x, w); set { z = value.x; x = value.y; w = value.z; } }
+    public int3 zyx { readonly get => new(z, y, x); set { z = value.x; y = value.y; x = value.z; } }
+    public readonly int3 zyy => new(z, y, y);
+    public readonly int3 zyz => new(z, y, z);
+    public int3 zyw { readonly get => new(z, y, w); set { z = value.x; y = value.y; w = value.z; } }
+    public readonly int3 zzx => new(z, z, x);
+    public readonly int3 zzy => new(z, z, y);
+    public readonly int3 zzz => new(z, z, z);
+    public readonly int3 zzw => new(z, z, w);
+    public int3 zwx { readonly get => new(z, w, x); set { z = value.x; w = value.y; x = value.z; } }
+    public int3 zwy { readonly get => new(z, w, y); set { z = value.x; w = value.y; y = value.z; } }
+    public readonly int3 zwz => new(z, w, z);
+    public readonly int3 zww => new(z, w, w);
+    public readonly int3 wxx => new(w, x, x);
+    public int3 wxy { readonly get => new(w, x, y); set { w = value.x; x = value.y; y = value.z; } }
+    public int3 wxz { readonly get => new(w, x, z); set { w = value.x; x = value.y; z = value.z; } }
+    public readonly int3 wxw => new(w, x, w);
+    public int3 wyx { readonly get => new(w, y, x); set { w = value.x; y = value.y; x = value.z; } }
+    public readonly int3 wyy => new(w, y, y);
+    public int3 wyz { readonly get => new(w, y, z); set { w = value.x; y = value.y; z = value.z; } }
+    public readonly int3 wyw => new(w, y, w);
+    public int3 wzx { readonly get => new(w, z, x); set { w = value.x; z = value.y; x = value.z; } }
+    public int3 wzy { readonly get => new(w, z, y); set { w = value.x; z = value.y; y = value.z; } }
+    public readonly int3 wzz => new(w, z, z);
+    public readonly int3 wzw => new(w, z, w);
+    public readonly int3 wwx => new(w, w, x);
+    public readonly int3 wwy => new(w, w, y);
+    public readonly int3 wwz => new(w, w, z);
+    public readonly int3 www => new(w, w, w);
+    public readonly int4 xxxx => new(x, x, x, x);
+    public readonly int4 xxxy => new(x, x, x, y);
+    public readonly int4 xxxz => new(x, x, x, z);
+    public readonly int4 xxxw => new(x, x, x, w);
+    public readonly int4 xxyx => new(x, x, y, x);
+    public readonly int4 xxyy => new(x, x, y, y);
+    public readonly int4 xxyz => new(x, x, y, z);
+    public readonly int4 xxyw => new(x, x, y, w);
+    public readonly int4 xxzx => new(x, x, z, x);
+    public readonly int4 xxzy => new(x, x, z, y);
+    public readonly int4 xxzz => new(x, x, z, z);
+    public readonly int4 xxzw => new(x, x, z, w);
+    public readonly int4 xxwx => new(x, x, w, x);
+    public readonly int4 xxwy => new(x, x, w, y);
+    public readonly int4 xxwz => new(x, x, w, z);
+    public readonly int4 xxww => new(x, x, w, w);
+    public readonly int4 xyxx => new(x, y, x, x);
+    public readonly int4 xyxy => new(x, y, x, y);
+    public readonly int4 xyxz => new(x, y, x, z);
+    public readonly int4 xyxw => new(x, y, x, w);
+    public readonly int4 xyyx => new(x, y, y, x);
+    public readonly int4 xyyy => new(x, y, y, y);
+    public readonly int4 xyyz => new(x, y, y, z);
+    public readonly int4 xyyw => new(x, y, y, w);
+    public readonly int4 xyzx => new(x, y, z, x);
+    public readonly int4 xyzy => new(x, y, z, y);
+    public readonly int4 xyzz => new(x, y, z, z);
+    public int4 xyzw { readonly get => new(x, y, z, w); set { x = value.x; y = value.y; z = value.z; w = value.w; } }
+    public readonly int4 xywx => new(x, y, w, x);
+    public readonly int4 xywy => new(x, y, w, y);
+    public int4 xywz { readonly get => new(x, y, w, z); set { x = value.x; y = value.y; w = value.z; z = value.w; } }
+    public readonly int4 xyww => new(x, y, w, w);
+    public readonly int4 xzxx => new(x, z, x, x);
+    public readonly int4 xzxy => new(x, z, x, y);
+    public readonly int4 xzxz => new(x, z, x, z);
+    public readonly int4 xzxw => new(x, z, x, w);
+    public readonly int4 xzyx => new(x, z, y, x);
+    public readonly int4 xzyy => new(x, z, y, y);
+    public readonly int4 xzyz => new(x, z, y, z);
+    public int4 xzyw { readonly get => new(x, z, y, w); set { x = value.x; z = value.y; y = value.z; w = value.w; } }
+    public readonly int4 xzzx => new(x, z, z, x);
+    public readonly int4 xzzy => new(x, z, z, y);
+    public readonly int4 xzzz => new(x, z, z, z);
+    public readonly int4 xzzw => new(x, z, z, w);
+    public readonly int4 xzwx => new(x, z, w, x);
+    public int4 xzwy { readonly get => new(x, z, w, y); set { x = value.x; z = value.y; w = value.z; y = value.w; } }
+    public readonly int4 xzwz => new(x, z, w, z);
+    public readonly int4 xzww => new(x, z, w, w);
+    public readonly int4 xwxx => new(x, w, x, x);
+    public readonly int4 xwxy => new(x, w, x, y);
+    public readonly int4 xwxz => new(x, w, x, z);
+    public readonly int4 xwxw => new(x, w, x, w);
+    public readonly int4 xwyx => new(x, w, y, x);
+    public readonly int4 xwyy => new(x, w, y, y);
+    public int4 xwyz { readonly get => new(x, w, y, z); set { x = value.x; w = value.y; y = value.z; z = value.w; } }
+    public readonly int4 xwyw => new(x, w, y, w);
+    public readonly int4 xwzx => new(x, w, z, x);
+    public int4 xwzy { readonly get => new(x, w, z, y); set { x = value.x; w = value.y; z = value.z; y = value.w; } }
+    public readonly int4 xwzz => new(x, w, z, z);
+    public readonly int4 xwzw => new(x, w, z, w);
+    public readonly int4 xwwx => new(x, w, w, x);
+    public readonly int4 xwwy => new(x, w, w, y);
+    public readonly int4 xwwz => new(x, w, w, z);
+    public readonly int4 xwww => new(x, w, w, w);
+    public readonly int4 yxxx => new(y, x, x, x);
+    public readonly int4 yxxy => new(y, x, x, y);
+    public readonly int4 yxxz => new(y, x, x, z);
+    public readonly int4 yxxw => new(y, x, x, w);
+    public readonly int4 yxyx => new(y, x, y, x);
+    public readonly int4 yxyy => new(y, x, y, y);
+    public readonly int4 yxyz => new(y, x, y, z);
+    public readonly int4 yxyw => new(y, x, y, w);
+    public readonly int4 yxzx => new(y, x, z, x);
+    public readonly int4 yxzy => new(y, x, z, y);
+    public readonly int4 yxzz => new(y, x, z, z);
+    public int4 yxzw { readonly get => new(y, x, z, w); set { y = value.x; x = value.y; z = value.z; w = value.w; } }
+    public readonly int4 yxwx => new(y, x, w, x);
+    public readonly int4 yxwy => new(y, x, w, y);
+    public int4 yxwz { readonly get => new(y, x, w, z); set { y = value.x; x = value.y; w = value.z; z = value.w; } }
+    public readonly int4 yxww => new(y, x, w, w);
+    public readonly int4 yyxx => new(y, y, x, x);
+    public readonly int4 yyxy => new(y, y, x, y);
+    public readonly int4 yyxz => new(y, y, x, z);
+    public readonly int4 yyxw => new(y, y, x, w);
+    public readonly int4 yyyx => new(y, y, y, x);
+    public readonly int4 yyyy => new(y, y, y, y);
+    public readonly int4 yyyz => new(y, y, y, z);
+    public readonly int4 yyyw => new(y, y, y, w);
+    public readonly int4 yyzx => new(y, y, z, x);
+    public readonly int4 yyzy => new(y, y, z, y);
+    public readonly int4 yyzz => new(y, y, z, z);
+    public readonly int4 yyzw => new(y, y, z, w);
+    public readonly int4 yywx => new(y, y, w, x);
+    public readonly int4 yywy => new(y, y, w, y);
+    public readonly int4 yywz => new(y, y, w, z);
+    public readonly int4 yyww => new(y, y, w, w);
+    public readonly int4 yzxx => new(y, z, x, x);
+    public readonly int4 yzxy => new(y, z, x, y);
+    public readonly int4 yzxz => new(y, z, x, z);
+    public int4 yzxw { readonly get => new(y, z, x, w); set { y = value.x; z = value.y; x = value.z; w = value.w; } }
+    public readonly int4 yzyx => new(y, z, y, x);
+    public readonly int4 yzyy => new(y, z, y, y);
+    public readonly int4 yzyz => new(y, z, y, z);
+    public readonly int4 yzyw => new(y, z, y, w);
+    public readonly int4 yzzx => new(y, z, z, x);
+    public readonly int4 yzzy => new(y, z, z, y);
+    public readonly int4 yzzz => new(y, z, z, z);
+    public readonly int4 yzzw => new(y, z, z, w);
+    public int4 yzwx { readonly get => new(y, z, w, x); set { y = value.x; z = value.y; w = value.z; x = value.w; } }
+    public readonly int4 yzwy => new(y, z, w, y);
+    public readonly int4 yzwz => new(y, z, w, z);
+    public readonly int4 yzww => new(y, z, w, w);
+    public readonly int4 ywxx => new(y, w, x, x);
+    public readonly int4 ywxy => new(y, w, x, y);
+    public int4 ywxz { readonly get => new(y, w, x, z); set { y = value.x; w = value.y; x = value.z; z = value.w; } }
+    public readonly int4 ywxw => new(y, w, x, w);
+    public readonly int4 ywyx => new(y, w, y, x);
+    public readonly int4 ywyy => new(y, w, y, y);
+    public readonly int4 ywyz => new(y, w, y, z);
+    public readonly int4 ywyw => new(y, w, y, w);
+    public int4 ywzx { readonly get => new(y, w, z, x); set { y = value.x; w = value.y; z = value.z; x = value.w; } }
+    public readonly int4 ywzy => new(y, w, z, y);
+    public readonly int4 ywzz => new(y, w, z, z);
+    public readonly int4 ywzw => new(y, w, z, w);
+    public readonly int4 ywwx => new(y, w, w, x);
+    public readonly int4 ywwy => new(y, w, w, y);
+    public readonly int4 ywwz => new(y, w, w, z);
+    public readonly int4 ywww => new(y, w, w, w);
+    public readonly int4 zxxx => new(z, x, x, x);
+    public readonly int4 zxxy => new(z, x, x, y);
+    public readonly int4 zxxz => new(z, x, x, z);
+    public readonly int4 zxxw => new(z, x, x, w);
+    public readonly int4 zxyx => new(z, x, y, x);
+    public readonly int4 zxyy => new(z, x, y, y);
+    public readonly int4 zxyz => new(z, x, y, z);
+    public int4 zxyw { readonly get => new(z, x, y, w); set { z = value.x; x = value.y; y = value.z; w = value.w; } }
+    public readonly int4 zxzx => new(z, x, z, x);
+    public readonly int4 zxzy => new(z, x, z, y);
+    public readonly int4 zxzz => new(z, x, z, z);
+    public readonly int4 zxzw => new(z, x, z, w);
+    public readonly int4 zxwx => new(z, x, w, x);
+    public int4 zxwy { readonly get => new(z, x, w, y); set { z = value.x; x = value.y; w = value.z; y = value.w; } }
+    public readonly int4 zxwz => new(z, x, w, z);
+    public readonly int4 zxww => new(z, x, w, w);
+    public readonly int4 zyxx => new(z, y, x, x);
+    public readonly int4 zyxy => new(z, y, x, y);
+    public readonly int4 zyxz => new(z, y, x, z);
+    public int4 zyxw { readonly get => new(z, y, x, w); set { z = value.x; y = value.y; x = value.z; w = value.w; } }
+    public readonly int4 zyyx => new(z, y, y, x);
+    public readonly int4 zyyy => new(z, y, y, y);
+    public readonly int4 zyyz => new(z, y, y, z);
+    public readonly int4 zyyw => new(z, y, y, w);
+    public readonly int4 zyzx => new(z, y, z, x);
+    public readonly int4 zyzy => new(z, y, z, y);
+    public readonly int4 zyzz => new(z, y, z, z);
+    public readonly int4 zyzw => new(z, y, z, w);
+    public int4 zywx { readonly get => new(z, y, w, x); set { z = value.x; y = value.y; w = value.z; x = value.w; } }
+    public readonly int4 zywy => new(z, y, w, y);
+    public readonly int4 zywz => new(z, y, w, z);
+    public readonly int4 zyww => new(z, y, w, w);
+    public readonly int4 zzxx => new(z, z, x, x);
+    public readonly int4 zzxy => new(z, z, x, y);
+    public readonly int4 zzxz => new(z, z, x, z);
+    public readonly int4 zzxw => new(z, z, x, w);
+    public readonly int4 zzyx => new(z, z, y, x);
+    public readonly int4 zzyy => new(z, z, y, y);
+    public readonly int4 zzyz => new(z, z, y, z);
+    public readonly int4 zzyw => new(z, z, y, w);
+    public readonly int4 zzzx => new(z, z, z, x);
+    public readonly int4 zzzy => new(z, z, z, y);
+    public readonly int4 zzzz => new(z, z, z, z);
+    public readonly int4 zzzw => new(z, z, z, w);
+    public readonly int4 zzwx => new(z, z, w, x);
+    public readonly int4 zzwy => new(z, z, w, y);
+    public readonly int4 zzwz => new(z, z, w, z);
+    public readonly int4 zzww => new(z, z, w, w);
+    public readonly int4 zwxx => new(z, w, x, x);
+    public int4 zwxy { readonly get => new(z, w, x, y); set { z = value.x; w = value.y; x = value.z; y = value.w; } }
+    public readonly int4 zwxz => new(z, w, x, z);
+    public readonly int4 zwxw => new(z, w, x, w);
+    public int4 zwyx { readonly get => new(z, w, y, x); set { z = value.x; w = value.y; y = value.z; x = value.w; } }
+    public readonly int4 zwyy => new(z, w, y, y);
+    public readonly int4 zwyz => new(z, w, y, z);
+    public readonly int4 zwyw => new(z, w, y, w);
+    public readonly int4 zwzx => new(z, w, z, x);
+    public readonly int4 zwzy => new(z, w, z, y);
+    public readonly int4 zwzz => new(z, w, z, z);
+    public readonly int4 zwzw => new(z, w, z, w);
+    public readonly int4 zwwx => new(z, w, w, x);
+    public readonly int4 zwwy => new(z, w, w, y);
+    public readonly int4 zwwz => new(z, w, w, z);
+    public readonly int4 zwww => new(z, w, w, w);
+    public readonly int4 wxxx => new(w, x, x, x);
+    public readonly int4 wxxy => new(w, x, x, y);
+    public readonly int4 wxxz => new(w, x, x, z);
+    public readonly int4 wxxw => new(w, x, x, w);
+    public readonly int4 wxyx => new(w, x, y, x);
+    public readonly int4 wxyy => new(w, x, y, y);
+    public int4 wxyz { readonly get => new(w, x, y, z); set { w = value.x; x = value.y; y = value.z; z = value.w; } }
+    public readonly int4 wxyw => new(w, x, y, w);
+    public readonly int4 wxzx => new(w, x, z, x);
+    public int4 wxzy { readonly get => new(w, x, z, y); set { w = value.x; x = value.y; z = value.z; y = value.w; } }
+    public readonly int4 wxzz => new(w, x, z, z);
+    public readonly int4 wxzw => new(w, x, z, w);
+    public readonly int4 wxwx => new(w, x, w, x);
+    public readonly int4 wxwy => new(w, x, w, y);
+    public readonly int4 wxwz => new(w, x, w, z);
+    public readonly int4 wxww => new(w, x, w, w);
+    public readonly int4 wyxx => new(w, y, x, x);
+    public readonly int4 wyxy => new(w, y, x, y);
+    public int4 wyxz { readonly get => new(w, y, x, z); set { w = value.x; y = value.y; x = value.z; z = value.w; } }
+    public readonly int4 wyxw => new(w, y, x, w);
+    public readonly int4 wyyx => new(w, y, y, x);
+    public readonly int4 wyyy => new(w, y, y, y);
+    public readonly int4 wyyz => new(w, y, y, z);
+    public readonly int4 wyyw => new(w, y, y, w);
+    public int4 wyzx { readonly get => new(w, y, z, x); set { w = value.x; y = value.y; z = value.z; x = value.w; } }
+    public readonly int4 wyzy => new(w, y, z, y);
+    public readonly int4 wyzz => new(w, y, z, z);
+    public readonly int4 wyzw => new(w, y, z, w);
+    public readonly int4 wywx => new(w, y, w, x);
+    public readonly int4 wywy => new(w, y, w, y);
+    public readonly int4 wywz => new(w, y, w, z);
+    public readonly int4 wyww => new(w, y, w, w);
+    public readonly int4 wzxx => new(w, z, x, x);
+    public int4 wzxy { readonly get => new(w, z, x, y); set { w = value.x; z = value.y; x = value.z; y = value.w; } }
+    public readonly int4 wzxz => new(w, z, x, z);
+    public readonly int4 wzxw => new(w, z, x, w);
+    public int4 wzyx { readonly get => new(w, z, y, x); set { w = value.x; z = value.y; y = value.z; x = value.w; } }
+    public readonly int4 wzyy => new(w, z, y, y);
+    public readonly int4 wzyz => new(w, z, y, z);
+    public readonly int4 wzyw => new(w, z, y, w);
+    public readonly int4 wzzx => new(w, z, z, x);
+    public readonly int4 wzzy => new(w, z, z, y);
+    public readonly int4 wzzz => new(w, z, z, z);
+    public readonly int4 wzzw => new(w, z, z, w);
+    public readonly int4 wzwx => new(w, z, w, x);
+    public readonly int4 wzwy => new(w, z, w, y);
+    public readonly int4 wzwz => new(w, z, w, z);
+    public readonly int4 wzww => new(w, z, w, w);
+    public readonly int4 wwxx => new(w, w, x, x);
+    public readonly int4 wwxy => new(w, w, x, y);
+    public readonly int4 wwxz => new(w, w, x, z);
+    public readonly int4 wwxw => new(w, w, x, w);
+    public readonly int4 wwyx => new(w, w, y, x);
+    public readonly int4 wwyy => new(w, w, y, y);
+    public readonly int4 wwyz => new(w, w, y, z);
+    public readonly int4 wwyw => new(w, w, y, w);
+    public readonly int4 wwzx => new(w, w, z, x);
+    public readonly int4 wwzy => new(w, w, z, y);
+    public readonly int4 wwzz => new(w, w, z, z);
+    public readonly int4 wwzw => new(w, w, z, w);
+    public readonly int4 wwwx => new(w, w, w, x);
+    public readonly int4 wwwy => new(w, w, w, y);
+    public readonly int4 wwwz => new(w, w, w, z);
+    public readonly int4 wwww => new(w, w, w, w);
+    public readonly int2 rr => new(x, x);
+    public int2 rg { readonly get => new(x, y); set { x = value.x; y = value.y; } }
+    public int2 rb { readonly get => new(x, z); set { x = value.x; z = value.y; } }
+    public int2 ra { readonly get => new(x, w); set { x = value.x; w = value.y; } }
+    public int2 gr { readonly get => new(y, x); set { y = value.x; x = value.y; } }
+    public readonly int2 gg => new(y, y);
+    public int2 gb { readonly get => new(y, z); set { y = value.x; z = value.y; } }
+    public int2 ga { readonly get => new(y, w); set { y = value.x; w = value.y; } }
+    public int2 br { readonly get => new(z, x); set { z = value.x; x = value.y; } }
+    public int2 bg { readonly get => new(z, y); set { z = value.x; y = value.y; } }
+    public readonly int2 bb => new(z, z);
+    public int2 ba { readonly get => new(z, w); set { z = value.x; w = value.y; } }
+    public int2 ar { readonly get => new(w, x); set { w = value.x; x = value.y; } }
+    public int2 ag { readonly get => new(w, y); set { w = value.x; y = value.y; } }
+    public int2 ab { readonly get => new(w, z); set { w = value.x; z = value.y; } }
+    public readonly int2 aa => new(w, w);
+    public readonly int3 rrr => new(x, x, x);
+    public readonly int3 rrg => new(x, x, y);
+    public readonly int3 rrb => new(x, x, z);
+    public readonly int3 rra => new(x, x, w);
+    public readonly int3 rgr => new(x, y, x);
+    public readonly int3 rgg => new(x, y, y);
+    public int3 rgb { readonly get => new(x, y, z); set { x = value.x; y = value.y; z = value.z; } }
+    public int3 rga { readonly get => new(x, y, w); set { x = value.x; y = value.y; w = value.z; } }
+    public readonly int3 rbr => new(x, z, x);
+    public int3 rbg { readonly get => new(x, z, y); set { x = value.x; z = value.y; y = value.z; } }
+    public readonly int3 rbb => new(x, z, z);
+    public int3 rba { readonly get => new(x, z, w); set { x = value.x; z = value.y; w = value.z; } }
+    public readonly int3 rar => new(x, w, x);
+    public int3 rag { readonly get => new(x, w, y); set { x = value.x; w = value.y; y = value.z; } }
+    public int3 rab { readonly get => new(x, w, z); set { x = value.x; w = value.y; z = value.z; } }
+    public readonly int3 raa => new(x, w, w);
+    public readonly int3 grr => new(y, x, x);
+    public readonly int3 grg => new(y, x, y);
+    public int3 grb { readonly get => new(y, x, z); set { y = value.x; x = value.y; z = value.z; } }
+    public int3 gra { readonly get => new(y, x, w); set { y = value.x; x = value.y; w = value.z; } }
+    public readonly int3 ggr => new(y, y, x);
+    public readonly int3 ggg => new(y, y, y);
+    public readonly int3 ggb => new(y, y, z);
+    public readonly int3 gga => new(y, y, w);
+    public int3 gbr { readonly get => new(y, z, x); set { y = value.x; z = value.y; x = value.z; } }
+    public readonly int3 gbg => new(y, z, y);
+    public readonly int3 gbb => new(y, z, z);
+    public int3 gba { readonly get => new(y, z, w); set { y = value.x; z = value.y; w = value.z; } }
+    public int3 gar { readonly get => new(y, w, x); set { y = value.x; w = value.y; x = value.z; } }
+    public readonly int3 gag => new(y, w, y);
+    public int3 gab { readonly get => new(y, w, z); set { y = value.x; w = value.y; z = value.z; } }
+    public readonly int3 gaa => new(y, w, w);
+    public readonly int3 brr => new(z, x, x);
+    public int3 brg { readonly get => new(z, x, y); set { z = value.x; x = value.y; y = value.z; } }
+    public readonly int3 brb => new(z, x, z);
+    public int3 bra { readonly get => new(z, x, w); set { z = value.x; x = value.y; w = value.z; } }
+    public int3 bgr { readonly get => new(z, y, x); set { z = value.x; y = value.y; x = value.z; } }
+    public readonly int3 bgg => new(z, y, y);
+    public readonly int3 bgb => new(z, y, z);
+    public int3 bga { readonly get => new(z, y, w); set { z = value.x; y = value.y; w = value.z; } }
+    public readonly int3 bbr => new(z, z, x);
+    public readonly int3 bbg => new(z, z, y);
+    public readonly int3 bbb => new(z, z, z);
+    public readonly int3 bba => new(z, z, w);
+    public int3 bar { readonly get => new(z, w, x); set { z = value.x; w = value.y; x = value.z; } }
+    public int3 bag { readonly get => new(z, w, y); set { z = value.x; w = value.y; y = value.z; } }
+    public readonly int3 bab => new(z, w, z);
+    public readonly int3 baa => new(z, w, w);
+    public readonly int3 arr => new(w, x, x);
+    public int3 arg { readonly get => new(w, x, y); set { w = value.x; x = value.y; y = value.z; } }
+    public int3 arb { readonly get => new(w, x, z); set { w = value.x; x = value.y; z = value.z; } }
+    public readonly int3 ara => new(w, x, w);
+    public int3 agr { readonly get => new(w, y, x); set { w = value.x; y = value.y; x = value.z; } }
+    public readonly int3 agg => new(w, y, y);
+    public int3 agb { readonly get => new(w, y, z); set { w = value.x; y = value.y; z = value.z; } }
+    public readonly int3 aga => new(w, y, w);
+    public int3 abr { readonly get => new(w, z, x); set { w = value.x; z = value.y; x = value.z; } }
+    public int3 abg { readonly get => new(w, z, y); set { w = value.x; z = value.y; y = value.z; } }
+    public readonly int3 abb => new(w, z, z);
+    public readonly int3 aba => new(w, z, w);
+    public readonly int3 aar => new(w, w, x);
+    public readonly int3 aag => new(w, w, y);
+    public readonly int3 aab => new(w, w, z);
+    public readonly int3 aaa => new(w, w, w);
+    public readonly int4 rrrr => new(x, x, x, x);
+    public readonly int4 rrrg => new(x, x, x, y);
+    public readonly int4 rrrb => new(x, x, x, z);
+    public readonly int4 rrra => new(x, x, x, w);
+    public readonly int4 rrgr => new(x, x, y, x);
+    public readonly int4 rrgg => new(x, x, y, y);
+    public readonly int4 rrgb => new(x, x, y, z);
+    public readonly int4 rrga => new(x, x, y, w);
+    public readonly int4 rrbr => new(x, x, z, x);
+    public readonly int4 rrbg => new(x, x, z, y);
+    public readonly int4 rrbb => new(x, x, z, z);
+    public readonly int4 rrba => new(x, x, z, w);
+    public readonly int4 rrar => new(x, x, w, x);
+    public readonly int4 rrag => new(x, x, w, y);
+    public readonly int4 rrab => new(x, x, w, z);
+    public readonly int4 rraa => new(x, x, w, w);
+    public readonly int4 rgrr => new(x, y, x, x);
+    public readonly int4 rgrg => new(x, y, x, y);
+    public readonly int4 rgrb => new(x, y, x, z);
+    public readonly int4 rgra => new(x, y, x, w);
+    public readonly int4 rggr => new(x, y, y, x);
+    public readonly int4 rggg => new(x, y, y, y);
+    public readonly int4 rggb => new(x, y, y, z);
+    public readonly int4 rgga => new(x, y, y, w);
+    public readonly int4 rgbr => new(x, y, z, x);
+    public readonly int4 rgbg => new(x, y, z, y);
+    public readonly int4 rgbb => new(x, y, z, z);
+    public int4 rgba { readonly get => new(x, y, z, w); set { x = value.x; y = value.y; z = value.z; w = value.w; } }
+    public readonly int4 rgar => new(x, y, w, x);
+    public readonly int4 rgag => new(x, y, w, y);
+    public int4 rgab { readonly get => new(x, y, w, z); set { x = value.x; y = value.y; w = value.z; z = value.w; } }
+    public readonly int4 rgaa => new(x, y, w, w);
+    public readonly int4 rbrr => new(x, z, x, x);
+    public readonly int4 rbrg => new(x, z, x, y);
+    public readonly int4 rbrb => new(x, z, x, z);
+    public readonly int4 rbra => new(x, z, x, w);
+    public readonly int4 rbgr => new(x, z, y, x);
+    public readonly int4 rbgg => new(x, z, y, y);
+    public readonly int4 rbgb => new(x, z, y, z);
+    public int4 rbga { readonly get => new(x, z, y, w); set { x = value.x; z = value.y; y = value.z; w = value.w; } }
+    public readonly int4 rbbr => new(x, z, z, x);
+    public readonly int4 rbbg => new(x, z, z, y);
+    public readonly int4 rbbb => new(x, z, z, z);
+    public readonly int4 rbba => new(x, z, z, w);
+    public readonly int4 rbar => new(x, z, w, x);
+    public int4 rbag { readonly get => new(x, z, w, y); set { x = value.x; z = value.y; w = value.z; y = value.w; } }
+    public readonly int4 rbab => new(x, z, w, z);
+    public readonly int4 rbaa => new(x, z, w, w);
+    public readonly int4 rarr => new(x, w, x, x);
+    public readonly int4 rarg => new(x, w, x, y);
+    public readonly int4 rarb => new(x, w, x, z);
+    public readonly int4 rara => new(x, w, x, w);
+    public readonly int4 ragr => new(x, w, y, x);
+    public readonly int4 ragg => new(x, w, y, y);
+    public int4 ragb { readonly get => new(x, w, y, z); set { x = value.x; w = value.y; y = value.z; z = value.w; } }
+    public readonly int4 raga => new(x, w, y, w);
+    public readonly int4 rabr => new(x, w, z, x);
+    public int4 rabg { readonly get => new(x, w, z, y); set { x = value.x; w = value.y; z = value.z; y = value.w; } }
+    public readonly int4 rabb => new(x, w, z, z);
+    public readonly int4 raba => new(x, w, z, w);
+    public readonly int4 raar => new(x, w, w, x);
+    public readonly int4 raag => new(x, w, w, y);
+    public readonly int4 raab => new(x, w, w, z);
+    public readonly int4 raaa => new(x, w, w, w);
+    public readonly int4 grrr => new(y, x, x, x);
+    public readonly int4 grrg => new(y, x, x, y);
+    public readonly int4 grrb => new(y, x, x, z);
+    public readonly int4 grra => new(y, x, x, w);
+    public readonly int4 grgr => new(y, x, y, x);
+    public readonly int4 grgg => new(y, x, y, y);
+    public readonly int4 grgb => new(y, x, y, z);
+    public readonly int4 grga => new(y, x, y, w);
+    public readonly int4 grbr => new(y, x, z, x);
+    public readonly int4 grbg => new(y, x, z, y);
+    public readonly int4 grbb => new(y, x, z, z);
+    public int4 grba { readonly get => new(y, x, z, w); set { y = value.x; x = value.y; z = value.z; w = value.w; } }
+    public readonly int4 grar => new(y, x, w, x);
+    public readonly int4 grag => new(y, x, w, y);
+    public int4 grab { readonly get => new(y, x, w, z); set { y = value.x; x = value.y; w = value.z; z = value.w; } }
+    public readonly int4 graa => new(y, x, w, w);
+    public readonly int4 ggrr => new(y, y, x, x);
+    public readonly int4 ggrg => new(y, y, x, y);
+    public readonly int4 ggrb => new(y, y, x, z);
+    public readonly int4 ggra => new(y, y, x, w);
+    public readonly int4 gggr => new(y, y, y, x);
+    public readonly int4 gggg => new(y, y, y, y);
+    public readonly int4 gggb => new(y, y, y, z);
+    public readonly int4 ggga => new(y, y, y, w);
+    public readonly int4 ggbr => new(y, y, z, x);
+    public readonly int4 ggbg => new(y, y, z, y);
+    public readonly int4 ggbb => new(y, y, z, z);
+    public readonly int4 ggba => new(y, y, z, w);
+    public readonly int4 ggar => new(y, y, w, x);
+    public readonly int4 ggag => new(y, y, w, y);
+    public readonly int4 ggab => new(y, y, w, z);
+    public readonly int4 ggaa => new(y, y, w, w);
+    public readonly int4 gbrr => new(y, z, x, x);
+    public readonly int4 gbrg => new(y, z, x, y);
+    public readonly int4 gbrb => new(y, z, x, z);
+    public int4 gbra { readonly get => new(y, z, x, w); set { y = value.x; z = value.y; x = value.z; w = value.w; } }
+    public readonly int4 gbgr => new(y, z, y, x);
+    public readonly int4 gbgg => new(y, z, y, y);
+    public readonly int4 gbgb => new(y, z, y, z);
+    public readonly int4 gbga => new(y, z, y, w);
+    public readonly int4 gbbr => new(y, z, z, x);
+    public readonly int4 gbbg => new(y, z, z, y);
+    public readonly int4 gbbb => new(y, z, z, z);
+    public readonly int4 gbba => new(y, z, z, w);
+    public int4 gbar { readonly get => new(y, z, w, x); set { y = value.x; z = value.y; w = value.z; x = value.w; } }
+    public readonly int4 gbag => new(y, z, w, y);
+    public readonly int4 gbab => new(y, z, w, z);
+    public readonly int4 gbaa => new(y, z, w, w);
+    public readonly int4 garr => new(y, w, x, x);
+    public readonly int4 garg => new(y, w, x, y);
+    public int4 garb { readonly get => new(y, w, x, z); set { y = value.x; w = value.y; x = value.z; z = value.w; } }
+    public readonly int4 gara => new(y, w, x, w);
+    public readonly int4 gagr => new(y, w, y, x);
+    public readonly int4 gagg => new(y, w, y, y);
+    public readonly int4 gagb => new(y, w, y, z);
+    public readonly int4 gaga => new(y, w, y, w);
+    public int4 gabr { readonly get => new(y, w, z, x); set { y = value.x; w = value.y; z = value.z; x = value.w; } }
+    public readonly int4 gabg => new(y, w, z, y);
+    public readonly int4 gabb => new(y, w, z, z);
+    public readonly int4 gaba => new(y, w, z, w);
+    public readonly int4 gaar => new(y, w, w, x);
+    public readonly int4 gaag => new(y, w, w, y);
+    public readonly int4 gaab => new(y, w, w, z);
+    public readonly int4 gaaa => new(y, w, w, w);
+    public readonly int4 brrr => new(z, x, x, x);
+    public readonly int4 brrg => new(z, x, x, y);
+    public readonly int4 brrb => new(z, x, x, z);
+    public readonly int4 brra => new(z, x, x, w);
+    public readonly int4 brgr => new(z, x, y, x);
+    public readonly int4 brgg => new(z, x, y, y);
+    public readonly int4 brgb => new(z, x, y, z);
+    public int4 brga { readonly get => new(z, x, y, w); set { z = value.x; x = value.y; y = value.z; w = value.w; } }
+    public readonly int4 brbr => new(z, x, z, x);
+    public readonly int4 brbg => new(z, x, z, y);
+    public readonly int4 brbb => new(z, x, z, z);
+    public readonly int4 brba => new(z, x, z, w);
+    public readonly int4 brar => new(z, x, w, x);
+    public int4 brag { readonly get => new(z, x, w, y); set { z = value.x; x = value.y; w = value.z; y = value.w; } }
+    public readonly int4 brab => new(z, x, w, z);
+    public readonly int4 braa => new(z, x, w, w);
+    public readonly int4 bgrr => new(z, y, x, x);
+    public readonly int4 bgrg => new(z, y, x, y);
+    public readonly int4 bgrb => new(z, y, x, z);
+    public int4 bgra { readonly get => new(z, y, x, w); set { z = value.x; y = value.y; x = value.z; w = value.w; } }
+    public readonly int4 bggr => new(z, y, y, x);
+    public readonly int4 bggg => new(z, y, y, y);
+    public readonly int4 bggb => new(z, y, y, z);
+    public readonly int4 bgga => new(z, y, y, w);
+    public readonly int4 bgbr => new(z, y, z, x);
+    public readonly int4 bgbg => new(z, y, z, y);
+    public readonly int4 bgbb => new(z, y, z, z);
+    public readonly int4 bgba => new(z, y, z, w);
+    public int4 bgar { readonly get => new(z, y, w, x); set { z = value.x; y = value.y; w = value.z; x = value.w; } }
+    public readonly int4 bgag => new(z, y, w, y);
+    public readonly int4 bgab => new(z, y, w, z);
+    public readonly int4 bgaa => new(z, y, w, w);
+    public readonly int4 bbrr => new(z, z, x, x);
+    public readonly int4 bbrg => new(z, z, x, y);
+    public readonly int4 bbrb => new(z, z, x, z);
+    public readonly int4 bbra => new(z, z, x, w);
+    public readonly int4 bbgr => new(z, z, y, x);
+    public readonly int4 bbgg => new(z, z, y, y);
+    public readonly int4 bbgb => new(z, z, y, z);
+    public readonly int4 bbga => new(z, z, y, w);
+    public readonly int4 bbbr => new(z, z, z, x);
+    public readonly int4 bbbg => new(z, z, z, y);
+    public readonly int4 bbbb => new(z, z, z, z);
+    public readonly int4 bbba => new(z, z, z, w);
+    public readonly int4 bbar => new(z, z, w, x);
+    public readonly int4 bbag => new(z, z, w, y);
+    public readonly int4 bbab => new(z, z, w, z);
+    public readonly int4 bbaa => new(z, z, w, w);
+    public readonly int4 barr => new(z, w, x, x);
+    public int4 barg { readonly get => new(z, w, x, y); set { z = value.x; w = value.y; x = value.z; y = value.w; } }
+    public readonly int4 barb => new(z, w, x, z);
+    public readonly int4 bara => new(z, w, x, w);
+    public int4 bagr { readonly get => new(z, w, y, x); set { z = value.x; w = value.y; y = value.z; x = value.w; } }
+    public readonly int4 bagg => new(z, w, y, y);
+    public readonly int4 bagb => new(z, w, y, z);
+    public readonly int4 baga => new(z, w, y, w);
+    public readonly int4 babr => new(z, w, z, x);
+    public readonly int4 babg => new(z, w, z, y);
+    public readonly int4 babb => new(z, w, z, z);
+    public readonly int4 baba => new(z, w, z, w);
+    public readonly int4 baar => new(z, w, w, x);
+    public readonly int4 baag => new(z, w, w, y);
+    public readonly int4 baab => new(z, w, w, z);
+    public readonly int4 baaa => new(z, w, w, w);
+    public readonly int4 arrr => new(w, x, x, x);
+    public readonly int4 arrg => new(w, x, x, y);
+    public readonly int4 arrb => new(w, x, x, z);
+    public readonly int4 arra => new(w, x, x, w);
+    public readonly int4 argr => new(w, x, y, x);
+    public readonly int4 argg => new(w, x, y, y);
+    public int4 argb { readonly get => new(w, x, y, z); set { w = value.x; x = value.y; y = value.z; z = value.w; } }
+    public readonly int4 arga => new(w, x, y, w);
+    public readonly int4 arbr => new(w, x, z, x);
+    public int4 arbg { readonly get => new(w, x, z, y); set { w = value.x; x = value.y; z = value.z; y = value.w; } }
+    public readonly int4 arbb => new(w, x, z, z);
+    public readonly int4 arba => new(w, x, z, w);
+    public readonly int4 arar => new(w, x, w, x);
+    public readonly int4 arag => new(w, x, w, y);
+    public readonly int4 arab => new(w, x, w, z);
+    public readonly int4 araa => new(w, x, w, w);
+    public readonly int4 agrr => new(w, y, x, x);
+    public readonly int4 agrg => new(w, y, x, y);
+    public int4 agrb { readonly get => new(w, y, x, z); set { w = value.x; y = value.y; x = value.z; z = value.w; } }
+    public readonly int4 agra => new(w, y, x, w);
+    public readonly int4 aggr => new(w, y, y, x);
+    public readonly int4 aggg => new(w, y, y, y);
+    public readonly int4 aggb => new(w, y, y, z);
+    public readonly int4 agga => new(w, y, y, w);
+    public int4 agbr { readonly get => new(w, y, z, x); set { w = value.x; y = value.y; z = value.z; x = value.w; } }
+    public readonly int4 agbg => new(w, y, z, y);
+    public readonly int4 agbb => new(w, y, z, z);
+    public readonly int4 agba => new(w, y, z, w);
+    public readonly int4 agar => new(w, y, w, x);
+    public readonly int4 agag => new(w, y, w, y);
+    public readonly int4 agab => new(w, y, w, z);
+    public readonly int4 agaa => new(w, y, w, w);
+    public readonly int4 abrr => new(w, z, x, x);
+    public int4 abrg { readonly get => new(w, z, x, y); set { w = value.x; z = value.y; x = value.z; y = value.w; } }
+    public readonly int4 abrb => new(w, z, x, z);
+    public readonly int4 abra => new(w, z, x, w);
+    public int4 abgr { readonly get => new(w, z, y, x); set { w = value.x; z = value.y; y = value.z; x = value.w; } }
+    public readonly int4 abgg => new(w, z, y, y);
+    public readonly int4 abgb => new(w, z, y, z);
+    public readonly int4 abga => new(w, z, y, w);
+    public readonly int4 abbr => new(w, z, z, x);
+    public readonly int4 abbg => new(w, z, z, y);
+    public readonly int4 abbb => new(w, z, z, z);
+    public readonly int4 abba => new(w, z, z, w);
+    public readonly int4 abar => new(w, z, w, x);
+    public readonly int4 abag => new(w, z, w, y);
+    public readonly int4 abab => new(w, z, w, z);
+    public readonly int4 abaa => new(w, z, w, w);
+    public readonly int4 aarr => new(w, w, x, x);
+    public readonly int4 aarg => new(w, w, x, y);
+    public readonly int4 aarb => new(w, w, x, z);
+    public readonly int4 aara => new(w, w, x, w);
+    public readonly int4 aagr => new(w, w, y, x);
+    public readonly int4 aagg => new(w, w, y, y);
+    public readonly int4 aagb => new(w, w, y, z);
+    public readonly int4 aaga => new(w, w, y, w);
+    public readonly int4 aabr => new(w, w, z, x);
+    public readonly int4 aabg => new(w, w, z, y);
+    public readonly int4 aabb => new(w, w, z, z);
+    public readonly int4 aaba => new(w, w, z, w);
+    public readonly int4 aaar => new(w, w, w, x);
+    public readonly int4 aaag => new(w, w, w, y);
+    public readonly int4 aaab => new(w, w, w, z);
+    public readonly int4 aaaa => new(w, w, w, w);
+}
+
+public partial struct bool2
+{
+    public bool2(bool2 xy) : this(xy.x, xy.y) { }
+    public bool r { readonly get => x; set => x = value; }
+    public bool g { readonly get => y; set => y = value; }
+    public readonly bool2 xx => new(x, x);
+    public bool2 xy { readonly get => new(x, y); set { x = value.x; y = value.y; } }
+    public bool2 yx { readonly get => new(y, x); set { y = value.x; x = value.y; } }
+    public readonly bool2 yy => new(y, y);
+    public readonly bool3 xxx => new(x, x, x);
+    public readonly bool3 xxy => new(x, x, y);
+    public readonly bool3 xyx => new(x, y, x);
+    public readonly bool3 xyy => new(x, y, y);
+    public readonly bool3 yxx => new(y, x, x);
+    public readonly bool3 yxy => new(y, x, y);
+    public readonly bool3 yyx => new(y, y, x);
+    public readonly bool3 yyy => new(y, y, y);
+    public readonly bool4 xxxx => new(x, x, x, x);
+    public readonly bool4 xxxy => new(x, x, x, y);
+    public readonly bool4 xxyx => new(x, x, y, x);
+    public readonly bool4 xxyy => new(x, x, y, y);
+    public readonly bool4 xyxx => new(x, y, x, x);
+    public readonly bool4 xyxy => new(x, y, x, y);
+    public readonly bool4 xyyx => new(x, y, y, x);
+    public readonly bool4 xyyy => new(x, y, y, y);
+    public readonly bool4 yxxx => new(y, x, x, x);
+    public readonly bool4 yxxy => new(y, x, x, y);
+    public readonly bool4 yxyx => new(y, x, y, x);
+    public readonly bool4 yxyy => new(y, x, y, y);
+    public readonly bool4 yyxx => new(y, y, x, x);
+    public readonly bool4 yyxy => new(y, y, x, y);
+    public readonly bool4 yyyx => new(y, y, y, x);
+    public readonly bool4 yyyy => new(y, y, y, y);
+    public readonly bool2 rr => new(x, x);
+    public bool2 rg { readonly get => new(x, y); set { x = value.x; y = value.y; } }
+    public bool2 gr { readonly get => new(y, x); set { y = value.x; x = value.y; } }
+    public readonly bool2 gg => new(y, y);
+    public readonly bool3 rrr => new(x, x, x);
+    public readonly bool3 rrg => new(x, x, y);
+    public readonly bool3 rgr => new(x, y, x);
+    public readonly bool3 rgg => new(x, y, y);
+    public readonly bool3 grr => new(y, x, x);
+    public readonly bool3 grg => new(y, x, y);
+    public readonly bool3 ggr => new(y, y, x);
+    public readonly bool3 ggg => new(y, y, y);
+    public readonly bool4 rrrr => new(x, x, x, x);
+    public readonly bool4 rrrg => new(x, x, x, y);
+    public readonly bool4 rrgr => new(x, x, y, x);
+    public readonly bool4 rrgg => new(x, x, y, y);
+    public readonly bool4 rgrr => new(x, y, x, x);
+    public readonly bool4 rgrg => new(x, y, x, y);
+    public readonly bool4 rggr => new(x, y, y, x);
+    public readonly bool4 rggg => new(x, y, y, y);
+    public readonly bool4 grrr => new(y, x, x, x);
+    public readonly bool4 grrg => new(y, x, x, y);
+    public readonly bool4 grgr => new(y, x, y, x);
+    public readonly bool4 grgg => new(y, x, y, y);
+    public readonly bool4 ggrr => new(y, y, x, x);
+    public readonly bool4 ggrg => new(y, y, x, y);
+    public readonly bool4 gggr => new(y, y, y, x);
+    public readonly bool4 gggg => new(y, y, y, y);
+}
+
+public partial struct bool3
+{
+    public bool3(bool x, bool2 yz) : this(x, yz.x, yz.y) { }
+    public bool3(bool2 xy, bool z) : this(xy.x, xy.y, z) { }
+    public bool3(bool3 xyz) : this(xyz.x, xyz.y, xyz.z) { }
+    public bool r { readonly get => x; set => x = value; }
+    public bool g { readonly get => y; set => y = value; }
+    public bool b { readonly get => z; set => z = value; }
+    public readonly bool2 xx => new(x, x);
+    public bool2 xy { readonly get => new(x, y); set { x = value.x; y = value.y; } }
+    public bool2 xz { readonly get => new(x, z); set { x = value.x; z = value.y; } }
+    public bool2 yx { readonly get => new(y, x); set { y = value.x; x = value.y; } }
+    public readonly bool2 yy => new(y, y);
+    public bool2 yz { readonly get => new(y, z); set { y = value.x; z = value.y; } }
+    public bool2 zx { readonly get => new(z, x); set { z = value.x; x = value.y; } }
+    public bool2 zy { readonly get => new(z, y); set { z = value.x; y = value.y; } }
+    public readonly bool2 zz => new(z, z);
+    public readonly bool3 xxx => new(x, x, x);
+    public readonly bool3 xxy => new(x, x, y);
+    public readonly bool3 xxz => new(x, x, z);
+    public readonly bool3 xyx => new(x, y, x);
+    public readonly bool3 xyy => new(x, y, y);
+    public bool3 xyz { readonly get => new(x, y, z); set { x = value.x; y = value.y; z = value.z; } }
+    public readonly bool3 xzx => new(x, z, x);
+    public bool3 xzy { readonly get => new(x, z, y); set { x = value.x; z = value.y; y = value.z; } }
+    public readonly bool3 xzz => new(x, z, z);
+    public readonly bool3 yxx => new(y, x, x);
+    public readonly bool3 yxy => new(y, x, y);
+    public bool3 yxz { readonly get => new(y, x, z); set { y = value.x; x = value.y; z = value.z; } }
+    public readonly bool3 yyx => new(y, y, x);
+    public readonly bool3 yyy => new(y, y, y);
+    public readonly bool3 yyz => new(y, y, z);
+    public bool3 yzx { readonly get => new(y, z, x); set { y = value.x; z = value.y; x = value.z; } }
+    public readonly bool3 yzy => new(y, z, y);
+    public readonly bool3 yzz => new(y, z, z);
+    public readonly bool3 zxx => new(z, x, x);
+    public bool3 zxy { readonly get => new(z, x, y); set { z = value.x; x = value.y; y = value.z; } }
+    public readonly bool3 zxz => new(z, x, z);
+    public bool3 zyx { readonly get => new(z, y, x); set { z = value.x; y = value.y; x = value.z; } }
+    public readonly bool3 zyy => new(z, y, y);
+    public readonly bool3 zyz => new(z, y, z);
+    public readonly bool3 zzx => new(z, z, x);
+    public readonly bool3 zzy => new(z, z, y);
+    public readonly bool3 zzz => new(z, z, z);
+    public readonly bool4 xxxx => new(x, x, x, x);
+    public readonly bool4 xxxy => new(x, x, x, y);
+    public readonly bool4 xxxz => new(x, x, x, z);
+    public readonly bool4 xxyx => new(x, x, y, x);
+    public readonly bool4 xxyy => new(x, x, y, y);
+    public readonly bool4 xxyz => new(x, x, y, z);
+    public readonly bool4 xxzx => new(x, x, z, x);
+    public readonly bool4 xxzy => new(x, x, z, y);
+    public readonly bool4 xxzz => new(x, x, z, z);
+    public readonly bool4 xyxx => new(x, y, x, x);
+    public readonly bool4 xyxy => new(x, y, x, y);
+    public readonly bool4 xyxz => new(x, y, x, z);
+    public readonly bool4 xyyx => new(x, y, y, x);
+    public readonly bool4 xyyy => new(x, y, y, y);
+    public readonly bool4 xyyz => new(x, y, y, z);
+    public readonly bool4 xyzx => new(x, y, z, x);
+    public readonly bool4 xyzy => new(x, y, z, y);
+    public readonly bool4 xyzz => new(x, y, z, z);
+    public readonly bool4 xzxx => new(x, z, x, x);
+    public readonly bool4 xzxy => new(x, z, x, y);
+    public readonly bool4 xzxz => new(x, z, x, z);
+    public readonly bool4 xzyx => new(x, z, y, x);
+    public readonly bool4 xzyy => new(x, z, y, y);
+    public readonly bool4 xzyz => new(x, z, y, z);
+    public readonly bool4 xzzx => new(x, z, z, x);
+    public readonly bool4 xzzy => new(x, z, z, y);
+    public readonly bool4 xzzz => new(x, z, z, z);
+    public readonly bool4 yxxx => new(y, x, x, x);
+    public readonly bool4 yxxy => new(y, x, x, y);
+    public readonly bool4 yxxz => new(y, x, x, z);
+    public readonly bool4 yxyx => new(y, x, y, x);
+    public readonly bool4 yxyy => new(y, x, y, y);
+    public readonly bool4 yxyz => new(y, x, y, z);
+    public readonly bool4 yxzx => new(y, x, z, x);
+    public readonly bool4 yxzy => new(y, x, z, y);
+    public readonly bool4 yxzz => new(y, x, z, z);
+    public readonly bool4 yyxx => new(y, y, x, x);
+    public readonly bool4 yyxy => new(y, y, x, y);
+    public readonly bool4 yyxz => new(y, y, x, z);
+    public readonly bool4 yyyx => new(y, y, y, x);
+    public readonly bool4 yyyy => new(y, y, y, y);
+    public readonly bool4 yyyz => new(y, y, y, z);
+    public readonly bool4 yyzx => new(y, y, z, x);
+    public readonly bool4 yyzy => new(y, y, z, y);
+    public readonly bool4 yyzz => new(y, y, z, z);
+    public readonly bool4 yzxx => new(y, z, x, x);
+    public readonly bool4 yzxy => new(y, z, x, y);
+    public readonly bool4 yzxz => new(y, z, x, z);
+    public readonly bool4 yzyx => new(y, z, y, x);
+    public readonly bool4 yzyy => new(y, z, y, y);
+    public readonly bool4 yzyz => new(y, z, y, z);
+    public readonly bool4 yzzx => new(y, z, z, x);
+    public readonly bool4 yzzy => new(y, z, z, y);
+    public readonly bool4 yzzz => new(y, z, z, z);
+    public readonly bool4 zxxx => new(z, x, x, x);
+    public readonly bool4 zxxy => new(z, x, x, y);
+    public readonly bool4 zxxz => new(z, x, x, z);
+    public readonly bool4 zxyx => new(z, x, y, x);
+    public readonly bool4 zxyy => new(z, x, y, y);
+    public readonly bool4 zxyz => new(z, x, y, z);
+    public readonly bool4 zxzx => new(z, x, z, x);
+    public readonly bool4 zxzy => new(z, x, z, y);
+    public readonly bool4 zxzz => new(z, x, z, z);
+    public readonly bool4 zyxx => new(z, y, x, x);
+    public readonly bool4 zyxy => new(z, y, x, y);
+    public readonly bool4 zyxz => new(z, y, x, z);
+    public readonly bool4 zyyx => new(z, y, y, x);
+    public readonly bool4 zyyy => new(z, y, y, y);
+    public readonly bool4 zyyz => new(z, y, y, z);
+    public readonly bool4 zyzx => new(z, y, z, x);
+    public readonly bool4 zyzy => new(z, y, z, y);
+    public readonly bool4 zyzz => new(z, y, z, z);
+    public readonly bool4 zzxx => new(z, z, x, x);
+    public readonly bool4 zzxy => new(z, z, x, y);
+    public readonly bool4 zzxz => new(z, z, x, z);
+    public readonly bool4 zzyx => new(z, z, y, x);
+    public readonly bool4 zzyy => new(z, z, y, y);
+    public readonly bool4 zzyz => new(z, z, y, z);
+    public readonly bool4 zzzx => new(z, z, z, x);
+    public readonly bool4 zzzy => new(z, z, z, y);
+    public readonly bool4 zzzz => new(z, z, z, z);
+    public readonly bool2 rr => new(x, x);
+    public bool2 rg { readonly get => new(x, y); set { x = value.x; y = value.y; } }
+    public bool2 rb { readonly get => new(x, z); set { x = value.x; z = value.y; } }
+    public bool2 gr { readonly get => new(y, x); set { y = value.x; x = value.y; } }
+    public readonly bool2 gg => new(y, y);
+    public bool2 gb { readonly get => new(y, z); set { y = value.x; z = value.y; } }
+    public bool2 br { readonly get => new(z, x); set { z = value.x; x = value.y; } }
+    public bool2 bg { readonly get => new(z, y); set { z = value.x; y = value.y; } }
+    public readonly bool2 bb => new(z, z);
+    public readonly bool3 rrr => new(x, x, x);
+    public readonly bool3 rrg => new(x, x, y);
+    public readonly bool3 rrb => new(x, x, z);
+    public readonly bool3 rgr => new(x, y, x);
+    public readonly bool3 rgg => new(x, y, y);
+    public bool3 rgb { readonly get => new(x, y, z); set { x = value.x; y = value.y; z = value.z; } }
+    public readonly bool3 rbr => new(x, z, x);
+    public bool3 rbg { readonly get => new(x, z, y); set { x = value.x; z = value.y; y = value.z; } }
+    public readonly bool3 rbb => new(x, z, z);
+    public readonly bool3 grr => new(y, x, x);
+    public readonly bool3 grg => new(y, x, y);
+    public bool3 grb { readonly get => new(y, x, z); set { y = value.x; x = value.y; z = value.z; } }
+    public readonly bool3 ggr => new(y, y, x);
+    public readonly bool3 ggg => new(y, y, y);
+    public readonly bool3 ggb => new(y, y, z);
+    public bool3 gbr { readonly get => new(y, z, x); set { y = value.x; z = value.y; x = value.z; } }
+    public readonly bool3 gbg => new(y, z, y);
+    public readonly bool3 gbb => new(y, z, z);
+    public readonly bool3 brr => new(z, x, x);
+    public bool3 brg { readonly get => new(z, x, y); set { z = value.x; x = value.y; y = value.z; } }
+    public readonly bool3 brb => new(z, x, z);
+    public bool3 bgr { readonly get => new(z, y, x); set { z = value.x; y = value.y; x = value.z; } }
+    public readonly bool3 bgg => new(z, y, y);
+    public readonly bool3 bgb => new(z, y, z);
+    public readonly bool3 bbr => new(z, z, x);
+    public readonly bool3 bbg => new(z, z, y);
+    public readonly bool3 bbb => new(z, z, z);
+    public readonly bool4 rrrr => new(x, x, x, x);
+    public readonly bool4 rrrg => new(x, x, x, y);
+    public readonly bool4 rrrb => new(x, x, x, z);
+    public readonly bool4 rrgr => new(x, x, y, x);
+    public readonly bool4 rrgg => new(x, x, y, y);
+    public readonly bool4 rrgb => new(x, x, y, z);
+    public readonly bool4 rrbr => new(x, x, z, x);
+    public readonly bool4 rrbg => new(x, x, z, y);
+    public readonly bool4 rrbb => new(x, x, z, z);
+    public readonly bool4 rgrr => new(x, y, x, x);
+    public readonly bool4 rgrg => new(x, y, x, y);
+    public readonly bool4 rgrb => new(x, y, x, z);
+    public readonly bool4 rggr => new(x, y, y, x);
+    public readonly bool4 rggg => new(x, y, y, y);
+    public readonly bool4 rggb => new(x, y, y, z);
+    public readonly bool4 rgbr => new(x, y, z, x);
+    public readonly bool4 rgbg => new(x, y, z, y);
+    public readonly bool4 rgbb => new(x, y, z, z);
+    public readonly bool4 rbrr => new(x, z, x, x);
+    public readonly bool4 rbrg => new(x, z, x, y);
+    public readonly bool4 rbrb => new(x, z, x, z);
+    public readonly bool4 rbgr => new(x, z, y, x);
+    public readonly bool4 rbgg => new(x, z, y, y);
+    public readonly bool4 rbgb => new(x, z, y, z);
+    public readonly bool4 rbbr => new(x, z, z, x);
+    public readonly bool4 rbbg => new(x, z, z, y);
+    public readonly bool4 rbbb => new(x, z, z, z);
+    public readonly bool4 grrr => new(y, x, x, x);
+    public readonly bool4 grrg => new(y, x, x, y);
+    public readonly bool4 grrb => new(y, x, x, z);
+    public readonly bool4 grgr => new(y, x, y, x);
+    public readonly bool4 grgg => new(y, x, y, y);
+    public readonly bool4 grgb => new(y, x, y, z);
+    public readonly bool4 grbr => new(y, x, z, x);
+    public readonly bool4 grbg => new(y, x, z, y);
+    public readonly bool4 grbb => new(y, x, z, z);
+    public readonly bool4 ggrr => new(y, y, x, x);
+    public readonly bool4 ggrg => new(y, y, x, y);
+    public readonly bool4 ggrb => new(y, y, x, z);
+    public readonly bool4 gggr => new(y, y, y, x);
+    public readonly bool4 gggg => new(y, y, y, y);
+    public readonly bool4 gggb => new(y, y, y, z);
+    public readonly bool4 ggbr => new(y, y, z, x);
+    public readonly bool4 ggbg => new(y, y, z, y);
+    public readonly bool4 ggbb => new(y, y, z, z);
+    public readonly bool4 gbrr => new(y, z, x, x);
+    public readonly bool4 gbrg => new(y, z, x, y);
+    public readonly bool4 gbrb => new(y, z, x, z);
+    public readonly bool4 gbgr => new(y, z, y, x);
+    public readonly bool4 gbgg => new(y, z, y, y);
+    public readonly bool4 gbgb => new(y, z, y, z);
+    public readonly bool4 gbbr => new(y, z, z, x);
+    public readonly bool4 gbbg => new(y, z, z, y);
+    public readonly bool4 gbbb => new(y, z, z, z);
+    public readonly bool4 brrr => new(z, x, x, x);
+    public readonly bool4 brrg => new(z, x, x, y);
+    public readonly bool4 brrb => new(z, x, x, z);
+    public readonly bool4 brgr => new(z, x, y, x);
+    public readonly bool4 brgg => new(z, x, y, y);
+    public readonly bool4 brgb => new(z, x, y, z);
+    public readonly bool4 brbr => new(z, x, z, x);
+    public readonly bool4 brbg => new(z, x, z, y);
+    public readonly bool4 brbb => new(z, x, z, z);
+    public readonly bool4 bgrr => new(z, y, x, x);
+    public readonly bool4 bgrg => new(z, y, x, y);
+    public readonly bool4 bgrb => new(z, y, x, z);
+    public readonly bool4 bggr => new(z, y, y, x);
+    public readonly bool4 bggg => new(z, y, y, y);
+    public readonly bool4 bggb => new(z, y, y, z);
+    public readonly bool4 bgbr => new(z, y, z, x);
+    public readonly bool4 bgbg => new(z, y, z, y);
+    public readonly bool4 bgbb => new(z, y, z, z);
+    public readonly bool4 bbrr => new(z, z, x, x);
+    public readonly bool4 bbrg => new(z, z, x, y);
+    public readonly bool4 bbrb => new(z, z, x, z);
+    public readonly bool4 bbgr => new(z, z, y, x);
+    public readonly bool4 bbgg => new(z, z, y, y);
+    public readonly bool4 bbgb => new(z, z, y, z);
+    public readonly bool4 bbbr => new(z, z, z, x);
+    public readonly bool4 bbbg => new(z, z, z, y);
+    public readonly bool4 bbbb => new(z, z, z, z);
+}
+
+public partial struct bool4
+{
+    public bool4(bool x, bool y, bool2 zw) : this(x, y, zw.x, zw.y) { }
+    public bool4(bool x, bool2 yz, bool w) : this(x, yz.x, yz.y, w) { }
+    public bool4(bool x, bool3 yzw) : this(x, yzw.x, yzw.y, yzw.z) { }
+    public bool4(bool2 xy, bool z, bool w) : this(xy.x, xy.y, z, w) { }
+    public bool4(bool2 xy, bool2 zw) : this(xy.x, xy.y, zw.x, zw.y) { }
+    public bool4(bool3 xyz, bool w) : this(xyz.x, xyz.y, xyz.z, w) { }
+    public bool4(bool4 xyzw) : this(xyzw.x, xyzw.y, xyzw.z, xyzw.w) { }
+    public bool r { readonly get => x; set => x = value; }
+    public bool g { readonly get => y; set => y = value; }
+    public bool b { readonly get => z; set => z = value; }
+    public bool a { readonly get => w; set => w = value; }
+    public readonly bool2 xx => new(x, x);
+    public bool2 xy { readonly get => new(x, y); set { x = value.x; y = value.y; } }
+    public bool2 xz { readonly get => new(x, z); set { x = value.x; z = value.y; } }
+    public bool2 xw { readonly get => new(x, w); set { x = value.x; w = value.y; } }
+    public bool2 yx { readonly get => new(y, x); set { y = value.x; x = value.y; } }
+    public readonly bool2 yy => new(y, y);
+    public bool2 yz { readonly get => new(y, z); set { y = value.x; z = value.y; } }
+    public bool2 yw { readonly get => new(y, w); set { y = value.x; w = value.y; } }
+    public bool2 zx { readonly get => new(z, x); set { z = value.x; x = value.y; } }
+    public bool2 zy { readonly get => new(z, y); set { z = value.x; y = value.y; } }
+    public readonly bool2 zz => new(z, z);
+    public bool2 zw { readonly get => new(z, w); set { z = value.x; w = value.y; } }
+    public bool2 wx { readonly get => new(w, x); set { w = value.x; x = value.y; } }
+    public bool2 wy { readonly get => new(w, y); set { w = value.x; y = value.y; } }
+    public bool2 wz { readonly get => new(w, z); set { w = value.x; z = value.y; } }
+    public readonly bool2 ww => new(w, w);
+    public readonly bool3 xxx => new(x, x, x);
+    public readonly bool3 xxy => new(x, x, y);
+    public readonly bool3 xxz => new(x, x, z);
+    public readonly bool3 xxw => new(x, x, w);
+    public readonly bool3 xyx => new(x, y, x);
+    public readonly bool3 xyy => new(x, y, y);
+    public bool3 xyz { readonly get => new(x, y, z); set { x = value.x; y = value.y; z = value.z; } }
+    public bool3 xyw { readonly get => new(x, y, w); set { x = value.x; y = value.y; w = value.z; } }
+    public readonly bool3 xzx => new(x, z, x);
+    public bool3 xzy { readonly get => new(x, z, y); set { x = value.x; z = value.y; y = value.z; } }
+    public readonly bool3 xzz => new(x, z, z);
+    public bool3 xzw { readonly get => new(x, z, w); set { x = value.x; z = value.y; w = value.z; } }
+    public readonly bool3 xwx => new(x, w, x);
+    public bool3 xwy { readonly get => new(x, w, y); set { x = value.x; w = value.y; y = value.z; } }
+    public bool3 xwz { readonly get => new(x, w, z); set { x = value.x; w = value.y; z = value.z; } }
+    public readonly bool3 xww => new(x, w, w);
+    public readonly bool3 yxx => new(y, x, x);
+    public readonly bool3 yxy => new(y, x, y);
+    public bool3 yxz { readonly get => new(y, x, z); set { y = value.x; x = value.y; z = value.z; } }
+    public bool3 yxw { readonly get => new(y, x, w); set { y = value.x; x = value.y; w = value.z; } }
+    public readonly bool3 yyx => new(y, y, x);
+    public readonly bool3 yyy => new(y, y, y);
+    public readonly bool3 yyz => new(y, y, z);
+    public readonly bool3 yyw => new(y, y, w);
+    public bool3 yzx { readonly get => new(y, z, x); set { y = value.x; z = value.y; x = value.z; } }
+    public readonly bool3 yzy => new(y, z, y);
+    public readonly bool3 yzz => new(y, z, z);
+    public bool3 yzw { readonly get => new(y, z, w); set { y = value.x; z = value.y; w = value.z; } }
+    public bool3 ywx { readonly get => new(y, w, x); set { y = value.x; w = value.y; x = value.z; } }
+    public readonly bool3 ywy => new(y, w, y);
+    public bool3 ywz { readonly get => new(y, w, z); set { y = value.x; w = value.y; z = value.z; } }
+    public readonly bool3 yww => new(y, w, w);
+    public readonly bool3 zxx => new(z, x, x);
+    public bool3 zxy { readonly get => new(z, x, y); set { z = value.x; x = value.y; y = value.z; } }
+    public readonly bool3 zxz => new(z, x, z);
+    public bool3 zxw { readonly get => new(z, x, w); set { z = value.x; x = value.y; w = value.z; } }
+    public bool3 zyx { readonly get => new(z, y, x); set { z = value.x; y = value.y; x = value.z; } }
+    public readonly bool3 zyy => new(z, y, y);
+    public readonly bool3 zyz => new(z, y, z);
+    public bool3 zyw { readonly get => new(z, y, w); set { z = value.x; y = value.y; w = value.z; } }
+    public readonly bool3 zzx => new(z, z, x);
+    public readonly bool3 zzy => new(z, z, y);
+    public readonly bool3 zzz => new(z, z, z);
+    public readonly bool3 zzw => new(z, z, w);
+    public bool3 zwx { readonly get => new(z, w, x); set { z = value.x; w = value.y; x = value.z; } }
+    public bool3 zwy { readonly get => new(z, w, y); set { z = value.x; w = value.y; y = value.z; } }
+    public readonly bool3 zwz => new(z, w, z);
+    public readonly bool3 zww => new(z, w, w);
+    public readonly bool3 wxx => new(w, x, x);
+    public bool3 wxy { readonly get => new(w, x, y); set { w = value.x; x = value.y; y = value.z; } }
+    public bool3 wxz { readonly get => new(w, x, z); set { w = value.x; x = value.y; z = value.z; } }
+    public readonly bool3 wxw => new(w, x, w);
+    public bool3 wyx { readonly get => new(w, y, x); set { w = value.x; y = value.y; x = value.z; } }
+    public readonly bool3 wyy => new(w, y, y);
+    public bool3 wyz { readonly get => new(w, y, z); set { w = value.x; y = value.y; z = value.z; } }
+    public readonly bool3 wyw => new(w, y, w);
+    public bool3 wzx { readonly get => new(w, z, x); set { w = value.x; z = value.y; x = value.z; } }
+    public bool3 wzy { readonly get => new(w, z, y); set { w = value.x; z = value.y; y = value.z; } }
+    public readonly bool3 wzz => new(w, z, z);
+    public readonly bool3 wzw => new(w, z, w);
+    public readonly bool3 wwx => new(w, w, x);
+    public readonly bool3 wwy => new(w, w, y);
+    public readonly bool3 wwz => new(w, w, z);
+    public readonly bool3 www => new(w, w, w);
+    public readonly bool4 xxxx => new(x, x, x, x);
+    public readonly bool4 xxxy => new(x, x, x, y);
+    public readonly bool4 xxxz => new(x, x, x, z);
+    public readonly bool4 xxxw => new(x, x, x, w);
+    public readonly bool4 xxyx => new(x, x, y, x);
+    public readonly bool4 xxyy => new(x, x, y, y);
+    public readonly bool4 xxyz => new(x, x, y, z);
+    public readonly bool4 xxyw => new(x, x, y, w);
+    public readonly bool4 xxzx => new(x, x, z, x);
+    public readonly bool4 xxzy => new(x, x, z, y);
+    public readonly bool4 xxzz => new(x, x, z, z);
+    public readonly bool4 xxzw => new(x, x, z, w);
+    public readonly bool4 xxwx => new(x, x, w, x);
+    public readonly bool4 xxwy => new(x, x, w, y);
+    public readonly bool4 xxwz => new(x, x, w, z);
+    public readonly bool4 xxww => new(x, x, w, w);
+    public readonly bool4 xyxx => new(x, y, x, x);
+    public readonly bool4 xyxy => new(x, y, x, y);
+    public readonly bool4 xyxz => new(x, y, x, z);
+    public readonly bool4 xyxw => new(x, y, x, w);
+    public readonly bool4 xyyx => new(x, y, y, x);
+    public readonly bool4 xyyy => new(x, y, y, y);
+    public readonly bool4 xyyz => new(x, y, y, z);
+    public readonly bool4 xyyw => new(x, y, y, w);
+    public readonly bool4 xyzx => new(x, y, z, x);
+    public readonly bool4 xyzy => new(x, y, z, y);
+    public readonly bool4 xyzz => new(x, y, z, z);
+    public bool4 xyzw { readonly get => new(x, y, z, w); set { x = value.x; y = value.y; z = value.z; w = value.w; } }
+    public readonly bool4 xywx => new(x, y, w, x);
+    public readonly bool4 xywy => new(x, y, w, y);
+    public bool4 xywz { readonly get => new(x, y, w, z); set { x = value.x; y = value.y; w = value.z; z = value.w; } }
+    public readonly bool4 xyww => new(x, y, w, w);
+    public readonly bool4 xzxx => new(x, z, x, x);
+    public readonly bool4 xzxy => new(x, z, x, y);
+    public readonly bool4 xzxz => new(x, z, x, z);
+    public readonly bool4 xzxw => new(x, z, x, w);
+    public readonly bool4 xzyx => new(x, z, y, x);
+    public readonly bool4 xzyy => new(x, z, y, y);
+    public readonly bool4 xzyz => new(x, z, y, z);
+    public bool4 xzyw { readonly get => new(x, z, y, w); set { x = value.x; z = value.y; y = value.z; w = value.w; } }
+    public readonly bool4 xzzx => new(x, z, z, x);
+    public readonly bool4 xzzy => new(x, z, z, y);
+    public readonly bool4 xzzz => new(x, z, z, z);
+    public readonly bool4 xzzw => new(x, z, z, w);
+    public readonly bool4 xzwx => new(x, z, w, x);
+    public bool4 xzwy { readonly get => new(x, z, w, y); set { x = value.x; z = value.y; w = value.z; y = value.w; } }
+    public readonly bool4 xzwz => new(x, z, w, z);
+    public readonly bool4 xzww => new(x, z, w, w);
+    public readonly bool4 xwxx => new(x, w, x, x);
+    public readonly bool4 xwxy => new(x, w, x, y);
+    public readonly bool4 xwxz => new(x, w, x, z);
+    public readonly bool4 xwxw => new(x, w, x, w);
+    public readonly bool4 xwyx => new(x, w, y, x);
+    public readonly bool4 xwyy => new(x, w, y, y);
+    public bool4 xwyz { readonly get => new(x, w, y, z); set { x = value.x; w = value.y; y = value.z; z = value.w; } }
+    public readonly bool4 xwyw => new(x, w, y, w);
+    public readonly bool4 xwzx => new(x, w, z, x);
+    public bool4 xwzy { readonly get => new(x, w, z, y); set { x = value.x; w = value.y; z = value.z; y = value.w; } }
+    public readonly bool4 xwzz => new(x, w, z, z);
+    public readonly bool4 xwzw => new(x, w, z, w);
+    public readonly bool4 xwwx => new(x, w, w, x);
+    public readonly bool4 xwwy => new(x, w, w, y);
+    public readonly bool4 xwwz => new(x, w, w, z);
+    public readonly bool4 xwww => new(x, w, w, w);
+    public readonly bool4 yxxx => new(y, x, x, x);
+    public readonly bool4 yxxy => new(y, x, x, y);
+    public readonly bool4 yxxz => new(y, x, x, z);
+    public readonly bool4 yxxw => new(y, x, x, w);
+    public readonly bool4 yxyx => new(y, x, y, x);
+    public readonly bool4 yxyy => new(y, x, y, y);
+    public readonly bool4 yxyz => new(y, x, y, z);
+    public readonly bool4 yxyw => new(y, x, y, w);
+    public readonly bool4 yxzx => new(y, x, z, x);
+    public readonly bool4 yxzy => new(y, x, z, y);
+    public readonly bool4 yxzz => new(y, x, z, z);
+    public bool4 yxzw { readonly get => new(y, x, z, w); set { y = value.x; x = value.y; z = value.z; w = value.w; } }
+    public readonly bool4 yxwx => new(y, x, w, x);
+    public readonly bool4 yxwy => new(y, x, w, y);
+    public bool4 yxwz { readonly get => new(y, x, w, z); set { y = value.x; x = value.y; w = value.z; z = value.w; } }
+    public readonly bool4 yxww => new(y, x, w, w);
+    public readonly bool4 yyxx => new(y, y, x, x);
+    public readonly bool4 yyxy => new(y, y, x, y);
+    public readonly bool4 yyxz => new(y, y, x, z);
+    public readonly bool4 yyxw => new(y, y, x, w);
+    public readonly bool4 yyyx => new(y, y, y, x);
+    public readonly bool4 yyyy => new(y, y, y, y);
+    public readonly bool4 yyyz => new(y, y, y, z);
+    public readonly bool4 yyyw => new(y, y, y, w);
+    public readonly bool4 yyzx => new(y, y, z, x);
+    public readonly bool4 yyzy => new(y, y, z, y);
+    public readonly bool4 yyzz => new(y, y, z, z);
+    public readonly bool4 yyzw => new(y, y, z, w);
+    public readonly bool4 yywx => new(y, y, w, x);
+    public readonly bool4 yywy => new(y, y, w, y);
+    public readonly bool4 yywz => new(y, y, w, z);
+    public readonly bool4 yyww => new(y, y, w, w);
+    public readonly bool4 yzxx => new(y, z, x, x);
+    public readonly bool4 yzxy => new(y, z, x, y);
+    public readonly bool4 yzxz => new(y, z, x, z);
+    public bool4 yzxw { readonly get => new(y, z, x, w); set { y = value.x; z = value.y; x = value.z; w = value.w; } }
+    public readonly bool4 yzyx => new(y, z, y, x);
+    public readonly bool4 yzyy => new(y, z, y, y);
+    public readonly bool4 yzyz => new(y, z, y, z);
+    public readonly bool4 yzyw => new(y, z, y, w);
+    public readonly bool4 yzzx => new(y, z, z, x);
+    public readonly bool4 yzzy => new(y, z, z, y);
+    public readonly bool4 yzzz => new(y, z, z, z);
+    public readonly bool4 yzzw => new(y, z, z, w);
+    public bool4 yzwx { readonly get => new(y, z, w, x); set { y = value.x; z = value.y; w = value.z; x = value.w; } }
+    public readonly bool4 yzwy => new(y, z, w, y);
+    public readonly bool4 yzwz => new(y, z, w, z);
+    public readonly bool4 yzww => new(y, z, w, w);
+    public readonly bool4 ywxx => new(y, w, x, x);
+    public readonly bool4 ywxy => new(y, w, x, y);
+    public bool4 ywxz { readonly get => new(y, w, x, z); set { y = value.x; w = value.y; x = value.z; z = value.w; } }
+    public readonly bool4 ywxw => new(y, w, x, w);
+    public readonly bool4 ywyx => new(y, w, y, x);
+    public readonly bool4 ywyy => new(y, w, y, y);
+    public readonly bool4 ywyz => new(y, w, y, z);
+    public readonly bool4 ywyw => new(y, w, y, w);
+    public bool4 ywzx { readonly get => new(y, w, z, x); set { y = value.x; w = value.y; z = value.z; x = value.w; } }
+    public readonly bool4 ywzy => new(y, w, z, y);
+    public readonly bool4 ywzz => new(y, w, z, z);
+    public readonly bool4 ywzw => new(y, w, z, w);
+    public readonly bool4 ywwx => new(y, w, w, x);
+    public readonly bool4 ywwy => new(y, w, w, y);
+    public readonly bool4 ywwz => new(y, w, w, z);
+    public readonly bool4 ywww => new(y, w, w, w);
+    public readonly bool4 zxxx => new(z, x, x, x);
+    public readonly bool4 zxxy => new(z, x, x, y);
+    public readonly bool4 zxxz => new(z, x, x, z);
+    public readonly bool4 zxxw => new(z, x, x, w);
+    public readonly bool4 zxyx => new(z, x, y, x);
+    public readonly bool4 zxyy => new(z, x, y, y);
+    public readonly bool4 zxyz => new(z, x, y, z);
+    public bool4 zxyw { readonly get => new(z, x, y, w); set { z = value.x; x = value.y; y = value.z; w = value.w; } }
+    public readonly bool4 zxzx => new(z, x, z, x);
+    public readonly bool4 zxzy => new(z, x, z, y);
+    public readonly bool4 zxzz => new(z, x, z, z);
+    public readonly bool4 zxzw => new(z, x, z, w);
+    public readonly bool4 zxwx => new(z, x, w, x);
+    public bool4 zxwy { readonly get => new(z, x, w, y); set { z = value.x; x = value.y; w = value.z; y = value.w; } }
+    public readonly bool4 zxwz => new(z, x, w, z);
+    public readonly bool4 zxww => new(z, x, w, w);
+    public readonly bool4 zyxx => new(z, y, x, x);
+    public readonly bool4 zyxy => new(z, y, x, y);
+    public readonly bool4 zyxz => new(z, y, x, z);
+    public bool4 zyxw { readonly get => new(z, y, x, w); set { z = value.x; y = value.y; x = value.z; w = value.w; } }
+    public readonly bool4 zyyx => new(z, y, y, x);
+    public readonly bool4 zyyy => new(z, y, y, y);
+    public readonly bool4 zyyz => new(z, y, y, z);
+    public readonly bool4 zyyw => new(z, y, y, w);
+    public readonly bool4 zyzx => new(z, y, z, x);
+    public readonly bool4 zyzy => new(z, y, z, y);
+    public readonly bool4 zyzz => new(z, y, z, z);
+    public readonly bool4 zyzw => new(z, y, z, w);
+    public bool4 zywx { readonly get => new(z, y, w, x); set { z = value.x; y = value.y; w = value.z; x = value.w; } }
+    public readonly bool4 zywy => new(z, y, w, y);
+    public readonly bool4 zywz => new(z, y, w, z);
+    public readonly bool4 zyww => new(z, y, w, w);
+    public readonly bool4 zzxx => new(z, z, x, x);
+    public readonly bool4 zzxy => new(z, z, x, y);
+    public readonly bool4 zzxz => new(z, z, x, z);
+    public readonly bool4 zzxw => new(z, z, x, w);
+    public readonly bool4 zzyx => new(z, z, y, x);
+    public readonly bool4 zzyy => new(z, z, y, y);
+    public readonly bool4 zzyz => new(z, z, y, z);
+    public readonly bool4 zzyw => new(z, z, y, w);
+    public readonly bool4 zzzx => new(z, z, z, x);
+    public readonly bool4 zzzy => new(z, z, z, y);
+    public readonly bool4 zzzz => new(z, z, z, z);
+    public readonly bool4 zzzw => new(z, z, z, w);
+    public readonly bool4 zzwx => new(z, z, w, x);
+    public readonly bool4 zzwy => new(z, z, w, y);
+    public readonly bool4 zzwz => new(z, z, w, z);
+    public readonly bool4 zzww => new(z, z, w, w);
+    public readonly bool4 zwxx => new(z, w, x, x);
+    public bool4 zwxy { readonly get => new(z, w, x, y); set { z = value.x; w = value.y; x = value.z; y = value.w; } }
+    public readonly bool4 zwxz => new(z, w, x, z);
+    public readonly bool4 zwxw => new(z, w, x, w);
+    public bool4 zwyx { readonly get => new(z, w, y, x); set { z = value.x; w = value.y; y = value.z; x = value.w; } }
+    public readonly bool4 zwyy => new(z, w, y, y);
+    public readonly bool4 zwyz => new(z, w, y, z);
+    public readonly bool4 zwyw => new(z, w, y, w);
+    public readonly bool4 zwzx => new(z, w, z, x);
+    public readonly bool4 zwzy => new(z, w, z, y);
+    public readonly bool4 zwzz => new(z, w, z, z);
+    public readonly bool4 zwzw => new(z, w, z, w);
+    public readonly bool4 zwwx => new(z, w, w, x);
+    public readonly bool4 zwwy => new(z, w, w, y);
+    public readonly bool4 zwwz => new(z, w, w, z);
+    public readonly bool4 zwww => new(z, w, w, w);
+    public readonly bool4 wxxx => new(w, x, x, x);
+    public readonly bool4 wxxy => new(w, x, x, y);
+    public readonly bool4 wxxz => new(w, x, x, z);
+    public readonly bool4 wxxw => new(w, x, x, w);
+    public readonly bool4 wxyx => new(w, x, y, x);
+    public readonly bool4 wxyy => new(w, x, y, y);
+    public bool4 wxyz { readonly get => new(w, x, y, z); set { w = value.x; x = value.y; y = value.z; z = value.w; } }
+    public readonly bool4 wxyw => new(w, x, y, w);
+    public readonly bool4 wxzx => new(w, x, z, x);
+    public bool4 wxzy { readonly get => new(w, x, z, y); set { w = value.x; x = value.y; z = value.z; y = value.w; } }
+    public readonly bool4 wxzz => new(w, x, z, z);
+    public readonly bool4 wxzw => new(w, x, z, w);
+    public readonly bool4 wxwx => new(w, x, w, x);
+    public readonly bool4 wxwy => new(w, x, w, y);
+    public readonly bool4 wxwz => new(w, x, w, z);
+    public readonly bool4 wxww => new(w, x, w, w);
+    public readonly bool4 wyxx => new(w, y, x, x);
+    public readonly bool4 wyxy => new(w, y, x, y);
+    public bool4 wyxz { readonly get => new(w, y, x, z); set { w = value.x; y = value.y; x = value.z; z = value.w; } }
+    public readonly bool4 wyxw => new(w, y, x, w);
+    public readonly bool4 wyyx => new(w, y, y, x);
+    public readonly bool4 wyyy => new(w, y, y, y);
+    public readonly bool4 wyyz => new(w, y, y, z);
+    public readonly bool4 wyyw => new(w, y, y, w);
+    public bool4 wyzx { readonly get => new(w, y, z, x); set { w = value.x; y = value.y; z = value.z; x = value.w; } }
+    public readonly bool4 wyzy => new(w, y, z, y);
+    public readonly bool4 wyzz => new(w, y, z, z);
+    public readonly bool4 wyzw => new(w, y, z, w);
+    public readonly bool4 wywx => new(w, y, w, x);
+    public readonly bool4 wywy => new(w, y, w, y);
+    public readonly bool4 wywz => new(w, y, w, z);
+    public readonly bool4 wyww => new(w, y, w, w);
+    public readonly bool4 wzxx => new(w, z, x, x);
+    public bool4 wzxy { readonly get => new(w, z, x, y); set { w = value.x; z = value.y; x = value.z; y = value.w; } }
+    public readonly bool4 wzxz => new(w, z, x, z);
+    public readonly bool4 wzxw => new(w, z, x, w);
+    public bool4 wzyx { readonly get => new(w, z, y, x); set { w = value.x; z = value.y; y = value.z; x = value.w; } }
+    public readonly bool4 wzyy => new(w, z, y, y);
+    public readonly bool4 wzyz => new(w, z, y, z);
+    public readonly bool4 wzyw => new(w, z, y, w);
+    public readonly bool4 wzzx => new(w, z, z, x);
+    public readonly bool4 wzzy => new(w, z, z, y);
+    public readonly bool4 wzzz => new(w, z, z, z);
+    public readonly bool4 wzzw => new(w, z, z, w);
+    public readonly bool4 wzwx => new(w, z, w, x);
+    public readonly bool4 wzwy => new(w, z, w, y);
+    public readonly bool4 wzwz => new(w, z, w, z);
+    public readonly bool4 wzww => new(w, z, w, w);
+    public readonly bool4 wwxx => new(w, w, x, x);
+    public readonly bool4 wwxy => new(w, w, x, y);
+    public readonly bool4 wwxz => new(w, w, x, z);
+    public readonly bool4 wwxw => new(w, w, x, w);
+    public readonly bool4 wwyx => new(w, w, y, x);
+    public readonly bool4 wwyy => new(w, w, y, y);
+    public readonly bool4 wwyz => new(w, w, y, z);
+    public readonly bool4 wwyw => new(w, w, y, w);
+    public readonly bool4 wwzx => new(w, w, z, x);
+    public readonly bool4 wwzy => new(w, w, z, y);
+    public readonly bool4 wwzz => new(w, w, z, z);
+    public readonly bool4 wwzw => new(w, w, z, w);
+    public readonly bool4 wwwx => new(w, w, w, x);
+    public readonly bool4 wwwy => new(w, w, w, y);
+    public readonly bool4 wwwz => new(w, w, w, z);
+    public readonly bool4 wwww => new(w, w, w, w);
+    public readonly bool2 rr => new(x, x);
+    public bool2 rg { readonly get => new(x, y); set { x = value.x; y = value.y; } }
+    public bool2 rb { readonly get => new(x, z); set { x = value.x; z = value.y; } }
+    public bool2 ra { readonly get => new(x, w); set { x = value.x; w = value.y; } }
+    public bool2 gr { readonly get => new(y, x); set { y = value.x; x = value.y; } }
+    public readonly bool2 gg => new(y, y);
+    public bool2 gb { readonly get => new(y, z); set { y = value.x; z = value.y; } }
+    public bool2 ga { readonly get => new(y, w); set { y = value.x; w = value.y; } }
+    public bool2 br { readonly get => new(z, x); set { z = value.x; x = value.y; } }
+    public bool2 bg { readonly get => new(z, y); set { z = value.x; y = value.y; } }
+    public readonly bool2 bb => new(z, z);
+    public bool2 ba { readonly get => new(z, w); set { z = value.x; w = value.y; } }
+    public bool2 ar { readonly get => new(w, x); set { w = value.x; x = value.y; } }
+    public bool2 ag { readonly get => new(w, y); set { w = value.x; y = value.y; } }
+    public bool2 ab { readonly get => new(w, z); set { w = value.x; z = value.y; } }
+    public readonly bool2 aa => new(w, w);
+    public readonly bool3 rrr => new(x, x, x);
+    public readonly bool3 rrg => new(x, x, y);
+    public readonly bool3 rrb => new(x, x, z);
+    public readonly bool3 rra => new(x, x, w);
+    public readonly bool3 rgr => new(x, y, x);
+    public readonly bool3 rgg => new(x, y, y);
+    public bool3 rgb { readonly get => new(x, y, z); set { x = value.x; y = value.y; z = value.z; } }
+    public bool3 rga { readonly get => new(x, y, w); set { x = value.x; y = value.y; w = value.z; } }
+    public readonly bool3 rbr => new(x, z, x);
+    public bool3 rbg { readonly get => new(x, z, y); set { x = value.x; z = value.y; y = value.z; } }
+    public readonly bool3 rbb => new(x, z, z);
+    public bool3 rba { readonly get => new(x, z, w); set { x = value.x; z = value.y; w = value.z; } }
+    public readonly bool3 rar => new(x, w, x);
+    public bool3 rag { readonly get => new(x, w, y); set { x = value.x; w = value.y; y = value.z; } }
+    public bool3 rab { readonly get => new(x, w, z); set { x = value.x; w = value.y; z = value.z; } }
+    public readonly bool3 raa => new(x, w, w);
+    public readonly bool3 grr => new(y, x, x);
+    public readonly bool3 grg => new(y, x, y);
+    public bool3 grb { readonly get => new(y, x, z); set { y = value.x; x = value.y; z = value.z; } }
+    public bool3 gra { readonly get => new(y, x, w); set { y = value.x; x = value.y; w = value.z; } }
+    public readonly bool3 ggr => new(y, y, x);
+    public readonly bool3 ggg => new(y, y, y);
+    public readonly bool3 ggb => new(y, y, z);
+    public readonly bool3 gga => new(y, y, w);
+    public bool3 gbr { readonly get => new(y, z, x); set { y = value.x; z = value.y; x = value.z; } }
+    public readonly bool3 gbg => new(y, z, y);
+    public readonly bool3 gbb => new(y, z, z);
+    public bool3 gba { readonly get => new(y, z, w); set { y = value.x; z = value.y; w = value.z; } }
+    public bool3 gar { readonly get => new(y, w, x); set { y = value.x; w = value.y; x = value.z; } }
+    public readonly bool3 gag => new(y, w, y);
+    public bool3 gab { readonly get => new(y, w, z); set { y = value.x; w = value.y; z = value.z; } }
+    public readonly bool3 gaa => new(y, w, w);
+    public readonly bool3 brr => new(z, x, x);
+    public bool3 brg { readonly get => new(z, x, y); set { z = value.x; x = value.y; y = value.z; } }
+    public readonly bool3 brb => new(z, x, z);
+    public bool3 bra { readonly get => new(z, x, w); set { z = value.x; x = value.y; w = value.z; } }
+    public bool3 bgr { readonly get => new(z, y, x); set { z = value.x; y = value.y; x = value.z; } }
+    public readonly bool3 bgg => new(z, y, y);
+    public readonly bool3 bgb => new(z, y, z);
+    public bool3 bga { readonly get => new(z, y, w); set { z = value.x; y = value.y; w = value.z; } }
+    public readonly bool3 bbr => new(z, z, x);
+    public readonly bool3 bbg => new(z, z, y);
+    public readonly bool3 bbb => new(z, z, z);
+    public readonly bool3 bba => new(z, z, w);
+    public bool3 bar { readonly get => new(z, w, x); set { z = value.x; w = value.y; x = value.z; } }
+    public bool3 bag { readonly get => new(z, w, y); set { z = value.x; w = value.y; y = value.z; } }
+    public readonly bool3 bab => new(z, w, z);
+    public readonly bool3 baa => new(z, w, w);
+    public readonly bool3 arr => new(w, x, x);
+    public bool3 arg { readonly get => new(w, x, y); set { w = value.x; x = value.y; y = value.z; } }
+    public bool3 arb { readonly get => new(w, x, z); set { w = value.x; x = value.y; z = value.z; } }
+    public readonly bool3 ara => new(w, x, w);
+    public bool3 agr { readonly get => new(w, y, x); set { w = value.x; y = value.y; x = value.z; } }
+    public readonly bool3 agg => new(w, y, y);
+    public bool3 agb { readonly get => new(w, y, z); set { w = value.x; y = value.y; z = value.z; } }
+    public readonly bool3 aga => new(w, y, w);
+    public bool3 abr { readonly get => new(w, z, x); set { w = value.x; z = value.y; x = value.z; } }
+    public bool3 abg { readonly get => new(w, z, y); set { w = value.x; z = value.y; y = value.z; } }
+    public readonly bool3 abb => new(w, z, z);
+    public readonly bool3 aba => new(w, z, w);
+    public readonly bool3 aar => new(w, w, x);
+    public readonly bool3 aag => new(w, w, y);
+    public readonly bool3 aab => new(w, w, z);
+    public readonly bool3 aaa => new(w, w, w);
+    public readonly bool4 rrrr => new(x, x, x, x);
+    public readonly bool4 rrrg => new(x, x, x, y);
+    public readonly bool4 rrrb => new(x, x, x, z);
+    public readonly bool4 rrra => new(x, x, x, w);
+    public readonly bool4 rrgr => new(x, x, y, x);
+    public readonly bool4 rrgg => new(x, x, y, y);
+    public readonly bool4 rrgb => new(x, x, y, z);
+    public readonly bool4 rrga => new(x, x, y, w);
+    public readonly bool4 rrbr => new(x, x, z, x);
+    public readonly bool4 rrbg => new(x, x, z, y);
+    public readonly bool4 rrbb => new(x, x, z, z);
+    public readonly bool4 rrba => new(x, x, z, w);
+    public readonly bool4 rrar => new(x, x, w, x);
+    public readonly bool4 rrag => new(x, x, w, y);
+    public readonly bool4 rrab => new(x, x, w, z);
+    public readonly bool4 rraa => new(x, x, w, w);
+    public readonly bool4 rgrr => new(x, y, x, x);
+    public readonly bool4 rgrg => new(x, y, x, y);
+    public readonly bool4 rgrb => new(x, y, x, z);
+    public readonly bool4 rgra => new(x, y, x, w);
+    public readonly bool4 rggr => new(x, y, y, x);
+    public readonly bool4 rggg => new(x, y, y, y);
+    public readonly bool4 rggb => new(x, y, y, z);
+    public readonly bool4 rgga => new(x, y, y, w);
+    public readonly bool4 rgbr => new(x, y, z, x);
+    public readonly bool4 rgbg => new(x, y, z, y);
+    public readonly bool4 rgbb => new(x, y, z, z);
+    public bool4 rgba { readonly get => new(x, y, z, w); set { x = value.x; y = value.y; z = value.z; w = value.w; } }
+    public readonly bool4 rgar => new(x, y, w, x);
+    public readonly bool4 rgag => new(x, y, w, y);
+    public bool4 rgab { readonly get => new(x, y, w, z); set { x = value.x; y = value.y; w = value.z; z = value.w; } }
+    public readonly bool4 rgaa => new(x, y, w, w);
+    public readonly bool4 rbrr => new(x, z, x, x);
+    public readonly bool4 rbrg => new(x, z, x, y);
+    public readonly bool4 rbrb => new(x, z, x, z);
+    public readonly bool4 rbra => new(x, z, x, w);
+    public readonly bool4 rbgr => new(x, z, y, x);
+    public readonly bool4 rbgg => new(x, z, y, y);
+    public readonly bool4 rbgb => new(x, z, y, z);
+    public bool4 rbga { readonly get => new(x, z, y, w); set { x = value.x; z = value.y; y = value.z; w = value.w; } }
+    public readonly bool4 rbbr => new(x, z, z, x);
+    public readonly bool4 rbbg => new(x, z, z, y);
+    public readonly bool4 rbbb => new(x, z, z, z);
+    public readonly bool4 rbba => new(x, z, z, w);
+    public readonly bool4 rbar => new(x, z, w, x);
+    public bool4 rbag { readonly get => new(x, z, w, y); set { x = value.x; z = value.y; w = value.z; y = value.w; } }
+    public readonly bool4 rbab => new(x, z, w, z);
+    public readonly bool4 rbaa => new(x, z, w, w);
+    public readonly bool4 rarr => new(x, w, x, x);
+    public readonly bool4 rarg => new(x, w, x, y);
+    public readonly bool4 rarb => new(x, w, x, z);
+    public readonly bool4 rara => new(x, w, x, w);
+    public readonly bool4 ragr => new(x, w, y, x);
+    public readonly bool4 ragg => new(x, w, y, y);
+    public bool4 ragb { readonly get => new(x, w, y, z); set { x = value.x; w = value.y; y = value.z; z = value.w; } }
+    public readonly bool4 raga => new(x, w, y, w);
+    public readonly bool4 rabr => new(x, w, z, x);
+    public bool4 rabg { readonly get => new(x, w, z, y); set { x = value.x; w = value.y; z = value.z; y = value.w; } }
+    public readonly bool4 rabb => new(x, w, z, z);
+    public readonly bool4 raba => new(x, w, z, w);
+    public readonly bool4 raar => new(x, w, w, x);
+    public readonly bool4 raag => new(x, w, w, y);
+    public readonly bool4 raab => new(x, w, w, z);
+    public readonly bool4 raaa => new(x, w, w, w);
+    public readonly bool4 grrr => new(y, x, x, x);
+    public readonly bool4 grrg => new(y, x, x, y);
+    public readonly bool4 grrb => new(y, x, x, z);
+    public readonly bool4 grra => new(y, x, x, w);
+    public readonly bool4 grgr => new(y, x, y, x);
+    public readonly bool4 grgg => new(y, x, y, y);
+    public readonly bool4 grgb => new(y, x, y, z);
+    public readonly bool4 grga => new(y, x, y, w);
+    public readonly bool4 grbr => new(y, x, z, x);
+    public readonly bool4 grbg => new(y, x, z, y);
+    public readonly bool4 grbb => new(y, x, z, z);
+    public bool4 grba { readonly get => new(y, x, z, w); set { y = value.x; x = value.y; z = value.z; w = value.w; } }
+    public readonly bool4 grar => new(y, x, w, x);
+    public readonly bool4 grag => new(y, x, w, y);
+    public bool4 grab { readonly get => new(y, x, w, z); set { y = value.x; x = value.y; w = value.z; z = value.w; } }
+    public readonly bool4 graa => new(y, x, w, w);
+    public readonly bool4 ggrr => new(y, y, x, x);
+    public readonly bool4 ggrg => new(y, y, x, y);
+    public readonly bool4 ggrb => new(y, y, x, z);
+    public readonly bool4 ggra => new(y, y, x, w);
+    public readonly bool4 gggr => new(y, y, y, x);
+    public readonly bool4 gggg => new(y, y, y, y);
+    public readonly bool4 gggb => new(y, y, y, z);
+    public readonly bool4 ggga => new(y, y, y, w);
+    public readonly bool4 ggbr => new(y, y, z, x);
+    public readonly bool4 ggbg => new(y, y, z, y);
+    public readonly bool4 ggbb => new(y, y, z, z);
+    public readonly bool4 ggba => new(y, y, z, w);
+    public readonly bool4 ggar => new(y, y, w, x);
+    public readonly bool4 ggag => new(y, y, w, y);
+    public readonly bool4 ggab => new(y, y, w, z);
+    public readonly bool4 ggaa => new(y, y, w, w);
+    public readonly bool4 gbrr => new(y, z, x, x);
+    public readonly bool4 gbrg => new(y, z, x, y);
+    public readonly bool4 gbrb => new(y, z, x, z);
+    public bool4 gbra { readonly get => new(y, z, x, w); set { y = value.x; z = value.y; x = value.z; w = value.w; } }
+    public readonly bool4 gbgr => new(y, z, y, x);
+    public readonly bool4 gbgg => new(y, z, y, y);
+    public readonly bool4 gbgb => new(y, z, y, z);
+    public readonly bool4 gbga => new(y, z, y, w);
+    public readonly bool4 gbbr => new(y, z, z, x);
+    public readonly bool4 gbbg => new(y, z, z, y);
+    public readonly bool4 gbbb => new(y, z, z, z);
+    public readonly bool4 gbba => new(y, z, z, w);
+    public bool4 gbar { readonly get => new(y, z, w, x); set { y = value.x; z = value.y; w = value.z; x = value.w; } }
+    public readonly bool4 gbag => new(y, z, w, y);
+    public readonly bool4 gbab => new(y, z, w, z);
+    public readonly bool4 gbaa => new(y, z, w, w);
+    public readonly bool4 garr => new(y, w, x, x);
+    public readonly bool4 garg => new(y, w, x, y);
+    public bool4 garb { readonly get => new(y, w, x, z); set { y = value.x; w = value.y; x = value.z; z = value.w; } }
+    public readonly bool4 gara => new(y, w, x, w);
+    public readonly bool4 gagr => new(y, w, y, x);
+    public readonly bool4 gagg => new(y, w, y, y);
+    public readonly bool4 gagb => new(y, w, y, z);
+    public readonly bool4 gaga => new(y, w, y, w);
+    public bool4 gabr { readonly get => new(y, w, z, x); set { y = value.x; w = value.y; z = value.z; x = value.w; } }
+    public readonly bool4 gabg => new(y, w, z, y);
+    public readonly bool4 gabb => new(y, w, z, z);
+    public readonly bool4 gaba => new(y, w, z, w);
+    public readonly bool4 gaar => new(y, w, w, x);
+    public readonly bool4 gaag => new(y, w, w, y);
+    public readonly bool4 gaab => new(y, w, w, z);
+    public readonly bool4 gaaa => new(y, w, w, w);
+    public readonly bool4 brrr => new(z, x, x, x);
+    public readonly bool4 brrg => new(z, x, x, y);
+    public readonly bool4 brrb => new(z, x, x, z);
+    public readonly bool4 brra => new(z, x, x, w);
+    public readonly bool4 brgr => new(z, x, y, x);
+    public readonly bool4 brgg => new(z, x, y, y);
+    public readonly bool4 brgb => new(z, x, y, z);
+    public bool4 brga { readonly get => new(z, x, y, w); set { z = value.x; x = value.y; y = value.z; w = value.w; } }
+    public readonly bool4 brbr => new(z, x, z, x);
+    public readonly bool4 brbg => new(z, x, z, y);
+    public readonly bool4 brbb => new(z, x, z, z);
+    public readonly bool4 brba => new(z, x, z, w);
+    public readonly bool4 brar => new(z, x, w, x);
+    public bool4 brag { readonly get => new(z, x, w, y); set { z = value.x; x = value.y; w = value.z; y = value.w; } }
+    public readonly bool4 brab => new(z, x, w, z);
+    public readonly bool4 braa => new(z, x, w, w);
+    public readonly bool4 bgrr => new(z, y, x, x);
+    public readonly bool4 bgrg => new(z, y, x, y);
+    public readonly bool4 bgrb => new(z, y, x, z);
+    public bool4 bgra { readonly get => new(z, y, x, w); set { z = value.x; y = value.y; x = value.z; w = value.w; } }
+    public readonly bool4 bggr => new(z, y, y, x);
+    public readonly bool4 bggg => new(z, y, y, y);
+    public readonly bool4 bggb => new(z, y, y, z);
+    public readonly bool4 bgga => new(z, y, y, w);
+    public readonly bool4 bgbr => new(z, y, z, x);
+    public readonly bool4 bgbg => new(z, y, z, y);
+    public readonly bool4 bgbb => new(z, y, z, z);
+    public readonly bool4 bgba => new(z, y, z, w);
+    public bool4 bgar { readonly get => new(z, y, w, x); set { z = value.x; y = value.y; w = value.z; x = value.w; } }
+    public readonly bool4 bgag => new(z, y, w, y);
+    public readonly bool4 bgab => new(z, y, w, z);
+    public readonly bool4 bgaa => new(z, y, w, w);
+    public readonly bool4 bbrr => new(z, z, x, x);
+    public readonly bool4 bbrg => new(z, z, x, y);
+    public readonly bool4 bbrb => new(z, z, x, z);
+    public readonly bool4 bbra => new(z, z, x, w);
+    public readonly bool4 bbgr => new(z, z, y, x);
+    public readonly bool4 bbgg => new(z, z, y, y);
+    public readonly bool4 bbgb => new(z, z, y, z);
+    public readonly bool4 bbga => new(z, z, y, w);
+    public readonly bool4 bbbr => new(z, z, z, x);
+    public readonly bool4 bbbg => new(z, z, z, y);
+    public readonly bool4 bbbb => new(z, z, z, z);
+    public readonly bool4 bbba => new(z, z, z, w);
+    public readonly bool4 bbar => new(z, z, w, x);
+    public readonly bool4 bbag => new(z, z, w, y);
+    public readonly bool4 bbab => new(z, z, w, z);
+    public readonly bool4 bbaa => new(z, z, w, w);
+    public readonly bool4 barr => new(z, w, x, x);
+    public bool4 barg { readonly get => new(z, w, x, y); set { z = value.x; w = value.y; x = value.z; y = value.w; } }
+    public readonly bool4 barb => new(z, w, x, z);
+    public readonly bool4 bara => new(z, w, x, w);
+    public bool4 bagr { readonly get => new(z, w, y, x); set { z = value.x; w = value.y; y = value.z; x = value.w; } }
+    public readonly bool4 bagg => new(z, w, y, y);
+    public readonly bool4 bagb => new(z, w, y, z);
+    public readonly bool4 baga => new(z, w, y, w);
+    public readonly bool4 babr => new(z, w, z, x);
+    public readonly bool4 babg => new(z, w, z, y);
+    public readonly bool4 babb => new(z, w, z, z);
+    public readonly bool4 baba => new(z, w, z, w);
+    public readonly bool4 baar => new(z, w, w, x);
+    public readonly bool4 baag => new(z, w, w, y);
+    public readonly bool4 baab => new(z, w, w, z);
+    public readonly bool4 baaa => new(z, w, w, w);
+    public readonly bool4 arrr => new(w, x, x, x);
+    public readonly bool4 arrg => new(w, x, x, y);
+    public readonly bool4 arrb => new(w, x, x, z);
+    public readonly bool4 arra => new(w, x, x, w);
+    public readonly bool4 argr => new(w, x, y, x);
+    public readonly bool4 argg => new(w, x, y, y);
+    public bool4 argb { readonly get => new(w, x, y, z); set { w = value.x; x = value.y; y = value.z; z = value.w; } }
+    public readonly bool4 arga => new(w, x, y, w);
+    public readonly bool4 arbr => new(w, x, z, x);
+    public bool4 arbg { readonly get => new(w, x, z, y); set { w = value.x; x = value.y; z = value.z; y = value.w; } }
+    public readonly bool4 arbb => new(w, x, z, z);
+    public readonly bool4 arba => new(w, x, z, w);
+    public readonly bool4 arar => new(w, x, w, x);
+    public readonly bool4 arag => new(w, x, w, y);
+    public readonly bool4 arab => new(w, x, w, z);
+    public readonly bool4 araa => new(w, x, w, w);
+    public readonly bool4 agrr => new(w, y, x, x);
+    public readonly bool4 agrg => new(w, y, x, y);
+    public bool4 agrb { readonly get => new(w, y, x, z); set { w = value.x; y = value.y; x = value.z; z = value.w; } }
+    public readonly bool4 agra => new(w, y, x, w);
+    public readonly bool4 aggr => new(w, y, y, x);
+    public readonly bool4 aggg => new(w, y, y, y);
+    public readonly bool4 aggb => new(w, y, y, z);
+    public readonly bool4 agga => new(w, y, y, w);
+    public bool4 agbr { readonly get => new(w, y, z, x); set { w = value.x; y = value.y; z = value.z; x = value.w; } }
+    public readonly bool4 agbg => new(w, y, z, y);
+    public readonly bool4 agbb => new(w, y, z, z);
+    public readonly bool4 agba => new(w, y, z, w);
+    public readonly bool4 agar => new(w, y, w, x);
+    public readonly bool4 agag => new(w, y, w, y);
+    public readonly bool4 agab => new(w, y, w, z);
+    public readonly bool4 agaa => new(w, y, w, w);
+    public readonly bool4 abrr => new(w, z, x, x);
+    public bool4 abrg { readonly get => new(w, z, x, y); set { w = value.x; z = value.y; x = value.z; y = value.w; } }
+    public readonly bool4 abrb => new(w, z, x, z);
+    public readonly bool4 abra => new(w, z, x, w);
+    public bool4 abgr { readonly get => new(w, z, y, x); set { w = value.x; z = value.y; y = value.z; x = value.w; } }
+    public readonly bool4 abgg => new(w, z, y, y);
+    public readonly bool4 abgb => new(w, z, y, z);
+    public readonly bool4 abga => new(w, z, y, w);
+    public readonly bool4 abbr => new(w, z, z, x);
+    public readonly bool4 abbg => new(w, z, z, y);
+    public readonly bool4 abbb => new(w, z, z, z);
+    public readonly bool4 abba => new(w, z, z, w);
+    public readonly bool4 abar => new(w, z, w, x);
+    public readonly bool4 abag => new(w, z, w, y);
+    public readonly bool4 abab => new(w, z, w, z);
+    public readonly bool4 abaa => new(w, z, w, w);
+    public readonly bool4 aarr => new(w, w, x, x);
+    public readonly bool4 aarg => new(w, w, x, y);
+    public readonly bool4 aarb => new(w, w, x, z);
+    public readonly bool4 aara => new(w, w, x, w);
+    public readonly bool4 aagr => new(w, w, y, x);
+    public readonly bool4 aagg => new(w, w, y, y);
+    public readonly bool4 aagb => new(w, w, y, z);
+    public readonly bool4 aaga => new(w, w, y, w);
+    public readonly bool4 aabr => new(w, w, z, x);
+    public readonly bool4 aabg => new(w, w, z, y);
+    public readonly bool4 aabb => new(w, w, z, z);
+    public readonly bool4 aaba => new(w, w, z, w);
+    public readonly bool4 aaar => new(w, w, w, x);
+    public readonly bool4 aaag => new(w, w, w, y);
+    public readonly bool4 aaab => new(w, w, w, z);
+    public readonly bool4 aaaa => new(w, w, w, w);
+}
+
+public partial struct double2
+{
+    public double2(double2 xy) : this(xy.x, xy.y) { }
+    public double r { readonly get => x; set => x = value; }
+    public double g { readonly get => y; set => y = value; }
+    public readonly double2 xx => new(x, x);
+    public double2 xy { readonly get => new(x, y); set { x = value.x; y = value.y; } }
+    public double2 yx { readonly get => new(y, x); set { y = value.x; x = value.y; } }
+    public readonly double2 yy => new(y, y);
+    public readonly double3 xxx => new(x, x, x);
+    public readonly double3 xxy => new(x, x, y);
+    public readonly double3 xyx => new(x, y, x);
+    public readonly double3 xyy => new(x, y, y);
+    public readonly double3 yxx => new(y, x, x);
+    public readonly double3 yxy => new(y, x, y);
+    public readonly double3 yyx => new(y, y, x);
+    public readonly double3 yyy => new(y, y, y);
+    public readonly double2 rr => new(x, x);
+    public double2 rg { readonly get => new(x, y); set { x = value.x; y = value.y; } }
+    public double2 gr { readonly get => new(y, x); set { y = value.x; x = value.y; } }
+    public readonly double2 gg => new(y, y);
+    public readonly double3 rrr => new(x, x, x);
+    public readonly double3 rrg => new(x, x, y);
+    public readonly double3 rgr => new(x, y, x);
+    public readonly double3 rgg => new(x, y, y);
+    public readonly double3 grr => new(y, x, x);
+    public readonly double3 grg => new(y, x, y);
+    public readonly double3 ggr => new(y, y, x);
+    public readonly double3 ggg => new(y, y, y);
+}
+
+public partial struct double3
+{
+    public double3(double x, double2 yz) : this(x, yz.x, yz.y) { }
+    public double3(double2 xy, double z) : this(xy.x, xy.y, z) { }
+    public double3(double3 xyz) : this(xyz.x, xyz.y, xyz.z) { }
+    public double r { readonly get => x; set => x = value; }
+    public double g { readonly get => y; set => y = value; }
+    public double b { readonly get => z; set => z = value; }
+    public readonly double2 xx => new(x, x);
+    public double2 xy { readonly get => new(x, y); set { x = value.x; y = value.y; } }
+    public double2 xz { readonly get => new(x, z); set { x = value.x; z = value.y; } }
+    public double2 yx { readonly get => new(y, x); set { y = value.x; x = value.y; } }
+    public readonly double2 yy => new(y, y);
+    public double2 yz { readonly get => new(y, z); set { y = value.x; z = value.y; } }
+    public double2 zx { readonly get => new(z, x); set { z = value.x; x = value.y; } }
+    public double2 zy { readonly get => new(z, y); set { z = value.x; y = value.y; } }
+    public readonly double2 zz => new(z, z);
+    public readonly double3 xxx => new(x, x, x);
+    public readonly double3 xxy => new(x, x, y);
+    public readonly double3 xxz => new(x, x, z);
+    public readonly double3 xyx => new(x, y, x);
+    public readonly double3 xyy => new(x, y, y);
+    public double3 xyz { readonly get => new(x, y, z); set { x = value.x; y = value.y; z = value.z; } }
+    public readonly double3 xzx => new(x, z, x);
+    public double3 xzy { readonly get => new(x, z, y); set { x = value.x; z = value.y; y = value.z; } }
+    public readonly double3 xzz => new(x, z, z);
+    public readonly double3 yxx => new(y, x, x);
+    public readonly double3 yxy => new(y, x, y);
+    public double3 yxz { readonly get => new(y, x, z); set { y = value.x; x = value.y; z = value.z; } }
+    public readonly double3 yyx => new(y, y, x);
+    public readonly double3 yyy => new(y, y, y);
+    public readonly double3 yyz => new(y, y, z);
+    public double3 yzx { readonly get => new(y, z, x); set { y = value.x; z = value.y; x = value.z; } }
+    public readonly double3 yzy => new(y, z, y);
+    public readonly double3 yzz => new(y, z, z);
+    public readonly double3 zxx => new(z, x, x);
+    public double3 zxy { readonly get => new(z, x, y); set { z = value.x; x = value.y; y = value.z; } }
+    public readonly double3 zxz => new(z, x, z);
+    public double3 zyx { readonly get => new(z, y, x); set { z = value.x; y = value.y; x = value.z; } }
+    public readonly double3 zyy => new(z, y, y);
+    public readonly double3 zyz => new(z, y, z);
+    public readonly double3 zzx => new(z, z, x);
+    public readonly double3 zzy => new(z, z, y);
+    public readonly double3 zzz => new(z, z, z);
+    public readonly double2 rr => new(x, x);
+    public double2 rg { readonly get => new(x, y); set { x = value.x; y = value.y; } }
+    public double2 rb { readonly get => new(x, z); set { x = value.x; z = value.y; } }
+    public double2 gr { readonly get => new(y, x); set { y = value.x; x = value.y; } }
+    public readonly double2 gg => new(y, y);
+    public double2 gb { readonly get => new(y, z); set { y = value.x; z = value.y; } }
+    public double2 br { readonly get => new(z, x); set { z = value.x; x = value.y; } }
+    public double2 bg { readonly get => new(z, y); set { z = value.x; y = value.y; } }
+    public readonly double2 bb => new(z, z);
+    public readonly double3 rrr => new(x, x, x);
+    public readonly double3 rrg => new(x, x, y);
+    public readonly double3 rrb => new(x, x, z);
+    public readonly double3 rgr => new(x, y, x);
+    public readonly double3 rgg => new(x, y, y);
+    public double3 rgb { readonly get => new(x, y, z); set { x = value.x; y = value.y; z = value.z; } }
+    public readonly double3 rbr => new(x, z, x);
+    public double3 rbg { readonly get => new(x, z, y); set { x = value.x; z = value.y; y = value.z; } }
+    public readonly double3 rbb => new(x, z, z);
+    public readonly double3 grr => new(y, x, x);
+    public readonly double3 grg => new(y, x, y);
+    public double3 grb { readonly get => new(y, x, z); set { y = value.x; x = value.y; z = value.z; } }
+    public readonly double3 ggr => new(y, y, x);
+    public readonly double3 ggg => new(y, y, y);
+    public readonly double3 ggb => new(y, y, z);
+    public double3 gbr { readonly get => new(y, z, x); set { y = value.x; z = value.y; x = value.z; } }
+    public readonly double3 gbg => new(y, z, y);
+    public readonly double3 gbb => new(y, z, z);
+    public readonly double3 brr => new(z, x, x);
+    public double3 brg { readonly get => new(z, x, y); set { z = value.x; x = value.y; y = value.z; } }
+    public readonly double3 brb => new(z, x, z);
+    public double3 bgr { readonly get => new(z, y, x); set { z = value.x; y = value.y; x = value.z; } }
+    public readonly double3 bgg => new(z, y, y);
+    public readonly double3 bgb => new(z, y, z);
+    public readonly double3 bbr => new(z, z, x);
+    public readonly double3 bbg => new(z, z, y);
+    public readonly double3 bbb => new(z, z, z);
+}
+
+public static partial class math
+{
+    public static float2 float2(float2 xy) => new(xy);
+    public static float3 float3(float x, float2 yz) => new(x, yz);
+    public static float3 float3(float2 xy, float z) => new(xy, z);
+    public static float3 float3(float3 xyz) => new(xyz);
+    public static float4 float4(float x, float y, float2 zw) => new(x, y, zw);
+    public static float4 float4(float x, float2 yz, float w) => new(x, yz, w);
+    public static float4 float4(float x, float3 yzw) => new(x, yzw);
+    public static float4 float4(float2 xy, float z, float w) => new(xy, z, w);
+    public static float4 float4(float2 xy, float2 zw) => new(xy, zw);
+    public static float4 float4(float3 xyz, float w) => new(xyz, w);
+    public static float4 float4(float4 xyzw) => new(xyzw);
+    public static int2 int2(int2 xy) => new(xy);
+    public static int3 int3(int x, int2 yz) => new(x, yz);
+    public static int3 int3(int2 xy, int z) => new(xy, z);
+    public static int3 int3(int3 xyz) => new(xyz);
+    public static int4 int4(int x, int y, int2 zw) => new(x, y, zw);
+    public static int4 int4(int x, int2 yz, int w) => new(x, yz, w);
+    public static int4 int4(int x, int3 yzw) => new(x, yzw);
+    public static int4 int4(int2 xy, int z, int w) => new(xy, z, w);
+    public static int4 int4(int2 xy, int2 zw) => new(xy, zw);
+    public static int4 int4(int3 xyz, int w) => new(xyz, w);
+    public static int4 int4(int4 xyzw) => new(xyzw);
+    public static bool2 bool2(bool2 xy) => new(xy);
+    public static bool3 bool3(bool x, bool2 yz) => new(x, yz);
+    public static bool3 bool3(bool2 xy, bool z) => new(xy, z);
+    public static bool3 bool3(bool3 xyz) => new(xyz);
+    public static bool4 bool4(bool x, bool y, bool2 zw) => new(x, y, zw);
+    public static bool4 bool4(bool x, bool2 yz, bool w) => new(x, yz, w);
+    public static bool4 bool4(bool x, bool3 yzw) => new(x, yzw);
+    public static bool4 bool4(bool2 xy, bool z, bool w) => new(xy, z, w);
+    public static bool4 bool4(bool2 xy, bool2 zw) => new(xy, zw);
+    public static bool4 bool4(bool3 xyz, bool w) => new(xyz, w);
+    public static bool4 bool4(bool4 xyzw) => new(xyzw);
+}
diff --git a/packages/cultmath/src/CultMath/Swizzles.g.cs.meta b/packages/cultmath/src/CultMath/Swizzles.g.cs.meta
new file mode 100644
index 00000000..035e577f
--- /dev/null
+++ b/packages/cultmath/src/CultMath/Swizzles.g.cs.meta
@@ -0,0 +1,2 @@
+fileFormatVersion: 2
+guid: e89d6089b354459788eb6f0faebfd6c0
diff --git a/packages/cultmath/src/CultMath/UnscopedRefAttribute.cs b/packages/cultmath/src/CultMath/UnscopedRefAttribute.cs
new file mode 100644
index 00000000..6e1e3148
--- /dev/null
+++ b/packages/cultmath/src/CultMath/UnscopedRefAttribute.cs
@@ -0,0 +1,10 @@
+#if !NET7_0_OR_GREATER
+namespace System.Diagnostics.CodeAnalysis;
+
+// Compiler-recognized polyfill so netstandard2.1 builds can return refs into a struct's
+// own fields (the matrix row indexer). net7.0+ supplies the real attribute.
+[AttributeUsage(AttributeTargets.Method | AttributeTargets.Property | AttributeTargets.Parameter, AllowMultiple = false, Inherited = false)]
+internal sealed class UnscopedRefAttribute : Attribute
+{
+}
+#endif
diff --git a/packages/cultmath/src/CultMath/UnscopedRefAttribute.cs.meta b/packages/cultmath/src/CultMath/UnscopedRefAttribute.cs.meta
new file mode 100644
index 00000000..61df7771
--- /dev/null
+++ b/packages/cultmath/src/CultMath/UnscopedRefAttribute.cs.meta
@@ -0,0 +1,2 @@
+fileFormatVersion: 2
+guid: 3f204000f9854517a8dd754e2d9dc975
diff --git a/packages/cultmath/src/CultMath/Voronoi.cs b/packages/cultmath/src/CultMath/Voronoi.cs
new file mode 100644
index 00000000..38b52d81
--- /dev/null
+++ b/packages/cultmath/src/CultMath/Voronoi.cs
@@ -0,0 +1,229 @@
+using System;
+using System.Runtime.InteropServices;
+
+namespace CultMath;
+
+public static class Voronoi
+{
+    public static bool NativeAvailable { get; private set; } = true;
+
+    public static Color32 SampleTone(float x, float y, float resolutionY, int frameIndex, CultMathTone tone, float span)
+    {
+        Span<float> xs = stackalloc[] { x };
+        Span<float> ys = stackalloc[] { y };
+        Span<CultMathTone> tones = stackalloc[] { tone };
+        Span<float> spans = stackalloc[] { span };
+        Span<Color32> colors = stackalloc Color32[1];
+        SampleTones(xs, ys, tones, spans, resolutionY, frameIndex, colors);
+        return colors[0];
+    }
+
+    public static void SampleTones(
+        ReadOnlySpan<float> xs,
+        ReadOnlySpan<float> ys,
+        ReadOnlySpan<CultMathTone> tones,
+        ReadOnlySpan<float> spans,
+        float resolutionY,
+        int frameIndex,
+        Span<Color32> colors)
+    {
+        if (xs.Length != ys.Length || xs.Length != tones.Length || xs.Length != spans.Length || xs.Length != colors.Length)
+        {
+            throw new ArgumentException("CultMath Voronoi batch spans must have equal length.");
+        }
+
+        if (xs.IsEmpty)
+        {
+            return;
+        }
+
+        if (NativeAvailable && TrySampleNative(xs, ys, tones, spans, resolutionY, frameIndex, colors))
+        {
+            return;
+        }
+
+        for (var index = 0; index < xs.Length; index++)
+        {
+            colors[index] = SampleManaged(xs[index], ys[index], resolutionY, frameIndex, tones[index], spans[index]);
+        }
+    }
+
+    private static unsafe bool TrySampleNative(
+        ReadOnlySpan<float> xs,
+        ReadOnlySpan<float> ys,
+        ReadOnlySpan<CultMathTone> tones,
+        ReadOnlySpan<float> spans,
+        float resolutionY,
+        int frameIndex,
+        Span<Color32> colors)
+    {
+        try
+        {
+            fixed (float* xPtr = xs)
+            fixed (float* yPtr = ys)
+            fixed (CultMathTone* tonePtr = tones)
+            fixed (float* spanPtr = spans)
+            fixed (Color32* colorPtr = colors)
+            {
+                var result = Native.cultmath_apollonian_voronoi_tones(
+                    xPtr,
+                    yPtr,
+                    (byte*)tonePtr,
+                    spanPtr,
+                    (nuint)xs.Length,
+                    resolutionY,
+                    frameIndex,
+                    colorPtr);
+                if (result == 0)
+                {
+                    return true;
+                }
+            }
+        }
+        catch (DllNotFoundException)
+        {
+            NativeAvailable = false;
+        }
+        catch (EntryPointNotFoundException)
+        {
+            NativeAvailable = false;
+        }
+
+        return false;
+    }
+
+    private static Color32 SampleManaged(float x, float y, float resolutionY, int frameIndex, CultMathTone tone, float span)
+    {
+        var sample = StableSample(x, y, resolutionY, frameIndex, tone, span);
+        var luminance = math.saturate(sample.x * 0.299f + sample.y * 0.587f + sample.z * 0.114f);
+        if (tone == CultMathTone.Header)
+        {
+            var glow = 0.62f + luminance * 0.38f;
+            return new Color32((byte)(255 * glow), (byte)(96 * glow), (byte)(14 * glow));
+        }
+
+        if (tone == CultMathTone.Body)
+        {
+            var glow = 0.68f + luminance * 0.32f;
+            return new Color32((byte)(245 * glow), (byte)(248 * glow), (byte)(252 * glow));
+        }
+
+        var gain = tone switch
+        {
+            CultMathTone.Panel => 0.42f,
+            CultMathTone.Edge => 1.05f,
+            _ => 0.24f,
+        };
+        var lift = tone switch
+        {
+            CultMathTone.Panel => 14.0f,
+            CultMathTone.Edge => 24.0f,
+            _ => 4.0f,
+        };
+        return new Color32(
+            (byte)Math.Clamp(lift + sample.x * 255.0f * gain, 0, 255),
+            (byte)Math.Clamp(lift + sample.y * 255.0f * gain, 0, 255),
+            (byte)Math.Clamp(lift + sample.z * 255.0f * gain, 0, 255));
+    }
+
+    private static float3 StableSample(float x, float y, float resolutionY, int frameIndex, CultMathTone tone, float span)
+    {
+        var seed = x * 12.9898f + y * 78.233f + Hash1(((byte)tone + 1.0f) * 19.19f);
+        var jitter = new float2((Hash1(seed) - 0.5f) * span, (Hash1(seed + 37.17f) - 0.5f) * span);
+        return SampleField(x + jitter.x, y + jitter.y, resolutionY, frameIndex);
+    }
+
+    private static float3 SampleField(float px, float py, float resolutionY, int frameIndex)
+    {
+        var time = frameIndex / 120.0f;
+        var p = new float2(6.0f * px / Math.Max(1.0f, resolutionY), 6.0f * py / Math.Max(1.0f, resolutionY));
+        var n = math.floor(p);
+        var f = math.frac(p);
+        var distance = 8.0f;
+        var color = float3.zero;
+        const float smoothness = 0.005f;
+        for (var j = -2; j <= 2; j++)
+        {
+            for (var i = -2; i <= 2; i++)
+            {
+                var g = new float2(i, j);
+                var o = Hash2(n + g);
+                var weight = o.x * 0.5f + 0.5f;
+                o = 0.5f + 0.5f * new float2(math.sin(time + 6.2831f * o.x), math.sin(time + 6.2831f * o.y));
+                var d2 = math.abs(g - f + o);
+                var d = Math.Max(d2.x, d2.y) * weight;
+                var seed = Hash1(math.dot(n + g, new float2(7.0f, 113.0f)));
+                var hue = math.frac((n.x + g.x) * 0.173f + (n.y + g.y) * 0.379f + seed * 0.431f);
+                var candidate = PastelSpectrum(hue);
+                var h = math.smoothstep(0.0f, 1.0f, 0.5f + 0.5f * (distance - d) / smoothness);
+                var correction = h * (1.0f - h) * smoothness / (1.0f + 3.0f * smoothness);
+                distance = math.lerp(distance, d, h) - correction;
+                color = math.lerp(color, candidate, h) - correction;
+            }
+        }
+
+        return math.max(float3.zero, color * (1.0f - 0.1f * math.smoothstep(0.04f, 0.05f, distance)));
+    }
+
+    private static float Hash1(float value) => math.frac(math.sin(value) * 43758.5453f);
+
+    private static float3 PastelSpectrum(float hue)
+    {
+        return HsvToRgb(hue, 0.52f, 0.98f);
+    }
+
+    private static float3 HsvToRgb(float hue, float saturation, float value)
+    {
+        var h = math.frac(hue) * 6.0f;
+        var c = value * saturation;
+        var x = c * (1.0f - Math.Abs(h % 2.0f - 1.0f));
+        var m = value - c;
+        float3 rgb;
+        if (h < 1.0f)
+        {
+            rgb = new float3(c, x, 0.0f);
+        }
+        else if (h < 2.0f)
+        {
+            rgb = new float3(x, c, 0.0f);
+        }
+        else if (h < 3.0f)
+        {
+            rgb = new float3(0.0f, c, x);
+        }
+        else if (h < 4.0f)
+        {
+            rgb = new float3(0.0f, x, c);
+        }
+        else if (h < 5.0f)
+        {
+            rgb = new float3(x, 0.0f, c);
+        }
+        else
+        {
+            rgb = new float3(c, 0.0f, x);
+        }
+
+        return rgb + m;
+    }
+
+    private static float2 Hash2(float2 value)
+    {
+        var p = new float2(math.dot(value, new float2(127.1f, 311.7f)), math.dot(value, new float2(269.5f, 183.3f)));
+        return math.frac(new float2(math.sin(p.x) * 43758.5453f, math.sin(p.y) * 43758.5453f));
+    }
+
+    private static unsafe partial class Native
+    {
+        [DllImport("cultmath_core", CallingConvention = CallingConvention.Cdecl)]
+        public static extern int cultmath_apollonian_voronoi_tones(
+            float* xs,
+            float* ys,
+            byte* tones,
+            float* spans,
+            nuint count,
+            float resolutionY,
+            int frameIndex,
+            Color32* outColors);
+    }
+}
diff --git a/packages/cultmath/src/CultMath/Voronoi.cs.meta b/packages/cultmath/src/CultMath/Voronoi.cs.meta
new file mode 100644
index 00000000..6c738085
--- /dev/null
+++ b/packages/cultmath/src/CultMath/Voronoi.cs.meta
@@ -0,0 +1,2 @@
+fileFormatVersion: 2
+guid: cb530f1428ac8ff43939b986986ae959
\ No newline at end of file
diff --git a/packages/cultmath/src/CultMath/bool2.cs b/packages/cultmath/src/CultMath/bool2.cs
new file mode 100644
index 00000000..29710f0c
--- /dev/null
+++ b/packages/cultmath/src/CultMath/bool2.cs
@@ -0,0 +1,51 @@
+using System;
+
+namespace CultMath;
+
+public partial struct bool2 : IEquatable<bool2>
+{
+    public static readonly bool2 @false = new(false, false);
+    public static readonly bool2 @true = new(true, true);
+
+    public bool x;
+    public bool y;
+
+    public bool2(bool x, bool y)
+    {
+        this.x = x;
+        this.y = y;
+    }
+
+    public bool this[int index]
+    {
+        readonly get => index switch
+        {
+            0 => x,
+            1 => y,
+            _ => throw new ArgumentOutOfRangeException(nameof(index)),
+        };
+        set
+        {
+            switch (index)
+            {
+                case 0: x = value; break;
+                case 1: y = value; break;
+                default: throw new ArgumentOutOfRangeException(nameof(index));
+            }
+        }
+    }
+
+    public static implicit operator bool2(bool value) => new(value, value);
+
+    public static bool2 operator !(bool2 value) => new(!value.x, !value.y);
+    public static bool2 operator &(bool2 left, bool2 right) => new(left.x & right.x, left.y & right.y);
+    public static bool2 operator |(bool2 left, bool2 right) => new(left.x | right.x, left.y | right.y);
+    public static bool2 operator ^(bool2 left, bool2 right) => new(left.x ^ right.x, left.y ^ right.y);
+    public static bool2 operator ==(bool2 left, bool2 right) => new(left.x == right.x, left.y == right.y);
+    public static bool2 operator !=(bool2 left, bool2 right) => new(left.x != right.x, left.y != right.y);
+
+    public readonly bool Equals(bool2 other) => x == other.x && y == other.y;
+    public override readonly bool Equals(object? obj) => obj is bool2 other && Equals(other);
+    public override readonly int GetHashCode() => HashCode.Combine(x, y);
+    public override readonly string ToString() => $"bool2({x}, {y})";
+}
diff --git a/packages/cultmath/src/CultMath/bool2.cs.meta b/packages/cultmath/src/CultMath/bool2.cs.meta
new file mode 100644
index 00000000..477ff144
--- /dev/null
+++ b/packages/cultmath/src/CultMath/bool2.cs.meta
@@ -0,0 +1,2 @@
+fileFormatVersion: 2
+guid: 725efb2725e987449a3782452f5a95e0
\ No newline at end of file
diff --git a/packages/cultmath/src/CultMath/bool3.cs b/packages/cultmath/src/CultMath/bool3.cs
new file mode 100644
index 00000000..9e4029c7
--- /dev/null
+++ b/packages/cultmath/src/CultMath/bool3.cs
@@ -0,0 +1,55 @@
+using System;
+
+namespace CultMath;
+
+public partial struct bool3 : IEquatable<bool3>
+{
+    public static readonly bool3 @false = new(false, false, false);
+    public static readonly bool3 @true = new(true, true, true);
+
+    public bool x;
+    public bool y;
+    public bool z;
+
+    public bool3(bool x, bool y, bool z)
+    {
+        this.x = x;
+        this.y = y;
+        this.z = z;
+    }
+
+    public bool this[int index]
+    {
+        readonly get => index switch
+        {
+            0 => x,
+            1 => y,
+            2 => z,
+            _ => throw new ArgumentOutOfRangeException(nameof(index)),
+        };
+        set
+        {
+            switch (index)
+            {
+                case 0: x = value; break;
+                case 1: y = value; break;
+                case 2: z = value; break;
+                default: throw new ArgumentOutOfRangeException(nameof(index));
+            }
+        }
+    }
+
+    public static implicit operator bool3(bool value) => new(value, value, value);
+
+    public static bool3 operator !(bool3 value) => new(!value.x, !value.y, !value.z);
+    public static bool3 operator &(bool3 left, bool3 right) => new(left.x & right.x, left.y & right.y, left.z & right.z);
+    public static bool3 operator |(bool3 left, bool3 right) => new(left.x | right.x, left.y | right.y, left.z | right.z);
+    public static bool3 operator ^(bool3 left, bool3 right) => new(left.x ^ right.x, left.y ^ right.y, left.z ^ right.z);
+    public static bool3 operator ==(bool3 left, bool3 right) => new(left.x == right.x, left.y == right.y, left.z == right.z);
+    public static bool3 operator !=(bool3 left, bool3 right) => new(left.x != right.x, left.y != right.y, left.z != right.z);
+
+    public readonly bool Equals(bool3 other) => x == other.x && y == other.y && z == other.z;
+    public override readonly bool Equals(object? obj) => obj is bool3 other && Equals(other);
+    public override readonly int GetHashCode() => HashCode.Combine(x, y, z);
+    public override readonly string ToString() => $"bool3({x}, {y}, {z})";
+}
diff --git a/packages/cultmath/src/CultMath/bool3.cs.meta b/packages/cultmath/src/CultMath/bool3.cs.meta
new file mode 100644
index 00000000..ada81b6d
--- /dev/null
+++ b/packages/cultmath/src/CultMath/bool3.cs.meta
@@ -0,0 +1,2 @@
+fileFormatVersion: 2
+guid: 323ec670fc374c8ba4d87b4bf4c91f34
diff --git a/packages/cultmath/src/CultMath/bool4.cs b/packages/cultmath/src/CultMath/bool4.cs
new file mode 100644
index 00000000..b12f15b6
--- /dev/null
+++ b/packages/cultmath/src/CultMath/bool4.cs
@@ -0,0 +1,59 @@
+using System;
+
+namespace CultMath;
+
+public partial struct bool4 : IEquatable<bool4>
+{
+    public static readonly bool4 @false = new(false, false, false, false);
+    public static readonly bool4 @true = new(true, true, true, true);
+
+    public bool x;
+    public bool y;
+    public bool z;
+    public bool w;
+
+    public bool4(bool x, bool y, bool z, bool w)
+    {
+        this.x = x;
+        this.y = y;
+        this.z = z;
+        this.w = w;
+    }
+
+    public bool this[int index]
+    {
+        readonly get => index switch
+        {
+            0 => x,
+            1 => y,
+            2 => z,
+            3 => w,
+            _ => throw new ArgumentOutOfRangeException(nameof(index)),
+        };
+        set
+        {
+            switch (index)
+            {
+                case 0: x = value; break;
+                case 1: y = value; break;
+                case 2: z = value; break;
+                case 3: w = value; break;
+                default: throw new ArgumentOutOfRangeException(nameof(index));
+            }
+        }
+    }
+
+    public static implicit operator bool4(bool value) => new(value, value, value, value);
+
+    public static bool4 operator !(bool4 value) => new(!value.x, !value.y, !value.z, !value.w);
+    public static bool4 operator &(bool4 left, bool4 right) => new(left.x & right.x, left.y & right.y, left.z & right.z, left.w & right.w);
+    public static bool4 operator |(bool4 left, bool4 right) => new(left.x | right.x, left.y | right.y, left.z | right.z, left.w | right.w);
+    public static bool4 operator ^(bool4 left, bool4 right) => new(left.x ^ right.x, left.y ^ right.y, left.z ^ right.z, left.w ^ right.w);
+    public static bool4 operator ==(bool4 left, bool4 right) => new(left.x == right.x, left.y == right.y, left.z == right.z, left.w == right.w);
+    public static bool4 operator !=(bool4 left, bool4 right) => new(left.x != right.x, left.y != right.y, left.z != right.z, left.w != right.w);
+
+    public readonly bool Equals(bool4 other) => x == other.x && y == other.y && z == other.z && w == other.w;
+    public override readonly bool Equals(object? obj) => obj is bool4 other && Equals(other);
+    public override readonly int GetHashCode() => HashCode.Combine(x, y, z, w);
+    public override readonly string ToString() => $"bool4({x}, {y}, {z}, {w})";
+}
diff --git a/packages/cultmath/src/CultMath/bool4.cs.meta b/packages/cultmath/src/CultMath/bool4.cs.meta
new file mode 100644
index 00000000..625bb46b
--- /dev/null
+++ b/packages/cultmath/src/CultMath/bool4.cs.meta
@@ -0,0 +1,2 @@
+fileFormatVersion: 2
+guid: d38b9f70d88c459584441b85ecbfd92a
diff --git a/packages/cultmath/src/CultMath/double2.cs b/packages/cultmath/src/CultMath/double2.cs
new file mode 100644
index 00000000..958b409d
--- /dev/null
+++ b/packages/cultmath/src/CultMath/double2.cs
@@ -0,0 +1,58 @@
+using System;
+
+namespace CultMath;
+
+public partial struct double2 : IEquatable<double2>
+{
+    public static readonly double2 zero = new(0.0, 0.0);
+    public static readonly double2 one = new(1.0, 1.0);
+
+    public double x;
+    public double y;
+
+    public double2(double x, double y)
+    {
+        this.x = x;
+        this.y = y;
+    }
+
+    public double this[int index]
+    {
+        readonly get => index switch
+        {
+            0 => x,
+            1 => y,
+            _ => throw new ArgumentOutOfRangeException(nameof(index)),
+        };
+        set
+        {
+            switch (index)
+            {
+                case 0: x = value; break;
+                case 1: y = value; break;
+                default: throw new ArgumentOutOfRangeException(nameof(index));
+            }
+        }
+    }
+
+    public static implicit operator double2(double value) => new(value, value);
+
+    public static double2 operator +(double2 value) => value;
+    public static double2 operator -(double2 value) => new(-value.x, -value.y);
+    public static double2 operator +(double2 left, double2 right) => new(left.x + right.x, left.y + right.y);
+    public static double2 operator -(double2 left, double2 right) => new(left.x - right.x, left.y - right.y);
+    public static double2 operator *(double2 left, double2 right) => new(left.x * right.x, left.y * right.y);
+    public static double2 operator /(double2 left, double2 right) => new(left.x / right.x, left.y / right.y);
+
+    public static bool2 operator <(double2 left, double2 right) => new(left.x < right.x, left.y < right.y);
+    public static bool2 operator >(double2 left, double2 right) => new(left.x > right.x, left.y > right.y);
+    public static bool2 operator <=(double2 left, double2 right) => new(left.x <= right.x, left.y <= right.y);
+    public static bool2 operator >=(double2 left, double2 right) => new(left.x >= right.x, left.y >= right.y);
+    public static bool2 operator ==(double2 left, double2 right) => new(left.x == right.x, left.y == right.y);
+    public static bool2 operator !=(double2 left, double2 right) => new(left.x != right.x, left.y != right.y);
+
+    public readonly bool Equals(double2 other) => x.Equals(other.x) && y.Equals(other.y);
+    public override readonly bool Equals(object? obj) => obj is double2 other && Equals(other);
+    public override readonly int GetHashCode() => HashCode.Combine(x, y);
+    public override readonly string ToString() => FormattableString.Invariant($"double2({x:R}, {y:R})");
+}
diff --git a/packages/cultmath/src/CultMath/double2.cs.meta b/packages/cultmath/src/CultMath/double2.cs.meta
new file mode 100644
index 00000000..61243b2a
--- /dev/null
+++ b/packages/cultmath/src/CultMath/double2.cs.meta
@@ -0,0 +1,2 @@
+fileFormatVersion: 2
+guid: bbe739a5f0216c3459762d2b5ee7401a
\ No newline at end of file
diff --git a/packages/cultmath/src/CultMath/double3.cs b/packages/cultmath/src/CultMath/double3.cs
new file mode 100644
index 00000000..5fbe9c65
--- /dev/null
+++ b/packages/cultmath/src/CultMath/double3.cs
@@ -0,0 +1,62 @@
+using System;
+
+namespace CultMath;
+
+public partial struct double3 : IEquatable<double3>
+{
+    public static readonly double3 zero = new(0.0, 0.0, 0.0);
+    public static readonly double3 one = new(1.0, 1.0, 1.0);
+
+    public double x;
+    public double y;
+    public double z;
+
+    public double3(double x, double y, double z)
+    {
+        this.x = x;
+        this.y = y;
+        this.z = z;
+    }
+
+    public double this[int index]
+    {
+        readonly get => index switch
+        {
+            0 => x,
+            1 => y,
+            2 => z,
+            _ => throw new ArgumentOutOfRangeException(nameof(index)),
+        };
+        set
+        {
+            switch (index)
+            {
+                case 0: x = value; break;
+                case 1: y = value; break;
+                case 2: z = value; break;
+                default: throw new ArgumentOutOfRangeException(nameof(index));
+            }
+        }
+    }
+
+    public static implicit operator double3(double value) => new(value, value, value);
+
+    public static double3 operator +(double3 value) => value;
+    public static double3 operator -(double3 value) => new(-value.x, -value.y, -value.z);
+    public static double3 operator +(double3 left, double3 right) => new(left.x + right.x, left.y + right.y, left.z + right.z);
+    public static double3 operator -(double3 left, double3 right) => new(left.x - right.x, left.y - right.y, left.z - right.z);
+    public static double3 operator *(double3 left, double3 right) => new(left.x * right.x, left.y * right.y, left.z * right.z);
+    public static double3 operator /(double3 left, double3 right) => new(left.x / right.x, left.y / right.y, left.z / right.z);
+
+    public static bool3 operator <(double3 left, double3 right) => new(left.x < right.x, left.y < right.y, left.z < right.z);
+    public static bool3 operator >(double3 left, double3 right) => new(left.x > right.x, left.y > right.y, left.z > right.z);
+    public static bool3 operator <=(double3 left, double3 right) => new(left.x <= right.x, left.y <= right.y, left.z <= right.z);
+    public static bool3 operator >=(double3 left, double3 right) => new(left.x >= right.x, left.y >= right.y, left.z >= right.z);
+    public static bool3 operator ==(double3 left, double3 right) => new(left.x == right.x, left.y == right.y, left.z == right.z);
+    public static bool3 operator !=(double3 left, double3 right) => new(left.x != right.x, left.y != right.y, left.z != right.z);
+
+    public readonly bool Equals(double3 other) => x.Equals(other.x) && y.Equals(other.y) && z.Equals(other.z);
+    public override readonly bool Equals(object? obj) => obj is double3 other && Equals(other);
+    public override readonly int GetHashCode() => HashCode.Combine(x, y, z);
+    public override readonly string ToString() => FormattableString.Invariant($"double3({x:R}, {y:R}, {z:R})");
+}
diff --git a/packages/cultmath/src/CultMath/double3.cs.meta b/packages/cultmath/src/CultMath/double3.cs.meta
new file mode 100644
index 00000000..302d13d8
--- /dev/null
+++ b/packages/cultmath/src/CultMath/double3.cs.meta
@@ -0,0 +1,2 @@
+fileFormatVersion: 2
+guid: 1cbaafd219703ee43ae279aa5cbf407f
\ No newline at end of file
diff --git a/packages/cultmath/src/CultMath/float2.cs b/packages/cultmath/src/CultMath/float2.cs
new file mode 100644
index 00000000..e33655a8
--- /dev/null
+++ b/packages/cultmath/src/CultMath/float2.cs
@@ -0,0 +1,84 @@
+using System;
+
+namespace CultMath;
+
+public partial struct float2 : IEquatable<float2>
+{
+    public static readonly float2 zero = new(0.0f, 0.0f);
+    public static readonly float2 one = new(1.0f, 1.0f);
+
+    public float x;
+    public float y;
+
+    public float2(float x, float y)
+    {
+        this.x = x;
+        this.y = y;
+    }
+
+    public float this[int index]
+    {
+        readonly get => index switch
+        {
+            0 => x,
+            1 => y,
+            _ => throw new ArgumentOutOfRangeException(nameof(index)),
+        };
+        set
+        {
+            switch (index)
+            {
+                case 0: x = value; break;
+                case 1: y = value; break;
+                default: throw new ArgumentOutOfRangeException(nameof(index));
+            }
+        }
+    }
+
+    public static implicit operator float2(float value) => new(value, value);
+    public static explicit operator System.Numerics.Vector2(float2 value) => new(value.x, value.y);
+    public static explicit operator float2(System.Numerics.Vector2 value) => new(value.X, value.Y);
+
+    public static float2 operator +(float2 value) => value;
+    public static float2 operator -(float2 value) => new(-value.x, -value.y);
+
+    public static float2 operator +(float2 left, float2 right) => new(left.x + right.x, left.y + right.y);
+    public static float2 operator +(float2 left, float right) => new(left.x + right, left.y + right);
+    public static float2 operator +(float left, float2 right) => new(left + right.x, left + right.y);
+    public static float2 operator -(float2 left, float2 right) => new(left.x - right.x, left.y - right.y);
+    public static float2 operator -(float2 left, float right) => new(left.x - right, left.y - right);
+    public static float2 operator -(float left, float2 right) => new(left - right.x, left - right.y);
+    public static float2 operator *(float2 left, float2 right) => new(left.x * right.x, left.y * right.y);
+    public static float2 operator *(float2 left, float right) => new(left.x * right, left.y * right);
+    public static float2 operator *(float left, float2 right) => new(left * right.x, left * right.y);
+    public static float2 operator /(float2 left, float2 right) => new(left.x / right.x, left.y / right.y);
+    public static float2 operator /(float2 left, float right) => new(left.x / right, left.y / right);
+    public static float2 operator /(float left, float2 right) => new(left / right.x, left / right.y);
+    public static float2 operator %(float2 left, float2 right) => new(left.x % right.x, left.y % right.y);
+    public static float2 operator %(float2 left, float right) => new(left.x % right, left.y % right);
+    public static float2 operator %(float left, float2 right) => new(left % right.x, left % right.y);
+
+    public static bool2 operator <(float2 left, float2 right) => new(left.x < right.x, left.y < right.y);
+    public static bool2 operator <(float2 left, float right) => new(left.x < right, left.y < right);
+    public static bool2 operator <(float left, float2 right) => new(left < right.x, left < right.y);
+    public static bool2 operator >(float2 left, float2 right) => new(left.x > right.x, left.y > right.y);
+    public static bool2 operator >(float2 left, float right) => new(left.x > right, left.y > right);
+    public static bool2 operator >(float left, float2 right) => new(left > right.x, left > right.y);
+    public static bool2 operator <=(float2 left, float2 right) => new(left.x <= right.x, left.y <= right.y);
+    public static bool2 operator <=(float2 left, float right) => new(left.x <= right, left.y <= right);
+    public static bool2 operator <=(float left, float2 right) => new(left <= right.x, left <= right.y);
+    public static bool2 operator >=(float2 left, float2 right) => new(left.x >= right.x, left.y >= right.y);
+    public static bool2 operator >=(float2 left, float right) => new(left.x >= right, left.y >= right);
+    public static bool2 operator >=(float left, float2 right) => new(left >= right.x, left >= right.y);
+    public static bool2 operator ==(float2 left, float2 right) => new(left.x == right.x, left.y == right.y);
+    public static bool2 operator ==(float2 left, float right) => new(left.x == right, left.y == right);
+    public static bool2 operator ==(float left, float2 right) => new(left == right.x, left == right.y);
+    public static bool2 operator !=(float2 left, float2 right) => new(left.x != right.x, left.y != right.y);
+    public static bool2 operator !=(float2 left, float right) => new(left.x != right, left.y != right);
+    public static bool2 operator !=(float left, float2 right) => new(left != right.x, left != right.y);
+
+    public readonly bool Equals(float2 other) => x.Equals(other.x) && y.Equals(other.y);
+    public override readonly bool Equals(object? obj) => obj is float2 other && Equals(other);
+    public override readonly int GetHashCode() => HashCode.Combine(x, y);
+    public override readonly string ToString() => FormattableString.Invariant($"float2({x:R}, {y:R})");
+}
diff --git a/packages/cultmath/src/CultMath/float2.cs.meta b/packages/cultmath/src/CultMath/float2.cs.meta
new file mode 100644
index 00000000..c82f69ae
--- /dev/null
+++ b/packages/cultmath/src/CultMath/float2.cs.meta
@@ -0,0 +1,2 @@
+fileFormatVersion: 2
+guid: fa066a0aed5494f499d462a2ebc51e50
\ No newline at end of file
diff --git a/packages/cultmath/src/CultMath/float2x2.cs b/packages/cultmath/src/CultMath/float2x2.cs
new file mode 100644
index 00000000..bd8673ae
--- /dev/null
+++ b/packages/cultmath/src/CultMath/float2x2.cs
@@ -0,0 +1,67 @@
+using System;
+using System.Diagnostics.CodeAnalysis;
+
+namespace CultMath;
+
+/// <summary>
+/// HLSL float2x2: row-major. Constructors take rows, <c>m[i]</c> is a writable reference to
+/// row i (so <c>m[1][0] = s</c> works), and <c>_mRC</c> names row R, column C exactly as HLSL
+/// does. Use <see cref="math.mul(float2x2, float2)"/> for products; there is no <c>*</c>
+/// matrix product because HLSL's <c>*</c> is component-wise.
+/// </summary>
+public struct float2x2 : IEquatable<float2x2>
+{
+    public static readonly float2x2 identity = new(1.0f, 0.0f, 0.0f, 1.0f);
+    public static readonly float2x2 zero = new(0.0f, 0.0f, 0.0f, 0.0f);
+
+    private float2 _row0;
+    private float2 _row1;
+
+    public float2x2(float m00, float m01, float m10, float m11)
+    {
+        _row0 = new float2(m00, m01);
+        _row1 = new float2(m10, m11);
+    }
+
+    public float2x2(float2 row0, float2 row1)
+    {
+        _row0 = row0;
+        _row1 = row1;
+    }
+
+    public float _m00 { readonly get => _row0.x; set => _row0.x = value; }
+    public float _m01 { readonly get => _row0.y; set => _row0.y = value; }
+    public float _m10 { readonly get => _row1.x; set => _row1.x = value; }
+    public float _m11 { readonly get => _row1.y; set => _row1.y = value; }
+
+    /// <remarks>Writes through a readonly field, <c>in</c> parameter, property, or <c>identity</c> hit a defensive copy and are lost; write to a local and assign it back.</remarks>
+    [UnscopedRef]
+    public ref float2 this[int row]
+    {
+        get
+        {
+            switch (row)
+            {
+                case 0: return ref _row0;
+                case 1: return ref _row1;
+                default: throw new ArgumentOutOfRangeException(nameof(row));
+            }
+        }
+    }
+
+    /// <summary>
+    /// Counter-clockwise rotation for column vectors: <c>mul(Rotate(a), v)</c> equals
+    /// <c>math.rotate(v, a)</c>; <c>mul(v, Rotate(a))</c> rotates the other way.
+    /// </summary>
+    public static float2x2 Rotate(float radians)
+    {
+        var s = MathF.Sin(radians);
+        var c = MathF.Cos(radians);
+        return new float2x2(c, -s, s, c);
+    }
+
+    public readonly bool Equals(float2x2 other) => _row0.Equals(other._row0) && _row1.Equals(other._row1);
+    public override readonly bool Equals(object? obj) => obj is float2x2 other && Equals(other);
+    public override readonly int GetHashCode() => HashCode.Combine(_row0, _row1);
+    public override readonly string ToString() => FormattableString.Invariant($"float2x2({_row0.x:R}, {_row0.y:R}, {_row1.x:R}, {_row1.y:R})");
+}
diff --git a/packages/cultmath/src/CultMath/float2x2.cs.meta b/packages/cultmath/src/CultMath/float2x2.cs.meta
new file mode 100644
index 00000000..56840df7
--- /dev/null
+++ b/packages/cultmath/src/CultMath/float2x2.cs.meta
@@ -0,0 +1,2 @@
+fileFormatVersion: 2
+guid: c0dcec14c0b7432dbd8ba0bebb0a7c2f
diff --git a/packages/cultmath/src/CultMath/float3.cs b/packages/cultmath/src/CultMath/float3.cs
new file mode 100644
index 00000000..ca83628b
--- /dev/null
+++ b/packages/cultmath/src/CultMath/float3.cs
@@ -0,0 +1,88 @@
+using System;
+
+namespace CultMath;
+
+public partial struct float3 : IEquatable<float3>
+{
+    public static readonly float3 zero = new(0.0f, 0.0f, 0.0f);
+    public static readonly float3 one = new(1.0f, 1.0f, 1.0f);
+
+    public float x;
+    public float y;
+    public float z;
+
+    public float3(float x, float y, float z)
+    {
+        this.x = x;
+        this.y = y;
+        this.z = z;
+    }
+
+    public float this[int index]
+    {
+        readonly get => index switch
+        {
+            0 => x,
+            1 => y,
+            2 => z,
+            _ => throw new ArgumentOutOfRangeException(nameof(index)),
+        };
+        set
+        {
+            switch (index)
+            {
+                case 0: x = value; break;
+                case 1: y = value; break;
+                case 2: z = value; break;
+                default: throw new ArgumentOutOfRangeException(nameof(index));
+            }
+        }
+    }
+
+    public static implicit operator float3(float value) => new(value, value, value);
+    public static explicit operator System.Numerics.Vector3(float3 value) => new(value.x, value.y, value.z);
+    public static explicit operator float3(System.Numerics.Vector3 value) => new(value.X, value.Y, value.Z);
+
+    public static float3 operator +(float3 value) => value;
+    public static float3 operator -(float3 value) => new(-value.x, -value.y, -value.z);
+
+    public static float3 operator +(float3 left, float3 right) => new(left.x + right.x, left.y + right.y, left.z + right.z);
+    public static float3 operator +(float3 left, float right) => new(left.x + right, left.y + right, left.z + right);
+    public static float3 operator +(float left, float3 right) => new(left + right.x, left + right.y, left + right.z);
+    public static float3 operator -(float3 left, float3 right) => new(left.x - right.x, left.y - right.y, left.z - right.z);
+    public static float3 operator -(float3 left, float right) => new(left.x - right, left.y - right, left.z - right);
+    public static float3 operator -(float left, float3 right) => new(left - right.x, left - right.y, left - right.z);
+    public static float3 operator *(float3 left, float3 right) => new(left.x * right.x, left.y * right.y, left.z * right.z);
+    public static float3 operator *(float3 left, float right) => new(left.x * right, left.y * right, left.z * right);
+    public static float3 operator *(float left, float3 right) => new(left * right.x, left * right.y, left * right.z);
+    public static float3 operator /(float3 left, float3 right) => new(left.x / right.x, left.y / right.y, left.z / right.z);
+    public static float3 operator /(float3 left, float right) => new(left.x / right, left.y / right, left.z / right);
+    public static float3 operator /(float left, float3 right) => new(left / right.x, left / right.y, left / right.z);
+    public static float3 operator %(float3 left, float3 right) => new(left.x % right.x, left.y % right.y, left.z % right.z);
+    public static float3 operator %(float3 left, float right) => new(left.x % right, left.y % right, left.z % right);
+    public static float3 operator %(float left, float3 right) => new(left % right.x, left % right.y, left % right.z);
+
+    public static bool3 operator <(float3 left, float3 right) => new(left.x < right.x, left.y < right.y, left.z < right.z);
+    public static bool3 operator <(float3 left, float right) => new(left.x < right, left.y < right, left.z < right);
+    public static bool3 operator <(float left, float3 right) => new(left < right.x, left < right.y, left < right.z);
+    public static bool3 operator >(float3 left, float3 right) => new(left.x > right.x, left.y > right.y, left.z > right.z);
+    public static bool3 operator >(float3 left, float right) => new(left.x > right, left.y > right, left.z > right);
+    public static bool3 operator >(float left, float3 right) => new(left > right.x, left > right.y, left > right.z);
+    public static bool3 operator <=(float3 left, float3 right) => new(left.x <= right.x, left.y <= right.y, left.z <= right.z);
+    public static bool3 operator <=(float3 left, float right) => new(left.x <= right, left.y <= right, left.z <= right);
+    public static bool3 operator <=(float left, float3 right) => new(left <= right.x, left <= right.y, left <= right.z);
+    public static bool3 operator >=(float3 left, float3 right) => new(left.x >= right.x, left.y >= right.y, left.z >= right.z);
+    public static bool3 operator >=(float3 left, float right) => new(left.x >= right, left.y >= right, left.z >= right);
+    public static bool3 operator >=(float left, float3 right) => new(left >= right.x, left >= right.y, left >= right.z);
+    public static bool3 operator ==(float3 left, float3 right) => new(left.x == right.x, left.y == right.y, left.z == right.z);
+    public static bool3 operator ==(float3 left, float right) => new(left.x == right, left.y == right, left.z == right);
+    public static bool3 operator ==(float left, float3 right) => new(left == right.x, left == right.y, left == right.z);
+    public static bool3 operator !=(float3 left, float3 right) => new(left.x != right.x, left.y != right.y, left.z != right.z);
+    public static bool3 operator !=(float3 left, float right) => new(left.x != right, left.y != right, left.z != right);
+    public static bool3 operator !=(float left, float3 right) => new(left != right.x, left != right.y, left != right.z);
+
+    public readonly bool Equals(float3 other) => x.Equals(other.x) && y.Equals(other.y) && z.Equals(other.z);
+    public override readonly bool Equals(object? obj) => obj is float3 other && Equals(other);
+    public override readonly int GetHashCode() => HashCode.Combine(x, y, z);
+    public override readonly string ToString() => FormattableString.Invariant($"float3({x:R}, {y:R}, {z:R})");
+}
diff --git a/packages/cultmath/src/CultMath/float3.cs.meta b/packages/cultmath/src/CultMath/float3.cs.meta
new file mode 100644
index 00000000..3c649c4a
--- /dev/null
+++ b/packages/cultmath/src/CultMath/float3.cs.meta
@@ -0,0 +1,2 @@
+fileFormatVersion: 2
+guid: 58a355dd1cf6b9f48a7595eea0c0e1f2
\ No newline at end of file
diff --git a/packages/cultmath/src/CultMath/float3x3.cs b/packages/cultmath/src/CultMath/float3x3.cs
new file mode 100644
index 00000000..d7aad21c
--- /dev/null
+++ b/packages/cultmath/src/CultMath/float3x3.cs
@@ -0,0 +1,116 @@
+using System;
+using System.Diagnostics.CodeAnalysis;
+
+namespace CultMath;
+
+/// <summary>
+/// HLSL float3x3: row-major. Constructors take rows, <c>m[i]</c> is a writable reference to
+/// row i (so <c>m[1][2] = s</c> works), and <c>_mRC</c> names row R, column C exactly as HLSL
+/// does. Use <see cref="math.mul(float3x3, float3)"/> for products; there is no <c>*</c>
+/// matrix product because HLSL's <c>*</c> is component-wise.
+/// </summary>
+public struct float3x3 : IEquatable<float3x3>
+{
+    public static readonly float3x3 identity = new(1.0f, 0.0f, 0.0f, 0.0f, 1.0f, 0.0f, 0.0f, 0.0f, 1.0f);
+    public static readonly float3x3 zero = new(0.0f, 0.0f, 0.0f, 0.0f, 0.0f, 0.0f, 0.0f, 0.0f, 0.0f);
+
+    private float3 _row0;
+    private float3 _row1;
+    private float3 _row2;
+
+    public float3x3(float m00, float m01, float m02, float m10, float m11, float m12, float m20, float m21, float m22)
+    {
+        _row0 = new float3(m00, m01, m02);
+        _row1 = new float3(m10, m11, m12);
+        _row2 = new float3(m20, m21, m22);
+    }
+
+    public float3x3(float3 row0, float3 row1, float3 row2)
+    {
+        _row0 = row0;
+        _row1 = row1;
+        _row2 = row2;
+    }
+
+    public float _m00 { readonly get => _row0.x; set => _row0.x = value; }
+    public float _m01 { readonly get => _row0.y; set => _row0.y = value; }
+    public float _m02 { readonly get => _row0.z; set => _row0.z = value; }
+    public float _m10 { readonly get => _row1.x; set => _row1.x = value; }
+    public float _m11 { readonly get => _row1.y; set => _row1.y = value; }
+    public float _m12 { readonly get => _row1.z; set => _row1.z = value; }
+    public float _m20 { readonly get => _row2.x; set => _row2.x = value; }
+    public float _m21 { readonly get => _row2.y; set => _row2.y = value; }
+    public float _m22 { readonly get => _row2.z; set => _row2.z = value; }
+
+    /// <remarks>Writes through a readonly field, <c>in</c> parameter, property, or <c>identity</c> hit a defensive copy and are lost; write to a local and assign it back.</remarks>
+    [UnscopedRef]
+    public ref float3 this[int row]
+    {
+        get
+        {
+            switch (row)
+            {
+                case 0: return ref _row0;
+                case 1: return ref _row1;
+                case 2: return ref _row2;
+                default: throw new ArgumentOutOfRangeException(nameof(row));
+            }
+        }
+    }
+
+    /// <summary>Rotation about +X for column vectors (<c>mul(m, v)</c>).</summary>
+    public static float3x3 RotateX(float radians)
+    {
+        var s = MathF.Sin(radians);
+        var c = MathF.Cos(radians);
+        return new float3x3(1.0f, 0.0f, 0.0f, 0.0f, c, -s, 0.0f, s, c);
+    }
+
+    /// <summary>Rotation about +Y for column vectors (<c>mul(m, v)</c>).</summary>
+    public static float3x3 RotateY(float radians)
+    {
+        var s = MathF.Sin(radians);
+        var c = MathF.Cos(radians);
+        return new float3x3(c, 0.0f, s, 0.0f, 1.0f, 0.0f, -s, 0.0f, c);
+    }
+
+    /// <summary>Rotation about +Z for column vectors (<c>mul(m, v)</c>).</summary>
+    public static float3x3 RotateZ(float radians)
+    {
+        var s = MathF.Sin(radians);
+        var c = MathF.Cos(radians);
+        return new float3x3(c, -s, 0.0f, s, c, 0.0f, 0.0f, 0.0f, 1.0f);
+    }
+
+    /// <summary>
+    /// Extrinsic Euler rotation in radians. The order names the axis applied first:
+    /// <see cref="math.RotationOrder.YXZ"/> rotates about Y, then X, then Z, so the
+    /// matrix is <c>mul(RotateZ, mul(RotateX, RotateY))</c> for column vectors.
+    /// </summary>
+    public static float3x3 Euler(float3 xyz, math.RotationOrder order = math.RotationOrder.Default)
+    {
+        var x = RotateX(xyz.x);
+        var y = RotateY(xyz.y);
+        var z = RotateZ(xyz.z);
+        return order switch
+        {
+            math.RotationOrder.XYZ => math.mul(z, math.mul(y, x)),
+            math.RotationOrder.XZY => math.mul(y, math.mul(z, x)),
+            math.RotationOrder.YXZ => math.mul(z, math.mul(x, y)),
+            math.RotationOrder.YZX => math.mul(x, math.mul(z, y)),
+            math.RotationOrder.ZXY => math.mul(y, math.mul(x, z)),
+            math.RotationOrder.ZYX => math.mul(x, math.mul(y, z)),
+            _ => throw new ArgumentOutOfRangeException(nameof(order)),
+        };
+    }
+
+    public static float3x3 Euler(float x, float y, float z, math.RotationOrder order = math.RotationOrder.Default) =>
+        Euler(new float3(x, y, z), order);
+
+    public readonly bool Equals(float3x3 other) => _row0.Equals(other._row0) && _row1.Equals(other._row1) && _row2.Equals(other._row2);
+    public override readonly bool Equals(object? obj) => obj is float3x3 other && Equals(other);
+    public override readonly int GetHashCode() => HashCode.Combine(_row0, _row1, _row2);
+
+    public override readonly string ToString() =>
+        FormattableString.Invariant($"float3x3({_row0.x:R}, {_row0.y:R}, {_row0.z:R}, {_row1.x:R}, {_row1.y:R}, {_row1.z:R}, {_row2.x:R}, {_row2.y:R}, {_row2.z:R})");
+}
diff --git a/packages/cultmath/src/CultMath/float3x3.cs.meta b/packages/cultmath/src/CultMath/float3x3.cs.meta
new file mode 100644
index 00000000..99b25ed3
--- /dev/null
+++ b/packages/cultmath/src/CultMath/float3x3.cs.meta
@@ -0,0 +1,2 @@
+fileFormatVersion: 2
+guid: 9ca36a9bfff144a9b51478a6d7b19c8e
diff --git a/packages/cultmath/src/CultMath/float4.cs b/packages/cultmath/src/CultMath/float4.cs
new file mode 100644
index 00000000..3f647971
--- /dev/null
+++ b/packages/cultmath/src/CultMath/float4.cs
@@ -0,0 +1,92 @@
+using System;
+
+namespace CultMath;
+
+public partial struct float4 : IEquatable<float4>
+{
+    public static readonly float4 zero = new(0.0f, 0.0f, 0.0f, 0.0f);
+    public static readonly float4 one = new(1.0f, 1.0f, 1.0f, 1.0f);
+
+    public float x;
+    public float y;
+    public float z;
+    public float w;
+
+    public float4(float x, float y, float z, float w)
+    {
+        this.x = x;
+        this.y = y;
+        this.z = z;
+        this.w = w;
+    }
+
+    public float this[int index]
+    {
+        readonly get => index switch
+        {
+            0 => x,
+            1 => y,
+            2 => z,
+            3 => w,
+            _ => throw new ArgumentOutOfRangeException(nameof(index)),
+        };
+        set
+        {
+            switch (index)
+            {
+                case 0: x = value; break;
+                case 1: y = value; break;
+                case 2: z = value; break;
+                case 3: w = value; break;
+                default: throw new ArgumentOutOfRangeException(nameof(index));
+            }
+        }
+    }
+
+    public static implicit operator float4(float value) => new(value, value, value, value);
+    public static explicit operator System.Numerics.Vector4(float4 value) => new(value.x, value.y, value.z, value.w);
+    public static explicit operator float4(System.Numerics.Vector4 value) => new(value.X, value.Y, value.Z, value.W);
+
+    public static float4 operator +(float4 value) => value;
+    public static float4 operator -(float4 value) => new(-value.x, -value.y, -value.z, -value.w);
+
+    public static float4 operator +(float4 left, float4 right) => new(left.x + right.x, left.y + right.y, left.z + right.z, left.w + right.w);
+    public static float4 operator +(float4 left, float right) => new(left.x + right, left.y + right, left.z + right, left.w + right);
+    public static float4 operator +(float left, float4 right) => new(left + right.x, left + right.y, left + right.z, left + right.w);
+    public static float4 operator -(float4 left, float4 right) => new(left.x - right.x, left.y - right.y, left.z - right.z, left.w - right.w);
+    public static float4 operator -(float4 left, float right) => new(left.x - right, left.y - right, left.z - right, left.w - right);
+    public static float4 operator -(float left, float4 right) => new(left - right.x, left - right.y, left - right.z, left - right.w);
+    public static float4 operator *(float4 left, float4 right) => new(left.x * right.x, left.y * right.y, left.z * right.z, left.w * right.w);
+    public static float4 operator *(float4 left, float right) => new(left.x * right, left.y * right, left.z * right, left.w * right);
+    public static float4 operator *(float left, float4 right) => new(left * right.x, left * right.y, left * right.z, left * right.w);
+    public static float4 operator /(float4 left, float4 right) => new(left.x / right.x, left.y / right.y, left.z / right.z, left.w / right.w);
+    public static float4 operator /(float4 left, float right) => new(left.x / right, left.y / right, left.z / right, left.w / right);
+    public static float4 operator /(float left, float4 right) => new(left / right.x, left / right.y, left / right.z, left / right.w);
+    public static float4 operator %(float4 left, float4 right) => new(left.x % right.x, left.y % right.y, left.z % right.z, left.w % right.w);
+    public static float4 operator %(float4 left, float right) => new(left.x % right, left.y % right, left.z % right, left.w % right);
+    public static float4 operator %(float left, float4 right) => new(left % right.x, left % right.y, left % right.z, left % right.w);
+
+    public static bool4 operator <(float4 left, float4 right) => new(left.x < right.x, left.y < right.y, left.z < right.z, left.w < right.w);
+    public static bool4 operator <(float4 left, float right) => new(left.x < right, left.y < right, left.z < right, left.w < right);
+    public static bool4 operator <(float left, float4 right) => new(left < right.x, left < right.y, left < right.z, left < right.w);
+    public static bool4 operator >(float4 left, float4 right) => new(left.x > right.x, left.y > right.y, left.z > right.z, left.w > right.w);
+    public static bool4 operator >(float4 left, float right) => new(left.x > right, left.y > right, left.z > right, left.w > right);
+    public static bool4 operator >(float left, float4 right) => new(left > right.x, left > right.y, left > right.z, left > right.w);
+    public static bool4 operator <=(float4 left, float4 right) => new(left.x <= right.x, left.y <= right.y, left.z <= right.z, left.w <= right.w);
+    public static bool4 operator <=(float4 left, float right) => new(left.x <= right, left.y <= right, left.z <= right, left.w <= right);
+    public static bool4 operator <=(float left, float4 right) => new(left <= right.x, left <= right.y, left <= right.z, left <= right.w);
+    public static bool4 operator >=(float4 left, float4 right) => new(left.x >= right.x, left.y >= right.y, left.z >= right.z, left.w >= right.w);
+    public static bool4 operator >=(float4 left, float right) => new(left.x >= right, left.y >= right, left.z >= right, left.w >= right);
+    public static bool4 operator >=(float left, float4 right) => new(left >= right.x, left >= right.y, left >= right.z, left >= right.w);
+    public static bool4 operator ==(float4 left, float4 right) => new(left.x == right.x, left.y == right.y, left.z == right.z, left.w == right.w);
+    public static bool4 operator ==(float4 left, float right) => new(left.x == right, left.y == right, left.z == right, left.w == right);
+    public static bool4 operator ==(float left, float4 right) => new(left == right.x, left == right.y, left == right.z, left == right.w);
+    public static bool4 operator !=(float4 left, float4 right) => new(left.x != right.x, left.y != right.y, left.z != right.z, left.w != right.w);
+    public static bool4 operator !=(float4 left, float right) => new(left.x != right, left.y != right, left.z != right, left.w != right);
+    public static bool4 operator !=(float left, float4 right) => new(left != right.x, left != right.y, left != right.z, left != right.w);
+
+    public readonly bool Equals(float4 other) => x.Equals(other.x) && y.Equals(other.y) && z.Equals(other.z) && w.Equals(other.w);
+    public override readonly bool Equals(object? obj) => obj is float4 other && Equals(other);
+    public override readonly int GetHashCode() => HashCode.Combine(x, y, z, w);
+    public override readonly string ToString() => FormattableString.Invariant($"float4({x:R}, {y:R}, {z:R}, {w:R})");
+}
diff --git a/packages/cultmath/src/CultMath/float4.cs.meta b/packages/cultmath/src/CultMath/float4.cs.meta
new file mode 100644
index 00000000..206444e0
--- /dev/null
+++ b/packages/cultmath/src/CultMath/float4.cs.meta
@@ -0,0 +1,2 @@
+fileFormatVersion: 2
+guid: fe24fbdab33538849bc6be0afbb0a692
\ No newline at end of file
diff --git a/packages/cultmath/src/CultMath/int2.cs b/packages/cultmath/src/CultMath/int2.cs
new file mode 100644
index 00000000..f690a25d
--- /dev/null
+++ b/packages/cultmath/src/CultMath/int2.cs
@@ -0,0 +1,62 @@
+using System;
+
+namespace CultMath;
+
+public partial struct int2 : IEquatable<int2>
+{
+    public static readonly int2 zero = new(0, 0);
+    public static readonly int2 one = new(1, 1);
+
+    public int x;
+    public int y;
+
+    public int2(int x, int y)
+    {
+        this.x = x;
+        this.y = y;
+    }
+
+    public int this[int index]
+    {
+        readonly get => index switch
+        {
+            0 => x,
+            1 => y,
+            _ => throw new ArgumentOutOfRangeException(nameof(index)),
+        };
+        set
+        {
+            switch (index)
+            {
+                case 0: x = value; break;
+                case 1: y = value; break;
+                default: throw new ArgumentOutOfRangeException(nameof(index));
+            }
+        }
+    }
+
+    public static implicit operator int2(int value) => new(value, value);
+    public static implicit operator float2(int2 value) => new(value.x, value.y);
+    public static explicit operator System.Numerics.Vector2(int2 value) => new(value.x, value.y);
+    public static explicit operator int2(System.Numerics.Vector2 value) => new((int)value.X, (int)value.Y);
+
+    public static int2 operator +(int2 value) => value;
+    public static int2 operator -(int2 value) => new(-value.x, -value.y);
+    public static int2 operator +(int2 left, int2 right) => new(left.x + right.x, left.y + right.y);
+    public static int2 operator -(int2 left, int2 right) => new(left.x - right.x, left.y - right.y);
+    public static int2 operator *(int2 left, int2 right) => new(left.x * right.x, left.y * right.y);
+    public static int2 operator /(int2 left, int2 right) => new(left.x / right.x, left.y / right.y);
+    public static int2 operator %(int2 left, int2 right) => new(left.x % right.x, left.y % right.y);
+
+    public static bool2 operator <(int2 left, int2 right) => new(left.x < right.x, left.y < right.y);
+    public static bool2 operator >(int2 left, int2 right) => new(left.x > right.x, left.y > right.y);
+    public static bool2 operator <=(int2 left, int2 right) => new(left.x <= right.x, left.y <= right.y);
+    public static bool2 operator >=(int2 left, int2 right) => new(left.x >= right.x, left.y >= right.y);
+    public static bool2 operator ==(int2 left, int2 right) => new(left.x == right.x, left.y == right.y);
+    public static bool2 operator !=(int2 left, int2 right) => new(left.x != right.x, left.y != right.y);
+
+    public readonly bool Equals(int2 other) => x == other.x && y == other.y;
+    public override readonly bool Equals(object? obj) => obj is int2 other && Equals(other);
+    public override readonly int GetHashCode() => HashCode.Combine(x, y);
+    public override readonly string ToString() => FormattableString.Invariant($"int2({x}, {y})");
+}
diff --git a/packages/cultmath/src/CultMath/int2.cs.meta b/packages/cultmath/src/CultMath/int2.cs.meta
new file mode 100644
index 00000000..5920328a
--- /dev/null
+++ b/packages/cultmath/src/CultMath/int2.cs.meta
@@ -0,0 +1,2 @@
+fileFormatVersion: 2
+guid: 577b174a998aaa4478ec26e7a6782f46
\ No newline at end of file
diff --git a/packages/cultmath/src/CultMath/int3.cs b/packages/cultmath/src/CultMath/int3.cs
new file mode 100644
index 00000000..454a8970
--- /dev/null
+++ b/packages/cultmath/src/CultMath/int3.cs
@@ -0,0 +1,64 @@
+using System;
+
+namespace CultMath;
+
+public partial struct int3 : IEquatable<int3>
+{
+    public static readonly int3 zero = new(0, 0, 0);
+    public static readonly int3 one = new(1, 1, 1);
+
+    public int x;
+    public int y;
+    public int z;
+
+    public int3(int x, int y, int z)
+    {
+        this.x = x;
+        this.y = y;
+        this.z = z;
+    }
+
+    public int this[int index]
+    {
+        readonly get => index switch
+        {
+            0 => x,
+            1 => y,
+            2 => z,
+            _ => throw new ArgumentOutOfRangeException(nameof(index)),
+        };
+        set
+        {
+            switch (index)
+            {
+                case 0: x = value; break;
+                case 1: y = value; break;
+                case 2: z = value; break;
+                default: throw new ArgumentOutOfRangeException(nameof(index));
+            }
+        }
+    }
+
+    public static implicit operator int3(int value) => new(value, value, value);
+    public static implicit operator float3(int3 value) => new(value.x, value.y, value.z);
+
+    public static int3 operator +(int3 value) => value;
+    public static int3 operator -(int3 value) => new(-value.x, -value.y, -value.z);
+    public static int3 operator +(int3 left, int3 right) => new(left.x + right.x, left.y + right.y, left.z + right.z);
+    public static int3 operator -(int3 left, int3 right) => new(left.x - right.x, left.y - right.y, left.z - right.z);
+    public static int3 operator *(int3 left, int3 right) => new(left.x * right.x, left.y * right.y, left.z * right.z);
+    public static int3 operator /(int3 left, int3 right) => new(left.x / right.x, left.y / right.y, left.z / right.z);
+    public static int3 operator %(int3 left, int3 right) => new(left.x % right.x, left.y % right.y, left.z % right.z);
+
+    public static bool3 operator <(int3 left, int3 right) => new(left.x < right.x, left.y < right.y, left.z < right.z);
+    public static bool3 operator >(int3 left, int3 right) => new(left.x > right.x, left.y > right.y, left.z > right.z);
+    public static bool3 operator <=(int3 left, int3 right) => new(left.x <= right.x, left.y <= right.y, left.z <= right.z);
+    public static bool3 operator >=(int3 left, int3 right) => new(left.x >= right.x, left.y >= right.y, left.z >= right.z);
+    public static bool3 operator ==(int3 left, int3 right) => new(left.x == right.x, left.y == right.y, left.z == right.z);
+    public static bool3 operator !=(int3 left, int3 right) => new(left.x != right.x, left.y != right.y, left.z != right.z);
+
+    public readonly bool Equals(int3 other) => x == other.x && y == other.y && z == other.z;
+    public override readonly bool Equals(object? obj) => obj is int3 other && Equals(other);
+    public override readonly int GetHashCode() => HashCode.Combine(x, y, z);
+    public override readonly string ToString() => FormattableString.Invariant($"int3({x}, {y}, {z})");
+}
diff --git a/packages/cultmath/src/CultMath/int3.cs.meta b/packages/cultmath/src/CultMath/int3.cs.meta
new file mode 100644
index 00000000..d0400303
--- /dev/null
+++ b/packages/cultmath/src/CultMath/int3.cs.meta
@@ -0,0 +1,2 @@
+fileFormatVersion: 2
+guid: 42ee98aace354db19b3ae87bdcbc1df9
diff --git a/packages/cultmath/src/CultMath/int4.cs b/packages/cultmath/src/CultMath/int4.cs
new file mode 100644
index 00000000..caaaeb9e
--- /dev/null
+++ b/packages/cultmath/src/CultMath/int4.cs
@@ -0,0 +1,68 @@
+using System;
+
+namespace CultMath;
+
+public partial struct int4 : IEquatable<int4>
+{
+    public static readonly int4 zero = new(0, 0, 0, 0);
+    public static readonly int4 one = new(1, 1, 1, 1);
+
+    public int x;
+    public int y;
+    public int z;
+    public int w;
+
+    public int4(int x, int y, int z, int w)
+    {
+        this.x = x;
+        this.y = y;
+        this.z = z;
+        this.w = w;
+    }
+
+    public int this[int index]
+    {
+        readonly get => index switch
+        {
+            0 => x,
+            1 => y,
+            2 => z,
+            3 => w,
+            _ => throw new ArgumentOutOfRangeException(nameof(index)),
+        };
+        set
+        {
+            switch (index)
+            {
+                case 0: x = value; break;
+                case 1: y = value; break;
+                case 2: z = value; break;
+                case 3: w = value; break;
+                default: throw new ArgumentOutOfRangeException(nameof(index));
+            }
+        }
+    }
+
+    public static implicit operator int4(int value) => new(value, value, value, value);
+    public static implicit operator float4(int4 value) => new(value.x, value.y, value.z, value.w);
+
+    public static int4 operator +(int4 value) => value;
+    public static int4 operator -(int4 value) => new(-value.x, -value.y, -value.z, -value.w);
+    public static int4 operator +(int4 left, int4 right) => new(left.x + right.x, left.y + right.y, left.z + right.z, left.w + right.w);
+    public static int4 operator -(int4 left, int4 right) => new(left.x - right.x, left.y - right.y, left.z - right.z, left.w - right.w);
+    public static int4 operator *(int4 left, int4 right) => new(left.x * right.x, left.y * right.y, left.z * right.z, left.w * right.w);
+    public static int4 operator /(int4 left, int4 right) => new(left.x / right.x, left.y / right.y, left.z / right.z, left.w / right.w);
+    public static int4 operator %(int4 left, int4 right) => new(left.x % right.x, left.y % right.y, left.z % right.z, left.w % right.w);
+
+    public static bool4 operator <(int4 left, int4 right) => new(left.x < right.x, left.y < right.y, left.z < right.z, left.w < right.w);
+    public static bool4 operator >(int4 left, int4 right) => new(left.x > right.x, left.y > right.y, left.z > right.z, left.w > right.w);
+    public static bool4 operator <=(int4 left, int4 right) => new(left.x <= right.x, left.y <= right.y, left.z <= right.z, left.w <= right.w);
+    public static bool4 operator >=(int4 left, int4 right) => new(left.x >= right.x, left.y >= right.y, left.z >= right.z, left.w >= right.w);
+    public static bool4 operator ==(int4 left, int4 right) => new(left.x == right.x, left.y == right.y, left.z == right.z, left.w == right.w);
+    public static bool4 operator !=(int4 left, int4 right) => new(left.x != right.x, left.y != right.y, left.z != right.z, left.w != right.w);
+
+    public readonly bool Equals(int4 other) => x == other.x && y == other.y && z == other.z && w == other.w;
+    public override readonly bool Equals(object? obj) => obj is int4 other && Equals(other);
+    public override readonly int GetHashCode() => HashCode.Combine(x, y, z, w);
+    public override readonly string ToString() => FormattableString.Invariant($"int4({x}, {y}, {z}, {w})");
+}
diff --git a/packages/cultmath/src/CultMath/int4.cs.meta b/packages/cultmath/src/CultMath/int4.cs.meta
new file mode 100644
index 00000000..48d0eaba
--- /dev/null
+++ b/packages/cultmath/src/CultMath/int4.cs.meta
@@ -0,0 +1,2 @@
+fileFormatVersion: 2
+guid: 1a313709f76a430eb83901bb2d05c74e
diff --git a/packages/cultmath/src/CultMath/math.cs b/packages/cultmath/src/CultMath/math.cs
new file mode 100644
index 00000000..ca74857f
--- /dev/null
+++ b/packages/cultmath/src/CultMath/math.cs
@@ -0,0 +1,623 @@
+using System;
+
+namespace CultMath;
+
+public static partial class math
+{
+    public const float PI = MathF.PI;
+    public const float TAU = MathF.PI * 2.0f;
+    public const float HALF_PI = MathF.PI * 0.5f;
+
+    /// <summary>
+    /// Extrinsic Euler order for <see cref="CultMath.float3x3.Euler(CultMath.float3, RotationOrder)"/>:
+    /// the first letter is the axis applied first. Nested here so <c>using static CultMath.math;</c>
+    /// brings it into scope with the rest of the shader vocabulary.
+    /// </summary>
+    public enum RotationOrder : byte
+    {
+        XYZ,
+        XZY,
+        YXZ,
+        YZX,
+        ZXY,
+        ZYX,
+        Default = ZXY,
+    }
+
+    public static float2 float2(float x, float y) => new(x, y);
+    public static float2 float2(float value) => new(value, value);
+    public static bool2 bool2(bool x, bool y) => new(x, y);
+    public static bool2 bool2(bool value) => new(value, value);
+    public static int2 int2(int x, int y) => new(x, y);
+    public static int2 int2(int value) => new(value, value);
+    // Mixed constructor functions (float4(float2, float2), ...) are generated in Swizzles.g.cs.
+    public static float3 float3(float x, float y, float z) => new(x, y, z);
+    public static float3 float3(float value) => new(value, value, value);
+    public static float4 float4(float x, float y, float z, float w) => new(x, y, z, w);
+    public static float4 float4(float value) => new(value, value, value, value);
+    public static bool3 bool3(bool x, bool y, bool z) => new(x, y, z);
+    public static bool3 bool3(bool value) => new(value, value, value);
+    public static bool4 bool4(bool x, bool y, bool z, bool w) => new(x, y, z, w);
+    public static bool4 bool4(bool value) => new(value, value, value, value);
+    public static int3 int3(int x, int y, int z) => new(x, y, z);
+    public static int3 int3(int value) => new(value, value, value);
+    public static int4 int4(int x, int y, int z, int w) => new(x, y, z, w);
+    public static int4 int4(int value) => new(value, value, value, value);
+
+    // Matrix constructor functions take rows, as HLSL does. Under `using static CultMath.math;`
+    // these method groups hide the type names in member access, so static members need a
+    // qualified type: `CultMath.float3x3.Euler(...)`, `CultMath.float2x2.Rotate(...)`.
+    public static float2x2 float2x2(float m00, float m01, float m10, float m11) => new(m00, m01, m10, m11);
+    public static float2x2 float2x2(float2 row0, float2 row1) => new(row0, row1);
+    public static float3x3 float3x3(float m00, float m01, float m02, float m10, float m11, float m12, float m20, float m21, float m22) =>
+        new(m00, m01, m02, m10, m11, m12, m20, m21, m22);
+    public static float3x3 float3x3(float3 row0, float3 row1, float3 row2) => new(row0, row1, row2);
+    public static float radians(float degrees) => degrees * (PI / 180.0f);
+    public static float degrees(float radians) => radians * (180.0f / PI);
+    public static float sin(float value) => MathF.Sin(value);
+    public static float cos(float value) => MathF.Cos(value);
+    public static float tan(float value) => MathF.Tan(value);
+    public static float asin(float value) => MathF.Asin(value);
+    public static float acos(float value) => MathF.Acos(value);
+    public static float atan(float value) => MathF.Atan(value);
+    public static float atan2(float y, float x) => MathF.Atan2(y, x);
+    public static float sqrt(float value) => MathF.Sqrt(value);
+    public static float pow(float value, float power) => MathF.Pow(value, power);
+    public static bool isinf(float value) => float.IsInfinity(value);
+    public static float exp(float value) => MathF.Exp(value);
+    public static double exp(double value) => Math.Exp(value);
+    public static float2 exp(float2 value) => new(exp(value.x), exp(value.y));
+    public static float3 exp(float3 value) => new(exp(value.x), exp(value.y), exp(value.z));
+    public static float4 exp(float4 value) => new(exp(value.x), exp(value.y), exp(value.z), exp(value.w));
+    public static double2 exp(double2 value) => new(exp(value.x), exp(value.y));
+    public static double3 exp(double3 value) => new(exp(value.x), exp(value.y), exp(value.z));
+
+    public static float abs(float value) => MathF.Abs(value);
+    public static float2 abs(float2 value) => new(abs(value.x), abs(value.y));
+    public static float3 abs(float3 value) => new(abs(value.x), abs(value.y), abs(value.z));
+    public static float4 abs(float4 value) => new(abs(value.x), abs(value.y), abs(value.z), abs(value.w));
+    public static int abs(int value) => Math.Abs(value);
+    public static int2 abs(int2 value) => new(abs(value.x), abs(value.y));
+    public static int3 abs(int3 value) => new(abs(value.x), abs(value.y), abs(value.z));
+    public static int4 abs(int4 value) => new(abs(value.x), abs(value.y), abs(value.z), abs(value.w));
+
+    // HLSL sign returns int. NaN compares false both ways, so it yields 0 instead of throwing.
+    public static int sign(float value) => value > 0.0f ? 1 : value < 0.0f ? -1 : 0;
+    public static int2 sign(float2 value) => new(sign(value.x), sign(value.y));
+    public static int3 sign(float3 value) => new(sign(value.x), sign(value.y), sign(value.z));
+    public static int4 sign(float4 value) => new(sign(value.x), sign(value.y), sign(value.z), sign(value.w));
+    public static int sign(int value) => value > 0 ? 1 : value < 0 ? -1 : 0;
+    public static int2 sign(int2 value) => new(sign(value.x), sign(value.y));
+    public static int3 sign(int3 value) => new(sign(value.x), sign(value.y), sign(value.z));
+    public static int4 sign(int4 value) => new(sign(value.x), sign(value.y), sign(value.z), sign(value.w));
+
+    public static float floor(float value) => MathF.Floor(value);
+    public static float2 floor(float2 value) => new(floor(value.x), floor(value.y));
+    public static float3 floor(float3 value) => new(floor(value.x), floor(value.y), floor(value.z));
+    public static float4 floor(float4 value) => new(floor(value.x), floor(value.y), floor(value.z), floor(value.w));
+
+    public static float ceil(float value) => MathF.Ceiling(value);
+    public static float2 ceil(float2 value) => new(ceil(value.x), ceil(value.y));
+    public static float3 ceil(float3 value) => new(ceil(value.x), ceil(value.y), ceil(value.z));
+    public static float4 ceil(float4 value) => new(ceil(value.x), ceil(value.y), ceil(value.z), ceil(value.w));
+
+    public static float frac(float value) => value - floor(value);
+    public static float2 frac(float2 value) => value - floor(value);
+    public static float3 frac(float3 value) => value - floor(value);
+    public static float4 frac(float4 value) => value - floor(value);
+
+    // dxc lowers float min/max/clamp to DXIL FMin/FMax (saturate to Saturate, defined as FMin(1, FMax(0, x))).
+    // DXIL.rst: FMin(a, b) is a < b ? a : b, FMax(a, b) is a >= b ? a : b, and a NaN operand returns the other.
+    public static float min(float left, float right) => left < right || float.IsNaN(right) ? left : right;
+    public static int min(int left, int right) => Math.Min(left, right);
+    public static float2 min(float2 left, float2 right) => new(min(left.x, right.x), min(left.y, right.y));
+    public static float3 min(float3 left, float3 right) => new(min(left.x, right.x), min(left.y, right.y), min(left.z, right.z));
+    public static float4 min(float4 left, float4 right) => new(min(left.x, right.x), min(left.y, right.y), min(left.z, right.z), min(left.w, right.w));
+    public static int2 min(int2 left, int2 right) => new(min(left.x, right.x), min(left.y, right.y));
+    public static int3 min(int3 left, int3 right) => new(min(left.x, right.x), min(left.y, right.y), min(left.z, right.z));
+    public static int4 min(int4 left, int4 right) => new(min(left.x, right.x), min(left.y, right.y), min(left.z, right.z), min(left.w, right.w));
+
+    public static float max(float left, float right) => left >= right || float.IsNaN(right) ? left : right;
+    public static int max(int left, int right) => Math.Max(left, right);
+    public static float2 max(float2 left, float2 right) => new(max(left.x, right.x), max(left.y, right.y));
+    public static float3 max(float3 left, float3 right) => new(max(left.x, right.x), max(left.y, right.y), max(left.z, right.z));
+    public static float4 max(float4 left, float4 right) => new(max(left.x, right.x), max(left.y, right.y), max(left.z, right.z), max(left.w, right.w));
+    public static int2 max(int2 left, int2 right) => new(max(left.x, right.x), max(left.y, right.y));
+    public static int3 max(int3 left, int3 right) => new(max(left.x, right.x), max(left.y, right.y), max(left.z, right.z));
+    public static int4 max(int4 left, int4 right) => new(max(left.x, right.x), max(left.y, right.y), max(left.z, right.z), max(left.w, right.w));
+
+    public static float clamp(float value, float minimum, float maximum) => min(max(value, minimum), maximum);
+    public static float2 clamp(float2 value, float2 minimum, float2 maximum) => min(max(value, minimum), maximum);
+    public static float3 clamp(float3 value, float3 minimum, float3 maximum) => min(max(value, minimum), maximum);
+    public static float4 clamp(float4 value, float4 minimum, float4 maximum) => min(max(value, minimum), maximum);
+
+    // DXIL Saturate is FMin(1, FMax(0, x)); that operand order, unlike clamp(x, 0, 1), maps -0 to +0.
+    public static float saturate(float value) => min(1.0f, max(0.0f, value));
+    public static float2 saturate(float2 value) => min(1.0f, max(0.0f, value));
+    public static float3 saturate(float3 value) => min(1.0f, max(0.0f, value));
+    public static float4 saturate(float4 value) => min(1.0f, max(0.0f, value));
+
+    public static float lerp(float start, float end, float amount) => start + (end - start) * amount;
+    public static double lerp(double start, double end, double amount) => start + (end - start) * amount;
+    public static float2 lerp(float2 start, float2 end, float2 amount) => start + (end - start) * amount;
+    public static float3 lerp(float3 start, float3 end, float3 amount) => start + (end - start) * amount;
+    public static float4 lerp(float4 start, float4 end, float4 amount) => start + (end - start) * amount;
+    public static double2 lerp(double2 start, double2 end, double2 amount) => start + (end - start) * amount;
+    public static double3 lerp(double3 start, double3 end, double3 amount) => start + (end - start) * amount;
+
+    public static float unlerp(float start, float end, float value) => (value - start) / (end - start);
+    public static double unlerp(double start, double end, double value) => (value - start) / (end - start);
+    public static float2 unlerp(float2 start, float2 end, float2 value) => (value - start) / (end - start);
+    public static float3 unlerp(float3 start, float3 end, float3 value) => (value - start) / (end - start);
+    public static float4 unlerp(float4 start, float4 end, float4 value) => (value - start) / (end - start);
+    public static double2 unlerp(double2 start, double2 end, double2 value) => (value - start) / (end - start);
+    public static double3 unlerp(double3 start, double3 end, double3 value) => (value - start) / (end - start);
+
+    // dxc lowers step(y, x) to x < y ? 0 : 1 (fcmp olt, then select), so a NaN on either side yields 1.
+    public static float step(float edge, float value) => value < edge ? 0.0f : 1.0f;
+    public static float2 step(float2 edge, float2 value) => new(step(edge.x, value.x), step(edge.y, value.y));
+    public static float3 step(float3 edge, float3 value) => new(step(edge.x, value.x), step(edge.y, value.y), step(edge.z, value.z));
+    public static float4 step(float4 edge, float4 value) => new(step(edge.x, value.x), step(edge.y, value.y), step(edge.z, value.z), step(edge.w, value.w));
+
+    public static float smoothstep(float minimum, float maximum, float value)
+    {
+        var t = saturate((value - minimum) / (maximum - minimum));
+        return t * t * (3.0f - 2.0f * t);
+    }
+
+    public static float2 smoothstep(float2 minimum, float2 maximum, float2 value)
+    {
+        var t = saturate((value - minimum) / (maximum - minimum));
+        return t * t * (3.0f - 2.0f * t);
+    }
+
+    public static float3 smoothstep(float3 minimum, float3 maximum, float3 value)
+    {
+        var t = saturate((value - minimum) / (maximum - minimum));
+        return t * t * (3.0f - 2.0f * t);
+    }
+
+    public static float4 smoothstep(float4 minimum, float4 maximum, float4 value)
+    {
+        var t = saturate((value - minimum) / (maximum - minimum));
+        return t * t * (3.0f - 2.0f * t);
+    }
+
+    public static float dot(float2 left, float2 right) => left.x * right.x + left.y * right.y;
+    public static float dot(float3 left, float3 right) => left.x * right.x + left.y * right.y + left.z * right.z;
+    public static float dot(float4 left, float4 right) => left.x * right.x + left.y * right.y + left.z * right.z + left.w * right.w;
+
+    public static float3 cross(float3 left, float3 right) =>
+        new(
+            left.y * right.z - left.z * right.y,
+            left.z * right.x - left.x * right.z,
+            left.x * right.y - left.y * right.x);
+
+    public static float lengthsq(float2 value) => dot(value, value);
+    public static float lengthsq(float3 value) => dot(value, value);
+    public static float lengthsq(float4 value) => dot(value, value);
+
+    public static float length(float2 value) => MathF.Sqrt(lengthsq(value));
+    public static float length(float3 value) => MathF.Sqrt(lengthsq(value));
+    public static float length(float4 value) => MathF.Sqrt(lengthsq(value));
+
+    public static float distance(float2 left, float2 right) => length(left - right);
+    public static float distance(float3 left, float3 right) => length(left - right);
+    public static float distance(float4 left, float4 right) => length(left - right);
+
+    public static float2 normalize(float2 value) => value / max(length(value), 1.0e-20f);
+    public static float3 normalize(float3 value) => value / max(length(value), 1.0e-20f);
+    public static float4 normalize(float4 value) => value / max(length(value), 1.0e-20f);
+    public static quaternion normalize(quaternion value)
+    {
+        var length = MathF.Sqrt(value.x * value.x + value.y * value.y + value.z * value.z + value.w * value.w);
+        if (length <= 1.0e-20f)
+        {
+            return quaternion.identity;
+        }
+
+        var invLength = 1.0f / length;
+        return new quaternion(value.x * invLength, value.y * invLength, value.z * invLength, value.w * invLength);
+    }
+
+    public static float2 reflect(float2 incident, float2 normal) => incident - 2.0f * dot(normal, incident) * normal;
+    public static float3 reflect(float3 incident, float3 normal) => incident - 2.0f * dot(normal, incident) * normal;
+
+    public static float2 rotate(float2 value, float radians)
+    {
+        var s = sin(radians);
+        var c = cos(radians);
+        return new float2(value.x * c - value.y * s, value.x * s + value.y * c);
+    }
+
+    public static float2 rotate_degrees(float2 value, float degrees) => rotate(value, radians(degrees));
+
+    public static float csum(float2 value) => value.x + value.y;
+    public static float csum(float3 value) => value.x + value.y + value.z;
+    public static float csum(float4 value) => value.x + value.y + value.z + value.w;
+
+    public static float decay(float source, float lambda, float dt) => source * exp(-lambda * dt);
+    public static float2 decay(float2 source, float lambda, float dt) => source * exp(-lambda * dt);
+    public static float3 decay(float3 source, float lambda, float dt) => source * exp(-lambda * dt);
+    public static float4 decay(float4 source, float lambda, float dt) => source * exp(-lambda * dt);
+    public static float2 decay(float2 source, float2 lambda, float dt) => source * exp(-lambda * dt);
+    public static float3 decay(float3 source, float3 lambda, float dt) => source * exp(-lambda * dt);
+    public static float4 decay(float4 source, float4 lambda, float dt) => source * exp(-lambda * dt);
+
+    public static float damp(float start, float end, float lambda, float dt) => lerp(start, end, 1.0f - exp(-lambda * dt));
+    public static float2 damp(float2 start, float2 end, float lambda, float dt) => lerp(start, end, 1.0f - exp(-lambda * dt));
+    public static float3 damp(float3 start, float3 end, float lambda, float dt) => lerp(start, end, 1.0f - exp(-lambda * dt));
+    public static float4 damp(float4 start, float4 end, float lambda, float dt) => lerp(start, end, 1.0f - exp(-lambda * dt));
+
+    public static float first_order_intercept_time(float shotSpeed, float3 targetRelativePosition, float3 targetRelativeVelocity)
+    {
+        var velocitySquared = lengthsq(targetRelativeVelocity);
+        if (velocitySquared < 0.001f)
+        {
+            return 0.0f;
+        }
+
+        var a = velocitySquared - shotSpeed * shotSpeed;
+        if (abs(a) < 0.001f)
+        {
+            var time = -lengthsq(targetRelativePosition) / (2.0f * dot(targetRelativeVelocity, targetRelativePosition));
+            return max(time, 0.0f);
+        }
+
+        var b = 2.0f * dot(targetRelativeVelocity, targetRelativePosition);
+        var c = lengthsq(targetRelativePosition);
+        var determinant = b * b - 4.0f * a * c;
+
+        if (determinant > 0.0f)
+        {
+            var root = sqrt(determinant);
+            var t1 = (-b + root) / (2.0f * a);
+            var t2 = (-b - root) / (2.0f * a);
+            if (t1 > 0.0f)
+            {
+                return t2 > 0.0f ? min(t1, t2) : t1;
+            }
+
+            return max(t2, 0.0f);
+        }
+
+        if (determinant < 0.0f)
+        {
+            return 0.0f;
+        }
+
+        return max(-b / (2.0f * a), 0.0f);
+    }
+
+    public static float3 first_order_intercept(
+        float3 shooterPosition,
+        float3 shooterVelocity,
+        float shotSpeed,
+        float3 targetPosition,
+        float3 targetVelocity)
+    {
+        var targetRelativePosition = targetPosition - shooterPosition;
+        var targetRelativeVelocity = targetVelocity - shooterVelocity;
+        var time = first_order_intercept_time(shotSpeed, targetRelativePosition, targetRelativeVelocity);
+        return targetPosition + time * targetRelativeVelocity;
+    }
+
+    public static float distance_to_segment(float2 point, float2 start, float2 end, out float2 closest)
+    {
+        var segment = end - start;
+        var segmentLengthSq = lengthsq(segment);
+        if (segmentLengthSq <= 0.0f)
+        {
+            closest = start;
+            return distance(point, start);
+        }
+
+        var t = saturate(dot(point - start, segment) / segmentLengthSq);
+        closest = start + segment * t;
+        return distance(point, closest);
+    }
+
+    public static float catmullrom(float p0, float p1, float p2, float p3, float t)
+    {
+        var t2 = t * t;
+        var t3 = t2 * t;
+        return 0.5f * ((2.0f * p1) + (p2 - p0) * t + (2.0f * p0 - 5.0f * p1 + 4.0f * p2 - p3) * t2 + (-p0 + 3.0f * p1 - 3.0f * p2 + p3) * t3);
+    }
+
+    public static float2 catmullrom(float2 p0, float2 p1, float2 p2, float2 p3, float t) =>
+        0.5f * ((2.0f * p1) + (p2 - p0) * t + (2.0f * p0 - 5.0f * p1 + 4.0f * p2 - p3) * (t * t) + (-p0 + 3.0f * p1 - 3.0f * p2 + p3) * (t * t * t));
+
+    public static float3 catmullrom(float3 p0, float3 p1, float3 p2, float3 p3, float t) =>
+        0.5f * ((2.0f * p1) + (p2 - p0) * t + (2.0f * p0 - 5.0f * p1 + 4.0f * p2 - p3) * (t * t) + (-p0 + 3.0f * p1 - 3.0f * p2 + p3) * (t * t * t));
+
+    public static float4 catmullrom(float4 p0, float4 p1, float4 p2, float4 p3, float t) =>
+        0.5f * ((2.0f * p1) + (p2 - p0) * t + (2.0f * p0 - 5.0f * p1 + 4.0f * p2 - p3) * (t * t) + (-p0 + 3.0f * p1 - 3.0f * p2 + p3) * (t * t * t));
+
+    public static float quadratic_bezier(float p0, float p1, float p2, float t)
+    {
+        t = saturate(t);
+        var inv = 1.0f - t;
+        return inv * inv * p0 + 2.0f * inv * t * p1 + t * t * p2;
+    }
+
+    public static float3 quadratic_bezier(float3 p0, float3 p1, float3 p2, float t)
+    {
+        t = saturate(t);
+        var inv = 1.0f - t;
+        return inv * inv * p0 + 2.0f * inv * t * p1 + t * t * p2;
+    }
+
+    public static float cubic_bezier(float p0, float p1, float p2, float p3, float t)
+    {
+        t = saturate(t);
+        var inv = 1.0f - t;
+        return inv * inv * inv * p0 + 3.0f * inv * inv * t * p1 + 3.0f * inv * t * t * p2 + t * t * t * p3;
+    }
+
+    public static float3 cubic_bezier(float3 p0, float3 p1, float3 p2, float3 p3, float t)
+    {
+        t = saturate(t);
+        var inv = 1.0f - t;
+        return inv * inv * inv * p0 + 3.0f * inv * inv * t * p1 + 3.0f * inv * t * t * p2 + t * t * t * p3;
+    }
+
+    public static float smoothstep01(float value) => smoothstep(0.0f, 1.0f, value);
+
+    public static float smootherstep(float value)
+    {
+        value = saturate(value);
+        return value * value * value * (value * (value * 6.0f - 15.0f) + 10.0f);
+    }
+
+    public static float hash(float value) => frac(sin(value) * 43758.5453f);
+    public static float hash(float2 value) => hash(dot(value, new float2(127.1f, 311.7f)));
+    public static float hash(float3 value) => hash(dot(value, new float3(127.1f, 311.7f, 74.7f)));
+
+    public static float log(float value) => MathF.Log(value);
+    public static float2 log(float2 value) => new(log(value.x), log(value.y));
+    public static float3 log(float3 value) => new(log(value.x), log(value.y), log(value.z));
+    public static float4 log(float4 value) => new(log(value.x), log(value.y), log(value.z), log(value.w));
+
+    public static float2 pow(float2 value, float2 power) => new(pow(value.x, power.x), pow(value.y, power.y));
+    public static float3 pow(float3 value, float3 power) => new(pow(value.x, power.x), pow(value.y, power.y), pow(value.z, power.z));
+    public static float4 pow(float4 value, float4 power) => new(pow(value.x, power.x), pow(value.y, power.y), pow(value.z, power.z), pow(value.w, power.w));
+
+    public static float2 sqrt(float2 value) => new(sqrt(value.x), sqrt(value.y));
+    public static float3 sqrt(float3 value) => new(sqrt(value.x), sqrt(value.y), sqrt(value.z));
+    public static float4 sqrt(float4 value) => new(sqrt(value.x), sqrt(value.y), sqrt(value.z), sqrt(value.w));
+
+    public static float2 sin(float2 value) => new(sin(value.x), sin(value.y));
+    public static float3 sin(float3 value) => new(sin(value.x), sin(value.y), sin(value.z));
+    public static float4 sin(float4 value) => new(sin(value.x), sin(value.y), sin(value.z), sin(value.w));
+
+    public static float2 cos(float2 value) => new(cos(value.x), cos(value.y));
+    public static float3 cos(float3 value) => new(cos(value.x), cos(value.y), cos(value.z));
+    public static float4 cos(float4 value) => new(cos(value.x), cos(value.y), cos(value.z), cos(value.w));
+
+    public static float2 acos(float2 value) => new(acos(value.x), acos(value.y));
+    public static float3 acos(float3 value) => new(acos(value.x), acos(value.y), acos(value.z));
+    public static float4 acos(float4 value) => new(acos(value.x), acos(value.y), acos(value.z), acos(value.w));
+
+    public static float2 atan2(float2 y, float2 x) => new(atan2(y.x, x.x), atan2(y.y, x.y));
+    public static float3 atan2(float3 y, float3 x) => new(atan2(y.x, x.x), atan2(y.y, x.y), atan2(y.z, x.z));
+    public static float4 atan2(float4 y, float4 x) => new(atan2(y.x, x.x), atan2(y.y, x.y), atan2(y.z, x.z), atan2(y.w, x.w));
+
+    // DXIL FMin/FMax take double overloads with the same rules as float (see min/max above).
+    public static double min(double left, double right) => left < right || double.IsNaN(right) ? left : right;
+    public static double max(double left, double right) => left >= right || double.IsNaN(right) ? left : right;
+
+    public static bool any(bool2 value) => value.x || value.y;
+    public static bool any(bool3 value) => value.x || value.y || value.z;
+    public static bool any(bool4 value) => value.x || value.y || value.z || value.w;
+    public static bool all(bool2 value) => value.x && value.y;
+    public static bool all(bool3 value) => value.x && value.y && value.z;
+    public static bool all(bool4 value) => value.x && value.y && value.z && value.w;
+
+    // HLSL any/all on numeric vectors test components against zero (NaN != 0 counts as true).
+    public static bool any(float2 value) => value.x != 0.0f || value.y != 0.0f;
+    public static bool any(float3 value) => value.x != 0.0f || value.y != 0.0f || value.z != 0.0f;
+    public static bool any(float4 value) => value.x != 0.0f || value.y != 0.0f || value.z != 0.0f || value.w != 0.0f;
+    public static bool all(float2 value) => value.x != 0.0f && value.y != 0.0f;
+    public static bool all(float3 value) => value.x != 0.0f && value.y != 0.0f && value.z != 0.0f;
+    public static bool all(float4 value) => value.x != 0.0f && value.y != 0.0f && value.z != 0.0f && value.w != 0.0f;
+    public static bool any(int2 value) => value.x != 0 || value.y != 0;
+    public static bool any(int3 value) => value.x != 0 || value.y != 0 || value.z != 0;
+    public static bool any(int4 value) => value.x != 0 || value.y != 0 || value.z != 0 || value.w != 0;
+    public static bool all(int2 value) => value.x != 0 && value.y != 0;
+    public static bool all(int3 value) => value.x != 0 && value.y != 0 && value.z != 0;
+    public static bool all(int4 value) => value.x != 0 && value.y != 0 && value.z != 0 && value.w != 0;
+
+    // HLSL 2021 argument order: select(condition, whenTrue, whenFalse).
+    // Unity.Mathematics' select(falseValue, trueValue, condition) is the reverse.
+    public static float select(bool condition, float whenTrue, float whenFalse) => condition ? whenTrue : whenFalse;
+    public static float2 select(bool2 condition, float2 whenTrue, float2 whenFalse) =>
+        new(condition.x ? whenTrue.x : whenFalse.x, condition.y ? whenTrue.y : whenFalse.y);
+    public static float3 select(bool3 condition, float3 whenTrue, float3 whenFalse) =>
+        new(condition.x ? whenTrue.x : whenFalse.x, condition.y ? whenTrue.y : whenFalse.y, condition.z ? whenTrue.z : whenFalse.z);
+    public static float4 select(bool4 condition, float4 whenTrue, float4 whenFalse) =>
+        new(condition.x ? whenTrue.x : whenFalse.x, condition.y ? whenTrue.y : whenFalse.y, condition.z ? whenTrue.z : whenFalse.z, condition.w ? whenTrue.w : whenFalse.w);
+
+    // HLSL mul: mul(m, v) treats v as a column vector, mul(v, m) as a row vector.
+    public static float mul(float left, float right) => left * right;
+
+    public static float2 mul(float2x2 m, float2 v) =>
+        new(m._m00 * v.x + m._m01 * v.y, m._m10 * v.x + m._m11 * v.y);
+
+    public static float2 mul(float2 v, float2x2 m) =>
+        new(v.x * m._m00 + v.y * m._m10, v.x * m._m01 + v.y * m._m11);
+
+    public static float2x2 mul(float2x2 a, float2x2 b) =>
+        new(
+            a._m00 * b._m00 + a._m01 * b._m10, a._m00 * b._m01 + a._m01 * b._m11,
+            a._m10 * b._m00 + a._m11 * b._m10, a._m10 * b._m01 + a._m11 * b._m11);
+
+    public static float3 mul(float3x3 m, float3 v) =>
+        new(
+            m._m00 * v.x + m._m01 * v.y + m._m02 * v.z,
+            m._m10 * v.x + m._m11 * v.y + m._m12 * v.z,
+            m._m20 * v.x + m._m21 * v.y + m._m22 * v.z);
+
+    public static float3 mul(float3 v, float3x3 m) =>
+        new(
+            v.x * m._m00 + v.y * m._m10 + v.z * m._m20,
+            v.x * m._m01 + v.y * m._m11 + v.z * m._m21,
+            v.x * m._m02 + v.y * m._m12 + v.z * m._m22);
+
+    public static float3x3 mul(float3x3 a, float3x3 b) =>
+        new(
+            a._m00 * b._m00 + a._m01 * b._m10 + a._m02 * b._m20,
+            a._m00 * b._m01 + a._m01 * b._m11 + a._m02 * b._m21,
+            a._m00 * b._m02 + a._m01 * b._m12 + a._m02 * b._m22,
+            a._m10 * b._m00 + a._m11 * b._m10 + a._m12 * b._m20,
+            a._m10 * b._m01 + a._m11 * b._m11 + a._m12 * b._m21,
+            a._m10 * b._m02 + a._m11 * b._m12 + a._m12 * b._m22,
+            a._m20 * b._m00 + a._m21 * b._m10 + a._m22 * b._m20,
+            a._m20 * b._m01 + a._m21 * b._m11 + a._m22 * b._m21,
+            a._m20 * b._m02 + a._m21 * b._m12 + a._m22 * b._m22);
+
+    // Ashima Arts / Ian McEwan 3D simplex noise (MIT), mirrored by cultmath_snoise(float3)
+    // in shaders/CultMath.hlsl with the same float32 evaluation order.
+    public static float snoise(float3 value)
+    {
+        const float cx = 1.0f / 6.0f;
+        const float cy = 1.0f / 3.0f;
+        var i = floor(value + dot(value, new float3(cy, cy, cy)));
+        var x0 = value - i + dot(i, new float3(cx, cx, cx));
+        var g = step(new float3(x0.y, x0.z, x0.x), x0);
+        var l = 1.0f - g;
+        var lzxy = new float3(l.z, l.x, l.y);
+        var i1 = min(g, lzxy);
+        var i2 = max(g, lzxy);
+        var x1 = x0 - i1 + cx;
+        var x2 = x0 - i2 + cy;
+        var x3 = x0 - 0.5f;
+
+        i = snoise_mod289(i);
+        var p = snoise_permute(snoise_permute(snoise_permute(
+            i.z + new float4(0.0f, i1.z, i2.z, 1.0f)) + i.y + new float4(0.0f, i1.y, i2.y, 1.0f)) + i.x + new float4(0.0f, i1.x, i2.x, 1.0f));
+
+        const float n = 0.142857142857f;
+        var ns = new float3(2.0f * n, 0.5f * n - 1.0f, n);
+        var j = p - 49.0f * floor(p * ns.z * ns.z);
+        var xs = floor(j * ns.z);
+        var ys = floor(j - 7.0f * xs);
+        var x = xs * ns.x + ns.y;
+        var y = ys * ns.x + ns.y;
+        var h = 1.0f - abs(x) - abs(y);
+
+        var b0 = new float4(x.x, x.y, y.x, y.y);
+        var b1 = new float4(x.z, x.w, y.z, y.w);
+        var s0 = floor(b0) * 2.0f + 1.0f;
+        var s1 = floor(b1) * 2.0f + 1.0f;
+        var sh = -step(h, 0.0f);
+        var a0 = new float4(b0.x, b0.z, b0.y, b0.w) + new float4(s0.x, s0.z, s0.y, s0.w) * new float4(sh.x, sh.x, sh.y, sh.y);
+        var a1 = new float4(b1.x, b1.z, b1.y, b1.w) + new float4(s1.x, s1.z, s1.y, s1.w) * new float4(sh.z, sh.z, sh.w, sh.w);
+
+        var p0 = new float3(a0.x, a0.y, h.x);
+        var p1 = new float3(a0.z, a0.w, h.y);
+        var p2 = new float3(a1.x, a1.y, h.z);
+        var p3 = new float3(a1.z, a1.w, h.w);
+        var norm = 1.79284291400159f - 0.85373472095314f * new float4(dot(p0, p0), dot(p1, p1), dot(p2, p2), dot(p3, p3));
+        p0 *= norm.x;
+        p1 *= norm.y;
+        p2 *= norm.z;
+        p3 *= norm.w;
+
+        var m = max(0.6f - new float4(dot(x0, x0), dot(x1, x1), dot(x2, x2), dot(x3, x3)), 0.0f);
+        m = m * m;
+        return 42.0f * dot(m * m, new float4(dot(p0, x0), dot(p1, x1), dot(p2, x2), dot(p3, x3)));
+    }
+
+    // Ashima Arts / Ian McEwan 2D simplex noise, kept component-explicit so
+    // the C# and HLSL mirrors preserve the same float32 evaluation order.
+    public static float snoise(float2 value)
+    {
+        var c = new float4(
+            0.211324865405187f,
+            0.366025403784439f,
+            -0.577350269189626f,
+            0.024390243902439f);
+        var i = floor(value + dot(value, new float2(c.y, c.y)));
+        var x0 = value - i + dot(i, new float2(c.x, c.x));
+        var i1 = x0.x > x0.y ? new float2(1.0f, 0.0f) : new float2(0.0f, 1.0f);
+        var x12 = new float4(
+            x0.x + c.x - i1.x,
+            x0.y + c.x - i1.y,
+            x0.x + c.z,
+            x0.y + c.z);
+
+        i = snoise_mod289(i);
+        var p = snoise_permute(snoise_permute(i.y + new float3(0.0f, i1.y, 1.0f)) + i.x + new float3(0.0f, i1.x, 1.0f));
+        var m = max(0.5f - new float3(
+            dot(x0, x0),
+            x12.x * x12.x + x12.y * x12.y,
+            x12.z * x12.z + x12.w * x12.w), 0.0f);
+        m = m * m;
+        m = m * m;
+
+        var x = 2.0f * frac(p * c.w) - 1.0f;
+        var h = abs(x) - 0.5f;
+        var ox = floor(x + 0.5f);
+        var a0 = x - ox;
+        m *= 1.79284291400159f - 0.85373472095314f * (a0 * a0 + h * h);
+
+        var g = new float3(
+            a0.x * x0.x + h.x * x0.y,
+            a0.y * x12.x + h.y * x12.y,
+            a0.z * x12.z + h.z * x12.w);
+        return 130.0f * dot(m, g);
+    }
+
+    private static float2 snoise_mod289(float2 value) => value - floor(value * (1.0f / 289.0f)) * 289.0f;
+    private static float3 snoise_mod289(float3 value) => value - floor(value * (1.0f / 289.0f)) * 289.0f;
+    private static float4 snoise_mod289(float4 value) => value - floor(value * (1.0f / 289.0f)) * 289.0f;
+    private static float3 snoise_permute(float3 value) => snoise_mod289(((value * 34.0f) + 1.0f) * value);
+    private static float4 snoise_permute(float4 value) => snoise_mod289(((value * 34.0f) + 1.0f) * value);
+
+    public static float value_noise(float2 position)
+    {
+        var cell = floor(position);
+        var local = frac(position);
+        var u = local * local * (3.0f - 2.0f * local);
+
+        var a = hash(cell);
+        var b = hash(cell + new float2(1.0f, 0.0f));
+        var c = hash(cell + new float2(0.0f, 1.0f));
+        var d = hash(cell + new float2(1.0f, 1.0f));
+
+        return lerp(lerp(a, b, u.x), lerp(c, d, u.x), u.y);
+    }
+
+    public static float value_noise_bicubic(float2 position)
+    {
+        var cell = floor(position);
+        var local = frac(position);
+
+        var y0 = catmullrom(
+            hash(cell + new float2(-1.0f, -1.0f)),
+            hash(cell + new float2(0.0f, -1.0f)),
+            hash(cell + new float2(1.0f, -1.0f)),
+            hash(cell + new float2(2.0f, -1.0f)),
+            local.x);
+        var y1 = catmullrom(
+            hash(cell + new float2(-1.0f, 0.0f)),
+            hash(cell + new float2(0.0f, 0.0f)),
+            hash(cell + new float2(1.0f, 0.0f)),
+            hash(cell + new float2(2.0f, 0.0f)),
+            local.x);
+        var y2 = catmullrom(
+            hash(cell + new float2(-1.0f, 1.0f)),
+            hash(cell + new float2(0.0f, 1.0f)),
+            hash(cell + new float2(1.0f, 1.0f)),
+            hash(cell + new float2(2.0f, 1.0f)),
+            local.x);
+        var y3 = catmullrom(
+            hash(cell + new float2(-1.0f, 2.0f)),
+            hash(cell + new float2(0.0f, 2.0f)),
+            hash(cell + new float2(1.0f, 2.0f)),
+            hash(cell + new float2(2.0f, 2.0f)),
+            local.x);
+
+        return catmullrom(y0, y1, y2, y3, local.y);
+    }
+}
diff --git a/packages/cultmath/src/CultMath/math.cs.meta b/packages/cultmath/src/CultMath/math.cs.meta
new file mode 100644
index 00000000..9222af7d
--- /dev/null
+++ b/packages/cultmath/src/CultMath/math.cs.meta
@@ -0,0 +1,2 @@
+fileFormatVersion: 2
+guid: 0d9b4cacc40d169429ee743d19577cb7
\ No newline at end of file
diff --git a/packages/cultmath/src/CultMath/quaternion.cs b/packages/cultmath/src/CultMath/quaternion.cs
new file mode 100644
index 00000000..e8c4a48c
--- /dev/null
+++ b/packages/cultmath/src/CultMath/quaternion.cs
@@ -0,0 +1,95 @@
+using System;
+
+namespace CultMath;
+
+/// <summary>
+/// Not an HLSL type: shaders carry rotations as float4. Equality therefore stays
+/// scalar (<c>==</c> returns bool) instead of following the component-wise vector rule.
+/// </summary>
+public struct quaternion : IEquatable<quaternion>
+{
+    public static readonly quaternion identity = new(0.0f, 0.0f, 0.0f, 1.0f);
+
+    public float x;
+    public float y;
+    public float z;
+    public float w;
+
+    public quaternion(float x, float y, float z, float w)
+    {
+        this.x = x;
+        this.y = y;
+        this.z = z;
+        this.w = w;
+    }
+
+    public static quaternion LookRotation(float3 forward, float3 up)
+    {
+        forward = math.normalize(forward);
+        up = math.normalize(up);
+
+        var right = math.normalize(math.cross(up, forward));
+        up = math.cross(forward, right);
+
+        var m00 = right.x;
+        var m01 = up.x;
+        var m02 = forward.x;
+        var m10 = right.y;
+        var m11 = up.y;
+        var m12 = forward.y;
+        var m20 = right.z;
+        var m21 = up.z;
+        var m22 = forward.z;
+
+        var trace = m00 + m11 + m22;
+        if (trace > 0.0f)
+        {
+            var s = math.sqrt(trace + 1.0f) * 2.0f;
+            return math.normalize(new quaternion(
+                (m21 - m12) / s,
+                (m02 - m20) / s,
+                (m10 - m01) / s,
+                0.25f * s));
+        }
+
+        if (m00 > m11 && m00 > m22)
+        {
+            var s = math.sqrt(1.0f + m00 - m11 - m22) * 2.0f;
+            return math.normalize(new quaternion(
+                0.25f * s,
+                (m01 + m10) / s,
+                (m02 + m20) / s,
+                (m21 - m12) / s));
+        }
+
+        if (m11 > m22)
+        {
+            var s = math.sqrt(1.0f + m11 - m00 - m22) * 2.0f;
+            return math.normalize(new quaternion(
+                (m01 + m10) / s,
+                0.25f * s,
+                (m12 + m21) / s,
+                (m02 - m20) / s));
+        }
+
+        {
+            var s = math.sqrt(1.0f + m22 - m00 - m11) * 2.0f;
+            return math.normalize(new quaternion(
+                (m02 + m20) / s,
+                (m12 + m21) / s,
+                0.25f * s,
+                (m10 - m01) / s));
+        }
+    }
+
+    public static implicit operator quaternion(float4 value) => new(value.x, value.y, value.z, value.w);
+    public static implicit operator float4(quaternion value) => new(value.x, value.y, value.z, value.w);
+
+    public static bool operator ==(quaternion left, quaternion right) => left.Equals(right);
+    public static bool operator !=(quaternion left, quaternion right) => !left.Equals(right);
+
+    public readonly bool Equals(quaternion other) => x.Equals(other.x) && y.Equals(other.y) && z.Equals(other.z) && w.Equals(other.w);
+    public override readonly bool Equals(object? obj) => obj is quaternion other && Equals(other);
+    public override readonly int GetHashCode() => HashCode.Combine(x, y, z, w);
+    public override readonly string ToString() => FormattableString.Invariant($"quaternion({x:R}, {y:R}, {z:R}, {w:R})");
+}
diff --git a/packages/cultmath/src/CultMath/quaternion.cs.meta b/packages/cultmath/src/CultMath/quaternion.cs.meta
new file mode 100644
index 00000000..ae6e8a11
--- /dev/null
+++ b/packages/cultmath/src/CultMath/quaternion.cs.meta
@@ -0,0 +1,2 @@
+fileFormatVersion: 2
+guid: 12f3627d9250dc348be9c1a1056ec7d0
\ No newline at end of file
diff --git a/packages/cultmath/src/CultMath/rect.cs b/packages/cultmath/src/CultMath/rect.cs
new file mode 100644
index 00000000..51e05c19
--- /dev/null
+++ b/packages/cultmath/src/CultMath/rect.cs
@@ -0,0 +1,59 @@
+namespace CultMath;
+
+/// <summary>
+/// Axis-aligned 2D bounds stored canonically as normalized minimum and maximum
+/// corners. Point containment and intersection include the boundary.
+/// </summary>
+public readonly record struct rect
+{
+    public rect(float minX, float minY, float maxX, float maxY)
+        : this(new float2(minX, minY), new float2(maxX, maxY))
+    {
+    }
+
+    public rect(float2 min, float2 max)
+    {
+        this.min = new float2(MathF.Min(min.x, max.x), MathF.Min(min.y, max.y));
+        this.max = new float2(MathF.Max(min.x, max.x), MathF.Max(min.y, max.y));
+    }
+
+    public float2 min { get; }
+    public float2 max { get; }
+
+    public float width => max.x - min.x;
+    public float height => max.y - min.y;
+    public float2 size => max - min;
+    public float2 center => (min + max) * 0.5f;
+    public float area => width * height;
+    public bool isEmpty => width == 0.0f || height == 0.0f;
+
+    public bool Contains(float2 point) =>
+        point.x >= min.x && point.x <= max.x &&
+        point.y >= min.y && point.y <= max.y;
+
+    public bool Contains(rect other) =>
+        other.min.x >= min.x && other.max.x <= max.x &&
+        other.min.y >= min.y && other.max.y <= max.y;
+
+    public bool Intersects(rect other) =>
+        min.x <= other.max.x && max.x >= other.min.x &&
+        min.y <= other.max.y && max.y >= other.min.y;
+
+    public rect Intersection(rect other)
+    {
+        if (!Intersects(other))
+            return new rect(0.0f, 0.0f, 0.0f, 0.0f);
+
+        return new rect(
+            MathF.Max(min.x, other.min.x),
+            MathF.Max(min.y, other.min.y),
+            MathF.Min(max.x, other.max.x),
+            MathF.Min(max.y, other.max.y));
+    }
+
+    public rect Encapsulate(float2 point) => new(
+        MathF.Min(min.x, point.x),
+        MathF.Min(min.y, point.y),
+        MathF.Max(max.x, point.x),
+        MathF.Max(max.y, point.y));
+}
diff --git a/packages/cultmath/src/CultMath/rect.cs.meta b/packages/cultmath/src/CultMath/rect.cs.meta
new file mode 100644
index 00000000..0b04a5ce
--- /dev/null
+++ b/packages/cultmath/src/CultMath/rect.cs.meta
@@ -0,0 +1,2 @@
+fileFormatVersion: 2
+guid: 5aab0d8e1ca94d42b85bba780a7ee449
diff --git a/packages/cultmath/tests.meta b/packages/cultmath/tests.meta
new file mode 100644
index 00000000..a35356c4
--- /dev/null
+++ b/packages/cultmath/tests.meta
@@ -0,0 +1,8 @@
+fileFormatVersion: 2
+guid: 4ca61dedbfb3c5d46b0acaf23202b5c2
+folderAsset: yes
+DefaultImporter:
+  externalObjects: {}
+  userData: 
+  assetBundleName: 
+  assetBundleVariant: 
diff --git a/packages/cultmath/tests/CultMath.Tests.meta b/packages/cultmath/tests/CultMath.Tests.meta
new file mode 100644
index 00000000..3f1451c6
--- /dev/null
+++ b/packages/cultmath/tests/CultMath.Tests.meta
@@ -0,0 +1,8 @@
+fileFormatVersion: 2
+guid: bcee65f13f85daa45b0cf3fdaa901779
+folderAsset: yes
+DefaultImporter:
+  externalObjects: {}
+  userData: 
+  assetBundleName: 
+  assetBundleVariant: 
diff --git a/packages/cultmath/tests/CultMath.Tests/CultMath.Tests.csproj b/packages/cultmath/tests/CultMath.Tests/CultMath.Tests.csproj
new file mode 100644
index 00000000..d77fd05f
--- /dev/null
+++ b/packages/cultmath/tests/CultMath.Tests/CultMath.Tests.csproj
@@ -0,0 +1,21 @@
+<Project Sdk="Microsoft.NET.Sdk">
+
+  <PropertyGroup>
+    <TargetFramework>net10.0</TargetFramework>
+    <ImplicitUsings>enable</ImplicitUsings>
+    <Nullable>enable</Nullable>
+    <IsPackable>false</IsPackable>
+  </PropertyGroup>
+
+  <ItemGroup>
+    <PackageReference Include="Microsoft.CodeAnalysis.CSharp" Version="5.3.0" />
+    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.14.1" />
+    <PackageReference Include="xunit.v3" Version="3.2.0" />
+    <PackageReference Include="xunit.runner.visualstudio" Version="3.1.5" />
+  </ItemGroup>
+
+  <ItemGroup>
+    <ProjectReference Include="..\..\src\CultMath\CultMath.csproj" />
+  </ItemGroup>
+
+</Project>
diff --git a/packages/cultmath/tests/CultMath.Tests/CultMath.Tests.csproj.meta b/packages/cultmath/tests/CultMath.Tests/CultMath.Tests.csproj.meta
new file mode 100644
index 00000000..709184bb
--- /dev/null
+++ b/packages/cultmath/tests/CultMath.Tests/CultMath.Tests.csproj.meta
@@ -0,0 +1,7 @@
+fileFormatVersion: 2
+guid: 636051db121e19146a0baf92b790415c
+DefaultImporter:
+  externalObjects: {}
+  userData: 
+  assetBundleName: 
+  assetBundleVariant: 
diff --git a/packages/cultmath/tests/CultMath.Tests/HlslMirrorTests.cs b/packages/cultmath/tests/CultMath.Tests/HlslMirrorTests.cs
new file mode 100644
index 00000000..445ad255
--- /dev/null
+++ b/packages/cultmath/tests/CultMath.Tests/HlslMirrorTests.cs
@@ -0,0 +1,77 @@
+using Xunit;
+
+namespace CultMath.Tests;
+
+public sealed class HlslMirrorTests
+{
+    [Fact]
+    public void HlslMirrorDoesNotPublishGeometryKernels()
+    {
+        var source = File.ReadAllText(Path.Combine(GetCultMathRoot(), "shaders", "CultMath.hlsl"));
+        Assert.DoesNotContain("AdvancedErosionFilter.hlsl", source);
+        Assert.DoesNotContain("Planetary.hlsl", source);
+        Assert.DoesNotContain("spherical_erosion", source);
+        Assert.DoesNotContain("planetary_radial_refinement", source);
+    }
+
+    [Fact]
+    public void HlslMirrorPublishesCultMathPrimitives()
+    {
+        var include = File.ReadAllText(Path.Combine(GetCultMathRoot(), "shaders", "CultMath.hlsl"));
+        var requiredSymbols = new[]
+        {
+            "cultmath_radians",
+            "cultmath_degrees",
+            "cultmath_frac",
+            "cultmath_clamp",
+            "cultmath_saturate",
+            "cultmath_lerp",
+            "cultmath_step",
+            "cultmath_smoothstep",
+            "cultmath_smootherstep",
+            "cultmath_lengthsq",
+            "cultmath_distance",
+            "cultmath_normalize",
+            "cultmath_reflect",
+            "cultmath_rotate",
+            "cultmath_csum",
+            "cultmath_decay",
+            "cultmath_damp",
+            "cultmath_catmullrom",
+            "cultmath_quadratic_bezier",
+            "cultmath_cubic_bezier",
+            "cultmath_hash",
+            "cultmath_value_noise",
+            "cultmath_snoise(float2",
+            "cultmath_snoise(float3",
+            "cultmath_value_noise_bicubic",
+            "cultmath_value_noise_texture",
+            "cultmath_value_noise_texture_bicubic",
+        };
+
+        foreach (var symbol in requiredSymbols)
+        {
+            Assert.Contains(symbol, include);
+        }
+
+        Assert.Contains("CULTMATH_NORMALIZE_EPSILON", include);
+        Assert.Contains("max(length(value), CULTMATH_NORMALIZE_EPSILON)", include);
+    }
+
+    private static string GetCultMathRoot()
+    {
+        var directory = new DirectoryInfo(AppContext.BaseDirectory);
+        while (directory is not null)
+        {
+            var monorepoPackage = Path.Combine(directory.FullName, "packages", "cultmath");
+            if (File.Exists(Path.Combine(monorepoPackage, "shaders", "CultMath.hlsl")))
+            {
+                return monorepoPackage;
+            }
+
+            directory = directory.Parent;
+        }
+
+        throw new InvalidOperationException("Could not locate the CultMath package root.");
+    }
+}
diff --git a/packages/cultmath/tests/CultMath.Tests/HlslMirrorTests.cs.meta b/packages/cultmath/tests/CultMath.Tests/HlslMirrorTests.cs.meta
new file mode 100644
index 00000000..1fcf44b3
--- /dev/null
+++ b/packages/cultmath/tests/CultMath.Tests/HlslMirrorTests.cs.meta
@@ -0,0 +1,2 @@
+fileFormatVersion: 2
+guid: 3d7eb9df849ea0148a71419bbfe2352c
\ No newline at end of file
diff --git a/packages/cultmath/tests/CultMath.Tests/HlslSemanticsTests.cs b/packages/cultmath/tests/CultMath.Tests/HlslSemanticsTests.cs
new file mode 100644
index 00000000..7b845ea7
--- /dev/null
+++ b/packages/cultmath/tests/CultMath.Tests/HlslSemanticsTests.cs
@@ -0,0 +1,441 @@
+using System.Text.Json;
+using Xunit;
+
+namespace CultMath.Tests;
+
+public sealed class HlslSemanticsTests
+{
+    [Fact]
+    public void ComponentsAndIndexersAreWritable()
+    {
+        var value = new float4(1.0f, 2.0f, 3.0f, 4.0f);
+        value.w = 9.0f;
+        value[0] = -1.0f;
+
+        Assert.Equal(new float4(-1.0f, 2.0f, 3.0f, 9.0f), value);
+
+        var cell = new int3(1, 2, 3);
+        cell[2] = 7;
+        Assert.Equal(new int3(1, 2, 7), cell);
+
+        ref var component = ref value.y;
+        component = 20.0f;
+        Assert.Equal(20.0f, value.y);
+    }
+
+    [Fact]
+    public void Float2SwizzlesReadAndWrite()
+    {
+        var value = new float2(1.0f, 2.0f);
+        Assert.Equal(new float2(2.0f, 1.0f), value.yx);
+
+        value.yx = new float2(5.0f, 6.0f);
+        Assert.Equal(new float2(6.0f, 5.0f), value);
+    }
+
+    [Fact]
+    public void Float3SwizzlesReadAndWrite()
+    {
+        var source = new float3(1.0f, 2.0f, 3.0f);
+        Assert.Equal(new float2(1.0f, 2.0f), source.xy);
+        Assert.Equal(new float2(1.0f, 3.0f), source.xz);
+        Assert.Equal(new float2(2.0f, 1.0f), source.yx);
+        Assert.Equal(new float2(2.0f, 3.0f), source.yz);
+        Assert.Equal(new float2(3.0f, 2.0f), source.zy);
+        Assert.Equal(new float3(1.0f, 2.0f, 3.0f), source.xyz);
+        Assert.Equal(new float3(1.0f, 3.0f, 2.0f), source.xzy);
+        Assert.Equal(new float3(2.0f, 3.0f, 1.0f), source.yzx);
+        Assert.Equal(new float3(3.0f, 2.0f, 1.0f), source.zyx);
+
+        Assert.Equal(new float3(8.0f, 9.0f, 3.0f), Write(source, (ref float3 v) => v.xy = new float2(8.0f, 9.0f)));
+        Assert.Equal(new float3(8.0f, 2.0f, 9.0f), Write(source, (ref float3 v) => v.xz = new float2(8.0f, 9.0f)));
+        Assert.Equal(new float3(9.0f, 8.0f, 3.0f), Write(source, (ref float3 v) => v.yx = new float2(8.0f, 9.0f)));
+        Assert.Equal(new float3(1.0f, 8.0f, 9.0f), Write(source, (ref float3 v) => v.yz = new float2(8.0f, 9.0f)));
+        Assert.Equal(new float3(1.0f, 9.0f, 8.0f), Write(source, (ref float3 v) => v.zy = new float2(8.0f, 9.0f)));
+        Assert.Equal(new float3(7.0f, 8.0f, 9.0f), Write(source, (ref float3 v) => v.xyz = new float3(7.0f, 8.0f, 9.0f)));
+        Assert.Equal(new float3(7.0f, 9.0f, 8.0f), Write(source, (ref float3 v) => v.xzy = new float3(7.0f, 8.0f, 9.0f)));
+        Assert.Equal(new float3(9.0f, 7.0f, 8.0f), Write(source, (ref float3 v) => v.yzx = new float3(7.0f, 8.0f, 9.0f)));
+        Assert.Equal(new float3(9.0f, 8.0f, 7.0f), Write(source, (ref float3 v) => v.zyx = new float3(7.0f, 8.0f, 9.0f)));
+    }
+
+    [Fact]
+    public void Float4SwizzlesReadAndWrite()
+    {
+        var source = new float4(1.0f, 2.0f, 3.0f, 4.0f);
+        Assert.Equal(new float2(1.0f, 2.0f), source.xy);
+        Assert.Equal(new float3(1.0f, 2.0f, 3.0f), source.xyz);
+        Assert.Equal(new float3(1.0f, 2.0f, 4.0f), source.xyw);
+        Assert.Equal(new float3(2.0f, 3.0f, 1.0f), source.yzx);
+
+        var a = source;
+        a.xy = new float2(8.0f, 9.0f);
+        Assert.Equal(new float4(8.0f, 9.0f, 3.0f, 4.0f), a);
+
+        var b = source;
+        b.xyz = new float3(7.0f, 8.0f, 9.0f);
+        Assert.Equal(new float4(7.0f, 8.0f, 9.0f, 4.0f), b);
+
+        var c = source;
+        c.xyw = new float3(7.0f, 8.0f, 9.0f);
+        Assert.Equal(new float4(7.0f, 8.0f, 3.0f, 9.0f), c);
+
+        var d = source;
+        d.yzx = new float3(7.0f, 8.0f, 9.0f);
+        Assert.Equal(new float4(9.0f, 7.0f, 8.0f, 4.0f), d);
+    }
+
+    [Fact]
+    public void GeneratedSwizzlesCoverRepeatsColorNamesAndAllVectorFamilies()
+    {
+        var v = new float4(1.0f, 2.0f, 3.0f, 4.0f);
+        Assert.Equal(new float4(4.0f, 4.0f, 1.0f, 2.0f), v.wwxy);
+        Assert.Equal(new float3(3.0f, 2.0f, 1.0f), v.bgr);
+        Assert.Equal(4.0f, v.a);
+        Assert.Equal(new float4(2.0f, 2.0f, 2.0f, 2.0f), new float2(1.0f, 2.0f).yyyy);
+
+        v.wx = new float2(9.0f, 8.0f);
+        Assert.Equal(new float4(8.0f, 2.0f, 3.0f, 9.0f), v);
+        v.r = 0.5f;
+        v.gb += new float2(1.0f, 1.0f);
+        Assert.Equal(new float4(0.5f, 3.0f, 4.0f, 9.0f), v);
+
+        Assert.Equal(new int3(3, 1, 1), new int3(1, 2, 3).zxx);
+        Assert.Equal(new bool2(false, true), new bool4(true, false, false, true).zw);
+        Assert.Equal(new double2(2.0, 1.0), new double3(1.0, 2.0, 3.0).yx);
+
+        var cell = new int4(1, 2, 3, 4);
+        cell.xyz = new int3(7, 8, 9);
+        Assert.Equal(new int4(7, 8, 9, 4), cell);
+    }
+
+    [Fact]
+    public void MixedConstructorsMatchHlsl()
+    {
+        var xy = new float2(1.0f, 2.0f);
+        var zw = new float2(3.0f, 4.0f);
+        var expected = new float4(1.0f, 2.0f, 3.0f, 4.0f);
+
+        Assert.Equal(expected, math.float4(xy, zw));
+        Assert.Equal(expected, math.float4(1.0f, new float3(2.0f, 3.0f, 4.0f)));
+        Assert.Equal(expected, math.float4(new float3(1.0f, 2.0f, 3.0f), 4.0f));
+        Assert.Equal(expected, math.float4(xy, 3.0f, 4.0f));
+        Assert.Equal(expected, math.float4(1.0f, 2.0f, zw));
+        Assert.Equal(expected, math.float4(1.0f, new float2(2.0f, 3.0f), 4.0f));
+        Assert.Equal(expected, new float4(xy, zw));
+        Assert.Equal(new float3(1.0f, 2.0f, 3.0f), math.float3(1.0f, zw - 1.0f));
+        Assert.Equal(new int4(1, 2, 3, 4), math.int4(new int2(1, 2), new int2(3, 4)));
+        Assert.Equal(new bool3(true, false, true), math.bool3(true, new bool2(false, true)));
+        Assert.Equal(new double3(1.0, 2.0, 3.0), new double3(new double2(1.0, 2.0), 3.0));
+    }
+
+    [Fact]
+    public void MatrixRowElementsAreWritable()
+    {
+        var m = float3x3.identity;
+        m[1][2] = 5.0f;
+        m[2].x = 7.0f;
+        m._m00 = 2.0f;
+
+        Assert.Equal(5.0f, m._m12);
+        Assert.Equal(7.0f, m._m20);
+        Assert.Equal(math.float3x3(2.0f, 0.0f, 0.0f, 0.0f, 1.0f, 5.0f, 7.0f, 0.0f, 1.0f), m);
+        Assert.Equal(float3x3.identity, math.float3x3(1.0f, 0.0f, 0.0f, 0.0f, 1.0f, 0.0f, 0.0f, 0.0f, 1.0f));
+
+        var r = float2x2.identity;
+        r[0][1] = 3.0f;
+        Assert.Equal(math.float2x2(1.0f, 3.0f, 0.0f, 1.0f), r);
+        Assert.Equal(new float2(0.0f, 1.0f), float2x2.identity[1]);
+    }
+
+    [Fact]
+    public void IntrinsicEdgeCasesFollowHlsl()
+    {
+        Assert.True(math.any(new float3(0.0f, 0.0f, -2.0f)));
+        Assert.False(math.any(float4.zero));
+        Assert.True(math.all(new int2(1, -1)));
+        Assert.False(math.all(new int3(1, 0, 1)));
+        Assert.True(math.any(new float2(float.NaN, 0.0f)));
+
+        Assert.Equal(new int3(1, 2, 3), math.min(new int3(1, 5, 3), new int3(4, 2, 6)));
+        Assert.Equal(new int2(4, 5), math.max(new int2(1, 5), new int2(4, 2)));
+        Assert.Equal(new int4(1, 2, 0, 3), math.abs(new int4(-1, 2, 0, -3)));
+        Assert.Equal(7, math.abs(-7));
+
+        Assert.Equal(1.0f, math.step(1.0f, float.NaN));
+        Assert.Equal(1.0f, math.step(float.NaN, 1.0f));
+        Assert.Equal(1.0f, math.step(1.0f, 1.0f));
+
+        // DXIL FMin/FMax/Saturate: a NaN operand returns the other; max(a, b) is a >= b ? a : b.
+        Assert.Equal(1.0f, math.min(float.NaN, 1.0f));
+        Assert.Equal(1.0f, math.min(1.0f, float.NaN));
+        Assert.Equal(1.0f, math.max(float.NaN, 1.0f));
+        Assert.Equal(1.0f, math.max(1.0f, float.NaN));
+        Assert.True(float.IsNaN(math.max(float.NaN, float.NaN)));
+        Assert.Equal(2.0f, math.clamp(float.NaN, 2.0f, 3.0f));
+        Assert.Equal(new float3(0.0f, 1.0f, 0.0f), math.saturate(new float3(float.NaN, 2.0f, -1.0f)));
+        Assert.Equal(new float2(-1.0f, 4.0f), math.max(new float2(float.NaN, 4.0f), new float2(-1.0f, float.NaN)));
+        static int Bits(float value) => BitConverter.SingleToInt32Bits(value);
+        Assert.Equal(Bits(-0.0f), Bits(math.max(-0.0f, 0.0f)));
+        Assert.Equal(Bits(0.0f), Bits(math.min(-0.0f, 0.0f)));
+        Assert.Equal(Bits(0.0f), Bits(math.saturate(-0.0f)));
+        Assert.Equal(1.0, math.min(double.NaN, 1.0));
+        Assert.Equal(1.0, math.min(1.0, double.NaN));
+        Assert.Equal(1.0, math.max(double.NaN, 1.0));
+        Assert.Equal(1.0, math.max(1.0, double.NaN));
+        Assert.True(double.IsNaN(math.max(double.NaN, double.NaN)));
+        static long DoubleBits(double value) => BitConverter.DoubleToInt64Bits(value);
+        Assert.Equal(DoubleBits(-0.0), DoubleBits(math.max(-0.0, 0.0)));
+        Assert.Equal(DoubleBits(0.0), DoubleBits(math.min(-0.0, 0.0)));
+
+        Assert.Equal(0, math.sign(float.NaN));
+        Assert.Equal(-1, math.sign(-0.5f));
+        Assert.Equal(new int3(-1, 0, 1), math.sign(new float3(-2.0f, 0.0f, 4.0f)));
+        Assert.Equal(new int2(1, -1), math.sign(new int2(9, -9)));
+    }
+
+    [Fact]
+    public void ComparisonOperatorsReturnComponentWiseBoolVectors()
+    {
+        var a = new float3(1.0f, 2.0f, 3.0f);
+        var b = new float3(3.0f, 2.0f, 1.0f);
+
+        Assert.Equal(new bool3(true, false, false), a < b);
+        Assert.Equal(new bool3(false, false, true), a > b);
+        Assert.Equal(new bool3(true, true, false), a <= b);
+        Assert.Equal(new bool3(false, true, true), a >= b);
+        Assert.Equal(new bool3(false, true, false), a == b);
+        Assert.Equal(new bool3(true, false, true), a != b);
+
+        Assert.Equal(new bool3(true, false, false), a < 2.0f);
+        Assert.Equal(new bool3(false, false, true), 2.0f < a);
+        Assert.Equal(new bool2(true, false), new float2(0.0f, 1.0f) == 0.0f);
+        Assert.Equal(new bool4(false, true, true, true), new float4(0.0f, 1.0f, 2.0f, 3.0f) >= 1.0f);
+        Assert.Equal(new bool2(false, true), new int2(1, 2) > new int2(1, 1));
+        Assert.Equal(new bool3(true, false, true), new int3(1, 2, 3) != new int3(0, 2, 4));
+        Assert.Equal(new bool4(true, true, false, false), new int4(1, 2, 3, 4) <= new int4(1, 2, 2, 2));
+        Assert.Equal(new bool2(true, false), new double2(0.5, 1.0) < new double2(1.0, 1.0));
+        Assert.Equal(new bool3(false, false, true), new double3(1.0, 1.0, 2.0) > new double3(1.0, 1.0, 1.0));
+    }
+
+    [Fact]
+    public void ScalarOperatorsApplyPerComponentOnBothSides()
+    {
+        var value = new float3(1.0f, 2.0f, 4.0f);
+
+        Assert.Equal(new float3(3.0f, 2.0f, 0.0f), 4.0f - value);
+        Assert.Equal(new float3(0.0f, 1.0f, 3.0f), value - 1.0f);
+        Assert.Equal(new float3(2.0f, 3.0f, 5.0f), 1.0f + value);
+        Assert.Equal(new float3(4.0f, 2.0f, 1.0f), 4.0f / value);
+        Assert.Equal(new float3(0.5f, 1.0f, 2.0f), value / 2.0f);
+        Assert.Equal(new float3(2.0f, 4.0f, 8.0f), 2.0f * value);
+        Assert.Equal(new float3(1.0f, 0.0f, 0.0f), value % 2.0f);
+        Assert.Equal(new float2(1.5f, 2.5f), new float2(1.0f, 2.0f) + 0.5f);
+        Assert.Equal(new float4(0.0f, 1.0f, 2.0f, 3.0f), new float4(1.0f, 2.0f, 3.0f, 4.0f) - 1.0f);
+    }
+
+    [Fact]
+    public void EqualsAndHashCodeStayValueBasedForDictionaryKeys()
+    {
+        var map = new Dictionary<float3, string> { [new float3(1.0f, 2.0f, 3.0f)] = "hit" };
+        Assert.Equal("hit", map[new float3(1.0f, 2.0f, 3.0f)]);
+        Assert.False(map.ContainsKey(new float3(1.0f, 2.0f, 3.5f)));
+
+        var cells = new HashSet<int2> { new int2(3, 4) };
+        Assert.Contains(new int2(3, 4), cells);
+        Assert.Contains(new int3(1, 2, 3), new HashSet<int3> { new int3(1, 2, 3) });
+
+        var nan = new float2(float.NaN, 0.0f);
+        var sameNan = nan;
+        Assert.True(nan.Equals(sameNan));
+        Assert.False((nan == sameNan).x);
+
+        Assert.True(new quaternion(0.0f, 0.0f, 0.0f, 1.0f) == quaternion.identity);
+        Assert.Equal(float2x2.identity, math.float2x2(1.0f, 0.0f, 0.0f, 1.0f));
+        Assert.Equal("float3(1, 2.5, -3)", new float3(1.0f, 2.5f, -3.0f).ToString());
+    }
+
+    [Fact]
+    public void AnyAllAndSelectFollowHlsl()
+    {
+        Assert.True(math.any(new bool2(false, true)));
+        Assert.False(math.any(bool3.@false));
+        Assert.True(math.all(bool4.@true));
+        Assert.False(math.all(new bool3(true, false, true)));
+
+        var mask = new bool3(true, false, true);
+        Assert.Equal(new float3(1.0f, 20.0f, 3.0f), math.select(mask, new float3(1.0f, 2.0f, 3.0f), new float3(10.0f, 20.0f, 30.0f)));
+        Assert.Equal(7.0f, math.select(true, 7.0f, 8.0f));
+        Assert.Equal(new float2(0.0f, 5.0f), math.select(new bool2(false, true), math.float2(5.0f), math.float2(0.0f)));
+        Assert.Equal(new float4(1.0f, 0.0f, 1.0f, 0.0f), math.select(new bool4(true, false, true, false), 1.0f, 0.0f));
+
+        Assert.Equal(new bool2(false, true), !new bool2(true, false));
+        Assert.Equal(new bool3(true, false, false), new bool3(true, true, false) & new bool3(true, false, true));
+        Assert.Equal(new bool3(true, true, true), new bool3(true, true, false) | new bool3(true, false, true));
+    }
+
+    [Fact]
+    public void AddedIntrinsicsAreComponentWise()
+    {
+        Assert.Equal(MathF.Log(3.0f), math.log(3.0f));
+        Assert.Equal(new float3(0.0f, MathF.Log(2.0f), MathF.Log(4.0f)), math.log(new float3(1.0f, 2.0f, 4.0f)));
+        Assert.Equal(new float2(8.0f, 9.0f), math.pow(new float2(2.0f, 3.0f), new float2(3.0f, 2.0f)));
+        Assert.Equal(new float4(1.0f, 2.0f, 3.0f, 4.0f), math.sqrt(new float4(1.0f, 4.0f, 9.0f, 16.0f)));
+        var sines = math.sin(new float3(0.0f, math.HALF_PI, math.PI));
+        Assert.Equal(0.0f, sines.x, precision: 5);
+        Assert.Equal(1.0f, sines.y, precision: 5);
+        Assert.Equal(0.0f, sines.z, precision: 5);
+        var cosines = math.cos(new float2(0.0f, math.PI));
+        Assert.Equal(1.0f, cosines.x, precision: 5);
+        Assert.Equal(-1.0f, cosines.y, precision: 5);
+        var arccosines = math.acos(new float3(1.0f, 0.0f, -1.0f));
+        Assert.Equal(0.0f, arccosines.x, precision: 5);
+        Assert.Equal(math.HALF_PI, arccosines.y, precision: 5);
+        Assert.Equal(math.PI, arccosines.z, precision: 5);
+        Assert.Equal(math.atan2(1.0f, -1.0f), math.atan2(new float2(1.0f, 0.0f), new float2(-1.0f, 1.0f)).x);
+        Assert.Equal(0.0f, math.atan2(new float4(1.0f, 0.0f, 1.0f, 0.0f), new float4(1.0f, 1.0f, 1.0f, 1.0f)).y);
+        Assert.Equal(2.5, math.min(2.5, 3.5));
+        Assert.Equal(3.5, math.max(2.5, 3.5));
+    }
+
+    [Fact]
+    public void IntVectorsPromoteToFloatVectors()
+    {
+        float3 promoted3 = new int3(1, 2, 3);
+        float4 promoted4 = new int4(1, 2, 3, 4);
+
+        Assert.Equal(new float3(1.0f, 2.0f, 3.0f), promoted3);
+        Assert.Equal(new float4(1.0f, 2.0f, 3.0f, 4.0f), promoted4);
+        Assert.Equal(new int3(2, 4, 6), new int3(1, 2, 3) * 2);
+        Assert.Equal(new int4(1, 0, 1, 0), new int4(3, 4, 5, 6) % 2);
+        Assert.Equal(new int3(1, 2, 3), math.int3(1, 2, 3));
+        Assert.Equal(new int4(5, 5, 5, 5), math.int4(5));
+    }
+
+    [Fact]
+    public void MatrixMulFollowsHlslRowMajorConvention()
+    {
+        var m = math.float2x2(1.0f, 2.0f, 3.0f, 4.0f);
+        var v = new float2(5.0f, 6.0f);
+
+        Assert.Equal(new float2(1.0f, 2.0f), m[0]);
+        Assert.Equal(new float2(17.0f, 39.0f), math.mul(m, v));
+        Assert.Equal(new float2(23.0f, 34.0f), math.mul(v, m));
+        Assert.Equal(math.float2x2(7.0f, 10.0f, 15.0f, 22.0f), math.mul(m, m));
+
+        var m3 = math.float3x3(new float3(1.0f, 2.0f, 3.0f), new float3(4.0f, 5.0f, 6.0f), new float3(7.0f, 8.0f, 9.0f));
+        var v3 = new float3(1.0f, 0.0f, -1.0f);
+        Assert.Equal(new float3(-2.0f, -2.0f, -2.0f), math.mul(m3, v3));
+        Assert.Equal(new float3(-6.0f, -6.0f, -6.0f), math.mul(v3, m3));
+        Assert.Equal(math.float3x3(30.0f, 36.0f, 42.0f, 66.0f, 81.0f, 96.0f, 102.0f, 126.0f, 150.0f), math.mul(m3, m3));
+        Assert.Equal(m3, math.mul(m3, float3x3.identity));
+
+        m3[1] = new float3(0.0f, 1.0f, 0.0f);
+        Assert.Equal(1.0f, m3._m11);
+        Assert.Equal(12.0f, math.mul(3.0f, 4.0f));
+    }
+
+    [Fact]
+    public void Float2x2RotateMatchesRotateAndUnityMathematics()
+    {
+        var rotation = float2x2.Rotate(0.5f);
+        var column = math.mul(rotation, new float2(1.0f, 0.0f));
+        var row = math.mul(new float2(1.0f, 0.0f), rotation);
+        var reference = math.rotate(new float2(1.0f, 0.0f), 0.5f);
+
+        Assert.Equal(reference.x, column.x, precision: 6);
+        Assert.Equal(reference.y, column.y, precision: 6);
+
+        // Unity.Mathematics 1.x reference values: mul(float2(1, 0), float2x2.Rotate(0.5f)).
+        Assert.Equal(0.87758255f, row.x, precision: 6);
+        Assert.Equal(-0.47942555f, row.y, precision: 6);
+    }
+
+    [Fact]
+    public void Float3x3EulerMatchesUnityMathematicsReference()
+    {
+        // Unity.Mathematics 1.x reference values captured from float3x3.Euler.
+        AssertRows(
+            float3x3.Euler(new float3(0.4f, -0.7f, 1.3f), math.RotationOrder.YXZ),
+            0.44632244f, -0.8874959f, 0.114662126f,
+            0.6698625f, 0.24638279f, -0.700414f,
+            0.59336376f, 0.38941833f, 0.70446634f);
+        AssertRows(
+            float3x3.Euler(new float3(0.4f, -0.7f, 1.3f)),
+            -0.037133574f, -0.8040775f, -0.59336376f,
+            0.8874959f, 0.24638279f, -0.38941833f,
+            0.45931715f, -0.5410684f, 0.70446634f);
+
+        // Aetheria ActionGameManager view direction: mul(float3(0, 0, 1), Euler(float3(yawPitch.yx, 0), YXZ)).
+        var yawPitch = new float2(0.3f, -1.1f);
+        var view = math.mul(new float3(0.0f, 0.0f, 1.0f), float3x3.Euler(new float3(yawPitch.yx, 0.0f), math.RotationOrder.YXZ));
+        Assert.Equal(-0.13404681f, view.x, precision: 5);
+        Assert.Equal(-0.8912074f, view.y, precision: 5);
+        Assert.Equal(0.4333369f, view.z, precision: 5);
+
+        var composed = math.mul(float3x3.RotateZ(0.2f), math.mul(float3x3.RotateY(0.3f), float3x3.RotateX(0.1f)));
+        AssertRows(float3x3.Euler(0.1f, 0.3f, 0.2f, math.RotationOrder.XYZ),
+            composed._m00, composed._m01, composed._m02,
+            composed._m10, composed._m11, composed._m12,
+            composed._m20, composed._m21, composed._m22);
+    }
+
+    [Theory]
+    [InlineData(0.0f, 0.0f, 0.0f, -0.41219875f)]
+    [InlineData(0.25f, -0.5f, 1.75f, 0.5250269f)]
+    [InlineData(12.25f, -4.5f, 3.125f, 0.008141451f)]
+    [InlineData(-7.3f, 2.9f, 101.4f, 0.578015f)]
+    public void Snoise3MatchesUnityMathematicsReference(float x, float y, float z, float expected)
+    {
+        Assert.Equal(expected, math.snoise(new float3(x, y, z)), precision: 5);
+    }
+
+    [Fact]
+    public void RandomFloat3OverloadsShareOneDrawOrder()
+    {
+        var a = new Random(99);
+        var b = new Random(99);
+        var c = new Random(99);
+
+        var unit = a.NextFloat3();
+        Assert.Equal(new float3(b.NextFloat(), b.NextFloat(), b.NextFloat()), unit);
+        Assert.Equal(unit * new float3(2.0f, 4.0f, 8.0f), c.NextFloat3(new float3(2.0f, 4.0f, 8.0f)));
+
+        var d = new Random(99);
+        Assert.Equal(math.float3(-1.0f) + unit * 2.0f, d.NextFloat3(math.float3(-1.0f), math.float3(1.0f)));
+    }
+
+    [Fact]
+    public void CoreAssemblyStaysEngineFree()
+    {
+        var references = typeof(math).Assembly.GetReferencedAssemblies();
+        Assert.DoesNotContain(references, reference => reference.Name!.StartsWith("UnityEngine", StringComparison.Ordinal));
+
+        var root = new DirectoryInfo(AppContext.BaseDirectory);
+        while (root is not null && !File.Exists(Path.Combine(root.FullName, "packages", "cultmath", "src", "CultMath", "CultMath.asmdef")))
+        {
+            root = root.Parent;
+        }
+
+        Assert.NotNull(root);
+        var asmdefPath = Path.Combine(root!.FullName, "packages", "cultmath", "src", "CultMath", "CultMath.asmdef");
+        using var asmdef = JsonDocument.Parse(File.ReadAllText(asmdefPath));
+        Assert.True(asmdef.RootElement.GetProperty("noEngineReferences").GetBoolean());
+    }
+
+    private static float3 Write(float3 value, WriteAction action)
+    {
+        action(ref value);
+        return value;
+    }
+
+    private delegate void WriteAction(ref float3 value);
+
+    private static void AssertRows(float3x3 m, params float[] expected)
+    {
+        var actual = new[] { m._m00, m._m01, m._m02, m._m10, m._m11, m._m12, m._m20, m._m21, m._m22 };
+        for (var index = 0; index < expected.Length; index++)
+        {
+            Assert.Equal(expected[index], actual[index], precision: 5);
+        }
+    }
+}
diff --git a/packages/cultmath/tests/CultMath.Tests/HlslSemanticsTests.cs.meta b/packages/cultmath/tests/CultMath.Tests/HlslSemanticsTests.cs.meta
new file mode 100644
index 00000000..8158a66d
--- /dev/null
+++ b/packages/cultmath/tests/CultMath.Tests/HlslSemanticsTests.cs.meta
@@ -0,0 +1,2 @@
+fileFormatVersion: 2
+guid: 7164d00a023e43578a31897347d8f106
diff --git a/packages/cultmath/tests/CultMath.Tests/HlslSourceCompatibilityTests.cs b/packages/cultmath/tests/CultMath.Tests/HlslSourceCompatibilityTests.cs
new file mode 100644
index 00000000..ca4584c7
--- /dev/null
+++ b/packages/cultmath/tests/CultMath.Tests/HlslSourceCompatibilityTests.cs
@@ -0,0 +1,203 @@
+using System.Reflection;
+using System.Text.RegularExpressions;
+using Microsoft.CodeAnalysis;
+using Microsoft.CodeAnalysis.CSharp;
+using Xunit;
+using static CultMath.math;
+
+namespace CultMath.Tests;
+
+/// <summary>
+/// The real shader mirror, <c>shaders/CultMath.hlsl</c>, compiles as C# against CultMath under
+/// <c>using static CultMath.math;</c> after exactly the source transformations listed in
+/// docs/design.md (HLSL Target: Source Transformations). <see cref="TransformHlslToCSharp"/> is
+/// that list in code; if a body needs anything else, this test fails.
+/// </summary>
+public sealed class HlslSourceCompatibilityTests
+{
+    [Fact]
+    public void ShaderMirrorBodiesCompileAsCSharp()
+    {
+        var (assembly, errors) = CompileShaderMirror();
+        Assert.True(assembly is not null, "HLSL mirror did not compile as C#:" + Environment.NewLine + string.Join(Environment.NewLine, errors));
+
+        var shader = assembly!.GetType("CultMathHlsl.HlslShader")!;
+        Assert.NotNull(ShaderFunction(shader, "cultmath_snoise", typeof(float3)));
+        Assert.NotNull(ShaderFunction(shader, "cultmath_snoise", typeof(float2)));
+        Assert.NotNull(ShaderFunction(shader, "cultmath_value_noise_bicubic", typeof(float2)));
+    }
+
+    // HLSL functions carry no access modifier, so they compile as private instance methods.
+    private static MethodInfo? ShaderFunction(Type shader, string name, params Type[] parameters) =>
+        shader.GetMethod(name, BindingFlags.Instance | BindingFlags.NonPublic, null, parameters, null);
+
+    // Mirror internals with no public C# math counterpart. Any other cultmath_* function must match one.
+    private static readonly string[] MirrorOnly = { "cultmath_snoise_mod289", "cultmath_snoise_permute" };
+
+    private static readonly float[] Specials = { 0.0f, -0.0f, 1.0f, -1.0f, 0.5f, -2.75f, 3.0f, 1.0e-7f, 1.0e4f, -1.0e4f, 1.0e7f, float.NaN };
+
+    /// <summary>
+    /// Every mirror function with a C# math counterpart returns the same bits (any NaN equals any NaN;
+    /// -0 differs from 0) over random inputs, every special value in every argument (ties, zeros,
+    /// negatives, NaN, large values, integer lattice points), special pairs, and vectors whose first two
+    /// components tie (x0.x == x0.y in snoise). This proves the text of CultMath.hlsl computes the same
+    /// float32 results as C# math on the CPU. It does not prove GPU agreement: driver sin precision alone
+    /// makes cultmath_hash and value noise differ bit for bit on hardware. The mirror's intrinsics are C#
+    /// math itself (it compiles under using static CultMath.math), so this proves the composition in the
+    /// text, not the intrinsic rules; HlslSemanticsTests alone pins those.
+    /// </summary>
+    [Fact]
+    public void EveryMirrorFunctionMatchesCSharpMath()
+    {
+        var (assembly, errors) = CompileShaderMirror();
+        Assert.True(assembly is not null, string.Join(Environment.NewLine, errors));
+        var shaderType = assembly!.GetType("CultMathHlsl.HlslShader")!;
+        var shader = Activator.CreateInstance(shaderType);
+
+        var random = new System.Random(0x5EED);
+        float Next() => random.NextSingle() * 200.0f - 100.0f;
+        var cases = new List<Func<int, float>>();
+        foreach (var s in Specials) cases.Add(_ => s);
+        for (var k = 0; k < Specials.Length; k++) { var o = k; cases.Add(i => Specials[(i + o + 1) % Specials.Length]); }
+        for (var k = 0; k < 64; k++) { var values = Enumerable.Range(0, 32).Select(_ => Next()).ToArray(); cases.Add(i => values[i]); }
+        for (var k = 0; k < 16; k++) { var values = Enumerable.Range(0, 32).Select(_ => Next()).ToArray(); cases.Add(i => values[i & ~1]); }
+
+        var mismatches = new List<string>();
+        var compared = new HashSet<string>();
+        foreach (var mirror in shaderType.GetMethods(BindingFlags.Instance | BindingFlags.NonPublic).Where(m => m.Name.StartsWith("cultmath_")))
+        {
+            var types = mirror.GetParameters().Select(p => p.ParameterType).ToArray();
+            var counterpart = typeof(math).GetMethod(mirror.Name["cultmath_".Length..], BindingFlags.Public | BindingFlags.Static, null, types, null);
+            if (counterpart is null)
+            {
+                Assert.Contains(mirror.Name, MirrorOnly);
+                continue;
+            }
+
+            compared.Add(mirror.Name);
+            foreach (var input in cases)
+            {
+                var slot = 0;
+                var args = types.Select(t => t == typeof(float) ? (object)input(slot++)
+                    : Activator.CreateInstance(t, Enumerable.Range(0, Components(t)).Select(_ => (object)input(slot++)).ToArray())!).ToArray();
+                var expected = Floats(counterpart.Invoke(null, args)!);
+                var actual = Floats(mirror.Invoke(shader, args)!);
+                if (expected.Length != actual.Length || expected.Zip(actual).Any(p => !(float.IsNaN(p.First) && float.IsNaN(p.Second))
+                    && BitConverter.SingleToInt32Bits(p.First) != BitConverter.SingleToInt32Bits(p.Second)))
+                {
+                    mismatches.Add($"{mirror.Name}({string.Join(", ", args.Select(a => string.Join(" ", Floats(a))))}): C# {string.Join(" ", expected)}, mirror {string.Join(" ", actual)}");
+                }
+            }
+        }
+
+        Assert.True(mismatches.Count == 0, $"{mismatches.Count} mismatches:{Environment.NewLine}{string.Join(Environment.NewLine, mismatches.Take(12))}");
+        Assert.Equal(26, compared.Count);
+    }
+
+    private static int Components(Type t) => t.GetFields().Count(f => f.FieldType == typeof(float) && !f.IsStatic);
+
+    private static float[] Floats(object value) => value is float f ? new[] { f }
+        : value.GetType().GetFields().Where(field => field.FieldType == typeof(float) && !field.IsStatic).Select(field => (float)field.GetValue(value)!).ToArray();
+
+    /// <summary>The documented HLSL-to-C# transformations, and nothing else.</summary>
+    internal static string TransformHlslToCSharp(string hlsl)
+    {
+        // 1. Include guards (#ifndef/#define/#endif) are dropped; C# has no textual include.
+        var source = Regex.Replace(hlsl, @"(?m)^\s*#(ifndef|define|endif)\b.*$", string.Empty);
+
+        // 2. Functions taking Texture2D/SamplerState resources are dropped; GPU resources have
+        //    no CultMath analog.
+        source = Regex.Replace(source, @"(?ms)^\w+ \w+\([^)]*\b(Texture2D|SamplerState)\b[^)]*\)\s*\{.*?^\}[ \t]*\r?$", string.Empty);
+
+        // 3. File-scope `static const` becomes `const` (C# consts are implicitly static).
+        source = Regex.Replace(source, @"(?m)^static const ", "const ");
+
+        // 4. Floating literals gain the `f` suffix; an unsuffixed C# literal is a double.
+        source = Regex.Replace(source, @"(?<![\w.])(\d+\.\d*(?:[eE][+-]?\d+)?|\d+[eE][+-]?\d+)(?![\w.])", "$1f");
+
+        // 5. The file body is wrapped in a class; C# has no free functions.
+        return "using CultMath;\nusing static CultMath.math;\nnamespace CultMathHlsl;\npublic class HlslShader\n{\n" + source + "\n}\n";
+    }
+
+    private static (Assembly? Assembly, IReadOnlyList<string> Errors) CompileShaderMirror()
+    {
+        var hlsl = File.ReadAllText(Path.Combine(FindCultMathRoot(), "shaders", "CultMath.hlsl"));
+        var tree = CSharpSyntaxTree.ParseText(TransformHlslToCSharp(hlsl));
+        var references = ((string)AppContext.GetData("TRUSTED_PLATFORM_ASSEMBLIES")!)
+            .Split(Path.PathSeparator)
+            .Append(typeof(math).Assembly.Location)
+            .Distinct(StringComparer.OrdinalIgnoreCase)
+            .Select(path => MetadataReference.CreateFromFile(path));
+        var compilation = CSharpCompilation.Create(
+            "CultMathHlslMirror",
+            new[] { tree },
+            references,
+            new CSharpCompilationOptions(OutputKind.DynamicallyLinkedLibrary));
+
+        using var stream = new MemoryStream();
+        var result = compilation.Emit(stream);
+        var errors = result.Diagnostics
+            .Where(diagnostic => diagnostic.Severity == DiagnosticSeverity.Error)
+            .Select(diagnostic => diagnostic.ToString())
+            .ToList();
+        return (result.Success ? Assembly.Load(stream.ToArray()) : null, errors);
+    }
+
+    private static string FindCultMathRoot()
+    {
+        var directory = new DirectoryInfo(AppContext.BaseDirectory);
+        while (directory is not null && !File.Exists(Path.Combine(directory.FullName, "packages", "cultmath", "shaders", "CultMath.hlsl")))
+        {
+            directory = directory.Parent;
+        }
+
+        return Path.Combine(directory?.FullName ?? throw new InvalidOperationException("CultMath package root not found."), "packages", "cultmath");
+    }
+
+    // ---- Hand-written HLSL-shaped host code: swizzles, mixed constructors, matrix rows. ----
+    static float3 shade(float3 position, float3 normal, float2 wind, float time)
+    {
+        float3 p = position;
+        p.xz = p.xz + wind * time;
+        p.y = saturate(p.y);
+
+        float3x3 basis = float3x3(float3(1, 0, 0), float3(0, 1, 0), float3(0, 0, 1));
+        basis[1][1] = 1.0f;
+        float3 n = normalize(mul(basis, normal));
+        float ndotl = saturate(dot(n, normalize(float3(0.3f, 1, 0.2f))));
+        float4 color = float4(lerp(float3(0.1f, 0.1f, 0.2f), float3(1, 0.9f, 0.7f), ndotl), 1);
+
+        if (any(p < 0.0f))
+            color.rgb *= 0.5f;
+        if (all(abs(n) <= 1.0f))
+            color.bgr = color.bgr * float3(1, 1, 1);
+
+        color.rgb = select(p > 10.0f, float3(0), color.rgb);
+        float2 uv = frac(p.xz * 0.25f);
+        color.rg = lerp(color.rg, uv, 0.1f);
+        return float4(color.xy, color.zw).xyz;
+    }
+
+    static float2 steer(float2 direction, float torque)
+    {
+        float2x2 turn = float2x2(cos(torque), -sin(torque), sin(torque), cos(torque));
+        float2 turned = mul(direction, turn);
+        return normalize(turned) * pow(length(turned), 1.0f);
+    }
+
+    [Fact]
+    public void HandWrittenShaderStyleMathEvaluates()
+    {
+        var color = shade(float3(1.0f, 0.5f, 2.0f), float3(0.0f, 1.0f, 0.0f), float2(1.0f, 0.0f), 0.0f);
+        Assert.True(color.x > 0.1f && color.x <= 1.0f);
+        Assert.True(float.IsFinite(color.y) && float.IsFinite(color.z));
+
+        var far = shade(float3(20.0f, 20.0f, 20.0f), float3(0.0f, 1.0f, 0.0f), float2(0.0f), 0.0f);
+        Assert.Equal(0.0f, far.z);
+
+        var steered = steer(float2(1.0f, 0.0f), 0.5f);
+        var viaRotate = mul(float2(1.0f, 0.0f), CultMath.float2x2.Rotate(0.5f));
+        Assert.Equal(viaRotate.x, steered.x, precision: 5);
+        Assert.Equal(viaRotate.y, steered.y, precision: 5);
+    }
+}
diff --git a/packages/cultmath/tests/CultMath.Tests/HlslSourceCompatibilityTests.cs.meta b/packages/cultmath/tests/CultMath.Tests/HlslSourceCompatibilityTests.cs.meta
new file mode 100644
index 00000000..0d673e1e
--- /dev/null
+++ b/packages/cultmath/tests/CultMath.Tests/HlslSourceCompatibilityTests.cs.meta
@@ -0,0 +1,2 @@
+fileFormatVersion: 2
+guid: 942fbcb9c28a4e559e5baf435dc24cf1
diff --git a/packages/cultmath/tests/CultMath.Tests/MathTests.cs b/packages/cultmath/tests/CultMath.Tests/MathTests.cs
new file mode 100644
index 00000000..de1bf996
--- /dev/null
+++ b/packages/cultmath/tests/CultMath.Tests/MathTests.cs
@@ -0,0 +1,335 @@
+using CultMath;
+using Xunit;
+
+namespace CultMath.Tests;
+
+public sealed class MathTests
+{
+    [Fact]
+    public void FracMatchesShaderStylePositiveAndNegativeValues()
+    {
+        Assert.Equal(0.25f, math.frac(1.25f));
+        Assert.Equal(0.75f, math.frac(-1.25f));
+    }
+
+    [Fact]
+    public void VectorOperationsAreComponentWise()
+    {
+        var value = new float3(1.0f, 2.0f, 3.0f) * new float3(4.0f, 5.0f, 6.0f);
+
+        Assert.Equal(new float3(4.0f, 10.0f, 18.0f), value);
+    }
+
+    [Fact]
+    public void VectorConstructorsAcceptLowerDimensionVectors()
+    {
+        Assert.Equal(new int2(1, 2), math.int2(1, 2));
+        Assert.Equal(new float2(1.0f, 2.0f), math.float2(1.0f, 2.0f));
+        Assert.Equal(new float3(1.0f, 1.0f, 1.0f), math.float3(1.0f));
+        Assert.Equal(new float4(1.0f, 2.0f, 3.0f, 4.0f), math.float4(new float3(1.0f, 2.0f, 3.0f), 4.0f));
+        Assert.Equal(new float3(1.0f, 2.0f, 3.0f), new float3(new float2(1.0f, 2.0f), 3.0f));
+        Assert.Equal(new float4(1.0f, 2.0f, 3.0f, 4.0f), new float4(new float2(1.0f, 2.0f), 3.0f, 4.0f));
+        Assert.Equal(new float4(1.0f, 2.0f, 3.0f, 4.0f), new float4(new float3(1.0f, 2.0f, 3.0f), 4.0f));
+    }
+
+    [Fact]
+    public void VectorsExposeCommonSwizzles()
+    {
+        Assert.Equal(new float3(2.0f, 3.0f, 1.0f), new float3(1.0f, 2.0f, 3.0f).yzx);
+        Assert.Equal(new float3(3.0f, 2.0f, 1.0f), new float3(1.0f, 2.0f, 3.0f).zyx);
+        Assert.Equal(new float2(3.0f, 2.0f), new float3(1.0f, 2.0f, 3.0f).zy);
+        Assert.Equal(new float3(1.0f, 2.0f, 4.0f), new float4(1.0f, 2.0f, 3.0f, 4.0f).xyw);
+        Assert.Equal(new float3(2.0f, 3.0f, 1.0f), new float4(1.0f, 2.0f, 3.0f, 4.0f).yzx);
+        Assert.Equal(new float4(1.0f, 2.0f, 3.0f, 4.0f), new float4(1.0f, new float3(2.0f, 3.0f, 4.0f)));
+        Assert.Equal(new float4(1.0f, 2.0f, 3.0f, 4.0f), math.float4(1.0f, new float3(2.0f, 3.0f, 4.0f)));
+    }
+
+    [Fact]
+    public void VectorsSupportUnityStyleFieldAndSwizzleMutation()
+    {
+        var position = new float3(1.0f, 2.0f, 3.0f);
+        position.y = 5.0f;
+        position.xz = new float2(8.0f, 13.0f);
+
+        Assert.Equal(new float3(8.0f, 5.0f, 13.0f), position);
+
+        var bounds = new float4(1.0f, 2.0f, 3.0f, 4.0f);
+        bounds.xy = new float2(-1.0f, -2.0f);
+
+        Assert.Equal(new float4(-1.0f, -2.0f, 3.0f, 4.0f), bounds);
+    }
+
+    [Fact]
+    public void DoubleVectorsSupportDampedMath()
+    {
+        var value = new double3(1.0, 2.0, 3.0);
+        value.xy = new double2(5.0, 8.0);
+
+        Assert.Equal(new double3(5.0, 8.0, 3.0), value);
+        Assert.Equal(new double2(Math.Exp(-2.0), Math.Exp(-4.0)), math.exp(new double2(-2.0, -4.0)));
+        Assert.Equal(new double3(2.0, 4.0, 6.0), math.lerp(new double3(0.0, 0.0, 0.0), new double3(4.0, 8.0, 12.0), new double3(0.5, 0.5, 0.5)));
+    }
+
+    [Fact]
+    public void Int2SupportsGridArithmeticAndFloatPromotion()
+    {
+        var cell = new int2(2, 3);
+
+        Assert.Equal(new int2(3, 5), cell + new int2(1, 2));
+        Assert.Equal(new int2(4, 6), cell * new int2(2, 2));
+        Assert.Equal(3, cell[1]);
+
+        float2 promoted = cell;
+        Assert.Equal(new float2(2.0f, 3.0f), promoted);
+    }
+
+    [Fact]
+    public void Bool2SupportsHullGridStyleStorage()
+    {
+        bool2 conductivity = true;
+
+        conductivity.y = false;
+
+        Assert.True(conductivity.x);
+        Assert.False(conductivity[1]);
+        Assert.Equal(new bool2(false, true), math.bool2(false, true));
+    }
+
+    [Fact]
+    public void QuaternionLookRotationProducesUnitOrientation()
+    {
+        var rotation = quaternion.LookRotation(new float3(0.0f, 0.0f, 1.0f), new float3(0.0f, 1.0f, 0.0f));
+
+        Assert.Equal(quaternion.identity, rotation);
+        Assert.Equal(1.0f, math.length((float4)quaternion.LookRotation(new float3(1.0f, 0.0f, 0.0f), new float3(0.0f, 1.0f, 0.0f))), precision: 5);
+    }
+
+    [Fact]
+    public void RandomUsesStableXorShift32Sequence()
+    {
+        var a = new Random(1234);
+        var b = new Random(1234);
+
+        Assert.Equal(332584831u, a.NextUInt());
+        Assert.Equal(1855942593u, a.NextUInt());
+        Assert.Equal(4018585650u, a.NextUInt());
+        Assert.Equal(3348358578u, a.NextUInt());
+        Assert.Equal(332584831u, b.NextUInt());
+    }
+
+    [Fact]
+    public void RandomProvidesDeterministicPortableSampling()
+    {
+        var a = new Random(1234);
+        var b = new Random(1234);
+
+        Assert.Equal(a.NextUInt(), b.NextUInt());
+        Assert.Equal(a.NextFloat(), b.NextFloat());
+
+        var bounded = a.NextFloat(-2.0f, 4.0f);
+        Assert.True(bounded >= -2.0f && bounded < 4.0f);
+
+        var direction = a.NextFloat2Direction();
+        Assert.Equal(1.0f, math.length(direction), precision: 5);
+
+        var point = a.NextFloat3(new float3(-1.0f, -2.0f, -3.0f), new float3(1.0f, 2.0f, 3.0f));
+        Assert.True(point.x >= -1.0f && point.x < 1.0f);
+        Assert.True(point.y >= -2.0f && point.y < 2.0f);
+        Assert.True(point.z >= -3.0f && point.z < 3.0f);
+    }
+
+    [Fact]
+    public void NormalizeProducesUnitLength()
+    {
+        var value = math.normalize(new float3(3.0f, 4.0f, 0.0f));
+
+        Assert.Equal(1.0f, math.length(value), precision: 5);
+    }
+
+    [Fact]
+    public void SmoothstepUsesHermiteRamp()
+    {
+        Assert.Equal(0.0f, math.smoothstep(0.0f, 1.0f, -1.0f));
+        Assert.Equal(0.5f, math.smoothstep(0.0f, 1.0f, 0.5f), precision: 5);
+        Assert.Equal(1.0f, math.smoothstep(0.0f, 1.0f, 2.0f));
+        Assert.Equal(0.5f, math.smootherstep(0.5f), precision: 5);
+    }
+
+    [Fact]
+    public void TrigIntrinsicsUseRadians()
+    {
+        Assert.Equal(1.0f, math.sin(math.HALF_PI), precision: 5);
+        Assert.Equal(-1.0f, math.cos(math.PI), precision: 5);
+        Assert.Equal(1.0f, math.tan(math.PI * 0.25f), precision: 5);
+        Assert.Equal(math.HALF_PI, math.atan2(1.0f, 0.0f), precision: 5);
+        Assert.Equal(2, math.min(2, 5));
+        Assert.Equal(5, math.max(2, 5));
+        Assert.True(math.isinf(float.PositiveInfinity));
+    }
+
+    [Fact]
+    public void SignIsComponentWiseForSimulationVectors()
+    {
+        Assert.Equal(-1, math.sign(-12.0f));
+        Assert.Equal(0, math.sign(0.0f));
+        Assert.Equal(1, math.sign(12.0f));
+        Assert.Equal(new int3(-1, 0, 1), math.sign(new float3(-2.0f, 0.0f, 4.0f)));
+    }
+
+    [Fact]
+    public void RotateTurnsFloat2CounterClockwiseInRadians()
+    {
+        var rotated = math.rotate(new float2(1.0f, 0.0f), math.HALF_PI);
+
+        Assert.Equal(0.0f, rotated.x, precision: 5);
+        Assert.Equal(1.0f, rotated.y, precision: 5);
+
+        var rotatedDegrees = math.rotate_degrees(new float2(0.0f, 1.0f), 90.0f);
+        Assert.Equal(-1.0f, rotatedDegrees.x, precision: 5);
+        Assert.Equal(0.0f, rotatedDegrees.y, precision: 5);
+    }
+
+    [Fact]
+    public void AetheriaPrimitivesRemainSmallAndDeterministic()
+    {
+        Assert.Equal(6.0f, math.csum(new float3(1.0f, 2.0f, 3.0f)));
+        Assert.Equal(0.25f, math.unlerp(10.0f, 30.0f, 15.0f));
+        Assert.Equal(new float2(0.25f, 0.75f), math.unlerp(new float2(10.0f, 10.0f), new float2(30.0f, 30.0f), new float2(15.0f, 25.0f)));
+        Assert.Equal(MathF.Exp(-2.0f), math.decay(1.0f, 2.0f, 1.0f), precision: 5);
+        Assert.Equal(1.0f - MathF.Exp(-2.0f), math.damp(0.0f, 1.0f, 2.0f, 1.0f), precision: 5);
+
+        Assert.Equal(15.0f, math.catmullrom(0.0f, 10.0f, 20.0f, 30.0f, 0.5f), precision: 5);
+        Assert.Equal(0.25f, math.quadratic_bezier(0.0f, 0.0f, 1.0f, 0.5f), precision: 5);
+        Assert.Equal(0.5f, math.cubic_bezier(0.0f, 0.0f, 1.0f, 1.0f, 0.5f), precision: 5);
+    }
+
+    [Fact]
+    public void SegmentDistanceReportsClosestPoint()
+    {
+        var distance = math.distance_to_segment(new float2(2.0f, 3.0f), new float2(0.0f, 0.0f), new float2(4.0f, 0.0f), out var closest);
+
+        Assert.Equal(3.0f, distance, precision: 5);
+        Assert.Equal(new float2(2.0f, 0.0f), closest);
+    }
+
+    [Fact]
+    public void RectNormalizesAndDerivesFromMinMax()
+    {
+        var bounds = new rect(8.0f, 6.0f, 2.0f, -2.0f);
+
+        Assert.Equal(new float2(2.0f, -2.0f), bounds.min);
+        Assert.Equal(new float2(8.0f, 6.0f), bounds.max);
+        Assert.Equal(new float2(6.0f, 8.0f), bounds.size);
+        Assert.Equal(new float2(5.0f, 2.0f), bounds.center);
+        Assert.Equal(48.0f, bounds.area);
+    }
+
+    [Fact]
+    public void RectContainmentIncludesBoundary()
+    {
+        var bounds = new rect(-2.0f, -1.0f, 4.0f, 3.0f);
+
+        Assert.True(bounds.Contains(new float2(-2.0f, -1.0f)));
+        Assert.True(bounds.Contains(new float2(4.0f, 3.0f)));
+        Assert.True(bounds.Contains(new rect(-1.0f, 0.0f, 1.0f, 2.0f)));
+        Assert.False(bounds.Contains(new float2(4.001f, 3.0f)));
+    }
+
+    [Fact]
+    public void RectIntersectionTreatsTouchingEdgesAsContact()
+    {
+        var left = new rect(0.0f, 0.0f, 4.0f, 4.0f);
+        var touching = new rect(4.0f, 1.0f, 8.0f, 3.0f);
+        var separate = new rect(4.001f, 1.0f, 8.0f, 3.0f);
+
+        Assert.True(left.Intersects(touching));
+        Assert.Equal(0.0f, left.Intersection(touching).area);
+        Assert.False(left.Intersects(separate));
+    }
+
+    [Fact]
+    public void FirstOrderInterceptSolvesSimpleClosingTarget()
+    {
+        var time = math.first_order_intercept_time(
+            2.0f,
+            new float3(10.0f, 0.0f, 0.0f),
+            new float3(-1.0f, 0.0f, 0.0f));
+
+        Assert.Equal(10.0f / 3.0f, time, precision: 5);
+    }
+
+    [Fact]
+    public void ValueNoiseIsDeterministicAndSmoothAtCellCorners()
+    {
+        var position = new float2(12.25f, -4.5f);
+
+        Assert.Equal(math.value_noise(position), math.value_noise(position));
+        Assert.Equal(math.hash(new float2(3.0f, 5.0f)), math.value_noise(new float2(3.0f, 5.0f)), precision: 5);
+
+        var bicubic = math.value_noise_bicubic(position);
+        Assert.True(bicubic > -0.25f && bicubic < 1.25f);
+    }
+
+    [Theory]
+    [InlineData(0.0f, 0.0f, 0.0f)]
+    [InlineData(0.25f, -0.5f, -0.425866783f)]
+    [InlineData(12.25f, -4.5f, 0.258312f)]
+    [InlineData(536.5106f, 536.5106f, -0.6901103f)]
+    public void SimplexNoiseMatchesUnityMathematics(float x, float y, float expected)
+    {
+        Assert.Equal(expected, math.snoise(new float2(x, y)), precision: 6);
+    }
+
+    [Fact]
+    public void VoronoiBatchProducesToneMappedColors()
+    {
+        var xs = new[] { 0.0f, 24.0f, 96.0f };
+        var ys = new[] { 0.0f, 36.0f, 144.0f };
+        var tones = new[] { CultMathTone.Background, CultMathTone.Header, CultMathTone.Body };
+        var spans = new[] { 1920.0f, 8.0f, 8.0f };
+        var colors = new Color32[xs.Length];
+
+        Voronoi.SampleTones(xs, ys, tones, spans, 1080.0f, 12, colors);
+
+        Assert.NotEqual(new Color32(), colors[0]);
+        Assert.True(colors[1].r > colors[1].g);
+        Assert.True(colors[2].r > 120 && colors[2].g > 120 && colors[2].b > 120);
+    }
+
+    [Fact]
+    public void BatchRadialFalloffAccelerationMatchesScalarContract()
+    {
+        var xs = new[] { 0.0f, 5.0f, 10.0f };
+        var ys = new[] { 0.0f, 0.0f, 0.0f };
+        var ax = new float[xs.Length];
+        var ay = new float[xs.Length];
+
+        BatchMath.AddRadialFalloffAcceleration2D(xs, ys, 10.0f, 0.0f, 10.0f, 20.0f, ax, ay);
+
+        Assert.True(BatchMath.LaneCount >= 4);
+        Assert.Equal(5.0f, ax[0], precision: 5);
+        Assert.Equal(7.5f, ax[1], precision: 5);
+        Assert.Equal(0.0f, ax[2], precision: 5);
+        Assert.Equal(0.0f, ay[0], precision: 5);
+    }
+
+    [Fact]
+    public void BatchEulerIntegrationHonorsDynamicMask()
+    {
+        var dynamicMask = new[] { 1.0f, 0.0f };
+        var px = new[] { 0.0f, 0.0f };
+        var py = new[] { 0.0f, 0.0f };
+        var vx = new[] { 1.0f, 1.0f };
+        var vy = new[] { 0.0f, 0.0f };
+        var ax = new[] { 2.0f, 2.0f };
+        var ay = new[] { 0.0f, 4.0f };
+
+        BatchMath.IntegrateSemiImplicitEuler2D(0.5f, dynamicMask, px, py, vx, vy, ax, ay);
+
+        Assert.Equal(2.0f, vx[0], precision: 5);
+        Assert.Equal(1.0f, px[0], precision: 5);
+        Assert.Equal(1.0f, vx[1], precision: 5);
+        Assert.Equal(0.0f, px[1], precision: 5);
+        Assert.Equal(0.0f, py[1], precision: 5);
+    }
+}
diff --git a/packages/cultmath/tests/CultMath.Tests/MathTests.cs.meta b/packages/cultmath/tests/CultMath.Tests/MathTests.cs.meta
new file mode 100644
index 00000000..277df5a3
--- /dev/null
+++ b/packages/cultmath/tests/CultMath.Tests/MathTests.cs.meta
@@ -0,0 +1,2 @@
+fileFormatVersion: 2
+guid: c7a709e5345da214aa650e8c796fcaff
\ No newline at end of file
diff --git a/packages/cultmath/tools.meta b/packages/cultmath/tools.meta
new file mode 100644
index 00000000..3594fa6a
--- /dev/null
+++ b/packages/cultmath/tools.meta
@@ -0,0 +1,8 @@
+fileFormatVersion: 2
+guid: 697162910ffd9614ba9655d31af9afa4
+folderAsset: yes
+DefaultImporter:
+  externalObjects: {}
+  userData: 
+  assetBundleName: 
+  assetBundleVariant: 
diff --git a/packages/cultmath/tools/compile-hlsl-spirv.ps1 b/packages/cultmath/tools/compile-hlsl-spirv.ps1
new file mode 100644
index 00000000..280e08d5
--- /dev/null
+++ b/packages/cultmath/tools/compile-hlsl-spirv.ps1
@@ -0,0 +1,69 @@
+param(
+    [Parameter(Mandatory = $true)]
+    [string]$ShaderPath,
+
+    [Parameter(Mandatory = $true)]
+    [string]$OutputPath,
+
+    [string]$EntryPoint = "main",
+    [string]$Profile = "cs_6_0",
+    [string[]]$IncludePath = @(),
+    [string]$TargetEnv = "",
+    [int]$VulkanCBufferShift = 0,
+    [int]$VulkanTextureShift = 10,
+    [int]$VulkanUavShift = 20,
+    [int]$VulkanSamplerShift = 30,
+    [string]$DxcPath = ""
+)
+
+$ErrorActionPreference = "Stop"
+
+$repoRoot = Resolve-Path (Join-Path $PSScriptRoot "..")
+if (-not $DxcPath) {
+    $DxcPath = Join-Path $repoRoot ".tools\dxc\current\bin\x64\dxc.exe"
+}
+
+if (-not (Test-Path $DxcPath)) {
+    throw "DXC not found at '$DxcPath'. Run tools\get-dxc.ps1 first or pass -DxcPath."
+}
+
+$resolvedShader = Resolve-Path $ShaderPath
+$resolvedIncludes = @((Join-Path $repoRoot "shaders"))
+foreach ($path in $IncludePath) {
+    $resolvedIncludes += (Resolve-Path $path)
+}
+
+$outputDirectory = Split-Path -Parent $OutputPath
+if ($outputDirectory) {
+    New-Item -ItemType Directory -Force -Path $outputDirectory | Out-Null
+}
+
+$arguments = @(
+    "-T", $Profile,
+    "-E", $EntryPoint,
+    "-spirv"
+)
+
+if ($TargetEnv) {
+    $arguments += "-fspv-target-env=$TargetEnv"
+}
+
+$arguments += @(
+    "-fvk-b-shift", $VulkanCBufferShift.ToString(), "0",
+    "-fvk-t-shift", $VulkanTextureShift.ToString(), "0",
+    "-fvk-u-shift", $VulkanUavShift.ToString(), "0",
+    "-fvk-s-shift", $VulkanSamplerShift.ToString(), "0"
+)
+
+foreach ($include in $resolvedIncludes) {
+    $arguments += @("-I", $include)
+}
+
+$arguments += @($resolvedShader, "-Fo", $OutputPath)
+
+& $DxcPath @arguments
+if ($LASTEXITCODE -ne 0) {
+    throw "dxc.exe failed with exit code $LASTEXITCODE."
+}
+
+Get-Item -LiteralPath $OutputPath
diff --git a/packages/cultmath/tools/compile-hlsl-spirv.ps1.meta b/packages/cultmath/tools/compile-hlsl-spirv.ps1.meta
new file mode 100644
index 00000000..31e7948a
--- /dev/null
+++ b/packages/cultmath/tools/compile-hlsl-spirv.ps1.meta
@@ -0,0 +1,7 @@
+fileFormatVersion: 2
+guid: b47e7016a99a5d148bc44c399c13c4d3
+DefaultImporter:
+  externalObjects: {}
+  userData: 
+  assetBundleName: 
+  assetBundleVariant: 
diff --git a/packages/cultmath/tools/compile-spirv-metal.ps1 b/packages/cultmath/tools/compile-spirv-metal.ps1
new file mode 100644
index 00000000..490e6331
--- /dev/null
+++ b/packages/cultmath/tools/compile-spirv-metal.ps1
@@ -0,0 +1,34 @@
+param(
+    [Parameter(Mandatory = $true)]
+    [string]$SpirvPath,
+
+    [Parameter(Mandatory = $true)]
+    [string]$OutputPath,
+
+    [int]$MslVersion = 23000,
+    [string]$SpirvCrossPath = ""
+)
+
+$ErrorActionPreference = "Stop"
+
+$repoRoot = Resolve-Path (Join-Path $PSScriptRoot "..")
+if (-not $SpirvCrossPath) {
+    $SpirvCrossPath = Join-Path $repoRoot ".tools\spirv-cross\build\spirv-cross.exe"
+}
+
+if (-not (Test-Path $SpirvCrossPath)) {
+    throw "SPIRV-Cross not found at '$SpirvCrossPath'. Run tools\get-spirv-cross.ps1 first or pass -SpirvCrossPath."
+}
+
+$resolvedSpirv = Resolve-Path $SpirvPath
+$outputDirectory = Split-Path -Parent $OutputPath
+if ($outputDirectory) {
+    New-Item -ItemType Directory -Force -Path $outputDirectory | Out-Null
+}
+
+& $SpirvCrossPath $resolvedSpirv --msl --msl-version $MslVersion --output $OutputPath
+if ($LASTEXITCODE -ne 0) {
+    throw "spirv-cross failed with exit code $LASTEXITCODE."
+}
+
+Get-Item -LiteralPath $OutputPath
diff --git a/packages/cultmath/tools/compile-spirv-metal.ps1.meta b/packages/cultmath/tools/compile-spirv-metal.ps1.meta
new file mode 100644
index 00000000..2e7e74c2
--- /dev/null
+++ b/packages/cultmath/tools/compile-spirv-metal.ps1.meta
@@ -0,0 +1,7 @@
+fileFormatVersion: 2
+guid: 6150c8f461e471b4c8641fd32d1984ef
+DefaultImporter:
+  externalObjects: {}
+  userData: 
+  assetBundleName: 
+  assetBundleVariant: 
diff --git a/packages/cultmath/tools/generate-swizzles.ps1 b/packages/cultmath/tools/generate-swizzles.ps1
new file mode 100644
index 00000000..9030f2be
--- /dev/null
+++ b/packages/cultmath/tools/generate-swizzles.ps1
@@ -0,0 +1,132 @@
+param(
+    [string]$OutputPath = ""
+)
+
+# Writes src\CultMath\Swizzles.g.cs: HLSL swizzles and mixed constructors for
+# CultMath's vector types. The output is checked in; rerun after changing the
+# family table below and commit both files together.
+
+$ErrorActionPreference = "Stop"
+
+if (-not $OutputPath) {
+    $OutputPath = Join-Path $PSScriptRoot "..\src\CultMath\Swizzles.g.cs"
+}
+
+# Functions: emit math.<type>(...) constructor functions. double has none because
+# a math.double3 method group would hide the double3 type name under
+# `using static CultMath.math;` and HLSL shader code does not construct doubles.
+$families = @(
+    @{ Scalar = "float"; Sizes = @(2, 3, 4); Functions = $true },
+    @{ Scalar = "int"; Sizes = @(2, 3, 4); Functions = $true },
+    @{ Scalar = "bool"; Sizes = @(2, 3, 4); Functions = $true },
+    @{ Scalar = "double"; Sizes = @(2, 3); Functions = $false }
+)
+$componentFields = @("x", "y", "z", "w")
+$namings = @(@("x", "y", "z", "w"), @("r", "g", "b", "a"))
+
+function Get-Compositions([int]$total) {
+    # Ordered part sizes summing to $total, excluding the all-scalar form that the
+    # hand-written base constructor already owns.
+    $results = [System.Collections.Generic.List[object]]::new()
+    function Expand([int]$remaining, [int[]]$prefix) {
+        if ($remaining -eq 0) {
+            if (@($prefix | Where-Object { $_ -ne 1 }).Count -gt 0) {
+                $results.Add($prefix)
+            }
+            return
+        }
+        for ($part = 1; $part -le $remaining; $part++) {
+            Expand ($remaining - $part) ($prefix + $part)
+        }
+    }
+    Expand $total @()
+    return , $results
+}
+
+$builder = [System.Text.StringBuilder]::new()
+function Line([string]$text = "") { [void]$builder.Append($text).Append("`n") }
+
+Line "// <auto-generated>"
+Line "// Generated by tools/generate-swizzles.ps1. Do not edit by hand."
+Line "// </auto-generated>"
+Line ""
+Line "namespace CultMath;"
+
+$functionLines = [System.Collections.Generic.List[string]]::new()
+
+foreach ($family in $families) {
+    $scalar = $family.Scalar
+    $maxSize = ($family.Sizes | Measure-Object -Maximum).Maximum
+    foreach ($size in $family.Sizes) {
+        $type = "$scalar$size"
+        Line ""
+        Line "public partial struct $type"
+        Line "{"
+
+        foreach ($composition in (Get-Compositions $size)) {
+            $parameters = @()
+            $arguments = @()
+            $offset = 0
+            foreach ($part in $composition) {
+                $name = -join $componentFields[$offset..($offset + $part - 1)]
+                if ($part -eq 1) {
+                    $parameters += "$scalar $name"
+                    $arguments += $name
+                } else {
+                    $parameters += "$scalar$part $name"
+                    for ($i = 0; $i -lt $part; $i++) { $arguments += "$name.$($componentFields[$i])" }
+                }
+                $offset += $part
+            }
+            $parameterList = $parameters -join ", "
+            Line "    public $type($parameterList) : this($($arguments -join ', ')) { }"
+            if ($family.Functions) {
+                $names = @($parameters | ForEach-Object { ($_ -split " ")[1] })
+                $functionLines.Add("    public static $type $type($parameterList) => new($($names -join ', '));")
+            }
+        }
+
+        # Single-component color aliases; x/y/z/w are the fields themselves.
+        $letters = $namings[1]
+        for ($i = 0; $i -lt $size; $i++) {
+            Line "    public $scalar $($letters[$i]) { readonly get => $($componentFields[$i]); set => $($componentFields[$i]) = value; }"
+        }
+
+        foreach ($letters in $namings) {
+            for ($length = 2; $length -le $maxSize; $length++) {
+                $count = [math]::Pow($size, $length)
+                for ($index = 0; $index -lt $count; $index++) {
+                    [int[]]$digits = @()
+                    [int]$remainder = $index
+                    for ($d = 0; $d -lt $length; $d++) {
+                        $digits = @([int]($remainder % $size)) + $digits
+                        $remainder = [int][math]::Floor($remainder / $size)
+                    }
+                    $name = -join ($digits | ForEach-Object { $letters[$_] })
+                    $getter = ($digits | ForEach-Object { $componentFields[$_] }) -join ", "
+                    $resultType = "$scalar$length"
+                    $unique = @($digits | Select-Object -Unique).Count -eq $length
+                    if ($unique) {
+                        $assignments = for ($d = 0; $d -lt $length; $d++) { "$($componentFields[$digits[$d]]) = value.$($componentFields[$d]);" }
+                        Line "    public $resultType $name { readonly get => new($getter); set { $($assignments -join ' ') } }"
+                    } else {
+                        Line "    public readonly $resultType $name => new($getter);"
+                    }
+                }
+            }
+        }
+
+        Line "}"
+    }
+}
+
+Line ""
+Line "public static partial class math"
+Line "{"
+foreach ($functionLine in $functionLines) { Line $functionLine }
+Line "}"
+
+$fullPath = [System.IO.Path]::GetFullPath($OutputPath)
+$content = $builder.ToString() -replace "`n", "`r`n"
+[System.IO.File]::WriteAllText($fullPath, $content, [System.Text.UTF8Encoding]::new($false))
+Write-Host "Wrote $fullPath ($((Get-Item -LiteralPath $fullPath).Length) bytes)"
diff --git a/packages/cultmath/tools/generate-swizzles.ps1.meta b/packages/cultmath/tools/generate-swizzles.ps1.meta
new file mode 100644
index 00000000..74842405
--- /dev/null
+++ b/packages/cultmath/tools/generate-swizzles.ps1.meta
@@ -0,0 +1,7 @@
+fileFormatVersion: 2
+guid: d7a796fd2d87489c9f055fd6e73513b5
+DefaultImporter:
+  externalObjects: {}
+  userData: 
+  assetBundleName: 
+  assetBundleVariant: 
diff --git a/packages/cultmath/tools/get-dxc.ps1 b/packages/cultmath/tools/get-dxc.ps1
new file mode 100644
index 00000000..d9b12593
--- /dev/null
+++ b/packages/cultmath/tools/get-dxc.ps1
@@ -0,0 +1,43 @@
+param(
+    [string]$InstallRoot = ".tools\dxc"
+)
+
+$ErrorActionPreference = "Stop"
+
+$repoRoot = Resolve-Path (Join-Path $PSScriptRoot "..")
+$installPath = Join-Path $repoRoot $InstallRoot
+New-Item -ItemType Directory -Force -Path $installPath | Out-Null
+
+# Pinned: parity means this compiler's lowering (dxcompiler 1.9.0.5402). The hash is the SHA256
+# of dxc_2026_07_29.zip downloaded from Microsoft's GitHub release v1.9.2607, and matches the
+# digest GitHub publishes for that asset.
+$zipName = "dxc_2026_07_29.zip"
+$zipUrl = "https://github.com/microsoft/DirectXShaderCompiler/releases/download/v1.9.2607/$zipName"
+$zipSha256 = "A1DFB116BA3EEAE6A1582291B53A8E7BF65AD760676BD3194685C8F7367CD241"
+
+$zipPath = Join-Path $installPath $zipName
+Remove-Item -LiteralPath $zipPath -Force -ErrorAction SilentlyContinue
+
+& curl.exe -L --retry 5 --retry-delay 2 --fail -o $zipPath $zipUrl
+if ($LASTEXITCODE -ne 0) {
+    throw "curl.exe failed with exit code $LASTEXITCODE."
+}
+
+$actualSha256 = (Get-FileHash -LiteralPath $zipPath -Algorithm SHA256).Hash
+if ($actualSha256 -ne $zipSha256) {
+    Remove-Item -LiteralPath $zipPath -Force
+    throw "$zipName SHA256 is $actualSha256, expected $zipSha256."
+}
+
+$currentPath = Join-Path $installPath "current"
+Remove-Item -LiteralPath $currentPath -Recurse -Force -ErrorAction SilentlyContinue
+New-Item -ItemType Directory -Force -Path $currentPath | Out-Null
+Expand-Archive -LiteralPath $zipPath -DestinationPath $currentPath -Force
+
+$dxcPath = Join-Path $currentPath "bin\x64\dxc.exe"
+if (-not (Test-Path $dxcPath)) {
+    throw "DXC x64 executable was not found after extraction."
+}
+
+& $dxcPath --version
+Write-Host "DXC installed at $dxcPath"
diff --git a/packages/cultmath/tools/get-dxc.ps1.meta b/packages/cultmath/tools/get-dxc.ps1.meta
new file mode 100644
index 00000000..c9ab0d82
--- /dev/null
+++ b/packages/cultmath/tools/get-dxc.ps1.meta
@@ -0,0 +1,7 @@
+fileFormatVersion: 2
+guid: 86d0b9a1006042745b7fff523831049c
+DefaultImporter:
+  externalObjects: {}
+  userData: 
+  assetBundleName: 
+  assetBundleVariant: 
diff --git a/packages/cultmath/tools/get-spirv-cross.ps1 b/packages/cultmath/tools/get-spirv-cross.ps1
new file mode 100644
index 00000000..f5105b9a
--- /dev/null
+++ b/packages/cultmath/tools/get-spirv-cross.ps1
@@ -0,0 +1,34 @@
+param(
+    [string]$InstallRoot = ".tools\spirv-cross"
+)
+
+$ErrorActionPreference = "Stop"
+
+$repoRoot = Resolve-Path (Join-Path $PSScriptRoot "..")
+$installPath = Join-Path $repoRoot $InstallRoot
+$sourcePath = Join-Path $installPath "src"
+$buildPath = Join-Path $installPath "build"
+
+New-Item -ItemType Directory -Force -Path $installPath | Out-Null
+
+if (-not (Test-Path $sourcePath)) {
+    git clone --depth 1 https://github.com/KhronosGroup/SPIRV-Cross.git $sourcePath
+}
+
+cmake `
+    -S $sourcePath `
+    -B $buildPath `
+    -G Ninja `
+    -DSPIRV_CROSS_CLI=ON `
+    -DSPIRV_CROSS_ENABLE_TESTS=OFF `
+    -DSPIRV_CROSS_ENABLE_C_API=OFF
+
+cmake --build $buildPath --target spirv-cross --config Release
+
+$spirvCrossPath = Join-Path $buildPath "spirv-cross.exe"
+if (-not (Test-Path $spirvCrossPath)) {
+    throw "SPIRV-Cross executable was not found after build."
+}
+
+& $spirvCrossPath --version
+Write-Host "SPIRV-Cross installed at $spirvCrossPath"
diff --git a/packages/cultmath/tools/get-spirv-cross.ps1.meta b/packages/cultmath/tools/get-spirv-cross.ps1.meta
new file mode 100644
index 00000000..12ccdd8e
--- /dev/null
+++ b/packages/cultmath/tools/get-spirv-cross.ps1.meta
@@ -0,0 +1,7 @@
+fileFormatVersion: 2
+guid: dcf41da07502f4b439f8fc5ad25d16c9
+DefaultImporter:
+  externalObjects: {}
+  userData: 
+  assetBundleName: 
+  assetBundleVariant: 
diff --git a/packages/cultmath/unity.meta b/packages/cultmath/unity.meta
new file mode 100644
index 00000000..de47a618
--- /dev/null
+++ b/packages/cultmath/unity.meta
@@ -0,0 +1,8 @@
+fileFormatVersion: 2
+guid: 366efeaef9f68224b80229332c7ecfc6
+folderAsset: yes
+DefaultImporter:
+  externalObjects: {}
+  userData: 
+  assetBundleName: 
+  assetBundleVariant: 
diff --git a/packages/cultmath/unity/org.gamecult.cultmath/LICENSE.md b/packages/cultmath/unity/org.gamecult.cultmath/LICENSE.md
new file mode 100644
index 00000000..5e50f2d6
--- /dev/null
+++ b/packages/cultmath/unity/org.gamecult.cultmath/LICENSE.md
@@ -0,0 +1,10 @@
+# CultMath License
+
+CultMath is licensed under the Mozilla Public License 2.0 (`MPL-2.0`).
+
+The complete license text is available from the Mozilla Foundation at
+<https://www.mozilla.org/MPL/2.0/>. Source and modification history for the
+precompiled assembly in this package are available in the GameCult/CultMath
+repository at the corresponding package tag.
+
+Third-party code retains its original license. See `THIRD-PARTY-NOTICES.md`.
diff --git a/packages/cultmath/unity/org.gamecult.cultmath/LICENSE.md.meta b/packages/cultmath/unity/org.gamecult.cultmath/LICENSE.md.meta
new file mode 100644
index 00000000..c234cd28
--- /dev/null
+++ b/packages/cultmath/unity/org.gamecult.cultmath/LICENSE.md.meta
@@ -0,0 +1,2 @@
+fileFormatVersion: 2
+guid: 7172bce28532878409e57f5fbbb12719
\ No newline at end of file
diff --git a/packages/cultmath/unity/org.gamecult.cultmath/README.md b/packages/cultmath/unity/org.gamecult.cultmath/README.md
new file mode 100644
index 00000000..20e1840c
--- /dev/null
+++ b/packages/cultmath/unity/org.gamecult.cultmath/README.md
@@ -0,0 +1,36 @@
+# CultMath for Unity
+
+This is CultMath's Unity 2021.3-compatible Git-UPM surface. It contains the
+precompiled `CultMath.dll`, portable symbols, the numeric
+`Shaders/CultMath.hlsl` mirror, and the `CultMath.UnityBridge` assembly.
+
+`CultMath.UnityBridge` is the only C# source Unity compiles here. It holds the
+UnityEngine conversions the engine-free core cannot declare: `ToCultMath()` on
+`Vector2/3/4`, `Vector2Int/3Int`, `Quaternion`, and `Color`; `ToUnity()` on
+`float2/3/4`, `int2/3`, and `quaternion`; `ToColor()` on `float4`. C# only
+admits conversion operators on the source or target type, so these are
+extension methods rather than implicit casts. Import `CultMath.UnityBridge` to
+use them.
+
+Unity does not compile CultMath's repository source tree. That source uses the
+current C# language and remains owned by the normal .NET project. The package
+imports only the tracked auto-referenced precompiled assembly, so consumers do
+not need `csc.rsp` language overrides or an asmdef propagation shim.
+
+Build and inspect the package from the repository root:
+
+```powershell
+.\scripts\build-unity-package.ps1
+```
+
+The builder fresh-builds CultMath for `netstandard2.1`, verifies the tracked
+DLL/PDB and stable Unity metadata, and stages an inspectable package under
+`artifacts/unity/org.gamecult.cultmath`.
+
+Consume the repository package with:
+
+```json
+"org.gamecult.cultmath": "https://github.com/GameCult/CultLib.git?path=/packages/cultmath/unity/org.gamecult.cultmath"
+```
+
+Production consumers should pin that URL to a commit or release tag.
diff --git a/packages/cultmath/unity/org.gamecult.cultmath/README.md.meta b/packages/cultmath/unity/org.gamecult.cultmath/README.md.meta
new file mode 100644
index 00000000..0ea270c2
--- /dev/null
+++ b/packages/cultmath/unity/org.gamecult.cultmath/README.md.meta
@@ -0,0 +1,2 @@
+fileFormatVersion: 2
+guid: b7429934026d747489a3876fd15576e5
\ No newline at end of file
diff --git a/packages/cultmath/unity/org.gamecult.cultmath/Runtime.meta b/packages/cultmath/unity/org.gamecult.cultmath/Runtime.meta
new file mode 100644
index 00000000..b0e76599
--- /dev/null
+++ b/packages/cultmath/unity/org.gamecult.cultmath/Runtime.meta
@@ -0,0 +1,8 @@
+fileFormatVersion: 2
+guid: a31bf2bb35e54dd1ad1c765337682769
+folderAsset: yes
+DefaultImporter:
+  externalObjects: {}
+  userData: 
+  assetBundleName: 
+  assetBundleVariant: 
diff --git a/packages/cultmath/unity/org.gamecult.cultmath/Runtime/Plugins.meta b/packages/cultmath/unity/org.gamecult.cultmath/Runtime/Plugins.meta
new file mode 100644
index 00000000..fe8acafa
--- /dev/null
+++ b/packages/cultmath/unity/org.gamecult.cultmath/Runtime/Plugins.meta
@@ -0,0 +1,8 @@
+fileFormatVersion: 2
+guid: f84156013e814c14b73f668b6610b9e0
+folderAsset: yes
+DefaultImporter:
+  externalObjects: {}
+  userData:
+  assetBundleName:
+  assetBundleVariant:
diff --git a/packages/cultmath/unity/org.gamecult.cultmath/Runtime/Plugins/CultMath.dll b/packages/cultmath/unity/org.gamecult.cultmath/Runtime/Plugins/CultMath.dll
new file mode 100644
index 00000000..bf712012
Binary files /dev/null and b/packages/cultmath/unity/org.gamecult.cultmath/Runtime/Plugins/CultMath.dll differ
diff --git a/packages/cultmath/unity/org.gamecult.cultmath/Runtime/Plugins/CultMath.dll.meta b/packages/cultmath/unity/org.gamecult.cultmath/Runtime/Plugins/CultMath.dll.meta
new file mode 100644
index 00000000..917e3849
--- /dev/null
+++ b/packages/cultmath/unity/org.gamecult.cultmath/Runtime/Plugins/CultMath.dll.meta
@@ -0,0 +1,21 @@
+fileFormatVersion: 2
+guid: 063b8a850f0f474aa7e89c4167f97a19
+PluginImporter:
+  externalObjects: {}
+  serializedVersion: 2
+  iconMap: {}
+  executionOrder: {}
+  defineConstraints: []
+  isPreloaded: 0
+  isOverridable: 0
+  isExplicitlyReferenced: 0
+  validateReferences: 1
+  platformData:
+  - first:
+      Any:
+    second:
+      enabled: 1
+      settings: {}
+  userData:
+  assetBundleName:
+  assetBundleVariant:
diff --git a/packages/cultmath/unity/org.gamecult.cultmath/Runtime/Plugins/CultMath.pdb b/packages/cultmath/unity/org.gamecult.cultmath/Runtime/Plugins/CultMath.pdb
new file mode 100644
index 00000000..1eaadd23
Binary files /dev/null and b/packages/cultmath/unity/org.gamecult.cultmath/Runtime/Plugins/CultMath.pdb differ
diff --git a/packages/cultmath/unity/org.gamecult.cultmath/Runtime/Plugins/CultMath.pdb.meta b/packages/cultmath/unity/org.gamecult.cultmath/Runtime/Plugins/CultMath.pdb.meta
new file mode 100644
index 00000000..e18fedbe
--- /dev/null
+++ b/packages/cultmath/unity/org.gamecult.cultmath/Runtime/Plugins/CultMath.pdb.meta
@@ -0,0 +1,7 @@
+fileFormatVersion: 2
+guid: a8cc555f643a4d7eb4dd340025b208f6
+DefaultImporter:
+  externalObjects: {}
+  userData: 
+  assetBundleName: 
+  assetBundleVariant: 
diff --git a/packages/cultmath/unity/org.gamecult.cultmath/Runtime/UnityBridge.meta b/packages/cultmath/unity/org.gamecult.cultmath/Runtime/UnityBridge.meta
new file mode 100644
index 00000000..d34f2ef0
--- /dev/null
+++ b/packages/cultmath/unity/org.gamecult.cultmath/Runtime/UnityBridge.meta
@@ -0,0 +1,8 @@
+fileFormatVersion: 2
+guid: 01f9f472b0a645b1ab392567aa38911a
+folderAsset: yes
+DefaultImporter:
+  externalObjects: {}
+  userData: 
+  assetBundleName: 
+  assetBundleVariant: 
diff --git a/packages/cultmath/unity/org.gamecult.cultmath/Runtime/UnityBridge/CultMath.UnityBridge.asmdef b/packages/cultmath/unity/org.gamecult.cultmath/Runtime/UnityBridge/CultMath.UnityBridge.asmdef
new file mode 100644
index 00000000..c54da7da
--- /dev/null
+++ b/packages/cultmath/unity/org.gamecult.cultmath/Runtime/UnityBridge/CultMath.UnityBridge.asmdef
@@ -0,0 +1,16 @@
+{
+  "name": "CultMath.UnityBridge",
+  "rootNamespace": "CultMath.UnityBridge",
+  "references": [],
+  "includePlatforms": [],
+  "excludePlatforms": [],
+  "allowUnsafeCode": false,
+  "overrideReferences": true,
+  "precompiledReferences": [
+    "CultMath.dll"
+  ],
+  "autoReferenced": true,
+  "defineConstraints": [],
+  "versionDefines": [],
+  "noEngineReferences": false
+}
diff --git a/packages/cultmath/unity/org.gamecult.cultmath/Runtime/UnityBridge/CultMath.UnityBridge.asmdef.meta b/packages/cultmath/unity/org.gamecult.cultmath/Runtime/UnityBridge/CultMath.UnityBridge.asmdef.meta
new file mode 100644
index 00000000..6875b788
--- /dev/null
+++ b/packages/cultmath/unity/org.gamecult.cultmath/Runtime/UnityBridge/CultMath.UnityBridge.asmdef.meta
@@ -0,0 +1,7 @@
+fileFormatVersion: 2
+guid: 77e50a05974842bc99d285ef6d5d04f7
+AssemblyDefinitionImporter:
+  externalObjects: {}
+  userData: 
+  assetBundleName: 
+  assetBundleVariant: 
diff --git a/packages/cultmath/unity/org.gamecult.cultmath/Runtime/UnityBridge/UnityConversions.cs b/packages/cultmath/unity/org.gamecult.cultmath/Runtime/UnityBridge/UnityConversions.cs
new file mode 100644
index 00000000..c8289a77
--- /dev/null
+++ b/packages/cultmath/unity/org.gamecult.cultmath/Runtime/UnityBridge/UnityConversions.cs
@@ -0,0 +1,28 @@
+using UnityEngine;
+
+namespace CultMath.UnityBridge
+{
+    /// <summary>
+    /// Explicit conversions between UnityEngine and CultMath value types.
+    /// C# only admits user-defined conversion operators declared on the source or target
+    /// type, and CultMath's core types stay engine-free, so the bridge is extension methods.
+    /// </summary>
+    public static class UnityConversions
+    {
+        public static float2 ToCultMath(this Vector2 value) => new float2(value.x, value.y);
+        public static float3 ToCultMath(this Vector3 value) => new float3(value.x, value.y, value.z);
+        public static float4 ToCultMath(this Vector4 value) => new float4(value.x, value.y, value.z, value.w);
+        public static float4 ToCultMath(this Color value) => new float4(value.r, value.g, value.b, value.a);
+        public static quaternion ToCultMath(this Quaternion value) => new quaternion(value.x, value.y, value.z, value.w);
+        public static int2 ToCultMath(this Vector2Int value) => new int2(value.x, value.y);
+        public static int3 ToCultMath(this Vector3Int value) => new int3(value.x, value.y, value.z);
+
+        public static Vector2 ToUnity(this float2 value) => new Vector2(value.x, value.y);
+        public static Vector3 ToUnity(this float3 value) => new Vector3(value.x, value.y, value.z);
+        public static Vector4 ToUnity(this float4 value) => new Vector4(value.x, value.y, value.z, value.w);
+        public static Quaternion ToUnity(this quaternion value) => new Quaternion(value.x, value.y, value.z, value.w);
+        public static Vector2Int ToUnity(this int2 value) => new Vector2Int(value.x, value.y);
+        public static Vector3Int ToUnity(this int3 value) => new Vector3Int(value.x, value.y, value.z);
+        public static Color ToColor(this float4 value) => new Color(value.x, value.y, value.z, value.w);
+    }
+}
diff --git a/packages/cultmath/unity/org.gamecult.cultmath/Runtime/UnityBridge/UnityConversions.cs.meta b/packages/cultmath/unity/org.gamecult.cultmath/Runtime/UnityBridge/UnityConversions.cs.meta
new file mode 100644
index 00000000..ccbd3f10
--- /dev/null
+++ b/packages/cultmath/unity/org.gamecult.cultmath/Runtime/UnityBridge/UnityConversions.cs.meta
@@ -0,0 +1,11 @@
+fileFormatVersion: 2
+guid: 8fc742177b3f4715b204afe0e69a400c
+MonoImporter:
+  externalObjects: {}
+  serializedVersion: 2
+  defaultReferences: []
+  executionOrder: 0
+  icon: {instanceID: 0}
+  userData: 
+  assetBundleName: 
+  assetBundleVariant: 
diff --git a/packages/cultmath/unity/org.gamecult.cultmath/Shaders.meta b/packages/cultmath/unity/org.gamecult.cultmath/Shaders.meta
new file mode 100644
index 00000000..1e7e7110
--- /dev/null
+++ b/packages/cultmath/unity/org.gamecult.cultmath/Shaders.meta
@@ -0,0 +1,8 @@
+fileFormatVersion: 2
+guid: ca5d773061ed49b3a173526048d40cb3
+folderAsset: yes
+DefaultImporter:
+  externalObjects: {}
+  userData:
+  assetBundleName:
+  assetBundleVariant:
diff --git a/packages/cultmath/unity/org.gamecult.cultmath/Shaders/CultMath.hlsl b/packages/cultmath/unity/org.gamecult.cultmath/Shaders/CultMath.hlsl
new file mode 100644
index 00000000..365705f5
--- /dev/null
+++ b/packages/cultmath/unity/org.gamecult.cultmath/Shaders/CultMath.hlsl
@@ -0,0 +1,356 @@
+#ifndef CULTMATH_HLSL
+#define CULTMATH_HLSL
+
+// CultMath HLSL mirror.
+//
+// HLSL already owns the float2/float3/float4 type names and most primitive
+// intrinsics. This include names the CultMath semantic surface explicitly so
+// shader code, C# wrappers, and Rust/native parity fixtures can share the same
+// small vocabulary without local helper drift.
+
+static const float CULTMATH_PI = 3.14159265358979323846;
+static const float CULTMATH_TAU = 6.28318530717958647692;
+static const float CULTMATH_HALF_PI = 1.57079632679489661923;
+static const float CULTMATH_NORMALIZE_EPSILON = 1.0e-20;
+
+float cultmath_radians(float degrees_value) { return degrees_value * (CULTMATH_PI / 180.0); }
+float cultmath_degrees(float radians_value) { return radians_value * (180.0 / CULTMATH_PI); }
+
+float cultmath_frac(float value) { return value - floor(value); }
+float2 cultmath_frac(float2 value) { return value - floor(value); }
+float3 cultmath_frac(float3 value) { return value - floor(value); }
+float4 cultmath_frac(float4 value) { return value - floor(value); }
+
+float cultmath_clamp(float value, float minimum, float maximum) { return min(max(value, minimum), maximum); }
+float2 cultmath_clamp(float2 value, float2 minimum, float2 maximum) { return min(max(value, minimum), maximum); }
+float3 cultmath_clamp(float3 value, float3 minimum, float3 maximum) { return min(max(value, minimum), maximum); }
+float4 cultmath_clamp(float4 value, float4 minimum, float4 maximum) { return min(max(value, minimum), maximum); }
+
+// DXIL Saturate is FMin(1, FMax(0, x)); dxc lowers min/max to the same FMin/FMax, NaN rules included.
+float cultmath_saturate(float value) { return min(1.0, max(0.0, value)); }
+float2 cultmath_saturate(float2 value) { return min(float2(1.0, 1.0), max(float2(0.0, 0.0), value)); }
+float3 cultmath_saturate(float3 value) { return min(float3(1.0, 1.0, 1.0), max(float3(0.0, 0.0, 0.0), value)); }
+float4 cultmath_saturate(float4 value) { return min(float4(1.0, 1.0, 1.0, 1.0), max(float4(0.0, 0.0, 0.0, 0.0), value)); }
+
+float cultmath_lerp(float start, float end, float amount) { return start + (end - start) * amount; }
+float2 cultmath_lerp(float2 start, float2 end, float2 amount) { return start + (end - start) * amount; }
+float3 cultmath_lerp(float3 start, float3 end, float3 amount) { return start + (end - start) * amount; }
+float4 cultmath_lerp(float4 start, float4 end, float4 amount) { return start + (end - start) * amount; }
+
+float cultmath_step(float edge, float value) { return value < edge ? 0.0 : 1.0; }
+float2 cultmath_step(float2 edge, float2 value) { return float2(cultmath_step(edge.x, value.x), cultmath_step(edge.y, value.y)); }
+float3 cultmath_step(float3 edge, float3 value) { return float3(cultmath_step(edge.x, value.x), cultmath_step(edge.y, value.y), cultmath_step(edge.z, value.z)); }
+float4 cultmath_step(float4 edge, float4 value) { return float4(cultmath_step(edge.x, value.x), cultmath_step(edge.y, value.y), cultmath_step(edge.z, value.z), cultmath_step(edge.w, value.w)); }
+
+float cultmath_smoothstep(float minimum, float maximum, float value)
+{
+    float t = cultmath_saturate((value - minimum) / (maximum - minimum));
+    return t * t * (3.0 - 2.0 * t);
+}
+
+float2 cultmath_smoothstep(float2 minimum, float2 maximum, float2 value)
+{
+    float2 t = cultmath_saturate((value - minimum) / (maximum - minimum));
+    return t * t * (float2(3.0, 3.0) - float2(2.0, 2.0) * t);
+}
+
+float3 cultmath_smoothstep(float3 minimum, float3 maximum, float3 value)
+{
+    float3 t = cultmath_saturate((value - minimum) / (maximum - minimum));
+    return t * t * (float3(3.0, 3.0, 3.0) - float3(2.0, 2.0, 2.0) * t);
+}
+
+float4 cultmath_smoothstep(float4 minimum, float4 maximum, float4 value)
+{
+    float4 t = cultmath_saturate((value - minimum) / (maximum - minimum));
+    return t * t * (float4(3.0, 3.0, 3.0, 3.0) - float4(2.0, 2.0, 2.0, 2.0) * t);
+}
+
+float cultmath_smoothstep01(float value) { return cultmath_smoothstep(0.0, 1.0, value); }
+
+float cultmath_smootherstep(float value)
+{
+    value = cultmath_saturate(value);
+    return value * value * value * (value * (value * 6.0 - 15.0) + 10.0);
+}
+
+float2 cultmath_snoise_mod289(float2 value) { return value - floor(value * (1.0 / 289.0)) * 289.0; }
+float3 cultmath_snoise_mod289(float3 value) { return value - floor(value * (1.0 / 289.0)) * 289.0; }
+float4 cultmath_snoise_mod289(float4 value) { return value - floor(value * (1.0 / 289.0)) * 289.0; }
+float3 cultmath_snoise_permute(float3 value) { return cultmath_snoise_mod289(((value * 34.0) + 1.0) * value); }
+float4 cultmath_snoise_permute(float4 value) { return cultmath_snoise_mod289(((value * 34.0) + 1.0) * value); }
+
+// Ashima Arts / Ian McEwan 3D simplex noise (MIT), same float32 evaluation
+// order as the C# math.snoise(float3) mirror.
+float cultmath_snoise(float3 value)
+{
+    float2 c = float2(1.0 / 6.0, 1.0 / 3.0);
+    float3 i = floor(value + dot(value, c.yyy));
+    float3 x0 = value - i + dot(i, c.xxx);
+    float3 g = step(x0.yzx, x0.xyz);
+    float3 l = 1.0 - g;
+    float3 i1 = min(g.xyz, l.zxy);
+    float3 i2 = max(g.xyz, l.zxy);
+    float3 x1 = x0 - i1 + c.xxx;
+    float3 x2 = x0 - i2 + c.yyy;
+    float3 x3 = x0 - 0.5;
+
+    i = cultmath_snoise_mod289(i);
+    float4 p = cultmath_snoise_permute(cultmath_snoise_permute(cultmath_snoise_permute(
+        i.z + float4(0.0, i1.z, i2.z, 1.0)) + i.y + float4(0.0, i1.y, i2.y, 1.0)) + i.x + float4(0.0, i1.x, i2.x, 1.0));
+
+    const float n_ = 0.142857142857;
+    float3 ns = float3(2.0 * n_, 0.5 * n_ - 1.0, n_);
+    float4 j = p - 49.0 * floor(p * ns.z * ns.z);
+    float4 x_ = floor(j * ns.z);
+    float4 y_ = floor(j - 7.0 * x_);
+    float4 x = x_ * ns.x + ns.yyyy;
+    float4 y = y_ * ns.x + ns.yyyy;
+    float4 h = 1.0 - abs(x) - abs(y);
+
+    float4 b0 = float4(x.xy, y.xy);
+    float4 b1 = float4(x.zw, y.zw);
+    float4 s0 = floor(b0) * 2.0 + 1.0;
+    float4 s1 = floor(b1) * 2.0 + 1.0;
+    float4 sh = -step(h, 0.0);
+    float4 a0 = b0.xzyw + s0.xzyw * sh.xxyy;
+    float4 a1 = b1.xzyw + s1.xzyw * sh.zzww;
+
+    float3 p0 = float3(a0.xy, h.x);
+    float3 p1 = float3(a0.zw, h.y);
+    float3 p2 = float3(a1.xy, h.z);
+    float3 p3 = float3(a1.zw, h.w);
+    float4 norm = 1.79284291400159 - 0.85373472095314 * float4(dot(p0, p0), dot(p1, p1), dot(p2, p2), dot(p3, p3));
+    p0 *= norm.x;
+    p1 *= norm.y;
+    p2 *= norm.z;
+    p3 *= norm.w;
+
+    float4 m = max(0.6 - float4(dot(x0, x0), dot(x1, x1), dot(x2, x2), dot(x3, x3)), 0.0);
+    m = m * m;
+    return 42.0 * dot(m * m, float4(dot(p0, x0), dot(p1, x1), dot(p2, x2), dot(p3, x3)));
+}
+
+float cultmath_snoise(float2 value)
+{
+    float4 c = float4(
+        0.211324865405187,
+        0.366025403784439,
+        -0.577350269189626,
+        0.024390243902439);
+    float2 i = floor(value + dot(value, c.yy));
+    float2 x0 = value - i + dot(i, c.xx);
+    float2 i1 = x0.x > x0.y ? float2(1.0, 0.0) : float2(0.0, 1.0);
+    float4 x12 = float4(x0.x + c.x - i1.x, x0.y + c.x - i1.y, x0.x + c.z, x0.y + c.z);
+
+    i = cultmath_snoise_mod289(i);
+    float3 p = cultmath_snoise_permute(
+        cultmath_snoise_permute(i.y + float3(0.0, i1.y, 1.0)) + i.x + float3(0.0, i1.x, 1.0));
+    float3 m = max(0.5 - float3(dot(x0, x0), dot(x12.xy, x12.xy), dot(x12.zw, x12.zw)), 0.0);
+    m *= m;
+    m *= m;
+
+    float3 x = 2.0 * frac(p * c.w) - 1.0;
+    float3 h = abs(x) - 0.5;
+    float3 ox = floor(x + 0.5);
+    float3 a0 = x - ox;
+    m *= 1.79284291400159 - 0.85373472095314 * (a0 * a0 + h * h);
+
+    float3 g = float3(
+        a0.x * x0.x + h.x * x0.y,
+        a0.y * x12.x + h.y * x12.y,
+        a0.z * x12.z + h.z * x12.w);
+    return 130.0 * dot(m, g);
+}
+
+float cultmath_lengthsq(float2 value) { return dot(value, value); }
+float cultmath_lengthsq(float3 value) { return dot(value, value); }
+float cultmath_lengthsq(float4 value) { return dot(value, value); }
+
+float cultmath_distance(float2 left, float2 right) { return length(left - right); }
+float cultmath_distance(float3 left, float3 right) { return length(left - right); }
+float cultmath_distance(float4 left, float4 right) { return length(left - right); }
+
+float2 cultmath_normalize(float2 value) { return value / max(length(value), CULTMATH_NORMALIZE_EPSILON); }
+float3 cultmath_normalize(float3 value) { return value / max(length(value), CULTMATH_NORMALIZE_EPSILON); }
+float4 cultmath_normalize(float4 value) { return value / max(length(value), CULTMATH_NORMALIZE_EPSILON); }
+
+float2 cultmath_reflect(float2 incident, float2 normal_value)
+{
+    return incident - 2.0 * dot(normal_value, incident) * normal_value;
+}
+
+float3 cultmath_reflect(float3 incident, float3 normal_value)
+{
+    return incident - 2.0 * dot(normal_value, incident) * normal_value;
+}
+
+float2 cultmath_rotate(float2 value, float radians_value)
+{
+    float s = sin(radians_value);
+    float c = cos(radians_value);
+    return float2(value.x * c - value.y * s, value.x * s + value.y * c);
+}
+
+float2 cultmath_rotate_degrees(float2 value, float degrees_value)
+{
+    return cultmath_rotate(value, cultmath_radians(degrees_value));
+}
+
+float cultmath_csum(float2 value) { return value.x + value.y; }
+float cultmath_csum(float3 value) { return value.x + value.y + value.z; }
+float cultmath_csum(float4 value) { return value.x + value.y + value.z + value.w; }
+
+float cultmath_decay(float source, float lambda_value, float dt) { return source * exp(-lambda_value * dt); }
+float2 cultmath_decay(float2 source, float lambda_value, float dt) { return source * exp(-lambda_value * dt); }
+float3 cultmath_decay(float3 source, float lambda_value, float dt) { return source * exp(-lambda_value * dt); }
+float4 cultmath_decay(float4 source, float lambda_value, float dt) { return source * exp(-lambda_value * dt); }
+
+float cultmath_damp(float start, float end, float lambda_value, float dt)
+{
+    return cultmath_lerp(start, end, 1.0 - exp(-lambda_value * dt));
+}
+
+float2 cultmath_damp(float2 start, float2 end, float lambda_value, float dt)
+{
+    return cultmath_lerp(start, end, 1.0 - exp(-lambda_value * dt));
+}
+
+float3 cultmath_damp(float3 start, float3 end, float lambda_value, float dt)
+{
+    return cultmath_lerp(start, end, 1.0 - exp(-lambda_value * dt));
+}
+
+float4 cultmath_damp(float4 start, float4 end, float lambda_value, float dt)
+{
+    return cultmath_lerp(start, end, 1.0 - exp(-lambda_value * dt));
+}
+
+float cultmath_catmullrom(float p0, float p1, float p2, float p3, float t)
+{
+    float t2 = t * t;
+    float t3 = t2 * t;
+    return 0.5 * ((2.0 * p1) + (p2 - p0) * t + (2.0 * p0 - 5.0 * p1 + 4.0 * p2 - p3) * t2 + (-p0 + 3.0 * p1 - 3.0 * p2 + p3) * t3);
+}
+
+float2 cultmath_catmullrom(float2 p0, float2 p1, float2 p2, float2 p3, float t)
+{
+    float t2 = t * t;
+    float t3 = t2 * t;
+    return 0.5 * ((2.0 * p1) + (p2 - p0) * t + (2.0 * p0 - 5.0 * p1 + 4.0 * p2 - p3) * t2 + (-p0 + 3.0 * p1 - 3.0 * p2 + p3) * t3);
+}
+
+float3 cultmath_catmullrom(float3 p0, float3 p1, float3 p2, float3 p3, float t)
+{
+    float t2 = t * t;
+    float t3 = t2 * t;
+    return 0.5 * ((2.0 * p1) + (p2 - p0) * t + (2.0 * p0 - 5.0 * p1 + 4.0 * p2 - p3) * t2 + (-p0 + 3.0 * p1 - 3.0 * p2 + p3) * t3);
+}
+
+float4 cultmath_catmullrom(float4 p0, float4 p1, float4 p2, float4 p3, float t)
+{
+    float t2 = t * t;
+    float t3 = t2 * t;
+    return 0.5 * ((2.0 * p1) + (p2 - p0) * t + (2.0 * p0 - 5.0 * p1 + 4.0 * p2 - p3) * t2 + (-p0 + 3.0 * p1 - 3.0 * p2 + p3) * t3);
+}
+
+float cultmath_quadratic_bezier(float p0, float p1, float p2, float t)
+{
+    t = cultmath_saturate(t);
+    float inv = 1.0 - t;
+    return inv * inv * p0 + 2.0 * inv * t * p1 + t * t * p2;
+}
+
+float3 cultmath_quadratic_bezier(float3 p0, float3 p1, float3 p2, float t)
+{
+    t = cultmath_saturate(t);
+    float inv = 1.0 - t;
+    return inv * inv * p0 + 2.0 * inv * t * p1 + t * t * p2;
+}
+
+float cultmath_cubic_bezier(float p0, float p1, float p2, float p3, float t)
+{
+    t = cultmath_saturate(t);
+    float inv = 1.0 - t;
+    return inv * inv * inv * p0 + 3.0 * inv * inv * t * p1 + 3.0 * inv * t * t * p2 + t * t * t * p3;
+}
+
+float3 cultmath_cubic_bezier(float3 p0, float3 p1, float3 p2, float3 p3, float t)
+{
+    t = cultmath_saturate(t);
+    float inv = 1.0 - t;
+    return inv * inv * inv * p0 + 3.0 * inv * inv * t * p1 + 3.0 * inv * t * t * p2 + t * t * t * p3;
+}
+
+float cultmath_hash(float value) { return cultmath_frac(sin(value) * 43758.5453); }
+float cultmath_hash(float2 value) { return cultmath_hash(dot(value, float2(127.1, 311.7))); }
+float cultmath_hash(float3 value) { return cultmath_hash(dot(value, float3(127.1, 311.7, 74.7))); }
+
+float cultmath_value_noise(float2 position)
+{
+    float2 cell = floor(position);
+    float2 local = cultmath_frac(position);
+    float2 u = local * local * (float2(3.0, 3.0) - float2(2.0, 2.0) * local);
+
+    float a = cultmath_hash(cell);
+    float b = cultmath_hash(cell + float2(1.0, 0.0));
+    float c = cultmath_hash(cell + float2(0.0, 1.0));
+    float d = cultmath_hash(cell + float2(1.0, 1.0));
+
+    return cultmath_lerp(cultmath_lerp(a, b, u.x), cultmath_lerp(c, d, u.x), u.y);
+}
+
+float cultmath_value_noise_bicubic(float2 position)
+{
+    float2 cell = floor(position);
+    float2 local = cultmath_frac(position);
+
+    float y0 = cultmath_catmullrom(cultmath_hash(cell + float2(-1.0, -1.0)), cultmath_hash(cell + float2(0.0, -1.0)), cultmath_hash(cell + float2(1.0, -1.0)), cultmath_hash(cell + float2(2.0, -1.0)), local.x);
+    float y1 = cultmath_catmullrom(cultmath_hash(cell + float2(-1.0, 0.0)), cultmath_hash(cell + float2(0.0, 0.0)), cultmath_hash(cell + float2(1.0, 0.0)), cultmath_hash(cell + float2(2.0, 0.0)), local.x);
+    float y2 = cultmath_catmullrom(cultmath_hash(cell + float2(-1.0, 1.0)), cultmath_hash(cell + float2(0.0, 1.0)), cultmath_hash(cell + float2(1.0, 1.0)), cultmath_hash(cell + float2(2.0, 1.0)), local.x);
+    float y3 = cultmath_catmullrom(cultmath_hash(cell + float2(-1.0, 2.0)), cultmath_hash(cell + float2(0.0, 2.0)), cultmath_hash(cell + float2(1.0, 2.0)), cultmath_hash(cell + float2(2.0, 2.0)), local.x);
+
+    return cultmath_catmullrom(y0, y1, y2, y3, local.y);
+}
+
+float cultmath_value_noise_texture(Texture2D<float> noise_texture, SamplerState noise_sampler, float2 uv, float scale)
+{
+    return noise_texture.SampleLevel(noise_sampler, uv * scale, 0.0).r;
+}
+
+float cultmath_value_noise_texture_bicubic(Texture2D<float> noise_texture, SamplerState noise_sampler, float2 uv, float scale, float2 texel_size)
+{
+    float2 position = uv * scale;
+    float2 cell = floor(position);
+    float2 local = cultmath_frac(position);
+    float2 base_uv = cell / scale;
+
+    float row0 = cultmath_catmullrom(
+        noise_texture.SampleLevel(noise_sampler, base_uv + texel_size * float2(-1.0, -1.0), 0.0).r,
+        noise_texture.SampleLevel(noise_sampler, base_uv + texel_size * float2(0.0, -1.0), 0.0).r,
+        noise_texture.SampleLevel(noise_sampler, base_uv + texel_size * float2(1.0, -1.0), 0.0).r,
+        noise_texture.SampleLevel(noise_sampler, base_uv + texel_size * float2(2.0, -1.0), 0.0).r,
+        local.x);
+    float row1 = cultmath_catmullrom(
+        noise_texture.SampleLevel(noise_sampler, base_uv + texel_size * float2(-1.0, 0.0), 0.0).r,
+        noise_texture.SampleLevel(noise_sampler, base_uv + texel_size * float2(0.0, 0.0), 0.0).r,
+        noise_texture.SampleLevel(noise_sampler, base_uv + texel_size * float2(1.0, 0.0), 0.0).r,
+        noise_texture.SampleLevel(noise_sampler, base_uv + texel_size * float2(2.0, 0.0), 0.0).r,
+        local.x);
+    float row2 = cultmath_catmullrom(
+        noise_texture.SampleLevel(noise_sampler, base_uv + texel_size * float2(-1.0, 1.0), 0.0).r,
+        noise_texture.SampleLevel(noise_sampler, base_uv + texel_size * float2(0.0, 1.0), 0.0).r,
+        noise_texture.SampleLevel(noise_sampler, base_uv + texel_size * float2(1.0, 1.0), 0.0).r,
+        noise_texture.SampleLevel(noise_sampler, base_uv + texel_size * float2(2.0, 1.0), 0.0).r,
+        local.x);
+    float row3 = cultmath_catmullrom(
+        noise_texture.SampleLevel(noise_sampler, base_uv + texel_size * float2(-1.0, 2.0), 0.0).r,
+        noise_texture.SampleLevel(noise_sampler, base_uv + texel_size * float2(0.0, 2.0), 0.0).r,
+        noise_texture.SampleLevel(noise_sampler, base_uv + texel_size * float2(1.0, 2.0), 0.0).r,
+        noise_texture.SampleLevel(noise_sampler, base_uv + texel_size * float2(2.0, 2.0), 0.0).r,
+        local.x);
+
+    return cultmath_catmullrom(row0, row1, row2, row3, local.y);
+}
+
+#endif
diff --git a/src/GameCult.Unity/Assets/Caching/Runtime/GameCult.Unity.Caching.asmdef.meta b/packages/cultmath/unity/org.gamecult.cultmath/Shaders/CultMath.hlsl.meta
similarity index 58%
rename from src/GameCult.Unity/Assets/Caching/Runtime/GameCult.Unity.Caching.asmdef.meta
rename to packages/cultmath/unity/org.gamecult.cultmath/Shaders/CultMath.hlsl.meta
index 00ae3475..d3b6d2b3 100644
--- a/src/GameCult.Unity/Assets/Caching/Runtime/GameCult.Unity.Caching.asmdef.meta
+++ b/packages/cultmath/unity/org.gamecult.cultmath/Shaders/CultMath.hlsl.meta
@@ -1,6 +1,6 @@
 fileFormatVersion: 2
-guid: ab6636c1402c4c579df9c07101542f13
-AssemblyDefinitionImporter:
+guid: a46136cb4acb4ff2bc47b6a4f786e4b3
+ShaderIncludeImporter:
   externalObjects: {}
   userData:
   assetBundleName:
diff --git a/packages/cultmath/unity/org.gamecult.cultmath/THIRD-PARTY-NOTICES.md b/packages/cultmath/unity/org.gamecult.cultmath/THIRD-PARTY-NOTICES.md
new file mode 100644
index 00000000..06ebb6c3
--- /dev/null
+++ b/packages/cultmath/unity/org.gamecult.cultmath/THIRD-PARTY-NOTICES.md
@@ -0,0 +1,11 @@
+# Third-Party Notices
+
+## 2D and 3D Simplex Noise
+
+`math.snoise` and `cultmath_snoise` port the textureless 2D and 3D
+simplex-noise functions by Ian McEwan and Ashima Arts, as distributed by Stefan
+Gustavson's `webgl-noise` project and Unity Mathematics.
+
+- Copyright 2011 Ashima Arts.
+- Upstream: <https://github.com/ashima/webgl-noise>
+- License: MIT.
diff --git a/packages/cultmath/unity/org.gamecult.cultmath/THIRD-PARTY-NOTICES.md.meta b/packages/cultmath/unity/org.gamecult.cultmath/THIRD-PARTY-NOTICES.md.meta
new file mode 100644
index 00000000..a53f08d8
--- /dev/null
+++ b/packages/cultmath/unity/org.gamecult.cultmath/THIRD-PARTY-NOTICES.md.meta
@@ -0,0 +1,2 @@
+fileFormatVersion: 2
+guid: 0c88669e4d1db604588be2a726b7d231
\ No newline at end of file
diff --git a/packages/cultmath/unity/org.gamecult.cultmath/package.json b/packages/cultmath/unity/org.gamecult.cultmath/package.json
new file mode 100644
index 00000000..c09bf6bb
--- /dev/null
+++ b/packages/cultmath/unity/org.gamecult.cultmath/package.json
@@ -0,0 +1,17 @@
+{
+  "name": "org.gamecult.cultmath",
+  "displayName": "CultMath",
+  "version": "0.2.0",
+  "unity": "2021.3",
+  "description": "Precompiled CultMath numeric primitives and matching HLSL semantics for GameCult Unity runtimes.",
+  "license": "MPL-2.0",
+  "author": {
+    "name": "GameCult"
+  },
+  "keywords": [
+    "GameCult",
+    "Math",
+    "HLSL",
+    "Simulation"
+  ]
+}
diff --git a/packages/cultmath/unity/org.gamecult.cultmath/package.json.meta b/packages/cultmath/unity/org.gamecult.cultmath/package.json.meta
new file mode 100644
index 00000000..337ba716
--- /dev/null
+++ b/packages/cultmath/unity/org.gamecult.cultmath/package.json.meta
@@ -0,0 +1,2 @@
+fileFormatVersion: 2
+guid: 33d8d4af49bf0f946ad00a375f26b1d1
\ No newline at end of file
diff --git a/packages/cultmath/web.meta b/packages/cultmath/web.meta
new file mode 100644
index 00000000..d65ff3e6
--- /dev/null
+++ b/packages/cultmath/web.meta
@@ -0,0 +1,8 @@
+fileFormatVersion: 2
+guid: daf45471f8b5f4f44a2cb86e77e010db
+folderAsset: yes
+DefaultImporter:
+  externalObjects: {}
+  userData: 
+  assetBundleName: 
+  assetBundleVariant: 
diff --git a/packages/cultmesh-browser/README.md b/packages/cultmesh-browser/README.md
new file mode 100644
index 00000000..59a44016
--- /dev/null
+++ b/packages/cultmesh-browser/README.md
@@ -0,0 +1,61 @@
+# CultMesh Browser
+
+`cultmesh-browser` is the browser-safe CultMesh client boundary. It owns one
+WebSocket session for a stable Verse/authority-runtime target, retains explicit raw
+document leases across route replacement, and correlates typed CultNet
+operations with provider receipts.
+
+It does not own application state and it does not expose direct document
+writes. A renderer watches provider-owned records and invokes provider-owned
+operations.
+
+```ts
+const odin = new CultMeshBrowserOdinRendezvous({
+  endpoints: ["wss://odin.example/verse"],
+  runtimeId: "counter-browser.discovery",
+});
+
+const mesh = await CultMeshBrowserClient.connect({
+  verseId: "sample.counter",
+  authorityRuntimeId: "sample.counter-daemon",
+  runtimeId: "counter-browser",
+  rendezvous: odin,
+});
+
+const counter = await mesh.leaseRawDocument({
+  schemaId: "sample.counter_state.v1",
+  recordKey: "counter:main",
+});
+
+counter.watch(record => renderCounter(decodeCultNetPayload(record)));
+```
+
+`invoke(...)` returns the correlated provider response. Routing, schema, and
+envelope failures reject immediately with `CultMeshBrowserOperationError`;
+callers can branch on its stable `status` and `code` without parsing prose or
+waiting for the request timeout. Domain rejections remain typed provider
+responses because the domain still owns their receipt schema.
+
+`CultMeshBrowserOdinRendezvous` speaks the canonical CultNet Verse-catalog
+messages to one or more configured Odin WebSocket endpoints. Application code
+supplies the Verse and authority-runtime identity; it does not own endpoint
+selection, reconnect, or resubscription. This is deliberately distinct from an
+Eve surface's `providerId`, which identifies the UI provider inside the Verse.
+The physical socket is a replaceable route, not either stable identity.
+
+Odin returns exact authority-route bindings. The browser selects only routes
+bound to the requested authority and `cultmesh.documents.v1`, then performs a
+session-open handshake. It does not report `connected` until the peer proves
+the exact Verse, authority runtime, protocol, and route generation. Operation
+responses must also name that authority. Legacy catalogs are accepted only
+when one authority runtime makes the endpoint binding unambiguous.
+
+The browser handshake carries authentication through the host application's
+ordinary secure cookie or equivalent upgrade credential. The C# host adapter
+rejects endpoints without an authorization predicate unless anonymous local
+development is explicitly enabled.
+
+Run `scripts/verify-eve-browser-network.mjs --eve-root <path-to-Eve>` for the
+real Chromium + C# headless chronology. The witness publishes a lower-priority
+decoy endpoint owned by another runtime and proves that neither client connects
+to it before and after route rotation.
diff --git a/packages/cultmesh-browser/package.json b/packages/cultmesh-browser/package.json
new file mode 100644
index 00000000..c49062b0
--- /dev/null
+++ b/packages/cultmesh-browser/package.json
@@ -0,0 +1,50 @@
+{
+  "name": "cultmesh-browser",
+  "version": "0.3.0",
+  "description": "Browser-safe CultMesh document leases and typed operations over CultNet WebSocket transport.",
+  "type": "module",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "default": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "scripts": {
+    "build": "node ../../node_modules/typescript/bin/tsc -p tsconfig.json",
+    "prepack": "node ../../node_modules/typescript/bin/tsc -p tsconfig.json",
+    "typecheck": "node ../../node_modules/typescript/bin/tsc -p tsconfig.json --pretty false",
+    "test": "node ../../node_modules/typescript/bin/tsc -p tsconfig.json && node ../../node_modules/typescript/bin/tsc -p tsconfig.test.json && node --test dist-test/test/*.test.js"
+  },
+  "keywords": [
+    "cultmesh",
+    "cultnet",
+    "browser",
+    "websocket",
+    "gamecult"
+  ],
+  "author": "metacratic",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/GameCult/CultLib.git",
+    "directory": "packages/cultmesh-browser"
+  },
+  "engines": {
+    "node": ">=18"
+  },
+  "dependencies": {
+    "@msgpack/msgpack": "^3.1.3",
+    "cultnet-ts": "^0.2.0"
+  },
+  "devDependencies": {
+    "@types/node": "^24.0.0",
+    "typescript": "^5.9.0"
+  }
+}
diff --git a/packages/cultmesh-browser/src/index.ts b/packages/cultmesh-browser/src/index.ts
new file mode 100644
index 00000000..4dddfa7d
--- /dev/null
+++ b/packages/cultmesh-browser/src/index.ts
@@ -0,0 +1,1076 @@
+import { decode, encode } from "@msgpack/msgpack";
+import {
+  encodeCultNetMessageForWire,
+  parseCultNetMessage,
+  type CultNetDatabaseChangeRawMessage,
+  type CultNetDatabaseSubscribeMessage,
+  type CultNetDatabaseUnsubscribeMessage,
+  type CultNetMessage,
+  type CultNetOperationRequestMessage,
+  type CultNetOperationResponseMessage,
+  type CultNetRawDocumentRecord,
+  type CultNetSnapshotResponseRawMessage,
+  type CultMeshVerseCatalogRequestMessage,
+  type CultMeshVerseCatalogResponseMessage,
+  type CultMeshSessionAcceptedMessage,
+  type CultMeshSessionOpenMessage,
+} from "cultnet-ts/contracts";
+
+export interface CultMeshBrowserIdentity {
+  verseId: string;
+  authorityRuntimeId: string;
+}
+
+export interface CultMeshBrowserRoute extends CultMeshBrowserIdentity {
+  endpoint: string;
+  protocolId?: string;
+  protocolIds?: readonly string[];
+  priority?: number;
+  generation: string;
+  certificate?: CultMeshBrowserRouteCertificate;
+}
+
+export interface CultMeshBrowserP256PublicKey {
+  keyId: string;
+  x: string;
+  y: string;
+}
+
+export interface CultMeshBrowserRouteCertificate {
+  providerKey: CultMeshBrowserP256PublicKey;
+  odinKeyId: string;
+  issuedAtUnixMilliseconds: number;
+  expiresAtUnixMilliseconds: number;
+  signature: string;
+}
+
+export type CultMeshBrowserAuthorityTrustMode = "authenticated-remote" | "local-development";
+
+export interface CultMeshBrowserAuthorityTrustPolicy {
+  mode: CultMeshBrowserAuthorityTrustMode;
+  odinRoots?: readonly CultMeshBrowserP256PublicKey[];
+  now?: () => number;
+}
+
+export interface CultMeshBrowserRendezvous {
+  resolve(
+    identity: CultMeshBrowserIdentity,
+    trust?: CultMeshBrowserAuthorityTrustPolicy,
+  ): Promise<CultMeshBrowserRoute>;
+}
+
+export interface CultMeshBrowserOdinRendezvousOptions {
+  endpoints: readonly string[];
+  runtimeId: string;
+  transportVersion?: string;
+  timeoutMs?: number;
+  maxFrameBytes?: number;
+  createId?: () => string;
+  socketFactory?: (endpoint: string) => CultMeshBrowserSocket;
+}
+
+export interface CultMeshBrowserSocket {
+  binaryType: BinaryType;
+  readonly readyState: number;
+  onopen: ((event: Event) => void) | null;
+  onmessage: ((event: MessageEvent) => void) | null;
+  onerror: ((event: Event) => void) | null;
+  onclose: ((event: CloseEvent) => void) | null;
+  send(data: ArrayBuffer | ArrayBufferView): void;
+  close(code?: number, reason?: string): void;
+}
+
+/** Resolves a stable Verse/authority-runtime target through Odin's canonical CultNet Verse catalog. */
+export class CultMeshBrowserOdinRendezvous implements CultMeshBrowserRendezvous {
+  #options: Required<Omit<CultMeshBrowserOdinRendezvousOptions, "transportVersion" | "socketFactory">> & {
+    transportVersion?: string;
+    socketFactory: (endpoint: string) => CultMeshBrowserSocket;
+  };
+
+  constructor(options: CultMeshBrowserOdinRendezvousOptions) {
+    requireText(options.runtimeId, "runtimeId");
+    const endpoints = [...new Set(options.endpoints.map(value => value.trim()).filter(Boolean))];
+    if (endpoints.length === 0) throw new Error("At least one Odin WebSocket endpoint is required.");
+    for (const endpoint of endpoints) requireWebSocketEndpoint(endpoint, "Odin rendezvous endpoint");
+    this.#options = {
+      ...options,
+      endpoints,
+      timeoutMs: options.timeoutMs ?? 10_000,
+      maxFrameBytes: options.maxFrameBytes ?? 4 * 1024 * 1024,
+      createId: options.createId ?? (() => crypto.randomUUID()),
+      socketFactory: options.socketFactory ?? (endpoint => new WebSocket(endpoint)),
+    };
+    if (this.#options.timeoutMs <= 0) throw new Error("Odin rendezvous timeoutMs must be positive.");
+    if (this.#options.maxFrameBytes <= 0) throw new Error("Odin rendezvous maxFrameBytes must be positive.");
+  }
+
+  async resolve(
+    identity: CultMeshBrowserIdentity,
+    trust: CultMeshBrowserAuthorityTrustPolicy = { mode: "authenticated-remote", odinRoots: [] },
+  ): Promise<CultMeshBrowserRoute> {
+    requireText(identity.verseId, "verseId");
+    requireText(identity.authorityRuntimeId, "authorityRuntimeId");
+    const failures: Error[] = [];
+    for (const endpoint of this.#options.endpoints) {
+      try {
+        return await this.resolveFrom(endpoint, identity, trust);
+      } catch (error) {
+        failures.push(error instanceof Error ? error : new Error(String(error)));
+      }
+    }
+    throw new AggregateError(
+      failures,
+      `Odin could not resolve Verse '${identity.verseId}' authority runtime '${identity.authorityRuntimeId}'.`,
+    );
+  }
+
+  private resolveFrom(
+    endpoint: string,
+    identity: CultMeshBrowserIdentity,
+    trust: CultMeshBrowserAuthorityTrustPolicy,
+  ): Promise<CultMeshBrowserRoute> {
+    const socket = this.#options.socketFactory(endpoint);
+    socket.binaryType = "arraybuffer";
+    const messageId = this.#options.createId();
+    const request: CultMeshVerseCatalogRequestMessage = {
+      schemaVersion: "cultmesh.verse_catalog_request.v0",
+      messageId,
+      verseIds: [identity.verseId],
+      ...(this.#options.transportVersion ? { transportVersion: this.#options.transportVersion } : {}),
+    };
+    return new Promise<CultMeshBrowserRoute>((resolve, reject) => {
+      let settled = false;
+      const finish = (error?: Error, route?: CultMeshBrowserRoute) => {
+        if (settled) return;
+        settled = true;
+        clearTimeout(timer);
+        socket.onopen = null;
+        socket.onmessage = null;
+        socket.onerror = null;
+        socket.onclose = null;
+        socket.close(1000, error ? "Odin resolution failed" : "Odin resolution complete");
+        if (error) reject(error);
+        else resolve(route!);
+      };
+      const timer = setTimeout(
+        () => finish(new Error(`Odin resolution timed out at '${endpoint}'.`)),
+        this.#options.timeoutMs,
+      );
+      socket.onopen = () => {
+        try {
+          sendSocketMessage(socket, {
+            schemaVersion: "cultnet.hello.v0",
+            runtimeId: this.#options.runtimeId,
+            runtimeKind: "browser",
+            supportedMessageVersions: [
+              "cultmesh.verse_catalog_request.v0",
+              "cultmesh.verse_catalog_response.v0",
+            ],
+          }, this.#options.maxFrameBytes);
+          sendSocketMessage(socket, request, this.#options.maxFrameBytes);
+        } catch (error) {
+          finish(error instanceof Error ? error : new Error(String(error)));
+        }
+      };
+      socket.onmessage = event => {
+        void decodeSocketMessage(event, this.#options.maxFrameBytes).then(message => {
+          if (message.schemaVersion === "cultnet.error.v0") {
+            finish(new Error(message.error));
+            return;
+          }
+          if (message.schemaVersion !== "cultmesh.verse_catalog_response.v0" || message.messageId !== messageId) return;
+          void selectOdinRoute(message, identity, trust)
+            .then(route => finish(undefined, route))
+            .catch(error => finish(error instanceof Error ? error : new Error(String(error))));
+        }).catch(error => finish(error instanceof Error ? error : new Error(String(error))));
+      };
+      socket.onerror = () => finish(new Error(`Odin WebSocket could not open '${endpoint}'.`));
+      socket.onclose = () => finish(new Error(`Odin WebSocket closed before resolving '${identity.verseId}'.`));
+    });
+  }
+}
+
+export interface CultMeshBrowserClientOptions extends CultMeshBrowserIdentity {
+  runtimeId: string;
+  rendezvous: CultMeshBrowserRendezvous;
+  socketFactory?: (endpoint: string) => CultMeshBrowserSocket;
+  reconnectDelayMs?: number;
+  connectTimeoutMs?: number;
+  requestTimeoutMs?: number;
+  maxFrameBytes?: number;
+  createId?: () => string;
+  /** Consumer-owned authority roots. Remote sessions fail closed when omitted. */
+  trust?: CultMeshBrowserAuthorityTrustPolicy;
+}
+
+export interface CultMeshRawDocumentLeaseOptions {
+  schemaId: string;
+  recordKey: string;
+  subscriptionId?: string;
+}
+
+export interface CultMeshOperationOptions {
+  serviceId: string;
+  operation: string;
+  payloadSchema: string;
+  payload: unknown;
+  idempotencyKey?: string;
+  /** @deprecated The connected authority is the operation target. A different value is rejected. */
+  targetRuntimeId?: string;
+}
+
+/** Portable schema returned when routing or envelope validation fails before a domain reply exists. */
+export const cultNetOperationFailureSchema = "gamecult.cultnet.operation_failure.v1";
+
+export interface CultNetOperationFailure {
+  code: string;
+  message: string;
+}
+
+/** Correlated framework-level failure returned by a CultMesh operation provider. */
+export class CultMeshBrowserOperationError extends Error {
+  readonly status: string;
+  readonly code: string;
+  readonly diagnostics: readonly string[];
+
+  constructor(response: CultNetOperationResponseMessage, failure: CultNetOperationFailure) {
+    super(failure.message || "CultMesh operation failed.");
+    this.name = "CultMeshBrowserOperationError";
+    this.status = response.status || "error";
+    this.code = failure.code || "operation-error";
+    this.diagnostics = response.diagnostics ?? [];
+  }
+}
+
+export type CultMeshConnectionState = "connecting" | "connected" | "reconnecting" | "disposed";
+
+type DocumentWatcher = (record: CultNetRawDocumentRecord | undefined) => void;
+
+interface PendingSnapshot {
+  lease: CultMeshRawDocumentLease;
+  resolve: () => void;
+  reject: (error: Error) => void;
+  timer: ReturnType<typeof setTimeout>;
+}
+
+interface PendingOperation {
+  request: CultNetOperationRequestMessage;
+  resolve: (response: CultNetOperationResponseMessage) => void;
+  reject: (error: Error) => void;
+  timer: ReturnType<typeof setTimeout>;
+}
+
+export class CultMeshRawDocumentLease implements Disposable {
+  readonly schemaId: string;
+  readonly recordKey: string;
+  readonly subscriptionId: string;
+  #client: CultMeshBrowserClient | undefined;
+  #current: CultNetRawDocumentRecord | undefined;
+  #watchers = new Set<DocumentWatcher>();
+
+  constructor(
+    client: CultMeshBrowserClient,
+    options: Required<CultMeshRawDocumentLeaseOptions>,
+  ) {
+    this.#client = client;
+    this.schemaId = options.schemaId;
+    this.recordKey = options.recordKey;
+    this.subscriptionId = options.subscriptionId;
+  }
+
+  get current(): CultNetRawDocumentRecord | undefined {
+    return this.#current;
+  }
+
+  watch(watcher: DocumentWatcher): () => void {
+    if (!this.#client) throw new Error("CultMesh document lease is disposed.");
+    this.#watchers.add(watcher);
+    watcher(this.#current);
+    return () => this.#watchers.delete(watcher);
+  }
+
+  dispose(): void {
+    this.#client?.releaseLease(this);
+    this.#client = undefined;
+    this.#watchers.clear();
+  }
+
+  [Symbol.dispose](): void {
+    this.dispose();
+  }
+
+  apply(record: CultNetRawDocumentRecord | undefined): void {
+    this.#current = record;
+    for (const watcher of this.#watchers) watcher(record);
+  }
+}
+
+export class CultMeshBrowserClient implements AsyncDisposable {
+  readonly identity: CultMeshBrowserIdentity;
+  readonly runtimeId: string;
+  #options: Required<Omit<CultMeshBrowserClientOptions, "socketFactory">> & {
+    socketFactory: (endpoint: string) => CultMeshBrowserSocket;
+  };
+  #socket: CultMeshBrowserSocket | undefined;
+  #socketGeneration = 0;
+  #state: CultMeshConnectionState = "connecting";
+  #disposed = false;
+  #reconnectTimer: ReturnType<typeof setTimeout> | undefined;
+  #connectPromise: Promise<void> | undefined;
+  #leases = new Map<string, CultMeshRawDocumentLease>();
+  #openingLeases = new Map<string, CultMeshRawDocumentLease>();
+  #pendingSnapshots = new Map<string, PendingSnapshot>();
+  #pendingOperations = new Map<string, PendingOperation>();
+  #stateWatchers = new Set<(state: CultMeshConnectionState) => void>();
+
+  private constructor(options: CultMeshBrowserClientOptions) {
+    requireText(options.verseId, "verseId");
+    requireText(options.authorityRuntimeId, "authorityRuntimeId");
+    requireText(options.runtimeId, "runtimeId");
+    this.identity = { verseId: options.verseId, authorityRuntimeId: options.authorityRuntimeId };
+    this.runtimeId = options.runtimeId;
+    this.#options = {
+      ...options,
+      reconnectDelayMs: options.reconnectDelayMs ?? 250,
+      connectTimeoutMs: options.connectTimeoutMs ?? 10_000,
+      requestTimeoutMs: options.requestTimeoutMs ?? 10_000,
+      maxFrameBytes: options.maxFrameBytes ?? 4 * 1024 * 1024,
+      createId: options.createId ?? (() => crypto.randomUUID()),
+      socketFactory: options.socketFactory ?? (endpoint => new WebSocket(endpoint)),
+      trust: options.trust ?? { mode: "authenticated-remote", odinRoots: [] },
+    };
+  }
+
+  static async connect(options: CultMeshBrowserClientOptions): Promise<CultMeshBrowserClient> {
+    const client = new CultMeshBrowserClient(options);
+    await client.connectSocket();
+    return client;
+  }
+
+  get state(): CultMeshConnectionState {
+    return this.#state;
+  }
+
+  watchState(watcher: (state: CultMeshConnectionState) => void): () => void {
+    this.#stateWatchers.add(watcher);
+    watcher(this.#state);
+    return () => this.#stateWatchers.delete(watcher);
+  }
+
+  async leaseRawDocument(options: CultMeshRawDocumentLeaseOptions): Promise<CultMeshRawDocumentLease> {
+    this.throwIfDisposed();
+    requireText(options.schemaId, "schemaId");
+    requireText(options.recordKey, "recordKey");
+    const subscriptionId = options.subscriptionId ?? `lease:${this.#options.createId()}`;
+    if (this.#leases.has(subscriptionId) || this.#openingLeases.has(subscriptionId)) {
+      throw new Error(`CultMesh subscription '${subscriptionId}' is already leased.`);
+    }
+    const lease = new CultMeshRawDocumentLease(this, { ...options, subscriptionId });
+    this.#openingLeases.set(subscriptionId, lease);
+    try {
+      await this.subscribe(lease);
+      this.#openingLeases.delete(subscriptionId);
+      this.#leases.set(subscriptionId, lease);
+      return lease;
+    } catch (error) {
+      this.#openingLeases.delete(subscriptionId);
+      throw error;
+    }
+  }
+
+  async invoke(options: CultMeshOperationOptions): Promise<CultNetOperationResponseMessage> {
+    this.throwIfDisposed();
+    requireText(options.serviceId, "serviceId");
+    requireText(options.operation, "operation");
+    requireText(options.payloadSchema, "payloadSchema");
+    if (options.targetRuntimeId && options.targetRuntimeId !== this.identity.authorityRuntimeId) {
+      throw new Error(
+        `CultMesh operation target '${options.targetRuntimeId}' does not match connected authority '${this.identity.authorityRuntimeId}'.`,
+      );
+    }
+    await this.ensureConnected();
+    const messageId = options.idempotencyKey ?? this.#options.createId();
+    requireText(messageId, "operation idempotencyKey");
+    if (this.#pendingOperations.has(messageId)) {
+      throw new Error(`CultMesh operation '${messageId}' is already in flight.`);
+    }
+    const request: CultNetOperationRequestMessage = {
+      schemaVersion: "cultnet.operation_request.v0",
+      messageId,
+      serviceId: options.serviceId,
+      operation: options.operation,
+      payloadSchema: options.payloadSchema,
+      payloadEncoding: "messagepack-base64",
+      payload: bytesToBase64(encode(options.payload)),
+      sourceRuntimeId: this.runtimeId,
+      targetRuntimeId: this.identity.authorityRuntimeId,
+    };
+    const response = new Promise<CultNetOperationResponseMessage>((resolve, reject) => {
+      const timer = setTimeout(() => {
+        if (!this.#pendingOperations.delete(messageId)) return;
+        reject(new Error(`CultMesh operation '${messageId}' timed out.`));
+      }, this.#options.requestTimeoutMs);
+      this.#pendingOperations.set(messageId, { request, resolve, reject, timer });
+    });
+    try {
+      this.send(request);
+    } catch (error) {
+      this.scheduleReconnect();
+    }
+    return response;
+  }
+
+  async refreshRoute(): Promise<void> {
+    this.throwIfDisposed();
+    this.#socketGeneration++;
+    const socket = this.#socket;
+    this.#socket = undefined;
+    socket?.close(1012, "CultMesh route refresh");
+    await this.connectSocket();
+  }
+
+  releaseLease(lease: CultMeshRawDocumentLease): void {
+    if (this.#leases.get(lease.subscriptionId) !== lease) return;
+    this.#leases.delete(lease.subscriptionId);
+    for (const [messageId, pending] of this.#pendingSnapshots) {
+      if (pending.lease !== lease) continue;
+      this.#pendingSnapshots.delete(messageId);
+      clearTimeout(pending.timer);
+      pending.reject(new Error("CultMesh document lease was disposed before its snapshot arrived."));
+    }
+    if (this.#state === "connected") {
+      const message: CultNetDatabaseUnsubscribeMessage = {
+        schemaVersion: "cultnet.database_unsubscribe.v0",
+        messageId: this.#options.createId(),
+        subscriptionId: lease.subscriptionId,
+      };
+      this.send(message);
+    }
+  }
+
+  async dispose(): Promise<void> {
+    if (this.#disposed) return;
+    this.#disposed = true;
+    this.setState("disposed");
+    if (this.#reconnectTimer) clearTimeout(this.#reconnectTimer);
+    this.#reconnectTimer = undefined;
+    const error = new Error("CultMesh browser client was disposed.");
+    for (const pending of this.#pendingSnapshots.values()) {
+      clearTimeout(pending.timer);
+      pending.reject(error);
+    }
+    for (const pending of this.#pendingOperations.values()) {
+      clearTimeout(pending.timer);
+      pending.reject(error);
+    }
+    this.#pendingSnapshots.clear();
+    this.#pendingOperations.clear();
+    this.#leases.clear();
+    this.#openingLeases.clear();
+    const socket = this.#socket;
+    this.#socket = undefined;
+    socket?.close(1000, "CultMesh client disposed");
+  }
+
+  async [Symbol.asyncDispose](): Promise<void> {
+    await this.dispose();
+  }
+
+  private async subscribe(lease: CultMeshRawDocumentLease): Promise<void> {
+    await this.ensureConnected();
+    const messageId = this.#options.createId();
+    const ready = new Promise<void>((resolve, reject) => {
+      const timer = setTimeout(() => {
+        if (!this.#pendingSnapshots.delete(messageId)) return;
+        reject(new Error(`CultMesh subscription '${lease.subscriptionId}' timed out.`));
+      }, this.#options.requestTimeoutMs);
+      this.#pendingSnapshots.set(messageId, { lease, resolve, reject, timer });
+    });
+    const request: CultNetDatabaseSubscribeMessage = {
+      schemaVersion: "cultnet.database_subscribe.v0",
+      messageId,
+      subscriptionId: lease.subscriptionId,
+      schemaIds: [lease.schemaId],
+      recordKeys: [lease.recordKey],
+      includeSnapshot: true,
+      consumerRuntimeId: this.runtimeId,
+    };
+    try {
+      this.send(request);
+    } catch (error) {
+      const pending = this.#pendingSnapshots.get(messageId);
+      if (pending) clearTimeout(pending.timer);
+      this.#pendingSnapshots.delete(messageId);
+      throw error;
+    }
+    return ready;
+  }
+
+  private ensureConnected(): Promise<void> {
+    if (this.#state === "connected" && this.#socket?.readyState === 1) return Promise.resolve();
+    return this.connectSocket();
+  }
+
+  private connectSocket(): Promise<void> {
+    this.throwIfDisposed();
+    if (this.#state === "connected" && this.#socket?.readyState === 1) return Promise.resolve();
+    if (this.#reconnectTimer) {
+      clearTimeout(this.#reconnectTimer);
+      this.#reconnectTimer = undefined;
+    }
+    if (this.#connectPromise) return this.#connectPromise;
+    const generation = ++this.#socketGeneration;
+    this.setState(this.#socket ? "reconnecting" : "connecting");
+    this.#connectPromise = this.openSocket(generation).finally(() => {
+      this.#connectPromise = undefined;
+    });
+    return this.#connectPromise;
+  }
+
+  private async openSocket(generation: number): Promise<void> {
+    const route = await this.#options.rendezvous.resolve(this.identity, this.#options.trust);
+    if (route.verseId !== this.identity.verseId ||
+        route.authorityRuntimeId !== this.identity.authorityRuntimeId) {
+      throw new Error("CultMesh rendezvous returned a route for the wrong stable identity.");
+    }
+    await verifyAuthorityRoute(route, this.#options.trust);
+    const endpoint = new URL(route.endpoint);
+    if (endpoint.protocol !== "ws:" && endpoint.protocol !== "wss:") {
+      throw new Error(`CultMesh browser route must use ws:// or wss://, got '${route.endpoint}'.`);
+    }
+    const socket = this.#options.socketFactory(route.endpoint);
+    socket.binaryType = "arraybuffer";
+    try {
+      await new Promise<void>((resolve, reject) => {
+        let opened = false;
+        let settled = false;
+        const handshakeId = this.#options.createId();
+        const clientNonce = randomNonce();
+        const sessionRequest: CultMeshSessionOpenMessage = {
+          schemaVersion: "cultmesh.session_open.v2",
+          messageId: handshakeId,
+          sourceRuntimeId: this.runtimeId,
+          verseId: this.identity.verseId,
+          authorityRuntimeId: this.identity.authorityRuntimeId,
+          protocolId: route.protocolId ?? "cultmesh.documents.v1",
+          routeGeneration: route.generation,
+          clientNonce,
+        };
+        const finish = (error?: Error) => {
+          if (settled) return;
+          settled = true;
+          clearTimeout(timer);
+          if (error) reject(error);
+          else resolve();
+        };
+        const timer = setTimeout(
+          () => finish(new Error(
+            opened
+              ? `CultMesh authority handshake timed out for '${route.endpoint}'.`
+              : `CultMesh WebSocket open timed out for '${route.endpoint}'.`,
+          )),
+          this.#options.connectTimeoutMs,
+        );
+        socket.onopen = () => {
+          opened = true;
+          try {
+            sendSocketMessage(socket, {
+              schemaVersion: "cultnet.hello.v0",
+              runtimeId: this.runtimeId,
+              runtimeKind: "browser",
+              supportedMessageVersions: [
+                "cultmesh.session_open.v2",
+                "cultmesh.session_accepted.v2",
+                "cultnet.database_subscribe.v0",
+                "cultnet.database_unsubscribe.v0",
+                "cultnet.database_change_raw.v0",
+                "cultnet.operation_request.v0",
+                "cultnet.operation_response.v0",
+              ],
+            }, this.#options.maxFrameBytes);
+            sendSocketMessage(socket, sessionRequest, this.#options.maxFrameBytes);
+          } catch (error) {
+            finish(error instanceof Error ? error : new Error(String(error)));
+          }
+        };
+        socket.onmessage = event => {
+          void decodeSocketMessage(event, this.#options.maxFrameBytes).then(message => {
+            if (message.schemaVersion === "cultnet.error.v0") {
+              finish(new Error(message.error));
+              return;
+            }
+            if (message.schemaVersion !== "cultmesh.session_accepted.v2" || message.messageId !== handshakeId) return;
+            void validateSessionAcceptance(
+              message,
+              sessionRequest,
+              route,
+              this.#options.trust,
+            ).then(finish).catch(error => finish(error instanceof Error ? error : new Error(String(error))));
+          }).catch(error => finish(error instanceof Error ? error : new Error(String(error))));
+        };
+        socket.onerror = () => finish(new Error(`CultMesh WebSocket could not open '${route.endpoint}'.`));
+        socket.onclose = () => finish(new Error(`CultMesh WebSocket closed before proving authority at '${route.endpoint}'.`));
+      });
+    } catch (error) {
+      socket.close(1000, "CultMesh route open failed");
+      throw error;
+    }
+    if (this.#disposed || generation !== this.#socketGeneration) {
+      socket.close(1000, "Stale CultMesh route");
+      return;
+    }
+    this.#socket = socket;
+    socket.onmessage = event => { void this.receive(event, generation); };
+    socket.onerror = () => undefined;
+    socket.onclose = () => this.handleClosed(generation);
+    this.setState("connected");
+    try {
+      await Promise.all([...this.#leases.values()].map(lease => this.subscribe(lease)));
+      for (const pending of this.#pendingOperations.values()) this.send(pending.request);
+    } catch (error) {
+      if (this.#socket === socket) this.#socket = undefined;
+      socket.onclose = null;
+      socket.close(1000, "CultMesh session initialization failed");
+      throw error;
+    }
+  }
+
+  private handleClosed(generation: number): void {
+    if (this.#disposed || generation !== this.#socketGeneration) return;
+    this.#socket = undefined;
+    const error = new Error("CultMesh route closed before the provider response arrived.");
+    for (const pending of this.#pendingSnapshots.values()) {
+      clearTimeout(pending.timer);
+      pending.reject(error);
+    }
+    this.#pendingSnapshots.clear();
+    this.setState("reconnecting");
+    this.#reconnectTimer = setTimeout(() => {
+      this.#reconnectTimer = undefined;
+      void this.connectSocket().catch(() => this.handleClosed(this.#socketGeneration));
+    }, this.#options.reconnectDelayMs);
+  }
+
+  private async receive(event: MessageEvent, generation: number): Promise<void> {
+    if (this.#disposed || generation !== this.#socketGeneration) return;
+    let message: CultNetMessage;
+    try {
+      message = await decodeSocketMessage(event, this.#options.maxFrameBytes);
+    } catch (error) {
+      const oversized = error instanceof Error && error.message.includes("exceeds");
+      this.#socket?.close(
+        oversized ? 1009 : 1003,
+        oversized ? "CultNet frame exceeds configured maximum" : "CultNet requires binary WebSocket frames",
+      );
+      return;
+    }
+    switch (message.schemaVersion) {
+      case "cultnet.snapshot_response_raw.v0":
+        this.applySnapshot(message);
+        return;
+      case "cultnet.database_change_raw.v0":
+        this.applyChange(message);
+        return;
+      case "cultnet.operation_response.v0": {
+        const pending = this.#pendingOperations.get(message.messageId);
+        if (!pending) return;
+        if (message.sourceRuntimeId !== this.identity.authorityRuntimeId) {
+          this.#pendingOperations.delete(message.messageId);
+          clearTimeout(pending.timer);
+          pending.reject(new Error(
+            `CultMesh operation response came from '${message.sourceRuntimeId ?? "unknown"}', expected '${this.identity.authorityRuntimeId}'.`,
+          ));
+          this.#socket?.close(1008, "CultMesh authority identity changed");
+          return;
+        }
+        this.#pendingOperations.delete(message.messageId);
+        clearTimeout(pending.timer);
+        if (message.payloadSchema === cultNetOperationFailureSchema) {
+          try {
+            pending.reject(new CultMeshBrowserOperationError(
+              message,
+              decodeCultNetOperationPayload<CultNetOperationFailure>(message),
+            ));
+          } catch (error) {
+            pending.reject(error instanceof Error
+              ? error
+              : new Error("CultMesh operation failure payload was malformed."));
+          }
+          return;
+        }
+        pending.resolve(message);
+        return;
+      }
+      case "cultnet.error.v0":
+        this.rejectCorrelated(message.error);
+        return;
+      default:
+        return;
+    }
+  }
+
+  private applySnapshot(message: CultNetSnapshotResponseRawMessage): void {
+    const pending = this.#pendingSnapshots.get(message.messageId);
+    if (!pending) return;
+    this.#pendingSnapshots.delete(message.messageId);
+    clearTimeout(pending.timer);
+    const matches = message.documents.filter(record =>
+      record.recordKey === pending.lease.recordKey && recordMatchesSchema(record, pending.lease.schemaId));
+    if (matches.length > 1) {
+      pending.reject(new Error(`CultMesh snapshot returned duplicate record '${pending.lease.recordKey}'.`));
+      return;
+    }
+    pending.lease.apply(matches[0]);
+    pending.resolve();
+  }
+
+  private applyChange(message: CultNetDatabaseChangeRawMessage): void {
+    const lease = this.#leases.get(message.subscriptionId) ?? this.#openingLeases.get(message.subscriptionId);
+    if (!lease) return;
+    if (message.changeKind === "removed") {
+      if (message.recordKey === lease.recordKey) lease.apply(undefined);
+      return;
+    }
+    const record = message.document;
+    if (record?.recordKey === lease.recordKey && recordMatchesSchema(record, lease.schemaId)) lease.apply(record);
+  }
+
+  private rejectCorrelated(reason: string): void {
+    if (this.#pendingOperations.size === 1) {
+      const [messageId, pending] = this.#pendingOperations.entries().next().value!;
+      this.#pendingOperations.delete(messageId);
+      clearTimeout(pending.timer);
+      pending.reject(new Error(reason));
+    }
+  }
+
+  private send(message: CultNetMessage): void {
+    const socket = this.#socket;
+    if (!socket || socket.readyState !== 1) throw new Error("CultMesh browser route is not connected.");
+    const payload = encode(encodeCultNetMessageForWire(message));
+    if (payload.byteLength > this.#options.maxFrameBytes) {
+      throw new Error(`CultMesh message exceeds the ${this.#options.maxFrameBytes}-byte limit.`);
+    }
+    socket.send(payload);
+  }
+
+  private setState(state: CultMeshConnectionState): void {
+    if (this.#state === state) return;
+    this.#state = state;
+    for (const watcher of this.#stateWatchers) watcher(state);
+  }
+
+  private scheduleReconnect(): void {
+    if (this.#disposed || this.#reconnectTimer) return;
+    this.setState("reconnecting");
+    this.#reconnectTimer = setTimeout(() => {
+      this.#reconnectTimer = undefined;
+      void this.connectSocket().catch(() => this.scheduleReconnect());
+    }, this.#options.reconnectDelayMs);
+  }
+
+  private throwIfDisposed(): void {
+    if (this.#disposed) throw new Error("CultMesh browser client is disposed.");
+  }
+}
+
+export function decodeCultNetPayload<T>(record: CultNetRawDocumentRecord): T {
+  if (record.payloadEncoding !== "messagepack") {
+    throw new Error(`Unsupported CultNet document payload '${record.payloadEncoding}'.`);
+  }
+  return decode(record.payload) as T;
+}
+
+function recordMatchesSchema(record: CultNetRawDocumentRecord, requestedSchema: string): boolean {
+  return record.schemaId === requestedSchema ||
+    record.schemaName === requestedSchema ||
+    record.schemaVersion === requestedSchema;
+}
+
+export function decodeCultNetOperationPayload<T>(response: CultNetOperationResponseMessage): T {
+  if (response.payloadEncoding !== "messagepack-base64") {
+    throw new Error(`Unsupported CultNet operation payload '${response.payloadEncoding ?? "unspecified"}'.`);
+  }
+  return decode(base64ToBytes(response.payload)) as T;
+}
+
+function bytesToBase64(bytes: Uint8Array): string {
+  let binary = "";
+  for (let offset = 0; offset < bytes.length; offset += 0x8000) {
+    binary += String.fromCharCode(...bytes.subarray(offset, offset + 0x8000));
+  }
+  return btoa(binary);
+}
+
+function base64ToBytes(value: string): Uint8Array {
+  const binary = atob(value);
+  return Uint8Array.from(binary, character => character.charCodeAt(0));
+}
+
+function requireWebSocketEndpoint(value: string, field: string): URL {
+  let endpoint: URL;
+  try {
+    endpoint = new URL(value);
+  } catch {
+    throw new Error(`${field} '${value}' is not a valid URL.`);
+  }
+  if (endpoint.protocol !== "ws:" && endpoint.protocol !== "wss:") {
+    throw new Error(`${field} must use ws:// or wss://, got '${value}'.`);
+  }
+  return endpoint;
+}
+
+function sendSocketMessage(socket: CultMeshBrowserSocket, message: CultNetMessage, maxFrameBytes: number): void {
+  const payload = encode(encodeCultNetMessageForWire(message));
+  if (payload.byteLength > maxFrameBytes) {
+    throw new Error(`CultNet message exceeds the ${maxFrameBytes}-byte limit.`);
+  }
+  socket.send(payload);
+}
+
+async function decodeSocketMessage(event: MessageEvent, maxFrameBytes: number): Promise<CultNetMessage> {
+  let payload: Uint8Array;
+  if (event.data instanceof ArrayBuffer) {
+    payload = new Uint8Array(event.data);
+  } else if (ArrayBuffer.isView(event.data)) {
+    payload = new Uint8Array(event.data.buffer, event.data.byteOffset, event.data.byteLength);
+  } else if (event.data instanceof Blob) {
+    payload = new Uint8Array(await event.data.arrayBuffer());
+  } else {
+    throw new Error("CultNet requires binary WebSocket frames.");
+  }
+  if (payload.byteLength > maxFrameBytes) {
+    throw new Error(`CultNet frame exceeds the ${maxFrameBytes}-byte limit.`);
+  }
+  return parseCultNetMessage(decode(payload));
+}
+
+async function selectOdinRoute(
+  response: CultMeshVerseCatalogResponseMessage,
+  identity: CultMeshBrowserIdentity,
+  trust: CultMeshBrowserAuthorityTrustPolicy,
+): Promise<CultMeshBrowserRoute> {
+  const matchingVerses = response.verses.filter(verse => verse.verseId === identity.verseId);
+  if (matchingVerses.length !== 1) {
+    throw new Error(
+      `Odin returned ${matchingVerses.length} routes for Verse '${identity.verseId}' authority runtime '${identity.authorityRuntimeId}'.`,
+    );
+  }
+  const verse = matchingVerses[0];
+  if (verse.authorityRoutes == null && verse.authorityRuntimeIds.length !== 1) {
+    throw new Error(
+      `Odin returned ambiguous legacy routes for Verse '${identity.verseId}'. Explicit authority route bindings are required.`,
+    );
+  }
+  if (verse.authorityRoutes == null && verse.authorityRuntimeIds[0] !== identity.authorityRuntimeId) {
+    throw new Error(
+      `Odin advertised no route for authority runtime '${identity.authorityRuntimeId}'.`,
+    );
+  }
+  const boundRoutes = verse.authorityRoutes ?? verse.discoveryEndpoints.map(endpoint => ({
+    authorityRuntimeId: verse.authorityRuntimeIds[0],
+    endpoint,
+    protocolIds: ["cultmesh.documents.v1"],
+    priority: 0,
+    generation: [verse.compatibility.transportVersion, verse.compatibility.rulesHash, endpoint].join(":"),
+    certificate: undefined,
+  }));
+  const routes = boundRoutes.filter(route =>
+    route.authorityRuntimeId === identity.authorityRuntimeId &&
+    route.protocolIds.includes("cultmesh.documents.v1") &&
+    (() => {
+    try {
+      requireWebSocketEndpoint(route.endpoint, "Odin provider route");
+      return true;
+    } catch {
+      return false;
+    }
+  })()).sort((left, right) => left.priority - right.priority || left.endpoint.localeCompare(right.endpoint));
+  if (routes.length === 0) {
+    throw new Error(`Odin advertised no browser-compatible route for authority runtime '${identity.authorityRuntimeId}'.`);
+  }
+  const failures: Error[] = [];
+  for (const route of routes) {
+    const candidate: CultMeshBrowserRoute = {
+      ...identity,
+      endpoint: route.endpoint,
+      protocolId: "cultmesh.documents.v1",
+      protocolIds: route.protocolIds,
+      priority: route.priority,
+      generation: route.generation,
+      ...(route.certificate ? { certificate: {
+        providerKey: {
+          keyId: route.certificate.providerKeyId,
+          x: route.certificate.providerPublicKeyX,
+          y: route.certificate.providerPublicKeyY,
+        },
+        odinKeyId: route.certificate.odinKeyId,
+        issuedAtUnixMilliseconds: route.certificate.issuedAtUnixMilliseconds,
+        expiresAtUnixMilliseconds: route.certificate.expiresAtUnixMilliseconds,
+        signature: route.certificate.signature,
+      } } : {}),
+    };
+    try {
+      await verifyAuthorityRoute(candidate, trust);
+      return candidate;
+    } catch (error) {
+      failures.push(error instanceof Error ? error : new Error(String(error)));
+    }
+  }
+  throw new AggregateError(
+    failures,
+    `Odin advertised no trusted browser route for authority runtime '${identity.authorityRuntimeId}'.`,
+  );
+}
+
+async function validateSessionAcceptance(
+  message: CultMeshSessionAcceptedMessage,
+  request: CultMeshSessionOpenMessage,
+  route: CultMeshBrowserRoute,
+  trust: CultMeshBrowserAuthorityTrustPolicy,
+): Promise<Error | undefined> {
+  if (!message.accepted) return new Error(message.error ?? "CultMesh authority rejected the session.");
+  const protocolId = route.protocolId ?? "cultmesh.documents.v1";
+  if (message.verseId !== request.verseId ||
+      message.authorityRuntimeId !== request.authorityRuntimeId ||
+      message.protocolId !== protocolId ||
+      message.routeGeneration !== route.generation ||
+      message.clientNonce !== request.clientNonce) {
+    return new Error(
+      `CultMesh route proved '${message.verseId}/${message.authorityRuntimeId}/${message.protocolId}/${message.routeGeneration}', ` +
+      `expected '${request.verseId}/${request.authorityRuntimeId}/${protocolId}/${route.generation}'.`,
+    );
+  }
+  if (trust.mode === "local-development" && isLoopbackEndpoint(route.endpoint) && !route.certificate) return undefined;
+  const providerKey = route.certificate?.providerKey;
+  if (!providerKey || message.providerKeyId !== providerKey.keyId || !message.providerSignature) {
+    return new Error("CultMesh authority did not prove possession of the Odin-certified provider key.");
+  }
+  if (!await verifyP256(providerKey, canonicalSession(request, route.endpoint), message.providerSignature)) {
+    return new Error("CultMesh provider session proof is invalid.");
+  }
+  return undefined;
+}
+
+async function verifyAuthorityRoute(
+  route: CultMeshBrowserRoute,
+  trust: CultMeshBrowserAuthorityTrustPolicy,
+): Promise<void> {
+  const certificate = route.certificate;
+  if (!certificate) {
+    if (trust.mode === "local-development" && isLoopbackEndpoint(route.endpoint)) return;
+    throw new Error("Remote CultMesh routes require an Odin-signed authority certificate.");
+  }
+  const endpoint = new URL(route.endpoint);
+  if (endpoint.protocol !== "wss:" && !(trust.mode === "local-development" && isLoopbackEndpoint(route.endpoint))) {
+    throw new Error("Authenticated remote CultMesh browser routes require wss:// channel protection.");
+  }
+  const now = trust.now?.() ?? Date.now();
+  if (now < certificate.issuedAtUnixMilliseconds || now >= certificate.expiresAtUnixMilliseconds) {
+    throw new Error("The Odin route certificate is not currently valid.");
+  }
+  const root = trust.odinRoots?.find(candidate => candidate.keyId === certificate.odinKeyId);
+  if (!root) throw new Error(`Odin key '${certificate.odinKeyId}' is not trusted by this consumer.`);
+  if (!await verifyP256(root, canonicalRoute(route), certificate.signature)) {
+    throw new Error("The Odin route certificate signature is invalid.");
+  }
+}
+
+function canonicalRoute(route: CultMeshBrowserRoute): Uint8Array {
+  const certificate = route.certificate!;
+  return canonicalFields(
+    "gamecult.cultmesh.route-certificate.v1",
+    route.verseId,
+    route.authorityRuntimeId,
+    route.endpoint,
+    [...(route.protocolIds ?? [route.protocolId ?? "cultmesh.documents.v1"])].sort().join("\u001f"),
+    String(route.priority ?? 0),
+    route.generation,
+    certificate.providerKey.keyId,
+    certificate.providerKey.x,
+    certificate.providerKey.y,
+    certificate.odinKeyId,
+    String(certificate.issuedAtUnixMilliseconds),
+    String(certificate.expiresAtUnixMilliseconds),
+  );
+}
+
+function canonicalSession(request: CultMeshSessionOpenMessage, endpoint: string): Uint8Array {
+  return canonicalFields(
+    "gamecult.cultmesh.session-proof.v1",
+    request.clientNonce,
+    request.messageId,
+    request.sourceRuntimeId,
+    request.verseId,
+    request.authorityRuntimeId,
+    request.protocolId,
+    endpoint,
+    request.routeGeneration,
+  );
+}
+
+function canonicalFields(...values: string[]): Uint8Array {
+  const encoder = new TextEncoder();
+  const encoded = values.map(value => encoder.encode(value));
+  const total = encoded.reduce((sum, value) => sum + 4 + value.byteLength, 0);
+  const result = new Uint8Array(total);
+  const view = new DataView(result.buffer);
+  let offset = 0;
+  for (const value of encoded) {
+    view.setUint32(offset, value.byteLength, false);
+    offset += 4;
+    result.set(value, offset);
+    offset += value.byteLength;
+  }
+  return result;
+}
+
+async function verifyP256(
+  key: CultMeshBrowserP256PublicKey,
+  payload: Uint8Array,
+  signatureBase64: string,
+): Promise<boolean> {
+  try {
+    const x = base64ToBytes(key.x);
+    const y = base64ToBytes(key.y);
+    const signature = base64ToBytes(signatureBase64);
+    if (x.byteLength !== 32 || y.byteLength !== 32 || signature.byteLength !== 64) return false;
+    const raw = new Uint8Array(65);
+    raw[0] = 4;
+    raw.set(x, 1);
+    raw.set(y, 33);
+    const publicKey = await crypto.subtle.importKey(
+      "raw",
+      raw.slice().buffer as ArrayBuffer,
+      { name: "ECDSA", namedCurve: "P-256" },
+      false,
+      ["verify"],
+    );
+    return await crypto.subtle.verify(
+      { name: "ECDSA", hash: "SHA-256" },
+      publicKey,
+      signature.slice().buffer as ArrayBuffer,
+      payload.slice().buffer as ArrayBuffer,
+    );
+  } catch {
+    return false;
+  }
+}
+
+function randomNonce(): string {
+  const bytes = crypto.getRandomValues(new Uint8Array(32));
+  return bytesToBase64(bytes);
+}
+
+function isLoopbackEndpoint(value: string): boolean {
+  try {
+    const host = new URL(value).hostname.replace(/^\[|\]$/g, "").toLowerCase();
+    return host === "localhost" || host === "127.0.0.1" || host === "::1";
+  } catch {
+    return false;
+  }
+}
+
+function requireText(value: string, field: string): void {
+  if (!value || value.trim().length === 0) throw new Error(`CultMesh browser ${field} is required.`);
+}
diff --git a/packages/cultmesh-browser/test/cultmesh-browser.test.ts b/packages/cultmesh-browser/test/cultmesh-browser.test.ts
new file mode 100644
index 00000000..6c169d93
--- /dev/null
+++ b/packages/cultmesh-browser/test/cultmesh-browser.test.ts
@@ -0,0 +1,929 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+
+import { decode, encode } from "@msgpack/msgpack";
+import {
+  encodeCultNetMessageForWire,
+  parseCultNetMessage,
+  type CultNetDatabaseSubscribeMessage,
+  type CultNetMessage,
+  type CultNetOperationRequestMessage,
+  type CultNetRawDocumentRecord,
+  type CultMeshVerseCatalogResponseMessage,
+  type CultMeshSessionOpenMessage,
+} from "cultnet-ts/contracts";
+
+import {
+  CultMeshBrowserClient,
+  CultMeshBrowserOperationError,
+  CultMeshBrowserOdinRendezvous,
+  decodeCultNetOperationPayload,
+  decodeCultNetPayload,
+  type CultMeshBrowserRoute,
+  type CultMeshBrowserP256PublicKey,
+  type CultMeshBrowserSocket,
+} from "../src/index.js";
+
+const localTrust = { mode: "local-development" as const };
+
+test("Odin rendezvous resolves stable authority-runtime identity and observes route rotation", async () => {
+  const odin = new FakeOdin("ws://127.0.0.1:4050/mesh");
+  let id = 0;
+  const rendezvous = new CultMeshBrowserOdinRendezvous({
+    endpoints: ["ws://127.0.0.1:4040/odin"],
+    runtimeId: "browser-odin-test",
+    createId: () => `odin-${++id}`,
+    socketFactory: () => odin.open(),
+  });
+
+  assert.equal((await rendezvous.resolve({
+    verseId: "sample.counter",
+    authorityRuntimeId: "sample.counter-daemon",
+  }, localTrust)).endpoint, "ws://127.0.0.1:4050/mesh");
+
+  odin.providerEndpoint = "ws://127.0.0.1:4060/mesh";
+  assert.equal((await rendezvous.resolve({
+    verseId: "sample.counter",
+    authorityRuntimeId: "sample.counter-daemon",
+  }, localTrust)).endpoint, "ws://127.0.0.1:4060/mesh");
+
+  await assert.rejects(
+    rendezvous.resolve({ verseId: "sample.counter", authorityRuntimeId: "other-runtime" }, localTrust),
+    /could not resolve/,
+  );
+});
+
+test("Odin rendezvous never selects another authority's faster endpoint", async () => {
+  const odin = new FakeOdin("ws://127.0.0.1:4050/mesh");
+  odin.decoyEndpoint = "ws://127.0.0.1:4049/decoy";
+  const rendezvous = new CultMeshBrowserOdinRendezvous({
+    endpoints: ["ws://127.0.0.1:4040/odin"],
+    runtimeId: "browser-route-binding-test",
+    socketFactory: () => odin.open(),
+  });
+
+  const route = await rendezvous.resolve({
+    verseId: "sample.counter",
+    authorityRuntimeId: "sample.counter-daemon",
+  }, localTrust);
+  assert.equal(route.endpoint, "ws://127.0.0.1:4050/mesh");
+});
+
+test("Odin rendezvous accepts one-authority legacy routes and rejects ambiguous legacy catalogs", async () => {
+  const odin = new FakeOdin("ws://127.0.0.1:4070/mesh");
+  odin.omitAuthorityRoutes = true;
+  const rendezvous = new CultMeshBrowserOdinRendezvous({
+    endpoints: ["ws://127.0.0.1:4040/odin"],
+    runtimeId: "browser-legacy-route-test",
+    socketFactory: () => odin.open(),
+  });
+
+  const route = await rendezvous.resolve({
+    verseId: "sample.counter",
+    authorityRuntimeId: "sample.counter-daemon",
+  }, localTrust);
+  assert.equal(route.endpoint, "ws://127.0.0.1:4070/mesh");
+
+  odin.decoyEndpoint = "ws://127.0.0.1:4069/decoy";
+  await assert.rejects(
+    rendezvous.resolve({ verseId: "sample.counter", authorityRuntimeId: "sample.counter-daemon" }, localTrust),
+    (error: unknown) =>
+      error instanceof AggregateError &&
+      error.errors.some(inner => inner instanceof Error && /ambiguous legacy routes/.test(inner.message)),
+  );
+});
+
+test("Odin rendezvous rejects a poisoned route without vetoing a certified fallback", async () => {
+  const signed = await createSignedRoute("wss://provider.example/mesh");
+  const odin = new FakeOdin(signed.route.endpoint);
+  odin.authorityRoutesOverride = [
+    {
+      authorityRuntimeId: signed.route.authorityRuntimeId,
+      endpoint: "wss://poison.example/mesh",
+      protocolIds: ["cultmesh.documents.v1"],
+      priority: 0,
+      generation: "poisoned",
+    },
+    routeForCatalog(signed.route),
+  ];
+  const rendezvous = new CultMeshBrowserOdinRendezvous({
+    endpoints: ["ws://127.0.0.1:4040/odin"],
+    runtimeId: "browser-certified-fallback-test",
+    socketFactory: () => odin.open(),
+  });
+
+  const selected = await rendezvous.resolve(
+    { verseId: signed.route.verseId, authorityRuntimeId: signed.route.authorityRuntimeId },
+    { mode: "authenticated-remote", odinRoots: [signed.odinPublic] },
+  );
+
+  assert.equal(selected.endpoint, signed.route.endpoint);
+});
+
+test("browser client leases provider state, invokes an operation, and follows route replacement", async () => {
+  const first = new FakeProvider("ws://127.0.0.1:4101/mesh", 4);
+  const second = new FakeProvider("ws://127.0.0.1:4102/mesh", 9);
+  let route = first.route;
+  let id = 0;
+  const client = await CultMeshBrowserClient.connect({
+    verseId: route.verseId,
+    authorityRuntimeId: route.authorityRuntimeId,
+    runtimeId: "browser-test",
+    trust: localTrust,
+    rendezvous: { resolve: async () => route },
+    createId: () => `id-${++id}`,
+    socketFactory: endpoint => endpoint === first.route.endpoint ? first.open() : second.open(),
+  });
+
+  const lease = await client.leaseRawDocument({
+    schemaId: "sample.counter_state.v1",
+    recordKey: "counter:main",
+  });
+  assert.deepEqual(decodeCultNetPayload<{ count: number }>(lease.current!).count, 4);
+
+  const observed: number[] = [];
+  const unwatch = lease.watch(record => {
+    if (record) observed.push(decodeCultNetPayload<{ count: number }>(record).count);
+  });
+  const response = await client.invoke({
+    serviceId: "sample.counter",
+    operation: "increment",
+    payloadSchema: "sample.increment.v1",
+    payload: { amount: 2 },
+  });
+  assert.equal(response.status, "accepted");
+  assert.deepEqual(decodeCultNetOperationPayload<{ count: number }>(response), { count: 6 });
+  assert.deepEqual(observed, [4, 6]);
+
+  route = second.route;
+  await client.refreshRoute();
+  assert.equal(client.state, "connected");
+  assert.deepEqual(decodeCultNetPayload<{ count: number }>(lease.current!).count, 9);
+  assert.deepEqual(observed, [4, 6, 9]);
+  assert.equal(first.activeSubscriptionCount, 0);
+  assert.equal(second.activeSubscriptionCount, 1);
+
+  unwatch();
+  lease.dispose();
+  assert.equal(second.activeSubscriptionCount, 0);
+  await client.dispose();
+});
+
+test("browser client rejects wrong rendezvous identity and has no document write API", async () => {
+  const provider = new FakeProvider("ws://127.0.0.1:4201/mesh", 1);
+  await assert.rejects(
+    CultMeshBrowserClient.connect({
+      verseId: "sample.counter",
+      authorityRuntimeId: "sample.counter-daemon",
+      runtimeId: "browser-test",
+      trust: localTrust,
+      rendezvous: {
+        resolve: async () => ({
+          ...provider.route,
+          authorityRuntimeId: "intruder-runtime",
+        }),
+      },
+      socketFactory: () => provider.open(),
+    }),
+    /wrong stable identity/,
+  );
+  assert.equal("putDocument" in CultMeshBrowserClient.prototype, false);
+  assert.equal("setDocument" in CultMeshBrowserClient.prototype, false);
+});
+
+test("browser client rejects a route whose peer proves the wrong authority", async () => {
+  const provider = new FakeProvider("ws://127.0.0.1:4251/mesh", 1, false, "intruder-runtime");
+  await assert.rejects(
+    CultMeshBrowserClient.connect({
+      verseId: "sample.counter",
+      authorityRuntimeId: "sample.counter-daemon",
+      runtimeId: "browser-peer-proof-test",
+      trust: localTrust,
+      rendezvous: { resolve: async () => ({ ...provider.route, authorityRuntimeId: "sample.counter-daemon" }) },
+      socketFactory: () => provider.open(),
+    }),
+    /proved .*intruder-runtime.*expected .*sample.counter-daemon/,
+  );
+});
+
+test("browser client accepts an Odin-certified route only after provider nonce proof", async () => {
+  const fixture = await createSignedRoute("wss://provider.example/mesh");
+  const client = await CultMeshBrowserClient.connect({
+    ...fixture.route,
+    runtimeId: "browser-authenticated-test",
+    rendezvous: { resolve: async () => fixture.route },
+    trust: { mode: "authenticated-remote", odinRoots: [fixture.odinPublic] },
+    socketFactory: () => signedHandshakeSocket(fixture.route, fixture.providerPrivate),
+  });
+
+  assert.equal(client.state, "connected");
+  await client.dispose();
+});
+
+test("browser client rejects a credential-free authority impersonator", async () => {
+  const fixture = await createSignedRoute("wss://provider.example/mesh");
+  const impersonator = new FakeProvider("wss://provider.example/mesh", 1);
+
+  await assert.rejects(
+    CultMeshBrowserClient.connect({
+      ...fixture.route,
+      runtimeId: "browser-impersonation-test",
+      rendezvous: { resolve: async () => fixture.route },
+      trust: { mode: "authenticated-remote", odinRoots: [fixture.odinPublic] },
+      socketFactory: () => impersonator.open(),
+    }),
+    /did not prove possession/,
+  );
+});
+
+test("browser client rejects a mutated or expired signed route before opening a provider socket", async () => {
+  const fixture = await createSignedRoute("wss://provider.example/mesh");
+  let opened = false;
+  const connect = (route: CultMeshBrowserRoute, now?: () => number) => CultMeshBrowserClient.connect({
+    ...route,
+    runtimeId: "browser-route-certificate-test",
+    rendezvous: { resolve: async () => route },
+    trust: { mode: "authenticated-remote", odinRoots: [fixture.odinPublic], now },
+    socketFactory: () => {
+      opened = true;
+      return signedHandshakeSocket(route, fixture.providerPrivate);
+    },
+  });
+
+  await assert.rejects(connect({ ...fixture.route, endpoint: "wss://evil.example/mesh" }), /signature is invalid/);
+  assert.equal(opened, false);
+  await assert.rejects(connect(fixture.route, () => fixture.expiresAt), /not currently valid/);
+  assert.equal(opened, false);
+});
+
+test("browser client bounds unanswered provider operations", async () => {
+  const route = {
+    verseId: "sample.counter",
+    authorityRuntimeId: "sample.counter-daemon",
+    endpoint: "ws://127.0.0.1:4301/mesh",
+    generation: "route-4301",
+  };
+  const client = await CultMeshBrowserClient.connect({
+    ...route,
+    runtimeId: "browser-timeout-test",
+    trust: localTrust,
+    rendezvous: { resolve: async () => route },
+    requestTimeoutMs: 5,
+    socketFactory: () => handshakeOnlySocket(route),
+  });
+  await assert.rejects(
+    client.invoke({
+      serviceId: "sample.counter",
+      operation: "increment",
+      payloadSchema: "sample.increment.v1",
+      payload: { amount: 1 },
+      idempotencyKey: "timeout-1",
+    }),
+    /timed out/,
+  );
+  await client.dispose();
+});
+
+test("browser client rejects a correlated framework failure without waiting for timeout", async () => {
+  const provider = new FakeProvider("ws://127.0.0.1:4351/mesh", 1, true);
+  const client = await CultMeshBrowserClient.connect({
+    ...provider.route,
+    runtimeId: "browser-failure-test",
+    trust: localTrust,
+    rendezvous: { resolve: async () => provider.route },
+    requestTimeoutMs: 60_000,
+    socketFactory: () => provider.open(),
+  });
+
+  await assert.rejects(
+    client.invoke({
+      serviceId: "sample.counter",
+      operation: "increment",
+      payloadSchema: "wrong.request.v1",
+      payload: { amount: 1 },
+      idempotencyKey: "failure-1",
+    }),
+    (error: unknown) => {
+      assert.ok(error instanceof CultMeshBrowserOperationError);
+      assert.equal(error.status, "invalid");
+      assert.equal(error.code, "request-schema-mismatch");
+      assert.match(error.message, /expected payload schema/i);
+      return true;
+    },
+  );
+  await client.dispose();
+});
+
+test("browser client replays one idempotent operation after route loss without duplicating its effect", async () => {
+  const firstRoute = localRoute("ws://127.0.0.1:4311/mesh", "generation-1");
+  const secondRoute = localRoute("ws://127.0.0.1:4312/mesh", "generation-2");
+  let route = firstRoute;
+  let effectCount = 0;
+  let dropFirstResponse = true;
+  const results = new Map<string, CultNetMessage>();
+  const open = () => {
+    let socket: FakeSocket;
+    socket = new FakeSocket(wire => {
+      const message = parseCultNetMessage(decode(wire));
+      if (message.schemaVersion === "cultmesh.session_open.v2") {
+        socket.deliver({
+          schemaVersion: "cultmesh.session_accepted.v2",
+          messageId: message.messageId,
+          accepted: true,
+          verseId: message.verseId,
+          authorityRuntimeId: message.authorityRuntimeId,
+          protocolId: message.protocolId,
+          routeGeneration: message.routeGeneration,
+          clientNonce: message.clientNonce,
+          providerKeyId: "",
+          providerSignature: "",
+        });
+        return;
+      }
+      if (message.schemaVersion !== "cultnet.operation_request.v0") return;
+      let response = results.get(message.messageId);
+      if (!response) {
+        effectCount++;
+        response = {
+          schemaVersion: "cultnet.operation_response.v0",
+          messageId: message.messageId,
+          serviceId: message.serviceId,
+          operation: message.operation,
+          status: "accepted",
+          payloadSchema: "sample.increment_receipt.v1",
+          payloadEncoding: "messagepack-base64",
+          payload: Buffer.from(encode({ count: effectCount })).toString("base64"),
+          sourceRuntimeId: "sample.counter-daemon",
+        };
+        results.set(message.messageId, response!);
+      }
+      if (dropFirstResponse) {
+        dropFirstResponse = false;
+        route = secondRoute;
+        socket.close(1012, "route lost after commit");
+        return;
+      }
+      socket.deliver(response!);
+    }, () => undefined);
+    return socket;
+  };
+  const client = await CultMeshBrowserClient.connect({
+    ...firstRoute,
+    runtimeId: "browser-operation-replay-test",
+    rendezvous: { resolve: async () => route },
+    trust: localTrust,
+    reconnectDelayMs: 1,
+    requestTimeoutMs: 2_000,
+    socketFactory: () => open(),
+  });
+
+  const response = await client.invoke({
+    serviceId: "sample.counter",
+    operation: "increment",
+    payloadSchema: "sample.increment.v1",
+    payload: { amount: 1 },
+    idempotencyKey: "replay-once",
+  });
+
+  assert.deepEqual(decodeCultNetOperationPayload<{ count: number }>(response), { count: 1 });
+  assert.equal(effectCount, 1);
+  await client.dispose();
+});
+
+test("an early caller reconnect cancels the scheduled reconnect and keeps one live socket", async () => {
+  const provider = new FakeProvider("ws://127.0.0.1:4361/mesh", 2);
+  const client = await CultMeshBrowserClient.connect({
+    ...provider.route,
+    runtimeId: "browser-single-reconnect-test",
+    rendezvous: { resolve: async () => provider.route },
+    trust: localTrust,
+    reconnectDelayMs: 40,
+    socketFactory: () => provider.open(),
+  });
+  const lease = await client.leaseRawDocument({
+    schemaId: "sample.counter_state.v1",
+    recordKey: "counter:main",
+  });
+
+  provider.dropConnections();
+  await client.invoke({
+    serviceId: "sample.counter",
+    operation: "increment",
+    payloadSchema: "sample.increment.v1",
+    payload: { amount: 1 },
+  });
+  await new Promise(resolve => setTimeout(resolve, 80));
+
+  assert.equal(provider.openCount, 2);
+  assert.equal(provider.liveSocketCount, 1);
+  assert.equal(provider.activeSubscriptionCount, 1);
+  lease.dispose();
+  await client.dispose();
+});
+
+test("browser client rejects an operation response from another runtime", async () => {
+  const provider = new FakeProvider(
+    "ws://127.0.0.1:4371/mesh",
+    1,
+    false,
+    "sample.counter-daemon",
+    "intruder-runtime",
+  );
+  const client = await CultMeshBrowserClient.connect({
+    ...provider.route,
+    runtimeId: "browser-response-authority-test",
+    trust: localTrust,
+    rendezvous: { resolve: async () => provider.route },
+    socketFactory: () => provider.open(),
+  });
+
+  await assert.rejects(
+    client.invoke({
+      serviceId: "sample.counter",
+      operation: "increment",
+      payloadSchema: "sample.increment.v1",
+      payload: { amount: 1 },
+    }),
+    /response came from 'intruder-runtime'/,
+  );
+  await client.dispose();
+});
+
+test("browser client rejects oversized outbound schema messages", async () => {
+  const route = {
+    verseId: "sample.counter",
+    authorityRuntimeId: "sample.counter-daemon",
+    endpoint: "ws://127.0.0.1:4401/mesh",
+    generation: "route-4401",
+  };
+  await assert.rejects(
+    CultMeshBrowserClient.connect({
+      ...route,
+      runtimeId: "browser-size-test",
+      trust: localTrust,
+      rendezvous: { resolve: async () => route },
+      maxFrameBytes: 8,
+      socketFactory: () => new FakeSocket(() => undefined, () => undefined),
+    }),
+    /exceeds the 8-byte limit/,
+  );
+});
+
+test("browser client reserves subscription identity while the initial lease opens", async () => {
+  const provider = new FakeProvider("ws://127.0.0.1:4501/mesh", 3);
+  const client = await CultMeshBrowserClient.connect({
+    ...provider.route,
+    runtimeId: "browser-lease-race-test",
+    trust: localTrust,
+    rendezvous: { resolve: async () => provider.route },
+    socketFactory: () => provider.open(),
+  });
+  const first = client.leaseRawDocument({
+    schemaId: "sample.counter_state.v1",
+    recordKey: "counter:main",
+    subscriptionId: "one-owner",
+  });
+  await assert.rejects(
+    client.leaseRawDocument({
+      schemaId: "sample.counter_state.v1",
+      recordKey: "counter:main",
+      subscriptionId: "one-owner",
+    }),
+    /already leased/,
+  );
+  (await first).dispose();
+  await client.dispose();
+});
+
+class FakeProvider {
+  readonly route: CultMeshBrowserRoute;
+  #count: number;
+  #subscriptions = new Map<FakeSocket, Map<string, CultNetDatabaseSubscribeMessage>>();
+  #rejectOperations: boolean;
+  #runtimeId: string;
+  #responseRuntimeId: string;
+  #openCount = 0;
+
+  constructor(
+    endpoint: string,
+    count: number,
+    rejectOperations = false,
+    runtimeId = "sample.counter-daemon",
+    responseRuntimeId = runtimeId,
+  ) {
+    this.route = {
+      verseId: "sample.counter",
+      authorityRuntimeId: "sample.counter-daemon",
+      endpoint,
+      generation: endpoint,
+    };
+    this.#count = count;
+    this.#rejectOperations = rejectOperations;
+    this.#runtimeId = runtimeId;
+    this.#responseRuntimeId = responseRuntimeId;
+  }
+
+  get activeSubscriptionCount(): number {
+    let count = 0;
+    for (const subscriptions of this.#subscriptions.values()) count += subscriptions.size;
+    return count;
+  }
+
+  get openCount(): number {
+    return this.#openCount;
+  }
+
+  get liveSocketCount(): number {
+    return this.#subscriptions.size;
+  }
+
+  dropConnections(): void {
+    for (const socket of [...this.#subscriptions.keys()]) socket.close(1012, "route dropped");
+  }
+
+  open(): FakeSocket {
+    this.#openCount++;
+    const socket = new FakeSocket(
+      wire => this.receive(socket, wire),
+      () => this.#subscriptions.delete(socket),
+    );
+    this.#subscriptions.set(socket, new Map());
+    return socket;
+  }
+
+  private receive(socket: FakeSocket, wire: Uint8Array): void {
+    const message = parseCultNetMessage(decode(wire));
+    switch (message.schemaVersion) {
+      case "cultmesh.session_open.v2":
+        this.acceptSession(socket, message);
+        return;
+      case "cultnet.database_subscribe.v0":
+        this.subscribe(socket, message);
+        return;
+      case "cultnet.database_unsubscribe.v0":
+        this.#subscriptions.get(socket)?.delete(message.subscriptionId);
+        return;
+      case "cultnet.operation_request.v0":
+        this.invoke(socket, message);
+        return;
+      default:
+        return;
+    }
+  }
+
+  private acceptSession(socket: FakeSocket, message: CultMeshSessionOpenMessage): void {
+    socket.deliver({
+      schemaVersion: "cultmesh.session_accepted.v2",
+      messageId: message.messageId,
+      accepted: true,
+      verseId: message.verseId,
+      authorityRuntimeId: this.#runtimeId,
+      protocolId: message.protocolId,
+      routeGeneration: message.routeGeneration,
+      clientNonce: message.clientNonce,
+      providerKeyId: "",
+      providerSignature: "",
+    });
+  }
+
+  private subscribe(socket: FakeSocket, message: CultNetDatabaseSubscribeMessage): void {
+    this.#subscriptions.get(socket)!.set(message.subscriptionId, message);
+    socket.deliver({
+      schemaVersion: "cultnet.snapshot_response_raw.v0",
+      messageId: message.messageId,
+      documents: [this.record()],
+    });
+  }
+
+  private invoke(socket: FakeSocket, message: CultNetOperationRequestMessage): void {
+    assert.equal(message.targetRuntimeId, this.#runtimeId);
+    if (this.#rejectOperations) {
+      socket.deliver({
+        schemaVersion: "cultnet.operation_response.v0",
+        messageId: message.messageId,
+        serviceId: message.serviceId,
+        operation: message.operation,
+        status: "invalid",
+        payloadSchema: "gamecult.cultnet.operation_failure.v1",
+        payloadEncoding: "messagepack-base64",
+        payload: bytesToBase64(encode({
+          code: "request-schema-mismatch",
+          message: "Expected payload schema 'sample.increment.v1'.",
+        })),
+        diagnostics: ["Request schema did not match."],
+        sourceRuntimeId: this.#responseRuntimeId,
+      });
+      return;
+    }
+    const payload = decode(base64ToBytes(message.payload)) as { amount: number };
+    this.#count += payload.amount;
+    for (const [peer, subscriptions] of this.#subscriptions) {
+      for (const subscriptionId of subscriptions.keys()) {
+        peer.deliver({
+          schemaVersion: "cultnet.database_change_raw.v0",
+          messageId: `change-${message.messageId}`,
+          subscriptionId,
+          changeKind: "updated",
+          document: this.record(),
+        });
+      }
+    }
+    socket.deliver({
+      schemaVersion: "cultnet.operation_response.v0",
+      messageId: message.messageId,
+      serviceId: message.serviceId,
+      operation: message.operation,
+      status: "accepted",
+      payloadSchema: "sample.increment_receipt.v1",
+      payloadEncoding: "messagepack-base64",
+      payload: bytesToBase64(encode({ count: this.#count })),
+      sourceRuntimeId: this.#responseRuntimeId,
+    });
+  }
+
+  private record(): CultNetRawDocumentRecord {
+    return {
+      schemaId: "sha256:sample-counter-state",
+      schemaName: "sample.counter_state",
+      schemaVersion: "sample.counter_state.v1",
+      schemaContentHash: "sha256:sample-counter-state-content",
+      recordKey: "counter:main",
+      storedAt: "2026-08-17T00:00:00Z",
+      payloadEncoding: "messagepack",
+      payload: encode({ count: this.#count }),
+      sourceRuntimeId: this.#runtimeId,
+    };
+  }
+}
+
+class FakeOdin {
+  providerEndpoint: string;
+  decoyEndpoint: string | undefined;
+  omitAuthorityRoutes = false;
+  authorityRoutesOverride: NonNullable<CultMeshVerseCatalogResponseMessage["verses"][number]["authorityRoutes"]> | undefined;
+
+  constructor(providerEndpoint: string) {
+    this.providerEndpoint = providerEndpoint;
+  }
+
+  open(): FakeSocket {
+    const socket = new FakeSocket(wire => {
+      const message = parseCultNetMessage(decode(wire));
+      if (message.schemaVersion !== "cultmesh.verse_catalog_request.v0") return;
+      socket.deliver({
+        schemaVersion: "cultmesh.verse_catalog_response.v0",
+        messageId: message.messageId,
+        verses: [{
+          verseId: "sample.counter",
+          displayName: "Counter",
+          authorityModel: "ServerAuthoritative",
+          compatibility: {
+            transportVersion: "cultmesh.v1",
+            rulesHash: "counter-v1",
+            compatibleVerseIds: [],
+            requiredPluginIds: [],
+            optionalPluginIds: [],
+          },
+          discoveryEndpoints: [this.providerEndpoint],
+          authorityRuntimeIds: this.decoyEndpoint
+            ? ["sample.counter-daemon", "sample.decoy-daemon"]
+            : ["sample.counter-daemon"],
+          ...(!this.omitAuthorityRoutes ? { authorityRoutes: this.authorityRoutesOverride ?? [
+            ...(this.decoyEndpoint ? [{
+              authorityRuntimeId: "sample.decoy-daemon",
+              endpoint: this.decoyEndpoint,
+              protocolIds: ["cultmesh.documents.v1"],
+              priority: 0,
+              generation: "decoy-generation",
+            }] : []),
+            {
+              authorityRuntimeId: "sample.counter-daemon",
+              endpoint: this.providerEndpoint,
+              protocolIds: ["cultmesh.documents.v1"],
+              priority: 10,
+              generation: this.providerEndpoint,
+            },
+          ] } : {}),
+        }],
+      });
+    }, () => undefined);
+    return socket;
+  }
+}
+
+function routeForCatalog(route: CultMeshBrowserRoute): NonNullable<
+  CultMeshVerseCatalogResponseMessage["verses"][number]["authorityRoutes"]
+>[number] {
+  return {
+    authorityRuntimeId: route.authorityRuntimeId,
+    endpoint: route.endpoint,
+    protocolIds: [...(route.protocolIds ?? [route.protocolId ?? "cultmesh.documents.v1"])],
+    priority: route.priority ?? 0,
+    generation: route.generation,
+    ...(route.certificate ? {
+      certificate: {
+        providerKeyId: route.certificate.providerKey.keyId,
+        providerPublicKeyX: route.certificate.providerKey.x,
+        providerPublicKeyY: route.certificate.providerKey.y,
+        odinKeyId: route.certificate.odinKeyId,
+        issuedAtUnixMilliseconds: route.certificate.issuedAtUnixMilliseconds,
+        expiresAtUnixMilliseconds: route.certificate.expiresAtUnixMilliseconds,
+        signature: route.certificate.signature,
+      },
+    } : {}),
+  };
+}
+
+function handshakeOnlySocket(route: CultMeshBrowserRoute): FakeSocket {
+  let socket: FakeSocket;
+  socket = new FakeSocket(wire => {
+    const message = parseCultNetMessage(decode(wire));
+    if (message.schemaVersion !== "cultmesh.session_open.v2") return;
+    socket.deliver({
+      schemaVersion: "cultmesh.session_accepted.v2",
+      messageId: message.messageId,
+      accepted: true,
+      verseId: route.verseId,
+      authorityRuntimeId: route.authorityRuntimeId,
+      protocolId: message.protocolId,
+      routeGeneration: message.routeGeneration,
+      clientNonce: message.clientNonce,
+      providerKeyId: "",
+      providerSignature: "",
+    });
+  }, () => undefined);
+  return socket;
+}
+
+function localRoute(endpoint: string, generation: string): CultMeshBrowserRoute {
+  return {
+    verseId: "sample.counter",
+    authorityRuntimeId: "sample.counter-daemon",
+    endpoint,
+    protocolId: "cultmesh.documents.v1",
+    protocolIds: ["cultmesh.documents.v1"],
+    priority: 0,
+    generation,
+  };
+}
+
+class FakeSocket implements CultMeshBrowserSocket {
+  binaryType: BinaryType = "arraybuffer";
+  readyState = 0;
+  onopen: ((event: Event) => void) | null = null;
+  onmessage: ((event: MessageEvent) => void) | null = null;
+  onerror: ((event: Event) => void) | null = null;
+  onclose: ((event: CloseEvent) => void) | null = null;
+  #receive: (wire: Uint8Array) => void;
+  #closed: () => void;
+
+  constructor(receive: (wire: Uint8Array) => void, closed: () => void) {
+    this.#receive = receive;
+    this.#closed = closed;
+    queueMicrotask(() => {
+      this.readyState = 1;
+      this.onopen?.({} as Event);
+    });
+  }
+
+  send(data: ArrayBuffer | ArrayBufferView): void {
+    if (this.readyState !== 1) throw new Error("Fake socket is not open.");
+    const wire = data instanceof ArrayBuffer
+      ? new Uint8Array(data)
+      : new Uint8Array(data.buffer, data.byteOffset, data.byteLength);
+    this.#receive(wire);
+  }
+
+  close(code = 1000, reason = ""): void {
+    if (this.readyState === 3) return;
+    this.readyState = 3;
+    this.#closed();
+    this.onclose?.({ code, reason } as CloseEvent);
+  }
+
+  deliver(message: CultNetMessage): void {
+    const wire = encode(encodeCultNetMessageForWire(message));
+    queueMicrotask(() => this.onmessage?.({ data: wire.slice().buffer } as MessageEvent));
+  }
+}
+
+async function createSignedRoute(endpoint: string): Promise<{
+  route: CultMeshBrowserRoute;
+  odinPublic: CultMeshBrowserP256PublicKey;
+  providerPrivate: CryptoKey;
+  expiresAt: number;
+}> {
+  const odin = await crypto.subtle.generateKey({ name: "ECDSA", namedCurve: "P-256" }, true, ["sign", "verify"]);
+  const provider = await crypto.subtle.generateKey({ name: "ECDSA", namedCurve: "P-256" }, true, ["sign", "verify"]);
+  const odinPublic = await exportPublic("odin-root-1", odin.publicKey);
+  const providerPublic = await exportPublic("provider-1", provider.publicKey);
+  const issuedAt = Date.now() - 1_000;
+  const expiresAt = Date.now() + 60_000;
+  const unsigned: CultMeshBrowserRoute = {
+    verseId: "sample.counter",
+    authorityRuntimeId: "sample.counter-daemon",
+    endpoint,
+    protocolId: "cultmesh.documents.v1",
+    protocolIds: ["cultmesh.documents.v1"],
+    priority: 0,
+    generation: "signed-generation-1",
+    certificate: {
+      providerKey: providerPublic,
+      odinKeyId: odinPublic.keyId,
+      issuedAtUnixMilliseconds: issuedAt,
+      expiresAtUnixMilliseconds: expiresAt,
+      signature: "",
+    },
+  };
+  const signature = await crypto.subtle.sign(
+    { name: "ECDSA", hash: "SHA-256" },
+    odin.privateKey,
+    testCanonicalRoute(unsigned).slice().buffer as ArrayBuffer,
+  );
+  return {
+    route: { ...unsigned, certificate: { ...unsigned.certificate!, signature: toBase64(new Uint8Array(signature)) } },
+    odinPublic,
+    providerPrivate: provider.privateKey,
+    expiresAt,
+  };
+}
+
+function signedHandshakeSocket(route: CultMeshBrowserRoute, providerPrivate: CryptoKey): FakeSocket {
+  let socket: FakeSocket;
+  socket = new FakeSocket(wire => {
+    const message = parseCultNetMessage(decode(wire));
+    if (message.schemaVersion !== "cultmesh.session_open.v2") return;
+    void crypto.subtle.sign(
+      { name: "ECDSA", hash: "SHA-256" },
+      providerPrivate,
+      testCanonicalSession(message, route.endpoint).slice().buffer as ArrayBuffer,
+    ).then(signature => socket.deliver({
+      schemaVersion: "cultmesh.session_accepted.v2",
+      messageId: message.messageId,
+      accepted: true,
+      verseId: message.verseId,
+      authorityRuntimeId: message.authorityRuntimeId,
+      protocolId: message.protocolId,
+      routeGeneration: message.routeGeneration,
+      clientNonce: message.clientNonce,
+      providerKeyId: route.certificate!.providerKey.keyId,
+      providerSignature: toBase64(new Uint8Array(signature)),
+    }));
+  }, () => undefined);
+  return socket;
+}
+
+async function exportPublic(keyId: string, key: CryptoKey): Promise<CultMeshBrowserP256PublicKey> {
+  const jwk = await crypto.subtle.exportKey("jwk", key);
+  return { keyId, x: urlBase64ToBase64(jwk.x!), y: urlBase64ToBase64(jwk.y!) };
+}
+
+function testCanonicalRoute(route: CultMeshBrowserRoute): Uint8Array {
+  const certificate = route.certificate!;
+  return testCanonical(
+    "gamecult.cultmesh.route-certificate.v1", route.verseId, route.authorityRuntimeId, route.endpoint,
+    [...route.protocolIds!].sort().join("\u001f"), String(route.priority), route.generation,
+    certificate.providerKey.keyId, certificate.providerKey.x, certificate.providerKey.y,
+    certificate.odinKeyId, String(certificate.issuedAtUnixMilliseconds), String(certificate.expiresAtUnixMilliseconds),
+  );
+}
+
+function testCanonicalSession(message: CultMeshSessionOpenMessage, endpoint: string): Uint8Array {
+  return testCanonical(
+    "gamecult.cultmesh.session-proof.v1", message.clientNonce, message.messageId, message.sourceRuntimeId,
+    message.verseId, message.authorityRuntimeId, message.protocolId, endpoint, message.routeGeneration,
+  );
+}
+
+function testCanonical(...values: string[]): Uint8Array {
+  const chunks = values.map(value => new TextEncoder().encode(value));
+  const bytes = new Uint8Array(chunks.reduce((sum, chunk) => sum + 4 + chunk.length, 0));
+  const view = new DataView(bytes.buffer);
+  let offset = 0;
+  for (const chunk of chunks) {
+    view.setUint32(offset, chunk.length, false);
+    offset += 4;
+    bytes.set(chunk, offset);
+    offset += chunk.length;
+  }
+  return bytes;
+}
+
+function toBase64(bytes: Uint8Array): string {
+  return Buffer.from(bytes).toString("base64");
+}
+
+function urlBase64ToBase64(value: string): string {
+  return Buffer.from(value, "base64url").toString("base64");
+}
+
+function bytesToBase64(bytes: Uint8Array): string {
+  let binary = "";
+  for (const byte of bytes) binary += String.fromCharCode(byte);
+  return btoa(binary);
+}
+
+function base64ToBytes(value: string): Uint8Array {
+  const binary = atob(value);
+  return Uint8Array.from(binary, character => character.charCodeAt(0));
+}
diff --git a/packages/cultmesh-browser/tsconfig.json b/packages/cultmesh-browser/tsconfig.json
new file mode 100644
index 00000000..b9b7caba
--- /dev/null
+++ b/packages/cultmesh-browser/tsconfig.json
@@ -0,0 +1,16 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "ES2022",
+    "moduleResolution": "Bundler",
+    "lib": ["ES2022", "DOM"],
+    "strict": true,
+    "declaration": true,
+    "declarationMap": true,
+    "sourceMap": true,
+    "outDir": "dist",
+    "rootDir": "src",
+    "skipLibCheck": true
+  },
+  "include": ["src/**/*.ts"]
+}
diff --git a/packages/cultmesh-browser/tsconfig.test.json b/packages/cultmesh-browser/tsconfig.test.json
new file mode 100644
index 00000000..4d148683
--- /dev/null
+++ b/packages/cultmesh-browser/tsconfig.test.json
@@ -0,0 +1,12 @@
+{
+  "extends": "./tsconfig.json",
+  "compilerOptions": {
+    "types": ["node"],
+    "declaration": false,
+    "declarationMap": false,
+    "sourceMap": false,
+    "outDir": "dist-test",
+    "rootDir": "."
+  },
+  "include": ["src/**/*.ts", "test/**/*.ts"]
+}
diff --git a/packages/cultmesh-kotlin/README.md b/packages/cultmesh-kotlin/README.md
index b25050bb..3da68679 100644
--- a/packages/cultmesh-kotlin/README.md
+++ b/packages/cultmesh-kotlin/README.md
@@ -66,11 +66,54 @@ target.applyRawSnapshotResponse(response)
 val note = target.require(notes, "note:1")
 ```
 
+When the caller wants one record as a local typed view, `syncDocument(...)`
+applies just that snapshot record and returns the requested document type. This
+is the comfortable alias path: the source can publish one Kotlin type, while
+the target registers a different Kotlin type with the same schema version.
+
+```kotlin
+val sourceNote = cultDocument(SourceNoteCodec)
+val uiNote = cultDocument(UiNoteCodec) // same schemaVersion as sourceNote
+
+source.remember(sourceNote, "note:bridge", SourceNote("kotlin.note.v1", "hello"))
+
+val response = source.createRawSnapshotResponse(
+    cultNetSnapshotRequest(
+        messageId = "sync-ui-note",
+        schemaIds = listOf(uiNote.schemaVersion),
+        recordKeys = listOf("note:bridge"),
+    ),
+)
+
+val note: UiNote = target.syncDocument(response, uiNote, "note:bridge")
+```
+
 `applyRawDocumentPut(...)`, `applyRawSnapshotResponse(...)`, and
 `applyDocumentDelete(...)` require matching codecs to be registered first, so
 raw bytes re-enter the typed cache through the same document definitions that
 local Kotlin callers use.
 
+Reactive document handles let Kotlin callers keep a typed local view and have
+CultMesh flush changed state on the debounce cadence:
+
+```kotlin
+val note = CultMesh.reactiveDocument(
+    target,
+    uiNote,
+    "note:bridge",
+    CultReactiveDocumentOptions(flushDelayMs = 16),
+)
+
+note.current.body = "local prediction"
+```
+
+For immutable document types, use `update { it.copy(...) }` or
+`setCurrent(...)`. When an authoritative raw document put arrives while local
+state is dirty, `applyRawDocumentPut(...)` records a
+`CultReactiveDocumentReconciliation` with the canonical value, predicted value,
+and a delta. Tuple-backed MessagePack codecs report delta keys by field slot,
+such as `"0"` and `"1"`.
+
 ## WebSocket Transport
 
 For browser/mobile-friendly schema lanes, `CultNetWebSocketTransportConnection`
diff --git a/packages/cultmesh-kotlin/src/main/kotlin/org/gamecult/cultmesh/CultMesh.kt b/packages/cultmesh-kotlin/src/main/kotlin/org/gamecult/cultmesh/CultMesh.kt
index 4b7bd68a..104bd1b9 100644
--- a/packages/cultmesh-kotlin/src/main/kotlin/org/gamecult/cultmesh/CultMesh.kt
+++ b/packages/cultmesh-kotlin/src/main/kotlin/org/gamecult/cultmesh/CultMesh.kt
@@ -195,6 +195,202 @@ fun <T : Any> CultCache.document(document: CultDocumentDefinition<T>, key: Strin
 fun <T : Any> CultCache.global(document: CultDocumentDefinition<T>): CultCacheDocumentHandle<T> =
     CultCacheDocumentHandle(this, document, CultCache.GLOBAL_KEY)
 
+data class CultReactiveDocumentOptions(
+    val flushDelayMs: Long = 16,
+    val detectLocalChanges: Boolean = true,
+    val replaceDirtyCurrentOnCanonicalSnapshot: Boolean = false,
+)
+
+data class CultReactiveDocumentReconciliation<T : Any>(
+    val canonical: T,
+    val predicted: T,
+    val delta: Map<String, Any?>,
+    val version: Long,
+    val receivedAt: Instant,
+)
+
+class CultReactiveDocument<T : Any>(
+    private val cache: CultCache,
+    private val document: CultDocumentDefinition<T>,
+    private val key: String,
+    private val options: CultReactiveDocumentOptions = CultReactiveDocumentOptions(),
+) : AutoCloseable {
+    private val lock = Any()
+    private val disposed = AtomicBoolean(false)
+    private var lastCleanPayload = ByteArray(0)
+    private var flushing = false
+    private var flushQueued = false
+    private var reconciliationVersion = 0L
+    private val detectWorker: Thread?
+
+    @Volatile
+    var current: T = cache.getRequired(document, key)
+        private set
+
+    @Volatile
+    var isDirty: Boolean = false
+        private set
+
+    @Volatile
+    var reconciliation: CultReactiveDocumentReconciliation<T>? = null
+        private set
+
+    @Volatile
+    var lastError: Throwable? = null
+        private set
+
+    init {
+        require(key.isNotBlank()) { "key must be non-empty" }
+        lastCleanPayload = document.codec.encode(current)
+        detectWorker = if (options.detectLocalChanges) {
+            Thread {
+                val delay = options.flushDelayMs.coerceAtLeast(1)
+                while (!disposed.get()) {
+                    try {
+                        Thread.sleep(delay)
+                        if (disposed.get()) return@Thread
+                        if (detectLocalChanges()) flush()
+                    } catch (_: InterruptedException) {
+                        if (disposed.get()) return@Thread
+                    } catch (error: Throwable) {
+                        lastError = error
+                    }
+                }
+            }.apply {
+                isDaemon = true
+                name = "cultmesh-reactive-document-${document.documentType}-$key"
+                start()
+            }
+        } else {
+            null
+        }
+    }
+
+    fun update(update: (T) -> T): T {
+        val predicted = synchronized(lock) {
+            current = update(current)
+            isDirty = true
+            current
+        }
+        if (options.flushDelayMs <= 0) flush()
+        return predicted
+    }
+
+    fun setCurrent(value: T): T {
+        synchronized(lock) {
+            current = value
+            isDirty = true
+        }
+        if (options.flushDelayMs <= 0) flush()
+        return value
+    }
+
+    fun markDirty() {
+        synchronized(lock) {
+            isDirty = true
+        }
+    }
+
+    fun refresh(): T {
+        val canonical = cache.getRequired(document, key)
+        synchronized(lock) {
+            current = canonical
+            lastCleanPayload = document.codec.encode(canonical)
+            isDirty = false
+            flushQueued = false
+            reconciliation = null
+        }
+        return canonical
+    }
+
+    fun flush() {
+        val predicted = synchronized(lock) {
+            if (!isDirty && !detectLocalChangesLocked()) return
+            if (flushing) {
+                flushQueued = true
+                return
+            }
+            flushing = true
+            isDirty = false
+            current
+        }
+        val payload = document.codec.encode(predicted)
+        cache.put(document, key, predicted)
+        val shouldFlushAgain = synchronized(lock) {
+            flushing = false
+            lastCleanPayload = payload
+            reconciliation = null
+            lastError = null
+            if (!document.codec.encode(current).contentEquals(lastCleanPayload)) {
+                isDirty = true
+            }
+            val queued = flushQueued || isDirty
+            flushQueued = false
+            queued
+        }
+        if (shouldFlushAgain) flush()
+    }
+
+    fun applyRawDocumentPut(message: CultNetMessage): T {
+        cache.applyRawDocumentPut(message)
+        return applyCanonical(cache.getRequired(document, key))
+    }
+
+    fun clearReconciliation() {
+        synchronized(lock) {
+            reconciliation = null
+        }
+    }
+
+    override fun close() {
+        disposed.set(true)
+        detectWorker?.interrupt()
+    }
+
+    private fun detectLocalChanges(): Boolean = synchronized(lock) {
+        detectLocalChangesLocked() && !flushing
+    }
+
+    private fun detectLocalChangesLocked(): Boolean {
+        if (!isDirty && !flushing && !document.codec.encode(current).contentEquals(lastCleanPayload)) {
+            isDirty = true
+        }
+        return isDirty
+    }
+
+    private fun applyCanonical(canonical: T): T {
+        synchronized(lock) {
+            if (isDirty || flushing) {
+                val predicted = current
+                val delta = reconciliationDelta(document.codec.encode(predicted), document.codec.encode(canonical))
+                reconciliation = if (delta.isEmpty()) {
+                    null
+                } else {
+                    reconciliationVersion += 1
+                    CultReactiveDocumentReconciliation(
+                        canonical = canonical,
+                        predicted = predicted,
+                        delta = delta,
+                        version = reconciliationVersion,
+                        receivedAt = Instant.now(),
+                    )
+                }
+                if (!options.replaceDirtyCurrentOnCanonicalSnapshot) return canonical
+            }
+            current = canonical
+            lastCleanPayload = document.codec.encode(canonical)
+            reconciliation = null
+            return canonical
+        }
+    }
+}
+
+fun <T : Any> CultCache.reactiveDocument(
+    document: CultDocumentDefinition<T>,
+    key: String,
+    options: CultReactiveDocumentOptions = CultReactiveDocumentOptions(),
+): CultReactiveDocument<T> = CultReactiveDocument(this, document, key, options)
+
 class StringDocumentCodec(
     override val documentType: String,
     override val schemaVersion: String,
@@ -225,6 +421,54 @@ fun bytesDocument(
     global: Boolean = false,
 ): CultDocumentDefinition<ByteArray> = cultDocument(ByteArrayDocumentCodec(documentType, schemaVersion), global)
 
+private data class KotlinCanonicalNote(
+    val schemaVersion: String,
+    val body: String,
+)
+
+private data class KotlinUiNote(
+    val schemaVersion: String,
+    val body: String,
+)
+
+private data class KotlinReactiveNote(
+    var body: String,
+    var revision: Long,
+)
+
+private class KotlinAliasNoteCodec<T : Any>(
+    override val documentType: String,
+    override val schemaVersion: String,
+    private val create: (String, String) -> T,
+    private val readSchemaVersion: (T) -> String,
+    private val readBody: (T) -> String,
+) : CultDocumentCodec<T> {
+    override fun encode(value: T): ByteArray =
+        MessagePackWriter()
+            .value(listOf(readSchemaVersion(value), readBody(value)))
+            .toByteArray()
+
+    override fun decode(payload: ByteArray): T {
+        val slots = anyList(MessagePackReader(payload).readAny())
+        return create(slots[0] as String, slots[1] as String)
+    }
+}
+
+private class KotlinReactiveNoteCodec(
+    override val documentType: String,
+    override val schemaVersion: String,
+) : CultDocumentCodec<KotlinReactiveNote> {
+    override fun encode(value: KotlinReactiveNote): ByteArray =
+        MessagePackWriter()
+            .value(listOf(value.body, value.revision))
+            .toByteArray()
+
+    override fun decode(payload: ByteArray): KotlinReactiveNote {
+        val slots = anyList(MessagePackReader(payload).readAny())
+        return KotlinReactiveNote(slots[0] as String, (slots[1] as Number).toLong())
+    }
+}
+
 class CultMeshNode(
     val cache: CultCache = CultCache(),
     private val random: SecureRandom = SecureRandom(),
@@ -270,6 +514,15 @@ class CultMeshNode(
 
     fun applyRawSnapshotResponse(response: CultNetMessage): List<Any> = cache.applyRawSnapshotResponse(response)
 
+    fun <T : Any> syncDocument(response: CultNetMessage, document: CultDocumentDefinition<T>, key: String): T =
+        cache.syncDocument(response, document, key)
+
+    fun <T : Any> reactiveDocument(
+        document: CultDocumentDefinition<T>,
+        key: String,
+        options: CultReactiveDocumentOptions = CultReactiveDocumentOptions(),
+    ): CultReactiveDocument<T> = cache.reactiveDocument(document, key, options)
+
     fun applyDocumentDelete(message: CultNetMessage): Boolean = cache.applyDocumentDelete(message)
 
     fun applyShardLogResponse(response: CultNetMessage): List<Any?> = cache.applyShardLogResponse(response)
@@ -280,6 +533,13 @@ object CultMesh {
 
     fun startNode(cache: CultCache = CultCache()): CultMeshNode = createNode(cache)
 
+    fun <T : Any> reactiveDocument(
+        node: CultMeshNode,
+        document: CultDocumentDefinition<T>,
+        key: String,
+        options: CultReactiveDocumentOptions = CultReactiveDocumentOptions(),
+    ): CultReactiveDocument<T> = node.reactiveDocument(document, key, options)
+
     fun createVerseCatalog(): CultMeshVerseCatalog = CultMeshVerseCatalog()
 
     fun createPeerCatalog(): CultMeshPeerCatalog = CultMeshPeerCatalog()
@@ -1973,6 +2233,22 @@ fun CultCache.applyRawSnapshotResponse(response: CultNetMessage): List<Any> {
         .map { applyRawDocumentRecord(it) }
 }
 
+fun <T : Any> CultCache.syncDocument(
+    response: CultNetMessage,
+    document: CultDocumentDefinition<T>,
+    key: String,
+): T {
+    require(response.schemaVersion == "cultnet.snapshot_response_raw.v0") {
+        "Expected cultnet.snapshot_response_raw.v0, received ${response.schemaVersion}"
+    }
+    val rawDocument = mapList(response.body["documents"])
+        .map { rawDocumentRecordFromWire(it) }
+        .firstOrNull { it.schemaId == document.schemaVersion && it.recordKey == key }
+        ?: throw NoSuchElementException("No ${document.schemaVersion} document for key $key")
+    applyRawDocumentRecord(rawDocument)
+    return getRequired(document, key)
+}
+
 fun CultCache.applyDocumentDelete(message: CultNetMessage): Boolean {
     require(message.schemaVersion == "cultnet.document_delete.v0") {
         "Expected cultnet.document_delete.v0, received ${message.schemaVersion}"
@@ -2208,6 +2484,39 @@ private fun mapValue(value: Any?): Map<String, Any?> {
     return map
 }
 
+private fun reconciliationDelta(predictedPayload: ByteArray, canonicalPayload: ByteArray): Map<String, Any?> {
+    val predicted = MessagePackReader(predictedPayload).readAny()
+    val canonical = MessagePackReader(canonicalPayload).readAny()
+    val delta = linkedMapOf<String, Any?>()
+    when {
+        predicted is Map<*, *> && canonical is Map<*, *> -> {
+            val canonicalMap = mapValue(canonical)
+            for ((key, predictedValue) in mapValue(predicted)) {
+                val canonicalValue = canonicalMap[key]
+                if (predictedValue == canonicalValue) continue
+                delta[key] = numericDelta(predictedValue, canonicalValue) ?: predictedValue
+            }
+        }
+        predicted is List<*> && canonical is List<*> -> {
+            predicted.forEachIndexed { index, predictedValue ->
+                val canonicalValue = canonical.getOrNull(index)
+                if (predictedValue == canonicalValue) return@forEachIndexed
+                delta[index.toString()] = numericDelta(predictedValue, canonicalValue) ?: predictedValue
+            }
+        }
+        predicted != canonical -> {
+            delta["value"] = numericDelta(predicted, canonical) ?: predicted
+        }
+    }
+    return delta
+}
+
+private fun numericDelta(predicted: Any?, canonical: Any?): Double? {
+    val predictedNumber = predicted as? Number ?: return null
+    val canonicalNumber = canonical as? Number ?: return null
+    return predictedNumber.toDouble() - canonicalNumber.toDouble()
+}
+
 private fun sha256Hex(value: String): String {
     val digest = MessageDigest.getInstance("SHA-256").digest(value.toByteArray(StandardCharsets.UTF_8))
     return digest.joinToString("") { "%02x".format(it.toInt() and 0xff) }
@@ -2278,6 +2587,7 @@ data class CultNetRudpPacket(
 data class CultNetRudpDeliveredFrame(val channelId: String, val payload: ByteArray, val sequence: Long)
 data class CultNetRudpReceiveResult(
     val delivered: List<CultNetRudpDeliveredFrame> = emptyList(),
+    val readyToSend: List<CultNetRudpPacket> = emptyList(),
     val reply: CultNetRudpPacket? = null,
     val pong: Boolean = false,
     val pongPayload: ByteArray = ByteArray(0),
@@ -2310,10 +2620,16 @@ private data class FragmentBuffer(
 )
 
 class CultNetRudpSession(options: CultNetRudpSessionOptions) {
+    companion object {
+        const val ReliableSendWindowPackets = 32
+        private const val ReceivedSequenceWindow = 4_096
+    }
+
     val connectionId: Long = uint32(options.connectionId, "connectionId")
     val resendDelayMs: Long = options.resendDelayMs
     private val maxPendingReliablePackets: Int? = options.maxPendingReliablePackets
     private var nextSequence = uint32(options.initialSequence, "initialSequence")
+    private val nextSequencedByChannel = linkedMapOf<String, Long>()
     private var nextFragmentId = 1
     var connected: Boolean = false
         private set
@@ -2321,13 +2637,19 @@ class CultNetRudpSession(options: CultNetRudpSessionOptions) {
         private set
     private var highestReceivedSequence: Long? = null
     private val receivedSequences = linkedSetOf<Long>()
+    private val latestSequencedByChannel = linkedMapOf<String, Long>()
     private val pendingReliable = linkedMapOf<Long, PendingReliablePacket>()
+    private val queuedReliable = ArrayDeque<CultNetRudpPacket>()
     private val orderedNextSequenceByChannel = linkedMapOf<String, Long>()
     private val orderedBuffers = linkedMapOf<String, TreeMap<Long, PendingOrderedFrame>>()
     private val fragmentBuffers = linkedMapOf<Pair<String, Int>, FragmentBuffer>()
 
     val pendingReliableSequences: List<Long>
         get() = pendingReliable.keys.sorted()
+    val queuedReliablePacketCount: Int
+        get() = queuedReliable.size
+    val outstandingReliablePacketCount: Int
+        get() = pendingReliable.size + queuedReliable.size
 
     init {
         if (maxPendingReliablePackets != null && maxPendingReliablePackets <= 0) {
@@ -2354,6 +2676,9 @@ class CultNetRudpSession(options: CultNetRudpSessionOptions) {
     }
 
     fun send(channelId: String, payload: ByteArray, options: CultNetRudpSendOptions = CultNetRudpSendOptions()): CultNetRudpPacket {
+        if (options.reliable && pendingReliable.size >= ReliableSendWindowPackets) {
+            throw IOException("RUDP reliable send window is full; receive acknowledgements before sending")
+        }
         return sendMany(channelId, payload, options).first()
     }
 
@@ -2364,13 +2689,14 @@ class CultNetRudpSession(options: CultNetRudpSessionOptions) {
         maxFragmentBytes: Int? = null,
     ): List<CultNetRudpPacket> {
         if (!connected) throw IOException("Cannot send RUDP data before the session is connected")
+        if (options.ordered && !options.reliable) throw IOException("RUDP ordered delivery requires reliability")
         if (maxFragmentBytes != null && maxFragmentBytes <= 0) throw IOException("RUDP maxFragmentBytes must be greater than zero")
         if (maxFragmentBytes != null && payload.size > maxFragmentBytes) {
             val fragmentCount = (payload.size + maxFragmentBytes - 1) / maxFragmentBytes
             if (fragmentCount > 0xffff) throw IOException("RUDP payload requires more than 65535 fragments")
             ensureReliableCapacity(if (options.reliable) fragmentCount else 0)
             val fragmentId = allocateFragmentId()
-            return (0 until fragmentCount).map { index ->
+            val packets = (0 until fragmentCount).map { index ->
                 val start = index * maxFragmentBytes
                 val packet = createPacket(
                     channelId = channelId,
@@ -2383,14 +2709,13 @@ class CultNetRudpSession(options: CultNetRudpSessionOptions) {
                     fragmentIndex = index,
                     fragmentCount = fragmentCount,
                 )
-                if (packet.reliable) trackReliable(packet, options.nowMs)
                 packet
             }
+            return if (options.reliable) admitReliablePackets(packets, options.nowMs) else packets
         }
         ensureReliableCapacity(if (options.reliable) 1 else 0)
         val packet = createPacket(channelId = channelId, packetType = CultNetRudpPacketType.Data, payload = payload, reliable = options.reliable, ordered = options.ordered, sequenced = options.sequenced)
-        if (packet.reliable) trackReliable(packet, options.nowMs)
-        return listOf(packet)
+        return if (packet.reliable) admitReliablePackets(listOf(packet), options.nowMs) else listOf(packet)
     }
 
     fun receive(packet: CultNetRudpPacket, nowMs: Long = 0): CultNetRudpReceiveResult {
@@ -2398,42 +2723,85 @@ class CultNetRudpSession(options: CultNetRudpSessionOptions) {
         val ignoredNow = nowMs
         requireConnection(packet)
         applyAcknowledgements(packet)
+        val readyToSend = promoteQueuedReliable(nowMs)
         lastReceivedAtMs = nowMs
         val expectedSequenceIfUninitialized = (highestReceivedSequence ?: (packet.sequence - 1)) + 1
         when (packet.packetType) {
             CultNetRudpPacketType.Accept -> {
                 rememberReceived(packet.sequence)
                 connected = true
-                return CultNetRudpReceiveResult()
+                return CultNetRudpReceiveResult(readyToSend = readyToSend)
             }
             CultNetRudpPacketType.Ping -> {
-                rememberReceived(packet.sequence)
-                return CultNetRudpReceiveResult(reply = createPacket(CultNetRudpPacketType.Pong, "control", packet.payload))
+                return CultNetRudpReceiveResult(readyToSend = readyToSend, reply = createPacket(CultNetRudpPacketType.Pong, "control", packet.payload))
             }
             CultNetRudpPacketType.Ack, CultNetRudpPacketType.Pong -> {
-                rememberReceived(packet.sequence)
                 return CultNetRudpReceiveResult(
+                    readyToSend = readyToSend,
                     pong = packet.packetType == CultNetRudpPacketType.Pong,
                     pongPayload = if (packet.packetType == CultNetRudpPacketType.Pong) packet.payload.copyOf() else ByteArray(0),
                 )
             }
             CultNetRudpPacketType.Disconnect -> {
-                rememberReceived(packet.sequence)
                 connected = false
-                return CultNetRudpReceiveResult(disconnected = true, disconnectReason = packet.payload.copyOf())
+                return CultNetRudpReceiveResult(readyToSend = readyToSend, disconnected = true, disconnectReason = packet.payload.copyOf())
             }
             CultNetRudpPacketType.Data -> Unit
-            else -> return CultNetRudpReceiveResult()
+            else -> return CultNetRudpReceiveResult(readyToSend = readyToSend)
         }
 
-        val duplicate = receivedSequences.contains(packet.sequence)
-        rememberReceived(packet.sequence)
-        if (duplicate) return CultNetRudpReceiveResult()
-        val reassembled = reassemble(packet) ?: return CultNetRudpReceiveResult()
-        return CultNetRudpReceiveResult(delivered = if (reassembled.ordered) deliverOrdered(reassembled.frame, reassembled.nextSequence, expectedSequenceIfUninitialized) else listOf(reassembled.frame))
+        val duplicate = packet.reliable && (receivedSequences.contains(packet.sequence) || (
+            highestReceivedSequence != null &&
+                packet.sequence < highestReceivedSequence!! &&
+                highestReceivedSequence!! - packet.sequence >= ReceivedSequenceWindow.toLong()
+            ))
+        if (packet.reliable) rememberReceived(packet.sequence)
+        if (duplicate) return CultNetRudpReceiveResult(readyToSend = readyToSend)
+        val reassembled = reassemble(packet) ?: return CultNetRudpReceiveResult(readyToSend = readyToSend)
+        if (!reassembled.ordered && packet.sequenced) {
+            val newestSequence = reassembled.nextSequence - 1
+            val latestSequence = latestSequencedByChannel[reassembled.frame.channelId]
+            if (latestSequence != null && newestSequence <= latestSequence) {
+                return CultNetRudpReceiveResult(readyToSend = readyToSend)
+            }
+            latestSequencedByChannel[reassembled.frame.channelId] = newestSequence
+        }
+        return CultNetRudpReceiveResult(
+            delivered = if (reassembled.ordered) deliverOrdered(reassembled.frame, reassembled.nextSequence, expectedSequenceIfUninitialized) else listOf(reassembled.frame),
+            readyToSend = readyToSend,
+        )
     }
 
-    fun createAck(): CultNetRudpPacket = createPacket(CultNetRudpPacketType.Ack, "control", ByteArray(0))
+    fun createAck(): CultNetRudpPacket {
+        val (ack, ackMask) = ackState()
+        return CultNetRudpPacket(
+            packetType = CultNetRudpPacketType.Ack,
+            connectionId = connectionId,
+            sequence = 0,
+            ack = ack,
+            ackMask = ackMask,
+            channelId = "control",
+        )
+    }
+
+    fun createAckFor(sequence: Long): CultNetRudpPacket = CultNetRudpPacket(
+        packetType = CultNetRudpPacketType.Ack,
+        connectionId = connectionId,
+        sequence = 0,
+        ack = uint32(sequence, "ack sequence"),
+        ackMask = 0,
+        channelId = "control",
+    )
+
+    fun createAckForReceived(sequence: Long): CultNetRudpPacket {
+        val receivedSequence = uint32(sequence, "received sequence")
+        val (ack, _) = ackState()
+        return if (ack >= receivedSequence && ack - receivedSequence <= 32L) {
+            createAck()
+        } else {
+            createAckFor(receivedSequence)
+        }
+    }
 
     fun createPing(payload: ByteArray = ByteArray(0)): CultNetRudpPacket =
         createPacket(CultNetRudpPacketType.Ping, "control", payload)
@@ -2468,8 +2836,15 @@ class CultNetRudpSession(options: CultNetRudpSessionOptions) {
         fragmentIndex: Int = 0,
         fragmentCount: Int = 0,
     ): CultNetRudpPacket {
-        val sequence = nextSequence
-        nextSequence = uint32(nextSequence + 1, "sequence")
+        val sequence = when {
+            reliable -> nextSequence.also {
+                nextSequence = uint32(nextSequence + 1, "reliable sequence")
+            }
+            sequenced -> (nextSequencedByChannel[channelId] ?: 1).also {
+                nextSequencedByChannel[channelId] = uint32(it + 1, "sequenced channel sequence")
+            }
+            else -> 0
+        }
         val (ack, ackMask) = ackState()
         return CultNetRudpPacket(packetType, connectionId, sequence, ack, ackMask, channelId, reliable, ordered, sequenced, fragmentId, fragmentIndex, fragmentCount, payload.copyOf())
     }
@@ -2478,9 +2853,28 @@ class CultNetRudpSession(options: CultNetRudpSessionOptions) {
         pendingReliable[packet.sequence] = PendingReliablePacket(packet.copy(payload = packet.payload.copyOf()), nowMs)
     }
 
+    private fun admitReliablePackets(packets: List<CultNetRudpPacket>, nowMs: Long): List<CultNetRudpPacket> {
+        val available = maxOf(0, ReliableSendWindowPackets - pendingReliable.size)
+        val ready = packets.take(available)
+        ready.forEach { trackReliable(it, nowMs) }
+        packets.drop(available).forEach { queuedReliable.addLast(it.copy(payload = it.payload.copyOf())) }
+        return ready
+    }
+
+    private fun promoteQueuedReliable(nowMs: Long): List<CultNetRudpPacket> {
+        val available = maxOf(0, ReliableSendWindowPackets - pendingReliable.size)
+        val ready = mutableListOf<CultNetRudpPacket>()
+        while (ready.size < available && !queuedReliable.isEmpty()) {
+            val packet = queuedReliable.removeFirst()
+            trackReliable(packet, nowMs)
+            ready.add(packet)
+        }
+        return ready
+    }
+
     private fun ensureReliableCapacity(packetCount: Int) {
         if (packetCount == 0 || maxPendingReliablePackets == null) return
-        if (pendingReliable.size + packetCount > maxPendingReliablePackets) {
+        if (outstandingReliablePacketCount + packetCount > maxPendingReliablePackets) {
             throw IOException("RUDP reliable send queue is full")
         }
     }
@@ -2497,6 +2891,10 @@ class CultNetRudpSession(options: CultNetRudpSessionOptions) {
     private fun rememberReceived(sequence: Long) {
         receivedSequences.add(sequence)
         if (highestReceivedSequence == null || sequence > highestReceivedSequence!!) highestReceivedSequence = sequence
+        if (receivedSequences.size > ReceivedSequenceWindow) {
+            val keepFrom = maxOf(0L, (highestReceivedSequence ?: sequence) - ReceivedSequenceWindow.toLong() + 1)
+            receivedSequences.removeIf { it < keepFrom }
+        }
     }
 
     private fun ackState(): Pair<Long, Long> {
@@ -2701,6 +3099,7 @@ class CultNetRudpSocketTransportConnection(
         maxPendingReliablePackets = maxPendingReliablePackets,
     )
     val connected: Boolean get() = session.connected
+    val outstandingReliablePacketCount: Int get() = session.outstandingReliablePacketCount
     val localPort: Int get() = socket.localPort
     override val stats: CultNetTransportStats get() = CultNetTransportStats(bytesReceived, bytesSent, framesReceived, framesSent)
 
@@ -2784,6 +3183,27 @@ class CultNetRudpSocketTransportConnection(
     override fun receiveSchemaMessage(timeoutMs: Long, pollIntervalMs: Long): CultNetMessage? =
         receiveSchema(timeoutMs, pollIntervalMs)?.let { parseCultNetMessage(it) }
 
+    fun flushReliable(timeoutMs: Long = 30_000, pollIntervalMs: Long = 5) {
+        val deadline = System.nanoTime() + timeoutMs.coerceAtLeast(0) * 1_000_000L
+        val preserved = ArrayDeque<CultNetTransportFrame>()
+        while (!delivered.isEmpty()) preserved.addLast(delivered.removeFirst())
+        try {
+            while (session.outstandingReliablePacketCount > 0) {
+                if (System.nanoTime() >= deadline) {
+                    throw SocketTimeoutException(
+                        "RUDP reliable flush timed out with ${session.outstandingReliablePacketCount} packets outstanding"
+                    )
+                }
+                receiveOnce()?.let { preserved.addLast(it) }
+                pollResends()
+                Thread.sleep(pollIntervalMs)
+            }
+        } finally {
+            while (!delivered.isEmpty()) preserved.addLast(delivered.removeFirst())
+            while (!preserved.isEmpty()) delivered.addLast(preserved.removeFirst())
+        }
+    }
+
     fun receiveOnce(): CultNetTransportFrame? {
         if (!delivered.isEmpty()) return delivered.removeFirst()
         val buffer = ByteArray(65535)
@@ -2807,6 +3227,7 @@ class CultNetRudpSocketTransportConnection(
         }
         val result = session.receive(packet, nowMs())
         result.reply?.let { sendPacket(it) }
+        result.readyToSend.forEach { sendPacket(it) }
         if (result.pong) {
             pongPayloads.add(result.pongPayload.copyOf())
         }
@@ -2819,7 +3240,9 @@ class CultNetRudpSocketTransportConnection(
             framesReceived += 1
         }
         val frame = if (delivered.isEmpty()) null else delivered.removeFirst()
-        if (packet.packetType == CultNetRudpPacketType.Accept || frame != null) sendPacket(session.createAck())
+        if (packet.reliable || packet.packetType == CultNetRudpPacketType.Accept || frame != null) {
+            sendPacket(session.createAckForReceived(packet.sequence))
+        }
         return frame
     }
 
@@ -2943,6 +3366,7 @@ fun main(args: Array<String>) {
         rudpSessionPingsAndDetectsReceiveTimeout()
         rudpSessionBoundsPendingReliablePacketsBeforeEnqueue()
         rudpSessionFragmentsAndReassemblesReliableOrderedPayloads()
+        rudpSessionAdvancesLargeFragmentSetsThroughBoundedReliableWindow()
         rudpSocketTransportErgonomicFactoriesCarrySchemaFrames()
         rudpSocketTransportHandshakesAndCarriesReliableOrderedSchemaFrames()
         rudpSocketTransportCarriesFragmentedReliableOrderedSchemaFrames()
@@ -3085,6 +3509,98 @@ private fun cultCacheRawSnapshotsRoundTripThroughCultNetMessages() {
     check(target.require(notes, "note:2") == "second")
     check(target.recallGlobal(settings) == null)
 
+    val canonicalNote = cultDocument(KotlinAliasNoteCodec(
+        documentType = "kotlin.alias_note",
+        schemaVersion = "kotlin.alias_note.v1",
+        create = ::KotlinCanonicalNote,
+        readSchemaVersion = KotlinCanonicalNote::schemaVersion,
+        readBody = KotlinCanonicalNote::body,
+    ))
+    val uiNote = cultDocument(KotlinAliasNoteCodec(
+        documentType = "kotlin.alias_note.ui",
+        schemaVersion = "kotlin.alias_note.v1",
+        create = ::KotlinUiNote,
+        readSchemaVersion = KotlinUiNote::schemaVersion,
+        readBody = KotlinUiNote::body,
+    ))
+    source.cache.register(canonicalNote)
+    target.cache.register(uiNote)
+    source.remember(canonicalNote, "note:alias", KotlinCanonicalNote("kotlin.alias_note.v1", "canonical-to-ui"))
+    val aliasSnapshotResponse = source.createRawSnapshotResponse(
+        cultNetSnapshotRequest(
+            messageId = "snapshot-alias-note",
+            schemaIds = listOf(uiNote.schemaVersion),
+            recordKeys = listOf("note:alias"),
+        ),
+        storedAt = "2026-06-15T00:00:02Z",
+        sourceRuntimeId = "kotlin-source",
+    )
+    val syncedAlias = target.syncDocument(aliasSnapshotResponse, uiNote, "note:alias")
+    check(syncedAlias == KotlinUiNote("kotlin.alias_note.v1", "canonical-to-ui"))
+    check(target.require(uiNote, "note:alias") == syncedAlias)
+
+    val reactiveUiNote = cultDocument(KotlinReactiveNoteCodec(
+        documentType = "kotlin.reactive_note.ui",
+        schemaVersion = "kotlin.reactive_note.v1",
+    ))
+    target.cache.register(reactiveUiNote)
+    target.remember(reactiveUiNote, "note:reactive", KotlinReactiveNote("initial", 1))
+    CultMesh.reactiveDocument(
+        target,
+        reactiveUiNote,
+        "note:reactive",
+        CultReactiveDocumentOptions(flushDelayMs = 5),
+    ).use { reactive ->
+        reactive.current.body = "first-local-edit"
+        reactive.current.body = "second-local-edit"
+        reactive.current.revision = 2
+        val deadline = System.nanoTime() + 500_000_000L
+        while (System.nanoTime() < deadline && target.require(reactiveUiNote, "note:reactive").body != "second-local-edit") {
+            Thread.sleep(5)
+        }
+        check(target.require(reactiveUiNote, "note:reactive") == KotlinReactiveNote("second-local-edit", 2))
+        check(!reactive.isDirty)
+        check(reactive.lastError == null)
+    }
+
+    val reactiveCanonicalNote = cultDocument(KotlinReactiveNoteCodec(
+        documentType = "kotlin.reactive_note",
+        schemaVersion = "kotlin.reactive_note.v1",
+    ))
+    target.cache.register(reactiveCanonicalNote)
+    target.remember(reactiveCanonicalNote, "note:reconcile", KotlinReactiveNote("initial", 1))
+    target.reactiveDocument(
+        reactiveCanonicalNote,
+        "note:reconcile",
+        CultReactiveDocumentOptions(flushDelayMs = 60_000, detectLocalChanges = false),
+    ).use { reactive ->
+        reactive.update {
+            it.body = "local-prediction"
+            it.revision = 2
+            it
+        }
+        val authoritative = cultNetDocumentPutRaw(
+            messageId = "put-authoritative-note",
+            document = CultNetRawDocumentRecord(
+                schemaId = reactiveCanonicalNote.schemaVersion,
+                recordKey = "note:reconcile",
+                storedAt = "2026-06-15T00:00:03Z",
+                payload = reactiveCanonicalNote.codec.encode(KotlinReactiveNote("authoritative", 7)),
+                sourceRuntimeId = "kotlin-authority",
+            ),
+        )
+        reactive.applyRawDocumentPut(authoritative)
+        check(reactive.current == KotlinReactiveNote("local-prediction", 2))
+        val reconciliation = reactive.reconciliation ?: error("Expected Kotlin reactive reconciliation")
+        check(reconciliation.canonical == KotlinReactiveNote("authoritative", 7))
+        check(reconciliation.predicted == KotlinReactiveNote("local-prediction", 2))
+        check(reconciliation.delta["0"] == "local-prediction")
+        check(reconciliation.delta["1"] == -5.0)
+        reactive.flush()
+        check(target.require(reactiveCanonicalNote, "note:reconcile") == KotlinReactiveNote("local-prediction", 2))
+        check(reactive.reconciliation == null)
+    }
+
     val rawPut = parseCultNetMessage(
         cultNetDocumentPutRaw(
             messageId = "put-note",
@@ -3492,7 +4008,10 @@ private fun startInteropRudpServer(
                 }
                 val result = session.receive(packet, nowMs())
                 result.reply?.let { sendInteropRudpPacket(socket, remote, it) }
-                if (packet.packetType == CultNetRudpPacketType.Data) sendInteropRudpPacket(socket, remote, session.createAck())
+                result.readyToSend.forEach { sendInteropRudpPacket(socket, remote, it) }
+                if (packet.reliable || packet.packetType == CultNetRudpPacketType.Data) {
+                    sendInteropRudpPacket(socket, remote, session.createAckForReceived(packet.sequence))
+                }
                 for (frame in result.delivered) {
                     if (frame.channelId != "schema") continue
                     val sender = InteropRudpSessionSender(socket, remote, session)
@@ -4822,6 +5341,43 @@ private fun rudpSessionFragmentsAndReassemblesReliableOrderedPayloads() {
     check(delivered.first().sequence == packets.first().sequence)
 }
 
+private fun rudpSessionAdvancesLargeFragmentSetsThroughBoundedReliableWindow() {
+    val connectionId = 457L
+    val sender = CultNetRudpSession(CultNetRudpSessionOptions(connectionId = connectionId, initialSequence = 1))
+    val receiver = CultNetRudpSession(CultNetRudpSessionOptions(connectionId = connectionId, initialSequence = 100))
+    sender.receive(CultNetRudpPacket(CultNetRudpPacketType.Accept, connectionId, 0, 0, 0, "control"))
+    receiver.receive(CultNetRudpPacket(CultNetRudpPacketType.Accept, connectionId, 0, 0, 0, "control"))
+
+    val fragmentCount = CultNetRudpSession.ReliableSendWindowPackets + 17
+    val payload = ByteArray(fragmentCount * 8) { index -> (index % 251).toByte() }
+    val wire = ArrayDeque(sender.sendMany(
+        "schema",
+        payload,
+        CultNetRudpSendOptions(reliable = true, ordered = true, nowMs = 1),
+        maxFragmentBytes = 8,
+    ))
+    check(wire.size == CultNetRudpSession.ReliableSendWindowPackets)
+    val oldestSequence = wire.first().sequence
+    check(sender.pendingReliableSequences.size == wire.size)
+    check(sender.queuedReliablePacketCount == 17)
+
+    val delivered = mutableListOf<CultNetRudpDeliveredFrame>()
+    while (!wire.isEmpty()) {
+        val admitted = wire.size
+        repeat(admitted) {
+            delivered.addAll(receiver.receive(wire.removeFirst(), 2).delivered)
+        }
+        val acknowledged = sender.receive(receiver.createAck(), 3)
+        acknowledged.readyToSend.forEach { wire.addLast(it) }
+    }
+    check(sender.outstandingReliablePacketCount == 0)
+    check(delivered.size == 1)
+    check(delivered.first().payload.contentEquals(payload))
+    val oldAck = receiver.createAckForReceived(oldestSequence)
+    check(oldAck.ack == oldestSequence)
+    check(oldAck.ackMask == 0L)
+}
+
 private fun rudpSocketTransportErgonomicFactoriesCarrySchemaFrames() {
     val connectionId = 0x10203042L
     CultMesh.createRudpServer(
diff --git a/packages/cultmesh-py/README.md b/packages/cultmesh-py/README.md
new file mode 100644
index 00000000..63799e52
--- /dev/null
+++ b/packages/cultmesh-py/README.md
@@ -0,0 +1,252 @@
+# cultmesh-py
+
+`cultmesh-py` is the Python CultMesh runtime: a cache-backed local node,
+reactive and observed documents, the branded `CultMesh` facade, Verse and peer
+discovery clients, snapshot and observation fan-out, peer health monitoring,
+game sessions with prediction reconciliation, committed simulation facts, the
+local TCP/RUDP server, and a package daemon.
+
+It depends on `cultcache-py` and `cultnet-py`, mirroring `cultmesh-rs` and
+`cultmesh-ts`. The Verse catalog, peer exchange, authority lease, stream
+negotiation, and simulation fact contracts are defined in
+`cultnet_py.cultmesh_contracts` and re-exported here.
+
+This is the package a Python process embeds to serve a Verse — the Brokkr
+Blender add-on serves its editor mirror through `CultMesh.serve_node(...)`
+from inside Blender's own interpreter.
+
+## Example
+
+```python
+from datetime import UTC, datetime, timedelta
+
+from cultcache_py import define_database_entry_type
+from cultnet_py import (
+    CultNetClientAuthorityScope,
+    CultNetFileShardReplicaCursorStore,
+    CultNetRawClient,
+    CultNetSchemaShardLogFetcher,
+    CultNetSchemaShardSnapshotFetcher,
+    CultNetShardDescriptor,
+    CultNetShardReplicator,
+    CultNetShardReplicatorOptions,
+)
+from cultmesh_py import (
+    CultMesh,
+    CultMeshAuthorityLease,
+    CultMeshGameSessionOptions,
+    CultMeshHmacAuthorityLeaseVerifier,
+    CultMeshNodeOptions,
+    CultMeshSnapshotFanout,
+    peer_exchange_request,
+)
+
+note_doc = define_database_entry_type(
+    "mesh.note",
+    [("body", 0), ("name", 1), ("kind", 2)],
+    name="name",
+    indexes={"kind": "kind"},
+)
+node = CultMesh.start_node(
+    "mesh.cc",
+    runtime_id="python-runtime",
+    options=CultMeshNodeOptions(enable_durable_shard_logs=True),
+)
+node.database.register_document(note_doc)
+unsubscribe = node.database.watch_record(note_doc, "note:1", lambda change: print(change.change_kind))
+unsubscribe_named = node.database.watch_by_name(note_doc, "intro", lambda change: print(change.record_key))
+unsubscribe_kind = node.database.watch_by_index(note_doc, "kind", "guide", lambda change: print(change.record_key))
+node.database.put(note_doc, "note:1", {"body": "hello", "name": "intro", "kind": "guide"})
+live_note = node.database.get_required(note_doc, "note:1")
+put_message = node.database.put_raw_message(
+    note_doc,
+    "note:2",
+    {"body": "wire me", "name": "wire", "kind": "interop"},
+    shard_id="interop",
+    shard_epoch=1,
+)
+snapshot_response = node.database.build_snapshot_response(schema_ids=[note_doc.catalog_entry().schema_id])
+snapshot_wire = node.database.create_snapshot_response(schema_ids=[note_doc.catalog_entry().schema_id])
+delete_message = node.database.delete_raw_message(note_doc, "note:2", shard_id="interop", shard_epoch=1)
+shard_log_response = node.database.build_shard_log_response(shard_id="interop", shard_epoch=1)
+shard_log_wire = node.database.create_shard_log_response(shard_id="interop", shard_epoch=1)
+
+station_stock_doc = define_database_entry_type(
+    "aetheria.station_stock",
+    [("missiles", 0), ("coolant", 1)],
+    schema_id="gamecult.aetheria.station_stock.v1",
+)
+station_stock_ui_doc = define_database_entry_type(
+    "aetheria.station_stock.ui",
+    [("missiles", 0), ("coolant", 1)],
+    schema_id="gamecult.aetheria.station_stock.v1",
+)
+node.database.register_document(station_stock_doc)
+node.database.put(station_stock_ui_doc, "station:starbridge:stock", {"missiles": 24, "coolant": 80})
+stock = node.database.get_required(station_stock_ui_doc, "station:starbridge:stock")
+
+peers = CultMesh.create_peer_catalog()
+response = peers.create_response(peer_exchange_request("pex-1", verse_id="local"))
+lease_verifier = CultMeshHmacAuthorityLeaseVerifier({"odin": b"shared-lease-key"})
+lease_catalog = CultMesh.create_authority_lease_catalog(
+    signature_verifier=lease_verifier.verify,
+    require_verified_signatures=True,
+)
+lease_valid_from = datetime.now(UTC)
+lease = lease_verifier.issue(CultMeshAuthorityLease(
+    lease_id="lease:python-runtime",
+    verse_id="local",
+    peer_id="python-runtime",
+    roles=("shard-primary",),
+    valid_from=lease_valid_from,
+    expires_at=lease_valid_from + timedelta(minutes=5),
+    shard_ids=("interop",),
+    issuer_runtime_id="odin",
+))
+lease_catalog.upsert(lease)
+session = CultMesh.create_game_session(
+    node,
+    CultMeshGameSessionOptions(
+        client_authority_scopes=(
+            CultNetClientAuthorityScope("python-runtime", schema_ids=(note_doc.catalog_entry().schema_id,), key_prefix="input:python"),
+        ),
+    ),
+)
+server = CultMesh.serve_node(
+    node,
+    peer_catalog=peers,
+    observation_hub=session.observation_hub,
+    port=3075,
+    max_snapshot_documents=1000,
+    max_snapshot_bytes=4 * 1024 * 1024,
+)
+```
+
+The same local server can be launched as a package daemon when another runtime
+or operator process needs a CultNet endpoint without embedding Python glue:
+
+```powershell
+python -m cultmesh_py.daemon --runtime-id python-runtime --display-name "Python Runtime" --host 127.0.0.1 --port 3075 --cache-file mesh.cc --enable-durable-shard-logs --seed-interop-note --seed-shard-id interop --verse-id local --role shard-primary --ready-file mesh.ready.json
+```
+
+The ready file and stdout line are process readiness hints. The served state and
+capability truth still live on the framed CultNet/CultMesh endpoint. Use
+`--register-interop-note` to expose the package interop-note schema without
+seeding a note, or `--seed-interop-note` to register it and publish one local
+record for wire probes. Seeded records are committed through the raw mutation
+path, so peers can read them through both snapshot and shard-log catch-up. Add
+`--verse-id` and one or more `--role` values to publish the launched endpoint in
+its own Verse and peer catalogs for discovery clients. When the daemon is
+launched with `--cache-file`, `--enable-durable-shard-logs`, and
+`--shard-log-file`, a later daemon process can rehydrate and serve the persisted
+snapshot and shard log without reseeding.
+
+`CultMeshPeerHealthMonitor` probes peer-card endpoints with `cultnet.hello.v0`
+and preserves the runtime id, display name, document types, message versions,
+and mutation contracts reported by the peer.
+
+```python
+client = CultMesh.create_verse_discovery_client("127.0.0.1", 3075)
+verses = client.fetch_verses(transport_version="cultmesh.v0")
+mesh_peers = client.fetch_peers(verse_id="python-interop", roles=["read-replica"])
+client.sync_peer_catalog(peers, verse_id="python-interop", roles=["read-replica"])
+client.fanout_peer_catalog(peers, verse_id="python-interop", roles=["read-replica"])
+replica_notes = client.sync_documents(
+    node.database,
+    peers,
+    verse_id="python-interop",
+    roles=["read-replica"],
+    documents=[(note_doc, "note:remote")],
+)
+snapshot_fanout = CultMeshSnapshotFanout(
+    client,
+    node.database,
+    peers,
+    verse_id="python-interop",
+    roles=["read-replica"],
+    documents=[(note_doc, "note:remote")],
+    on_document=lambda note: print(note),
+)
+snapshot_fanout.sync_once()
+
+raw_client = CultNetRawClient("127.0.0.1", 3075)
+synced_note = node.database.sync_document(raw_client, note_doc, "note:remote")
+synced_stock = CultMesh.sync_document(
+    node,
+    raw_client,
+    station_stock_ui_doc,
+    "station:starbridge:stock",
+)
+with CultMesh.subscribe_document(
+    node,
+    raw_client,
+    station_stock_ui_doc,
+    "station:starbridge:stock",
+) as stock_subscription:
+    stock = stock_subscription.sync_initial()
+    next_change = stock_subscription.read_next_change()
+node.database.sync_shard_log(raw_client, shard_id="interop", shard_epoch=1)
+replicator = CultNetShardReplicator(
+    node.database,
+    CultNetShardReplicatorOptions(
+        fetcher=CultNetSchemaShardLogFetcher(),
+        snapshot_fetcher=CultNetSchemaShardSnapshotFetcher(),
+        cursor_store=CultNetFileShardReplicaCursorStore("mesh.replica-cursors.msgpack"),
+        poll_interval_seconds=1.0,
+        on_error=lambda error: print(error),
+    ),
+)
+replica_shard = CultNetShardDescriptor(
+    shard_id="interop",
+    owner_runtime_id="primary-runtime",
+    epoch=1,
+    schema_ids=(note_doc.catalog_entry().schema_id,),
+    primary_endpoints=("cultnet://127.0.0.1:3075",),
+)
+replicator.pull_once(replica_shard)
+replicator.start([replica_shard])
+replicator.stop()
+server.stop()
+
+streams = CultMesh.create_stream_catalog()
+
+facts = CultMesh.create_simulation_fact_committer(node)
+committed = facts.commit({
+    "shardId": "arena",
+    "shardEpoch": 4,
+    "frame": 100,
+    "subjectId": "bob",
+    "claimKind": "hit",
+    "claimHash": "accepted-claim-hash",
+    "witnessCount": 2,
+    "supportWeight": 2.0,
+    "totalWeight": 2.0,
+    "confidence": 1.0,
+    "hasQuorum": True,
+})
+prediction = session.predict(note_doc, "input:python:move", {"body": "predicted input"})
+unsubscribe()
+```
+
+## Verify
+
+`cultmesh_py.verify` checks the public exports and `py.typed` markers of all
+three Python packages, smokes a local node over the wire, checks the served
+capability truth, and runs the benchmark for sanity:
+
+```powershell
+python -m cultmesh_py.verify --json
+```
+
+## Tests
+
+```powershell
+$env:PYTHONPATH="$PWD\packages\cultcache-py\src;$PWD\packages\cultnet-py\src;$PWD\packages\cultmesh-py\src"
+python -m unittest discover -s packages\cultmesh-py\tests
+```
+
+`packages\cultnet-ts\test\interop\cultnet-interop.test.ts` verifies the public
+`CultMeshDiscoveryClient` can fetch typed Verse and peer descriptors from the
+live Python peer. See
+[docs/python-runtime-parity.md](../../docs/python-runtime-parity.md) for the
+evidence map across the three Python packages.
diff --git a/packages/cultmesh-py/pyproject.toml b/packages/cultmesh-py/pyproject.toml
new file mode 100644
index 00000000..a1df5ee3
--- /dev/null
+++ b/packages/cultmesh-py/pyproject.toml
@@ -0,0 +1,28 @@
+[build-system]
+requires = ["setuptools>=68"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "cultmesh-py"
+version = "0.1.0"
+description = "Python CultMesh node, discovery, sessions, and local server for GameCult typed state."
+readme = "README.md"
+requires-python = ">=3.10"
+license = "MIT"
+authors = [{ name = "GameCult" }]
+classifiers = [
+  "Programming Language :: Python :: 3",
+  "Programming Language :: Python :: 3.10",
+  "Programming Language :: Python :: 3.11",
+  "Programming Language :: Python :: 3.12",
+]
+dependencies = ["cultcache-py>=0.2.0", "cultnet-py>=0.1.0"]
+[project.scripts]
+cultmesh-py-daemon = "cultmesh_py.daemon:main"
+cultmesh-py-verify = "cultmesh_py.verify:main"
+
+[tool.setuptools.packages.find]
+where = ["src"]
+
+[tool.setuptools.package-data]
+cultmesh_py = ["py.typed"]
diff --git a/packages/cultcache-py/src/cultmesh_py/__init__.py b/packages/cultmesh-py/src/cultmesh_py/__init__.py
similarity index 79%
rename from packages/cultcache-py/src/cultmesh_py/__init__.py
rename to packages/cultmesh-py/src/cultmesh_py/__init__.py
index 72f649ba..af4da272 100644
--- a/packages/cultcache-py/src/cultmesh_py/__init__.py
+++ b/packages/cultmesh-py/src/cultmesh_py/__init__.py
@@ -1,5 +1,6 @@
 from .client import (
     CultMeshDiscoveryClient,
+    CultMeshDocumentSubscription,
     CultMeshPeerExchangeClient,
     CultMeshPeerHealth,
     CultMeshPeerHealthMonitor,
@@ -9,7 +10,20 @@ from .client import (
 )
 from .daemon import READY_SCHEMA_VERSION, daemon_ready_document
 from .facade import CultMesh, CultMeshRudpEndpoint
-from .node import CultMeshDatabase, CultMeshDatabaseChange, CultMeshNode, CultMeshNodeOptions, create_node
+from .node import (
+    CultMeshDatabase,
+    CultMeshDatabaseChange,
+    CultMeshDocumentPublicationSource,
+    CultMeshDocumentWriter,
+    CultMeshNode,
+    CultMeshNodeOptions,
+    CultMeshObservedDocument,
+    CultMeshPublicationDocumentBinding,
+    CultMeshReactiveDocument,
+    CultMeshReactiveDocumentOptions,
+    CultMeshReactiveDocumentReconciliation,
+    create_node,
+)
 from .server import CultMeshLocalServer
 from .session import (
     CultMeshGameSession,
@@ -25,7 +39,7 @@ from .simulation import (
     CultMeshSimulationFactCommitter,
     simulation_fact_document,
 )
-from .wire import (
+from cultnet_py.cultmesh_contracts import (
     PEER_EXCHANGE_REQUEST,
     PEER_EXCHANGE_RESPONSE,
     VERSE_CATALOG_REQUEST,
@@ -55,7 +69,14 @@ __all__ = [
     "CultMeshNodeOptions",
     "CultMeshDatabase",
     "CultMeshDatabaseChange",
+    "CultMeshDocumentPublicationSource",
+    "CultMeshDocumentWriter",
     "CultMesh",
+    "CultMeshPublicationDocumentBinding",
+    "CultMeshObservedDocument",
+    "CultMeshReactiveDocument",
+    "CultMeshReactiveDocumentOptions",
+    "CultMeshReactiveDocumentReconciliation",
     "CultMeshGameSession",
     "CultMeshGameSessionOptions",
     "CultMeshLocalServer",
@@ -72,6 +93,7 @@ __all__ = [
     "CultMeshHmacAuthorityLeaseVerifier",
     "AuthorityLeaseVerifier",
     "CultMeshDiscoveryClient",
+    "CultMeshDocumentSubscription",
     "CultMeshPeerExchangeClient",
     "CultMeshPeerHealth",
     "CultMeshPeerHealthMonitor",
diff --git a/packages/cultcache-py/src/cultmesh_py/client.py b/packages/cultmesh-py/src/cultmesh_py/client.py
similarity index 78%
rename from packages/cultcache-py/src/cultmesh_py/client.py
rename to packages/cultmesh-py/src/cultmesh_py/client.py
index 89a9b442..2e1c3ab1 100644
--- a/packages/cultcache-py/src/cultmesh_py/client.py
+++ b/packages/cultmesh-py/src/cultmesh_py/client.py
@@ -6,9 +6,10 @@ from datetime import UTC, datetime
 from typing import Any, Callable
 from urllib.parse import urlparse
 
-from cultnet_py import CultNetRawClient, CultNetRawSnapshotResponse, hello
+from cultcache_py.documents import DocumentDefinition
+from cultnet_py import CultNetDatabaseSubscription, CultNetRawClient, CultNetRawSnapshotResponse, hello
 
-from .wire import (
+from cultnet_py.cultmesh_contracts import (
     PEER_EXCHANGE_RESPONSE,
     VERSE_CATALOG_RESPONSE,
     CultMeshPeerCard,
@@ -279,6 +280,61 @@ class CultMeshDiscoveryClient:
             applied.extend(database.apply_snapshot_response(response))
         return applied
 
+    def sync_documents(
+        self,
+        database: Any,
+        catalog: CultMeshPeerCatalog,
+        *,
+        verse_id: str,
+        documents: list[tuple[DocumentDefinition[Any], str]],
+        roles: list[str] | None = None,
+        shard_id: str | None = None,
+        shard_epoch: int | None = None,
+        on_error: Callable[[str, Exception], None] | None = None,
+    ) -> list[Any]:
+        if not documents:
+            return []
+        schema_ids = _distinct_non_empty([
+            document.catalog_entry().schema_id
+            for document, _key in documents
+        ])
+        record_keys = _distinct_non_empty([key for _document, key in documents])
+        self.sync_snapshots(
+            database,
+            catalog,
+            verse_id=verse_id,
+            roles=roles,
+            schema_ids=schema_ids,
+            record_keys=record_keys,
+            shard_id=shard_id,
+            shard_epoch=shard_epoch,
+            on_error=on_error,
+        )
+        return [
+            database.get_required(document, key)
+            for document, key in documents
+        ]
+
+    def subscribe_document(
+        self,
+        database: Any,
+        document: DocumentDefinition[Any],
+        key: str,
+        *,
+        subscription_id: str | None = None,
+        message_id: str = "cultmesh-python-document-subscribe",
+        include_snapshot: bool = True,
+    ) -> "CultMeshDocumentSubscription":
+        return CultMeshDocumentSubscription(
+            client=CultNetRawClient(self.host, self.port, self.timeout_seconds),
+            database=database,
+            document=document,
+            key=key,
+            subscription_id=subscription_id,
+            message_id=message_id,
+            include_snapshot=include_snapshot,
+        )
+
     def _fanout_endpoints(
         self,
         catalog: CultMeshPeerCatalog,
@@ -353,6 +409,88 @@ class CultMeshPeerExchangeClient(CultMeshDiscoveryClient):
         return self.fanout_peer_catalog(catalog, verse_id=verse_id, roles=roles, limit=limit)
 
 
+@dataclass
+class CultMeshDocumentSubscription:
+    client: CultNetRawClient
+    database: Any
+    document: DocumentDefinition[Any]
+    key: str
+    subscription_id: str | None = None
+    message_id: str = "cultmesh-python-document-subscribe"
+    include_snapshot: bool = True
+    _subscription: CultNetDatabaseSubscription | None = field(default=None, init=False, repr=False)
+
+    def __enter__(self) -> "CultMeshDocumentSubscription":
+        if not self.key:
+            raise ValueError("key must be non-empty")
+        registered = self.database._resolve_document_alias(self.document)
+        self._subscription = self.client.subscribe_database(
+            subscription_id=self.subscription_id or f"{registered.type}:{self.key}",
+            message_id=self.message_id,
+            schema_ids=[registered.catalog_entry().schema_id],
+            record_keys=[self.key],
+            include_snapshot=self.include_snapshot,
+        )
+        self._subscription.__enter__()
+        return self
+
+    def __exit__(self, exc_type: Any, exc: Any, traceback: Any) -> None:
+        if self._subscription is not None:
+            self._subscription.__exit__(exc_type, exc, traceback)
+            self._subscription = None
+
+    def sync_initial(self) -> Any:
+        self._require_subscription()
+        changes = self._capture_changes(lambda: self.database.apply_snapshot_response(
+            self._subscription.read_next_snapshot_response()  # type: ignore[union-attr]
+        ))
+        if changes:
+            return changes[-1].value
+        return self.database.get_required(self.document, self.key)
+
+    def send(self, message: Any) -> None:
+        self._require_subscription()
+        self._subscription.send(message)  # type: ignore[union-attr]
+
+    def read_next_change(self) -> Any:
+        self._require_subscription()
+        remote_change = self._subscription.read_next_change()  # type: ignore[union-attr]
+
+        def apply_remote_change() -> None:
+            if remote_change.raw_document is not None:
+                self.database.apply_raw_put_message({
+                    "schemaVersion": "cultnet.document_put_raw.v0",
+                    "messageId": remote_change.message_id,
+                    "document": remote_change.raw_document.to_wire(),
+                })
+                return
+            if remote_change.change_kind == "removed":
+                self.database.apply_raw_delete_message({
+                    "schemaVersion": "cultnet.document_delete.v0",
+                    "messageId": remote_change.message_id,
+                    "schemaId": remote_change.schema_id,
+                    "recordKey": remote_change.record_key,
+                })
+
+        changes = self._capture_changes(apply_remote_change)
+        if not changes:
+            raise RuntimeError("CultMesh document subscription change did not apply to the local database")
+        return changes[-1]
+
+    def _capture_changes(self, action: Callable[[], Any]) -> list[Any]:
+        changes: list[Any] = []
+        unsubscribe = self.database.watch_record(self.document, self.key, changes.append)
+        try:
+            action()
+        finally:
+            unsubscribe()
+        return changes
+
+    def _require_subscription(self) -> None:
+        if self._subscription is None:
+            raise RuntimeError("CultMesh document subscription is not open")
+
+
 @dataclass
 class CultMeshSimulationObservationFanout:
     client: CultMeshDiscoveryClient
@@ -437,17 +575,34 @@ class CultMeshSnapshotFanout:
     peer_catalog: CultMeshPeerCatalog
     verse_id: str
     roles: list[str] | None = None
+    documents: list[tuple[DocumentDefinition[Any], str]] | None = None
     schema_ids: list[str] | None = None
     record_keys: list[str] | None = None
     shard_id: str | None = None
     shard_epoch: int | None = None
     interval_seconds: float = 1.0
     on_applied: Callable[[Any], None] | None = None
+    on_document: Callable[[Any], None] | None = None
     on_error: Callable[[str, Exception], None] | None = None
     _stop: threading.Event = field(default_factory=threading.Event, init=False, repr=False)
     _thread: threading.Thread | None = field(default=None, init=False, repr=False)
 
     def sync_once(self) -> list[Any]:
+        if self.documents is not None:
+            values = self.client.sync_documents(
+                self.database,
+                self.peer_catalog,
+                verse_id=self.verse_id,
+                roles=self.roles,
+                documents=self.documents,
+                shard_id=self.shard_id,
+                shard_epoch=self.shard_epoch,
+                on_error=self.on_error,
+            )
+            for value in values:
+                if self.on_document is not None:
+                    self.on_document(value)
+            return values
         applied = self.client.sync_snapshots(
             self.database,
             self.peer_catalog,
diff --git a/packages/cultcache-py/src/cultmesh_py/daemon.py b/packages/cultmesh-py/src/cultmesh_py/daemon.py
similarity index 99%
rename from packages/cultcache-py/src/cultmesh_py/daemon.py
rename to packages/cultmesh-py/src/cultmesh_py/daemon.py
index 087dc218..d21d42d8 100644
--- a/packages/cultcache-py/src/cultmesh_py/daemon.py
+++ b/packages/cultmesh-py/src/cultmesh_py/daemon.py
@@ -13,7 +13,7 @@ from cultnet_py import CultNetSimulationConsensusOptions, CultNetSimulationObser
 
 from .facade import CultMesh
 from .server import CultMeshLocalServer
-from .wire import (
+from cultnet_py.cultmesh_contracts import (
     CultMeshPeerCard,
     CultMeshPeerCatalog,
     CultMeshVerseCatalog,
diff --git a/packages/cultcache-py/src/cultmesh_py/facade.py b/packages/cultmesh-py/src/cultmesh_py/facade.py
similarity index 78%
rename from packages/cultcache-py/src/cultmesh_py/facade.py
rename to packages/cultmesh-py/src/cultmesh_py/facade.py
index a7900a44..53328aab 100644
--- a/packages/cultcache-py/src/cultmesh_py/facade.py
+++ b/packages/cultmesh-py/src/cultmesh_py/facade.py
@@ -7,6 +7,7 @@ from pathlib import Path
 from typing import Any
 from urllib.parse import urlparse
 
+from cultcache_py.documents import DocumentDefinition
 from cultnet_py import (
     CultNetRawClient,
     CultNetReconnectPolicy,
@@ -20,12 +21,20 @@ from cultnet_py import (
     wire_message_schema_catalog,
 )
 
-from .client import CultMeshPeerExchangeClient, CultMeshVerseDiscoveryClient
-from .node import CultMeshNode, CultMeshNodeOptions, create_node
+from .client import CultMeshDocumentSubscription, CultMeshPeerExchangeClient, CultMeshVerseDiscoveryClient
+from .node import (
+    CultMeshDocumentPublicationSource,
+    CultMeshDocumentWriter,
+    CultMeshNode,
+    CultMeshNodeOptions,
+    CultMeshObservedDocument,
+    CultMeshPublicationDocumentBinding,
+    create_node,
+)
 from .server import CultMeshLocalServer
 from .session import CultMeshGameSession, CultMeshGameSessionOptions
 from .simulation import CultMeshSimulationFactCommitter
-from .wire import (
+from cultnet_py.cultmesh_contracts import (
     AuthorityLeaseVerifier,
     CultMeshAuthorityLeaseCatalog,
     CultMeshPeerCard,
@@ -273,6 +282,106 @@ class CultMesh:
     def create_simulation_fact_committer(node: CultMeshNode) -> CultMeshSimulationFactCommitter:
         return CultMeshSimulationFactCommitter(node)
 
+    @staticmethod
+    def sync_document(
+        node: CultMeshNode,
+        client: CultNetRawClient,
+        document: DocumentDefinition[Any],
+        key: str,
+        *,
+        shard_id: str | None = None,
+        shard_epoch: int | None = None,
+    ) -> Any:
+        return node.sync_document(
+            client,
+            document,
+            key,
+            shard_id=shard_id,
+            shard_epoch=shard_epoch,
+        )
+
+    @staticmethod
+    def authoritative_writer(
+        node: CultMeshNode,
+        document: DocumentDefinition[Any],
+        key: str,
+    ) -> CultMeshDocumentWriter:
+        return node.authoritative_writer(document, key)
+
+    @staticmethod
+    def observe_document(
+        node: CultMeshNode,
+        document: DocumentDefinition[Any],
+        key: str,
+    ) -> CultMeshObservedDocument:
+        return node.observe_document(document, key)
+
+    @staticmethod
+    def publication_source_from_peer_snapshot(
+        client: CultNetRawClient,
+        *,
+        shard_id: str | None = None,
+        shard_epoch: int | None = None,
+    ) -> CultMeshDocumentPublicationSource:
+        return CultMeshDocumentPublicationSource.peer_snapshot(
+            client,
+            shard_id=shard_id,
+            shard_epoch=shard_epoch,
+        )
+
+    @staticmethod
+    def publication_source_from_single_file(path: str | Path) -> CultMeshDocumentPublicationSource:
+        return CultMeshDocumentPublicationSource.single_file(path)
+
+    @staticmethod
+    def publication_document(
+        document: DocumentDefinition[Any],
+        key: str,
+        *,
+        source: CultMeshDocumentPublicationSource | None = None,
+    ) -> CultMeshPublicationDocumentBinding:
+        if not key:
+            raise ValueError("key must be non-empty")
+        return CultMeshPublicationDocumentBinding(document=document, key=key, source=source)
+
+    @staticmethod
+    def sync_document_from_publication(
+        node: CultMeshNode,
+        source: CultMeshDocumentPublicationSource,
+        document: DocumentDefinition[Any],
+        key: str,
+    ) -> Any:
+        return node.sync_document_from_publication(source, document, key)
+
+    @staticmethod
+    def sync_documents_from_publication(
+        node: CultMeshNode,
+        source: CultMeshDocumentPublicationSource,
+        bindings: list[CultMeshPublicationDocumentBinding] | tuple[CultMeshPublicationDocumentBinding, ...],
+    ) -> list[Any]:
+        return node.sync_documents_from_publication(source, bindings)
+
+    @staticmethod
+    def subscribe_document(
+        node: CultMeshNode,
+        client: CultNetRawClient,
+        document: DocumentDefinition[Any],
+        key: str,
+        *,
+        subscription_id: str | None = None,
+        message_id: str = "cultmesh-python-document-subscribe",
+        include_snapshot: bool = True,
+    ) -> CultMeshDocumentSubscription:
+        return CultMeshDocumentSubscription(
+            client=client,
+            database=node.database,
+            document=document,
+            key=key,
+            subscription_id=subscription_id,
+            message_id=message_id,
+            include_snapshot=include_snapshot,
+        )
+
     @staticmethod
     def create_game_session(
         node: CultMeshNode,
diff --git a/packages/cultcache-py/src/cultmesh_py/node.py b/packages/cultmesh-py/src/cultmesh_py/node.py
similarity index 53%
rename from packages/cultcache-py/src/cultmesh_py/node.py
rename to packages/cultmesh-py/src/cultmesh_py/node.py
index b567ca82..09ac2012 100644
--- a/packages/cultcache-py/src/cultmesh_py/node.py
+++ b/packages/cultmesh-py/src/cultmesh_py/node.py
@@ -1,11 +1,16 @@
 from __future__ import annotations
 
+import threading
+import heapq
+import time
+import traceback
 from dataclasses import dataclass, field
 from datetime import UTC, datetime
 from pathlib import Path
 from typing import Any, Callable
 
 from cultcache_py import CultCache, CultCacheEnvelope, SingleFileMessagePackBackingStore
+from cultcache_py.cache import CultCacheError
 from cultcache_py.documents import DocumentDefinition, extract_value
 from cultnet_py import (
     CultNetAppliedRecord,
@@ -21,6 +26,7 @@ from cultnet_py import (
     apply_shard_log_response as apply_cultnet_shard_log_response,
     document_delete,
     document_put_raw,
+    resolve_document_and_schema_id_for_raw_record,
     schema_document_map,
 )
 
@@ -35,6 +41,136 @@ class CultMeshDatabaseChange:
     previous_value: Any | None = None
 
 
+@dataclass(frozen=True)
+class CultMeshDocumentPublicationSource:
+    kind: str
+    client: CultNetRawClient | None = None
+    path: Path | None = None
+    shard_id: str | None = None
+    shard_epoch: int | None = None
+
+    @staticmethod
+    def peer_snapshot(
+        client: CultNetRawClient,
+        *,
+        shard_id: str | None = None,
+        shard_epoch: int | None = None,
+    ) -> "CultMeshDocumentPublicationSource":
+        return CultMeshDocumentPublicationSource(
+            kind="peer_snapshot",
+            client=client,
+            shard_id=shard_id,
+            shard_epoch=shard_epoch,
+        )
+
+    @staticmethod
+    def single_file(path: str | Path) -> "CultMeshDocumentPublicationSource":
+        return CultMeshDocumentPublicationSource(kind="single_file", path=Path(path))
+
+
+@dataclass(frozen=True)
+class CultMeshPublicationDocumentBinding:
+    document: DocumentDefinition[Any]
+    key: str
+    source: CultMeshDocumentPublicationSource | None = None
+
+
+@dataclass(frozen=True)
+class CultMeshReactiveDocumentReconciliation:
+    canonical: Any
+    predicted: Any
+    delta: dict[str, Any]
+    version: int
+    received_at: datetime
+
+
+@dataclass(frozen=True)
+class CultMeshReactiveDocumentOptions:
+    flush_delay_seconds: float = 0.016
+    replace_dirty_current_on_canonical_snapshot: bool = False
+
+
+class _CultMeshScheduledCall:
+    def __init__(self, callback: Callable[[], None], wake: Callable[[], None]) -> None:
+        self._callback: Callable[[], None] | None = callback
+        self._wake = wake
+        self._lock = threading.Lock()
+
+    def cancel(self) -> None:
+        with self._lock:
+            self._callback = None
+        self._wake()
+
+    def take(self) -> Callable[[], None] | None:
+        with self._lock:
+            callback = self._callback
+            self._callback = None
+            return callback
+
+    @property
+    def cancelled(self) -> bool:
+        with self._lock:
+            return self._callback is None
+
+
+class _CultMeshReactiveScheduler:
+    """One lazy daemon worker owns delayed reactive flushes for the process."""
+
+    def __init__(self) -> None:
+        self._condition = threading.Condition()
+        self._queue: list[tuple[float, int, _CultMeshScheduledCall]] = []
+        self._sequence = 0
+        self._worker: threading.Thread | None = None
+
+    def schedule(self, delay_seconds: float, callback: Callable[[], None]) -> _CultMeshScheduledCall:
+        call = _CultMeshScheduledCall(callback, self._wake)
+        with self._condition:
+            self._sequence += 1
+            heapq.heappush(
+                self._queue,
+                (time.monotonic() + max(0.0, delay_seconds), self._sequence, call),
+            )
+            if self._worker is None:
+                self._worker = threading.Thread(
+                    target=self._run,
+                    name="cultmesh-reactive-scheduler",
+                    daemon=True,
+                )
+                self._worker.start()
+            self._condition.notify()
+        return call
+
+    def _wake(self) -> None:
+        with self._condition:
+            self._condition.notify()
+
+    def _run(self) -> None:
+        while True:
+            callback: Callable[[], None] | None = None
+            with self._condition:
+                while callback is None:
+                    while self._queue and self._queue[0][2].cancelled:
+                        heapq.heappop(self._queue)
+                    if not self._queue:
+                        self._condition.wait()
+                        continue
+                    deadline, _, call = self._queue[0]
+                    remaining = deadline - time.monotonic()
+                    if remaining > 0:
+                        self._condition.wait(remaining)
+                        continue
+                    heapq.heappop(self._queue)
+                    callback = call.take()
+            if callback is not None:
+                try:
+                    callback()
+                except Exception:
+                    traceback.print_exc()
+
+
+_REACTIVE_SCHEDULER = _CultMeshReactiveScheduler()
+
+
 @dataclass
 class CultMeshNode:
     cache: CultCache = field(default_factory=CultCache)
@@ -79,6 +215,15 @@ class CultMeshNode:
     def get_required(self, document: DocumentDefinition[Any], key: str) -> Any:
         return self.database.get_required(document, key)
 
+    def get_all(self, document: DocumentDefinition[Any]) -> list[Any]:
+        return self.database.get_all(document)
+
+    def get_by_name(self, document: DocumentDefinition[Any], name: str) -> Any:
+        return self.database.get_by_name(document, name)
+
+    def get_by_index(self, document: DocumentDefinition[Any], index: str, value: str) -> Any:
+        return self.database.get_by_index(document, index, value)
+
     def get_global(self, document: DocumentDefinition[Any]) -> Any:
         return self.database.get_global(document)
 
@@ -169,6 +314,52 @@ class CultMeshNode:
             shard_epoch=shard_epoch,
         )
 
+    def sync_document(
+        self,
+        client: CultNetRawClient,
+        document: DocumentDefinition[Any],
+        key: str,
+        *,
+        shard_id: str | None = None,
+        shard_epoch: int | None = None,
+    ) -> Any:
+        return self.database.sync_document(
+            client,
+            document,
+            key,
+            shard_id=shard_id,
+            shard_epoch=shard_epoch,
+        )
+
+    def authoritative_writer(
+        self,
+        document: DocumentDefinition[Any],
+        key: str,
+    ) -> "CultMeshDocumentWriter":
+        return self.database.authoritative_writer(document, key)
+
+    def observe_document(
+        self,
+        document: DocumentDefinition[Any],
+        key: str,
+    ) -> "CultMeshObservedDocument":
+        return self.database.observe_document(document, key)
+
+    def sync_document_from_publication(
+        self,
+        source: CultMeshDocumentPublicationSource,
+        document: DocumentDefinition[Any],
+        key: str,
+    ) -> Any:
+        return self.database.sync_document_from_publication(source, document, key)
+
+    def sync_documents_from_publication(
+        self,
+        source: CultMeshDocumentPublicationSource,
+        bindings: list[CultMeshPublicationDocumentBinding] | tuple[CultMeshPublicationDocumentBinding, ...],
+    ) -> list[Any]:
+        return self.database.sync_documents_from_publication(source, bindings)
+
     def sync_shard_log(
         self,
         client: CultNetRawClient,
@@ -253,7 +444,16 @@ class CultMeshDatabase:
         document: DocumentDefinition[Any] | None = None,
         key: str | None = None,
     ) -> Callable[[], None]:
-        subscriber = (document, key, callback)
+        requested = document
+        registered = None if document is None else self._resolve_document_alias(document)
+
+        def converted(change: CultMeshDatabaseChange) -> None:
+            if requested is None:
+                callback(change)
+            else:
+                callback(self._change_as_document(change, requested))
+
+        subscriber = (registered, key, converted)
         self._subscribers.append(subscriber)
 
         def unsubscribe() -> None:
@@ -268,7 +468,13 @@ class CultMeshDatabase:
         key: str,
         callback: Callable[[CultMeshDatabaseChange], None],
     ) -> Callable[[], None]:
-        return self.watch(callback, document=document, key=key)
+        requested = document
+        registered = self._resolve_document_alias(document)
+
+        def converted(change: CultMeshDatabaseChange) -> None:
+            callback(self._change_as_document(change, requested))
+
+        return self.watch(converted, document=registered, key=key)
 
     def watch_global(
         self,
@@ -283,6 +489,8 @@ class CultMeshDatabase:
         name: str,
         callback: Callable[[CultMeshDatabaseChange], None],
     ) -> Callable[[], None]:
+        requested = document
+        document = self._resolve_document_alias(document)
         if not name:
             raise ValueError("Name watch values must be non-empty")
         if document.name is None:
@@ -290,7 +498,7 @@ class CultMeshDatabase:
 
         def filtered(change: CultMeshDatabaseChange) -> None:
             if self._change_matches_extractor(change, document.name, name):
-                callback(change)
+                callback(self._change_as_document(change, requested))
 
         return self.watch(filtered, document=document)
 
@@ -301,6 +509,8 @@ class CultMeshDatabase:
         value: str,
         callback: Callable[[CultMeshDatabaseChange], None],
     ) -> Callable[[], None]:
+        requested = document
+        document = self._resolve_document_alias(document)
         if not index:
             raise ValueError("Index watch aliases must be non-empty")
         if not value:
@@ -311,7 +521,7 @@ class CultMeshDatabase:
 
         def filtered(change: CultMeshDatabaseChange) -> None:
             if self._change_matches_extractor(change, extractor, value):
-                callback(change)
+                callback(self._change_as_document(change, requested))
 
         return self.watch(filtered, document=document)
 
@@ -329,9 +539,11 @@ class CultMeshDatabase:
         self._shard_log_store = store
 
     def put(self, document: DocumentDefinition[Any], key: str, value: Any) -> None:
-        previous = self.cache.get(document, key)
-        self.cache.put(document, key, value)
-        self._publish_local_change(document, key, "added" if previous is None else "updated", value, previous)
+        registered = self._resolve_document_alias(document)
+        parsed = self._convert_document_value(value, document, registered)
+        previous = self.cache.get(registered, key)
+        self.cache.put(registered, key, parsed)
+        self._publish_local_change(registered, key, "added" if previous is None else "updated", parsed, previous)
 
     def put_global(self, document: DocumentDefinition[Any], value: Any) -> None:
         self.put(document, self.cache.GLOBAL_KEY, value)
@@ -346,17 +558,19 @@ class CultMeshDatabase:
         shard_id: str | None = None,
         shard_epoch: int | None = None,
     ) -> CultNetMessage:
-        catalog_entry = document.catalog_entry()
-        previous = self.cache.get(document, key)
+        registered = self._resolve_document_alias(document)
+        parsed = self._convert_document_value(value, document, registered)
+        catalog_entry = registered.catalog_entry()
+        previous = self.cache.get(registered, key)
         envelope = CultCacheEnvelope.create(
             key=key,
-            type=document.type,
-            payload=document.encode_payload(value),
+            type=registered.type,
+            payload=registered.encode_payload(parsed),
             schema_id=catalog_entry.schema_id,
             catalog_entry=catalog_entry,
         )
-        value = self.cache.put_envelope(document, envelope)
-        self._publish_local_change(document, key, "added" if previous is None else "updated", value, previous)
+        value = self.cache.put_envelope(registered, envelope)
+        self._publish_local_change(registered, key, "added" if previous is None else "updated", value, previous)
         message = document_put_raw(
             message_id=message_id,
             key=key,
@@ -371,22 +585,45 @@ class CultMeshDatabase:
         return message
 
     def get(self, document: DocumentDefinition[Any], key: str) -> Any:
-        return self.cache.get(document, key)
+        registered = self._resolve_document_alias(document)
+        value = self.cache.get(registered, key)
+        return None if value is None else self._convert_document_value(value, registered, document)
 
     def get_required(self, document: DocumentDefinition[Any], key: str) -> Any:
-        return self.cache.get_required(document, key)
+        value = self.get(document, key)
+        if value is None:
+            raise CultCacheError(f"Missing {document.type}:{key}")
+        return value
+
+    def get_all(self, document: DocumentDefinition[Any]) -> list[Any]:
+        registered = self._resolve_document_alias(document)
+        return [
+            self._convert_document_value(value, registered, document)
+            for value in self.cache.get_all(registered)
+        ]
+
+    def get_by_name(self, document: DocumentDefinition[Any], name: str) -> Any:
+        registered = self._resolve_document_alias(document)
+        value = self.cache.get_by_name(registered, name)
+        return None if value is None else self._convert_document_value(value, registered, document)
+
+    def get_by_index(self, document: DocumentDefinition[Any], index: str, value: str) -> Any:
+        registered = self._resolve_document_alias(document)
+        result = self.cache.get_by_index(registered, index, value)
+        return None if result is None else self._convert_document_value(result, registered, document)
 
     def get_global(self, document: DocumentDefinition[Any]) -> Any:
-        return self.cache.get_global(document)
+        return self.get(document, self.cache.GLOBAL_KEY)
 
     def get_required_global(self, document: DocumentDefinition[Any]) -> Any:
-        return self.cache.get_required_global(document)
+        return self.get_required(document, self.cache.GLOBAL_KEY)
 
     def delete(self, document: DocumentDefinition[Any], key: str) -> None:
-        previous = self.cache.get(document, key)
-        self.cache.delete(document, key)
+        registered = self._resolve_document_alias(document)
+        previous = self.cache.get(registered, key)
+        self.cache.delete(registered, key)
         if previous is not None:
-            self._publish_local_change(document, key, "removed", None, previous)
+            self._publish_local_change(registered, key, "removed", None, previous)
 
     def delete_global(self, document: DocumentDefinition[Any]) -> None:
         self.delete(document, self.cache.GLOBAL_KEY)
@@ -400,7 +637,8 @@ class CultMeshDatabase:
         shard_id: str | None = None,
         shard_epoch: int | None = None,
     ) -> CultNetMessage:
-        schema_id = document.catalog_entry().schema_id
+        registered = self._resolve_document_alias(document)
+        schema_id = registered.catalog_entry().schema_id
         self.delete(document, key)
         message = document_delete(
             message_id=message_id,
@@ -417,15 +655,21 @@ class CultMeshDatabase:
         if not isinstance(document_record, dict):
             return None
         schema_id = str(document_record.get("schemaId") or "")
-        document = self._document_for_schema(schema_id)
-        if document is None:
+        documents_by_schema_id = schema_document_map(self.documents)
+        try:
+            document, resolved_schema_id = resolve_document_and_schema_id_for_raw_record(
+                documents_by_schema_id,
+                schema_id,
+                document_record,
+            )
+        except KeyError:
             return None
         record_key = str(document_record["recordKey"])
         previous = self.cache.get(document, record_key)
         envelope = CultCacheEnvelope(
             key=record_key,
             type=document.type,
-            schema_id=schema_id,
+            schema_id=resolved_schema_id,
             payload=bytes(document_record["payload"]),
             stored_at=str(document_record.get("storedAt") or ""),
             catalog_entry=document.catalog_entry(),
@@ -513,6 +757,8 @@ class CultMeshDatabase:
     ) -> CultNetRawSnapshotResponse:
         requested_schema_ids = set(schema_ids or [])
         requested_record_keys = set(record_keys or [])
+        documents_by_type = {document.type: document for document in self.documents}
+        documents_by_schema_id = schema_document_map(self.documents)
         shard_record_keys = (
             self._live_shard_record_keys(shard_id)
             if shard_id is not None and shard_id in self._shard_logs
@@ -521,7 +767,8 @@ class CultMeshDatabase:
         documents: list[CultNetRawDocumentRecord] = []
         for envelope in self.cache.snapshot_envelopes():
             schema_id = envelope.schema_id or envelope.type
-            if requested_schema_ids and schema_id not in requested_schema_ids:
+            document = documents_by_type.get(envelope.type) or documents_by_schema_id.get(schema_id)
+            if requested_schema_ids and not self._schema_matches_request(schema_id, document, requested_schema_ids):
                 continue
             if requested_record_keys and envelope.key not in requested_record_keys:
                 continue
@@ -563,6 +810,101 @@ class CultMeshDatabase:
         )
         return self.apply_snapshot_response(response)
 
+    def sync_document(
+        self,
+        client: CultNetRawClient,
+        document: DocumentDefinition[Any],
+        key: str,
+        *,
+        shard_id: str | None = None,
+        shard_epoch: int | None = None,
+    ) -> Any:
+        if not key:
+            raise ValueError("key must be non-empty")
+        requested = document
+        registered = self._resolve_document_alias(document)
+        schema_id = registered.catalog_entry().schema_id
+        self.sync_snapshot(
+            client,
+            schema_ids=[schema_id],
+            record_keys=[key],
+            shard_id=shard_id,
+            shard_epoch=shard_epoch,
+        )
+        return self.get_required(requested, key)
+
+    def authoritative_writer(
+        self,
+        document: DocumentDefinition[Any],
+        key: str,
+    ) -> "CultMeshDocumentWriter":
+        if not key:
+            raise ValueError("key must be non-empty")
+        if not any(self._documents_alias(document, registered) for registered in self.documents):
+            self.register_document(document)
+        return CultMeshDocumentWriter(self, document, key)
+
+    def observe_document(
+        self,
+        document: DocumentDefinition[Any],
+        key: str,
+    ) -> "CultMeshObservedDocument":
+        if not key:
+            raise ValueError("key must be non-empty")
+        if not any(self._documents_alias(document, registered) for registered in self.documents):
+            self.register_document(document)
+        return CultMeshObservedDocument(self, document, key)
+
+    def sync_document_from_publication(
+        self,
+        source: CultMeshDocumentPublicationSource,
+        document: DocumentDefinition[Any],
+        key: str,
+    ) -> Any:
+        if not key:
+            raise ValueError("key must be non-empty")
+        if source.kind == "peer_snapshot":
+            if source.client is None:
+                raise ValueError("peer snapshot publication sources require a client")
+            return self.sync_document(
+                source.client,
+                document,
+                key,
+                shard_id=source.shard_id,
+                shard_epoch=source.shard_epoch,
+            )
+        if source.kind == "single_file":
+            if source.path is None:
+                raise ValueError("single-file publication sources require a path")
+            registered = self._resolve_document_alias(document)
+            cache = CultCache()
+            cache.register_document_type(registered)
+            cache.add_generic_store(SingleFileMessagePackBackingStore(source.path))
+            cache.pull_all_backing_stores()
+            value = cache.get_required(registered, key)
+            requested = self._convert_document_value(value, registered, document)
+            self.put(document, key, requested)
+            return self.get_required(document, key)
+        raise ValueError(f"Unsupported CultMesh document publication source: {source.kind!r}")
+
+    def sync_documents_from_publication(
+        self,
+        source: CultMeshDocumentPublicationSource,
+        bindings: list[CultMeshPublicationDocumentBinding] | tuple[CultMeshPublicationDocumentBinding, ...],
+    ) -> list[Any]:
+        if source is None:
+            raise ValueError("publication source is required")
+        if bindings is None:
+            raise ValueError("publication bindings are required")
+        return [
+            self.sync_document_from_publication(
+                binding.source or source,
+                binding.document,
+                binding.key,
+            )
+            for binding in bindings
+        ]
+
     def sync_shard_log(
         self,
         client: CultNetRawClient,
@@ -716,7 +1058,7 @@ class CultMeshDatabase:
 
     def _publish(self, change: CultMeshDatabaseChange) -> None:
         for document, key, callback in list(self._subscribers):
-            if document is not None and document.type != change.document.type:
+            if document is not None and not self._documents_alias(document, change.document):
                 continue
             if key is not None and key != change.record_key:
                 continue
@@ -782,15 +1124,37 @@ class CultMeshDatabase:
                 schema_id = document.get("schemaId")
                 record_key = document.get("recordKey")
                 if schema_id and record_key:
-                    records.add((str(schema_id), str(record_key)))
+                    records.add(self._canonical_shard_record_key(str(schema_id), str(record_key), document))
             delete = entry.get("delete")
             if isinstance(delete, dict):
                 schema_id = delete.get("schemaId")
                 record_key = delete.get("recordKey")
                 if schema_id and record_key:
-                    records.discard((str(schema_id), str(record_key)))
+                    records.discard(self._canonical_shard_record_key(str(schema_id), str(record_key)))
         return records
 
+    def _canonical_shard_record_key(
+        self,
+        schema_id: str,
+        record_key: str,
+        raw_record: dict[str, Any] | None = None,
+    ) -> tuple[str, str]:
+        documents_by_schema_id = schema_document_map(self.documents)
+        if raw_record is not None:
+            try:
+                _, resolved_schema_id = resolve_document_and_schema_id_for_raw_record(
+                    documents_by_schema_id,
+                    schema_id,
+                    raw_record,
+                )
+                return resolved_schema_id, record_key
+            except KeyError:
+                pass
+        document = documents_by_schema_id.get(schema_id)
+        if document is not None:
+            return document.catalog_entry().schema_id, record_key
+        return schema_id, record_key
+
     def _shard_log_entries(
         self,
         shard_id: str,
@@ -823,11 +1187,67 @@ class CultMeshDatabase:
 
     def _document_for_schema(self, schema_id: str) -> DocumentDefinition[Any] | None:
         for document in self.documents:
-            entry = document.catalog_entry()
-            if schema_id == entry.schema_id or schema_id in entry.compatible_schema_ids:
+            if _document_matches_schema_id(document, schema_id):
                 return document
         return None
 
+    def _resolve_document_alias(self, document: DocumentDefinition[Any]) -> DocumentDefinition[Any]:
+        for registered in self.documents:
+            if self._documents_alias(document, registered):
+                return registered
+        return document
+
+    def _convert_document_value(
+        self,
+        value: Any,
+        source: DocumentDefinition[Any],
+        target: DocumentDefinition[Any],
+    ) -> Any:
+        return target.decode_payload(source.encode_payload(value))
+
+    def _change_as_document(
+        self,
+        change: CultMeshDatabaseChange,
+        target: DocumentDefinition[Any],
+    ) -> CultMeshDatabaseChange:
+        if change.document.type == target.type:
+            return change
+        if not self._documents_alias(change.document, target):
+            return change
+        return CultMeshDatabaseChange(
+            document=target,
+            schema_id=target.catalog_entry().schema_id,
+            record_key=change.record_key,
+            change_kind=change.change_kind,
+            value=None if change.value is None else self._convert_document_value(
+                change.value,
+                change.document,
+                target,
+            ),
+            previous_value=None if change.previous_value is None else self._convert_document_value(
+                change.previous_value,
+                change.document,
+                target,
+            ),
+        )
+
+    def _documents_alias(
+        self,
+        left: DocumentDefinition[Any],
+        right: DocumentDefinition[Any],
+    ) -> bool:
+        if left.type == right.type:
+            return True
+        left_entry = left.catalog_entry()
+        right_entry = right.catalog_entry()
+        if left_entry.schema_id == right_entry.schema_id:
+            return True
+        if left_entry.schema_name == right_entry.schema_name and left_entry.schema_version == right_entry.schema_version:
+            return True
+        if left_entry.schema_id in right_entry.compatible_schema_ids:
+            return True
+        return right_entry.schema_id in left_entry.compatible_schema_ids
+
     def _change_matches_extractor(
         self,
         change: CultMeshDatabaseChange,
@@ -875,7 +1295,8 @@ class CultMeshDatabase:
             if document is None:
                 continue
             record_key = str(delete.get("recordKey"))
-            previous[(schema_id, record_key)] = self.cache.get(document, record_key)
+            resolved_schema_id = document.catalog_entry().schema_id
+            previous[(resolved_schema_id, record_key)] = self.cache.get(document, record_key)
         return previous
 
     def _previous_values_for_raw_records(self, records: Any) -> dict[tuple[str, str], Any]:
@@ -885,13 +1306,337 @@ class CultMeshDatabase:
             if not isinstance(record, dict):
                 continue
             schema_id = str(record.get("schemaId"))
-            document = documents_by_schema_id.get(schema_id)
-            if document is None:
+            try:
+                document, resolved_schema_id = resolve_document_and_schema_id_for_raw_record(
+                    documents_by_schema_id,
+                    schema_id,
+                    record,
+                )
+            except KeyError:
                 continue
             record_key = str(record.get("recordKey"))
-            previous[(schema_id, record_key)] = self.cache.get(document, record_key)
+            previous[(resolved_schema_id, record_key)] = self.cache.get(document, record_key)
         return previous
 
+    @staticmethod
+    def _schema_matches_request(
+        schema_id: str,
+        document: DocumentDefinition[Any] | None,
+        requested_schema_ids: set[str],
+    ) -> bool:
+        if not requested_schema_ids or schema_id in requested_schema_ids:
+            return True
+        if document is None:
+            return False
+        entry = document.catalog_entry()
+        if entry.schema_id in requested_schema_ids or entry.schema_name in requested_schema_ids:
+            return True
+        if any(schema_id in requested_schema_ids for schema_id in entry.compatible_schema_ids):
+            return True
+        return any(_infer_schema_name(schema_id) == entry.schema_name for schema_id in requested_schema_ids)
+
+
+def _infer_schema_name(schema_id: str) -> str | None:
+    marker = schema_id.rfind(".v")
+    if marker <= 0 or marker + 2 >= len(schema_id):
+        return None
+    version = schema_id[marker + 2:]
+    return schema_id[:marker] if version.isdigit() else None
+
+
+def _document_matches_schema_id(document: DocumentDefinition[Any], schema_id: str) -> bool:
+    entry = document.catalog_entry()
+    if schema_id in (entry.schema_id, entry.schema_name, entry.schema_version):
+        return True
+    if schema_id in entry.compatible_schema_ids:
+        return True
+    return _infer_schema_name(schema_id) == entry.schema_name
+
+
+class CultMeshDocumentWriter:
+    def __init__(
+        self,
+        database: CultMeshDatabase,
+        document: DocumentDefinition[Any],
+        key: str,
+    ) -> None:
+        self.database = database
+        self.document = document
+        self.key = key
+
+    def write(self, value: Any) -> None:
+        self.database.put(self.document, self.key, self._clone(value))
+
+    def update(self, callback: Callable[[Any], Any | None]) -> Any:
+        draft = self._clone(self.database.get_required(self.document, self.key))
+        replacement = callback(draft)
+        next_value = draft if replacement is None else replacement
+        self.write(next_value)
+        return self._clone(next_value)
+
+    def reactive(
+        self,
+        options: CultMeshReactiveDocumentOptions | None = None,
+    ) -> "CultMeshReactiveDocument":
+        return CultMeshReactiveDocument(self, options)
+
+    def _clone(self, value: Any) -> Any:
+        return self.document.decode_payload(self.document.encode_payload(value))
+
+
+class CultMeshObservedDocument:
+    def __init__(
+        self,
+        database: CultMeshDatabase,
+        document: DocumentDefinition[Any],
+        key: str,
+    ) -> None:
+        self._database = database
+        self._document = document
+        self._key = key
+        self._lock = threading.RLock()
+        self._disposed = False
+        self._current = self._clone(database.get_required(document, key))
+        self._unsubscribe = database.watch_record(document, key, self._apply_canonical_change)
+
+    @property
+    def current(self) -> Any:
+        with self._lock:
+            self._raise_if_disposed()
+            return self._current
+
+    def refresh(self) -> Any:
+        with self._lock:
+            self._raise_if_disposed()
+            self._current = self._clone(
+                self._database.get_required(self._document, self._key)
+            )
+            return self._current
+
+    def dispose(self) -> None:
+        with self._lock:
+            if self._disposed:
+                return
+            self._disposed = True
+        self._unsubscribe()
+
+    def __enter__(self) -> "CultMeshObservedDocument":
+        return self
+
+    def __exit__(self, _exc_type: Any, _exc: Any, _tb: Any) -> None:
+        self.dispose()
+
+    def _apply_canonical_change(self, change: CultMeshDatabaseChange) -> None:
+        if change.value is None:
+            return
+        with self._lock:
+            if not self._disposed:
+                self._current = self._clone(change.value)
+
+    def _clone(self, value: Any) -> Any:
+        return self._document.decode_payload(self._document.encode_payload(value))
+
+    def _raise_if_disposed(self) -> None:
+        if self._disposed:
+            raise RuntimeError("CultMeshObservedDocument has been disposed")
+
+
+class CultMeshReactiveDocument:
+    def __init__(
+        self,
+        writer: CultMeshDocumentWriter,
+        options: CultMeshReactiveDocumentOptions | None = None,
+    ) -> None:
+        self.writer = writer
+        self._database = writer.database
+        self._document = writer.document
+        self._key = writer.key
+        self._options = options or CultMeshReactiveDocumentOptions()
+        self._lock = threading.RLock()
+        self._disposed = False
+        self._dirty = False
+        self._flushing = False
+        self._flush_queued = False
+        self._flush_timer: _CultMeshScheduledCall | None = None
+        self._reconciliation_version = 0
+        self.reconciliation: CultMeshReactiveDocumentReconciliation | None = None
+        self._current = self._clone(self._database.get_required(self._document, self._key))
+        self._unsubscribe = self._database.watch_record(
+            self._document,
+            self._key,
+            self._apply_canonical_change,
+        )
+
+    @property
+    def document(self) -> DocumentDefinition[Any]:
+        return self._document
+
+    @property
+    def key(self) -> str:
+        return self._key
+
+    @property
+    def is_dirty(self) -> bool:
+        with self._lock:
+            return self._dirty
+
+    @property
+    def snapshot(self) -> Any:
+        with self._lock:
+            self._raise_if_disposed()
+            return self._clone(self._current)
+
+    def update(self, callback: Callable[[Any], Any | None]) -> Any:
+        with self._lock:
+            self._raise_if_disposed()
+            draft = self._clone(self._current)
+            replacement = callback(draft)
+            self._current = self._clone(draft if replacement is None else replacement)
+            self._dirty = True
+            self._schedule_flush_locked()
+            return self._clone(self._current)
+
+    def replace_local(self, value: Any) -> Any:
+        with self._lock:
+            self._raise_if_disposed()
+            self._current = self._clone(value)
+            self._dirty = True
+            self._schedule_flush_locked()
+            return self._clone(self._current)
+
+    def refresh(self) -> Any:
+        with self._lock:
+            self._raise_if_disposed()
+            self._current = self._clone(
+                self._database.get_required(self._document, self._key)
+            )
+            self._dirty = False
+            self.reconciliation = None
+            return self._clone(self._current)
+
+    def flush(self) -> None:
+        with self._lock:
+            self._raise_if_disposed()
+            if not self._dirty:
+                return
+            if self._flushing:
+                self._flush_queued = True
+                return
+            if self._flush_timer is not None:
+                self._flush_timer.cancel()
+                self._flush_timer = None
+            self._flushing = True
+            self._dirty = False
+            predicted = self._clone(self._current)
+
+        try:
+            self.writer.write(predicted)
+        finally:
+            should_flush_again = False
+            with self._lock:
+                self._flushing = False
+                should_flush_again = self._flush_queued or self._dirty
+                self._flush_queued = False
+            if should_flush_again:
+                self.flush()
+
+    def clear_reconciliation(self) -> None:
+        with self._lock:
+            self._raise_if_disposed()
+            self.reconciliation = None
+
+    def dispose(self) -> None:
+        with self._lock:
+            if self._disposed:
+                return
+            self._disposed = True
+            if self._flush_timer is not None:
+                self._flush_timer.cancel()
+        self._unsubscribe()
+
+    def __enter__(self) -> "CultMeshReactiveDocument":
+        return self
+
+    def __exit__(self, _exc_type: Any, _exc: Any, _tb: Any) -> None:
+        self.dispose()
+
+    def _apply_canonical_change(self, change: CultMeshDatabaseChange) -> None:
+        if change.value is None:
+            return
+        with self._lock:
+            if self._disposed:
+                return
+            replacement = None
+            if self._dirty or self._flushing:
+                delta = self._create_delta(self._current, change.value)
+                if delta:
+                    canonical = self._clone(change.value)
+                    predicted = self._clone(self._current)
+                    replacement = canonical
+                    self._reconciliation_version += 1
+                    self.reconciliation = CultMeshReactiveDocumentReconciliation(
+                        canonical=canonical,
+                        predicted=predicted,
+                        delta=delta,
+                        version=self._reconciliation_version,
+                        received_at=datetime.now(UTC),
+                    )
+                else:
+                    self.reconciliation = None
+                if not self._options.replace_dirty_current_on_canonical_snapshot:
+                    return
+            self._current = (
+                replacement
+                if replacement is not None
+                else self._clone(change.value)
+            )
+            self.reconciliation = None
+
+    def _schedule_flush_locked(self) -> None:
+        if self._flush_timer is not None:
+            self._flush_timer.cancel()
+        self._flush_timer = _REACTIVE_SCHEDULER.schedule(
+            self._options.flush_delay_seconds,
+            self.flush,
+        )
+
+    def _clone(self, value: Any) -> Any:
+        return self._document.decode_payload(self._document.encode_payload(value))
+
+    @staticmethod
+    def _create_delta(predicted: Any, canonical: Any) -> dict[str, Any]:
+        delta: dict[str, Any] = {}
+        canonical_members = _public_document_members(canonical)
+        for name, predicted_value in _public_document_members(predicted).items():
+            canonical_value = canonical_members.get(name)
+            if predicted_value == canonical_value:
+                continue
+            if isinstance(predicted_value, (int, float)) and isinstance(canonical_value, (int, float)):
+                delta[name] = predicted_value - canonical_value
+            else:
+                delta[name] = predicted_value
+        return delta
+
+    def _raise_if_disposed(self) -> None:
+        if self._disposed:
+            raise RuntimeError("CultMeshReactiveDocument has been disposed")
+
+
+def _public_document_members(value: Any) -> dict[str, Any]:
+    if hasattr(value, "__dataclass_fields__"):
+        return {
+            name: getattr(value, name)
+            for name in value.__dataclass_fields__  # type: ignore[attr-defined]
+            if not name.startswith("_")
+        }
+    if isinstance(value, dict):
+        return {str(key): item for key, item in value.items()}
+    return {
+        name: item
+        for name, item in vars(value).items()
+        if not name.startswith("_")
+    }
+
 
 def create_node(
     cache_path: str | Path | None = None,
diff --git a/packages/cultcache-py/src/cultmesh_py/py.typed b/packages/cultmesh-py/src/cultmesh_py/py.typed
similarity index 100%
rename from packages/cultcache-py/src/cultmesh_py/py.typed
rename to packages/cultmesh-py/src/cultmesh_py/py.typed
diff --git a/packages/cultcache-py/src/cultmesh_py/server.py b/packages/cultmesh-py/src/cultmesh_py/server.py
similarity index 86%
rename from packages/cultcache-py/src/cultmesh_py/server.py
rename to packages/cultmesh-py/src/cultmesh_py/server.py
index 986460ff..e0c7fdd0 100644
--- a/packages/cultcache-py/src/cultmesh_py/server.py
+++ b/packages/cultmesh-py/src/cultmesh_py/server.py
@@ -24,7 +24,7 @@ from cultnet_py import (
 )
 
 from .node import CultMeshNode
-from .wire import (
+from cultnet_py.cultmesh_contracts import (
     PEER_EXCHANGE_REQUEST,
     VERSE_CATALOG_REQUEST,
     CultMeshPeerCatalog,
@@ -245,6 +245,8 @@ class CultMeshLocalServer:
             result = peer.session.receive(packet, now_ms)
             if result.reply is not None:
                 self._send_rudp_packet(rudp_socket, remote_addr, result.reply)
+            for ready in result.ready_to_send:
+                self._send_rudp_packet(rudp_socket, remote_addr, ready)
             if result.disconnected:
                 peers.pop(remote_addr, None)
                 continue
@@ -265,8 +267,12 @@ class CultMeshLocalServer:
                         peer.session,
                         msgpack.packb(response, use_bin_type=True),
                     )
-            if packet.packet_type == CultNetRudpPacketType.DATA or result.delivered:
-                self._send_rudp_packet(rudp_socket, remote_addr, peer.session.create_ack())
+            if packet.reliable or packet.packet_type == CultNetRudpPacketType.DATA or result.delivered:
+                self._send_rudp_packet(
+                    rudp_socket,
+                    remote_addr,
+                    peer.session.create_ack_for_received(packet.sequence),
+                )
 
     def _poll_rudp_resends(
         self,
@@ -354,7 +360,13 @@ class CultMeshLocalServer:
                 message_id=str(message.get("messageId") or ""),
                 code="unregistered_document_put",
             )]
-        return self._database_change_notifications(message, document_record, change.change_kind, subscriptions)
+        return self._database_change_notifications(
+            message,
+            document_record,
+            change.change_kind,
+            subscriptions,
+            resolved_schema_id=change.schema_id,
+        )
 
     def _handle_raw_delete(
         self,
@@ -376,7 +388,7 @@ class CultMeshLocalServer:
                 message_id=str(message.get("messageId") or ""),
                 code="unregistered_document_delete",
             )]
-        return self._database_delete_notifications(message, subscriptions)
+        return self._database_delete_notifications(message, subscriptions, resolved_schema_id=change.schema_id)
 
     def _database_change_notifications(
         self,
@@ -384,10 +396,16 @@ class CultMeshLocalServer:
         document: dict[str, Any],
         change_kind: str,
         subscriptions: dict[str, _DatabaseSubscription],
+        *,
+        resolved_schema_id: str | None = None,
     ) -> list[dict[str, Any]]:
         notifications = []
         for subscription in subscriptions.values():
-            if not subscription.matches(document):
+            if not self._subscription_matches_document(
+                subscription,
+                document,
+                resolved_schema_id=resolved_schema_id,
+            ):
                 continue
             message_id = message.get("messageId") or document.get("recordKey") or "change"
             notifications.append({
@@ -403,13 +421,19 @@ class CultMeshLocalServer:
         self,
         message: dict[str, Any],
         subscriptions: dict[str, _DatabaseSubscription],
+        *,
+        resolved_schema_id: str | None = None,
     ) -> list[dict[str, Any]]:
         schema_id = str(message.get("schemaId") or "")
         record_key = str(message.get("recordKey") or "")
         notifications = []
         document = {"schemaId": schema_id, "recordKey": record_key}
         for subscription in subscriptions.values():
-            if not subscription.matches(document):
+            if not self._subscription_matches_document(
+                subscription,
+                document,
+                resolved_schema_id=resolved_schema_id,
+            ):
                 continue
             message_id = message.get("messageId") or record_key or "change"
             notifications.append({
@@ -422,6 +446,35 @@ class CultMeshLocalServer:
             })
         return notifications
 
+    def _subscription_matches_document(
+        self,
+        subscription: _DatabaseSubscription,
+        document: dict[str, Any],
+        *,
+        resolved_schema_id: str | None = None,
+    ) -> bool:
+        record_key = str(document.get("recordKey") or "")
+        if subscription.record_keys and record_key not in subscription.record_keys:
+            return False
+        if not subscription.schema_ids:
+            return True
+
+        document_schema_id = str(document.get("schemaId") or "")
+        documents_by_schema_id = _schema_document_map(self.node.documents)
+        if _schema_matches_request(
+            document_schema_id,
+            documents_by_schema_id.get(document_schema_id),
+            subscription.schema_ids,
+        ):
+            return True
+        if resolved_schema_id is None:
+            return False
+        return _schema_matches_request(
+            resolved_schema_id,
+            documents_by_schema_id.get(resolved_schema_id),
+            subscription.schema_ids,
+        )
+
     def _hello_response(self) -> dict[str, Any]:
         return {
             "schemaVersion": "cultnet.hello.v0",
@@ -591,12 +644,21 @@ class CultMeshLocalServer:
     def _shard_catalog_response(self, request: dict[str, Any]) -> dict[str, Any]:
         requested_schema_ids = {str(value) for value in request.get("schemaIds") or []}
         document_schema_ids = [document.catalog_entry().schema_id for document in self.node.documents]
+        documents_by_schema_id = _schema_document_map(self.node.documents)
         shard_ids = self.node.database.shard_ids() or ["primary"]
         shards = []
         for shard_id in shard_ids:
             schema_ids = self.node.database.shard_schema_ids(shard_id) or document_schema_ids
             if requested_schema_ids:
-                schema_ids = [schema_id for schema_id in schema_ids if schema_id in requested_schema_ids]
+                schema_ids = [
+                    schema_id
+                    for schema_id in schema_ids
+                    if _schema_matches_request(
+                        schema_id,
+                        documents_by_schema_id.get(schema_id),
+                        requested_schema_ids,
+                    )
+                ]
             if not schema_ids:
                 continue
             shards.append({
@@ -620,3 +682,40 @@ class CultMeshLocalServer:
 
 def _now_ms() -> int:
     return int(time.time() * 1000)
+
+
+def _schema_document_map(documents: list[Any]) -> dict[str, Any]:
+    mapped: dict[str, Any] = {}
+    for document in documents:
+        entry = document.catalog_entry()
+        mapped[entry.schema_id] = document
+        mapped[entry.schema_name] = document
+        mapped[entry.schema_version] = document
+        for compatible_schema_id in entry.compatible_schema_ids:
+            mapped[compatible_schema_id] = document
+    return mapped
+
+
+def _schema_matches_request(
+    schema_id: str,
+    document: Any | None,
+    requested_schema_ids: set[str],
+) -> bool:
+    if not requested_schema_ids or schema_id in requested_schema_ids:
+        return True
+    if document is None:
+        return False
+    entry = document.catalog_entry()
+    if entry.schema_id in requested_schema_ids or entry.schema_name in requested_schema_ids:
+        return True
+    if any(compatible_schema_id in requested_schema_ids for compatible_schema_id in entry.compatible_schema_ids):
+        return True
+    return any(_infer_schema_name(requested_schema_id) == entry.schema_name for requested_schema_id in requested_schema_ids)
+
+
+def _infer_schema_name(schema_id: str) -> str | None:
+    marker = schema_id.rfind(".v")
+    if marker <= 0 or marker + 2 >= len(schema_id):
+        return None
+    version = schema_id[marker + 2:]
+    return schema_id[:marker] if version.isdigit() else None
diff --git a/packages/cultcache-py/src/cultmesh_py/session.py b/packages/cultmesh-py/src/cultmesh_py/session.py
similarity index 98%
rename from packages/cultcache-py/src/cultmesh_py/session.py
rename to packages/cultmesh-py/src/cultmesh_py/session.py
index 7e4b1bc1..c02696f0 100644
--- a/packages/cultcache-py/src/cultmesh_py/session.py
+++ b/packages/cultmesh-py/src/cultmesh_py/session.py
@@ -23,7 +23,7 @@ from .simulation import (
     CultMeshSimulationFactCommitter,
     simulation_fact_document,
 )
-from .wire import CultMeshAuthorityLeaseCatalog, CultMeshPeerCatalog, CultMeshVerseCatalog
+from cultnet_py.cultmesh_contracts import CultMeshAuthorityLeaseCatalog, CultMeshPeerCatalog, CultMeshVerseCatalog
 
 if TYPE_CHECKING:
     from .server import CultMeshLocalServer
diff --git a/packages/cultmesh-py/src/cultmesh_py/simulation.py b/packages/cultmesh-py/src/cultmesh_py/simulation.py
new file mode 100644
index 00000000..a89ba4a2
--- /dev/null
+++ b/packages/cultmesh-py/src/cultmesh_py/simulation.py
@@ -0,0 +1,47 @@
+from __future__ import annotations
+
+from dataclasses import dataclass
+from typing import Any
+
+from cultcache_py.documents import DocumentDefinition
+from cultnet_py.cultmesh_contracts import (
+    SIMULATION_FACT_DOCUMENT_TYPE,
+    SIMULATION_FACT_SCHEMA_VERSION,
+    CultMeshSimulationFact,
+    simulation_fact_document,
+)
+
+from .node import CultMeshNode
+
+__all__ = [
+    "SIMULATION_FACT_DOCUMENT_TYPE",
+    "SIMULATION_FACT_SCHEMA_VERSION",
+    "CultMeshSimulationFact",
+    "CultMeshSimulationFactCommit",
+    "CultMeshSimulationFactCommitter",
+    "simulation_fact_document",
+]
+
+
+@dataclass(frozen=True)
+class CultMeshSimulationFactCommit:
+    key: str
+    fact: CultMeshSimulationFact
+
+
+@dataclass
+class CultMeshSimulationFactCommitter:
+    node: CultMeshNode
+    document: DocumentDefinition[CultMeshSimulationFact] = simulation_fact_document
+
+    def __post_init__(self) -> None:
+        if all(document.type != self.document.type for document in self.node.documents):
+            self.node.register_document(self.document)
+
+    def commit(self, candidate: dict[str, Any], *, committed_at: str | None = None) -> CultMeshSimulationFactCommit:
+        if not bool(candidate.get("hasQuorum") if "hasQuorum" in candidate else candidate.get("has_quorum")):
+            raise ValueError("Simulation candidate cannot be committed before quorum")
+        key = CultMeshSimulationFact.create_record_key(candidate)
+        fact = CultMeshSimulationFact.from_candidate(candidate, committed_at=committed_at)
+        self.node.put(self.document, key, fact)
+        return CultMeshSimulationFactCommit(key=key, fact=fact)
diff --git a/packages/cultcache-py/src/cultcache_py/verify.py b/packages/cultmesh-py/src/cultmesh_py/verify.py
similarity index 98%
rename from packages/cultcache-py/src/cultcache_py/verify.py
rename to packages/cultmesh-py/src/cultmesh_py/verify.py
index b6a85430..068f5dc2 100644
--- a/packages/cultcache-py/src/cultcache_py/verify.py
+++ b/packages/cultmesh-py/src/cultmesh_py/verify.py
@@ -6,7 +6,7 @@ import json
 from importlib import resources
 from typing import Any
 
-from .benchmark import run_benchmark
+from cultnet_py.benchmark import run_benchmark
 
 
 EXPECTED_EXPORTS: dict[str, tuple[str, ...]] = {
@@ -150,7 +150,7 @@ EXPECTED_EXPORTS: dict[str, tuple[str, ...]] = {
 
 
 def main(argv: list[str] | None = None) -> int:
-    parser = argparse.ArgumentParser(prog="cultcache-py-verify")
+    parser = argparse.ArgumentParser(prog="cultmesh-py-verify")
     parser.add_argument("--records", type=int, default=64)
     parser.add_argument("--json", action="store_true", dest="emit_json")
     args = parser.parse_args(argv)
@@ -159,7 +159,7 @@ def main(argv: list[str] | None = None) -> int:
     if args.emit_json:
         print(json.dumps(result, indent=2, sort_keys=True))
     else:
-        print(f"cultcache-py verify: {result['status']}")
+        print(f"cultmesh-py verify: {result['status']}")
         for check in result["checks"]:
             print(f"- {check['name']}: {check['status']}")
     return 0 if result["status"] == "ok" else 1
diff --git a/packages/cultmesh-py/tests/test_cultmesh.py b/packages/cultmesh-py/tests/test_cultmesh.py
new file mode 100644
index 00000000..b6a21bb8
--- /dev/null
+++ b/packages/cultmesh-py/tests/test_cultmesh.py
@@ -0,0 +1,4491 @@
+from __future__ import annotations
+
+import json
+import os
+import socket
+import subprocess
+import sys
+import tempfile
+import threading
+import time
+import unittest
+from unittest.mock import patch
+from dataclasses import dataclass
+from datetime import UTC, datetime, timedelta
+from pathlib import Path
+from typing import Any, Callable
+from cultcache_py import (
+    CultCache,
+    SingleFileMessagePackBackingStore,
+    define_database_entry_type,
+    define_document_type,
+)
+from cultcache_py.interop import INTEROP_SCHEMA_VERSION, interop_note_document
+from cultmesh_py.verify import verify
+from cultnet_py import (
+    compute_simulation_claim_hash,
+    CultNetClientAuthorityScope,
+    CultNetRawClient,
+    CultNetRawDocumentRecord,
+    CultNetRawSnapshotResponse,
+    CultNetSchemaCatalog,
+    CultNetShardCatalog,
+    CultNetShardDescriptor,
+    CultNetShardLogResponse,
+    CultNetFileShardReplicaCursorStore,
+    CultNetFileShardMutationLogStore,
+    CultNetInMemoryShardReplicaCursorStore,
+    CultNetSchemaWriteForwarder,
+    CultNetSchemaShardLogFetcher,
+    CultNetSchemaShardSnapshotFetcher,
+    CultNetPeerError,
+    CultNetShardReplicator,
+    CultNetShardReplicatorOptions,
+    CultNetShardMutationLogStore,
+    CultNetShardWriteForwarder,
+    CultNetSimulationConsensusOptions,
+    CultNetSimulationConsensusCandidate,
+    CultNetSimulationObservation,
+    CultNetSimulationObservationHub,
+    CultNetRudpSocketMode,
+    CultNetRudpSocketTransportConnection,
+    CultNetRudpSocketTransportOptions,
+    apply_shard_log_response,
+    document_delete,
+    document_put_raw,
+    hello,
+    simulation_observation,
+    snapshot_request,
+)
+from cultmesh_py import create_node
+from cultmesh_py import (
+    CultMesh,
+    CultMeshDatabase,
+    CultMeshDatabaseChange,
+    CultMeshGameSessionOptions,
+    CultMeshNodeOptions,
+    CultMeshReactiveDocumentOptions,
+    CultMeshPeerCard,
+    CultMeshPeerCatalog,
+    CultMeshSimulationFact,
+    CultMeshAuthorityLease,
+    CultMeshAuthorityLeaseCatalog,
+    CultMeshHmacAuthorityLeaseVerifier,
+    CultMeshDiscoveryClient,
+    CultMeshPeerExchangeClient,
+    CultMeshPeerHealthMonitor,
+    CultMeshSimulationObservationFanout,
+    CultMeshSnapshotFanout,
+    CultMeshStreamCatalog,
+    CultMeshStreamConsumerProfile,
+    CultMeshStreamDescriptor,
+    CultMeshStreamFrameHandle,
+    CultMeshVerseCatalog,
+    CultMeshVerseCompatibility,
+    CultMeshVerseDescriptor,
+    CultMeshVerseDiscoveryClient,
+    READY_SCHEMA_VERSION,
+    peer_exchange_request,
+    simulation_fact_document,
+    verse_catalog_request,
+)
+
+
+def bind_udp_socket() -> socket.socket:
+    sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
+    sock.bind(("127.0.0.1", 0))
+    sock.settimeout(0.02)
+    return sock
+
+
+def pump_rudp_handshake(
+    client: CultNetRudpSocketTransportConnection,
+    server: CultNetRudpSocketTransportConnection,
+) -> None:
+    for _ in range(20):
+        server.receive_once()
+        client.receive_once()
+        server.receive_once()
+        if client.connected and server.connected:
+            return
+        time.sleep(0.005)
+    raise AssertionError("RUDP socket handshake did not complete")
+
+
+def receive_rudp_frame(transport: CultNetRudpSocketTransportConnection):
+    for _ in range(20):
+        frame = transport.receive_once()
+        if frame is not None:
+            return frame
+        time.sleep(0.005)
+    raise AssertionError("RUDP socket frame was not delivered")
+
+
+@dataclass
+class Item:
+    name: str
+    category: str
+    value: int
+
+
+class CultMeshTests(unittest.TestCase):
+    def _wait_until(self, predicate: Callable[[], bool], *, timeout_seconds: float = 2.0) -> None:
+        deadline = time.monotonic() + timeout_seconds
+        while time.monotonic() < deadline:
+            if predicate():
+                return
+            time.sleep(0.01)
+        self.fail("Timed out waiting for condition")
+
+    def test_verify_reports_python_runtime_surface_health(self) -> None:
+        result = verify(records=4)
+
+        self.assertEqual(result["status"], "ok")
+        self.assertEqual(
+            {check["name"] for check in result["checks"]},
+            {
+                "public_exports",
+                "typed_markers",
+                "local_cultmesh_wire_smoke",
+                "cultmesh_capability_truth",
+                "benchmark_sanity",
+            },
+        )
+        by_name = {check["name"]: check for check in result["checks"]}
+        self.assertEqual(by_name["public_exports"]["missing"], {})
+        self.assertEqual(by_name["cultmesh_capability_truth"]["failures"], [])
+
+    def test_cultmesh_client_uses_rudp_schema_transport_endpoint(self) -> None:
+        import msgpack  # type: ignore
+
+        server_socket = bind_udp_socket()
+        server_host, server_port = server_socket.getsockname()[:2]
+        connection_id = 0x43554C54
+        server = CultNetRudpSocketTransportConnection(
+            CultNetRudpSocketTransportOptions(
+                runtime_id="python-rudp-schema-server",
+                socket=server_socket,
+                mode=CultNetRudpSocketMode.SERVER,
+                connection_id=connection_id,
+                initial_sequence=100,
+                resend_delay_ms=25,
+            )
+        )
+        received_messages: list[dict[str, object]] = []
+
+        def serve_once() -> None:
+            deadline = time.monotonic() + 2.0
+            try:
+                while time.monotonic() < deadline:
+                    frame = server.receive_once()
+                    server.poll_resends()
+                    if frame is None:
+                        time.sleep(0.005)
+                        continue
+                    received = msgpack.unpackb(frame.payload, raw=False)
+                    received_messages.append(received)
+                    response = {
+                        "schemaVersion": "cultnet.schema_catalog_response.v0",
+                        "messageId": received["messageId"],
+                        "schemas": [],
+                    }
+                    server.send("schema", msgpack.packb(response, use_bin_type=True))
+                    return
+                raise AssertionError("RUDP schema server did not receive a request")
+            finally:
+                server.close()
+
+        server_thread = threading.Thread(target=serve_once, daemon=True)
+        server_thread.start()
+        client = CultMesh.create_client(
+            endpoint=f"rudp://{server_host}:{server_port}",
+            timeout_seconds=2.0,
+            connection_id=connection_id,
+            runtime_id="python-rudp-schema-client",
+        )
+
+        response = client.fetch_schema_catalog(message_id="rudp-transport-factory")
+        server_thread.join(timeout=2.0)
+
+        self.assertFalse(server_thread.is_alive())
+        self.assertEqual(response["schemaVersion"], "cultnet.schema_catalog_response.v0")
+        self.assertEqual(response["messageId"], "rudp-transport-factory")
+        self.assertEqual(received_messages[0]["schemaVersion"], "cultnet.schema_catalog_request.v0")
+        self.assertEqual(received_messages[0]["messageId"], "rudp-transport-factory")
+
+    def test_cultmesh_facade_creates_rudp_client_from_peer_endpoint(self) -> None:
+        connection_id = 0x10203042
+        server = CultMesh.create_rudp_server(
+            "python-cultmesh-rudp-server",
+            connection_id,
+            initial_sequence=100,
+            resend_delay_ms=25,
+            max_fragment_bytes=1024,
+            max_pending_reliable_packets=16,
+        )
+        server_host, server_port = server.socket.getsockname()[:2]
+        endpoint = CultMesh.parse_rudp_endpoint(f"rudp://{server_host}:{server_port}")
+        self.assertEqual(endpoint.host, server_host)
+        self.assertEqual(endpoint.port, server_port)
+        peer = CultMeshPeerCard(
+            peer_id="python-cultmesh-rudp-server",
+            verse_id="local",
+            endpoints=(endpoint.uri,),
+            roles=("schema",),
+            authority_lease_id="lease:python-cultmesh-rudp-server",
+        )
+        peers = CultMesh.create_peer_catalog()
+        leases = CultMesh.create_authority_lease_catalog()
+        peers.upsert(peer)
+        with self.assertRaisesRegex(ValueError, "No authorized RUDP peer"):
+            CultMesh.create_rudp_client_for_authorized_peer(
+                "python-cultmesh-rudp-client",
+                connection_id,
+                peers,
+                leases,
+                "local",
+                "schema",
+                resend_delay_ms=25,
+                max_fragment_bytes=1024,
+                max_pending_reliable_packets=16,
+            )
+        leases.upsert(
+            CultMeshAuthorityLease(
+                lease_id="lease:python-cultmesh-rudp-server",
+                verse_id="local",
+                peer_id="python-cultmesh-rudp-server",
+                roles=("schema",),
+                valid_from=datetime.now(UTC) - timedelta(seconds=1),
+                expires_at=datetime.now(UTC) + timedelta(seconds=30),
+                issuer_runtime_id="python-authority",
+            )
+        )
+        client = CultMesh.create_rudp_client_for_authorized_peer(
+            "python-cultmesh-rudp-client",
+            connection_id,
+            peers,
+            leases,
+            "local",
+            "schema",
+            resend_delay_ms=25,
+            max_fragment_bytes=1024,
+            max_pending_reliable_packets=16,
+        )
+
+        try:
+            client.connect(b"join")
+            pump_rudp_handshake(client, server)
+            self.assertTrue(client.connected)
+            self.assertTrue(server.connected)
+
+            client.send("schema", b"client-state")
+            server_frame = receive_rudp_frame(server)
+            self.assertEqual(server_frame.channel_id, "schema")
+            self.assertEqual(server_frame.payload, b"client-state")
+            self.assertEqual(server.profile["transports"][0]["protocol"], "rudp")
+            self.assertEqual(client.profile["transports"][0]["protocol"], "rudp")
+        finally:
+            client.close()
+            server.close()
+
+    def test_cultmesh_node_applies_foreign_schema_snapshot_as_local_update(self) -> None:
+        document = define_database_entry_type(
+            "mesh.runtime-policy",
+            [
+                ("schema_version", 0),
+                ("name", 1),
+                ("value", 2),
+            ],
+            schema_id="mesh.runtime-policy.current",
+            schema_name="mesh.runtime_policy",
+            schema_version="mesh.runtime_policy.v1",
+        )
+        node = create_node(runtime_id="python-node")
+        node.register_document(document)
+        node.put(document, "policy:1", {
+            "schema_version": "mesh.runtime_policy.v1",
+            "name": "policy",
+            "value": "old",
+        })
+        observed: list[CultMeshDatabaseChange] = []
+        unsubscribe = node.database.watch_record(document, "policy:1", observed.append)
+        try:
+            applied = node.database.apply_snapshot_response({
+                "schemaVersion": "cultnet.snapshot_response_raw.v0",
+                "messageId": "foreign-schema-snapshot",
+                "documents": [
+                    {
+                        "schemaId": "sha256:foreign-mesh-runtime-policy",
+                        "recordKey": "policy:1",
+                        "storedAt": "2026-06-25T00:00:00Z",
+                        "payloadEncoding": "messagepack",
+                        "payload": document.encode_payload({
+                            "schema_version": "mesh.runtime_policy.v1",
+                            "name": "policy",
+                            "value": "new",
+                        }),
+                    },
+                ],
+            })
+        finally:
+            unsubscribe()
+
+        local_schema_id = document.catalog_entry().schema_id
+        self.assertEqual(applied[0].schema_id, local_schema_id)
+        self.assertEqual(observed[0].schema_id, local_schema_id)
+        self.assertEqual(observed[0].change_kind, "updated")
+        self.assertEqual(observed[0].previous_value["value"], "old")
+        self.assertEqual(observed[0].value["value"], "new")
+        self.assertEqual(node.cache.get_required_envelope(document, "policy:1").schema_id, local_schema_id)
+
+    def test_cultmesh_node_syncs_snapshot_and_shard_log_through_cultnet_client(self) -> None:
+        import msgpack  # type: ignore
+        from cultnet_py import read_frame, write_frame
+
+        document = define_database_entry_type(
+            "mesh.sync_item",
+            [
+                ("name", 0),
+                ("category", 1),
+                ("value", 2, 0),
+            ],
+            cls=Item,
+        )
+        node = create_node(runtime_id="python-node")
+        node.register_document(document)
+        schema_id = document.catalog_entry().schema_id
+        ready = threading.Event()
+        server_error: list[BaseException] = []
+        port_holder: list[int] = []
+
+        def serve_requests() -> None:
+            try:
+                with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as server:
+                    server.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
+                    server.bind(("127.0.0.1", 0))
+                    port_holder.append(server.getsockname()[1])
+                    server.listen(2)
+                    ready.set()
+                    for _ in range(2):
+                        connection, _ = server.accept()
+                        with connection:
+                            stream = connection.makefile("rwb")
+                            request = msgpack.unpackb(read_frame(stream), raw=False)
+                            if request["schemaVersion"] == "cultnet.snapshot_request.v0":
+                                response = {
+                                    "schemaVersion": "cultnet.snapshot_response_raw.v0",
+                                    "messageId": request["messageId"],
+                                    "documents": [
+                                        {
+                                            "schemaId": schema_id,
+                                            "recordKey": "item:node",
+                                            "storedAt": "2026-06-13T00:00:00Z",
+                                            "payloadEncoding": "messagepack",
+                                            "payload": document.encode_payload(Item("node", "mesh", 1)),
+                                        }
+                                    ],
+                                }
+                            elif request["schemaVersion"] == "cultnet.shard_log_request.v0":
+                                response = {
+                                    "schemaVersion": "cultnet.shard_log_response.v0",
+                                    "messageId": request["messageId"],
+                                    "shardId": request["shardId"],
+                                    "shardEpoch": request["shardEpoch"],
+                                    "resyncRequired": False,
+                                    "entries": [
+                                        {
+                                            "sequence": 1,
+                                            "changeKind": "updated",
+                                            "put": {
+                                                "schemaVersion": "cultnet.document_put_raw.v0",
+                                                "messageId": "put-node",
+                                                "document": {
+                                                    "schemaId": schema_id,
+                                                    "recordKey": "item:node",
+                                                    "storedAt": "2026-06-13T00:00:01Z",
+                                                    "payloadEncoding": "messagepack",
+                                                    "payload": document.encode_payload(Item("node", "mesh", 9)),
+                                                },
+                                                "shardId": request["shardId"],
+                                                "shardEpoch": request["shardEpoch"],
+                                            },
+                                        }
+                                    ],
+                                }
+                            else:
+                                raise AssertionError(f"unexpected request {request['schemaVersion']}")
+                            write_frame(stream, msgpack.packb(response, use_bin_type=True))
+                            stream.flush()
+            except BaseException as error:
+                server_error.append(error)
+                ready.set()
+
+        thread = threading.Thread(target=serve_requests, daemon=True)
+        thread.start()
+        self.assertTrue(ready.wait(2.0))
+        self.assertFalse(server_error)
+
+        client = CultNetRawClient("127.0.0.1", port_holder[0], timeout_seconds=2.0)
+        snapshot_changes = node.sync_snapshot(client, schema_ids=[schema_id])
+        log_changes = node.sync_shard_log(client, shard_id="mesh", shard_epoch=1)
+
+        thread.join(2.0)
+        self.assertFalse(server_error)
+        self.assertEqual(snapshot_changes[0].record_key, "item:node")
+        self.assertEqual(log_changes[0].change_kind, "updated")
+        self.assertEqual(node.get_required(document, "item:node").value, 9)
+
+    def test_cultmesh_node_sync_document_returns_requested_alias_type(self) -> None:
+        @dataclass
+        class CanonicalNote:
+            body: str
+
+        @dataclass
+        class UiNote:
+            body: str
+
+        document = define_database_entry_type(
+            "mesh.sync_alias_note",
+            [("body", 0)],
+            cls=CanonicalNote,
+            schema_id="mesh.sync_alias_note.v1",
+            schema_name="mesh.sync_alias_note",
+            schema_version="mesh.sync_alias_note.v1",
+        )
+        alias = define_database_entry_type(
+            "mesh.sync_alias_note.ui",
+            [("body", 0)],
+            cls=UiNote,
+            schema_id="mesh.sync_alias_note.v1",
+            schema_name="mesh.sync_alias_note",
+            schema_version="mesh.sync_alias_note.v1",
+        )
+        node = create_node(runtime_id="python-node")
+        node.register_document(document)
+        requests: list[dict[str, Any]] = []
+
+        class SnapshotClient:
+            def fetch_snapshot_response(
+                self,
+                *,
+                schema_ids: list[str] | None = None,
+                record_keys: list[str] | None = None,
+                shard_id: str | None = None,
+                shard_epoch: int | None = None,
+            ) -> dict[str, Any]:
+                requests.append({
+                    "schema_ids": schema_ids,
+                    "record_keys": record_keys,
+                    "shard_id": shard_id,
+                    "shard_epoch": shard_epoch,
+                })
+                return {
+                    "schemaVersion": "cultnet.snapshot_response_raw.v0",
+                    "messageId": "sync-document",
+                    "documents": [
+                        {
+                            "schemaId": document.catalog_entry().schema_id,
+                            "recordKey": "note:remote",
+                            "storedAt": "2026-06-27T00:00:00Z",
+                            "payloadEncoding": "messagepack",
+                            "payload": document.encode_payload(CanonicalNote("synced-alias")),
+                        }
+                    ],
+                }
+
+        synced = node.sync_document(SnapshotClient(), alias, "note:remote")
+        facade_synced = CultMesh.sync_document(node, SnapshotClient(), alias, "note:remote")
+
+        self.assertIsInstance(synced, UiNote)
+        self.assertEqual(synced.body, "synced-alias")
+        self.assertIsInstance(facade_synced, UiNote)
+        self.assertEqual(facade_synced.body, "synced-alias")
+        self.assertEqual(node.get_required(document, "note:remote").body, "synced-alias")
+        self.assertIsInstance(node.get_required(alias, "note:remote"), UiNote)
+        self.assertEqual(requests, [
+            {
+                "schema_ids": ["mesh.sync_alias_note.v1"],
+                "record_keys": ["note:remote"],
+                "shard_id": None,
+                "shard_epoch": None,
+            },
+            {
+                "schema_ids": ["mesh.sync_alias_note.v1"],
+                "record_keys": ["note:remote"],
+                "shard_id": None,
+                "shard_epoch": None,
+            },
+        ])
+
+    def test_cultmesh_node_sync_document_from_publication_returns_requested_alias_type(self) -> None:
+        @dataclass
+        class CanonicalNote:
+            body: str
+
+        @dataclass
+        class UiNote:
+            body: str
+
+        document = define_database_entry_type(
+            "mesh.publication_alias_note",
+            [("body", 0)],
+            cls=CanonicalNote,
+            schema_id="mesh.publication_alias_note.v1",
+            schema_name="mesh.publication_alias_note",
+            schema_version="mesh.publication_alias_note.v1",
+        )
+        alias = define_database_entry_type(
+            "mesh.publication_alias_note.ui",
+            [("body", 0)],
+            cls=UiNote,
+            schema_id="mesh.publication_alias_note.v1",
+            schema_name="mesh.publication_alias_note",
+            schema_version="mesh.publication_alias_note.v1",
+        )
+        node = create_node(runtime_id="python-publication-node")
+        node.register_document(document)
+        requests: list[dict[str, Any]] = []
+
+        class SnapshotClient:
+            def fetch_snapshot_response(
+                self,
+                *,
+                schema_ids: list[str] | None = None,
+                record_keys: list[str] | None = None,
+                shard_id: str | None = None,
+                shard_epoch: int | None = None,
+            ) -> dict[str, Any]:
+                requests.append({
+                    "schema_ids": schema_ids,
+                    "record_keys": record_keys,
+                    "shard_id": shard_id,
+                    "shard_epoch": shard_epoch,
+                })
+                return {
+                    "schemaVersion": "cultnet.snapshot_response_raw.v0",
+                    "messageId": "publication-sync-document",
+                    "documents": [
+                        {
+                            "schemaId": document.catalog_entry().schema_id,
+                            "recordKey": "note:published-peer",
+                            "storedAt": "2026-06-27T00:00:00Z",
+                            "payloadEncoding": "messagepack",
+                            "payload": document.encode_payload(CanonicalNote("peer-publication-alias")),
+                        }
+                    ],
+                }
+
+        source = CultMesh.publication_source_from_peer_snapshot(
+            SnapshotClient(),
+            shard_id="notes",
+            shard_epoch=3,
+        )
+
+        synced = node.sync_document_from_publication(source, alias, "note:published-peer")
+        facade_synced = CultMesh.sync_document_from_publication(node, source, alias, "note:published-peer")
+
+        self.assertIsInstance(synced, UiNote)
+        self.assertEqual(synced.body, "peer-publication-alias")
+        self.assertIsInstance(facade_synced, UiNote)
+        self.assertEqual(facade_synced.body, "peer-publication-alias")
+        self.assertEqual(node.get_required(document, "note:published-peer").body, "peer-publication-alias")
+        self.assertEqual(requests, [
+            {
+                "schema_ids": ["mesh.publication_alias_note.v1"],
+                "record_keys": ["note:published-peer"],
+                "shard_id": "notes",
+                "shard_epoch": 3,
+            },
+            {
+                "schema_ids": ["mesh.publication_alias_note.v1"],
+                "record_keys": ["note:published-peer"],
+                "shard_id": "notes",
+                "shard_epoch": 3,
+            },
+        ])
+
+    def test_cultmesh_node_sync_document_from_single_file_publication_uses_node_aliases(self) -> None:
+        @dataclass
+        class CanonicalNote:
+            body: str
+
+        @dataclass
+        class UiNote:
+            body: str
+
+        document = define_database_entry_type(
+            "mesh.file_publication_alias_note",
+            [("body", 0)],
+            cls=CanonicalNote,
+            schema_id="mesh.file_publication_alias_note.v1",
+            schema_name="mesh.file_publication_alias_note",
+            schema_version="mesh.file_publication_alias_note.v1",
+        )
+        alias = define_database_entry_type(
+            "mesh.file_publication_alias_note.ui",
+            [("body", 0)],
+            cls=UiNote,
+            schema_id="mesh.file_publication_alias_note.v1",
+            schema_name="mesh.file_publication_alias_note",
+            schema_version="mesh.file_publication_alias_note.v1",
+        )
+        with tempfile.TemporaryDirectory() as tmp:
+            path = Path(tmp) / "publication.ccmp"
+            writer = CultCache()
+            writer.register_document_type(document)
+            writer.add_generic_store(SingleFileMessagePackBackingStore(path))
+            writer.put(document, "note:published-file", CanonicalNote("file-publication-alias"))
+
+            node = create_node(runtime_id="python-file-publication-node")
+            node.register_document(document)
+            source = CultMesh.publication_source_from_single_file(path)
+
+            synced = CultMesh.sync_document_from_publication(node, source, alias, "note:published-file")
+
+        self.assertIsInstance(synced, UiNote)
+        self.assertEqual(synced.body, "file-publication-alias")
+        self.assertEqual(node.get_required(document, "note:published-file").body, "file-publication-alias")
+        self.assertIsInstance(node.get_required(alias, "note:published-file"), UiNote)
+
+    def test_cultmesh_node_sync_documents_from_publication_uses_binding_sources_and_aliases(self) -> None:
+        @dataclass
+        class CanonicalNote:
+            body: str
+
+        @dataclass
+        class UiNote:
+            body: str
+
+        document = define_database_entry_type(
+            "mesh.catalog_publication_alias_note",
+            [("body", 0)],
+            cls=CanonicalNote,
+            schema_id="mesh.catalog_publication_alias_note.v1",
+            schema_name="mesh.catalog_publication_alias_note",
+            schema_version="mesh.catalog_publication_alias_note.v1",
+        )
+        alias = define_database_entry_type(
+            "mesh.catalog_publication_alias_note.ui",
+            [("body", 0)],
+            cls=UiNote,
+            schema_id="mesh.catalog_publication_alias_note.v1",
+            schema_name="mesh.catalog_publication_alias_note",
+            schema_version="mesh.catalog_publication_alias_note.v1",
+        )
+        with tempfile.TemporaryDirectory() as tmp:
+            first_path = Path(tmp) / "first.ccmp"
+            second_path = Path(tmp) / "second.ccmp"
+            first = CultCache()
+            first.register_document_type(document)
+            first.add_generic_store(SingleFileMessagePackBackingStore(first_path))
+            first.put(document, "note:first", CanonicalNote("first catalog publication"))
+            second = CultCache()
+            second.register_document_type(document)
+            second.add_generic_store(SingleFileMessagePackBackingStore(second_path))
+            second.put(document, "note:second", CanonicalNote("second catalog publication"))
+
+            node = create_node(runtime_id="python-catalog-publication-node")
+            node.register_document(document)
+            source = CultMesh.publication_source_from_single_file(first_path)
+            bindings = [
+                CultMesh.publication_document(alias, "note:first"),
+                CultMesh.publication_document(
+                    alias,
+                    "note:second",
+                    source=CultMesh.publication_source_from_single_file(second_path),
+                ),
+            ]
+
+            synced = node.sync_documents_from_publication(source, bindings)
+            facade_synced = CultMesh.sync_documents_from_publication(node, source, bindings)
+
+        self.assertEqual([value.body for value in synced], [
+            "first catalog publication",
+            "second catalog publication",
+        ])
+        self.assertTrue(all(isinstance(value, UiNote) for value in synced))
+        self.assertEqual([value.body for value in facade_synced], [
+            "first catalog publication",
+            "second catalog publication",
+        ])
+        self.assertEqual(node.get_required(document, "note:first").body, "first catalog publication")
+        self.assertEqual(node.get_required(document, "note:second").body, "second catalog publication")
+        self.assertIsInstance(node.get_required(alias, "note:second"), UiNote)
+
+    def test_cultmesh_node_emits_raw_put_and_delete_messages_for_local_writes(self) -> None:
+        document = define_database_entry_type(
+            "mesh.emit_item",
+            [
+                ("name", 0),
+                ("category", 1),
+                ("value", 2, 0),
+            ],
+            cls=Item,
+        )
+        node = create_node(runtime_id="python-node")
+        node.register_document(document)
+
+        put = node.put_raw_message(
+            document,
+            "item:emit",
+            Item("wand", "gear", 4),
+            message_id="put-emit",
+            shard_id="mesh",
+            shard_epoch=1,
+        ).to_wire()
+        self.assertEqual(node.get_required(document, "item:emit").name, "wand")
+        self.assertEqual(put["schemaVersion"], "cultnet.document_put_raw.v0")
+        self.assertEqual(put["messageId"], "put-emit")
+        self.assertEqual(put["document"]["schemaId"], document.catalog_entry().schema_id)
+        self.assertEqual(put["document"]["recordKey"], "item:emit")
+        self.assertEqual(put["document"]["sourceRuntimeId"], "python-node")
+        self.assertEqual(put["shardId"], "mesh")
+        self.assertEqual(put["shardEpoch"], 1)
+
+        delete = node.delete_raw_message(
+            document,
+            "item:emit",
+            message_id="delete-emit",
+            shard_id="mesh",
+            shard_epoch=1,
+        ).to_wire()
+        self.assertIsNone(node.get(document, "item:emit"))
+        self.assertEqual(delete["schemaVersion"], "cultnet.document_delete.v0")
+        self.assertEqual(delete["messageId"], "delete-emit")
+        self.assertEqual(delete["schemaId"], document.catalog_entry().schema_id)
+        self.assertEqual(delete["recordKey"], "item:emit")
+        self.assertEqual(delete["shardId"], "mesh")
+        self.assertEqual(delete["shardEpoch"], 1)
+
+    def test_cultmesh_node_resolves_same_schema_aliases_for_local_state(self) -> None:
+        @dataclass
+        class CanonicalNote:
+            body: str
+
+        @dataclass
+        class UiNote:
+            body: str
+
+        document = define_database_entry_type(
+            "mesh.alias_note",
+            [("body", 0)],
+            cls=CanonicalNote,
+            schema_id="mesh.alias_note.v1",
+            schema_name="mesh.alias_note",
+            schema_version="mesh.alias_note.v1",
+        )
+        alias = define_database_entry_type(
+            "mesh.alias_note.ui",
+            [("body", 0)],
+            cls=UiNote,
+            schema_id="mesh.alias_note.v1",
+            schema_name="mesh.alias_note",
+            schema_version="mesh.alias_note.v1",
+        )
+        node = create_node(runtime_id="python-node")
+        node.register_document(document)
+        seen: list[CultMeshDatabaseChange] = []
+        all_seen: list[CultMeshDatabaseChange] = []
+        node.database.watch(all_seen.append, document=alias)
+        node.database.watch_record(alias, "note:alias", seen.append)
+
+        node.put(alias, "note:alias", UiNote("from-alias-put"))
+        self.assertEqual(node.get_required(document, "note:alias").body, "from-alias-put")
+        alias_value = node.get_required(alias, "note:alias")
+        self.assertIsInstance(alias_value, UiNote)
+        self.assertEqual(alias_value.body, "from-alias-put")
+        alias_collection = node.get_all(alias)
+        self.assertEqual(len(alias_collection), 1)
+        self.assertIsInstance(alias_collection[0], UiNote)
+        self.assertEqual(alias_collection[0].body, "from-alias-put")
+        self.assertEqual(seen[0].document.type, alias.type)
+        self.assertEqual(seen[0].schema_id, "mesh.alias_note.v1")
+        self.assertIsInstance(seen[0].value, UiNote)
+        self.assertEqual(seen[0].value.body, "from-alias-put")
+        self.assertEqual(all_seen[0].document.type, alias.type)
+        self.assertIsInstance(all_seen[0].value, UiNote)
+        self.assertEqual(all_seen[0].value.body, "from-alias-put")
+
+        node.put(document, "note:alias", CanonicalNote("from-canonical-put"))
+        self.assertEqual(seen[1].document.type, alias.type)
+        self.assertIsInstance(seen[1].value, UiNote)
+        self.assertIsInstance(seen[1].previous_value, UiNote)
+        self.assertEqual(seen[1].value.body, "from-canonical-put")
+        self.assertEqual(seen[1].previous_value.body, "from-alias-put")
+
+        put = node.put_raw_message(
+            alias,
+            "note:alias",
+            UiNote("from-alias-raw-put"),
+            message_id="alias-put",
+        ).to_wire()
+        self.assertEqual(put["document"]["schemaId"], "mesh.alias_note.v1")
+        self.assertEqual(put["document"]["recordKey"], "note:alias")
+        self.assertEqual(node.get_required(alias, "note:alias").body, "from-alias-raw-put")
+
+        delete = node.delete_raw_message(alias, "note:alias", message_id="alias-delete").to_wire()
+        self.assertEqual(delete["schemaId"], "mesh.alias_note.v1")
+        self.assertIsNone(node.get(alias, "note:alias"))
+        self.assertEqual(node.get_all(alias), [])
+
+    def test_cultmesh_reactive_document_coalesces_explicit_alias_updates(self) -> None:
+        @dataclass
+        class CanonicalNote:
+            body: str
+            revision: int
+
+        @dataclass
+        class UiNote:
+            body: str
+            revision: int
+
+        document = define_database_entry_type(
+            "mesh.reactive_alias_note",
+            [("body", 0), ("revision", 1)],
+            cls=CanonicalNote,
+            schema_id="mesh.reactive_alias_note.v1",
+            schema_name="mesh.reactive_alias_note",
+            schema_version="mesh.reactive_alias_note.v1",
+        )
+        alias = define_database_entry_type(
+            "mesh.reactive_alias_note.ui",
+            [("body", 0), ("revision", 1)],
+            cls=UiNote,
+            schema_id="mesh.reactive_alias_note.v1",
+            schema_name="mesh.reactive_alias_note",
+            schema_version="mesh.reactive_alias_note.v1",
+        )
+        node = create_node(runtime_id="python-reactive")
+        node.register_document(document)
+        node.put(document, "note:reactive", CanonicalNote("initial", 1))
+        seen: list[CultMeshDatabaseChange] = []
+        node.database.watch_record(alias, "note:reactive", seen.append)
+
+        reactive = node.authoritative_writer(alias, "note:reactive").reactive(
+            CultMeshReactiveDocumentOptions(flush_delay_seconds=0.02)
+        )
+        try:
+            self.assertIsInstance(reactive.snapshot, UiNote)
+            reactive.update(lambda note: setattr(note, "body", "first-local-edit"))
+            reactive.update(lambda note: setattr(note, "body", "second-local-edit"))
+            reactive.update(lambda note: setattr(note, "revision", 2))
+
+            self._wait_until(lambda: node.get_required(alias, "note:reactive").body == "second-local-edit")
+
+            self.assertFalse(reactive.is_dirty)
+            self.assertEqual(node.get_required(document, "note:reactive").revision, 2)
+            self.assertEqual(seen[-1].value.body, "second-local-edit")
+        finally:
+            reactive.dispose()
+
+    def test_cultmesh_reactive_document_tracks_canonical_reconciliation_delta(self) -> None:
+        @dataclass
+        class Note:
+            body: str
+            revision: int
+
+        document = define_database_entry_type(
+            "mesh.reactive_reconcile_note",
+            [("body", 0), ("revision", 1)],
+            cls=Note,
+            schema_id="mesh.reactive_reconcile_note.v1",
+            schema_name="mesh.reactive_reconcile_note",
+            schema_version="mesh.reactive_reconcile_note.v1",
+        )
+        node = create_node(runtime_id="python-reactive-reconcile")
+        node.register_document(document)
+        node.put(document, "note:reconcile", Note("initial", 1))
+
+        reactive = CultMesh.authoritative_writer(
+            node,
+            document,
+            "note:reconcile",
+        ).reactive(CultMeshReactiveDocumentOptions(flush_delay_seconds=60))
+        try:
+            reactive.update(lambda note: setattr(note, "body", "local-prediction"))
+            reactive.update(lambda note: setattr(note, "revision", 2))
+
+            node.put(document, "note:reconcile", Note("authoritative", 7))
+
+            self.assertEqual(reactive.snapshot.body, "local-prediction")
+            self.assertIsNotNone(reactive.reconciliation)
+            self.assertEqual(reactive.reconciliation.canonical.body, "authoritative")
+            self.assertEqual(reactive.reconciliation.predicted.body, "local-prediction")
+            self.assertEqual(reactive.reconciliation.delta["body"], "local-prediction")
+            self.assertEqual(reactive.reconciliation.delta["revision"], -5)
+
+            reactive.flush()
+            self.assertEqual(node.get_required(document, "note:reconcile").body, "local-prediction")
+            self.assertIsNone(reactive.reconciliation)
+        finally:
+            reactive.dispose()
+
+    def test_cultmesh_reactive_document_is_idle_until_explicit_nested_update(self) -> None:
+        document = define_document_type(
+            "mesh.nested_loadout",
+            encode=lambda value: value,
+            decode=lambda value: value,
+        )
+        node = create_node(runtime_id="python-reactive-nested")
+        node.register_document(document)
+        node.put(
+            document,
+            "ship:nested",
+            {"loadout": {"weapon": {"tuning": {"damage": 10}}}},
+        )
+
+        with patch("cultmesh_py.node.threading.Timer") as timer:
+            reactive = node.authoritative_writer(document, "ship:nested").reactive()
+            timer.assert_not_called()
+
+        try:
+            borrowed = reactive.snapshot
+            borrowed["loadout"]["weapon"]["tuning"]["damage"] = 99
+            self.assertEqual(
+                node.get_required(document, "ship:nested")["loadout"]["weapon"]["tuning"]["damage"],
+                10,
+            )
+
+            reactive.update(
+                lambda draft: draft["loadout"]["weapon"]["tuning"].__setitem__("damage", 12)
+            )
+            reactive.flush()
+
+            self.assertEqual(reactive.snapshot["loadout"]["weapon"]["tuning"]["damage"], 12)
+            self.assertEqual(
+                node.get_required(document, "ship:nested")["loadout"]["weapon"]["tuning"]["damage"],
+                12,
+            )
+        finally:
+            reactive.dispose()
+
+    def test_cultmesh_reactive_scheduling_scales_with_changed_documents_only(self) -> None:
+        document = define_document_type(
+            "mesh.reactive_scale_note",
+            encode=lambda value: value,
+            decode=lambda value: value,
+        )
+
+        for document_count in (1, 100, 1000):
+            node = create_node(runtime_id=f"python-reactive-scale-{document_count}")
+            node.register_document(document)
+            for index in range(document_count):
+                node.put(document, f"note:{index}", {"body": "initial", "revision": 1})
+
+            scheduled_timers: list[Any] = []
+
+            class FakeScheduledCall:
+                def __init__(self, delay_seconds: float, callback: Callable[[], None]) -> None:
+                    self.delay_seconds = delay_seconds
+                    self.callback = callback
+                    self.cancelled = False
+
+                def cancel(self) -> None:
+                    self.cancelled = True
+
+            class FakeScheduler:
+                def schedule(
+                    self,
+                    delay_seconds: float,
+                    callback: Callable[[], None],
+                ) -> FakeScheduledCall:
+                    call = FakeScheduledCall(delay_seconds, callback)
+                    scheduled_timers.append(call)
+                    return call
+
+            reactive_documents: list[Any] = []
+            with patch("cultmesh_py.node._REACTIVE_SCHEDULER", FakeScheduler()):
+                try:
+                    for index in range(document_count):
+                        reactive_documents.append(
+                            node.authoritative_writer(document, f"note:{index}").reactive()
+                        )
+
+                    self.assertEqual(
+                        len(scheduled_timers),
+                        0,
+                        f"{document_count} idle documents must schedule no timers",
+                    )
+
+                    changed_document_count = max(1, document_count // 100)
+                    for index in range(changed_document_count):
+                        reactive_documents[index].update(
+                            lambda draft, changed=index: draft.update(
+                                body=f"changed-{changed}",
+                                revision=2,
+                            )
+                        )
+
+                    self.assertEqual(len(scheduled_timers), changed_document_count)
+                    self.assertEqual(
+                        sum(reactive.is_dirty for reactive in reactive_documents),
+                        changed_document_count,
+                    )
+                finally:
+                    for reactive in reactive_documents:
+                        reactive.dispose()
+
+            self.assertTrue(all(timer.cancelled for timer in scheduled_timers))
+
+    def test_cultmesh_reactive_documents_share_one_lazy_scheduler_thread(self) -> None:
+        document = define_document_type(
+            "mesh.reactive_shared_scheduler_note",
+            encode=lambda value: value,
+            decode=lambda value: value,
+        )
+        node = create_node(runtime_id="python-reactive-shared-scheduler")
+        node.register_document(document)
+        reactive_documents: list[Any] = []
+        try:
+            for index in range(100):
+                node.put(document, f"note:{index}", {"body": "initial", "revision": 1})
+                reactive_documents.append(
+                    node.authoritative_writer(document, f"note:{index}").reactive(
+                        CultMeshReactiveDocumentOptions(flush_delay_seconds=60.0)
+                    )
+                )
+
+            before = sum(
+                thread.name == "cultmesh-reactive-scheduler"
+                for thread in threading.enumerate()
+            )
+            for index, reactive in enumerate(reactive_documents):
+                reactive.update(
+                    lambda draft, changed=index: draft.update(
+                        body=f"changed-{changed}",
+                        revision=2,
+                    )
+                )
+            after = sum(
+                thread.name == "cultmesh-reactive-scheduler"
+                for thread in threading.enumerate()
+            )
+
+            self.assertLessEqual(before, 1)
+            self.assertEqual(after, 1)
+        finally:
+            for reactive in reactive_documents:
+                reactive.dispose()
+
+    def test_cultmesh_observed_document_cannot_publish_borrowed_mutation(self) -> None:
+        document = define_document_type(
+            "mesh.observed_note",
+            encode=lambda value: value,
+            decode=lambda value: value,
+        )
+        node = create_node(runtime_id="python-observed")
+        node.register_document(document)
+        node.put(document, "note:observed", {"body": "initial"})
+
+        observed = node.observe_document(document, "note:observed")
+        try:
+            observed.current["body"] = "borrowed-local-edit"
+            self.assertEqual(node.get_required(document, "note:observed")["body"], "initial")
+
+            node.put(document, "note:observed", {"body": "canonical"})
+            self.assertEqual(observed.current["body"], "canonical")
+        finally:
+            observed.dispose()
+
+    def test_cultmesh_node_uses_cultcache_store(self) -> None:
+        with tempfile.TemporaryDirectory() as tmp:
+            document = define_database_entry_type("mesh.note", [("body", 0)])
+            store_path = Path(tmp) / "mesh.cc"
+            node = create_node(store_path, runtime_id="mesh-test")
+            self.assertIsInstance(node.database, CultMeshDatabase)
+            node.database.register_document(document)
+            node.database.put(document, "note:1", {"body": "hello"})
+            self.assertEqual(node.get_required(document, "note:1")["body"], "hello")
+
+            reopened = create_node(store_path, runtime_id="mesh-test")
+            reopened.database.register_document(document)
+            reopened.database.pull()
+            self.assertEqual(reopened.database.get(document, "note:1")["body"], "hello")
+
+    def test_cultmesh_node_options_attach_default_durable_shard_log_store(self) -> None:
+        with tempfile.TemporaryDirectory() as tmp:
+            document = define_database_entry_type(
+                "mesh.durable_option_note",
+                [("body", 0)],
+                schema_id="mesh.durable_option_note.v1",
+            )
+            cache_path = Path(tmp) / "world.cc"
+            node = CultMesh.create_node(
+                cache_path,
+                runtime_id="durable-option-primary",
+                options=CultMeshNodeOptions(enable_durable_shard_logs=True),
+            )
+            node.database.register_document(document)
+            node.database.put_raw_message(document, "note:1", {"body": "stored"}, shard_id="notes", shard_epoch=5)
+
+            log_path = Path(tmp) / "world.cultmesh" / "shard-logs"
+            self.assertTrue(log_path.exists())
+
+            reopened = CultMesh.start_node(
+                cache_path,
+                runtime_id="durable-option-primary",
+                enable_durable_shard_logs=True,
+            )
+            reopened.database.register_document(document)
+            response = reopened.database.build_shard_log_response(shard_id="notes", shard_epoch=5)
+
+            self.assertEqual(reopened.database.shard_ids(), ["notes"])
+            self.assertEqual([entry.sequence for entry in response.entries], [1])
+            self.assertEqual(response.entries[0].raw_document.record_key, "note:1")
+
+    def test_cultmesh_database_watchers_observe_local_changes_and_unsubscribe(self) -> None:
+        document = define_database_entry_type("mesh.watch", [("body", 0)])
+        node = CultMesh.create_node(runtime_id="mesh-watch")
+        node.database.register_document(document)
+        changes: list[CultMeshDatabaseChange] = []
+        all_changes: list[CultMeshDatabaseChange] = []
+
+        unsubscribe_record = node.database.watch_record(document, "note:1", changes.append)
+        unsubscribe_all = node.database.watch(all_changes.append, document=document)
+
+        node.database.put(document, "note:1", {"body": "hello"})
+        node.database.put(document, "note:2", {"body": "skip"})
+        node.database.put(document, "note:1", {"body": "updated"})
+        node.database.delete(document, "note:1")
+        unsubscribe_record()
+        node.database.put(document, "note:1", {"body": "after-unsubscribe"})
+        unsubscribe_all()
+
+        self.assertEqual([change.change_kind for change in changes], ["added", "updated", "removed"])
+        self.assertEqual([change.record_key for change in changes], ["note:1", "note:1", "note:1"])
+        self.assertEqual(changes[1].previous_value, {"body": "hello"})
+        self.assertIsNone(changes[2].value)
+        self.assertEqual([change.record_key for change in all_changes], ["note:1", "note:2", "note:1", "note:1", "note:1"])
+
+    def test_cultmesh_database_register_document_is_idempotent(self) -> None:
+        document = define_database_entry_type("mesh.idempotent", [("body", 0)])
+        conflicting = define_database_entry_type("mesh.idempotent", [("title", 0)])
+        node = CultMesh.create_node(runtime_id="mesh-idempotent")
+
+        node.database.register_document(document)
+        node.database.register_document(document)
+        node.database.put(document, "note:1", {"body": "still registered once"})
+
+        self.assertEqual(node.database.get_required(document, "note:1")["body"], "still registered once")
+        self.assertEqual([registered.type for registered in node.documents], ["mesh.idempotent"])
+        with self.assertRaises(ValueError):
+            node.database.register_document(conflicting)
+
+    def test_cultmesh_database_global_document_facade_uses_singleton_key_and_watchers(self) -> None:
+        document = define_database_entry_type(
+            "mesh.global_settings",
+            [("theme", 0)],
+            global_document=True,
+        )
+        node = CultMesh.create_node(runtime_id="mesh-global")
+        node.database.register_document(document)
+        changes: list[CultMeshDatabaseChange] = []
+
+        node.database.watch_global(document, changes.append)
+        node.database.put_global(document, {"theme": "ash"})
+        node.put_global(document, {"theme": "ember"})
+        node.delete_global(document)
+
+        self.assertIsNone(node.database.get_global(document))
+        self.assertEqual([change.record_key for change in changes], [node.cache.GLOBAL_KEY] * 3)
+        self.assertEqual([change.change_kind for change in changes], ["added", "updated", "removed"])
+        self.assertEqual(changes[1].previous_value, {"theme": "ash"})
+        self.assertEqual(changes[2].previous_value, {"theme": "ember"})
+        with self.assertRaises(Exception):
+            node.database.put(document, "settings:wrong", {"theme": "bad"})
+
+    def test_cultmesh_database_creates_raw_snapshot_response_from_envelopes(self) -> None:
+        document = define_database_entry_type(
+            "mesh.snapshot_note",
+            [("body", 0)],
+            schema_id="mesh.snapshot_note.v1",
+        )
+        source = CultMesh.create_node(runtime_id="mesh-snapshot-source")
+        source.database.register_document(document)
+        source.database.put(document, "note:1", {"body": "include"})
+        source.database.put(document, "note:2", {"body": "skip"})
+
+        typed_response = source.database.build_snapshot_response(
+            message_id="snapshot-1",
+            schema_ids=["mesh.snapshot_note.v1"],
+            record_keys=["note:1"],
+            shard_id="notes",
+            shard_epoch=4,
+            shard_log_sequence=7,
+        )
+        response = source.database.create_snapshot_response(
+            message_id="snapshot-1",
+            schema_ids=["mesh.snapshot_note.v1"],
+            record_keys=["note:1"],
+            shard_id="notes",
+            shard_epoch=4,
+            shard_log_sequence=7,
+        )
+
+        self.assertIsInstance(typed_response, CultNetRawSnapshotResponse)
+        self.assertEqual(typed_response.message_id, "snapshot-1")
+        self.assertEqual(typed_response.documents[0].record_key, "note:1")
+        self.assertEqual(typed_response.to_wire(), response)
+        self.assertEqual(source.build_snapshot_response(schema_ids=["mesh.snapshot_note.v1"]).documents[0].record_key, "note:1")
+        self.assertEqual(response["schemaVersion"], "cultnet.snapshot_response_raw.v0")
+        self.assertEqual(response["messageId"], "snapshot-1")
+        self.assertEqual(response["shardId"], "notes")
+        self.assertEqual(response["shardEpoch"], 4)
+        self.assertEqual(response["shardLogSequence"], 7)
+        self.assertEqual([record["recordKey"] for record in response["documents"]], ["note:1"])
+        self.assertEqual(response["documents"][0]["schemaId"], "mesh.snapshot_note.v1")
+        self.assertEqual(response["documents"][0]["payloadEncoding"], "messagepack")
+
+        target = CultMesh.create_node(runtime_id="mesh-snapshot-target")
+        target.database.register_document(document)
+        applied = target.database.apply_snapshot_response(response)
+        self.assertEqual([(record.schema_id, record.record_key) for record in applied], [("mesh.snapshot_note.v1", "note:1")])
+        self.assertEqual(target.database.get_required(document, "note:1"), {"body": "include"})
+        self.assertIsNone(target.database.get(document, "note:2"))
+
+        typed_target = CultMesh.create_node(runtime_id="mesh-snapshot-typed-target")
+        typed_target.database.register_document(document)
+        typed_applied = typed_target.database.apply_snapshot_response(typed_response)
+        self.assertEqual([(record.schema_id, record.record_key) for record in typed_applied], [("mesh.snapshot_note.v1", "note:1")])
+        self.assertEqual(typed_target.database.get_required(document, "note:1"), {"body": "include"})
+
+    def test_cultmesh_database_filters_snapshot_by_logged_shard_membership(self) -> None:
+        document = define_database_entry_type(
+            "mesh.sharded_snapshot_note",
+            [("body", 0)],
+            schema_id="mesh.sharded_snapshot_note.v1",
+        )
+        source = CultMesh.create_node(runtime_id="mesh-sharded-snapshot-source")
+        source.database.register_document(document)
+        source.database.put_raw_message(document, "note:notes", {"body": "include"}, shard_id="notes", shard_epoch=2)
+        source.database.put_raw_message(document, "note:other", {"body": "skip"}, shard_id="other", shard_epoch=1)
+
+        response = source.database.build_snapshot_response(
+            schema_ids=["mesh.sharded_snapshot_note.v1"],
+            shard_id="notes",
+            shard_epoch=2,
+        )
+
+        self.assertEqual(response.shard_id, "notes")
+        self.assertEqual(response.shard_epoch, 2)
+        self.assertEqual([record.record_key for record in response.documents], ["note:notes"])
+
+    def test_cultmesh_database_creates_shard_log_response_from_raw_mutations(self) -> None:
+        document = define_database_entry_type(
+            "mesh.log_note",
+            [("body", 0)],
+            schema_id="mesh.log_note.v1",
+        )
+        source = CultMesh.create_node(runtime_id="mesh-log-source")
+        source.database.register_document(document)
+        source.database.put_raw_message(document, "note:1", {"body": "first"}, shard_id="notes", shard_epoch=3)
+        source.database.put_raw_message(document, "note:1", {"body": "second"}, shard_id="notes", shard_epoch=3)
+        source.database.put_raw_message(document, "note:2", {"body": "other"}, shard_id="other", shard_epoch=1)
+        source.database.delete_raw_message(document, "note:1", shard_id="notes", shard_epoch=3)
+
+        self.assertEqual(source.database.shard_ids(), ["notes", "other"])
+        self.assertEqual(source.database.shard_schema_ids("notes"), ["mesh.log_note.v1"])
+
+        typed_response = source.database.build_shard_log_response(
+            message_id="log-1",
+            shard_id="notes",
+            shard_epoch=3,
+            after_sequence=1,
+            limit=2,
+        )
+        response = source.database.create_shard_log_response(
+            message_id="log-1",
+            shard_id="notes",
+            shard_epoch=3,
+            after_sequence=1,
+            limit=2,
+        )
+
+        self.assertIsInstance(typed_response, CultNetShardLogResponse)
+        self.assertEqual(typed_response.message_id, "log-1")
+        self.assertEqual([entry.sequence for entry in typed_response.entries], [2, 3])
+        self.assertEqual(typed_response.to_wire(), response)
+        self.assertEqual([entry.sequence for entry in source.build_shard_log_response(shard_id="notes").entries], [1, 2, 3])
+        self.assertEqual(response["schemaVersion"], "cultnet.shard_log_response.v0")
+        self.assertEqual(response["messageId"], "log-1")
+        self.assertEqual(response["shardId"], "notes")
+        self.assertEqual(response["shardEpoch"], 3)
+        self.assertFalse(response["resyncRequired"])
+        self.assertEqual([entry["sequence"] for entry in response["entries"]], [2, 3])
+        self.assertEqual([entry["changeKind"] for entry in response["entries"]], ["updated", "removed"])
+        self.assertEqual(response["entries"][0]["put"]["document"]["recordKey"], "note:1")
+        self.assertEqual(response["entries"][1]["delete"]["recordKey"], "note:1")
+        empty = source.database.create_shard_log_response(shard_id="missing")
+        self.assertEqual(empty["shardEpoch"], 0)
+        self.assertEqual(empty["entries"], [])
+        self.assertTrue(empty["resyncRequired"])
+        self.assertEqual(empty["reason"], "unknown_shard")
+        stale = source.database.create_shard_log_response(shard_id="notes", shard_epoch=2)
+        self.assertEqual(stale["shardEpoch"], 3)
+        self.assertEqual(stale["entries"], [])
+        self.assertTrue(stale["resyncRequired"])
+        self.assertEqual(stale["reason"], "stale_epoch")
+        with self.assertRaises(ValueError):
+            source.database.create_shard_log_response(shard_id="notes", after_sequence=-1)
+        with self.assertRaises(ValueError):
+            source.database.create_shard_log_response(shard_id="notes", limit=-1)
+
+        target = CultMesh.create_node(runtime_id="mesh-log-target")
+        target.database.register_document(document)
+        target.database.put(document, "note:1", {"body": "first"})
+        applied = target.database.apply_shard_log_response(response)
+        self.assertEqual([record.change_kind for record in applied], ["updated", "removed"])
+        self.assertIsNone(target.database.get(document, "note:1"))
+        self.assertIsNone(target.database.get(document, "note:2"))
+
+        typed_target = CultMesh.create_node(runtime_id="mesh-log-typed-target")
+        typed_target.database.register_document(document)
+        typed_target.database.put(document, "note:1", {"body": "first"})
+        typed_applied = typed_target.database.apply_shard_log_response(typed_response)
+        self.assertEqual([record.change_kind for record in typed_applied], ["updated", "removed"])
+        self.assertIsNone(typed_target.database.get(document, "note:1"))
+
+    def test_cultnet_file_shard_mutation_log_store_persists_authoritative_entries(self) -> None:
+        document = define_database_entry_type(
+            "mesh.durable_log_note",
+            [("body", 0)],
+            schema_id="mesh.durable_log_note.v1",
+        )
+        with tempfile.TemporaryDirectory() as tmp:
+            store: CultNetShardMutationLogStore = CultNetFileShardMutationLogStore(Path(tmp) / "logs")
+            source = CultMesh.create_node(runtime_id="durable-primary")
+            source.database.register_document(document)
+            source.database.use_shard_mutation_log_store(store)
+            source.database.put_raw_message(document, "note:1", {"body": "first"}, shard_id="durable", shard_epoch=4)
+            source.database.put_raw_message(document, "note:2", {"body": "second"}, shard_id="durable", shard_epoch=4)
+
+            reopened = CultMesh.create_node(runtime_id="durable-primary")
+            reopened.database.register_document(document)
+            reopened.database.use_shard_mutation_log_store(CultNetFileShardMutationLogStore(Path(tmp) / "logs"))
+            response = reopened.database.build_shard_log_response(shard_id="durable", shard_epoch=4)
+            self.assertEqual(reopened.database.shard_ids(), ["durable"])
+            self.assertEqual(reopened.database.shard_schema_ids("durable"), ["mesh.durable_log_note.v1"])
+            self.assertEqual([entry.sequence for entry in response.entries], [1, 2])
+            self.assertEqual(response.entries[0].raw_document.record_key, "note:1")
+
+            store.compact_through("durable", 1)
+            compacted = reopened.database.build_shard_log_response(shard_id="durable", shard_epoch=4, after_sequence=0)
+            retained = reopened.database.build_shard_log_response(shard_id="durable", shard_epoch=4, after_sequence=1)
+            self.assertTrue(compacted.resync_required)
+            self.assertEqual(compacted.reason, "compacted_history")
+            self.assertEqual(compacted.compacted_through, 1)
+            self.assertEqual([entry.sequence for entry in retained.entries], [2])
+
+    def test_cultnet_shard_replicator_pulls_logs_and_resyncs_from_snapshot(self) -> None:
+        document = define_database_entry_type(
+            "mesh.replica_note",
+            [("body", 0)],
+            schema_id="mesh.replica_note.v1",
+        )
+        source = CultMesh.create_node(runtime_id="primary")
+        source.database.register_document(document)
+        source.database.put_raw_message(document, "note:1", {"body": "one"}, shard_id="notes", shard_epoch=3)
+        source.database.put_raw_message(document, "note:2", {"body": "two"}, shard_id="notes", shard_epoch=3)
+        with tempfile.TemporaryDirectory() as tmp:
+            cursor_path = Path(tmp) / "replica-cursors.msgpack"
+            server = CultMesh.serve_node(source)
+            try:
+                shard = CultNetShardDescriptor(
+                    shard_id="notes",
+                    owner_runtime_id="primary",
+                    epoch=3,
+                    is_primary=False,
+                    schema_ids=("mesh.replica_note.v1",),
+                    primary_endpoints=(f"cultnet://127.0.0.1:{server.port}",),
+                )
+                target = CultMesh.create_node(runtime_id="replica")
+                target.database.register_document(document)
+                cursor_store = CultNetFileShardReplicaCursorStore(cursor_path)
+                replicator = CultNetShardReplicator(
+                    target.database,
+                    CultNetShardReplicatorOptions(
+                        fetcher=CultNetSchemaShardLogFetcher(timeout_seconds=2.0),
+                        snapshot_fetcher=CultNetSchemaShardSnapshotFetcher(timeout_seconds=2.0),
+                        cursor_store=cursor_store,
+                        batch_size=16,
+                    ),
+                )
+
+                first_sequence = replicator.pull_once(shard)
+                restarted_replicator = CultNetShardReplicator(
+                    target.database,
+                    CultNetShardReplicatorOptions(
+                        fetcher=CultNetSchemaShardLogFetcher(timeout_seconds=2.0),
+                        snapshot_fetcher=CultNetSchemaShardSnapshotFetcher(timeout_seconds=2.0),
+                        cursor_store=CultNetFileShardReplicaCursorStore(cursor_path),
+                        batch_size=16,
+                    ),
+                )
+                second_sequence = restarted_replicator.pull_once(shard)
+
+                self.assertEqual(first_sequence, 2)
+                self.assertEqual(second_sequence, 2)
+                self.assertEqual(target.get_required(document, "note:1")["body"], "one")
+                self.assertEqual(target.get_required(document, "note:2")["body"], "two")
+                cursor = CultNetFileShardReplicaCursorStore(cursor_path).read("notes")
+                self.assertIsNotNone(cursor)
+                assert cursor is not None
+                self.assertEqual(cursor.last_applied_sequence, 2)
+                self.assertEqual(cursor.shard_epoch, 3)
+            finally:
+                server.stop()
+
+        resync_target = CultMesh.create_node(runtime_id="resync-replica")
+        resync_target.database.register_document(document)
+        snapshot = source.database.build_snapshot_response(shard_id="notes", shard_epoch=3, shard_log_sequence=2)
+
+        class CompactingFetcher:
+            def fetch(self, shard: CultNetShardDescriptor, *, after_sequence: int, limit: int | None = None) -> CultNetShardLogResponse:
+                return CultNetShardLogResponse(
+                    message_id="compact",
+                    shard_id=shard.shard_id,
+                    shard_epoch=shard.epoch,
+                    entries=(),
+                    resync_required=True,
+                    reason="compacted_history",
+                    compacted_through=after_sequence,
+                )
+
+        class SnapshotFetcher:
+            def fetch(self, shard: CultNetShardDescriptor) -> CultNetRawSnapshotResponse:
+                return snapshot
+
+        resync_replicator = CultNetShardReplicator(
+            resync_target.database,
+            CultNetShardReplicatorOptions(
+                fetcher=CompactingFetcher(),
+                snapshot_fetcher=SnapshotFetcher(),
+                cursor_store=CultNetInMemoryShardReplicaCursorStore(),
+            ),
+        )
+        resync_sequence = resync_replicator.pull_once(CultNetShardDescriptor(
+            shard_id="notes",
+            owner_runtime_id="primary",
+            epoch=3,
+            is_primary=False,
+            schema_ids=("mesh.replica_note.v1",),
+            primary_endpoints=("cultnet://primary:3075",),
+        ))
+
+        self.assertEqual(resync_sequence, 2)
+        self.assertEqual(resync_target.get_required(document, "note:1")["body"], "one")
+
+    def test_cultnet_shard_replicator_background_loop_polls_non_primary_shards(self) -> None:
+        document = define_database_entry_type(
+            "mesh.background_replica_note",
+            [("body", 0)],
+            schema_id="mesh.background_replica_note.v1",
+        )
+        source = CultMesh.create_node(runtime_id="background-primary")
+        source.database.register_document(document)
+        target = CultMesh.create_node(runtime_id="background-replica")
+        target.database.register_document(document)
+        cursor_store = CultNetInMemoryShardReplicaCursorStore()
+        errors: list[Exception] = []
+
+        class FlakySourceFetcher:
+            def __init__(self) -> None:
+                self.calls = 0
+
+            def fetch(self, shard: CultNetShardDescriptor, *, after_sequence: int, limit: int | None = None) -> CultNetShardLogResponse:
+                self.calls += 1
+                if self.calls == 1:
+                    raise RuntimeError("transient fetch failure")
+                return source.database.build_shard_log_response(
+                    shard_id=shard.shard_id,
+                    shard_epoch=shard.epoch,
+                    after_sequence=after_sequence,
+                    limit=limit,
+                )
+
+        fetcher = FlakySourceFetcher()
+        shard = CultNetShardDescriptor(
+            shard_id="background",
+            owner_runtime_id="background-primary",
+            epoch=7,
+            is_primary=False,
+            schema_ids=("mesh.background_replica_note.v1",),
+            primary_endpoints=("cultnet://127.0.0.1:3075",),
+        )
+        replicator = CultNetShardReplicator(
+            target.database,
+            CultNetShardReplicatorOptions(
+                fetcher=fetcher,
+                cursor_store=cursor_store,
+                batch_size=1,
+                poll_interval_seconds=0.01,
+                on_error=errors.append,
+            ),
+        )
+        try:
+            source.database.put_raw_message(document, "note:1", {"body": "one"}, shard_id="background", shard_epoch=7)
+            replicator.start([shard])
+            self._wait_until(lambda: target.database.get(document, "note:1") is not None)
+            source.database.put_raw_message(document, "note:2", {"body": "two"}, shard_id="background", shard_epoch=7)
+            self._wait_until(lambda: target.database.get(document, "note:2") is not None)
+        finally:
+            replicator.stop()
+
+        cursor = cursor_store.read("background")
+        self.assertEqual(target.get_required(document, "note:1")["body"], "one")
+        self.assertEqual(target.get_required(document, "note:2")["body"], "two")
+        self.assertIsNotNone(cursor)
+        assert cursor is not None
+        self.assertEqual(cursor.last_applied_sequence, 2)
+        self.assertEqual(cursor.shard_epoch, 7)
+        self.assertEqual(len(errors), 1)
+        self.assertEqual(str(errors[0]), "transient fetch failure")
+
+    def test_cultnet_schema_write_forwarder_sends_raw_writes_to_primary(self) -> None:
+        document = define_database_entry_type(
+            "mesh.forward_note",
+            [("body", 0)],
+            schema_id="mesh.forward_note.v1",
+        )
+        primary = CultMesh.create_node(runtime_id="forward-primary")
+        primary.database.register_document(document)
+        server = CultMesh.serve_node(primary)
+        try:
+            shard = CultNetShardDescriptor(
+                shard_id="forward",
+                owner_runtime_id="forward-primary",
+                epoch=9,
+                is_primary=False,
+                schema_ids=("mesh.forward_note.v1",),
+                primary_endpoints=(f"cultnet://127.0.0.1:{server.port}",),
+            )
+            forwarder: CultNetShardWriteForwarder = CultNetSchemaWriteForwarder(timeout_seconds=2.0)
+            put = document_put_raw(
+                message_id="forward-put",
+                key="note:forward",
+                schema_id=document.catalog_entry().schema_id,
+                stored_at="2026-06-14T00:00:00Z",
+                payload=document.encode_payload({"body": "forwarded"}),
+            ).to_wire()
+            delete = document_delete(
+                message_id="forward-delete",
+                schema_id=document.catalog_entry().schema_id,
+                record_key="note:forward",
+            ).to_wire()
+
+            forwarder.forward_put(shard, put)
+            self._eventually(lambda: primary.database.get(document, "note:forward") is not None)
+            self.assertEqual(primary.database.get_required(document, "note:forward")["body"], "forwarded")
+            forwarder.forward_delete(shard, delete)
+            self._eventually(lambda: primary.database.get(document, "note:forward") is None)
+
+            log = primary.database.build_shard_log_response(shard_id="forward", shard_epoch=9)
+            self.assertIsNone(primary.database.get(document, "note:forward"))
+            self.assertEqual([entry.change_kind for entry in log.entries], ["added", "removed"])
+            self.assertEqual(log.entries[0].put["shardId"], "forward")
+            self.assertEqual(log.entries[1].delete["shardEpoch"], 9)
+        finally:
+            server.stop()
+
+    def _eventually(self, predicate: Callable[[], bool], *, timeout_seconds: float = 2.0) -> None:
+        deadline = time.monotonic() + timeout_seconds
+        while time.monotonic() < deadline:
+            if predicate():
+                return
+            time.sleep(0.01)
+        self.assertTrue(predicate())
+
+    def test_cultmesh_database_watchers_observe_name_and_index_changes(self) -> None:
+        document = define_database_entry_type(
+            "mesh.named_watch",
+            [("name", 0), ("kind", 1)],
+            name="name",
+            indexes={"kind": "kind"},
+        )
+        node = CultMesh.create_node(runtime_id="mesh-named-watch")
+        node.database.register_document(document)
+        name_changes: list[CultMeshDatabaseChange] = []
+        index_changes: list[CultMeshDatabaseChange] = []
+
+        node.database.watch_by_name(document, "Potion", name_changes.append)
+        node.database.watch_by_index(document, "kind", "consumable", index_changes.append)
+
+        node.database.put(document, "item:1", {"name": "Potion", "kind": "consumable"})
+        node.database.put(document, "item:2", {"name": "Sword", "kind": "weapon"})
+        node.database.put(document, "item:1", {"name": "Elixir", "kind": "rare"})
+        node.database.delete(document, "item:1")
+
+        self.assertEqual([change.change_kind for change in name_changes], ["added", "updated"])
+        self.assertEqual([change.record_key for change in name_changes], ["item:1", "item:1"])
+        self.assertEqual(name_changes[1].previous_value, {"name": "Potion", "kind": "consumable"})
+        self.assertEqual([change.change_kind for change in index_changes], ["added", "updated"])
+        self.assertEqual([change.record_key for change in index_changes], ["item:1", "item:1"])
+        self.assertEqual(index_changes[1].value, {"name": "Elixir", "kind": "rare"})
+
+    def test_cultmesh_database_collection_reads_resolve_same_schema_aliases(self) -> None:
+        @dataclass
+        class CanonicalItem:
+            name: str
+            kind: str
+
+        @dataclass
+        class UiItem:
+            name: str
+            kind: str
+
+        document = define_database_entry_type(
+            "mesh.alias_collection_item",
+            [("name", 0), ("kind", 1)],
+            cls=CanonicalItem,
+            name="name",
+            indexes={"kind": "kind"},
+            schema_id="mesh.alias_collection_item.v1",
+            schema_name="mesh.alias_collection_item",
+            schema_version="mesh.alias_collection_item.v1",
+        )
+        alias = define_database_entry_type(
+            "mesh.alias_collection_item.ui",
+            [("name", 0), ("kind", 1)],
+            cls=UiItem,
+            name="name",
+            indexes={"kind": "kind"},
+            schema_id="mesh.alias_collection_item.v1",
+            schema_name="mesh.alias_collection_item",
+            schema_version="mesh.alias_collection_item.v1",
+        )
+        node = CultMesh.create_node(runtime_id="mesh-alias-collection")
+        node.database.register_document(document)
+
+        node.database.put(alias, "item:potion", UiItem("Potion", "consumable"))
+        node.database.put(document, "item:sword", CanonicalItem("Sword", "weapon"))
+
+        all_items = node.database.get_all(alias)
+        potion = node.database.get_by_name(alias, "Potion")
+        sword = node.get_by_index(alias, "kind", "weapon")
+
+        self.assertEqual([item.name for item in all_items], ["Potion", "Sword"])
+        self.assertTrue(all(isinstance(item, UiItem) for item in all_items))
+        self.assertIsInstance(potion, UiItem)
+        self.assertEqual(potion.kind, "consumable")
+        self.assertIsInstance(sword, UiItem)
+        self.assertEqual(sword.name, "Sword")
+        self.assertIsNone(node.database.get_by_name(alias, "Missing"))
+
+    def test_cultmesh_database_alias_collection_watches_emit_alias_values(self) -> None:
+        @dataclass
+        class CanonicalItem:
+            name: str
+            kind: str
+
+        @dataclass
+        class UiItem:
+            name: str
+            kind: str
+
+        document = define_database_entry_type(
+            "mesh.alias_collection_watch_item",
+            [("name", 0), ("kind", 1)],
+            cls=CanonicalItem,
+            name="name",
+            indexes={"kind": "kind"},
+            schema_id="mesh.alias_collection_watch_item.v1",
+            schema_name="mesh.alias_collection_watch_item",
+            schema_version="mesh.alias_collection_watch_item.v1",
+        )
+        alias = define_database_entry_type(
+            "mesh.alias_collection_watch_item.ui",
+            [("name", 0), ("kind", 1)],
+            cls=UiItem,
+            name="name",
+            indexes={"kind": "kind"},
+            schema_id="mesh.alias_collection_watch_item.v1",
+            schema_name="mesh.alias_collection_watch_item",
+            schema_version="mesh.alias_collection_watch_item.v1",
+        )
+        node = CultMesh.create_node(runtime_id="mesh-alias-collection-watch")
+        node.database.register_document(document)
+        name_changes: list[CultMeshDatabaseChange] = []
+        index_changes: list[CultMeshDatabaseChange] = []
+
+        node.database.watch_by_name(alias, "Potion", name_changes.append)
+        node.database.watch_by_index(alias, "kind", "consumable", index_changes.append)
+
+        node.database.put(document, "item:potion", CanonicalItem("Potion", "consumable"))
+        node.database.put(document, "item:potion", CanonicalItem("Elixir", "rare"))
+
+        self.assertEqual([change.change_kind for change in name_changes], ["added", "updated"])
+        self.assertTrue(all(change.document.type == alias.type for change in name_changes))
+        self.assertIsInstance(name_changes[0].value, UiItem)
+        self.assertIsInstance(name_changes[1].value, UiItem)
+        self.assertIsInstance(name_changes[1].previous_value, UiItem)
+        self.assertEqual(name_changes[1].previous_value.name, "Potion")
+        self.assertEqual(name_changes[1].value.name, "Elixir")
+        self.assertEqual([change.change_kind for change in index_changes], ["added", "updated"])
+        self.assertTrue(all(change.document.type == alias.type for change in index_changes))
+        self.assertIsInstance(index_changes[0].value, UiItem)
+        self.assertIsInstance(index_changes[1].previous_value, UiItem)
+
+    def test_cultmesh_database_watch_by_name_and_index_validate_lookup_shape(self) -> None:
+        document = define_database_entry_type("mesh.unnamed_watch", [("body", 0)])
+        node = CultMesh.create_node(runtime_id="mesh-watch-validation")
+        node.database.register_document(document)
+
+        with self.assertRaises(ValueError):
+            node.database.watch_by_name(document, "missing", lambda _: None)
+        with self.assertRaises(ValueError):
+            node.database.watch_by_index(document, "missing", "value", lambda _: None)
+        with self.assertRaises(ValueError):
+            node.database.watch_by_index(document, "", "value", lambda _: None)
+        with self.assertRaises(ValueError):
+            node.database.watch_by_index(document, "missing", "", lambda _: None)
+
+    def test_cultmesh_facade_matches_peer_runtime_entrypoints(self) -> None:
+        with tempfile.TemporaryDirectory() as tmp:
+            store_path = Path(tmp) / "mesh.cc"
+            node = CultMesh.start_node(store_path, runtime_id="mesh-facade")
+
+            self.assertEqual(node.runtime_id, "mesh-facade")
+            self.assertIsInstance(CultMesh.create_node(), type(node))
+            self.assertIsInstance(CultMesh.create_verse_catalog(), CultMeshVerseCatalog)
+            self.assertIsInstance(CultMesh.create_peer_catalog(), CultMeshPeerCatalog)
+            self.assertIsInstance(CultMesh.create_authority_lease_catalog(), CultMeshAuthorityLeaseCatalog)
+            self.assertIsInstance(CultMesh.create_stream_catalog(), CultMeshStreamCatalog)
+            self.assertIsInstance(CultMesh.create_schema_catalog(), CultNetSchemaCatalog)
+            self.assertIsInstance(CultMesh.create_builtin_schema_catalog(), CultNetSchemaCatalog)
+            self.assertIsInstance(CultMesh.create_shard_catalog(), CultNetShardCatalog)
+            builtins = CultMesh.create_builtin_schema_catalog(
+                include_schema_json=False,
+                kinds=["shared_contract"],
+            )
+            self.assertEqual(
+                builtins.list()[0].schema_id,
+                "https://github.com/GameCult/cultnet-ts/contracts/cultnet.transport-profile.schema.json",
+            )
+            self.assertIsNone(builtins.list()[0].schema_json)
+            peer_exchange_schema_id = (
+                "https://github.com/GameCult/cultnet-ts/contracts/cultmesh.peer-exchange-request.schema.json"
+            )
+            filtered_builtin = CultMesh.create_builtin_schema_catalog(
+                include_schema_json=True,
+                schema_ids=[peer_exchange_schema_id],
+            )
+            self.assertEqual(
+                filtered_builtin.list()[0].schema_version,
+                "cultmesh.peer_exchange_request.v0",
+            )
+            self.assertIn(
+                "cultmesh.peer_exchange_request.v0",
+                filtered_builtin.list()[0].schema_json or "",
+            )
+            shard_catalog = CultMesh.create_shard_catalog()
+            shard_catalog.upsert(
+                CultNetShardDescriptor(
+                    shard_id="python-notes-a",
+                    owner_runtime_id="mesh-facade",
+                    epoch=7,
+                    is_primary=True,
+                    schema_ids=("python.note.v1",),
+                    key_prefix="note:",
+                )
+            )
+            self.assertEqual(
+                [
+                    shard.shard_id
+                    for shard in shard_catalog.list(schema_ids=["python.note.v1"], record_keys=["note:1"])
+                ],
+                ["python-notes-a"],
+            )
+            verse_client = CultMesh.create_verse_discovery_client("127.0.0.1", 4010, timeout_seconds=1.5)
+            peer_client = CultMesh.create_peer_exchange_client("127.0.0.1", 4011, timeout_seconds=1.5)
+            raw_client = CultMesh.create_client("127.0.0.1", 4012, timeout_seconds=1.5)
+            connected_client = CultMesh.connect_client("127.0.0.1", 4013, timeout_seconds=1.5)
+            self.assertIsInstance(verse_client, CultMeshVerseDiscoveryClient)
+            self.assertIsInstance(peer_client, CultMeshPeerExchangeClient)
+            self.assertIsInstance(verse_client, CultMeshDiscoveryClient)
+            self.assertIsInstance(peer_client, CultMeshDiscoveryClient)
+            self.assertIsInstance(raw_client, CultNetRawClient)
+            self.assertIsInstance(connected_client, CultNetRawClient)
+            self.assertEqual((verse_client.host, verse_client.port, verse_client.timeout_seconds), ("127.0.0.1", 4010, 1.5))
+            self.assertEqual((peer_client.host, peer_client.port, peer_client.timeout_seconds), ("127.0.0.1", 4011, 1.5))
+            self.assertEqual((raw_client.host, raw_client.port, raw_client.timeout_seconds), ("127.0.0.1", 4012, 1.5))
+            self.assertEqual((connected_client.host, connected_client.port, connected_client.timeout_seconds), ("127.0.0.1", 4013, 1.5))
+
+    def test_cultmesh_simulation_fact_uses_csharp_slot_contract(self) -> None:
+        import msgpack  # type: ignore
+
+        candidate = {
+            "shardId": "arena",
+            "shardEpoch": 4,
+            "frame": 100,
+            "subjectId": "bob",
+            "claimKind": "hit",
+            "claimHash": compute_simulation_claim_hash("hit", "alice", "bob", "frame:100"),
+            "claimSummary": "alice shot bob first",
+            "witnessCount": 2,
+            "supportWeight": 2.0,
+            "totalWeight": 2.0,
+            "confidence": 1.0,
+            "hasQuorum": True,
+        }
+
+        fact = CultMeshSimulationFact.from_candidate(candidate, committed_at="2026-06-13T00:00:00Z")
+        payload = simulation_fact_document.encode_payload(fact)
+        slots = msgpack.unpackb(payload, raw=False)
+
+        self.assertEqual(CultMeshSimulationFact.create_record_key(candidate), f"simulation:{fact.fact_id}")
+        self.assertEqual(slots[0], fact.fact_id)
+        self.assertEqual(slots[1], "arena")
+        self.assertEqual(slots[2], 4)
+        self.assertEqual(slots[3], 100)
+        self.assertEqual(slots[4], "bob")
+        self.assertEqual(slots[5], "hit")
+        self.assertEqual(slots[6], candidate["claimHash"])
+        self.assertEqual(slots[7], "alice shot bob first")
+        self.assertEqual(slots[8], 2)
+        self.assertEqual(slots[9], 2.0)
+        self.assertEqual(slots[10], 2.0)
+        self.assertEqual(slots[11], 1.0)
+        self.assertEqual(slots[12], "2026-06-13T00:00:00Z")
+
+    def test_cultmesh_simulation_fact_committer_rejects_without_quorum_and_stores_fact(self) -> None:
+        candidate = {
+            "shardId": "arena",
+            "shardEpoch": 4,
+            "frame": 100,
+            "subjectId": "bob",
+            "claimKind": "hit",
+            "claimHash": compute_simulation_claim_hash("hit", "alice", "bob", "frame:100"),
+            "claimSummary": "alice shot bob first",
+            "witnessCount": 2,
+            "supportWeight": 2.0,
+            "totalWeight": 2.0,
+            "confidence": 1.0,
+            "hasQuorum": True,
+        }
+
+        with tempfile.TemporaryDirectory() as tmp:
+            node = CultMesh.create_node(Path(tmp) / "facts.cc", runtime_id="mesh-facts")
+            committer = CultMesh.create_simulation_fact_committer(node)
+
+            rejected = dict(candidate)
+            rejected["hasQuorum"] = False
+            with self.assertRaisesRegex(ValueError, "before quorum"):
+                committer.commit(rejected)
+
+            committed = committer.commit(candidate, committed_at="2026-06-13T00:00:00Z")
+            stored = node.get_required(simulation_fact_document, committed.key)
+
+            self.assertEqual(stored.claim_hash, candidate["claimHash"])
+            self.assertEqual(stored.committed_at, "2026-06-13T00:00:00Z")
+            self.assertEqual(committed.fact.fact_id, stored.fact_id)
+
+    def test_cultmesh_game_session_submits_observations_and_commits_quorum_once(self) -> None:
+        claim_hash = compute_simulation_claim_hash("hit", "alice", "bob", "frame:100")
+        first = simulation_observation(
+            message_id="obs-1",
+            witness_runtime_id="watcher-1",
+            shard_id="arena",
+            shard_epoch=4,
+            frame=100,
+            subject_id="bob",
+            claim_kind="hit",
+            claim_hash=claim_hash,
+            claim_summary="alice shot bob first",
+        ).to_wire()
+        second = simulation_observation(
+            message_id="obs-2",
+            witness_runtime_id="watcher-2",
+            shard_id="arena",
+            shard_epoch=4,
+            frame=100,
+            subject_id="bob",
+            claim_kind="hit",
+            claim_hash=claim_hash,
+            claim_summary="alice shot bob first",
+        ).to_wire()
+
+        with tempfile.TemporaryDirectory() as tmp:
+            node = CultMesh.create_node(Path(tmp) / "session.cc", runtime_id="mesh-session")
+            session = CultMesh.create_game_session(
+                node,
+                CultMeshGameSessionOptions(
+                    consensus_options=CultNetSimulationConsensusOptions(minimum_witnesses=2, quorum_ratio=1.0)
+                ),
+            )
+            seen_candidates: list[CultNetSimulationConsensusCandidate] = []
+            seen_facts: list[CultMeshDatabaseChange] = []
+            unsubscribe_candidates = session.watch_candidates(seen_candidates.append)
+            unsubscribe_facts = session.watch_simulation_facts(seen_facts.append)
+
+            self.assertEqual(session.submit_and_commit(CultNetSimulationObservation.from_wire(first)), [])
+            typed_candidates = session.submit_observation_candidates(CultNetSimulationObservation.from_wire(second))
+            commits = session.commit_quorum_candidate_objects(typed_candidates)
+            replay = session.commit_quorum_candidates(session.submit_observation(second))
+            unsubscribe_candidates()
+            unsubscribe_facts()
+
+            self.assertEqual(len(typed_candidates), 1)
+            self.assertTrue(typed_candidates[0].has_quorum)
+            self.assertEqual(len(commits), 1)
+            self.assertEqual(replay, [])
+            self.assertEqual([candidate.claim_hash for candidate in seen_candidates], [claim_hash, claim_hash, claim_hash])
+            self.assertEqual(len(seen_facts), 1)
+            self.assertEqual(seen_facts[0].change_kind, "added")
+            self.assertEqual(seen_facts[0].value.claim_hash, claim_hash)
+            stored = node.get_required(simulation_fact_document, commits[0].key)
+            self.assertEqual(stored.claim_hash, claim_hash)
+            self.assertEqual(stored.witness_count, 2)
+
+    def test_cultmesh_game_session_serves_catalogs_and_observations_over_wire(self) -> None:
+        verse_catalog = CultMeshVerseCatalog()
+        peer_catalog = CultMeshPeerCatalog()
+        verse_catalog.upsert(CultMeshVerseDescriptor(
+            verse_id="session-verse",
+            display_name="Session Verse",
+            authority_model="local",
+            compatibility=CultMeshVerseCompatibility("cultmesh.v0", "session-rules"),
+        ))
+        peer_catalog.upsert(CultMeshPeerCard(
+            peer_id="session-peer",
+            verse_id="session-verse",
+            endpoints=("cultnet://127.0.0.1:0",),
+            roles=("simulation-observer", "read-replica"),
+            shard_ids=("arena",),
+        ))
+        session = CultMesh.create_game_session(
+            CultMesh.create_node(runtime_id="session-peer"),
+            CultMeshGameSessionOptions(
+                verse_catalog=verse_catalog,
+                peer_catalog=peer_catalog,
+                consensus_options=CultNetSimulationConsensusOptions(minimum_witnesses=2, quorum_ratio=1.0),
+            ),
+        )
+        server = session.serve(display_name="Session Peer")
+        try:
+            raw_client = CultMesh.create_client("127.0.0.1", server.port, timeout_seconds=2.0)
+            hello_response = raw_client.request(
+                hello(runtime_id="session-prober"),
+                expected_schema_version="cultnet.hello.v0",
+            )
+            discovery_client = CultMesh.create_verse_discovery_client("127.0.0.1", server.port, timeout_seconds=2.0)
+            verses = discovery_client.fetch_verses(transport_version="cultmesh.v0")
+            peers = discovery_client.fetch_peers(verse_id="session-verse", roles=["simulation-observer"])
+            claim_hash = compute_simulation_claim_hash("hit", "alice", "bob", "frame:100")
+            first = raw_client.request(
+                simulation_observation(
+                    message_id="session-wire-1",
+                    witness_runtime_id="watcher-1",
+                    shard_id="arena",
+                    shard_epoch=4,
+                    frame=100,
+                    subject_id="bob",
+                    claim_kind="hit",
+                    claim_hash=claim_hash,
+                    claim_summary="alice shot bob first",
+                ),
+                expected_schema_version="cultnet.simulation_consensus_candidate.v0",
+            )
+            second = raw_client.request(
+                simulation_observation(
+                    message_id="session-wire-2",
+                    witness_runtime_id="watcher-2",
+                    shard_id="arena",
+                    shard_epoch=4,
+                    frame=100,
+                    subject_id="bob",
+                    claim_kind="hit",
+                    claim_hash=claim_hash,
+                    claim_summary="alice shot bob first",
+                ),
+                expected_schema_version="cultnet.simulation_consensus_candidate.v0",
+            )
+        finally:
+            server.stop()
+
+        self.assertIn("cultnet.simulation_observation.v0", hello_response["supportedMessageVersions"])
+        self.assertEqual(verses[0].verse_id, "session-verse")
+        self.assertEqual(peers[0].peer_id, "session-peer")
+        self.assertIn("simulation-observer", peers[0].roles)
+        self.assertFalse(first["hasQuorum"])
+        self.assertEqual(first["witnessCount"], 1)
+        self.assertTrue(second["hasQuorum"])
+        self.assertEqual(second["witnessCount"], 2)
+
+    def test_cultmesh_game_session_can_disable_served_simulation_observations(self) -> None:
+        verse_catalog = CultMeshVerseCatalog()
+        verse_catalog.upsert(CultMeshVerseDescriptor(
+            verse_id="session-quiet",
+            display_name="Quiet Session",
+            authority_model="local",
+            compatibility=CultMeshVerseCompatibility("cultmesh.v0", "quiet-rules"),
+        ))
+        session = CultMesh.create_game_session(
+            CultMesh.create_node(runtime_id="quiet-session-peer"),
+            CultMeshGameSessionOptions(
+                verse_catalog=verse_catalog,
+                serve_simulation_observations=False,
+            ),
+        )
+        server = session.serve(display_name="Quiet Session Peer")
+        try:
+            raw_client = CultMesh.create_client("127.0.0.1", server.port, timeout_seconds=2.0)
+            hello_response = raw_client.request(
+                hello(runtime_id="quiet-session-prober"),
+                expected_schema_version="cultnet.hello.v0",
+            )
+            discovery_client = CultMesh.create_verse_discovery_client("127.0.0.1", server.port, timeout_seconds=2.0)
+            verses = discovery_client.fetch_verses(transport_version="cultmesh.v0")
+            with self.assertRaisesRegex(CultNetPeerError, "Simulation observations are not enabled") as raised:
+                raw_client.request(
+                    simulation_observation(
+                        message_id="quiet-session-sim",
+                        witness_runtime_id="watcher-1",
+                        shard_id="arena",
+                        shard_epoch=4,
+                        frame=100,
+                        subject_id="bob",
+                        claim_kind="hit",
+                        claim_hash=compute_simulation_claim_hash("hit", "alice", "bob", "frame:100"),
+                    ),
+                    expected_schema_version="cultnet.simulation_consensus_candidate.v0",
+                )
+        finally:
+            server.stop()
+
+        self.assertNotIn("cultnet.simulation_observation.v0", hello_response["supportedMessageVersions"])
+        self.assertEqual(verses[0].verse_id, "session-quiet")
+        self.assertEqual(raised.exception.response["code"], "simulation_observations_disabled")
+
+    def test_cultmesh_game_session_prediction_requires_scope_and_reconciles_shard_log(self) -> None:
+        note_doc = define_database_entry_type(
+            "mesh.input",
+            [("body", 0)],
+            schema_id="mesh.input.v1",
+        )
+        with tempfile.TemporaryDirectory() as tmp:
+            node = CultMesh.create_node(Path(tmp) / "prediction.cc", runtime_id="client-a")
+            node.register_document(note_doc)
+            session = CultMesh.create_game_session(
+                node,
+                CultMeshGameSessionOptions(
+                    client_authority_scopes=(
+                        CultNetClientAuthorityScope(
+                            "client-a",
+                            schema_ids=("mesh.input.v1",),
+                            key_prefix="input:client-a",
+                        ),
+                    )
+                ),
+            )
+
+            with self.assertRaisesRegex(ValueError, "does not have client prediction authority"):
+                session.predict(note_doc, "input:other", {"body": "nope"})
+
+            prediction = session.predict(note_doc, "input:client-a:move", {"body": "predicted"})
+            put = document_put_raw(
+                message_id="authoritative",
+                key=prediction.key,
+                schema_id=prediction.schema_id,
+                stored_at="2026-06-13T00:00:00Z",
+                payload=note_doc.encode_payload({"body": "authoritative"}),
+                shard_id="inputs",
+                shard_epoch=1,
+            )
+            authoritative_response = {
+                "schemaVersion": "cultnet.shard_log_response.v0",
+                "messageId": "inputs-log",
+                "shardId": "inputs",
+                "shardEpoch": 1,
+                "entries": [
+                    {
+                        "sequence": 1,
+                        "committedAt": "2026-06-13T00:00:00Z",
+                        "changeKind": "updated",
+                        "put": put.to_wire(),
+                    }
+                ],
+                "resyncRequired": False,
+            }
+            changes = session.apply_shard_log_response(CultNetShardLogResponse.from_wire(authoritative_response))
+
+            self.assertEqual(changes[0].change_kind, "reconciled")
+            self.assertEqual(node.get_required(note_doc, prediction.key)["body"], "authoritative")
+            self.assertEqual(session.pending_predictions(), ())
+            self.assertEqual(session.resimulation_inputs(), ())
+
+    def test_cultmesh_game_session_partial_reconciliation_keeps_unmatched_predictions(self) -> None:
+        note_doc = define_database_entry_type(
+            "mesh.partial_input",
+            [("body", 0)],
+            schema_id="mesh.partial_input.v1",
+        )
+        node = CultMesh.create_node(runtime_id="client-partial")
+        node.register_document(note_doc)
+        session = CultMesh.create_game_session(
+            node,
+            CultMeshGameSessionOptions(
+                client_authority_scopes=(
+                    CultNetClientAuthorityScope(
+                        "client-partial",
+                        schema_ids=("mesh.partial_input.v1",),
+                        key_prefix="input:client-partial",
+                    ),
+                )
+            ),
+        )
+        pending = session.predict(note_doc, "input:client-partial:pending", {"body": "pending-local"})
+        accepted = session.predict(note_doc, "input:client-partial:accepted", {"body": "accepted-local"})
+        put = document_put_raw(
+            message_id="authoritative-partial",
+            key=accepted.key,
+            schema_id=accepted.schema_id,
+            stored_at="2026-06-13T00:00:00Z",
+            payload=note_doc.encode_payload({"body": "accepted-authority"}),
+            shard_id="inputs",
+            shard_epoch=1,
+        )
+
+        changes = session.apply_shard_log_response({
+            "schemaVersion": "cultnet.shard_log_response.v0",
+            "messageId": "inputs-partial-log",
+            "shardId": "inputs",
+            "shardEpoch": 1,
+            "entries": [
+                {
+                    "sequence": 1,
+                    "committedAt": "2026-06-13T00:00:00Z",
+                    "changeKind": "updated",
+                    "put": put.to_wire(),
+                }
+            ],
+            "resyncRequired": False,
+        })
+
+        self.assertEqual([(change.change_kind, change.record_key) for change in changes], [
+            ("reconciled", accepted.key),
+        ])
+        self.assertEqual(node.get_required(note_doc, accepted.key)["body"], "accepted-authority")
+        self.assertEqual(node.get_required(note_doc, pending.key)["body"], "pending-local")
+        self.assertEqual([prediction.key for prediction in session.pending_predictions()], [pending.key])
+        self.assertEqual([prediction.key for prediction in session.resimulation_inputs()], [pending.key])
+
+    def test_cultmesh_game_session_rolls_back_pending_predictions(self) -> None:
+        note_doc = define_database_entry_type(
+            "mesh.rollback_input",
+            [("body", 0)],
+            schema_id="mesh.rollback_input.v1",
+        )
+        node = CultMesh.create_node(runtime_id="client-rollback")
+        node.register_document(note_doc)
+        node.put(note_doc, "input:client-rollback:existing", {"body": "previous"})
+        session = CultMesh.create_game_session(
+            node,
+            CultMeshGameSessionOptions(
+                client_authority_scopes=(
+                    CultNetClientAuthorityScope(
+                        "client-rollback",
+                        schema_ids=("mesh.rollback_input.v1",),
+                        key_prefix="input:client-rollback",
+                    ),
+                )
+            ),
+        )
+
+        existing = session.predict(note_doc, "input:client-rollback:existing", {"body": "predicted-existing"})
+        created = session.predict(note_doc, "input:client-rollback:new", {"body": "predicted-new"})
+        self.assertEqual(
+            [prediction.key for prediction in session.pending_predictions()],
+            ["input:client-rollback:existing", "input:client-rollback:new"],
+        )
+        self.assertEqual([prediction.key for prediction in session.resimulation_inputs()], [
+            "input:client-rollback:existing",
+            "input:client-rollback:new",
+        ])
+
+        restored = session.rollback_prediction(existing)
+        self.assertIsNotNone(restored)
+        assert restored is not None
+        self.assertEqual(restored.change_kind, "rolled_back")
+        self.assertEqual(restored.value, {"body": "previous"})
+        self.assertEqual(node.get_required(note_doc, "input:client-rollback:existing")["body"], "previous")
+
+        rolled_back = session.rollback_predictions()
+        self.assertEqual([(change.change_kind, change.record_key, change.value) for change in rolled_back], [
+            ("rolled_back", created.key, None),
+        ])
+        self.assertIsNone(node.get(note_doc, created.key))
+        self.assertEqual(session.pending_predictions(), ())
+
+    def test_cultmesh_game_session_authoritative_delete_rolls_back_prediction(self) -> None:
+        note_doc = define_database_entry_type(
+            "mesh.deleted_input",
+            [("body", 0)],
+            schema_id="mesh.deleted_input.v1",
+        )
+        node = CultMesh.create_node(runtime_id="client-delete")
+        node.register_document(note_doc)
+        session = CultMesh.create_game_session(
+            node,
+            CultMeshGameSessionOptions(
+                client_authority_scopes=(
+                    CultNetClientAuthorityScope(
+                        "client-delete",
+                        schema_ids=("mesh.deleted_input.v1",),
+                        key_prefix="input:client-delete",
+                    ),
+                )
+            ),
+        )
+
+        prediction = session.predict(note_doc, "input:client-delete:move", {"body": "predicted"})
+        delete = document_delete(
+            message_id="authoritative-delete",
+            schema_id=prediction.schema_id,
+            record_key=prediction.key,
+            shard_id="inputs",
+            shard_epoch=1,
+        )
+        changes = session.apply_shard_log_response({
+            "schemaVersion": "cultnet.shard_log_response.v0",
+            "messageId": "inputs-delete-log",
+            "shardId": "inputs",
+            "shardEpoch": 1,
+            "entries": [
+                {
+                    "sequence": 1,
+                    "committedAt": "2026-06-13T00:00:00Z",
+                    "changeKind": "removed",
+                    "delete": delete.to_wire(),
+                }
+            ],
+            "resyncRequired": False,
+        })
+
+        self.assertEqual(changes[0].change_kind, "rolled_back")
+        self.assertIsNone(node.get(note_doc, prediction.key))
+        self.assertEqual(session.pending_predictions(), ())
+
+    def test_cultmesh_database_watchers_observe_authoritative_shard_log_reconciliation(self) -> None:
+        note_doc = define_database_entry_type(
+            "mesh.watched_input",
+            [("body", 0)],
+            schema_id="mesh.watched_input.v1",
+        )
+        node = CultMesh.create_node(runtime_id="client-watch")
+        node.database.register_document(note_doc)
+        seen: list[CultMeshDatabaseChange] = []
+        node.database.watch_record(note_doc, "input:client-watch:move", seen.append)
+        session = CultMesh.create_game_session(
+            node,
+            CultMeshGameSessionOptions(
+                client_authority_scopes=(
+                    CultNetClientAuthorityScope(
+                        "client-watch",
+                        schema_ids=("mesh.watched_input.v1",),
+                        key_prefix="input:client-watch",
+                    ),
+                )
+            ),
+        )
+
+        prediction = session.predict(note_doc, "input:client-watch:move", {"body": "predicted"})
+        put = document_put_raw(
+            message_id="authoritative-watch",
+            key=prediction.key,
+            schema_id=prediction.schema_id,
+            stored_at="2026-06-13T00:00:00Z",
+            payload=note_doc.encode_payload({"body": "authoritative"}),
+            shard_id="inputs",
+            shard_epoch=1,
+        )
+        session_changes = session.apply_shard_log_response({
+            "schemaVersion": "cultnet.shard_log_response.v0",
+            "messageId": "inputs-watch-log",
+            "shardId": "inputs",
+            "shardEpoch": 1,
+            "entries": [
+                {
+                    "sequence": 1,
+                    "committedAt": "2026-06-13T00:00:00Z",
+                    "changeKind": "updated",
+                    "put": put.to_wire(),
+                }
+            ],
+            "resyncRequired": False,
+        })
+
+        self.assertEqual([change.change_kind for change in seen], ["added", "updated"])
+        self.assertEqual(seen[1].value, {"body": "authoritative"})
+        self.assertEqual(seen[1].previous_value, {"body": "predicted"})
+        self.assertEqual(session_changes[0].change_kind, "reconciled")
+
+    def test_cultmesh_verse_catalog_response_matches_schema_v0_wire_shape(self) -> None:
+        import msgpack  # type: ignore
+
+        catalog = CultMeshVerseCatalog()
+        catalog.upsert(
+            CultMeshVerseDescriptor(
+                verse_id="aetheria-main",
+                display_name="Aetheria",
+                authority_model="OperatorCluster",
+                compatibility=CultMeshVerseCompatibility(
+                    transport_version="cultmesh.v0",
+                    rules_hash="rules",
+                    compatible_verse_ids=("aetheria-modded",),
+                    required_plugin_ids=("core",),
+                    optional_plugin_ids=("skylands",),
+                ),
+                discovery_endpoints=("cultmesh://aetheria.example.test:3075",),
+                authority_runtime_ids=("runtime-a",),
+                description="main branch",
+            )
+        )
+
+        response = catalog.create_response(verse_catalog_request("verses-1"))
+        decoded = msgpack.unpackb(msgpack.packb(response, use_bin_type=True), raw=False)
+        self.assertEqual(decoded["schemaVersion"], "cultmesh.verse_catalog_response.v0")
+        self.assertEqual(decoded["messageId"], "verses-1")
+        self.assertEqual(decoded["verses"][0]["verseId"], "aetheria-main")
+        self.assertEqual(decoded["verses"][0]["compatibility"]["requiredPluginIds"], ["core"])
+
+    def test_cultmesh_verse_catalog_watches_updates_and_finds_transfer_targets(self) -> None:
+        source = CultMeshVerseDescriptor(
+            verse_id="aetheria-main",
+            display_name="Aetheria",
+            authority_model="federated",
+            compatibility=CultMeshVerseCompatibility(
+                transport_version="cultmesh.v0",
+                rules_hash="rules-main",
+            ),
+        )
+        compatible = CultMeshVerseDescriptor(
+            verse_id="aetheria-modded",
+            display_name="Aetheria Modded",
+            authority_model="federated",
+            compatibility=CultMeshVerseCompatibility(
+                transport_version="cultmesh.v0",
+                rules_hash="rules-modded",
+                compatible_verse_ids=("aetheria-main",),
+            ),
+        )
+        incompatible = CultMeshVerseDescriptor(
+            verse_id="old-world",
+            display_name="Old World",
+            authority_model="solo",
+            compatibility=CultMeshVerseCompatibility(
+                transport_version="cultmesh.v0",
+                rules_hash="rules-old",
+            ),
+        )
+        catalog = CultMeshVerseCatalog()
+        seen: list[str] = []
+        unsubscribe = catalog.watch(lambda verse: seen.append(verse.verse_id))
+
+        catalog.upsert(source)
+        catalog.apply_response({
+            "schemaVersion": "cultmesh.verse_catalog_response.v0",
+            "messageId": "verses-watch",
+            "verses": [compatible.to_wire(), incompatible.to_wire()],
+        })
+        unsubscribe()
+        catalog.upsert(CultMeshVerseDescriptor(
+            verse_id="after-unsubscribe",
+            display_name="After",
+            authority_model="none",
+            compatibility=CultMeshVerseCompatibility("cultmesh.v0", "rules-after"),
+        ))
+
+        self.assertEqual(seen, ["aetheria-main", "aetheria-modded", "old-world"])
+        self.assertEqual([verse.verse_id for verse in catalog.verses], ["aetheria-main", "aetheria-modded", "after-unsubscribe", "old-world"])
+        self.assertEqual(catalog.get("aetheria-modded"), compatible)
+        self.assertEqual([verse.verse_id for verse in catalog.find_transfer_targets(source)], ["aetheria-modded"])
+
+    def test_cultmesh_peer_exchange_response_matches_schema_v0_wire_shape(self) -> None:
+        import msgpack  # type: ignore
+
+        catalog = CultMeshPeerCatalog()
+        catalog.upsert(
+            CultMeshPeerCard(
+                peer_id="peer-a",
+                verse_id="aetheria-main",
+                endpoints=("cultnet://peer-a.example.test:3075",),
+                roles=("discovery", "read-replica"),
+                shard_ids=("players",),
+                region="eu-west",
+                authority_lease_id="lease-1",
+                expires_at="2026-05-20T12:00:00.0000000Z",
+                signature="sig",
+            )
+        )
+
+        response = catalog.create_response(
+            peer_exchange_request("pex-1", verse_id="aetheria-main", roles=["read-replica"])
+        )
+        decoded = msgpack.unpackb(msgpack.packb(response, use_bin_type=True), raw=False)
+        self.assertEqual(decoded["schemaVersion"], "cultmesh.peer_exchange_response.v0")
+        self.assertEqual(decoded["messageId"], "pex-1")
+        self.assertEqual(decoded["peers"][0]["peerId"], "peer-a")
+        self.assertIn("read-replica", decoded["peers"][0]["roles"])
+        self.assertEqual(decoded["peers"][0]["authorityLeaseId"], "lease-1")
+
+    def test_cultmesh_peer_catalog_watches_updates_and_gets_peers(self) -> None:
+        first = CultMeshPeerCard(
+            peer_id="peer-a",
+            verse_id="aetheria-main",
+            endpoints=("cultnet://peer-a.example.test:3075",),
+            roles=("discovery", "read-replica"),
+        )
+        second = CultMeshPeerCard(
+            peer_id="peer-b",
+            verse_id="aetheria-main",
+            endpoints=("cultnet://peer-b.example.test:3075",),
+            roles=("shard-primary",),
+        )
+        catalog = CultMeshPeerCatalog()
+        seen: list[str] = []
+        unsubscribe = catalog.watch(lambda peer: seen.append(peer.peer_id))
+
+        catalog.upsert(first)
+        catalog.apply_response({
+            "schemaVersion": "cultmesh.peer_exchange_response.v0",
+            "messageId": "peers-watch",
+            "peers": [second.to_wire()],
+        })
+        unsubscribe()
+        catalog.upsert(CultMeshPeerCard(
+            peer_id="peer-c",
+            verse_id="aetheria-main",
+            endpoints=("cultnet://peer-c.example.test:3075",),
+            roles=("read-replica",),
+        ))
+
+        self.assertEqual(seen, ["peer-a", "peer-b"])
+        self.assertTrue(first.has_role("read-replica"))
+        self.assertEqual([peer.peer_id for peer in catalog.peers], ["peer-a", "peer-b", "peer-c"])
+        self.assertEqual(catalog.get("peer-b"), second)
+        self.assertEqual([peer.peer_id for peer in catalog.find("aetheria-main", role="read-replica")], ["peer-a", "peer-c"])
+
+    def test_cultmesh_discovery_client_fetches_typed_catalogs_over_cultnet_frames(self) -> None:
+        import msgpack  # type: ignore
+        from cultnet_py import read_frame, write_frame
+
+        verses = CultMeshVerseCatalog()
+        verses.upsert(
+            CultMeshVerseDescriptor(
+                verse_id="aetheria-main",
+                display_name="Aetheria",
+                authority_model="federated",
+                compatibility=CultMeshVerseCompatibility(
+                    transport_version="cultmesh.v0",
+                    rules_hash="rules-1",
+                    required_plugin_ids=("core",),
+                ),
+                discovery_endpoints=("cultmesh://aetheria.example.test:3075",),
+                authority_runtime_ids=("runtime-a",),
+            )
+        )
+        peers = CultMeshPeerCatalog()
+        peers.upsert(
+            CultMeshPeerCard(
+                peer_id="peer-a",
+                verse_id="aetheria-main",
+                endpoints=("cultnet://peer-a.example.test:3075",),
+                roles=("read-replica",),
+                shard_ids=("players",),
+            )
+        )
+
+        ready = threading.Event()
+        server_error: list[BaseException] = []
+
+        def serve_requests() -> None:
+            try:
+                with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as server:
+                    server.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
+                    server.bind(("127.0.0.1", 0))
+                    port_holder.append(server.getsockname()[1])
+                    server.listen(8)
+                    ready.set()
+                    for _ in range(8):
+                        connection, _ = server.accept()
+                        with connection:
+                            stream = connection.makefile("rwb")
+                            request = msgpack.unpackb(read_frame(stream), raw=False)
+                            if request["schemaVersion"] == "cultmesh.verse_catalog_request.v0":
+                                response = verses.create_response(request)
+                            elif request["schemaVersion"] == "cultmesh.peer_exchange_request.v0":
+                                response = peers.create_response(request)
+                            else:
+                                raise AssertionError(f"unexpected request {request['schemaVersion']}")
+                            write_frame(stream, msgpack.packb(response, use_bin_type=True))
+                            stream.flush()
+            except BaseException as error:
+                server_error.append(error)
+                ready.set()
+
+        port_holder: list[int] = []
+        thread = threading.Thread(target=serve_requests, daemon=True)
+        thread.start()
+        self.assertTrue(ready.wait(2.0))
+        self.assertFalse(server_error)
+
+        client = CultMeshDiscoveryClient("127.0.0.1", port_holder[0], timeout_seconds=2.0)
+        fetched_verses = client.fetch_verses(transport_version="cultmesh.v0")
+        fetched_peers = client.fetch_peers(verse_id="aetheria-main", roles=["read-replica"])
+        local_verses = CultMeshVerseCatalog()
+        local_peers = CultMeshPeerCatalog()
+        synced_verses = client.sync_verse_catalog(local_verses, transport_version="cultmesh.v0")
+        synced_peers = client.sync_peer_catalog(local_peers, verse_id="aetheria-main", roles=["read-replica"])
+        discovered_verses = CultMeshVerseCatalog()
+        discovered_peers = CultMeshPeerCatalog()
+        endpoint = f"cultnet://127.0.0.1:{port_holder[0]}"
+        verse_discovery = CultMeshVerseDiscoveryClient.from_endpoint(endpoint, timeout_seconds=2.0)
+        peer_discovery = CultMeshPeerExchangeClient.from_endpoint(endpoint, timeout_seconds=2.0)
+        discovered_verse_count = verse_discovery.discover(
+            discovered_verses,
+            endpoints=[endpoint, endpoint, ""],
+            transport_version="cultmesh.v0",
+        )
+        discovered_peer_count = peer_discovery.discover(
+            discovered_peers,
+            verse_id="aetheria-main",
+            endpoints=[endpoint, endpoint, ""],
+            roles=["read-replica"],
+        )
+        fanout_verses = CultMeshVerseCatalog()
+        fanout_verses.upsert(
+            CultMeshVerseDescriptor(
+                verse_id="aetheria-main",
+                display_name="Known Aetheria",
+                authority_model="federated",
+                compatibility=CultMeshVerseCompatibility("cultmesh.v0", "rules-1"),
+                discovery_endpoints=(endpoint, endpoint, ""),
+            )
+        )
+        fanout_peers = CultMeshPeerCatalog()
+        fanout_peers.upsert(
+            CultMeshPeerCard(
+                peer_id="known-peer",
+                verse_id="aetheria-main",
+                endpoints=(endpoint, endpoint, ""),
+                roles=("read-replica",),
+            )
+        )
+        fanout_verse_count = verse_discovery.fanout(fanout_verses, transport_version="cultmesh.v0")
+        fanout_peer_count = peer_discovery.fanout(
+            fanout_peers,
+            verse_id="aetheria-main",
+            roles=["read-replica"],
+        )
+
+        thread.join(2.0)
+        self.assertFalse(server_error)
+        self.assertEqual(fetched_verses[0].verse_id, "aetheria-main")
+        self.assertEqual(fetched_verses[0].compatibility.required_plugin_ids, ("core",))
+        self.assertEqual(fetched_peers[0].peer_id, "peer-a")
+        self.assertEqual(fetched_peers[0].shard_ids, ("players",))
+        self.assertEqual(synced_verses[0].verse_id, "aetheria-main")
+        self.assertEqual(local_peers.find("aetheria-main", role="read-replica")[0].peer_id, "peer-a")
+        self.assertEqual(synced_peers[0].roles, ("read-replica",))
+        self.assertEqual(discovered_verse_count, 1)
+        self.assertEqual(discovered_peer_count, 1)
+        self.assertEqual(discovered_verses.get("aetheria-main").display_name, "Aetheria")
+        self.assertEqual(discovered_peers.find("aetheria-main", role="read-replica")[0].peer_id, "peer-a")
+        self.assertEqual(fanout_verse_count, 1)
+        self.assertEqual(fanout_peer_count, 1)
+        self.assertEqual(fanout_verses.get("aetheria-main").display_name, "Aetheria")
+        self.assertIn(
+            "peer-a",
+            {peer.peer_id for peer in fanout_peers.find("aetheria-main", role="read-replica")},
+        )
+
+    def test_cultmesh_discovery_client_fans_out_simulation_observations_to_peers(self) -> None:
+        first_hub = CultNetSimulationObservationHub(
+            CultNetSimulationConsensusOptions(minimum_witnesses=1, quorum_ratio=1.0)
+        )
+        second_hub = CultNetSimulationObservationHub(
+            CultNetSimulationConsensusOptions(minimum_witnesses=1, quorum_ratio=1.0)
+        )
+        first_server = CultMesh.serve_node(
+            CultMesh.create_node(runtime_id="sim-peer-a"),
+            observation_hub=first_hub,
+        )
+        second_server = CultMesh.serve_node(
+            CultMesh.create_node(runtime_id="sim-peer-b"),
+            observation_hub=second_hub,
+        )
+        try:
+            peers = CultMeshPeerCatalog()
+            peers.upsert(CultMeshPeerCard(
+                peer_id="sim-peer-a",
+                verse_id="arena",
+                endpoints=(f"cultnet://127.0.0.1:{first_server.port}",),
+                roles=("simulation-witness",),
+            ))
+            peers.upsert(CultMeshPeerCard(
+                peer_id="sim-peer-b",
+                verse_id="arena",
+                endpoints=(f"cultnet://127.0.0.1:{second_server.port}",),
+                roles=("simulation-witness",),
+            ))
+            claim_hash = compute_simulation_claim_hash("hit", "alice", "bob", "frame:200")
+            message = simulation_observation(
+                message_id="fanout-observation",
+                witness_runtime_id="python-fanout",
+                shard_id="arena",
+                shard_epoch=1,
+                frame=200,
+                subject_id="bob",
+                claim_kind="hit",
+                claim_hash=claim_hash,
+                claim_summary="alice hit bob",
+            ).to_wire()
+
+            client = CultMeshDiscoveryClient("127.0.0.1", first_server.port, timeout_seconds=2.0)
+            candidates = client.fanout_simulation_observation(
+                peers,
+                message,
+                verse_id="arena",
+                roles=["simulation-witness"],
+            )
+        finally:
+            first_server.stop()
+            second_server.stop()
+
+        self.assertEqual([candidate["schemaVersion"] for candidate in candidates], [
+            "cultnet.simulation_consensus_candidate.v0",
+            "cultnet.simulation_consensus_candidate.v0",
+        ])
+        self.assertEqual({candidate["claimHash"] for candidate in candidates}, {claim_hash})
+        self.assertEqual({candidate["messageId"] for candidate in candidates}, {"fanout-observation"})
+        self.assertEqual({candidate["hasQuorum"] for candidate in candidates}, {True})
+
+    def test_cultmesh_simulation_observation_fanout_flushes_queued_messages(self) -> None:
+        hub = CultNetSimulationObservationHub(
+            CultNetSimulationConsensusOptions(minimum_witnesses=1, quorum_ratio=1.0)
+        )
+        server = CultMesh.serve_node(CultMesh.create_node(runtime_id="sim-flush-peer"), observation_hub=hub)
+        try:
+            peers = CultMeshPeerCatalog()
+            peers.upsert(CultMeshPeerCard(
+                peer_id="sim-flush-peer",
+                verse_id="arena",
+                endpoints=(f"cultnet://127.0.0.1:{server.port}",),
+                roles=("simulation-witness",),
+            ))
+            claim_hash = compute_simulation_claim_hash("hit", "alice", "bob", "frame:210")
+            seen_candidates: list[dict[str, object]] = []
+            fanout = CultMeshSimulationObservationFanout(
+                CultMeshDiscoveryClient("127.0.0.1", server.port, timeout_seconds=2.0),
+                peers,
+                verse_id="arena",
+                roles=["simulation-witness"],
+                on_candidate=seen_candidates.append,
+            )
+            fanout.enqueue(simulation_observation(
+                message_id="queued-observation",
+                witness_runtime_id="python-fanout",
+                shard_id="arena",
+                shard_epoch=1,
+                frame=210,
+                subject_id="bob",
+                claim_kind="hit",
+                claim_hash=claim_hash,
+                claim_summary="alice hit bob",
+            ).to_wire())
+
+            candidates = fanout.flush()
+        finally:
+            server.stop()
+
+        self.assertEqual(fanout.pending_count(), 0)
+        self.assertEqual([candidate["claimHash"] for candidate in candidates], [claim_hash])
+        self.assertEqual(seen_candidates[0]["messageId"], "queued-observation")
+
+    def test_cultmesh_simulation_observation_fanout_keeps_failed_messages_pending(self) -> None:
+        closed_socket = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+        closed_socket.bind(("127.0.0.1", 0))
+        closed_port = closed_socket.getsockname()[1]
+        closed_socket.close()
+        peers = CultMeshPeerCatalog()
+        peers.upsert(CultMeshPeerCard(
+            peer_id="closed-simulation-peer",
+            verse_id="arena",
+            endpoints=(f"cultnet://127.0.0.1:{closed_port}",),
+            roles=("simulation-witness",),
+        ))
+        errors: list[tuple[str, str]] = []
+        fanout = CultMeshSimulationObservationFanout(
+            CultMeshDiscoveryClient("127.0.0.1", closed_port, timeout_seconds=0.2),
+            peers,
+            verse_id="arena",
+            roles=["simulation-witness"],
+            on_error=lambda endpoint, error: errors.append((endpoint, str(error))),
+        )
+        fanout.enqueue(simulation_observation(
+            message_id="retry-observation",
+            witness_runtime_id="python-fanout",
+            shard_id="arena",
+            shard_epoch=1,
+            frame=212,
+            subject_id="bob",
+            claim_kind="miss",
+            claim_hash=compute_simulation_claim_hash("miss", "alice", "bob", "frame:212"),
+            claim_summary="alice missed bob",
+        ).to_wire())
+
+        candidates = fanout.flush()
+
+        self.assertEqual(candidates, [])
+        self.assertEqual(fanout.pending_count(), 1)
+        self.assertEqual(len(errors), 1)
+        self.assertIn(f"127.0.0.1:{closed_port}", errors[0][0])
+
+    def test_cultmesh_simulation_observation_fanout_runs_background_loop(self) -> None:
+        hub = CultNetSimulationObservationHub(
+            CultNetSimulationConsensusOptions(minimum_witnesses=1, quorum_ratio=1.0)
+        )
+        server = CultMesh.serve_node(CultMesh.create_node(runtime_id="sim-loop-peer"), observation_hub=hub)
+        try:
+            peers = CultMeshPeerCatalog()
+            peers.upsert(CultMeshPeerCard(
+                peer_id="sim-loop-peer",
+                verse_id="arena",
+                endpoints=(f"cultnet://127.0.0.1:{server.port}",),
+                roles=("simulation-witness",),
+            ))
+            claim_hash = compute_simulation_claim_hash("block", "dana", "eve", "frame:211")
+            seen_candidates: list[dict[str, object]] = []
+            fanout = CultMeshSimulationObservationFanout(
+                CultMeshDiscoveryClient("127.0.0.1", server.port, timeout_seconds=2.0),
+                peers,
+                verse_id="arena",
+                roles=["simulation-witness"],
+                interval_seconds=0.05,
+                on_candidate=seen_candidates.append,
+            )
+            fanout.start()
+            fanout.enqueue(simulation_observation(
+                message_id="loop-observation",
+                witness_runtime_id="python-fanout",
+                shard_id="arena",
+                shard_epoch=1,
+                frame=211,
+                subject_id="eve",
+                claim_kind="block",
+                claim_hash=claim_hash,
+                claim_summary="dana blocked eve",
+            ).to_wire())
+            deadline = time.monotonic() + 2.0
+            while not seen_candidates and time.monotonic() < deadline:
+                time.sleep(0.01)
+            fanout.stop()
+        finally:
+            server.stop()
+
+        self.assertEqual(fanout.pending_count(), 0)
+        self.assertTrue(seen_candidates)
+        self.assertEqual(seen_candidates[0]["claimHash"], claim_hash)
+        self.assertEqual(seen_candidates[0]["messageId"], "loop-observation")
+
+    def test_cultmesh_discovery_client_fans_out_snapshots_to_peers(self) -> None:
+        document = define_database_entry_type(
+            "mesh.snapshot_fanout_note",
+            [("body", 0)],
+            schema_id="mesh.snapshot_fanout_note.v1",
+        )
+        first = CultMesh.create_node(runtime_id="snapshot-peer-a")
+        first.database.register_document(document)
+        first.database.put_raw_message(document, "note:a", {"body": "from-a"}, shard_id="notes", shard_epoch=1)
+        second = CultMesh.create_node(runtime_id="snapshot-peer-b")
+        second.database.register_document(document)
+        second.database.put_raw_message(document, "note:b", {"body": "from-b"}, shard_id="notes", shard_epoch=1)
+        target = CultMesh.create_node(runtime_id="snapshot-target")
+        target.database.register_document(document)
+        first_server = CultMesh.serve_node(first)
+        second_server = CultMesh.serve_node(second)
+        try:
+            peers = CultMeshPeerCatalog()
+            peers.upsert(CultMeshPeerCard(
+                peer_id="snapshot-peer-a",
+                verse_id="mesh",
+                endpoints=(f"cultnet://127.0.0.1:{first_server.port}", f"cultnet://127.0.0.1:{first_server.port}"),
+                roles=("read-replica",),
+            ))
+            peers.upsert(CultMeshPeerCard(
+                peer_id="snapshot-peer-b",
+                verse_id="mesh",
+                endpoints=(f"cultnet://127.0.0.1:{second_server.port}",),
+                roles=("read-replica",),
+            ))
+
+            client = CultMeshDiscoveryClient("127.0.0.1", first_server.port, timeout_seconds=2.0)
+            responses = client.fanout_snapshot_responses(
+                peers,
+                verse_id="mesh",
+                roles=["read-replica"],
+                schema_ids=["mesh.snapshot_fanout_note.v1"],
+            )
+            applied = client.sync_snapshots(
+                target.database,
+                peers,
+                verse_id="mesh",
+                roles=["read-replica"],
+                schema_ids=["mesh.snapshot_fanout_note.v1"],
+            )
+        finally:
+            first_server.stop()
+            second_server.stop()
+
+        self.assertEqual(len(responses), 2)
+        self.assertTrue(all(isinstance(response, CultNetRawSnapshotResponse) for response in responses))
+        self.assertEqual(
+            sorted(record.record_key for response in responses for record in response.documents),
+            ["note:a", "note:b"],
+        )
+        self.assertEqual(sorted(record.record_key for record in applied), ["note:a", "note:b"])
+        self.assertEqual(target.database.get_required(document, "note:a")["body"], "from-a")
+        self.assertEqual(target.database.get_required(document, "note:b")["body"], "from-b")
+
+    def test_cultmesh_discovery_client_sync_documents_returns_requested_aliases(self) -> None:
+        @dataclass
+        class CanonicalNote:
+            body: str
+
+        @dataclass
+        class UiNote:
+            body: str
+
+        document = define_database_entry_type(
+            "mesh.snapshot_fanout_alias_note",
+            [("body", 0)],
+            cls=CanonicalNote,
+            schema_id="mesh.snapshot_fanout_alias_note.v1",
+            schema_name="mesh.snapshot_fanout_alias_note",
+            schema_version="mesh.snapshot_fanout_alias_note.v1",
+        )
+        alias = define_database_entry_type(
+            "mesh.snapshot_fanout_alias_note.ui",
+            [("body", 0)],
+            cls=UiNote,
+            schema_id="mesh.snapshot_fanout_alias_note.v1",
+            schema_name="mesh.snapshot_fanout_alias_note",
+            schema_version="mesh.snapshot_fanout_alias_note.v1",
+        )
+        source = CultMesh.create_node(runtime_id="snapshot-alias-source")
+        source.database.register_document(document)
+        source.database.put_raw_message(document, "note:alias", CanonicalNote("from-source"))
+        target = CultMesh.create_node(runtime_id="snapshot-alias-target")
+        target.database.register_document(document)
+        server = CultMesh.serve_node(source)
+        try:
+            peers = CultMeshPeerCatalog()
+            peers.upsert(CultMeshPeerCard(
+                peer_id="snapshot-alias-source",
+                verse_id="mesh",
+                endpoints=(f"cultnet://127.0.0.1:{server.port}",),
+                roles=("read-replica",),
+            ))
+
+            values = CultMeshDiscoveryClient("127.0.0.1", server.port, timeout_seconds=2.0).sync_documents(
+                target.database,
+                peers,
+                verse_id="mesh",
+                roles=["read-replica"],
+                documents=[(alias, "note:alias")],
+            )
+        finally:
+            server.stop()
+
+        self.assertEqual(len(values), 1)
+        self.assertIsInstance(values[0], UiNote)
+        self.assertEqual(values[0].body, "from-source")
+        self.assertEqual(target.database.get_required(document, "note:alias").body, "from-source")
+        self.assertIsInstance(target.database.get_required(alias, "note:alias"), UiNote)
+
+    def test_cultmesh_document_subscription_syncs_alias_snapshot_and_changes(self) -> None:
+        @dataclass
+        class CanonicalNote:
+            body: str
+
+        @dataclass
+        class UiNote:
+            body: str
+
+        document = define_database_entry_type(
+            "mesh.subscription_alias_note",
+            [("body", 0)],
+            cls=CanonicalNote,
+            schema_id="mesh.subscription_alias_note.v1",
+            schema_name="mesh.subscription_alias_note",
+            schema_version="mesh.subscription_alias_note.v1",
+        )
+        alias = define_database_entry_type(
+            "mesh.subscription_alias_note.ui",
+            [("body", 0)],
+            cls=UiNote,
+            schema_id="mesh.subscription_alias_note.v1",
+            schema_name="mesh.subscription_alias_note",
+            schema_version="mesh.subscription_alias_note.v1",
+        )
+        source = CultMesh.create_node(runtime_id="subscription-alias-source")
+        source.database.register_document(document)
+        source.database.put_raw_message(document, "note:live", CanonicalNote("initial"))
+        target = CultMesh.create_node(runtime_id="subscription-alias-target")
+        target.database.register_document(document)
+        server = CultMesh.serve_node(source)
+        try:
+            raw_client = CultMesh.create_client("127.0.0.1", server.port, timeout_seconds=2.0)
+            with CultMesh.subscribe_document(target, raw_client, alias, "note:live") as subscription:
+                initial = subscription.sync_initial()
+                subscription.send(document_put_raw(
+                    message_id="subscription-alias-put",
+                    key="note:live",
+                    schema_id="mesh.subscription_alias_note.v1",
+                    stored_at="2026-06-14T00:00:00Z",
+                    payload=document.encode_payload(CanonicalNote("updated")),
+                ))
+                updated = subscription.read_next_change()
+                subscription.send(document_delete(
+                    message_id="subscription-alias-delete",
+                    schema_id="mesh.subscription_alias_note.v1",
+                    record_key="note:live",
+                ))
+                removed = subscription.read_next_change()
+        finally:
+            server.stop()
+
+        self.assertIsInstance(initial, UiNote)
+        self.assertEqual(initial.body, "initial")
+        self.assertEqual(updated.change_kind, "updated")
+        self.assertIsInstance(updated.value, UiNote)
+        self.assertEqual(updated.value.body, "updated")
+        self.assertIsInstance(updated.previous_value, UiNote)
+        self.assertEqual(updated.previous_value.body, "initial")
+        self.assertEqual(removed.change_kind, "removed")
+        self.assertIsNone(removed.value)
+        self.assertIsInstance(removed.previous_value, UiNote)
+        self.assertEqual(removed.previous_value.body, "updated")
+        self.assertIsNone(target.database.get(alias, "note:live"))
+
+    def test_cultmesh_snapshot_fanout_syncs_once_and_reports_applied_records(self) -> None:
+        document = define_database_entry_type(
+            "mesh.snapshot_loop_note",
+            [("body", 0)],
+            schema_id="mesh.snapshot_loop_note.v1",
+        )
+        source = CultMesh.create_node(runtime_id="snapshot-loop-source")
+        source.database.register_document(document)
+        source.database.put_raw_message(document, "note:sync-once", {"body": "from-source"})
+        target = CultMesh.create_node(runtime_id="snapshot-loop-target")
+        target.database.register_document(document)
+        server = CultMesh.serve_node(source)
+        try:
+            peers = CultMeshPeerCatalog()
+            peers.upsert(CultMeshPeerCard(
+                peer_id="snapshot-loop-source",
+                verse_id="mesh",
+                endpoints=(f"cultnet://127.0.0.1:{server.port}",),
+                roles=("read-replica",),
+            ))
+            seen: list[str] = []
+            fanout = CultMeshSnapshotFanout(
+                CultMeshDiscoveryClient("127.0.0.1", server.port, timeout_seconds=2.0),
+                target.database,
+                peers,
+                verse_id="mesh",
+                roles=["read-replica"],
+                schema_ids=["mesh.snapshot_loop_note.v1"],
+                on_applied=lambda record: seen.append(record.record_key),
+            )
+
+            applied = fanout.sync_once()
+        finally:
+            server.stop()
+
+        self.assertEqual([record.record_key for record in applied], ["note:sync-once"])
+        self.assertEqual(seen, ["note:sync-once"])
+        self.assertEqual(target.database.get_required(document, "note:sync-once")["body"], "from-source")
+
+    def test_cultmesh_snapshot_fanout_syncs_typed_documents_and_reports_alias_values(self) -> None:
+        @dataclass
+        class CanonicalNote:
+            body: str
+
+        @dataclass
+        class UiNote:
+            body: str
+
+        document = define_database_entry_type(
+            "mesh.snapshot_loop_alias_note",
+            [("body", 0)],
+            cls=CanonicalNote,
+            schema_id="mesh.snapshot_loop_alias_note.v1",
+            schema_name="mesh.snapshot_loop_alias_note",
+            schema_version="mesh.snapshot_loop_alias_note.v1",
+        )
+        alias = define_database_entry_type(
+            "mesh.snapshot_loop_alias_note.ui",
+            [("body", 0)],
+            cls=UiNote,
+            schema_id="mesh.snapshot_loop_alias_note.v1",
+            schema_name="mesh.snapshot_loop_alias_note",
+            schema_version="mesh.snapshot_loop_alias_note.v1",
+        )
+        source = CultMesh.create_node(runtime_id="snapshot-loop-alias-source")
+        source.database.register_document(document)
+        source.database.put_raw_message(document, "note:typed-loop", CanonicalNote("from-source"))
+        target = CultMesh.create_node(runtime_id="snapshot-loop-alias-target")
+        target.database.register_document(document)
+        server = CultMesh.serve_node(source)
+        try:
+            peers = CultMeshPeerCatalog()
+            peers.upsert(CultMeshPeerCard(
+                peer_id="snapshot-loop-alias-source",
+                verse_id="mesh",
+                endpoints=(f"cultnet://127.0.0.1:{server.port}",),
+                roles=("read-replica",),
+            ))
+            seen: list[UiNote] = []
+            fanout = CultMeshSnapshotFanout(
+                CultMeshDiscoveryClient("127.0.0.1", server.port, timeout_seconds=2.0),
+                target.database,
+                peers,
+                verse_id="mesh",
+                roles=["read-replica"],
+                documents=[(alias, "note:typed-loop")],
+                on_document=seen.append,
+            )
+
+            values = fanout.sync_once()
+        finally:
+            server.stop()
+
+        self.assertEqual(len(values), 1)
+        self.assertIsInstance(values[0], UiNote)
+        self.assertEqual(values[0].body, "from-source")
+        self.assertEqual(seen, [values[0]])
+        self.assertEqual(target.database.get_required(document, "note:typed-loop").body, "from-source")
+        self.assertIsInstance(target.database.get_required(alias, "note:typed-loop"), UiNote)
+
+    def test_cultmesh_snapshot_fanout_runs_background_loop(self) -> None:
+        document = define_database_entry_type(
+            "mesh.snapshot_background_note",
+            [("body", 0)],
+            schema_id="mesh.snapshot_background_note.v1",
+        )
+        source = CultMesh.create_node(runtime_id="snapshot-background-source")
+        source.database.register_document(document)
+        source.database.put_raw_message(document, "note:background", {"body": "from-background"})
+        target = CultMesh.create_node(runtime_id="snapshot-background-target")
+        target.database.register_document(document)
+        server = CultMesh.serve_node(source)
+        try:
+            peers = CultMeshPeerCatalog()
+            peers.upsert(CultMeshPeerCard(
+                peer_id="snapshot-background-source",
+                verse_id="mesh",
+                endpoints=(f"cultnet://127.0.0.1:{server.port}",),
+                roles=("read-replica",),
+            ))
+            seen: list[str] = []
+            fanout = CultMeshSnapshotFanout(
+                CultMeshDiscoveryClient("127.0.0.1", server.port, timeout_seconds=2.0),
+                target.database,
+                peers,
+                verse_id="mesh",
+                roles=["read-replica"],
+                schema_ids=["mesh.snapshot_background_note.v1"],
+                interval_seconds=0.05,
+                on_applied=lambda record: seen.append(record.record_key),
+            )
+            fanout.start()
+            deadline = time.monotonic() + 2.0
+            while not seen and time.monotonic() < deadline:
+                time.sleep(0.01)
+            fanout.stop()
+        finally:
+            server.stop()
+
+        self.assertTrue(seen)
+        self.assertEqual(target.database.get_required(document, "note:background")["body"], "from-background")
+
+    def test_cultmesh_peer_health_monitor_probes_reachable_and_failed_endpoints(self) -> None:
+        document = define_database_entry_type(
+            "mesh.health_note",
+            [("body", 0)],
+            schema_id="mesh.health_note.v1",
+        )
+        node = CultMesh.create_node(runtime_id="health-peer")
+        node.database.register_document(document)
+        server = CultMesh.serve_node(node)
+        closed_socket = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+        closed_socket.bind(("127.0.0.1", 0))
+        closed_port = closed_socket.getsockname()[1]
+        closed_socket.close()
+        try:
+            peers = CultMeshPeerCatalog()
+            peers.upsert(CultMeshPeerCard(
+                peer_id="health-peer",
+                verse_id="mesh",
+                endpoints=(f"cultnet://127.0.0.1:{server.port}",),
+                roles=("read-replica",),
+            ))
+            peers.upsert(CultMeshPeerCard(
+                peer_id="closed-peer",
+                verse_id="mesh",
+                endpoints=(f"cultnet://127.0.0.1:{closed_port}",),
+                roles=("read-replica",),
+            ))
+            seen: list[tuple[str, bool]] = []
+            monitor = CultMeshPeerHealthMonitor(
+                runtime_id="health-prober",
+                timeout_seconds=0.2,
+                on_update=lambda health: seen.append((health.peer_id, health.is_reachable)),
+            )
+
+            results = monitor.probe_catalog(peers, verse_id="mesh", roles=["read-replica"])
+        finally:
+            server.stop()
+
+        by_peer = {result.peer_id: result for result in results}
+        self.assertTrue(by_peer["health-peer"].is_reachable)
+        self.assertEqual(by_peer["health-peer"].runtime_id, "health-peer")
+        self.assertEqual(by_peer["health-peer"].runtime_kind, "python")
+        self.assertEqual(by_peer["health-peer"].display_name, "health-peer")
+        self.assertEqual(by_peer["health-peer"].supported_document_types, ("mesh.health_note",))
+        self.assertIn("cultnet.hello.v0", by_peer["health-peer"].supported_message_versions)
+        self.assertIn("cultnet.error.v0", by_peer["health-peer"].supported_message_versions)
+        self.assertEqual(by_peer["health-peer"].supported_mutation_contracts[0]["documentType"], "mesh.health_note")
+        self.assertIn("shardLog", by_peer["health-peer"].supported_mutation_contracts[0]["operations"])
+        self.assertFalse(by_peer["closed-peer"].is_reachable)
+        self.assertIsNone(by_peer["closed-peer"].runtime_kind)
+        self.assertEqual(by_peer["closed-peer"].supported_document_types, ())
+        self.assertEqual(by_peer["closed-peer"].supported_message_versions, ())
+        self.assertEqual(by_peer["closed-peer"].supported_mutation_contracts, ())
+        self.assertTrue(by_peer["closed-peer"].error)
+        self.assertEqual({peer_id for peer_id, _ in seen}, {"health-peer", "closed-peer"})
+        self.assertEqual(len(monitor.latest()), 2)
+
+    def test_cultmesh_peer_health_monitor_runs_background_probe_loop(self) -> None:
+        server = CultMesh.serve_node(CultMesh.create_node(runtime_id="health-loop-peer"))
+        try:
+            peers = CultMeshPeerCatalog()
+            peers.upsert(CultMeshPeerCard(
+                peer_id="health-loop-peer",
+                verse_id="mesh",
+                endpoints=(f"cultnet://127.0.0.1:{server.port}",),
+                roles=("read-replica",),
+            ))
+            seen: list[str] = []
+            monitor = CultMeshPeerHealthMonitor(
+                runtime_id="health-loop-prober",
+                timeout_seconds=0.2,
+                interval_seconds=0.05,
+                on_update=lambda health: seen.append(health.peer_id),
+            )
+            monitor.start(peers, verse_id="mesh", roles=["read-replica"])
+            deadline = time.monotonic() + 2.0
+            while time.monotonic() < deadline:
+                latest = monitor.latest()
+                if latest and latest[0].is_reachable:
+                    break
+                time.sleep(0.01)
+            monitor.stop()
+        finally:
+            server.stop()
+
+        self.assertTrue(seen)
+        latest = monitor.latest()
+        self.assertEqual(latest[0].peer_id, "health-loop-peer")
+        self.assertTrue(latest[0].is_reachable)
+
+    def test_cultmesh_daemon_entrypoint_serves_framed_cultnet_hello(self) -> None:
+        with tempfile.TemporaryDirectory() as temp:
+            ready_path = Path(temp) / "ready.json"
+            package_src = Path(__file__).resolve().parents[1] / "src"
+            env = dict(os.environ)
+            existing_pythonpath = env.get("PYTHONPATH")
+            env["PYTHONPATH"] = (
+                str(package_src)
+                if not existing_pythonpath
+                else f"{package_src}{os.pathsep}{existing_pythonpath}"
+            )
+            process = subprocess.Popen(
+                [
+                    sys.executable,
+                    "-m",
+                    "cultmesh_py.daemon",
+                    "--runtime-id",
+                    "daemon-test-peer",
+                    "--display-name",
+                    "Daemon Test Peer",
+                    "--port",
+                    "0",
+                    "--ready-file",
+                    str(ready_path),
+                    "--seed-interop-note",
+                    "--seed-shard-id",
+                    "daemon-interop",
+                    "--verse-id",
+                    "daemon-verse",
+                    "--verse-display-name",
+                    "Daemon Verse",
+                    "--role",
+                    "shard-primary",
+                ],
+                stdout=subprocess.PIPE,
+                stderr=subprocess.PIPE,
+                text=True,
+                env=env,
+            )
+            try:
+                deadline = time.monotonic() + 5.0
+                while not ready_path.exists() and time.monotonic() < deadline:
+                    if process.poll() is not None:
+                        break
+                    time.sleep(0.05)
+                if not ready_path.exists():
+                    _, stderr = process.communicate(timeout=2.0)
+                    self.fail(f"cultmesh daemon did not publish readiness: {stderr}")
+                ready = json.loads(ready_path.read_text(encoding="utf-8"))
+                self.assertEqual(ready["schemaVersion"], READY_SCHEMA_VERSION)
+                self.assertEqual(ready["runtimeId"], "daemon-test-peer")
+                self.assertEqual(ready["runtimeKind"], "python")
+                self.assertEqual(ready["displayName"], "Daemon Test Peer")
+                self.assertEqual(ready["endpoint"], f"cultnet://127.0.0.1:{ready['port']}")
+                self.assertEqual(ready["shardIds"], ["daemon-interop"])
+                self.assertEqual(ready["supportedDocumentTypes"], ["cultcache.interop-note"])
+                self.assertIn("cultnet.hello.v0", ready["supportedMessageVersions"])
+                self.assertIn("cultnet.document_put_raw.v0", ready["supportedMessageVersions"])
+                self.assertNotIn("cultnet.simulation_observation.v0", ready["supportedMessageVersions"])
+                self.assertEqual(ready["supportedMutationContracts"][0]["documentType"], "cultcache.interop-note")
+                self.assertIn("shardLog", ready["supportedMutationContracts"][0]["operations"])
+                self.assertEqual(ready["snapshotLimits"], {"maxSnapshotBytes": None, "maxSnapshotDocuments": None})
+                self.assertEqual(ready["verses"][0]["verseId"], "daemon-verse")
+                self.assertEqual(ready["verses"][0]["displayName"], "Daemon Verse")
+                self.assertEqual(ready["verses"][0]["discoveryEndpoints"], [ready["endpoint"]])
+                self.assertEqual(ready["verses"][0]["authorityRuntimeIds"], ["daemon-test-peer"])
+                self.assertEqual(ready["peers"][0]["peerId"], "daemon-test-peer")
+                self.assertEqual(ready["peers"][0]["endpoints"], [ready["endpoint"]])
+                self.assertEqual(ready["peers"][0]["roles"], ["shard-primary"])
+                self.assertEqual(ready["peers"][0]["shardIds"], ["daemon-interop"])
+
+                client = CultMesh.create_client("127.0.0.1", int(ready["port"]), timeout_seconds=2.0)
+                hello_response = client.request(
+                    hello(runtime_id="daemon-test-prober"),
+                    expected_schema_version="cultnet.hello.v0",
+                )
+
+                self.assertEqual(hello_response["runtimeId"], "daemon-test-peer")
+                self.assertEqual(hello_response["displayName"], "Daemon Test Peer")
+                self.assertIn("cultnet.hello.v0", hello_response["supportedMessageVersions"])
+                self.assertIn("cultnet.schema_catalog_request.v0", hello_response["supportedMessageVersions"])
+                self.assertNotIn("cultnet.simulation_observation.v0", hello_response["supportedMessageVersions"])
+                self.assertEqual(hello_response["supportedDocumentTypes"], ["cultcache.interop-note"])
+                self.assertEqual(hello_response["transportProfiles"][0]["transports"][0]["protocol"], "tcp_framed")
+                self.assertEqual(hello_response["transportProfiles"][0]["transports"][0]["port"], int(ready["port"]))
+                self.assertEqual(ready["supportedMessageVersions"], hello_response["supportedMessageVersions"])
+                self.assertEqual(ready["supportedMutationContracts"], hello_response["supportedMutationContracts"])
+                self.assertEqual(ready["transportProfiles"], hello_response["transportProfiles"])
+
+                schema_response = client.fetch_schema_catalog(schema_ids=["cultcache.interop-note"], include_schema_json=True)
+                self.assertEqual(schema_response["schemas"][0]["schemaVersion"], INTEROP_SCHEMA_VERSION)
+                self.assertEqual(schema_response["schemas"][0]["documentType"], "cultcache.interop-note")
+
+                snapshot_response = client.fetch_snapshot_response(schema_ids=["cultcache.interop-note"])
+                self.assertEqual(snapshot_response.documents[0].record_key, "note:daemon-test-peer")
+                note = interop_note_document.decode_payload(snapshot_response.documents[0].payload)
+                self.assertEqual(note["authorRuntimeId"], "daemon-test-peer")
+                self.assertIn("daemon", note["tags"])
+
+                shard_catalog = client.fetch_shard_catalog(schema_ids=["cultcache.interop-note"])
+                self.assertEqual(shard_catalog["shards"][0]["shardId"], "daemon-interop")
+                self.assertEqual(shard_catalog["shards"][0]["schemaIds"], ["cultcache.interop-note"])
+
+                shard_log = client.fetch_shard_log_response(shard_id="daemon-interop", shard_epoch=1)
+                self.assertFalse(shard_log.resync_required)
+                self.assertEqual(shard_log.entries[0].sequence, 1)
+                self.assertEqual(shard_log.entries[0].change_kind, "added")
+                self.assertIsNotNone(shard_log.entries[0].raw_document)
+                assert shard_log.entries[0].raw_document is not None
+                self.assertEqual(shard_log.entries[0].raw_document.record_key, "note:daemon-test-peer")
+
+                discovery_client = CultMesh.create_verse_discovery_client("127.0.0.1", int(ready["port"]), timeout_seconds=2.0)
+                verses = discovery_client.fetch_verses(transport_version="cultmesh.v0")
+                self.assertEqual(verses[0].verse_id, "daemon-verse")
+                self.assertEqual(verses[0].display_name, "Daemon Verse")
+                self.assertEqual(verses[0].discovery_endpoints, (ready["endpoint"],))
+                self.assertEqual(verses[0].authority_runtime_ids, ("daemon-test-peer",))
+                self.assertEqual([verse.to_wire() for verse in verses], ready["verses"])
+
+                peers = discovery_client.fetch_peers(verse_id="daemon-verse", roles=["shard-primary"])
+                self.assertEqual(peers[0].peer_id, "daemon-test-peer")
+                self.assertEqual(peers[0].endpoints, (ready["endpoint"],))
+                self.assertEqual(peers[0].roles, ("shard-primary",))
+                self.assertEqual(peers[0].shard_ids, ("daemon-interop",))
+                self.assertEqual([peer.to_wire() for peer in peers], ready["peers"])
+
+                monitor = CultMeshPeerHealthMonitor(runtime_id="daemon-health-prober", timeout_seconds=2.0)
+                health = monitor.probe_peer(peers[0])[0]
+                self.assertTrue(health.is_reachable)
+                self.assertEqual(health.runtime_id, "daemon-test-peer")
+                self.assertEqual(health.supported_document_types, ("cultcache.interop-note",))
+                self.assertEqual(health.supported_mutation_contracts[0]["documentType"], "cultcache.interop-note")
+            finally:
+                process.terminate()
+                try:
+                    process.communicate(timeout=5.0)
+                except subprocess.TimeoutExpired:
+                    process.kill()
+                    process.communicate(timeout=5.0)
+
+    def test_cultmesh_daemon_restarts_with_persisted_cache_and_shard_log(self) -> None:
+        with tempfile.TemporaryDirectory() as temp:
+            root = Path(temp)
+            cache_path = root / "mesh.cc"
+            shard_log_path = root / "shard-log"
+            env = dict(os.environ)
+            package_src = Path(__file__).resolve().parents[1] / "src"
+            existing_pythonpath = env.get("PYTHONPATH")
+            env["PYTHONPATH"] = (
+                str(package_src)
+                if not existing_pythonpath
+                else f"{package_src}{os.pathsep}{existing_pythonpath}"
+            )
+
+            first_ready = root / "first-ready.json"
+            first = subprocess.Popen(
+                [
+                    sys.executable,
+                    "-m",
+                    "cultmesh_py.daemon",
+                    "--runtime-id",
+                    "durable-daemon-peer",
+                    "--port",
+                    "0",
+                    "--cache-file",
+                    str(cache_path),
+                    "--enable-durable-shard-logs",
+                    "--shard-log-file",
+                    str(shard_log_path),
+                    "--seed-interop-note",
+                    "--seed-shard-id",
+                    "durable-interop",
+                    "--ready-file",
+                    str(first_ready),
+                ],
+                stdout=subprocess.PIPE,
+                stderr=subprocess.PIPE,
+                text=True,
+                env=env,
+            )
+            try:
+                self._wait_for_ready_file(first, first_ready)
+            finally:
+                self._terminate_process(first)
+
+            second_ready = root / "second-ready.json"
+            second = subprocess.Popen(
+                [
+                    sys.executable,
+                    "-m",
+                    "cultmesh_py.daemon",
+                    "--runtime-id",
+                    "durable-daemon-peer",
+                    "--port",
+                    "0",
+                    "--cache-file",
+                    str(cache_path),
+                    "--enable-durable-shard-logs",
+                    "--shard-log-file",
+                    str(shard_log_path),
+                    "--register-interop-note",
+                    "--verse-id",
+                    "durable-verse",
+                    "--role",
+                    "shard-primary",
+                    "--ready-file",
+                    str(second_ready),
+                ],
+                stdout=subprocess.PIPE,
+                stderr=subprocess.PIPE,
+                text=True,
+                env=env,
+            )
+            try:
+                ready = self._wait_for_ready_file(second, second_ready)
+                client = CultMesh.create_client("127.0.0.1", int(ready["port"]), timeout_seconds=2.0)
+
+                snapshot_response = client.fetch_snapshot_response(schema_ids=["cultcache.interop-note"])
+                self.assertEqual(snapshot_response.documents[0].record_key, "note:durable-daemon-peer")
+                note = interop_note_document.decode_payload(snapshot_response.documents[0].payload)
+                self.assertEqual(note["authorRuntimeId"], "durable-daemon-peer")
+
+                shard_log = client.fetch_shard_log_response(shard_id="durable-interop", shard_epoch=1)
+                self.assertFalse(shard_log.resync_required)
+                self.assertEqual(shard_log.entries[0].sequence, 1)
+                self.assertIsNotNone(shard_log.entries[0].raw_document)
+                assert shard_log.entries[0].raw_document is not None
+                self.assertEqual(shard_log.entries[0].raw_document.record_key, "note:durable-daemon-peer")
+
+                discovery_client = CultMesh.create_verse_discovery_client("127.0.0.1", int(ready["port"]), timeout_seconds=2.0)
+                peers = discovery_client.fetch_peers(verse_id="durable-verse", roles=["shard-primary"])
+                self.assertEqual(peers[0].shard_ids, ("durable-interop",))
+            finally:
+                self._terminate_process(second)
+
+    def test_cultmesh_daemon_serves_live_database_subscription_mutations(self) -> None:
+        with tempfile.TemporaryDirectory() as temp:
+            ready_path = Path(temp) / "ready.json"
+            package_src = Path(__file__).resolve().parents[1] / "src"
+            env = dict(os.environ)
+            existing_pythonpath = env.get("PYTHONPATH")
+            env["PYTHONPATH"] = (
+                str(package_src)
+                if not existing_pythonpath
+                else f"{package_src}{os.pathsep}{existing_pythonpath}"
+            )
+            process = subprocess.Popen(
+                [
+                    sys.executable,
+                    "-m",
+                    "cultmesh_py.daemon",
+                    "--runtime-id",
+                    "live-daemon-peer",
+                    "--port",
+                    "0",
+                    "--seed-interop-note",
+                    "--seed-shard-id",
+                    "live-interop",
+                    "--ready-file",
+                    str(ready_path),
+                ],
+                stdout=subprocess.PIPE,
+                stderr=subprocess.PIPE,
+                text=True,
+                env=env,
+            )
+            try:
+                ready = self._wait_for_ready_file(process, ready_path)
+                client = CultMesh.create_client("127.0.0.1", int(ready["port"]), timeout_seconds=2.0)
+                live_note = {
+                    "schemaVersion": INTEROP_SCHEMA_VERSION,
+                    "documentId": "note:daemon-live",
+                    "authorRuntimeId": "daemon-live-client",
+                    "title": "daemon live subscription note",
+                    "body": "live subscription put from Python daemon smoke",
+                    "tags": ["daemon", "subscription", "interop"],
+                }
+
+                with client.subscribe_database(
+                    subscription_id="daemon-live-sub",
+                    schema_ids=["cultcache.interop-note"],
+                ) as subscription:
+                    snapshot = subscription.read_next_snapshot_response()
+                    subscription.send(document_put_raw(
+                        message_id="daemon-live-put",
+                        key="note:daemon-live",
+                        schema_id="cultcache.interop-note",
+                        stored_at="2026-06-14T00:00:00Z",
+                        payload=interop_note_document.encode_payload(live_note),
+                        source_runtime_id="daemon-live-client",
+                        shard_id="live-interop",
+                        shard_epoch=1,
+                    ))
+                    change = subscription.read_next_change()
+
+                self.assertEqual(snapshot.documents[0].record_key, "note:live-daemon-peer")
+                self.assertEqual(change.change_kind, "added")
+                self.assertEqual(change.record_key, "note:daemon-live")
+                self.assertIsNotNone(change.raw_document)
+                assert change.raw_document is not None
+                self.assertEqual(
+                    interop_note_document.decode_payload(change.raw_document.payload),
+                    live_note,
+                )
+
+                shard_log = client.fetch_shard_log_response(shard_id="live-interop", shard_epoch=1)
+                self.assertFalse(shard_log.resync_required)
+                self.assertEqual([entry.sequence for entry in shard_log.entries], [1, 2])
+                self.assertEqual(shard_log.entries[1].change_kind, "added")
+                self.assertIsNotNone(shard_log.entries[1].raw_document)
+                assert shard_log.entries[1].raw_document is not None
+                self.assertEqual(shard_log.entries[1].raw_document.record_key, "note:daemon-live")
+            finally:
+                self._terminate_process(process)
+
+    def test_cultmesh_daemon_serves_compacted_shard_log_resync_boundary(self) -> None:
+        with tempfile.TemporaryDirectory() as temp:
+            root = Path(temp)
+            cache_path = root / "mesh.cc"
+            shard_log_path = root / "shard-log"
+            store = CultNetFileShardMutationLogStore(shard_log_path)
+            node = CultMesh.create_node(
+                cache_path,
+                runtime_id="compacted-daemon-peer",
+                enable_durable_shard_logs=True,
+                shard_log_path=shard_log_path,
+            )
+            node.database.register_document(interop_note_document)
+            node.database.put_raw_message(
+                interop_note_document,
+                "note:compacted-one",
+                {
+                    "schemaVersion": INTEROP_SCHEMA_VERSION,
+                    "documentId": "note:compacted-one",
+                    "authorRuntimeId": "compacted-daemon-peer",
+                    "title": "compacted daemon note one",
+                    "body": "first retained cache value",
+                    "tags": ["daemon", "compaction"],
+                },
+                message_id="compacted-put-1",
+                shard_id="compacted-interop",
+                shard_epoch=7,
+            )
+            node.database.put_raw_message(
+                interop_note_document,
+                "note:compacted-two",
+                {
+                    "schemaVersion": INTEROP_SCHEMA_VERSION,
+                    "documentId": "note:compacted-two",
+                    "authorRuntimeId": "compacted-daemon-peer",
+                    "title": "compacted daemon note two",
+                    "body": "second retained cache value",
+                    "tags": ["daemon", "compaction"],
+                },
+                message_id="compacted-put-2",
+                shard_id="compacted-interop",
+                shard_epoch=7,
+            )
+            store.compact_through("compacted-interop", 1)
+
+            ready_path = root / "ready.json"
+            package_src = Path(__file__).resolve().parents[1] / "src"
+            env = dict(os.environ)
+            existing_pythonpath = env.get("PYTHONPATH")
+            env["PYTHONPATH"] = (
+                str(package_src)
+                if not existing_pythonpath
+                else f"{package_src}{os.pathsep}{existing_pythonpath}"
+            )
+            process = subprocess.Popen(
+                [
+                    sys.executable,
+                    "-m",
+                    "cultmesh_py.daemon",
+                    "--runtime-id",
+                    "compacted-daemon-peer",
+                    "--port",
+                    "0",
+                    "--cache-file",
+                    str(cache_path),
+                    "--enable-durable-shard-logs",
+                    "--shard-log-file",
+                    str(shard_log_path),
+                    "--register-interop-note",
+                    "--ready-file",
+                    str(ready_path),
+                ],
+                stdout=subprocess.PIPE,
+                stderr=subprocess.PIPE,
+                text=True,
+                env=env,
+            )
+            try:
+                ready = self._wait_for_ready_file(process, ready_path)
+                client = CultMesh.create_client("127.0.0.1", int(ready["port"]), timeout_seconds=2.0)
+
+                snapshot_response = client.fetch_snapshot_response(schema_ids=["cultcache.interop-note"])
+                self.assertEqual(
+                    {document.record_key for document in snapshot_response.documents},
+                    {"note:compacted-one", "note:compacted-two"},
+                )
+
+                compacted = client.fetch_shard_log_response(
+                    shard_id="compacted-interop",
+                    shard_epoch=7,
+                    after_sequence=0,
+                )
+                retained = client.fetch_shard_log_response(
+                    shard_id="compacted-interop",
+                    shard_epoch=7,
+                    after_sequence=1,
+                )
+
+                self.assertTrue(compacted.resync_required)
+                self.assertEqual(compacted.reason, "compacted_history")
+                self.assertEqual(compacted.compacted_through, 1)
+                self.assertEqual(compacted.entries, ())
+                self.assertFalse(retained.resync_required)
+                self.assertEqual([entry.sequence for entry in retained.entries], [2])
+                self.assertIsNotNone(retained.entries[0].raw_document)
+                assert retained.entries[0].raw_document is not None
+                self.assertEqual(retained.entries[0].raw_document.record_key, "note:compacted-two")
+            finally:
+                self._terminate_process(process)
+
+    def test_cultmesh_daemon_accepts_schema_write_forwarder_mutations(self) -> None:
+        with tempfile.TemporaryDirectory() as temp:
+            ready_path = Path(temp) / "ready.json"
+            package_src = Path(__file__).resolve().parents[1] / "src"
+            env = dict(os.environ)
+            existing_pythonpath = env.get("PYTHONPATH")
+            env["PYTHONPATH"] = (
+                str(package_src)
+                if not existing_pythonpath
+                else f"{package_src}{os.pathsep}{existing_pythonpath}"
+            )
+            process = subprocess.Popen(
+                [
+                    sys.executable,
+                    "-m",
+                    "cultmesh_py.daemon",
+                    "--runtime-id",
+                    "forwarder-daemon-peer",
+                    "--port",
+                    "0",
+                    "--register-interop-note",
+                    "--ready-file",
+                    str(ready_path),
+                ],
+                stdout=subprocess.PIPE,
+                stderr=subprocess.PIPE,
+                text=True,
+                env=env,
+            )
+            try:
+                ready = self._wait_for_ready_file(process, ready_path)
+                endpoint = f"cultnet://127.0.0.1:{ready['port']}"
+                shard = CultNetShardDescriptor(
+                    shard_id="forwarded-interop",
+                    owner_runtime_id="forwarder-daemon-peer",
+                    epoch=3,
+                    is_primary=False,
+                    schema_ids=("cultcache.interop-note",),
+                    primary_endpoints=(endpoint,),
+                )
+                forwarder: CultNetShardWriteForwarder = CultNetSchemaWriteForwarder(timeout_seconds=2.0)
+                note = {
+                    "schemaVersion": INTEROP_SCHEMA_VERSION,
+                    "documentId": "note:forwarded-daemon",
+                    "authorRuntimeId": "forwarding-client",
+                    "title": "forwarded daemon note",
+                    "body": "forwarded through the schema write-forwarder",
+                    "tags": ["daemon", "forwarded"],
+                }
+
+                forwarder.forward_put(shard, document_put_raw(
+                    message_id="forwarded-daemon-put",
+                    key="note:forwarded-daemon",
+                    schema_id="cultcache.interop-note",
+                    stored_at="2026-06-14T00:00:00Z",
+                    payload=interop_note_document.encode_payload(note),
+                    source_runtime_id="forwarding-client",
+                ).to_wire())
+
+                client = CultMesh.create_client("127.0.0.1", int(ready["port"]), timeout_seconds=2.0)
+                self._eventually(lambda: bool(client.fetch_snapshot_response(
+                    schema_ids=["cultcache.interop-note"],
+                    record_keys=["note:forwarded-daemon"],
+                ).documents))
+                snapshot = client.fetch_snapshot_response(
+                    schema_ids=["cultcache.interop-note"],
+                    record_keys=["note:forwarded-daemon"],
+                )
+                self.assertEqual(
+                    interop_note_document.decode_payload(snapshot.documents[0].payload),
+                    note,
+                )
+
+                forwarder.forward_delete(shard, document_delete(
+                    message_id="forwarded-daemon-delete",
+                    schema_id="cultcache.interop-note",
+                    record_key="note:forwarded-daemon",
+                ).to_wire())
+                self._eventually(lambda: not client.fetch_snapshot_response(
+                    schema_ids=["cultcache.interop-note"],
+                    record_keys=["note:forwarded-daemon"],
+                ).documents)
+
+                shard_log = client.fetch_shard_log_response(shard_id="forwarded-interop", shard_epoch=3)
+                self.assertEqual([entry.change_kind for entry in shard_log.entries], ["added", "removed"])
+                self.assertEqual(shard_log.entries[0].put["shardId"], "forwarded-interop")
+                self.assertEqual(shard_log.entries[0].put["shardEpoch"], 3)
+                self.assertEqual(shard_log.entries[1].delete["shardId"], "forwarded-interop")
+                self.assertEqual(shard_log.entries[1].delete["shardEpoch"], 3)
+            finally:
+                self._terminate_process(process)
+
+    def test_cultmesh_daemon_enforces_snapshot_document_limit_as_peer_error(self) -> None:
+        with tempfile.TemporaryDirectory() as temp:
+            ready_path = Path(temp) / "ready.json"
+            package_src = Path(__file__).resolve().parents[1] / "src"
+            env = dict(os.environ)
+            existing_pythonpath = env.get("PYTHONPATH")
+            env["PYTHONPATH"] = (
+                str(package_src)
+                if not existing_pythonpath
+                else f"{package_src}{os.pathsep}{existing_pythonpath}"
+            )
+            process = subprocess.Popen(
+                [
+                    sys.executable,
+                    "-m",
+                    "cultmesh_py.daemon",
+                    "--runtime-id",
+                    "limited-daemon-peer",
+                    "--port",
+                    "0",
+                    "--seed-interop-note",
+                    "--max-snapshot-documents",
+                    "0",
+                    "--ready-file",
+                    str(ready_path),
+                ],
+                stdout=subprocess.PIPE,
+                stderr=subprocess.PIPE,
+                text=True,
+                env=env,
+            )
+            try:
+                ready = self._wait_for_ready_file(process, ready_path)
+                self.assertEqual(ready["snapshotLimits"], {"maxSnapshotBytes": None, "maxSnapshotDocuments": 0})
+                client = CultMesh.create_client("127.0.0.1", int(ready["port"]), timeout_seconds=2.0)
+
+                with self.assertRaisesRegex(CultNetPeerError, "Snapshot document limit exceeded") as raised:
+                    client.fetch_snapshot_response(schema_ids=["cultcache.interop-note"])
+
+                self.assertEqual(raised.exception.response["schemaVersion"], "cultnet.error.v0")
+                self.assertEqual(raised.exception.response["code"], "snapshot_document_limit_exceeded")
+                self.assertEqual(raised.exception.response["details"]["documentCount"], 1)
+                self.assertEqual(raised.exception.response["details"]["maxSnapshotDocuments"], 0)
+            finally:
+                self._terminate_process(process)
+
+    def test_cultmesh_daemon_serves_opt_in_simulation_observations(self) -> None:
+        with tempfile.TemporaryDirectory() as temp:
+            ready_path = Path(temp) / "ready.json"
+            package_src = Path(__file__).resolve().parents[1] / "src"
+            env = dict(os.environ)
+            existing_pythonpath = env.get("PYTHONPATH")
+            env["PYTHONPATH"] = (
+                str(package_src)
+                if not existing_pythonpath
+                else f"{package_src}{os.pathsep}{existing_pythonpath}"
+            )
+            process = subprocess.Popen(
+                [
+                    sys.executable,
+                    "-m",
+                    "cultmesh_py.daemon",
+                    "--runtime-id",
+                    "simulation-daemon-peer",
+                    "--port",
+                    "0",
+                    "--enable-simulation-observations",
+                    "--simulation-minimum-witnesses",
+                    "2",
+                    "--simulation-quorum-ratio",
+                    "1.0",
+                    "--verse-id",
+                    "simulation-verse",
+                    "--ready-file",
+                    str(ready_path),
+                ],
+                stdout=subprocess.PIPE,
+                stderr=subprocess.PIPE,
+                text=True,
+                env=env,
+            )
+            try:
+                ready = self._wait_for_ready_file(process, ready_path)
+                self.assertIn("cultnet.simulation_observation.v0", ready["supportedMessageVersions"])
+                self.assertIn("cultnet.simulation_consensus_candidate.v0", ready["supportedMessageVersions"])
+                client = CultMesh.create_client("127.0.0.1", int(ready["port"]), timeout_seconds=2.0)
+                hello_response = client.request(
+                    hello(runtime_id="simulation-daemon-prober"),
+                    expected_schema_version="cultnet.hello.v0",
+                )
+                self.assertEqual(ready["supportedMessageVersions"], hello_response["supportedMessageVersions"])
+                discovery_client = CultMesh.create_verse_discovery_client("127.0.0.1", int(ready["port"]), timeout_seconds=2.0)
+                peers = discovery_client.fetch_peers(verse_id="simulation-verse", roles=["simulation-observer"])
+                self.assertEqual(peers[0].peer_id, "simulation-daemon-peer")
+                self.assertIn("simulation-observer", peers[0].roles)
+                self.assertIn("read-replica", peers[0].roles)
+
+                claim_hash = compute_simulation_claim_hash("hit", "alice", "bob", "frame:100")
+                first = client.request(
+                    simulation_observation(
+                        message_id="daemon-sim-1",
+                        witness_runtime_id="watcher-1",
+                        shard_id="arena",
+                        shard_epoch=4,
+                        frame=100,
+                        subject_id="bob",
+                        claim_kind="hit",
+                        claim_hash=claim_hash,
+                        claim_summary="alice shot bob first",
+                    ),
+                    expected_schema_version="cultnet.simulation_consensus_candidate.v0",
+                )
+                second = client.request(
+                    simulation_observation(
+                        message_id="daemon-sim-2",
+                        witness_runtime_id="watcher-2",
+                        shard_id="arena",
+                        shard_epoch=4,
+                        frame=100,
+                        subject_id="bob",
+                        claim_kind="hit",
+                        claim_hash=claim_hash,
+                        claim_summary="alice shot bob first",
+                    ),
+                    expected_schema_version="cultnet.simulation_consensus_candidate.v0",
+                )
+
+                self.assertEqual(first["messageId"], "daemon-sim-1")
+                self.assertFalse(first["hasQuorum"])
+                self.assertEqual(first["witnessCount"], 1)
+                self.assertEqual(second["messageId"], "daemon-sim-2")
+                self.assertTrue(second["hasQuorum"])
+                self.assertEqual(second["witnessCount"], 2)
+                self.assertEqual(second["claimHash"], claim_hash)
+            finally:
+                self._terminate_process(process)
+
+    def _wait_for_ready_file(self, process: subprocess.Popen[str], ready_path: Path) -> dict[str, object]:
+        deadline = time.monotonic() + 5.0
+        while not ready_path.exists() and time.monotonic() < deadline:
+            if process.poll() is not None:
+                break
+            time.sleep(0.05)
+        if not ready_path.exists():
+            _, stderr = process.communicate(timeout=2.0)
+            self.fail(f"cultmesh daemon did not publish readiness: {stderr}")
+        return json.loads(ready_path.read_text(encoding="utf-8"))
+
+    def _terminate_process(self, process: subprocess.Popen[str]) -> None:
+        process.terminate()
+        try:
+            process.communicate(timeout=5.0)
+        except subprocess.TimeoutExpired:
+            process.kill()
+            process.communicate(timeout=5.0)
+
+    def test_cultmesh_local_server_serves_node_and_catalogs_over_clients(self) -> None:
+        document = define_database_entry_type(
+            "mesh.server_note",
+            [("body", 0)],
+            schema_id="mesh.server_note.v1",
+        )
+        node = CultMesh.create_node(runtime_id="mesh-server")
+        node.database.register_document(document)
+        node.database.put_raw_message(document, "note:1", {"body": "served"}, shard_id="notes", shard_epoch=1)
+        observation_hub = CultNetSimulationObservationHub(
+            CultNetSimulationConsensusOptions(minimum_witnesses=2, quorum_ratio=1.0)
+        )
+        seen_candidates: list[CultNetSimulationConsensusCandidate] = []
+        unsubscribe_candidates = observation_hub.watch_candidates(seen_candidates.append)
+        claim_hash = compute_simulation_claim_hash("hit", "alice", "bob", "frame:100")
+        verses = CultMeshVerseCatalog()
+        verses.upsert(
+            CultMeshVerseDescriptor(
+                verse_id="server-verse",
+                display_name="Server Verse",
+                authority_model="local",
+                compatibility=CultMeshVerseCompatibility("cultmesh.v0", "rules"),
+            )
+        )
+        peers = CultMeshPeerCatalog()
+        peers.upsert(
+            CultMeshPeerCard(
+                peer_id="mesh-server",
+                verse_id="server-verse",
+                endpoints=("cultnet://127.0.0.1:0",),
+                roles=("read-replica",),
+            )
+        )
+
+        server = CultMesh.serve_node(
+            node,
+            verse_catalog=verses,
+            peer_catalog=peers,
+            observation_hub=observation_hub,
+            display_name="Mesh Server",
+        )
+        try:
+            raw_client = CultMesh.create_client("127.0.0.1", server.port, timeout_seconds=2.0)
+            hello_response = raw_client.request(hello(runtime_id="probe"), expected_schema_version="cultnet.hello.v0")
+            schema_response = raw_client.fetch_schema_catalog(schema_ids=["mesh.server_note.v1"], include_schema_json=True)
+            rudp_client = CultMesh.create_client(
+                endpoint=f"rudp://127.0.0.1:{server.port}",
+                timeout_seconds=2.0,
+                connection_id=server.rudp_connection_id,
+                runtime_id="rudp-probe",
+            )
+            rudp_hello_response = rudp_client.request(
+                hello(runtime_id="rudp-probe"),
+                expected_schema_version="cultnet.hello.v0",
+            )
+            rudp_schema_response = rudp_client.fetch_schema_catalog(
+                schema_ids=["mesh.server_note.v1"],
+                include_schema_json=True,
+            )
+            wire_schema_response = raw_client.fetch_schema_catalog(kinds=["wire_message"], include_schema_json=True)
+            synced_schema_catalog = CultNetSchemaCatalog()
+            synced_wire_descriptors = raw_client.sync_schema_catalog(
+                synced_schema_catalog,
+                kinds=["wire_message"],
+                include_schema_json=True,
+            )
+            snapshot_response = raw_client.fetch_snapshot(schema_ids=["mesh.server_note.v1"])
+            typed_snapshot_response = raw_client.fetch_snapshot_response(schema_ids=["mesh.server_note.v1"])
+            shard_catalog = raw_client.fetch_shard_catalog(schema_ids=["mesh.server_note.v1"])
+            synced_shard_catalog = CultNetShardCatalog()
+            synced_shards = raw_client.sync_shard_catalog(synced_shard_catalog, schema_ids=["mesh.server_note.v1"])
+            shard_log = raw_client.fetch_shard_log(shard_id="notes", shard_epoch=1)
+            typed_shard_log = raw_client.fetch_shard_log_response(shard_id="notes", shard_epoch=1)
+            self.assertEqual(hello_response["transportProfiles"][0]["transports"][0]["protocol"], "tcp_framed")
+            self.assertEqual(hello_response["transportProfiles"][0]["transports"][0]["port"], server.port)
+            stale_shard_log = raw_client.fetch_shard_log(shard_id="notes", shard_epoch=0)
+            discovery_client = CultMesh.create_verse_discovery_client("127.0.0.1", server.port, timeout_seconds=2.0)
+            fetched_verses = discovery_client.fetch_verses(transport_version="cultmesh.v0")
+            fetched_peers = discovery_client.fetch_peers(verse_id="server-verse", roles=["read-replica"])
+            first_candidate = raw_client.request(
+                simulation_observation(
+                    message_id="obs-1",
+                    witness_runtime_id="watcher-1",
+                    shard_id="arena",
+                    shard_epoch=4,
+                    frame=100,
+                    subject_id="bob",
+                    claim_kind="hit",
+                    claim_hash=claim_hash,
+                    claim_summary="alice shot bob first",
+                ),
+                expected_schema_version="cultnet.simulation_consensus_candidate.v0",
+            )
+            quorum_candidate = raw_client.request(
+                simulation_observation(
+                    message_id="obs-2",
+                    witness_runtime_id="watcher-2",
+                    shard_id="arena",
+                    shard_epoch=4,
+                    frame=100,
+                    subject_id="bob",
+                    claim_kind="hit",
+                    claim_hash=claim_hash,
+                    claim_summary="alice shot bob first",
+                ),
+                expected_schema_version="cultnet.simulation_consensus_candidate.v0",
+            )
+            with raw_client.subscribe_database(subscription_id="sub-server", schema_ids=["mesh.server_note.v1"]) as subscription:
+                subscription_snapshot = subscription.read_next_snapshot_response()
+                subscription.send(document_put_raw(
+                    message_id="server-put",
+                    key="note:2",
+                    schema_id="mesh.server_note.v1",
+                    stored_at="2026-06-14T00:00:00Z",
+                    payload=document.encode_payload({"body": "subscribed"}),
+                    shard_id="primary",
+                    shard_epoch=1,
+                ))
+                subscription_change = subscription.read_next_change()
+                subscription.send(document_delete(
+                    message_id="server-delete",
+                    schema_id="mesh.server_note.v1",
+                    record_key="note:2",
+                    shard_id="primary",
+                    shard_epoch=1,
+                ))
+                subscription_delete = subscription.read_next_change()
+        finally:
+            unsubscribe_candidates()
+            server.stop()
+
+        self.assertEqual(hello_response["runtimeId"], "mesh-server")
+        self.assertEqual(hello_response["displayName"], "Mesh Server")
+        self.assertIn("cultnet.database_subscribe.v0", hello_response["supportedMessageVersions"])
+        self.assertIn("cultnet.error.v0", hello_response["supportedMessageVersions"])
+        self.assertIn("cultnet.document_put_raw.v0", hello_response["supportedMessageVersions"])
+        self.assertIn("cultnet.simulation_observation.v0", hello_response["supportedMessageVersions"])
+        self.assertEqual(hello_response["supportedMutationContracts"][0]["documentType"], "mesh.server_note")
+        self.assertIn("documentDelete", hello_response["supportedMutationContracts"][0]["operations"])
+        self.assertIn("shardLog", hello_response["supportedMutationContracts"][0]["operations"])
+        advertised_transports = {
+            transport["protocol"]: transport
+            for profile in hello_response["transportProfiles"]
+            for transport in profile["transports"]
+        }
+        self.assertEqual(advertised_transports["tcp_framed"]["port"], server.port)
+        self.assertEqual(advertised_transports["rudp"]["port"], server.port)
+        self.assertEqual(rudp_hello_response["runtimeId"], "mesh-server")
+        self.assertEqual(rudp_schema_response["schemas"][0]["schemaId"], "mesh.server_note.v1")
+        self.assertEqual(schema_response["schemas"][0]["schemaId"], "mesh.server_note.v1")
+        self.assertIn("schemaJson", schema_response["schemas"][0])
+        self.assertIn("cultnet.document_delete.v0", schema_response["schemas"][0]["wireContracts"])
+        self.assertIn("cultnet.shard_log_response.v0", schema_response["schemas"][0]["wireContracts"])
+        wire_descriptors = {schema["schemaVersion"]: schema for schema in wire_schema_response["schemas"]}
+        self.assertEqual(wire_descriptors["cultnet.error.v0"]["kind"], "wire_message")
+        self.assertEqual(wire_descriptors["cultnet.document_put_raw.v0"]["kind"], "wire_message")
+        self.assertIn("schemaJson", wire_descriptors["cultnet.document_put_raw.v0"])
+        self.assertIn("cultmesh.peer_exchange_response.v0", wire_descriptors)
+        self.assertIn("cultnet.error.v0", {descriptor.schema_version for descriptor in synced_wire_descriptors})
+        self.assertIn("cultnet.document_put_raw.v0", {descriptor.schema_version for descriptor in synced_wire_descriptors})
+        self.assertIsNotNone(synced_schema_catalog.get("https://github.com/GameCult/cultnet-ts/contracts/cultnet.document-put-raw.schema.json"))
+        self.assertEqual(snapshot_response["documents"][0]["recordKey"], "note:1")
+        self.assertEqual(typed_snapshot_response.documents[0].record_key, "note:1")
+        self.assertEqual(typed_snapshot_response.documents[0].schema_id, "mesh.server_note.v1")
+        self.assertEqual(shard_catalog["shards"][0]["schemaIds"], ["mesh.server_note.v1"])
+        self.assertEqual(shard_catalog["shards"][0]["epoch"], 1)
+        self.assertEqual(shard_catalog["shards"][0]["shardId"], "notes")
+        self.assertEqual(synced_shards[0].shard_id, "notes")
+        self.assertEqual(synced_shards[0].epoch, 1)
+        self.assertEqual(synced_shard_catalog.get("notes"), synced_shards[0])
+        self.assertEqual(shard_log["entries"][0]["changeKind"], "added")
+        self.assertTrue(stale_shard_log["resyncRequired"])
+        self.assertEqual(stale_shard_log["reason"], "stale_epoch")
+        self.assertEqual(stale_shard_log["shardEpoch"], 1)
+        self.assertEqual(stale_shard_log["entries"], [])
+        self.assertEqual(typed_shard_log.last_sequence, 1)
+        self.assertEqual(typed_shard_log.entries[0].put["document"]["recordKey"], "note:1")
+        self.assertIsInstance(typed_shard_log.entries[0].raw_document, CultNetRawDocumentRecord)
+        self.assertEqual(typed_shard_log.entries[0].raw_document.record_key, "note:1")
+        self.assertEqual(fetched_verses[0].verse_id, "server-verse")
+        self.assertEqual(fetched_peers[0].peer_id, "mesh-server")
+        self.assertEqual(first_candidate["messageId"], "obs-1")
+        self.assertFalse(first_candidate["hasQuorum"])
+        self.assertEqual(quorum_candidate["messageId"], "obs-2")
+        self.assertEqual(quorum_candidate["claimHash"], claim_hash)
+        self.assertTrue(quorum_candidate["hasQuorum"])
+        self.assertEqual(quorum_candidate["witnessCount"], 2)
+        self.assertEqual([candidate.claim_hash for candidate in seen_candidates], [claim_hash, claim_hash])
+        self.assertIsInstance(subscription_snapshot, CultNetRawSnapshotResponse)
+        self.assertEqual(subscription_snapshot.to_wire()["schemaVersion"], "cultnet.snapshot_response_raw.v0")
+        self.assertEqual(subscription_change.change_kind, "added")
+        self.assertEqual(subscription_change.record_key, "note:2")
+        self.assertEqual(subscription_change.document["recordKey"], "note:2")
+        self.assertIsInstance(subscription_change.raw_document, CultNetRawDocumentRecord)
+        self.assertEqual(subscription_change.raw_document.schema_id, "mesh.server_note.v1")
+        self.assertEqual(subscription_delete.change_kind, "removed")
+        self.assertEqual(subscription_delete.record_key, "note:2")
+        self.assertIsNone(subscription_delete.raw_document)
+        self.assertIsNone(node.database.get(document, "note:2"))
+
+    def test_cultmesh_local_server_resolves_snapshot_and_shard_catalog_schema_aliases(self) -> None:
+        document = define_database_entry_type(
+            "mesh.alias_server_note",
+            [("body", 0)],
+            schema_id="sha256:mesh-alias-server-note",
+            schema_name="mesh.alias_server_note",
+            schema_version="mesh.alias_server_note.v1",
+        )
+        node = CultMesh.create_node(runtime_id="mesh-alias-server")
+        node.database.register_document(document)
+        node.database.put_raw_message(
+            document,
+            "note:alias",
+            {"body": "served through alias"},
+            shard_id="notes",
+            shard_epoch=1,
+        )
+
+        server = CultMesh.serve_node(node)
+        try:
+            raw_client = CultMesh.create_client("127.0.0.1", server.port, timeout_seconds=2.0)
+            snapshot = raw_client.fetch_snapshot(schema_ids=["mesh.alias_server_note.v1"])
+            typed_snapshot = raw_client.fetch_snapshot_response(schema_ids=["mesh.alias_server_note.v1"])
+            shard_catalog = raw_client.fetch_shard_catalog(schema_ids=["mesh.alias_server_note.v1"])
+        finally:
+            server.stop()
+
+        local_schema_id = document.catalog_entry().schema_id
+        self.assertEqual(snapshot["documents"][0]["schemaId"], local_schema_id)
+        self.assertEqual(snapshot["documents"][0]["recordKey"], "note:alias")
+        self.assertEqual(typed_snapshot.documents[0].schema_id, local_schema_id)
+        self.assertEqual(shard_catalog["shards"][0]["schemaIds"], [local_schema_id])
+        self.assertEqual(shard_catalog["shards"][0]["shardId"], "notes")
+
+    def test_cultmesh_shard_snapshot_keeps_foreign_schema_alias_membership(self) -> None:
+        document = define_database_entry_type(
+            "mesh.alias_shard_note",
+            [
+                ("schema_version", 0),
+                ("body", 1),
+            ],
+            schema_id="sha256:mesh-alias-shard-note",
+            schema_name="mesh.alias_shard_note",
+            schema_version="mesh.alias_shard_note.v1",
+        )
+        node = CultMesh.create_node(runtime_id="mesh-alias-shard-server")
+        node.database.register_document(document)
+
+        node.database.apply_raw_put_message(document_put_raw(
+            message_id="put-foreign-shard-alias",
+            key="note:foreign-shard",
+            schema_id="runtime.generated.mesh.alias_shard_note.ui.99",
+            stored_at="2026-06-27T00:00:00Z",
+            payload=document.encode_payload({
+                "schema_version": "mesh.alias_shard_note.v1",
+                "body": "visible through shard snapshot",
+            }),
+            shard_id="notes",
+            shard_epoch=1,
+        ).to_wire())
+        node.database.put_raw_message(
+            document,
+            "note:other-shard",
+            {
+                "schema_version": "mesh.alias_shard_note.v1",
+                "body": "hidden by shard filter",
+            },
+            shard_id="other",
+            shard_epoch=1,
+        )
+
+        response = node.database.build_snapshot_response(
+            schema_ids=["mesh.alias_shard_note.v1"],
+            shard_id="notes",
+            shard_epoch=1,
+        )
+
+        local_schema_id = document.catalog_entry().schema_id
+        self.assertEqual(response.shard_id, "notes")
+        self.assertEqual(response.shard_epoch, 1)
+        self.assertEqual([(record.schema_id, record.record_key) for record in response.documents], [
+            (local_schema_id, "note:foreign-shard"),
+        ])
+        self.assertEqual(node.cache.get_required_envelope(document, "note:foreign-shard").schema_id, local_schema_id)
+
+        node.database.apply_raw_delete_message(document_delete(
+            message_id="delete-foreign-shard-alias",
+            schema_id="mesh.alias_shard_note.v1",
+            record_key="note:foreign-shard",
+            shard_id="notes",
+            shard_epoch=1,
+        ).to_wire())
+        deleted_response = node.database.build_snapshot_response(
+            schema_ids=["mesh.alias_shard_note.v1"],
+            shard_id="notes",
+            shard_epoch=1,
+        )
+        self.assertEqual(deleted_response.documents, ())
+
+    def test_cultmesh_local_server_notifies_schema_alias_subscription_for_raw_put(self) -> None:
+        document = define_database_entry_type(
+            "mesh.alias_sub_note",
+            [
+                ("schema_version", 0),
+                ("body", 1),
+            ],
+            schema_id="sha256:mesh-alias-sub-note",
+            schema_name="mesh.alias_sub_note",
+            schema_version="mesh.alias_sub_note.v1",
+        )
+        node = CultMesh.create_node(runtime_id="mesh-alias-sub-server")
+        node.database.register_document(document)
+
+        server = CultMesh.serve_node(node)
+        try:
+            raw_client = CultMesh.create_client("127.0.0.1", server.port, timeout_seconds=2.0)
+            with raw_client.subscribe_database(
+                subscription_id="sub-alias",
+                schema_ids=["mesh.alias_sub_note.v1"],
+                include_snapshot=False,
+            ) as subscription:
+                subscription.send(document_put_raw(
+                    message_id="put-foreign-alias",
+                    key="note:alias-sub",
+                    schema_id="runtime.generated.mesh.alias_sub_note.ui.99",
+                    stored_at="2026-06-27T00:00:00Z",
+                    payload=document.encode_payload({
+                        "schema_version": "mesh.alias_sub_note.v1",
+                        "body": "notified",
+                    }),
+                ))
+                change = subscription.read_next_change()
+        finally:
+            server.stop()
+
+        local_schema_id = document.catalog_entry().schema_id
+        self.assertEqual(change.subscription_id, "sub-alias")
+        self.assertEqual(change.change_kind, "added")
+        self.assertEqual(change.record_key, "note:alias-sub")
+        self.assertIsInstance(change.raw_document, CultNetRawDocumentRecord)
+        self.assertEqual(change.raw_document.schema_id, "runtime.generated.mesh.alias_sub_note.ui.99")
+        self.assertEqual(node.database.get_required(document, "note:alias-sub")["body"], "notified")
+        self.assertEqual(node.cache.get_required_envelope(document, "note:alias-sub").schema_id, local_schema_id)
+
+    def test_cultmesh_local_server_notifies_schema_alias_subscription_for_delete(self) -> None:
+        document = define_database_entry_type(
+            "mesh.alias_delete_note",
+            [("body", 0)],
+            schema_id="sha256:mesh-alias-delete-note",
+            schema_name="mesh.alias_delete_note",
+            schema_version="mesh.alias_delete_note.v1",
+        )
+        node = CultMesh.create_node(runtime_id="mesh-alias-delete-server")
+        node.database.register_document(document)
+        node.database.put_raw_message(
+            document,
+            "note:delete-alias",
+            {"body": "remove me"},
+            shard_id="notes",
+            shard_epoch=1,
+        )
+
+        server = CultMesh.serve_node(node)
+        try:
+            raw_client = CultMesh.create_client("127.0.0.1", server.port, timeout_seconds=2.0)
+            with raw_client.subscribe_database(
+                subscription_id="sub-delete-alias",
+                schema_ids=[document.catalog_entry().schema_id],
+                include_snapshot=False,
+            ) as subscription:
+                subscription.send(document_delete(
+                    message_id="delete-foreign-alias",
+                    schema_id="mesh.alias_delete_note.v1",
+                    record_key="note:delete-alias",
+                    shard_id="notes",
+                    shard_epoch=1,
+                ))
+                change = subscription.read_next_change()
+        finally:
+            server.stop()
+
+        self.assertEqual(change.subscription_id, "sub-delete-alias")
+        self.assertEqual(change.change_kind, "removed")
+        self.assertEqual(change.schema_id, "mesh.alias_delete_note.v1")
+        self.assertEqual(change.record_key, "note:delete-alias")
+        self.assertIsNone(change.raw_document)
+        self.assertIsNone(node.database.get(document, "note:delete-alias"))
+
+    def test_cultmesh_local_server_rejects_oversized_snapshot_responses(self) -> None:
+        document = define_database_entry_type(
+            "mesh.snapshot_limit_note",
+            [("body", 0)],
+            schema_id="mesh.snapshot_limit_note.v1",
+        )
+        node = CultMesh.create_node(runtime_id="mesh-snapshot-limits")
+        node.database.register_document(document)
+        node.database.put_raw_message(document, "note:1", {"body": "first"})
+        node.database.put_raw_message(document, "note:2", {"body": "second"})
+
+        server = CultMesh.serve_node(node, max_snapshot_documents=1)
+        try:
+            raw_client = CultMesh.create_client("127.0.0.1", server.port, timeout_seconds=2.0)
+            filtered_snapshot = raw_client.fetch_snapshot(record_keys=["note:1"])
+            error = raw_client.request(
+                snapshot_request(schema_ids=["mesh.snapshot_limit_note.v1"]),
+                expected_schema_version="cultnet.error.v0",
+            )
+            with self.assertRaisesRegex(CultNetPeerError, "Snapshot document limit exceeded"):
+                raw_client.fetch_snapshot(schema_ids=["mesh.snapshot_limit_note.v1"])
+        finally:
+            server.stop()
+
+        self.assertEqual(filtered_snapshot["schemaVersion"], "cultnet.snapshot_response_raw.v0")
+        self.assertEqual([document["recordKey"] for document in filtered_snapshot["documents"]], ["note:1"])
+        self.assertEqual(error["schemaVersion"], "cultnet.error.v0")
+        self.assertIn("Snapshot document limit exceeded", error["error"])
+        self.assertEqual(error["code"], "snapshot_document_limit_exceeded")
+        self.assertEqual(error["details"]["documentCount"], 2)
+        self.assertEqual(error["details"]["maxSnapshotDocuments"], 1)
+
+    def test_cultmesh_local_server_returns_errors_for_bad_requests(self) -> None:
+        document = define_database_entry_type(
+            "mesh.error_note",
+            [("body", 0)],
+            schema_id="mesh.error_note.v1",
+        )
+        node = CultMesh.create_node(runtime_id="mesh-error-server")
+        node.database.register_document(document)
+
+        server = CultMesh.serve_node(node)
+        try:
+            raw_client = CultMesh.create_client("127.0.0.1", server.port, timeout_seconds=2.0)
+            unsupported = raw_client.request(
+                {"schemaVersion": "cultnet.nope.v0", "messageId": "bad-schema"},
+                expected_schema_version="cultnet.error.v0",
+            )
+            malformed_put = raw_client.request(
+                {"schemaVersion": "cultnet.document_put_raw.v0", "messageId": "bad-put"},
+                expected_schema_version="cultnet.error.v0",
+            )
+            malformed_delete = raw_client.request(
+                {"schemaVersion": "cultnet.document_delete.v0", "messageId": "bad-delete", "schemaId": "mesh.error_note.v1"},
+                expected_schema_version="cultnet.error.v0",
+            )
+        finally:
+            server.stop()
+
+        self.assertEqual(unsupported["messageId"], "bad-schema")
+        self.assertEqual(unsupported["code"], "unsupported_schema_version")
+        self.assertEqual(unsupported["details"]["schemaVersion"], "cultnet.nope.v0")
+        self.assertIn("Unsupported CultNet message schema", unsupported["error"])
+        self.assertEqual(malformed_put["messageId"], "bad-put")
+        self.assertEqual(malformed_put["code"], "malformed_document_put")
+        self.assertEqual(malformed_delete["messageId"], "bad-delete")
+        self.assertEqual(malformed_delete["code"], "malformed_document_delete")
+
+    def test_cultmesh_authority_lease_requires_live_matching_lease(self) -> None:
+        peer = CultMeshPeerCard(
+            peer_id="voidbot-local",
+            verse_id="local",
+            endpoints=("cultmesh://localhost",),
+            roles=("shard-primary",),
+            authority_lease_id="lease:voidbot-local",
+        )
+        leases = CultMeshAuthorityLeaseCatalog()
+        peers = CultMeshPeerCatalog()
+        peers.upsert(peer)
+        now = datetime.now(UTC)
+        self.assertFalse(leases.is_authorized(peer, "shard-primary", at=now))
+        self.assertEqual(peers.find_authorized("local", "shard-primary", leases, at=now), [])
+
+        leases.upsert(
+            CultMeshAuthorityLease(
+                lease_id="lease:voidbot-local",
+                verse_id="local",
+                peer_id="voidbot-local",
+                roles=("shard-primary", "shard-primary", ""),
+                valid_from=now - timedelta(seconds=1),
+                expires_at=now + timedelta(seconds=1),
+                shard_ids=("shard-a",),
+                issuer_runtime_id="odin",
+                signature="signed",
+            )
+        )
+
+        lease = leases.get("lease:voidbot-local")
+        self.assertIsNotNone(lease)
+        assert lease is not None
+        self.assertEqual(leases.leases, (lease,))
+        self.assertEqual(lease.roles, ("shard-primary",))
+        self.assertEqual(lease.issuer_runtime_id, "odin")
+        self.assertEqual(lease.signature, "signed")
+        self.assertTrue(lease.is_valid_at(now))
+        self.assertTrue(lease.covers(peer, "shard-primary", shard_id="shard-a", at=now))
+        self.assertFalse(lease.covers(peer, "shard-primary", shard_id="shard-b", at=now))
+        self.assertTrue(leases.is_authorized(peer, "shard-primary", shard_id="shard-a", at=now))
+        self.assertEqual(
+            peers.find_authorized("local", "shard-primary", leases, shard_id="shard-a", at=now),
+            [peer],
+        )
+        self.assertEqual(
+            peers.first_authorized("local", "shard-primary", leases, shard_id="shard-a", at=now),
+            peer,
+        )
+        self.assertIsNone(peers.first_authorized("local", "read-replica", leases, at=now))
+        self.assertFalse(leases.is_authorized(peer, "shard-primary", shard_id="shard-b", at=now))
+        self.assertFalse(leases.is_authorized(peer, "read-replica", at=now))
+        self.assertIsNone(leases.get("missing"))
+
+    def test_cultmesh_authority_lease_catalog_can_require_verified_signatures(self) -> None:
+        peer = CultMeshPeerCard(
+            peer_id="voidbot-local",
+            verse_id="local",
+            endpoints=("cultmesh://localhost",),
+            roles=("shard-primary",),
+            shard_ids=("shard-a",),
+            authority_lease_id="lease:voidbot-local",
+        )
+        now = datetime.now(UTC)
+        unsigned = CultMeshAuthorityLease(
+            lease_id="lease:voidbot-local",
+            verse_id="local",
+            peer_id="voidbot-local",
+            roles=("shard-primary",),
+            valid_from=now - timedelta(seconds=1),
+            expires_at=now + timedelta(seconds=30),
+            shard_ids=("shard-a",),
+            issuer_runtime_id="odin",
+        )
+        verifier = CultMeshHmacAuthorityLeaseVerifier({"odin": b"lease-secret"})
+        signed = verifier.issue(unsigned)
+        strict_leases = CultMesh.create_authority_lease_catalog(
+            signature_verifier=verifier.verify,
+            require_verified_signatures=True,
+        )
+        strict_leases.upsert(unsigned)
+        self.assertFalse(strict_leases.is_verified(unsigned.lease_id))
+        self.assertFalse(strict_leases.is_authorized(peer, "shard-primary", shard_id="shard-a", at=now))
+
+        strict_leases.upsert(signed)
+        self.assertTrue(strict_leases.is_verified(signed.lease_id))
+        self.assertTrue(strict_leases.is_authorized(peer, "shard-primary", shard_id="shard-a", at=now))
+
+        wrong_key = CultMesh.create_authority_lease_catalog(
+            signature_verifier=CultMeshHmacAuthorityLeaseVerifier({"odin": b"wrong-secret"}).verify,
+            require_verified_signatures=True,
+        )
+        wrong_key.upsert(signed)
+        self.assertFalse(wrong_key.is_verified(signed.lease_id))
+        self.assertFalse(wrong_key.is_authorized(peer, "shard-primary", shard_id="shard-a", at=now))
+
+        tampered = CultMeshAuthorityLease(
+            lease_id=signed.lease_id,
+            verse_id=signed.verse_id,
+            peer_id=signed.peer_id,
+            roles=("shard-primary", "read-replica"),
+            valid_from=signed.valid_from,
+            expires_at=signed.expires_at,
+            shard_ids=signed.shard_ids,
+            issuer_runtime_id=signed.issuer_runtime_id,
+            signature=signed.signature,
+        )
+        strict_leases.upsert(tampered)
+        self.assertFalse(strict_leases.is_verified(tampered.lease_id))
+        self.assertFalse(strict_leases.is_authorized(peer, "shard-primary", shard_id="shard-a", at=now))
+
+    def test_cultmesh_stream_catalog_negotiates_transport_and_latest_frame(self) -> None:
+        streams = CultMeshStreamCatalog()
+        streams.declare(
+            CultMeshStreamDescriptor(
+                stream_id="mimir:kiyo-pro",
+                verse_id="studio",
+                owner_peer_id="starfire",
+                kind="video",
+                label="Kiyo Pro",
+                clock={"clockDomainId": "starfire-qpc", "confidence": 0.25},
+                video={"width": 1920, "height": 1080, "pixelFormat": "YUY2", "framesPerSecond": 30},
+                preferred_transports=("shared-d3d12-texture", "shared-memory", "cultcache-page"),
+                max_in_flight_frames=3,
+            )
+        )
+
+        negotiation = streams.negotiate(
+            "mimir:kiyo-pro",
+            CultMeshStreamConsumerProfile(
+                peer_id="fensalir",
+                verse_id="studio",
+                supported_transports=("shared-d3d12-texture", "cultcache-page"),
+                accepted_kinds=("video",),
+                can_import_gpu_handles=True,
+                max_in_flight_frames=2,
+            ),
+        )
+
+        self.assertEqual(negotiation.transport, "shared-d3d12-texture")
+        self.assertEqual(negotiation.max_in_flight_frames, 2)
+        self.assertEqual(negotiation.copy_budget, "zero-copy-target")
+
+        streams.publish_frame(
+            CultMeshStreamFrameHandle(
+                stream_id="mimir:kiyo-pro",
+                sequence=42,
+                timestamp_ns=1_000_000_000,
+                duration_ns=33_333_334,
+                transport="shared-d3d12-texture",
+                native_handle="0xfeed",
+                fence_handle="0xbeef",
+                fence_value=7,
+                unavoidable_copy_count=0,
+            )
+        )
+        self.assertEqual(streams.latest_frame("mimir:kiyo-pro").sequence, 42)
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/packages/cultmesh-py/tools/reactive_performance_probe.py b/packages/cultmesh-py/tools/reactive_performance_probe.py
new file mode 100644
index 00000000..86ab9441
--- /dev/null
+++ b/packages/cultmesh-py/tools/reactive_performance_probe.py
@@ -0,0 +1,145 @@
+from __future__ import annotations
+
+import argparse
+import json
+import threading
+import time
+import tracemalloc
+from typing import Any
+
+from cultcache_py import define_document_type
+from cultmesh_py import CultMeshReactiveDocumentOptions, create_node
+
+
+def percentile(ordered: list[float], ratio: float) -> float:
+    if not ordered:
+        return 0.0
+    index = max(0, min(len(ordered) - 1, int(len(ordered) * ratio + 0.999999) - 1))
+    return ordered[index]
+
+
+def measure(document_count: int, idle_seconds: float, active_seconds: float) -> dict[str, Any]:
+    payload = "x" * (16 * 1024)
+    changed_document_count = max(1, document_count // 100)
+    document = define_document_type(
+        f"gamecult.mesh.python_performance_probe_{document_count}",
+        encode=lambda value: value,
+        decode=lambda value: value,
+    )
+    node = create_node(runtime_id=f"python-performance-{document_count}")
+    node.register_document(document)
+    reactive_documents = []
+    publish_events = [threading.Event() for _ in range(document_count)]
+    update_started_at = [0.0] * document_count
+    latencies: list[float] = []
+    payload_bytes_published = 0
+    publishes = 0
+    measurement_lock = threading.Lock()
+
+    for index in range(document_count):
+        key = f"performance:{index}"
+        node.put(document, key, {"id": key, "payload": payload, "revision": 1})
+        writer = node.authoritative_writer(document, key)
+        original_write = writer.write
+
+        def measured_write(value: Any, document_index: int = index, write=original_write) -> None:
+            nonlocal payload_bytes_published, publishes
+            encoded_bytes = len(document.encode_payload(value))
+            latency_ms = (time.perf_counter() - update_started_at[document_index]) * 1000
+            with measurement_lock:
+                payload_bytes_published += encoded_bytes
+                publishes += 1
+                latencies.append(latency_ms)
+            write(value)
+            publish_events[document_index].set()
+
+        writer.write = measured_write  # type: ignore[method-assign]
+        reactive_documents.append(
+            writer.reactive(CultMeshReactiveDocumentOptions(flush_delay_seconds=0.0))
+        )
+
+    tracemalloc.start()
+    idle_cpu_start = time.process_time()
+    time.sleep(idle_seconds)
+    idle_current_bytes, idle_peak_bytes = tracemalloc.get_traced_memory()
+    idle_cpu_ms = (time.process_time() - idle_cpu_start) * 1000
+    tracemalloc.reset_peak()
+    active_current_start, _ = tracemalloc.get_traced_memory()
+    active_cpu_start = time.process_time()
+    active_started_at = time.perf_counter()
+    frames = 0
+    while time.perf_counter() - active_started_at < active_seconds:
+        for index in range(changed_document_count):
+            publish_events[index].clear()
+            update_started_at[index] = time.perf_counter()
+            reactive_documents[index].update(
+                lambda draft: draft.__setitem__("revision", draft["revision"] + 1)
+            )
+        for index in range(changed_document_count):
+            if not publish_events[index].wait(timeout=1.0):
+                raise RuntimeError(f"Python reactive publication timed out for document {index}")
+        frames += 1
+        remaining = frames / 60 - (time.perf_counter() - active_started_at)
+        if remaining > 0:
+            time.sleep(remaining)
+
+    active_elapsed_seconds = time.perf_counter() - active_started_at
+    active_cpu_ms = (time.process_time() - active_cpu_start) * 1000
+    active_current_bytes, active_peak_bytes = tracemalloc.get_traced_memory()
+    tracemalloc.stop()
+    for reactive in reactive_documents:
+        reactive.dispose()
+    ordered = sorted(latencies)
+    return {
+        "documentCount": document_count,
+        "changedDocumentCount": changed_document_count,
+        "frames": frames,
+        "expectedPublishes": frames * changed_document_count,
+        "actualPublishes": publishes,
+        "payloadBytesPublished": payload_bytes_published,
+        "idleTracedCurrentBytes": idle_current_bytes,
+        "idleTracedPeakBytes": idle_peak_bytes,
+        "idleCpuMilliseconds": idle_cpu_ms,
+        "activeTracedRetainedGrowthBytes": active_current_bytes - active_current_start,
+        "activeTracedPeakGrowthBytes": active_peak_bytes - active_current_start,
+        "activeCpuMilliseconds": active_cpu_ms,
+        "publishedPayloadBytesPerSecond": payload_bytes_published / active_elapsed_seconds,
+        "p50PublishLatencyMilliseconds": percentile(ordered, 0.50),
+        "p95PublishLatencyMilliseconds": percentile(ordered, 0.95),
+        "p99PublishLatencyMilliseconds": percentile(ordered, 0.99),
+        "schedulerThreads": sum(
+            thread.name == "cultmesh-reactive-scheduler" for thread in threading.enumerate()
+        ),
+    }
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser()
+    parser.add_argument("--quick", action="store_true")
+    args = parser.parse_args()
+    idle_seconds = 0.25 if args.quick else 10.0
+    active_seconds = 0.5 if args.quick else 10.0
+    results = [measure(count, idle_seconds, active_seconds) for count in (1, 100, 1000)]
+    print(json.dumps({
+        "runtime": "python",
+        "workload": {
+            "documentCounts": [1, 100, 1000],
+            "payloadBytes": 16 * 1024,
+            "idleSeconds": idle_seconds,
+            "activeSeconds": active_seconds,
+            "updateRateHz": 60,
+            "changedFraction": 0.01,
+        },
+        "results": results,
+    }, indent=2))
+    return 0 if all(
+        result["actualPublishes"] == result["expectedPublishes"]
+        and result["p99PublishLatencyMilliseconds"] < 250
+        and result["activeTracedPeakGrowthBytes"] < 128 * 1024 * 1024
+        and result["schedulerThreads"] == 1
+        for result in results
+    ) else 1
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
diff --git a/packages/cultmesh-rs/Cargo.lock b/packages/cultmesh-rs/Cargo.lock
new file mode 100644
index 00000000..945bc65b
--- /dev/null
+++ b/packages/cultmesh-rs/Cargo.lock
@@ -0,0 +1,1183 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 4
+
+[[package]]
+name = "aead"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d122413f284cf2d62fb1b7db97e02edb8cda96d769b16e443a4f6195e35662b0"
+dependencies = [
+ "crypto-common",
+ "generic-array",
+]
+
+[[package]]
+name = "aes"
+version = "0.8.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b169f7a6d4742236a0a00c541b845991d0ac43e546831af1249753ab4c3aa3a0"
+dependencies = [
+ "cfg-if",
+ "cipher",
+ "cpufeatures",
+]
+
+[[package]]
+name = "aes-gcm"
+version = "0.10.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "831010a0f742e1209b3bcea8fab6a8e149051ba6099432c8cb2cc117dec3ead1"
+dependencies = [
+ "aead",
+ "aes",
+ "cipher",
+ "ctr",
+ "ghash",
+ "subtle",
+]
+
+[[package]]
+name = "android_system_properties"
+version = "0.1.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ae221649c9976a6f6c56ae1facf410f3ddb33cc661c4b7b61020a912d4237fbc"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "anyhow"
+version = "1.0.104"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "330a5ed07fa54e4702c9d6c4174f74427fc0ef6e214bbd677ae50a5099946470"
+
+[[package]]
+name = "autocfg"
+version = "1.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f2032f911046de80f0a198e0901378627c33f59ea0ac00e363d481118bd70a53"
+
+[[package]]
+name = "base64"
+version = "0.22.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"
+
+[[package]]
+name = "base64ct"
+version = "1.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2af50177e190e07a26ab74f8b1efbfe2ef87da2116221318cb1c2e82baf7de06"
+
+[[package]]
+name = "bitflags"
+version = "2.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b588b76d00fde79687d7646a9b5bdf3cc0f655e0bbd080335a95d7e96f3587da"
+
+[[package]]
+name = "block-buffer"
+version = "0.10.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3078c7629b62d3f0439517fa394996acacc5cbc91c5a20d8c658e77abd503a71"
+dependencies = [
+ "generic-array",
+]
+
+[[package]]
+name = "bumpalo"
+version = "3.20.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72f5acc6cb2ba439de613abc23857ec3d78374d8ed5ac84e9d11336e87da8649"
+
+[[package]]
+name = "cc"
+version = "1.4.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0ad534f4357a5264cce5019c989cf66a4f0dc4e0d1b1d15f8aacec0ff7360273"
+dependencies = [
+ "find-msvc-tools",
+ "shlex",
+]
+
+[[package]]
+name = "cfg-if"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
+
+[[package]]
+name = "chrono"
+version = "0.4.45"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1aa79e62e7697b8e29b513a68abacf485adcd1fe8284a4316c5ae868e6633327"
+dependencies = [
+ "iana-time-zone",
+ "js-sys",
+ "num-traits",
+ "serde",
+ "wasm-bindgen",
+ "windows-link",
+]
+
+[[package]]
+name = "cipher"
+version = "0.4.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "773f3b9af64447d2ce9850330c473515014aa235e6a783b02db81ff39e4a3dad"
+dependencies = [
+ "crypto-common",
+ "inout",
+]
+
+[[package]]
+name = "const-oid"
+version = "0.9.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c2459377285ad874054d797f3ccebf984978aa39129f6eafde5cdc8315b612f8"
+
+[[package]]
+name = "core-foundation-sys"
+version = "0.8.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "773648b94d0e5d620f64f280777445740e61fe701025087ec8b57f45c791888b"
+
+[[package]]
+name = "cpufeatures"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "59ed5838eebb26a2bb2e58f6d5b5316989ae9d08bab10e0e6d103e656d1b0280"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "crypto-common"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "78c8292055d1c1df0cce5d180393dc8cce0abec0a7102adb6c7b1eef6016d60a"
+dependencies = [
+ "generic-array",
+ "rand_core 0.6.4",
+ "typenum",
+]
+
+[[package]]
+name = "ctr"
+version = "0.9.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0369ee1ad671834580515889b80f2ea915f23b8be8d0daa4bbaf2ac5c7590835"
+dependencies = [
+ "cipher",
+]
+
+[[package]]
+name = "cultcache-rs"
+version = "0.2.0"
+dependencies = [
+ "anyhow",
+ "chrono",
+ "cultcache-rs-derive",
+ "fs2",
+ "redb",
+ "rmp-serde",
+ "serde",
+ "serde_bytes",
+ "serde_json",
+ "uuid",
+ "windows-sys 0.59.0",
+]
+
+[[package]]
+name = "cultcache-rs-derive"
+version = "0.1.0"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "cultmesh-rs"
+version = "0.1.0"
+dependencies = [
+ "anyhow",
+ "cultcache-rs",
+ "cultnet-rs",
+ "pretty_assertions",
+ "rmp-serde",
+ "serde",
+ "tempfile",
+]
+
+[[package]]
+name = "cultnet-rs"
+version = "0.1.0"
+dependencies = [
+ "aes-gcm",
+ "anyhow",
+ "base64",
+ "chrono",
+ "cultcache-rs",
+ "ed25519-dalek",
+ "hmac",
+ "rand",
+ "rmp-serde",
+ "rmpv",
+ "serde",
+ "serde_bytes",
+ "serde_json",
+ "sha2",
+ "socket2",
+ "uuid",
+ "windows-sys 0.61.2",
+ "zeroize",
+]
+
+[[package]]
+name = "curve25519-dalek"
+version = "4.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "97fb8b7c4503de7d6ae7b42ab72a5a59857b4c937ec27a3d4539dba95b5ab2be"
+dependencies = [
+ "cfg-if",
+ "cpufeatures",
+ "curve25519-dalek-derive",
+ "digest",
+ "fiat-crypto",
+ "rustc_version",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "curve25519-dalek-derive"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f46882e17999c6cc590af592290432be3bce0428cb0d5f8b6715e4dc7b383eb3"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "der"
+version = "0.7.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e7c1832837b905bbfb5101e07cc24c8deddf52f93225eee6ead5f4d63d53ddcb"
+dependencies = [
+ "const-oid",
+ "zeroize",
+]
+
+[[package]]
+name = "diff"
+version = "0.1.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "56254986775e3233ffa9c4d7d3faaf6d36a2c09d30b20687e9f88bc8bafc16c8"
+
+[[package]]
+name = "digest"
+version = "0.10.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
+dependencies = [
+ "block-buffer",
+ "crypto-common",
+ "subtle",
+]
+
+[[package]]
+name = "ed25519"
+version = "2.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "115531babc129696a58c64a4fef0a8bf9e9698629fb97e9e40767d235cfbcd53"
+dependencies = [
+ "pkcs8",
+ "signature",
+]
+
+[[package]]
+name = "ed25519-dalek"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "70e796c081cee67dc755e1a36a0a172b897fab85fc3f6bc48307991f64e4eca9"
+dependencies = [
+ "curve25519-dalek",
+ "ed25519",
+ "serde",
+ "sha2",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "errno"
+version = "0.3.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
+dependencies = [
+ "libc",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "fastrand"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "da7c62ceae207dd37ea5b845da6a0696c799f85e97da1ab5b7910be3c1c80223"
+
+[[package]]
+name = "fiat-crypto"
+version = "0.2.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "28dea519a9695b9977216879a3ebfddf92f1c08c05d984f8996aecd6ecdc811d"
+
+[[package]]
+name = "find-msvc-tools"
+version = "0.1.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d45db016d36b838f563236e9193d0ee6ce38f3f68b6c94e914b4929c96bbb890"
+
+[[package]]
+name = "fs2"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9564fc758e15025b46aa6643b1b77d047d1a56a1aea6e01002ac0c7026876213"
+dependencies = [
+ "libc",
+ "winapi",
+]
+
+[[package]]
+name = "futures-core"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "92d699e522242e69e3003b94ecc1f960f3a5e015aa7c5d7486e65ad01dd94f5e"
+
+[[package]]
+name = "futures-task"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cd417de3d1d015fc3bfd2b1ea46dfc7bab72ef86f1cc7cc9c78e728b34a6d1fd"
+
+[[package]]
+name = "futures-util"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0d50a92467f8ba5dd6e3ee5d4bd04d73ab2e4e1c44474a0674821dfce14b79bc"
+dependencies = [
+ "futures-core",
+ "futures-task",
+ "pin-project-lite",
+ "slab",
+]
+
+[[package]]
+name = "generic-array"
+version = "0.14.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "85649ca51fd72272d7821adaf274ad91c288277713d9c18820d8499a7ff69e9a"
+dependencies = [
+ "typenum",
+ "version_check",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ff2abc00be7fca6ebc474524697ae276ad847ad0a6b3faa4bcb027e9a4614ad0"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "wasi",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.3.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "899def5c37c4fd7b2664648c28120ecec138e4d395b459e5ca34f9cce2dd77fd"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "r-efi 5.3.0",
+ "wasip2",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "300e883d756b2e4ec94e02791f39b04b522276138852cfc41d9fb7e904106099"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "r-efi 6.0.0",
+]
+
+[[package]]
+name = "ghash"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f0d8a4362ccb29cb0b265253fb0a2728f592895ee6854fd9bc13f2ffda266ff1"
+dependencies = [
+ "opaque-debug",
+ "polyval",
+]
+
+[[package]]
+name = "hmac"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6c49c37c09c17a53d937dfbb742eb3a961d65a994e6bcdcf37e7399d0cc8ab5e"
+dependencies = [
+ "digest",
+]
+
+[[package]]
+name = "iana-time-zone"
+version = "0.1.65"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e31bc9ad994ba00e440a8aa5c9ef0ec67d5cb5e5cb0cc7f8b744a35b389cc470"
+dependencies = [
+ "android_system_properties",
+ "core-foundation-sys",
+ "iana-time-zone-haiku",
+ "js-sys",
+ "log",
+ "wasm-bindgen",
+ "windows-core",
+]
+
+[[package]]
+name = "iana-time-zone-haiku"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f31827a206f56af32e590ba56d5d2d085f558508192593743f16b2306495269f"
+dependencies = [
+ "cc",
+]
+
+[[package]]
+name = "inout"
+version = "0.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "879f10e63c20629ecabbb64a8010319738c66a5cd0c29b02d63d272b03751d01"
+dependencies = [
+ "generic-array",
+]
+
+[[package]]
+name = "itoa"
+version = "1.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682"
+
+[[package]]
+name = "js-sys"
+version = "0.3.104"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0e0c1080212aad755ea003d18543e8768dd432c48819efd73a7bf1e39b7a5a3a"
+dependencies = [
+ "cfg-if",
+ "futures-util",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "libc"
+version = "0.2.189"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3eaf3ede3fee6db1a4c2ee091bf8a8b4dccdc6d17f656fb07896ee72867612f2"
+
+[[package]]
+name = "linux-raw-sys"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32a66949e030da00e8c7d4434b251670a91556f4144941d37452769c25d58a53"
+
+[[package]]
+name = "log"
+version = "0.4.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f9f8bd3e56ce4dfc153cf470fffbfa98c7620958b312ca5c3a4b8d5181fd13c6"
+
+[[package]]
+name = "memchr"
+version = "2.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf8baf1c55e62ffcace7a9f06f4bd9cd3f0c4beb022d3b367256b91b87513d98"
+
+[[package]]
+name = "num-traits"
+version = "0.2.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "071dfc062690e90b734c0b2273ce72ad0ffa95f0c74596bc250dcfd960262841"
+dependencies = [
+ "autocfg",
+]
+
+[[package]]
+name = "once_cell"
+version = "1.21.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9f7c3e4beb33f85d45ae3e3a1792185706c8e16d043238c593331cc7cd313b50"
+
+[[package]]
+name = "opaque-debug"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c08d65885ee38876c4f86fa503fb49d7b507c2b62552df7c70b2fce627e06381"
+
+[[package]]
+name = "pin-project-lite"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a89322df9ebe1c1578d689c92318e070967d1042b512afbe49518723f4e6d5cd"
+
+[[package]]
+name = "pkcs8"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f950b2377845cebe5cf8b5165cb3cc1a5e0fa5cfa3e1f7f55707d8fd82e0a7b7"
+dependencies = [
+ "der",
+ "spki",
+]
+
+[[package]]
+name = "polyval"
+version = "0.6.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9d1fe60d06143b2430aa532c94cfe9e29783047f06c0d7fd359a9a51b729fa25"
+dependencies = [
+ "cfg-if",
+ "cpufeatures",
+ "opaque-debug",
+ "universal-hash",
+]
+
+[[package]]
+name = "ppv-lite86"
+version = "0.2.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "85eae3c4ed2f50dcfe72643da4befc30deadb458a9b590d720cde2f2b1e97da9"
+dependencies = [
+ "zerocopy",
+]
+
+[[package]]
+name = "pretty_assertions"
+version = "1.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3ae130e2f271fbc2ac3a40fb1d07180839cdbbe443c7a27e1e3c13c5cac0116d"
+dependencies = [
+ "diff",
+ "yansi",
+]
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.107"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "985e7ec9bb745e6ce6535b544d84d6cd6f7ad8bd711c398938ae983b91a766d9"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "quote"
+version = "1.0.47"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1fbf4db142a473a8d80c26bbf18454ed458bf8d26c8219c331daecfdbd079001"
+dependencies = [
+ "proc-macro2",
+]
+
+[[package]]
+name = "r-efi"
+version = "5.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "69cdb34c158ceb288df11e18b4bd39de994f6657d83847bdffdbd7f346754b0f"
+
+[[package]]
+name = "r-efi"
+version = "6.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8dcc9c7d52a811697d2151c701e0d08956f92b0e24136cf4cf27b57a6a0d9bf"
+
+[[package]]
+name = "rand"
+version = "0.9.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b9ef1d0d795eb7d84685bca4f72f3649f064e6641543d3a8c415898726a57b41"
+dependencies = [
+ "rand_chacha",
+ "rand_core 0.9.5",
+]
+
+[[package]]
+name = "rand_chacha"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d3022b5f1df60f26e1ffddd6c66e8aa15de382ae63b3a0c1bfc0e4d3e3f325cb"
+dependencies = [
+ "ppv-lite86",
+ "rand_core 0.9.5",
+]
+
+[[package]]
+name = "rand_core"
+version = "0.6.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ec0be4795e2f6a28069bec0b5ff3e2ac9bafc99e6a9a7dc3547996c5c816922c"
+dependencies = [
+ "getrandom 0.2.17",
+]
+
+[[package]]
+name = "rand_core"
+version = "0.9.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "76afc826de14238e6e8c374ddcc1fa19e374fd8dd986b0d2af0d02377261d83c"
+dependencies = [
+ "getrandom 0.3.4",
+]
+
+[[package]]
+name = "redb"
+version = "4.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "de6c3b63e007e90ce536ec2ae4690826136a20ec8dbbbb400daef1bb999d2e36"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "rmp"
+version = "0.8.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4ba8be72d372b2c9b35542551678538b562e7cf86c3315773cae48dfbfe7790c"
+dependencies = [
+ "num-traits",
+]
+
+[[package]]
+name = "rmp-serde"
+version = "1.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72f81bee8c8ef9b577d1681a70ebbc962c232461e397b22c208c43c04b67a155"
+dependencies = [
+ "rmp",
+ "serde",
+]
+
+[[package]]
+name = "rmpv"
+version = "1.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7a4e1d4b9b938a26d2996af33229f0ca0956c652c1375067f0b45291c1df8417"
+dependencies = [
+ "rmp",
+ "serde",
+ "serde_bytes",
+]
+
+[[package]]
+name = "rustc_version"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cfcb3a22ef46e85b45de6ee7e79d063319ebb6594faafcf1c225ea92ab6e9b92"
+dependencies = [
+ "semver",
+]
+
+[[package]]
+name = "rustix"
+version = "1.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6fe4565b9518b83ef4f91bb47ce29620ca828bd32cb7e408f0062e9930ba190"
+dependencies = [
+ "bitflags",
+ "errno",
+ "libc",
+ "linux-raw-sys",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "rustversion"
+version = "1.0.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf54715a573b99ac80df0bc206da022bcd442c974952c7b9720069370852e21f"
+
+[[package]]
+name = "semver"
+version = "1.0.28"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8a7852d02fc848982e0c167ef163aaff9cd91dc640ba85e263cb1ce46fae51cd"
+
+[[package]]
+name = "serde"
+version = "1.0.229"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4148590afebada386688f18773da617792bf2ef03ffc1e4cbd2b1d45b023e0ba"
+dependencies = [
+ "serde_core",
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_bytes"
+version = "0.11.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a5d440709e79d88e51ac01c4b72fc6cb7314017bb7da9eeff678aa94c10e3ea8"
+dependencies = [
+ "serde",
+ "serde_core",
+]
+
+[[package]]
+name = "serde_core"
+version = "1.0.229"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "67dca2c9c51e58a4791a4b1ed58308b39c64224d349a935ab5039aa360942a48"
+dependencies = [
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_derive"
+version = "1.0.229"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e7a5d71263a5a7d47b41f6b3f06ba276f10cc18b0931f1799f710578e2309348"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.4",
+]
+
+[[package]]
+name = "serde_json"
+version = "1.0.151"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c841b55ecdae098c80dcae9cf767f6f8a0c2cdb3416bbef72181df4d0fe73f14"
+dependencies = [
+ "itoa",
+ "memchr",
+ "serde",
+ "serde_core",
+ "zmij",
+]
+
+[[package]]
+name = "sha2"
+version = "0.10.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a7507d819769d01a365ab707794a4084392c824f54a7a6a7862f8c3d0892b283"
+dependencies = [
+ "cfg-if",
+ "cpufeatures",
+ "digest",
+]
+
+[[package]]
+name = "shlex"
+version = "2.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8fadd59c855ef2080decdef8ff161eb6661b86933c9d82e5ba29dc602a55aba"
+
+[[package]]
+name = "signature"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "77549399552de45a898a580c1b41d445bf730df867cc44e6c0233bbc4b8329de"
+dependencies = [
+ "rand_core 0.6.4",
+]
+
+[[package]]
+name = "slab"
+version = "0.4.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0c790de23124f9ab44544d7ac05d60440adc586479ce501c1d6d7da3cd8c9cf5"
+
+[[package]]
+name = "socket2"
+version = "0.5.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e22376abed350d73dd1cd119b57ffccad95b4e585a7cda43e286245ce23c0678"
+dependencies = [
+ "libc",
+ "windows-sys 0.52.0",
+]
+
+[[package]]
+name = "spki"
+version = "0.7.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d91ed6c858b01f942cd56b37a94b3e0a1798290327d1236e4d9cf4eaca44d29d"
+dependencies = [
+ "base64ct",
+ "der",
+]
+
+[[package]]
+name = "subtle"
+version = "2.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "13c2bddecc57b384dee18652358fb23172facb8a2c51ccc10d74c157bdea3292"
+
+[[package]]
+name = "syn"
+version = "2.0.119"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "872831b642d1a07999a962a351ed35b955ea2cfc8f3862091e2a240a84f17297"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "syn"
+version = "3.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e6275cddf4610d1775e6d1fe9469b2e77d0f39fd98fb7450901b821e0c53649f"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "tempfile"
+version = "3.27.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd"
+dependencies = [
+ "fastrand",
+ "getrandom 0.4.3",
+ "once_cell",
+ "rustix",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "typenum"
+version = "1.20.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6f5e870be6c3b371b77fe0ee0bafb859fa4964b4404c27de1d380043c4dda20"
+
+[[package]]
+name = "unicode-ident"
+version = "1.0.24"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75"
+
+[[package]]
+name = "universal-hash"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fc1de2c688dc15305988b563c3854064043356019f97a4b46276fe734c4f07ea"
+dependencies = [
+ "crypto-common",
+ "subtle",
+]
+
+[[package]]
+name = "uuid"
+version = "1.26.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b5772d71c9be8a8a6ac2117d949c5b224c1b72241bb611d9a3012edcf8af7812"
+dependencies = [
+ "getrandom 0.4.3",
+ "js-sys",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "version_check"
+version = "0.9.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b928f33d975fc6ad9f86c8f283853ad26bdd5b10b7f1542aa2fa15e2289105a"
+
+[[package]]
+name = "wasi"
+version = "0.11.1+wasi-snapshot-preview1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ccf3ec651a847eb01de73ccad15eb7d99f80485de043efb2f370cd654f4ea44b"
+
+[[package]]
+name = "wasip2"
+version = "1.0.4+wasi-0.2.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b67efb37e106e55ce722a510d6b5f9c17f083e5fc79afc2badeb12cc313d9487"
+dependencies = [
+ "wit-bindgen",
+]
+
+[[package]]
+name = "wasm-bindgen"
+version = "0.2.127"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1b70935747edd64d89de3efa29d73789b806c15798f8e7dca4d8ac356b50ce70"
+dependencies = [
+ "cfg-if",
+ "once_cell",
+ "rustversion",
+ "wasm-bindgen-macro",
+ "wasm-bindgen-shared",
+]
+
+[[package]]
+name = "wasm-bindgen-macro"
+version = "0.2.127"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "77775f8f3f7217702089053b94958f8f54061a3f663417df76e19cbdcca29bc1"
+dependencies = [
+ "quote",
+ "wasm-bindgen-macro-support",
+]
+
+[[package]]
+name = "wasm-bindgen-macro-support"
+version = "0.2.127"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e11d33f857dc2fb11b8bc75aee111aa9cbeb12cd9f25efd3d4c2a3dd4e235284"
+dependencies = [
+ "bumpalo",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+ "wasm-bindgen-shared",
+]
+
+[[package]]
+name = "wasm-bindgen-shared"
+version = "0.2.127"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7ef64dbcc55df09c7e5a46182d181c2cfa3e925f3da937ea764728b4bbb9dcbf"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "winapi"
+version = "0.3.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c839a674fcd7a98952e593242ea400abe93992746761e38641405d28b00f419"
+dependencies = [
+ "winapi-i686-pc-windows-gnu",
+ "winapi-x86_64-pc-windows-gnu",
+]
+
+[[package]]
+name = "winapi-i686-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
+
+[[package]]
+name = "winapi-x86_64-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
+
+[[package]]
+name = "windows-core"
+version = "0.62.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8e83a14d34d0623b51dce9581199302a221863196a1dde71a7663a4c2be9deb"
+dependencies = [
+ "windows-implement",
+ "windows-interface",
+ "windows-link",
+ "windows-result",
+ "windows-strings",
+]
+
+[[package]]
+name = "windows-implement"
+version = "0.60.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "053e2e040ab57b9dc951b72c264860db7eb3b0200ba345b4e4c3b14f67855ddf"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "windows-interface"
+version = "0.59.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3f316c4a2570ba26bbec722032c4099d8c8bc095efccdc15688708623367e358"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "windows-link"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f0805222e57f7521d6a62e36fa9163bc891acd422f971defe97d64e70d0a4fe5"
+
+[[package]]
+name = "windows-result"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7781fa89eaf60850ac3d2da7af8e5242a5ea78d1a11c49bf2910bb5a73853eb5"
+dependencies = [
+ "windows-link",
+]
+
+[[package]]
+name = "windows-strings"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7837d08f69c77cf6b07689544538e017c1bfcf57e34b4c0ff58e6c2cd3b37091"
+dependencies = [
+ "windows-link",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.52.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "282be5f36a8ce781fad8c8ae18fa3f9beff57ec1b52cb3de0789201425d9a33d"
+dependencies = [
+ "windows-targets",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.59.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e38bc4d79ed67fd075bcc251a1c39b32a1776bbe92e5bef1f0bf1f8c531853b"
+dependencies = [
+ "windows-targets",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.61.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ae137229bcbd6cdf0f7b80a31df61766145077ddf49416a728b02cb3921ff3fc"
+dependencies = [
+ "windows-link",
+]
+
+[[package]]
+name = "windows-targets"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b724f72796e036ab90c1021d4780d4d3d648aca59e491e6b98e725b84e99973"
+dependencies = [
+ "windows_aarch64_gnullvm",
+ "windows_aarch64_msvc",
+ "windows_i686_gnu",
+ "windows_i686_gnullvm",
+ "windows_i686_msvc",
+ "windows_x86_64_gnu",
+ "windows_x86_64_gnullvm",
+ "windows_x86_64_msvc",
+]
+
+[[package]]
+name = "windows_aarch64_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32a4622180e7a0ec044bb555404c800bc9fd9ec262ec147edd5989ccd0c02cd3"
+
+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "09ec2a7bb152e2252b53fa7803150007879548bc709c039df7627cabbd05d469"
+
+[[package]]
+name = "windows_i686_gnu"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e9b5ad5ab802e97eb8e295ac6720e509ee4c243f69d781394014ebfe8bbfa0b"
+
+[[package]]
+name = "windows_i686_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0eee52d38c090b3caa76c563b86c3a4bd71ef1a819287c19d586d7334ae8ed66"
+
+[[package]]
+name = "windows_i686_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "240948bc05c5e7c6dabba28bf89d89ffce3e303022809e73deaefe4f6ec56c66"
+
+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "147a5c80aabfbf0c7d901cb5895d1de30ef2907eb21fbbab29ca94c5b08b1a78"
+
+[[package]]
+name = "windows_x86_64_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "24d5b23dc417412679681396f2b49f3de8c1473deb516bd34410872eff51ed0d"
+
+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"
+
+[[package]]
+name = "wit-bindgen"
+version = "0.57.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1ebf944e87a7c253233ad6766e082e3cd714b5d03812acc24c318f549614536e"
+
+[[package]]
+name = "yansi"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cfe53a6657fd280eaa890a3bc59152892ffa3e30101319d168b781ed6529b049"
+
+[[package]]
+name = "zerocopy"
+version = "0.8.56"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "556764e583adb45a9f8d413c2a147fa7e8d821e48e12b14fd560b607998b75eb"
+dependencies = [
+ "zerocopy-derive",
+]
+
+[[package]]
+name = "zerocopy-derive"
+version = "0.8.56"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f2ab42fc20575779bd240faa45f94a74256f755c0fa9e89f0ede20d91d0cdfc1"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "zeroize"
+version = "1.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e13c156562582aa81c60cb29407084cdb54c4164760106ab78e6c5b0858cf64e"
+
+[[package]]
+name = "zmij"
+version = "1.0.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "29666d0abbfad1e3dc4dcf6144730dd3a3ab225bbbdac83319345b1b44ccfc1b"
diff --git a/packages/cultmesh-rs/Cargo.toml b/packages/cultmesh-rs/Cargo.toml
new file mode 100644
index 00000000..820050c3
--- /dev/null
+++ b/packages/cultmesh-rs/Cargo.toml
@@ -0,0 +1,21 @@
+[package]
+name = "cultmesh-rs"
+version = "0.1.0"
+edition = "2024"
+license = "MIT"
+publish = false
+
+[lib]
+name = "cultmesh_rs"
+path = "src/lib.rs"
+
+[dependencies]
+anyhow = "1"
+cultcache-rs = { path = "../cultcache-rs" }
+cultnet-rs = { path = "../cultnet-rs" }
+serde = { version = "1", features = ["derive"] }
+
+[dev-dependencies]
+pretty_assertions = "1.4.1"
+rmp-serde = "1"
+tempfile = "3"
diff --git a/packages/cultmesh-rs/src/lib.rs b/packages/cultmesh-rs/src/lib.rs
new file mode 100644
index 00000000..8cfe8cec
--- /dev/null
+++ b/packages/cultmesh-rs/src/lib.rs
@@ -0,0 +1,1609 @@
+use anyhow::{Context, Result};
+use cultcache_rs::CultCache;
+use cultcache_rs::CultCacheEnvelope;
+use cultcache_rs::CultSoaTable;
+use cultcache_rs::DatabaseEntry;
+use cultcache_rs::SingleFileMessagePackBackingStore;
+use cultcache_rs::SoaDocument;
+use cultnet_rs::CultNetDocumentPutOptions;
+use cultnet_rs::CultNetDocumentRegistry;
+use cultnet_rs::CultNetRudpSocketTransportConnection;
+use cultnet_rs::CultNetRudpSocketTransportOptions;
+use cultnet_rs::CultNetWireContract;
+use cultnet_rs::decode_cultnet_message_from_slice;
+use cultnet_rs::encode_cultnet_message_to_vec;
+use serde::Serialize;
+use std::collections::BTreeMap;
+use std::collections::hash_map::RandomState;
+use std::env;
+use std::hash::{BuildHasher, Hasher};
+use std::net::SocketAddr;
+use std::net::UdpSocket;
+use std::path::Path;
+use std::thread;
+use std::time::Duration;
+use std::time::Instant;
+
+mod rudp_document_server;
+
+pub use rudp_document_server::*;
+
+pub const CULTMESH_RUDP_DOCUMENT_CATALOG_CONNECTION_ID: u32 = 0x0d1d_0002;
+
+pub trait CultMeshDocumentSet: Clone + Send + Sync + 'static {
+    fn register_cache(&self, cache: &mut CultCache) -> Result<()>;
+    fn register_documents(&self, registry: &mut CultNetDocumentRegistry) -> Result<()>;
+}
+
+#[macro_export]
+macro_rules! cultmesh_documents {
+    ($name:ident { $($entry:ty => $schema_version:expr),* $(,)? }) => {
+        #[derive(Clone, Copy, Debug, Default)]
+        pub struct $name;
+
+        impl $crate::CultMeshDocumentSet for $name {
+            fn register_cache(
+                &self,
+                cache: &mut cultcache_rs::CultCache,
+            ) -> ::anyhow::Result<()> {
+                $(
+                    cache.register_entry_type::<$entry>()?;
+                )*
+                Ok(())
+            }
+
+            fn register_documents(
+                &self,
+                registry: &mut cultnet_rs::CultNetDocumentRegistry,
+            ) -> ::anyhow::Result<()> {
+                $(
+                    registry.register(
+                        cultnet_rs::CultNetDocumentBinding::for_entry_with_schema_id::<$entry>(
+                            $schema_version.to_string(),
+                            $schema_version.to_string(),
+                        ),
+                    );
+                )*
+                Ok(())
+            }
+        }
+    };
+}
+
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct CultMeshNodeOptions {
+    pub runtime_id: String,
+    pub pull_on_start: bool,
+}
+
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct CultMeshRudpDocumentPublishOptions {
+    pub target: SocketAddr,
+    pub runtime_id: String,
+    pub connect_timeout: Duration,
+    pub flush_timeout: Duration,
+    pub poll_interval: Duration,
+    pub resend_delay_ms: u64,
+    pub source_agent_id: Option<String>,
+    pub source_role: Option<String>,
+    pub tags: Vec<String>,
+}
+
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct CultMeshRudpSnapshotOptions {
+    pub target: SocketAddr,
+    pub runtime_id: String,
+    /// Exact correlation id for the SnapshotRequest. Raw callers must supply
+    /// this; `CultMeshNode::pull_rudp_catalog_snapshot` generates one when it
+    /// owns the request.
+    pub message_id: String,
+    pub connect_timeout: Duration,
+    pub response_timeout: Duration,
+    pub poll_interval: Duration,
+    pub resend_delay_ms: u64,
+    pub schema_ids: Option<Vec<String>>,
+    pub record_keys: Option<Vec<String>>,
+}
+
+impl CultMeshRudpSnapshotOptions {
+    pub fn odin(target: SocketAddr, runtime_id: impl Into<String>) -> Self {
+        Self {
+            target,
+            runtime_id: runtime_id.into(),
+            ..Self::default()
+        }
+    }
+}
+
+impl Default for CultMeshRudpSnapshotOptions {
+    fn default() -> Self {
+        Self {
+            target: SocketAddr::from(([0, 0, 0, 0], 0)),
+            runtime_id: "cultmesh-rudp-snapshot-client".to_string(),
+            message_id: String::new(),
+            connect_timeout: Duration::from_secs(3),
+            response_timeout: Duration::from_secs(3),
+            poll_interval: Duration::from_millis(10),
+            resend_delay_ms: 50,
+            schema_ids: None,
+            record_keys: None,
+        }
+    }
+}
+
+impl CultMeshRudpDocumentPublishOptions {
+    pub fn odin(target: SocketAddr, runtime_id: impl Into<String>) -> Self {
+        Self {
+            target,
+            runtime_id: runtime_id.into(),
+            ..Self::default()
+        }
+    }
+}
+
+impl Default for CultMeshRudpDocumentPublishOptions {
+    fn default() -> Self {
+        Self {
+            target: SocketAddr::from(([0, 0, 0, 0], 0)),
+            runtime_id: "cultmesh-rudp-document-publisher".to_string(),
+            connect_timeout: Duration::from_secs(3),
+            flush_timeout: Duration::from_millis(300),
+            poll_interval: Duration::from_millis(10),
+            resend_delay_ms: 50,
+            source_agent_id: None,
+            source_role: None,
+            tags: Vec::new(),
+        }
+    }
+}
+
+impl Default for CultMeshNodeOptions {
+    fn default() -> Self {
+        Self {
+            runtime_id: "cultmesh-local".to_string(),
+            pull_on_start: true,
+        }
+    }
+}
+
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct CultMeshRudpEndpoint {
+    pub host: String,
+    pub port: u16,
+    pub addr: SocketAddr,
+}
+
+pub struct CultMeshNode {
+    runtime_id: String,
+    cache: CultCache,
+    documents: CultNetDocumentRegistry,
+}
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum CultMeshStreamKind {
+    Audio,
+    Video,
+    Tensor,
+    Bytes,
+}
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum CultMeshStreamBodyTransport {
+    SharedMemory,
+    SharedD3d12Texture,
+    SharedD3d11Texture,
+    DmaBuf,
+    IoSurface,
+    AHardwareBuffer,
+    CultCachePage,
+    InlineBytes,
+}
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum CultMeshStreamAccess {
+    Read,
+    Write,
+    ReadWrite,
+}
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum CultMeshStreamCopyBudget {
+    ZeroCopyTarget,
+    OneCopyFallback,
+    OpaqueRuntime,
+}
+
+#[derive(Clone, Debug, PartialEq)]
+pub struct CultMeshStreamClock {
+    pub clock_domain_id: String,
+    pub source_id: Option<String>,
+    pub sample_rate: i32,
+    pub offset_to_verse_time_ns: i64,
+    pub confidence: f64,
+    pub evidence_kind: Option<String>,
+}
+
+impl CultMeshStreamClock {
+    pub fn new(clock_domain_id: impl Into<String>) -> Result<Self> {
+        let clock_domain_id = require_non_empty(clock_domain_id.into(), "clock_domain_id")?;
+        Ok(Self {
+            clock_domain_id,
+            source_id: None,
+            sample_rate: 0,
+            offset_to_verse_time_ns: 0,
+            confidence: 0.0,
+            evidence_kind: None,
+        })
+    }
+
+    pub fn source_id(mut self, source_id: impl Into<String>) -> Result<Self> {
+        self.source_id = Some(require_non_empty(source_id.into(), "source_id")?);
+        Ok(self)
+    }
+
+    pub fn confidence(mut self, confidence: f64) -> Self {
+        self.confidence = confidence;
+        self
+    }
+
+    pub fn evidence_kind(mut self, evidence_kind: impl Into<String>) -> Result<Self> {
+        self.evidence_kind = Some(require_non_empty(evidence_kind.into(), "evidence_kind")?);
+        Ok(self)
+    }
+}
+
+#[derive(Clone, Debug, PartialEq)]
+pub struct CultMeshStreamDescriptor {
+    pub stream_id: String,
+    pub verse_id: String,
+    pub owner_peer_id: String,
+    pub kind: CultMeshStreamKind,
+    pub clock: CultMeshStreamClock,
+    pub preferred_transports: Vec<CultMeshStreamBodyTransport>,
+    pub label: Option<String>,
+    pub required_access: CultMeshStreamAccess,
+    pub max_in_flight_frames: u32,
+    pub metadata_schema_id: Option<String>,
+}
+
+impl CultMeshStreamDescriptor {
+    pub fn new(
+        stream_id: impl Into<String>,
+        verse_id: impl Into<String>,
+        owner_peer_id: impl Into<String>,
+        kind: CultMeshStreamKind,
+        clock: CultMeshStreamClock,
+        preferred_transports: Vec<CultMeshStreamBodyTransport>,
+    ) -> Result<Self> {
+        if preferred_transports.is_empty() {
+            anyhow::bail!("preferred_transports must not be empty");
+        }
+        Ok(Self {
+            stream_id: require_non_empty(stream_id.into(), "stream_id")?,
+            verse_id: require_non_empty(verse_id.into(), "verse_id")?,
+            owner_peer_id: require_non_empty(owner_peer_id.into(), "owner_peer_id")?,
+            kind,
+            clock,
+            preferred_transports,
+            label: None,
+            required_access: CultMeshStreamAccess::Read,
+            max_in_flight_frames: 0,
+            metadata_schema_id: None,
+        })
+    }
+
+    pub fn label(mut self, label: impl Into<String>) -> Result<Self> {
+        self.label = Some(require_non_empty(label.into(), "label")?);
+        Ok(self)
+    }
+
+    pub fn max_in_flight_frames(mut self, max_in_flight_frames: u32) -> Self {
+        self.max_in_flight_frames = max_in_flight_frames;
+        self
+    }
+
+    pub fn metadata_schema_id(mut self, metadata_schema_id: impl Into<String>) -> Result<Self> {
+        self.metadata_schema_id = Some(require_non_empty(
+            metadata_schema_id.into(),
+            "metadata_schema_id",
+        )?);
+        Ok(self)
+    }
+}
+
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct CultMeshStreamConsumerProfile {
+    pub peer_id: String,
+    pub verse_id: String,
+    pub supported_transports: Vec<CultMeshStreamBodyTransport>,
+    pub accepted_kinds: Vec<CultMeshStreamKind>,
+    pub max_in_flight_frames: u32,
+}
+
+impl CultMeshStreamConsumerProfile {
+    pub fn new(
+        peer_id: impl Into<String>,
+        verse_id: impl Into<String>,
+        supported_transports: Vec<CultMeshStreamBodyTransport>,
+    ) -> Result<Self> {
+        if supported_transports.is_empty() {
+            anyhow::bail!("supported_transports must not be empty");
+        }
+        Ok(Self {
+            peer_id: require_non_empty(peer_id.into(), "peer_id")?,
+            verse_id: require_non_empty(verse_id.into(), "verse_id")?,
+            supported_transports,
+            accepted_kinds: Vec::new(),
+            max_in_flight_frames: 0,
+        })
+    }
+}
+
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct CultMeshStreamNegotiation {
+    pub stream_id: String,
+    pub producer_peer_id: String,
+    pub consumer_peer_id: String,
+    pub transport: CultMeshStreamBodyTransport,
+    pub access: CultMeshStreamAccess,
+    pub max_in_flight_frames: u32,
+    pub copy_budget: CultMeshStreamCopyBudget,
+}
+
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct CultMeshStreamFrameHandle {
+    pub stream_id: String,
+    pub sequence: u64,
+    pub timestamp_ns: i64,
+    pub duration_ns: i64,
+    pub transport: CultMeshStreamBodyTransport,
+    pub byte_length: usize,
+    pub resource_key: Option<String>,
+    pub unavoidable_copy_count: u32,
+}
+
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct CultMeshSharedMemoryFrameRingStats {
+    pub stream_id: String,
+    pub slot_count: usize,
+    pub slot_byte_length: usize,
+    pub published_frames: u64,
+    pub dropped_frames: u64,
+    pub blocked_writes: u64,
+    pub latest_sequence: u64,
+    pub unavoidable_copy_count: u64,
+}
+
+pub struct CultMeshFrameReadLease<'a> {
+    pub handle: CultMeshStreamFrameHandle,
+    bytes: &'a [u8],
+}
+
+impl CultMeshFrameReadLease<'_> {
+    pub fn bytes(&self) -> &[u8] {
+        self.bytes
+    }
+}
+
+#[derive(Clone, Debug)]
+pub struct CultMeshSharedMemoryFrameRing {
+    stream_id: String,
+    slot_byte_length: usize,
+    slots: Vec<Option<(CultMeshStreamFrameHandle, Vec<u8>)>>,
+    write_cursor: usize,
+    latest_slot: Option<usize>,
+    next_sequence: u64,
+    published_frames: u64,
+    dropped_frames: u64,
+    blocked_writes: u64,
+    unavoidable_copy_count: u64,
+}
+
+impl CultMeshSharedMemoryFrameRing {
+    pub fn new(
+        stream_id: impl Into<String>,
+        slot_count: usize,
+        slot_byte_length: usize,
+    ) -> Result<Self> {
+        let stream_id = require_non_empty(stream_id.into(), "stream_id")?;
+        if slot_count == 0 {
+            anyhow::bail!("slot_count must be greater than zero");
+        }
+        if slot_byte_length == 0 {
+            anyhow::bail!("slot_byte_length must be greater than zero");
+        }
+        Ok(Self {
+            stream_id,
+            slot_byte_length,
+            slots: vec![None; slot_count],
+            write_cursor: 0,
+            latest_slot: None,
+            next_sequence: 0,
+            published_frames: 0,
+            dropped_frames: 0,
+            blocked_writes: 0,
+            unavoidable_copy_count: 0,
+        })
+    }
+
+    pub fn try_publish_copy(
+        &mut self,
+        bytes: &[u8],
+        timestamp_ns: i64,
+        duration_ns: i64,
+    ) -> Result<Option<CultMeshStreamFrameHandle>> {
+        if bytes.len() > self.slot_byte_length {
+            anyhow::bail!("frame byte length exceeds slot size");
+        }
+        if self.slots.is_empty() {
+            self.blocked_writes += 1;
+            return Ok(None);
+        }
+
+        let slot_index = self.write_cursor;
+        if self.slots[slot_index].is_some() {
+            self.dropped_frames += 1;
+        }
+        let handle = CultMeshStreamFrameHandle {
+            stream_id: self.stream_id.clone(),
+            sequence: self.next_sequence,
+            timestamp_ns,
+            duration_ns,
+            transport: CultMeshStreamBodyTransport::SharedMemory,
+            byte_length: bytes.len(),
+            resource_key: Some(format!("{}:slot:{slot_index}", self.stream_id)),
+            unavoidable_copy_count: 1,
+        };
+        self.slots[slot_index] = Some((handle.clone(), bytes.to_vec()));
+        self.latest_slot = Some(slot_index);
+        self.write_cursor = (slot_index + 1) % self.slots.len();
+        self.next_sequence = self.next_sequence.saturating_add(1);
+        self.published_frames = self.published_frames.saturating_add(1);
+        self.unavoidable_copy_count = self.unavoidable_copy_count.saturating_add(1);
+        Ok(Some(handle))
+    }
+
+    pub fn try_acquire_latest_read(&self) -> Option<CultMeshFrameReadLease<'_>> {
+        let slot_index = self.latest_slot?;
+        let (handle, bytes) = self.slots[slot_index].as_ref()?;
+        Some(CultMeshFrameReadLease {
+            handle: handle.clone(),
+            bytes,
+        })
+    }
+
+    pub fn stats(&self) -> CultMeshSharedMemoryFrameRingStats {
+        let latest_sequence = self
+            .latest_slot
+            .and_then(|slot| self.slots[slot].as_ref().map(|(handle, _)| handle.sequence))
+            .unwrap_or(0);
+        CultMeshSharedMemoryFrameRingStats {
+            stream_id: self.stream_id.clone(),
+            slot_count: self.slots.len(),
+            slot_byte_length: self.slot_byte_length,
+            published_frames: self.published_frames,
+            dropped_frames: self.dropped_frames,
+            blocked_writes: self.blocked_writes,
+            latest_sequence,
+            unavoidable_copy_count: self.unavoidable_copy_count,
+        }
+    }
+}
+
+#[derive(Clone, Debug, Default)]
+pub struct CultMeshStreamCatalog {
+    streams: BTreeMap<String, CultMeshStreamDescriptor>,
+    latest_frames: BTreeMap<String, CultMeshStreamFrameHandle>,
+    rings: BTreeMap<String, CultMeshSharedMemoryFrameRing>,
+}
+
+impl CultMeshStreamCatalog {
+    pub fn declare(&mut self, stream: CultMeshStreamDescriptor) {
+        self.streams.insert(stream.stream_id.clone(), stream);
+    }
+
+    pub fn get(&self, stream_id: &str) -> Option<&CultMeshStreamDescriptor> {
+        self.streams.get(stream_id)
+    }
+
+    pub fn streams(&self) -> Vec<&CultMeshStreamDescriptor> {
+        self.streams.values().collect()
+    }
+
+    pub fn find(
+        &self,
+        verse_id: &str,
+        kind: Option<CultMeshStreamKind>,
+    ) -> Vec<&CultMeshStreamDescriptor> {
+        self.streams
+            .values()
+            .filter(|stream| stream.verse_id == verse_id && kind.is_none_or(|k| stream.kind == k))
+            .collect()
+    }
+
+    pub fn negotiate(
+        &self,
+        stream_id: &str,
+        consumer: &CultMeshStreamConsumerProfile,
+    ) -> Result<CultMeshStreamNegotiation> {
+        let stream = self
+            .streams
+            .get(stream_id)
+            .ok_or_else(|| anyhow::anyhow!("unknown CultMesh stream '{stream_id}'"))?;
+        if stream.verse_id != consumer.verse_id {
+            anyhow::bail!("stream and consumer must belong to the same Verse");
+        }
+        if !consumer.accepted_kinds.is_empty() && !consumer.accepted_kinds.contains(&stream.kind) {
+            anyhow::bail!("consumer does not accept stream kind");
+        }
+        let transport = stream
+            .preferred_transports
+            .iter()
+            .copied()
+            .find(|candidate| consumer.supported_transports.contains(candidate))
+            .ok_or_else(|| {
+                anyhow::anyhow!("stream and consumer have no compatible body transport")
+            })?;
+        let producer_max = if stream.max_in_flight_frames == 0 {
+            u32::MAX
+        } else {
+            stream.max_in_flight_frames
+        };
+        let consumer_max = if consumer.max_in_flight_frames == 0 {
+            u32::MAX
+        } else {
+            consumer.max_in_flight_frames
+        };
+        Ok(CultMeshStreamNegotiation {
+            stream_id: stream.stream_id.clone(),
+            producer_peer_id: stream.owner_peer_id.clone(),
+            consumer_peer_id: consumer.peer_id.clone(),
+            transport,
+            access: stream.required_access,
+            max_in_flight_frames: producer_max.min(consumer_max),
+            copy_budget: copy_budget_for(transport),
+        })
+    }
+
+    pub fn create_shared_memory_ring(
+        &mut self,
+        stream_id: &str,
+        slot_count: usize,
+        slot_byte_length: usize,
+    ) -> Result<&mut CultMeshSharedMemoryFrameRing> {
+        if !self.streams.contains_key(stream_id) {
+            anyhow::bail!("unknown CultMesh stream '{stream_id}'");
+        }
+        self.rings.insert(
+            stream_id.to_string(),
+            CultMeshSharedMemoryFrameRing::new(stream_id, slot_count, slot_byte_length)?,
+        );
+        Ok(self
+            .rings
+            .get_mut(stream_id)
+            .expect("ring was inserted for stream"))
+    }
+
+    pub fn ring(&self, stream_id: &str) -> Option<&CultMeshSharedMemoryFrameRing> {
+        self.rings.get(stream_id)
+    }
+
+    pub fn ring_mut(&mut self, stream_id: &str) -> Option<&mut CultMeshSharedMemoryFrameRing> {
+        self.rings.get_mut(stream_id)
+    }
+
+    pub fn publish_frame(&mut self, handle: CultMeshStreamFrameHandle) -> Result<()> {
+        if !self.streams.contains_key(&handle.stream_id) {
+            anyhow::bail!("unknown CultMesh stream '{}'", handle.stream_id);
+        }
+        self.latest_frames.insert(handle.stream_id.clone(), handle);
+        Ok(())
+    }
+
+    pub fn latest_frame(&self, stream_id: &str) -> Option<&CultMeshStreamFrameHandle> {
+        self.latest_frames.get(stream_id)
+    }
+}
+
+fn copy_budget_for(transport: CultMeshStreamBodyTransport) -> CultMeshStreamCopyBudget {
+    match transport {
+        CultMeshStreamBodyTransport::SharedMemory
+        | CultMeshStreamBodyTransport::SharedD3d12Texture
+        | CultMeshStreamBodyTransport::SharedD3d11Texture
+        | CultMeshStreamBodyTransport::DmaBuf
+        | CultMeshStreamBodyTransport::IoSurface
+        | CultMeshStreamBodyTransport::AHardwareBuffer => CultMeshStreamCopyBudget::ZeroCopyTarget,
+        CultMeshStreamBodyTransport::CultCachePage => CultMeshStreamCopyBudget::OneCopyFallback,
+        CultMeshStreamBodyTransport::InlineBytes => CultMeshStreamCopyBudget::OpaqueRuntime,
+    }
+}
+
+fn require_non_empty(value: String, name: &str) -> Result<String> {
+    if value.trim().is_empty() {
+        anyhow::bail!("{name} must be non-empty");
+    }
+    Ok(value)
+}
+
+impl CultMeshNode {
+    pub fn runtime_id(&self) -> &str {
+        &self.runtime_id
+    }
+
+    pub fn cache(&self) -> &CultCache {
+        &self.cache
+    }
+
+    pub fn documents(&self) -> &CultNetDocumentRegistry {
+        &self.documents
+    }
+
+    pub fn get<T: DatabaseEntry>(&self, key: &str) -> Result<Option<T>> {
+        self.cache.get::<T>(key)
+    }
+
+    pub fn get_required<T: DatabaseEntry>(&self, key: &str) -> Result<T> {
+        self.cache.get_required::<T>(key)
+    }
+
+    pub fn get_all_with_keys<T: DatabaseEntry>(&self) -> Result<Vec<(String, T)>> {
+        self.cache.get_all_with_keys::<T>()
+    }
+
+    pub fn soa<T: SoaDocument>(&self) -> Result<CultSoaTable<T>> {
+        self.cache.soa::<T>()
+    }
+
+    pub fn put<T: DatabaseEntry>(&mut self, key: impl Into<String>, value: &T) -> Result<T> {
+        self.cache.put(key, value)
+    }
+
+    pub fn pull_all_backing_stores(&mut self) -> Result<()> {
+        self.cache.pull_all_backing_stores()
+    }
+
+    pub fn delete<T: DatabaseEntry>(&mut self, key: &str) -> Result<bool> {
+        self.cache.delete::<T>(key)
+    }
+
+    pub fn flush(&mut self) -> Result<()> {
+        Ok(())
+    }
+
+    pub fn publish_document_to_rudp_catalog<T>(
+        &self,
+        key: impl Into<String>,
+        value: &T,
+        options: CultMeshRudpDocumentPublishOptions,
+    ) -> Result<()>
+    where
+        T: DatabaseEntry + Serialize,
+    {
+        let message = self.create_rudp_document_message(key, value, &options)?;
+        publish_cultnet_message_to_rudp_catalog(&message, options)
+    }
+
+    pub fn create_rudp_document_message<T>(
+        &self,
+        key: impl Into<String>,
+        value: &T,
+        options: &CultMeshRudpDocumentPublishOptions,
+    ) -> Result<cultnet_rs::CultNetMessage>
+    where
+        T: DatabaseEntry + Serialize,
+    {
+        let key = key.into();
+        self.documents.create_raw_document_put_message(
+            format!("{}:{}:{}", options.runtime_id, T::TYPE, key),
+            key,
+            value,
+            CultNetDocumentPutOptions {
+                source_runtime_id: Some(options.runtime_id.clone()),
+                source_agent_id: options.source_agent_id.clone(),
+                source_role: options.source_role.clone(),
+                tags: if options.tags.is_empty() {
+                    None
+                } else {
+                    Some(options.tags.clone())
+                },
+                ..CultNetDocumentPutOptions::default()
+            },
+        )
+    }
+
+    pub fn pull_rudp_catalog_snapshot(
+        &mut self,
+        mut options: CultMeshRudpSnapshotOptions,
+    ) -> Result<usize> {
+        if options.message_id.trim().is_empty() {
+            options.message_id = format!(
+                "{}:snapshot:{}:{}",
+                options.runtime_id,
+                unix_millis(),
+                fresh_rudp_connection_epoch()
+            );
+        }
+        let response = request_raw_snapshot_from_rudp_catalog(options)?;
+        let cultnet_rs::CultNetMessage::SnapshotResponseRaw { documents, .. } = response else {
+            anyhow::bail!("expected cultnet.snapshot_response_raw.v0");
+        };
+        let mut applied = 0usize;
+        for document in documents {
+            let Some(document_type) =
+                registered_document_type_for_schema(&self.documents, &document.schema_id)
+            else {
+                continue;
+            };
+            self.cache.put_raw_envelope(CultCacheEnvelope {
+                key: document.record_key,
+                r#type: document_type,
+                payload: document.payload,
+                stored_at: document.stored_at,
+                schema_id: Some(document.schema_id),
+            })?;
+            applied += 1;
+        }
+        Ok(applied)
+    }
+}
+
+fn registered_document_type_for_schema(
+    documents: &CultNetDocumentRegistry,
+    schema_id: &str,
+) -> Option<String> {
+    let normalized = strip_schema_version_suffix(schema_id);
+    if normalized != schema_id {
+        return Some(normalized.to_string());
+    }
+    documents
+        .binding_by_schema_id(schema_id)
+        .map(|binding| binding.document_type.clone())
+        .or_else(|| documents.binding(schema_id).map(|_| schema_id.to_string()))
+}
+
+fn strip_schema_version_suffix(value: &str) -> &str {
+    let Some((prefix, suffix)) = value.rsplit_once(".v") else {
+        return value;
+    };
+    if suffix.chars().all(|character| character.is_ascii_digit()) {
+        prefix
+    } else {
+        value
+    }
+}
+
+/// Request a raw CultNet snapshot without importing it into a local cache.
+///
+/// The returned value is the exact validated `SnapshotResponseRaw`, including
+/// its correlation `message_id`. Each call binds a fresh source port, chooses a
+/// fresh connection epoch, and succeeds only after the reliable request is
+/// acknowledged.
+pub fn request_raw_snapshot_from_rudp_catalog(
+    options: CultMeshRudpSnapshotOptions,
+) -> Result<cultnet_rs::CultNetMessage> {
+    if options.runtime_id.trim().is_empty() {
+        anyhow::bail!("runtime_id must be non-empty");
+    }
+    if options.message_id.trim().is_empty() {
+        anyhow::bail!("raw CultMesh RUDP snapshot requires a message_id");
+    }
+    let message_id = options.message_id.clone();
+    let mut client = connect_rudp_client(
+        options.target,
+        &options.runtime_id,
+        options.connect_timeout,
+        options.poll_interval,
+        options.resend_delay_ms,
+        "cultmesh-rudp-snapshot-client",
+    )?;
+
+    let request = cultnet_rs::CultNetMessage::SnapshotRequest {
+        message_id: message_id.clone(),
+        schema_ids: options.schema_ids,
+        record_keys: options.record_keys,
+    };
+    let payload = encode_cultnet_message_to_vec(&request, CultNetWireContract::CultNetSchemaV0)?;
+    let receipt = client.send_reliable("schema", payload)?;
+    let response_deadline = Instant::now() + options.response_timeout;
+    let mut snapshot_response = None;
+    while Instant::now() < response_deadline {
+        if let Some(frame) = client.receive_once()? {
+            if frame.channel_id == "schema" {
+                let message = decode_cultnet_message_from_slice(
+                    &frame.payload,
+                    CultNetWireContract::CultNetSchemaV0,
+                )?;
+                match &message {
+                    cultnet_rs::CultNetMessage::SnapshotResponseRaw {
+                        message_id: received,
+                        ..
+                    } if received == &message_id => {
+                        snapshot_response = Some(message);
+                    }
+                    cultnet_rs::CultNetMessage::Error { error } => {
+                        let _ = client.disconnect(b"snapshot-error".to_vec());
+                        anyhow::bail!("CultMesh RUDP snapshot failed: {error}");
+                    }
+                    _ => {}
+                }
+            }
+        }
+        match client.reliable_send_status(&receipt) {
+            cultnet_rs::CultNetRudpReliableSendStatus::Acknowledged
+                if snapshot_response.is_some() =>
+            {
+                let _ = client.disconnect(b"snapshot-complete".to_vec());
+                return Ok(snapshot_response.expect("response was checked as present"));
+            }
+            cultnet_rs::CultNetRudpReliableSendStatus::Invalidated => {
+                anyhow::bail!("CultMesh RUDP snapshot request receipt was invalidated")
+            }
+            _ => {}
+        }
+        client.poll_resends()?;
+        thread::sleep(options.poll_interval);
+    }
+    let _ = client.disconnect(b"snapshot-timeout".to_vec());
+    if snapshot_response.is_some() {
+        anyhow::bail!(
+            "timed out waiting for reliable acknowledgement of CultMesh RUDP snapshot request to {}",
+            options.target
+        );
+    }
+    anyhow::bail!(
+        "timed out waiting for CultMesh RUDP snapshot from {}",
+        options.target
+    )
+}
+
+fn unix_millis() -> u128 {
+    std::time::SystemTime::now()
+        .duration_since(std::time::UNIX_EPOCH)
+        .unwrap_or_default()
+        .as_millis()
+}
+
+/// Publish one raw CultNet schema message to a RUDP catalog.
+///
+/// Each call owns a fresh connection epoch and returns only after the catalog
+/// acknowledges reliable application admission.
+pub fn publish_cultnet_message_to_rudp_catalog(
+    message: &cultnet_rs::CultNetMessage,
+    options: CultMeshRudpDocumentPublishOptions,
+) -> Result<()> {
+    if options.runtime_id.trim().is_empty() {
+        anyhow::bail!("runtime_id must be non-empty");
+    }
+    let mut client = connect_rudp_client(
+        options.target,
+        &options.runtime_id,
+        options.connect_timeout,
+        options.poll_interval,
+        options.resend_delay_ms,
+        "cultmesh-rudp-document-publisher",
+    )?;
+
+    let payload = encode_cultnet_message_to_vec(message, CultNetWireContract::CultNetSchemaV0)?;
+    let receipt = client.send_reliable("schema", payload)?;
+    let flush_deadline = Instant::now() + options.flush_timeout;
+    while Instant::now() < flush_deadline {
+        let _ = client.receive_once()?;
+        match client.reliable_send_status(&receipt) {
+            cultnet_rs::CultNetRudpReliableSendStatus::Acknowledged => {
+                let _ = client.disconnect(b"document-acknowledged".to_vec());
+                return Ok(());
+            }
+            cultnet_rs::CultNetRudpReliableSendStatus::Invalidated => {
+                anyhow::bail!("CultMesh RUDP document receipt was invalidated")
+            }
+            cultnet_rs::CultNetRudpReliableSendStatus::Pending => {}
+        }
+        client.poll_resends()?;
+        thread::sleep(options.poll_interval);
+    }
+    let _ = client.disconnect(b"document-unacknowledged".to_vec());
+    anyhow::bail!(
+        "timed out waiting for reliable acknowledgement from CultMesh RUDP catalog {}",
+        options.target
+    )
+}
+
+/// Publish a batch of raw CultNet schema messages to a RUDP catalog.
+///
+/// Unlike [`publish_cultnet_message_to_rudp_catalog`], which polls for
+/// per-message application-level acknowledgement, this sends every message on
+/// one connection and waits only for a transport-level `flush_reliable`. It
+/// trades per-receipt confirmation for batch throughput; callers that need a
+/// stronger delivery guarantee should use the singular publish path instead.
+pub fn publish_cultnet_messages_to_rudp_catalog(
+    messages: &[cultnet_rs::CultNetMessage],
+    options: CultMeshRudpDocumentPublishOptions,
+) -> Result<()> {
+    if options.runtime_id.trim().is_empty() {
+        anyhow::bail!("runtime_id must be non-empty");
+    }
+    let mut client = connect_rudp_client(
+        options.target,
+        &options.runtime_id,
+        options.connect_timeout,
+        options.poll_interval,
+        options.resend_delay_ms,
+        "cultmesh-rudp-document-publisher",
+    )?;
+
+    for message in messages {
+        let payload = encode_cultnet_message_to_vec(message, CultNetWireContract::CultNetSchemaV0)?;
+        client.send("schema", payload)?;
+    }
+    client.flush_reliable(options.flush_timeout)
+}
+
+fn connect_rudp_client(
+    target: SocketAddr,
+    runtime_id: &str,
+    connect_timeout: Duration,
+    poll_interval: Duration,
+    resend_delay_ms: u64,
+    transport_id: &str,
+) -> Result<CultNetRudpSocketTransportConnection> {
+    let bind_addr = if target.is_ipv4() {
+        SocketAddr::from(([0, 0, 0, 0], 0))
+    } else {
+        SocketAddr::from(([0, 0, 0, 0, 0, 0, 0, 0], 0))
+    };
+    let socket = UdpSocket::bind(bind_addr)?;
+    socket.set_read_timeout(Some(poll_interval))?;
+    let mut client =
+        CultNetRudpSocketTransportConnection::new(CultNetRudpSocketTransportOptions {
+            media_delivery: None,
+            runtime_id: runtime_id.to_string(),
+            socket,
+            mode: cultnet_rs::CultNetRudpSocketMode::Client,
+            remote_addr: Some(target),
+            connection_id: fresh_rudp_connection_epoch(),
+            initial_sequence: 1,
+            resend_delay_ms,
+            transport_id: Some(transport_id.to_string()),
+            max_payload_bytes: None,
+            max_fragment_bytes: Some(1200),
+            max_pending_reliable_packets: Some(1024),
+            media_reliable_expire_after_ms: None,
+            reconnect_policy: None,
+        })?;
+    client.connect(Vec::new())?;
+    let connect_deadline = Instant::now() + connect_timeout;
+    while !client.connected() && Instant::now() < connect_deadline {
+        let _ = client.receive_once()?;
+        client.poll_resends()?;
+        thread::sleep(poll_interval);
+    }
+    if !client.connected() {
+        anyhow::bail!("timed out connecting CultMesh RUDP client {runtime_id} to {target}");
+    }
+    Ok(client)
+}
+
+fn fresh_rudp_connection_epoch() -> u32 {
+    let mut hasher = RandomState::new().build_hasher();
+    hasher.write_u128(unix_millis());
+    let epoch = hasher.finish() as u32;
+    if epoch == 0 { 1 } else { epoch }
+}
+
+#[derive(Clone, Copy, Debug, Default)]
+pub struct CultMesh;
+
+impl CultMesh {
+    pub fn resolve_rudp_endpoint(endpoint: &str) -> Result<SocketAddr> {
+        let text = require_non_empty(endpoint.trim().to_string(), "endpoint")?;
+        if text.starts_with("rudp://") {
+            return parse_rudp_socket_addr(&text);
+        }
+        if text.starts_with("cultmesh://") {
+            let resolved = default_cultmesh_rudp_endpoint_resolver(&text)?.ok_or_else(|| {
+                anyhow::anyhow!("CultMesh URI {text} did not resolve to a RUDP endpoint")
+            })?;
+            return parse_rudp_socket_addr(&resolved);
+        }
+        parse_socket_addr(&text)
+    }
+
+    pub fn create_node<D>(
+        store_path: impl AsRef<Path>,
+        documents: D,
+        options: CultMeshNodeOptions,
+    ) -> Result<CultMeshNode>
+    where
+        D: CultMeshDocumentSet,
+    {
+        let mut cache = CultCache::new();
+        documents.register_cache(&mut cache)?;
+        cache.add_generic_backing_store(SingleFileMessagePackBackingStore::new(store_path.as_ref()))?;
+        if options.pull_on_start {
+            cache.pull_all_backing_stores()?;
+        }
+
+        let mut registry = CultNetDocumentRegistry::new();
+        documents.register_documents(&mut registry)?;
+
+        Ok(CultMeshNode {
+            runtime_id: options.runtime_id,
+            cache,
+            documents: registry,
+        })
+    }
+
+    pub fn start_node<D>(
+        store_path: impl AsRef<Path>,
+        documents: D,
+        options: CultMeshNodeOptions,
+    ) -> Result<CultMeshNode>
+    where
+        D: CultMeshDocumentSet,
+    {
+        Self::create_node(store_path, documents, options)
+    }
+
+    pub fn create_stream_catalog() -> CultMeshStreamCatalog {
+        CultMeshStreamCatalog::default()
+    }
+}
+
+pub fn create_node<D>(
+    store_path: impl AsRef<Path>,
+    documents: D,
+    options: CultMeshNodeOptions,
+) -> Result<CultMeshNode>
+where
+    D: CultMeshDocumentSet,
+{
+    CultMesh::create_node(store_path, documents, options)
+}
+
+pub fn start_node<D>(
+    store_path: impl AsRef<Path>,
+    documents: D,
+    options: CultMeshNodeOptions,
+) -> Result<CultMeshNode>
+where
+    D: CultMeshDocumentSet,
+{
+    CultMesh::start_node(store_path, documents, options)
+}
+
+pub fn create_stream_catalog() -> CultMeshStreamCatalog {
+    CultMesh::create_stream_catalog()
+}
+
+pub fn resolve_rudp_endpoint(endpoint: &str) -> Result<SocketAddr> {
+    CultMesh::resolve_rudp_endpoint(endpoint)
+}
+
+fn parse_rudp_socket_addr(value: &str) -> Result<SocketAddr> {
+    let text = value.trim().strip_prefix("rudp://").unwrap_or(value.trim());
+    parse_socket_addr(text)
+}
+
+fn parse_socket_addr(value: &str) -> Result<SocketAddr> {
+    value
+        .parse()
+        .with_context(|| format!("RUDP endpoint must be a socket address, got {value:?}"))
+}
+
+fn default_cultmesh_rudp_endpoint_resolver(uri: &str) -> Result<Option<String>> {
+    let authority = cultmesh_uri_authority(uri)?;
+    let slug = authority
+        .chars()
+        .map(|ch| {
+            if ch.is_ascii_alphanumeric() {
+                ch.to_ascii_uppercase()
+            } else {
+                '_'
+            }
+        })
+        .collect::<String>()
+        .trim_matches('_')
+        .to_string();
+    if slug.is_empty() {
+        return Ok(None);
+    }
+
+    for key in [
+        format!("CULTMESH_URI_{slug}_RUDP"),
+        format!("{slug}_CULTMESH_RUDP_ENDPOINT"),
+    ] {
+        if let Ok(value) = env::var(&key) {
+            let text = value.trim();
+            if !text.is_empty() {
+                return Ok(Some(if text.starts_with("rudp://") {
+                    text.to_string()
+                } else {
+                    format!("rudp://{text}")
+                }));
+            }
+        }
+    }
+    Ok(None)
+}
+
+fn cultmesh_uri_authority(uri: &str) -> Result<String> {
+    let rest = uri
+        .strip_prefix("cultmesh://")
+        .ok_or_else(|| anyhow::anyhow!("CultMesh URI must start with cultmesh://"))?;
+    let authority = rest.split(['/', '?', '#']).next().unwrap_or("").trim();
+    if authority.is_empty() {
+        anyhow::bail!("CultMesh URI must include an authority");
+    }
+    Ok(authority.to_string())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use pretty_assertions::assert_eq;
+
+    #[derive(Clone, Debug, PartialEq, Eq, cultcache_rs::DatabaseEntry)]
+    #[cultcache(type = "cultmesh.test.note", schema = "CultMeshTestNote")]
+    struct Note {
+        #[cultcache(key = 0)]
+        body: String,
+    }
+
+    cultmesh_documents!(TestDocuments {
+        Note => "cultmesh.test.note.v0",
+    });
+
+    #[test]
+    fn node_round_trips_registered_documents() -> Result<()> {
+        let temp = tempfile::tempdir()?;
+        let store_path = temp.path().join("cultmesh.cc");
+        let note = Note {
+            body: "blessed circuit".to_string(),
+        };
+
+        let mut node = CultMesh::create_node(
+            &store_path,
+            TestDocuments,
+            CultMeshNodeOptions {
+                runtime_id: "test-runtime".to_string(),
+                ..CultMeshNodeOptions::default()
+            },
+        )?;
+        assert_eq!(node.runtime_id(), "test-runtime");
+        node.put("note", &note)?;
+        node.flush()?;
+
+        let reloaded = CultMesh::create_node(&store_path, TestDocuments, Default::default())?;
+        assert_eq!(reloaded.get_required::<Note>("note")?, note);
+        assert!(
+            reloaded
+                .documents()
+                .binding_by_schema_id("cultmesh.test.note.v0")
+                .is_some()
+        );
+        Ok(())
+    }
+
+    #[test]
+    fn node_publishes_registered_document_to_rudp_catalog() -> Result<()> {
+        let temp = tempfile::tempdir()?;
+        let store_path = temp.path().join("cultmesh.cc");
+        let note = Note {
+            body: "respect odin once".to_string(),
+        };
+        let node = CultMesh::create_node(
+            &store_path,
+            TestDocuments,
+            CultMeshNodeOptions {
+                runtime_id: "muninn-test".to_string(),
+                ..CultMeshNodeOptions::default()
+            },
+        )?;
+
+        let socket = UdpSocket::bind("127.0.0.1:0")?;
+        socket.set_read_timeout(Some(Duration::from_millis(10)))?;
+        let target = socket.local_addr()?;
+        let (sender, receiver) = std::sync::mpsc::channel();
+        let delivered = std::sync::Arc::new(std::sync::atomic::AtomicBool::new(false));
+        let delivered_by_sink = delivered.clone();
+        let server = thread::spawn(move || -> Result<()> {
+            let mut server = CultMeshRudpDocumentServer::new(
+                socket,
+                move |receipt: CultMeshRudpRawDocumentReceipt| {
+                    sender
+                        .send((
+                            receipt.document.schema_id,
+                            receipt.document.record_key,
+                            receipt.document.source_runtime_id,
+                        ))
+                        .ok();
+                    delivered_by_sink.store(true, std::sync::atomic::Ordering::SeqCst);
+                    Ok(())
+                },
+                |_query: &CultMeshRudpSnapshotQuery| Ok(Vec::new()),
+                CultMeshSystemClock::default(),
+                CultMeshRudpDocumentServerOptions::default(),
+            )?;
+            let deadline = Instant::now() + Duration::from_secs(2);
+            while Instant::now() < deadline {
+                server.poll_once()?;
+                if delivered.load(std::sync::atomic::Ordering::SeqCst) {
+                    return Ok(());
+                }
+                thread::sleep(Duration::from_millis(1));
+            }
+            anyhow::bail!("timed out waiting for RUDP document put")
+        });
+
+        node.publish_document_to_rudp_catalog(
+            "note",
+            &note,
+            CultMeshRudpDocumentPublishOptions::odin(target, "muninn-test"),
+        )?;
+        let received = receiver.recv_timeout(Duration::from_secs(2))?;
+        server.join().expect("server thread should not panic")?;
+
+        assert_eq!(received.0, "cultmesh.test.note.v0");
+        assert_eq!(received.1, "note");
+        assert_eq!(received.2.as_deref(), Some("muninn-test"));
+        Ok(())
+    }
+
+    #[test]
+    fn document_publish_fails_when_catalog_is_unreachable() -> Result<()> {
+        let temp = tempfile::tempdir()?;
+        let node = CultMesh::create_node(
+            temp.path().join("cultmesh.cc"),
+            TestDocuments,
+            Default::default(),
+        )?;
+        let unused = UdpSocket::bind("127.0.0.1:0")?;
+        let target = unused.local_addr()?;
+        drop(unused);
+
+        let error = node
+            .publish_document_to_rudp_catalog(
+                "note",
+                &Note {
+                    body: "no false success".into(),
+                },
+                CultMeshRudpDocumentPublishOptions {
+                    target,
+                    connect_timeout: Duration::from_millis(30),
+                    poll_interval: Duration::from_millis(2),
+                    ..CultMeshRudpDocumentPublishOptions::default()
+                },
+            )
+            .expect_err("unreachable catalog must fail closed");
+        assert!(error.to_string().contains("timed out connecting"));
+        Ok(())
+    }
+
+    #[test]
+    fn document_publish_requires_application_acknowledgement() -> Result<()> {
+        let temp = tempfile::tempdir()?;
+        let node = CultMesh::create_node(
+            temp.path().join("cultmesh.cc"),
+            TestDocuments,
+            Default::default(),
+        )?;
+        let socket = UdpSocket::bind("127.0.0.1:0")?;
+        let target = socket.local_addr()?;
+        let stop = std::sync::Arc::new(std::sync::atomic::AtomicBool::new(false));
+        let server_stop = stop.clone();
+        let server = thread::spawn(move || -> Result<()> {
+            let mut server = CultMeshRudpDocumentServer::new(
+                socket,
+                |_receipt: CultMeshRudpRawDocumentReceipt| {
+                    anyhow::bail!("injected durable sink failure")
+                },
+                |_query: &CultMeshRudpSnapshotQuery| Ok(Vec::new()),
+                CultMeshSystemClock::default(),
+                CultMeshRudpDocumentServerOptions::default(),
+            )?;
+            while !server_stop.load(std::sync::atomic::Ordering::SeqCst) {
+                let _ = server.poll_once();
+                thread::sleep(Duration::from_millis(1));
+            }
+            Ok(())
+        });
+
+        let error = node
+            .publish_document_to_rudp_catalog(
+                "note",
+                &Note {
+                    body: "still not accepted".into(),
+                },
+                CultMeshRudpDocumentPublishOptions {
+                    target,
+                    connect_timeout: Duration::from_millis(100),
+                    flush_timeout: Duration::from_millis(50),
+                    poll_interval: Duration::from_millis(2),
+                    resend_delay_ms: 5,
+                    ..CultMeshRudpDocumentPublishOptions::default()
+                },
+            )
+            .expect_err("unacknowledged document must fail closed");
+        stop.store(true, std::sync::atomic::Ordering::SeqCst);
+        server.join().expect("server thread should not panic")?;
+        assert!(error.to_string().contains("reliable acknowledgement"));
+        Ok(())
+    }
+
+    #[test]
+    fn raw_snapshot_preserves_caller_challenge_and_raw_response() -> Result<()> {
+        let expected = cultnet_rs::CultNetRawDocumentRecord {
+            schema_id: "cultmesh.test.raw.v0".into(),
+            record_key: "route-proof".into(),
+            stored_at: "2026-09-03T00:00:00Z".into(),
+            payload_encoding: cultnet_rs::CultNetRawPayloadEncoding::Messagepack,
+            payload: vec![0xc4, 0x03, 0, 0xff, 1],
+            source_runtime_id: Some("odin-test".into()),
+            source_agent_id: None,
+            source_role: None,
+            tags: None,
+        };
+        let socket = UdpSocket::bind("127.0.0.1:0")?;
+        let target = socket.local_addr()?;
+        let challenge = "9aa63ad8-83b5-4cc4-ae4a-91d361d5f845".to_string();
+        let server_document = expected.clone();
+        let server_challenge = challenge.clone();
+        let stop = std::sync::Arc::new(std::sync::atomic::AtomicBool::new(false));
+        let server_stop = stop.clone();
+        let server = thread::spawn(move || -> Result<()> {
+            let mut server = CultMeshRudpDocumentServer::new(
+                socket,
+                |_receipt: CultMeshRudpRawDocumentReceipt| Ok(()),
+                move |query: &CultMeshRudpSnapshotQuery| {
+                    if query.message_id != server_challenge {
+                        anyhow::bail!("snapshot challenge changed")
+                    }
+                    Ok(vec![server_document.clone()])
+                },
+                CultMeshSystemClock::default(),
+                CultMeshRudpDocumentServerOptions::default(),
+            )?;
+            while !server_stop.load(std::sync::atomic::Ordering::SeqCst) {
+                server.poll_once()?;
+                thread::sleep(Duration::from_millis(1));
+            }
+            Ok(())
+        });
+
+        let response = request_raw_snapshot_from_rudp_catalog(CultMeshRudpSnapshotOptions {
+            target,
+            runtime_id: "route-proof-test".into(),
+            message_id: challenge.clone(),
+            connect_timeout: Duration::from_millis(100),
+            response_timeout: Duration::from_millis(500),
+            poll_interval: Duration::from_millis(2),
+            resend_delay_ms: 5,
+            schema_ids: Some(vec!["cultmesh.test.raw.v0".into()]),
+            record_keys: Some(vec!["route-proof".into()]),
+        });
+        stop.store(true, std::sync::atomic::Ordering::SeqCst);
+        server.join().expect("server thread should not panic")?;
+        let response = response?;
+        assert_eq!(
+            response,
+            cultnet_rs::CultNetMessage::SnapshotResponseRaw {
+                message_id: challenge,
+                documents: vec![expected],
+            }
+        );
+        Ok(())
+    }
+
+    #[test]
+    fn raw_snapshot_rejects_response_without_request_acknowledgement() -> Result<()> {
+        let socket = UdpSocket::bind("127.0.0.1:0")?;
+        socket.set_read_timeout(Some(Duration::from_millis(200)))?;
+        let target = socket.local_addr()?;
+        let server = thread::spawn(move || -> Result<()> {
+            let mut wire = vec![0_u8; 65_535];
+            let (received, peer) = socket.recv_from(&mut wire)?;
+            let connect = cultnet_rs::decode_rudp_packet(&wire[..received])?;
+            let mut session =
+                cultnet_rs::CultNetRudpSession::new(cultnet_rs::CultNetRudpSessionOptions {
+                    connection_id: connect.connection_id,
+                    initial_sequence: 1,
+                    resend_delay_ms: 5,
+                    max_pending_reliable_packets: Some(64),
+                });
+            let accept = session.accept_connect(&connect, 1, Vec::new())?;
+            socket.send_to(&cultnet_rs::encode_rudp_packet(&accept)?, peer)?;
+
+            loop {
+                let (received, received_peer) = socket.recv_from(&mut wire)?;
+                if received_peer != peer {
+                    continue;
+                }
+                let packet = cultnet_rs::decode_rudp_packet(&wire[..received])?;
+                let result = session.receive(&packet, 2)?;
+                let Some(frame) = result.delivered.into_iter().next() else {
+                    continue;
+                };
+                let request = decode_cultnet_message_from_slice(
+                    &frame.payload,
+                    CultNetWireContract::CultNetSchemaV0,
+                )?;
+                let cultnet_rs::CultNetMessage::SnapshotRequest { message_id, .. } = request else {
+                    anyhow::bail!("expected snapshot request")
+                };
+                let payload = encode_cultnet_message_to_vec(
+                    &cultnet_rs::CultNetMessage::SnapshotResponseRaw {
+                        message_id,
+                        documents: Vec::new(),
+                    },
+                    CultNetWireContract::CultNetSchemaV0,
+                )?;
+                let mut packets = session.send_many(
+                    "schema",
+                    payload,
+                    cultnet_rs::CultNetRudpSendOptions {
+                        reliable: true,
+                        ordered: true,
+                        sequenced: false,
+                        now_ms: 2,
+                        reliable_expire_after_ms: None,
+                    },
+                    Some(1200),
+                )?;
+                for packet in &mut packets {
+                    packet.ack = 0;
+                    packet.ack_mask = 0;
+                    socket.send_to(&cultnet_rs::encode_rudp_packet(packet)?, peer)?;
+                }
+                return Ok(());
+            }
+        });
+
+        let error = request_raw_snapshot_from_rudp_catalog(CultMeshRudpSnapshotOptions {
+            target,
+            runtime_id: "unacknowledged-snapshot-test".into(),
+            message_id: "b7987efb-69c5-4c42-9355-b6e09535ad21".into(),
+            connect_timeout: Duration::from_millis(100),
+            response_timeout: Duration::from_millis(50),
+            poll_interval: Duration::from_millis(2),
+            resend_delay_ms: 5,
+            schema_ids: None,
+            record_keys: None,
+        })
+        .expect_err("response without request ACK must fail closed");
+        server.join().expect("server thread should not panic")?;
+        assert!(error.to_string().contains("reliable acknowledgement"));
+        Ok(())
+    }
+
+    #[test]
+    fn resolves_rudp_endpoint_from_cultmesh_uri_bootstrap_env() -> Result<()> {
+        let previous = env::var("CULTMESH_URI_ODIN_RUDP").ok();
+        unsafe {
+            env::set_var("CULTMESH_URI_ODIN_RUDP", "127.0.0.1:17871");
+        }
+        let result = CultMesh::resolve_rudp_endpoint("cultmesh://odin/rendezvous/provider-catalog");
+        unsafe {
+            if let Some(value) = previous {
+                env::set_var("CULTMESH_URI_ODIN_RUDP", value);
+            } else {
+                env::remove_var("CULTMESH_URI_ODIN_RUDP");
+            }
+        }
+
+        assert_eq!(result?, "127.0.0.1:17871".parse()?);
+        Ok(())
+    }
+
+    #[test]
+    fn rejects_unresolved_cultmesh_rudp_endpoint() {
+        let previous = env::var("CULTMESH_URI_MISSING_ODIN_RUDP").ok();
+        unsafe {
+            env::remove_var("CULTMESH_URI_MISSING_ODIN_RUDP");
+        }
+        let error =
+            CultMesh::resolve_rudp_endpoint("cultmesh://missing-odin/rendezvous/provider-catalog")
+                .expect_err("unresolved CultMesh URI should fail");
+        unsafe {
+            if let Some(value) = previous {
+                env::set_var("CULTMESH_URI_MISSING_ODIN_RUDP", value);
+            }
+        }
+        assert!(error.to_string().contains("did not resolve"));
+    }
+
+    #[test]
+    fn raw_snapshot_application_uses_registered_document_type() -> Result<()> {
+        let temp = tempfile::tempdir()?;
+        let store_path = temp.path().join("cultmesh.cc");
+        let mut node = CultMesh::create_node(
+            &store_path,
+            TestDocuments,
+            CultMeshNodeOptions {
+                runtime_id: "snapshot-apply-test".to_string(),
+                ..CultMeshNodeOptions::default()
+            },
+        )?;
+        let payload = rmp_serde::to_vec(&Note {
+            body: "catalog truth".to_string(),
+        })?;
+
+        node.cache
+            .put_raw_envelope(cultcache_rs::CultCacheEnvelope {
+                key: "note".to_string(),
+                r#type: node
+                    .documents
+                    .binding_by_schema_id("cultmesh.test.note.v0")
+                    .expect("test binding")
+                    .document_type
+                    .clone(),
+                payload,
+                stored_at: "2026-07-03T00:00:00Z".to_string(),
+                schema_id: Some("cultmesh.test.note.v0".to_string()),
+            })?;
+        node.flush()?;
+
+        let reloaded = CultMesh::create_node(&store_path, TestDocuments, Default::default())?;
+        assert_eq!(reloaded.get_required::<Note>("note")?.body, "catalog truth");
+        assert_eq!(reloaded.cache().snapshot()[0].r#type, Note::TYPE);
+        Ok(())
+    }
+
+    #[test]
+    fn stream_catalog_negotiates_and_publishes_latest_shared_memory_frame() -> Result<()> {
+        let mut catalog = CultMesh::create_stream_catalog();
+        let stream = CultMeshStreamDescriptor::new(
+            "muninn:nightwing:move-evidence",
+            "mimir-live",
+            "muninn:nightwing",
+            CultMeshStreamKind::Bytes,
+            CultMeshStreamClock::new("muninn:nightwing:clock")?
+                .source_id("muninn:nightwing:move-evidence")?
+                .confidence(1.0)
+                .evidence_kind("muninn-move-evidence")?,
+            vec![
+                CultMeshStreamBodyTransport::SharedMemory,
+                CultMeshStreamBodyTransport::CultCachePage,
+            ],
+        )?
+        .label("Muninn Move evidence")?
+        .max_in_flight_frames(4)
+        .metadata_schema_id("mimir.muninn_move_evidence_stream_frame.v1")?;
+        catalog.declare(stream);
+
+        let consumer = CultMeshStreamConsumerProfile::new(
+            "mimir:starfire",
+            "mimir-live",
+            vec![CultMeshStreamBodyTransport::SharedMemory],
+        )?;
+        let negotiation = catalog.negotiate("muninn:nightwing:move-evidence", &consumer)?;
+
+        assert_eq!(
+            negotiation.transport,
+            CultMeshStreamBodyTransport::SharedMemory
+        );
+        assert_eq!(
+            negotiation.copy_budget,
+            CultMeshStreamCopyBudget::ZeroCopyTarget
+        );
+
+        let handle = {
+            let ring =
+                catalog.create_shared_memory_ring("muninn:nightwing:move-evidence", 4, 128)?;
+            ring.try_publish_copy(&[1, 2, 3], 42, 0)?
+                .expect("frame should publish")
+        };
+        catalog.publish_frame(handle.clone())?;
+
+        assert_eq!(
+            catalog.latest_frame("muninn:nightwing:move-evidence"),
+            Some(&handle)
+        );
+        let lease = catalog
+            .ring("muninn:nightwing:move-evidence")
+            .and_then(CultMeshSharedMemoryFrameRing::try_acquire_latest_read)
+            .expect("latest frame should be readable");
+        assert_eq!(lease.handle.sequence, 0);
+        assert_eq!(lease.bytes(), &[1, 2, 3]);
+        Ok(())
+    }
+}
diff --git a/packages/cultmesh-rs/src/rudp_document_server.rs b/packages/cultmesh-rs/src/rudp_document_server.rs
new file mode 100644
index 00000000..bebeb6c3
--- /dev/null
+++ b/packages/cultmesh-rs/src/rudp_document_server.rs
@@ -0,0 +1,647 @@
+use anyhow::{Result, anyhow};
+use cultnet_rs::{
+    CultNetMessage, CultNetRawDocumentRecord, CultNetRudpPacket, CultNetRudpPacketType,
+    CultNetRudpSendOptions, CultNetRudpSession, CultNetRudpSessionOptions, CultNetWireContract,
+    decode_cultnet_message_from_slice, decode_rudp_packet, encode_cultnet_message_to_vec,
+    encode_rudp_packet,
+};
+use std::collections::BTreeMap;
+use std::io::ErrorKind;
+use std::net::{SocketAddr, UdpSocket};
+use std::time::{Duration, Instant, SystemTime, UNIX_EPOCH};
+
+const MAX_UDP_DATAGRAM_BYTES: usize = 65_535;
+
+/// The transport identity of one remote CultNet RUDP session.
+///
+/// Connection identifiers are scoped to a remote socket address. Two clients
+/// may therefore use the same connection identifier without sharing ordering,
+/// acknowledgement, resend, or fragment state.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, PartialOrd, Ord)]
+pub struct CultMeshRudpSessionKey {
+    pub remote_addr: SocketAddr,
+    pub connection_id: u32,
+}
+
+/// A raw document plus the receipt fact owned by the receiving process.
+///
+/// `document.payload` is the exact byte vector decoded from the CultNet raw
+/// record. The trusted receipt time lives beside the sender-owned record so the
+/// transport never rewrites its metadata or payload.
+#[derive(Clone, Debug, PartialEq)]
+pub struct CultMeshRudpRawDocumentReceipt {
+    pub session: CultMeshRudpSessionKey,
+    pub message_id: String,
+    pub transport_sequence: u32,
+    pub received_at_unix_millis: u64,
+    pub document: CultNetRawDocumentRecord,
+}
+
+/// The caller-visible query for a read-only raw snapshot.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct CultMeshRudpSnapshotQuery {
+    pub session: CultMeshRudpSessionKey,
+    pub message_id: String,
+    pub requested_at_unix_millis: u64,
+    pub schema_ids: Option<Vec<String>>,
+    pub record_keys: Option<Vec<String>>,
+}
+
+/// Caller-owned admission/persistence port for received raw documents.
+pub trait CultMeshRudpRawDocumentSink {
+    fn accept_raw_document(&mut self, receipt: CultMeshRudpRawDocumentReceipt) -> Result<()>;
+}
+
+impl<F> CultMeshRudpRawDocumentSink for F
+where
+    F: FnMut(CultMeshRudpRawDocumentReceipt) -> Result<()>,
+{
+    fn accept_raw_document(&mut self, receipt: CultMeshRudpRawDocumentReceipt) -> Result<()> {
+        self(receipt)
+    }
+}
+
+/// Caller-owned catalog port for serving raw snapshot requests.
+///
+/// The caller decides which records the requester may see. CultMesh preserves
+/// those records as raw CultNet documents and does not interpret their schemas.
+pub trait CultMeshRudpSnapshotSource {
+    fn raw_snapshot(
+        &mut self,
+        query: &CultMeshRudpSnapshotQuery,
+    ) -> Result<Vec<CultNetRawDocumentRecord>>;
+}
+
+impl<F> CultMeshRudpSnapshotSource for F
+where
+    F: FnMut(&CultMeshRudpSnapshotQuery) -> Result<Vec<CultNetRawDocumentRecord>>,
+{
+    fn raw_snapshot(
+        &mut self,
+        query: &CultMeshRudpSnapshotQuery,
+    ) -> Result<Vec<CultNetRawDocumentRecord>> {
+        self(query)
+    }
+}
+
+/// Trusted local clocks for receipt facts and transport maintenance.
+///
+/// Receipt time is wall time. Expiry and resend decisions use the monotonic
+/// value, so a wall-clock correction cannot resurrect or pin a session.
+pub trait CultMeshRudpServerClock {
+    fn now_unix_millis(&self) -> u64;
+    fn now_monotonic_millis(&self) -> u64;
+}
+
+#[derive(Clone, Debug)]
+pub struct CultMeshSystemClock {
+    monotonic_origin: Instant,
+}
+
+impl Default for CultMeshSystemClock {
+    fn default() -> Self {
+        Self {
+            monotonic_origin: Instant::now(),
+        }
+    }
+}
+
+impl CultMeshRudpServerClock for CultMeshSystemClock {
+    fn now_unix_millis(&self) -> u64 {
+        SystemTime::now()
+            .duration_since(UNIX_EPOCH)
+            .unwrap_or_default()
+            .as_millis()
+            .try_into()
+            .unwrap_or(u64::MAX)
+    }
+
+    fn now_monotonic_millis(&self) -> u64 {
+        self.monotonic_origin
+            .elapsed()
+            .as_millis()
+            .try_into()
+            .unwrap_or(u64::MAX)
+    }
+}
+
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct CultMeshRudpDocumentServerOptions {
+    pub max_sessions: usize,
+    pub session_idle_timeout: Duration,
+    pub session_max_lifetime: Duration,
+    /// Conservative payload admission budget across all live sessions.
+    ///
+    /// Admitted ingress and queued snapshot-response bytes are charged until
+    /// the session ends even when CultNet releases them sooner. Together with
+    /// CultNet's per-session receive caps, this makes retained payload memory
+    /// finite without duplicating its fragment/ordering machinery here.
+    pub max_admitted_payload_bytes: usize,
+    pub max_admitted_payload_bytes_per_session: usize,
+    pub max_snapshot_response_bytes: usize,
+    pub max_snapshot_documents: usize,
+    pub resend_delay: Duration,
+    pub max_pending_reliable_packets_per_session: usize,
+    pub max_fragment_bytes: usize,
+}
+
+impl Default for CultMeshRudpDocumentServerOptions {
+    fn default() -> Self {
+        Self {
+            max_sessions: 64,
+            session_idle_timeout: Duration::from_secs(30),
+            session_max_lifetime: Duration::from_secs(15 * 60),
+            max_admitted_payload_bytes: 32 * 1024 * 1024,
+            max_admitted_payload_bytes_per_session: 4 * 1024 * 1024,
+            max_snapshot_response_bytes: 1024 * 1024,
+            max_snapshot_documents: 4096,
+            resend_delay: Duration::from_millis(50),
+            max_pending_reliable_packets_per_session: 1024,
+            max_fragment_bytes: 1200,
+        }
+    }
+}
+
+#[derive(Clone, Debug, Default, PartialEq, Eq)]
+pub struct CultMeshRudpMaintenance {
+    pub sessions_expired: usize,
+    pub packets_resent: usize,
+}
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum CultMeshRudpApplicationOperation {
+    DocumentPutRaw,
+    SnapshotRequest,
+}
+
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct CultMeshRudpApplicationRejection {
+    pub session: CultMeshRudpSessionKey,
+    pub operation: CultMeshRudpApplicationOperation,
+    pub message_id: String,
+    pub reason: String,
+}
+
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub enum CultMeshRudpPollOutcome {
+    Idle,
+    Handled,
+    ApplicationRejected(CultMeshRudpApplicationRejection),
+}
+
+struct SessionEntry {
+    session: CultNetRudpSession,
+    created_at_monotonic_millis: u64,
+    last_activity_monotonic_millis: u64,
+    admitted_payload_bytes: usize,
+}
+
+/// A synchronous, multi-session CultNet RUDP raw-document server.
+///
+/// The server owns exactly one UDP socket. Call `poll_once` from an existing
+/// daemon loop; no executor or background thread is created here.
+pub struct CultMeshRudpDocumentServer<S, Q, C> {
+    socket: UdpSocket,
+    sessions: BTreeMap<CultMeshRudpSessionKey, SessionEntry>,
+    sink: S,
+    snapshot_source: Q,
+    clock: C,
+    options: CultMeshRudpDocumentServerOptions,
+}
+
+impl<S, Q, C> CultMeshRudpDocumentServer<S, Q, C>
+where
+    S: CultMeshRudpRawDocumentSink,
+    Q: CultMeshRudpSnapshotSource,
+    C: CultMeshRudpServerClock,
+{
+    pub fn new(
+        socket: UdpSocket,
+        sink: S,
+        snapshot_source: Q,
+        clock: C,
+        options: CultMeshRudpDocumentServerOptions,
+    ) -> Result<Self> {
+        validate_options(&options)?;
+        socket.local_addr().map_err(|error| {
+            anyhow!("CultMesh RUDP server requires a bound UDP socket: {error}")
+        })?;
+        socket.set_nonblocking(true)?;
+        Ok(Self {
+            socket,
+            sessions: BTreeMap::new(),
+            sink,
+            snapshot_source,
+            clock,
+            options,
+        })
+    }
+
+    pub fn local_addr(&self) -> Result<SocketAddr> {
+        Ok(self.socket.local_addr()?)
+    }
+
+    pub fn session_count(&self) -> usize {
+        self.sessions.len()
+    }
+
+    /// Poll transport maintenance and receive at most one UDP datagram.
+    ///
+    /// Application rejection invalidates only the responsible peer session and
+    /// is returned as data so a daemon can log it and keep serving. Local
+    /// socket and server-state failures remain errors.
+    pub fn poll_once(&mut self) -> Result<CultMeshRudpPollOutcome> {
+        self.maintain()?;
+        let mut wire = vec![0_u8; MAX_UDP_DATAGRAM_BYTES];
+        let (received, remote_addr) = match self.socket.recv_from(&mut wire) {
+            Ok(value) => value,
+            Err(error) if error.kind() == ErrorKind::WouldBlock => {
+                return Ok(CultMeshRudpPollOutcome::Idle);
+            }
+            Err(error) => return Err(error.into()),
+        };
+        wire.truncate(received);
+
+        let packet = match decode_rudp_packet(&wire) {
+            Ok(packet) => packet,
+            Err(_) => return Ok(CultMeshRudpPollOutcome::Handled),
+        };
+        let now_unix = self.clock.now_unix_millis();
+        let now_monotonic = self.clock.now_monotonic_millis();
+        let key = CultMeshRudpSessionKey {
+            remote_addr,
+            connection_id: packet.connection_id,
+        };
+
+        if packet.packet_type == CultNetRudpPacketType::Connect {
+            self.accept_connection(key, &packet, now_monotonic)?;
+            return Ok(CultMeshRudpPollOutcome::Handled);
+        }
+
+        if !self.sessions.contains_key(&key) {
+            return Ok(CultMeshRudpPollOutcome::Handled);
+        }
+        if packet.packet_type == CultNetRudpPacketType::Data
+            && packet.channel_id == "schema"
+            && !packet.reliable
+        {
+            return Ok(CultMeshRudpPollOutcome::Handled);
+        }
+        let payload_charge = if packet.packet_type == CultNetRudpPacketType::Data {
+            packet.payload.len()
+        } else {
+            0
+        };
+        if !self.payload_budget_allows(key, payload_charge) {
+            return Ok(CultMeshRudpPollOutcome::Handled);
+        }
+
+        let result = {
+            let entry = self
+                .sessions
+                .get_mut(&key)
+                .expect("checked session must remain present");
+            entry.last_activity_monotonic_millis = now_monotonic;
+            entry.admitted_payload_bytes =
+                entry.admitted_payload_bytes.saturating_add(payload_charge);
+            entry.session.receive(&packet, now_monotonic)
+        };
+        let result = match result {
+            Ok(result) => result,
+            Err(_) => {
+                self.sessions.remove(&key);
+                return Ok(CultMeshRudpPollOutcome::Handled);
+            }
+        };
+
+        if let Some(reply) = result.reply {
+            self.send_packet(key.remote_addr, &reply)?;
+        }
+
+        if result.disconnected {
+            self.sessions.remove(&key);
+            return Ok(CultMeshRudpPollOutcome::Handled);
+        }
+
+        for frame in result.delivered {
+            if frame.channel_id != "schema" {
+                continue;
+            }
+            let message = match decode_cultnet_message_from_slice(
+                &frame.payload,
+                CultNetWireContract::CultNetSchemaV0,
+            ) {
+                Ok(message) => message,
+                Err(_) => continue,
+            };
+            if let Some(rejection) = self.deliver_application_message(
+                key,
+                frame.sequence,
+                message,
+                now_unix,
+                now_monotonic,
+            )? {
+                self.sessions.remove(&key);
+                return Ok(CultMeshRudpPollOutcome::ApplicationRejected(rejection));
+            }
+        }
+
+        if packet.reliable {
+            let ack = self
+                .sessions
+                .get_mut(&key)
+                .ok_or_else(|| anyhow!("CultMesh RUDP session disappeared before ACK"))?
+                .session
+                .create_ack();
+            self.send_packet(key.remote_addr, &ack)?;
+        }
+        Ok(CultMeshRudpPollOutcome::Handled)
+    }
+
+    /// Expire idle sessions and resend reliable packets whose deadline passed.
+    pub fn maintain(&mut self) -> Result<CultMeshRudpMaintenance> {
+        let now = self.clock.now_monotonic_millis();
+        let idle_timeout_ms = duration_millis(self.options.session_idle_timeout);
+        let lifetime_ms = duration_millis(self.options.session_max_lifetime);
+        let before = self.sessions.len();
+        self.sessions.retain(|_, entry| {
+            now.saturating_sub(entry.last_activity_monotonic_millis) <= idle_timeout_ms
+                && now.saturating_sub(entry.created_at_monotonic_millis) <= lifetime_ms
+        });
+        let expired = before - self.sessions.len();
+
+        let mut resends = Vec::new();
+        for (key, entry) in &mut self.sessions {
+            for packet in entry.session.due_resends(now) {
+                resends.push((key.remote_addr, packet));
+            }
+        }
+        for (remote_addr, packet) in &resends {
+            self.send_packet(*remote_addr, packet)?;
+        }
+        Ok(CultMeshRudpMaintenance {
+            sessions_expired: expired,
+            packets_resent: resends.len(),
+        })
+    }
+
+    fn accept_connection(
+        &mut self,
+        key: CultMeshRudpSessionKey,
+        packet: &CultNetRudpPacket,
+        now: u64,
+    ) -> Result<()> {
+        if !self.sessions.contains_key(&key) {
+            if self.sessions.len() >= self.options.max_sessions {
+                return Ok(());
+            }
+            self.sessions.insert(
+                key,
+                SessionEntry {
+                    session: CultNetRudpSession::new(CultNetRudpSessionOptions {
+                        connection_id: key.connection_id,
+                        initial_sequence: 1,
+                        resend_delay_ms: duration_millis(self.options.resend_delay),
+                        max_pending_reliable_packets: Some(
+                            self.options.max_pending_reliable_packets_per_session,
+                        ),
+                    }),
+                    created_at_monotonic_millis: now,
+                    last_activity_monotonic_millis: now,
+                    admitted_payload_bytes: 0,
+                },
+            );
+        }
+
+        let accept = {
+            let entry = self
+                .sessions
+                .get_mut(&key)
+                .expect("accepted session must be present");
+            // The same key is a retransmitted Connect for the existing epoch.
+            // A genuinely fresh client incarnation must choose a fresh id.
+            entry.last_activity_monotonic_millis = now;
+            entry.session.accept_connect(packet, now, Vec::new())?
+        };
+        self.send_packet(key.remote_addr, &accept)
+    }
+
+    fn deliver_application_message(
+        &mut self,
+        key: CultMeshRudpSessionKey,
+        transport_sequence: u32,
+        message: CultNetMessage,
+        now_unix: u64,
+        now: u64,
+    ) -> Result<Option<CultMeshRudpApplicationRejection>> {
+        match message {
+            CultNetMessage::DocumentPutRaw {
+                message_id,
+                document,
+            } => {
+                let receipt = CultMeshRudpRawDocumentReceipt {
+                    session: key,
+                    message_id: message_id.clone(),
+                    transport_sequence,
+                    received_at_unix_millis: now_unix,
+                    document,
+                };
+                if let Err(error) = self.sink.accept_raw_document(receipt) {
+                    return Ok(Some(CultMeshRudpApplicationRejection {
+                        session: key,
+                        operation: CultMeshRudpApplicationOperation::DocumentPutRaw,
+                        message_id,
+                        reason: format!("{error:#}"),
+                    }));
+                }
+            }
+            CultNetMessage::SnapshotRequest {
+                message_id,
+                schema_ids,
+                record_keys,
+            } => {
+                let query = CultMeshRudpSnapshotQuery {
+                    session: key,
+                    message_id: message_id.clone(),
+                    requested_at_unix_millis: now_unix,
+                    schema_ids,
+                    record_keys,
+                };
+                let documents = match self.snapshot_source.raw_snapshot(&query) {
+                    Ok(documents) => documents,
+                    Err(error) => {
+                        return Ok(Some(CultMeshRudpApplicationRejection {
+                            session: key,
+                            operation: CultMeshRudpApplicationOperation::SnapshotRequest,
+                            message_id,
+                            reason: format!("{error:#}"),
+                        }));
+                    }
+                };
+                if documents.len() > self.options.max_snapshot_documents {
+                    return Ok(Some(CultMeshRudpApplicationRejection {
+                        session: key,
+                        operation: CultMeshRudpApplicationOperation::SnapshotRequest,
+                        message_id,
+                        reason: format!(
+                            "snapshot returned {} documents; limit is {}",
+                            documents.len(),
+                            self.options.max_snapshot_documents
+                        ),
+                    }));
+                }
+                let response = CultNetMessage::SnapshotResponseRaw {
+                    message_id: message_id.clone(),
+                    documents,
+                };
+                let payload = match encode_cultnet_message_to_vec(
+                    &response,
+                    CultNetWireContract::CultNetSchemaV0,
+                ) {
+                    Ok(payload) => payload,
+                    Err(error) => {
+                        return Ok(Some(CultMeshRudpApplicationRejection {
+                            session: key,
+                            operation: CultMeshRudpApplicationOperation::SnapshotRequest,
+                            message_id,
+                            reason: format!("snapshot response could not be encoded: {error:#}"),
+                        }));
+                    }
+                };
+                if payload.len() > self.options.max_snapshot_response_bytes {
+                    return Ok(Some(CultMeshRudpApplicationRejection {
+                        session: key,
+                        operation: CultMeshRudpApplicationOperation::SnapshotRequest,
+                        message_id,
+                        reason: format!(
+                            "snapshot response is {} bytes; limit is {}",
+                            payload.len(),
+                            self.options.max_snapshot_response_bytes
+                        ),
+                    }));
+                }
+                if !self.payload_budget_allows(key, payload.len()) {
+                    return Ok(Some(CultMeshRudpApplicationRejection {
+                        session: key,
+                        operation: CultMeshRudpApplicationOperation::SnapshotRequest,
+                        message_id,
+                        reason: "retained payload budget is full".into(),
+                    }));
+                }
+                let payload_bytes = payload.len();
+                let entry = self
+                    .sessions
+                    .get_mut(&key)
+                    .ok_or_else(|| anyhow!("CultMesh RUDP session disappeared before response"))?;
+                let packets = match entry.session.send_many(
+                    "schema",
+                    payload,
+                    CultNetRudpSendOptions {
+                        reliable: true,
+                        ordered: true,
+                        sequenced: false,
+                        now_ms: now,
+                        reliable_expire_after_ms: None,
+                    },
+                    Some(self.options.max_fragment_bytes),
+                ) {
+                    Ok(packets) => packets,
+                    Err(error) => {
+                        return Ok(Some(CultMeshRudpApplicationRejection {
+                            session: key,
+                            operation: CultMeshRudpApplicationOperation::SnapshotRequest,
+                            message_id,
+                            reason: format!("snapshot response could not be queued: {error:#}"),
+                        }));
+                    }
+                };
+                entry.admitted_payload_bytes =
+                    entry.admitted_payload_bytes.saturating_add(payload_bytes);
+                for packet in &packets {
+                    self.send_packet(key.remote_addr, packet)?;
+                }
+            }
+            _ => {}
+        }
+        Ok(None)
+    }
+
+    fn payload_budget_allows(&self, key: CultMeshRudpSessionKey, bytes: usize) -> bool {
+        let Some(session_bytes) = self
+            .sessions
+            .get(&key)
+            .map(|entry| entry.admitted_payload_bytes)
+        else {
+            return false;
+        };
+        if session_bytes
+            .checked_add(bytes)
+            .is_none_or(|total| total > self.options.max_admitted_payload_bytes_per_session)
+        {
+            return false;
+        }
+        self.sessions
+            .values()
+            .try_fold(0_usize, |total, entry| {
+                total.checked_add(entry.admitted_payload_bytes)
+            })
+            .and_then(|total| total.checked_add(bytes))
+            .is_some_and(|total| total <= self.options.max_admitted_payload_bytes)
+    }
+
+    fn send_packet(&mut self, remote_addr: SocketAddr, packet: &CultNetRudpPacket) -> Result<()> {
+        let wire = encode_rudp_packet(packet)?;
+        self.socket.send_to(&wire, remote_addr)?;
+        Ok(())
+    }
+}
+
+fn validate_options(options: &CultMeshRudpDocumentServerOptions) -> Result<()> {
+    if options.max_sessions == 0 {
+        return Err(anyhow!("max_sessions must be greater than zero"));
+    }
+    if options.session_idle_timeout.is_zero() {
+        return Err(anyhow!("session_idle_timeout must be greater than zero"));
+    }
+    if options.session_max_lifetime.is_zero() {
+        return Err(anyhow!("session_max_lifetime must be greater than zero"));
+    }
+    if options.max_admitted_payload_bytes == 0 {
+        return Err(anyhow!(
+            "max_admitted_payload_bytes must be greater than zero"
+        ));
+    }
+    if options.max_admitted_payload_bytes_per_session == 0
+        || options.max_admitted_payload_bytes_per_session > options.max_admitted_payload_bytes
+    {
+        return Err(anyhow!(
+            "per-session admitted payload limit must be non-zero and no larger than the server limit"
+        ));
+    }
+    if options.max_snapshot_response_bytes == 0
+        || options.max_snapshot_response_bytes > options.max_admitted_payload_bytes_per_session
+    {
+        return Err(anyhow!(
+            "snapshot response limit must be non-zero and fit in one session's payload budget"
+        ));
+    }
+    if options.max_snapshot_documents == 0 {
+        return Err(anyhow!("max_snapshot_documents must be greater than zero"));
+    }
+    if options.resend_delay.is_zero() {
+        return Err(anyhow!("resend_delay must be greater than zero"));
+    }
+    if options.max_pending_reliable_packets_per_session == 0 {
+        return Err(anyhow!(
+            "max_pending_reliable_packets_per_session must be greater than zero"
+        ));
+    }
+    if options.max_fragment_bytes == 0 {
+        return Err(anyhow!("max_fragment_bytes must be greater than zero"));
+    }
+    Ok(())
+}
+
+fn duration_millis(duration: Duration) -> u64 {
+    duration.as_millis().try_into().unwrap_or(u64::MAX)
+}
diff --git a/packages/cultmesh-rs/tests/rudp_document_server.rs b/packages/cultmesh-rs/tests/rudp_document_server.rs
new file mode 100644
index 00000000..df14b4ea
--- /dev/null
+++ b/packages/cultmesh-rs/tests/rudp_document_server.rs
@@ -0,0 +1,555 @@
+use anyhow::Result;
+use cultmesh_rs::{
+    CultMeshRudpApplicationOperation, CultMeshRudpDocumentServer,
+    CultMeshRudpDocumentServerOptions, CultMeshRudpPollOutcome, CultMeshRudpRawDocumentReceipt,
+    CultMeshRudpRawDocumentSink, CultMeshRudpServerClock, CultMeshRudpSnapshotQuery,
+    CultMeshRudpSnapshotSource,
+};
+use cultnet_rs::{
+    CultNetMessage, CultNetRawDocumentRecord, CultNetRawPayloadEncoding,
+    CultNetRudpReliableSendReceipt, CultNetRudpReliableSendStatus, CultNetRudpSocketMode,
+    CultNetRudpSocketTransportConnection, CultNetRudpSocketTransportOptions, CultNetWireContract,
+    decode_cultnet_message_from_slice, encode_cultnet_message_to_vec,
+};
+use pretty_assertions::assert_eq;
+use std::net::{SocketAddr, UdpSocket};
+use std::sync::atomic::{AtomicU64, Ordering};
+use std::sync::{Arc, Mutex};
+use std::thread;
+use std::time::Duration;
+
+#[derive(Default)]
+struct SinkState {
+    receipts: Vec<CultMeshRudpRawDocumentReceipt>,
+    failures_remaining: usize,
+}
+
+#[derive(Clone, Default)]
+struct Sink(Arc<Mutex<SinkState>>);
+
+impl Sink {
+    fn fail_once() -> Self {
+        Self(Arc::new(Mutex::new(SinkState {
+            failures_remaining: 1,
+            ..Default::default()
+        })))
+    }
+}
+
+impl CultMeshRudpRawDocumentSink for Sink {
+    fn accept_raw_document(&mut self, receipt: CultMeshRudpRawDocumentReceipt) -> Result<()> {
+        let mut state = self.0.lock().unwrap();
+        if state.failures_remaining > 0 {
+            state.failures_remaining -= 1;
+            anyhow::bail!("injected sink failure");
+        }
+        state.receipts.push(receipt);
+        Ok(())
+    }
+}
+
+#[derive(Default)]
+struct SourceState {
+    documents: Vec<CultNetRawDocumentRecord>,
+    failures_remaining: usize,
+    calls: usize,
+}
+
+#[derive(Clone, Default)]
+struct Source(Arc<Mutex<SourceState>>);
+
+impl Source {
+    fn documents(documents: Vec<CultNetRawDocumentRecord>) -> Self {
+        Self(Arc::new(Mutex::new(SourceState {
+            documents,
+            ..Default::default()
+        })))
+    }
+
+    fn fail_once(documents: Vec<CultNetRawDocumentRecord>) -> Self {
+        Self(Arc::new(Mutex::new(SourceState {
+            documents,
+            failures_remaining: 1,
+            calls: 0,
+        })))
+    }
+}
+
+impl CultMeshRudpSnapshotSource for Source {
+    fn raw_snapshot(
+        &mut self,
+        _: &CultMeshRudpSnapshotQuery,
+    ) -> Result<Vec<CultNetRawDocumentRecord>> {
+        let mut state = self.0.lock().unwrap();
+        state.calls += 1;
+        if state.failures_remaining > 0 {
+            state.failures_remaining -= 1;
+            anyhow::bail!("injected source failure");
+        }
+        Ok(state.documents.clone())
+    }
+}
+
+#[derive(Clone)]
+struct Clock {
+    unix: Arc<AtomicU64>,
+    monotonic: Arc<AtomicU64>,
+}
+
+impl Clock {
+    fn new(now: u64) -> Self {
+        Self {
+            unix: Arc::new(AtomicU64::new(now)),
+            monotonic: Arc::new(AtomicU64::new(now)),
+        }
+    }
+
+    fn set(&self, now: u64) {
+        self.unix.store(now, Ordering::SeqCst);
+        self.monotonic.store(now, Ordering::SeqCst);
+    }
+
+    fn set_unix(&self, now: u64) {
+        self.unix.store(now, Ordering::SeqCst);
+    }
+
+    fn set_monotonic(&self, now: u64) {
+        self.monotonic.store(now, Ordering::SeqCst);
+    }
+}
+
+impl CultMeshRudpServerClock for Clock {
+    fn now_unix_millis(&self) -> u64 {
+        self.unix.load(Ordering::SeqCst)
+    }
+
+    fn now_monotonic_millis(&self) -> u64 {
+        self.monotonic.load(Ordering::SeqCst)
+    }
+}
+
+type Server = CultMeshRudpDocumentServer<Sink, Source, Clock>;
+
+fn document(key: &str, payload: Vec<u8>) -> CultNetRawDocumentRecord {
+    CultNetRawDocumentRecord {
+        schema_id: "test.raw.v1".into(),
+        record_key: key.into(),
+        stored_at: "2026-09-03T00:00:00Z".into(),
+        payload_encoding: CultNetRawPayloadEncoding::Messagepack,
+        payload,
+        source_runtime_id: Some(format!("runtime-{key}")),
+        source_agent_id: None,
+        source_role: None,
+        tags: None,
+    }
+}
+
+fn server(
+    options: CultMeshRudpDocumentServerOptions,
+    clock: Clock,
+    sink: Sink,
+    source: Source,
+) -> Result<Server> {
+    CultMeshRudpDocumentServer::new(
+        UdpSocket::bind("127.0.0.1:0")?,
+        sink,
+        source,
+        clock,
+        options,
+    )
+}
+
+fn client(target: SocketAddr, id: u32) -> Result<CultNetRudpSocketTransportConnection> {
+    let socket = UdpSocket::bind("127.0.0.1:0")?;
+    socket.set_nonblocking(true)?;
+    CultNetRudpSocketTransportConnection::new(CultNetRudpSocketTransportOptions {
+        media_delivery: None,
+        runtime_id: "test-client".into(),
+        socket,
+        mode: CultNetRudpSocketMode::Client,
+        remote_addr: Some(target),
+        connection_id: id,
+        initial_sequence: 1,
+        resend_delay_ms: 10,
+        transport_id: None,
+        max_payload_bytes: None,
+        max_fragment_bytes: Some(1200),
+        max_pending_reliable_packets: Some(64),
+        media_reliable_expire_after_ms: None,
+        reconnect_policy: None,
+    })
+}
+
+fn connect(
+    server: &mut Server,
+    clients: &mut [&mut CultNetRudpSocketTransportConnection],
+) -> Result<()> {
+    for client in &mut *clients {
+        client.connect(Vec::new())?;
+    }
+    for _ in 0..500 {
+        server.poll_once()?;
+        for client in &mut *clients {
+            client.receive_once()?;
+        }
+        if clients.iter().all(|client| client.connected()) {
+            for _ in 0..clients.len() {
+                server.poll_once()?;
+            }
+            return Ok(());
+        }
+        thread::sleep(Duration::from_millis(1));
+    }
+    anyhow::bail!("client connection timed out")
+}
+
+fn send(client: &mut CultNetRudpSocketTransportConnection, message: &CultNetMessage) -> Result<()> {
+    client.send(
+        "schema",
+        encode_cultnet_message_to_vec(message, CultNetWireContract::CultNetSchemaV0)?,
+    )
+}
+
+fn send_reliable(
+    client: &mut CultNetRudpSocketTransportConnection,
+    message: &CultNetMessage,
+) -> Result<CultNetRudpReliableSendReceipt> {
+    client.send_reliable(
+        "schema",
+        encode_cultnet_message_to_vec(message, CultNetWireContract::CultNetSchemaV0)?,
+    )
+}
+
+#[test]
+fn same_connection_id_is_peer_scoped_and_raw_bytes_are_untouched() -> Result<()> {
+    let clock = Clock::new(42_000);
+    let sink = Sink::default();
+    let mut server = server(Default::default(), clock, sink.clone(), Source::default())?;
+    let mut a = client(server.local_addr()?, 77)?;
+    let mut b = client(server.local_addr()?, 77)?;
+    connect(&mut server, &mut [&mut a, &mut b])?;
+
+    let a_bytes = vec![0xc4, 0x04, 0x00, 0xff, 0x80, 0x01];
+    let b_bytes = vec![0x92, 0x01, 0xc4, 0x02, 0x00, 0xff];
+    send(
+        &mut a,
+        &CultNetMessage::DocumentPutRaw {
+            message_id: "a".into(),
+            document: document("a", a_bytes.clone()),
+        },
+    )?;
+    send(
+        &mut b,
+        &CultNetMessage::DocumentPutRaw {
+            message_id: "b".into(),
+            document: document("b", b_bytes.clone()),
+        },
+    )?;
+    for _ in 0..500 {
+        server.poll_once()?;
+        a.receive_once()?;
+        b.receive_once()?;
+        if sink.0.lock().unwrap().receipts.len() == 2 {
+            break;
+        }
+    }
+
+    let receipts = sink.0.lock().unwrap();
+    assert_eq!(server.session_count(), 2);
+    assert_eq!(receipts.receipts.len(), 2);
+    assert_ne!(
+        receipts.receipts[0].session.remote_addr,
+        receipts.receipts[1].session.remote_addr
+    );
+    assert_eq!(
+        receipts
+            .receipts
+            .iter()
+            .find(|r| r.message_id == "a")
+            .unwrap()
+            .document
+            .payload,
+        a_bytes
+    );
+    assert_eq!(
+        receipts
+            .receipts
+            .iter()
+            .find(|r| r.message_id == "b")
+            .unwrap()
+            .document
+            .payload,
+        b_bytes
+    );
+    assert!(
+        receipts
+            .receipts
+            .iter()
+            .all(|r| r.received_at_unix_millis == 42_000)
+    );
+    Ok(())
+}
+
+#[test]
+fn duplicate_connect_preserves_epoch_and_fresh_epoch_is_separate() -> Result<()> {
+    let clock = Clock::new(45_000);
+    let sink = Sink::default();
+    let mut server = server(Default::default(), clock, sink.clone(), Source::default())?;
+    let target = server.local_addr()?;
+    let mut incumbent = client(target, 91)?;
+    connect(&mut server, &mut [&mut incumbent])?;
+
+    incumbent.connect(Vec::new())?;
+    server.poll_once()?;
+    incumbent.receive_once()?;
+    assert_eq!(server.session_count(), 1);
+
+    send(
+        &mut incumbent,
+        &CultNetMessage::DocumentPutRaw {
+            message_id: "after-duplicate".into(),
+            document: document("incumbent", vec![1, 2, 3]),
+        },
+    )?;
+    for _ in 0..20 {
+        server.poll_once()?;
+        if sink.0.lock().unwrap().receipts.len() == 1 {
+            break;
+        }
+    }
+    assert_eq!(sink.0.lock().unwrap().receipts.len(), 1);
+
+    let mut fresh_epoch = client(target, 92)?;
+    connect(&mut server, &mut [&mut fresh_epoch])?;
+    assert_eq!(server.session_count(), 2);
+    Ok(())
+}
+
+#[test]
+fn application_rejection_is_nonfatal_peer_scoped_and_unacknowledged() -> Result<()> {
+    let clock = Clock::new(48_000);
+    let sink = Sink::fail_once();
+    let source = Source::fail_once(vec![document("snapshot", vec![4, 5, 6])]);
+    let mut server = server(
+        Default::default(),
+        clock.clone(),
+        sink.clone(),
+        source.clone(),
+    )?;
+    let target = server.local_addr()?;
+
+    let mut publisher = client(target, 101)?;
+    let mut snapshot_client = client(target, 102)?;
+    let mut survivor = client(target, 103)?;
+    connect(
+        &mut server,
+        &mut [&mut publisher, &mut snapshot_client, &mut survivor],
+    )?;
+    let publish_receipt = send_reliable(
+        &mut publisher,
+        &CultNetMessage::DocumentPutRaw {
+            message_id: "rejected-put".into(),
+            document: document("rejected", vec![0, 255, 1]),
+        },
+    )?;
+    let CultMeshRudpPollOutcome::ApplicationRejected(rejection) = server.poll_once()? else {
+        panic!("sink rejection must be returned as a nonfatal poll outcome");
+    };
+    assert_eq!(rejection.session.connection_id, 101);
+    assert_eq!(
+        rejection.operation,
+        CultMeshRudpApplicationOperation::DocumentPutRaw
+    );
+    assert_eq!(rejection.message_id, "rejected-put");
+    assert!(rejection.reason.contains("injected sink failure"));
+    assert_eq!(server.session_count(), 2);
+    publisher.receive_once()?;
+    assert_eq!(
+        publisher.reliable_send_status(&publish_receipt),
+        CultNetRudpReliableSendStatus::Pending
+    );
+
+    let snapshot_receipt = send_reliable(
+        &mut snapshot_client,
+        &CultNetMessage::SnapshotRequest {
+            message_id: "rejected-snapshot".into(),
+            schema_ids: None,
+            record_keys: None,
+        },
+    )?;
+    let CultMeshRudpPollOutcome::ApplicationRejected(rejection) = server.poll_once()? else {
+        panic!("source rejection must be returned as a nonfatal poll outcome");
+    };
+    assert_eq!(rejection.session.connection_id, 102);
+    assert_eq!(
+        rejection.operation,
+        CultMeshRudpApplicationOperation::SnapshotRequest
+    );
+    assert_eq!(rejection.message_id, "rejected-snapshot");
+    assert!(rejection.reason.contains("injected source failure"));
+    assert_eq!(server.session_count(), 1);
+    snapshot_client.receive_once()?;
+    assert_eq!(
+        snapshot_client.reliable_send_status(&snapshot_receipt),
+        CultNetRudpReliableSendStatus::Pending
+    );
+
+    let survivor_receipt = send_reliable(
+        &mut survivor,
+        &CultNetMessage::DocumentPutRaw {
+            message_id: "accepted-after-rejections".into(),
+            document: document("survivor", vec![9, 8, 7]),
+        },
+    )?;
+    assert_eq!(server.poll_once()?, CultMeshRudpPollOutcome::Handled);
+    for _ in 0..20 {
+        survivor.receive_once()?;
+        if survivor.reliable_send_status(&survivor_receipt)
+            == CultNetRudpReliableSendStatus::Acknowledged
+        {
+            break;
+        }
+    }
+    assert_eq!(
+        survivor.reliable_send_status(&survivor_receipt),
+        CultNetRudpReliableSendStatus::Acknowledged
+    );
+    assert_eq!(sink.0.lock().unwrap().receipts.len(), 1);
+    assert_eq!(source.0.lock().unwrap().calls, 1);
+    Ok(())
+}
+
+#[test]
+fn snapshot_response_resends_until_acknowledged() -> Result<()> {
+    let clock = Clock::new(51_000);
+    let expected = document("catalog", vec![0x81, 0xa1, 0x78, 0x2a]);
+    let source = Source::documents(vec![expected.clone()]);
+    let options = CultMeshRudpDocumentServerOptions {
+        resend_delay: Duration::from_millis(10),
+        ..Default::default()
+    };
+    let mut server = server(options, clock.clone(), Sink::default(), source)?;
+    let mut client = client(server.local_addr()?, 88)?;
+    connect(&mut server, &mut [&mut client])?;
+    send(
+        &mut client,
+        &CultNetMessage::SnapshotRequest {
+            message_id: "snapshot".into(),
+            schema_ids: Some(vec!["test.raw.v1".into()]),
+            record_keys: Some(vec!["catalog".into()]),
+        },
+    )?;
+    server.poll_once()?;
+
+    clock.set(51_011);
+    assert_eq!(server.maintain()?.packets_resent, 1);
+    let response = loop {
+        if let Some(frame) = client.receive_once()? {
+            break decode_cultnet_message_from_slice(
+                &frame.payload,
+                CultNetWireContract::CultNetSchemaV0,
+            )?;
+        }
+    };
+    assert_eq!(
+        response,
+        CultNetMessage::SnapshotResponseRaw {
+            message_id: "snapshot".into(),
+            documents: vec![expected],
+        }
+    );
+
+    for _ in 0..20 {
+        server.poll_once()?;
+    }
+    clock.set(51_022);
+    assert_eq!(server.maintain()?.packets_resent, 0);
+    Ok(())
+}
+
+#[test]
+fn payload_and_snapshot_output_budgets_fail_closed() -> Result<()> {
+    let clock = Clock::new(55_000);
+    let sink = Sink::default();
+    let message = CultNetMessage::DocumentPutRaw {
+        message_id: "budget".into(),
+        document: document("budget", vec![7; 64]),
+    };
+    let encoded = encode_cultnet_message_to_vec(&message, CultNetWireContract::CultNetSchemaV0)?;
+    let options = CultMeshRudpDocumentServerOptions {
+        max_admitted_payload_bytes: encoded.len(),
+        max_admitted_payload_bytes_per_session: encoded.len(),
+        max_snapshot_response_bytes: encoded.len(),
+        ..Default::default()
+    };
+    let mut budget_server = server(options, clock, sink.clone(), Source::default())?;
+    let target = budget_server.local_addr()?;
+    let mut first = client(target, 111)?;
+    let mut second = client(target, 112)?;
+    connect(&mut budget_server, &mut [&mut first, &mut second])?;
+    send(&mut first, &message)?;
+    budget_server.poll_once()?;
+    send(&mut second, &message)?;
+    budget_server.poll_once()?;
+    assert_eq!(sink.0.lock().unwrap().receipts.len(), 1);
+
+    let oversized = Source::documents(vec![document("oversized", vec![8; 512])]);
+    let options = CultMeshRudpDocumentServerOptions {
+        max_snapshot_response_bytes: 128,
+        ..Default::default()
+    };
+    let mut snapshot_server = server(options, Clock::new(56_000), Sink::default(), oversized)?;
+    let mut snapshot_client = client(snapshot_server.local_addr()?, 113)?;
+    connect(&mut snapshot_server, &mut [&mut snapshot_client])?;
+    let receipt = send_reliable(
+        &mut snapshot_client,
+        &CultNetMessage::SnapshotRequest {
+            message_id: "too-large".into(),
+            schema_ids: None,
+            record_keys: None,
+        },
+    )?;
+    let CultMeshRudpPollOutcome::ApplicationRejected(rejection) = snapshot_server.poll_once()?
+    else {
+        panic!("oversized snapshot must reject only its session");
+    };
+    assert_eq!(
+        rejection.operation,
+        CultMeshRudpApplicationOperation::SnapshotRequest
+    );
+    assert_eq!(rejection.message_id, "too-large");
+    assert!(rejection.reason.contains("snapshot response is"));
+    assert_eq!(snapshot_server.session_count(), 0);
+    snapshot_client.receive_once()?;
+    assert_eq!(
+        snapshot_client.reliable_send_status(&receipt),
+        CultNetRudpReliableSendStatus::Pending
+    );
+    Ok(())
+}
+
+#[test]
+fn session_cap_and_expiry_use_monotonic_time() -> Result<()> {
+    let clock = Clock::new(60_000);
+    let options = CultMeshRudpDocumentServerOptions {
+        max_sessions: 1,
+        session_idle_timeout: Duration::from_secs(1),
+        session_max_lifetime: Duration::from_millis(100),
+        ..Default::default()
+    };
+    let mut server = server(options, clock.clone(), Sink::default(), Source::default())?;
+    let target = server.local_addr()?;
+    let mut admitted = client(target, 1)?;
+    connect(&mut server, &mut [&mut admitted])?;
+    let mut rejected = client(target, 1)?;
+    rejected.connect(Vec::new())?;
+    server.poll_once()?;
+    assert_eq!(server.session_count(), 1);
+    assert!(!rejected.connected());
+
+    clock.set_unix(1);
+    clock.set_monotonic(60_101);
+    assert_eq!(server.maintain()?.sessions_expired, 1);
+    assert_eq!(server.session_count(), 0);
+    Ok(())
+}
diff --git a/packages/cultmesh-ts/README.md b/packages/cultmesh-ts/README.md
index e0481ed7..d3fe565b 100644
--- a/packages/cultmesh-ts/README.md
+++ b/packages/cultmesh-ts/README.md
@@ -11,6 +11,195 @@ frame body path.
 The TypeScript projection keeps the same local catalog ergonomics as the other
 runtimes: sorted views, direct lookup, and unsubscribe-able watches.
 
+## Shared Primitives
+
+CultMesh primitives are shared cross-runtime developer affordances, not just
+DTOs. They bundle the typed surface, metadata, routing hints, diagnostics, and
+fast-path hooks that let application code feel like it is talking to native
+state while CultMesh chooses the right local, shared-memory, IPC, network, or
+WASM route. Runtime code can ask for a whole XY rect, then adapt it to the
+current wire schema at the edge:
+
+```ts
+import { CultMesh } from "cultmesh-ts";
+
+const viewport = CultMesh.rectFromBounds(-500, -300, 500, 300);
+const request = CultMesh.viewportRequest(viewport, [3, 8]);
+```
+
+The request currently projects to the compact `{ minX, minY, maxX, maxY }`
+shape used by Aetheria viewport queries, while the authored code keeps the
+designer-facing concept as a `CultMeshRect`.
+
+Typed operations follow the same rule: client code holds a method-shaped handle
+and a runtime context, while CultMesh hides the route and authority metadata
+from call sites that do not need to inspect it.
+
+```ts
+const move = CultMesh.operation("game.pilot.move.v1", async (request, context) => {
+  return submitToBestRoute(request, context);
+});
+
+await move.invoke({ direction: CultMesh.vec2(1, 0) }, CultMesh.operationContext("rts-client", {
+  routeHint: CultMesh.routeHint("network", "starfire Verse"),
+}));
+```
+
+Typed query surfaces can be read once or watched through the same handle. A
+projection recipe keeps its source metadata, route preference, and reactive
+watcher when it becomes a query surface:
+
+```ts
+const objects = CultMesh.projectionRecipe(
+  "aetheria.zone.objects.visible",
+  [CultMesh.projectionSource("daemon:aetheria.frame.latest.v1")],
+  projectObjects,
+  {
+    routeHint: CultMesh.routeHint("shared-memory", "co-located frame slab"),
+    watchProjection: watchObjects,
+  },
+).asQuerySurface();
+
+const stop = objects.watch(
+  { viewport: CultMesh.viewportRequest(CultMesh.rectFromBounds(-10, -10, 10, 10)) },
+  "browser-starfire",
+  (next) => render(next),
+);
+```
+
+Typed document handles use the same shape for local cache reads, network
+snapshots, replacement, and client prediction. Authority-specific code plugs in
+the submitter once; gameplay callers keep using the document:
+
+```ts
+const input = CultMesh.document(
+  "input:pilot-a:thermal",
+  pilotInputDocument,
+  async (context) => readInput(context),
+  {
+    routeHint: CultMesh.routeHint("network", "Starbridge Verse"),
+    watchDocument: watchInput,
+    submitPrediction: async (context, value) => submitPredictedInput(context, value),
+  },
+);
+
+await input.submitPrediction("pilot-a", predictedInput);
+const stop = input.watch("pilot-a", latest => reconcileInput(latest));
+```
+
+Durable nodes resolve same-schema aliases at the boundary. Register the
+canonical document that owns storage and replication, then ask the node for the
+typed view the current runtime wants:
+
+```ts
+const station = await CultMesh.startNode(statePath, {
+  documents: [stationStockDocument],
+});
+
+const stock = station.document(stationStockUiDocument, "station:starbridge:stock");
+const current = await stock.latest();
+
+await stock.authoritativeWriter().write(updatedStockFromUi);
+
+const reactive = stock.authoritativeWriter().reactive();
+await reactive.ready;
+reactive.update(draft => {
+  draft.availableMissiles -= 4;
+});
+```
+
+State pointers are the same kind of managed surface for UI and tools. They can
+advertise source documents, inherit a Verse route when bound, and resolve
+through that Verse without caller-side context plumbing:
+
+```ts
+const framePointer = CultMesh.statePointer(
+  "daemon:aetheria.frame.latest.v1",
+  async (context) => readFrameViaBestRoute(context),
+  undefined,
+  {
+    sources: [CultMesh.projectionSource("daemon:aetheria.frame.latest.v1")],
+    routeHint: CultMesh.routeHint("shared-memory", "co-located daemon frame"),
+  },
+);
+
+const frame = await CultMesh
+  .bindStatePointer(verse.withRoute("ipc", "Bifrost tool bridge"), framePointer)
+  .resolve();
+
+const stateBinding = CultMesh.stateBinding("value", framePointer);
+const stateBindingRecord = CultMesh.stateBindingRecord(stateBinding);
+const restoredStateBinding = CultMesh.stateBindingFromRecord(stateBindingRecord);
+```
+
+Eve/CultUI lowerers that still receive authored state refs should use a named
+state-ref resolver instead of local string utilities. Resolvers compose, carry
+source and route metadata, and can be described by tools:
+
+```ts
+const daemonRefs = CultMesh.stateRefResolver(
+  "aetheria.daemon.refs",
+  (stateRef, context) => resolveDaemonStateRef(stateRef, context),
+  {
+    sources: [CultMesh.projectionSource("daemon:aetheria.frame.latest.v1")],
+    routeHint: CultMesh.routeHint("shared-memory", "co-located daemon state"),
+  },
+);
+
+const catalogRefs = CultMesh.stateRefResolver(
+  "aetheria.item_stats.refs",
+  (stateRef) => resolveItemStatRef(stateRef),
+);
+
+const resolver = daemonRefs.or(catalogRefs);
+const value = resolver.resolve("aetheria:daemon:item-stat:laser.output");
+const diagnostic = CultMesh.describeStateRefResolver(resolver);
+```
+
+Operation surfaces should preserve typed CultMesh identity all the way through
+UI/runtime boundaries. Use invocation records and payload records at persistence
+edges instead of local route parsers or string-map conventions:
+
+```ts
+const binding = CultMesh.operationBinding("gamecult.aetheria.pilot.set_target.v1", {
+  schemaId: "gamecult.aetheria.pilot.set_target.request.v1",
+  routeHint: CultMesh.routeHint("network", "co-op Verse"),
+});
+const bindingRecord = CultMesh.operationBindingRecord(binding);
+const restoredBinding = CultMesh.operationBindingFromRecord(bindingRecord);
+
+const invocation = CultMesh.operationInvocation(binding, {
+  idempotencyKey: "target:starfire:42",
+});
+const invocationRecord = CultMesh.operationInvocationRecord(invocation);
+const payloadRecord = CultMesh.operationPayload({ targetEntityKey: "bandit-7" }).toRecord();
+const restored = CultMesh.operationInvocationFromRecord(invocationRecord);
+```
+
+Route fields use the same shared primitive:
+
+```ts
+const routeRecord = CultMesh.routeRecord(CultMesh.routeHint("shared-memory", "co-located slab"));
+const route = CultMesh.routeFromRecord(routeRecord);
+```
+
+When a client needs one coherent live view composed from several query surfaces,
+use a live feed instead of putting a refresh loop in the UI:
+
+```ts
+const viewportFeed = CultMesh.liveFeed(
+  "aetheria.rts.viewport.feed",
+  snapshotViewport,
+  {
+    sources: objects.sources,
+    routeHint: objects.routeHint,
+    watchFeed: CultMesh.pollingQueryWatcher(snapshotViewport, { intervalMs: 50 }),
+  },
+);
+
+const stopFeed = viewportFeed.watch(request, "browser-starfire", render);
+```
+
 ```ts
 import { CultMesh } from "cultmesh-ts";
 
@@ -75,6 +264,71 @@ Schema and shard catalog factories delegate to `cultnet-ts`; the branded
 `CultMesh` entrypoint does not create a second owner for schema discovery or
 topology truth.
 
+## Long-Lived Providers
+
+TypeScript provider daemons use `CultMeshProviderSession` to retain one logical
+provider lifecycle across physical reconnects. The session owns registration,
+lease renewal, desired typed publication replay, command dispatch, receipt
+publication, and withdrawal. Provider code owns domain state and idempotent
+command transactions; the injected transport owns CultNet wire details.
+
+```ts
+import {
+  CultMeshProviderRudpTransport,
+  CultMeshProviderSession,
+} from "cultmesh-ts";
+
+const odinTransport = new CultMeshProviderRudpTransport({
+  endpoint: "rudp://127.0.0.1:17871",
+  runtimeId: "voidbot-worker-7",
+  connectionId: 0x43554c54,
+  sessionToken: process.env.ODIN_PROVIDER_SESSION_TOKEN,
+});
+
+const session = new CultMeshProviderSession({
+  identity: {
+    providerId: "voidbot.swarm",
+    serviceInstanceId: "voidbot-worker-7",
+    endpointId: "odin:voidbot-worker-7",
+    verseId: "voidbot.local",
+  },
+  transport: odinTransport,
+  receiptStore: durableReceiptStore,
+  publications: [advertisementPublication, surfacePublication],
+  commandHandlers: {
+    "swarm.set_heat": applyHeatCommandTransaction,
+  },
+});
+
+await session.start();
+await session.upsertPublication(nextSurfacePublication);
+```
+
+Provider, service-instance, endpoint, and body-producer identities are separate
+contracts. The provider session never infers one from another. A durable
+receipt store is required; `CultMeshMemoryProviderReceiptStore` is intended
+only for tests and disposable tools. The store is a durable outbox: a receipt
+is persisted before transport publication, remains pending across reconnects,
+and is marked published only after the current connection accepts it. Receipt
+store failure degrades command intake without inventing a network outage.
+
+The RUDP provider transport carries lifecycle payloads inside the existing
+`cultnet.operation_request.v0` and `cultnet.operation_response.v0` envelopes.
+RUDP acknowledgements prove byte delivery only. Registration, renewal,
+publication changes, receipts, and withdrawal complete only after the
+provider-session broker returns a correlated application response. The broker
+owns lease fencing and accepted publication membership; the provider owns its
+desired documents and durable receipt outbox.
+
+`CultMeshProviderRudpTransport` is currently a private-development transport.
+Do not advertise it as a public provider boundary until the surrounding
+CultNet session authenticates a claim authorizing the four-part provider
+identity. Source address and successful contact are not authority.
+The adapter carries `sessionToken` in a typed RUDP Connect-evidence map beside
+a fresh `clientSessionId`. Packet retransmits reuse that id; an actual reconnect
+mints another. The receiver must decode and validate the token as authorization
+evidence for the requested provider identity.
+
 ## RUDP Helpers
 
 Node runtimes can build the shared CultNet reliable-UDP transport from the
@@ -117,6 +371,30 @@ const client = await CultMesh.createRudpPeerForAuthorizedPeer(
 );
 const schemas = CultMesh.createSchemaCatalog();
 await client.syncSchemaCatalog(schemas, { kinds: ["document_payload"] });
+
+const health = CultMesh.documentFromPeerSnapshot(
+  () => client,
+  daemonHealthDocument,
+  "daemon:aetheria.health.v1",
+  {
+    routeHint: CultMesh.routeHint("network", endpoint.uri),
+    timeoutMs: 5_000,
+  },
+);
+
+const latestHealth = await health.latest();
+
+const syncedHealth = await station.syncDocumentFromPeerSnapshot(
+  () => client,
+  daemonHealthUiDocument,
+  "daemon:aetheria.health.v1",
+  {
+    timeoutMs: 5_000,
+  },
+);
+const localHealth = await station
+  .document(daemonHealthUiDocument, "daemon:aetheria.health.v1")
+  .latest();
 ```
 
 `CultMesh.createRudpPeerForPeer(...)` remains available for already trusted
@@ -127,6 +405,38 @@ Discovery-first schema/catalog paths should prefer
 `CultMeshPeerCatalog.firstAuthorized(...)` with the authority lease catalog
 before using the peer-card endpoint as a dial target.
 
+`CultMesh.documentFromPeerSnapshot(...)` is the document-level path for RUDP
+snapshots. It hides the snapshot request message id, response listener, raw
+payload binary normalization, and MessagePack decode behind the same
+`CultMeshDocumentHandle` shape as local documents. The helper prefers an exact
+schema id match and falls back to the requested record key, so runtimes that
+alias the same logical document through different generated schema names can
+still read the publication with one CultMesh call. Pass a CultCache document
+definition instead of a raw schema id when you want a typed handle whose
+`latest()` result is parsed through that definition.
+
+Use `node.syncDocumentFromPeerSnapshot(...)` or
+`CultMesh.syncDocumentFromPeerSnapshot(...)` when a runtime should hydrate its
+local node from the remote snapshot. The helper requests the raw snapshot,
+applies it through the node's document registry, and returns the requested
+typed definition. Same-schema aliases stay local after the call: the caller can
+keep using `node.document(aliasDefinition, key)` and explicitly select
+`authoritativeWriter()`, `predictionWriter()`, or `observe()`
+without re-threading the RUDP peer.
+
+The same typed-definition overload is available for
+`CultMesh.documentFromStore(...)` and `CultMesh.documentFromSingleFile(...)`, so
+local schema publications can be read as typed reactive documents without
+manually pulling records, decoding MessagePack, or parsing the payload.
+When the caller wants source selection to be configuration, use
+`CultMesh.documentFromPublication(...)` with a `single-file`, `store`, or
+`peer-snapshot` source; it returns the same typed handle while hiding whether
+sync came from local persistence or a remote CultNet snapshot.
+Use `node.syncDocumentFromPublication(...)` or
+`CultMesh.syncDocumentFromPublication(...)` for the same source-agnostic shape
+when the publication should hydrate a local node before the caller continues
+through `node.document(...)` and its explicit writer or observer.
+
 ## Streaming Mode
 
 CultMesh streaming mode is for audio, video, tensor, and opaque byte frames that
diff --git a/packages/cultmesh-ts/package.json b/packages/cultmesh-ts/package.json
index b233d448..0ca8afb3 100644
--- a/packages/cultmesh-ts/package.json
+++ b/packages/cultmesh-ts/package.json
@@ -1,16 +1,24 @@
 {
   "name": "cultmesh-ts",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "CultMesh local typed state and mesh catalog primitives for TypeScript runtimes.",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "require": "./dist/index.js",
+      "default": "./dist/index.js"
+    }
+  },
   "files": [
     "dist"
   ],
   "scripts": {
-    "build": "tsc -p tsconfig.json",
-    "typecheck": "tsc -p tsconfig.json --pretty false",
-    "test": "npm run build && tsc -p tsconfig.test.json && node --test dist-test/test/*.test.js"
+    "build": "node ../../node_modules/typescript/bin/tsc -p tsconfig.json",
+    "prepack": "node ../../node_modules/typescript/bin/tsc -p tsconfig.json",
+    "typecheck": "node ../../node_modules/typescript/bin/tsc -p tsconfig.json --pretty false",
+    "test": "node ../../node_modules/typescript/bin/tsc -p tsconfig.json && node ../../node_modules/typescript/bin/tsc -p tsconfig.test.json && node --test dist-test/test/*.test.js"
   },
   "keywords": [
     "cultmesh",
@@ -21,10 +29,22 @@
   ],
   "author": "metacratic",
   "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/GameCult/CultLib.git",
+    "directory": "packages/cultmesh-ts"
+  },
+  "bugs": {
+    "url": "https://github.com/GameCult/CultLib/issues"
+  },
+  "homepage": "https://github.com/GameCult/CultLib/tree/main/packages/cultmesh-ts#readme",
+  "engines": {
+    "node": ">=18"
+  },
   "dependencies": {
     "@msgpack/msgpack": "^3.1.2",
-    "cultcache-ts": "file:../cultcache-ts",
-    "cultnet-ts": "file:../cultnet-ts"
+    "@gamecult/cultcache-ts": "^0.14.0",
+    "cultnet-ts": "^0.2.0"
   },
   "devDependencies": {
     "@types/node": "^24.0.0",
diff --git a/packages/cultmesh-ts/src/index.ts b/packages/cultmesh-ts/src/index.ts
index 53225705..e9fbb8be 100644
--- a/packages/cultmesh-ts/src/index.ts
+++ b/packages/cultmesh-ts/src/index.ts
@@ -6,8 +6,9 @@ import {
   SingleFileMessagePackBackingStore,
   type AnyCultCacheDocumentDefinition,
   type CacheBackingStore,
+  type CultCacheEnvelope,
   type CultCacheDocumentValue,
-} from "cultcache-ts";
+} from "@gamecult/cultcache-ts";
 import {
   CultNetDocumentRegistry,
   CultNetRudpSession,
@@ -21,14 +22,3974 @@ import {
   encodeCultNetMessageForWire,
   encodeRudpPacket,
   parseCultNetMessage,
+  type CultNetErrorMessage,
   type CultNetDocumentBinding,
   type CultNetMessage,
+  type CultNetOperationRequestMessage,
+  type CultNetOperationResponseMessage,
   type CultNetRawDocumentRecord,
   type CultNetReconnectPolicy,
   type CultNetSchemaCatalogOptions,
+  type CultNetSnapshotResponseRawMessage,
   type CultNetWireContract,
 } from "cultnet-ts";
 
+export * from "./provider-session";
+export * from "./provider-session-wire";
+export * from "./provider-rudp-transport";
+export * from "./provider-session-broker";
+
+export interface CultMeshVec2 {
+  readonly x: number;
+  readonly y: number;
+}
+
+export interface CultMeshRect {
+  readonly min: CultMeshVec2;
+  readonly max: CultMeshVec2;
+}
+
+export interface CultMeshViewportRequest {
+  readonly minX: number;
+  readonly minY: number;
+  readonly maxX: number;
+  readonly maxY: number;
+  readonly controlledEntityIndices?: readonly number[];
+}
+
+export type CultMeshLocalityKind =
+  | "automatic"
+  | "in-process"
+  | "shared-memory"
+  | "ipc"
+  | "network"
+  | "wasm";
+
+export interface CultMeshRouteHint {
+  readonly kind: CultMeshLocalityKind;
+  readonly description?: string;
+}
+
+export interface CultMeshRouteRecord {
+  readonly kind: string;
+  readonly description: string;
+}
+
+/**
+ * Consumer view of provider-session publications. The provider-session client
+ * owns ordering, replay, and reconnect; document handles only project that
+ * live publication state into typed latest/watch semantics.
+ */
+export interface CultMeshLivePublicationSource {
+  latest(schemaId: string, recordKey: string): Promise<unknown>;
+  watch(
+    schemaId: string,
+    recordKey: string,
+    callback: (value: unknown) => void,
+  ): CultMeshUnsubscribe;
+}
+
+export type CultMeshDocumentPublicationSource =
+  | {
+      readonly kind: "single-file";
+      readonly path: string;
+    }
+  | {
+      readonly kind: "store";
+      readonly store: CacheBackingStore;
+    }
+  | {
+      readonly kind: "peer-snapshot";
+      readonly peer: CultNetPeer | (() => CultNetPeer | Promise<CultNetPeer>);
+      readonly endpoint?: string;
+    }
+  | {
+      readonly kind: "live-publication";
+      readonly source: CultMeshLivePublicationSource;
+      readonly endpoint?: string;
+    };
+
+export interface CultMeshPublicationDocumentBinding {
+  readonly schema: string | AnyCultCacheDocumentDefinition;
+  readonly recordKey: string;
+  readonly documentId?: string;
+  readonly sourceId?: string;
+  readonly source?: CultMeshDocumentPublicationSource;
+}
+
+export type CultMeshDocumentPublicationSourceResolver =
+  | CultMeshDocumentPublicationSource
+  | ((binding: CultMeshPublicationDocumentBinding) => CultMeshDocumentPublicationSource);
+
+export interface CultMeshAuthorityClaim {
+  readonly role: string;
+  readonly shardId?: string;
+  readonly leaseId?: string;
+}
+
+export interface CultMeshVerseContext {
+  readonly verseId: string;
+  readonly runtimeId: string;
+  readonly routeHint: CultMeshRouteHint;
+  readonly claims: readonly CultMeshAuthorityClaim[];
+}
+
+export interface CultMeshOperationContext {
+  readonly runtimeId: string;
+  readonly claims: readonly CultMeshAuthorityClaim[];
+  readonly routeHint: CultMeshRouteHint;
+  readonly idempotencyKey?: string;
+}
+
+export interface CultMeshOperationReceipt {
+  readonly operationId: string;
+  readonly accepted: boolean;
+  readonly route: CultMeshRouteHint;
+  readonly diagnostic?: string;
+}
+
+export interface CultMeshQueryContext {
+  readonly runtimeId: string;
+  readonly routeHint: CultMeshRouteHint;
+}
+
+export type CultMeshUnsubscribe = () => void;
+
+export type CultMeshDocumentWatcher<TDocument> = (
+  context: CultMeshQueryContext,
+  callback: (value: TDocument) => void,
+) => CultMeshUnsubscribe;
+
+export type CultMeshDocumentReplacer<TDocument> = (
+  context: CultMeshQueryContext,
+  value: TDocument,
+) => Promise<void>;
+
+export type CultMeshDocumentPredictionSubmitter<TDocument> = (
+  context: CultMeshQueryContext,
+  value: TDocument,
+) => Promise<void>;
+
+export type CultMeshDocumentUpdater<TDocument> = (
+  current: TDocument,
+) => TDocument | Promise<TDocument>;
+
+export type CultMeshCollectionSnapshot<TDocument> = readonly TDocument[];
+
+export type CultMeshCollectionChangeKind = "added" | "updated" | "removed" | "reset";
+
+export interface CultMeshCollectionChange<TDocument> {
+  readonly kind: CultMeshCollectionChangeKind;
+  readonly key?: string;
+  readonly value?: TDocument;
+}
+
+export type CultMeshCollectionWatcher<TDocument> = (
+  context: CultMeshQueryContext,
+  callback: (change: CultMeshCollectionChange<TDocument>) => void,
+) => CultMeshUnsubscribe;
+
+export interface CultMeshDocumentSchemaDescriptor {
+  readonly type?: string;
+  readonly schemaId?: string;
+  readonly schemaName?: string;
+  readonly schemaVersion?: string;
+}
+
+export type CultMeshStatePointerResolver<T> = (
+  context: CultMeshQueryContext,
+) => Promise<T | undefined>;
+
+export type CultMeshStatePointerWatcher<T> = (
+  context: CultMeshQueryContext,
+  callback: (value: T) => void,
+) => CultMeshUnsubscribe;
+
+export type CultMeshMutableStatePointerReplacer<T> = (
+  context: CultMeshQueryContext,
+  value: T,
+) => Promise<void>;
+
+export type CultMeshQueryWatcher<TParameters, TResult> = (
+  parameters: TParameters,
+  context: CultMeshQueryContext,
+  callback: (value: TResult) => void,
+) => CultMeshUnsubscribe;
+
+export type CultMeshLiveFeedWatcher<TParameters, TResult> = (
+  parameters: TParameters,
+  context: CultMeshQueryContext,
+  callback: (value: TResult) => void,
+) => CultMeshUnsubscribe;
+
+export interface CultMeshPollingWatchOptions<TResult> {
+  readonly intervalMs?: number;
+  readonly emitInitial?: boolean;
+  readonly equals?: (left: TResult, right: TResult) => boolean;
+}
+
+export interface CultMeshReactiveDocumentOptions {
+  readonly context?: CultMeshQueryContext | string;
+  readonly watch?: boolean;
+  readonly debounceMs?: number;
+  readonly replaceDirtyCurrentOnCanonicalSnapshot?: boolean;
+  readonly onError?: (error: unknown) => void;
+}
+
+export type CultMeshReactiveDocumentDelta<TDocument extends object> = Partial<{
+  readonly [K in keyof TDocument]: TDocument[K] extends number ? number : TDocument[K];
+}>;
+
+export interface CultMeshReactiveDocumentReconciliation<TDocument extends object> {
+  readonly version: number;
+  readonly canonical: TDocument;
+  readonly predicted: TDocument;
+  readonly delta: CultMeshReactiveDocumentDelta<TDocument>;
+  readonly receivedAtMs: number;
+}
+
+export interface CultMeshReactiveDocument<TDocument extends object> {
+  readonly writer: CultMeshDocumentWriter<TDocument>;
+  readonly snapshot: TDocument;
+  readonly dirty: boolean;
+  readonly reconciliation: CultMeshReactiveDocumentReconciliation<TDocument> | undefined;
+  readonly ready: Promise<TDocument>;
+  readonly disposed: boolean;
+  update(update: (draft: TDocument) => void | TDocument): TDocument;
+  replaceLocal(value: TDocument): TDocument;
+  flush(): Promise<void>;
+  clearReconciliation(): void;
+  refresh(): Promise<TDocument>;
+  dispose(): void;
+}
+
+export interface CultMeshObservedDocument<TDocument extends object> {
+  readonly current: TDocument;
+  readonly ready: Promise<TDocument>;
+  readonly disposed: boolean;
+  refresh(): Promise<TDocument>;
+  dispose(): void;
+}
+
+export type CultMeshDocumentWriteKind = "authoritative-replacement" | "prediction";
+
+export interface CultMeshNativeSliceColumn {
+  readonly name: string;
+  readonly valueType: string;
+  readonly elementSizeBytes: number;
+}
+
+export interface CultMeshNativeSliceViewDescriptor {
+  readonly viewId: string;
+  readonly schemaId: string;
+  readonly rowCount: number;
+  readonly columns: readonly CultMeshNativeSliceColumn[];
+  readonly route: CultMeshRouteHint;
+  readonly nativeHandle?: string;
+}
+
+export interface CultMeshProjectionSource {
+  readonly sourceId: string;
+  readonly schemaId?: string;
+  readonly description?: string;
+}
+
+export interface CultMeshStateBindingDescriptor {
+  readonly targetProp: string;
+  readonly pointerId: string;
+  readonly sourceId?: string;
+  readonly schemaId?: string;
+  readonly routeHint: CultMeshRouteHint;
+  readonly bindingName?: string;
+  readonly documentId?: string;
+  readonly fieldPath?: string;
+  readonly valueKind?: "string" | "number" | "boolean" | "choice" | "string-list";
+  readonly accessMode?: "read" | "write" | "read-write" | "local-draft";
+  readonly authority?: string;
+  readonly writeCommand?: string;
+}
+
+export interface CultMeshStateBindingRecord {
+  readonly targetProp: string;
+  readonly pointerId: string;
+  readonly sourceId: string;
+  readonly schemaId: string;
+  readonly routeKind: string;
+  readonly routeDescription: string;
+  readonly bindingName: string;
+  readonly documentId: string;
+  readonly fieldPath: string;
+  readonly valueKind: string;
+  readonly accessMode: string;
+  readonly authority: string;
+  readonly writeCommand: string;
+}
+
+export interface CultMeshOperationBindingDescriptor {
+  readonly operationId: string;
+  readonly label: string;
+  readonly schemaId: string;
+  readonly routeHint: CultMeshRouteHint;
+}
+
+export interface CultMeshOperationBindingRecord {
+  readonly operationId: string;
+  readonly label: string;
+  readonly schemaId: string;
+  readonly routeKind: string;
+  readonly routeDescription: string;
+}
+
+export interface CultMeshOperationInvocationDescriptor {
+  readonly operationId: string;
+  readonly schemaId: string;
+  readonly routeHint: CultMeshRouteHint;
+  readonly idempotencyKey?: string;
+}
+
+export interface CultMeshOperationInvocationRecord {
+  readonly operationId: string;
+  readonly schemaId: string;
+  readonly routeKind: string;
+  readonly routeDescription: string;
+  readonly idempotencyKey: string;
+}
+
+export interface CultMeshOperationPayload {
+  readonly fields: Readonly<Record<string, string>>;
+  getString(key: string, defaultValue?: string): string;
+  getInt(key: string, defaultValue?: number): number;
+  getDouble(key: string, defaultValue?: number): number;
+  getBoolean(key: string, defaultValue?: boolean): boolean;
+  with(key: string, value: string | number | boolean): CultMeshOperationPayload;
+  toRecord(): Readonly<Record<string, string>>;
+}
+
+export interface CultMeshQuerySurfaceDiagnostic {
+  readonly queryId: string;
+  readonly routeHint: CultMeshRouteHint;
+  readonly sources: readonly CultMeshProjectionSource[];
+}
+
+export interface CultMeshOperationHandleDiagnostic {
+  readonly operationId: string;
+}
+
+export interface CultMeshStatePointerDiagnostic {
+  readonly pointerId: string;
+  readonly routeHint: CultMeshRouteHint;
+  readonly sources: readonly CultMeshProjectionSource[];
+}
+
+export interface CultMeshStateRefResolverDiagnostic {
+  readonly resolverId: string;
+  readonly routeHint: CultMeshRouteHint;
+  readonly sources: readonly CultMeshProjectionSource[];
+}
+
+export interface CultMeshProjectionRecipeDiagnostic {
+  readonly projectionId: string;
+  readonly routeHint: CultMeshRouteHint;
+  readonly sources: readonly CultMeshProjectionSource[];
+}
+
+export interface CultMeshLiveFeedDiagnostic {
+  readonly feedId: string;
+  readonly routeHint: CultMeshRouteHint;
+  readonly sources: readonly CultMeshProjectionSource[];
+}
+
+export type CultMeshSurfaceKind =
+  | "query"
+  | "projection-recipe"
+  | "live-feed"
+  | "operation"
+  | "document"
+  | "collection"
+  | "state-pointer"
+  | "native-slice-view";
+
+export interface CultMeshSurfaceDiagnostic {
+  readonly kind: CultMeshSurfaceKind;
+  readonly surfaceId: string;
+  readonly routeHint: CultMeshRouteHint;
+  readonly sources: readonly CultMeshProjectionSource[];
+}
+
+export interface CultMeshSurfaceCatalogDiagnostic {
+  readonly catalogId: string;
+  readonly surfaces: readonly CultMeshSurfaceDiagnostic[];
+}
+
+export interface CultMeshSurfaceCatalogIndexDiagnostic {
+  readonly catalogId: string;
+  readonly queries: readonly CultMeshSurfaceDiagnostic[];
+  readonly projectionRecipes: readonly CultMeshSurfaceDiagnostic[];
+  readonly liveFeeds: readonly CultMeshSurfaceDiagnostic[];
+  readonly operations: readonly CultMeshSurfaceDiagnostic[];
+  readonly documents: readonly CultMeshSurfaceDiagnostic[];
+  readonly collections: readonly CultMeshSurfaceDiagnostic[];
+  readonly statePointers: readonly CultMeshSurfaceDiagnostic[];
+  readonly nativeSliceViews: readonly CultMeshSurfaceDiagnostic[];
+}
+
+export interface CultMeshNativeSliceViewDiagnostic {
+  readonly viewId: string;
+  readonly schemaId: string;
+  readonly rowCount: number;
+  readonly columns: readonly CultMeshNativeSliceColumn[];
+  readonly route: CultMeshRouteHint;
+  readonly nativeHandle?: string;
+  readonly denseRowStrideBytes: number;
+}
+
+export class CultMeshOperationContextBuilder {
+  readonly #runtimeId: string;
+  #claims: CultMeshAuthorityClaim[] = [];
+  #routeHint: CultMeshRouteHint = cultMeshRouteHint();
+  #idempotencyKey: string | undefined;
+
+  public constructor(runtimeId: string) {
+    requireNonEmpty(runtimeId, "runtimeId");
+    this.#runtimeId = runtimeId;
+  }
+
+  public claim(
+    role: string,
+    options: { shardId?: string; leaseId?: string } = {},
+  ): this {
+    this.#claims.push(cultMeshAuthorityClaim(role, options));
+    return this;
+  }
+
+  public claims(claims: readonly CultMeshAuthorityClaim[]): this {
+    this.#claims.push(...claims);
+    return this;
+  }
+
+  public route(kind: CultMeshLocalityKind, description?: string): this {
+    this.#routeHint = cultMeshRouteHint(kind, description);
+    return this;
+  }
+
+  public idempotency(key: string): this {
+    requireNonEmpty(key, "idempotencyKey");
+    this.#idempotencyKey = key;
+    return this;
+  }
+
+  public build(): CultMeshOperationContext {
+    return cultMeshOperationContext(this.#runtimeId, {
+      claims: this.#claims,
+      routeHint: this.#routeHint,
+      idempotencyKey: this.#idempotencyKey,
+    });
+  }
+}
+
+export class CultMeshQueryContextBuilder {
+  readonly #runtimeId: string;
+  #routeHint: CultMeshRouteHint = cultMeshRouteHint();
+
+  public constructor(runtimeId: string) {
+    requireNonEmpty(runtimeId, "runtimeId");
+    this.#runtimeId = runtimeId;
+  }
+
+  public route(kind: CultMeshLocalityKind, description?: string): this {
+    this.#routeHint = cultMeshRouteHint(kind, description);
+    return this;
+  }
+
+  public build(): CultMeshQueryContext {
+    return cultMeshQueryContext(this.#runtimeId, {
+      routeHint: this.#routeHint,
+    });
+  }
+}
+
+export class CultMeshVerse {
+  public constructor(public readonly context: CultMeshVerseContext) {
+    requireNonEmpty(context.verseId, "verseId");
+    requireNonEmpty(context.runtimeId, "runtimeId");
+  }
+
+  public get verseId(): string {
+    return this.context.verseId;
+  }
+
+  public get runtimeId(): string {
+    return this.context.runtimeId;
+  }
+
+  public use<TSchema>(schemaFactory: (context: CultMeshVerseContext) => TSchema): TSchema {
+    return schemaFactory(this.context);
+  }
+
+  public withRoute(kind: CultMeshLocalityKind, description?: string): CultMeshVerse {
+    return new CultMeshVerse({
+      ...this.context,
+      routeHint: cultMeshRouteHint(kind, description),
+    });
+  }
+
+  public withClaim(role: string, options: { shardId?: string; leaseId?: string } = {}): CultMeshVerse {
+    return new CultMeshVerse({
+      ...this.context,
+      claims: [...this.context.claims, cultMeshAuthorityClaim(role, options)],
+    });
+  }
+
+  public operationContext(options: { idempotencyKey?: string } = {}): CultMeshOperationContext {
+    return cultMeshOperationContextFromVerse(this.context, options);
+  }
+
+  public queryContext(): CultMeshQueryContext {
+    return cultMeshQueryContextFromVerse(this.context);
+  }
+
+  public bindOperation<TRequest, TResponse>(
+    operation: CultMeshOperationHandle<TRequest, TResponse>,
+  ): CultMeshBoundOperationHandle<TRequest, TResponse> {
+    return cultMeshBindOperation(this.context, operation);
+  }
+
+  public bindQuery<TParameters, TResult>(
+    query: CultMeshQuerySurface<TParameters, TResult>,
+  ): CultMeshBoundQuerySurface<TParameters, TResult> {
+    return cultMeshBindQuery(this.context, query);
+  }
+
+  public bindLiveFeed<TParameters, TResult>(
+    feed: CultMeshLiveFeed<TParameters, TResult>,
+  ): CultMeshBoundLiveFeed<TParameters, TResult> {
+    return cultMeshBindLiveFeed(this.context, feed);
+  }
+
+  public bindDocument<TDocument>(
+    document: CultMeshDocumentHandle<TDocument>,
+  ): CultMeshBoundDocumentHandle<TDocument> {
+    return cultMeshBindDocument(this.context, document);
+  }
+
+  public bindCollection<TDocument>(
+    collection: CultMeshCollectionHandle<TDocument>,
+  ): CultMeshBoundCollectionHandle<TDocument> {
+    return cultMeshBindCollection(this.context, collection);
+  }
+
+  public bindStatePointer<T>(
+    pointer: CultMeshStatePointer<T>,
+  ): CultMeshBoundStatePointer<T> {
+    return cultMeshBindStatePointer(this.context, pointer);
+  }
+
+  public bindMutableStatePointer<T>(
+    pointer: CultMeshMutableStatePointer<T>,
+  ): CultMeshBoundMutableStatePointer<T> {
+    return cultMeshBindMutableStatePointer(this.context, pointer);
+  }
+}
+
+export class CultMeshOperationHandle<TRequest, TResponse> {
+  public constructor(
+    public readonly operationId: string,
+    private readonly invokeOperation: (
+      request: TRequest,
+      context: CultMeshOperationContext,
+    ) => Promise<TResponse>,
+  ) {
+    requireNonEmpty(operationId, "operationId");
+  }
+
+  public invoke(
+    request: TRequest,
+    context: CultMeshOperationContext | string,
+  ): Promise<TResponse> {
+    return this.invokeOperation(
+      request,
+      typeof context === "string" ? cultMeshOperationContext(context) : context,
+    );
+  }
+
+  public bind(
+    verse: CultMeshVerseContext | CultMeshVerse,
+  ): CultMeshBoundOperationHandle<TRequest, TResponse> {
+    return cultMeshBindOperation(verse, this);
+  }
+}
+
+export class CultMeshBoundOperationHandle<TRequest, TResponse> {
+  public constructor(
+    public readonly verse: CultMeshVerseContext,
+    public readonly operation: CultMeshOperationHandle<TRequest, TResponse>,
+  ) {}
+
+  public get operationId(): string {
+    return this.operation.operationId;
+  }
+
+  public invoke(
+    request: TRequest,
+    options: { idempotencyKey?: string } = {},
+  ): Promise<TResponse> {
+    return this.operation.invoke(
+      request,
+      cultMeshOperationContextFromVerse(this.verse, options),
+    );
+  }
+}
+
+export class CultMeshQuerySurface<TParameters, TResult> {
+  public readonly sources: readonly CultMeshProjectionSource[];
+  public readonly routeHint: CultMeshRouteHint;
+
+  public constructor(
+    public readonly queryId: string,
+    private readonly executeQuery: (
+      parameters: TParameters,
+      context: CultMeshQueryContext,
+    ) => Promise<TResult>,
+    options: {
+      sources?: readonly CultMeshProjectionSource[];
+      routeHint?: CultMeshRouteHint;
+      watchQuery?: CultMeshQueryWatcher<TParameters, TResult>;
+    } = {},
+  ) {
+    requireNonEmpty(queryId, "queryId");
+    this.sources = [...(options.sources ?? [])];
+    this.routeHint = options.routeHint ?? cultMeshRouteHint();
+    this.watchQuery = options.watchQuery;
+  }
+
+  private readonly watchQuery: CultMeshQueryWatcher<TParameters, TResult> | undefined;
+
+  public execute(
+    parameters: TParameters,
+    context: CultMeshQueryContext | string,
+  ): Promise<TResult> {
+    return this.executeQuery(
+      parameters,
+      typeof context === "string" ? cultMeshQueryContext(context) : context,
+    );
+  }
+
+  public query(parameters: TParameters, context: CultMeshQueryContext | string): Promise<TResult> {
+    return this.execute(parameters, context);
+  }
+
+  public watch(
+    parameters: TParameters,
+    context: CultMeshQueryContext | string,
+    callback: (value: TResult) => void,
+  ): CultMeshUnsubscribe {
+    if (!this.watchQuery) {
+      throw new Error(`Query surface '${this.queryId}' does not support watches.`);
+    }
+
+    return this.watchQuery(
+      parameters,
+      typeof context === "string" ? cultMeshQueryContext(context) : context,
+      callback,
+    );
+  }
+
+  public bind(
+    verse: CultMeshVerseContext | CultMeshVerse,
+  ): CultMeshBoundQuerySurface<TParameters, TResult> {
+    return cultMeshBindQuery(verse, this);
+  }
+}
+
+export class CultMeshBoundQuerySurface<TParameters, TResult> {
+  public constructor(
+    public readonly verse: CultMeshVerseContext,
+    public readonly query: CultMeshQuerySurface<TParameters, TResult>,
+  ) {}
+
+  public get queryId(): string {
+    return this.query.queryId;
+  }
+
+  public get sources(): readonly CultMeshProjectionSource[] {
+    return this.query.sources;
+  }
+
+  public get routeHint(): CultMeshRouteHint {
+    return this.query.routeHint;
+  }
+
+  public execute(parameters: TParameters): Promise<TResult> {
+    return this.query.execute(parameters, cultMeshQueryContextFromVerse(this.verse));
+  }
+
+  public queryOnce(parameters: TParameters): Promise<TResult> {
+    return this.execute(parameters);
+  }
+
+  public watch(
+    parameters: TParameters,
+    callback: (value: TResult) => void,
+  ): CultMeshUnsubscribe {
+    return this.query.watch(parameters, cultMeshQueryContextFromVerse(this.verse), callback);
+  }
+}
+
+export class CultMeshLiveFeed<TParameters, TResult> {
+  public readonly sources: readonly CultMeshProjectionSource[];
+  public readonly routeHint: CultMeshRouteHint;
+
+  public constructor(
+    public readonly feedId: string,
+    private readonly snapshotFeed: (
+      parameters: TParameters,
+      context: CultMeshQueryContext,
+    ) => Promise<TResult>,
+    options: {
+      sources?: readonly CultMeshProjectionSource[];
+      routeHint?: CultMeshRouteHint;
+      watchFeed?: CultMeshLiveFeedWatcher<TParameters, TResult>;
+    } = {},
+  ) {
+    requireNonEmpty(feedId, "feedId");
+    this.sources = [...(options.sources ?? [])];
+    this.routeHint = options.routeHint ?? cultMeshRouteHint();
+    this.watchFeed = options.watchFeed;
+  }
+
+  private readonly watchFeed: CultMeshLiveFeedWatcher<TParameters, TResult> | undefined;
+
+  public snapshot(
+    parameters: TParameters,
+    context: CultMeshQueryContext | string,
+  ): Promise<TResult> {
+    return this.snapshotFeed(
+      parameters,
+      this.resolveContext(typeof context === "string" ? cultMeshQueryContext(context) : context),
+    );
+  }
+
+  public watch(
+    parameters: TParameters,
+    context: CultMeshQueryContext | string,
+    callback: (value: TResult) => void,
+  ): CultMeshUnsubscribe {
+    if (!this.watchFeed) {
+      throw new Error(`Live feed '${this.feedId}' does not support watches.`);
+    }
+
+    return this.watchFeed(
+      parameters,
+      this.resolveContext(typeof context === "string" ? cultMeshQueryContext(context) : context),
+      callback,
+    );
+  }
+
+  public bind(
+    verse: CultMeshVerseContext | CultMeshVerse,
+  ): CultMeshBoundLiveFeed<TParameters, TResult> {
+    return cultMeshBindLiveFeed(verse, this);
+  }
+
+  private resolveContext(context: CultMeshQueryContext): CultMeshQueryContext {
+    if (context.routeHint.kind !== "automatic" || this.routeHint.kind === "automatic") {
+      return context;
+    }
+
+    return cultMeshQueryContext(context.runtimeId, {
+      routeHint: this.routeHint,
+    });
+  }
+}
+
+export class CultMeshBoundLiveFeed<TParameters, TResult> {
+  public constructor(
+    public readonly verse: CultMeshVerseContext,
+    public readonly feed: CultMeshLiveFeed<TParameters, TResult>,
+  ) {}
+
+  public get feedId(): string {
+    return this.feed.feedId;
+  }
+
+  public get sources(): readonly CultMeshProjectionSource[] {
+    return this.feed.sources;
+  }
+
+  public get routeHint(): CultMeshRouteHint {
+    return this.feed.routeHint;
+  }
+
+  public snapshot(parameters: TParameters): Promise<TResult> {
+    return this.feed.snapshot(parameters, cultMeshQueryContextFromVerse(this.verse));
+  }
+
+  public watch(
+    parameters: TParameters,
+    callback: (value: TResult) => void,
+  ): CultMeshUnsubscribe {
+    return this.feed.watch(parameters, cultMeshQueryContextFromVerse(this.verse), callback);
+  }
+}
+
+export class CultMeshDocumentHandle<TDocument> {
+  public readonly schema: CultMeshDocumentSchemaDescriptor;
+  public readonly sources: readonly CultMeshProjectionSource[];
+  public readonly routeHint: CultMeshRouteHint;
+
+  public constructor(
+    public readonly documentId: string,
+    schema: CultMeshDocumentSchemaDescriptor,
+    private readonly snapshotDocument: (context: CultMeshQueryContext) => Promise<TDocument>,
+    options: {
+      sources?: readonly CultMeshProjectionSource[];
+      routeHint?: CultMeshRouteHint;
+      watchDocument?: CultMeshDocumentWatcher<TDocument>;
+      replaceDocument?: CultMeshDocumentReplacer<TDocument>;
+      submitPrediction?: CultMeshDocumentPredictionSubmitter<TDocument>;
+    } = {},
+  ) {
+    requireNonEmpty(documentId, "documentId");
+    this.schema = normalizeCultMeshDocumentSchema(schema);
+    this.sources = [...(options.sources ?? [])];
+    this.routeHint = options.routeHint ?? cultMeshRouteHint();
+    this.watchDocument = options.watchDocument;
+    this.replaceDocument = options.replaceDocument;
+    this.submitPredictionDocument = options.submitPrediction;
+  }
+
+  private readonly watchDocument: CultMeshDocumentWatcher<TDocument> | undefined;
+  private readonly replaceDocument: CultMeshDocumentReplacer<TDocument> | undefined;
+  private readonly submitPredictionDocument:
+    | CultMeshDocumentPredictionSubmitter<TDocument>
+    | undefined;
+
+  public get canReplace(): boolean {
+    return this.replaceDocument !== undefined;
+  }
+
+  public get canSubmitPrediction(): boolean {
+    return this.submitPredictionDocument !== undefined;
+  }
+
+  public latest(context: CultMeshQueryContext | string = "local"): Promise<TDocument> {
+    return this.snapshotDocument(
+      this.resolveContext(typeof context === "string" ? cultMeshQueryContext(context) : context),
+    );
+  }
+
+  public read(context: CultMeshQueryContext | string = "local"): Promise<TDocument> {
+    return this.latest(context);
+  }
+
+  public watch(callback: (value: TDocument) => void): CultMeshUnsubscribe;
+  public watch(context: CultMeshQueryContext | string, callback: (value: TDocument) => void): CultMeshUnsubscribe;
+  public watch(
+    contextOrCallback: CultMeshQueryContext | string | ((value: TDocument) => void),
+    maybeCallback?: (value: TDocument) => void,
+  ): CultMeshUnsubscribe {
+    if (!this.watchDocument) {
+      throw new Error(`Document '${this.documentId}' does not support watches.`);
+    }
+
+    const callback =
+      typeof contextOrCallback === "function" ? contextOrCallback : maybeCallback;
+    if (!callback) {
+      throw new Error(`Document '${this.documentId}' requires a watch callback.`);
+    }
+
+    const context =
+      typeof contextOrCallback === "function"
+        ? cultMeshQueryContext("local")
+        : typeof contextOrCallback === "string"
+          ? cultMeshQueryContext(contextOrCallback)
+          : contextOrCallback;
+
+    return this.watchDocument(this.resolveContext(context), callback);
+  }
+
+  public replace(value: TDocument): Promise<void>;
+  public replace(context: CultMeshQueryContext | string, value: TDocument): Promise<void>;
+  public replace(
+    contextOrValue: CultMeshQueryContext | string | TDocument,
+    maybeValue?: TDocument,
+  ): Promise<void> {
+    if (!this.replaceDocument) {
+      throw new Error(`Document '${this.documentId}' does not support replacement.`);
+    }
+
+    const hasContext =
+      typeof contextOrValue === "string" || isCultMeshQueryContext(contextOrValue);
+    const context = hasContext
+      ? typeof contextOrValue === "string"
+        ? cultMeshQueryContext(contextOrValue)
+        : contextOrValue as CultMeshQueryContext
+      : cultMeshQueryContext("local");
+    const value = hasContext ? maybeValue : contextOrValue as TDocument;
+    if (value === undefined) {
+      throw new Error(`Document '${this.documentId}' requires a replacement value.`);
+    }
+
+    return this.replaceDocument(this.resolveContext(context), value);
+  }
+
+  public submitPrediction(value: TDocument): Promise<void>;
+  public submitPrediction(context: CultMeshQueryContext | string, value: TDocument): Promise<void>;
+  public submitPrediction(
+    contextOrValue: CultMeshQueryContext | string | TDocument,
+    maybeValue?: TDocument,
+  ): Promise<void> {
+    if (!this.submitPredictionDocument) {
+      throw new Error(`Document '${this.documentId}' does not support prediction submission.`);
+    }
+
+    const hasContext =
+      typeof contextOrValue === "string" || isCultMeshQueryContext(contextOrValue);
+    const context = hasContext
+      ? typeof contextOrValue === "string"
+        ? cultMeshQueryContext(contextOrValue)
+        : contextOrValue as CultMeshQueryContext
+      : cultMeshQueryContext("local");
+    const value = hasContext ? maybeValue : contextOrValue as TDocument;
+    if (value === undefined) {
+      throw new Error(`Document '${this.documentId}' requires a prediction value.`);
+    }
+
+    return this.submitPredictionDocument(this.resolveContext(context), value);
+  }
+
+  public authoritativeWriter(
+    context: CultMeshQueryContext | string = "local",
+  ): CultMeshDocumentWriter<TDocument & object> {
+    if (!this.replaceDocument) {
+      throw new Error(`Document '${this.documentId}' does not support authoritative replacement.`);
+    }
+    const resolved = this.resolveContext(
+      typeof context === "string" ? cultMeshQueryContext(context) : context,
+    );
+    return new CultMeshDocumentWriter(
+      this as unknown as CultMeshDocumentHandle<TDocument & object>,
+      "authoritative-replacement",
+      resolved,
+      value => this.replaceDocument!(resolved, value as unknown as TDocument),
+    );
+  }
+
+  public predictionWriter(
+    context: CultMeshQueryContext | string = "local",
+  ): CultMeshDocumentWriter<TDocument & object> {
+    if (!this.submitPredictionDocument) {
+      throw new Error(`Document '${this.documentId}' does not support prediction submission.`);
+    }
+    const resolved = this.resolveContext(
+      typeof context === "string" ? cultMeshQueryContext(context) : context,
+    );
+    return new CultMeshDocumentWriter(
+      this as unknown as CultMeshDocumentHandle<TDocument & object>,
+      "prediction",
+      resolved,
+      value => this.submitPredictionDocument!(resolved, value as unknown as TDocument),
+    );
+  }
+
+  public observe<TObject extends TDocument & object>(
+    options: CultMeshReactiveDocumentOptions = {},
+  ): CultMeshObservedDocument<TObject> {
+    return new CultMeshObservedDocumentHandle<TObject>(
+      this as unknown as CultMeshDocumentHandle<TObject>,
+      options,
+    );
+  }
+
+  public asSchemaAlias<TAlias>(
+    schema: CultMeshDocumentSchemaDescriptor,
+    options: { parse?: (value: unknown) => TAlias } = {},
+  ): CultMeshDocumentHandle<TAlias> {
+    const aliasSchema = normalizeCultMeshDocumentSchema(schema);
+    if (!cultMeshSchemasAreCompatible(this.schema, aliasSchema)) {
+      throw new Error(
+        `Document '${this.documentId}' schema ${cultMeshSchemaLabel(this.schema)} is not compatible with alias ${cultMeshSchemaLabel(aliasSchema)}.`,
+      );
+    }
+
+    const parse = options.parse ?? ((value: unknown) => value as TAlias);
+    return new CultMeshDocumentHandle<TAlias>(
+      this.documentId,
+      aliasSchema,
+      async (context) => parse(await this.latest(context)),
+      {
+        sources: this.sources,
+        routeHint: this.routeHint,
+        watchDocument: this.watchDocument
+          ? (context, callback) => this.watch(context, value => callback(parse(value)))
+          : undefined,
+        replaceDocument: this.replaceDocument
+          ? (context, value) => this.replace(context, value as unknown as TDocument)
+          : undefined,
+        submitPrediction: this.submitPredictionDocument
+          ? (context, value) => this.submitPrediction(context, value as unknown as TDocument)
+          : undefined,
+      },
+    );
+  }
+
+  public bind(verse: CultMeshVerseContext | CultMeshVerse): CultMeshBoundDocumentHandle<TDocument> {
+    return cultMeshBindDocument(verse, this);
+  }
+
+  private resolveContext(context: CultMeshQueryContext): CultMeshQueryContext {
+    if (context.routeHint.kind !== "automatic" || this.routeHint.kind === "automatic") {
+      return context;
+    }
+
+    return cultMeshQueryContext(context.runtimeId, {
+      routeHint: this.routeHint,
+    });
+  }
+}
+
+export class CultMeshDocumentWriter<TDocument extends object> {
+  public constructor(
+    public readonly document: CultMeshDocumentHandle<TDocument>,
+    public readonly kind: CultMeshDocumentWriteKind,
+    public readonly context: CultMeshQueryContext,
+    private readonly writeDocument: (value: TDocument) => Promise<void>,
+  ) {}
+
+  public write(value: TDocument): Promise<void> {
+    return this.writeDocument(cloneCultMeshDocument(value));
+  }
+
+  public async update(update: CultMeshDocumentUpdater<TDocument>): Promise<TDocument> {
+    const next = await update(cloneCultMeshDocument(await this.document.latest(this.context)));
+    await this.write(next);
+    return next;
+  }
+
+  public reactive(
+    options: Omit<CultMeshReactiveDocumentOptions, "context"> = {},
+  ): CultMeshReactiveDocument<TDocument> {
+    return new CultMeshReactiveDocumentHandle(this, options);
+  }
+}
+
+class CultMeshObservedDocumentHandle<TDocument extends object>
+  implements CultMeshObservedDocument<TDocument> {
+  readonly #document: CultMeshDocumentHandle<TDocument>;
+  readonly #context: CultMeshQueryContext | string;
+  readonly #onError: (error: unknown) => void;
+  #canonicalVersion = 0;
+  #current = {} as TDocument;
+  #disposed = false;
+  #unsubscribe: CultMeshUnsubscribe | undefined;
+
+  public readonly ready: Promise<TDocument>;
+
+  public constructor(
+    document: CultMeshDocumentHandle<TDocument>,
+    options: CultMeshReactiveDocumentOptions = {},
+  ) {
+    this.#document = document;
+    this.#context = options.context ?? "local";
+    this.#onError = options.onError ?? ((error) => {
+      queueMicrotask(() => {
+        throw error;
+      });
+    });
+    this.ready = this.refresh();
+    if (options.watch !== false) {
+      try {
+        this.#unsubscribe = document.watch(this.#context, value => {
+          this.#current = cloneCultMeshDocument(value);
+          this.#canonicalVersion++;
+        });
+      } catch (error) {
+        this.#onError(error);
+      }
+    }
+  }
+
+  public get current(): TDocument {
+    this.throwIfDisposed();
+    return this.#current;
+  }
+
+  public get disposed(): boolean {
+    return this.#disposed;
+  }
+
+  public async refresh(): Promise<TDocument> {
+    this.throwIfDisposed();
+    const versionBeforeRead = this.#canonicalVersion;
+    const latest = cloneCultMeshDocument(await this.#document.latest(this.#context));
+    if (versionBeforeRead === this.#canonicalVersion) {
+      this.#current = latest;
+      this.#canonicalVersion++;
+    }
+    return this.#current;
+  }
+
+  public dispose(): void {
+    if (this.#disposed) return;
+    this.#disposed = true;
+    this.#unsubscribe?.();
+    this.#unsubscribe = undefined;
+  }
+
+  private throwIfDisposed(): void {
+    if (this.#disposed) {
+      throw new Error(`Observed document '${this.#document.documentId}' is disposed.`);
+    }
+  }
+}
+
+class CultMeshReactiveDocumentHandle<TDocument extends object>
+  implements CultMeshReactiveDocument<TDocument> {
+  readonly #writer: CultMeshDocumentWriter<TDocument>;
+  readonly #document: CultMeshDocumentHandle<TDocument>;
+  readonly #onError: (error: unknown) => void;
+  readonly #debounceMs: number;
+  readonly #replaceDirtyCurrentOnCanonicalSnapshot: boolean;
+  #current = {} as TDocument;
+  #disposed = false;
+  #pendingSet: Promise<void> = Promise.resolve();
+  #flushScheduled = false;
+  #cancelScheduledFlush: (() => void) | undefined;
+  #unsubscribe: CultMeshUnsubscribe | undefined;
+  #dirty = false;
+  #lastPredicted: TDocument | undefined;
+  #reconciliation: CultMeshReactiveDocumentReconciliation<TDocument> | undefined;
+  #reconciliationVersion = 0;
+  #canonicalVersion = 0;
+
+  public readonly ready: Promise<TDocument>;
+
+  public constructor(
+    writer: CultMeshDocumentWriter<TDocument>,
+    options: Omit<CultMeshReactiveDocumentOptions, "context"> = {},
+  ) {
+    this.#writer = writer;
+    this.#document = writer.document;
+    this.#debounceMs = options.debounceMs ?? 0;
+    this.#replaceDirtyCurrentOnCanonicalSnapshot =
+      options.replaceDirtyCurrentOnCanonicalSnapshot ?? false;
+    this.#onError = options.onError ?? ((error) => {
+      queueMicrotask(() => {
+        throw error;
+      });
+    });
+    this.ready = this.refresh();
+
+    if (options.watch !== false) {
+      try {
+        this.#unsubscribe = this.#document.watch(this.#writer.context, value => {
+          this.applySnapshot(value);
+        });
+      } catch (error) {
+        this.#onError(error);
+      }
+    }
+  }
+
+  public get writer(): CultMeshDocumentWriter<TDocument> {
+    return this.#writer;
+  }
+
+  public get snapshot(): TDocument {
+    this.throwIfDisposed();
+    return cloneCultMeshDocument(this.#current);
+  }
+
+  public get dirty(): boolean {
+    return this.#dirty;
+  }
+
+  public get reconciliation(): CultMeshReactiveDocumentReconciliation<TDocument> | undefined {
+    return this.#reconciliation;
+  }
+
+  public get disposed(): boolean {
+    return this.#disposed;
+  }
+
+  public async refresh(): Promise<TDocument> {
+    this.throwIfDisposed();
+    const versionBeforeRead = this.#canonicalVersion;
+    const latest = await this.#document.latest(this.#writer.context);
+    if (versionBeforeRead === this.#canonicalVersion) {
+      this.applySnapshot(latest);
+    }
+    return this.snapshot;
+  }
+
+  public update(update: (draft: TDocument) => void | TDocument): TDocument {
+    this.throwIfDisposed();
+    const draft = cloneCultMeshDocument(this.#current);
+    const returned = update(draft);
+    this.#current = cloneCultMeshDocument(returned ?? draft);
+    this.#dirty = true;
+    this.queueSet();
+    return this.snapshot;
+  }
+
+  public replaceLocal(value: TDocument): TDocument {
+    this.throwIfDisposed();
+    this.#current = cloneCultMeshDocument(value);
+    this.#dirty = true;
+    this.queueSet();
+    return this.snapshot;
+  }
+
+  public async flush(): Promise<void> {
+    this.throwIfDisposed();
+    this.flushNow();
+    await this.#pendingSet;
+  }
+
+  public clearReconciliation(): void {
+    this.#reconciliation = undefined;
+  }
+
+  public dispose(): void {
+    this.#disposed = true;
+    this.#cancelScheduledFlush?.();
+    this.#cancelScheduledFlush = undefined;
+    this.#flushScheduled = false;
+    this.#unsubscribe?.();
+    this.#unsubscribe = undefined;
+  }
+
+  private applySnapshot(value: TDocument): void {
+    const canonical = cloneCultMeshDocument(value);
+    this.#canonicalVersion++;
+    this.captureReconciliation(canonical);
+    if (this.#dirty && !this.#replaceDirtyCurrentOnCanonicalSnapshot) {
+      return;
+    }
+    this.#current = canonical;
+    this.#dirty = false;
+  }
+
+  private captureReconciliation(canonical: TDocument): void {
+    if (!this.#lastPredicted) {
+      return;
+    }
+
+    const predicted = this.#lastPredicted;
+    const delta = createCultMeshReconciliationDelta(predicted, canonical) as
+      CultMeshReactiveDocumentDelta<TDocument>;
+    if (Reflect.ownKeys(delta).length === 0) {
+      this.#lastPredicted = undefined;
+      return;
+    }
+
+    this.#reconciliation = {
+      version: ++this.#reconciliationVersion,
+      canonical: cloneCultMeshDocument(canonical),
+      predicted: cloneCultMeshDocument(predicted),
+      delta,
+      receivedAtMs: Date.now(),
+    };
+    this.#lastPredicted = undefined;
+  }
+
+  private queueSet(): void {
+    if (this.#disposed) {
+      return;
+    }
+    if (this.#flushScheduled) {
+      return;
+    }
+
+    this.#flushScheduled = true;
+    const flush = () => this.flushNow();
+
+    const debounceMs = this.#debounceMs;
+    if (debounceMs > 0) {
+      const timer = setTimeout(flush, debounceMs);
+      this.#cancelScheduledFlush = () => clearTimeout(timer);
+      return;
+    }
+
+    const requestFrame = (globalThis as {
+      requestAnimationFrame?: (callback: FrameRequestCallback) => number;
+      cancelAnimationFrame?: (handle: number) => void;
+    }).requestAnimationFrame;
+    if (typeof requestFrame === "function") {
+      const frame = requestFrame(() => flush());
+      const cancelFrame = (globalThis as {
+        cancelAnimationFrame?: (handle: number) => void;
+      }).cancelAnimationFrame;
+      this.#cancelScheduledFlush = typeof cancelFrame === "function"
+        ? () => cancelFrame(frame)
+        : undefined;
+      return;
+    }
+
+    let cancelled = false;
+    queueMicrotask(() => {
+      if (!cancelled) flush();
+    });
+    this.#cancelScheduledFlush = () => { cancelled = true; };
+  }
+
+  private flushNow(): void {
+    if (!this.#flushScheduled && !this.#dirty) return;
+    this.#flushScheduled = false;
+    this.#cancelScheduledFlush?.();
+    this.#cancelScheduledFlush = undefined;
+    if (this.#disposed || !this.#dirty) return;
+    const snapshot = cloneCultMeshDocument(this.#current);
+    this.#dirty = false;
+    this.#lastPredicted = snapshot;
+    this.#pendingSet = this.#pendingSet
+      .catch(() => undefined)
+      .then(() => this.#writer.write(snapshot))
+      .catch(error => this.#onError(error));
+  }
+
+  private throwIfDisposed(): void {
+    if (this.#disposed) {
+      throw new Error(`Reactive document '${this.#document.documentId}' is disposed.`);
+    }
+  }
+}
+
+function cloneCultMeshDocument<TDocument>(value: TDocument): TDocument {
+  if (typeof structuredClone === "function") {
+    try {
+      return structuredClone(value);
+    } catch (error) {
+      if ((error as { name?: string }).name !== "DataCloneError") {
+        throw error;
+      }
+    }
+  }
+  return JSON.parse(JSON.stringify(value)) as TDocument;
+}
+
+function createCultMeshReconciliationDelta<TDocument extends object>(
+  predicted: TDocument,
+  canonical: TDocument,
+): Partial<Record<keyof TDocument, unknown>> {
+  const delta: Partial<Record<keyof TDocument, unknown>> = {};
+  const keys = new Set([
+    ...Reflect.ownKeys(predicted),
+    ...Reflect.ownKeys(canonical),
+  ]);
+
+  for (const key of keys) {
+    const predictedValue = Reflect.get(predicted, key);
+    const canonicalValue = Reflect.get(canonical, key);
+    if (cultMeshValuesEqual(predictedValue, canonicalValue)) {
+      continue;
+    }
+
+    const deltaKey = key as keyof TDocument;
+    delta[deltaKey] =
+      typeof predictedValue === "number" && typeof canonicalValue === "number"
+        ? predictedValue - canonicalValue
+        : predictedValue;
+  }
+
+  return delta;
+}
+
+function cultMeshValuesEqual(left: unknown, right: unknown): boolean {
+  if (Object.is(left, right)) {
+    return true;
+  }
+  if (typeof left !== "object" || left === null ||
+      typeof right !== "object" || right === null) {
+    return false;
+  }
+
+  return JSON.stringify(left) === JSON.stringify(right);
+}
+
+export class CultMeshBoundDocumentHandle<TDocument> {
+  public constructor(
+    public readonly verse: CultMeshVerseContext,
+    public readonly document: CultMeshDocumentHandle<TDocument>,
+  ) {}
+
+  public get documentId(): string {
+    return this.document.documentId;
+  }
+
+  public get schema(): CultMeshDocumentSchemaDescriptor {
+    return this.document.schema;
+  }
+
+  public get canReplace(): boolean {
+    return this.document.canReplace;
+  }
+
+  public get canSubmitPrediction(): boolean {
+    return this.document.canSubmitPrediction;
+  }
+
+  public latest(): Promise<TDocument> {
+    return this.document.latest(cultMeshQueryContextFromVerse(this.verse));
+  }
+
+  public read(): Promise<TDocument> {
+    return this.latest();
+  }
+
+  public watch(callback: (value: TDocument) => void): CultMeshUnsubscribe {
+    return this.document.watch(cultMeshQueryContextFromVerse(this.verse), callback);
+  }
+
+  public replace(value: TDocument): Promise<void> {
+    return this.document.replace(cultMeshQueryContextFromVerse(this.verse), value);
+  }
+
+  public submitPrediction(value: TDocument): Promise<void> {
+    return this.document.submitPrediction(cultMeshQueryContextFromVerse(this.verse), value);
+  }
+
+  public authoritativeWriter(): CultMeshDocumentWriter<TDocument & object> {
+    return this.document.authoritativeWriter(cultMeshQueryContextFromVerse(this.verse));
+  }
+
+  public predictionWriter(): CultMeshDocumentWriter<TDocument & object> {
+    return this.document.predictionWriter(cultMeshQueryContextFromVerse(this.verse));
+  }
+
+  public observe<TObject extends TDocument & object>(
+    options: Omit<CultMeshReactiveDocumentOptions, "context"> = {},
+  ): CultMeshObservedDocument<TObject> {
+    return this.document.observe<TObject>({
+      ...options,
+      context: cultMeshQueryContextFromVerse(this.verse),
+    });
+  }
+
+  public asSchemaAlias<TAlias>(
+    schema: CultMeshDocumentSchemaDescriptor,
+    options: { parse?: (value: unknown) => TAlias } = {},
+  ): CultMeshBoundDocumentHandle<TAlias> {
+    return cultMeshBindDocument(this.verse, this.document.asSchemaAlias(schema, options));
+  }
+}
+
+export class CultMeshDocumentCatalog {
+  readonly #byDocumentId = new Map<string, CultMeshDocumentHandle<any>>();
+  readonly #byType = new Map<string, CultMeshDocumentHandle<any>>();
+  readonly #bySchemaId = new Map<string, CultMeshDocumentHandle<any>>();
+  readonly #bySchemaNameVersion = new Map<string, CultMeshDocumentHandle<any>>();
+
+  public constructor(documents: Iterable<CultMeshDocumentHandle<any>>) {
+    for (const document of documents) {
+      this.add(document);
+    }
+  }
+
+  public get documents(): readonly CultMeshDocumentHandle<any>[] {
+    return [...this.#byDocumentId.values()];
+  }
+
+  public add<TDocument>(document: CultMeshDocumentHandle<TDocument>): this {
+    this.#byDocumentId.set(document.documentId, document as CultMeshDocumentHandle<any>);
+    if (document.schema.type) {
+      this.#byType.set(document.schema.type, document as CultMeshDocumentHandle<any>);
+    }
+    if (document.schema.schemaId) {
+      this.#bySchemaId.set(document.schema.schemaId, document as CultMeshDocumentHandle<any>);
+    }
+    const key = cultMeshSchemaNameVersionKey(document.schema);
+    if (key) {
+      this.#bySchemaNameVersion.set(key, document as CultMeshDocumentHandle<any>);
+    }
+    return this;
+  }
+
+  public tryDocument<TDocument>(
+    schema: CultMeshDocumentSchemaDescriptor,
+    options: { parse?: (value: unknown) => TDocument } = {},
+  ): CultMeshDocumentHandle<TDocument> | undefined {
+    const descriptor = normalizeCultMeshDocumentSchema(schema);
+    const exact =
+      (descriptor.type ? this.#byType.get(descriptor.type) : undefined) ??
+      (descriptor.schemaId ? this.#bySchemaId.get(descriptor.schemaId) : undefined) ??
+      (() => {
+        const key = cultMeshSchemaNameVersionKey(descriptor);
+        return key ? this.#bySchemaNameVersion.get(key) : undefined;
+      })();
+
+    if (!exact) {
+      return undefined;
+    }
+
+    return cultMeshSchemasAreCompatible(exact.schema, descriptor)
+      ? exact.asSchemaAlias(descriptor, options)
+      : undefined;
+  }
+
+  public document<TDocument>(
+    schema: CultMeshDocumentSchemaDescriptor,
+    options: { parse?: (value: unknown) => TDocument } = {},
+  ): CultMeshDocumentHandle<TDocument> {
+    const document = this.tryDocument(schema, options);
+    if (!document) {
+      throw new Error(`Document catalog has no document for ${cultMeshSchemaLabel(schema)}.`);
+    }
+    return document;
+  }
+
+  public latest<TDocument>(
+    schema: CultMeshDocumentSchemaDescriptor,
+    context: CultMeshQueryContext | string = "local",
+    options: { parse?: (value: unknown) => TDocument } = {},
+  ): Promise<TDocument> {
+    return this.document(schema, options).latest(context);
+  }
+
+  public canReplace(schema: CultMeshDocumentSchemaDescriptor): boolean {
+    return this.tryDocument(schema)?.canReplace ?? false;
+  }
+
+  public replace<TDocument>(
+    schema: CultMeshDocumentSchemaDescriptor,
+    value: TDocument,
+    options?: { parse?: (value: unknown) => TDocument; context?: CultMeshQueryContext | string },
+  ): Promise<void>;
+  public replace<TDocument>(
+    schema: CultMeshDocumentSchemaDescriptor,
+    context: CultMeshQueryContext | string,
+    value: TDocument,
+    options?: { parse?: (value: unknown) => TDocument },
+  ): Promise<void>;
+  public replace<TDocument>(
+    schema: CultMeshDocumentSchemaDescriptor,
+    contextOrValue: CultMeshQueryContext | string | TDocument,
+    valueOrOptions?: TDocument | { parse?: (value: unknown) => TDocument; context?: CultMeshQueryContext | string },
+    maybeOptions: { parse?: (value: unknown) => TDocument } = {},
+  ): Promise<void> {
+    const hasContext =
+      typeof contextOrValue === "string" || isCultMeshQueryContext(contextOrValue);
+    const context = hasContext
+      ? contextOrValue as CultMeshQueryContext | string
+      : (valueOrOptions as { context?: CultMeshQueryContext | string } | undefined)?.context ?? "local";
+    const value = hasContext ? valueOrOptions as TDocument : contextOrValue as TDocument;
+    const options = hasContext ? maybeOptions : valueOrOptions as { parse?: (value: unknown) => TDocument } | undefined;
+    return this.document(schema, options).replace(context, value);
+  }
+
+  public canSubmitPrediction(schema: CultMeshDocumentSchemaDescriptor): boolean {
+    return this.tryDocument(schema)?.canSubmitPrediction ?? false;
+  }
+
+  public submitPrediction<TDocument>(
+    schema: CultMeshDocumentSchemaDescriptor,
+    value: TDocument,
+    options?: { parse?: (value: unknown) => TDocument; context?: CultMeshQueryContext | string },
+  ): Promise<void>;
+  public submitPrediction<TDocument>(
+    schema: CultMeshDocumentSchemaDescriptor,
+    context: CultMeshQueryContext | string,
+    value: TDocument,
+    options?: { parse?: (value: unknown) => TDocument },
+  ): Promise<void>;
+  public submitPrediction<TDocument>(
+    schema: CultMeshDocumentSchemaDescriptor,
+    contextOrValue: CultMeshQueryContext | string | TDocument,
+    valueOrOptions?: TDocument | { parse?: (value: unknown) => TDocument; context?: CultMeshQueryContext | string },
+    maybeOptions: { parse?: (value: unknown) => TDocument } = {},
+  ): Promise<void> {
+    const hasContext =
+      typeof contextOrValue === "string" || isCultMeshQueryContext(contextOrValue);
+    const context = hasContext
+      ? contextOrValue as CultMeshQueryContext | string
+      : (valueOrOptions as { context?: CultMeshQueryContext | string } | undefined)?.context ?? "local";
+    const value = hasContext ? valueOrOptions as TDocument : contextOrValue as TDocument;
+    const options = hasContext ? maybeOptions : valueOrOptions as { parse?: (value: unknown) => TDocument } | undefined;
+    return this.document(schema, options).submitPrediction(context, value);
+  }
+
+  public authoritativeWriter<TDocument extends object>(
+    schema: CultMeshDocumentSchemaDescriptor,
+    options: { parse?: (value: unknown) => TDocument; context?: CultMeshQueryContext | string } = {},
+  ): CultMeshDocumentWriter<TDocument> {
+    return this.document(schema, options).authoritativeWriter(options.context ?? "local");
+  }
+
+  public predictionWriter<TDocument extends object>(
+    schema: CultMeshDocumentSchemaDescriptor,
+    options: { parse?: (value: unknown) => TDocument; context?: CultMeshQueryContext | string } = {},
+  ): CultMeshDocumentWriter<TDocument> {
+    return this.document(schema, options).predictionWriter(options.context ?? "local");
+  }
+
+  public watch<TDocument>(
+    schema: CultMeshDocumentSchemaDescriptor,
+    callback: (value: TDocument) => void,
+    options: { parse?: (value: unknown) => TDocument; context?: CultMeshQueryContext | string } = {},
+  ): CultMeshUnsubscribe {
+    return this.document(schema, options).watch(options.context ?? "local", callback);
+  }
+}
+
+export class CultMeshCollectionHandle<TDocument> {
+  public readonly schema: CultMeshDocumentSchemaDescriptor;
+  public readonly sources: readonly CultMeshProjectionSource[];
+  public readonly routeHint: CultMeshRouteHint;
+
+  public constructor(
+    public readonly collectionId: string,
+    schema: CultMeshDocumentSchemaDescriptor,
+    private readonly snapshotCollection: (context: CultMeshQueryContext) => Promise<CultMeshCollectionSnapshot<TDocument>>,
+    options: {
+      sources?: readonly CultMeshProjectionSource[];
+      routeHint?: CultMeshRouteHint;
+      watchCollection?: CultMeshCollectionWatcher<TDocument>;
+    } = {},
+  ) {
+    requireNonEmpty(collectionId, "collectionId");
+    this.schema = normalizeCultMeshDocumentSchema(schema);
+    this.sources = [...(options.sources ?? [])];
+    this.routeHint = options.routeHint ?? cultMeshRouteHint();
+    this.watchCollection = options.watchCollection;
+  }
+
+  private readonly watchCollection: CultMeshCollectionWatcher<TDocument> | undefined;
+
+  public latest(context: CultMeshQueryContext | string = "local"): Promise<CultMeshCollectionSnapshot<TDocument>> {
+    return this.snapshotCollection(
+      this.resolveContext(typeof context === "string" ? cultMeshQueryContext(context) : context),
+    );
+  }
+
+  public watchChanges(callback: (change: CultMeshCollectionChange<TDocument>) => void): CultMeshUnsubscribe;
+  public watchChanges(
+    context: CultMeshQueryContext | string,
+    callback: (change: CultMeshCollectionChange<TDocument>) => void,
+  ): CultMeshUnsubscribe;
+  public watchChanges(
+    contextOrCallback:
+      | CultMeshQueryContext
+      | string
+      | ((change: CultMeshCollectionChange<TDocument>) => void),
+    maybeCallback?: (change: CultMeshCollectionChange<TDocument>) => void,
+  ): CultMeshUnsubscribe {
+    if (!this.watchCollection) {
+      throw new Error(`Collection '${this.collectionId}' does not support watches.`);
+    }
+
+    const callback =
+      typeof contextOrCallback === "function" ? contextOrCallback : maybeCallback;
+    if (!callback) {
+      throw new Error(`Collection '${this.collectionId}' requires a watch callback.`);
+    }
+
+    const context =
+      typeof contextOrCallback === "function"
+        ? cultMeshQueryContext("local")
+        : typeof contextOrCallback === "string"
+          ? cultMeshQueryContext(contextOrCallback)
+          : contextOrCallback;
+
+    return this.watchCollection(this.resolveContext(context), callback);
+  }
+
+  public asSchemaAlias<TAlias>(
+    schema: CultMeshDocumentSchemaDescriptor,
+    options: { parse?: (value: unknown) => TAlias } = {},
+  ): CultMeshCollectionHandle<TAlias> {
+    const aliasSchema = normalizeCultMeshDocumentSchema(schema);
+    if (!cultMeshSchemasAreCompatible(this.schema, aliasSchema)) {
+      throw new Error(
+        `Collection '${this.collectionId}' schema ${cultMeshSchemaLabel(this.schema)} is not compatible with alias ${cultMeshSchemaLabel(aliasSchema)}.`,
+      );
+    }
+
+    const parse = options.parse ?? ((value: unknown) => value as TAlias);
+    return new CultMeshCollectionHandle<TAlias>(
+      this.collectionId,
+      aliasSchema,
+      async (context) => (await this.latest(context)).map(value => parse(value)),
+      {
+        sources: this.sources,
+        routeHint: this.routeHint,
+        watchCollection: this.watchCollection
+          ? (context, callback) => this.watchChanges(context, change => callback({
+              ...change,
+              value: change.value === undefined ? undefined : parse(change.value),
+            }))
+          : undefined,
+      },
+    );
+  }
+
+  public bind(verse: CultMeshVerseContext | CultMeshVerse): CultMeshBoundCollectionHandle<TDocument> {
+    return cultMeshBindCollection(verse, this);
+  }
+
+  private resolveContext(context: CultMeshQueryContext): CultMeshQueryContext {
+    if (context.routeHint.kind !== "automatic" || this.routeHint.kind === "automatic") {
+      return context;
+    }
+
+    return cultMeshQueryContext(context.runtimeId, {
+      routeHint: this.routeHint,
+    });
+  }
+}
+
+export class CultMeshCollectionCatalog {
+  readonly #byCollectionId = new Map<string, CultMeshCollectionHandle<any>>();
+  readonly #byType = new Map<string, CultMeshCollectionHandle<any>>();
+  readonly #bySchemaId = new Map<string, CultMeshCollectionHandle<any>>();
+  readonly #bySchemaNameVersion = new Map<string, CultMeshCollectionHandle<any>>();
+
+  public constructor(collections: Iterable<CultMeshCollectionHandle<any>>) {
+    for (const collection of collections) {
+      this.add(collection);
+    }
+  }
+
+  public get collections(): readonly CultMeshCollectionHandle<any>[] {
+    return [...this.#byCollectionId.values()];
+  }
+
+  public add<TDocument>(collection: CultMeshCollectionHandle<TDocument>): this {
+    this.#byCollectionId.set(collection.collectionId, collection as CultMeshCollectionHandle<any>);
+    if (collection.schema.type) {
+      this.#byType.set(collection.schema.type, collection as CultMeshCollectionHandle<any>);
+    }
+    if (collection.schema.schemaId) {
+      this.#bySchemaId.set(collection.schema.schemaId, collection as CultMeshCollectionHandle<any>);
+    }
+    const key = cultMeshSchemaNameVersionKey(collection.schema);
+    if (key) {
+      this.#bySchemaNameVersion.set(key, collection as CultMeshCollectionHandle<any>);
+    }
+    return this;
+  }
+
+  public tryCollection<TDocument>(
+    schema: CultMeshDocumentSchemaDescriptor,
+    options: { parse?: (value: unknown) => TDocument } = {},
+  ): CultMeshCollectionHandle<TDocument> | undefined {
+    const descriptor = normalizeCultMeshDocumentSchema(schema);
+    const exact =
+      (descriptor.type ? this.#byType.get(descriptor.type) : undefined) ??
+      (descriptor.schemaId ? this.#bySchemaId.get(descriptor.schemaId) : undefined) ??
+      (() => {
+        const key = cultMeshSchemaNameVersionKey(descriptor);
+        return key ? this.#bySchemaNameVersion.get(key) : undefined;
+      })();
+
+    if (!exact) {
+      return undefined;
+    }
+
+    return cultMeshSchemasAreCompatible(exact.schema, descriptor)
+      ? exact.asSchemaAlias(descriptor, options)
+      : undefined;
+  }
+
+  public collection<TDocument>(
+    schema: CultMeshDocumentSchemaDescriptor,
+    options: { parse?: (value: unknown) => TDocument } = {},
+  ): CultMeshCollectionHandle<TDocument> {
+    const collection = this.tryCollection(schema, options);
+    if (!collection) {
+      throw new Error(`Collection catalog has no collection for ${cultMeshSchemaLabel(schema)}.`);
+    }
+    return collection;
+  }
+
+  public latest<TDocument>(
+    schema: CultMeshDocumentSchemaDescriptor,
+    context: CultMeshQueryContext | string = "local",
+    options: { parse?: (value: unknown) => TDocument } = {},
+  ): Promise<CultMeshCollectionSnapshot<TDocument>> {
+    return this.collection(schema, options).latest(context);
+  }
+
+  public watchChanges<TDocument>(
+    schema: CultMeshDocumentSchemaDescriptor,
+    callback: (change: CultMeshCollectionChange<TDocument>) => void,
+    options: { parse?: (value: unknown) => TDocument; context?: CultMeshQueryContext | string } = {},
+  ): CultMeshUnsubscribe {
+    return this.collection(schema, options).watchChanges(options.context ?? "local", callback);
+  }
+}
+
+export class CultMeshBoundCollectionHandle<TDocument> {
+  public constructor(
+    public readonly verse: CultMeshVerseContext,
+    public readonly collection: CultMeshCollectionHandle<TDocument>,
+  ) {}
+
+  public get collectionId(): string {
+    return this.collection.collectionId;
+  }
+
+  public get schema(): CultMeshDocumentSchemaDescriptor {
+    return this.collection.schema;
+  }
+
+  public latest(): Promise<CultMeshCollectionSnapshot<TDocument>> {
+    return this.collection.latest(cultMeshQueryContextFromVerse(this.verse));
+  }
+
+  public watchChanges(callback: (change: CultMeshCollectionChange<TDocument>) => void): CultMeshUnsubscribe {
+    return this.collection.watchChanges(cultMeshQueryContextFromVerse(this.verse), callback);
+  }
+
+  public asSchemaAlias<TAlias>(
+    schema: CultMeshDocumentSchemaDescriptor,
+    options: { parse?: (value: unknown) => TAlias } = {},
+  ): CultMeshBoundCollectionHandle<TAlias> {
+    return cultMeshBindCollection(this.verse, this.collection.asSchemaAlias(schema, options));
+  }
+}
+
+export class CultMeshStatePointer<T> {
+  public readonly sources: readonly CultMeshProjectionSource[];
+  public readonly routeHint: CultMeshRouteHint;
+
+  public constructor(
+    public readonly pointerId: string,
+    private readonly resolvePointer: (() => Promise<T | undefined>) | CultMeshStatePointerResolver<T>,
+    private readonly watchPointer?:
+      | ((callback: (value: T) => void) => CultMeshUnsubscribe)
+      | CultMeshStatePointerWatcher<T>,
+    options: {
+      sources?: readonly CultMeshProjectionSource[];
+      routeHint?: CultMeshRouteHint;
+    } = {},
+  ) {
+    requireNonEmpty(pointerId, "pointerId");
+    this.sources = [...(options.sources ?? [])];
+    this.routeHint = options.routeHint ?? cultMeshRouteHint();
+  }
+
+  public resolve(context?: CultMeshQueryContext | string): Promise<T | undefined> {
+    return (this.resolvePointer as CultMeshStatePointerResolver<T>)(
+      this.resolveContext(
+        typeof context === "string" ? cultMeshQueryContext(context) : context,
+      ),
+    );
+  }
+
+  public watch(callback: (value: T) => void): CultMeshUnsubscribe;
+  public watch(context: CultMeshQueryContext | string, callback: (value: T) => void): CultMeshUnsubscribe;
+  public watch(
+    contextOrCallback: CultMeshQueryContext | string | ((value: T) => void),
+    maybeCallback?: (value: T) => void,
+  ): CultMeshUnsubscribe {
+    if (!this.watchPointer) {
+      throw new Error(`State pointer '${this.pointerId}' does not support watches.`);
+    }
+
+    const callback =
+      typeof contextOrCallback === "function" ? contextOrCallback : maybeCallback;
+    if (!callback) {
+      throw new Error(`State pointer '${this.pointerId}' requires a watch callback.`);
+    }
+
+    if (this.watchPointer.length <= 1) {
+      return (this.watchPointer as (callback: (value: T) => void) => CultMeshUnsubscribe)(callback);
+    }
+
+    const context =
+      typeof contextOrCallback === "function"
+        ? undefined
+        : typeof contextOrCallback === "string"
+          ? cultMeshQueryContext(contextOrCallback)
+          : contextOrCallback;
+    return (this.watchPointer as CultMeshStatePointerWatcher<T>)(
+      this.resolveContext(context),
+      callback,
+    );
+  }
+
+  public bind(
+    verse: CultMeshVerseContext | CultMeshVerse,
+  ): CultMeshBoundStatePointer<T> {
+    return cultMeshBindStatePointer(verse, this);
+  }
+
+  private resolveContext(context?: CultMeshQueryContext): CultMeshQueryContext {
+    const resolved = context ?? cultMeshQueryContext("local");
+    if (resolved.routeHint.kind !== "automatic" || this.routeHint.kind === "automatic") {
+      return resolved;
+    }
+
+    return cultMeshQueryContext(resolved.runtimeId, {
+      routeHint: this.routeHint,
+    });
+  }
+}
+
+export class CultMeshBoundStatePointer<T> {
+  public constructor(
+    public readonly verse: CultMeshVerseContext,
+    public readonly pointer: CultMeshStatePointer<T>,
+  ) {}
+
+  public get pointerId(): string {
+    return this.pointer.pointerId;
+  }
+
+  public get sources(): readonly CultMeshProjectionSource[] {
+    return this.pointer.sources;
+  }
+
+  public get routeHint(): CultMeshRouteHint {
+    return this.pointer.routeHint;
+  }
+
+  public resolve(): Promise<T | undefined> {
+    return this.pointer.resolve(cultMeshQueryContextFromVerse(this.verse));
+  }
+
+  public watch(callback: (value: T) => void): CultMeshUnsubscribe {
+    return this.pointer.watch(cultMeshQueryContextFromVerse(this.verse), callback);
+  }
+}
+
+export class CultMeshMutableStatePointer<T> {
+  public readonly sources: readonly CultMeshProjectionSource[];
+  public readonly routeHint: CultMeshRouteHint;
+
+  public constructor(
+    public readonly pointerId: string,
+    private readonly resolvePointer: (() => Promise<T | undefined>) | CultMeshStatePointerResolver<T>,
+    private readonly watchPointer:
+      | ((callback: (value: T) => void) => CultMeshUnsubscribe)
+      | CultMeshStatePointerWatcher<T>,
+    private readonly replacePointer:
+      | ((value: T) => Promise<void>)
+      | CultMeshMutableStatePointerReplacer<T>,
+    options: {
+      sources?: readonly CultMeshProjectionSource[];
+      routeHint?: CultMeshRouteHint;
+    } = {},
+  ) {
+    requireNonEmpty(pointerId, "pointerId");
+    this.sources = [...(options.sources ?? [])];
+    this.routeHint = options.routeHint ?? cultMeshRouteHint();
+  }
+
+  public resolve(context?: CultMeshQueryContext | string): Promise<T | undefined> {
+    return (this.resolvePointer as CultMeshStatePointerResolver<T>)(
+      this.resolveContext(
+        typeof context === "string" ? cultMeshQueryContext(context) : context,
+      ),
+    );
+  }
+
+  public read(context?: CultMeshQueryContext | string): Promise<T | undefined> {
+    return this.resolve(context);
+  }
+
+  public replace(value: T): Promise<void>;
+  public replace(context: CultMeshQueryContext | string, value: T): Promise<void>;
+  public replace(
+    contextOrValue: CultMeshQueryContext | string | T,
+    maybeValue?: T,
+  ): Promise<void> {
+    if (this.replacePointer.length <= 1) {
+      return (this.replacePointer as (value: T) => Promise<void>)(
+        contextOrValue as T,
+      );
+    }
+
+    const context =
+      typeof contextOrValue === "string"
+        ? cultMeshQueryContext(contextOrValue)
+        : isCultMeshQueryContext(contextOrValue)
+          ? contextOrValue
+          : undefined;
+    const value = context ? maybeValue : (contextOrValue as T);
+    if (value === undefined) {
+      throw new Error(`Mutable state pointer '${this.pointerId}' requires a replacement value.`);
+    }
+
+    return (this.replacePointer as CultMeshMutableStatePointerReplacer<T>)(
+      this.resolveContext(context),
+      value,
+    );
+  }
+
+  public watch(callback: (value: T) => void): CultMeshUnsubscribe;
+  public watch(context: CultMeshQueryContext | string, callback: (value: T) => void): CultMeshUnsubscribe;
+  public watch(
+    contextOrCallback: CultMeshQueryContext | string | ((value: T) => void),
+    maybeCallback?: (value: T) => void,
+  ): CultMeshUnsubscribe {
+    const callback =
+      typeof contextOrCallback === "function" ? contextOrCallback : maybeCallback;
+    if (!callback) {
+      throw new Error(`Mutable state pointer '${this.pointerId}' requires a watch callback.`);
+    }
+
+    if (this.watchPointer.length <= 1) {
+      return (this.watchPointer as (callback: (value: T) => void) => CultMeshUnsubscribe)(callback);
+    }
+
+    const context =
+      typeof contextOrCallback === "function"
+        ? undefined
+        : typeof contextOrCallback === "string"
+          ? cultMeshQueryContext(contextOrCallback)
+          : contextOrCallback;
+    return (this.watchPointer as CultMeshStatePointerWatcher<T>)(
+      this.resolveContext(context),
+      callback,
+    );
+  }
+
+  public asStatePointer(): CultMeshStatePointer<T> {
+    return cultMeshStatePointer(
+      this.pointerId,
+      (context) => this.resolve(context),
+      (context, callback) => this.watch(context, callback),
+      {
+        routeHint: this.routeHint,
+        sources: this.sources,
+      },
+    );
+  }
+
+  public bind(
+    verse: CultMeshVerseContext | CultMeshVerse,
+  ): CultMeshBoundMutableStatePointer<T> {
+    return cultMeshBindMutableStatePointer(verse, this);
+  }
+
+  private resolveContext(context?: CultMeshQueryContext): CultMeshQueryContext {
+    const resolved = context ?? cultMeshQueryContext("local");
+    if (resolved.routeHint.kind !== "automatic" || this.routeHint.kind === "automatic") {
+      return resolved;
+    }
+
+    return cultMeshQueryContext(resolved.runtimeId, {
+      routeHint: this.routeHint,
+    });
+  }
+}
+
+export class CultMeshBoundMutableStatePointer<T> {
+  public constructor(
+    public readonly verse: CultMeshVerseContext,
+    public readonly pointer: CultMeshMutableStatePointer<T>,
+  ) {}
+
+  public get pointerId(): string {
+    return this.pointer.pointerId;
+  }
+
+  public get sources(): readonly CultMeshProjectionSource[] {
+    return this.pointer.sources;
+  }
+
+  public get routeHint(): CultMeshRouteHint {
+    return this.pointer.routeHint;
+  }
+
+  public resolve(): Promise<T | undefined> {
+    return this.pointer.resolve(cultMeshQueryContextFromVerse(this.verse));
+  }
+
+  public read(): Promise<T | undefined> {
+    return this.resolve();
+  }
+
+  public replace(value: T): Promise<void> {
+    return this.pointer.replace(cultMeshQueryContextFromVerse(this.verse), value);
+  }
+
+  public watch(callback: (value: T) => void): CultMeshUnsubscribe {
+    return this.pointer.watch(cultMeshQueryContextFromVerse(this.verse), callback);
+  }
+
+  public asStatePointer(): CultMeshBoundStatePointer<T> {
+    return cultMeshBindStatePointer(this.verse, this.pointer.asStatePointer());
+  }
+}
+
+export class CultMeshProjectionRecipe<TParameters, TResult> {
+  public readonly sources: readonly CultMeshProjectionSource[];
+  public readonly routeHint: CultMeshRouteHint;
+
+  public constructor(
+    public readonly projectionId: string,
+    sources: readonly CultMeshProjectionSource[],
+    private readonly projectProjection: (
+      parameters: TParameters,
+      context: CultMeshQueryContext,
+    ) => Promise<TResult>,
+    options: {
+      routeHint?: CultMeshRouteHint;
+      watchProjection?: (
+        parameters: TParameters,
+        context: CultMeshQueryContext,
+        callback: (value: TResult) => void,
+      ) => CultMeshUnsubscribe;
+    } = {},
+  ) {
+    requireNonEmpty(projectionId, "projectionId");
+    this.sources = [...sources];
+    this.routeHint = options.routeHint ?? cultMeshRouteHint();
+    this.watchProjection = options.watchProjection;
+  }
+
+  private readonly watchProjection:
+    | ((
+        parameters: TParameters,
+        context: CultMeshQueryContext,
+        callback: (value: TResult) => void,
+      ) => CultMeshUnsubscribe)
+    | undefined;
+
+  public project(
+    parameters: TParameters,
+    context: CultMeshQueryContext | string,
+  ): Promise<TResult> {
+    return this.projectProjection(
+      parameters,
+      this.resolveContext(
+        typeof context === "string" ? cultMeshQueryContext(context) : context,
+      ),
+    );
+  }
+
+  public watch(
+    parameters: TParameters,
+    context: CultMeshQueryContext | string,
+    callback: (value: TResult) => void,
+  ): CultMeshUnsubscribe {
+    if (!this.watchProjection) {
+      throw new Error(`Projection recipe '${this.projectionId}' does not support watches.`);
+    }
+
+    return this.watchProjection(
+      parameters,
+      this.resolveContext(
+        typeof context === "string" ? cultMeshQueryContext(context) : context,
+      ),
+      callback,
+    );
+  }
+
+  public asQuerySurface(): CultMeshQuerySurface<TParameters, TResult> {
+    return cultMeshQuery(this.projectionId, (parameters, context) =>
+      this.project(parameters, context),
+      {
+        sources: this.sources,
+        routeHint: this.routeHint,
+        watchQuery: this.watchProjection
+          ? (parameters, context, callback) => this.watch(parameters, context, callback)
+          : undefined,
+      },
+    );
+  }
+
+  private resolveContext(context: CultMeshQueryContext): CultMeshQueryContext {
+    if (context.routeHint.kind !== "automatic" || this.routeHint.kind === "automatic") {
+      return context;
+    }
+
+    return cultMeshQueryContext(context.runtimeId, {
+      routeHint: this.routeHint,
+    });
+  }
+}
+
+export function cultMeshOperationContextFor(runtimeId: string): CultMeshOperationContextBuilder {
+  return new CultMeshOperationContextBuilder(runtimeId);
+}
+
+export function cultMeshQueryContextFor(runtimeId: string): CultMeshQueryContextBuilder {
+  return new CultMeshQueryContextBuilder(runtimeId);
+}
+
+export function cultMeshVec2(x: number, y: number): CultMeshVec2 {
+  return { x, y };
+}
+
+export function cultMeshRect(min: CultMeshVec2, max: CultMeshVec2): CultMeshRect {
+  return {
+    min: cultMeshVec2(Math.min(min.x, max.x), Math.min(min.y, max.y)),
+    max: cultMeshVec2(Math.max(min.x, max.x), Math.max(min.y, max.y)),
+  };
+}
+
+export function cultMeshRectFromBounds(
+  minX: number,
+  minY: number,
+  maxX: number,
+  maxY: number,
+): CultMeshRect {
+  return cultMeshRect(cultMeshVec2(minX, minY), cultMeshVec2(maxX, maxY));
+}
+
+export function cultMeshViewportRequest(
+  viewport: CultMeshRect,
+  controlledEntityIndices?: readonly number[],
+): CultMeshViewportRequest {
+  return {
+    minX: viewport.min.x,
+    minY: viewport.min.y,
+    maxX: viewport.max.x,
+    maxY: viewport.max.y,
+    controlledEntityIndices,
+  };
+}
+
+export function cultMeshRouteHint(
+  kind: CultMeshLocalityKind = "automatic",
+  description?: string,
+): CultMeshRouteHint {
+  return description ? { kind, description } : { kind };
+}
+
+export function cultMeshRouteRecord(
+  routeHint?: CultMeshRouteHint,
+): CultMeshRouteRecord;
+export function cultMeshRouteRecord(
+  kind?: string,
+  description?: string,
+): CultMeshRouteRecord;
+export function cultMeshRouteRecord(
+  routeOrKind?: CultMeshRouteHint | string,
+  description = "",
+): CultMeshRouteRecord {
+  if (typeof routeOrKind === "string" || routeOrKind === undefined) {
+    return {
+      kind: routeOrKind ?? "",
+      description,
+    };
+  }
+
+  return {
+    kind: routeOrKind.kind,
+    description: routeOrKind.description ?? "",
+  };
+}
+
+export function cultMeshRouteFromRecord(
+  record: Partial<CultMeshRouteRecord>,
+  fallback: CultMeshRouteHint = cultMeshRouteHint(),
+): CultMeshRouteHint {
+  return cultMeshRouteHint(
+    parseCultMeshLocalityKind(record.kind, fallback.kind),
+    nonBlankOr(record.description, fallback.description),
+  );
+}
+
+export function cultMeshAuthorityClaim(
+  role: string,
+  options: { shardId?: string; leaseId?: string } = {},
+): CultMeshAuthorityClaim {
+  requireNonEmpty(role, "role");
+  return {
+    role,
+    shardId: options.shardId,
+    leaseId: options.leaseId,
+  };
+}
+
+export function cultMeshVerseContext(
+  verseId: string,
+  runtimeId: string,
+  options: {
+    routeHint?: CultMeshRouteHint;
+    claims?: readonly CultMeshAuthorityClaim[];
+  } = {},
+): CultMeshVerseContext {
+  requireNonEmpty(verseId, "verseId");
+  requireNonEmpty(runtimeId, "runtimeId");
+  return {
+    verseId,
+    runtimeId,
+    routeHint: options.routeHint ?? cultMeshRouteHint(),
+    claims: options.claims ? [...options.claims] : [],
+  };
+}
+
+export function cultMeshVerse(
+  verseId: string,
+  runtimeId: string,
+  options: {
+    routeHint?: CultMeshRouteHint;
+    claims?: readonly CultMeshAuthorityClaim[];
+  } = {},
+): CultMeshVerse {
+  return new CultMeshVerse(cultMeshVerseContext(verseId, runtimeId, options));
+}
+
+export function cultMeshOperationContextFromVerse(
+  context: CultMeshVerseContext,
+  options: { idempotencyKey?: string } = {},
+): CultMeshOperationContext {
+  return cultMeshOperationContext(context.runtimeId, {
+    claims: context.claims,
+    routeHint: context.routeHint,
+    idempotencyKey: options.idempotencyKey,
+  });
+}
+
+export function cultMeshQueryContextFromVerse(
+  context: CultMeshVerseContext,
+): CultMeshQueryContext {
+  return cultMeshQueryContext(context.runtimeId, {
+    routeHint: context.routeHint,
+  });
+}
+
+export function cultMeshBindOperation<TRequest, TResponse>(
+  verse: CultMeshVerseContext | CultMeshVerse,
+  operation: CultMeshOperationHandle<TRequest, TResponse>,
+): CultMeshBoundOperationHandle<TRequest, TResponse> {
+  return new CultMeshBoundOperationHandle(resolveCultMeshVerseContext(verse), operation);
+}
+
+export function cultMeshBindQuery<TParameters, TResult>(
+  verse: CultMeshVerseContext | CultMeshVerse,
+  query: CultMeshQuerySurface<TParameters, TResult>,
+): CultMeshBoundQuerySurface<TParameters, TResult> {
+  return new CultMeshBoundQuerySurface(resolveCultMeshVerseContext(verse), query);
+}
+
+export function cultMeshBindLiveFeed<TParameters, TResult>(
+  verse: CultMeshVerseContext | CultMeshVerse,
+  feed: CultMeshLiveFeed<TParameters, TResult>,
+): CultMeshBoundLiveFeed<TParameters, TResult> {
+  return new CultMeshBoundLiveFeed(resolveCultMeshVerseContext(verse), feed);
+}
+
+export function cultMeshBindStatePointer<T>(
+  verse: CultMeshVerseContext | CultMeshVerse,
+  pointer: CultMeshStatePointer<T>,
+): CultMeshBoundStatePointer<T> {
+  return new CultMeshBoundStatePointer(resolveCultMeshVerseContext(verse), pointer);
+}
+
+export function cultMeshBindMutableStatePointer<T>(
+  verse: CultMeshVerseContext | CultMeshVerse,
+  pointer: CultMeshMutableStatePointer<T>,
+): CultMeshBoundMutableStatePointer<T> {
+  return new CultMeshBoundMutableStatePointer(resolveCultMeshVerseContext(verse), pointer);
+}
+
+export function cultMeshBindDocument<TDocument>(
+  verse: CultMeshVerseContext | CultMeshVerse,
+  document: CultMeshDocumentHandle<TDocument>,
+): CultMeshBoundDocumentHandle<TDocument> {
+  return new CultMeshBoundDocumentHandle(resolveCultMeshVerseContext(verse), document);
+}
+
+export function cultMeshBindCollection<TDocument>(
+  verse: CultMeshVerseContext | CultMeshVerse,
+  collection: CultMeshCollectionHandle<TDocument>,
+): CultMeshBoundCollectionHandle<TDocument> {
+  return new CultMeshBoundCollectionHandle(resolveCultMeshVerseContext(verse), collection);
+}
+
+function resolveCultMeshVerseContext(verse: CultMeshVerseContext | CultMeshVerse): CultMeshVerseContext {
+  return verse instanceof CultMeshVerse ? verse.context : verse;
+}
+
+function isCultMeshQueryContext(value: unknown): value is CultMeshQueryContext {
+  if (typeof value !== "object" || value === null) {
+    return false;
+  }
+
+  const maybeContext = value as Partial<CultMeshQueryContext>;
+  return typeof maybeContext.runtimeId === "string" &&
+    typeof maybeContext.routeHint === "object" &&
+    maybeContext.routeHint !== null;
+}
+
+export function cultMeshOperationContext(
+  runtimeId: string,
+  options: {
+    claims?: readonly CultMeshAuthorityClaim[];
+    routeHint?: CultMeshRouteHint;
+    idempotencyKey?: string;
+  } = {},
+): CultMeshOperationContext {
+  requireNonEmpty(runtimeId, "runtimeId");
+  return {
+    runtimeId,
+    claims: options.claims ? [...options.claims] : [],
+    routeHint: options.routeHint ?? cultMeshRouteHint(),
+    idempotencyKey: options.idempotencyKey,
+  };
+}
+
+export function cultMeshQueryContext(
+  runtimeId: string,
+  options: { routeHint?: CultMeshRouteHint } = {},
+): CultMeshQueryContext {
+  requireNonEmpty(runtimeId, "runtimeId");
+  return {
+    runtimeId,
+    routeHint: options.routeHint ?? cultMeshRouteHint(),
+  };
+}
+
+export function cultMeshOperationReceipt(
+  operationId: string,
+  accepted: boolean,
+  options: { route?: CultMeshRouteHint; diagnostic?: string } = {},
+): CultMeshOperationReceipt {
+  requireNonEmpty(operationId, "operationId");
+  return {
+    operationId,
+    accepted,
+    route: options.route ?? cultMeshRouteHint(),
+    diagnostic: options.diagnostic,
+  };
+}
+
+export function cultMeshOperation<TRequest, TResponse>(
+  operationId: string,
+  invokeOperation: (
+    request: TRequest,
+    context: CultMeshOperationContext,
+  ) => Promise<TResponse>,
+): CultMeshOperationHandle<TRequest, TResponse> {
+  return new CultMeshOperationHandle(operationId, invokeOperation);
+}
+
+export function cultMeshQuery<TParameters, TResult>(
+  queryId: string,
+  executeQuery: (
+    parameters: TParameters,
+    context: CultMeshQueryContext,
+  ) => Promise<TResult>,
+  options: {
+    sources?: readonly CultMeshProjectionSource[];
+    routeHint?: CultMeshRouteHint;
+    watchQuery?: CultMeshQueryWatcher<TParameters, TResult>;
+  } = {},
+): CultMeshQuerySurface<TParameters, TResult> {
+  return new CultMeshQuerySurface(queryId, executeQuery, options);
+}
+
+export function cultMeshDescribeQuerySurface(
+  query: {
+    readonly queryId: string;
+    readonly routeHint: CultMeshRouteHint;
+    readonly sources: readonly CultMeshProjectionSource[];
+  },
+): CultMeshQuerySurfaceDiagnostic {
+  return {
+    queryId: query.queryId,
+    routeHint: query.routeHint,
+    sources: [...query.sources],
+  };
+}
+
+export function cultMeshDescribeOperationHandle(
+  operation: {
+    readonly operationId: string;
+  },
+): CultMeshOperationHandleDiagnostic {
+  return {
+    operationId: operation.operationId,
+  };
+}
+
+export function cultMeshDescribeStatePointer(
+  pointer: {
+    readonly pointerId: string;
+    readonly routeHint?: CultMeshRouteHint;
+    readonly sources?: readonly CultMeshProjectionSource[];
+  },
+): CultMeshStatePointerDiagnostic {
+  return {
+    pointerId: pointer.pointerId,
+    routeHint: pointer.routeHint ?? cultMeshRouteHint(),
+    sources: [...(pointer.sources ?? [])],
+  };
+}
+
+export function cultMeshLiveFeed<TParameters, TResult>(
+  feedId: string,
+  snapshotFeed: (
+    parameters: TParameters,
+    context: CultMeshQueryContext,
+  ) => Promise<TResult>,
+  options: {
+    sources?: readonly CultMeshProjectionSource[];
+    routeHint?: CultMeshRouteHint;
+    watchFeed?: CultMeshLiveFeedWatcher<TParameters, TResult>;
+  } = {},
+): CultMeshLiveFeed<TParameters, TResult> {
+  return new CultMeshLiveFeed(feedId, snapshotFeed, options);
+}
+
+export function cultMeshDocument<TDocument>(
+  documentId: string,
+  schema: CultMeshDocumentSchemaDescriptor,
+  snapshotDocument: (context: CultMeshQueryContext) => Promise<TDocument>,
+  options: {
+    sources?: readonly CultMeshProjectionSource[];
+    routeHint?: CultMeshRouteHint;
+    watchDocument?: CultMeshDocumentWatcher<TDocument>;
+    replaceDocument?: CultMeshDocumentReplacer<TDocument>;
+    submitPrediction?: CultMeshDocumentPredictionSubmitter<TDocument>;
+  } = {},
+): CultMeshDocumentHandle<TDocument> {
+  return new CultMeshDocumentHandle(documentId, schema, snapshotDocument, options);
+}
+
+export function cultMeshDocumentFromCache<TDefinition extends AnyCultCacheDocumentDefinition>(
+  cache: CultCache,
+  definition: TDefinition,
+  key: string,
+  options: {
+    documentId?: string;
+    routeHint?: CultMeshRouteHint;
+    pollMs?: number;
+  } = {},
+): CultMeshDocumentHandle<CultCacheDocumentValue<TDefinition>> {
+  requireNonEmpty(key, "key");
+  const documentId = options.documentId ?? `${definition.type}:${key}`;
+  const schema = cultMeshSchemaFromDefinition(definition);
+  return cultMeshDocument(
+    documentId,
+    schema,
+    async () => cache.getRequired(definition, key),
+    {
+      routeHint: options.routeHint ?? cultMeshRouteHint("in-process", "CultCache"),
+      sources: [cultMeshProjectionSource(documentId, { schemaId: schema.schemaId })],
+      watchDocument: cultMeshPollingDocumentWatcher(
+        async () => cache.getRequired(definition, key),
+        { intervalMs: options.pollMs ?? 50 },
+      ),
+      replaceDocument: async (_context, value) => {
+        await cache.put(definition, key, value);
+      },
+    },
+  );
+}
+
+export function cultMeshDocumentFromStore(
+  store: CacheBackingStore,
+  schemaId: string,
+  options?: {
+    documentId?: string;
+    routeHint?: CultMeshRouteHint;
+    sourceId?: string;
+    pollMs?: number;
+  },
+): CultMeshDocumentHandle<unknown>;
+export function cultMeshDocumentFromStore<TDefinition extends AnyCultCacheDocumentDefinition>(
+  store: CacheBackingStore,
+  definition: TDefinition,
+  options?: {
+    documentId?: string;
+    routeHint?: CultMeshRouteHint;
+    sourceId?: string;
+    pollMs?: number;
+  },
+): CultMeshDocumentHandle<CultCacheDocumentValue<TDefinition>>;
+export function cultMeshDocumentFromStore(
+  store: CacheBackingStore,
+  schemaOrDefinition: string | AnyCultCacheDocumentDefinition,
+  options: {
+    documentId?: string;
+    routeHint?: CultMeshRouteHint;
+    sourceId?: string;
+    pollMs?: number;
+  } = {},
+): CultMeshDocumentHandle<unknown> {
+  const schema = typeof schemaOrDefinition === "string"
+    ? { schemaId: schemaOrDefinition }
+    : cultMeshSchemaFromDefinition(schemaOrDefinition);
+  const resolvedSchemaId = schema.schemaId ?? schema.type;
+  if (!resolvedSchemaId) {
+    throw new Error("CultMesh store document requires a schema id or document type.");
+  }
+  if (typeof schemaOrDefinition === "string") {
+    requireNonEmpty(schemaOrDefinition, "schemaId");
+  }
+  const documentId = options.documentId ?? resolvedSchemaId;
+  const read = async () => {
+    const records = await store.pullAll();
+    const record = resolveCultMeshStoreDocumentRecord(records, schema, schemaOrDefinition);
+    if (!record) {
+      throw new Error(`CultMesh store document '${documentId}' did not contain schema ${resolvedSchemaId}.`);
+    }
+    return parseCultMeshDocumentValue(schemaOrDefinition, decode(record.payload));
+  };
+
+  return cultMeshDocument(
+    documentId,
+    schema,
+    async () => read(),
+    {
+      routeHint: options.routeHint ?? cultMeshRouteHint("in-process", "CultCache store"),
+      sources: [cultMeshProjectionSource(options.sourceId ?? documentId, { schemaId: resolvedSchemaId })],
+      watchDocument: cultMeshPollingDocumentWatcher(read, {
+        intervalMs: options.pollMs ?? 50,
+      }),
+    },
+  );
+}
+
+export function cultMeshDocumentFromSingleFile(
+  path: string,
+  schemaId: string,
+  options?: {
+    documentId?: string;
+    routeHint?: CultMeshRouteHint;
+    sourceId?: string;
+    pollMs?: number;
+  },
+): CultMeshDocumentHandle<unknown>;
+export function cultMeshDocumentFromSingleFile<TDefinition extends AnyCultCacheDocumentDefinition>(
+  path: string,
+  definition: TDefinition,
+  options?: {
+    documentId?: string;
+    routeHint?: CultMeshRouteHint;
+    sourceId?: string;
+    pollMs?: number;
+  },
+): CultMeshDocumentHandle<CultCacheDocumentValue<TDefinition>>;
+export function cultMeshDocumentFromSingleFile(
+  path: string,
+  schemaOrDefinition: string | AnyCultCacheDocumentDefinition,
+  options: {
+    documentId?: string;
+    routeHint?: CultMeshRouteHint;
+    sourceId?: string;
+    pollMs?: number;
+  } = {},
+): CultMeshDocumentHandle<unknown> {
+  requireNonEmpty(path, "path");
+  const store = new SingleFileMessagePackBackingStore(path);
+  const resolvedOptions = {
+    ...options,
+    routeHint: options.routeHint ?? cultMeshRouteHint("shared-memory", path),
+  };
+  return typeof schemaOrDefinition === "string"
+    ? cultMeshDocumentFromStore(store, schemaOrDefinition, resolvedOptions)
+    : cultMeshDocumentFromStore(store, schemaOrDefinition, resolvedOptions);
+}
+
+export function cultMeshDocumentFromPeerSnapshot(
+  peer: CultNetPeer | (() => CultNetPeer | Promise<CultNetPeer>),
+  schemaId: string,
+  recordKey: string,
+  options?: {
+    documentId?: string;
+    routeHint?: CultMeshRouteHint;
+    sourceId?: string;
+    timeoutMs?: number;
+    pollMs?: number;
+    messageIdPrefix?: string;
+  },
+): CultMeshDocumentHandle<unknown>;
+export function cultMeshDocumentFromPeerSnapshot<TDefinition extends AnyCultCacheDocumentDefinition>(
+  peer: CultNetPeer | (() => CultNetPeer | Promise<CultNetPeer>),
+  definition: TDefinition,
+  recordKey: string,
+  options?: {
+    documentId?: string;
+    routeHint?: CultMeshRouteHint;
+    sourceId?: string;
+    timeoutMs?: number;
+    pollMs?: number;
+    messageIdPrefix?: string;
+  },
+): CultMeshDocumentHandle<CultCacheDocumentValue<TDefinition>>;
+export function cultMeshDocumentFromPeerSnapshot(
+  peer: CultNetPeer | (() => CultNetPeer | Promise<CultNetPeer>),
+  schemaOrDefinition: string | AnyCultCacheDocumentDefinition,
+  recordKey: string,
+  options: {
+    documentId?: string;
+    routeHint?: CultMeshRouteHint;
+    sourceId?: string;
+    timeoutMs?: number;
+    pollMs?: number;
+    messageIdPrefix?: string;
+  } = {},
+): CultMeshDocumentHandle<unknown> {
+  const schema = typeof schemaOrDefinition === "string"
+    ? { schemaId: schemaOrDefinition }
+    : cultMeshSchemaFromDefinition(schemaOrDefinition);
+  const resolvedSchemaId = schema.schemaId ?? schema.type;
+  if (!resolvedSchemaId) {
+    throw new Error("CultMesh peer snapshot document requires a schema id or document type.");
+  }
+  if (typeof schemaOrDefinition === "string") {
+    requireNonEmpty(schemaOrDefinition, "schemaId");
+  }
+  requireNonEmpty(recordKey, "recordKey");
+  const documentId = options.documentId ?? recordKey;
+  const read = async () =>
+    parseCultMeshDocumentValue(
+      schemaOrDefinition,
+      decodeCultNetRawDocumentPayload(
+        await requestCultNetRawSnapshotDocument(
+          peer,
+          resolvedSchemaId,
+          recordKey,
+          {
+            timeoutMs: options.timeoutMs,
+            messageIdPrefix: options.messageIdPrefix ?? documentId,
+            accepts: typeof schemaOrDefinition === "string"
+              ? undefined
+              : record => {
+                  try {
+                    schemaOrDefinition.schema.parse(decodeCultNetRawDocumentPayload(record));
+                    return true;
+                  } catch {
+                    return false;
+                  }
+                },
+          },
+        ),
+      ),
+    );
+
+  return cultMeshDocument(
+    documentId,
+    schema,
+    async () => read(),
+    {
+      routeHint: options.routeHint ?? cultMeshRouteHint("network", "CultNet snapshot"),
+      sources: [cultMeshProjectionSource(options.sourceId ?? documentId, { schemaId: resolvedSchemaId })],
+      watchDocument: cultMeshPollingDocumentWatcher(read, {
+        intervalMs: options.pollMs ?? 250,
+      }),
+    },
+  );
+}
+
+export function cultMeshDocumentFromPublication(
+  source: CultMeshDocumentPublicationSource,
+  schemaId: string,
+  recordKey: string,
+  options?: {
+    documentId?: string;
+    routeHint?: CultMeshRouteHint;
+    sourceId?: string;
+    timeoutMs?: number;
+    pollMs?: number;
+    messageIdPrefix?: string;
+  },
+): CultMeshDocumentHandle<unknown>;
+export function cultMeshDocumentFromPublication<TDefinition extends AnyCultCacheDocumentDefinition>(
+  source: CultMeshDocumentPublicationSource,
+  definition: TDefinition,
+  recordKey: string,
+  options?: {
+    documentId?: string;
+    routeHint?: CultMeshRouteHint;
+    sourceId?: string;
+    timeoutMs?: number;
+    pollMs?: number;
+    messageIdPrefix?: string;
+  },
+): CultMeshDocumentHandle<CultCacheDocumentValue<TDefinition>>;
+export function cultMeshDocumentFromPublication(
+  source: CultMeshDocumentPublicationSource,
+  schemaOrDefinition: string | AnyCultCacheDocumentDefinition,
+  recordKey: string,
+  options: {
+    documentId?: string;
+    routeHint?: CultMeshRouteHint;
+    sourceId?: string;
+    timeoutMs?: number;
+    pollMs?: number;
+    messageIdPrefix?: string;
+  } = {},
+): CultMeshDocumentHandle<unknown> {
+  if (!source) {
+    throw new Error("CultMesh publication source is required.");
+  }
+  requireNonEmpty(recordKey, "recordKey");
+
+  switch (source.kind) {
+    case "live-publication": {
+      const schema = typeof schemaOrDefinition === "string"
+        ? { schemaId: schemaOrDefinition }
+        : cultMeshSchemaFromDefinition(schemaOrDefinition);
+      const schemaId = schema.schemaId ?? schema.type;
+      if (!schemaId) {
+        throw new Error("CultMesh live publication document requires a schema id or document type.");
+      }
+      const parse = (value: unknown) => parseCultMeshDocumentValue(schemaOrDefinition, value);
+      return cultMeshDocument(
+        options.documentId ?? recordKey,
+        schema,
+        async () => parse(await source.source.latest(schemaId, recordKey)),
+        {
+          routeHint: options.routeHint ?? cultMeshRouteHint(
+            "network",
+            source.endpoint ?? "CultMesh provider-session publication",
+          ),
+          sources: [cultMeshProjectionSource(options.sourceId ?? recordKey, { schemaId })],
+          watchDocument: (_context, callback) => source.source.watch(
+            schemaId,
+            recordKey,
+            value => callback(parse(value)),
+          ),
+        },
+      );
+    }
+    case "single-file":
+      return typeof schemaOrDefinition === "string"
+        ? cultMeshDocumentFromSingleFile(source.path, schemaOrDefinition, {
+            documentId: options.documentId ?? recordKey,
+            routeHint: options.routeHint,
+            sourceId: options.sourceId ?? recordKey,
+            pollMs: options.pollMs,
+          })
+        : cultMeshDocumentFromSingleFile(source.path, schemaOrDefinition, {
+            documentId: options.documentId ?? recordKey,
+            routeHint: options.routeHint,
+            sourceId: options.sourceId ?? recordKey,
+            pollMs: options.pollMs,
+          });
+    case "store":
+      return typeof schemaOrDefinition === "string"
+        ? cultMeshDocumentFromStore(source.store, schemaOrDefinition, {
+            documentId: options.documentId ?? recordKey,
+            routeHint: options.routeHint,
+            sourceId: options.sourceId ?? recordKey,
+            pollMs: options.pollMs,
+          })
+        : cultMeshDocumentFromStore(source.store, schemaOrDefinition, {
+            documentId: options.documentId ?? recordKey,
+            routeHint: options.routeHint,
+            sourceId: options.sourceId ?? recordKey,
+            pollMs: options.pollMs,
+          });
+    case "peer-snapshot":
+      return typeof schemaOrDefinition === "string"
+        ? cultMeshDocumentFromPeerSnapshot(source.peer, schemaOrDefinition, recordKey, {
+            documentId: options.documentId ?? recordKey,
+            routeHint: options.routeHint ?? cultMeshRouteHint("network", source.endpoint ?? "CultNet snapshot"),
+            sourceId: options.sourceId ?? recordKey,
+            timeoutMs: options.timeoutMs,
+            pollMs: options.pollMs,
+            messageIdPrefix: options.messageIdPrefix,
+          })
+        : cultMeshDocumentFromPeerSnapshot(source.peer, schemaOrDefinition, recordKey, {
+            documentId: options.documentId ?? recordKey,
+            routeHint: options.routeHint ?? cultMeshRouteHint("network", source.endpoint ?? "CultNet snapshot"),
+            sourceId: options.sourceId ?? recordKey,
+            timeoutMs: options.timeoutMs,
+            pollMs: options.pollMs,
+            messageIdPrefix: options.messageIdPrefix,
+          });
+    default:
+      throw new Error(`Unsupported CultMesh publication source kind '${(source as { kind?: string }).kind}'.`);
+  }
+}
+
+export async function cultMeshSyncDocumentFromPublication<TDefinition extends AnyCultCacheDocumentDefinition>(
+  node: CultMeshNode,
+  source: CultMeshDocumentPublicationSource,
+  definition: TDefinition,
+  recordKey: string,
+  options: {
+    timeoutMs?: number;
+    messageIdPrefix?: string;
+  } = {},
+): Promise<CultCacheDocumentValue<TDefinition>> {
+  if (!source) {
+    throw new Error("CultMesh publication source is required.");
+  }
+  requireNonEmpty(recordKey, "recordKey");
+
+  if (source.kind === "peer-snapshot") {
+    return node.syncDocumentFromPeerSnapshot(source.peer, definition, recordKey, options);
+  }
+
+  const value = await cultMeshDocumentFromPublication(
+    source,
+    definition,
+    recordKey,
+    {
+      timeoutMs: options.timeoutMs,
+      messageIdPrefix: options.messageIdPrefix,
+    },
+  ).latest();
+  return node.put(definition, recordKey, value);
+}
+
+export async function cultMeshSyncDocumentsFromPublication(
+  node: CultMeshNode,
+  source: CultMeshDocumentPublicationSourceResolver,
+  bindings: readonly CultMeshPublicationDocumentBinding[],
+  options: {
+    routeHint?: CultMeshRouteHint;
+    timeoutMs?: number;
+    pollMs?: number;
+    messageIdPrefix?: string;
+  } = {},
+): Promise<CultMeshDocumentCatalog> {
+  if (!node) {
+    throw new Error("CultMesh node is required.");
+  }
+  if (!source) {
+    throw new Error("CultMesh publication source is required.");
+  }
+  if (!bindings) {
+    throw new Error("CultMesh publication bindings are required.");
+  }
+
+  const documents = await Promise.all(bindings.map(async binding => {
+    if (!binding) {
+      throw new Error("CultMesh publication binding is required.");
+    }
+    if (typeof binding.schema === "string") {
+      throw new Error(
+        `CultMesh synced publication binding '${binding.recordKey}' requires a document definition, not only a schema id.`,
+      );
+    }
+    const resolvedSource = binding.source ??
+      (typeof source === "function" ? source(binding) : source);
+    await node.syncDocumentFromPublication(
+      resolvedSource,
+      binding.schema,
+      binding.recordKey,
+      {
+        timeoutMs: options.timeoutMs,
+        messageIdPrefix: options.messageIdPrefix,
+      },
+    );
+    return node.document(binding.schema, binding.recordKey, {
+      documentId: binding.documentId ?? binding.recordKey,
+      routeHint: options.routeHint,
+      pollMs: options.pollMs,
+    });
+  }));
+
+  return cultMeshDocuments(...documents);
+}
+
+export function cultMeshGlobalDocumentFromCache<TDefinition extends AnyCultCacheDocumentDefinition>(
+  cache: CultCache,
+  definition: TDefinition,
+  options: {
+    documentId?: string;
+    routeHint?: CultMeshRouteHint;
+    pollMs?: number;
+  } = {},
+): CultMeshDocumentHandle<CultCacheDocumentValue<TDefinition>> {
+  const documentId = options.documentId ?? `${definition.type}:global`;
+  const schema = cultMeshSchemaFromDefinition(definition);
+  return cultMeshDocument(
+    documentId,
+    schema,
+    async () => cache.getRequiredGlobal(definition),
+    {
+      routeHint: options.routeHint ?? cultMeshRouteHint("in-process", "CultCache"),
+      sources: [cultMeshProjectionSource(documentId, { schemaId: schema.schemaId })],
+      watchDocument: cultMeshPollingDocumentWatcher(
+        async () => cache.getRequiredGlobal(definition),
+        { intervalMs: options.pollMs ?? 50 },
+      ),
+      replaceDocument: async (_context, value) => {
+        await cache.putGlobal(definition, value);
+      },
+    },
+  );
+}
+
+export function cultMeshDocuments(
+  ...documents: readonly CultMeshDocumentHandle<any>[]
+): CultMeshDocumentCatalog {
+  return new CultMeshDocumentCatalog(documents);
+}
+
+export function cultMeshPublicationDocument(
+  schema: string | AnyCultCacheDocumentDefinition,
+  recordKey: string,
+  options: {
+    documentId?: string;
+    sourceId?: string;
+    source?: CultMeshDocumentPublicationSource;
+  } = {},
+): CultMeshPublicationDocumentBinding {
+  requireNonEmpty(recordKey, "recordKey");
+  return {
+    schema,
+    recordKey,
+    documentId: options.documentId,
+    sourceId: options.sourceId,
+    source: options.source,
+  };
+}
+
+export function cultMeshDocumentsFromPublication(
+  source: CultMeshDocumentPublicationSourceResolver,
+  bindings: readonly CultMeshPublicationDocumentBinding[],
+  options: {
+    routeHint?: CultMeshRouteHint;
+    timeoutMs?: number;
+    pollMs?: number;
+    messageIdPrefix?: string;
+  } = {},
+): CultMeshDocumentCatalog {
+  if (!source) {
+    throw new Error("CultMesh publication source is required.");
+  }
+  if (!bindings) {
+    throw new Error("CultMesh publication bindings are required.");
+  }
+
+  return cultMeshDocuments(
+    ...bindings.map(binding => {
+      if (!binding) {
+        throw new Error("CultMesh publication binding is required.");
+      }
+      const resolvedSource = binding.source ??
+        (typeof source === "function" ? source(binding) : source);
+      return typeof binding.schema === "string"
+        ? cultMeshDocumentFromPublication(
+            resolvedSource,
+            binding.schema,
+            binding.recordKey,
+            {
+              documentId: binding.documentId ?? binding.recordKey,
+              sourceId: binding.sourceId ?? binding.documentId ?? binding.recordKey,
+              routeHint: options.routeHint,
+              timeoutMs: options.timeoutMs,
+              pollMs: options.pollMs,
+              messageIdPrefix: options.messageIdPrefix,
+            },
+          )
+        : cultMeshDocumentFromPublication(
+            resolvedSource,
+            binding.schema,
+            binding.recordKey,
+            {
+              documentId: binding.documentId ?? binding.recordKey,
+              sourceId: binding.sourceId ?? binding.documentId ?? binding.recordKey,
+              routeHint: options.routeHint,
+              timeoutMs: options.timeoutMs,
+              pollMs: options.pollMs,
+              messageIdPrefix: options.messageIdPrefix,
+            },
+          );
+    }),
+  );
+}
+
+export function cultMeshCollection<TDocument>(
+  collectionId: string,
+  schema: CultMeshDocumentSchemaDescriptor,
+  snapshotCollection: (context: CultMeshQueryContext) => Promise<CultMeshCollectionSnapshot<TDocument>>,
+  options: {
+    sources?: readonly CultMeshProjectionSource[];
+    routeHint?: CultMeshRouteHint;
+    watchCollection?: CultMeshCollectionWatcher<TDocument>;
+  } = {},
+): CultMeshCollectionHandle<TDocument> {
+  return new CultMeshCollectionHandle(collectionId, schema, snapshotCollection, options);
+}
+
+export function cultMeshCollections(
+  ...collections: readonly CultMeshCollectionHandle<any>[]
+): CultMeshCollectionCatalog {
+  return new CultMeshCollectionCatalog(collections);
+}
+
+export function cultMeshCollectionFromCache<TDefinition extends AnyCultCacheDocumentDefinition>(
+  cache: CultCache,
+  definition: TDefinition,
+  options: {
+    collectionId?: string;
+    routeHint?: CultMeshRouteHint;
+    pollMs?: number;
+  } = {},
+): CultMeshCollectionHandle<CultCacheDocumentValue<TDefinition>> {
+  const collectionId = options.collectionId ?? definition.type;
+  const schema = cultMeshSchemaFromDefinition(definition);
+  return cultMeshCollection(
+    collectionId,
+    schema,
+    async () => cache.getAll(definition),
+    {
+      routeHint: options.routeHint ?? cultMeshRouteHint("in-process", "CultCache"),
+      sources: [cultMeshProjectionSource(collectionId, { schemaId: schema.schemaId })],
+      watchCollection: cultMeshPollingCollectionWatcher(
+        async () => cache.getAll(definition),
+        { intervalMs: options.pollMs ?? 50 },
+      ),
+    },
+  );
+}
+
+export function cultMeshDescribeLiveFeed(
+  feed: {
+    readonly feedId: string;
+    readonly routeHint: CultMeshRouteHint;
+    readonly sources: readonly CultMeshProjectionSource[];
+  },
+): CultMeshLiveFeedDiagnostic {
+  return {
+    feedId: feed.feedId,
+    routeHint: feed.routeHint,
+    sources: [...feed.sources],
+  };
+}
+
+export function cultMeshPollingQueryWatcher<TParameters, TResult>(
+  executeQuery: (
+    parameters: TParameters,
+    context: CultMeshQueryContext,
+  ) => Promise<TResult>,
+  options: CultMeshPollingWatchOptions<TResult> = {},
+): CultMeshQueryWatcher<TParameters, TResult> {
+  const intervalMs = Math.max(1, options.intervalMs ?? 50);
+  const emitInitial = options.emitInitial ?? true;
+  return (parameters, context, callback) => {
+    let disposed = false;
+    let running = false;
+    let last: TResult | undefined;
+    let hasLast = false;
+    let timer: ReturnType<typeof setInterval> | undefined;
+
+    const poll = async () => {
+      if (disposed || running) {
+        return;
+      }
+
+      running = true;
+      try {
+        const next = await executeQuery(parameters, context);
+        const changed = !hasLast || !(options.equals?.(last as TResult, next) ?? Object.is(last, next));
+        const shouldEmit = hasLast ? changed : emitInitial;
+        last = next;
+        hasLast = true;
+        if (shouldEmit) {
+          callback(next);
+        }
+      } finally {
+        running = false;
+      }
+    };
+
+    void poll();
+    timer = setInterval(() => {
+      void poll();
+    }, intervalMs);
+
+    return () => {
+      disposed = true;
+      if (timer) {
+        clearInterval(timer);
+      }
+    };
+  };
+}
+
+export function cultMeshPollingDocumentWatcher<TDocument>(
+  readDocument: (context: CultMeshQueryContext) => Promise<TDocument>,
+  options: CultMeshPollingWatchOptions<TDocument> = {},
+): CultMeshDocumentWatcher<TDocument> {
+  const watch = cultMeshPollingQueryWatcher<void, TDocument>(
+    async (_parameters, context) => readDocument(context),
+    options,
+  );
+  return (context, callback) => watch(undefined, context, callback);
+}
+
+export function cultMeshPollingCollectionWatcher<TDocument>(
+  readCollection: (context: CultMeshQueryContext) => Promise<CultMeshCollectionSnapshot<TDocument>>,
+  options: CultMeshPollingWatchOptions<CultMeshCollectionSnapshot<TDocument>> = {},
+): CultMeshCollectionWatcher<TDocument> {
+  const watch = cultMeshPollingQueryWatcher<void, CultMeshCollectionSnapshot<TDocument>>(
+    async (_parameters, context) => readCollection(context),
+    {
+      ...options,
+      equals: options.equals ?? ((left, right) => JSON.stringify(left) === JSON.stringify(right)),
+    },
+  );
+  return (context, callback) => watch(undefined, context, () => callback({
+    kind: "reset",
+  }));
+}
+
+export function cultMeshStatePointer<T>(
+  pointerId: string,
+  resolvePointer: (() => Promise<T | undefined>) | CultMeshStatePointerResolver<T>,
+  watchPointer?:
+    | ((callback: (value: T) => void) => CultMeshUnsubscribe)
+    | CultMeshStatePointerWatcher<T>,
+  options: {
+    sources?: readonly CultMeshProjectionSource[];
+    routeHint?: CultMeshRouteHint;
+  } = {},
+): CultMeshStatePointer<T> {
+  return new CultMeshStatePointer(pointerId, resolvePointer, watchPointer, options);
+}
+
+export function cultMeshMutableStatePointer<T>(
+  pointerId: string,
+  resolvePointer: (() => Promise<T | undefined>) | CultMeshStatePointerResolver<T>,
+  watchPointer:
+    | ((callback: (value: T) => void) => CultMeshUnsubscribe)
+    | CultMeshStatePointerWatcher<T>,
+  replacePointer:
+    | ((value: T) => Promise<void>)
+    | CultMeshMutableStatePointerReplacer<T>,
+  options: {
+    sources?: readonly CultMeshProjectionSource[];
+    routeHint?: CultMeshRouteHint;
+  } = {},
+): CultMeshMutableStatePointer<T> {
+  return new CultMeshMutableStatePointer(
+    pointerId,
+    resolvePointer,
+    watchPointer,
+    replacePointer,
+    options,
+  );
+}
+
+export function cultMeshProjectionSource(
+  sourceId: string,
+  options: { schemaId?: string; description?: string } = {},
+): CultMeshProjectionSource {
+  requireNonEmpty(sourceId, "sourceId");
+  return {
+    sourceId,
+    schemaId: options.schemaId,
+    description: options.description,
+  };
+}
+
+export class CultMeshStateRefResolver {
+  public readonly sources: readonly CultMeshProjectionSource[];
+  public readonly routeHint: CultMeshRouteHint;
+
+  public constructor(
+    public readonly resolverId: string,
+    private readonly resolveRef: (stateRef: string, context: CultMeshQueryContext) => string | undefined,
+    options: {
+      sources?: readonly CultMeshProjectionSource[];
+      routeHint?: CultMeshRouteHint;
+    } = {},
+  ) {
+    requireNonEmpty(resolverId, "resolverId");
+    this.sources = [...(options.sources ?? [])];
+    this.routeHint = options.routeHint ?? cultMeshRouteHint();
+  }
+
+  public resolve(stateRef: string, context: CultMeshQueryContext | string = "local"): string {
+    if (!stateRef.trim()) {
+      return "";
+    }
+    return (
+      this.resolveRef(
+        stateRef,
+        this.resolveContext(typeof context === "string" ? cultMeshQueryContext(context) : context),
+      ) ?? ""
+    );
+  }
+
+  public tryResolve(
+    stateRef: string,
+    context: CultMeshQueryContext | string = "local",
+  ): { resolved: boolean; value: string } {
+    const value = this.resolve(stateRef, context);
+    return { resolved: value.length > 0, value };
+  }
+
+  public or(fallback: CultMeshStateRefResolver): CultMeshStateRefResolver {
+    return new CultMeshStateRefResolver(
+      `${this.resolverId}|${fallback.resolverId}`,
+      (stateRef, context) => {
+        const value = this.resolve(stateRef, context);
+        return value.length > 0 ? value : fallback.resolve(stateRef, context);
+      },
+      {
+        sources: [...this.sources, ...fallback.sources],
+        routeHint: this.routeHint.kind === "automatic" ? fallback.routeHint : this.routeHint,
+      },
+    );
+  }
+
+  public asFunction(): (stateRef: string) => string {
+    return (stateRef) => this.resolve(stateRef);
+  }
+
+  private resolveContext(context: CultMeshQueryContext): CultMeshQueryContext {
+    if (context.routeHint.kind !== "automatic" || this.routeHint.kind === "automatic") {
+      return context;
+    }
+    return cultMeshQueryContext(context.runtimeId, { routeHint: this.routeHint });
+  }
+}
+
+export function cultMeshStateRefResolver(
+  resolverId: string,
+  resolveRef:
+    | ((stateRef: string) => string | undefined)
+    | ((stateRef: string, context: CultMeshQueryContext) => string | undefined),
+  options: {
+    sources?: readonly CultMeshProjectionSource[];
+    routeHint?: CultMeshRouteHint;
+  } = {},
+): CultMeshStateRefResolver {
+  return new CultMeshStateRefResolver(
+    resolverId,
+    (stateRef, context) =>
+      resolveRef.length <= 1
+        ? (resolveRef as (stateRef: string) => string | undefined)(stateRef)
+        : (resolveRef as (stateRef: string, context: CultMeshQueryContext) => string | undefined)(
+            stateRef,
+            context,
+          ),
+    options,
+  );
+}
+
+export function cultMeshDescribeStateRefResolver(
+  resolver: CultMeshStateRefResolver,
+): CultMeshStateRefResolverDiagnostic {
+  return {
+    resolverId: resolver.resolverId,
+    routeHint: resolver.routeHint,
+    sources: [...resolver.sources],
+  };
+}
+
+function stateBindingMetadata(
+  options: Pick<CultMeshStateBindingDescriptor,
+    "bindingName" | "documentId" | "fieldPath" | "valueKind" | "accessMode" | "authority" | "writeCommand">,
+): Partial<CultMeshStateBindingDescriptor> {
+  return Object.fromEntries(
+    Object.entries(options).filter(([, value]) => value !== undefined),
+  ) as Partial<CultMeshStateBindingDescriptor>;
+}
+
+export function cultMeshStateBinding(
+  targetProp: string,
+  pointer:
+    | {
+        readonly pointerId: string;
+        readonly routeHint?: CultMeshRouteHint;
+        readonly sources?: readonly CultMeshProjectionSource[];
+      }
+    | string,
+  options: {
+    sourceId?: string;
+    schemaId?: string;
+    routeHint?: CultMeshRouteHint;
+    bindingName?: string;
+    documentId?: string;
+    fieldPath?: string;
+    valueKind?: CultMeshStateBindingDescriptor["valueKind"];
+    accessMode?: CultMeshStateBindingDescriptor["accessMode"];
+    authority?: string;
+    writeCommand?: string;
+  } = {},
+): CultMeshStateBindingDescriptor {
+  requireNonEmpty(targetProp, "targetProp");
+  if (typeof pointer === "string") {
+    requireNonEmpty(pointer, "pointerId");
+    return {
+      targetProp,
+      pointerId: pointer,
+      sourceId: options.sourceId,
+      schemaId: options.schemaId,
+      routeHint: options.routeHint ?? cultMeshRouteHint(),
+      ...stateBindingMetadata(options),
+    };
+  }
+
+  requireNonEmpty(pointer.pointerId, "pointerId");
+  const source = pointer.sources?.[0];
+  return {
+    targetProp,
+    pointerId: pointer.pointerId,
+    sourceId: options.sourceId ?? source?.sourceId,
+    schemaId: options.schemaId ?? source?.schemaId,
+    routeHint: options.routeHint ?? pointer.routeHint ?? cultMeshRouteHint(),
+    ...stateBindingMetadata(options),
+  };
+}
+
+export function cultMeshStateBindingRecord(
+  binding?: Partial<CultMeshStateBindingDescriptor>,
+): CultMeshStateBindingRecord;
+export function cultMeshStateBindingRecord(
+  targetProp?: string,
+  pointerId?: string,
+  sourceId?: string,
+  schemaId?: string,
+  routeKind?: string,
+  routeDescription?: string,
+  bindingName?: string,
+  documentId?: string,
+  fieldPath?: string,
+  valueKind?: string,
+  accessMode?: string,
+  authority?: string,
+  writeCommand?: string,
+): CultMeshStateBindingRecord;
+export function cultMeshStateBindingRecord(
+  bindingOrTargetProp?: Partial<CultMeshStateBindingDescriptor> | string,
+  pointerId?: string,
+  sourceId?: string,
+  schemaId?: string,
+  routeKind?: string,
+  routeDescription?: string,
+  bindingName?: string,
+  documentId?: string,
+  fieldPath?: string,
+  valueKind?: string,
+  accessMode?: string,
+  authority?: string,
+  writeCommand?: string,
+): CultMeshStateBindingRecord {
+  if (typeof bindingOrTargetProp === "object" || bindingOrTargetProp === undefined) {
+    const binding = bindingOrTargetProp;
+    const route = cultMeshRouteRecord(binding?.routeHint);
+    return {
+      targetProp: binding?.targetProp?.trim() || "value",
+      pointerId: binding?.pointerId ?? "",
+      sourceId: binding?.sourceId ?? "",
+      schemaId: binding?.schemaId ?? "",
+      routeKind: route.kind,
+      routeDescription: route.description,
+      bindingName: binding?.bindingName ?? "",
+      documentId: binding?.documentId ?? "",
+      fieldPath: binding?.fieldPath ?? "",
+      valueKind: binding?.valueKind ?? "",
+      accessMode: binding?.accessMode ?? "",
+      authority: binding?.authority ?? "",
+      writeCommand: binding?.writeCommand ?? "",
+    };
+  }
+
+  return {
+    targetProp: bindingOrTargetProp?.trim() || "value",
+    pointerId: pointerId ?? "",
+    sourceId: sourceId ?? "",
+    schemaId: schemaId ?? "",
+    routeKind: routeKind ?? "",
+    routeDescription: routeDescription ?? "",
+    bindingName: bindingName ?? "",
+    documentId: documentId ?? "",
+    fieldPath: fieldPath ?? "",
+    valueKind: valueKind ?? "",
+    accessMode: accessMode ?? "",
+    authority: authority ?? "",
+    writeCommand: writeCommand ?? "",
+  };
+}
+
+export function cultMeshStateBindingFromRecord(
+  record: Partial<CultMeshStateBindingRecord>,
+  options: {
+    fallbackRouteHint?: CultMeshRouteHint;
+    fallbackTargetProp?: string;
+  } = {},
+): CultMeshStateBindingDescriptor {
+  const targetProp = record.targetProp?.trim() || options.fallbackTargetProp?.trim() || "value";
+  return {
+    targetProp,
+    pointerId: record.pointerId?.trim() || `${targetProp}.unknown`,
+    sourceId: record.sourceId ?? "",
+    schemaId: record.schemaId ?? "",
+    routeHint: cultMeshRouteFromRecord(
+      {
+        kind: record.routeKind,
+        description: record.routeDescription,
+      },
+      options.fallbackRouteHint,
+    ),
+    ...stateBindingMetadata({
+      bindingName: record.bindingName || undefined,
+      documentId: record.documentId || undefined,
+      fieldPath: record.fieldPath || undefined,
+      valueKind: (record.valueKind || undefined) as CultMeshStateBindingDescriptor["valueKind"],
+      accessMode: (record.accessMode || undefined) as CultMeshStateBindingDescriptor["accessMode"],
+      authority: record.authority || undefined,
+      writeCommand: record.writeCommand || undefined,
+    }),
+  };
+}
+
+export function cultMeshOperationBinding(
+  operation:
+    | {
+        readonly operationId: string;
+      }
+    | string,
+  options: {
+    label?: string;
+    schemaId?: string;
+    routeHint?: CultMeshRouteHint;
+  } = {},
+): CultMeshOperationBindingDescriptor {
+  const operationId = typeof operation === "string" ? operation : operation.operationId;
+  requireNonEmpty(operationId, "operationId");
+  return {
+    operationId,
+    label: options.label ?? "",
+    schemaId: options.schemaId ?? "",
+    routeHint: options.routeHint ?? cultMeshRouteHint(),
+  };
+}
+
+export function cultMeshOperationBindingRecord(
+  binding?: Partial<CultMeshOperationBindingDescriptor>,
+): CultMeshOperationBindingRecord;
+export function cultMeshOperationBindingRecord(
+  operationId?: string,
+  label?: string,
+  schemaId?: string,
+  routeKind?: string,
+  routeDescription?: string,
+): CultMeshOperationBindingRecord;
+export function cultMeshOperationBindingRecord(
+  bindingOrOperationId?: Partial<CultMeshOperationBindingDescriptor> | string,
+  label?: string,
+  schemaId?: string,
+  routeKind?: string,
+  routeDescription?: string,
+): CultMeshOperationBindingRecord {
+  if (typeof bindingOrOperationId === "object" || bindingOrOperationId === undefined) {
+    const binding = bindingOrOperationId;
+    const route = cultMeshRouteRecord(binding?.routeHint);
+    return {
+      operationId: binding?.operationId ?? "",
+      label: binding?.label ?? "",
+      schemaId: binding?.schemaId ?? "",
+      routeKind: route.kind,
+      routeDescription: route.description,
+    };
+  }
+
+  return {
+    operationId: bindingOrOperationId ?? "",
+    label: label ?? "",
+    schemaId: schemaId ?? "",
+    routeKind: routeKind ?? "",
+    routeDescription: routeDescription ?? "",
+  };
+}
+
+export function cultMeshOperationBindingFromRecord(
+  record: Partial<CultMeshOperationBindingRecord>,
+  options: {
+    fallbackRouteHint?: CultMeshRouteHint;
+    fallbackOperationId?: string;
+  } = {},
+): CultMeshOperationBindingDescriptor {
+  return {
+    operationId: record.operationId?.trim() || options.fallbackOperationId || "",
+    label: record.label ?? "",
+    schemaId: record.schemaId ?? "",
+    routeHint: cultMeshRouteFromRecord(
+      {
+        kind: record.routeKind,
+        description: record.routeDescription,
+      },
+      options.fallbackRouteHint,
+    ),
+  };
+}
+
+export function cultMeshOperationInvocation(
+  operation:
+    | {
+        readonly operationId: string;
+        readonly schemaId?: string;
+        readonly routeHint?: CultMeshRouteHint;
+      }
+    | string,
+  options: {
+    schemaId?: string;
+    routeHint?: CultMeshRouteHint;
+    idempotencyKey?: string;
+  } = {},
+): CultMeshOperationInvocationDescriptor {
+  const operationId = typeof operation === "string" ? operation : operation.operationId;
+  requireNonEmpty(operationId, "operationId");
+  return {
+    operationId,
+    schemaId: options.schemaId ?? (typeof operation === "string" ? "" : operation.schemaId) ?? "",
+    routeHint:
+      options.routeHint ??
+      (typeof operation === "string" ? undefined : operation.routeHint) ??
+      cultMeshRouteHint(),
+    idempotencyKey: options.idempotencyKey,
+  };
+}
+
+export function cultMeshOperationInvocationRecord(
+  invocation?: CultMeshOperationInvocationDescriptor,
+  options: {
+    fallbackOperationId?: string;
+    fallbackSchemaId?: string;
+    fallbackRouteHint?: CultMeshRouteHint;
+    fallbackIdempotencyKey?: string;
+  } = {},
+): CultMeshOperationInvocationRecord {
+  const route = cultMeshRouteRecord(invocation?.routeHint ?? options.fallbackRouteHint);
+  return {
+    operationId: nonBlankOr(invocation?.operationId, options.fallbackOperationId),
+    schemaId: nonBlankOr(invocation?.schemaId, options.fallbackSchemaId),
+    routeKind: route.kind,
+    routeDescription: route.description,
+    idempotencyKey: nonBlankOr(invocation?.idempotencyKey, options.fallbackIdempotencyKey),
+  };
+}
+
+export function cultMeshOperationInvocationFromRecord(
+  record: Partial<CultMeshOperationInvocationRecord>,
+  options: {
+    fallbackOperationId?: string;
+    fallbackSchemaId?: string;
+    fallbackRouteHint?: CultMeshRouteHint;
+    fallbackIdempotencyKey?: string;
+  } = {},
+): CultMeshOperationInvocationDescriptor {
+  const operationId = nonBlankOr(record.operationId, options.fallbackOperationId);
+  requireNonEmpty(operationId, "operationId");
+  const fallbackRoute = options.fallbackRouteHint ?? cultMeshRouteHint();
+  const route = cultMeshRouteFromRecord(
+    {
+      kind: record.routeKind,
+      description: record.routeDescription,
+    },
+    fallbackRoute,
+  );
+  return {
+    operationId,
+    schemaId: nonBlankOr(record.schemaId, options.fallbackSchemaId),
+    routeHint: route,
+    idempotencyKey: nonBlankOr(record.idempotencyKey, options.fallbackIdempotencyKey) || undefined,
+  };
+}
+
+export function cultMeshOperationPayload(
+  fields: Readonly<Record<string, string | number | boolean | undefined>> = {},
+): CultMeshOperationPayload {
+  const normalized: Record<string, string> = {};
+  for (const [key, value] of Object.entries(fields)) {
+    if (!key.trim() || value === undefined) {
+      continue;
+    }
+    normalized[key] = String(value);
+  }
+
+  return {
+    fields: Object.freeze({ ...normalized }),
+    getString(key, defaultValue = "") {
+      return normalized[key] ?? defaultValue;
+    },
+    getInt(key, defaultValue = 0) {
+      const raw = normalized[key];
+      if (raw === undefined || raw.trim() === "") {
+        return defaultValue;
+      }
+      const parsed = Number.parseInt(raw, 10);
+      return Number.isNaN(parsed) ? defaultValue : parsed;
+    },
+    getDouble(key, defaultValue = 0) {
+      const raw = normalized[key];
+      if (raw === undefined || raw.trim() === "") {
+        return defaultValue;
+      }
+      const parsed = Number.parseFloat(raw);
+      return Number.isNaN(parsed) ? defaultValue : parsed;
+    },
+    getBoolean(key, defaultValue = false) {
+      const raw = normalized[key]?.toLowerCase();
+      if (raw === "true" || raw === "1" || raw === "yes" || raw === "on") {
+        return true;
+      }
+      if (raw === "false" || raw === "0" || raw === "no" || raw === "off") {
+        return false;
+      }
+      return defaultValue;
+    },
+    with(key, value) {
+      requireNonEmpty(key, "key");
+      return cultMeshOperationPayload({
+        ...normalized,
+        [key]: value,
+      });
+    },
+    toRecord() {
+      return Object.freeze({ ...normalized });
+    },
+  };
+}
+
+export function cultMeshProjectionRecipe<TParameters, TResult>(
+  projectionId: string,
+  sources: readonly CultMeshProjectionSource[],
+  projectProjection: (
+    parameters: TParameters,
+    context: CultMeshQueryContext,
+  ) => Promise<TResult>,
+  options: {
+    routeHint?: CultMeshRouteHint;
+    watchProjection?: (
+      parameters: TParameters,
+      context: CultMeshQueryContext,
+      callback: (value: TResult) => void,
+    ) => CultMeshUnsubscribe;
+  } = {},
+): CultMeshProjectionRecipe<TParameters, TResult> {
+  return new CultMeshProjectionRecipe(
+    projectionId,
+    sources,
+    projectProjection,
+    options,
+  );
+}
+
+export function cultMeshDescribeProjectionRecipe(
+  recipe: {
+    readonly projectionId: string;
+    readonly routeHint: CultMeshRouteHint;
+    readonly sources: readonly CultMeshProjectionSource[];
+  },
+): CultMeshProjectionRecipeDiagnostic {
+  return {
+    projectionId: recipe.projectionId,
+    routeHint: recipe.routeHint,
+    sources: [...recipe.sources],
+  };
+}
+
+export function cultMeshDescribeSurface(
+  surface:
+    | {
+        readonly queryId: string;
+        readonly routeHint: CultMeshRouteHint;
+        readonly sources: readonly CultMeshProjectionSource[];
+      }
+    | {
+        readonly operationId: string;
+      }
+    | {
+        readonly projectionId: string;
+        readonly routeHint: CultMeshRouteHint;
+        readonly sources: readonly CultMeshProjectionSource[];
+      }
+    | {
+        readonly feedId: string;
+        readonly routeHint: CultMeshRouteHint;
+        readonly sources: readonly CultMeshProjectionSource[];
+      }
+    | {
+        readonly documentId: string;
+        readonly routeHint: CultMeshRouteHint;
+        readonly sources: readonly CultMeshProjectionSource[];
+      }
+    | {
+        readonly collectionId: string;
+        readonly routeHint: CultMeshRouteHint;
+        readonly sources: readonly CultMeshProjectionSource[];
+      }
+    | {
+        readonly pointerId: string;
+        readonly routeHint?: CultMeshRouteHint;
+        readonly sources?: readonly CultMeshProjectionSource[];
+      }
+    | CultMeshNativeSliceViewDescriptor,
+): CultMeshSurfaceDiagnostic {
+  if ("queryId" in surface) {
+    return cultMeshSurfaceDiagnostic("query", surface.queryId, {
+      routeHint: surface.routeHint,
+      sources: surface.sources,
+    });
+  }
+
+  if ("operationId" in surface) {
+    return cultMeshSurfaceDiagnostic("operation", surface.operationId);
+  }
+
+  if ("pointerId" in surface) {
+    return cultMeshSurfaceDiagnostic("state-pointer", surface.pointerId, {
+      routeHint: surface.routeHint,
+      sources: surface.sources,
+    });
+  }
+
+  if ("documentId" in surface) {
+    return cultMeshSurfaceDiagnostic("document", surface.documentId, {
+      routeHint: surface.routeHint,
+      sources: surface.sources,
+    });
+  }
+
+  if ("collectionId" in surface) {
+    return cultMeshSurfaceDiagnostic("collection", surface.collectionId, {
+      routeHint: surface.routeHint,
+      sources: surface.sources,
+    });
+  }
+
+  if ("viewId" in surface) {
+    return cultMeshSurfaceDiagnostic("native-slice-view", surface.viewId, {
+      routeHint: surface.route,
+    });
+  }
+
+  if ("projectionId" in surface) {
+    return cultMeshSurfaceDiagnostic("projection-recipe", surface.projectionId, {
+      routeHint: surface.routeHint,
+      sources: surface.sources,
+    });
+  }
+
+  return cultMeshSurfaceDiagnostic("live-feed", surface.feedId, {
+    routeHint: surface.routeHint,
+    sources: surface.sources,
+  });
+}
+
+export function cultMeshSurfaceDiagnostic(
+  kind: CultMeshSurfaceKind,
+  surfaceId: string,
+  options: {
+    routeHint?: CultMeshRouteHint;
+    sources?: readonly CultMeshProjectionSource[];
+  } = {},
+): CultMeshSurfaceDiagnostic {
+  requireNonEmpty(surfaceId, "surfaceId");
+  return {
+    kind,
+    surfaceId,
+    routeHint: options.routeHint ?? cultMeshRouteHint(),
+    sources: [...(options.sources ?? [])],
+  };
+}
+
+export function cultMeshDescribeSurfaceCatalog(
+  catalogId: string,
+  surfaces: readonly CultMeshSurfaceDiagnostic[],
+): CultMeshSurfaceCatalogDiagnostic {
+  requireNonEmpty(catalogId, "catalogId");
+  return {
+    catalogId,
+    surfaces: surfaces.map(surface => cultMeshSurfaceDiagnostic(surface.kind, surface.surfaceId, {
+      routeHint: surface.routeHint,
+      sources: surface.sources,
+    })),
+  };
+}
+
+export function cultMeshFindSurface(
+  catalog: CultMeshSurfaceCatalogDiagnostic,
+  surfaceId: string,
+): CultMeshSurfaceDiagnostic | undefined {
+  requireNonEmpty(surfaceId, "surfaceId");
+  return catalog.surfaces.find(surface => surface.surfaceId === surfaceId);
+}
+
+export function cultMeshSurfacesByKind(
+  catalog: CultMeshSurfaceCatalogDiagnostic,
+  kind: CultMeshSurfaceKind,
+): CultMeshSurfaceDiagnostic[] {
+  return catalog.surfaces
+    .filter(surface => surface.kind === kind)
+    .map(surface => cultMeshSurfaceDiagnostic(surface.kind, surface.surfaceId, {
+      routeHint: surface.routeHint,
+      sources: surface.sources,
+    }));
+}
+
+export function cultMeshSurfaceCatalogIndex(
+  catalog: CultMeshSurfaceCatalogDiagnostic,
+): CultMeshSurfaceCatalogIndexDiagnostic {
+  return {
+    catalogId: catalog.catalogId,
+    queries: cultMeshSurfacesByKind(catalog, "query"),
+    projectionRecipes: cultMeshSurfacesByKind(catalog, "projection-recipe"),
+    liveFeeds: cultMeshSurfacesByKind(catalog, "live-feed"),
+    operations: cultMeshSurfacesByKind(catalog, "operation"),
+    documents: cultMeshSurfacesByKind(catalog, "document"),
+    collections: cultMeshSurfacesByKind(catalog, "collection"),
+    statePointers: cultMeshSurfacesByKind(catalog, "state-pointer"),
+    nativeSliceViews: cultMeshSurfacesByKind(catalog, "native-slice-view"),
+  };
+}
+
+export function cultMeshNativeSliceColumn(
+  name: string,
+  valueType: string,
+  elementSizeBytes: number,
+): CultMeshNativeSliceColumn {
+  requireNonEmpty(name, "name");
+  requireNonEmpty(valueType, "valueType");
+  if (!Number.isInteger(elementSizeBytes) || elementSizeBytes <= 0) {
+    throw new Error("elementSizeBytes must be a positive integer.");
+  }
+
+  return { name, valueType, elementSizeBytes };
+}
+
+export function cultMeshNativeSliceView(
+  viewId: string,
+  schemaId: string,
+  rowCount: number,
+  columns: readonly CultMeshNativeSliceColumn[],
+  options: { route?: CultMeshRouteHint; nativeHandle?: string } = {},
+): CultMeshNativeSliceViewDescriptor {
+  requireNonEmpty(viewId, "viewId");
+  requireNonEmpty(schemaId, "schemaId");
+  if (!Number.isInteger(rowCount) || rowCount < 0) {
+    throw new Error("rowCount must be a non-negative integer.");
+  }
+
+  return {
+    viewId,
+    schemaId,
+    rowCount,
+    columns: [...columns],
+    route: options.route ?? cultMeshRouteHint(),
+    nativeHandle: options.nativeHandle,
+  };
+}
+
+export function cultMeshDenseRowStrideBytes(
+  view: CultMeshNativeSliceViewDescriptor,
+): number {
+  return view.columns.reduce((sum, column) => sum + column.elementSizeBytes, 0);
+}
+
+export function cultMeshFindNativeSliceColumn(
+  view: CultMeshNativeSliceViewDescriptor,
+  name: string,
+): CultMeshNativeSliceColumn | undefined {
+  requireNonEmpty(name, "name");
+  return view.columns.find((column) => column.name === name);
+}
+
+export function cultMeshDescribeNativeSliceView(
+  view: CultMeshNativeSliceViewDescriptor,
+): CultMeshNativeSliceViewDiagnostic {
+  return {
+    viewId: view.viewId,
+    schemaId: view.schemaId,
+    rowCount: view.rowCount,
+    columns: [...view.columns],
+    route: view.route,
+    nativeHandle: view.nativeHandle,
+    denseRowStrideBytes: cultMeshDenseRowStrideBytes(view),
+  };
+}
+
 export interface CultMeshNodeOptions {
   documents?: Iterable<AnyCultCacheDocumentDefinition>;
   bindings?: Iterable<CultNetDocumentBinding>;
@@ -47,14 +4008,23 @@ export class CultMeshNode {
     definition: TDefinition,
     key: string,
   ): CultCacheDocumentValue<TDefinition> | undefined {
-    return this.cache.get(definition, key);
+    const registered = this.resolveCacheDefinition(definition);
+    const value = this.cache.get(registered, key);
+    return value === undefined
+      ? undefined
+      : this.parseDocumentValue(definition, value);
   }
 
   public getRequired<TDefinition extends AnyCultCacheDocumentDefinition>(
     definition: TDefinition,
     key: string,
   ): CultCacheDocumentValue<TDefinition> {
-    return this.cache.getRequired(definition, key);
+    const value = this.get(definition, key);
+    if (value === undefined) {
+      throw new Error(`CultMesh node has no "${definition.type}" document at key "${key}".`);
+    }
+
+    return value;
   }
 
   public put<TDefinition extends AnyCultCacheDocumentDefinition>(
@@ -62,19 +4032,173 @@ export class CultMeshNode {
     key: string,
     value: CultCacheDocumentValue<TDefinition>,
   ): Promise<CultCacheDocumentValue<TDefinition>> {
-    return this.cache.put(definition, key, value);
+    const registered = this.resolveCacheDefinition(definition);
+    return this.cache
+      .put(registered, key, this.parseDocumentValue(definition, value) as never)
+      .then(stored => this.parseDocumentValue(definition, stored));
   }
 
   public delete<TDefinition extends AnyCultCacheDocumentDefinition>(
     definition: TDefinition,
     key: string,
   ): Promise<boolean> {
-    return this.cache.delete(definition, key);
+    return this.cache.delete(this.resolveCacheDefinition(definition), key);
+  }
+
+  public document<TDefinition extends AnyCultCacheDocumentDefinition>(
+    definition: TDefinition,
+    key: string,
+    options: {
+      documentId?: string;
+      routeHint?: CultMeshRouteHint;
+      pollMs?: number;
+    } = {},
+  ): CultMeshDocumentHandle<CultCacheDocumentValue<TDefinition>> {
+    const documentId = options.documentId ?? `${definition.type}:${key}`;
+    return this.asRequestedDocument(
+      cultMeshDocumentFromCache(
+        this.cache,
+        this.resolveCacheDefinition(definition),
+        key,
+        { ...options, documentId },
+      ),
+      definition,
+    );
+  }
+
+  public async syncDocumentFromPeerSnapshot<TDefinition extends AnyCultCacheDocumentDefinition>(
+    peer: CultNetPeer | (() => CultNetPeer | Promise<CultNetPeer>),
+    definition: TDefinition,
+    key: string,
+    options: {
+      timeoutMs?: number;
+      messageIdPrefix?: string;
+    } = {},
+  ): Promise<CultCacheDocumentValue<TDefinition>> {
+    const registered = this.resolveCacheDefinition(definition);
+    const schema = cultMeshSchemaFromDefinition(definition);
+    const schemaId = schema.schemaId ?? schema.type;
+    if (!schemaId) {
+      throw new Error("CultMesh synced document requires a schema id or document type.");
+    }
+    const document = await requestCultNetRawSnapshotDocument(
+      peer,
+      schemaId,
+      key,
+      {
+        timeoutMs: options.timeoutMs,
+        messageIdPrefix: options.messageIdPrefix ?? key,
+        accepts: record => {
+          try {
+            definition.schema.parse(decodeCultNetRawDocumentPayload(record));
+            return true;
+          } catch {
+            return false;
+          }
+        },
+      },
+    );
+    await this.documents.applyRawDocumentPutMessage(this.cache, {
+      schemaVersion: "cultnet.document_put_raw.v0",
+      messageId: options.messageIdPrefix ?? `sync:${key}`,
+      document,
+    });
+    return this.parseDocumentValue(definition, this.cache.getRequired(registered, key));
+  }
+
+  public syncDocumentFromPublication<TDefinition extends AnyCultCacheDocumentDefinition>(
+    source: CultMeshDocumentPublicationSource,
+    definition: TDefinition,
+    key: string,
+    options: {
+      timeoutMs?: number;
+      messageIdPrefix?: string;
+    } = {},
+  ): Promise<CultCacheDocumentValue<TDefinition>> {
+    return cultMeshSyncDocumentFromPublication(this, source, definition, key, options);
+  }
+
+  public syncDocumentsFromPublication(
+    source: CultMeshDocumentPublicationSourceResolver,
+    bindings: readonly CultMeshPublicationDocumentBinding[],
+    options: {
+      routeHint?: CultMeshRouteHint;
+      timeoutMs?: number;
+      pollMs?: number;
+      messageIdPrefix?: string;
+    } = {},
+  ): Promise<CultMeshDocumentCatalog> {
+    return cultMeshSyncDocumentsFromPublication(this, source, bindings, options);
+  }
+
+  public globalDocument<TDefinition extends AnyCultCacheDocumentDefinition>(
+    definition: TDefinition,
+    options: {
+      documentId?: string;
+      routeHint?: CultMeshRouteHint;
+      pollMs?: number;
+    } = {},
+  ): CultMeshDocumentHandle<CultCacheDocumentValue<TDefinition>> {
+    const documentId = options.documentId ?? `${definition.type}:global`;
+    return this.asRequestedDocument(
+      cultMeshGlobalDocumentFromCache(
+        this.cache,
+        this.resolveCacheDefinition(definition),
+        { ...options, documentId },
+      ),
+      definition,
+    );
+  }
+
+  public collection<TDefinition extends AnyCultCacheDocumentDefinition>(
+    definition: TDefinition,
+    options: {
+      collectionId?: string;
+      routeHint?: CultMeshRouteHint;
+      pollMs?: number;
+    } = {},
+  ): CultMeshCollectionHandle<CultCacheDocumentValue<TDefinition>> {
+    const collectionId = options.collectionId ?? definition.type;
+    return cultMeshCollectionFromCache(
+      this.cache,
+      this.resolveCacheDefinition(definition),
+      { ...options, collectionId },
+    ).asSchemaAlias<CultCacheDocumentValue<TDefinition>>(
+      cultMeshSchemaFromDefinition(definition),
+      { parse: value => this.parseDocumentValue(definition, value) },
+    );
   }
 
   public async flush(soft = false): Promise<void> {
     await this.store.pushAll?.(this.cache.snapshot(), { soft });
   }
+
+  private resolveCacheDefinition<TDefinition extends AnyCultCacheDocumentDefinition>(
+    definition: TDefinition,
+  ): AnyCultCacheDocumentDefinition {
+    const schema = cultMeshSchemaFromDefinition(definition);
+    return (
+      this.documents.get(definition.type) ??
+      (schema.schemaId ? this.documents.getBySchemaId(schema.schemaId) : undefined)
+    )?.definition ?? definition;
+  }
+
+  private asRequestedDocument<TDefinition extends AnyCultCacheDocumentDefinition>(
+    document: CultMeshDocumentHandle<unknown>,
+    definition: TDefinition,
+  ): CultMeshDocumentHandle<CultCacheDocumentValue<TDefinition>> {
+    return document.asSchemaAlias<CultCacheDocumentValue<TDefinition>>(
+      cultMeshSchemaFromDefinition(definition),
+      { parse: value => this.parseDocumentValue(definition, value) },
+    );
+  }
+
+  private parseDocumentValue<TDefinition extends AnyCultCacheDocumentDefinition>(
+    definition: TDefinition,
+    value: unknown,
+  ): CultCacheDocumentValue<TDefinition> {
+    return definition.schema.parse(value) as CultCacheDocumentValue<TDefinition>;
+  }
 }
 
 export class CultMeshVerseCatalog<TVerse = unknown> {
@@ -133,15 +4257,41 @@ export interface CultMeshRudpDocumentPut {
   };
 }
 
+export interface CultMeshRudpDocumentReceipt<TDefinition extends AnyCultCacheDocumentDefinition = AnyCultCacheDocumentDefinition> {
+  binding: CultNetDocumentBinding<TDefinition>;
+  recordKey: string;
+  value: CultCacheDocumentValue<TDefinition>;
+  messageId?: string;
+  sourceRuntimeId?: string;
+  sourceAgentId?: string;
+  sourceRole?: string;
+  tags?: string[];
+}
+
 export interface CultMeshRudpDocumentServerOptions extends CultMeshRudpSocketOptions {
   documents: CultNetDocumentRegistry;
   getCache?: () => Promise<CultCache> | CultCache;
   onError?: (error: Error) => void;
-  onDocumentPutRaw?: (document: CultMeshRudpDocumentPut) => void | Promise<void>;
+  onDocumentPutRaw?: (document: CultMeshRudpDocumentPut) =>
+    | CultMeshRudpDocumentReceipt
+    | void
+    | Promise<CultMeshRudpDocumentReceipt | void>;
+  onOperationRequest?: (
+    request: CultNetOperationRequestMessage,
+    session: CultMeshRudpServerSession,
+  ) => CultNetOperationResponseMessage | Promise<CultNetOperationResponseMessage>;
+  onSessionClosed?: (session: CultMeshRudpServerSession) => void | Promise<void>;
   wireContract?: CultNetWireContract;
   sessionTimeoutMs?: number;
 }
 
+export interface CultMeshRudpServerSession {
+  readonly sessionId: string;
+  readonly remote: { address: string; family: string; port: number };
+  readonly connectPayload?: Uint8Array;
+  send(message: CultNetMessage): void;
+}
+
 export interface CultMeshRudpDocumentServer {
   readonly bind: { host: string; port: number };
   start(): Promise<void>;
@@ -157,6 +4307,10 @@ export interface CultMeshRudpDocumentPublishOptions extends CultMeshRudpPeerOpti
   flushTimeoutMs?: number;
 }
 
+export interface CultMeshRudpDocumentReceiptOptions extends CultMeshRudpDocumentPublishOptions {
+  receiptTimeoutMs?: number;
+}
+
 export interface CultMeshRudpEndpoint {
   host: string;
   port: number;
@@ -544,6 +4698,974 @@ export class CultMeshStreamCatalog {
 }
 
 export class CultMesh {
+  public static vec2(x: number, y: number): CultMeshVec2 {
+    return cultMeshVec2(x, y);
+  }
+
+  public static rect(min: CultMeshVec2, max: CultMeshVec2): CultMeshRect {
+    return cultMeshRect(min, max);
+  }
+
+  public static rectFromBounds(
+    minX: number,
+    minY: number,
+    maxX: number,
+    maxY: number,
+  ): CultMeshRect {
+    return cultMeshRectFromBounds(minX, minY, maxX, maxY);
+  }
+
+  public static viewportRequest(
+    viewport: CultMeshRect,
+    controlledEntityIndices?: readonly number[],
+  ): CultMeshViewportRequest {
+    return cultMeshViewportRequest(viewport, controlledEntityIndices);
+  }
+
+  public static routeHint(
+    kind: CultMeshLocalityKind = "automatic",
+    description?: string,
+  ): CultMeshRouteHint {
+    return cultMeshRouteHint(kind, description);
+  }
+
+  public static routeRecord(routeHint?: CultMeshRouteHint): CultMeshRouteRecord;
+  public static routeRecord(kind?: string, description?: string): CultMeshRouteRecord;
+  public static routeRecord(
+    routeOrKind?: CultMeshRouteHint | string,
+    description = "",
+  ): CultMeshRouteRecord {
+    return typeof routeOrKind === "string" || routeOrKind === undefined
+      ? cultMeshRouteRecord(routeOrKind, description)
+      : cultMeshRouteRecord(routeOrKind);
+  }
+
+  public static routeFromRecord(
+    record: Partial<CultMeshRouteRecord>,
+    fallback: CultMeshRouteHint = cultMeshRouteHint(),
+  ): CultMeshRouteHint {
+    return cultMeshRouteFromRecord(record, fallback);
+  }
+
+  public static authorityClaim(
+    role: string,
+    options: { shardId?: string; leaseId?: string } = {},
+  ): CultMeshAuthorityClaim {
+    return cultMeshAuthorityClaim(role, options);
+  }
+
+  public static verseContext(
+    verseId: string,
+    runtimeId: string,
+    options: {
+      routeHint?: CultMeshRouteHint;
+      claims?: readonly CultMeshAuthorityClaim[];
+    } = {},
+  ): CultMeshVerseContext {
+    return cultMeshVerseContext(verseId, runtimeId, options);
+  }
+
+  public static verse(
+    verseId: string,
+    runtimeId: string,
+    options: {
+      routeHint?: CultMeshRouteHint;
+      claims?: readonly CultMeshAuthorityClaim[];
+    } = {},
+  ): CultMeshVerse {
+    return cultMeshVerse(verseId, runtimeId, options);
+  }
+
+  public static async connectVerse(
+    verseId: string,
+    runtimeId: string,
+    options: {
+      routeHint?: CultMeshRouteHint;
+      claims?: readonly CultMeshAuthorityClaim[];
+    } = {},
+  ): Promise<CultMeshVerse> {
+    return cultMeshVerse(verseId, runtimeId, options);
+  }
+
+  public static operationContextFromVerse(
+    context: CultMeshVerseContext,
+    options: { idempotencyKey?: string } = {},
+  ): CultMeshOperationContext {
+    return cultMeshOperationContextFromVerse(context, options);
+  }
+
+  public static queryContextFromVerse(
+    context: CultMeshVerseContext,
+  ): CultMeshQueryContext {
+    return cultMeshQueryContextFromVerse(context);
+  }
+
+  public static bindOperation<TRequest, TResponse>(
+    verse: CultMeshVerseContext | CultMeshVerse,
+    operation: CultMeshOperationHandle<TRequest, TResponse>,
+  ): CultMeshBoundOperationHandle<TRequest, TResponse> {
+    return cultMeshBindOperation(verse, operation);
+  }
+
+  public static bindQuery<TParameters, TResult>(
+    verse: CultMeshVerseContext | CultMeshVerse,
+    query: CultMeshQuerySurface<TParameters, TResult>,
+  ): CultMeshBoundQuerySurface<TParameters, TResult> {
+    return cultMeshBindQuery(verse, query);
+  }
+
+  public static bindLiveFeed<TParameters, TResult>(
+    verse: CultMeshVerseContext | CultMeshVerse,
+    feed: CultMeshLiveFeed<TParameters, TResult>,
+  ): CultMeshBoundLiveFeed<TParameters, TResult> {
+    return cultMeshBindLiveFeed(verse, feed);
+  }
+
+  public static operationContext(
+    runtimeId: string,
+    options: {
+      claims?: readonly CultMeshAuthorityClaim[];
+      routeHint?: CultMeshRouteHint;
+      idempotencyKey?: string;
+    } = {},
+  ): CultMeshOperationContext {
+    return cultMeshOperationContext(runtimeId, options);
+  }
+
+  public static operationContextFor(runtimeId: string): CultMeshOperationContextBuilder {
+    return cultMeshOperationContextFor(runtimeId);
+  }
+
+  public static queryContext(
+    runtimeId: string,
+    options: { routeHint?: CultMeshRouteHint } = {},
+  ): CultMeshQueryContext {
+    return cultMeshQueryContext(runtimeId, options);
+  }
+
+  public static queryContextFor(runtimeId: string): CultMeshQueryContextBuilder {
+    return cultMeshQueryContextFor(runtimeId);
+  }
+
+  public static operationReceipt(
+    operationId: string,
+    accepted: boolean,
+    options: { route?: CultMeshRouteHint; diagnostic?: string } = {},
+  ): CultMeshOperationReceipt {
+    return cultMeshOperationReceipt(operationId, accepted, options);
+  }
+
+  public static operation<TRequest, TResponse>(
+    operationId: string,
+    invokeOperation: (
+      request: TRequest,
+      context: CultMeshOperationContext,
+    ) => Promise<TResponse>,
+  ): CultMeshOperationHandle<TRequest, TResponse> {
+    return cultMeshOperation(operationId, invokeOperation);
+  }
+
+  public static query<TParameters, TResult>(
+    queryId: string,
+    executeQuery: (
+      parameters: TParameters,
+      context: CultMeshQueryContext,
+    ) => Promise<TResult>,
+    options: {
+      sources?: readonly CultMeshProjectionSource[];
+      routeHint?: CultMeshRouteHint;
+      watchQuery?: CultMeshQueryWatcher<TParameters, TResult>;
+    } = {},
+  ): CultMeshQuerySurface<TParameters, TResult> {
+    return cultMeshQuery(queryId, executeQuery, options);
+  }
+
+  public static describeQuerySurface(
+    query: {
+      readonly queryId: string;
+      readonly routeHint: CultMeshRouteHint;
+      readonly sources: readonly CultMeshProjectionSource[];
+    },
+  ): CultMeshQuerySurfaceDiagnostic {
+    return cultMeshDescribeQuerySurface(query);
+  }
+
+  public static describeOperationHandle(
+    operation: {
+      readonly operationId: string;
+    },
+  ): CultMeshOperationHandleDiagnostic {
+    return cultMeshDescribeOperationHandle(operation);
+  }
+
+  public static describeStatePointer(
+    pointer: {
+      readonly pointerId: string;
+      readonly routeHint?: CultMeshRouteHint;
+      readonly sources?: readonly CultMeshProjectionSource[];
+    },
+  ): CultMeshStatePointerDiagnostic {
+    return cultMeshDescribeStatePointer(pointer);
+  }
+
+  public static liveFeed<TParameters, TResult>(
+    feedId: string,
+    snapshotFeed: (
+      parameters: TParameters,
+      context: CultMeshQueryContext,
+    ) => Promise<TResult>,
+    options: {
+      sources?: readonly CultMeshProjectionSource[];
+      routeHint?: CultMeshRouteHint;
+      watchFeed?: CultMeshLiveFeedWatcher<TParameters, TResult>;
+    } = {},
+  ): CultMeshLiveFeed<TParameters, TResult> {
+    return cultMeshLiveFeed(feedId, snapshotFeed, options);
+  }
+
+  public static document<TDocument>(
+    documentId: string,
+    schema: CultMeshDocumentSchemaDescriptor,
+    snapshotDocument: (context: CultMeshQueryContext) => Promise<TDocument>,
+    options: {
+      sources?: readonly CultMeshProjectionSource[];
+      routeHint?: CultMeshRouteHint;
+      watchDocument?: CultMeshDocumentWatcher<TDocument>;
+      replaceDocument?: CultMeshDocumentReplacer<TDocument>;
+      submitPrediction?: CultMeshDocumentPredictionSubmitter<TDocument>;
+    } = {},
+  ): CultMeshDocumentHandle<TDocument> {
+    return cultMeshDocument(documentId, schema, snapshotDocument, options);
+  }
+
+  public static documentFromCache<TDefinition extends AnyCultCacheDocumentDefinition>(
+    cache: CultCache,
+    definition: TDefinition,
+    key: string,
+    options: {
+      documentId?: string;
+      routeHint?: CultMeshRouteHint;
+      pollMs?: number;
+    } = {},
+  ): CultMeshDocumentHandle<CultCacheDocumentValue<TDefinition>> {
+    return cultMeshDocumentFromCache(cache, definition, key, options);
+  }
+
+  public static documentFromStore(
+    store: CacheBackingStore,
+    schemaId: string,
+    options?: {
+      documentId?: string;
+      routeHint?: CultMeshRouteHint;
+      sourceId?: string;
+      pollMs?: number;
+    },
+  ): CultMeshDocumentHandle<unknown>;
+  public static documentFromStore<TDefinition extends AnyCultCacheDocumentDefinition>(
+    store: CacheBackingStore,
+    definition: TDefinition,
+    options?: {
+      documentId?: string;
+      routeHint?: CultMeshRouteHint;
+      sourceId?: string;
+      pollMs?: number;
+    },
+  ): CultMeshDocumentHandle<CultCacheDocumentValue<TDefinition>>;
+  public static documentFromStore(
+    store: CacheBackingStore,
+    schemaOrDefinition: string | AnyCultCacheDocumentDefinition,
+    options: {
+      documentId?: string;
+      routeHint?: CultMeshRouteHint;
+      sourceId?: string;
+      pollMs?: number;
+    } = {},
+  ): CultMeshDocumentHandle<unknown> {
+    return typeof schemaOrDefinition === "string"
+      ? cultMeshDocumentFromStore(store, schemaOrDefinition, options)
+      : cultMeshDocumentFromStore(store, schemaOrDefinition, options);
+  }
+
+  public static documentFromSingleFile(
+    path: string,
+    schemaId: string,
+    options?: {
+      documentId?: string;
+      routeHint?: CultMeshRouteHint;
+      sourceId?: string;
+      pollMs?: number;
+    },
+  ): CultMeshDocumentHandle<unknown>;
+  public static documentFromSingleFile<TDefinition extends AnyCultCacheDocumentDefinition>(
+    path: string,
+    definition: TDefinition,
+    options?: {
+      documentId?: string;
+      routeHint?: CultMeshRouteHint;
+      sourceId?: string;
+      pollMs?: number;
+    },
+  ): CultMeshDocumentHandle<CultCacheDocumentValue<TDefinition>>;
+  public static documentFromSingleFile(
+    path: string,
+    schemaOrDefinition: string | AnyCultCacheDocumentDefinition,
+    options: {
+      documentId?: string;
+      routeHint?: CultMeshRouteHint;
+      sourceId?: string;
+      pollMs?: number;
+    } = {},
+  ): CultMeshDocumentHandle<unknown> {
+    return typeof schemaOrDefinition === "string"
+      ? cultMeshDocumentFromSingleFile(path, schemaOrDefinition, options)
+      : cultMeshDocumentFromSingleFile(path, schemaOrDefinition, options);
+  }
+
+  public static documentFromPeerSnapshot(
+    peer: CultNetPeer | (() => CultNetPeer | Promise<CultNetPeer>),
+    schemaId: string,
+    recordKey: string,
+    options?: {
+      documentId?: string;
+      routeHint?: CultMeshRouteHint;
+      sourceId?: string;
+      timeoutMs?: number;
+      pollMs?: number;
+      messageIdPrefix?: string;
+    },
+  ): CultMeshDocumentHandle<unknown>;
+  public static documentFromPeerSnapshot<TDefinition extends AnyCultCacheDocumentDefinition>(
+    peer: CultNetPeer | (() => CultNetPeer | Promise<CultNetPeer>),
+    definition: TDefinition,
+    recordKey: string,
+    options?: {
+      documentId?: string;
+      routeHint?: CultMeshRouteHint;
+      sourceId?: string;
+      timeoutMs?: number;
+      pollMs?: number;
+      messageIdPrefix?: string;
+    },
+  ): CultMeshDocumentHandle<CultCacheDocumentValue<TDefinition>>;
+  public static documentFromPeerSnapshot(
+    peer: CultNetPeer | (() => CultNetPeer | Promise<CultNetPeer>),
+    schemaOrDefinition: string | AnyCultCacheDocumentDefinition,
+    recordKey: string,
+    options: {
+      documentId?: string;
+      routeHint?: CultMeshRouteHint;
+      sourceId?: string;
+      timeoutMs?: number;
+      pollMs?: number;
+      messageIdPrefix?: string;
+    } = {},
+  ): CultMeshDocumentHandle<unknown> {
+    return typeof schemaOrDefinition === "string"
+      ? cultMeshDocumentFromPeerSnapshot(peer, schemaOrDefinition, recordKey, options)
+      : cultMeshDocumentFromPeerSnapshot(peer, schemaOrDefinition, recordKey, options);
+  }
+
+  public static documentFromPublication(
+    source: CultMeshDocumentPublicationSource,
+    schemaId: string,
+    recordKey: string,
+    options?: {
+      documentId?: string;
+      routeHint?: CultMeshRouteHint;
+      sourceId?: string;
+      timeoutMs?: number;
+      pollMs?: number;
+      messageIdPrefix?: string;
+    },
+  ): CultMeshDocumentHandle<unknown>;
+  public static documentFromPublication<TDefinition extends AnyCultCacheDocumentDefinition>(
+    source: CultMeshDocumentPublicationSource,
+    definition: TDefinition,
+    recordKey: string,
+    options?: {
+      documentId?: string;
+      routeHint?: CultMeshRouteHint;
+      sourceId?: string;
+      timeoutMs?: number;
+      pollMs?: number;
+      messageIdPrefix?: string;
+    },
+  ): CultMeshDocumentHandle<CultCacheDocumentValue<TDefinition>>;
+  public static documentFromPublication(
+    source: CultMeshDocumentPublicationSource,
+    schemaOrDefinition: string | AnyCultCacheDocumentDefinition,
+    recordKey: string,
+    options: {
+      documentId?: string;
+      routeHint?: CultMeshRouteHint;
+      sourceId?: string;
+      timeoutMs?: number;
+      pollMs?: number;
+      messageIdPrefix?: string;
+    } = {},
+  ): CultMeshDocumentHandle<unknown> {
+    return typeof schemaOrDefinition === "string"
+      ? cultMeshDocumentFromPublication(source, schemaOrDefinition, recordKey, options)
+      : cultMeshDocumentFromPublication(source, schemaOrDefinition, recordKey, options);
+  }
+
+  public static globalDocumentFromCache<TDefinition extends AnyCultCacheDocumentDefinition>(
+    cache: CultCache,
+    definition: TDefinition,
+    options: {
+      documentId?: string;
+      routeHint?: CultMeshRouteHint;
+      pollMs?: number;
+    } = {},
+  ): CultMeshDocumentHandle<CultCacheDocumentValue<TDefinition>> {
+    return cultMeshGlobalDocumentFromCache(cache, definition, options);
+  }
+
+  public static syncDocumentFromPeerSnapshot<TDefinition extends AnyCultCacheDocumentDefinition>(
+    node: CultMeshNode,
+    peer: CultNetPeer | (() => CultNetPeer | Promise<CultNetPeer>),
+    definition: TDefinition,
+    key: string,
+    options: {
+      timeoutMs?: number;
+      messageIdPrefix?: string;
+    } = {},
+  ): Promise<CultCacheDocumentValue<TDefinition>> {
+    return node.syncDocumentFromPeerSnapshot(peer, definition, key, options);
+  }
+
+  public static syncDocumentFromPublication<TDefinition extends AnyCultCacheDocumentDefinition>(
+    node: CultMeshNode,
+    source: CultMeshDocumentPublicationSource,
+    definition: TDefinition,
+    key: string,
+    options: {
+      timeoutMs?: number;
+      messageIdPrefix?: string;
+    } = {},
+  ): Promise<CultCacheDocumentValue<TDefinition>> {
+    return node.syncDocumentFromPublication(source, definition, key, options);
+  }
+
+  public static syncDocumentsFromPublication(
+    node: CultMeshNode,
+    source: CultMeshDocumentPublicationSourceResolver,
+    bindings: readonly CultMeshPublicationDocumentBinding[],
+    options: {
+      routeHint?: CultMeshRouteHint;
+      timeoutMs?: number;
+      pollMs?: number;
+      messageIdPrefix?: string;
+    } = {},
+  ): Promise<CultMeshDocumentCatalog> {
+    return node.syncDocumentsFromPublication(source, bindings, options);
+  }
+
+  public static documents(
+    ...documents: readonly CultMeshDocumentHandle<any>[]
+  ): CultMeshDocumentCatalog {
+    return cultMeshDocuments(...documents);
+  }
+
+  public static publicationDocument(
+    schema: string | AnyCultCacheDocumentDefinition,
+    recordKey: string,
+    options: {
+      documentId?: string;
+      sourceId?: string;
+      source?: CultMeshDocumentPublicationSource;
+    } = {},
+  ): CultMeshPublicationDocumentBinding {
+    return cultMeshPublicationDocument(schema, recordKey, options);
+  }
+
+  public static documentsFromPublication(
+    source: CultMeshDocumentPublicationSourceResolver,
+    bindings: readonly CultMeshPublicationDocumentBinding[],
+    options: {
+      routeHint?: CultMeshRouteHint;
+      timeoutMs?: number;
+      pollMs?: number;
+      messageIdPrefix?: string;
+    } = {},
+  ): CultMeshDocumentCatalog {
+    return cultMeshDocumentsFromPublication(source, bindings, options);
+  }
+
+  public static bindDocument<TDocument>(
+    verse: CultMeshVerseContext | CultMeshVerse,
+    document: CultMeshDocumentHandle<TDocument>,
+  ): CultMeshBoundDocumentHandle<TDocument> {
+    return cultMeshBindDocument(verse, document);
+  }
+
+  public static collection<TDocument>(
+    collectionId: string,
+    schema: CultMeshDocumentSchemaDescriptor,
+    snapshotCollection: (context: CultMeshQueryContext) => Promise<CultMeshCollectionSnapshot<TDocument>>,
+    options: {
+      sources?: readonly CultMeshProjectionSource[];
+      routeHint?: CultMeshRouteHint;
+      watchCollection?: CultMeshCollectionWatcher<TDocument>;
+    } = {},
+  ): CultMeshCollectionHandle<TDocument> {
+    return cultMeshCollection(collectionId, schema, snapshotCollection, options);
+  }
+
+  public static collections(
+    ...collections: readonly CultMeshCollectionHandle<any>[]
+  ): CultMeshCollectionCatalog {
+    return cultMeshCollections(...collections);
+  }
+
+  public static collectionFromCache<TDefinition extends AnyCultCacheDocumentDefinition>(
+    cache: CultCache,
+    definition: TDefinition,
+    options: {
+      collectionId?: string;
+      routeHint?: CultMeshRouteHint;
+      pollMs?: number;
+    } = {},
+  ): CultMeshCollectionHandle<CultCacheDocumentValue<TDefinition>> {
+    return cultMeshCollectionFromCache(cache, definition, options);
+  }
+
+  public static bindCollection<TDocument>(
+    verse: CultMeshVerseContext | CultMeshVerse,
+    collection: CultMeshCollectionHandle<TDocument>,
+  ): CultMeshBoundCollectionHandle<TDocument> {
+    return cultMeshBindCollection(verse, collection);
+  }
+
+  public static describeLiveFeed(
+    feed: {
+      readonly feedId: string;
+      readonly routeHint: CultMeshRouteHint;
+      readonly sources: readonly CultMeshProjectionSource[];
+    },
+  ): CultMeshLiveFeedDiagnostic {
+    return cultMeshDescribeLiveFeed(feed);
+  }
+
+  public static pollingQueryWatcher<TParameters, TResult>(
+    executeQuery: (
+      parameters: TParameters,
+      context: CultMeshQueryContext,
+    ) => Promise<TResult>,
+    options: CultMeshPollingWatchOptions<TResult> = {},
+  ): CultMeshQueryWatcher<TParameters, TResult> {
+    return cultMeshPollingQueryWatcher(executeQuery, options);
+  }
+
+  public static statePointer<T>(
+    pointerId: string,
+    resolvePointer: (() => Promise<T | undefined>) | CultMeshStatePointerResolver<T>,
+    watchPointer?:
+      | ((callback: (value: T) => void) => CultMeshUnsubscribe)
+      | CultMeshStatePointerWatcher<T>,
+    options: {
+      sources?: readonly CultMeshProjectionSource[];
+      routeHint?: CultMeshRouteHint;
+    } = {},
+  ): CultMeshStatePointer<T> {
+    return cultMeshStatePointer(pointerId, resolvePointer, watchPointer, options);
+  }
+
+  public static mutableStatePointer<T>(
+    pointerId: string,
+    resolvePointer: (() => Promise<T | undefined>) | CultMeshStatePointerResolver<T>,
+    watchPointer:
+      | ((callback: (value: T) => void) => CultMeshUnsubscribe)
+      | CultMeshStatePointerWatcher<T>,
+    replacePointer:
+      | ((value: T) => Promise<void>)
+      | CultMeshMutableStatePointerReplacer<T>,
+    options: {
+      sources?: readonly CultMeshProjectionSource[];
+      routeHint?: CultMeshRouteHint;
+    } = {},
+  ): CultMeshMutableStatePointer<T> {
+    return cultMeshMutableStatePointer(
+      pointerId,
+      resolvePointer,
+      watchPointer,
+      replacePointer,
+      options,
+    );
+  }
+
+  public static bindStatePointer<T>(
+    verse: CultMeshVerseContext | CultMeshVerse,
+    pointer: CultMeshStatePointer<T>,
+  ): CultMeshBoundStatePointer<T> {
+    return cultMeshBindStatePointer(verse, pointer);
+  }
+
+  public static bindMutableStatePointer<T>(
+    verse: CultMeshVerseContext | CultMeshVerse,
+    pointer: CultMeshMutableStatePointer<T>,
+  ): CultMeshBoundMutableStatePointer<T> {
+    return cultMeshBindMutableStatePointer(verse, pointer);
+  }
+
+  public static projectionSource(
+    sourceId: string,
+    options: { schemaId?: string; description?: string } = {},
+  ): CultMeshProjectionSource {
+    return cultMeshProjectionSource(sourceId, options);
+  }
+
+  public static stateRefResolver(
+    resolverId: string,
+    resolveRef:
+      | ((stateRef: string) => string | undefined)
+      | ((stateRef: string, context: CultMeshQueryContext) => string | undefined),
+    options: {
+      sources?: readonly CultMeshProjectionSource[];
+      routeHint?: CultMeshRouteHint;
+    } = {},
+  ): CultMeshStateRefResolver {
+    return cultMeshStateRefResolver(resolverId, resolveRef, options);
+  }
+
+  public static describeStateRefResolver(
+    resolver: CultMeshStateRefResolver,
+  ): CultMeshStateRefResolverDiagnostic {
+    return cultMeshDescribeStateRefResolver(resolver);
+  }
+
+  public static stateBinding(
+    targetProp: string,
+    pointer:
+      | {
+          readonly pointerId: string;
+          readonly routeHint?: CultMeshRouteHint;
+          readonly sources?: readonly CultMeshProjectionSource[];
+        }
+      | string,
+    options: {
+      sourceId?: string;
+      schemaId?: string;
+      routeHint?: CultMeshRouteHint;
+      bindingName?: string;
+      documentId?: string;
+      fieldPath?: string;
+      valueKind?: CultMeshStateBindingDescriptor["valueKind"];
+      accessMode?: CultMeshStateBindingDescriptor["accessMode"];
+      authority?: string;
+      writeCommand?: string;
+    } = {},
+  ): CultMeshStateBindingDescriptor {
+    return cultMeshStateBinding(targetProp, pointer, options);
+  }
+
+  public static stateBindingRecord(
+    binding?: Partial<CultMeshStateBindingDescriptor>,
+  ): CultMeshStateBindingRecord;
+  public static stateBindingRecord(
+    targetProp?: string,
+    pointerId?: string,
+    sourceId?: string,
+    schemaId?: string,
+    routeKind?: string,
+    routeDescription?: string,
+    bindingName?: string,
+    documentId?: string,
+    fieldPath?: string,
+    valueKind?: string,
+    accessMode?: string,
+    authority?: string,
+    writeCommand?: string,
+  ): CultMeshStateBindingRecord;
+  public static stateBindingRecord(
+    bindingOrTargetProp?: Partial<CultMeshStateBindingDescriptor> | string,
+    pointerId?: string,
+    sourceId?: string,
+    schemaId?: string,
+    routeKind?: string,
+    routeDescription?: string,
+    bindingName?: string,
+    documentId?: string,
+    fieldPath?: string,
+    valueKind?: string,
+    accessMode?: string,
+    authority?: string,
+    writeCommand?: string,
+  ): CultMeshStateBindingRecord {
+    return typeof bindingOrTargetProp === "object" || bindingOrTargetProp === undefined
+      ? cultMeshStateBindingRecord(bindingOrTargetProp)
+      : cultMeshStateBindingRecord(
+          bindingOrTargetProp,
+          pointerId,
+          sourceId,
+          schemaId,
+          routeKind,
+          routeDescription,
+          bindingName,
+          documentId,
+          fieldPath,
+          valueKind,
+          accessMode,
+          authority,
+          writeCommand,
+        );
+  }
+
+  public static stateBindingFromRecord(
+    record: Partial<CultMeshStateBindingRecord>,
+    options: {
+      fallbackRouteHint?: CultMeshRouteHint;
+      fallbackTargetProp?: string;
+    } = {},
+  ): CultMeshStateBindingDescriptor {
+    return cultMeshStateBindingFromRecord(record, options);
+  }
+
+  public static operationBinding(
+    operation:
+      | {
+          readonly operationId: string;
+        }
+      | string,
+    options: {
+      label?: string;
+      schemaId?: string;
+      routeHint?: CultMeshRouteHint;
+    } = {},
+  ): CultMeshOperationBindingDescriptor {
+    return cultMeshOperationBinding(operation, options);
+  }
+
+  public static operationBindingRecord(
+    binding?: Partial<CultMeshOperationBindingDescriptor>,
+  ): CultMeshOperationBindingRecord;
+  public static operationBindingRecord(
+    operationId?: string,
+    label?: string,
+    schemaId?: string,
+    routeKind?: string,
+    routeDescription?: string,
+  ): CultMeshOperationBindingRecord;
+  public static operationBindingRecord(
+    bindingOrOperationId?: Partial<CultMeshOperationBindingDescriptor> | string,
+    label?: string,
+    schemaId?: string,
+    routeKind?: string,
+    routeDescription?: string,
+  ): CultMeshOperationBindingRecord {
+    return typeof bindingOrOperationId === "object" || bindingOrOperationId === undefined
+      ? cultMeshOperationBindingRecord(bindingOrOperationId)
+      : cultMeshOperationBindingRecord(
+          bindingOrOperationId,
+          label,
+          schemaId,
+          routeKind,
+          routeDescription,
+        );
+  }
+
+  public static operationBindingFromRecord(
+    record: Partial<CultMeshOperationBindingRecord>,
+    options: {
+      fallbackRouteHint?: CultMeshRouteHint;
+      fallbackOperationId?: string;
+    } = {},
+  ): CultMeshOperationBindingDescriptor {
+    return cultMeshOperationBindingFromRecord(record, options);
+  }
+
+  public static operationInvocation(
+    operation:
+      | {
+          readonly operationId: string;
+          readonly schemaId?: string;
+          readonly routeHint?: CultMeshRouteHint;
+        }
+      | string,
+    options: {
+      schemaId?: string;
+      routeHint?: CultMeshRouteHint;
+      idempotencyKey?: string;
+    } = {},
+  ): CultMeshOperationInvocationDescriptor {
+    return cultMeshOperationInvocation(operation, options);
+  }
+
+  public static operationInvocationRecord(
+    invocation?: CultMeshOperationInvocationDescriptor,
+    options: {
+      fallbackOperationId?: string;
+      fallbackSchemaId?: string;
+      fallbackRouteHint?: CultMeshRouteHint;
+      fallbackIdempotencyKey?: string;
+    } = {},
+  ): CultMeshOperationInvocationRecord {
+    return cultMeshOperationInvocationRecord(invocation, options);
+  }
+
+  public static operationInvocationFromRecord(
+    record: Partial<CultMeshOperationInvocationRecord>,
+    options: {
+      fallbackOperationId?: string;
+      fallbackSchemaId?: string;
+      fallbackRouteHint?: CultMeshRouteHint;
+      fallbackIdempotencyKey?: string;
+    } = {},
+  ): CultMeshOperationInvocationDescriptor {
+    return cultMeshOperationInvocationFromRecord(record, options);
+  }
+
+  public static operationPayload(
+    fields: Readonly<Record<string, string | number | boolean | undefined>> = {},
+  ): CultMeshOperationPayload {
+    return cultMeshOperationPayload(fields);
+  }
+
+  public static projectionRecipe<TParameters, TResult>(
+    projectionId: string,
+    sources: readonly CultMeshProjectionSource[],
+    projectProjection: (
+      parameters: TParameters,
+      context: CultMeshQueryContext,
+    ) => Promise<TResult>,
+    options: {
+      routeHint?: CultMeshRouteHint;
+      watchProjection?: (
+        parameters: TParameters,
+        context: CultMeshQueryContext,
+        callback: (value: TResult) => void,
+      ) => CultMeshUnsubscribe;
+    } = {},
+  ): CultMeshProjectionRecipe<TParameters, TResult> {
+    return cultMeshProjectionRecipe(
+      projectionId,
+      sources,
+      projectProjection,
+      options,
+    );
+  }
+
+  public static describeProjectionRecipe(
+    recipe: {
+      readonly projectionId: string;
+      readonly routeHint: CultMeshRouteHint;
+      readonly sources: readonly CultMeshProjectionSource[];
+    },
+  ): CultMeshProjectionRecipeDiagnostic {
+    return cultMeshDescribeProjectionRecipe(recipe);
+  }
+
+  public static describeSurface(
+    surface:
+      | {
+          readonly queryId: string;
+          readonly routeHint: CultMeshRouteHint;
+          readonly sources: readonly CultMeshProjectionSource[];
+        }
+      | {
+          readonly operationId: string;
+        }
+      | {
+          readonly projectionId: string;
+          readonly routeHint: CultMeshRouteHint;
+          readonly sources: readonly CultMeshProjectionSource[];
+        }
+    | {
+        readonly feedId: string;
+        readonly routeHint: CultMeshRouteHint;
+        readonly sources: readonly CultMeshProjectionSource[];
+      }
+    | {
+        readonly pointerId: string;
+      }
+    | {
+        readonly documentId: string;
+        readonly routeHint: CultMeshRouteHint;
+        readonly sources: readonly CultMeshProjectionSource[];
+      }
+    | {
+        readonly collectionId: string;
+        readonly routeHint: CultMeshRouteHint;
+        readonly sources: readonly CultMeshProjectionSource[];
+      }
+    | CultMeshNativeSliceViewDescriptor,
+  ): CultMeshSurfaceDiagnostic {
+    return cultMeshDescribeSurface(surface);
+  }
+
+  public static surfaceDiagnostic(
+    kind: CultMeshSurfaceKind,
+    surfaceId: string,
+    options: {
+      routeHint?: CultMeshRouteHint;
+      sources?: readonly CultMeshProjectionSource[];
+    } = {},
+  ): CultMeshSurfaceDiagnostic {
+    return cultMeshSurfaceDiagnostic(kind, surfaceId, options);
+  }
+
+  public static describeSurfaceCatalog(
+    catalogId: string,
+    surfaces: readonly CultMeshSurfaceDiagnostic[],
+  ): CultMeshSurfaceCatalogDiagnostic {
+    return cultMeshDescribeSurfaceCatalog(catalogId, surfaces);
+  }
+
+  public static findSurface(
+    catalog: CultMeshSurfaceCatalogDiagnostic,
+    surfaceId: string,
+  ): CultMeshSurfaceDiagnostic | undefined {
+    return cultMeshFindSurface(catalog, surfaceId);
+  }
+
+  public static surfacesByKind(
+    catalog: CultMeshSurfaceCatalogDiagnostic,
+    kind: CultMeshSurfaceKind,
+  ): CultMeshSurfaceDiagnostic[] {
+    return cultMeshSurfacesByKind(catalog, kind);
+  }
+
+  public static surfaceCatalogIndex(
+    catalog: CultMeshSurfaceCatalogDiagnostic,
+  ): CultMeshSurfaceCatalogIndexDiagnostic {
+    return cultMeshSurfaceCatalogIndex(catalog);
+  }
+
+  public static nativeSliceColumn(
+    name: string,
+    valueType: string,
+    elementSizeBytes: number,
+  ): CultMeshNativeSliceColumn {
+    return cultMeshNativeSliceColumn(name, valueType, elementSizeBytes);
+  }
+
+  public static nativeSliceView(
+    viewId: string,
+    schemaId: string,
+    rowCount: number,
+    columns: readonly CultMeshNativeSliceColumn[],
+    options: { route?: CultMeshRouteHint; nativeHandle?: string } = {},
+  ): CultMeshNativeSliceViewDescriptor {
+    return cultMeshNativeSliceView(viewId, schemaId, rowCount, columns, options);
+  }
+
+  public static denseRowStrideBytes(view: CultMeshNativeSliceViewDescriptor): number {
+    return cultMeshDenseRowStrideBytes(view);
+  }
+
+  public static findNativeSliceColumn(
+    view: CultMeshNativeSliceViewDescriptor,
+    name: string,
+  ): CultMeshNativeSliceColumn | undefined {
+    return cultMeshFindNativeSliceColumn(view, name);
+  }
+
+  public static describeNativeSliceView(
+    view: CultMeshNativeSliceViewDescriptor,
+  ): CultMeshNativeSliceViewDiagnostic {
+    return cultMeshDescribeNativeSliceView(view);
+  }
+
   public static async createNode(
     cachePath: string,
     options: CultMeshNodeOptions = {},
@@ -555,7 +5677,7 @@ export class CultMesh {
     const documents = new CultNetDocumentRegistry(options.bindings);
 
     for (const definition of options.documents ?? []) {
-      cache.registerDocumentType(definition);
+      await cache.registerDocumentType(definition);
       if (!documents.get(definition.type)) {
         documents.register(defineCultNetDocumentBinding({ definition }));
       }
@@ -628,9 +5750,14 @@ export class CultMesh {
     const bind = { host, port };
     const socket = options.socket ?? createSocket(host.includes(":") ? "udp6" : "udp4");
     const sessions = new Map<string, {
+      sessionId: string;
       remote: { address: string; family: string; port: number };
       session: CultNetRudpSession;
+      connectPayload: Uint8Array;
+      closed: boolean;
+      work: Promise<void>;
     }>();
+    let sessionSequence = 0;
     const resendPollMs = Math.max(10, options.resendPollMs ?? 25);
     const sessionTimeoutMs = Math.max(1_000, options.sessionTimeoutMs ?? 30_000);
     const wireContract = options.wireContract ?? "cultnet.schema.v0";
@@ -653,14 +5780,28 @@ export class CultMesh {
         let record = sessions.get(key);
 
         if (packet.packetType === "connect") {
+          const connectPayload = Uint8Array.from(packet.payload ?? []);
+          if (record && byteArraysEqual(record.connectPayload, connectPayload)) {
+            socket.send(
+              encodeRudpPacket(record.session.acceptConnect(packet, nowMs)),
+              remote.port,
+              remote.address,
+            );
+            return;
+          }
+          if (record) closeSession(record);
           record = {
+            sessionId: `${runtimeId}:${++sessionSequence}`,
             remote: { address: remote.address, family: remote.family, port: remote.port },
+            connectPayload,
+            closed: false,
             session: new CultNetRudpSession({
               connectionId,
               initialSequence: options.initialSequence,
               resendDelayMs: options.resendDelayMs,
               maxPendingReliablePackets: options.maxPendingReliablePackets,
             }),
+            work: Promise.resolve(),
           };
           sessions.set(key, record);
           socket.send(encodeRudpPacket(record.session.acceptConnect(packet, nowMs)), remote.port, remote.address);
@@ -675,20 +5816,28 @@ export class CultMesh {
         if (result.reply) {
           socket.send(encodeRudpPacket(result.reply), record.remote.port, record.remote.address);
         }
+        for (const ready of result.readyToSend ?? []) {
+          socket.send(encodeRudpPacket(ready), record.remote.port, record.remote.address);
+        }
         for (const frame of result.delivered) {
           if (frame.channelId !== "schema") {
             continue;
           }
-          handleDocumentServerFrame(record, frame.payload).catch((error) => {
-            reportError(error);
-          });
+          record.work = record.work
+            .then(() => handleDocumentServerFrame(record, frame.payload))
+            .catch(reportError);
         }
         if (result.disconnected) {
           sessions.delete(key);
+          closeSession(record);
           return;
         }
-        if (packet.packetType === "accept" || result.delivered.length > 0) {
-          socket.send(encodeRudpPacket(record.session.createAck()), record.remote.port, record.remote.address);
+        if (packet.reliable) {
+          socket.send(
+            encodeRudpPacket(record.session.createAckFor(packet.sequence)),
+            record.remote.port,
+            record.remote.address,
+          );
         }
       } catch (error) {
         reportError(error);
@@ -697,9 +5846,10 @@ export class CultMesh {
     socket.on("error", reportError);
 
     async function handleDocumentServerFrame(
-      record: { remote: { address: string; family: string; port: number }; session: CultNetRudpSession },
+      record: { sessionId: string; remote: { address: string; family: string; port: number }; session: CultNetRudpSession; connectPayload: Uint8Array; closed: boolean },
       payload: Uint8Array,
     ): Promise<void> {
+      if (record.closed) return;
       const message = parseCultNetMessage(decode(payload), wireContract);
       switch (message.schemaVersion) {
         case "cultnet.snapshot_request.v0": {
@@ -726,9 +5876,30 @@ export class CultMesh {
           return;
         case "cultnet.document_put_raw.v0":
           if (options.onDocumentPutRaw) {
-            await options.onDocumentPutRaw(normalizeRudpDocumentPut(message, record.remote));
+            const receipt = await options.onDocumentPutRaw(normalizeRudpDocumentPut(message, record.remote));
+            if (receipt) {
+              sendSchemaMessage(record, options.documents.createRawDocumentPutMessage(
+                receipt.binding, receipt.messageId ?? message.messageId, receipt.recordKey, receipt.value,
+                {
+                  sourceRuntimeId: receipt.sourceRuntimeId ?? runtimeId,
+                  sourceAgentId: receipt.sourceAgentId,
+                  sourceRole: receipt.sourceRole ?? "provider",
+                  tags: receipt.tags ?? ["receipt"],
+                },
+              ));
+            }
           }
           return;
+        case "cultnet.operation_request.v0":
+          if (!options.onOperationRequest) {
+            sendSchemaMessage(record, {
+              schemaVersion: "cultnet.error.v0",
+              error: "CultMesh RUDP document server has no operation handler.",
+            });
+            return;
+          }
+          sendSchemaMessage(record, await options.onOperationRequest(message, publicSession(record)));
+          return;
         default:
           sendSchemaMessage(record, {
             schemaVersion: "cultnet.error.v0",
@@ -737,10 +5908,52 @@ export class CultMesh {
       }
     }
 
+    function publicSession(record: {
+      sessionId: string;
+      remote: { address: string; family: string; port: number };
+      session: CultNetRudpSession;
+      connectPayload: Uint8Array;
+      closed: boolean;
+    }): CultMeshRudpServerSession {
+      return {
+        sessionId: record.sessionId,
+        remote: { ...record.remote },
+        connectPayload: Uint8Array.from(record.connectPayload),
+        send: message => {
+          if (record.closed) throw new Error(`CultMesh RUDP session ${record.sessionId} is closed.`);
+          sendSchemaMessage(record, message);
+        },
+      };
+    }
+
+    function notifySessionClosed(record: {
+      sessionId: string;
+      remote: { address: string; family: string; port: number };
+      session: CultNetRudpSession;
+      connectPayload: Uint8Array;
+      closed: boolean;
+    }): void {
+      if (!options.onSessionClosed) return;
+      void Promise.resolve(options.onSessionClosed(publicSession(record))).catch(reportError);
+    }
+
+    function closeSession(record: {
+      sessionId: string;
+      remote: { address: string; family: string; port: number };
+      session: CultNetRudpSession;
+      connectPayload: Uint8Array;
+      closed: boolean;
+    }): void {
+      if (record.closed) return;
+      record.closed = true;
+      notifySessionClosed(record);
+    }
+
     function sendSchemaMessage(
-      record: { remote: { address: string; port: number }; session: CultNetRudpSession },
+      record: { sessionId: string; remote: { address: string; port: number }; session: CultNetRudpSession; closed: boolean },
       message: CultNetMessage,
     ): void {
+      if (record.closed) throw new Error(`CultMesh RUDP session ${record.sessionId} is closed.`);
       const payload = encode(encodeCultNetMessageForWire(message, wireContract));
       for (const packet of record.session.sendMany("schema", payload, {
         reliable: true,
@@ -770,6 +5983,7 @@ export class CultMesh {
           for (const [key, record] of sessions) {
             if (record.session.checkTimeout(nowMs, sessionTimeoutMs)) {
               sessions.delete(key);
+              closeSession(record);
               continue;
             }
             for (const packet of record.session.dueResends(nowMs)) {
@@ -784,12 +5998,44 @@ export class CultMesh {
           clearInterval(resendTimer);
           resendTimer = undefined;
         }
+        for (const record of sessions.values()) closeSession(record);
         sessions.clear();
         socket.close();
       },
     };
   }
 
+  public static resolveRudpEndpoint(
+    endpoint: string,
+    environment: Record<string, string | undefined> = process.env,
+  ): CultMeshRudpEndpoint {
+    requireNonEmpty(endpoint, "endpoint");
+    const text = endpoint.trim();
+    if (text.toLowerCase().startsWith("rudp://")) {
+      return CultMesh.parseRudpEndpoint(text);
+    }
+    if (!text.toLowerCase().startsWith("cultmesh://")) {
+      return CultMesh.parseRudpEndpoint(`rudp://${text}`);
+    }
+
+    const uri = new URL(text);
+    const authority = uri.hostname.trim();
+    if (!authority) throw new Error("CultMesh URI must include an authority.");
+    const slug = authority
+      .replace(/[^a-z0-9]+/gi, "_")
+      .replace(/^_+|_+$/g, "")
+      .toUpperCase();
+    for (const key of [`CULTMESH_URI_${slug}_RUDP`, `${slug}_CULTMESH_RUDP_ENDPOINT`]) {
+      const resolved = environment[key]?.trim();
+      if (resolved) {
+        return CultMesh.parseRudpEndpoint(
+          resolved.toLowerCase().startsWith("rudp://") ? resolved : `rudp://${resolved}`,
+        );
+      }
+    }
+    throw new Error(`CultMesh URI ${text} did not resolve to a RUDP endpoint.`);
+  }
+
   public static parseRudpEndpoint(endpoint: string): CultMeshRudpEndpoint {
     requireNonEmpty(endpoint, "endpoint");
     const parsed = new URL(endpoint);
@@ -835,12 +6081,42 @@ export class CultMesh {
           tags: options.tags,
         },
       ));
-      await new Promise((resolve) => setTimeout(resolve, Math.max(0, options.flushTimeoutMs ?? 150)));
+      await peer.flush(options.flushTimeoutMs ?? 30_000);
     } finally {
       peer.close();
     }
   }
 
+  public static async publishRudpDocumentAndWaitForReceipt<TDefinition extends AnyCultCacheDocumentDefinition, TReceiptDefinition extends AnyCultCacheDocumentDefinition>(
+    runtimeId: string, connectionId: number, endpoint: string | CultMeshRudpEndpoint,
+    binding: CultNetDocumentBinding<TDefinition>, recordKey: string, value: CultCacheDocumentValue<TDefinition>,
+    receiptBinding: CultNetDocumentBinding<TReceiptDefinition>, options: CultMeshRudpDocumentReceiptOptions = {},
+  ): Promise<CultCacheDocumentValue<TReceiptDefinition>> {
+    requireNonEmpty(runtimeId, "runtimeId");
+    requireNonEmpty(recordKey, "recordKey");
+    const messageId = options.messageId ?? `${runtimeId}:${binding.definition.type}:${recordKey}`;
+    const peer = await CultMesh.createRudpPeer(runtimeId, connectionId, endpoint, options);
+    try {
+      const receipt = new Promise<CultCacheDocumentValue<TReceiptDefinition>>((resolve, reject) => {
+        const timeout = setTimeout(() => { cleanup(); reject(new Error(`Timed out waiting for RUDP application receipt for ${recordKey}.`)); }, options.receiptTimeoutMs ?? 5_000);
+        const onMessage = (message: CultNetMessage): void => {
+          if (message.schemaVersion !== "cultnet.document_put_raw.v0" || message.messageId !== messageId || message.document.schemaId !== receiptBinding.definition.schemaId) return;
+          try {
+            const decoded = decode(new Uint8Array(message.document.payload));
+            cleanup();
+            resolve(receiptBinding.definition.schema.parse(decoded) as CultCacheDocumentValue<TReceiptDefinition>);
+          } catch (error) { cleanup(); reject(error); }
+        };
+        const cleanup = (): void => { clearTimeout(timeout); peer.off("message", onMessage); };
+        peer.on("message", onMessage);
+      });
+      peer.send(new CultNetDocumentRegistry([binding]).createRawDocumentPutMessage(binding, messageId, recordKey, value, {
+        sourceRuntimeId: options.sourceRuntimeId ?? runtimeId, sourceAgentId: options.sourceAgentId, sourceRole: options.sourceRole, tags: options.tags,
+      }));
+      return await receipt;
+    } finally { peer.close(); }
+  }
+
   public static async createRudpServer(
     runtimeId: string,
     connectionId: number,
@@ -994,6 +6270,136 @@ export class CultMesh {
   }
 }
 
+function cultMeshSchemaFromDefinition(
+  definition: AnyCultCacheDocumentDefinition,
+): CultMeshDocumentSchemaDescriptor {
+  return {
+    type: definition.type,
+    schemaId: definition.schemaId ?? definition.type,
+    schemaName: definition.schemaName,
+    schemaVersion: definition.schemaVersion,
+  };
+}
+
+function normalizeCultMeshDocumentSchema(
+  schema: CultMeshDocumentSchemaDescriptor,
+): CultMeshDocumentSchemaDescriptor {
+  const schemaId = schema.schemaId?.trim() || undefined;
+  const inferredSchemaName = schema.schemaName?.trim() || inferCultMeshSchemaName(schemaId);
+  const normalized = {
+    type: schema.type?.trim() || undefined,
+    schemaId,
+    schemaName: inferredSchemaName,
+    schemaVersion: schema.schemaVersion?.trim() || (inferredSchemaName ? schemaId : undefined),
+  };
+
+  if (!normalized.type && !normalized.schemaId && !normalized.schemaName) {
+    throw new Error("Document schema must include type, schemaId, or schemaName.");
+  }
+
+  return normalized;
+}
+
+function cultMeshSchemaNameVersionKey(
+  schema: CultMeshDocumentSchemaDescriptor,
+): string | undefined {
+  return schema.schemaName
+    ? `${schema.schemaName}@${schema.schemaVersion ?? ""}`
+    : undefined;
+}
+
+function cultMeshSchemasAreCompatible(
+  left: CultMeshDocumentSchemaDescriptor,
+  right: CultMeshDocumentSchemaDescriptor,
+): boolean {
+  if (left.schemaId && right.schemaId && left.schemaId === right.schemaId) {
+    return true;
+  }
+
+  if (
+    left.schemaName &&
+    right.schemaName &&
+    left.schemaName === right.schemaName &&
+    (left.schemaVersion ?? "") === (right.schemaVersion ?? "")
+  ) {
+    return true;
+  }
+
+  return Boolean(left.type && right.type && left.type === right.type);
+}
+
+function inferCultMeshSchemaName(schemaId: string | undefined): string | undefined {
+  if (!schemaId) {
+    return undefined;
+  }
+  const marker = schemaId.lastIndexOf(".v");
+  if (marker <= 0 || marker + 2 >= schemaId.length) {
+    return undefined;
+  }
+  const version = schemaId.slice(marker + 2);
+  return /^\d+$/.test(version) ? schemaId.slice(0, marker) : undefined;
+}
+
+function resolveCultMeshStoreDocumentRecord(
+  records: readonly CultCacheEnvelope[],
+  schema: CultMeshDocumentSchemaDescriptor,
+  schemaOrDefinition: string | AnyCultCacheDocumentDefinition,
+): CultCacheEnvelope | undefined {
+  const schemaId = schema.schemaId ?? schema.type;
+  return (
+    records.find(candidate => schemaId !== undefined && candidate.schemaId === schemaId) ??
+    records.find(candidate =>
+      cultMeshEnvelopeMatchesSchema(candidate, schema) &&
+      (typeof schemaOrDefinition === "string" ||
+        cultMeshEnvelopeParsesAsDefinition(candidate, schemaOrDefinition))) ??
+    (typeof schemaOrDefinition === "string"
+      ? undefined
+      : records.find(candidate => cultMeshEnvelopeParsesAsDefinition(candidate, schemaOrDefinition)))
+  );
+}
+
+function cultMeshEnvelopeMatchesSchema(
+  envelope: CultCacheEnvelope,
+  schema: CultMeshDocumentSchemaDescriptor,
+): boolean {
+  const entry = envelope.catalogEntry;
+  if (!entry) {
+    return false;
+  }
+  if (
+    schema.schemaId &&
+    (entry.schemaId === schema.schemaId ||
+      envelope.schemaId === schema.schemaId ||
+      entry.compatibleSchemaIds?.includes(schema.schemaId))
+  ) {
+    return true;
+  }
+  return Boolean(
+    schema.schemaName &&
+    entry.schemaName === schema.schemaName &&
+    (schema.schemaVersion ?? "") === (entry.schemaVersion ?? ""),
+  );
+}
+
+function cultMeshEnvelopeParsesAsDefinition(
+  envelope: CultCacheEnvelope,
+  definition: AnyCultCacheDocumentDefinition,
+): boolean {
+  try {
+    definition.schema.parse(decode(envelope.payload));
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+function cultMeshSchemaLabel(schema: CultMeshDocumentSchemaDescriptor): string {
+  return schema.schemaId ??
+    cultMeshSchemaNameVersionKey(schema) ??
+    schema.type ??
+    "<anonymous-schema>";
+}
+
 function requireNonEmpty(value: string, name: string): void {
   if (!value || value.trim().length === 0) {
     throw new Error(`${name} must be non-empty.`);
@@ -1027,6 +6433,125 @@ function normalizeRudpDocumentPut(
   };
 }
 
+async function requestCultNetRawSnapshotDocument(
+  peerOrProvider: CultNetPeer | (() => CultNetPeer | Promise<CultNetPeer>),
+  schemaId: string,
+  recordKey: string,
+  options: {
+    timeoutMs?: number;
+    messageIdPrefix?: string;
+    accepts?: (document: CultNetRawDocumentRecord) => boolean;
+  } = {},
+): Promise<CultNetRawDocumentRecord> {
+  const peer = await resolveCultNetPeer(peerOrProvider);
+  const messageId = `${options.messageIdPrefix ?? "cultmesh-snapshot"}:${Date.now()}:${Math.random().toString(16).slice(2)}`;
+  const response = await requestCultNetRawSnapshot(peer, [recordKey], {
+    messageId,
+    timeoutMs: options.timeoutMs,
+  });
+  const candidates = response.documents.filter(candidate => candidate.recordKey === recordKey);
+  const document =
+    candidates.find(candidate => candidate.schemaId === schemaId) ??
+    (options.accepts ? candidates.find(options.accepts) : undefined) ??
+    candidates[0];
+  if (!document) {
+    throw new Error(`CultMesh peer snapshot did not return ${schemaId} at ${recordKey}.`);
+  }
+  return document;
+}
+
+async function requestCultNetRawSnapshot(
+  peer: CultNetPeer,
+  recordKeys: readonly string[],
+  options: {
+    messageId: string;
+    timeoutMs?: number;
+  },
+): Promise<CultNetSnapshotResponseRawMessage> {
+  return new Promise<CultNetSnapshotResponseRawMessage>((resolve, reject) => {
+    const cleanup = (): void => {
+      clearTimeout(timer);
+      peer.off("message", onMessage);
+      peer.off("invalidMessage", onInvalidMessage);
+      peer.off("error", onError);
+      peer.off("close", onClose);
+    };
+    const rejectWith = (error: Error): void => {
+      cleanup();
+      reject(error);
+    };
+    const onMessage = (message: CultNetMessage): void => {
+      if (isCultNetErrorMessage(message)) {
+        cleanup();
+        reject(new Error(message.error));
+        return;
+      }
+      if (message.schemaVersion !== "cultnet.snapshot_response_raw.v0" ||
+          message.messageId !== options.messageId) {
+        return;
+      }
+
+      cleanup();
+      resolve(message);
+    };
+    const onInvalidMessage = (error: Error): void => rejectWith(error);
+    const onError = (error: Error): void => rejectWith(error);
+    const onClose = (): void => rejectWith(new Error("CultNet peer closed before snapshot response."));
+    const timer = setTimeout(
+      () => rejectWith(new Error(`Timed out waiting for CultNet snapshot ${options.messageId}.`)),
+      options.timeoutMs ?? 4_000,
+    );
+
+    peer.on("message", onMessage);
+    peer.on("invalidMessage", onInvalidMessage);
+    peer.on("error", onError);
+    peer.on("close", onClose);
+    peer.sendSnapshotRequest({
+      schemaVersion: "cultnet.snapshot_request.v0",
+      messageId: options.messageId,
+      recordKeys: [...recordKeys],
+    });
+  });
+}
+
+async function resolveCultNetPeer(
+  peerOrProvider: CultNetPeer | (() => CultNetPeer | Promise<CultNetPeer>),
+): Promise<CultNetPeer> {
+  return typeof peerOrProvider === "function"
+    ? await peerOrProvider()
+    : peerOrProvider;
+}
+
+function decodeCultNetRawDocumentPayload(document: CultNetRawDocumentRecord): unknown {
+  if (document.payloadEncoding !== "messagepack") {
+    throw new Error(`Unsupported CultNet raw document payload encoding ${document.payloadEncoding}.`);
+  }
+  return decode(toUint8Array(document.payload));
+}
+
+function parseCultMeshDocumentValue<TDefinition extends AnyCultCacheDocumentDefinition>(
+  schemaOrDefinition: string | TDefinition,
+  value: unknown,
+): unknown | CultCacheDocumentValue<TDefinition> {
+  return typeof schemaOrDefinition === "string"
+    ? value
+    : schemaOrDefinition.schema.parse(value);
+}
+
+function isCultNetErrorMessage(message: CultNetMessage): message is CultNetErrorMessage {
+  return message.schemaVersion === "cultnet.error.v0";
+}
+
+function toUint8Array(value: unknown): Uint8Array {
+  if (value instanceof Uint8Array) {
+    return value;
+  }
+  if (Array.isArray(value)) {
+    return Uint8Array.from(value);
+  }
+  throw new Error("CultNet raw document payload was not binary.");
+}
+
 async function bindRudpSocket(options: CultMeshRudpSocketOptions): Promise<Socket> {
   const socket = createSocket("udp4");
   const host = options.bindHost ?? "127.0.0.1";
@@ -1107,3 +6632,39 @@ function copyBudgetFor(
       return "opaque-runtime";
   }
 }
+
+function nonBlankOr(value?: string, fallback = ""): string {
+  return value && value.trim() ? value : fallback;
+}
+
+function byteArraysEqual(left: Uint8Array, right: Uint8Array): boolean {
+  if (left.byteLength !== right.byteLength) return false;
+  for (let index = 0; index < left.byteLength; index += 1) {
+    if (left[index] !== right[index]) return false;
+  }
+  return true;
+}
+
+function parseCultMeshLocalityKind(
+  value: string | undefined,
+  fallback: CultMeshLocalityKind,
+): CultMeshLocalityKind {
+  switch ((value ?? "").trim().toLowerCase()) {
+    case "automatic":
+      return "automatic";
+    case "inprocess":
+    case "in-process":
+      return "in-process";
+    case "sharedmemory":
+    case "shared-memory":
+      return "shared-memory";
+    case "ipc":
+      return "ipc";
+    case "network":
+      return "network";
+    case "wasm":
+      return "wasm";
+    default:
+      return fallback;
+  }
+}
diff --git a/packages/cultmesh-ts/src/provider-rudp-transport.ts b/packages/cultmesh-ts/src/provider-rudp-transport.ts
new file mode 100644
index 00000000..0557bf48
--- /dev/null
+++ b/packages/cultmesh-ts/src/provider-rudp-transport.ts
@@ -0,0 +1,395 @@
+import { randomUUID } from "node:crypto";
+import { createSocket, type Socket } from "node:dgram";
+import { encode } from "@msgpack/msgpack";
+import {
+  CultNetPeer,
+  CultNetRudpSocketTransportConnection,
+  type CultNetMessage,
+  type CultNetOperationRequestMessage,
+  type CultNetOperationResponseMessage,
+  type CultNetRawDocumentRecord,
+} from "cultnet-ts";
+
+import type {
+  CultMeshProviderCommand,
+  CultMeshProviderCommandListener,
+  CultMeshProviderCommandReceipt,
+  CultMeshProviderConnection,
+  CultMeshProviderIdentity,
+  CultMeshProviderLease,
+  CultMeshProviderPublication,
+  CultMeshProviderRegistration,
+  CultMeshProviderTransport,
+  CultMeshProviderUnsubscribe,
+  CultMeshProviderWithdrawal,
+} from "./provider-session";
+import {
+  CULTMESH_PROVIDER_SESSION_SERVICE_ID,
+  assertMutationAcceptance,
+  assertProviderLease,
+  cultMeshProviderSessionOperations,
+  cultMeshProviderSessionSchemas,
+  decodeProviderCommandDocument,
+  encodeProviderConnectEvidence,
+  decodeProviderSessionPayload,
+  encodeProviderSessionPayload,
+  type CultMeshProviderCommandReceiptWire,
+  type CultMeshProviderLeaseWire,
+  type CultMeshProviderMutationAcceptanceWire,
+} from "./provider-session-wire";
+
+export interface CultMeshProviderRudpTransportOptions {
+  readonly endpoint: string;
+  readonly runtimeId: string;
+  readonly connectionId: number;
+  readonly bindHost?: string;
+  readonly connectTimeoutMs?: number;
+  readonly operationTimeoutMs?: number;
+  readonly maxFragmentBytes?: number;
+  readonly sessionToken?: string;
+  readonly socketFactory?: () => Socket;
+}
+
+/**
+ * Private-development provider transport. Public deployment additionally needs
+ * an authenticated CultNet session whose claims authorize the provider identity.
+ */
+export class CultMeshProviderRudpTransport implements CultMeshProviderTransport {
+  readonly #options: CultMeshProviderRudpTransportOptions;
+
+  public constructor(options: CultMeshProviderRudpTransportOptions) {
+    if (!options.endpoint) throw new Error("CultMesh provider RUDP transport requires endpoint.");
+    if (!options.runtimeId) throw new Error("CultMesh provider RUDP transport requires runtimeId.");
+    if (!Number.isInteger(options.connectionId)) throw new Error("CultMesh provider RUDP transport requires integer connectionId.");
+    this.#options = options;
+  }
+
+  public async connect(
+    identity: CultMeshProviderIdentity,
+    signal: AbortSignal,
+  ): Promise<CultMeshProviderConnection> {
+    if (signal.aborted) throw abortError();
+    const endpoint = parseEndpoint(this.#options.endpoint);
+    const socket = this.#options.socketFactory?.() ?? createSocket(endpoint.host.includes(":") ? "udp6" : "udp4");
+    await bindSocket(socket, this.#options.bindHost ?? (endpoint.host.includes(":") ? "::" : "0.0.0.0"), signal);
+    const transport = new CultNetRudpSocketTransportConnection({
+      mode: "client",
+      runtimeId: this.#options.runtimeId,
+      transportId: `${this.#options.runtimeId}.cultmesh-provider-session`,
+      socket,
+      remoteHost: endpoint.host,
+      remotePort: endpoint.port,
+      connectionId: this.#options.connectionId,
+      maxFragmentBytes: this.#options.maxFragmentBytes ?? 2_048,
+    });
+    const peer = new CultNetPeer(transport, { wireContract: "cultnet.schema.v0" });
+    transport.connect(Buffer.from(encodeProviderConnectEvidence({
+      clientSessionId: randomUUID(),
+      sessionToken: this.#options.sessionToken ?? null,
+    })));
+    try {
+      await waitUntilConnected(transport, signal, this.#options.connectTimeoutMs ?? 2_000);
+      return new RudpProviderConnection(identity, peer, transport, this.#options.operationTimeoutMs ?? 5_000);
+    } catch (error) {
+      transport.close();
+      throw error;
+    }
+  }
+}
+
+class RudpProviderConnection implements CultMeshProviderConnection {
+  readonly #identity: CultMeshProviderIdentity;
+  readonly #peer: CultNetPeer;
+  readonly #transport: CultNetRudpSocketTransportConnection;
+  readonly #timeoutMs: number;
+  readonly #listeners = new Set<CultMeshProviderCommandListener>();
+  readonly #pending = new Map<string, {
+    operation: string;
+    payloadSchema: string;
+    resolve: (response: CultNetOperationResponseMessage) => void;
+    reject: (error: Error) => void;
+    timer: NodeJS.Timeout;
+  }>();
+  readonly #publications = new Map<string, CultMeshProviderPublication>();
+  readonly #bufferedCommands = new Map<string, CultMeshProviderCommand>();
+  #closed = false;
+  #requestedLeaseDurationMs = 30_000;
+
+  public constructor(
+    identity: CultMeshProviderIdentity,
+    peer: CultNetPeer,
+    transport: CultNetRudpSocketTransportConnection,
+    timeoutMs: number,
+  ) {
+    this.#identity = identity;
+    this.#peer = peer;
+    this.#transport = transport;
+    this.#timeoutMs = timeoutMs;
+    peer.on("message", message => this.#onMessage(message));
+    peer.on("invalidMessage", error => this.#failPending(error));
+    peer.on("close", () => this.#failPending(new Error("CultMesh provider RUDP connection closed.")));
+    peer.on("error", error => this.#failPending(error));
+  }
+
+  public async register(
+    registration: CultMeshProviderRegistration,
+    signal: AbortSignal,
+  ): Promise<CultMeshProviderLease> {
+    this.#requestedLeaseDurationMs = registration.requestedLeaseDurationMs;
+    const response = await this.#operation(
+      cultMeshProviderSessionOperations.register,
+      cultMeshProviderSessionSchemas.registration,
+      cultMeshProviderSessionSchemas.lease,
+      { ...registration.identity, requestedLeaseDurationMs: registration.requestedLeaseDurationMs },
+      signal,
+    );
+    const wire = decodeProviderSessionPayload<CultMeshProviderLeaseWire>(response.payload);
+    assertProviderLease(wire);
+    assertIdentity(this.#identity, wire);
+    return { leaseId: wire.leaseId, expiresAt: new Date(wire.expiresAtUtc) };
+  }
+
+  public async renew(lease: CultMeshProviderLease): Promise<CultMeshProviderLease> {
+    const response = await this.#operation(
+      cultMeshProviderSessionOperations.renew,
+      cultMeshProviderSessionSchemas.leaseRenewal,
+      cultMeshProviderSessionSchemas.lease,
+      { leaseId: lease.leaseId, requestedLeaseDurationMs: this.#requestedLeaseDurationMs },
+    );
+    const wire = decodeProviderSessionPayload<CultMeshProviderLeaseWire>(response.payload);
+    assertProviderLease(wire);
+    assertIdentity(this.#identity, wire);
+    return { leaseId: wire.leaseId, expiresAt: new Date(wire.expiresAtUtc) };
+  }
+
+  public async publish(
+    publication: CultMeshProviderPublication,
+    lease: CultMeshProviderLease,
+  ): Promise<void> {
+    const document: CultNetRawDocumentRecord = {
+      schemaId: publication.schemaId,
+      recordKey: publication.recordKey,
+      storedAt: new Date().toISOString(),
+      payloadEncoding: "messagepack",
+      payload: encode(publication.value),
+      sourceRuntimeId: this.#identity.serviceInstanceId,
+      sourceAgentId: this.#identity.providerId,
+      sourceRole: "provider",
+    };
+    await this.#accepted(cultMeshProviderSessionOperations.publicationPut, cultMeshProviderSessionSchemas.publicationPut, {
+      leaseId: lease.leaseId,
+      publicationId: publication.publicationId,
+      document,
+    });
+    this.#publications.set(publication.publicationId, publication);
+  }
+
+  public async withdrawPublication(publicationId: string, lease: CultMeshProviderLease): Promise<void> {
+    const publication = this.#publications.get(publicationId);
+    if (!publication) throw new Error(`CultMesh provider publication ${publicationId} is not owned by this connection.`);
+    await this.#accepted(cultMeshProviderSessionOperations.publicationDelete, cultMeshProviderSessionSchemas.publicationDelete, {
+      leaseId: lease.leaseId,
+      publicationId,
+      schemaId: publication.schemaId,
+      recordKey: publication.recordKey,
+    });
+    this.#publications.delete(publicationId);
+  }
+
+  public watchCommands(listener: CultMeshProviderCommandListener): CultMeshProviderUnsubscribe {
+    this.#listeners.add(listener);
+    for (const [commandId, command] of this.#bufferedCommands) {
+      this.#bufferedCommands.delete(commandId);
+      void Promise.resolve(listener(command)).catch(() => undefined);
+    }
+    return () => {
+      this.#listeners.delete(listener);
+    };
+  }
+
+  public async publishReceipt(
+    receipt: CultMeshProviderCommandReceipt,
+    lease: CultMeshProviderLease,
+  ): Promise<void> {
+    const wire: CultMeshProviderCommandReceiptWire = {
+      receiptId: receipt.receiptId,
+      commandId: receipt.commandId,
+      commandKind: receipt.commandKind,
+      providerId: receipt.providerId,
+      serviceInstanceId: receipt.serviceInstanceId,
+      state: receipt.state,
+      completedAtUtc: receipt.completedAt.toISOString(),
+      result: receipt.result,
+      error: receipt.error,
+    };
+    await this.#accepted(cultMeshProviderSessionOperations.receiptPut, cultMeshProviderSessionSchemas.receiptPut, {
+      leaseId: lease.leaseId,
+      receipt: wire,
+    });
+  }
+
+  public async withdraw(withdrawal: CultMeshProviderWithdrawal): Promise<void> {
+    await this.#accepted(cultMeshProviderSessionOperations.withdraw, cultMeshProviderSessionSchemas.withdrawal, {
+      leaseId: withdrawal.leaseId,
+    });
+    this.#publications.clear();
+  }
+
+  public close(): void {
+    if (this.#closed) return;
+    this.#closed = true;
+    this.#failPending(new Error("CultMesh provider RUDP connection closed."));
+    this.#listeners.clear();
+    this.#transport.close();
+  }
+
+  async #accepted(operation: string, payloadSchema: string, payload: unknown): Promise<CultMeshProviderMutationAcceptanceWire> {
+    const response = await this.#operation(operation, payloadSchema, cultMeshProviderSessionSchemas.mutationAcceptance, payload);
+    const acceptance = decodeProviderSessionPayload<CultMeshProviderMutationAcceptanceWire>(response.payload);
+    assertMutationAcceptance(acceptance);
+    return acceptance;
+  }
+
+  async #operation(
+    operation: string,
+    payloadSchema: string,
+    responsePayloadSchema: string,
+    payload: unknown,
+    signal?: AbortSignal,
+  ): Promise<CultNetOperationResponseMessage> {
+    if (this.#closed) throw new Error("CultMesh provider RUDP connection is closed.");
+    if (signal?.aborted) throw abortError();
+    const messageId = randomUUID();
+    const request: CultNetOperationRequestMessage = {
+      schemaVersion: "cultnet.operation_request.v0",
+      messageId,
+      serviceId: CULTMESH_PROVIDER_SESSION_SERVICE_ID,
+      operation,
+      payloadSchema,
+      payloadEncoding: "messagepack-base64",
+      payload: encodeProviderSessionPayload(payload),
+      sourceRuntimeId: this.#identity.serviceInstanceId,
+    };
+    return await new Promise<CultNetOperationResponseMessage>((resolve, reject) => {
+      const timer = setTimeout(() => {
+        this.#pending.delete(messageId);
+        reject(new Error(`CultMesh provider operation ${operation} timed out.`));
+      }, this.#timeoutMs);
+      const abort = (): void => {
+        clearTimeout(timer);
+        this.#pending.delete(messageId);
+        reject(abortError());
+      };
+      signal?.addEventListener("abort", abort, { once: true });
+      this.#pending.set(messageId, {
+        operation,
+        payloadSchema: responsePayloadSchema,
+        timer,
+        resolve: response => {
+          signal?.removeEventListener("abort", abort);
+          if (response.serviceId !== CULTMESH_PROVIDER_SESSION_SERVICE_ID || response.operation !== operation) {
+            reject(new Error(`CultMesh provider response correlation does not match ${operation}.`));
+            return;
+          }
+          if (response.payloadEncoding !== "messagepack-base64") {
+            reject(new Error(`CultMesh provider response for ${operation} has incompatible payload encoding.`));
+            return;
+          }
+          if (response.status !== "ok") {
+            reject(new Error(`CultMesh provider operation ${operation} was ${response.status}: ${(response.diagnostics ?? []).join("; ")}`));
+            return;
+          }
+          if (response.payloadSchema !== responsePayloadSchema) {
+            reject(new Error(`CultMesh provider response for ${operation} has incompatible payload schema.`));
+            return;
+          }
+          resolve(response);
+        },
+        reject: error => {
+          signal?.removeEventListener("abort", abort);
+          reject(error);
+        },
+      });
+      this.#peer.send(request);
+    });
+  }
+
+  #onMessage(message: CultNetMessage): void {
+    if (message.schemaVersion === "cultnet.operation_response.v0") {
+      const pending = this.#pending.get(message.messageId);
+      if (!pending) return;
+      this.#pending.delete(message.messageId);
+      clearTimeout(pending.timer);
+      pending.resolve(message);
+      return;
+    }
+    if (message.schemaVersion !== "cultnet.document_put_raw.v0") return;
+    if (message.document.schemaId !== cultMeshProviderSessionSchemas.command) return;
+    const wire = decodeProviderCommandDocument(message.document);
+    if (wire.providerId !== this.#identity.providerId || wire.serviceInstanceId !== this.#identity.serviceInstanceId) return;
+    const command: CultMeshProviderCommand = { ...wire };
+    if (this.#listeners.size === 0) {
+      this.#bufferedCommands.set(command.commandId, command);
+      return;
+    }
+    for (const listener of [...this.#listeners]) void Promise.resolve(listener(command)).catch(() => undefined);
+  }
+
+  #failPending(error: Error): void {
+    for (const [messageId, pending] of this.#pending) {
+      this.#pending.delete(messageId);
+      clearTimeout(pending.timer);
+      pending.reject(error);
+    }
+  }
+}
+
+function assertIdentity(identity: CultMeshProviderIdentity, lease: CultMeshProviderLeaseWire): void {
+  for (const key of ["providerId", "serviceInstanceId", "endpointId", "verseId"] as const) {
+    if (identity[key] !== lease[key]) throw new Error(`CultMesh provider lease ${key} does not match the registered identity.`);
+  }
+}
+
+function parseEndpoint(endpoint: string): { host: string; port: number } {
+  const url = new URL(endpoint);
+  const port = Number(url.port);
+  if (url.protocol !== "rudp:" || !url.hostname || !Number.isInteger(port) || port <= 0 || port > 65_535) {
+    throw new Error(`Invalid CultMesh provider RUDP endpoint ${endpoint}.`);
+  }
+  return { host: url.hostname, port };
+}
+
+function bindSocket(socket: Socket, host: string, signal: AbortSignal): Promise<void> {
+  return new Promise((resolve, reject) => {
+    const abort = (): void => {
+      socket.close();
+      reject(abortError());
+    };
+    signal.addEventListener("abort", abort, { once: true });
+    socket.once("error", reject);
+    socket.bind(0, host, () => {
+      signal.removeEventListener("abort", abort);
+      socket.removeListener("error", reject);
+      resolve();
+    });
+  });
+}
+
+async function waitUntilConnected(
+  transport: CultNetRudpSocketTransportConnection,
+  signal: AbortSignal,
+  timeoutMs: number,
+): Promise<void> {
+  const deadline = Date.now() + timeoutMs;
+  while (!transport.connected) {
+    if (signal.aborted) throw abortError();
+    if (Date.now() >= deadline) throw new Error("CultMesh provider RUDP connection timed out.");
+    await new Promise(resolve => setTimeout(resolve, 5));
+  }
+}
+
+function abortError(): Error {
+  const error = new Error("CultMesh provider RUDP operation aborted.");
+  error.name = "AbortError";
+  return error;
+}
diff --git a/packages/cultmesh-ts/src/provider-session-broker.ts b/packages/cultmesh-ts/src/provider-session-broker.ts
new file mode 100644
index 00000000..eb9e18b5
--- /dev/null
+++ b/packages/cultmesh-ts/src/provider-session-broker.ts
@@ -0,0 +1,528 @@
+import { encode } from "@msgpack/msgpack";
+import type {
+  CultNetDocumentPutRawMessage,
+  CultNetOperationRequestMessage,
+  CultNetOperationResponseMessage,
+  CultNetRawDocumentRecord,
+} from "cultnet-ts";
+
+import type { CultMeshRudpServerSession } from "./index";
+import {
+  CULTMESH_PROVIDER_SESSION_SERVICE_ID,
+  cultMeshProviderSessionOperations,
+  cultMeshProviderSessionSchemas,
+  decodeProviderSessionPayload,
+  encodeProviderSessionPayload,
+  type CultMeshProviderCommandReceiptWire,
+  type CultMeshProviderCommandWire,
+  type CultMeshProviderLeaseRenewalWire,
+  type CultMeshProviderLeaseWire,
+  type CultMeshProviderOperationStatus,
+  type CultMeshProviderPublicationDeleteWire,
+  type CultMeshProviderPublicationPutWire,
+  type CultMeshProviderReceiptPutWire,
+  type CultMeshProviderRegistrationWire,
+  type CultMeshProviderWithdrawalWire,
+} from "./provider-session-wire";
+
+export interface CultMeshProviderBrokerClock {
+  now(): Date;
+}
+
+export interface CultMeshProviderSessionBrokerOptions {
+  readonly runtimeId: string;
+  readonly clock?: CultMeshProviderBrokerClock;
+  readonly createLeaseId?: () => string;
+  readonly maximumLeaseDurationMs?: number;
+  readonly expiryPollMs?: number;
+  readonly onError?: (error: Error) => void;
+  readonly authorizeRegistration: (
+    identity: CultMeshProviderRegistrationWire,
+    session: CultMeshRudpServerSession,
+  ) => boolean | Promise<boolean>;
+  readonly acceptPublication: (
+    identity: CultMeshProviderRegistrationWire,
+    publicationId: string,
+    document: CultNetRawDocumentRecord,
+  ) => void | Promise<void>;
+  readonly deletePublications: (
+    identity: CultMeshProviderRegistrationWire,
+    publications: readonly {
+      publicationId: string;
+      document: Pick<CultNetRawDocumentRecord, "schemaId" | "recordKey">;
+    }[],
+  ) => void | Promise<void>;
+  readonly acceptReceipt: (
+    identity: CultMeshProviderRegistrationWire,
+    receipt: CultMeshProviderCommandReceiptWire,
+  ) => void | Promise<void>;
+}
+
+interface LeaseRecord {
+  identity: CultMeshProviderRegistrationWire;
+  lease: CultMeshProviderLeaseWire;
+  session?: CultMeshRudpServerSession;
+  publications: Map<string, CultNetRawDocumentRecord>;
+}
+
+export class CultMeshProviderSessionBroker {
+  readonly #options: CultMeshProviderSessionBrokerOptions;
+  readonly #clock: CultMeshProviderBrokerClock;
+  readonly #leases = new Map<string, LeaseRecord>();
+  readonly #identityLeases = new Map<string, string>();
+  readonly #sessionLeases = new Map<string, Set<string>>();
+  readonly #commands = new Map<string, CultMeshProviderCommandWire>();
+  readonly #receipts = new Map<string, CultMeshProviderCommandReceiptWire>();
+  readonly #publicationOwners = new Map<string, { identityKey: string; publicationId: string }>();
+  readonly #closedSessions = new Set<string>();
+  readonly #inFlightBySession = new Map<string, number>();
+  readonly #expiryTimer: NodeJS.Timeout;
+  #work: Promise<void> = Promise.resolve();
+  #leaseSequence = 0;
+
+  public constructor(options: CultMeshProviderSessionBrokerOptions) {
+    if (!options.runtimeId) throw new Error("CultMesh provider-session broker requires runtimeId.");
+    if (!options.authorizeRegistration) throw new Error("CultMesh provider-session broker requires an explicit registration authority.");
+    this.#options = options;
+    this.#clock = options.clock ?? { now: () => new Date() };
+    this.#expiryTimer = setInterval(() => {
+      void this.expireLeases().catch(error => {
+        const normalized = error instanceof Error ? error : new Error(String(error));
+        if (this.#options.onError) this.#options.onError(normalized);
+        else console.error(`CultMesh provider-session expiry failed: ${normalized.message}`);
+      });
+    }, Math.max(10, options.expiryPollMs ?? 1_000));
+    this.#expiryTimer.unref?.();
+  }
+
+  public close(): void {
+    clearInterval(this.#expiryTimer);
+  }
+
+  public async handle(
+    request: CultNetOperationRequestMessage,
+    session: CultMeshRudpServerSession,
+  ): Promise<CultNetOperationResponseMessage> {
+    this.#inFlightBySession.set(
+      session.sessionId,
+      (this.#inFlightBySession.get(session.sessionId) ?? 0) + 1,
+    );
+    const work = this.#work.then(() => this.#handle(request, session));
+    this.#work = work.then(() => undefined, () => undefined);
+    try {
+      return await work;
+    } finally {
+      const remaining = (this.#inFlightBySession.get(session.sessionId) ?? 1) - 1;
+      if (remaining > 0) {
+        this.#inFlightBySession.set(session.sessionId, remaining);
+      } else {
+        this.#inFlightBySession.delete(session.sessionId);
+        this.#closedSessions.delete(session.sessionId);
+      }
+    }
+  }
+
+  async #handle(
+    request: CultNetOperationRequestMessage,
+    session: CultMeshRudpServerSession,
+  ): Promise<CultNetOperationResponseMessage> {
+    if (this.#closedSessions.has(session.sessionId)) {
+      return this.#response(request, "denied", cultMeshProviderSessionSchemas.mutationAcceptance, {}, [
+        "The physical provider session is closed or replaced.",
+      ]);
+    }
+    if (request.serviceId !== CULTMESH_PROVIDER_SESSION_SERVICE_ID) {
+      return this.#response(request, "denied", cultMeshProviderSessionSchemas.mutationAcceptance, {}, [
+        `Unsupported service ${request.serviceId}.`,
+      ]);
+    }
+    if (request.payloadEncoding !== "messagepack-base64") {
+      return this.#response(request, "invalid", cultMeshProviderSessionSchemas.mutationAcceptance, {}, [
+        "Provider-session operation payloads must use messagepack-base64.",
+      ]);
+    }
+    try {
+      switch (request.operation) {
+        case cultMeshProviderSessionOperations.register:
+          return await this.#register(request, session);
+        case cultMeshProviderSessionOperations.renew:
+          return await this.#renew(request, session);
+        case cultMeshProviderSessionOperations.publicationPut:
+          return await this.#publicationPut(request, session);
+        case cultMeshProviderSessionOperations.publicationDelete:
+          return await this.#publicationDelete(request, session);
+        case cultMeshProviderSessionOperations.receiptPut:
+          return await this.#receiptPut(request, session);
+        case cultMeshProviderSessionOperations.withdraw:
+          return await this.#withdraw(request, session);
+        default:
+          return this.#response(request, "invalid", cultMeshProviderSessionSchemas.mutationAcceptance, {}, [
+            `Unsupported provider-session operation ${request.operation}.`,
+          ]);
+      }
+    } catch (error) {
+      if (error instanceof BrokerInfrastructureError) throw error.cause;
+      return this.#response(request, error instanceof BrokerStatusError ? error.status : "invalid", cultMeshProviderSessionSchemas.mutationAcceptance, {}, [
+        error instanceof Error ? error.message : String(error),
+      ]);
+    }
+  }
+
+  public sessionClosed(session: CultMeshRudpServerSession): void {
+    if ((this.#inFlightBySession.get(session.sessionId) ?? 0) > 0) {
+      this.#closedSessions.add(session.sessionId);
+    }
+    for (const leaseId of this.#sessionLeases.get(session.sessionId) ?? []) {
+      const record = this.#leases.get(leaseId);
+      if (record?.session?.sessionId === session.sessionId) record.session = undefined;
+    }
+    this.#sessionLeases.delete(session.sessionId);
+  }
+
+  public enqueueCommand(command: CultMeshProviderCommandWire): void {
+    requireText(command.commandId, "commandId");
+    requireText(command.providerId, "providerId");
+    requireText(command.serviceInstanceId, "serviceInstanceId");
+    const completed = this.#receipts.get(command.commandId);
+    if (completed) {
+      if (completed.commandKind !== command.commandKind || completed.providerId !== command.providerId || completed.serviceInstanceId !== command.serviceInstanceId) {
+        throw new Error(`Command id ${command.commandId} is already completed for another command transaction.`);
+      }
+      return;
+    }
+    const existing = this.#commands.get(command.commandId);
+    if (existing && !wireEquivalent(existing, command)) {
+      throw new Error(`Command id ${command.commandId} is already retained for another command transaction.`);
+    }
+    this.#commands.set(command.commandId, existing ?? command);
+    for (const record of this.#leases.values()) {
+      if (!this.#isActive(record)) continue;
+      if (record.identity.providerId !== command.providerId || record.identity.serviceInstanceId !== command.serviceInstanceId) continue;
+      this.#sendCommand(record, command);
+    }
+  }
+
+  public get activeLeaseCount(): number {
+    return [...this.#leases.values()].filter(record => this.#isActive(record)).length;
+  }
+
+  public async expireLeases(): Promise<void> {
+    const work = this.#work.then(() => this.#expireLeases());
+    this.#work = work.then(() => undefined, () => undefined);
+    await work;
+  }
+
+  async #expireLeases(): Promise<void> {
+    const now = this.#clock.now().getTime();
+    for (const [leaseId, record] of [...this.#leases]) {
+      if (Date.parse(record.lease.expiresAtUtc) > now) continue;
+      await this.#options.deletePublications(record.identity, publicationEntries(record));
+      this.#releasePublicationOwners(record);
+      this.#removeLease(leaseId, record);
+    }
+  }
+
+  async #register(request: CultNetOperationRequestMessage, session: CultMeshRudpServerSession): Promise<CultNetOperationResponseMessage> {
+    expectSchema(request, cultMeshProviderSessionSchemas.registration);
+    const identity = decodeProviderSessionPayload<CultMeshProviderRegistrationWire>(request.payload);
+    validateRegistration(identity);
+    if (!await infrastructure(() => this.#options.authorizeRegistration(identity, session))) {
+      return this.#response(request, "denied", cultMeshProviderSessionSchemas.mutationAcceptance, {}, [
+        "The CultNet session does not authorize this provider identity.",
+      ]);
+    }
+    if (this.#closedSessions.has(session.sessionId)) {
+      return this.#response(request, "denied", cultMeshProviderSessionSchemas.mutationAcceptance, {}, [
+        "The physical provider session closed while registration authority was being checked.",
+      ]);
+    }
+    const identityKey = identityTuple(identity);
+    const previousLeaseId = this.#identityLeases.get(identityKey);
+    let publications = new Map<string, CultNetRawDocumentRecord>();
+    if (previousLeaseId) {
+      const previous = this.#leases.get(previousLeaseId);
+      if (previous) {
+        publications = previous.publications;
+        this.#removeLease(previousLeaseId, previous);
+      }
+    }
+    const lease = this.#createLease(identity, identity.requestedLeaseDurationMs);
+    const record: LeaseRecord = { identity, lease, session, publications };
+    this.#leases.set(lease.leaseId, record);
+    this.#identityLeases.set(identityKey, lease.leaseId);
+    this.#attachSession(session, lease.leaseId);
+    this.#replayCommands(record);
+    return this.#response(request, "ok", cultMeshProviderSessionSchemas.lease, lease);
+  }
+
+  async #renew(request: CultNetOperationRequestMessage, session: CultMeshRudpServerSession): Promise<CultNetOperationResponseMessage> {
+    expectSchema(request, cultMeshProviderSessionSchemas.leaseRenewal);
+    const renewal = decodeProviderSessionPayload<CultMeshProviderLeaseRenewalWire>(request.payload);
+    const current = this.#requireLease(renewal.leaseId, session);
+    const lease = this.#createLease(current.identity, renewal.requestedLeaseDurationMs);
+    const replacement: LeaseRecord = { ...current, lease, session };
+    this.#removeLease(renewal.leaseId, current);
+    this.#leases.set(lease.leaseId, replacement);
+    this.#identityLeases.set(identityTuple(current.identity), lease.leaseId);
+    this.#attachSession(session, lease.leaseId);
+    return this.#response(request, "ok", cultMeshProviderSessionSchemas.lease, lease);
+  }
+
+  async #publicationPut(request: CultNetOperationRequestMessage, session: CultMeshRudpServerSession): Promise<CultNetOperationResponseMessage> {
+    expectSchema(request, cultMeshProviderSessionSchemas.publicationPut);
+    const mutation = decodeProviderSessionPayload<CultMeshProviderPublicationPutWire>(request.payload);
+    const record = this.#requireLease(mutation.leaseId, session);
+    requireText(mutation.publicationId, "publicationId");
+    validateDocument(mutation.document);
+    const previous = record.publications.get(mutation.publicationId);
+    if (previous && (previous.schemaId !== mutation.document.schemaId || previous.recordKey !== mutation.document.recordKey)) {
+      return this.#response(request, "conflict", cultMeshProviderSessionSchemas.mutationAcceptance, {}, [
+        `Publication ${mutation.publicationId} already owns ${previous.schemaId}:${previous.recordKey}. Delete it before changing its tuple.`,
+      ]);
+    }
+    const tuple = documentTuple(mutation.document);
+    const owner = this.#publicationOwners.get(tuple);
+    const ownerIdentity = identityTuple(record.identity);
+    if (owner && (owner.identityKey !== ownerIdentity || owner.publicationId !== mutation.publicationId)) {
+      return this.#response(request, "conflict", cultMeshProviderSessionSchemas.mutationAcceptance, {}, [
+        `Publication tuple ${mutation.document.schemaId}:${mutation.document.recordKey} is already owned.`,
+      ]);
+    }
+    const normalizedDocument: CultNetRawDocumentRecord = {
+      ...mutation.document,
+      sourceRuntimeId: record.identity.serviceInstanceId,
+      sourceAgentId: record.identity.providerId,
+      sourceRole: "provider",
+    };
+    await infrastructure(() => this.#options.acceptPublication(record.identity, mutation.publicationId, normalizedDocument));
+    record.publications.set(mutation.publicationId, normalizedDocument);
+    this.#publicationOwners.set(tuple, { identityKey: ownerIdentity, publicationId: mutation.publicationId });
+    return this.#accepted(request, record.lease.leaseId, { publicationId: mutation.publicationId });
+  }
+
+  async #publicationDelete(request: CultNetOperationRequestMessage, session: CultMeshRudpServerSession): Promise<CultNetOperationResponseMessage> {
+    expectSchema(request, cultMeshProviderSessionSchemas.publicationDelete);
+    const mutation = decodeProviderSessionPayload<CultMeshProviderPublicationDeleteWire>(request.payload);
+    const record = this.#requireLease(mutation.leaseId, session);
+    const owned = record.publications.get(mutation.publicationId);
+    if (!owned || owned.schemaId !== mutation.schemaId || owned.recordKey !== mutation.recordKey) {
+      return this.#response(request, "denied", cultMeshProviderSessionSchemas.mutationAcceptance, {}, [
+        `Publication ${mutation.publicationId} is not owned by this lease with the supplied schema and key.`,
+      ]);
+    }
+    await infrastructure(() => this.#options.deletePublications(record.identity, [{ publicationId: mutation.publicationId, document: owned }]));
+    record.publications.delete(mutation.publicationId);
+    this.#publicationOwners.delete(documentTuple(owned));
+    return this.#accepted(request, record.lease.leaseId, { publicationId: mutation.publicationId });
+  }
+
+  async #receiptPut(request: CultNetOperationRequestMessage, session: CultMeshRudpServerSession): Promise<CultNetOperationResponseMessage> {
+    expectSchema(request, cultMeshProviderSessionSchemas.receiptPut);
+    const mutation = decodeProviderSessionPayload<CultMeshProviderReceiptPutWire>(request.payload);
+    const record = this.#requireLease(mutation.leaseId, session);
+    const receipt = mutation.receipt;
+    validateReceipt(receipt);
+    if (receipt.providerId !== record.identity.providerId || receipt.serviceInstanceId !== record.identity.serviceInstanceId) {
+      return this.#response(request, "denied", cultMeshProviderSessionSchemas.mutationAcceptance, {}, ["Receipt identity does not match its lease."]);
+    }
+    const previousReceipt = this.#receipts.get(receipt.commandId);
+    if (previousReceipt) {
+      if (!wireEquivalent(previousReceipt, receipt)) {
+        return this.#response(request, "conflict", cultMeshProviderSessionSchemas.mutationAcceptance, {}, [
+          `Command ${receipt.commandId} already has a different accepted receipt.`,
+        ]);
+      }
+      return this.#accepted(request, record.lease.leaseId, { commandId: receipt.commandId, receiptId: receipt.receiptId });
+    }
+    const command = this.#commands.get(receipt.commandId);
+    if (!command || command.commandKind !== receipt.commandKind || command.providerId !== receipt.providerId || command.serviceInstanceId !== receipt.serviceInstanceId) {
+      return this.#response(request, "denied", cultMeshProviderSessionSchemas.mutationAcceptance, {}, [
+        `Receipt ${receipt.receiptId} does not match a retained command for this provider generation.`,
+      ]);
+    }
+    await infrastructure(() => this.#options.acceptReceipt(record.identity, receipt));
+    this.#receipts.set(receipt.commandId, receipt);
+    this.#commands.delete(receipt.commandId);
+    return this.#accepted(request, record.lease.leaseId, { commandId: receipt.commandId, receiptId: receipt.receiptId });
+  }
+
+  async #withdraw(request: CultNetOperationRequestMessage, session: CultMeshRudpServerSession): Promise<CultNetOperationResponseMessage> {
+    expectSchema(request, cultMeshProviderSessionSchemas.withdrawal);
+    const mutation = decodeProviderSessionPayload<CultMeshProviderWithdrawalWire>(request.payload);
+    const record = this.#requireLease(mutation.leaseId, session);
+    await infrastructure(() => this.#options.deletePublications(record.identity, publicationEntries(record)));
+    this.#releasePublicationOwners(record);
+    this.#removeLease(mutation.leaseId, record);
+    return this.#accepted(request, mutation.leaseId);
+  }
+
+  #requireLease(leaseId: string, session: CultMeshRudpServerSession): LeaseRecord {
+    requireText(leaseId, "leaseId");
+    const record = this.#leases.get(leaseId);
+    if (!record || !this.#isActive(record)) throw new BrokerStatusError("expired", `Provider lease ${leaseId} is expired or fenced.`);
+    if (record.session?.sessionId !== session.sessionId) throw new BrokerStatusError("denied", `Provider lease ${leaseId} belongs to another physical session.`);
+    return record;
+  }
+
+  #isActive(record: LeaseRecord): boolean {
+    return Date.parse(record.lease.expiresAtUtc) > this.#clock.now().getTime();
+  }
+
+  #createLease(identity: CultMeshProviderRegistrationWire, requestedMs: number): CultMeshProviderLeaseWire {
+    if (!Number.isFinite(requestedMs) || requestedMs <= 0) throw new Error("requestedLeaseDurationMs must be positive.");
+    const durationMs = Math.min(requestedMs, this.#options.maximumLeaseDurationMs ?? 120_000);
+    const now = this.#clock.now();
+    return {
+      providerId: identity.providerId,
+      serviceInstanceId: identity.serviceInstanceId,
+      endpointId: identity.endpointId,
+      verseId: identity.verseId,
+      leaseId: this.#options.createLeaseId?.() ?? `${this.#options.runtimeId}:lease:${++this.#leaseSequence}`,
+      validFromUtc: now.toISOString(),
+      expiresAtUtc: new Date(now.getTime() + durationMs).toISOString(),
+    };
+  }
+
+  #attachSession(session: CultMeshRudpServerSession, leaseId: string): void {
+    let leases = this.#sessionLeases.get(session.sessionId);
+    if (!leases) this.#sessionLeases.set(session.sessionId, leases = new Set());
+    leases.add(leaseId);
+  }
+
+  #removeLease(leaseId: string, record: LeaseRecord): void {
+    this.#leases.delete(leaseId);
+    if (this.#identityLeases.get(identityTuple(record.identity)) === leaseId) this.#identityLeases.delete(identityTuple(record.identity));
+    this.#sessionLeases.get(record.session?.sessionId ?? "")?.delete(leaseId);
+  }
+
+  #releasePublicationOwners(record: LeaseRecord): void {
+    const ownerIdentity = identityTuple(record.identity);
+    for (const [publicationId, document] of record.publications) {
+      const tuple = documentTuple(document);
+      const owner = this.#publicationOwners.get(tuple);
+      if (owner?.identityKey === ownerIdentity && owner.publicationId === publicationId) this.#publicationOwners.delete(tuple);
+    }
+  }
+
+  #replayCommands(record: LeaseRecord): void {
+    for (const command of this.#commands.values()) {
+      if (command.providerId === record.identity.providerId && command.serviceInstanceId === record.identity.serviceInstanceId) this.#sendCommand(record, command);
+    }
+  }
+
+  #sendCommand(record: LeaseRecord, command: CultMeshProviderCommandWire): void {
+    if (!record.session) return;
+    const message: CultNetDocumentPutRawMessage = {
+      schemaVersion: "cultnet.document_put_raw.v0",
+      messageId: `${this.#options.runtimeId}:command:${command.commandId}`,
+      document: {
+        schemaId: cultMeshProviderSessionSchemas.command,
+        recordKey: `${command.providerId}/${command.serviceInstanceId}/${command.commandId}`,
+        storedAt: this.#clock.now().toISOString(),
+        payloadEncoding: "messagepack",
+        payload: encode(command),
+        sourceRuntimeId: this.#options.runtimeId,
+        sourceRole: "provider-session-broker",
+      },
+    };
+    record.session.send(message);
+  }
+
+  #accepted(request: CultNetOperationRequestMessage, leaseId: string, extra: Record<string, string> = {}): CultNetOperationResponseMessage {
+    return this.#response(request, "ok", cultMeshProviderSessionSchemas.mutationAcceptance, {
+      acceptedAtUtc: this.#clock.now().toISOString(),
+      leaseId,
+      ...extra,
+    });
+  }
+
+  #response(
+    request: CultNetOperationRequestMessage,
+    status: CultMeshProviderOperationStatus,
+    payloadSchema: string,
+    payload: unknown,
+    diagnostics?: string[],
+  ): CultNetOperationResponseMessage {
+    const response: CultNetOperationResponseMessage = {
+      schemaVersion: "cultnet.operation_response.v0",
+      messageId: request.messageId,
+      serviceId: request.serviceId,
+      operation: request.operation,
+      status,
+      payloadSchema,
+      payloadEncoding: "messagepack-base64",
+      payload: encodeProviderSessionPayload(payload),
+      sourceRuntimeId: this.#options.runtimeId,
+    };
+    if (diagnostics) response.diagnostics = diagnostics;
+    return response;
+  }
+}
+
+class BrokerStatusError extends Error {
+  public constructor(public readonly status: CultMeshProviderOperationStatus, message: string) {
+    super(message);
+  }
+}
+
+class BrokerInfrastructureError extends Error {
+  public constructor(public readonly cause: unknown) {
+    super(cause instanceof Error ? cause.message : String(cause));
+  }
+}
+
+async function infrastructure<T>(action: () => T | Promise<T>): Promise<T> {
+  try {
+    return await action();
+  } catch (error) {
+    throw new BrokerInfrastructureError(error);
+  }
+}
+
+function expectSchema(request: CultNetOperationRequestMessage, schema: string): void {
+  if (request.payloadSchema !== schema) throw new Error(`Operation ${request.operation} requires payload schema ${schema}.`);
+}
+
+function validateRegistration(value: CultMeshProviderRegistrationWire): void {
+  for (const field of ["providerId", "serviceInstanceId", "endpointId", "verseId"] as const) requireText(value[field], field);
+  if (!Number.isFinite(value.requestedLeaseDurationMs) || value.requestedLeaseDurationMs <= 0) throw new Error("requestedLeaseDurationMs must be positive.");
+}
+
+function validateDocument(document: CultNetRawDocumentRecord): void {
+  requireText(document?.schemaId, "document.schemaId");
+  requireText(document?.recordKey, "document.recordKey");
+  if (document.payloadEncoding !== "messagepack" || !(document.payload instanceof Uint8Array)) throw new Error("Provider publications must carry a raw MessagePack document.");
+}
+
+function validateReceipt(receipt: CultMeshProviderCommandReceiptWire): void {
+  requireText(receipt?.receiptId, "receipt.receiptId");
+  requireText(receipt?.commandId, "receipt.commandId");
+  requireText(receipt?.commandKind, "receipt.commandKind");
+  requireText(receipt?.providerId, "receipt.providerId");
+  requireText(receipt?.serviceInstanceId, "receipt.serviceInstanceId");
+  if (receipt.state !== "applied" && receipt.state !== "rejected" && receipt.state !== "failed") throw new Error("CultMesh provider-session receipt.state is invalid.");
+  if (!Number.isFinite(Date.parse(receipt.completedAtUtc))) throw new Error("CultMesh provider-session receipt.completedAtUtc must be RFC3339.");
+}
+
+function identityTuple(identity: CultMeshProviderRegistrationWire): string {
+  return `${identity.verseId}\u0000${identity.providerId}\u0000${identity.serviceInstanceId}\u0000${identity.endpointId}`;
+}
+
+function documentTuple(document: Pick<CultNetRawDocumentRecord, "schemaId" | "recordKey">): string {
+  return `${document.schemaId}\u0000${document.recordKey}`;
+}
+
+function wireEquivalent(left: unknown, right: unknown): boolean {
+  return Buffer.from(encode(left)).equals(Buffer.from(encode(right)));
+}
+
+function publicationEntries(record: LeaseRecord): readonly {
+  publicationId: string;
+  document: Pick<CultNetRawDocumentRecord, "schemaId" | "recordKey">;
+}[] {
+  return [...record.publications].map(([publicationId, document]) => ({ publicationId, document }));
+}
+
+function requireText(value: unknown, name: string): asserts value is string {
+  if (typeof value !== "string" || value.trim().length === 0) throw new Error(`CultMesh provider-session ${name} must be non-empty.`);
+}
diff --git a/packages/cultmesh-ts/src/provider-session-wire.ts b/packages/cultmesh-ts/src/provider-session-wire.ts
new file mode 100644
index 00000000..e89a3148
--- /dev/null
+++ b/packages/cultmesh-ts/src/provider-session-wire.ts
@@ -0,0 +1,207 @@
+import { decode, encode } from "@msgpack/msgpack";
+import type { CultNetRawDocumentRecord } from "cultnet-ts";
+
+export const CULTMESH_PROVIDER_SESSION_SERVICE_ID = "gamecult.mesh.provider_session";
+
+export const cultMeshProviderSessionOperations = {
+  register: "provider.register",
+  renew: "provider.renew",
+  publicationPut: "provider.publication.put",
+  publicationDelete: "provider.publication.delete",
+  receiptPut: "provider.receipt.put",
+  withdraw: "provider.withdraw",
+} as const;
+
+export const cultMeshProviderSessionSchemas = {
+  registration: "gamecult.mesh.provider_registration.v1",
+  lease: "gamecult.mesh.provider_lease.v1",
+  leaseRenewal: "gamecult.mesh.provider_lease_renewal.v1",
+  publicationPut: "gamecult.mesh.provider_publication_put.v1",
+  publicationDelete: "gamecult.mesh.provider_publication_delete.v1",
+  command: "gamecult.mesh.provider_command.v1",
+  receiptPut: "gamecult.mesh.provider_receipt_put.v1",
+  withdrawal: "gamecult.mesh.provider_withdrawal.v1",
+  mutationAcceptance: "gamecult.mesh.provider_mutation_acceptance.v1",
+} as const;
+
+export type CultMeshProviderOperationStatus =
+  | "ok"
+  | "conflict"
+  | "expired"
+  | "denied"
+  | "invalid";
+
+/**
+ * Transport evidence carried by a provider's RUDP Connect packet.
+ *
+ * `clientSessionId` distinguishes an actual reconnect from retransmission of
+ * the same Connect packet. The token remains authorization evidence only; it
+ * is not a transport-session identifier.
+ */
+export interface CultMeshProviderConnectEvidenceWire {
+  clientSessionId: string;
+  sessionToken: string | null;
+}
+
+export interface CultMeshProviderRegistrationWire {
+  providerId: string;
+  serviceInstanceId: string;
+  endpointId: string;
+  verseId: string;
+  requestedLeaseDurationMs: number;
+  authorityLeaseId?: string;
+}
+
+export interface CultMeshProviderLeaseWire {
+  providerId: string;
+  serviceInstanceId: string;
+  endpointId: string;
+  verseId: string;
+  leaseId: string;
+  validFromUtc: string;
+  expiresAtUtc: string;
+}
+
+export interface CultMeshProviderLeaseRenewalWire {
+  leaseId: string;
+  requestedLeaseDurationMs: number;
+}
+
+export interface CultMeshProviderPublicationPutWire {
+  leaseId: string;
+  publicationId: string;
+  document: CultNetRawDocumentRecord;
+}
+
+export interface CultMeshProviderPublicationDeleteWire {
+  leaseId: string;
+  publicationId: string;
+  schemaId: string;
+  recordKey: string;
+}
+
+export interface CultMeshProviderCommandWire {
+  commandId: string;
+  commandKind: string;
+  providerId: string;
+  serviceInstanceId: string;
+  payload: unknown;
+}
+
+export type CultMeshProviderReceiptStateWire = "applied" | "rejected" | "failed";
+
+export interface CultMeshProviderCommandReceiptWire {
+  receiptId: string;
+  commandId: string;
+  commandKind: string;
+  providerId: string;
+  serviceInstanceId: string;
+  state: CultMeshProviderReceiptStateWire;
+  completedAtUtc: string;
+  result?: unknown;
+  error?: string;
+}
+
+export interface CultMeshProviderReceiptPutWire {
+  leaseId: string;
+  receipt: CultMeshProviderCommandReceiptWire;
+}
+
+export interface CultMeshProviderWithdrawalWire {
+  leaseId: string;
+}
+
+export interface CultMeshProviderMutationAcceptanceWire {
+  acceptedAtUtc: string;
+  leaseId?: string;
+  publicationId?: string;
+  commandId?: string;
+  receiptId?: string;
+}
+
+export function encodeProviderSessionPayload(value: unknown): string {
+  return Buffer.from(encode(value)).toString("base64");
+}
+
+export function decodeProviderSessionPayload<T>(payload: string): T {
+  if (typeof payload !== "string" || payload.length === 0) {
+    throw new Error("CultMesh provider-session payload must be non-empty MessagePack base64.");
+  }
+  return decode(Buffer.from(payload, "base64")) as T;
+}
+
+export function encodeProviderConnectEvidence(
+  evidence: CultMeshProviderConnectEvidenceWire,
+): Uint8Array {
+  assertProviderConnectEvidence(evidence);
+  return encode(evidence);
+}
+
+export function decodeProviderConnectEvidence(
+  payload: Uint8Array,
+): CultMeshProviderConnectEvidenceWire {
+  const evidence = decode(payload) as unknown;
+  assertProviderConnectEvidence(evidence);
+  return evidence;
+}
+
+export function assertProviderConnectEvidence(
+  value: unknown,
+): asserts value is CultMeshProviderConnectEvidenceWire {
+  const evidence = requireObject(value, "provider Connect evidence");
+  requireText(evidence.clientSessionId, "clientSessionId");
+  if (evidence.sessionToken !== null) {
+    requireText(evidence.sessionToken, "sessionToken");
+  }
+}
+
+export function decodeProviderCommandDocument(document: CultNetRawDocumentRecord): CultMeshProviderCommandWire {
+  if (document.schemaId !== cultMeshProviderSessionSchemas.command) {
+    throw new Error(`Expected ${cultMeshProviderSessionSchemas.command}, received ${document.schemaId}.`);
+  }
+  if (document.payloadEncoding !== "messagepack") {
+    throw new Error(`Provider command ${document.recordKey} must use MessagePack.`);
+  }
+  const command = decode(document.payload) as Partial<CultMeshProviderCommandWire>;
+  requireText(command.commandId, "commandId");
+  requireText(command.commandKind, "commandKind");
+  requireText(command.providerId, "providerId");
+  requireText(command.serviceInstanceId, "serviceInstanceId");
+  return command as CultMeshProviderCommandWire;
+}
+
+export function assertProviderLease(value: unknown): asserts value is CultMeshProviderLeaseWire {
+  const lease = requireObject(value, "provider lease");
+  requireText(lease.providerId, "providerId");
+  requireText(lease.serviceInstanceId, "serviceInstanceId");
+  requireText(lease.endpointId, "endpointId");
+  requireText(lease.verseId, "verseId");
+  requireText(lease.leaseId, "leaseId");
+  requireTimestamp(lease.validFromUtc, "validFromUtc");
+  requireTimestamp(lease.expiresAtUtc, "expiresAtUtc");
+}
+
+export function assertMutationAcceptance(value: unknown): asserts value is CultMeshProviderMutationAcceptanceWire {
+  const acceptance = requireObject(value, "provider mutation acceptance");
+  requireTimestamp(acceptance.acceptedAtUtc, "acceptedAtUtc");
+}
+
+function requireObject(value: unknown, name: string): Record<string, unknown> {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error(`CultMesh ${name} must be a MessagePack map.`);
+  }
+  return value as Record<string, unknown>;
+}
+
+function requireText(value: unknown, name: string): asserts value is string {
+  if (typeof value !== "string" || value.trim().length === 0) {
+    throw new Error(`CultMesh provider-session ${name} must be non-empty.`);
+  }
+}
+
+function requireTimestamp(value: unknown, name: string): asserts value is string {
+  requireText(value, name);
+  if (!Number.isFinite(Date.parse(value))) {
+    throw new Error(`CultMesh provider-session ${name} must be an RFC3339 timestamp.`);
+  }
+}
diff --git a/packages/cultmesh-ts/src/provider-session.ts b/packages/cultmesh-ts/src/provider-session.ts
new file mode 100644
index 00000000..f63d222c
--- /dev/null
+++ b/packages/cultmesh-ts/src/provider-session.ts
@@ -0,0 +1,884 @@
+export interface CultMeshProviderIdentity {
+  readonly providerId: string;
+  readonly serviceInstanceId: string;
+  readonly endpointId: string;
+  readonly verseId: string;
+}
+
+export interface CultMeshProviderLease {
+  readonly leaseId: string;
+  readonly expiresAt: Date;
+}
+
+export interface CultMeshProviderPublication<TValue = unknown> {
+  readonly publicationId: string;
+  readonly documentType: string;
+  readonly schemaId: string;
+  readonly recordKey: string;
+  readonly value: TValue;
+}
+
+export interface CultMeshProviderCommand<TPayload = unknown> {
+  readonly commandId: string;
+  readonly commandKind: string;
+  readonly providerId: string;
+  readonly serviceInstanceId: string;
+  readonly payload: TPayload;
+}
+
+export type CultMeshProviderReceiptState = "applied" | "rejected" | "failed";
+
+export interface CultMeshProviderCommandReceipt<TResult = unknown> {
+  readonly receiptId: string;
+  readonly commandId: string;
+  readonly commandKind: string;
+  readonly providerId: string;
+  readonly serviceInstanceId: string;
+  readonly state: CultMeshProviderReceiptState;
+  readonly completedAt: Date;
+  readonly result?: TResult;
+  readonly error?: string;
+}
+
+export interface CultMeshProviderCommandOutcome<TResult = unknown> {
+  readonly state: CultMeshProviderReceiptState;
+  readonly result?: TResult;
+  readonly error?: string;
+}
+
+export interface CultMeshProviderCommandContext {
+  readonly identity: CultMeshProviderIdentity;
+}
+
+export type CultMeshProviderCommandHandler = (
+  command: CultMeshProviderCommand,
+  context: CultMeshProviderCommandContext,
+) => Promise<CultMeshProviderCommandOutcome>;
+
+export interface CultMeshProviderReceiptStore {
+  get(commandId: string): Promise<CultMeshProviderCommandReceipt | undefined>;
+  put(receipt: CultMeshProviderCommandReceipt): Promise<void>;
+  listPending(): Promise<readonly CultMeshProviderCommandReceipt[]>;
+  markPublished(receiptId: string): Promise<void>;
+}
+
+export class CultMeshMemoryProviderReceiptStore implements CultMeshProviderReceiptStore {
+  readonly #receipts = new Map<string, CultMeshProviderCommandReceipt>();
+  readonly #pendingReceiptIds = new Set<string>();
+
+  public async get(commandId: string): Promise<CultMeshProviderCommandReceipt | undefined> {
+    return this.#receipts.get(commandId);
+  }
+
+  public async put(receipt: CultMeshProviderCommandReceipt): Promise<void> {
+    this.#receipts.set(receipt.commandId, receipt);
+    this.#pendingReceiptIds.add(receipt.receiptId);
+  }
+
+  public async listPending(): Promise<readonly CultMeshProviderCommandReceipt[]> {
+    return [...this.#receipts.values()]
+      .filter(receipt => this.#pendingReceiptIds.has(receipt.receiptId))
+      .sort((left, right) => left.receiptId.localeCompare(right.receiptId));
+  }
+
+  public async markPublished(receiptId: string): Promise<void> {
+    this.#pendingReceiptIds.delete(receiptId);
+  }
+}
+
+export interface CultMeshProviderRegistration {
+  readonly identity: CultMeshProviderIdentity;
+  readonly requestedLeaseDurationMs: number;
+}
+
+export interface CultMeshProviderWithdrawal {
+  readonly identity: CultMeshProviderIdentity;
+  readonly leaseId: string;
+  readonly publicationIds: readonly string[];
+}
+
+export type CultMeshProviderCommandListener = (
+  command: CultMeshProviderCommand,
+) => void | Promise<void>;
+
+export type CultMeshProviderUnsubscribe = () => void | Promise<void>;
+
+export interface CultMeshProviderConnection {
+  register(
+    registration: CultMeshProviderRegistration,
+    signal: AbortSignal,
+  ): Promise<CultMeshProviderLease>;
+  renew(lease: CultMeshProviderLease): Promise<CultMeshProviderLease>;
+  publish(
+    publication: CultMeshProviderPublication,
+    lease: CultMeshProviderLease,
+  ): Promise<void>;
+  withdrawPublication(publicationId: string, lease: CultMeshProviderLease): Promise<void>;
+  watchCommands(listener: CultMeshProviderCommandListener): CultMeshProviderUnsubscribe;
+  publishReceipt(
+    receipt: CultMeshProviderCommandReceipt,
+    lease: CultMeshProviderLease,
+  ): Promise<void>;
+  withdraw(withdrawal: CultMeshProviderWithdrawal): Promise<void>;
+  close(): void | Promise<void>;
+}
+
+export interface CultMeshProviderTransport {
+  connect(
+    identity: CultMeshProviderIdentity,
+    signal: AbortSignal,
+  ): Promise<CultMeshProviderConnection>;
+}
+
+export interface CultMeshProviderScheduledTask {
+  cancel(): void;
+}
+
+export interface CultMeshProviderScheduler {
+  now(): Date;
+  schedule(delayMs: number, action: () => void | Promise<void>): CultMeshProviderScheduledTask;
+}
+
+export class CultMeshSystemProviderScheduler implements CultMeshProviderScheduler {
+  public now(): Date {
+    return new Date();
+  }
+
+  public schedule(delayMs: number, action: () => void | Promise<void>): CultMeshProviderScheduledTask {
+    const timer = setTimeout(() => {
+      void Promise.resolve(action()).catch(() => undefined);
+    }, Math.max(0, delayMs));
+    return { cancel: () => clearTimeout(timer) };
+  }
+}
+
+export type CultMeshProviderSessionStatus =
+  | "stopped"
+  | "connecting"
+  | "active"
+  | "degraded"
+  | "reconnecting"
+  | "withdrawing";
+
+export interface CultMeshProviderSessionState {
+  readonly status: CultMeshProviderSessionStatus;
+  readonly identity: CultMeshProviderIdentity;
+  readonly reconnectAttempt: number;
+  readonly leaseId?: string;
+  readonly leaseExpiresAt?: Date;
+  readonly lastError?: string;
+}
+
+export interface CultMeshProviderSessionOptions {
+  readonly identity: CultMeshProviderIdentity;
+  readonly transport: CultMeshProviderTransport;
+  readonly publications?: Iterable<CultMeshProviderPublication>;
+  readonly commandHandlers?: Readonly<Record<string, CultMeshProviderCommandHandler>>;
+  readonly receiptStore: CultMeshProviderReceiptStore;
+  readonly scheduler?: CultMeshProviderScheduler;
+  readonly onObserverError?: (error: unknown) => void;
+  readonly leaseDurationMs?: number;
+  readonly renewalLeadMs?: number;
+  readonly reconnectBaseDelayMs?: number;
+  readonly reconnectMaxDelayMs?: number;
+}
+
+export class CultMeshProviderSession {
+  readonly #identity: CultMeshProviderIdentity;
+  readonly #transport: CultMeshProviderTransport;
+  readonly #receiptStore: CultMeshProviderReceiptStore;
+  readonly #scheduler: CultMeshProviderScheduler;
+  readonly #onObserverError: (error: unknown) => void;
+  readonly #leaseDurationMs: number;
+  readonly #renewalLeadMs: number;
+  readonly #reconnectBaseDelayMs: number;
+  readonly #reconnectMaxDelayMs: number;
+  readonly #publications = new Map<string, CultMeshProviderPublication>();
+  readonly #handlers = new Map<string, CultMeshProviderCommandHandler>();
+  readonly #subscribers = new Set<(state: CultMeshProviderSessionState) => void>();
+  readonly #inFlightCommands = new Map<string, {
+    command: CultMeshProviderCommand;
+    work: Promise<void>;
+  }>();
+  #state: CultMeshProviderSessionState;
+  #connection?: CultMeshProviderConnection;
+  #lease?: CultMeshProviderLease;
+  #unsubscribeCommands?: CultMeshProviderUnsubscribe;
+  #scheduled?: CultMeshProviderScheduledTask;
+  #abort?: AbortController;
+  #running = false;
+  #generation = 0;
+  #reconnectAttempt = 0;
+  #publicationWork: Promise<void> = Promise.resolve();
+  #startWork?: Promise<void>;
+  #stopWork?: Promise<void>;
+  #lossWork?: { generation: number; work: Promise<void> };
+
+  public constructor(options: CultMeshProviderSessionOptions) {
+    this.#identity = validateIdentity(options.identity);
+    this.#transport = options.transport;
+    if (!options.receiptStore) {
+      throw new Error(
+        "CultMesh provider sessions require an explicit receiptStore so command receipts survive the provider lifecycle.",
+      );
+    }
+    this.#receiptStore = options.receiptStore;
+    this.#scheduler = options.scheduler ?? new CultMeshSystemProviderScheduler();
+    this.#onObserverError = options.onObserverError ?? (() => undefined);
+    this.#leaseDurationMs = positive(options.leaseDurationMs ?? 30_000, "leaseDurationMs");
+    this.#renewalLeadMs = nonNegative(options.renewalLeadMs ?? 10_000, "renewalLeadMs");
+    if (this.#renewalLeadMs >= this.#leaseDurationMs) {
+      throw new Error("CultMesh provider renewalLeadMs must be less than leaseDurationMs.");
+    }
+    this.#reconnectBaseDelayMs = positive(
+      options.reconnectBaseDelayMs ?? 250,
+      "reconnectBaseDelayMs",
+    );
+    this.#reconnectMaxDelayMs = positive(
+      options.reconnectMaxDelayMs ?? 10_000,
+      "reconnectMaxDelayMs",
+    );
+    if (this.#reconnectMaxDelayMs < this.#reconnectBaseDelayMs) {
+      throw new Error("CultMesh provider reconnectMaxDelayMs must not be less than reconnectBaseDelayMs.");
+    }
+    for (const publication of options.publications ?? []) {
+      this.#publications.set(validatePublication(publication).publicationId, publication);
+    }
+    for (const [kind, handler] of Object.entries(options.commandHandlers ?? {})) {
+      this.setCommandHandler(kind, handler);
+    }
+    this.#state = {
+      status: "stopped",
+      identity: this.#identity,
+      reconnectAttempt: 0,
+    };
+  }
+
+  public get identity(): CultMeshProviderIdentity {
+    return this.#identity;
+  }
+
+  public get state(): CultMeshProviderSessionState {
+    return this.#state;
+  }
+
+  public get publications(): readonly CultMeshProviderPublication[] {
+    return [...this.#publications.values()].sort((left, right) =>
+      left.publicationId.localeCompare(right.publicationId),
+    );
+  }
+
+  public watchState(callback: (state: CultMeshProviderSessionState) => void): () => void {
+    this.#subscribers.add(callback);
+    try {
+      callback(this.#state);
+    } catch (error) {
+      this.#reportObserverError(error);
+    }
+    return () => this.#subscribers.delete(callback);
+  }
+
+  public setCommandHandler(kind: string, handler: CultMeshProviderCommandHandler): void {
+    this.#handlers.set(required(kind, "command kind"), handler);
+  }
+
+  public removeCommandHandler(kind: string): boolean {
+    return this.#handlers.delete(required(kind, "command kind"));
+  }
+
+  public upsertPublication(publication: CultMeshProviderPublication): Promise<void> {
+    const valid = validatePublication(publication);
+    this.#publications.set(valid.publicationId, valid);
+    if (this.#connection && this.#lease) {
+      return this.#enqueuePublication(() => this.#deliverPublication(valid, this.#generation));
+    }
+    return Promise.resolve();
+  }
+
+  public async removePublication(publicationId: string): Promise<boolean> {
+    const id = required(publicationId, "publicationId");
+    const removed = this.#publications.delete(id);
+    if (removed && this.#connection && this.#lease) {
+      await this.#enqueuePublication(() => this.#withdrawPublication(id, this.#generation));
+    }
+    return removed;
+  }
+
+  public start(): Promise<void> {
+    if (this.#stopWork) {
+      return Promise.reject(new Error("CultMesh provider cannot start while shutdown is in progress."));
+    }
+    if (this.#startWork) return this.#startWork;
+    if (this.#running) return Promise.resolve();
+    let tracked!: Promise<void>;
+    tracked = Promise.resolve().then(() => this.#start()).finally(() => {
+      if (this.#startWork === tracked) this.#startWork = undefined;
+    });
+    this.#startWork = tracked;
+    return tracked;
+  }
+
+  async #start(): Promise<void> {
+    this.#running = true;
+    this.#reconnectAttempt = 0;
+    const generation = ++this.#generation;
+    this.#abort = new AbortController();
+    await this.#connect(generation, false);
+  }
+
+  public stop(): Promise<void> {
+    if (this.#stopWork) return this.#stopWork;
+    if (!this.#running && !this.#startWork && this.#state.status === "stopped") {
+      return Promise.resolve();
+    }
+    let tracked!: Promise<void>;
+    tracked = Promise.resolve().then(() => this.#stop()).finally(() => {
+      if (this.#stopWork === tracked) this.#stopWork = undefined;
+    });
+    this.#stopWork = tracked;
+    return tracked;
+  }
+
+  async #stop(): Promise<void> {
+    this.#running = false;
+    const generation = ++this.#generation;
+    this.#cancelScheduled();
+    this.#abort?.abort();
+    this.#setState("withdrawing");
+    const connection = this.#connection;
+    const lease = this.#lease;
+    const starting = this.#startWork;
+    const losing = this.#lossWork?.work;
+    this.#connection = undefined;
+    this.#lease = undefined;
+    const errors: unknown[] = [];
+    try {
+      await this.#unsubscribe();
+    } catch (error) {
+      errors.push(error);
+    }
+    try {
+      await this.#publicationWork;
+    } catch (error) {
+      errors.push(error);
+    }
+    for (const lifecycleWork of [starting, losing]) {
+      if (!lifecycleWork) continue;
+      try {
+        await lifecycleWork;
+      } catch (error) {
+        errors.push(error);
+      }
+    }
+    this.#cancelScheduled();
+    const commandWork = [...this.#inFlightCommands.values()].map(value => value.work);
+    const commandResults = await Promise.allSettled(commandWork);
+    for (const result of commandResults) {
+      if (result.status === "rejected") errors.push(result.reason);
+    }
+    if (connection && lease) {
+      try {
+        await connection.withdraw({
+          identity: this.#identity,
+          leaseId: lease.leaseId,
+          publicationIds: this.publications.map(value => value.publicationId),
+        });
+      } catch (error) {
+        errors.push(error);
+      }
+    }
+    if (connection) {
+      try {
+        await connection.close();
+      } catch (error) {
+        errors.push(error);
+      }
+    }
+    if (generation === this.#generation) this.#setState("stopped");
+    if (errors.length > 0) {
+      throw new AggregateError(errors, "CultMesh provider shutdown completed with cleanup failures.");
+    }
+  }
+
+  async #connect(generation: number, reconnecting: boolean): Promise<void> {
+    if (!this.#isCurrent(generation)) return;
+    this.#scheduled = undefined;
+    this.#setState(reconnecting ? "reconnecting" : "connecting");
+    try {
+      const connection = await this.#transport.connect(this.#identity, this.#abort!.signal);
+      if (!this.#isCurrent(generation)) {
+        await connection.close();
+        return;
+      }
+      this.#connection = connection;
+      const lease = validateLease(
+        await connection.register({
+          identity: this.#identity,
+          requestedLeaseDurationMs: this.#leaseDurationMs,
+        }, this.#abort!.signal),
+        this.#scheduler.now(),
+      );
+      if (!this.#isCurrent(generation)) {
+        await connection.close();
+        return;
+      }
+      this.#lease = lease;
+      const initialPublications = this.publications;
+      await this.#enqueuePublication(async () => {
+        for (const publication of initialPublications) {
+          if (!this.#isCurrent(generation)) return;
+          requireUnexpiredLease(lease, this.#scheduler.now());
+          await connection.publish(publication, lease);
+        }
+      });
+      if (!this.#isCurrent(generation)) return;
+      const readyLease = await this.#renewIfNeeded(connection, lease, generation);
+      if (!readyLease || !this.#isCurrent(generation)) return;
+      this.#lease = readyLease;
+      this.#reconnectAttempt = 0;
+      const receiptsReady = await this.#drainPendingReceipts(connection, readyLease, generation);
+      if (!this.#isCurrent(generation)) return;
+      if (receiptsReady) {
+        this.#enableCommands(connection, generation);
+        this.#setState("active", undefined, readyLease);
+      }
+      this.#scheduleRenewal(generation, readyLease);
+    } catch (error) {
+      await this.#loseConnection(generation, error);
+    }
+  }
+
+  #scheduleRenewal(generation: number, lease: CultMeshProviderLease): void {
+    if (!this.#isCurrent(generation)) return;
+    this.#scheduled?.cancel();
+    const delay = Math.max(
+      1,
+      lease.expiresAt.getTime() - this.#scheduler.now().getTime() - this.#renewalLeadMs,
+    );
+    this.#scheduled = this.#scheduler.schedule(delay, () => this.#renew(generation));
+  }
+
+  async #renew(generation: number): Promise<void> {
+    if (!this.#isCurrent(generation) || !this.#connection || !this.#lease) return;
+    this.#scheduled = undefined;
+    try {
+      let lease = validateLease(
+        await this.#connection.renew(this.#lease),
+        this.#scheduler.now(),
+      );
+      if (!this.#isCurrent(generation)) return;
+      this.#lease = lease;
+      const receiptsReady = await this.#drainPendingReceipts(this.#connection, lease, generation);
+      if (!this.#isCurrent(generation)) return;
+      if (receiptsReady) {
+        lease = await this.#renewIfNeeded(this.#connection, lease, generation) ?? lease;
+        if (!this.#isCurrent(generation)) return;
+        this.#lease = lease;
+        this.#enableCommands(this.#connection, generation);
+        this.#setState("active", undefined, lease);
+      }
+      this.#scheduleRenewal(generation, lease);
+    } catch (error) {
+      await this.#loseConnection(generation, error);
+    }
+  }
+
+  async #deliverPublication(
+    publication: CultMeshProviderPublication,
+    generation: number,
+  ): Promise<void> {
+    const connection = this.#connection;
+    const lease = this.#lease;
+    if (!connection || !lease || !this.#isCurrent(generation)) return;
+    try {
+      requireUnexpiredLease(lease, this.#scheduler.now());
+      await connection.publish(publication, lease);
+    } catch (error) {
+      await this.#loseConnection(generation, error);
+    }
+  }
+
+  async #withdrawPublication(publicationId: string, generation: number): Promise<void> {
+    const connection = this.#connection;
+    const lease = this.#lease;
+    if (!connection || !lease || !this.#isCurrent(generation)) return;
+    try {
+      requireUnexpiredLease(lease, this.#scheduler.now());
+      await connection.withdrawPublication(publicationId, lease);
+    } catch (error) {
+      await this.#loseConnection(generation, error);
+    }
+  }
+
+  async #receiveCommand(command: CultMeshProviderCommand, generation: number): Promise<void> {
+    if (!this.#isCurrent(generation) ||
+        command.providerId !== this.#identity.providerId ||
+        command.serviceInstanceId !== this.#identity.serviceInstanceId) {
+      return;
+    }
+    try {
+      required(command.commandId, "commandId");
+      required(command.commandKind, "commandKind");
+    } catch (error) {
+      this.#setState("degraded", errorText(error), this.#lease);
+      return;
+    }
+    const inFlight = this.#inFlightCommands.get(command.commandId);
+    if (inFlight) {
+      if (!sameCommandIdentity(inFlight.command, command)) {
+        this.#setState(
+          "degraded",
+          `CultMesh command id '${command.commandId}' was reused with different identity while in flight.`,
+          this.#lease,
+        );
+        return;
+      }
+      await inFlight.work;
+      return;
+    }
+    const work = this.#processCommand(command, generation);
+    const entry = { command, work };
+    this.#inFlightCommands.set(command.commandId, entry);
+    try {
+      await work;
+    } finally {
+      if (this.#inFlightCommands.get(command.commandId) === entry) {
+        this.#inFlightCommands.delete(command.commandId);
+      }
+    }
+  }
+
+  async #processCommand(command: CultMeshProviderCommand, generation: number): Promise<void> {
+    let receipt: CultMeshProviderCommandReceipt;
+    try {
+      receipt = await this.#resolveCommand(command);
+    } catch (error) {
+      if (this.#isCurrent(generation)) {
+        await this.#degradeReceiptStore(
+          `Command receipt persistence failed: ${errorText(error)}`,
+          generation,
+        );
+      }
+      return;
+    }
+    const connection = this.#connection;
+    const lease = this.#lease;
+    if (!connection || !lease || !this.#isCurrent(generation)) return;
+    try {
+      await connection.publishReceipt(receipt, lease);
+    } catch (error) {
+      await this.#loseConnection(generation, error);
+      return;
+    }
+    try {
+      await this.#receiptStore.markPublished(receipt.receiptId);
+    } catch (error) {
+      if (this.#isCurrent(generation)) {
+        await this.#degradeReceiptStore(
+          `Command receipt publication could not be committed: ${errorText(error)}`,
+          generation,
+        );
+      }
+    }
+  }
+
+  async #resolveCommand(command: CultMeshProviderCommand): Promise<CultMeshProviderCommandReceipt> {
+    const prior = await this.#receiptStore.get(command.commandId);
+    if (prior) {
+      validateStoredReceipt(prior, this.#identity);
+      if (prior.commandKind !== command.commandKind) {
+        throw new Error(`CultMesh command id '${command.commandId}' was reused with different identity.`);
+      }
+      return prior;
+    }
+    const handler = this.#handlers.get(command.commandKind);
+    let outcome: CultMeshProviderCommandOutcome;
+    if (!handler) {
+      outcome = { state: "rejected", error: `No handler for '${command.commandKind}'.` };
+    } else {
+      try {
+        outcome = await handler(command, { identity: this.#identity });
+        validateOutcomeState(outcome?.state);
+      } catch (error) {
+        outcome = { state: "failed", error: errorText(error) };
+      }
+    }
+    const receipt: CultMeshProviderCommandReceipt = {
+      receiptId: receiptId(this.#identity, command.commandId),
+      commandId: command.commandId,
+      commandKind: command.commandKind,
+      providerId: this.#identity.providerId,
+      serviceInstanceId: this.#identity.serviceInstanceId,
+      state: validateOutcomeState(outcome.state),
+      completedAt: this.#scheduler.now(),
+      result: outcome.result,
+      error: outcome.error,
+    };
+    await this.#receiptStore.put(receipt);
+    return receipt;
+  }
+
+  async #loseConnection(generation: number, error: unknown): Promise<void> {
+    if (!this.#isCurrent(generation)) return;
+    const existing = this.#lossWork;
+    if (existing?.generation === generation) {
+      await existing.work;
+      return;
+    }
+    let tracked!: Promise<void>;
+    tracked = this.#performConnectionLoss(generation, error).finally(() => {
+      if (this.#lossWork?.work === tracked) this.#lossWork = undefined;
+    });
+    this.#lossWork = { generation, work: tracked };
+    await tracked;
+  }
+
+  async #performConnectionLoss(generation: number, error: unknown): Promise<void> {
+    this.#cancelScheduled();
+    const connection = this.#connection;
+    this.#connection = undefined;
+    this.#lease = undefined;
+    this.#reconnectAttempt++;
+    const failures = [errorText(error)];
+    this.#setState("reconnecting", failures[0]);
+    try {
+      await this.#unsubscribe();
+    } catch (cleanupError) {
+      failures.push(`unsubscribe failed: ${errorText(cleanupError)}`);
+    }
+    if (connection) {
+      try {
+        await connection.close();
+      } catch (cleanupError) {
+        failures.push(`close failed: ${errorText(cleanupError)}`);
+      }
+    }
+    if (!this.#isCurrent(generation)) return;
+    this.#setState("reconnecting", failures.join("; "));
+    const exponent = Math.max(0, this.#reconnectAttempt - 1);
+    const delay = Math.min(
+      this.#reconnectMaxDelayMs,
+      this.#reconnectBaseDelayMs * 2 ** exponent,
+    );
+    this.#scheduled = this.#scheduler.schedule(delay, () => this.#connect(generation, true));
+  }
+
+  async #drainPendingReceipts(
+    connection: CultMeshProviderConnection,
+    lease: CultMeshProviderLease,
+    generation: number,
+  ): Promise<boolean> {
+    let pending: readonly CultMeshProviderCommandReceipt[];
+    try {
+      pending = await this.#receiptStore.listPending();
+    } catch (error) {
+      if (this.#isCurrent(generation)) {
+        await this.#degradeReceiptStore(
+          `Pending command receipts could not be read: ${errorText(error)}`,
+          generation,
+        );
+      }
+      return false;
+    }
+    for (const receipt of [...pending].sort((left, right) => left.receiptId.localeCompare(right.receiptId))) {
+      try {
+        validateStoredReceipt(receipt, this.#identity);
+      } catch (error) {
+        if (this.#isCurrent(generation)) {
+          await this.#degradeReceiptStore(
+            `Pending command receipt is invalid: ${errorText(error)}`,
+            generation,
+          );
+        }
+        return false;
+      }
+      if (!this.#isCurrent(generation)) return false;
+      requireUnexpiredLease(lease, this.#scheduler.now());
+      await connection.publishReceipt(receipt, lease);
+      try {
+        await this.#receiptStore.markPublished(receipt.receiptId);
+      } catch (error) {
+        if (this.#isCurrent(generation)) {
+          await this.#degradeReceiptStore(
+            `Command receipt publication could not be committed: ${errorText(error)}`,
+            generation,
+          );
+        }
+        return false;
+      }
+    }
+    return true;
+  }
+
+  async #renewIfNeeded(
+    connection: CultMeshProviderConnection,
+    lease: CultMeshProviderLease,
+    generation: number,
+  ): Promise<CultMeshProviderLease | undefined> {
+    if (lease.expiresAt.getTime() - this.#scheduler.now().getTime() > this.#renewalLeadMs) {
+      return lease;
+    }
+    const renewed = validateLease(await connection.renew(lease), this.#scheduler.now());
+    return this.#isCurrent(generation) ? renewed : undefined;
+  }
+
+  #enableCommands(connection: CultMeshProviderConnection, generation: number): void {
+    if (this.#unsubscribeCommands || !this.#isCurrent(generation)) return;
+    this.#unsubscribeCommands = connection.watchCommands(command => this.#receiveCommand(command, generation));
+  }
+
+  async #degradeReceiptStore(message: string, generation: number): Promise<void> {
+    try {
+      await this.#unsubscribe();
+    } catch (error) {
+      this.#reportObserverError(error);
+    }
+    if (this.#isCurrent(generation)) this.#setState("degraded", message, this.#lease);
+  }
+
+  async #unsubscribe(): Promise<void> {
+    const unsubscribe = this.#unsubscribeCommands;
+    this.#unsubscribeCommands = undefined;
+    if (unsubscribe) await unsubscribe();
+  }
+
+  #cancelScheduled(): void {
+    const scheduled = this.#scheduled;
+    this.#scheduled = undefined;
+    scheduled?.cancel();
+  }
+
+  #enqueuePublication(action: () => Promise<void>): Promise<void> {
+    const work = this.#publicationWork.then(action, action);
+    this.#publicationWork = work.catch(() => undefined);
+    return work;
+  }
+
+  #isCurrent(generation: number): boolean {
+    return this.#running && generation === this.#generation;
+  }
+
+  #setState(
+    status: CultMeshProviderSessionStatus,
+    lastError?: string,
+    lease?: CultMeshProviderLease,
+  ): void {
+    this.#state = {
+      status,
+      identity: this.#identity,
+      reconnectAttempt: this.#reconnectAttempt,
+      leaseId: lease?.leaseId,
+      leaseExpiresAt: lease?.expiresAt,
+      lastError,
+    };
+    for (const subscriber of [...this.#subscribers]) {
+      try {
+        subscriber(this.#state);
+      } catch (error) {
+        this.#reportObserverError(error);
+      }
+    }
+  }
+
+  #reportObserverError(error: unknown): void {
+    try {
+      this.#onObserverError(error);
+    } catch {
+      // Diagnostics cannot become a provider lifecycle authority.
+    }
+  }
+}
+
+function validateIdentity(identity: CultMeshProviderIdentity): CultMeshProviderIdentity {
+  required(identity.providerId, "providerId");
+  required(identity.serviceInstanceId, "serviceInstanceId");
+  required(identity.endpointId, "endpointId");
+  required(identity.verseId, "verseId");
+  return identity;
+}
+
+function validatePublication(publication: CultMeshProviderPublication): CultMeshProviderPublication {
+  required(publication.publicationId, "publicationId");
+  required(publication.documentType, "documentType");
+  required(publication.schemaId, "schemaId");
+  required(publication.recordKey, "recordKey");
+  return publication;
+}
+
+function validateLease(lease: CultMeshProviderLease, now: Date): CultMeshProviderLease {
+  required(lease.leaseId, "leaseId");
+  if (!(lease.expiresAt instanceof Date) || !Number.isFinite(lease.expiresAt.getTime())) {
+    throw new Error("CultMesh provider lease requires a valid expiresAt date.");
+  }
+  if (lease.expiresAt <= now) {
+    throw new Error("CultMesh provider lease must expire in the future.");
+  }
+  return lease;
+}
+
+function requireUnexpiredLease(lease: CultMeshProviderLease, now: Date): void {
+  if (lease.expiresAt <= now) {
+    throw new Error(`CultMesh provider lease '${lease.leaseId}' expired during replay.`);
+  }
+}
+
+function validateOutcomeState(state: CultMeshProviderReceiptState): CultMeshProviderReceiptState {
+  if (state !== "applied" && state !== "rejected" && state !== "failed") {
+    throw new Error(`CultMesh provider command handler returned invalid receipt state '${String(state)}'.`);
+  }
+  return state;
+}
+
+function sameCommandIdentity(
+  left: CultMeshProviderCommand,
+  right: CultMeshProviderCommand,
+): boolean {
+  return left.providerId === right.providerId &&
+    left.serviceInstanceId === right.serviceInstanceId &&
+    left.commandKind === right.commandKind;
+}
+
+function validateStoredReceipt(
+  receipt: CultMeshProviderCommandReceipt,
+  identity: CultMeshProviderIdentity,
+): void {
+  required(receipt.commandId, "stored receipt commandId");
+  required(receipt.commandKind, "stored receipt commandKind");
+  required(receipt.receiptId, "stored receipt receiptId");
+  validateOutcomeState(receipt.state);
+  if (receipt.providerId !== identity.providerId ||
+      receipt.serviceInstanceId !== identity.serviceInstanceId ||
+      receipt.receiptId !== receiptId(identity, receipt.commandId)) {
+    throw new Error(`CultMesh stored receipt '${receipt.receiptId}' does not belong to this provider session.`);
+  }
+}
+
+function receiptId(identity: CultMeshProviderIdentity, commandId: string): string {
+  const parts = [identity.providerId, identity.serviceInstanceId, commandId];
+  return `receipt:${parts.map(value => `${value.length}:${value}`).join("")}`;
+}
+
+function required(value: string, name: string): string {
+  if (!value || value.trim().length === 0) {
+    throw new Error(`CultMesh provider ${name} must be non-empty.`);
+  }
+  return value;
+}
+
+function positive(value: number, name: string): number {
+  if (!Number.isFinite(value) || value <= 0) {
+    throw new Error(`CultMesh provider ${name} must be positive.`);
+  }
+  return value;
+}
+
+function nonNegative(value: number, name: string): number {
+  if (!Number.isFinite(value) || value < 0) {
+    throw new Error(`CultMesh provider ${name} must be non-negative.`);
+  }
+  return value;
+}
+
+function errorText(error: unknown): string {
+  return error instanceof Error ? error.message : String(error);
+}
diff --git a/packages/cultmesh-ts/test/cultmesh.test.ts b/packages/cultmesh-ts/test/cultmesh.test.ts
index c14d3a47..16d51e1e 100644
--- a/packages/cultmesh-ts/test/cultmesh.test.ts
+++ b/packages/cultmesh-ts/test/cultmesh.test.ts
@@ -5,7 +5,7 @@ import test from "node:test";
 import assert from "node:assert/strict";
 import { encode } from "@msgpack/msgpack";
 import { z } from "zod";
-import { defineDocumentType } from "cultcache-ts";
+import { defineDocumentType } from "@gamecult/cultcache-ts";
 import {
   CultNetDocumentRegistry,
   CultNetPeer,
@@ -24,6 +24,41 @@ const noteDocument = defineDocumentType({
   name: "noteId",
 });
 
+const noteAliasDocument = defineDocumentType({
+  type: "cultmesh.note.ui",
+  schemaId: "cultmesh.note.v0",
+  schema: z.object({
+    noteId: z.string(),
+    body: z.string(),
+  }),
+  name: "noteId",
+});
+
+const noteReceiptDocument = defineDocumentType({
+  type: "cultmesh.note_receipt",
+  schemaId: "cultmesh.note_receipt.v0",
+  schema: z.object({ commandId: z.string(), state: z.literal("applied"), body: z.string() }),
+  name: "commandId",
+});
+
+const foreignNoteDocument = defineDocumentType({
+  type: "runtime.generated.cultmesh.note",
+  schemaId: "runtime.generated.cultmesh.note.ui.42",
+  schema: z.object({
+    noteId: z.string(),
+    body: z.string(),
+  }),
+  name: "noteId",
+});
+
+const incompatibleNoteDocument = defineDocumentType({
+  type: "runtime.generated.incompatible-note",
+  schemaId: "runtime.generated.incompatible-note.v1",
+  schema: z.object({
+    nope: z.string(),
+  }),
+});
+
 async function waitFor(predicate: () => boolean, description: string): Promise<void> {
   const startedAt = Date.now();
   while (!predicate()) {
@@ -58,6 +93,1110 @@ test("CultMesh TS opens a durable local node and registers document bindings", a
   assert.ok(reopened.documents.getBySchemaId("cultmesh.note.v0"));
 });
 
+test("CultMesh TS document handles hide local cache plumbing behind typed reactive reads", async () => {
+  const filePath = join(await mkdtemp(join(tmpdir(), "cultmesh-ts-doc-")), "node.ccmp");
+  const node = await CultMesh.startNode(filePath, {
+    documents: [noteDocument],
+  });
+  await node.put(noteDocument, "note:1", {
+    noteId: "note:1",
+    body: "initial",
+  });
+
+  const document = node.document(noteDocument, "note:1", { pollMs: 5 });
+  const verse = CultMesh.verse("local", "browser-client", {
+    routeHint: CultMesh.routeHint("shared-memory", "local cache"),
+  });
+  const bound = verse.bindDocument(document);
+  const observed: string[] = [];
+  const unsubscribe = bound.watch(note => observed.push(note.body));
+
+  assert.equal(document.documentId, "cultmesh.note:note:1");
+  assert.equal(document.canReplace, true);
+  assert.equal(document.canSubmitPrediction, false);
+  assert.equal((await bound.latest()).body, "initial");
+
+  await bound.replace({
+    noteId: "note:1",
+    body: "updated",
+  });
+  await waitFor(() => observed.includes("updated"), "document handle update");
+  unsubscribe();
+
+  const alias = bound.asSchemaAlias(noteAliasDocument, {
+    parse: value => noteAliasDocument.schema.parse(value),
+  });
+  assert.equal((await alias.latest()).body, "updated");
+
+  const catalog = CultMesh.documents(document);
+  assert.equal(catalog.canReplace(noteAliasDocument), true);
+  await catalog.authoritativeWriter(noteAliasDocument, {
+    parse: value => noteAliasDocument.schema.parse(value),
+    context: "browser-client",
+  }).write({
+    noteId: "note:1",
+    body: "catalog-updated",
+  });
+  assert.equal(
+    (await catalog.latest(noteAliasDocument, "browser-client", {
+      parse: value => noteAliasDocument.schema.parse(value),
+    })).body,
+    "catalog-updated",
+  );
+  const incremented = await bound.authoritativeWriter().update(value => ({
+    ...value,
+    body: `${value.body}:updated-through-bound-set`,
+  }));
+  assert.equal(incremented.body, "catalog-updated:updated-through-bound-set");
+  assert.equal((await document.latest()).body, "catalog-updated:updated-through-bound-set");
+  assert.throws(
+    () => document.asSchemaAlias({ schemaId: "cultmesh.other.v0" }),
+    /not compatible/,
+  );
+});
+
+test("CultMesh TS document handles submit predictions through configured authority hooks", async () => {
+  let current = {
+    noteId: "note:prediction",
+    body: "initial",
+  };
+  const predictions: string[] = [];
+  const contexts: string[] = [];
+  const document = CultMesh.document(
+    "cultmesh.note:prediction",
+    noteDocument,
+    async () => current,
+    {
+      routeHint: CultMesh.routeHint("network", "CultNet prediction"),
+      submitPrediction: async (context, value) => {
+        contexts.push(`${context.runtimeId}:${context.routeHint.kind}`);
+        predictions.push(value.body);
+        current = value;
+      },
+    },
+  );
+  const verse = CultMesh.verse("starbridge", "pilot-a");
+  const bound = document.bind(verse);
+  const catalog = CultMesh.documents(document);
+
+  assert.equal(document.canReplace, false);
+  assert.equal(document.canSubmitPrediction, true);
+  assert.equal(bound.canSubmitPrediction, true);
+  assert.equal(catalog.canSubmitPrediction(noteAliasDocument), true);
+
+  await catalog.predictionWriter(noteAliasDocument, {
+    parse: value => noteAliasDocument.schema.parse(value),
+    context: "pilot-a",
+  }).write({
+    noteId: "note:prediction",
+    body: "predicted",
+  });
+
+  assert.deepEqual(contexts, ["pilot-a:network"]);
+  assert.deepEqual(predictions, ["predicted"]);
+  assert.equal((await bound.latest()).body, "predicted");
+
+  const alias = bound.asSchemaAlias(noteAliasDocument, {
+    parse: value => noteAliasDocument.schema.parse(value),
+  });
+  assert.equal(alias.canSubmitPrediction, true);
+  await alias.predictionWriter().write({
+    noteId: "note:prediction",
+    body: "alias-predicted",
+  });
+
+  assert.deepEqual(predictions, ["predicted", "alias-predicted"]);
+  assert.equal((await document.latest("pilot-a")).body, "alias-predicted");
+  const updated = await document.predictionWriter("pilot-a").update(value => ({
+    ...value,
+    body: "updated-as-prediction",
+  }));
+  assert.equal(updated.body, "updated-as-prediction");
+  assert.deepEqual(predictions, ["predicted", "alias-predicted", "updated-as-prediction"]);
+
+  assert.throws(
+    () => document.replace({
+      noteId: "note:prediction",
+      body: "not-authoritative",
+    }),
+    /does not support replacement/,
+  );
+});
+
+test("CultMesh TS documents with both capabilities require an immutable writer choice", async () => {
+  let current = { noteId: "note:dual", body: "initial" };
+  const writes: string[] = [];
+  const document = CultMesh.document(
+    "cultmesh.note:dual",
+    noteDocument,
+    async () => current,
+    {
+      replaceDocument: async (_context, value) => {
+        writes.push(`authoritative:${value.body}`);
+        current = value;
+      },
+      submitPrediction: async (_context, value) => {
+        writes.push(`prediction:${value.body}`);
+        current = value;
+      },
+    },
+  );
+
+  assert.equal((document as unknown as { set?: unknown }).set, undefined);
+  await document.authoritativeWriter().write({ noteId: "note:dual", body: "canonical" });
+  const predictionWriter = document.predictionWriter();
+  await predictionWriter.write({ noteId: "note:dual", body: "predicted" });
+
+  assert.equal(predictionWriter.kind, "prediction");
+  assert.deepEqual(writes, ["authoritative:canonical", "prediction:predicted"]);
+});
+
+test("CultMesh TS store document handles choose compatible foreign schema payloads", async () => {
+  const store = {
+    async pullAll() {
+      return [
+        {
+          key: "note:foreign",
+          type: "runtime.generated.incompatible-note",
+          schemaId: "runtime.generated.incompatible-note.v1",
+          storedAt: "2026-06-27T00:00:00Z",
+          payload: encode({ nope: "not the requested shape" }),
+          catalogEntry: {
+            schemaId: "runtime.generated.incompatible-note.v1",
+            schemaName: "runtime.generated.incompatible-note",
+            schemaVersion: "runtime.generated.incompatible-note.v1",
+            contentHash: "runtime.generated.incompatible-note.v1",
+            canonicalSchemaJson: "{}",
+            compatibleSchemaIds: ["runtime.generated.incompatible-note.v1"],
+          },
+        },
+        {
+          key: "note:foreign",
+          type: "runtime.generated.cultmesh.note",
+          schemaId: "runtime.generated.cultmesh.note.ui.42",
+          storedAt: "2026-06-27T00:00:01Z",
+          payload: encode({
+            noteId: "note:foreign",
+            body: "foreign schema id, local store shape",
+          }),
+          catalogEntry: {
+            schemaId: "runtime.generated.cultmesh.note.ui.42",
+            schemaName: "cultmesh.note",
+            schemaVersion: "cultmesh.note.v1",
+            contentHash: "runtime.generated.cultmesh.note.ui.42",
+            canonicalSchemaJson: "{}",
+            compatibleSchemaIds: ["runtime.generated.cultmesh.note.ui.42"],
+          },
+        },
+      ];
+    },
+    async push() {},
+    async delete() {},
+  };
+
+  const document = CultMesh.documentFromStore(store, noteAliasDocument, {
+    documentId: "note:foreign.store",
+  });
+
+  assert.deepEqual(await document.latest(), {
+    noteId: "note:foreign",
+    body: "foreign schema id, local store shape",
+  });
+});
+
+test("CultMesh TS reactive documents submit predictions from explicit updates", async () => {
+  let current = {
+    noteId: "note:reactive",
+    body: "initial",
+  };
+  const predictions: string[] = [];
+  const document = CultMesh.document(
+    "cultmesh.note:reactive",
+    noteDocument,
+    async () => current,
+    {
+      routeHint: CultMesh.routeHint("network", "CultNet prediction"),
+      submitPrediction: async (_context, value) => {
+        predictions.push(value.body);
+        current = value;
+      },
+    },
+  );
+
+  const reactive = document.predictionWriter().reactive({
+    watch: false,
+  });
+  await reactive.ready;
+  reactive.update(value => {
+    value.body = "explicit-update-prediction";
+  });
+  reactive.update(value => {
+    value.body = "explicit-update-prediction-final";
+  });
+  await waitFor(
+    () => predictions.includes("explicit-update-prediction-final"),
+    "reactive explicit update prediction",
+  );
+
+  assert.equal(current.body, "explicit-update-prediction-final");
+  assert.deepEqual(predictions, ["explicit-update-prediction-final"]);
+  reactive.dispose();
+  assert.throws(() => reactive.update(value => {
+    value.body = "after-dispose";
+  }), /disposed/);
+  assert.deepEqual(predictions, ["explicit-update-prediction-final"]);
+});
+
+test("CultMesh TS reactive updates publish nested edits while snapshot mutation stays local", async () => {
+  let current = {
+    shipId: "ship:nested",
+    loadout: {
+      weapon: {
+        key: "weapon:laser",
+        tuning: { damage: 10 },
+      },
+    },
+  };
+  const predictions: typeof current[] = [];
+  const document = CultMesh.document(
+    "cultmesh.ship:nested",
+    { schemaId: "cultmesh.ship.nested.v0" },
+    async () => current,
+    {
+      submitPrediction: async (_context, value) => {
+        current = structuredClone(value);
+        predictions.push(structuredClone(value));
+      },
+    },
+  );
+  const reactive = document.predictionWriter().reactive({ watch: false });
+  await reactive.ready;
+
+  reactive.update(draft => {
+    draft.loadout.weapon.tuning.damage = 12;
+  });
+  await reactive.flush();
+
+  assert.equal(current.loadout.weapon.tuning.damage, 12);
+  assert.equal(predictions.length, 1);
+
+  const borrowed = reactive.snapshot;
+  borrowed.loadout.weapon.tuning.damage = 99;
+  await new Promise(resolve => setTimeout(resolve, 20));
+
+  assert.equal(reactive.snapshot.loadout.weapon.tuning.damage, 12);
+  assert.equal(current.loadout.weapon.tuning.damage, 12);
+  assert.equal(predictions.length, 1);
+  reactive.dispose();
+});
+
+test("CultMesh TS node opens same-schema aliases with one call", async () => {
+  const filePath = join(await mkdtemp(join(tmpdir(), "cultmesh-ts-node-reactive-")), "node.ccmp");
+  const node = await CultMesh.startNode(filePath, {
+    documents: [noteDocument],
+  });
+  await node.put(noteDocument, "note:node-reactive", {
+    noteId: "note:node-reactive",
+    body: "initial",
+  });
+
+  const aliasHandle = node.document(noteAliasDocument, "note:node-reactive", {
+    pollMs: 5,
+  });
+  assert.equal(aliasHandle.documentId, "cultmesh.note.ui:note:node-reactive");
+  assert.equal((await aliasHandle.latest()).body, "initial");
+  await aliasHandle.authoritativeWriter().write({
+    noteId: "note:node-reactive",
+    body: "edited-through-alias-handle",
+  });
+  assert.equal(
+    node.getRequired(noteAliasDocument, "note:node-reactive").body,
+    "edited-through-alias-handle",
+  );
+
+  await node.put(noteAliasDocument, "note:node-reactive", {
+    noteId: "note:node-reactive",
+    body: "edited-through-alias-put",
+  });
+  assert.equal(
+    node.getRequired(noteDocument, "note:node-reactive").body,
+    "edited-through-alias-put",
+  );
+  assert.deepEqual(
+    (await node.collection(noteAliasDocument).latest()).map(note => note.body),
+    ["edited-through-alias-put"],
+  );
+
+  const reactive = aliasHandle.authoritativeWriter(
+    CultMesh.queryContext("browser-client"),
+  ).reactive({
+    watch: false,
+  });
+  await reactive.ready;
+  reactive.update(value => {
+    value.body = "edited-through-node-helper";
+  });
+  await waitFor(
+    () => node.getRequired(noteDocument, "note:node-reactive").body === "edited-through-node-helper",
+    "node-level reactive alias write",
+  );
+
+  assert.equal(reactive.snapshot.noteId, "note:node-reactive");
+  assert.equal(
+    node.document(noteDocument, "note:node-reactive").asSchemaAlias(noteAliasDocument, {
+      parse: value => noteAliasDocument.schema.parse(value),
+    }).canReplace,
+    true,
+  );
+  assert.equal(
+    (await node.document(noteAliasDocument, "note:node-reactive").observe({
+      watch: false,
+    }).ready).body,
+    "edited-through-node-helper",
+  );
+  reactive.dispose();
+});
+
+test("CultMesh TS reactive documents store reconciliation deltas after misprediction", async () => {
+  let current = {
+    noteId: "note:reconcile",
+    body: "initial",
+    revision: 1,
+  };
+  let watcher: ((value: typeof current) => void) | undefined;
+  const predictions: typeof current[] = [];
+  const document = CultMesh.document(
+    "cultmesh.note:reconcile",
+    { schemaId: "cultmesh.note.reconcile.v0" },
+    async () => current,
+    {
+      routeHint: CultMesh.routeHint("network", "CultNet prediction"),
+      submitPrediction: async (_context, value) => {
+        predictions.push(value);
+        current = value;
+      },
+      watchDocument: (_context, callback) => {
+        watcher = callback;
+        return () => {
+          watcher = undefined;
+        };
+      },
+    },
+  );
+
+  const reactive = document.predictionWriter().reactive();
+  await reactive.ready;
+  reactive.update(value => {
+    value.body = "predicted";
+    value.revision = 7;
+  });
+  await waitFor(() => predictions.length === 1, "reactive reconciliation prediction");
+
+  watcher?.({
+    noteId: "note:reconcile",
+    body: "authoritative",
+    revision: 5,
+  });
+
+  assert.equal(reactive.snapshot.body, "authoritative");
+  assert.equal(reactive.snapshot.revision, 5);
+  assert.equal(reactive.reconciliation?.version, 1);
+  assert.deepEqual(reactive.reconciliation?.canonical, {
+    noteId: "note:reconcile",
+    body: "authoritative",
+    revision: 5,
+  });
+  assert.deepEqual(reactive.reconciliation?.predicted, {
+    noteId: "note:reconcile",
+    body: "predicted",
+    revision: 7,
+  });
+  assert.deepEqual(reactive.reconciliation?.delta, {
+    body: "predicted",
+    revision: 2,
+  });
+
+  reactive.clearReconciliation();
+  assert.equal(reactive.reconciliation, undefined);
+  reactive.dispose();
+});
+
+test("CultMesh TS reactive documents coalesce same-frame explicit updates", async () => {
+  let current = {
+    noteId: "note:reactive-frame",
+    body: "initial",
+  };
+  const predictions: string[] = [];
+  const previousRequestAnimationFrame = globalThis.requestAnimationFrame;
+  const frameCallbacks: FrameRequestCallback[] = [];
+  globalThis.requestAnimationFrame = callback => {
+    frameCallbacks.push(callback);
+    return frameCallbacks.length;
+  };
+  const document = CultMesh.document(
+    "cultmesh.note:reactive-frame",
+    noteDocument,
+    async () => current,
+    {
+      submitPrediction: async (_context, value) => {
+        predictions.push(value.body);
+        current = value;
+      },
+    },
+  );
+
+  const reactive = document.predictionWriter().reactive({
+    watch: false,
+  });
+  try {
+    await reactive.ready;
+    reactive.update(value => { value.body = "frame-1"; });
+    reactive.update(value => { value.body = "frame-2"; });
+    reactive.update(value => { value.body = "frame-3"; });
+
+    assert.equal(frameCallbacks.length, 1);
+    frameCallbacks[0](performance.now());
+    await waitFor(() => predictions.length === 1, "same-frame prediction");
+
+    assert.deepEqual(predictions, ["frame-3"]);
+    assert.equal(current.body, "frame-3");
+  } finally {
+    reactive.dispose();
+    if (previousRequestAnimationFrame) {
+      globalThis.requestAnimationFrame = previousRequestAnimationFrame;
+    } else {
+      delete (globalThis as unknown as {
+        requestAnimationFrame?: (callback: FrameRequestCallback) => number;
+      }).requestAnimationFrame;
+    }
+  }
+});
+
+test("CultMesh TS headless reactive documents coalesce on one microtask", async () => {
+  const previousRequestAnimationFrame = globalThis.requestAnimationFrame;
+  delete (globalThis as unknown as {
+    requestAnimationFrame?: (callback: FrameRequestCallback) => number;
+  }).requestAnimationFrame;
+  let current = { noteId: "note:reactive-headless", body: "initial" };
+  const predictions: string[] = [];
+  const document = CultMesh.document(
+    "cultmesh.note:reactive-headless",
+    noteDocument,
+    async () => current,
+    {
+      submitPrediction: async (_context, value) => {
+        predictions.push(value.body);
+        current = value;
+      },
+    },
+  );
+  const reactive = document.predictionWriter().reactive({ watch: false });
+  try {
+    await reactive.ready;
+    reactive.update(value => { value.body = "microtask-1"; });
+    reactive.update(value => { value.body = "microtask-2"; });
+    reactive.update(value => { value.body = "microtask-3"; });
+    assert.equal(predictions.length, 0, "the current turn remains coalesced");
+
+    await waitFor(() => predictions.length === 1, "headless microtask prediction");
+    assert.deepEqual(predictions, ["microtask-3"]);
+  } finally {
+    reactive.dispose();
+    if (previousRequestAnimationFrame) {
+      globalThis.requestAnimationFrame = previousRequestAnimationFrame;
+    }
+  }
+});
+
+test("CultMesh TS reactive scheduling scales with changed documents only", async () => {
+  const previousRequestAnimationFrame = globalThis.requestAnimationFrame;
+  const previousCancelAnimationFrame = globalThis.cancelAnimationFrame;
+  const frameCallbacks = new Map<number, FrameRequestCallback>();
+  let nextFrame = 1;
+  globalThis.requestAnimationFrame = callback => {
+    const frame = nextFrame++;
+    frameCallbacks.set(frame, callback);
+    return frame;
+  };
+  globalThis.cancelAnimationFrame = frame => {
+    frameCallbacks.delete(frame);
+  };
+
+  try {
+    for (const documentCount of [1, 100, 1000]) {
+      const reactiveDocuments = [];
+      for (let index = 0; index < documentCount; index++) {
+        let current = {
+          noteId: `note:scale:${index}`,
+          body: "initial",
+        };
+        const document = CultMesh.document(
+          `cultmesh.note:scale:${index}`,
+          noteDocument,
+          async () => current,
+          {
+            submitPrediction: async (_context, value) => {
+              current = value;
+            },
+          },
+        );
+        reactiveDocuments.push(document.predictionWriter().reactive({ watch: false }));
+      }
+
+      await Promise.all(reactiveDocuments.map(document => document.ready));
+      assert.equal(frameCallbacks.size, 0, `${documentCount} idle documents scheduled no work`);
+
+      const changedDocumentCount = Math.max(1, Math.floor(documentCount / 100));
+      for (let index = 0; index < changedDocumentCount; index++) {
+        reactiveDocuments[index].update(value => {
+          value.body = `changed-${index}`;
+        });
+      }
+
+      assert.equal(
+        frameCallbacks.size,
+        changedDocumentCount,
+        `${documentCount} documents scheduled only the ${changedDocumentCount} changed documents`,
+      );
+      assert.equal(
+        reactiveDocuments.filter(document => document.dirty).length,
+        changedDocumentCount,
+      );
+
+      for (const reactive of reactiveDocuments) reactive.dispose();
+      assert.equal(frameCallbacks.size, 0, "dispose cancels every scheduled frame flush");
+    }
+  } finally {
+    if (previousRequestAnimationFrame) {
+      globalThis.requestAnimationFrame = previousRequestAnimationFrame;
+    } else {
+      delete (globalThis as unknown as {
+        requestAnimationFrame?: (callback: FrameRequestCallback) => number;
+      }).requestAnimationFrame;
+    }
+    if (previousCancelAnimationFrame) {
+      globalThis.cancelAnimationFrame = previousCancelAnimationFrame;
+    } else {
+      delete (globalThis as unknown as {
+        cancelAnimationFrame?: (handle: number) => void;
+      }).cancelAnimationFrame;
+    }
+  }
+});
+
+test("CultMesh TS reactive documents queue edits made while a prediction is in flight", async () => {
+  let current = {
+    noteId: "note:reactive-in-flight",
+    body: "initial",
+  };
+  let releaseFirstPrediction!: () => void;
+  let resolveFirstPredictionStarted!: () => void;
+  const firstPredictionStarted = new Promise<void>(resolve => {
+    resolveFirstPredictionStarted = resolve;
+  });
+  const predictions: typeof current[] = [];
+  const document = CultMesh.document(
+    "cultmesh.note:reactive-in-flight",
+    noteDocument,
+    async () => current,
+    {
+      submitPrediction: async (_context, value) => {
+        predictions.push(value);
+        if (predictions.length === 1) {
+          resolveFirstPredictionStarted();
+          await new Promise<void>(release => {
+            releaseFirstPrediction = release;
+          });
+        }
+        current = value;
+      },
+    },
+  );
+
+  const reactive = document.predictionWriter().reactive({
+    watch: false,
+    debounceMs: 0,
+  });
+  await reactive.ready;
+  reactive.update(value => { value.body = "first"; });
+  await firstPredictionStarted;
+  reactive.update(value => { value.body = "second"; });
+  releaseFirstPrediction();
+  await waitFor(() => predictions.length === 2, "in-flight queued prediction");
+
+  assert.deepEqual(predictions.map(value => value.body), ["first", "second"]);
+  assert.equal(current.body, "second");
+  reactive.dispose();
+});
+
+test("CultMesh TS observed documents never publish borrowed snapshot mutation and keep watching", async () => {
+  let current = {
+    noteId: "note:reactive-readonly",
+    body: "initial",
+  };
+  let watcher: ((value: typeof current) => void) | undefined;
+  const writes: typeof current[] = [];
+  const document = CultMesh.document(
+    "cultmesh.note:reactive-readonly",
+    noteDocument,
+    async () => current,
+    {
+      watchDocument: (_context, callback) => {
+        watcher = callback;
+        return () => {
+          watcher = undefined;
+        };
+      },
+      submitPrediction: async (_context, value) => {
+        writes.push(value);
+      },
+    },
+  );
+
+  const observed = document.observe<typeof current>();
+  await observed.ready;
+  observed.current.body = "borrowed-local-edit";
+  await new Promise(resolve => setTimeout(resolve, 20));
+  assert.deepEqual(writes, []);
+
+  current = {
+    noteId: "note:reactive-readonly",
+    body: "canonical-after-error",
+  };
+  watcher?.(current);
+
+  assert.equal(observed.current.body, "canonical-after-error");
+  observed.dispose();
+});
+
+test("CultMesh TS document handles read schema publications from single-file stores", async () => {
+  const filePath = join(await mkdtemp(join(tmpdir(), "cultmesh-ts-publication-")), "publication.ccmp");
+  const node = await CultMesh.startNode(filePath, {
+    documents: [noteDocument],
+  });
+  await node.put(noteDocument, "note:publication", {
+    noteId: "note:publication",
+    body: "published",
+  });
+  await node.flush();
+
+  const document = CultMesh.documentFromPublication({
+    kind: "single-file",
+    path: filePath,
+  }, noteDocument, "note:publication", {
+    documentId: "daemon:cultmesh.note.latest",
+    sourceId: "daemon:cultmesh.note.latest.v0",
+    pollMs: 50,
+  });
+  const observed: string[] = [];
+  const unsubscribe = document.watch(value => {
+    observed.push(value.body);
+  });
+
+  try {
+    assert.equal((await document.latest()).body, "published");
+    assert.equal(document.schema.type, "cultmesh.note");
+
+    const republisher = await CultMesh.startNode(filePath, {
+      documents: [noteDocument],
+    });
+    await republisher.put(noteDocument, "note:publication", {
+      noteId: "note:publication",
+      body: "republished",
+    });
+    await waitFor(() => observed.includes("republished"), "single-file document watch update");
+  } finally {
+    unsubscribe();
+  }
+
+  assert.equal(document.documentId, "daemon:cultmesh.note.latest");
+  assert.equal(document.routeHint.kind, "shared-memory");
+  assert.deepEqual(document.sources.map(source => source.schemaId), [
+    "cultmesh.note.v0",
+  ]);
+});
+
+test("CultMesh TS projects live provider publications as typed document handles", async () => {
+  let current: unknown = {
+    noteId: "note:live-provider",
+    body: "initial publication",
+  };
+  let watcher: ((value: unknown) => void) | undefined;
+  const calls: string[] = [];
+
+  const document = CultMesh.documentFromPublication(
+    {
+      kind: "live-publication",
+      endpoint: "provider-session:aetheria",
+      source: {
+        latest: async (schemaId, recordKey) => {
+          calls.push(`latest:${schemaId}:${recordKey}`);
+          return current;
+        },
+        watch: (schemaId, recordKey, callback) => {
+          calls.push(`watch:${schemaId}:${recordKey}`);
+          watcher = callback;
+          return () => {
+            calls.push("unsubscribed");
+            watcher = undefined;
+          };
+        },
+      },
+    },
+    noteDocument,
+    "note:live-provider",
+    { documentId: "aetheria.note.live" },
+  );
+
+  assert.deepEqual(await document.latest(), current);
+  assert.equal(document.routeHint.kind, "network");
+  assert.equal(document.routeHint.description, "provider-session:aetheria");
+
+  const observed: string[] = [];
+  const unsubscribe = document.watch(value => observed.push(value.body));
+  current = {
+    noteId: "note:live-provider",
+    body: "ordered live upsert",
+  };
+  watcher?.(current);
+  unsubscribe();
+
+  assert.deepEqual(observed, ["ordered live upsert"]);
+  assert.deepEqual(calls, [
+    "latest:cultmesh.note.v0:note:live-provider",
+    "watch:cultmesh.note.v0:note:live-provider",
+    "unsubscribed",
+  ]);
+  assert.equal(watcher, undefined);
+});
+
+test("CultMesh TS validates live provider publications through typed document schemas", async () => {
+  const document = CultMesh.documentFromPublication(
+    {
+      kind: "live-publication",
+      source: {
+        latest: async () => ({ noteId: 42, body: "invalid" }),
+        watch: () => () => undefined,
+      },
+    },
+    noteDocument,
+    "note:invalid-live-provider",
+  );
+
+  await assert.rejects(document.latest(), /noteId/);
+});
+
+test("CultMesh TS binds publication document catalogs from source resolvers", async () => {
+  const root = await mkdtemp(join(tmpdir(), "cultmesh-ts-publication-catalog-"));
+  const firstPath = join(root, "first.ccmp");
+  const secondPath = join(root, "second.ccmp");
+  const first = await CultMesh.startNode(firstPath, {
+    documents: [noteDocument],
+  });
+  const second = await CultMesh.startNode(secondPath, {
+    documents: [noteDocument],
+  });
+  await first.put(noteDocument, "note:first", {
+    noteId: "note:first",
+    body: "first source",
+  });
+  await second.put(noteDocument, "note:second", {
+    noteId: "note:second",
+    body: "second source",
+  });
+  await first.flush();
+  await second.flush();
+
+  const bindings = [
+    CultMesh.publicationDocument(noteDocument, "note:first", {
+      documentId: "daemon:first",
+      sourceId: "daemon:first.latest",
+    }),
+    CultMesh.publicationDocument(noteDocument, "note:second", {
+      documentId: "daemon:second",
+      sourceId: "daemon:second.latest",
+    }),
+  ];
+  const paths = new Map([
+    ["note:first", firstPath],
+    ["note:second", secondPath],
+  ]);
+  const catalog = CultMesh.documentsFromPublication(
+    binding => ({
+      kind: "single-file",
+      path: paths.get(binding.recordKey) ?? firstPath,
+    }),
+    bindings,
+    {
+      routeHint: CultMesh.routeHint("shared-memory", "publication catalog"),
+      pollMs: 50,
+    },
+  );
+
+  assert.deepEqual(
+    catalog.documents.map(document => document.documentId),
+    ["daemon:first", "daemon:second"],
+  );
+  assert.equal(
+    (await catalog.document(noteAliasDocument, {
+      parse: value => noteAliasDocument.schema.parse(value),
+    }).latest()).body,
+    "second source",
+  );
+  assert.equal(catalog.document(noteDocument).routeHint.description, "publication catalog");
+});
+
+test("CultMesh TS syncs configured publications into local node aliases", async () => {
+  const sourcePath = join(await mkdtemp(join(tmpdir(), "cultmesh-ts-publication-sync-source-")), "source.ccmp");
+  const targetPath = join(await mkdtemp(join(tmpdir(), "cultmesh-ts-publication-sync-target-")), "target.ccmp");
+  const source = await CultMesh.startNode(sourcePath, {
+    documents: [noteDocument],
+  });
+  await source.put(noteDocument, "note:published", {
+    noteId: "note:published",
+    body: "publication source hydrates local alias",
+  });
+  await source.flush();
+  const target = await CultMesh.startNode(targetPath, {
+    documents: [noteDocument],
+  });
+
+  const synced = await target.syncDocumentFromPublication(
+    {
+      kind: "single-file",
+      path: sourcePath,
+    },
+    noteAliasDocument,
+    "note:published",
+  );
+  const facadeSynced = await CultMesh.syncDocumentFromPublication(
+    target,
+    {
+      kind: "single-file",
+      path: sourcePath,
+    },
+    noteAliasDocument,
+    "note:published",
+  );
+
+  assert.deepEqual(synced, {
+    noteId: "note:published",
+    body: "publication source hydrates local alias",
+  });
+  assert.deepEqual(facadeSynced, synced);
+  assert.equal(target.getRequired(noteDocument, "note:published").body, "publication source hydrates local alias");
+  assert.equal(target.getRequired(noteAliasDocument, "note:published").body, "publication source hydrates local alias");
+  assert.equal((await target.document(noteAliasDocument, "note:published").observe({ watch: false }).ready).body, "publication source hydrates local alias");
+});
+
+test("CultMesh TS syncs configured publication catalogs into local node aliases", async () => {
+  const firstPath = join(await mkdtemp(join(tmpdir(), "cultmesh-ts-publication-sync-catalog-first-")), "first.ccmp");
+  const secondPath = join(await mkdtemp(join(tmpdir(), "cultmesh-ts-publication-sync-catalog-second-")), "second.ccmp");
+  const targetPath = join(await mkdtemp(join(tmpdir(), "cultmesh-ts-publication-sync-catalog-target-")), "target.ccmp");
+  const first = await CultMesh.startNode(firstPath, {
+    documents: [noteDocument],
+  });
+  const second = await CultMesh.startNode(secondPath, {
+    documents: [noteDocument],
+  });
+  await first.put(noteDocument, "note:first-sync", {
+    noteId: "note:first-sync",
+    body: "first synced publication",
+  });
+  await second.put(noteDocument, "note:second-sync", {
+    noteId: "note:second-sync",
+    body: "second synced publication",
+  });
+  await first.flush();
+  await second.flush();
+  const target = await CultMesh.startNode(targetPath, {
+    documents: [noteDocument],
+  });
+  const bindings = [
+    CultMesh.publicationDocument(noteDocument, "note:first-sync", {
+      documentId: "local:first",
+    }),
+    CultMesh.publicationDocument(noteAliasDocument, "note:second-sync", {
+      documentId: "local:second",
+      source: {
+        kind: "single-file",
+        path: secondPath,
+      },
+    }),
+  ];
+
+  const catalog = await target.syncDocumentsFromPublication(
+    {
+      kind: "single-file",
+      path: firstPath,
+    },
+    bindings,
+    {
+      routeHint: CultMesh.routeHint("shared-memory", "publication sync catalog"),
+      pollMs: 5,
+    },
+  );
+  const facadeCatalog = await CultMesh.syncDocumentsFromPublication(
+    target,
+    {
+      kind: "single-file",
+      path: firstPath,
+    },
+    bindings,
+  );
+
+  assert.deepEqual(
+    catalog.documents.map(document => document.documentId),
+    ["local:first", "local:second"],
+  );
+  assert.equal(
+    await catalog.document(noteDocument, {
+      parse: value => noteDocument.schema.parse(value),
+    }).latest().then(value => value.body),
+    "first synced publication",
+  );
+  assert.equal(
+    await catalog.document(noteAliasDocument, {
+      parse: value => noteAliasDocument.schema.parse(value),
+    }).latest().then(value => value.body),
+    "second synced publication",
+  );
+  assert.equal(catalog.document(noteAliasDocument).routeHint.description, "publication sync catalog");
+  assert.equal(target.getRequired(noteDocument, "note:second-sync").body, "second synced publication");
+  assert.equal(target.getRequired(noteAliasDocument, "note:second-sync").body, "second synced publication");
+  assert.equal(
+    await facadeCatalog.document(noteAliasDocument, {
+      parse: value => noteAliasDocument.schema.parse(value),
+    }).latest().then(value => value.body),
+    "second synced publication",
+  );
+});
+
+test("CultMesh TS document catalogs resolve semantic schema versions passed as schema ids", async () => {
+  const current = {
+    noteId: "note:semantic",
+    body: "semantic alias",
+  };
+  const document = CultMesh.document(
+    "daemon:semantic-note",
+    {
+      schemaId: "sha256:runtime-generated-note",
+      schemaName: "cultmesh.note",
+      schemaVersion: "cultmesh.note.v1",
+    },
+    async () => current,
+    {
+      routeHint: CultMesh.routeHint("shared-memory", "semantic alias catalog"),
+    },
+  );
+  const catalog = CultMesh.documents(document);
+
+  const alias = catalog.document({
+    schemaId: "cultmesh.note.v1",
+  });
+
+  assert.equal(alias.documentId, "daemon:semantic-note");
+  assert.equal(alias.routeHint.description, "semantic alias catalog");
+  assert.deepEqual(await alias.latest(), current);
+});
+
+test("CultMesh TS collection handles expose typed snapshots and reset watches", async () => {
+  const filePath = join(await mkdtemp(join(tmpdir(), "cultmesh-ts-coll-")), "node.ccmp");
+  const node = await CultMesh.startNode(filePath, {
+    documents: [noteDocument],
+  });
+  await node.put(noteDocument, "note:a", {
+    noteId: "note:a",
+    body: "alpha",
+  });
+
+  const collection = node.collection(noteDocument, { pollMs: 5 });
+  const bound = CultMesh.bindCollection(
+    CultMesh.verse("local", "rts-client").withRoute("shared-memory", "local cache"),
+    collection,
+  );
+  const changes: string[] = [];
+  const unsubscribe = bound.watchChanges(change => changes.push(change.kind));
+
+  assert.deepEqual((await bound.latest()).map(note => note.body), ["alpha"]);
+
+  await node.put(noteDocument, "note:b", {
+    noteId: "note:b",
+    body: "bravo",
+  });
+  await waitFor(() => changes.length >= 2, "collection reset after update");
+  unsubscribe();
+
+  assert.deepEqual(
+    (await collection.asSchemaAlias(noteAliasDocument, {
+      parse: value => noteAliasDocument.schema.parse(value),
+    }).latest()).map(note => note.body).sort(),
+    ["alpha", "bravo"],
+  );
+  const catalog = CultMesh.collections(collection);
+  assert.deepEqual(
+    (await catalog.latest(noteAliasDocument, "local", {
+      parse: value => noteAliasDocument.schema.parse(value),
+    })).map(note => note.body).sort(),
+    ["alpha", "bravo"],
+  );
+  assert.equal(
+    catalog.collection({ schemaId: "cultmesh.note.v0" }).collectionId,
+    collection.collectionId,
+  );
+  assert.equal(catalog.tryCollection({ schemaId: "cultmesh.missing.v1" }), undefined);
+  assert.ok(changes.every(kind => kind === "reset"));
+});
+
+test("CultMesh TS collection catalogs resolve same-schema alias watches", async () => {
+  const current = [{
+    noteId: "note:catalog-watch",
+    body: "initial",
+  }];
+  let watcher: ((change: { kind: "updated"; value: typeof current[number] }) => void) | undefined;
+  const collection = CultMesh.collection(
+    "daemon:catalog-watch",
+    {
+      schemaId: "sha256:runtime-generated-note",
+      schemaName: "cultmesh.note",
+      schemaVersion: "cultmesh.note.v1",
+    },
+    async () => current,
+    {
+      routeHint: CultMesh.routeHint("shared-memory", "collection catalog"),
+      watchCollection: (_context, callback) => {
+        watcher = callback as typeof watcher;
+        return () => {
+          watcher = undefined;
+        };
+      },
+    },
+  );
+  const catalog = CultMesh.collections(collection);
+  const observed: string[] = [];
+  const semanticAlias = { schemaId: "cultmesh.note.v1" };
+  const unsubscribe = catalog.watchChanges<z.infer<typeof noteAliasDocument.schema>>(semanticAlias, change => {
+    if (change.value) {
+      observed.push(change.value.body);
+    }
+  }, {
+    parse: value => noteAliasDocument.schema.parse(value),
+  });
+
+  watcher?.({
+    kind: "updated",
+    value: {
+      noteId: "note:catalog-watch",
+      body: "through-catalog-alias",
+    },
+  });
+  unsubscribe();
+
+  assert.deepEqual(observed, ["through-catalog-alias"]);
+  assert.equal(watcher, undefined);
+  assert.equal(catalog.collection(semanticAlias).routeHint.description, "collection catalog");
+});
+
 test("CultMesh TS local authority leases do not trust peer cards by contact alone", () => {
   const peers = CultMesh.createPeerCatalog();
   const leases = CultMesh.createAuthorityLeaseCatalog();
@@ -145,6 +1284,1192 @@ test("CultMesh TS local Verse catalog exposes sorted views and watch ergonomics"
   );
 });
 
+test("CultMesh TS exposes shared geometry query primitives", () => {
+  const viewport = CultMesh.rect(CultMesh.vec2(10, -5), CultMesh.vec2(-2, 7));
+  assert.deepEqual(viewport, {
+    min: { x: -2, y: -5 },
+    max: { x: 10, y: 7 },
+  });
+
+  assert.deepEqual(CultMesh.viewportRequest(viewport, [3, 1]), {
+    minX: -2,
+    minY: -5,
+    maxX: 10,
+    maxY: 7,
+    controlledEntityIndices: [3, 1],
+  });
+
+  assert.deepEqual(CultMesh.rectFromBounds(4, 3, 2, 1), {
+    min: { x: 2, y: 1 },
+    max: { x: 4, y: 3 },
+  });
+});
+
+test("CultMesh TS exposes typed operation primitives", async () => {
+  const operation = CultMesh.operation<
+    { actor: string; direction: { x: number; y: number } },
+    { receipt: ReturnType<typeof CultMesh.operationReceipt>; actor: string }
+  >("game.test.move", async (request, context) => {
+    assert.equal(context.runtimeId, "rts-client");
+    assert.deepEqual(context.claims, [
+      { role: "simulation-authority", shardId: "zone:0", leaseId: "lease:zone:0" },
+    ]);
+    assert.deepEqual(context.routeHint, {
+      kind: "network",
+      description: "remote Verse node",
+    });
+    assert.equal(context.idempotencyKey, "move-1");
+    return {
+      receipt: CultMesh.operationReceipt("game.test.move", true, {
+        route: context.routeHint,
+      }),
+      actor: request.actor,
+    };
+  });
+
+  const response = await operation.invoke(
+    { actor: "pawn:1", direction: CultMesh.vec2(1, 0) },
+    CultMesh.operationContext("rts-client", {
+      claims: [
+        CultMesh.authorityClaim("simulation-authority", {
+          shardId: "zone:0",
+          leaseId: "lease:zone:0",
+        }),
+      ],
+      routeHint: CultMesh.routeHint("network", "remote Verse node"),
+      idempotencyKey: "move-1",
+    }),
+  );
+
+  assert.equal(operation.operationId, "game.test.move");
+  assert.equal(response.actor, "pawn:1");
+  assert.deepEqual(CultMesh.describeOperationHandle(operation), {
+    operationId: "game.test.move",
+  });
+  assert.deepEqual(response.receipt, {
+    operationId: "game.test.move",
+    accepted: true,
+    route: {
+      kind: "network",
+      description: "remote Verse node",
+    },
+    diagnostic: undefined,
+  });
+});
+
+test("CultMesh TS flattens and parses cross-runtime route records", () => {
+  const record = CultMesh.routeRecord(
+    CultMesh.routeHint("shared-memory", "co-located slab"),
+  );
+  const restored = CultMesh.routeFromRecord(record);
+  const fromCsharp = CultMesh.routeFromRecord(
+    {
+      kind: "InProcess",
+      description: "",
+    },
+    CultMesh.routeHint("network", "fallback route"),
+  );
+  const fallback = CultMesh.routeFromRecord(
+    {
+      kind: "not-real",
+      description: "",
+    },
+    CultMesh.routeHint("ipc", "fallback route"),
+  );
+
+  assert.deepEqual(record, {
+    kind: "shared-memory",
+    description: "co-located slab",
+  });
+  assert.deepEqual(restored, {
+    kind: "shared-memory",
+    description: "co-located slab",
+  });
+  assert.deepEqual(fromCsharp, {
+    kind: "in-process",
+    description: "fallback route",
+  });
+  assert.deepEqual(fallback, {
+    kind: "ipc",
+    description: "fallback route",
+  });
+});
+
+test("CultMesh TS exposes typed query primitives", async () => {
+  const watchedCounts: number[] = [];
+  const visibleObjects = CultMesh.query<
+    { viewport: ReturnType<typeof CultMesh.viewportRequest> },
+    { queryId: string; count: number }
+  >("game.test.visible_objects", async (parameters, context) => {
+    assert.equal(context.runtimeId, "browser-client");
+    assert.deepEqual(context.routeHint, {
+      kind: "shared-memory",
+      description: "co-located daemon slab",
+    });
+    assert.equal(parameters.viewport.minX, -10);
+    return {
+      queryId: "game.test.visible_objects",
+      count: 2,
+    };
+  }, {
+    watchQuery: (parameters, context, callback) => {
+      assert.equal(context.runtimeId, "browser-client");
+      assert.equal(parameters.viewport.maxX, 10);
+      callback({ queryId: "game.test.visible_objects", count: 3 });
+      return () => watchedCounts.push(-1);
+    },
+  });
+
+  const result = await visibleObjects.execute(
+    { viewport: CultMesh.viewportRequest(CultMesh.rectFromBounds(-10, -5, 10, 5)) },
+    CultMesh.queryContext("browser-client", {
+      routeHint: CultMesh.routeHint("shared-memory", "co-located daemon slab"),
+    }),
+  );
+
+  assert.deepEqual(result, {
+    queryId: "game.test.visible_objects",
+    count: 2,
+  });
+
+  const diagnostic = CultMesh.describeQuerySurface(visibleObjects);
+  assert.equal(diagnostic.queryId, "game.test.visible_objects");
+  assert.equal(diagnostic.routeHint.kind, "automatic");
+  assert.deepEqual(diagnostic.sources, []);
+  assert.notEqual(diagnostic.sources, visibleObjects.sources);
+
+  const unsubscribe = visibleObjects.watch(
+    { viewport: CultMesh.viewportRequest(CultMesh.rectFromBounds(-10, -5, 10, 5)) },
+    "browser-client",
+    (value) => watchedCounts.push(value.count),
+  );
+  unsubscribe();
+
+  assert.deepEqual(watchedCounts, [3, -1]);
+});
+
+test("CultMesh TS polling watcher turns snapshots into a query watch", async () => {
+  let value = 0;
+  const observed: number[] = [];
+  const query = CultMesh.query<void, number>(
+    "game.test.counter",
+    async () => value,
+    {
+      watchQuery: CultMesh.pollingQueryWatcher(async () => value, {
+        intervalMs: 5,
+        equals: (left, right) => left === right,
+      }),
+    },
+  );
+
+  const unsubscribe = query.watch(undefined, "browser-client", next => observed.push(next));
+  await delay(15);
+  value = 1;
+  await delay(20);
+  value = 1;
+  await delay(12);
+  value = 2;
+  await delay(20);
+  unsubscribe();
+  value = 3;
+  await delay(12);
+
+  assert.deepEqual(observed, [0, 1, 2]);
+});
+
+test("CultMesh TS polling watcher can suppress the initial baseline", async () => {
+  let value = "baseline";
+  const observed: string[] = [];
+  const watch = CultMesh.pollingQueryWatcher<void, string>(async () => value, {
+    intervalMs: 5,
+    emitInitial: false,
+  });
+
+  const unsubscribe = watch(undefined, CultMesh.queryContext("browser-client"), next => observed.push(next));
+  await delay(15);
+  value = "changed";
+  await delay(15);
+  unsubscribe();
+
+  assert.deepEqual(observed, ["changed"]);
+});
+
+test("CultMesh TS exposes live feed primitives for reactive client views", async () => {
+  let frameId = 10;
+  const observed: number[] = [];
+  const feed = CultMesh.liveFeed<
+    { viewport: ReturnType<typeof CultMesh.viewportRequest> },
+    { frameId: number; route: string }
+  >(
+    "aetheria.rts.viewport.feed",
+    async (_parameters, context) => ({
+      frameId,
+      route: context.routeHint.kind,
+    }),
+    {
+      sources: [
+        CultMesh.projectionSource("daemon:aetheria.frame.latest.v1"),
+        CultMesh.projectionSource("daemon:aetheria.health.latest.v1"),
+      ],
+      routeHint: CultMesh.routeHint("shared-memory", "co-located RTS cache"),
+      watchFeed: CultMesh.pollingQueryWatcher(async (_parameters, context) => ({
+        frameId,
+        route: context.routeHint.kind,
+      }), {
+        intervalMs: 5,
+        equals: (left, right) => left.frameId === right.frameId && left.route === right.route,
+      }),
+    },
+  );
+
+  assert.equal(feed.feedId, "aetheria.rts.viewport.feed");
+  assert.equal(feed.routeHint.kind, "shared-memory");
+  assert.deepEqual(feed.sources.map(source => source.sourceId), [
+    "daemon:aetheria.frame.latest.v1",
+    "daemon:aetheria.health.latest.v1",
+  ]);
+
+  const diagnostic = CultMesh.describeLiveFeed(feed);
+  assert.equal(diagnostic.feedId, "aetheria.rts.viewport.feed");
+  assert.equal(diagnostic.routeHint.description, "co-located RTS cache");
+  assert.deepEqual(diagnostic.sources.map(source => source.sourceId), [
+    "daemon:aetheria.frame.latest.v1",
+    "daemon:aetheria.health.latest.v1",
+  ]);
+  assert.notEqual(diagnostic.sources, feed.sources);
+
+  const snapshot = await feed.snapshot(
+    { viewport: CultMesh.viewportRequest(CultMesh.rectFromBounds(-1, -1, 1, 1)) },
+    "browser-client",
+  );
+
+  assert.deepEqual(snapshot, {
+    frameId: 10,
+    route: "shared-memory",
+  });
+
+  const unsubscribe = feed.watch(
+    { viewport: CultMesh.viewportRequest(CultMesh.rectFromBounds(-1, -1, 1, 1)) },
+    "browser-client",
+    value => observed.push(value.frameId),
+  );
+  await delay(15);
+  frameId = 11;
+  await delay(15);
+  unsubscribe();
+
+  assert.deepEqual(observed, [10, 11]);
+});
+
+test("CultMesh TS exposes projection recipes as shared query affordances", async () => {
+  const watchedRoutes: string[] = [];
+  const recipe = CultMesh.projectionRecipe<
+    { viewport: ReturnType<typeof CultMesh.viewportRequest> },
+    { projectionId: string; sourceCount: number; route: string }
+  >(
+    "aetheria.zone.objects.visible",
+    [
+      CultMesh.projectionSource("daemon:aetheria.frame.latest.v1", {
+        schemaId: "gamecult.aetheria.daemon_frame.v1",
+        description: "latest daemon frame",
+      }),
+      CultMesh.projectionSource("daemon:aetheria.authority.policy.v1", {
+        schemaId: "gamecult.aetheria.authority_policy.v1",
+      }),
+    ],
+    async (_parameters, context) => ({
+      projectionId: "aetheria.zone.objects.visible",
+      sourceCount: 2,
+      route: context.routeHint.kind,
+    }),
+    {
+      routeHint: CultMesh.routeHint("shared-memory", "co-located frame slab"),
+      watchProjection: (_parameters, context, callback) => {
+        callback({
+          projectionId: "aetheria.zone.objects.visible",
+          sourceCount: 2,
+          route: context.routeHint.kind,
+        });
+        return () => watchedRoutes.push("unsubscribed");
+      },
+    },
+  );
+
+  assert.equal(recipe.projectionId, "aetheria.zone.objects.visible");
+  assert.equal(recipe.routeHint.kind, "shared-memory");
+  assert.deepEqual(recipe.sources.map((source) => source.sourceId), [
+    "daemon:aetheria.frame.latest.v1",
+    "daemon:aetheria.authority.policy.v1",
+  ]);
+
+  const recipeDiagnostic = CultMesh.describeProjectionRecipe(recipe);
+  assert.equal(recipeDiagnostic.projectionId, "aetheria.zone.objects.visible");
+  assert.equal(recipeDiagnostic.routeHint.description, "co-located frame slab");
+  assert.deepEqual(recipeDiagnostic.sources.map((source) => source.schemaId), [
+    "gamecult.aetheria.daemon_frame.v1",
+    "gamecult.aetheria.authority_policy.v1",
+  ]);
+  assert.notEqual(recipeDiagnostic.sources, recipe.sources);
+
+  const projected = await recipe.project(
+    { viewport: CultMesh.viewportRequest(CultMesh.rectFromBounds(-10, -5, 10, 5)) },
+    CultMesh.queryContextFor("browser-starfire")
+      .route("wasm", "browser-local projection")
+      .build(),
+  );
+
+  assert.deepEqual(projected, {
+    projectionId: "aetheria.zone.objects.visible",
+    sourceCount: 2,
+    route: "wasm",
+  });
+
+  const query = recipe.asQuerySurface();
+  assert.equal(query.routeHint.kind, "shared-memory");
+  assert.deepEqual(query.sources.map((source) => source.schemaId), [
+    "gamecult.aetheria.daemon_frame.v1",
+    "gamecult.aetheria.authority_policy.v1",
+  ]);
+
+  const queried = await query.execute(
+    { viewport: CultMesh.viewportRequest(CultMesh.rectFromBounds(-1, -1, 1, 1)) },
+    "unity-raven",
+  );
+
+  assert.equal(query.queryId, recipe.projectionId);
+  assert.equal(queried.route, "shared-memory");
+
+  const queryDiagnostic = CultMesh.describeQuerySurface(query);
+  assert.equal(queryDiagnostic.queryId, "aetheria.zone.objects.visible");
+  assert.equal(queryDiagnostic.routeHint.kind, "shared-memory");
+  assert.deepEqual(queryDiagnostic.sources.map((source) => source.sourceId), [
+    "daemon:aetheria.frame.latest.v1",
+    "daemon:aetheria.authority.policy.v1",
+  ]);
+  assert.notEqual(queryDiagnostic.sources, query.sources);
+
+  const unsubscribe = query.watch(
+    { viewport: CultMesh.viewportRequest(CultMesh.rectFromBounds(-1, -1, 1, 1)) },
+    "unity-raven",
+    (value) => watchedRoutes.push(value.route),
+  );
+  unsubscribe();
+
+  assert.deepEqual(watchedRoutes, ["shared-memory", "unsubscribed"]);
+});
+
+test("CultMesh TS describes typed surface catalogs for tools and generated bindings", () => {
+  const source = CultMesh.projectionSource("daemon:aetheria.frame.latest.v1", {
+    schemaId: "gamecult.aetheria.daemon_frame.v1",
+  });
+  const routeHint = CultMesh.routeHint("shared-memory", "co-located frame slab");
+  const query = CultMesh.query<void, string>(
+    "aetheria.zone.objects.visible",
+    async () => "objects",
+    {
+      sources: [source],
+      routeHint,
+    },
+  );
+  const feed = CultMesh.liveFeed<void, string>(
+    "aetheria.rts.viewport.feed",
+    async () => "frame",
+    {
+      sources: [source],
+      routeHint,
+    },
+  );
+  const operation = CultMesh.operation<void, string>(
+    "aetheria.pilot.set_move_vector",
+    async () => "accepted",
+  );
+  const pointer = CultMesh.statePointer(
+    "aetheria.selection.current",
+    async () => "entity:ship:1",
+    undefined,
+    {
+      sources: [source],
+      routeHint,
+    },
+  );
+  const document = CultMesh.document(
+    "daemon:aetheria.frame.latest.v1",
+    { schemaId: "gamecult.aetheria.daemon_frame.v1" },
+    async () => ({ frameId: 1 }),
+    {
+      sources: [source],
+      routeHint,
+    },
+  );
+  const collection = CultMesh.collection(
+    "daemon:aetheria.contacts.v1",
+    { schemaId: "gamecult.aetheria.contact.v1" },
+    async () => [],
+    {
+      sources: [source],
+      routeHint,
+    },
+  );
+  const nativeView = CultMesh.nativeSliceView(
+    "aetheria.zone.render",
+    "gamecult.aetheria.render_body.v1",
+    128,
+    [CultMesh.nativeSliceColumn("position", "CultVec2", 8)],
+    { route: routeHint },
+  );
+
+  const querySurface = CultMesh.describeSurface(query);
+  const feedSurface = CultMesh.describeSurface(feed);
+  const operationSurface = CultMesh.describeSurface(operation);
+  const pointerSurface = CultMesh.describeSurface(pointer);
+  const documentSurface = CultMesh.describeSurface(document);
+  const collectionSurface = CultMesh.describeSurface(collection);
+  const nativeViewSurface = CultMesh.describeSurface(nativeView);
+  const catalog = CultMesh.describeSurfaceCatalog("gamecult.aetheria.rts.surfaces.v1", [
+    querySurface,
+    feedSurface,
+    operationSurface,
+    documentSurface,
+    collectionSurface,
+    pointerSurface,
+    nativeViewSurface,
+  ]);
+
+  assert.equal(querySurface.kind, "query");
+  assert.equal(feedSurface.kind, "live-feed");
+  assert.equal(documentSurface.kind, "document");
+  assert.equal(collectionSurface.kind, "collection");
+  assert.equal(pointerSurface.kind, "state-pointer");
+  assert.equal(pointerSurface.routeHint.kind, "shared-memory");
+  assert.deepEqual(pointerSurface.sources.map(next => next.schemaId), [
+    "gamecult.aetheria.daemon_frame.v1",
+  ]);
+  assert.equal(nativeViewSurface.kind, "native-slice-view");
+  assert.equal(catalog.catalogId, "gamecult.aetheria.rts.surfaces.v1");
+  assert.deepEqual(catalog.surfaces.map(surface => surface.surfaceId), [
+    "aetheria.zone.objects.visible",
+    "aetheria.rts.viewport.feed",
+    "aetheria.pilot.set_move_vector",
+    "daemon:aetheria.frame.latest.v1",
+    "daemon:aetheria.contacts.v1",
+    "aetheria.selection.current",
+    "aetheria.zone.render",
+  ]);
+  assert.equal(catalog.surfaces[0].routeHint.kind, "shared-memory");
+  assert.deepEqual(catalog.surfaces[0].sources.map(next => next.schemaId), [
+    "gamecult.aetheria.daemon_frame.v1",
+  ]);
+  assert.notEqual(catalog.surfaces[0], querySurface);
+  assert.notEqual(catalog.surfaces[0].sources, querySurface.sources);
+  assert.equal(catalog.surfaces[6].routeHint.kind, "shared-memory");
+
+  assert.equal(
+    CultMesh.findSurface(catalog, "aetheria.selection.current")?.kind,
+    "state-pointer",
+  );
+  assert.equal(
+    CultMesh.findSurface(catalog, "daemon:aetheria.frame.latest.v1")?.kind,
+    "document",
+  );
+  assert.equal(CultMesh.findSurface(catalog, "missing"), undefined);
+
+  const operations = CultMesh.surfacesByKind(catalog, "operation");
+  assert.deepEqual(operations.map(surface => surface.surfaceId), [
+    "aetheria.pilot.set_move_vector",
+  ]);
+  assert.notEqual(operations, catalog.surfaces);
+  assert.notEqual(operations[0], operationSurface);
+
+  const index = CultMesh.surfaceCatalogIndex(catalog);
+  assert.equal(index.catalogId, "gamecult.aetheria.rts.surfaces.v1");
+  assert.deepEqual(index.queries.map(surface => surface.surfaceId), [
+    "aetheria.zone.objects.visible",
+  ]);
+  assert.deepEqual(index.liveFeeds.map(surface => surface.surfaceId), [
+    "aetheria.rts.viewport.feed",
+  ]);
+  assert.deepEqual(index.operations.map(surface => surface.surfaceId), [
+    "aetheria.pilot.set_move_vector",
+  ]);
+  assert.deepEqual(index.documents.map(surface => surface.surfaceId), [
+    "daemon:aetheria.frame.latest.v1",
+  ]);
+  assert.deepEqual(index.collections.map(surface => surface.surfaceId), [
+    "daemon:aetheria.contacts.v1",
+  ]);
+  assert.deepEqual(index.statePointers.map(surface => surface.surfaceId), [
+    "aetheria.selection.current",
+  ]);
+  assert.deepEqual(index.nativeSliceViews.map(surface => surface.surfaceId), [
+    "aetheria.zone.render",
+  ]);
+  assert.deepEqual(index.projectionRecipes, []);
+  assert.notEqual(index.operations, operations);
+  assert.notEqual(index.operations[0], operations[0]);
+});
+
+test("CultMesh TS exposes fluent context builders for typed handles", async () => {
+  const operationContext = CultMesh.operationContextFor("unity-client")
+    .claim("pilot-authority", { shardId: "zone:raven" })
+    .route("shared-memory", "co-located Verse")
+    .idempotency("move:raven:1")
+    .build();
+
+  assert.deepEqual(operationContext, {
+    runtimeId: "unity-client",
+    claims: [{ role: "pilot-authority", shardId: "zone:raven", leaseId: undefined }],
+    routeHint: { kind: "shared-memory", description: "co-located Verse" },
+    idempotencyKey: "move:raven:1",
+  });
+
+  const queryContext = CultMesh.queryContextFor("browser-client")
+    .route("wasm", "browser-local projection")
+    .build();
+
+  assert.deepEqual(queryContext, {
+    runtimeId: "browser-client",
+    routeHint: { kind: "wasm", description: "browser-local projection" },
+  });
+});
+
+test("CultMesh TS Verse context lets generated domain sugar use shared typed contexts", async () => {
+  const verse = await CultMesh.connectVerse("starbridge", "browser-starfire", {
+    routeHint: CultMesh.routeHint("network", "remote Verse peer"),
+    claims: [
+      CultMesh.authorityClaim("commander-control", {
+        shardId: "zone:frontier",
+        leaseId: "lease:starfire",
+      }),
+    ],
+  });
+  const queryVerse = verse.withRoute("shared-memory", "local projection slab");
+  const commandVerse = verse.withRoute("network", "remote command route");
+
+  const aetheria = queryVerse.use((queryContext) => {
+    const moveOperation = commandVerse.bindOperation(CultMesh.operation<
+      { entityId: number; direction: { x: number; y: number } },
+      ReturnType<typeof CultMesh.operationReceipt>
+    >("aetheria.entity.pilot.move", async (request, operationContext) => {
+      assert.equal(operationContext.runtimeId, "browser-starfire");
+      assert.equal(operationContext.claims[0]?.role, "commander-control");
+      assert.equal(operationContext.idempotencyKey, "move:starfire:1");
+      return CultMesh.operationReceipt("aetheria.entity.pilot.move", request.entityId === 7, {
+        route: operationContext.routeHint,
+      });
+    }));
+    const objectsVisible = CultMesh.bindQuery(queryContext, CultMesh.query<
+      { viewport: ReturnType<typeof CultMesh.viewportRequest> },
+      { runtimeId: string; zoneId: string; route: string; minX: number }
+    >("aetheria.zone.objects.visible", async (parameters, context) => ({
+      runtimeId: context.runtimeId,
+      zoneId: "zone:frontier",
+      route: context.routeHint.kind,
+      minX: parameters.viewport.minX,
+    })));
+
+    return {
+    entity: (entityId: number) => ({
+      pilot: {
+        move: (direction: { x: number; y: number }, idempotencyKey: string) =>
+          moveOperation.invoke({ entityId, direction }, { idempotencyKey }),
+      },
+    }),
+    zone: (zoneId: string) => ({
+      objects: {
+        visibleWithin: async (viewport: ReturnType<typeof CultMesh.viewportRequest>) => ({
+          ...await objectsVisible.execute({ viewport }),
+          zoneId,
+        }),
+      },
+    }),
+  };
+  });
+
+  const receipt = await aetheria
+    .entity(7)
+    .pilot
+    .move(CultMesh.vec2(1, 0), "move:starfire:1");
+  const viewport = await aetheria
+    .zone("zone:frontier")
+    .objects
+    .visibleWithin(CultMesh.viewportRequest(CultMesh.rectFromBounds(-16, -8, 16, 8)));
+
+  assert.equal(verse.verseId, "starbridge");
+  assert.equal(verse.runtimeId, "browser-starfire");
+  assert.deepEqual(verse.operationContext({ idempotencyKey: "move:starfire:2" }), {
+    runtimeId: "browser-starfire",
+    claims: [{ role: "commander-control", shardId: "zone:frontier", leaseId: "lease:starfire" }],
+    routeHint: { kind: "network", description: "remote Verse peer" },
+    idempotencyKey: "move:starfire:2",
+  });
+  assert.deepEqual(queryVerse.queryContext(), {
+    runtimeId: "browser-starfire",
+    routeHint: { kind: "shared-memory", description: "local projection slab" },
+  });
+  assert.equal(commandVerse.bindOperation(CultMesh.operation("noop", async (_request, context) =>
+    CultMesh.operationReceipt("noop", true, { route: context.routeHint }))).operationId, "noop");
+  assert.deepEqual(receipt, {
+    operationId: "aetheria.entity.pilot.move",
+    accepted: true,
+    route: {
+      kind: "network",
+      description: "remote command route",
+    },
+    diagnostic: undefined,
+  });
+  assert.deepEqual(viewport, {
+    runtimeId: "browser-starfire",
+    zoneId: "zone:frontier",
+    route: "shared-memory",
+    minX: -16,
+  });
+});
+
+test("CultMesh TS exposes typed state pointers for UI and tools", async () => {
+  const updates: string[] = [];
+  let value = "initial";
+  const pointer = CultMesh.statePointer(
+    "aetheria.selection.current",
+    async () => value,
+    (callback: (value: string) => void) => {
+      callback(value);
+      return () => updates.push("unsubscribed");
+    },
+    {
+      sources: [
+        CultMesh.projectionSource("daemon:aetheria.selection.current.v1", {
+          schemaId: "gamecult.aetheria.selection.v1",
+        }),
+      ],
+      routeHint: CultMesh.routeHint("shared-memory", "co-located selection cache"),
+    },
+  );
+
+  assert.equal(pointer.pointerId, "aetheria.selection.current");
+  assert.equal(await pointer.resolve(), "initial");
+  assert.deepEqual(CultMesh.describeStatePointer(pointer), {
+    pointerId: "aetheria.selection.current",
+    routeHint: {
+      kind: "shared-memory",
+      description: "co-located selection cache",
+    },
+    sources: [
+      {
+        sourceId: "daemon:aetheria.selection.current.v1",
+        schemaId: "gamecult.aetheria.selection.v1",
+        description: undefined,
+      },
+    ],
+  });
+
+  value = "selected:ship:1";
+  const unsubscribe = pointer.watch((next) => updates.push(next));
+  unsubscribe();
+
+  assert.deepEqual(updates, ["selected:ship:1", "unsubscribed"]);
+
+  const contextualUpdates: string[] = [];
+  const contextualPointer = CultMesh.statePointer(
+    "aetheria.daemon.frame.latest",
+    async (context) => `${context.runtimeId}:${context.routeHint.kind}`,
+    (context, callback) => {
+      callback(`${context.runtimeId}:frame:12:${context.routeHint.kind}`);
+      return () => contextualUpdates.push("contextual-unsubscribed");
+    },
+    {
+      sources: [
+        CultMesh.projectionSource("daemon:aetheria.frame.latest.v1", {
+          schemaId: "gamecult.aetheria.daemon_frame.v1",
+        }),
+      ],
+      routeHint: CultMesh.routeHint("shared-memory", "co-located daemon frame"),
+    },
+  );
+  const verse = CultMesh.verse("aetheria.local", "bifrost-tool")
+    .withRoute("ipc", "tool bridge");
+  const bound = CultMesh.bindStatePointer(verse, contextualPointer);
+
+  assert.equal(await bound.resolve(), "bifrost-tool:ipc");
+  const contextualUnsubscribe = bound.watch((next) => contextualUpdates.push(next));
+  contextualUnsubscribe();
+
+  assert.equal(bound.pointerId, "aetheria.daemon.frame.latest");
+  assert.deepEqual(bound.sources.map(source => source.schemaId), [
+    "gamecult.aetheria.daemon_frame.v1",
+  ]);
+  assert.deepEqual(contextualUpdates, [
+    "bifrost-tool:frame:12:ipc",
+    "contextual-unsubscribed",
+  ]);
+});
+
+test("CultMesh TS mutable state pointers read watch and replace through a Verse", async () => {
+  let stored = "frame:0";
+  let watcher: ((value: string) => void) | undefined;
+  const contexts: string[] = [];
+  const pointer = CultMesh.mutableStatePointer(
+    "aetheria.daemon.frame.latest",
+    async (context) => {
+      contexts.push(`read:${context.runtimeId}:${context.routeHint.kind}`);
+      return stored;
+    },
+    (context, callback) => {
+      contexts.push(`watch:${context.runtimeId}:${context.routeHint.kind}`);
+      watcher = (value) => callback(`${context.runtimeId}:${value}:${context.routeHint.kind}`);
+      return () => {
+        watcher = undefined;
+      };
+    },
+    async (context, value) => {
+      contexts.push(`replace:${context.runtimeId}:${context.routeHint.kind}`);
+      stored = value;
+      watcher?.(value);
+    },
+    {
+      routeHint: CultMesh.routeHint("shared-memory", "co-located daemon frame"),
+      sources: [
+        CultMesh.projectionSource("daemon:aetheria.frame.latest.v1", {
+          schemaId: "gamecult.aetheria.daemon_frame.v1",
+        }),
+      ],
+    },
+  );
+
+  const verse = CultMesh.verse("aetheria.local", "unity-raven", {
+    routeHint: CultMesh.routeHint("ipc", "tool bridge"),
+  });
+  const bound = verse.bindMutableStatePointer(pointer);
+
+  let observed = "";
+  const unsubscribe = bound.watch((value) => {
+    observed = value;
+  });
+  assert.equal(await bound.read(), "frame:0");
+  await bound.replace("frame:1");
+  unsubscribe();
+
+  assert.equal(stored, "frame:1");
+  assert.equal(observed, "unity-raven:frame:1:ipc");
+  assert.deepEqual(contexts, [
+    "watch:unity-raven:ipc",
+    "read:unity-raven:ipc",
+    "replace:unity-raven:ipc",
+  ]);
+  assert.deepEqual(CultMesh.describeStatePointer(pointer), {
+    pointerId: "aetheria.daemon.frame.latest",
+    routeHint: {
+      kind: "shared-memory",
+      description: "co-located daemon frame",
+    },
+    sources: [
+      {
+        sourceId: "daemon:aetheria.frame.latest.v1",
+        schemaId: "gamecult.aetheria.daemon_frame.v1",
+        description: undefined,
+      },
+    ],
+  });
+  assert.deepEqual(CultMesh.stateBinding("frame", pointer), {
+    targetProp: "frame",
+    pointerId: "aetheria.daemon.frame.latest",
+    sourceId: "daemon:aetheria.frame.latest.v1",
+    schemaId: "gamecult.aetheria.daemon_frame.v1",
+    routeHint: {
+      kind: "shared-memory",
+      description: "co-located daemon frame",
+    },
+  });
+});
+
+test("CultMesh TS describes UI state bindings from typed state pointers", async () => {
+  const pointer = CultMesh.statePointer(
+    "aetheria.selection.current",
+    async () => "entity:station:0",
+    undefined,
+    {
+      sources: [
+        CultMesh.projectionSource("daemon:aetheria.selection.current.v1", {
+          schemaId: "gamecult.aetheria.selection.v1",
+        }),
+      ],
+      routeHint: CultMesh.routeHint("shared-memory", "co-located selection cache"),
+    },
+  );
+
+  const binding = CultMesh.stateBinding("value", pointer);
+  const explicitBinding = CultMesh.stateBinding(
+    "label",
+    "aetheria.selection.label",
+    {
+      sourceId: "daemon:aetheria.selection.label.v1",
+      schemaId: "gamecult.aetheria.selection_label.v1",
+      routeHint: CultMesh.routeHint("ipc", "tool bridge"),
+    },
+  );
+
+  assert.deepEqual(binding, {
+    targetProp: "value",
+    pointerId: "aetheria.selection.current",
+    sourceId: "daemon:aetheria.selection.current.v1",
+    schemaId: "gamecult.aetheria.selection.v1",
+    routeHint: {
+      kind: "shared-memory",
+      description: "co-located selection cache",
+    },
+  });
+  assert.deepEqual(explicitBinding, {
+    targetProp: "label",
+    pointerId: "aetheria.selection.label",
+    sourceId: "daemon:aetheria.selection.label.v1",
+    schemaId: "gamecult.aetheria.selection_label.v1",
+    routeHint: {
+      kind: "ipc",
+      description: "tool bridge",
+    },
+  });
+});
+
+test("CultMesh TS flattens and rehydrates UI state binding records", () => {
+  const binding = CultMesh.stateBinding(
+    "status",
+    "aetheria.current.status",
+    {
+      sourceId: "daemon:aetheria.frame.latest.v1",
+      schemaId: "gamecult.aetheria.daemon_frame.v1",
+      routeHint: CultMesh.routeHint("shared-memory", "co-located frame slab"),
+    },
+  );
+
+  assert.deepEqual(CultMesh.stateBindingRecord(binding), {
+    targetProp: "status",
+    pointerId: "aetheria.current.status",
+    sourceId: "daemon:aetheria.frame.latest.v1",
+    schemaId: "gamecult.aetheria.daemon_frame.v1",
+    routeKind: "shared-memory",
+    routeDescription: "co-located frame slab",
+    bindingName: "",
+    documentId: "",
+    fieldPath: "",
+    valueKind: "",
+    accessMode: "",
+    authority: "",
+    writeCommand: "",
+  });
+
+  assert.deepEqual(CultMesh.stateBindingFromRecord({
+    targetProp: "value",
+    pointerId: "aetheria.selection.current",
+    sourceId: "daemon:aetheria.selection.current.v1",
+    schemaId: "gamecult.aetheria.selection.v1",
+    routeKind: "InProcess",
+    routeDescription: "embedded tool host",
+  }), {
+    targetProp: "value",
+    pointerId: "aetheria.selection.current",
+    sourceId: "daemon:aetheria.selection.current.v1",
+    schemaId: "gamecult.aetheria.selection.v1",
+    routeHint: {
+      kind: "in-process",
+      description: "embedded tool host",
+    },
+  });
+});
+
+test("CultMesh TS preserves editable binding identity and authority through transport records", () => {
+  const binding = CultMesh.stateBinding("value", "ghostlight.session-zero.composer", {
+    sourceId: "session-zero:draft-7",
+    schemaId: "session_zero.v1",
+    routeHint: CultMesh.routeHint("network", "Ghostlight provider"),
+    bindingName: "composer.message",
+    documentId: "session-zero:draft-7",
+    fieldPath: "channels.private.messages.pending",
+    valueKind: "string",
+    accessMode: "local-draft",
+    authority: "SessionZeroKernel",
+    writeCommand: "edit.value",
+  });
+  const record = CultMesh.stateBindingRecord(binding);
+  assert.equal(record.bindingName, "composer.message");
+  assert.equal(record.fieldPath, "channels.private.messages.pending");
+  assert.equal(record.accessMode, "local-draft");
+  assert.deepEqual(CultMesh.stateBindingFromRecord(record), binding);
+});
+
+test("CultMesh TS describes UI command bindings from typed operations", async () => {
+  const operation = CultMesh.operation<
+    { actor: string },
+    ReturnType<typeof CultMesh.operationReceipt>
+  >("aetheria.entity.pilot.move", async (_request, context) =>
+    CultMesh.operationReceipt("aetheria.entity.pilot.move", true, {
+      route: context.routeHint,
+    }));
+
+  const binding = CultMesh.operationBinding(operation, {
+    label: "Move",
+    schemaId: "gamecult.aetheria.pilot_move.v1",
+    routeHint: CultMesh.routeHint("network", "remote Verse peer"),
+  });
+  const explicitBinding = CultMesh.operationBinding("aetheria.surface.refresh", {
+    label: "Refresh",
+  });
+
+  assert.deepEqual(binding, {
+    operationId: "aetheria.entity.pilot.move",
+    label: "Move",
+    schemaId: "gamecult.aetheria.pilot_move.v1",
+    routeHint: {
+      kind: "network",
+      description: "remote Verse peer",
+    },
+  });
+  assert.deepEqual(explicitBinding, {
+    operationId: "aetheria.surface.refresh",
+    label: "Refresh",
+    schemaId: "",
+    routeHint: {
+      kind: "automatic",
+    },
+  });
+});
+
+test("CultMesh TS flattens and rehydrates UI operation binding records", () => {
+  const binding = CultMesh.operationBinding("aetheria.entity.pilot.move", {
+    label: "Move",
+    schemaId: "gamecult.aetheria.pilot_move.v1",
+    routeHint: CultMesh.routeHint("network", "remote Verse peer"),
+  });
+
+  assert.deepEqual(CultMesh.operationBindingRecord(binding), {
+    operationId: "aetheria.entity.pilot.move",
+    label: "Move",
+    schemaId: "gamecult.aetheria.pilot_move.v1",
+    routeKind: "network",
+    routeDescription: "remote Verse peer",
+  });
+
+  assert.deepEqual(CultMesh.operationBindingFromRecord({
+    operationId: "aetheria.surface.refresh",
+    label: "Refresh",
+    schemaId: "gamecult.aetheria.refresh.v1",
+    routeKind: "SharedMemory",
+    routeDescription: "co-located command boundary",
+  }), {
+    operationId: "aetheria.surface.refresh",
+    label: "Refresh",
+    schemaId: "gamecult.aetheria.refresh.v1",
+    routeHint: {
+      kind: "shared-memory",
+      description: "co-located command boundary",
+    },
+  });
+});
+
+test("CultMesh TS carries UI command invocations as typed operation descriptors", () => {
+  const binding = CultMesh.operationBinding("aetheria.entity.pilot.move", {
+    label: "Move",
+    schemaId: "gamecult.aetheria.pilot_move.v1",
+    routeHint: CultMesh.routeHint("ipc", "local Verse node"),
+  });
+
+  const invocation = CultMesh.operationInvocation(binding, {
+    idempotencyKey: "move:42",
+  });
+  const explicitInvocation = CultMesh.operationInvocation(
+    "aetheria.surface.refresh",
+    {
+      routeHint: CultMesh.routeHint("network", "remote Verse peer"),
+    },
+  );
+
+  assert.deepEqual(invocation, {
+    operationId: "aetheria.entity.pilot.move",
+    schemaId: "gamecult.aetheria.pilot_move.v1",
+    routeHint: {
+      kind: "ipc",
+      description: "local Verse node",
+    },
+    idempotencyKey: "move:42",
+  });
+  assert.deepEqual(explicitInvocation, {
+    operationId: "aetheria.surface.refresh",
+    schemaId: "",
+    routeHint: {
+      kind: "network",
+      description: "remote Verse peer",
+    },
+    idempotencyKey: undefined,
+  });
+});
+
+test("CultMesh TS reads common operation payload scalar fields", () => {
+  const payload = CultMesh.operationPayload({
+    value: "42.5",
+    tierIndex: 3,
+    enabled: "on",
+    name: "Starfire",
+  });
+  const updated = payload.with("enabled", false);
+
+  assert.equal(payload.getString("name"), "Starfire");
+  assert.equal(payload.getString("missing", "fallback"), "fallback");
+  assert.equal(payload.getInt("tierIndex", -1), 3);
+  assert.equal(payload.getInt("missing", -1), -1);
+  assert.equal(payload.getDouble("value", -1), 42.5);
+  assert.equal(payload.getBoolean("enabled"), true);
+  assert.equal(payload.getBoolean("missing", true), true);
+  assert.equal(updated.getBoolean("enabled", true), false);
+  assert.equal(updated.getString("name"), "Starfire");
+  assert.deepEqual(payload.fields, {
+    value: "42.5",
+    tierIndex: "3",
+    enabled: "on",
+    name: "Starfire",
+  });
+  assert.deepEqual(payload.toRecord(), payload.fields);
+});
+
+test("CultMesh TS flattens and rehydrates operation invocation records", () => {
+  const invocation = CultMesh.operationInvocation("aetheria.entity.pilot.move", {
+    schemaId: "gamecult.aetheria.pilot_move.v1",
+    routeHint: CultMesh.routeHint("ipc", "local Verse node"),
+    idempotencyKey: "move:42",
+  });
+
+  const record = CultMesh.operationInvocationRecord(invocation);
+  const restored = CultMesh.operationInvocationFromRecord(record, {
+    fallbackOperationId: "fallback.operation",
+    fallbackSchemaId: "fallback.schema",
+    fallbackRouteHint: CultMesh.routeHint("network", "fallback route"),
+  });
+  const csharpRecord = CultMesh.operationInvocationFromRecord(
+    {
+      operationId: "",
+      schemaId: "",
+      routeKind: "InProcess",
+      routeDescription: "",
+      idempotencyKey: "",
+    },
+    {
+      fallbackOperationId: "fallback.operation",
+      fallbackSchemaId: "fallback.schema",
+      fallbackRouteHint: CultMesh.routeHint("network", "fallback route"),
+      fallbackIdempotencyKey: "fallback-key",
+    },
+  );
+
+  assert.deepEqual(record, {
+    operationId: "aetheria.entity.pilot.move",
+    schemaId: "gamecult.aetheria.pilot_move.v1",
+    routeKind: "ipc",
+    routeDescription: "local Verse node",
+    idempotencyKey: "move:42",
+  });
+  assert.deepEqual(restored, invocation);
+  assert.deepEqual(csharpRecord, {
+    operationId: "fallback.operation",
+    schemaId: "fallback.schema",
+    routeHint: {
+      kind: "in-process",
+      description: "fallback route",
+    },
+    idempotencyKey: "fallback-key",
+  });
+});
+
+test("CultMesh TS composes named state ref resolvers for surfaces", () => {
+  const daemon = CultMesh.stateRefResolver(
+    "aetheria.daemon.refs",
+    (stateRef: string, context) =>
+      stateRef === "aetheria.daemon/frame/id"
+        ? `${context.runtimeId}:${context.routeHint.kind}:42`
+        : "",
+    {
+      sources: [
+        CultMesh.projectionSource("daemon:aetheria.frame.latest.v1", {
+          schemaId: "gamecult.aetheria.daemon_frame.v1",
+        }),
+      ],
+      routeHint: CultMesh.routeHint("in-process", "embedded renderer"),
+    },
+  );
+  const itemStats = CultMesh.stateRefResolver(
+    "aetheria.item_stats.refs",
+    (stateRef: string) =>
+      stateRef === "aetheria.item_stats/laser/damage" ? "12.5" : "",
+  );
+  const resolver = daemon.or(itemStats);
+
+  assert.equal(
+    resolver.resolve(
+      "aetheria.daemon/frame/id",
+      CultMesh.queryContext("unity-raven", {
+        routeHint: CultMesh.routeHint("network", "remote peer"),
+      }),
+    ),
+    "unity-raven:network:42",
+  );
+  assert.equal(resolver.resolve("aetheria.item_stats/laser/damage"), "12.5");
+  assert.deepEqual(resolver.tryResolve("missing"), {
+    resolved: false,
+    value: "",
+  });
+  assert.equal(resolver.asFunction()("aetheria.item_stats/laser/damage"), "12.5");
+
+  assert.deepEqual(CultMesh.describeStateRefResolver(resolver), {
+    resolverId: "aetheria.daemon.refs|aetheria.item_stats.refs",
+    routeHint: {
+      kind: "in-process",
+      description: "embedded renderer",
+    },
+    sources: [
+      {
+        sourceId: "daemon:aetheria.frame.latest.v1",
+        schemaId: "gamecult.aetheria.daemon_frame.v1",
+        description: undefined,
+      },
+    ],
+  });
+});
+
+test("CultMesh TS exposes native slice descriptors", () => {
+  const view = CultMesh.nativeSliceView(
+    "aetheria.zone.render",
+    "gamecult.aetheria.zone_render.v1",
+    12,
+    [
+      CultMesh.nativeSliceColumn("position", "CultVec3", 12),
+      CultMesh.nativeSliceColumn("rotationRadians", "float32", 4),
+      CultMesh.nativeSliceColumn("renderGroupId", "uint32", 4),
+    ],
+    {
+      route: CultMesh.routeHint("shared-memory", "CultCache slab"),
+      nativeHandle: "aetheria-zone-render-001",
+    },
+  );
+
+  assert.equal(CultMesh.denseRowStrideBytes(view), 20);
+  assert.deepEqual(CultMesh.findNativeSliceColumn(view, "position"), {
+    name: "position",
+    valueType: "CultVec3",
+    elementSizeBytes: 12,
+  });
+  assert.equal(CultMesh.findNativeSliceColumn(view, "missing"), undefined);
+
+  const diagnostic = CultMesh.describeNativeSliceView(view);
+  assert.equal(diagnostic.viewId, "aetheria.zone.render");
+  assert.equal(diagnostic.schemaId, "gamecult.aetheria.zone_render.v1");
+  assert.equal(diagnostic.rowCount, 12);
+  assert.equal(diagnostic.route.kind, "shared-memory");
+  assert.equal(diagnostic.nativeHandle, "aetheria-zone-render-001");
+  assert.equal(diagnostic.denseRowStrideBytes, 20);
+  assert.deepEqual(diagnostic.columns.map(column => column.name), [
+    "position",
+    "rotationRadians",
+    "renderGroupId",
+  ]);
+  assert.notEqual(diagnostic.columns, view.columns);
+});
+
 test("CultMesh TS branded facade exposes schema and shard catalogs", () => {
   const schemaCatalog = CultMesh.createSchemaCatalog();
   const schemaUpdates: string[] = [];
@@ -537,6 +2862,284 @@ test("CultMesh TS publishes one registered document to a RUDP catalog", async ()
   }
 });
 
+test("CultMesh TS resolves a CultMesh URI through its authority bootstrap", () => {
+  assert.deepEqual(
+    CultMesh.resolveRudpEndpoint("cultmesh://odin/rendezvous/provider-catalog", {
+      CULTMESH_URI_ODIN_RUDP: "127.0.0.1:17871",
+    }),
+    { host: "127.0.0.1", port: 17871, uri: "rudp://127.0.0.1:17871" },
+  );
+  assert.throws(
+    () => CultMesh.resolveRudpEndpoint("cultmesh://missing/rendezvous/provider-catalog", {}),
+    /did not resolve/,
+  );
+});
+
+test("CultMesh TS returns a correlated provider receipt after a RUDP document mutation", async () => {
+  const connectionId = 0x10203050;
+  const commandBinding = defineCultNetDocumentBinding({ definition: noteDocument });
+  const receiptBinding = defineCultNetDocumentBinding({ definition: noteReceiptDocument });
+  const server = CultMesh.createRudpDocumentServer("cultmesh-ts-receipt-server", connectionId, {
+    documents: new CultNetDocumentRegistry([commandBinding, receiptBinding]), bindHost: "127.0.0.1", bindPort: 0,
+    resendDelayMs: 25, resendPollMs: 5,
+    onDocumentPutRaw: async (document) => ({
+      binding: receiptBinding, recordKey: document.recordKey,
+      value: { commandId: document.recordKey, state: "applied", body: (document.payload as { body: string }).body },
+    }),
+  });
+  try {
+    await server.start();
+    const receipt = await CultMesh.publishRudpDocumentAndWaitForReceipt(
+      "cultmesh-ts-receipt-client", connectionId, `rudp://127.0.0.1:${server.bind.port}`,
+      commandBinding, "command:note", { noteId: "command:note", body: "provider applied this" }, receiptBinding,
+      { messageId: "command:note", receiptTimeoutMs: 1_000, resendPollMs: 5 },
+    );
+    assert.deepEqual(receipt, { commandId: "command:note", state: "applied", body: "provider applied this" });
+  } finally { server.close(); }
+});
+
+test("CultMesh TS reads remote RUDP snapshots through document handles", async () => {
+  const connectionId = 0x10203048;
+  const node = await CultMesh.startNode(
+    join(await mkdtemp(join(tmpdir(), "cultmesh-ts-rudp-snapshot-")), "node.ccmp"),
+    {
+      documents: [noteDocument],
+    },
+  );
+  await node.put(noteDocument, "note:remote", {
+    noteId: "note:remote",
+    body: "remote handles feel local",
+  });
+
+  const server = CultMesh.createRudpDocumentServer(
+    "cultmesh-ts-rudp-snapshot-server",
+    connectionId,
+    {
+      documents: new CultNetDocumentRegistry([
+        defineCultNetDocumentBinding({ definition: noteDocument }),
+      ]),
+      getCache: () => node.cache,
+      bindHost: "127.0.0.1",
+      bindPort: 0,
+      resendDelayMs: 25,
+      resendPollMs: 5,
+      maxFragmentBytes: 1024,
+      maxPendingReliablePackets: 16,
+    },
+  );
+
+  let peer: CultNetPeer | undefined;
+  try {
+    await server.start();
+    peer = await CultMesh.createRudpPeer(
+      "cultmesh-ts-rudp-snapshot-client",
+      connectionId,
+      `rudp://127.0.0.1:${server.bind.port}`,
+      {
+        resendDelayMs: 25,
+        resendPollMs: 5,
+        maxFragmentBytes: 1024,
+        maxPendingReliablePackets: 16,
+        connectTimeoutMs: 1_000,
+      },
+    );
+
+    const document = CultMesh.documentFromPublication(
+      {
+        kind: "peer-snapshot",
+        peer,
+        endpoint: `rudp://127.0.0.1:${server.bind.port}`,
+      },
+      noteDocument,
+      "note:remote",
+      {
+        documentId: "note:remote",
+        timeoutMs: 1_000,
+      },
+    );
+
+    const latest = await document.latest();
+    assert.equal(latest.body, "remote handles feel local");
+    assert.deepEqual(latest, {
+      noteId: "note:remote",
+      body: "remote handles feel local",
+    });
+    assert.equal(document.schema.type, "cultmesh.note");
+
+    const alias = CultMesh.documentFromPeerSnapshot(
+      peer,
+      "cultmesh.note.alias.v1",
+      "note:remote",
+      {
+        documentId: "note:remote.alias",
+        timeoutMs: 1_000,
+      },
+    );
+
+    assert.deepEqual(await alias.latest(), {
+      noteId: "note:remote",
+      body: "remote handles feel local",
+    });
+  } finally {
+    peer?.close();
+    server.close();
+  }
+});
+
+test("CultMesh TS syncs remote RUDP snapshots into a local node with same-schema aliases", async () => {
+  const connectionId = 0x1020304a;
+  const source = await CultMesh.startNode(
+    join(await mkdtemp(join(tmpdir(), "cultmesh-ts-rudp-sync-source-")), "node.ccmp"),
+    {
+      documents: [noteDocument],
+    },
+  );
+  await source.put(noteDocument, "note:sync-remote", {
+    noteId: "note:sync-remote",
+    body: "synced once, read as local",
+  });
+  const target = await CultMesh.startNode(
+    join(await mkdtemp(join(tmpdir(), "cultmesh-ts-rudp-sync-target-")), "node.ccmp"),
+    {
+      documents: [noteDocument],
+    },
+  );
+
+  const server = CultMesh.createRudpDocumentServer(
+    "cultmesh-ts-rudp-sync-server",
+    connectionId,
+    {
+      documents: new CultNetDocumentRegistry([
+        defineCultNetDocumentBinding({ definition: noteDocument }),
+      ]),
+      getCache: () => source.cache,
+      bindHost: "127.0.0.1",
+      bindPort: 0,
+      resendDelayMs: 25,
+      resendPollMs: 5,
+      maxFragmentBytes: 1024,
+      maxPendingReliablePackets: 16,
+    },
+  );
+
+  let peer: CultNetPeer | undefined;
+  try {
+    await server.start();
+    peer = await CultMesh.createRudpPeer(
+      "cultmesh-ts-rudp-sync-client",
+      connectionId,
+      `rudp://127.0.0.1:${server.bind.port}`,
+      {
+        resendDelayMs: 25,
+        resendPollMs: 5,
+        maxFragmentBytes: 1024,
+        maxPendingReliablePackets: 16,
+        connectTimeoutMs: 1_000,
+      },
+    );
+
+    const synced = await target.syncDocumentFromPeerSnapshot(
+      peer,
+      noteAliasDocument,
+      "note:sync-remote",
+      {
+        timeoutMs: 1_000,
+      },
+    );
+    const facadeSynced = await CultMesh.syncDocumentFromPeerSnapshot(
+      target,
+      peer,
+      noteAliasDocument,
+      "note:sync-remote",
+      {
+        timeoutMs: 1_000,
+      },
+    );
+
+    assert.deepEqual(synced, {
+      noteId: "note:sync-remote",
+      body: "synced once, read as local",
+    });
+    assert.deepEqual(facadeSynced, synced);
+    assert.equal(target.getRequired(noteDocument, "note:sync-remote").body, "synced once, read as local");
+    assert.equal(target.getRequired(noteAliasDocument, "note:sync-remote").body, "synced once, read as local");
+    assert.equal((await target.document(noteAliasDocument, "note:sync-remote").latest()).body, "synced once, read as local");
+  } finally {
+    peer?.close();
+    server.close();
+  }
+});
+
+test("CultMesh TS peer snapshot handles choose compatible foreign schema payloads", async () => {
+  const connectionId = 0x10203049;
+  const node = await CultMesh.startNode(
+    join(await mkdtemp(join(tmpdir(), "cultmesh-ts-rudp-foreign-snapshot-")), "node.ccmp"),
+    {
+      documents: [incompatibleNoteDocument, foreignNoteDocument],
+    },
+  );
+  await node.put(incompatibleNoteDocument, "note:foreign", {
+    nope: "not the requested shape",
+  });
+  await node.put(foreignNoteDocument, "note:foreign", {
+    noteId: "note:foreign",
+    body: "foreign schema id, local shape",
+  });
+
+  const server = CultMesh.createRudpDocumentServer(
+    "cultmesh-ts-rudp-foreign-snapshot-server",
+    connectionId,
+    {
+      documents: new CultNetDocumentRegistry([
+        defineCultNetDocumentBinding({ definition: incompatibleNoteDocument }),
+        defineCultNetDocumentBinding({ definition: foreignNoteDocument }),
+      ]),
+      getCache: () => node.cache,
+      bindHost: "127.0.0.1",
+      bindPort: 0,
+      resendDelayMs: 25,
+      resendPollMs: 5,
+      maxFragmentBytes: 1024,
+      maxPendingReliablePackets: 16,
+    },
+  );
+
+  let peer: CultNetPeer | undefined;
+  try {
+    await server.start();
+    peer = await CultMesh.createRudpPeer(
+      "cultmesh-ts-rudp-foreign-snapshot-client",
+      connectionId,
+      `rudp://127.0.0.1:${server.bind.port}`,
+      {
+        resendDelayMs: 25,
+        resendPollMs: 5,
+        maxFragmentBytes: 1024,
+        maxPendingReliablePackets: 16,
+        connectTimeoutMs: 1_000,
+      },
+    );
+
+    const alias = CultMesh.documentFromPeerSnapshot(
+      peer,
+      noteAliasDocument,
+      "note:foreign",
+      {
+        documentId: "note:foreign.alias",
+        timeoutMs: 1_000,
+      },
+    );
+
+    assert.deepEqual(await alias.latest(), {
+      noteId: "note:foreign",
+      body: "foreign schema id, local shape",
+    });
+  } finally {
+    peer?.close();
+    server.close();
+  }
+});
+
 test("CultMesh TS negotiates streaming frame body transports explicitly", () => {
   const streams = CultMesh.createStreamCatalog();
   const streamUpdates: string[] = [];
@@ -615,3 +3218,7 @@ test("CultMesh TS negotiates streaming frame body transports explicitly", () =>
   assert.deepEqual(streamUpdates, ["mimir:kiyo-pro"]);
   assert.deepEqual(frameUpdates, [42n]);
 });
+
+function delay(milliseconds: number): Promise<void> {
+  return new Promise(resolve => setTimeout(resolve, milliseconds));
+}
diff --git a/packages/cultmesh-ts/test/provider-rudp-transport.test.ts b/packages/cultmesh-ts/test/provider-rudp-transport.test.ts
new file mode 100644
index 00000000..5b44c84b
--- /dev/null
+++ b/packages/cultmesh-ts/test/provider-rudp-transport.test.ts
@@ -0,0 +1,334 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import { createSocket } from "node:dgram";
+import { decode } from "@msgpack/msgpack";
+import {
+  CultNetDocumentRegistry,
+  CultNetRudpSession,
+  decodeRudpPacket,
+  encodeRudpPacket,
+  type CultNetOperationRequestMessage,
+} from "cultnet-ts";
+
+import {
+  CultMesh,
+  CultMeshProviderRudpTransport,
+  CultMeshProviderSessionBroker,
+  CULTMESH_PROVIDER_SESSION_SERVICE_ID,
+  cultMeshProviderSessionOperations,
+  cultMeshProviderSessionSchemas,
+  decodeProviderConnectEvidence,
+  encodeProviderConnectEvidence,
+  encodeProviderSessionPayload,
+  type CultMeshProviderCommand,
+  type CultMeshProviderIdentity,
+  type CultMeshProviderPublication,
+} from "../src";
+
+const identity: CultMeshProviderIdentity = {
+  providerId: "voidbot.swarm",
+  serviceInstanceId: "voidbot-worker-7",
+  endpointId: "voidbot-worker-7.rudp",
+  verseId: "voidbot.local",
+};
+
+test("RUDP provider transport requires broker acceptance for the full lifecycle", async () => {
+  const accepted = new Map<string, unknown>();
+  const acceptedProvenance = new Map<string, { runtime?: string; agent?: string }>();
+  const deleted: string[] = [];
+  const receipts: string[] = [];
+  let leaseSequence = 0;
+  const broker = new CultMeshProviderSessionBroker({
+    runtimeId: "odin-test",
+    createLeaseId: () => `lease-${++leaseSequence}`,
+    authorizeRegistration: (_identity, session) =>
+      session.connectPayload !== undefined
+      && decodeProviderConnectEvidence(session.connectPayload).sessionToken === "signed-provider-token",
+    acceptPublication: (_identity, publicationId, document) => {
+      accepted.set(publicationId, decode(document.payload));
+      acceptedProvenance.set(publicationId, {
+        runtime: document.sourceRuntimeId,
+        agent: document.sourceAgentId,
+      });
+    },
+    deletePublications: (_identity, publications) => {
+      for (const { publicationId } of publications) {
+        deleted.push(publicationId);
+        accepted.delete(publicationId);
+      }
+    },
+    acceptReceipt: (_identity, receipt) => {
+      receipts.push(receipt.receiptId);
+    },
+  });
+  const server = CultMesh.createRudpDocumentServer("odin-test", 0x43554c54, {
+    bindPort: 0,
+    documents: new CultNetDocumentRegistry(),
+    onOperationRequest: (request, session) => broker.handle(request, session),
+    onSessionClosed: session => broker.sessionClosed(session),
+  });
+  await server.start();
+
+  const unauthorizedConnection = await new CultMeshProviderRudpTransport({
+    endpoint: `rudp://127.0.0.1:${server.bind.port}`,
+    runtimeId: "unauthorized-provider",
+    connectionId: 0x43554c54,
+    sessionToken: "not-authority",
+  }).connect(identity, new AbortController().signal);
+  try {
+    await assert.rejects(
+      unauthorizedConnection.register(
+        { identity, requestedLeaseDurationMs: 10_000 },
+        new AbortController().signal,
+      ),
+      /denied|not authorized/i,
+    );
+    assert.equal(
+      broker.activeLeaseCount,
+      0,
+      "a successful RUDP handshake does not grant provider authority",
+    );
+  } finally {
+    unauthorizedConnection.close();
+  }
+
+  const providerSocket = createSocket("udp4");
+  const rawSend = providerSocket.send.bind(providerSocket);
+  let originalConnectWire: Buffer | undefined;
+  providerSocket.send = ((message: Uint8Array, ...args: unknown[]) => {
+    if (decodeRudpPacket(message).packetType === "connect" && !originalConnectWire) {
+      originalConnectWire = Buffer.from(message);
+    }
+    return (rawSend as (...parameters: unknown[]) => boolean)(message, ...args);
+  }) as typeof providerSocket.send;
+  const transport = new CultMeshProviderRudpTransport({
+    endpoint: `rudp://127.0.0.1:${server.bind.port}`,
+    runtimeId: identity.serviceInstanceId,
+    connectionId: 0x43554c54,
+    sessionToken: "signed-provider-token",
+    socketFactory: () => providerSocket,
+  });
+  const connection = await transport.connect(identity, new AbortController().signal);
+  const secondIdentity: CultMeshProviderIdentity = {
+    providerId: "aetheria",
+    serviceInstanceId: "aetheria-daemon-2",
+    endpointId: "aetheria-daemon-2.rudp",
+    verseId: "aetheria.local",
+  };
+  const secondConnection = await new CultMeshProviderRudpTransport({
+    endpoint: `rudp://127.0.0.1:${server.bind.port}`,
+    runtimeId: secondIdentity.serviceInstanceId,
+    connectionId: 0x43554c54,
+    sessionToken: "signed-provider-token",
+  }).connect(secondIdentity, new AbortController().signal);
+  try {
+    broker.enqueueCommand({
+      commandId: "refresh-1",
+      commandKind: "voidbot.refresh",
+      providerId: identity.providerId,
+      serviceInstanceId: identity.serviceInstanceId,
+      payload: { force: true },
+    });
+    const lease = await connection.register({ identity, requestedLeaseDurationMs: 10_000 }, new AbortController().signal);
+    assert.equal(lease.leaseId, "lease-1");
+    assert.ok(originalConnectWire);
+    await new Promise<void>((resolve, reject) => {
+      rawSend(originalConnectWire!, server.bind.port, "127.0.0.1", error => error ? reject(error) : resolve());
+    });
+    await new Promise(resolve => setTimeout(resolve, 25));
+    assert.equal(broker.activeLeaseCount, 1, "a duplicate Connect cannot revoke the live provider lease");
+    const secondLease = await secondConnection.register({
+      identity: secondIdentity,
+      requestedLeaseDurationMs: 10_000,
+    }, new AbortController().signal);
+    assert.equal(secondLease.leaseId, "lease-2");
+    assert.equal(broker.activeLeaseCount, 2, "the broker demultiplexes simultaneous physical provider sessions");
+
+    const publication: CultMeshProviderPublication = {
+      publicationId: "voidbot.surface",
+      documentType: "gamecult.eve.surface_state",
+      schemaId: "gamecult.eve.surface_state.v1",
+      recordKey: "voidbot.swarm",
+      value: { generation: 3 },
+    };
+    await connection.publish(publication, lease);
+    assert.deepEqual(accepted.get(publication.publicationId), publication.value);
+    assert.deepEqual(acceptedProvenance.get(publication.publicationId), {
+      runtime: identity.serviceInstanceId,
+      agent: identity.providerId,
+    }, "the broker derives provenance from the fenced identity");
+    const secondPublication: CultMeshProviderPublication = {
+      publicationId: "aetheria.surface",
+      documentType: "gamecult.eve.surface_state",
+      schemaId: "gamecult.eve.surface_state.v1",
+      recordKey: "aetheria.pilot",
+      value: { generation: 8 },
+    };
+    await secondConnection.publish(secondPublication, secondLease);
+    await assert.rejects(secondConnection.publish({
+      ...secondPublication,
+      publicationId: "aetheria.stolen-tuple",
+      recordKey: publication.recordKey,
+    }, secondLease), /already owned/);
+    await assert.rejects(
+      secondConnection.publish({ ...secondPublication, value: { generation: 9 } }, lease),
+      /belongs to another physical session/,
+    );
+
+    const commandArrived = deferred<CultMeshProviderCommand>();
+    connection.watchCommands(command => commandArrived.resolve(command));
+    const command = await commandArrived.promise;
+    assert.equal(command.commandId, "refresh-1");
+    await connection.publishReceipt({
+      receiptId: "receipt-refresh-1",
+      commandId: command.commandId,
+      commandKind: command.commandKind,
+      providerId: identity.providerId,
+      serviceInstanceId: identity.serviceInstanceId,
+      state: "applied",
+      completedAt: new Date(),
+      result: { refreshed: true },
+    }, lease);
+    assert.deepEqual(receipts, ["receipt-refresh-1"]);
+
+    const renewed = await connection.renew(lease);
+    assert.equal(renewed.leaseId, "lease-3");
+    await assert.rejects(connection.withdrawPublication(publication.publicationId, lease), /expired|fenced/);
+    await connection.withdraw({ identity, leaseId: renewed.leaseId, publicationIds: [publication.publicationId] });
+    await secondConnection.withdraw({
+      identity: secondIdentity,
+      leaseId: secondLease.leaseId,
+      publicationIds: [secondPublication.publicationId],
+    });
+    assert.deepEqual(deleted, [publication.publicationId, secondPublication.publicationId]);
+    assert.equal(accepted.size, 0);
+    assert.equal(broker.activeLeaseCount, 0);
+  } finally {
+    connection.close();
+    secondConnection.close();
+    server.close();
+    broker.close();
+  }
+});
+
+test("closed physical sessions cannot finish delayed registration", async () => {
+  const authorization = deferred<boolean>();
+  const broker = new CultMeshProviderSessionBroker({
+    runtimeId: "odin-test",
+    authorizeRegistration: () => authorization.promise,
+    acceptPublication: () => undefined,
+    deletePublications: () => undefined,
+    acceptReceipt: () => undefined,
+  });
+  const session = {
+    sessionId: "closed-generation",
+    remote: { address: "127.0.0.1", family: "IPv4", port: 40000 },
+    connectPayload: new Uint8Array(),
+    send: () => undefined,
+  };
+  const request: CultNetOperationRequestMessage = {
+    schemaVersion: "cultnet.operation_request.v0",
+    messageId: "late-register",
+    serviceId: CULTMESH_PROVIDER_SESSION_SERVICE_ID,
+    operation: cultMeshProviderSessionOperations.register,
+    payloadSchema: cultMeshProviderSessionSchemas.registration,
+    payloadEncoding: "messagepack-base64",
+    payload: encodeProviderSessionPayload({ ...identity, requestedLeaseDurationMs: 10_000 }),
+  };
+  try {
+    const pending = broker.handle(request, session);
+    await new Promise(resolve => setTimeout(resolve, 0));
+    broker.sessionClosed(session);
+    authorization.resolve(true);
+    const response = await pending;
+    assert.equal(response.status, "denied");
+    assert.equal(broker.activeLeaseCount, 0);
+  } finally {
+    broker.close();
+  }
+});
+
+test("a replaced RUDP generation drops operations queued behind an active handler", async () => {
+  const connectionId = 0x43554c54;
+  const handlerGate = deferred<void>();
+  let handlerCalls = 0;
+  let closedSessions = 0;
+  const server = CultMesh.createRudpDocumentServer("odin-queue-test", connectionId, {
+    bindPort: 0,
+    documents: new CultNetDocumentRegistry(),
+    onOperationRequest: async request => {
+      handlerCalls += 1;
+      if (handlerCalls === 1) await handlerGate.promise;
+      return {
+        schemaVersion: "cultnet.operation_response.v0",
+        messageId: request.messageId,
+        serviceId: request.serviceId,
+        operation: request.operation,
+        status: "denied",
+        payloadSchema: cultMeshProviderSessionSchemas.mutationAcceptance,
+        payloadEncoding: "messagepack-base64",
+        payload: encodeProviderSessionPayload({}),
+      };
+    },
+    onSessionClosed: () => { closedSessions += 1; },
+    onError: () => undefined,
+  });
+  await server.start();
+
+  const socket = createSocket("udp4");
+  const rawSend = socket.send.bind(socket);
+  const connection = await new CultMeshProviderRudpTransport({
+    endpoint: `rudp://127.0.0.1:${server.bind.port}`,
+    runtimeId: identity.serviceInstanceId,
+    connectionId,
+    sessionToken: "signed-provider-token",
+    operationTimeoutMs: 100,
+    socketFactory: () => socket,
+  }).connect(identity, new AbortController().signal);
+  try {
+    const first = connection.register(
+      { identity, requestedLeaseDurationMs: 10_000 },
+      new AbortController().signal,
+    );
+    const second = connection.register(
+      { identity, requestedLeaseDurationMs: 10_000 },
+      new AbortController().signal,
+    );
+    await waitFor(() => handlerCalls === 1, "first queued provider operation");
+
+    const replacement = new CultNetRudpSession({ connectionId });
+    const replacementWire = encodeRudpPacket(replacement.createConnect(
+      Date.now(),
+      Buffer.from(encodeProviderConnectEvidence({
+        clientSessionId: "replacement-generation",
+        sessionToken: "signed-provider-token",
+      })),
+    ));
+    await new Promise<void>((resolve, reject) => {
+      rawSend(replacementWire, server.bind.port, "127.0.0.1", error => error ? reject(error) : resolve());
+    });
+    await waitFor(() => closedSessions === 1, "old RUDP generation closure");
+    handlerGate.resolve();
+    await new Promise(resolve => setTimeout(resolve, 20));
+    assert.equal(handlerCalls, 1, "transport-queued work from the closed generation must be dropped");
+
+    connection.close();
+    await Promise.allSettled([first, second]);
+  } finally {
+    connection.close();
+    server.close();
+  }
+});
+
+function deferred<T>(): { promise: Promise<T>; resolve(value: T): void } {
+  let resolve!: (value: T) => void;
+  return { promise: new Promise<T>(done => resolve = done), resolve };
+}
+
+async function waitFor(predicate: () => boolean, description: string): Promise<void> {
+  const startedAt = Date.now();
+  while (!predicate()) {
+    if (Date.now() - startedAt > 1_000) throw new Error(`Timed out waiting for ${description}.`);
+    await new Promise(resolve => setTimeout(resolve, 5));
+  }
+}
diff --git a/packages/cultmesh-ts/test/provider-session-wire.test.ts b/packages/cultmesh-ts/test/provider-session-wire.test.ts
new file mode 100644
index 00000000..ac607163
--- /dev/null
+++ b/packages/cultmesh-ts/test/provider-session-wire.test.ts
@@ -0,0 +1,43 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+
+import {
+  decodeProviderConnectEvidence,
+  encodeProviderConnectEvidence,
+  encodeProviderSessionPayload,
+} from "../src/provider-session-wire";
+
+const REGISTRATION_GOLDEN = "hqpwcm92aWRlcklkqGFldGhlcmlhsXNlcnZpY2VJbnN0YW5jZUlkq2FldGhlcmlhLTQyqmVuZHBvaW50SWSvYWV0aGVyaWEtcHVibGljp3ZlcnNlSWSmcHVibGljuHJlcXVlc3RlZExlYXNlRHVyYXRpb25Nc811MLBhdXRob3JpdHlMZWFzZUlkq2F1dGhvcml0eS03";
+const CONNECT_EVIDENCE_GOLDEN = "gq9jbGllbnRTZXNzaW9uSWSyYWV0aGVyaWEtY2xpZW50LTQyrHNlc3Npb25Ub2tlbrJvZGluLXNlc3Npb24tdG9rZW4=";
+const TOKENLESS_CONNECT_EVIDENCE_GOLDEN = "gq9jbGllbnRTZXNzaW9uSWSyYWV0aGVyaWEtY2xpZW50LTQyrHNlc3Npb25Ub2tlbsA=";
+
+test("provider registration matches the shared C# MessagePack golden payload", () => {
+  assert.equal(encodeProviderSessionPayload({
+    providerId: "aetheria",
+    serviceInstanceId: "aetheria-42",
+    endpointId: "aetheria-public",
+    verseId: "public",
+    requestedLeaseDurationMs: 30_000,
+    authorityLeaseId: "authority-7",
+  }), REGISTRATION_GOLDEN);
+});
+
+test("provider Connect evidence keeps transport generation separate from authority", () => {
+  const evidence = {
+    clientSessionId: "aetheria-client-42",
+    sessionToken: "odin-session-token",
+  };
+  const encoded = encodeProviderConnectEvidence(evidence);
+  assert.equal(Buffer.from(encoded).toString("base64"), CONNECT_EVIDENCE_GOLDEN);
+  assert.deepEqual(
+    decodeProviderConnectEvidence(encoded),
+    evidence,
+  );
+  assert.equal(
+    Buffer.from(encodeProviderConnectEvidence({
+      clientSessionId: "aetheria-client-42",
+      sessionToken: null,
+    })).toString("base64"),
+    TOKENLESS_CONNECT_EVIDENCE_GOLDEN,
+  );
+});
diff --git a/packages/cultmesh-ts/test/provider-session.test.ts b/packages/cultmesh-ts/test/provider-session.test.ts
new file mode 100644
index 00000000..8e1c9d50
--- /dev/null
+++ b/packages/cultmesh-ts/test/provider-session.test.ts
@@ -0,0 +1,791 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import {
+  CultMeshMemoryProviderReceiptStore,
+  CultMeshProviderSession,
+  type CultMeshProviderCommand,
+  type CultMeshProviderCommandListener,
+  type CultMeshProviderCommandReceipt,
+  type CultMeshProviderConnection,
+  type CultMeshProviderIdentity,
+  type CultMeshProviderLease,
+  type CultMeshProviderPublication,
+  type CultMeshProviderRegistration,
+  type CultMeshProviderScheduledTask,
+  type CultMeshProviderScheduler,
+  type CultMeshProviderTransport,
+  type CultMeshProviderWithdrawal,
+  type CultMeshProviderUnsubscribe,
+} from "../src/provider-session";
+
+const identity: CultMeshProviderIdentity = {
+  providerId: "voidbot.swarm",
+  serviceInstanceId: "voidbot-worker-7",
+  endpointId: "odin:voidbot-worker-7",
+  verseId: "voidbot.local",
+};
+
+const surface: CultMeshProviderPublication = {
+  publicationId: "voidbot.swarm.surface",
+  documentType: "gamecult.eve.surface_state",
+  schemaId: "gamecult.eve.surface_state.v1",
+  recordKey: "voidbot.swarm",
+  value: { version: 1 },
+};
+
+const advertisement: CultMeshProviderPublication = {
+  publicationId: "voidbot.swarm.advertisement",
+  documentType: "gamecult.eve.provider_advertisement",
+  schemaId: "gamecult.eve.provider_advertisement.v1",
+  recordKey: "voidbot.swarm",
+  value: { providerId: "voidbot.swarm" },
+};
+
+test("provider session owns registration, renewal, desired publication, and withdrawal", async () => {
+  const scheduler = new ManualScheduler();
+  const transport = new FakeTransport(scheduler);
+  const states: string[] = [];
+  const session = new CultMeshProviderSession({
+    identity,
+    transport,
+    scheduler,
+    receiptStore: new CultMeshMemoryProviderReceiptStore(),
+    publications: [surface, advertisement],
+    leaseDurationMs: 1_000,
+    renewalLeadMs: 200,
+    reconnectBaseDelayMs: 100,
+    reconnectMaxDelayMs: 1_000,
+  });
+  session.watchState(state => states.push(state.status));
+
+  await session.start();
+
+  const connection = transport.connections[0]!;
+  assert.equal(session.state.status, "active");
+  assert.deepEqual(connection.registrations[0]?.identity, identity);
+  assert.deepEqual(
+    connection.publications.map(value => value.publicationId),
+    [advertisement.publicationId, surface.publicationId],
+    "initial desired state is republished in stable order",
+  );
+  assert.notEqual(identity.providerId, identity.serviceInstanceId);
+  assert.notEqual(identity.serviceInstanceId, identity.endpointId);
+
+  await scheduler.advance(800);
+  assert.equal(connection.renewals.length, 1);
+  assert.equal(session.state.status, "active");
+
+  const updatedSurface = { ...surface, value: { version: 2 } };
+  const finalSurface = { ...surface, value: { version: 3 } };
+  const publishBarrier = new Deferred<void>();
+  connection.publishBarrier = publishBarrier;
+  const updating = session.upsertPublication(updatedSurface);
+  const finalizing = session.upsertPublication(finalSurface);
+  await settle();
+  assert.deepEqual(connection.publications.at(-1), surface, "the second update waits behind the first delivery");
+  publishBarrier.resolve();
+  await Promise.all([updating, finalizing]);
+  assert.deepEqual(
+    connection.publications.slice(-2),
+    [updatedSurface, finalSurface],
+    "desired publication updates preserve caller order on the live connection",
+  );
+
+  assert.equal(await session.removePublication(surface.publicationId), true);
+  assert.deepEqual(connection.withdrawnPublications, [surface.publicationId]);
+
+  await session.stop();
+  assert.equal(connection.closed, true);
+  assert.deepEqual(connection.withdrawals[0]?.identity, identity);
+  assert.deepEqual(connection.withdrawals[0]?.publicationIds, [advertisement.publicationId]);
+  assert.equal(session.state.status, "stopped");
+  assert.ok(states.includes("connecting"));
+  assert.ok(states.includes("withdrawing"));
+});
+
+test("stopping during registration prevents a stale connection from publishing", async () => {
+  const scheduler = new ManualScheduler();
+  const transport = new FakeTransport(scheduler);
+  transport.registerBarrier = new Deferred<void>();
+  const session = new CultMeshProviderSession({
+    identity,
+    transport,
+    scheduler,
+    receiptStore: new CultMeshMemoryProviderReceiptStore(),
+    publications: [advertisement],
+    leaseDurationMs: 1_000,
+    renewalLeadMs: 200,
+  });
+
+  const starting = session.start();
+  await settle();
+  const connection = transport.connections[0]!;
+  const stopping = session.stop();
+  transport.registerBarrier.resolve();
+  await Promise.all([starting, stopping]);
+
+  assert.equal(session.state.status, "stopped");
+  assert.equal(connection.closed, true);
+  assert.deepEqual(connection.publications, []);
+  assert.deepEqual(connection.withdrawals, []);
+});
+
+test("provider session reconnects and republishes desired state after transient failure", async () => {
+  const scheduler = new ManualScheduler();
+  const transport = new FakeTransport(scheduler);
+  transport.failConnectCount = 2;
+  const session = new CultMeshProviderSession({
+    identity,
+    transport,
+    scheduler,
+    receiptStore: new CultMeshMemoryProviderReceiptStore(),
+    publications: [advertisement],
+    leaseDurationMs: 1_000,
+    renewalLeadMs: 200,
+    reconnectBaseDelayMs: 100,
+    reconnectMaxDelayMs: 400,
+  });
+
+  await session.start();
+  assert.equal(session.state.status, "reconnecting");
+  assert.equal(session.state.reconnectAttempt, 1);
+
+  await scheduler.advance(100);
+  assert.equal(session.state.status, "reconnecting");
+  assert.equal(session.state.reconnectAttempt, 2);
+  await scheduler.advance(200);
+  assert.equal(session.state.status, "active");
+  assert.equal(transport.connections.length, 1);
+  assert.deepEqual(
+    transport.connections[0]?.publications.map(value => value.publicationId),
+    [advertisement.publicationId],
+  );
+
+  transport.connections[0]!.failNextPublish = new Error("partition");
+  await session.upsertPublication(surface);
+  assert.equal(session.state.status, "reconnecting");
+  assert.match(session.state.lastError ?? "", /partition/);
+  assert.equal(transport.connections[0]?.closed, true);
+
+  await scheduler.advance(100);
+  assert.equal(session.state.status, "active");
+  assert.deepEqual(
+    transport.connections[1]?.publications.map(value => value.publicationId),
+    [advertisement.publicationId, surface.publicationId],
+  );
+  await session.stop();
+});
+
+test("receipt persistence failure degrades the provider without inventing a transport outage", async () => {
+  const scheduler = new ManualScheduler();
+  const transport = new FakeTransport(scheduler);
+  const session = new CultMeshProviderSession({
+    identity,
+    transport,
+    scheduler,
+    receiptStore: {
+      get: async () => { throw new Error("receipt store offline"); },
+      put: async () => undefined,
+      listPending: async () => [],
+      markPublished: async () => undefined,
+    },
+    leaseDurationMs: 1_000,
+    renewalLeadMs: 200,
+    commandHandlers: {
+      "swarm.set_heat": async () => ({ state: "applied" }),
+    },
+  });
+  await session.start();
+  const connection = transport.connections[0]!;
+  await connection.emit({
+    commandId: "heat-store-failure",
+    commandKind: "swarm.set_heat",
+    providerId: identity.providerId,
+    serviceInstanceId: identity.serviceInstanceId,
+    payload: 0.5,
+  });
+
+  assert.equal(session.state.status, "degraded");
+  assert.match(session.state.lastError ?? "", /receipt store offline/);
+  assert.equal(connection.closed, false);
+  assert.equal(transport.connections.length, 1);
+  await session.stop();
+});
+
+test("provider session dispatches commands once and republishes typed receipts", async () => {
+  const scheduler = new ManualScheduler();
+  const transport = new FakeTransport(scheduler);
+  let applyCount = 0;
+  const session = new CultMeshProviderSession({
+    identity,
+    transport,
+    scheduler,
+    receiptStore: new CultMeshMemoryProviderReceiptStore(),
+    leaseDurationMs: 1_000,
+    renewalLeadMs: 200,
+    commandHandlers: {
+      "swarm.set_heat": async command => {
+        applyCount++;
+        await settle();
+        return { state: "applied", result: { heat: command.payload } };
+      },
+    },
+  });
+  await session.start();
+  const connection = transport.connections[0]!;
+  const command: CultMeshProviderCommand = {
+    commandId: "heat-1",
+    commandKind: "swarm.set_heat",
+    providerId: identity.providerId,
+    serviceInstanceId: identity.serviceInstanceId,
+    payload: 0.75,
+  };
+
+  await Promise.all([connection.emit(command), connection.emit(command)]);
+  await connection.emit(command);
+
+  assert.equal(applyCount, 1);
+  assert.equal(connection.receipts.length, 2, "concurrent duplicates share one delivery; later retries republish");
+  assert.ok(connection.receipts.every(receipt =>
+    receipt.receiptId === "receipt:13:voidbot.swarm16:voidbot-worker-76:heat-1"));
+  assert.ok(connection.receipts.every(receipt => receipt.state === "applied"));
+
+  await connection.emit({ ...command, commandId: "unknown-1", commandKind: "swarm.unknown" });
+  assert.equal(connection.receipts.at(-1)?.state, "rejected");
+
+  await connection.emit({ ...command, commandId: "wrong-instance", serviceInstanceId: "somebody-else" });
+  assert.equal(connection.receipts.length, 3, "commands for another service instance are ignored");
+  await session.stop();
+});
+
+test("persisted receipts survive a transport failure and leave the outbox only after replay", async () => {
+  const scheduler = new ManualScheduler();
+  const transport = new FakeTransport(scheduler);
+  const receipts = new CultMeshMemoryProviderReceiptStore();
+  let applyCount = 0;
+  const session = new CultMeshProviderSession({
+    identity,
+    transport,
+    scheduler,
+    receiptStore: receipts,
+    leaseDurationMs: 1_000,
+    renewalLeadMs: 200,
+    reconnectBaseDelayMs: 100,
+    commandHandlers: {
+      "swarm.set_heat": async () => {
+        applyCount++;
+        return { state: "applied" };
+      },
+    },
+  });
+  await session.start();
+  transport.connections[0]!.failNextReceipt = new Error("receipt route lost");
+  await transport.connections[0]!.emit({
+    commandId: "durable-1",
+    commandKind: "swarm.set_heat",
+    providerId: identity.providerId,
+    serviceInstanceId: identity.serviceInstanceId,
+    payload: 0.25,
+  });
+
+  assert.equal(session.state.status, "reconnecting");
+  assert.equal((await receipts.listPending()).length, 1);
+  await scheduler.advance(100);
+  assert.equal(session.state.status, "active");
+  assert.equal(transport.connections[1]!.receipts.length, 1);
+  assert.equal((await receipts.listPending()).length, 0);
+  assert.equal(applyCount, 1);
+
+  transport.connections[1]!.failNextPublish = new Error("state route lost");
+  await session.upsertPublication(surface);
+  await scheduler.advance(100);
+  assert.equal(transport.connections[2]!.receipts.length, 0, "marked receipts are not replayed again");
+  await session.stop();
+});
+
+test("initial replay and live publication changes share one ordered lane", async () => {
+  const scheduler = new ManualScheduler();
+  const transport = new FakeTransport(scheduler);
+  transport.publishBarrier = new Deferred<void>();
+  const session = new CultMeshProviderSession({
+    identity,
+    transport,
+    scheduler,
+    receiptStore: new CultMeshMemoryProviderReceiptStore(),
+    publications: [surface],
+    leaseDurationMs: 1_000,
+    renewalLeadMs: 200,
+  });
+
+  const starting = session.start();
+  await settle();
+  const connection = transport.connections[0]!;
+  const updated = { ...surface, value: { version: 2 } };
+  const updating = session.upsertPublication(updated);
+  const removing = session.removePublication(surface.publicationId);
+  transport.publishBarrier.resolve();
+  await Promise.all([starting, updating, removing]);
+
+  assert.deepEqual(connection.publications, [surface, updated]);
+  assert.deepEqual(connection.withdrawnPublications, [surface.publicationId]);
+  assert.deepEqual(session.publications, []);
+  await session.stop();
+});
+
+test("state observers cannot become lifecycle authorities", async () => {
+  const scheduler = new ManualScheduler();
+  const transport = new FakeTransport(scheduler);
+  const observerErrors: unknown[] = [];
+  const observed: string[] = [];
+  const session = new CultMeshProviderSession({
+    identity,
+    transport,
+    scheduler,
+    receiptStore: new CultMeshMemoryProviderReceiptStore(),
+    leaseDurationMs: 1_000,
+    renewalLeadMs: 200,
+    onObserverError: error => observerErrors.push(error),
+  });
+  session.watchState(() => { throw new Error("display broken"); });
+  session.watchState(state => observed.push(state.status));
+
+  await session.start();
+  await session.stop();
+
+  assert.equal(session.state.status, "stopped");
+  assert.ok(observerErrors.length >= 3);
+  assert.deepEqual(observed, ["stopped", "connecting", "active", "withdrawing", "stopped"]);
+});
+
+test("shutdown drains command persistence and always closes after cleanup failures", async () => {
+  const scheduler = new ManualScheduler();
+  const transport = new FakeTransport(scheduler);
+  const handlerBarrier = new Deferred<void>();
+  const session = new CultMeshProviderSession({
+    identity,
+    transport,
+    scheduler,
+    receiptStore: new CultMeshMemoryProviderReceiptStore(),
+    leaseDurationMs: 1_000,
+    renewalLeadMs: 200,
+    commandHandlers: {
+      "swarm.set_heat": async () => {
+        await handlerBarrier.promise;
+        return { state: "applied" };
+      },
+    },
+  });
+  await session.start();
+  const connection = transport.connections[0]!;
+  const command = connection.emit({
+    commandId: "stop-drain-1",
+    commandKind: "swarm.set_heat",
+    providerId: identity.providerId,
+    serviceInstanceId: identity.serviceInstanceId,
+    payload: 0.5,
+  });
+  connection.unsubscribeError = new Error("unsubscribe failed");
+  connection.withdrawError = new Error("withdraw failed");
+  connection.closeError = new Error("close failed");
+  let stopped = false;
+  const stopping = session.stop().finally(() => { stopped = true; });
+  await settle();
+  assert.equal(stopped, false, "shutdown waits for the authoritative command transaction");
+  handlerBarrier.resolve();
+  await command;
+  await assert.rejects(stopping, AggregateError);
+
+  assert.equal(connection.closeAttempts, 1);
+  assert.equal(session.state.status, "stopped");
+});
+
+test("concurrent reuse of a command id with another kind cannot join the first transaction", async () => {
+  const scheduler = new ManualScheduler();
+  const transport = new FakeTransport(scheduler);
+  const barrier = new Deferred<void>();
+  let heatCount = 0;
+  let otherCount = 0;
+  const session = new CultMeshProviderSession({
+    identity,
+    transport,
+    scheduler,
+    receiptStore: new CultMeshMemoryProviderReceiptStore(),
+    leaseDurationMs: 1_000,
+    renewalLeadMs: 200,
+    commandHandlers: {
+      "swarm.set_heat": async () => {
+        heatCount++;
+        await barrier.promise;
+        return { state: "applied" };
+      },
+      "swarm.other": async () => {
+        otherCount++;
+        return { state: "applied" };
+      },
+    },
+  });
+  await session.start();
+  const connection = transport.connections[0]!;
+  const first = connection.emit({
+    commandId: "collision-1",
+    commandKind: "swarm.set_heat",
+    providerId: identity.providerId,
+    serviceInstanceId: identity.serviceInstanceId,
+    payload: 0.5,
+  });
+  await settle();
+  await connection.emit({
+    commandId: "collision-1",
+    commandKind: "swarm.other",
+    providerId: identity.providerId,
+    serviceInstanceId: identity.serviceInstanceId,
+    payload: null,
+  });
+  assert.equal(session.state.status, "degraded");
+  barrier.resolve();
+  await first;
+  assert.equal(heatCount, 1);
+  assert.equal(otherCount, 0);
+  await session.stop();
+});
+
+test("registration failure closes the connection before retry", async () => {
+  const scheduler = new ManualScheduler();
+  const transport = new FakeTransport(scheduler);
+  transport.registerError = new Error("registration rejected");
+  const session = new CultMeshProviderSession({
+    identity,
+    transport,
+    scheduler,
+    receiptStore: new CultMeshMemoryProviderReceiptStore(),
+    leaseDurationMs: 1_000,
+    renewalLeadMs: 200,
+    reconnectBaseDelayMs: 100,
+  });
+  await session.start();
+  assert.equal(transport.connections[0]!.closed, true);
+  assert.equal(session.state.status, "reconnecting");
+  await session.stop();
+});
+
+test("an expired replay lease never carries the next pending receipt", async () => {
+  const scheduler = new ManualScheduler();
+  const transport = new FakeTransport(scheduler);
+  const receipts = new CultMeshMemoryProviderReceiptStore();
+  const pending = (commandId: string): CultMeshProviderCommandReceipt => ({
+    receiptId: `receipt:13:voidbot.swarm16:voidbot-worker-7${commandId.length}:${commandId}`,
+    commandId,
+    commandKind: "swarm.set_heat",
+    providerId: identity.providerId,
+    serviceInstanceId: identity.serviceInstanceId,
+    state: "applied",
+    completedAt: scheduler.now(),
+  });
+  await receipts.put(pending("one"));
+  await receipts.put(pending("two"));
+  const session = new CultMeshProviderSession({
+    identity,
+    transport,
+    scheduler,
+    receiptStore: receipts,
+    leaseDurationMs: 1_000,
+    renewalLeadMs: 200,
+    reconnectBaseDelayMs: 100,
+  });
+  transport.onFirstConnection = connection => {
+    connection.afterPublishReceipt = async () => scheduler.advance(1_001);
+  };
+
+  await session.start();
+  assert.equal(session.state.status, "reconnecting");
+  assert.deepEqual(
+    transport.connections[0]!.receipts.map(value => value.commandId),
+    ["one"],
+    "the expired lease is rejected before the next receipt",
+  );
+  assert.deepEqual((await receipts.listPending()).map(value => value.commandId), ["two"]);
+  await scheduler.advance(100);
+  assert.equal(session.state.status, "active");
+  assert.deepEqual(transport.connections[1]!.receipts.map(value => value.commandId), ["two"]);
+  assert.equal((await receipts.listPending()).length, 0);
+  await session.stop();
+});
+
+test("overlapping shutdown callers share cleanup and restart waits for its boundary", async () => {
+  const scheduler = new ManualScheduler();
+  const transport = new FakeTransport(scheduler);
+  const session = new CultMeshProviderSession({
+    identity,
+    transport,
+    scheduler,
+    receiptStore: new CultMeshMemoryProviderReceiptStore(),
+    leaseDurationMs: 1_000,
+    renewalLeadMs: 200,
+  });
+  await session.start();
+  const connection = transport.connections[0]!;
+  connection.withdrawBarrier = new Deferred<void>();
+
+  const firstStop = session.stop();
+  const secondStop = session.stop();
+  assert.equal(firstStop, secondStop, "concurrent callers own one shutdown operation");
+  await assert.rejects(session.start(), /shutdown is in progress/);
+  await settle();
+  assert.equal(connection.closed, false);
+  connection.withdrawBarrier.resolve();
+  await firstStop;
+  assert.equal(session.state.status, "stopped");
+
+  await session.start();
+  assert.equal(session.state.status, "active");
+  assert.equal(transport.connections.length, 2);
+  await session.stop();
+});
+
+test("loss cleanup failures cannot suppress reconnect scheduling", async () => {
+  const scheduler = new ManualScheduler();
+  const transport = new FakeTransport(scheduler);
+  const session = new CultMeshProviderSession({
+    identity,
+    transport,
+    scheduler,
+    receiptStore: new CultMeshMemoryProviderReceiptStore(),
+    leaseDurationMs: 1_000,
+    renewalLeadMs: 200,
+    reconnectBaseDelayMs: 100,
+  });
+  await session.start();
+  const connection = transport.connections[0]!;
+  connection.unsubscribeError = new Error("watch cleanup failed");
+  connection.closeError = new Error("route close failed");
+  connection.failNextPublish = new Error("route lost");
+
+  await session.upsertPublication(surface);
+  assert.equal(session.state.status, "reconnecting");
+  assert.match(session.state.lastError ?? "", /watch cleanup failed/);
+  assert.match(session.state.lastError ?? "", /route close failed/);
+  await scheduler.advance(100);
+  assert.equal(session.state.status, "active");
+  await session.stop();
+});
+
+test("stop during receipt replay cannot publish active state or leave a renewal timer", async () => {
+  const scheduler = new ManualScheduler();
+  const transport = new FakeTransport(scheduler);
+  const listBarrier = new Deferred<void>();
+  const states: string[] = [];
+  const session = new CultMeshProviderSession({
+    identity,
+    transport,
+    scheduler,
+    receiptStore: {
+      get: async () => undefined,
+      put: async () => undefined,
+      listPending: async () => {
+        await listBarrier.promise;
+        return [];
+      },
+      markPublished: async () => undefined,
+    },
+    leaseDurationMs: 1_000,
+    renewalLeadMs: 200,
+  });
+  session.watchState(state => states.push(state.status));
+  const starting = session.start();
+  await settle();
+  const stopping = session.stop();
+  await settle();
+  const withdrawingIndex = states.lastIndexOf("withdrawing");
+  listBarrier.resolve();
+  await Promise.all([starting, stopping]);
+
+  assert.equal(session.state.status, "stopped");
+  assert.equal(states.slice(withdrawingIndex + 1).includes("active"), false);
+  assert.equal(scheduler.pendingTaskCount, 0);
+});
+
+class ManualScheduler implements CultMeshProviderScheduler {
+  #nowMs = Date.parse("2026-07-14T00:00:00.000Z");
+  readonly #tasks: Array<{
+    dueAt: number;
+    cancelled: boolean;
+    action: () => void | Promise<void>;
+  }> = [];
+
+  public now(): Date {
+    return new Date(this.#nowMs);
+  }
+
+  public get pendingTaskCount(): number {
+    return this.#tasks.filter(value => !value.cancelled).length;
+  }
+
+  public schedule(delayMs: number, action: () => void | Promise<void>): CultMeshProviderScheduledTask {
+    const task = { dueAt: this.#nowMs + delayMs, cancelled: false, action };
+    this.#tasks.push(task);
+    return { cancel: () => { task.cancelled = true; } };
+  }
+
+  public async advance(delayMs: number): Promise<void> {
+    this.#nowMs += delayMs;
+    while (true) {
+      const task = this.#tasks
+        .filter(value => !value.cancelled && value.dueAt <= this.#nowMs)
+        .sort((left, right) => left.dueAt - right.dueAt)[0];
+      if (!task) return;
+      task.cancelled = true;
+      await task.action();
+    }
+  }
+}
+
+class FakeTransport implements CultMeshProviderTransport {
+  public failConnectCount = 0;
+  public registerBarrier?: Deferred<void>;
+  public registerError?: Error;
+  public publishBarrier?: Deferred<void>;
+  public onFirstConnection?: (connection: FakeConnection) => void;
+  public readonly connections: FakeConnection[] = [];
+
+  public constructor(private readonly scheduler: CultMeshProviderScheduler) {}
+
+  public async connect(
+    connectedIdentity: CultMeshProviderIdentity,
+    signal: AbortSignal,
+  ): Promise<CultMeshProviderConnection> {
+    assert.deepEqual(connectedIdentity, identity);
+    assert.equal(signal.aborted, false);
+    if (this.failConnectCount-- > 0) throw new Error("bootstrap unavailable");
+    const connection = new FakeConnection(this.scheduler);
+    connection.registerBarrier = this.registerBarrier;
+    connection.registerError = this.registerError;
+    connection.publishBarrier = this.publishBarrier;
+    this.connections.push(connection);
+    if (this.connections.length === 1) this.onFirstConnection?.(connection);
+    return connection;
+  }
+}
+
+class FakeConnection implements CultMeshProviderConnection {
+  public readonly registrations: CultMeshProviderRegistration[] = [];
+  public readonly renewals: CultMeshProviderLease[] = [];
+  public readonly publications: CultMeshProviderPublication[] = [];
+  public readonly withdrawnPublications: string[] = [];
+  public readonly receipts: CultMeshProviderCommandReceipt[] = [];
+  public readonly withdrawals: CultMeshProviderWithdrawal[] = [];
+  public failNextPublish?: Error;
+  public failNextReceipt?: Error;
+  public registerError?: Error;
+  public registerBarrier?: Deferred<void>;
+  public publishBarrier?: Deferred<void>;
+  public unsubscribeError?: Error;
+  public withdrawError?: Error;
+  public closeError?: Error;
+  public closeAttempts = 0;
+  public afterPublishReceipt?: () => void | Promise<void>;
+  public withdrawBarrier?: Deferred<void>;
+  public closed = false;
+  #listener?: CultMeshProviderCommandListener;
+  #leaseSequence = 0;
+
+  public constructor(private readonly scheduler: CultMeshProviderScheduler) {}
+
+  public async register(
+    registration: CultMeshProviderRegistration,
+    signal: AbortSignal,
+  ): Promise<CultMeshProviderLease> {
+    this.registrations.push(registration);
+    if (this.registerBarrier) {
+      await Promise.race([
+        this.registerBarrier.promise,
+        new Promise<never>((_resolve, reject) => {
+          signal.addEventListener("abort", () => reject(new Error("registration aborted")), { once: true });
+        }),
+      ]);
+    }
+    if (this.registerError) throw this.registerError;
+    return this.lease(registration.requestedLeaseDurationMs);
+  }
+
+  public async renew(lease: CultMeshProviderLease): Promise<CultMeshProviderLease> {
+    this.renewals.push(lease);
+    return this.lease(1_000);
+  }
+
+  public async publish(publication: CultMeshProviderPublication): Promise<void> {
+    if (this.failNextPublish) {
+      const error = this.failNextPublish;
+      this.failNextPublish = undefined;
+      throw error;
+    }
+    const barrier = this.publishBarrier;
+    this.publishBarrier = undefined;
+    await barrier?.promise;
+    this.publications.push(publication);
+  }
+
+  public async withdrawPublication(publicationId: string): Promise<void> {
+    this.withdrawnPublications.push(publicationId);
+  }
+
+  public watchCommands(listener: CultMeshProviderCommandListener): CultMeshProviderUnsubscribe {
+    this.#listener = listener;
+    return () => {
+      this.#listener = undefined;
+      if (this.unsubscribeError) throw this.unsubscribeError;
+    };
+  }
+
+  public async publishReceipt(receipt: CultMeshProviderCommandReceipt): Promise<void> {
+    if (this.failNextReceipt) {
+      const error = this.failNextReceipt;
+      this.failNextReceipt = undefined;
+      throw error;
+    }
+    this.receipts.push(receipt);
+    const afterPublish = this.afterPublishReceipt;
+    this.afterPublishReceipt = undefined;
+    await afterPublish?.();
+  }
+
+  public async withdraw(withdrawal: CultMeshProviderWithdrawal): Promise<void> {
+    this.withdrawals.push(withdrawal);
+    await this.withdrawBarrier?.promise;
+    if (this.withdrawError) throw this.withdrawError;
+  }
+
+  public close(): void {
+    this.closeAttempts++;
+    this.closed = true;
+    if (this.closeError) throw this.closeError;
+  }
+
+  public async emit(command: CultMeshProviderCommand): Promise<void> {
+    await this.#listener?.(command);
+  }
+
+  private lease(durationMs: number): CultMeshProviderLease {
+    this.#leaseSequence++;
+    return {
+      leaseId: `lease-${this.#leaseSequence}`,
+      expiresAt: new Date(this.scheduler.now().getTime() + durationMs),
+    };
+  }
+}
+
+async function settle(): Promise<void> {
+  await new Promise<void>(resolve => setImmediate(resolve));
+}
+
+class Deferred<T> {
+  public readonly promise: Promise<T>;
+  #resolve!: (value: T | PromiseLike<T>) => void;
+
+  public constructor() {
+    this.promise = new Promise<T>(resolve => { this.#resolve = resolve; });
+  }
+
+  public resolve(value?: T): void {
+    this.#resolve(value as T);
+  }
+}
diff --git a/packages/cultnet-py/README.md b/packages/cultnet-py/README.md
new file mode 100644
index 00000000..cca39ba7
--- /dev/null
+++ b/packages/cultnet-py/README.md
@@ -0,0 +1,156 @@
+# cultnet-py
+
+`cultnet-py` is the Python CultNet runtime: schema-v0 MessagePack wire helpers,
+4-byte big-endian framing, the raw client, database subscriptions, shard
+catch-up and replication, simulation observations and consensus, witness
+artifact bundles, the RUDP codec/session/socket transport, and the CultMesh
+wire contracts that both a node and a bare peer have to agree on.
+
+It depends on `cultcache-py` and `msgpack`; AES-GCM helpers on `CultNetSecret`
+light up with the optional `crypto` extra. `cultmesh-py` builds on it. The
+layering mirrors `cultnet-rs` and `cultnet-ts`.
+
+## Example
+
+```python
+from datetime import UTC, datetime
+
+from cultnet_py import (
+    CultNetSecret,
+    CultNetServerSecurityOptions,
+    CultNetRawClient,
+    CultNetSimulationObservation,
+    CultNetWitnessArtifactBundle,
+    apply_raw_snapshot,
+    apply_shard_log_response,
+    compute_simulation_claim_hash,
+    database_subscribe,
+    decode_frame,
+    encode_frame,
+    hello,
+    parse_message,
+    shard_catalog_request,
+    simulation_observation,
+    witness_artifact_bundle,
+)
+
+payload = hello(runtime_id="python-runtime").to_bytes()
+message = parse_message(decode_frame(encode_frame(payload)))
+
+client = CultNetRawClient("127.0.0.1", 3075)
+catalog = client.fetch_schema_catalog(kinds=["wire_message"])
+snapshot = client.fetch_snapshot_response(schema_ids=["cultnet.interop-note"])
+shard_catalog = client.fetch_shard_catalog(schema_ids=["cultnet.interop-note"])
+# With a local CultCache and the matching registered document definitions:
+# applied = apply_raw_snapshot(cache, [note_doc], snapshot)
+
+subscription = database_subscribe(subscription_id="ui", schema_ids=["cultnet.interop-note"])
+shard_request = shard_catalog_request(message_id="shards", schema_ids=["cultnet.interop-note"])
+shard_log = client.fetch_shard_log_response(shard_id="interop", shard_epoch=1, after_sequence=0)
+# log_changes = apply_shard_log_response(cache, [note_doc], shard_log)
+with client.subscribe_database(subscription_id="ui", schema_ids=["cultnet.interop-note"]) as live:
+    initial_snapshot = live.read_next_snapshot_response()
+
+claim_hash = compute_simulation_claim_hash("frame:42", "subject:player-1", "hit")
+observation = simulation_observation(
+    message_id="obs-1",
+    witness_runtime_id="python-runtime",
+    shard_id="interop",
+    shard_epoch=1,
+    frame=42,
+    subject_id="player-1",
+    claim_kind="hit",
+    claim_hash=claim_hash,
+)
+typed_observation = CultNetSimulationObservation.from_wire(observation.to_wire())
+witness = witness_artifact_bundle(
+    bundle_id="bundle-1",
+    witness_kind="interop-proof",
+    captured_at="2026-06-13T00:00:00Z",
+    subject={"documentType": "cultnet.interop-note", "subjectId": "note:python"},
+    contracts=[{"role": "payload", "schemaId": "cultnet.interop-note"}],
+    artifacts=[{"role": "log", "uri": "cultcache://bundle-1/log", "mediaType": "text/plain"}],
+    provenance={"pipelineId": "interop", "runId": "run-1", "runtimeId": "python-runtime"},
+)
+typed_witness = CultNetWitnessArtifactBundle.from_wire(witness)
+witness_payload = typed_witness.to_payload()
+
+security = CultNetServerSecurityOptions.development()
+token = CultNetSecret.create_session_token(
+    "318fb4b6-ff5e-4c4f-b911-d81807de53a8",
+    datetime(2035, 1, 1, tzinfo=UTC),
+    security,
+    session_version=1,
+)
+session = CultNetSecret.try_validate_session_token(token, security)
+```
+
+The raw-client request surface can ride RUDP when the peer advertises a
+`rudp://` endpoint and shares the connection id for that lane;
+`create_rudp_schema_transport(...)` builds that transport, and
+`cultmesh_py.CultMesh.create_client(endpoint="rudp://...")` selects it from an
+endpoint string.
+
+## CultMesh wire contracts
+
+`cultnet_py.cultmesh_contracts` carries the Verse catalog, peer exchange,
+authority lease, stream negotiation, and committed simulation fact contracts.
+They live here rather than in `cultmesh-py` for the same reason
+`CultMeshPeerCard` lives in `cultnet-rs`: the interop peer has to speak them
+without owning a node. `cultmesh_py` re-exports every one of them, so callers
+that already import from there keep working.
+
+## RUDP
+
+`CultNetRudpSession` is the shared reliable/unreliable/sequenced/ordered
+session over the RUDP packet codec, with fragmentation above
+`max_fragment_bytes`, a bounded reliable window, reliable expiry, and a
+bounded fragment reassembly map that evicts the oldest stranded set and counts
+it in `fragment_sets_evicted` rather than refusing new payloads. The
+socket-backed transport, reconnect policy/controller, and reconnect loop follow
+the Rust and TypeScript entrypoint pattern.
+
+## Interop peer
+
+The peer can serve, dial, and probe the same raw-state interop lane used by the
+TypeScript, Rust, and C# test peers, and answers Verse catalog and peer exchange
+requests without a CultMesh node:
+
+```powershell
+python -m cultnet_py.interop_peer serve --runtime-id python-peer --runtime-kind python --display-name "Python Peer" --agent-id python-agent --advertise-host 127.0.0.1 --tcp-port 3075 --discovery-port 4075 --discovery-group 239.77.44.11 --schema-path ..\cultnet-ts\integration\contracts\cultnet.interop-note.schema.json
+python -m cultnet_py.interop_peer dial --runtime-id python-client --runtime-kind python --display-name "Python Client" --agent-id python-client --target-host 127.0.0.1 --target-port 3075 --schema-path ..\cultnet-ts\integration\contracts\cultnet.interop-note.schema.json
+python -m cultnet_py.interop_peer probe --runtime-id python-prober --discovery-port 4075 --discovery-group 239.77.44.11
+```
+
+`packages/cultnet-ts/test/interop/cultnet-interop.test.ts` drives it inside the
+live TS/Rust/C#/Python peer ring.
+
+## Performance baseline
+
+The package ships a lightweight benchmark for Python-owned hot paths. In a
+CultLib source checkout, it can also run the C# reference benchmark beside it:
+
+```powershell
+python -m cultnet_py.benchmark --records 1000 --json
+python -m cultnet_py.compare_csharp --records 1000 --json
+```
+
+It reports slot-indexed `DatabaseEntry` encode/decode throughput, framed
+CultNet MessagePack parse throughput, raw snapshot application into a
+registered cache, and public `CultCache` upsert/get throughput. The C# compare
+command also runs `packages/cultnet-py/tools/GameCult.Caching.Benchmark` and
+reports median Python-to-C# ratios for the shared public cache operations. It
+uses three samples by default; pass `--samples` when you need a different
+evidence shape. Treat the numbers as a local baseline, not a claim that Python
+matches the C# reference in every workload.
+
+## Tests
+
+```powershell
+$env:PYTHONPATH="$PWD\packages\cultcache-py\src;$PWD\packages\cultnet-py\src"
+python -m unittest discover -s packages\cultnet-py\tests
+```
+
+The suite runs without `cultmesh_py` on the path. See
+[docs/python-runtime-parity.md](../../docs/python-runtime-parity.md) for the
+evidence map across the three Python packages.
diff --git a/packages/cultnet-py/pyproject.toml b/packages/cultnet-py/pyproject.toml
new file mode 100644
index 00000000..41c4e8f6
--- /dev/null
+++ b/packages/cultnet-py/pyproject.toml
@@ -0,0 +1,32 @@
+[build-system]
+requires = ["setuptools>=68"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "cultnet-py"
+version = "0.1.0"
+description = "Python CultNet transport, wire contracts, and replication for GameCult typed state."
+readme = "README.md"
+requires-python = ">=3.10"
+license = "MIT"
+authors = [{ name = "GameCult" }]
+classifiers = [
+  "Programming Language :: Python :: 3",
+  "Programming Language :: Python :: 3.10",
+  "Programming Language :: Python :: 3.11",
+  "Programming Language :: Python :: 3.12",
+]
+dependencies = ["cultcache-py>=0.2.0", "msgpack>=1.0"]
+[project.optional-dependencies]
+crypto = ["cryptography>=42"]
+
+[project.scripts]
+cultnet-py-interop = "cultnet_py.interop_peer:main"
+cultnet-py-benchmark = "cultnet_py.benchmark:main"
+cultnet-py-compare-csharp = "cultnet_py.compare_csharp:main"
+
+[tool.setuptools.packages.find]
+where = ["src"]
+
+[tool.setuptools.package-data]
+cultnet_py = ["py.typed"]
diff --git a/packages/cultcache-py/src/cultnet_py/__init__.py b/packages/cultnet-py/src/cultnet_py/__init__.py
similarity index 78%
rename from packages/cultcache-py/src/cultnet_py/__init__.py
rename to packages/cultnet-py/src/cultnet_py/__init__.py
index 5a842dbe..b1734f25 100644
--- a/packages/cultcache-py/src/cultnet_py/__init__.py
+++ b/packages/cultnet-py/src/cultnet_py/__init__.py
@@ -7,6 +7,34 @@ from .client import (
     create_rudp_schema_transport,
     create_tcp_framed_schema_transport,
 )
+from .cultmesh_contracts import (
+    PEER_EXCHANGE_REQUEST,
+    PEER_EXCHANGE_RESPONSE,
+    SIMULATION_FACT_DOCUMENT_TYPE,
+    SIMULATION_FACT_SCHEMA_VERSION,
+    VERSE_CATALOG_REQUEST,
+    VERSE_CATALOG_RESPONSE,
+    AuthorityLeaseVerifier,
+    CultMeshAuthorityLease,
+    CultMeshAuthorityLeaseCatalog,
+    CultMeshHmacAuthorityLeaseVerifier,
+    CultMeshPeerCard,
+    CultMeshPeerCatalog,
+    CultMeshSimulationFact,
+    CultMeshStreamCatalog,
+    CultMeshStreamConsumerProfile,
+    CultMeshStreamDescriptor,
+    CultMeshStreamFrameHandle,
+    CultMeshStreamNegotiation,
+    CultMeshVerseCatalog,
+    CultMeshVerseCompatibility,
+    CultMeshVerseDescriptor,
+    peer_exchange_request,
+    peer_from_wire,
+    simulation_fact_document,
+    verse_catalog_request,
+    verse_from_wire,
+)
 from .framing import decode_frame, encode_frame, read_frame, write_frame
 from .messages import (
     CultNetMessage,
@@ -37,6 +65,7 @@ from .replication import (
     apply_raw_document_record,
     apply_raw_snapshot,
     apply_shard_log_response,
+    resolve_document_and_schema_id_for_raw_record,
     schema_document_map,
 )
 from .schema_catalog import (
@@ -107,6 +136,32 @@ from .simulation import (
 )
 
 __all__ = [
+    "PEER_EXCHANGE_REQUEST",
+    "PEER_EXCHANGE_RESPONSE",
+    "SIMULATION_FACT_DOCUMENT_TYPE",
+    "SIMULATION_FACT_SCHEMA_VERSION",
+    "VERSE_CATALOG_REQUEST",
+    "VERSE_CATALOG_RESPONSE",
+    "AuthorityLeaseVerifier",
+    "CultMeshAuthorityLease",
+    "CultMeshAuthorityLeaseCatalog",
+    "CultMeshHmacAuthorityLeaseVerifier",
+    "CultMeshPeerCard",
+    "CultMeshPeerCatalog",
+    "CultMeshSimulationFact",
+    "CultMeshStreamCatalog",
+    "CultMeshStreamConsumerProfile",
+    "CultMeshStreamDescriptor",
+    "CultMeshStreamFrameHandle",
+    "CultMeshStreamNegotiation",
+    "CultMeshVerseCatalog",
+    "CultMeshVerseCompatibility",
+    "CultMeshVerseDescriptor",
+    "peer_exchange_request",
+    "peer_from_wire",
+    "simulation_fact_document",
+    "verse_catalog_request",
+    "verse_from_wire",
     "CultNetMessage",
     "CultNetWitnessArtifactBundle",
     "CultNetDatabaseSubscription",
@@ -168,6 +223,7 @@ __all__ = [
     "apply_raw_document_record",
     "apply_raw_snapshot",
     "apply_shard_log_response",
+    "resolve_document_and_schema_id_for_raw_record",
     "compute_simulation_claim_hash",
     "compute_reconnect_delay_ms",
     "create_reconnect_policy",
diff --git a/packages/cultcache-py/src/cultcache_py/benchmark.py b/packages/cultnet-py/src/cultnet_py/benchmark.py
similarity index 98%
rename from packages/cultcache-py/src/cultcache_py/benchmark.py
rename to packages/cultnet-py/src/cultnet_py/benchmark.py
index a444acd9..83834635 100644
--- a/packages/cultcache-py/src/cultcache_py/benchmark.py
+++ b/packages/cultnet-py/src/cultnet_py/benchmark.py
@@ -19,7 +19,7 @@ class BenchItem:
 
 
 def main(argv: list[str] | None = None) -> int:
-    parser = argparse.ArgumentParser(prog="cultcache-py-benchmark")
+    parser = argparse.ArgumentParser(prog="cultnet-py-benchmark")
     parser.add_argument("--records", type=int, default=5000)
     parser.add_argument("--json", action="store_true", dest="as_json")
     args = parser.parse_args(argv)
diff --git a/packages/cultcache-py/src/cultnet_py/client.py b/packages/cultnet-py/src/cultnet_py/client.py
similarity index 100%
rename from packages/cultcache-py/src/cultnet_py/client.py
rename to packages/cultnet-py/src/cultnet_py/client.py
diff --git a/packages/cultcache-py/src/cultcache_py/compare_csharp.py b/packages/cultnet-py/src/cultnet_py/compare_csharp.py
similarity index 99%
rename from packages/cultcache-py/src/cultcache_py/compare_csharp.py
rename to packages/cultnet-py/src/cultnet_py/compare_csharp.py
index 8a9e4c5b..a2654a33 100644
--- a/packages/cultcache-py/src/cultcache_py/compare_csharp.py
+++ b/packages/cultnet-py/src/cultnet_py/compare_csharp.py
@@ -16,7 +16,7 @@ DEFAULT_PARITY_THRESHOLD = 0.90
 
 
 def main(argv: list[str] | None = None) -> int:
-    parser = argparse.ArgumentParser(prog="cultcache-py-compare-csharp")
+    parser = argparse.ArgumentParser(prog="cultnet-py-compare-csharp")
     parser.add_argument("--records", type=int, default=5000)
     parser.add_argument("--samples", type=int, default=DEFAULT_SAMPLE_COUNT)
     parser.add_argument("--parity-threshold", type=float, default=DEFAULT_PARITY_THRESHOLD)
diff --git a/packages/cultcache-py/src/cultmesh_py/wire.py b/packages/cultnet-py/src/cultnet_py/cultmesh_contracts.py
similarity index 84%
rename from packages/cultcache-py/src/cultmesh_py/wire.py
rename to packages/cultnet-py/src/cultnet_py/cultmesh_contracts.py
index 9a666a1e..91d0805b 100644
--- a/packages/cultcache-py/src/cultmesh_py/wire.py
+++ b/packages/cultnet-py/src/cultnet_py/cultmesh_contracts.py
@@ -1,14 +1,18 @@
 from __future__ import annotations
 
 import base64
+import hashlib
 import hmac
 from dataclasses import dataclass, field, replace
-from datetime import datetime
+from datetime import UTC, datetime
 from hashlib import sha256
 from typing import Any, Callable, Mapping
 
 import msgpack
 
+from cultcache_py import define_database_entry_type
+from cultcache_py.documents import DocumentDefinition
+
 
 VERSE_CATALOG_REQUEST = "cultmesh.verse_catalog_request.v0"
 VERSE_CATALOG_RESPONSE = "cultmesh.verse_catalog_response.v0"
@@ -613,3 +617,104 @@ def copy_budget_for(transport: str) -> str:
     if transport == "inline-bytes":
         return "opaque-runtime"
     return "opaque-runtime"
+
+
+SIMULATION_FACT_DOCUMENT_TYPE = "gamecult.mesh.simulation_fact"
+SIMULATION_FACT_SCHEMA_VERSION = "gamecult.mesh.simulation_fact.v1"
+
+
+@dataclass(frozen=True)
+class CultMeshSimulationFact:
+    fact_id: str
+    shard_id: str
+    shard_epoch: int
+    frame: int
+    subject_id: str
+    claim_kind: str
+    claim_hash: str
+    claim_summary: str | None
+    witness_count: int
+    support_weight: float
+    total_weight: float
+    confidence: float
+    committed_at: str
+
+    @staticmethod
+    def compute_fact_id(candidate: dict[str, Any]) -> str:
+        canonical = "\x1f".join([
+            _candidate_string(candidate, "shardId", "shard_id"),
+            str(_candidate_int(candidate, "shardEpoch", "shard_epoch")),
+            str(_candidate_int(candidate, "frame", "frame")),
+            _candidate_string(candidate, "subjectId", "subject_id"),
+            _candidate_string(candidate, "claimKind", "claim_kind"),
+        ])
+        return hashlib.sha256(canonical.encode("utf-8")).hexdigest()
+
+    @staticmethod
+    def create_record_key(candidate: dict[str, Any]) -> str:
+        return f"simulation:{CultMeshSimulationFact.compute_fact_id(candidate)}"
+
+    @staticmethod
+    def from_candidate(candidate: dict[str, Any], *, committed_at: str | None = None) -> "CultMeshSimulationFact":
+        return CultMeshSimulationFact(
+            fact_id=CultMeshSimulationFact.compute_fact_id(candidate),
+            shard_id=_candidate_string(candidate, "shardId", "shard_id"),
+            shard_epoch=_candidate_int(candidate, "shardEpoch", "shard_epoch"),
+            frame=_candidate_int(candidate, "frame", "frame"),
+            subject_id=_candidate_string(candidate, "subjectId", "subject_id"),
+            claim_kind=_candidate_string(candidate, "claimKind", "claim_kind"),
+            claim_hash=_candidate_string(candidate, "claimHash", "claim_hash"),
+            claim_summary=_candidate_optional_string(candidate, "claimSummary", "claim_summary"),
+            witness_count=_candidate_int(candidate, "witnessCount", "witness_count"),
+            support_weight=_candidate_float(candidate, "supportWeight", "support_weight"),
+            total_weight=_candidate_float(candidate, "totalWeight", "total_weight"),
+            confidence=_candidate_float(candidate, "confidence", "confidence"),
+            committed_at=committed_at or datetime.now(UTC).isoformat(),
+        )
+
+
+simulation_fact_document: DocumentDefinition[CultMeshSimulationFact] = define_database_entry_type(
+    SIMULATION_FACT_DOCUMENT_TYPE,
+    [
+        ("fact_id", 0),
+        ("shard_id", 1),
+        ("shard_epoch", 2),
+        ("frame", 3),
+        ("subject_id", 4),
+        ("claim_kind", 5),
+        ("claim_hash", 6),
+        ("claim_summary", 7, None),
+        ("witness_count", 8),
+        ("support_weight", 9),
+        ("total_weight", 10),
+        ("confidence", 11),
+        ("committed_at", 12),
+    ],
+    cls=CultMeshSimulationFact,
+    name="fact_id",
+    indexes={"shard": "shard_id", "frame": "frame", "subject": "subject_id", "claim_kind": "claim_kind"},
+    schema_name=SIMULATION_FACT_DOCUMENT_TYPE,
+    schema_version=SIMULATION_FACT_SCHEMA_VERSION,
+)
+
+
+def _candidate_string(candidate: dict[str, Any], camel: str, snake: str) -> str:
+    value = candidate.get(camel, candidate.get(snake, ""))
+    if value is None:
+        return ""
+    return str(value)
+
+
+def _candidate_optional_string(candidate: dict[str, Any], camel: str, snake: str) -> str | None:
+    value = candidate.get(camel, candidate.get(snake))
+    if value is None:
+        return None
+    return str(value)
+
+
+def _candidate_int(candidate: dict[str, Any], camel: str, snake: str) -> int:
+    return int(candidate.get(camel, candidate.get(snake, 0)))
+
+
+def _candidate_float(candidate: dict[str, Any], camel: str, snake: str) -> float:
+    return float(candidate.get(camel, candidate.get(snake, 0.0)))
diff --git a/packages/cultcache-py/src/cultnet_py/framing.py b/packages/cultnet-py/src/cultnet_py/framing.py
similarity index 100%
rename from packages/cultcache-py/src/cultnet_py/framing.py
rename to packages/cultnet-py/src/cultnet_py/framing.py
diff --git a/packages/cultcache-py/src/cultnet_py/interop_peer.py b/packages/cultnet-py/src/cultnet_py/interop_peer.py
similarity index 99%
rename from packages/cultcache-py/src/cultnet_py/interop_peer.py
rename to packages/cultnet-py/src/cultnet_py/interop_peer.py
index d26f1b70..ca3c692d 100644
--- a/packages/cultcache-py/src/cultnet_py/interop_peer.py
+++ b/packages/cultnet-py/src/cultnet_py/interop_peer.py
@@ -24,7 +24,7 @@ from cultcache_py import (
     define_document_type,
 )
 from cultcache_py.documents import DocumentDefinition
-from cultmesh_py import (
+from .cultmesh_contracts import (
     PEER_EXCHANGE_REQUEST,
     SIMULATION_FACT_DOCUMENT_TYPE,
     VERSE_CATALOG_REQUEST,
@@ -306,6 +306,8 @@ def rudp_loop(
             result = peer.session.receive(packet, now_ms())
             if result.reply is not None:
                 send_rudp_packet(sock, remote, result.reply)
+            for ready in result.ready_to_send:
+                send_rudp_packet(sock, remote, ready)
             if result.disconnected:
                 peers.pop(remote, None)
                 continue
@@ -317,8 +319,8 @@ def rudp_loop(
                     continue
                 for response in handle_server_message(state, message, peer.subscriptions):
                     send_rudp_schema_frame(sock, remote, peer.session, response)
-            if packet.packet_type == CultNetRudpPacketType.DATA or result.delivered:
-                send_rudp_packet(sock, remote, peer.session.create_ack())
+            if packet.reliable or packet.packet_type == CultNetRudpPacketType.DATA or result.delivered:
+                send_rudp_packet(sock, remote, peer.session.create_ack_for_received(packet.sequence))
         except Exception as error:
             sys.stderr.write(json.dumps({
                 "event": "rudpMessageError",
diff --git a/packages/cultcache-py/src/cultnet_py/messages.py b/packages/cultnet-py/src/cultnet_py/messages.py
similarity index 100%
rename from packages/cultcache-py/src/cultnet_py/messages.py
rename to packages/cultnet-py/src/cultnet_py/messages.py
diff --git a/packages/cultcache-py/src/cultnet_py/prediction.py b/packages/cultnet-py/src/cultnet_py/prediction.py
similarity index 100%
rename from packages/cultcache-py/src/cultnet_py/prediction.py
rename to packages/cultnet-py/src/cultnet_py/prediction.py
diff --git a/packages/cultcache-py/src/cultnet_py/py.typed b/packages/cultnet-py/src/cultnet_py/py.typed
similarity index 100%
rename from packages/cultcache-py/src/cultnet_py/py.typed
rename to packages/cultnet-py/src/cultnet_py/py.typed
diff --git a/packages/cultcache-py/src/cultnet_py/replication.py b/packages/cultnet-py/src/cultnet_py/replication.py
similarity index 62%
rename from packages/cultcache-py/src/cultnet_py/replication.py
rename to packages/cultnet-py/src/cultnet_py/replication.py
index 7290a434..6450d4f9 100644
--- a/packages/cultcache-py/src/cultnet_py/replication.py
+++ b/packages/cultnet-py/src/cultnet_py/replication.py
@@ -23,6 +23,8 @@ def schema_document_map(documents: Iterable[DocumentDefinition[Any]]) -> dict[st
     for document in documents:
         catalog_entry = document.catalog_entry()
         mapped[catalog_entry.schema_id] = document
+        mapped[catalog_entry.schema_name] = document
+        mapped[catalog_entry.schema_version] = document
         for compatible_schema_id in catalog_entry.compatible_schema_ids:
             mapped[compatible_schema_id] = document
     return mapped
@@ -35,11 +37,15 @@ def apply_raw_document_record(
 ) -> CultNetAppliedRecord:
     wire = record.to_wire() if isinstance(record, CultNetRawDocumentRecord) else record
     schema_id = str(wire["schemaId"])
-    document = documents_by_schema_id[schema_id]
-    envelope = raw_record_to_envelope(document, schema_id, wire)
+    document, resolved_schema_id = resolve_document_and_schema_id_for_raw_record(
+        documents_by_schema_id,
+        schema_id,
+        wire,
+    )
+    envelope = raw_record_to_envelope(document, resolved_schema_id, wire)
     value = cache.put_envelope(document, envelope)
     return CultNetAppliedRecord(
-        schema_id=schema_id,
+        schema_id=resolved_schema_id,
         record_key=envelope.key,
         change_kind="added",
         value=value,
@@ -76,11 +82,15 @@ def apply_raw_snapshot(
         if not isinstance(record, dict):
             continue
         schema_id = str(record["schemaId"])
-        document = documents_by_schema_id[schema_id]
-        envelope = raw_record_to_envelope(document, schema_id, record)
+        document, resolved_schema_id = resolve_document_and_schema_id_for_raw_record(
+            documents_by_schema_id,
+            schema_id,
+            record,
+        )
+        envelope = raw_record_to_envelope(document, resolved_schema_id, record)
         batch = batches.setdefault(document.type, (document, []))
-        batch[1].append((schema_id, envelope))
-        order.append((document, schema_id, envelope))
+        batch[1].append((resolved_schema_id, envelope))
+        order.append((document, resolved_schema_id, envelope))
 
     values_by_key: dict[tuple[str, str], Any] = {}
     for document, entries in batches.values():
@@ -120,7 +130,7 @@ def apply_shard_log_response(
         if change_kind in ("added", "updated") and isinstance(entry.get("put"), dict):
             put = entry["put"]
             schema_id = str(put["document"]["schemaId"])
-            if schema_id not in documents_by_schema_id:
+            if not can_resolve_document_for_raw_record(documents_by_schema_id, schema_id, put["document"]):
                 continue
             result = apply_raw_document_record(cache, documents_by_schema_id, put["document"])
             applied.append(CultNetAppliedRecord(result.schema_id, result.record_key, str(change_kind), result.value))
@@ -131,6 +141,67 @@ def apply_shard_log_response(
             if schema_id not in documents_by_schema_id:
                 continue
             document = documents_by_schema_id[schema_id]
+            resolved_schema_id = document.catalog_entry().schema_id
             cache.delete(document, record_key)
-            applied.append(CultNetAppliedRecord(schema_id, record_key, "removed", None))
+            applied.append(CultNetAppliedRecord(resolved_schema_id, record_key, "removed", None))
     return applied
+
+
+def can_resolve_document_for_raw_record(
+    documents_by_schema_id: dict[str, DocumentDefinition[Any]],
+    schema_id: str,
+    record: dict[str, Any],
+) -> bool:
+    try:
+        resolve_document_for_raw_record(documents_by_schema_id, schema_id, record)
+        return True
+    except KeyError:
+        return False
+
+
+def resolve_document_for_raw_record(
+    documents_by_schema_id: dict[str, DocumentDefinition[Any]],
+    schema_id: str,
+    record: dict[str, Any],
+) -> DocumentDefinition[Any]:
+    return resolve_document_and_schema_id_for_raw_record(documents_by_schema_id, schema_id, record)[0]
+
+
+def resolve_document_and_schema_id_for_raw_record(
+    documents_by_schema_id: dict[str, DocumentDefinition[Any]],
+    schema_id: str,
+    record: dict[str, Any],
+) -> tuple[DocumentDefinition[Any], str]:
+    document = documents_by_schema_id.get(schema_id)
+    if document is not None:
+        return document, schema_id
+    schema_version = _infer_schema_version_from_payload(bytes(record["payload"]))
+    schema_name = _infer_schema_name(schema_version) if schema_version is not None else None
+    if schema_name is not None and schema_name in documents_by_schema_id:
+        document = documents_by_schema_id[schema_name]
+        return document, document.catalog_entry().schema_id
+    raise KeyError(schema_id)
+
+
+def _infer_schema_version_from_payload(payload: bytes) -> str | None:
+    try:
+        import msgpack  # type: ignore
+        decoded = msgpack.unpackb(payload, raw=False)
+    except Exception:
+        return None
+    if isinstance(decoded, list) and decoded and isinstance(decoded[0], str):
+        return decoded[0]
+    if isinstance(decoded, dict):
+        value = decoded.get("schemaVersion", decoded.get("schema_version"))
+        return value if isinstance(value, str) else None
+    return None
+
+
+def _infer_schema_name(schema_version: str) -> str | None:
+    marker = schema_version.rfind(".v")
+    if marker <= 0:
+        return None
+    version = schema_version[marker + 2:]
+    if not version or not version.isdigit():
+        return None
+    return schema_version[:marker]
diff --git a/packages/cultcache-py/src/cultnet_py/schema_catalog.py b/packages/cultnet-py/src/cultnet_py/schema_catalog.py
similarity index 100%
rename from packages/cultcache-py/src/cultnet_py/schema_catalog.py
rename to packages/cultnet-py/src/cultnet_py/schema_catalog.py
diff --git a/packages/cultcache-py/src/cultnet_py/security.py b/packages/cultnet-py/src/cultnet_py/security.py
similarity index 100%
rename from packages/cultcache-py/src/cultnet_py/security.py
rename to packages/cultnet-py/src/cultnet_py/security.py
diff --git a/packages/cultcache-py/src/cultnet_py/shard_catalog.py b/packages/cultnet-py/src/cultnet_py/shard_catalog.py
similarity index 84%
rename from packages/cultcache-py/src/cultnet_py/shard_catalog.py
rename to packages/cultnet-py/src/cultnet_py/shard_catalog.py
index 951ad5b7..4335f617 100644
--- a/packages/cultcache-py/src/cultnet_py/shard_catalog.py
+++ b/packages/cultnet-py/src/cultnet_py/shard_catalog.py
@@ -60,7 +60,7 @@ class CultNetShardDescriptor:
         return wire
 
     def serves(self, *, schema_id: str | None = None, record_key: str | None = None) -> bool:
-        if schema_id is not None and self.schema_ids and schema_id not in self.schema_ids:
+        if schema_id is not None and self.schema_ids and not _schema_ids_match_any(self.schema_ids, (schema_id,)):
             return False
         if record_key is not None and self.key_prefix and not record_key.startswith(self.key_prefix):
             return False
@@ -122,13 +122,38 @@ def _shard_matches(
     requested_schema_ids: set[str],
     requested_record_keys: list[str],
 ) -> bool:
-    if requested_schema_ids and not any(schema_id in shard.schema_ids for schema_id in requested_schema_ids):
+    if requested_schema_ids and not _schema_ids_match_any(shard.schema_ids, requested_schema_ids):
         return False
     if requested_record_keys and not any(shard.serves(record_key=record_key) for record_key in requested_record_keys):
         return False
     return True
 
 
+def _schema_ids_match_any(
+    advertised_schema_ids: tuple[str, ...],
+    requested_schema_ids: set[str] | tuple[str, ...],
+) -> bool:
+    return any(
+        _schema_ids_match(advertised, requested)
+        for advertised in advertised_schema_ids
+        for requested in requested_schema_ids
+    )
+
+
+def _schema_ids_match(left: str, right: str) -> bool:
+    if left == right:
+        return True
+    return (_infer_schema_name(left) or left) == (_infer_schema_name(right) or right)
+
+
+def _infer_schema_name(schema_id: str) -> str | None:
+    marker = schema_id.rfind(".v")
+    if marker <= 0 or marker + 2 >= len(schema_id):
+        return None
+    version = schema_id[marker + 2:]
+    return schema_id[:marker] if version.isdigit() else None
+
+
 def _string_tuple(value: Any) -> tuple[str, ...]:
     return tuple(str(item) for item in value or [])
 
diff --git a/packages/cultcache-py/src/cultnet_py/shard_log.py b/packages/cultnet-py/src/cultnet_py/shard_log.py
similarity index 100%
rename from packages/cultcache-py/src/cultnet_py/shard_log.py
rename to packages/cultnet-py/src/cultnet_py/shard_log.py
diff --git a/packages/cultcache-py/src/cultnet_py/shard_replication.py b/packages/cultnet-py/src/cultnet_py/shard_replication.py
similarity index 100%
rename from packages/cultcache-py/src/cultnet_py/shard_replication.py
rename to packages/cultnet-py/src/cultnet_py/shard_replication.py
diff --git a/packages/cultcache-py/src/cultnet_py/simulation.py b/packages/cultnet-py/src/cultnet_py/simulation.py
similarity index 100%
rename from packages/cultcache-py/src/cultnet_py/simulation.py
rename to packages/cultnet-py/src/cultnet_py/simulation.py
diff --git a/packages/cultcache-py/src/cultnet_py/snapshot.py b/packages/cultnet-py/src/cultnet_py/snapshot.py
similarity index 100%
rename from packages/cultcache-py/src/cultnet_py/snapshot.py
rename to packages/cultnet-py/src/cultnet_py/snapshot.py
diff --git a/packages/cultcache-py/src/cultnet_py/subscription.py b/packages/cultnet-py/src/cultnet_py/subscription.py
similarity index 100%
rename from packages/cultcache-py/src/cultnet_py/subscription.py
rename to packages/cultnet-py/src/cultnet_py/subscription.py
diff --git a/packages/cultcache-py/src/cultnet_py/transport.py b/packages/cultnet-py/src/cultnet_py/transport.py
similarity index 82%
rename from packages/cultcache-py/src/cultnet_py/transport.py
rename to packages/cultnet-py/src/cultnet_py/transport.py
index 25a4c891..73bd1e62 100644
--- a/packages/cultcache-py/src/cultnet_py/transport.py
+++ b/packages/cultnet-py/src/cultnet_py/transport.py
@@ -280,6 +280,7 @@ class CultNetRudpDeliveredFrame:
 @dataclass(frozen=True)
 class CultNetRudpReceiveResult:
     delivered: tuple[CultNetRudpDeliveredFrame, ...] = field(default_factory=tuple)
+    ready_to_send: tuple[CultNetRudpPacket, ...] = field(default_factory=tuple)
     reply: CultNetRudpPacket | None = None
     pong: bool = False
     pong_payload: bytes = b""
@@ -395,6 +396,9 @@ def create_rudp_transport_profile(
 
 
 class CultNetRudpSession:
+    RELIABLE_SEND_WINDOW_PACKETS = 32
+    RECEIVED_SEQUENCE_WINDOW = 4_096
+
     def __init__(self, options: CultNetRudpSessionOptions) -> None:
         self.connection_id = _uint32(options.connection_id, "connection_id")
         self.resend_delay_ms = options.resend_delay_ms
@@ -402,20 +406,33 @@ class CultNetRudpSession:
             raise ValueError("RUDP max_pending_reliable_packets must be greater than zero")
         self.max_pending_reliable_packets = options.max_pending_reliable_packets
         self._next_sequence = _uint32(options.initial_sequence, "initial_sequence")
+        self._next_sequenced_by_channel: dict[str, int] = {}
         self._next_fragment_id = 1
         self._connected = False
         self._last_received_at_ms: int | None = None
         self._highest_received_sequence: int | None = None
         self._received_sequences: set[int] = set()
+        self._latest_sequenced_by_channel: dict[str, int] = {}
         self._pending_reliable: dict[int, _PendingReliablePacket] = {}
+        self._queued_reliable: deque[CultNetRudpPacket] = deque()
         self._ordered_next_sequence_by_channel: dict[str, int] = {}
         self._ordered_buffers: dict[str, dict[int, tuple[CultNetRudpDeliveredFrame, int]]] = {}
         self._fragment_buffers: dict[tuple[str, int], dict[str, Any]] = {}
+        # Matches cultnet-rs max_pending_fragment_sets. A set that loses one
+        # fragment is never completed; without a bound it is kept for the life
+        # of the session and the map grows under any loss on a fragmenting channel.
+        self._max_pending_fragment_sets = 64
+        self._fragment_sets_evicted = 0
 
     @property
     def connected(self) -> bool:
         return self._connected
 
+    @property
+    def fragment_sets_evicted(self) -> int:
+        """Incomplete fragment sets dropped to admit newer ones; one lost payload each."""
+        return self._fragment_sets_evicted
+
     @property
     def last_received_at_ms(self) -> int | None:
         return self._last_received_at_ms
@@ -424,6 +441,14 @@ class CultNetRudpSession:
     def pending_reliable_sequences(self) -> tuple[int, ...]:
         return tuple(sorted(self._pending_reliable))
 
+    @property
+    def queued_reliable_packet_count(self) -> int:
+        return len(self._queued_reliable)
+
+    @property
+    def outstanding_reliable_packet_count(self) -> int:
+        return len(self._pending_reliable) + len(self._queued_reliable)
+
     def create_connect(self, now_ms: int = 0, payload: bytes = b"") -> CultNetRudpPacket:
         self._ensure_reliable_capacity(1)
         packet = self._create_packet(
@@ -465,7 +490,10 @@ class CultNetRudpSession:
         payload: bytes,
         options: CultNetRudpSendOptions | None = None,
     ) -> CultNetRudpPacket:
-        return self.send_many(channel_id, payload, options)[0]
+        resolved = options or CultNetRudpSendOptions()
+        if resolved.reliable and len(self._pending_reliable) >= self.RELIABLE_SEND_WINDOW_PACKETS:
+            raise ValueError("RUDP reliable send window is full; receive acknowledgements before sending")
+        return self.send_many(channel_id, payload, resolved)[0]
 
     def send_many(
         self,
@@ -479,6 +507,8 @@ class CultNetRudpSession:
             raise ValueError("Cannot send RUDP data before the session is connected")
 
         options = options or CultNetRudpSendOptions()
+        if options.ordered and not options.reliable:
+            raise ValueError("RUDP ordered delivery requires reliability")
         if max_fragment_bytes is not None and max_fragment_bytes <= 0:
             raise ValueError("RUDP max_fragment_bytes must be greater than zero")
 
@@ -492,9 +522,7 @@ class CultNetRudpSession:
                 ordered=options.ordered,
                 sequenced=options.sequenced,
             )
-            if packet.reliable:
-                self._track_reliable(packet, options.now_ms)
-            return (packet,)
+            return self._admit_reliable_packets((packet,), options.now_ms) if packet.reliable else (packet,)
 
         fragment_count = (len(payload) + max_fragment_bytes - 1) // max_fragment_bytes
         if fragment_count > 0xFFFF:
@@ -516,14 +544,13 @@ class CultNetRudpSession:
                 fragment_index=index,
                 fragment_count=fragment_count,
             )
-            if packet.reliable:
-                self._track_reliable(packet, options.now_ms)
             packets.append(packet)
-        return tuple(packets)
+        return self._admit_reliable_packets(tuple(packets), options.now_ms) if options.reliable else tuple(packets)
 
     def receive(self, packet: CultNetRudpPacket, now_ms: int = 0) -> CultNetRudpReceiveResult:
         self._require_connection(packet)
         self._apply_acknowledgements(packet)
+        ready_to_send = self._promote_queued_reliable(now_ms)
         self._last_received_at_ms = now_ms
         expected_sequence_if_uninitialized = (
             packet.sequence
@@ -534,51 +561,93 @@ class CultNetRudpSession:
         if packet.packet_type == CultNetRudpPacketType.ACCEPT:
             self._remember_received(packet.sequence)
             self._connected = True
-            return CultNetRudpReceiveResult()
+            return CultNetRudpReceiveResult(ready_to_send=ready_to_send)
 
         if packet.packet_type == CultNetRudpPacketType.PING:
-            self._remember_received(packet.sequence)
             return CultNetRudpReceiveResult(
+                ready_to_send=ready_to_send,
                 reply=self._create_packet(CultNetRudpPacketType.PONG, "control", packet.payload)
             )
 
         if packet.packet_type in (CultNetRudpPacketType.ACK, CultNetRudpPacketType.PONG):
-            self._remember_received(packet.sequence)
             return CultNetRudpReceiveResult(
+                ready_to_send=ready_to_send,
                 pong=packet.packet_type == CultNetRudpPacketType.PONG,
                 pong_payload=bytes(packet.payload) if packet.packet_type == CultNetRudpPacketType.PONG else b"",
             )
 
         if packet.packet_type == CultNetRudpPacketType.DISCONNECT:
-            self._remember_received(packet.sequence)
             self._connected = False
             return CultNetRudpReceiveResult(
+                ready_to_send=ready_to_send,
                 disconnected=True,
                 disconnect_reason=bytes(packet.payload),
             )
 
         if packet.packet_type != CultNetRudpPacketType.DATA:
-            return CultNetRudpReceiveResult()
+            return CultNetRudpReceiveResult(ready_to_send=ready_to_send)
 
-        duplicate = packet.sequence in self._received_sequences
-        self._remember_received(packet.sequence)
+        duplicate = packet.reliable and (
+            packet.sequence in self._received_sequences or (
+                self._highest_received_sequence is not None
+                and packet.sequence < self._highest_received_sequence
+                and self._highest_received_sequence - packet.sequence >= self.RECEIVED_SEQUENCE_WINDOW
+            )
+        )
+        if packet.reliable:
+            self._remember_received(packet.sequence)
         if duplicate:
-            return CultNetRudpReceiveResult()
+            return CultNetRudpReceiveResult(ready_to_send=ready_to_send)
 
         reassembled = self._reassemble(packet)
         if reassembled is None:
-            return CultNetRudpReceiveResult()
+            return CultNetRudpReceiveResult(ready_to_send=ready_to_send)
         frame, ordered, next_sequence = reassembled
+        if not ordered and packet.sequenced:
+            newest_sequence = next_sequence - 1
+            latest_sequence = self._latest_sequenced_by_channel.get(frame.channel_id)
+            if latest_sequence is not None and newest_sequence <= latest_sequence:
+                return CultNetRudpReceiveResult(ready_to_send=ready_to_send)
+            self._latest_sequenced_by_channel[frame.channel_id] = newest_sequence
+            return CultNetRudpReceiveResult(delivered=(frame,), ready_to_send=ready_to_send)
         if not ordered:
-            return CultNetRudpReceiveResult(delivered=(frame,))
+            return CultNetRudpReceiveResult(delivered=(frame,), ready_to_send=ready_to_send)
         return CultNetRudpReceiveResult(
             delivered=tuple(
                 self._deliver_ordered(frame, next_sequence, expected_sequence_if_uninitialized)
-            )
+            ),
+            ready_to_send=ready_to_send,
         )
 
     def create_ack(self) -> CultNetRudpPacket:
-        return self._create_packet(CultNetRudpPacketType.ACK, "control", b"")
+        ack, ack_mask = self._ack_state()
+        return CultNetRudpPacket(
+            packet_type=CultNetRudpPacketType.ACK,
+            connection_id=self.connection_id,
+            sequence=0,
+            ack=ack,
+            ack_mask=ack_mask,
+            channel_id="control",
+            payload=b"",
+        )
+
+    def create_ack_for(self, sequence: int) -> CultNetRudpPacket:
+        return CultNetRudpPacket(
+            packet_type=CultNetRudpPacketType.ACK,
+            connection_id=self.connection_id,
+            sequence=0,
+            ack=_uint32(sequence, "ack sequence"),
+            ack_mask=0,
+            channel_id="control",
+            payload=b"",
+        )
+
+    def create_ack_for_received(self, sequence: int) -> CultNetRudpPacket:
+        received_sequence = _uint32(sequence, "received sequence")
+        ack, _ = self._ack_state()
+        if ack >= received_sequence and ack - received_sequence <= 32:
+            return self.create_ack()
+        return self.create_ack_for(received_sequence)
 
     def create_ping(self, payload: bytes = b"") -> CultNetRudpPacket:
         return self._create_packet(CultNetRudpPacketType.PING, "control", payload)
@@ -616,8 +685,17 @@ class CultNetRudpSession:
         fragment_index: int = 0,
         fragment_count: int = 0,
     ) -> CultNetRudpPacket:
-        sequence = self._next_sequence
-        self._next_sequence = _uint32(self._next_sequence + 1, "sequence")
+        if reliable:
+            sequence = self._next_sequence
+            self._next_sequence = _uint32(self._next_sequence + 1, "reliable sequence")
+        elif sequenced:
+            sequence = self._next_sequenced_by_channel.get(channel_id, 1)
+            self._next_sequenced_by_channel[channel_id] = _uint32(
+                sequence + 1,
+                "sequenced channel sequence",
+            )
+        else:
+            sequence = 0
         ack, ack_mask = self._ack_state()
         return CultNetRudpPacket(
             packet_type=packet_type,
@@ -655,10 +733,31 @@ class CultNetRudpSession:
             last_sent_at_ms=now_ms,
         )
 
+    def _admit_reliable_packets(
+        self,
+        packets: tuple[CultNetRudpPacket, ...],
+        now_ms: int,
+    ) -> tuple[CultNetRudpPacket, ...]:
+        available = max(0, self.RELIABLE_SEND_WINDOW_PACKETS - len(self._pending_reliable))
+        ready = packets[:available]
+        for packet in ready:
+            self._track_reliable(packet, now_ms)
+        self._queued_reliable.extend(packets[available:])
+        return ready
+
+    def _promote_queued_reliable(self, now_ms: int) -> tuple[CultNetRudpPacket, ...]:
+        available = max(0, self.RELIABLE_SEND_WINDOW_PACKETS - len(self._pending_reliable))
+        ready: list[CultNetRudpPacket] = []
+        while len(ready) < available and self._queued_reliable:
+            packet = self._queued_reliable.popleft()
+            self._track_reliable(packet, now_ms)
+            ready.append(packet)
+        return tuple(ready)
+
     def _ensure_reliable_capacity(self, packet_count: int) -> None:
         if packet_count == 0 or self.max_pending_reliable_packets is None:
             return
-        if len(self._pending_reliable) + packet_count > self.max_pending_reliable_packets:
+        if self.outstanding_reliable_packet_count + packet_count > self.max_pending_reliable_packets:
             raise ValueError("RUDP reliable send queue is full")
 
     def _apply_acknowledgements(self, packet: CultNetRudpPacket) -> None:
@@ -671,6 +770,9 @@ class CultNetRudpSession:
         self._received_sequences.add(sequence)
         if self._highest_received_sequence is None or sequence > self._highest_received_sequence:
             self._highest_received_sequence = sequence
+        if len(self._received_sequences) > self.RECEIVED_SEQUENCE_WINDOW:
+            keep_from = max(0, (self._highest_received_sequence or sequence) - self.RECEIVED_SEQUENCE_WINDOW + 1)
+            self._received_sequences = {received for received in self._received_sequences if received >= keep_from}
 
     def _ack_state(self) -> tuple[int, int]:
         ack = self._highest_received_sequence or 0
@@ -693,6 +795,11 @@ class CultNetRudpSession:
             raise ValueError("RUDP fragment index must be lower than fragment count")
 
         key = (packet.channel_id, packet.fragment_id)
+        if key not in self._fragment_buffers and len(self._fragment_buffers) >= self._max_pending_fragment_sets:
+            # Evict the oldest stranded set rather than refusing the payload; dicts
+            # iterate in insertion order, so the first key is the oldest.
+            del self._fragment_buffers[next(iter(self._fragment_buffers))]
+            self._fragment_sets_evicted += 1
         buffer = self._fragment_buffers.setdefault(
             key,
             {
@@ -838,6 +945,10 @@ class CultNetRudpSocketTransportConnection:
             frames_sent=self._frames_sent,
         )
 
+    @property
+    def outstanding_reliable_packet_count(self) -> int:
+        return self.session.outstanding_reliable_packet_count
+
     def connect(self, payload: bytes = b"") -> None:
         if self.mode != CultNetRudpSocketMode.CLIENT:
             raise ValueError("Only a client RUDP socket transport can initiate connect")
@@ -879,6 +990,8 @@ class CultNetRudpSocketTransportConnection:
         result = self.session.receive(packet, _now_ms())
         if result.reply is not None:
             self._send_packet(result.reply)
+        for ready in result.ready_to_send:
+            self._send_packet(ready)
         if result.pong:
             self.pong_payloads.append(result.pong_payload)
         if result.disconnected:
@@ -892,8 +1005,8 @@ class CultNetRudpSocketTransportConnection:
             self._frames_received += 1
 
         frame = self._delivered_frames.popleft() if self._delivered_frames else None
-        if packet.packet_type == CultNetRudpPacketType.ACCEPT or frame is not None:
-            self._send_packet(self.session.create_ack())
+        if packet.reliable or packet.packet_type == CultNetRudpPacketType.ACCEPT or frame is not None:
+            self._send_packet(self.session.create_ack_for_received(packet.sequence))
         return frame
 
     def receive(self, timeout_seconds: float | None = None) -> CultNetTransportFrame:
@@ -906,6 +1019,29 @@ class CultNetRudpSocketTransportConnection:
             if deadline is not None and time.monotonic() >= deadline:
                 raise TimeoutError("Timed out waiting for RUDP schema frame")
 
+    def flush_reliable(self, timeout_seconds: float = 30.0) -> None:
+        deadline = time.monotonic() + max(0.0, timeout_seconds)
+        original_timeout = self.socket.gettimeout()
+        poll_timeout = min(original_timeout, 0.01) if original_timeout is not None else 0.01
+        preserved = deque(self._delivered_frames)
+        self._delivered_frames.clear()
+        self.socket.settimeout(poll_timeout)
+        try:
+            while self.session.outstanding_reliable_packet_count > 0:
+                if time.monotonic() >= deadline:
+                    raise TimeoutError(
+                        "RUDP reliable flush timed out with "
+                        f"{self.session.outstanding_reliable_packet_count} packets outstanding"
+                    )
+                frame = self.receive_once()
+                if frame is not None:
+                    preserved.append(frame)
+                self.poll_resends()
+        finally:
+            preserved.extend(self._delivered_frames)
+            self._delivered_frames = preserved
+            self.socket.settimeout(original_timeout)
+
     def disconnect(self, reason: bytes = b"") -> None:
         self._send_packet(self.session.create_disconnect(reason))
 
diff --git a/packages/cultnet-py/tests/test_cultnet.py b/packages/cultnet-py/tests/test_cultnet.py
new file mode 100644
index 00000000..171a34b9
--- /dev/null
+++ b/packages/cultnet-py/tests/test_cultnet.py
@@ -0,0 +1,2046 @@
+from __future__ import annotations
+
+import json
+import socket
+import threading
+import time
+import unittest
+import hashlib
+import hmac
+import io
+from dataclasses import dataclass
+from datetime import UTC, datetime
+from pathlib import Path
+from typing import Callable
+from uuid import uuid4
+from cultcache_py import CultCache, define_database_entry_type
+from cultnet_py.benchmark import run_benchmark
+from cultnet_py.compare_csharp import (
+    DEFAULT_PARITY_THRESHOLD,
+    DEFAULT_SAMPLE_COUNT,
+    _compare_common_metrics,
+    _median_result,
+    _parity_status,
+)
+from cultnet_py.interop_peer import append_shard_log_put, build_state, raw_snapshot_response
+from cultnet_py import (
+    compute_simulation_claim_hash,
+    CultNetDatabaseChange,
+    CultNetRawClient,
+    CultNetRawDocumentRecord,
+    CultNetRawSnapshotResponse,
+    CultNetSchemaCatalog,
+    CultNetSchemaDescriptor,
+    CultNetShardCatalog,
+    CultNetShardDescriptor,
+    CultNetShardLogEntry,
+    CultNetShardLogResponse,
+    CultNetPeerError,
+    CultNetClientSecurityOptions,
+    CultNetSecret,
+    CultNetServerSecurityOptions,
+    CultNetSimulationConsensusOptions,
+    CultNetSimulationConsensusCandidate,
+    CultNetSimulationObservation,
+    CultNetRudpPacket,
+    CultNetRudpPacketType,
+    CultNetRudpSendOptions,
+    CultNetRudpSession,
+    CultNetRudpSessionOptions,
+    CultNetRudpSocketMode,
+    CultNetRudpReconnectLoop,
+    CultNetRudpSocketTransportConnection,
+    CultNetRudpSocketTransportOptions,
+    TcpFramedTransportConnection,
+    CultNetWitnessArtifactBundle,
+    apply_raw_document_record,
+    apply_raw_snapshot,
+    apply_shard_log_response,
+    create_rudp_transport_profile,
+    create_tcp_framed_transport_profile,
+    create_reconnect_policy,
+    CultNetReconnectController,
+    database_subscribe,
+    database_unsubscribe,
+    decode_frame,
+    decode_rudp_packet,
+    decode_witness_artifact_bundle_payload,
+    document_delete,
+    document_put_raw,
+    encode_frame,
+    encode_rudp_packet,
+    encode_witness_artifact_bundle_payload,
+    hello,
+    login,
+    login_success,
+    parse_message,
+    register,
+    schema_catalog_request,
+    schema_document_map,
+    shard_catalog_request,
+    shard_log_request,
+    simulation_observation,
+    snapshot_request,
+    verify_session,
+    wire_message_schema_catalog,
+    wire_message_schema_descriptors,
+    witness_artifact_bundle,
+    compute_reconnect_delay_ms,
+)
+
+
+def bind_udp_socket() -> socket.socket:
+    sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
+    sock.bind(("127.0.0.1", 0))
+    sock.settimeout(0.02)
+    return sock
+
+
+def pump_rudp_handshake(
+    client: CultNetRudpSocketTransportConnection,
+    server: CultNetRudpSocketTransportConnection,
+) -> None:
+    for _ in range(20):
+        server.receive_once()
+        client.receive_once()
+        server.receive_once()
+        if client.connected and server.connected:
+            return
+        time.sleep(0.005)
+    raise AssertionError("RUDP socket handshake did not complete")
+
+
+def receive_rudp_frame(transport: CultNetRudpSocketTransportConnection):
+    for _ in range(20):
+        frame = transport.receive_once()
+        if frame is not None:
+            return frame
+        time.sleep(0.005)
+    raise AssertionError("RUDP socket frame was not delivered")
+
+
+@dataclass
+class Item:
+    name: str
+    category: str
+    value: int
+
+
+class CultNetTests(unittest.TestCase):
+    def test_benchmark_reports_core_hot_path_metrics(self) -> None:
+        result = run_benchmark(8)
+        metric_names = {metric["name"] for metric in result["metrics"]}
+        self.assertEqual(result["records"], 8)
+        self.assertEqual(result["wireMessageCount"], 8)
+        self.assertEqual(metric_names, {
+            "database_entry_encode",
+            "database_entry_decode",
+            "cultnet_frame_parse",
+            "raw_snapshot_apply",
+            "cache_upsert",
+            "cache_get",
+        })
+        self.assertTrue(all(metric["opsPerSecond"] > 0 for metric in result["metrics"]))
+
+    def test_compare_csharp_median_result_summarizes_samples(self) -> None:
+        self.assertEqual(DEFAULT_SAMPLE_COUNT, 3)
+        self.assertEqual(DEFAULT_PARITY_THRESHOLD, 0.90)
+        samples = [
+            {
+                "runtime": "python",
+                "records": 3,
+                "metrics": [
+                    {"name": "cache_get", "operations": 3, "elapsedMs": 30.0, "opsPerSecond": 100.0},
+                    {"name": "cache_upsert", "operations": 3, "elapsedMs": 60.0, "opsPerSecond": 50.0},
+                ],
+            },
+            {
+                "runtime": "python",
+                "records": 3,
+                "metrics": [
+                    {"name": "cache_get", "operations": 3, "elapsedMs": 10.0, "opsPerSecond": 300.0},
+                    {"name": "cache_upsert", "operations": 3, "elapsedMs": 20.0, "opsPerSecond": 150.0},
+                ],
+            },
+            {
+                "runtime": "python",
+                "records": 3,
+                "metrics": [
+                    {"name": "cache_get", "operations": 3, "elapsedMs": 20.0, "opsPerSecond": 200.0},
+                    {"name": "cache_upsert", "operations": 3, "elapsedMs": 40.0, "opsPerSecond": 75.0},
+                ],
+            },
+        ]
+
+        summarized = _median_result(samples)
+
+        self.assertEqual(summarized["sampleCount"], 3)
+        self.assertEqual(summarized["metrics"][0]["name"], "cache_get")
+        self.assertEqual(summarized["metrics"][0]["elapsedMs"], 20.0)
+        self.assertEqual(summarized["metrics"][0]["opsPerSecond"], 200.0)
+        self.assertEqual(summarized["metrics"][1]["opsPerSecond"], 75.0)
+
+    def test_compare_csharp_marks_threshold_status_per_metric(self) -> None:
+        python_result = {
+            "metrics": [
+                {"name": "cache_get", "operations": 3, "elapsedMs": 2.0, "opsPerSecond": 50.0},
+                {"name": "cache_upsert", "operations": 3, "elapsedMs": 1.0, "opsPerSecond": 95.0},
+            ],
+        }
+        csharp_result = {
+            "metrics": [
+                {"name": "cache_get", "operations": 3, "elapsedMs": 1.0, "opsPerSecond": 100.0},
+                {"name": "cache_upsert", "operations": 3, "elapsedMs": 1.0, "opsPerSecond": 100.0},
+            ],
+        }
+
+        comparison = _compare_common_metrics(python_result, csharp_result, parity_threshold=0.90)
+        by_name = {item["name"]: item for item in comparison}
+
+        self.assertFalse(by_name["cache_get"]["meetsParityThreshold"])
+        self.assertTrue(by_name["cache_upsert"]["meetsParityThreshold"])
+        self.assertEqual(_parity_status(comparison, "ok"), "below-threshold")
+        self.assertEqual(_parity_status([by_name["cache_upsert"]], "ok"), "meets-threshold")
+        self.assertEqual(_parity_status(comparison, "failed"), "unknown")
+
+    def test_compare_csharp_marks_meets_threshold_when_all_common_metrics_pass(self) -> None:
+        comparison = _compare_common_metrics(
+            {
+                "metrics": [
+                    {"name": "cache_get", "operations": 3, "elapsedMs": 1.0, "opsPerSecond": 95.0},
+                    {"name": "cache_upsert", "operations": 3, "elapsedMs": 1.0, "opsPerSecond": 120.0},
+                ],
+            },
+            {
+                "metrics": [
+                    {"name": "cache_get", "operations": 3, "elapsedMs": 1.0, "opsPerSecond": 100.0},
+                    {"name": "cache_upsert", "operations": 3, "elapsedMs": 1.0, "opsPerSecond": 100.0},
+                ],
+            },
+            parity_threshold=0.90,
+        )
+
+        self.assertEqual(_parity_status(comparison, "ok"), "meets-threshold")
+
+    def test_cultnet_security_options_match_cultlib_defaults_and_environment_rules(self) -> None:
+        client = CultNetClientSecurityOptions.development()
+        server = CultNetServerSecurityOptions.development()
+
+        self.assertEqual(client.connection_key, "gamecult-dev-connection-key")
+        self.assertEqual(server.connection_key, "gamecult-dev-connection-key")
+        self.assertTrue(server.is_development)
+        self.assertEqual(server.to_client_options().connection_key, client.connection_key)
+        self.assertEqual(client.encryption_key(), hashlib.sha256(b"gamecult-dev-connection-key").digest())
+        self.assertEqual(server.session_signing_key(), hashlib.sha256(b"gamecult-dev-session-signing-secret").digest())
+        self.assertEqual(
+            CultNetServerSecurityOptions.from_environment({}, allow_development_defaults=True),
+            server,
+        )
+        with self.assertRaisesRegex(ValueError, "not configured"):
+            CultNetServerSecurityOptions.from_environment({})
+        with self.assertRaisesRegex(ValueError, "GAMECULT_SESSION_SIGNING_SECRET"):
+            CultNetServerSecurityOptions.from_environment({"GAMECULT_CONNECTION_KEY": "key"})
+        configured = CultNetServerSecurityOptions.from_environment({
+            "GAMECULT_CONNECTION_KEY": "prod-key",
+            "GAMECULT_SESSION_SIGNING_SECRET": "prod-secret",
+        })
+        self.assertEqual(configured.connection_key, "prod-key")
+        self.assertFalse(configured.is_development)
+
+    def test_cultnet_secret_helpers_validate_csharp_versioned_session_tokens(self) -> None:
+        security = CultNetServerSecurityOptions("connection-key", "session-secret")
+        user_id = uuid4()
+        expires = datetime(2035, 1, 2, 3, 4, 5, tzinfo=UTC)
+
+        token = CultNetSecret.create_session_token(user_id, expires, security, session_version=7)
+        payload_b64, signature_b64 = token.split(".")
+        self.assertEqual(
+            CultNetSecret.from_base64url(payload_b64).decode("utf-8"),
+            f"{user_id.hex}|{int(expires.timestamp())}|7",
+        )
+        self.assertEqual(
+            CultNetSecret.from_base64url(signature_b64),
+            hmac.new(
+                hashlib.sha256(b"session-secret").digest(),
+                CultNetSecret.from_base64url(payload_b64),
+                hashlib.sha256,
+            ).digest(),
+        )
+
+        validated = CultNetSecret.try_validate_session_token(
+            token,
+            security,
+            now_utc=datetime(2035, 1, 2, 3, 4, 4, tzinfo=UTC),
+        )
+        self.assertIsNotNone(validated)
+        assert validated is not None
+        self.assertEqual(validated.user_id, user_id)
+        self.assertEqual(validated.expires_at_utc, expires)
+        self.assertEqual(validated.session_version, 7)
+
+        tampered_payload = CultNetSecret.to_base64url(CultNetSecret.from_base64url(payload_b64) + b"tamper")
+        tampered = f"{tampered_payload}.{signature_b64}"
+        self.assertIsNone(CultNetSecret.try_validate_session_token(tampered, security))
+        self.assertIsNone(CultNetSecret.try_validate_session_token(token, security, now_utc=expires))
+
+    def test_cultnet_secret_helpers_validate_legacy_two_field_session_tokens(self) -> None:
+        security = CultNetServerSecurityOptions.development()
+        user_id = uuid4()
+        expires_at_seconds = int(datetime(2036, 1, 1, tzinfo=UTC).timestamp())
+        payload = f"{user_id.hex}|{expires_at_seconds}".encode("utf-8")
+        signature = hmac.new(security.session_signing_key(), payload, hashlib.sha256).digest()
+        token = f"{CultNetSecret.to_base64url(payload)}.{CultNetSecret.to_base64url(signature)}"
+
+        validated = CultNetSecret.try_validate_session_token(
+            token,
+            security,
+            now_utc=datetime(2035, 12, 31, tzinfo=UTC),
+        )
+
+        self.assertIsNotNone(validated)
+        assert validated is not None
+        self.assertEqual(validated.user_id, user_id)
+        self.assertEqual(validated.session_version, 0)
+
+    def test_cultnet_secret_encryption_helpers_are_optional_without_crypto_dependency(self) -> None:
+        nonce = b"123456789012"
+        security = CultNetServerSecurityOptions.development()
+        try:
+            encrypted = CultNetSecret.encrypt_string("hello", nonce, security.to_client_options())
+        except ImportError as exc:
+            self.assertIn("cryptography", str(exc))
+            return
+        self.assertEqual(CultNetSecret.decrypt_string(encrypted, nonce, security), "hello")
+
+    def test_cultnet_schema_message_frame_round_trip(self) -> None:
+        message = hello(
+            runtime_id="python-test",
+            supported_schema_versions=["cultnet.hello.v0"],
+            transport_profiles=[
+                {
+                    "schemaVersion": "cultnet.transport_profile.v0",
+                    "runtimeId": "python-test",
+                    "transports": [
+                        {
+                            "transportId": "test",
+                            "protocol": "tcp_framed",
+                            "channels": [{"channelId": "schema", "delivery": "reliable", "ordering": "ordered"}],
+                        }
+                    ],
+                }
+            ],
+        )
+        parsed = parse_message(decode_frame(encode_frame(message.to_bytes())))
+        self.assertEqual(parsed.schema_version, "cultnet.hello.v0")
+        self.assertEqual(parsed.body["runtimeId"], "python-test")
+        self.assertEqual(parsed.body["transportProfiles"][0]["transports"][0]["protocol"], "tcp_framed")
+
+    def test_cultnet_tcp_framed_transport_carries_schema_payloads_with_stats(self) -> None:
+        payload = b"cultnet-payload"
+        output = io.BytesIO()
+        sender = TcpFramedTransportConnection(
+            output,
+            profile=create_tcp_framed_transport_profile("sender", transport_id="test-tcp"),
+        )
+        sender.send("schema", payload)
+        self.assertEqual(sender.stats.frames_sent, 1)
+        self.assertEqual(sender.stats.bytes_sent, len(payload) + 4)
+        with self.assertRaisesRegex(ValueError, "only supports the schema channel"):
+            sender.send("unreliable", b"")
+
+        receiver = TcpFramedTransportConnection(
+            io.BytesIO(output.getvalue()),
+            profile=create_tcp_framed_transport_profile("receiver", transport_id="test-tcp"),
+        )
+        frame = receiver.receive()
+        self.assertEqual(frame.channel_id, "schema")
+        self.assertEqual(frame.payload, payload)
+        self.assertEqual(receiver.stats.frames_received, 1)
+        self.assertEqual(receiver.stats.bytes_received, len(payload) + 4)
+        self.assertEqual(receiver.profile["transports"][0]["protocol"], "tcp_framed")
+
+    def test_cultnet_raw_client_uses_schema_transport_factory(self) -> None:
+        import msgpack  # type: ignore
+
+        sent_messages: list[dict[str, object]] = []
+        test_case = self
+
+        class FakeSchemaTransport:
+            profile = create_tcp_framed_transport_profile("fake-client")
+
+            def __enter__(self) -> "FakeSchemaTransport":
+                return self
+
+            def __exit__(self, exc_type: object, exc: object, traceback: object) -> None:
+                self.close()
+
+            def send(self, channel_id: str, payload: bytes) -> None:
+                test_case.assertEqual(channel_id, "schema")
+                sent_messages.append(msgpack.unpackb(payload, raw=False))
+
+            def receive(self) -> object:
+                response = {
+                    "schemaVersion": "cultnet.schema_catalog_response.v0",
+                    "messageId": "transport-factory",
+                    "schemas": [],
+                }
+                return type("Frame", (), {"channel_id": "schema", "payload": msgpack.packb(response, use_bin_type=True)})()
+
+            def close(self) -> None:
+                pass
+
+        client = CultNetRawClient(
+            "unused.example.test",
+            1,
+            create_transport=FakeSchemaTransport,
+        )
+
+        response = client.fetch_schema_catalog(message_id="transport-factory")
+
+        self.assertEqual(response["schemaVersion"], "cultnet.schema_catalog_response.v0")
+        self.assertEqual(sent_messages[0]["schemaVersion"], "cultnet.schema_catalog_request.v0")
+        self.assertEqual(sent_messages[0]["messageId"], "transport-factory")
+
+    def test_cultnet_rudp_packet_codec_uses_deterministic_reliable_ordered_fixture(self) -> None:
+        encoded = encode_rudp_packet(
+            CultNetRudpPacket(
+                packet_type=CultNetRudpPacketType.DATA,
+                connection_id=0x01020304,
+                sequence=0x0000002A,
+                ack=0x00000029,
+                ack_mask=0x80000001,
+                channel_id="schema",
+                reliable=True,
+                ordered=True,
+                fragment_id=7,
+                fragment_index=1,
+                fragment_count=3,
+                payload=b"hello",
+            )
+        )
+
+        self.assertEqual(
+            encoded.hex(),
+            "434e523000030b2a010203040000002a0000002980000001000700010003000000050600736368656d6168656c6c6f",
+        )
+
+        decoded = decode_rudp_packet(encoded)
+        self.assertEqual(decoded.packet_type, CultNetRudpPacketType.DATA)
+        self.assertEqual(decoded.connection_id, 0x01020304)
+        self.assertEqual(decoded.sequence, 0x0000002A)
+        self.assertEqual(decoded.ack, 0x00000029)
+        self.assertEqual(decoded.ack_mask, 0x80000001)
+        self.assertEqual(decoded.channel_id, "schema")
+        self.assertTrue(decoded.reliable)
+        self.assertTrue(decoded.ordered)
+        self.assertFalse(decoded.sequenced)
+        self.assertEqual(decoded.fragment_id, 7)
+        self.assertEqual(decoded.fragment_index, 1)
+        self.assertEqual(decoded.fragment_count, 3)
+        self.assertEqual(decoded.payload, b"hello")
+
+    def test_cultnet_rudp_transport_profile_advertises_state_and_realtime_channels(self) -> None:
+        profile = create_rudp_transport_profile(
+            "python-rudp",
+            transport_id="public-rudp",
+            host="127.0.0.1",
+            port=7777,
+            max_payload_bytes=1200,
+            max_fragment_bytes=1000,
+        )
+
+        self.assertEqual(profile["transports"][0]["protocol"], "rudp")
+        self.assertEqual(profile["transports"][0]["reconnectPolicy"]["schemaVersion"], "cultnet.reconnect_policy.v0")
+        self.assertEqual(profile["transports"][0]["reconnectPolicy"]["baseDelayMs"], 1_000)
+        self.assertEqual(
+            [
+                (channel["channelId"], channel["delivery"], channel["ordering"])
+                for channel in profile["transports"][0]["channels"]
+            ],
+            [
+                ("schema", "reliable", "ordered"),
+                ("latest", "unreliable", "sequenced"),
+                ("realtime", "unreliable", "unordered"),
+            ],
+        )
+
+    def test_cultnet_reconnect_policy_exposes_portable_delay_contract(self) -> None:
+        policy = create_reconnect_policy(policy_id="rudp-default", max_attempts=8)
+
+        self.assertEqual(policy.schema_version, "cultnet.reconnect_policy.v0")
+        self.assertEqual(policy.policy_id, "rudp-default")
+        self.assertEqual(policy.max_attempts, 8)
+        self.assertEqual(policy.to_wire()["policyId"], "rudp-default")
+        self.assertEqual(policy.to_wire()["maxAttempts"], 8)
+        self.assertEqual(compute_reconnect_delay_ms(policy, 1), 1_000)
+        self.assertEqual(compute_reconnect_delay_ms(policy, 3, 17), 4_017)
+        self.assertEqual(compute_reconnect_delay_ms(policy, 9, 999), 30_250)
+        self.assertEqual(compute_reconnect_delay_ms(policy, 0, -5), 1_000)
+
+    def test_cultnet_reconnect_controller_schedules_attempts_and_reset(self) -> None:
+        controller = CultNetReconnectController(create_reconnect_policy(max_attempts=2))
+
+        first = controller.record_failure(10_000)
+        self.assertEqual(first.attempt, 1)
+        self.assertTrue(first.should_retry)
+        self.assertEqual(first.delay_ms, 1_000)
+        self.assertEqual(first.next_attempt_at_ms, 11_000)
+        self.assertFalse(first.exhausted)
+        self.assertFalse(controller.can_attempt(10_999))
+        self.assertTrue(controller.can_attempt(11_000))
+
+        second = controller.record_failure(11_000, 17)
+        self.assertEqual(second.attempt, 2)
+        self.assertEqual(second.delay_ms, 2_017)
+        self.assertEqual(second.next_attempt_at_ms, 13_017)
+        self.assertTrue(second.should_retry)
+
+        exhausted = controller.record_failure(13_017)
+        self.assertEqual(exhausted.attempt, 2)
+        self.assertFalse(exhausted.should_retry)
+        self.assertEqual(exhausted.delay_ms, 0)
+        self.assertIsNone(exhausted.next_attempt_at_ms)
+        self.assertTrue(exhausted.exhausted)
+        self.assertFalse(controller.can_attempt(99_000))
+
+        controller.reset()
+        self.assertEqual(controller.attempt, 0)
+        self.assertIsNone(controller.next_attempt_at_ms)
+        self.assertFalse(controller.exhausted)
+        self.assertTrue(controller.can_attempt(99_000))
+
+    def test_cultnet_rudp_reconnect_loop_consumes_shared_controller(self) -> None:
+        class FakeRudpReconnectTransport:
+            def __init__(self) -> None:
+                self.connect_calls = 0
+                self.close_calls = 0
+                self.last_payload: bytes | None = None
+
+            def connect(self, payload: bytes = b"") -> None:
+                self.connect_calls += 1
+                self.last_payload = bytes(payload)
+
+            def close(self) -> None:
+                self.close_calls += 1
+
+        now_ms = 10_000
+        captured_callback: list[Callable[[], None]] = []
+        transports: list[FakeRudpReconnectTransport] = []
+
+        def create_transport() -> FakeRudpReconnectTransport:
+            transport = FakeRudpReconnectTransport()
+            transports.append(transport)
+            return transport
+
+        def scheduler(delay_ms: int, callback: Callable[[], None]) -> Callable[[], None]:
+            self.assertEqual(delay_ms, 1_017)
+            captured_callback[:] = [callback]
+
+            def cancel() -> None:
+                captured_callback.clear()
+
+            return cancel
+
+        loop = CultNetRudpReconnectLoop(
+            create_transport,
+            reconnect_policy=create_reconnect_policy(max_attempts=2),
+            connect_payload=b"join",
+            now_ms=lambda: now_ms,
+            jitter_ms=lambda: 17,
+            scheduler=scheduler,
+        )
+
+        first = loop.start()
+        self.assertEqual(first.connect_calls, 1)
+        self.assertEqual(first.last_payload, b"join")
+        self.assertIs(loop.transport, first)
+
+        decision = loop.handle_closed()
+        self.assertIsNotNone(decision)
+        self.assertEqual(decision.attempt, 1)
+        self.assertTrue(decision.should_retry)
+        self.assertEqual(decision.delay_ms, 1_017)
+        self.assertEqual(decision.next_attempt_at_ms, 11_017)
+        self.assertEqual(loop.reconnect_controller.attempt, 1)
+        self.assertEqual(loop.reconnect_controller.next_attempt_at_ms, 11_017)
+        self.assertEqual(len(captured_callback), 1)
+
+        now_ms = 11_017
+        captured_callback[0]()
+        self.assertEqual(len(transports), 2)
+        self.assertEqual(transports[1].connect_calls, 1)
+        self.assertIs(loop.transport, transports[1])
+
+        loop.mark_connected()
+        self.assertEqual(loop.reconnect_controller.attempt, 0)
+
+        loop.stop()
+        self.assertEqual(transports[1].close_calls, 1)
+        self.assertIsNone(loop.transport)
+
+    def test_cultnet_rudp_session_handshake_acks_reliable_connect_and_accept_packets(self) -> None:
+        client = CultNetRudpSession(
+            CultNetRudpSessionOptions(connection_id=0x0A0B0C0D, initial_sequence=1, resend_delay_ms=50)
+        )
+        server = CultNetRudpSession(
+            CultNetRudpSessionOptions(connection_id=0x0A0B0C0D, initial_sequence=100, resend_delay_ms=50)
+        )
+
+        connect = client.create_connect(0, b"join")
+        self.assertEqual(connect.packet_type, CultNetRudpPacketType.CONNECT)
+        self.assertEqual(connect.sequence, 1)
+        self.assertEqual(client.pending_reliable_sequences, (1,))
+
+        accept = server.accept_connect(connect, 10, b"ok")
+        self.assertEqual(accept.packet_type, CultNetRudpPacketType.ACCEPT)
+        self.assertEqual(accept.ack, 1)
+        self.assertTrue(server.connected)
+        self.assertEqual(server.pending_reliable_sequences, (100,))
+
+        client.receive(accept, 20)
+        self.assertTrue(client.connected)
+        self.assertEqual(client.pending_reliable_sequences, ())
+
+        ack = client.create_ack()
+        self.assertEqual(ack.ack, 100)
+        server.receive(ack, 30)
+        self.assertEqual(server.pending_reliable_sequences, ())
+
+    def test_cultnet_rudp_session_computes_ack_masks_and_clears_pending_reliable_packets(self) -> None:
+        sender = CultNetRudpSession(CultNetRudpSessionOptions(connection_id=7, initial_sequence=10, resend_delay_ms=100))
+        receiver = CultNetRudpSession(
+            CultNetRudpSessionOptions(connection_id=7, initial_sequence=200, resend_delay_ms=100)
+        )
+        sender.receive(
+            CultNetRudpPacket(CultNetRudpPacketType.ACCEPT, 7, 1, 0, 0, "control")
+        )
+        receiver.receive(
+            CultNetRudpPacket(CultNetRudpPacketType.ACCEPT, 7, 2, 0, 0, "control")
+        )
+
+        first = sender.send(
+            "schema",
+            b"first",
+            CultNetRudpSendOptions(reliable=True, ordered=True, now_ms=0),
+        )
+        second = sender.send(
+            "schema",
+            b"second",
+            CultNetRudpSendOptions(reliable=True, ordered=True, now_ms=0),
+        )
+        third = sender.send(
+            "schema",
+            b"third",
+            CultNetRudpSendOptions(reliable=True, ordered=True, now_ms=0),
+        )
+        self.assertEqual(sender.pending_reliable_sequences, (10, 11, 12))
+
+        receiver.receive(first)
+        receiver.receive(third)
+        ack_with_gap = receiver.create_ack()
+        self.assertEqual(ack_with_gap.ack, 12)
+        self.assertEqual(ack_with_gap.ack_mask, 0b10 | (1 << 9))
+        sender.receive(ack_with_gap)
+        self.assertEqual(sender.pending_reliable_sequences, (11,))
+
+        receiver.receive(second)
+        full_ack = receiver.create_ack()
+        self.assertEqual(full_ack.ack, 12)
+        self.assertEqual(full_ack.ack_mask, 0b11 | (1 << 9))
+        sender.receive(full_ack)
+        self.assertEqual(sender.pending_reliable_sequences, ())
+
+    def test_cultnet_rudp_session_schedules_reliable_resends_until_acked(self) -> None:
+        session = CultNetRudpSession(CultNetRudpSessionOptions(connection_id=99, initial_sequence=1, resend_delay_ms=100))
+        session.receive(
+            CultNetRudpPacket(CultNetRudpPacketType.ACCEPT, 99, 50, 0, 0, "control")
+        )
+        sent = session.send(
+            "schema",
+            b"payload",
+            CultNetRudpSendOptions(reliable=True, ordered=True, now_ms=10),
+        )
+
+        self.assertEqual(session.due_resends(90), ())
+        self.assertEqual(tuple(packet.sequence for packet in session.due_resends(110)), (sent.sequence,))
+        self.assertEqual(session.due_resends(150), ())
+
+        session.receive(
+            CultNetRudpPacket(CultNetRudpPacketType.ACK, 99, 51, sent.sequence, 0, "control")
+        )
+        self.assertEqual(session.due_resends(250), ())
+
+    def test_cultnet_rudp_session_pings_and_detects_receive_timeout(self) -> None:
+        client = CultNetRudpSession(CultNetRudpSessionOptions(connection_id=101, initial_sequence=1))
+        server = CultNetRudpSession(CultNetRudpSessionOptions(connection_id=101, initial_sequence=100))
+        connect = client.create_connect(0, b"join")
+        accept = server.accept_connect(connect, 10)
+        client.receive(accept, 20)
+
+        ping = client.create_ping(b"pulse")
+        ping_result = server.receive(ping, 30)
+        self.assertIsNotNone(ping_result.reply)
+        self.assertEqual(ping_result.reply.packet_type, CultNetRudpPacketType.PONG)
+        self.assertEqual(ping_result.reply.payload, b"pulse")
+
+        pong_result = client.receive(ping_result.reply, 40)
+        self.assertTrue(pong_result.pong)
+        self.assertEqual(pong_result.pong_payload, b"pulse")
+        self.assertFalse(client.check_timeout(90, 50))
+        self.assertTrue(client.check_timeout(91, 50))
+        self.assertFalse(client.connected)
+
+    def test_cultnet_rudp_session_bounds_pending_reliable_packets_before_enqueue(self) -> None:
+        session = CultNetRudpSession(
+            CultNetRudpSessionOptions(connection_id=102, initial_sequence=1, max_pending_reliable_packets=2)
+        )
+        session.receive(CultNetRudpPacket(CultNetRudpPacketType.ACCEPT, 102, 50, 0, 0, "control"))
+        session.send("schema", b"first", CultNetRudpSendOptions(reliable=True, ordered=True))
+        session.send("schema", b"second", CultNetRudpSendOptions(reliable=True, ordered=True))
+        with self.assertRaisesRegex(ValueError, "reliable send queue is full"):
+            session.send("schema", b"third", CultNetRudpSendOptions(reliable=True, ordered=True))
+        self.assertEqual(session.pending_reliable_sequences, (1, 2))
+
+        fragmented = CultNetRudpSession(
+            CultNetRudpSessionOptions(connection_id=103, initial_sequence=1, max_pending_reliable_packets=3)
+        )
+        fragmented.receive(CultNetRudpPacket(CultNetRudpPacketType.ACCEPT, 103, 50, 0, 0, "control"))
+        with self.assertRaisesRegex(ValueError, "reliable send queue is full"):
+            fragmented.send_many(
+                "schema",
+                b"fragment-me",
+                CultNetRudpSendOptions(reliable=True, ordered=True),
+                max_fragment_bytes=3,
+            )
+        self.assertEqual(fragmented.pending_reliable_sequences, ())
+
+    def test_cultnet_rudp_session_suppresses_duplicates_and_delivers_reliable_ordered_payloads(self) -> None:
+        sender = CultNetRudpSession(CultNetRudpSessionOptions(connection_id=123, initial_sequence=1))
+        receiver = CultNetRudpSession(CultNetRudpSessionOptions(connection_id=123, initial_sequence=100))
+        sender.receive(
+            CultNetRudpPacket(CultNetRudpPacketType.ACCEPT, 123, 90, 0, 0, "control")
+        )
+        receiver.receive(
+            CultNetRudpPacket(CultNetRudpPacketType.ACCEPT, 123, 91, 0, 0, "control")
+        )
+
+        first = sender.send("schema", b"first", CultNetRudpSendOptions(reliable=True, ordered=True))
+        second = sender.send("schema", b"second", CultNetRudpSendOptions(reliable=True, ordered=True))
+        third = sender.send("schema", b"third", CultNetRudpSendOptions(reliable=True, ordered=True))
+
+        self.assertEqual([frame.payload.decode("utf-8") for frame in receiver.receive(first).delivered], ["first"])
+        self.assertEqual(receiver.receive(third).delivered, ())
+        self.assertEqual(receiver.receive(first).delivered, ())
+        self.assertEqual(
+            [frame.payload.decode("utf-8") for frame in receiver.receive(second).delivered],
+            ["second", "third"],
+        )
+
+    def test_cultnet_rudp_lossy_packets_cannot_create_reliable_ordered_gaps(self) -> None:
+        sender = CultNetRudpSession(CultNetRudpSessionOptions(connection_id=198, initial_sequence=1))
+        receiver = CultNetRudpSession(CultNetRudpSessionOptions(connection_id=198, initial_sequence=100))
+        sender.receive(CultNetRudpPacket(CultNetRudpPacketType.ACCEPT, 198, 90, 0, 0, "control"))
+        receiver.receive(CultNetRudpPacket(CultNetRudpPacketType.ACCEPT, 198, 91, 0, 0, "control"))
+
+        realtime = sender.send("realtime", b"discarded realtime", CultNetRudpSendOptions())
+        latest = sender.send("latest", b"discarded latest state", CultNetRudpSendOptions(sequenced=True))
+        schema = sender.send("schema", b"committed response", CultNetRudpSendOptions(reliable=True, ordered=True))
+
+        self.assertEqual(realtime.sequence, 0)
+        self.assertEqual(latest.sequence, 1)
+        self.assertEqual(
+            [frame.payload.decode("utf-8") for frame in receiver.receive(schema).delivered],
+            ["committed response"],
+        )
+
+    def test_cultnet_rudp_unreliable_sequenced_delivery_is_scoped_to_its_channel(self) -> None:
+        sender = CultNetRudpSession(CultNetRudpSessionOptions(connection_id=197, initial_sequence=50))
+        receiver = CultNetRudpSession(CultNetRudpSessionOptions(connection_id=197, initial_sequence=100))
+        sender.receive(CultNetRudpPacket(CultNetRudpPacketType.ACCEPT, 197, 90, 0, 0, "control"))
+        receiver.receive(CultNetRudpPacket(CultNetRudpPacketType.ACCEPT, 197, 91, 0, 0, "control"))
+
+        older = sender.send("latest", b"older", CultNetRudpSendOptions(sequenced=True))
+        newer = sender.send("latest", b"newer", CultNetRudpSendOptions(sequenced=True))
+
+        self.assertEqual(older.sequence, 1)
+        self.assertEqual(newer.sequence, 2)
+        self.assertEqual(
+            [frame.payload.decode("utf-8") for frame in receiver.receive(newer).delivered],
+            ["newer"],
+        )
+        self.assertEqual(receiver.receive(older).delivered, ())
+
+    def test_cultnet_rudp_rejects_unreliable_ordered_delivery(self) -> None:
+        session = CultNetRudpSession(CultNetRudpSessionOptions(connection_id=196, initial_sequence=1))
+        session.receive(CultNetRudpPacket(CultNetRudpPacketType.ACCEPT, 196, 50, 0, 0, "control"))
+
+        with self.assertRaises(ValueError) as raised:
+            session.send(
+                "schema",
+                b"cannot order what will not retransmit",
+                CultNetRudpSendOptions(ordered=True),
+            )
+        self.assertIn("ordered delivery requires reliability", str(raised.exception))
+
+    def test_cultnet_rudp_session_skips_control_packets_while_ordering_schema_payloads(self) -> None:
+        sender = CultNetRudpSession(CultNetRudpSessionOptions(connection_id=124, initial_sequence=1))
+        receiver = CultNetRudpSession(CultNetRudpSessionOptions(connection_id=124, initial_sequence=100))
+        sender.receive(
+            CultNetRudpPacket(CultNetRudpPacketType.ACCEPT, 124, 90, 0, 0, "control")
+        )
+        receiver.receive(
+            CultNetRudpPacket(CultNetRudpPacketType.ACCEPT, 124, 91, 0, 0, "control")
+        )
+
+        first = sender.send("schema", b"first", CultNetRudpSendOptions(reliable=True, ordered=True))
+        control = sender.create_ack()
+        second = sender.send("schema", b"second", CultNetRudpSendOptions(reliable=True, ordered=True))
+
+        self.assertEqual([frame.payload.decode("utf-8") for frame in receiver.receive(first).delivered], ["first"])
+        self.assertEqual(receiver.receive(control).delivered, ())
+        self.assertEqual([frame.payload.decode("utf-8") for frame in receiver.receive(second).delivered], ["second"])
+
+    def test_cultnet_rudp_session_fragments_and_reassembles_reliable_ordered_payloads(self) -> None:
+        sender = CultNetRudpSession(CultNetRudpSessionOptions(connection_id=456, initial_sequence=1))
+        receiver = CultNetRudpSession(CultNetRudpSessionOptions(connection_id=456, initial_sequence=100))
+        sender.receive(
+            CultNetRudpPacket(CultNetRudpPacketType.ACCEPT, 456, 90, 0, 0, "control")
+        )
+        receiver.receive(
+            CultNetRudpPacket(CultNetRudpPacketType.ACCEPT, 456, 91, 0, 0, "control")
+        )
+
+        packets = sender.send_many(
+            "schema",
+            b"fragment-me-please",
+            CultNetRudpSendOptions(reliable=True, ordered=True, now_ms=10),
+            max_fragment_bytes=5,
+        )
+        self.assertEqual(len(packets), 4)
+        self.assertEqual(tuple(packet.fragment_count for packet in packets), (4, 4, 4, 4))
+        self.assertEqual(tuple(packet.fragment_index for packet in packets), (0, 1, 2, 3))
+        self.assertTrue(all(packet.fragment_id == packets[0].fragment_id for packet in packets))
+
+        self.assertEqual(receiver.receive(packets[0]).delivered, ())
+        self.assertEqual(receiver.receive(packets[1]).delivered, ())
+        self.assertEqual(receiver.receive(packets[2]).delivered, ())
+        delivered = receiver.receive(packets[3]).delivered
+        self.assertEqual(len(delivered), 1)
+        self.assertEqual(delivered[0].payload, b"fragment-me-please")
+        self.assertEqual(delivered[0].sequence, packets[0].sequence)
+
+    def test_cultnet_rudp_session_advances_large_fragment_sets_through_bounded_window(self) -> None:
+        connection_id = 457
+        sender = CultNetRudpSession(CultNetRudpSessionOptions(connection_id=connection_id, initial_sequence=1))
+        receiver = CultNetRudpSession(CultNetRudpSessionOptions(connection_id=connection_id, initial_sequence=100))
+        sender.receive(CultNetRudpPacket(CultNetRudpPacketType.ACCEPT, connection_id, 0, 0, 0, "control"))
+        receiver.receive(CultNetRudpPacket(CultNetRudpPacketType.ACCEPT, connection_id, 0, 0, 0, "control"))
+
+        fragment_count = CultNetRudpSession.RELIABLE_SEND_WINDOW_PACKETS + 17
+        payload = bytes(index % 251 for index in range(fragment_count * 8))
+        wire = list(sender.send_many(
+            "schema",
+            payload,
+            CultNetRudpSendOptions(reliable=True, ordered=True, now_ms=1),
+            max_fragment_bytes=8,
+        ))
+        self.assertEqual(len(wire), CultNetRudpSession.RELIABLE_SEND_WINDOW_PACKETS)
+        oldest_sequence = wire[0].sequence
+        self.assertEqual(len(sender.pending_reliable_sequences), len(wire))
+        self.assertEqual(sender.queued_reliable_packet_count, 17)
+
+        delivered = []
+        while wire:
+            admitted = len(wire)
+            for _ in range(admitted):
+                packet = wire.pop(0)
+                delivered.extend(receiver.receive(packet, 2).delivered)
+            acknowledged = sender.receive(receiver.create_ack(), 3)
+            wire.extend(acknowledged.ready_to_send)
+
+        self.assertEqual(sender.outstanding_reliable_packet_count, 0)
+        self.assertEqual(len(delivered), 1)
+        self.assertEqual(delivered[0].payload, payload)
+        old_ack = receiver.create_ack_for_received(oldest_sequence)
+        self.assertEqual(old_ack.ack, oldest_sequence)
+        self.assertEqual(old_ack.ack_mask, 0)
+
+    def test_cultnet_rudp_socket_transport_handshakes_and_carries_reliable_ordered_schema_frames(self) -> None:
+        server_socket = bind_udp_socket()
+        client_socket = bind_udp_socket()
+        connection_id = 0x10203040
+        server = CultNetRudpSocketTransportConnection(
+            CultNetRudpSocketTransportOptions(
+                runtime_id="python-rudp-server",
+                socket=server_socket,
+                mode=CultNetRudpSocketMode.SERVER,
+                connection_id=connection_id,
+                initial_sequence=100,
+                resend_delay_ms=25,
+            )
+        )
+        client = CultNetRudpSocketTransportConnection(
+            CultNetRudpSocketTransportOptions(
+                runtime_id="python-rudp-client",
+                socket=client_socket,
+                mode=CultNetRudpSocketMode.CLIENT,
+                remote_addr=server_socket.getsockname(),
+                connection_id=connection_id,
+                initial_sequence=1,
+                resend_delay_ms=25,
+            )
+        )
+
+        try:
+            client.connect(b"join")
+            pump_rudp_handshake(client, server)
+            self.assertTrue(client.connected)
+            self.assertTrue(server.connected)
+
+            client.send("schema", b"client-state")
+            server_frame = receive_rudp_frame(server)
+            self.assertEqual(server_frame.channel_id, "schema")
+            self.assertEqual(server_frame.payload, b"client-state")
+
+            server.send("schema", b"server-state")
+            client_frame = receive_rudp_frame(client)
+            self.assertEqual(client_frame.channel_id, "schema")
+            self.assertEqual(client_frame.payload, b"server-state")
+            self.assertEqual(server.profile["transports"][0]["protocol"], "rudp")
+            self.assertEqual(client.stats.frames_sent, 1)
+            self.assertEqual(server.stats.frames_received, 1)
+        finally:
+            client.close()
+            server.close()
+
+    def test_cultnet_rudp_socket_transport_carries_fragmented_reliable_ordered_schema_frames(self) -> None:
+        server_socket = bind_udp_socket()
+        client_socket = bind_udp_socket()
+        connection_id = 0x10203041
+        server = CultNetRudpSocketTransportConnection(
+            CultNetRudpSocketTransportOptions(
+                runtime_id="python-rudp-fragment-server",
+                socket=server_socket,
+                mode=CultNetRudpSocketMode.SERVER,
+                connection_id=connection_id,
+                initial_sequence=100,
+                resend_delay_ms=25,
+                max_fragment_bytes=8,
+            )
+        )
+        client = CultNetRudpSocketTransportConnection(
+            CultNetRudpSocketTransportOptions(
+                runtime_id="python-rudp-fragment-client",
+                socket=client_socket,
+                mode=CultNetRudpSocketMode.CLIENT,
+                remote_addr=server_socket.getsockname(),
+                connection_id=connection_id,
+                initial_sequence=1,
+                resend_delay_ms=25,
+                max_fragment_bytes=8,
+            )
+        )
+
+        try:
+            payload = b"this-schema-frame-is-larger-than-one-rudp-fragment"
+            client.connect(b"join")
+            pump_rudp_handshake(client, server)
+            client.send("schema", payload)
+            server_frame = receive_rudp_frame(server)
+            self.assertEqual(server_frame.channel_id, "schema")
+            self.assertEqual(server_frame.payload, payload)
+            self.assertEqual(client.stats.frames_sent, 1)
+            self.assertEqual(server.stats.frames_received, 1)
+        finally:
+            client.close()
+            server.close()
+
+    def test_cultnet_database_subscription_helpers_match_schema_v0_shape(self) -> None:
+        subscribe = database_subscribe(
+            message_id="sub-message",
+            subscription_id="sub-1",
+            schema_ids=["schema-a"],
+            record_keys=["record-a"],
+            include_snapshot=False,
+        ).to_wire()
+        self.assertEqual(subscribe["schemaVersion"], "cultnet.database_subscribe.v0")
+        self.assertEqual(subscribe["messageId"], "sub-message")
+        self.assertEqual(subscribe["subscriptionId"], "sub-1")
+        self.assertEqual(subscribe["schemaIds"], ["schema-a"])
+        self.assertEqual(subscribe["recordKeys"], ["record-a"])
+        self.assertFalse(subscribe["includeSnapshot"])
+
+        unsubscribe = database_unsubscribe(message_id="unsub-message", subscription_id="sub-1").to_wire()
+        self.assertEqual(unsubscribe["schemaVersion"], "cultnet.database_unsubscribe.v0")
+        self.assertEqual(unsubscribe["messageId"], "unsub-message")
+        self.assertEqual(unsubscribe["subscriptionId"], "sub-1")
+
+    def test_cultnet_database_change_parses_put_and_delete_shapes(self) -> None:
+        put_change = CultNetDatabaseChange.from_wire({
+            "schemaVersion": "cultnet.database_change_raw.v0",
+            "messageId": "change-put",
+            "subscriptionId": "sub-1",
+            "changeKind": "added",
+            "document": {
+                "schemaId": "schema-note",
+                "recordKey": "note:1",
+                "payload": b"payload",
+            },
+        })
+        self.assertEqual(put_change.schema_id, "schema-note")
+        self.assertEqual(put_change.record_key, "note:1")
+        self.assertIsInstance(put_change.raw_document, CultNetRawDocumentRecord)
+        self.assertEqual(put_change.raw_document.payload, b"payload")
+        self.assertEqual(put_change.to_wire()["document"]["recordKey"], "note:1")
+
+        delete_change = CultNetDatabaseChange.from_wire({
+            "schemaVersion": "cultnet.database_change_raw.v0",
+            "messageId": "change-delete",
+            "subscriptionId": "sub-1",
+            "changeKind": "removed",
+            "schemaId": "schema-note",
+            "recordKey": "note:1",
+        })
+        self.assertIsNone(delete_change.document)
+        self.assertIsNone(delete_change.raw_document)
+        self.assertEqual(delete_change.schema_id, "schema-note")
+        self.assertEqual(delete_change.to_wire()["recordKey"], "note:1")
+
+    def test_cultnet_raw_put_helper_carries_message_id(self) -> None:
+        put = document_put_raw(
+            message_id="put-1",
+            key="record-a",
+            schema_id="schema-a",
+            stored_at="2026-06-13T00:00:00Z",
+            payload=b"payload",
+            source_runtime_id="python-test",
+            shard_id="interop",
+            shard_epoch=1,
+        ).to_wire()
+        self.assertEqual(put["schemaVersion"], "cultnet.document_put_raw.v0")
+        self.assertEqual(put["messageId"], "put-1")
+        self.assertEqual(put["document"]["recordKey"], "record-a")
+        self.assertEqual(put["document"]["sourceRuntimeId"], "python-test")
+        self.assertEqual(put["shardId"], "interop")
+        self.assertEqual(put["shardEpoch"], 1)
+
+    def test_cultnet_catalog_and_snapshot_helpers_accept_filters(self) -> None:
+        catalog = schema_catalog_request(
+            message_id="catalog-1",
+            include_schema_json=True,
+            schema_ids=["schema-a"],
+            kinds=["wire_message"],
+        ).to_wire()
+        self.assertEqual(catalog["schemaVersion"], "cultnet.schema_catalog_request.v0")
+        self.assertEqual(catalog["messageId"], "catalog-1")
+        self.assertTrue(catalog["includeSchemaJson"])
+        self.assertEqual(catalog["schemaIds"], ["schema-a"])
+        self.assertEqual(catalog["kinds"], ["wire_message"])
+
+        snapshot = snapshot_request(
+            message_id="snapshot-1",
+            schema_ids=["schema-a"],
+            record_keys=["record-a"],
+            shard_id="interop",
+            shard_epoch=1,
+        ).to_wire()
+        self.assertEqual(snapshot["schemaVersion"], "cultnet.snapshot_request.v0")
+        self.assertEqual(snapshot["messageId"], "snapshot-1")
+        self.assertEqual(snapshot["schemaIds"], ["schema-a"])
+        self.assertEqual(snapshot["recordKeys"], ["record-a"])
+        self.assertEqual(snapshot["shardId"], "interop")
+        self.assertEqual(snapshot["shardEpoch"], 1)
+
+    def test_cultnet_raw_snapshot_response_filters_and_roundtrips_records(self) -> None:
+        response = CultNetRawSnapshotResponse.from_wire({
+            "schemaVersion": "cultnet.snapshot_response_raw.v0",
+            "messageId": "snapshot-1",
+            "shardId": "notes",
+            "shardEpoch": 3,
+            "shardLogSequence": 8,
+            "documents": [
+                CultNetRawDocumentRecord(
+                    schema_id="schema-note",
+                    record_key="note:1",
+                    stored_at="2026-06-14T00:00:00Z",
+                    payload=b"note",
+                    source_runtime_id="python-test",
+                    tags=("snapshot",),
+                ).to_wire(),
+                {
+                    "schemaId": "schema-fact",
+                    "recordKey": "fact:1",
+                    "payloadEncoding": "messagepack",
+                    "payload": b"fact",
+                },
+            ],
+        })
+        self.assertEqual(response.shard_id, "notes")
+        self.assertEqual(response.shard_epoch, 3)
+        self.assertEqual(response.shard_log_sequence, 8)
+        self.assertEqual(response.documents[0].source_runtime_id, "python-test")
+        self.assertEqual(response.filter(schema_ids=["schema-note"])[0].record_key, "note:1")
+        self.assertEqual(response.filter(record_keys=["fact:1"])[0].schema_id, "schema-fact")
+        self.assertEqual(response.to_wire()["documents"][0]["tags"], ["snapshot"])
+
+    def test_cultnet_raw_client_fetches_schema_snapshot_and_shard_reads(self) -> None:
+        import msgpack  # type: ignore
+        from cultnet_py import read_frame, write_frame
+
+        received_versions: list[str] = []
+        ready = threading.Event()
+        server_error: list[BaseException] = []
+        port_holder: list[int] = []
+
+        def serve_requests() -> None:
+            try:
+                with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as server:
+                    server.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
+                    server.bind(("127.0.0.1", 0))
+                    port_holder.append(server.getsockname()[1])
+                    server.listen(4)
+                    ready.set()
+                    for _ in range(4):
+                        connection, _ = server.accept()
+                        with connection:
+                            stream = connection.makefile("rwb")
+                            request = msgpack.unpackb(read_frame(stream), raw=False)
+                            received_versions.append(request["schemaVersion"])
+                            if request["schemaVersion"] == "cultnet.schema_catalog_request.v0":
+                                self.assertEqual(request["kinds"], ["wire_message"])
+                                response = {"schemaVersion": "cultnet.schema_catalog_response.v0", "messageId": request["messageId"], "schemas": []}
+                            elif request["schemaVersion"] == "cultnet.snapshot_request.v0":
+                                self.assertEqual(request["shardId"], "interop")
+                                response = {"schemaVersion": "cultnet.snapshot_response_raw.v0", "messageId": request["messageId"], "documents": []}
+                            elif request["schemaVersion"] == "cultnet.shard_catalog_request.v0":
+                                response = {
+                                    "schemaVersion": "cultnet.shard_catalog_response.v0",
+                                    "messageId": request["messageId"],
+                                    "shards": [{
+                                        "shardId": "interop",
+                                        "ownerRuntimeId": "socket-test",
+                                        "epoch": 1,
+                                        "schemaIds": request["schemaIds"],
+                                        "keyPrefix": "record-",
+                                        "primaryEndpoints": ["cultnet://127.0.0.1:1"],
+                                    }],
+                                }
+                            elif request["schemaVersion"] == "cultnet.shard_log_request.v0":
+                                self.assertEqual(request["afterSequence"], 7)
+                                response = {
+                                    "schemaVersion": "cultnet.shard_log_response.v0",
+                                    "messageId": request["messageId"],
+                                    "shardId": request["shardId"],
+                                    "shardEpoch": request["shardEpoch"],
+                                    "entries": [],
+                                    "resyncRequired": False,
+                                }
+                            else:
+                                raise AssertionError(f"unexpected request {request['schemaVersion']}")
+                            write_frame(stream, msgpack.packb(response, use_bin_type=True))
+                            stream.flush()
+            except BaseException as error:
+                server_error.append(error)
+                ready.set()
+
+        thread = threading.Thread(target=serve_requests, daemon=True)
+        thread.start()
+        self.assertTrue(ready.wait(2.0))
+        self.assertFalse(server_error)
+
+        client = CultNetRawClient("127.0.0.1", port_holder[0], timeout_seconds=2.0)
+        self.assertEqual(client.fetch_schema_catalog(kinds=["wire_message"])["schemaVersion"], "cultnet.schema_catalog_response.v0")
+        typed_snapshot = client.fetch_snapshot_response(shard_id="interop", shard_epoch=1)
+        self.assertEqual(typed_snapshot.shard_id, None)
+        self.assertEqual(typed_snapshot.documents, ())
+        shard_catalog = CultNetShardCatalog()
+        synced_shards = client.sync_shard_catalog(shard_catalog, schema_ids=["schema-a"])
+        self.assertEqual(synced_shards[0].shard_id, "interop")
+        self.assertEqual(shard_catalog.get("interop"), synced_shards[0])
+        shard_log = client.fetch_shard_log_response(shard_id="interop", shard_epoch=1, after_sequence=7)
+        self.assertEqual(shard_log.shard_id, "interop")
+        self.assertFalse(shard_log.resync_required)
+        self.assertEqual(shard_log.last_sequence, 0)
+
+        thread.join(2.0)
+        self.assertFalse(server_error)
+        self.assertEqual(received_versions, [
+            "cultnet.schema_catalog_request.v0",
+            "cultnet.snapshot_request.v0",
+            "cultnet.shard_catalog_request.v0",
+            "cultnet.shard_log_request.v0",
+        ])
+
+    def test_cultnet_raw_client_raises_typed_peer_error_response(self) -> None:
+        import msgpack  # type: ignore
+        from cultnet_py import read_frame, write_frame
+
+        ready = threading.Event()
+        port_holder: list[int] = []
+
+        def serve_error() -> None:
+            with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as server:
+                server.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
+                server.bind(("127.0.0.1", 0))
+                port_holder.append(server.getsockname()[1])
+                server.listen(1)
+                ready.set()
+                connection, _ = server.accept()
+                with connection:
+                    stream = connection.makefile("rwb")
+                    read_frame(stream)
+                    write_frame(stream, msgpack.packb({
+                        "schemaVersion": "cultnet.error.v0",
+                        "messageId": "error-1",
+                        "error": "Snapshot document limit exceeded",
+                    }, use_bin_type=True))
+                    stream.flush()
+
+        thread = threading.Thread(target=serve_error, daemon=True)
+        thread.start()
+        self.assertTrue(ready.wait(2.0))
+
+        client = CultNetRawClient("127.0.0.1", port_holder[0], timeout_seconds=2.0)
+        with self.assertRaisesRegex(CultNetPeerError, "Snapshot document limit exceeded") as raised:
+            client.fetch_snapshot()
+
+        self.assertEqual(raised.exception.peer_error, "Snapshot document limit exceeded")
+        self.assertEqual(raised.exception.response["schemaVersion"], "cultnet.error.v0")
+        thread.join(2.0)
+
+    def test_cultnet_database_subscription_reads_snapshot_and_change(self) -> None:
+        import msgpack  # type: ignore
+        from cultnet_py import read_frame, write_frame
+
+        document = define_database_entry_type(
+            "sub.item",
+            [
+                ("name", 0),
+                ("category", 1),
+                ("value", 2, 0),
+            ],
+            cls=Item,
+        )
+        schema_id = document.catalog_entry().schema_id
+        ready = threading.Event()
+        server_error: list[BaseException] = []
+        port_holder: list[int] = []
+        received_versions: list[str] = []
+
+        def serve_subscription() -> None:
+            try:
+                with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as server:
+                    server.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
+                    server.bind(("127.0.0.1", 0))
+                    port_holder.append(server.getsockname()[1])
+                    server.listen(1)
+                    ready.set()
+                    connection, _ = server.accept()
+                    with connection:
+                        stream = connection.makefile("rwb")
+                        subscribe = msgpack.unpackb(read_frame(stream), raw=False)
+                        received_versions.append(subscribe["schemaVersion"])
+                        self.assertEqual(subscribe["subscriptionId"], "sub-1")
+                        snapshot = {
+                            "schemaVersion": "cultnet.snapshot_response_raw.v0",
+                            "messageId": subscribe["messageId"],
+                            "documents": [],
+                        }
+                        write_frame(stream, msgpack.packb(snapshot, use_bin_type=True))
+                        stream.flush()
+
+                        put = msgpack.unpackb(read_frame(stream), raw=False)
+                        received_versions.append(put["schemaVersion"])
+                        change = {
+                            "schemaVersion": "cultnet.database_change_raw.v0",
+                            "messageId": "change-1",
+                            "subscriptionId": "sub-1",
+                            "changeKind": "added",
+                            "document": put["document"],
+                        }
+                        write_frame(stream, msgpack.packb(change, use_bin_type=True))
+                        stream.flush()
+
+                        unsubscribe = msgpack.unpackb(read_frame(stream), raw=False)
+                        received_versions.append(unsubscribe["schemaVersion"])
+            except BaseException as error:
+                server_error.append(error)
+                ready.set()
+
+        thread = threading.Thread(target=serve_subscription, daemon=True)
+        thread.start()
+        self.assertTrue(ready.wait(2.0))
+        self.assertFalse(server_error)
+
+        client = CultNetRawClient("127.0.0.1", port_holder[0], timeout_seconds=2.0)
+        put = document_put_raw(
+            message_id="put-sub",
+            key="item:sub",
+            schema_id=schema_id,
+            stored_at="2026-06-14T00:00:00Z",
+            payload=document.encode_payload(Item("orb", "gear", 8)),
+        )
+        with client.subscribe_database(subscription_id="sub-1", schema_ids=[schema_id]) as subscription:
+            snapshot = subscription.read_next_snapshot_response()
+            subscription.send(put)
+            change = subscription.read_next_change()
+
+        thread.join(2.0)
+        self.assertFalse(server_error)
+        self.assertIsInstance(snapshot, CultNetRawSnapshotResponse)
+        self.assertEqual(snapshot.message_id, "cultnet-python-subscribe")
+        self.assertEqual(snapshot.to_wire()["schemaVersion"], "cultnet.snapshot_response_raw.v0")
+        self.assertEqual(change.change_kind, "added")
+        self.assertEqual(change.record_key, "item:sub")
+        self.assertIsInstance(change.raw_document, CultNetRawDocumentRecord)
+        self.assertEqual(change.raw_document.record_key, "item:sub")
+        self.assertEqual(received_versions, [
+            "cultnet.database_subscribe.v0",
+            "cultnet.document_put_raw.v0",
+            "cultnet.database_unsubscribe.v0",
+        ])
+
+    def test_cultnet_database_subscription_raises_typed_peer_error(self) -> None:
+        import msgpack  # type: ignore
+        from cultnet_py import read_frame, write_frame
+
+        ready = threading.Event()
+        port_holder: list[int] = []
+
+        def serve_subscription_error() -> None:
+            with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as server:
+                server.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
+                server.bind(("127.0.0.1", 0))
+                port_holder.append(server.getsockname()[1])
+                server.listen(1)
+                ready.set()
+                connection, _ = server.accept()
+                with connection:
+                    stream = connection.makefile("rwb")
+                    read_frame(stream)
+                    write_frame(stream, msgpack.packb({
+                        "schemaVersion": "cultnet.error.v0",
+                        "messageId": "subscription-error",
+                        "error": "subscription rejected",
+                    }, use_bin_type=True))
+                    stream.flush()
+
+        thread = threading.Thread(target=serve_subscription_error, daemon=True)
+        thread.start()
+        self.assertTrue(ready.wait(2.0))
+
+        client = CultNetRawClient("127.0.0.1", port_holder[0], timeout_seconds=2.0)
+        with client.subscribe_database(subscription_id="sub-error") as subscription:
+            with self.assertRaisesRegex(CultNetPeerError, "subscription rejected") as raised:
+                subscription.read_next()
+        self.assertEqual(raised.exception.response["messageId"], "subscription-error")
+        thread.join(2.0)
+
+    def test_cultnet_replication_helpers_apply_raw_snapshot_and_shard_log(self) -> None:
+        document = define_database_entry_type(
+            "replica.item",
+            [
+                ("name", 0),
+                ("category", 1),
+                ("value", 2, 0),
+            ],
+            cls=Item,
+        )
+        cache = CultCache()
+        cache.register_document_type(document)
+        schema_id = document.catalog_entry().schema_id
+
+        snapshot = {
+            "schemaVersion": "cultnet.snapshot_response_raw.v0",
+            "messageId": "snapshot-1",
+            "documents": [
+                {
+                    "schemaId": schema_id,
+                    "recordKey": "item:1",
+                    "storedAt": "2026-06-13T00:00:00Z",
+                    "payloadEncoding": "messagepack",
+                    "payload": document.encode_payload(Item("sword", "gear", 3)),
+                }
+            ],
+        }
+        applied_snapshot = apply_raw_snapshot(cache, [document], snapshot)
+        self.assertEqual(applied_snapshot[0].record_key, "item:1")
+        self.assertEqual(cache.get_required(document, "item:1").value, 3)
+        typed_snapshot = CultNetRawSnapshotResponse.from_wire(snapshot)
+        direct_applied = apply_raw_document_record(cache, schema_document_map([document]), typed_snapshot.documents[0])
+        self.assertEqual(direct_applied.schema_id, schema_id)
+        self.assertEqual(direct_applied.record_key, "item:1")
+        typed_snapshot_applied = apply_raw_snapshot(cache, [document], typed_snapshot)
+        self.assertEqual(typed_snapshot_applied[0].record_key, "item:1")
+
+        shard_log = {
+            "schemaVersion": "cultnet.shard_log_response.v0",
+            "messageId": "log-1",
+            "shardId": "interop",
+            "shardEpoch": 1,
+            "resyncRequired": False,
+            "entries": [
+                {
+                    "sequence": 0,
+                    "changeKind": "updated",
+                    "put": {
+                        "schemaVersion": "cultnet.document_put_raw.v0",
+                        "messageId": "put-unknown",
+                        "document": {
+                            "schemaId": "replica.unknown.v1",
+                            "recordKey": "unknown:1",
+                            "storedAt": "2026-06-13T00:00:01Z",
+                            "payloadEncoding": "messagepack",
+                            "payload": document.encode_payload(Item("ignored", "unknown", 0)),
+                        },
+                        "shardId": "interop",
+                        "shardEpoch": 1,
+                    },
+                },
+                {
+                    "sequence": 1,
+                    "changeKind": "updated",
+                    "put": {
+                        "schemaVersion": "cultnet.document_put_raw.v0",
+                        "messageId": "put-1",
+                        "document": {
+                            "schemaId": schema_id,
+                            "recordKey": "item:1",
+                            "storedAt": "2026-06-13T00:00:01Z",
+                            "payloadEncoding": "messagepack",
+                            "payload": document.encode_payload(Item("sword", "gear", 12)),
+                        },
+                        "shardId": "interop",
+                        "shardEpoch": 1,
+                    },
+                },
+                {
+                    "sequence": 2,
+                    "changeKind": "removed",
+                    "delete": {
+                        "schemaVersion": "cultnet.document_delete.v0",
+                        "messageId": "delete-1",
+                        "schemaId": schema_id,
+                        "recordKey": "item:1",
+                        "shardId": "interop",
+                        "shardEpoch": 1,
+                    },
+                },
+            ],
+        }
+        applied_log = apply_shard_log_response(cache, [document], shard_log)
+        self.assertEqual([change.change_kind for change in applied_log], ["updated", "removed"])
+        self.assertIsNone(cache.get(document, "item:1"))
+
+        cache.put(document, "item:1", Item("sword", "gear", 3))
+        typed_shard_log = CultNetShardLogResponse.from_wire({
+            **shard_log,
+            "entries": shard_log["entries"][1:],
+        })
+        typed_applied_log = apply_shard_log_response(cache, [document], typed_shard_log)
+        self.assertEqual([change.change_kind for change in typed_applied_log], ["updated", "removed"])
+        self.assertIsNone(cache.get(document, "item:1"))
+
+    def test_cultnet_replication_helpers_recover_schema_stamped_raw_records(self) -> None:
+        document = define_database_entry_type(
+            "replica.runtime-policy",
+            [
+                ("schema_version", 0),
+                ("name", 1),
+                ("value", 2),
+            ],
+            schema_id="replica.runtime-policy.current",
+            schema_name="replica.runtime_policy",
+            schema_version="replica.runtime_policy.v1",
+        )
+        cache = CultCache()
+        cache.register_document_type(document)
+        stale_schema_id = "sha256:stale-replica-runtime-policy"
+        payload = document.encode_payload({
+            "schema_version": "replica.runtime_policy.v1",
+            "name": "policy",
+            "value": "still synced",
+        })
+        record = {
+            "schemaId": stale_schema_id,
+            "recordKey": "policy:1",
+            "storedAt": "2026-06-25T00:00:00Z",
+            "payloadEncoding": "messagepack",
+            "payload": payload,
+        }
+        snapshot = {
+            "schemaVersion": "cultnet.snapshot_response_raw.v0",
+            "messageId": "snapshot-stale",
+            "documents": [record],
+        }
+
+        applied_snapshot = apply_raw_snapshot(cache, [document], snapshot)
+        local_schema_id = document.catalog_entry().schema_id
+        self.assertEqual(applied_snapshot[0].schema_id, local_schema_id)
+        self.assertEqual(cache.get_required(document, "policy:1")["value"], "still synced")
+        self.assertEqual(cache.get_required_envelope(document, "policy:1").schema_id, local_schema_id)
+        direct_applied = apply_raw_document_record(cache, schema_document_map([document]), record)
+        self.assertEqual(direct_applied.schema_id, local_schema_id)
+        self.assertEqual(cache.get_required_envelope(document, "policy:1").schema_id, local_schema_id)
+
+        shard_log = {
+            "schemaVersion": "cultnet.shard_log_response.v0",
+            "messageId": "log-stale",
+            "shardId": "interop",
+            "shardEpoch": 1,
+            "resyncRequired": False,
+            "entries": [
+                {
+                    "sequence": 0,
+                    "changeKind": "updated",
+                    "put": {
+                        "schemaVersion": "cultnet.document_put_raw.v0",
+                        "messageId": "put-stale",
+                        "document": {
+                            **record,
+                            "payload": document.encode_payload({
+                                "schema_version": "replica.runtime_policy.v1",
+                                "name": "policy",
+                                "value": "updated through log",
+                            }),
+                        },
+                        "shardId": "interop",
+                        "shardEpoch": 1,
+                    },
+                }
+            ],
+        }
+
+        applied_log = apply_shard_log_response(cache, [document], shard_log)
+        self.assertEqual(applied_log[0].schema_id, local_schema_id)
+        self.assertEqual(cache.get_required(document, "policy:1")["value"], "updated through log")
+        self.assertEqual(cache.get_required_envelope(document, "policy:1").schema_id, local_schema_id)
+
+        delete_log = {
+            "schemaVersion": "cultnet.shard_log_response.v0",
+            "messageId": "log-delete-alias",
+            "shardId": "interop",
+            "shardEpoch": 1,
+            "resyncRequired": False,
+            "entries": [
+                {
+                    "sequence": 1,
+                    "changeKind": "removed",
+                    "delete": {
+                        "schemaVersion": "cultnet.document_delete.v0",
+                        "messageId": "delete-version-alias",
+                        "schemaId": "replica.runtime_policy.v1",
+                        "recordKey": "policy:1",
+                        "shardId": "interop",
+                        "shardEpoch": 1,
+                    },
+                }
+            ],
+        }
+        applied_delete = apply_shard_log_response(cache, [document], delete_log)
+        self.assertEqual(applied_delete[0].schema_id, local_schema_id)
+        self.assertEqual(applied_delete[0].change_kind, "removed")
+        self.assertIsNone(cache.get(document, "policy:1"))
+
+    def test_cultnet_document_delete_helper_matches_schema_v0_shape(self) -> None:
+        message = document_delete(
+            message_id="delete-1",
+            schema_id="schema-a",
+            record_key="record-a",
+            shard_id="interop",
+            shard_epoch=1,
+        ).to_wire()
+        self.assertEqual(message["schemaVersion"], "cultnet.document_delete.v0")
+        self.assertEqual(message["messageId"], "delete-1")
+        self.assertEqual(message["schemaId"], "schema-a")
+        self.assertEqual(message["recordKey"], "record-a")
+        self.assertEqual(message["shardId"], "interop")
+        self.assertEqual(message["shardEpoch"], 1)
+
+    def test_cultnet_auth_session_helpers_match_schema_v0_shape(self) -> None:
+        self.assertEqual(
+            login(nonce="nonce", auth="encrypted-auth", password="encrypted-password").to_wire(),
+            {
+                "schemaVersion": "cultnet.login.v0",
+                "nonce": "nonce",
+                "auth": "encrypted-auth",
+                "password": "encrypted-password",
+            },
+        )
+        self.assertEqual(
+            register(
+                nonce="nonce",
+                email="encrypted-email",
+                password="encrypted-password",
+                name="encrypted-name",
+            ).to_wire(),
+            {
+                "schemaVersion": "cultnet.register.v0",
+                "nonce": "nonce",
+                "email": "encrypted-email",
+                "password": "encrypted-password",
+                "name": "encrypted-name",
+            },
+        )
+        self.assertEqual(
+            verify_session(nonce="nonce", session="encrypted-session").to_wire(),
+            {
+                "schemaVersion": "cultnet.verify.v0",
+                "nonce": "nonce",
+                "session": "encrypted-session",
+            },
+        )
+        self.assertEqual(
+            login_success(nonce="nonce", session="encrypted-session").to_wire(),
+            {
+                "schemaVersion": "cultnet.login_success.v0",
+                "nonce": "nonce",
+                "session": "encrypted-session",
+            },
+        )
+
+    def test_cultnet_wire_catalog_describes_python_handled_messages(self) -> None:
+        descriptors = wire_message_schema_descriptors(include_schema_json=True)
+        by_version = {descriptor["schemaVersion"]: descriptor for descriptor in descriptors}
+        for schema_version in [
+            "cultnet.error.v0",
+            "cultnet.login.v0",
+            "cultnet.register.v0",
+            "cultnet.verify.v0",
+            "cultnet.login_success.v0",
+            "cultnet.transport_profile.v0",
+            "cultnet.document_delete.v0",
+            "cultnet.database_change_raw.v0",
+            "cultnet.shard_log_response.v0",
+            "cultnet.simulation_consensus_candidate.v0",
+            "cultmesh.peer_exchange_response.v0",
+        ]:
+            self.assertIn(schema_version, by_version)
+            expected_kind = "shared_contract" if schema_version == "cultnet.transport_profile.v0" else "wire_message"
+            self.assertEqual(by_version[schema_version]["kind"], expected_kind)
+            self.assertIn("cultnet.schema.v0", by_version[schema_version]["wireContracts"])
+            self.assertIn(schema_version, by_version[schema_version]["schemaJson"])
+            self.assertEqual(len(by_version[schema_version]["contentHash"]), 64)
+
+        delete_schema = json.loads(by_version["cultnet.document_delete.v0"]["schemaJson"])
+        self.assertEqual(
+            delete_schema["required"],
+            ["schemaVersion", "messageId", "schemaId", "recordKey"],
+        )
+        self.assertEqual(delete_schema["properties"]["recordKey"]["type"], "string")
+
+        error_schema = json.loads(by_version["cultnet.error.v0"]["schemaJson"])
+        self.assertEqual(error_schema["required"], ["schemaVersion", "error"])
+        self.assertEqual(error_schema["properties"]["error"]["type"], "string")
+        self.assertIn("details", error_schema["properties"])
+
+        login_schema = json.loads(by_version["cultnet.login.v0"]["schemaJson"])
+        self.assertEqual(login_schema["required"], ["schemaVersion", "nonce", "auth", "password"])
+        self.assertEqual(login_schema["properties"]["auth"]["type"], "string")
+
+        register_schema = json.loads(by_version["cultnet.register.v0"]["schemaJson"])
+        self.assertEqual(register_schema["required"], ["schemaVersion", "nonce", "email", "password", "name"])
+        self.assertEqual(register_schema["properties"]["email"]["type"], "string")
+
+        verify_schema = json.loads(by_version["cultnet.verify.v0"]["schemaJson"])
+        self.assertEqual(verify_schema["required"], ["schemaVersion", "nonce", "session"])
+        self.assertEqual(verify_schema["properties"]["session"]["type"], "string")
+
+        success_schema = json.loads(by_version["cultnet.login_success.v0"]["schemaJson"])
+        self.assertEqual(success_schema["required"], ["schemaVersion", "nonce", "session"])
+
+        transport_profile_schema = json.loads(by_version["cultnet.transport_profile.v0"]["schemaJson"])
+        self.assertEqual(transport_profile_schema["required"], ["schemaVersion", "runtimeId", "transports"])
+        transport = transport_profile_schema["properties"]["transports"]["items"]
+        self.assertEqual(transport["properties"]["protocol"]["enum"], ["tcp_framed", "litenetlib", "websocket", "rudp"])
+        self.assertEqual(
+            transport["properties"]["reconnectPolicy"]["properties"]["schemaVersion"]["const"],
+            "cultnet.reconnect_policy.v0",
+        )
+        channel = transport["properties"]["channels"]["items"]
+        self.assertEqual(channel["properties"]["ordering"]["enum"], ["ordered", "unordered", "sequenced"])
+
+        change_schema = json.loads(by_version["cultnet.database_change_raw.v0"]["schemaJson"])
+        self.assertEqual(change_schema["properties"]["changeKind"]["enum"], ["added", "updated", "removed"])
+        self.assertIn("document", change_schema["properties"])
+        self.assertIn("schemaId", change_schema["properties"])
+        self.assertIn("recordKey", change_schema["properties"])
+
+        log_schema = json.loads(by_version["cultnet.shard_log_response.v0"]["schemaJson"])
+        self.assertIn("entries", log_schema["required"])
+        self.assertIn("resyncRequired", log_schema["required"])
+        self.assertIn("compactedThrough", log_schema["properties"])
+
+        hello_schema = json.loads(by_version["cultnet.hello.v0"]["schemaJson"])
+        mutation_contract = hello_schema["properties"]["supportedMutationContracts"]["items"]
+        self.assertEqual(mutation_contract["type"], "object")
+        self.assertIn("operations", mutation_contract["properties"])
+        self.assertEqual(
+            hello_schema["properties"]["transportProfiles"]["items"]["$ref"],
+            "https://github.com/GameCult/cultnet-ts/contracts/cultnet.transport-profile.schema.json",
+        )
+
+        consensus_schema = json.loads(by_version["cultnet.simulation_consensus_candidate.v0"]["schemaJson"])
+        for required_field in ["witnessCount", "supportWeight", "totalWeight", "hasQuorum", "confidence"]:
+            self.assertIn(required_field, consensus_schema["required"])
+
+    def test_cultnet_schema_catalog_applies_filters_and_responses(self) -> None:
+        catalog = wire_message_schema_catalog(include_schema_json=True)
+        descriptor = catalog.get("https://github.com/GameCult/cultnet-ts/contracts/cultnet.document-put-raw.schema.json")
+        self.assertIsNotNone(descriptor)
+        assert descriptor is not None
+        self.assertEqual(descriptor.kind, "wire_message")
+        self.assertEqual(descriptor.schema_version, "cultnet.document_put_raw.v0")
+        self.assertIsNotNone(descriptor.schema_json)
+
+        filtered = catalog.list(kinds=["wire_message"], schema_ids=[descriptor.schema_id])
+        self.assertEqual(filtered, [descriptor])
+
+        response = catalog.create_response(
+            message_id="catalog-response",
+            include_schema_json=False,
+            schema_ids=[descriptor.schema_id],
+            kinds=["wire_message"],
+        )
+        self.assertEqual(response["schemaVersion"], "cultnet.schema_catalog_response.v0")
+        self.assertNotIn("schemaJson", response["schemas"][0])
+
+        remote = CultNetSchemaCatalog()
+        applied = remote.apply_response({
+            "schemaVersion": "cultnet.schema_catalog_response.v0",
+            "messageId": "remote",
+            "schemas": [
+                CultNetSchemaDescriptor(
+                    schema_id="schema:custom",
+                    kind="shared_contract",
+                    schema_version="custom.v0",
+                    wire_contracts=("cultnet.schema.v0",),
+                    content_hash="hash",
+                    schema_json="{}",
+                ).to_wire()
+            ],
+        })
+        self.assertEqual(applied[0].schema_id, "schema:custom")
+        self.assertEqual(remote.get("schema:custom"), applied[0])
+
+    def test_cultnet_shard_helpers_match_schema_v0_shape(self) -> None:
+        catalog = shard_catalog_request(
+            message_id="catalog-1",
+            schema_ids=["schema-a"],
+            record_keys=["record-a"],
+        ).to_wire()
+        self.assertEqual(catalog["schemaVersion"], "cultnet.shard_catalog_request.v0")
+        self.assertEqual(catalog["messageId"], "catalog-1")
+        self.assertEqual(catalog["schemaIds"], ["schema-a"])
+        self.assertEqual(catalog["recordKeys"], ["record-a"])
+
+        log = shard_log_request(
+            message_id="log-1",
+            shard_id="interop",
+            shard_epoch=7,
+            after_sequence=3,
+            limit=2,
+        ).to_wire()
+        self.assertEqual(log["schemaVersion"], "cultnet.shard_log_request.v0")
+        self.assertEqual(log["messageId"], "log-1")
+        self.assertEqual(log["shardId"], "interop")
+        self.assertEqual(log["shardEpoch"], 7)
+        self.assertEqual(log["afterSequence"], 3)
+        self.assertEqual(log["limit"], 2)
+
+    def test_cultnet_shard_catalog_applies_filters_and_responses(self) -> None:
+        catalog = CultNetShardCatalog()
+        primary = catalog.upsert(CultNetShardDescriptor(
+            shard_id="notes",
+            owner_runtime_id="python-runtime",
+            epoch=2,
+            is_primary=True,
+            schema_ids=("schema-note.v1",),
+            key_prefix="note:",
+            primary_endpoints=("cultnet://127.0.0.1:3075",),
+            read_replica_endpoints=("cultnet://127.0.0.1:3075",),
+            region="local",
+        ))
+        catalog.upsert({
+            "shardId": "facts",
+            "ownerRuntimeId": "python-runtime",
+            "epoch": 1,
+            "schemaIds": ["schema-fact"],
+            "keyPrefix": "fact:",
+            "primaryEndpoints": ["cultnet://127.0.0.1:3076"],
+        })
+
+        self.assertTrue(primary.serves(schema_id="schema-note.v1", record_key="note:1"))
+        self.assertTrue(primary.serves(schema_id="schema-note", record_key="note:1"))
+        self.assertFalse(primary.serves(schema_id="schema-note", record_key="fact:1"))
+        self.assertEqual(catalog.list(schema_ids=["schema-note.v1"]), [primary])
+        self.assertEqual(catalog.list(schema_ids=["schema-note"]), [primary])
+        self.assertEqual(catalog.list(record_keys=["note:1"]), [primary])
+
+        response = catalog.create_response(
+            message_id="shards",
+            schema_ids=["schema-note"],
+            record_keys=["note:1"],
+        )
+        self.assertEqual(response["schemaVersion"], "cultnet.shard_catalog_response.v0")
+        self.assertEqual(response["shards"][0]["shardId"], "notes")
+        self.assertEqual(response["shards"][0]["ownerRuntimeId"], "python-runtime")
+
+        remote = CultNetShardCatalog()
+        applied = remote.apply_response(response)
+        self.assertEqual(applied[0].shard_id, "notes")
+        self.assertEqual(remote.get("notes"), applied[0])
+
+    def test_cultnet_shard_log_response_tracks_cursor_and_resync_state(self) -> None:
+        response = CultNetShardLogResponse.from_wire({
+            "schemaVersion": "cultnet.shard_log_response.v0",
+            "messageId": "log",
+            "shardId": "notes",
+            "shardEpoch": 2,
+            "entries": [
+                CultNetShardLogEntry(
+                    sequence=2,
+                    change_kind="updated",
+                    put={"schemaVersion": "cultnet.document_put_raw.v0", "messageId": "put", "document": {"schemaId": "schema-note", "recordKey": "note:1", "payload": b"p"}},
+                    committed_at="2026-06-14T00:00:00Z",
+                ).to_wire(),
+                {"sequence": 3, "changeKind": "removed", "delete": {"schemaId": "schema-note", "recordKey": "note:1"}},
+            ],
+            "resyncRequired": False,
+        })
+        self.assertEqual(response.last_sequence, 3)
+        self.assertFalse(response.resync_required)
+        self.assertEqual(response.entries[0].put["document"]["recordKey"], "note:1")
+        self.assertIsInstance(response.entries[0].raw_document, CultNetRawDocumentRecord)
+        self.assertEqual(response.entries[0].raw_document.record_key, "note:1")
+        self.assertEqual(response.entries[1].delete_schema_id, "schema-note")
+        self.assertEqual(response.entries[1].delete_record_key, "note:1")
+        self.assertEqual(response.to_wire()["entries"][1]["delete"]["recordKey"], "note:1")
+        self.assertIs(response.require_usable(), response)
+
+        resync = CultNetShardLogResponse.from_wire({
+            "schemaVersion": "cultnet.shard_log_response.v0",
+            "messageId": "log-resync",
+            "shardId": "notes",
+            "shardEpoch": 2,
+            "entries": [],
+            "resyncRequired": True,
+            "reason": "compacted",
+            "compactedThrough": 12,
+        })
+        self.assertEqual(resync.last_sequence, 12)
+        with self.assertRaisesRegex(ValueError, "compacted"):
+            resync.require_usable()
+
+    def test_cultnet_simulation_observation_helper_matches_schema_v0_shape(self) -> None:
+        claim_hash = compute_simulation_claim_hash("frame:42", "subject:player-1", "hit")
+        self.assertEqual(len(claim_hash), 64)
+        message = simulation_observation(
+            message_id="obs-1",
+            witness_runtime_id="python-test",
+            shard_id="interop",
+            shard_epoch=1,
+            frame=42,
+            subject_id="player-1",
+            claim_kind="hit",
+            claim_hash=claim_hash,
+            claim_summary="player-1 hit target-a",
+            observed_at="2026-06-13T00:00:02Z",
+        ).to_wire()
+        self.assertEqual(message["schemaVersion"], "cultnet.simulation_observation.v0")
+        self.assertEqual(message["messageId"], "obs-1")
+        self.assertEqual(message["observation"]["witnessRuntimeId"], "python-test")
+        self.assertEqual(message["observation"]["claimHash"], claim_hash)
+        self.assertEqual(message["observation"]["weight"], 1.0)
+        observation = CultNetSimulationObservation.from_wire(message)
+        self.assertEqual(observation.witness_runtime_id, "python-test")
+        self.assertEqual(observation.claim_summary, "player-1 hit target-a")
+        self.assertEqual(observation.to_message_wire(message_id="obs-2")["observation"], message["observation"])
+
+    def test_cultnet_witness_artifact_bundle_uses_csharp_slot_order(self) -> None:
+        import msgpack  # type: ignore
+
+        bundle = witness_artifact_bundle(
+            bundle_id="bundle-1",
+            witness_kind="interop-proof",
+            captured_at="2026-06-13T00:00:03Z",
+            subject={"documentType": "cultnet.interop-note", "subjectId": "note:python"},
+            contracts=[{"role": "payload", "schemaId": "schema-a"}],
+            artifacts=[{"role": "log", "uri": "cultcache://bundle-1/log", "mediaType": "text/plain"}],
+            timing_witnesses=[{"stage": "roundtrip", "startedAt": "2026-06-13T00:00:03Z", "completedAt": "2026-06-13T00:00:04Z", "latencyMs": 1.0}],
+            provenance={"pipelineId": "interop", "runId": "run-1", "runtimeId": "python-test"},
+        )
+        payload = encode_witness_artifact_bundle_payload(bundle)
+        decoded = decode_witness_artifact_bundle_payload(payload)
+        typed = CultNetWitnessArtifactBundle.from_wire(bundle)
+        typed_payload = typed.to_payload()
+        typed_decoded = CultNetWitnessArtifactBundle.from_payload(typed_payload)
+        slots = msgpack.unpackb(payload, raw=False)
+
+        self.assertEqual(payload, typed_payload)
+        self.assertEqual(slots[0], "bundle-1")
+        self.assertEqual(slots[1], "interop-proof")
+        self.assertEqual(slots[2], "2026-06-13T00:00:03Z")
+        self.assertEqual(slots[3]["subjectId"], "note:python")
+        self.assertEqual(slots[4][0]["schemaId"], "schema-a")
+        self.assertEqual(slots[5][0]["uri"], "cultcache://bundle-1/log")
+        self.assertEqual(slots[6][0]["latencyMs"], 1.0)
+        self.assertEqual(slots[7]["runtimeId"], "python-test")
+        self.assertEqual(decoded["bundleId"], "bundle-1")
+        self.assertEqual(decoded["witnessKind"], "interop-proof")
+        self.assertEqual(decoded["subject"]["subjectId"], "note:python")
+        self.assertEqual(decoded["contracts"][0]["schemaId"], "schema-a")
+        self.assertEqual(decoded["artifacts"][0]["mediaType"], "text/plain")
+        self.assertEqual(decoded["provenance"]["runtimeId"], "python-test")
+        self.assertEqual(typed.bundle_id, "bundle-1")
+        self.assertEqual(typed_decoded.to_wire(), bundle)
+
+    def test_python_interop_peer_filters_shard_snapshot_by_logged_membership(self) -> None:
+        runtime_id = f"python-interop-test-{uuid4().hex}"
+        state = build_state(
+            runtime_id=runtime_id,
+            runtime_kind="python",
+            display_name="Python Interop Test",
+            agent_id="python-interop-test-agent",
+            schema_path=str(Path("packages/cultnet-ts/integration/contracts/cultnet.interop-note.schema.json")),
+        )
+        binding = state.bindings["note"]
+        logged_value = {
+            "schemaVersion": "cultnet.interop_note.v0",
+            "documentId": "note:logged",
+            "authorRuntimeId": runtime_id,
+            "title": "Logged",
+            "body": "This record belongs to the shard log.",
+            "tags": ["interop", "logged"],
+        }
+        unlogged_value = {
+            **logged_value,
+            "documentId": "note:unlogged",
+            "title": "Unlogged",
+            "body": "This record is in cache but not in the shard log.",
+        }
+        state.cache.put(binding.document, "note:logged", logged_value)
+        state.cache.put(binding.document, "note:unlogged", unlogged_value)
+        logged_record = {
+            "schemaId": state.note_schema_id,
+            "recordKey": "note:logged",
+            "storedAt": "2026-06-14T00:00:00Z",
+            "payloadEncoding": "messagepack",
+            "payload": binding.document.encode_payload(logged_value),
+        }
+        append_shard_log_put(
+            state,
+            {"messageId": "logged-put"},
+            logged_record,
+        )
+
+        response = raw_snapshot_response(
+            state,
+            {
+                "schemaVersion": "cultnet.snapshot_request.v0",
+                "messageId": "interop-shard-snapshot",
+                "schemaIds": [state.note_schema_id],
+                "shardId": state.shard_id,
+            },
+        )
+
+        self.assertEqual(response["shardId"], state.shard_id)
+        self.assertEqual(response["shardLogSequence"], 1)
+        self.assertEqual([record["recordKey"] for record in response["documents"]], ["note:logged"])
+
+    def test_cultnet_simulation_consensus_dedupes_witnesses_and_requires_quorum(self) -> None:
+        from cultnet_py import CultNetSimulationConsensus
+
+        consensus = CultNetSimulationConsensus(
+            CultNetSimulationConsensusOptions(minimum_witnesses=2, quorum_ratio=1.0)
+        )
+        claim_hash = compute_simulation_claim_hash("hit", "alice", "bob", "frame:100")
+        observations = [
+            {
+                "witnessRuntimeId": "watcher-1",
+                "shardId": "arena",
+                "shardEpoch": 4,
+                "frame": 100,
+                "subjectId": "bob",
+                "claimKind": "hit",
+                "claimHash": claim_hash,
+                "claimSummary": "alice shot bob first",
+                "weight": 1.0,
+            },
+            {
+                "witnessRuntimeId": "watcher-1",
+                "shardId": "arena",
+                "shardEpoch": 4,
+                "frame": 100,
+                "subjectId": "bob",
+                "claimKind": "hit",
+                "claimHash": "stale-duplicate",
+                "weight": 0.5,
+            },
+            {
+                "witnessRuntimeId": "watcher-2",
+                "shardId": "arena",
+                "shardEpoch": 4,
+                "frame": 100,
+                "subjectId": "bob",
+                "claimKind": "hit",
+                "claimHash": claim_hash,
+                "weight": 1.0,
+            },
+        ]
+
+        candidates = consensus.build_candidates(observations)
+        typed_candidates = consensus.build_candidate_objects([
+            CultNetSimulationObservation.from_wire(observation)
+            for observation in observations
+        ])
+
+        self.assertEqual(len(candidates), 1)
+        self.assertEqual(candidates[0]["claimHash"], claim_hash)
+        self.assertEqual(candidates[0]["witnessCount"], 2)
+        self.assertEqual(candidates[0]["supportWeight"], 2.0)
+        self.assertTrue(candidates[0]["hasQuorum"])
+        self.assertEqual(len(typed_candidates), 1)
+        self.assertIsInstance(typed_candidates[0], CultNetSimulationConsensusCandidate)
+        self.assertEqual(typed_candidates[0].claim_hash, claim_hash)
+        self.assertEqual(typed_candidates[0].to_wire(), candidates[0])
+        self.assertEqual(CultNetSimulationConsensusCandidate.from_wire(candidates[0]), typed_candidates[0])
+
+
+class CultNetRudpFragmentBoundTests(unittest.TestCase):
+    def _pair(self) -> tuple[CultNetRudpSession, CultNetRudpSession]:
+        sender = CultNetRudpSession(CultNetRudpSessionOptions(connection_id=311, initial_sequence=1))
+        receiver = CultNetRudpSession(CultNetRudpSessionOptions(connection_id=311, initial_sequence=100))
+        sender.receive(CultNetRudpPacket(CultNetRudpPacketType.ACCEPT, 311, 90, 0, 0, "control"))
+        receiver.receive(CultNetRudpPacket(CultNetRudpPacketType.ACCEPT, 311, 91, 0, 0, "control"))
+        return sender, receiver
+
+    def test_stranded_fragment_sets_are_bounded_and_evicted_oldest_first(self) -> None:
+        sender, receiver = self._pair()
+        receiver._max_pending_fragment_sets = 4
+
+        # Eight payloads each lose their last fragment; the map must not grow past four.
+        stranded = []
+        for fill in range(1, 9):
+            packets = sender.send_many("media", bytes([fill]) * 2500, max_fragment_bytes=1000)
+            self.assertEqual(len(packets), 3)
+            for packet in packets[:2]:
+                self.assertEqual(receiver.receive(packet).delivered, ())
+            stranded.append(packets[2])
+        self.assertEqual(len(receiver._fragment_buffers), 4)
+        self.assertEqual(receiver.fragment_sets_evicted, 4)
+
+        # A complete payload still lands.
+        delivered = []
+        for packet in sender.send_many("media", bytes([9]) * 2500, max_fragment_bytes=1000):
+            delivered.extend(receiver.receive(packet).delivered)
+        self.assertEqual([frame.payload for frame in delivered], [bytes([9]) * 2500])
+        self.assertEqual(receiver.fragment_sets_evicted, 5)
+
+        # Oldest-first: set 8 still pends and completes late; set 1 was evicted.
+        self.assertEqual(receiver.receive(stranded[7]).delivered[0].payload, bytes([8]) * 2500)
+        self.assertEqual(receiver.receive(stranded[0]).delivered, ())
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/packages/cultcache-py/tools/GameCult.Caching.Benchmark/GameCult.Caching.Benchmark.csproj b/packages/cultnet-py/tools/GameCult.Caching.Benchmark/GameCult.Caching.Benchmark.csproj
similarity index 100%
rename from packages/cultcache-py/tools/GameCult.Caching.Benchmark/GameCult.Caching.Benchmark.csproj
rename to packages/cultnet-py/tools/GameCult.Caching.Benchmark/GameCult.Caching.Benchmark.csproj
diff --git a/packages/cultcache-py/tools/GameCult.Caching.Benchmark/Program.cs b/packages/cultnet-py/tools/GameCult.Caching.Benchmark/Program.cs
similarity index 96%
rename from packages/cultcache-py/tools/GameCult.Caching.Benchmark/Program.cs
rename to packages/cultnet-py/tools/GameCult.Caching.Benchmark/Program.cs
index 698b07ec..14ec8d5e 100644
--- a/packages/cultcache-py/tools/GameCult.Caching.Benchmark/Program.cs
+++ b/packages/cultnet-py/tools/GameCult.Caching.Benchmark/Program.cs
@@ -1,6 +1,7 @@
 using System.Diagnostics;
 using System.Text.Json;
 using GameCult.Caching;
+using MessagePack;
 
 var records = 5000;
 var emitJson = false;
@@ -93,12 +94,15 @@ internal sealed record BenchmarkResult(string Runtime, int Records, IReadOnlyLis
 internal sealed record BenchmarkMetric(string Name, int Operations, double ElapsedMs, double OpsPerSecond);
 
 [CultDocument("bench.item", "bench.item.v1")]
+[MessagePackObject(AllowPrivate = true)]
 internal sealed class BenchItem
 {
-    [CultName]
+    [Key(0)] [CultName]
     public string Name { get; set; } = string.Empty;
 
+    [Key(1)]
     public string Category { get; set; } = string.Empty;
 
+    [Key(2)]
     public int Value { get; set; }
 }
diff --git a/packages/cultnet-rs/Cargo.toml b/packages/cultnet-rs/Cargo.toml
index 41d14b52..f289d86e 100644
--- a/packages/cultnet-rs/Cargo.toml
+++ b/packages/cultnet-rs/Cargo.toml
@@ -16,6 +16,7 @@ anyhow = "1"
 base64 = "0.22"
 chrono = { version = "0.4", features = ["serde"] }
 cultcache-rs = { path = "../cultcache-rs" }
+ed25519-dalek = "2.2"
 hmac = "0.12"
 rand = "0.9"
 rmp-serde = "1.3"
@@ -24,9 +25,13 @@ serde = { version = "1", features = ["derive"] }
 serde_bytes = "0.11"
 serde_json = "1"
 sha2 = "0.10"
+zeroize = "1"
 socket2 = "0.5"
 uuid = { version = "1", features = ["v4"] }
 
+[target.'cfg(windows)'.dependencies]
+windows-sys = { version = "0.61", features = ["Win32_Foundation", "Win32_Security_Cryptography"] }
+
 [dev-dependencies]
 pretty_assertions = "1.4"
 tempfile = "3"
diff --git a/packages/cultnet-rs/README.md b/packages/cultnet-rs/README.md
index 69ab72c4..7ade81dc 100644
--- a/packages/cultnet-rs/README.md
+++ b/packages/cultnet-rs/README.md
@@ -43,6 +43,7 @@ The initial tests prove:
 - shard catalog request/response filtering and response application
 - CultCache snapshot replication through registered typed documents
 - raw snapshot replication that preserves the original payload bytes
+- raw snapshot replication into a local same-schema Rust alias type
 - document mutation contract advertisement through hello frames and registries
 
 ## Schema Discovery
@@ -110,12 +111,65 @@ CultCache along with the typed envelope metadata. Combined with
 `CultCache::put_envelope::<T>()`, that lets a bit-compatible neighbor ingest the
 document without re-encoding the payload first.
 
+The receiving Rust type does not have to be the sender's concrete Rust type. If
+the local registry binds a different `DatabaseEntry` to the same schema id,
+`sync_raw_document_from_snapshot_response::<LocalAlias>(...)` hydrates one local
+alias type directly:
+
+```rust
+let mut target_registry = CultNetDocumentRegistry::new();
+target_registry.register(CultNetDocumentBinding::for_entry_with_schema_id::<UiNote>(
+    "aetheria.note.v1".to_string(),
+    "aetheria.note.v1".to_string(),
+));
+
+let note = target_registry.sync_raw_document_from_snapshot_response::<UiNote>(
+    &mut target_cache,
+    &snapshot_response,
+    "note:bridge",
+)?;
+```
+
 That still is not zero-copy in the religious sense. Frames allocate, bytes move,
 and the receiving cache still decodes once to keep typed reads and validation
 honest. The win is narrower and realer: identical payload bytes stop getting
 decoded into generic sludge and then encoded right back into the same bytes for
 no reason.
 
+## Reactive Documents
+
+For local state that should feel owned by the caller, Rust can wrap a registered
+CultCache record as a managed reactive document:
+
+```rust
+use std::sync::{Arc, Mutex};
+use cultnet_rs::{CultNetReactiveDocumentOptions, CultNetDocumentRegistry};
+
+let cache = Arc::new(Mutex::new(target_cache));
+let note = registry.reactive_document::<UiNote>(
+    Arc::clone(&cache),
+    "note:bridge",
+    CultNetReactiveDocumentOptions::default(),
+)?;
+
+{
+    let current = note.current();
+    current.lock().unwrap().body = "local prediction".to_string();
+}
+```
+
+The handle polls the serialized `current` value on the configured debounce
+cadence and flushes changed state back through the typed cache. `update(...)`,
+`set_current(...)`, `mark_dirty()`, and `flush()` are available when the caller
+wants a more explicit Rust shape.
+
+When a canonical document put arrives while local state is dirty,
+`apply_document_put_message(...)` or `apply_raw_document_put_message(...)`
+records a `CultNetReactiveDocumentReconciliation`: the canonical value, the
+predicted local value, and a delta that can be smoothed by the caller. CultCache
+payloads serialize by numeric field slot, so Rust tuple-backed deltas use slot
+keys such as `"0"` and `"1"` when field names are not present on the wire.
+
 ## CultMesh Rust Facade
 
 Rust is still the low-level substrate runtime, not a clone of the C# game
diff --git a/packages/cultnet-rs/examples/cultnet_interop_peer.rs b/packages/cultnet-rs/examples/cultnet_interop_peer.rs
index ab00c6c8..07f6f400 100644
--- a/packages/cultnet-rs/examples/cultnet_interop_peer.rs
+++ b/packages/cultnet-rs/examples/cultnet_interop_peer.rs
@@ -256,7 +256,7 @@ fn serve(config: PeerConfig) -> Result<()> {
     register_capability_entry_types(&mut cache)?;
     cache.add_generic_backing_store(SingleFileMessagePackBackingStore::new(runtime_store_path(
         &config.runtime_id,
-    )));
+    )))?;
     cache.pull_all_backing_stores()?;
     let note = build_note(&config.runtime_id, &config.display_name);
     cache.put(&note.document_id, &note)?;
@@ -380,7 +380,7 @@ fn dial(config: DialConfig) -> Result<()> {
     register_capability_entry_types(&mut cache)?;
     cache.add_generic_backing_store(SingleFileMessagePackBackingStore::new(runtime_store_path(
         &format!("{}-dial", config.runtime_id),
-    )));
+    )))?;
     cache.pull_all_backing_stores()?;
 
     let mut document_registry = CultNetDocumentRegistry::new();
@@ -986,6 +986,9 @@ fn run_rudp_server(
                 if let Some(reply) = result.reply {
                     send_rudp_packet(&socket, remote_addr, &reply)?;
                 }
+                for ready in result.ready_to_send {
+                    send_rudp_packet(&socket, remote_addr, &ready)?;
+                }
                 if packet.packet_type == CultNetRudpPacketType::Data {
                     let ack = peer.session.create_ack();
                     send_rudp_packet(&socket, remote_addr, &ack)?;
@@ -1471,6 +1474,7 @@ impl SchemaMessageSender for RudpSessionSender<'_> {
                 ordered: true,
                 sequenced: false,
                 now_ms: rudp_now_ms(),
+                            reliable_expire_after_ms: None,
             },
             Some(RUDP_INTEROP_MAX_FRAGMENT_BYTES),
         )?;
diff --git a/packages/cultnet-rs/examples/media_delivery_probe.rs b/packages/cultnet-rs/examples/media_delivery_probe.rs
new file mode 100644
index 00000000..397eb656
--- /dev/null
+++ b/packages/cultnet-rs/examples/media_delivery_probe.rs
@@ -0,0 +1,183 @@
+//! Measures what a media channel actually costs on the wire under loss.
+//!
+//! The claim under test: a reliable media channel retransmits lost packets, so
+//! it adds load exactly when the link has least to give, while an unreliable one
+//! drops them and holds its rate. Run both halves through `cultnet-impair` with
+//! a `loss_basis_points` profile and compare bytes on the wire against bytes of
+//! payload offered.
+//!
+//! ```text
+//! media_delivery_probe recv <bind_addr> <expect_count>
+//! media_delivery_probe send <endpoint> <reliable|unreliable> <payload_bytes> <count>
+//! ```
+//!
+//! The sender reports amplification: wire bytes divided by offered payload
+//! bytes. At 1.0 nothing was retransmitted. Well above 1.0 under loss is the
+//! pathology.
+
+use std::env;
+use std::net::{SocketAddr, UdpSocket};
+use std::time::{Duration, Instant};
+
+use anyhow::{Result, anyhow};
+use cultnet_rs::{
+    CultNetRudpServerHubOptions, CultNetRudpSocketTransportConnection,
+    CultNetRudpSocketTransportOptions, CultNetTransportDelivery,
+};
+
+const CHANNEL: &str = "media";
+const DRAIN: Duration = Duration::from_secs(5);
+
+fn main() -> Result<()> {
+    let args: Vec<String> = env::args().collect();
+    match args.get(1).map(String::as_str) {
+        Some("recv") => recv(
+            args.get(2).ok_or_else(|| anyhow!("bind addr"))?.parse()?,
+            args.get(3).ok_or_else(|| anyhow!("expect count"))?.parse()?,
+        ),
+        Some("send") => send(
+            args.get(2).ok_or_else(|| anyhow!("endpoint"))?.parse()?,
+            match args.get(3).map(String::as_str) {
+                Some("unreliable") => CultNetTransportDelivery::Unreliable,
+                Some("reliable") => CultNetTransportDelivery::Reliable,
+                other => return Err(anyhow!("delivery must be reliable|unreliable, got {other:?}")),
+            },
+            args.get(4).ok_or_else(|| anyhow!("payload bytes"))?.parse()?,
+            args.get(5).ok_or_else(|| anyhow!("count"))?.parse()?,
+            args.get(6).map(|v| v.parse()).transpose()?.unwrap_or(12.0),
+            args.get(7).map(|v| v.parse()).transpose()?,
+        ),
+        _ => Err(anyhow!(
+            "usage: media_delivery_probe recv <bind> <count> | send <endpoint> <reliable|unreliable> <bytes> <count> [mbps] [max_fragment_bytes]"
+        )),
+    }
+}
+
+fn recv(bind: SocketAddr, expect: u64) -> Result<()> {
+    let socket = UdpSocket::bind(bind)?;
+    socket.set_nonblocking(true)?;
+    let mut hub = cultnet_rs::CultNetRudpServerHub::new(CultNetRudpServerHubOptions::new(
+        "probe-recv",
+        socket,
+        0x0BE0_0001,
+    ))?;
+
+    println!("listening on {bind}, expecting {expect} frames");
+    let started = Instant::now();
+    let mut frames = 0u64;
+    let mut payload_bytes = 0u64;
+    let mut last_progress = Instant::now();
+
+    loop {
+        while let Some(event) = hub.receive_event_once()? {
+            if let cultnet_rs::CultNetRudpServerEvent::Frame { frame, .. } = event
+                && frame.channel_id == CHANNEL
+            {
+                frames += 1;
+                payload_bytes += frame.payload.len() as u64;
+                last_progress = Instant::now();
+            }
+        }
+        if frames >= expect || last_progress.elapsed() > DRAIN {
+            break;
+        }
+        std::thread::sleep(Duration::from_micros(200));
+    }
+
+    let stats = hub.stats();
+    let elapsed = started.elapsed().as_secs_f64();
+    println!("RESULT recv frames={frames} expected={expect} payload_bytes={payload_bytes}");
+    println!(
+        "RESULT recv wire_bytes_in={} wire_bytes_out={} elapsed_s={elapsed:.2} delivered_pct={:.2} fragment_sets_evicted={}",
+        stats.bytes_received,
+        stats.bytes_sent,
+        (frames as f64 / expect as f64) * 100.0,
+        stats.fragment_sets_evicted
+    );
+    Ok(())
+}
+
+fn send(
+    endpoint: SocketAddr,
+    delivery: CultNetTransportDelivery,
+    payload_bytes: usize,
+    count: u64,
+    target_mbps: f64,
+    max_fragment_bytes: Option<u32>,
+) -> Result<()> {
+    let socket = UdpSocket::bind("0.0.0.0:0")?;
+    socket.set_nonblocking(true)?;
+    let mut options =
+        CultNetRudpSocketTransportOptions::client("probe-send", socket, endpoint, 0x0BE0_0001);
+    options.media_delivery = Some(delivery);
+    options.media_reliable_expire_after_ms = None;
+    // Fragment above this many bytes so a lost datagram costs a whole payload;
+    // None sends each payload as one datagram, which loopback carries whole.
+    options.max_fragment_bytes = max_fragment_bytes;
+
+    let mut transport = CultNetRudpSocketTransportConnection::new(options)?;
+    transport.connect(b"probe".to_vec())?;
+    let deadline = Instant::now() + Duration::from_secs(10);
+    while !transport.connected() {
+        let _ = transport.receive_once()?;
+        transport.poll_resends()?;
+        if Instant::now() >= deadline {
+            return Err(anyhow!("timed out connecting to {endpoint}"));
+        }
+        std::thread::sleep(Duration::from_millis(2));
+    }
+
+    // Pace to a realistic media rate. An unpaced blast overruns the receiver's
+    // socket buffer and manufactures loss that has nothing to do with the link.
+    let per_packet = Duration::from_secs_f64((payload_bytes as f64 * 8.0) / (target_mbps * 1e6));
+    let payload = vec![0xA5u8; payload_bytes];
+    let offered = payload_bytes as u64 * count;
+    let started = Instant::now();
+    let mut sent = 0u64;
+    let mut would_block = 0u64;
+
+    while sent < count {
+        match transport.send(CHANNEL, payload.clone()) {
+            Ok(()) => sent += 1,
+            Err(error) if error.to_string().contains("would block") => {
+                would_block += 1;
+                transport.poll_resends()?;
+                let _ = transport.receive_once()?;
+                std::thread::sleep(Duration::from_micros(500));
+            }
+            Err(error) => return Err(error),
+        }
+        if sent % 64 == 0 {
+            let _ = transport.receive_once()?;
+            transport.poll_resends()?;
+        }
+        let due = started + per_packet.mul_f64(sent as f64);
+        if let Some(wait) = due.checked_duration_since(Instant::now()) {
+            std::thread::sleep(wait);
+        }
+    }
+    let send_elapsed = started.elapsed();
+
+    // Let retransmission run: this is where a reliable channel spends what an
+    // unreliable one does not.
+    let drain_start = Instant::now();
+    while drain_start.elapsed() < DRAIN {
+        let _ = transport.receive_once()?;
+        transport.poll_resends()?;
+        std::thread::sleep(Duration::from_millis(1));
+    }
+
+    let stats = transport.stats();
+    let amplification = stats.bytes_sent as f64 / offered as f64;
+    println!(
+        "RESULT send delivery={delivery:?} payload_bytes={payload_bytes} count={count} offered={offered} target_mbps={target_mbps}"
+    );
+    println!(
+        "RESULT send wire_bytes={} amplification={amplification:.3} send_s={:.2} total_s={:.2} would_block={would_block} reliable_expired={}",
+        stats.bytes_sent,
+        send_elapsed.as_secs_f64(),
+        started.elapsed().as_secs_f64(),
+        stats.reliable_packets_expired
+    );
+    Ok(())
+}
diff --git a/packages/cultnet-rs/examples/runtime_presence_vector.rs b/packages/cultnet-rs/examples/runtime_presence_vector.rs
new file mode 100644
index 00000000..04571a8b
--- /dev/null
+++ b/packages/cultnet-rs/examples/runtime_presence_vector.rs
@@ -0,0 +1,67 @@
+//! Emit canonical bytes for one fixed runtime-presence record.
+//!
+//! This is the reference the TypeScript fork is tested against. The two forks
+//! agree only if `gamecult.runtime_presence_health.v2` means the same bytes in
+//! both, and the only way to know that is to have one produce the vector and
+//! the other reproduce it. A fixture written by hand for both sides would agree
+//! with itself and prove nothing.
+
+use cultnet_rs::{GameCultRuntimeCapability, GameCultRuntimePresenceHealthRecord};
+
+fn main() -> anyhow::Result<()> {
+    let record = GameCultRuntimePresenceHealthRecord {
+        schema_version: "gamecult.runtime_presence_health.v2".into(),
+        target: "heimdall".into(),
+        expected_projection_sha256: format!("sha256-{}", "a".repeat(64)),
+        plan_id: format!("sha256-{}", "b".repeat(64)),
+        incarnation_id: "service-incarnation-1".into(),
+        sealed_release_id: format!("sha256-{}", "c".repeat(64)),
+        activation_witness_sha256: format!("sha256-{}", "d".repeat(64)),
+        state_schema_generation: Some("v1".into()),
+        state_contract_sha256: Some(format!("sha256-{}", "e".repeat(64))),
+        runtime_id: "heimdall-yggdrasil".into(),
+        runtime_instance_id: format!("sha256-{}", "f".repeat(64)),
+        bound_endpoint: Some("http://127.0.0.1:14101".into()),
+        capabilities: vec![
+            GameCultRuntimeCapability {
+                capability: "heimdall.access".into(),
+                schema: "heimdall.access.v1".into(),
+                compatibility: "v1".into(),
+                capacity: 2,
+            },
+            GameCultRuntimeCapability {
+                capability: "zeta.runtime".into(),
+                schema: "zeta.runtime.v1".into(),
+                compatibility: "v1".into(),
+                capacity: 1,
+            },
+        ],
+        health_contract: "heimdall.cultnet-rudp-provider-health".into(),
+        state: "warming".into(),
+        detail: "Heimdall candidate warming".into(),
+        write_lease_sha256: None,
+        signer_identity_id: "1".repeat(64),
+        publisher_sequence: 7,
+        observed_at_unix_millis: 1_757_000_000_000,
+        signature_algorithm: "ed25519".into(),
+        signature: Vec::new(),
+        activation_signer_identity_id: "2".repeat(64),
+        activation_signature: Vec::new(),
+    };
+
+    // The proof payload: both signature fields empty. This is what both keys
+    // sign, so it is the vector that matters most.
+    let proof = record.canonical_proof_payload()?;
+    println!("proof {}", hex(&proof));
+
+    // And the complete record, with both proofs filled, to pin the signed shape.
+    let mut signed = record;
+    signed.signature = vec![0x11; 64];
+    signed.activation_signature = vec![0x22; 64];
+    println!("signed {}", hex(&rmp_serde::to_vec(&signed)?));
+    Ok(())
+}
+
+fn hex(bytes: &[u8]) -> String {
+    bytes.iter().map(|byte| format!("{byte:02x}")).collect()
+}
diff --git a/packages/cultnet-rs/src/contracts.rs b/packages/cultnet-rs/src/contracts.rs
index cf828e15..b5c89ff7 100644
--- a/packages/cultnet-rs/src/contracts.rs
+++ b/packages/cultnet-rs/src/contracts.rs
@@ -142,6 +142,12 @@ pub struct CultNetTransportChannel {
     pub max_fragment_bytes: Option<u32>,
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub max_pending_reliable_packets: Option<u32>,
+    /// Drop a reliable packet on this channel instead of retransmitting it once
+    /// this many milliseconds have passed since the send. Omitted when absent,
+    /// so a profile that does not set it is byte-identical to one from a
+    /// runtime that does not know the field.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub reliable_expire_after_ms: Option<u64>,
 }
 
 #[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize)]
@@ -354,6 +360,39 @@ pub enum CultNetMessage {
         message_id: String,
         shards: Vec<CultNetShardDescriptor>,
     },
+    #[serde(rename = "cultnet.operation_request.v0", rename_all = "camelCase")]
+    OperationRequest {
+        message_id: String,
+        service_id: String,
+        operation: String,
+        payload_schema: String,
+        #[serde(default = "messagepack_base64_encoding")]
+        payload_encoding: String,
+        payload: String,
+        #[serde(default, skip_serializing_if = "Option::is_none")]
+        source_runtime_id: Option<String>,
+        #[serde(default, skip_serializing_if = "Option::is_none")]
+        target_runtime_id: Option<String>,
+    },
+    #[serde(rename = "cultnet.operation_response.v0", rename_all = "camelCase")]
+    OperationResponse {
+        message_id: String,
+        service_id: String,
+        operation: String,
+        status: String,
+        payload_schema: String,
+        #[serde(default = "messagepack_base64_encoding")]
+        payload_encoding: String,
+        payload: String,
+        #[serde(default, skip_serializing_if = "Vec::is_empty")]
+        diagnostics: Vec<String>,
+        #[serde(default, skip_serializing_if = "Option::is_none")]
+        source_runtime_id: Option<String>,
+    },
+}
+
+fn messagepack_base64_encoding() -> String {
+    "messagepack-base64".to_string()
 }
 
 pub fn parse_cultnet_message(
@@ -560,6 +599,45 @@ fn validate_message(message: &CultNetMessage) -> Result<()> {
                 validate_shard_descriptor(shard)?;
             }
         }
+        CultNetMessage::OperationRequest {
+            message_id,
+            service_id,
+            operation,
+            payload_schema,
+            payload_encoding,
+            payload,
+            source_runtime_id,
+            target_runtime_id,
+        } => {
+            require_non_empty(message_id, "messageId")?;
+            require_non_empty(service_id, "serviceId")?;
+            require_non_empty(operation, "operation")?;
+            require_non_empty(payload_schema, "payloadSchema")?;
+            require_exact(payload_encoding, "messagepack-base64", "payloadEncoding")?;
+            require_non_empty(payload, "payload")?;
+            require_optional_non_empty(source_runtime_id.as_deref(), "sourceRuntimeId")?;
+            require_optional_non_empty(target_runtime_id.as_deref(), "targetRuntimeId")?;
+        }
+        CultNetMessage::OperationResponse {
+            message_id,
+            service_id,
+            operation,
+            status,
+            payload_schema,
+            payload_encoding,
+            payload,
+            diagnostics: _,
+            source_runtime_id,
+        } => {
+            require_non_empty(message_id, "messageId")?;
+            require_non_empty(service_id, "serviceId")?;
+            require_non_empty(operation, "operation")?;
+            require_non_empty(status, "status")?;
+            require_non_empty(payload_schema, "payloadSchema")?;
+            require_exact(payload_encoding, "messagepack-base64", "payloadEncoding")?;
+            require_non_empty(payload, "payload")?;
+            require_optional_non_empty(source_runtime_id.as_deref(), "sourceRuntimeId")?;
+        }
     }
     Ok(())
 }
@@ -655,6 +733,13 @@ fn require_non_empty(value: &str, field: &str) -> Result<()> {
     Ok(())
 }
 
+fn require_exact(value: &str, expected: &str, field: &str) -> Result<()> {
+    if value != expected {
+        return Err(anyhow!("{field} must be {expected}"));
+    }
+    Ok(())
+}
+
 fn require_optional_non_empty(value: Option<&str>, field: &str) -> Result<()> {
     if let Some(value) = value {
         require_non_empty(value, field)?;
diff --git a/packages/cultnet-rs/src/cultmesh.rs b/packages/cultnet-rs/src/cultmesh.rs
index 20d21232..14998396 100644
--- a/packages/cultnet-rs/src/cultmesh.rs
+++ b/packages/cultnet-rs/src/cultmesh.rs
@@ -318,6 +318,8 @@ impl CultMesh {
     ) -> Result<CultNetRudpSocketTransportConnection> {
         let socket = bind_rudp_socket(&options)?;
         CultNetRudpSocketTransportConnection::new(CultNetRudpSocketTransportOptions {
+            media_reliable_expire_after_ms: None,
+            media_delivery: None,
             runtime_id: runtime_id.into(),
             socket,
             mode: CultNetRudpSocketMode::Server,
@@ -341,6 +343,8 @@ impl CultMesh {
     ) -> Result<CultNetRudpSocketTransportConnection> {
         let socket = bind_rudp_socket(&options)?;
         CultNetRudpSocketTransportConnection::new(CultNetRudpSocketTransportOptions {
+            media_reliable_expire_after_ms: None,
+            media_delivery: None,
             runtime_id: runtime_id.into(),
             socket,
             mode: CultNetRudpSocketMode::Client,
diff --git a/packages/cultnet-rs/src/idunn_deployment_brake.rs b/packages/cultnet-rs/src/idunn_deployment_brake.rs
new file mode 100644
index 00000000..e790f2a1
--- /dev/null
+++ b/packages/cultnet-rs/src/idunn_deployment_brake.rs
@@ -0,0 +1,492 @@
+use anyhow::{Result, bail};
+use cultcache_rs::DatabaseEntry;
+
+use crate::{
+    IdunnDeploymentBrakeOperatorIdentity, IdunnDeploymentBrakeReleasePurpose,
+    ServiceIdentitySignature, ServiceIdentityTrustAnchor, verify_service_identity_signature,
+};
+
+pub const IDUNN_DEPLOYMENT_BRAKE_SCHEMA: &str = "idunn.deployment_brake.v1";
+pub const IDUNN_DEPLOYMENT_BRAKE_TYPE: &str = "idunn.deployment_brake";
+pub const IDUNN_DEPLOYMENT_BRAKE_ID: &str = "idunn/deployment-brake";
+pub const IDUNN_DEPLOYMENT_BRAKE_AUTHORITY: &str = "idunn.deployment-brake";
+pub const IDUNN_DEPLOYMENT_BRAKE_SCOPE: &str = "deployment";
+pub const IDUNN_DEPLOYMENT_RELEASE_PURPOSE: &str = "idunn.deployment-release.v1";
+pub const IDUNN_DEPLOYMENT_RELEASE_MAX_LIFETIME_MILLIS: u64 = 15 * 60 * 1_000;
+
+/// Canonical deployment-facing brake projection consumed by Idunn. A released
+/// status is not permission by itself: the authorization fields bind one
+/// release and one deployment attempt for a short, explicit interval.
+#[derive(Clone, Debug, PartialEq, Eq, DatabaseEntry)]
+#[cultcache(type = "idunn.deployment_brake", schema = "idunn.deployment_brake.v1")]
+pub struct IdunnDeploymentBrakeRecord {
+    #[cultcache(key = 0)]
+    pub schema_version: String,
+    #[cultcache(key = 1)]
+    pub brake_id: String,
+    #[cultcache(key = 2)]
+    pub authority: String,
+    #[cultcache(key = 3)]
+    pub runtime_id: String,
+    #[cultcache(key = 4)]
+    pub status: String,
+    #[cultcache(key = 5)]
+    pub scope: String,
+    #[cultcache(key = 6)]
+    pub reason: String,
+    #[cultcache(key = 7)]
+    pub observed_at_unix_millis: u64,
+    #[cultcache(key = 8)]
+    pub expires_at_unix_millis: Option<u64>,
+    #[cultcache(key = 9)]
+    pub authorization_id: Option<String>,
+    #[cultcache(key = 10)]
+    pub authorization_purpose: Option<String>,
+    #[cultcache(key = 11)]
+    pub authorized_release_id: Option<String>,
+    #[cultcache(key = 12)]
+    pub authorized_deployment_id: Option<String>,
+    #[cultcache(key = 13)]
+    pub authorized_by: Option<String>,
+    #[cultcache(key = 14)]
+    pub authorization_issued_at_unix_millis: Option<u64>,
+    #[cultcache(key = 15)]
+    pub authorization_expires_at_unix_millis: Option<u64>,
+    #[cultcache(key = 16)]
+    pub signature_algorithm: Option<String>,
+    #[cultcache(key = 17)]
+    pub signature: Option<Vec<u8>>,
+    #[cultcache(key = 18)]
+    pub private_state_exposed: bool,
+    /// Human/operator principal responsible for the latest transition. This is
+    /// distinct from `authorized_by`, which is the cryptographic identity id.
+    #[cultcache(key = 19)]
+    pub updated_by: String,
+}
+
+impl IdunnDeploymentBrakeRecord {
+    pub fn validate(&self) -> Result<()> {
+        if self.schema_version != IDUNN_DEPLOYMENT_BRAKE_SCHEMA {
+            bail!("deployment brake schema is unsupported");
+        }
+        identifier(&self.brake_id, "brake id")?;
+        identifier(&self.authority, "authority")?;
+        identifier(&self.runtime_id, "runtime id")?;
+        identifier(&self.reason, "reason")?;
+        identifier(&self.scope, "scope")?;
+        identifier(&self.updated_by, "updating operator")?;
+        if !matches!(self.status.as_str(), "engaged" | "released")
+            || self.observed_at_unix_millis == 0
+            || self
+                .expires_at_unix_millis
+                .is_some_and(|v| v <= self.observed_at_unix_millis)
+            || self.private_state_exposed
+        {
+            bail!("deployment brake shape, lifetime, or privacy is invalid");
+        }
+
+        let authorization = [
+            self.authorization_id.as_ref(),
+            self.authorization_purpose.as_ref(),
+            self.authorized_release_id.as_ref(),
+            self.authorized_deployment_id.as_ref(),
+            self.authorized_by.as_ref(),
+            self.signature_algorithm.as_ref(),
+        ];
+        let has_authorization = authorization.iter().any(|v| v.is_some())
+            || self.authorization_issued_at_unix_millis.is_some()
+            || self.authorization_expires_at_unix_millis.is_some()
+            || self.signature.is_some();
+        if self.status == "engaged" {
+            if has_authorization {
+                bail!("engaged deployment brake must not carry release authorization");
+            }
+            return Ok(());
+        }
+        if authorization.iter().any(|v| v.is_none())
+            || self.authorization_issued_at_unix_millis.is_none()
+            || self.authorization_expires_at_unix_millis.is_none()
+            || self.signature.is_none()
+        {
+            bail!("released deployment brake authorization is incomplete");
+        }
+        for (value, label) in [
+            (&self.authorization_id, "authorization id"),
+            (&self.authorized_release_id, "authorized release id"),
+            (&self.authorized_deployment_id, "authorized deployment id"),
+            (&self.authorized_by, "authorizer"),
+        ] {
+            identifier(value.as_deref().unwrap(), label)?;
+        }
+        let issued = self.authorization_issued_at_unix_millis.unwrap();
+        let expires = self.authorization_expires_at_unix_millis.unwrap();
+        if self.authorization_purpose.as_deref() != Some(IDUNN_DEPLOYMENT_RELEASE_PURPOSE)
+            || self.signature_algorithm.as_deref() != Some("ed25519")
+            || self.signature.as_ref().is_none_or(|v| v.len() != 64)
+            || issued < self.observed_at_unix_millis
+            || expires <= issued
+            || expires - issued > IDUNN_DEPLOYMENT_RELEASE_MAX_LIFETIME_MILLIS
+            || self
+                .expires_at_unix_millis
+                .is_some_and(|brake_expiry| expires > brake_expiry)
+        {
+            bail!("deployment release authorization purpose, signature, or lifetime is invalid");
+        }
+        Ok(())
+    }
+}
+
+#[derive(Clone, Copy, Debug)]
+pub enum IdunnDeploymentBrakeObservation<'a> {
+    Missing,
+    Corrupt,
+    Present(&'a IdunnDeploymentBrakeRecord),
+}
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum IdunnDeploymentBrakeDenial {
+    Missing,
+    Corrupt,
+    Foreign,
+    WrongRuntime,
+    WrongScope,
+    Engaged,
+    Expired,
+    ReleaseMismatch,
+    DeploymentMismatch,
+    InvalidSignature,
+}
+
+fn classify_idunn_deployment_brake(
+    observation: IdunnDeploymentBrakeObservation<'_>,
+    runtime_id: &str,
+    release_id: &str,
+    deployment_id: &str,
+    now_unix_millis: u64,
+) -> std::result::Result<(), IdunnDeploymentBrakeDenial> {
+    let record = match observation {
+        IdunnDeploymentBrakeObservation::Missing => {
+            return Err(IdunnDeploymentBrakeDenial::Missing);
+        }
+        IdunnDeploymentBrakeObservation::Corrupt => {
+            return Err(IdunnDeploymentBrakeDenial::Corrupt);
+        }
+        IdunnDeploymentBrakeObservation::Present(record) => record,
+    };
+    if record.validate().is_err() {
+        return Err(IdunnDeploymentBrakeDenial::Corrupt);
+    }
+    if record.brake_id != IDUNN_DEPLOYMENT_BRAKE_ID
+        || record.authority != IDUNN_DEPLOYMENT_BRAKE_AUTHORITY
+    {
+        return Err(IdunnDeploymentBrakeDenial::Foreign);
+    }
+    if record.runtime_id != runtime_id {
+        return Err(IdunnDeploymentBrakeDenial::WrongRuntime);
+    }
+    if !matches!(record.scope.as_str(), "all" | IDUNN_DEPLOYMENT_BRAKE_SCOPE) {
+        return Err(IdunnDeploymentBrakeDenial::WrongScope);
+    }
+    if record.status == "engaged" {
+        return Err(IdunnDeploymentBrakeDenial::Engaged);
+    }
+    if record
+        .expires_at_unix_millis
+        .is_some_and(|v| now_unix_millis >= v)
+        || record
+            .authorization_expires_at_unix_millis
+            .is_none_or(|v| now_unix_millis >= v)
+        || record
+            .authorization_issued_at_unix_millis
+            .is_none_or(|v| now_unix_millis < v)
+    {
+        return Err(IdunnDeploymentBrakeDenial::Expired);
+    }
+    if record.authorized_release_id.as_deref() != Some(release_id) {
+        return Err(IdunnDeploymentBrakeDenial::ReleaseMismatch);
+    }
+    if record.authorized_deployment_id.as_deref() != Some(deployment_id) {
+        return Err(IdunnDeploymentBrakeDenial::DeploymentMismatch);
+    }
+    Ok(())
+}
+
+pub fn evaluate_idunn_deployment_brake(
+    observation: IdunnDeploymentBrakeObservation<'_>,
+    operator_anchor: &ServiceIdentityTrustAnchor,
+    runtime_id: &str,
+    release_id: &str,
+    deployment_id: &str,
+    now_unix_millis: u64,
+) -> std::result::Result<(), IdunnDeploymentBrakeDenial> {
+    classify_idunn_deployment_brake(
+        observation,
+        runtime_id,
+        release_id,
+        deployment_id,
+        now_unix_millis,
+    )?;
+    let IdunnDeploymentBrakeObservation::Present(record) = observation else {
+        unreachable!("successful classification always has a present record")
+    };
+    verify_idunn_deployment_brake_authorization(record, operator_anchor)
+        .map_err(|_| IdunnDeploymentBrakeDenial::InvalidSignature)
+}
+
+/// Verify the release grant using the dedicated operator public anchor. The
+/// signed payload is the complete positional record with the signature field
+/// empty, so authority, runtime, target IDs, and both time bounds are covered.
+pub fn verify_idunn_deployment_brake_authorization(
+    record: &IdunnDeploymentBrakeRecord,
+    anchor: &ServiceIdentityTrustAnchor,
+) -> Result<()> {
+    record.validate()?;
+    if record.status != "released" {
+        bail!("engaged deployment brake has no release authorization to verify");
+    }
+    let identity_id = record
+        .authorized_by
+        .as_ref()
+        .ok_or_else(|| anyhow::anyhow!("deployment brake authorizer is absent"))?;
+    let signature = record
+        .signature
+        .as_ref()
+        .ok_or_else(|| anyhow::anyhow!("deployment brake signature is absent"))?;
+    let mut unsigned = record.clone();
+    unsigned.signature = None;
+    verify_service_identity_signature::<
+        IdunnDeploymentBrakeOperatorIdentity,
+        IdunnDeploymentBrakeReleasePurpose,
+    >(
+        anchor,
+        &rmp_serde::to_vec(&unsigned)?,
+        &ServiceIdentitySignature {
+            identity_id: identity_id.clone(),
+            signature: signature.clone(),
+        },
+    )
+}
+
+fn identifier(value: &str, label: &str) -> Result<()> {
+    if value.trim().is_empty() || value.len() > 256 || value.chars().any(char::is_control) {
+        bail!("{label} is empty, oversized, or contains control characters");
+    }
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::enroll_service_identity_at;
+
+    fn released() -> IdunnDeploymentBrakeRecord {
+        IdunnDeploymentBrakeRecord {
+            schema_version: IDUNN_DEPLOYMENT_BRAKE_SCHEMA.into(),
+            brake_id: IDUNN_DEPLOYMENT_BRAKE_ID.into(),
+            authority: IDUNN_DEPLOYMENT_BRAKE_AUTHORITY.into(),
+            runtime_id: "yggdrasil".into(),
+            status: "released".into(),
+            scope: "deployment".into(),
+            reason: "operator authorized one attempt".into(),
+            observed_at_unix_millis: 100,
+            expires_at_unix_millis: Some(1000),
+            authorization_id: Some("auth/r4".into()),
+            authorization_purpose: Some(IDUNN_DEPLOYMENT_RELEASE_PURPOSE.into()),
+            authorized_release_id: Some("release-4".into()),
+            authorized_deployment_id: Some("deployment-4".into()),
+            authorized_by: Some("operator/metacrat".into()),
+            authorization_issued_at_unix_millis: Some(100),
+            authorization_expires_at_unix_millis: Some(900),
+            signature_algorithm: Some("ed25519".into()),
+            signature: Some(vec![7; 64]),
+            private_state_exposed: false,
+            updated_by: "operator/metacrat".into(),
+        }
+    }
+
+    #[test]
+    fn only_exact_bounded_release_is_permitted() {
+        let value = released();
+        assert_eq!(
+            classify_idunn_deployment_brake(
+                IdunnDeploymentBrakeObservation::Present(&value),
+                "yggdrasil",
+                "release-4",
+                "deployment-4",
+                500
+            ),
+            Ok(())
+        );
+        assert_eq!(
+            classify_idunn_deployment_brake(
+                IdunnDeploymentBrakeObservation::Missing,
+                "yggdrasil",
+                "release-4",
+                "deployment-4",
+                500
+            ),
+            Err(IdunnDeploymentBrakeDenial::Missing)
+        );
+        assert_eq!(
+            classify_idunn_deployment_brake(
+                IdunnDeploymentBrakeObservation::Corrupt,
+                "yggdrasil",
+                "release-4",
+                "deployment-4",
+                500
+            ),
+            Err(IdunnDeploymentBrakeDenial::Corrupt)
+        );
+        assert_eq!(
+            classify_idunn_deployment_brake(
+                IdunnDeploymentBrakeObservation::Present(&value),
+                "yggdrasil",
+                "other",
+                "deployment-4",
+                500
+            ),
+            Err(IdunnDeploymentBrakeDenial::ReleaseMismatch)
+        );
+        assert_eq!(
+            classify_idunn_deployment_brake(
+                IdunnDeploymentBrakeObservation::Present(&value),
+                "yggdrasil",
+                "release-4",
+                "other",
+                500
+            ),
+            Err(IdunnDeploymentBrakeDenial::DeploymentMismatch)
+        );
+        assert_eq!(
+            classify_idunn_deployment_brake(
+                IdunnDeploymentBrakeObservation::Present(&value),
+                "yggdrasil",
+                "release-4",
+                "deployment-4",
+                900
+            ),
+            Err(IdunnDeploymentBrakeDenial::Expired)
+        );
+    }
+
+    #[test]
+    fn hostile_authority_scope_and_shape_substitutions_fail_closed() {
+        let mut value = released();
+        value.authority = "idunn".into();
+        assert_eq!(
+            classify_idunn_deployment_brake(
+                IdunnDeploymentBrakeObservation::Present(&value),
+                "yggdrasil",
+                "release-4",
+                "deployment-4",
+                500
+            ),
+            Err(IdunnDeploymentBrakeDenial::Foreign)
+        );
+        let mut value = released();
+        value.runtime_id = "nightwing".into();
+        assert_eq!(
+            classify_idunn_deployment_brake(
+                IdunnDeploymentBrakeObservation::Present(&value),
+                "yggdrasil",
+                "release-4",
+                "deployment-4",
+                500
+            ),
+            Err(IdunnDeploymentBrakeDenial::WrongRuntime)
+        );
+        let mut value = released();
+        value.scope = "persona.public_speech".into();
+        assert_eq!(
+            classify_idunn_deployment_brake(
+                IdunnDeploymentBrakeObservation::Present(&value),
+                "yggdrasil",
+                "release-4",
+                "deployment-4",
+                500
+            ),
+            Err(IdunnDeploymentBrakeDenial::WrongScope)
+        );
+        let mut value = released();
+        value.signature = Some(vec![0; 63]);
+        assert_eq!(
+            classify_idunn_deployment_brake(
+                IdunnDeploymentBrakeObservation::Present(&value),
+                "yggdrasil",
+                "release-4",
+                "deployment-4",
+                500
+            ),
+            Err(IdunnDeploymentBrakeDenial::Corrupt)
+        );
+        let mut value = released();
+        value.authorization_expires_at_unix_millis =
+            Some(100 + IDUNN_DEPLOYMENT_RELEASE_MAX_LIFETIME_MILLIS + 1);
+        assert!(value.validate().is_err());
+    }
+
+    #[test]
+    fn engaged_record_cannot_smuggle_authorization() {
+        let mut value = released();
+        value.status = "engaged".into();
+        assert!(value.validate().is_err());
+        value.authorization_id = None;
+        value.authorization_purpose = None;
+        value.authorized_release_id = None;
+        value.authorized_deployment_id = None;
+        value.authorized_by = None;
+        value.authorization_issued_at_unix_millis = None;
+        value.authorization_expires_at_unix_millis = None;
+        value.signature_algorithm = None;
+        value.signature = None;
+        value.validate().unwrap();
+        assert_eq!(
+            classify_idunn_deployment_brake(
+                IdunnDeploymentBrakeObservation::Present(&value),
+                "yggdrasil",
+                "release-4",
+                "deployment-4",
+                500
+            ),
+            Err(IdunnDeploymentBrakeDenial::Engaged)
+        );
+    }
+
+    #[test]
+    fn evaluation_requires_the_dedicated_operator_signature() -> Result<()> {
+        let temp = tempfile::tempdir()?;
+        let signer = enroll_service_identity_at::<IdunnDeploymentBrakeOperatorIdentity>(
+            &temp.path().join("operator.cc"),
+        )?;
+        let anchor = signer.trust_anchor()?;
+        let mut value = released();
+        value.authorized_by = Some(anchor.identity_id.clone());
+        value.signature = None;
+        let proof = signer.sign::<IdunnDeploymentBrakeReleasePurpose>(&rmp_serde::to_vec(&value)?);
+        value.signature = Some(proof.signature);
+        assert_eq!(
+            evaluate_idunn_deployment_brake(
+                IdunnDeploymentBrakeObservation::Present(&value),
+                &anchor,
+                "yggdrasil",
+                "release-4",
+                "deployment-4",
+                500,
+            ),
+            Ok(())
+        );
+        value.reason = "tampered after authorization".into();
+        assert_eq!(
+            evaluate_idunn_deployment_brake(
+                IdunnDeploymentBrakeObservation::Present(&value),
+                &anchor,
+                "yggdrasil",
+                "release-4",
+                "deployment-4",
+                500,
+            ),
+            Err(IdunnDeploymentBrakeDenial::InvalidSignature)
+        );
+        Ok(())
+    }
+}
diff --git a/packages/cultnet-rs/src/idunn_lifecycle_brake.rs b/packages/cultnet-rs/src/idunn_lifecycle_brake.rs
new file mode 100644
index 00000000..86eefa64
--- /dev/null
+++ b/packages/cultnet-rs/src/idunn_lifecycle_brake.rs
@@ -0,0 +1,325 @@
+use anyhow::{Result, bail};
+use cultcache_rs::DatabaseEntry;
+
+pub const IDUNN_LIFECYCLE_BRAKE_SCHEMA: &str = "idunn.lifecycle_brake.v1";
+pub const IDUNN_LIFECYCLE_BRAKE_TYPE: &str = "idunn.lifecycle_brake";
+pub const IDUNN_LIFECYCLE_BRAKE_AUTHORITY: &str = "idunn.root";
+pub const IDUNN_LIFECYCLE_BRAKE_SCOPE: &str = "continuity-restart";
+
+/// Root-owned, per-target continuity brake. This document has no authority over
+/// Idunn startup, deployment, route admission, or any target other than the one
+/// named in `target`.
+#[derive(Clone, Debug, PartialEq, Eq, DatabaseEntry)]
+#[cultcache(type = "idunn.lifecycle_brake", schema = "idunn.lifecycle_brake.v1")]
+pub struct IdunnLifecycleBrakeRecord {
+    #[cultcache(key = 0)]
+    pub schema_version: String,
+    #[cultcache(key = 1)]
+    pub authority: String,
+    #[cultcache(key = 2)]
+    pub runtime_id: String,
+    #[cultcache(key = 3)]
+    pub target: String,
+    #[cultcache(key = 4)]
+    pub scope: String,
+    #[cultcache(key = 5)]
+    pub status: String,
+    #[cultcache(key = 6)]
+    pub reason: String,
+    #[cultcache(key = 7)]
+    pub updated_at_unix_millis: u64,
+    #[cultcache(key = 8)]
+    pub released_until_unix_millis: Option<u64>,
+}
+
+impl IdunnLifecycleBrakeRecord {
+    pub fn validate(&self) -> Result<()> {
+        if self.schema_version != IDUNN_LIFECYCLE_BRAKE_SCHEMA {
+            bail!("lifecycle brake schema is unsupported");
+        }
+        identifier(&self.authority, "authority")?;
+        identifier(&self.runtime_id, "runtime id")?;
+        identifier(&self.target, "target")?;
+        identifier(&self.scope, "scope")?;
+        identifier(&self.reason, "reason")?;
+        if !matches!(self.status.as_str(), "engaged" | "released")
+            || self.updated_at_unix_millis == 0
+        {
+            bail!("lifecycle brake status or update time is invalid");
+        }
+        if self.status == "engaged" && self.released_until_unix_millis.is_some() {
+            bail!("engaged lifecycle brake cannot carry a release expiry");
+        }
+        if self
+            .released_until_unix_millis
+            .is_some_and(|expires| expires <= self.updated_at_unix_millis)
+        {
+            bail!("lifecycle brake release expiry is not after its update");
+        }
+        Ok(())
+    }
+
+    pub fn canonical_bytes(&self) -> Result<Vec<u8>> {
+        self.validate()?;
+        Ok(rmp_serde::to_vec(self)?)
+    }
+
+    pub fn decode_canonical(payload: &[u8]) -> Result<Self> {
+        if messagepack_array_len(payload) != Some(9) {
+            bail!("lifecycle brake is not the 9-field positional contract");
+        }
+        let value: Self = rmp_serde::from_slice(payload)?;
+        value.validate()?;
+        if rmp_serde::to_vec(&value)? != payload {
+            bail!("lifecycle brake encoding is not canonical");
+        }
+        Ok(value)
+    }
+}
+
+#[derive(Clone, Copy, Debug)]
+pub enum IdunnLifecycleBrakeObservation<'a> {
+    Missing,
+    Corrupt,
+    Present(&'a IdunnLifecycleBrakeRecord),
+}
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum IdunnLifecycleBrakeDenial {
+    Corrupt,
+    Foreign,
+    WrongRuntime,
+    WrongTarget,
+    Engaged,
+    Expired,
+}
+
+/// Decide only whether Idunn may restart one already-admitted target to keep it
+/// alive. Absence is the default allow state; a present record must bind the
+/// exact Idunn runtime and target and must be explicitly released.
+pub fn evaluate_idunn_continuity_restart(
+    observation: IdunnLifecycleBrakeObservation<'_>,
+    runtime_id: &str,
+    target: &str,
+    now_unix_millis: u64,
+) -> std::result::Result<(), IdunnLifecycleBrakeDenial> {
+    let record = match observation {
+        IdunnLifecycleBrakeObservation::Missing => return Ok(()),
+        IdunnLifecycleBrakeObservation::Corrupt => {
+            return Err(IdunnLifecycleBrakeDenial::Corrupt);
+        }
+        IdunnLifecycleBrakeObservation::Present(record) => record,
+    };
+    if record.validate().is_err() {
+        return Err(IdunnLifecycleBrakeDenial::Corrupt);
+    }
+    if record.authority != IDUNN_LIFECYCLE_BRAKE_AUTHORITY
+        || record.scope != IDUNN_LIFECYCLE_BRAKE_SCOPE
+    {
+        return Err(IdunnLifecycleBrakeDenial::Foreign);
+    }
+    if record.runtime_id != runtime_id {
+        return Err(IdunnLifecycleBrakeDenial::WrongRuntime);
+    }
+    if record.target != target {
+        return Err(IdunnLifecycleBrakeDenial::WrongTarget);
+    }
+    if record.status == "engaged" {
+        return Err(IdunnLifecycleBrakeDenial::Engaged);
+    }
+    if record
+        .released_until_unix_millis
+        .is_some_and(|expires| now_unix_millis >= expires)
+    {
+        return Err(IdunnLifecycleBrakeDenial::Expired);
+    }
+    Ok(())
+}
+
+fn identifier(value: &str, label: &str) -> Result<()> {
+    if value.trim().is_empty() || value.len() > 256 || value.chars().any(char::is_control) {
+        bail!("{label} is empty, oversized, or contains control characters");
+    }
+    Ok(())
+}
+
+fn messagepack_array_len(payload: &[u8]) -> Option<usize> {
+    match *payload.first()? {
+        marker @ 0x90..=0x9f => Some((marker & 0x0f) as usize),
+        0xdc if payload.len() >= 3 => Some(u16::from_be_bytes([payload[1], payload[2]]) as usize),
+        0xdd if payload.len() >= 5 => {
+            Some(u32::from_be_bytes([payload[1], payload[2], payload[3], payload[4]]) as usize)
+        }
+        _ => None,
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn released() -> IdunnLifecycleBrakeRecord {
+        IdunnLifecycleBrakeRecord {
+            schema_version: IDUNN_LIFECYCLE_BRAKE_SCHEMA.into(),
+            authority: IDUNN_LIFECYCLE_BRAKE_AUTHORITY.into(),
+            runtime_id: "idunn-yggdrasil".into(),
+            target: "ghostlight".into(),
+            scope: IDUNN_LIFECYCLE_BRAKE_SCOPE.into(),
+            status: "released".into(),
+            reason: "continuity restart permitted".into(),
+            updated_at_unix_millis: 100,
+            released_until_unix_millis: None,
+        }
+    }
+
+    fn evaluate(
+        observation: IdunnLifecycleBrakeObservation<'_>,
+        target: &str,
+        now: u64,
+    ) -> std::result::Result<(), IdunnLifecycleBrakeDenial> {
+        evaluate_idunn_continuity_restart(observation, "idunn-yggdrasil", target, now)
+    }
+
+    #[test]
+    fn lifecycle_brake_round_trips_only_as_the_canonical_positional_contract() -> Result<()> {
+        let value = released();
+        let encoded = value.canonical_bytes()?;
+        assert_eq!(encoded[0], 0x99);
+        assert_eq!(
+            IdunnLifecycleBrakeRecord::decode_canonical(&encoded)?,
+            value
+        );
+
+        let mut noncanonical = vec![0xdc, 0, 9];
+        noncanonical.extend_from_slice(&encoded[1..]);
+        assert!(IdunnLifecycleBrakeRecord::decode_canonical(&noncanonical).is_err());
+
+        let mut extended = encoded;
+        extended[0] = 0x9a;
+        extended.push(0xc0);
+        assert!(IdunnLifecycleBrakeRecord::decode_canonical(&extended).is_err());
+        Ok(())
+    }
+
+    #[test]
+    fn absence_and_explicit_release_allow_only_the_named_continuity_restart() {
+        assert_eq!(
+            evaluate(IdunnLifecycleBrakeObservation::Missing, "ghostlight", 500),
+            Ok(())
+        );
+
+        let mut value = released();
+        assert_eq!(
+            evaluate(
+                IdunnLifecycleBrakeObservation::Present(&value),
+                "ghostlight",
+                500
+            ),
+            Ok(())
+        );
+        value.released_until_unix_millis = Some(900);
+        assert_eq!(
+            evaluate(
+                IdunnLifecycleBrakeObservation::Present(&value),
+                "ghostlight",
+                899
+            ),
+            Ok(())
+        );
+        assert_eq!(
+            evaluate(
+                IdunnLifecycleBrakeObservation::Present(&value),
+                "ghostlight",
+                900
+            ),
+            Err(IdunnLifecycleBrakeDenial::Expired)
+        );
+        assert_eq!(
+            evaluate(IdunnLifecycleBrakeObservation::Missing, "odin", 900),
+            Ok(())
+        );
+        assert_eq!(
+            evaluate(IdunnLifecycleBrakeObservation::Present(&value), "odin", 500),
+            Err(IdunnLifecycleBrakeDenial::WrongTarget)
+        );
+    }
+
+    #[test]
+    fn corrupt_foreign_wrong_runtime_and_wrong_target_records_deny() {
+        assert_eq!(
+            evaluate(IdunnLifecycleBrakeObservation::Corrupt, "ghostlight", 500),
+            Err(IdunnLifecycleBrakeDenial::Corrupt)
+        );
+
+        let mut value = released();
+        value.status = "paused".into();
+        assert_eq!(
+            evaluate(
+                IdunnLifecycleBrakeObservation::Present(&value),
+                "ghostlight",
+                500
+            ),
+            Err(IdunnLifecycleBrakeDenial::Corrupt)
+        );
+
+        let mut value = released();
+        value.authority = "service-owned".into();
+        assert_eq!(
+            evaluate(
+                IdunnLifecycleBrakeObservation::Present(&value),
+                "ghostlight",
+                500
+            ),
+            Err(IdunnLifecycleBrakeDenial::Foreign)
+        );
+
+        let mut value = released();
+        value.scope = "deployment".into();
+        assert_eq!(
+            evaluate(
+                IdunnLifecycleBrakeObservation::Present(&value),
+                "ghostlight",
+                500
+            ),
+            Err(IdunnLifecycleBrakeDenial::Foreign)
+        );
+
+        let value = released();
+        assert_eq!(
+            evaluate_idunn_continuity_restart(
+                IdunnLifecycleBrakeObservation::Present(&value),
+                "idunn-nightwing",
+                "ghostlight",
+                500
+            ),
+            Err(IdunnLifecycleBrakeDenial::WrongRuntime)
+        );
+        assert_eq!(
+            evaluate(IdunnLifecycleBrakeObservation::Present(&value), "odin", 500),
+            Err(IdunnLifecycleBrakeDenial::WrongTarget)
+        );
+    }
+
+    #[test]
+    fn engaged_always_denies_and_cannot_smuggle_a_release_expiry() {
+        let mut value = released();
+        value.status = "engaged".into();
+        assert_eq!(
+            evaluate(
+                IdunnLifecycleBrakeObservation::Present(&value),
+                "ghostlight",
+                500
+            ),
+            Err(IdunnLifecycleBrakeDenial::Engaged)
+        );
+        value.released_until_unix_millis = Some(900);
+        assert_eq!(
+            evaluate(
+                IdunnLifecycleBrakeObservation::Present(&value),
+                "ghostlight",
+                500
+            ),
+            Err(IdunnLifecycleBrakeDenial::Corrupt)
+        );
+    }
+}
diff --git a/packages/cultnet-rs/src/lib.rs b/packages/cultnet-rs/src/lib.rs
index 6519ef24..074c2a29 100644
--- a/packages/cultnet-rs/src/lib.rs
+++ b/packages/cultnet-rs/src/lib.rs
@@ -1,6 +1,16 @@
 mod contracts;
+mod idunn_deployment_brake;
+mod idunn_lifecycle_brake;
+mod media_stream_contracts;
+mod media_stream_wire;
+mod provider_health_contracts;
+mod runtime_authority_contracts;
+mod service_identity;
+mod snapshot_query;
 mod cultmesh;
 mod framing;
+mod operation_service;
+mod provider_session;
 mod replication;
 mod rudp;
 mod schema_discovery;
@@ -9,8 +19,18 @@ mod shard_catalog;
 mod transport;
 
 pub use contracts::*;
+pub use idunn_deployment_brake::*;
+pub use idunn_lifecycle_brake::*;
+pub use media_stream_contracts::*;
+pub use media_stream_wire::*;
+pub use provider_health_contracts::*;
+pub use runtime_authority_contracts::*;
+pub use service_identity::*;
+pub use snapshot_query::*;
 pub use cultmesh::*;
 pub use framing::*;
+pub use operation_service::*;
+pub use provider_session::*;
 pub use replication::*;
 pub use rudp::*;
 pub use schema_discovery::*;
diff --git a/packages/cultnet-rs/src/media_stream_contracts.rs b/packages/cultnet-rs/src/media_stream_contracts.rs
new file mode 100644
index 00000000..5704912e
--- /dev/null
+++ b/packages/cultnet-rs/src/media_stream_contracts.rs
@@ -0,0 +1,578 @@
+//! CultMesh Media Stream: the typed contract for carrying live audio and video
+//! over CultNet.
+//!
+//! These records describe a media stream and nothing about who produced it. A
+//! capture broker, an editor runtime, a recorder, or a synthetic source may all
+//! publish them; an OBS bridge, a compositor, a recorder, or a browser lowering
+//! may all consume them. Producers advertise their streams through Odin and
+//! consumers resolve them there, so neither end needs to name the other.
+//!
+//! They lived in `odin-core` as `muninn.media_*`, named after the one producer
+//! that happened to emit them first. Every field here is producer-agnostic — the
+//! name was the only coupling, and a second producer would have had to
+//! impersonate Muninn or fork the shape.
+//!
+//! # Layout is wire contract
+//!
+//! CultCache encodes these positionally. Field order and `key` indices are the
+//! wire format: append new fields with `default` at the next free index, never
+//! reorder or renumber. `missing_video_chunk_keys` shows the pattern.
+//!
+//! Payloads carry `bytes` so they serialize as MessagePack `bin` rather than an
+//! array of integers, which is what the C#, TypeScript and Python runtimes
+//! expect and what keeps a 848-byte payload at 851 bytes instead of 1234. Note
+//! that this is the derive's own attribute — `#[serde(with = "serde_bytes")]`
+//! is inert here, because `DatabaseEntry` writes its own `Serialize`.
+//!
+//! # Timebase
+//!
+//! `pts_ticks`, `duration_ticks` and `deadline_ticks` are expressed in
+//! `timebase_num / timebase_den` units, carried per record so a consumer never
+//! has to assume a producer's clock. `deadline_ticks` is the presentation
+//! deadline past which a late arrival is worth dropping rather than displaying.
+//!
+//! # Reliability
+//!
+//! Nothing here specifies a delivery guarantee. Whether a stream rides a
+//! reliable or lossy CultNet channel, and whether it carries parity, is a
+//! transport decision made per stream — not a property of the payload shape.
+//! Video parity shards exist for producers that choose forward error correction;
+//! audio currently has no parity record, and a producer emitting audio on a
+//! lossy channel needs one.
+
+use cultcache_rs::DatabaseEntry;
+
+pub const GAMECULT_MEDIA_VIDEO_ACCESS_UNIT_SCHEMA: &str = "gamecult.media_video_access_unit.v1";
+pub const GAMECULT_MEDIA_VIDEO_PARITY_SHARD_SCHEMA: &str = "gamecult.media_video_parity_shard.v2";
+pub const GAMECULT_MEDIA_AUDIO_PACKET_SCHEMA: &str = "gamecult.media_audio_packet.v1";
+pub const GAMECULT_MEDIA_RECEIVER_FEEDBACK_SCHEMA: &str = "gamecult.media_receiver_feedback.v1";
+pub const GAMECULT_MEDIA_STREAM_ADVERTISEMENT_SCHEMA: &str =
+    "gamecult.media_stream_advertisement.v1";
+pub const GAMECULT_MEDIA_STREAM_REQUEST_SCHEMA: &str = "gamecult.media_stream_request.v1";
+
+/// A media stream a producer can serve on request, as it appears in Odin.
+///
+/// Odin admits these without any registration: it derives the document type
+/// from the schema id (`prefix.vN` -> `prefix`) and refuses only a short list
+/// of authority-owned types (`gamecult.runtime_presence_health`,
+/// `odin.runtime_topology_correlation`, `idunn.expected_incarnation`,
+/// `idunn.runtime_activation`, `idunn.process_write_lease`,
+/// `gamecult.service_trust_anchor`). A new record whose type collided with one
+/// of those would be rejected at the catalog with no mention of the collision.
+///
+/// This is the record a consumer's picker is built from: which streams exist,
+/// which video and audio sources each can capture, which codecs it can encode,
+/// the defaults it would use, and where it serves the stream from. It is state, not media — it travels as a
+/// CultMesh document through Odin, never on the media channel — and it names no
+/// consumer. `producer_id` is the runtime that answers requests for it.
+///
+/// Keyed by `stream_id`.
+#[derive(Clone, Debug, PartialEq, Eq, DatabaseEntry)]
+#[cultcache(
+    type = "gamecult.media_stream_advertisement",
+    schema = "gamecult.media_stream_advertisement.v1"
+)]
+pub struct GameCultMediaStreamAdvertisementRecord {
+    #[cultcache(key = 0)]
+    pub stream_id: String,
+    #[cultcache(key = 1)]
+    pub producer_id: String,
+    #[cultcache(key = 2)]
+    pub label: String,
+    /// `available`, `streaming`, or `unavailable`.
+    #[cultcache(key = 3)]
+    pub state: String,
+    #[cultcache(key = 4)]
+    pub video_source_ids: Vec<String>,
+    #[cultcache(key = 5)]
+    pub video_source_labels: Vec<String>,
+    #[cultcache(key = 6)]
+    pub audio_source_ids: Vec<String>,
+    #[cultcache(key = 7)]
+    pub audio_source_labels: Vec<String>,
+    /// Codecs the producer can encode video as, e.g. `h264`.
+    #[cultcache(key = 8)]
+    pub video_codecs: Vec<String>,
+    /// Codecs the producer can emit audio as, e.g. `pcm-f32le-interleaved`.
+    #[cultcache(key = 9)]
+    pub audio_codecs: Vec<String>,
+    #[cultcache(key = 10)]
+    pub audio_sample_rate: u32,
+    #[cultcache(key = 11)]
+    pub audio_channels: u32,
+    #[cultcache(key = 12)]
+    pub default_video_bitrate_kbps: u32,
+    #[cultcache(key = 13)]
+    pub default_latency_budget_ms: u32,
+    #[cultcache(key = 14)]
+    pub media_packet_bytes: u32,
+    /// `host:port` the producer serves this stream from. A consumer dials it
+    /// with `media_connection_id` once its request is answered `running`;
+    /// the producer listens. The consumer's host admits nothing inbound,
+    /// which is what lets a viewer install a plugin without opening a port.
+    #[cultcache(key = 15)]
+    pub media_endpoint: String,
+    /// The CultNet RUDP connection id a consumer dials `media_endpoint` with.
+    #[cultcache(key = 16)]
+    pub media_connection_id: u32,
+    #[cultcache(key = 17)]
+    pub updated_at: String,
+}
+
+/// A consumer asking a producer to start or stop serving a stream to it.
+///
+/// The producer answers by rewriting `state` and `detail` on the same record
+/// key, so a consumer watches one document for the outcome. A newer request for
+/// the same `stream_id` and `receiver_id` supersedes an older one.
+///
+/// It carries no consumer endpoint. The consumer dials the advertised
+/// `media_endpoint` and identifies itself on the wire by `receiver_id`.
+///
+/// Keyed by `media_stream_request_key(stream_id, receiver_id)`.
+#[derive(Clone, Debug, PartialEq, Eq, DatabaseEntry)]
+#[cultcache(
+    type = "gamecult.media_stream_request",
+    schema = "gamecult.media_stream_request.v1"
+)]
+pub struct GameCultMediaStreamRequestRecord {
+    #[cultcache(key = 0)]
+    pub request_id: String,
+    #[cultcache(key = 1)]
+    pub stream_id: String,
+    #[cultcache(key = 2)]
+    pub producer_id: String,
+    #[cultcache(key = 3)]
+    pub receiver_id: String,
+    /// `start` or `stop`.
+    #[cultcache(key = 4)]
+    pub action: String,
+    /// `pending`, `running`, `stopped`, or `failed`; the producer owns it after
+    /// `pending`.
+    #[cultcache(key = 5)]
+    pub state: String,
+    /// Empty means no video.
+    #[cultcache(key = 6)]
+    pub video_source_id: String,
+    /// Empty means no audio.
+    #[cultcache(key = 7)]
+    pub audio_source_id: String,
+    #[cultcache(key = 8)]
+    pub video_codec: String,
+    #[cultcache(key = 9)]
+    pub audio_codec: String,
+    #[cultcache(key = 10)]
+    pub video_bitrate_kbps: u32,
+    #[cultcache(key = 11)]
+    pub latency_budget_ms: u32,
+    #[cultcache(key = 12)]
+    pub media_packet_bytes: u32,
+    #[cultcache(key = 13)]
+    pub detail: String,
+    #[cultcache(key = 14)]
+    pub updated_at: String,
+}
+
+pub const MEDIA_STREAM_REQUEST_ACTIONS: [&str; 2] = ["start", "stop"];
+pub const MEDIA_STREAM_REQUEST_STATES: [&str; 4] = ["pending", "running", "stopped", "failed"];
+pub const MEDIA_STREAM_ADVERTISEMENT_STATES: [&str; 3] = ["available", "streaming", "unavailable"];
+
+/// One live request per stream per receiver: a newer one replaces the older.
+pub fn media_stream_request_key(stream_id: &str, receiver_id: &str) -> String {
+    format!("{stream_id}:{receiver_id}")
+}
+
+pub fn validate_media_stream_advertisement(
+    record: &GameCultMediaStreamAdvertisementRecord,
+) -> anyhow::Result<()> {
+    use anyhow::anyhow;
+    for (name, value) in [
+        ("stream_id", &record.stream_id),
+        ("producer_id", &record.producer_id),
+        ("label", &record.label),
+        ("updated_at", &record.updated_at),
+    ] {
+        if value.is_empty() {
+            return Err(anyhow!("media stream advertisement {name} must be non-empty"));
+        }
+    }
+    if !MEDIA_STREAM_ADVERTISEMENT_STATES.contains(&record.state.as_str()) {
+        return Err(anyhow!(
+            "media stream advertisement state {:?} is not one of {:?}",
+            record.state,
+            MEDIA_STREAM_ADVERTISEMENT_STATES
+        ));
+    }
+    if record.video_source_ids.len() != record.video_source_labels.len() {
+        return Err(anyhow!(
+            "media stream advertisement has {} video source ids and {} labels",
+            record.video_source_ids.len(),
+            record.video_source_labels.len()
+        ));
+    }
+    if record.audio_source_ids.len() != record.audio_source_labels.len() {
+        return Err(anyhow!(
+            "media stream advertisement has {} audio source ids and {} labels",
+            record.audio_source_ids.len(),
+            record.audio_source_labels.len()
+        ));
+    }
+    if !record.audio_source_ids.is_empty() && (record.audio_sample_rate == 0 || record.audio_channels == 0) {
+        return Err(anyhow!(
+            "media stream advertisement offers audio without a sample rate and channel count"
+        ));
+    }
+    if record.media_connection_id == 0 {
+        return Err(anyhow!("media stream advertisement media_connection_id must be non-zero"));
+    }
+    if !is_host_port(&record.media_endpoint) {
+        return Err(anyhow!(
+            "media stream advertisement media_endpoint {:?} must be host:port",
+            record.media_endpoint
+        ));
+    }
+    Ok(())
+}
+
+pub fn validate_media_stream_request(
+    record: &GameCultMediaStreamRequestRecord,
+) -> anyhow::Result<()> {
+    use anyhow::anyhow;
+    for (name, value) in [
+        ("request_id", &record.request_id),
+        ("stream_id", &record.stream_id),
+        ("producer_id", &record.producer_id),
+        ("receiver_id", &record.receiver_id),
+        ("updated_at", &record.updated_at),
+    ] {
+        if value.is_empty() {
+            return Err(anyhow!("media stream request {name} must be non-empty"));
+        }
+    }
+    if !MEDIA_STREAM_REQUEST_ACTIONS.contains(&record.action.as_str()) {
+        return Err(anyhow!(
+            "media stream request action {:?} is not one of {:?}",
+            record.action,
+            MEDIA_STREAM_REQUEST_ACTIONS
+        ));
+    }
+    if !MEDIA_STREAM_REQUEST_STATES.contains(&record.state.as_str()) {
+        return Err(anyhow!(
+            "media stream request state {:?} is not one of {:?}",
+            record.state,
+            MEDIA_STREAM_REQUEST_STATES
+        ));
+    }
+    if record.action == "start" {
+        if record.video_source_id.is_empty() && record.audio_source_id.is_empty() {
+            return Err(anyhow!("media stream request asks for neither video nor audio"));
+        }
+        if !record.video_source_id.is_empty() && record.video_codec.is_empty() {
+            return Err(anyhow!("media stream request names a video source without a codec"));
+        }
+        if !record.audio_source_id.is_empty() && record.audio_codec.is_empty() {
+            return Err(anyhow!("media stream request names an audio source without a codec"));
+        }
+    }
+    Ok(())
+}
+
+/// A hostname or IP and a non-zero port. Not `SocketAddr`: a producer may
+/// advertise a name the consumer resolves.
+fn is_host_port(value: &str) -> bool {
+    let Some((host, port)) = value.rsplit_once(':') else {
+        return false;
+    };
+    let host = host.trim_start_matches('[').trim_end_matches(']');
+    !host.is_empty() && port.parse::<u16>().is_ok_and(|port| port != 0)
+}
+
+#[cfg(test)]
+mod media_stream_catalog_tests {
+    use super::*;
+
+    fn advertisement() -> GameCultMediaStreamAdvertisementRecord {
+        GameCultMediaStreamAdvertisementRecord {
+            stream_id: "muninn.raven.av.rudp".into(),
+            producer_id: "raven".into(),
+            label: "Raven desktop".into(),
+            state: "available".into(),
+            video_source_ids: vec!["display:0".into()],
+            video_source_labels: vec!["Display 1".into()],
+            audio_source_ids: vec!["wasapi-loopback:Realtek".into()],
+            audio_source_labels: vec!["Realtek loopback".into()],
+            video_codecs: vec!["h264".into()],
+            audio_codecs: vec!["pcm-f32le-interleaved".into()],
+            audio_sample_rate: 48_000,
+            audio_channels: 2,
+            default_video_bitrate_kbps: 12_000,
+            default_latency_budget_ms: 250,
+            media_packet_bytes: 848,
+            media_endpoint: "192.168.178.20:5220".into(),
+            media_connection_id: 0x6d75_0001,
+            updated_at: "2026-09-10T00:00:00Z".into(),
+        }
+    }
+
+    fn request() -> GameCultMediaStreamRequestRecord {
+        GameCultMediaStreamRequestRecord {
+            request_id: "req-1".into(),
+            stream_id: "muninn.raven.av.rudp".into(),
+            producer_id: "raven".into(),
+            receiver_id: "starfire.obs".into(),
+            action: "start".into(),
+            state: "pending".into(),
+            video_source_id: "display:0".into(),
+            audio_source_id: "wasapi-loopback:Realtek".into(),
+            video_codec: "h264".into(),
+            audio_codec: "pcm-f32le-interleaved".into(),
+            video_bitrate_kbps: 12_000,
+            latency_budget_ms: 250,
+            media_packet_bytes: 848,
+            detail: String::new(),
+            updated_at: "2026-09-10T00:00:00Z".into(),
+        }
+    }
+
+    #[test]
+    fn a_complete_advertisement_and_request_validate() -> anyhow::Result<()> {
+        validate_media_stream_advertisement(&advertisement())?;
+        validate_media_stream_request(&request())?;
+        Ok(())
+    }
+
+    #[test]
+    fn source_ids_and_labels_must_pair_up() {
+        let mut record = advertisement();
+        record.video_source_labels.clear();
+        let error = validate_media_stream_advertisement(&record).unwrap_err();
+        assert!(error.to_string().contains("video source ids"), "{error}");
+    }
+
+    #[test]
+    fn audio_on_offer_needs_a_sample_rate_and_channels() {
+        let mut record = advertisement();
+        record.audio_channels = 0;
+        assert!(validate_media_stream_advertisement(&record).is_err());
+        record.audio_source_ids.clear();
+        record.audio_source_labels.clear();
+        assert!(validate_media_stream_advertisement(&record).is_ok(), "no audio, no requirement");
+    }
+
+    /// The producer is the listener, so it must say where.
+    #[test]
+    fn an_advertisement_says_where_the_stream_is_served() {
+        for bad in ["", "raven", "raven:", "raven:0", ":5220"] {
+            let mut record = advertisement();
+            record.media_endpoint = bad.into();
+            assert!(validate_media_stream_advertisement(&record).unwrap_err().to_string().contains("host:port"), "{bad:?}");
+        }
+        for good in ["raven:5220", "10.77.0.2:5220", "[::1]:5220"] {
+            let mut record = advertisement();
+            record.media_endpoint = good.into();
+            assert!(validate_media_stream_advertisement(&record).is_ok(), "{good:?}");
+        }
+    }
+
+    #[test]
+    fn a_start_needs_something_to_send() {
+        let mut record = request();
+        record.video_source_id.clear();
+        record.audio_source_id.clear();
+        assert!(validate_media_stream_request(&record).unwrap_err().to_string().contains("neither"));
+        let mut record = request();
+        record.video_codec.clear();
+        assert!(validate_media_stream_request(&record).unwrap_err().to_string().contains("codec"));
+    }
+
+    #[test]
+    fn a_stop_needs_no_sources() -> anyhow::Result<()> {
+        let mut record = request();
+        record.action = "stop".into();
+        record.video_source_id.clear();
+        record.audio_source_id.clear();
+        validate_media_stream_request(&record)
+    }
+
+    #[test]
+    fn unknown_actions_and_states_are_refused() {
+        let mut record = request();
+        record.action = "pause".into();
+        assert!(validate_media_stream_request(&record).is_err());
+        let mut record = request();
+        record.state = "done".into();
+        assert!(validate_media_stream_request(&record).is_err());
+    }
+
+    #[test]
+    fn one_request_per_stream_per_receiver() {
+        assert_eq!(media_stream_request_key("s", "starfire.obs"), "s:starfire.obs");
+    }
+
+    /// The records round-trip through the same positional encoding every
+    /// other runtime reads, so a Python or TypeScript consumer sees the same
+    /// slots.
+    #[test]
+    fn records_round_trip_positionally() -> anyhow::Result<()> {
+        let record = advertisement();
+        let encoded = rmp_serde::to_vec(&record)?;
+        let decoded: GameCultMediaStreamAdvertisementRecord = rmp_serde::from_slice(&encoded)?;
+        assert_eq!(decoded, record);
+        let record = request();
+        let encoded = rmp_serde::to_vec(&record)?;
+        let decoded: GameCultMediaStreamRequestRecord = rmp_serde::from_slice(&encoded)?;
+        assert_eq!(decoded, record);
+        Ok(())
+    }
+}
+
+/// One coded video access unit, possibly split across `chunk_count` records
+/// sharing a `frame_id`. A consumer reassembles by `(stream_id, session_id,
+/// frame_id)` and orders by `chunk_index`.
+#[derive(Clone, Debug, PartialEq, Eq, DatabaseEntry)]
+#[cultcache(
+    type = "gamecult.media_video_access_unit",
+    schema = "gamecult.media_video_access_unit.v1"
+)]
+pub struct GameCultMediaVideoAccessUnitRecord {
+    #[cultcache(key = 0)]
+    pub stream_id: String,
+    #[cultcache(key = 1)]
+    pub session_id: String,
+    #[cultcache(key = 2)]
+    pub frame_id: u64,
+    #[cultcache(key = 3)]
+    pub codec: String,
+    #[cultcache(key = 4)]
+    pub pts_ticks: i64,
+    #[cultcache(key = 5)]
+    pub duration_ticks: u32,
+    #[cultcache(key = 6)]
+    pub timebase_num: u32,
+    #[cultcache(key = 7)]
+    pub timebase_den: u32,
+    #[cultcache(key = 8)]
+    pub keyframe: bool,
+    #[cultcache(key = 9)]
+    pub dependency_frame_id: Option<u64>,
+    #[cultcache(key = 10)]
+    pub deadline_ticks: i64,
+    #[cultcache(key = 11)]
+    pub chunk_index: u16,
+    #[cultcache(key = 12)]
+    pub chunk_count: u16,
+    #[cultcache(key = 13, bytes)]
+    pub payload: Vec<u8>,
+}
+
+/// Forward-error-correction parity for one video access unit. Carries the
+/// framing fields of the access unit it protects so a receiver can recover
+/// without having seen the original, plus the shard geometry needed to run
+/// recovery: `parity_index` within `parity_count`, and the chunk sizes the
+/// parity was computed over.
+#[derive(Clone, Debug, PartialEq, Eq, DatabaseEntry)]
+#[cultcache(
+    type = "gamecult.media_video_parity_shard",
+    schema = "gamecult.media_video_parity_shard.v2"
+)]
+pub struct GameCultMediaVideoParityShardRecord {
+    #[cultcache(key = 0)]
+    pub stream_id: String,
+    #[cultcache(key = 1)]
+    pub session_id: String,
+    #[cultcache(key = 2)]
+    pub frame_id: u64,
+    #[cultcache(key = 3)]
+    pub codec: String,
+    #[cultcache(key = 4)]
+    pub pts_ticks: i64,
+    #[cultcache(key = 5)]
+    pub duration_ticks: u32,
+    #[cultcache(key = 6)]
+    pub timebase_num: u32,
+    #[cultcache(key = 7)]
+    pub timebase_den: u32,
+    #[cultcache(key = 8)]
+    pub keyframe: bool,
+    #[cultcache(key = 9)]
+    pub dependency_frame_id: Option<u64>,
+    #[cultcache(key = 10)]
+    pub deadline_ticks: i64,
+    #[cultcache(key = 11)]
+    pub chunk_count: u16,
+    #[cultcache(key = 12)]
+    pub parity_index: u16,
+    #[cultcache(key = 13)]
+    pub parity_count: u16,
+    #[cultcache(key = 14)]
+    pub chunk_payload_bytes: u32,
+    #[cultcache(key = 15)]
+    pub last_chunk_payload_bytes: u32,
+    #[cultcache(key = 16, bytes)]
+    pub payload: Vec<u8>,
+}
+
+/// One coded audio packet. Unlike video these are not chunked: a packet is
+/// whole or it is absent, and `payload` carries whatever `codec` names.
+#[derive(Clone, Debug, PartialEq, Eq, DatabaseEntry)]
+#[cultcache(
+    type = "gamecult.media_audio_packet",
+    schema = "gamecult.media_audio_packet.v1"
+)]
+pub struct GameCultMediaAudioPacketRecord {
+    #[cultcache(key = 0)]
+    pub stream_id: String,
+    #[cultcache(key = 1)]
+    pub session_id: String,
+    #[cultcache(key = 2)]
+    pub packet_id: u64,
+    #[cultcache(key = 3)]
+    pub codec: String,
+    #[cultcache(key = 4)]
+    pub pts_ticks: i64,
+    #[cultcache(key = 5)]
+    pub duration_ticks: u32,
+    #[cultcache(key = 6)]
+    pub timebase_num: u32,
+    #[cultcache(key = 7)]
+    pub timebase_den: u32,
+    #[cultcache(key = 8)]
+    pub deadline_ticks: i64,
+    #[cultcache(key = 9, bytes)]
+    pub payload: Vec<u8>,
+}
+
+/// What a receiver observed, published back to the producer so it can adapt:
+/// what decoded, what is missing, what arrived too late, and how much queue and
+/// jitter the receiver is carrying.
+///
+/// This is the only record here that flows consumer-to-producer. A producer is
+/// free to ignore it; it reports observation, it does not issue commands.
+#[derive(Clone, Debug, PartialEq, Eq, DatabaseEntry)]
+#[cultcache(
+    type = "gamecult.media_receiver_feedback",
+    schema = "gamecult.media_receiver_feedback.v1"
+)]
+pub struct GameCultMediaReceiverFeedbackRecord {
+    #[cultcache(key = 0)]
+    pub stream_id: String,
+    #[cultcache(key = 1)]
+    pub session_id: String,
+    #[cultcache(key = 2)]
+    pub receiver_id: String,
+    #[cultcache(key = 3)]
+    pub highest_decodable_frame_id: Option<u64>,
+    #[cultcache(key = 4)]
+    pub missing_frame_ids: Vec<u64>,
+    #[cultcache(key = 5)]
+    pub late_frame_ids: Vec<u64>,
+    #[cultcache(key = 6)]
+    pub requested_keyframe: bool,
+    #[cultcache(key = 7)]
+    pub jitter_us: i64,
+    #[cultcache(key = 8)]
+    pub decode_queue_us: i64,
+    #[cultcache(key = 9)]
+    pub observed_at: String,
+    #[cultcache(key = 10, default)]
+    pub missing_video_chunk_keys: Vec<String>,
+}
diff --git a/packages/cultnet-rs/src/media_stream_wire.rs b/packages/cultnet-rs/src/media_stream_wire.rs
new file mode 100644
index 00000000..9b7fbc1b
--- /dev/null
+++ b/packages/cultnet-rs/src/media_stream_wire.rs
@@ -0,0 +1,581 @@
+//! How a CultMesh Media Stream record travels: the envelope both ends must
+//! agree on.
+//!
+//! The records in `media_stream_contracts` describe media. This describes how
+//! one reaches a peer — wrapped in `cultnet.document_put_raw.v0` with a schema
+//! id, a record key, and provenance. It lives here because a producer and a
+//! consumer that never link each other still have to agree on it exactly, and
+//! the last time they did not, one end was Rust and the other was 6,515 lines
+//! of C++ that had drifted.
+//!
+//! # No producer's name belongs in a shared envelope
+//!
+//! The Muninn implementation this replaces hardcoded `"muninn-media:"` into
+//! every message id and `"muninn.media"` into every tag, so a second producer
+//! would have had to label its traffic as Muninn's. The producer namespace is a
+//! parameter here: see [`MediaWireProvenance`].
+//!
+//! # Record keys are addresses, not decoration
+//!
+//! A key identifies one piece of media within a session, so a consumer can tell
+//! a retransmission from a new frame and a chunk from its siblings. The shapes
+//! are fixed by this module rather than by each producer, because a consumer
+//! parses them.
+
+use anyhow::{Result, anyhow};
+
+use crate::contracts::{
+    CultNetMessage, CultNetRawDocumentRecord, CultNetRawPayloadEncoding, CultNetWireContract,
+    decode_cultnet_message_from_slice, encode_cultnet_message_to_vec,
+};
+use crate::media_stream_contracts::{
+    GAMECULT_MEDIA_AUDIO_PACKET_SCHEMA, GAMECULT_MEDIA_RECEIVER_FEEDBACK_SCHEMA,
+    GAMECULT_MEDIA_VIDEO_ACCESS_UNIT_SCHEMA, GAMECULT_MEDIA_VIDEO_PARITY_SHARD_SCHEMA,
+    GameCultMediaAudioPacketRecord, GameCultMediaReceiverFeedbackRecord,
+    GameCultMediaVideoAccessUnitRecord, GameCultMediaVideoParityShardRecord,
+};
+
+/// The CultNet channel video and receiver feedback ride.
+pub const GAMECULT_MEDIA_CHANNEL: &str = "media";
+
+/// The CultNet channel audio rides. Audio has its own channel so one session
+/// can carry it reliably with a short expiry while video stays lossy under
+/// parity; the RUDP transport profile owns each channel's delivery.
+pub const GAMECULT_MEDIA_AUDIO_CHANNEL: &str = "audio";
+
+/// One media record on its way somewhere.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub enum GameCultMediaWireRecord {
+    Video(GameCultMediaVideoAccessUnitRecord),
+    VideoParity(GameCultMediaVideoParityShardRecord),
+    Audio(GameCultMediaAudioPacketRecord),
+    Feedback(GameCultMediaReceiverFeedbackRecord),
+}
+
+/// Who is sending, and when. `producer` namespaces message ids and tags so a
+/// stream can be attributed without the envelope knowing any producer by name.
+#[derive(Clone, Copy, Debug)]
+pub struct MediaWireProvenance<'a> {
+    pub stored_at: &'a str,
+    pub runtime_id: &'a str,
+    pub role: &'a str,
+    pub producer: &'a str,
+}
+
+impl MediaWireProvenance<'_> {
+    fn validate(&self) -> Result<()> {
+        for (name, value) in [
+            ("stored_at", self.stored_at),
+            ("runtime_id", self.runtime_id),
+            ("role", self.role),
+            ("producer", self.producer),
+        ] {
+            if value.is_empty() {
+                return Err(anyhow!("media wire provenance {name} must be non-empty"));
+            }
+        }
+        Ok(())
+    }
+}
+
+impl GameCultMediaWireRecord {
+    pub fn schema_id(&self) -> &'static str {
+        match self {
+            Self::Video(_) => GAMECULT_MEDIA_VIDEO_ACCESS_UNIT_SCHEMA,
+            Self::VideoParity(_) => GAMECULT_MEDIA_VIDEO_PARITY_SHARD_SCHEMA,
+            Self::Audio(_) => GAMECULT_MEDIA_AUDIO_PACKET_SCHEMA,
+            Self::Feedback(_) => GAMECULT_MEDIA_RECEIVER_FEEDBACK_SCHEMA,
+        }
+    }
+
+    /// Addresses this record within its session.
+    pub fn record_key(&self) -> String {
+        match self {
+            Self::Video(record) => format!(
+                "{}:{}:video:{}:{}",
+                record.stream_id, record.session_id, record.frame_id, record.chunk_index
+            ),
+            Self::VideoParity(record) => format!(
+                "{}:{}:video-parity:{}:{}",
+                record.stream_id, record.session_id, record.frame_id, record.parity_index
+            ),
+            Self::Audio(record) => format!(
+                "{}:{}:audio:{}",
+                record.stream_id, record.session_id, record.packet_id
+            ),
+            Self::Feedback(record) => format!(
+                "{}:{}:feedback:{}",
+                record.stream_id, record.session_id, record.receiver_id
+            ),
+        }
+    }
+
+    /// The record's own MessagePack form.
+    ///
+    /// Serializing the record directly is only correct because the payload
+    /// fields carry `#[cultcache(key = N, bytes)]`. Muninn previously mirrored
+    /// each record into a parallel tuple struct — every field restated, in
+    /// order, by hand — solely so `#[serde(with = "serde_bytes")]` could be
+    /// applied to the payload, because the `DatabaseEntry` derive does not read
+    /// serde attributes. Those shadow structs are gone; the derive emits `bin`
+    /// itself now. Do not reintroduce one.
+    fn payload_bytes(&self) -> Result<Vec<u8>> {
+        match self {
+            Self::Video(record) => rmp_serde::to_vec(record),
+            Self::VideoParity(record) => rmp_serde::to_vec(record),
+            Self::Audio(record) => rmp_serde::to_vec(record),
+            Self::Feedback(record) => rmp_serde::to_vec(record),
+        }
+        .map_err(Into::into)
+    }
+}
+
+/// Wraps a media record for the wire.
+pub fn encode_media_wire_record(
+    record: &GameCultMediaWireRecord,
+    provenance: MediaWireProvenance<'_>,
+) -> Result<Vec<u8>> {
+    provenance.validate()?;
+
+    let schema_id = record.schema_id();
+    let record_key = record.record_key();
+    let message = CultNetMessage::DocumentPutRaw {
+        message_id: format!(
+            "{}-media:{}:{}",
+            provenance.producer,
+            schema_id,
+            record_key.replace(':', "-")
+        ),
+        document: CultNetRawDocumentRecord {
+            schema_id: schema_id.to_string(),
+            record_key,
+            stored_at: provenance.stored_at.to_string(),
+            payload_encoding: CultNetRawPayloadEncoding::Messagepack,
+            payload: record.payload_bytes()?,
+            source_runtime_id: Some(provenance.runtime_id.to_string()),
+            source_agent_id: None,
+            source_role: Some(provenance.role.to_string()),
+            tags: Some(vec![format!("{}.media", provenance.producer)]),
+        },
+    };
+
+    encode_cultnet_message_to_vec(&message, CultNetWireContract::CultNetSchemaV0).map_err(Into::into)
+}
+
+/// Unwraps a media record from the wire.
+pub fn decode_media_wire_record(payload: &[u8]) -> Result<GameCultMediaWireRecord> {
+    let message = decode_cultnet_message_from_slice(payload, CultNetWireContract::CultNetSchemaV0)?;
+    let CultNetMessage::DocumentPutRaw { document, .. } = message else {
+        return Err(anyhow!("expected cultnet.document_put_raw.v0"));
+    };
+    if document.payload_encoding != CultNetRawPayloadEncoding::Messagepack {
+        return Err(anyhow!("media document payload must be MessagePack"));
+    }
+
+    let record = match document.schema_id.as_str() {
+        GAMECULT_MEDIA_VIDEO_ACCESS_UNIT_SCHEMA => {
+            let record: GameCultMediaVideoAccessUnitRecord =
+                rmp_serde::from_slice(&document.payload)?;
+            validate_video_record(&record)?;
+            GameCultMediaWireRecord::Video(record)
+        }
+        GAMECULT_MEDIA_VIDEO_PARITY_SHARD_SCHEMA => {
+            let record: GameCultMediaVideoParityShardRecord =
+                rmp_serde::from_slice(&document.payload)?;
+            validate_video_parity_record(&record)?;
+            GameCultMediaWireRecord::VideoParity(record)
+        }
+        GAMECULT_MEDIA_AUDIO_PACKET_SCHEMA => {
+            let record: GameCultMediaAudioPacketRecord =
+                rmp_serde::from_slice(&document.payload)?;
+            validate_audio_record(&record)?;
+            GameCultMediaWireRecord::Audio(record)
+        }
+        GAMECULT_MEDIA_RECEIVER_FEEDBACK_SCHEMA => {
+            let record: GameCultMediaReceiverFeedbackRecord =
+                rmp_serde::from_slice(&document.payload)?;
+            validate_feedback_record(&record)?;
+            GameCultMediaWireRecord::Feedback(record)
+        }
+        other => return Err(anyhow!("unsupported media schema {other}")),
+    };
+
+    // The key is derived from the record's own contents, so a mismatch means the
+    // envelope and its payload disagree about what this is. Admitting it would
+    // let a consumer address media by a key its producer never meant.
+    let expected = record.record_key();
+    if document.record_key != expected {
+        return Err(anyhow!(
+            "record key mismatch: envelope says {}, record derives {expected}",
+            document.record_key
+        ));
+    }
+
+    Ok(record)
+}
+
+// ---------------------------------------------------------------------------
+// Validation
+//
+// Moved here from Muninn with the envelope. A decoder that does not validate
+// leaves each consumer to invent its own idea of a well-formed record, which is
+// how the C++ receiver and the Rust sender came to disagree while both looked
+// correct in isolation. Muninn's tests for these came too; they now cover the
+// contract rather than one producer's copy of it.
+// ---------------------------------------------------------------------------
+
+/// Addresses one chunk of a video frame. The string form appears in receiver
+/// feedback and is parsed by consumers, so its shape is contract.
+#[derive(Clone, Debug, PartialEq, Eq, PartialOrd, Ord)]
+pub struct VideoChunkKey {
+    pub frame_id: u64,
+    pub chunk_index: u16,
+}
+
+impl VideoChunkKey {
+    pub fn new(frame_id: u64, chunk_index: u16) -> Self {
+        Self {
+            frame_id,
+            chunk_index,
+        }
+    }
+
+    pub fn parse(value: &str) -> Result<Self> {
+        if value.matches(':').count() != 1 {
+            return Err(anyhow!(
+                "video chunk key must contain exactly one ':' separator"
+            ));
+        }
+        let (frame_id, chunk_index) = value
+            .split_once(':')
+            .ok_or_else(|| anyhow!("video chunk key must be '<frame_id>:<chunk_index>'"))?;
+        Ok(Self {
+            frame_id: frame_id
+                .parse()
+                .map_err(|_| anyhow!("video chunk key frame_id must be an integer"))?,
+            chunk_index: chunk_index
+                .parse()
+                .map_err(|_| anyhow!("video chunk key chunk_index must be an integer"))?,
+        })
+    }
+
+    pub fn as_feedback_key(&self) -> String {
+        format!("{}:{}", self.frame_id, self.chunk_index)
+    }
+}
+
+pub fn video_chunk_feedback_key(frame_id: u64, chunk_index: u16) -> String {
+    VideoChunkKey::new(frame_id, chunk_index).as_feedback_key()
+}
+
+pub fn normalize_video_chunk_feedback_keys(keys: Vec<String>) -> Result<Vec<String>> {
+    let mut parsed = keys
+        .iter()
+        .map(|key| VideoChunkKey::parse(key))
+        .collect::<Result<Vec<_>>>()?;
+    parsed.sort_unstable();
+    parsed.dedup();
+    Ok(parsed
+        .into_iter()
+        .map(|key| key.as_feedback_key())
+        .collect())
+}
+
+pub fn validate_video_record(record: &GameCultMediaVideoAccessUnitRecord) -> Result<()> {
+    if record.stream_id.is_empty() {
+        return Err(anyhow!("video media record stream_id must be non-empty"));
+    }
+    if record.session_id.is_empty() {
+        return Err(anyhow!("video media record session_id must be non-empty"));
+    }
+    if record.codec.is_empty() {
+        return Err(anyhow!("video media record codec must be non-empty"));
+    }
+    if record.timebase_num == 0 || record.timebase_den == 0 {
+        return Err(anyhow!("video media record timebase must be non-zero"));
+    }
+    if record.duration_ticks == 0 {
+        return Err(anyhow!(
+            "video media record duration_ticks must be greater than zero"
+        ));
+    }
+    if record.deadline_ticks < record.pts_ticks {
+        return Err(anyhow!(
+            "video media record deadline_ticks must not precede pts_ticks"
+        ));
+    }
+    if record.chunk_count == 0 {
+        return Err(anyhow!("video media record chunk_count must be non-zero"));
+    }
+    if record.chunk_index >= record.chunk_count {
+        return Err(anyhow!(
+            "video media record chunk_index {} is outside chunk_count {}",
+            record.chunk_index,
+            record.chunk_count
+        ));
+    }
+    if record.payload.is_empty() {
+        return Err(anyhow!("video media record payload must be non-empty"));
+    }
+    Ok(())
+}
+
+pub fn validate_video_parity_record(record: &GameCultMediaVideoParityShardRecord) -> Result<()> {
+    if record.stream_id.is_empty() {
+        return Err(anyhow!(
+            "video parity media record stream_id must be non-empty"
+        ));
+    }
+    if record.session_id.is_empty() {
+        return Err(anyhow!(
+            "video parity media record session_id must be non-empty"
+        ));
+    }
+    if record.codec.is_empty() {
+        return Err(anyhow!("video parity media record codec must be non-empty"));
+    }
+    if record.timebase_num == 0 || record.timebase_den == 0 {
+        return Err(anyhow!(
+            "video parity media record timebase must be non-zero"
+        ));
+    }
+    if record.duration_ticks == 0 {
+        return Err(anyhow!(
+            "video parity media record duration_ticks must be greater than zero"
+        ));
+    }
+    if record.deadline_ticks < record.pts_ticks {
+        return Err(anyhow!(
+            "video parity media record deadline_ticks must not precede pts_ticks"
+        ));
+    }
+    if record.chunk_count == 0 {
+        return Err(anyhow!(
+            "video parity media record chunk_count must be non-zero"
+        ));
+    }
+    if record.parity_count == 0 || record.parity_index >= record.parity_count {
+        return Err(anyhow!(
+            "video parity media record has invalid parity stripe metadata"
+        ));
+    }
+    if record.parity_count > record.chunk_count {
+        return Err(anyhow!(
+            "video parity media record parity_count exceeds chunk_count"
+        ));
+    }
+    if record.chunk_payload_bytes == 0 || record.last_chunk_payload_bytes == 0 {
+        return Err(anyhow!(
+            "video parity media record chunk lengths must be non-zero"
+        ));
+    }
+    if record.last_chunk_payload_bytes > record.chunk_payload_bytes {
+        return Err(anyhow!(
+            "video parity media record last chunk length exceeds regular chunk length"
+        ));
+    }
+    if record.payload.is_empty() {
+        return Err(anyhow!(
+            "video parity media record payload must be non-empty"
+        ));
+    }
+    if record.payload.len() > record.chunk_payload_bytes as usize {
+        return Err(anyhow!(
+            "video parity media record payload exceeds declared chunk length"
+        ));
+    }
+    Ok(())
+}
+
+pub fn validate_audio_record(record: &GameCultMediaAudioPacketRecord) -> Result<()> {
+    if record.stream_id.is_empty() {
+        return Err(anyhow!("audio media record stream_id must be non-empty"));
+    }
+    if record.session_id.is_empty() {
+        return Err(anyhow!("audio media record session_id must be non-empty"));
+    }
+    if record.codec.is_empty() {
+        return Err(anyhow!("audio media record codec must be non-empty"));
+    }
+    if record.timebase_num == 0 || record.timebase_den == 0 {
+        return Err(anyhow!("audio media record timebase must be non-zero"));
+    }
+    if record.duration_ticks == 0 {
+        return Err(anyhow!(
+            "audio media record duration_ticks must be greater than zero"
+        ));
+    }
+    if record.deadline_ticks < record.pts_ticks {
+        return Err(anyhow!(
+            "audio media record deadline_ticks must not precede pts_ticks"
+        ));
+    }
+    if record.payload.is_empty() {
+        return Err(anyhow!("audio media record payload must be non-empty"));
+    }
+    Ok(())
+}
+
+pub fn validate_feedback_record(record: &GameCultMediaReceiverFeedbackRecord) -> Result<()> {
+    if record.stream_id.is_empty() {
+        return Err(anyhow!(
+            "receiver feedback media record stream_id must be non-empty"
+        ));
+    }
+    if record.session_id.is_empty() {
+        return Err(anyhow!(
+            "receiver feedback media record session_id must be non-empty"
+        ));
+    }
+    if record.receiver_id.is_empty() {
+        return Err(anyhow!(
+            "receiver feedback media record receiver_id must be non-empty"
+        ));
+    }
+    if record.observed_at.is_empty() {
+        return Err(anyhow!(
+            "receiver feedback media record observed_at must be non-empty"
+        ));
+    }
+    if record.jitter_us < 0 {
+        return Err(anyhow!(
+            "receiver feedback media record jitter_us must be non-negative"
+        ));
+    }
+    if record.decode_queue_us < 0 {
+        return Err(anyhow!(
+            "receiver feedback media record decode_queue_us must be non-negative"
+        ));
+    }
+    normalize_video_chunk_feedback_keys(record.missing_video_chunk_keys.clone())?;
+    Ok(())
+}
+
+/// What a receiver has to say about a stream. The record it builds is the
+/// contract's; this normalises it so both ends agree on its shape: damage
+/// lists sorted and unique, chunk keys well-formed, and a keyframe requested
+/// whenever a whole frame is missing, since a producer's repair cache holds
+/// chunks, not references. Missing chunks alone are a repair request, which
+/// exists precisely so that a keyframe is not needed.
+#[derive(Clone, Debug)]
+pub struct ReceiverFeedbackOptions<'a> {
+    pub stream_id: &'a str,
+    pub session_id: &'a str,
+    pub receiver_id: &'a str,
+    pub highest_decodable_frame_id: Option<u64>,
+    pub missing_frame_ids: Vec<u64>,
+    pub missing_video_chunk_keys: Vec<String>,
+    pub late_frame_ids: Vec<u64>,
+    pub requested_keyframe: bool,
+    pub jitter_us: i64,
+    pub decode_queue_us: i64,
+    pub observed_at: &'a str,
+}
+
+pub fn build_receiver_feedback(
+    options: ReceiverFeedbackOptions<'_>,
+) -> Result<GameCultMediaReceiverFeedbackRecord> {
+    let mut missing_frame_ids = options.missing_frame_ids;
+    missing_frame_ids.sort_unstable();
+    missing_frame_ids.dedup();
+    let missing_video_chunk_keys =
+        normalize_video_chunk_feedback_keys(options.missing_video_chunk_keys)?;
+    let mut late_frame_ids = options.late_frame_ids;
+    late_frame_ids.sort_unstable();
+    late_frame_ids.dedup();
+    let requested_keyframe = options.requested_keyframe || !missing_frame_ids.is_empty();
+
+    let record = GameCultMediaReceiverFeedbackRecord {
+        stream_id: options.stream_id.to_string(),
+        session_id: options.session_id.to_string(),
+        receiver_id: options.receiver_id.to_string(),
+        highest_decodable_frame_id: options.highest_decodable_frame_id,
+        missing_frame_ids,
+        late_frame_ids,
+        requested_keyframe,
+        jitter_us: options.jitter_us,
+        decode_queue_us: options.decode_queue_us,
+        observed_at: options.observed_at.to_string(),
+        missing_video_chunk_keys,
+    };
+    validate_feedback_record(&record)?;
+    Ok(record)
+}
+
+#[cfg(test)]
+mod receiver_feedback_tests {
+    use super::*;
+
+    fn options() -> ReceiverFeedbackOptions<'static> {
+        ReceiverFeedbackOptions {
+            stream_id: "muninn.raven.av.rudp",
+            session_id: "session-1",
+            receiver_id: "starfire.obs",
+            highest_decodable_frame_id: Some(40),
+            missing_frame_ids: Vec::new(),
+            missing_video_chunk_keys: Vec::new(),
+            late_frame_ids: Vec::new(),
+            requested_keyframe: false,
+            jitter_us: 0,
+            decode_queue_us: 2_000,
+            observed_at: "2026-06-18T00:00:00Z",
+        }
+    }
+
+    #[test]
+    fn builds_receiver_feedback_with_sorted_unique_damage_lists() -> Result<()> {
+        let feedback = build_receiver_feedback(ReceiverFeedbackOptions {
+            missing_frame_ids: vec![43, 42, 43],
+            missing_video_chunk_keys: vec![
+                video_chunk_feedback_key(43, 2),
+                video_chunk_feedback_key(42, 1),
+                video_chunk_feedback_key(42, 1),
+            ],
+            late_frame_ids: vec![39, 39, 38],
+            jitter_us: 700,
+            ..options()
+        })?;
+
+        assert_eq!(feedback.missing_frame_ids, vec![42, 43]);
+        assert_eq!(feedback.missing_video_chunk_keys, vec!["42:1", "43:2"]);
+        assert_eq!(feedback.late_frame_ids, vec![38, 39]);
+        assert!(feedback.requested_keyframe, "a whole missing frame is a lost reference");
+        Ok(())
+    }
+
+    /// A producer answers a keyframe request with an IDR. A repair request is
+    /// the cheaper alternative and must not carry one by accident.
+    #[test]
+    fn a_repair_request_does_not_ask_for_a_keyframe() -> Result<()> {
+        let feedback = build_receiver_feedback(ReceiverFeedbackOptions {
+            missing_video_chunk_keys: vec![video_chunk_feedback_key(42, 1)],
+            ..options()
+        })?;
+        assert!(!feedback.requested_keyframe);
+        Ok(())
+    }
+
+    #[test]
+    fn rejects_negative_receiver_feedback_timing() {
+        let error = build_receiver_feedback(ReceiverFeedbackOptions { jitter_us: -1, ..options() })
+            .unwrap_err();
+        assert!(error.to_string().contains("jitter_us"));
+    }
+
+    #[test]
+    fn rejects_malformed_receiver_feedback_chunk_keys() {
+        let error = build_receiver_feedback(ReceiverFeedbackOptions {
+            missing_video_chunk_keys: vec!["frame:chunk".to_string()],
+            ..options()
+        })
+        .unwrap_err();
+        assert!(error.to_string().contains("frame_id"), "{error}");
+    }
+
+    #[test]
+    fn rejects_an_empty_receiver_id() {
+        let error = build_receiver_feedback(ReceiverFeedbackOptions { receiver_id: "", ..options() })
+            .unwrap_err();
+        assert!(error.to_string().contains("receiver_id"));
+    }
+}
diff --git a/packages/cultnet-rs/src/operation_service.rs b/packages/cultnet-rs/src/operation_service.rs
new file mode 100644
index 00000000..84d60cfa
--- /dev/null
+++ b/packages/cultnet-rs/src/operation_service.rs
@@ -0,0 +1,60 @@
+use std::net::UdpSocket;
+use std::time::Duration;
+
+use anyhow::{Result, anyhow};
+
+use crate::{
+    CultNetMessage, CultNetRudpSocketTransportConnection, CultNetRudpSocketTransportOptions,
+};
+
+pub const CULTNET_OPERATION_CONNECTION_ID: u32 = 0x4355_4c54;
+
+pub struct CultNetOperationServer {
+    transport: CultNetRudpSocketTransportConnection,
+    endpoint: String,
+}
+
+impl CultNetOperationServer {
+    pub fn bind(runtime_id: impl Into<String>, host: &str, port: u16) -> Result<Self> {
+        let socket = UdpSocket::bind((host, port))?;
+        socket.set_read_timeout(Some(Duration::from_millis(25)))?;
+        let address = socket.local_addr()?;
+        let mut options = CultNetRudpSocketTransportOptions::server(
+            runtime_id,
+            socket,
+            CULTNET_OPERATION_CONNECTION_ID,
+        );
+        options.max_fragment_bytes = Some(2048);
+        Ok(Self {
+            transport: CultNetRudpSocketTransportConnection::new(options)?,
+            endpoint: format!("rudp://{}:{}", address.ip(), address.port()),
+        })
+    }
+
+    pub fn endpoint(&self) -> &str {
+        &self.endpoint
+    }
+
+    pub fn serve_once(
+        &mut self,
+        mut handler: impl FnMut(CultNetMessage) -> Result<CultNetMessage>,
+    ) -> Result<bool> {
+        let Some(request) = self.transport.receive_schema_message_once()? else {
+            self.transport.poll_resends()?;
+            return Ok(false);
+        };
+        if !matches!(request, CultNetMessage::OperationRequest { .. }) {
+            return Err(anyhow!(
+                "CultNet operation service received a non-operation message"
+            ));
+        }
+        let response = handler(request)?;
+        if !matches!(response, CultNetMessage::OperationResponse { .. }) {
+            return Err(anyhow!(
+                "CultNet operation handler returned a non-operation response"
+            ));
+        }
+        self.transport.send_schema_message(&response)?;
+        Ok(true)
+    }
+}
diff --git a/packages/cultnet-rs/src/provider_health_contracts.rs b/packages/cultnet-rs/src/provider_health_contracts.rs
new file mode 100644
index 00000000..632c74f2
--- /dev/null
+++ b/packages/cultnet-rs/src/provider_health_contracts.rs
@@ -0,0 +1,716 @@
+use anyhow::{Context, Result, anyhow, bail};
+use cultcache_rs::DatabaseEntry;
+use serde::{Deserialize, Serialize};
+
+use crate::runtime_authority_contracts::{
+    GAMECULT_RUNTIME_PRESENCE_HEALTH_SCHEMA, GAMECULT_RUNTIME_PRESENCE_HEALTH_SIGNING_PURPOSE,
+    ODIN_RUNTIME_TOPOLOGY_CORRELATION_SCHEMA, ODIN_RUNTIME_TOPOLOGY_CORRELATION_SIGNING_PURPOSE,
+};
+use crate::{
+    GameCultProviderHealthIdentity, IdunnServiceIdentity, OdinTopologyIdentity,
+    derive_service_identity_id,
+};
+
+pub const GAMECULT_SERVICE_TRUST_ANCHOR_SCHEMA: &str = "gamecult.service_trust_anchor.v1";
+pub const IDUNN_AUTHENTICATED_PROVIDER_HEALTH_PROJECTION_SCHEMA: &str =
+    "idunn.authenticated_provider_health_projection.v1";
+pub const IDUNN_SIGNED_DAEMON_HEALTH_SCHEMA: &str = "idunn.signed_daemon_health.v1";
+pub const IDUNN_AUTHENTICATED_PROVIDER_HEALTH_PROJECTION_SIGNING_PURPOSE: &str =
+    "idunn.authenticated-provider-health-projection.v1";
+pub const IDUNN_PROVIDER_ACTIVE_REASON: &str = "authenticated_provider_active";
+pub const IDUNN_PROVIDER_WARMING_REASON: &str = "authenticated_provider_warming";
+pub const IDUNN_PROVIDER_DEGRADED_REASON: &str = "authenticated_provider_degraded";
+pub const IDUNN_PROVIDER_FAILED_REASON: &str = "authenticated_provider_failed";
+pub const IDUNN_DAEMON_HEALTH_TRUST_BINDING_SCHEMA: &str = "idunn.daemon_health_trust_binding.v1";
+
+/// Provider-owned health statement. Ingress verifies `signature` over the
+/// complete positional record with this field empty before admitting it.
+#[derive(Clone, Debug, PartialEq, Eq, DatabaseEntry)]
+#[cultcache(
+    type = "idunn.signed_daemon_health",
+    schema = "idunn.signed_daemon_health.v1"
+)]
+pub struct IdunnSignedDaemonHealthRecord {
+    #[cultcache(key = 0)]
+    pub schema_version: String,
+    #[cultcache(key = 1)]
+    pub daemon_id: String,
+    #[cultcache(key = 2)]
+    pub health_contract: String,
+    #[cultcache(key = 3)]
+    pub source_runtime_id: String,
+    #[cultcache(key = 4)]
+    pub state: String,
+    #[cultcache(key = 5)]
+    pub detail: String,
+    #[cultcache(key = 6)]
+    pub signer_identity_id: String,
+    #[cultcache(key = 7)]
+    pub publisher_incarnation_id: String,
+    #[cultcache(key = 8)]
+    pub publisher_sequence: u64,
+    #[cultcache(key = 9)]
+    pub observed_at_unix_millis: u64,
+    #[cultcache(key = 10)]
+    pub release_id: Option<String>,
+    #[cultcache(key = 11)]
+    pub release_witness_sha256: Option<String>,
+    #[cultcache(key = 12)]
+    pub source_commit: Option<String>,
+    #[cultcache(key = 13)]
+    pub deployment_id: Option<String>,
+    #[cultcache(key = 14)]
+    pub signature_algorithm: String,
+    #[cultcache(key = 15, bytes)]
+    pub signature: Vec<u8>,
+    #[cultcache(key = 16)]
+    pub private_state_exposed: bool,
+    #[cultcache(key = 17, default)]
+    pub activation_witness_sha256: Option<String>,
+}
+
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+struct LegacyIdunnSignedDaemonHealthWire {
+    schema_version: String,
+    daemon_id: String,
+    health_contract: String,
+    source_runtime_id: String,
+    state: String,
+    detail: String,
+    signer_identity_id: String,
+    publisher_incarnation_id: String,
+    publisher_sequence: u64,
+    observed_at_unix_millis: u64,
+    release_id: Option<String>,
+    release_witness_sha256: Option<String>,
+    source_commit: Option<String>,
+    deployment_id: Option<String>,
+    signature_algorithm: String,
+    #[serde(with = "serde_bytes")]
+    signature: Vec<u8>,
+    private_state_exposed: bool,
+}
+
+impl From<LegacyIdunnSignedDaemonHealthWire> for IdunnSignedDaemonHealthRecord {
+    fn from(value: LegacyIdunnSignedDaemonHealthWire) -> Self {
+        Self {
+            schema_version: value.schema_version,
+            daemon_id: value.daemon_id,
+            health_contract: value.health_contract,
+            source_runtime_id: value.source_runtime_id,
+            state: value.state,
+            detail: value.detail,
+            signer_identity_id: value.signer_identity_id,
+            publisher_incarnation_id: value.publisher_incarnation_id,
+            publisher_sequence: value.publisher_sequence,
+            observed_at_unix_millis: value.observed_at_unix_millis,
+            release_id: value.release_id,
+            release_witness_sha256: value.release_witness_sha256,
+            source_commit: value.source_commit,
+            deployment_id: value.deployment_id,
+            signature_algorithm: value.signature_algorithm,
+            signature: value.signature,
+            private_state_exposed: value.private_state_exposed,
+            activation_witness_sha256: None,
+        }
+    }
+}
+
+impl IdunnSignedDaemonHealthRecord {
+    /// Decode the canonical current or pre-activation positional wire and
+    /// return the exact wire generation's unsigned signature payload.
+    pub fn decode_canonical_signed_payload(payload: &[u8]) -> Result<(Self, Vec<u8>)> {
+        match messagepack_array_len(payload) {
+            Some(18) => {
+                let statement: Self = rmp_serde::from_slice(payload)
+                    .context("decoding generic signed daemon health")?;
+                if rmp_serde::to_vec(&statement)? != payload {
+                    bail!("signed daemon health payload is not canonical positional MessagePack");
+                }
+                let mut unsigned = statement.clone();
+                unsigned.signature.clear();
+                Ok((statement, rmp_serde::to_vec(&unsigned)?))
+            }
+            Some(17) => {
+                let legacy: LegacyIdunnSignedDaemonHealthWire = rmp_serde::from_slice(payload)
+                    .context("decoding legacy generic signed daemon health")?;
+                if rmp_serde::to_vec(&legacy)? != payload {
+                    bail!("signed daemon health payload is not canonical positional MessagePack");
+                }
+                let mut unsigned = legacy.clone();
+                unsigned.signature.clear();
+                let unsigned_payload = rmp_serde::to_vec(&unsigned)?;
+                Ok((legacy.into(), unsigned_payload))
+            }
+            _ => bail!("signed daemon health payload is not canonical positional MessagePack"),
+        }
+    }
+
+    pub fn validate(&self) -> Result<()> {
+        if self.schema_version != IDUNN_SIGNED_DAEMON_HEALTH_SCHEMA {
+            bail!("signed daemon health schema is unsupported");
+        }
+        validate_identifier(&self.daemon_id, "daemon id")?;
+        validate_identifier(&self.health_contract, "health contract")?;
+        validate_identifier(&self.source_runtime_id, "source runtime id")?;
+        validate_identifier(&self.signer_identity_id, "signer identity id")?;
+        validate_identifier(&self.publisher_incarnation_id, "publisher incarnation id")?;
+        if !matches!(
+            self.state.as_str(),
+            "active" | "warming" | "degraded" | "failed"
+        ) || self.detail.len() > 512
+            || self.signature_algorithm != "ed25519"
+            || self.signature.len() != 64
+            || self.publisher_sequence == 0
+            || self.observed_at_unix_millis == 0
+        {
+            bail!("signed daemon health shape is invalid");
+        }
+        validate_optional_release_binding(
+            &self.release_id,
+            &self.release_witness_sha256,
+            &self.source_commit,
+        )?;
+        validate_optional_identifier(&self.deployment_id, "deployment id")?;
+        validate_optional_sha256(&self.activation_witness_sha256, "activation witness sha256")?;
+        if self.private_state_exposed {
+            bail!("signed daemon health exposes private state");
+        }
+        Ok(())
+    }
+}
+
+fn messagepack_array_len(payload: &[u8]) -> Option<usize> {
+    match *payload.first()? {
+        marker @ 0x90..=0x9f => Some(usize::from(marker & 0x0f)),
+        0xdc => Some(usize::from(u16::from_be_bytes([
+            *payload.get(1)?,
+            *payload.get(2)?,
+        ]))),
+        0xdd => usize::try_from(u32::from_be_bytes([
+            *payload.get(1)?,
+            *payload.get(2)?,
+            *payload.get(3)?,
+            *payload.get(4)?,
+        ]))
+        .ok(),
+        _ => None,
+    }
+}
+
+/// Root-owned admission binding. Store ownership is the physical authority;
+/// this document names the only signer accepted for one daemon/contract/runtime.
+#[derive(Clone, Debug, PartialEq, Eq, DatabaseEntry)]
+#[cultcache(
+    type = "idunn.daemon_health_trust_binding",
+    schema = "idunn.daemon_health_trust_binding.v1"
+)]
+pub struct IdunnDaemonHealthTrustBindingRecord {
+    #[cultcache(key = 0)]
+    pub schema_version: String,
+    #[cultcache(key = 1)]
+    pub binding_id: String,
+    #[cultcache(key = 2)]
+    pub daemon_id: String,
+    #[cultcache(key = 3)]
+    pub health_contract: String,
+    #[cultcache(key = 4)]
+    pub source_runtime_id: String,
+    #[cultcache(key = 5)]
+    pub signer_identity_id: String,
+    #[cultcache(key = 6)]
+    pub signer_public_key: Vec<u8>,
+    #[cultcache(key = 7)]
+    pub binding_authority: String,
+    #[cultcache(key = 8)]
+    pub bound_at_unix_millis: u64,
+    #[cultcache(key = 9)]
+    pub release_binding_required: bool,
+    #[cultcache(key = 10)]
+    pub private_state_exposed: bool,
+}
+
+impl IdunnDaemonHealthTrustBindingRecord {
+    pub fn validate(&self) -> Result<()> {
+        if self.schema_version != IDUNN_DAEMON_HEALTH_TRUST_BINDING_SCHEMA {
+            bail!("daemon health trust binding schema is unsupported");
+        }
+        validate_identifier(&self.binding_id, "binding id")?;
+        validate_identifier(&self.daemon_id, "daemon id")?;
+        validate_identifier(&self.health_contract, "health contract")?;
+        validate_identifier(&self.source_runtime_id, "source runtime id")?;
+        validate_identifier(&self.signer_identity_id, "signer identity id")?;
+        if self.signer_public_key.len() != 32
+            || self.binding_authority != "root"
+            || self.bound_at_unix_millis == 0
+        {
+            bail!("daemon health trust binding authority or key is invalid");
+        }
+        if self.private_state_exposed {
+            bail!("daemon health trust binding exposes private state");
+        }
+        if self.signer_identity_id
+            != derive_service_identity_id::<GameCultProviderHealthIdentity>(
+                &self.signer_public_key,
+            )?
+        {
+            bail!("daemon health trust binding identity does not match its public key");
+        }
+        Ok(())
+    }
+}
+
+/// Root-distributed public key binding for one service-owned signed contract.
+/// Consumers pin this document; a self-declared key inside a signed projection
+/// is never authority.
+#[derive(Clone, Debug, PartialEq, Eq, DatabaseEntry)]
+#[cultcache(
+    type = "gamecult.service_trust_anchor",
+    schema = "gamecult.service_trust_anchor.v1"
+)]
+pub struct GameCultServiceTrustAnchorRecord {
+    #[cultcache(key = 0)]
+    pub schema_version: String,
+    #[cultcache(key = 1)]
+    pub trust_anchor_id: String,
+    #[cultcache(key = 2)]
+    pub service_id: String,
+    #[cultcache(key = 3)]
+    pub runtime_id: String,
+    #[cultcache(key = 4)]
+    pub signer_identity_id: String,
+    #[cultcache(key = 5)]
+    pub signer_public_key: Vec<u8>,
+    #[cultcache(key = 6)]
+    pub signature_algorithm: String,
+    #[cultcache(key = 7)]
+    pub signing_purpose: String,
+    #[cultcache(key = 8)]
+    pub signed_schema: String,
+    #[cultcache(key = 9)]
+    pub binding_authority: String,
+    #[cultcache(key = 10)]
+    pub bound_at_unix_millis: u64,
+    #[cultcache(key = 11)]
+    pub expires_at_unix_millis: Option<u64>,
+    #[cultcache(key = 12)]
+    pub private_state_exposed: bool,
+}
+
+impl GameCultServiceTrustAnchorRecord {
+    pub fn validate(&self) -> Result<()> {
+        if self.schema_version != GAMECULT_SERVICE_TRUST_ANCHOR_SCHEMA {
+            bail!("service trust anchor schema is unsupported");
+        }
+        validate_identifier(&self.trust_anchor_id, "trust anchor id")?;
+        validate_identifier(&self.service_id, "service id")?;
+        validate_identifier(&self.runtime_id, "runtime id")?;
+        validate_identifier(&self.signer_identity_id, "signer identity id")?;
+        validate_identifier(&self.signing_purpose, "signing purpose")?;
+        validate_identifier(&self.signed_schema, "signed schema")?;
+        if self.signer_public_key.len() != 32
+            || self.signature_algorithm != "ed25519"
+            || self.binding_authority != "root"
+            || self.bound_at_unix_millis == 0
+            || self
+                .expires_at_unix_millis
+                .is_some_and(|expires_at| expires_at <= self.bound_at_unix_millis)
+            || self.private_state_exposed
+        {
+            bail!("service trust anchor authority, key, lifetime, or privacy is invalid");
+        }
+        if self.signed_schema == IDUNN_AUTHENTICATED_PROVIDER_HEALTH_PROJECTION_SCHEMA
+            && (self.service_id != "idunn"
+                || self.signing_purpose
+                    != IDUNN_AUTHENTICATED_PROVIDER_HEALTH_PROJECTION_SIGNING_PURPOSE
+                || self.signer_identity_id
+                    != derive_service_identity_id::<IdunnServiceIdentity>(&self.signer_public_key)?)
+        {
+            bail!("Idunn provider-health trust anchor profile is invalid");
+        }
+        let is_runtime_presence_profile = self
+            .signed_schema
+            .starts_with("gamecult.runtime_presence_health.")
+            || self
+                .signing_purpose
+                .starts_with("gamecult.runtime_presence_health.");
+        if is_runtime_presence_profile
+            && (self.signed_schema != GAMECULT_RUNTIME_PRESENCE_HEALTH_SCHEMA
+                || self.signing_purpose != GAMECULT_RUNTIME_PRESENCE_HEALTH_SIGNING_PURPOSE
+                || self.signer_identity_id
+                    != derive_service_identity_id::<GameCultProviderHealthIdentity>(
+                        &self.signer_public_key,
+                    )?)
+        {
+            bail!("runtime presence trust anchor profile is invalid");
+        }
+        if (self.signed_schema == ODIN_RUNTIME_TOPOLOGY_CORRELATION_SCHEMA
+            || self.signing_purpose == ODIN_RUNTIME_TOPOLOGY_CORRELATION_SIGNING_PURPOSE)
+            && (self.signed_schema != ODIN_RUNTIME_TOPOLOGY_CORRELATION_SCHEMA
+                || self.signing_purpose != ODIN_RUNTIME_TOPOLOGY_CORRELATION_SIGNING_PURPOSE
+                || self.service_id != "odin"
+                || self.signer_identity_id
+                    != derive_service_identity_id::<OdinTopologyIdentity>(&self.signer_public_key)?)
+        {
+            bail!("Odin topology correlation trust anchor profile is invalid");
+        }
+        Ok(())
+    }
+}
+
+/// Idunn-owned public projection of one current authenticated generic provider
+/// admission. Absence and dependency failure produce no record; they are not
+/// provider states Idunn may manufacture.
+#[derive(Clone, Debug, PartialEq, Eq, DatabaseEntry)]
+#[cultcache(
+    type = "idunn.authenticated_provider_health_projection",
+    schema = "idunn.authenticated_provider_health_projection.v1"
+)]
+pub struct IdunnAuthenticatedProviderHealthProjectionRecord {
+    #[cultcache(key = 0)]
+    pub schema_version: String,
+    #[cultcache(key = 1)]
+    pub projection_id: String,
+    #[cultcache(key = 2)]
+    pub daemon_id: String,
+    #[cultcache(key = 3)]
+    pub health_contract: String,
+    #[cultcache(key = 4)]
+    pub provider_state: String,
+    #[cultcache(key = 5)]
+    pub reason_code: String,
+    #[cultcache(key = 6)]
+    pub provider_observed_at_unix_millis: u64,
+    #[cultcache(key = 7)]
+    pub admitted_at_unix_millis: u64,
+    #[cultcache(key = 8)]
+    pub evaluated_at_unix_millis: u64,
+    #[cultcache(key = 9)]
+    pub trust_binding_id: String,
+    #[cultcache(key = 10)]
+    pub trust_binding_sha256: String,
+    #[cultcache(key = 11)]
+    pub signed_health_sha256: String,
+    #[cultcache(key = 12)]
+    pub authenticated_admission_sha256: String,
+    #[cultcache(key = 13)]
+    pub provider_signer_identity_id: String,
+    #[cultcache(key = 14)]
+    pub provider_incarnation_id: String,
+    #[cultcache(key = 15)]
+    pub provider_sequence: u64,
+    #[cultcache(key = 16)]
+    pub release_id: Option<String>,
+    #[cultcache(key = 17)]
+    pub release_witness_sha256: Option<String>,
+    #[cultcache(key = 18)]
+    pub source_commit: Option<String>,
+    #[cultcache(key = 19)]
+    pub deployment_id: Option<String>,
+    #[cultcache(key = 20)]
+    pub idunn_runtime_id: String,
+    #[cultcache(key = 21)]
+    pub idunn_signer_identity_id: String,
+    #[cultcache(key = 22)]
+    pub projection_incarnation_id: String,
+    #[cultcache(key = 23)]
+    pub projection_sequence: u64,
+    #[cultcache(key = 24)]
+    pub signature_algorithm: String,
+    #[cultcache(key = 25)]
+    pub signature: Vec<u8>,
+    #[cultcache(key = 26)]
+    pub private_state_exposed: bool,
+    #[cultcache(key = 27)]
+    pub expires_at_unix_millis: u64,
+}
+
+/// Closed derivation for an authenticated provider state. `None` means no
+/// provider-health projection may be published.
+pub fn authenticated_provider_health_reason_code(state: &str) -> Option<&'static str> {
+    match state {
+        "active" => Some(IDUNN_PROVIDER_ACTIVE_REASON),
+        "warming" => Some(IDUNN_PROVIDER_WARMING_REASON),
+        "degraded" => Some(IDUNN_PROVIDER_DEGRADED_REASON),
+        "failed" => Some(IDUNN_PROVIDER_FAILED_REASON),
+        _ => None,
+    }
+}
+
+impl IdunnAuthenticatedProviderHealthProjectionRecord {
+    pub fn validate(&self) -> Result<()> {
+        if self.schema_version != IDUNN_AUTHENTICATED_PROVIDER_HEALTH_PROJECTION_SCHEMA {
+            bail!("authenticated provider health projection schema is unsupported");
+        }
+        validate_identifier(&self.projection_id, "projection id")?;
+        validate_identifier(&self.daemon_id, "daemon id")?;
+        validate_identifier(&self.health_contract, "health contract")?;
+        validate_identifier(&self.trust_binding_id, "trust binding id")?;
+        validate_identifier(
+            &self.provider_signer_identity_id,
+            "provider signer identity id",
+        )?;
+        validate_identifier(&self.provider_incarnation_id, "provider incarnation id")?;
+        validate_identifier(&self.idunn_runtime_id, "Idunn runtime id")?;
+        validate_identifier(&self.idunn_signer_identity_id, "Idunn signer identity id")?;
+        validate_identifier(&self.projection_incarnation_id, "projection incarnation id")?;
+        let reason_is_valid = authenticated_provider_health_reason_code(&self.provider_state)
+            .is_some_and(|reason| reason == self.reason_code);
+        if !reason_is_valid
+            || self.provider_observed_at_unix_millis == 0
+            || self.admitted_at_unix_millis < self.provider_observed_at_unix_millis
+            || self.evaluated_at_unix_millis < self.admitted_at_unix_millis
+            || self.expires_at_unix_millis <= self.evaluated_at_unix_millis
+            || self.provider_sequence == 0
+            || self.projection_sequence == 0
+            || !is_sha256(&self.trust_binding_sha256)
+            || !is_sha256(&self.signed_health_sha256)
+            || !is_sha256(&self.authenticated_admission_sha256)
+            || self.signature_algorithm != "ed25519"
+            || self.signature.len() != 64
+            || self.private_state_exposed
+        {
+            bail!(
+                "authenticated provider health projection shape, lineage, reason, signature, or privacy is invalid"
+            );
+        }
+        validate_optional_release_binding(
+            &self.release_id,
+            &self.release_witness_sha256,
+            &self.source_commit,
+        )?;
+        validate_optional_identifier(&self.deployment_id, "deployment id")?;
+        if self.deployment_id.is_some() != self.release_id.is_some() {
+            bail!("authenticated provider health projection release lineage is partial");
+        }
+        Ok(())
+    }
+}
+
+fn validate_identifier(value: &str, label: &str) -> Result<()> {
+    if value.trim().is_empty() || value.len() > 256 || value.chars().any(char::is_control) {
+        bail!("{label} is empty, oversized, or contains control characters");
+    }
+    Ok(())
+}
+
+fn validate_optional_identifier(value: &Option<String>, label: &str) -> Result<()> {
+    if let Some(value) = value {
+        validate_identifier(value, label)?;
+    }
+    Ok(())
+}
+
+fn validate_optional_sha256(value: &Option<String>, label: &str) -> Result<()> {
+    if value.as_deref().is_some_and(|value| !is_sha256(value)) {
+        bail!("{label} is malformed");
+    }
+    Ok(())
+}
+
+fn validate_optional_release_binding(
+    release_id: &Option<String>,
+    witness: &Option<String>,
+    source_commit: &Option<String>,
+) -> Result<()> {
+    if release_id.is_some() || witness.is_some() || source_commit.is_some() {
+        validate_optional_identifier(release_id, "release id")?;
+        let witness = witness
+            .as_deref()
+            .ok_or_else(|| anyhow!("release witness is absent"))?;
+        let commit = source_commit
+            .as_deref()
+            .ok_or_else(|| anyhow!("source commit is absent"))?;
+        if release_id.is_none() || !is_sha256(witness) || !is_lower_hex(commit, 40) {
+            bail!("release binding is incomplete or malformed");
+        }
+    }
+    Ok(())
+}
+
+fn is_sha256(value: &str) -> bool {
+    value
+        .strip_prefix("sha256-")
+        .is_some_and(|digest| is_lower_hex(digest, 64))
+}
+
+fn is_lower_hex(value: &str, length: usize) -> bool {
+    value.len() == length
+        && value
+            .bytes()
+            .all(|byte| byte.is_ascii_hexdigit() && !byte.is_ascii_uppercase())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn signed_health() -> IdunnSignedDaemonHealthRecord {
+        IdunnSignedDaemonHealthRecord {
+            schema_version: IDUNN_SIGNED_DAEMON_HEALTH_SCHEMA.into(),
+            daemon_id: "epiphany".into(),
+            health_contract: "epiphany.cultnet-rudp-runtime-health".into(),
+            source_runtime_id: "epiphany-yggdrasil".into(),
+            state: "active".into(),
+            detail: "managed-services-current".into(),
+            signer_identity_id: "provider-signing-key".into(),
+            publisher_incarnation_id: "9c2cba2e-c2de-4750-b222-b732f97d0435".into(),
+            publisher_sequence: 1,
+            observed_at_unix_millis: 100,
+            release_id: Some("release-1".into()),
+            release_witness_sha256: Some(format!("sha256-{}", "d".repeat(64))),
+            source_commit: Some("e".repeat(40)),
+            deployment_id: Some("deployment-1".into()),
+            signature_algorithm: "ed25519".into(),
+            signature: vec![6; 64],
+            private_state_exposed: false,
+            activation_witness_sha256: Some(format!("sha256-{}", "f".repeat(64))),
+        }
+    }
+
+    fn anchor() -> GameCultServiceTrustAnchorRecord {
+        let public_key = vec![5; 32];
+        GameCultServiceTrustAnchorRecord {
+            schema_version: GAMECULT_SERVICE_TRUST_ANCHOR_SCHEMA.into(),
+            trust_anchor_id: "root/idunn/provider-health".into(),
+            service_id: "idunn".into(),
+            runtime_id: "idunn-yggdrasil".into(),
+            signer_identity_id: derive_service_identity_id::<IdunnServiceIdentity>(&public_key)
+                .unwrap(),
+            signer_public_key: public_key,
+            signature_algorithm: "ed25519".into(),
+            signing_purpose: IDUNN_AUTHENTICATED_PROVIDER_HEALTH_PROJECTION_SIGNING_PURPOSE.into(),
+            signed_schema: IDUNN_AUTHENTICATED_PROVIDER_HEALTH_PROJECTION_SCHEMA.into(),
+            binding_authority: "root".into(),
+            bound_at_unix_millis: 100,
+            expires_at_unix_millis: Some(200),
+            private_state_exposed: false,
+        }
+    }
+
+    fn projection() -> IdunnAuthenticatedProviderHealthProjectionRecord {
+        IdunnAuthenticatedProviderHealthProjectionRecord {
+            schema_version: IDUNN_AUTHENTICATED_PROVIDER_HEALTH_PROJECTION_SCHEMA.into(),
+            projection_id: "authenticated-provider-health:epiphany".into(),
+            daemon_id: "epiphany".into(),
+            health_contract: "health.v1".into(),
+            provider_state: "active".into(),
+            reason_code: IDUNN_PROVIDER_ACTIVE_REASON.into(),
+            provider_observed_at_unix_millis: 100,
+            admitted_at_unix_millis: 101,
+            evaluated_at_unix_millis: 102,
+            trust_binding_id: "root/epiphany".into(),
+            trust_binding_sha256: format!("sha256-{}", "a".repeat(64)),
+            signed_health_sha256: format!("sha256-{}", "b".repeat(64)),
+            authenticated_admission_sha256: format!("sha256-{}", "c".repeat(64)),
+            provider_signer_identity_id: "provider-signing-key".into(),
+            provider_incarnation_id: "provider/boot/1".into(),
+            provider_sequence: 1,
+            release_id: Some("release-1".into()),
+            release_witness_sha256: Some(format!("sha256-{}", "d".repeat(64))),
+            source_commit: Some("e".repeat(40)),
+            deployment_id: Some("deployment-1".into()),
+            idunn_runtime_id: "idunn-yggdrasil".into(),
+            idunn_signer_identity_id: "idunn-signing-key".into(),
+            projection_incarnation_id: "idunn/boot/1".into(),
+            projection_sequence: 1,
+            signature_algorithm: "ed25519".into(),
+            signature: vec![6; 64],
+            private_state_exposed: false,
+            expires_at_unix_millis: 200,
+        }
+    }
+
+    #[test]
+    fn contracts_accept_exact_root_and_lineage_shapes() -> Result<()> {
+        let anchor = anchor();
+        let projection = projection();
+        let health = signed_health();
+        anchor.validate()?;
+        projection.validate()?;
+        health.validate()?;
+        let encoded = rmp_serde::to_vec(&health)?;
+        assert_eq!(encoded.first().copied(), Some(0xdc));
+        assert_eq!(&encoded[1..3], &[0, 18]);
+        assert!(
+            encoded
+                .windows(4)
+                .any(|window| window == [0xc4, 0x40, 6, 6]),
+            "provider signature must use the portable MessagePack binary shape"
+        );
+        assert_eq!(
+            rmp_serde::from_slice::<IdunnSignedDaemonHealthRecord>(&encoded)?,
+            health
+        );
+        assert_eq!(
+            rmp_serde::from_slice::<GameCultServiceTrustAnchorRecord>(&rmp_serde::to_vec(
+                &anchor
+            )?)?,
+            anchor
+        );
+        assert_eq!(
+            rmp_serde::from_slice::<IdunnAuthenticatedProviderHealthProjectionRecord>(
+                &rmp_serde::to_vec(&projection)?
+            )?,
+            projection
+        );
+        assert_eq!(authenticated_provider_health_reason_code("missing"), None);
+        Ok(())
+    }
+
+    #[test]
+    fn activation_binding_is_additive_for_legacy_generic_health_records() -> Result<()> {
+        let mut health = signed_health();
+        health.activation_witness_sha256 = None;
+        let mut legacy = rmp_serde::to_vec(&health)?;
+        assert_eq!(&legacy[..3], &[0xdc, 0, 18]);
+        assert_eq!(legacy.pop(), Some(0xc0));
+        legacy[2] = 17;
+        let decoded: IdunnSignedDaemonHealthRecord = rmp_serde::from_slice(&legacy)?;
+        assert_eq!(decoded.activation_witness_sha256, None);
+        decoded.validate()?;
+        let (decoded, unsigned) =
+            IdunnSignedDaemonHealthRecord::decode_canonical_signed_payload(&legacy)?;
+        assert_eq!(decoded.activation_witness_sha256, None);
+        assert_eq!(&unsigned[..3], &[0xdc, 0, 17]);
+        Ok(())
+    }
+
+    #[test]
+    fn contracts_refuse_substitution_and_manufactured_states() {
+        let mut value = anchor();
+        value.binding_authority = "idunn".into();
+        assert!(value.validate().is_err());
+        let mut value = anchor();
+        value.signer_identity_id = "caller-selected".into();
+        assert!(value.validate().is_err());
+        let mut value = projection();
+        value.reason_code = "release_drift".into();
+        assert!(value.validate().is_err());
+        let mut value = projection();
+        value.provider_state = "missing".into();
+        assert!(value.validate().is_err());
+        let mut value = projection();
+        value.deployment_id = None;
+        assert!(value.validate().is_err());
+        let mut value = projection();
+        value.signature.clear();
+        assert!(value.validate().is_err());
+        let mut value = projection();
+        value.signed_health_sha256 = format!("sha256-{}", "A".repeat(64));
+        assert!(value.validate().is_err());
+        let mut value = signed_health();
+        value.publisher_sequence = 0;
+        assert!(value.validate().is_err());
+        let mut value = signed_health();
+        value.activation_witness_sha256 = Some(format!("sha256-{}", "F".repeat(64)));
+        assert!(value.validate().is_err());
+        let mut value = signed_health();
+        value.release_witness_sha256 = None;
+        assert!(value.validate().is_err());
+        let mut value = signed_health();
+        value.private_state_exposed = true;
+        assert!(value.validate().is_err());
+    }
+}
diff --git a/packages/cultnet-rs/src/provider_session.rs b/packages/cultnet-rs/src/provider_session.rs
new file mode 100644
index 00000000..9965b0ef
--- /dev/null
+++ b/packages/cultnet-rs/src/provider_session.rs
@@ -0,0 +1,625 @@
+use anyhow::{Result, anyhow};
+use base64::Engine;
+use base64::engine::general_purpose::STANDARD;
+use chrono::DateTime;
+use rmpv::Value;
+use serde::de::DeserializeOwned;
+use serde::{Deserialize, Serialize};
+
+use crate::{CultNetMessage, CultNetRawDocumentRecord};
+
+pub const CULTMESH_PROVIDER_SESSION_SERVICE_ID: &str = "gamecult.mesh.provider_session";
+pub const CULTMESH_PROVIDER_SESSION_PAYLOAD_ENCODING: &str = "messagepack-base64";
+
+pub const CULTMESH_PROVIDER_REGISTER_OPERATION: &str = "provider.register";
+pub const CULTMESH_PROVIDER_RENEW_OPERATION: &str = "provider.renew";
+pub const CULTMESH_PROVIDER_PUBLICATION_PUT_OPERATION: &str = "provider.publication.put";
+pub const CULTMESH_PROVIDER_PUBLICATION_DELETE_OPERATION: &str = "provider.publication.delete";
+pub const CULTMESH_PROVIDER_RECEIPT_PUT_OPERATION: &str = "provider.receipt.put";
+pub const CULTMESH_PROVIDER_WITHDRAW_OPERATION: &str = "provider.withdraw";
+
+pub const CULTMESH_PROVIDER_REGISTRATION_SCHEMA: &str = "gamecult.mesh.provider_registration.v1";
+pub const CULTMESH_PROVIDER_LEASE_SCHEMA: &str = "gamecult.mesh.provider_lease.v1";
+pub const CULTMESH_PROVIDER_LEASE_RENEWAL_SCHEMA: &str = "gamecult.mesh.provider_lease_renewal.v1";
+pub const CULTMESH_PROVIDER_PUBLICATION_PUT_SCHEMA: &str =
+    "gamecult.mesh.provider_publication_put.v1";
+pub const CULTMESH_PROVIDER_PUBLICATION_DELETE_SCHEMA: &str =
+    "gamecult.mesh.provider_publication_delete.v1";
+pub const CULTMESH_PROVIDER_COMMAND_SCHEMA: &str = "gamecult.mesh.provider_command.v1";
+pub const CULTMESH_PROVIDER_RECEIPT_PUT_SCHEMA: &str = "gamecult.mesh.provider_receipt_put.v1";
+pub const CULTMESH_PROVIDER_WITHDRAWAL_SCHEMA: &str = "gamecult.mesh.provider_withdrawal.v1";
+pub const CULTMESH_PROVIDER_MUTATION_ACCEPTANCE_SCHEMA: &str =
+    "gamecult.mesh.provider_mutation_acceptance.v1";
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum CultMeshProviderOperationStatus {
+    Ok,
+    Conflict,
+    Expired,
+    Denied,
+    Invalid,
+}
+
+impl CultMeshProviderOperationStatus {
+    pub fn as_str(self) -> &'static str {
+        match self {
+            Self::Ok => "ok",
+            Self::Conflict => "conflict",
+            Self::Expired => "expired",
+            Self::Denied => "denied",
+            Self::Invalid => "invalid",
+        }
+    }
+
+    pub fn parse(value: &str) -> Result<Self> {
+        match value {
+            "ok" => Ok(Self::Ok),
+            "conflict" => Ok(Self::Conflict),
+            "expired" => Ok(Self::Expired),
+            "denied" => Ok(Self::Denied),
+            "invalid" => Ok(Self::Invalid),
+            _ => Err(anyhow!("Unsupported provider-session status {value:?}")),
+        }
+    }
+}
+
+pub trait CultMeshProviderSessionPayload {
+    fn validate(&self) -> Result<()>;
+}
+
+/// Provider-owned evidence carried verbatim in the RUDP Connect payload.
+/// `client_session_id` distinguishes process/session generations; the optional
+/// token remains opaque authorization evidence for the receiving service.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct CultMeshProviderConnectEvidenceWire {
+    pub client_session_id: String,
+    #[serde(default)]
+    pub session_token: Option<String>,
+}
+
+impl CultMeshProviderSessionPayload for CultMeshProviderConnectEvidenceWire {
+    fn validate(&self) -> Result<()> {
+        require_text(&self.client_session_id, "clientSessionId")?;
+        require_optional_text(self.session_token.as_deref(), "sessionToken")
+    }
+}
+
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct CultMeshProviderRegistrationWire {
+    pub provider_id: String,
+    pub service_instance_id: String,
+    pub endpoint_id: String,
+    pub verse_id: String,
+    pub requested_lease_duration_ms: i32,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub authority_lease_id: Option<String>,
+}
+
+impl CultMeshProviderSessionPayload for CultMeshProviderRegistrationWire {
+    fn validate(&self) -> Result<()> {
+        require_identity(
+            &self.provider_id,
+            &self.service_instance_id,
+            &self.endpoint_id,
+            &self.verse_id,
+        )?;
+        require_positive(self.requested_lease_duration_ms, "requestedLeaseDurationMs")?;
+        require_optional_text(self.authority_lease_id.as_deref(), "authorityLeaseId")
+    }
+}
+
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct CultMeshProviderLeaseWire {
+    pub provider_id: String,
+    pub service_instance_id: String,
+    pub endpoint_id: String,
+    pub verse_id: String,
+    pub lease_id: String,
+    pub valid_from_utc: String,
+    pub expires_at_utc: String,
+}
+
+impl CultMeshProviderSessionPayload for CultMeshProviderLeaseWire {
+    fn validate(&self) -> Result<()> {
+        require_identity(
+            &self.provider_id,
+            &self.service_instance_id,
+            &self.endpoint_id,
+            &self.verse_id,
+        )?;
+        require_text(&self.lease_id, "leaseId")?;
+        let valid_from = require_timestamp(&self.valid_from_utc, "validFromUtc")?;
+        let expires_at = require_timestamp(&self.expires_at_utc, "expiresAtUtc")?;
+        if expires_at <= valid_from {
+            return Err(anyhow!("Provider lease must expire after validFromUtc"));
+        }
+        Ok(())
+    }
+}
+
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct CultMeshProviderLeaseRenewalWire {
+    pub lease_id: String,
+    pub requested_lease_duration_ms: i32,
+}
+
+impl CultMeshProviderSessionPayload for CultMeshProviderLeaseRenewalWire {
+    fn validate(&self) -> Result<()> {
+        require_text(&self.lease_id, "leaseId")?;
+        require_positive(self.requested_lease_duration_ms, "requestedLeaseDurationMs")
+    }
+}
+
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct CultMeshProviderPublicationPutWire {
+    pub lease_id: String,
+    pub publication_id: String,
+    pub document: CultNetRawDocumentRecord,
+}
+
+impl CultMeshProviderSessionPayload for CultMeshProviderPublicationPutWire {
+    fn validate(&self) -> Result<()> {
+        require_text(&self.lease_id, "leaseId")?;
+        require_text(&self.publication_id, "publicationId")?;
+        validate_raw_document(&self.document)
+    }
+}
+
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct CultMeshProviderPublicationDeleteWire {
+    pub lease_id: String,
+    pub publication_id: String,
+    pub schema_id: String,
+    pub record_key: String,
+}
+
+impl CultMeshProviderSessionPayload for CultMeshProviderPublicationDeleteWire {
+    fn validate(&self) -> Result<()> {
+        require_text(&self.lease_id, "leaseId")?;
+        require_text(&self.publication_id, "publicationId")?;
+        require_text(&self.schema_id, "schemaId")?;
+        require_text(&self.record_key, "recordKey")
+    }
+}
+
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct CultMeshProviderCommandWire {
+    pub command_id: String,
+    pub command_kind: String,
+    pub provider_id: String,
+    pub service_instance_id: String,
+    pub payload: Value,
+}
+
+impl CultMeshProviderSessionPayload for CultMeshProviderCommandWire {
+    fn validate(&self) -> Result<()> {
+        require_text(&self.command_id, "commandId")?;
+        require_text(&self.command_kind, "commandKind")?;
+        require_text(&self.provider_id, "providerId")?;
+        require_text(&self.service_instance_id, "serviceInstanceId")
+    }
+}
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "lowercase")]
+pub enum CultMeshProviderReceiptStateWire {
+    Applied,
+    Rejected,
+    Failed,
+}
+
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct CultMeshProviderCommandReceiptWire {
+    pub receipt_id: String,
+    pub command_id: String,
+    pub command_kind: String,
+    pub provider_id: String,
+    pub service_instance_id: String,
+    pub state: CultMeshProviderReceiptStateWire,
+    pub completed_at_utc: String,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub result: Option<Value>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub error: Option<String>,
+}
+
+impl CultMeshProviderSessionPayload for CultMeshProviderCommandReceiptWire {
+    fn validate(&self) -> Result<()> {
+        require_text(&self.receipt_id, "receiptId")?;
+        require_text(&self.command_id, "commandId")?;
+        require_text(&self.command_kind, "commandKind")?;
+        require_text(&self.provider_id, "providerId")?;
+        require_text(&self.service_instance_id, "serviceInstanceId")?;
+        require_timestamp(&self.completed_at_utc, "completedAtUtc")?;
+        require_optional_text(self.error.as_deref(), "error")
+    }
+}
+
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct CultMeshProviderReceiptPutWire {
+    pub lease_id: String,
+    pub receipt: CultMeshProviderCommandReceiptWire,
+}
+
+impl CultMeshProviderSessionPayload for CultMeshProviderReceiptPutWire {
+    fn validate(&self) -> Result<()> {
+        require_text(&self.lease_id, "leaseId")?;
+        self.receipt.validate()
+    }
+}
+
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct CultMeshProviderWithdrawalWire {
+    pub lease_id: String,
+}
+
+impl CultMeshProviderSessionPayload for CultMeshProviderWithdrawalWire {
+    fn validate(&self) -> Result<()> {
+        require_text(&self.lease_id, "leaseId")
+    }
+}
+
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct CultMeshProviderMutationAcceptanceWire {
+    pub accepted_at_utc: String,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub lease_id: Option<String>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub publication_id: Option<String>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub command_id: Option<String>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub receipt_id: Option<String>,
+}
+
+impl CultMeshProviderSessionPayload for CultMeshProviderMutationAcceptanceWire {
+    fn validate(&self) -> Result<()> {
+        require_timestamp(&self.accepted_at_utc, "acceptedAtUtc")?;
+        require_optional_text(self.lease_id.as_deref(), "leaseId")?;
+        require_optional_text(self.publication_id.as_deref(), "publicationId")?;
+        require_optional_text(self.command_id.as_deref(), "commandId")?;
+        require_optional_text(self.receipt_id.as_deref(), "receiptId")
+    }
+}
+
+#[derive(Clone, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub struct CultMeshProviderErrorWire {}
+
+impl CultMeshProviderSessionPayload for CultMeshProviderErrorWire {
+    fn validate(&self) -> Result<()> {
+        Ok(())
+    }
+}
+
+pub fn encode_provider_session_payload<T>(value: &T) -> Result<String>
+where
+    T: CultMeshProviderSessionPayload + Serialize,
+{
+    value.validate()?;
+    Ok(STANDARD.encode(rmp_serde::to_vec_named(value)?))
+}
+
+pub fn encode_provider_connect_evidence(
+    evidence: &CultMeshProviderConnectEvidenceWire,
+) -> Result<Vec<u8>> {
+    evidence.validate()?;
+    Ok(rmp_serde::to_vec_named(evidence)?)
+}
+
+pub fn decode_provider_connect_evidence(
+    payload: &[u8],
+) -> Result<CultMeshProviderConnectEvidenceWire> {
+    if payload.is_empty() {
+        return Err(anyhow!(
+            "Provider Connect evidence must be a non-empty MessagePack map"
+        ));
+    }
+    let evidence: CultMeshProviderConnectEvidenceWire = rmp_serde::from_slice(payload)?;
+    evidence.validate()?;
+    Ok(evidence)
+}
+
+pub fn decode_provider_session_payload<T>(payload: &str) -> Result<T>
+where
+    T: CultMeshProviderSessionPayload + DeserializeOwned,
+{
+    require_text(payload, "payload")?;
+    let bytes = STANDARD
+        .decode(payload)
+        .map_err(|error| anyhow!("Provider-session payload must be MessagePack base64: {error}"))?;
+    let value: T = rmp_serde::from_slice(&bytes)?;
+    value.validate()?;
+    Ok(value)
+}
+
+pub fn decode_provider_command_document(
+    document: &CultNetRawDocumentRecord,
+) -> Result<CultMeshProviderCommandWire> {
+    if document.schema_id != CULTMESH_PROVIDER_COMMAND_SCHEMA {
+        return Err(anyhow!(
+            "Expected provider command schema {:?}, received {:?}",
+            CULTMESH_PROVIDER_COMMAND_SCHEMA,
+            document.schema_id
+        ));
+    }
+    let command: CultMeshProviderCommandWire = rmp_serde::from_slice(&document.payload)?;
+    command.validate()?;
+    Ok(command)
+}
+
+pub fn create_provider_session_request<T>(
+    message_id: impl Into<String>,
+    operation: impl Into<String>,
+    payload_schema: impl Into<String>,
+    payload: &T,
+    source_runtime_id: Option<String>,
+    target_runtime_id: Option<String>,
+) -> Result<CultNetMessage>
+where
+    T: CultMeshProviderSessionPayload + Serialize,
+{
+    let message_id = message_id.into();
+    let operation = operation.into();
+    let payload_schema = payload_schema.into();
+    require_text(&message_id, "messageId")?;
+    validate_operation_schema(&operation, &payload_schema)?;
+    Ok(CultNetMessage::OperationRequest {
+        message_id,
+        service_id: CULTMESH_PROVIDER_SESSION_SERVICE_ID.to_string(),
+        operation,
+        payload_schema,
+        payload_encoding: CULTMESH_PROVIDER_SESSION_PAYLOAD_ENCODING.to_string(),
+        payload: encode_provider_session_payload(payload)?,
+        source_runtime_id,
+        target_runtime_id,
+    })
+}
+
+pub fn decode_provider_session_request<T>(
+    request: &CultNetMessage,
+    expected_operation: &str,
+    expected_payload_schema: &str,
+) -> Result<T>
+where
+    T: CultMeshProviderSessionPayload + DeserializeOwned,
+{
+    let CultNetMessage::OperationRequest {
+        service_id,
+        operation,
+        payload_schema,
+        payload_encoding,
+        payload,
+        ..
+    } = request
+    else {
+        return Err(anyhow!("Expected a CultNet operation request"));
+    };
+    require_envelope(
+        service_id,
+        operation,
+        payload_schema,
+        payload_encoding,
+        expected_operation,
+        expected_payload_schema,
+    )?;
+    decode_provider_session_payload(payload)
+}
+
+pub fn create_provider_session_response<T>(
+    request: &CultNetMessage,
+    status: CultMeshProviderOperationStatus,
+    payload_schema: impl Into<String>,
+    payload: &T,
+    source_runtime_id: Option<String>,
+) -> Result<CultNetMessage>
+where
+    T: CultMeshProviderSessionPayload + Serialize,
+{
+    let CultNetMessage::OperationRequest {
+        message_id,
+        operation,
+        ..
+    } = request
+    else {
+        return Err(anyhow!("Expected a CultNet operation request"));
+    };
+    require_text(message_id, "messageId")?;
+    require_text(operation, "operation")?;
+    let payload_schema = payload_schema.into();
+    require_text(&payload_schema, "payloadSchema")?;
+    Ok(CultNetMessage::OperationResponse {
+        message_id: message_id.clone(),
+        service_id: CULTMESH_PROVIDER_SESSION_SERVICE_ID.to_string(),
+        operation: operation.clone(),
+        status: status.as_str().to_string(),
+        payload_schema,
+        payload_encoding: CULTMESH_PROVIDER_SESSION_PAYLOAD_ENCODING.to_string(),
+        payload: encode_provider_session_payload(payload)?,
+        diagnostics: Vec::new(),
+        source_runtime_id,
+    })
+}
+
+pub fn create_provider_session_error_response(
+    request: &CultNetMessage,
+    status: CultMeshProviderOperationStatus,
+    diagnostics: Vec<String>,
+    source_runtime_id: Option<String>,
+) -> Result<CultNetMessage> {
+    if status == CultMeshProviderOperationStatus::Ok {
+        return Err(anyhow!(
+            "Provider-session error responses require a non-ok status"
+        ));
+    }
+    if diagnostics.is_empty() {
+        return Err(anyhow!(
+            "Provider-session error responses require diagnostics"
+        ));
+    }
+    for diagnostic in &diagnostics {
+        require_text(diagnostic, "diagnostics[]")?;
+    }
+    let mut response = create_provider_session_response(
+        request,
+        status,
+        CULTMESH_PROVIDER_MUTATION_ACCEPTANCE_SCHEMA,
+        &CultMeshProviderErrorWire {},
+        source_runtime_id,
+    )?;
+    let CultNetMessage::OperationResponse {
+        diagnostics: response_diagnostics,
+        ..
+    } = &mut response
+    else {
+        unreachable!("provider-session response helper returned a request")
+    };
+    *response_diagnostics = diagnostics;
+    Ok(response)
+}
+
+pub fn decode_provider_session_response<T>(
+    response: &CultNetMessage,
+    expected_operation: &str,
+    expected_payload_schema: &str,
+) -> Result<(CultMeshProviderOperationStatus, T)>
+where
+    T: CultMeshProviderSessionPayload + DeserializeOwned,
+{
+    let CultNetMessage::OperationResponse {
+        service_id,
+        operation,
+        status,
+        payload_schema,
+        payload_encoding,
+        payload,
+        ..
+    } = response
+    else {
+        return Err(anyhow!("Expected a CultNet operation response"));
+    };
+    require_envelope(
+        service_id,
+        operation,
+        payload_schema,
+        payload_encoding,
+        expected_operation,
+        expected_payload_schema,
+    )?;
+    Ok((
+        CultMeshProviderOperationStatus::parse(status)?,
+        decode_provider_session_payload(payload)?,
+    ))
+}
+
+fn validate_operation_schema(operation: &str, payload_schema: &str) -> Result<()> {
+    let expected = match operation {
+        CULTMESH_PROVIDER_REGISTER_OPERATION => CULTMESH_PROVIDER_REGISTRATION_SCHEMA,
+        CULTMESH_PROVIDER_RENEW_OPERATION => CULTMESH_PROVIDER_LEASE_RENEWAL_SCHEMA,
+        CULTMESH_PROVIDER_PUBLICATION_PUT_OPERATION => CULTMESH_PROVIDER_PUBLICATION_PUT_SCHEMA,
+        CULTMESH_PROVIDER_PUBLICATION_DELETE_OPERATION => {
+            CULTMESH_PROVIDER_PUBLICATION_DELETE_SCHEMA
+        }
+        CULTMESH_PROVIDER_RECEIPT_PUT_OPERATION => CULTMESH_PROVIDER_RECEIPT_PUT_SCHEMA,
+        CULTMESH_PROVIDER_WITHDRAW_OPERATION => CULTMESH_PROVIDER_WITHDRAWAL_SCHEMA,
+        _ => {
+            return Err(anyhow!(
+                "Unsupported provider-session operation {operation:?}"
+            ));
+        }
+    };
+    if payload_schema != expected {
+        return Err(anyhow!(
+            "Provider-session operation {operation:?} requires payload schema {expected:?}"
+        ));
+    }
+    Ok(())
+}
+
+fn require_envelope(
+    service_id: &str,
+    operation: &str,
+    payload_schema: &str,
+    payload_encoding: &str,
+    expected_operation: &str,
+    expected_payload_schema: &str,
+) -> Result<()> {
+    if service_id != CULTMESH_PROVIDER_SESSION_SERVICE_ID {
+        return Err(anyhow!(
+            "Unexpected provider-session service id {service_id:?}"
+        ));
+    }
+    if operation != expected_operation {
+        return Err(anyhow!(
+            "Unexpected provider-session operation {operation:?}"
+        ));
+    }
+    if payload_schema != expected_payload_schema {
+        return Err(anyhow!(
+            "Unexpected provider-session payload schema {payload_schema:?}"
+        ));
+    }
+    if payload_encoding != CULTMESH_PROVIDER_SESSION_PAYLOAD_ENCODING {
+        return Err(anyhow!(
+            "Unexpected provider-session payload encoding {payload_encoding:?}"
+        ));
+    }
+    Ok(())
+}
+
+fn validate_raw_document(document: &CultNetRawDocumentRecord) -> Result<()> {
+    require_text(&document.schema_id, "document.schemaId")?;
+    require_text(&document.record_key, "document.recordKey")?;
+    Ok(())
+}
+
+fn require_identity(
+    provider_id: &str,
+    service_instance_id: &str,
+    endpoint_id: &str,
+    verse_id: &str,
+) -> Result<()> {
+    require_text(provider_id, "providerId")?;
+    require_text(service_instance_id, "serviceInstanceId")?;
+    require_text(endpoint_id, "endpointId")?;
+    require_text(verse_id, "verseId")
+}
+
+fn require_text(value: &str, field: &str) -> Result<()> {
+    if value.trim().is_empty() {
+        return Err(anyhow!("Provider-session {field} must not be empty"));
+    }
+    Ok(())
+}
+
+fn require_optional_text(value: Option<&str>, field: &str) -> Result<()> {
+    if let Some(value) = value {
+        require_text(value, field)?;
+    }
+    Ok(())
+}
+
+fn require_positive(value: i32, field: &str) -> Result<()> {
+    if value <= 0 {
+        return Err(anyhow!(
+            "Provider-session {field} must be greater than zero"
+        ));
+    }
+    Ok(())
+}
+
+fn require_timestamp(value: &str, field: &str) -> Result<DateTime<chrono::FixedOffset>> {
+    require_text(value, field)?;
+    DateTime::parse_from_rfc3339(value)
+        .map_err(|error| anyhow!("Provider-session {field} must be RFC3339: {error}"))
+}
diff --git a/packages/cultnet-rs/src/replication.rs b/packages/cultnet-rs/src/replication.rs
index 492cf317..7073f1a9 100644
--- a/packages/cultnet-rs/src/replication.rs
+++ b/packages/cultnet-rs/src/replication.rs
@@ -9,6 +9,13 @@ use serde::de::DeserializeOwned;
 use serde_json::Value;
 use std::collections::BTreeMap;
 use std::collections::BTreeSet;
+use std::sync::Arc;
+use std::sync::Mutex;
+use std::sync::atomic::AtomicBool;
+use std::sync::atomic::Ordering;
+use std::thread;
+use std::thread::JoinHandle;
+use std::time::Duration;
 
 use crate::CultNetDocumentMutationContract;
 use crate::CultNetDocumentRecord;
@@ -67,6 +74,56 @@ pub struct CultNetDocumentRegistry {
     bindings_by_schema_id: BTreeMap<String, CultNetDocumentBinding>,
 }
 
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct CultNetReactiveDocumentOptions {
+    pub flush_delay: Duration,
+    pub detect_local_changes: bool,
+    pub replace_dirty_current_on_canonical_snapshot: bool,
+}
+
+impl Default for CultNetReactiveDocumentOptions {
+    fn default() -> Self {
+        Self {
+            flush_delay: Duration::from_millis(16),
+            detect_local_changes: true,
+            replace_dirty_current_on_canonical_snapshot: false,
+        }
+    }
+}
+
+#[derive(Clone, Debug, PartialEq)]
+pub struct CultNetReactiveDocumentReconciliation<T> {
+    pub canonical: T,
+    pub predicted: T,
+    pub delta: BTreeMap<String, Value>,
+    pub version: u64,
+    pub received_at: String,
+}
+
+struct CultNetReactiveDocumentState<T> {
+    dirty: bool,
+    flushing: bool,
+    flush_queued: bool,
+    last_clean_payload: Vec<u8>,
+    reconciliation: Option<CultNetReactiveDocumentReconciliation<T>>,
+    reconciliation_version: u64,
+    last_error: Option<String>,
+}
+
+pub struct CultNetReactiveDocument<T>
+where
+    T: DatabaseEntry + Serialize + DeserializeOwned,
+{
+    registry: CultNetDocumentRegistry,
+    cache: Arc<Mutex<CultCache>>,
+    record_key: String,
+    current: Arc<Mutex<T>>,
+    state: Arc<Mutex<CultNetReactiveDocumentState<T>>>,
+    options: CultNetReactiveDocumentOptions,
+    disposed: Arc<AtomicBool>,
+    detect_worker: Option<JoinHandle<()>>,
+}
+
 impl CultNetDocumentRegistry {
     pub fn new() -> Self {
         Self::default()
@@ -352,6 +409,40 @@ impl CultNetDocumentRegistry {
         Ok(applied)
     }
 
+    pub fn sync_document_from_snapshot_response<T>(
+        &self,
+        cache: &mut CultCache,
+        response: &CultNetMessage,
+        record_key: &str,
+    ) -> Result<T>
+    where
+        T: DatabaseEntry + Serialize + DeserializeOwned,
+    {
+        let CultNetMessage::SnapshotResponse { documents, .. } = response else {
+            return Err(anyhow!("expected cultnet.snapshot_response.v0"));
+        };
+        let binding = self.require_binding(T::TYPE)?;
+        let document = documents
+            .iter()
+            .find(|document| {
+                document.schema_id == binding.schema_id && document.record_key == record_key
+            })
+            .ok_or_else(|| {
+                anyhow!(
+                    "No CultNet snapshot document for schema {:?} and record key {:?}",
+                    binding.schema_id,
+                    record_key
+                )
+            })?;
+        self.apply_document_put_message::<T>(
+            cache,
+            &CultNetMessage::DocumentPut {
+                message_id: "snapshot-sync".to_string(),
+                document: document.clone(),
+            },
+        )
+    }
+
     pub fn apply_raw_snapshot_response<T>(
         &self,
         cache: &mut CultCache,
@@ -380,6 +471,52 @@ impl CultNetDocumentRegistry {
         Ok(applied)
     }
 
+    pub fn sync_raw_document_from_snapshot_response<T>(
+        &self,
+        cache: &mut CultCache,
+        response: &CultNetMessage,
+        record_key: &str,
+    ) -> Result<T>
+    where
+        T: DatabaseEntry + Serialize + DeserializeOwned,
+    {
+        let CultNetMessage::SnapshotResponseRaw { documents, .. } = response else {
+            return Err(anyhow!("expected cultnet.snapshot_response_raw.v0"));
+        };
+        let binding = self.require_binding(T::TYPE)?;
+        let document = documents
+            .iter()
+            .find(|document| {
+                document.schema_id == binding.schema_id && document.record_key == record_key
+            })
+            .ok_or_else(|| {
+                anyhow!(
+                    "No raw CultNet snapshot document for schema {:?} and record key {:?}",
+                    binding.schema_id,
+                    record_key
+                )
+            })?;
+        self.apply_raw_document_put_message::<T>(
+            cache,
+            &CultNetMessage::DocumentPutRaw {
+                message_id: "snapshot-sync-raw".to_string(),
+                document: document.clone(),
+            },
+        )
+    }
+
+    pub fn reactive_document<T>(
+        &self,
+        cache: Arc<Mutex<CultCache>>,
+        record_key: impl Into<String>,
+        options: CultNetReactiveDocumentOptions,
+    ) -> Result<CultNetReactiveDocument<T>>
+    where
+        T: DatabaseEntry + Serialize + DeserializeOwned,
+    {
+        CultNetReactiveDocument::new(self.clone(), cache, record_key, options)
+    }
+
     fn document_record_from_envelope(
         &self,
         envelope: &CultCacheEnvelope,
@@ -403,7 +540,7 @@ impl CultNetDocumentRegistry {
         })
     }
 
-    fn raw_document_record_from_envelope(
+    pub fn raw_document_record_from_envelope(
         &self,
         envelope: &CultCacheEnvelope,
     ) -> Result<CultNetRawDocumentRecord> {
@@ -428,6 +565,443 @@ impl CultNetDocumentRegistry {
     }
 }
 
+impl<T> CultNetReactiveDocument<T>
+where
+    T: DatabaseEntry + Serialize + DeserializeOwned,
+{
+    pub fn new(
+        registry: CultNetDocumentRegistry,
+        cache: Arc<Mutex<CultCache>>,
+        record_key: impl Into<String>,
+        options: CultNetReactiveDocumentOptions,
+    ) -> Result<Self> {
+        let record_key = record_key.into();
+        if record_key.trim().is_empty() {
+            return Err(anyhow!("record_key must be non-empty"));
+        }
+        registry.require_binding(T::TYPE)?;
+        let current = {
+            let cache = cache
+                .lock()
+                .map_err(|_| anyhow!("CultCache mutex poisoned"))?;
+            cache.get_required::<T>(&record_key)?
+        };
+        let last_clean_payload = serialize_typed(&current)?;
+        let current = Arc::new(Mutex::new(current));
+        let state = Arc::new(Mutex::new(CultNetReactiveDocumentState {
+            dirty: false,
+            flushing: false,
+            flush_queued: false,
+            last_clean_payload,
+            reconciliation: None,
+            reconciliation_version: 0,
+            last_error: None,
+        }));
+        let disposed = Arc::new(AtomicBool::new(false));
+        let detect_worker = if options.detect_local_changes {
+            Some(start_reactive_detection_worker::<T>(
+                Arc::clone(&cache),
+                Arc::clone(&current),
+                Arc::clone(&state),
+                Arc::clone(&disposed),
+                options.flush_delay,
+                record_key.clone(),
+            ))
+        } else {
+            None
+        };
+        Ok(Self {
+            registry,
+            cache,
+            record_key,
+            current,
+            state,
+            options,
+            disposed,
+            detect_worker,
+        })
+    }
+
+    pub fn current(&self) -> Arc<Mutex<T>> {
+        Arc::clone(&self.current)
+    }
+
+    pub fn record_key(&self) -> &str {
+        &self.record_key
+    }
+
+    pub fn is_dirty(&self) -> bool {
+        self.state.lock().map(|state| state.dirty).unwrap_or(false)
+    }
+
+    pub fn reconciliation(&self) -> Option<CultNetReactiveDocumentReconciliation<T>> {
+        self.state
+            .lock()
+            .ok()
+            .and_then(|state| state.reconciliation.clone())
+    }
+
+    pub fn last_error(&self) -> Option<String> {
+        self.state
+            .lock()
+            .ok()
+            .and_then(|state| state.last_error.clone())
+    }
+
+    pub fn update(&self, update: impl FnOnce(&mut T)) -> Result<T> {
+        let predicted = {
+            let mut current = self
+                .current
+                .lock()
+                .map_err(|_| anyhow!("reactive document mutex poisoned"))?;
+            update(&mut current);
+            current.clone()
+        };
+        {
+            let mut state = self
+                .state
+                .lock()
+                .map_err(|_| anyhow!("reactive document state mutex poisoned"))?;
+            state.dirty = true;
+        }
+        if self.options.flush_delay.is_zero() {
+            self.flush()?;
+        }
+        Ok(predicted)
+    }
+
+    pub fn set_current(&self, value: T) -> Result<T> {
+        {
+            let mut current = self
+                .current
+                .lock()
+                .map_err(|_| anyhow!("reactive document mutex poisoned"))?;
+            *current = value.clone();
+        }
+        {
+            let mut state = self
+                .state
+                .lock()
+                .map_err(|_| anyhow!("reactive document state mutex poisoned"))?;
+            state.dirty = true;
+        }
+        if self.options.flush_delay.is_zero() {
+            self.flush()?;
+        }
+        Ok(value)
+    }
+
+    pub fn mark_dirty(&self) -> Result<()> {
+        let mut state = self
+            .state
+            .lock()
+            .map_err(|_| anyhow!("reactive document state mutex poisoned"))?;
+        state.dirty = true;
+        Ok(())
+    }
+
+    pub fn refresh(&self) -> Result<T> {
+        let canonical = {
+            let cache = self
+                .cache
+                .lock()
+                .map_err(|_| anyhow!("CultCache mutex poisoned"))?;
+            cache.get_required::<T>(&self.record_key)?
+        };
+        {
+            let mut current = self
+                .current
+                .lock()
+                .map_err(|_| anyhow!("reactive document mutex poisoned"))?;
+            *current = canonical.clone();
+        }
+        {
+            let mut state = self
+                .state
+                .lock()
+                .map_err(|_| anyhow!("reactive document state mutex poisoned"))?;
+            state.last_clean_payload = serialize_typed(&canonical)?;
+            state.dirty = false;
+            state.flush_queued = false;
+            state.reconciliation = None;
+        }
+        Ok(canonical)
+    }
+
+    pub fn flush(&self) -> Result<()> {
+        flush_reactive_document::<T>(&self.cache, &self.current, &self.state, &self.record_key)
+    }
+
+    pub fn apply_document_put_message(&self, message: &CultNetMessage) -> Result<T> {
+        let canonical = {
+            let mut cache = self
+                .cache
+                .lock()
+                .map_err(|_| anyhow!("CultCache mutex poisoned"))?;
+            self.registry
+                .apply_document_put_message::<T>(&mut cache, message)?
+        };
+        self.apply_canonical_value(canonical)
+    }
+
+    pub fn apply_raw_document_put_message(&self, message: &CultNetMessage) -> Result<T> {
+        let canonical = {
+            let mut cache = self
+                .cache
+                .lock()
+                .map_err(|_| anyhow!("CultCache mutex poisoned"))?;
+            self.registry
+                .apply_raw_document_put_message::<T>(&mut cache, message)?
+        };
+        self.apply_canonical_value(canonical)
+    }
+
+    pub fn clear_reconciliation(&self) -> Result<()> {
+        let mut state = self
+            .state
+            .lock()
+            .map_err(|_| anyhow!("reactive document state mutex poisoned"))?;
+        state.reconciliation = None;
+        Ok(())
+    }
+
+    fn apply_canonical_value(&self, canonical: T) -> Result<T> {
+        let predicted = self
+            .current
+            .lock()
+            .map_err(|_| anyhow!("reactive document mutex poisoned"))?
+            .clone();
+        let mut state = self
+            .state
+            .lock()
+            .map_err(|_| anyhow!("reactive document state mutex poisoned"))?;
+        if state.dirty || state.flushing {
+            let delta = create_reconciliation_delta(&predicted, &canonical)?;
+            if delta.is_empty() {
+                state.reconciliation = None;
+            } else {
+                state.reconciliation_version += 1;
+                state.reconciliation = Some(CultNetReactiveDocumentReconciliation {
+                    canonical: canonical.clone(),
+                    predicted,
+                    delta,
+                    version: state.reconciliation_version,
+                    received_at: now_utc_second(),
+                });
+            }
+            if !self.options.replace_dirty_current_on_canonical_snapshot {
+                return Ok(canonical);
+            }
+        }
+        drop(state);
+        {
+            let mut current = self
+                .current
+                .lock()
+                .map_err(|_| anyhow!("reactive document mutex poisoned"))?;
+            *current = canonical.clone();
+        }
+        let mut state = self
+            .state
+            .lock()
+            .map_err(|_| anyhow!("reactive document state mutex poisoned"))?;
+        state.last_clean_payload = serialize_typed(&canonical)?;
+        state.reconciliation = None;
+        Ok(canonical)
+    }
+}
+
+impl<T> Drop for CultNetReactiveDocument<T>
+where
+    T: DatabaseEntry + Serialize + DeserializeOwned,
+{
+    fn drop(&mut self) {
+        self.disposed.store(true, Ordering::SeqCst);
+        let _ = self.detect_worker.take();
+    }
+}
+
+fn start_reactive_detection_worker<T>(
+    cache: Arc<Mutex<CultCache>>,
+    current: Arc<Mutex<T>>,
+    state: Arc<Mutex<CultNetReactiveDocumentState<T>>>,
+    disposed: Arc<AtomicBool>,
+    flush_delay: Duration,
+    record_key: String,
+) -> JoinHandle<()>
+where
+    T: DatabaseEntry + Serialize + DeserializeOwned,
+{
+    thread::spawn(move || {
+        let delay = if flush_delay.is_zero() {
+            Duration::from_millis(1)
+        } else {
+            flush_delay
+        };
+        while !disposed.load(Ordering::SeqCst) {
+            thread::sleep(delay);
+            match detect_reactive_document_change::<T>(&current, &state).and_then(|dirty| {
+                if dirty {
+                    flush_reactive_document::<T>(&cache, &current, &state, &record_key)?;
+                }
+                Ok(())
+            }) {
+                Ok(()) => {}
+                Err(error) => {
+                    if let Ok(mut state) = state.lock() {
+                        state.last_error = Some(error.to_string());
+                    }
+                }
+            }
+        }
+    })
+}
+
+fn detect_reactive_document_change<T>(
+    current: &Arc<Mutex<T>>,
+    state: &Arc<Mutex<CultNetReactiveDocumentState<T>>>,
+) -> Result<bool>
+where
+    T: DatabaseEntry + Serialize + DeserializeOwned,
+{
+    let payload = {
+        let current = current
+            .lock()
+            .map_err(|_| anyhow!("reactive document mutex poisoned"))?;
+        serialize_typed(&*current)?
+    };
+    let mut state = state
+        .lock()
+        .map_err(|_| anyhow!("reactive document state mutex poisoned"))?;
+    if !state.dirty && !state.flushing && payload != state.last_clean_payload {
+        state.dirty = true;
+    }
+    Ok(state.dirty && !state.flushing)
+}
+
+fn flush_reactive_document<T>(
+    cache: &Arc<Mutex<CultCache>>,
+    current: &Arc<Mutex<T>>,
+    state: &Arc<Mutex<CultNetReactiveDocumentState<T>>>,
+    record_key: &str,
+) -> Result<()>
+where
+    T: DatabaseEntry + Serialize + DeserializeOwned,
+{
+    let predicted = {
+        let mut state_guard = state
+            .lock()
+            .map_err(|_| anyhow!("reactive document state mutex poisoned"))?;
+        if !state_guard.dirty {
+            drop(state_guard);
+            if !detect_reactive_document_change::<T>(current, state)? {
+                return Ok(());
+            }
+            state_guard = state
+                .lock()
+                .map_err(|_| anyhow!("reactive document state mutex poisoned"))?;
+        }
+        if state_guard.flushing {
+            state_guard.flush_queued = true;
+            return Ok(());
+        }
+        state_guard.flushing = true;
+        state_guard.dirty = false;
+        current
+            .lock()
+            .map_err(|_| anyhow!("reactive document mutex poisoned"))?
+            .clone()
+    };
+    let payload = serialize_typed(&predicted)?;
+    {
+        let mut cache = cache
+            .lock()
+            .map_err(|_| anyhow!("CultCache mutex poisoned"))?;
+        cache.put::<T>(record_key.to_string(), &predicted)?;
+    }
+    let should_flush_again = {
+        let mut state = state
+            .lock()
+            .map_err(|_| anyhow!("reactive document state mutex poisoned"))?;
+        state.flushing = false;
+        state.last_clean_payload = payload;
+        state.last_error = None;
+        state.reconciliation = None;
+        let changed_after_flush = {
+            let current = current
+                .lock()
+                .map_err(|_| anyhow!("reactive document mutex poisoned"))?;
+            serialize_typed(&*current)? != state.last_clean_payload
+        };
+        if changed_after_flush {
+            state.dirty = true;
+        }
+        let should_flush_again = state.flush_queued || state.dirty;
+        state.flush_queued = false;
+        should_flush_again
+    };
+    if should_flush_again {
+        flush_reactive_document::<T>(cache, current, state, record_key)?;
+    }
+    Ok(())
+}
+
+fn serialize_typed<T>(value: &T) -> Result<Vec<u8>>
+where
+    T: Serialize,
+{
+    Ok(rmp_serde::to_vec(value)?)
+}
+
+fn create_reconciliation_delta<T>(predicted: &T, canonical: &T) -> Result<BTreeMap<String, Value>>
+where
+    T: Serialize,
+{
+    let predicted = serde_json::to_value(predicted)?;
+    let canonical = serde_json::to_value(canonical)?;
+    let mut delta = BTreeMap::new();
+    match (predicted, canonical) {
+        (Value::Object(predicted), Value::Object(canonical)) => {
+            for (key, predicted_value) in predicted {
+                let canonical_value = canonical.get(&key).cloned().unwrap_or(Value::Null);
+                if predicted_value == canonical_value {
+                    continue;
+                }
+                delta.insert(
+                    key,
+                    numeric_delta(&predicted_value, &canonical_value).unwrap_or(predicted_value),
+                );
+            }
+        }
+        (Value::Array(predicted), Value::Array(canonical)) => {
+            for (index, predicted_value) in predicted.into_iter().enumerate() {
+                let canonical_value = canonical.get(index).cloned().unwrap_or(Value::Null);
+                if predicted_value == canonical_value {
+                    continue;
+                }
+                delta.insert(
+                    index.to_string(),
+                    numeric_delta(&predicted_value, &canonical_value).unwrap_or(predicted_value),
+                );
+            }
+        }
+        (predicted, canonical) if predicted != canonical => {
+            delta.insert(
+                "value".to_string(),
+                numeric_delta(&predicted, &canonical).unwrap_or(predicted),
+            );
+        }
+        _ => {}
+    }
+    Ok(delta)
+}
+
+fn numeric_delta(predicted: &Value, canonical: &Value) -> Option<Value> {
+    let predicted = predicted.as_f64()?;
+    let canonical = canonical.as_f64()?;
+    serde_json::Number::from_f64(predicted - canonical).map(Value::Number)
+}
+
 fn round_trip_typed<T>(value: &T) -> Result<T>
 where
     T: Serialize + DeserializeOwned,
diff --git a/packages/cultnet-rs/src/rudp.rs b/packages/cultnet-rs/src/rudp.rs
index 8566c38c..174739be 100644
--- a/packages/cultnet-rs/src/rudp.rs
+++ b/packages/cultnet-rs/src/rudp.rs
@@ -6,8 +6,9 @@ use std::collections::VecDeque;
 use std::io::ErrorKind;
 use std::net::SocketAddr;
 use std::net::UdpSocket;
-use std::time::SystemTime;
-use std::time::UNIX_EPOCH;
+use std::thread;
+use std::time::{Duration, Instant, SystemTime, UNIX_EPOCH};
+use uuid::Uuid;
 
 use crate::CultNetMessage;
 use crate::CultNetReconnectController;
@@ -29,6 +30,22 @@ use crate::encode_cultnet_message_to_vec;
 const RUDP_MAGIC: [u8; 4] = [0x43, 0x4e, 0x52, 0x30];
 const RUDP_VERSION: u8 = 0;
 const RUDP_FIXED_HEADER_BYTES: usize = 36;
+pub const CULTNET_RUDP_DEFAULT_MAX_PAYLOAD_BYTES: usize = 16 * 1024 * 1024;
+pub const CULTNET_RUDP_RELIABLE_SEND_WINDOW_PACKETS: usize = 32;
+const RUDP_RECEIVED_SEQUENCE_WINDOW: usize = 4_096;
+/// Live media tolerates loss but not lateness: a frame retransmitted after this
+/// long describes a moment that has already passed. State channels never
+/// expire, so this default applies only to the media channel.
+const DEFAULT_MEDIA_RELIABLE_EXPIRE_AFTER_MS: u64 = 75;
+/// A peer chooses its own channel ids and its own send order, so the per-channel
+/// maps and the out-of-order hold buffer are both attacker-sized unless capped.
+const RUDP_MAX_TRACKED_CHANNELS: usize = 64;
+/// A peer cannot be trusted to pick the next sequence honestly. One packet far
+/// ahead of the current highest would otherwise advance the receive state past
+/// every legitimate sequence still in flight and starve the session.
+const RUDP_RECEIVE_AHEAD_WINDOW: u32 = 1_024;
+const RUDP_MAX_ORDERED_BUFFERED_FRAMES: usize = 1_024;
+const RUDP_MAX_ORDERED_BUFFERED_BYTES: usize = 4 * 1024 * 1024;
 
 #[derive(Clone, Copy, Debug, PartialEq, Eq)]
 pub enum CultNetRudpPacketType {
@@ -68,6 +85,7 @@ pub struct CultNetRudpDeliveredFrame {
 #[derive(Clone, Debug, PartialEq, Eq)]
 pub struct CultNetRudpReceiveResult {
     pub delivered: Vec<CultNetRudpDeliveredFrame>,
+    pub ready_to_send: Vec<CultNetRudpPacket>,
     pub reply: Option<CultNetRudpPacket>,
     pub pong: bool,
     pub pong_payload: Vec<u8>,
@@ -100,12 +118,40 @@ pub struct CultNetRudpSendOptions {
     pub ordered: bool,
     pub sequenced: bool,
     pub now_ms: u64,
+    /// Drop a reliable packet instead of retransmitting it once this many
+    /// milliseconds have passed since the send call. `None` retransmits until
+    /// acknowledged, which is correct for state and wrong for live media, where
+    /// a late frame is worse than a missing one.
+    pub reliable_expire_after_ms: Option<u64>,
+}
+
+/// Identifies every transport packet belonging to one non-expiring reliable
+/// send. Receipts are local to the session that issued them and cannot survive
+/// a peer reset.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct CultNetRudpReliableSendReceipt {
+    session_scope: Uuid,
+    sequences: Vec<u32>,
+}
+
+impl CultNetRudpReliableSendReceipt {
+    pub fn packet_sequences(&self) -> &[u32] {
+        &self.sequences
+    }
+}
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum CultNetRudpReliableSendStatus {
+    Pending,
+    Acknowledged,
+    Invalidated,
 }
 
 #[derive(Clone, Debug, PartialEq, Eq)]
 struct PendingReliablePacket {
     packet: CultNetRudpPacket,
     last_sent_at_ms: u64,
+    expires_at_ms: Option<u64>,
 }
 
 #[derive(Clone, Debug, PartialEq, Eq)]
@@ -121,40 +167,64 @@ struct FragmentBuffer {
     fragment_count: u16,
     payloads: BTreeMap<u16, Vec<u8>>,
     sequences: BTreeMap<u16, u32>,
+    /// Session-local arrival ordinal of the newest fragment in this set. A
+    /// set that stops being touched is one that lost a fragment; it is the
+    /// first to go when the pending-set bound is reached.
+    last_touched: u64,
 }
 
 pub struct CultNetRudpSession {
+    session_scope: Uuid,
     connection_id: u32,
     resend_delay_ms: u64,
     max_pending_reliable_packets: Option<usize>,
+    max_payload_bytes: Option<usize>,
+    max_pending_fragment_sets: usize,
+    initial_sequence: u32,
     next_sequence: u32,
+    next_sequenced_by_channel: BTreeMap<String, u32>,
     next_fragment_id: u16,
     connected: bool,
     last_received_at_ms: Option<u64>,
     highest_received_sequence: Option<u32>,
     received_sequences: BTreeSet<u32>,
+    latest_sequenced_by_channel: BTreeMap<String, u32>,
     pending_reliable: BTreeMap<u32, PendingReliablePacket>,
+    queued_reliable: VecDeque<(CultNetRudpPacket, Option<u64>)>,
+    reliable_packets_expired: u64,
     ordered_next_sequence_by_channel: BTreeMap<String, u32>,
     ordered_buffers: BTreeMap<String, BTreeMap<u32, PendingOrderedFrame>>,
     fragment_buffers: BTreeMap<(String, u16), FragmentBuffer>,
+    fragment_touches: u64,
+    fragment_sets_evicted: u64,
 }
 
 impl CultNetRudpSession {
     pub fn new(options: CultNetRudpSessionOptions) -> Self {
         Self {
+            session_scope: Uuid::new_v4(),
             connection_id: options.connection_id,
             resend_delay_ms: options.resend_delay_ms,
             max_pending_reliable_packets: options.max_pending_reliable_packets,
+            max_payload_bytes: None,
+            max_pending_fragment_sets: 64,
+            initial_sequence: options.initial_sequence,
             next_sequence: options.initial_sequence,
+            next_sequenced_by_channel: BTreeMap::new(),
             next_fragment_id: 1,
             connected: false,
             last_received_at_ms: None,
             highest_received_sequence: None,
             received_sequences: BTreeSet::new(),
+            latest_sequenced_by_channel: BTreeMap::new(),
             pending_reliable: BTreeMap::new(),
+            queued_reliable: VecDeque::new(),
+            reliable_packets_expired: 0,
             ordered_next_sequence_by_channel: BTreeMap::new(),
             ordered_buffers: BTreeMap::new(),
             fragment_buffers: BTreeMap::new(),
+            fragment_touches: 0,
+            fragment_sets_evicted: 0,
         }
     }
 
@@ -170,14 +240,117 @@ impl CultNetRudpSession {
         self.connected
     }
 
+    pub fn assume_connected(&mut self, now_ms: u64) {
+        self.connected = true;
+        self.last_received_at_ms = Some(now_ms);
+    }
+
     pub fn pending_reliable_sequences(&self) -> Vec<u32> {
         self.pending_reliable.keys().copied().collect()
     }
 
+    /// Reliable packets dropped by their expiry deadline rather than
+    /// acknowledged. A rising count means the peer is not keeping up.
+    pub fn reliable_packets_expired(&self) -> u64 {
+        self.reliable_packets_expired
+    }
+
+    /// Incomplete fragment sets discarded to admit a newer one. Each is a
+    /// payload that lost at least one fragment on the wire; a rising count is
+    /// the link's loss rate multiplied by the fragment count, and the reason
+    /// media payloads should fit in one packet.
+    pub fn fragment_sets_evicted(&self) -> u64 {
+        self.fragment_sets_evicted
+    }
+
+    pub fn queued_reliable_packet_count(&self) -> usize {
+        self.queued_reliable.len()
+    }
+
+    pub fn outstanding_reliable_packet_count(&self) -> usize {
+        self.pending_reliable.len() + self.queued_reliable.len()
+    }
+
+    fn pending_accept_for_resend(&mut self, now_ms: u64) -> Option<CultNetRudpPacket> {
+        let pending = self
+            .pending_reliable
+            .values_mut()
+            .find(|pending| pending.packet.packet_type == CultNetRudpPacketType::Accept)?;
+        pending.last_sent_at_ms = now_ms;
+        Some(pending.packet.clone())
+    }
+
+    fn reliable_send_status(
+        &self,
+        receipt: &CultNetRudpReliableSendReceipt,
+    ) -> CultNetRudpReliableSendStatus {
+        if receipt.session_scope != self.session_scope {
+            return CultNetRudpReliableSendStatus::Invalidated;
+        }
+        if receipt
+            .sequences
+            .iter()
+            .any(|sequence| self.pending_reliable.contains_key(sequence))
+        {
+            CultNetRudpReliableSendStatus::Pending
+        } else {
+            CultNetRudpReliableSendStatus::Acknowledged
+        }
+    }
+
+    fn non_expiring_reliable_receipt(
+        &self,
+        packets: &[CultNetRudpPacket],
+    ) -> Result<CultNetRudpReliableSendReceipt> {
+        if packets.is_empty() || packets.iter().any(|packet| !packet.reliable) {
+            return Err(anyhow!(
+                "RUDP acknowledgement receipts require a non-empty reliable packet set"
+            ));
+        }
+        Ok(CultNetRudpReliableSendReceipt {
+            session_scope: self.session_scope,
+            sequences: packets.iter().map(|packet| packet.sequence).collect(),
+        })
+    }
+
     pub fn last_received_at_ms(&self) -> Option<u64> {
         self.last_received_at_ms
     }
 
+    pub fn set_max_payload_bytes(&mut self, max_payload_bytes: Option<usize>) {
+        self.max_payload_bytes = max_payload_bytes;
+    }
+
+    pub fn set_max_pending_fragment_sets(
+        &mut self,
+        max_pending_fragment_sets: usize,
+    ) -> Result<()> {
+        if max_pending_fragment_sets == 0 {
+            return Err(anyhow!(
+                "RUDP max_pending_fragment_sets must be greater than zero"
+            ));
+        }
+        self.max_pending_fragment_sets = max_pending_fragment_sets;
+        Ok(())
+    }
+
+    pub fn reset_peer_state(&mut self) {
+        self.session_scope = Uuid::new_v4();
+        self.next_sequence = self.initial_sequence;
+        self.next_sequenced_by_channel.clear();
+        self.next_fragment_id = 1;
+        self.connected = false;
+        self.last_received_at_ms = None;
+        self.highest_received_sequence = None;
+        self.received_sequences.clear();
+        self.latest_sequenced_by_channel.clear();
+        self.pending_reliable.clear();
+        self.queued_reliable.clear();
+        self.ordered_next_sequence_by_channel.clear();
+        self.ordered_buffers.clear();
+        self.fragment_buffers.clear();
+    }
+
     pub fn create_connect(&mut self, now_ms: u64, payload: Vec<u8>) -> Result<CultNetRudpPacket> {
         self.ensure_reliable_capacity(1)?;
         let packet = self.create_packet(
@@ -188,7 +361,7 @@ impl CultNetRudpSession {
             true,
             false,
         );
-        self.track_reliable(packet.clone(), now_ms);
+        self.track_reliable(packet.clone(), now_ms, None);
         Ok(packet)
     }
 
@@ -208,6 +381,7 @@ impl CultNetRudpSession {
 
         self.ensure_reliable_capacity(1)?;
         self.remember_received(packet.sequence);
+        self.last_received_at_ms = Some(now_ms);
         self.connected = true;
         let response = self.create_packet(
             CultNetRudpPacketType::Accept,
@@ -217,7 +391,7 @@ impl CultNetRudpSession {
             true,
             false,
         );
-        self.track_reliable(response.clone(), now_ms);
+        self.track_reliable(response.clone(), now_ms, None);
         Ok(response)
     }
 
@@ -227,6 +401,13 @@ impl CultNetRudpSession {
         payload: Vec<u8>,
         options: CultNetRudpSendOptions,
     ) -> Result<CultNetRudpPacket> {
+        if options.reliable
+            && self.pending_reliable.len() >= CULTNET_RUDP_RELIABLE_SEND_WINDOW_PACKETS
+        {
+            return Err(anyhow!(
+                "RUDP reliable send window is full; receive acknowledgements before sending"
+            ));
+        }
         self.send_many(channel_id, payload, options, None)?
             .into_iter()
             .next()
@@ -245,6 +426,16 @@ impl CultNetRudpSession {
                 "Cannot send RUDP data before the session is connected"
             ));
         }
+        if options.ordered && !options.reliable {
+            return Err(anyhow!("RUDP ordered delivery requires reliability"));
+        }
+        self.require_payload_size(payload.len())?;
+        // Reclaim deadline-passed sends before measuring window capacity, so an
+        // expiring stream cannot be refused for a backlog it no longer owns.
+        self.purge_expired_reliable(options.now_ms);
+        let expires_at_ms = options
+            .reliable_expire_after_ms
+            .map(|ttl| options.now_ms.saturating_add(ttl));
 
         if let Some(max_fragment_bytes) = max_fragment_bytes {
             if max_fragment_bytes == 0 {
@@ -272,12 +463,13 @@ impl CultNetRudpSession {
                         index as u16,
                         fragment_count as u16,
                     );
-                    if packet.reliable {
-                        self.track_reliable(packet.clone(), options.now_ms);
-                    }
                     packets.push(packet);
                 }
-                return Ok(packets);
+                return Ok(if options.reliable {
+                    self.admit_reliable_packets(packets, options.now_ms, expires_at_ms)
+                } else {
+                    packets
+                });
             }
         }
 
@@ -291,7 +483,7 @@ impl CultNetRudpSession {
             options.sequenced,
         );
         if packet.reliable {
-            self.track_reliable(packet.clone(), options.now_ms);
+            return Ok(self.admit_reliable_packets(vec![packet], options.now_ms, expires_at_ms));
         }
         Ok(vec![packet])
     }
@@ -303,6 +495,8 @@ impl CultNetRudpSession {
     ) -> Result<CultNetRudpReceiveResult> {
         self.require_connection(packet)?;
         self.apply_acknowledgements(packet);
+        self.purge_expired_reliable(now_ms);
+        let ready_to_send = self.promote_queued_reliable(now_ms);
         self.last_received_at_ms = Some(now_ms);
         let expected_sequence_if_uninitialized = self
             .highest_received_sequence
@@ -314,6 +508,7 @@ impl CultNetRudpSession {
             self.connected = true;
             return Ok(CultNetRudpReceiveResult {
                 delivered: Vec::new(),
+                ready_to_send,
                 reply: None,
                 pong: false,
                 pong_payload: Vec::new(),
@@ -323,9 +518,9 @@ impl CultNetRudpSession {
         }
 
         if packet.packet_type == CultNetRudpPacketType::Ping {
-            self.remember_received(packet.sequence);
             return Ok(CultNetRudpReceiveResult {
                 delivered: Vec::new(),
+                ready_to_send,
                 reply: Some(self.create_packet(
                     CultNetRudpPacketType::Pong,
                     "control",
@@ -344,9 +539,9 @@ impl CultNetRudpSession {
         if packet.packet_type == CultNetRudpPacketType::Ack
             || packet.packet_type == CultNetRudpPacketType::Pong
         {
-            self.remember_received(packet.sequence);
             return Ok(CultNetRudpReceiveResult {
                 delivered: Vec::new(),
+                ready_to_send,
                 reply: None,
                 pong: packet.packet_type == CultNetRudpPacketType::Pong,
                 pong_payload: if packet.packet_type == CultNetRudpPacketType::Pong {
@@ -360,10 +555,10 @@ impl CultNetRudpSession {
         }
 
         if packet.packet_type == CultNetRudpPacketType::Disconnect {
-            self.remember_received(packet.sequence);
             self.connected = false;
             return Ok(CultNetRudpReceiveResult {
                 delivered: Vec::new(),
+                ready_to_send,
                 reply: None,
                 pong: false,
                 pong_payload: Vec::new(),
@@ -375,6 +570,7 @@ impl CultNetRudpSession {
         if packet.packet_type != CultNetRudpPacketType::Data {
             return Ok(CultNetRudpReceiveResult {
                 delivered: Vec::new(),
+                ready_to_send,
                 reply: None,
                 pong: false,
                 pong_payload: Vec::new(),
@@ -383,11 +579,38 @@ impl CultNetRudpSession {
             });
         }
 
-        let duplicate = self.received_sequences.contains(&packet.sequence);
-        self.remember_received(packet.sequence);
+        let far_ahead = packet.reliable
+            && self.highest_received_sequence.is_some_and(|highest| {
+                packet.sequence > highest
+                    && packet.sequence - highest > RUDP_RECEIVE_AHEAD_WINDOW
+            });
+        if far_ahead {
+            // Refuse without remembering. Recording it would move the highest
+            // received sequence out of reach of everything still in flight.
+            return Ok(CultNetRudpReceiveResult {
+                delivered: Vec::new(),
+                ready_to_send,
+                reply: None,
+                pong: false,
+                pong_payload: Vec::new(),
+                disconnected: false,
+                disconnect_reason: Vec::new(),
+            });
+        }
+
+        let duplicate = packet.reliable
+            && (self.received_sequences.contains(&packet.sequence)
+                || self.highest_received_sequence.is_some_and(|highest| {
+                    packet.sequence < highest
+                        && highest - packet.sequence >= RUDP_RECEIVED_SEQUENCE_WINDOW as u32
+                }));
+        if packet.reliable {
+            self.remember_received(packet.sequence);
+        }
         if duplicate {
             return Ok(CultNetRudpReceiveResult {
                 delivered: Vec::new(),
+                ready_to_send,
                 reply: None,
                 pong: false,
                 pong_payload: Vec::new(),
@@ -399,6 +622,7 @@ impl CultNetRudpSession {
         let Some((frame, ordered, next_sequence)) = self.reassemble(packet)? else {
             return Ok(CultNetRudpReceiveResult {
                 delivered: Vec::new(),
+                ready_to_send,
                 reply: None,
                 pong: false,
                 pong_payload: Vec::new(),
@@ -407,12 +631,33 @@ impl CultNetRudpSession {
             });
         };
         let delivered = if ordered {
-            self.deliver_ordered(frame, next_sequence, expected_sequence_if_uninitialized)
+            self.deliver_ordered(frame, next_sequence, expected_sequence_if_uninitialized)?
+        } else if packet.sequenced {
+            if !self
+                .latest_sequenced_by_channel
+                .contains_key(&frame.channel_id)
+                && self.latest_sequenced_by_channel.len() >= RUDP_MAX_TRACKED_CHANNELS
+            {
+                return Err(anyhow!("RUDP session has too many sequenced channels"));
+            }
+            let latest = self
+                .latest_sequenced_by_channel
+                .get(&frame.channel_id)
+                .copied();
+            let newest_sequence = next_sequence.saturating_sub(1);
+            if latest.is_some_and(|latest| newest_sequence <= latest) {
+                Vec::new()
+            } else {
+                self.latest_sequenced_by_channel
+                    .insert(frame.channel_id.clone(), newest_sequence);
+                vec![frame]
+            }
         } else {
             vec![frame]
         };
         Ok(CultNetRudpReceiveResult {
             delivered,
+            ready_to_send,
             reply: None,
             pong: false,
             pong_payload: Vec::new(),
@@ -422,14 +667,49 @@ impl CultNetRudpSession {
     }
 
     pub fn create_ack(&mut self) -> CultNetRudpPacket {
-        self.create_packet(
-            CultNetRudpPacketType::Ack,
-            "control",
-            Vec::new(),
-            false,
-            false,
-            false,
-        )
+        let (ack, ack_mask) = self.ack_state();
+        CultNetRudpPacket {
+            packet_type: CultNetRudpPacketType::Ack,
+            connection_id: self.connection_id,
+            sequence: 0,
+            ack,
+            ack_mask,
+            channel_id: "control".to_string(),
+            reliable: false,
+            ordered: false,
+            sequenced: false,
+            fragment_id: 0,
+            fragment_index: 0,
+            fragment_count: 0,
+            payload: Vec::new(),
+        }
+    }
+
+    pub fn create_ack_for(&self, sequence: u32) -> CultNetRudpPacket {
+        CultNetRudpPacket {
+            packet_type: CultNetRudpPacketType::Ack,
+            connection_id: self.connection_id,
+            sequence: 0,
+            ack: sequence,
+            ack_mask: 0,
+            channel_id: "control".to_string(),
+            reliable: false,
+            ordered: false,
+            sequenced: false,
+            fragment_id: 0,
+            fragment_index: 0,
+            fragment_count: 0,
+            payload: Vec::new(),
+        }
+    }
+
+    pub fn create_ack_for_received(&mut self, sequence: u32) -> CultNetRudpPacket {
+        let (ack, _) = self.ack_state();
+        if ack >= sequence && ack - sequence <= 32 {
+            self.create_ack()
+        } else {
+            self.create_ack_for(sequence)
+        }
     }
 
     pub fn create_ping(&mut self, payload: Vec<u8>) -> CultNetRudpPacket {
@@ -516,11 +796,23 @@ impl CultNetRudpSession {
         fragment_index: u16,
         fragment_count: u16,
     ) -> CultNetRudpPacket {
-        let sequence = self.next_sequence;
-        self.next_sequence = self
-            .next_sequence
-            .checked_add(1)
-            .expect("sequence overflow");
+        let sequence = if reliable {
+            let sequence = self.next_sequence;
+            self.next_sequence = self
+                .next_sequence
+                .saturating_add(1);
+            sequence
+        } else if sequenced {
+            let next = self
+                .next_sequenced_by_channel
+                .entry(channel_id.to_string())
+                .or_insert(1);
+            let sequence = *next;
+            *next = next.saturating_add(1);
+            sequence
+        } else {
+            0
+        };
         let (ack, ack_mask) = self.ack_state();
         CultNetRudpPacket {
             packet_type,
@@ -539,25 +831,88 @@ impl CultNetRudpSession {
         }
     }
 
-    fn track_reliable(&mut self, packet: CultNetRudpPacket, now_ms: u64) {
+    fn track_reliable(
+        &mut self,
+        packet: CultNetRudpPacket,
+        now_ms: u64,
+        expires_at_ms: Option<u64>,
+    ) {
         self.pending_reliable.insert(
             packet.sequence,
             PendingReliablePacket {
                 packet,
                 last_sent_at_ms: now_ms,
+                expires_at_ms,
             },
         );
     }
 
+    /// Drop pending and queued reliable packets past their deadline. The
+    /// deadline is fixed when the send is admitted, so time spent waiting in
+    /// the backlog counts against it exactly as time spent awaiting an ACK does.
+    fn purge_expired_reliable(&mut self, now_ms: u64) {
+        let before = self.pending_reliable.len() + self.queued_reliable.len();
+        self.pending_reliable
+            .retain(|_, pending| pending.expires_at_ms.is_none_or(|at| now_ms <= at));
+        self.queued_reliable
+            .retain(|(_, expires_at_ms)| expires_at_ms.is_none_or(|at| now_ms <= at));
+        let after = self.pending_reliable.len() + self.queued_reliable.len();
+        self.reliable_packets_expired = self
+            .reliable_packets_expired
+            .saturating_add((before - after) as u64);
+    }
+
+    fn admit_reliable_packets(
+        &mut self,
+        packets: Vec<CultNetRudpPacket>,
+        now_ms: u64,
+        expires_at_ms: Option<u64>,
+    ) -> Vec<CultNetRudpPacket> {
+        let available =
+            CULTNET_RUDP_RELIABLE_SEND_WINDOW_PACKETS.saturating_sub(self.pending_reliable.len());
+        let mut ready = Vec::with_capacity(available.min(packets.len()));
+        for packet in packets {
+            if ready.len() < available {
+                self.track_reliable(packet.clone(), now_ms, expires_at_ms);
+                ready.push(packet);
+            } else {
+                self.queued_reliable.push_back((packet, expires_at_ms));
+            }
+        }
+        ready
+    }
+
+    fn promote_queued_reliable(&mut self, now_ms: u64) -> Vec<CultNetRudpPacket> {
+        let available =
+            CULTNET_RUDP_RELIABLE_SEND_WINDOW_PACKETS.saturating_sub(self.pending_reliable.len());
+        let mut ready = Vec::with_capacity(available.min(self.queued_reliable.len()));
+        for _ in 0..available {
+            let Some((packet, expires_at_ms)) = self.queued_reliable.pop_front() else {
+                break;
+            };
+            self.track_reliable(packet.clone(), now_ms, expires_at_ms);
+            ready.push(packet);
+        }
+        ready
+    }
+
     fn ensure_reliable_capacity(&self, packet_count: usize) -> Result<()> {
         if packet_count == 0 {
             return Ok(());
         }
         if let Some(limit) = self.max_pending_reliable_packets {
-            if self.pending_reliable.len() + packet_count > limit {
+            if self.outstanding_reliable_packet_count() + packet_count > limit {
                 return Err(anyhow!("RUDP reliable send queue is full"));
             }
         }
+        // Refuse before allocation rather than at it. A session that runs out of
+        // reliable sequence space must report it, not abort the process.
+        let required = u32::try_from(packet_count)
+            .ok()
+            .filter(|required| self.next_sequence.checked_add(*required).is_some());
+        if required.is_none() {
+            return Err(anyhow!("RUDP reliable sequence space is exhausted"));
+        }
         Ok(())
     }
 
@@ -578,6 +933,13 @@ impl CultNetRudpSession {
         {
             self.highest_received_sequence = Some(sequence);
         }
+        if self.received_sequences.len() > RUDP_RECEIVED_SEQUENCE_WINDOW {
+            let keep_from = self
+                .highest_received_sequence
+                .unwrap_or(sequence)
+                .saturating_sub(RUDP_RECEIVED_SEQUENCE_WINDOW as u32 - 1);
+            self.received_sequences = self.received_sequences.split_off(&keep_from);
+        }
     }
 
     fn ack_state(&self) -> (u32, u32) {
@@ -596,6 +958,7 @@ impl CultNetRudpSession {
         packet: &CultNetRudpPacket,
     ) -> Result<Option<(CultNetRudpDeliveredFrame, bool, u32)>> {
         if packet.fragment_count == 0 {
+            self.require_payload_size(packet.payload.len())?;
             return Ok(Some((
                 CultNetRudpDeliveredFrame {
                     channel_id: packet.channel_id.clone(),
@@ -618,6 +981,39 @@ impl CultNetRudpSession {
         }
 
         let key = (packet.channel_id.clone(), packet.fragment_id);
+        if !self.fragment_buffers.contains_key(&key)
+            && self.fragment_buffers.len() >= self.max_pending_fragment_sets
+        {
+            // A set that is still incomplete when the bound is reached has
+            // almost certainly lost a fragment; its siblings were delivered
+            // long ago. Drop the one untouched longest so the session keeps
+            // receiving. Erroring here made any lossy fragmenting channel a
+            // countdown to a dead receiver.
+            let stalest = self
+                .fragment_buffers
+                .iter()
+                .min_by_key(|(_, buffer)| buffer.last_touched)
+                .map(|(key, _)| key.clone())
+                .expect("bound reached implies a pending set exists");
+            self.fragment_buffers.remove(&stalest);
+            self.fragment_sets_evicted += 1;
+        }
+        let buffered_bytes = self
+            .fragment_buffers
+            .get(&key)
+            .map(|buffer| {
+                buffer
+                    .payloads
+                    .iter()
+                    .filter(|(index, _)| **index != packet.fragment_index)
+                    .map(|(_, payload)| payload.len())
+                    .sum::<usize>()
+            })
+            .unwrap_or(0);
+        if let Err(error) = self.require_payload_size(buffered_bytes + packet.payload.len()) {
+            self.fragment_buffers.remove(&key);
+            return Err(error);
+        }
         let buffer = self
             .fragment_buffers
             .entry(key.clone())
@@ -627,12 +1023,15 @@ impl CultNetRudpSession {
                 fragment_count: packet.fragment_count,
                 payloads: BTreeMap::new(),
                 sequences: BTreeMap::new(),
+                last_touched: 0,
             });
         if buffer.fragment_count != packet.fragment_count || buffer.ordered != packet.ordered {
             return Err(anyhow!(
                 "RUDP fragment metadata changed within a fragment set"
             ));
         }
+        self.fragment_touches += 1;
+        buffer.last_touched = self.fragment_touches;
         buffer
             .payloads
             .insert(packet.fragment_index, packet.payload.clone());
@@ -669,13 +1068,40 @@ impl CultNetRudpSession {
         )))
     }
 
+    fn require_payload_size(&self, payload_bytes: usize) -> Result<()> {
+        if self
+            .max_payload_bytes
+            .is_some_and(|max_payload_bytes| payload_bytes > max_payload_bytes)
+        {
+            return Err(anyhow!("RUDP payload exceeds max_payload_bytes"));
+        }
+        Ok(())
+    }
+
+    fn ordered_buffered_frames(&self) -> usize {
+        self.ordered_buffers.values().map(BTreeMap::len).sum()
+    }
+
+    fn ordered_buffered_bytes(&self) -> usize {
+        self.ordered_buffers
+            .values()
+            .flat_map(BTreeMap::values)
+            .map(|pending| pending.frame.payload.len())
+            .sum()
+    }
+
     fn deliver_ordered(
         &mut self,
         frame: CultNetRudpDeliveredFrame,
         next_sequence_after_frame: u32,
         expected_sequence_if_uninitialized: u32,
-    ) -> Vec<CultNetRudpDeliveredFrame> {
+    ) -> Result<Vec<CultNetRudpDeliveredFrame>> {
         let channel_id = frame.channel_id.clone();
+        if !self.ordered_next_sequence_by_channel.contains_key(&channel_id)
+            && self.ordered_next_sequence_by_channel.len() >= RUDP_MAX_TRACKED_CHANNELS
+        {
+            return Err(anyhow!("RUDP session has too many ordered channels"));
+        }
         let mut next = if let Some(next) = self
             .ordered_next_sequence_by_channel
             .get(&channel_id)
@@ -703,10 +1129,16 @@ impl CultNetRudpSession {
         }
 
         if frame.sequence < next {
-            return Vec::new();
+            return Ok(Vec::new());
         }
 
         if frame.sequence > next {
+            if self.ordered_buffered_frames() >= RUDP_MAX_ORDERED_BUFFERED_FRAMES
+                || self.ordered_buffered_bytes() + frame.payload.len()
+                    > RUDP_MAX_ORDERED_BUFFERED_BYTES
+            {
+                return Err(anyhow!("RUDP ordered hold buffer is full"));
+            }
             self.ordered_buffers.entry(channel_id).or_default().insert(
                 frame.sequence,
                 PendingOrderedFrame {
@@ -714,14 +1146,14 @@ impl CultNetRudpSession {
                     next_sequence: next_sequence_after_frame,
                 },
             );
-            return Vec::new();
+            return Ok(Vec::new());
         }
 
         self.ordered_next_sequence_by_channel
             .insert(channel_id.clone(), next_sequence_after_frame);
         let mut delivered = vec![frame];
         delivered.extend(self.drain_ordered(&channel_id));
-        delivered
+        Ok(delivered)
     }
 
     fn drain_ordered(&mut self, channel_id: &str) -> Vec<CultNetRudpDeliveredFrame> {
@@ -770,7 +1202,9 @@ impl CultNetRudpSession {
 
     fn allocate_fragment_id(&mut self) -> u16 {
         let fragment_id = self.next_fragment_id;
-        self.next_fragment_id = self.next_fragment_id.saturating_add(1);
+        // Wrap, never saturate: `saturating_add` parked every set after the
+        // 65,535th on one shared id, and the reassembler stitched them together.
+        self.next_fragment_id = self.next_fragment_id.wrapping_add(1);
         if self.next_fragment_id == 0 {
             self.next_fragment_id = 1;
         }
@@ -808,6 +1242,9 @@ pub struct CultNetRudpSocketTransportOptions {
     pub max_fragment_bytes: Option<u32>,
     pub max_pending_reliable_packets: Option<u32>,
     pub reconnect_policy: Option<CultNetReconnectPolicy>,
+    pub media_reliable_expire_after_ms: Option<u64>,
+    /// `None` means the historical default, `Reliable`.
+    pub media_delivery: Option<CultNetTransportDelivery>,
 }
 
 impl CultNetRudpSocketTransportOptions {
@@ -818,6 +1255,8 @@ impl CultNetRudpSocketTransportOptions {
         connection_id: u32,
     ) -> Self {
         Self {
+            media_reliable_expire_after_ms: Some(DEFAULT_MEDIA_RELIABLE_EXPIRE_AFTER_MS),
+            media_delivery: None,
             runtime_id: runtime_id.into(),
             socket,
             mode: CultNetRudpSocketMode::Client,
@@ -835,6 +1274,8 @@ impl CultNetRudpSocketTransportOptions {
 
     pub fn server(runtime_id: impl Into<String>, socket: UdpSocket, connection_id: u32) -> Self {
         Self {
+            media_reliable_expire_after_ms: Some(DEFAULT_MEDIA_RELIABLE_EXPIRE_AFTER_MS),
+            media_delivery: None,
             runtime_id: runtime_id.into(),
             socket,
             mode: CultNetRudpSocketMode::Server,
@@ -864,16 +1305,439 @@ pub struct CultNetRudpSocketTransportConnection {
     pong_payloads: VecDeque<Vec<u8>>,
 }
 
-impl CultNetRudpSocketTransportConnection {
-    pub fn new(options: CultNetRudpSocketTransportOptions) -> Result<Self> {
+pub struct CultNetRudpServerHubOptions {
+    pub runtime_id: String,
+    pub socket: UdpSocket,
+    pub connection_id: u32,
+    pub initial_sequence: u32,
+    pub resend_delay_ms: u64,
+    pub transport_id: Option<String>,
+    pub max_payload_bytes: Option<u32>,
+    pub max_fragment_bytes: Option<u32>,
+    pub max_pending_reliable_packets: Option<u32>,
+    pub max_peers: usize,
+    pub media_reliable_expire_after_ms: Option<u64>,
+    /// `None` means the historical default, `Reliable`.
+    pub media_delivery: Option<CultNetTransportDelivery>,
+}
+
+impl CultNetRudpServerHubOptions {
+    pub fn new(runtime_id: impl Into<String>, socket: UdpSocket, connection_id: u32) -> Self {
+        Self {
+            media_reliable_expire_after_ms: Some(DEFAULT_MEDIA_RELIABLE_EXPIRE_AFTER_MS),
+            media_delivery: None,
+            runtime_id: runtime_id.into(),
+            socket,
+            connection_id,
+            initial_sequence: 1,
+            resend_delay_ms: 250,
+            transport_id: None,
+            max_payload_bytes: None,
+            max_fragment_bytes: None,
+            max_pending_reliable_packets: None,
+            max_peers: 256,
+        }
+    }
+}
+
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct CultNetRudpServerSessionContext {
+    pub remote_addr: SocketAddr,
+    pub connection_id: u32,
+    /// Server-minted generation used to fence work from an older session at
+    /// the same UDP endpoint.
+    pub session_generation: u64,
+    /// Exact bytes supplied by the peer's most recently accepted Connect packet.
+    /// CultNet does not interpret these bytes; higher layers may use them as
+    /// transport evidence when making their own authorization decision.
+    pub connect_payload: Vec<u8>,
+}
+
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub enum CultNetRudpServerEvent {
+    Connected {
+        session: CultNetRudpServerSessionContext,
+    },
+    Frame {
+        session: CultNetRudpServerSessionContext,
+        frame: CultNetTransportFrame,
+    },
+    Pong {
+        session: CultNetRudpServerSessionContext,
+        payload: Vec<u8>,
+    },
+    Disconnected {
+        session: CultNetRudpServerSessionContext,
+        reason: Vec<u8>,
+    },
+}
+
+struct CultNetRudpServerPeer {
+    session: CultNetRudpSession,
+    context: CultNetRudpServerSessionContext,
+}
+
+/// One UDP listener with an independent reliable session for every remote peer.
+///
+/// The hub owns packet/session mechanics only. Registration, leases, commands,
+/// and all other application policy belong to the service using the hub.
+pub struct CultNetRudpServerHub {
+    socket: UdpSocket,
+    connection_id: u32,
+    initial_sequence: u32,
+    resend_delay_ms: u64,
+    max_pending_reliable_packets: Option<usize>,
+    max_payload_bytes: usize,
+    max_fragment_bytes: Option<usize>,
+    max_peers: usize,
+    next_session_generation: u64,
+    peers: BTreeMap<SocketAddr, CultNetRudpServerPeer>,
+    pending_events: VecDeque<CultNetRudpServerEvent>,
+    pub profile: CultNetTransportProfile,
+    stats: CultNetTransportStats,
+}
+
+impl CultNetRudpServerHub {
+    pub fn new(options: CultNetRudpServerHubOptions) -> Result<Self> {
         let local_addr = options.socket.local_addr()?;
+        if options.max_peers == 0 {
+            return Err(anyhow!(
+                "RUDP server hub max_peers must be greater than zero"
+            ));
+        }
+        let max_payload_bytes = options
+            .max_payload_bytes
+            .or(Some(CULTNET_RUDP_DEFAULT_MAX_PAYLOAD_BYTES as u32));
         let profile = create_rudp_transport_profile(
             options.runtime_id,
             RudpTransportProfileOptions {
+                media_reliable_expire_after_ms: options.media_reliable_expire_after_ms,
+                media_delivery: options.media_delivery,
                 transport_id: options.transport_id,
                 host: Some(local_addr.ip().to_string()),
                 port: Some(local_addr.port()),
-                max_payload_bytes: options.max_payload_bytes,
+                max_payload_bytes,
+                max_fragment_bytes: options.max_fragment_bytes,
+                max_pending_reliable_packets: options.max_pending_reliable_packets,
+                reconnect_policy: None,
+            },
+        );
+        Ok(Self {
+            socket: options.socket,
+            connection_id: options.connection_id,
+            initial_sequence: options.initial_sequence,
+            resend_delay_ms: options.resend_delay_ms,
+            max_pending_reliable_packets: options
+                .max_pending_reliable_packets
+                .map(|value| value as usize),
+            max_payload_bytes: max_payload_bytes.expect("RUDP hub has an effective payload limit")
+                as usize,
+            max_fragment_bytes: options.max_fragment_bytes.map(|value| value as usize),
+            max_peers: options.max_peers,
+            next_session_generation: 1,
+            peers: BTreeMap::new(),
+            pending_events: VecDeque::new(),
+            profile,
+            stats: CultNetTransportStats::default(),
+        })
+    }
+
+    pub fn local_addr(&self) -> Result<SocketAddr> {
+        Ok(self.socket.local_addr()?)
+    }
+
+    pub fn stats(&self) -> CultNetTransportStats {
+        let mut stats = self.stats.clone();
+        stats.reliable_packets_expired = self
+            .peers
+            .values()
+            .map(|peer| peer.session.reliable_packets_expired())
+            .fold(0_u64, |total, expired| total.saturating_add(expired));
+        stats.fragment_sets_evicted = self
+            .peers
+            .values()
+            .map(|peer| peer.session.fragment_sets_evicted())
+            .fold(0_u64, |total, evicted| total.saturating_add(evicted));
+        stats
+    }
+
+    pub fn sessions(&self) -> Vec<CultNetRudpServerSessionContext> {
+        self.peers
+            .values()
+            .map(|peer| peer.context.clone())
+            .collect()
+    }
+
+    pub fn session(&self, remote_addr: SocketAddr) -> Option<&CultNetRudpServerSessionContext> {
+        self.peers.get(&remote_addr).map(|peer| &peer.context)
+    }
+
+    pub fn send(
+        &mut self,
+        session: &CultNetRudpServerSessionContext,
+        channel_id: &str,
+        payload: Vec<u8>,
+    ) -> Result<()> {
+        let remote_addr = session.remote_addr;
+        let packets = {
+            let peer = self
+                .peers
+                .get_mut(&remote_addr)
+                .ok_or_else(|| anyhow!("Unknown RUDP server peer {remote_addr}"))?;
+            if peer.context.session_generation != session.session_generation {
+                return Err(anyhow!(
+                    "RUDP server session generation {} is no longer active",
+                    session.session_generation
+                ));
+            }
+            peer.session.send_many(
+                channel_id,
+                payload,
+                channel_send_options(
+                channel_id,
+                now_ms(),
+                channel_reliable_expire_after_ms(&self.profile, channel_id),
+                channel_delivery(&self.profile, channel_id),
+            ),
+                self.max_fragment_bytes,
+            )?
+        };
+        for packet in packets {
+            self.send_packet(remote_addr, &packet)?;
+        }
+        self.stats.frames_sent += 1;
+        Ok(())
+    }
+
+    pub fn send_schema_message(
+        &mut self,
+        session: &CultNetRudpServerSessionContext,
+        message: &CultNetMessage,
+    ) -> Result<()> {
+        let payload = encode_cultnet_message_to_vec(message, CultNetWireContract::CultNetSchemaV0)?;
+        self.send(session, "schema", payload)
+    }
+
+    pub fn disconnect(
+        &mut self,
+        session: &CultNetRudpServerSessionContext,
+        reason: Vec<u8>,
+    ) -> Result<bool> {
+        let Some(peer) = self.peers.get(&session.remote_addr) else {
+            return Ok(false);
+        };
+        if peer.context.session_generation != session.session_generation {
+            return Ok(false);
+        }
+        let mut peer = self
+            .peers
+            .remove(&session.remote_addr)
+            .expect("validated RUDP peer exists");
+        let packet = peer.session.create_disconnect(reason);
+        self.send_packet(session.remote_addr, &packet)?;
+        Ok(true)
+    }
+
+    /// The next event, or `None` only when nothing is waiting on the socket.
+    ///
+    /// Packets that carry no event for the caller — acknowledgements, pings,
+    /// a repeated Connect, a fragment that completes nothing yet — are
+    /// consumed here and reading continues. Returning `None` after one of
+    /// those made a caller that polls once per send fall behind its own
+    /// peers' acknowledgements, and a reliable channel then resent everything.
+    pub fn receive_event_once(&mut self) -> Result<Option<CultNetRudpServerEvent>> {
+        loop {
+            if let Some(event) = self.pending_events.pop_front() {
+                return Ok(Some(event));
+            }
+            if !self.receive_packet_once()? {
+                return Ok(None);
+            }
+        }
+    }
+
+    /// Reads one datagram and applies it. `false` when the socket is empty.
+    fn receive_packet_once(&mut self) -> Result<bool> {
+        let mut wire = vec![0_u8; 65_535];
+        let (received, remote_addr) = match self.socket.recv_from(&mut wire) {
+            Ok(value) => value,
+            Err(error)
+                if error.kind() == ErrorKind::WouldBlock
+                    || error.kind() == ErrorKind::TimedOut
+                    || error.kind() == ErrorKind::ConnectionReset =>
+            {
+                return Ok(false);
+            }
+            Err(error) => return Err(error.into()),
+        };
+        wire.truncate(received);
+        self.stats.bytes_received += received as u64;
+        let packet = decode_rudp_packet(&wire)?;
+        if packet.connection_id != self.connection_id {
+            return Ok(true);
+        }
+
+        if packet.packet_type == CultNetRudpPacketType::Connect {
+            if let Some(peer) = self.peers.get_mut(&remote_addr)
+                && peer.context.connect_payload == packet.payload
+            {
+                let _ = peer.session.receive(&packet, now_ms())?;
+                let reply = peer
+                    .session
+                    .pending_accept_for_resend(now_ms())
+                    .unwrap_or_else(|| peer.session.create_ack());
+                self.send_packet(remote_addr, &reply)?;
+                return Ok(true);
+            }
+            if !self.peers.contains_key(&remote_addr) && self.peers.len() >= self.max_peers {
+                return Err(anyhow!("RUDP server hub peer limit reached"));
+            }
+            let mut session = CultNetRudpSession::new(CultNetRudpSessionOptions {
+                connection_id: self.connection_id,
+                initial_sequence: self.initial_sequence,
+                resend_delay_ms: self.resend_delay_ms,
+                max_pending_reliable_packets: self.max_pending_reliable_packets,
+            });
+            session.set_max_payload_bytes(Some(self.max_payload_bytes));
+            let generation = self.next_session_generation;
+            self.next_session_generation = self
+                .next_session_generation
+                .checked_add(1)
+                .ok_or_else(|| anyhow!("RUDP server session generation exhausted"))?;
+            let context = CultNetRudpServerSessionContext {
+                remote_addr,
+                connection_id: packet.connection_id,
+                session_generation: generation,
+                connect_payload: packet.payload.clone(),
+            };
+            let accept = session.accept_connect(&packet, now_ms(), Vec::new())?;
+            self.send_packet(remote_addr, &accept)?;
+            let replaced = self.peers.insert(
+                remote_addr,
+                CultNetRudpServerPeer {
+                    session,
+                    context: context.clone(),
+                },
+            );
+            if let Some(replaced) = replaced {
+                self.pending_events
+                    .push_back(CultNetRudpServerEvent::Disconnected {
+                        session: replaced.context,
+                        reason: b"replaced by a new Connect generation".to_vec(),
+                    });
+            }
+            self.pending_events
+                .push_back(CultNetRudpServerEvent::Connected { session: context });
+            return Ok(true);
+        }
+
+        let Some(peer) = self.peers.get_mut(&remote_addr) else {
+            return Ok(true);
+        };
+        let result = peer.session.receive(&packet, now_ms())?;
+        let context = peer.context.clone();
+        let ack = if packet.reliable {
+            Some(peer.session.create_ack_for_received(packet.sequence))
+        } else {
+            None
+        };
+        if let Some(reply) = result.reply {
+            self.send_packet(remote_addr, &reply)?;
+        }
+        for ready in result.ready_to_send {
+            self.send_packet(remote_addr, &ready)?;
+        }
+        if let Some(ack) = ack {
+            self.send_packet(remote_addr, &ack)?;
+        }
+        if result.pong {
+            self.pending_events.push_back(CultNetRudpServerEvent::Pong {
+                session: context.clone(),
+                payload: result.pong_payload,
+            });
+        }
+        for delivered in result.delivered {
+            self.stats.frames_received += 1;
+            self.pending_events
+                .push_back(CultNetRudpServerEvent::Frame {
+                    session: context.clone(),
+                    frame: CultNetTransportFrame {
+                        channel_id: delivered.channel_id,
+                        payload: delivered.payload,
+                    },
+                });
+        }
+        if result.disconnected {
+            self.pending_events
+                .push_back(CultNetRudpServerEvent::Disconnected {
+                    session: context,
+                    reason: result.disconnect_reason,
+                });
+            self.peers.remove(&remote_addr);
+        }
+        Ok(true)
+    }
+
+    pub fn poll_resends(&mut self) -> Result<()> {
+        let now = now_ms();
+        let mut packets = Vec::new();
+        for (remote_addr, peer) in &mut self.peers {
+            packets.extend(
+                peer.session
+                    .due_resends(now)
+                    .into_iter()
+                    .map(|packet| (*remote_addr, packet)),
+            );
+        }
+        for (remote_addr, packet) in packets {
+            self.send_packet(remote_addr, &packet)?;
+        }
+        Ok(())
+    }
+
+    pub fn remove_timed_out_sessions(
+        &mut self,
+        timeout_ms: u64,
+    ) -> Vec<CultNetRudpServerSessionContext> {
+        let now = now_ms();
+        let timed_out = self
+            .peers
+            .iter_mut()
+            .filter_map(|(remote_addr, peer)| {
+                peer.session
+                    .check_timeout(now, timeout_ms)
+                    .then_some((*remote_addr, peer.context.clone()))
+            })
+            .collect::<Vec<_>>();
+        for (remote_addr, _) in &timed_out {
+            self.peers.remove(remote_addr);
+        }
+        timed_out.into_iter().map(|(_, context)| context).collect()
+    }
+
+    fn send_packet(&mut self, remote_addr: SocketAddr, packet: &CultNetRudpPacket) -> Result<()> {
+        let wire = encode_rudp_packet(packet)?;
+        let sent = self.socket.send_to(&wire, remote_addr)?;
+        self.stats.bytes_sent += sent as u64;
+        Ok(())
+    }
+}
+
+impl CultNetRudpSocketTransportConnection {
+    pub fn new(options: CultNetRudpSocketTransportOptions) -> Result<Self> {
+        let local_addr = options.socket.local_addr()?;
+        let max_payload_bytes = options
+            .max_payload_bytes
+            .or(Some(CULTNET_RUDP_DEFAULT_MAX_PAYLOAD_BYTES as u32));
+        let profile = create_rudp_transport_profile(
+            options.runtime_id,
+            RudpTransportProfileOptions {
+                media_reliable_expire_after_ms: options.media_reliable_expire_after_ms,
+                media_delivery: options.media_delivery,
+                transport_id: options.transport_id,
+                host: Some(local_addr.ip().to_string()),
+                port: Some(local_addr.port()),
+                max_payload_bytes,
                 max_fragment_bytes: options.max_fragment_bytes,
                 max_pending_reliable_packets: options.max_pending_reliable_packets,
                 reconnect_policy: options.reconnect_policy,
@@ -882,14 +1746,16 @@ impl CultNetRudpSocketTransportConnection {
         let max_pending_reliable_packets = options
             .max_pending_reliable_packets
             .map(|value| value as usize);
+        let mut session = CultNetRudpSession::new(CultNetRudpSessionOptions {
+            connection_id: options.connection_id,
+            initial_sequence: options.initial_sequence,
+            resend_delay_ms: options.resend_delay_ms,
+            max_pending_reliable_packets,
+        });
+        session.set_max_payload_bytes(max_payload_bytes.map(|value| value as usize));
         Ok(Self {
             socket: options.socket,
-            session: CultNetRudpSession::new(CultNetRudpSessionOptions {
-                connection_id: options.connection_id,
-                initial_sequence: options.initial_sequence,
-                resend_delay_ms: options.resend_delay_ms,
-                max_pending_reliable_packets,
-            }),
+            session,
             mode: options.mode,
             remote_addr: options.remote_addr,
             profile,
@@ -906,7 +1772,10 @@ impl CultNetRudpSocketTransportConnection {
     }
 
     pub fn stats(&self) -> CultNetTransportStats {
-        self.stats.clone()
+        let mut stats = self.stats.clone();
+        stats.reliable_packets_expired = self.session.reliable_packets_expired();
+        stats.fragment_sets_evicted = self.session.fragment_sets_evicted();
+        stats
     }
 
     pub fn disconnect_reason(&self) -> Option<&[u8]> {
@@ -928,17 +1797,69 @@ impl CultNetRudpSocketTransportConnection {
     }
 
     pub fn send(&mut self, channel_id: &str, payload: Vec<u8>) -> Result<()> {
-        let options = channel_send_options(channel_id, now_ms());
+        let options =
+            channel_send_options(
+                channel_id,
+                now_ms(),
+                channel_reliable_expire_after_ms(&self.profile, channel_id),
+                channel_delivery(&self.profile, channel_id),
+            );
         let packets =
             self.session
                 .send_many(channel_id, payload, options, self.max_fragment_bytes)?;
-        for packet in packets {
-            self.send_packet(&packet)?;
-        }
+        self.send_data_packets(&packets)?;
         self.stats.frames_sent += 1;
         Ok(())
     }
 
+    /// Sends one frame on a reliable channel whose packets cannot expire and
+    /// returns the transport receipt used to observe its exact acknowledgement.
+    pub fn send_reliable(
+        &mut self,
+        channel_id: &str,
+        payload: Vec<u8>,
+    ) -> Result<CultNetRudpReliableSendReceipt> {
+        let options =
+            channel_send_options(
+                channel_id,
+                now_ms(),
+                channel_reliable_expire_after_ms(&self.profile, channel_id),
+                channel_delivery(&self.profile, channel_id),
+            );
+        // This lineage has no reliable-expiry concept, so every reliable channel is
+        // already non-expiring. Restore the expiry half of this guard if one is added.
+        if !options.reliable {
+            return Err(anyhow!(
+                "RUDP acknowledgement receipts require a non-expiring reliable channel"
+            ));
+        }
+        let packets =
+            self.session
+                .send_many(channel_id, payload, options, self.max_fragment_bytes)?;
+        self.send_data_packets(&packets)?;
+        let receipt = self.session.non_expiring_reliable_receipt(&packets)?;
+        self.stats.frames_sent += 1;
+        Ok(receipt)
+    }
+
+    pub fn reliable_send_status(
+        &self,
+        receipt: &CultNetRudpReliableSendReceipt,
+    ) -> CultNetRudpReliableSendStatus {
+        self.session.reliable_send_status(receipt)
+    }
+
+    fn send_data_packets(&mut self, packets: &[CultNetRudpPacket]) -> Result<()> {
+        let fragmented = packets.len() > 1;
+        for (index, packet) in packets.iter().enumerate() {
+            self.send_packet(packet)?;
+            if fragmented && (index + 1) % 16 == 0 {
+                thread::sleep(Duration::from_millis(1));
+            }
+        }
+        Ok(())
+    }
+
     pub fn send_schema_message(&mut self, message: &CultNetMessage) -> Result<()> {
         let payload = encode_cultnet_message_to_vec(message, CultNetWireContract::CultNetSchemaV0)?;
         self.send("schema", payload)
@@ -974,51 +1895,122 @@ impl CultNetRudpSocketTransportConnection {
         self.session.check_timeout(now_ms(), timeout_ms)
     }
 
-    pub fn receive_once(&mut self) -> Result<Option<CultNetTransportFrame>> {
-        if let Some(frame) = self.delivered_frames.pop_front() {
-            return Ok(Some(frame));
-        }
+    pub fn pending_reliable_packet_count(&self) -> usize {
+        self.session.pending_reliable_sequences().len()
+    }
 
+    pub fn outstanding_reliable_packet_count(&self) -> usize {
+        self.session.outstanding_reliable_packet_count()
+    }
+
+    pub fn flush_reliable(&mut self, timeout: Duration) -> Result<()> {
+        let original_timeout = self.socket.read_timeout()?;
+        let poll_timeout = original_timeout
+            .map(|configured| configured.min(Duration::from_millis(10)))
+            .unwrap_or(Duration::from_millis(10));
+        self.socket.set_read_timeout(Some(poll_timeout))?;
+
+        let deadline = Instant::now() + timeout;
+        let mut preserved_frames = VecDeque::new();
+        let result = (|| {
+            while self.outstanding_reliable_packet_count() > 0 {
+                if Instant::now() >= deadline {
+                    return Err(anyhow!(
+                        "RUDP reliable flush timed out with {} packets outstanding",
+                        self.outstanding_reliable_packet_count()
+                    ));
+                }
+                if let Some(frame) = self.receive_once()? {
+                    preserved_frames.push_back(frame);
+                }
+                self.poll_resends()?;
+            }
+            Ok(())
+        })();
+
+        preserved_frames.append(&mut self.delivered_frames);
+        self.delivered_frames = preserved_frames;
+        let restore = self.socket.set_read_timeout(original_timeout);
+        match (result, restore) {
+            (Err(error), _) => Err(error),
+            (Ok(()), Err(error)) => Err(error.into()),
+            (Ok(()), Ok(())) => Ok(()),
+        }
+    }
+
+    /// The next delivered frame, or `None` only when nothing is waiting on
+    /// the socket. Acknowledgements, pongs and incomplete fragments are
+    /// consumed and reading continues; see the hub's `receive_event_once`.
+    pub fn receive_once(&mut self) -> Result<Option<CultNetTransportFrame>> {
+        loop {
+            if let Some(frame) = self.delivered_frames.pop_front() {
+                return Ok(Some(frame));
+            }
+            if !self.receive_packet_once()? {
+                return Ok(None);
+            }
+        }
+    }
+
+    /// Reads one datagram and applies it. `false` when the socket is empty
+    /// or the session has been disconnected.
+    fn receive_packet_once(&mut self) -> Result<bool> {
         let mut wire = vec![0_u8; 65_535];
         let (received, remote_addr) = match self.socket.recv_from(&mut wire) {
             Ok(value) => value,
             Err(error)
-                if error.kind() == ErrorKind::WouldBlock || error.kind() == ErrorKind::TimedOut =>
+                if error.kind() == ErrorKind::WouldBlock
+                    || error.kind() == ErrorKind::TimedOut
+                    || error.kind() == ErrorKind::ConnectionReset =>
             {
-                return Ok(None);
+                return Ok(false);
             }
             Err(error) => return Err(error.into()),
         };
         wire.truncate(received);
         self.stats.bytes_received += received as u64;
 
+        let packet = decode_rudp_packet(&wire)?;
         if let Some(expected) = self.remote_addr {
             if expected != remote_addr {
-                return Ok(None);
+                if self.mode == CultNetRudpSocketMode::Server
+                    && packet.packet_type == CultNetRudpPacketType::Connect
+                {
+                    self.remote_addr = Some(remote_addr);
+                } else {
+                    return Ok(true);
+                }
             }
         } else {
+            if self.mode == CultNetRudpSocketMode::Server
+                && packet.packet_type != CultNetRudpPacketType::Connect
+            {
+                return Ok(true);
+            }
             self.remote_addr = Some(remote_addr);
         }
-
-        let packet = decode_rudp_packet(&wire)?;
         if self.mode == CultNetRudpSocketMode::Server
             && packet.packet_type == CultNetRudpPacketType::Connect
         {
+            self.session.reset_peer_state();
             let accept = self.session.accept_connect(&packet, now_ms(), Vec::new())?;
             self.send_packet(&accept)?;
-            return Ok(None);
+            return Ok(true);
         }
 
         let result = self.session.receive(&packet, now_ms())?;
         if let Some(reply) = result.reply {
             self.send_packet(&reply)?;
         }
+        for ready in result.ready_to_send {
+            self.send_packet(&ready)?;
+        }
         if result.pong {
             self.pong_payloads.push_back(result.pong_payload);
         }
         if result.disconnected {
             self.disconnect_reason = Some(result.disconnect_reason);
-            return Ok(None);
+            return Ok(false);
         }
 
         for frame in result.delivered {
@@ -1028,12 +2020,14 @@ impl CultNetRudpSocketTransportConnection {
             });
             self.stats.frames_received += 1;
         }
-        let frame = self.delivered_frames.pop_front();
-        if packet.packet_type == CultNetRudpPacketType::Accept || frame.is_some() {
-            let ack = self.session.create_ack();
+        // Only what the sender is waiting on is acknowledged. An unreliable
+        // frame carries no sequence, so an ACK for it tells the sender
+        // nothing and costs it one datagram to read for every one it sent.
+        if packet.reliable || packet.packet_type == CultNetRudpPacketType::Accept {
+            let ack = self.session.create_ack_for_received(packet.sequence);
             self.send_packet(&ack)?;
         }
-        Ok(frame)
+        Ok(true)
     }
 
     pub fn poll_resends(&mut self) -> Result<()> {
@@ -1157,6 +2151,9 @@ pub struct RudpTransportProfileOptions {
     pub max_fragment_bytes: Option<u32>,
     pub max_pending_reliable_packets: Option<u32>,
     pub reconnect_policy: Option<CultNetReconnectPolicy>,
+    pub media_reliable_expire_after_ms: Option<u64>,
+    /// `None` means the historical default, `Reliable`.
+    pub media_delivery: Option<CultNetTransportDelivery>,
 }
 
 pub fn create_rudp_transport_profile(
@@ -1187,6 +2184,7 @@ pub fn create_rudp_transport_profile(
                     max_payload_bytes: options.max_payload_bytes,
                     max_fragment_bytes: options.max_fragment_bytes,
                     max_pending_reliable_packets: options.max_pending_reliable_packets,
+                    reliable_expire_after_ms: None,
                 },
                 CultNetTransportChannel {
                     channel_id: "latest".to_string(),
@@ -1195,6 +2193,7 @@ pub fn create_rudp_transport_profile(
                     max_payload_bytes: options.max_payload_bytes,
                     max_fragment_bytes: options.max_fragment_bytes,
                     max_pending_reliable_packets: options.max_pending_reliable_packets,
+                    reliable_expire_after_ms: None,
                 },
                 CultNetTransportChannel {
                     channel_id: "realtime".to_string(),
@@ -1203,14 +2202,29 @@ pub fn create_rudp_transport_profile(
                     max_payload_bytes: options.max_payload_bytes,
                     max_fragment_bytes: options.max_fragment_bytes,
                     max_pending_reliable_packets: options.max_pending_reliable_packets,
+                    reliable_expire_after_ms: None,
                 },
                 CultNetTransportChannel {
                     channel_id: "media".to_string(),
+                    delivery: options
+                        .media_delivery
+                        .unwrap_or(CultNetTransportDelivery::Reliable),
+                    ordering: CultNetTransportOrdering::Unordered,
+                    max_payload_bytes: options.max_payload_bytes,
+                    max_fragment_bytes: options.max_fragment_bytes,
+                    max_pending_reliable_packets: options.max_pending_reliable_packets,
+                    reliable_expire_after_ms: options.media_reliable_expire_after_ms,
+                },
+                // Audio beside lossy video on one session: reliable, but a packet
+                // older than the media expiry is not worth a retransmit.
+                CultNetTransportChannel {
+                    channel_id: "audio".to_string(),
                     delivery: CultNetTransportDelivery::Reliable,
                     ordering: CultNetTransportOrdering::Unordered,
                     max_payload_bytes: options.max_payload_bytes,
                     max_fragment_bytes: options.max_fragment_bytes,
                     max_pending_reliable_packets: options.max_pending_reliable_packets,
+                    reliable_expire_after_ms: options.media_reliable_expire_after_ms,
                 },
             ],
         }],
@@ -1319,31 +2333,77 @@ fn packet_type_to_code(packet_type: CultNetRudpPacketType) -> u8 {
     }
 }
 
-fn channel_send_options(channel_id: &str, now_ms: u64) -> CultNetRudpSendOptions {
+/// The advertised profile owns each channel's expiry. Resolving it here keeps
+/// one answer for what a channel does, rather than a runtime field that can
+/// disagree with the profile the peer was shown.
+fn channel_reliable_expire_after_ms(
+    profile: &CultNetTransportProfile,
+    channel_id: &str,
+) -> Option<u64> {
+    profile
+        .transports
+        .iter()
+        .flat_map(|transport| transport.channels.iter())
+        .find(|channel| channel.channel_id == channel_id)
+        .and_then(|channel| channel.reliable_expire_after_ms)
+}
+
+/// The advertised profile owns each channel's delivery, for the same reason it
+/// owns expiry: a send path that hardcodes reliability can disagree with the
+/// profile the peer was shown, and then no one can say what the channel does.
+///
+/// Falls back to `Reliable` for a channel the profile does not describe, which
+/// is what every channel got before delivery was configurable.
+fn channel_delivery(
+    profile: &CultNetTransportProfile,
+    channel_id: &str,
+) -> CultNetTransportDelivery {
+    profile
+        .transports
+        .iter()
+        .flat_map(|transport| transport.channels.iter())
+        .find(|channel| channel.channel_id == channel_id)
+        .map(|channel| channel.delivery)
+        .unwrap_or(CultNetTransportDelivery::Reliable)
+}
+
+fn channel_send_options(
+    channel_id: &str,
+    now_ms: u64,
+    reliable_expire_after_ms: Option<u64>,
+    delivery: CultNetTransportDelivery,
+) -> CultNetRudpSendOptions {
     match channel_id {
         "schema" => CultNetRudpSendOptions {
             reliable: true,
             ordered: true,
             sequenced: false,
             now_ms,
+            reliable_expire_after_ms: None,
         },
         "latest" => CultNetRudpSendOptions {
             reliable: false,
             ordered: false,
             sequenced: true,
             now_ms,
+            reliable_expire_after_ms: None,
         },
-        "media" => CultNetRudpSendOptions {
-            reliable: true,
+        // The one channel whose delivery a caller chooses. Media that has gone
+        // stale is worth dropping, not retransmitting: a reliable media channel
+        // under loss adds load exactly when the link has least to give.
+        "media" | "audio" => CultNetRudpSendOptions {
+            reliable: matches!(delivery, CultNetTransportDelivery::Reliable),
             ordered: false,
             sequenced: false,
             now_ms,
+            reliable_expire_after_ms,
         },
         _ => CultNetRudpSendOptions {
             reliable: false,
             ordered: false,
             sequenced: false,
             now_ms,
+            reliable_expire_after_ms: None,
         },
     }
 }
diff --git a/packages/cultnet-rs/src/runtime_authority_contracts.rs b/packages/cultnet-rs/src/runtime_authority_contracts.rs
new file mode 100644
index 00000000..426be1fb
--- /dev/null
+++ b/packages/cultnet-rs/src/runtime_authority_contracts.rs
@@ -0,0 +1,3309 @@
+use anyhow::{Context, Result, bail, ensure};
+use cultcache_rs::DatabaseEntry;
+use ed25519_dalek::{Signature, Signer, SigningKey, Verifier, VerifyingKey};
+use rand::RngCore;
+use serde::{Deserialize, Serialize};
+use sha2::{Digest, Sha256};
+use std::io::{Read, Write};
+use zeroize::Zeroizing;
+
+pub const GAMECULT_RUNTIME_PRESENCE_HEALTH_SCHEMA: &str = "gamecult.runtime_presence_health.v2";
+pub const GAMECULT_RUNTIME_PRESENCE_HEALTH_SIGNING_PURPOSE: &str =
+    "gamecult.runtime_presence_health.v2";
+pub const GAMECULT_RUNTIME_ACTIVATION_PROOF_SIGNING_PURPOSE: &str =
+    "gamecult.runtime_presence.activation-proof.v1";
+pub const IDUNN_RUNTIME_ACTIVATION_SCHEMA: &str = "idunn.runtime_activation.v2";
+pub const IDUNN_RUNTIME_ACTIVATION_SIGNING_PURPOSE: &str = "idunn.runtime_activation.v2";
+pub const IDUNN_RUNTIME_ACTIVATION_CREDENTIAL_NAME: &str = "gamecult-idunn-runtime-activation-key";
+pub const IDUNN_PROCESS_WRITE_LEASE_SCHEMA: &str = "idunn.process_write_lease.v1";
+pub const IDUNN_EXPECTED_INCARNATION_SCHEMA: &str = "idunn.expected_incarnation.v2";
+pub const ODIN_RUNTIME_TOPOLOGY_CORRELATION_SCHEMA: &str = "odin.runtime_topology_correlation.v2";
+pub const ODIN_RUNTIME_TOPOLOGY_CORRELATION_SIGNING_PURPOSE: &str =
+    "odin.runtime_topology_correlation.v2";
+
+const MAX_RUNTIME_CAPABILITIES: usize = 256;
+const MAX_RUNTIME_DEPENDENCIES: usize = 256;
+const MAX_TOPOLOGY_DISAGREEMENTS: usize = 256;
+const IDUNN_RUNTIME_ACTIVATION_ID_DOMAIN: &[u8] = b"idunn.runtime-activation.id.v1\0";
+const IDUNN_RUNTIME_ACTIVATION_SIGNATURE_DOMAIN: &[u8] = b"idunn.runtime-activation.signature.v1\0";
+
+/// One provider-owned capability claim inside a runtime-presence statement.
+/// The enclosing vector is canonical only when these records are strictly
+/// increasing by `(capability, schema, compatibility)`. Capacity describes
+/// that one claim and does not create a second identity for the same claim.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct GameCultRuntimeCapability {
+    pub capability: String,
+    pub schema: String,
+    pub compatibility: String,
+    pub capacity: u32,
+}
+
+impl GameCultRuntimeCapability {
+    fn identity(&self) -> (&str, &str, &str) {
+        (&self.capability, &self.schema, &self.compatibility)
+    }
+}
+
+/// Idunn's admitted requirement for one provider-owned runtime capability.
+/// The provider reports actual capacity in `GameCultRuntimeCapability`; this
+/// record states only the minimum needed for this incarnation to be Ready.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct IdunnExpectedCapability {
+    pub capability: String,
+    pub schema: String,
+    pub compatibility: String,
+    pub minimum_capacity: u32,
+}
+
+impl IdunnExpectedCapability {
+    fn identity(&self) -> (&str, &str, &str) {
+        (&self.capability, &self.schema, &self.compatibility)
+    }
+}
+
+/// Dual-proved claim from one exact runtime launch. The stable provider key and
+/// Idunn's activation-scoped ephemeral key both sign `canonical_proof_payload`:
+/// the canonical positional encoding of this complete record with both proof
+/// byte fields empty. Present authority requires a matching Idunn-published
+/// current activation; neither proof can establish admission by itself.
+#[derive(Clone, Debug, PartialEq, Eq, DatabaseEntry)]
+#[cultcache(
+    type = "gamecult.runtime_presence_health",
+    schema = "gamecult.runtime_presence_health.v2"
+)]
+pub struct GameCultRuntimePresenceHealthRecord {
+    #[cultcache(key = 0)]
+    pub schema_version: String,
+    #[cultcache(key = 1)]
+    pub target: String,
+    #[cultcache(key = 2)]
+    pub expected_projection_sha256: String,
+    #[cultcache(key = 3)]
+    pub plan_id: String,
+    #[cultcache(key = 4)]
+    pub incarnation_id: String,
+    #[cultcache(key = 5)]
+    pub sealed_release_id: String,
+    #[cultcache(key = 6)]
+    pub activation_witness_sha256: String,
+    #[cultcache(key = 7)]
+    pub state_schema_generation: Option<String>,
+    #[cultcache(key = 8)]
+    pub state_contract_sha256: Option<String>,
+    #[cultcache(key = 9)]
+    pub runtime_id: String,
+    #[cultcache(key = 10)]
+    pub runtime_instance_id: String,
+    #[cultcache(key = 11)]
+    pub bound_endpoint: Option<String>,
+    #[cultcache(key = 12)]
+    pub capabilities: Vec<GameCultRuntimeCapability>,
+    #[cultcache(key = 13)]
+    pub health_contract: String,
+    #[cultcache(key = 14)]
+    pub state: String,
+    #[cultcache(key = 15)]
+    pub detail: String,
+    #[cultcache(key = 16)]
+    pub write_lease_sha256: Option<String>,
+    #[cultcache(key = 17)]
+    pub signer_identity_id: String,
+    #[cultcache(key = 18)]
+    pub publisher_sequence: u64,
+    #[cultcache(key = 19)]
+    pub observed_at_unix_millis: u64,
+    #[cultcache(key = 20)]
+    pub signature_algorithm: String,
+    #[cultcache(key = 21, bytes)]
+    pub signature: Vec<u8>,
+    #[cultcache(key = 22)]
+    pub activation_signer_identity_id: String,
+    #[cultcache(key = 23, bytes)]
+    pub activation_signature: Vec<u8>,
+}
+
+impl GameCultRuntimePresenceHealthRecord {
+    /// Return the one canonical payload covered by both the stable provider
+    /// signature and the activation-scoped proof. Both signature fields are
+    /// empty in these bytes, avoiding circular signatures while binding every
+    /// authority-bearing statement field and both signer identities.
+    pub fn canonical_proof_payload(&self) -> Result<Vec<u8>> {
+        self.validate_shape(true)?;
+        let mut unsigned = self.clone();
+        unsigned.signature.clear();
+        unsigned.activation_signature.clear();
+        Ok(rmp_serde::to_vec(&unsigned)?)
+    }
+
+    /// Digest the complete signed presence record for an Odin correlation
+    /// receipt. An unsigned construction value is deliberately not digestible.
+    pub fn canonical_sha256(&self) -> Result<String> {
+        self.validate()?;
+        Ok(prefixed_sha256(&rmp_serde::to_vec(self)?))
+    }
+
+    pub fn validate(&self) -> Result<()> {
+        self.validate_shape(false)
+    }
+
+    fn validate_shape(&self, allow_unsigned: bool) -> Result<()> {
+        if self.schema_version != GAMECULT_RUNTIME_PRESENCE_HEALTH_SCHEMA {
+            bail!("runtime presence schema is unsupported");
+        }
+        validate_authority_identifier(&self.target, "target")?;
+        validate_required_sha256(
+            &self.expected_projection_sha256,
+            "expected projection sha256",
+        )?;
+        validate_required_sha256(&self.plan_id, "plan id")?;
+        validate_authority_identifier(&self.incarnation_id, "incarnation id")?;
+        validate_required_sha256(&self.sealed_release_id, "sealed release id")?;
+        validate_required_sha256(&self.activation_witness_sha256, "activation witness sha256")?;
+        match (&self.state_schema_generation, &self.state_contract_sha256) {
+            (Some(generation), Some(contract_sha256)) => {
+                validate_authority_identifier(generation, "state schema generation")?;
+                validate_required_sha256(contract_sha256, "state contract sha256")?;
+            }
+            (None, None) => {}
+            _ => bail!("runtime presence state lineage is partial"),
+        }
+        validate_authority_identifier(&self.runtime_id, "runtime id")?;
+        validate_required_sha256(&self.runtime_instance_id, "runtime instance id")?;
+        validate_optional_endpoint(&self.bound_endpoint)?;
+        validate_runtime_capabilities(&self.capabilities)?;
+        validate_authority_identifier(&self.health_contract, "health contract")?;
+        validate_authority_identifier(&self.signer_identity_id, "signer identity id")?;
+        validate_authority_identifier(
+            &self.activation_signer_identity_id,
+            "activation signer identity id",
+        )?;
+        validate_optional_sha256(&self.write_lease_sha256, "write lease sha256")?;
+
+        let signature_is_valid =
+            self.signature.len() == 64 || (allow_unsigned && self.signature.is_empty());
+        let activation_signature_is_valid = self.activation_signature.len() == 64
+            || (allow_unsigned && self.activation_signature.is_empty());
+        if self.publisher_sequence == 0
+            || self.observed_at_unix_millis == 0
+            || !matches!(
+                self.state.as_str(),
+                "warming" | "active" | "degraded" | "failed"
+            )
+            || self.detail.len() > 512
+            || self.detail.chars().any(char::is_control)
+            || self.signature_algorithm != "ed25519"
+            || !signature_is_valid
+            || !activation_signature_is_valid
+        {
+            bail!("runtime presence state, sequence, detail, or signature is invalid");
+        }
+        if self.state == "warming" && self.write_lease_sha256.is_some() {
+            bail!("warming runtime presence cannot claim a process write lease");
+        }
+        if self.state_schema_generation.is_none() && self.write_lease_sha256.is_some() {
+            bail!("stateless runtime presence cannot claim a process write lease");
+        }
+        Ok(())
+    }
+}
+
+/// Public route facts admitted for one incarnation. These are service-facing
+/// endpoints only; actuator paths, unit files, container sockets, and runner
+/// credentials do not belong in the Expected projection.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct IdunnExpectedRoute {
+    pub route_id: String,
+    pub transport: String,
+    pub stable_endpoint: String,
+    pub candidate_endpoint: String,
+}
+
+impl IdunnExpectedRoute {
+    fn validate(&self) -> Result<()> {
+        validate_authority_identifier(&self.route_id, "route id")?;
+        validate_endpoint(&self.stable_endpoint, "stable route endpoint")?;
+        validate_endpoint(&self.candidate_endpoint, "candidate route endpoint")?;
+        if self.stable_endpoint == self.candidate_endpoint {
+            bail!("stable and candidate route endpoints are identical");
+        }
+        match self.transport.as_str() {
+            "http" => {
+                if !(self.stable_endpoint.starts_with("http://")
+                    || self.stable_endpoint.starts_with("https://"))
+                    || !self.candidate_endpoint.starts_with("http://")
+                {
+                    bail!("HTTP route endpoints use an unsupported scheme");
+                }
+            }
+            "tcp" => {
+                if !self.stable_endpoint.starts_with("tcp://")
+                    || !self.candidate_endpoint.starts_with("tcp://")
+                {
+                    bail!("TCP route endpoints use an unsupported scheme");
+                }
+            }
+            "rudp" => {
+                if !self.stable_endpoint.starts_with("rudp://")
+                    || !self.candidate_endpoint.starts_with("rudp://")
+                {
+                    bail!("RUDP route endpoints use an unsupported scheme");
+                }
+            }
+            _ => bail!("route transport is unsupported"),
+        }
+        Ok(())
+    }
+}
+
+/// One capability requirement and Idunn's exact admitted provider selection.
+/// Provider fields are all absent while unresolved. Managed providers bind an
+/// Expected digest; external operator bindings instead bind an endpoint.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct IdunnExpectedDependency {
+    pub kind: String,
+    pub capability: String,
+    pub schema: String,
+    pub compatibility: String,
+    pub minimum_capacity: u32,
+    pub startup: String,
+    pub provider_id: Option<String>,
+    pub provider_authority: Option<String>,
+    pub provider_expected_projection_sha256: Option<String>,
+    pub provider_endpoint: Option<String>,
+}
+
+impl IdunnExpectedDependency {
+    fn identity(&self) -> (&str, &str, &str) {
+        (&self.capability, &self.schema, &self.compatibility)
+    }
+
+    fn validate(&self) -> Result<()> {
+        if !matches!(
+            self.kind.as_str(),
+            "bootstrap"
+                | "required"
+                | "optional"
+                | "shared-infrastructure"
+                | "private"
+                | "external-operator-binding"
+        ) {
+            bail!("dependency kind is unsupported");
+        }
+        validate_authority_identifier(&self.capability, "dependency capability")?;
+        validate_authority_identifier(&self.schema, "dependency schema")?;
+        validate_authority_identifier(&self.compatibility, "dependency compatibility")?;
+        if self.minimum_capacity == 0
+            || !matches!(self.startup.as_str(), "before-start" | "before-promotion")
+        {
+            bail!("dependency capacity or startup condition is invalid");
+        }
+        if self.kind == "bootstrap" && self.startup != "before-start" {
+            bail!("bootstrap dependency must be satisfied before start");
+        }
+        validate_optional_identifier(&self.provider_id, "dependency provider id")?;
+        validate_optional_identifier(&self.provider_authority, "dependency provider authority")?;
+        validate_optional_sha256(
+            &self.provider_expected_projection_sha256,
+            "dependency provider expected projection sha256",
+        )?;
+        validate_optional_endpoint_labeled(
+            &self.provider_endpoint,
+            "dependency provider endpoint",
+        )?;
+
+        match (
+            &self.provider_id,
+            &self.provider_authority,
+            &self.provider_expected_projection_sha256,
+            &self.provider_endpoint,
+        ) {
+            (None, None, None, None) => {}
+            (Some(_), Some(authority), Some(_), _) if authority == "managed-incarnation" => {
+                if self.kind == "external-operator-binding" {
+                    bail!("external operator dependency cannot select a managed incarnation");
+                }
+            }
+            (Some(_), Some(authority), None, Some(_))
+                if authority == "external-operator-binding"
+                    && self.kind == "external-operator-binding" => {}
+            _ => bail!("dependency provider binding is partial or authority-incoherent"),
+        }
+        Ok(())
+    }
+}
+
+/// Idunn-owned desired deployment identity published into CultMesh before
+/// promotion. It describes the admitted incarnation and its public contracts,
+/// never the private details needed to execute it on a particular host.
+#[derive(Clone, Debug, PartialEq, Eq, DatabaseEntry)]
+#[cultcache(
+    type = "idunn.expected_incarnation",
+    schema = "idunn.expected_incarnation.v2"
+)]
+pub struct IdunnExpectedIncarnationRecord {
+    #[cultcache(key = 0)]
+    pub schema_version: String,
+    #[cultcache(key = 1)]
+    pub target: String,
+    #[cultcache(key = 2)]
+    pub plan_id: String,
+    #[cultcache(key = 3)]
+    pub incarnation_id: String,
+    #[cultcache(key = 4)]
+    pub sealed_release_id: String,
+    #[cultcache(key = 5)]
+    pub source_repository: String,
+    #[cultcache(key = 6)]
+    pub source_revision: String,
+    #[cultcache(key = 7)]
+    pub recipe_sha256: String,
+    #[cultcache(key = 8)]
+    pub runtime_id: String,
+    #[cultcache(key = 9)]
+    pub expected_signer_identity_id: String,
+    #[cultcache(key = 10)]
+    pub health_contract: String,
+    #[cultcache(key = 11)]
+    pub artifact_sha256: String,
+    #[cultcache(key = 12)]
+    pub state_schema_generation: Option<String>,
+    #[cultcache(key = 13)]
+    pub state_contract_sha256: Option<String>,
+    #[cultcache(key = 14)]
+    pub write_lease_required: bool,
+    #[cultcache(key = 15)]
+    pub route: Option<IdunnExpectedRoute>,
+    #[cultcache(key = 16)]
+    pub capabilities: Vec<IdunnExpectedCapability>,
+    #[cultcache(key = 17)]
+    pub dependencies: Vec<IdunnExpectedDependency>,
+}
+
+impl IdunnExpectedIncarnationRecord {
+    pub fn decode_canonical(payload: &[u8]) -> Result<Self> {
+        if messagepack_array_len(payload) != Some(18) {
+            bail!("expected incarnation is not the 18-field positional contract");
+        }
+        let expected: Self =
+            rmp_serde::from_slice(payload).context("decoding expected incarnation")?;
+        if rmp_serde::to_vec(&expected)? != payload {
+            bail!("expected incarnation is not canonical positional MessagePack");
+        }
+        expected.validate()?;
+        Ok(expected)
+    }
+
+    pub fn canonical_bytes(&self) -> Result<Vec<u8>> {
+        self.validate()?;
+        Ok(rmp_serde::to_vec(self)?)
+    }
+
+    pub fn canonical_sha256(&self) -> Result<String> {
+        Ok(prefixed_sha256(&self.canonical_bytes()?))
+    }
+
+    pub fn validate(&self) -> Result<()> {
+        if self.schema_version != IDUNN_EXPECTED_INCARNATION_SCHEMA {
+            bail!("expected incarnation schema is unsupported");
+        }
+        validate_authority_identifier(&self.target, "target")?;
+        validate_required_sha256(&self.plan_id, "plan id")?;
+        validate_authority_identifier(&self.incarnation_id, "incarnation id")?;
+        validate_required_sha256(&self.sealed_release_id, "sealed release id")?;
+        validate_source_repository(&self.source_repository)?;
+        if !is_lower_hex(&self.source_revision, 40) {
+            bail!("source revision is not a lowercase Git object id");
+        }
+        validate_required_sha256(&self.recipe_sha256, "recipe sha256")?;
+        validate_authority_identifier(&self.runtime_id, "runtime id")?;
+        validate_authority_identifier(
+            &self.expected_signer_identity_id,
+            "expected signer identity id",
+        )?;
+        validate_authority_identifier(&self.health_contract, "health contract")?;
+        validate_required_sha256(&self.artifact_sha256, "artifact sha256")?;
+        match (&self.state_schema_generation, &self.state_contract_sha256) {
+            (Some(generation), Some(contract_sha256)) => {
+                validate_authority_identifier(generation, "state schema generation")?;
+                validate_required_sha256(contract_sha256, "state contract sha256")?;
+            }
+            (None, None) => {}
+            _ => bail!("expected incarnation state lineage is partial"),
+        }
+        if self.write_lease_required && self.state_schema_generation.is_none() {
+            bail!("stateless incarnation cannot require a process write lease");
+        }
+        if let Some(route) = &self.route {
+            route.validate()?;
+        }
+        validate_expected_capabilities(&self.capabilities)?;
+        validate_expected_dependencies(&self.dependencies)?;
+        Ok(())
+    }
+}
+
+/// Odin's observation of one dependency selected in the bound Expected
+/// projection. Evidence digests identify the signed/provider-owned facts Odin
+/// used; they do not copy those facts into Odin authority.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct OdinRuntimeDependencyEvidence {
+    pub kind: String,
+    pub capability: String,
+    pub schema: String,
+    pub compatibility: String,
+    pub provider_id: Option<String>,
+    pub provider_authority: Option<String>,
+    pub provider_expected_projection_sha256: Option<String>,
+    pub provider_endpoint: Option<String>,
+    pub observed_capacity: Option<u32>,
+    pub provider_evidence_sha256: Option<String>,
+    pub ready: bool,
+}
+
+impl OdinRuntimeDependencyEvidence {
+    fn identity(&self) -> (&str, &str, &str) {
+        (&self.capability, &self.schema, &self.compatibility)
+    }
+
+    fn validate(&self) -> Result<()> {
+        if !matches!(
+            self.kind.as_str(),
+            "bootstrap"
+                | "required"
+                | "optional"
+                | "shared-infrastructure"
+                | "private"
+                | "external-operator-binding"
+        ) {
+            bail!("dependency evidence kind is unsupported");
+        }
+        validate_authority_identifier(&self.kind, "dependency evidence kind")?;
+        validate_authority_identifier(&self.capability, "dependency evidence capability")?;
+        validate_authority_identifier(&self.schema, "dependency evidence schema")?;
+        validate_authority_identifier(&self.compatibility, "dependency evidence compatibility")?;
+        validate_optional_identifier(&self.provider_id, "dependency evidence provider id")?;
+        validate_optional_identifier(
+            &self.provider_authority,
+            "dependency evidence provider authority",
+        )?;
+        validate_optional_sha256(
+            &self.provider_expected_projection_sha256,
+            "dependency evidence provider expected projection sha256",
+        )?;
+        validate_optional_endpoint_labeled(
+            &self.provider_endpoint,
+            "dependency evidence provider endpoint",
+        )?;
+        validate_optional_sha256(
+            &self.provider_evidence_sha256,
+            "dependency provider evidence sha256",
+        )?;
+        if self.observed_capacity == Some(0) {
+            bail!("dependency evidence capacity is zero");
+        }
+        if self.provider_id.is_none()
+            && (self.provider_authority.is_some()
+                || self.provider_expected_projection_sha256.is_some()
+                || self.provider_endpoint.is_some()
+                || self.observed_capacity.is_some()
+                || self.provider_evidence_sha256.is_some()
+                || self.ready)
+        {
+            bail!("dependency evidence has facts without a provider");
+        }
+        if self.provider_id.is_some() && self.provider_authority.is_none() {
+            bail!("dependency evidence provider authority is missing");
+        }
+        match (
+            &self.provider_id,
+            &self.provider_authority,
+            &self.provider_expected_projection_sha256,
+            &self.provider_endpoint,
+        ) {
+            (None, None, None, None) => {}
+            (Some(_), Some(authority), Some(_), _) if authority == "managed-incarnation" => {
+                if self.kind == "external-operator-binding" {
+                    bail!("external dependency evidence names a managed incarnation");
+                }
+            }
+            (Some(_), Some(authority), None, Some(_))
+                if authority == "external-operator-binding"
+                    && self.kind == "external-operator-binding" => {}
+            _ => bail!("dependency evidence provider binding is authority-incoherent"),
+        }
+        if self.ready
+            && (self.observed_capacity.is_none() || self.provider_evidence_sha256.is_none())
+        {
+            bail!("ready dependency lacks capacity or signed evidence");
+        }
+        Ok(())
+    }
+}
+
+/// One explicit Expected/observed disagreement. Codes are unique and sorted so
+/// the signed receipt has one canonical explanation for each disagreement.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct OdinTopologyDisagreement {
+    pub code: String,
+    pub expected: Option<String>,
+    pub observed: Option<String>,
+}
+
+impl OdinTopologyDisagreement {
+    fn validate(&self) -> Result<()> {
+        validate_authority_identifier(&self.code, "topology disagreement code")?;
+        validate_optional_detail(&self.expected, "topology disagreement expected value")?;
+        validate_optional_detail(&self.observed, "topology disagreement observed value")?;
+        if self.expected.is_none() && self.observed.is_none() {
+            bail!("topology disagreement carries no expected or observed value");
+        }
+        Ok(())
+    }
+}
+
+/// Odin-owned signed correlation of Idunn's exact Expected projection with
+/// current Idunn activation and provider-signed presence. Presence state and
+/// write-lease observation remain explicit so an opaque Ready bit cannot cross
+/// Idunn's warming/fencing boundary. The signature covers the canonical
+/// positional encoding with `signature` empty.
+#[derive(Clone, Debug, PartialEq, Eq, DatabaseEntry)]
+#[cultcache(
+    type = "odin.runtime_topology_correlation",
+    schema = "odin.runtime_topology_correlation.v2"
+)]
+pub struct OdinRuntimeTopologyCorrelationRecord {
+    #[cultcache(key = 0)]
+    pub schema_version: String,
+    #[cultcache(key = 1)]
+    pub target: String,
+    #[cultcache(key = 2)]
+    pub expected_projection_sha256: String,
+    #[cultcache(key = 3)]
+    pub expected: bool,
+    #[cultcache(key = 4)]
+    pub current_activation_sha256: Option<String>,
+    #[cultcache(key = 5)]
+    pub signed_presence_sha256: Option<String>,
+    #[cultcache(key = 6)]
+    pub observed_presence_state: Option<String>,
+    #[cultcache(key = 7)]
+    pub observed_presence_publisher_sequence: Option<u64>,
+    #[cultcache(key = 8)]
+    pub observed_write_lease_sha256: Option<String>,
+    #[cultcache(key = 9)]
+    pub observed_capabilities: Vec<GameCultRuntimeCapability>,
+    #[cultcache(key = 10)]
+    pub runtime_id: String,
+    #[cultcache(key = 11)]
+    pub runtime_instance_id: Option<String>,
+    #[cultcache(key = 12)]
+    pub present: bool,
+    #[cultcache(key = 13)]
+    pub ready: bool,
+    #[cultcache(key = 14)]
+    pub dependencies: Vec<OdinRuntimeDependencyEvidence>,
+    #[cultcache(key = 15)]
+    pub disagreements: Vec<OdinTopologyDisagreement>,
+    #[cultcache(key = 16)]
+    pub signer_identity_id: String,
+    #[cultcache(key = 17)]
+    pub publisher_sequence: u64,
+    #[cultcache(key = 18)]
+    pub observed_at_unix_millis: u64,
+    #[cultcache(key = 19)]
+    pub signature_algorithm: String,
+    #[cultcache(key = 20, bytes)]
+    pub signature: Vec<u8>,
+}
+
+impl OdinRuntimeTopologyCorrelationRecord {
+    pub fn decode_canonical_signed_payload(payload: &[u8]) -> Result<(Self, Vec<u8>)> {
+        if messagepack_array_len(payload) != Some(21) {
+            bail!("topology correlation is not the 21-field positional contract");
+        }
+        let receipt: Self =
+            rmp_serde::from_slice(payload).context("decoding runtime topology correlation")?;
+        if rmp_serde::to_vec(&receipt)? != payload {
+            bail!("topology correlation is not canonical positional MessagePack");
+        }
+        receipt.validate()?;
+        let unsigned = receipt.unsigned_signature_payload()?;
+        Ok((receipt, unsigned))
+    }
+
+    pub fn unsigned_signature_payload(&self) -> Result<Vec<u8>> {
+        self.validate_shape(true)?;
+        let mut unsigned = self.clone();
+        unsigned.signature.clear();
+        Ok(rmp_serde::to_vec(&unsigned)?)
+    }
+
+    pub fn canonical_bytes(&self) -> Result<Vec<u8>> {
+        self.validate()?;
+        Ok(rmp_serde::to_vec(self)?)
+    }
+
+    pub fn canonical_sha256(&self) -> Result<String> {
+        Ok(prefixed_sha256(&self.canonical_bytes()?))
+    }
+
+    pub fn validate(&self) -> Result<()> {
+        self.validate_shape(false)
+    }
+
+    pub fn validate_against_expected(
+        &self,
+        expected: &IdunnExpectedIncarnationRecord,
+        current_write_lease_sha256: Option<&str>,
+    ) -> Result<()> {
+        self.validate()?;
+        expected.validate()?;
+        if self.expected_projection_sha256 != expected.canonical_sha256()?
+            || self.target != expected.target
+            || self.runtime_id != expected.runtime_id
+            || self.dependencies.len() != expected.dependencies.len()
+        {
+            bail!("topology correlation substitutes or omits Expected authority");
+        }
+        for (evidence, requirement) in self.dependencies.iter().zip(&expected.dependencies) {
+            if evidence.identity() != requirement.identity()
+                || evidence.kind != requirement.kind
+                || evidence.provider_id != requirement.provider_id
+                || evidence.provider_authority != requirement.provider_authority
+                || evidence.provider_expected_projection_sha256
+                    != requirement.provider_expected_projection_sha256
+                || evidence.provider_endpoint != requirement.provider_endpoint
+            {
+                bail!("topology dependency evidence does not bind the Expected dependency");
+            }
+            if evidence.ready
+                && evidence
+                    .observed_capacity
+                    .is_none_or(|capacity| capacity < requirement.minimum_capacity)
+            {
+                bail!("ready dependency does not meet Expected capacity");
+            }
+        }
+        let mut capability_disagreements = Vec::new();
+        correlate_capabilities(
+            &mut capability_disagreements,
+            &expected.capabilities,
+            &self.observed_capabilities,
+        );
+        for disagreement in &capability_disagreements {
+            if !self.disagreements.contains(disagreement) {
+                bail!("topology correlation omits an observed capability disagreement");
+            }
+        }
+        if let Some(current_write_lease_sha256) = current_write_lease_sha256 {
+            validate_required_sha256(current_write_lease_sha256, "current write lease sha256")?;
+        }
+        if expected.write_lease_required {
+            if self
+                .observed_write_lease_sha256
+                .as_deref()
+                .is_some_and(|observed| Some(observed) != current_write_lease_sha256)
+            {
+                bail!("observed write lease is not the current Idunn grant");
+            }
+            if self.ready
+                && (self.observed_write_lease_sha256.is_none()
+                    || current_write_lease_sha256.is_none())
+            {
+                bail!("Ready stateful topology lacks the exact current write lease");
+            }
+        } else if self.observed_write_lease_sha256.is_some() || current_write_lease_sha256.is_some()
+        {
+            bail!("stateless Expected topology cannot carry a process write lease");
+        }
+        Ok(())
+    }
+
+    fn validate_shape(&self, allow_unsigned: bool) -> Result<()> {
+        if self.schema_version != ODIN_RUNTIME_TOPOLOGY_CORRELATION_SCHEMA {
+            bail!("topology correlation schema is unsupported");
+        }
+        validate_authority_identifier(&self.target, "target")?;
+        validate_required_sha256(
+            &self.expected_projection_sha256,
+            "correlation expected projection sha256",
+        )?;
+        if !self.expected {
+            bail!("topology correlation cannot deny the Expected record it binds");
+        }
+        validate_optional_sha256(&self.current_activation_sha256, "current activation sha256")?;
+        validate_optional_sha256(&self.signed_presence_sha256, "signed presence sha256")?;
+        validate_optional_identifier(&self.observed_presence_state, "observed presence state")?;
+        if self.observed_presence_publisher_sequence == Some(0) {
+            bail!("observed presence publisher sequence is zero");
+        }
+        validate_optional_sha256(
+            &self.observed_write_lease_sha256,
+            "observed write lease sha256",
+        )?;
+        validate_runtime_capabilities(&self.observed_capabilities)?;
+        if self.signed_presence_sha256.is_none() && !self.observed_capabilities.is_empty() {
+            bail!("topology correlation has capabilities without signed presence");
+        }
+        match (
+            &self.signed_presence_sha256,
+            &self.observed_presence_state,
+            self.observed_presence_publisher_sequence,
+            &self.observed_write_lease_sha256,
+        ) {
+            (None, None, None, None) => {}
+            (Some(_), Some(state), Some(_), write_lease)
+                if matches!(state.as_str(), "warming" | "active" | "degraded" | "failed") =>
+            {
+                if state == "warming" && write_lease.is_some() {
+                    bail!("warming topology presence cannot carry a process write lease");
+                }
+            }
+            _ => bail!("signed presence state, sequence, or write-lease observation is partial"),
+        }
+        validate_authority_identifier(&self.runtime_id, "runtime id")?;
+        validate_optional_sha256(&self.runtime_instance_id, "runtime instance id")?;
+        let has_runtime_evidence =
+            self.current_activation_sha256.is_some() || self.signed_presence_sha256.is_some();
+        if self.runtime_instance_id.is_some() != has_runtime_evidence {
+            bail!("runtime instance identity and observation evidence are partial");
+        }
+        if self.present
+            && (self.current_activation_sha256.is_none()
+                || self.signed_presence_sha256.is_none()
+                || self.observed_presence_publisher_sequence.is_none()
+                || self.runtime_instance_id.is_none())
+        {
+            bail!("Present topology state lacks an authenticated runtime session");
+        }
+        validate_dependency_evidence(&self.dependencies)?;
+        validate_topology_disagreements(&self.disagreements)?;
+        let has_activation = self.current_activation_sha256.is_some();
+        let has_presence = self.signed_presence_sha256.is_some();
+        if has_activation && has_presence && !self.present {
+            bail!("authenticated runtime session cannot be projected as not Present");
+        }
+        if has_activation != has_presence && self.disagreements.is_empty() {
+            bail!("partial or rejected runtime evidence lacks an explicit disagreement");
+        }
+        if self.ready
+            && (!self.present
+                || self.observed_presence_state.as_deref() != Some("active")
+                || !self.disagreements.is_empty()
+                || self
+                    .dependencies
+                    .iter()
+                    .any(|dependency| dependency.kind != "optional" && !dependency.ready))
+        {
+            bail!("Ready topology state is not supported by correlated evidence");
+        }
+        validate_authority_identifier(&self.signer_identity_id, "signer identity id")?;
+        let signature_is_valid =
+            self.signature.len() == 64 || (allow_unsigned && self.signature.is_empty());
+        if self.publisher_sequence == 0
+            || self.observed_at_unix_millis == 0
+            || self.signature_algorithm != "ed25519"
+            || !signature_is_valid
+        {
+            bail!("topology correlation sequence, time, or signature is invalid");
+        }
+        Ok(())
+    }
+}
+
+/// An in-memory activation-scoped signer reconstructed by the launched service
+/// from its protected systemd credential. The stable service identity never
+/// receives this key, and the public activation record never contains it.
+pub struct IdunnRuntimeActivationSigner {
+    signing_key: SigningKey,
+}
+
+impl IdunnRuntimeActivationSigner {
+    fn generate() -> Self {
+        let mut seed = Zeroizing::new([0_u8; 32]);
+        rand::rng().fill_bytes(seed.as_mut());
+        Self {
+            signing_key: SigningKey::from_bytes(&*seed),
+        }
+    }
+
+    /// Open the exact raw 32-byte Ed25519 seed supplied through Idunn's systemd
+    /// credential without retaining an ordinary heap copy. No persistent key
+    /// schema exists: this authority lives for one activation and is replaced
+    /// on every launch.
+    pub fn from_credential_reader(mut credential: impl Read) -> Result<Self> {
+        let mut seed = Zeroizing::new([0_u8; 32]);
+        credential
+            .read_exact(seed.as_mut())
+            .context("reading runtime activation credential")?;
+        let mut extra = [0_u8; 1];
+        if credential.read(&mut extra)? != 0 {
+            bail!("runtime activation credential is longer than 32 bytes");
+        }
+        Ok(Self {
+            signing_key: SigningKey::from_bytes(&*seed),
+        })
+    }
+
+    fn write_credential(&self, mut destination: impl Write) -> Result<()> {
+        let seed = Zeroizing::new(self.signing_key.to_bytes());
+        destination
+            .write_all(seed.as_ref())
+            .context("writing runtime activation credential")
+    }
+
+    pub fn public_key(&self) -> Vec<u8> {
+        self.signing_key.verifying_key().to_bytes().to_vec()
+    }
+
+    pub fn identity_id(&self) -> String {
+        derive_idunn_runtime_activation_identity_id(&self.public_key())
+            .expect("an Ed25519 activation signer always has a 32-byte public key")
+    }
+
+    pub fn sign_presence_proof(
+        &self,
+        presence: &GameCultRuntimePresenceHealthRecord,
+    ) -> Result<Vec<u8>> {
+        if presence.activation_signer_identity_id != self.identity_id() {
+            bail!("runtime presence names a different activation signer");
+        }
+        let payload = presence.canonical_proof_payload()?;
+        Ok(self
+            .signing_key
+            .sign(&runtime_activation_signing_message(&payload))
+            .to_bytes()
+            .to_vec())
+    }
+}
+
+/// Idunn's one-shot launch material. Issuance always creates a fresh key, and
+/// writing the protected credential consumes the only Idunn-side signer.
+pub struct IdunnRuntimeActivationLaunch {
+    activation: IdunnRuntimeActivationRecord,
+    signer: IdunnRuntimeActivationSigner,
+}
+
+impl IdunnRuntimeActivationLaunch {
+    pub fn issue(
+        expected: &IdunnExpectedIncarnationRecord,
+        runtime_instance_id: String,
+        issued_at_unix_millis: u64,
+        idunn_signer: &crate::ServiceIdentitySigner<crate::IdunnServiceIdentity>,
+    ) -> Result<Self> {
+        let signer = IdunnRuntimeActivationSigner::generate();
+        let activation = IdunnRuntimeActivationRecord::issue_with_signer(
+            expected,
+            runtime_instance_id,
+            &signer,
+            issued_at_unix_millis,
+            idunn_signer,
+        )?;
+        Ok(Self { activation, signer })
+    }
+
+    pub fn activation(&self) -> &IdunnRuntimeActivationRecord {
+        &self.activation
+    }
+
+    pub fn write_credential(self, destination: impl Write) -> Result<IdunnRuntimeActivationRecord> {
+        self.signer.write_credential(destination)?;
+        Ok(self.activation)
+    }
+}
+
+/// Derive the activation-scoped identity from the Idunn-issued public key. The
+/// domain is dedicated to runtime activation and cannot be substituted for a
+/// stable provider, Idunn, or Odin service identity.
+pub fn derive_idunn_runtime_activation_identity_id(public_key: &[u8]) -> Result<String> {
+    if public_key.len() != 32 {
+        bail!("runtime activation public key has invalid length");
+    }
+    Ok(format!(
+        "{:x}",
+        Sha256::digest([IDUNN_RUNTIME_ACTIVATION_ID_DOMAIN, public_key].concat())
+    ))
+}
+
+/// Current Idunn authority for one launch. Idunn's stable signature binds the
+/// complete Expected digest and activation key; Expected in turn pins the
+/// provider signer identity. The provider public key is lookup material, not a
+/// second authority: its profile-derived identity must equal Idunn's signed
+/// selection exactly.
+#[derive(Clone, Debug)]
+pub struct VerifiedRuntimeAuthority {
+    expected: IdunnExpectedIncarnationRecord,
+    activation: IdunnRuntimeActivationRecord,
+    provider_signer_public_key: Vec<u8>,
+    expected_sha256: String,
+    activation_sha256: String,
+}
+
+impl VerifiedRuntimeAuthority {
+    pub fn expected(&self) -> &IdunnExpectedIncarnationRecord {
+        &self.expected
+    }
+
+    pub fn activation(&self) -> &IdunnRuntimeActivationRecord {
+        &self.activation
+    }
+
+    pub fn expected_sha256(&self) -> &str {
+        &self.expected_sha256
+    }
+
+    pub fn activation_sha256(&self) -> &str {
+        &self.activation_sha256
+    }
+}
+
+pub fn verify_runtime_authority(
+    expected: &IdunnExpectedIncarnationRecord,
+    activation: &IdunnRuntimeActivationRecord,
+    idunn_anchor: &crate::ServiceIdentityTrustAnchor,
+    provider_signer_public_key: &[u8],
+) -> Result<VerifiedRuntimeAuthority> {
+    expected.validate()?;
+    activation.verify_for_expected(expected, idunn_anchor)?;
+    if crate::derive_service_identity_id::<crate::GameCultProviderHealthIdentity>(
+        provider_signer_public_key,
+    )? != expected.expected_signer_identity_id
+    {
+        bail!("provider public key is not Idunn's Expected signer selection");
+    }
+    Ok(VerifiedRuntimeAuthority {
+        expected: expected.clone(),
+        activation: activation.clone(),
+        provider_signer_public_key: provider_signer_public_key.to_vec(),
+        expected_sha256: expected.canonical_sha256()?,
+        activation_sha256: activation.canonical_sha256()?,
+    })
+}
+
+#[derive(Clone, Copy, Debug)]
+pub struct RuntimePresenceAuthenticationContext {
+    pub trusted_received_at_unix_millis: u64,
+    pub maximum_age_millis: u64,
+    pub maximum_future_skew_millis: u64,
+}
+
+/// Canonical runtime bytes authenticated by both the Expected provider key and
+/// the current activation key. No semantic claim has yet been accepted as
+/// Present; Odin must correlate this observation against current authority.
+#[derive(Clone, Debug)]
+pub struct AuthenticatedRuntimePresenceClaim {
+    record: GameCultRuntimePresenceHealthRecord,
+    canonical_bytes: Vec<u8>,
+    signed_presence_sha256: String,
+    received_at_unix_millis: u64,
+}
+
+impl AuthenticatedRuntimePresenceClaim {
+    pub fn record(&self) -> &GameCultRuntimePresenceHealthRecord {
+        &self.record
+    }
+
+    pub fn canonical_bytes(&self) -> &[u8] {
+        &self.canonical_bytes
+    }
+
+    pub fn signed_presence_sha256(&self) -> &str {
+        &self.signed_presence_sha256
+    }
+
+    pub fn received_at_unix_millis(&self) -> u64 {
+        self.received_at_unix_millis
+    }
+}
+
+/// A signed Odin receipt authenticated against the exact current Expected,
+/// activation, write lease, Idunn-admitted topology key, and trusted receipt
+/// time. This is evidence, not a replay cursor or route-promotion grant. The
+/// caller must source the key from Idunn's admitted Odin binding. Idunn's
+/// durable admission owner must atomically check and advance Odin's publisher
+/// sequence before treating the receipt as current.
+#[derive(Clone, Debug)]
+pub struct AuthenticatedOdinRuntimeTopologyCorrelation {
+    record: OdinRuntimeTopologyCorrelationRecord,
+    canonical_bytes: Vec<u8>,
+}
+
+impl AuthenticatedOdinRuntimeTopologyCorrelation {
+    pub fn record(&self) -> &OdinRuntimeTopologyCorrelationRecord {
+        &self.record
+    }
+
+    pub fn canonical_bytes(&self) -> &[u8] {
+        &self.canonical_bytes
+    }
+}
+
+#[derive(Clone, Copy, Debug)]
+pub struct OdinTopologyAuthenticationContext {
+    pub trusted_received_at_unix_millis: u64,
+    pub maximum_age_millis: u64,
+    pub maximum_future_skew_millis: u64,
+}
+
+pub fn authenticate_odin_runtime_topology_correlation(
+    canonical_correlation: &[u8],
+    authority: &VerifiedRuntimeAuthority,
+    current_write_lease_sha256: Option<&str>,
+    admitted_odin_signer_public_key: &[u8],
+    context: OdinTopologyAuthenticationContext,
+) -> Result<AuthenticatedOdinRuntimeTopologyCorrelation> {
+    ensure!(
+        context.trusted_received_at_unix_millis > 0 && context.maximum_age_millis > 0,
+        "Odin topology trusted time and maximum age must be positive"
+    );
+    let (record, unsigned) = OdinRuntimeTopologyCorrelationRecord::decode_canonical_signed_payload(
+        canonical_correlation,
+    )?;
+    record.validate_against_expected(authority.expected(), current_write_lease_sha256)?;
+    if record.current_activation_sha256.as_deref() != Some(authority.activation_sha256())
+        || record.runtime_instance_id.as_deref()
+            != Some(authority.activation.runtime_instance_id.as_str())
+    {
+        bail!("topology correlation does not bind the current activation");
+    }
+    let latest_trusted_timestamp = context
+        .trusted_received_at_unix_millis
+        .saturating_add(context.maximum_future_skew_millis);
+    if record.observed_at_unix_millis > latest_trusted_timestamp
+        || context
+            .trusted_received_at_unix_millis
+            .saturating_sub(record.observed_at_unix_millis)
+            > context.maximum_age_millis
+    {
+        bail!("Odin topology correlation is outside the trusted observation window");
+    }
+    crate::verify_service_identity_signature_with_public_key::<
+        crate::OdinTopologyIdentity,
+        crate::OdinRuntimeTopologyCorrelationPurpose,
+    >(
+        admitted_odin_signer_public_key,
+        &unsigned,
+        &crate::ServiceIdentitySignature {
+            identity_id: record.signer_identity_id.clone(),
+            signature: record.signature.clone(),
+        },
+    )?;
+    Ok(AuthenticatedOdinRuntimeTopologyCorrelation {
+        record,
+        canonical_bytes: canonical_correlation.to_vec(),
+    })
+}
+
+/// Odin's deterministic interpretation of an authenticated provider claim.
+/// Authentication of the stable provider and current activation establishes
+/// Present. Correlation disagreements remain explicit and deny Ready; they do
+/// not erase the observed session that produced them.
+#[derive(Clone, Debug)]
+pub struct RuntimePresenceCorrelation {
+    presence: VerifiedRuntimePresence,
+    disagreements: Vec<OdinTopologyDisagreement>,
+}
+
+impl RuntimePresenceCorrelation {
+    pub fn claim(&self) -> &AuthenticatedRuntimePresenceClaim {
+        &self.presence.claim
+    }
+
+    pub fn disagreements(&self) -> &[OdinTopologyDisagreement] {
+        &self.disagreements
+    }
+
+    pub fn into_present(self) -> VerifiedRuntimePresence {
+        self.presence
+    }
+
+    pub fn into_undisputed_present(self) -> Result<VerifiedRuntimePresence> {
+        if !self.disagreements.is_empty() {
+            bail!("runtime presence disagrees with current Expected projection");
+        }
+        Ok(self.presence)
+    }
+}
+
+/// A dual-authenticated claim that matches current authority. This is the only
+/// value that represents semantic Present. Replay admission deliberately does
+/// not live here: Odin's durable store must atomically check and advance every
+/// authenticated provider sequence, including disagreement-bearing claims,
+/// before it signs a topology correlation.
+#[derive(Clone, Debug)]
+pub struct VerifiedRuntimePresence {
+    claim: AuthenticatedRuntimePresenceClaim,
+}
+
+impl VerifiedRuntimePresence {
+    pub fn record(&self) -> &GameCultRuntimePresenceHealthRecord {
+        self.claim.record()
+    }
+
+    pub fn canonical_bytes(&self) -> &[u8] {
+        self.claim.canonical_bytes()
+    }
+
+    pub fn signed_presence_sha256(&self) -> &str {
+        self.claim.signed_presence_sha256()
+    }
+
+    pub fn accepted_at_unix_millis(&self) -> u64 {
+        self.claim.received_at_unix_millis()
+    }
+}
+
+pub fn authenticate_runtime_presence_claim(
+    canonical_presence: &[u8],
+    authority: &VerifiedRuntimeAuthority,
+    context: RuntimePresenceAuthenticationContext,
+) -> Result<AuthenticatedRuntimePresenceClaim> {
+    ensure!(
+        context.trusted_received_at_unix_millis > 0 && context.maximum_age_millis > 0,
+        "runtime presence trusted time and maximum age must be positive"
+    );
+    if messagepack_array_len(canonical_presence) != Some(24) {
+        bail!("runtime presence payload is not the 24-field positional contract");
+    }
+    let presence: GameCultRuntimePresenceHealthRecord =
+        rmp_serde::from_slice(canonical_presence).context("decoding runtime presence health")?;
+    if rmp_serde::to_vec(&presence)? != canonical_presence {
+        bail!("runtime presence payload is not canonical positional MessagePack");
+    }
+    presence.validate()?;
+    let latest_trusted_timestamp = context
+        .trusted_received_at_unix_millis
+        .saturating_add(context.maximum_future_skew_millis);
+    if presence.observed_at_unix_millis > latest_trusted_timestamp
+        || authority.activation.issued_at_unix_millis > latest_trusted_timestamp
+        || context
+            .trusted_received_at_unix_millis
+            .saturating_sub(presence.observed_at_unix_millis)
+            > context.maximum_age_millis
+    {
+        bail!("runtime presence is outside the trusted observation window");
+    }
+    if presence.signer_identity_id != authority.expected.expected_signer_identity_id {
+        bail!("runtime presence signer is not Idunn's Expected signer selection");
+    }
+
+    let proof_payload = presence.canonical_proof_payload()?;
+    crate::verify_service_identity_signature_with_public_key::<
+        crate::GameCultProviderHealthIdentity,
+        crate::GameCultRuntimePresenceHealthPurpose,
+    >(
+        &authority.provider_signer_public_key,
+        &proof_payload,
+        &crate::ServiceIdentitySignature {
+            identity_id: presence.signer_identity_id.clone(),
+            signature: presence.signature.clone(),
+        },
+    )?;
+    let activation_public_key: [u8; 32] = authority
+        .activation
+        .activation_signer_public_key
+        .as_slice()
+        .try_into()
+        .map_err(|_| anyhow::anyhow!("runtime activation public key has invalid length"))?;
+    let activation_signature = Signature::from_slice(&presence.activation_signature)
+        .map_err(|_| anyhow::anyhow!("runtime activation signature has invalid length"))?;
+    VerifyingKey::from_bytes(&activation_public_key)?
+        .verify(
+            &runtime_activation_signing_message(&proof_payload),
+            &activation_signature,
+        )
+        .map_err(|_| anyhow::anyhow!("runtime activation proof verification failed"))?;
+
+    Ok(AuthenticatedRuntimePresenceClaim {
+        record: presence,
+        canonical_bytes: canonical_presence.to_vec(),
+        signed_presence_sha256: prefixed_sha256(canonical_presence),
+        received_at_unix_millis: context.trusted_received_at_unix_millis,
+    })
+}
+
+pub fn correlate_runtime_presence_claim(
+    claim: AuthenticatedRuntimePresenceClaim,
+    authority: &VerifiedRuntimeAuthority,
+) -> Result<RuntimePresenceCorrelation> {
+    let expected = authority.expected();
+    let activation = authority.activation();
+    let presence = claim.record();
+    let expected_endpoint = expected
+        .route
+        .as_ref()
+        .map(|route| route.candidate_endpoint.clone());
+    let mut disagreements = Vec::new();
+    push_disagreement(
+        &mut disagreements,
+        "activation-signer-identity",
+        Some(&activation.activation_signer_identity_id),
+        Some(&presence.activation_signer_identity_id),
+    );
+    push_disagreement(
+        &mut disagreements,
+        "activation-witness",
+        Some(authority.activation_sha256()),
+        Some(&presence.activation_witness_sha256),
+    );
+    push_disagreement(
+        &mut disagreements,
+        "bound-endpoint",
+        expected_endpoint.as_deref(),
+        presence.bound_endpoint.as_deref(),
+    );
+    push_disagreement(
+        &mut disagreements,
+        "expected-projection",
+        Some(authority.expected_sha256()),
+        Some(&presence.expected_projection_sha256),
+    );
+    push_disagreement(
+        &mut disagreements,
+        "health-contract",
+        Some(&expected.health_contract),
+        Some(&presence.health_contract),
+    );
+    push_disagreement(
+        &mut disagreements,
+        "incarnation-id",
+        Some(&expected.incarnation_id),
+        Some(&presence.incarnation_id),
+    );
+    push_disagreement(
+        &mut disagreements,
+        "plan-id",
+        Some(&expected.plan_id),
+        Some(&presence.plan_id),
+    );
+    push_disagreement(
+        &mut disagreements,
+        "runtime-id",
+        Some(&expected.runtime_id),
+        Some(&presence.runtime_id),
+    );
+    push_disagreement(
+        &mut disagreements,
+        "runtime-instance-id",
+        Some(&activation.runtime_instance_id),
+        Some(&presence.runtime_instance_id),
+    );
+    push_disagreement(
+        &mut disagreements,
+        "sealed-release-id",
+        Some(&expected.sealed_release_id),
+        Some(&presence.sealed_release_id),
+    );
+    push_disagreement(
+        &mut disagreements,
+        "signer-identity",
+        Some(&expected.expected_signer_identity_id),
+        Some(&presence.signer_identity_id),
+    );
+    push_disagreement(
+        &mut disagreements,
+        "state-contract",
+        expected.state_contract_sha256.as_deref(),
+        presence.state_contract_sha256.as_deref(),
+    );
+    push_disagreement(
+        &mut disagreements,
+        "state-schema-generation",
+        expected.state_schema_generation.as_deref(),
+        presence.state_schema_generation.as_deref(),
+    );
+    push_disagreement(
+        &mut disagreements,
+        "target",
+        Some(&expected.target),
+        Some(&presence.target),
+    );
+    if activation.issued_at_unix_millis > presence.observed_at_unix_millis {
+        disagreements.push(OdinTopologyDisagreement {
+            code: "activation-issued-after-presence".into(),
+            expected: Some(format!("at-most:{}", presence.observed_at_unix_millis)),
+            observed: Some(activation.issued_at_unix_millis.to_string()),
+        });
+    }
+    correlate_capabilities(
+        &mut disagreements,
+        &expected.capabilities,
+        &presence.capabilities,
+    );
+    disagreements.sort_by(|left, right| left.code.cmp(&right.code));
+    validate_topology_disagreements(&disagreements)?;
+    Ok(RuntimePresenceCorrelation {
+        presence: VerifiedRuntimePresence { claim },
+        disagreements,
+    })
+}
+
+fn push_disagreement(
+    disagreements: &mut Vec<OdinTopologyDisagreement>,
+    code: &str,
+    expected: Option<&str>,
+    observed: Option<&str>,
+) {
+    if expected != observed {
+        disagreements.push(OdinTopologyDisagreement {
+            code: code.into(),
+            expected: expected.map(str::to_string),
+            observed: observed.map(str::to_string),
+        });
+    }
+}
+
+fn correlate_capabilities(
+    disagreements: &mut Vec<OdinTopologyDisagreement>,
+    expected: &[IdunnExpectedCapability],
+    observed: &[GameCultRuntimeCapability],
+) {
+    for (index, required) in expected.iter().enumerate() {
+        let actual = observed
+            .iter()
+            .find(|actual| actual.identity() == required.identity());
+        let requirement = format!(
+            "{}/{}/{} capacity>={}",
+            required.capability, required.schema, required.compatibility, required.minimum_capacity
+        );
+        match actual {
+            None => disagreements.push(OdinTopologyDisagreement {
+                code: format!("expected-capability-{index:03}-missing"),
+                expected: Some(requirement),
+                observed: None,
+            }),
+            Some(actual) if actual.capacity < required.minimum_capacity => {
+                disagreements.push(OdinTopologyDisagreement {
+                    code: format!("expected-capability-{index:03}-capacity"),
+                    expected: Some(requirement),
+                    observed: Some(format!("capacity={}", actual.capacity)),
+                });
+            }
+            Some(_) => {}
+        }
+    }
+}
+
+fn runtime_activation_signing_message(payload: &[u8]) -> Vec<u8> {
+    let purpose = GAMECULT_RUNTIME_ACTIVATION_PROOF_SIGNING_PURPOSE.as_bytes();
+    let mut out = Vec::with_capacity(
+        IDUNN_RUNTIME_ACTIVATION_SIGNATURE_DOMAIN.len() + purpose.len() + payload.len() + 16,
+    );
+    out.extend_from_slice(IDUNN_RUNTIME_ACTIVATION_SIGNATURE_DOMAIN);
+    out.extend_from_slice(&(purpose.len() as u64).to_be_bytes());
+    out.extend_from_slice(purpose);
+    out.extend_from_slice(&(payload.len() as u64).to_be_bytes());
+    out.extend_from_slice(payload);
+    out
+}
+
+/// Idunn-issued launch identity. Idunn's stable service identity signs the
+/// complete activation, including the ephemeral public key, before the private
+/// credential is passed to one workload alongside Expected. Odin still treats
+/// it as current only after Idunn publishes an observed native process.
+#[derive(Clone, Debug, PartialEq, Eq, DatabaseEntry)]
+#[cultcache(
+    type = "idunn.runtime_activation",
+    schema = "idunn.runtime_activation.v2"
+)]
+pub struct IdunnRuntimeActivationRecord {
+    #[cultcache(key = 0)]
+    pub schema_version: String,
+    #[cultcache(key = 1)]
+    pub expected_projection_sha256: String,
+    #[cultcache(key = 2)]
+    pub runtime_id: String,
+    #[cultcache(key = 3)]
+    pub runtime_instance_id: String,
+    #[cultcache(key = 4)]
+    pub activation_signer_identity_id: String,
+    #[cultcache(key = 5, bytes)]
+    pub activation_signer_public_key: Vec<u8>,
+    #[cultcache(key = 6)]
+    pub issued_at_unix_millis: u64,
+    #[cultcache(key = 7)]
+    pub idunn_signer_identity_id: String,
+    #[cultcache(key = 8)]
+    pub signature_algorithm: String,
+    #[cultcache(key = 9, bytes)]
+    pub signature: Vec<u8>,
+}
+
+impl IdunnRuntimeActivationRecord {
+    fn issue_with_signer(
+        expected: &IdunnExpectedIncarnationRecord,
+        runtime_instance_id: String,
+        activation_signer: &IdunnRuntimeActivationSigner,
+        issued_at_unix_millis: u64,
+        idunn_signer: &crate::ServiceIdentitySigner<crate::IdunnServiceIdentity>,
+    ) -> Result<Self> {
+        expected.validate()?;
+        let mut activation = Self {
+            schema_version: IDUNN_RUNTIME_ACTIVATION_SCHEMA.into(),
+            expected_projection_sha256: expected.canonical_sha256()?,
+            runtime_id: expected.runtime_id.clone(),
+            runtime_instance_id,
+            activation_signer_identity_id: activation_signer.identity_id(),
+            activation_signer_public_key: activation_signer.public_key(),
+            issued_at_unix_millis,
+            idunn_signer_identity_id: idunn_signer.entry().identity_id.clone(),
+            signature_algorithm: "ed25519".into(),
+            signature: Vec::new(),
+        };
+        let proof = idunn_signer.sign::<crate::IdunnRuntimeActivationPurpose>(
+            &activation.unsigned_signature_payload()?,
+        );
+        activation.signature = proof.signature;
+        activation.validate()?;
+        Ok(activation)
+    }
+
+    pub fn decode_canonical(payload: &[u8]) -> Result<Self> {
+        if messagepack_array_len(payload) != Some(10) {
+            bail!("runtime activation is not the 10-field positional contract");
+        }
+        let activation: Self =
+            rmp_serde::from_slice(payload).context("decoding runtime activation")?;
+        if rmp_serde::to_vec(&activation)? != payload {
+            bail!("runtime activation is not canonical positional MessagePack");
+        }
+        activation.validate()?;
+        Ok(activation)
+    }
+
+    pub fn canonical_bytes(&self) -> Result<Vec<u8>> {
+        self.validate()?;
+        Ok(rmp_serde::to_vec(self)?)
+    }
+
+    pub fn canonical_sha256(&self) -> Result<String> {
+        Ok(prefixed_sha256(&self.canonical_bytes()?))
+    }
+
+    pub fn unsigned_signature_payload(&self) -> Result<Vec<u8>> {
+        self.validate_shape(true)?;
+        let mut unsigned = self.clone();
+        unsigned.signature.clear();
+        Ok(rmp_serde::to_vec(&unsigned)?)
+    }
+
+    pub fn verify_for_expected(
+        &self,
+        expected: &IdunnExpectedIncarnationRecord,
+        idunn_anchor: &crate::ServiceIdentityTrustAnchor,
+    ) -> Result<()> {
+        self.validate()?;
+        expected.validate()?;
+        if self.expected_projection_sha256 != expected.canonical_sha256()?
+            || self.runtime_id != expected.runtime_id
+        {
+            bail!("runtime activation does not bind the current Expected incarnation");
+        }
+        crate::verify_service_identity_signature::<
+            crate::IdunnServiceIdentity,
+            crate::IdunnRuntimeActivationPurpose,
+        >(
+            idunn_anchor,
+            &self.unsigned_signature_payload()?,
+            &crate::ServiceIdentitySignature {
+                identity_id: self.idunn_signer_identity_id.clone(),
+                signature: self.signature.clone(),
+            },
+        )
+        .context("verifying Idunn runtime activation signature")
+    }
+
+    pub fn validate(&self) -> Result<()> {
+        self.validate_shape(false)
+    }
+
+    fn validate_shape(&self, allow_unsigned: bool) -> Result<()> {
+        if self.schema_version != IDUNN_RUNTIME_ACTIVATION_SCHEMA {
+            bail!("runtime activation schema is unsupported");
+        }
+        validate_required_sha256(
+            &self.expected_projection_sha256,
+            "activation expected projection sha256",
+        )?;
+        validate_authority_identifier(&self.runtime_id, "activation runtime id")?;
+        validate_required_sha256(&self.runtime_instance_id, "runtime instance id")?;
+        validate_authority_identifier(
+            &self.activation_signer_identity_id,
+            "activation signer identity id",
+        )?;
+        if self.activation_signer_identity_id
+            != derive_idunn_runtime_activation_identity_id(&self.activation_signer_public_key)?
+        {
+            bail!("runtime activation signer identity does not match its public key");
+        }
+        validate_authority_identifier(
+            &self.idunn_signer_identity_id,
+            "Idunn activation signer identity id",
+        )?;
+        let signature_is_valid =
+            self.signature.len() == 64 || (allow_unsigned && self.signature.is_empty());
+        if self.issued_at_unix_millis == 0
+            || self.signature_algorithm != "ed25519"
+            || !signature_is_valid
+        {
+            bail!("runtime activation issue time or signature is invalid");
+        }
+        Ok(())
+    }
+}
+
+/// Unsigned Idunn-owned local file that grants one exact process incarnation
+/// state-write authority. It is authoritative only when read through the
+/// root-owned admitted path and lock protocol; its bytes carry no route or
+/// traffic authority.
+#[derive(Clone, Debug, PartialEq, Eq, DatabaseEntry)]
+#[cultcache(
+    type = "idunn.process_write_lease",
+    schema = "idunn.process_write_lease.v1"
+)]
+pub struct IdunnProcessWriteLeaseRecord {
+    #[cultcache(key = 0)]
+    pub schema_version: String,
+    #[cultcache(key = 1)]
+    pub target: String,
+    #[cultcache(key = 2)]
+    pub expected_projection_sha256: String,
+    #[cultcache(key = 3)]
+    pub plan_id: String,
+    #[cultcache(key = 4)]
+    pub incarnation_id: String,
+    #[cultcache(key = 5)]
+    pub sealed_release_id: String,
+    #[cultcache(key = 6)]
+    pub activation_witness_sha256: String,
+    #[cultcache(key = 7)]
+    pub state_schema_generation: String,
+    #[cultcache(key = 8)]
+    pub state_contract_sha256: String,
+    #[cultcache(key = 9)]
+    pub runtime_id: String,
+    #[cultcache(key = 10)]
+    pub runtime_instance_id: String,
+    #[cultcache(key = 11)]
+    pub warming_presence_sha256: String,
+    #[cultcache(key = 12)]
+    pub lease_epoch: u64,
+    #[cultcache(key = 13)]
+    pub issued_at_unix_millis: u64,
+}
+
+impl IdunnProcessWriteLeaseRecord {
+    pub fn decode_canonical(payload: &[u8]) -> Result<Self> {
+        if messagepack_array_len(payload) != Some(14) {
+            bail!("process write lease is not the 14-field positional contract");
+        }
+        let lease: Self = rmp_serde::from_slice(payload).context("decoding process write lease")?;
+        if rmp_serde::to_vec(&lease)? != payload {
+            bail!("process write lease is not canonical positional MessagePack");
+        }
+        lease.validate()?;
+        Ok(lease)
+    }
+
+    pub fn canonical_bytes(&self) -> Result<Vec<u8>> {
+        self.validate()?;
+        Ok(rmp_serde::to_vec(self)?)
+    }
+
+    pub fn canonical_sha256(&self) -> Result<String> {
+        Ok(prefixed_sha256(&self.canonical_bytes()?))
+    }
+
+    pub fn validate(&self) -> Result<()> {
+        if self.schema_version != IDUNN_PROCESS_WRITE_LEASE_SCHEMA {
+            bail!("process write lease schema is unsupported");
+        }
+        validate_authority_identifier(&self.target, "target")?;
+        validate_required_sha256(
+            &self.expected_projection_sha256,
+            "lease expected projection sha256",
+        )?;
+        validate_required_sha256(&self.plan_id, "plan id")?;
+        validate_authority_identifier(&self.incarnation_id, "incarnation id")?;
+        validate_required_sha256(&self.sealed_release_id, "sealed release id")?;
+        validate_required_sha256(&self.activation_witness_sha256, "activation witness sha256")?;
+        validate_authority_identifier(&self.state_schema_generation, "state schema generation")?;
+        validate_required_sha256(&self.state_contract_sha256, "state contract sha256")?;
+        validate_authority_identifier(&self.runtime_id, "runtime id")?;
+        validate_required_sha256(&self.runtime_instance_id, "runtime instance id")?;
+        validate_required_sha256(&self.warming_presence_sha256, "warming presence sha256")?;
+        if self.lease_epoch == 0 || self.issued_at_unix_millis == 0 {
+            bail!("process write lease epoch or issue time is invalid");
+        }
+        Ok(())
+    }
+}
+
+fn messagepack_array_len(payload: &[u8]) -> Option<usize> {
+    match *payload.first()? {
+        marker @ 0x90..=0x9f => Some(usize::from(marker & 0x0f)),
+        0xdc => Some(usize::from(u16::from_be_bytes([
+            *payload.get(1)?,
+            *payload.get(2)?,
+        ]))),
+        0xdd => usize::try_from(u32::from_be_bytes([
+            *payload.get(1)?,
+            *payload.get(2)?,
+            *payload.get(3)?,
+            *payload.get(4)?,
+        ]))
+        .ok(),
+        _ => None,
+    }
+}
+
+fn validate_authority_identifier(value: &str, label: &str) -> Result<()> {
+    if value.is_empty()
+        || value.len() > 256
+        || value.trim() != value
+        || value.chars().any(char::is_control)
+    {
+        bail!("{label} is empty, oversized, padded, or contains control characters");
+    }
+    Ok(())
+}
+
+fn validate_optional_identifier(value: &Option<String>, label: &str) -> Result<()> {
+    if let Some(value) = value {
+        validate_authority_identifier(value, label)?;
+    }
+    Ok(())
+}
+
+fn validate_source_repository(value: &str) -> Result<()> {
+    validate_authority_identifier(value, "source repository")?;
+    let segments: Vec<&str> = value.split('/').collect();
+    if segments.len() < 3
+        || !segments[0].contains('.')
+        || segments.iter().any(|segment| {
+            segment.is_empty()
+                || matches!(*segment, "." | "..")
+                || !segment
+                    .bytes()
+                    .all(|byte| byte.is_ascii_alphanumeric() || matches!(byte, b'-' | b'_' | b'.'))
+        })
+    {
+        bail!("source repository is not a canonical host/owner/repository identity");
+    }
+    Ok(())
+}
+
+fn validate_endpoint(value: &str, label: &str) -> Result<()> {
+    if value.is_empty()
+        || value.len() > 2048
+        || value.trim() != value
+        || value.chars().any(char::is_control)
+    {
+        bail!("{label} is empty, oversized, padded, or contains control characters");
+    }
+    Ok(())
+}
+
+fn validate_optional_endpoint_labeled(value: &Option<String>, label: &str) -> Result<()> {
+    if let Some(endpoint) = value {
+        validate_endpoint(endpoint, label)?;
+    }
+    Ok(())
+}
+
+fn validate_optional_endpoint(value: &Option<String>) -> Result<()> {
+    validate_optional_endpoint_labeled(value, "bound endpoint")
+}
+
+fn validate_runtime_capabilities(capabilities: &[GameCultRuntimeCapability]) -> Result<()> {
+    if capabilities.len() > MAX_RUNTIME_CAPABILITIES {
+        bail!("runtime presence capability count exceeds its contract bound");
+    }
+    let mut previous: Option<(&str, &str, &str)> = None;
+    for capability in capabilities {
+        validate_authority_identifier(&capability.capability, "capability")?;
+        validate_authority_identifier(&capability.schema, "capability schema")?;
+        validate_authority_identifier(&capability.compatibility, "capability compatibility")?;
+        if capability.capacity == 0 {
+            bail!("runtime capability capacity is zero");
+        }
+        let identity = (
+            capability.capability.as_str(),
+            capability.schema.as_str(),
+            capability.compatibility.as_str(),
+        );
+        if previous.is_some_and(|previous| previous >= identity) {
+            bail!("runtime capabilities are not strictly sorted and unique");
+        }
+        previous = Some(identity);
+    }
+    Ok(())
+}
+
+fn validate_expected_capabilities(capabilities: &[IdunnExpectedCapability]) -> Result<()> {
+    if capabilities.len() > MAX_RUNTIME_CAPABILITIES {
+        bail!("Expected capability count exceeds its contract bound");
+    }
+    let mut previous: Option<(&str, &str, &str)> = None;
+    for capability in capabilities {
+        validate_authority_identifier(&capability.capability, "Expected capability")?;
+        validate_authority_identifier(&capability.schema, "Expected capability schema")?;
+        validate_authority_identifier(
+            &capability.compatibility,
+            "Expected capability compatibility",
+        )?;
+        if capability.minimum_capacity == 0 {
+            bail!("Expected capability minimum capacity is zero");
+        }
+        let identity = capability.identity();
+        if previous.is_some_and(|previous| previous >= identity) {
+            bail!("Expected capabilities are not strictly sorted and unique");
+        }
+        previous = Some(identity);
+    }
+    Ok(())
+}
+
+fn validate_expected_dependencies(dependencies: &[IdunnExpectedDependency]) -> Result<()> {
+    if dependencies.len() > MAX_RUNTIME_DEPENDENCIES {
+        bail!("Expected dependency count exceeds its contract bound");
+    }
+    let mut previous: Option<(&str, &str, &str)> = None;
+    for dependency in dependencies {
+        dependency.validate()?;
+        let identity = dependency.identity();
+        if previous.is_some_and(|previous| previous >= identity) {
+            bail!("Expected dependencies are not strictly sorted and unique");
+        }
+        previous = Some(identity);
+    }
+    Ok(())
+}
+
+fn validate_dependency_evidence(dependencies: &[OdinRuntimeDependencyEvidence]) -> Result<()> {
+    if dependencies.len() > MAX_RUNTIME_DEPENDENCIES {
+        bail!("dependency evidence count exceeds its contract bound");
+    }
+    let mut previous: Option<(&str, &str, &str)> = None;
+    for dependency in dependencies {
+        dependency.validate()?;
+        let identity = dependency.identity();
+        if previous.is_some_and(|previous| previous >= identity) {
+            bail!("dependency evidence is not strictly sorted and unique");
+        }
+        previous = Some(identity);
+    }
+    Ok(())
+}
+
+fn validate_topology_disagreements(disagreements: &[OdinTopologyDisagreement]) -> Result<()> {
+    if disagreements.len() > MAX_TOPOLOGY_DISAGREEMENTS {
+        bail!("topology disagreement count exceeds its contract bound");
+    }
+    let mut previous: Option<&str> = None;
+    for disagreement in disagreements {
+        disagreement.validate()?;
+        if previous.is_some_and(|previous| previous >= disagreement.code.as_str()) {
+            bail!("topology disagreements are not strictly sorted and unique by code");
+        }
+        previous = Some(&disagreement.code);
+    }
+    Ok(())
+}
+
+fn validate_optional_detail(value: &Option<String>, label: &str) -> Result<()> {
+    if value.as_deref().is_some_and(|value| {
+        value.is_empty()
+            || value.len() > 1024
+            || value.trim() != value
+            || value.chars().any(char::is_control)
+    }) {
+        bail!("{label} is empty, oversized, padded, or contains control characters");
+    }
+    Ok(())
+}
+
+fn validate_required_sha256(value: &str, label: &str) -> Result<()> {
+    if !is_sha256(value) {
+        bail!("{label} is malformed");
+    }
+    Ok(())
+}
+
+fn validate_optional_sha256(value: &Option<String>, label: &str) -> Result<()> {
+    if value.as_deref().is_some_and(|value| !is_sha256(value)) {
+        bail!("{label} is malformed");
+    }
+    Ok(())
+}
+
+fn prefixed_sha256(bytes: &[u8]) -> String {
+    format!("sha256-{:x}", Sha256::digest(bytes))
+}
+
+fn is_sha256(value: &str) -> bool {
+    value
+        .strip_prefix("sha256-")
+        .is_some_and(|digest| is_lower_hex(digest, 64))
+}
+
+fn is_lower_hex(value: &str, length: usize) -> bool {
+    value.len() == length
+        && value
+            .bytes()
+            .all(|byte| byte.is_ascii_hexdigit() && !byte.is_ascii_uppercase())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::{
+        GAMECULT_SERVICE_TRUST_ANCHOR_SCHEMA, GameCultProviderHealthIdentity,
+        GameCultRuntimePresenceHealthPurpose, GameCultServiceTrustAnchorRecord,
+        IDUNN_SIGNED_DAEMON_HEALTH_SCHEMA, IdunnServiceIdentity,
+        OdinRuntimeTopologyCorrelationPurpose, OdinTopologyIdentity, ServiceIdentitySignature,
+        ServiceIdentitySigner, ServiceSignaturePurpose, derive_service_identity_id,
+        enroll_service_identity_at, verify_service_identity_signature,
+    };
+
+    struct WrongOdinTopologyPurpose;
+
+    impl ServiceSignaturePurpose<OdinTopologyIdentity> for WrongOdinTopologyPurpose {
+        const PURPOSE: &'static [u8] = b"odin.not-runtime-topology-correlation.v1";
+    }
+
+    fn digest(byte: char) -> String {
+        format!("sha256-{}", byte.to_string().repeat(64))
+    }
+
+    fn runtime_capability(name: &str) -> GameCultRuntimeCapability {
+        GameCultRuntimeCapability {
+            capability: name.into(),
+            schema: format!("{name}.v1"),
+            compatibility: "v1".into(),
+            capacity: 1,
+        }
+    }
+
+    fn expected_capability(name: &str) -> IdunnExpectedCapability {
+        IdunnExpectedCapability {
+            capability: name.into(),
+            schema: format!("{name}.v1"),
+            compatibility: "v1".into(),
+            minimum_capacity: 1,
+        }
+    }
+
+    fn runtime_presence() -> GameCultRuntimePresenceHealthRecord {
+        GameCultRuntimePresenceHealthRecord {
+            schema_version: GAMECULT_RUNTIME_PRESENCE_HEALTH_SCHEMA.into(),
+            target: "ghostlight".into(),
+            expected_projection_sha256: digest('9'),
+            plan_id: digest('e'),
+            incarnation_id: "ghostlight/2026-09-02/1".into(),
+            sealed_release_id: digest('f'),
+            activation_witness_sha256: digest('a'),
+            state_schema_generation: Some("world-v2".into()),
+            state_contract_sha256: Some(digest('b')),
+            runtime_id: "ghostlight-yggdrasil-1".into(),
+            runtime_instance_id: digest('8'),
+            bound_endpoint: Some("http://127.0.0.1:14103".into()),
+            capabilities: vec![
+                runtime_capability("conversation"),
+                runtime_capability("state"),
+            ],
+            health_contract: "ghostlight.runtime-health.v1".into(),
+            state: "active".into(),
+            detail: "ready".into(),
+            write_lease_sha256: Some(digest('c')),
+            signer_identity_id: "provider-signing-key".into(),
+            publisher_sequence: 1,
+            observed_at_unix_millis: 100,
+            signature_algorithm: "ed25519".into(),
+            signature: vec![6; 64],
+            activation_signer_identity_id: "activation-signing-key".into(),
+            activation_signature: vec![7; 64],
+        }
+    }
+
+    fn runtime_activation() -> IdunnRuntimeActivationRecord {
+        let signer = IdunnRuntimeActivationSigner::from_credential_reader(&[8; 32][..]).unwrap();
+        IdunnRuntimeActivationRecord {
+            schema_version: IDUNN_RUNTIME_ACTIVATION_SCHEMA.into(),
+            expected_projection_sha256: digest('9'),
+            runtime_id: "ghostlight-yggdrasil-1".into(),
+            runtime_instance_id: digest('8'),
+            activation_signer_identity_id: signer.identity_id(),
+            activation_signer_public_key: signer.public_key(),
+            issued_at_unix_millis: 99,
+            idunn_signer_identity_id: "idunn-signing-key".into(),
+            signature_algorithm: "ed25519".into(),
+            signature: vec![5; 64],
+        }
+    }
+
+    fn process_write_lease() -> IdunnProcessWriteLeaseRecord {
+        IdunnProcessWriteLeaseRecord {
+            schema_version: IDUNN_PROCESS_WRITE_LEASE_SCHEMA.into(),
+            target: "ghostlight".into(),
+            expected_projection_sha256: digest('9'),
+            plan_id: digest('e'),
+            incarnation_id: "ghostlight/2026-09-02/1".into(),
+            sealed_release_id: digest('f'),
+            activation_witness_sha256: digest('a'),
+            state_schema_generation: "world-v2".into(),
+            state_contract_sha256: digest('b'),
+            runtime_id: "ghostlight-yggdrasil-1".into(),
+            runtime_instance_id: digest('8'),
+            warming_presence_sha256: digest('d'),
+            lease_epoch: 1,
+            issued_at_unix_millis: 101,
+        }
+    }
+
+    fn expected_dependency(
+        kind: &str,
+        capability: &str,
+        provider_id: Option<&str>,
+    ) -> IdunnExpectedDependency {
+        IdunnExpectedDependency {
+            kind: kind.into(),
+            capability: capability.into(),
+            schema: format!("{capability}.v1"),
+            compatibility: "v1".into(),
+            minimum_capacity: 1,
+            startup: if kind == "bootstrap" {
+                "before-start".into()
+            } else {
+                "before-promotion".into()
+            },
+            provider_id: provider_id.map(str::to_string),
+            provider_authority: provider_id.map(|_| "managed-incarnation".into()),
+            provider_expected_projection_sha256: provider_id.map(|_| digest('1')),
+            provider_endpoint: provider_id.map(|_| "tcp://127.0.0.1:14100".into()),
+        }
+    }
+
+    fn expected_incarnation() -> IdunnExpectedIncarnationRecord {
+        IdunnExpectedIncarnationRecord {
+            schema_version: IDUNN_EXPECTED_INCARNATION_SCHEMA.into(),
+            target: "ghostlight".into(),
+            plan_id: digest('2'),
+            incarnation_id: "ghostlight/2026-09-02/1".into(),
+            sealed_release_id: digest('3'),
+            source_repository: "github.com/GameCult/Ghostlight".into(),
+            source_revision: "4".repeat(40),
+            recipe_sha256: digest('5'),
+            runtime_id: "ghostlight-yggdrasil-1".into(),
+            expected_signer_identity_id: "ghostlight-provider-signing-key".into(),
+            health_contract: "ghostlight.runtime-health.v1".into(),
+            artifact_sha256: digest('6'),
+            state_schema_generation: Some("world-v2".into()),
+            state_contract_sha256: Some(digest('7')),
+            write_lease_required: true,
+            route: Some(IdunnExpectedRoute {
+                route_id: "ghostlight-public".into(),
+                transport: "http".into(),
+                stable_endpoint: "https://ghostlight.gamecult.net".into(),
+                candidate_endpoint: "http://127.0.0.1:14103".into(),
+            }),
+            capabilities: vec![
+                expected_capability("conversation"),
+                expected_capability("state"),
+            ],
+            dependencies: vec![
+                expected_dependency("shared-infrastructure", "rendezvous", Some("odin-ygg-1")),
+                expected_dependency("optional", "telemetry", None),
+            ],
+        }
+    }
+
+    fn dependency_evidence(requirement: &IdunnExpectedDependency) -> OdinRuntimeDependencyEvidence {
+        let selected = requirement.provider_id.is_some();
+        OdinRuntimeDependencyEvidence {
+            kind: requirement.kind.clone(),
+            capability: requirement.capability.clone(),
+            schema: requirement.schema.clone(),
+            compatibility: requirement.compatibility.clone(),
+            provider_id: requirement.provider_id.clone(),
+            provider_authority: requirement.provider_authority.clone(),
+            provider_expected_projection_sha256: requirement
+                .provider_expected_projection_sha256
+                .clone(),
+            provider_endpoint: requirement.provider_endpoint.clone(),
+            observed_capacity: selected.then_some(1),
+            provider_evidence_sha256: selected.then(|| digest('8')),
+            ready: selected,
+        }
+    }
+
+    fn topology_correlation(
+        expected: &IdunnExpectedIncarnationRecord,
+    ) -> OdinRuntimeTopologyCorrelationRecord {
+        OdinRuntimeTopologyCorrelationRecord {
+            schema_version: ODIN_RUNTIME_TOPOLOGY_CORRELATION_SCHEMA.into(),
+            target: expected.target.clone(),
+            expected_projection_sha256: expected.canonical_sha256().unwrap(),
+            expected: true,
+            current_activation_sha256: Some(digest('9')),
+            signed_presence_sha256: Some(digest('a')),
+            observed_presence_state: Some("active".into()),
+            observed_presence_publisher_sequence: Some(1),
+            observed_write_lease_sha256: Some(digest('c')),
+            observed_capabilities: expected
+                .capabilities
+                .iter()
+                .map(|capability| GameCultRuntimeCapability {
+                    capability: capability.capability.clone(),
+                    schema: capability.schema.clone(),
+                    compatibility: capability.compatibility.clone(),
+                    capacity: capability.minimum_capacity,
+                })
+                .collect(),
+            runtime_id: expected.runtime_id.clone(),
+            runtime_instance_id: Some(digest('b')),
+            present: true,
+            ready: true,
+            dependencies: expected
+                .dependencies
+                .iter()
+                .map(dependency_evidence)
+                .collect(),
+            disagreements: vec![],
+            signer_identity_id: "odin-topology-signing-key".into(),
+            publisher_sequence: 1,
+            observed_at_unix_millis: 102,
+            signature_algorithm: "ed25519".into(),
+            signature: vec![7; 64],
+        }
+    }
+
+    fn validate_against_current_lease(
+        receipt: &OdinRuntimeTopologyCorrelationRecord,
+        expected: &IdunnExpectedIncarnationRecord,
+    ) -> Result<()> {
+        let current_lease = digest('c');
+        receipt.validate_against_expected(expected, Some(&current_lease))
+    }
+
+    fn topology_anchor() -> GameCultServiceTrustAnchorRecord {
+        let public_key = vec![9; 32];
+        GameCultServiceTrustAnchorRecord {
+            schema_version: GAMECULT_SERVICE_TRUST_ANCHOR_SCHEMA.into(),
+            trust_anchor_id: "root/odin/runtime-topology".into(),
+            service_id: "odin".into(),
+            runtime_id: "odin-yggdrasil-1".into(),
+            signer_identity_id: derive_service_identity_id::<OdinTopologyIdentity>(&public_key)
+                .unwrap(),
+            signer_public_key: public_key,
+            signature_algorithm: "ed25519".into(),
+            signing_purpose: ODIN_RUNTIME_TOPOLOGY_CORRELATION_SIGNING_PURPOSE.into(),
+            signed_schema: ODIN_RUNTIME_TOPOLOGY_CORRELATION_SCHEMA.into(),
+            binding_authority: "root".into(),
+            bound_at_unix_millis: 100,
+            expires_at_unix_millis: Some(200),
+            private_state_exposed: false,
+        }
+    }
+
+    fn runtime_presence_anchor() -> GameCultServiceTrustAnchorRecord {
+        let public_key = vec![7; 32];
+        GameCultServiceTrustAnchorRecord {
+            schema_version: GAMECULT_SERVICE_TRUST_ANCHOR_SCHEMA.into(),
+            trust_anchor_id: "root/ghostlight/runtime-presence".into(),
+            service_id: "ghostlight".into(),
+            runtime_id: "ghostlight-yggdrasil-1".into(),
+            signer_identity_id: derive_service_identity_id::<GameCultProviderHealthIdentity>(
+                &public_key,
+            )
+            .unwrap(),
+            signer_public_key: public_key,
+            signature_algorithm: "ed25519".into(),
+            signing_purpose: GAMECULT_RUNTIME_PRESENCE_HEALTH_SIGNING_PURPOSE.into(),
+            signed_schema: GAMECULT_RUNTIME_PRESENCE_HEALTH_SCHEMA.into(),
+            binding_authority: "root".into(),
+            bound_at_unix_millis: 100,
+            expires_at_unix_millis: Some(200),
+            private_state_exposed: false,
+        }
+    }
+
+    struct DualProofFixture {
+        stable_signer: ServiceIdentitySigner<GameCultProviderHealthIdentity>,
+        activation_signer: IdunnRuntimeActivationSigner,
+        odin_signer: ServiceIdentitySigner<OdinTopologyIdentity>,
+        idunn_anchor: crate::ServiceIdentityTrustAnchor,
+        stable_public_key: Vec<u8>,
+        odin_anchor: GameCultServiceTrustAnchorRecord,
+        expected: IdunnExpectedIncarnationRecord,
+        activation: IdunnRuntimeActivationRecord,
+        presence: GameCultRuntimePresenceHealthRecord,
+    }
+
+    fn dual_proof_fixture(identity_path: &std::path::Path) -> Result<DualProofFixture> {
+        let stable_signer =
+            enroll_service_identity_at::<GameCultProviderHealthIdentity>(identity_path)?;
+        let stable_public = stable_signer.trust_anchor()?;
+        let idunn_signer = enroll_service_identity_at::<IdunnServiceIdentity>(
+            &identity_path.with_extension("idunn.cc"),
+        )?;
+        let idunn_anchor = idunn_signer.trust_anchor()?;
+        let odin_signer = enroll_service_identity_at::<OdinTopologyIdentity>(
+            &identity_path.with_extension("odin.cc"),
+        )?;
+        let odin_public = odin_signer.trust_anchor()?;
+        let mut expected = expected_incarnation();
+        expected.expected_signer_identity_id = stable_public.identity_id.clone();
+        expected.capabilities[0].minimum_capacity = 2;
+        let launch =
+            IdunnRuntimeActivationLaunch::issue(&expected, digest('8'), 99, &idunn_signer)?;
+        let activation = launch.activation().clone();
+        let mut activation_credential = Vec::new();
+        assert_eq!(
+            launch.write_credential(&mut activation_credential)?,
+            activation
+        );
+        let activation_signer =
+            IdunnRuntimeActivationSigner::from_credential_reader(&activation_credential[..])?;
+
+        let stable_public_key = stable_public.public_key.clone();
+        let odin_anchor = GameCultServiceTrustAnchorRecord {
+            schema_version: GAMECULT_SERVICE_TRUST_ANCHOR_SCHEMA.into(),
+            trust_anchor_id: "root/odin/runtime-topology".into(),
+            service_id: "odin".into(),
+            runtime_id: "odin-yggdrasil-1".into(),
+            signer_identity_id: odin_public.identity_id,
+            signer_public_key: odin_public.public_key,
+            signature_algorithm: "ed25519".into(),
+            signing_purpose: ODIN_RUNTIME_TOPOLOGY_CORRELATION_SIGNING_PURPOSE.into(),
+            signed_schema: ODIN_RUNTIME_TOPOLOGY_CORRELATION_SCHEMA.into(),
+            binding_authority: "root".into(),
+            bound_at_unix_millis: 1,
+            expires_at_unix_millis: Some(1_000),
+            private_state_exposed: false,
+        };
+
+        let mut presence = runtime_presence();
+        presence.target = expected.target.clone();
+        presence.plan_id = expected.plan_id.clone();
+        presence.incarnation_id = expected.incarnation_id.clone();
+        presence.sealed_release_id = expected.sealed_release_id.clone();
+        presence.state_schema_generation = expected.state_schema_generation.clone();
+        presence.state_contract_sha256 = expected.state_contract_sha256.clone();
+        presence.bound_endpoint = expected
+            .route
+            .as_ref()
+            .map(|route| route.candidate_endpoint.clone());
+        presence.capabilities = expected
+            .capabilities
+            .iter()
+            .map(|capability| GameCultRuntimeCapability {
+                capability: capability.capability.clone(),
+                schema: capability.schema.clone(),
+                compatibility: capability.compatibility.clone(),
+                capacity: capability.minimum_capacity,
+            })
+            .collect();
+        presence.health_contract = expected.health_contract.clone();
+        presence.runtime_id = activation.runtime_id.clone();
+        presence.runtime_instance_id = activation.runtime_instance_id.clone();
+        presence.expected_projection_sha256 = activation.expected_projection_sha256.clone();
+        presence.activation_witness_sha256 = activation.canonical_sha256()?;
+        presence.signer_identity_id = stable_public.identity_id;
+        presence.activation_signer_identity_id = activation_signer.identity_id();
+        presence.observed_at_unix_millis = 110;
+        presence.signature.clear();
+        presence.activation_signature.clear();
+        let proof_payload = presence.canonical_proof_payload()?;
+        presence.signature = stable_signer
+            .sign::<GameCultRuntimePresenceHealthPurpose>(&proof_payload)
+            .signature;
+        presence.activation_signature = activation_signer.sign_presence_proof(&presence)?;
+
+        Ok(DualProofFixture {
+            stable_signer,
+            activation_signer,
+            odin_signer,
+            idunn_anchor,
+            stable_public_key,
+            odin_anchor,
+            expected,
+            activation,
+            presence,
+        })
+    }
+
+    fn resign_presence(fixture: &mut DualProofFixture) -> Result<Vec<u8>> {
+        fixture.presence.signature.clear();
+        fixture.presence.activation_signature.clear();
+        let proof_payload = fixture.presence.canonical_proof_payload()?;
+        fixture.presence.signature = fixture
+            .stable_signer
+            .sign::<GameCultRuntimePresenceHealthPurpose>(&proof_payload)
+            .signature;
+        fixture.presence.activation_signature = fixture
+            .activation_signer
+            .sign_presence_proof(&fixture.presence)?;
+        Ok(rmp_serde::to_vec(&fixture.presence)?)
+    }
+
+    fn fixture_authority(fixture: &DualProofFixture) -> Result<VerifiedRuntimeAuthority> {
+        verify_runtime_authority(
+            &fixture.expected,
+            &fixture.activation,
+            &fixture.idunn_anchor,
+            &fixture.stable_public_key,
+        )
+    }
+
+    fn authenticate_fixture(
+        fixture: &DualProofFixture,
+    ) -> Result<AuthenticatedRuntimePresenceClaim> {
+        authenticate_runtime_presence_claim(
+            &rmp_serde::to_vec(&fixture.presence)?,
+            &fixture_authority(fixture)?,
+            RuntimePresenceAuthenticationContext {
+                trusted_received_at_unix_millis: 120,
+                maximum_age_millis: 30,
+                maximum_future_skew_millis: 5,
+            },
+        )
+    }
+
+    fn correlate_fixture(fixture: &DualProofFixture) -> Result<RuntimePresenceCorrelation> {
+        correlate_runtime_presence_claim(
+            authenticate_fixture(fixture)?,
+            &fixture_authority(fixture)?,
+        )
+    }
+
+    fn verify_fixture(fixture: &DualProofFixture) -> Result<VerifiedRuntimePresence> {
+        correlate_fixture(fixture)?.into_undisputed_present()
+    }
+
+    fn authenticated_topology_receipt(
+        fixture: &DualProofFixture,
+        presence: &VerifiedRuntimePresence,
+        present: bool,
+        disagreements: Vec<OdinTopologyDisagreement>,
+    ) -> Result<AuthenticatedOdinRuntimeTopologyCorrelation> {
+        let authority = fixture_authority(fixture)?;
+        let mut receipt = topology_correlation(&fixture.expected);
+        receipt.current_activation_sha256 = Some(authority.activation_sha256().into());
+        receipt.signed_presence_sha256 = Some(presence.signed_presence_sha256().into());
+        receipt.observed_presence_state = Some(presence.record().state.clone());
+        receipt.observed_presence_publisher_sequence = Some(presence.record().publisher_sequence);
+        receipt.observed_write_lease_sha256 = presence.record().write_lease_sha256.clone();
+        receipt.observed_capabilities = presence.record().capabilities.clone();
+        receipt.runtime_instance_id = Some(fixture.activation.runtime_instance_id.clone());
+        receipt.present = present;
+        receipt.ready = present && presence.record().state == "active";
+        receipt.disagreements = disagreements;
+        receipt.signer_identity_id = fixture.odin_anchor.signer_identity_id.clone();
+        receipt.signature.clear();
+        receipt.signature = fixture
+            .odin_signer
+            .sign::<OdinRuntimeTopologyCorrelationPurpose>(&receipt.unsigned_signature_payload()?)
+            .signature;
+        let encoded = receipt.canonical_bytes()?;
+        authenticate_odin_runtime_topology_correlation(
+            &encoded,
+            &authority,
+            presence.record().write_lease_sha256.as_deref(),
+            &fixture.odin_anchor.signer_public_key,
+            OdinTopologyAuthenticationContext {
+                trusted_received_at_unix_millis: 120,
+                maximum_age_millis: 30,
+                maximum_future_skew_millis: 5,
+            },
+        )
+    }
+
+    #[test]
+    fn runtime_authority_contracts_round_trip_as_canonical_positional_records() -> Result<()> {
+        let presence = runtime_presence();
+        presence.validate()?;
+        let encoded_presence = rmp_serde::to_vec(&presence)?;
+        assert_eq!(messagepack_array_len(&encoded_presence), Some(24));
+        let decoded_presence: GameCultRuntimePresenceHealthRecord =
+            rmp_serde::from_slice(&encoded_presence)?;
+        assert_eq!(decoded_presence, presence);
+        let unsigned = presence.canonical_proof_payload()?;
+        let unsigned_presence: GameCultRuntimePresenceHealthRecord =
+            rmp_serde::from_slice(&unsigned)?;
+        assert!(unsigned_presence.signature.is_empty());
+        assert!(unsigned_presence.activation_signature.is_empty());
+
+        let activation = runtime_activation();
+        let encoded_activation = activation.canonical_bytes()?;
+        assert_eq!(messagepack_array_len(&encoded_activation), Some(10));
+        assert_eq!(
+            IdunnRuntimeActivationRecord::decode_canonical(&encoded_activation)?,
+            activation
+        );
+        assert_eq!(
+            activation.canonical_sha256()?,
+            prefixed_sha256(&encoded_activation)
+        );
+
+        let lease = process_write_lease();
+        lease.validate()?;
+        let encoded_lease = lease.canonical_bytes()?;
+        assert_eq!(messagepack_array_len(&encoded_lease), Some(14));
+        assert_eq!(
+            IdunnProcessWriteLeaseRecord::decode_canonical(&encoded_lease)?,
+            lease
+        );
+        assert_eq!(lease.canonical_sha256()?, prefixed_sha256(&encoded_lease));
+        Ok(())
+    }
+
+    #[test]
+    fn exact_stable_and_activation_proofs_admit_runtime_presence() -> Result<()> {
+        let temp = tempfile::tempdir()?;
+        let fixture = dual_proof_fixture(&temp.path().join("runtime-presence.cc"))?;
+        assert_eq!(fixture.activation.activation_signer_public_key.len(), 32);
+        let verified = verify_fixture(&fixture)?;
+        assert_eq!(verified.record(), &fixture.presence);
+        Ok(())
+    }
+
+    #[test]
+    fn authenticated_expected_disagreements_remain_typed_present_and_not_ready() -> Result<()> {
+        type Mutation = fn(&mut GameCultRuntimePresenceHealthRecord);
+        let cases: &[(&str, &str, Mutation)] = &[
+            ("target", "target", |value| value.target = "epiphany".into()),
+            ("projection", "expected-projection", |value| {
+                value.expected_projection_sha256 = digest('0')
+            }),
+            ("plan", "plan-id", |value| value.plan_id = digest('0')),
+            ("incarnation", "incarnation-id", |value| {
+                value.incarnation_id = "ghostlight/other/1".into()
+            }),
+            ("release", "sealed-release-id", |value| {
+                value.sealed_release_id = digest('0')
+            }),
+            ("runtime", "runtime-id", |value| {
+                value.runtime_id = "ghostlight-other-runtime".into()
+            }),
+            ("process", "runtime-instance-id", |value| {
+                value.runtime_instance_id = digest('0')
+            }),
+            ("endpoint", "bound-endpoint", |value| {
+                value.bound_endpoint = Some("http://127.0.0.1:14104".into())
+            }),
+            ("health", "health-contract", |value| {
+                value.health_contract = "ghostlight.other-health.v1".into()
+            }),
+            ("state-generation", "state-schema-generation", |value| {
+                value.state_schema_generation = Some("world-v3".into())
+            }),
+            ("state-contract", "state-contract", |value| {
+                value.state_contract_sha256 = Some(digest('0'))
+            }),
+            ("activation", "activation-witness", |value| {
+                value.activation_witness_sha256 = digest('0')
+            }),
+        ];
+
+        let temp = tempfile::tempdir()?;
+        for (name, expected_code, mutate) in cases {
+            let mut fixture = dual_proof_fixture(&temp.path().join(format!("{name}.cc")))?;
+            mutate(&mut fixture.presence);
+            resign_presence(&mut fixture)?;
+            let correlation = correlate_fixture(&fixture)?;
+            assert!(
+                correlation
+                    .disagreements()
+                    .iter()
+                    .any(|disagreement| disagreement.code == *expected_code),
+                "missing {expected_code} disagreement for {name}"
+            );
+            assert_eq!(
+                correlation.claim().record().runtime_instance_id,
+                fixture.presence.runtime_instance_id
+            );
+            assert!(correlation.into_undisputed_present().is_err());
+        }
+        Ok(())
+    }
+
+    #[test]
+    fn provider_owns_observed_capacity_while_expected_owns_only_the_minimum() -> Result<()> {
+        let temp = tempfile::tempdir()?;
+        let mut fixture = dual_proof_fixture(&temp.path().join("runtime-presence.cc"))?;
+        fixture.presence.capabilities[0].capacity = 50;
+        fixture
+            .presence
+            .capabilities
+            .push(runtime_capability("telemetry"));
+        resign_presence(&mut fixture)?;
+        verify_fixture(&fixture)?;
+
+        fixture.presence.capabilities[0].capacity = 1;
+        fixture
+            .presence
+            .capabilities
+            .retain(|capability| capability.capability != "state");
+        resign_presence(&mut fixture)?;
+        let correlation = correlate_fixture(&fixture)?;
+        let codes = correlation
+            .disagreements()
+            .iter()
+            .map(|disagreement| disagreement.code.as_str())
+            .collect::<Vec<_>>();
+        assert!(codes.contains(&"expected-capability-000-capacity"));
+        assert!(codes.contains(&"expected-capability-001-missing"));
+        assert!(!codes.iter().any(|code| code.contains("unexpected")));
+        Ok(())
+    }
+
+    #[test]
+    fn stable_proof_and_provider_key_substitution_fail_closed() -> Result<()> {
+        let temp = tempfile::tempdir()?;
+        let mut fixture = dual_proof_fixture(&temp.path().join("runtime-presence.cc"))?;
+        fixture.presence.detail = "tampered after signing".into();
+        assert!(authenticate_fixture(&fixture).is_err());
+
+        let other_idunn = enroll_service_identity_at::<IdunnServiceIdentity>(
+            &temp.path().join("other-idunn.cc"),
+        )?;
+        assert!(
+            verify_runtime_authority(
+                &fixture.expected,
+                &fixture.activation,
+                &other_idunn.trust_anchor()?,
+                &fixture.stable_public_key,
+            )
+            .is_err()
+        );
+
+        fixture.stable_public_key = vec![9; 32];
+        assert!(fixture_authority(&fixture).is_err());
+        Ok(())
+    }
+
+    #[test]
+    fn incumbent_stable_key_without_activation_key_cannot_claim_presence() -> Result<()> {
+        let temp = tempfile::tempdir()?;
+        let mut fixture = dual_proof_fixture(&temp.path().join("runtime-presence.cc"))?;
+        fixture.presence.activation_signature = vec![0; 64];
+        let proof_payload = fixture.presence.canonical_proof_payload()?;
+        fixture.presence.signature = fixture
+            .stable_signer
+            .sign::<GameCultRuntimePresenceHealthPurpose>(&proof_payload)
+            .signature;
+
+        let error = verify_fixture(&fixture).unwrap_err();
+        assert!(error.to_string().contains("activation proof verification"));
+        Ok(())
+    }
+
+    #[test]
+    fn activation_cannot_substitute_another_expected_runtime_id() -> Result<()> {
+        let temp = tempfile::tempdir()?;
+        let mut fixture = dual_proof_fixture(&temp.path().join("runtime-presence.cc"))?;
+        fixture.activation.runtime_id = "ghostlight-yggdrasil-2".into();
+        fixture.presence.runtime_id = fixture.activation.runtime_id.clone();
+        fixture.presence.activation_witness_sha256 = fixture.activation.canonical_sha256()?;
+
+        // The stable service key can re-sign the altered canonical statement,
+        // but the activation proof still came from the other runtime id.
+        let proof_payload = fixture.presence.canonical_proof_payload()?;
+        fixture.presence.signature = fixture
+            .stable_signer
+            .sign::<GameCultRuntimePresenceHealthPurpose>(&proof_payload)
+            .signature;
+        let error = fixture_authority(&fixture).unwrap_err();
+        assert!(error.to_string().contains("current Expected"));
+        Ok(())
+    }
+
+    #[test]
+    fn idunn_signature_prevents_provider_minted_activation() -> Result<()> {
+        let temp = tempfile::tempdir()?;
+        let mut fixture = dual_proof_fixture(&temp.path().join("runtime-presence.cc"))?;
+        fixture.activation.issued_at_unix_millis += 1;
+        fixture.presence.activation_witness_sha256 = fixture.activation.canonical_sha256()?;
+        resign_presence(&mut fixture)?;
+        let error = fixture_authority(&fixture).unwrap_err();
+        assert!(
+            error
+                .to_string()
+                .contains("Idunn runtime activation signature")
+        );
+        Ok(())
+    }
+
+    #[test]
+    fn authenticated_odin_receipt_is_fresh_evidence_not_replay_authority() -> Result<()> {
+        let temp = tempfile::tempdir()?;
+        let fixture = dual_proof_fixture(&temp.path().join("runtime-presence.cc"))?;
+        let authority = fixture_authority(&fixture)?;
+        let presence = verify_fixture(&fixture)?;
+        let accepted = authenticated_topology_receipt(&fixture, &presence, true, Vec::new())?;
+        assert_eq!(
+            accepted.record().observed_presence_publisher_sequence,
+            Some(fixture.presence.publisher_sequence)
+        );
+        assert_eq!(
+            accepted.record().signed_presence_sha256.as_deref(),
+            Some(presence.signed_presence_sha256())
+        );
+
+        let mut tampered = accepted.record().clone();
+        tampered.signature = vec![0; 64];
+        assert!(
+            authenticate_odin_runtime_topology_correlation(
+                &tampered.canonical_bytes()?,
+                &authority,
+                presence.record().write_lease_sha256.as_deref(),
+                &fixture.odin_anchor.signer_public_key,
+                OdinTopologyAuthenticationContext {
+                    trusted_received_at_unix_millis: 120,
+                    maximum_age_millis: 30,
+                    maximum_future_skew_millis: 5,
+                },
+            )
+            .is_err()
+        );
+        assert!(
+            authenticate_odin_runtime_topology_correlation(
+                accepted.canonical_bytes(),
+                &authority,
+                presence.record().write_lease_sha256.as_deref(),
+                &fixture.odin_anchor.signer_public_key,
+                OdinTopologyAuthenticationContext {
+                    trusted_received_at_unix_millis: 200,
+                    maximum_age_millis: 30,
+                    maximum_future_skew_millis: 5,
+                },
+            )
+            .is_err()
+        );
+        Ok(())
+    }
+
+    #[test]
+    fn separate_launches_receive_distinct_activation_identities() -> Result<()> {
+        let temp = tempfile::tempdir()?;
+        let idunn =
+            enroll_service_identity_at::<IdunnServiceIdentity>(&temp.path().join("idunn.cc"))?;
+        let expected = expected_incarnation();
+        let first = IdunnRuntimeActivationLaunch::issue(&expected, digest('8'), 99, &idunn)?;
+        let second = IdunnRuntimeActivationLaunch::issue(&expected, digest('9'), 100, &idunn)?;
+        assert_ne!(
+            first.activation().activation_signer_identity_id,
+            second.activation().activation_signer_identity_id
+        );
+        Ok(())
+    }
+
+    #[test]
+    fn trusted_time_rejects_stale_and_future_presence() -> Result<()> {
+        let temp = tempfile::tempdir()?;
+        let mut fixture = dual_proof_fixture(&temp.path().join("runtime-presence.cc"))?;
+        let authority = fixture_authority(&fixture)?;
+        let canonical = rmp_serde::to_vec(&fixture.presence)?;
+        assert!(
+            authenticate_runtime_presence_claim(
+                &canonical,
+                &authority,
+                RuntimePresenceAuthenticationContext {
+                    trusted_received_at_unix_millis: 200,
+                    maximum_age_millis: 10,
+                    maximum_future_skew_millis: 5,
+                },
+            )
+            .is_err()
+        );
+
+        fixture.presence.observed_at_unix_millis = 126;
+        resign_presence(&mut fixture)?;
+        assert!(
+            authenticate_runtime_presence_claim(
+                &rmp_serde::to_vec(&fixture.presence)?,
+                &authority,
+                RuntimePresenceAuthenticationContext {
+                    trusted_received_at_unix_millis: 120,
+                    maximum_age_millis: 30,
+                    maximum_future_skew_millis: 5,
+                },
+            )
+            .is_err()
+        );
+
+        Ok(())
+    }
+
+    #[test]
+    fn runtime_authority_decoders_reject_malformed_and_noncanonical_bytes() -> Result<()> {
+        let temp = tempfile::tempdir()?;
+        let fixture = dual_proof_fixture(&temp.path().join("runtime-presence.cc"))?;
+        assert!(
+            authenticate_runtime_presence_claim(
+                &[0x91, 0xc0],
+                &fixture_authority(&fixture)?,
+                RuntimePresenceAuthenticationContext {
+                    trusted_received_at_unix_millis: 120,
+                    maximum_age_millis: 30,
+                    maximum_future_skew_millis: 5,
+                },
+            )
+            .is_err()
+        );
+        assert!(IdunnRuntimeActivationRecord::decode_canonical(&[0x91, 0xc0]).is_err());
+        assert!(IdunnProcessWriteLeaseRecord::decode_canonical(&[0x91, 0xc0]).is_err());
+
+        let mut legacy_presence = fixture.presence.clone();
+        legacy_presence.schema_version = "gamecult.runtime_presence_health.v1".into();
+        assert!(
+            authenticate_runtime_presence_claim(
+                &rmp_serde::to_vec(&legacy_presence)?,
+                &fixture_authority(&fixture)?,
+                RuntimePresenceAuthenticationContext {
+                    trusted_received_at_unix_millis: 120,
+                    maximum_age_millis: 30,
+                    maximum_future_skew_millis: 5,
+                },
+            )
+            .is_err()
+        );
+        let mut legacy_activation = fixture.activation.clone();
+        legacy_activation.schema_version = "idunn.runtime_activation.v1".into();
+        assert!(
+            IdunnRuntimeActivationRecord::decode_canonical(&rmp_serde::to_vec(&legacy_activation)?)
+                .is_err()
+        );
+        let mut legacy_expected = fixture.expected.clone();
+        legacy_expected.schema_version = "idunn.expected_incarnation.v1".into();
+        assert!(
+            IdunnExpectedIncarnationRecord::decode_canonical(&rmp_serde::to_vec(&legacy_expected)?)
+                .is_err()
+        );
+        let mut legacy_topology = topology_correlation(&fixture.expected);
+        legacy_topology.schema_version = "odin.runtime_topology_correlation.v1".into();
+        assert!(
+            OdinRuntimeTopologyCorrelationRecord::decode_canonical_signed_payload(
+                &rmp_serde::to_vec(&legacy_topology)?,
+            )
+            .is_err()
+        );
+
+        let presence = rmp_serde::to_vec(&runtime_presence())?;
+        assert_eq!(&presence[..3], &[0xdc, 0, 24]);
+        let mut noncanonical_presence = vec![0xdd, 0, 0, 0, 24];
+        noncanonical_presence.extend_from_slice(&presence[3..]);
+        assert!(
+            authenticate_runtime_presence_claim(
+                &noncanonical_presence,
+                &fixture_authority(&fixture)?,
+                RuntimePresenceAuthenticationContext {
+                    trusted_received_at_unix_millis: 120,
+                    maximum_age_millis: 30,
+                    maximum_future_skew_millis: 5,
+                },
+            )
+            .is_err()
+        );
+
+        let activation = runtime_activation().canonical_bytes()?;
+        assert_eq!(activation[0], 0x9a);
+        let mut noncanonical_activation = vec![0xdc, 0, 10];
+        noncanonical_activation.extend_from_slice(&activation[1..]);
+        assert!(IdunnRuntimeActivationRecord::decode_canonical(&noncanonical_activation).is_err());
+
+        let lease = process_write_lease().canonical_bytes()?;
+        assert_eq!(lease[0], 0x9e);
+        let mut noncanonical_lease = vec![0xdc, 0, 14];
+        noncanonical_lease.extend_from_slice(&lease[1..]);
+        assert!(IdunnProcessWriteLeaseRecord::decode_canonical(&noncanonical_lease).is_err());
+        Ok(())
+    }
+
+    #[test]
+    fn runtime_presence_refuses_capability_and_warming_lease_ambiguity() {
+        let mut value = runtime_presence();
+        value.capabilities.reverse();
+        assert!(value.validate().is_err());
+
+        let mut value = runtime_presence();
+        let mut duplicate = runtime_capability("state");
+        duplicate.capacity = 2;
+        value.capabilities.push(duplicate);
+        assert!(value.validate().is_err());
+
+        let mut value = runtime_presence();
+        value.capabilities[0].capacity = 0;
+        assert!(value.validate().is_err());
+
+        let mut value = runtime_presence();
+        value.state = "warming".into();
+        assert!(value.validate().is_err());
+        value.write_lease_sha256 = None;
+        assert!(value.validate().is_ok());
+
+        let mut value = runtime_presence();
+        value.state_schema_generation = None;
+        assert!(value.validate().is_err());
+        value.state_contract_sha256 = None;
+        assert!(value.validate().is_err());
+        value.write_lease_sha256 = None;
+        assert!(value.validate().is_ok());
+    }
+
+    #[test]
+    fn runtime_authority_refuses_malformed_digest_process_and_epoch_bindings() {
+        let mut value = runtime_presence();
+        value.activation_witness_sha256 = digest('A');
+        assert!(value.validate().is_err());
+
+        let mut value = runtime_presence();
+        value.plan_id = "plan-1".into();
+        assert!(value.validate().is_err());
+
+        let mut value = runtime_presence();
+        value.sealed_release_id = "release-1".into();
+        assert!(value.validate().is_err());
+
+        let mut value = runtime_presence();
+        value.runtime_instance_id = "systemd-invocation-1".into();
+        assert!(value.validate().is_err());
+
+        let mut value = runtime_presence();
+        value.expected_projection_sha256 = "expected-1".into();
+        assert!(value.validate().is_err());
+
+        let mut value = runtime_presence();
+        value.write_lease_sha256 = Some("lease-1".into());
+        assert!(value.validate().is_err());
+
+        let mut value = process_write_lease();
+        value.warming_presence_sha256 = digest('D');
+        assert!(value.validate().is_err());
+
+        let mut value = process_write_lease();
+        value.plan_id = "plan-1".into();
+        assert!(value.validate().is_err());
+
+        let mut value = process_write_lease();
+        value.runtime_instance_id = "pid-4242".into();
+        assert!(value.validate().is_err());
+
+        let mut value = process_write_lease();
+        value.lease_epoch = 0;
+        assert!(value.validate().is_err());
+
+        let mut value = runtime_activation();
+        value.runtime_instance_id = digest('A');
+        assert!(value.validate().is_err());
+
+        let mut value = runtime_activation();
+        value.expected_projection_sha256 = "expected-1".into();
+        assert!(value.validate().is_err());
+    }
+
+    #[test]
+    fn runtime_presence_trust_anchor_is_provider_profile_and_purpose_bound() -> Result<()> {
+        let anchor = runtime_presence_anchor();
+        anchor.validate()?;
+
+        let mut value = anchor.clone();
+        value.signing_purpose = "idunn.signed_daemon_health.v1".into();
+        assert!(value.validate().is_err());
+
+        let mut value = anchor.clone();
+        value.signed_schema = IDUNN_SIGNED_DAEMON_HEALTH_SCHEMA.into();
+        assert!(value.validate().is_err());
+
+        let mut value = anchor.clone();
+        value.signing_purpose = "gamecult.runtime_presence_health.v1".into();
+        value.signed_schema = "gamecult.runtime_presence_health.v1".into();
+        assert!(value.validate().is_err());
+
+        let mut value = anchor;
+        value.signer_identity_id =
+            derive_service_identity_id::<IdunnServiceIdentity>(&value.signer_public_key)?;
+        assert!(value.validate().is_err());
+        Ok(())
+    }
+
+    #[test]
+    fn process_write_lease_cannot_encode_route_or_traffic_authority() -> Result<()> {
+        let canonical = process_write_lease().canonical_bytes()?;
+        assert_eq!(messagepack_array_len(&canonical), Some(14));
+
+        for forbidden in ["route", "traffic"] {
+            let mut with_extra_authority = vec![0xdc, 0, 15];
+            with_extra_authority.extend_from_slice(&canonical[1..]);
+            with_extra_authority.extend_from_slice(&rmp_serde::to_vec(&forbidden)?);
+            assert!(IdunnProcessWriteLeaseRecord::decode_canonical(&with_extra_authority).is_err());
+        }
+        Ok(())
+    }
+
+    #[test]
+    fn expected_and_topology_correlation_round_trip_canonically() -> Result<()> {
+        let expected = expected_incarnation();
+        let expected_bytes = expected.canonical_bytes()?;
+        assert_eq!(&expected_bytes[..3], &[0xdc, 0, 18]);
+        assert_eq!(
+            IdunnExpectedIncarnationRecord::decode_canonical(&expected_bytes)?,
+            expected
+        );
+        assert_eq!(
+            expected.canonical_sha256()?,
+            prefixed_sha256(&expected_bytes)
+        );
+
+        let receipt = topology_correlation(&expected);
+        validate_against_current_lease(&receipt, &expected)?;
+        let receipt_bytes = receipt.canonical_bytes()?;
+        assert_eq!(&receipt_bytes[..3], &[0xdc, 0, 21]);
+        let (decoded, unsigned) =
+            OdinRuntimeTopologyCorrelationRecord::decode_canonical_signed_payload(&receipt_bytes)?;
+        assert_eq!(decoded, receipt);
+        let unsigned_receipt: OdinRuntimeTopologyCorrelationRecord =
+            rmp_serde::from_slice(&unsigned)?;
+        assert!(unsigned_receipt.signature.is_empty());
+        assert_eq!(unsigned, receipt.unsigned_signature_payload()?);
+        assert_eq!(receipt.canonical_sha256()?, prefixed_sha256(&receipt_bytes));
+        Ok(())
+    }
+
+    #[test]
+    fn expected_and_topology_decoders_reject_noncanonical_or_extended_records() -> Result<()> {
+        assert!(IdunnExpectedIncarnationRecord::decode_canonical(&[0x91, 0xc0]).is_err());
+        assert!(
+            OdinRuntimeTopologyCorrelationRecord::decode_canonical_signed_payload(&[0x91, 0xc0])
+                .is_err()
+        );
+
+        let expected = expected_incarnation().canonical_bytes()?;
+        let mut noncanonical_expected = vec![0xdd, 0, 0, 0, 18];
+        noncanonical_expected.extend_from_slice(&expected[3..]);
+        assert!(IdunnExpectedIncarnationRecord::decode_canonical(&noncanonical_expected).is_err());
+
+        let receipt = topology_correlation(&expected_incarnation()).canonical_bytes()?;
+        let mut noncanonical_receipt = vec![0xdd, 0, 0, 0, 21];
+        noncanonical_receipt.extend_from_slice(&receipt[3..]);
+        assert!(
+            OdinRuntimeTopologyCorrelationRecord::decode_canonical_signed_payload(
+                &noncanonical_receipt,
+            )
+            .is_err()
+        );
+
+        for forbidden in ["private-host-path", "runner-secret"] {
+            let mut extended = vec![0xdc, 0, 19];
+            extended.extend_from_slice(&expected[3..]);
+            extended.extend_from_slice(&rmp_serde::to_vec(&forbidden)?);
+            assert!(IdunnExpectedIncarnationRecord::decode_canonical(&extended).is_err());
+        }
+        Ok(())
+    }
+
+    #[test]
+    fn expected_refuses_partial_state_and_noncanonical_claim_sets() {
+        let mut value = expected_incarnation();
+        value.state_contract_sha256 = None;
+        assert!(value.validate().is_err());
+
+        let mut value = expected_incarnation();
+        value.state_schema_generation = None;
+        assert!(value.validate().is_err());
+
+        let mut value = expected_incarnation();
+        value.state_schema_generation = None;
+        value.state_contract_sha256 = None;
+        assert!(value.validate().is_err());
+        value.write_lease_required = false;
+        assert!(value.validate().is_ok());
+
+        let mut value = expected_incarnation();
+        value.capabilities.reverse();
+        assert!(value.validate().is_err());
+
+        let mut value = expected_incarnation();
+        value.capabilities.push(expected_capability("state"));
+        assert!(value.validate().is_err());
+
+        let mut value = expected_incarnation();
+        value.dependencies.reverse();
+        assert!(value.validate().is_err());
+
+        let mut value = expected_incarnation();
+        value.dependencies.push(value.dependencies[1].clone());
+        assert!(value.validate().is_err());
+
+        let mut value = expected_incarnation();
+        let mut duplicate = value.dependencies[1].clone();
+        duplicate.kind = "required".into();
+        value.dependencies.push(duplicate);
+        assert!(value.validate().is_err());
+
+        let mut value = expected_incarnation();
+        value.dependencies[0].provider_authority = None;
+        assert!(value.validate().is_err());
+
+        let mut value = expected_incarnation();
+        value.source_revision = "A".repeat(40);
+        assert!(value.validate().is_err());
+
+        for private_source in [
+            "F:\\Projects\\Ghostlight",
+            "/srv/build/Ghostlight",
+            "https://token@github.com/GameCult/Ghostlight",
+        ] {
+            let mut value = expected_incarnation();
+            value.source_repository = private_source.into();
+            assert!(value.validate().is_err());
+        }
+
+        let mut value = expected_incarnation();
+        let stable_endpoint = value.route.as_ref().unwrap().stable_endpoint.clone();
+        value.route.as_mut().unwrap().candidate_endpoint = stable_endpoint;
+        assert!(value.validate().is_err());
+    }
+
+    #[test]
+    fn expected_route_keeps_rudp_distinct_and_scheme_exact() {
+        let mut value = expected_incarnation();
+        value.route = Some(IdunnExpectedRoute {
+            route_id: "odin-rendezvous".into(),
+            transport: "rudp".into(),
+            stable_endpoint: "rudp://10.77.0.1:17871".into(),
+            candidate_endpoint: "rudp://127.0.0.1:24171".into(),
+        });
+        assert!(value.validate().is_ok());
+
+        value.route.as_mut().unwrap().candidate_endpoint = "tcp://127.0.0.1:24171".into();
+        assert!(value.validate().is_err());
+
+        value.route.as_mut().unwrap().candidate_endpoint = "udp://127.0.0.1:24171".into();
+        assert!(value.validate().is_err());
+    }
+
+    #[test]
+    fn topology_correlation_refuses_expected_substitution_and_dependency_omission() {
+        let expected = expected_incarnation();
+
+        let mut value = topology_correlation(&expected);
+        value.target = "epiphany".into();
+        assert!(value.validate().is_ok());
+        assert!(validate_against_current_lease(&value, &expected).is_err());
+
+        let mut value = topology_correlation(&expected);
+        value.runtime_id = "ghostlight-other-runtime".into();
+        assert!(validate_against_current_lease(&value, &expected).is_err());
+
+        let mut value = topology_correlation(&expected);
+        value.expected_projection_sha256 = digest('c');
+        assert!(validate_against_current_lease(&value, &expected).is_err());
+
+        let mut value = topology_correlation(&expected);
+        value.dependencies.pop();
+        assert!(value.validate().is_ok());
+        assert!(validate_against_current_lease(&value, &expected).is_err());
+
+        let mut value = topology_correlation(&expected);
+        value.dependencies[0].provider_id = Some("odin-substitute".into());
+        assert!(value.validate().is_ok());
+        assert!(validate_against_current_lease(&value, &expected).is_err());
+
+        let mut value = topology_correlation(&expected);
+        value.dependencies[0].kind = "required".into();
+        assert!(value.validate().is_ok());
+        assert!(validate_against_current_lease(&value, &expected).is_err());
+
+        let mut value = topology_correlation(&expected);
+        value.dependencies[0].observed_capacity = Some(0);
+        assert!(value.validate().is_err());
+
+        let mut value = topology_correlation(&expected);
+        value.dependencies[0].observed_capacity = Some(1);
+        let mut stricter = expected.clone();
+        stricter.dependencies[0].minimum_capacity = 2;
+        value.expected_projection_sha256 = stricter.canonical_sha256().unwrap();
+        assert!(validate_against_current_lease(&value, &stricter).is_err());
+    }
+
+    #[test]
+    fn topology_correlation_requires_explicit_coherent_partial_states() {
+        let expected = expected_incarnation();
+        let mut value = topology_correlation(&expected);
+        value.signed_presence_sha256 = None;
+        value.observed_presence_state = None;
+        value.observed_presence_publisher_sequence = None;
+        value.observed_write_lease_sha256 = None;
+        value.observed_capabilities.clear();
+        value.present = false;
+        value.ready = false;
+        assert!(value.validate().is_err());
+
+        value.disagreements.push(OdinTopologyDisagreement {
+            code: "presence-missing".into(),
+            expected: Some("signed-runtime-presence".into()),
+            observed: None,
+        });
+        assert!(value.validate().is_ok());
+
+        let mut value = topology_correlation(&expected);
+        value.runtime_instance_id = None;
+        assert!(value.validate().is_err());
+
+        let mut value = topology_correlation(&expected);
+        value.current_activation_sha256 = None;
+        value.present = true;
+        value.ready = false;
+        value.disagreements.push(OdinTopologyDisagreement {
+            code: "activation-missing".into(),
+            expected: Some("current-activation".into()),
+            observed: None,
+        });
+        assert!(value.validate().is_err());
+
+        let mut value = topology_correlation(&expected);
+        value.expected = false;
+        value.present = false;
+        value.ready = false;
+        assert!(value.validate().is_err());
+    }
+
+    #[test]
+    fn topology_correlation_refuses_unsorted_or_duplicate_claims() {
+        let expected = expected_incarnation();
+        let mut value = topology_correlation(&expected);
+        value.dependencies.reverse();
+        assert!(value.validate().is_err());
+
+        let mut value = topology_correlation(&expected);
+        value.dependencies.push(value.dependencies[1].clone());
+        assert!(value.validate().is_err());
+
+        let mut value = topology_correlation(&expected);
+        value.ready = false;
+        value.disagreements = vec![
+            OdinTopologyDisagreement {
+                code: "schema-mismatch".into(),
+                expected: Some("state.v2".into()),
+                observed: Some("state.v1".into()),
+            },
+            OdinTopologyDisagreement {
+                code: "endpoint-mismatch".into(),
+                expected: Some("route-a".into()),
+                observed: Some("route-b".into()),
+            },
+        ];
+        assert!(value.validate().is_err());
+
+        value.disagreements[1].code = "schema-mismatch".into();
+        assert!(value.validate().is_err());
+    }
+
+    #[test]
+    fn topology_correlation_preserves_warming_and_exact_write_lease_authority() {
+        let expected = expected_incarnation();
+        let value = topology_correlation(&expected);
+        validate_against_current_lease(&value, &expected).unwrap();
+        assert!(
+            value
+                .validate_against_expected(&expected, Some(&digest('d')))
+                .is_err()
+        );
+        assert!(value.validate_against_expected(&expected, None).is_err());
+
+        let mut digest_only_ready = topology_correlation(&expected);
+        digest_only_ready.observed_write_lease_sha256 = None;
+        digest_only_ready.validate().unwrap();
+        assert!(
+            digest_only_ready
+                .validate_against_expected(&expected, Some(&digest('c')))
+                .is_err()
+        );
+
+        let mut warming = topology_correlation(&expected);
+        warming.observed_presence_state = Some("warming".into());
+        warming.ready = false;
+        assert!(warming.validate().is_err());
+        warming.observed_write_lease_sha256 = None;
+        warming.validate().unwrap();
+        warming.validate_against_expected(&expected, None).unwrap();
+        warming.ready = true;
+        assert!(warming.validate().is_err());
+
+        let mut partial = topology_correlation(&expected);
+        partial.observed_presence_state = None;
+        assert!(partial.validate().is_err());
+        let mut partial = topology_correlation(&expected);
+        partial.signed_presence_sha256 = None;
+        assert!(partial.validate().is_err());
+
+        let mut stateless = expected.clone();
+        stateless.state_schema_generation = None;
+        stateless.state_contract_sha256 = None;
+        stateless.write_lease_required = false;
+        let mut stateless_receipt = topology_correlation(&stateless);
+        stateless_receipt.observed_write_lease_sha256 = None;
+        stateless_receipt
+            .validate_against_expected(&stateless, None)
+            .unwrap();
+        stateless_receipt.observed_write_lease_sha256 = Some(digest('c'));
+        assert!(
+            stateless_receipt
+                .validate_against_expected(&stateless, Some(&digest('c')))
+                .is_err()
+        );
+    }
+
+    #[test]
+    fn topology_correlation_cannot_manufacture_ready() {
+        let expected = expected_incarnation();
+        let mut value = topology_correlation(&expected);
+        value.dependencies[0].ready = false;
+        assert!(value.validate().is_err());
+
+        let mut value = topology_correlation(&expected);
+        value.disagreements.push(OdinTopologyDisagreement {
+            code: "capability-mismatch".into(),
+            expected: Some("conversation.v1".into()),
+            observed: Some("conversation.v0".into()),
+        });
+        assert!(value.validate().is_err());
+
+        let mut value = topology_correlation(&expected);
+        value.present = false;
+        value.disagreements.push(OdinTopologyDisagreement {
+            code: "identity-mismatch".into(),
+            expected: Some("expected-runtime".into()),
+            observed: Some("other-runtime".into()),
+        });
+        assert!(value.validate().is_err());
+
+        let mut value = topology_correlation(&expected);
+        value.dependencies[0].provider_evidence_sha256 = None;
+        assert!(value.validate().is_err());
+
+        let mut missing_capability = topology_correlation(&expected);
+        missing_capability.observed_capabilities.pop();
+        assert!(missing_capability.validate().is_ok());
+        assert!(
+            missing_capability
+                .validate_against_expected(&expected, Some(&digest('c')))
+                .is_err()
+        );
+        missing_capability.present = true;
+        missing_capability.ready = false;
+        missing_capability.disagreements = vec![OdinTopologyDisagreement {
+            code: "generic-mismatch".into(),
+            expected: Some("expected".into()),
+            observed: Some("observed".into()),
+        }];
+        assert!(
+            missing_capability
+                .validate_against_expected(&expected, Some(&digest('c')))
+                .is_err()
+        );
+        correlate_capabilities(
+            &mut missing_capability.disagreements,
+            &expected.capabilities,
+            &missing_capability.observed_capabilities,
+        );
+        missing_capability
+            .disagreements
+            .sort_by(|left, right| left.code.cmp(&right.code));
+        missing_capability
+            .validate_against_expected(&expected, Some(&digest('c')))
+            .unwrap();
+
+        let mut additional_capability = topology_correlation(&expected);
+        additional_capability
+            .observed_capabilities
+            .push(runtime_capability("telemetry"));
+        additional_capability
+            .validate_against_expected(&expected, Some(&digest('c')))
+            .unwrap();
+    }
+
+    #[test]
+    fn topology_signature_is_exact_and_purpose_bound() -> Result<()> {
+        let temp = tempfile::tempdir()?;
+        let signer = enroll_service_identity_at::<OdinTopologyIdentity>(
+            &temp.path().join("odin-topology.cc"),
+        )?;
+        let anchor = signer.trust_anchor()?;
+        let expected = expected_incarnation();
+        let mut receipt = topology_correlation(&expected);
+        receipt.signer_identity_id = anchor.identity_id.clone();
+        receipt.signature.clear();
+        let unsigned = receipt.unsigned_signature_payload()?;
+        let proof = signer.sign::<OdinRuntimeTopologyCorrelationPurpose>(&unsigned);
+        receipt.signature = proof.signature.clone();
+
+        let encoded = receipt.canonical_bytes()?;
+        let (decoded, decoded_unsigned) =
+            OdinRuntimeTopologyCorrelationRecord::decode_canonical_signed_payload(&encoded)?;
+        verify_service_identity_signature::<
+            OdinTopologyIdentity,
+            OdinRuntimeTopologyCorrelationPurpose,
+        >(
+            &anchor,
+            &decoded_unsigned,
+            &ServiceIdentitySignature {
+                identity_id: decoded.signer_identity_id,
+                signature: decoded.signature,
+            },
+        )?;
+
+        let mut substituted = decoded_unsigned.clone();
+        substituted.push(0);
+        assert!(
+            verify_service_identity_signature::<
+                OdinTopologyIdentity,
+                OdinRuntimeTopologyCorrelationPurpose,
+            >(&anchor, &substituted, &proof)
+            .is_err()
+        );
+
+        let wrong_purpose = signer.sign::<WrongOdinTopologyPurpose>(&decoded_unsigned);
+        assert!(
+            verify_service_identity_signature::<
+                OdinTopologyIdentity,
+                OdinRuntimeTopologyCorrelationPurpose,
+            >(&anchor, &decoded_unsigned, &wrong_purpose)
+            .is_err()
+        );
+        Ok(())
+    }
+
+    #[test]
+    fn topology_trust_anchor_is_odin_profile_and_purpose_bound() -> Result<()> {
+        let anchor = topology_anchor();
+        anchor.validate()?;
+
+        let mut value = anchor.clone();
+        value.service_id = "idunn".into();
+        assert!(value.validate().is_err());
+
+        let mut value = anchor.clone();
+        value.signing_purpose = GAMECULT_RUNTIME_PRESENCE_HEALTH_SIGNING_PURPOSE.into();
+        assert!(value.validate().is_err());
+
+        let mut value = anchor.clone();
+        value.signed_schema = GAMECULT_RUNTIME_PRESENCE_HEALTH_SCHEMA.into();
+        assert!(value.validate().is_err());
+
+        let mut value = anchor;
+        value.signer_identity_id =
+            derive_service_identity_id::<IdunnServiceIdentity>(&value.signer_public_key)?;
+        assert!(value.validate().is_err());
+        Ok(())
+    }
+}
diff --git a/packages/cultnet-rs/src/service_identity.rs b/packages/cultnet-rs/src/service_identity.rs
new file mode 100644
index 00000000..6f3e58d8
--- /dev/null
+++ b/packages/cultnet-rs/src/service_identity.rs
@@ -0,0 +1,959 @@
+use anyhow::{Context, Result, anyhow, bail};
+use cultcache_rs::{CacheBackingStore, CultCacheEnvelope, SingleFileMessagePackBackingStore};
+use ed25519_dalek::{Signature, Signer, SigningKey, Verifier, VerifyingKey};
+use rand::RngCore;
+use serde::{Deserialize, Serialize};
+use sha2::{Digest, Sha256};
+use std::io::{Read, Write};
+use std::marker::PhantomData;
+use std::path::Path;
+#[cfg(windows)]
+use zeroize::Zeroize;
+use zeroize::Zeroizing;
+
+pub const WINDOWS_SERVICE_IDENTITY_ASSURANCE: &str = "os_user_installation_bound_best_effort";
+pub const LINUX_SERVICE_IDENTITY_ASSURANCE: &str = "os_installation_file_bound_cloneable_baseline";
+
+/// Fixes every authority-bearing name at the call site. A service cannot open
+/// another service's identity by supplying a convenient runtime string.
+pub trait ServiceIdentityProfile: Send + Sync + 'static {
+    const PRIVATE_TYPE: &'static str;
+    const PRIVATE_SCHEMA: &'static str;
+    const PRIVATE_KEY: &'static str;
+    const TRUST_ANCHOR_TYPE: &'static str;
+    const TRUST_ANCHOR_SCHEMA: &'static str;
+    const TRUST_ANCHOR_KEY: &'static str;
+    const ID_DOMAIN: &'static [u8];
+    const SIGNATURE_DOMAIN: &'static [u8];
+    const PROTECTOR_CONTEXT: &'static str;
+}
+
+/// A purpose is a type, not caller-provided prose. Protocol implementations
+/// define one zero-sized type per signed statement kind.
+pub trait ServiceSignaturePurpose<P: ServiceIdentityProfile>: Send + Sync + 'static {
+    const PURPOSE: &'static [u8];
+}
+
+pub enum IdunnServiceIdentity {}
+
+/// Odin-owned identity dedicated to signed Expected/Present/Ready topology
+/// correlation. It is not a provider-health key and cannot issue Idunn
+/// admission or lifecycle authority.
+pub enum OdinTopologyIdentity {}
+
+pub struct OdinRuntimeTopologyCorrelationPurpose;
+
+impl ServiceSignaturePurpose<OdinTopologyIdentity> for OdinRuntimeTopologyCorrelationPurpose {
+    const PURPOSE: &'static [u8] = b"odin.runtime_topology_correlation.v2";
+}
+
+impl ServiceIdentityProfile for OdinTopologyIdentity {
+    const PRIVATE_TYPE: &'static str = "odin.topology_identity.private.v1";
+    const PRIVATE_SCHEMA: &'static str = "odin.topology_identity.private.v1";
+    const PRIVATE_KEY: &'static str = "odin-topology-identity";
+    const TRUST_ANCHOR_TYPE: &'static str = "odin.topology_identity.trust_anchor.v1";
+    const TRUST_ANCHOR_SCHEMA: &'static str = "odin.topology_identity.trust_anchor.v1";
+    const TRUST_ANCHOR_KEY: &'static str = "odin-topology-identity-public";
+    const ID_DOMAIN: &'static [u8] = b"odin.topology-identity.id.v1\0";
+    const SIGNATURE_DOMAIN: &'static [u8] = b"odin.topology-identity.signature.v1\0";
+    const PROTECTOR_CONTEXT: &'static str = "odin-topology-identity-v1";
+}
+
+/// Root-operated identity dedicated to deployment-brake release grants. The
+/// Idunn daemon receives only this profile's public trust anchor; opening the
+/// private store is a provisioning operation, never daemon startup work.
+pub enum IdunnDeploymentBrakeOperatorIdentity {}
+
+pub struct IdunnDeploymentBrakeReleasePurpose;
+
+impl ServiceSignaturePurpose<IdunnDeploymentBrakeOperatorIdentity>
+    for IdunnDeploymentBrakeReleasePurpose
+{
+    const PURPOSE: &'static [u8] = b"idunn.deployment-release.v1";
+}
+
+impl ServiceIdentityProfile for IdunnDeploymentBrakeOperatorIdentity {
+    const PRIVATE_TYPE: &'static str = "idunn.deployment_brake_operator.private.v1";
+    const PRIVATE_SCHEMA: &'static str = "idunn.deployment_brake_operator.private.v1";
+    const PRIVATE_KEY: &'static str = "idunn-deployment-brake-operator";
+    const TRUST_ANCHOR_TYPE: &'static str = "idunn.deployment_brake_operator.trust_anchor.v1";
+    const TRUST_ANCHOR_SCHEMA: &'static str = "idunn.deployment_brake_operator.trust_anchor.v1";
+    const TRUST_ANCHOR_KEY: &'static str = "idunn-deployment-brake-operator-public";
+    const ID_DOMAIN: &'static [u8] = b"idunn.deployment-brake-operator.id.v1\0";
+    const SIGNATURE_DOMAIN: &'static [u8] = b"idunn.deployment-brake-operator.signature.v1\0";
+    const PROTECTOR_CONTEXT: &'static str = "idunn-deployment-brake-operator-v1";
+}
+
+/// Dedicated provider-owned identity for generic daemon-health statements.
+/// It is intentionally independent of any one provider runtime or repository.
+pub enum GameCultProviderHealthIdentity {}
+
+/// The only generic health statement purpose accepted from provider-health
+/// identities by Idunn admission.
+pub struct IdunnSignedDaemonHealthPurpose;
+
+impl ServiceSignaturePurpose<GameCultProviderHealthIdentity> for IdunnSignedDaemonHealthPurpose {
+    const PURPOSE: &'static [u8] = b"idunn.signed_daemon_health.v1";
+}
+
+/// Provider-owned runtime presence and health. This is deliberately distinct
+/// from the legacy daemon-health purpose so an old signature cannot acquire
+/// deployment-incarnation authority by substitution.
+pub struct GameCultRuntimePresenceHealthPurpose;
+
+impl ServiceSignaturePurpose<GameCultProviderHealthIdentity>
+    for GameCultRuntimePresenceHealthPurpose
+{
+    const PURPOSE: &'static [u8] = b"gamecult.runtime_presence_health.v2";
+}
+
+impl ServiceIdentityProfile for GameCultProviderHealthIdentity {
+    const PRIVATE_TYPE: &'static str = "gamecult.provider_health_identity.private.v1";
+    const PRIVATE_SCHEMA: &'static str = "gamecult.provider_health_identity.private.v1";
+    const PRIVATE_KEY: &'static str = "gamecult-provider-health-identity";
+    const TRUST_ANCHOR_TYPE: &'static str = "gamecult.provider_health_identity.trust_anchor.v1";
+    const TRUST_ANCHOR_SCHEMA: &'static str = "gamecult.provider_health_identity.trust_anchor.v1";
+    const TRUST_ANCHOR_KEY: &'static str = "gamecult-provider-health-identity-public";
+    const ID_DOMAIN: &'static [u8] = b"gamecult.provider-health.identity.v1\0";
+    const SIGNATURE_DOMAIN: &'static [u8] = b"gamecult.provider-health.signature.v1\0";
+    const PROTECTOR_CONTEXT: &'static str = "gamecult-provider-health-identity-v1";
+}
+
+/// The only signing purpose accepted for Idunn's public projection of a
+/// provider-authenticated health admission. Keeping this profile here makes
+/// purpose selection a compile-time protocol choice rather than caller text.
+pub struct IdunnAuthenticatedProviderHealthProjectionPurpose;
+
+impl ServiceSignaturePurpose<IdunnServiceIdentity>
+    for IdunnAuthenticatedProviderHealthProjectionPurpose
+{
+    const PURPOSE: &'static [u8] = b"idunn.authenticated-provider-health-projection.v1";
+}
+
+/// Idunn's stable identity signs every activation before its ephemeral key is
+/// handed to a workload. This makes the launch witness portable without
+/// allowing a configuration file or provider to mint its own activation.
+pub struct IdunnRuntimeActivationPurpose;
+
+impl ServiceSignaturePurpose<IdunnServiceIdentity> for IdunnRuntimeActivationPurpose {
+    const PURPOSE: &'static [u8] = b"idunn.runtime_activation.v2";
+}
+
+impl ServiceIdentityProfile for IdunnServiceIdentity {
+    const PRIVATE_TYPE: &'static str = "idunn.service_identity.private.v1";
+    const PRIVATE_SCHEMA: &'static str = "idunn.service_identity.private.v1";
+    const PRIVATE_KEY: &'static str = "idunn-service-identity";
+    const TRUST_ANCHOR_TYPE: &'static str = "idunn.service_identity.trust_anchor.v1";
+    const TRUST_ANCHOR_SCHEMA: &'static str = "idunn.service_identity.trust_anchor.v1";
+    const TRUST_ANCHOR_KEY: &'static str = "idunn-service-identity-public";
+    const ID_DOMAIN: &'static [u8] = b"idunn.service-identity.id.v1\0";
+    const SIGNATURE_DOMAIN: &'static [u8] = b"idunn.service-identity.signature.v1\0";
+    const PROTECTOR_CONTEXT: &'static str = "idunn-service-identity-v1";
+}
+
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
+pub struct ServiceIdentityPrivateEntry {
+    pub schema_version: String,
+    pub identity_id: String,
+    pub public_key: Vec<u8>,
+    pub protected_private_seed: Vec<u8>,
+    pub protector_kind: String,
+    pub protector_binding: String,
+    pub protector_version: String,
+    pub assurance: String,
+    pub created_at: String,
+    pub enrollment_nonce: Vec<u8>,
+}
+
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+pub struct ServiceIdentityTrustAnchor {
+    pub schema_version: String,
+    pub identity_id: String,
+    pub public_key: Vec<u8>,
+    pub assurance: String,
+    pub identity_created_at: String,
+    pub source_identity_record_sha256: String,
+}
+
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct ServiceIdentitySignature {
+    pub identity_id: String,
+    pub signature: Vec<u8>,
+}
+
+/// The only value holding unprotected key material. It exposes signing, never
+/// seed export or access to the underlying signing key.
+pub struct ServiceIdentitySigner<P: ServiceIdentityProfile> {
+    entry: ServiceIdentityPrivateEntry,
+    signing_key: SigningKey,
+    profile: PhantomData<P>,
+}
+
+impl<P: ServiceIdentityProfile> ServiceIdentitySigner<P> {
+    pub fn entry(&self) -> &ServiceIdentityPrivateEntry {
+        &self.entry
+    }
+
+    pub fn trust_anchor(&self) -> Result<ServiceIdentityTrustAnchor> {
+        Ok(ServiceIdentityTrustAnchor {
+            schema_version: P::TRUST_ANCHOR_SCHEMA.into(),
+            identity_id: self.entry.identity_id.clone(),
+            public_key: self.entry.public_key.clone(),
+            assurance: self.entry.assurance.clone(),
+            identity_created_at: self.entry.created_at.clone(),
+            source_identity_record_sha256: format!(
+                "sha256-{}",
+                hex(&Sha256::digest(rmp_serde::to_vec(&self.entry)?))
+            ),
+        })
+    }
+
+    pub fn sign<S: ServiceSignaturePurpose<P>>(&self, payload: &[u8]) -> ServiceIdentitySignature {
+        ServiceIdentitySignature {
+            identity_id: self.entry.identity_id.clone(),
+            signature: self
+                .signing_key
+                .sign(&signing_message::<P, S>(payload))
+                .to_bytes()
+                .to_vec(),
+        }
+    }
+}
+
+pub fn enroll_service_identity_at<P: ServiceIdentityProfile>(
+    path: &Path,
+) -> Result<ServiceIdentitySigner<P>> {
+    if path.exists() {
+        bail!(
+            "service identity store {} already exists; enrollment is immutable",
+            path.display()
+        );
+    }
+    prepare_private_parent(path)?;
+    let mut seed = Zeroizing::new([0u8; 32]);
+    rand::rng().fill_bytes(seed.as_mut());
+    let signing_key = SigningKey::from_bytes(&*seed);
+    let mut nonce = [0u8; 32];
+    rand::rng().fill_bytes(&mut nonce);
+    let public_key = signing_key.verifying_key().to_bytes();
+    let binding = platform_binding::<P>()?;
+    let entry = ServiceIdentityPrivateEntry {
+        schema_version: P::PRIVATE_SCHEMA.into(),
+        identity_id: identity_id::<P>(&public_key),
+        public_key: public_key.to_vec(),
+        protected_private_seed: protect_seed::<P>(&*seed, &binding)?,
+        protector_kind: platform_protector_kind().into(),
+        protector_binding: binding,
+        protector_version: "v1".into(),
+        assurance: platform_assurance().into(),
+        created_at: chrono::Utc::now().to_rfc3339(),
+        enrollment_nonce: nonce.to_vec(),
+    };
+    validate_private::<P>(&entry)?;
+    let envelope = private_envelope::<P>(&entry)?;
+    atomic_create_private_store(path, &envelope)?;
+    harden_store_permissions(path)?;
+    open_service_identity_at::<P>(path)
+}
+
+pub fn open_service_identity_at<P: ServiceIdentityProfile>(
+    path: &Path,
+) -> Result<ServiceIdentitySigner<P>> {
+    if !path.is_file() {
+        bail!("service identity store {} does not exist", path.display());
+    }
+    let entries = SingleFileMessagePackBackingStore::new(path).pull_all()?;
+    open_service_identity_envelopes::<P>(&entries)
+}
+
+/// Opens an immutable service-identity credential from a read-only stream.
+///
+/// Unlike [`open_service_identity_at`], this path has no sibling-lock or
+/// writable-filesystem requirement. It is intended for immutable credential
+/// copies such as systemd `LoadCredential` files.
+pub fn open_service_identity_credential_reader<P: ServiceIdentityProfile>(
+    mut reader: impl Read,
+) -> Result<ServiceIdentitySigner<P>> {
+    let mut bytes = Zeroizing::new(Vec::new());
+    reader
+        .read_to_end(&mut bytes)
+        .context("failed to read immutable service identity credential")?;
+    open_service_identity_credential_bytes::<P>(&bytes)
+}
+
+/// Opens an immutable service-identity credential from its exact bytes.
+pub fn open_service_identity_credential_bytes<P: ServiceIdentityProfile>(
+    bytes: &[u8],
+) -> Result<ServiceIdentitySigner<P>> {
+    let mut decoder = rmp_serde::Deserializer::new(std::io::Cursor::new(bytes));
+    let entries = Vec::<CultCacheEnvelope>::deserialize(&mut decoder)
+        .context("immutable service identity credential is malformed MessagePack")?;
+    if decoder.position() != bytes.len() as u64 {
+        bail!("immutable service identity credential contains trailing data");
+    }
+    open_service_identity_envelopes::<P>(&entries)
+}
+
+fn open_service_identity_envelopes<P: ServiceIdentityProfile>(
+    entries: &[CultCacheEnvelope],
+) -> Result<ServiceIdentitySigner<P>> {
+    let [envelope] = entries else {
+        bail!("service identity store must contain exactly one immutable envelope");
+    };
+    if envelope.r#type != P::PRIVATE_TYPE
+        || envelope.key != P::PRIVATE_KEY
+        || envelope.schema_id.as_deref() != Some(P::PRIVATE_SCHEMA)
+    {
+        bail!("service identity store belongs to a different profile or schema");
+    }
+    let entry: ServiceIdentityPrivateEntry = rmp_serde::from_slice(&envelope.payload)
+        .context("service identity private payload is malformed MessagePack")?;
+    validate_private::<P>(&entry)?;
+    if entry.protector_kind != platform_protector_kind() || entry.assurance != platform_assurance()
+    {
+        bail!("service identity protector does not belong to this platform implementation");
+    }
+    let binding = platform_binding::<P>()?;
+    if entry.protector_binding != binding {
+        bail!("service identity protector binding does not match this OS installation or profile");
+    }
+    let seed = unprotect_seed::<P>(&entry.protected_private_seed, &binding)?;
+    let seed: &[u8; 32] = seed
+        .as_slice()
+        .try_into()
+        .map_err(|_| anyhow!("unprotected service identity seed has invalid length"))?;
+    let signing_key = SigningKey::from_bytes(seed);
+    if signing_key.verifying_key().to_bytes().as_slice() != entry.public_key.as_slice() {
+        bail!("service identity private seed does not match enrolled public key");
+    }
+    Ok(ServiceIdentitySigner {
+        entry,
+        signing_key,
+        profile: PhantomData,
+    })
+}
+
+pub fn export_service_identity_trust_anchor<P: ServiceIdentityProfile>(
+    signer: &ServiceIdentitySigner<P>,
+    path: &Path,
+) -> Result<ServiceIdentityTrustAnchor> {
+    let anchor = signer.trust_anchor()?;
+    ensure_parent(path)?;
+    let envelope = CultCacheEnvelope {
+        key: P::TRUST_ANCHOR_KEY.into(),
+        r#type: P::TRUST_ANCHOR_TYPE.into(),
+        payload: rmp_serde::to_vec(&anchor)?,
+        stored_at: anchor.identity_created_at.clone(),
+        schema_id: Some(P::TRUST_ANCHOR_SCHEMA.into()),
+    };
+    let mut backing = SingleFileMessagePackBackingStore::new(path);
+    match backing.pull_all()?.as_slice() {
+        [] => backing.push(&envelope)?,
+        [current] if current == &envelope => {}
+        _ => bail!("service identity trust anchor output already contains different state"),
+    }
+    Ok(anchor)
+}
+
+pub fn verify_service_identity_signature<P, S>(
+    anchor: &ServiceIdentityTrustAnchor,
+    payload: &[u8],
+    proof: &ServiceIdentitySignature,
+) -> Result<()>
+where
+    P: ServiceIdentityProfile,
+    S: ServiceSignaturePurpose<P>,
+{
+    validate_anchor::<P>(anchor)?;
+    if proof.identity_id != anchor.identity_id {
+        bail!("service identity signature names a different identity");
+    }
+    let key: [u8; 32] = anchor
+        .public_key
+        .as_slice()
+        .try_into()
+        .map_err(|_| anyhow!("service identity public key has invalid length"))?;
+    let signature = Signature::from_slice(&proof.signature)
+        .map_err(|_| anyhow!("service identity signature has invalid length"))?;
+    VerifyingKey::from_bytes(&key)?
+        .verify(&signing_message::<P, S>(payload), &signature)
+        .map_err(|_| anyhow!("service identity signature verification failed"))
+}
+
+/// Verify against a public key already admitted by an owning trust store.
+/// The profile derives the identity, so callers cannot substitute a convenient
+/// identity string while retaining the same signature bytes.
+pub fn verify_service_identity_signature_with_public_key<P, S>(
+    public_key: &[u8],
+    payload: &[u8],
+    proof: &ServiceIdentitySignature,
+) -> Result<()>
+where
+    P: ServiceIdentityProfile,
+    S: ServiceSignaturePurpose<P>,
+{
+    if proof.identity_id != derive_service_identity_id::<P>(public_key)? {
+        bail!("service identity signature names a different identity");
+    }
+    let key: [u8; 32] = public_key
+        .try_into()
+        .map_err(|_| anyhow!("service identity public key has invalid length"))?;
+    let signature = Signature::from_slice(&proof.signature)
+        .map_err(|_| anyhow!("service identity signature has invalid length"))?;
+    VerifyingKey::from_bytes(&key)?
+        .verify(&signing_message::<P, S>(payload), &signature)
+        .map_err(|_| anyhow!("service identity signature verification failed"))
+}
+
+fn validate_private<P: ServiceIdentityProfile>(entry: &ServiceIdentityPrivateEntry) -> Result<()> {
+    if entry.schema_version != P::PRIVATE_SCHEMA
+        || entry.public_key.len() != 32
+        || entry.enrollment_nonce.len() != 32
+        || entry.protected_private_seed.is_empty()
+        || entry.protector_version != "v1"
+    {
+        bail!("service identity private entry violates its profile schema");
+    }
+    chrono::DateTime::parse_from_rfc3339(&entry.created_at)
+        .map_err(|_| anyhow!("service identity created_at is not RFC3339"))?;
+    if identity_id::<P>(&entry.public_key) != entry.identity_id {
+        bail!("service identity id does not match public key");
+    }
+    Ok(())
+}
+
+fn validate_anchor<P: ServiceIdentityProfile>(anchor: &ServiceIdentityTrustAnchor) -> Result<()> {
+    if anchor.schema_version != P::TRUST_ANCHOR_SCHEMA
+        || anchor.public_key.len() != 32
+        || derive_service_identity_id::<P>(&anchor.public_key)? != anchor.identity_id
+    {
+        bail!("service identity trust anchor violates its profile schema");
+    }
+    Ok(())
+}
+
+/// Derives the profile-bound identity id from an exact Ed25519 public key.
+/// Consumers use this instead of accepting a caller-supplied identity string.
+pub fn derive_service_identity_id<P: ServiceIdentityProfile>(public_key: &[u8]) -> Result<String> {
+    if public_key.len() != 32 {
+        bail!("service identity public key has invalid length");
+    }
+    Ok(hex(&Sha256::digest([P::ID_DOMAIN, public_key].concat())))
+}
+
+fn identity_id<P: ServiceIdentityProfile>(key: &[u8]) -> String {
+    derive_service_identity_id::<P>(key).expect("internal service identity key is Ed25519")
+}
+
+fn signing_message<P: ServiceIdentityProfile, S: ServiceSignaturePurpose<P>>(
+    payload: &[u8],
+) -> Vec<u8> {
+    let mut out =
+        Vec::with_capacity(P::SIGNATURE_DOMAIN.len() + S::PURPOSE.len() + payload.len() + 16);
+    out.extend_from_slice(P::SIGNATURE_DOMAIN);
+    out.extend_from_slice(&(S::PURPOSE.len() as u64).to_be_bytes());
+    out.extend_from_slice(S::PURPOSE);
+    out.extend_from_slice(&(payload.len() as u64).to_be_bytes());
+    out.extend_from_slice(payload);
+    out
+}
+
+fn private_envelope<P: ServiceIdentityProfile>(
+    entry: &ServiceIdentityPrivateEntry,
+) -> Result<CultCacheEnvelope> {
+    Ok(CultCacheEnvelope {
+        key: P::PRIVATE_KEY.into(),
+        r#type: P::PRIVATE_TYPE.into(),
+        payload: rmp_serde::to_vec(entry)?,
+        stored_at: entry.created_at.clone(),
+        schema_id: Some(P::PRIVATE_SCHEMA.into()),
+    })
+}
+
+fn ensure_parent(path: &Path) -> Result<()> {
+    let parent = path
+        .parent()
+        .ok_or_else(|| anyhow!("service identity path has no parent"))?;
+    std::fs::create_dir_all(parent)?;
+    Ok(())
+}
+
+/// Like [`ensure_parent`], but also locks the directory down to owner-only
+/// access. Reserved for paths that hold private key material: a public trust
+/// anchor is routinely exported into a directory another service already
+/// owns and reads from, and forcing that directory to `0700` would lock the
+/// legitimate reader out rather than protect anything.
+fn prepare_private_parent(path: &Path) -> Result<()> {
+    ensure_parent(path)?;
+    #[cfg(unix)]
+    {
+        use std::os::unix::fs::PermissionsExt;
+        let parent = path
+            .parent()
+            .ok_or_else(|| anyhow!("service identity path has no parent"))?;
+        std::fs::set_permissions(parent, std::fs::Permissions::from_mode(0o700))?;
+    }
+    Ok(())
+}
+
+/// Enrollment is a one-shot authority transition. `create_new` makes two
+/// simultaneous enrollments unable to overwrite one another, while the encoded
+/// envelope vector remains a supported CultCache single-file representation.
+fn atomic_create_private_store(path: &Path, envelope: &CultCacheEnvelope) -> Result<()> {
+    let bytes = rmp_serde::to_vec(&vec![envelope.clone()])
+        .context("failed to encode immutable service identity store")?;
+    let mut file = std::fs::OpenOptions::new()
+        .create_new(true)
+        .write(true)
+        .open(path)
+        .with_context(|| {
+            format!(
+                "service identity store {} already exists or cannot be created; enrollment is immutable",
+                path.display()
+            )
+        })?;
+    if let Err(error) = file.write_all(&bytes).and_then(|()| file.sync_all()) {
+        drop(file);
+        let _ = std::fs::remove_file(path);
+        return Err(error).context("failed to persist immutable service identity store");
+    }
+    Ok(())
+}
+fn harden_store_permissions(_path: &Path) -> Result<()> {
+    #[cfg(unix)]
+    {
+        use std::os::unix::fs::PermissionsExt;
+        std::fs::set_permissions(_path, std::fs::Permissions::from_mode(0o600))?;
+    }
+    Ok(())
+}
+
+#[cfg(windows)]
+fn platform_protector_kind() -> &'static str {
+    "windows_dpapi_current_user"
+}
+#[cfg(target_os = "linux")]
+fn platform_protector_kind() -> &'static str {
+    "linux_file_mode_machine_id_binding"
+}
+#[cfg(windows)]
+fn platform_assurance() -> &'static str {
+    WINDOWS_SERVICE_IDENTITY_ASSURANCE
+}
+#[cfg(target_os = "linux")]
+fn platform_assurance() -> &'static str {
+    LINUX_SERVICE_IDENTITY_ASSURANCE
+}
+
+#[cfg(windows)]
+fn platform_binding<P: ServiceIdentityProfile>() -> Result<String> {
+    Ok(format!("dpapi-current-user:{}", P::PROTECTOR_CONTEXT))
+}
+#[cfg(target_os = "linux")]
+fn platform_binding<P: ServiceIdentityProfile>() -> Result<String> {
+    let raw = std::fs::read_to_string("/etc/machine-id")
+        .or_else(|_| std::fs::read_to_string("/var/lib/dbus/machine-id"))
+        .context("Linux machine-id is unavailable")?;
+    let id = raw.trim();
+    if id.is_empty() {
+        bail!("Linux machine-id is empty");
+    }
+    Ok(format!(
+        "{}:machine-id-sha256:{}",
+        P::PROTECTOR_CONTEXT,
+        hex(&Sha256::digest(id.as_bytes()))
+    ))
+}
+
+#[cfg(windows)]
+fn protect_seed<P: ServiceIdentityProfile>(seed: &[u8; 32], binding: &str) -> Result<Vec<u8>> {
+    Ok(dpapi::<P>(seed, binding, true)?.to_vec())
+}
+#[cfg(windows)]
+fn unprotect_seed<P: ServiceIdentityProfile>(
+    seed: &[u8],
+    binding: &str,
+) -> Result<Zeroizing<Vec<u8>>> {
+    dpapi::<P>(seed, binding, false)
+}
+#[cfg(windows)]
+fn dpapi<P: ServiceIdentityProfile>(
+    input: &[u8],
+    binding: &str,
+    protect: bool,
+) -> Result<Zeroizing<Vec<u8>>> {
+    use windows_sys::Win32::Foundation::LocalFree;
+    use windows_sys::Win32::Security::Cryptography::{
+        CRYPT_INTEGER_BLOB, CRYPTPROTECT_UI_FORBIDDEN, CryptProtectData, CryptUnprotectData,
+    };
+    let mut input = Zeroizing::new(input.to_vec());
+    let mut entropy = Zeroizing::new(
+        Sha256::digest(
+            [
+                b"gamecult-service-identity-dpapi-v1\0".as_slice(),
+                P::PROTECTOR_CONTEXT.as_bytes(),
+                binding.as_bytes(),
+            ]
+            .concat(),
+        )
+        .to_vec(),
+    );
+    let ib = CRYPT_INTEGER_BLOB {
+        cbData: input.len() as u32,
+        pbData: input.as_mut_ptr(),
+    };
+    let eb = CRYPT_INTEGER_BLOB {
+        cbData: entropy.len() as u32,
+        pbData: entropy.as_mut_ptr(),
+    };
+    let mut output = CRYPT_INTEGER_BLOB {
+        cbData: 0,
+        pbData: std::ptr::null_mut(),
+    };
+    let ok = unsafe {
+        if protect {
+            CryptProtectData(
+                &ib,
+                std::ptr::null(),
+                &eb,
+                std::ptr::null(),
+                std::ptr::null(),
+                CRYPTPROTECT_UI_FORBIDDEN,
+                &mut output,
+            )
+        } else {
+            CryptUnprotectData(
+                &ib,
+                std::ptr::null_mut(),
+                &eb,
+                std::ptr::null(),
+                std::ptr::null(),
+                CRYPTPROTECT_UI_FORBIDDEN,
+                &mut output,
+            )
+        }
+    };
+    if ok == 0 {
+        return Err(std::io::Error::last_os_error())
+            .context("DPAPI service identity operation failed");
+    }
+    if output.pbData.is_null() {
+        bail!("DPAPI service identity operation returned a null output");
+    }
+    let output = unsafe { std::slice::from_raw_parts_mut(output.pbData, output.cbData as usize) };
+    let bytes = Zeroizing::new(output.to_vec());
+    output.zeroize();
+    unsafe {
+        LocalFree(output.as_mut_ptr().cast());
+    }
+    Ok(bytes)
+}
+
+#[cfg(target_os = "linux")]
+fn protect_seed<P: ServiceIdentityProfile>(seed: &[u8; 32], binding: &str) -> Result<Vec<u8>> {
+    xor_linux::<P>(seed, binding)
+}
+#[cfg(target_os = "linux")]
+fn unprotect_seed<P: ServiceIdentityProfile>(
+    seed: &[u8],
+    binding: &str,
+) -> Result<Zeroizing<Vec<u8>>> {
+    if seed.len() != 32 {
+        bail!("protected Linux service seed has invalid length");
+    }
+    let mask = Sha256::digest(
+        [
+            b"gamecult-linux-service-seed-v1\0".as_slice(),
+            P::PROTECTOR_CONTEXT.as_bytes(),
+            binding.as_bytes(),
+        ]
+        .concat(),
+    );
+    let mut clear_seed = Zeroizing::new(Vec::with_capacity(seed.len()));
+    clear_seed.extend(seed.iter().zip(mask).map(|(a, b)| a ^ b));
+    Ok(clear_seed)
+}
+#[cfg(target_os = "linux")]
+fn xor_linux<P: ServiceIdentityProfile>(seed: &[u8], binding: &str) -> Result<Vec<u8>> {
+    let mask = Sha256::digest(
+        [
+            b"gamecult-linux-service-seed-v1\0".as_slice(),
+            P::PROTECTOR_CONTEXT.as_bytes(),
+            binding.as_bytes(),
+        ]
+        .concat(),
+    );
+    Ok(seed.iter().zip(mask).map(|(a, b)| a ^ b).collect())
+}
+
+fn hex(bytes: &[u8]) -> String {
+    const D: &[u8; 16] = b"0123456789abcdef";
+    let mut s = String::with_capacity(bytes.len() * 2);
+    for b in bytes {
+        s.push(D[(b >> 4) as usize] as char);
+        s.push(D[(b & 15) as usize] as char);
+    }
+    s
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    enum OtherPurpose {}
+    impl ServiceSignaturePurpose<IdunnServiceIdentity> for OtherPurpose {
+        const PURPOSE: &'static [u8] = b"idunn.other.v1";
+    }
+
+    #[test]
+    fn immutable_enrollment_reopens_and_is_purpose_and_payload_bound() -> Result<()> {
+        let temp = tempfile::tempdir()?;
+        let path = temp.path().join("idunn.ccmp");
+        let signer = enroll_service_identity_at::<IdunnServiceIdentity>(&path)?;
+        let proof = signer.sign::<IdunnAuthenticatedProviderHealthProjectionPurpose>(b"healthy");
+        let anchor = signer.trust_anchor()?;
+        verify_service_identity_signature::<
+            IdunnServiceIdentity,
+            IdunnAuthenticatedProviderHealthProjectionPurpose,
+        >(&anchor, b"healthy", &proof)?;
+        assert!(
+            verify_service_identity_signature::<
+                IdunnServiceIdentity,
+                IdunnAuthenticatedProviderHealthProjectionPurpose,
+            >(&anchor, b"unhealthy", &proof)
+            .is_err()
+        );
+        assert!(
+            verify_service_identity_signature::<IdunnServiceIdentity, OtherPurpose>(
+                &anchor, b"healthy", &proof
+            )
+            .is_err()
+        );
+        assert!(enroll_service_identity_at::<IdunnServiceIdentity>(&path).is_err());
+        assert_eq!(
+            derive_service_identity_id::<IdunnServiceIdentity>(&anchor.public_key)?,
+            anchor.identity_id
+        );
+        assert!(derive_service_identity_id::<IdunnServiceIdentity>(&[0; 31]).is_err());
+        assert_eq!(
+            open_service_identity_at::<IdunnServiceIdentity>(&path)?.entry(),
+            signer.entry()
+        );
+        Ok(())
+    }
+
+    #[test]
+    fn immutable_credential_reader_opens_without_a_path_and_retains_signing_authority() -> Result<()>
+    {
+        let temp = tempfile::tempdir()?;
+        let path = temp.path().join("provider-health.cc");
+        let enrolled = enroll_service_identity_at::<GameCultProviderHealthIdentity>(&path)?;
+        let bytes = std::fs::read(path)?;
+
+        let from_reader = open_service_identity_credential_reader::<GameCultProviderHealthIdentity>(
+            std::io::Cursor::new(bytes.clone()),
+        )?;
+        let from_bytes =
+            open_service_identity_credential_bytes::<GameCultProviderHealthIdentity>(&bytes)?;
+        assert_eq!(from_reader.entry(), enrolled.entry());
+        assert_eq!(from_bytes.entry(), enrolled.entry());
+
+        let payload = b"runtime-presence";
+        let proof = from_reader.sign::<GameCultRuntimePresenceHealthPurpose>(payload);
+        verify_service_identity_signature::<
+            GameCultProviderHealthIdentity,
+            GameCultRuntimePresenceHealthPurpose,
+        >(&enrolled.trust_anchor()?, payload, &proof)?;
+        Ok(())
+    }
+
+    #[test]
+    fn immutable_credential_reader_rejects_ambiguous_profile_or_machine_state() -> Result<()> {
+        let temp = tempfile::tempdir()?;
+        let path = temp.path().join("idunn.ccmp");
+        enroll_service_identity_at::<IdunnServiceIdentity>(&path)?;
+        let bytes = std::fs::read(path)?;
+
+        assert!(
+            open_service_identity_credential_bytes::<GameCultProviderHealthIdentity>(&bytes)
+                .is_err()
+        );
+
+        let mut envelopes: Vec<CultCacheEnvelope> = rmp_serde::from_slice(&bytes)?;
+        let mut duplicated = envelopes.clone();
+        duplicated.push(envelopes[0].clone());
+        assert!(
+            open_service_identity_credential_bytes::<IdunnServiceIdentity>(&rmp_serde::to_vec(
+                &duplicated
+            )?)
+            .is_err()
+        );
+
+        let mut trailing = bytes.clone();
+        trailing.push(0xc0);
+        assert!(open_service_identity_credential_bytes::<IdunnServiceIdentity>(&trailing).is_err());
+
+        let mut wrong_seed_envelopes = envelopes.clone();
+        let mut wrong_seed: ServiceIdentityPrivateEntry =
+            rmp_serde::from_slice(&wrong_seed_envelopes[0].payload)?;
+        wrong_seed.protected_private_seed[0] ^= 1;
+        wrong_seed_envelopes[0].payload = rmp_serde::to_vec(&wrong_seed)?;
+        assert!(
+            open_service_identity_credential_bytes::<IdunnServiceIdentity>(&rmp_serde::to_vec(
+                &wrong_seed_envelopes
+            )?)
+            .is_err()
+        );
+
+        let mut entry: ServiceIdentityPrivateEntry = rmp_serde::from_slice(&envelopes[0].payload)?;
+        entry.protector_binding.push_str(":another-machine");
+        envelopes[0].payload = rmp_serde::to_vec(&entry)?;
+        assert!(
+            open_service_identity_credential_bytes::<IdunnServiceIdentity>(&rmp_serde::to_vec(
+                &envelopes
+            )?)
+            .is_err()
+        );
+        Ok(())
+    }
+
+    #[test]
+    fn malformed_or_profile_substituted_state_fails_closed_without_replacement() -> Result<()> {
+        enum Alien {}
+        impl ServiceIdentityProfile for Alien {
+            const PRIVATE_TYPE: &'static str = "alien.private.v1";
+            const PRIVATE_SCHEMA: &'static str = "alien.private.v1";
+            const PRIVATE_KEY: &'static str = "alien";
+            const TRUST_ANCHOR_TYPE: &'static str = "alien.anchor.v1";
+            const TRUST_ANCHOR_SCHEMA: &'static str = "alien.anchor.v1";
+            const TRUST_ANCHOR_KEY: &'static str = "alien-public";
+            const ID_DOMAIN: &'static [u8] = b"alien.id\0";
+            const SIGNATURE_DOMAIN: &'static [u8] = b"alien.sig\0";
+            const PROTECTOR_CONTEXT: &'static str = "alien-v1";
+        }
+        let temp = tempfile::tempdir()?;
+        let malformed = temp.path().join("bad.ccmp");
+        std::fs::write(&malformed, b"rot")?;
+        let before = std::fs::read(&malformed)?;
+        assert!(open_service_identity_at::<IdunnServiceIdentity>(&malformed).is_err());
+        assert!(enroll_service_identity_at::<IdunnServiceIdentity>(&malformed).is_err());
+        assert_eq!(before, std::fs::read(&malformed)?);
+        let good = temp.path().join("good.ccmp");
+        enroll_service_identity_at::<IdunnServiceIdentity>(&good)?;
+        assert!(open_service_identity_at::<Alien>(&good).is_err());
+        Ok(())
+    }
+
+    #[test]
+    fn exporting_a_public_trust_anchor_does_not_narrow_its_parent_permissions() -> Result<()> {
+        let temp = tempfile::tempdir()?;
+        let signer =
+            enroll_service_identity_at::<IdunnServiceIdentity>(&temp.path().join("private.ccmp"))?;
+        let public_parent = temp.path().join("public");
+        std::fs::create_dir(&public_parent)?;
+        #[cfg(unix)]
+        {
+            use std::os::unix::fs::PermissionsExt;
+            std::fs::set_permissions(&public_parent, std::fs::Permissions::from_mode(0o750))?;
+        }
+        let output = public_parent.join("public.ccmp");
+        export_service_identity_trust_anchor(&signer, &output)?;
+        #[cfg(unix)]
+        {
+            use std::os::unix::fs::PermissionsExt;
+            assert_eq!(
+                std::fs::metadata(&public_parent)?.permissions().mode() & 0o777,
+                0o750,
+                "exporting a public trust anchor must not reassign its parent directory's permissions"
+            );
+        }
+        Ok(())
+    }
+
+    #[test]
+    fn exported_anchor_is_public_only_immutable_and_rejects_identity_substitution() -> Result<()> {
+        let temp = tempfile::tempdir()?;
+        let signer =
+            enroll_service_identity_at::<IdunnServiceIdentity>(&temp.path().join("private.ccmp"))?;
+        let output = temp.path().join("public.ccmp");
+        let anchor = export_service_identity_trust_anchor(&signer, &output)?;
+        let bytes = std::fs::read(&output)?;
+        assert!(
+            !bytes
+                .windows(signer.entry().protected_private_seed.len())
+                .any(|w| w == signer.entry().protected_private_seed)
+        );
+        export_service_identity_trust_anchor(&signer, &output)?;
+        assert_eq!(bytes, std::fs::read(&output)?);
+        let other =
+            enroll_service_identity_at::<IdunnServiceIdentity>(&temp.path().join("other.ccmp"))?;
+        let proof = other.sign::<IdunnAuthenticatedProviderHealthProjectionPurpose>(b"healthy");
+        assert!(
+            verify_service_identity_signature::<
+                IdunnServiceIdentity,
+                IdunnAuthenticatedProviderHealthProjectionPurpose,
+            >(&anchor, b"healthy", &proof)
+            .is_err()
+        );
+        Ok(())
+    }
+
+    #[test]
+    fn provider_health_profile_is_domain_separated_and_purpose_bound() -> Result<()> {
+        let temp = tempfile::tempdir()?;
+        let signer = enroll_service_identity_at::<GameCultProviderHealthIdentity>(
+            &temp.path().join("provider-health.cc"),
+        )?;
+        let proof = signer.sign::<IdunnSignedDaemonHealthPurpose>(b"signed-health-record");
+        let anchor = signer.trust_anchor()?;
+        verify_service_identity_signature::<
+            GameCultProviderHealthIdentity,
+            IdunnSignedDaemonHealthPurpose,
+        >(&anchor, b"signed-health-record", &proof)?;
+        verify_service_identity_signature_with_public_key::<
+            GameCultProviderHealthIdentity,
+            IdunnSignedDaemonHealthPurpose,
+        >(&anchor.public_key, b"signed-health-record", &proof)?;
+        assert_eq!(
+            anchor.schema_version,
+            "gamecult.provider_health_identity.trust_anchor.v1"
+        );
+        assert_ne!(
+            derive_service_identity_id::<GameCultProviderHealthIdentity>(&anchor.public_key)?,
+            derive_service_identity_id::<IdunnServiceIdentity>(&anchor.public_key)?
+        );
+        Ok(())
+    }
+
+    #[test]
+    fn runtime_presence_and_legacy_health_purposes_cannot_be_substituted() -> Result<()> {
+        let temp = tempfile::tempdir()?;
+        let signer = enroll_service_identity_at::<GameCultProviderHealthIdentity>(
+            &temp.path().join("provider-runtime-presence.cc"),
+        )?;
+        let anchor = signer.trust_anchor()?;
+        let payload = b"runtime-presence";
+
+        let presence = signer.sign::<GameCultRuntimePresenceHealthPurpose>(payload);
+        verify_service_identity_signature::<
+            GameCultProviderHealthIdentity,
+            GameCultRuntimePresenceHealthPurpose,
+        >(&anchor, payload, &presence)?;
+        assert!(
+            verify_service_identity_signature::<
+                GameCultProviderHealthIdentity,
+                IdunnSignedDaemonHealthPurpose,
+            >(&anchor, payload, &presence)
+            .is_err()
+        );
+
+        let legacy = signer.sign::<IdunnSignedDaemonHealthPurpose>(payload);
+        assert!(
+            verify_service_identity_signature::<
+                GameCultProviderHealthIdentity,
+                GameCultRuntimePresenceHealthPurpose,
+            >(&anchor, payload, &legacy)
+            .is_err()
+        );
+        Ok(())
+    }
+}
diff --git a/packages/cultnet-rs/src/snapshot_query.rs b/packages/cultnet-rs/src/snapshot_query.rs
new file mode 100644
index 00000000..f6150d1d
--- /dev/null
+++ b/packages/cultnet-rs/src/snapshot_query.rs
@@ -0,0 +1,339 @@
+use anyhow::{Result, anyhow};
+use std::collections::{BTreeMap, BTreeSet};
+
+use crate::{CultNetDocumentRegistry, CultNetMessage, CultNetRawDocumentRecord};
+
+/// Read-only backing surface for a CultNet snapshot server.
+///
+/// Records returned here are already the stored wire records. The snapshot
+/// server selects and clones them; it never decodes payloads, rewrites source
+/// metadata, or applies them to another cache.
+pub trait CultNetRawSnapshotSource {
+    fn raw_snapshot(&self) -> Result<Vec<CultNetRawDocumentRecord>>;
+}
+
+impl CultNetRawSnapshotSource for Vec<CultNetRawDocumentRecord> {
+    fn raw_snapshot(&self) -> Result<Vec<CultNetRawDocumentRecord>> {
+        Ok(self.clone())
+    }
+}
+
+impl<F> CultNetRawSnapshotSource for F
+where
+    F: Fn() -> Result<Vec<CultNetRawDocumentRecord>>,
+{
+    fn raw_snapshot(&self) -> Result<Vec<CultNetRawDocumentRecord>> {
+        self()
+    }
+}
+
+#[derive(Clone, Debug, Default, PartialEq, Eq)]
+pub struct CultNetReadOnlySnapshotPolicy {
+    allowed_records: BTreeSet<(String, String)>,
+}
+
+impl CultNetReadOnlySnapshotPolicy {
+    pub fn new() -> Self {
+        Self::default()
+    }
+
+    pub fn allow(
+        &mut self,
+        schema_id: impl Into<String>,
+        record_key: impl Into<String>,
+    ) -> Result<&mut Self> {
+        let schema_id = schema_id.into();
+        let record_key = record_key.into();
+        require_non_empty(&schema_id, "schema_id")?;
+        require_non_empty(&record_key, "record_key")?;
+        self.allowed_records.insert((schema_id, record_key));
+        Ok(self)
+    }
+
+    fn allows(&self, schema_id: &str, record_key: &str) -> bool {
+        self.allowed_records
+            .contains(&(schema_id.to_string(), record_key.to_string()))
+    }
+}
+
+/// Serve one raw snapshot request from an explicitly bounded, read-only view.
+///
+/// The document registry proves that every exposed schema belongs to the
+/// runtime. The policy grants individual `(schema_id, record_key)` pairs. The
+/// source owns the bytes and metadata; this function only selects records.
+pub fn serve_read_only_raw_snapshot<S: CultNetRawSnapshotSource>(
+    document_registry: &CultNetDocumentRegistry,
+    policy: &CultNetReadOnlySnapshotPolicy,
+    source: &S,
+    request: &CultNetMessage,
+) -> Result<CultNetMessage> {
+    let CultNetMessage::SnapshotRequest {
+        message_id,
+        schema_ids,
+        record_keys,
+    } = request
+    else {
+        return Err(anyhow!("expected cultnet.snapshot_request.v0"));
+    };
+    require_non_empty(message_id, "message_id")?;
+    reject_duplicates(schema_ids.as_deref(), "requested schema id")?;
+    reject_duplicates(record_keys.as_deref(), "requested record key")?;
+
+    let requested_schemas = schema_ids
+        .as_ref()
+        .map(|values| values.iter().map(String::as_str).collect::<BTreeSet<_>>());
+    let requested_keys = record_keys
+        .as_ref()
+        .map(|values| values.iter().map(String::as_str).collect::<BTreeSet<_>>());
+    let mut selected = Vec::new();
+    let mut seen = BTreeSet::new();
+
+    for document in source.raw_snapshot()? {
+        let identity = (document.schema_id.clone(), document.record_key.clone());
+        if !seen.insert(identity.clone()) {
+            return Err(anyhow!(
+                "snapshot source contains duplicate record {:?}/{:?}",
+                identity.0,
+                identity.1
+            ));
+        }
+        if document_registry
+            .binding_by_schema_id(&document.schema_id)
+            .is_none()
+        {
+            return Err(anyhow!(
+                "snapshot source record {:?}/{:?} uses an unregistered schema",
+                document.schema_id,
+                document.record_key
+            ));
+        }
+        if !policy.allows(&document.schema_id, &document.record_key) {
+            continue;
+        }
+        if requested_schemas
+            .as_ref()
+            .is_some_and(|schemas| !schemas.contains(document.schema_id.as_str()))
+        {
+            continue;
+        }
+        if requested_keys
+            .as_ref()
+            .is_some_and(|keys| !keys.contains(document.record_key.as_str()))
+        {
+            continue;
+        }
+        selected.push(document);
+    }
+
+    Ok(CultNetMessage::SnapshotResponseRaw {
+        message_id: message_id.clone(),
+        documents: selected,
+    })
+}
+
+#[derive(Clone, Debug, Default, PartialEq, Eq)]
+pub struct CultNetSnapshotSourceExpectation {
+    pub runtime_id: Option<String>,
+    pub agent_id: Option<String>,
+    pub role: Option<String>,
+    pub tags: Option<Vec<String>>,
+}
+
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct CultNetSnapshotRecordExpectation {
+    pub schema_id: String,
+    pub record_key: String,
+    pub source: CultNetSnapshotSourceExpectation,
+}
+
+impl CultNetSnapshotRecordExpectation {
+    pub fn new(schema_id: impl Into<String>, record_key: impl Into<String>) -> Self {
+        Self {
+            schema_id: schema_id.into(),
+            record_key: record_key.into(),
+            source: CultNetSnapshotSourceExpectation::default(),
+        }
+    }
+}
+
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct CultNetRawSnapshotQuery {
+    message_id: String,
+    expectations: BTreeMap<(String, String), CultNetSnapshotSourceExpectation>,
+}
+
+impl CultNetRawSnapshotQuery {
+    pub fn new(
+        message_id: impl Into<String>,
+        records: Vec<CultNetSnapshotRecordExpectation>,
+    ) -> Result<Self> {
+        let message_id = message_id.into();
+        require_non_empty(&message_id, "message_id")?;
+        if records.is_empty() {
+            return Err(anyhow!("snapshot query must request at least one record"));
+        }
+        let mut expectations = BTreeMap::new();
+        for record in records {
+            require_non_empty(&record.schema_id, "schema_id")?;
+            require_non_empty(&record.record_key, "record_key")?;
+            let identity = (record.schema_id, record.record_key);
+            if expectations
+                .insert(identity.clone(), record.source)
+                .is_some()
+            {
+                return Err(anyhow!(
+                    "snapshot query contains duplicate requested record {:?}/{:?}",
+                    identity.0,
+                    identity.1
+                ));
+            }
+        }
+        Ok(Self {
+            message_id,
+            expectations,
+        })
+    }
+
+    pub fn request(&self) -> CultNetMessage {
+        CultNetMessage::SnapshotRequest {
+            message_id: self.message_id.clone(),
+            schema_ids: Some(
+                self.expectations
+                    .keys()
+                    .map(|(schema_id, _)| schema_id.clone())
+                    .collect::<BTreeSet<_>>()
+                    .into_iter()
+                    .collect(),
+            ),
+            record_keys: Some(
+                self.expectations
+                    .keys()
+                    .map(|(_, record_key)| record_key.clone())
+                    .collect::<BTreeSet<_>>()
+                    .into_iter()
+                    .collect(),
+            ),
+        }
+    }
+
+    /// Validate a response and return records without mutating any local cache.
+    pub fn accept_response(
+        &self,
+        response: CultNetMessage,
+    ) -> Result<Vec<CultNetRawDocumentRecord>> {
+        let CultNetMessage::SnapshotResponseRaw {
+            message_id,
+            documents,
+        } = response
+        else {
+            return Err(anyhow!("expected cultnet.snapshot_response_raw.v0"));
+        };
+        if message_id != self.message_id {
+            return Err(anyhow!(
+                "snapshot response message id {:?} does not match request {:?}",
+                message_id,
+                self.message_id
+            ));
+        }
+
+        let mut seen = BTreeSet::new();
+        for document in &documents {
+            let identity = (document.schema_id.clone(), document.record_key.clone());
+            if !seen.insert(identity.clone()) {
+                return Err(anyhow!(
+                    "snapshot response contains duplicate record {:?}/{:?}",
+                    identity.0,
+                    identity.1
+                ));
+            }
+            let expected = self.expectations.get(&identity).ok_or_else(|| {
+                anyhow!(
+                    "snapshot response contains unexpected record {:?}/{:?}",
+                    identity.0,
+                    identity.1
+                )
+            })?;
+            require_expected_metadata(
+                "source_runtime_id",
+                expected.runtime_id.as_deref(),
+                document.source_runtime_id.as_deref(),
+                &identity,
+            )?;
+            require_expected_metadata(
+                "source_agent_id",
+                expected.agent_id.as_deref(),
+                document.source_agent_id.as_deref(),
+                &identity,
+            )?;
+            require_expected_metadata(
+                "source_role",
+                expected.role.as_deref(),
+                document.source_role.as_deref(),
+                &identity,
+            )?;
+            if let Some(expected_tags) = expected.tags.as_ref()
+                && document.tags.as_ref() != Some(expected_tags)
+            {
+                return Err(anyhow!(
+                    "snapshot response record {:?}/{:?} has unexpected tags: expected {:?}, got {:?}",
+                    identity.0,
+                    identity.1,
+                    expected_tags,
+                    document.tags
+                ));
+            }
+        }
+        Ok(documents)
+    }
+}
+
+pub fn query_read_only_raw_snapshot<F>(
+    query: &CultNetRawSnapshotQuery,
+    exchange: F,
+) -> Result<Vec<CultNetRawDocumentRecord>>
+where
+    F: FnOnce(CultNetMessage) -> Result<CultNetMessage>,
+{
+    query.accept_response(exchange(query.request())?)
+}
+
+fn require_expected_metadata(
+    field: &str,
+    expected: Option<&str>,
+    actual: Option<&str>,
+    identity: &(String, String),
+) -> Result<()> {
+    if let Some(expected) = expected
+        && actual != Some(expected)
+    {
+        return Err(anyhow!(
+            "snapshot response record {:?}/{:?} has unexpected {field}: expected {:?}, got {:?}",
+            identity.0,
+            identity.1,
+            expected,
+            actual
+        ));
+    }
+    Ok(())
+}
+
+fn reject_duplicates(values: Option<&[String]>, label: &str) -> Result<()> {
+    let Some(values) = values else {
+        return Ok(());
+    };
+    let mut seen = BTreeSet::new();
+    for value in values {
+        require_non_empty(value, label)?;
+        if !seen.insert(value) {
+            return Err(anyhow!("duplicate {label} {value:?}"));
+        }
+    }
+    Ok(())
+}
+
+fn require_non_empty(value: &str, field: &str) -> Result<()> {
+    if value.trim().is_empty() {
+        return Err(anyhow!("{field} must be non-empty"));
+    }
+    Ok(())
+}
diff --git a/packages/cultnet-rs/src/transport.rs b/packages/cultnet-rs/src/transport.rs
index d7aad261..d097aa3c 100644
--- a/packages/cultnet-rs/src/transport.rs
+++ b/packages/cultnet-rs/src/transport.rs
@@ -19,6 +19,13 @@ pub struct CultNetTransportStats {
     pub bytes_sent: u64,
     pub frames_received: u64,
     pub frames_sent: u64,
+    /// Reliable packets dropped by a send-side expiry deadline instead of being
+    /// retransmitted. Always zero for transports without reliable expiry.
+    pub reliable_packets_expired: u64,
+    /// Incomplete fragment sets discarded to admit newer ones. Each is one
+    /// payload that lost a fragment on the wire. Zero for non-fragmenting
+    /// transports.
+    pub fragment_sets_evicted: u64,
 }
 
 #[derive(Clone, Debug, PartialEq, Eq)]
@@ -201,6 +208,7 @@ pub fn create_tcp_framed_transport_profile(
                 max_payload_bytes: options.max_payload_bytes,
                 max_fragment_bytes: options.max_fragment_bytes,
                 max_pending_reliable_packets: None,
+                            reliable_expire_after_ms: None,
             }],
         }],
     }
@@ -258,6 +266,27 @@ where
         let mut header = [0_u8; FRAME_HEADER_BYTES];
         self.stream.read_exact(&mut header)?;
         let payload_len = u32::from_be_bytes(header) as usize;
+        // Refuse before allocating. The length is the peer's claim, so honouring
+        // it without checking the advertised maximum lets one header reserve as
+        // much memory as the peer cares to name.
+        if let Some(max_payload_bytes) = self
+            .profile
+            .transports
+            .iter()
+            .find(|transport| transport.protocol == CultNetTransportProtocol::TcpFramed)
+            .and_then(|transport| {
+                transport
+                    .channels
+                    .iter()
+                    .find(|channel| channel.channel_id == "schema")
+            })
+            .and_then(|channel| channel.max_payload_bytes)
+            && payload_len > max_payload_bytes as usize
+        {
+            return Err(anyhow!(
+                "tcp_framed payload length {payload_len} exceeds advertised maximum {max_payload_bytes}"
+            ));
+        }
         let mut payload = vec![0_u8; payload_len];
         self.stream.read_exact(&mut payload)?;
         self.stats.bytes_received += (FRAME_HEADER_BYTES + payload_len) as u64;
diff --git a/packages/cultnet-rs/tests/byte_slot_migration.rs b/packages/cultnet-rs/tests/byte_slot_migration.rs
new file mode 100644
index 00000000..0acdcd4d
--- /dev/null
+++ b/packages/cultnet-rs/tests/byte_slot_migration.rs
@@ -0,0 +1,113 @@
+//! Does adding `#[cultcache(key = N, bytes)]` to a field break reading the
+//! records already written without it?
+//!
+//! The attribute changes a slot from a MessagePack array-of-integers (serde's
+//! default for `Vec<u8>`) to a real `bin`. Six of cultnet-rs's byte fields
+//! already carry it and four do not, so converting the remaining four is a
+//! stored-data question before it is a signature question: every record
+//! written before the flip holds an array in that slot.
+//!
+//! Both directions are tested, because a migration has to survive a rollback
+//! as well as a roll-forward.
+
+use cultcache_rs::DatabaseEntry;
+use serde::Serialize;
+
+#[derive(Clone, Debug, PartialEq, Eq, DatabaseEntry)]
+#[cultcache(type = "test.byte_slot", schema = "test.byte_slot.v1")]
+struct ArrayEncoded {
+    #[cultcache(key = 0)]
+    schema_version: String,
+    #[cultcache(key = 1)]
+    payload: Vec<u8>,
+}
+
+#[derive(Clone, Debug, PartialEq, Eq, DatabaseEntry)]
+#[cultcache(type = "test.byte_slot", schema = "test.byte_slot.v1")]
+struct BinEncoded {
+    #[cultcache(key = 0)]
+    schema_version: String,
+    #[cultcache(key = 1, bytes)]
+    payload: Vec<u8>,
+}
+
+fn sample() -> Vec<u8> {
+    (0u8..=255).collect()
+}
+
+#[test]
+fn the_attribute_is_what_switches_the_wire_shape() {
+    let array = rmp_serde::to_vec(&ArrayEncoded {
+        schema_version: "test.byte_slot.v1".into(),
+        payload: sample(),
+    })
+    .expect("array encodes");
+    let bin = rmp_serde::to_vec(&BinEncoded {
+        schema_version: "test.byte_slot.v1".into(),
+        payload: sample(),
+    })
+    .expect("bin encodes");
+
+    // 256 bytes as `bin` is a 3-byte header plus the payload. As an array it
+    // is one or two bytes per element, because every value above 0x7f needs a
+    // u8 marker of its own.
+    println!("array-encoded {} bytes, bin-encoded {} bytes", array.len(), bin.len());
+    assert!(
+        array.len() > bin.len(),
+        "array {} should exceed bin {}",
+        array.len(),
+        bin.len()
+    );
+}
+
+#[test]
+fn a_bytes_reader_still_reads_records_written_before_the_attribute() {
+    let written_before = rmp_serde::to_vec(&ArrayEncoded {
+        schema_version: "test.byte_slot.v1".into(),
+        payload: sample(),
+    })
+    .expect("array encodes");
+
+    // serde_bytes::ByteBuf accepts an array marker as well as bin, so the
+    // flip is NOT a hard read break. This was worth measuring rather than
+    // assuming: the opposite would have forced a dual-read path or a rewrite
+    // migration onto every field with persisted records.
+    let read_after =
+        rmp_serde::from_slice::<BinEncoded>(&written_before).expect("bytes reader reads an array");
+    assert_eq!(read_after.payload, sample());
+}
+
+#[test]
+fn a_pre_attribute_reader_still_reads_records_written_after_it() {
+    let written_after = rmp_serde::to_vec(&BinEncoded {
+        schema_version: "test.byte_slot.v1".into(),
+        payload: sample(),
+    })
+    .expect("bin encodes");
+
+    // The rollback direction, so reverting the binary is survivable.
+    let read_by_old =
+        rmp_serde::from_slice::<ArrayEncoded>(&written_after).expect("plain reader reads bin");
+    assert_eq!(read_by_old.payload, sample());
+}
+
+#[test]
+fn re_encoding_an_old_record_under_the_attribute_does_not_reproduce_its_bytes() {
+    // Where the cost actually lands. Reading is compatible; reproducing is
+    // not. Idunn byte-exact-checks its control store by re-encoding what it
+    // decoded, and canonical_sha256 hashes the same serialization -- so a
+    // record written before the flip can be read, but can never re-encode to
+    // the bytes it was stored as, and its canonical digest changes.
+    let written_before = rmp_serde::to_vec(&ArrayEncoded {
+        schema_version: "test.byte_slot.v1".into(),
+        payload: sample(),
+    })
+    .expect("array encodes");
+    let decoded = rmp_serde::from_slice::<BinEncoded>(&written_before).expect("reads");
+    let re_encoded = rmp_serde::to_vec(&decoded).expect("re-encodes");
+
+    assert_ne!(
+        written_before, re_encoded,
+        "identical bytes would mean the attribute changed nothing"
+    );
+}
diff --git a/packages/cultnet-rs/tests/cultnet.rs b/packages/cultnet-rs/tests/cultnet.rs
index 2803db51..0b76990f 100644
--- a/packages/cultnet-rs/tests/cultnet.rs
+++ b/packages/cultnet-rs/tests/cultnet.rs
@@ -4,6 +4,7 @@ use chrono::Utc;
 use cultcache_rs::CultCache;
 use cultcache_rs::DatabaseEntry;
 use cultcache_rs::SingleFileMessagePackBackingStore;
+use cultnet_rs::CULTNET_RUDP_RELIABLE_SEND_WINDOW_PACKETS;
 use cultnet_rs::CultMesh;
 use cultnet_rs::CultMeshAuthorityLease;
 use cultnet_rs::CultMeshPeerCard;
@@ -17,6 +18,7 @@ use cultnet_rs::CultNetDocumentPutOptions;
 use cultnet_rs::CultNetDocumentRegistry;
 use cultnet_rs::CultNetMessage;
 use cultnet_rs::CultNetMutationAuthority;
+use cultnet_rs::CultNetReactiveDocumentOptions;
 use cultnet_rs::CultNetReconnectController;
 use cultnet_rs::CultNetReconnectPolicyOptions;
 use cultnet_rs::CultNetRudpPacket;
@@ -59,12 +61,14 @@ use cultnet_rs::encode_frame;
 use cultnet_rs::encode_rudp_packet;
 use pretty_assertions::assert_eq;
 use std::cell::RefCell;
+use std::collections::VecDeque;
 use std::net::UdpSocket;
 use std::rc::Rc;
 use std::sync::atomic::{AtomicBool, Ordering};
 use std::sync::{Arc, Mutex};
 use std::thread;
 use std::time::Duration as StdDuration;
+use std::time::Instant as StdInstant;
 
 const TS_HELLO_FRAME: &[u8] = include_bytes!("fixtures/cultnet-ts-hello.frame");
 const TS_LEGACY_LOGIN_FRAME: &[u8] = include_bytes!("fixtures/cultnet-ts-legacy-login.frame");
@@ -149,6 +153,44 @@ struct GhostlightAgentStateFixture {
     display_name: String,
 }
 
+#[derive(Clone, Debug, PartialEq, DatabaseEntry)]
+#[cultcache(
+    type = "ghostlight.agent-state.ui",
+    schema = "GhostlightAgentStateUiFixture"
+)]
+struct GhostlightAgentStateUiFixture {
+    #[cultcache(key = 0)]
+    schema_version: String,
+    #[cultcache(key = 1)]
+    agent_id: String,
+    #[cultcache(key = 2)]
+    display_name: String,
+}
+
+#[derive(Clone, Debug, PartialEq, DatabaseEntry)]
+#[cultcache(
+    type = "ghostlight.reactive-note",
+    schema = "GhostlightReactiveNoteFixture"
+)]
+struct GhostlightReactiveNoteFixture {
+    #[cultcache(key = 0)]
+    body: String,
+    #[cultcache(key = 1)]
+    revision: i32,
+}
+
+#[derive(Clone, Debug, PartialEq, DatabaseEntry)]
+#[cultcache(
+    type = "ghostlight.reactive-note.ui",
+    schema = "GhostlightReactiveNoteUiFixture"
+)]
+struct GhostlightReactiveNoteUiFixture {
+    #[cultcache(key = 0)]
+    body: String,
+    #[cultcache(key = 1)]
+    revision: i32,
+}
+
 #[test]
 fn security_helpers_round_trip_encrypted_strings_and_validate_sessions() -> Result<()> {
     let server_security = CultNetServerSecurityOptions::development();
@@ -216,6 +258,7 @@ fn cultnet_schema_messages_round_trip_through_messagepack_frames() -> Result<()>
                     max_payload_bytes: None,
                     max_fragment_bytes: None,
                     max_pending_reliable_packets: None,
+                                    reliable_expire_after_ms: None,
                 }],
             }],
         }]),
@@ -316,6 +359,7 @@ fn rudp_transport_profile_advertises_state_and_realtime_channels() {
     let profile = create_rudp_transport_profile(
         "rust-rudp",
         cultnet_rs::RudpTransportProfileOptions {
+            media_delivery: None,
             transport_id: Some("public-rudp".to_string()),
             host: Some("127.0.0.1".to_string()),
             port: Some(7777),
@@ -323,6 +367,7 @@ fn rudp_transport_profile_advertises_state_and_realtime_channels() {
             max_fragment_bytes: Some(1000),
             max_pending_reliable_packets: Some(64),
             reconnect_policy: None,
+                    media_reliable_expire_after_ms: None,
         },
     );
 
@@ -383,6 +428,12 @@ fn rudp_transport_profile_advertises_state_and_realtime_channels() {
                 CultNetTransportOrdering::Unordered,
                 Some(64)
             ),
+            (
+                "audio",
+                CultNetTransportDelivery::Reliable,
+                CultNetTransportOrdering::Unordered,
+                Some(64)
+            ),
         ]
     );
 }
@@ -715,6 +766,133 @@ fn rudp_session_pings_and_detects_receive_timeout() -> Result<()> {
     Ok(())
 }
 
+#[test]
+fn rudp_lossy_packets_cannot_create_reliable_ordered_gaps() -> Result<()> {
+    let mut client = CultNetRudpSession::new(CultNetRudpSessionOptions {
+        connection_id: 198,
+        initial_sequence: 1,
+        ..CultNetRudpSessionOptions::default()
+    });
+    let mut server = CultNetRudpSession::new(CultNetRudpSessionOptions {
+        connection_id: 198,
+        initial_sequence: 100,
+        ..CultNetRudpSessionOptions::default()
+    });
+    let connect = client.create_connect(0, Vec::new())?;
+    let accept = server.accept_connect(&connect, 1, Vec::new())?;
+    client.receive(&accept, 2)?;
+
+    let ping = client.create_ping(b"pulse".to_vec());
+    let pong = server
+        .receive(&ping, 3)?
+        .reply
+        .expect("ping should produce pong");
+    let realtime = server.send(
+        "realtime",
+        b"discarded realtime".to_vec(),
+        CultNetRudpSendOptions::default(),
+    )?;
+    let latest = server.send(
+        "latest",
+        b"discarded latest state".to_vec(),
+        CultNetRudpSendOptions {
+            sequenced: true,
+            ..CultNetRudpSendOptions::default()
+        },
+    )?;
+    let schema = server.send(
+        "schema",
+        b"committed response".to_vec(),
+        CultNetRudpSendOptions {
+            reliable: true,
+            ordered: true,
+            ..CultNetRudpSendOptions::default()
+        },
+    )?;
+
+    assert_eq!(ping.sequence, 0);
+    assert_eq!(pong.sequence, 0);
+    assert_eq!(realtime.sequence, 0);
+    assert_eq!(latest.sequence, 1);
+    assert_eq!(schema.sequence, accept.sequence + 1);
+    assert_eq!(
+        client.receive(&schema, 4)?.delivered[0].payload,
+        b"committed response"
+    );
+    Ok(())
+}
+
+#[test]
+fn rudp_unreliable_sequenced_delivery_is_scoped_to_its_channel() -> Result<()> {
+    let mut sender = CultNetRudpSession::new(CultNetRudpSessionOptions {
+        connection_id: 197,
+        initial_sequence: 50,
+        ..CultNetRudpSessionOptions::default()
+    });
+    let mut receiver = CultNetRudpSession::new(CultNetRudpSessionOptions {
+        connection_id: 197,
+        initial_sequence: 100,
+        ..CultNetRudpSessionOptions::default()
+    });
+    let connect = sender.create_connect(0, Vec::new())?;
+    let accept = receiver.accept_connect(&connect, 1, Vec::new())?;
+    sender.receive(&accept, 2)?;
+    let options = CultNetRudpSendOptions {
+        sequenced: true,
+        ..CultNetRudpSendOptions::default()
+    };
+    let older = sender.send("latest", b"older".to_vec(), options.clone())?;
+    let newer = sender.send("latest", b"newer".to_vec(), options)?;
+
+    assert_eq!(older.sequence, 1);
+    assert_eq!(newer.sequence, 2);
+    assert_eq!(receiver.receive(&newer, 3)?.delivered[0].payload, b"newer");
+    assert!(receiver.receive(&older, 4)?.delivered.is_empty());
+    Ok(())
+}
+
+#[test]
+fn rudp_rejects_unreliable_ordered_delivery() -> Result<()> {
+    let mut session = CultNetRudpSession::new(CultNetRudpSessionOptions {
+        connection_id: 196,
+        ..CultNetRudpSessionOptions::default()
+    });
+    session.receive(
+        &CultNetRudpPacket {
+            packet_type: CultNetRudpPacketType::Accept,
+            connection_id: 196,
+            sequence: 50,
+            ack: 0,
+            ack_mask: 0,
+            channel_id: "control".to_string(),
+            reliable: false,
+            ordered: false,
+            sequenced: false,
+            fragment_id: 0,
+            fragment_index: 0,
+            fragment_count: 0,
+            payload: Vec::new(),
+        },
+        0,
+    )?;
+    let error = session
+        .send(
+            "schema",
+            b"cannot order what will not retransmit".to_vec(),
+            CultNetRudpSendOptions {
+                ordered: true,
+                ..CultNetRudpSendOptions::default()
+            },
+        )
+        .unwrap_err();
+    assert!(
+        error
+            .to_string()
+            .contains("ordered delivery requires reliability")
+    );
+    Ok(())
+}
+
 #[test]
 fn rudp_session_bounds_pending_reliable_packets_before_enqueue() -> Result<()> {
     let mut session = CultNetRudpSession::new(CultNetRudpSessionOptions {
@@ -953,6 +1131,8 @@ fn rudp_session_skips_control_packets_while_ordering_schema_payloads() -> Result
     let first = sender.send("schema", b"first".to_vec(), options.clone())?;
     let control = sender.create_ack();
     let second = sender.send("schema", b"second".to_vec(), options)?;
+    assert_eq!(control.sequence, 0);
+    assert_eq!(second.sequence, first.sequence + 1);
 
     assert_eq!(
         receiver
@@ -1075,6 +1255,7 @@ fn rudp_socket_transport_handshakes_and_carries_reliable_ordered_schema_frames()
     let connection_id = 0x1020_3040;
     let mut server =
         CultNetRudpSocketTransportConnection::new(CultNetRudpSocketTransportOptions {
+            media_delivery: None,
             runtime_id: "rust-rudp-server".to_string(),
             socket: server_socket,
             mode: CultNetRudpSocketMode::Server,
@@ -1087,9 +1268,11 @@ fn rudp_socket_transport_handshakes_and_carries_reliable_ordered_schema_frames()
             max_fragment_bytes: None,
             max_pending_reliable_packets: None,
             reconnect_policy: None,
+                    media_reliable_expire_after_ms: None,
         })?;
     let mut client =
         CultNetRudpSocketTransportConnection::new(CultNetRudpSocketTransportOptions {
+            media_delivery: None,
             runtime_id: "rust-rudp-client".to_string(),
             socket: client_socket,
             mode: CultNetRudpSocketMode::Client,
@@ -1102,6 +1285,7 @@ fn rudp_socket_transport_handshakes_and_carries_reliable_ordered_schema_frames()
             max_fragment_bytes: None,
             max_pending_reliable_packets: None,
             reconnect_policy: None,
+                    media_reliable_expire_after_ms: None,
         })?;
 
     client.connect(b"join".to_vec())?;
@@ -1165,6 +1349,7 @@ fn rudp_socket_transport_carries_fragmented_reliable_ordered_schema_frames() ->
     let connection_id = 0x1020_3041;
     let mut server =
         CultNetRudpSocketTransportConnection::new(CultNetRudpSocketTransportOptions {
+            media_delivery: None,
             runtime_id: "rust-rudp-fragment-server".to_string(),
             socket: server_socket,
             mode: CultNetRudpSocketMode::Server,
@@ -1177,9 +1362,11 @@ fn rudp_socket_transport_carries_fragmented_reliable_ordered_schema_frames() ->
             max_fragment_bytes: Some(8),
             max_pending_reliable_packets: None,
             reconnect_policy: None,
+                    media_reliable_expire_after_ms: None,
         })?;
     let mut client =
         CultNetRudpSocketTransportConnection::new(CultNetRudpSocketTransportOptions {
+            media_delivery: None,
             runtime_id: "rust-rudp-fragment-client".to_string(),
             socket: client_socket,
             mode: CultNetRudpSocketMode::Client,
@@ -1192,6 +1379,7 @@ fn rudp_socket_transport_carries_fragmented_reliable_ordered_schema_frames() ->
             max_fragment_bytes: Some(8),
             max_pending_reliable_packets: None,
             reconnect_policy: None,
+                    media_reliable_expire_after_ms: None,
         })?;
 
     client.connect(b"join".to_vec())?;
@@ -1207,6 +1395,164 @@ fn rudp_socket_transport_carries_fragmented_reliable_ordered_schema_frames() ->
     Ok(())
 }
 
+#[test]
+fn rudp_session_advances_large_fragment_sets_through_a_bounded_reliable_window() -> Result<()> {
+    let connection_id = 0x1020_3042;
+    let mut sender = CultNetRudpSession::new(CultNetRudpSessionOptions {
+        connection_id,
+        initial_sequence: 1,
+        resend_delay_ms: 25,
+        max_pending_reliable_packets: None,
+    });
+    let mut receiver = CultNetRudpSession::new(CultNetRudpSessionOptions {
+        connection_id,
+        initial_sequence: 100,
+        resend_delay_ms: 25,
+        max_pending_reliable_packets: None,
+    });
+    for session in [&mut sender, &mut receiver] {
+        session.receive(
+            &CultNetRudpPacket {
+                packet_type: CultNetRudpPacketType::Accept,
+                connection_id,
+                sequence: 0,
+                ack: 0,
+                ack_mask: 0,
+                channel_id: "control".into(),
+                reliable: false,
+                ordered: false,
+                sequenced: false,
+                fragment_id: 0,
+                fragment_index: 0,
+                fragment_count: 0,
+                payload: Vec::new(),
+            },
+            0,
+        )?;
+    }
+
+    let fragment_count = CULTNET_RUDP_RELIABLE_SEND_WINDOW_PACKETS + 17;
+    let payload = (0..fragment_count * 8)
+        .map(|index| (index % 251) as u8)
+        .collect::<Vec<_>>();
+    let initial = sender.send_many(
+        "schema",
+        payload.clone(),
+        CultNetRudpSendOptions {
+            reliable: true,
+            ordered: true,
+            now_ms: 1,
+            ..CultNetRudpSendOptions::default()
+        },
+        Some(8),
+    )?;
+    assert_eq!(initial.len(), CULTNET_RUDP_RELIABLE_SEND_WINDOW_PACKETS);
+    let oldest_sequence = initial[0].sequence;
+    assert_eq!(sender.pending_reliable_sequences().len(), initial.len());
+    assert_eq!(sender.queued_reliable_packet_count(), 17);
+
+    let mut wire = VecDeque::from(initial);
+    let mut delivered = Vec::new();
+    while !wire.is_empty() {
+        let admitted = wire.len();
+        for _ in 0..admitted {
+            let packet = wire.pop_front().expect("admitted packet remains queued");
+            let received = receiver.receive(&packet, 2)?;
+            delivered.extend(received.delivered);
+        }
+        let acknowledged = sender.receive(&receiver.create_ack(), 3)?;
+        wire.extend(acknowledged.ready_to_send);
+    }
+
+    assert_eq!(sender.outstanding_reliable_packet_count(), 0);
+    assert_eq!(delivered.len(), 1);
+    assert_eq!(delivered[0].payload, payload);
+    let old_ack = receiver.create_ack_for_received(oldest_sequence);
+    assert_eq!(old_ack.ack, oldest_sequence);
+    assert_eq!(old_ack.ack_mask, 0);
+    Ok(())
+}
+
+#[test]
+fn rudp_socket_flush_waits_for_large_fragment_delivery() -> Result<()> {
+    let server_socket = bind_udp_socket()?;
+    let client_socket = bind_udp_socket()?;
+    let server_addr = server_socket.local_addr()?;
+    let connection_id = 0x1020_3043;
+    let mut server =
+        CultNetRudpSocketTransportConnection::new(CultNetRudpSocketTransportOptions {
+            media_delivery: None,
+            runtime_id: "rust-rudp-window-server".into(),
+            socket: server_socket,
+            mode: CultNetRudpSocketMode::Server,
+            remote_addr: None,
+            connection_id,
+            initial_sequence: 100,
+            resend_delay_ms: 25,
+            transport_id: None,
+            max_payload_bytes: None,
+            max_fragment_bytes: Some(8),
+            max_pending_reliable_packets: None,
+            reconnect_policy: None,
+                    media_reliable_expire_after_ms: None,
+        })?;
+    let mut client =
+        CultNetRudpSocketTransportConnection::new(CultNetRudpSocketTransportOptions {
+            media_delivery: None,
+            runtime_id: "rust-rudp-window-client".into(),
+            socket: client_socket,
+            mode: CultNetRudpSocketMode::Client,
+            remote_addr: Some(server_addr),
+            connection_id,
+            initial_sequence: 1,
+            resend_delay_ms: 25,
+            transport_id: None,
+            max_payload_bytes: None,
+            max_fragment_bytes: Some(8),
+            max_pending_reliable_packets: None,
+            reconnect_policy: None,
+                    media_reliable_expire_after_ms: None,
+        })?;
+    client.connect(b"join".to_vec())?;
+    pump_rudp_handshake(&mut client, &mut server)?;
+
+    let payload = vec![0x5a; (CULTNET_RUDP_RELIABLE_SEND_WINDOW_PACKETS + 17) * 8];
+    client.send("schema", payload.clone())?;
+    assert_eq!(
+        client.pending_reliable_packet_count(),
+        CULTNET_RUDP_RELIABLE_SEND_WINDOW_PACKETS
+    );
+    assert_eq!(
+        client.outstanding_reliable_packet_count(),
+        CULTNET_RUDP_RELIABLE_SEND_WINDOW_PACKETS + 17
+    );
+
+    let server_worker = thread::spawn(move || -> Result<CultNetTransportFrame> {
+        let delivery_deadline = StdInstant::now() + StdDuration::from_secs(5);
+        let delivered = loop {
+            if let Some(frame) = server.receive_once()? {
+                break frame;
+            }
+            if StdInstant::now() >= delivery_deadline {
+                anyhow::bail!("RUDP large socket frame was not delivered");
+            }
+        };
+        let linger_deadline = StdInstant::now() + StdDuration::from_millis(250);
+        while StdInstant::now() < linger_deadline {
+            let _ = server.receive_once()?;
+            server.poll_resends()?;
+        }
+        Ok(delivered)
+    });
+    client.flush_reliable(StdDuration::from_secs(5))?;
+    let delivered = server_worker
+        .join()
+        .map_err(|_| anyhow::anyhow!("RUDP server worker panicked"))??;
+    assert_eq!(delivered.payload, payload);
+    assert_eq!(client.outstanding_reliable_packet_count(), 0);
+    Ok(())
+}
+
 #[test]
 fn cultmesh_facade_creates_rudp_client_from_peer_endpoint() -> Result<()> {
     let connection_id = 0x2030_4050;
@@ -1604,7 +1950,7 @@ fn document_registry_replicates_typed_cultcache_state() -> Result<()> {
 
     let mut origin = CultCache::new();
     origin.register_entry_type::<GhostlightAgentStateFixture>()?;
-    origin.add_generic_backing_store(SingleFileMessagePackBackingStore::new(&origin_store));
+    origin.add_generic_backing_store(SingleFileMessagePackBackingStore::new(&origin_store))?;
     origin.pull_all_backing_stores()?;
     origin.put("epiphany.persona", &payload)?;
 
@@ -1612,11 +1958,17 @@ fn document_registry_replicates_typed_cultcache_state() -> Result<()> {
 
     let mut target = CultCache::new();
     target.register_entry_type::<GhostlightAgentStateFixture>()?;
-    target.add_generic_backing_store(SingleFileMessagePackBackingStore::new(&target_store));
+    target.add_generic_backing_store(SingleFileMessagePackBackingStore::new(&target_store))?;
     target.pull_all_backing_stores()?;
     let applied =
         registry.apply_snapshot_response::<GhostlightAgentStateFixture>(&mut target, &snapshot)?;
+    let synced = registry.sync_document_from_snapshot_response::<GhostlightAgentStateFixture>(
+        &mut target,
+        &snapshot,
+        "epiphany.persona",
+    )?;
     assert_eq!(applied, vec![payload.clone()]);
+    assert_eq!(synced, payload);
     assert_eq!(
         target.get_required::<GhostlightAgentStateFixture>("epiphany.persona")?,
         payload
@@ -1655,7 +2007,7 @@ fn raw_snapshot_replication_preserves_messagepack_payload_bytes() -> Result<()>
 
     let mut origin = CultCache::new();
     origin.register_entry_type::<GhostlightAgentStateFixture>()?;
-    origin.add_generic_backing_store(SingleFileMessagePackBackingStore::new(&origin_store));
+    origin.add_generic_backing_store(SingleFileMessagePackBackingStore::new(&origin_store))?;
     origin.pull_all_backing_stores()?;
     origin.put("epiphany.persona", &payload)?;
 
@@ -1666,7 +2018,7 @@ fn raw_snapshot_replication_preserves_messagepack_payload_bytes() -> Result<()>
 
     let mut target = CultCache::new();
     target.register_entry_type::<GhostlightAgentStateFixture>()?;
-    target.add_generic_backing_store(SingleFileMessagePackBackingStore::new(&target_store));
+    target.add_generic_backing_store(SingleFileMessagePackBackingStore::new(&target_store))?;
     target.pull_all_backing_stores()?;
     let applied = registry
         .apply_raw_snapshot_response::<GhostlightAgentStateFixture>(&mut target, &raw_snapshot)?;
@@ -1682,6 +2034,213 @@ fn raw_snapshot_replication_preserves_messagepack_payload_bytes() -> Result<()>
     Ok(())
 }
 
+#[test]
+fn raw_snapshot_replication_hydrates_same_schema_rust_aliases() -> Result<()> {
+    let temp = tempfile::tempdir()?;
+    let origin_store = temp.path().join("origin-alias.msgpack");
+    let target_store = temp.path().join("target-alias.msgpack");
+    let canonical = GhostlightAgentStateFixture {
+        schema_version: "ghostlight.agent_state.v0".to_string(),
+        agent_id: "epiphany.persona".to_string(),
+        display_name: "Persona".to_string(),
+    };
+
+    let mut origin_registry = CultNetDocumentRegistry::new();
+    origin_registry.register(CultNetDocumentBinding::for_entry_with_schema_id::<
+        GhostlightAgentStateFixture,
+    >(
+        "ghostlight.agent_state.v0".to_string(),
+        "ghostlight.agent_state.v0".to_string(),
+    ));
+    let mut origin = CultCache::new();
+    origin.register_entry_type::<GhostlightAgentStateFixture>()?;
+    origin.add_generic_backing_store(SingleFileMessagePackBackingStore::new(&origin_store))?;
+    origin.pull_all_backing_stores()?;
+    origin.put("epiphany.persona", &canonical)?;
+    let raw_snapshot = origin_registry.create_raw_snapshot_response(
+        &origin,
+        "raw-snapshot-alias",
+        Some(&["ghostlight.agent_state.v0".to_string()]),
+        Some(&["epiphany.persona".to_string()]),
+    )?;
+
+    let mut alias_registry = CultNetDocumentRegistry::new();
+    alias_registry.register(CultNetDocumentBinding::for_entry_with_schema_id::<
+        GhostlightAgentStateUiFixture,
+    >(
+        "ghostlight.agent_state.v0".to_string(),
+        "ghostlight.agent_state.v0".to_string(),
+    ));
+    let mut target = CultCache::new();
+    target.register_entry_type::<GhostlightAgentStateUiFixture>()?;
+    target.add_generic_backing_store(SingleFileMessagePackBackingStore::new(&target_store))?;
+    target.pull_all_backing_stores()?;
+
+    let applied = alias_registry
+        .sync_raw_document_from_snapshot_response::<GhostlightAgentStateUiFixture>(
+            &mut target,
+            &raw_snapshot,
+            "epiphany.persona",
+        )?;
+
+    assert_eq!(
+        applied,
+        GhostlightAgentStateUiFixture {
+            schema_version: "ghostlight.agent_state.v0".to_string(),
+            agent_id: "epiphany.persona".to_string(),
+            display_name: "Persona".to_string(),
+        }
+    );
+    assert_eq!(
+        target.get_required::<GhostlightAgentStateUiFixture>("epiphany.persona")?,
+        applied
+    );
+    Ok(())
+}
+
+#[test]
+fn reactive_document_coalesces_direct_same_schema_alias_member_writes() -> Result<()> {
+    let temp = tempfile::tempdir()?;
+    let target_store = temp.path().join("target-reactive-alias.msgpack");
+    let mut registry = CultNetDocumentRegistry::new();
+    registry.register(CultNetDocumentBinding::for_entry_with_schema_id::<
+        GhostlightReactiveNoteUiFixture,
+    >(
+        "ghostlight.reactive_note.v0".to_string(),
+        "ghostlight.reactive_note.v0".to_string(),
+    ));
+    let cache = Arc::new(Mutex::new(CultCache::new()));
+    {
+        let mut cache = cache.lock().expect("cache mutex");
+        cache.register_entry_type::<GhostlightReactiveNoteUiFixture>()?;
+        cache.add_generic_backing_store(SingleFileMessagePackBackingStore::new(&target_store))?;
+        cache.pull_all_backing_stores()?;
+        cache.put(
+            "note:reactive",
+            &GhostlightReactiveNoteUiFixture {
+                body: "initial".to_string(),
+                revision: 1,
+            },
+        )?;
+    }
+
+    let reactive = registry.reactive_document::<GhostlightReactiveNoteUiFixture>(
+        Arc::clone(&cache),
+        "note:reactive",
+        CultNetReactiveDocumentOptions {
+            flush_delay: StdDuration::from_millis(5),
+            ..CultNetReactiveDocumentOptions::default()
+        },
+    )?;
+    {
+        let current = reactive.current();
+        let mut current = current.lock().expect("reactive current mutex");
+        current.body = "first-local-edit".to_string();
+        current.body = "second-local-edit".to_string();
+        current.revision = 2;
+    }
+
+    for _ in 0..30 {
+        let body = cache
+            .lock()
+            .expect("cache mutex")
+            .get_required::<GhostlightReactiveNoteUiFixture>("note:reactive")?
+            .body;
+        if body == "second-local-edit" {
+            break;
+        }
+        thread::sleep(StdDuration::from_millis(5));
+    }
+
+    let stored = cache
+        .lock()
+        .expect("cache mutex")
+        .get_required::<GhostlightReactiveNoteUiFixture>("note:reactive")?;
+    assert_eq!(stored.body, "second-local-edit");
+    assert_eq!(stored.revision, 2);
+    assert!(!reactive.is_dirty());
+    assert!(reactive.last_error().is_none());
+    Ok(())
+}
+
+#[test]
+fn reactive_document_tracks_canonical_reconciliation_delta() -> Result<()> {
+    let temp = tempfile::tempdir()?;
+    let target_store = temp.path().join("target-reactive-reconcile.msgpack");
+    let mut registry = CultNetDocumentRegistry::new();
+    registry.register(CultNetDocumentBinding::for_entry_with_schema_id::<
+        GhostlightReactiveNoteFixture,
+    >(
+        "ghostlight.reactive_note.v0".to_string(),
+        "ghostlight.reactive_note.v0".to_string(),
+    ));
+    let cache = Arc::new(Mutex::new(CultCache::new()));
+    {
+        let mut cache = cache.lock().expect("cache mutex");
+        cache.register_entry_type::<GhostlightReactiveNoteFixture>()?;
+        cache.add_generic_backing_store(SingleFileMessagePackBackingStore::new(&target_store))?;
+        cache.pull_all_backing_stores()?;
+        cache.put(
+            "note:reconcile",
+            &GhostlightReactiveNoteFixture {
+                body: "initial".to_string(),
+                revision: 1,
+            },
+        )?;
+    }
+
+    let reactive = registry.reactive_document::<GhostlightReactiveNoteFixture>(
+        Arc::clone(&cache),
+        "note:reconcile",
+        CultNetReactiveDocumentOptions {
+            flush_delay: StdDuration::from_secs(60),
+            detect_local_changes: false,
+            ..CultNetReactiveDocumentOptions::default()
+        },
+    )?;
+    reactive.update(|note| {
+        note.body = "local-prediction".to_string();
+        note.revision = 2;
+    })?;
+    let authoritative = registry.create_document_put_message(
+        "put-authoritative",
+        "note:reconcile",
+        &GhostlightReactiveNoteFixture {
+            body: "authoritative".to_string(),
+            revision: 7,
+        },
+        CultNetDocumentPutOptions::default(),
+    )?;
+
+    reactive.apply_document_put_message(&authoritative)?;
+
+    let current = reactive.current();
+    let current = current.lock().expect("reactive current mutex").clone();
+    assert_eq!(current.body, "local-prediction");
+    let reconciliation = reactive
+        .reconciliation()
+        .expect("dirty canonical apply records reconciliation");
+    assert_eq!(reconciliation.canonical.body, "authoritative");
+    assert_eq!(reconciliation.predicted.body, "local-prediction");
+    assert_eq!(
+        reconciliation.delta.get("0"),
+        Some(&serde_json::json!("local-prediction"))
+    );
+    assert_eq!(
+        reconciliation.delta.get("1"),
+        Some(&serde_json::json!(-5.0))
+    );
+
+    reactive.flush()?;
+    let stored = cache
+        .lock()
+        .expect("cache mutex")
+        .get_required::<GhostlightReactiveNoteFixture>("note:reconcile")?;
+    assert_eq!(stored.body, "local-prediction");
+    assert!(reactive.reconciliation().is_none());
+    Ok(())
+}
+
 #[test]
 fn client_security_keeps_the_connection_key_visible_without_exposing_cipher_logic() -> Result<()> {
     let options = CultNetClientSecurityOptions::development();
@@ -1879,3 +2438,514 @@ fn schema_discovery_round_trips_over_legacy_gamecult_contract_when_inline_schema
     );
     Ok(())
 }
+
+#[test]
+fn rudp_sequenced_channel_tracking_is_bounded() -> Result<()> {
+    let mut sender = CultNetRudpSession::new(CultNetRudpSessionOptions {
+        connection_id: 401,
+        initial_sequence: 1,
+        ..CultNetRudpSessionOptions::default()
+    });
+    let mut receiver = CultNetRudpSession::new(CultNetRudpSessionOptions {
+        connection_id: 401,
+        initial_sequence: 100,
+        ..CultNetRudpSessionOptions::default()
+    });
+    let connect = sender.create_connect(0, Vec::new())?;
+    let accept = receiver.accept_connect(&connect, 1, Vec::new())?;
+    sender.receive(&accept, 2)?;
+
+    // A peer picks its own channel ids, so the sequenced map is attacker-sized.
+    let mut error = None;
+    for channel in 0..256u32 {
+        let packet = sender.send(
+            &format!("channel-{channel}"),
+            b"state".to_vec(),
+            CultNetRudpSendOptions {
+                sequenced: true,
+                ..CultNetRudpSendOptions::default()
+            },
+        )?;
+        if let Err(refused) = receiver.receive(&packet, 3) {
+            error = Some(refused);
+            break;
+        }
+    }
+    let error = error.expect("unbounded sequenced channel tracking");
+    assert!(
+        error.to_string().contains("too many sequenced channels"),
+        "unexpected refusal: {error}"
+    );
+    Ok(())
+}
+
+#[test]
+fn rudp_ordered_channel_tracking_is_bounded() -> Result<()> {
+    let mut sender = CultNetRudpSession::new(CultNetRudpSessionOptions {
+        connection_id: 402,
+        initial_sequence: 1,
+        ..CultNetRudpSessionOptions::default()
+    });
+    let mut receiver = CultNetRudpSession::new(CultNetRudpSessionOptions {
+        connection_id: 402,
+        initial_sequence: 100,
+        ..CultNetRudpSessionOptions::default()
+    });
+    let connect = sender.create_connect(0, Vec::new())?;
+    let accept = receiver.accept_connect(&connect, 1, Vec::new())?;
+    sender.receive(&accept, 2)?;
+
+    let mut error = None;
+    for channel in 0..256u32 {
+        let packet = sender.send(
+            &format!("ordered-{channel}"),
+            b"state".to_vec(),
+            CultNetRudpSendOptions {
+                reliable: true,
+                ordered: true,
+                ..CultNetRudpSendOptions::default()
+            },
+        )?;
+        match receiver.receive(&packet, 3) {
+            Ok(_) => {
+                sender.receive(&receiver.create_ack_for(packet.sequence), 3)?;
+            }
+            Err(refused) => {
+                error = Some(refused);
+                break;
+            }
+        }
+    }
+    let error = error.expect("unbounded ordered channel tracking");
+    assert!(
+        error.to_string().contains("too many ordered channels"),
+        "unexpected refusal: {error}"
+    );
+    Ok(())
+}
+
+#[test]
+fn rudp_ordered_hold_buffer_is_bounded() -> Result<()> {
+    let mut sender = CultNetRudpSession::new(CultNetRudpSessionOptions {
+        connection_id: 403,
+        initial_sequence: 1,
+        ..CultNetRudpSessionOptions::default()
+    });
+    let mut receiver = CultNetRudpSession::new(CultNetRudpSessionOptions {
+        connection_id: 403,
+        initial_sequence: 100,
+        ..CultNetRudpSessionOptions::default()
+    });
+    let connect = sender.create_connect(0, Vec::new())?;
+    let accept = receiver.accept_connect(&connect, 1, Vec::new())?;
+    sender.receive(&accept, 2)?;
+
+    let options = CultNetRudpSendOptions {
+        reliable: true,
+        ordered: true,
+        ..CultNetRudpSendOptions::default()
+    };
+    // Withhold the first frame so every later one has to be held.
+    let withheld = sender.send("schema", b"first".to_vec(), options.clone())?;
+    sender.receive(&receiver.create_ack_for(withheld.sequence), 3)?;
+
+    let mut error = None;
+    for step in 0..4_096u32 {
+        let packet = sender.send("schema", vec![(step % 251) as u8], options.clone())?;
+        match receiver.receive(&packet, 4) {
+            Ok(result) => {
+                assert!(result.delivered.is_empty(), "gap should hold every frame");
+                sender.receive(&receiver.create_ack_for(packet.sequence), 4)?;
+            }
+            Err(refused) => {
+                error = Some(refused);
+                break;
+            }
+        }
+    }
+    let error = error.expect("unbounded ordered hold buffer");
+    assert!(
+        error.to_string().contains("ordered hold buffer is full"),
+        "unexpected refusal: {error}"
+    );
+    Ok(())
+}
+
+#[test]
+fn rudp_far_ahead_sequence_cannot_starve_the_session() -> Result<()> {
+    let mut sender = CultNetRudpSession::new(CultNetRudpSessionOptions {
+        connection_id: 404,
+        initial_sequence: 1,
+        ..CultNetRudpSessionOptions::default()
+    });
+    let mut receiver = CultNetRudpSession::new(CultNetRudpSessionOptions {
+        connection_id: 404,
+        initial_sequence: 100,
+        ..CultNetRudpSessionOptions::default()
+    });
+    let connect = sender.create_connect(0, Vec::new())?;
+    let accept = receiver.accept_connect(&connect, 1, Vec::new())?;
+    sender.receive(&accept, 2)?;
+
+    let options = CultNetRudpSendOptions {
+        reliable: true,
+        ..CultNetRudpSendOptions::default()
+    };
+    let first = sender.send("schema", b"before".to_vec(), options.clone())?;
+    assert_eq!(receiver.receive(&first, 3)?.delivered.len(), 1);
+    sender.receive(&receiver.create_ack_for(first.sequence), 3)?;
+
+    // A forged packet far past the current highest. Recording it would push the
+    // receive state beyond every sequence still in flight.
+    let forged = CultNetRudpPacket {
+        packet_type: CultNetRudpPacketType::Data,
+        connection_id: 404,
+        sequence: first.sequence.saturating_add(500_000),
+        ack: 0,
+        ack_mask: 0,
+        channel_id: "schema".to_string(),
+        reliable: true,
+        ordered: false,
+        sequenced: false,
+        fragment_id: 0,
+        fragment_index: 0,
+        fragment_count: 0,
+        payload: b"hostile".to_vec(),
+    };
+    assert!(receiver.receive(&forged, 4)?.delivered.is_empty());
+
+    // The session must still accept the next legitimate packet.
+    let second = sender.send("schema", b"after".to_vec(), options)?;
+    assert_eq!(
+        receiver.receive(&second, 5)?.delivered[0].payload,
+        b"after".to_vec()
+    );
+    Ok(())
+}
+
+#[test]
+fn rudp_reliable_sequence_exhaustion_is_reported_not_fatal() -> Result<()> {
+    let mut sender = CultNetRudpSession::new(CultNetRudpSessionOptions {
+        connection_id: 405,
+        // One sequence left: the handshake takes it, so the next send is the
+        // first allocation with nowhere to go.
+        initial_sequence: u32::MAX - 1,
+        ..CultNetRudpSessionOptions::default()
+    });
+    let mut receiver = CultNetRudpSession::new(CultNetRudpSessionOptions {
+        connection_id: 405,
+        initial_sequence: 100,
+        ..CultNetRudpSessionOptions::default()
+    });
+    let connect = sender.create_connect(0, Vec::new())?;
+    let accept = receiver.accept_connect(&connect, 1, Vec::new())?;
+    sender.receive(&accept, 2)?;
+
+    let error = sender
+        .send(
+            "schema",
+            b"one past the end".to_vec(),
+            CultNetRudpSendOptions {
+                reliable: true,
+                ..CultNetRudpSendOptions::default()
+            },
+        )
+        .unwrap_err();
+    assert!(
+        error.to_string().contains("sequence space is exhausted"),
+        "unexpected error: {error}"
+    );
+    Ok(())
+}
+
+#[test]
+fn tcp_framed_receive_refuses_a_length_beyond_the_advertised_maximum() -> Result<()> {
+    let profile = create_tcp_framed_transport_profile(
+        "rust-transport",
+        TcpFramedTransportProfileOptions {
+            transport_id: Some("bounded-tcp".to_string()),
+            max_payload_bytes: Some(64),
+            ..TcpFramedTransportProfileOptions::default()
+        },
+    );
+    let advertised = profile
+        .transports
+        .iter()
+        .find(|transport| transport.protocol == CultNetTransportProtocol::TcpFramed)
+        .and_then(|transport| {
+            transport
+                .channels
+                .iter()
+                .find(|channel| channel.channel_id == "schema")
+        })
+        .and_then(|channel| channel.max_payload_bytes)
+        .expect("tcp_framed schema channel advertises a maximum payload");
+
+    // Only a header, declaring more than the profile allows. Honouring it would
+    // reserve the peer's number before a single payload byte arrives.
+    let mut header = ((advertised as u64 + 1) as u32).to_be_bytes().to_vec();
+    header.extend_from_slice(b"short");
+    let mut receiver = TcpFramedTransportConnection::new(std::io::Cursor::new(header), profile);
+    let error = receiver.receive().unwrap_err();
+    assert!(
+        error.to_string().contains("exceeds advertised maximum"),
+        "unexpected error: {error}"
+    );
+    Ok(())
+}
+
+#[test]
+fn rudp_reliable_expiry_drops_late_packets_and_leaves_durable_sends_alone() -> Result<()> {
+    let mut sender = CultNetRudpSession::new(CultNetRudpSessionOptions {
+        connection_id: 7,
+        initial_sequence: 10,
+        resend_delay_ms: 100,
+        ..CultNetRudpSessionOptions::default()
+    });
+    accept_rudp_session(&mut sender, 7)?;
+
+    let expiring = sender.send(
+        "media",
+        b"late".to_vec(),
+        CultNetRudpSendOptions {
+            reliable: true,
+            now_ms: 0,
+            reliable_expire_after_ms: Some(50),
+            ..CultNetRudpSendOptions::default()
+        },
+    )?;
+    let durable = sender.send(
+        "schema",
+        b"state".to_vec(),
+        CultNetRudpSendOptions {
+            reliable: true,
+            now_ms: 0,
+            ..CultNetRudpSendOptions::default()
+        },
+    )?;
+    assert_eq!(sender.pending_reliable_sequences().len(), 2);
+    assert_eq!(sender.reliable_packets_expired(), 0);
+
+    // One millisecond before the deadline nothing is dropped: the boundary is
+    // inclusive, so a packet is never discarded early.
+    sender.send(
+        "schema",
+        b"tick".to_vec(),
+        CultNetRudpSendOptions {
+            reliable: false,
+            now_ms: 50,
+            ..CultNetRudpSendOptions::default()
+        },
+    )?;
+    assert_eq!(sender.reliable_packets_expired(), 0);
+
+    sender.send(
+        "schema",
+        b"tick".to_vec(),
+        CultNetRudpSendOptions {
+            reliable: false,
+            now_ms: 51,
+            ..CultNetRudpSendOptions::default()
+        },
+    )?;
+    assert_eq!(sender.reliable_packets_expired(), 1);
+    assert_eq!(
+        sender.pending_reliable_sequences(),
+        vec![durable.sequence],
+        "a send without an expiry deadline is never dropped"
+    );
+    assert_ne!(expiring.sequence, durable.sequence);
+    Ok(())
+}
+
+#[test]
+fn rudp_reliable_expiry_also_reclaims_the_send_backlog() -> Result<()> {
+    let mut sender = CultNetRudpSession::new(CultNetRudpSessionOptions {
+        connection_id: 9,
+        initial_sequence: 10,
+        resend_delay_ms: 100,
+        ..CultNetRudpSessionOptions::default()
+    });
+    accept_rudp_session(&mut sender, 9)?;
+
+    let fragment_count = CULTNET_RUDP_RELIABLE_SEND_WINDOW_PACKETS + 5;
+    let payload = (0..fragment_count * 8)
+        .map(|index| (index % 251) as u8)
+        .collect::<Vec<_>>();
+    sender.send_many(
+        "media",
+        payload,
+        CultNetRudpSendOptions {
+            reliable: true,
+            now_ms: 0,
+            reliable_expire_after_ms: Some(30),
+            ..CultNetRudpSendOptions::default()
+        },
+        Some(8),
+    )?;
+    assert_eq!(
+        sender.pending_reliable_sequences().len(),
+        CULTNET_RUDP_RELIABLE_SEND_WINDOW_PACKETS
+    );
+    assert_eq!(sender.queued_reliable_packet_count(), 5);
+
+    // The deadline is fixed at admission, so waiting in the backlog spends it
+    // exactly as waiting for an acknowledgement does. A queued packet promoted
+    // after its moment has passed would be as useless as a retransmitted one.
+    sender.send(
+        "schema",
+        b"tick".to_vec(),
+        CultNetRudpSendOptions {
+            reliable: false,
+            now_ms: 31,
+            ..CultNetRudpSendOptions::default()
+        },
+    )?;
+    assert_eq!(sender.pending_reliable_sequences().len(), 0);
+    assert_eq!(sender.queued_reliable_packet_count(), 0);
+    assert_eq!(
+        sender.reliable_packets_expired(),
+        fragment_count as u64,
+        "both the in-flight window and the backlog are counted"
+    );
+    Ok(())
+}
+
+fn accept_rudp_session(session: &mut CultNetRudpSession, connection_id: u32) -> Result<()> {
+    session.receive(
+        &CultNetRudpPacket {
+            packet_type: CultNetRudpPacketType::Accept,
+            connection_id,
+            sequence: 0,
+            ack: 0,
+            ack_mask: 0,
+            channel_id: "control".into(),
+            reliable: false,
+            ordered: false,
+            sequenced: false,
+            fragment_id: 0,
+            fragment_index: 0,
+            fragment_count: 0,
+            payload: Vec::new(),
+        },
+        0,
+    )?;
+    Ok(())
+}
+
+#[test]
+fn rudp_profile_expires_only_the_media_channels() -> Result<()> {
+    let socket = std::net::UdpSocket::bind("127.0.0.1:0")?;
+    let peer = socket.local_addr()?;
+    let options = CultNetRudpSocketTransportOptions::client("expiry-profile", socket, peer, 11);
+    let connection = CultNetRudpSocketTransportConnection::new(options)?;
+
+    let channels = connection
+        .profile
+        .transports
+        .iter()
+        .flat_map(|transport| transport.channels.iter())
+        .map(|channel| (channel.channel_id.as_str(), channel.reliable_expire_after_ms))
+        .collect::<Vec<_>>();
+
+    for media_channel in ["media", "audio"] {
+        assert!(
+            channels.contains(&(media_channel, Some(75))),
+            "the {media_channel} channel advertises its expiry so a peer can see it: {channels:?}"
+        );
+    }
+    for (channel_id, expiry) in &channels {
+        if !matches!(*channel_id, "media" | "audio") {
+            assert_eq!(
+                *expiry, None,
+                "state channel {channel_id} must never expire a reliable send"
+            );
+        }
+    }
+    Ok(())
+}
+
+fn connected_rudp_pair() -> Result<(CultNetRudpSession, CultNetRudpSession)> {
+    let mut client = CultNetRudpSession::new(CultNetRudpSessionOptions {
+        connection_id: 311,
+        initial_sequence: 1,
+        ..CultNetRudpSessionOptions::default()
+    });
+    let mut server = CultNetRudpSession::new(CultNetRudpSessionOptions {
+        connection_id: 311,
+        initial_sequence: 100,
+        ..CultNetRudpSessionOptions::default()
+    });
+    let connect = client.create_connect(0, Vec::new())?;
+    let accept = server.accept_connect(&connect, 1, Vec::new())?;
+    client.receive(&accept, 2)?;
+    Ok((client, server))
+}
+
+#[test]
+fn rudp_evicts_stalest_incomplete_fragment_set_instead_of_dying() -> Result<()> {
+    let (mut client, mut server) = connected_rudp_pair()?;
+    client.set_max_pending_fragment_sets(4)?;
+    let fragmented = |server: &mut CultNetRudpSession, fill: u8| {
+        server.send_many(
+            "media",
+            vec![fill; 2500],
+            CultNetRudpSendOptions::default(),
+            Some(1000),
+        )
+    };
+
+    // Eight payloads each lose their last fragment on the wire. Before, the
+    // fifth new set errored the receiver out and every later fragmented
+    // payload with it.
+    let mut stranded = Vec::new();
+    for fill in 1..=8u8 {
+        let packets = fragmented(&mut server, fill)?;
+        assert_eq!(packets.len(), 3);
+        for packet in &packets[..2] {
+            assert!(client.receive(packet, 10)?.delivered.is_empty());
+        }
+        stranded.push(packets[2].clone());
+    }
+    assert_eq!(client.fragment_sets_evicted(), 4);
+
+    // A complete payload still lands.
+    let complete = fragmented(&mut server, 9)?;
+    let mut delivered = Vec::new();
+    for packet in &complete {
+        delivered.extend(client.receive(packet, 11)?.delivered);
+    }
+    assert_eq!(delivered.len(), 1);
+    assert_eq!(delivered[0].payload, vec![9u8; 2500]);
+    assert_eq!(client.fragment_sets_evicted(), 5);
+
+    // The eviction order is stalest-first: set 8 is still pending and completes
+    // when its late fragment shows up; set 1 was evicted long ago, so its late
+    // fragment opens a fresh set and delivers nothing.
+    assert_eq!(
+        client.receive(&stranded[7], 12)?.delivered[0].payload,
+        vec![8u8; 2500]
+    );
+    assert!(client.receive(&stranded[0], 13)?.delivered.is_empty());
+    Ok(())
+}
+
+#[test]
+fn rudp_fragment_ids_wrap_instead_of_saturating() -> Result<()> {
+    let (_client, mut server) = connected_rudp_pair()?;
+    let mut ids = Vec::new();
+    for _ in 0..(u16::MAX as usize + 1) {
+        let packets = server.send_many(
+            "media",
+            vec![0u8; 1500],
+            CultNetRudpSendOptions::default(),
+            Some(1000),
+        )?;
+        ids.push(packets[0].fragment_id);
+    }
+    assert_eq!(ids[0], 1);
+    assert_eq!(ids[u16::MAX as usize - 1], u16::MAX);
+    // The 65,536th set must not share an id with the 65,535th.
+    assert_eq!(ids[u16::MAX as usize], 1);
+    Ok(())
+}
diff --git a/packages/cultnet-rs/tests/media_channel_delivery.rs b/packages/cultnet-rs/tests/media_channel_delivery.rs
new file mode 100644
index 00000000..499be0d3
--- /dev/null
+++ b/packages/cultnet-rs/tests/media_channel_delivery.rs
@@ -0,0 +1,92 @@
+//! Media delivery is the caller's choice, and the advertised profile is where
+//! that choice lives.
+//!
+//! Before this, `media` was hardcoded `Reliable` in two places — the profile
+//! builder and the per-channel send options — so no caller could say otherwise.
+//! A producer asking for an unreliable media lane got a reliable one that
+//! retransmits under loss, which adds load exactly when the link has least to
+//! give. Muninn asked for that lane by passing no expiry, meaning "unreliable,
+//! so expiry is moot", and got reliable-with-no-expiry instead: retransmit
+//! forever.
+//!
+//! The default stays `Reliable` so every existing consumer is untouched.
+
+use std::net::UdpSocket;
+
+use cultnet_rs::{
+    CultNetRudpSocketTransportConnection, CultNetRudpSocketTransportOptions,
+    CultNetTransportDelivery,
+};
+
+fn media_channel_delivery(
+    media_delivery: Option<CultNetTransportDelivery>,
+) -> (CultNetTransportDelivery, Option<u64>) {
+    let socket = UdpSocket::bind("127.0.0.1:0").expect("binds");
+    let endpoint = "127.0.0.1:5204".parse().expect("parses");
+    let mut options = CultNetRudpSocketTransportOptions::client("test-media", socket, endpoint, 7);
+    options.media_delivery = media_delivery;
+    options.media_reliable_expire_after_ms = None;
+
+    let transport = CultNetRudpSocketTransportConnection::new(options).expect("opens");
+    let channel = transport
+        .profile
+        .transports
+        .first()
+        .expect("a transport")
+        .channels
+        .iter()
+        .find(|channel| channel.channel_id == "media")
+        .expect("a media channel");
+    (channel.delivery, channel.reliable_expire_after_ms)
+}
+
+#[test]
+fn media_defaults_to_reliable_so_existing_consumers_do_not_move() {
+    let (delivery, _) = media_channel_delivery(None);
+    assert_eq!(delivery, CultNetTransportDelivery::Reliable);
+}
+
+#[test]
+fn a_caller_can_ask_for_an_unreliable_media_lane() {
+    let (delivery, expiry) = media_channel_delivery(Some(CultNetTransportDelivery::Unreliable));
+    assert_eq!(delivery, CultNetTransportDelivery::Unreliable);
+    assert_eq!(
+        expiry, None,
+        "an unreliable channel has nothing to expire; the pairing should stay honest"
+    );
+}
+
+#[test]
+fn asking_for_reliable_explicitly_matches_the_default() {
+    let (explicit, _) = media_channel_delivery(Some(CultNetTransportDelivery::Reliable));
+    let (defaulted, _) = media_channel_delivery(None);
+    assert_eq!(explicit, defaulted);
+}
+
+/// The channels whose semantics are fixed by design must not drift with this.
+#[test]
+fn the_other_channels_keep_their_fixed_delivery() {
+    let socket = UdpSocket::bind("127.0.0.1:0").expect("binds");
+    let endpoint = "127.0.0.1:5204".parse().expect("parses");
+    let mut options = CultNetRudpSocketTransportOptions::client("test-media", socket, endpoint, 8);
+    options.media_delivery = Some(CultNetTransportDelivery::Unreliable);
+
+    let transport = CultNetRudpSocketTransportConnection::new(options).expect("opens");
+    let channels = &transport
+        .profile
+        .transports
+        .first()
+        .expect("a transport")
+        .channels;
+
+    let delivery_of = |id: &str| {
+        channels
+            .iter()
+            .find(|channel| channel.channel_id == id)
+            .unwrap_or_else(|| panic!("channel {id}"))
+            .delivery
+    };
+
+    assert_eq!(delivery_of("schema"), CultNetTransportDelivery::Reliable);
+    assert_eq!(delivery_of("realtime"), CultNetTransportDelivery::Unreliable);
+}
diff --git a/packages/cultnet-rs/tests/media_stream_contracts.rs b/packages/cultnet-rs/tests/media_stream_contracts.rs
new file mode 100644
index 00000000..963d78a2
--- /dev/null
+++ b/packages/cultnet-rs/tests/media_stream_contracts.rs
@@ -0,0 +1,217 @@
+//! The CultMesh Media Stream records are a wire contract shared by producers and
+//! consumers that never link each other. These tests pin the properties a
+//! consumer is entitled to rely on: positional layout, declared field order, and
+//! tolerance of records written before an appended field existed.
+
+use cultcache_rs::DatabaseEntry;
+use cultnet_rs::{
+    GAMECULT_MEDIA_AUDIO_PACKET_SCHEMA, GAMECULT_MEDIA_RECEIVER_FEEDBACK_SCHEMA,
+    GAMECULT_MEDIA_VIDEO_ACCESS_UNIT_SCHEMA, GAMECULT_MEDIA_VIDEO_PARITY_SHARD_SCHEMA,
+    GameCultMediaAudioPacketRecord, GameCultMediaReceiverFeedbackRecord,
+    GameCultMediaVideoAccessUnitRecord, GameCultMediaVideoParityShardRecord,
+};
+use rmpv::Value;
+
+fn access_unit() -> GameCultMediaVideoAccessUnitRecord {
+    GameCultMediaVideoAccessUnitRecord {
+        stream_id: "raven-primary-av".to_string(),
+        session_id: "session-1".to_string(),
+        frame_id: 4242,
+        codec: "h264".to_string(),
+        pts_ticks: 90_000,
+        duration_ticks: 3_000,
+        timebase_num: 1,
+        timebase_den: 90_000,
+        keyframe: true,
+        dependency_frame_id: None,
+        deadline_ticks: 108_000,
+        chunk_index: 2,
+        chunk_count: 5,
+        payload: vec![0xDE, 0xAD, 0xBE, 0xEF],
+    }
+}
+
+fn audio_packet() -> GameCultMediaAudioPacketRecord {
+    GameCultMediaAudioPacketRecord {
+        stream_id: "raven-primary-av".to_string(),
+        session_id: "session-1".to_string(),
+        packet_id: 77,
+        codec: "opus".to_string(),
+        pts_ticks: 48_000,
+        duration_ticks: 960,
+        timebase_num: 1,
+        timebase_den: 48_000,
+        deadline_ticks: 96_000,
+        payload: vec![1, 2, 3],
+    }
+}
+
+fn decode_as_value(bytes: &[u8]) -> Value {
+    rmp_serde::from_slice(bytes).expect("records decode as generic MessagePack")
+}
+
+/// The declared `key` indices are the wire layout, not documentation. A consumer
+/// in another language reads position 2 for `frame_id` and position 13 for
+/// `payload`; reordering the struct would silently break it.
+#[test]
+fn video_access_unit_encodes_as_a_positional_array() {
+    let encoded = rmp_serde::to_vec(&access_unit()).expect("encodes");
+    let Value::Array(slots) = decode_as_value(&encoded) else {
+        panic!("access units must encode as a positional array");
+    };
+
+    assert_eq!(slots.len(), 14, "field count is wire contract");
+    assert_eq!(slots[0].as_str(), Some("raven-primary-av"));
+    assert_eq!(slots[2].as_u64(), Some(4242), "slot 2 is frame_id");
+    assert_eq!(slots[3].as_str(), Some("h264"));
+    assert_eq!(slots[8].as_bool(), Some(true), "slot 8 is keyframe");
+    assert!(slots[9].is_nil(), "an absent dependency stays nil, not 0");
+    assert_eq!(slots[12].as_u64(), Some(5), "slot 12 is chunk_count");
+    assert_eq!(
+        slots[13].as_slice(),
+        Some([0xDE, 0xAD, 0xBE, 0xEF].as_slice()),
+        "slot 13 is the payload, carried as bin"
+    );
+}
+
+/// Payloads must reach the wire as MessagePack `bin`, not as an array of
+/// integers. The C#, TypeScript and Python runtimes all read byte fields as
+/// `bin`, so a payload serialized as a sequence is unreadable by the reference
+/// implementation, and costs 1.45x besides: 848 bytes encode to 1234 as an
+/// integer array against 851 as `bin`.
+///
+/// This is what the derive's `bytes` attribute buys. `#[serde(with =
+/// "serde_bytes")]` will not do it — `DatabaseEntry` emits its own `Serialize`
+/// and reads only its own `cultcache` attribute namespace.
+#[test]
+fn payload_should_encode_as_messagepack_bin() {
+    let encoded = rmp_serde::to_vec(&access_unit()).expect("encodes");
+    let Value::Array(slots) = decode_as_value(&encoded) else {
+        panic!("access units must encode as a positional array");
+    };
+
+    assert_eq!(
+        slots[13].as_slice(),
+        Some([0xDE, 0xAD, 0xBE, 0xEF].as_slice()),
+        "payloads belong on the wire as bin, not as an array of integers"
+    );
+}
+
+#[test]
+fn audio_packets_are_whole_and_carry_their_own_timebase() {
+    let encoded = rmp_serde::to_vec(&audio_packet()).expect("encodes");
+    let Value::Array(slots) = decode_as_value(&encoded) else {
+        panic!("audio packets must encode as a positional array");
+    };
+
+    assert_eq!(slots.len(), 10, "field count is wire contract");
+    assert_eq!(slots[2].as_u64(), Some(77), "slot 2 is packet_id");
+    assert_eq!(slots[6].as_u64(), Some(1), "slot 6 is timebase_num");
+    assert_eq!(slots[7].as_u64(), Some(48_000), "slot 7 is timebase_den");
+
+    let decoded: GameCultMediaAudioPacketRecord =
+        rmp_serde::from_slice(&encoded).expect("round-trips");
+    assert_eq!(decoded, audio_packet());
+}
+
+#[test]
+fn parity_shards_carry_the_geometry_recovery_needs() {
+    let shard = GameCultMediaVideoParityShardRecord {
+        stream_id: "raven-primary-av".to_string(),
+        session_id: "session-1".to_string(),
+        frame_id: 4242,
+        codec: "h264".to_string(),
+        pts_ticks: 90_000,
+        duration_ticks: 3_000,
+        timebase_num: 1,
+        timebase_den: 90_000,
+        keyframe: false,
+        dependency_frame_id: Some(4241),
+        deadline_ticks: 108_000,
+        chunk_count: 5,
+        parity_index: 1,
+        parity_count: 2,
+        chunk_payload_bytes: 1024,
+        last_chunk_payload_bytes: 512,
+        payload: vec![9, 9, 9],
+    };
+
+    let encoded = rmp_serde::to_vec(&shard).expect("encodes");
+    let Value::Array(slots) = decode_as_value(&encoded) else {
+        panic!("parity shards must encode as a positional array");
+    };
+
+    assert_eq!(slots.len(), 17, "field count is wire contract");
+    assert_eq!(slots[12].as_u64(), Some(1), "slot 12 is parity_index");
+    assert_eq!(slots[13].as_u64(), Some(2), "slot 13 is parity_count");
+    assert_eq!(
+        slots[15].as_u64(),
+        Some(512),
+        "slot 15 is last_chunk_payload_bytes, which recovery needs to size the tail"
+    );
+
+    let decoded: GameCultMediaVideoParityShardRecord =
+        rmp_serde::from_slice(&encoded).expect("round-trips");
+    assert_eq!(decoded, shard);
+}
+
+/// `missing_video_chunk_keys` was appended after producers were already writing
+/// feedback. A record written without it must still decode, or the append was a
+/// breaking change wearing a `default` attribute.
+#[test]
+fn receiver_feedback_decodes_records_written_before_its_last_field() {
+    let without_appended_field = Value::Array(vec![
+        Value::from("raven-primary-av"),
+        Value::from("session-1"),
+        Value::from("starfire-obs"),
+        Value::from(4200u64),
+        Value::Array(vec![Value::from(4198u64)]),
+        Value::Array(vec![Value::from(4199u64)]),
+        Value::from(true),
+        Value::from(1_500i64),
+        Value::from(9_000i64),
+        Value::from("2026-09-09T00:00:00Z"),
+    ]);
+
+    let mut bytes = Vec::new();
+    rmpv::encode::write_value(&mut bytes, &without_appended_field).expect("writes legacy record");
+
+    let decoded: GameCultMediaReceiverFeedbackRecord =
+        rmp_serde::from_slice(&bytes).expect("a pre-append record must still decode");
+
+    assert_eq!(decoded.receiver_id, "starfire-obs");
+    assert_eq!(decoded.highest_decodable_frame_id, Some(4200));
+    assert!(decoded.requested_keyframe);
+    assert!(
+        decoded.missing_video_chunk_keys.is_empty(),
+        "the appended field defaults rather than failing the decode"
+    );
+}
+
+/// The published constants and the derived type identity must not drift apart;
+/// a consumer resolving by schema id and a producer registering by type would
+/// then disagree without either failing to compile.
+#[test]
+fn published_schema_constants_match_the_derived_identity() {
+    assert_eq!(
+        GameCultMediaVideoAccessUnitRecord::SCHEMA_NAME,
+        GAMECULT_MEDIA_VIDEO_ACCESS_UNIT_SCHEMA
+    );
+    assert_eq!(
+        GameCultMediaVideoParityShardRecord::SCHEMA_NAME,
+        GAMECULT_MEDIA_VIDEO_PARITY_SHARD_SCHEMA
+    );
+    assert_eq!(
+        GameCultMediaAudioPacketRecord::SCHEMA_NAME,
+        GAMECULT_MEDIA_AUDIO_PACKET_SCHEMA
+    );
+    assert_eq!(
+        GameCultMediaReceiverFeedbackRecord::SCHEMA_NAME,
+        GAMECULT_MEDIA_RECEIVER_FEEDBACK_SCHEMA
+    );
+
+    assert_eq!(
+        GameCultMediaAudioPacketRecord::TYPE,
+        "gamecult.media_audio_packet"
+    );
+}
diff --git a/packages/cultnet-rs/tests/media_stream_wire.rs b/packages/cultnet-rs/tests/media_stream_wire.rs
new file mode 100644
index 00000000..cee31a04
--- /dev/null
+++ b/packages/cultnet-rs/tests/media_stream_wire.rs
@@ -0,0 +1,217 @@
+//! The envelope, and one proof that removing Muninn's shadow structs changed
+//! nothing on the wire.
+
+use cultnet_rs::{
+    GAMECULT_MEDIA_CHANNEL, GameCultMediaAudioPacketRecord, GameCultMediaReceiverFeedbackRecord,
+    GameCultMediaVideoAccessUnitRecord, GameCultMediaVideoParityShardRecord,
+    GameCultMediaWireRecord, MediaWireProvenance, decode_media_wire_record,
+    encode_media_wire_record,
+};
+use serde::Serialize;
+
+fn provenance() -> MediaWireProvenance<'static> {
+    MediaWireProvenance {
+        stored_at: "unix:1000",
+        runtime_id: "raven",
+        role: "muninn.media",
+        producer: "muninn",
+    }
+}
+
+fn access_unit() -> GameCultMediaVideoAccessUnitRecord {
+    GameCultMediaVideoAccessUnitRecord {
+        stream_id: "raven-primary-av".to_string(),
+        session_id: "session-1".to_string(),
+        frame_id: 4242,
+        codec: "h264".to_string(),
+        pts_ticks: 90_000,
+        duration_ticks: 3_000,
+        timebase_num: 1,
+        timebase_den: 90_000,
+        keyframe: true,
+        dependency_frame_id: None,
+        deadline_ticks: 108_000,
+        chunk_index: 2,
+        chunk_count: 5,
+        payload: (0u8..=255).collect(),
+    }
+}
+
+/// Muninn's `VideoAccessUnitWirePayload`, reproduced exactly as it was.
+///
+/// It existed only so `#[serde(with = "serde_bytes")]` could reach the payload,
+/// because the `DatabaseEntry` derive ignores serde attributes. Every other
+/// field was restated by hand, in order, and had to stay in step with the record
+/// by discipline alone.
+#[derive(Serialize)]
+struct LegacyVideoAccessUnitWirePayload<'a>(
+    &'a str,
+    &'a str,
+    u64,
+    &'a str,
+    i64,
+    u32,
+    u32,
+    u32,
+    bool,
+    Option<u64>,
+    i64,
+    u16,
+    u16,
+    #[serde(with = "serde_bytes")] &'a [u8],
+);
+
+/// If these differ, deleting the shadow structs was a wire break rather than a
+/// simplification, and every existing consumer would need to move in step.
+#[test]
+fn the_derive_reproduces_the_hand_written_wire_payload_byte_for_byte() {
+    let record = access_unit();
+    let legacy = LegacyVideoAccessUnitWirePayload(
+        &record.stream_id,
+        &record.session_id,
+        record.frame_id,
+        &record.codec,
+        record.pts_ticks,
+        record.duration_ticks,
+        record.timebase_num,
+        record.timebase_den,
+        record.keyframe,
+        record.dependency_frame_id,
+        record.deadline_ticks,
+        record.chunk_index,
+        record.chunk_count,
+        &record.payload,
+    );
+
+    let from_derive = rmp_serde::to_vec(&record).expect("record encodes");
+    let from_shadow = rmp_serde::to_vec(&legacy).expect("shadow struct encodes");
+
+    assert_eq!(
+        from_derive, from_shadow,
+        "the `bytes` attribute must reproduce what serde_bytes produced by hand"
+    );
+}
+
+#[test]
+fn a_video_record_round_trips_through_the_envelope() {
+    let record = GameCultMediaWireRecord::Video(access_unit());
+    let wire = encode_media_wire_record(&record, provenance()).expect("encodes");
+    assert_eq!(decode_media_wire_record(&wire).expect("decodes"), record);
+}
+
+#[test]
+fn every_variant_round_trips() {
+    let variants = vec![
+        GameCultMediaWireRecord::Video(access_unit()),
+        GameCultMediaWireRecord::VideoParity(GameCultMediaVideoParityShardRecord {
+            stream_id: "s".to_string(),
+            session_id: "x".to_string(),
+            frame_id: 1,
+            codec: "h264".to_string(),
+            pts_ticks: 0,
+            duration_ticks: 1,
+            timebase_num: 1,
+            timebase_den: 90_000,
+            keyframe: false,
+            dependency_frame_id: Some(0),
+            deadline_ticks: 1,
+            chunk_count: 4,
+            parity_index: 1,
+            parity_count: 2,
+            chunk_payload_bytes: 848,
+            last_chunk_payload_bytes: 400,
+            payload: vec![1, 2, 3],
+        }),
+        GameCultMediaWireRecord::Audio(GameCultMediaAudioPacketRecord {
+            stream_id: "s".to_string(),
+            session_id: "x".to_string(),
+            packet_id: 9,
+            codec: "opus".to_string(),
+            pts_ticks: 0,
+            duration_ticks: 960,
+            timebase_num: 1,
+            timebase_den: 48_000,
+            deadline_ticks: 1,
+            payload: vec![4, 5, 6],
+        }),
+        GameCultMediaWireRecord::Feedback(GameCultMediaReceiverFeedbackRecord {
+            stream_id: "s".to_string(),
+            session_id: "x".to_string(),
+            receiver_id: "starfire-obs".to_string(),
+            highest_decodable_frame_id: Some(41),
+            missing_frame_ids: vec![42],
+            late_frame_ids: vec![43],
+            requested_keyframe: true,
+            jitter_us: 500,
+            decode_queue_us: 2_000,
+            observed_at: "unix:1000".to_string(),
+            missing_video_chunk_keys: vec!["42:1".to_string()],
+        }),
+    ];
+
+    for record in variants {
+        let wire = encode_media_wire_record(&record, provenance()).expect("encodes");
+        assert_eq!(
+            decode_media_wire_record(&wire).expect("decodes"),
+            record,
+            "variant {} did not survive the envelope",
+            record.schema_id()
+        );
+    }
+}
+
+/// Record keys address one piece of media within a session. A consumer parses
+/// them, so their shape is contract.
+#[test]
+fn record_keys_distinguish_chunks_parity_and_senders() {
+    let mut second_chunk = access_unit();
+    second_chunk.chunk_index = 3;
+
+    let first = GameCultMediaWireRecord::Video(access_unit()).record_key();
+    let second = GameCultMediaWireRecord::Video(second_chunk).record_key();
+    assert_ne!(first, second, "chunks of one frame must not share a key");
+    assert!(first.contains(":video:"), "got {first}");
+}
+
+/// A shared envelope must not label another producer's traffic as Muninn's.
+#[test]
+fn the_producer_namespace_is_the_callers_not_the_envelopes() {
+    let record = GameCultMediaWireRecord::Video(access_unit());
+    let theirs = MediaWireProvenance {
+        stored_at: "unix:1000",
+        runtime_id: "nightwing",
+        role: "brokkr.media",
+        producer: "brokkr",
+    };
+
+    let wire = encode_media_wire_record(&record, theirs).expect("encodes");
+    let text = String::from_utf8_lossy(&wire);
+    assert!(text.contains("brokkr-media:"), "message id names the producer");
+    assert!(text.contains("brokkr.media"), "tag names the producer");
+    assert!(
+        !text.contains("muninn"),
+        "the envelope must not name a producer the caller did not supply"
+    );
+}
+
+#[test]
+fn provenance_must_be_complete() {
+    let record = GameCultMediaWireRecord::Video(access_unit());
+    for blank in ["stored_at", "runtime_id", "role", "producer"] {
+        let mut incomplete = provenance();
+        match blank {
+            "stored_at" => incomplete.stored_at = "",
+            "runtime_id" => incomplete.runtime_id = "",
+            "role" => incomplete.role = "",
+            _ => incomplete.producer = "",
+        }
+        let error = encode_media_wire_record(&record, incomplete)
+            .expect_err("empty provenance must be refused");
+        assert!(error.to_string().contains(blank), "got {error}");
+    }
+}
+
+#[test]
+fn the_media_channel_is_named_once() {
+    assert_eq!(GAMECULT_MEDIA_CHANNEL, "media");
+}
diff --git a/packages/cultnet-rs/tests/provider_session.rs b/packages/cultnet-rs/tests/provider_session.rs
new file mode 100644
index 00000000..4ad7c23a
--- /dev/null
+++ b/packages/cultnet-rs/tests/provider_session.rs
@@ -0,0 +1,365 @@
+use anyhow::Result;
+use cultnet_rs::*;
+
+const REGISTRATION_GOLDEN: &str = "hqpwcm92aWRlcklkqGFldGhlcmlhsXNlcnZpY2VJbnN0YW5jZUlkq2FldGhlcmlhLTQyqmVuZHBvaW50SWSvYWV0aGVyaWEtcHVibGljp3ZlcnNlSWSmcHVibGljuHJlcXVlc3RlZExlYXNlRHVyYXRpb25Nc811MLBhdXRob3JpdHlMZWFzZUlkq2F1dGhvcml0eS03";
+const CONNECT_EVIDENCE_GOLDEN: &str =
+    "gq9jbGllbnRTZXNzaW9uSWSyYWV0aGVyaWEtY2xpZW50LTQyrHNlc3Npb25Ub2tlbrJvZGluLXNlc3Npb24tdG9rZW4=";
+const TOKENLESS_CONNECT_EVIDENCE_GOLDEN: &str =
+    "gq9jbGllbnRTZXNzaW9uSWSwYW5vbnltb3VzLWNsaWVudKxzZXNzaW9uVG9rZW7A";
+
+fn registration() -> CultMeshProviderRegistrationWire {
+    CultMeshProviderRegistrationWire {
+        provider_id: "aetheria".to_string(),
+        service_instance_id: "aetheria-42".to_string(),
+        endpoint_id: "aetheria-public".to_string(),
+        verse_id: "public".to_string(),
+        requested_lease_duration_ms: 30_000,
+        authority_lease_id: Some("authority-7".to_string()),
+    }
+}
+
+#[test]
+fn registration_matches_csharp_and_typescript_golden_payload() -> Result<()> {
+    let encoded = encode_provider_session_payload(&registration())?;
+    assert_eq!(encoded, REGISTRATION_GOLDEN);
+    assert_eq!(
+        decode_provider_session_payload::<CultMeshProviderRegistrationWire>(&encoded)?,
+        registration()
+    );
+    Ok(())
+}
+
+#[test]
+fn connect_evidence_is_a_validated_named_messagepack_map() -> Result<()> {
+    let evidence = CultMeshProviderConnectEvidenceWire {
+        client_session_id: "aetheria-client-42".to_string(),
+        session_token: Some("odin-session-token".to_string()),
+    };
+    let encoded = encode_provider_connect_evidence(&evidence)?;
+    assert_eq!(
+        base64::Engine::encode(&base64::engine::general_purpose::STANDARD, &encoded),
+        CONNECT_EVIDENCE_GOLDEN
+    );
+    assert_eq!(decode_provider_connect_evidence(&encoded)?, evidence);
+    let value: rmpv::Value = rmp_serde::from_slice(&encoded)?;
+    let map = value.as_map().expect("Connect evidence is a named map");
+    assert_eq!(
+        map.iter()
+            .find_map(|(key, value)| (key.as_str() == Some("clientSessionId")).then_some(value))
+            .and_then(rmpv::Value::as_str),
+        Some("aetheria-client-42")
+    );
+    assert_eq!(
+        map.iter()
+            .find_map(|(key, value)| (key.as_str() == Some("sessionToken")).then_some(value))
+            .and_then(rmpv::Value::as_str),
+        Some("odin-session-token")
+    );
+
+    assert!(
+        encode_provider_connect_evidence(&CultMeshProviderConnectEvidenceWire {
+            client_session_id: String::new(),
+            session_token: None,
+        })
+        .is_err()
+    );
+    assert!(
+        encode_provider_connect_evidence(&CultMeshProviderConnectEvidenceWire {
+            client_session_id: "client".to_string(),
+            session_token: Some(" ".to_string()),
+        })
+        .is_err()
+    );
+    assert!(decode_provider_connect_evidence(&[]).is_err());
+    let tokenless = CultMeshProviderConnectEvidenceWire {
+        client_session_id: "anonymous-client".to_string(),
+        session_token: None,
+    };
+    let tokenless_encoded = encode_provider_connect_evidence(&tokenless)?;
+    assert_eq!(
+        base64::Engine::encode(
+            &base64::engine::general_purpose::STANDARD,
+            &tokenless_encoded
+        ),
+        TOKENLESS_CONNECT_EVIDENCE_GOLDEN
+    );
+    assert_eq!(
+        decode_provider_connect_evidence(&tokenless_encoded)?,
+        tokenless
+    );
+    Ok(())
+}
+
+#[test]
+fn registration_round_trips_inside_canonical_operation_envelope() -> Result<()> {
+    let request = create_provider_session_request(
+        "register-1",
+        CULTMESH_PROVIDER_REGISTER_OPERATION,
+        CULTMESH_PROVIDER_REGISTRATION_SCHEMA,
+        &registration(),
+        Some("aetheria-42".to_string()),
+        Some("odin".to_string()),
+    )?;
+    let bytes = encode_cultnet_message_to_vec(&request, CultNetWireContract::CultNetSchemaV0)?;
+    let decoded_request =
+        decode_cultnet_message_from_slice(&bytes, CultNetWireContract::CultNetSchemaV0)?;
+    let decoded: CultMeshProviderRegistrationWire = decode_provider_session_request(
+        &decoded_request,
+        CULTMESH_PROVIDER_REGISTER_OPERATION,
+        CULTMESH_PROVIDER_REGISTRATION_SCHEMA,
+    )?;
+    assert_eq!(decoded, registration());
+
+    let lease = CultMeshProviderLeaseWire {
+        provider_id: "aetheria".to_string(),
+        service_instance_id: "aetheria-42".to_string(),
+        endpoint_id: "aetheria-public".to_string(),
+        verse_id: "public".to_string(),
+        lease_id: "lease-2".to_string(),
+        valid_from_utc: "2026-07-14T12:00:00Z".to_string(),
+        expires_at_utc: "2026-07-14T12:00:10Z".to_string(),
+    };
+    let response = create_provider_session_response(
+        &decoded_request,
+        CultMeshProviderOperationStatus::Ok,
+        CULTMESH_PROVIDER_LEASE_SCHEMA,
+        &lease,
+        Some("odin".to_string()),
+    )?;
+    let (status, decoded_lease) = decode_provider_session_response::<CultMeshProviderLeaseWire>(
+        &response,
+        CULTMESH_PROVIDER_REGISTER_OPERATION,
+        CULTMESH_PROVIDER_LEASE_SCHEMA,
+    )?;
+    assert_eq!(status, CultMeshProviderOperationStatus::Ok);
+    assert_eq!(decoded_lease, lease);
+    Ok(())
+}
+
+#[test]
+fn publication_and_command_preserve_typed_messagepack_values() -> Result<()> {
+    let publication = CultMeshProviderPublicationPutWire {
+        lease_id: "lease-1".to_string(),
+        publication_id: "surface:pilot".to_string(),
+        document: CultNetRawDocumentRecord {
+            schema_id: "gamecult.eve.surface.v1".to_string(),
+            record_key: "eve:surface:pilot".to_string(),
+            stored_at: String::new(),
+            payload_encoding: CultNetRawPayloadEncoding::Messagepack,
+            payload: vec![0x81, 0xa2, 0x69, 0x64, 0x01],
+            source_runtime_id: Some("aetheria-42".to_string()),
+            source_agent_id: None,
+            source_role: None,
+            tags: None,
+        },
+    };
+    let publication_encoded = encode_provider_session_payload(&publication)?;
+    assert_eq!(
+        decode_provider_session_payload::<CultMeshProviderPublicationPutWire>(
+            &publication_encoded
+        )?,
+        publication
+    );
+
+    let command = CultMeshProviderCommandWire {
+        command_id: "cmd-7".to_string(),
+        command_kind: "pilot.thrust".to_string(),
+        provider_id: "aetheria".to_string(),
+        service_instance_id: "aetheria-42".to_string(),
+        payload: rmpv::Value::Map(vec![(rmpv::Value::from("axis"), rmpv::Value::F64(0.75))]),
+    };
+    let command_bytes = base64::Engine::decode(
+        &base64::engine::general_purpose::STANDARD,
+        encode_provider_session_payload(&command)?,
+    )?;
+    let decoded_command = decode_provider_command_document(&CultNetRawDocumentRecord {
+        schema_id: CULTMESH_PROVIDER_COMMAND_SCHEMA.to_string(),
+        record_key: "provider-command:aetheria:aetheria-42:cmd-7".to_string(),
+        stored_at: String::new(),
+        payload_encoding: CultNetRawPayloadEncoding::Messagepack,
+        payload: command_bytes,
+        source_runtime_id: Some("odin".to_string()),
+        source_agent_id: None,
+        source_role: Some("provider-session-broker".to_string()),
+        tags: None,
+    })?;
+    assert_eq!(decoded_command, command);
+    Ok(())
+}
+
+#[test]
+fn lifecycle_validation_rejects_split_or_malformed_authority() {
+    let mismatched = create_provider_session_request(
+        "bad-schema",
+        CULTMESH_PROVIDER_REGISTER_OPERATION,
+        CULTMESH_PROVIDER_PUBLICATION_PUT_SCHEMA,
+        &registration(),
+        None,
+        None,
+    );
+    assert!(mismatched.is_err());
+
+    let malformed_lease = CultMeshProviderLeaseWire {
+        provider_id: "provider".to_string(),
+        service_instance_id: "instance".to_string(),
+        endpoint_id: "endpoint".to_string(),
+        verse_id: "verse".to_string(),
+        lease_id: "lease".to_string(),
+        valid_from_utc: "2026-07-14T12:00:10Z".to_string(),
+        expires_at_utc: "2026-07-14T12:00:00Z".to_string(),
+    };
+    assert!(encode_provider_session_payload(&malformed_lease).is_err());
+
+    let malformed_request = CultNetMessage::OperationRequest {
+        message_id: String::new(),
+        service_id: CULTMESH_PROVIDER_SESSION_SERVICE_ID.to_string(),
+        operation: String::new(),
+        payload_schema: CULTMESH_PROVIDER_REGISTRATION_SCHEMA.to_string(),
+        payload_encoding: CULTMESH_PROVIDER_SESSION_PAYLOAD_ENCODING.to_string(),
+        payload: REGISTRATION_GOLDEN.to_string(),
+        source_runtime_id: None,
+        target_runtime_id: None,
+    };
+    assert!(
+        create_provider_session_response(
+            &malformed_request,
+            CultMeshProviderOperationStatus::Invalid,
+            CULTMESH_PROVIDER_MUTATION_ACCEPTANCE_SCHEMA,
+            &CultMeshProviderMutationAcceptanceWire {
+                accepted_at_utc: "2026-07-14T12:00:00Z".to_string(),
+                lease_id: None,
+                publication_id: None,
+                command_id: None,
+                receipt_id: None,
+            },
+            None,
+        )
+        .is_err()
+    );
+}
+
+#[test]
+fn remaining_lifecycle_payloads_round_trip_as_named_maps() -> Result<()> {
+    let renewal = CultMeshProviderLeaseRenewalWire {
+        lease_id: "lease-1".to_string(),
+        requested_lease_duration_ms: 30_000,
+    };
+    assert_eq!(
+        decode_provider_session_payload::<CultMeshProviderLeaseRenewalWire>(
+            &encode_provider_session_payload(&renewal)?
+        )?,
+        renewal
+    );
+
+    let deletion = CultMeshProviderPublicationDeleteWire {
+        lease_id: "lease-1".to_string(),
+        publication_id: "surface:pilot".to_string(),
+        schema_id: "gamecult.eve.surface.v1".to_string(),
+        record_key: "eve:surface:pilot".to_string(),
+    };
+    assert_eq!(
+        decode_provider_session_payload::<CultMeshProviderPublicationDeleteWire>(
+            &encode_provider_session_payload(&deletion)?
+        )?,
+        deletion
+    );
+
+    let receipt = CultMeshProviderReceiptPutWire {
+        lease_id: "lease-1".to_string(),
+        receipt: CultMeshProviderCommandReceiptWire {
+            receipt_id: "receipt-7".to_string(),
+            command_id: "cmd-7".to_string(),
+            command_kind: "pilot.thrust".to_string(),
+            provider_id: "aetheria".to_string(),
+            service_instance_id: "aetheria-42".to_string(),
+            state: CultMeshProviderReceiptStateWire::Applied,
+            completed_at_utc: "2026-07-14T12:01:02.345Z".to_string(),
+            result: Some(rmpv::Value::Map(vec![(
+                rmpv::Value::from("accepted"),
+                rmpv::Value::Boolean(true),
+            )])),
+            error: None,
+        },
+    };
+    assert_eq!(
+        decode_provider_session_payload::<CultMeshProviderReceiptPutWire>(
+            &encode_provider_session_payload(&receipt)?
+        )?,
+        receipt
+    );
+
+    let withdrawal = CultMeshProviderWithdrawalWire {
+        lease_id: "lease-1".to_string(),
+    };
+    assert_eq!(
+        decode_provider_session_payload::<CultMeshProviderWithdrawalWire>(
+            &encode_provider_session_payload(&withdrawal)?
+        )?,
+        withdrawal
+    );
+
+    let acceptance = CultMeshProviderMutationAcceptanceWire {
+        accepted_at_utc: "2026-07-14T12:01:03Z".to_string(),
+        lease_id: Some("lease-1".to_string()),
+        publication_id: Some("surface:pilot".to_string()),
+        command_id: None,
+        receipt_id: None,
+    };
+    assert_eq!(
+        decode_provider_session_payload::<CultMeshProviderMutationAcceptanceWire>(
+            &encode_provider_session_payload(&acceptance)?
+        )?,
+        acceptance
+    );
+    Ok(())
+}
+
+#[test]
+fn non_ok_response_uses_correlated_empty_map_and_diagnostics() -> Result<()> {
+    let request = create_provider_session_request(
+        "register-denied",
+        CULTMESH_PROVIDER_REGISTER_OPERATION,
+        CULTMESH_PROVIDER_REGISTRATION_SCHEMA,
+        &registration(),
+        Some("aetheria-42".to_string()),
+        Some("odin".to_string()),
+    )?;
+    let response = create_provider_session_error_response(
+        &request,
+        CultMeshProviderOperationStatus::Denied,
+        vec!["registration authority rejected the session".to_string()],
+        Some("odin".to_string()),
+    )?;
+    let CultNetMessage::OperationResponse {
+        message_id,
+        operation,
+        status,
+        payload_schema,
+        payload,
+        diagnostics,
+        ..
+    } = response
+    else {
+        panic!("expected operation response");
+    };
+    assert_eq!(message_id, "register-denied");
+    assert_eq!(operation, CULTMESH_PROVIDER_REGISTER_OPERATION);
+    assert_eq!(status, "denied");
+    assert_eq!(payload_schema, CULTMESH_PROVIDER_MUTATION_ACCEPTANCE_SCHEMA);
+    assert_eq!(diagnostics.len(), 1);
+    let bytes = base64::Engine::decode(&base64::engine::general_purpose::STANDARD, payload)?;
+    assert_eq!(
+        rmp_serde::from_slice::<rmpv::Value>(&bytes)?,
+        rmpv::Value::Map(Vec::new())
+    );
+    assert!(
+        create_provider_session_error_response(
+            &request,
+            CultMeshProviderOperationStatus::Ok,
+            vec!["not an error".to_string()],
+            None,
+        )
+        .is_err()
+    );
+    Ok(())
+}
diff --git a/packages/cultnet-rs/tests/rudp_server_hub.rs b/packages/cultnet-rs/tests/rudp_server_hub.rs
new file mode 100644
index 00000000..201cf3b4
--- /dev/null
+++ b/packages/cultnet-rs/tests/rudp_server_hub.rs
@@ -0,0 +1,574 @@
+use std::collections::VecDeque;
+use std::net::UdpSocket;
+use std::time::Duration;
+
+use anyhow::{Result, anyhow};
+use cultnet_rs::*;
+
+const CONNECTION_ID: u32 = 0x4355_4c54;
+
+fn socket() -> Result<UdpSocket> {
+    let socket = UdpSocket::bind("127.0.0.1:0")?;
+    socket.set_read_timeout(Some(Duration::from_millis(20)))?;
+    Ok(socket)
+}
+
+fn client(remote: std::net::SocketAddr) -> Result<CultNetRudpSocketTransportConnection> {
+    let mut options =
+        CultNetRudpSocketTransportOptions::client("provider", socket()?, remote, CONNECTION_ID);
+    options.max_fragment_bytes = Some(2_048);
+    CultNetRudpSocketTransportConnection::new(options)
+}
+
+fn connect(
+    hub: &mut CultNetRudpServerHub,
+    client: &mut CultNetRudpSocketTransportConnection,
+    evidence: &[u8],
+) -> Result<CultNetRudpServerSessionContext> {
+    client.connect(evidence.to_vec())?;
+    let mut connected = None;
+    for _ in 0..20 {
+        if let Some(CultNetRudpServerEvent::Connected { session }) = hub.receive_event_once()? {
+            connected = Some(session);
+            break;
+        }
+    }
+    let session = connected.ok_or_else(|| anyhow!("hub did not receive Connect"))?;
+    let _ = client.receive_once()?;
+    assert!(client.connected());
+    Ok(session)
+}
+
+fn receive_frame(hub: &mut CultNetRudpServerHub) -> Result<CultNetRudpServerEvent> {
+    for _ in 0..20 {
+        if let Some(event @ CultNetRudpServerEvent::Frame { .. }) = hub.receive_event_once()? {
+            return Ok(event);
+        }
+    }
+    Err(anyhow!("hub did not receive a frame"))
+}
+
+fn receive_message(client: &mut CultNetRudpSocketTransportConnection) -> Result<CultNetMessage> {
+    for _ in 0..20 {
+        if let Some(message) = client.receive_schema_message_once()? {
+            return Ok(message);
+        }
+    }
+    Err(anyhow!("client did not receive a schema message"))
+}
+
+#[test]
+fn hub_keeps_independent_peer_sessions_and_exposes_connect_evidence() -> Result<()> {
+    let server_socket = socket()?;
+    let server_addr = server_socket.local_addr()?;
+    let mut hub = CultNetRudpServerHub::new(CultNetRudpServerHubOptions::new(
+        "odin",
+        server_socket,
+        CONNECTION_ID,
+    ))?;
+    let mut first = client(server_addr)?;
+    let mut second = client(server_addr)?;
+
+    let first_session = connect(&mut hub, &mut first, b"session-token-one")?;
+    let second_session = connect(&mut hub, &mut second, b"session-token-two")?;
+    assert_ne!(first_session.remote_addr, second_session.remote_addr);
+    assert_eq!(first_session.connect_payload, b"session-token-one");
+    assert_eq!(second_session.connect_payload, b"session-token-two");
+    assert_eq!(hub.sessions().len(), 2);
+
+    let first_request = create_provider_session_request(
+        "register-first",
+        CULTMESH_PROVIDER_REGISTER_OPERATION,
+        CULTMESH_PROVIDER_REGISTRATION_SCHEMA,
+        &CultMeshProviderRegistrationWire {
+            provider_id: "first".to_string(),
+            service_instance_id: "first-1".to_string(),
+            endpoint_id: "first-public".to_string(),
+            verse_id: "public".to_string(),
+            requested_lease_duration_ms: 30_000,
+            authority_lease_id: None,
+        },
+        Some("first-1".to_string()),
+        Some("odin".to_string()),
+    )?;
+    let second_request = create_provider_session_request(
+        "register-second",
+        CULTMESH_PROVIDER_REGISTER_OPERATION,
+        CULTMESH_PROVIDER_REGISTRATION_SCHEMA,
+        &CultMeshProviderRegistrationWire {
+            provider_id: "second".to_string(),
+            service_instance_id: "second-1".to_string(),
+            endpoint_id: "second-public".to_string(),
+            verse_id: "public".to_string(),
+            requested_lease_duration_ms: 30_000,
+            authority_lease_id: None,
+        },
+        Some("second-1".to_string()),
+        Some("odin".to_string()),
+    )?;
+    first.send_schema_message(&first_request)?;
+    second.send_schema_message(&second_request)?;
+
+    for _ in 0..2 {
+        let CultNetRudpServerEvent::Frame { session, frame } = receive_frame(&mut hub)? else {
+            unreachable!();
+        };
+        assert_eq!(frame.channel_id, "schema");
+        let request = decode_cultnet_message_from_slice(
+            &frame.payload,
+            CultNetWireContract::CultNetSchemaV0,
+        )?;
+        let CultNetMessage::OperationRequest { message_id, .. } = &request else {
+            return Err(anyhow!("expected operation request"));
+        };
+        let provider_id = if message_id == "register-first" {
+            "first"
+        } else {
+            "second"
+        };
+        let lease = CultMeshProviderLeaseWire {
+            provider_id: provider_id.to_string(),
+            service_instance_id: format!("{provider_id}-1"),
+            endpoint_id: format!("{provider_id}-public"),
+            verse_id: "public".to_string(),
+            lease_id: format!("lease-{provider_id}"),
+            valid_from_utc: "2026-07-14T12:00:00Z".to_string(),
+            expires_at_utc: "2026-07-14T12:00:30Z".to_string(),
+        };
+        let response = create_provider_session_response(
+            &request,
+            CultMeshProviderOperationStatus::Ok,
+            CULTMESH_PROVIDER_LEASE_SCHEMA,
+            &lease,
+            Some("odin".to_string()),
+        )?;
+        hub.send_schema_message(&session, &response)?;
+    }
+
+    let first_response = receive_message(&mut first)?;
+    let second_response = receive_message(&mut second)?;
+    let (_, first_lease) = decode_provider_session_response::<CultMeshProviderLeaseWire>(
+        &first_response,
+        CULTMESH_PROVIDER_REGISTER_OPERATION,
+        CULTMESH_PROVIDER_LEASE_SCHEMA,
+    )?;
+    let (_, second_lease) = decode_provider_session_response::<CultMeshProviderLeaseWire>(
+        &second_response,
+        CULTMESH_PROVIDER_REGISTER_OPERATION,
+        CULTMESH_PROVIDER_LEASE_SCHEMA,
+    )?;
+    assert_eq!(first_lease.provider_id, "first");
+    assert_eq!(second_lease.provider_id, "second");
+    assert_eq!(hub.session(first_session.remote_addr), Some(&first_session));
+    assert_eq!(
+        hub.session(second_session.remote_addr),
+        Some(&second_session)
+    );
+    Ok(())
+}
+
+#[test]
+fn hub_fences_replaced_generations_and_does_not_replace_connect_retransmits() -> Result<()> {
+    let server_socket = socket()?;
+    let server_addr = server_socket.local_addr()?;
+    let mut hub = CultNetRudpServerHub::new(CultNetRudpServerHubOptions::new(
+        "odin",
+        server_socket,
+        CONNECTION_ID,
+    ))?;
+    let mut provider = client(server_addr)?;
+    let original_evidence =
+        encode_provider_connect_evidence(&CultMeshProviderConnectEvidenceWire {
+            client_session_id: "provider-client-1".to_string(),
+            session_token: Some("shared-session-token".to_string()),
+        })?;
+    let replacement_evidence =
+        encode_provider_connect_evidence(&CultMeshProviderConnectEvidenceWire {
+            client_session_id: "provider-client-2".to_string(),
+            session_token: Some("shared-session-token".to_string()),
+        })?;
+    let original = connect(&mut hub, &mut provider, &original_evidence)?;
+
+    provider.connect(original_evidence.clone())?;
+    for _ in 0..3 {
+        assert!(hub.receive_event_once()?.is_none());
+    }
+    assert_eq!(hub.session(original.remote_addr), Some(&original));
+
+    provider.connect(replacement_evidence.clone())?;
+    let mut disconnected = None;
+    for _ in 0..20 {
+        if let Some(event @ CultNetRudpServerEvent::Disconnected { .. }) =
+            hub.receive_event_once()?
+        {
+            disconnected = Some(event);
+            break;
+        }
+    }
+    let disconnected =
+        disconnected.ok_or_else(|| anyhow!("replacement did not disconnect old generation"))?;
+    let CultNetRudpServerEvent::Disconnected { session, .. } = disconnected else {
+        return Err(anyhow!("expected old generation Disconnected event"));
+    };
+    assert_eq!(session, original);
+    let connected = hub
+        .receive_event_once()?
+        .ok_or_else(|| anyhow!("replacement did not connect new generation"))?;
+    let CultNetRudpServerEvent::Connected {
+        session: replacement,
+    } = connected
+    else {
+        return Err(anyhow!("expected replacement Connected event"));
+    };
+    assert_ne!(replacement.session_generation, original.session_generation);
+    let original_decoded = decode_provider_connect_evidence(&original.connect_payload)?;
+    let replacement_decoded = decode_provider_connect_evidence(&replacement.connect_payload)?;
+    assert_eq!(
+        original_decoded.session_token,
+        replacement_decoded.session_token
+    );
+    assert_ne!(
+        original_decoded.client_session_id,
+        replacement_decoded.client_session_id
+    );
+    assert!(
+        hub.send(&original, "schema", vec![0x80])
+            .unwrap_err()
+            .to_string()
+            .contains("no longer active")
+    );
+    assert_eq!(hub.session(replacement.remote_addr), Some(&replacement));
+    Ok(())
+}
+
+#[test]
+fn identical_connect_retransmit_reuses_pending_accept_after_loss() -> Result<()> {
+    let server_socket = socket()?;
+    let server_addr = server_socket.local_addr()?;
+    let mut hub = CultNetRudpServerHub::new(CultNetRudpServerHubOptions::new(
+        "odin",
+        server_socket,
+        CONNECTION_ID,
+    ))?;
+    let client_socket = socket()?;
+    let mut client_session = CultNetRudpSession::new(CultNetRudpSessionOptions {
+        connection_id: CONNECTION_ID,
+        initial_sequence: 1,
+        resend_delay_ms: 250,
+        max_pending_reliable_packets: None,
+    });
+    let evidence = encode_provider_connect_evidence(&CultMeshProviderConnectEvidenceWire {
+        client_session_id: "provider-client-lost-accept".to_string(),
+        session_token: Some("shared-session-token".to_string()),
+    })?;
+    let connect_packet = client_session.create_connect(0, evidence)?;
+    let connect_wire = encode_rudp_packet(&connect_packet)?;
+
+    client_socket.send_to(&connect_wire, server_addr)?;
+    let CultNetRudpServerEvent::Connected { session } = hub
+        .receive_event_once()?
+        .ok_or_else(|| anyhow!("hub did not accept first Connect"))?
+    else {
+        return Err(anyhow!("hub did not emit Connected"));
+    };
+    let mut buffer = vec![0_u8; 65_535];
+    let (first_len, _) = client_socket.recv_from(&mut buffer)?;
+    let lost_accept = decode_rudp_packet(&buffer[..first_len])?;
+    assert_eq!(lost_accept.packet_type, CultNetRudpPacketType::Accept);
+
+    client_socket.send_to(&connect_wire, server_addr)?;
+    assert!(hub.receive_event_once()?.is_none());
+    let (resent_len, _) = client_socket.recv_from(&mut buffer)?;
+    let resent_accept = decode_rudp_packet(&buffer[..resent_len])?;
+    assert_eq!(resent_accept, lost_accept);
+    assert_eq!(hub.session(session.remote_addr), Some(&session));
+
+    client_session.receive(&resent_accept, 1)?;
+    assert!(client_session.connected());
+    Ok(())
+}
+
+#[test]
+fn exact_reliable_acks_clear_more_than_one_ack_window_of_fragments() -> Result<()> {
+    let mut sender = CultNetRudpSession::new(CultNetRudpSessionOptions {
+        connection_id: CONNECTION_ID,
+        initial_sequence: 1,
+        resend_delay_ms: 250,
+        max_pending_reliable_packets: None,
+    });
+    let mut receiver = CultNetRudpSession::new(CultNetRudpSessionOptions {
+        connection_id: CONNECTION_ID,
+        initial_sequence: 1,
+        resend_delay_ms: 250,
+        max_pending_reliable_packets: None,
+    });
+    let connect_packet = sender.create_connect(0, Vec::new())?;
+    let accept = receiver.accept_connect(&connect_packet, 0, Vec::new())?;
+    sender.receive(&accept, 0)?;
+    receiver.receive(&sender.create_ack_for(accept.sequence), 0)?;
+
+    let packets = sender.send_many(
+        "schema",
+        vec![0x5a; 40],
+        CultNetRudpSendOptions {
+            reliable: true,
+            ordered: true,
+            sequenced: false,
+            now_ms: 1,
+                    reliable_expire_after_ms: None,
+        },
+        Some(1),
+    )?;
+    // Forty one-byte fragments cannot leave inside one reliable send window. The
+    // window's worth goes out now and the rest queue until acknowledgements free
+    // space, which is the crossing this test exists to prove.
+    assert_eq!(packets.len(), CULTNET_RUDP_RELIABLE_SEND_WINDOW_PACKETS);
+    assert_eq!(
+        sender.queued_reliable_packet_count(),
+        40 - CULTNET_RUDP_RELIABLE_SEND_WINDOW_PACKETS
+    );
+
+    let mut wire = VecDeque::from(packets);
+    let mut delivered = Vec::new();
+    while !wire.is_empty() {
+        let admitted = wire.len();
+        for _ in 0..admitted {
+            let packet = wire.pop_front().expect("admitted packet remains queued");
+            let received = receiver.receive(&packet, 2)?;
+            delivered.extend(received.delivered);
+        }
+        let acknowledged = sender.receive(&receiver.create_ack(), 3)?;
+        wire.extend(acknowledged.ready_to_send);
+    }
+
+    assert_eq!(delivered.len(), 1);
+    assert_eq!(delivered[0].payload, vec![0x5a; 40]);
+    assert!(sender.pending_reliable_sequences().is_empty());
+    assert_eq!(sender.outstanding_reliable_packet_count(), 0);
+    Ok(())
+}
+
+#[test]
+fn session_and_hub_reject_configured_memory_bounds() -> Result<()> {
+    let mut receiver = CultNetRudpSession::new(CultNetRudpSessionOptions {
+        connection_id: CONNECTION_ID,
+        initial_sequence: 1,
+        resend_delay_ms: 250,
+        max_pending_reliable_packets: None,
+    });
+    receiver.set_max_payload_bytes(Some(4));
+    receiver.set_max_pending_fragment_sets(1)?;
+    let mut sender = CultNetRudpSession::new(CultNetRudpSessionOptions {
+        connection_id: CONNECTION_ID,
+        initial_sequence: 1,
+        resend_delay_ms: 250,
+        max_pending_reliable_packets: None,
+    });
+    let connect_packet = sender.create_connect(0, Vec::new())?;
+    let accept = receiver.accept_connect(&connect_packet, 0, Vec::new())?;
+    sender.receive(&accept, 0)?;
+
+    let oversized = sender.send_many(
+        "schema",
+        vec![1, 2, 3, 4, 5],
+        CultNetRudpSendOptions {
+            reliable: true,
+            ordered: true,
+            sequenced: false,
+            now_ms: 1,
+                    reliable_expire_after_ms: None,
+        },
+        Some(2),
+    )?;
+    receiver.receive(&oversized[0], 1)?;
+    receiver.receive(&oversized[1], 1)?;
+    assert!(receiver.receive(&oversized[2], 1).is_err());
+
+    let fragment_options = CultNetRudpSendOptions {
+        reliable: true,
+        ordered: true,
+        sequenced: false,
+        now_ms: 2,
+            reliable_expire_after_ms: None,
+    };
+    let first_set = sender.send_many(
+        "schema",
+        vec![1, 2, 3, 4],
+        fragment_options.clone(),
+        Some(2),
+    )?;
+    let second_set = sender.send_many("schema", vec![5, 6, 7, 8], fragment_options, Some(2))?;
+    receiver.receive(&first_set[0], 2)?;
+    // The fragment-set bound evicts the stalest incomplete set rather than
+    // refusing the packet: a receiver that dies at its bound under loss is a
+    // fuse, not a limit (measured 2026-09-10, see tests/cultnet.rs).
+    assert_eq!(receiver.fragment_sets_evicted(), 0);
+    receiver.receive(&second_set[0], 2)?;
+    assert_eq!(receiver.fragment_sets_evicted(), 1, "the first set was evicted for the second");
+
+    let server_socket = socket()?;
+    let server_addr = server_socket.local_addr()?;
+    let mut options = CultNetRudpServerHubOptions::new("odin", server_socket, CONNECTION_ID);
+    options.max_peers = 1;
+    let mut hub = CultNetRudpServerHub::new(options)?;
+    let mut first = client(server_addr)?;
+    let mut second = client(server_addr)?;
+    connect(&mut hub, &mut first, b"first")?;
+    second.connect(b"second".to_vec())?;
+    for _ in 0..20 {
+        match hub.receive_event_once() {
+            Err(error) => {
+                assert!(error.to_string().contains("peer limit"));
+                return Ok(());
+            }
+            Ok(_) => continue,
+        }
+    }
+    Err(anyhow!("hub did not enforce peer limit"))
+}
+
+#[test]
+fn replay_history_is_bounded_and_idle_hub_sessions_expire() -> Result<()> {
+    let mut sender = CultNetRudpSession::new(CultNetRudpSessionOptions {
+        connection_id: CONNECTION_ID,
+        initial_sequence: 1,
+        resend_delay_ms: 250,
+        max_pending_reliable_packets: None,
+    });
+    let mut receiver = CultNetRudpSession::new(CultNetRudpSessionOptions {
+        connection_id: CONNECTION_ID,
+        initial_sequence: 1,
+        resend_delay_ms: 250,
+        max_pending_reliable_packets: None,
+    });
+    let connect_packet = sender.create_connect(0, Vec::new())?;
+    let accept = receiver.accept_connect(&connect_packet, 0, Vec::new())?;
+    sender.receive(&accept, 0)?;
+    let mut oldest = None;
+    for sequence in 0..4_100 {
+        let packet = sender.send(
+            "realtime",
+            vec![(sequence % 251) as u8],
+            CultNetRudpSendOptions {
+                reliable: false,
+                ordered: false,
+                sequenced: false,
+                now_ms: sequence,
+                            reliable_expire_after_ms: None,
+            },
+        )?;
+        if oldest.is_none() {
+            oldest = Some(packet.clone());
+        }
+        assert_eq!(receiver.receive(&packet, sequence)?.delivered.len(), 1);
+    }
+    // Separating the sequence domains moved duplicate suppression onto the
+    // reliable domain, so a replayed lossy datagram is delivered again rather
+    // than silently dropped. Lossy traffic is remembered nowhere, which is what
+    // bounds its history.
+    assert_eq!(
+        receiver
+            .receive(&oldest.expect("oldest packet"), 4_101)?
+            .delivered
+            .len(),
+        1
+    );
+
+    // The bounded replay window still guards the reliable domain, and nothing
+    // else asserts it once the lossy path stopped being remembered.
+    let mut oldest_reliable = None;
+    for step in 0..4_100u64 {
+        let packet = sender.send(
+            "schema",
+            vec![(step % 251) as u8],
+            CultNetRudpSendOptions {
+                reliable: true,
+                ordered: false,
+                sequenced: false,
+                now_ms: step,
+                            reliable_expire_after_ms: None,
+            },
+        )?;
+        if oldest_reliable.is_none() {
+            oldest_reliable = Some(packet.clone());
+        }
+        assert_eq!(receiver.receive(&packet, step)?.delivered.len(), 1);
+        sender.receive(&receiver.create_ack_for(packet.sequence), step)?;
+    }
+    assert!(
+        receiver
+            .receive(&oldest_reliable.expect("oldest reliable packet"), 4_101)?
+            .delivered
+            .is_empty()
+    );
+
+    let server_socket = socket()?;
+    let server_addr = server_socket.local_addr()?;
+    let mut hub = CultNetRudpServerHub::new(CultNetRudpServerHubOptions::new(
+        "odin",
+        server_socket,
+        CONNECTION_ID,
+    ))?;
+    let mut provider = client(server_addr)?;
+    let context = connect(&mut hub, &mut provider, b"expiring-session")?;
+    std::thread::sleep(Duration::from_millis(2));
+    assert_eq!(hub.remove_timed_out_sessions(0), vec![context]);
+    assert!(hub.sessions().is_empty());
+    Ok(())
+}
+
+/// A packet that carries no event — an acknowledgement, a ping — must not
+/// make the reader report "nothing waiting" while frames sit behind it.
+/// A caller that polls once per send fell behind its peer's acknowledgements
+/// this way and a reliable channel resent everything.
+#[test]
+fn a_reader_does_not_stop_at_a_packet_that_carries_no_event() -> Result<()> {
+    let mut hub = CultNetRudpServerHub::new(CultNetRudpServerHubOptions::new(
+        "hub",
+        socket()?,
+        CONNECTION_ID,
+    ))?;
+    let mut peer = client(hub.local_addr()?)?;
+    let session = connect(&mut hub, &mut peer, b"evidence")?;
+
+    // Hub side: a ping (reply, no event) ahead of a reliable frame.
+    peer.ping(b"keepalive".to_vec())?;
+    peer.send("schema", b"after the ping".to_vec())?;
+    std::thread::sleep(Duration::from_millis(20));
+    match hub.receive_event_once()? {
+        Some(CultNetRudpServerEvent::Frame { frame, .. }) => {
+            assert_eq!(frame.payload, b"after the ping");
+        }
+        other => panic!("the first read must reach the frame behind the ping, got {other:?}"),
+    }
+
+    // Client side: the hub's acknowledgement of that frame is queued ahead of
+    // two unreliable frames; the client must reach both without a "nothing"
+    // in between, and must not acknowledge unreliable frames back.
+    let mut unreliable_hub_options =
+        CultNetRudpServerHubOptions::new("hub-unreliable", socket()?, CONNECTION_ID);
+    unreliable_hub_options.media_delivery = Some(CultNetTransportDelivery::Unreliable);
+    let mut media_hub = CultNetRudpServerHub::new(unreliable_hub_options)?;
+    let mut media_client = client(media_hub.local_addr()?)?;
+    let media_session = connect(&mut media_hub, &mut media_client, b"media")?;
+    media_client.send("schema", b"reliable, will be acked".to_vec())?;
+    std::thread::sleep(Duration::from_millis(20));
+    while media_hub.receive_event_once()?.is_some() {}
+    media_hub.send(&media_session, "media", b"one".to_vec())?;
+    media_hub.send(&media_session, "media", b"two".to_vec())?;
+    std::thread::sleep(Duration::from_millis(20));
+    let before = media_hub.stats().bytes_received;
+    let first = media_client.receive_once()?.expect("the first read reaches the frame behind the ack");
+    let second = media_client.receive_once()?.expect("the second frame follows");
+    assert_eq!((first.payload, second.payload), (b"one".to_vec(), b"two".to_vec()));
+    assert!(media_client.receive_once()?.is_none());
+    std::thread::sleep(Duration::from_millis(20));
+    while media_hub.receive_event_once()?.is_some() {}
+    assert_eq!(
+        media_hub.stats().bytes_received,
+        before,
+        "unreliable frames are not acknowledged; the hub read nothing back"
+    );
+    let _ = session;
+    Ok(())
+}
diff --git a/packages/cultnet-ts/README.md b/packages/cultnet-ts/README.md
index 5ff66e7e..75e77b88 100644
--- a/packages/cultnet-ts/README.md
+++ b/packages/cultnet-ts/README.md
@@ -195,7 +195,7 @@ the helper path.
 ## Quick Example
 
 ```ts
-import { CultCache, defineDocumentType } from "cultcache-ts";
+import { CultCache, defineDocumentType } from "@gamecult/cultcache-ts";
 import {
   CultNetDocumentRegistry,
   createTcpFramedCultNetPeer,
diff --git a/packages/cultnet-ts/contracts/cultmesh.session-accepted.schema.json b/packages/cultnet-ts/contracts/cultmesh.session-accepted.schema.json
new file mode 100644
index 00000000..aca1ff2b
--- /dev/null
+++ b/packages/cultnet-ts/contracts/cultmesh.session-accepted.schema.json
@@ -0,0 +1,21 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://github.com/GameCult/cultnet-ts/contracts/cultmesh.session-accepted.schema.json",
+  "title": "CultMesh Session Accepted",
+  "type": "object",
+  "required": ["schemaVersion", "messageId", "accepted", "verseId", "authorityRuntimeId", "protocolId", "routeGeneration", "clientNonce", "providerKeyId", "providerSignature"],
+  "additionalProperties": false,
+  "properties": {
+    "schemaVersion": { "const": "cultmesh.session_accepted.v2" },
+    "messageId": { "type": "string", "minLength": 1 },
+    "accepted": { "type": "boolean" },
+    "verseId": { "type": "string", "minLength": 1 },
+    "authorityRuntimeId": { "type": "string", "minLength": 1 },
+    "protocolId": { "type": "string", "minLength": 1 },
+    "routeGeneration": { "type": "string" },
+    "clientNonce": { "type": "string" },
+    "providerKeyId": { "type": "string" },
+    "providerSignature": { "type": "string" },
+    "error": { "type": "string", "minLength": 1 }
+  }
+}
diff --git a/packages/cultnet-ts/contracts/cultmesh.session-open.schema.json b/packages/cultnet-ts/contracts/cultmesh.session-open.schema.json
new file mode 100644
index 00000000..937f3e28
--- /dev/null
+++ b/packages/cultnet-ts/contracts/cultmesh.session-open.schema.json
@@ -0,0 +1,18 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://github.com/GameCult/cultnet-ts/contracts/cultmesh.session-open.schema.json",
+  "title": "CultMesh Session Open",
+  "type": "object",
+  "required": ["schemaVersion", "messageId", "sourceRuntimeId", "verseId", "authorityRuntimeId", "protocolId", "routeGeneration", "clientNonce"],
+  "additionalProperties": false,
+  "properties": {
+    "schemaVersion": { "const": "cultmesh.session_open.v2" },
+    "messageId": { "type": "string", "minLength": 1 },
+    "sourceRuntimeId": { "type": "string", "minLength": 1 },
+    "verseId": { "type": "string", "minLength": 1 },
+    "authorityRuntimeId": { "type": "string", "minLength": 1 },
+    "protocolId": { "type": "string", "minLength": 1 },
+    "routeGeneration": { "type": "string" },
+    "clientNonce": { "type": "string", "minLength": 1 }
+  }
+}
diff --git a/packages/cultnet-ts/contracts/cultmesh.verse-catalog-request.schema.json b/packages/cultnet-ts/contracts/cultmesh.verse-catalog-request.schema.json
new file mode 100644
index 00000000..e99b9dea
--- /dev/null
+++ b/packages/cultnet-ts/contracts/cultmesh.verse-catalog-request.schema.json
@@ -0,0 +1,14 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://github.com/GameCult/cultnet-ts/contracts/cultmesh.verse-catalog-request.schema.json",
+  "title": "CultMesh Verse Catalog Request",
+  "type": "object",
+  "required": ["schemaVersion", "messageId"],
+  "additionalProperties": false,
+  "properties": {
+    "schemaVersion": { "const": "cultmesh.verse_catalog_request.v0" },
+    "messageId": { "type": "string", "minLength": 1 },
+    "verseIds": { "type": "array", "items": { "type": "string", "minLength": 1 }, "uniqueItems": true },
+    "transportVersion": { "type": "string", "minLength": 1 }
+  }
+}
diff --git a/packages/cultnet-ts/contracts/cultmesh.verse-catalog-response.schema.json b/packages/cultnet-ts/contracts/cultmesh.verse-catalog-response.schema.json
new file mode 100644
index 00000000..464908ad
--- /dev/null
+++ b/packages/cultnet-ts/contracts/cultmesh.verse-catalog-response.schema.json
@@ -0,0 +1,72 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://github.com/GameCult/cultnet-ts/contracts/cultmesh.verse-catalog-response.schema.json",
+  "title": "CultMesh Verse Catalog Response",
+  "type": "object",
+  "required": ["schemaVersion", "messageId", "verses"],
+  "additionalProperties": false,
+  "$defs": {
+    "compatibility": {
+      "type": "object",
+      "required": ["transportVersion", "rulesHash", "compatibleVerseIds", "requiredPluginIds", "optionalPluginIds"],
+      "additionalProperties": false,
+      "properties": {
+        "transportVersion": { "type": "string", "minLength": 1 },
+        "rulesHash": { "type": "string", "minLength": 1 },
+        "compatibleVerseIds": { "type": "array", "items": { "type": "string", "minLength": 1 }, "uniqueItems": true },
+        "requiredPluginIds": { "type": "array", "items": { "type": "string", "minLength": 1 }, "uniqueItems": true },
+        "optionalPluginIds": { "type": "array", "items": { "type": "string", "minLength": 1 }, "uniqueItems": true }
+      }
+    },
+    "authorityRoute": {
+      "type": "object",
+      "required": ["authorityRuntimeId", "endpoint", "protocolIds", "priority", "generation"],
+      "additionalProperties": false,
+      "properties": {
+        "authorityRuntimeId": { "type": "string", "minLength": 1 },
+        "endpoint": { "type": "string", "minLength": 1 },
+        "protocolIds": { "type": "array", "items": { "type": "string", "minLength": 1 }, "uniqueItems": true },
+        "priority": { "type": "integer", "minimum": 0 },
+        "generation": { "type": "string", "minLength": 1 },
+        "certificate": {
+          "anyOf": [{ "$ref": "#/$defs/routeCertificate" }, { "type": "null" }]
+        }
+      }
+    },
+    "routeCertificate": {
+      "type": "object",
+      "required": ["providerKeyId", "providerPublicKeyX", "providerPublicKeyY", "odinKeyId", "issuedAtUnixMilliseconds", "expiresAtUnixMilliseconds", "signature"],
+      "additionalProperties": false,
+      "properties": {
+        "providerKeyId": { "type": "string", "minLength": 1 },
+        "providerPublicKeyX": { "type": "string", "minLength": 1 },
+        "providerPublicKeyY": { "type": "string", "minLength": 1 },
+        "odinKeyId": { "type": "string", "minLength": 1 },
+        "issuedAtUnixMilliseconds": { "type": "integer", "minimum": 0 },
+        "expiresAtUnixMilliseconds": { "type": "integer", "minimum": 1 },
+        "signature": { "type": "string", "minLength": 1 }
+      }
+    },
+    "verse": {
+      "type": "object",
+      "required": ["verseId", "displayName", "authorityModel", "compatibility", "discoveryEndpoints", "authorityRuntimeIds"],
+      "additionalProperties": false,
+      "properties": {
+        "verseId": { "type": "string", "minLength": 1 },
+        "displayName": { "type": "string", "minLength": 1 },
+        "authorityModel": { "type": "string", "minLength": 1 },
+        "compatibility": { "$ref": "#/$defs/compatibility" },
+        "discoveryEndpoints": { "type": "array", "items": { "type": "string", "minLength": 1 }, "uniqueItems": true },
+        "authorityRuntimeIds": { "type": "array", "items": { "type": "string", "minLength": 1 }, "uniqueItems": true },
+        "authorityRoutes": { "type": "array", "items": { "$ref": "#/$defs/authorityRoute" } },
+        "parentVerseId": { "type": "string", "minLength": 1 },
+        "description": { "type": "string" }
+      }
+    }
+  },
+  "properties": {
+    "schemaVersion": { "const": "cultmesh.verse_catalog_response.v0" },
+    "messageId": { "type": "string", "minLength": 1 },
+    "verses": { "type": "array", "items": { "$ref": "#/$defs/verse" } }
+  }
+}
diff --git a/packages/cultnet-ts/contracts/cultnet.database-change-raw.schema.json b/packages/cultnet-ts/contracts/cultnet.database-change-raw.schema.json
new file mode 100644
index 00000000..dd650fa0
--- /dev/null
+++ b/packages/cultnet-ts/contracts/cultnet.database-change-raw.schema.json
@@ -0,0 +1,24 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://github.com/GameCult/cultnet-ts/contracts/cultnet.database-change-raw.schema.json",
+  "title": "CultNet Raw Database Change Message",
+  "type": "object",
+  "required": ["schemaVersion", "messageId", "subscriptionId", "changeKind"],
+  "additionalProperties": false,
+  "properties": {
+    "schemaVersion": { "const": "cultnet.database_change_raw.v0" },
+    "messageId": { "type": "string", "minLength": 1 },
+    "subscriptionId": { "type": "string", "minLength": 1 },
+    "changeKind": { "enum": ["added", "updated", "removed"] },
+    "document": { "$ref": "./cultnet.raw-document-record.schema.json" },
+    "recordKey": { "type": "string", "minLength": 1 },
+    "schemaId": { "type": "string", "minLength": 1 }
+  },
+  "allOf": [
+    {
+      "if": { "properties": { "changeKind": { "const": "removed" } } },
+      "then": { "required": ["recordKey", "schemaId"] },
+      "else": { "required": ["document"] }
+    }
+  ]
+}
diff --git a/packages/cultnet-ts/contracts/cultnet.database-subscribe.schema.json b/packages/cultnet-ts/contracts/cultnet.database-subscribe.schema.json
new file mode 100644
index 00000000..08304199
--- /dev/null
+++ b/packages/cultnet-ts/contracts/cultnet.database-subscribe.schema.json
@@ -0,0 +1,19 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://github.com/GameCult/cultnet-ts/contracts/cultnet.database-subscribe.schema.json",
+  "title": "CultNet Database Subscribe Message",
+  "type": "object",
+  "required": ["schemaVersion", "messageId", "subscriptionId", "includeSnapshot"],
+  "additionalProperties": false,
+  "properties": {
+    "schemaVersion": { "const": "cultnet.database_subscribe.v0" },
+    "messageId": { "type": "string", "minLength": 1 },
+    "subscriptionId": { "type": "string", "minLength": 1 },
+    "schemaIds": { "type": "array", "items": { "type": "string", "minLength": 1 } },
+    "recordKeys": { "type": "array", "items": { "type": "string", "minLength": 1 } },
+    "includeSnapshot": { "type": "boolean" },
+    "consumerRuntimeId": { "type": "string", "minLength": 1 },
+    "bodyIds": { "type": "array", "items": { "type": "string", "minLength": 1 } },
+    "supportedBodyTransports": { "type": "array", "items": { "type": "string", "minLength": 1 } }
+  }
+}
diff --git a/packages/cultnet-ts/contracts/cultnet.database-unsubscribe.schema.json b/packages/cultnet-ts/contracts/cultnet.database-unsubscribe.schema.json
new file mode 100644
index 00000000..7d4b0855
--- /dev/null
+++ b/packages/cultnet-ts/contracts/cultnet.database-unsubscribe.schema.json
@@ -0,0 +1,13 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://github.com/GameCult/cultnet-ts/contracts/cultnet.database-unsubscribe.schema.json",
+  "title": "CultNet Database Unsubscribe Message",
+  "type": "object",
+  "required": ["schemaVersion", "messageId", "subscriptionId"],
+  "additionalProperties": false,
+  "properties": {
+    "schemaVersion": { "const": "cultnet.database_unsubscribe.v0" },
+    "messageId": { "type": "string", "minLength": 1 },
+    "subscriptionId": { "type": "string", "minLength": 1 }
+  }
+}
diff --git a/packages/cultnet-ts/contracts/cultnet.operation-request.schema.json b/packages/cultnet-ts/contracts/cultnet.operation-request.schema.json
new file mode 100644
index 00000000..07cd9d8d
--- /dev/null
+++ b/packages/cultnet-ts/contracts/cultnet.operation-request.schema.json
@@ -0,0 +1,19 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://github.com/GameCult/cultnet-ts/contracts/cultnet.operation-request.schema.json",
+  "title": "CultNet Operation Request",
+  "type": "object",
+  "required": ["schemaVersion", "messageId", "serviceId", "operation", "payloadSchema", "payload"],
+  "additionalProperties": false,
+  "properties": {
+    "schemaVersion": { "const": "cultnet.operation_request.v0" },
+    "messageId": { "type": "string", "minLength": 1 },
+    "serviceId": { "type": "string", "minLength": 1 },
+    "operation": { "type": "string", "minLength": 1 },
+    "payloadSchema": { "type": "string", "minLength": 1 },
+    "payloadEncoding": { "const": "messagepack-base64" },
+    "payload": { "type": "string", "minLength": 1, "contentEncoding": "base64" },
+    "sourceRuntimeId": { "type": "string", "minLength": 1 },
+    "targetRuntimeId": { "type": "string", "minLength": 1 }
+  }
+}
diff --git a/packages/cultnet-ts/contracts/cultnet.operation-response.schema.json b/packages/cultnet-ts/contracts/cultnet.operation-response.schema.json
new file mode 100644
index 00000000..c3be917d
--- /dev/null
+++ b/packages/cultnet-ts/contracts/cultnet.operation-response.schema.json
@@ -0,0 +1,20 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://github.com/GameCult/cultnet-ts/contracts/cultnet.operation-response.schema.json",
+  "title": "CultNet Operation Response",
+  "type": "object",
+  "required": ["schemaVersion", "messageId", "serviceId", "operation", "status", "payloadSchema", "payload"],
+  "additionalProperties": false,
+  "properties": {
+    "schemaVersion": { "const": "cultnet.operation_response.v0" },
+    "messageId": { "type": "string", "minLength": 1 },
+    "serviceId": { "type": "string", "minLength": 1 },
+    "operation": { "type": "string", "minLength": 1 },
+    "status": { "type": "string", "minLength": 1 },
+    "payloadSchema": { "type": "string", "minLength": 1 },
+    "payloadEncoding": { "const": "messagepack-base64" },
+    "payload": { "type": "string", "minLength": 1, "contentEncoding": "base64" },
+    "diagnostics": { "type": "array", "items": { "type": "string" } },
+    "sourceRuntimeId": { "type": "string", "minLength": 1 }
+  }
+}
diff --git a/packages/cultnet-ts/package-lock.json b/packages/cultnet-ts/package-lock.json
deleted file mode 100644
index 349dfe87..00000000
--- a/packages/cultnet-ts/package-lock.json
+++ /dev/null
@@ -1,322 +0,0 @@
-{
-  "name": "cultnet-ts",
-  "version": "0.1.0",
-  "lockfileVersion": 3,
-  "requires": true,
-  "packages": {
-    "": {
-      "name": "cultnet-ts",
-      "version": "0.1.0",
-      "license": "MIT",
-      "dependencies": {
-        "@msgpack/msgpack": "^3.1.3",
-        "ajv": "^8.17.1",
-        "cultcache-ts": "github:GameCult/cultcache-ts"
-      },
-      "devDependencies": {
-        "@types/node": "^24.0.0",
-        "json-schema-to-typescript": "^15.0.4",
-        "typescript": "^5.9.0",
-        "zod": "^3.25.76"
-      }
-    },
-    "node_modules/@apidevtools/json-schema-ref-parser": {
-      "version": "11.9.3",
-      "resolved": "https://registry.npmjs.org/@apidevtools/json-schema-ref-parser/-/json-schema-ref-parser-11.9.3.tgz",
-      "integrity": "sha512-60vepv88RwcJtSHrD6MjIL6Ta3SOYbgfnkHb+ppAVK+o9mXprRtulx7VlRl3lN3bbvysAfCS7WMVfhUYemB0IQ==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@jsdevtools/ono": "^7.1.3",
-        "@types/json-schema": "^7.0.15",
-        "js-yaml": "^4.1.0"
-      },
-      "engines": {
-        "node": ">= 16"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/philsturgeon"
-      }
-    },
-    "node_modules/@jsdevtools/ono": {
-      "version": "7.1.3",
-      "resolved": "https://registry.npmjs.org/@jsdevtools/ono/-/ono-7.1.3.tgz",
-      "integrity": "sha512-4JQNk+3mVzK3xh2rqd6RB4J46qUR19azEHBneZyTZM+c456qOrbbM/5xcR8huNCCcbVt7+UmizG6GuUvPvKUYg==",
-      "dev": true,
-      "license": "MIT"
-    },
-    "node_modules/@msgpack/msgpack": {
-      "version": "3.1.3",
-      "resolved": "https://registry.npmjs.org/@msgpack/msgpack/-/msgpack-3.1.3.tgz",
-      "integrity": "sha512-47XIizs9XZXvuJgoaJUIE2lFoID8ugvc0jzSHP+Ptfk8nTbnR8g788wv48N03Kx0UkAv559HWRQ3yzOgzlRNUA==",
-      "license": "ISC",
-      "engines": {
-        "node": ">= 18"
-      }
-    },
-    "node_modules/@types/json-schema": {
-      "version": "7.0.15",
-      "resolved": "https://registry.npmjs.org/@types/json-schema/-/json-schema-7.0.15.tgz",
-      "integrity": "sha512-5+fP8P8MFNC+AyZCDxrB2pkZFPGzqQWUzpSeuuVLvm8VMcorNYavBqoFcxK8bQz4Qsbn4oUEEem4wDLfcysGHA==",
-      "dev": true,
-      "license": "MIT"
-    },
-    "node_modules/@types/lodash": {
-      "version": "4.17.24",
-      "resolved": "https://registry.npmjs.org/@types/lodash/-/lodash-4.17.24.tgz",
-      "integrity": "sha512-gIW7lQLZbue7lRSWEFql49QJJWThrTFFeIMJdp3eH4tKoxm1OvEPg02rm4wCCSHS0cL3/Fizimb35b7k8atwsQ==",
-      "dev": true,
-      "license": "MIT"
-    },
-    "node_modules/@types/node": {
-      "version": "24.12.2",
-      "resolved": "https://registry.npmjs.org/@types/node/-/node-24.12.2.tgz",
-      "integrity": "sha512-A1sre26ke7HDIuY/M23nd9gfB+nrmhtYyMINbjI1zHJxYteKR6qSMX56FsmjMcDb3SMcjJg5BiRRgOCC/yBD0g==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "undici-types": "~7.16.0"
-      }
-    },
-    "node_modules/ajv": {
-      "version": "8.20.0",
-      "resolved": "https://registry.npmjs.org/ajv/-/ajv-8.20.0.tgz",
-      "integrity": "sha512-Thbli+OlOj+iMPYFBVBfJ3OmCAnaSyNn4M1vz9T6Gka5Jt9ba/HIR56joy65tY6kx/FCF5VXNB819Y7/GUrBGA==",
-      "license": "MIT",
-      "dependencies": {
-        "fast-deep-equal": "^3.1.3",
-        "fast-uri": "^3.0.1",
-        "json-schema-traverse": "^1.0.0",
-        "require-from-string": "^2.0.2"
-      },
-      "funding": {
-        "type": "github",
-        "url": "https://github.com/sponsors/epoberezkin"
-      }
-    },
-    "node_modules/argparse": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/argparse/-/argparse-2.0.1.tgz",
-      "integrity": "sha512-8+9WqebbFzpX9OR+Wa6O29asIogeRMzcGtAINdpMHHyAg10f05aSFVBbcEqGf/PXw1EjAZ+q2/bEBg3DvurK3Q==",
-      "dev": true,
-      "license": "Python-2.0"
-    },
-    "node_modules/cultcache-ts": {
-      "version": "0.1.0",
-      "resolved": "git+ssh://git@github.com/GameCult/cultcache-ts.git#6c2e1e3691146f99c44c098371cc8c787b4a8d0c",
-      "license": "MIT",
-      "dependencies": {
-        "@msgpack/msgpack": "^3.1.3",
-        "zod": "^3.25.76"
-      }
-    },
-    "node_modules/fast-deep-equal": {
-      "version": "3.1.3",
-      "resolved": "https://registry.npmjs.org/fast-deep-equal/-/fast-deep-equal-3.1.3.tgz",
-      "integrity": "sha512-f3qQ9oQy9j2AhBe/H9VC91wLmKBCCU/gDOnKNAYG5hswO7BLKj09Hc5HYNz9cGI++xlpDCIgDaitVs03ATR84Q==",
-      "license": "MIT"
-    },
-    "node_modules/fast-uri": {
-      "version": "3.1.2",
-      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.2.tgz",
-      "integrity": "sha512-rVjf7ArG3LTk+FS6Yw81V1DLuZl1bRbNrev6Tmd/9RaroeeRRJhAt7jg/6YFxbvAQXUCavSoZhPPj6oOx+5KjQ==",
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/fastify"
-        },
-        {
-          "type": "opencollective",
-          "url": "https://opencollective.com/fastify"
-        }
-      ],
-      "license": "BSD-3-Clause"
-    },
-    "node_modules/fdir": {
-      "version": "6.5.0",
-      "resolved": "https://registry.npmjs.org/fdir/-/fdir-6.5.0.tgz",
-      "integrity": "sha512-tIbYtZbucOs0BRGqPJkshJUYdL+SDH7dVM8gjy+ERp3WAUjLEFJE+02kanyHtwjWOnwrKYBiwAmM0p4kLJAnXg==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=12.0.0"
-      },
-      "peerDependencies": {
-        "picomatch": "^3 || ^4"
-      },
-      "peerDependenciesMeta": {
-        "picomatch": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/is-extglob": {
-      "version": "2.1.1",
-      "resolved": "https://registry.npmjs.org/is-extglob/-/is-extglob-2.1.1.tgz",
-      "integrity": "sha512-SbKbANkN603Vi4jEZv49LeVJMn4yGwsbzZworEoyEiutsN3nJYdbO36zfhGJ6QEDpOZIFkDtnq5JRxmvl3jsoQ==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/is-glob": {
-      "version": "4.0.3",
-      "resolved": "https://registry.npmjs.org/is-glob/-/is-glob-4.0.3.tgz",
-      "integrity": "sha512-xelSayHH36ZgE7ZWhli7pW34hNbNl8Ojv5KVmkJD4hBdD3th8Tfk9vYasLM+mXWOZhFkgZfxhLSnrwRr4elSSg==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "is-extglob": "^2.1.1"
-      },
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/js-yaml": {
-      "version": "4.1.1",
-      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.1.1.tgz",
-      "integrity": "sha512-qQKT4zQxXl8lLwBtHMWwaTcGfFOZviOJet3Oy/xmGk2gZH677CJM9EvtfdSkgWcATZhj/55JZ0rmy3myCT5lsA==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "argparse": "^2.0.1"
-      },
-      "bin": {
-        "js-yaml": "bin/js-yaml.js"
-      }
-    },
-    "node_modules/json-schema-to-typescript": {
-      "version": "15.0.4",
-      "resolved": "https://registry.npmjs.org/json-schema-to-typescript/-/json-schema-to-typescript-15.0.4.tgz",
-      "integrity": "sha512-Su9oK8DR4xCmDsLlyvadkXzX6+GGXJpbhwoLtOGArAG61dvbW4YQmSEno2y66ahpIdmLMg6YUf/QHLgiwvkrHQ==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@apidevtools/json-schema-ref-parser": "^11.5.5",
-        "@types/json-schema": "^7.0.15",
-        "@types/lodash": "^4.17.7",
-        "is-glob": "^4.0.3",
-        "js-yaml": "^4.1.0",
-        "lodash": "^4.17.21",
-        "minimist": "^1.2.8",
-        "prettier": "^3.2.5",
-        "tinyglobby": "^0.2.9"
-      },
-      "bin": {
-        "json2ts": "dist/src/cli.js"
-      },
-      "engines": {
-        "node": ">=16.0.0"
-      }
-    },
-    "node_modules/json-schema-traverse": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/json-schema-traverse/-/json-schema-traverse-1.0.0.tgz",
-      "integrity": "sha512-NM8/P9n3XjXhIZn1lLhkFaACTOURQXjWhV4BA/RnOv8xvgqtqpAX9IO4mRQxSx1Rlo4tqzeqb0sOlruaOy3dug==",
-      "license": "MIT"
-    },
-    "node_modules/lodash": {
-      "version": "4.18.1",
-      "resolved": "https://registry.npmjs.org/lodash/-/lodash-4.18.1.tgz",
-      "integrity": "sha512-dMInicTPVE8d1e5otfwmmjlxkZoUpiVLwyeTdUsi/Caj/gfzzblBcCE5sRHV/AsjuCmxWrte2TNGSYuCeCq+0Q==",
-      "dev": true,
-      "license": "MIT"
-    },
-    "node_modules/minimist": {
-      "version": "1.2.8",
-      "resolved": "https://registry.npmjs.org/minimist/-/minimist-1.2.8.tgz",
-      "integrity": "sha512-2yyAR8qBkN3YuheJanUpWC5U3bb5osDywNB8RzDVlDwDHbocAJveqqj1u8+SVD7jkWT4yvsHCpWqqWqAxb0zCA==",
-      "dev": true,
-      "license": "MIT",
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/picomatch": {
-      "version": "4.0.4",
-      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.4.tgz",
-      "integrity": "sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=12"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/jonschlinkert"
-      }
-    },
-    "node_modules/prettier": {
-      "version": "3.8.3",
-      "resolved": "https://registry.npmjs.org/prettier/-/prettier-3.8.3.tgz",
-      "integrity": "sha512-7igPTM53cGHMW8xWuVTydi2KO233VFiTNyF5hLJqpilHfmn8C8gPf+PS7dUT64YcXFbiMGZxS9pCSxL/Dxm/Jw==",
-      "dev": true,
-      "license": "MIT",
-      "bin": {
-        "prettier": "bin/prettier.cjs"
-      },
-      "engines": {
-        "node": ">=14"
-      },
-      "funding": {
-        "url": "https://github.com/prettier/prettier?sponsor=1"
-      }
-    },
-    "node_modules/require-from-string": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/require-from-string/-/require-from-string-2.0.2.tgz",
-      "integrity": "sha512-Xf0nWe6RseziFMu+Ap9biiUbmplq6S9/p+7w7YXP/JBHhrUDDUhwa+vANyubuqfZWTveU//DYVGsDG7RKL/vEw==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/tinyglobby": {
-      "version": "0.2.16",
-      "resolved": "https://registry.npmjs.org/tinyglobby/-/tinyglobby-0.2.16.tgz",
-      "integrity": "sha512-pn99VhoACYR8nFHhxqix+uvsbXineAasWm5ojXoN8xEwK5Kd3/TrhNn1wByuD52UxWRLy8pu+kRMniEi6Eq9Zg==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "fdir": "^6.5.0",
-        "picomatch": "^4.0.4"
-      },
-      "engines": {
-        "node": ">=12.0.0"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/SuperchupuDev"
-      }
-    },
-    "node_modules/typescript": {
-      "version": "5.9.3",
-      "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.9.3.tgz",
-      "integrity": "sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw==",
-      "dev": true,
-      "license": "Apache-2.0",
-      "bin": {
-        "tsc": "bin/tsc",
-        "tsserver": "bin/tsserver"
-      },
-      "engines": {
-        "node": ">=14.17"
-      }
-    },
-    "node_modules/undici-types": {
-      "version": "7.16.0",
-      "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-7.16.0.tgz",
-      "integrity": "sha512-Zz+aZWSj8LE6zoxD+xrjh4VfkIG8Ya6LvYkZqtUQGJPZjYl53ypCaUwWqo7eI0x66KBGeRo+mlBEkMSeSZ38Nw==",
-      "dev": true,
-      "license": "MIT"
-    },
-    "node_modules/zod": {
-      "version": "3.25.76",
-      "resolved": "https://registry.npmjs.org/zod/-/zod-3.25.76.tgz",
-      "integrity": "sha512-gzUt/qt81nXsFGKIFcC3YnfEAx5NkunCfnDlvuBSSFS02bcXu4Lmea0AFIUwbLWxWPx3d9p8S5QoaujKcNQxcQ==",
-      "license": "MIT",
-      "funding": {
-        "url": "https://github.com/sponsors/colinhacks"
-      }
-    }
-  }
-}
diff --git a/packages/cultnet-ts/package.json b/packages/cultnet-ts/package.json
index b4c17ade..2f4b74f1 100644
--- a/packages/cultnet-ts/package.json
+++ b/packages/cultnet-ts/package.json
@@ -1,19 +1,32 @@
 {
   "name": "cultnet-ts",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "CultNet-style typed direct-pipe messaging and state replication for TypeScript runtimes.",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "require": "./dist/index.js",
+      "default": "./dist/index.js"
+    },
+    "./contracts": {
+      "types": "./dist/contracts.d.ts",
+      "require": "./dist/contracts.js",
+      "default": "./dist/contracts.js"
+    }
+  },
   "files": [
     "dist",
     "contracts"
   ],
   "scripts": {
     "contracts:generate": "node tools/generate-swarm-contracts.mjs",
-    "build": "npm run contracts:generate && tsc -p tsconfig.json",
-    "typecheck": "npm run contracts:generate && tsc -p tsconfig.json --pretty false",
-    "test": "npm run build && tsc -p tsconfig.test.json && node --test dist-test/test/*.test.js",
-    "test:interop": "npm run build && tsc -p tsconfig.test.json && node --test dist-test/test/interop/*.test.js"
+    "build": "node tools/generate-swarm-contracts.mjs && node ../../node_modules/typescript/bin/tsc -p tsconfig.json",
+    "prepack": "node tools/generate-swarm-contracts.mjs && node ../../node_modules/typescript/bin/tsc -p tsconfig.json",
+    "typecheck": "node tools/generate-swarm-contracts.mjs && node ../../node_modules/typescript/bin/tsc -p tsconfig.json --pretty false",
+    "test": "node tools/generate-swarm-contracts.mjs && node ../../node_modules/typescript/bin/tsc -p tsconfig.json && node ../../node_modules/typescript/bin/tsc -p tsconfig.test.json && node --test dist-test/test/*.test.js",
+    "test:interop": "node tools/generate-swarm-contracts.mjs && node ../../node_modules/typescript/bin/tsc -p tsconfig.json && node ../../node_modules/typescript/bin/tsc -p tsconfig.test.json && node --test --test-force-exit dist-test/test/interop/*.test.js"
   },
   "keywords": [
     "messagepack",
@@ -25,10 +38,22 @@
   ],
   "author": "metacratic",
   "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/GameCult/CultLib.git",
+    "directory": "packages/cultnet-ts"
+  },
+  "bugs": {
+    "url": "https://github.com/GameCult/CultLib/issues"
+  },
+  "homepage": "https://github.com/GameCult/CultLib/tree/main/packages/cultnet-ts#readme",
+  "engines": {
+    "node": ">=18"
+  },
   "dependencies": {
     "@msgpack/msgpack": "^3.1.3",
     "ajv": "^8.17.1",
-    "cultcache-ts": "file:../cultcache-ts"
+    "@gamecult/cultcache-ts": "^0.14.0"
   },
   "devDependencies": {
     "@types/node": "^24.0.0",
diff --git a/packages/cultnet-ts/src/contracts.ts b/packages/cultnet-ts/src/contracts.ts
index 2e89c025..c71cdcc1 100644
--- a/packages/cultnet-ts/src/contracts.ts
+++ b/packages/cultnet-ts/src/contracts.ts
@@ -18,11 +18,20 @@ import transportProfileSchema from "../contracts/cultnet.transport-profile.schem
 import snapshotRequestSchema from "../contracts/cultnet.snapshot-request.schema.json";
 import snapshotResponseSchema from "../contracts/cultnet.snapshot-response.schema.json";
 import snapshotResponseRawSchema from "../contracts/cultnet.snapshot-response-raw.schema.json";
+import databaseSubscribeSchema from "../contracts/cultnet.database-subscribe.schema.json";
+import databaseUnsubscribeSchema from "../contracts/cultnet.database-unsubscribe.schema.json";
+import databaseChangeRawSchema from "../contracts/cultnet.database-change-raw.schema.json";
 import schemaDescriptorSchema from "../contracts/cultnet.schema-descriptor.schema.json";
 import schemaCatalogRequestSchema from "../contracts/cultnet.schema-catalog-request.schema.json";
 import schemaCatalogResponseSchema from "../contracts/cultnet.schema-catalog-response.schema.json";
 import shardCatalogRequestSchema from "../contracts/cultnet.shard-catalog-request.schema.json";
 import shardCatalogResponseSchema from "../contracts/cultnet.shard-catalog-response.schema.json";
+import operationRequestSchema from "../contracts/cultnet.operation-request.schema.json";
+import operationResponseSchema from "../contracts/cultnet.operation-response.schema.json";
+import verseCatalogRequestSchema from "../contracts/cultmesh.verse-catalog-request.schema.json";
+import verseCatalogResponseSchema from "../contracts/cultmesh.verse-catalog-response.schema.json";
+import sessionOpenSchema from "../contracts/cultmesh.session-open.schema.json";
+import sessionAcceptedSchema from "../contracts/cultmesh.session-accepted.schema.json";
 import ghostlightAgentStateSchema from "../contracts/ghostlight.agent-state.schema.json";
 
 export type CultNetWireContract = "cultnet.schema.v0" | "gamecult.networking.v0";
@@ -42,10 +51,19 @@ export type CultNetSchemaVersion =
   | "cultnet.snapshot_request.v0"
   | "cultnet.snapshot_response.v0"
   | "cultnet.snapshot_response_raw.v0"
+  | "cultnet.database_subscribe.v0"
+  | "cultnet.database_unsubscribe.v0"
+  | "cultnet.database_change_raw.v0"
   | "cultnet.schema_catalog_request.v0"
   | "cultnet.schema_catalog_response.v0"
   | "cultnet.shard_catalog_request.v0"
-  | "cultnet.shard_catalog_response.v0";
+  | "cultnet.shard_catalog_response.v0"
+  | "cultnet.operation_request.v0"
+  | "cultnet.operation_response.v0"
+  | "cultmesh.verse_catalog_request.v0"
+  | "cultmesh.verse_catalog_response.v0"
+  | "cultmesh.session_open.v2"
+  | "cultmesh.session_accepted.v2";
 
 export type CultNetSchemaKind = "wire_message" | "document_payload" | "shared_contract";
 export type CultNetRawPayloadEncoding = "messagepack";
@@ -176,6 +194,9 @@ export interface CultNetDocumentDeleteMessage {
 
 export interface CultNetRawDocumentRecord {
   schemaId: string;
+  schemaName?: string;
+  schemaVersion?: string;
+  schemaContentHash?: string;
   recordKey: string;
   storedAt: string;
   payloadEncoding: CultNetRawPayloadEncoding;
@@ -213,6 +234,34 @@ export interface CultNetSnapshotResponseRawMessage {
   documents: CultNetRawDocumentRecord[];
 }
 
+export interface CultNetDatabaseSubscribeMessage {
+  schemaVersion: "cultnet.database_subscribe.v0";
+  messageId: string;
+  subscriptionId: string;
+  schemaIds?: string[];
+  recordKeys?: string[];
+  includeSnapshot: boolean;
+  consumerRuntimeId?: string;
+  bodyIds?: string[];
+  supportedBodyTransports?: string[];
+}
+
+export interface CultNetDatabaseUnsubscribeMessage {
+  schemaVersion: "cultnet.database_unsubscribe.v0";
+  messageId: string;
+  subscriptionId: string;
+}
+
+export interface CultNetDatabaseChangeRawMessage {
+  schemaVersion: "cultnet.database_change_raw.v0";
+  messageId: string;
+  subscriptionId: string;
+  changeKind: "added" | "updated" | "removed";
+  document?: CultNetRawDocumentRecord;
+  recordKey?: string;
+  schemaId?: string;
+}
+
 export interface CultNetSchemaDescriptor {
   schemaId: string;
   kind: CultNetSchemaKind;
@@ -265,6 +314,108 @@ export interface CultNetShardCatalogResponseMessage {
   shards: CultNetShardDescriptor[];
 }
 
+export interface CultNetOperationRequestMessage {
+  schemaVersion: "cultnet.operation_request.v0";
+  messageId: string;
+  serviceId: string;
+  operation: string;
+  payloadSchema: string;
+  payloadEncoding?: "messagepack-base64";
+  payload: string;
+  sourceRuntimeId?: string;
+  targetRuntimeId?: string;
+}
+
+export interface CultNetOperationResponseMessage {
+  schemaVersion: "cultnet.operation_response.v0";
+  messageId: string;
+  serviceId: string;
+  operation: string;
+  status: string;
+  payloadSchema: string;
+  payloadEncoding?: "messagepack-base64";
+  payload: string;
+  diagnostics?: string[];
+  sourceRuntimeId?: string;
+}
+
+export interface CultMeshVerseCompatibilityMessage {
+  transportVersion: string;
+  rulesHash: string;
+  compatibleVerseIds: string[];
+  requiredPluginIds: string[];
+  optionalPluginIds: string[];
+}
+
+export interface CultMeshVerseDescriptorMessage {
+  verseId: string;
+  displayName: string;
+  authorityModel: string;
+  compatibility: CultMeshVerseCompatibilityMessage;
+  discoveryEndpoints: string[];
+  authorityRuntimeIds: string[];
+  authorityRoutes?: CultMeshAuthorityRouteMessage[];
+  parentVerseId?: string;
+  description?: string;
+}
+
+export interface CultMeshAuthorityRouteMessage {
+  authorityRuntimeId: string;
+  endpoint: string;
+  protocolIds: string[];
+  priority: number;
+  generation: string;
+  certificate?: CultMeshRouteCertificateMessage;
+}
+
+export interface CultMeshRouteCertificateMessage {
+  providerKeyId: string;
+  providerPublicKeyX: string;
+  providerPublicKeyY: string;
+  odinKeyId: string;
+  issuedAtUnixMilliseconds: number;
+  expiresAtUnixMilliseconds: number;
+  signature: string;
+}
+
+export interface CultMeshSessionOpenMessage {
+  schemaVersion: "cultmesh.session_open.v2";
+  messageId: string;
+  sourceRuntimeId: string;
+  verseId: string;
+  authorityRuntimeId: string;
+  protocolId: string;
+  routeGeneration: string;
+  clientNonce: string;
+}
+
+export interface CultMeshSessionAcceptedMessage {
+  schemaVersion: "cultmesh.session_accepted.v2";
+  messageId: string;
+  accepted: boolean;
+  verseId: string;
+  authorityRuntimeId: string;
+  protocolId: string;
+  routeGeneration: string;
+  clientNonce: string;
+  providerKeyId: string;
+  providerSignature: string;
+  error?: string;
+}
+
+export interface CultMeshVerseCatalogRequestMessage {
+  schemaVersion: "cultmesh.verse_catalog_request.v0";
+  messageId: string;
+  verseIds?: string[];
+  transportVersion?: string;
+}
+
+export interface CultMeshVerseCatalogResponseMessage {
+  schemaVersion: "cultmesh.verse_catalog_response.v0";
+  messageId: string;
+  verses: CultMeshVerseDescriptorMessage[];
+}
+
 export interface GhostlightPressure {
   pressure_id: string;
   label: string;
@@ -506,10 +657,19 @@ export type CultNetMessage =
   | CultNetSnapshotRequestMessage
   | CultNetSnapshotResponseMessage
   | CultNetSnapshotResponseRawMessage
+  | CultNetDatabaseSubscribeMessage
+  | CultNetDatabaseUnsubscribeMessage
+  | CultNetDatabaseChangeRawMessage
   | CultNetSchemaCatalogRequestMessage
   | CultNetSchemaCatalogResponseMessage
   | CultNetShardCatalogRequestMessage
-  | CultNetShardCatalogResponseMessage;
+  | CultNetShardCatalogResponseMessage
+  | CultNetOperationRequestMessage
+  | CultNetOperationResponseMessage
+  | CultMeshVerseCatalogRequestMessage
+  | CultMeshVerseCatalogResponseMessage
+  | CultMeshSessionOpenMessage
+  | CultMeshSessionAcceptedMessage;
 
 const ajv = new Ajv2020({
   allErrors: true,
@@ -531,10 +691,19 @@ const CULTNET_MESSAGE_SCHEMAS = [
   snapshotRequestSchema,
   snapshotResponseSchema,
   snapshotResponseRawSchema,
+  databaseSubscribeSchema,
+  databaseUnsubscribeSchema,
+  databaseChangeRawSchema,
   schemaCatalogRequestSchema,
   schemaCatalogResponseSchema,
   shardCatalogRequestSchema,
   shardCatalogResponseSchema,
+  operationRequestSchema,
+  operationResponseSchema,
+  verseCatalogRequestSchema,
+  verseCatalogResponseSchema,
+  sessionOpenSchema,
+  sessionAcceptedSchema,
 ] as const;
 
 const cultNetValidators = new Map<CultNetSchemaVersion, ValidateFunction>();
@@ -587,6 +756,11 @@ export function parseCultNetMessage(input: unknown, wireContract: CultNetWireCon
     return input as CultNetSnapshotResponseRawMessage;
   }
 
+  if (schemaVersion === "cultnet.database_change_raw.v0") {
+    validateDatabaseChangeRawMessage(input);
+    return input as CultNetDatabaseChangeRawMessage;
+  }
+
   if (!validator(input)) {
     const keys = Object.keys(input as Record<string, unknown>).join(",");
     throw new Error(`${renderValidationErrors(schemaVersion, validator)}; keys=${keys}`);
@@ -873,8 +1047,11 @@ function encodeLegacySchemaDescriptor(schema: CultNetSchemaDescriptor): Record<s
 }
 
 function encodeBase64Url(input: Uint8Array): string {
-  return Buffer.from(input)
-    .toString("base64")
+  let binary = "";
+  for (let offset = 0; offset < input.length; offset += 0x8000) {
+    binary += String.fromCharCode(...input.subarray(offset, offset + 0x8000));
+  }
+  return btoa(binary)
     .replace(/\+/g, "-")
     .replace(/\//g, "_")
     .replace(/=+$/u, "");
@@ -893,7 +1070,13 @@ function decodeBase64Url(input: string, fieldName: string): Uint8Array {
     ? normalized
     : normalized + "=".repeat(4 - remainder);
 
-  return Buffer.from(padded, "base64");
+  let binary: string;
+  try {
+    binary = atob(padded);
+  } catch (error) {
+    throw new Error(`${fieldName} must be valid base64url data.`, { cause: error });
+  }
+  return Uint8Array.from(binary, character => character.charCodeAt(0));
 }
 
 function validateDocumentPutRawMessage(input: unknown): asserts input is CultNetDocumentPutRawMessage {
@@ -918,9 +1101,39 @@ function validateSnapshotResponseRawMessage(
   });
 }
 
+function validateDatabaseChangeRawMessage(
+  input: unknown,
+): asserts input is CultNetDatabaseChangeRawMessage {
+  const candidate = validateBinaryMessageRoot(input, "cultnet.database_change_raw.v0");
+  requireNonEmptyString(candidate.subscriptionId, "/subscriptionId");
+  if (candidate.changeKind !== "added" &&
+      candidate.changeKind !== "updated" &&
+      candidate.changeKind !== "removed") {
+    throw new Error(
+      "Validation failed for cultnet.database_change_raw.v0: /changeKind: must be added, updated, or removed",
+    );
+  }
+
+  if (candidate.changeKind === "removed") {
+    requireNonEmptyString(candidate.recordKey, "/recordKey");
+    requireNonEmptyString(candidate.schemaId, "/schemaId");
+    return;
+  }
+
+  if (!("document" in candidate)) {
+    throw new Error(
+      "Validation failed for cultnet.database_change_raw.v0: /document: is required for added or updated changes",
+    );
+  }
+  validateRawDocumentRecord(candidate.document, "/document");
+}
+
 function validateBinaryMessageRoot(
   input: unknown,
-  schemaVersion: "cultnet.document_put_raw.v0" | "cultnet.snapshot_response_raw.v0",
+  schemaVersion:
+    | "cultnet.document_put_raw.v0"
+    | "cultnet.snapshot_response_raw.v0"
+    | "cultnet.database_change_raw.v0",
 ): Record<string, unknown> {
   if (!input || typeof input !== "object") {
     throw new Error(`Validation failed for ${schemaVersion}: /: must be an object`);
@@ -947,6 +1160,9 @@ function validateRawDocumentRecord(
 
   const candidate = input as Record<string, unknown>;
   requireNonEmptyString(candidate.schemaId, `${instancePath}/schemaId`);
+  requireOptionalNonEmptyString(candidate.schemaName, `${instancePath}/schemaName`);
+  requireOptionalNonEmptyString(candidate.schemaVersion, `${instancePath}/schemaVersion`);
+  requireOptionalNonEmptyString(candidate.schemaContentHash, `${instancePath}/schemaContentHash`);
   requireNonEmptyString(candidate.recordKey, `${instancePath}/recordKey`);
   requireNonEmptyString(candidate.storedAt, `${instancePath}/storedAt`);
   if (candidate.payloadEncoding !== "messagepack") {
@@ -1010,6 +1226,34 @@ function normalizeCultNetOptionalNulls(
       acceptLegacyPropertyName(candidate, "ShardEpoch", "shardEpoch");
       stripNullProperties(candidate, ["schemaIds", "recordKeys", "shardId", "shardEpoch"]);
       return;
+    case "cultnet.database_subscribe.v0":
+      stripNullProperties(candidate, [
+        "schemaIds",
+        "recordKeys",
+        "consumerRuntimeId",
+        "bodyIds",
+        "supportedBodyTransports",
+      ]);
+      return;
+    case "cultnet.operation_request.v0":
+      stripNullProperties(candidate, ["payloadEncoding", "sourceRuntimeId", "targetRuntimeId"]);
+      return;
+    case "cultnet.operation_response.v0":
+      stripNullProperties(candidate, ["payloadEncoding", "diagnostics", "sourceRuntimeId"]);
+      return;
+    case "cultmesh.verse_catalog_request.v0":
+      stripNullProperties(candidate, ["verseIds", "transportVersion"]);
+      return;
+    case "cultmesh.verse_catalog_response.v0":
+      for (const verse of Array.isArray(candidate.verses) ? candidate.verses : []) {
+        if (verse && typeof verse === "object") {
+          stripNullProperties(verse as Record<string, unknown>, ["parentVerseId", "description"]);
+        }
+      }
+      return;
+    case "cultmesh.session_accepted.v2":
+      stripNullProperties(candidate, ["error"]);
+      return;
     case "cultnet.schema_catalog_request.v0":
       stripNullProperties(candidate, ["schemaIds", "kinds"]);
       return;
@@ -1059,10 +1303,15 @@ export const cultNetSchemas = {
   snapshotRequestSchema,
   snapshotResponseSchema,
   snapshotResponseRawSchema,
+  databaseSubscribeSchema,
+  databaseUnsubscribeSchema,
+  databaseChangeRawSchema,
   schemaDescriptorSchema,
   schemaCatalogRequestSchema,
   schemaCatalogResponseSchema,
   shardCatalogRequestSchema,
   shardCatalogResponseSchema,
+  operationRequestSchema,
+  operationResponseSchema,
   ghostlightAgentStateSchema,
 } as const;
diff --git a/packages/cultnet-ts/src/index.ts b/packages/cultnet-ts/src/index.ts
index 5d0ecf99..140526c5 100644
--- a/packages/cultnet-ts/src/index.ts
+++ b/packages/cultnet-ts/src/index.ts
@@ -8,12 +8,17 @@ export {
   type CultNetDocumentPutMessage,
   type CultNetDocumentPutRawMessage,
   type CultNetDocumentRecord,
+  type CultNetDatabaseSubscribeMessage,
+  type CultNetDatabaseUnsubscribeMessage,
+  type CultNetDatabaseChangeRawMessage,
   type CultNetRawDocumentRecord,
   type CultNetRawPayloadEncoding,
   type CultNetErrorMessage,
   type CultNetHelloMessage,
   type CultNetLoginMessage,
   type CultNetLoginSuccessMessage,
+  type CultNetOperationRequestMessage,
+  type CultNetOperationResponseMessage,
   type CultNetMessage,
   type CultNetRegisterMessage,
   type CultNetSampleChangeNameMessage,
@@ -78,6 +83,7 @@ export {
   createRudpTransportProfile,
   decodeRudpPacket,
   encodeRudpPacket,
+  CULTNET_RUDP_RELIABLE_SEND_WINDOW_PACKETS,
   CultNetRudpReconnectLoop,
   CultNetRudpSession,
   CultNetRudpSocketTransportConnection,
@@ -91,6 +97,13 @@ export {
   type CultNetRudpSessionOptions,
   type RudpTransportProfileOptions,
 } from "./rudp";
+export {
+  invokeCultNetOperation,
+  startCultNetOperationServer,
+  type CultNetOperationClientOptions,
+  type CultNetOperationServer,
+  type CultNetOperationServerOptions,
+} from "./operation-service";
 export {
   defineJsonSchemaContract,
   type JsonSchemaContract,
@@ -131,3 +144,33 @@ export {
   validateGhostlightAgentStateGenerated,
   type GhostlightAgentStateShape,
 } from "./generated/swarm-contracts.generated";
+export {
+  CULTNET_RUDP_PROTOCOL_ID,
+  createSignedDaemonHealthPublisher,
+  parseEndpoint as parseDaemonHealthEndpoint,
+  publishSignedDaemonHealth,
+  signedDaemonHealthPayload,
+  signedDaemonHealthSigningMessage,
+  type DaemonHealth,
+  type SignedDaemonHealthContract,
+  type SignedDaemonHealthPublisher,
+  type SignedDaemonHealthPublisherOptions,
+} from "./signed-daemon-health";
+
+export {
+  GAMECULT_RUNTIME_ACTIVATION_PROOF_SIGNING_PURPOSE,
+  GAMECULT_RUNTIME_PRESENCE_HEALTH_SCHEMA,
+  GAMECULT_RUNTIME_PRESENCE_HEALTH_SIGNING_PURPOSE,
+  GAMECULT_RUNTIME_PRESENCE_IDENTITY_NAME,
+  IDUNN_RUNTIME_ACTIVATION_CREDENTIAL_NAME,
+  RUNTIME_PRESENCE_FIELD_COUNT,
+  RUNTIME_PRESENCE_SLOT,
+  encodeRuntimePresenceHealth,
+  runtimePresenceActivationSigningMessage,
+  runtimePresenceProofPayload,
+  runtimePresenceProviderSigningMessage,
+  validateRuntimePresence,
+  type GameCultRuntimeCapability,
+  type RuntimePresenceHealth,
+  type RuntimePresenceState,
+} from "./runtime-presence-health";
diff --git a/packages/cultnet-ts/src/json-schema-contract.ts b/packages/cultnet-ts/src/json-schema-contract.ts
index b97a6762..4d8fb85d 100644
--- a/packages/cultnet-ts/src/json-schema-contract.ts
+++ b/packages/cultnet-ts/src/json-schema-contract.ts
@@ -1,5 +1,5 @@
 import Ajv2020, { type ErrorObject, type ValidateFunction } from "ajv/dist/2020";
-import type { CultCacheSchema } from "cultcache-ts";
+import type { CultCacheSchema } from "@gamecult/cultcache-ts";
 
 export interface JsonSchemaContract<TValue> extends CultCacheSchema<TValue> {
   readonly schemaId: string;
diff --git a/packages/cultnet-ts/src/operation-service.ts b/packages/cultnet-ts/src/operation-service.ts
new file mode 100644
index 00000000..ee13457f
--- /dev/null
+++ b/packages/cultnet-ts/src/operation-service.ts
@@ -0,0 +1,202 @@
+import { createSocket, type RemoteInfo, type Socket } from "node:dgram";
+import { decode, encode } from "@msgpack/msgpack";
+
+import {
+  encodeCultNetMessageForWire,
+  parseCultNetMessage,
+  type CultNetOperationRequestMessage,
+  type CultNetOperationResponseMessage,
+} from "./contracts";
+import {
+  CultNetRudpSession,
+  CultNetRudpSocketTransportConnection,
+  decodeRudpPacket,
+  encodeRudpPacket,
+  type CultNetRudpPacket,
+} from "./rudp";
+import { CultNetPeer } from "./peer";
+
+const DEFAULT_CONNECTION_ID = 0x43554c54;
+
+export interface CultNetOperationServerOptions {
+  runtimeId: string;
+  host?: string;
+  port?: number;
+  connectionId?: number;
+  maxFragmentBytes?: number;
+  handler: (request: CultNetOperationRequestMessage) =>
+    CultNetOperationResponseMessage | Promise<CultNetOperationResponseMessage>;
+}
+
+export interface CultNetOperationServer {
+  readonly endpoint: string;
+  close(): Promise<void>;
+}
+
+export interface CultNetOperationClientOptions {
+  runtimeId: string;
+  connectionId?: number;
+  timeoutMs?: number;
+  maxFragmentBytes?: number;
+}
+
+interface RemoteSession {
+  session: CultNetRudpSession;
+  remote: RemoteInfo;
+}
+
+export async function startCultNetOperationServer(
+  options: CultNetOperationServerOptions,
+): Promise<CultNetOperationServer> {
+  if (!options.runtimeId) throw new Error("CultNet operation server requires runtimeId.");
+  if (!options.handler) throw new Error("CultNet operation server requires a handler.");
+  const socket = createSocket("udp4");
+  const connectionId = options.connectionId ?? DEFAULT_CONNECTION_ID;
+  const sessions = new Map<string, RemoteSession>();
+  const sendPacket = (remote: RemoteInfo, packet: CultNetRudpPacket): void => {
+    const wire = encodeRudpPacket(packet);
+    socket.send(wire, remote.port, remote.address);
+  };
+  socket.on("message", (wire, remote) => {
+    void handleServerDatagram(socket, sessions, connectionId, options, wire, remote, sendPacket);
+  });
+  await bindSocket(socket, options.port ?? 0, options.host ?? "127.0.0.1");
+  const resendTimer = setInterval(() => {
+    for (const peer of sessions.values()) {
+      for (const packet of peer.session.dueResends(Date.now())) sendPacket(peer.remote, packet);
+    }
+  }, 25);
+  resendTimer.unref?.();
+  const address = socket.address();
+  const endpoint = `rudp://${address.address}:${address.port}`;
+  return {
+    endpoint,
+    close: async () => {
+      clearInterval(resendTimer);
+      await closeSocket(socket);
+    },
+  };
+}
+
+export async function invokeCultNetOperation(
+  endpoint: string,
+  request: CultNetOperationRequestMessage,
+  options: CultNetOperationClientOptions,
+): Promise<CultNetOperationResponseMessage> {
+  const target = parseRudpEndpoint(endpoint);
+  const socket = createSocket("udp4");
+  await bindSocket(socket, 0, "127.0.0.1");
+  const transport = new CultNetRudpSocketTransportConnection({
+    mode: "client",
+    runtimeId: options.runtimeId,
+    transportId: `${options.runtimeId}.operations`,
+    socket,
+    remoteHost: target.host,
+    remotePort: target.port,
+    connectionId: options.connectionId ?? DEFAULT_CONNECTION_ID,
+    maxFragmentBytes: options.maxFragmentBytes ?? 2048,
+  });
+  const peer = new CultNetPeer(transport, { wireContract: "cultnet.schema.v0" });
+  const timeoutMs = options.timeoutMs ?? 10_000;
+  try {
+    transport.connect();
+    await waitUntil(() => transport.connected, timeoutMs, "CultNet operation connection timed out.");
+    return await new Promise<CultNetOperationResponseMessage>((resolve, reject) => {
+      const timer = setTimeout(() => reject(new Error("CultNet operation response timed out.")), timeoutMs);
+      const onMessage = (message: unknown): void => {
+        const candidate = message as CultNetOperationResponseMessage;
+        if (candidate.schemaVersion !== "cultnet.operation_response.v0" || candidate.messageId !== request.messageId) return;
+        clearTimeout(timer);
+        peer.off("message", onMessage);
+        resolve(candidate);
+      };
+      peer.on("message", onMessage);
+      peer.send(request);
+    });
+  } finally {
+    transport.close();
+  }
+}
+
+async function handleServerDatagram(
+  socket: Socket,
+  sessions: Map<string, RemoteSession>,
+  connectionId: number,
+  options: CultNetOperationServerOptions,
+  wire: Buffer,
+  remote: RemoteInfo,
+  sendPacket: (remote: RemoteInfo, packet: CultNetRudpPacket) => void,
+): Promise<void> {
+  let packet: CultNetRudpPacket;
+  try {
+    packet = decodeRudpPacket(wire);
+  } catch {
+    return;
+  }
+  if (packet.connectionId !== connectionId) return;
+  const key = `${remote.address}:${remote.port}`;
+  let peer = sessions.get(key);
+  if (packet.packetType === "connect") {
+    peer = { session: new CultNetRudpSession({ connectionId, resendDelayMs: 25 }), remote };
+    sessions.set(key, peer);
+    sendPacket(remote, peer.session.acceptConnect(packet, Date.now(), encode("cultnet-operation-service")));
+    return;
+  }
+  if (!peer) return;
+  const result = peer.session.receive(packet, Date.now());
+  if (result.reply) sendPacket(remote, result.reply);
+  for (const ready of result.readyToSend ?? []) sendPacket(remote, ready);
+  if (result.disconnected) {
+    sessions.delete(key);
+    return;
+  }
+  for (const frame of result.delivered) {
+    if (frame.channelId !== "schema") continue;
+    const message = parseCultNetMessage(decode(frame.payload));
+    if (message.schemaVersion !== "cultnet.operation_request.v0") continue;
+    const response = await options.handler(message);
+    const payload = encode(encodeCultNetMessageForWire(response, "cultnet.schema.v0"));
+    for (const responsePacket of peer.session.sendMany("schema", payload, {
+      reliable: true,
+      ordered: true,
+      nowMs: Date.now(),
+      maxFragmentBytes: options.maxFragmentBytes ?? 2048,
+    })) sendPacket(remote, responsePacket);
+  }
+  if (packet.packetType === "data" || result.delivered.length > 0) {
+    sendPacket(remote, peer.session.createAckForReceived(packet.sequence));
+  }
+}
+
+function parseRudpEndpoint(endpoint: string): { host: string; port: number } {
+  const url = new URL(endpoint);
+  if (url.protocol !== "rudp:") throw new Error(`CultNet operation endpoint must use rudp://: ${endpoint}`);
+  const port = Number(url.port);
+  if (!url.hostname || !Number.isInteger(port) || port <= 0) throw new Error(`Invalid CultNet operation endpoint: ${endpoint}`);
+  return { host: url.hostname, port };
+}
+
+function bindSocket(socket: Socket, port: number, host: string): Promise<void> {
+  return new Promise((resolve, reject) => {
+    socket.once("error", reject);
+    socket.bind(port, host, () => {
+      socket.off("error", reject);
+      resolve();
+    });
+  });
+}
+
+function closeSocket(socket: Socket): Promise<void> {
+  return new Promise(resolve => {
+    if (!socket.address()) return resolve();
+    socket.close(() => resolve());
+  });
+}
+
+async function waitUntil(check: () => boolean, timeoutMs: number, message: string): Promise<void> {
+  const deadline = Date.now() + timeoutMs;
+  while (!check()) {
+    if (Date.now() >= deadline) throw new Error(message);
+    await new Promise(resolve => setTimeout(resolve, 5));
+  }
+}
diff --git a/packages/cultnet-ts/src/peer.ts b/packages/cultnet-ts/src/peer.ts
index 816fcfd6..0e54ee58 100644
--- a/packages/cultnet-ts/src/peer.ts
+++ b/packages/cultnet-ts/src/peer.ts
@@ -106,6 +106,10 @@ export class CultNetPeer extends EventEmitter {
     this.#stream?.write(encodeFrame(payload));
   }
 
+  async flush(timeoutMs?: number): Promise<void> {
+    await this.#transport?.flush?.(timeoutMs);
+  }
+
   sendHello(message: CultNetHelloMessage): void {
     this.send(message);
   }
diff --git a/packages/cultnet-ts/src/replication.ts b/packages/cultnet-ts/src/replication.ts
index 600a21e3..77dab70f 100644
--- a/packages/cultnet-ts/src/replication.ts
+++ b/packages/cultnet-ts/src/replication.ts
@@ -6,7 +6,7 @@ import type {
   CultCacheDocumentFormatter,
   CultCacheDocumentValue,
   CultCacheEnvelope,
-} from "cultcache-ts";
+} from "@gamecult/cultcache-ts";
 
 import {
   type CultNetDocumentDeleteMessage,
@@ -57,7 +57,15 @@ export class CultNetDocumentRegistry {
   }
 
   getBySchemaId(schemaId: string): CultNetDocumentBinding | undefined {
-    return this.#schemaBindings.get(schemaId);
+    const exact = this.#schemaBindings.get(schemaId);
+    if (exact) {
+      return exact;
+    }
+
+    const requestedSchemaIds = new Set([schemaId]);
+    return this.#uniqueBindings().find(binding =>
+      schemaMatchesBinding(schemaIdForBinding(binding), binding, requestedSchemaIds),
+    );
   }
 
   createDocumentPutMessage<TDefinition extends AnyCultCacheDocumentDefinition>(
@@ -159,7 +167,7 @@ export class CultNetDocumentRegistry {
       const binding = this.#requireBinding(envelope.type);
       const schemaId = schemaIdForEnvelope(envelope, binding);
 
-      if (requestedSchemaIds && !requestedSchemaIds.has(schemaId)) {
+      if (requestedSchemaIds && !schemaMatchesBinding(schemaId, binding, requestedSchemaIds)) {
         continue;
       }
 
@@ -196,7 +204,7 @@ export class CultNetDocumentRegistry {
       const binding = this.#requireBinding(envelope.type);
       const schemaId = schemaIdForEnvelope(envelope, binding);
 
-      if (requestedSchemaIds && !requestedSchemaIds.has(schemaId)) {
+      if (requestedSchemaIds && !schemaMatchesBinding(schemaId, binding, requestedSchemaIds)) {
         continue;
       }
 
@@ -238,11 +246,14 @@ export class CultNetDocumentRegistry {
     cache: CultCache,
     message: CultNetDocumentPutRawMessage,
   ): Promise<unknown> {
-    const binding = this.#requireSchemaBinding(message.document.schemaId);
+    const resolution = this.#resolveRawDocumentBinding(message.document);
+    const { binding } = resolution;
     return cache.putEnvelope(binding.definition, {
       key: message.document.recordKey,
       type: binding.definition.type,
-      schemaId: message.document.schemaId,
+      schemaId: resolution.preserveIncomingSchemaId
+        ? message.document.schemaId
+        : schemaIdForBinding(binding),
       payload: new Uint8Array(message.document.payload),
       storedAt: message.document.storedAt,
     });
@@ -292,6 +303,35 @@ export class CultNetDocumentRegistry {
     return binding;
   }
 
+  #resolveRawDocumentBinding(document: CultNetRawDocumentRecord): {
+    binding: CultNetDocumentBinding;
+    preserveIncomingSchemaId: boolean;
+  } {
+    const exact = this.getBySchemaId(document.schemaId);
+    if (exact) {
+      return { binding: exact, preserveIncomingSchemaId: true };
+    }
+
+    const payload = new Uint8Array(document.payload);
+    for (const binding of this.#uniqueBindings()) {
+      try {
+        decodeDocumentValue(binding.definition, payload);
+        return { binding, preserveIncomingSchemaId: false };
+      } catch {
+        // Keep looking; a foreign schema id is acceptable only when the payload validates locally.
+      }
+    }
+
+    throw new Error(`No CultNet document binding is registered for schema "${document.schemaId}".`);
+  }
+
+  #uniqueBindings(): CultNetDocumentBinding[] {
+    return [...new Set([
+      ...this.#schemaBindings.values(),
+      ...this.#bindings.values(),
+    ])];
+  }
+
   #createRawDocumentRecord(envelope: CultCacheEnvelope): CultNetRawDocumentRecord {
     const binding = this.#requireBinding(envelope.type);
     return {
@@ -308,6 +348,42 @@ function schemaIdForBinding(binding: CultNetDocumentBinding): string {
   return binding.definition.schemaId ?? binding.definition.type;
 }
 
+function schemaMatchesBinding(
+  schemaId: string,
+  binding: CultNetDocumentBinding,
+  requestedSchemaIds: Set<string>,
+): boolean {
+  if (requestedSchemaIds.has(schemaId)) {
+    return true;
+  }
+
+  const definition = binding.definition;
+  if (definition.schemaId && requestedSchemaIds.has(definition.schemaId)) {
+    return true;
+  }
+  if (definition.schemaName && requestedSchemaIds.has(definition.schemaName)) {
+    return true;
+  }
+  if (definition.schemaVersion && requestedSchemaIds.has(definition.schemaVersion)) {
+    return true;
+  }
+  if (definition.compatibleSchemaIds?.some(candidate => requestedSchemaIds.has(candidate))) {
+    return true;
+  }
+
+  return Array.from(requestedSchemaIds)
+    .some(candidate => inferSchemaName(candidate) === definition.schemaName);
+}
+
+function inferSchemaName(schemaId: string): string | undefined {
+  const marker = schemaId.lastIndexOf(".v");
+  if (marker <= 0 || marker + 2 >= schemaId.length) {
+    return undefined;
+  }
+  const version = schemaId.slice(marker + 2);
+  return /^\d+$/u.test(version) ? schemaId.slice(0, marker) : undefined;
+}
+
 function schemaIdForEnvelope(
   envelope: CultCacheEnvelope,
   binding: CultNetDocumentBinding,
diff --git a/packages/cultnet-ts/src/rudp.ts b/packages/cultnet-ts/src/rudp.ts
index 54b85e83..56dc67fa 100644
--- a/packages/cultnet-ts/src/rudp.ts
+++ b/packages/cultnet-ts/src/rudp.ts
@@ -16,6 +16,8 @@ const RUDP_MAGIC = [0x43, 0x4e, 0x52, 0x30] as const; // CNR0
 const RUDP_VERSION = 0;
 const RUDP_FIXED_HEADER_BYTES = 36;
 const MAX_CHANNEL_ID_BYTES = 255;
+export const CULTNET_RUDP_RELIABLE_SEND_WINDOW_PACKETS = 32;
+const RUDP_RECEIVED_SEQUENCE_WINDOW = 4_096;
 
 export type CultNetRudpPacketType =
   | "connect"
@@ -57,6 +59,7 @@ export interface CultNetRudpSessionOptions {
 
 export interface CultNetRudpReceiveResult {
   delivered: CultNetRudpDeliveredFrame[];
+  readyToSend?: CultNetRudpPacket[];
   reply?: CultNetRudpPacket;
   pong?: boolean;
   pongPayload?: Uint8Array;
@@ -144,16 +147,25 @@ export class CultNetRudpSession {
   readonly connectionId: number;
   readonly resendDelayMs: number;
   #nextSequence: number;
+  readonly #nextSequencedByChannel = new Map<string, number>();
   #nextFragmentId = 1;
   #connected = false;
   readonly #maxPendingReliablePackets: number | undefined;
   #lastReceivedAtMs: number | undefined;
   #highestReceivedSequence: number | undefined;
   readonly #receivedSequences = new Set<number>();
+  readonly #latestSequencedByChannel = new Map<string, number>();
   readonly #pendingReliable = new Map<number, PendingReliablePacket>();
+  readonly #queuedReliable: CultNetRudpPacket[] = [];
   readonly #orderedNextSequenceByChannel = new Map<string, number>();
   readonly #orderedBuffers = new Map<string, Map<number, PendingOrderedFrame>>();
   readonly #fragmentBuffers = new Map<string, FragmentBuffer>();
+  /// Matches cultnet-rs's `max_pending_fragment_sets`. A fragment set is only
+  /// removed on successful reassembly, so a set that loses one fragment is
+  /// stranded for the life of the session. Without a bound the map grows
+  /// forever under any loss on a fragmenting channel.
+  #maxPendingFragmentSets = 64;
+  #fragmentSetsEvicted = 0;
 
   constructor(options: CultNetRudpSessionOptions) {
     this.connectionId = toUint32(options.connectionId, "connectionId");
@@ -173,10 +185,44 @@ export class CultNetRudpSession {
     return [...this.#pendingReliable.keys()].sort((left, right) => left - right);
   }
 
+  get queuedReliablePacketCount(): number {
+    return this.#queuedReliable.length;
+  }
+
+  get outstandingReliablePacketCount(): number {
+    return this.#pendingReliable.size + this.#queuedReliable.length;
+  }
+
+  /// Incomplete fragment sets dropped to stay within the pending bound.
+  /// Non-zero means the peer is losing fragments: the receiver is still
+  /// serving, and something upstream is not.
+  get fragmentSetsEvicted(): number {
+    return this.#fragmentSetsEvicted;
+  }
+
+  get pendingFragmentSetCount(): number {
+    return this.#fragmentBuffers.size;
+  }
+
   get lastReceivedAtMs(): number | undefined {
     return this.#lastReceivedAtMs;
   }
 
+  resetPeerState(): void {
+    this.#connected = false;
+    this.#lastReceivedAtMs = undefined;
+    this.#highestReceivedSequence = undefined;
+    this.#receivedSequences.clear();
+    this.#nextSequencedByChannel.clear();
+    this.#latestSequencedByChannel.clear();
+    this.#pendingReliable.clear();
+    this.#queuedReliable.splice(0);
+    this.#orderedNextSequenceByChannel.clear();
+    this.#orderedBuffers.clear();
+    this.#fragmentBuffers.clear();
+    this.#fragmentSetsEvicted = 0;
+  }
+
   createConnect(nowMs = 0, payload = new Uint8Array()): CultNetRudpPacket {
     this.#ensureReliableCapacity(1);
     const packet = this.#createPacket({
@@ -196,8 +242,20 @@ export class CultNetRudpSession {
       throw new Error(`Expected RUDP connect packet, got ${packet.packetType}.`);
     }
 
+    const pendingAccept = [...this.#pendingReliable.values()]
+      .find(pending => pending.packet.packetType === "accept");
+    if (pendingAccept) {
+      this.#rememberReceived(packet.sequence);
+      this.#lastReceivedAtMs = nowMs;
+      pendingAccept.lastSentAtMs = nowMs;
+      return {
+        ...pendingAccept.packet,
+        payload: new Uint8Array(pendingAccept.packet.payload ?? new Uint8Array()),
+      };
+    }
     this.#ensureReliableCapacity(1);
     this.#rememberReceived(packet.sequence);
+    this.#lastReceivedAtMs = nowMs;
     this.#connected = true;
     const response = this.#createPacket({
       packetType: "accept",
@@ -215,6 +273,9 @@ export class CultNetRudpSession {
     payload: Uint8Array,
     options: { reliable?: boolean; ordered?: boolean; sequenced?: boolean; nowMs?: number } = {},
   ): CultNetRudpPacket {
+    if (options.reliable && this.#pendingReliable.size >= CULTNET_RUDP_RELIABLE_SEND_WINDOW_PACKETS) {
+      throw new Error("RUDP reliable send window is full; receive acknowledgements before sending.");
+    }
     return this.sendMany(channelId, payload, options)[0]!;
   }
 
@@ -232,6 +293,9 @@ export class CultNetRudpSession {
     if (!this.#connected) {
       throw new Error("Cannot send RUDP data before the session is connected.");
     }
+    if (options.ordered && !options.reliable) {
+      throw new Error("RUDP ordered delivery requires reliability.");
+    }
 
     const maxFragmentBytes = options.maxFragmentBytes;
     if (maxFragmentBytes !== undefined && maxFragmentBytes <= 0) {
@@ -248,10 +312,9 @@ export class CultNetRudpSession {
         ordered: options.ordered,
         sequenced: options.sequenced,
       });
-      if (packet.reliable) {
-        this.#trackReliable(packet, options.nowMs ?? 0);
-      }
-      return [packet];
+      return packet.reliable
+        ? this.#admitReliablePackets([packet], options.nowMs ?? 0)
+        : [packet];
     }
 
     const fragmentCount = Math.ceil(payload.byteLength / maxFragmentBytes);
@@ -275,17 +338,17 @@ export class CultNetRudpSession {
         fragmentIndex: index,
         fragmentCount,
       });
-      if (packet.reliable) {
-        this.#trackReliable(packet, options.nowMs ?? 0);
-      }
       packets.push(packet);
     }
-    return packets;
+    return options.reliable
+      ? this.#admitReliablePackets(packets, options.nowMs ?? 0)
+      : packets;
   }
 
   receive(packet: CultNetRudpPacket, nowMs = 0): CultNetRudpReceiveResult {
     this.#requireConnection(packet);
     this.#applyAcknowledgements(packet);
+    const readyToSend = this.#promoteQueuedReliable(nowMs);
     this.#lastReceivedAtMs = nowMs;
     const expectedSequenceIfUninitialized = this.#highestReceivedSequence === undefined
       ? packet.sequence
@@ -294,13 +357,13 @@ export class CultNetRudpSession {
     if (packet.packetType === "accept") {
       this.#rememberReceived(packet.sequence);
       this.#connected = true;
-      return { delivered: [] };
+      return { delivered: [], readyToSend };
     }
 
     if (packet.packetType === "ping") {
-      this.#rememberReceived(packet.sequence);
       return {
         delivered: [],
+        readyToSend,
         reply: this.#createPacket({
           packetType: "pong",
           channelId: "control",
@@ -310,51 +373,106 @@ export class CultNetRudpSession {
     }
 
     if (packet.packetType === "ack" || packet.packetType === "pong") {
-      this.#rememberReceived(packet.sequence);
       return {
         delivered: [],
+        readyToSend,
         pong: packet.packetType === "pong",
         pongPayload: packet.packetType === "pong" ? packet.payload ?? new Uint8Array() : undefined,
       };
     }
 
     if (packet.packetType === "disconnect") {
-      this.#rememberReceived(packet.sequence);
       this.#connected = false;
       return {
         delivered: [],
+        readyToSend,
         disconnected: true,
         disconnectReason: packet.payload ?? new Uint8Array(),
       };
     }
 
     if (packet.packetType !== "data") {
-      return { delivered: [] };
+      return { delivered: [], readyToSend };
     }
 
-    const isDuplicate = this.#receivedSequences.has(packet.sequence);
-    this.#rememberReceived(packet.sequence);
+    const isDuplicate = (packet.reliable ?? false)
+      && (this.#receivedSequences.has(packet.sequence)
+        || (this.#highestReceivedSequence !== undefined
+          && packet.sequence < this.#highestReceivedSequence
+          && this.#highestReceivedSequence - packet.sequence >= RUDP_RECEIVED_SEQUENCE_WINDOW));
+    if (packet.reliable ?? false) this.#rememberReceived(packet.sequence);
     if (isDuplicate) {
-      return { delivered: [] };
+      return { delivered: [], readyToSend };
     }
 
     const reassembled = this.#reassemble(packet);
     if (!reassembled) {
-      return { delivered: [] };
+      return { delivered: [], readyToSend };
+    }
+
+    if (!reassembled.ordered && (packet.sequenced ?? false)) {
+      const newestSequence = reassembled.nextSequence - 1;
+      const latestSequence = this.#latestSequencedByChannel.get(reassembled.frame.channelId);
+      if (latestSequence !== undefined && newestSequence <= latestSequence) {
+        return { delivered: [], readyToSend };
+      }
+      this.#latestSequencedByChannel.set(reassembled.frame.channelId, newestSequence);
+      return { delivered: [reassembled.frame], readyToSend };
     }
 
     if (!reassembled.ordered) {
-      return { delivered: [reassembled.frame] };
+      return { delivered: [reassembled.frame], readyToSend };
     }
 
-    return { delivered: this.#deliverOrdered(reassembled.frame, reassembled.nextSequence, expectedSequenceIfUninitialized) };
+    return {
+      delivered: this.#deliverOrdered(reassembled.frame, reassembled.nextSequence, expectedSequenceIfUninitialized),
+      readyToSend,
+    };
   }
 
   createAck(): CultNetRudpPacket {
-    return this.#createPacket({
+    const { ack, ackMask } = this.#ackState();
+    return {
       packetType: "ack",
+      connectionId: this.connectionId,
+      sequence: 0,
+      ack,
+      ackMask,
       channelId: "control",
-    });
+      reliable: false,
+      ordered: false,
+      sequenced: false,
+      fragmentId: 0,
+      fragmentIndex: 0,
+      fragmentCount: 0,
+      payload: new Uint8Array(),
+    };
+  }
+
+  createAckFor(sequence: number): CultNetRudpPacket {
+    return {
+      packetType: "ack",
+      connectionId: this.connectionId,
+      sequence: 0,
+      ack: toUint32(sequence, "ack sequence"),
+      ackMask: 0,
+      channelId: "control",
+      reliable: false,
+      ordered: false,
+      sequenced: false,
+      fragmentId: 0,
+      fragmentIndex: 0,
+      fragmentCount: 0,
+      payload: new Uint8Array(),
+    };
+  }
+
+  createAckForReceived(sequence: number): CultNetRudpPacket {
+    const receivedSequence = toUint32(sequence, "received sequence");
+    const { ack } = this.#ackState();
+    return ack >= receivedSequence && ack - receivedSequence <= 32
+      ? this.createAck()
+      : this.createAckFor(receivedSequence);
   }
 
   createPing(payload = new Uint8Array()): CultNetRudpPacket {
@@ -407,8 +525,17 @@ export class CultNetRudpSession {
     fragmentIndex?: number;
     fragmentCount?: number;
   }): CultNetRudpPacket {
-    const sequence = this.#nextSequence;
-    this.#nextSequence = toUint32(this.#nextSequence + 1, "sequence");
+    let sequence = 0;
+    if (packet.reliable ?? false) {
+      sequence = this.#nextSequence;
+      this.#nextSequence = toUint32(this.#nextSequence + 1, "reliable sequence");
+    } else if (packet.sequenced ?? false) {
+      sequence = this.#nextSequencedByChannel.get(packet.channelId) ?? 1;
+      this.#nextSequencedByChannel.set(
+        packet.channelId,
+        toUint32(sequence + 1, "sequenced channel sequence"),
+      );
+    }
     const { ack, ackMask } = this.#ackState();
     return {
       packetType: packet.packetType,
@@ -434,11 +561,26 @@ export class CultNetRudpSession {
     });
   }
 
+  #admitReliablePackets(packets: CultNetRudpPacket[], nowMs: number): CultNetRudpPacket[] {
+    const available = Math.max(0, CULTNET_RUDP_RELIABLE_SEND_WINDOW_PACKETS - this.#pendingReliable.size);
+    const ready = packets.slice(0, available);
+    for (const packet of ready) this.#trackReliable(packet, nowMs);
+    this.#queuedReliable.push(...packets.slice(available));
+    return ready;
+  }
+
+  #promoteQueuedReliable(nowMs: number): CultNetRudpPacket[] {
+    const available = Math.max(0, CULTNET_RUDP_RELIABLE_SEND_WINDOW_PACKETS - this.#pendingReliable.size);
+    const ready = this.#queuedReliable.splice(0, available);
+    for (const packet of ready) this.#trackReliable(packet, nowMs);
+    return ready;
+  }
+
   #ensureReliableCapacity(packetCount: number): void {
     if (packetCount === 0 || this.#maxPendingReliablePackets === undefined) {
       return;
     }
-    if (this.#pendingReliable.size + packetCount > this.#maxPendingReliablePackets) {
+    if (this.outstandingReliablePacketCount + packetCount > this.#maxPendingReliablePackets) {
       throw new Error("RUDP reliable send queue is full.");
     }
   }
@@ -457,6 +599,12 @@ export class CultNetRudpSession {
     if (this.#highestReceivedSequence === undefined || sequence > this.#highestReceivedSequence) {
       this.#highestReceivedSequence = sequence;
     }
+    if (this.#receivedSequences.size > RUDP_RECEIVED_SEQUENCE_WINDOW) {
+      const keepFrom = Math.max(0, (this.#highestReceivedSequence ?? sequence) - RUDP_RECEIVED_SEQUENCE_WINDOW + 1);
+      for (const received of this.#receivedSequences) {
+        if (received < keepFrom) this.#receivedSequences.delete(received);
+      }
+    }
   }
 
   #ackState(): { ack: number; ackMask: number } {
@@ -506,6 +654,20 @@ export class CultNetRudpSession {
         payloads: new Map(),
         sequences: new Map(),
       };
+      // Evict the oldest stranded set rather than refusing the payload. A
+      // receiver that stops accepting fragmented traffic after a bounded
+      // number of losses is a denial of service delivered by the network;
+      // dropping the least recent incomplete set costs one payload that was
+      // already incomplete. Map iteration is insertion-ordered, so the first
+      // key is the oldest.
+      while (this.#fragmentBuffers.size >= this.#maxPendingFragmentSets) {
+        const oldest = this.#fragmentBuffers.keys().next();
+        if (oldest.done) {
+          break;
+        }
+        this.#fragmentBuffers.delete(oldest.value);
+        this.#fragmentSetsEvicted += 1;
+      }
       this.#fragmentBuffers.set(key, buffer);
     }
     if (buffer.fragmentCount !== fragmentCount || buffer.ordered !== (packet.ordered ?? false)) {
@@ -692,6 +854,10 @@ export class CultNetRudpSocketTransportConnection extends EventEmitter implement
     return { ...this.#stats };
   }
 
+  get outstandingReliablePacketCount(): number {
+    return this.#session.outstandingReliablePacketCount;
+  }
+
   connect(payload = new Uint8Array()): void {
     if (this.#mode !== "client") {
       throw new Error("Only a client RUDP socket transport can initiate connect.");
@@ -711,6 +877,21 @@ export class CultNetRudpSocketTransportConnection extends EventEmitter implement
     this.#stats.framesSent += 1;
   }
 
+  async flush(timeoutMs = 30_000): Promise<void> {
+    const deadline = Date.now() + Math.max(0, timeoutMs);
+    while (this.#session.outstandingReliablePacketCount > 0) {
+      if (this.#closed) {
+        throw new Error("RUDP transport closed before reliable packets were acknowledged.");
+      }
+      if (Date.now() >= deadline) {
+        throw new Error(
+          `RUDP reliable flush timed out with ${this.#session.outstandingReliablePacketCount} packets outstanding.`,
+        );
+      }
+      await new Promise(resolve => setTimeout(resolve, 5));
+    }
+  }
+
   ping(payload = new Uint8Array()): void {
     this.#sendPacket(this.#session.createPing(payload));
   }
@@ -727,6 +908,13 @@ export class CultNetRudpSocketTransportConnection extends EventEmitter implement
   close(): void {
     clearInterval(this.#resendTimer);
     if (!this.#closed) {
+      if (this.#session.connected && this.#remoteHost && this.#remotePort !== undefined) {
+        try {
+          this.#sendPacket(this.#session.createDisconnect());
+        } catch {
+          // Best-effort shutdown: close must still release the UDP socket.
+        }
+      }
       this.#closed = true;
       this.#socket.close();
     }
@@ -746,11 +934,17 @@ export class CultNetRudpSocketTransportConnection extends EventEmitter implement
       this.#remoteHost = remote.address;
       this.#remotePort = remote.port;
     } else if (remote.address !== this.#remoteHost || remote.port !== this.#remotePort) {
-      return;
+      if (this.#mode === "server" && packet.packetType === "connect") {
+        this.#remoteHost = remote.address;
+        this.#remotePort = remote.port;
+      } else {
+        return;
+      }
     }
 
     try {
       if (this.#mode === "server" && packet.packetType === "connect") {
+        this.#session.resetPeerState();
         this.#sendPacket(this.#session.acceptConnect(packet, Date.now()));
         return;
       }
@@ -759,6 +953,9 @@ export class CultNetRudpSocketTransportConnection extends EventEmitter implement
       if (result.reply) {
         this.#sendPacket(result.reply);
       }
+      for (const ready of result.readyToSend ?? []) {
+        this.#sendPacket(ready);
+      }
       if (result.pong) {
         this.emit("pong", { payload: result.pongPayload ?? new Uint8Array() });
       }
@@ -774,8 +971,8 @@ export class CultNetRudpSocketTransportConnection extends EventEmitter implement
         this.emit("close");
         return;
       }
-      if (packet.packetType === "accept" || result.delivered.length > 0) {
-        this.#sendPacket(this.#session.createAck());
+      if (packet.packetType === "accept" || packet.packetType === "data" || result.delivered.length > 0) {
+        this.#sendPacket(this.#session.createAckForReceived(packet.sequence));
       }
     } catch (error) {
       this.emit("error", error instanceof Error ? error : new Error(String(error)));
diff --git a/packages/cultnet-ts/src/runtime-presence-health.ts b/packages/cultnet-ts/src/runtime-presence-health.ts
new file mode 100644
index 00000000..8d70da8e
--- /dev/null
+++ b/packages/cultnet-ts/src/runtime-presence-health.ts
@@ -0,0 +1,256 @@
+// Runtime presence health: the dual-proved statement one launched incarnation
+// makes about itself.
+//
+// This is the TypeScript half of `gamecult.runtime_presence_health.v2`, the
+// contract `cultnet-rs` defines in `runtime_authority_contracts.rs`. Odin admits
+// a document as runtime presence only when it carries this schema id and its
+// record key equals the signed target; anything else it files away as an
+// ordinary document, and no topology correlation is ever produced for it.
+//
+// Two proofs cover one payload. The stable provider key says "this service made
+// this statement"; the activation key Idunn hands the process at launch says
+// "and it is the incarnation Idunn started". Neither establishes admission
+// alone, which is why both signature fields are empty in the signed bytes: it
+// avoids a circular signature while binding every authority-bearing field and
+// both signer identities.
+//
+// The wire shape is a positional tuple indexed by the same field slots the Rust
+// derive emits. Field N here is field N there; that correspondence is the whole
+// contract, and the constants below name the slots so it stays checkable.
+
+import { encode } from "@msgpack/msgpack";
+
+export const GAMECULT_RUNTIME_PRESENCE_HEALTH_SCHEMA = "gamecult.runtime_presence_health.v2";
+
+/** Purpose for the stable provider-health signature over the proof payload. */
+export const GAMECULT_RUNTIME_PRESENCE_HEALTH_SIGNING_PURPOSE =
+  "gamecult.runtime_presence_health.v2";
+
+/** Purpose for the activation-scoped proof over the same payload. */
+export const GAMECULT_RUNTIME_ACTIVATION_PROOF_SIGNING_PURPOSE =
+  "gamecult.runtime_presence.activation-proof.v1";
+
+/** systemd file-descriptor name Idunn uses for the activation signing key. */
+export const IDUNN_RUNTIME_ACTIVATION_CREDENTIAL_NAME = "gamecult-idunn-runtime-activation-key";
+
+/** systemd file-descriptor name Idunn uses for the provider-health identity. */
+export const GAMECULT_RUNTIME_PRESENCE_IDENTITY_NAME = "gamecult-runtime-presence-identity";
+
+const PROVIDER_HEALTH_SIGNATURE_DOMAIN = Buffer.from(
+  "gamecult.provider-health.signature.v1\0",
+  "utf8",
+);
+
+const RUNTIME_ACTIVATION_SIGNATURE_DOMAIN = Buffer.from(
+  "idunn.runtime-activation.signature.v1\0",
+  "utf8",
+);
+
+/**
+ * Positional slots, mirroring the `#[cultcache(key = N)]` attributes on
+ * `GameCultRuntimePresenceHealthRecord`. The tuple is always this long: the
+ * Rust derive serialises `max_slot + 1` elements regardless of which are set.
+ */
+export const RUNTIME_PRESENCE_SLOT = {
+  schemaVersion: 0,
+  target: 1,
+  expectedProjectionSha256: 2,
+  planId: 3,
+  incarnationId: 4,
+  sealedReleaseId: 5,
+  activationWitnessSha256: 6,
+  stateSchemaGeneration: 7,
+  stateContractSha256: 8,
+  runtimeId: 9,
+  runtimeInstanceId: 10,
+  boundEndpoint: 11,
+  capabilities: 12,
+  healthContract: 13,
+  state: 14,
+  detail: 15,
+  writeLeaseSha256: 16,
+  signerIdentityId: 17,
+  publisherSequence: 18,
+  observedAtUnixMillis: 19,
+  signatureAlgorithm: 20,
+  signature: 21,
+  activationSignerIdentityId: 22,
+  activationSignature: 23,
+} as const;
+
+export const RUNTIME_PRESENCE_FIELD_COUNT = 24;
+
+/** A capability claim. Nested as its own positional tuple, not a map. */
+export interface GameCultRuntimeCapability {
+  capability: string;
+  schema: string;
+  compatibility: string;
+  capacity: number;
+}
+
+/** The states the contract admits. */
+export type RuntimePresenceState = "warming" | "active" | "degraded" | "failed";
+
+export interface RuntimePresenceHealth {
+  target: string;
+  expectedProjectionSha256: string;
+  planId: string;
+  incarnationId: string;
+  sealedReleaseId: string;
+  activationWitnessSha256: string;
+  stateSchemaGeneration: string | null;
+  stateContractSha256: string | null;
+  runtimeId: string;
+  runtimeInstanceId: string;
+  boundEndpoint: string | null;
+  capabilities: GameCultRuntimeCapability[];
+  healthContract: string;
+  state: RuntimePresenceState;
+  detail: string;
+  writeLeaseSha256: string | null;
+  signerIdentityId: string;
+  publisherSequence: number;
+  observedAtUnixMillis: number;
+  activationSignerIdentityId: string;
+}
+
+function encodeCapability(capability: GameCultRuntimeCapability): unknown[] {
+  // Plain serde struct on the Rust side, and the record is encoded with
+  // rmp_serde's compact form, so a capability is a positional tuple too.
+  return [capability.capability, capability.schema, capability.compatibility, capability.capacity];
+}
+
+/**
+ * Capabilities are canonical only when strictly increasing by
+ * `(capability, schema, compatibility)`. Sorting here rather than trusting the
+ * caller keeps a correct statement from being rejected over field order.
+ */
+function canonicalCapabilities(capabilities: GameCultRuntimeCapability[]): unknown[][] {
+  const sorted = [...capabilities].sort((left, right) => {
+    const leftKey = [left.capability, left.schema, left.compatibility];
+    const rightKey = [right.capability, right.schema, right.compatibility];
+    for (let index = 0; index < leftKey.length; index += 1) {
+      if (leftKey[index]! < rightKey[index]!) return -1;
+      if (leftKey[index]! > rightKey[index]!) return 1;
+    }
+    return 0;
+  });
+  return sorted.map(encodeCapability);
+}
+
+function presenceTuple(
+  presence: RuntimePresenceHealth,
+  signature: Uint8Array,
+  activationSignature: Uint8Array,
+): unknown[] {
+  const fields = new Array<unknown>(RUNTIME_PRESENCE_FIELD_COUNT);
+  fields[RUNTIME_PRESENCE_SLOT.schemaVersion] = GAMECULT_RUNTIME_PRESENCE_HEALTH_SCHEMA;
+  fields[RUNTIME_PRESENCE_SLOT.target] = presence.target;
+  fields[RUNTIME_PRESENCE_SLOT.expectedProjectionSha256] = presence.expectedProjectionSha256;
+  fields[RUNTIME_PRESENCE_SLOT.planId] = presence.planId;
+  fields[RUNTIME_PRESENCE_SLOT.incarnationId] = presence.incarnationId;
+  fields[RUNTIME_PRESENCE_SLOT.sealedReleaseId] = presence.sealedReleaseId;
+  fields[RUNTIME_PRESENCE_SLOT.activationWitnessSha256] = presence.activationWitnessSha256;
+  fields[RUNTIME_PRESENCE_SLOT.stateSchemaGeneration] = presence.stateSchemaGeneration;
+  fields[RUNTIME_PRESENCE_SLOT.stateContractSha256] = presence.stateContractSha256;
+  fields[RUNTIME_PRESENCE_SLOT.runtimeId] = presence.runtimeId;
+  fields[RUNTIME_PRESENCE_SLOT.runtimeInstanceId] = presence.runtimeInstanceId;
+  fields[RUNTIME_PRESENCE_SLOT.boundEndpoint] = presence.boundEndpoint;
+  fields[RUNTIME_PRESENCE_SLOT.capabilities] = canonicalCapabilities(presence.capabilities);
+  fields[RUNTIME_PRESENCE_SLOT.healthContract] = presence.healthContract;
+  fields[RUNTIME_PRESENCE_SLOT.state] = presence.state;
+  fields[RUNTIME_PRESENCE_SLOT.detail] = presence.detail;
+  fields[RUNTIME_PRESENCE_SLOT.writeLeaseSha256] = presence.writeLeaseSha256;
+  fields[RUNTIME_PRESENCE_SLOT.signerIdentityId] = presence.signerIdentityId;
+  fields[RUNTIME_PRESENCE_SLOT.publisherSequence] = presence.publisherSequence;
+  fields[RUNTIME_PRESENCE_SLOT.observedAtUnixMillis] = presence.observedAtUnixMillis;
+  fields[RUNTIME_PRESENCE_SLOT.signatureAlgorithm] = "ed25519";
+  fields[RUNTIME_PRESENCE_SLOT.signature] = signature;
+  fields[RUNTIME_PRESENCE_SLOT.activationSignerIdentityId] = presence.activationSignerIdentityId;
+  fields[RUNTIME_PRESENCE_SLOT.activationSignature] = activationSignature;
+  return fields;
+}
+
+/**
+ * Reject statements the contract forbids, before they are signed.
+ *
+ * These are the same conditions `validate_shape` enforces on the Rust side. A
+ * statement that fails here would be refused after a round trip and a signature;
+ * failing early names the actual problem instead.
+ */
+export function validateRuntimePresence(presence: RuntimePresenceHealth): void {
+  if (presence.publisherSequence <= 0 || !Number.isSafeInteger(presence.publisherSequence)) {
+    throw new Error("runtime presence publisher sequence must be a positive integer");
+  }
+  if (presence.observedAtUnixMillis <= 0 || !Number.isSafeInteger(presence.observedAtUnixMillis)) {
+    throw new Error("runtime presence observation time must be a positive integer");
+  }
+  if (presence.detail.length > 512 || /\p{Cc}/u.test(presence.detail)) {
+    throw new Error("runtime presence detail is too long or carries control characters");
+  }
+  if (presence.state === "warming" && presence.writeLeaseSha256 !== null) {
+    throw new Error("warming runtime presence cannot claim a process write lease");
+  }
+  if (presence.stateSchemaGeneration === null && presence.writeLeaseSha256 !== null) {
+    throw new Error("stateless runtime presence cannot claim a process write lease");
+  }
+  const generationPresent = presence.stateSchemaGeneration !== null;
+  const contractPresent = presence.stateContractSha256 !== null;
+  if (generationPresent !== contractPresent) {
+    throw new Error("runtime presence state lineage is partial");
+  }
+}
+
+/**
+ * The one payload both proofs cover: the complete record with both signature
+ * fields empty.
+ */
+export function runtimePresenceProofPayload(presence: RuntimePresenceHealth): Uint8Array {
+  validateRuntimePresence(presence);
+  return encode(presenceTuple(presence, new Uint8Array(), new Uint8Array()));
+}
+
+/** The complete signed record, as put on the wire. */
+export function encodeRuntimePresenceHealth(
+  presence: RuntimePresenceHealth,
+  signature: Uint8Array,
+  activationSignature: Uint8Array,
+): Uint8Array {
+  if (signature.length !== 64 || activationSignature.length !== 64) {
+    throw new Error("runtime presence proofs must both be 64-byte ed25519 signatures");
+  }
+  validateRuntimePresence(presence);
+  return encode(presenceTuple(presence, signature, activationSignature));
+}
+
+function domainSeparated(domain: Buffer, purpose: string, payload: Uint8Array): Buffer {
+  const purposeBytes = Buffer.from(purpose, "utf8");
+  const lengths = Buffer.alloc(16);
+  lengths.writeBigUInt64BE(BigInt(purposeBytes.length), 0);
+  lengths.writeBigUInt64BE(BigInt(payload.length), 8);
+  return Buffer.concat([
+    domain,
+    lengths.subarray(0, 8),
+    purposeBytes,
+    lengths.subarray(8, 16),
+    Buffer.from(payload),
+  ]);
+}
+
+/** Message the stable provider-health key signs. */
+export function runtimePresenceProviderSigningMessage(payload: Uint8Array): Buffer {
+  return domainSeparated(
+    PROVIDER_HEALTH_SIGNATURE_DOMAIN,
+    GAMECULT_RUNTIME_PRESENCE_HEALTH_SIGNING_PURPOSE,
+    payload,
+  );
+}
+
+/** Message the activation key Idunn passed at launch signs. */
+export function runtimePresenceActivationSigningMessage(payload: Uint8Array): Buffer {
+  return domainSeparated(
+    RUNTIME_ACTIVATION_SIGNATURE_DOMAIN,
+    GAMECULT_RUNTIME_ACTIVATION_PROOF_SIGNING_PURPOSE,
+    payload,
+  );
+}
diff --git a/packages/cultnet-ts/src/shard-catalog.ts b/packages/cultnet-ts/src/shard-catalog.ts
index 38a5d1c3..f57e0bee 100644
--- a/packages/cultnet-ts/src/shard-catalog.ts
+++ b/packages/cultnet-ts/src/shard-catalog.ts
@@ -47,11 +47,11 @@ export class CultNetShardCatalog {
   }
 
   list(options: CultNetShardCatalogOptions = {}): CultNetShardDescriptor[] {
-    const requestedSchemaIds = options.schemaIds ? new Set(options.schemaIds) : null;
+    const requestedSchemaIds = options.schemaIds ?? [];
     const requestedRecordKeys = options.recordKeys ?? [];
 
     return this.shards.filter((shard) => {
-      if (requestedSchemaIds && !shard.schemaIds?.some((schemaId) => requestedSchemaIds.has(schemaId))) {
+      if (requestedSchemaIds.length > 0 && !schemaIdsMatchAny(shard.schemaIds ?? [], requestedSchemaIds)) {
         return false;
       }
       if (requestedRecordKeys.length > 0 && !requestedRecordKeys.some((recordKey) => shardServes(shard, { recordKey }))) {
@@ -86,7 +86,12 @@ export function shardServes(
   shard: CultNetShardDescriptor,
   options: { schemaId?: string; recordKey?: string } = {},
 ): boolean {
-  if (options.schemaId !== undefined && shard.schemaIds !== undefined && shard.schemaIds.length > 0 && !shard.schemaIds.includes(options.schemaId)) {
+  if (
+    options.schemaId !== undefined &&
+    shard.schemaIds !== undefined &&
+    shard.schemaIds.length > 0 &&
+    !schemaIdsMatchAny(shard.schemaIds, [options.schemaId])
+  ) {
     return false;
   }
   if (options.recordKey !== undefined && shard.keyPrefix !== undefined && !options.recordKey.startsWith(shard.keyPrefix)) {
@@ -95,6 +100,35 @@ export function shardServes(
   return true;
 }
 
+function schemaIdsMatchAny(
+  advertisedSchemaIds: readonly string[],
+  requestedSchemaIds: readonly string[],
+): boolean {
+  return advertisedSchemaIds.some(advertised =>
+    requestedSchemaIds.some(requested => schemaIdsMatch(advertised, requested)),
+  );
+}
+
+function schemaIdsMatch(left: string, right: string): boolean {
+  if (left === right) {
+    return true;
+  }
+
+  const leftName = inferSchemaName(left) ?? left;
+  const rightName = inferSchemaName(right) ?? right;
+  return leftName === rightName;
+}
+
+function inferSchemaName(schemaId: string): string | undefined {
+  const marker = schemaId.lastIndexOf(".v");
+  if (marker <= 0 || marker + 2 >= schemaId.length) {
+    return undefined;
+  }
+
+  const version = schemaId.slice(marker + 2);
+  return /^\d+$/u.test(version) ? schemaId.slice(0, marker) : undefined;
+}
+
 function cloneShardDescriptor(descriptor: CultNetShardDescriptor): CultNetShardDescriptor {
   return {
     shardId: descriptor.shardId,
diff --git a/packages/cultnet-ts/src/signed-daemon-health.ts b/packages/cultnet-ts/src/signed-daemon-health.ts
new file mode 100644
index 00000000..d4f0f0ce
--- /dev/null
+++ b/packages/cultnet-ts/src/signed-daemon-health.ts
@@ -0,0 +1,377 @@
+// Signed daemon-health publication over CultNet RUDP.
+//
+// This is the transport half of daemon health publication: bind a socket, shake
+// hands, sign the statement, put the document, wait for the ack. It is generic
+// across services. The receiving service owns the connection id and the schema
+// names, and supplies them as a contract; nothing service-specific is hardcoded
+// here.
+//
+// The signature and identity domains are deliberately not parameterised. They
+// are the GameCult provider-health domains, shared by every publisher and
+// verifier, and a caller that could vary them could silently produce statements
+// nobody verifies.
+
+import dgram from "node:dgram";
+import crypto from "node:crypto";
+import fs from "node:fs";
+import { encode } from "@msgpack/msgpack";
+
+import { CultNetRudpSession, decodeRudpPacket, encodeRudpPacket } from "./rudp";
+import type { CultNetRudpPacket } from "./rudp";
+import { encodeCultNetMessageForWire } from "./contracts";
+
+export const CULTNET_RUDP_PROTOCOL_ID = "cultnet.transport.rudp.v0";
+
+const SIGNATURE_DOMAIN = Buffer.from("gamecult.provider-health.signature.v1\0", "utf8");
+const ID_DOMAIN = Buffer.from("gamecult.provider-health.identity.v1\0", "utf8");
+
+/** What the receiving service owns: where to connect and what to call the documents. */
+export interface SignedDaemonHealthContract {
+  /** RUDP connection id the receiving service listens on. */
+  connectionId: number;
+  /** Schema id for a signed statement. Also the signing purpose. */
+  signedSchemaId: string;
+  /** Schema id used when no signing key is configured. */
+  unsignedSchemaId: string;
+  /** Prefix for generated message ids. Defaults to "daemon-health". */
+  messageIdPrefix?: string;
+}
+
+export interface SignedDaemonHealthPublisherOptions {
+  /** host:port, or [ipv6]:port. */
+  endpoint: string;
+  daemonId: string;
+  healthContract: string;
+  sourceRuntimeId?: string;
+  /** Omit to publish unsigned. */
+  privateKeyPath?: string;
+  contract: SignedDaemonHealthContract;
+}
+
+export interface DaemonHealth {
+  state: string;
+  detail?: string;
+  observedAt?: string;
+}
+
+export interface SignedDaemonHealthPublisher {
+  daemonId: string;
+  endpoint: { host: string; port: number };
+  healthContract: string;
+  publisherIncarnationId: string;
+  publisherSequence: number;
+  sourceRuntimeId: string;
+  contract: SignedDaemonHealthContract;
+  privateKey?: crypto.KeyObject;
+  publicKey?: Buffer;
+  signerIdentityId?: string;
+}
+
+export function createSignedDaemonHealthPublisher(
+  options: SignedDaemonHealthPublisherOptions | null | undefined,
+): SignedDaemonHealthPublisher | null {
+  if (!options) return null;
+  if (!options.contract) {
+    throw new Error("Signed daemon health publisher requires a contract naming the connection id and schema ids.");
+  }
+
+  const publisher: SignedDaemonHealthPublisher = {
+    daemonId: options.daemonId,
+    endpoint: parseEndpoint(options.endpoint),
+    healthContract: options.healthContract,
+    publisherIncarnationId: crypto.randomUUID(),
+    publisherSequence: 0,
+    sourceRuntimeId: options.sourceRuntimeId || "daemon-health-publisher",
+    contract: options.contract,
+  };
+
+  if (options.privateKeyPath) {
+    publisher.privateKey = crypto.createPrivateKey(fs.readFileSync(options.privateKeyPath));
+    publisher.publicKey = rawEd25519PublicKey(publisher.privateKey);
+    publisher.signerIdentityId = crypto
+      .createHash("sha256")
+      .update(ID_DOMAIN)
+      .update(publisher.publicKey)
+      .digest("hex");
+  }
+  return publisher;
+}
+
+export async function publishSignedDaemonHealth(
+  publisher: SignedDaemonHealthPublisher | null,
+  health: DaemonHealth,
+): Promise<void> {
+  if (!publisher) return;
+  const { contract } = publisher;
+
+  const socket = dgram.createSocket(endpointFamily(publisher.endpoint.host));
+  await bindSocket(socket, publisher.endpoint);
+  const receiver = createPacketReceiver(socket);
+  const session = new CultNetRudpSession({
+    connectionId: contract.connectionId,
+    initialSequence: 1,
+    resendDelayMs: 100,
+  });
+
+  try {
+    const connect = session.createConnect(Date.now(), new Uint8Array());
+    await sendPacket(socket, publisher.endpoint, connect);
+    await receiveUntil(receiver, session, publisher.endpoint, (packet) => packet.packetType === "accept", 5000, "accept");
+
+    const observedAt = health.observedAt || new Date().toISOString();
+    const signed = publisher.privateKey ? signedDaemonHealthPayload(publisher, health, observedAt) : null;
+    const payload = signed?.payload || encode([
+      publisher.daemonId,
+      health.state,
+      String(health.detail || "").slice(0, 512),
+      observedAt,
+      publisher.healthContract,
+      "daemon-published",
+      CULTNET_RUDP_PROTOCOL_ID,
+    ]);
+
+    const message = {
+      schemaVersion: "cultnet.document_put_raw.v0",
+      messageId: `${contract.messageIdPrefix || "daemon-health"}:${publisher.daemonId}:${observedAt.replace(/[:.]/g, "-")}`,
+      document: {
+        schemaId: signed ? contract.signedSchemaId : contract.unsignedSchemaId,
+        recordKey: publisher.daemonId,
+        storedAt: observedAt,
+        payloadEncoding: "messagepack",
+        payload,
+        sourceRuntimeId: publisher.sourceRuntimeId,
+        sourceRole: "daemon-health-publisher",
+        tags: [CULTNET_RUDP_PROTOCOL_ID],
+      },
+    };
+
+    const wirePayload = encode(encodeCultNetMessageForWire(message as never, "cultnet.schema.v0"));
+    const dataPackets = session.sendMany("schema", wirePayload, { reliable: true, ordered: true, nowMs: Date.now() });
+    const ack = receiveUntil(
+      receiver,
+      session,
+      publisher.endpoint,
+      (packet) => packet.packetType === "ack",
+      500,
+      "ack",
+    ).catch(() => undefined);
+    for (const packet of dataPackets) {
+      await sendPacket(socket, publisher.endpoint, packet);
+    }
+    await ack;
+  } finally {
+    receiver.close();
+    socket.close();
+  }
+}
+
+export function signedDaemonHealthPayload(
+  publisher: SignedDaemonHealthPublisher,
+  health: DaemonHealth,
+  observedAt: string,
+): { payload: Uint8Array; statement: unknown[]; unsignedPayload: Uint8Array } {
+  if (!publisher.privateKey) {
+    throw new Error("Signed daemon health requires a configured private key.");
+  }
+  publisher.publisherSequence += 1;
+  const observedAtUnixMillis = Date.parse(observedAt);
+  if (!Number.isSafeInteger(observedAtUnixMillis) || observedAtUnixMillis <= 0) {
+    throw new Error("Signed daemon health observation time is invalid.");
+  }
+
+  const unsigned: unknown[] = [
+    publisher.contract.signedSchemaId,
+    publisher.daemonId,
+    publisher.healthContract,
+    publisher.sourceRuntimeId,
+    health.state,
+    String(health.detail || "").slice(0, 512),
+    publisher.signerIdentityId,
+    publisher.publisherIncarnationId,
+    publisher.publisherSequence,
+    observedAtUnixMillis,
+    null,
+    null,
+    null,
+    null,
+    "ed25519",
+    new Uint8Array(),
+    false,
+  ];
+
+  const unsignedPayload = encode(unsigned);
+  const signature = crypto.sign(
+    null,
+    signedDaemonHealthSigningMessage(publisher.contract.signedSchemaId, unsignedPayload),
+    publisher.privateKey,
+  );
+  const statement = unsigned.slice();
+  statement[15] = new Uint8Array(signature);
+  return { payload: encode(statement), statement, unsignedPayload };
+}
+
+/**
+ * Domain-separated signing preimage. The signing purpose is the signed schema
+ * id, so a statement signed for one service's schema cannot verify as another's.
+ */
+export function signedDaemonHealthSigningMessage(signedSchemaId: string, payload: Uint8Array): Buffer {
+  const purpose = Buffer.from(signedSchemaId, "utf8");
+  const purposeLength = Buffer.alloc(8);
+  purposeLength.writeBigUInt64BE(BigInt(purpose.length));
+  const payloadLength = Buffer.alloc(8);
+  payloadLength.writeBigUInt64BE(BigInt(payload.length));
+  return Buffer.concat([SIGNATURE_DOMAIN, purposeLength, purpose, payloadLength, Buffer.from(payload)]);
+}
+
+function rawEd25519PublicKey(privateKey: crypto.KeyObject): Buffer {
+  const der = crypto.createPublicKey(privateKey).export({ type: "spki", format: "der" }) as Buffer;
+  if (der.length < 32) throw new Error("Ed25519 public key export is too short.");
+  return Buffer.from(der.subarray(der.length - 32));
+}
+
+async function bindSocket(socket: dgram.Socket, endpoint: { host: string }): Promise<void> {
+  await new Promise<void>((resolve, reject) => {
+    socket.once("error", reject);
+    socket.bind(0, endpoint.host.includes(":") ? "::" : "0.0.0.0", () => {
+      socket.off("error", reject);
+      resolve();
+    });
+  });
+}
+
+export function parseEndpoint(value: string): { host: string; port: number } {
+  const text = String(value || "").trim();
+  const ipv6 = text.match(/^\[([^\]]+)\]:(\d+)$/);
+  if (ipv6) return { host: ipv6[1], port: parsePort(ipv6[2]) };
+  const index = text.lastIndexOf(":");
+  if (index <= 0) {
+    throw new Error(`Daemon health RUDP endpoint must be host:port, got "${value}".`);
+  }
+  return { host: text.slice(0, index), port: parsePort(text.slice(index + 1)) };
+}
+
+function parsePort(value: string): number {
+  const port = Number(value);
+  if (!Number.isInteger(port) || port <= 0 || port > 65535) {
+    throw new Error(`Daemon health RUDP endpoint port is invalid: ${value}`);
+  }
+  return port;
+}
+
+function endpointFamily(host: string): "udp4" | "udp6" {
+  return host.includes(":") ? "udp6" : "udp4";
+}
+
+interface PacketReceiver {
+  socket: dgram.Socket;
+  next(timeoutMs: number, label?: string): Promise<CultNetRudpPacket>;
+  close(): void;
+}
+
+async function receiveUntil(
+  receiver: PacketReceiver,
+  session: CultNetRudpSession,
+  endpoint: { host: string; port: number },
+  predicate: (packet: CultNetRudpPacket) => boolean,
+  timeoutMs: number,
+  label: string,
+): Promise<void> {
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() < deadline) {
+    try {
+      const packet = await receiver.next(Math.min(100, deadline - Date.now()), label);
+      const result = session.receive(packet, Date.now());
+      if (result.reply) {
+        throw new Error("Daemon health publisher received an unexpected reply-required packet.");
+      }
+      if (predicate(packet)) return;
+    } catch (error) {
+      if ((error as NodeJS.ErrnoException)?.code !== "ETIMEDOUT") throw error;
+    }
+    for (const packet of session.dueResends(Date.now())) {
+      await sendPacket(receiver.socket, endpoint, packet);
+    }
+  }
+  throw new Error(`timed out waiting for daemon health RUDP ${label} response after ${timeoutMs}ms`);
+}
+
+function createPacketReceiver(socket: dgram.Socket): PacketReceiver {
+  const packets: CultNetRudpPacket[] = [];
+  const waiters: Array<{
+    resolve: (packet: CultNetRudpPacket) => void;
+    reject: (error: Error) => void;
+    timer: NodeJS.Timeout;
+  }> = [];
+  const errors: Error[] = [];
+
+  const resolveNext = () => {
+    while (waiters.length > 0 && (packets.length > 0 || errors.length > 0)) {
+      const waiter = waiters.shift()!;
+      clearTimeout(waiter.timer);
+      if (errors.length > 0) waiter.reject(errors.shift()!);
+      else waiter.resolve(packets.shift()!);
+    }
+  };
+  const onMessage = (wire: Buffer) => {
+    try {
+      packets.push(decodeRudpPacket(wire));
+    } catch (error) {
+      errors.push(error as Error);
+    }
+    resolveNext();
+  };
+  const onError = (error: Error) => {
+    errors.push(error);
+    resolveNext();
+  };
+
+  socket.on("message", onMessage);
+  socket.on("error", onError);
+
+  return {
+    socket,
+    next(timeoutMs: number, label = "packet") {
+      if (packets.length > 0) return Promise.resolve(packets.shift()!);
+      if (errors.length > 0) return Promise.reject(errors.shift()!);
+      return new Promise<CultNetRudpPacket>((resolve, reject) => {
+        const waiter = {
+          resolve,
+          reject,
+          timer: setTimeout(() => {
+            const index = waiters.indexOf(waiter);
+            if (index >= 0) waiters.splice(index, 1);
+            const error = new Error(`timed out waiting for daemon health RUDP ${label}`) as NodeJS.ErrnoException;
+            error.code = "ETIMEDOUT";
+            reject(error);
+          }, Math.max(1, timeoutMs)),
+        };
+        waiters.push(waiter);
+      });
+    },
+    close() {
+      socket.off("message", onMessage);
+      socket.off("error", onError);
+      while (waiters.length > 0) {
+        const waiter = waiters.shift()!;
+        clearTimeout(waiter.timer);
+        const error = new Error("Daemon health publisher closed.") as NodeJS.ErrnoException;
+        error.code = "ECLOSED";
+        waiter.reject(error);
+      }
+    },
+  };
+}
+
+async function sendPacket(
+  socket: dgram.Socket,
+  endpoint: { host: string; port: number },
+  packet: CultNetRudpPacket,
+): Promise<void> {
+  const wire = encodeRudpPacket(packet);
+  await new Promise<void>((resolve, reject) => {
+    socket.send(wire, endpoint.port, endpoint.host, (error) => {
+      if (error) reject(error);
+      else resolve();
+    });
+  });
+}
diff --git a/packages/cultnet-ts/src/transport.ts b/packages/cultnet-ts/src/transport.ts
index 53f64127..a1b9b3ce 100644
--- a/packages/cultnet-ts/src/transport.ts
+++ b/packages/cultnet-ts/src/transport.ts
@@ -131,6 +131,7 @@ export interface CultNetTransportConnection {
   readonly profile: CultNetTransportProfile;
   readonly stats: CultNetTransportStats;
   send(channelId: string, payload: Uint8Array): void;
+  flush?(timeoutMs?: number): Promise<void>;
   close(): void;
   on<EventName extends keyof CultNetTransportConnectionEvents>(
     eventName: EventName,
diff --git a/packages/cultnet-ts/test/cultnet.test.ts b/packages/cultnet-ts/test/cultnet.test.ts
index c2a8a8d8..2f540a86 100644
--- a/packages/cultnet-ts/test/cultnet.test.ts
+++ b/packages/cultnet-ts/test/cultnet.test.ts
@@ -12,7 +12,7 @@ import {
   CultCache,
   SingleFileMessagePackBackingStore,
   defineDocumentType,
-} from "cultcache-ts";
+} from "@gamecult/cultcache-ts";
 
 import {
   CultNetClientSecurityOptions,
@@ -21,6 +21,7 @@ import {
   CultNetRudpReconnectLoop,
   CultNetRudpSession,
   CultNetRudpSocketTransportConnection,
+  CULTNET_RUDP_RELIABLE_SEND_WINDOW_PACKETS,
   CultNetSchemaCatalog,
   CultNetSchemaRegistry,
   CultNetSecret,
@@ -41,6 +42,8 @@ import {
   encodeRudpPacket,
   ghostlightAgentStateGeneratedContract,
   parseCultNetMessage,
+  invokeCultNetOperation,
+  startCultNetOperationServer,
   validateGhostlightAgentStateGenerated,
   validateGhostlightAgentState,
   shardServes,
@@ -56,6 +59,64 @@ import {
   type InteropNote,
 } from "./interop/cultnet-interop-shared";
 
+test("CultNet validates the canonical CultMesh Verse catalog messages", () => {
+  const request = parseCultNetMessage({
+    schemaVersion: "cultmesh.verse_catalog_request.v0",
+    messageId: "catalog-1",
+    verseIds: ["sample.counter"],
+    transportVersion: "cultmesh.v1",
+  });
+  assert.equal(request.schemaVersion, "cultmesh.verse_catalog_request.v0");
+
+  const response = parseCultNetMessage({
+    schemaVersion: "cultmesh.verse_catalog_response.v0",
+    messageId: "catalog-1",
+    verses: [{
+      verseId: "sample.counter",
+      displayName: "Counter",
+      authorityModel: "OperatorCluster",
+      compatibility: {
+        transportVersion: "cultmesh.v1",
+        rulesHash: "counter-v1",
+        compatibleVerseIds: [],
+        requiredPluginIds: [],
+        optionalPluginIds: [],
+      },
+      discoveryEndpoints: ["wss://provider.example/cultmesh"],
+      authorityRuntimeIds: ["sample.counter-provider"],
+      authorityRoutes: [{
+        authorityRuntimeId: "sample.counter-provider",
+        endpoint: "wss://provider.example/cultmesh",
+        protocolIds: ["cultmesh.documents.v1"],
+        priority: 0,
+        generation: "provider-route-1",
+      }],
+    }],
+  });
+  assert.equal(response.schemaVersion, "cultmesh.verse_catalog_response.v0");
+  assert.equal(response.verses[0].authorityRuntimeIds[0], "sample.counter-provider");
+  assert.equal(response.verses[0].authorityRoutes![0].generation, "provider-route-1");
+
+  const session = parseCultNetMessage({
+    schemaVersion: "cultmesh.session_accepted.v2",
+    messageId: "session-1",
+    accepted: true,
+    verseId: "sample.counter",
+    authorityRuntimeId: "sample.counter-provider",
+    protocolId: "cultmesh.documents.v1",
+    routeGeneration: "provider-route-1",
+    clientNonce: "bm9uY2U=",
+    providerKeyId: "provider-key-1",
+    providerSignature: "c2lnbmF0dXJl",
+  });
+  assert.equal(session.schemaVersion, "cultmesh.session_accepted.v2");
+
+  assert.throws(() => parseCultNetMessage({
+    ...response,
+    verses: [{ ...response.verses[0], compatibility: { ...response.verses[0].compatibility, rulesHash: "" } }],
+  }), /rulesHash/);
+});
+
 class FakeRudpReconnectTransport extends EventEmitter {
   public connectCalls = 0;
   public closeCalls = 0;
@@ -413,11 +474,20 @@ test("rudp session handshake acks reliable connect and accept packets", () => {
   assert.equal(server.connected, true);
   assert.deepEqual(server.pendingReliableSequences, [100]);
 
+  const retransmittedAccept = server.acceptConnect(connect, 15, Buffer.from("ok", "utf8"));
+  assert.deepEqual(
+    encodeRudpPacket(retransmittedAccept),
+    encodeRudpPacket(accept),
+    "a retransmitted Connect reuses the pending Accept packet",
+  );
+  assert.deepEqual(server.pendingReliableSequences, [100]);
+
   client.receive(accept, 20);
   assert.equal(client.connected, true);
   assert.deepEqual(client.pendingReliableSequences, []);
 
   const ack = client.createAck();
+  assert.equal(ack.sequence, 0);
   assert.equal(ack.ack, 100);
   server.receive(ack, 30);
   assert.deepEqual(server.pendingReliableSequences, []);
@@ -483,6 +553,53 @@ test("rudp session pings and detects receive timeout", () => {
   assert.equal(client.connected, false);
 });
 
+test("rudp lossy packets cannot create reliable ordered gaps", () => {
+  const client = new CultNetRudpSession({ connectionId: 198, initialSequence: 1 });
+  const server = new CultNetRudpSession({ connectionId: 198, initialSequence: 100 });
+  const connect = client.createConnect(0);
+  const accept = server.acceptConnect(connect, 1);
+  client.receive(accept, 2);
+
+  const ping = client.createPing(Buffer.from("pulse"));
+  const pong = server.receive(ping, 3).reply!;
+  const realtime = server.send("realtime", Buffer.from("discarded realtime"));
+  const latest = server.send("latest", Buffer.from("discarded latest state"), { sequenced: true });
+  const schema = server.send("schema", Buffer.from("committed response"), { reliable: true, ordered: true });
+
+  assert.equal(ping.sequence, 0);
+  assert.equal(pong.sequence, 0);
+  assert.equal(realtime.sequence, 0);
+  assert.equal(latest.sequence, 1);
+  assert.equal(schema.sequence, accept.sequence + 1);
+  assert.deepEqual(client.receive(schema, 4).delivered.map(frame => Buffer.from(frame.payload).toString("utf8")), [
+    "committed response",
+  ]);
+});
+
+test("rudp unreliable sequenced delivery is scoped to its channel", () => {
+  const sender = new CultNetRudpSession({ connectionId: 197, initialSequence: 50 });
+  const receiver = new CultNetRudpSession({ connectionId: 197, initialSequence: 100 });
+  const connect = sender.createConnect(0);
+  const accept = receiver.acceptConnect(connect, 1);
+  sender.receive(accept, 2);
+  const older = sender.send("latest", Buffer.from("older"), { sequenced: true });
+  const newer = sender.send("latest", Buffer.from("newer"), { sequenced: true });
+
+  assert.equal(older.sequence, 1);
+  assert.equal(newer.sequence, 2);
+  assert.deepEqual(receiver.receive(newer, 3).delivered.map(frame => Buffer.from(frame.payload).toString("utf8")), ["newer"]);
+  assert.deepEqual(receiver.receive(older, 4).delivered, []);
+});
+
+test("rudp rejects unreliable ordered delivery", () => {
+  const session = new CultNetRudpSession({ connectionId: 196 });
+  session.receive({ packetType: "accept", connectionId: 196, sequence: 50, ack: 0, ackMask: 0, channelId: "control" });
+  assert.throws(
+    () => session.send("schema", Buffer.from("cannot order what will not retransmit"), { ordered: true }),
+    /ordered delivery requires reliability/,
+  );
+});
+
 test("rudp session bounds pending reliable packets before enqueue", () => {
   const session = new CultNetRudpSession({ connectionId: 102, initialSequence: 1, maxPendingReliablePackets: 2 });
   session.receive({ packetType: "accept", connectionId: 102, sequence: 50, ack: 0, ackMask: 0, channelId: "control" });
@@ -533,6 +650,9 @@ test("rudp session skips received control packets while ordering schema payloads
   const control = sender.createAck();
   const second = sender.send("schema", Buffer.from("second"), { reliable: true, ordered: true });
 
+  assert.equal(control.sequence, 0);
+  assert.equal(second.sequence, first.sequence + 1);
+
   assert.deepEqual(receiver.receive(first).delivered.map((frame) => Buffer.from(frame.payload).toString("utf8")), ["first"]);
   assert.deepEqual(receiver.receive(control).delivered, []);
   assert.deepEqual(receiver.receive(second).delivered.map((frame) => Buffer.from(frame.payload).toString("utf8")), ["second"]);
@@ -807,9 +927,9 @@ test("CultNet can round-trip gamecult.networking.v0 auth messages through the ex
   assert.deepEqual(wireValue, [
     0,
     [
-      Buffer.from("nonce", "utf8"),
-      Buffer.from("auth", "utf8"),
-      Buffer.from("password", "utf8"),
+      new TextEncoder().encode("nonce"),
+      new TextEncoder().encode("auth"),
+      new TextEncoder().encode("password"),
     ],
   ]);
 
@@ -936,13 +1056,15 @@ test("CultNet shard catalog filters descriptors and answers catalog requests", (
 
   assert.equal(watchedShardId, "profiles-a");
   assert.equal(shardServes(catalog.get("notes-a")!, { schemaId: "note.v1", recordKey: "note:1" }), true);
+  assert.equal(shardServes(catalog.get("notes-a")!, { schemaId: "note", recordKey: "note:1" }), true);
   assert.equal(shardServes(catalog.get("notes-a")!, { schemaId: "profile.v1", recordKey: "note:1" }), false);
   assert.deepEqual(catalog.list({ schemaIds: ["note.v1"], recordKeys: ["note:1"] }).map((shard) => shard.shardId), ["notes-a"]);
+  assert.deepEqual(catalog.list({ schemaIds: ["note"], recordKeys: ["note:1"] }).map((shard) => shard.shardId), ["notes-a"]);
 
   const response = catalog.createCatalogResponse({
     schemaVersion: "cultnet.shard_catalog_request.v0",
     messageId: "shards",
-    schemaIds: ["note.v1"],
+    schemaIds: ["note"],
     recordKeys: ["note:2"],
   });
   assert.equal(response.schemaVersion, "cultnet.shard_catalog_response.v0");
@@ -987,7 +1109,7 @@ test("CultNet peer can request and sync shard catalogs by message id", async ()
   const synced = new CultNetShardCatalog();
   const applied = await requester.syncShardCatalog(synced, {
     messageId: "peer-shards",
-    schemaIds: ["note.v1"],
+    schemaIds: ["note"],
     recordKeys: ["note:local"],
     timeoutMs: 1_000,
   });
@@ -1215,6 +1337,361 @@ test("CultNet raw replication preserves CultCache payload bytes for bit-compatib
   }
 });
 
+test("operation envelopes preserve typed service routing and payload correlation", () => {
+  const request = parseCultNetMessage({
+    schemaVersion: "cultnet.operation_request.v0",
+    messageId: "plugin-42",
+    serviceId: "sai.vn",
+    operation: "project",
+    payloadSchema: "gamecult.eve.plugin_abi.request.v1",
+    payloadEncoding: "messagepack-base64",
+    payload: "gaZzY2hlbWHEJ2dhbWVjdWx0LmV2ZS5wbHVnaW5fYWJpLnJlcXVlc3QudjE=",
+    sourceRuntimeId: "eve-unity",
+  });
+  assert.equal(request.schemaVersion, "cultnet.operation_request.v0");
+  assert.equal(request.messageId, "plugin-42");
+  assert.equal(request.serviceId, "sai.vn");
+
+  const response = parseCultNetMessage({
+    schemaVersion: "cultnet.operation_response.v0",
+    messageId: "plugin-42",
+    serviceId: "sai.vn",
+    operation: "project",
+    status: "ok",
+    payloadSchema: "gamecult.eve.plugin_abi.response.v1",
+    payloadEncoding: "messagepack-base64",
+    payload: "gaZzdGF0dXOkb2s=",
+    diagnostics: [],
+  });
+  assert.equal(response.schemaVersion, "cultnet.operation_response.v0");
+  assert.equal(response.messageId, request.messageId);
+});
+
+test("rudp session advances large fragment sets through a bounded reliable window", () => {
+  const connectionId = 457;
+  const sender = new CultNetRudpSession({ connectionId, initialSequence: 1, resendDelayMs: 25 });
+  const receiver = new CultNetRudpSession({ connectionId, initialSequence: 100, resendDelayMs: 25 });
+  sender.receive({ packetType: "accept", connectionId, sequence: 0, ack: 0, ackMask: 0, channelId: "control" });
+  receiver.receive({ packetType: "accept", connectionId, sequence: 0, ack: 0, ackMask: 0, channelId: "control" });
+
+  const fragmentCount = CULTNET_RUDP_RELIABLE_SEND_WINDOW_PACKETS + 17;
+  const payload = Uint8Array.from(
+    { length: fragmentCount * 8 },
+    (_, index) => index % 251,
+  );
+  const wire = sender.sendMany("schema", payload, {
+    reliable: true,
+    ordered: true,
+    nowMs: 1,
+    maxFragmentBytes: 8,
+  });
+  assert.equal(wire.length, CULTNET_RUDP_RELIABLE_SEND_WINDOW_PACKETS);
+  const oldestSequence = wire[0]!.sequence;
+  assert.equal(sender.pendingReliableSequences.length, wire.length);
+  assert.equal(sender.queuedReliablePacketCount, 17);
+
+  const delivered = [];
+  while (wire.length > 0) {
+    const admitted = wire.length;
+    for (let index = 0; index < admitted; index += 1) {
+      const packet = wire.shift()!;
+      delivered.push(...receiver.receive(packet, 2).delivered);
+    }
+    const acknowledged = sender.receive(receiver.createAck(), 3);
+    wire.push(...(acknowledged.readyToSend ?? []));
+  }
+
+  assert.equal(sender.outstandingReliablePacketCount, 0);
+  assert.equal(delivered.length, 1);
+  assert.deepEqual(delivered[0]?.payload, payload);
+  const oldAck = receiver.createAckForReceived(oldestSequence);
+  assert.equal(oldAck.ack, oldestSequence);
+  assert.equal(oldAck.ackMask, 0);
+});
+
+test("CultNet contracts encode legacy bytes without Node Buffer authority", () => {
+  const originalBuffer = globalThis.Buffer;
+  try {
+    Object.defineProperty(globalThis, "Buffer", { configurable: true, value: undefined });
+    const message = parseCultNetMessage({
+      schemaVersion: "cultnet.login.v0",
+      nonce: "AQID",
+      auth: "BAUG",
+      password: "BwgJ",
+    });
+    const wire = encodeCultNetMessageForWire(message, "gamecult.networking.v0") as [number, Uint8Array[]];
+    assert.equal(wire[0], 0);
+    assert.deepEqual([...wire[1][0]], [1, 2, 3]);
+  } finally {
+    Object.defineProperty(globalThis, "Buffer", { configurable: true, value: originalBuffer });
+  }
+});
+
+test("database subscription contracts match the C# live document lane", () => {
+  const subscribe = parseCultNetMessage({
+    schemaVersion: "cultnet.database_subscribe.v0",
+    messageId: "subscribe-counter",
+    subscriptionId: "counter:browser-1",
+    schemaIds: ["sample.counter_state.v1"],
+    recordKeys: ["counter:main"],
+    includeSnapshot: true,
+    consumerRuntimeId: "browser-1",
+  });
+  assert.equal(subscribe.schemaVersion, "cultnet.database_subscribe.v0");
+  assert.equal(subscribe.subscriptionId, "counter:browser-1");
+
+  const added = parseCultNetMessage({
+    schemaVersion: "cultnet.database_change_raw.v0",
+    messageId: "change-counter-1",
+    subscriptionId: "counter:browser-1",
+    changeKind: "added",
+    document: {
+      schemaId: "sample.counter_state.v1",
+      recordKey: "counter:main",
+      storedAt: "2026-08-17T00:00:00Z",
+      payloadEncoding: "messagepack",
+      payload: new Uint8Array([0x81, 0xa5, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x01]),
+    },
+  });
+  assert.equal(added.schemaVersion, "cultnet.database_change_raw.v0");
+  assert.equal(added.document?.recordKey, "counter:main");
+
+  const removed = parseCultNetMessage({
+    schemaVersion: "cultnet.database_change_raw.v0",
+    messageId: "change-counter-2",
+    subscriptionId: "counter:browser-1",
+    changeKind: "removed",
+    recordKey: "counter:main",
+    schemaId: "sample.counter_state.v1",
+  });
+  assert.equal(removed.schemaVersion, "cultnet.database_change_raw.v0");
+  assert.equal(removed.recordKey, "counter:main");
+
+  const unsubscribe = parseCultNetMessage({
+    schemaVersion: "cultnet.database_unsubscribe.v0",
+    messageId: "unsubscribe-counter",
+    subscriptionId: "counter:browser-1",
+  });
+  assert.equal(unsubscribe.schemaVersion, "cultnet.database_unsubscribe.v0");
+
+  assert.throws(
+    () => parseCultNetMessage({
+      schemaVersion: "cultnet.database_change_raw.v0",
+      messageId: "invalid-change",
+      subscriptionId: "counter:browser-1",
+      changeKind: "updated",
+    }),
+    /document: is required/,
+  );
+});
+
+test("RUDP operation service correlates typed payload envelopes", async () => {
+  const server = await startCultNetOperationServer({
+    runtimeId: "sai-sidecar",
+    handler: request => ({
+      schemaVersion: "cultnet.operation_response.v0",
+      messageId: request.messageId,
+      serviceId: request.serviceId,
+      operation: request.operation,
+      status: "ok",
+      payloadSchema: "gamecult.eve.plugin_abi.response.v1",
+      payloadEncoding: "messagepack-base64",
+      payload: request.payload,
+      diagnostics: [],
+      sourceRuntimeId: "sai-sidecar",
+    }),
+  });
+  try {
+    const response = await invokeCultNetOperation(server.endpoint, {
+      schemaVersion: "cultnet.operation_request.v0",
+      messageId: "service-1",
+      serviceId: "sai.vn",
+      operation: "describe",
+      payloadSchema: "gamecult.eve.plugin_abi.request.v1",
+      payloadEncoding: "messagepack-base64",
+      payload: "gaZzY2hlbWHEJ2dhbWVjdWx0LmV2ZS5wbHVnaW5fYWJpLnJlcXVlc3QudjE=",
+    }, { runtimeId: "eve-test" });
+    assert.equal(response.messageId, "service-1");
+    assert.equal(response.serviceId, "sai.vn");
+    assert.equal(response.status, "ok");
+  } finally {
+    await server.close();
+  }
+});
+
+test("rudp sequence-neutral acknowledgements interoperate with ordered receivers", () => {
+  const sender = new CultNetRudpSession({ connectionId: 125, initialSequence: 1 });
+  const receiver = new CultNetRudpSession({ connectionId: 125, initialSequence: 100 });
+  sender.receive({ packetType: "accept", connectionId: 125, sequence: 90, ack: 0, ackMask: 0, channelId: "control" });
+  receiver.receive({ packetType: "accept", connectionId: 125, sequence: 91, ack: 0, ackMask: 0, channelId: "control" });
+
+  const ack = sender.createAck();
+  const request = sender.send("schema", Buffer.from("snapshot"), { reliable: true, ordered: true });
+
+  assert.equal(ack.sequence, 0);
+  assert.equal(request.sequence, 1);
+  assert.deepEqual(receiver.receive(ack).delivered, []);
+  assert.deepEqual(receiver.receive(request).delivered.map(frame => Buffer.from(frame.payload).toString("utf8")), ["snapshot"]);
+});
+
+test("CultNet raw replication applies compatible foreign-schema snapshots", async () => {
+  const tempDir = mkdtempSync(join(tmpdir(), "cultnetts-foreign-schema-raw-"));
+
+  try {
+    const documentDefinition = defineDocumentType({
+      type: "cultnet.note",
+      schemaId: "cultnet.note.v1",
+      schemaName: "cultnet.note",
+      schemaVersion: "cultnet.note.v1",
+      schema: z.object({
+        schema_version: z.string(),
+        noteId: z.string(),
+        body: z.string(),
+      }),
+      name: "noteId",
+    });
+    const registry = new CultNetDocumentRegistry([
+      defineCultNetDocumentBinding({ definition: documentDefinition }),
+    ]);
+    const originCache = CultCache.builder()
+      .withDocumentType(documentDefinition)
+      .withGenericStore(new SingleFileMessagePackBackingStore(join(tempDir, "origin.msgpack")))
+      .build();
+    const targetCache = CultCache.builder()
+      .withDocumentType(documentDefinition)
+      .withGenericStore(new SingleFileMessagePackBackingStore(join(tempDir, "target.msgpack")))
+      .build();
+
+    await originCache.put(documentDefinition, "note:foreign-schema", {
+      schema_version: "cultnet.note.v1",
+      noteId: "note:foreign-schema",
+      body: "accepted by payload shape",
+    });
+    const rawSnapshot = registry.createRawSnapshotResponse(originCache, "foreign-schema-raw");
+    rawSnapshot.documents[0]!.schemaId = "runtime.generated.cultnet.note.ui.99";
+
+    await registry.applyRawSnapshotResponse(targetCache, rawSnapshot);
+
+    assert.equal(
+      targetCache.getRequired(documentDefinition, "note:foreign-schema").body,
+      "accepted by payload shape",
+    );
+    assert.equal(
+      targetCache.getRequiredEnvelope(documentDefinition, "note:foreign-schema").schemaId,
+      "cultnet.note.v1",
+    );
+  } finally {
+    rmSync(tempDir, { recursive: true, force: true });
+  }
+});
+
+test("CultNet document registry filters snapshots by schema aliases", async () => {
+  const tempDir = mkdtempSync(join(tmpdir(), "cultnetts-alias-snapshot-"));
+
+  try {
+    const documentDefinition = defineDocumentType({
+      type: "cultnet.alias_note",
+      schemaId: "sha256:cultnet-alias-note",
+      schemaName: "cultnet.alias_note",
+      schemaVersion: "cultnet.alias_note.v1",
+      schema: z.object({
+        schema_version: z.string(),
+        noteId: z.string(),
+        body: z.string(),
+      }),
+      name: "noteId",
+    });
+    const registry = new CultNetDocumentRegistry([
+      defineCultNetDocumentBinding({ definition: documentDefinition }),
+    ]);
+    const cache = CultCache.builder()
+      .withDocumentType(documentDefinition)
+      .withGenericStore(new SingleFileMessagePackBackingStore(join(tempDir, "alias.msgpack")))
+      .build();
+
+    await cache.put(documentDefinition, "note:alias", {
+      schema_version: "cultnet.alias_note.v1",
+      noteId: "note:alias",
+      body: "filtered by alias",
+    });
+
+    const typedSnapshot = registry.createSnapshotResponse(cache, "typed-alias", {
+      schemaVersion: "cultnet.snapshot_request.v0",
+      messageId: "typed-alias",
+      schemaIds: ["cultnet.alias_note.v1"],
+    });
+    const rawSnapshot = registry.createRawSnapshotResponse(cache, "raw-alias", {
+      schemaVersion: "cultnet.snapshot_request.v0",
+      messageId: "raw-alias",
+      schemaIds: ["cultnet.alias_note.v1"],
+    });
+
+    assert.equal(typedSnapshot.documents[0]?.schemaId, "sha256:cultnet-alias-note");
+    assert.equal(typedSnapshot.documents[0]?.recordKey, "note:alias");
+    assert.equal(rawSnapshot.documents[0]?.schemaId, "sha256:cultnet-alias-note");
+    assert.equal(rawSnapshot.documents[0]?.recordKey, "note:alias");
+  } finally {
+    rmSync(tempDir, { recursive: true, force: true });
+  }
+});
+
+test("CultNet document registry applies typed put and delete messages by schema alias", async () => {
+  const tempDir = mkdtempSync(join(tmpdir(), "cultnetts-alias-typed-"));
+
+  try {
+    const documentDefinition = defineDocumentType({
+      type: "cultnet.typed_alias_note",
+      schemaId: "sha256:cultnet-typed-alias-note",
+      schemaName: "cultnet.typed_alias_note",
+      schemaVersion: "cultnet.typed_alias_note.v1",
+      schema: z.object({
+        schema_version: z.string(),
+        noteId: z.string(),
+        body: z.string(),
+      }),
+      name: "noteId",
+    });
+    const registry = new CultNetDocumentRegistry([
+      defineCultNetDocumentBinding({ definition: documentDefinition }),
+    ]);
+    const cache = CultCache.builder()
+      .withDocumentType(documentDefinition)
+      .withGenericStore(new SingleFileMessagePackBackingStore(join(tempDir, "typed-alias.msgpack")))
+      .build();
+
+    await registry.applyDocumentPutMessage(cache, {
+      schemaVersion: "cultnet.document_put.v0",
+      messageId: "typed-alias-put",
+      document: {
+        schemaId: "cultnet.typed_alias_note.v1",
+        recordKey: "note:typed-alias",
+        storedAt: "2026-06-27T00:00:00.000Z",
+        payload: {
+          schema_version: "cultnet.typed_alias_note.v1",
+          noteId: "note:typed-alias",
+          body: "typed alias applied",
+        },
+      },
+    });
+
+    assert.equal(
+      cache.getRequired(documentDefinition, "note:typed-alias").body,
+      "typed alias applied",
+    );
+    assert.equal(registry.getBySchemaId("cultnet.typed_alias_note.v1")?.definition.type, documentDefinition.type);
+
+    assert.equal(await registry.applyDocumentDeleteMessage(cache, {
+      schemaVersion: "cultnet.document_delete.v0",
+      messageId: "typed-alias-delete",
+      schemaId: "cultnet.typed_alias_note.v1",
+      recordKey: "note:typed-alias",
+    }), true);
+    assert.equal(cache.get(documentDefinition, "note:typed-alias"), undefined);
+  } finally {
+    rmSync(tempDir, { recursive: true, force: true });
+  }
+});
+
 test("CultNet interop slot compatibility defaults missing trailing fields and rejects mismatched slots", () => {
   const note: InteropNote = {
     schemaVersion: INTEROP_SCHEMA_VERSION,
@@ -1344,3 +1821,49 @@ test("Generated Ghostlight contracts can feed CultCacheTS directly without a Zod
     rmSync(tempDir, { recursive: true, force: true });
   }
 });
+
+test("rudp receiver evicts stranded fragment sets instead of refusing new ones", () => {
+  // A fragment set is removed only on successful reassembly, so every set that
+  // loses a fragment is stranded for the life of the session. Ghostlight sends
+  // Heimdall fragmented envelopes (max_fragment_bytes = 2048), so on the live
+  // auth path this map grew for every lost fragment and was never swept.
+  const receiver = new CultNetRudpSession({ connectionId: 9, initialSequence: 1, resendDelayMs: 50 });
+  receiver.receive({ packetType: "accept", connectionId: 9, sequence: 1, ack: 0, ackMask: 0, channelId: "control" });
+
+  // 200 fragment sets that each lose their second fragment.
+  for (let id = 1; id <= 200; id += 1) {
+    const stranded = receiver.receive({
+      packetType: "data",
+      connectionId: 9,
+      sequence: 100 + id,
+      ack: 0,
+      ackMask: 0,
+      channelId: "schema",
+      fragmentId: id,
+      fragmentIndex: 0,
+      fragmentCount: 2,
+      payload: Buffer.from([id & 0xff]),
+    });
+    assert.equal(stranded.delivered.length, 0, "an incomplete set must not reassemble");
+  }
+
+  // Bounded rather than unbounded, and still serving.
+  assert.ok(receiver.pendingFragmentSetCount <= 64, `pending ${receiver.pendingFragmentSetCount}`);
+  assert.ok(receiver.fragmentSetsEvicted > 0, "nothing was evicted");
+
+  // The receiver still completes a fresh fragmented payload, which is what
+  // erroring at the cap took away: any nonzero loss killed the channel.
+  const first = receiver.receive({
+    packetType: "data", connectionId: 9, sequence: 900, ack: 0, ackMask: 0,
+    channelId: "schema", fragmentId: 1000, fragmentIndex: 0, fragmentCount: 2,
+    payload: Buffer.from("he"),
+  });
+  assert.equal(first.delivered.length, 0);
+  const second = receiver.receive({
+    packetType: "data", connectionId: 9, sequence: 901, ack: 0, ackMask: 0,
+    channelId: "schema", fragmentId: 1000, fragmentIndex: 1, fragmentCount: 2,
+    payload: Buffer.from("llo"),
+  });
+  assert.equal(second.delivered.length, 1);
+  assert.equal(Buffer.from(second.delivered[0]!.payload).toString(), "hello");
+});
diff --git a/packages/cultnet-ts/test/fixtures/runtime-presence-vectors.json b/packages/cultnet-ts/test/fixtures/runtime-presence-vectors.json
new file mode 100644
index 00000000..043689f4
--- /dev/null
+++ b/packages/cultnet-ts/test/fixtures/runtime-presence-vectors.json
@@ -0,0 +1,4 @@
+{
+  "proof": "dc0018d92367616d6563756c742e72756e74696d655f70726573656e63655f6865616c74682e7632a86865696d64616c6cd9477368613235362d61616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161d9477368613235362d62626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262b5736572766963652d696e6361726e6174696f6e2d31d9477368613235362d63636363636363636363636363636363636363636363636363636363636363636363636363636363636363636363636363636363636363636363636363636363d9477368613235362d64646464646464646464646464646464646464646464646464646464646464646464646464646464646464646464646464646464646464646464646464646464a27631d9477368613235362d65656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565b26865696d64616c6c2d79676764726173696cd9477368613235362d66666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666b6687474703a2f2f3132372e302e302e313a31343130319294af6865696d64616c6c2e616363657373b26865696d64616c6c2e6163636573732e7631a276310294ac7a6574612e72756e74696d65af7a6574612e72756e74696d652e7631a2763101d9256865696d64616c6c2e63756c746e65742d727564702d70726f76696465722d6865616c7468a77761726d696e67ba4865696d64616c6c2063616e646964617465207761726d696e67c0d9403131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313107cf00000199155c6200a765643235353139c400d94032323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232c400",
+  "signed": "dc0018d92367616d6563756c742e72756e74696d655f70726573656e63655f6865616c74682e7632a86865696d64616c6cd9477368613235362d61616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161d9477368613235362d62626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262b5736572766963652d696e6361726e6174696f6e2d31d9477368613235362d63636363636363636363636363636363636363636363636363636363636363636363636363636363636363636363636363636363636363636363636363636363d9477368613235362d64646464646464646464646464646464646464646464646464646464646464646464646464646464646464646464646464646464646464646464646464646464a27631d9477368613235362d65656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565b26865696d64616c6c2d79676764726173696cd9477368613235362d66666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666b6687474703a2f2f3132372e302e302e313a31343130319294af6865696d64616c6c2e616363657373b26865696d64616c6c2e6163636573732e7631a276310294ac7a6574612e72756e74696d65af7a6574612e72756e74696d652e7631a2763101d9256865696d64616c6c2e63756c746e65742d727564702d70726f76696465722d6865616c7468a77761726d696e67ba4865696d64616c6c2063616e646964617465207761726d696e67c0d9403131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313107cf00000199155c6200a765643235353139c44011111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111d94032323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232c44022222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222"
+}
diff --git a/packages/cultnet-ts/test/interop/cultnet-interop-peer.ts b/packages/cultnet-ts/test/interop/cultnet-interop-peer.ts
index 0af43301..57b7fa37 100644
--- a/packages/cultnet-ts/test/interop/cultnet-interop-peer.ts
+++ b/packages/cultnet-ts/test/interop/cultnet-interop-peer.ts
@@ -6,7 +6,7 @@ import process from "node:process";
 import { setTimeout as delay } from "node:timers/promises";
 
 import { decode, encode } from "@msgpack/msgpack";
-import { CultCache, SingleFileMessagePackBackingStore, defineDocumentType, type AnyCultCacheDocumentDefinition } from "cultcache-ts";
+import { CultCache, SingleFileMessagePackBackingStore, defineDocumentType, type AnyCultCacheDocumentDefinition } from "@gamecult/cultcache-ts";
 import {
   CultNetDocumentRegistry,
   CultNetPeer,
diff --git a/packages/cultnet-ts/test/interop/cultnet-interop.test.ts b/packages/cultnet-ts/test/interop/cultnet-interop.test.ts
index bec86942..00fff83d 100644
--- a/packages/cultnet-ts/test/interop/cultnet-interop.test.ts
+++ b/packages/cultnet-ts/test/interop/cultnet-interop.test.ts
@@ -24,7 +24,9 @@ const pythonCommand = process.env.PYTHON ?? resolvePythonCommand();
 const cultNetTsRoot = resolve(__dirname, "../../..");
 const cultLibRoot = findAncestor(cultNetTsRoot, "CultLib.sln") ?? resolve(cultNetTsRoot, "..", "CultLib");
 const cultcachePyRoot = resolve(cultLibRoot, "packages", "cultcache-py");
-const cultcachePySrc = resolve(cultcachePyRoot, "src");
+const cultcachePySrc = ["cultcache-py", "cultnet-py", "cultmesh-py"]
+  .map((name) => resolve(cultLibRoot, "packages", name, "src"))
+  .join(delimiter);
 const cultmeshKotlinRoot = resolve(cultLibRoot, "packages", "cultmesh-kotlin");
 const kotlinHome = process.env.KOTLIN_HOME ?? "C:\\Program Files\\Android\\Android Studio\\plugins\\Kotlin\\kotlinc";
 const kotlinJavaHome = process.env.KOTLIN_JAVA_HOME ?? "C:\\Program Files\\Android\\Android Studio\\jbr";
@@ -414,6 +416,12 @@ test("CultNet TS/Rust/C#/Python peers discover each other and exchange raw state
   const advertiseHost = findAdvertiseHost();
 
   const servers: RunningServeProcess[] = [];
+  // Registered before anything is spawned. A peer whose readiness rejects
+  // would otherwise skip this and strand every peer already running.
+  t.after(async () => {
+    await Promise.all(servers.map(stopProcess));
+  });
+
   logInteropPhase("schema-v0", "start rust peer");
   servers.push(await spawnServeProcess("rust", {
     command: rustBinaryPath,
@@ -498,10 +506,6 @@ test("CultNet TS/Rust/C#/Python peers discover each other and exchange raw state
   }));
   await servers[servers.length - 1].ready;
 
-  t.after(async () => {
-    await Promise.all(servers.map(stopProcess));
-  });
-
   logInteropPhase("schema-v0", "typescript dials rust");
   const tsDial = await runJsonCommand("ts-dial", process.execPath, [
     tsPeerScript,
@@ -989,6 +993,12 @@ test("CultNet TypeScript and Rust full interop peers exchange schema-v0 over RUD
   const discoveryPort = await getFreePort();
   const advertiseHost = findAdvertiseHost();
   const servers: RunningServeProcess[] = [];
+  // Registered before anything is spawned. A peer whose readiness rejects
+  // would otherwise skip this and strand every peer already running.
+  t.after(async () => {
+    await Promise.all(servers.map(stopProcess));
+  });
+
   servers.push(await spawnServeProcess("rust-rudp", {
     command: rustBinaryPath,
     args: [
@@ -1030,10 +1040,6 @@ test("CultNet TypeScript and Rust full interop peers exchange schema-v0 over RUD
   }));
   await servers[servers.length - 1].ready;
 
-  t.after(async () => {
-    await Promise.all(servers.map(stopProcess));
-  });
-
   logInteropPhase("ts-rust-full-rudp", "typescript dials rust over rudp");
   const tsRudpDial = await runJsonCommand("ts-rust-rudp-dial", process.execPath, [
     tsPeerScript,
@@ -1139,6 +1145,7 @@ test("CultNet Python and TypeScript exchange schema frames when Python dials a T
     assert.equal(exitCode, 0, pythonClient.stderr.join(""));
   } finally {
     server.close();
+    closeUdpSocket(serverSocket);
     if (pythonClient.child.exitCode === null && !pythonClient.child.killed) {
       pythonClient.child.kill("SIGTERM");
       await once(pythonClient.child, "exit").catch(() => undefined);
@@ -1246,6 +1253,7 @@ test("CultNet Python and TypeScript exchange schema-v0 MessagePack messages over
     assert.equal(exitCode, 0, pythonClient.stderr.join(""));
   } finally {
     server.close();
+    closeUdpSocket(serverSocket);
     if (pythonClient.child.exitCode === null && !pythonClient.child.killed) {
       pythonClient.child.kill("SIGTERM");
       await once(pythonClient.child, "exit").catch(() => undefined);
@@ -1322,6 +1330,7 @@ test("CultNet Rust and TypeScript exchange schema frames when Rust dials a TypeS
     assert.equal(exitCode, 0, rustClient.stderr.join(""));
   } finally {
     server.close();
+    closeUdpSocket(serverSocket);
     if (rustClient.child.exitCode === null && !rustClient.child.killed) {
       rustClient.child.kill("SIGTERM");
       await once(rustClient.child, "exit").catch(() => undefined);
@@ -1431,6 +1440,7 @@ test("CultNet Rust and TypeScript exchange schema-v0 MessagePack messages over R
     assert.equal(exitCode, 0, rustClient.stderr.join(""));
   } finally {
     server.close();
+    closeUdpSocket(serverSocket);
     if (rustClient.child.exitCode === null && !rustClient.child.killed) {
       rustClient.child.kill("SIGTERM");
       await once(rustClient.child, "exit").catch(() => undefined);
@@ -1507,6 +1517,7 @@ test("CultNet C# and TypeScript exchange schema frames when C# dials a TypeScrip
     assert.equal(exitCode, 0, csharpClient.stderr.join(""));
   } finally {
     server.close();
+    closeUdpSocket(serverSocket);
     if (csharpClient.child.exitCode === null && !csharpClient.child.killed) {
       csharpClient.child.kill("SIGTERM");
       await once(csharpClient.child, "exit").catch(() => undefined);
@@ -1616,6 +1627,7 @@ test("CultNet C# and TypeScript exchange schema-v0 MessagePack messages over RUD
     assert.equal(exitCode, 0, csharpClient.stderr.join(""));
   } finally {
     server.close();
+    closeUdpSocket(serverSocket);
     if (csharpClient.child.exitCode === null && !csharpClient.child.killed) {
       csharpClient.child.kill("SIGTERM");
       await once(csharpClient.child, "exit").catch(() => undefined);
@@ -1692,6 +1704,7 @@ test("CultNet Kotlin and TypeScript exchange schema frames when Kotlin dials a T
     assert.equal(exitCode, 0, kotlinClient.stderr.join(""));
   } finally {
     server.close();
+    closeUdpSocket(serverSocket);
     if (kotlinClient.child.exitCode === null && !kotlinClient.child.killed) {
       kotlinClient.child.kill("SIGTERM");
       await once(kotlinClient.child, "exit").catch(() => undefined);
@@ -1801,6 +1814,7 @@ test("CultNet Kotlin and TypeScript exchange schema-v0 MessagePack messages over
     assert.equal(exitCode, 0, kotlinClient.stderr.join(""));
   } finally {
     server.close();
+    closeUdpSocket(serverSocket);
     if (kotlinClient.child.exitCode === null && !kotlinClient.child.killed) {
       kotlinClient.child.kill("SIGTERM");
       await once(kotlinClient.child, "exit").catch(() => undefined);
@@ -1823,6 +1837,12 @@ test("CultNet TypeScript and C# full interop peers exchange schema-v0 over RUDP"
   const discoveryPort = await getFreePort();
   const advertiseHost = findAdvertiseHost();
   const servers: RunningServeProcess[] = [];
+  // Registered before anything is spawned. A peer whose readiness rejects
+  // would otherwise skip this and strand every peer already running.
+  t.after(async () => {
+    await Promise.all(servers.map(stopProcess));
+  });
+
   servers.push(await spawnServeProcess("csharp-rudp", {
     command: dotnetCommand,
     args: [
@@ -1865,10 +1885,6 @@ test("CultNet TypeScript and C# full interop peers exchange schema-v0 over RUDP"
   }));
   await servers[servers.length - 1].ready;
 
-  t.after(async () => {
-    await Promise.all(servers.map(stopProcess));
-  });
-
   logInteropPhase("ts-csharp-full-rudp", "typescript dials csharp over rudp");
   const tsRudpDial = await runJsonCommand("ts-csharp-rudp-dial", process.execPath, [
     tsPeerScript,
@@ -1923,6 +1939,12 @@ test("CultNet TypeScript and Kotlin full interop peers exchange schema-v0 over R
   const discoveryPort = await getFreePort();
   const advertiseHost = findAdvertiseHost();
   const servers: RunningServeProcess[] = [];
+  // Registered before anything is spawned. A peer whose readiness rejects
+  // would otherwise skip this and strand every peer already running.
+  t.after(async () => {
+    await Promise.all(servers.map(stopProcess));
+  });
+
   servers.push(await spawnServeProcess("kotlin-rudp", {
     command: kotlinJavaCommand,
     args: [
@@ -1966,10 +1988,6 @@ test("CultNet TypeScript and Kotlin full interop peers exchange schema-v0 over R
   }));
   await servers[servers.length - 1].ready;
 
-  t.after(async () => {
-    await Promise.all(servers.map(stopProcess));
-  });
-
   logInteropPhase("ts-kotlin-full-rudp", "typescript dials kotlin over rudp");
   const tsRudpDial = await runJsonCommand("ts-kotlin-rudp-dial", process.execPath, [
     tsPeerScript,
@@ -3160,6 +3178,20 @@ function spawnRustRudpMessageClient(remotePort: number): Omit<RunningPythonRudpP
   return { child, stderr };
 }
 
+/** Closes a socket this file bound, tolerating a transport that adopted and
+ * already closed it. A socket left open holds the event loop forever, which is
+ * invisible while tests pass and fatal to the runner's exit. */
+function closeUdpSocket(socket: Socket | undefined): void {
+  if (!socket) {
+    return;
+  }
+  try {
+    socket.close();
+  } catch {
+    // already closed
+  }
+}
+
 async function bindUdpSocket(): Promise<Socket> {
   const socket = dgram.createSocket("udp4");
   await new Promise<void>((resolveBind, rejectBind) => {
diff --git a/packages/cultnet-ts/test/runtime-presence-health.test.ts b/packages/cultnet-ts/test/runtime-presence-health.test.ts
new file mode 100644
index 00000000..fa21aeaa
--- /dev/null
+++ b/packages/cultnet-ts/test/runtime-presence-health.test.ts
@@ -0,0 +1,123 @@
+// Cross-fork conformance for `gamecult.runtime_presence_health.v2`.
+//
+// The vectors below were produced by `cultnet-rs`, not written by hand:
+//
+//   cargo run --example runtime_presence_vector -p cultnet-rs
+//
+// That matters. A fixture authored for both sides at once agrees with itself
+// and proves nothing; the contract is only real if one fork emits the bytes and
+// the other reproduces them. Regenerate these vectors from the Rust example if
+// the record ever changes, and never by editing them to match this code.
+
+import test from "node:test";
+import assert from "node:assert/strict";
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+
+import {
+  RUNTIME_PRESENCE_FIELD_COUNT,
+  encodeRuntimePresenceHealth,
+  runtimePresenceProofPayload,
+  validateRuntimePresence,
+  type RuntimePresenceHealth,
+} from "../src/runtime-presence-health";
+
+// Read from the source tree, not a copy beside the compiled test: the vectors
+// are generated output and must have exactly one home.
+const VECTORS = JSON.parse(
+  readFileSync(
+    join(__dirname, "..", "..", "test", "fixtures", "runtime-presence-vectors.json"),
+    "utf8",
+  ),
+) as { proof: string; signed: string };
+
+/** The same statement the Rust example builds. */
+function referencePresence(): RuntimePresenceHealth {
+  return {
+    target: "heimdall",
+    expectedProjectionSha256: `sha256-${"a".repeat(64)}`,
+    planId: `sha256-${"b".repeat(64)}`,
+    incarnationId: "service-incarnation-1",
+    sealedReleaseId: `sha256-${"c".repeat(64)}`,
+    activationWitnessSha256: `sha256-${"d".repeat(64)}`,
+    stateSchemaGeneration: "v1",
+    stateContractSha256: `sha256-${"e".repeat(64)}`,
+    runtimeId: "heimdall-yggdrasil",
+    runtimeInstanceId: `sha256-${"f".repeat(64)}`,
+    boundEndpoint: "http://127.0.0.1:14101",
+    capabilities: [
+      {
+        capability: "heimdall.access",
+        schema: "heimdall.access.v1",
+        compatibility: "v1",
+        capacity: 2,
+      },
+      { capability: "zeta.runtime", schema: "zeta.runtime.v1", compatibility: "v1", capacity: 1 },
+    ],
+    healthContract: "heimdall.cultnet-rudp-provider-health",
+    state: "warming",
+    detail: "Heimdall candidate warming",
+    writeLeaseSha256: null,
+    signerIdentityId: "1".repeat(64),
+    publisherSequence: 7,
+    observedAtUnixMillis: 1_757_000_000_000,
+    activationSignerIdentityId: "2".repeat(64),
+  };
+}
+
+function hex(bytes: Uint8Array): string {
+  return Buffer.from(bytes).toString("hex");
+}
+
+test("the proof payload is byte-identical to the one cultnet-rs signs", () => {
+  assert.equal(hex(runtimePresenceProofPayload(referencePresence())), VECTORS.proof);
+});
+
+test("the signed record carries both proofs in their own slots", () => {
+  const signed = encodeRuntimePresenceHealth(
+    referencePresence(),
+    new Uint8Array(64).fill(0x11),
+    new Uint8Array(64).fill(0x22),
+  );
+  // Byte-identical to the fully signed record cultnet-rs emits, so the proofs
+  // land in their own slots rather than being appended.
+  assert.equal(hex(signed), VECTORS.signed);
+});
+
+test("capabilities are ordered canonically regardless of caller order", () => {
+  const presence = referencePresence();
+  const reversed = { ...presence, capabilities: [...presence.capabilities].reverse() };
+  assert.equal(
+    hex(runtimePresenceProofPayload(reversed)),
+    hex(runtimePresenceProofPayload(presence)),
+  );
+});
+
+test("the tuple is always the full contract width", () => {
+  assert.equal(RUNTIME_PRESENCE_FIELD_COUNT, 24);
+});
+
+test("statements the contract forbids are refused before they are signed", () => {
+  const warmingWithLease = {
+    ...referencePresence(),
+    writeLeaseSha256: `sha256-${"0".repeat(64)}`,
+  };
+  assert.throws(() => validateRuntimePresence(warmingWithLease), /cannot claim a process write/);
+
+  const statelessWithLease = {
+    ...referencePresence(),
+    state: "active" as const,
+    stateSchemaGeneration: null,
+    stateContractSha256: null,
+    writeLeaseSha256: `sha256-${"0".repeat(64)}`,
+  };
+  assert.throws(() => validateRuntimePresence(statelessWithLease), /stateless runtime presence/);
+
+  assert.throws(
+    () => validateRuntimePresence({ ...referencePresence(), publisherSequence: 0 }),
+    /publisher sequence/,
+  );
+
+  const partialLineage = { ...referencePresence(), stateContractSha256: null };
+  assert.throws(() => validateRuntimePresence(partialLineage), /state lineage is partial/);
+});
diff --git a/samples/eve-browser-network/EveBrowserNetworkSample.csproj b/samples/eve-browser-network/EveBrowserNetworkSample.csproj
new file mode 100644
index 00000000..50b41781
--- /dev/null
+++ b/samples/eve-browser-network/EveBrowserNetworkSample.csproj
@@ -0,0 +1,23 @@
+<Project Sdk="Microsoft.NET.Sdk.Web">
+  <PropertyGroup>
+    <TargetFramework>net10.0</TargetFramework>
+    <ImplicitUsings>enable</ImplicitUsings>
+    <Nullable>enable</Nullable>
+    <EveRoot Condition="'$(EveRoot)' == ''">$(MSBuildThisFileDirectory)..\..\..\Eve</EveRoot>
+    <UsePackageArtifacts Condition="'$(UsePackageArtifacts)' == ''">false</UsePackageArtifacts>
+    <CultLibPackageVersion Condition="'$(CultLibPackageVersion)' == ''">1.0.35</CultLibPackageVersion>
+    <EveSurfacePackageVersion Condition="'$(EveSurfacePackageVersion)' == ''">0.3.3</EveSurfacePackageVersion>
+    <RestoreAdditionalProjectSources Condition="'$(PackageFeed)' != ''">$(PackageFeed)</RestoreAdditionalProjectSources>
+  </PropertyGroup>
+  <ItemGroup Condition="'$(UsePackageArtifacts)' != 'true'">
+    <ProjectReference Include="..\..\src\GameCult.Networking.WebSockets\GameCult.Networking.WebSockets.csproj" />
+    <ProjectReference Include="..\..\src\GameCult.Mesh\GameCult.Mesh.csproj" />
+    <ProjectReference Include="$(EveRoot)\packages\org.gamecult.eve.surface\GameCult.Eve.Surface.csproj"
+                      AdditionalProperties="CultLibRoot=$(MSBuildThisFileDirectory)..\.." />
+  </ItemGroup>
+  <ItemGroup Condition="'$(UsePackageArtifacts)' == 'true'">
+    <PackageReference Include="GameCult.Mesh" Version="$(CultLibPackageVersion)" />
+    <PackageReference Include="GameCult.Networking.WebSockets" Version="$(CultLibPackageVersion)" />
+    <PackageReference Include="GameCult.Eve.Surface" Version="$(EveSurfacePackageVersion)" />
+  </ItemGroup>
+</Project>
diff --git a/samples/eve-browser-network/Program.cs b/samples/eve-browser-network/Program.cs
new file mode 100644
index 00000000..c26d654b
--- /dev/null
+++ b/samples/eve-browser-network/Program.cs
@@ -0,0 +1,520 @@
+using System.Net;
+using System.Diagnostics;
+using System.Text.Json;
+using GameCult.Caching;
+using GameCult.Caching.MessagePack;
+using GameCult.Eve.Surface;
+using GameCult.Mesh;
+using GameCult.Networking;
+using GameCult.Networking.WebSockets;
+using MessagePack;
+using Microsoft.AspNetCore.Hosting.Server;
+using Microsoft.AspNetCore.Hosting.Server.Features;
+using Microsoft.Extensions.DependencyInjection;
+
+const string counterKey = "counter:main";
+const string surfaceKey = "sample.counter";
+const string providerKey = "sample.counter-ui";
+const string commandBoundary = "sample.counter.commands";
+var arguments = Args.Parse(args);
+if (arguments.Mode == "provider")
+{
+    await RunProviderAsync(arguments);
+    return;
+}
+if (arguments.Mode == "headless")
+{
+    await RunHeadlessAsync(arguments);
+    return;
+}
+if (arguments.Mode == "odin")
+{
+    await RunOdinAsync(arguments);
+    return;
+}
+throw new InvalidOperationException("Use 'provider', 'headless', or 'odin'.");
+
+static async Task RunOdinAsync(Args arguments)
+{
+    if (string.IsNullOrWhiteSpace(arguments.ProviderEndpoint))
+        throw new ArgumentException("The Odin fixture requires --provider-endpoint.");
+    using var catalog = new CultMeshVerseCatalog();
+    var routes = new List<CultMeshAuthorityRoute>
+    {
+        new(
+            arguments.AuthorityRuntimeId,
+            arguments.ProviderEndpoint,
+            [CultMeshProtocols.Documents.Value],
+            priority: 10,
+            generation: arguments.RouteGeneration)
+    };
+    if (!string.IsNullOrWhiteSpace(arguments.DecoyEndpoint))
+    {
+        routes.Add(new CultMeshAuthorityRoute(
+            arguments.DecoyAuthorityRuntimeId,
+            arguments.DecoyEndpoint,
+            [CultMeshProtocols.Documents.Value],
+            priority: 0,
+            generation: arguments.DecoyRouteGeneration));
+    }
+    catalog.Upsert(new CultMeshVerseDescriptor(
+        arguments.VerseId,
+        arguments.VerseName,
+        CultMeshVerseAuthorityModel.OperatorCluster,
+        new CultMeshVerseCompatibility(arguments.TransportVersion, arguments.RulesHash),
+        authorityRoutes: routes,
+        description: "Local executable Odin fixture for the browser/network onboarding witness."));
+
+    await using var schemaServer = new CultNetWebSocketSchemaServer();
+    schemaServer.OnCultNet<CultMeshVerseCatalogRequestMessage>((request, peer) =>
+    {
+        peer.SendCultNet(CultMeshVerseMessages.CreateCatalogResponse(catalog, request));
+        return Task.CompletedTask;
+    });
+    var builder = WebApplication.CreateSlimBuilder();
+    builder.WebHost.ConfigureKestrel(options => options.Listen(IPAddress.Loopback, arguments.Port));
+    var app = builder.Build();
+    app.UseWebSockets();
+    app.MapCultNetWebSocket("/odin", schemaServer, new CultNetWebSocketEndpointOptions
+    {
+        AuthorizeAsync = context => ValueTask.FromResult(
+            context.Request.Cookies.TryGetValue("cultnet_session", out var token) &&
+            string.Equals(token, arguments.Token, StringComparison.Ordinal))
+    });
+    await app.StartAsync();
+    var address = app.Services.GetRequiredService<IServer>()
+        .Features.Get<IServerAddressesFeature>()!.Addresses.Single();
+    Console.WriteLine("ODIN_READY " + address.Replace("http://", "ws://", StringComparison.Ordinal) + "/odin");
+    await app.WaitForShutdownAsync();
+    await app.DisposeAsync();
+}
+
+static async Task RunProviderAsync(Args arguments)
+{
+    var documentTypes = new[] { typeof(CounterState), typeof(EveSurfaceDocument), typeof(EveProviderAdvertisementDocument) };
+    var registry = CultMesh.CreateCultCacheDocumentRegistry(documentTypes);
+    var documents = CultMesh.CreateCultNetDocumentRegistry(documentTypes, registry);
+    using var node = await CultMesh.CreateNodeAsync(arguments.StatePath, new CultMeshNodeOptions
+    {
+        StartServer = false,
+        CacheOptions = new CultCacheOpenOptions
+        {
+            Registry = registry,
+            FlushOnDispose = true,
+            StoreFlushOnDispose = true
+        },
+        DatabaseOptions = new CultNetDatabaseOptions
+        {
+            RuntimeId = arguments.AuthorityRuntimeId,
+            DocumentRegistry = documents
+        }
+    });
+    if (node.Cache.Get<CounterState>(new CultRecordKey(counterKey)) == null)
+        await node.Database.PutAsync(new CultRecordKey(counterKey), CounterState.Initial(counterKey));
+    if (node.Cache.Get<EveSurfaceDocument>(new CultRecordKey(surfaceKey)) == null)
+        await node.Database.PutAsync(new CultRecordKey(surfaceKey), CreateCounterSurface());
+    // The advertisement is how a lowering learns where this surface's commands
+    // go and what comes back. Eve refuses to build a command intent without it,
+    // and the browser must not have to restate it: the provider is the owner.
+    await node.Database.PutAsync(new CultRecordKey(providerKey), CreateProviderAdvertisement(arguments));
+    await node.FlushAsync();
+
+    await using var schemaServer = new CultNetWebSocketSchemaServer();
+    using var identity = new CultMeshSessionIdentityServer(
+        schemaServer,
+        arguments.AuthorityRuntimeId,
+        [arguments.VerseId],
+        [CultMeshProtocols.Documents.Value],
+        [arguments.RouteGeneration]);
+    using var subscriptions = new CultNetDatabaseSubscriptionServer(schemaServer, node.Database);
+    using var operationGate = new SemaphoreSlim(1, 1);
+    using var operations = new CultNetOperationServer(schemaServer, arguments.AuthorityRuntimeId)
+        .Register<PingRequest, PingReceipt>(
+            "sample.counter",
+            "sample.counter.ping",
+            "sample.ping_request.v1",
+            "sample.ping_receipt.v1",
+            context => Task.FromResult(new PingReceipt { Sequence = context.Value.Sequence }))
+        .Register<IncrementRequest, IncrementReceipt>(
+            "sample.counter",
+            "sample.counter.increment",
+            "sample.increment.v1",
+            "gamecult.eve.command_receipt.v1",
+            async context =>
+            {
+                await operationGate.WaitAsync();
+                try
+                {
+                    var current = node.Cache.Get<CounterState>(new CultRecordKey(counterKey))
+                        ?? throw new InvalidOperationException("Counter state is unavailable.");
+                    if (current.Receipts.TryGetValue(context.IdempotencyKey, out var existing))
+                        return existing;
+
+                    var receipt = IncrementReceipt.Accepted(
+                        context.IdempotencyKey,
+                        current.Count + context.Value.Amount);
+                    var receipts = new Dictionary<string, IncrementReceipt>(current.Receipts, StringComparer.Ordinal)
+                    {
+                        [context.IdempotencyKey] = receipt
+                    };
+                    await node.Database.PutAsync(new CultRecordKey(counterKey), new CounterState
+                    {
+                        CounterId = counterKey,
+                        Count = receipt.Count,
+                        Receipts = receipts
+                    });
+                    await node.FlushAsync();
+                    return receipt;
+                }
+                finally
+                {
+                    operationGate.Release();
+                }
+            });
+
+    var builder = WebApplication.CreateSlimBuilder();
+    builder.WebHost.ConfigureKestrel(options => options.Listen(IPAddress.Loopback, arguments.Port));
+    var app = builder.Build();
+    app.UseWebSockets();
+    app.MapCultNetWebSocket("/cultmesh", schemaServer, new CultNetWebSocketEndpointOptions
+    {
+        AuthorizeAsync = context => ValueTask.FromResult(
+            context.Request.Cookies.TryGetValue("cultnet_session", out var token) &&
+            string.Equals(token, arguments.Token, StringComparison.Ordinal))
+    });
+    await app.StartAsync();
+    var address = app.Services.GetRequiredService<IServer>()
+        .Features.Get<IServerAddressesFeature>()!.Addresses.Single();
+    Console.WriteLine("PROVIDER_READY " + address.Replace("http://", "ws://", StringComparison.Ordinal) + "/cultmesh");
+    await app.WaitForShutdownAsync();
+    await app.DisposeAsync();
+}
+
+static async Task RunHeadlessAsync(Args arguments)
+{
+    if (string.IsNullOrWhiteSpace(arguments.OdinEndpoint))
+        throw new ArgumentException("The headless client requires --odin.");
+    CultNetWebSocketSchemaClient CreateClient() => new(options =>
+        options.SetRequestHeader("Cookie", $"cultnet_session={arguments.Token}"));
+    using var mesh = new CultMeshClient(new CultMeshClientOptions
+    {
+        RendezvousEndpoints = [arguments.OdinEndpoint],
+        Discovery = new CultMeshVerseDiscoveryClientOptions
+        {
+            CreateClient = CreateClient,
+            TransportVersion = arguments.TransportVersion
+        },
+        Sessions = new CultMeshSessionManagerOptions
+        {
+            Trust = new CultMeshAuthorityTrustPolicy(CultMeshAuthorityTrustMode.LocalDevelopment)
+        },
+        Connectors =
+        [
+            new CultMeshUriSchemaTransportConnector(
+                "cultnet-websocket",
+                ["ws", "wss"],
+                _ => CreateClient())
+        ]
+    });
+    var target = new CultMeshSessionTarget(arguments.VerseId, arguments.AuthorityRuntimeId);
+    using var lease = await mesh.LeaseDocumentAsync<CounterState>(target, counterKey);
+    var completion = new TaskCompletionSource(TaskCreationOptions.RunContinuationsAsynchronously);
+    var lastCount = -1;
+    using var watch = lease.Handle.Watch(counter =>
+    {
+        if (counter.Count <= lastCount) return;
+        lastCount = counter.Count;
+        if (counter.Count == 0)
+            Console.WriteLine("HEADLESS_READY " + JsonSerializer.Serialize(new { count = counter.Count }));
+        else
+            Console.WriteLine($"HEADLESS_UPDATE_{counter.Count} " + JsonSerializer.Serialize(new
+            {
+                count = counter.Count,
+                receiptIds = counter.Receipts.Values
+                    .Select(receipt => receipt.ReceiptId)
+                    .OrderBy(value => value, StringComparer.Ordinal)
+                    .ToArray()
+            }));
+        if (counter.Count >= arguments.ExpectedCount) completion.TrySetResult();
+    });
+    var initial = await lease.Handle.LatestAsync();
+    if (lastCount < 0)
+    {
+        lastCount = initial.Count;
+        Console.WriteLine("HEADLESS_READY " + JsonSerializer.Serialize(new { count = initial.Count }));
+    }
+    if (initial.Count >= arguments.ExpectedCount) completion.TrySetResult();
+    var commandTask = Task.Run(async () =>
+    {
+        var line = await Console.In.ReadLineAsync();
+        if (line == null || !line.StartsWith("INVOKE ", StringComparison.Ordinal))
+            throw new InvalidOperationException("The headless sample expected 'INVOKE <idempotency-key>' on stdin.");
+        var commandId = line["INVOKE ".Length..].Trim();
+        var result = await mesh.InvokeAsync<IncrementRequest, IncrementReceipt>(
+            target,
+            "sample.counter",
+            "sample.counter.increment",
+            "sample.increment.v1",
+            "gamecult.eve.command_receipt.v1",
+            new IncrementRequest { Amount = 1 },
+            sourceRuntimeId: "sample.csharp",
+            idempotencyKey: commandId);
+        Console.WriteLine("HEADLESS_RECEIPT " + JsonSerializer.Serialize(new
+        {
+            receiptId = result.Value.ReceiptId,
+            count = result.Value.Count,
+            status = result.Status
+        }));
+        Console.WriteLine("HEADLESS_NETWORK_BENCHMARK " + JsonSerializer.Serialize(
+            await MeasureOperationSessionAsync(mesh, target, arguments)));
+    });
+    await Task.WhenAll(completion.Task, commandTask).WaitAsync(TimeSpan.FromSeconds(45));
+}
+
+static async Task<object> MeasureOperationSessionAsync(
+    CultMeshClient mesh,
+    CultMeshSessionTarget target,
+    Args arguments)
+{
+    const int warmupOperations = 100;
+    if (arguments.BenchmarkOperations <= 0)
+        throw new ArgumentOutOfRangeException(nameof(arguments.BenchmarkOperations));
+    for (var index = 0; index < warmupOperations; index++)
+        await PingAsync(mesh, target, "warmup:" + index, index);
+
+    ForceCollection();
+    using var process = Process.GetCurrentProcess();
+    process.Refresh();
+    var managedHeapBefore = GC.GetTotalMemory(forceFullCollection: false);
+    var privateBytesBefore = process.PrivateMemorySize64;
+    var latencies = new double[arguments.BenchmarkOperations];
+    var clock = Stopwatch.StartNew();
+    for (var index = 0; index < arguments.BenchmarkOperations; index++)
+    {
+        var started = Stopwatch.GetTimestamp();
+        await PingAsync(mesh, target, "benchmark:" + index, index);
+        latencies[index] = Stopwatch.GetElapsedTime(started).TotalMilliseconds;
+    }
+    clock.Stop();
+    ForceCollection();
+    process.Refresh();
+    var managedHeapAfter = GC.GetTotalMemory(forceFullCollection: false);
+    var privateBytesAfter = process.PrivateMemorySize64;
+    Array.Sort(latencies);
+    var p99 = latencies[Math.Clamp((int)Math.Ceiling(latencies.Length * 0.99) - 1, 0, latencies.Length - 1)];
+    var managedHeapGrowth = managedHeapAfter - managedHeapBefore;
+    if (managedHeapGrowth > 8 * 1024 * 1024)
+        throw new InvalidOperationException($"Retained operation session grew the managed heap by {managedHeapGrowth} bytes.");
+    if (p99 > 250)
+        throw new InvalidOperationException($"Retained operation session p99 was {p99:F2} ms.");
+    return new
+    {
+        operations = arguments.BenchmarkOperations,
+        p99Milliseconds = p99,
+        operationsPerSecond = arguments.BenchmarkOperations / clock.Elapsed.TotalSeconds,
+        managedHeapBefore,
+        managedHeapAfter,
+        managedHeapGrowth,
+        privateBytesBefore,
+        privateBytesAfter,
+        privateBytesGrowth = privateBytesAfter - privateBytesBefore
+    };
+}
+
+static async Task PingAsync(
+    CultMeshClient mesh,
+    CultMeshSessionTarget target,
+    string idempotencyKey,
+    int sequence)
+{
+    var result = await mesh.InvokeAsync<PingRequest, PingReceipt>(
+        target,
+        "sample.counter",
+        "sample.counter.ping",
+        "sample.ping_request.v1",
+        "sample.ping_receipt.v1",
+        new PingRequest { Sequence = sequence },
+        sourceRuntimeId: "sample.csharp",
+        idempotencyKey: idempotencyKey);
+    if (result.Status != "accepted" || result.Value.Sequence != sequence)
+        throw new InvalidOperationException("The typed ping receipt did not match its request.");
+}
+
+static void ForceCollection()
+{
+    GC.Collect();
+    GC.WaitForPendingFinalizers();
+    GC.Collect();
+}
+
+static EveProviderAdvertisementDocument CreateProviderAdvertisement(Args arguments)
+{
+    var worldInteraction = new EveWorldInteractionAdvertisement(
+        projectionKind: "surface-state",
+        stateSchemas: ["sample.counter_state.v1"],
+        commandBoundary: commandBoundary,
+        commandRecordRef: "",
+        receiptSchema: EveCommandReceiptDocument.SchemaId,
+        receiptRecordRef: "",
+        assetManifestRecordRef: "",
+        loweringTargets: ["browser"],
+        ownership: arguments.AuthorityRuntimeId);
+    return new EveProviderAdvertisementDocument(
+        providerId: providerKey,
+        serviceId: arguments.VerseId,
+        verseId: arguments.VerseId,
+        title: "CultMesh browser counter",
+        kind: "sample.daemon",
+        cultMeshAddress: arguments.AuthorityRuntimeId,
+        updatedAtUtc: DateTime.UtcNow.ToString("O"),
+        freshness: new EveProviderFreshness("live", DateTime.UtcNow.ToString("O"), 0),
+        schemas: ["sample.counter_state.v1", EveSurfaceDocument.SchemaId, EveCommandReceiptDocument.SchemaId],
+        witnesses: [],
+        surfaces:
+        [
+            new EveAdvertisedSurface(
+                surfaceKey,
+                EveSurfaceDocument.SchemaId,
+                surfaceKey,
+                "cultmesh",
+                "live",
+                "surface",
+                worldInteraction)
+        ],
+        commands: [new EveAdvertisedCommand("sample.counter.increment", surfaceKey, "cultmesh", "Increment")]);
+}
+
+static EveSurfaceDocument CreateCounterSurface()
+{
+    var networkRoute = new CultMeshRouteHint(CultMeshLocalityKind.Network, "cultmesh");
+    var count = new CultMeshStateBindingDescriptor(
+        "value",
+        "sample.counter.count",
+        "sample.counter_state:counter:main",
+        "sample.counter_state.v1",
+        networkRoute);
+    var increment = CultMesh.OperationBinding(
+        "sample.counter.increment",
+        "Increment",
+        "sample.increment.v1",
+        networkRoute);
+    return EveSurface.Create(surfaceKey)
+        .Provider("sample.counter-ui", "sample.daemon")
+        .Title("CultMesh browser counter")
+        .Version(1)
+        .UpdatedAtUtc("2026-08-17T00:00:00Z")
+        .RootColumn("counter.root", root => root
+            .Title("counter.title", "CultMesh browser counter")
+            .Metric("counter.value", "Canonical count", "0", count)
+            .Button("counter.increment", "Increment", increment))
+        .Build();
+}
+
+sealed class Args
+{
+    public string Mode { get; private init; } = "";
+    public int Port { get; private init; }
+    public string StatePath { get; private init; } = "sample-counter.cc";
+    public string OdinEndpoint { get; private init; } = "";
+    public string ProviderEndpoint { get; private init; } = "";
+    public string DecoyEndpoint { get; private init; } = "";
+    public string Token { get; private init; } = "sample-session";
+    public string VerseId { get; private init; } = "sample.counter";
+    public string VerseName { get; private init; } = "CultMesh browser counter";
+    public string AuthorityRuntimeId { get; private init; } = "sample.counter-daemon";
+    public string DecoyAuthorityRuntimeId { get; private init; } = "sample.decoy-daemon";
+    public string TransportVersion { get; private init; } = "cultmesh.v0";
+    public string RulesHash { get; private init; } = "sample-counter-v1";
+    public string RouteGeneration { get; private init; } = "sample-counter-route-1";
+    public string DecoyRouteGeneration { get; private init; } = "sample-decoy-route-1";
+    public int ExpectedCount { get; private init; } = 2;
+    public int BenchmarkOperations { get; private init; } = 10_000;
+
+    public static Args Parse(string[] values)
+    {
+        if (values.Length == 0) return new Args();
+        var named = new Dictionary<string, string>(StringComparer.Ordinal);
+        for (var index = 1; index + 1 < values.Length; index += 2)
+            named[values[index]] = values[index + 1];
+        return new Args
+        {
+            Mode = values[0],
+            Port = named.TryGetValue("--port", out var port) ? int.Parse(port) : 0,
+            StatePath = named.GetValueOrDefault("--state", "sample-counter.cc"),
+            OdinEndpoint = named.GetValueOrDefault("--odin", ""),
+            ProviderEndpoint = named.GetValueOrDefault("--provider-endpoint", ""),
+            DecoyEndpoint = named.GetValueOrDefault("--decoy-endpoint", ""),
+            Token = named.GetValueOrDefault("--token", "sample-session"),
+            VerseId = named.GetValueOrDefault("--verse-id", "sample.counter"),
+            VerseName = named.GetValueOrDefault("--verse-name", "CultMesh browser counter"),
+            AuthorityRuntimeId = named.GetValueOrDefault("--authority-runtime-id", "sample.counter-daemon"),
+            DecoyAuthorityRuntimeId = named.GetValueOrDefault("--decoy-authority-runtime-id", "sample.decoy-daemon"),
+            TransportVersion = named.GetValueOrDefault("--transport-version", "cultmesh.v0"),
+            RulesHash = named.GetValueOrDefault("--rules-hash", "sample-counter-v1"),
+            RouteGeneration = named.GetValueOrDefault("--route-generation", "sample-counter-route-1"),
+            DecoyRouteGeneration = named.GetValueOrDefault("--decoy-route-generation", "sample-decoy-route-1"),
+            ExpectedCount = named.TryGetValue("--expected-count", out var expectedCount)
+                ? int.Parse(expectedCount)
+                : 2,
+            BenchmarkOperations = named.TryGetValue("--benchmark-operations", out var benchmarkOperations)
+                ? int.Parse(benchmarkOperations)
+                : 10_000
+        };
+    }
+}
+
+[CultDocument("sample.counter_state", "sample.counter_state.v1")]
+[MessagePackObject]
+public sealed class CounterState
+{
+    [Key(0)] public string CounterId { get; set; } = "";
+    [Key(1)] public int Count { get; set; }
+    [Key(2)] public Dictionary<string, IncrementReceipt> Receipts { get; set; } = new(StringComparer.Ordinal);
+    public static CounterState Initial(string counterId) => new() { CounterId = counterId };
+}
+
+[MessagePackObject]
+public sealed class IncrementRequest
+{
+    [Key("amount")] public int Amount { get; set; } = 1;
+}
+
+[MessagePackObject]
+public sealed class IncrementReceipt
+{
+    [Key("receiptId")] public string ReceiptId { get; set; } = "";
+    [Key("schema")] public string Schema { get; set; } = "gamecult.eve.command_receipt.v1";
+    [Key("commandId")] public string CommandId { get; set; } = "";
+    [Key("command")] public string Command { get; set; } = "sample.counter.increment";
+    [Key("state")] public string State { get; set; } = "accepted";
+    [Key("ownerRepo")] public string OwnerRepo { get; set; } = "CultLib";
+    [Key("authority")] public string Authority { get; set; } = "provider-daemon";
+    [Key("providerId")] public string ProviderId { get; set; } = "sample.counter-ui";
+    [Key("surfaceId")] public string SurfaceId { get; set; } = "sample.counter";
+    [Key("issuedAtUtc")] public string IssuedAtUtc { get; set; } = "";
+    [Key("sourceVersion")] public int SourceVersion { get; set; }
+    [Key("idempotencyKey")] public string IdempotencyKey { get; set; } = "";
+    [Key("count")] public int Count { get; set; }
+
+    public static IncrementReceipt Accepted(string id, int count) => new()
+    {
+        ReceiptId = $"receipt:{id}",
+        CommandId = id,
+        IssuedAtUtc = DateTimeOffset.UtcNow.ToString("O"),
+        SourceVersion = count,
+        IdempotencyKey = id,
+        Count = count
+    };
+}
+
+[MessagePackObject]
+public sealed class PingRequest
+{
+    [Key("sequence")] public int Sequence { get; set; }
+}
+
+[MessagePackObject]
+public sealed class PingReceipt
+{
+    [Key("sequence")] public int Sequence { get; set; }
+}
diff --git a/samples/eve-browser-network/README.md b/samples/eve-browser-network/README.md
new file mode 100644
index 00000000..445bfb9d
--- /dev/null
+++ b/samples/eve-browser-network/README.md
@@ -0,0 +1,58 @@
+# Eve Browser + Headless Counter
+
+This is the real-process continuation of `samples/eve-two-runtime`:
+
+- one C# provider owns a durable `.cc` counter, the Eve surface, command
+  idempotency, and canonical receipts;
+- one real Chromium page leases both documents through `cultmesh-browser` and
+  lowers the provider-owned Eve surface;
+- one retained C# headless client discovers the provider through the same Odin
+  identity, observes the typed counter and canonical receipt ids, survives the
+  provider route replacement, and invokes through the generic CultMesh client
+  without application transport or reconnect code;
+- one separate local Odin fixture answers the canonical CultMesh Verse catalog
+  over binary CultNet WebSocket messages;
+- one wrong-authority provider is deliberately advertised on a better-priority
+  route, and both clients must ignore it because the route is bound to another
+  runtime;
+- the browser and C# clients speak the same binary CultNet schema-v0 WebSocket
+  messages through the authenticated host adapter.
+
+The provider registers typed commands through `CultNetOperationServer`.
+Application code receives `CultNetOperationContext<TRequest>` and returns a
+typed receipt; it does not parse base64, switch on wire envelopes, or construct
+correlation responses. The counter's durable transaction still owns
+idempotency and state mutation. The provider opens one public `CultMeshNode`;
+it does not assemble a parallel CultCache/CultNet database host by hand.
+
+Run the proof from the CultLib repository:
+
+```powershell
+pwsh -File ./scripts/verify-eve-getting-started.ps1
+```
+
+The wrapper first proves clean package consumption, then runs this real-process
+checkpoint. Run `node scripts/verify-eve-browser-network.mjs --eve-root ../Eve`
+directly only to diagnose the network layer. Browser discovery is portable:
+`CHROME_PATH` wins when configured, then common Chrome/Chromium/Edge locations
+and Playwright's installed Chromium are checked.
+
+The verifier clicks the Eve button twice with one idempotency key and requires
+one state transition. It then restarts the provider on a different physical
+port, updates the local Odin fixture, and requires both retained clients to
+rediscover and resubscribe. The C# client invokes the second command through
+`CultMeshClient.InvokeAsync`; Chromium observes the resulting count and both
+clients observe both canonical receipt ids.
+The retained C# client then sends 10,000 typed no-op operations over the same
+real WebSocket session. The gate records p99 latency, throughput, managed heap,
+and private memory, and rejects more than 8 MiB of post-GC managed growth or a
+250 ms p99. The no-op provider handler stores no receipt history, so persistence
+growth cannot impersonate a client leak.
+The fixture speaks the production Verse-catalog contract; a deployment smoke
+against the full Odin daemon remains a separate infrastructure gate.
+
+The `odin` fixture defaults to this sample's Verse, but its `--verse-id`,
+`--verse-name`, `--authority-runtime-id`, `--transport-version`, and
+`--rules-hash` arguments can advertise another real provider during a product
+route-rotation witness. The provider endpoint remains data owned by Odin; the
+consumer still connects only by stable Verse and provider identity.
diff --git a/samples/eve-browser-network/browser/index.html b/samples/eve-browser-network/browser/index.html
new file mode 100644
index 00000000..d23ad8ab
--- /dev/null
+++ b/samples/eve-browser-network/browser/index.html
@@ -0,0 +1,13 @@
+<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <title>CultMesh Eve browser counter</title>
+</head>
+<body>
+  <main id="surface">Connecting to the Verse…</main>
+  <output id="receipt" aria-live="polite"></output>
+  <script type="module" src="/bundle.js"></script>
+</body>
+</html>
diff --git a/samples/eve-browser-network/browser/main.ts b/samples/eve-browser-network/browser/main.ts
new file mode 100644
index 00000000..fac4cc43
--- /dev/null
+++ b/samples/eve-browser-network/browser/main.ts
@@ -0,0 +1,110 @@
+import { parseEveCommandReceipt, parseEveProviderAdvertisement, parseEveSurfaceDocument } from "@gamecult/eve-contracts";
+import { renderEveSurface } from "@gamecult/eve-browser-lowering";
+import {
+  CultMeshBrowserClient,
+  CultMeshBrowserOdinRendezvous,
+  decodeCultNetOperationPayload,
+  decodeCultNetPayload,
+} from "cultmesh-browser";
+
+// CounterState is an integer-keyed MessagePack object: [counterId, count, receipts].
+const counterCount = (record: Parameters<typeof decodeCultNetPayload>[0]) =>
+  decodeCultNetPayload<[string, number, unknown]>(record)[1];
+
+declare global {
+  interface Window {
+    __sampleReady?: boolean;
+    __sampleCount?: number;
+    __sampleReceipt?: { receiptId: string; count: number };
+    __sampleCommandId?: string;
+    __sampleConnectionStates?: string[];
+    __sampleError?: string;
+  }
+}
+
+const params = new URLSearchParams(location.search);
+const odinEndpoint = params.get("odin");
+const token = params.get("token") || "sample-session";
+if (!odinEndpoint) throw new Error("The sample requires an Odin endpoint query parameter.");
+document.cookie = `cultnet_session=${encodeURIComponent(token)}; Path=/; SameSite=Strict`;
+
+const host = document.querySelector<HTMLElement>("#surface")!;
+const receiptOutput = document.querySelector<HTMLOutputElement>("#receipt")!;
+
+try {
+  const mesh = await CultMeshBrowserClient.connect({
+    verseId: "sample.counter",
+    authorityRuntimeId: "sample.counter-daemon",
+    runtimeId: "sample.chromium",
+    trust: { mode: "local-development" },
+    rendezvous: new CultMeshBrowserOdinRendezvous({
+      endpoints: [odinEndpoint],
+      runtimeId: "sample.chromium.discovery",
+      transportVersion: "cultmesh.v0",
+    }),
+  });
+  window.__sampleConnectionStates = [];
+  mesh.watchState(state => window.__sampleConnectionStates!.push(state));
+  window.__sampleCommandId = "browser-click-1";
+  const counter = await mesh.leaseRawDocument({
+    schemaId: "sample.counter_state.v1",
+    recordKey: "counter:main",
+    subscriptionId: "browser-counter",
+  });
+  const surface = await mesh.leaseRawDocument({
+    schemaId: "gamecult.eve.surface.v1",
+    recordKey: "sample.counter",
+    subscriptionId: "browser-surface",
+  });
+  // The provider owns the declaration of where this surface's commands go and
+  // what comes back; the page reads it rather than restating it.
+  const advertisement = await mesh.leaseRawDocument({
+    schemaId: "gamecult.eve.provider_advertisement.v1",
+    recordKey: "sample.counter-ui",
+    subscriptionId: "browser-provider",
+  });
+  const provider = parseEveProviderAdvertisement(decodeCultNetPayload(advertisement.current!));
+  const currentSurface = parseEveSurfaceDocument(decodeCultNetPayload(surface.current!));
+  renderEveSurface(currentSurface, host, {
+    activeSurfaceId: "sample.counter",
+    clientId: "sample.chromium",
+    provider,
+    commandSink: async intent => {
+      const response = await mesh.invoke({
+        serviceId: "sample.counter",
+        operation: intent.operation.operationId,
+        payloadSchema: "sample.increment.v1",
+        payload: { amount: 1 },
+        idempotencyKey: window.__sampleCommandId,
+      });
+      const receipt = parseEveCommandReceipt(decodeCultNetOperationPayload(response)) as {
+        receiptId: string;
+        count: number;
+      };
+      window.__sampleReceipt = receipt;
+      receiptOutput.textContent = receipt.receiptId;
+    },
+    stateBindingResolver: async binding => {
+      if (binding.pointerId !== "sample.counter.count") return undefined;
+      return {
+        latest: async () => counterCount(counter.current!),
+        watch: callback => counter.watch(record => {
+          if (!record) return;
+          const count = counterCount(record);
+          window.__sampleCount = count;
+          callback(count);
+        }),
+      };
+    },
+  });
+  window.__sampleCount = counterCount(counter.current!);
+  window.__sampleReady = true;
+} catch (error) {
+  const details = error instanceof AggregateError
+    ? error.errors.map(inner => inner instanceof Error ? inner.stack || inner.message : String(inner)).join("\n---\n")
+    : "";
+  window.__sampleError = (error instanceof Error ? error.stack || error.message : String(error))
+    + (details ? `\n${details}` : "");
+  host.textContent = window.__sampleError;
+  throw error;
+}
diff --git a/samples/eve-two-runtime/README.md b/samples/eve-two-runtime/README.md
new file mode 100644
index 00000000..0981ad1a
--- /dev/null
+++ b/samples/eve-two-runtime/README.md
@@ -0,0 +1,37 @@
+# Eve Two-Consumer Counter
+
+This is the smallest executable package-consumer checkpoint for CultMesh plus
+Eve. It intentionally has one owner for each decision:
+
+- the provider node owns the counter document and command transaction;
+- Eve owns the validated surface and command-receipt contracts;
+- CultMesh owns typed observation and the operation boundary;
+- the DOM lowerer owns HTML only;
+- the headless observer owns no state.
+
+Run it from the CultLib repository:
+
+```powershell
+pwsh -File ./scripts/verify-eve-getting-started.ps1
+```
+
+That command continues into the real Chromium/C# network checkpoint after this
+artifact layer passes. Run `verify-eve-two-runtime-sample.ps1` directly only to
+diagnose clean package consumption in isolation.
+
+From clean CultLib and Eve checkouts, the verifier installs missing build
+dependencies, builds package artifacts, installs them into a new empty
+temporary consumer, and runs `sample.mjs`. Success proves:
+
+1. no source-tree import is required by the consumer;
+2. the provider surface and receipt pass Eve's generated runtime validators;
+3. a DOM click executes one idempotent provider operation;
+4. the DOM binding and a separate headless observer converge on the same count;
+5. the canonical receipt and state survive reopening the `.cc` store.
+
+This artifact checkpoint is deliberately not the network proof. The DOM lowerer
+is hosted by jsdom in Node and both consumers share one local CultMesh node. The
+same wrapper continues into a separate real Chromium/C# process chronology with
+Odin discovery, route replacement, and persistent provider state. Keeping those
+evidence layers separate prevents a fast package test from impersonating the
+network.
diff --git a/samples/eve-two-runtime/sample.mjs b/samples/eve-two-runtime/sample.mjs
new file mode 100644
index 00000000..93ed1dc8
--- /dev/null
+++ b/samples/eve-two-runtime/sample.mjs
@@ -0,0 +1,247 @@
+import assert from "node:assert/strict";
+import { mkdtemp } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { JSDOM } from "jsdom";
+import { z } from "zod";
+import { defineDocumentType } from "@gamecult/cultcache-ts";
+import { CultMesh } from "cultmesh-ts";
+import {
+  parseEveCommandReceipt,
+  parseEveSurfaceDocument,
+} from "@gamecult/eve-contracts";
+import { renderEveSurface } from "@gamecult/eve-browser-lowering";
+
+const providerId = "sample.counter-provider";
+const surfaceId = "sample.counter";
+const stateKey = "counter:main";
+
+const counterDocument = defineDocumentType({
+  type: "sample.counter_state",
+  schemaId: "sample.counter_state.v1",
+  schema: z.object({ counterId: z.string(), count: z.number().int() }),
+  name: "counterId",
+});
+
+const surfaceDocument = defineDocumentType({
+  type: "gamecult.eve.surface",
+  schemaId: "gamecult.eve.surface.v1",
+  schema: z.unknown().transform(value => parseEveSurfaceDocument(value)),
+});
+
+const receiptDocument = defineDocumentType({
+  type: "gamecult.eve.command_receipt",
+  schemaId: "gamecult.eve.command_receipt.v1",
+  schema: z.unknown().transform(value => parseEveCommandReceipt(value)),
+  name: "receiptId",
+});
+
+function counterSurface() {
+  return {
+    type: "surface-state",
+    schema: "gamecult.eve.surface.v1",
+    providerId,
+    providerKind: "sample.daemon",
+    title: "CultMesh two-runtime counter",
+    version: 1,
+    updatedAtUtc: "2026-08-17T00:00:00Z",
+    surface: {
+      id: surfaceId,
+      title: "Counter",
+      root: {
+        id: "counter.root",
+        kind: "column",
+        props: {},
+        children: [
+          {
+            id: "counter.value",
+            kind: "metric",
+            props: { label: "Canonical count", value: 0 },
+            children: [],
+            stateBindings: [{
+              targetProp: "value",
+              pointerId: "sample.counter.count",
+              sourceId: `${counterDocument.type}:${stateKey}`,
+              schemaId: counterDocument.schemaId,
+              routeKind: "shared-memory",
+            }],
+          },
+          {
+            id: "counter.increment",
+            kind: "control.button",
+            props: { label: "Increment", command: "sample.counter.increment" },
+            children: [],
+          },
+        ],
+      },
+      styles: {},
+    },
+    commands: [{
+      schema: "gamecult.eve.command.v1",
+      command: "sample.counter.increment",
+      label: "Increment",
+      surfaceId,
+      transport: "cultmesh",
+      authority: "provider-daemon",
+      result: "gamecult.eve.command_receipt.v1",
+    }],
+  };
+}
+
+function installDom() {
+  const dom = new JSDOM("<!doctype html><html><head></head><body><main id='surface'></main></body></html>", {
+    url: "https://eve.sample/",
+    pretendToBeVisual: true,
+  });
+  for (const name of [
+    "document",
+    "window",
+    "Element",
+    "HTMLElement",
+    "HTMLButtonElement",
+    "HTMLInputElement",
+    "HTMLTextAreaElement",
+    "HTMLImageElement",
+  ]) globalThis[name] = dom.window[name];
+  return dom;
+}
+
+async function waitFor(predicate, description) {
+  const deadline = Date.now() + 2_000;
+  while (!predicate()) {
+    if (Date.now() >= deadline) throw new Error(`Timed out waiting for ${description}.`);
+    await new Promise(resolve => setTimeout(resolve, 5));
+  }
+}
+
+assert.throws(
+  () => parseEveSurfaceDocument({ providerId, surface: { id: surfaceId } }),
+  /Invalid Eve surface/,
+);
+assert.throws(
+  () => parseEveCommandReceipt({ receiptId: "unowned" }),
+  /Invalid Eve commandReceipt/,
+);
+
+const statePath = join(await mkdtemp(join(tmpdir(), "cultmesh-eve-two-runtime-")), "state.cc");
+const node = await CultMesh.startNode(statePath, {
+  documents: [counterDocument, surfaceDocument, receiptDocument],
+});
+await node.put(counterDocument, stateKey, { counterId: stateKey, count: 0 });
+await node.put(surfaceDocument, surfaceId, counterSurface());
+await node.flush();
+
+const state = node.document(counterDocument, stateKey, { pollMs: 5 });
+const headless = state.observe({ context: "headless-client" });
+await headless.ready;
+const receiptsByIdempotencyKey = new Map();
+const increment = CultMesh.operation("sample.counter.increment", async (_request, context) => {
+  const idempotencyKey = context.idempotencyKey || "missing";
+  const existing = receiptsByIdempotencyKey.get(idempotencyKey)
+    || node.get(receiptDocument, `receipt:${idempotencyKey}`);
+  if (existing) return existing;
+  const next = await state.authoritativeWriter("provider-daemon").update(current => ({
+    ...current,
+    count: current.count + 1,
+  }));
+  const receipt = {
+    receiptId: `receipt:${idempotencyKey}`,
+    schema: "gamecult.eve.command_receipt.v1",
+    commandId: idempotencyKey,
+    command: "sample.counter.increment",
+    state: "accepted",
+    ownerRepo: "CultLib",
+    authority: "provider-daemon",
+    providerId,
+    surfaceId,
+    issuedAtUtc: new Date().toISOString(),
+    sourceVersion: next.count,
+    idempotencyKey,
+    count: next.count,
+  };
+  receiptsByIdempotencyKey.set(idempotencyKey, receipt);
+  await node.put(receiptDocument, receipt.receiptId, receipt);
+  await node.flush();
+  return receipt;
+});
+
+const dom = installDom();
+const host = document.querySelector("#surface");
+const browserVerse = CultMesh.verse("local", "browser-client");
+let browserReceipt;
+renderEveSurface(await node.document(surfaceDocument, surfaceId).latest(), host, {
+  activeSurfaceId: surfaceId,
+  clientId: "browser-client",
+  // Eve refuses to build a command intent for a surface that has not
+  // advertised where its commands go and what comes back. The provider
+  // advertisement is that declaration; a lowering cannot infer it.
+  provider: {
+    providerId,
+    surfaces: [{
+      surfaceId,
+      worldInteraction: {
+        commandBoundary: "sample.counter.commands",
+        receiptSchema: "gamecult.eve.command_receipt.v1",
+      },
+    }],
+  },
+  commandSink: async intent => {
+    browserReceipt = await increment.bind(browserVerse).invoke(intent.payload, {
+      idempotencyKey: "browser-click-1",
+    });
+  },
+  stateBindingResolver: async binding => {
+    if (binding.pointerId !== "sample.counter.count") return undefined;
+    return {
+      latest: async () => (await state.latest("browser-client")).count,
+      watch: callback => state.watch("browser-client", value => callback(value.count)),
+    };
+  },
+});
+
+await waitFor(() => host.querySelector(".metric-value")?.textContent === "0", "initial browser binding");
+host.querySelector("button").click();
+await waitFor(() => browserReceipt?.count === 1, "typed command receipt");
+await waitFor(() => headless.current.count === 1, "headless convergence");
+await waitFor(() => host.querySelector(".metric-value")?.textContent === "1", "browser convergence");
+
+const duplicate = await increment.bind(browserVerse).invoke({}, { idempotencyKey: "browser-click-1" });
+assert.equal(duplicate.receiptId, browserReceipt.receiptId);
+assert.equal(headless.current.count, 1);
+
+headless.dispose();
+renderEveSurface(parseEveSurfaceDocument({
+  type: "surface-state",
+  schema: "gamecult.eve.surface.v1",
+  providerId,
+  providerKind: "sample.daemon",
+  title: "Closed counter",
+  version: 2,
+  updatedAtUtc: "2026-08-17T00:00:01Z",
+  surface: {
+    id: "sample.closed",
+    root: { id: "closed.root", kind: "column", props: {}, children: [] },
+    styles: {},
+  },
+  commands: [],
+}), host);
+dom.window.close();
+await node.flush();
+const reopened = await CultMesh.startNode(statePath, {
+  documents: [counterDocument, surfaceDocument, receiptDocument],
+});
+assert.equal(reopened.getRequired(counterDocument, stateKey).count, 1);
+assert.equal(
+  reopened.getRequired(receiptDocument, "receipt:browser-click-1").receiptId,
+  browserReceipt.receiptId,
+);
+
+console.log(JSON.stringify({
+  providerId,
+  surfaceId,
+  receiptId: browserReceipt.receiptId,
+  loweringRuntime: "jsdom",
+  browserCount: 1,
+  headlessCount: 1,
+  restartCount: 1,
+}));
diff --git a/scripts/build-quic-native.ps1 b/scripts/build-quic-native.ps1
new file mode 100644
index 00000000..68496180
--- /dev/null
+++ b/scripts/build-quic-native.ps1
@@ -0,0 +1,61 @@
+param(
+  [string] $Configuration = "Release",
+  [string] $Architecture = "x64",
+  [string] $OutputDirectory = "artifacts\quic-native"
+)
+
+$ErrorActionPreference = "Stop"
+if ($Architecture -ne "x64") {
+  throw "The first CultMesh native QUIC package supports x64 Windows desktop only."
+}
+
+$repoRoot = Split-Path -Parent $PSScriptRoot
+$version = "2.5.9"
+$expectedPackageSha256 = "9877A919E1AA73AA4800F1E8A06B6539021F376228910138EB04540CD956617B"
+$cacheRoot = Join-Path $repoRoot "artifacts\dependencies\msquic-schannel-$version"
+$packagePath = Join-Path $cacheRoot "Microsoft.Native.Quic.MsQuic.Schannel.$version.zip"
+$extractRoot = Join-Path $cacheRoot "package"
+$nativeRoot = Join-Path $extractRoot "build\native"
+$buildRoot = Join-Path $repoRoot "artifacts\quic-native-build\$Architecture\$Configuration"
+$outputRoot = if ([IO.Path]::IsPathRooted($OutputDirectory)) {
+  $OutputDirectory
+} else {
+  Join-Path $repoRoot $OutputDirectory
+}
+
+New-Item -ItemType Directory -Force -Path $cacheRoot | Out-Null
+if (-not (Test-Path -LiteralPath $packagePath)) {
+  & curl.exe -L --fail --silent --show-error `
+    -o $packagePath `
+    "https://www.nuget.org/api/v2/package/Microsoft.Native.Quic.MsQuic.Schannel/$version"
+  if ($LASTEXITCODE -ne 0) { throw "MsQuic package download failed with exit code $LASTEXITCODE" }
+}
+$sha256 = [Security.Cryptography.SHA256]::Create()
+try {
+  $packageBytes = [IO.File]::ReadAllBytes($packagePath)
+  $packageSha256 = [BitConverter]::ToString($sha256.ComputeHash($packageBytes)).Replace("-", "")
+} finally {
+  $sha256.Dispose()
+}
+if ($packageSha256 -ne $expectedPackageSha256) {
+  throw "MsQuic package digest does not match the pinned release."
+}
+if (-not (Test-Path -LiteralPath (Join-Path $nativeRoot "include\msquic.h"))) {
+  if (Test-Path -LiteralPath $extractRoot) { Remove-Item -LiteralPath $extractRoot -Recurse -Force }
+  Expand-Archive -LiteralPath $packagePath -DestinationPath $extractRoot
+}
+
+cmake -S (Join-Path $repoRoot "native\GameCult.Mesh.Quic.Native") -B $buildRoot -A x64 `
+  "-DMSQUIC_ROOT=$($nativeRoot.Replace('\', '/'))"
+if ($LASTEXITCODE -ne 0) { throw "CultMesh native QUIC configure failed with exit code $LASTEXITCODE" }
+cmake --build $buildRoot --config $Configuration
+if ($LASTEXITCODE -ne 0) { throw "CultMesh native QUIC build failed with exit code $LASTEXITCODE" }
+
+New-Item -ItemType Directory -Force -Path $outputRoot | Out-Null
+Copy-Item -LiteralPath (Join-Path $buildRoot "bin\$Configuration\gamecult_mesh_quic_native.dll") `
+  -Destination $outputRoot -Force
+Copy-Item -LiteralPath (Join-Path $nativeRoot "bin\x64\msquic.dll") -Destination $outputRoot -Force
+Copy-Item -LiteralPath (Join-Path $extractRoot "LICENSE") -Destination (Join-Path $outputRoot "MSQUIC-LICENSE.txt") -Force
+
+Write-Host "CultMesh native QUIC runtime: $outputRoot"
+Get-ChildItem -LiteralPath $outputRoot -File | Select-Object Name,Length
diff --git a/scripts/build-unity-package.ps1 b/scripts/build-unity-package.ps1
new file mode 100644
index 00000000..804f78df
--- /dev/null
+++ b/scripts/build-unity-package.ps1
@@ -0,0 +1,184 @@
+param(
+  [string] $Configuration = "Release",
+  [string] $OutputDirectory = "artifacts\unity\org.gamecult.cultlib",
+  [string] $NuGetConfig = "",
+  [switch] $NoRestore,
+  [switch] $UpdateTemplate
+)
+
+$ErrorActionPreference = "Stop"
+
+$repoRoot = Split-Path -Parent $PSScriptRoot
+$projectPath = Join-Path $repoRoot "src\GameCult.Mesh\GameCult.Mesh.csproj"
+$webSocketProjectPath = Join-Path $repoRoot "src\GameCult.Networking.WebSockets\GameCult.Networking.WebSockets.csproj"
+$quicProjectPath = Join-Path $repoRoot "src\GameCult.Mesh.Quic.Native\GameCult.Mesh.Quic.Native.csproj"
+$templateRoot = Join-Path $repoRoot "unity\org.gamecult.cultlib"
+$publishRoot = Join-Path $repoRoot "artifacts\unity-publish"
+$webSocketPublishRoot = Join-Path $repoRoot "artifacts\unity-websocket-publish"
+$quicPublishRoot = Join-Path $repoRoot "artifacts\unity-quic-publish"
+$quicNativeRoot = Join-Path $repoRoot "artifacts\unity-quic-native"
+$outputRoot = if ([System.IO.Path]::IsPathRooted($OutputDirectory)) {
+  $OutputDirectory
+} else {
+  Join-Path $repoRoot $OutputDirectory
+}
+$pluginRoot = Join-Path $outputRoot "Runtime\Plugins"
+
+if (Test-Path -LiteralPath $publishRoot) {
+  Remove-Item -LiteralPath $publishRoot -Recurse -Force
+}
+if (Test-Path -LiteralPath $quicPublishRoot) {
+  Remove-Item -LiteralPath $quicPublishRoot -Recurse -Force
+}
+if (Test-Path -LiteralPath $webSocketPublishRoot) {
+  Remove-Item -LiteralPath $webSocketPublishRoot -Recurse -Force
+}
+if (Test-Path -LiteralPath $outputRoot) {
+  Remove-Item -LiteralPath $outputRoot -Recurse -Force
+}
+
+$unityPackageVersion = (Get-Content -LiteralPath (Join-Path $templateRoot "package.json") -Raw | ConvertFrom-Json).version
+$publishArguments = @("publish", $projectPath, "-c", $Configuration, "-o", $publishRoot, "-p:CultLibPackageVersion=$unityPackageVersion")
+if ($NoRestore) { $publishArguments += "--no-restore" }
+if (-not [string]::IsNullOrWhiteSpace($NuGetConfig)) {
+  $publishArguments += "-p:RestoreConfigFile=$([IO.Path]::GetFullPath($NuGetConfig))"
+}
+& dotnet @publishArguments
+if ($LASTEXITCODE -ne 0) {
+  throw "CultLib publish failed with exit code $LASTEXITCODE"
+}
+$webSocketPublishArguments = @("publish", $webSocketProjectPath, "-c", $Configuration, "-f", "netstandard2.1", "-o", $webSocketPublishRoot, "-p:CultLibPackageVersion=$unityPackageVersion")
+if ($NoRestore) { $webSocketPublishArguments += "--no-restore" }
+if (-not [string]::IsNullOrWhiteSpace($NuGetConfig)) {
+  $webSocketPublishArguments += "-p:RestoreConfigFile=$([IO.Path]::GetFullPath($NuGetConfig))"
+}
+& dotnet @webSocketPublishArguments
+if ($LASTEXITCODE -ne 0) {
+  throw "CultLib WebSocket publish failed with exit code $LASTEXITCODE"
+}
+$quicPublishArguments = @("publish", $quicProjectPath, "-c", $Configuration, "-o", $quicPublishRoot, "-p:CultLibPackageVersion=$unityPackageVersion")
+if ($NoRestore) { $quicPublishArguments += "--no-restore" }
+if (-not [string]::IsNullOrWhiteSpace($NuGetConfig)) {
+  $quicPublishArguments += "-p:RestoreConfigFile=$([IO.Path]::GetFullPath($NuGetConfig))"
+}
+& dotnet @quicPublishArguments
+if ($LASTEXITCODE -ne 0) {
+  throw "CultLib native QUIC managed publish failed with exit code $LASTEXITCODE"
+}
+& (Join-Path $PSScriptRoot "build-quic-native.ps1") `
+  -Configuration $Configuration `
+  -OutputDirectory $quicNativeRoot
+
+New-Item -ItemType Directory -Force -Path $pluginRoot | Out-Null
+Copy-Item -LiteralPath (Join-Path $templateRoot "package.json") -Destination $outputRoot
+Copy-Item -LiteralPath (Join-Path $templateRoot "README.md") -Destination $outputRoot
+
+$expectedAssemblies = @(
+  "ConcurrentCollections.dll",
+  "GameCult.Caching.dll",
+  "GameCult.Caching.MessagePack.dll",
+  "GameCult.Logging.dll",
+  "GameCult.Mesh.dll",
+  "GameCult.Mesh.Quic.Native.dll",
+  "GameCult.Networking.dll",
+  "GameCult.Networking.WebSockets.dll",
+  "Isopoh.Cryptography.Argon2.dll",
+  "Isopoh.Cryptography.Blake2b.dll",
+  "Isopoh.Cryptography.SecureArray.dll",
+  "LiteNetLib.dll",
+  "MessagePack.Annotations.dll",
+  "MessagePack.dll",
+  "Microsoft.Bcl.AsyncInterfaces.dll",
+  "Microsoft.Bcl.TimeProvider.dll",
+  "Microsoft.NET.StringTools.dll",
+  "R3.dll",
+  "System.Collections.Immutable.dll",
+  "System.ComponentModel.Annotations.dll",
+  "System.IO.Pipelines.dll",
+  "System.Runtime.CompilerServices.Unsafe.dll",
+  "System.Text.Encodings.Web.dll",
+  "System.Text.Json.dll",
+  "System.Threading.Channels.dll"
+)
+$publishedByName = @{}
+foreach ($assembly in Get-ChildItem -LiteralPath $publishRoot -Filter "*.dll") {
+  $publishedByName[$assembly.Name] = $assembly
+}
+foreach ($assembly in Get-ChildItem -LiteralPath $quicPublishRoot -Filter "*.dll") {
+  $publishedByName[$assembly.Name] = $assembly
+}
+foreach ($assembly in Get-ChildItem -LiteralPath $webSocketPublishRoot -Filter "*.dll") {
+  $publishedByName[$assembly.Name] = $assembly
+}
+foreach ($assemblyName in $expectedAssemblies) {
+  if (-not $publishedByName.ContainsKey($assemblyName)) {
+    throw "CultLib Unity package is missing expected assembly: $assemblyName"
+  }
+}
+
+Copy-Item -LiteralPath (Join-Path $templateRoot "Runtime\GameCult.CultLib.asmdef") `
+  -Destination (Join-Path $outputRoot "Runtime")
+foreach ($assemblyName in $expectedAssemblies) {
+  $assembly = $publishedByName[$assemblyName]
+  Copy-Item -LiteralPath $assembly.FullName -Destination $pluginRoot
+  $pdb = [System.IO.Path]::ChangeExtension($assembly.FullName, ".pdb")
+  if (Test-Path -LiteralPath $pdb) {
+    Copy-Item -LiteralPath $pdb -Destination $pluginRoot
+  }
+}
+$nativePluginRoot = Join-Path $pluginRoot "x86_64"
+New-Item -ItemType Directory -Force -Path $nativePluginRoot | Out-Null
+Copy-Item -LiteralPath (Join-Path $quicNativeRoot "gamecult_mesh_quic_native.dll") -Destination $nativePluginRoot
+Copy-Item -LiteralPath (Join-Path $quicNativeRoot "msquic.dll") -Destination $nativePluginRoot
+New-Item -ItemType Directory -Force -Path (Join-Path $outputRoot "Third Party Notices") | Out-Null
+Copy-Item -LiteralPath (Join-Path $quicNativeRoot "MSQUIC-LICENSE.txt") `
+  -Destination (Join-Path $outputRoot "Third Party Notices\MSQUIC-LICENSE.txt")
+
+$meshPackagePath = Join-Path $pluginRoot "GameCult.Mesh.dll"
+$meshPackageVersion = [Reflection.AssemblyName]::GetAssemblyName($meshPackagePath).Version.ToString()
+if ($meshPackageVersion -ne "$unityPackageVersion.0") {
+  throw "Packaged GameCult.Mesh.dll version '$meshPackageVersion' does not match package '$unityPackageVersion'."
+}
+$meshPackageMetadata = [Text.Encoding]::UTF8.GetString([IO.File]::ReadAllBytes($meshPackagePath))
+foreach ($requiredType in @(
+  "GameCult.Mesh.CultMeshAuthorityTrustPolicy",
+  "GameCult.Mesh.CultMeshRouteCertificate",
+  "GameCult.Mesh.CultMeshHttpsContentTransportConnector")) {
+  if (-not $meshPackageMetadata.Contains($requiredType.Split('.')[-1])) {
+    throw "Packaged GameCult.Mesh.dll is missing required API '$requiredType'."
+  }
+}
+$webSocketPackageMetadata = [Text.Encoding]::UTF8.GetString(
+  [IO.File]::ReadAllBytes((Join-Path $pluginRoot "GameCult.Networking.WebSockets.dll")))
+if (-not $webSocketPackageMetadata.Contains("CultNetWebSocketSchemaClient")) {
+  throw "Packaged WebSocket assembly is missing the Unity-compatible CultNet client."
+}
+
+if ($UpdateTemplate) {
+  $templatePluginRoot = Join-Path $templateRoot "Runtime\Plugins"
+  foreach ($assemblyName in $expectedAssemblies) {
+    Copy-Item -LiteralPath (Join-Path $pluginRoot $assemblyName) -Destination $templatePluginRoot -Force
+    $pdbName = [System.IO.Path]::ChangeExtension($assemblyName, ".pdb")
+    $pdb = Join-Path $pluginRoot $pdbName
+    if (Test-Path -LiteralPath $pdb) {
+      Copy-Item -LiteralPath $pdb -Destination $templatePluginRoot -Force
+    }
+  }
+  $templateNativePluginRoot = Join-Path $templatePluginRoot "x86_64"
+  New-Item -ItemType Directory -Force -Path $templateNativePluginRoot | Out-Null
+  Copy-Item -LiteralPath (Join-Path $nativePluginRoot "gamecult_mesh_quic_native.dll") `
+    -Destination $templateNativePluginRoot -Force
+  Copy-Item -LiteralPath (Join-Path $nativePluginRoot "msquic.dll") `
+    -Destination $templateNativePluginRoot -Force
+  $templateNoticesRoot = Join-Path $templateRoot "Third Party Notices"
+  New-Item -ItemType Directory -Force -Path $templateNoticesRoot | Out-Null
+  Copy-Item -LiteralPath (Join-Path $outputRoot "Third Party Notices\MSQUIC-LICENSE.txt") `
+    -Destination $templateNoticesRoot -Force
+  Write-Host "Updated tracked Unity package assemblies: $templatePluginRoot"
+}
+
+$manifest = Get-Content -LiteralPath (Join-Path $outputRoot "package.json") -Raw | ConvertFrom-Json
+Write-Host "CultLib Unity package: $outputRoot"
+Write-Host "Package: $($manifest.name)@$($manifest.version)"
+Write-Host "Managed assemblies: $($expectedAssemblies.Count)"
+Write-Host "Native realtime: MsQuic Schannel 2.5.9 (Windows x64)"
diff --git a/scripts/measure-reactive-document-performance.mjs b/scripts/measure-reactive-document-performance.mjs
new file mode 100644
index 00000000..786cb3ed
--- /dev/null
+++ b/scripts/measure-reactive-document-performance.mjs
@@ -0,0 +1,141 @@
+import { monitorEventLoopDelay, performance } from "node:perf_hooks";
+import process from "node:process";
+
+import { CultMesh } from "../packages/cultmesh-ts/dist/index.js";
+
+const quick = process.argv.includes("--quick");
+const idleMs = quick ? 250 : 10_000;
+const activeMs = quick ? 500 : 10_000;
+const results = [];
+
+for (const documentCount of [1, 100, 1000]) {
+  results.push(await measure(documentCount));
+}
+
+console.log(JSON.stringify({
+  runtime: "typescript",
+  workload: {
+    documentCounts: [1, 100, 1000],
+    payloadBytes: 16 * 1024,
+    idleSeconds: idleMs / 1000,
+    activeSeconds: activeMs / 1000,
+    updateRateHz: 60,
+    changedFraction: 0.01,
+  },
+  results,
+}, undefined, 2));
+
+if (results.some(result =>
+  result.actualPublishes !== result.expectedPublishes ||
+  result.p99PublishLatencyMilliseconds >= 250 ||
+  result.activeHeapPeakGrowthBytes >= 128 * 1024 * 1024)) {
+  process.exitCode = 1;
+}
+
+async function measure(documentCount) {
+  const payload = "x".repeat(16 * 1024);
+  const changedDocumentCount = Math.max(1, Math.floor(documentCount / 100));
+  const reactiveDocuments = [];
+  const publishSignals = new Array(documentCount);
+  const updateStartedAt = new Float64Array(documentCount);
+  const latencies = [];
+  let payloadBytesPublished = 0;
+  let publishes = 0;
+
+  for (let index = 0; index < documentCount; index++) {
+    let current = { id: `performance:${index}`, payload, revision: 1 };
+    let watcher;
+    const document = CultMesh.document(
+      `performance:${index}`,
+      { schemaId: "gamecult.mesh.performance_probe.v1" },
+      async () => current,
+      {
+        submitPrediction: async (_context, value) => {
+          payloadBytesPublished += Buffer.byteLength(JSON.stringify(value));
+          latencies.push(performance.now() - updateStartedAt[index]);
+          publishes++;
+          current = value;
+          watcher?.(value);
+          publishSignals[index]?.();
+        },
+        watchDocument: (_context, callback) => {
+          watcher = callback;
+          return () => { watcher = undefined; };
+        },
+      },
+    );
+    const reactive = document.predictionWriter().reactive();
+    reactiveDocuments.push(reactive);
+  }
+
+  await Promise.all(reactiveDocuments.map(document => document.ready));
+  collect();
+  const idleHeapStart = process.memoryUsage().heapUsed;
+  const idleCpuStart = process.cpuUsage();
+  await delay(idleMs);
+  collect();
+  const idleHeapGrowthBytes = process.memoryUsage().heapUsed - idleHeapStart;
+  const idleCpu = process.cpuUsage(idleCpuStart);
+
+  collect();
+  const activeHeapStart = process.memoryUsage().heapUsed;
+  let activeHeapPeak = activeHeapStart;
+  const activeCpuStart = process.cpuUsage();
+  const eventLoop = monitorEventLoopDelay({ resolution: 10 });
+  eventLoop.enable();
+  const activeStartedAt = performance.now();
+  let frames = 0;
+  while (performance.now() - activeStartedAt < activeMs) {
+    const completions = [];
+    for (let index = 0; index < changedDocumentCount; index++) {
+      completions.push(new Promise(resolve => { publishSignals[index] = resolve; }));
+      updateStartedAt[index] = performance.now();
+      reactiveDocuments[index].update(value => { value.revision++; });
+    }
+    await Promise.all(completions);
+    frames++;
+    activeHeapPeak = Math.max(activeHeapPeak, process.memoryUsage().heapUsed);
+    const remaining = frames * (1000 / 60) - (performance.now() - activeStartedAt);
+    if (remaining > 0) await delay(remaining);
+  }
+  eventLoop.disable();
+  const activeElapsedSeconds = (performance.now() - activeStartedAt) / 1000;
+  const activeCpu = process.cpuUsage(activeCpuStart);
+  const ordered = latencies.toSorted((left, right) => left - right);
+
+  for (const document of reactiveDocuments) document.dispose();
+
+  return {
+    documentCount,
+    changedDocumentCount,
+    frames,
+    expectedPublishes: frames * changedDocumentCount,
+    actualPublishes: publishes,
+    payloadBytesPublished,
+    idleHeapGrowthBytes,
+    idleCpuMilliseconds: (idleCpu.user + idleCpu.system) / 1000,
+    activeHeapPeakGrowthBytes: activeHeapPeak - activeHeapStart,
+    activeCpuMilliseconds: (activeCpu.user + activeCpu.system) / 1000,
+    publishedPayloadBytesPerSecond: payloadBytesPublished / activeElapsedSeconds,
+    p50PublishLatencyMilliseconds: percentile(ordered, 0.50),
+    p95PublishLatencyMilliseconds: percentile(ordered, 0.95),
+    p99PublishLatencyMilliseconds: percentile(ordered, 0.99),
+    p99EventLoopDelayMilliseconds: eventLoop.percentile(99) / 1_000_000,
+  };
+}
+
+function percentile(ordered, ratio) {
+  if (ordered.length === 0) return 0;
+  return ordered[Math.max(0, Math.ceil(ordered.length * ratio) - 1)];
+}
+
+function collect() {
+  if (typeof globalThis.gc !== "function") {
+    throw new Error("Run this probe with node --expose-gc.");
+  }
+  globalThis.gc();
+}
+
+function delay(milliseconds) {
+  return new Promise(resolve => setTimeout(resolve, milliseconds));
+}
diff --git a/scripts/measure-reactive-document-performance.ps1 b/scripts/measure-reactive-document-performance.ps1
new file mode 100644
index 00000000..c0f44eaf
--- /dev/null
+++ b/scripts/measure-reactive-document-performance.ps1
@@ -0,0 +1,88 @@
+param(
+    [switch] $Quick,
+    [switch] $SkipRuntimeBuild,
+    [string] $PythonPath = "",
+    [string] $NodePath = ""
+)
+
+$ErrorActionPreference = "Stop"
+$root = Split-Path -Parent $PSScriptRoot
+$nodeExecutable = if ([string]::IsNullOrWhiteSpace($NodePath)) {
+    (Get-Command node -ErrorAction Stop).Source
+}
+else {
+    [IO.Path]::GetFullPath($NodePath)
+}
+$pythonExecutable = if ([string]::IsNullOrWhiteSpace($PythonPath)) {
+    (Get-Command python -ErrorAction Stop).Source
+}
+else {
+    [IO.Path]::GetFullPath($PythonPath)
+}
+foreach ($executable in @($nodeExecutable, $pythonExecutable)) {
+    if (-not (Test-Path -LiteralPath $executable -PathType Leaf)) {
+        throw "Performance probe runtime not found: $executable"
+    }
+}
+
+if (-not $SkipRuntimeBuild) {
+    $typescript = Join-Path $root "node_modules\typescript\bin\tsc"
+    foreach ($dependency in @("cultcache-ts", "cultnet-ts", "cultmesh-ts")) {
+        $dependencyRoot = Join-Path $root "packages\$dependency"
+        if ($dependency -eq "cultnet-ts") {
+            & $nodeExecutable (Join-Path $dependencyRoot "tools\generate-swarm-contracts.mjs")
+            if ($LASTEXITCODE -ne 0) { throw "CultNet TypeScript contract generation failed." }
+        }
+        & $nodeExecutable $typescript -p (Join-Path $dependencyRoot "tsconfig.json") --pretty false
+        if ($LASTEXITCODE -ne 0) { throw "TypeScript performance dependency build failed: $dependency" }
+    }
+}
+
+$project = Join-Path $root "tools\GameCult.Mesh.PerformanceProbe\GameCult.Mesh.PerformanceProbe.csproj"
+$buildArguments = @(
+    "build",
+    $project,
+    "--configuration", "Release",
+    "--verbosity", "quiet",
+    "/p:NoWarn=1591%3BCS8632"
+)
+& dotnet @buildArguments
+if ($LASTEXITCODE -ne 0) {
+    throw "CultMesh reactive document performance probe build failed."
+}
+
+$arguments = @("run", "--project", $project, "--configuration", "Release", "--no-build")
+if ($Quick) {
+    $arguments += @("--", "--quick")
+}
+
+& dotnet @arguments
+if ($LASTEXITCODE -ne 0) {
+    throw "CultMesh C# reactive document performance probe failed."
+}
+
+$runtimeArguments = @()
+if ($Quick) { $runtimeArguments += "--quick" }
+
+& $nodeExecutable --expose-gc (Join-Path $root "scripts\measure-reactive-document-performance.mjs") @runtimeArguments
+if ($LASTEXITCODE -ne 0) {
+    throw "CultMesh TypeScript reactive document performance probe failed."
+}
+
+$pythonSource = (@("cultcache-py", "cultnet-py", "cultmesh-py") | ForEach-Object { Join-Path $root "packages\$_\src" }) -join [IO.Path]::PathSeparator
+$previousPythonPath = $env:PYTHONPATH
+$env:PYTHONPATH = if ([string]::IsNullOrWhiteSpace($previousPythonPath)) {
+    $pythonSource
+}
+else {
+    $pythonSource + [IO.Path]::PathSeparator + $previousPythonPath
+}
+try {
+    & $pythonExecutable (Join-Path $root "packages\cultmesh-py\tools\reactive_performance_probe.py") @runtimeArguments
+    if ($LASTEXITCODE -ne 0) {
+        throw "CultMesh Python reactive document performance probe failed."
+    }
+}
+finally {
+    $env:PYTHONPATH = $previousPythonPath
+}
diff --git a/scripts/pack-nuget.ps1 b/scripts/pack-nuget.ps1
new file mode 100644
index 00000000..95e5cd2f
--- /dev/null
+++ b/scripts/pack-nuget.ps1
@@ -0,0 +1,105 @@
+param(
+  [string] $Configuration = "Release",
+  [string] $OutputDirectory = "artifacts\nuget",
+  [string] $PackageVersion = "",
+  [switch] $SkipConsumerSmoke
+)
+
+$ErrorActionPreference = "Stop"
+$repoRoot = Split-Path -Parent $PSScriptRoot
+$outputRoot = if ([IO.Path]::IsPathRooted($OutputDirectory)) {
+  $OutputDirectory
+} else {
+  Join-Path $repoRoot $OutputDirectory
+}
+
+$projects = @(
+  "src\GameCult.Logging\GameCult.Logging.csproj",
+  "src\GameCult.Caching\GameCult.Caching.csproj",
+  "src\GameCult.Caching.MessagePack\GameCult.Caching.MessagePack.csproj",
+  "src\GameCult.Networking\GameCult.Networking.csproj",
+  "src\GameCult.Networking.WebSockets\GameCult.Networking.WebSockets.csproj",
+  "src\GameCult.Mesh\GameCult.Mesh.csproj"
+)
+
+if (Test-Path -LiteralPath $outputRoot) {
+  Remove-Item -LiteralPath $outputRoot -Recurse -Force
+}
+New-Item -ItemType Directory -Force -Path $outputRoot | Out-Null
+
+foreach ($project in $projects) {
+  $packArguments = @(
+    "pack", (Join-Path $repoRoot $project), "-c", $Configuration, "-o", $outputRoot,
+    "--nologo", "--verbosity", "quiet", "-p:NoWarn=1591%3BCS8632"
+  )
+  if (-not [string]::IsNullOrWhiteSpace($PackageVersion)) {
+    $packArguments += "-p:CultLibPackageVersion=$PackageVersion"
+  }
+  & dotnet @packArguments
+  if ($LASTEXITCODE -ne 0) {
+    throw "NuGet pack failed for $project with exit code $LASTEXITCODE"
+  }
+}
+
+$meshPackage = Get-ChildItem -LiteralPath $outputRoot -Filter "GameCult.Mesh.*.nupkg" |
+  Where-Object { $_.Name -notlike "*.snupkg" } |
+  Select-Object -First 1
+if (-not $meshPackage) {
+  throw "GameCult.Mesh package was not produced."
+}
+
+$version = [regex]::Match($meshPackage.Name, '^GameCult\.Mesh\.(.+)\.nupkg$').Groups[1].Value
+$expectedPackages = @(
+  "GameCult.Logging.$version.nupkg",
+  "GameCult.Caching.$version.nupkg",
+  "GameCult.Caching.MessagePack.$version.nupkg",
+  "GameCult.Networking.$version.nupkg",
+  "GameCult.Networking.WebSockets.$version.nupkg",
+  "GameCult.Mesh.$version.nupkg"
+)
+foreach ($package in $expectedPackages) {
+  if (-not (Test-Path -LiteralPath (Join-Path $outputRoot $package))) {
+    throw "NuGet dependency closure is missing $package"
+  }
+}
+
+if (-not $SkipConsumerSmoke) {
+  $smokeRoot = Join-Path $repoRoot "artifacts\nuget-consumer-smoke"
+  if (Test-Path -LiteralPath $smokeRoot) {
+    Remove-Item -LiteralPath $smokeRoot -Recurse -Force
+  }
+  New-Item -ItemType Directory -Force -Path $smokeRoot | Out-Null
+  $consumerPackages = Join-Path $smokeRoot "packages"
+  $projectDocument = @"
+<Project Sdk="Microsoft.NET.Sdk">
+  <PropertyGroup>
+    <TargetFramework>net10.0</TargetFramework>
+    <OutputType>Exe</OutputType>
+    <ImplicitUsings>enable</ImplicitUsings>
+    <RestoreSources>$outputRoot;https://api.nuget.org/v3/index.json</RestoreSources>
+    <RestorePackagesPath>$consumerPackages</RestorePackagesPath>
+    <RestoreNoCache>true</RestoreNoCache>
+  </PropertyGroup>
+  <ItemGroup>
+    <PackageReference Include="GameCult.Mesh" Version="$version" />
+  </ItemGroup>
+</Project>
+"@
+  $program = @"
+using GameCult.Mesh;
+
+var verse = CultMesh.Verse("nuget-smoke", "cultlib.pack");
+Console.WriteLine(verse.Context.VerseId);
+"@
+  [IO.File]::WriteAllText((Join-Path $smokeRoot "Consumer.csproj"), $projectDocument, [Text.UTF8Encoding]::new($false))
+  [IO.File]::WriteAllText((Join-Path $smokeRoot "Program.cs"), $program, [Text.UTF8Encoding]::new($false))
+  dotnet run --project (Join-Path $smokeRoot "Consumer.csproj") -c Release `
+    --nologo --verbosity quiet
+  if ($LASTEXITCODE -ne 0) {
+    throw "GameCult.Mesh NuGet consumer smoke failed with exit code $LASTEXITCODE"
+  }
+}
+
+Write-Host "CultLib NuGet feed: $outputRoot"
+Write-Host "GameCult.Mesh: $version"
+Write-Host "Public package closure: $($expectedPackages.Count) packages"
diff --git a/scripts/run-typescript-workspaces.mjs b/scripts/run-typescript-workspaces.mjs
new file mode 100644
index 00000000..933079da
--- /dev/null
+++ b/scripts/run-typescript-workspaces.mjs
@@ -0,0 +1,30 @@
+import { execFileSync } from "node:child_process";
+import { dirname, join } from "node:path";
+
+const command = process.argv[2];
+if (!command) throw new Error("Usage: node scripts/run-typescript-workspaces.mjs <script>");
+
+const npmCli = process.env.npm_execpath ??
+  join(dirname(process.execPath), "node_modules", "npm", "bin", "npm-cli.js");
+const workspaces = ["cultcache-ts", "cultnet-ts", "cultmesh-ts", "cultmesh-browser"];
+const childEnv = process.platform === "win32"
+  ? {
+      ...process.env,
+      PATH: [
+        dirname(process.execPath),
+        `${process.env.SystemRoot}\\System32`,
+        process.env.SystemRoot,
+        `${process.env.USERPROFILE}\\AppData\\Local\\Microsoft\\WindowsApps`,
+        `${process.env.USERPROFILE}\\.cargo\\bin`,
+        "C:\\Program Files\\dotnet",
+        "C:\\Program Files\\Git\\cmd",
+      ].join(";"),
+    }
+  : process.env;
+
+for (const workspace of workspaces) {
+  execFileSync(process.execPath, [npmCli, "--workspace", workspace, "run", command], {
+    env: childEnv,
+    stdio: "inherit",
+  });
+}
diff --git a/scripts/test-typescript-package-closure.mjs b/scripts/test-typescript-package-closure.mjs
new file mode 100644
index 00000000..5f00aa47
--- /dev/null
+++ b/scripts/test-typescript-package-closure.mjs
@@ -0,0 +1,160 @@
+import assert from "node:assert/strict";
+import { execFileSync } from "node:child_process";
+import { mkdtempSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { dirname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const repoRoot = resolve(dirname(fileURLToPath(import.meta.url)), "..");
+const workspacePackages = ["cultcache-ts", "cultnet-ts", "cultmesh-ts", "cultmesh-browser"];
+const npmCli = process.env.npm_execpath ??
+  join(dirname(process.execPath), "node_modules", "npm", "bin", "npm-cli.js");
+const childEnv = process.platform === "win32"
+  ? {
+      ...process.env,
+      PATH: `${dirname(process.execPath)};${process.env.SystemRoot}\\System32;${process.env.SystemRoot}`,
+    }
+  : process.env;
+const smokeRoot = mkdtempSync(join(tmpdir(), "cultlib-ts-package-smoke-"));
+const tarballRoot = join(smokeRoot, "tarballs");
+const consumerRoot = join(smokeRoot, "consumer");
+mkdirSync(tarballRoot);
+mkdirSync(consumerRoot);
+
+function npm(...args) {
+  return execFileSync(process.execPath, [npmCli, ...args], {
+    cwd: repoRoot,
+    encoding: "utf8",
+    env: childEnv,
+    stdio: ["ignore", "pipe", "inherit"],
+  });
+}
+
+try {
+  const tarballs = [];
+  for (const packageName of workspacePackages) {
+    const packageRoot = join(repoRoot, "packages", packageName);
+    const packed = JSON.parse(npm("pack", packageRoot, "--json", "--pack-destination", tarballRoot));
+    assert.equal(packed.length, 1, `${packageName} must produce exactly one tarball`);
+    const files = packed[0].files.map(file => file.path);
+    assert.ok(files.includes("dist/index.js"), `${packageName} tarball is missing dist/index.js`);
+    assert.ok(files.includes("dist/index.d.ts"), `${packageName} tarball is missing dist/index.d.ts`);
+    tarballs.push(join(tarballRoot, packed[0].filename));
+  }
+
+  writeFileSync(join(consumerRoot, "package.json"), JSON.stringify({
+    name: "cultlib-ts-package-smoke",
+    version: "1.0.0",
+    private: true,
+  }, null, 2));
+
+  execFileSync(process.execPath, [npmCli,
+    "install",
+    "--ignore-scripts",
+    "--no-audit",
+    "--no-fund",
+    ...tarballs,
+  ], { cwd: consumerRoot, env: childEnv, stdio: "inherit" });
+
+  writeFileSync(join(consumerRoot, "runtime-smoke.cjs"), `
+const assert = require("node:assert/strict");
+const cache = require("@gamecult/cultcache-ts");
+const net = require("cultnet-ts");
+const mesh = require("cultmesh-ts");
+assert.equal(typeof cache.defineDocumentType, "function");
+assert.equal(typeof net.CultNetPeer, "function");
+assert.equal(typeof mesh.CultMesh, "function");
+assert.equal(typeof mesh.CultMeshProviderSession, "function");
+assert.deepEqual(mesh.CultMesh.vec2(3, 4), { x: 3, y: 4 });
+`);
+  execFileSync(process.execPath, ["runtime-smoke.cjs"], { cwd: consumerRoot, stdio: "inherit" });
+
+  writeFileSync(join(consumerRoot, "browser-runtime-smoke.mjs"), `
+import assert from "node:assert/strict";
+import { CultMeshBrowserClient, decodeCultNetPayload } from "cultmesh-browser";
+import { parseCultNetMessage } from "cultnet-ts/contracts";
+assert.equal(typeof CultMeshBrowserClient.connect, "function");
+assert.equal(typeof decodeCultNetPayload, "function");
+assert.equal(typeof parseCultNetMessage, "function");
+assert.equal("putDocument" in CultMeshBrowserClient.prototype, false);
+`);
+  execFileSync(process.execPath, ["browser-runtime-smoke.mjs"], { cwd: consumerRoot, stdio: "inherit" });
+
+  writeFileSync(join(consumerRoot, "types-smoke.ts"), `
+import { defineDocumentType } from "@gamecult/cultcache-ts";
+import { CultNetPeer } from "cultnet-ts";
+import {
+  CultMesh,
+  CultMeshProviderSession,
+  type CultMeshProviderIdentity,
+  type CultMeshProviderTransport,
+  type CultMeshVec2,
+} from "cultmesh-ts";
+
+const point: CultMeshVec2 = CultMesh.vec2(3, 4);
+const defineDocument: typeof defineDocumentType = defineDocumentType;
+const peerType: typeof CultNetPeer = CultNetPeer;
+const providerSessionType: typeof CultMeshProviderSession = CultMeshProviderSession;
+const providerIdentity: CultMeshProviderIdentity = {
+  providerId: "smoke.provider",
+  serviceInstanceId: "smoke.instance",
+  endpointId: "odin:smoke.instance",
+  verseId: "smoke",
+};
+let providerTransport: CultMeshProviderTransport | undefined;
+void point;
+void defineDocument;
+void peerType;
+void providerSessionType;
+void providerIdentity;
+void providerTransport;
+`);
+  const tsc = join(repoRoot, "node_modules", "typescript", "bin", "tsc");
+  assert.ok(readFileSync(tsc, "utf8").length > 0, "workspace TypeScript compiler is unavailable");
+  execFileSync(process.execPath, [
+    tsc,
+    "--noEmit",
+    "--strict",
+    "--target", "ES2022",
+    "--module", "CommonJS",
+    "--moduleResolution", "Node",
+    "--skipLibCheck",
+    "types-smoke.ts",
+  ], { cwd: consumerRoot, stdio: "inherit" });
+
+  writeFileSync(join(consumerRoot, "browser-types-smoke.mts"), `
+import {
+  CultMeshBrowserClient,
+  type CultMeshBrowserIdentity,
+  type CultMeshRawDocumentLeaseOptions,
+} from "cultmesh-browser";
+
+const identity: CultMeshBrowserIdentity = {
+  verseId: "smoke",
+  authorityRuntimeId: "smoke.authority",
+};
+const lease: CultMeshRawDocumentLeaseOptions = {
+  schemaId: "smoke.document.v1",
+  recordKey: "smoke:main",
+};
+const clientType: typeof CultMeshBrowserClient = CultMeshBrowserClient;
+void identity;
+void lease;
+void clientType;
+`);
+  execFileSync(process.execPath, [
+    tsc,
+    "--noEmit",
+    "--strict",
+    "--target", "ES2022",
+    "--module", "NodeNext",
+    "--moduleResolution", "NodeNext",
+    "--skipLibCheck",
+    "browser-types-smoke.mts",
+  ], { cwd: consumerRoot, stdio: "inherit" });
+
+  console.log("TypeScript package closure smoke: passed");
+  for (const tarball of tarballs) console.log(`Packed: ${tarball}`);
+} finally {
+  rmSync(smokeRoot, { recursive: true, force: true });
+}
diff --git a/scripts/verify-eve-browser-network.mjs b/scripts/verify-eve-browser-network.mjs
new file mode 100644
index 00000000..c1388712
--- /dev/null
+++ b/scripts/verify-eve-browser-network.mjs
@@ -0,0 +1,339 @@
+import assert from "node:assert/strict";
+import { spawn } from "node:child_process";
+import { existsSync } from "node:fs";
+import { createServer as createHttpServer } from "node:http";
+import { mkdtemp, readFile, rm } from "node:fs/promises";
+import { createServer as createNetServer } from "node:net";
+import { tmpdir } from "node:os";
+import { dirname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+
+import { build } from "esbuild";
+import { chromium } from "playwright-core";
+
+const repoRoot = resolve(dirname(fileURLToPath(import.meta.url)), "..");
+const eveFlag = process.argv.indexOf("--eve-root");
+const eveRoot = resolve(eveFlag >= 0 ? process.argv[eveFlag + 1] : join(repoRoot, "..", "Eve"));
+const packageFeedFlag = process.argv.indexOf("--package-feed");
+const packageFeed = packageFeedFlag >= 0 ? resolve(process.argv[packageFeedFlag + 1]) : undefined;
+const cultLibVersionFlag = process.argv.indexOf("--cultlib-package-version");
+const cultLibPackageVersion = cultLibVersionFlag >= 0 ? process.argv[cultLibVersionFlag + 1] : undefined;
+const eveSurfaceVersionFlag = process.argv.indexOf("--eve-surface-package-version");
+const eveSurfacePackageVersion = eveSurfaceVersionFlag >= 0 ? process.argv[eveSurfaceVersionFlag + 1] : undefined;
+const nugetConfigFlag = process.argv.indexOf("--nuget-config");
+const nugetConfig = nugetConfigFlag >= 0 ? resolve(process.argv[nugetConfigFlag + 1]) : undefined;
+const sampleRoot = join(repoRoot, "samples", "eve-browser-network");
+const workRoot = await mkdtemp(join(tmpdir(), "cultmesh-browser-network-"));
+const statePath = join(workRoot, "counter.cc");
+const decoyStatePath = join(workRoot, "decoy-counter.cc");
+const bundlePath = join(workRoot, "bundle.js");
+const token = "sample-session";
+let provider;
+let decoyProvider;
+let replacementProvider;
+let odin;
+let headless;
+let httpServer;
+let browser;
+
+try {
+  const tsc = join(repoRoot, "node_modules", "typescript", "bin", "tsc");
+  await run(process.execPath, [tsc, "-p", join(repoRoot, "packages", "cultnet-ts", "tsconfig.json"), "--pretty", "false"]);
+  await run(process.execPath, [tsc, "-p", join(repoRoot, "packages", "cultmesh-browser", "tsconfig.json"), "--pretty", "false"]);
+  await build({
+    entryPoints: [join(sampleRoot, "browser", "main.ts")],
+    outfile: bundlePath,
+    bundle: true,
+    format: "esm",
+    platform: "browser",
+    target: "es2022",
+    sourcemap: true,
+    alias: {
+      "@gamecult/eve-contracts": join(eveRoot, "packages", "eve-contracts", "src", "index.ts"),
+      "@gamecult/eve-browser-lowering": join(eveRoot, "packages", "eve-browser-lowering", "src", "index.ts"),
+      "cultmesh-browser": join(repoRoot, "packages", "cultmesh-browser", "src", "index.ts"),
+      "cultnet-ts/contracts": join(repoRoot, "packages", "cultnet-ts", "src", "contracts.ts"),
+    },
+    logLevel: "warning",
+  });
+  const bundle = await readFile(bundlePath, "utf8");
+  assert.doesNotMatch(bundle, /(?:from\s*["']node:|require\(["']node:)/u, "browser bundle contains a Node builtin import");
+
+  const dotnetBuildArguments = [
+    "build",
+    join(sampleRoot, "EveBrowserNetworkSample.csproj"),
+    "-m:1",
+    "--verbosity", "quiet",
+    "-p:NoWarn=1591%3BCS8632",
+    "-p:NuGetAudit=false",
+    "-p:RestoreIgnoreFailedSources=true",
+  ];
+  if (nugetConfig) dotnetBuildArguments.push(`-p:RestoreConfigFile=${nugetConfig}`);
+  if (packageFeed) {
+    if (!cultLibPackageVersion || !eveSurfacePackageVersion) {
+      throw new Error("Package artifact builds require both CultLib and Eve surface package versions.");
+    }
+    dotnetBuildArguments.push(
+      "-p:UsePackageArtifacts=true",
+      `-p:PackageFeed=${packageFeed}`,
+      `-p:CultLibPackageVersion=${cultLibPackageVersion}`,
+      `-p:EveSurfacePackageVersion=${eveSurfacePackageVersion}`,
+    );
+  } else {
+    dotnetBuildArguments.push(`-p:EveRoot=${eveRoot}`, `-p:CultLibRoot=${repoRoot}`);
+  }
+  await run("dotnet", dotnetBuildArguments);
+  const providerPort = await freePort();
+  const decoyProviderPort = await freePort();
+  const replacementProviderPort = await freePort();
+  const odinPort = await freePort();
+  const httpPort = await freePort();
+  provider = await startProvider(providerPort);
+  const endpoint = await provider.waitFor("PROVIDER_READY ");
+  decoyProvider = await startProvider(decoyProviderPort, {
+    authorityRuntimeId: "sample.decoy-daemon",
+    routeGeneration: "sample-decoy-route-1",
+    statePath: decoyStatePath,
+  });
+  const decoyEndpoint = await decoyProvider.waitFor("PROVIDER_READY ");
+  odin = await startOdin(odinPort, endpoint, decoyEndpoint);
+  const odinEndpoint = await odin.waitFor("ODIN_READY ");
+  headless = startDotnet([
+    "headless", "--odin", odinEndpoint, "--verse-id", "sample.counter",
+    "--expected-count", "2", "--token", token,
+  ]);
+  await headless.waitFor("HEADLESS_READY ");
+  httpServer = await serve(httpPort, sampleRoot, bundlePath);
+
+  browser = await chromium.launch({ executablePath: resolveChromiumExecutable(), headless: true });
+  let page = await browser.newPage();
+  // A command the lowering refuses is caught inside the page; without this
+  // the only symptom is a 30 s timeout on the receipt.
+  page.on("console", message => console.log(`[browser:${message.type()}] ${message.text()}`));
+  page.on("pageerror", error => console.log(`[browser:pageerror] ${error.message}`));
+  const url = `http://127.0.0.1:${httpPort}/?odin=${encodeURIComponent(odinEndpoint)}&token=${token}`;
+  await page.goto(url);
+  await page.waitForFunction(() => window.__sampleReady || window.__sampleError);
+  assert.equal(await page.evaluate(() => window.__sampleError), undefined);
+  assert.equal(await page.evaluate(() => window.__sampleCount), 0);
+  await page.locator("button").click();
+  await page.waitForFunction(() => window.__sampleReceipt?.count === 1 && window.__sampleCount === 1);
+  const firstReceipt = await page.evaluate(() => window.__sampleReceipt?.receiptId);
+  const firstHeadlessUpdate = JSON.parse(await headless.waitFor("HEADLESS_UPDATE_1 "));
+  assert.equal(firstHeadlessUpdate.count, 1);
+  assert.ok(firstHeadlessUpdate.receiptIds.includes(firstReceipt));
+  await page.locator("button").click();
+  await page.waitForFunction(receipt => window.__sampleReceipt?.receiptId === receipt, firstReceipt);
+  assert.equal(await page.evaluate(() => window.__sampleCount), 1, "duplicate idempotency key changed canonical state");
+
+  replacementProvider = await startProvider(replacementProviderPort);
+  const restartedEndpoint = await replacementProvider.waitFor("PROVIDER_READY ");
+  assert.notEqual(restartedEndpoint, endpoint);
+  await stop(odin.process);
+  odin = await startOdin(odinPort, restartedEndpoint, decoyEndpoint);
+  assert.equal(await odin.waitFor("ODIN_READY "), odinEndpoint);
+  await stop(provider.process);
+  provider = replacementProvider;
+  replacementProvider = undefined;
+  await page.waitForFunction(() =>
+    window.__sampleConnectionStates?.includes("reconnecting")
+    && window.__sampleConnectionStates.at(-1) === "connected");
+  headless.sendLine("INVOKE headless-command-2");
+  const headlessReceipt = JSON.parse(await headless.waitFor("HEADLESS_RECEIPT "));
+  assert.equal(headlessReceipt.status, "accepted");
+  assert.equal(headlessReceipt.count, 2);
+  await page.waitForFunction(() => window.__sampleCount === 2);
+  const secondReceipt = headlessReceipt.receiptId;
+  const secondHeadlessUpdate = JSON.parse(await headless.waitFor("HEADLESS_UPDATE_2 "));
+  assert.equal(secondHeadlessUpdate.count, 2);
+  assert.ok(secondHeadlessUpdate.receiptIds.includes(firstReceipt));
+  assert.ok(secondHeadlessUpdate.receiptIds.includes(secondReceipt));
+  const networkBenchmark = JSON.parse(await headless.waitFor("HEADLESS_NETWORK_BENCHMARK ", 60_000));
+  assert.equal(networkBenchmark.operations, 10_000);
+  assert.ok(networkBenchmark.p99Milliseconds < 250);
+  assert.ok(networkBenchmark.managedHeapGrowth <= 8 * 1024 * 1024);
+  const connectionStates = await page.evaluate(() => window.__sampleConnectionStates);
+  assert.equal(connectionStates[0], "connected");
+  assert.equal(connectionStates.at(-1), "connected");
+  assert.ok(connectionStates.includes("reconnecting"));
+  assert.ok(!connectionStates.includes("disposed"));
+
+  console.log(JSON.stringify({
+    providerEndpoint: endpoint,
+    replacementProviderEndpoint: restartedEndpoint,
+    rejectedWrongAuthorityEndpoint: decoyEndpoint,
+    odinEndpoint,
+    browserRuntime: "chromium",
+    headlessRuntime: "csharp",
+    receiptId: firstReceipt,
+    secondReceiptId: secondReceipt,
+    count: 2,
+    routeRotationCount: 1,
+    retainedHeadlessLease: true,
+    networkBenchmark,
+  }));
+} finally {
+  if (browser) await browser.close().catch(() => undefined);
+  if (headless) await stop(headless.process);
+  if (provider) await stop(provider.process);
+  if (decoyProvider) await stop(decoyProvider.process);
+  if (replacementProvider) await stop(replacementProvider.process);
+  if (odin) await stop(odin.process);
+  if (httpServer) await new Promise(resolve => httpServer.close(resolve));
+  await rm(workRoot, { recursive: true, force: true });
+}
+
+async function startProvider(port, options = {}) {
+  return startDotnet([
+    "provider", "--port", String(port),
+    "--state", options.statePath ?? statePath,
+    "--authority-runtime-id", options.authorityRuntimeId ?? "sample.counter-daemon",
+    "--route-generation", options.routeGeneration ?? "sample-counter-route-1",
+    "--token", token,
+  ]);
+}
+
+async function startOdin(port, providerEndpoint, decoyEndpoint) {
+  return startDotnet([
+    "odin",
+    "--port", String(port),
+    "--provider-endpoint", providerEndpoint,
+    "--decoy-endpoint", decoyEndpoint,
+    "--decoy-authority-runtime-id", "sample.decoy-daemon",
+    "--decoy-route-generation", "sample-decoy-route-1",
+    "--token", token,
+  ]);
+}
+
+function startDotnet(arguments_) {
+  const process = spawn("dotnet", [
+    "run", "--no-build", "--project", join(sampleRoot, "EveBrowserNetworkSample.csproj"), "--", ...arguments_,
+  ], { cwd: repoRoot, stdio: ["pipe", "pipe", "pipe"] });
+  let output = "";
+  let error = "";
+  const waiters = [];
+  process.stdout.setEncoding("utf8");
+  process.stderr.setEncoding("utf8");
+  process.stdout.on("data", chunk => { output += chunk; settle(); });
+  process.stderr.on("data", chunk => { error += chunk; });
+  process.on("exit", code => {
+    for (const waiter of waiters.splice(0)) {
+      clearTimeout(waiter.timer);
+      waiter.reject(new Error(`dotnet sample exited ${code}\n${output}\n${error}`));
+    }
+  });
+  function settle() {
+    for (let index = waiters.length - 1; index >= 0; index--) {
+      const waiter = waiters[index];
+      const line = output.split(/\r?\n/u).find(value => value.startsWith(waiter.prefix));
+      if (!line) continue;
+      waiters.splice(index, 1);
+      clearTimeout(waiter.timer);
+      waiter.resolve(line.slice(waiter.prefix.length));
+    }
+  }
+  return {
+    process,
+    sendLine(line) {
+      process.stdin.write(`${line}\n`);
+    },
+    waitFor(prefix, timeoutMs = 30_000) {
+      const existing = output.split(/\r?\n/u).find(value => value.startsWith(prefix));
+      if (existing) return Promise.resolve(existing.slice(prefix.length));
+      return new Promise((resolve, reject) => {
+        const waiter = {
+          prefix,
+          resolve,
+          reject,
+          timer: setTimeout(() => {
+            const index = waiters.indexOf(waiter);
+            if (index >= 0) waiters.splice(index, 1);
+            reject(new Error(`Timed out waiting for '${prefix}'.\n${output}\n${error}`));
+          }, timeoutMs),
+        };
+        waiters.push(waiter);
+      });
+    },
+  };
+}
+
+function run(command, arguments_) {
+  return new Promise((resolvePromise, reject) => {
+    const process = spawn(command, arguments_, { cwd: repoRoot, stdio: "inherit" });
+    process.on("error", reject);
+    process.on("exit", code => code === 0 ? resolvePromise() : reject(new Error(`${command} exited ${code}`)));
+  });
+}
+
+async function serve(port, root, builtBundle) {
+  const index = await readFile(join(root, "browser", "index.html"));
+  const server = createHttpServer(async (request, response) => {
+    if (request.url?.startsWith("/bundle.js")) {
+      response.setHeader("Content-Type", "text/javascript; charset=utf-8");
+      response.end(await readFile(builtBundle));
+      return;
+    }
+    response.setHeader("Content-Type", "text/html; charset=utf-8");
+    response.end(index);
+  });
+  await new Promise((resolvePromise, reject) => {
+    server.once("error", reject);
+    server.listen(port, "127.0.0.1", resolvePromise);
+  });
+  return server;
+}
+
+async function freePort() {
+  const server = createNetServer();
+  await new Promise((resolvePromise, reject) => {
+    server.once("error", reject);
+    server.listen(0, "127.0.0.1", resolvePromise);
+  });
+  const address = server.address();
+  const port = typeof address === "object" && address ? address.port : 0;
+  await new Promise(resolvePromise => server.close(resolvePromise));
+  return port;
+}
+
+async function stop(process) {
+  if (!process || process.exitCode !== null) return;
+  process.kill();
+  await Promise.race([
+    new Promise(resolvePromise => process.once("exit", resolvePromise)),
+    new Promise(resolvePromise => setTimeout(resolvePromise, 2_000)),
+  ]);
+  if (process.exitCode === null) process.kill("SIGKILL");
+}
+
+function resolveChromiumExecutable() {
+  const candidates = [process.env.CHROME_PATH];
+  if (process.platform === "win32") {
+    for (const root of [process.env.ProgramFiles, process.env["ProgramFiles(x86)"], process.env.LOCALAPPDATA]) {
+      if (!root) continue;
+      candidates.push(
+        join(root, "Google", "Chrome", "Application", "chrome.exe"),
+        join(root, "Microsoft", "Edge", "Application", "msedge.exe"),
+      );
+    }
+  } else if (process.platform === "darwin") {
+    candidates.push(
+      "/Applications/Google Chrome.app/Contents/MacOS/Google Chrome",
+      "/Applications/Microsoft Edge.app/Contents/MacOS/Microsoft Edge",
+    );
+  } else {
+    candidates.push(
+      "/usr/bin/google-chrome",
+      "/usr/bin/google-chrome-stable",
+      "/usr/bin/chromium",
+      "/usr/bin/chromium-browser",
+      "/opt/google/chrome/chrome",
+    );
+  }
+  candidates.push(chromium.executablePath());
+  const executablePath = candidates.find(candidate => candidate && existsSync(candidate));
+  if (executablePath) return executablePath;
+  throw new Error(
+    "No Chromium-family browser was found. Set CHROME_PATH or run "
+    + "'node node_modules/playwright-core/cli.js install chromium'.",
+  );
+}
diff --git a/scripts/verify-eve-getting-started.ps1 b/scripts/verify-eve-getting-started.ps1
new file mode 100644
index 00000000..4a87b19d
--- /dev/null
+++ b/scripts/verify-eve-getting-started.ps1
@@ -0,0 +1,86 @@
+param(
+    [string] $EveRoot = (Join-Path (Split-Path -Parent $PSScriptRoot) "..\Eve"),
+    [switch] $SkipDependencyInstall
+)
+
+$ErrorActionPreference = "Stop"
+$cultLibRoot = Split-Path -Parent $PSScriptRoot
+$EveRoot = [IO.Path]::GetFullPath($EveRoot)
+$networkSample = Join-Path $cultLibRoot "samples\eve-browser-network\Program.cs"
+$networkSampleSource = Get-Content -LiteralPath $networkSample -Raw
+if ($networkSampleSource -match 'OnCultNet\s*<\s*CultNetOperationRequestMessage' -or
+    $networkSampleSource -match 'Convert\.FromBase64String\s*\(\s*request\.Payload') {
+    throw "The getting-started provider has regressed to hand-written CultNet operation envelope dispatch."
+}
+foreach ($requiredPrimitive in @("CultNetOperationServer", "EveSurface.Create")) {
+    if ($networkSampleSource -notmatch [regex]::Escape($requiredPrimitive)) {
+        throw "The getting-started provider is missing the public primitive '$requiredPrimitive'."
+    }
+}
+if ($networkSampleSource -notmatch 'new\s+CultMeshSessionTarget\s*\(') {
+    throw "The getting-started client must address one explicit Verse/authority-runtime target."
+}
+$cultMeshClientSource = Get-Content -LiteralPath (Join-Path $cultLibRoot "src\GameCult.Mesh\CultMeshClient.cs") -Raw
+if ($cultMeshClientSource -match 'ConnectAsync\s*\(\s*string\s+(endpointId|verseId)' -or
+    $cultMeshClientSource -match 'Lease(Document|Collection)Async[^\(]*\(\s*string\s+(endpointId|verseId)') {
+    throw "CultMeshClient must not expose an ambiguous one-string session identity."
+}
+$dotnetPackageRoot = Join-Path ([IO.Path]::GetTempPath()) `
+    ("eve-getting-started-nuget-" + [guid]::NewGuid().ToString("N"))
+$sourceRevision = (& git -C $cultLibRoot rev-parse --short=12 HEAD).Trim()
+if ($LASTEXITCODE -ne 0 -or [string]::IsNullOrWhiteSpace($sourceRevision)) {
+    throw "Could not determine the CultLib source revision for local package identity."
+}
+$verificationNonce = [guid]::NewGuid().ToString("N").Substring(0, 8)
+$cultLibLocalVersion = "1.0.35-local.$sourceRevision.$verificationNonce"
+$surfaceLocalVersion = "0.3.3-local.$sourceRevision.$verificationNonce"
+try {
+    & (Join-Path $EveRoot "scripts\pack-dotnet-surface.ps1") `
+        -CultLibRoot $cultLibRoot `
+        -OutputDirectory $dotnetPackageRoot `
+        -CultLibPackageVersion $cultLibLocalVersion `
+        -SurfacePackageVersion $surfaceLocalVersion
+    if ($LASTEXITCODE -ne 0) {
+        throw "The clean .NET package-consumer checkpoint failed."
+    }
+
+    $cultLibPackage = Get-ChildItem -LiteralPath $dotnetPackageRoot -Filter "GameCult.Mesh.*.nupkg" |
+        Where-Object { $_.Name -notlike "*.snupkg" } |
+        Select-Object -First 1
+    $surfacePackage = Get-ChildItem -LiteralPath $dotnetPackageRoot -Filter "GameCult.Eve.Surface.*.nupkg" |
+        Where-Object { $_.Name -notlike "*.snupkg" } |
+        Select-Object -First 1
+    if (-not $cultLibPackage -or -not $surfacePackage) {
+        throw "The local package feed is missing CultMesh or Eve surface artifacts."
+    }
+    $cultLibVersion = [regex]::Match($cultLibPackage.Name, '^GameCult\.Mesh\.(.+)\.nupkg$').Groups[1].Value
+    $surfaceVersion = [regex]::Match($surfacePackage.Name, '^GameCult\.Eve\.Surface\.(.+)\.nupkg$').Groups[1].Value
+
+    & (Join-Path $PSScriptRoot "verify-eve-two-runtime-sample.ps1") `
+        -EveRoot $EveRoot `
+        -SkipDependencyInstall:$SkipDependencyInstall
+    if ($LASTEXITCODE -ne 0) {
+        throw "The clean package-consumer checkpoint failed."
+    }
+
+    $nodeCommand = Get-Command node -ErrorAction Stop
+    $playwrightCli = Join-Path $cultLibRoot "node_modules\playwright-core\cli.js"
+    if (-not (Test-Path -LiteralPath $playwrightCli -PathType Leaf)) {
+        throw "playwright-core is missing after dependency setup: $playwrightCli"
+    }
+
+    & $nodeCommand.Source (Join-Path $PSScriptRoot "verify-eve-browser-network.mjs") `
+        --eve-root $EveRoot `
+        --package-feed $dotnetPackageRoot `
+        --cultlib-package-version $cultLibVersion `
+        --eve-surface-package-version $surfaceVersion
+    if ($LASTEXITCODE -ne 0) {
+        throw "The real browser/C# network checkpoint failed."
+    }
+
+    Write-Host "Eve getting-started verification passed: clean .NET and TypeScript artifacts, DOM and headless convergence, real Chromium and C# clients, Odin discovery, authority-bound routes, receipts, persistence, and route replacement."
+} finally {
+    if (Test-Path -LiteralPath $dotnetPackageRoot) {
+        Remove-Item -LiteralPath $dotnetPackageRoot -Recurse -Force
+    }
+}
diff --git a/scripts/verify-eve-two-runtime-sample.ps1 b/scripts/verify-eve-two-runtime-sample.ps1
new file mode 100644
index 00000000..e33a0622
--- /dev/null
+++ b/scripts/verify-eve-two-runtime-sample.ps1
@@ -0,0 +1,149 @@
+param(
+    [string] $EveRoot = (Join-Path (Split-Path -Parent $PSScriptRoot) "..\Eve"),
+    [switch] $SkipDependencyInstall
+)
+
+$ErrorActionPreference = "Stop"
+
+$cultLibRoot = Split-Path -Parent $PSScriptRoot
+$samplePath = Join-Path $cultLibRoot "samples\eve-two-runtime\sample.mjs"
+$eveBrowserPackage = Join-Path $EveRoot "packages\eve-browser-lowering"
+$eveContractsPackage = Join-Path $EveRoot "packages\eve-contracts"
+$packageRoots = @(
+    (Join-Path $cultLibRoot "packages\cultcache-ts"),
+    (Join-Path $cultLibRoot "packages\cultnet-ts"),
+    (Join-Path $cultLibRoot "packages\cultmesh-ts"),
+    $eveContractsPackage,
+    $eveBrowserPackage
+)
+$onWindows = [System.Environment]::OSVersion.Platform -eq [System.PlatformID]::Win32NT
+
+$nodeCommand = Get-Command node -ErrorAction SilentlyContinue
+if (-not $nodeCommand) {
+    $standardNode = if ($onWindows -and $env:ProgramFiles) {
+        Join-Path $env:ProgramFiles "nodejs\node.exe"
+    }
+    else {
+        ""
+    }
+    if (Test-Path -LiteralPath $standardNode) {
+        $nodeCommand = Get-Item -LiteralPath $standardNode
+    }
+}
+if (-not $nodeCommand) {
+    throw "Node.js is required to verify the Eve two-runtime sample."
+}
+$nodePath = $nodeCommand.Source
+$nodeDirectory = Split-Path -Parent $nodePath
+$npmPath = if ($onWindows) {
+    Join-Path $nodeDirectory "npm.cmd"
+}
+else {
+    (Get-Command npm -ErrorAction Stop).Source
+}
+if (-not (Test-Path -LiteralPath $npmPath)) {
+    throw "npm was not found beside Node.js: $npmPath"
+}
+$env:PATH = $nodeDirectory + [IO.Path]::PathSeparator + $env:PATH
+if (-not (Test-Path -LiteralPath $samplePath)) {
+    throw "Sample not found: $samplePath"
+}
+foreach ($packageRoot in $packageRoots) {
+    if (-not (Test-Path -LiteralPath (Join-Path $packageRoot "package.json"))) {
+        throw "Package root not found: $packageRoot"
+    }
+}
+
+if (-not $SkipDependencyInstall) {
+    $dependencyRoots = @($cultLibRoot, $eveContractsPackage, $eveBrowserPackage)
+    foreach ($dependencyRoot in $dependencyRoots) {
+        $typescript = Join-Path $dependencyRoot "node_modules\typescript\bin\tsc"
+        if (Test-Path -LiteralPath $typescript -PathType Leaf) {
+            continue
+        }
+        Push-Location $dependencyRoot
+        try {
+            & $npmPath ci --no-audit --no-fund
+            if ($LASTEXITCODE -ne 0) {
+                throw "Dependency installation failed: $dependencyRoot"
+            }
+        }
+        finally {
+            Pop-Location
+        }
+    }
+}
+
+$tempBase = [IO.Path]::GetFullPath([IO.Path]::GetTempPath())
+$workRoot = Join-Path $tempBase ("gamecult-eve-two-runtime-" + [guid]::NewGuid().ToString("N"))
+$artifactRoot = Join-Path $workRoot "artifacts"
+$consumerRoot = Join-Path $workRoot "consumer"
+New-Item -ItemType Directory -Path $artifactRoot, $consumerRoot -Force | Out-Null
+
+try {
+    foreach ($packageRoot in $packageRoots) {
+        Push-Location $packageRoot
+        try {
+            if ((Split-Path -Leaf $packageRoot) -eq "cultnet-ts") {
+                & $nodePath (Join-Path $packageRoot "tools\generate-swarm-contracts.mjs")
+                if ($LASTEXITCODE -ne 0) {
+                    throw "CultNet TypeScript contract generation failed: $packageRoot"
+                }
+            }
+            $typescriptPath = if ($packageRoot -eq $eveBrowserPackage -or $packageRoot -eq $eveContractsPackage) {
+                Join-Path $packageRoot "node_modules\typescript\bin\tsc"
+            }
+            else {
+                Join-Path $cultLibRoot "node_modules\typescript\bin\tsc"
+            }
+            & $nodePath $typescriptPath -p (Join-Path $packageRoot "tsconfig.json") --pretty false
+            if ($LASTEXITCODE -ne 0) {
+                throw "Package build failed: $packageRoot"
+            }
+            & $npmPath pack --ignore-scripts --silent --pack-destination $artifactRoot | Out-Null
+            if ($LASTEXITCODE -ne 0) {
+                throw "Package pack failed: $packageRoot"
+            }
+        }
+        finally {
+            Pop-Location
+        }
+    }
+
+    Push-Location $consumerRoot
+    try {
+        & $npmPath init --yes --silent | Out-Null
+        $tarballs = Get-ChildItem -LiteralPath $artifactRoot -Filter "*.tgz" |
+            Sort-Object Name |
+            ForEach-Object FullName
+        $installArguments = @(
+            "install",
+            "--silent",
+            "--no-audit",
+            "--no-fund",
+            "@msgpack/msgpack@3",
+            "ajv@8",
+            "jsdom@30",
+            "zod@3"
+        ) + @($tarballs)
+        & $npmPath @installArguments
+        if ($LASTEXITCODE -ne 0) {
+            throw "Clean consumer package installation failed."
+        }
+        Copy-Item -LiteralPath $samplePath -Destination (Join-Path $consumerRoot "sample.mjs")
+        & $nodePath (Join-Path $consumerRoot "sample.mjs")
+        if ($LASTEXITCODE -ne 0) {
+            throw "Eve two-runtime sample failed."
+        }
+    }
+    finally {
+        Pop-Location
+    }
+}
+finally {
+    $resolvedWorkRoot = [IO.Path]::GetFullPath($workRoot)
+    if ($resolvedWorkRoot.StartsWith($tempBase, [StringComparison]::OrdinalIgnoreCase) -and
+        (Test-Path -LiteralPath $resolvedWorkRoot)) {
+        Remove-Item -LiteralPath $resolvedWorkRoot -Recurse -Force
+    }
+}
diff --git a/scripts/verify-reactive-document-scaling.ps1 b/scripts/verify-reactive-document-scaling.ps1
new file mode 100644
index 00000000..523b761f
--- /dev/null
+++ b/scripts/verify-reactive-document-scaling.ps1
@@ -0,0 +1,105 @@
+param(
+    [string] $PythonPath = "",
+    [string] $NodePath = ""
+)
+
+$ErrorActionPreference = "Stop"
+
+$root = Split-Path -Parent $PSScriptRoot
+$dotnet = Get-Command dotnet -ErrorAction Stop
+$nodeExecutable = if ([string]::IsNullOrWhiteSpace($NodePath)) {
+    $node = Get-Command node -ErrorAction SilentlyContinue
+    if ($node) { $node.Source } else { Join-Path $env:ProgramFiles "nodejs\node.exe" }
+}
+else {
+    [IO.Path]::GetFullPath($NodePath)
+}
+if (-not (Test-Path -LiteralPath $nodeExecutable -PathType Leaf)) {
+    throw "Node.js executable not found: $nodeExecutable"
+}
+$pythonExecutable = if ([string]::IsNullOrWhiteSpace($PythonPath)) {
+    (Get-Command python -ErrorAction Stop).Source
+}
+else {
+    [IO.Path]::GetFullPath($PythonPath)
+}
+if (-not (Test-Path -LiteralPath $pythonExecutable)) {
+    throw "Python executable not found: $pythonExecutable"
+}
+$typescript = Join-Path $root "node_modules\typescript\bin\tsc"
+if (-not (Test-Path -LiteralPath $typescript)) {
+    throw "TypeScript compiler not found: $typescript"
+}
+
+foreach ($dependency in @("cultcache-ts", "cultnet-ts")) {
+    $dependencyRoot = Join-Path $root "packages\$dependency"
+    Push-Location $dependencyRoot
+    try {
+        if ($dependency -eq "cultnet-ts") {
+            & $nodeExecutable (Join-Path $dependencyRoot "tools\generate-swarm-contracts.mjs")
+            if ($LASTEXITCODE -ne 0) {
+                throw "CultNet TypeScript contract generation failed."
+            }
+        }
+        & $nodeExecutable $typescript -p tsconfig.json --pretty false
+        if ($LASTEXITCODE -ne 0) {
+            throw "TypeScript dependency build failed: $dependency"
+        }
+    }
+    finally {
+        Pop-Location
+    }
+}
+
+& $dotnet.Source test (Join-Path $root "tests\GameCult.Mesh.Tests\GameCult.Mesh.Tests.csproj") `
+    --filter "FullyQualifiedName~ReactiveDocument_SchedulingScalesWithChangedDocumentsOnly" `
+    --nologo `
+    --verbosity minimal
+if ($LASTEXITCODE -ne 0) {
+    throw "CultMesh C# reactive scaling verification failed."
+}
+
+Push-Location (Join-Path $root "packages\cultmesh-ts")
+try {
+    & $nodeExecutable $typescript -p tsconfig.json --pretty false
+    if ($LASTEXITCODE -ne 0) {
+        throw "CultMesh TypeScript source build failed."
+    }
+    & $nodeExecutable $typescript -p tsconfig.test.json --pretty false
+    if ($LASTEXITCODE -ne 0) {
+        throw "CultMesh TypeScript test build failed."
+    }
+    $testFiles = Get-ChildItem -LiteralPath .\dist-test\test -Filter "*.test.js" |
+        Sort-Object Name |
+        ForEach-Object FullName
+    & $nodeExecutable --test @testFiles
+    if ($LASTEXITCODE -ne 0) {
+        throw "CultMesh TypeScript reactive scaling verification failed."
+    }
+}
+finally {
+    Pop-Location
+}
+
+$pythonPath = (@("cultcache-py", "cultnet-py", "cultmesh-py") | ForEach-Object { Join-Path $root "packages\$_\src" }) -join [IO.Path]::PathSeparator
+$previousPythonPath = $env:PYTHONPATH
+$env:PYTHONPATH = if ([string]::IsNullOrWhiteSpace($previousPythonPath)) {
+    $pythonPath
+}
+else {
+    $pythonPath + [IO.Path]::PathSeparator + $previousPythonPath
+}
+try {
+    & $pythonExecutable -m unittest discover `
+        -s (Join-Path $root "packages\cultmesh-py\tests") `
+        -p "test_cultmesh.py" `
+        -k "reactive_scheduling_scales_with_changed_documents_only"
+    if ($LASTEXITCODE -ne 0) {
+        throw "CultMesh Python reactive scaling verification failed."
+    }
+}
+finally {
+    $env:PYTHONPATH = $previousPythonPath
+}
+
+Write-Output '{"runtimes":["csharp","typescript","python"],"documentCounts":[1,100,1000],"changedFraction":0.01,"idleSchedules":0,"invariant":"scheduling is proportional to explicitly changed documents"}'
diff --git a/src/GameCult.Caching.MessagePack.Analyzers/Class1.cs b/src/GameCult.Caching.MessagePack.Analyzers/Class1.cs
deleted file mode 100644
index 345e38e6..00000000
--- a/src/GameCult.Caching.MessagePack.Analyzers/Class1.cs
+++ /dev/null
@@ -1,11 +0,0 @@
-using System;
-
-namespace GameCult.Caching.MessagePack.Analyzer
-{
-    /// <summary>
-    /// Placeholder type for the analyzer packaging project.
-    /// </summary>
-    public class Class1
-    {
-    }
-}
diff --git a/src/GameCult.Caching.MessagePack.Analyzers/GameCult.Caching.MessagePack.Analyzers.csproj b/src/GameCult.Caching.MessagePack.Analyzers/GameCult.Caching.MessagePack.Analyzers.csproj
deleted file mode 100644
index 12c4e684..00000000
--- a/src/GameCult.Caching.MessagePack.Analyzers/GameCult.Caching.MessagePack.Analyzers.csproj
+++ /dev/null
@@ -1,33 +0,0 @@
-<Project Sdk="Microsoft.NET.Sdk">
-
-  <PropertyGroup>
-
-    <Description>Source generator that emits MessagePack formatters for DatabaseEntry subclasses</Description>
-    <PackageTags>MessagePack;SourceGenerator;DatabaseEntry;Analyzer</PackageTags>
-	
-    <IncludeBuildOutput>false</IncludeBuildOutput>
-    <TargetsForTfmSpecificContentInPackage>$(TargetsForTfmSpecificContentInPackage);PackBuildOutputs</TargetsForTfmSpecificContentInPackage>
-    <SuppressDependenciesWhenPacking>true</SuppressDependenciesWhenPacking>
-    <IncludeSymbols>false</IncludeSymbols>
-    <DevelopmentDependency>true</DevelopmentDependency>
-  </PropertyGroup>
-
-  <ItemGroup>
-    <!-- Reference the generator project, but not for compile -->
-    <ProjectReference Include="..\GameCult.Caching.MessagePack.Generator\GameCult.Caching.MessagePack.Generator.csproj"
-                      ExcludeAssets="compile" />
-  </ItemGroup>
-  
-  <Target Name="DebugResolvedProjectReferences" AfterTargets="ResolveProjectReferences">
-    <Message Importance="High" Text="ResolvedProjectReferencePaths = %(_ResolvedProjectReferencePaths.Identity)" />
-  </Target>
-  
-  <!-- This target must run after ResolveProjectReferences and ensure the generator was built -->
-  <Target Name="PackBuildOutputs" DependsOnTargets="ResolveProjectReferences;DebugSymbolsProjectOutputGroup">
-    <ItemGroup>
-      <!-- Put generator DLL into the analyzers folder -->
-      <TfmSpecificPackageFile Include="%(_ResolvedProjectReferencePaths.Identity)" PackagePath="analyzers/dotnet/cs/" />
-    </ItemGroup>
-  </Target>
-
-</Project>
diff --git a/src/GameCult.Caching.MessagePack.Analyzers/README.md b/src/GameCult.Caching.MessagePack.Analyzers/README.md
deleted file mode 100644
index e4b25bd4..00000000
--- a/src/GameCult.Caching.MessagePack.Analyzers/README.md
+++ /dev/null
@@ -1,25 +0,0 @@
-# GameCult.Caching.MessagePack.Analyzers
-
-`GameCult.Caching.MessagePack.Analyzers` is the delivery mechanism for the MessagePack source generator used by the cache libraries.
-
-## Scope
-
-This project is primarily packaging infrastructure. It exists so consuming projects can receive generator output at compile time without treating the generator assembly as a normal runtime dependency.
-
-## What It Does
-
-- references the generator project
-- arranges for the generator assembly to be packed under `analyzers/dotnet/cs`
-- keeps generator assets out of the normal compile/runtime reference flow
-
-## Practical Meaning
-
-When a consuming project adds the analyzer package:
-
-- the generator runs during compilation
-- concrete `DatabaseEntry` types receive generated MessagePack formatters
-- `GameCult.Caching.MessagePack` can then serialize those types without handwritten formatter code
-
-## Current State
-
-This project is a packaging host. It does not currently expose custom analyzer diagnostics of its own.
diff --git a/src/GameCult.Caching.MessagePack.Generator/CultDocumentMessagePackGenerator.cs b/src/GameCult.Caching.MessagePack.Generator/CultDocumentMessagePackGenerator.cs
deleted file mode 100644
index eeb09475..00000000
--- a/src/GameCult.Caching.MessagePack.Generator/CultDocumentMessagePackGenerator.cs
+++ /dev/null
@@ -1,617 +0,0 @@
-using System;
-using System.Collections.Generic;
-using System.Collections.Immutable;
-using System.Linq;
-using System.Text;
-using Microsoft.CodeAnalysis;
-using Microsoft.CodeAnalysis.CSharp.Syntax;
-using Microsoft.CodeAnalysis.Text;
-
-namespace GameCult.Caching.MessagePack.Generator
-{
-/// <summary>
-/// Emits MessagePack payload serializers for CultCache document types.
-/// </summary>
-[Generator]
-public sealed class CultDocumentMessagePackGenerator : IIncrementalGenerator
-{
-    /// <summary>
-    /// Registers the generator pipeline.
-    /// </summary>
-    public void Initialize(IncrementalGeneratorInitializationContext context)
-        {
-            var documentShapes = context.SyntaxProvider
-                .CreateSyntaxProvider(
-                    static (node, _) => node is ClassDeclarationSyntax cds && cds.AttributeLists.Count > 0,
-                    static (ctx, _) => BuildDocumentShape(ctx))
-                .Where(static shape => shape != null)
-                .Select(static (shape, _) => shape!);
-
-            var compilationAndShapes = context.CompilationProvider.Combine(documentShapes.Collect());
-            context.RegisterSourceOutput(
-                compilationAndShapes,
-                static (spc, pair) => EmitProvider(spc, pair.Left, pair.Right));
-        }
-
-        private static DocumentShape? BuildDocumentShape(GeneratorSyntaxContext context)
-        {
-            if (context.SemanticModel.GetDeclaredSymbol(context.Node) is not INamedTypeSymbol typeSymbol)
-            {
-                return null;
-            }
-
-            var documentAttribute = GetAttribute(typeSymbol, "GameCult.Caching.CultDocumentAttribute");
-            if (documentAttribute == null ||
-                documentAttribute.ConstructorArguments.Length < 2 ||
-                documentAttribute.ConstructorArguments[0].Value is not string schemaName ||
-                documentAttribute.ConstructorArguments[1].Value is not string schemaVersion)
-            {
-                return null;
-            }
-
-            var members = DiscoverMembers(typeSymbol);
-            var nameMember = members.FirstOrDefault(member => member.IsName);
-            return new DocumentShape(
-                typeSymbol.ToDisplayString(SymbolDisplayFormat.FullyQualifiedFormat),
-                schemaName,
-                schemaVersion,
-                GetAttribute(typeSymbol, "GameCult.Caching.CultGlobalAttribute") != null,
-                nameMember?.Name,
-                nameMember?.AccessorMethodName,
-                members.Where(member => member.IndexAlias != null)
-                    .Select(member => new IndexAccessorShape(member.IndexAlias!, member.IndexAccessorMethodName!))
-                    .ToImmutableArray(),
-                members.ToImmutableArray());
-        }
-
-        private static ImmutableArray<MemberShape> DiscoverMembers(INamedTypeSymbol typeSymbol)
-        {
-            var candidates = new List<MemberShapeSeed>();
-            foreach (var member in typeSymbol.GetMembers())
-            {
-                if (member is IFieldSymbol field)
-                {
-                    if (field.IsStatic || field.DeclaredAccessibility != Accessibility.Public || IsIgnored(field))
-                    {
-                        continue;
-                    }
-
-                    candidates.Add(MemberShapeSeed.From(field, field.Type));
-                    continue;
-                }
-
-                if (member is IPropertySymbol property)
-                {
-                    if (property.IsStatic ||
-                        property.IsIndexer ||
-                        property.DeclaredAccessibility != Accessibility.Public ||
-                        property.GetMethod == null ||
-                        property.SetMethod == null ||
-                        IsIgnored(property))
-                    {
-                        continue;
-                    }
-
-                    candidates.Add(MemberShapeSeed.From(property, property.Type));
-                }
-            }
-
-            var explicitMembers = candidates
-                .Where(member => member.ExplicitSlot.HasValue)
-                .OrderBy(member => member.ExplicitSlot!.Value)
-                .ThenBy(member => member.SortKey, StringComparer.Ordinal)
-                .ToArray();
-            var implicitMembers = candidates
-                .Where(member => !member.ExplicitSlot.HasValue)
-                .OrderBy(member => member.SortKey, StringComparer.Ordinal)
-                .ToArray();
-            var nextSlot = explicitMembers.Length == 0 ? 0 : explicitMembers.Max(member => member.ExplicitSlot!.Value) + 1;
-            var shaped = new List<MemberShape>(candidates.Count);
-
-            foreach (var member in explicitMembers)
-            {
-                shaped.Add(member.WithSlot(member.ExplicitSlot!.Value));
-            }
-
-            foreach (var member in implicitMembers)
-            {
-                shaped.Add(member.WithSlot(nextSlot++));
-            }
-
-            return shaped
-                .OrderBy(member => member.Slot)
-                .ToImmutableArray();
-        }
-
-        private static bool IsIgnored(ISymbol member)
-        {
-            return GetAttribute(member, "MessagePack.IgnoreMemberAttribute") != null;
-        }
-
-        private static AttributeData? GetAttribute(ISymbol symbol, string fullyQualifiedName)
-        {
-            return symbol.GetAttributes().FirstOrDefault(attribute =>
-                attribute.AttributeClass?.ToDisplayString() == fullyQualifiedName);
-        }
-
-        private static int? GetExplicitSlot(ISymbol member)
-        {
-            var keyAttribute = GetAttribute(member, "MessagePack.KeyAttribute");
-            if (keyAttribute == null || keyAttribute.ConstructorArguments.Length == 0)
-            {
-                return null;
-            }
-
-            var argument = keyAttribute.ConstructorArguments[0];
-            return argument.Kind == TypedConstantKind.Primitive && argument.Value is int slot
-                ? slot
-                : null;
-        }
-
-        private static void EmitProvider(SourceProductionContext context, Compilation compilation, ImmutableArray<DocumentShape> shapes)
-        {
-            var documents = shapes
-                .Where(shape => shape != null)
-                .GroupBy(shape => shape.DocumentTypeName, StringComparer.Ordinal)
-                .Select(group => group.First())
-                .OrderBy(shape => shape.DocumentTypeName, StringComparer.Ordinal)
-                .ToArray();
-
-            if (documents.Length == 0)
-            {
-                return;
-            }
-
-            var canEmitPayloadCodecs =
-                compilation.GetTypeByMetadataName("MessagePack.MessagePackWriter") != null &&
-                compilation.GetTypeByMetadataName("GameCult.Caching.MessagePack.CultDocumentMessagePackSerialization") != null;
-
-            var providerName = $"GeneratedCultDocumentMetadataProvider_{SanitizeIdentifier(compilation.AssemblyName ?? "GameCult")}";
-            var builder = new StringBuilder();
-            builder.AppendLine("// <auto-generated/>");
-            builder.AppendLine("#nullable enable");
-            builder.AppendLine($"[assembly: global::GameCult.Caching.CultGeneratedDocumentMetadataProviderAttribute(typeof(global::GameCult.Caching.Generated.{providerName}))]");
-            builder.AppendLine("namespace GameCult.Caching.Generated");
-            builder.AppendLine("{");
-            builder.AppendLine($"    internal sealed class {providerName} : global::GameCult.Caching.ICultGeneratedDocumentMetadataProvider");
-            builder.AppendLine("    {");
-            builder.AppendLine("        private static readonly global::GameCult.Caching.CultGeneratedDocumentDefinition[] s_documents =");
-            builder.AppendLine("        {");
-
-            foreach (var document in documents)
-            {
-                builder.AppendLine("            new global::GameCult.Caching.CultGeneratedDocumentDefinition(");
-                builder.AppendLine($"                typeof({document.DocumentTypeName}),");
-                builder.AppendLine($"                \"{Escape(document.SchemaName)}\",");
-                builder.AppendLine($"                \"{Escape(document.SchemaVersion)}\",");
-                builder.AppendLine($"                {(document.IsGlobal ? "true" : "false")},");
-                builder.AppendLine(document.NameMember == null
-                    ? "                null,"
-                    : $"                \"{Escape(document.NameMember)}\",");
-                builder.AppendLine(document.NameAccessorMethodName == null
-                    ? "                null,"
-                    : $"                {document.NameAccessorMethodName},");
-                builder.AppendLine(canEmitPayloadCodecs
-                    ? $"                {document.PayloadSerializerMethodName},"
-                    : "                null,");
-                builder.AppendLine(canEmitPayloadCodecs
-                    ? $"                {document.PayloadDeserializerMethodName},"
-                    : "                null,");
-                builder.AppendLine("                new global::GameCult.Caching.CultGeneratedDocumentIndexAccessor[]");
-                builder.AppendLine("                {");
-                foreach (var indexAccessor in document.IndexAccessors)
-                {
-                    builder.AppendLine($"                    new global::GameCult.Caching.CultGeneratedDocumentIndexAccessor(\"{Escape(indexAccessor.Alias)}\", {indexAccessor.AccessorMethodName}),");
-                }
-                builder.AppendLine("                },");
-                builder.AppendLine("                new global::GameCult.Caching.CultGeneratedDocumentMemberDefinition[]");
-                builder.AppendLine("                {");
-                foreach (var member in document.Members.OrderBy(member => member.Slot))
-                {
-                    builder.AppendLine("                    new global::GameCult.Caching.CultGeneratedDocumentMemberDefinition(");
-                    builder.AppendLine($"                        \"{Escape(member.Name)}\",");
-                    builder.AppendLine($"                        {member.Slot},");
-                    builder.AppendLine($"                        \"{Escape(member.SchemaTypeName)}\",");
-                    builder.AppendLine($"                        {(member.IsReference ? "true" : "false")},");
-                    builder.AppendLine($"                        {(member.IsMany ? "true" : "false")},");
-                    builder.AppendLine(member.TargetSchemaName == null
-                        ? "                        null,"
-                        : $"                        \"{Escape(member.TargetSchemaName)}\",");
-                    builder.AppendLine($"                        {(member.IsName ? "true" : "false")},");
-                    builder.AppendLine(member.IndexAlias == null
-                        ? "                        null),"
-                        : $"                        \"{Escape(member.IndexAlias)}\"),");
-                }
-                builder.AppendLine("                }),");
-            }
-
-            builder.AppendLine("        };");
-            builder.AppendLine();
-            builder.AppendLine("        public global::System.Collections.Generic.IEnumerable<global::GameCult.Caching.CultGeneratedDocumentDefinition> GetDocumentDefinitions()");
-            builder.AppendLine("        {");
-            builder.AppendLine("            return s_documents;");
-            builder.AppendLine("        }");
-            builder.AppendLine();
-
-            foreach (var document in documents)
-            {
-                if (canEmitPayloadCodecs)
-                {
-                    EmitPayloadSerializer(builder, document);
-                    EmitPayloadDeserializer(builder, document);
-                }
-
-                foreach (var member in document.Members.Where(member => member.AccessorMethodName != null))
-                {
-                    builder.AppendLine($"        private static string? {member.AccessorMethodName}(object document)");
-                    builder.AppendLine("        {");
-                    builder.AppendLine(member.CanBeNull
-                        ? $"            return (({document.DocumentTypeName})document).{member.Name}?.ToString();"
-                        : $"            return (({document.DocumentTypeName})document).{member.Name}.ToString();");
-                    builder.AppendLine("        }");
-                    builder.AppendLine();
-                }
-
-                foreach (var member in document.Members.Where(member => member.IndexAccessorMethodName != null))
-                {
-                    builder.AppendLine($"        private static string {member.IndexAccessorMethodName}(object document)");
-                    builder.AppendLine("        {");
-                    builder.AppendLine(member.CanBeNull
-                        ? $"            return (({document.DocumentTypeName})document).{member.Name}?.ToString() ?? string.Empty;"
-                        : $"            return (({document.DocumentTypeName})document).{member.Name}.ToString();");
-                    builder.AppendLine("        }");
-                    builder.AppendLine();
-                }
-            }
-
-            builder.AppendLine("    }");
-            builder.AppendLine("}");
-            context.AddSource($"{providerName}.g.cs", SourceText.From(builder.ToString(), Encoding.UTF8));
-        }
-
-        private static void EmitPayloadSerializer(StringBuilder builder, DocumentShape document)
-        {
-            builder.AppendLine($"        private static byte[] {document.PayloadSerializerMethodName}(object document)");
-            builder.AppendLine("        {");
-            builder.AppendLine($"            var typed = ({document.DocumentTypeName})document;");
-            builder.AppendLine("            var options = global::GameCult.Caching.MessagePack.CultDocumentMessagePackSerialization.Options;");
-            builder.AppendLine("            var buffer = new global::System.Buffers.ArrayBufferWriter<byte>();");
-            builder.AppendLine("            var writer = new global::MessagePack.MessagePackWriter(buffer);");
-            builder.AppendLine($"            writer.WriteArrayHeader({document.Members.Length});");
-            foreach (var member in document.Members.OrderBy(member => member.Slot))
-            {
-                builder.AppendLine($"            global::MessagePack.FormatterResolverExtensions.GetFormatterWithVerify<{member.TypeSyntaxName}>(options.Resolver).Serialize(ref writer, typed.{member.Name}, options);");
-            }
-            builder.AppendLine("            writer.Flush();");
-            builder.AppendLine("            return buffer.WrittenSpan.ToArray();");
-            builder.AppendLine("        }");
-            builder.AppendLine();
-        }
-
-        private static void EmitPayloadDeserializer(StringBuilder builder, DocumentShape document)
-        {
-            builder.AppendLine($"        private static object {document.PayloadDeserializerMethodName}(byte[] payload)");
-            builder.AppendLine("        {");
-            builder.AppendLine("            var options = global::GameCult.Caching.MessagePack.CultDocumentMessagePackSerialization.Options;");
-            builder.AppendLine("            var reader = new global::MessagePack.MessagePackReader(payload);");
-            builder.AppendLine("            var count = reader.ReadArrayHeader();");
-            builder.AppendLine($"            var value = new {document.DocumentTypeName}();");
-            foreach (var member in document.Members.OrderBy(member => member.Slot))
-            {
-                builder.AppendLine($"            if (count > {member.Slot})");
-                builder.AppendLine("            {");
-                builder.AppendLine($"                value.{member.Name} = global::MessagePack.FormatterResolverExtensions.GetFormatterWithVerify<{member.TypeSyntaxName}>(options.Resolver).Deserialize(ref reader, options);");
-                builder.AppendLine("            }");
-            }
-            builder.AppendLine($"            for (var index = {document.Members.Length}; index < count; index++)");
-            builder.AppendLine("            {");
-            builder.AppendLine("                reader.Skip();");
-            builder.AppendLine("            }");
-            builder.AppendLine("            return value;");
-            builder.AppendLine("        }");
-            builder.AppendLine();
-        }
-
-        private static string Escape(string value)
-        {
-            return value
-                .Replace("\\", "\\\\")
-                .Replace("\"", "\\\"")
-                .Replace("\r", "\\r")
-                .Replace("\n", "\\n")
-                .Replace("\t", "\\t");
-        }
-
-        private static string SanitizeIdentifier(string value)
-        {
-            var builder = new StringBuilder(value.Length);
-            foreach (var character in value)
-            {
-                builder.Append(char.IsLetterOrDigit(character) ? character : '_');
-            }
-
-            if (builder.Length == 0 || !char.IsLetter(builder[0]) && builder[0] != '_')
-            {
-                builder.Insert(0, '_');
-            }
-
-            return builder.ToString();
-        }
-
-        private static string GetSchemaTypeName(ITypeSymbol typeSymbol)
-        {
-            if (typeSymbol is IArrayTypeSymbol arrayType)
-            {
-                return GetSchemaTypeName(arrayType.ElementType) + "[]";
-            }
-
-            if (typeSymbol is INamedTypeSymbol namedType && namedType.IsGenericType)
-            {
-                var baseName = GetNamedTypeBaseName(namedType.ConstructedFrom);
-                var arguments = string.Join(", ", namedType.TypeArguments.Select(GetSchemaTypeName));
-                return $"{baseName}<{arguments}>";
-            }
-
-            return typeSymbol.SpecialType switch
-            {
-                SpecialType.System_Boolean => "System.Boolean",
-                SpecialType.System_Byte => "System.Byte",
-                SpecialType.System_Char => "System.Char",
-                SpecialType.System_Decimal => "System.Decimal",
-                SpecialType.System_Double => "System.Double",
-                SpecialType.System_Int16 => "System.Int16",
-                SpecialType.System_Int32 => "System.Int32",
-                SpecialType.System_Int64 => "System.Int64",
-                SpecialType.System_Object => "System.Object",
-                SpecialType.System_SByte => "System.SByte",
-                SpecialType.System_Single => "System.Single",
-                SpecialType.System_String => "System.String",
-                SpecialType.System_UInt16 => "System.UInt16",
-                SpecialType.System_UInt32 => "System.UInt32",
-                SpecialType.System_UInt64 => "System.UInt64",
-                _ => GetNamedTypeBaseName((INamedTypeSymbol)typeSymbol)
-            };
-        }
-
-        private static string GetNamedTypeBaseName(INamedTypeSymbol typeSymbol)
-        {
-            var parts = new Stack<string>();
-            var current = typeSymbol;
-            while (current != null)
-            {
-                parts.Push(current.Name);
-                current = current.ContainingType;
-            }
-
-            var namespaceName = typeSymbol.ContainingNamespace?.ToDisplayString();
-            return string.IsNullOrWhiteSpace(namespaceName)
-                ? string.Join(".", parts)
-                : namespaceName + "." + string.Join(".", parts);
-        }
-
-        private static bool CanBeNull(ITypeSymbol typeSymbol)
-        {
-            if (typeSymbol.NullableAnnotation == NullableAnnotation.Annotated)
-            {
-                return true;
-            }
-
-            if (typeSymbol.IsReferenceType)
-            {
-                return true;
-            }
-
-            return typeSymbol is INamedTypeSymbol namedType &&
-                   namedType.IsGenericType &&
-                   namedType.ConstructedFrom.SpecialType == SpecialType.System_Nullable_T;
-        }
-
-        private sealed class MemberShapeSeed
-        {
-            private MemberShapeSeed(
-                string name,
-                string schemaTypeName,
-                string typeSyntaxName,
-                int? explicitSlot,
-                string sortKey,
-                bool isName,
-                string? indexAlias,
-                bool isReference,
-                bool isMany,
-                bool canBeNull,
-                string? targetSchemaName)
-            {
-                Name = name;
-                SchemaTypeName = schemaTypeName;
-                TypeSyntaxName = typeSyntaxName;
-                ExplicitSlot = explicitSlot;
-                SortKey = sortKey;
-                IsName = isName;
-                IndexAlias = indexAlias;
-                IsReference = isReference;
-                IsMany = isMany;
-                CanBeNull = canBeNull;
-                TargetSchemaName = targetSchemaName;
-            }
-
-            public string Name { get; }
-            public string SchemaTypeName { get; }
-            public string TypeSyntaxName { get; }
-            public int? ExplicitSlot { get; }
-            public string SortKey { get; }
-            public bool IsName { get; }
-            public string? IndexAlias { get; }
-            public bool IsReference { get; }
-            public bool IsMany { get; }
-            public bool CanBeNull { get; }
-            public string? TargetSchemaName { get; }
-
-            public MemberShape WithSlot(int slot)
-            {
-                var accessorStem = SanitizeIdentifier(SortKey);
-                return new MemberShape(
-                    Name,
-                    slot,
-                    SchemaTypeName,
-                    TypeSyntaxName,
-                    IsReference,
-                    IsMany,
-                    TargetSchemaName,
-                    IsName,
-                    IndexAlias,
-                    CanBeNull,
-                    IsName ? $"Access_{accessorStem}_Name" : null,
-                    IndexAlias != null ? $"Access_{accessorStem}_Index" : null);
-            }
-
-            public static MemberShapeSeed From(ISymbol member, ITypeSymbol memberType)
-            {
-                var referenceAttribute = GetAttribute(member, "GameCult.Caching.CultReferenceAttribute");
-                var explicitTarget = referenceAttribute?.ConstructorArguments.Length > 0
-                    ? referenceAttribute.ConstructorArguments[0].Value as INamedTypeSymbol
-                    : null;
-                var many = referenceAttribute?.ConstructorArguments.Length > 1 &&
-                           referenceAttribute.ConstructorArguments[1].Value is bool manyValue &&
-                           manyValue;
-                var targetType = ResolveReferenceTarget(memberType, explicitTarget);
-                var targetSchemaName = targetType == null
-                    ? null
-                    : GetAttribute(targetType, "GameCult.Caching.CultDocumentAttribute")?.ConstructorArguments[0].Value as string;
-                var indexAttribute = GetAttribute(member, "GameCult.Caching.CultIndexAttribute");
-                var indexAlias = indexAttribute == null
-                    ? null
-                    : indexAttribute.ConstructorArguments.Length == 0 || indexAttribute.ConstructorArguments[0].Value is not string alias || string.IsNullOrWhiteSpace(alias)
-                        ? member.Name
-                        : alias;
-
-                return new MemberShapeSeed(
-                    member.Name,
-                    GetSchemaTypeName(memberType),
-                    memberType.ToDisplayString(SymbolDisplayFormat.FullyQualifiedFormat),
-                    GetExplicitSlot(member),
-                    BuildAccessorStem(member),
-                    GetAttribute(member, "GameCult.Caching.CultNameAttribute") != null,
-                    indexAlias,
-                    targetType != null || referenceAttribute != null,
-                    many,
-                    CanBeNull(memberType),
-                    targetSchemaName);
-            }
-
-            private static INamedTypeSymbol? ResolveReferenceTarget(ITypeSymbol memberType, INamedTypeSymbol? explicitTarget)
-            {
-                if (explicitTarget != null)
-                {
-                    return explicitTarget;
-                }
-
-                return memberType is INamedTypeSymbol namedType &&
-                       namedType.IsGenericType &&
-                       namedType.Name == "CultRecordRef" &&
-                       namedType.ContainingNamespace.ToDisplayString() == "GameCult.Caching"
-                    ? namedType.TypeArguments[0] as INamedTypeSymbol
-                    : null;
-            }
-
-            private static string BuildAccessorStem(ISymbol member)
-            {
-                return member.ContainingType == null
-                    ? member.Name
-                    : member.ContainingType.Name + "_" + member.Name;
-            }
-        }
-
-        private sealed class DocumentShape
-        {
-            public DocumentShape(
-                string documentTypeName,
-                string schemaName,
-                string schemaVersion,
-                bool isGlobal,
-                string? nameMember,
-                string? nameAccessorMethodName,
-                ImmutableArray<IndexAccessorShape> indexAccessors,
-                ImmutableArray<MemberShape> members)
-            {
-                DocumentTypeName = documentTypeName;
-                SchemaName = schemaName;
-                SchemaVersion = schemaVersion;
-                IsGlobal = isGlobal;
-                NameMember = nameMember;
-                NameAccessorMethodName = nameAccessorMethodName;
-                var safeStem = SanitizeIdentifier(documentTypeName.Replace("global::", string.Empty).Replace(".", "_"));
-                PayloadSerializerMethodName = $"Serialize_{safeStem}_Payload";
-                PayloadDeserializerMethodName = $"Deserialize_{safeStem}_Payload";
-                IndexAccessors = indexAccessors;
-                Members = members;
-            }
-
-            public string DocumentTypeName { get; }
-            public string SchemaName { get; }
-            public string SchemaVersion { get; }
-            public bool IsGlobal { get; }
-            public string? NameMember { get; }
-            public string? NameAccessorMethodName { get; }
-            public string PayloadSerializerMethodName { get; }
-            public string PayloadDeserializerMethodName { get; }
-            public ImmutableArray<IndexAccessorShape> IndexAccessors { get; }
-            public ImmutableArray<MemberShape> Members { get; }
-        }
-
-        private sealed class IndexAccessorShape
-        {
-            public IndexAccessorShape(string alias, string accessorMethodName)
-            {
-                Alias = alias;
-                AccessorMethodName = accessorMethodName;
-            }
-
-            public string Alias { get; }
-            public string AccessorMethodName { get; }
-        }
-
-        private sealed class MemberShape
-        {
-            public MemberShape(
-                string name,
-                int slot,
-                string schemaTypeName,
-                string typeSyntaxName,
-                bool isReference,
-                bool isMany,
-                string? targetSchemaName,
-                bool isName,
-                string? indexAlias,
-                bool canBeNull,
-                string? accessorMethodName,
-                string? indexAccessorMethodName)
-            {
-                Name = name;
-                Slot = slot;
-                SchemaTypeName = schemaTypeName;
-                TypeSyntaxName = typeSyntaxName;
-                IsReference = isReference;
-                IsMany = isMany;
-                TargetSchemaName = targetSchemaName;
-                IsName = isName;
-                IndexAlias = indexAlias;
-                CanBeNull = canBeNull;
-                AccessorMethodName = accessorMethodName;
-                IndexAccessorMethodName = indexAccessorMethodName;
-            }
-
-            public string Name { get; }
-            public int Slot { get; }
-            public string SchemaTypeName { get; }
-            public string TypeSyntaxName { get; }
-            public bool IsReference { get; }
-            public bool IsMany { get; }
-            public string? TargetSchemaName { get; }
-            public bool IsName { get; }
-            public string? IndexAlias { get; }
-            public bool CanBeNull { get; }
-            public string? AccessorMethodName { get; }
-            public string? IndexAccessorMethodName { get; }
-        }
-    }
-}
diff --git a/src/GameCult.Caching.MessagePack.Generator/GameCult.Caching.MessagePack.Generator.csproj b/src/GameCult.Caching.MessagePack.Generator/GameCult.Caching.MessagePack.Generator.csproj
deleted file mode 100644
index 1a6e372e..00000000
--- a/src/GameCult.Caching.MessagePack.Generator/GameCult.Caching.MessagePack.Generator.csproj
+++ /dev/null
@@ -1,16 +0,0 @@
-<Project Sdk="Microsoft.NET.Sdk">
-
-  <PropertyGroup>
-    <IsRoslynComponent>true</IsRoslynComponent>
-    <Nullable>enable</Nullable>
-    <IsPackable>false</IsPackable>
-    <TargetFramework>netstandard2.0</TargetFramework>
-    <EnforceExtendedAnalyzerRules>true</EnforceExtendedAnalyzerRules>
-  </PropertyGroup>
-
-  <ItemGroup>
-    <PackageReference Include="Microsoft.CodeAnalysis.Analyzers" Version="5.3.0" PrivateAssets="all" />
-    <PackageReference Include="Microsoft.CodeAnalysis.CSharp" Version="5.3.0" PrivateAssets="all" />
-  </ItemGroup>
-
-</Project>
diff --git a/src/GameCult.Caching.MessagePack.Generator/README.md b/src/GameCult.Caching.MessagePack.Generator/README.md
deleted file mode 100644
index 79bfd29a..00000000
--- a/src/GameCult.Caching.MessagePack.Generator/README.md
+++ /dev/null
@@ -1,73 +0,0 @@
-# GameCult.Caching.MessagePack.Generator
-
-`GameCult.Caching.MessagePack.Generator` is a Roslyn incremental source generator that emits MessagePack formatters for concrete `DatabaseEntry` subclasses.
-
-## Scope
-
-This project is infrastructure for the caching stack. Application code usually does not reference it directly.
-
-Its job is to:
-
-- find non-abstract subclasses of `DatabaseEntry`
-- generate concrete `IMessagePackFormatter<T>` implementations
-- generate resolver mappings consumed by `DatabaseEntryResolver`
-
-## What It Generates
-
-For each discovered concrete `DatabaseEntry` subtype, the generator emits:
-
-- a formatter type
-- a resolver mapping entry
-
-Member slot assignment is:
-
-1. `ID` in slot `0`
-2. members with `[Key(...)]` in their exact key slot
-3. remaining non-ignored instance fields and properties appended after the
-   highest occupied slot as legacy convenience
-
-The generated formatter writes a MessagePack array sized to the highest occupied
-slot and writes nil for unused gaps. Deserialization tolerates shorter older
-arrays by leaving missing members at their constructor/field-initializer values,
-and skips unknown extra slots. That makes `[Key(n)]` a durable wire contract:
-deleted fields can leave their slot reserved and new fields can use new keys
-without a store migration.
-
-For schema-stable cache entries, annotate every persisted member. Unkeyed
-members are supported for older code, but they are not a good long-term wire
-contract because source member order is not a schema.
-
-## Example
-
-Given:
-
-```csharp
-[MessagePackObject]
-public class PlayerData : DatabaseEntry, INamedEntry
-{
-    [Key(1)] public string Email = string.Empty;
-    [Key(2)] public string PasswordHash = string.Empty;
-    [Key(3)] public string Username = string.Empty;
-
-    [IgnoreMember]
-    public string EntryName
-    {
-        get => Username;
-        set => Username = value;
-    }
-}
-```
-
-the generator emits the formatter plumbing needed for MessagePack serialization of `PlayerData` without manually implementing an `IMessagePackFormatter<PlayerData>`.
-
-## When You Need To Think About This Package
-
-Usually only when:
-
-- formatter generation is not happening
-- a cache-entry type is not serializing as expected
-- you are debugging build-time source generation behavior
-
-## Distribution
-
-The generator is packaged for consumers through [../GameCult.Caching.MessagePack.Analyzers/README.md](../GameCult.Caching.MessagePack.Analyzers/README.md).
diff --git a/src/GameCult.Caching.MessagePack/CultCacheFormatterResolverAttribute.cs b/src/GameCult.Caching.MessagePack/CultCacheFormatterResolverAttribute.cs
new file mode 100644
index 00000000..038b65f6
--- /dev/null
+++ b/src/GameCult.Caching.MessagePack/CultCacheFormatterResolverAttribute.cs
@@ -0,0 +1,15 @@
+using System;
+
+namespace GameCult.Caching.MessagePack;
+
+// The resolver type exposes a public static Instance of IFormatterResolver or a public parameterless constructor.
+[AttributeUsage(AttributeTargets.Assembly, AllowMultiple = true)]
+public sealed class CultCacheFormatterResolverAttribute : Attribute
+{
+    public CultCacheFormatterResolverAttribute(Type resolverType)
+    {
+        ResolverType = resolverType ?? throw new ArgumentNullException(nameof(resolverType));
+    }
+
+    public Type ResolverType { get; }
+}
diff --git a/src/GameCult.Caching.MessagePack/CultCacheMessagePack.cs b/src/GameCult.Caching.MessagePack/CultCacheMessagePack.cs
index ad2d73a3..e1a68c12 100644
--- a/src/GameCult.Caching.MessagePack/CultCacheMessagePack.cs
+++ b/src/GameCult.Caching.MessagePack/CultCacheMessagePack.cs
@@ -4,65 +4,31 @@ using System.Threading.Tasks;
 
 namespace GameCult.Caching.MessagePack
 {
-    /// <summary>
-    /// Options for opening a CultCache over the canonical single-file MessagePack backing store.
-    /// </summary>
     public sealed class CultCacheOpenOptions
     {
-        /// <summary>
-        /// Gets or sets the document registry to use. When omitted, the shared registry is used.
-        /// </summary>
         public CultDocumentRegistry? Registry { get; set; }
 
-        /// <summary>
-        /// Gets or sets whether the cache should pull the existing snapshot during open.
-        /// </summary>
-        public bool PullOnOpen { get; set; } = true;
+        public bool ReadOnly { get; set; }
 
-        /// <summary>
-        /// Gets or sets whether the cache should flush attached stores when disposed.
-        /// </summary>
         public bool FlushOnDispose { get; set; }
 
-        /// <summary>
-        /// Gets or sets whether the backing store should flush when disposed.
-        /// </summary>
         public bool StoreFlushOnDispose { get; set; }
 
-        /// <summary>
-        /// Gets or sets an optional callback used to customize the cache before opening.
-        /// </summary>
-        public Action<CultCache>? ConfigureCache { get; set; }
-
-        /// <summary>
-        /// Gets or sets an optional callback used to customize the backing store before opening.
-        /// </summary>
-        public Action<SingleFileMessagePackBackingStore>? ConfigureStore { get; set; }
-
-        /// <summary>
-        /// Gets or sets whether the cache should use a paged directory store instead of one whole-file snapshot.
-        /// </summary>
         public bool UseDirectoryStore { get; set; }
-
-        /// <summary>
-        /// Gets or sets the directory used for paged records. When omitted, the store uses the file path plus ".records".
-        /// </summary>
-        public string? DirectoryStorePath { get; set; }
-
-        /// <summary>
-        /// Gets or sets an optional callback used to customize the directory backing store before opening.
-        /// </summary>
-        public Action<DirectoryMessagePackBackingStore>? ConfigureDirectoryStore { get; set; }
     }
 
-    /// <summary>
-    /// Friendly MessagePack entrypoints for opening a CultCache with the canonical backing store.
-    /// </summary>
     public static class CultCacheMessagePack
     {
-        /// <summary>
-        /// Creates a cache with the canonical single-file MessagePack backing store attached.
-        /// </summary>
+        // The inspection model over this codec. Values serialize without the document guard but with their owning document's
+        // options, resolvers included, so dictionary keys compare by the bytes the store writes; clones deserialize as
+        // registered documents.
+        public static CultInspectorModel CreateInspectorModel(CultDocumentRegistry registry) => new CultInspectorModel(
+            registry,
+            (value, type, document) => global::MessagePack.MessagePackSerializer.Serialize(type, value, CultDocumentMessagePackSerialization.OptionsFor(document.Assembly)),
+            (type, bytes) => CultDocumentMessagePackSerialization.DeserializeUntyped(type, bytes, registry));
+
+        // Opening hydrates. A consumer that wants a fresh store removes the records it does not keep, upserts, and
+        // flushes; the atomic replace does the rest.
         public static CultCache Create(string filePath, CultCacheOpenOptions? options = null)
         {
             if (string.IsNullOrWhiteSpace(filePath))
@@ -71,48 +37,22 @@ namespace GameCult.Caching.MessagePack
             }
 
             options ??= new CultCacheOpenOptions();
-
             var cache = new CultCache(options.Registry)
             {
                 FlushAttachedStoresOnDispose = options.FlushOnDispose
             };
-            options.ConfigureCache?.Invoke(cache);
-
-            if (options.UseDirectoryStore || Directory.Exists(options.DirectoryStorePath ?? DirectoryMessagePackBackingStore.DefaultRecordDirectoryPath(filePath)))
-            {
-                var directoryStore = new DirectoryMessagePackBackingStore(filePath, options.DirectoryStorePath)
-                {
-                    FlushOnDispose = options.StoreFlushOnDispose
-                };
-                options.ConfigureDirectoryStore?.Invoke(directoryStore);
-                cache.AddBackingStore(directoryStore);
-            }
-            else
-            {
-                var store = new SingleFileMessagePackBackingStore(filePath)
-                {
-                    FlushOnDispose = options.StoreFlushOnDispose
-                };
-                options.ConfigureStore?.Invoke(store);
-                cache.AddBackingStore(store);
-            }
 
+            CacheBackingStore store = options.UseDirectoryStore || Directory.Exists(DirectoryMessagePackBackingStore.DefaultRecordDirectoryPath(filePath))
+                ? new DirectoryMessagePackBackingStore(filePath, readOnly: options.ReadOnly)
+                : new SingleFileMessagePackBackingStore(filePath, options.ReadOnly);
+            store.FlushOnDispose = options.StoreFlushOnDispose;
+            cache.AddBackingStore(store);
             return cache;
         }
 
-        /// <summary>
-        /// Creates a cache with the canonical single-file MessagePack backing store attached and optionally pulls the on-disk snapshot.
-        /// </summary>
-        public static async Task<CultCache> OpenAsync(string filePath, CultCacheOpenOptions? options = null)
+        public static Task<CultCache> OpenAsync(string filePath, CultCacheOpenOptions? options = null)
         {
-            options ??= new CultCacheOpenOptions();
-            var cache = Create(filePath, options);
-            if (options.PullOnOpen)
-            {
-                await cache.PullAllBackingStoresAsync().ConfigureAwait(false);
-            }
-
-            return cache;
+            return Task.FromResult(Create(filePath, options));
         }
     }
 }
diff --git a/src/GameCult.Caching.MessagePack/CultDocumentMessagePackSerialization.cs b/src/GameCult.Caching.MessagePack/CultDocumentMessagePackSerialization.cs
index 21278fa8..1e99125e 100644
--- a/src/GameCult.Caching.MessagePack/CultDocumentMessagePackSerialization.cs
+++ b/src/GameCult.Caching.MessagePack/CultDocumentMessagePackSerialization.cs
@@ -1,5 +1,8 @@
 using System;
 using System.Buffers;
+using System.Collections.Concurrent;
+using System.Linq;
+using System.Reflection;
 using GameCult.Caching;
 using MessagePack;
 using MessagePack.Formatters;
@@ -7,20 +10,11 @@ using MessagePack.Resolvers;
 
 namespace GameCult.Caching.MessagePack;
 
-/// <summary>
-/// MessagePack resolver for CultCache-specific value types.
-/// </summary>
 public sealed class CultDocumentResolver : IFormatterResolver
 {
-    /// <summary>
-    /// Gets the shared resolver instance.
-    /// </summary>
     public static readonly CultDocumentResolver Instance = new();
     private CultDocumentResolver() { }
 
-    /// <summary>
-    /// Gets a formatter for the requested type, when this resolver owns it.
-    /// </summary>
     public IMessagePackFormatter<T>? GetFormatter<T>()
     {
         var type = typeof(T);
@@ -34,9 +28,6 @@ public sealed class CultDocumentResolver : IFormatterResolver
     }
 }
 
-/// <summary>
-/// MessagePack serialization helpers for CultCache documents and backing stores.
-/// </summary>
 public static class CultDocumentMessagePackSerialization
 {
     private const int PersistedRecordFieldCount = 4;
@@ -44,67 +35,65 @@ public static class CultDocumentMessagePackSerialization
     private const int SchemaCatalogMemberFieldCount = 8;
     private const int StoreSnapshotFieldCount = 3;
 
-    /// <summary>
-    /// Gets the shared MessagePack serializer options for CultCache payloads.
-    /// </summary>
-    public static readonly MessagePackSerializerOptions Options =
-        MessagePackSerializerOptions.Standard
+    public static readonly MessagePackSerializerOptions Options = Compose(Array.Empty<IFormatterResolver>());
+
+    private static readonly ConcurrentDictionary<Assembly, MessagePackSerializerOptions> AssemblyOptions = new();
+
+    public static MessagePackSerializerOptions OptionsFor(Assembly documentAssembly)
+    {
+        if (documentAssembly == null) throw new ArgumentNullException(nameof(documentAssembly));
+        return AssemblyOptions.GetOrAdd(documentAssembly, static assembly =>
+        {
+            var resolvers = assembly.GetCustomAttributes<CultCacheFormatterResolverAttribute>()
+                .Select(attribute => CreateResolver(attribute.ResolverType))
+                .ToArray();
+            return resolvers.Length == 0 ? Options : Compose(resolvers);
+        });
+    }
+
+    private static MessagePackSerializerOptions Compose(IFormatterResolver[] consumerResolvers)
+    {
+        return MessagePackSerializerOptions.Standard
             .WithResolver(CompositeResolver.Create(
-                CultDocumentResolver.Instance,
-                StandardResolver.Instance))
-            .WithSecurity(MessagePackSecurity.UntrustedData);
-
-    /// <summary>
-    /// Serializes a typed value with the CultCache MessagePack options.
-    /// </summary>
-    public static byte[] Serialize<T>(T value)
-    {
-        return MessagePackSerializer.Serialize(value, Options);
+                consumerResolvers.Append(CultDocumentResolver.Instance).Append(StandardResolver.Instance).ToArray()))
+            .WithSecurity(CultMessagePackSecurity.Instance);
     }
 
-    /// <summary>
-    /// Deserializes a typed value with the CultCache MessagePack options.
-    /// </summary>
-    public static T Deserialize<T>(byte[] payload)
+    private static IFormatterResolver CreateResolver(Type resolverType)
     {
-        return MessagePackSerializer.Deserialize<T>(payload, Options);
+        var instance = resolverType.GetField("Instance", BindingFlags.Public | BindingFlags.Static)?.GetValue(null)
+                       ?? resolverType.GetProperty("Instance", BindingFlags.Public | BindingFlags.Static)?.GetValue(null)
+                       ?? (resolverType.GetConstructor(Type.EmptyTypes) != null ? Activator.CreateInstance(resolverType) : null);
+        return instance as IFormatterResolver
+               ?? throw new InvalidOperationException(
+                   $"Formatter resolver {resolverType.FullName} needs a public static Instance or a public parameterless constructor and must implement {nameof(IFormatterResolver)}.");
     }
 
-    /// <summary>
-    /// Serializes a value whose document type is known at runtime.
-    /// </summary>
     public static byte[] SerializeUntyped(object value, Type type)
     {
-        if (value != null)
-        {
-            var descriptor = CultDocumentRegistry.Shared.GetRequired(type);
-            if (descriptor.GeneratedPayloadSerializer != null)
-            {
-                return descriptor.GeneratedPayloadSerializer(value);
-            }
-        }
-
-        return MessagePackSerializer.Serialize(type, value, Options);
+        return SerializeUntyped(value, type, CultDocumentRegistry.Shared);
+    }
+
+    public static byte[] SerializeUntyped(object value, Type type, CultDocumentRegistry registry)
+    {
+        if (registry == null) throw new ArgumentNullException(nameof(registry));
+        if (value != null) registry.GetRequired(type);
+        return MessagePackSerializer.Serialize(type, value, OptionsFor(type.Assembly));
     }
 
-    /// <summary>
-    /// Deserializes a value whose document type is known at runtime.
-    /// </summary>
     public static object DeserializeUntyped(Type type, byte[] payload)
     {
-        var descriptor = CultDocumentRegistry.Shared.GetRequired(type);
-        if (descriptor.GeneratedPayloadDeserializer != null)
-        {
-            return descriptor.GeneratedPayloadDeserializer(payload);
-        }
+        return DeserializeUntyped(type, payload, CultDocumentRegistry.Shared);
+    }
 
-        return MessagePackSerializer.Deserialize(type, payload, Options)
+    public static object DeserializeUntyped(Type type, byte[] payload, CultDocumentRegistry registry)
+    {
+        if (registry == null) throw new ArgumentNullException(nameof(registry));
+        registry.GetRequired(type);
+        return MessagePackSerializer.Deserialize(type, payload, OptionsFor(type.Assembly))
             ?? throw new InvalidOperationException($"MessagePack returned null for Cult document type {type.FullName}.");
     }
 
-    /// <summary>
-    /// Serializes one persisted store record.
-    /// </summary>
     public static byte[] SerializePersistedRecord(CultPersistedRecord record)
     {
         var buffer = new global::System.Buffers.ArrayBufferWriter<byte>();
@@ -114,51 +103,12 @@ public static class CultDocumentMessagePackSerialization
         return buffer.WrittenSpan.ToArray();
     }
 
-    /// <summary>
-    /// Deserializes one persisted store record.
-    /// </summary>
     public static CultPersistedRecord DeserializePersistedRecord(byte[] payload)
     {
         var reader = new MessagePackReader(payload);
         return ReadPersistedRecord(ref reader);
     }
 
-    /// <summary>
-    /// Serializes a schema catalog.
-    /// </summary>
-    public static byte[] SerializeSchemaCatalog(CultSchemaCatalogEntry[] catalog)
-    {
-        var buffer = new global::System.Buffers.ArrayBufferWriter<byte>();
-        var writer = new MessagePackWriter(buffer);
-        writer.WriteArrayHeader(catalog.Length);
-        foreach (var entry in catalog)
-        {
-            WriteSchemaCatalogEntry(ref writer, entry);
-        }
-
-        writer.Flush();
-        return buffer.WrittenSpan.ToArray();
-    }
-
-    /// <summary>
-    /// Deserializes a schema catalog.
-    /// </summary>
-    public static CultSchemaCatalogEntry[] DeserializeSchemaCatalog(byte[] payload)
-    {
-        var reader = new MessagePackReader(payload);
-        var count = reader.ReadArrayHeader();
-        var catalog = new CultSchemaCatalogEntry[count];
-        for (var index = 0; index < count; index++)
-        {
-            catalog[index] = ReadSchemaCatalogEntry(ref reader);
-        }
-
-        return catalog;
-    }
-
-    /// <summary>
-    /// Serializes a complete persisted store snapshot.
-    /// </summary>
     public static byte[] SerializeSnapshot(CultPersistedStoreSnapshot snapshot)
     {
         var buffer = new global::System.Buffers.ArrayBufferWriter<byte>();
@@ -181,9 +131,6 @@ public static class CultDocumentMessagePackSerialization
         return buffer.WrittenSpan.ToArray();
     }
 
-    /// <summary>
-    /// Deserializes a complete persisted store snapshot.
-    /// </summary>
     public static CultPersistedStoreSnapshot DeserializeSnapshot(byte[] payload)
     {
         var reader = new MessagePackReader(payload);
@@ -411,47 +358,29 @@ public static class CultDocumentMessagePackSerialization
     }
 }
 
-/// <summary>
-/// Single-file CultCache backing store that persists snapshots as MessagePack.
-/// </summary>
 public class SingleFileMessagePackBackingStore : SingleFileBackingStore
 {
-    /// <summary>
-    /// Creates a MessagePack single-file backing store.
-    /// </summary>
-    public SingleFileMessagePackBackingStore(string filePath) : base(filePath)
+    public SingleFileMessagePackBackingStore(string filePath, bool readOnly = false) : base(filePath, readOnly)
     {
     }
 
-    /// <summary>
-    /// Serializes a store snapshot.
-    /// </summary>
     protected override byte[] SerializeSnapshot(CultPersistedStoreSnapshot snapshot)
     {
         return CultDocumentMessagePackSerialization.SerializeSnapshot(snapshot);
     }
 
-    /// <summary>
-    /// Deserializes a store snapshot.
-    /// </summary>
     protected override CultPersistedStoreSnapshot DeserializeSnapshot(byte[] data)
     {
         return CultDocumentMessagePackSerialization.DeserializeSnapshot(data);
     }
 
-    /// <summary>
-    /// Serializes one document payload.
-    /// </summary>
     protected override byte[] SerializePayload(object document)
     {
-        return CultDocumentMessagePackSerialization.SerializeUntyped(document, document.GetType());
+        return CultDocumentMessagePackSerialization.SerializeUntyped(document, document.GetType(), Registry);
     }
 
-    /// <summary>
-    /// Deserializes one document payload.
-    /// </summary>
     protected override object DeserializePayload(Type documentType, byte[] payload)
     {
-        return CultDocumentMessagePackSerialization.DeserializeUntyped(documentType, payload);
+        return CultDocumentMessagePackSerialization.DeserializeUntyped(documentType, payload, Registry);
     }
 }
diff --git a/src/GameCult.Caching.MessagePack/CultMessagePackSecurity.cs b/src/GameCult.Caching.MessagePack/CultMessagePackSecurity.cs
new file mode 100644
index 00000000..64b237d5
--- /dev/null
+++ b/src/GameCult.Caching.MessagePack/CultMessagePackSecurity.cs
@@ -0,0 +1,35 @@
+using System;
+using System.Collections.Generic;
+using MessagePack;
+
+namespace GameCult.Caching.MessagePack;
+
+// UntrustedData, plus a collision-resistant comparer for CultRecordRef<T> dictionary keys over the key string.
+public sealed class CultMessagePackSecurity : MessagePackSecurity
+{
+    public static readonly CultMessagePackSecurity Instance = new(UntrustedData);
+
+    private CultMessagePackSecurity(MessagePackSecurity copyFrom) : base(copyFrom) { }
+
+    protected override IEqualityComparer<T> GetHashCollisionResistantEqualityComparer<T>()
+    {
+        var type = typeof(T);
+        if (!type.IsGenericType || type.GetGenericTypeDefinition() != typeof(CultRecordRef<>))
+            return base.GetHashCollisionResistantEqualityComparer<T>();
+        var comparerType = typeof(RecordRefComparer<>).MakeGenericType(type.GetGenericArguments()[0]);
+        return (IEqualityComparer<T>)Activator.CreateInstance(comparerType, GetEqualityComparer<string>())!;
+    }
+
+    protected override MessagePackSecurity Clone() => new CultMessagePackSecurity(this);
+
+    private sealed class RecordRefComparer<TDocument> : IEqualityComparer<CultRecordRef<TDocument>>
+    {
+        private readonly IEqualityComparer<string> _keys;
+
+        public RecordRefComparer(IEqualityComparer<string> keys) => _keys = keys;
+
+        public bool Equals(CultRecordRef<TDocument> x, CultRecordRef<TDocument> y) => _keys.Equals(x.Key.Value, y.Key.Value);
+
+        public int GetHashCode(CultRecordRef<TDocument> value) => _keys.GetHashCode(value.Key.Value);
+    }
+}
diff --git a/src/GameCult.Caching.MessagePack/CultRecordRefFormatter.cs b/src/GameCult.Caching.MessagePack/CultRecordRefFormatter.cs
index 3348c1c3..a5f984fc 100644
--- a/src/GameCult.Caching.MessagePack/CultRecordRefFormatter.cs
+++ b/src/GameCult.Caching.MessagePack/CultRecordRefFormatter.cs
@@ -3,22 +3,13 @@ using MessagePack.Formatters;
 
 namespace GameCult.Caching;
 
-/// <summary>
-/// Serializes typed CultCache record references as their persisted key strings.
-/// </summary>
 public sealed class CultRecordRefFormatter<T> : IMessagePackFormatter<CultRecordRef<T>>
 {
-    /// <summary>
-    /// Writes a typed record reference to MessagePack.
-    /// </summary>
     public void Serialize(ref MessagePackWriter writer, CultRecordRef<T> value, MessagePackSerializerOptions options)
     {
         options.Resolver.GetFormatterWithVerify<string>().Serialize(ref writer, value.Key.Value, options);
     }
 
-    /// <summary>
-    /// Reads a typed record reference from MessagePack.
-    /// </summary>
     public CultRecordRef<T> Deserialize(ref MessagePackReader reader, MessagePackSerializerOptions options)
     {
         var key = options.Resolver.GetFormatterWithVerify<string>().Deserialize(ref reader, options) ?? string.Empty;
diff --git a/src/GameCult.Caching.MessagePack/DirectoryMessagePackBackingStore.cs b/src/GameCult.Caching.MessagePack/DirectoryMessagePackBackingStore.cs
index 991037da..9e185202 100644
--- a/src/GameCult.Caching.MessagePack/DirectoryMessagePackBackingStore.cs
+++ b/src/GameCult.Caching.MessagePack/DirectoryMessagePackBackingStore.cs
@@ -1,27 +1,32 @@
 using System;
 using System.Collections.Concurrent;
 using System.Collections.Generic;
+using System.Diagnostics;
 using System.IO;
 using System.Linq;
+using System.Runtime.ExceptionServices;
 using System.Security.Cryptography;
-using System.Text;
+using System.Threading;
+using System.Threading.Tasks;
+using MessagePack;
 
 namespace GameCult.Caching.MessagePack;
 
-/// <summary>
-/// MessagePack backing store that keeps a small schema manifest hot and stores each record as its own cold file.
-/// </summary>
+// A small hot manifest indexes the store; each record lives in one cold content-addressed page.
 public sealed class DirectoryMessagePackBackingStore : CacheBackingStore
 {
+    private const string IndexedFormatVersion = "cultcache.store.v4.directory-content-addressed-pages";
+    // An unleased load that has not settled after this many attempts throws.
+    private const int UnleasedLoadAttempts = 5;
     private readonly FileInfo _manifestFile;
     private readonly DirectoryInfo _recordDirectory;
     private readonly ConcurrentDictionary<string, bool> _dirtyKeys = new(StringComparer.Ordinal);
     private readonly ConcurrentDictionary<string, bool> _deletedKeys = new(StringComparer.Ordinal);
+    private readonly HashSet<string> _hydratedKeys = new(StringComparer.Ordinal);
+    private CultSchemaCatalogEntry[] _durableCatalog = Array.Empty<CultSchemaCatalogEntry>();
 
-    /// <summary>
-    /// Creates a paged MessagePack backing store.
-    /// </summary>
-    public DirectoryMessagePackBackingStore(string manifestPath, string? recordDirectoryPath = null)
+    public DirectoryMessagePackBackingStore(string manifestPath, string? recordDirectoryPath = null, bool readOnly = false)
+        : base(readOnly)
     {
         if (string.IsNullOrWhiteSpace(manifestPath))
         {
@@ -32,88 +37,222 @@ public sealed class DirectoryMessagePackBackingStore : CacheBackingStore
         _recordDirectory = new DirectoryInfo(recordDirectoryPath ?? DefaultRecordDirectoryPath(manifestPath));
     }
 
-    /// <summary>
-    /// Gets the default record directory path for a manifest path.
-    /// </summary>
     public static string DefaultRecordDirectoryPath(string manifestPath) => manifestPath + ".records";
 
-    /// <inheritdoc />
-    public override void PullAll()
+    // Test seam: runs between an unleased load's manifest read and its page reads.
+    internal Action? UnleasedManifestRead { get; set; }
+
+    public override string ToString() => _manifestFile.FullName;
+
+    public override void PullAll() => Held(PullAllCore);
+
+    private void PullAllCore()
     {
-        if (!_manifestFile.Exists && !_recordDirectory.Exists)
+        var traceStartup = string.Equals(
+            Environment.GetEnvironmentVariable("CULTCACHE_TRACE_STARTUP_PHASES"),
+            "1",
+            StringComparison.Ordinal);
+        var startupPhase = Stopwatch.StartNew();
+        void Trace(string phase)
         {
-            SetLastSchemaMigrationReports(Array.Empty<CultSchemaMigrationReport>());
-            IsDirty = false;
-            return;
+            if (traceStartup)
+                Console.WriteLine($"CultCache directory-pull phase {phase} took {startupPhase.Elapsed.TotalMilliseconds:0.###}ms.");
+            startupPhase.Restart();
         }
 
-        var manifest = ReadManifest();
         var reports = new List<CultSchemaMigrationReport>();
-        foreach (var record in manifest.Records)
+        var loaded = new Dictionary<string, CultStoredDocument>(StringComparer.Ordinal);
+        CultSchemaCatalogEntry[] catalog;
+        for (var attempt = 1; ; attempt++)
         {
-            reports.Add(Registry.ResolvePersistedSchemaReport(record.SchemaId, manifest.SchemaCatalog));
-            var stored = ToStoredDocument(record, manifest.SchemaCatalog, CultDocumentMessagePackSerialization.DeserializeUntyped);
-            Entries[stored.Key.Value] = stored;
-            _dirtyKeys[stored.Key.Value] = true;
-            EntryAdded.OnNext(stored);
+            loaded.Clear();
+            reports.Clear();
+            // Only pages named by the manifest read under the lease are loaded; orphaned pages are never loaded. With no
+            // lock to lease (none created yet, or a store copied without it) a writer may commit mid-load, so an unleased
+            // load stands only if its manifest is still current; if the manifest moved it reloads, under the lease the
+            // writer created. A page that fails under an unmoved manifest is corruption, not a race.
+            using var lease = AcquireCommitLease(wait: true, create: false);
+            var manifestBytes = ReadManifestBytes();
+            var manifest = ParseManifest(manifestBytes);
+            Trace($"manifest records={manifest.Records.Length}");
+            try
+            {
+                if (lease == null)
+                    UnleasedManifestRead?.Invoke();
+                LoadRecordPages(
+                    manifest.Records.OrderBy(record => record.Key, StringComparer.Ordinal).ToArray(),
+                    manifest.SchemaCatalog,
+                    loaded,
+                    reports);
+                if (lease != null || !ManifestMoved(manifestBytes))
+                {
+                    catalog = manifest.SchemaCatalog;
+                    Trace($"indexed-pages loaded={loaded.Count}");
+                    break;
+                }
+            }
+            catch (Exception exception) when (lease == null && IsTornGeneration(exception))
+            {
+                // The re-read stays out of the filter: an exception thrown inside a filter is swallowed as false.
+                if (!ManifestMoved(manifestBytes))
+                    throw;
+                if (attempt == UnleasedLoadAttempts)
+                    throw Unsettled(exception);
+                continue;
+            }
+
+            if (attempt == UnleasedLoadAttempts)
+                throw Unsettled(null);
         }
 
-        if (_recordDirectory.Exists)
-        {
-            foreach (var recordFile in _recordDirectory.EnumerateFiles("*.msgpack").OrderBy(file => file.Name, StringComparer.Ordinal))
-            {
-                var record = CultDocumentMessagePackSerialization.DeserializePersistedRecord(File.ReadAllBytes(recordFile.FullName));
-                reports.Add(Registry.ResolvePersistedSchemaReport(record.SchemaId, manifest.SchemaCatalog));
-                var stored = ToStoredDocument(record, manifest.SchemaCatalog, CultDocumentMessagePackSerialization.DeserializeUntyped);
-                Entries[stored.Key.Value] = stored;
-                EntryAdded.OnNext(stored);
-            }
-        }
+        bool Staged(string key) => _dirtyKeys.ContainsKey(key) || _deletedKeys.ContainsKey(key);
+        var arrived = loaded
+            .Where(pair => !Staged(pair.Key) &&
+                           (!Entries.TryGetValue(pair.Key, out var existing) ||
+                            existing.StoredAt != pair.Value.StoredAt ||
+                            existing.Descriptor.SchemaId != pair.Value.Descriptor.SchemaId))
+            .Select(pair => pair.Value)
+            .ToArray();
+        var departed = _hydratedKeys
+            .Where(key => !loaded.ContainsKey(key) && !Staged(key) && Entries.ContainsKey(key))
+            .Select(key => Entries[key])
+            .ToArray();
+        if (arrived.Length > 0 || departed.Length > 0)
+            Loaded?.Invoke(arrived, departed);
+
+        // Adopted only once the cache admitted the load; a refused load leaves the store's durable view untouched.
+        _durableCatalog = catalog;
+        foreach (var stored in departed)
+            Entries.TryRemove(stored.Key.Value, out _);
+        _hydratedKeys.RemoveWhere(key => !loaded.ContainsKey(key) && !Staged(key));
+        foreach (var stored in arrived)
+            Entries[stored.Key.Value] = stored;
+        foreach (var key in loaded.Keys)
+            _hydratedKeys.Add(key);
 
         SetLastSchemaMigrationReports(reports);
-        if (manifest.Records.Length == 0)
-        {
-            _dirtyKeys.Clear();
-        }
-
-        _deletedKeys.Clear();
-        IsDirty = _dirtyKeys.Count > 0;
+        IsDirty = !_dirtyKeys.IsEmpty || !_deletedKeys.IsEmpty;
+        Trace("publish");
     }
 
-    /// <inheritdoc />
     public override void Push(CultStoredDocument entry)
     {
-        Entries[entry.Key.Value] = entry;
-        _dirtyKeys[entry.Key.Value] = true;
-        _deletedKeys.TryRemove(entry.Key.Value, out _);
-        IsDirty = true;
+        ThrowIfReadOnly();
+        Held(() =>
+        {
+            Entries[entry.Key.Value] = entry;
+            _dirtyKeys[entry.Key.Value] = true;
+            _deletedKeys.TryRemove(entry.Key.Value, out _);
+            IsDirty = true;
+        });
     }
 
-    /// <inheritdoc />
     public override void Delete(CultStoredDocument entry)
     {
-        Entries.TryRemove(entry.Key.Value, out _);
-        _dirtyKeys.TryRemove(entry.Key.Value, out _);
-        _deletedKeys[entry.Key.Value] = true;
-        IsDirty = true;
+        ThrowIfReadOnly();
+        Held(() =>
+        {
+            Entries.TryRemove(entry.Key.Value, out _);
+            _dirtyKeys.TryRemove(entry.Key.Value, out _);
+            _deletedKeys[entry.Key.Value] = true;
+            IsDirty = true;
+        });
     }
 
-    /// <inheritdoc />
-    public override void PushAll(bool soft = false)
+    public override CultCommitOutcome CommitBatch(CultCommitRequest request, bool wait)
     {
-        Directory.CreateDirectory(_manifestFile.DirectoryName!);
-        Directory.CreateDirectory(_recordDirectory.FullName);
-
-        foreach (var key in _deletedKeys.Keys)
+        ThrowIfReadOnly();
+        return Held(() =>
         {
-            var path = RecordPath(key);
-            if (File.Exists(path))
+            Directory.CreateDirectory(_manifestFile.DirectoryName!);
+            using var commitLease = AcquireCommitLease(wait, create: true);
+            if (commitLease == null)
+                return CultCommitOutcome.Contended;
+            var manifest = ReadManifest();
+            if (!request.ConditionsHold(manifest.Records, Entries.Values))
+                return CultCommitOutcome.Mismatch;
+
+            var previousEntries = Entries.ToDictionary(pair => pair.Key, pair => pair.Value, StringComparer.Ordinal);
+            var previousDirtyKeys = _dirtyKeys.Keys.ToArray();
+            var previousDeletedKeys = _deletedKeys.Keys.ToArray();
+            var wasDirty = IsDirty;
+            try
             {
-                File.Delete(path);
+                foreach (var entry in request.Deletes)
+                {
+                    Entries.TryRemove(entry.Key.Value, out _);
+                    _dirtyKeys.TryRemove(entry.Key.Value, out _);
+                    _deletedKeys[entry.Key.Value] = true;
+                }
+                foreach (var entry in request.Upserts)
+                {
+                    Entries[entry.Key.Value] = entry;
+                    _dirtyKeys[entry.Key.Value] = true;
+                    _deletedKeys.TryRemove(entry.Key.Value, out _);
+                }
+                IsDirty = true;
+                WriteGeneration(manifest);
+                return CultCommitOutcome.Committed;
             }
+            catch
+            {
+                Entries.Clear();
+                foreach (var pair in previousEntries)
+                    Entries[pair.Key] = pair.Value;
+                _dirtyKeys.Clear();
+                foreach (var key in previousDirtyKeys)
+                    _dirtyKeys[key] = true;
+                _deletedKeys.Clear();
+                foreach (var key in previousDeletedKeys)
+                    _deletedKeys[key] = true;
+                IsDirty = wasDirty;
+                throw;
+            }
+        });
+    }
+
+    public override void PushAll()
+    {
+        ThrowIfReadOnly();
+        Held(() =>
+        {
+            if (!IsDirty)
+                return;
+
+            Directory.CreateDirectory(_manifestFile.DirectoryName!);
+            using var commitLease = AcquireCommitLease(wait: true, create: true);
+            WriteGeneration(ReadManifest());
+        });
+    }
+
+    // Runs under the commit lease: pages first, then the manifest that names them.
+    private void WriteGeneration(CultPersistedStoreSnapshot currentManifest)
+    {
+        Directory.CreateDirectory(_recordDirectory.FullName);
+        var currentIndex = currentManifest.Records.ToDictionary(record => record.Key, record => record, StringComparer.Ordinal);
+        foreach (var key in _deletedKeys.Keys)
+            currentIndex.Remove(key);
+        foreach (var key in _dirtyKeys.Keys)
+        {
+            if (Entries.TryGetValue(key, out var stored))
+                currentIndex[key] = ToIndexRecord(stored);
         }
 
-        foreach (var key in _dirtyKeys.Keys.OrderBy(value => value, StringComparer.Ordinal))
+        var catalogCandidates = currentManifest.SchemaCatalog
+            .Concat(_durableCatalog)
+            .Concat(Entries.Values.Select(entry => entry.Descriptor.ToCatalogEntry()))
+            .GroupBy(entry => entry.SchemaId, StringComparer.Ordinal)
+            .Select(group => group.Last())
+            .ToArray();
+        var usedSchemaIds = currentIndex.Values.Select(record => record.SchemaId).ToHashSet(StringComparer.Ordinal);
+        var targetCatalog = catalogCandidates
+            .Where(entry => usedSchemaIds.Contains(entry.SchemaId))
+            .OrderBy(entry => entry.SchemaName, StringComparer.Ordinal)
+            .ToArray();
+        var keysToWrite = _dirtyKeys.Keys
+            .OrderBy(value => value, StringComparer.Ordinal)
+            .ToArray();
+        foreach (var key in keysToWrite)
         {
             if (!Entries.TryGetValue(key, out var stored))
             {
@@ -121,59 +260,238 @@ public sealed class DirectoryMessagePackBackingStore : CacheBackingStore
             }
 
             var record = ToPersistedRecord(stored, document =>
-                CultDocumentMessagePackSerialization.SerializeUntyped(document, stored.Descriptor.DocumentType));
-            WriteFileAtomically(RecordPath(key), CultDocumentMessagePackSerialization.SerializePersistedRecord(record));
+                CultDocumentMessagePackSerialization.SerializeUntyped(
+                    document,
+                    stored.Descriptor.DocumentType,
+                    Registry));
+            var pagePayload = CultDocumentMessagePackSerialization.SerializePersistedRecord(record);
+            var indexRecord = ToContentAddressedIndexRecord(record, pagePayload);
+            currentIndex[key] = indexRecord;
+            WriteFileAtomically(
+                ContentAddressedRecordPath(indexRecord),
+                pagePayload);
         }
 
-        var manifest = new CultPersistedStoreSnapshot
-        {
-            FormatVersion = "cultcache.store.v1.directory",
-            SchemaCatalog = Entries.Values
-                .Select(entry => entry.Descriptor.ToCatalogEntry())
-                .GroupBy(entry => entry.SchemaId, StringComparer.Ordinal)
-                .Select(group => group.First())
-                .OrderBy(entry => entry.SchemaName, StringComparer.Ordinal)
-                .ToArray(),
-            Records = Array.Empty<CultPersistedRecord>()
-        };
-        WriteFileAtomically(_manifestFile.FullName, CultDocumentMessagePackSerialization.SerializeSnapshot(manifest));
+        WriteManifest(targetCatalog, currentIndex.Values
+            .OrderBy(record => record.Key, StringComparer.Ordinal)
+            .ToArray());
 
+        DeleteUnreferencedRecordPages(currentIndex.Values);
+
+        _durableCatalog = targetCatalog;
         _dirtyKeys.Clear();
         _deletedKeys.Clear();
         MarkFlushSucceeded();
     }
 
-    private CultPersistedStoreSnapshot ReadManifest()
+    private void WriteManifest(CultSchemaCatalogEntry[] catalog, CultPersistedRecord[] index)
     {
-        if (_manifestFile.Exists)
+        var manifest = new CultPersistedStoreSnapshot
         {
-            var snapshot = CultDocumentMessagePackSerialization.DeserializeSnapshot(File.ReadAllBytes(_manifestFile.FullName));
-            if (snapshot.SchemaCatalog.Length > 0 || snapshot.Records.Length == 0)
+            FormatVersion = IndexedFormatVersion,
+            SchemaCatalog = catalog,
+            Records = index
+        };
+        WriteFileAtomically(_manifestFile.FullName, CultDocumentMessagePackSerialization.SerializeSnapshot(manifest));
+    }
+
+    private void LoadRecordPages(
+        CultPersistedRecord[] records,
+        IReadOnlyCollection<CultSchemaCatalogEntry> catalogEntries,
+        Dictionary<string, CultStoredDocument> loaded,
+        List<CultSchemaMigrationReport> reports)
+    {
+        var tracePages = string.Equals(
+            Environment.GetEnvironmentVariable("CULTCACHE_TRACE_STARTUP_PHASES"),
+            "1",
+            StringComparison.Ordinal);
+        var recordReports = new CultSchemaMigrationReport[records.Length];
+        var storedRecords = new CultStoredDocument?[records.Length];
+        var pageBytes = tracePages ? new long[records.Length] : Array.Empty<long>();
+        var pageElapsedTicks = tracePages ? new long[records.Length] : Array.Empty<long>();
+        try
+        {
+            ReadPages();
+        }
+        catch (AggregateException aggregate)
+        {
+            // The page's own failure propagates, not Parallel.For's wrapper.
+            ExceptionDispatchInfo.Capture(aggregate.Flatten().InnerExceptions[0]).Throw();
+        }
+
+        void ReadPages() => Parallel.For(
+            0,
+            records.Length,
+            new ParallelOptions { MaxDegreeOfParallelism = Math.Min(Environment.ProcessorCount, 8) },
+            index =>
             {
-                return snapshot;
+                var started = tracePages ? Stopwatch.GetTimestamp() : 0L;
+                var metadata = records[index];
+                var record = ReadPersistedRecordPage(metadata, out var pagePayload);
+                recordReports[index] = Registry.ResolvePersistedSchemaReport(record.SchemaId, catalogEntries);
+                storedRecords[index] = ToStoredDocument(
+                    record,
+                    catalogEntries,
+                    (type, payload) => CultDocumentMessagePackSerialization.DeserializeUntyped(type, payload, Registry));
+                if (tracePages)
+                {
+                    pageBytes[index] = pagePayload.LongLength;
+                    pageElapsedTicks[index] = Stopwatch.GetTimestamp() - started;
+                }
+            });
+
+        if (tracePages)
+        {
+            var schemaNames = catalogEntries.ToDictionary(entry => entry.SchemaId, entry => entry.SchemaName, StringComparer.Ordinal);
+            foreach (var group in records
+                         .Select((record, index) => new { record.SchemaId, Index = index })
+                         .Where(item => pageElapsedTicks[item.Index] > 0)
+                         .GroupBy(item => item.SchemaId, StringComparer.Ordinal)
+                         .Select(group => new
+                         {
+                             SchemaId = group.Key,
+                             Count = group.Count(),
+                             Bytes = group.Sum(item => pageBytes[item.Index]),
+                             TotalMs = group.Sum(item => pageElapsedTicks[item.Index]) * 1000d / Stopwatch.Frequency,
+                             MaxMs = group.Max(item => pageElapsedTicks[item.Index]) * 1000d / Stopwatch.Frequency
+                         })
+                         .OrderByDescending(group => group.TotalMs)
+                         .Take(10))
+            {
+                var schemaName = schemaNames.TryGetValue(group.SchemaId, out var name) ? name : group.SchemaId;
+                Console.WriteLine(
+                    $"CultCache directory-page schema={schemaName} count={group.Count} bytes={group.Bytes} " +
+                    $"cumulative={group.TotalMs:0.###}ms max={group.MaxMs:0.###}ms.");
             }
         }
 
-        if (_manifestFile.Exists)
+        for (var index = 0; index < storedRecords.Length; index++)
         {
-            return CultDocumentMessagePackSerialization.DeserializeSnapshot(File.ReadAllBytes(_manifestFile.FullName));
+            var stored = storedRecords[index];
+            if (stored == null)
+                continue;
+            reports.Add(recordReports[index]);
+            loaded[stored.Key.Value] = stored;
         }
-
-        return new CultPersistedStoreSnapshot
-        {
-            FormatVersion = "cultcache.store.v1.directory",
-            SchemaCatalog = Array.Empty<CultSchemaCatalogEntry>(),
-            Records = Array.Empty<CultPersistedRecord>()
-        };
     }
 
-    private string RecordPath(string key) => Path.Combine(_recordDirectory.FullName, $"{HashKey(key)}.msgpack");
+    private static CultPersistedRecord ToIndexRecord(CultStoredDocument stored) => new()
+    {
+        Key = stored.Key.Value,
+        SchemaId = stored.Descriptor.SchemaId,
+        StoredAt = stored.StoredAt,
+        Payload = Array.Empty<byte>()
+    };
 
-    private static string HashKey(string key)
+    private static CultPersistedRecord ToContentAddressedIndexRecord(
+        CultPersistedRecord record,
+        byte[] pagePayload) => new()
+    {
+        Key = record.Key,
+        SchemaId = record.SchemaId,
+        StoredAt = record.StoredAt,
+        Payload = HashPayload(pagePayload)
+    };
+
+    private CultPersistedStoreSnapshot ReadManifest() => ParseManifest(ReadManifestBytes());
+
+    private byte[]? ReadManifestBytes() => File.Exists(_manifestFile.FullName) ? ReadAllBytesShared(_manifestFile.FullName) : null;
+
+    // A manifest that cannot be re-read (a writer mid-replace) has moved.
+    private bool ManifestMoved(byte[]? read)
+    {
+        try
+        {
+            var current = ReadManifestBytes();
+            return read == null ? current != null : current == null || !read.SequenceEqual(current);
+        }
+        catch (Exception)
+        {
+            return true;
+        }
+    }
+
+    // A page the manifest named that vanished or was replaced. It is a writer committing mid-load only when the manifest
+    // moved too; under an unchanged manifest the same failure is corruption and is thrown as it is.
+    private static bool IsTornGeneration(Exception exception) =>
+        exception is InvalidDataException or FileNotFoundException or DirectoryNotFoundException;
+
+    private InvalidOperationException Unsettled(Exception? last) => new(
+        $"Directory store {_manifestFile.FullName} changed under every one of {UnleasedLoadAttempts} unlocked loads; it did not settle.", last);
+
+    // A missing manifest is an empty store. An existing manifest in any other format is refused.
+    private CultPersistedStoreSnapshot ParseManifest(byte[]? manifestBytes)
+    {
+        if (manifestBytes == null)
+        {
+            return new CultPersistedStoreSnapshot
+            {
+                FormatVersion = IndexedFormatVersion,
+                SchemaCatalog = Array.Empty<CultSchemaCatalogEntry>(),
+                Records = Array.Empty<CultPersistedRecord>()
+            };
+        }
+
+        var snapshot = CultDocumentMessagePackSerialization.DeserializeSnapshot(manifestBytes);
+        if (!string.Equals(snapshot.FormatVersion, IndexedFormatVersion, StringComparison.Ordinal))
+        {
+            throw new InvalidOperationException(
+                $"Directory store {_manifestFile.FullName} is {snapshot.FormatVersion}; only {IndexedFormatVersion} is readable.");
+        }
+
+        return snapshot;
+    }
+
+    private string ContentAddressedRecordPath(CultPersistedRecord metadata)
+    {
+        if (metadata.Payload == null || metadata.Payload.Length != 32)
+            throw new InvalidDataException($"Record '{metadata.Key}' has no committed SHA-256 page identity.");
+        var hash = BitConverter.ToString(metadata.Payload).Replace("-", string.Empty).ToLowerInvariant();
+        return Path.Combine(_recordDirectory.FullName, $"{hash}.msgpack");
+    }
+
+    private static byte[] HashPayload(byte[] payload)
     {
         using var sha256 = SHA256.Create();
-        var hash = sha256.ComputeHash(Encoding.UTF8.GetBytes(key));
-        return BitConverter.ToString(hash).Replace("-", string.Empty).ToLowerInvariant();
+        return sha256.ComputeHash(payload);
+    }
+
+    private void DeleteUnreferencedRecordPages(IEnumerable<CultPersistedRecord> durableRecords)
+    {
+        var referenced = durableRecords
+            .Select(ContentAddressedRecordPath)
+            .ToHashSet(StringComparer.OrdinalIgnoreCase);
+        foreach (var file in _recordDirectory.EnumerateFiles("*.msgpack"))
+        {
+            if (referenced.Contains(file.FullName))
+                continue;
+            try
+            {
+                File.Delete(file.FullName);
+            }
+            catch (IOException)
+            {
+                // An orphan is harmless: no committed manifest references it.
+            }
+            catch (UnauthorizedAccessException)
+            {
+                // Cleanup is best effort and never changes the committed generation.
+            }
+        }
+    }
+
+    private CultPersistedRecord ReadPersistedRecordPage(CultPersistedRecord metadata, out byte[] pagePayload)
+    {
+        var path = ContentAddressedRecordPath(metadata);
+        if (!File.Exists(path))
+            throw new InvalidDataException($"Committed record page '{path}' is missing from the selected manifest generation.");
+        pagePayload = ReadAllBytesShared(path);
+        if (!HashPayload(pagePayload).SequenceEqual(metadata.Payload))
+            throw new InvalidDataException($"Record page '{path}' does not match its committed content hash.");
+        var record = CultDocumentMessagePackSerialization.DeserializePersistedRecord(pagePayload);
+        if (!string.Equals(record.Key, metadata.Key, StringComparison.Ordinal))
+            throw new InvalidDataException($"Record page '{path}' contains key '{record.Key}', expected '{metadata.Key}'.");
+        return record;
     }
 
     private static void WriteFileAtomically(string path, byte[] payload)
@@ -198,7 +516,7 @@ public sealed class DirectoryMessagePackBackingStore : CacheBackingStore
 
             if (File.Exists(path))
             {
-                File.Replace(tempPath, path, null);
+                ReplaceExistingFile(tempPath, path);
             }
             else
             {
@@ -213,4 +531,74 @@ public sealed class DirectoryMessagePackBackingStore : CacheBackingStore
             }
         }
     }
+
+    private static byte[] ReadAllBytesShared(string path)
+    {
+        using var stream = new FileStream(path, FileMode.Open, FileAccess.Read, FileShare.ReadWrite | FileShare.Delete);
+        using var buffer = new MemoryStream();
+        stream.CopyTo(buffer);
+        return buffer.ToArray();
+    }
+
+    // Only a writer creates the records folder and the lock, so opening the store creates nothing. A reader opens an
+    // existing lock and returns null when there is none; that does not mean no writer committed (a store may be copied
+    // without its lock, and a first writer may create it mid-load), so an unleased load checks that it settled.
+    private FileStream? AcquireCommitLease(bool wait, bool create)
+    {
+        if (create)
+            Directory.CreateDirectory(_recordDirectory.FullName);
+        var lockPath = Path.Combine(_recordDirectory.FullName, ".commit.lock");
+        var started = Stopwatch.StartNew();
+        while (true)
+        {
+            try
+            {
+                return new FileStream(
+                    lockPath,
+                    create ? FileMode.OpenOrCreate : FileMode.Open,
+                    FileAccess.ReadWrite,
+                    FileShare.None,
+                    bufferSize: 1,
+                    FileOptions.WriteThrough);
+            }
+            catch (FileNotFoundException) when (!create)
+            {
+                return null;
+            }
+            catch (DirectoryNotFoundException) when (!create)
+            {
+                return null;
+            }
+            catch (IOException) when (!wait)
+            {
+                return null;
+            }
+            catch (IOException) when (started.Elapsed < TimeSpan.FromSeconds(30))
+            {
+                Thread.Sleep(10);
+            }
+        }
+    }
+
+    private static void ReplaceExistingFile(string sourcePath, string destinationPath)
+    {
+        for (var attempt = 0; attempt < 3; attempt++)
+        {
+            try
+            {
+                File.Replace(sourcePath, destinationPath, null);
+                return;
+            }
+            catch (IOException) when (attempt < 2)
+            {
+                Thread.Sleep(10 * (attempt + 1));
+            }
+            catch (UnauthorizedAccessException) when (attempt < 2)
+            {
+                Thread.Sleep(10 * (attempt + 1));
+            }
+        }
+
+        File.Replace(sourcePath, destinationPath, null);
+    }
 }
diff --git a/src/GameCult.Caching.MessagePack/GameCult.Caching.MessagePack.csproj b/src/GameCult.Caching.MessagePack/GameCult.Caching.MessagePack.csproj
index 71fcc969..c2bd1c1b 100644
--- a/src/GameCult.Caching.MessagePack/GameCult.Caching.MessagePack.csproj
+++ b/src/GameCult.Caching.MessagePack/GameCult.Caching.MessagePack.csproj
@@ -1,13 +1,13 @@
 <Project Sdk="Microsoft.NET.Sdk">
   <PropertyGroup>
     <Description>File-based MessagePack backing store for CultCache</Description>
+    <NoWarn>$(NoWarn);CS1591</NoWarn>
   </PropertyGroup>
   
   <ItemGroup>
     <ProjectReference Include="..\GameCult.Caching\GameCult.Caching.csproj" />
-    <!-- Bring in analyzers project so its DLL is packed alongside -->
-    <ProjectReference Include="..\GameCult.Caching.MessagePack.Analyzers\GameCult.Caching.MessagePack.Analyzers.csproj"
-                      PrivateAssets="none" />
     <PackageReference Include="MessagePack" Version="3.1.7" />
+    <PackageReference Include="MessagePackAnalyzer" Version="3.1.7" PrivateAssets="all" />
+    <InternalsVisibleTo Include="GameCult.Caching.Tests" />
   </ItemGroup>
 </Project>
diff --git a/src/GameCult.Caching.MessagePack/README.md b/src/GameCult.Caching.MessagePack/README.md
index 660da700..c69ab887 100644
--- a/src/GameCult.Caching.MessagePack/README.md
+++ b/src/GameCult.Caching.MessagePack/README.md
@@ -10,16 +10,16 @@ format for the attribute-first `GameCult.Caching` stack.
 - `CultDocumentResolver`
 - `CultRecordRefFormatter<T>`
 
-When a project declares `[CultDocument]` models, wire in the
-`GameCult.Caching.MessagePack.Generator` analyzer there as well. It emits
-assembly-local metadata providers for the cache registry. Cult documents then
-serialize through explicit generated slot codecs, while the store snapshot
-format is written by hand against `MessagePackWriter`/`MessagePackReader`.
+Cult document payloads serialize through `MessagePackSerializer` with the
+options of the document's assembly (`CultDocumentMessagePackSerialization.OptionsFor`),
+after the reflective `CultDocumentRegistry` has accepted the document shape. The
+store snapshot format is written by hand against
+`MessagePackWriter`/`MessagePackReader`.
 
 ## What It Does
 
 - stores whole CultCache snapshots in MessagePack
-- serializes plain attributed document payloads through explicit generated slot codecs
+- serializes attributed document payloads as MessagePack `[Key(n)]` arrays
 - keeps explicit `CultRecordRef<T>` values compact on disk/wire
 - preserves the cache/store split where metadata lives outside the domain model
 
@@ -54,7 +54,5 @@ await cache.PullAllBackingStoresAsync();
 
 - Payload bytes are MessagePack. Store metadata and schema catalogs are also
   persisted through hand-written MessagePack array layouts in this package.
-- The generator package now targets attributed document types instead of
-  `DatabaseEntry` subclasses.
 - The raw CultNet document lane should treat these payload bytes as already
   blessed, not decode and re-encode them for sport.
diff --git a/src/GameCult.Caching/Contracts/cultcache-persistence-format.md b/src/GameCult.Caching/Contracts/cultcache-persistence-format.md
index 66d0e135..e8231c10 100644
--- a/src/GameCult.Caching/Contracts/cultcache-persistence-format.md
+++ b/src/GameCult.Caching/Contracts/cultcache-persistence-format.md
@@ -39,6 +39,36 @@ These are **not** domain fields and should not be exposed on app-facing types:
 
 Those belong to the CultCache persistence layer.
 
+## Transaction Visibility
+
+A multi-record commit is an explicit batch of records that resolve to one home
+store. The store commits the batch as one durable step. Nothing in the batch is
+visible, to the committing flow or to observers, until the store has accepted
+it; a failed commit changes nothing on disk or in memory.
+
+A batch may carry conditions: per-record `(schemaId, storedAt)` identity, or
+the whole store unchanged since it was last loaded. Conditions are evaluated
+under the store's exclusive lock against what is durably on disk. A failed
+condition is a lost race, not an error: the commit reports it and writes
+nothing.
+
+**Conditional commit is the only safe multi-process write.** A plain flush and
+an unconditional commit are last-writer-wins and write the same bytes: a single
+file is replaced by the writer's whole view, a directory manifest takes the
+writer's staged keys over the current manifest. An unconditional commit also
+persists writes staged earlier and leaves the store clean. Processes sharing a
+store must all use conditional commit.
+
+A store that fails to hydrate on open (corrupt bytes, unresolvable schema)
+makes the open throw and is left byte-identical; it is never silently
+overwritten. Within one process the lock order is the cache's gate, then the
+store's file lock; a store's I/O blocks its cache's readers.
+
+C# implements batch and conditional commit (`CultCache.Commit`, `TryCommit`,
+`CultCacheBatch`). Rust implements both. TypeScript and Python implement
+neither yet. Routing, batches and conditions are specified in
+`cultcache-store-composition.md`.
+
 ## Canonical Store Shape
 
 A persisted CultCache file should contain:
@@ -335,12 +365,14 @@ The v1 concurrent single-file policy is:
    lock.
 2. Writers take an exclusive sidecar lock derived from the `.cc` path.
 3. Writers re-read the current snapshot after taking the lock.
-4. Writers merge or reject local staged changes against the latest generation.
+4. Writers using conditional commit evaluate their conditions against the
+   latest snapshot and write nothing if one fails. A plain flush and an
+   unconditional commit compare nothing and are last-writer-wins.
 5. Writers write a temp file, flush it, atomically replace the `.cc` file, and
    release the lock.
 
-This preserves the key invariant: every reader sees a complete snapshot, and no
-writer commits over unseen data without passing through the merge/reject point.
+This preserves the key invariant: every reader sees a complete snapshot. Only a
+conditional commit is protected against committing over unseen data.
 
 ## Live Change Observation
 
diff --git a/src/GameCult.Caching/Contracts/cultcache-schema-compatibility.md b/src/GameCult.Caching/Contracts/cultcache-schema-compatibility.md
index 26e9e205..297c3184 100644
--- a/src/GameCult.Caching/Contracts/cultcache-schema-compatibility.md
+++ b/src/GameCult.Caching/Contracts/cultcache-schema-compatibility.md
@@ -26,6 +26,53 @@ The canonical fixtures currently exercised in C# are:
 See `GameCult.Caching.Tests/BackingStoreTests.cs` for the canonical fixture
 documents and the expected receipts.
 
+## Slots
+
+A member's slot is its MessagePack `[Key(n)]` integer. MessagePack's `[Key]` and
+`[IgnoreMember]` are the single slot authority, so `GameCult.Caching` depends on
+`MessagePack.Annotations`. Payloads are written by `MessagePackSerializer`, so
+the registry refuses a document type without `[MessagePackObject]` and a
+non-public document type without `[MessagePackObject(AllowPrivate = true)]`.
+A member's type name is the CLR full name; a nested type is written `Outer+Inner`.
+The registry also refuses a public member without `[Key]` or `[IgnoreMember]`
+(get-only properties included; MessagePack throws on them), a string `[Key]`,
+two members sharing a slot (including `new`-hidden members), a hidden persisted
+member, and an override whose `[Key]` or `[IgnoreMember]` differs from its base
+declaration's (MessagePack reads the base declaration).
+
+Visibility follows MessagePack's rule: the registry accepts what MessagePack
+round-trips and refuses what it would silently lose. The registry persists
+every keyed public field and property, get-only ones included, because
+MessagePack writes them all. A `[Key]` on a non-public member without
+`AllowPrivate` is refused because MessagePack skips that member. With
+`AllowPrivate`, MessagePack also reads non-public members, so every non-public
+instance field or property must be `[IgnoreMember]`.
+
+A class needs a constructor MessagePack can call: the `[SerializationConstructor]`
+if one is marked, otherwise the longest constructor (public unless
+`AllowPrivate`) whose every parameter takes the keyed member at its position
+(`[Key(0)]`, `[Key(1)]`, ...). A parameterless constructor always qualifies; a
+primary constructor usually does not. MessagePack reads a member back through
+its setter, or through that constructor when the member's slot is below the
+constructor's parameter count. A setter counts when it is public, or any setter
+(private, internal, init-only) under `AllowPrivate`; a readonly field counts as
+writable under `AllowPrivate` only. A keyed member MessagePack cannot read back
+either way is refused: a get-only property, a readonly field without
+`AllowPrivate`, or a property whose setter is non-public without
+`AllowPrivate`, when the constructor does not fill it.
+
+## Which schema a record carries
+
+A record is written under the schema of its runtime type. Writing a derived
+document through a base-typed handle or generic parameter (`UpsertAsync<Gear>`
+with a `Weapon`) persists the `Weapon` schema, and the record reloads as a
+`Weapon`. A runtime type without `[CultDocument]` is refused.
+
+Typed lookups and watches (`Get<T>`, `GetAll<T>`, `GetByName<T>`,
+`GetByIndex<T>`, `GetGlobal<T>`, `Watch<T>`) match every record whose runtime
+type is assignable to `T`. A single-result lookup with several candidates
+throws.
+
 ## Soft-migratable drift
 
 CultCache accepts compatible drift only when the local reader can still map the
diff --git a/src/GameCult.Caching/Contracts/cultcache-store-composition.md b/src/GameCult.Caching/Contracts/cultcache-store-composition.md
new file mode 100644
index 00000000..8c4fc529
--- /dev/null
+++ b/src/GameCult.Caching/Contracts/cultcache-store-composition.md
@@ -0,0 +1,273 @@
+# CultCache Store Composition
+
+How one cache composes its backing stores: where a record lives, when a store
+is read or written, what a global is, how a multi-record commit lands, and who
+owns serialization options. `GameCult.Caching` in C# is the reference; the
+runtime table at the end says which runtime implements what.
+
+None of this changes bytes on disk. Every store file is a complete
+`cultcache.store.v1` snapshot (single file) or a v4 directory manifest, exactly
+as `cultcache-persistence-format.md` describes. No file records which cache or
+which route wrote it.
+
+## One home store per document type
+
+- A document type has exactly one home store. A cache attaches stores with an
+  optional list of home types: `AddBackingStore(store, params Type[] homes)`.
+- The home of a document is chosen from its **runtime type**
+  (`document.GetType()`), never from a generic type parameter at the call site.
+  Among routed stores whose home types are assignable from the runtime type, the
+  most derived home type wins; otherwise the untyped store; otherwise none.
+- C# routes by assignable CLR type. TypeScript, Rust and Python route by the
+  exact type string they already use.
+- A second untyped store is a registration error. A home type already claimed by
+  another store, by exact type equality, is a registration error. Routes to a
+  base type and a derived type may coexist; the most derived wins.
+- A write whose document has no home, once any store is attached, is an error.
+  A cache with zero stores is an in-memory cache and needs no home.
+- Nothing is mirrored or replicated. A write touches exactly one store.
+- This is the contract in every runtime. A runtime that still mirrors is
+  non-conforming until it deletes its mirrors.
+
+## Attachment is hydration
+
+- Attaching a store reads it. There is no interval in which a store is attached
+  but unread, and no push of existing records into a newly attached store.
+- A store must be clean (`IsDirty` false) when attached.
+- A record's home cannot change after it is admitted. Attaching a store that
+  would move the home of a record already in the cache is an error. The
+  consequence is the attach order: routed stores first, the untyped store last.
+- A record loaded from a store that is not its home is refused at load, naming
+  the key and both stores.
+- Pulling again after attach is a re-pull. It does not erase mutations staged in
+  a dirty store. A dirty single-file store skips the re-pull entirely; a missing
+  single file keeps staged writes dirty and does not drop loaded records.
+- A load publishes changes to `Watch` subscribers and fires `OnUpdate`. A local
+  write or commit publishes to `Watch` only; `OnUpdate` fires for loads alone.
+- Changes published through `Watch`/`WatchRecord` carry a `Sequence`: a
+  per-cache, in-memory number assigned when the cache admits the change, under
+  its gate. It increases in admission order and is not persisted.
+  `OnUpdate(previous, current)` carries none. Streams CultNet derives from
+  `OnUpdate` (`CultNetDatabase.WatchAllChanges`, the subscription server,
+  database-backed Mesh handles) have no ordering guarantee and no stale
+  protection.
+- `GetWithSequence(key)` returns the document and the cache's current
+  `Sequence`, read together under the gate: every change with a `Sequence` at
+  or below it is reflected in the document.
+- Adding the optional `sequence` constructor argument to
+  `CultCacheDocumentChange<T>` changed its binary signature; no external
+  constructor is known.
+- Observers and `OnUpdate` run after the cache releases its gate, never under
+  it: an observer may read or write the cache from any thread. Each call
+  publishes exactly its own changes, on its own thread, after releasing the gate
+  and before it returns; no call publishes another call's changes or waits on
+  another call's delivery. A write made by an observer is its own call and
+  publishes its own changes before that write returns. A direct `PullAll` on an
+  attached store is such a call.
+- Cross-thread delivery order is not guaranteed. A consumer that keeps a latest
+  value per record ignores a change whose `Sequence` is not above the one it
+  already applied for that record. It subscribes first, then takes
+  `GetWithSequence` and adopts that `Sequence` as applied; a change delivered
+  after subscribing with a `Sequence` at or below the read is already in the
+  document and is dropped. CultMesh cache-record mirrors (`ObserveAsync`,
+  `ReactiveAsync`, and `RefreshAsync` on both) do this.
+- Not stale-protected: schema-alias handles (`AsSchemaAlias`) get no
+  `Sequence`; removals do not advance a mirror's applied `Sequence`, and the
+  mirrors do not surface removals.
+- An `OnUpdate` handler exception is rethrown to that caller after all of that
+  call's changes are delivered (an `AggregateException` if several threw). If
+  the call itself failed, its own exception is rethrown and handler exceptions
+  are dropped. A `Watch` subscriber exception is not rethrown; it follows R3's
+  unhandled-exception handling. A throwing handler cannot undo the store's
+  adoption of a load; the store and cache already agree when publication starts.
+- Pulling all stores pulls every attached store even if a handler throws during
+  one store's load, then rethrows.
+- Hydration failure on open is loud: a corrupt store file, or a record whose
+  schema the registry cannot resolve, makes the open throw and leaves the file
+  byte-identical. Consumers never delete and rewrite a store they failed to
+  open.
+
+## Locking
+
+- One lock order: the cache's gate, then the store's lock. A store attached to a
+  cache takes that cache's gate as its own lock, so a store's load callback into
+  the cache cannot take the two out of order. A store must not call `Loaded`
+  while holding its own lock outside the cache's hold.
+- A thread holds one cache's gate at a time: entering a cache's hold inside
+  another cache's hold throws.
+- A store doing I/O on behalf of its cache (pull, flush, commit) holds the gate,
+  so that cache's readers wait for the I/O. The file lock (`<path>.lock` or the
+  directory commit lease) is always taken inside the gate and released before a
+  load is handed to the cache.
+- Direct calls on an attached store (`Push`, `Delete`, `PushAll`, `CommitBatch`,
+  `PullAll`) take the same gate, so they wait for that cache's pull, flush or
+  commit, and the cache's flush on dispose runs under it.
+- In every runtime, a store call must not wait for a write to its own cache to
+  finish: that write queues behind the operation that is waiting for it, a
+  cycle. A handler or subscriber that writes back without the store waiting for
+  it is fine; its write queues and lands after the operation. Python refuses a
+  mutation started on a thread already inside one of that cache's mutations
+  with an error; no runtime detects a wait that escapes to another thread or
+  async context.
+
+## Dirtiness: loading never writes
+
+- A store's `IsDirty` derives only from its own writes and deletes. Pulling sets
+  it false.
+- A cache's `IsDirty` is whether any attached store is dirty, or, with no stores,
+  whether it has been mutated in memory.
+- Opening a store and flushing without a mutation leaves every file
+  byte-identical.
+- A mutation reaches the home store before the cache's in-memory view changes.
+  If the store refuses the write, the cache holds nothing new and publishes no
+  change.
+
+## Read-only stores
+
+- A store can be opened read-only. Writes, deletes and full pushes on it throw
+  and name the store.
+- A write whose home is a read-only store throws before anything changes.
+- Flushing skips read-only stores.
+
+## Lookups and watches honor inheritance
+
+`Get<T>`, `GetAll<T>`, `GetByName<T>`, `GetByIndex<T>`, `GetGlobal<T>` and
+`Watch<T>` match every document whose runtime type is assignable to `T`. A
+lookup that returns one document and finds several candidates throws, naming
+them. Indexes stay keyed by concrete type; lookups enumerate assignable keys.
+
+## Globals
+
+- `[CultGlobal]` means: at most one record of the type per cache, `GetGlobal<T>()`
+  returns it or `null`, and a write without a handle keys it
+  `global:{schemaId}`.
+- The cache never creates a global. Constructing a cache, attaching a store and
+  pulling produce no record the store did not contain. The code path that begins
+  a global's lifecycle creates it with an ordinary upsert.
+- A second record of a global type, through a write or a load, is refused
+  before any store is touched.
+- TypeScript and Python key the single record `__global__`; C# keys it
+  `global:{schemaId}`. The divergence is recorded, not changed, because changing
+  it changes bytes. Rust has no global concept.
+
+## Atomic commit: an explicit batch
+
+- A multi-record commit is an explicit batch value staged by the caller and
+  committed with `Commit`. Every record in the batch must resolve to one home
+  store; a batch spanning two homes throws before any store is touched.
+- The store commits the batch as one durable step: one atomic replace for a
+  single file, pages then manifest for a directory store. A failed commit
+  restores the store's staging and changes nothing in memory.
+- Nothing in a batch is visible, to the staging code or to observers, until the
+  store has accepted it. Reads during staging see committed state. There is no
+  ambient transaction and no in-flight overlay.
+- After the store accepts, each record is admitted through the same path as a
+  single write (home, read-only and global checks included) and one change is
+  published per record.
+- A cache with no stores admits a batch in memory.
+
+## Conditional commit (compare-exchange)
+
+A batch may carry conditions, evaluated under the home store's exclusive lock
+against what is durably on disk at that moment:
+
+- `Expect(key, current)`: the record at `key` must still be the one this cache
+  observed, or, with `current` null, must be absent. Only named keys are
+  constrained; unrelated concurrent writes do not fail the commit. Passing any
+  instance other than the one the cache holds throws.
+- `ExpectUnchanged()`: the store's persisted record set must equal what this
+  cache last loaded from it, compared as the ordered list of
+  `(key, schemaId, storedAt)`. Any insert, delete or replace fails it.
+
+Record identity for conditions is `(schemaId, storedAt)`. It is sound because
+every write to a key mints a `storedAt` strictly later than the record it
+replaces; writers bump a minted timestamp by one tick when it is not later.
+
+- A failed condition is a lost race, not an error: `Commit` returns false and
+  nothing is written, changed in memory, or published. `TryCommit` makes one
+  non-blocking lock attempt and reports `Contended` instead of waiting. On a
+  directory store the lock is the commit lease that pulls also take, so
+  `Contended` can mean another cache or process is reading or committing. The
+  attempt itself runs inside the cache gate, so `TryCommit` may first block
+  behind a pull or flush of the same cache, for up to that operation's lease
+  wait bound (30 seconds).
+- A conditional commit on a store with staged single-record writes throws:
+  flush first.
+- Single-file stores lock a sidecar `<path>.lock` opened exclusively. Directory
+  stores use their existing commit lease.
+- A directory store with no `.commit.lock` (no writer has created it yet, or
+  the store was copied without it) gives a pull no lease, and opening it
+  creates none. Such a pull re-reads the manifest after loading its pages and
+  reloads when the manifest changed or a page it named was missing or did not
+  match its content address, at most five times; a pull that has not settled
+  by then throws.
+
+**A plain flush and an unconditional commit are last-writer-wins: per file for
+single-file stores, per key for directory stores.** Both run
+under the same lock, so two writers never interleave bytes, but they compare
+nothing. Only a conditional commit (`Expect` or `ExpectUnchanged`) protects
+against another writer; processes sharing a store must all use it.
+
+- A single-file store writes this cache's whole view of the file: a record
+  another writer added since this cache last pulled is gone.
+- A directory store writes this cache's staged keys onto the current manifest:
+  another writer's unrelated keys survive, a key both wrote holds the last
+  write.
+- An unconditional commit writes exactly what a flush of the same staged state
+  plus the batch would write. It also persists any single writes staged earlier
+  in that store, and leaves the store clean.
+- A conditional commit lands the batch onto the file as it is under the lock.
+
+A store is written by one runtime at a time. Whether a Rust `fs2` lock and a C#
+exclusive open of the same lock file exclude each other is not established, and
+another runtime need not obey the `storedAt` rule.
+
+## Serialization options
+
+- Options belong to the assembly that declares a document. That assembly names
+  its formatter resolvers with `[assembly: CultCacheFormatterResolver(typeof(R))]`;
+  the payload serializer resolves options from the document's assembly. There is no mutable static, no registration call, and no load-order
+  rule.
+- A generic document's options come from the generic definition's assembly:
+  `Doc<X>` uses the resolvers `Doc`'s assembly declares, never `X`'s. A formatter
+  for `X` that `Doc<X>` needs is declared in `Doc`'s assembly.
+- An assembly that declares nothing, and the store envelope, use the base
+  options.
+- Deserialization runs under untrusted-data security. `CultRecordRef<T>` is a
+  permitted dictionary key, compared by its key string.
+
+## Value-type encoding
+
+Vector-like value types (Unity.Mathematics, consumer structs) encode as
+**fixed-length positional arrays of primitive components**: a two-component
+float vector is `[f32, f32]`, a three-component one `[f32, f32, f32]`, an
+integer pair `[int, int]`. No ext types, no maps, no names. The persisted member
+type name is the CLR full name, the same rule as `System.Int32`. A reader in
+another runtime needs only the component count and primitive type. CultMath has
+no serialization; a CultMath encoding, if added, uses this shape.
+
+## Runtime status
+
+| Rule | C# | Rust | TypeScript | Python |
+|---|---|---|---|---|
+| One home store, no mirrors | implemented | implemented (exact type ids; `add_backing_store` returns `Err` on a second generic store or a claimed type; an empty type list is the generic store) | implemented (exact type ids; `addBackingStore` throws on a second generic store or a claimed type; no types is the generic store) | implemented (exact type ids; `add_backing_store`/`add_generic_store` raise on a claimed type or a second generic store; an empty type list is the generic store) |
+| Zero stores is in memory | implemented | implemented | implemented | implemented |
+| Home cannot move after admission | implemented | implemented (`add_backing_store` returns `Err` and attaches nothing) | implemented (`addBackingStore` rejects and attaches nothing; it runs in the cache's serial queue, so it cannot move a write that is in flight) | implemented (`add_backing_store`/`add_generic_store` raise and attach nothing; they hold the cache's lock, so they cannot move a write that is in flight) |
+| Refused at load when not home | implemented | implemented (`pull_all_backing_stores` returns `Err` naming key and both stores; `load_soa` returns `Err` for a type with no home once a store is attached; both admit nothing and leave the prior view intact) | implemented (`pullAllBackingStores` throws naming key and both stores; admits nothing) | implemented (`pull_all_backing_stores` raises naming key and both stores; admits nothing) |
+| Refused write changes neither store nor cache | implemented | implemented (`put`, `put_envelope`, `put_raw_envelope`, `put_prepared_batch` and `delete` validate before the store call and apply infallibly after it; there are no user accessors) | implemented (home, `__global__` key and name and index accessors run before the store call; overwrite and delete use lookup values stored at admission; attach, pull, registration, writes and deletes run through one per-cache promise queue; one of those started from inside an operation queues behind it, so a store that waits for it never finishes (see Locking)) | implemented (same validation order and stored lookup keys as TypeScript; attach, pull, registration, writes, deletes, name and index resolution and snapshots hold one lock per cache; a mutation started on a thread already inside one of that cache's mutations raises, reads stay reentrant; a wait on another thread is not detected (see Locking)) |
+| Attach hydrates; loading never writes | implemented | attach does not read (call `pull_all_backing_stores`); pull loads without writing | attach does not read (call `pullAllBackingStores`); pull loads without writing | attach does not read (call `pull_all_backing_stores`); pull loads without writing |
+| Runtime type decides schema | implemented | n/a (explicit type ids) | n/a | n/a |
+| Assignable lookups and watches | implemented | exact type ids | exact type ids | exact type ids |
+| Globals never invented, singleton | implemented | no globals | single `__global__`; a write under any other key is refused before any store is touched; replacing writes `__global__` in place; a second persisted global (any keys) is refused on pull; invents nothing; load compatibility: a pull adopts a global stored under another key as `__global__` without writing, and the first write of it pushes `__global__`, then deletes the legacy record, deleting `__global__` again if that delete fails (a delete of it removes only the legacy record). A crash between the two steps, or a failed compensation, leaves both records on disk, and the next pull refuses them loudly as a second global. Removed once no store holds a non-`__global__` global | single `__global__`; `put`, `put_envelope` and `put_envelopes` refuse any other key before any store is touched; a second persisted global (any keys) is refused on pull; invents nothing; load compatibility: a pull adopts a global stored under another key as `__global__` without writing, and the first write of it pushes `__global__`, then deletes the legacy record, deleting `__global__` again if that delete fails (a delete of it removes only the legacy record). A crash between the two steps, or a failed compensation, leaves both records on disk, and the next pull refuses them loudly as a second global. Removed once no store holds a non-`__global__` global |
+| Explicit batch commit | implemented | `put_prepared_batch`: staged records must share one home; that store receives one `push_all` of its own held records plus the batch; empty key or `stored_at` refused first; all-or-nothing on stores whose `push_all` is atomic, which the trait requires of every store: `push_all` has no default, and the bundled single-file and redb stores replace in one step | not implemented | `put_envelopes`, one type per call; every record validated before one `push_all`, applied only after the store accepts; atomicity on disk is the store's `push_all` |
+| Conditional commit | implemented | store-level `compare_exchange` family | not implemented | not implemented |
+| Per-assembly options, value-type arrays | contract | n/a | n/a | n/a |
+
+A "contract" cell means this document is ahead of the C# code.
+
+Opening a store always hydrates it. A consumer that wants a store to hold only
+what it writes removes the records it does not keep, upserts, and flushes. On a
+single-file store the flush replaces the file in one atomic step. On a directory
+store the flush writes pages, then the manifest, under the commit lease, merging
+its staged keys and removals onto the current manifest; a key another writer
+added since the pull survives. There is no open-without-reading option.
diff --git a/src/GameCult.Caching/CultCache.cs b/src/GameCult.Caching/CultCache.cs
index e5e1d31a..5e8c8f6d 100644
--- a/src/GameCult.Caching/CultCache.cs
+++ b/src/GameCult.Caching/CultCache.cs
@@ -1,217 +1,98 @@
 using System;
 using System.Collections.Concurrent;
 using System.Collections.Generic;
+using System.Diagnostics;
+using System.Globalization;
 using System.IO;
 using System.Linq;
 using System.Reflection;
 using System.Runtime.CompilerServices;
+using System.Runtime.ExceptionServices;
 using System.Security.Cryptography;
 using System.Text;
+using System.Threading;
 using System.Threading.Tasks;
-using GameCult.Logging;
+using MessagePack;
 using R3;
 
 namespace GameCult.Caching
 {
-    /// <summary>
-    /// Persisted schema metadata embedded in a CultCache backing store.
-    /// </summary>
     public sealed class CultSchemaCatalogEntry
     {
-        /// <summary>
-        /// Gets or sets the content-derived schema identifier.
-        /// </summary>
         public string SchemaId { get; set; } = string.Empty;
-        /// <summary>
-        /// Gets or sets the stable schema name.
-        /// </summary>
         public string SchemaName { get; set; } = string.Empty;
-        /// <summary>
-        /// Gets or sets the schema version string.
-        /// </summary>
         public string SchemaVersion { get; set; } = string.Empty;
-        /// <summary>
-        /// Gets or sets the canonical schema content hash.
-        /// </summary>
         public string ContentHash { get; set; } = string.Empty;
-        /// <summary>
-        /// Gets or sets the canonical schema description.
-        /// </summary>
         public string CanonicalSchemaJson { get; set; } = string.Empty;
-        /// <summary>
-        /// Gets or sets schema identifiers compatible with this entry.
-        /// </summary>
         public string[] CompatibleSchemaIds { get; set; } = Array.Empty<string>();
 
-        /// <summary>
-        /// Gets or sets the persisted member descriptors used for compatibility checks.
-        /// </summary>
         public CultSchemaMemberCatalogEntry[] Members { get; set; } = Array.Empty<CultSchemaMemberCatalogEntry>();
     }
 
-    /// <summary>
-    /// Persisted catalog entry describing one schema member.
-    /// </summary>
     public sealed class CultSchemaMemberCatalogEntry
     {
-        /// <summary>
-        /// Gets or sets the persisted slot number.
-        /// </summary>
         public int Slot { get; set; }
 
-        /// <summary>
-        /// Gets or sets the member name.
-        /// </summary>
         public string MemberName { get; set; } = string.Empty;
 
-        /// <summary>
-        /// Gets or sets the persisted type name.
-        /// </summary>
         public string TypeName { get; set; } = string.Empty;
 
-        /// <summary>
-        /// Gets or sets whether the member is a reference.
-        /// </summary>
         public bool IsReference { get; set; }
 
-        /// <summary>
-        /// Gets or sets whether the member stores many values.
-        /// </summary>
         public bool IsMany { get; set; }
 
-        /// <summary>
-        /// Gets or sets the referenced schema name, when the member is a reference.
-        /// </summary>
         public string? TargetSchemaName { get; set; }
 
-        /// <summary>
-        /// Gets or sets whether the member provides the name lookup.
-        /// </summary>
         public bool IsName { get; set; }
 
-        /// <summary>
-        /// Gets or sets the index alias, when the member participates in lookups.
-        /// </summary>
         public string? IndexAlias { get; set; }
     }
 
-    /// <summary>
-    /// Persisted serialized document record.
-    /// </summary>
     public sealed class CultPersistedRecord
     {
-        /// <summary>
-        /// Gets or sets the persisted record key.
-        /// </summary>
         public string Key { get; set; } = string.Empty;
-        /// <summary>
-        /// Gets or sets the schema identifier used to deserialize the payload.
-        /// </summary>
         public string SchemaId { get; set; } = string.Empty;
-        /// <summary>
-        /// Gets or sets the storage timestamp.
-        /// </summary>
         public string StoredAt { get; set; } = string.Empty;
-        /// <summary>
-        /// Gets or sets the serialized document payload.
-        /// </summary>
         public byte[] Payload { get; set; } = Array.Empty<byte>();
     }
 
-    /// <summary>
-    /// Complete snapshot persisted by a single-file CultCache backing store.
-    /// </summary>
     public sealed class CultPersistedStoreSnapshot
     {
-        /// <summary>
-        /// Gets or sets the backing store format version.
-        /// </summary>
         public string FormatVersion { get; set; } = "cultcache.store.v1";
-        /// <summary>
-        /// Gets or sets the embedded schema catalog.
-        /// </summary>
         public CultSchemaCatalogEntry[] SchemaCatalog { get; set; } = Array.Empty<CultSchemaCatalogEntry>();
-        /// <summary>
-        /// Gets or sets the persisted records.
-        /// </summary>
         public CultPersistedRecord[] Records { get; set; } = Array.Empty<CultPersistedRecord>();
     }
 
-    /// <summary>
-    /// Classifies how a persisted schema mapped onto the local document registry.
-    /// </summary>
     public enum CultSchemaMigrationKind
     {
-        /// <summary>
-        /// The persisted schema matched the local schema exactly.
-        /// </summary>
         Exact,
 
-        /// <summary>
-        /// The persisted schema required a compatible soft-migration path.
-        /// </summary>
         CompatibleDrift
     }
 
-    /// <summary>
-    /// Describes one schema-resolution warning emitted during load.
-    /// </summary>
     public sealed class CultSchemaMigrationWarning
     {
-        /// <summary>
-        /// Gets or sets the stable warning code.
-        /// </summary>
         public string Code { get; set; } = string.Empty;
 
-        /// <summary>
-        /// Gets or sets the human-readable warning text.
-        /// </summary>
         public string Message { get; set; } = string.Empty;
     }
 
-    /// <summary>
-    /// Reports how one persisted schema entry resolved against the local schema catalog.
-    /// </summary>
     public sealed class CultSchemaMigrationReport
     {
-        /// <summary>
-        /// Gets or sets the persisted schema identifier.
-        /// </summary>
         public string PersistedSchemaId { get; set; } = string.Empty;
 
-        /// <summary>
-        /// Gets or sets the local schema identifier selected for reading.
-        /// </summary>
         public string LocalSchemaId { get; set; } = string.Empty;
 
-        /// <summary>
-        /// Gets or sets the persisted schema name.
-        /// </summary>
         public string PersistedSchemaName { get; set; } = string.Empty;
 
-        /// <summary>
-        /// Gets or sets the local schema name.
-        /// </summary>
         public string LocalSchemaName { get; set; } = string.Empty;
 
-        /// <summary>
-        /// Gets or sets how the persisted schema matched locally.
-        /// </summary>
         public CultSchemaMigrationKind Kind { get; set; }
 
-        /// <summary>
-        /// Gets or sets the persisted member slots ignored by the local reader.
-        /// </summary>
         public int[] IgnoredExtraSlots { get; set; } = Array.Empty<int>();
 
-        /// <summary>
-        /// Gets or sets the local member slots defaulted because the persisted record did not contain them.
-        /// </summary>
         public int[] DefaultedMissingSlots { get; set; } = Array.Empty<int>();
 
-        /// <summary>
-        /// Gets or sets emitted migration warnings.
-        /// </summary>
         public CultSchemaMigrationWarning[] Warnings { get; set; } = Array.Empty<CultSchemaMigrationWarning>();
     }
 
@@ -228,9 +109,6 @@ namespace GameCult.Caching
         public CultSchemaMigrationReport Report { get; }
     }
 
-    /// <summary>
-    /// Runtime descriptor for a CultCache document type.
-    /// </summary>
     public sealed class CultDocumentDescriptor
     {
         internal CultDocumentDescriptor(
@@ -243,8 +121,6 @@ namespace GameCult.Caching
             bool isGlobal,
             string? nameMember,
             Func<object, string?>? nameAccessor,
-            Func<object, byte[]>? generatedPayloadSerializer,
-            Func<byte[], object>? generatedPayloadDeserializer,
             IReadOnlyDictionary<string, Func<object, string>> indexAccessors,
             IReadOnlyList<CultDocumentMemberDescriptor> members)
         {
@@ -257,59 +133,22 @@ namespace GameCult.Caching
             IsGlobal = isGlobal;
             NameMember = nameMember;
             NameAccessor = nameAccessor;
-            GeneratedPayloadSerializer = generatedPayloadSerializer;
-            GeneratedPayloadDeserializer = generatedPayloadDeserializer;
             IndexAccessors = indexAccessors;
             Members = members;
         }
 
-        /// <summary>
-        /// Gets the CLR document type.
-        /// </summary>
         public Type DocumentType { get; }
-        /// <summary>
-        /// Gets the stable schema name.
-        /// </summary>
         public string SchemaName { get; }
-        /// <summary>
-        /// Gets the schema version string.
-        /// </summary>
         public string SchemaVersion { get; }
-        /// <summary>
-        /// Gets the content-derived schema identifier.
-        /// </summary>
         public string SchemaId { get; }
-        /// <summary>
-        /// Gets the canonical schema content hash.
-        /// </summary>
         public string ContentHash { get; }
-        /// <summary>
-        /// Gets the canonical schema description.
-        /// </summary>
         public string CanonicalSchemaJson { get; }
-        /// <summary>
-        /// Gets whether this document type stores one global record.
-        /// </summary>
         public bool IsGlobal { get; }
-        /// <summary>
-        /// Gets the document name member, if any.
-        /// </summary>
         public string? NameMember { get; }
         internal Func<object, string?>? NameAccessor { get; }
-        /// <summary>
-        /// Gets the generated payload serializer, if one is available.
-        /// </summary>
-        public Func<object, byte[]>? GeneratedPayloadSerializer { get; }
-        /// <summary>
-        /// Gets the generated payload deserializer, if one is available.
-        /// </summary>
-        public Func<byte[], object>? GeneratedPayloadDeserializer { get; }
         internal IReadOnlyDictionary<string, Func<object, string>> IndexAccessors { get; }
         internal IReadOnlyList<CultDocumentMemberDescriptor> Members { get; }
 
-        /// <summary>
-        /// Converts this descriptor into a persisted schema catalog entry.
-        /// </summary>
         public CultSchemaCatalogEntry ToCatalogEntry()
         {
             return new CultSchemaCatalogEntry
@@ -358,14 +197,8 @@ namespace GameCult.Caching
         public string? IndexAlias { get; set; }
     }
 
-    /// <summary>
-    /// Stores a resolved document together with its descriptor and key.
-    /// </summary>
     public sealed class CultStoredDocument
     {
-        /// <summary>
-        /// Creates a stored document wrapper.
-        /// </summary>
         public CultStoredDocument(
             CultRecordKey key,
             string storedAt,
@@ -378,96 +211,70 @@ namespace GameCult.Caching
             Document = document;
         }
 
-        /// <summary>
-        /// Gets the record key.
-        /// </summary>
         public CultRecordKey Key { get; }
-        /// <summary>
-        /// Gets the storage timestamp.
-        /// </summary>
         public string StoredAt { get; }
-        /// <summary>
-        /// Gets the document descriptor.
-        /// </summary>
         public CultDocumentDescriptor Descriptor { get; }
-        /// <summary>
-        /// Gets the document instance.
-        /// </summary>
         public object Document { get; }
     }
 
-    /// <summary>
-    /// Discovers, indexes, and resolves CultCache document descriptors.
-    /// </summary>
     public sealed class CultDocumentRegistry
     {
         private static readonly Lazy<CultDocumentRegistry> SharedRegistry =
             new(() => new CultDocumentRegistry());
 
-        private readonly ConcurrentDictionary<Type, CultDocumentDescriptor> _byType = new();
-        private readonly ConcurrentDictionary<string, CultDocumentDescriptor> _bySchemaId =
-            new(StringComparer.Ordinal);
-        private readonly ConcurrentDictionary<string, CultDocumentDescriptor> _bySchemaName =
-            new(StringComparer.Ordinal);
+        private volatile RegistryIndexes _indexes = new();
+        private readonly object _registrationGate = new();
 
-        /// <summary>
-        /// Gets the shared process-wide document registry.
-        /// </summary>
         public static CultDocumentRegistry Shared => SharedRegistry.Value;
 
-        /// <summary>
-        /// Creates a registry and discovers currently loaded document metadata.
-        /// </summary>
         public CultDocumentRegistry()
         {
             Refresh();
         }
 
-        /// <summary>
-        /// Gets all known document descriptors.
-        /// </summary>
-        public IEnumerable<CultDocumentDescriptor> AllDescriptors => _byType.Values.OrderBy(d => d.SchemaName, StringComparer.Ordinal);
+        private CultDocumentRegistry(bool discoverLoadedDocuments)
+        {
+            if (discoverLoadedDocuments)
+                Refresh();
+        }
+
+        public static CultDocumentRegistry ForTypes(IEnumerable<Type> documentTypes)
+        {
+            if (documentTypes == null) throw new ArgumentNullException(nameof(documentTypes));
+            var registry = new CultDocumentRegistry(discoverLoadedDocuments: false);
+            foreach (var type in documentTypes.Distinct())
+            {
+                registry.GetRequired(type ?? throw new ArgumentException(
+                    "Document type collections cannot contain null entries.",
+                    nameof(documentTypes)));
+            }
+            return registry;
+        }
+
+        public IEnumerable<CultDocumentDescriptor> AllDescriptors =>
+            _indexes.ByType.Values.OrderBy(d => d.SchemaName, StringComparer.Ordinal);
 
-        /// <summary>
-        /// Rebuilds the registry from generated metadata and reflected document attributes.
-        /// </summary>
         public void Refresh()
         {
-            _byType.Clear();
-            _bySchemaId.Clear();
-            _bySchemaName.Clear();
-
-            var generatedTypes = new HashSet<Type>();
-            foreach (var definition in CultGeneratedDocumentMetadataLoader.LoadDefinitions())
+            lock (_registrationGate)
             {
-                var descriptor = BuildDescriptor(definition);
-                RegisterDescriptor(descriptor);
-                generatedTypes.Add(descriptor.DocumentType);
-            }
+                var rebuilt = new RegistryIndexes();
+                foreach (var type in ReflectionExtensions.GetAttributedDocumentTypes())
+                {
+                    RegisterDescriptor(rebuilt, BuildDescriptor(type));
+                }
 
-            foreach (var type in ReflectionExtensions.GetAttributedDocumentTypes().Where(type => !generatedTypes.Contains(type)))
-            {
-                RegisterDescriptor(BuildDescriptor(type));
+                _indexes = rebuilt;
             }
         }
 
-        /// <summary>
-        /// Gets the descriptor for a document type, building it when needed.
-        /// </summary>
         public CultDocumentDescriptor GetRequired(Type type)
         {
-            if (_byType.TryGetValue(type, out var descriptor))
+            if (_indexes.ByType.TryGetValue(type, out var descriptor))
             {
                 return descriptor;
             }
 
-            descriptor = TryBuildGeneratedDescriptor(type);
-            if (descriptor != null)
-            {
-                RegisterDescriptor(descriptor);
-                return descriptor;
-            }
-
             var attribute = type.GetCustomAttribute<CultDocumentAttribute>();
             if (attribute == null)
             {
@@ -476,24 +283,17 @@ namespace GameCult.Caching
             }
 
             descriptor = BuildDescriptor(type);
-            RegisterDescriptor(descriptor);
-            return descriptor;
+            return RegisterDescriptor(descriptor);
         }
 
-        /// <summary>
-        /// Gets the descriptor for a document type.
-        /// </summary>
         public CultDocumentDescriptor GetRequired<T>() where T : class
         {
             return GetRequired(typeof(T));
         }
 
-        /// <summary>
-        /// Gets a descriptor by its schema identifier.
-        /// </summary>
         public CultDocumentDescriptor GetRequiredBySchemaId(string schemaId)
         {
-            if (_bySchemaId.TryGetValue(schemaId, out var descriptor))
+            if (_indexes.BySchemaId.TryGetValue(schemaId, out var descriptor))
             {
                 return descriptor;
             }
@@ -501,17 +301,11 @@ namespace GameCult.Caching
             throw new InvalidOperationException($"Unknown CultCache schema id '{schemaId}'.");
         }
 
-        /// <summary>
-        /// Resolves a persisted schema identifier against the local registry and embedded catalog.
-        /// </summary>
         public CultDocumentDescriptor ResolvePersistedSchema(string schemaId, IReadOnlyCollection<CultSchemaCatalogEntry> catalog)
         {
             return ResolvePersistedSchemaDetailed(schemaId, catalog).Descriptor;
         }
 
-        /// <summary>
-        /// Resolves a persisted schema identifier and returns the selected descriptor with migration diagnostics.
-        /// </summary>
         public CultSchemaMigrationReport ResolvePersistedSchemaReport(string schemaId, IReadOnlyCollection<CultSchemaCatalogEntry> catalog)
         {
             return ResolvePersistedSchemaDetailed(schemaId, catalog).Report;
@@ -519,7 +313,8 @@ namespace GameCult.Caching
 
         internal CultSchemaResolutionResult ResolvePersistedSchemaDetailed(string schemaId, IReadOnlyCollection<CultSchemaCatalogEntry> catalog)
         {
-            if (_bySchemaId.TryGetValue(schemaId, out var exact))
+            var indexes = _indexes;
+            if (indexes.BySchemaId.TryGetValue(schemaId, out var exact))
             {
                 return new CultSchemaResolutionResult(
                     exact,
@@ -541,35 +336,121 @@ namespace GameCult.Caching
 
             foreach (var compatibleSchemaId in persisted.CompatibleSchemaIds.Where(candidate => !string.IsNullOrWhiteSpace(candidate)))
             {
-                if (_bySchemaId.TryGetValue(compatibleSchemaId, out var compatibleLocal))
+                if (indexes.BySchemaId.TryGetValue(compatibleSchemaId, out var compatibleLocal))
                 {
                     return BuildCompatibleResolutionResult(persisted, compatibleLocal);
                 }
             }
 
-            if (_bySchemaName.TryGetValue(persisted.SchemaName, out var local))
+            if (indexes.BySchemaName.TryGetValue(persisted.SchemaName, out var localVersions))
             {
-                return BuildCompatibleResolutionResult(persisted, local);
+                if (localVersions.Length == 1)
+                {
+                    return BuildCompatibleResolutionResult(persisted, localVersions[0]);
+                }
+
+                throw new InvalidOperationException(
+                    $"CultCache schema name '{persisted.SchemaName}' is ambiguous across local versions " +
+                    $"[{string.Join(", ", localVersions.Select(candidate => candidate.SchemaVersion).OrderBy(version => version, StringComparer.Ordinal))}]. " +
+                    "Persisted schema compatibility must identify an explicit schema id.");
             }
 
             throw new InvalidOperationException(
                 $"No local CultCache schema matches persisted schema '{persisted.SchemaName}' ({schemaId}).");
         }
 
-        private void RegisterDescriptor(CultDocumentDescriptor descriptor)
+        private CultDocumentDescriptor RegisterDescriptor(CultDocumentDescriptor descriptor)
         {
-            _byType[descriptor.DocumentType] = descriptor;
-            _bySchemaId[descriptor.SchemaId] = descriptor;
-            _bySchemaName[descriptor.SchemaName] = descriptor;
+            lock (_registrationGate)
+            {
+                var current = _indexes;
+                if (current.ByType.TryGetValue(descriptor.DocumentType, out var registered))
+                    return registered;
+
+                var updated = new RegistryIndexes(current);
+                registered = RegisterDescriptor(updated, descriptor);
+                _indexes = updated;
+                return registered;
+            }
         }
 
-        private static CultDocumentDescriptor? TryBuildGeneratedDescriptor(Type type)
+        private static CultDocumentDescriptor RegisterDescriptor(
+            RegistryIndexes indexes,
+            CultDocumentDescriptor descriptor)
         {
-            var definition = CultGeneratedDocumentMetadataLoader.LoadDefinitions(type.Assembly)
-                .FirstOrDefault(candidate => candidate.DocumentType == type);
-            return definition == null
-                ? null
-                : BuildDescriptor(definition);
+            if (indexes.ByType.TryGetValue(descriptor.DocumentType, out var registered))
+                return registered;
+
+            indexes.BySchemaName.TryGetValue(descriptor.SchemaName, out var schemaNameVersions);
+            var schemaVersionOwner = schemaNameVersions?.FirstOrDefault(candidate =>
+                string.Equals(candidate.SchemaVersion, descriptor.SchemaVersion, StringComparison.Ordinal));
+            if (schemaVersionOwner != null)
+            {
+                if (IsExactWireAlias(schemaVersionOwner, descriptor))
+                {
+                    indexes.ByType[descriptor.DocumentType] = descriptor;
+                    return descriptor;
+                }
+
+                throw DuplicateSchemaRegistration(
+                    $"schema name '{descriptor.SchemaName}' version '{descriptor.SchemaVersion}'",
+                    schemaVersionOwner.DocumentType,
+                    descriptor.DocumentType);
+            }
+
+            if (indexes.BySchemaId.TryGetValue(descriptor.SchemaId, out var schemaIdOwner))
+            {
+                throw DuplicateSchemaRegistration(
+                    $"schema id '{descriptor.SchemaId}'",
+                    schemaIdOwner.DocumentType,
+                    descriptor.DocumentType);
+            }
+
+            indexes.ByType[descriptor.DocumentType] = descriptor;
+            indexes.BySchemaId[descriptor.SchemaId] = descriptor;
+            indexes.BySchemaName[descriptor.SchemaName] = schemaNameVersions == null
+                ? [descriptor]
+                : [.. schemaNameVersions, descriptor];
+            return descriptor;
+        }
+
+        private static bool IsExactWireAlias(
+            CultDocumentDescriptor canonical,
+            CultDocumentDescriptor candidate) =>
+            string.Equals(canonical.SchemaName, candidate.SchemaName, StringComparison.Ordinal) &&
+            string.Equals(canonical.SchemaVersion, candidate.SchemaVersion, StringComparison.Ordinal) &&
+            string.Equals(canonical.SchemaId, candidate.SchemaId, StringComparison.Ordinal) &&
+            string.Equals(canonical.ContentHash, candidate.ContentHash, StringComparison.Ordinal) &&
+            string.Equals(canonical.CanonicalSchemaJson, candidate.CanonicalSchemaJson, StringComparison.Ordinal);
+
+        private static InvalidOperationException DuplicateSchemaRegistration(
+            string identity,
+            Type existingType,
+            Type claimedType) =>
+            new(
+                $"CultCache {identity} is already registered to CLR type " +
+                $"'{existingType.FullName}' and cannot also be claimed by '{claimedType.FullName}'. " +
+                "Schema compatibility must be declared through explicit persisted-schema alias metadata.");
+
+        private sealed class RegistryIndexes
+        {
+            public RegistryIndexes()
+            {
+                ByType = new Dictionary<Type, CultDocumentDescriptor>();
+                BySchemaId = new Dictionary<string, CultDocumentDescriptor>(StringComparer.Ordinal);
+                BySchemaName = new Dictionary<string, CultDocumentDescriptor[]>(StringComparer.Ordinal);
+            }
+
+            public RegistryIndexes(RegistryIndexes source)
+            {
+                ByType = new Dictionary<Type, CultDocumentDescriptor>(source.ByType);
+                BySchemaId = new Dictionary<string, CultDocumentDescriptor>(source.BySchemaId, StringComparer.Ordinal);
+                BySchemaName = new Dictionary<string, CultDocumentDescriptor[]>(source.BySchemaName, StringComparer.Ordinal);
+            }
+
+            public Dictionary<Type, CultDocumentDescriptor> ByType { get; }
+            public Dictionary<string, CultDocumentDescriptor> BySchemaId { get; }
+            public Dictionary<string, CultDocumentDescriptor[]> BySchemaName { get; }
         }
 
         private static CultDocumentDescriptor BuildDescriptor(Type type)
@@ -613,49 +494,10 @@ namespace GameCult.Caching
                 type.GetCustomAttribute<CultGlobalAttribute>() != null,
                 nameMember?.Member.Name,
                 nameMember?.GetterNullable,
-                null,
-                null,
                 indexAccessors,
                 descriptorMembers);
         }
 
-        private static CultDocumentDescriptor BuildDescriptor(CultGeneratedDocumentDefinition definition)
-        {
-            var descriptorMembers = definition.Members
-                .OrderBy(member => member.Slot)
-                .Select(member => new CultDocumentMemberDescriptor
-                {
-                    MemberName = member.MemberName,
-                    Slot = member.Slot,
-                    TypeName = member.TypeName,
-                    IsReference = member.IsReference,
-                    IsMany = member.IsMany,
-                    TargetSchemaName = member.TargetSchemaName,
-                    IsName = member.IsName,
-                    IndexAlias = member.IndexAlias
-                })
-                .ToArray();
-            var schemaJson = BuildCanonicalSchemaJson(definition.SchemaName, definition.SchemaVersion, descriptorMembers);
-            var contentHash = Sha256(schemaJson);
-            var semanticFingerprint = BuildSemanticFingerprint(definition.SchemaName, definition.SchemaVersion, descriptorMembers);
-            var schemaId = Sha256(semanticFingerprint);
-
-            return new CultDocumentDescriptor(
-                definition.DocumentType,
-                definition.SchemaName,
-                definition.SchemaVersion,
-                schemaId,
-                contentHash,
-                schemaJson,
-                definition.IsGlobal,
-                definition.NameMember,
-                definition.NameAccessor,
-                definition.SerializePayload,
-                definition.DeserializePayload,
-                definition.IndexAccessors.ToDictionary(accessor => accessor.Alias, accessor => accessor.Accessor, StringComparer.Ordinal),
-                descriptorMembers);
-        }
-
         private static string BuildSemanticFingerprint(
             string schemaName,
             string schemaVersion,
@@ -991,81 +833,211 @@ namespace GameCult.Caching
             public int[] DefaultedMissingSlots { get; }
         }
 
+        // Public instance fields and properties (get-only included: MessagePack writes every keyed public member), most-derived
+        // declaration first; GetCustomAttributes inherits a property's attributes up its override chain, as MessagePack's resolver reads them.
         private static IReadOnlyList<PersistedMember> DiscoverMembers(Type type)
         {
-            var members = new List<PersistedMember>();
-
-            foreach (var field in type.GetFields(BindingFlags.Instance | BindingFlags.Public))
+            const BindingFlags declared = BindingFlags.DeclaredOnly | BindingFlags.Instance | BindingFlags.Public;
+            var messagePackObject = type.GetCustomAttribute<MessagePackObjectAttribute>(true);
+            var allowPrivate = messagePackObject?.AllowPrivate == true;
+            // Writable: MessagePack can assign the member after construction. A member that is not must be filled by the constructor.
+            var candidates = new List<(MemberInfo Member, Type MemberType, int Depth, bool Writable, PropertyInfo? DivergentRoot)>();
+            var seenRoots = new HashSet<(Type, string)>();
+            var depth = 0;
+            for (var current = type; current != null && current != typeof(object); current = current.BaseType, depth++)
             {
-                if (IsIgnored(field))
+                foreach (var field in current.GetFields(declared))
                 {
-                    continue;
+                    // MessagePack's rule: a readonly field is writable under AllowPrivate only.
+                    if (!IsIgnored(field))
+                        candidates.Add((field, field.FieldType, depth, !field.IsInitOnly || allowPrivate, null));
                 }
 
-                members.Add(PersistedMember.FromMember(field, field.FieldType, value => field.GetValue(value), GetKeyValue(field)));
-            }
-
-            foreach (var property in type.GetProperties(BindingFlags.Instance | BindingFlags.Public))
-            {
-                if (property.GetMethod == null || property.SetMethod == null || IsIgnored(property))
+                foreach (var property in current.GetProperties(declared))
                 {
-                    continue;
+                    if (property.GetIndexParameters().Length > 0 || !seenRoots.Add(RootOf(property)))
+                        continue;
+                    var chain = OverrideChain(property).ToArray();
+                    var setter = chain.Select(declaration => declaration.SetMethod).FirstOrDefault(method => method != null);
+                    if (chain.All(declaration => declaration.GetMethod == null))
+                        continue;
+                    // MessagePack's resolver reads the base declaration's [Key]/[IgnoreMember]; an override that changes them is refused.
+                    var root = chain[chain.Length - 1];
+                    var divergentRoot = chain.Any(declaration =>
+                        !Equals(GetKeyValue(declaration), GetKeyValue(root)) || IsIgnored(declaration) != IsIgnored(root))
+                        ? root
+                        : null;
+                    if (divergentRoot == null && IsIgnored(property))
+                        continue;
+                    // MessagePack's own rule: it calls a setter that is public, or any setter (init-only included) under AllowPrivate.
+                    candidates.Add((property, property.PropertyType, depth, setter != null && (setter.IsPublic || allowPrivate), divergentRoot));
                 }
-
-                members.Add(PersistedMember.FromMember(property, property.PropertyType, value => property.GetValue(value), GetKeyValue(property)));
             }
 
-            var explicitMembers = members.Where(member => member.ExplicitSlot.HasValue).OrderBy(member => member.ExplicitSlot.GetValueOrDefault()).ToArray();
-            var implicitMembers = members.Where(member => !member.ExplicitSlot.HasValue).OrderBy(member => member.MetadataToken).ToArray();
-            var assigned = new List<PersistedMember>(members.Count);
-            var nextSlot = explicitMembers.Length == 0 ? 0 : explicitMembers.Max(member => member.ExplicitSlot.GetValueOrDefault()) + 1;
-
-            foreach (var member in explicitMembers)
+            var rejections = new List<string>();
+            if (messagePackObject == null)
+                rejections.Add(NotMessagePackObjectMessage(type.Name));
+            else if (!type.IsVisible && !allowPrivate)
+                rejections.Add(NotVisibleMessage(type.Name));
+            else
             {
-                member.Slot = member.ExplicitSlot.GetValueOrDefault();
-                assigned.Add(member);
-            }
-
-            foreach (var member in implicitMembers)
-            {
-                member.Slot = nextSlot++;
-                assigned.Add(member);
-            }
-
-            return assigned.OrderBy(member => member.Slot).ToArray();
-        }
-
-        private static bool IsIgnored(MemberInfo member)
-        {
-            return member.GetCustomAttributes().Any(attribute =>
-            {
-                var name = attribute.GetType().FullName;
-                return name == "MessagePack.IgnoreMemberAttribute";
-            });
-        }
-
-        private static int? GetKeyValue(MemberInfo member)
-        {
-            foreach (var attribute in member.GetCustomAttributes())
-            {
-                var name = attribute.GetType().FullName;
-                if (name == "MessagePack.KeyAttribute")
+                // AllowPrivate makes MessagePack read non-public members, which the registry does not persist; without it MessagePack
+                // silently skips a keyed non-public member.
+                const BindingFlags nonPublic = BindingFlags.DeclaredOnly | BindingFlags.Instance | BindingFlags.NonPublic;
+                for (var current = type; current != null && current != typeof(object); current = current.BaseType)
                 {
-                    var property = attribute.GetType().GetProperty("IntKey");
-                    if (property?.GetValue(attribute) is int intKey)
+                    foreach (var member in current.GetFields(nonPublic).Cast<MemberInfo>().Concat(current.GetProperties(nonPublic)))
                     {
-                        return intKey;
+                        if (allowPrivate && !member.IsDefined(typeof(CompilerGeneratedAttribute)) && !IsIgnored(member))
+                            rejections.Add(UnmarkedNonPublicMemberMessage(type.Name, Qualified(member)));
+                        else if (!allowPrivate && GetKeyValue(member) != null && !IsIgnored(member))
+                            rejections.Add(KeyedNonPublicMemberMessage(type.Name, Qualified(member)));
                     }
+                }
+            }
+            var keyed = new List<(MemberInfo Member, Type MemberType, int Slot, bool Writable)>();
+            foreach (var candidate in candidates.OrderBy(candidate => candidate.Depth).ThenBy(candidate => candidate.Member.Name, StringComparer.Ordinal))
+            {
+                var key = GetKeyValue(candidate.Member);
+                if (candidate.DivergentRoot != null)
+                    rejections.Add(DivergentOverrideMessage(type.Name, Qualified(candidate.Member), Qualified(candidate.DivergentRoot)));
+                else if (key is string)
+                    rejections.Add(StringKeyMessage(type.Name, candidate.Member.Name));
+                else if (key is not int slot)
+                    rejections.Add(UnkeyedMemberMessage(type.Name, candidate.Member.Name));
+                else
+                    keyed.Add((candidate.Member, candidate.MemberType, slot, candidate.Writable));
+            }
 
-                    var ctorArg = attribute.GetType().GetProperty("StringKey");
-                    if (ctorArg?.GetValue(attribute) is string)
+            if (messagePackObject != null)
+            {
+                // A member MessagePack cannot assign is read back only through the picked constructor's parameter at its slot.
+                var arity = ConstructorArity(type, allowPrivate, keyed.Select(entry => (entry.MemberType, entry.Slot)));
+                if (arity == null)
+                    rejections.Add(NoConstructorMessage(type.Name));
+                else
+                {
+                    foreach (var entry in keyed.Where(entry => !entry.Writable && entry.Slot >= arity))
                     {
-                        return null;
+                        rejections.Add(entry.Member switch
+                        {
+                            FieldInfo => ReadonlyUnfilledMessage(type.Name, entry.Member.Name, entry.Slot),
+                            PropertyInfo property when property.SetMethod == null && OverrideChain(property).All(declaration => declaration.SetMethod == null) =>
+                                GetOnlyUnfilledMessage(type.Name, entry.Member.Name, entry.Slot),
+                            _ => NonPublicSetterMessage(type.Name, entry.Member.Name)
+                        });
                     }
                 }
             }
 
-            return null;
+            foreach (var group in keyed.GroupBy(entry => entry.Slot).Where(group => group.Count() > 1).OrderBy(group => group.Key))
+            {
+                var pair = group.Take(2).ToArray();
+                rejections.Add(DuplicateSlotMessage(type.Name, Qualified(pair[0].Member), Qualified(pair[1].Member), group.Key));
+            }
+
+            foreach (var group in keyed.GroupBy(entry => entry.Member.Name)
+                         .Where(group => group.Select(entry => entry.Slot).Distinct().Count() > 1)
+                         .OrderBy(group => group.Key, StringComparer.Ordinal))
+            {
+                var pair = group.Take(2).ToArray();
+                rejections.Add(HiddenMemberMessage(type.Name, Qualified(pair[0].Member), Qualified(pair[1].Member)));
+            }
+
+            if (rejections.Count > 0)
+                throw new InvalidOperationException(rejections[0]);
+
+            return keyed
+                .Select(entry => PersistedMember.FromMember(
+                    entry.Member,
+                    entry.MemberType,
+                    entry.Member is FieldInfo field ? field.GetValue : ((PropertyInfo)entry.Member).GetValue,
+                    entry.Slot))
+                .OrderBy(member => member.Slot)
+                .ToArray();
+        }
+
+        private static (Type, string) RootOf(PropertyInfo property) =>
+            ((property.GetMethod ?? property.SetMethod)!.GetBaseDefinition().DeclaringType!, property.Name);
+
+        private static IEnumerable<PropertyInfo> OverrideChain(PropertyInfo property)
+        {
+            var root = RootOf(property);
+            for (var current = property.DeclaringType; current != null; current = current.BaseType)
+            {
+                var declaration = current.GetProperty(property.Name, BindingFlags.DeclaredOnly | BindingFlags.Instance | BindingFlags.Public | BindingFlags.NonPublic);
+                if (declaration != null && declaration.GetIndexParameters().Length == 0 && RootOf(declaration) == root)
+                    yield return declaration;
+            }
+        }
+
+        // MessagePack's DynamicObjectResolver picks the [SerializationConstructor] if one is marked, otherwise the longest public constructor
+        // (any constructor under AllowPrivate) whose every parameter takes the keyed member at its position (slot == parameter index).
+        // Returns that constructor's parameter count, 0 for a struct with none, or null when MessagePack finds no constructor.
+        private static int? ConstructorArity(Type type, bool allowPrivate, IEnumerable<(Type MemberType, int Slot)> members)
+        {
+            var slots = new Dictionary<int, Type>();
+            foreach (var member in members)
+                slots.TryAdd(member.Slot, member.MemberType);
+            var constructors = type.GetConstructors(BindingFlags.Instance | BindingFlags.Public | BindingFlags.NonPublic);
+            var marked = constructors.Where(constructor => constructor.IsDefined(typeof(SerializationConstructorAttribute))).ToArray();
+            var arities = (marked.Length > 0 ? marked : constructors.Where(constructor => allowPrivate || constructor.IsPublic))
+                .Select(constructor => constructor.GetParameters())
+                .Where(parameters => parameters.All(parameter =>
+                    slots.TryGetValue(parameter.Position, out var memberType) && parameter.ParameterType.IsAssignableFrom(memberType)))
+                .Select(parameters => (int?)parameters.Length)
+                .ToArray();
+            return arities.Length > 0 ? arities.Max() : type.IsValueType && marked.Length == 0 ? 0 : null;
+        }
+
+        private static string Qualified(MemberInfo member) => member.DeclaringType!.Name.Split('`')[0] + "." + member.Name;
+
+        private static string NotMessagePackObjectMessage(string documentTypeName) =>
+            $"Cult document {documentTypeName} is not a MessagePack object; add [MessagePackObject] so MessagePack serializes its [Key(n)] members.";
+
+        private static string NotVisibleMessage(string documentTypeName) =>
+            $"Cult document {documentTypeName} is not public; MessagePack serializes a non-public type only with [MessagePackObject(AllowPrivate = true)], so make it public or set AllowPrivate.";
+
+        private static string UnmarkedNonPublicMemberMessage(string documentTypeName, string memberName) =>
+            $"Cult document {documentTypeName} member {memberName} is non-public; [MessagePackObject(AllowPrivate = true)] makes MessagePack read it, so mark it [IgnoreMember].";
+
+        internal static string UnkeyedMemberMessage(string documentTypeName, string memberName) =>
+            $"Cult document {documentTypeName} member {memberName} has no [Key]; MessagePack requires [Key(n)] or [IgnoreMember] on every public member, so mark it one or the other.";
+
+        private static string StringKeyMessage(string documentTypeName, string memberName) =>
+            $"Cult document {documentTypeName} member {memberName} has a string [Key]; string keys are not supported; use integer [Key(n)].";
+
+        private static string ReadonlyUnfilledMessage(string documentTypeName, string memberName, int slot) =>
+            $"Cult document {documentTypeName} member {memberName} is a readonly field that no constructor fills; MessagePack writes it but never reads it back, so give the constructor MessagePack calls a parameter at position {slot}, drop readonly, or add [MessagePackObject(AllowPrivate = true)].";
+
+        private static string GetOnlyUnfilledMessage(string documentTypeName, string memberName, int slot) =>
+            $"Cult document {documentTypeName} member {memberName} is a get-only property that no constructor fills; MessagePack writes it but never reads it back, so give the constructor MessagePack calls a parameter at position {slot}, add a setter, or mark it [IgnoreMember].";
+
+        private static string NonPublicSetterMessage(string documentTypeName, string memberName) =>
+            $"Cult document {documentTypeName} member {memberName} has a non-public set accessor; MessagePack writes it but never reads it back without AllowPrivate, so make the setter public or add [MessagePackObject(AllowPrivate = true)].";
+
+        private static string KeyedNonPublicMemberMessage(string documentTypeName, string memberName) =>
+            $"Cult document {documentTypeName} member {memberName} is non-public; MessagePack skips it silently, so [Key] on a non-public member requires [MessagePackObject(AllowPrivate = true)].";
+
+        private static string NoConstructorMessage(string documentTypeName) =>
+            $"Cult document {documentTypeName} has no constructor MessagePack can call; add a parameterless constructor (public unless AllowPrivate), or one whose parameters take the [Key(0)], [Key(1)], ... members in order.";
+
+        private static string DuplicateSlotMessage(string documentTypeName, string first, string second, int slot) =>
+            $"Cult document {documentTypeName} members {first} and {second} share [Key({slot})]; every persisted member needs a distinct [Key(n)].";
+
+        private static string DivergentOverrideMessage(string documentTypeName, string member, string root) =>
+            $"Cult document {documentTypeName} member {member} overrides {root} with a different [Key] or [IgnoreMember]; MessagePack reads the base declaration's, so an override must repeat or omit them.";
+
+        private static string HiddenMemberMessage(string documentTypeName, string first, string second) =>
+            $"Cult document {documentTypeName} member {first} hides persisted member {second}; persisted member names must be unique.";
+
+        private static bool IsIgnored(MemberInfo member) =>
+            member.GetCustomAttribute<global::MessagePack.IgnoreMemberAttribute>() != null;
+
+        private static object? GetKeyValue(MemberInfo member)
+        {
+            var key = member.GetCustomAttribute<global::MessagePack.KeyAttribute>();
+            return key?.IntKey is int slot ? slot : key?.StringKey;
         }
 
         private static string Sha256(string input)
@@ -1079,8 +1051,6 @@ namespace GameCult.Caching
         {
             public MemberInfo Member { get; set; } = default!;
             public Type MemberType { get; set; } = default!;
-            public int MetadataToken { get; set; }
-            public int? ExplicitSlot { get; set; }
             public int Slot { get; set; }
             public bool IsName { get; set; }
             public string? IndexAlias { get; set; }
@@ -1094,7 +1064,7 @@ namespace GameCult.Caching
                 MemberInfo member,
                 Type memberType,
                 Func<object, object?> getValue,
-                int? explicitSlot)
+                int slot)
             {
                 var referenceAttribute = member.GetCustomAttribute<CultReferenceAttribute>();
                 var targetType = ResolveReferenceTarget(memberType, referenceAttribute?.TargetType);
@@ -1103,9 +1073,7 @@ namespace GameCult.Caching
                 {
                     Member = member,
                     MemberType = memberType,
-                    MetadataToken = member.MetadataToken,
-                    ExplicitSlot = explicitSlot,
-                    Slot = explicitSlot ?? -1,
+                    Slot = slot,
                     IsName = member.GetCustomAttribute<CultNameAttribute>() != null,
                     IndexAlias = ResolveIndexAlias(member),
                     IsReference = targetType != null || referenceAttribute != null,
@@ -1147,625 +1115,783 @@ namespace GameCult.Caching
         }
     }
 
-    /// <summary>
-    /// In-memory document cache with pluggable persisted backing stores.
-    /// </summary>
+    public enum CultCommitOutcome
+    {
+        Committed,
+        Mismatch,
+        Contended
+    }
+
+    public sealed class CultCommitRequest
+    {
+        internal CultCommitRequest(
+            IReadOnlyList<CultStoredDocument> upserts,
+            IReadOnlyList<CultStoredDocument> deletes,
+            IReadOnlyList<(CultRecordKey Key, string? SchemaId, string? StoredAt)> expected,
+            bool expectUnchanged)
+        {
+            Upserts = upserts;
+            Deletes = deletes;
+            Expected = expected;
+            ExpectUnchanged = expectUnchanged;
+        }
+
+        public IReadOnlyList<CultStoredDocument> Upserts { get; }
+        public IReadOnlyList<CultStoredDocument> Deletes { get; }
+        public IReadOnlyList<(CultRecordKey Key, string? SchemaId, string? StoredAt)> Expected { get; }
+        public bool ExpectUnchanged { get; }
+        public bool HasConditions => Expected.Count > 0 || ExpectUnchanged;
+
+        // durable is what the store holds on disk now; observed is what its cache last loaded or committed.
+        // Identity is (schemaId, storedAt), sound because every write to a key mints a later storedAt.
+        public bool ConditionsHold(IReadOnlyCollection<CultPersistedRecord> durable, IEnumerable<CultStoredDocument> observed)
+        {
+            var byKey = durable.ToDictionary(record => record.Key, StringComparer.Ordinal);
+            foreach (var (key, schemaId, storedAt) in Expected)
+            {
+                byKey.TryGetValue(key.Value, out var record);
+                var holds = schemaId == null
+                    ? record == null
+                    : record != null && record.SchemaId == schemaId && record.StoredAt == storedAt;
+                if (!holds)
+                    return false;
+            }
+
+            return !ExpectUnchanged ||
+                   durable.Select(record => Identity(record.Key, record.SchemaId, record.StoredAt))
+                       .OrderBy(identity => identity, StringComparer.Ordinal)
+                       .SequenceEqual(observed
+                           .Select(stored => Identity(stored.Key.Value, stored.Descriptor.SchemaId, stored.StoredAt))
+                           .OrderBy(identity => identity, StringComparer.Ordinal));
+        }
+
+        private static string Identity(string key, string schemaId, string storedAt) => $"{key}\n{schemaId}\n{storedAt}";
+    }
+
+    // An explicit value: nothing staged here is visible to anyone until Commit returns.
+    public sealed class CultCacheBatch
+    {
+        private readonly CultCache _cache;
+        internal readonly Dictionary<string, (CultRecordKey Key, CultStoredDocument? Stored)> Operations = new(StringComparer.Ordinal);
+        internal readonly List<(CultRecordKey Key, string? SchemaId, string? StoredAt)> Expected = new();
+        internal bool ExpectsUnchanged;
+        internal bool Sealed;
+
+        internal CultCacheBatch(CultCache cache)
+        {
+            _cache = cache;
+        }
+
+        public CultRecordHandle<T> Upsert<T>(T document, CultRecordHandle<T>? handle = null)
+        {
+            if (document == null) throw new ArgumentNullException(nameof(document));
+            return new CultRecordHandle<T>(Stage(document, handle?.Key));
+        }
+
+        public CultRecordKey Upsert(Type type, object document, CultRecordKey? key = null)
+        {
+            CultCache.RequireInstanceOf(type, document);
+            return Stage(document, key);
+        }
+
+        public void Remove(CultRecordKey key)
+        {
+            ThrowIfSealed();
+            Operations[key.Value] = (key, null);
+        }
+
+        public void Expect(CultRecordKey key, object? current)
+        {
+            ThrowIfSealed();
+            var observed = _cache.Observe(key, current);
+            Expected.Add((key, observed?.Descriptor.SchemaId, observed?.StoredAt));
+        }
+
+        public void ExpectUnchanged()
+        {
+            ThrowIfSealed();
+            ExpectsUnchanged = true;
+        }
+
+        private CultRecordKey Stage(object document, CultRecordKey? key)
+        {
+            ThrowIfSealed();
+            var stored = _cache.CreateStoredDocument(document, key);
+            Operations[stored.Key.Value] = (stored.Key, stored);
+            return stored.Key;
+        }
+
+        private void ThrowIfSealed()
+        {
+            if (Sealed)
+                throw new InvalidOperationException("This batch has already been committed or abandoned.");
+        }
+    }
+
     public sealed class CultCache : IDisposable
     {
         private readonly CultDocumentRegistry _registry;
-        private readonly List<CacheBackingStore> _backingStores = new();
-        private readonly ConcurrentDictionary<string, CultStoredDocument> _entries = new(StringComparer.Ordinal);
-        private readonly ConcurrentDictionary<Type, ConcurrentDictionary<string, string>> _nameMaps = new();
-        private readonly ConcurrentDictionary<(Type Type, string Alias), ConcurrentDictionary<string, string>> _indexMaps = new();
-        private readonly ConcurrentDictionary<Type, string> _globalKeys = new();
-        private readonly ConditionalWeakTable<object, DocumentHandleBox> _documentHandles = new();
-        private readonly Subject<object> _changes = new();
-        private readonly CultCacheSoaStore _soa = new();
-        private ILogger _logger = new NullLogger();
-        private bool _hasUnflushedMutations;
+        private readonly List<(CacheBackingStore Store, Type[] Homes)> _stores = new();
+        private readonly Dictionary<string, CultStoredDocument> _entries = new(StringComparer.Ordinal);
+        private readonly Dictionary<Type, Dictionary<string, string>> _names = new();
+        private readonly Dictionary<(Type Type, string Alias), Dictionary<string, string>> _indexes = new();
+        private readonly Dictionary<Type, string> _globals = new();
+        private readonly ConditionalWeakTable<object, KeyBox> _handles = new();
+        private readonly Subject<Change> _changes = new();
+        private readonly object _gate = new();
+        private long _sequence;
+        // The changes admitted by this thread's outermost hold, published by that hold when it exits.
+        [ThreadStatic] private static List<(Change Change, bool Loaded)>? _held;
+        private bool _dirtyInMemory;
 
-        /// <summary>
-        /// Creates a cache using the supplied document registry or the shared registry.
-        /// </summary>
         public CultCache(CultDocumentRegistry? registry = null)
         {
             _registry = registry ?? CultDocumentRegistry.Shared;
-            InitializeGlobals();
         }
 
-        /// <summary>
-        /// Gets or sets the cache logger.
-        /// </summary>
-        public ILogger Logger
-        {
-            get => _logger;
-            set => _logger = value ?? new NullLogger();
-        }
-
-        /// <summary>
-        /// Gets whether the cache currently holds unflushed mutations in any attached backing store or only in memory.
-        /// </summary>
-        public bool IsDirty => _hasUnflushedMutations || _backingStores.Any(store => store.IsDirty);
-
-        /// <summary>
-        /// Gets the UTC timestamp of the last successful flush across all attached backing stores.
-        /// </summary>
-        public DateTimeOffset? LastSuccessfulFlushAtUtc { get; private set; }
-
-        /// <summary>
-        /// Gets or sets whether disposing the cache should flush attached dirty backing stores first.
-        /// </summary>
-        public bool FlushAttachedStoresOnDispose { get; set; }
-
-        /// <summary>
-        /// Raised when a backing store adds, updates, or removes a document.
-        /// </summary>
-        public event Action<object?, object?>? OnUpdate;
-
-        /// <summary>
-        /// Gets attached backing stores in registration order.
-        /// </summary>
-        public IReadOnlyList<CacheBackingStore> BackingStores => _backingStores;
-
-        /// <summary>
-        /// Gets all document instances currently held by the cache.
-        /// </summary>
-        public IEnumerable<object> AllEntries => _entries.Values.Select(entry => entry.Document);
-
-        /// <summary>
-        /// Gets all stored document records currently held by the cache.
-        /// </summary>
-        public IEnumerable<CultStoredDocument> AllStoredDocuments =>
-            _entries.Values.OrderBy(entry => entry.Descriptor.SchemaName, StringComparer.Ordinal)
-                .ThenBy(entry => entry.Key.Value, StringComparer.Ordinal);
-
-        /// <summary>
-        /// Gets the document registry used by this cache.
-        /// </summary>
         public CultDocumentRegistry Registry => _registry;
 
-        /// <summary>
-        /// Opens a reactive POCO presentation for one cache-managed document.
-        /// </summary>
-        public CultManagedDocument<T> Document<T>(CultRecordKey key) where T : class
+        public bool IsDirty
         {
-            return new CultManagedDocument<T>(
-                key,
-                () => Get<T>(key),
-                async value => { await UpsertAsync(value, new CultRecordHandle<T>(key)).ConfigureAwait(false); },
-                WatchRecord<T>(key)
-                    .Where(change => change.Document != null)
-                    .Select(change => change.Document!));
+            get
+            {
+                lock (_gate)
+                    return _stores.Count == 0 ? _dirtyInMemory : _stores.Any(entry => entry.Store.IsDirty);
+            }
+        }
+
+        public bool FlushAttachedStoresOnDispose { get; set; }
+
+        public event Action<object?, object?>? OnUpdate;
+
+        public IReadOnlyList<CacheBackingStore> BackingStores
+        {
+            get
+            {
+                lock (_gate)
+                    return _stores.Select(entry => entry.Store).ToArray();
+            }
+        }
+
+        public IEnumerable<object> AllEntries
+        {
+            get
+            {
+                lock (_gate)
+                    return _entries.Values.Select(entry => entry.Document).ToArray();
+            }
+        }
+
+        public IEnumerable<CultStoredDocument> AllStoredDocuments
+        {
+            get
+            {
+                lock (_gate)
+                    return _entries.Values
+                        .OrderBy(entry => entry.Descriptor.SchemaName, StringComparer.Ordinal)
+                        .ThenBy(entry => entry.Key.Value, StringComparer.Ordinal)
+                        .ToArray();
+            }
         }
 
-        /// <summary>
-        /// Watches all local cache changes assignable to the requested document type.
-        /// </summary>
         public Observable<CultCacheDocumentChange<T>> Watch<T>() where T : class
         {
             return _changes
-                .Where(change => change is CultCacheDocumentChange<T>)
-                .Select(change => (CultCacheDocumentChange<T>)change);
+                .Where(change => typeof(T).IsAssignableFrom(change.Stored.Descriptor.DocumentType))
+                .Select(change => new CultCacheDocumentChange<T>(
+                    change.Kind,
+                    change.Stored.Key,
+                    change.Document as T,
+                    change.Previous as T,
+                    change.Sequence));
         }
 
-        /// <summary>
-        /// Watches one local cache record.
-        /// </summary>
         public Observable<CultCacheDocumentChange<T>> WatchRecord<T>(CultRecordKey key) where T : class
         {
             return Watch<T>().Where(change => change.Key.Equals(key));
         }
 
-        /// <summary>
-        /// Gets the cache-owned structure-of-arrays table for a document type.
-        /// </summary>
-        public CultSoaTable<T> Soa<T>() where T : class
-        {
-            return _soa.Snapshot<T>();
-        }
-
-        /// <summary>
-        /// Attaches a backing store to this cache.
-        /// </summary>
-        public void AddBackingStore(CacheBackingStore store)
+        // Attaching reads the store; there is no interval in which it is attached but unread.
+        public void AddBackingStore(CacheBackingStore store, params Type[] homes)
         {
             if (store == null) throw new ArgumentNullException(nameof(store));
-            store.AttachRegistry(_registry);
-            store.Logger = Logger;
-            store.EntryAdded.Subscribe(entry => AddStoredDocumentInternal(entry, store, raiseUpdate: true).GetAwaiter().GetResult());
-            store.EntryUpdated.Subscribe(entry => AddStoredDocumentInternal(entry, store, raiseUpdate: true).GetAwaiter().GetResult());
-            store.EntryDeleted.Subscribe(entry => RemoveStoredDocumentInternal(entry, store, raiseUpdate: true));
-
-            foreach (var entry in _entries.Values.OrderBy(entry => entry.Key.Value, StringComparer.Ordinal))
+            homes ??= Array.Empty<Type>();
+            Held(() =>
             {
-                store.Push(entry);
-            }
+                if (store.Loaded != null)
+                    throw new InvalidOperationException($"Backing store {store} is already attached to a cache.");
+                if (store.IsDirty)
+                    throw new InvalidOperationException($"Backing store {store} has staged writes; attach it clean.");
+                if (homes.Length == 0 && _stores.Any(entry => entry.Homes.Length == 0))
+                    throw new InvalidOperationException(
+                        $"Backing store {store} would be a second untyped store; name the types it is home to.");
+                foreach (var home in homes)
+                {
+                    var owner = _stores.FirstOrDefault(entry => entry.Homes.Contains(home)).Store;
+                    if (owner != null)
+                        throw new InvalidOperationException($"{home.FullName} is already routed to {owner}; it cannot also route to {store}.");
+                }
 
-            _backingStores.Add(store);
+                var candidate = (store, homes);
+                foreach (var type in _entries.Values.Select(entry => entry.Descriptor).Distinct())
+                {
+                    var before = Home(type.DocumentType);
+                    _stores.Add(candidate);
+                    var after = Home(type.DocumentType);
+                    _stores.RemoveAt(_stores.Count - 1);
+                    if (before != after)
+                        throw new InvalidOperationException(
+                            $"Attaching {store} would move {type.SchemaName} from {before?.ToString() ?? "memory"} to {after}; " +
+                            "attach routed stores before the untyped store.");
+                }
+
+                store.AttachRegistry(_registry);
+                store.Cache = this;
+                store.Loaded = (loaded, dropped) => Admit(loaded, dropped, store, _ => CultCommitOutcome.Committed);
+                _stores.Add(candidate);
+                try
+                {
+                    store.PullAll();
+                }
+                catch
+                {
+                    _stores.Remove(candidate);
+                    store.Loaded = null;
+                    store.Cache = null;
+                    throw;
+                }
+                return true;
+            });
         }
 
-        /// <summary>
-        /// Pulls all documents from every attached backing store.
-        /// </summary>
-        public async Task PullAllBackingStoresAsync()
+        public Task PullAllBackingStoresAsync()
         {
-            foreach (var store in _backingStores)
+            // Our stores take the gate themselves; a third-party store might not, so the cache takes it here.
+            // One store's throwing OnUpdate handler does not stop the others from loading.
+            var failures = new List<Exception>();
+            foreach (var store in BackingStores)
             {
-                store.PullAll();
+                try
+                {
+                    Held(() => { store.PullAll(); return true; });
+                }
+                catch (Exception exception)
+                {
+                    failures.Add(exception);
+                }
             }
 
-            _hasUnflushedMutations = _backingStores.Any(store => store.IsDirty);
-            await Task.CompletedTask;
-        }
-
-        /// <summary>
-        /// Flushes all attached backing stores.
-        /// </summary>
-        public void FlushAllBackingStores(bool soft = false)
-        {
-            foreach (var store in _backingStores)
-            {
-                FlushBackingStore(store, soft);
-            }
-
-            RecomputeDirtyState();
-            if (!IsDirty)
-            {
-                LastSuccessfulFlushAtUtc = DateTimeOffset.UtcNow;
-            }
-        }
-
-        /// <summary>
-        /// Flushes all attached backing stores.
-        /// </summary>
-        public Task FlushAsync(bool soft = false)
-        {
-            FlushAllBackingStores(soft);
+            if (failures.Count == 1)
+                ExceptionDispatchInfo.Capture(failures[0]).Throw();
+            if (failures.Count > 1)
+                throw new AggregateException(failures);
             return Task.CompletedTask;
         }
 
-        /// <summary>
-        /// Flushes one attached backing store.
-        /// </summary>
-        public void FlushBackingStore(CacheBackingStore store, bool soft = false)
+        public void FlushAllBackingStores() => Held(() =>
         {
-            if (store == null) throw new ArgumentNullException(nameof(store));
-            if (!_backingStores.Contains(store))
+            foreach (var (store, _) in _stores)
             {
-                throw new InvalidOperationException("Backing store is not attached to this cache.");
+                if (!store.IsReadOnly && store.IsDirty)
+                    store.PushAll();
             }
+            return true;
+        });
 
-            store.PushAll(soft);
-            RecomputeDirtyState();
-            if (!store.IsDirty)
-            {
-                LastSuccessfulFlushAtUtc = DateTimeOffset.UtcNow;
-            }
-        }
-
-        /// <summary>
-        /// Flushes attached backing stores at a lifecycle boundary such as shutdown or assembly reload.
-        /// </summary>
-        public void PrepareForReloadOrShutdown(bool soft = false)
+        public Task FlushAsync()
         {
-            FlushAllBackingStores(soft);
-        }
-
-        /// <summary>
-        /// Flushes attached backing stores at a lifecycle boundary such as shutdown or assembly reload.
-        /// </summary>
-        public Task PrepareForReloadOrShutdownAsync(bool soft = false)
-        {
-            PrepareForReloadOrShutdown(soft);
+            FlushAllBackingStores();
             return Task.CompletedTask;
         }
 
-        /// <summary>
-        /// Adds or replaces a typed document and returns its record handle.
-        /// </summary>
-        public async Task<CultRecordHandle<T>> AddAsync<T>(T document, CultRecordHandle<T>? handle = null)
+        public Task<CultRecordHandle<T>> AddAsync<T>(T document, CultRecordHandle<T>? handle = null)
         {
-            if (document == null) throw new ArgumentNullException(nameof(document));
-            var stored = await AddStoredDocumentInternal(
-                CreateStoredDocument(typeof(T), document, handle?.Key),
-                source: null,
-                raiseUpdate: false);
-            return new CultRecordHandle<T>(stored.Key);
+            return UpsertAsync(document, handle);
         }
 
-        /// <summary>
-        /// Adds or replaces a typed document and returns its record handle.
-        /// </summary>
         public Task<CultRecordHandle<T>> UpsertAsync<T>(T document, CultRecordHandle<T>? handle = null)
         {
-            return AddAsync(document, handle);
-        }
-
-        /// <summary>
-        /// Adds or replaces a document whose concrete type is known at runtime.
-        /// </summary>
-        public async Task<CultRecordKey> UpsertAsync(Type documentType, object document, CultRecordKey? key = null)
-        {
-            if (documentType == null) throw new ArgumentNullException(nameof(documentType));
             if (document == null) throw new ArgumentNullException(nameof(document));
-            if (!documentType.IsInstanceOfType(document))
-            {
-                throw new ArgumentException(
-                    $"Document instance must be assignable to {documentType.FullName}.",
-                    nameof(document));
-            }
-
-            var stored = await AddStoredDocumentInternal(
-                CreateStoredDocument(documentType, document, key),
-                source: null,
-                raiseUpdate: false).ConfigureAwait(false);
-            return stored.Key;
+            return Task.FromResult(new CultRecordHandle<T>(Write(document, handle?.Key)));
+        }
+
+        public Task<CultRecordKey> UpsertAsync(Type documentType, object document, CultRecordKey? key = null)
+        {
+            RequireInstanceOf(documentType, document);
+            return Task.FromResult(Write(document, key));
+        }
+
+        public bool Remove(CultRecordKey key) => Held(() =>
+        {
+            if (!_entries.TryGetValue(key.Value, out var existing))
+                return false;
+            Admit(Array.Empty<CultStoredDocument>(), new[] { existing }, null, home =>
+            {
+                home?.Delete(existing);
+                return CultCommitOutcome.Committed;
+            });
+            return true;
+        });
+
+        public void Remove<T>(CultRecordHandle<T> handle)
+        {
+            Remove(handle.Key);
+        }
+
+        // false: a condition failed; nothing was written, changed in memory, or published.
+        public bool Commit(Action<CultCacheBatch> stage)
+        {
+            return Land(stage, wait: true) == CultCommitOutcome.Committed;
+        }
+
+        public CultCommitOutcome TryCommit(Action<CultCacheBatch> stage)
+        {
+            return Land(stage, wait: false);
         }
 
-        /// <summary>
-        /// Gets the record handle for a document instance, if it is tracked.
-        /// </summary>
         public CultRecordHandle<T>? TryGetHandle<T>(T document)
         {
             if (document == null) throw new ArgumentNullException(nameof(document));
-            return _documentHandles.TryGetValue(document, out var box)
-                ? new CultRecordHandle<T>(box.Key)
-                : null;
+            lock (_gate)
+                return _handles.TryGetValue(document, out var box) ? new CultRecordHandle<T>(box.Key) : null;
         }
 
-        /// <summary>
-        /// Gets a document by record key.
-        /// </summary>
         public object? Get(CultRecordKey key)
         {
-            return _entries.TryGetValue(key.Value, out var stored)
-                ? stored.Document
-                : null;
+            lock (_gate)
+                return _entries.TryGetValue(key.Value, out var stored) ? stored.Document : null;
         }
 
-        /// <summary>
-        /// Gets a typed document by record key.
-        /// </summary>
         public T? Get<T>(CultRecordKey key) where T : class
         {
             return Get(key) as T;
         }
 
-        /// <summary>
-        /// Tries to get a typed document by record key.
-        /// </summary>
+        // Every change whose Sequence is at or below the returned one is reflected in the returned document.
+        public (object? Document, long Sequence) GetWithSequence(CultRecordKey key)
+        {
+            lock (_gate)
+                return (_entries.TryGetValue(key.Value, out var stored) ? stored.Document : null, _sequence);
+        }
+
         public bool TryGet<T>(CultRecordKey key, out T? document) where T : class
         {
             document = Get<T>(key);
             return document != null;
         }
 
-        /// <summary>
-        /// Gets all cached documents assignable to the requested type.
-        /// </summary>
         public IEnumerable<T> GetAll<T>() where T : class
         {
-            var type = typeof(T);
-            return _entries.Values
-                .Where(entry => type.IsAssignableFrom(entry.Descriptor.DocumentType))
-                .Select(entry => (T)entry.Document);
+            lock (_gate)
+                return _entries.Values.Select(entry => entry.Document).OfType<T>().ToArray();
         }
 
-        /// <summary>
-        /// Gets the global document for the requested type, if one exists.
-        /// </summary>
         public T? GetGlobal<T>() where T : class
         {
-            return _globalKeys.TryGetValue(typeof(T), out var key)
-                ? Get<T>(new CultRecordKey(key))
-                : null;
+            return Single<T>("global", () => _globals
+                .Where(pair => typeof(T).IsAssignableFrom(pair.Key))
+                .Select(pair => pair.Value));
         }
 
-        /// <summary>
-        /// Gets a typed document by its CultName value.
-        /// </summary>
         public T? GetByName<T>(string name) where T : class
         {
-            var type = typeof(T);
-            if (_nameMaps.TryGetValue(type, out var map) &&
-                map.TryGetValue(name, out var key))
-            {
-                return Get<T>(new CultRecordKey(key));
-            }
-
-            return null;
+            return Single<T>($"name '{name}'", () => _names
+                .Where(pair => typeof(T).IsAssignableFrom(pair.Key))
+                .SelectMany(pair => pair.Value.TryGetValue(name, out var key) ? new[] { key } : Array.Empty<string>()));
         }
 
-        /// <summary>
-        /// Tries to get a typed document by its CultName value.
-        /// </summary>
-        public bool TryGetByName<T>(string name, out T? document) where T : class
-        {
-            document = GetByName<T>(name);
-            return document != null;
-        }
-
-        /// <summary>
-        /// Gets a typed document by an indexed value.
-        /// </summary>
         public T? GetByIndex<T>(string alias, string value) where T : class
         {
-            if (_indexMaps.TryGetValue((typeof(T), alias), out var map) &&
-                map.TryGetValue(value, out var key))
-            {
-                return Get<T>(new CultRecordKey(key));
-            }
-
-            return null;
+            return Single<T>($"index {alias}='{value}'", () => _indexes
+                .Where(pair => pair.Key.Alias == alias && typeof(T).IsAssignableFrom(pair.Key.Type))
+                .SelectMany(pair => pair.Value.TryGetValue(value, out var key) ? new[] { key } : Array.Empty<string>()));
         }
 
-        /// <summary>
-        /// Tries to get a typed document by an indexed value.
-        /// </summary>
-        public bool TryGetByIndex<T>(string alias, string value, out T? document) where T : class
-        {
-            document = GetByIndex<T>(alias, value);
-            return document != null;
-        }
-
-        /// <summary>
-        /// Resolves a typed document reference against this cache.
-        /// </summary>
-        public T? Resolve<T>(CultRecordRef<T> reference) where T : class
-        {
-            return Get<T>(reference.Key);
-        }
-
-        /// <summary>
-        /// Removes a document by typed handle.
-        /// </summary>
-        public void Remove<T>(CultRecordHandle<T> handle)
-        {
-            if (_entries.TryGetValue(handle.Key.Value, out var stored))
-            {
-                RemoveStoredDocumentInternal(stored, source: null, raiseUpdate: false);
-            }
-        }
-
-        /// <summary>
-        /// Removes a document by cache-owned record key.
-        /// </summary>
-        public bool Remove(CultRecordKey key)
-        {
-            if (!_entries.TryGetValue(key.Value, out var stored))
-            {
-                return false;
-            }
-
-            RemoveStoredDocumentInternal(stored, source: null, raiseUpdate: false);
-            return true;
-        }
-
-        /// <summary>
-        /// Removes a document by typed handle.
-        /// </summary>
-        public Task DeleteAsync<T>(CultRecordHandle<T> handle)
-        {
-            Remove(handle);
-            return Task.CompletedTask;
-        }
-
-        /// <summary>
-        /// Disposes attached disposable backing stores.
-        /// </summary>
         public void Dispose()
         {
-            if (FlushAttachedStoresOnDispose && IsDirty)
+            Held(() =>
             {
-                FlushAllBackingStores();
-            }
+                if (FlushAttachedStoresOnDispose && IsDirty)
+                    FlushAllBackingStores();
+                return true;
+            });
 
-            foreach (var store in _backingStores.OfType<IDisposable>())
-            {
+            foreach (var store in BackingStores)
                 store.Dispose();
-            }
 
             _changes.Dispose();
         }
 
-        internal CultStoredDocument CreateStoredDocument(Type documentType, object document, CultRecordKey? key = null, string? storedAt = null)
+        internal static void RequireInstanceOf(Type documentType, object document)
         {
-            var descriptor = _registry.GetRequired(documentType);
-            var resolvedKey = key ?? ResolveKey(document, descriptor);
-            return new CultStoredDocument(
-                resolvedKey,
-                storedAt ?? DateTimeOffset.UtcNow.ToString("O"),
-                descriptor,
-                document);
+            if (documentType == null) throw new ArgumentNullException(nameof(documentType));
+            if (document == null) throw new ArgumentNullException(nameof(document));
+            if (!documentType.IsInstanceOfType(document))
+                throw new ArgumentException($"Document instance must be assignable to {documentType.FullName}.", nameof(document));
         }
 
-        private async Task<CultStoredDocument> AddStoredDocumentInternal(
-            CultStoredDocument stored,
-            CacheBackingStore? source,
-            bool raiseUpdate)
+        // The runtime type decides the schema; a minted storedAt is always later than the record it replaces.
+        internal CultStoredDocument CreateStoredDocument(object document, CultRecordKey? key)
         {
-            CultStoredDocument? existing = null;
-            _entries.TryGetValue(stored.Key.Value, out existing);
-            if (existing != null)
+            var descriptor = _registry.GetRequired(document.GetType());
+            lock (_gate)
+                return Stamp(
+                    key ?? (_handles.TryGetValue(document, out var box) ? box.Key
+                        : descriptor.IsGlobal ? new CultRecordKey($"global:{descriptor.SchemaId}")
+                        : new CultRecordKey(Guid.NewGuid().ToString("N"))),
+                    descriptor,
+                    document);
+        }
+
+        // Call under the gate that admits the result, so no load can land a later storedAt in between.
+        private CultStoredDocument Stamp(CultRecordKey key, CultDocumentDescriptor descriptor, object document) =>
+            new(key, MintStoredAt(_entries.TryGetValue(key.Value, out var previous) ? previous.StoredAt : null), descriptor, document);
+
+        internal CultStoredDocument? Observe(CultRecordKey key, object? current)
+        {
+            if (current == null)
+                return null;
+            lock (_gate)
             {
-                RemoveIndexes(existing);
+                if (_handles.TryGetValue(current, out var box) && box.Key.Equals(key) &&
+                    _entries.TryGetValue(key.Value, out var stored) && ReferenceEquals(stored.Document, current))
+                    return stored;
             }
 
-            _entries[stored.Key.Value] = stored;
-            _documentHandles.Remove(stored.Document);
-            _documentHandles.Add(stored.Document, new DocumentHandleBox(stored.Key));
-            _soa.Upsert(stored);
-            AddIndexes(stored);
+            throw new ArgumentException($"Expect({key.Value}) was given an instance this cache does not hold at that key.", nameof(current));
+        }
 
-            foreach (var store in _backingStores)
+        private static string MintStoredAt(string? previous)
+        {
+            var now = DateTimeOffset.UtcNow;
+            if (previous != null &&
+                DateTimeOffset.TryParse(previous, CultureInfo.InvariantCulture, DateTimeStyles.RoundtripKind, out var last) &&
+                now <= last)
+                now = last.ToUniversalTime().AddTicks(1);
+            return now.ToString("O", CultureInfo.InvariantCulture);
+        }
+
+        private CultRecordKey Write(object document, CultRecordKey? key) => Held(() =>
+        {
+            var stored = CreateStoredDocument(document, key);
+            Admit(new[] { stored }, Array.Empty<CultStoredDocument>(), null, home =>
             {
-                if (store != source)
+                home?.Push(stored);
+                return CultCommitOutcome.Committed;
+            });
+            return stored.Key;
+        });
+
+        private CultCommitOutcome Land(Action<CultCacheBatch> stage, bool wait)
+        {
+            if (stage == null) throw new ArgumentNullException(nameof(stage));
+            var batch = new CultCacheBatch(this);
+            try
+            {
+                stage(batch);
+            }
+            finally
+            {
+                batch.Sealed = true;
+            }
+
+            // The in-process gate is always entered; only the store lock attempt honors wait, so Contended means another writer holds the store.
+            return Held(() =>
+            {
+                // Staging stamped outside this gate; a pull since then may hold a later storedAt, so stamp again.
+                var upserts = batch.Operations.Values
+                    .Where(op => op.Stored != null)
+                    .Select(op => Stamp(op.Key, op.Stored!.Descriptor, op.Stored.Document))
+                    .ToArray();
+                var deletes = batch.Operations.Values
+                    .Where(op => op.Stored == null && _entries.ContainsKey(op.Key.Value))
+                    .Select(op => _entries[op.Key.Value])
+                    .ToArray();
+                var request = new CultCommitRequest(upserts, deletes, batch.Expected.ToArray(), batch.ExpectsUnchanged);
+                return Admit(upserts, deletes, null, home =>
                 {
-                    store.Push(stored);
+                    if (home != null)
+                    {
+                        if (request.HasConditions && home.IsDirty)
+                            throw new InvalidOperationException($"Backing store {home} has staged writes; flush before a conditional commit.");
+                        return home.CommitBatch(request, wait);
+                    }
+
+                    if (request.HasConditions && _stores.Count > 0)
+                        throw new InvalidOperationException("A conditional batch names its home store through a record it upserts or removes.");
+                    var inMemory = _entries.Values
+                        .Select(entry => new CultPersistedRecord { Key = entry.Key.Value, SchemaId = entry.Descriptor.SchemaId, StoredAt = entry.StoredAt })
+                        .ToArray();
+                    return request.ConditionsHold(inMemory, _entries.Values) ? CultCommitOutcome.Committed : CultCommitOutcome.Mismatch;
+                });
+            });
+        }
+
+        // Every add and remove passes here: single writes, committed batches, and loads (source set).
+        // Nothing lands unless all of it is admissible; land is the durable step between validation and memory.
+        private CultCommitOutcome Admit(
+            IReadOnlyList<CultStoredDocument> admitted,
+            IReadOnlyList<CultStoredDocument> evicted,
+            CacheBackingStore? source,
+            Func<CacheBackingStore?, CultCommitOutcome> land) => Held(() =>
+        {
+            if (_held == null)
+                throw new InvalidOperationException("An admission reached the cache under a plain lock on its gate; every admission runs in a hold.");
+            var outcome = land(Validate(admitted, evicted, source));
+            if (outcome != CultCommitOutcome.Committed)
+                return outcome;
+            foreach (var change in Apply(admitted, evicted, source))
+                _held.Add((change, source != null));
+            return CultCommitOutcome.Committed;
+        });
+
+        // Every admission runs in a hold. A nested hold on the same cache adds to the outermost one, which publishes
+        // exactly its own changes after it leaves the gate, before it returns, on its caller's thread: observers never
+        // run under the gate, and a write an observer makes is a new outermost hold. Cross-thread delivery order is not
+        // guaranteed; each change carries the Sequence it was admitted with. Every change is delivered even if an
+        // OnUpdate handler throws; then the first handler exception (an AggregateException for several) is rethrown.
+        // If the body threw, its exception wins.
+        internal T Held<T>(Func<T> body)
+        {
+            if (Monitor.IsEntered(_gate))
+                return body();
+            if (_held != null)
+                throw new InvalidOperationException(
+                    "A cache hold was entered inside another cache's hold; a thread holds one cache's gate at a time.");
+            var mine = _held = new List<(Change Change, bool Loaded)>();
+            T result;
+            try
+            {
+                lock (_gate)
+                    result = body();
+            }
+            catch
+            {
+                _held = null;
+                Publish(mine);
+                throw;
+            }
+
+            _held = null;
+            var failures = Publish(mine);
+            if (failures.Count == 1)
+                ExceptionDispatchInfo.Capture(failures[0]).Throw();
+            if (failures.Count > 1)
+                throw new AggregateException(failures);
+            return result;
+        }
+
+        private List<Exception> Publish(List<(Change Change, bool Loaded)> changes)
+        {
+            var failures = new List<Exception>();
+            foreach (var (change, loaded) in changes)
+            {
+                // R3 routes a throwing subscriber to its unhandled-exception handler; OnNext does not throw.
+                _changes.OnNext(change);
+                if (!loaded)
+                    continue;
+                try
+                {
+                    OnUpdate?.Invoke(change.Previous, change.Document);
+                }
+                catch (Exception exception)
+                {
+                    failures.Add(exception);
                 }
             }
 
-            if (source == null)
-            {
-                _hasUnflushedMutations = true;
-            }
-            else
-            {
-                RecomputeDirtyState();
-            }
-
-            PublishChange(stored, existing?.Document);
-
-            if (raiseUpdate)
-            {
-                OnUpdate?.Invoke(existing?.Document, stored.Document);
-            }
-
-            await Task.CompletedTask;
-            return stored;
+            return failures;
         }
 
-        private void RemoveStoredDocumentInternal(
-            CultStoredDocument stored,
-            CacheBackingStore? source,
-            bool raiseUpdate)
+        private CacheBackingStore? Validate(
+            IReadOnlyList<CultStoredDocument> admitted,
+            IReadOnlyList<CultStoredDocument> evicted,
+            CacheBackingStore? source)
         {
-            if (!_entries.TryRemove(stored.Key.Value, out var existing))
+            var homes = new List<CacheBackingStore>();
+            var globals = new Dictionary<Type, string>(_globals);
+            foreach (var stored in evicted)
             {
-                return;
+                var type = stored.Descriptor.DocumentType;
+                if (globals.TryGetValue(type, out var key) && key == stored.Key.Value)
+                    globals.Remove(type);
+                if (source == null)
+                    Claim(stored);
             }
 
-            RemoveIndexes(existing);
-            _documentHandles.Remove(existing.Document);
-            _soa.Remove(existing);
-
-            foreach (var store in _backingStores)
+            foreach (var stored in admitted)
             {
-                if (store != source)
+                var descriptor = stored.Descriptor;
+                if (source == null)
+                    Claim(stored);
+                else if (Home(descriptor.DocumentType) is var home && home != source)
+                    throw new InvalidOperationException(
+                        $"{descriptor.SchemaName} record {stored.Key.Value} was loaded from {source} but its home is {home?.ToString() ?? "no store"}.");
+
+                // One key, one store: a key never moves between homes, and two stores never both deliver it.
+                if (_entries.TryGetValue(stored.Key.Value, out var present) &&
+                    Home(present.Descriptor.DocumentType) is var held &&
+                    Home(descriptor.DocumentType) is var incoming &&
+                    held != incoming)
+                    throw new InvalidOperationException(
+                        $"Record {stored.Key.Value} is held by {held?.ToString() ?? "memory"}; " +
+                        $"{(source == null ? "writing" : "loading")} it as {descriptor.SchemaName} from {incoming?.ToString() ?? "memory"} would give the key a second store.");
+
+                if (!descriptor.IsGlobal)
+                    continue;
+                if (globals.TryGetValue(descriptor.DocumentType, out var existing) && existing != stored.Key.Value)
+                    throw new InvalidOperationException(
+                        $"{descriptor.SchemaName} is a global and already has record {existing}; {stored.Key.Value} would be a second.");
+                globals[descriptor.DocumentType] = stored.Key.Value;
+            }
+
+            var distinct = homes.Distinct().ToArray();
+            if (distinct.Length > 1)
+                throw new InvalidOperationException(
+                    $"The batch spans {distinct[0]} and {distinct[1]}; a commit lands in one home store.");
+            return distinct.FirstOrDefault();
+
+            void Claim(CultStoredDocument stored)
+            {
+                var home = Home(stored.Descriptor.DocumentType);
+                if (home == null)
                 {
-                    store.Delete(existing);
+                    if (_stores.Count > 0)
+                        throw new InvalidOperationException($"No backing store is home to {stored.Descriptor.SchemaName}.");
+                    return;
                 }
-            }
 
-            if (source == null)
-            {
-                _hasUnflushedMutations = true;
-            }
-            else
-            {
-                RecomputeDirtyState();
-            }
-
-            PublishChange(existing, existing.Document, removed: true);
-
-            if (raiseUpdate)
-            {
-                OnUpdate?.Invoke(existing.Document, null);
+                if (home.IsReadOnly)
+                    throw new InvalidOperationException(
+                        $"{stored.Descriptor.SchemaName} record {stored.Key.Value} routes to read-only backing store {home}.");
+                homes.Add(home);
             }
         }
 
-        private void InitializeGlobals()
+        private List<Change> Apply(
+            IReadOnlyList<CultStoredDocument> admitted,
+            IReadOnlyList<CultStoredDocument> evicted,
+            CacheBackingStore? source)
         {
-            foreach (var descriptor in _registry.AllDescriptors.Where(candidate => candidate.IsGlobal))
+            var changes = new List<Change>(admitted.Count + evicted.Count);
+            foreach (var stored in evicted)
             {
-                if (descriptor.DocumentType.GetConstructor(Type.EmptyTypes) == null)
+                if (!_entries.TryGetValue(stored.Key.Value, out var existing))
+                    continue;
+                Unindex(existing);
+                _entries.Remove(stored.Key.Value);
+                _handles.Remove(existing.Document);
+                changes.Add(new Change(CultCacheDocumentChangeKind.Removed, existing, null, existing.Document, ++_sequence));
+            }
+
+            foreach (var stored in admitted)
+            {
+                _entries.TryGetValue(stored.Key.Value, out var previous);
+                if (previous != null)
                 {
+                    Unindex(previous);
+                    _handles.Remove(previous.Document);
+                }
+
+                _entries[stored.Key.Value] = stored;
+                _handles.AddOrUpdate(stored.Document, new KeyBox(stored.Key));
+                Index(stored);
+                changes.Add(new Change(
+                    previous == null ? CultCacheDocumentChangeKind.Added : CultCacheDocumentChangeKind.Updated,
+                    stored,
+                    stored.Document,
+                    previous?.Document,
+                    ++_sequence));
+            }
+
+            if (source == null && _stores.Count == 0)
+                _dirtyInMemory = true;
+            return changes;
+        }
+
+        // The most derived routed home type assignable from the document type, else the untyped store.
+        private CacheBackingStore? Home(Type documentType)
+        {
+            CacheBackingStore? untyped = null;
+            CacheBackingStore? routed = null;
+            Type? best = null;
+            foreach (var (store, homes) in _stores)
+            {
+                if (homes.Length == 0)
+                {
+                    untyped = store;
                     continue;
                 }
 
-                var instance = Activator.CreateInstance(descriptor.DocumentType);
-                if (instance == null)
+                foreach (var home in homes)
                 {
-                    continue;
+                    if (home.IsAssignableFrom(documentType) && (best == null || best.IsAssignableFrom(home)))
+                    {
+                        best = home;
+                        routed = store;
+                    }
                 }
+            }
 
-                AddStoredDocumentInternal(
-                    new CultStoredDocument(
-                        new CultRecordKey($"global:{descriptor.SchemaId}"),
-                        DateTimeOffset.UtcNow.ToString("O"),
-                        descriptor,
-                        instance),
-                    source: null,
-                    raiseUpdate: false).GetAwaiter().GetResult();
+            return routed ?? untyped;
+        }
+
+        private T? Single<T>(string lookup, Func<IEnumerable<string>> keys) where T : class
+        {
+            lock (_gate)
+            {
+                var found = keys().Distinct().ToArray();
+                if (found.Length > 1)
+                    throw new InvalidOperationException(
+                        $"{typeof(T).Name} {lookup} matches records {string.Join(", ", found)}; look it up by its concrete type.");
+                return found.Length == 1 && _entries.TryGetValue(found[0], out var stored) ? stored.Document as T : null;
             }
         }
 
-        private CultRecordKey ResolveKey(object document, CultDocumentDescriptor descriptor)
-        {
-            if (_documentHandles.TryGetValue(document, out var existing))
-            {
-                return existing.Key;
-            }
-
-            if (descriptor.IsGlobal)
-            {
-                return new CultRecordKey($"global:{descriptor.SchemaId}");
-            }
-
-            return new CultRecordKey(Guid.NewGuid().ToString("N"));
-        }
-
-        private void AddIndexes(CultStoredDocument stored)
+        private void Index(CultStoredDocument stored)
         {
+            var type = stored.Descriptor.DocumentType;
             if (stored.Descriptor.IsGlobal)
-            {
-                _globalKeys[stored.Descriptor.DocumentType] = stored.Key.Value;
-            }
-
+                _globals[type] = stored.Key.Value;
             if (stored.Descriptor.NameAccessor?.Invoke(stored.Document) is { Length: > 0 } name)
-            {
-                var map = _nameMaps.GetOrAdd(
-                    stored.Descriptor.DocumentType,
-                    _ => new ConcurrentDictionary<string, string>(StringComparer.Ordinal));
-                map[name] = stored.Key.Value;
-            }
-
+                MapOf(_names, type)[name] = stored.Key.Value;
             foreach (var pair in stored.Descriptor.IndexAccessors)
             {
                 var value = pair.Value(stored.Document);
-                if (string.IsNullOrWhiteSpace(value))
-                {
-                    continue;
-                }
-
-                var map = _indexMaps.GetOrAdd(
-                    (stored.Descriptor.DocumentType, pair.Key),
-                    _ => new ConcurrentDictionary<string, string>(StringComparer.Ordinal));
-                map[value] = stored.Key.Value;
+                if (!string.IsNullOrWhiteSpace(value))
+                    MapOf(_indexes, (type, pair.Key))[value] = stored.Key.Value;
             }
         }
 
-        private void RemoveIndexes(CultStoredDocument stored)
+        // Documents are mutable, so a name or index value may have changed since it was indexed: drop by key.
+        private void Unindex(CultStoredDocument stored)
         {
-            if (stored.Descriptor.IsGlobal)
-            {
-                _globalKeys.TryRemove(stored.Descriptor.DocumentType, out _);
-            }
-
-            if (stored.Descriptor.NameAccessor?.Invoke(stored.Document) is { Length: > 0 } name &&
-                _nameMaps.TryGetValue(stored.Descriptor.DocumentType, out var nameMap))
-            {
-                nameMap.TryRemove(name, out _);
-            }
-
-            foreach (var pair in stored.Descriptor.IndexAccessors)
-            {
-                var value = pair.Value(stored.Document);
-                if (string.IsNullOrWhiteSpace(value))
-                {
-                    continue;
-                }
-
-                if (_indexMaps.TryGetValue((stored.Descriptor.DocumentType, pair.Key), out var map))
-                {
-                    map.TryRemove(value, out _);
-                }
-            }
+            var type = stored.Descriptor.DocumentType;
+            if (_globals.TryGetValue(type, out var globalKey) && globalKey == stored.Key.Value)
+                _globals.Remove(type);
+            if (_names.TryGetValue(type, out var names))
+                RemoveKey(names, stored.Key.Value);
+            foreach (var pair in _indexes.Where(pair => pair.Key.Type == type))
+                RemoveKey(pair.Value, stored.Key.Value);
         }
 
-        private sealed class DocumentHandleBox
+        private static Dictionary<string, string> MapOf<TKey>(Dictionary<TKey, Dictionary<string, string>> maps, TKey key)
+            where TKey : notnull
         {
-            public DocumentHandleBox(CultRecordKey key)
+            if (!maps.TryGetValue(key, out var map))
+                maps[key] = map = new Dictionary<string, string>(StringComparer.Ordinal);
+            return map;
+        }
+
+        private static void RemoveKey(Dictionary<string, string> map, string key)
+        {
+            foreach (var stale in map.Where(pair => pair.Value == key).Select(pair => pair.Key).ToArray())
+                map.Remove(stale);
+        }
+
+        private sealed class KeyBox
+        {
+            public KeyBox(CultRecordKey key)
             {
                 Key = key;
             }
@@ -1773,138 +1899,97 @@ namespace GameCult.Caching
             public CultRecordKey Key { get; }
         }
 
-        private void RecomputeDirtyState()
+        private sealed class Change
         {
-            _hasUnflushedMutations = _backingStores.Count == 0
-                ? _hasUnflushedMutations
-                : _backingStores.Any(store => store.IsDirty);
-        }
-
-        private void PublishChange(CultStoredDocument stored, object? previousDocument, bool removed = false)
-        {
-            var changeType = typeof(CultCacheDocumentChange<>).MakeGenericType(stored.Descriptor.DocumentType);
-            var change = Activator.CreateInstance(
-                changeType,
-                removed ? CultCacheDocumentChangeKind.Removed :
-                previousDocument == null ? CultCacheDocumentChangeKind.Added :
-                CultCacheDocumentChangeKind.Updated,
-                stored.Key,
-                removed ? null : stored.Document,
-                previousDocument);
-            if (change != null)
+            public Change(CultCacheDocumentChangeKind kind, CultStoredDocument stored, object? document, object? previous, long sequence)
             {
-                _changes.OnNext(change);
+                Kind = kind;
+                Stored = stored;
+                Document = document;
+                Previous = previous;
+                Sequence = sequence;
             }
+
+            public CultCacheDocumentChangeKind Kind { get; }
+            public CultStoredDocument Stored { get; }
+            public object? Document { get; }
+            public object? Previous { get; }
+            public long Sequence { get; }
         }
     }
 
-    /// <summary>
-    /// Base class for CultCache persistence adapters.
-    /// </summary>
     public abstract class CacheBackingStore : IDisposable
     {
         private CultDocumentRegistry? _registry;
-        private ILogger _logger = new NullLogger();
-        private bool _isDirty;
         private CultSchemaMigrationReport[] _lastSchemaMigrationReports = Array.Empty<CultSchemaMigrationReport>();
 
-        /// <summary>
-        /// Gets the attached document registry.
-        /// </summary>
+        protected CacheBackingStore(bool readOnly = false)
+        {
+            IsReadOnly = readOnly;
+        }
+
         protected CultDocumentRegistry Registry =>
             _registry ?? throw new InvalidOperationException("Backing store is not attached to a CultDocumentRegistry.");
 
-        /// <summary>
-        /// Gets the backing store entries by record key.
-        /// </summary>
         protected ConcurrentDictionary<string, CultStoredDocument> Entries { get; } =
             new(StringComparer.Ordinal);
 
-        /// <summary>
-        /// Gets or sets the backing store logger.
-        /// </summary>
-        public ILogger Logger
-        {
-            get => _logger;
-            set => _logger = value ?? new NullLogger();
-        }
+        public bool IsReadOnly { get; }
 
-        /// <summary>
-        /// Gets whether the backing store holds staged mutations not yet durably flushed.
-        /// </summary>
-        public bool IsDirty
-        {
-            get => _isDirty;
-            protected set => _isDirty = value;
-        }
+        public bool IsDirty { get; protected set; }
 
-        /// <summary>
-        /// Gets the UTC timestamp of the last successful durable flush.
-        /// </summary>
-        public DateTimeOffset? LastSuccessfulFlushAtUtc { get; protected set; }
-
-        /// <summary>
-        /// Gets or sets whether disposing the backing store should flush staged mutations first.
-        /// </summary>
         public bool FlushOnDispose { get; set; }
 
-        /// <summary>
-        /// Gets schema migration reports emitted during the most recent pull.
-        /// </summary>
         public IReadOnlyList<CultSchemaMigrationReport> LastSchemaMigrationReports => _lastSchemaMigrationReports;
 
-        /// <summary>
-        /// Publishes documents added by the backing store.
-        /// </summary>
-        public Subject<CultStoredDocument> EntryAdded { get; } = new();
-        /// <summary>
-        /// Publishes documents updated by the backing store.
-        /// </summary>
-        public Subject<CultStoredDocument> EntryUpdated { get; } = new();
-        /// <summary>
-        /// Publishes documents deleted by the backing store.
-        /// </summary>
-        public Subject<CultStoredDocument> EntryDeleted { get; } = new();
+        // Set by the cache at attach. A pull hands over everything it loaded and dropped in one call before it adopts
+        // any of it; if the cache refuses a record the call throws and the store keeps its previous view.
+        protected internal Action<IReadOnlyList<CultStoredDocument>, IReadOnlyList<CultStoredDocument>>? Loaded;
+
+        private readonly object _detachedGate = new();
+        internal CultCache? Cache;
+
+        // Once attached, a hold on the cache's gate: the store and its cache share one lock, so a load calling back into
+        // the cache can never take the gate after the store lock, and a direct call publishes what it loaded when it
+        // returns. File locks are always taken inside it.
+        protected T Held<T>(Func<T> body)
+        {
+            if (Cache is { } cache)
+                return cache.Held(body);
+            lock (_detachedGate)
+                return body();
+        }
+
+        protected void Held(Action body) => Held(() => { body(); return true; });
 
         internal void AttachRegistry(CultDocumentRegistry registry)
         {
             _registry = registry ?? throw new ArgumentNullException(nameof(registry));
         }
 
-        /// <summary>
-        /// Pulls all persisted records into the backing store.
-        /// </summary>
         public abstract void PullAll();
-        /// <summary>
-        /// Pushes one stored document into the backing store.
-        /// </summary>
         public abstract void Push(CultStoredDocument entry);
-        /// <summary>
-        /// Deletes one stored document from the backing store.
-        /// </summary>
         public abstract void Delete(CultStoredDocument entry);
-        /// <summary>
-        /// Persists all current backing store entries.
-        /// </summary>
-        public abstract void PushAll(bool soft = false);
-        /// <summary>
-        /// Releases backing store event subjects.
-        /// </summary>
+        public abstract void PushAll();
+
+        // One durable step under the store's exclusive lock; conditions are evaluated against what is on disk then.
+        // A failure restores the store's staged view.
+        public abstract CultCommitOutcome CommitBatch(CultCommitRequest request, bool wait);
+
         public virtual void Dispose()
         {
-            if (FlushOnDispose && IsDirty)
+            if (FlushOnDispose && IsDirty && !IsReadOnly)
             {
                 PushAll();
             }
-
-            EntryAdded.Dispose();
-            EntryUpdated.Dispose();
-            EntryDeleted.Dispose();
         }
 
-        /// <summary>
-        /// Converts a stored document into a persisted record.
-        /// </summary>
+        protected void ThrowIfReadOnly()
+        {
+            if (IsReadOnly)
+                throw new InvalidOperationException($"Backing store {this} is read-only.");
+        }
+
         protected CultPersistedRecord ToPersistedRecord(CultStoredDocument entry, Func<object, byte[]> serializePayload)
         {
             return new CultPersistedRecord
@@ -1916,9 +2001,6 @@ namespace GameCult.Caching
             };
         }
 
-        /// <summary>
-        /// Converts a persisted record into a stored document.
-        /// </summary>
         protected CultStoredDocument ToStoredDocument(
             CultPersistedRecord record,
             IReadOnlyCollection<CultSchemaCatalogEntry> catalog,
@@ -1933,124 +2015,206 @@ namespace GameCult.Caching
                 document);
         }
 
-        /// <summary>
-        /// Records schema migration reports captured during a pull.
-        /// </summary>
         protected void SetLastSchemaMigrationReports(IEnumerable<CultSchemaMigrationReport> reports)
         {
             _lastSchemaMigrationReports = reports?.ToArray() ?? Array.Empty<CultSchemaMigrationReport>();
         }
 
-        /// <summary>
-        /// Marks the backing store as durably flushed.
-        /// </summary>
         protected void MarkFlushSucceeded()
         {
             IsDirty = false;
-            LastSuccessfulFlushAtUtc = DateTimeOffset.UtcNow;
         }
     }
 
-    /// <summary>
-    /// Base class for backing stores that persist a complete snapshot to one file.
-    /// </summary>
     public abstract class SingleFileBackingStore : CacheBackingStore
     {
-        /// <summary>
-        /// Creates a single-file backing store.
-        /// </summary>
-        protected SingleFileBackingStore(string filePath)
+        protected SingleFileBackingStore(string filePath, bool readOnly = false)
+            : base(readOnly)
         {
             FileInfo = new FileInfo(filePath);
         }
 
-        /// <summary>
-        /// Gets the file used by this backing store.
-        /// </summary>
         protected FileInfo FileInfo { get; }
-        /// <summary>
-        /// Serializes a full store snapshot.
-        /// </summary>
         protected abstract byte[] SerializeSnapshot(CultPersistedStoreSnapshot snapshot);
-        /// <summary>
-        /// Deserializes a full store snapshot.
-        /// </summary>
         protected abstract CultPersistedStoreSnapshot DeserializeSnapshot(byte[] data);
-        /// <summary>
-        /// Serializes one document payload.
-        /// </summary>
         protected abstract byte[] SerializePayload(object document);
-        /// <summary>
-        /// Deserializes one document payload.
-        /// </summary>
         protected abstract object DeserializePayload(Type documentType, byte[] payload);
 
-        /// <summary>
-        /// Loads every persisted record from disk.
-        /// </summary>
-        public override void PullAll()
+        public override string ToString() => FileInfo.FullName;
+
+        public override void PullAll() => Held(PullAllCore);
+
+        private void PullAllCore()
         {
-            if (!FileInfo.Exists)
+            // A single-file snapshot cannot distinguish local dirty keys from clean keys. Pulling while local mutations
+            // are staged would let an older disk snapshot erase them before the next flush. Flush first.
+            if (IsDirty)
+                return;
+
+            var snapshot = ReadSnapshot();
+            if (snapshot == null)
             {
                 SetLastSchemaMigrationReports(Array.Empty<CultSchemaMigrationReport>());
-                IsDirty = false;
                 return;
             }
 
-            var snapshot = DeserializeSnapshot(File.ReadAllBytes(FileInfo.FullName));
             var reports = new List<CultSchemaMigrationReport>(snapshot.Records.Length);
+            var persisted = new Dictionary<string, CultStoredDocument>(StringComparer.Ordinal);
             foreach (var record in snapshot.Records)
             {
                 reports.Add(Registry.ResolvePersistedSchemaReport(record.SchemaId, snapshot.SchemaCatalog));
                 var stored = ToStoredDocument(record, snapshot.SchemaCatalog, DeserializePayload);
-                Entries[stored.Key.Value] = stored;
-                EntryAdded.OnNext(stored);
+                persisted[stored.Key.Value] = stored;
             }
 
+            var loaded = persisted.Values
+                .Where(stored => !Entries.TryGetValue(stored.Key.Value, out var existing) ||
+                                 existing.StoredAt != stored.StoredAt ||
+                                 existing.Descriptor.SchemaId != stored.Descriptor.SchemaId)
+                .ToArray();
+            var dropped = Entries.Values.Where(existing => !persisted.ContainsKey(existing.Key.Value)).ToArray();
+            if (loaded.Length > 0 || dropped.Length > 0)
+                Loaded?.Invoke(loaded, dropped);
+
+            foreach (var stored in dropped)
+                Entries.TryRemove(stored.Key.Value, out _);
+            foreach (var stored in loaded)
+                Entries[stored.Key.Value] = stored;
             SetLastSchemaMigrationReports(reports);
-            IsDirty = false;
         }
 
-        /// <summary>
-        /// Stages one stored document in memory.
-        /// </summary>
         public override void Push(CultStoredDocument entry)
         {
-            Entries[entry.Key.Value] = entry;
-            IsDirty = true;
+            ThrowIfReadOnly();
+            Held(() =>
+            {
+                Entries[entry.Key.Value] = entry;
+                IsDirty = true;
+            });
         }
 
-        /// <summary>
-        /// Removes one staged document.
-        /// </summary>
         public override void Delete(CultStoredDocument entry)
         {
-            Entries.TryRemove(entry.Key.Value, out _);
-            IsDirty = true;
+            ThrowIfReadOnly();
+            Held(() =>
+            {
+                Entries.TryRemove(entry.Key.Value, out _);
+                IsDirty = true;
+            });
         }
 
-        /// <summary>
-        /// Writes the staged snapshot to disk.
-        /// </summary>
-        public override void PushAll(bool soft = false)
+        // A plain flush writes this store's whole view under the lock: two writers never interleave bytes, but the last
+        // one wins. Processes sharing a store must use conditional commit.
+        public override void PushAll()
         {
+            ThrowIfReadOnly();
+            Held(() =>
+            {
+                using (AcquireLock(wait: true))
+                {
+                    WriteSnapshot(
+                        Entries.Values.Select(entry => ToPersistedRecord(entry, SerializePayload)),
+                        Entries.Values.Select(entry => entry.Descriptor.ToCatalogEntry()));
+                }
+
+                MarkFlushSucceeded();
+            });
+        }
+
+        public override CultCommitOutcome CommitBatch(CultCommitRequest request, bool wait)
+        {
+            ThrowIfReadOnly();
+            return Held(() => CommitBatchCore(request, wait));
+        }
+
+        private CultCommitOutcome CommitBatchCore(CultCommitRequest request, bool wait)
+        {
+            using var fileLock = AcquireLock(wait);
+            if (fileLock == null)
+                return CultCommitOutcome.Contended;
+
+            var disk = ReadSnapshot() ?? new CultPersistedStoreSnapshot();
+            if (!request.ConditionsHold(disk.Records, Entries.Values))
+                return CultCommitOutcome.Mismatch;
+
+            // An unconditional commit writes what a flush would, this store's whole view plus the batch: last-writer-wins,
+            // and staged single writes land with it. A conditional commit (store clean) lands the batch onto the file as it is.
+            var ontoDisk = request.HasConditions && !IsDirty;
+            var records = ontoDisk
+                ? disk.Records.ToDictionary(record => record.Key, StringComparer.Ordinal)
+                : Entries.Values.Select(entry => ToPersistedRecord(entry, SerializePayload)).ToDictionary(record => record.Key, StringComparer.Ordinal);
+            var catalog = ontoDisk
+                ? disk.SchemaCatalog
+                : Entries.Values.Select(entry => entry.Descriptor.ToCatalogEntry());
+            foreach (var entry in request.Deletes)
+                records.Remove(entry.Key.Value);
+            foreach (var entry in request.Upserts)
+                records[entry.Key.Value] = ToPersistedRecord(entry, SerializePayload);
+
+            WriteSnapshot(records.Values, catalog.Concat(request.Upserts.Select(entry => entry.Descriptor.ToCatalogEntry())));
+            foreach (var entry in request.Deletes)
+                Entries.TryRemove(entry.Key.Value, out _);
+            foreach (var entry in request.Upserts)
+                Entries[entry.Key.Value] = entry;
+            MarkFlushSucceeded();
+            return CultCommitOutcome.Committed;
+        }
+
+        private CultPersistedStoreSnapshot? ReadSnapshot()
+        {
+            FileInfo.Refresh();
+            if (!FileInfo.Exists)
+                return null;
+            try
+            {
+                return DeserializeSnapshot(ReadAllBytesShared(FileInfo.FullName));
+            }
+            catch (FileNotFoundException)
+            {
+                return null;
+            }
+        }
+
+        private void WriteSnapshot(IEnumerable<CultPersistedRecord> records, IEnumerable<CultSchemaCatalogEntry> catalog)
+        {
+            var ordered = records.OrderBy(record => record.Key, StringComparer.Ordinal).ToArray();
+            var used = new HashSet<string>(ordered.Select(record => record.SchemaId), StringComparer.Ordinal);
             var snapshot = new CultPersistedStoreSnapshot
             {
-                SchemaCatalog = Entries.Values
-                    .Select(entry => entry.Descriptor.ToCatalogEntry())
+                SchemaCatalog = catalog
                     .GroupBy(entry => entry.SchemaId, StringComparer.Ordinal)
                     .Select(group => group.First())
+                    .Where(entry => used.Contains(entry.SchemaId))
                     .OrderBy(entry => entry.SchemaName, StringComparer.Ordinal)
                     .ToArray(),
-                Records = Entries.Values
-                    .OrderBy(entry => entry.Key.Value, StringComparer.Ordinal)
-                    .Select(entry => ToPersistedRecord(entry, SerializePayload))
-                    .ToArray()
+                Records = ordered
             };
 
             Directory.CreateDirectory(FileInfo.DirectoryName!);
             WriteSnapshotAtomically(FileInfo.FullName, SerializeSnapshot(snapshot));
-            MarkFlushSucceeded();
+        }
+
+        // The lock is a sidecar opened exclusively, which excludes other handles in this process and in others alike.
+        private FileStream? AcquireLock(bool wait)
+        {
+            Directory.CreateDirectory(FileInfo.DirectoryName!);
+            var lockPath = FileInfo.FullName + ".lock";
+            var started = Stopwatch.StartNew();
+            while (true)
+            {
+                try
+                {
+                    return new FileStream(lockPath, FileMode.OpenOrCreate, FileAccess.ReadWrite, FileShare.None, bufferSize: 1);
+                }
+                catch (IOException) when (!wait)
+                {
+                    return null;
+                }
+                catch (IOException) when (started.Elapsed < TimeSpan.FromSeconds(30))
+                {
+                    Thread.Sleep(10);
+                }
+            }
         }
 
         private static void WriteSnapshotAtomically(string path, byte[] payload)
@@ -2089,5 +2253,13 @@ namespace GameCult.Caching
                 }
             }
         }
+
+        private static byte[] ReadAllBytesShared(string path)
+        {
+            using var stream = new FileStream(path, FileMode.Open, FileAccess.Read, FileShare.ReadWrite | FileShare.Delete);
+            using var buffer = new MemoryStream();
+            stream.CopyTo(buffer);
+            return buffer.ToArray();
+        }
     }
 }
diff --git a/src/GameCult.Caching/CultDocumentContracts.cs b/src/GameCult.Caching/CultDocumentContracts.cs
index 46dca479..0d4f1643 100644
--- a/src/GameCult.Caching/CultDocumentContracts.cs
+++ b/src/GameCult.Caching/CultDocumentContracts.cs
@@ -2,15 +2,9 @@ using System;
 
 namespace GameCult.Caching
 {
-    /// <summary>
-    /// Marks a type as a CultCache document with a stable schema name and version.
-    /// </summary>
     [AttributeUsage(AttributeTargets.Class, Inherited = false)]
     public sealed class CultDocumentAttribute : Attribute
     {
-        /// <summary>
-        /// Creates a document marker for the supplied schema identity.
-        /// </summary>
         public CultDocumentAttribute(string schemaName, string schemaVersion)
         {
             SchemaName = string.IsNullOrWhiteSpace(schemaName)
@@ -21,172 +15,97 @@ namespace GameCult.Caching
                 : schemaVersion;
         }
 
-        /// <summary>
-        /// Gets the stable schema name used by CultCache and CultNet.
-        /// </summary>
         public string SchemaName { get; }
 
-        /// <summary>
-        /// Gets the semantic schema version string for this document shape.
-        /// </summary>
         public string SchemaVersion { get; }
     }
 
-    /// <summary>
-    /// Marks a document type as having one global record in a cache.
-    /// </summary>
     [AttributeUsage(AttributeTargets.Class, Inherited = false)]
     public sealed class CultGlobalAttribute : Attribute
     {
     }
 
-    /// <summary>
-    /// Marks the member that supplies the human-readable document name.
-    /// </summary>
     [AttributeUsage(AttributeTargets.Field | AttributeTargets.Property, Inherited = true)]
     public sealed class CultNameAttribute : Attribute
     {
     }
 
-    /// <summary>
-    /// Marks a member as an indexed lookup value.
-    /// </summary>
     [AttributeUsage(AttributeTargets.Field | AttributeTargets.Property, Inherited = true, AllowMultiple = false)]
     public sealed class CultIndexAttribute : Attribute
     {
-        /// <summary>
-        /// Creates an index marker with an optional alias.
-        /// </summary>
         public CultIndexAttribute(string? alias = null)
         {
             Alias = alias;
         }
 
-        /// <summary>
-        /// Gets the external index alias, or null to use the member name.
-        /// </summary>
         public string? Alias { get; }
     }
 
-    /// <summary>
-    /// Marks a member as a reference to another CultCache document.
-    /// </summary>
     [AttributeUsage(AttributeTargets.Field | AttributeTargets.Property, Inherited = true)]
     public sealed class CultReferenceAttribute : Attribute
     {
-        /// <summary>
-        /// Creates a document reference marker.
-        /// </summary>
         public CultReferenceAttribute(Type? targetType = null, bool many = false)
         {
             TargetType = targetType;
             Many = many;
         }
 
-        /// <summary>
-        /// Gets the explicit referenced document type, when one is required.
-        /// </summary>
         public Type? TargetType { get; }
 
-        /// <summary>
-        /// Gets whether this member stores many references rather than one reference.
-        /// </summary>
         public bool Many { get; }
     }
 
-    /// <summary>
-    /// Identifies a record inside a CultCache backing store.
-    /// </summary>
     public readonly struct CultRecordKey : IEquatable<CultRecordKey>
     {
-        /// <summary>
-        /// Creates a record key from its persisted string value.
-        /// </summary>
         public CultRecordKey(string value)
         {
             Value = value ?? string.Empty;
         }
 
-        /// <summary>
-        /// Gets the persisted key value.
-        /// </summary>
         public string Value { get; }
 
-        /// <summary>
-        /// Returns the persisted key value.
-        /// </summary>
         public override string ToString() => Value;
 
-        /// <summary>
-        /// Returns whether this key and another key contain the same persisted value.
-        /// </summary>
         public bool Equals(CultRecordKey other) => string.Equals(Value, other.Value, StringComparison.Ordinal);
 
-        /// <summary>
-        /// Returns whether this key and another object contain the same persisted value.
-        /// </summary>
         public override bool Equals(object? obj) => obj is CultRecordKey other && Equals(other);
 
-        /// <summary>
-        /// Returns a hash code for the persisted key value.
-        /// </summary>
         public override int GetHashCode() => StringComparer.Ordinal.GetHashCode(Value);
     }
 
-    /// <summary>
-    /// Carries the persisted record key for a typed document.
-    /// </summary>
     public readonly struct CultRecordHandle<T>
     {
-        /// <summary>
-        /// Creates a typed document handle.
-        /// </summary>
         public CultRecordHandle(CultRecordKey key)
         {
             Key = key;
         }
 
-        /// <summary>
-        /// Gets the persisted record key.
-        /// </summary>
         public CultRecordKey Key { get; }
 
-        /// <summary>
-        /// Returns the persisted key value.
-        /// </summary>
         public override string ToString() => Key.ToString();
     }
 
-    /// <summary>
-    /// Stores a typed reference to a CultCache document.
-    /// </summary>
-    public readonly struct CultRecordRef<T>
+    // The key of any CultRecordRef<T>, for code that holds one without knowing T.
+    public interface ICultRecordRef
+    {
+        CultRecordKey Key { get; }
+    }
+
+    public readonly struct CultRecordRef<T> : ICultRecordRef
     {
-        /// <summary>
-        /// Creates a typed document reference.
-        /// </summary>
         public CultRecordRef(CultRecordKey key)
         {
             Key = key;
         }
 
-        /// <summary>
-        /// Gets the referenced record key.
-        /// </summary>
         public CultRecordKey Key { get; }
 
-        /// <summary>
-        /// Resolves the referenced record against the provided cache.
-        /// </summary>
         public T? Resolve(CultCache cache)
         {
             if (cache == null) throw new ArgumentNullException(nameof(cache));
             return cache.Get(Key) is T typed ? typed : default;
         }
 
-        /// <summary>
-        /// Returns the referenced key value.
-        /// </summary>
         public override string ToString() => Key.ToString();
     }
 }
diff --git a/src/GameCult.Caching/CultGeneratedDocumentMetadata.cs b/src/GameCult.Caching/CultGeneratedDocumentMetadata.cs
deleted file mode 100644
index 7314c87f..00000000
--- a/src/GameCult.Caching/CultGeneratedDocumentMetadata.cs
+++ /dev/null
@@ -1,308 +0,0 @@
-using System;
-using System.Collections.Generic;
-using System.Linq;
-using System.Reflection;
-using System.Text;
-
-namespace GameCult.Caching
-{
-    /// <summary>
-    /// Registers a generated CultCache document metadata provider with an assembly.
-    /// </summary>
-    [AttributeUsage(AttributeTargets.Assembly, AllowMultiple = true)]
-    public sealed class CultGeneratedDocumentMetadataProviderAttribute : Attribute
-    {
-        /// <summary>
-        /// Creates an assembly metadata provider registration.
-        /// </summary>
-        public CultGeneratedDocumentMetadataProviderAttribute(Type providerType)
-        {
-            ProviderType = providerType ?? throw new ArgumentNullException(nameof(providerType));
-        }
-
-        /// <summary>
-        /// Gets the provider type that can create generated document definitions.
-        /// </summary>
-        public Type ProviderType { get; }
-    }
-
-    /// <summary>
-    /// Supplies generated CultCache document metadata for an assembly.
-    /// </summary>
-    public interface ICultGeneratedDocumentMetadataProvider
-    {
-        /// <summary>
-        /// Gets the generated document definitions exposed by the provider.
-        /// </summary>
-        IEnumerable<CultGeneratedDocumentDefinition> GetDocumentDefinitions();
-    }
-
-    /// <summary>
-    /// Describes one generated CultCache document contract.
-    /// </summary>
-    public sealed class CultGeneratedDocumentDefinition
-    {
-        /// <summary>
-        /// Creates a generated document contract definition.
-        /// </summary>
-        public CultGeneratedDocumentDefinition(
-            Type documentType,
-            string schemaName,
-            string schemaVersion,
-            bool isGlobal,
-            string? nameMember,
-            Func<object, string?>? nameAccessor,
-            Func<object, byte[]>? serializePayload,
-            Func<byte[], object>? deserializePayload,
-            IReadOnlyList<CultGeneratedDocumentIndexAccessor> indexAccessors,
-            IReadOnlyList<CultGeneratedDocumentMemberDefinition> members)
-        {
-            DocumentType = documentType ?? throw new ArgumentNullException(nameof(documentType));
-            SchemaName = string.IsNullOrWhiteSpace(schemaName)
-                ? throw new ArgumentException("Schema name must be non-empty.", nameof(schemaName))
-                : schemaName;
-            SchemaVersion = string.IsNullOrWhiteSpace(schemaVersion)
-                ? throw new ArgumentException("Schema version must be non-empty.", nameof(schemaVersion))
-                : schemaVersion;
-            IsGlobal = isGlobal;
-            NameMember = nameMember;
-            NameAccessor = nameAccessor;
-            SerializePayload = serializePayload;
-            DeserializePayload = deserializePayload;
-            IndexAccessors = indexAccessors ?? Array.Empty<CultGeneratedDocumentIndexAccessor>();
-            Members = members ?? Array.Empty<CultGeneratedDocumentMemberDefinition>();
-        }
-
-        /// <summary>
-        /// Gets the CLR document type.
-        /// </summary>
-        public Type DocumentType { get; }
-
-        /// <summary>
-        /// Gets the stable CultCache schema name.
-        /// </summary>
-        public string SchemaName { get; }
-
-        /// <summary>
-        /// Gets the schema version string.
-        /// </summary>
-        public string SchemaVersion { get; }
-
-        /// <summary>
-        /// Gets whether this document type stores one global record.
-        /// </summary>
-        public bool IsGlobal { get; }
-
-        /// <summary>
-        /// Gets the member used as the document name, if any.
-        /// </summary>
-        public string? NameMember { get; }
-
-        /// <summary>
-        /// Gets the generated name accessor, if any.
-        /// </summary>
-        public Func<object, string?>? NameAccessor { get; }
-
-        /// <summary>
-        /// Gets the generated payload serializer, if one was emitted.
-        /// </summary>
-        public Func<object, byte[]>? SerializePayload { get; }
-
-        /// <summary>
-        /// Gets the generated payload deserializer, if one was emitted.
-        /// </summary>
-        public Func<byte[], object>? DeserializePayload { get; }
-
-        /// <summary>
-        /// Gets the generated index accessors.
-        /// </summary>
-        public IReadOnlyList<CultGeneratedDocumentIndexAccessor> IndexAccessors { get; }
-
-        /// <summary>
-        /// Gets the generated persisted member definitions.
-        /// </summary>
-        public IReadOnlyList<CultGeneratedDocumentMemberDefinition> Members { get; }
-    }
-
-    /// <summary>
-    /// Describes a generated accessor for one CultCache index.
-    /// </summary>
-    public sealed class CultGeneratedDocumentIndexAccessor
-    {
-        /// <summary>
-        /// Creates a generated index accessor.
-        /// </summary>
-        public CultGeneratedDocumentIndexAccessor(string alias, Func<object, string> accessor)
-        {
-            Alias = string.IsNullOrWhiteSpace(alias)
-                ? throw new ArgumentException("Alias must be non-empty.", nameof(alias))
-                : alias;
-            Accessor = accessor ?? throw new ArgumentNullException(nameof(accessor));
-        }
-
-        /// <summary>
-        /// Gets the index alias.
-        /// </summary>
-        public string Alias { get; }
-
-        /// <summary>
-        /// Gets the function that extracts the index value.
-        /// </summary>
-        public Func<object, string> Accessor { get; }
-    }
-
-    /// <summary>
-    /// Describes one generated persisted document member.
-    /// </summary>
-    public sealed class CultGeneratedDocumentMemberDefinition
-    {
-        /// <summary>
-        /// Creates a generated persisted member definition.
-        /// </summary>
-        public CultGeneratedDocumentMemberDefinition(
-            string memberName,
-            int slot,
-            string typeName,
-            bool isReference,
-            bool isMany,
-            string? targetSchemaName,
-            bool isName,
-            string? indexAlias)
-        {
-            MemberName = string.IsNullOrWhiteSpace(memberName)
-                ? throw new ArgumentException("Member name must be non-empty.", nameof(memberName))
-                : memberName;
-            Slot = slot;
-            TypeName = string.IsNullOrWhiteSpace(typeName)
-                ? throw new ArgumentException("Type name must be non-empty.", nameof(typeName))
-                : typeName;
-            IsReference = isReference;
-            IsMany = isMany;
-            TargetSchemaName = targetSchemaName;
-            IsName = isName;
-            IndexAlias = indexAlias;
-        }
-
-        /// <summary>
-        /// Gets the CLR member name.
-        /// </summary>
-        public string MemberName { get; }
-
-        /// <summary>
-        /// Gets the persisted slot number.
-        /// </summary>
-        public int Slot { get; }
-
-        /// <summary>
-        /// Gets the persisted type name.
-        /// </summary>
-        public string TypeName { get; }
-
-        /// <summary>
-        /// Gets whether this member stores a document reference.
-        /// </summary>
-        public bool IsReference { get; }
-
-        /// <summary>
-        /// Gets whether this member stores many references.
-        /// </summary>
-        public bool IsMany { get; }
-
-        /// <summary>
-        /// Gets the target schema name for reference members.
-        /// </summary>
-        public string? TargetSchemaName { get; }
-
-        /// <summary>
-        /// Gets whether this member is the document name.
-        /// </summary>
-        public bool IsName { get; }
-
-        /// <summary>
-        /// Gets the index alias for indexed members.
-        /// </summary>
-        public string? IndexAlias { get; }
-    }
-
-    internal static class CultGeneratedDocumentMetadataLoader
-    {
-        public static IEnumerable<CultGeneratedDocumentDefinition> LoadDefinitions()
-        {
-            return AppDomain.CurrentDomain.GetAssemblies()
-                .Where(assembly => !assembly.IsDynamic)
-                .SelectMany(LoadDefinitions);
-        }
-
-        public static IEnumerable<CultGeneratedDocumentDefinition> LoadDefinitions(Assembly assembly)
-        {
-            foreach (var attribute in assembly.GetCustomAttributes<CultGeneratedDocumentMetadataProviderAttribute>())
-            {
-                if (!typeof(ICultGeneratedDocumentMetadataProvider).IsAssignableFrom(attribute.ProviderType))
-                {
-                    continue;
-                }
-
-                if (Activator.CreateInstance(attribute.ProviderType) is not ICultGeneratedDocumentMetadataProvider provider)
-                {
-                    continue;
-                }
-
-                foreach (var definition in provider.GetDocumentDefinitions())
-                {
-                    yield return definition;
-                }
-            }
-        }
-    }
-
-    internal static class CultSchemaTypeNames
-    {
-        public static string FromType(Type type)
-        {
-            if (type.IsArray)
-            {
-                return FromType(type.GetElementType()!) + "[]";
-            }
-
-            if (type.IsGenericType)
-            {
-                var definition = type.GetGenericTypeDefinition();
-                var name = definition.FullName ?? definition.Name;
-                var tickIndex = name.IndexOf('`');
-                if (tickIndex >= 0)
-                {
-                    name = name[..tickIndex];
-                }
-
-                var arguments = string.Join(", ", type.GetGenericArguments().Select(FromType));
-                return $"{name}<{arguments}>";
-            }
-
-            return type.FullName ?? type.Name;
-        }
-
-        public static string EscapeForLiteral(string value)
-        {
-            if (string.IsNullOrEmpty(value))
-            {
-                return value;
-            }
-
-            var builder = new StringBuilder(value.Length);
-            foreach (var character in value)
-            {
-                builder.Append(character switch
-                {
-                    '\\' => "\\\\",
-                    '"' => "\\\"",
-                    '\r' => "\\r",
-                    '\n' => "\\n",
-                    '\t' => "\\t",
-                    _ => character.ToString()
-                });
-            }
-
-            return builder.ToString();
-        }
-    }
-}
diff --git a/src/GameCult.Unity/Assets/Caching/Runtime/CultCacheInspectorAttributes.cs b/src/GameCult.Caching/CultInspectorAttributes.cs
similarity index 57%
rename from src/GameCult.Unity/Assets/Caching/Runtime/CultCacheInspectorAttributes.cs
rename to src/GameCult.Caching/CultInspectorAttributes.cs
index b7202791..881208ea 100644
--- a/src/GameCult.Unity/Assets/Caching/Runtime/CultCacheInspectorAttributes.cs
+++ b/src/GameCult.Caching/CultInspectorAttributes.cs
@@ -1,10 +1,10 @@
 using System;
 
-namespace GameCult.Unity.Caching
+namespace GameCult.Caching
 {
-    /// <summary>
-    /// Overrides the label shown for a CultCache document member in Unity editor tooling.
-    /// </summary>
+    // Inspection metadata for document members. Engine-free: headless models carry it, and every inspector lowering
+    // (the Unity editor Studio, a runtime CultUI panel) reads it through CultInspectorModel.
+
     [AttributeUsage(AttributeTargets.Field | AttributeTargets.Property | AttributeTargets.Class, Inherited = true)]
     public sealed class CultInspectorLabelAttribute : Attribute
     {
@@ -16,25 +16,17 @@ namespace GameCult.Unity.Caching
         public string Label { get; }
     }
 
-    /// <summary>
-    /// Hides a CultCache document member from Unity editor tooling.
-    /// </summary>
     [AttributeUsage(AttributeTargets.Field | AttributeTargets.Property, Inherited = true)]
     public sealed class CultInspectorHiddenAttribute : Attribute
     {
     }
 
-    /// <summary>
-    /// Shows a CultCache document member without allowing editor mutation.
-    /// </summary>
     [AttributeUsage(AttributeTargets.Field | AttributeTargets.Property, Inherited = true)]
     public sealed class CultInspectorReadOnlyAttribute : Attribute
     {
     }
 
-    /// <summary>
-    /// Controls member ordering in Unity editor tooling. Lower values appear first.
-    /// </summary>
+    // Lower values appear first; members without it keep their slot order.
     [AttributeUsage(AttributeTargets.Field | AttributeTargets.Property, Inherited = true)]
     public sealed class CultInspectorOrderAttribute : Attribute
     {
@@ -46,9 +38,6 @@ namespace GameCult.Unity.Caching
         public int Order { get; }
     }
 
-    /// <summary>
-    /// Draws a string member as a multi-line text area.
-    /// </summary>
     [AttributeUsage(AttributeTargets.Field | AttributeTargets.Property, Inherited = true)]
     public sealed class CultInspectorTextAreaAttribute : Attribute
     {
@@ -62,9 +51,6 @@ namespace GameCult.Unity.Caching
         public int MaxLines { get; }
     }
 
-    /// <summary>
-    /// Draws numeric members with a slider.
-    /// </summary>
     [AttributeUsage(AttributeTargets.Field | AttributeTargets.Property, Inherited = true)]
     public sealed class CultInspectorRangeAttribute : Attribute
     {
@@ -78,17 +64,33 @@ namespace GameCult.Unity.Caching
         public float Max { get; }
     }
 
-    /// <summary>
-    /// Draws a string member as a Unity asset path picker.
-    /// </summary>
+    // A string member holding an engine asset path. AssetType is the engine's asset type, named by the consumer
+    // (typeof(UnityEngine.Texture2D) in a Unity assembly); a lowering that does not know the type ignores it.
     [AttributeUsage(AttributeTargets.Field | AttributeTargets.Property, Inherited = true)]
     public sealed class CultInspectorAssetPathAttribute : Attribute
     {
-        public CultInspectorAssetPathAttribute(Type assetType = null)
+        public CultInspectorAssetPathAttribute(Type? assetType = null)
         {
             AssetType = assetType;
         }
 
-        public Type AssetType { get; }
+        public Type? AssetType { get; }
+    }
+
+    // Marks a lowering's drawer class as the drawer for a claimed type. Claimed is either an Attribute subclass (the
+    // drawer draws every member carrying that attribute) or a value type (every value of that type, or of any closed
+    // form when Claimed is an open generic definition). Attribute claims win over type claims, which win over the
+    // built-in kinds. A claim two drawers make is used by neither.
+    [AttributeUsage(AttributeTargets.Class, Inherited = false)]
+    public sealed class CultInspectorDrawerAttribute : Attribute
+    {
+        public CultInspectorDrawerAttribute(Type claimed)
+        {
+            Claimed = claimed ?? throw new ArgumentNullException(nameof(claimed));
+        }
+
+        public Type Claimed { get; }
+
+        public bool ClaimsAttribute => typeof(Attribute).IsAssignableFrom(Claimed);
     }
 }
diff --git a/src/GameCult.Caching/CultInspectorModel.cs b/src/GameCult.Caching/CultInspectorModel.cs
new file mode 100644
index 00000000..f40d9055
--- /dev/null
+++ b/src/GameCult.Caching/CultInspectorModel.cs
@@ -0,0 +1,630 @@
+using System;
+using System.Collections;
+using System.Collections.Generic;
+using System.Linq;
+using System.Reflection;
+using MessagePack;
+
+namespace GameCult.Caching
+{
+    // The engine-free inspection model: what an inspector draws for a document and which edits it may make. Lowerings
+    // (the Unity editor Studio's IMGUI, a runtime CultUI panel) own only widgets and layout; members, metadata, value
+    // shapes, drawer claims and edit rules come from here.
+
+    public enum CultInspectorValueKind
+    {
+        Unsupported,
+        String,
+        Integer,
+        Float,
+        Bool,
+        Enum,
+        RecordRef,
+        List,
+        Dictionary,
+        Union,
+        Nested
+    }
+
+    // What the inspection attributes on one member say. A bare value has none.
+    public sealed class CultInspectorMetadata
+    {
+        internal static readonly CultInspectorMetadata None = new CultInspectorMetadata(null);
+
+        internal CultInspectorMetadata(MemberInfo? member)
+        {
+            Attributes = member == null ? Array.Empty<Attribute>() : member.GetCustomAttributes(true).OfType<Attribute>().ToArray();
+            var label = Find<CultInspectorLabelAttribute>()?.Label;
+            Label = string.IsNullOrWhiteSpace(label) ? null : label;
+            Hidden = Find<CultInspectorHiddenAttribute>() != null;
+            ReadOnly = Find<CultInspectorReadOnlyAttribute>() != null;
+            Order = Find<CultInspectorOrderAttribute>()?.Order;
+            Range = Find<CultInspectorRangeAttribute>();
+            TextArea = Find<CultInspectorTextAreaAttribute>();
+            AssetPath = Find<CultInspectorAssetPathAttribute>();
+        }
+
+        public IReadOnlyList<Attribute> Attributes { get; }
+
+        // The declared label, or null; the lowering derives one from the member name.
+        public string? Label { get; }
+        public bool Hidden { get; }
+        public bool ReadOnly { get; }
+        public int? Order { get; }
+        public CultInspectorRangeAttribute? Range { get; }
+        public CultInspectorTextAreaAttribute? TextArea { get; }
+        public CultInspectorAssetPathAttribute? AssetPath { get; }
+
+        public T? Find<T>() where T : Attribute => Attributes.OfType<T>().FirstOrDefault();
+    }
+
+    public sealed class CultInspectorMember
+    {
+        internal CultInspectorMember(MemberInfo member, Type valueType, int slot, bool assignable, CultInspectorMetadata metadata)
+        {
+            Member = member;
+            ValueType = valueType;
+            Slot = slot;
+            IsAssignable = assignable;
+            Metadata = metadata;
+            IsReadOnly = metadata.ReadOnly || !assignable;
+        }
+
+        public MemberInfo Member { get; }
+        public string Name => Member.Name;
+        public Type ValueType { get; }
+        public int Slot { get; }
+        public CultInspectorMetadata Metadata { get; }
+
+        // SetValue works: MessagePack's own rule, the one the registry persists by (a public setter or non-readonly field, or
+        // any setter or readonly field under AllowPrivate).
+        public bool IsAssignable { get; }
+
+        // The lowering offers no edit: declared [CultInspectorReadOnly], or not assignable.
+        public bool IsReadOnly { get; }
+
+        public object? GetValue(object target) =>
+            Member is FieldInfo field ? field.GetValue(target) : ((PropertyInfo)Member).GetValue(target);
+
+        public void SetValue(object target, object? value)
+        {
+            if (!IsAssignable)
+                throw new InvalidOperationException($"{Member.DeclaringType?.Name}.{Name} is not assignable.");
+            if (Member is FieldInfo field) field.SetValue(target, value);
+            else ((PropertyInfo)Member).SetValue(target, value);
+        }
+    }
+
+    public sealed class CultInspectorShape
+    {
+        internal CultInspectorShape(Type type, CultInspectorValueKind kind)
+        {
+            Type = type;
+            Kind = kind;
+        }
+
+        public Type Type { get; }
+        public CultInspectorValueKind Kind { get; }
+
+        // List
+        public Type? ElementType { get; internal set; }
+
+        // Dictionary
+        public Type? KeyType { get; internal set; }
+        public Type? ValueType { get; internal set; }
+
+        // RecordRef: the T of CultRecordRef<T>.
+        public Type? RecordTarget { get; internal set; }
+
+        // Union: the declared [Union] subtypes in key order, and nothing else.
+        public IReadOnlyList<Type> UnionChoices { get; internal set; } = Array.Empty<Type>();
+
+        // Nested: the members in inspection order.
+        public IReadOnlyList<CultInspectorMember> Members { get; internal set; } = Array.Empty<CultInspectorMember>();
+
+        // Unsupported: why.
+        public string? Reason { get; internal set; }
+
+        internal Type? BuildType { get; set; }
+    }
+
+    public readonly struct CultInspectorClaim
+    {
+        internal CultInspectorClaim(Type? drawer, string? conflict)
+        {
+            Drawer = drawer;
+            Conflict = conflict;
+        }
+
+        // The claiming drawer class, or null for the lowering's built-in drawing.
+        public Type? Drawer { get; }
+
+        // Set when the claim is contested; the lowering shows it instead of drawing.
+        public string? Conflict { get; }
+    }
+
+    // Which lowering drawer draws a value: a claim on one of the member's attributes, then a claim on the value's type
+    // (exact, then its open generic definition), then none. A lowering builds this once from the drawer classes it
+    // discovers; an invalid drawer or a contested claim is reported in Errors and draws nothing. An attribute claim
+    // reaches every value drawn under the member, list elements and dictionary keys and values included, so the drawer
+    // decides by the value type it is handed.
+    public sealed class CultInspectorDrawerClaims
+    {
+        private readonly Dictionary<Type, Type> _claims = new Dictionary<Type, Type>();
+        private readonly Dictionary<Type, string> _contested = new Dictionary<Type, string>();
+        private readonly List<string> _errors = new List<string>();
+        private readonly Dictionary<(Type, MemberInfo?), CultInspectorClaim> _resolved = new Dictionary<(Type, MemberInfo?), CultInspectorClaim>();
+
+        public CultInspectorDrawerClaims(IEnumerable<Type> drawerTypes, Type drawerContract)
+        {
+            if (drawerTypes == null) throw new ArgumentNullException(nameof(drawerTypes));
+            if (drawerContract == null) throw new ArgumentNullException(nameof(drawerContract));
+            foreach (var drawer in drawerTypes)
+            {
+                var attribute = drawer.GetCustomAttribute<CultInspectorDrawerAttribute>(false);
+                if (attribute == null)
+                    continue;
+                if (!drawerContract.IsAssignableFrom(drawer) || drawer.IsAbstract || drawer.GetConstructor(Type.EmptyTypes) == null)
+                {
+                    _errors.Add($"{drawer.FullName} is marked [CultInspectorDrawer] but is not a concrete {drawerContract.Name} with a parameterless constructor.");
+                    continue;
+                }
+
+                var claimed = attribute.Claimed;
+                if (_contested.TryGetValue(claimed, out var claimants))
+                {
+                    _contested[claimed] = claimants + ", " + drawer.FullName;
+                }
+                else if (_claims.TryGetValue(claimed, out var holder))
+                {
+                    _claims.Remove(claimed);
+                    _contested[claimed] = holder.FullName + ", " + drawer.FullName;
+                }
+                else
+                {
+                    _claims[claimed] = drawer;
+                }
+            }
+
+            foreach (var pair in _contested.OrderBy(pair => pair.Key.FullName, StringComparer.Ordinal))
+                _errors.Add($"{pair.Value} all claim {pair.Key.FullName}; none of them draws it.");
+        }
+
+        public IReadOnlyList<string> Errors => _errors;
+
+        public CultInspectorClaim Resolve(Type valueType, MemberInfo? member)
+        {
+            if (valueType == null) throw new ArgumentNullException(nameof(valueType));
+            lock (_resolved)
+            {
+                if (!_resolved.TryGetValue((valueType, member), out var claim))
+                    _resolved[(valueType, member)] = claim = ResolveCore(valueType, member);
+                return claim;
+            }
+        }
+
+        private CultInspectorClaim ResolveCore(Type valueType, MemberInfo? member)
+        {
+            Type? drawer = null;
+            foreach (var attribute in member?.GetCustomAttributes(true).OfType<Attribute>() ?? Enumerable.Empty<Attribute>())
+            {
+                for (var type = attribute.GetType(); type != null && type != typeof(Attribute); type = type.BaseType)
+                {
+                    if (_contested.TryGetValue(type, out var claimants))
+                        return new CultInspectorClaim(null, $"[{type.Name}] is claimed by {claimants}");
+                    if (!_claims.TryGetValue(type, out var claimant))
+                        continue;
+                    if (drawer != null && drawer != claimant)
+                        return new CultInspectorClaim(null, $"{member!.Name} carries attributes claimed by {drawer.FullName} and {claimant.FullName}");
+                    drawer = claimant;
+                    break;
+                }
+            }
+
+            if (drawer != null)
+                return new CultInspectorClaim(drawer, null);
+            foreach (var type in valueType.IsGenericType ? new[] { valueType, valueType.GetGenericTypeDefinition() } : new[] { valueType })
+            {
+                if (_contested.TryGetValue(type, out var claimants))
+                    return new CultInspectorClaim(null, $"{type.FullName} is claimed by {claimants}");
+                if (_claims.TryGetValue(type, out var claimant))
+                    return new CultInspectorClaim(claimant, null);
+            }
+
+            return default;
+        }
+    }
+
+    // A private copy of one stored document. A lowering draws into Document; the cached object is never touched.
+    public sealed class CultInspectorEdit
+    {
+        internal CultInspectorEdit(CultStoredDocument source, object document)
+        {
+            Source = source;
+            Document = document;
+        }
+
+        public CultStoredDocument Source { get; }
+        public object Document { get; }
+        public bool IsSpent { get; private set; }
+
+        public bool IsFor(CultStoredDocument record) => !IsSpent && ReferenceEquals(Source, record);
+
+        // Upserts the copy under the source key. Committed, the cache holds the copy; refused, the cached object is
+        // unchanged. Either way the edit is spent and the copy belongs to nobody: begin a new edit from the cache.
+        public bool Commit(CultCache cache, out string? error)
+        {
+            if (cache == null) throw new ArgumentNullException(nameof(cache));
+            if (IsSpent) throw new InvalidOperationException("This edit was already committed; begin a new edit.");
+            IsSpent = true;
+            try
+            {
+                cache.UpsertAsync(Source.Descriptor.DocumentType, Document, Source.Key).GetAwaiter().GetResult();
+                error = null;
+                return true;
+            }
+            catch (Exception exception)
+            {
+                error = exception.GetBaseException().Message;
+                return false;
+            }
+        }
+    }
+
+    public sealed class CultInspectorModel
+    {
+        private const string RecordRefIdentity = "ref:";
+        private const BindingFlags Public = BindingFlags.Public | BindingFlags.Instance;
+
+        private static readonly HashSet<Type> IntegerTypes = new HashSet<Type>
+        {
+            typeof(int), typeof(long), typeof(uint), typeof(short), typeof(ushort), typeof(byte), typeof(sbyte)
+        };
+
+        private readonly Func<object, Type, Type, byte[]> _serialize;
+        private readonly Func<Type, byte[], object> _deserialize;
+        private readonly Dictionary<Type, CultInspectorShape> _shapes = new Dictionary<Type, CultInspectorShape>();
+        private readonly Dictionary<MemberInfo, CultInspectorMetadata> _metadata = new Dictionary<MemberInfo, CultInspectorMetadata>();
+
+        // serialize (value, value type, owning document type) and deserialize are the store's codec
+        // (CultCacheMessagePack.CreateInspectorModel for .cc stores). Edits clone documents through both; dictionary keys
+        // compare by serialize under their owning document, exactly as the store writes them inside it, so serialize must
+        // take any value, not only documents.
+        public CultInspectorModel(CultDocumentRegistry registry, Func<object, Type, Type, byte[]> serialize, Func<Type, byte[], object> deserialize)
+        {
+            Registry = registry ?? throw new ArgumentNullException(nameof(registry));
+            _serialize = serialize ?? throw new ArgumentNullException(nameof(serialize));
+            _deserialize = deserialize ?? throw new ArgumentNullException(nameof(deserialize));
+        }
+
+        public CultDocumentRegistry Registry { get; }
+
+        public static string RecordLabel(CultStoredDocument record)
+        {
+            var name = record.Descriptor.NameAccessor?.Invoke(record.Document);
+            return string.IsNullOrWhiteSpace(name) ? record.Key.Value : name!;
+        }
+
+        // The key a CultRecordRef<T> holds; null and "" are both the empty key.
+        public static string RecordKey(object? recordRef) => (recordRef as ICultRecordRef)?.Key.Value ?? string.Empty;
+
+        public CultInspectorShape ShapeOf(Type type)
+        {
+            if (type == null) throw new ArgumentNullException(nameof(type));
+            lock (_shapes)
+            {
+                if (!_shapes.TryGetValue(type, out var shape))
+                    _shapes[type] = shape = Classify(type);
+                return shape;
+            }
+        }
+
+        public IReadOnlyList<CultInspectorMember> MembersOf(Type type)
+        {
+            var shape = ShapeOf(type);
+            return shape.Kind == CultInspectorValueKind.Nested ? shape.Members : Array.Empty<CultInspectorMember>();
+        }
+
+        public CultInspectorMetadata MetadataOf(MemberInfo? member)
+        {
+            if (member == null)
+                return CultInspectorMetadata.None;
+            lock (_metadata)
+            {
+                if (!_metadata.TryGetValue(member, out var metadata))
+                    _metadata[member] = metadata = new CultInspectorMetadata(member);
+                return metadata;
+            }
+        }
+
+        public object Clone(object document, Type type) => _deserialize(type, _serialize(document, type, type));
+
+        public CultInspectorEdit BeginEdit(CultStoredDocument record)
+        {
+            if (record == null) throw new ArgumentNullException(nameof(record));
+            return new CultInspectorEdit(record, Clone(record.Document, record.Descriptor.DocumentType));
+        }
+
+        // Whether CreateDefault makes a value: a string, struct, list or dictionary, or a concrete class with a parameterless constructor.
+        public bool CanCreate(Type type) =>
+            type == typeof(string) || type.IsValueType ||
+            ShapeOf(type).Kind is CultInspectorValueKind.List or CultInspectorValueKind.Dictionary ||
+            !type.IsAbstract && !type.IsInterface && type.GetConstructor(Type.EmptyTypes) != null;
+
+        public object? CreateDefault(Type type)
+        {
+            if (!CanCreate(type)) return null;
+            if (type == typeof(string)) return string.Empty;
+            var shape = ShapeOf(type);
+            if (type.IsArray) return Array.CreateInstance(shape.ElementType!, 0);
+            return Activator.CreateInstance(shape.Kind == CultInspectorValueKind.Dictionary ? shape.BuildType! : type);
+        }
+
+        // What a new value for a slot of elementType (a list element, a dictionary value, a union pick) may be: a union's
+        // declared subtypes, or elementType itself.
+        public IReadOnlyList<Type> ElementChoices(Type elementType)
+        {
+            var shape = ShapeOf(elementType);
+            return shape.Kind == CultInspectorValueKind.Union ? shape.UnionChoices : new[] { elementType };
+        }
+
+        // A new value of choice for a slot of elementType, or null with a notice when choice cannot be made.
+        public object? CreateElement(Type elementType, Type choice, out string? notice)
+        {
+            // A slot's own type is always offered; an abstract one is refused with the notice below.
+            if (choice != elementType && !ElementChoices(elementType).Contains(choice))
+                throw new ArgumentException($"{choice.Name} is not a choice for {elementType.Name}.", nameof(choice));
+            var created = CreateDefault(choice);
+            // Null is a value only for a Nullable<T> slot; anywhere else it is nothing made.
+            notice = created == null && !choice.IsValueType
+                ? $"{choice.Name} is abstract or has no parameterless constructor; nothing was created."
+                : null;
+            return created;
+        }
+
+        // An integer edit as a value of integerType, clamped to that type's range instead of overflowing.
+        public object NarrowInteger(Type integerType, long value)
+        {
+            if (!IntegerTypes.Contains(integerType))
+                throw new ArgumentException($"{integerType.Name} is not an integer the inspector edits.", nameof(integerType));
+            long Bound(string name) => Convert.ToInt64(integerType.GetField(name)!.GetValue(null));
+            return Convert.ChangeType(Math.Max(Bound("MinValue"), Math.Min(Bound("MaxValue"), value)), integerType);
+        }
+
+        // A new collection holding items; the value it replaces is never mutated.
+        public object BuildList(Type listType, IReadOnlyList<object?> items)
+        {
+            var shape = ShapeOf(listType);
+            if (shape.Kind != CultInspectorValueKind.List)
+                throw new ArgumentException($"{listType.Name} is not a list the inspector builds.", nameof(listType));
+            if (listType.IsArray)
+            {
+                var array = Array.CreateInstance(shape.ElementType!, items.Count);
+                for (var i = 0; i < items.Count; i++) array.SetValue(items[i], i);
+                return array;
+            }
+
+            var list = (IList)Activator.CreateInstance(listType)!;
+            foreach (var item in items) list.Add(item);
+            return list;
+        }
+
+        public object BuildDictionary(Type dictionaryType, IEnumerable<KeyValuePair<object?, object?>> entries)
+        {
+            var dictionary = (IDictionary)Activator.CreateInstance(DictionaryShape(dictionaryType).BuildType!)!;
+            foreach (var entry in entries) dictionary.Add(entry.Key!, entry.Value);
+            return dictionary;
+        }
+
+        // The key entry `index` of a dictionary in a documentType document holding `keys` takes when a lowering offers
+        // `candidate`: the candidate, or the kept key and a notice saying why. An unchanged key is never refused. Any other
+        // key must be non-null, not an empty record reference, and not taken by another entry, so BuildDictionary cannot
+        // throw. A key the document cannot serialize is refused: the store could not write it.
+        public object? ReplaceKey(Type documentType, Type dictionaryType, IReadOnlyList<object?> keys, int index, object? candidate, out string? notice)
+        {
+            var shape = DictionaryShape(dictionaryType);
+            string? refusal;
+            try
+            {
+                var identity = KeyIdentity(documentType, shape, candidate);
+                refusal = identity == KeyIdentity(documentType, shape, keys[index]) ? null
+                    : identity == null ? "a null key"
+                    : identity == RecordRefIdentity ? "an empty record reference as a key"
+                    : Taken(documentType, shape, candidate!, keys.Where((_, i) => i != index)) ? "a duplicate key"
+                    : null;
+            }
+            catch (Exception exception)
+            {
+                refusal = $"a key {documentType.Name} cannot serialize ({exception.GetBaseException().Message})";
+            }
+
+            notice = refusal == null ? null : $"Refused {refusal} on entry {index}; its key was kept.";
+            return refusal == null ? candidate : keys[index];
+        }
+
+        // A key to add beside `keys` in a documentType document: a record-reference key takes the first candidate record not
+        // already used; any other key is the type's default. Null with a notice when no such key is free or serializable.
+        public object? FreshKey(Type documentType, Type dictionaryType, IReadOnlyList<object?> keys, IEnumerable<CultStoredDocument> records, out string? notice)
+        {
+            var shape = DictionaryShape(dictionaryType);
+            var keyType = shape.KeyType!;
+            var candidates = ShapeOf(keyType).Kind == CultInspectorValueKind.RecordRef
+                ? RecordCandidates(keyType, records).Select(record => CreateRecordRef(keyType, record.Key.Value))
+                : new[] { CreateDefault(keyType) };
+            try
+            {
+                var fresh = candidates.FirstOrDefault(key => key != null && !Taken(documentType, shape, key, keys));
+                notice = fresh == null ? $"No unused {keyType.Name} key is available; nothing was added." : null;
+                return fresh;
+            }
+            catch (Exception exception)
+            {
+                notice = $"{documentType.Name} cannot serialize a {keyType.Name} key ({exception.GetBaseException().Message}); nothing was added.";
+                return null;
+            }
+        }
+
+        // A key is taken when another serializes the same (a CultRecordRef<T> by its key string, null and "" alike) or when
+        // the rebuilt dictionary type's default comparer calls them equal (0.0 and -0.0 serialize apart but are one double key).
+        private bool Taken(Type documentType, CultInspectorShape dictionary, object key, IEnumerable<object?> keys)
+        {
+            var identity = KeyIdentity(documentType, dictionary, key);
+            var probe = (IDictionary)Activator.CreateInstance(dictionary.BuildType!)!;
+            var filler = dictionary.ValueType!.IsValueType ? Activator.CreateInstance(dictionary.ValueType) : null;
+            foreach (var other in keys.Where(other => other != null))
+            {
+                if (KeyIdentity(documentType, dictionary, other) == identity) return true;
+                probe[other!] = filler;
+            }
+
+            return probe.Contains(key);
+        }
+
+        // A key's bytes as its declared key type under the owning document's serializer, the store's own path. Throws when
+        // that serializer cannot write the key.
+        private string? KeyIdentity(Type documentType, CultInspectorShape dictionary, object? key) =>
+            key == null ? null
+            : key is ICultRecordRef reference ? RecordRefIdentity + reference.Key.Value
+            : "value:" + Convert.ToBase64String(_serialize(key, dictionary.KeyType!, documentType));
+
+        private CultInspectorShape DictionaryShape(Type dictionaryType)
+        {
+            var shape = ShapeOf(dictionaryType);
+            return shape.Kind == CultInspectorValueKind.Dictionary
+                ? shape
+                : throw new ArgumentException($"{dictionaryType.Name} is not a dictionary the inspector builds.", nameof(dictionaryType));
+        }
+
+        // The records a CultRecordRef<T> may point at: every record whose document is a T, by label.
+        public IReadOnlyList<CultStoredDocument> RecordCandidates(Type recordRefType, IEnumerable<CultStoredDocument> records)
+        {
+            var target = ShapeOf(recordRefType).RecordTarget
+                         ?? throw new ArgumentException($"{recordRefType.Name} is not a CultRecordRef<T>.", nameof(recordRefType));
+            return records
+                .Where(record => target.IsInstanceOfType(record.Document) && record.Key.Value.Length > 0)
+                .OrderBy(RecordLabel, StringComparer.OrdinalIgnoreCase)
+                .ToArray();
+        }
+
+        public object CreateRecordRef(Type recordRefType, string key)
+        {
+            if (ShapeOf(recordRefType).Kind != CultInspectorValueKind.RecordRef)
+                throw new ArgumentException($"{recordRefType.Name} is not a CultRecordRef<T>.", nameof(recordRefType));
+            return Activator.CreateInstance(recordRefType, new CultRecordKey(key))!;
+        }
+
+        private CultInspectorShape Classify(Type type)
+        {
+            if (type == typeof(string)) return new CultInspectorShape(type, CultInspectorValueKind.String);
+            if (type == typeof(bool)) return new CultInspectorShape(type, CultInspectorValueKind.Bool);
+            if (type.IsEnum) return new CultInspectorShape(type, CultInspectorValueKind.Enum);
+            if (IntegerTypes.Contains(type)) return new CultInspectorShape(type, CultInspectorValueKind.Integer);
+            if (type == typeof(float) || type == typeof(double)) return new CultInspectorShape(type, CultInspectorValueKind.Float);
+            if (type.IsArray && type.GetArrayRank() != 1)
+                return Unsupported(type, $"{type.Name} is a multi-dimensional array, which the inspector does not edit.");
+            if (type.IsGenericType && type.GetGenericTypeDefinition() == typeof(CultRecordRef<>))
+                return new CultInspectorShape(type, CultInspectorValueKind.RecordRef) { RecordTarget = type.GetGenericArguments()[0] };
+
+            var dictionary = type.GetInterfaces().Prepend(type)
+                .FirstOrDefault(candidate => candidate.IsGenericType && candidate.GetGenericTypeDefinition() == typeof(IDictionary<,>));
+            if (dictionary != null)
+            {
+                var arguments = dictionary.GetGenericArguments();
+                var build = type.IsInterface || type.IsAbstract ? typeof(Dictionary<,>).MakeGenericType(arguments) : type;
+                return typeof(IDictionary).IsAssignableFrom(build) && build.GetConstructor(Type.EmptyTypes) != null
+                    ? new CultInspectorShape(type, CultInspectorValueKind.Dictionary) { KeyType = arguments[0], ValueType = arguments[1], BuildType = build }
+                    : Unsupported(type, $"{type.Name} is a dictionary the inspector cannot rebuild.");
+            }
+
+            if (type.IsArray)
+                return new CultInspectorShape(type, CultInspectorValueKind.List) { ElementType = type.GetElementType() };
+            if (type.IsGenericType && !type.IsAbstract && !type.IsInterface && typeof(IList).IsAssignableFrom(type) && type.GetConstructor(Type.EmptyTypes) != null)
+                return new CultInspectorShape(type, CultInspectorValueKind.List) { ElementType = type.GetGenericArguments()[0] };
+
+            if (type.IsAbstract || type.IsInterface)
+            {
+                var choices = type.GetCustomAttributes<UnionAttribute>(false).OrderBy(union => union.Key).Select(union => union.SubType).ToArray();
+                return choices.Length == 0
+                    ? Unsupported(type, $"{type.Name} declares no [Union] subtypes.")
+                    : new CultInspectorShape(type, CultInspectorValueKind.Union) { UnionChoices = choices };
+            }
+
+            var keyed = KeyedMembers(type);
+            if (keyed.Length > 0)
+                return new CultInspectorShape(type, CultInspectorValueKind.Nested) { Members = keyed };
+            // An unkeyed struct is edited in place. With public fields it shows only them, readonly ones read-only: its
+            // properties alias those values (a Quaternion's eulerAngles, a Rect's min and max). Without, it shows its public
+            // properties with a setter, init-only ones read-only (record structs, matrices over private rows). Get-only
+            // properties are computed or kept by the in-place edit, so they are never rows.
+            if (type.IsValueType)
+            {
+                var fields = type.GetFields(Public);
+                var members = (fields.Length > 0
+                        ? fields.OrderBy(field => field.MetadataToken)
+                            .Select(field => (Member: (MemberInfo)field, Type: field.FieldType, Assignable: !field.IsInitOnly))
+                        : type.GetProperties(Public).OrderBy(property => property.MetadataToken)
+                            .Where(property => property.GetIndexParameters().Length == 0 && property.GetGetMethod() != null && property.GetSetMethod() != null)
+                            .Select(property => (Member: (MemberInfo)property, Type: property.PropertyType, Assignable: !IsInitOnly(property.GetSetMethod()!))))
+                    .Select((member, slot) => new CultInspectorMember(member.Member, member.Type, slot, member.Assignable, MetadataOf(member.Member)))
+                    .ToArray();
+                if (members.Length > 0)
+                    return new CultInspectorShape(type, CultInspectorValueKind.Nested) { Members = members };
+            }
+
+            return Unsupported(type, "no drawer for " + type.FullName);
+        }
+
+        // Documents take their members and slots from the registry's catalog; other MessagePack objects from their [Key]s.
+        private CultInspectorMember[] KeyedMembers(Type type)
+        {
+            var allowPrivate = type.GetCustomAttribute<MessagePackObjectAttribute>(true)?.AllowPrivate == true;
+            var candidates = type.GetMembers(Public)
+                .Where(member => member is FieldInfo field && !field.IsLiteral ||
+                                 member is PropertyInfo property && property.GetGetMethod() != null && property.GetIndexParameters().Length == 0)
+                .Where(member => !member.IsDefined(typeof(IgnoreMemberAttribute), true))
+                // A member hidden with `new` is its most-derived declaration, as the registry's own-member scan reads it.
+                .GroupBy(member => member.Name)
+                .Select(hides => hides.OrderByDescending(member => Ancestry(member.DeclaringType)).First());
+            IEnumerable<(MemberInfo Member, int Slot)> slotted;
+            if (type.IsDefined(typeof(CultDocumentAttribute), false))
+            {
+                var slots = Registry.GetRequired(type).ToCatalogEntry().Members.ToDictionary(member => member.MemberName, member => member.Slot, StringComparer.Ordinal);
+                slotted = candidates.Where(member => slots.ContainsKey(member.Name)).Select(member => (member, slots[member.Name]));
+            }
+            else
+            {
+                slotted = candidates
+                    .Select(member => (Member: member, Slot: member.GetCustomAttribute<KeyAttribute>(true)?.IntKey))
+                    .Where(entry => entry.Slot != null)
+                    .Select(entry => (entry.Member, entry.Slot!.Value));
+            }
+
+            return slotted
+                .Select(entry => new CultInspectorMember(entry.Member, TypeOf(entry.Member), entry.Slot, Assignable(entry.Member, allowPrivate), MetadataOf(entry.Member)))
+                .OrderBy(member => member.Metadata.Order ?? member.Slot)
+                .ThenBy(member => member.Slot)
+                .ToArray();
+        }
+
+        private static CultInspectorShape Unsupported(Type type, string reason) =>
+            new CultInspectorShape(type, CultInspectorValueKind.Unsupported) { Reason = reason };
+
+        private static int Ancestry(Type? type) => type == null ? 0 : 1 + Ancestry(type.BaseType);
+
+        // `init` is a setter whose return carries the IsExternalInit modreq; the language contract, matched by name because
+        // netstandard2.1 does not ship the type. A runtime that does not report the modreq (unverified on Unity's Mono) shows
+        // init members editable instead of read-only; SetValue still assigns them, so their edits round-trip either way.
+        private static bool IsInitOnly(MethodInfo setter) =>
+            setter.ReturnParameter.GetRequiredCustomModifiers().Any(modifier => modifier.FullName == "System.Runtime.CompilerServices.IsExternalInit");
+
+        private static Type TypeOf(MemberInfo member) => member is FieldInfo field ? field.FieldType : ((PropertyInfo)member).PropertyType;
+
+        private static bool Assignable(MemberInfo member, bool allowPrivate)
+        {
+            if (member is FieldInfo field)
+                return !field.IsInitOnly || allowPrivate;
+            var setter = ((PropertyInfo)member).GetSetMethod(true);
+            return setter != null && (setter.IsPublic || allowPrivate);
+        }
+    }
+}
diff --git a/src/GameCult.Caching/CultManagedDocument.cs b/src/GameCult.Caching/CultManagedDocument.cs
index 100cb628..00a6b2c2 100644
--- a/src/GameCult.Caching/CultManagedDocument.cs
+++ b/src/GameCult.Caching/CultManagedDocument.cs
@@ -7,409 +7,40 @@ using R3;
 
 namespace GameCult.Caching
 {
-    /// <summary>
-    /// Describes how a CultCache-managed document changed.
-    /// </summary>
     public enum CultCacheDocumentChangeKind
     {
-        /// <summary>
-        /// A document was added.
-        /// </summary>
         Added,
 
-        /// <summary>
-        /// A document was updated.
-        /// </summary>
         Updated,
 
-        /// <summary>
-        /// A document was removed.
-        /// </summary>
         Removed
     }
 
-    /// <summary>
-    /// One reactive CultCache document change.
-    /// </summary>
     public sealed class CultCacheDocumentChange<T> where T : class
     {
-        /// <summary>
-        /// Creates a document change.
-        /// </summary>
         public CultCacheDocumentChange(
             CultCacheDocumentChangeKind kind,
             CultRecordKey key,
             T? document,
-            T? previousDocument)
+            T? previousDocument,
+            long sequence = 0)
         {
             Kind = kind;
             Key = key;
             Document = document;
             PreviousDocument = previousDocument;
+            Sequence = sequence;
         }
 
-        /// <summary>
-        /// Gets the change kind.
-        /// </summary>
+        // Per-cache, in memory, assigned at admission. A consumer keeping a latest value ignores a lower one.
+        public long Sequence { get; }
+
         public CultCacheDocumentChangeKind Kind { get; }
 
-        /// <summary>
-        /// Gets the document record key.
-        /// </summary>
         public CultRecordKey Key { get; }
 
-        /// <summary>
-        /// Gets the current POCO presentation, when present.
-        /// </summary>
         public T? Document { get; }
 
-        /// <summary>
-        /// Gets the previous POCO presentation, when present.
-        /// </summary>
         public T? PreviousDocument { get; }
     }
-
-    /// <summary>
-    /// Reactive POCO presentation for one CultCache-managed document.
-    /// </summary>
-    public sealed class CultManagedDocument<T> where T : class
-    {
-        private readonly Func<T?> _read;
-        private readonly Func<T, Task> _commit;
-        private readonly Observable<T> _watch;
-
-        /// <summary>
-        /// Creates a managed document presentation.
-        /// </summary>
-        public CultManagedDocument(
-            CultRecordKey key,
-            Func<T?> read,
-            Func<T, Task> commit,
-            Observable<T> watch)
-        {
-            Key = key;
-            _read = read ?? throw new ArgumentNullException(nameof(read));
-            _commit = commit ?? throw new ArgumentNullException(nameof(commit));
-            _watch = watch ?? throw new ArgumentNullException(nameof(watch));
-        }
-
-        /// <summary>
-        /// Gets the document record key.
-        /// </summary>
-        public CultRecordKey Key { get; }
-
-        /// <summary>
-        /// Gets the current POCO presentation.
-        /// </summary>
-        public T? Value => _read();
-
-        /// <summary>
-        /// Watches committed values for this document.
-        /// </summary>
-        public Observable<T> Watch()
-        {
-            return _watch;
-        }
-
-        /// <summary>
-        /// Commits the current POCO value through the owner-supplied commit path.
-        /// </summary>
-        public Task CommitAsync()
-        {
-            var value = Value ?? throw new InvalidOperationException($"Document '{Key.Value}' is not present.");
-            return _commit(value);
-        }
-
-        /// <summary>
-        /// Replaces the current value through the owner-supplied commit path.
-        /// </summary>
-        public Task ReplaceAsync(T value)
-        {
-            if (value == null) throw new ArgumentNullException(nameof(value));
-            return _commit(value);
-        }
-    }
-
-    /// <summary>
-    /// CPU-local structure-of-arrays table owned by CultCache for one document type.
-    /// </summary>
-    public sealed class CultSoaTable<TDocument> where TDocument : class
-    {
-        private readonly Dictionary<string, object> _columns;
-
-        internal CultSoaTable(
-            CultRecordKey[] keys,
-            TDocument[] documents,
-            Dictionary<string, object> columns)
-        {
-            Keys = keys;
-            Documents = documents;
-            _columns = columns;
-        }
-
-        /// <summary>
-        /// Gets record keys in row order.
-        /// </summary>
-        public IReadOnlyList<CultRecordKey> Keys { get; }
-
-        /// <summary>
-        /// Gets POCO presentations in row order.
-        /// </summary>
-        public IReadOnlyList<TDocument> Documents { get; }
-
-        /// <summary>
-        /// Gets the row count.
-        /// </summary>
-        public int Count => Keys.Count;
-
-        /// <summary>
-        /// Gets a contiguous unmanaged field/property column.
-        /// </summary>
-        public CultSoaColumn<TValue> Column<TValue>(string name) where TValue : unmanaged
-        {
-            if (!_columns.TryGetValue(name, out var column))
-            {
-                throw new KeyNotFoundException($"SoA table for {typeof(TDocument).Name} has no '{name}' column.");
-            }
-
-            if (column is not TValue[] values)
-            {
-                throw new InvalidOperationException(
-                    $"SoA table column '{name}' stores {column.GetType().GetElementType()?.FullName}, not {typeof(TValue).FullName}.");
-            }
-
-            return new CultSoaColumn<TValue>(name, values);
-        }
-    }
-
-    /// <summary>
-    /// Contiguous typed SoA column.
-    /// </summary>
-    public readonly struct CultSoaColumn<TValue> where TValue : unmanaged
-    {
-        internal CultSoaColumn(string name, TValue[] values)
-        {
-            Name = name;
-            Values = values;
-        }
-
-        /// <summary>
-        /// Gets the column name.
-        /// </summary>
-        public string Name { get; }
-
-        /// <summary>
-        /// Gets the backing array.
-        /// </summary>
-        public TValue[] Values { get; }
-
-        /// <summary>
-        /// Gets the backing array as a span.
-        /// </summary>
-        public Span<TValue> Span => Values.AsSpan();
-    }
-
-    internal sealed class CultCacheSoaStore
-    {
-        private readonly Dictionary<Type, CultCacheSoaTypeTable> _tables = new();
-
-        public void Upsert(CultStoredDocument stored)
-        {
-            Table(stored.Descriptor.DocumentType).Upsert(stored.Key, stored.Document);
-        }
-
-        public void Remove(CultStoredDocument stored)
-        {
-            if (_tables.TryGetValue(stored.Descriptor.DocumentType, out var table))
-            {
-                table.Remove(stored.Key);
-            }
-        }
-
-        public CultSoaTable<TDocument> Snapshot<TDocument>() where TDocument : class
-        {
-            return Table(typeof(TDocument)).Snapshot<TDocument>();
-        }
-
-        private CultCacheSoaTypeTable Table(Type documentType)
-        {
-            if (!_tables.TryGetValue(documentType, out var table))
-            {
-                table = new CultCacheSoaTypeTable(documentType);
-                _tables[documentType] = table;
-            }
-
-            return table;
-        }
-    }
-
-    internal sealed class CultCacheSoaTypeTable
-    {
-        private readonly Type _documentType;
-        private readonly List<CultRecordKey> _keys = new();
-        private readonly List<object> _documents = new();
-        private readonly Dictionary<string, CultCacheSoaMember> _members;
-        private readonly Dictionary<string, object> _columns;
-        private readonly Dictionary<string, int> _rowsByKey = new(StringComparer.Ordinal);
-
-        public CultCacheSoaTypeTable(Type documentType)
-        {
-            _documentType = documentType;
-            _members = CultCacheSoaMember.Discover(documentType)
-                .ToDictionary(member => member.Name, StringComparer.Ordinal);
-            _columns = _members.Values.ToDictionary(
-                member => member.Name,
-                member => Array.CreateInstance(member.ValueType, 0) as object,
-                StringComparer.Ordinal);
-        }
-
-        public void Upsert(CultRecordKey key, object document)
-        {
-            if (_rowsByKey.TryGetValue(key.Value, out var row))
-            {
-                _documents[row] = document;
-            }
-            else
-            {
-                row = _keys.Count;
-                _rowsByKey[key.Value] = row;
-                _keys.Add(key);
-                _documents.Add(document);
-                EnsureColumnCapacity(_keys.Count);
-            }
-
-            WriteRow(row, document);
-        }
-
-        public void Remove(CultRecordKey key)
-        {
-            if (!_rowsByKey.TryGetValue(key.Value, out var row))
-            {
-                return;
-            }
-
-            var lastRow = _keys.Count - 1;
-            if (row != lastRow)
-            {
-                _keys[row] = _keys[lastRow];
-                _documents[row] = _documents[lastRow];
-                _rowsByKey[_keys[row].Value] = row;
-                CopyRow(lastRow, row);
-            }
-
-            _rowsByKey.Remove(key.Value);
-            _keys.RemoveAt(lastRow);
-            _documents.RemoveAt(lastRow);
-        }
-
-        public CultSoaTable<TDocument> Snapshot<TDocument>() where TDocument : class
-        {
-            if (!typeof(TDocument).IsAssignableFrom(_documentType))
-            {
-                throw new InvalidOperationException($"{_documentType.FullName} is not assignable to {typeof(TDocument).FullName}.");
-            }
-
-            var count = _keys.Count;
-            var columns = new Dictionary<string, object>(StringComparer.Ordinal);
-            foreach (var pair in _columns)
-            {
-                var member = _members[pair.Key];
-                var source = (Array)pair.Value;
-                var target = Array.CreateInstance(member.ValueType, count);
-                Array.Copy(source, target, count);
-                columns[pair.Key] = target;
-            }
-
-            return new CultSoaTable<TDocument>(
-                _keys.ToArray(),
-                _documents.Cast<TDocument>().ToArray(),
-                columns);
-        }
-
-        private void EnsureColumnCapacity(int count)
-        {
-            foreach (var member in _members.Values)
-            {
-                var column = (Array)_columns[member.Name];
-                if (column.Length >= count)
-                {
-                    continue;
-                }
-
-                var nextLength = Math.Max(count, Math.Max(4, column.Length * 2));
-                var next = Array.CreateInstance(member.ValueType, nextLength);
-                Array.Copy(column, next, column.Length);
-                _columns[member.Name] = next;
-            }
-        }
-
-        private void WriteRow(int row, object document)
-        {
-            foreach (var member in _members.Values)
-            {
-                ((Array)_columns[member.Name]).SetValue(member.Get(document), row);
-            }
-        }
-
-        private void CopyRow(int sourceRow, int targetRow)
-        {
-            foreach (var member in _members.Values)
-            {
-                var column = (Array)_columns[member.Name];
-                column.SetValue(column.GetValue(sourceRow), targetRow);
-            }
-        }
-    }
-
-    internal sealed class CultCacheSoaMember
-    {
-        private CultCacheSoaMember(string name, Type valueType, Func<object, object?> getter)
-        {
-            Name = name;
-            ValueType = valueType;
-            Get = getter;
-        }
-
-        public string Name { get; }
-        public Type ValueType { get; }
-        public Func<object, object?> Get { get; }
-
-        public static IEnumerable<CultCacheSoaMember> Discover(Type documentType)
-        {
-            const BindingFlags flags = BindingFlags.Instance | BindingFlags.Public;
-            foreach (var field in documentType.GetFields(flags).OrderBy(field => field.MetadataToken))
-            {
-                if (IsColumnType(field.FieldType))
-                {
-                    yield return new CultCacheSoaMember(field.Name, field.FieldType, field.GetValue);
-                }
-            }
-
-            foreach (var property in documentType.GetProperties(flags).OrderBy(property => property.MetadataToken))
-            {
-                if (property.GetMethod != null &&
-                    property.GetIndexParameters().Length == 0 &&
-                    IsColumnType(property.PropertyType))
-                {
-                    yield return new CultCacheSoaMember(property.Name, property.PropertyType, property.GetValue);
-                }
-            }
-        }
-
-        private static bool IsColumnType(Type type)
-        {
-            return type.IsEnum ||
-                   type == typeof(byte) ||
-                   type == typeof(sbyte) ||
-                   type == typeof(short) ||
-                   type == typeof(ushort) ||
-                   type == typeof(int) ||
-                   type == typeof(uint) ||
-                   type == typeof(long) ||
-                   type == typeof(ulong) ||
-                   type == typeof(float) ||
-                   type == typeof(double) ||
-                   type == typeof(bool);
-        }
-    }
 }
diff --git a/src/GameCult.Caching/CultSchemaTypeNames.cs b/src/GameCult.Caching/CultSchemaTypeNames.cs
new file mode 100644
index 00000000..ada0d594
--- /dev/null
+++ b/src/GameCult.Caching/CultSchemaTypeNames.cs
@@ -0,0 +1,57 @@
+using System;
+using System.Linq;
+using System.Text;
+
+namespace GameCult.Caching
+{
+    internal static class CultSchemaTypeNames
+    {
+        public static string FromType(Type type)
+        {
+            if (type.IsArray)
+            {
+                return FromType(type.GetElementType()!) + "[]";
+            }
+
+            if (type.IsGenericType)
+            {
+                var definition = type.GetGenericTypeDefinition();
+                var name = definition.FullName ?? definition.Name;
+                var tickIndex = name.IndexOf('`');
+                if (tickIndex >= 0)
+                {
+                    name = name[..tickIndex];
+                }
+
+                var arguments = string.Join(", ", type.GetGenericArguments().Select(FromType));
+                return $"{name}<{arguments}>";
+            }
+
+            return type.FullName ?? type.Name;
+        }
+
+        public static string EscapeForLiteral(string value)
+        {
+            if (string.IsNullOrEmpty(value))
+            {
+                return value;
+            }
+
+            var builder = new StringBuilder(value.Length);
+            foreach (var character in value)
+            {
+                builder.Append(character switch
+                {
+                    '\\' => "\\\\",
+                    '"' => "\\\"",
+                    '\r' => "\\r",
+                    '\n' => "\\n",
+                    '\t' => "\\t",
+                    _ => character.ToString()
+                });
+            }
+
+            return builder.ToString();
+        }
+    }
+}
diff --git a/src/GameCult.Caching/GameCult.Caching.csproj b/src/GameCult.Caching/GameCult.Caching.csproj
index 194872bc..a34cdfd3 100644
--- a/src/GameCult.Caching/GameCult.Caching.csproj
+++ b/src/GameCult.Caching/GameCult.Caching.csproj
@@ -1,10 +1,11 @@
 <Project Sdk="Microsoft.NET.Sdk">
   <PropertyGroup>
     <Description>CultCache: Concurrent polymorphic cache with modular backing stores for .NET</Description>
+    <NoWarn>$(NoWarn);CS1591</NoWarn>
   </PropertyGroup>
   
   <ItemGroup>
-    <ProjectReference Include="..\GameCult.Logging\GameCult.Logging.csproj" />
+    <PackageReference Include="MessagePack.Annotations" Version="3.1.7" />
     <PackageReference Include="R3" Version="1.3.0" />
     <PackageReference Include="ConcurrentHashSet " Version="1.3.0" />
   </ItemGroup>
diff --git a/src/GameCult.Caching/GameCult.Caching.txt b/src/GameCult.Caching/GameCult.Caching.txt
deleted file mode 100644
index ab959478..00000000
--- a/src/GameCult.Caching/GameCult.Caching.txt
+++ /dev/null
@@ -1,1213 +0,0 @@
-
-
-// E:\Projects\CultLib\src\GameCult.Caching\CultCache.cs
-
-using System;
-using System.Collections.Concurrent;
-using System.Collections.Generic;
-using System.IO;
-using System.Linq;
-using System.Reflection;
-using System.Threading.Tasks;
-using ConcurrentCollections;
-using GameCult.Logging;
-using MessagePack;
-using R3;
-
-namespace GameCult.Caching
-{
-    /// <summary>
-    /// Specifies that the decorated class contains global settings.
-    /// Use this attribute to mark classes intended to hold application-wide configuration or settings.
-    /// </summary>
-    [AttributeUsage(AttributeTargets.Class)]
-    public class GlobalSettingsAttribute : Attribute { }
-    
-    /// <summary>
-    /// Represents an in-memory and persistent cache for <see cref="DatabaseEntry"/> objects, supporting global entries,
-    /// named entries, generic field indexes, and multiple backing stores. Provides thread-safe operations for adding,
-    /// retrieving, indexing, and removing entries, with support for event notifications and logging.
-    /// </summary>
-    /// <remarks>
-    /// <para>
-    /// <b>Features:</b>
-    /// <list type="bullet">
-    /// <item>Supports multiple <see cref="CacheBackingStore"/>s for persistence and synchronization.</item>
-    /// <item>Handles global settings entries via <see cref="GlobalSettingsAttribute"/>.</item>
-    /// <item>Provides fast lookup by ID, name (for <see cref="INamedEntry"/>), and indexed fields.</item>
-    /// <item>Allows registering generic indexes for any public field of a <see cref="DatabaseEntry"/> type.</item>
-    /// <item>Thread-safe via <see cref="ConcurrentDictionary{TKey, TValue}"/> and <see cref="ConcurrentHashSet{T}"/>.</item>
-    /// <item>Notifies on entry updates via <see cref="OnUpdate"/> event.</item>
-    /// <item>Supports both synchronous and asynchronous add operations.</item>
-    /// <item>Integrates with <see cref="ILogger"/> for error and event logging.</item>
-    /// </list>
-    /// </para>
-    /// <para>
-    /// <b>Usage:</b>
-    /// <code>
-    /// var cache = new CultCache();
-    /// cache.RegisterIndex&lt;PlayerData&gt;("Email");
-    /// cache.AddAsync(new PlayerData { ... }).GetAwaiter().GetResult();
-    /// var player = cache.GetByIndex&lt;PlayerData&gt;("Email", "user@example.com");
-    /// </code>
-    /// </para>
-    /// </remarks>
-    public class CultCache : IDisposable
-    {
-        private readonly object addLock = new object(); // Retained for synchronous Add compatibility
-
-        /// <summary>
-        /// Occurs when a <see cref="DatabaseEntry"/> is updated.
-        /// The event provides the old and new <see cref="DatabaseEntry"/> instances.
-        /// </summary>
-        /// <remarks>
-        /// The first parameter is the previous entry, and the second parameter is the updated entry.
-        /// The first parameter will be <c>null</c> if the entry is newly added,
-        /// and the second parameter will be <c>null</c> if the entry is deleted.
-        /// </remarks>
-        public event Action<DatabaseEntry?, DatabaseEntry?>? OnUpdate;
-
-        private readonly List<CacheBackingStore> _backingStores = new();
-        private readonly ConcurrentDictionary<Type, CacheBackingStore> _typeStores = new();
-        private readonly ConcurrentDictionary<CacheBackingStore, Type[]> _storeTypes = new();
-        private readonly ConcurrentDictionary<Guid, DatabaseEntry> _entries = new();
-        private readonly ConcurrentDictionary<Type, DatabaseEntry?> _globals = new();
-        private readonly ConcurrentDictionary<Type, ConcurrentHashSet<DatabaseEntry>> _types = new();
-        private readonly ConcurrentDictionary<Type, ConcurrentDictionary<string, Guid>> _nameToIdMap = new();
-        // Generic indexes: Map (Type, FieldName) -> (Value -> ID). Allows registering indexes for any field
-        private readonly ConcurrentDictionary<(Type Type, string FieldName), ConcurrentDictionary<string, Guid>> _indexes = new();
-        // Cache getters per type (list of (field, getter) for that type only). Avoids scanning all indexes.
-        private readonly ConcurrentDictionary<Type, List<(string FieldName, Func<DatabaseEntry, string> Getter)>> _typeToGetters = new();
-        private ILogger _logger = new NullLogger();
-        
-        /// <summary>
-        /// Gets or sets the <see cref="ILogger"/> instance used for logging within the cache.
-        /// If set to <c>null</c>, a <see cref="NullLogger"/> will be used as a fallback.
-        /// </summary>
-        public ILogger Logger
-        {
-            get => _logger;
-            set => _logger = value ?? new NullLogger();
-        }
-
-        /// <summary>
-        /// Gets all <see cref="DatabaseEntry"/> objects currently stored in the cache.
-        /// </summary>
-        public IEnumerable<DatabaseEntry> AllEntries => _entries.Values;
-
-        /// <summary>
-        /// Initializes a new instance of the <see cref="CultCache"/> class.
-        /// Sets up the cache by registering all child classes of <see cref="DatabaseEntry"/>.
-        /// For each child type:
-        /// <list type="bullet">
-        /// <item>Adds a concurrent hash set for caching entries of that type.</item>
-        /// <item>If the type is marked with <see cref="GlobalSettingsAttribute"/>, adds it to the global settings and creates an instance.</item>
-        /// <item>If the type implements <see cref="INamedEntry"/>, initializes a name-to-ID mapping dictionary.</item>
-        /// </list>
-        /// Also sets the static cache reference in <see cref="DatabaseLinkBase"/>.
-        /// </summary>
-        public CultCache()
-        {
-            DatabaseLinkBase.Cache = this;
-
-            foreach (var type in typeof(DatabaseEntry).GetAllChildClasses())
-            {
-                _types.TryAdd(type, new ConcurrentHashSet<DatabaseEntry>());
-                if (type.GetCustomAttribute<GlobalSettingsAttribute>() != null)
-                {
-                    _globals.TryAdd(type, null);
-                    try
-                    {
-                        var global = (DatabaseEntry)Activator.CreateInstance(type)!;
-                        AddAsync(global).GetAwaiter().GetResult();
-                        _globals[type] = global;  // Update after successful add
-                    }
-                    catch (Exception ex)
-                    {
-                        Logger.LogError($"Failed to initialize global {type.Name}: {ex.Message}");
-                        _globals[type] = null;
-                    }
-                }
-                // Initialize name-to-ID map for INamedEntry types
-                if (typeof(INamedEntry).IsAssignableFrom(type))
-                {
-                    _nameToIdMap.TryAdd(type, new ConcurrentDictionary<string, Guid>());
-                }
-            }
-        }
-
-        /// <summary>
-        /// Adds a backing store to the cache system and configures domain type associations and event subscriptions.
-        /// </summary>
-        /// <param name="store">The <see cref="CacheBackingStore"/> instance to add.</param>
-        /// <param name="domain">
-        /// Optional array of <see cref="Type"/> objects representing domain types associated with the backing store.
-        /// If provided, the store is mapped to these types; otherwise, the store is added to the general backing store list and subscribes to existing stores.
-        /// </param>
-        /// <remarks>
-        /// <para>
-        /// If no domain types are specified, the store subscribes to all existing backing stores to receive their updates,
-        /// ensuring synchronization across stores, with the first store added acting as the primary source of truth.
-        /// </para>
-        /// <para>
-        /// Specifying domain types allows for targeted storage and retrieval of specific <see cref="DatabaseEntry"/> types,
-        /// for example, using a database store for user data and a file-based store for configuration data or game assets.
-        /// </para>
-        /// </remarks>
-        public void AddBackingStore(CacheBackingStore store, params Type[] domain)
-        {
-            if (domain.Length > 0)
-            {
-                _storeTypes.TryAdd(store, domain);
-                foreach (var t in domain) _typeStores.TryAdd(t, store);
-            }
-            else
-            {
-                foreach (var existingStore in _backingStores) store.SubscribeTo(existingStore);
-                _backingStores.Add(store);
-            }
-            store.EntryAdded.Subscribe(async entry =>
-            {
-                try // Try-catch logs without swallowing. Added to EntryDeleted for consistency (even though sync)
-                {
-                    await AddAsync(entry, store);
-                    OnUpdate?.Invoke(null, entry);
-                }
-                catch (Exception ex)
-                {
-                    Logger.LogError($"EntryAdded processing failed for {entry?.ID}: {ex.Message}");
-                }
-            });
-            store.EntryUpdated.Subscribe(async entry =>
-            {
-                try
-                {
-                    await AddAsync(entry, store);
-                    OnUpdate?.Invoke(entry, entry);
-                }
-                catch (Exception ex)
-                {
-                    Logger.LogError($"EntryUpdated processing failed for {entry?.ID}: {ex.Message}");
-                }
-            });
-            store.EntryDeleted.Subscribe(entry =>
-            {
-                try
-                {
-                    Remove(entry, store);
-                    OnUpdate?.Invoke(entry, null);
-                }
-                catch (Exception ex)
-                {
-                    Logger.LogError($"EntryDeleted processing failed for {entry?.ID}: {ex.Message}");
-                }
-            });
-            store.Logger = Logger;
-        }
-        
-        /// <summary>
-        /// Asynchronously pulls all data from the backing stores.
-        /// Initiates parallel tasks to execute the <c>PullAll</c> method on each backing store and store type,
-        /// and waits for all tasks to complete.
-        /// </summary>
-        /// <returns>A task that represents the asynchronous operation.</returns>
-        public async Task PullAllBackingStoresAsync()
-        {
-            var tasks = _backingStores.Select(store => Task.Run(store.PullAll))
-                .Concat(_storeTypes.Keys.Select(store => Task.Run(store.PullAll)))
-                .ToArray();
-            await Task.WhenAll(tasks);
-        }
-
-        /// <summary>
-        /// Adds a <see cref="DatabaseEntry"/> to the cache asynchronously, updating all relevant maps and indexes.
-        /// If the entry already exists, cleans up old mappings before updating.
-        /// Also persists the entry to the backing store if available.
-        /// </summary>
-        /// <param name="entry">The <see cref="DatabaseEntry"/> to add or update in the cache.</param>
-        /// <param name="source">
-        /// The <see cref="CacheBackingStore"/> source from which the entry originated, used internally to avoid redundant writes.
-        /// Optional; defaults to <c>null</c>.
-        /// </param>
-        /// <returns>A <see cref="Task"/> representing the asynchronous operation.</returns>
-        public async Task AddAsync(DatabaseEntry entry, CacheBackingStore? source = null)
-        {
-            if (entry == null) return;
-
-            var type = entry.GetType();
-
-            // Pre-fetch existing to detect updates (for map/index cleanup)
-            if (!_entries.TryGetValue(entry.ID, out var existing)) existing = null;
-
-            // Cleanup old maps/indexes BEFORE updating _entries
-            if (existing != null)
-            {
-                // For name map (if updating existing)
-                if (existing is INamedEntry existingNamed && _nameToIdMap.TryGetValue(type, out var nameMap))
-                {
-                    nameMap.TryRemove(existingNamed.EntryName, out _);
-                }
-
-                // For generic indexes (if registered)
-                if (_typeToGetters.TryGetValue(type, out var getters))
-                {
-                    foreach (var (fieldName, getter) in getters)
-                    {
-                        var oldValue = getter(existing);
-                        if (!string.IsNullOrEmpty(oldValue))
-                        {
-                            var indexKey = (type, fieldName);
-                            _indexes[indexKey].TryRemove(oldValue, out _);
-                        }
-                    }
-                }
-                
-                // For type sets
-                _types[existing.GetType()].TryRemove(existing);
-                foreach (var parentType in existing.GetType().GetParentTypes())
-                {
-                    if (_types.TryGetValue(parentType, out var typeSet))
-                        typeSet.TryRemove(existing);
-                }
-            }
-
-            _entries[entry.ID] = entry;
-            _types[type].Add(entry);  // Assumes exists; throws if not (edge case)
-            foreach (var parentType in type.GetParentTypes())
-            {
-                if (_types.TryGetValue(parentType, out var typeSet))
-                    typeSet.Add(entry);
-            }
-
-            if (_globals.ContainsKey(type))
-            {
-                _globals.AddOrUpdate(type, entry, (_, old) => entry);
-            }
-
-            // Add new values (always, for both new and updates)
-            // Update name-to-ID map if INamedEntry
-            if (entry is INamedEntry namedEntry && _nameToIdMap.TryGetValue(type, out var nameMap2))
-            {
-                nameMap2[namedEntry.EntryName] = entry.ID;
-            }
-
-            // Update generic indexes if registered for this type
-            if (_typeToGetters.TryGetValue(type, out var getters2))
-            {
-                foreach (var (fieldName, getter) in getters2)
-                {
-                    var value = getter(entry);
-                    if (!string.IsNullOrEmpty(value))
-                    {
-                        var indexKey = (type, fieldName);
-                        _indexes[indexKey][value] = entry.ID;
-                    }
-                }
-            }
-
-            // Async file write
-            try
-            {
-                if (_typeStores.TryGetValue(type, out var store))
-                    await Task.Run(() => store.Push(entry));
-                else if (_backingStores.Any() && _backingStores.First() != source)
-                    await Task.Run(() => _backingStores.First().Push(entry));
-            }
-            catch (Exception ex)
-            {
-                // Log error but don't revert cache update to ensure consistency
-                Logger.LogError($"Failed to persist entry {entry.ID}: {ex.Message}");
-            }
-        }
-
-        /// <summary>
-        /// Determines whether the specified <see cref="DatabaseEntry"/> is a global settings entry.
-        /// </summary>
-        /// <param name="entry">The <see cref="DatabaseEntry"/> to check.</param>
-        /// <returns><c>true</c> if the entry is global; otherwise, <c>false</c>.</returns>
-        public bool IsGlobal(DatabaseEntry entry) => _globals.ContainsKey(entry.GetType());
-
-        /// <summary>
-        /// Adds all <see cref="DatabaseEntry"/> objects from the specified collection to the cache asynchronously.
-        /// </summary>
-        /// <param name="entries">The collection of <see cref="DatabaseEntry"/> objects to add.</param>
-        /// <param name="source">
-        /// The <see cref="CacheBackingStore"/> source from which the entries originated, used to avoid redundant writes.
-        /// Optional; defaults to <c>null</c>.
-        /// </param>
-        /// <returns>A <see cref="Task"/> representing the asynchronous operation.</returns>
-        public Task AddAllAsync(IEnumerable<DatabaseEntry> entries, CacheBackingStore? source = null)
-        {
-            var tasks = entries.Select(entry => AddAsync(entry, source)).ToArray();
-            return Task.WhenAll(tasks);
-        }
-
-        /// <summary>
-        /// Retrieves a <see cref="DatabaseEntry"/> from the cache by its unique <see cref="Guid"/> identifier.
-        /// </summary>
-        /// <param name="guid">The unique identifier of the entry to retrieve.</param>
-        /// <returns>The <see cref="DatabaseEntry"/> associated with the specified <see cref="Guid"/>, or <c>null</c> if not found.</returns>
-        public DatabaseEntry Get(Guid guid)
-        {
-            _entries.TryGetValue(guid, out var entry);
-            return entry;
-        }
-
-        /// <summary>
-        /// Retrieves a <see cref="DatabaseEntry"/> of type <typeparamref name="T"/> from the cache by its unique <see cref="Guid"/> identifier.
-        /// </summary>
-        /// <typeparam name="T">The type of <see cref="DatabaseEntry"/> to retrieve.</typeparam>
-        /// <param name="guid">The unique identifier of the entry to retrieve.</param>
-        /// <returns>The entry of type <typeparamref name="T"/> associated with the specified <see cref="Guid"/>, or <c>null</c> if not found or not of type <typeparamref name="T"/>.</returns>
-        public T? Get<T>(Guid guid) where T : DatabaseEntry
-        {
-            return Get(guid) as T;
-        }
-
-        /// <summary>
-        /// Retrieves the global <see cref="DatabaseEntry"/> instance for the specified type, if it exists.
-        /// </summary>
-        /// <param name="type">The type of the global entry to retrieve.</param>
-        /// <returns>The global <see cref="DatabaseEntry"/> instance associated with the specified type, or <c>null</c> if not found.</returns>
-        public DatabaseEntry? GetGlobal(Type type)
-        {
-            _globals.TryGetValue(type, out var entry);
-            return entry;
-        }
-
-        /// <summary>
-        /// Retrieves the global <see cref="DatabaseEntry"/> instance of type <typeparamref name="T"/>, if it exists.
-        /// </summary>
-        /// <typeparam name="T">The type of the global entry to retrieve.</typeparam>
-        /// <returns>The global entry of type <typeparamref name="T"/>, or <c>null</c> if not found.</returns>
-        public T? GetGlobal<T>() where T : DatabaseEntry
-        {
-            return GetGlobal(typeof(T)) as T;
-        }
-
-        /// <summary>
-        /// Retrieves all <see cref="DatabaseEntry"/> objects of the specified type from the cache.
-        /// </summary>
-        /// <param name="type">The type of <see cref="DatabaseEntry"/> to retrieve.</param>
-        /// <returns>An enumerable collection of <see cref="DatabaseEntry"/> objects of the specified type.</returns>
-        public IEnumerable<DatabaseEntry> GetAll(Type type)
-        {
-            return _types.TryGetValue(type, out var entries) ? entries : Enumerable.Empty<DatabaseEntry>();
-        }
-
-        /// <summary>
-        /// Retrieves all <see cref="DatabaseEntry"/> objects of type <typeparamref name="T"/> from the cache.
-        /// </summary>
-        /// <typeparam name="T">The type of <see cref="DatabaseEntry"/> to retrieve.</typeparam>
-        /// <returns>An enumerable collection of <typeparamref name="T"/> objects from the cache.</returns>
-        public IEnumerable<T> GetAll<T>() where T : DatabaseEntry
-        {
-            return _types.TryGetValue(typeof(T), out var entries) ? entries.Cast<T>() : Enumerable.Empty<T>();
-        }
-        
-        /// <summary>
-        /// Retrieves the unique identifier (<see cref="Guid"/>) of an entry of type <typeparamref name="T"/> by its name.
-        /// </summary>
-        /// <typeparam name="T">The type of <see cref="DatabaseEntry"/> that implements <see cref="INamedEntry"/>.</typeparam>
-        /// <param name="name">The name of the entry to look up.</param>
-        /// <returns>The <see cref="Guid"/> of the entry if found; otherwise, <c>null</c>.</returns>
-        public Guid? GetIdByName<T>(string name) where T : DatabaseEntry, INamedEntry
-        {
-            var type = typeof(T);
-            if (_nameToIdMap.TryGetValue(type, out var nameMap) && nameMap.TryGetValue(name, out var id))
-                return id;
-            return null;
-        }
-
-        /// <summary>
-        /// Retrieves an entry of type <typeparamref name="T"/> by its name from the cache.
-        /// </summary>
-        /// <typeparam name="T">The type of <see cref="DatabaseEntry"/> that implements <see cref="INamedEntry"/>.</typeparam>
-        /// <param name="name">The name of the entry to retrieve.</param>
-        /// <returns>The entry of type <typeparamref name="T"/> if found; otherwise, <c>null</c>.</returns>
-        public T? GetByName<T>(string name) where T : DatabaseEntry, INamedEntry
-        {
-            return GetIdByName<T>(name) is { } id ? Get<T>(id) : null;
-        }
-        
-        /// <summary>
-        /// Registers an index for a public member (field or property) of the specified <see cref="DatabaseEntry"/> type.
-        /// This enables fast lookup of entries by the value of the indexed member.
-        /// Call this method once per member to be indexed.
-        /// </summary>
-        /// <typeparam name="T">The type of <see cref="DatabaseEntry"/> for which to register the index.</typeparam>
-        /// <param name="memberName">The name of the public member to index.</param>
-        /// <exception cref="ArgumentException">Thrown if the specified member does not exist on the type.</exception>
-        public void RegisterIndex<T>(string memberName) where T : DatabaseEntry
-        {
-            var type = typeof(T);
-            var key = (type, memberName);
-            if (_indexes.ContainsKey(key))
-                return;  // Already registered; ignore
-
-            _indexes[key] = new ConcurrentDictionary<string, Guid>();
-
-            // Cache a getter func for perf.
-            if (type.GetField(memberName) is { } field)
-            {
-                var getter = (Func<DatabaseEntry, string>)(entry => field.GetValue(entry)?.ToString() ?? string.Empty);
-                _typeToGetters.AddOrUpdate(type,
-                    _ => new List<(string, Func<DatabaseEntry, string>)> { (memberName, getter) },
-                    (_, list) => { list.Add((memberName, getter)); return list; });
-            }
-            else if (type.GetProperty(memberName) is { } property)
-            {
-                var getter = (Func<DatabaseEntry, string>)(entry => property.GetValue(entry)?.ToString() ?? string.Empty);
-                _typeToGetters.AddOrUpdate(type,
-                    _ => new List<(string, Func<DatabaseEntry, string>)> { (memberName, getter) },
-                    (_, list) => { list.Add((memberName, getter)); return list; });
-            }
-            else
-            {
-                throw new ArgumentException($"No public field or property '{memberName}' on {type.Name}");
-            }
-        }
-
-        /// <summary>
-        /// Retrieves the unique identifier (<see cref="Guid"/>) of an entry of type <typeparamref name="T"/> by the value of an indexed field.
-        /// </summary>
-        /// <typeparam name="T">The type of <see cref="DatabaseEntry"/> for which the index is registered.</typeparam>
-        /// <param name="fieldName">The name of the indexed field.</param>
-        /// <param name="value">The value of the indexed field to look up.</param>
-        /// <returns>The <see cref="Guid"/> of the entry if found; otherwise, <c>null</c>.</returns>
-        public Guid? GetIdByIndex<T>(string fieldName, string value) where T : DatabaseEntry
-        {
-            var key = (typeof(T), fieldName);
-            if (_indexes.TryGetValue(key, out var indexMap) && indexMap.TryGetValue(value, out var id))
-                return id;
-            return null;
-        }
-
-        /// <summary>
-        /// Retrieves an entry of type <typeparamref name="T"/> by the value of an indexed field from the cache.
-        /// </summary>
-        /// <typeparam name="T">The type of <see cref="DatabaseEntry"/> for which the index is registered.</typeparam>
-        /// <param name="fieldName">The name of the indexed field.</param>
-        /// <param name="value">The value of the indexed field to look up.</param>
-        /// <returns>The entry of type <typeparamref name="T"/> if found; otherwise, <c>null</c>.</returns>
-        public T? GetByIndex<T>(string fieldName, string value) where T : DatabaseEntry
-        {
-            return GetIdByIndex<T>(fieldName, value) is { } id ? Get<T>(id) : null;
-        }
-        
-        /// <summary>
-        /// Removes the specified <see cref="DatabaseEntry"/> from the cache, including all associated indexes, type stores, 
-        /// global references, parent type sets, and name-to-ID mappings.
-        /// </summary>
-        /// <param name="entry">The <see cref="DatabaseEntry"/> to remove from the cache.</param>
-        /// <param name="source">
-        /// The <see cref="CacheBackingStore"/> to exclude from deletion. Used internally to avoid redundant deletions when the entry originates from a specific store.
-        /// </param>
-        public void Remove(DatabaseEntry entry, CacheBackingStore? source = null)
-        {
-            var type = entry.GetType();
-            if (!_entries.TryRemove(entry.ID, out _)) return;
-
-            // Clean up type sets
-            _types[type].TryRemove(entry);
-            foreach (var parentType in type.GetParentTypes())
-            {
-                if (_types.TryGetValue(parentType, out var typeSet))
-                    typeSet.TryRemove(entry);
-            }
-
-            // Clean up global if applicable
-            if (_globals.TryGetValue(type, out var global) && global != null && global.Equals(entry)) _globals[type] = null!;
-
-            // Propagate delete to backing stores (except source)
-            if (_typeStores.TryGetValue(type, out var typeStore))
-                typeStore.Delete(entry);
-            else
-            {
-                foreach (var store in _backingStores)
-                {
-                    if (store != source)
-                        store.Delete(entry);
-                }
-            }
-
-            // Clean up name-to-ID map if INamedEntry
-            if (entry is INamedEntry namedEntry && _nameToIdMap.TryGetValue(type, out var nameMap))
-            {
-                nameMap.TryRemove(namedEntry.EntryName, out _);
-            }
-
-            // Clean up generic indexes if registered for this type
-            if (_typeToGetters.TryGetValue(type, out var getters))
-            {
-                foreach (var (fieldName, getter) in getters)
-                {
-                    var value = getter(entry);
-                    if (!string.IsNullOrEmpty(value))
-                    {
-                        var indexKey = (type, fieldName);
-                        _indexes[indexKey].TryRemove(value, out _);
-                    }
-                }
-            }
-        }
-        
-        /// <inheritdoc/>
-        public void Dispose()
-        {
-            foreach (var store in _backingStores)
-                if (store is IDisposable d) d.Dispose();
-            foreach (var store in _storeTypes.Keys)
-                if (store is IDisposable d) d.Dispose();
-        }
-    }
-
-    /// <summary>
-    /// Represents a backing store that supports observing real-time changes.
-    /// </summary>
-    public interface IRealtimeBackingStore
-    {
-        /// <summary>
-        /// Begins observing real-time changes in the backing store and triggers appropriate events when changes occur.
-        /// </summary>
-        public void ObserveChanges();
-    }
-
-    /// <summary>
-    /// Represents an abstract backing store for caching <see cref="DatabaseEntry"/> objects.
-    /// Provides mechanisms for pulling, pushing, deleting, and synchronizing entries, as well as event notifications for entry changes.
-    /// </summary>
-    public abstract class CacheBackingStore : IDisposable
-    {
-        private ILogger _logger = new NullLogger();
-        
-        /// <summary>
-        /// Gets or sets the <see cref="ILogger"/> instance used for logging within the cache.
-        /// If set to <c>null</c>, a <see cref="NullLogger"/> will be used as a fallback.
-        /// </summary>
-        public ILogger Logger
-        {
-            get => _logger;
-            set => _logger = value ?? new NullLogger();
-        }
-        
-        /// <summary>
-        /// Initializes a new instance of the <see cref="CacheBackingStore"/> class.
-        /// Sets up subjects for entry added, deleted, and updated events.
-        /// </summary>
-        protected CacheBackingStore()
-        {
-            EntryAdded = new Subject<DatabaseEntry>();
-            EntryDeleted = new Subject<DatabaseEntry>();
-            EntryUpdated = new Subject<DatabaseEntry>();
-        }
-
-        /// <summary>
-        /// Pulls all entries from the backing store into the cache.
-        /// Implementations should load all persisted <see cref="DatabaseEntry"/> objects and notify via <see cref="EntryAdded"/>.
-        /// </summary>
-        public abstract void PullAll();
-        /// <summary>
-        /// Persists the specified <see cref="DatabaseEntry"/> to the backing store.
-        /// Implementations should save or update the entry in the underlying storage.
-        /// </summary>
-        /// <param name="entry">The <see cref="DatabaseEntry"/> to persist.</param>
-        public abstract void Push(DatabaseEntry entry);
-        /// <summary>
-        /// Deletes the specified <see cref="DatabaseEntry"/> from the backing store.
-        /// Implementations should remove the entry from the underlying storage.
-        /// </summary>
-        /// <param name="entry">The <see cref="DatabaseEntry"/> to delete.</param>
-        public abstract void Delete(DatabaseEntry entry);
-        /// <summary>
-        /// Persists all <see cref="DatabaseEntry"/> objects to the backing store.
-        /// Implementations should save or update all entries in the underlying storage.
-        /// </summary>
-        /// <param name="soft">
-        /// If <c>true</c>, performs a soft push (implementation-specific); otherwise, performs a full push.
-        /// </param>
-        public abstract void PushAll(bool soft = false);
-        
-        /// <summary>
-        /// Gets the subject that notifies when a <see cref="DatabaseEntry"/> is added to the backing store.
-        /// </summary>
-        public Subject<DatabaseEntry> EntryAdded { get; }
-        /// <summary>
-        /// Gets the subject that notifies when a <see cref="DatabaseEntry"/> is deleted from the backing store.
-        /// </summary>
-        public Subject<DatabaseEntry> EntryDeleted { get; }
-        /// <summary>
-        /// Gets the subject that notifies when a <see cref="DatabaseEntry"/> is updated in the backing store.
-        /// </summary>
-        public Subject<DatabaseEntry> EntryUpdated { get; }
-
-        /// <summary>
-        /// Stores all <see cref="DatabaseEntry"/> objects managed by this backing store, keyed by their unique <see cref="Guid"/> identifier.
-        /// </summary>
-        protected ConcurrentDictionary<Guid, DatabaseEntry> Entries = new();
-
-        /// <summary>
-        /// Subscribes this backing store to the entry events of another <see cref="CacheBackingStore"/>, 
-        /// so that added, deleted, and updated entries in the target store are automatically pushed or deleted in this store.
-        /// </summary>
-        /// <param name="targetStore">The target <see cref="CacheBackingStore"/> to subscribe to.</param>
-        public void SubscribeTo(CacheBackingStore targetStore)
-        {
-            targetStore.EntryAdded.Subscribe(Push);
-            targetStore.EntryDeleted.Subscribe(Delete);
-            targetStore.EntryUpdated.Subscribe(Push);
-        }
-
-        /// <inheritdoc/>
-        public void Dispose()
-        {
-            EntryAdded?.Dispose();
-            EntryDeleted?.Dispose();
-            EntryUpdated?.Dispose();
-        }
-    }
-    
-    /// <summary>
-    /// An abstract cache backing store that persists <see cref="DatabaseEntry"/> objects as individual files,
-    /// organizing them by entry type in subdirectories under a root directory. Supports real-time change observation
-    /// via <see cref="FileSystemWatcher"/> and provides serialization/deserialization hooks for custom formats.
-    /// </summary>
-    /// <remarks>
-    /// <para>
-    /// Each entry type is mapped to its own directory, and entries are stored as files with a configurable extension.
-    /// The class maintains a mapping between file paths and entry IDs for efficient lookup and change tracking.
-    /// </para>
-    /// <para>
-    /// Real-time changes (creation, modification, deletion) to files are observed and propagated to upstream subscribers
-    /// using Rx subjects and debounced event handling.
-    /// </para>
-    /// <para>
-    /// Subclasses must implement <see cref="Serialize(DatabaseEntry)"/>, <see cref="Deserialize(byte[])"/>, and <see cref="Extension"/>
-    /// to define the file format.
-    /// </para>
-    /// </remarks>
-    public abstract class MultiFileBackingStore : CacheBackingStore, IRealtimeBackingStore, IDisposable
-    {
-        /// <summary>
-        /// Gets the root directory where all entry files are stored.
-        /// </summary>
-        public DirectoryInfo RootDirectory { get; }
-        /// <summary>
-        /// Maps each <see cref="DatabaseEntry"/> type to its corresponding subdirectory.
-        /// </summary>
-        protected readonly Dictionary<Type, DirectoryInfo> EntryTypeDirectories = new();
-        /// <summary>
-        /// Maps file paths to their corresponding <see cref="DatabaseEntry"/> IDs for quick lookup during change detection.
-        /// </summary>
-        protected readonly ConcurrentDictionary<string, Guid> _filePathToIdMap = new();
-        private FileSystemWatcher? watcher;
-        private Subject<string>? _changedSubject;
-
-        /// <summary>
-        /// Serializes a <see cref="DatabaseEntry"/> into a byte array for file storage.
-        /// </summary>
-        /// <param name="entry">The <see cref="DatabaseEntry"/> to serialize.</param>
-        /// <returns>A byte array representing the serialized entry.</returns>
-        public abstract byte[] Serialize(DatabaseEntry entry);
-        /// <summary>
-        /// Deserializes a byte array into a <see cref="DatabaseEntry"/> object.
-        /// </summary>
-        /// <param name="data">The byte array containing the serialized entry.</param>
-        /// <returns>The deserialized <see cref="DatabaseEntry"/> object.</returns>
-        public abstract DatabaseEntry Deserialize(byte[] data);
-        /// <summary>
-        /// Gets the file extension used for storing entries (e.g., ".json", ".msgpack").
-        /// </summary>
-        public abstract string Extension { get; }
-
-        /// <summary>
-        /// Initializes a new instance of the <see cref="MultiFileBackingStore"/> class.
-        /// Creates the root directory if it does not exist and sets up subdirectories for each <see cref="DatabaseEntry"/> child type.
-        /// </summary>
-        /// <param name="path">The path to the root directory for storing entry files.</param>
-        public MultiFileBackingStore(string path)
-        {
-            RootDirectory = new DirectoryInfo(path);
-            foreach (var type in typeof(DatabaseEntry).GetAllChildClasses())
-            {
-                EntryTypeDirectories[type] = GetDirectoryForType(type);
-            }
-        }
-
-        private DirectoryInfo GetDirectoryForType(Type type)
-        {
-            var stack = new Stack<string>();
-            var t = type;
-            while (t != null && t != typeof(DatabaseEntry))
-            {
-                stack.Push(t.Name);
-                t = t.BaseType;
-            }
-            stack.Push(RootDirectory.FullName);
-            // ToArray() copies in LIFO order (top/first: root, then parents, deepest child last)
-            // Ensures Path.Combine yields: Root\Parent\...\Child
-            return Directory.CreateDirectory(Path.Combine(stack.ToArray()));
-        }
-        
-        /// <summary>
-        /// Loads all <see cref="DatabaseEntry"/> objects from individual files in the root directory and its subdirectories,
-        /// organized by entry type. Each file is deserialized using <see cref="Deserialize(byte[])"/>,
-        /// added to the local <see cref="CacheBackingStore.Entries"/> dictionary, and notifies upstream via <see cref="CacheBackingStore.EntryAdded"/>.
-        /// Skips files that cannot be deserialized, logging errors without failing the entire operation.
-        /// Only processes files matching the <see cref="Extension"/>.
-        /// </summary>
-        public override void PullAll()
-        {
-            if (!RootDirectory.Exists) return;
-
-            foreach (var directory in EntryTypeDirectories.Values)
-            {
-                foreach (var file in directory.EnumerateFiles($"*.{Extension}"))
-                {
-                    try
-                    {
-                        var entry = Deserialize(File.ReadAllBytes(file.FullName));
-                        Entries[entry.ID] = entry;
-                        EntryAdded.OnNext(entry);
-                        _filePathToIdMap[file.FullName] = entry.ID;
-                    }
-                    catch (Exception ex)
-                    {
-                        Logger.LogError($"Failed to pull entry from {file.FullName}: {ex.Message}");
-                    }
-                }
-            }
-        }
-
-        private string GetFileName(DatabaseEntry entry)
-        {
-            string name = entry is INamedEntry namedEntry ? namedEntry.EntryName : entry.ID.ToString();
-            // Sanitize to prevent invalid chars/path traversal
-            foreach (char invalid in Path.GetInvalidFileNameChars())
-                name = name.Replace(invalid, '_');
-            return $"{name}.{Extension}";
-        }
-        
-        /// <summary>
-        /// Persists the specified <see cref="DatabaseEntry"/> to a file in the appropriate type subdirectory.
-        /// The file name is generated using <see cref="GetFileName(DatabaseEntry)"/>, which prefers the entry name if available.
-        /// The entry is serialized via <see cref="Serialize(DatabaseEntry)"/> and written to disk.
-        /// Updates the local <see cref="CacheBackingStore.Entries"/> dictionary and the <see cref="_filePathToIdMap"/> for change tracking.
-        /// Logs errors if the write fails but re-throws to allow caller handling.
-        /// </summary>
-        /// <param name="entry">The <see cref="DatabaseEntry"/> to persist to a file.</param>
-        public override void Push(DatabaseEntry entry)
-        {
-            var type = entry.GetType();
-            Entries[entry.ID] = entry;
-            var directory = EntryTypeDirectories[type];
-            var filePath = Path.Combine(directory.FullName, GetFileName(entry));
-            File.WriteAllBytes(filePath, Serialize(entry));
-            _filePathToIdMap[filePath] = entry.ID;
-        }
-
-        /// <summary>
-        /// Removes the specified <see cref="DatabaseEntry"/> from the local <see cref="CacheBackingStore.Entries"/> dictionary
-        /// and deletes its corresponding file in the type subdirectory.
-        /// Updates the <see cref="_filePathToIdMap"/> and notifies upstream via <see cref="CacheBackingStore.EntryDeleted"/>.
-        /// File deletion failures are logged but do not prevent local removal or notification.
-        /// </summary>
-        /// <param name="entry">The <see cref="DatabaseEntry"/> to delete from storage.</param>
-        public override void Delete(DatabaseEntry entry)
-        {
-            if (Entries.ContainsKey(entry.ID))
-            {
-                var type = entry.GetType();
-                Entries.TryRemove(entry.ID, out _);
-                var directory = EntryTypeDirectories[type];
-                var filePath = Path.Combine(directory.FullName, GetFileName(entry));
-                _filePathToIdMap.TryRemove(filePath, out _);
-                var file = new FileInfo(filePath);
-                if (file.Exists)
-                    file.Delete();
-            }
-        }
-
-        /// <summary>
-        /// Persists all entries in <see cref="CacheBackingStore.Entries"/> to their respective files by invoking <see cref="Push(DatabaseEntry)"/> for each.
-        /// The <paramref name="soft"/> parameter is ignored in this implementation, as all pushes are full writes.
-        /// Errors during individual pushes are logged but do not halt the process.
-        /// Suitable for batch synchronization after bulk changes.
-        /// </summary>
-        /// <param name="soft">If <c>true</c>, performs a soft push (not supported; treated as full push).</param>
-        public override void PushAll(bool soft = false)
-        {
-            foreach (var entry in Entries.Values.ToArray()) Push(entry);
-        }
-        
-        /// <summary>
-        /// Starts monitoring the root directory and its subdirectories for file system changes related to entry files.
-        /// Initializes a <see cref="FileSystemWatcher"/> with filters for creation, modification, and deletion events on files matching <see cref="Extension"/>.
-        /// Uses debouncing for change events to handle bursty writes (100ms delay via <see cref="_changedSubject"/> and R3).
-        /// Disposes any existing watcher before creating a new one to prevent duplicates.
-        /// Logs a warning if the root directory does not exist and skips observation.
-        /// Logs info when observation starts successfully.
-        /// Call this method to enable real-time synchronization with external file modifications.
-        /// </summary>
-        public void ObserveChanges()
-        {
-            if (watcher != null) // Guard against re-creation
-                Dispose();
-
-            watcher = new FileSystemWatcher(RootDirectory.FullName, $"*.{Extension}")
-            {
-                NotifyFilter = NotifyFilters.LastWrite | NotifyFilters.FileName | NotifyFilters.DirectoryName,
-                EnableRaisingEvents = true,
-                IncludeSubdirectories = true
-            };
-
-            // Use R3 to throttle events if file writes are bursty
-            _changedSubject = new Subject<string>();  // For paths
-            _changedSubject.Debounce(TimeSpan.FromMilliseconds(100)).Subscribe(HandleFileChange);
-
-            watcher.Changed += (sender, args) =>
-            {
-                _changedSubject.OnNext(args.FullPath);  // Debounced handling
-            };
-            watcher.Created += (sender, args) =>
-            {
-                HandleFileCreation(args.FullPath);
-            };
-            watcher.Deleted += (sender, args) =>
-            {
-                HandleFileRemoval(args.FullPath);
-            };
-        }
-
-        private void HandleFileCreation(string fullPath)
-        {
-            try
-            {
-                var entry = Deserialize(File.ReadAllBytes(fullPath));
-                Entries[entry.ID] = entry;
-                _filePathToIdMap[fullPath] = entry.ID;
-                EntryAdded.OnNext(entry);  // Upstream notify
-            }
-            catch (Exception ex)
-            {
-                Logger.LogError($"Failed to handle creation of {fullPath}: {ex.Message}");
-            }
-        }
-
-        private void HandleFileChange(string fullPath)
-        {
-            try
-            {
-                var entry = Deserialize(File.ReadAllBytes(fullPath));
-                Entries[entry.ID] = entry;
-                _filePathToIdMap[fullPath] = entry.ID;
-                EntryUpdated.OnNext(entry);  // Upstream notify
-            }
-            catch (Exception ex)
-            {
-                Logger.LogError($"Failed to handle change in {fullPath}: {ex.Message}");
-            }
-        }
-
-        private void HandleFileRemoval(string fullPath)
-        {
-            try
-            {
-                // External deletion detected—handle without deserializing
-                if (_filePathToIdMap.TryGetValue(fullPath, out var id))
-                {
-                    _filePathToIdMap.TryRemove(fullPath, out _);  // Clean map immediately
-
-                    // Emit delete if we have the entry locally
-                    if (Entries.TryGetValue(id, out var entry))
-                    {
-                        Entries.TryRemove(id, out _);  // Sync local dict
-                        EntryDeleted.OnNext(entry);
-                    }
-                    else
-                    {
-                        // Fallback: Stub if race/removed already (rare)
-                        var type = GetTypeFromPath(fullPath);  // See helper below
-                        var stub = CreateStubEntry(id, type);
-                        EntryDeleted.OnNext(stub);
-                        Logger.LogWarning($"External deletion of {fullPath} (ID: {id}) with no local entry; emitted stub for cleanup.");
-                    }
-                }
-            }
-            catch (Exception ex)
-            {
-                Logger.LogError($"Failed to handle deletion of {fullPath}: {ex.Message}");
-            }
-        }
-
-        // Helper: Infer type from path (e.g., based on directory name matching EntryTypeDirectories keys)
-        private Type GetTypeFromPath(string filePath)
-        {
-            var currentDir = new DirectoryInfo(Path.GetDirectoryName(filePath) ?? string.Empty);
-            // Walk up the directory tree to find matching EntryTypeDirectories (handles sub-subdirs)
-            while (currentDir is { Exists: true })
-            {
-                var matchingType = EntryTypeDirectories.FirstOrDefault(kvp => kvp.Value.FullName == currentDir.FullName).Key;
-                if (matchingType != null)
-                    return matchingType;
-                currentDir = currentDir.Parent;  // Walk up (e.g., from "PlayerData/backup" to "PlayerData")
-            }
-            return typeof(DatabaseEntry);  // Fallback if no match (e.g., manual file)
-        }
-
-        // Stub creator (minimal; only for rare fallback—extend if Deletion events need more data)
-        private DatabaseEntry CreateStubEntry(Guid id, Type type)
-        {
-            var entry = (DatabaseEntry)Activator.CreateInstance(type);
-            typeof(DatabaseEntry).GetField("ID")?.SetValue(entry, id);  // Set ID via reflection
-            return entry;
-        }
-
-        /// <inheritdoc/>
-        public new void Dispose()
-        {
-            base.Dispose();
-            watcher?.Dispose();
-            _changedSubject?.Dispose();
-        }
-    }
-
-    /// <summary>
-    /// An abstract cache backing store that persists all <see cref="DatabaseEntry"/> objects in a single file.
-    /// Supports serialization of the entire collection and provides hooks for custom binary formats.
-    /// Suitable for smaller datasets or when atomic updates are preferred over individual file management.
-    /// </summary>
-    /// <remarks>
-    /// <para>
-    /// All entries are loaded and saved as a single array in the specified file.
-    /// Changes do not trigger a write, must manually call PushAll to persist.
-    /// </para>
-    /// <para>
-    /// Subclasses must implement <see cref="Serialize(DatabaseEntry[])"/> and <see cref="Deserialize(byte[])"/>
-    /// to define the storage format (e.g., JSON array, MessagePack array).
-    /// </para>
-    /// </remarks>
-    public abstract class SingleFileBackingStore : CacheBackingStore
-    {
-        /// <summary>
-        /// Gets the file where all entries are stored.
-        /// </summary>
-        public FileInfo FileInfo { get; }
-
-        /// <summary>
-        /// Serializes an array of <see cref="DatabaseEntry"/> objects into a byte array for single-file storage.
-        /// </summary>
-        /// <param name="entries">The array of <see cref="DatabaseEntry"/> objects to serialize.</param>
-        /// <returns>A byte array representing the serialized entries.</returns>
-        public abstract byte[] Serialize(DatabaseEntry[] entries);
-        /// <summary>
-        /// Deserializes a byte array into an array of <see cref="DatabaseEntry"/> objects.
-        /// </summary>
-        /// <param name="data">The byte array containing the serialized entries.</param>
-        /// <returns>An array of deserialized <see cref="DatabaseEntry"/> objects.</returns>
-        public abstract DatabaseEntry[] Deserialize(byte[] data);
-
-        /// <summary>
-        /// Initializes a new instance of the <see cref="SingleFileBackingStore"/> class.
-        /// </summary>
-        /// <param name="filePath">The path to the single file for storing all entries.</param>
-        public SingleFileBackingStore(string filePath)
-        {
-            FileInfo = new FileInfo(filePath);
-        }
-        
-        /// <summary>
-        /// Loads all <see cref="DatabaseEntry"/> objects from the single storage file by reading its contents,
-        /// deserializing via <see cref="Deserialize(byte[])"/> into an array, and adding each to the local <see cref="CacheBackingStore.Entries"/> dictionary.
-        /// Notifies upstream via <see cref="CacheBackingStore.EntryAdded"/> for each entry.
-        /// If the file does not exist or deserialization fails, logs an error and returns without adding entries.
-        /// Logs the number of loaded entries for debugging.
-        /// </summary>
-        public override void PullAll()
-        {
-            if (!FileInfo.Exists) return;
-
-            foreach (var entry in Deserialize(File.ReadAllBytes(FileInfo.FullName)))
-            {
-                Entries[entry.ID] = entry;
-                EntryAdded.OnNext(entry);
-            }
-        }
-
-        /// <summary>
-        /// Adds or updates the specified <see cref="DatabaseEntry"/> in the local <see cref="CacheBackingStore.Entries"/> dictionary.
-        /// Does not immediately persist to the single file; call <see cref="PushAll(bool)"/> to save changes.
-        /// </summary>
-        /// <param name="entry">The <see cref="DatabaseEntry"/> to persist.</param>
-        public override void Push(DatabaseEntry entry)
-        {
-            var type = entry.GetType();
-            Entries[entry.ID] = entry;
-        }
-
-        /// <summary>
-        /// Removes the specified <see cref="DatabaseEntry"/> from the local <see cref="CacheBackingStore.Entries"/> dictionary.
-        /// Does not immediately persist to the single file; call <see cref="PushAll(bool)"/> to save changes.
-        /// </summary>
-        /// <param name="entry">The <see cref="DatabaseEntry"/> to delete.</param>
-        public override void Delete(DatabaseEntry entry)
-        {
-            if (Entries.TryGetValue(entry.ID, out _))
-            {
-                Entries.TryRemove(entry.ID, out _);
-            }
-        }
-
-        /// <summary>
-        /// Serializes all entries in <see cref="CacheBackingStore.Entries"/> to a byte array using <see cref="Serialize(DatabaseEntry[])"/>
-        /// and writes it to the single storage file, overwriting any existing content.
-        /// The <paramref name="soft"/> parameter is ignored in this implementation, as saves are always full rewrites.
-        /// Logs the number of saved entries and errors if the write fails, re-throwing for caller handling.
-        /// </summary>
-        /// <param name="soft">If <c>true</c>, performs a soft push (not supported; treated as full push).</param>
-        public override void PushAll(bool soft = false)
-        {
-            var entriesArray = Entries.Values.ToArray();
-            File.WriteAllBytes(FileInfo.FullName, Serialize(entriesArray));
-        }
-    }
-}
-
-// E:\Projects\CultLib\src\GameCult.Caching\DatabaseEntry.cs
-
-using System;
-using MessagePack;
-
-namespace GameCult.Caching
-{
-    public interface INamedEntry
-    {
-        string EntryName { get; set; }
-    }
-
-    /// <summary>
-    /// Base abstract class for all database entries in the cache.
-    /// For optional MessagePack integration, define concrete subclasses with [MessagePackObject] and [Key(n)] on fields.
-    /// The ID field can be serialized via a custom formatter in MessagePack stores.
-    /// </summary>
-    public abstract class DatabaseEntry
-    {
-        /// <summary>
-        /// Unique identifier for the entry. Handled by custom formatters in MessagePack integration.
-        /// </summary>
-        public Guid ID = Guid.NewGuid();
-
-        /// <inheritdoc/>
-        public override int GetHashCode()
-        {
-            return ID.GetHashCode();
-        }
-
-        /// <inheritdoc/>
-        public override bool Equals(object obj)
-        {
-            if (obj is DatabaseEntry entry) return entry.ID == ID;
-            return false;
-        }
-    }
-
-    /// <summary>
-    /// Generic link to a <see cref="DatabaseEntry"/> in the cache.
-    /// Value is computed from the cache; serializes only LinkID.
-    /// </summary>
-    public class DatabaseLink<T> : DatabaseLinkBase where T : DatabaseEntry
-    {
-        /// <summary>
-        /// Computed value from the cache (not serialized; regenerated post-deserialize).
-        /// </summary>
-        public T? Value => Cache.Get<T>(LinkID);
-    }
-
-    /// <summary>
-    /// Base for database links. LinkID is serialized directly; Value is computed in subclasses.
-    /// </summary>
-    public class DatabaseLinkBase
-    {
-        /// <summary>
-        /// ID of the linked entry.
-        /// </summary>
-        public Guid LinkID;
-
-        /// <summary>
-        /// Static reference to the cache (not serialized).
-        /// </summary>
-        public static CultCache? Cache;
-    }
-    
-    // Example of a DatabaseEntry implementation in user code
-    public class PlayerData : DatabaseEntry, INamedEntry
-    {
-        [Key(1)]
-        public string Email;
-
-        [Key(2)]
-        public string PasswordHash;
-
-        [Key(3)]
-        public string Username;
-
-        [IgnoreMember]
-        public string EntryName
-        {
-            get => Username;
-            set => Username = value;
-        }
-    }
-}
-
-// E:\Projects\CultLib\src\GameCult.Caching\ReflectionExtensions.cs
-
-using System;
-using System.Collections.Generic;
-using System.Linq;
-using System.Reflection;
-using System.Text;
-using System.Text.RegularExpressions;
-using System.Threading.Tasks;
-
-namespace GameCult.Caching
-{
-    public static class ReflectionExtensions
-    {
-        private static Dictionary<Type, Type[]> ParentTypes = new Dictionary<Type, Type[]>();
-
-        public static Type[] GetParentTypes(this Type type)
-        {
-            if (ParentTypes.ContainsKey(type))
-                return ParentTypes[type];
-            return ParentTypes[type] = type.GetParents().ToArray();
-        }
-
-        private static IEnumerable<Type> GetParents(this Type type)
-        {
-            // is there any base type?
-            if (type == null)
-            {
-                yield break;
-            }
-
-            // return all inherited types
-            var currentBaseType = type.BaseType;
-            while (currentBaseType != null)
-            {
-                yield return currentBaseType;
-                currentBaseType = currentBaseType.BaseType;
-            }
-        }
-
-        private static Dictionary<Type, Type[]> ChildClasses = new Dictionary<Type, Type[]>();
-        public static Type[] GetAllChildClasses(this Type type)
-        {
-            if (ChildClasses.ContainsKey(type))
-                return ChildClasses[type];
-            return ChildClasses[type] = AppDomain.CurrentDomain.GetAssemblies()
-                .SelectMany(ass => ass.GetTypes()).Where(type.IsAssignableFrom).ToArray();
-        }
-
-    }
-}
diff --git a/src/GameCult.Caching/README.md b/src/GameCult.Caching/README.md
index 7e51227b..e9edb63d 100644
--- a/src/GameCult.Caching/README.md
+++ b/src/GameCult.Caching/README.md
@@ -37,11 +37,9 @@ Available cache attributes:
 - `CultGlobal`
 - `CultReference(targetType?, many: false)`
 
-If you want compile-time document metadata instead of runtime assembly
-spelunking, add the `GameCult.Caching.MessagePack.Generator` analyzer to the
-project that declares your `[CultDocument]` types. It emits a metadata provider
-the cache registry can load directly, while reflection stays behind as fallback
-for projects that have not taken the hint yet.
+`CultDocumentRegistry` builds every document descriptor by reflection over
+these attributes and MessagePack's `[Key]`/`[IgnoreMember]`; it is the only
+descriptor authority.
 
 ## Main Concepts
 
diff --git a/src/GameCult.Geometry/CultGeometryIsoSurface.cs b/src/GameCult.Geometry/CultGeometryIsoSurface.cs
new file mode 100644
index 00000000..6fc9355c
--- /dev/null
+++ b/src/GameCult.Geometry/CultGeometryIsoSurface.cs
@@ -0,0 +1,193 @@
+using System;
+using System.Collections.Generic;
+using CultMath;
+
+namespace GameCult.Geometry
+{
+    /// <summary>
+    /// Extracts engine-neutral triangle meshes from sampled scalar fields.
+    /// </summary>
+    public static class CultGeometryIsoSurface
+    {
+        private static readonly float3[] CubeCorners =
+        {
+            new(0f, 0f, 0f),
+            new(1f, 0f, 0f),
+            new(1f, 1f, 0f),
+            new(0f, 1f, 0f),
+            new(0f, 0f, 1f),
+            new(1f, 0f, 1f),
+            new(1f, 1f, 1f),
+            new(0f, 1f, 1f),
+        };
+
+        // A fixed six-tetrahedra decomposition keeps neighboring cube faces consistent.
+        private static readonly int[,] CubeTetrahedra =
+        {
+            { 0, 5, 1, 6 },
+            { 0, 1, 2, 6 },
+            { 0, 2, 3, 6 },
+            { 0, 3, 7, 6 },
+            { 0, 7, 4, 6 },
+            { 0, 4, 5, 6 },
+        };
+
+        /// <summary>
+        /// Extracts the <paramref name="isoValue"/> surface with marching tetrahedra.
+        /// Values less than or equal to the isovalue are treated as inside.
+        /// </summary>
+        public static CultGeometryTriangleMesh Extract(
+            float[,,] samples,
+            float isoValue = 0f,
+            CultVec3 origin = default,
+            float cellSize = 1f)
+        {
+            if (samples == null) throw new ArgumentNullException(nameof(samples));
+            if (samples.GetLength(0) < 2 || samples.GetLength(1) < 2 || samples.GetLength(2) < 2)
+            {
+                throw new ArgumentException("An isosurface field requires at least two samples on every axis.", nameof(samples));
+            }
+
+            if (!(cellSize > 0f) || float.IsInfinity(cellSize))
+            {
+                throw new ArgumentOutOfRangeException(nameof(cellSize), "Cell size must be finite and positive.");
+            }
+
+            var positions = new List<float>();
+            var normals = new List<float>();
+            var indices = new List<uint>();
+            var originValue = new float3(origin.X, origin.Y, origin.Z);
+            var cornerPositions = new float3[8];
+            var cornerValues = new float[8];
+            var tetraPositions = new float3[4];
+            var tetraValues = new float[4];
+
+            for (var x = 0; x < samples.GetLength(0) - 1; x++)
+            for (var y = 0; y < samples.GetLength(1) - 1; y++)
+            for (var z = 0; z < samples.GetLength(2) - 1; z++)
+            {
+                var cubeOrigin = originValue + new float3(x, y, z) * cellSize;
+                for (var corner = 0; corner < CubeCorners.Length; corner++)
+                {
+                    var offset = CubeCorners[corner];
+                    cornerPositions[corner] = cubeOrigin + offset * cellSize;
+                    cornerValues[corner] = samples[
+                        x + (int)offset.x,
+                        y + (int)offset.y,
+                        z + (int)offset.z];
+                }
+
+                for (var tetrahedron = 0; tetrahedron < CubeTetrahedra.GetLength(0); tetrahedron++)
+                {
+                    for (var vertex = 0; vertex < 4; vertex++)
+                    {
+                        var corner = CubeTetrahedra[tetrahedron, vertex];
+                        tetraPositions[vertex] = cornerPositions[corner];
+                        tetraValues[vertex] = cornerValues[corner];
+                    }
+
+                    PolygonizeTetrahedron(tetraPositions, tetraValues, isoValue, positions, normals, indices);
+                }
+            }
+
+            return new CultGeometryTriangleMesh
+            {
+                Positions = positions.ToArray(),
+                Normals = normals.ToArray(),
+                Indices = indices.ToArray(),
+                Uvs = Array.Empty<float>(),
+                TriangleMaterials = new uint[indices.Count / 3],
+            };
+        }
+
+        private static void PolygonizeTetrahedron(
+            float3[] positions,
+            float[] values,
+            float isoValue,
+            List<float> outputPositions,
+            List<float> outputNormals,
+            List<uint> outputIndices)
+        {
+            Span<int> inside = stackalloc int[4];
+            Span<int> outside = stackalloc int[4];
+            var insideCount = 0;
+            var outsideCount = 0;
+
+            for (var vertex = 0; vertex < 4; vertex++)
+            {
+                if (values[vertex] <= isoValue) inside[insideCount++] = vertex;
+                else outside[outsideCount++] = vertex;
+            }
+
+            if (insideCount == 0 || insideCount == 4) return;
+
+            var outward = Centroid(positions, outside, outsideCount) - Centroid(positions, inside, insideCount);
+            if (insideCount == 1 || outsideCount == 1)
+            {
+                var loneIsInside = insideCount == 1;
+                var lone = loneIsInside ? inside[0] : outside[0];
+                var others = loneIsInside ? outside : inside;
+                var a = Interpolate(positions[lone], values[lone], positions[others[0]], values[others[0]], isoValue);
+                var b = Interpolate(positions[lone], values[lone], positions[others[1]], values[others[1]], isoValue);
+                var c = Interpolate(positions[lone], values[lone], positions[others[2]], values[others[2]], isoValue);
+                EmitOrientedTriangle(a, b, c, outward, outputPositions, outputNormals, outputIndices);
+                return;
+            }
+
+            var p00 = Interpolate(positions[inside[0]], values[inside[0]], positions[outside[0]], values[outside[0]], isoValue);
+            var p01 = Interpolate(positions[inside[0]], values[inside[0]], positions[outside[1]], values[outside[1]], isoValue);
+            var p10 = Interpolate(positions[inside[1]], values[inside[1]], positions[outside[0]], values[outside[0]], isoValue);
+            var p11 = Interpolate(positions[inside[1]], values[inside[1]], positions[outside[1]], values[outside[1]], isoValue);
+            EmitOrientedTriangle(p00, p01, p11, outward, outputPositions, outputNormals, outputIndices);
+            EmitOrientedTriangle(p00, p11, p10, outward, outputPositions, outputNormals, outputIndices);
+        }
+
+        private static float3 Interpolate(float3 first, float firstValue, float3 second, float secondValue, float isoValue)
+        {
+            var delta = secondValue - firstValue;
+            var amount = math.abs(delta) <= 1e-20f ? 0.5f : (isoValue - firstValue) / delta;
+            return math.lerp(first, second, amount);
+        }
+
+        private static float3 Centroid(float3[] positions, Span<int> vertices, int count)
+        {
+            var sum = float3.zero;
+            for (var index = 0; index < count; index++) sum += positions[vertices[index]];
+            return sum / count;
+        }
+
+        private static void EmitOrientedTriangle(
+            float3 a,
+            float3 b,
+            float3 c,
+            float3 outward,
+            List<float> positions,
+            List<float> normals,
+            List<uint> indices)
+        {
+            var normal = math.cross(b - a, c - a);
+            if (math.dot(normal, outward) < 0f)
+            {
+                (b, c) = (c, b);
+                normal = -normal;
+            }
+
+            normal = math.normalize(normal);
+            var firstIndex = (uint)(positions.Count / 3);
+            Append(a, positions);
+            Append(b, positions);
+            Append(c, positions);
+            for (var vertex = 0; vertex < 3; vertex++) Append(normal, normals);
+            indices.Add(firstIndex);
+            indices.Add(firstIndex + 1);
+            indices.Add(firstIndex + 2);
+        }
+
+        private static void Append(float3 value, List<float> destination)
+        {
+            destination.Add(value.x);
+            destination.Add(value.y);
+            destination.Add(value.z);
+        }
+    }
+}
diff --git a/src/GameCult.Geometry/CultGeometryPrimitives.cs b/src/GameCult.Geometry/CultGeometryPrimitives.cs
new file mode 100644
index 00000000..99587b8e
--- /dev/null
+++ b/src/GameCult.Geometry/CultGeometryPrimitives.cs
@@ -0,0 +1,308 @@
+using System;
+using System.Text.Json.Serialization;
+using MessagePack;
+
+namespace GameCult.Geometry
+{
+    /// <summary>
+    /// Deterministic two-dimensional float vector for cross-runtime geometry and query contracts.
+    /// </summary>
+    [MessagePackObject]
+    public readonly struct CultVec2 : IEquatable<CultVec2>
+    {
+        /// <summary>Creates a two-dimensional vector.</summary>
+        public CultVec2(float x, float y)
+        {
+            X = x;
+            Y = y;
+        }
+
+        /// <summary>Gets the x component.</summary>
+        [Key(0)]
+        public float X { get; }
+
+        /// <summary>Gets the y component.</summary>
+        [Key(1)]
+        public float Y { get; }
+
+        /// <summary>Gets the zero vector.</summary>
+        [IgnoreMember]
+        [JsonIgnore]
+        public static CultVec2 Zero => new(0f, 0f);
+
+        /// <summary>Gets the squared vector length.</summary>
+        [IgnoreMember]
+        [JsonIgnore]
+        public float LengthSquared => (X * X) + (Y * Y);
+
+        /// <summary>Returns whether this vector is equal to another vector.</summary>
+        public bool Equals(CultVec2 other) => X.Equals(other.X) && Y.Equals(other.Y);
+
+        /// <inheritdoc />
+        public override bool Equals(object? obj) => obj is CultVec2 other && Equals(other);
+
+        /// <inheritdoc />
+        public override int GetHashCode() => HashCode.Combine(X, Y);
+
+        /// <inheritdoc />
+        public override string ToString() => $"({X}, {Y})";
+
+        public static CultVec2 operator +(CultVec2 left, CultVec2 right) => new(left.X + right.X, left.Y + right.Y);
+        public static CultVec2 operator -(CultVec2 left, CultVec2 right) => new(left.X - right.X, left.Y - right.Y);
+        public static CultVec2 operator *(CultVec2 value, float scalar) => new(value.X * scalar, value.Y * scalar);
+        public static CultVec2 operator /(CultVec2 value, float scalar) => new(value.X / scalar, value.Y / scalar);
+        public static bool operator ==(CultVec2 left, CultVec2 right) => left.Equals(right);
+        public static bool operator !=(CultVec2 left, CultVec2 right) => !left.Equals(right);
+    }
+
+    /// <summary>
+    /// Deterministic three-dimensional float vector for cross-runtime geometry and query contracts.
+    /// </summary>
+    [MessagePackObject]
+    public readonly struct CultVec3 : IEquatable<CultVec3>
+    {
+        /// <summary>Creates a three-dimensional vector.</summary>
+        public CultVec3(float x, float y, float z)
+        {
+            X = x;
+            Y = y;
+            Z = z;
+        }
+
+        /// <summary>Gets the x component.</summary>
+        [Key(0)]
+        public float X { get; }
+
+        /// <summary>Gets the y component.</summary>
+        [Key(1)]
+        public float Y { get; }
+
+        /// <summary>Gets the z component.</summary>
+        [Key(2)]
+        public float Z { get; }
+
+        /// <summary>Gets the zero vector.</summary>
+        [IgnoreMember]
+        [JsonIgnore]
+        public static CultVec3 Zero => new(0f, 0f, 0f);
+
+        /// <summary>Gets the XY plane projection.</summary>
+        [IgnoreMember]
+        [JsonIgnore]
+        public CultVec2 Xy => new(X, Y);
+
+        /// <summary>Gets the XZ plane projection for Unity compatibility adapters.</summary>
+        [IgnoreMember]
+        [JsonIgnore]
+        public CultVec2 Xz => new(X, Z);
+
+        /// <summary>Gets the squared vector length.</summary>
+        [IgnoreMember]
+        [JsonIgnore]
+        public float LengthSquared => (X * X) + (Y * Y) + (Z * Z);
+
+        /// <summary>Returns whether this vector is equal to another vector.</summary>
+        public bool Equals(CultVec3 other) => X.Equals(other.X) && Y.Equals(other.Y) && Z.Equals(other.Z);
+
+        /// <inheritdoc />
+        public override bool Equals(object? obj) => obj is CultVec3 other && Equals(other);
+
+        /// <inheritdoc />
+        public override int GetHashCode() => HashCode.Combine(X, Y, Z);
+
+        /// <inheritdoc />
+        public override string ToString() => $"({X}, {Y}, {Z})";
+
+        public static CultVec3 operator +(CultVec3 left, CultVec3 right) => new(left.X + right.X, left.Y + right.Y, left.Z + right.Z);
+        public static CultVec3 operator -(CultVec3 left, CultVec3 right) => new(left.X - right.X, left.Y - right.Y, left.Z - right.Z);
+        public static CultVec3 operator *(CultVec3 value, float scalar) => new(value.X * scalar, value.Y * scalar, value.Z * scalar);
+        public static CultVec3 operator /(CultVec3 value, float scalar) => new(value.X / scalar, value.Y / scalar, value.Z / scalar);
+        public static bool operator ==(CultVec3 left, CultVec3 right) => left.Equals(right);
+        public static bool operator !=(CultVec3 left, CultVec3 right) => !left.Equals(right);
+    }
+
+    /// <summary>
+    /// Axis-aligned two-dimensional rectangle represented by canonical min and max corners.
+    /// </summary>
+    [MessagePackObject]
+    public readonly struct CultRect : IEquatable<CultRect>
+    {
+        /// <summary>Creates a rectangle and canonicalizes min/max corners.</summary>
+        public CultRect(CultVec2 min, CultVec2 max)
+        {
+            Min = new CultVec2(Math.Min(min.X, max.X), Math.Min(min.Y, max.Y));
+            Max = new CultVec2(Math.Max(min.X, max.X), Math.Max(min.Y, max.Y));
+        }
+
+        /// <summary>Creates a rectangle and canonicalizes min/max corners.</summary>
+        public CultRect(float minX, float minY, float maxX, float maxY)
+            : this(new CultVec2(minX, minY), new CultVec2(maxX, maxY))
+        {
+        }
+
+        /// <summary>Gets the canonical minimum corner.</summary>
+        [Key(0)]
+        public CultVec2 Min { get; }
+
+        /// <summary>Gets the canonical maximum corner.</summary>
+        [Key(1)]
+        public CultVec2 Max { get; }
+
+        /// <summary>Gets the rectangle size.</summary>
+        [IgnoreMember]
+        [JsonIgnore]
+        public CultVec2 Size => Max - Min;
+
+        /// <summary>Gets the rectangle center.</summary>
+        [IgnoreMember]
+        [JsonIgnore]
+        public CultVec2 Center => (Min + Max) * 0.5f;
+
+        /// <summary>Returns whether the point lies inside or on the rectangle edge.</summary>
+        public bool Contains(CultVec2 point)
+        {
+            return point.X >= Min.X &&
+                   point.X <= Max.X &&
+                   point.Y >= Min.Y &&
+                   point.Y <= Max.Y;
+        }
+
+        /// <summary>Returns whether this rectangle intersects another rectangle.</summary>
+        public bool Intersects(CultRect other)
+        {
+            return Min.X <= other.Max.X &&
+                   Max.X >= other.Min.X &&
+                   Min.Y <= other.Max.Y &&
+                   Max.Y >= other.Min.Y;
+        }
+
+        /// <summary>Returns whether this rectangle is equal to another rectangle.</summary>
+        public bool Equals(CultRect other) => Min == other.Min && Max == other.Max;
+
+        /// <inheritdoc />
+        public override bool Equals(object? obj) => obj is CultRect other && Equals(other);
+
+        /// <inheritdoc />
+        public override int GetHashCode() => HashCode.Combine(Min, Max);
+
+        /// <inheritdoc />
+        public override string ToString() => $"[{Min}..{Max}]";
+
+        public static bool operator ==(CultRect left, CultRect right) => left.Equals(right);
+        public static bool operator !=(CultRect left, CultRect right) => !left.Equals(right);
+    }
+
+    /// <summary>
+    /// Two-dimensional circle for spatial queries.
+    /// </summary>
+    [MessagePackObject]
+    public readonly struct CultCircle : IEquatable<CultCircle>
+    {
+        /// <summary>Creates a circle.</summary>
+        public CultCircle(CultVec2 center, float radius)
+        {
+            if (radius < 0f)
+            {
+                throw new ArgumentOutOfRangeException(nameof(radius), "Radius cannot be negative.");
+            }
+
+            Center = center;
+            Radius = radius;
+        }
+
+        /// <summary>Gets the circle center.</summary>
+        [Key(0)]
+        public CultVec2 Center { get; }
+
+        /// <summary>Gets the circle radius.</summary>
+        [Key(1)]
+        public float Radius { get; }
+
+        /// <summary>Gets the circle bounds.</summary>
+        [IgnoreMember]
+        [JsonIgnore]
+        public CultRect Bounds => new(
+            Center.X - Radius,
+            Center.Y - Radius,
+            Center.X + Radius,
+            Center.Y + Radius);
+
+        /// <summary>Returns whether the point lies inside or on the circle edge.</summary>
+        public bool Contains(CultVec2 point)
+        {
+            var delta = point - Center;
+            return delta.LengthSquared <= Radius * Radius;
+        }
+
+        /// <summary>Returns whether this circle intersects a rectangle.</summary>
+        public bool Intersects(CultRect rect)
+        {
+            var clampedX = Math.Max(rect.Min.X, Math.Min(Center.X, rect.Max.X));
+            var clampedY = Math.Max(rect.Min.Y, Math.Min(Center.Y, rect.Max.Y));
+            return Contains(new CultVec2(clampedX, clampedY));
+        }
+
+        /// <summary>Returns whether this circle is equal to another circle.</summary>
+        public bool Equals(CultCircle other) => Center == other.Center && Radius.Equals(other.Radius);
+
+        /// <inheritdoc />
+        public override bool Equals(object? obj) => obj is CultCircle other && Equals(other);
+
+        /// <inheritdoc />
+        public override int GetHashCode() => HashCode.Combine(Center, Radius);
+
+        public static bool operator ==(CultCircle left, CultCircle right) => left.Equals(right);
+        public static bool operator !=(CultCircle left, CultCircle right) => !left.Equals(right);
+    }
+
+    /// <summary>
+    /// Three-dimensional sphere for physics and spatial queries.
+    /// </summary>
+    [MessagePackObject]
+    public readonly struct CultSphere : IEquatable<CultSphere>
+    {
+        /// <summary>Creates a sphere.</summary>
+        public CultSphere(CultVec3 center, float radius)
+        {
+            if (radius < 0f)
+            {
+                throw new ArgumentOutOfRangeException(nameof(radius), "Radius cannot be negative.");
+            }
+
+            Center = center;
+            Radius = radius;
+        }
+
+        /// <summary>Gets the sphere center.</summary>
+        [Key(0)]
+        public CultVec3 Center { get; }
+
+        /// <summary>Gets the sphere radius.</summary>
+        [Key(1)]
+        public float Radius { get; }
+
+        /// <summary>Gets the XY circle projection.</summary>
+        [IgnoreMember]
+        [JsonIgnore]
+        public CultCircle XyCircle => new(Center.Xy, Radius);
+
+        /// <summary>Returns whether the point lies inside or on the sphere surface.</summary>
+        public bool Contains(CultVec3 point)
+        {
+            var delta = point - Center;
+            return delta.LengthSquared <= Radius * Radius;
+        }
+
+        /// <summary>Returns whether this sphere is equal to another sphere.</summary>
+        public bool Equals(CultSphere other) => Center == other.Center && Radius.Equals(other.Radius);
+
+        /// <inheritdoc />
+        public override bool Equals(object? obj) => obj is CultSphere other && Equals(other);
+
+        /// <inheritdoc />
+        public override int GetHashCode() => HashCode.Combine(Center, Radius);
+
+        public static bool operator ==(CultSphere left, CultSphere right) => left.Equals(right);
+        public static bool operator !=(CultSphere left, CultSphere right) => !left.Equals(right);
+    }
+}
diff --git a/src/GameCult.Geometry/GameCult.Geometry.csproj b/src/GameCult.Geometry/GameCult.Geometry.csproj
index 23999af8..a3ad9457 100644
--- a/src/GameCult.Geometry/GameCult.Geometry.csproj
+++ b/src/GameCult.Geometry/GameCult.Geometry.csproj
@@ -1,6 +1,6 @@
 <Project Sdk="Microsoft.NET.Sdk">
   <PropertyGroup>
-    <Description>Typed CultCache geometry domain and chunk artifact documents for VibeGeometry and Fensalir</Description>
+    <Description>CultGeometry algorithms and typed CultCache geometry artifacts</Description>
     <PackageId>GameCult.Geometry</PackageId>
     <PackageTags>game;geometry;csg;lod;cultcache;cultmesh;vibegeometry;fensalir</PackageTags>
     <PackageReadmeFile>README.md</PackageReadmeFile>
@@ -8,11 +8,14 @@
   </PropertyGroup>
 
   <ItemGroup>
+    <ProjectReference Include="..\..\packages\cultmath\src\CultMath\CultMath.csproj" />
     <ProjectReference Include="..\GameCult.Caching\GameCult.Caching.csproj" />
     <PackageReference Include="MessagePack" Version="3.1.7" />
+    <PackageReference Include="System.Text.Json" Version="9.0.10" />
   </ItemGroup>
 
   <ItemGroup>
     <None Include="README.md" Pack="true" PackagePath="\" />
+    <None Include="ISOSURFACE-PROVENANCE.md" Pack="true" PackagePath="\" />
   </ItemGroup>
 </Project>
diff --git a/src/GameCult.Geometry/ISOSURFACE-PROVENANCE.md b/src/GameCult.Geometry/ISOSURFACE-PROVENANCE.md
new file mode 100644
index 00000000..a15a4933
--- /dev/null
+++ b/src/GameCult.Geometry/ISOSURFACE-PROVENANCE.md
@@ -0,0 +1,32 @@
+# Isosurface extraction provenance
+
+`CultGeometryIsoSurface` is a clean implementation of marching tetrahedra over
+a regular scalar grid. The implementation follows the tetrahedral case shape
+described by Peter Shirley and Allan Tuchman, “A Polygonal Approximation to
+Direct Scalar Volume Rendering,” Computer Graphics 24(5), 1990,
+doi:10.1145/99308.99322.
+
+The DELVE/HOLD port was behaviorally motivated by these unversioned local Unity
+sources:
+
+- `D:\WIP4\Projects\VoxelTerrain\Assets\Scripts\Procedural\GenerateTerrain.cs`
+- `D:\WIP4\Projects\VoxelTerrain\Assets\Plugins\MarchingCubes.cs`
+
+The source directory is not a Git checkout and the plugin carries no license or
+author notice. Its code and lookup tables were therefore not copied. The
+CultGeometry implementation uses a fresh six-tetrahedra decomposition, explicit
+inside/outside classification, interpolation, winding, and flat-normal output.
+
+Deliberate behavior retained:
+
+- scalar samples less than or equal to the isovalue are inside;
+- intersections are linearly interpolated along cell edges;
+- vertices are emitted per triangle rather than welded;
+- output is engine-neutral positions, normals, indices, and material slots.
+
+Deliberate changes:
+
+- no Unity mesh, physics, coroutine, navigation, or random dependency;
+- no mutable global target, mode, or winding state;
+- outward winding is derived from inside-to-outside direction;
+- invalid fields and cell sizes fail at the public boundary.
diff --git a/src/GameCult.Geometry/README.md b/src/GameCult.Geometry/README.md
index 57112b08..2d12dc25 100644
--- a/src/GameCult.Geometry/README.md
+++ b/src/GameCult.Geometry/README.md
@@ -1,7 +1,21 @@
 # GameCult.Geometry
 
-`GameCult.Geometry` defines CultCache-native documents for procedural geometry
-domains, LOD build requests, selected-cut manifests, and mesh chunk artifacts.
+The project is known as **CultGeometry**. `GameCult.Geometry` is its clean .NET
+package and namespace identity.
+
+`GameCult.Geometry` owns reusable procedural geometry algorithms together with
+the CultCache-native documents that carry their domains, build requests,
+selected cuts, and mesh chunk artifacts.
+
+It is the schema authority for the shared `CultGeometry*` records.
+`GameCult.Geometry.Csg` owns CSG production behavior and proves wire parity
+against those records; it does not independently evolve their identities.
+
+Its first engine-neutral algorithm is `CultGeometryIsoSurface.Extract`, a
+marching-tetrahedra extractor over regular scalar grids. It uses CultMath for
+numeric primitives and emits `CultGeometryTriangleMesh`; Godot, Unity, native
+workers, and other consumers adapt that neutral result into their own runtime
+objects. See `ISOSURFACE-PROVENANCE.md` for the clean-port boundary.
 
 The package is deliberately substrate-shaped:
 
@@ -14,12 +28,28 @@ The package is deliberately substrate-shaped:
   the xeno boundary, but the live machine eats and emits typed CultCache
   documents.
 
+## Value Primitives
+
+The small value layer is for cross-runtime query contracts, physics probes,
+native slices, and UI surfaces:
+
+- `CultVec2` and `CultVec3`: whole-vector values for positions, velocities,
+  accelerations, and query inputs. SoA layouts may store them efficiently, but
+  the semantic API does not force callers to split x/y/z into unrelated fields.
+- `CultRect`: canonical XY viewport/query rectangle stored as min/max corners.
+- `CultCircle`: 2D influence/query brush with rect intersection helpers.
+- `CultSphere`: 3D query primitive with whole-vector center and XY projection.
+
+Aetheria object viewports, gravity influence brushes, Ymir overlap/cast query
+fixtures, and Unity native render views should use these shapes or generated
+runtime equivalents instead of bespoke `{ minX, minY, maxX, maxY }` payloads.
+
 ## Runtime Path
 
-`vg-csg` emits domain documents, selected-cut manifests, and chunk artifacts as
-MessagePack CultCache documents. A Unity runtime, local worker, or remote
-geometry process should receive the same records through CultMesh/CultNet and
-read them back as `CultGeometry*` types.
+CultGeometry CSG (`GameCult.Geometry.Csg`) emits domain documents, selected-cut
+manifests, and chunk artifacts as MessagePack CultCache documents. A Godot
+runtime, local worker, or remote geometry process receives the same records
+through CultMesh/CultNet and reads them back as `CultGeometry*` types.
 
 ```csharp
 using GameCult.Caching;
@@ -37,7 +67,7 @@ using var node = await CultMesh.CreateNodeAsync("ragnarok-geometry.ccmp", new Cu
 {
     DatabaseOptions = new CultNetDatabaseOptions
     {
-        RuntimeId = "unity-runtime",
+        RuntimeId = "godot-runtime",
         DocumentRegistry = geometryDocuments
     }
 });
@@ -55,6 +85,8 @@ cache miss; that is split-brain geometry.
 
 ## Documents
 
+- `CultVec2`, `CultVec3`, `CultRect`, `CultCircle`, `CultSphere`: shared value
+  primitives for query and view contracts.
 - `CultGeometryDomainDocument`: one hierarchical domain tree, suitable for
   Ragnarok/Fensalir-style feature DSL output.
 - `CultGeometryBuildRequest`: one LOD/frustum/budget request for workers.
diff --git a/src/GameCult.Mesh.Quic.Native/CultMeshNativeQuicRealtimeTransport.cs b/src/GameCult.Mesh.Quic.Native/CultMeshNativeQuicRealtimeTransport.cs
new file mode 100644
index 00000000..cb356044
--- /dev/null
+++ b/src/GameCult.Mesh.Quic.Native/CultMeshNativeQuicRealtimeTransport.cs
@@ -0,0 +1,278 @@
+using System;
+using System.IO;
+using System.Runtime.InteropServices;
+using System.Text;
+using System.Threading;
+using System.Threading.Tasks;
+using GameCult.Mesh;
+
+namespace GameCult.Mesh.Quic.Native
+{
+    public sealed class CultMeshNativeQuicRealtimeConnectorOptions
+    {
+        public TimeSpan HandshakeTimeout { get; set; } = TimeSpan.FromSeconds(10);
+        public TimeSpan PollInterval { get; set; } = TimeSpan.FromMilliseconds(2);
+    }
+
+    /// <summary>
+    /// Creates receive-capable MsQuic sessions on Unity-compatible managed runtimes.
+    /// Commands and receipts remain on their typed control plane.
+    /// </summary>
+    public sealed class CultMeshNativeQuicRealtimeTransportConnector : ICultMeshRealtimeTransportConnector
+    {
+        public const string Scheme = "cultmesh-state+quic";
+        private readonly CultMeshNativeQuicRealtimeConnectorOptions _options;
+
+        public CultMeshNativeQuicRealtimeTransportConnector(
+            CultMeshNativeQuicRealtimeConnectorOptions? options = null)
+        {
+            _options = options ?? new CultMeshNativeQuicRealtimeConnectorOptions();
+            if (_options.HandshakeTimeout <= TimeSpan.Zero)
+                throw new ArgumentOutOfRangeException(nameof(options), "QUIC handshake timeout must be positive.");
+            if (_options.PollInterval <= TimeSpan.Zero)
+                throw new ArgumentOutOfRangeException(nameof(options), "QUIC poll interval must be positive.");
+        }
+
+        public string ConnectorId => "msquic-native-realtime";
+        public int Priority => 0;
+
+        public bool CanConnect(CultMeshTransportCandidate candidate) =>
+            candidate != null && RuntimeInformation.IsOSPlatform(OSPlatform.Windows) &&
+            TryParseEndpoint(candidate.Endpoint, out _, out _, out _);
+
+        public async Task<ICultMeshRealtimeTransport> ConnectAsync(
+            CultMeshTransportCandidate candidate,
+            CultMeshSessionTarget target,
+            CancellationToken cancellationToken = default)
+        {
+            if (candidate == null) throw new ArgumentNullException(nameof(candidate));
+            if (target == null) throw new ArgumentNullException(nameof(target));
+            if (!TryParseEndpoint(candidate.Endpoint, out var host, out var port, out var pin))
+                throw new NotSupportedException($"Native QUIC connector does not support '{candidate.Endpoint}'.");
+
+            IntPtr handle;
+            int opened;
+            try
+            {
+                opened = NativeMethods.Open(host, checked((ushort)port), pin, out handle);
+            }
+            catch (DllNotFoundException error)
+            {
+                throw new PlatformNotSupportedException(
+                    "CultMesh native QUIC requires gamecult_mesh_quic_native and msquic beside the managed runtime.",
+                    error);
+            }
+            catch (EntryPointNotFoundException error)
+            {
+                throw new PlatformNotSupportedException("The installed CultMesh native QUIC bridge is incompatible.", error);
+            }
+            if (opened != 0 || handle == IntPtr.Zero)
+                throw new IOException($"CultMesh native QUIC initialization failed with status 0x{opened:X8}.");
+
+            var transport = new CultMeshNativeQuicRealtimeTransport(
+                candidate.Endpoint,
+                handle,
+                _options.PollInterval,
+                target,
+                candidate.Generation);
+            try
+            {
+                await transport.WaitUntilConnectedAsync(_options.HandshakeTimeout, cancellationToken).ConfigureAwait(false);
+                return transport;
+            }
+            catch
+            {
+                transport.Dispose();
+                throw;
+            }
+        }
+
+        private static bool TryParseEndpoint(
+            string? endpoint,
+            out string host,
+            out int port,
+            out string certificatePin)
+        {
+            host = string.Empty;
+            port = 0;
+            certificatePin = string.Empty;
+            if (!Uri.TryCreate(endpoint, UriKind.Absolute, out var uri) ||
+                !string.Equals(uri.Scheme, Scheme, StringComparison.OrdinalIgnoreCase) ||
+                string.IsNullOrWhiteSpace(uri.Host) || uri.Port <= 0)
+                return false;
+            var pin = ParseQueryValue(uri.Query, "cert-sha256");
+            if (pin == null || pin.Length != 64) return false;
+            for (var index = 0; index < pin.Length; index++)
+                if (!Uri.IsHexDigit(pin[index])) return false;
+            host = uri.Host;
+            port = uri.Port;
+            certificatePin = pin.ToUpperInvariant();
+            return true;
+        }
+
+        private static string? ParseQueryValue(string query, string key)
+        {
+            foreach (var component in query.TrimStart('?').Split(new[] { '&' }, StringSplitOptions.RemoveEmptyEntries))
+            {
+                var separator = component.IndexOf('=');
+                var candidateKey = separator < 0 ? component : component.Substring(0, separator);
+                if (!string.Equals(Uri.UnescapeDataString(candidateKey), key, StringComparison.OrdinalIgnoreCase))
+                    continue;
+                return separator < 0 ? string.Empty : Uri.UnescapeDataString(component.Substring(separator + 1));
+            }
+            return null;
+        }
+    }
+
+    internal sealed class CultMeshNativeQuicRealtimeTransport : ICultMeshRealtimeTransport, ICultMeshVerifiedTransport
+    {
+        private readonly object _gate = new object();
+        private readonly TimeSpan _pollInterval;
+        private IntPtr _handle;
+        private readonly CultMeshSessionTarget _target;
+        private readonly string _routeGeneration;
+        private bool _disposed;
+
+        public CultMeshNativeQuicRealtimeTransport(
+            string endpoint,
+            IntPtr handle,
+            TimeSpan pollInterval,
+            CultMeshSessionTarget target,
+            string routeGeneration)
+        {
+            Endpoint = endpoint;
+            _handle = handle;
+            _pollInterval = pollInterval;
+            _target = target;
+            _routeGeneration = routeGeneration ?? string.Empty;
+        }
+
+        public string TransportId => "msquic-native-realtime";
+        public string Endpoint { get; }
+
+        public bool IsVerifiedFor(
+            string verseId,
+            string authorityRuntimeId,
+            string protocolId,
+            string routeGeneration) =>
+            string.Equals(_target.VerseId, verseId, StringComparison.Ordinal) &&
+            string.Equals(_target.AuthorityRuntimeId, authorityRuntimeId, StringComparison.Ordinal) &&
+            string.Equals(CultMeshProtocols.RealtimeState.Value, protocolId, StringComparison.Ordinal) &&
+            string.Equals(_routeGeneration, routeGeneration, StringComparison.Ordinal);
+
+        public Task SendAsync(CultMeshRealtimeFrame frame, CancellationToken cancellationToken = default) =>
+            Task.FromException(new NotSupportedException(
+                "The Unity-compatible native QUIC connector currently owns provider-to-client state only."));
+
+        public async Task<CultMeshRealtimeFrame> ReceiveAsync(CancellationToken cancellationToken = default)
+        {
+            while (true)
+            {
+                cancellationToken.ThrowIfCancellationRequested();
+                byte[]? bytes = null;
+                lock (_gate)
+                {
+                    ThrowIfDisposed();
+                    var state = NativeMethods.State(_handle);
+                    if (state == 2) throw new IOException(ReadNativeError(_handle));
+                    var first = NativeMethods.Poll(_handle, IntPtr.Zero, 0, out var required);
+                    if (first < 0) throw new IOException(ReadNativeError(_handle));
+                    if (first == 2 && required > 0)
+                    {
+                        bytes = new byte[required];
+                        var pinned = GCHandle.Alloc(bytes, GCHandleType.Pinned);
+                        try
+                        {
+                            var second = NativeMethods.Poll(
+                                _handle,
+                                pinned.AddrOfPinnedObject(),
+                                bytes.Length,
+                                out var received);
+                            if (second != 1 || received != bytes.Length)
+                                throw new IOException("CultMesh native QUIC frame changed while it was acquired.");
+                        }
+                        finally
+                        {
+                            pinned.Free();
+                        }
+                    }
+                }
+                if (bytes != null) return CultMeshRealtimeWireProtocol.DecodeFrame(bytes);
+                await Task.Delay(_pollInterval, cancellationToken).ConfigureAwait(false);
+            }
+        }
+
+        internal async Task WaitUntilConnectedAsync(TimeSpan timeout, CancellationToken cancellationToken)
+        {
+            var deadline = DateTimeOffset.UtcNow + timeout;
+            while (true)
+            {
+                cancellationToken.ThrowIfCancellationRequested();
+                lock (_gate)
+                {
+                    ThrowIfDisposed();
+                    var state = NativeMethods.State(_handle);
+                    if (state == 1) return;
+                    if (state == 2) throw new IOException(ReadNativeError(_handle));
+                }
+                if (DateTimeOffset.UtcNow >= deadline)
+                    throw new TimeoutException($"CultMesh native QUIC handshake with '{Endpoint}' timed out.");
+                await Task.Delay(_pollInterval, cancellationToken).ConfigureAwait(false);
+            }
+        }
+
+        public void Dispose()
+        {
+            lock (_gate)
+            {
+                if (_disposed) return;
+                _disposed = true;
+                if (_handle != IntPtr.Zero) NativeMethods.Close(_handle);
+                _handle = IntPtr.Zero;
+            }
+        }
+
+        private void ThrowIfDisposed()
+        {
+            if (_disposed || _handle == IntPtr.Zero)
+                throw new ObjectDisposedException(nameof(CultMeshNativeQuicRealtimeTransport));
+        }
+
+        private static string ReadNativeError(IntPtr handle)
+        {
+            var bytes = new byte[1024];
+            var pinned = GCHandle.Alloc(bytes, GCHandleType.Pinned);
+            try
+            {
+                var count = NativeMethods.Error(handle, pinned.AddrOfPinnedObject(), bytes.Length);
+                return count > 0
+                    ? Encoding.UTF8.GetString(bytes, 0, count)
+                    : "CultMesh native QUIC transport failed.";
+            }
+            finally
+            {
+                pinned.Free();
+            }
+        }
+    }
+
+    internal static class NativeMethods
+    {
+        private const string Library = "gamecult_mesh_quic_native";
+
+        [DllImport(Library, EntryPoint = "cultmesh_quic_open", CallingConvention = CallingConvention.Cdecl, CharSet = CharSet.Ansi)]
+        internal static extern int Open(string host, ushort port, string certificateSha256, out IntPtr client);
+
+        [DllImport(Library, EntryPoint = "cultmesh_quic_state", CallingConvention = CallingConvention.Cdecl)]
+        internal static extern int State(IntPtr client);
+
+        [DllImport(Library, EntryPoint = "cultmesh_quic_poll", CallingConvention = CallingConvention.Cdecl)]
+        internal static extern int Poll(IntPtr client, IntPtr destination, int destinationLength, out int requiredLength);
+
+        [DllImport(Library, EntryPoint = "cultmesh_quic_error", CallingConvention = CallingConvention.Cdecl)]
+        internal static extern int Error(IntPtr client, IntPtr destination, int destinationLength);
+
+        [DllImport(Library, EntryPoint = "cultmesh_quic_close", CallingConvention = CallingConvention.Cdecl)]
+        internal static extern void Close(IntPtr client);
+    }
+}
diff --git a/src/GameCult.Mesh.Quic.Native/GameCult.Mesh.Quic.Native.csproj b/src/GameCult.Mesh.Quic.Native/GameCult.Mesh.Quic.Native.csproj
new file mode 100644
index 00000000..5a9f2bc0
--- /dev/null
+++ b/src/GameCult.Mesh.Quic.Native/GameCult.Mesh.Quic.Native.csproj
@@ -0,0 +1,13 @@
+<Project Sdk="Microsoft.NET.Sdk">
+  <PropertyGroup>
+    <TargetFramework>netstandard2.1</TargetFramework>
+    <Nullable>enable</Nullable>
+    <ImplicitUsings>disable</ImplicitUsings>
+    <AssemblyName>GameCult.Mesh.Quic.Native</AssemblyName>
+    <RootNamespace>GameCult.Mesh.Quic.Native</RootNamespace>
+    <Description>Native MsQuic CultMesh realtime connector for Unity and other netstandard runtimes.</Description>
+  </PropertyGroup>
+  <ItemGroup>
+    <ProjectReference Include="..\GameCult.Mesh\GameCult.Mesh.csproj" />
+  </ItemGroup>
+</Project>
diff --git a/src/GameCult.Mesh.Quic/CultMeshQuicRealtimeTransport.cs b/src/GameCult.Mesh.Quic/CultMeshQuicRealtimeTransport.cs
new file mode 100644
index 00000000..91af6d7c
--- /dev/null
+++ b/src/GameCult.Mesh.Quic/CultMeshQuicRealtimeTransport.cs
@@ -0,0 +1,674 @@
+using System.Buffers.Binary;
+using System.Collections.Concurrent;
+using System.Net;
+using System.Net.Quic;
+using System.Net.Security;
+using System.Security.Authentication;
+using System.Security.Cryptography;
+using System.Security.Cryptography.X509Certificates;
+using System.Threading.Channels;
+
+namespace GameCult.Mesh.Quic;
+
+/// <summary>Configures identity-bound CultMesh QUIC client connections.</summary>
+public sealed class CultMeshQuicRealtimeConnectorOptions
+{
+    /// <summary>Application protocol negotiated during the TLS handshake.</summary>
+    public SslApplicationProtocol ApplicationProtocol { get; set; } = CultMeshQuicRealtimeProtocol.ApplicationProtocol;
+
+    /// <summary>Maximum time permitted for connection establishment.</summary>
+    public TimeSpan HandshakeTimeout { get; set; } = TimeSpan.FromSeconds(10);
+
+    /// <summary>
+    /// Optional provider-aware certificate validator. Standard TLS validation is used when omitted.
+    /// </summary>
+    public Func<CultMeshRuntimeId, X509Certificate2?, X509Chain?, SslPolicyErrors, bool>?
+        ValidateProviderCertificate { get; set; }
+}
+
+/// <summary>Creates MsQuic-backed realtime state connections for .NET runtimes.</summary>
+public sealed class CultMeshQuicRealtimeTransportConnector : ICultMeshRealtimeTransportConnector
+{
+    /// <summary>Discovery scheme owned by this connector.</summary>
+    public const string Scheme = "cultmesh-state+quic";
+
+    private readonly CultMeshQuicRealtimeConnectorOptions _options;
+
+    /// <summary>Creates a QUIC connector.</summary>
+    public CultMeshQuicRealtimeTransportConnector(CultMeshQuicRealtimeConnectorOptions? options = null)
+    {
+        _options = options ?? new CultMeshQuicRealtimeConnectorOptions();
+        if (_options.HandshakeTimeout <= TimeSpan.Zero)
+            throw new ArgumentOutOfRangeException(nameof(options), "QUIC handshake timeout must be positive.");
+    }
+
+    /// <inheritdoc />
+    public string ConnectorId => "msquic-realtime";
+
+    /// <inheritdoc />
+    public int Priority => 0;
+
+    /// <inheritdoc />
+    public bool CanConnect(CultMeshTransportCandidate candidate) =>
+        candidate != null && TryParseEndpoint(candidate.Endpoint, out _, out _);
+
+    /// <inheritdoc />
+    public async Task<ICultMeshRealtimeTransport> ConnectAsync(
+        CultMeshTransportCandidate candidate,
+        CultMeshSessionTarget target,
+        CancellationToken cancellationToken = default)
+    {
+        if (candidate == null) throw new ArgumentNullException(nameof(candidate));
+        if (target == null) throw new ArgumentNullException(nameof(target));
+        if (!QuicConnection.IsSupported)
+            throw new PlatformNotSupportedException("QUIC is unavailable. Install a supported MsQuic runtime.");
+        if (!TryParseEndpoint(candidate.Endpoint, out var host, out var port))
+            throw new NotSupportedException($"QUIC realtime connector does not support '{candidate.Endpoint}'.");
+
+        var validator = _options.ValidateProviderCertificate;
+        EndPoint remoteEndPoint = IPAddress.TryParse(host, out var address)
+            ? new IPEndPoint(address, port)
+            : new DnsEndPoint(host, port);
+        var connection = await QuicConnection.ConnectAsync(new QuicClientConnectionOptions
+        {
+            RemoteEndPoint = remoteEndPoint,
+            DefaultCloseErrorCode = CultMeshQuicRealtimeProtocol.ConnectionCloseCode,
+            DefaultStreamErrorCode = CultMeshQuicRealtimeProtocol.StreamAbortCode,
+            MaxInboundUnidirectionalStreams = 1024,
+            HandshakeTimeout = _options.HandshakeTimeout,
+            ClientAuthenticationOptions = new SslClientAuthenticationOptions
+            {
+                ApplicationProtocols = new List<SslApplicationProtocol> { _options.ApplicationProtocol },
+                EnabledSslProtocols = SslProtocols.Tls13,
+                RemoteCertificateValidationCallback = (_, certificate, chain, errors) =>
+                {
+                    var providerCertificate = certificate as X509Certificate2 ??
+                        (certificate == null ? null : new X509Certificate2(certificate));
+                    return validator?.Invoke(CultMeshRuntimeId.Parse(target.AuthorityRuntimeId), providerCertificate, chain, errors) ??
+                        errors == SslPolicyErrors.None ||
+                        MatchesAdvertisedCertificatePin(candidate.Endpoint, providerCertificate);
+                }
+            }
+        }, cancellationToken).ConfigureAwait(false);
+
+        return new CultMeshQuicRealtimeTransport(
+            candidate.Endpoint, connection, target: target, routeGeneration: candidate.Generation);
+    }
+
+    private static bool TryParseEndpoint(string? endpoint, out string host, out int port)
+    {
+        host = string.Empty;
+        port = 0;
+        if (!Uri.TryCreate(endpoint, UriKind.Absolute, out var uri) ||
+            !string.Equals(uri.Scheme, Scheme, StringComparison.OrdinalIgnoreCase) ||
+            string.IsNullOrWhiteSpace(uri.Host) || uri.Port <= 0)
+            return false;
+        host = uri.Host;
+        port = uri.Port;
+        return true;
+    }
+
+    private static bool MatchesAdvertisedCertificatePin(string endpoint, X509Certificate2? certificate)
+    {
+        if (certificate == null || !Uri.TryCreate(endpoint, UriKind.Absolute, out var uri))
+            return false;
+        var advertised = ParseQueryValue(uri.Query, "cert-sha256");
+        if (string.IsNullOrWhiteSpace(advertised)) return false;
+        var actual = Convert.ToHexString(SHA256.HashData(certificate.RawData));
+        return string.Equals(advertised, actual, StringComparison.OrdinalIgnoreCase);
+    }
+
+    private static string? ParseQueryValue(string query, string key)
+    {
+        foreach (var component in query.TrimStart('?').Split('&', StringSplitOptions.RemoveEmptyEntries))
+        {
+            var separator = component.IndexOf('=');
+            var candidateKey = separator < 0 ? component : component[..separator];
+            if (!string.Equals(Uri.UnescapeDataString(candidateKey), key, StringComparison.OrdinalIgnoreCase))
+                continue;
+            return separator < 0 ? string.Empty : Uri.UnescapeDataString(component[(separator + 1)..]);
+        }
+        return null;
+    }
+}
+
+/// <summary>Configures an authenticated CultMesh QUIC realtime listener.</summary>
+public sealed class CultMeshQuicRealtimeServerOptions
+{
+    /// <summary>Local endpoint to bind.</summary>
+    public IPEndPoint ListenEndPoint { get; set; } = new(IPAddress.Loopback, 0);
+
+    /// <summary>Server certificate used by QUIC TLS 1.3.</summary>
+    public X509Certificate2 ServerCertificate { get; set; } = null!;
+
+    /// <summary>Application protocol negotiated during the TLS handshake.</summary>
+    public SslApplicationProtocol ApplicationProtocol { get; set; } = CultMeshQuicRealtimeProtocol.ApplicationProtocol;
+
+    /// <summary>Maximum time permitted for connection establishment.</summary>
+    public TimeSpan HandshakeTimeout { get; set; } = TimeSpan.FromSeconds(10);
+}
+
+/// <summary>
+/// Accepts .NET QUIC realtime sessions. It owns physical connections only; provider
+/// authorization and the meaning of frames remain outside this adapter.
+/// </summary>
+public sealed class CultMeshQuicRealtimeServer : IAsyncDisposable
+{
+    private readonly QuicListener _listener;
+    private readonly CancellationTokenSource _shutdown = new();
+    private readonly ConcurrentDictionary<CultMeshQuicRealtimeTransport, byte> _clients = new();
+    private readonly CultMeshRealtimeInbox _received = new();
+    private readonly TaskCompletionSource<Exception> _backgroundFailure = new(
+        TaskCreationOptions.RunContinuationsAsynchronously);
+    private readonly Task _acceptLoop;
+    private bool _disposed;
+
+    private CultMeshQuicRealtimeServer(QuicListener listener)
+    {
+        _listener = listener;
+        _acceptLoop = AcceptLoopAsync(_shutdown.Token);
+    }
+
+    /// <summary>Bound listener endpoint.</summary>
+    public IPEndPoint LocalEndPoint => (IPEndPoint)_listener.LocalEndPoint;
+
+    /// <summary>Number of active physical client connections.</summary>
+    public int ConnectionCount => _clients.Count;
+
+    /// <summary>Completes if the listener's background accept loop fails.</summary>
+    public Task<Exception> BackgroundFailure => _backgroundFailure.Task;
+
+    /// <summary>Creates and starts an authenticated QUIC listener.</summary>
+    public static async Task<CultMeshQuicRealtimeServer> ListenAsync(
+        CultMeshQuicRealtimeServerOptions options,
+        CancellationToken cancellationToken = default)
+    {
+        if (options == null) throw new ArgumentNullException(nameof(options));
+        if (options.ServerCertificate == null)
+            throw new ArgumentException("A QUIC server certificate is required.", nameof(options));
+        if (options.HandshakeTimeout <= TimeSpan.Zero)
+            throw new ArgumentOutOfRangeException(nameof(options), "QUIC handshake timeout must be positive.");
+        if (!QuicListener.IsSupported)
+            throw new PlatformNotSupportedException("QUIC is unavailable. Install a supported MsQuic runtime.");
+
+        var listener = await QuicListener.ListenAsync(new QuicListenerOptions
+        {
+            ListenEndPoint = options.ListenEndPoint,
+            ApplicationProtocols = new List<SslApplicationProtocol> { options.ApplicationProtocol },
+            ConnectionOptionsCallback = (_, _, _) => ValueTask.FromResult(new QuicServerConnectionOptions
+            {
+                DefaultCloseErrorCode = CultMeshQuicRealtimeProtocol.ConnectionCloseCode,
+                DefaultStreamErrorCode = CultMeshQuicRealtimeProtocol.StreamAbortCode,
+                MaxInboundUnidirectionalStreams = 1024,
+                HandshakeTimeout = options.HandshakeTimeout,
+                ServerAuthenticationOptions = new SslServerAuthenticationOptions
+                {
+                    ApplicationProtocols = new List<SslApplicationProtocol> { options.ApplicationProtocol },
+                    EnabledSslProtocols = SslProtocols.Tls13,
+                    ServerCertificate = options.ServerCertificate
+                }
+            })
+        }, cancellationToken).ConfigureAwait(false);
+        return new CultMeshQuicRealtimeServer(listener);
+    }
+
+    /// <summary>Broadcasts one state frame to the currently connected clients.</summary>
+    public async Task BroadcastAsync(
+        CultMeshRealtimeFrame frame,
+        CancellationToken cancellationToken = default)
+    {
+        if (frame == null) throw new ArgumentNullException(nameof(frame));
+        cancellationToken.ThrowIfCancellationRequested();
+
+        if (frame.Delivery == CultMeshRealtimeDelivery.LatestOnly)
+        {
+            foreach (var client in _clients.Keys)
+            {
+                if (client.TryPublishLatest(frame)) continue;
+                if (_clients.TryRemove(client, out _)) client.Dispose();
+            }
+            return;
+        }
+
+        var sends = _clients.Keys.Select(client => SendToConnectedClientAsync(client, frame, cancellationToken)).ToArray();
+        if (sends.Length > 0) await Task.WhenAll(sends).ConfigureAwait(false);
+    }
+
+    private async Task SendToConnectedClientAsync(
+        CultMeshQuicRealtimeTransport client,
+        CultMeshRealtimeFrame frame,
+        CancellationToken cancellationToken)
+    {
+        try
+        {
+            await client.SendAsync(frame, cancellationToken).ConfigureAwait(false);
+        }
+        catch (OperationCanceledException) when (cancellationToken.IsCancellationRequested)
+        {
+            throw;
+        }
+        catch
+        {
+            if (_clients.TryRemove(client, out _))
+                client.Dispose();
+        }
+    }
+
+    /// <summary>Receives the next client-originated state frame.</summary>
+    public Task<CultMeshRealtimeFrame> ReceiveAsync(CancellationToken cancellationToken = default) =>
+        _received.ReceiveAsync(cancellationToken);
+
+    /// <inheritdoc />
+    public async ValueTask DisposeAsync()
+    {
+        if (_disposed) return;
+        _disposed = true;
+        _shutdown.Cancel();
+        await _listener.DisposeAsync().ConfigureAwait(false);
+        foreach (var client in _clients.Keys) client.Dispose();
+        _clients.Clear();
+        _received.Complete();
+        try { await _acceptLoop.ConfigureAwait(false); }
+        catch (OperationCanceledException) { }
+        _shutdown.Dispose();
+    }
+
+    private async Task AcceptLoopAsync(CancellationToken cancellationToken)
+    {
+        try
+        {
+            while (!cancellationToken.IsCancellationRequested)
+            {
+                var connection = await _listener.AcceptConnectionAsync(cancellationToken).ConfigureAwait(false);
+                var transport = new CultMeshQuicRealtimeTransport(
+                    connection.RemoteEndPoint?.ToString() ?? "quic-peer",
+                    connection,
+                    frame => _received.Publish(frame));
+                _clients.TryAdd(transport, 0);
+                _ = transport.Completion.ContinueWith(
+                    completed =>
+                    {
+                        _clients.TryRemove(transport, out _);
+                        transport.Dispose();
+                    },
+                    CancellationToken.None,
+                    TaskContinuationOptions.ExecuteSynchronously,
+                    TaskScheduler.Default);
+            }
+        }
+        catch (OperationCanceledException) when (cancellationToken.IsCancellationRequested)
+        {
+        }
+        catch (ObjectDisposedException) when (_disposed)
+        {
+        }
+        catch (Exception error)
+        {
+            _backgroundFailure.TrySetResult(error);
+        }
+    }
+}
+
+internal sealed class CultMeshQuicRealtimeTransport : ICultMeshRealtimeTransport, ICultMeshVerifiedTransport
+{
+    private readonly QuicConnection _connection;
+    private readonly CancellationTokenSource _shutdown = new();
+    private readonly CultMeshRealtimeInbox _received = new();
+    private readonly ConcurrentDictionary<string, CultMeshGeneration> _latestGenerations = new(StringComparer.Ordinal);
+    private readonly ConcurrentDictionary<int, Task> _streamReaders = new();
+    private readonly SemaphoreSlim _reliableSendGate = new(1, 1);
+    private readonly CultMeshRealtimeInbox _outbound = new();
+    private readonly Action<CultMeshRealtimeFrame>? _observer;
+    private readonly CultMeshSessionTarget? _target;
+    private readonly string _routeGeneration;
+    private readonly Task _acceptLoop;
+    private readonly Task _outboundLoop;
+    private readonly Task _completion;
+    private QuicStream? _reliableOutbound;
+    private int _nextReaderId;
+    private bool _disposed;
+
+    public CultMeshQuicRealtimeTransport(
+        string endpoint,
+        QuicConnection connection,
+        Action<CultMeshRealtimeFrame>? observer = null,
+        CultMeshSessionTarget? target = null,
+        string routeGeneration = "")
+    {
+        Endpoint = endpoint;
+        _connection = connection;
+        _observer = observer;
+        _target = target;
+        _routeGeneration = routeGeneration ?? string.Empty;
+        _acceptLoop = AcceptStreamsAsync(_shutdown.Token);
+        _outboundLoop = SendPublishedFramesAsync(_shutdown.Token);
+        _completion = Task.WhenAll(_acceptLoop, _outboundLoop);
+    }
+
+    public string TransportId => "msquic-realtime";
+    public string Endpoint { get; }
+    public Task Completion => _completion;
+
+    public bool IsVerifiedFor(
+        string verseId,
+        string authorityRuntimeId,
+        string protocolId,
+        string routeGeneration) =>
+        _target != null &&
+        string.Equals(_target.VerseId, verseId, StringComparison.Ordinal) &&
+        string.Equals(_target.AuthorityRuntimeId, authorityRuntimeId, StringComparison.Ordinal) &&
+        string.Equals(CultMeshProtocols.RealtimeState.Value, protocolId, StringComparison.Ordinal) &&
+        string.Equals(_routeGeneration, routeGeneration, StringComparison.Ordinal);
+
+    internal bool TryPublishLatest(CultMeshRealtimeFrame frame)
+    {
+        if (_disposed || frame.Delivery != CultMeshRealtimeDelivery.LatestOnly) return false;
+        return _outbound.Publish(frame);
+    }
+
+    public async Task SendAsync(CultMeshRealtimeFrame frame, CancellationToken cancellationToken = default)
+    {
+        if (_disposed) throw new ObjectDisposedException(nameof(CultMeshQuicRealtimeTransport));
+        if (frame == null) throw new ArgumentNullException(nameof(frame));
+        if (frame.Delivery == CultMeshRealtimeDelivery.Unreliable)
+            throw new NotSupportedException(
+                "System.Net.Quic exposes streams but not QUIC datagrams; unreliable delivery requires a native MsQuic connector.");
+
+        var payload = CultMeshQuicRealtimeProtocol.EncodeFrame(frame);
+        if (frame.Delivery == CultMeshRealtimeDelivery.ReliableOrdered)
+        {
+            await _reliableSendGate.WaitAsync(cancellationToken).ConfigureAwait(false);
+            try
+            {
+                _reliableOutbound ??= await OpenStreamAsync(
+                    CultMeshQuicRealtimeProtocol.ReliableStream,
+                    cancellationToken).ConfigureAwait(false);
+                await CultMeshQuicRealtimeProtocol.WriteFramedAsync(
+                    _reliableOutbound,
+                    payload,
+                    cancellationToken).ConfigureAwait(false);
+            }
+            finally
+            {
+                _reliableSendGate.Release();
+            }
+            return;
+        }
+
+        await using var stream = await OpenStreamAsync(
+            CultMeshQuicRealtimeProtocol.LatestOnlyStream,
+            cancellationToken).ConfigureAwait(false);
+        await CultMeshQuicRealtimeProtocol.WriteFramedAsync(stream, payload, cancellationToken).ConfigureAwait(false);
+        stream.CompleteWrites();
+    }
+
+    public Task<CultMeshRealtimeFrame> ReceiveAsync(CancellationToken cancellationToken = default) =>
+        _received.ReceiveAsync(cancellationToken);
+
+    public void Dispose()
+    {
+        if (_disposed) return;
+        _disposed = true;
+        _outbound.Complete();
+        _shutdown.Cancel();
+        _reliableOutbound?.DisposeAsync().AsTask().GetAwaiter().GetResult();
+        _connection.DisposeAsync().AsTask().GetAwaiter().GetResult();
+        _received.Complete();
+        _reliableSendGate.Dispose();
+        _shutdown.Dispose();
+    }
+
+    private async Task SendPublishedFramesAsync(CancellationToken cancellationToken)
+    {
+        try
+        {
+            while (!cancellationToken.IsCancellationRequested)
+            {
+                var frame = await _outbound.ReceiveAsync(cancellationToken).ConfigureAwait(false);
+                await SendAsync(frame, cancellationToken).ConfigureAwait(false);
+            }
+        }
+        catch (OperationCanceledException) when (cancellationToken.IsCancellationRequested)
+        {
+        }
+        catch
+        {
+            _shutdown.Cancel();
+            throw;
+        }
+    }
+
+    private async Task<QuicStream> OpenStreamAsync(byte kind, CancellationToken cancellationToken)
+    {
+        var stream = await _connection.OpenOutboundStreamAsync(
+            QuicStreamType.Unidirectional,
+            cancellationToken).ConfigureAwait(false);
+        await stream.WriteAsync(new[] { kind }, cancellationToken).ConfigureAwait(false);
+        return stream;
+    }
+
+    private async Task AcceptStreamsAsync(CancellationToken cancellationToken)
+    {
+        try
+        {
+            while (!cancellationToken.IsCancellationRequested)
+            {
+                var stream = await _connection.AcceptInboundStreamAsync(cancellationToken).ConfigureAwait(false);
+                var readerId = Interlocked.Increment(ref _nextReaderId);
+                var reader = ReadStreamOwnedAsync(readerId, stream, cancellationToken);
+                _streamReaders.TryAdd(readerId, reader);
+            }
+        }
+        catch (OperationCanceledException) when (cancellationToken.IsCancellationRequested)
+        {
+        }
+        catch (QuicException) when (_disposed)
+        {
+        }
+        finally
+        {
+            try
+            {
+                await Task.WhenAll(_streamReaders.Values).ConfigureAwait(false);
+                _received.Complete();
+            }
+            catch (Exception error)
+            {
+                _received.Complete(error);
+                throw;
+            }
+        }
+    }
+
+    private async Task ReadStreamOwnedAsync(
+        int readerId,
+        QuicStream stream,
+        CancellationToken cancellationToken)
+    {
+        try
+        {
+            await ReadStreamAsync(stream, cancellationToken).ConfigureAwait(false);
+        }
+        catch (Exception error) when (!_disposed && error is not OperationCanceledException)
+        {
+            _received.Complete(error);
+            _shutdown.Cancel();
+        }
+        finally
+        {
+            _streamReaders.TryRemove(readerId, out _);
+        }
+    }
+
+    private async Task ReadStreamAsync(QuicStream stream, CancellationToken cancellationToken)
+    {
+        await using (stream.ConfigureAwait(false))
+        {
+            try
+            {
+                var kind = await CultMeshQuicRealtimeProtocol.ReadByteAsync(stream, cancellationToken).ConfigureAwait(false);
+                if (kind != CultMeshQuicRealtimeProtocol.ReliableStream &&
+                    kind != CultMeshQuicRealtimeProtocol.LatestOnlyStream)
+                    throw new InvalidDataException($"Unknown CultMesh QUIC stream kind {kind}.");
+
+                do
+                {
+                    var payload = await CultMeshQuicRealtimeProtocol.ReadFramedAsync(stream, cancellationToken).ConfigureAwait(false);
+                    if (payload == null) break;
+                    var frame = CultMeshQuicRealtimeProtocol.DecodeFrame(payload);
+                    if (kind == CultMeshQuicRealtimeProtocol.ReliableStream &&
+                        frame.Delivery != CultMeshRealtimeDelivery.ReliableOrdered)
+                        throw new InvalidDataException("Reliable QUIC stream carried incompatible delivery semantics.");
+                    if (kind == CultMeshQuicRealtimeProtocol.LatestOnlyStream &&
+                        frame.Delivery != CultMeshRealtimeDelivery.LatestOnly)
+                        throw new InvalidDataException("Latest-only QUIC stream carried incompatible delivery semantics.");
+                    PublishReceived(frame);
+                }
+                while (kind == CultMeshQuicRealtimeProtocol.ReliableStream);
+            }
+            catch (OperationCanceledException) when (cancellationToken.IsCancellationRequested)
+            {
+            }
+            catch (QuicException) when (_disposed)
+            {
+            }
+        }
+    }
+
+    private void PublishReceived(CultMeshRealtimeFrame frame)
+    {
+        if (frame.Delivery == CultMeshRealtimeDelivery.LatestOnly)
+        {
+            var key = frame.ChannelId + "\u001f" + frame.BodyId;
+            var generation = new CultMeshGeneration(frame.ProducerEpoch, frame.Sequence);
+            while (true)
+            {
+                if (_latestGenerations.TryGetValue(key, out var current))
+                {
+                    if (generation.CompareTo(current) <= 0) return;
+                    if (!_latestGenerations.TryUpdate(key, generation, current)) continue;
+                }
+                else if (!_latestGenerations.TryAdd(key, generation))
+                {
+                    continue;
+                }
+                break;
+            }
+        }
+        _observer?.Invoke(frame);
+        _received.Publish(frame);
+    }
+
+    private readonly record struct CultMeshGeneration(long ProducerEpoch, long Sequence) : IComparable<CultMeshGeneration>
+    {
+        public int CompareTo(CultMeshGeneration other)
+        {
+            var epochOrder = ProducerEpoch.CompareTo(other.ProducerEpoch);
+            return epochOrder != 0 ? epochOrder : Sequence.CompareTo(other.Sequence);
+        }
+    }
+}
+
+internal sealed class CultMeshRealtimeInbox
+{
+    private readonly object _gate = new();
+    private readonly Channel<InboxToken> _ready = Channel.CreateUnbounded<InboxToken>(
+        new UnboundedChannelOptions { SingleReader = false, SingleWriter = false });
+    private readonly Dictionary<string, CultMeshRealtimeFrame> _latest = new(StringComparer.Ordinal);
+    private bool _completed;
+
+    public bool Publish(CultMeshRealtimeFrame frame)
+    {
+        if (frame.Delivery != CultMeshRealtimeDelivery.LatestOnly)
+        {
+            return _ready.Writer.TryWrite(new InboxToken(frame, null));
+        }
+
+        var key = frame.ChannelId + "\u001f" + frame.BodyId;
+        lock (_gate)
+        {
+            if (_completed) return false;
+            var alreadyPending = _latest.ContainsKey(key);
+            _latest[key] = frame;
+            return alreadyPending || _ready.Writer.TryWrite(new InboxToken(null, key));
+        }
+    }
+
+    public async Task<CultMeshRealtimeFrame> ReceiveAsync(CancellationToken cancellationToken)
+    {
+        while (true)
+        {
+            var token = await _ready.Reader.ReadAsync(cancellationToken).ConfigureAwait(false);
+            if (token.Frame != null) return token.Frame;
+            lock (_gate)
+            {
+                if (token.LatestKey != null && _latest.Remove(token.LatestKey, out var latest))
+                    return latest;
+            }
+        }
+    }
+
+    public void Complete(Exception? error = null)
+    {
+        lock (_gate) _completed = true;
+        _ready.Writer.TryComplete(error);
+    }
+
+    private sealed record InboxToken(CultMeshRealtimeFrame? Frame, string? LatestKey);
+}
+
+internal static class CultMeshQuicRealtimeProtocol
+{
+    public static readonly SslApplicationProtocol ApplicationProtocol =
+        new(CultMeshRealtimeWireProtocol.ApplicationProtocolName);
+    public const long ConnectionCloseCode = CultMeshRealtimeWireProtocol.ConnectionCloseCode;
+    public const long StreamAbortCode = CultMeshRealtimeWireProtocol.StreamAbortCode;
+    public const byte ReliableStream = CultMeshRealtimeWireProtocol.ReliableStream;
+    public const byte LatestOnlyStream = CultMeshRealtimeWireProtocol.LatestOnlyStream;
+
+    public static byte[] EncodeFrame(CultMeshRealtimeFrame frame) =>
+        CultMeshRealtimeWireProtocol.EncodeFrame(frame);
+
+    public static CultMeshRealtimeFrame DecodeFrame(byte[] bytes) =>
+        CultMeshRealtimeWireProtocol.DecodeFrame(bytes);
+
+    public static async Task WriteFramedAsync(Stream stream, byte[] payload, CancellationToken cancellationToken)
+    {
+        var header = new byte[4];
+        BinaryPrimitives.WriteInt32LittleEndian(header, payload.Length);
+        await stream.WriteAsync(header, cancellationToken).ConfigureAwait(false);
+        await stream.WriteAsync(payload, cancellationToken).ConfigureAwait(false);
+    }
+
+    public static async Task<byte[]?> ReadFramedAsync(Stream stream, CancellationToken cancellationToken)
+    {
+        var header = new byte[4];
+        var first = await stream.ReadAsync(header.AsMemory(0, 1), cancellationToken).ConfigureAwait(false);
+        if (first == 0) return null;
+        await ReadExactlyAsync(stream, header.AsMemory(1), cancellationToken).ConfigureAwait(false);
+        var length = BinaryPrimitives.ReadInt32LittleEndian(header);
+        if (length <= 0 || length > CultMeshRealtimeWireProtocol.MaximumEncodedFrameBytes)
+            throw new InvalidDataException("Realtime QUIC frame length is invalid.");
+        var payload = new byte[length];
+        await ReadExactlyAsync(stream, payload, cancellationToken).ConfigureAwait(false);
+        return payload;
+    }
+
+    public static async Task<byte> ReadByteAsync(Stream stream, CancellationToken cancellationToken)
+    {
+        var value = new byte[1];
+        await ReadExactlyAsync(stream, value, cancellationToken).ConfigureAwait(false);
+        return value[0];
+    }
+
+    private static async Task ReadExactlyAsync(Stream stream, Memory<byte> destination, CancellationToken cancellationToken)
+    {
+        var offset = 0;
+        while (offset < destination.Length)
+        {
+            var read = await stream.ReadAsync(destination[offset..], cancellationToken).ConfigureAwait(false);
+            if (read == 0) throw new EndOfStreamException("QUIC stream ended before its frame was complete.");
+            offset += read;
+        }
+    }
+}
diff --git a/src/GameCult.Mesh.Quic/GameCult.Mesh.Quic.csproj b/src/GameCult.Mesh.Quic/GameCult.Mesh.Quic.csproj
new file mode 100644
index 00000000..2685220a
--- /dev/null
+++ b/src/GameCult.Mesh.Quic/GameCult.Mesh.Quic.csproj
@@ -0,0 +1,16 @@
+<Project Sdk="Microsoft.NET.Sdk">
+  <PropertyGroup>
+    <TargetFramework>net10.0</TargetFramework>
+    <ImplicitUsings>enable</ImplicitUsings>
+    <Nullable>enable</Nullable>
+    <Description>MsQuic-backed realtime state transport for CultMesh</Description>
+    <PackageId>GameCult.Mesh.Quic</PackageId>
+    <PackageTags>game;distributed;realtime;mesh;quic;msquic</PackageTags>
+    <PackageReadmeFile>README.md</PackageReadmeFile>
+    <NoWarn>$(NoWarn);CA1416</NoWarn>
+  </PropertyGroup>
+  <ItemGroup>
+    <ProjectReference Include="..\GameCult.Mesh\GameCult.Mesh.csproj" />
+    <None Include="README.md" Pack="true" PackagePath="\" />
+  </ItemGroup>
+</Project>
diff --git a/src/GameCult.Mesh.Quic/README.md b/src/GameCult.Mesh.Quic/README.md
new file mode 100644
index 00000000..1aab43c5
--- /dev/null
+++ b/src/GameCult.Mesh.Quic/README.md
@@ -0,0 +1,76 @@
+# GameCult.Mesh.Quic
+
+`GameCult.Mesh.Quic` is the optional MsQuic-backed realtime state plane for
+CultMesh daemons and .NET tools. It implements the transport-neutral contracts
+from `GameCult.Mesh`; it does not own discovery, provider authorization, state
+meaning, commands, receipts, schemas, or immutable content.
+
+The package targets .NET 10. It uses `System.Net.Quic`, which requires a
+supported MsQuic runtime and TLS 1.3. Unity runtimes do not consume this package;
+their generic CultMesh lowerer needs a native MsQuic connector implementing the
+same `ICultMeshRealtimeTransportConnector` contract.
+
+## Provider
+
+```csharp
+using GameCult.Mesh.Quic;
+
+await using var server = await CultMeshQuicRealtimeServer.ListenAsync(
+    new CultMeshQuicRealtimeServerOptions
+    {
+        ListenEndPoint = new IPEndPoint(IPAddress.Any, 7443),
+        ServerCertificate = providerCertificate
+    });
+
+await server.BroadcastAsync(new CultMeshRealtimeFrame
+{
+    ChannelId = "aetheria.entities",
+    SchemaId = "eve.entity_soa.v1",
+    BodyId = "body:aetheria:entities",
+    ProducerEpoch = epoch,
+    Sequence = sequence,
+    Delivery = CultMeshRealtimeDelivery.LatestOnly,
+    Payload = encodedSoa
+});
+```
+
+Advertise the listener as `cultmesh-state+quic://host:port`. Certificate
+identity and provider identity must be bound by the application trust policy;
+accepting every certificate is appropriate only in isolated tests.
+For directly trusted discovery records, a provider may append its uppercase
+SHA-256 certificate fingerprint as `?cert-sha256=...`. The default connector
+accepts a self-signed certificate only when its raw certificate bytes match that
+advertised pin. A caller-supplied validator remains authoritative when present.
+
+## Consumer
+
+```csharp
+var connector = new CultMeshQuicRealtimeTransportConnector(
+    new CultMeshQuicRealtimeConnectorOptions
+    {
+        ValidateProviderCertificate = ValidateAdvertisedProvider
+    });
+
+using var sessions = new CultMeshSessionManager(
+    discovery,
+    schemaConnectors,
+    contentConnectors,
+    new ICultMeshRealtimeTransportConnector[] { connector });
+
+var session = await sessions.ConnectRealtimeAsync(providerId);
+var frame = await session.ReceiveAsync(cancellationToken);
+```
+
+## Delivery modes
+
+- `ReliableOrdered` uses one ordered QUIC stream.
+- `LatestOnly` uses independent streams and keeps at most one pending frame per
+  channel and body. A newer `(producer epoch, sequence)` generation replaces
+  queued state.
+- `Unreliable` fails closed in this adapter because `System.Net.Quic` does not
+  expose QUIC datagrams. Use a native MsQuic connector when datagram semantics
+  are required.
+
+Schemas, commands, receipts, manifests, and immutable content remain on their
+TCP planes. Same-machine SoA should negotiate mapped/shared memory instead of
+crossing QUIC.
diff --git a/src/GameCult.Mesh/CultMesh.cs b/src/GameCult.Mesh/CultMesh.cs
index 9cc40ca2..e7436db2 100644
--- a/src/GameCult.Mesh/CultMesh.cs
+++ b/src/GameCult.Mesh/CultMesh.cs
@@ -1,12 +1,16 @@
 using System;
+using System.Collections.Generic;
 using System.IO;
 using System.Linq;
 using System.Net;
 using System.Net.Sockets;
+using System.Reflection;
+using System.Threading;
 using System.Threading.Tasks;
 using GameCult.Caching;
 using GameCult.Caching.MessagePack;
 using GameCult.Networking;
+using R3;
 
 namespace GameCult.Mesh
 {
@@ -105,6 +109,279 @@ namespace GameCult.Mesh
         }
     }
 
+    /// <summary>
+    /// Options for opening one typed document from a remote CultNet snapshot endpoint.
+    /// </summary>
+    public sealed class CultMeshPeerSnapshotDocumentOptions
+    {
+        /// <summary>Gets or sets the semantic document id. Defaults to the record key.</summary>
+        public string? DocumentId { get; set; }
+
+        /// <summary>Gets or sets the source id advertised by diagnostics. Defaults to the record key.</summary>
+        public string? SourceId { get; set; }
+
+        /// <summary>Gets or sets the route hint for the resulting handle.</summary>
+        public CultMeshRouteHint? RouteHint { get; set; }
+
+        /// <summary>Gets or sets the response timeout for each snapshot request.</summary>
+        public TimeSpan ResponseTimeout { get; set; } = TimeSpan.FromSeconds(5);
+
+        /// <summary>Gets or sets the connection timeout for endpoint-created clients.</summary>
+        public TimeSpan ConnectTimeout { get; set; } = TimeSpan.FromSeconds(5);
+
+        /// <summary>Gets or sets the polling interval for watch fallback.</summary>
+        public TimeSpan PollInterval { get; set; } = TimeSpan.FromMilliseconds(250);
+
+        /// <summary>Gets or sets the message id prefix used for snapshot requests.</summary>
+        public string? MessageIdPrefix { get; set; }
+
+        /// <summary>Gets or sets schema ids to request. Empty means the document type schema is requested.</summary>
+        public IReadOnlyList<string>? SchemaIds { get; set; }
+
+        /// <summary>Gets or sets the target shard id, when the endpoint is shard-aware.</summary>
+        public string? ShardId { get; set; }
+
+        /// <summary>Gets or sets the target shard epoch, when the endpoint is shard-aware.</summary>
+        public long? ShardEpoch { get; set; }
+
+        /// <summary>Gets or sets client security options for endpoint-created clients.</summary>
+        public ClientSecurityOptions? Security { get; set; }
+
+        /// <summary>Gets or sets a callback used to configure endpoint-created LiteNetLib clients.</summary>
+        public Action<Client>? ConfigureClient { get; set; }
+
+        /// <summary>Gets or sets the runtime id used by endpoint-created RUDP clients.</summary>
+        public string? RudpRuntimeId { get; set; }
+
+        /// <summary>Gets or sets the connection id used by endpoint-created RUDP clients.</summary>
+        public uint RudpConnectionId { get; set; } = 0x43554c54;
+
+        /// <summary>Gets or sets the connect payload used by endpoint-created RUDP clients.</summary>
+        public string RudpConnectPayload { get; set; } = "cultnet-schema-rudp";
+
+        /// <summary>Gets or sets the maximum fragment size used by endpoint-created RUDP clients.</summary>
+        public int RudpMaxFragmentBytes { get; set; } = 1024;
+
+        /// <summary>Gets or sets the resend delay used by endpoint-created RUDP clients.</summary>
+        public long RudpResendDelayMs { get; set; } = 25;
+    }
+
+    /// <summary>
+    /// Options for opening one typed document from a CultCache backing-store publication.
+    /// </summary>
+    public sealed class CultMeshStoreDocumentOptions
+    {
+        /// <summary>Gets or sets the semantic document id. Defaults to the record key.</summary>
+        public string? DocumentId { get; set; }
+
+        /// <summary>Gets or sets the source id advertised by diagnostics. Defaults to the record key.</summary>
+        public string? SourceId { get; set; }
+
+        /// <summary>Gets or sets the route hint for the resulting handle.</summary>
+        public CultMeshRouteHint? RouteHint { get; set; }
+
+        /// <summary>Gets or sets the polling interval for watch fallback.</summary>
+        public TimeSpan PollInterval { get; set; } = TimeSpan.FromMilliseconds(250);
+
+        /// <summary>Gets or sets the document registry used to resolve persisted schema aliases.</summary>
+        public CultDocumentRegistry? Registry { get; set; }
+    }
+
+    /// <summary>
+    /// Describes where a typed document publication should be read from.
+    /// </summary>
+    public abstract class CultMeshDocumentPublicationSource
+    {
+        private CultMeshDocumentPublicationSource()
+        {
+        }
+
+        /// <summary>Creates a publication source from a CultCache backing store.</summary>
+        public static CultMeshDocumentPublicationSource Store(CacheBackingStore store)
+        {
+            return new StoreSource(store);
+        }
+
+        /// <summary>Creates a publication source from a single-file MessagePack CultCache publication.</summary>
+        public static CultMeshDocumentPublicationSource SingleFile(string path)
+        {
+            return new SingleFileSource(path);
+        }
+
+        /// <summary>Creates a publication source from a remote CultNet snapshot response provider.</summary>
+        public static CultMeshDocumentPublicationSource PeerSnapshot(Func<CultMeshQueryContext, Task<CultNetSnapshotResponseRawMessage>> snapshot)
+        {
+            return new PeerSnapshotSource(snapshot);
+        }
+
+        /// <summary>Creates a publication source from a remote CultNet schema endpoint.</summary>
+        public static CultMeshDocumentPublicationSource PeerSnapshot(string endpoint)
+        {
+            return new PeerSnapshotEndpointSource(endpoint);
+        }
+
+        /// <summary>Creates a publication source from a remote CultNet schema client factory.</summary>
+        public static CultMeshDocumentPublicationSource PeerSnapshot(Func<ICultNetSchemaClient> createClient, string endpoint)
+        {
+            return new PeerSnapshotClientSource(createClient, endpoint);
+        }
+
+        internal sealed class StoreSource : CultMeshDocumentPublicationSource
+        {
+            public StoreSource(CacheBackingStore store)
+            {
+                BackingStore = store ?? throw new ArgumentNullException(nameof(store));
+            }
+
+            public CacheBackingStore BackingStore { get; }
+        }
+
+        internal sealed class SingleFileSource : CultMeshDocumentPublicationSource
+        {
+            public SingleFileSource(string path)
+            {
+                Path = string.IsNullOrWhiteSpace(path)
+                    ? throw new ArgumentException("Value must be non-empty.", nameof(path))
+                    : path;
+            }
+
+            public string Path { get; }
+        }
+
+        internal sealed class PeerSnapshotSource : CultMeshDocumentPublicationSource
+        {
+            public PeerSnapshotSource(Func<CultMeshQueryContext, Task<CultNetSnapshotResponseRawMessage>> snapshot)
+            {
+                Snapshot = snapshot ?? throw new ArgumentNullException(nameof(snapshot));
+            }
+
+            public Func<CultMeshQueryContext, Task<CultNetSnapshotResponseRawMessage>> Snapshot { get; }
+        }
+
+        internal sealed class PeerSnapshotEndpointSource : CultMeshDocumentPublicationSource
+        {
+            public PeerSnapshotEndpointSource(string endpoint)
+            {
+                Endpoint = string.IsNullOrWhiteSpace(endpoint)
+                    ? throw new ArgumentException("Value must be non-empty.", nameof(endpoint))
+                    : endpoint;
+            }
+
+            public string Endpoint { get; }
+        }
+
+        internal sealed class PeerSnapshotClientSource : CultMeshDocumentPublicationSource
+        {
+            public PeerSnapshotClientSource(Func<ICultNetSchemaClient> createClient, string endpoint)
+            {
+                CreateClient = createClient ?? throw new ArgumentNullException(nameof(createClient));
+                Endpoint = string.IsNullOrWhiteSpace(endpoint)
+                    ? throw new ArgumentException("Value must be non-empty.", nameof(endpoint))
+                    : endpoint;
+            }
+
+            public Func<ICultNetSchemaClient> CreateClient { get; }
+
+            public string Endpoint { get; }
+        }
+    }
+
+    /// <summary>
+    /// Describes one typed document to bind from a CultMesh publication source.
+    /// </summary>
+    public interface ICultMeshPublicationDocumentBinding
+    {
+        /// <summary>Gets the publication source override for this document, when it differs from the catalog source.</summary>
+        CultMeshDocumentPublicationSource? Source { get; }
+
+        /// <summary>Binds this document request to a publication-backed handle.</summary>
+        ICultMeshDocumentHandle Bind(
+            CultMeshDocumentPublicationSource source,
+            CultMeshVerseContext context,
+            CultMeshStoreDocumentOptions? storeOptions,
+            CultMeshPeerSnapshotDocumentOptions? peerOptions);
+
+        /// <summary>Reads this publication document and hydrates it into a local node.</summary>
+        Task<ICultMeshDocumentHandle> SyncAsync(
+            CultMeshNode node,
+            CultMeshDocumentPublicationSource source,
+            CultMeshVerseContext context,
+            CultMeshStoreDocumentOptions? storeOptions,
+            CultMeshPeerSnapshotDocumentOptions? peerOptions);
+    }
+
+    /// <summary>
+    /// Describes one typed document to bind from a CultMesh publication source.
+    /// </summary>
+    public sealed class CultMeshPublicationDocumentBinding<TDocument> : ICultMeshPublicationDocumentBinding
+        where TDocument : class
+    {
+        internal CultMeshPublicationDocumentBinding(
+            CultRecordKey key,
+            string? documentId,
+            string? sourceId,
+            CultMeshDocumentPublicationSource? source)
+        {
+            Key = key;
+            DocumentId = documentId;
+            SourceId = sourceId;
+            Source = source;
+        }
+
+        /// <summary>Gets the record key to read.</summary>
+        public CultRecordKey Key { get; }
+
+        /// <summary>Gets the semantic document id. Defaults to the record key.</summary>
+        public string? DocumentId { get; }
+
+        /// <summary>Gets the source id advertised by diagnostics. Defaults to the document id or record key.</summary>
+        public string? SourceId { get; }
+
+        /// <inheritdoc />
+        public CultMeshDocumentPublicationSource? Source { get; }
+
+        /// <inheritdoc />
+        public ICultMeshDocumentHandle Bind(
+            CultMeshDocumentPublicationSource source,
+            CultMeshVerseContext context,
+            CultMeshStoreDocumentOptions? storeOptions,
+            CultMeshPeerSnapshotDocumentOptions? peerOptions)
+        {
+            return CultMesh.DocumentFromPublication<TDocument>(
+                Source ?? source,
+                Key,
+                context,
+                CultMesh.WithPublicationBindingOptions(storeOptions, Key, DocumentId, SourceId),
+                CultMesh.WithPublicationBindingOptions(peerOptions, Key, DocumentId, SourceId));
+        }
+
+        /// <inheritdoc />
+        public async Task<ICultMeshDocumentHandle> SyncAsync(
+            CultMeshNode node,
+            CultMeshDocumentPublicationSource source,
+            CultMeshVerseContext context,
+            CultMeshStoreDocumentOptions? storeOptions,
+            CultMeshPeerSnapshotDocumentOptions? peerOptions)
+        {
+            if (node == null) throw new ArgumentNullException(nameof(node));
+            if (context == null) throw new ArgumentNullException(nameof(context));
+
+            var publication = CultMesh.DocumentFromPublication<TDocument>(
+                Source ?? source,
+                Key,
+                context,
+                CultMesh.WithPublicationBindingOptions(storeOptions, Key, DocumentId, SourceId),
+                CultMesh.WithPublicationBindingOptions(peerOptions, Key, DocumentId, SourceId));
+            var local = CultMesh.Document<TDocument>(
+                node,
+                Key,
+                context,
+                string.IsNullOrWhiteSpace(DocumentId) ? Key.Value : DocumentId);
+            await local.ReplaceAsync(await publication.LatestAsync().ConfigureAwait(false)).ConfigureAwait(false);
+            return local;
+        }
+    }
+
     /// <summary>
     /// A locally hosted CultMesh node over CultCache, CultNet transport, and the mesh database facade.
     /// </summary>
@@ -155,7 +432,65 @@ namespace GameCult.Mesh
         /// </summary>
         public Task FlushAsync(bool soft = false)
         {
-            return _host.FlushAsync(soft);
+            return _host.FlushAsync();
+        }
+
+        /// <summary>
+        /// Creates a typed document handle over one distributed record hosted by this node.
+        /// </summary>
+        public CultMeshDocumentHandle<TDocument> Document<TDocument>(
+            CultRecordKey key,
+            CultMeshVerseContext context,
+            string? documentId = null,
+            IEnumerable<CultMeshProjectionSource>? sources = null,
+            CultMeshRouteHint? routeHint = null)
+            where TDocument : class
+        {
+            return CultMesh.Document<TDocument>(Database, key, context, documentId, sources, routeHint);
+        }
+
+        /// <summary>
+        /// Creates a typed document handle over one distributed record hosted by this node.
+        /// </summary>
+        public CultMeshDocumentHandle<TDocument> Document<TDocument>(
+            CultRecordKey key,
+            CultMeshVerse verse,
+            string? documentId = null,
+            IEnumerable<CultMeshProjectionSource>? sources = null,
+            CultMeshRouteHint? routeHint = null)
+            where TDocument : class
+        {
+            if (verse == null) throw new ArgumentNullException(nameof(verse));
+            return Document<TDocument>(key, verse.Context, documentId, sources, routeHint);
+        }
+
+        /// <summary>
+        /// Creates a typed document handle over one distributed record hosted by this node.
+        /// </summary>
+        public CultMeshDocumentHandle<TDocument> Document<TDocument>(
+            string recordKey,
+            CultMeshVerseContext context,
+            string? documentId = null,
+            IEnumerable<CultMeshProjectionSource>? sources = null,
+            CultMeshRouteHint? routeHint = null)
+            where TDocument : class
+        {
+            return Document<TDocument>(new CultRecordKey(recordKey), context, documentId, sources, routeHint);
+        }
+
+        /// <summary>
+        /// Creates a typed document handle over one distributed record hosted by this node.
+        /// </summary>
+        public CultMeshDocumentHandle<TDocument> Document<TDocument>(
+            string recordKey,
+            CultMeshVerse verse,
+            string? documentId = null,
+            IEnumerable<CultMeshProjectionSource>? sources = null,
+            CultMeshRouteHint? routeHint = null)
+            where TDocument : class
+        {
+            if (verse == null) throw new ArgumentNullException(nameof(verse));
+            return Document<TDocument>(recordKey, verse.Context, documentId, sources, routeHint);
         }
 
         /// <inheritdoc />
@@ -203,7 +538,7 @@ namespace GameCult.Mesh
     public sealed class CultMeshRudpSocketOptions
     {
         /// <summary>Gets or sets the local bind host.</summary>
-        public string BindHost { get; set; } = "127.0.0.1";
+        public string BindHost { get; set; } = "0.0.0.0";
         /// <summary>Gets or sets the local bind port.</summary>
         public int BindPort { get; set; }
         /// <summary>Gets or sets a caller-owned bound socket.</summary>
@@ -242,7 +577,7 @@ namespace GameCult.Mesh
     /// <summary>
     /// Public CultMesh entrypoints.
     /// </summary>
-    public static class CultMesh
+    public static partial class CultMesh
     {
         /// <summary>
         /// Creates a local CultMesh node with a durable CultCache and the canonical MessagePack backing store.
@@ -297,6 +632,2181 @@ namespace GameCult.Mesh
             return new CultMeshStreamCatalog();
         }
 
+        /// <summary>
+        /// Packs bytes into content-addressed CDN chunk documents and a versioned artifact manifest.
+        /// </summary>
+        public static CultMeshCdnArtifact PackCdnArtifact(
+            string artifactId,
+            byte[] payload,
+            CultMeshCdnPackOptions? options = null)
+        {
+            return CultMeshCdn.PackArtifact(artifactId, payload, options);
+        }
+
+        /// <summary>
+        /// Publishes a packed CDN artifact into a local cache.
+        /// </summary>
+        public static Task<CultMeshCdnArtifactManifest> PublishCdnArtifactAsync(
+            CultCache cache,
+            CultMeshCdnArtifact artifact)
+        {
+            return CultMeshCdn.PublishAsync(cache, artifact);
+        }
+
+        /// <summary>
+        /// Publishes a packed CDN artifact into a distributed CultNet database.
+        /// </summary>
+        public static Task<CultMeshCdnArtifactManifest> PublishCdnArtifactAsync(
+            CultNetDatabase database,
+            CultMeshCdnArtifact artifact)
+        {
+            return CultMeshCdn.PublishAsync(database, artifact);
+        }
+
+        /// <summary>
+        /// Reassembles and verifies a CDN artifact from a local cache.
+        /// </summary>
+        public static byte[] ReadCdnArtifact(
+            CultCache cache,
+            CultMeshCdnArtifactManifest manifest)
+        {
+            return CultMeshCdn.ReadArtifact(cache, manifest);
+        }
+
+        /// <summary>
+        /// Reassembles and verifies a CDN artifact from a distributed CultNet database.
+        /// </summary>
+        public static Task<byte[]> ReadCdnArtifactAsync(
+            CultNetDatabase database,
+            CultMeshCdnArtifactManifest manifest)
+        {
+            return CultMeshCdn.ReadArtifactAsync(database, manifest);
+        }
+
+        /// <summary>
+        /// Creates a CultNet document registry for CDN artifact manifests and chunks.
+        /// </summary>
+        public static CultNetDocumentRegistry CreateCdnDocumentRegistry(CultDocumentRegistry? documents = null)
+        {
+            return CultMeshCdn.CreateDocumentRegistry(documents);
+        }
+
+        /// <summary>
+        /// Computes and stamps the content hash for a portable entity prefab package.
+        /// </summary>
+        public static CultMeshEntityPrefabPackage FinalizeEntityPrefabPackage(
+            CultMeshEntityPrefabPackage package)
+        {
+            return CultMeshEntityPrefabs.FinalizePackage(package);
+        }
+
+        /// <summary>
+        /// Publishes a portable entity prefab package into a local cache.
+        /// </summary>
+        public static Task<CultMeshEntityPrefabPackage> PublishEntityPrefabPackageAsync(
+            CultCache cache,
+            CultMeshEntityPrefabPackage package)
+        {
+            return CultMeshEntityPrefabs.PublishAsync(cache, package);
+        }
+
+        /// <summary>
+        /// Publishes a portable entity prefab package into a distributed CultNet database.
+        /// </summary>
+        public static Task<CultMeshEntityPrefabPackage> PublishEntityPrefabPackageAsync(
+            CultNetDatabase database,
+            CultMeshEntityPrefabPackage package)
+        {
+            return CultMeshEntityPrefabs.PublishAsync(database, package);
+        }
+
+        /// <summary>
+        /// Creates a CultNet document registry for portable entity prefab packages.
+        /// </summary>
+        public static CultNetDocumentRegistry CreateEntityPrefabDocumentRegistry(CultDocumentRegistry? documents = null)
+        {
+            return CultMeshEntityPrefabs.CreateDocumentRegistry(documents);
+        }
+
+        /// <summary>
+        /// Creates a CultNet document registry for CDN assets and portable entity prefab packages.
+        /// </summary>
+        public static CultNetDocumentRegistry CreateAssetPipelineDocumentRegistry(CultDocumentRegistry? documents = null)
+        {
+            return CultMeshEntityPrefabs.CreateAssetPipelineDocumentRegistry(documents);
+        }
+
+        /// <summary>
+        /// Creates a managed Verse context for generated domain sugar.
+        /// </summary>
+        public static CultMeshVerse Verse(
+            string verseId,
+            string runtimeId,
+            CultMeshRouteHint? routeHint = null,
+            IEnumerable<CultMeshAuthorityClaim>? claims = null)
+        {
+            return new CultMeshVerse(new CultMeshVerseContext(verseId, runtimeId, routeHint, claims));
+        }
+
+        /// <summary>
+        /// Creates a managed Verse context for generated domain sugar.
+        /// </summary>
+        public static Task<CultMeshVerse> ConnectVerseAsync(
+            string verseId,
+            string runtimeId,
+            CultMeshRouteHint? routeHint = null,
+            IEnumerable<CultMeshAuthorityClaim>? claims = null)
+        {
+            return Task.FromResult(Verse(verseId, runtimeId, routeHint, claims));
+        }
+
+        /// <summary>
+        /// Starts a fluent typed operation context for one runtime.
+        /// </summary>
+        public static CultMeshOperationContextBuilder OperationContextFor(string runtimeId)
+        {
+            return new CultMeshOperationContextBuilder(runtimeId);
+        }
+
+        /// <summary>
+        /// Starts a fluent typed query context for one runtime.
+        /// </summary>
+        public static CultMeshQueryContextBuilder QueryContextFor(string runtimeId)
+        {
+            return new CultMeshQueryContextBuilder(runtimeId);
+        }
+
+        /// <summary>
+        /// Binds a typed operation handle to a Verse context.
+        /// </summary>
+        public static CultMeshBoundOperationHandle<TRequest, TResponse> BindOperation<TRequest, TResponse>(
+            CultMeshVerseContext context,
+            CultMeshOperationHandle<TRequest, TResponse> operation)
+        {
+            return new CultMeshBoundOperationHandle<TRequest, TResponse>(context, operation);
+        }
+
+        /// <summary>
+        /// Binds a typed operation handle to a Verse.
+        /// </summary>
+        public static CultMeshBoundOperationHandle<TRequest, TResponse> BindOperation<TRequest, TResponse>(
+            CultMeshVerse verse,
+            CultMeshOperationHandle<TRequest, TResponse> operation)
+        {
+            if (verse == null) throw new ArgumentNullException(nameof(verse));
+            return BindOperation(verse.Context, operation);
+        }
+
+        /// <summary>
+        /// Binds a typed query surface to a Verse context.
+        /// </summary>
+        public static CultMeshBoundQuerySurface<TParameters, TResult> BindQuery<TParameters, TResult>(
+            CultMeshVerseContext context,
+            CultMeshQuerySurface<TParameters, TResult> query)
+        {
+            return new CultMeshBoundQuerySurface<TParameters, TResult>(context, query);
+        }
+
+        /// <summary>
+        /// Binds a typed query surface to a Verse.
+        /// </summary>
+        public static CultMeshBoundQuerySurface<TParameters, TResult> BindQuery<TParameters, TResult>(
+            CultMeshVerse verse,
+            CultMeshQuerySurface<TParameters, TResult> query)
+        {
+            if (verse == null) throw new ArgumentNullException(nameof(verse));
+            return BindQuery(verse.Context, query);
+        }
+
+        /// <summary>
+        /// Binds a typed live feed to a Verse context.
+        /// </summary>
+        public static CultMeshBoundLiveFeed<TParameters, TResult> BindLiveFeed<TParameters, TResult>(
+            CultMeshVerseContext context,
+            CultMeshLiveFeed<TParameters, TResult> feed)
+        {
+            return new CultMeshBoundLiveFeed<TParameters, TResult>(context, feed);
+        }
+
+        /// <summary>
+        /// Binds a typed live feed to a Verse.
+        /// </summary>
+        public static CultMeshBoundLiveFeed<TParameters, TResult> BindLiveFeed<TParameters, TResult>(
+            CultMeshVerse verse,
+            CultMeshLiveFeed<TParameters, TResult> feed)
+        {
+            if (verse == null) throw new ArgumentNullException(nameof(verse));
+            return BindLiveFeed(verse.Context, feed);
+        }
+
+        /// <summary>
+        /// Binds a typed document live feed to a Verse context.
+        /// </summary>
+        public static CultMeshDocumentHandle<TDocument> BindDocument<TDocument>(
+            CultMeshVerseContext context,
+            CultMeshLiveFeed<CultMeshDocumentQueryParameters, TDocument> feed)
+            where TDocument : class
+        {
+            return new CultMeshDocumentHandle<TDocument>(BindLiveFeed(context, feed));
+        }
+
+        /// <summary>
+        /// Binds a mutable typed document live feed to a Verse context.
+        /// </summary>
+        public static CultMeshDocumentHandle<TDocument> BindDocument<TDocument>(
+            CultMeshVerseContext context,
+            CultMeshLiveFeed<CultMeshDocumentQueryParameters, TDocument> feed,
+            Func<TDocument, Task> replace)
+            where TDocument : class
+        {
+            if (replace == null) throw new ArgumentNullException(nameof(replace));
+            return new CultMeshDocumentHandle<TDocument>(BindLiveFeed(context, feed), replace);
+        }
+
+        /// <summary>
+        /// Binds a mutable predicted typed document live feed to a Verse context.
+        /// </summary>
+        public static CultMeshDocumentHandle<TDocument> BindDocument<TDocument>(
+            CultMeshVerseContext context,
+            CultMeshLiveFeed<CultMeshDocumentQueryParameters, TDocument> feed,
+            Func<TDocument, Task> replace,
+            Func<TDocument, Task> submitPrediction)
+            where TDocument : class
+        {
+            if (replace == null) throw new ArgumentNullException(nameof(replace));
+            if (submitPrediction == null) throw new ArgumentNullException(nameof(submitPrediction));
+            return new CultMeshDocumentHandle<TDocument>(BindLiveFeed(context, feed), replace, submitPrediction);
+        }
+
+        /// <summary>
+        /// Binds a typed document live feed to a Verse.
+        /// </summary>
+        public static CultMeshDocumentHandle<TDocument> BindDocument<TDocument>(
+            CultMeshVerse verse,
+            CultMeshLiveFeed<CultMeshDocumentQueryParameters, TDocument> feed)
+            where TDocument : class
+        {
+            if (verse == null) throw new ArgumentNullException(nameof(verse));
+            return BindDocument(verse.Context, feed);
+        }
+
+        /// <summary>
+        /// Binds a mutable typed document live feed to a Verse.
+        /// </summary>
+        public static CultMeshDocumentHandle<TDocument> BindDocument<TDocument>(
+            CultMeshVerse verse,
+            CultMeshLiveFeed<CultMeshDocumentQueryParameters, TDocument> feed,
+            Func<TDocument, Task> replace)
+            where TDocument : class
+        {
+            if (verse == null) throw new ArgumentNullException(nameof(verse));
+            return BindDocument(verse.Context, feed, replace);
+        }
+
+        /// <summary>
+        /// Binds a mutable predicted typed document live feed to a Verse.
+        /// </summary>
+        public static CultMeshDocumentHandle<TDocument> BindDocument<TDocument>(
+            CultMeshVerse verse,
+            CultMeshLiveFeed<CultMeshDocumentQueryParameters, TDocument> feed,
+            Func<TDocument, Task> replace,
+            Func<TDocument, Task> submitPrediction)
+            where TDocument : class
+        {
+            if (verse == null) throw new ArgumentNullException(nameof(verse));
+            return BindDocument(verse.Context, feed, replace, submitPrediction);
+        }
+
+        /// <summary>
+        /// Binds a typed state pointer to a Verse context.
+        /// </summary>
+        public static CultMeshBoundStatePointer<TValue> BindStatePointer<TValue>(
+            CultMeshVerseContext context,
+            CultMeshStatePointer<TValue> pointer)
+        {
+            return new CultMeshBoundStatePointer<TValue>(context, pointer);
+        }
+
+        /// <summary>
+        /// Binds a typed state pointer to a Verse.
+        /// </summary>
+        public static CultMeshBoundStatePointer<TValue> BindStatePointer<TValue>(
+            CultMeshVerse verse,
+            CultMeshStatePointer<TValue> pointer)
+        {
+            if (verse == null) throw new ArgumentNullException(nameof(verse));
+            return BindStatePointer(verse.Context, pointer);
+        }
+
+        /// <summary>
+        /// Binds a mutable typed state pointer to a Verse context.
+        /// </summary>
+        public static CultMeshBoundMutableStatePointer<TValue> BindMutableStatePointer<TValue>(
+            CultMeshVerseContext context,
+            CultMeshMutableStatePointer<TValue> pointer)
+        {
+            return new CultMeshBoundMutableStatePointer<TValue>(context, pointer);
+        }
+
+        /// <summary>
+        /// Binds a mutable typed state pointer to a Verse.
+        /// </summary>
+        public static CultMeshBoundMutableStatePointer<TValue> BindMutableStatePointer<TValue>(
+            CultMeshVerse verse,
+            CultMeshMutableStatePointer<TValue> pointer)
+        {
+            if (verse == null) throw new ArgumentNullException(nameof(verse));
+            return BindMutableStatePointer(verse.Context, pointer);
+        }
+
+        /// <summary>
+        /// Creates a typed state pointer to Verse state.
+        /// </summary>
+        public static CultMeshStatePointer<TValue> StatePointer<TValue>(
+            string pointerId,
+            Func<Task<TValue?>> resolve,
+            Func<R3.Observable<TValue>> watch,
+            CultMeshRouteHint? routeHint = null,
+            IEnumerable<CultMeshProjectionSource>? sources = null)
+        {
+            return new CultMeshStatePointer<TValue>(
+                pointerId,
+                resolve,
+                watch,
+                routeHint,
+                sources);
+        }
+
+        /// <summary>
+        /// Creates a typed state pointer to Verse state that can resolve through a query context.
+        /// </summary>
+        public static CultMeshStatePointer<TValue> StatePointer<TValue>(
+            string pointerId,
+            Func<CultMeshQueryContext, Task<TValue?>> resolve,
+            Func<CultMeshQueryContext, R3.Observable<TValue>> watch,
+            CultMeshRouteHint? routeHint = null,
+            IEnumerable<CultMeshProjectionSource>? sources = null)
+        {
+            return new CultMeshStatePointer<TValue>(
+                pointerId,
+                resolve,
+                watch,
+                routeHint,
+                sources);
+        }
+
+        /// <summary>
+        /// Creates a mutable typed state pointer to Verse state.
+        /// </summary>
+        public static CultMeshMutableStatePointer<TValue> MutableStatePointer<TValue>(
+            string pointerId,
+            Func<Task<TValue?>> resolve,
+            Func<R3.Observable<TValue>> watch,
+            Func<TValue, Task> replace,
+            CultMeshRouteHint? routeHint = null,
+            IEnumerable<CultMeshProjectionSource>? sources = null)
+        {
+            return new CultMeshMutableStatePointer<TValue>(
+                pointerId,
+                resolve,
+                watch,
+                replace,
+                routeHint,
+                sources);
+        }
+
+        /// <summary>
+        /// Creates a mutable typed state pointer to Verse state that can operate through a query context.
+        /// </summary>
+        public static CultMeshMutableStatePointer<TValue> MutableStatePointer<TValue>(
+            string pointerId,
+            Func<CultMeshQueryContext, Task<TValue?>> resolve,
+            Func<CultMeshQueryContext, R3.Observable<TValue>> watch,
+            Func<CultMeshQueryContext, TValue, Task> replace,
+            CultMeshRouteHint? routeHint = null,
+            IEnumerable<CultMeshProjectionSource>? sources = null)
+        {
+            return new CultMeshMutableStatePointer<TValue>(
+                pointerId,
+                resolve,
+                watch,
+                replace,
+                routeHint,
+                sources);
+        }
+
+        /// <summary>
+        /// Creates a typed projection source descriptor.
+        /// </summary>
+        public static CultMeshProjectionSource ProjectionSource(
+            string sourceId,
+            string? schemaId = null,
+            string? description = null)
+        {
+            return new CultMeshProjectionSource(sourceId, schemaId, description);
+        }
+
+        /// <summary>
+        /// Creates a named state-reference resolver for portable UI/tool surfaces.
+        /// </summary>
+        public static CultMeshStateRefResolver StateRefResolver(
+            string resolverId,
+            Func<string, string?> resolve,
+            IEnumerable<CultMeshProjectionSource>? sources = null,
+            CultMeshRouteHint? routeHint = null)
+        {
+            if (resolve == null) throw new ArgumentNullException(nameof(resolve));
+            return new CultMeshStateRefResolver(
+                resolverId,
+                (stateRef, _context) => resolve(stateRef),
+                sources,
+                routeHint);
+        }
+
+        /// <summary>
+        /// Creates a named state-reference resolver for portable UI/tool surfaces.
+        /// </summary>
+        public static CultMeshStateRefResolver StateRefResolver(
+            string resolverId,
+            Func<string, CultMeshQueryContext, string?> resolve,
+            IEnumerable<CultMeshProjectionSource>? sources = null,
+            CultMeshRouteHint? routeHint = null)
+        {
+            return new CultMeshStateRefResolver(resolverId, resolve, sources, routeHint);
+        }
+
+        /// <summary>
+        /// Describes a state-reference resolver for catalogs and tools.
+        /// </summary>
+        public static CultMeshStateRefResolverDiagnostic DescribeStateRefResolver(
+            CultMeshStateRefResolver resolver)
+        {
+            if (resolver == null) throw new ArgumentNullException(nameof(resolver));
+            return new CultMeshStateRefResolverDiagnostic(
+                resolver.ResolverId,
+                resolver.RouteHint,
+                resolver.Sources);
+        }
+
+        /// <summary>
+        /// Creates a UI/tool binding descriptor from a component property to a typed state pointer.
+        /// </summary>
+        public static CultMeshStateBindingDescriptor StateBinding<TValue>(
+            string targetProp,
+            CultMeshStatePointer<TValue> pointer)
+        {
+            return CultMeshStateBindingDescriptor.FromPointer(targetProp, pointer);
+        }
+
+        /// <summary>
+        /// Creates a UI/tool binding descriptor from a component property to a mutable typed state pointer.
+        /// </summary>
+        public static CultMeshStateBindingDescriptor StateBinding<TValue>(
+            string targetProp,
+            CultMeshMutableStatePointer<TValue> pointer)
+        {
+            if (pointer == null) throw new ArgumentNullException(nameof(pointer));
+            return CultMeshStateBindingDescriptor.FromPointer(targetProp, pointer.AsStatePointer());
+        }
+
+        /// <summary>
+        /// Creates a UI/tool binding descriptor from a component property to a state pointer id.
+        /// </summary>
+        public static CultMeshStateBindingDescriptor StateBinding(
+            string targetProp,
+            string pointerId,
+            string? sourceId = null,
+            string? schemaId = null,
+            CultMeshRouteHint? routeHint = null,
+            string? bindingName = null,
+            string? documentId = null,
+            string? fieldPath = null,
+            string? valueKind = null,
+            string? accessMode = null,
+            string? authority = null,
+            string? writeCommand = null)
+        {
+            return new CultMeshStateBindingDescriptor(
+                targetProp, pointerId, sourceId, schemaId, routeHint,
+                bindingName, documentId, fieldPath, valueKind, accessMode, authority, writeCommand);
+        }
+
+        /// <summary>
+        /// Creates transport-friendly fields from a state binding descriptor.
+        /// </summary>
+        public static CultMeshStateBindingRecord StateBindingRecord(CultMeshStateBindingDescriptor? binding)
+        {
+            return CultMeshStateBindingRecord.FromBinding(binding);
+        }
+
+        /// <summary>
+        /// Creates transport-friendly state binding fields directly.
+        /// </summary>
+        public static CultMeshStateBindingRecord StateBindingRecord(
+            string? targetProp,
+            string? pointerId,
+            string? sourceId = null,
+            string? schemaId = null,
+            string? routeKind = null,
+            string? routeDescription = null,
+            string? bindingName = null,
+            string? documentId = null,
+            string? fieldPath = null,
+            string? valueKind = null,
+            string? accessMode = null,
+            string? authority = null,
+            string? writeCommand = null)
+        {
+            return new CultMeshStateBindingRecord(
+                targetProp,
+                pointerId,
+                sourceId,
+                schemaId,
+                routeKind,
+                routeDescription,
+                bindingName,
+                documentId,
+                fieldPath,
+                valueKind,
+                accessMode,
+                authority,
+                writeCommand);
+        }
+
+        /// <summary>
+        /// Creates a UI/tool command binding descriptor from a typed operation handle.
+        /// </summary>
+        public static CultMeshOperationBindingDescriptor OperationBinding<TRequest, TResponse>(
+            CultMeshOperationHandle<TRequest, TResponse> operation,
+            string? label = null,
+            string? schemaId = null,
+            CultMeshRouteHint? routeHint = null)
+        {
+            return CultMeshOperationBindingDescriptor.FromOperation(operation, label, schemaId, routeHint);
+        }
+
+        /// <summary>
+        /// Creates a UI/tool command binding descriptor from a typed operation id.
+        /// </summary>
+        public static CultMeshOperationBindingDescriptor OperationBinding(
+            string operationId,
+            string? label = null,
+            string? schemaId = null,
+            CultMeshRouteHint? routeHint = null)
+        {
+            return new CultMeshOperationBindingDescriptor(operationId, label, schemaId, routeHint);
+        }
+
+        /// <summary>
+        /// Creates transport-friendly fields from an operation binding descriptor.
+        /// </summary>
+        public static CultMeshOperationBindingRecord OperationBindingRecord(
+            CultMeshOperationBindingDescriptor? binding)
+        {
+            return CultMeshOperationBindingRecord.FromBinding(binding);
+        }
+
+        /// <summary>
+        /// Creates transport-friendly operation binding fields directly.
+        /// </summary>
+        public static CultMeshOperationBindingRecord OperationBindingRecord(
+            string? operationId,
+            string? label = null,
+            string? schemaId = null,
+            string? routeKind = null,
+            string? routeDescription = null)
+        {
+            return new CultMeshOperationBindingRecord(
+                operationId,
+                label,
+                schemaId,
+                routeKind,
+                routeDescription);
+        }
+
+        /// <summary>
+        /// Creates a concrete invocation descriptor from an advertised operation binding.
+        /// </summary>
+        public static CultMeshOperationInvocationDescriptor OperationInvocation(
+            CultMeshOperationBindingDescriptor binding,
+            string? idempotencyKey = null)
+        {
+            return CultMeshOperationInvocationDescriptor.FromBinding(binding, idempotencyKey);
+        }
+
+        /// <summary>
+        /// Creates a concrete invocation descriptor from a typed operation handle.
+        /// </summary>
+        public static CultMeshOperationInvocationDescriptor OperationInvocation<TRequest, TResponse>(
+            CultMeshOperationHandle<TRequest, TResponse> operation,
+            string? schemaId = null,
+            CultMeshRouteHint? routeHint = null,
+            string? idempotencyKey = null)
+        {
+            return CultMeshOperationInvocationDescriptor.FromOperation(
+                operation,
+                schemaId,
+                routeHint,
+                idempotencyKey);
+        }
+
+        /// <summary>
+        /// Creates a concrete invocation descriptor from a typed operation id.
+        /// </summary>
+        public static CultMeshOperationInvocationDescriptor OperationInvocation(
+            string operationId,
+            string? schemaId = null,
+            CultMeshRouteHint? routeHint = null,
+            string? idempotencyKey = null)
+        {
+            return new CultMeshOperationInvocationDescriptor(operationId, schemaId, routeHint, idempotencyKey);
+        }
+
+        /// <summary>
+        /// Creates transport-friendly fields from a route hint.
+        /// </summary>
+        public static CultMeshRouteRecord RouteRecord(CultMeshRouteHint? routeHint)
+        {
+            return CultMeshRouteRecord.FromRoute(routeHint);
+        }
+
+        /// <summary>
+        /// Creates transport-friendly route fields directly.
+        /// </summary>
+        public static CultMeshRouteRecord RouteRecord(string? kind, string? description = null)
+        {
+            return new CultMeshRouteRecord(kind, description);
+        }
+
+        /// <summary>
+        /// Creates transport-friendly fields from a typed operation invocation.
+        /// </summary>
+        public static CultMeshOperationInvocationRecord OperationInvocationRecord(
+            CultMeshOperationInvocationDescriptor? invocation,
+            string? fallbackOperationId = null,
+            string? fallbackSchemaId = null,
+            CultMeshRouteHint? fallbackRouteHint = null,
+            string? fallbackIdempotencyKey = null)
+        {
+            return CultMeshOperationInvocationRecord.FromInvocation(
+                invocation,
+                fallbackOperationId,
+                fallbackSchemaId,
+                fallbackRouteHint,
+                fallbackIdempotencyKey);
+        }
+
+        /// <summary>
+        /// Creates transport-friendly operation invocation fields directly.
+        /// </summary>
+        public static CultMeshOperationInvocationRecord OperationInvocationRecord(
+            string? operationId,
+            string? schemaId = null,
+            string? routeKind = null,
+            string? routeDescription = null,
+            string? idempotencyKey = null)
+        {
+            return new CultMeshOperationInvocationRecord(
+                operationId,
+                schemaId,
+                routeKind,
+                routeDescription,
+                idempotencyKey);
+        }
+
+        /// <summary>
+        /// Creates an empty shared operation payload.
+        /// </summary>
+        public static CultMeshOperationPayload OperationPayload()
+        {
+            return CultMeshOperationPayload.Empty;
+        }
+
+        /// <summary>
+        /// Creates a shared operation payload from string-compatible fields.
+        /// </summary>
+        public static CultMeshOperationPayload OperationPayload(
+            IEnumerable<KeyValuePair<string, string>>? fields)
+        {
+            return CultMeshOperationPayload.FromStrings(fields);
+        }
+
+        /// <summary>
+        /// Creates a shared operation payload from key/value pairs.
+        /// </summary>
+        public static CultMeshOperationPayload OperationPayload(params (string Key, string Value)[] fields)
+        {
+            var pairs = fields?.Select(field => new KeyValuePair<string, string>(field.Key, field.Value));
+            return CultMeshOperationPayload.FromStrings(pairs);
+        }
+
+        /// <summary>
+        /// Creates a reusable projection recipe over typed source state.
+        /// </summary>
+        public static CultMeshProjectionRecipe<TParameters, TResult> ProjectionRecipe<TParameters, TResult>(
+            string projectionId,
+            IEnumerable<CultMeshProjectionSource> sources,
+            Func<TParameters, CultMeshQueryContext, Task<TResult>> project,
+            CultMeshRouteHint? routeHint = null,
+            Func<TParameters, CultMeshQueryContext, R3.Observable<TResult>>? watch = null)
+        {
+            return new CultMeshProjectionRecipe<TParameters, TResult>(
+                projectionId,
+                sources,
+                project,
+                routeHint,
+                watch);
+        }
+
+        /// <summary>
+        /// Creates a typed live feed surface for coherent client snapshots.
+        /// </summary>
+        public static CultMeshLiveFeed<TParameters, TResult> LiveFeed<TParameters, TResult>(
+            string feedId,
+            Func<TParameters, CultMeshQueryContext, Task<TResult>> snapshot,
+            Func<TParameters, CultMeshQueryContext, R3.Observable<TResult>>? watch = null,
+            IEnumerable<CultMeshProjectionSource>? sources = null,
+            CultMeshRouteHint? routeHint = null)
+        {
+            return new CultMeshLiveFeed<TParameters, TResult>(
+                feedId,
+                snapshot,
+                watch,
+                sources,
+                routeHint);
+        }
+
+        /// <summary>
+        /// Creates a typed document handle from snapshot/watch delegates and binds it to a Verse context.
+        /// </summary>
+        public static CultMeshDocumentHandle<TDocument> Document<TDocument>(
+            string documentId,
+            CultMeshVerseContext context,
+            Func<CultMeshQueryContext, Task<TDocument>> latest,
+            Func<CultMeshQueryContext, R3.Observable<TDocument>> watch,
+            IEnumerable<CultMeshProjectionSource>? sources = null,
+            CultMeshRouteHint? routeHint = null)
+            where TDocument : class
+        {
+            if (latest == null) throw new ArgumentNullException(nameof(latest));
+            if (watch == null) throw new ArgumentNullException(nameof(watch));
+
+            var feed = LiveFeed<CultMeshDocumentQueryParameters, TDocument>(
+                documentId,
+                (_parameters, queryContext) => latest(queryContext),
+                (_parameters, queryContext) => watch(queryContext),
+                sources,
+                routeHint);
+            return BindDocument(context, feed);
+        }
+
+        /// <summary>
+        /// Creates a mutable typed document handle from snapshot/watch/replace delegates and binds it to a Verse context.
+        /// </summary>
+        public static CultMeshDocumentHandle<TDocument> Document<TDocument>(
+            string documentId,
+            CultMeshVerseContext context,
+            Func<CultMeshQueryContext, Task<TDocument>> latest,
+            Func<CultMeshQueryContext, R3.Observable<TDocument>> watch,
+            Func<TDocument, Task> replace,
+            IEnumerable<CultMeshProjectionSource>? sources = null,
+            CultMeshRouteHint? routeHint = null)
+            where TDocument : class
+        {
+            if (replace == null) throw new ArgumentNullException(nameof(replace));
+
+            var feed = LiveFeed<CultMeshDocumentQueryParameters, TDocument>(
+                documentId,
+                (_parameters, queryContext) => latest(queryContext),
+                (_parameters, queryContext) => watch(queryContext),
+                sources,
+                routeHint);
+            return BindDocument(context, feed, replace);
+        }
+
+        /// <summary>
+        /// Creates a mutable predicted typed document handle from snapshot/watch/replace/prediction delegates and binds it to a Verse context.
+        /// </summary>
+        public static CultMeshDocumentHandle<TDocument> Document<TDocument>(
+            string documentId,
+            CultMeshVerseContext context,
+            Func<CultMeshQueryContext, Task<TDocument>> latest,
+            Func<CultMeshQueryContext, R3.Observable<TDocument>> watch,
+            Func<TDocument, Task> replace,
+            Func<TDocument, Task> submitPrediction,
+            IEnumerable<CultMeshProjectionSource>? sources = null,
+            CultMeshRouteHint? routeHint = null)
+            where TDocument : class
+        {
+            if (replace == null) throw new ArgumentNullException(nameof(replace));
+            if (submitPrediction == null) throw new ArgumentNullException(nameof(submitPrediction));
+
+            var feed = LiveFeed<CultMeshDocumentQueryParameters, TDocument>(
+                documentId,
+                (_parameters, queryContext) => latest(queryContext),
+                (_parameters, queryContext) => watch(queryContext),
+                sources,
+                routeHint);
+            return BindDocument(context, feed, replace, submitPrediction);
+        }
+
+        /// <summary>
+        /// Creates a typed document handle from snapshot/watch delegates and binds it to a Verse.
+        /// </summary>
+        public static CultMeshDocumentHandle<TDocument> Document<TDocument>(
+            string documentId,
+            CultMeshVerse verse,
+            Func<CultMeshQueryContext, Task<TDocument>> latest,
+            Func<CultMeshQueryContext, R3.Observable<TDocument>> watch,
+            IEnumerable<CultMeshProjectionSource>? sources = null,
+            CultMeshRouteHint? routeHint = null)
+            where TDocument : class
+        {
+            if (verse == null) throw new ArgumentNullException(nameof(verse));
+            return Document(documentId, verse.Context, latest, watch, sources, routeHint);
+        }
+
+        /// <summary>
+        /// Creates a mutable typed document handle from snapshot/watch/replace delegates and binds it to a Verse.
+        /// </summary>
+        public static CultMeshDocumentHandle<TDocument> Document<TDocument>(
+            string documentId,
+            CultMeshVerse verse,
+            Func<CultMeshQueryContext, Task<TDocument>> latest,
+            Func<CultMeshQueryContext, R3.Observable<TDocument>> watch,
+            Func<TDocument, Task> replace,
+            IEnumerable<CultMeshProjectionSource>? sources = null,
+            CultMeshRouteHint? routeHint = null)
+            where TDocument : class
+        {
+            if (verse == null) throw new ArgumentNullException(nameof(verse));
+            return Document(documentId, verse.Context, latest, watch, replace, sources, routeHint);
+        }
+
+        /// <summary>
+        /// Creates a mutable predicted typed document handle from snapshot/watch/replace/prediction delegates and binds it to a Verse.
+        /// </summary>
+        public static CultMeshDocumentHandle<TDocument> Document<TDocument>(
+            string documentId,
+            CultMeshVerse verse,
+            Func<CultMeshQueryContext, Task<TDocument>> latest,
+            Func<CultMeshQueryContext, R3.Observable<TDocument>> watch,
+            Func<TDocument, Task> replace,
+            Func<TDocument, Task> submitPrediction,
+            IEnumerable<CultMeshProjectionSource>? sources = null,
+            CultMeshRouteHint? routeHint = null)
+            where TDocument : class
+        {
+            if (verse == null) throw new ArgumentNullException(nameof(verse));
+            return Document(documentId, verse.Context, latest, watch, replace, submitPrediction, sources, routeHint);
+        }
+
+        /// <summary>
+        /// Creates a typed document handle directly over one CultCache record.
+        /// </summary>
+        public static CultMeshDocumentHandle<TDocument> Document<TDocument>(
+            CultCache cache,
+            CultRecordKey key,
+            CultMeshVerseContext context,
+            string? documentId = null,
+            IEnumerable<CultMeshProjectionSource>? sources = null,
+            CultMeshRouteHint? routeHint = null)
+            where TDocument : class
+        {
+            if (cache == null) throw new ArgumentNullException(nameof(cache));
+            if (context == null) throw new ArgumentNullException(nameof(context));
+
+            var descriptor = cache.Registry.GetRequired<TDocument>();
+            var sourceList = sources?.ToArray()
+                ?? new[] { ProjectionSource(key.Value, descriptor.SchemaId, "CultCache record") };
+            var route = routeHint ?? new CultMeshRouteHint(CultMeshLocalityKind.InProcess, "CultCache document");
+            var feed = LiveFeed<CultMeshDocumentQueryParameters, TDocument>(
+                ResolveDocumentId(documentId, key),
+                (_parameters, _context) => Task.FromResult(ReadRequired<TDocument>(cache, key)),
+                (_parameters, _context) => cache.WatchRecord<TDocument>(key)
+                    .Where(change => change.Document != null)
+                    .Select(change => change.Document!),
+                sourceList,
+                route);
+            return new CultMeshDocumentHandle<TDocument>(
+                BindLiveFeed(context, feed),
+                async value => await cache.UpsertAsync(value, new CultRecordHandle<TDocument>(key)).ConfigureAwait(false),
+                () => cache.WatchRecord<TDocument>(key),
+                () =>
+                {
+                    var (document, sequence) = cache.GetWithSequence(key);
+                    return (RequireDocument<TDocument>(document, key), sequence);
+                });
+        }
+
+        /// <summary>
+        /// Creates a typed document handle directly over one CultCache record.
+        /// </summary>
+        public static CultMeshDocumentHandle<TDocument> Document<TDocument>(
+            CultCache cache,
+            CultRecordKey key,
+            CultMeshVerse verse,
+            string? documentId = null,
+            IEnumerable<CultMeshProjectionSource>? sources = null,
+            CultMeshRouteHint? routeHint = null)
+            where TDocument : class
+        {
+            if (verse == null) throw new ArgumentNullException(nameof(verse));
+            return Document<TDocument>(cache, key, verse.Context, documentId, sources, routeHint);
+        }
+
+        /// <summary>
+        /// Creates a typed document handle directly over one CultCache record with a local Verse context.
+        /// </summary>
+        public static CultMeshDocumentHandle<TDocument> Document<TDocument>(
+            CultCache cache,
+            CultRecordKey key,
+            string? documentId = null,
+            IEnumerable<CultMeshProjectionSource>? sources = null,
+            CultMeshRouteHint? routeHint = null)
+            where TDocument : class
+        {
+            return Document<TDocument>(
+                cache,
+                key,
+                Verse("local", "local", routeHint).Context,
+                documentId,
+                sources,
+                routeHint);
+        }
+
+        /// <summary>
+        /// Creates a read-only typed document handle over one CultCache backing-store publication.
+        /// </summary>
+        public static CultMeshDocumentHandle<TDocument> DocumentFromStore<TDocument>(
+            CacheBackingStore store,
+            CultRecordKey key,
+            CultMeshVerseContext context,
+            CultMeshStoreDocumentOptions? options = null)
+            where TDocument : class
+        {
+            if (store == null) throw new ArgumentNullException(nameof(store));
+            if (context == null) throw new ArgumentNullException(nameof(context));
+
+            var resolvedOptions = options ?? new CultMeshStoreDocumentOptions();
+            var cache = new CultCache(resolvedOptions.Registry ?? CultDocumentRegistry.Shared);
+            cache.AddBackingStore(store);
+
+            var descriptor = cache.Registry.GetRequired<TDocument>();
+            var documentId = ResolveDocumentId(resolvedOptions.DocumentId, key);
+            var route = resolvedOptions.RouteHint ?? new CultMeshRouteHint(CultMeshLocalityKind.InProcess, "CultCache backing store");
+            var sources = new[]
+            {
+                ProjectionSource(
+                    string.IsNullOrWhiteSpace(resolvedOptions.SourceId) ? key.Value : resolvedOptions.SourceId!,
+                    descriptor.SchemaId,
+                    "CultCache backing store")
+            };
+            Func<CultMeshQueryContext, Task<TDocument>> latest = async _ =>
+            {
+                await cache.PullAllBackingStoresAsync().ConfigureAwait(false);
+                return ReadRequired<TDocument>(cache, key);
+            };
+            var watch = PollingQueryWatcher<CultMeshDocumentQueryParameters, TDocument>(
+                async (_parameters, queryContext) => await latest(queryContext).ConfigureAwait(false),
+                new CultMeshPollingWatchOptions<TDocument>(resolvedOptions.PollInterval));
+
+            return Document<TDocument>(
+                documentId,
+                context,
+                latest,
+                queryContext => watch(CultMeshDocumentQueryParameters.Empty, queryContext),
+                sources,
+                route);
+        }
+
+        /// <summary>
+        /// Creates a read-only typed document handle over one CultCache backing-store publication.
+        /// </summary>
+        public static CultMeshDocumentHandle<TDocument> DocumentFromStore<TDocument>(
+            CacheBackingStore store,
+            CultRecordKey key,
+            CultMeshVerse verse,
+            CultMeshStoreDocumentOptions? options = null)
+            where TDocument : class
+        {
+            if (verse == null) throw new ArgumentNullException(nameof(verse));
+            return DocumentFromStore<TDocument>(store, key, verse.Context, options);
+        }
+
+        /// <summary>
+        /// Creates a read-only typed document handle over one single-file MessagePack CultCache publication.
+        /// </summary>
+        public static CultMeshDocumentHandle<TDocument> DocumentFromSingleFile<TDocument>(
+            string path,
+            CultRecordKey key,
+            CultMeshVerseContext context,
+            CultMeshStoreDocumentOptions? options = null)
+            where TDocument : class
+        {
+            if (string.IsNullOrWhiteSpace(path)) throw new ArgumentException("Value must be non-empty.", nameof(path));
+            var resolvedOptions = options ?? new CultMeshStoreDocumentOptions();
+            var fileOptions = new CultMeshStoreDocumentOptions
+            {
+                DocumentId = resolvedOptions.DocumentId,
+                SourceId = resolvedOptions.SourceId,
+                RouteHint = resolvedOptions.RouteHint ?? new CultMeshRouteHint(CultMeshLocalityKind.SharedMemory, path),
+                PollInterval = resolvedOptions.PollInterval,
+                Registry = resolvedOptions.Registry
+            };
+            return DocumentFromStore<TDocument>(
+                new SingleFileMessagePackBackingStore(path),
+                key,
+                context,
+                fileOptions);
+        }
+
+        /// <summary>
+        /// Creates a read-only typed document handle over one single-file MessagePack CultCache publication.
+        /// </summary>
+        public static CultMeshDocumentHandle<TDocument> DocumentFromSingleFile<TDocument>(
+            string path,
+            CultRecordKey key,
+            CultMeshVerse verse,
+            CultMeshStoreDocumentOptions? options = null)
+            where TDocument : class
+        {
+            if (verse == null) throw new ArgumentNullException(nameof(verse));
+            return DocumentFromSingleFile<TDocument>(path, key, verse.Context, options);
+        }
+
+        /// <summary>
+        /// Creates a typed document handle from a configured publication source.
+        /// </summary>
+        public static CultMeshDocumentHandle<TDocument> DocumentFromPublication<TDocument>(
+            CultMeshDocumentPublicationSource source,
+            CultRecordKey key,
+            CultMeshVerseContext context,
+            CultMeshStoreDocumentOptions? storeOptions = null,
+            CultMeshPeerSnapshotDocumentOptions? peerOptions = null)
+            where TDocument : class
+        {
+            if (source == null) throw new ArgumentNullException(nameof(source));
+            if (context == null) throw new ArgumentNullException(nameof(context));
+
+            switch (source)
+            {
+                case CultMeshDocumentPublicationSource.StoreSource store:
+                    return DocumentFromStore<TDocument>(store.BackingStore, key, context, storeOptions);
+                case CultMeshDocumentPublicationSource.SingleFileSource file:
+                    return DocumentFromSingleFile<TDocument>(file.Path, key, context, storeOptions);
+                case CultMeshDocumentPublicationSource.PeerSnapshotSource snapshot:
+                    return DocumentFromPeerSnapshot<TDocument>(snapshot.Snapshot, key.Value, context, peerOptions);
+                case CultMeshDocumentPublicationSource.PeerSnapshotEndpointSource endpoint:
+                    return DocumentFromPeerSnapshot<TDocument>(endpoint.Endpoint, key.Value, context, peerOptions);
+                case CultMeshDocumentPublicationSource.PeerSnapshotClientSource client:
+                    return DocumentFromPeerSnapshot<TDocument>(client.CreateClient, client.Endpoint, key.Value, context, peerOptions);
+                default:
+                    throw new NotSupportedException(
+                        $"Unsupported CultMesh document publication source '{source.GetType().FullName}'.");
+            }
+        }
+
+        /// <summary>
+        /// Creates a typed document handle from a configured publication source.
+        /// </summary>
+        public static CultMeshDocumentHandle<TDocument> DocumentFromPublication<TDocument>(
+            CultMeshDocumentPublicationSource source,
+            CultRecordKey key,
+            CultMeshVerse verse,
+            CultMeshStoreDocumentOptions? storeOptions = null,
+            CultMeshPeerSnapshotDocumentOptions? peerOptions = null)
+            where TDocument : class
+        {
+            if (verse == null) throw new ArgumentNullException(nameof(verse));
+            return DocumentFromPublication<TDocument>(source, key, verse.Context, storeOptions, peerOptions);
+        }
+
+        /// <summary>
+        /// Describes one typed document to bind from a CultMesh publication source.
+        /// </summary>
+        public static CultMeshPublicationDocumentBinding<TDocument> PublicationDocument<TDocument>(
+            CultRecordKey key,
+            string? documentId = null,
+            string? sourceId = null,
+            CultMeshDocumentPublicationSource? source = null)
+            where TDocument : class
+        {
+            return new CultMeshPublicationDocumentBinding<TDocument>(key, documentId, sourceId, source);
+        }
+
+        /// <summary>
+        /// Describes one typed document to bind from a CultMesh publication source.
+        /// </summary>
+        public static CultMeshPublicationDocumentBinding<TDocument> PublicationDocument<TDocument>(
+            string recordKey,
+            string? documentId = null,
+            string? sourceId = null,
+            CultMeshDocumentPublicationSource? source = null)
+            where TDocument : class
+        {
+            if (string.IsNullOrWhiteSpace(recordKey)) throw new ArgumentException("Value must be non-empty.", nameof(recordKey));
+            return PublicationDocument<TDocument>(new CultRecordKey(recordKey), documentId, sourceId, source);
+        }
+
+        /// <summary>
+        /// Creates a schema-aware document catalog from one or more configured publication bindings.
+        /// </summary>
+        public static CultMeshDocumentCatalog DocumentsFromPublication(
+            CultMeshDocumentPublicationSource source,
+            IEnumerable<ICultMeshPublicationDocumentBinding> bindings,
+            CultMeshVerseContext context,
+            CultMeshStoreDocumentOptions? storeOptions = null,
+            CultMeshPeerSnapshotDocumentOptions? peerOptions = null)
+        {
+            if (source == null) throw new ArgumentNullException(nameof(source));
+            if (bindings == null) throw new ArgumentNullException(nameof(bindings));
+            if (context == null) throw new ArgumentNullException(nameof(context));
+
+            return Documents(bindings.Select(binding =>
+            {
+                if (binding == null) throw new ArgumentException("CultMesh publication bindings cannot contain null.", nameof(bindings));
+                return binding.Bind(source, context, storeOptions, peerOptions);
+            }).ToArray());
+        }
+
+        /// <summary>
+        /// Creates a schema-aware document catalog from one or more configured publication bindings.
+        /// </summary>
+        public static CultMeshDocumentCatalog DocumentsFromPublication(
+            CultMeshDocumentPublicationSource source,
+            IEnumerable<ICultMeshPublicationDocumentBinding> bindings,
+            CultMeshVerse verse,
+            CultMeshStoreDocumentOptions? storeOptions = null,
+            CultMeshPeerSnapshotDocumentOptions? peerOptions = null)
+        {
+            if (verse == null) throw new ArgumentNullException(nameof(verse));
+            return DocumentsFromPublication(source, bindings, verse.Context, storeOptions, peerOptions);
+        }
+
+        /// <summary>
+        /// Reads configured publication documents, hydrates them into a local node, and returns local handles as a catalog.
+        /// </summary>
+        public static async Task<CultMeshDocumentCatalog> SyncDocumentsFromPublicationAsync(
+            CultMeshNode node,
+            CultMeshDocumentPublicationSource source,
+            IEnumerable<ICultMeshPublicationDocumentBinding> bindings,
+            CultMeshVerseContext context,
+            CultMeshStoreDocumentOptions? storeOptions = null,
+            CultMeshPeerSnapshotDocumentOptions? peerOptions = null,
+            bool flush = false)
+        {
+            if (node == null) throw new ArgumentNullException(nameof(node));
+            if (source == null) throw new ArgumentNullException(nameof(source));
+            if (bindings == null) throw new ArgumentNullException(nameof(bindings));
+            if (context == null) throw new ArgumentNullException(nameof(context));
+
+            var handles = await Task.WhenAll(bindings.Select(binding =>
+            {
+                if (binding == null) throw new ArgumentException("CultMesh publication bindings cannot contain null.", nameof(bindings));
+                return binding.SyncAsync(node, source, context, storeOptions, peerOptions);
+            })).ConfigureAwait(false);
+
+            if (flush)
+                await node.FlushAsync().ConfigureAwait(false);
+
+            return Documents(handles);
+        }
+
+        /// <summary>
+        /// Reads configured publication documents, hydrates them into a local node, and returns local handles as a catalog.
+        /// </summary>
+        public static Task<CultMeshDocumentCatalog> SyncDocumentsFromPublicationAsync(
+            CultMeshNode node,
+            CultMeshDocumentPublicationSource source,
+            IEnumerable<ICultMeshPublicationDocumentBinding> bindings,
+            CultMeshVerse verse,
+            CultMeshStoreDocumentOptions? storeOptions = null,
+            CultMeshPeerSnapshotDocumentOptions? peerOptions = null,
+            bool flush = false)
+        {
+            if (verse == null) throw new ArgumentNullException(nameof(verse));
+            return SyncDocumentsFromPublicationAsync(
+                node,
+                source,
+                bindings,
+                verse.Context,
+                storeOptions,
+                peerOptions,
+                flush);
+        }
+
+        /// <summary>
+        /// Reads one typed document from a configured publication source and hydrates it into a local node.
+        /// </summary>
+        public static async Task<TDocument> SyncDocumentFromPublicationAsync<TDocument>(
+            CultMeshNode node,
+            CultMeshDocumentPublicationSource source,
+            CultRecordKey key,
+            CultMeshVerseContext context,
+            CultMeshStoreDocumentOptions? storeOptions = null,
+            CultMeshPeerSnapshotDocumentOptions? peerOptions = null,
+            bool flush = false)
+            where TDocument : class
+        {
+            if (node == null) throw new ArgumentNullException(nameof(node));
+            if (source == null) throw new ArgumentNullException(nameof(source));
+            if (context == null) throw new ArgumentNullException(nameof(context));
+
+            var document = await DocumentFromPublication<TDocument>(
+                    source,
+                    key,
+                    context,
+                    storeOptions,
+                    peerOptions)
+                .LatestAsync()
+                .ConfigureAwait(false);
+
+            await Document<TDocument>(node, key, context)
+                .ReplaceAsync(document)
+                .ConfigureAwait(false);
+
+            if (flush)
+                await node.FlushAsync().ConfigureAwait(false);
+
+            return document;
+        }
+
+        /// <summary>
+        /// Reads one typed document from a configured publication source and hydrates it into a local node.
+        /// </summary>
+        public static Task<TDocument> SyncDocumentFromPublicationAsync<TDocument>(
+            CultMeshNode node,
+            CultMeshDocumentPublicationSource source,
+            CultRecordKey key,
+            CultMeshVerse verse,
+            CultMeshStoreDocumentOptions? storeOptions = null,
+            CultMeshPeerSnapshotDocumentOptions? peerOptions = null,
+            bool flush = false)
+            where TDocument : class
+        {
+            if (verse == null) throw new ArgumentNullException(nameof(verse));
+            return SyncDocumentFromPublicationAsync<TDocument>(
+                node,
+                source,
+                key,
+                verse.Context,
+                storeOptions,
+                peerOptions,
+                flush);
+        }
+
+        /// <summary>
+        /// Reads one typed document from a configured publication source and hydrates it into a local node.
+        /// </summary>
+        public static Task<TDocument> SyncDocumentFromPublicationAsync<TDocument>(
+            CultMeshNode node,
+            CultMeshDocumentPublicationSource source,
+            string recordKey,
+            CultMeshVerse verse,
+            CultMeshStoreDocumentOptions? storeOptions = null,
+            CultMeshPeerSnapshotDocumentOptions? peerOptions = null,
+            bool flush = false)
+            where TDocument : class
+        {
+            if (string.IsNullOrWhiteSpace(recordKey)) throw new ArgumentException("Value must be non-empty.", nameof(recordKey));
+            return SyncDocumentFromPublicationAsync<TDocument>(
+                node,
+                source,
+                new CultRecordKey(recordKey),
+                verse,
+                storeOptions,
+                peerOptions,
+                flush);
+        }
+
+        internal static CultMeshStoreDocumentOptions WithPublicationBindingOptions(
+            CultMeshStoreDocumentOptions? options,
+            CultRecordKey key,
+            string? documentId,
+            string? sourceId)
+        {
+            return new CultMeshStoreDocumentOptions
+            {
+                DocumentId = string.IsNullOrWhiteSpace(documentId) ? key.Value : documentId,
+                SourceId = string.IsNullOrWhiteSpace(sourceId)
+                    ? (string.IsNullOrWhiteSpace(documentId) ? key.Value : documentId)
+                    : sourceId,
+                RouteHint = options?.RouteHint,
+                PollInterval = options?.PollInterval ?? TimeSpan.FromMilliseconds(250),
+                Registry = options?.Registry
+            };
+        }
+
+        internal static CultMeshPeerSnapshotDocumentOptions WithPublicationBindingOptions(
+            CultMeshPeerSnapshotDocumentOptions? options,
+            CultRecordKey key,
+            string? documentId,
+            string? sourceId)
+        {
+            return new CultMeshPeerSnapshotDocumentOptions
+            {
+                DocumentId = string.IsNullOrWhiteSpace(documentId) ? key.Value : documentId,
+                SourceId = string.IsNullOrWhiteSpace(sourceId)
+                    ? (string.IsNullOrWhiteSpace(documentId) ? key.Value : documentId)
+                    : sourceId,
+                RouteHint = options?.RouteHint,
+                ResponseTimeout = options?.ResponseTimeout ?? TimeSpan.FromSeconds(5),
+                ConnectTimeout = options?.ConnectTimeout ?? TimeSpan.FromSeconds(5),
+                PollInterval = options?.PollInterval ?? TimeSpan.FromMilliseconds(250),
+                MessageIdPrefix = options?.MessageIdPrefix,
+                SchemaIds = options?.SchemaIds,
+                ShardId = options?.ShardId,
+                ShardEpoch = options?.ShardEpoch,
+                Security = options?.Security,
+                ConfigureClient = options?.ConfigureClient,
+                RudpRuntimeId = options?.RudpRuntimeId,
+                RudpConnectionId = options?.RudpConnectionId ?? 0x43554c54,
+                RudpConnectPayload = options?.RudpConnectPayload ?? "cultnet-schema-rudp",
+                RudpMaxFragmentBytes = options?.RudpMaxFragmentBytes ?? 1024,
+                RudpResendDelayMs = options?.RudpResendDelayMs ?? 25
+            };
+        }
+
+        /// <summary>
+        /// Creates a typed document handle directly over one distributed CultNet database record.
+        /// </summary>
+        public static CultMeshDocumentHandle<TDocument> Document<TDocument>(
+            CultNetDatabase database,
+            CultRecordKey key,
+            CultMeshVerseContext context,
+            string? documentId = null,
+            IEnumerable<CultMeshProjectionSource>? sources = null,
+            CultMeshRouteHint? routeHint = null)
+            where TDocument : class
+        {
+            if (database == null) throw new ArgumentNullException(nameof(database));
+            if (context == null) throw new ArgumentNullException(nameof(context));
+
+            var descriptor = CultDocumentRegistry.Shared.GetRequired<TDocument>();
+            var sourceList = sources?.ToArray()
+                ?? new[] { ProjectionSource(key.Value, descriptor.SchemaId, "CultNet database record") };
+            var route = routeHint ?? new CultMeshRouteHint(CultMeshLocalityKind.Automatic, "CultNet database document");
+            var feed = LiveFeed<CultMeshDocumentQueryParameters, TDocument>(
+                ResolveDocumentId(documentId, key),
+                (_parameters, _context) => ReadDatabaseDocumentRequiredAsync<TDocument>(database, key),
+                (_parameters, _context) => WatchDatabaseRecordAs<TDocument>(database, key),
+                sourceList,
+                route);
+            Func<TDocument, Task>? replace = database.CanWriteAuthoritatively<TDocument>(key)
+                ? value => PutDatabaseDocumentAsync(database, key, value, predicted: false)
+                : null;
+            Func<TDocument, Task>? submitPrediction = database.CanSubmitPrediction<TDocument>(key)
+                ? value => PutDatabaseDocumentAsync(database, key, value, predicted: true)
+                : null;
+            return new CultMeshDocumentHandle<TDocument>(
+                BindLiveFeed(context, feed),
+                replace,
+                submitPrediction);
+        }
+
+        /// <summary>
+        /// Creates a typed document handle directly over one distributed CultNet database record.
+        /// </summary>
+        public static CultMeshDocumentHandle<TDocument> Document<TDocument>(
+            CultNetDatabase database,
+            CultRecordKey key,
+            CultMeshVerse verse,
+            string? documentId = null,
+            IEnumerable<CultMeshProjectionSource>? sources = null,
+            CultMeshRouteHint? routeHint = null)
+            where TDocument : class
+        {
+            if (verse == null) throw new ArgumentNullException(nameof(verse));
+            return Document<TDocument>(database, key, verse.Context, documentId, sources, routeHint);
+        }
+
+        /// <summary>
+        /// Creates a typed document handle over one remote CultNet snapshot response provider.
+        /// </summary>
+        public static CultMeshDocumentHandle<TDocument> DocumentFromPeerSnapshot<TDocument>(
+            Func<CultMeshQueryContext, Task<CultNetSnapshotResponseRawMessage>> snapshot,
+            string recordKey,
+            CultMeshVerseContext context,
+            CultMeshPeerSnapshotDocumentOptions? options = null)
+            where TDocument : class
+        {
+            if (snapshot == null) throw new ArgumentNullException(nameof(snapshot));
+            if (string.IsNullOrWhiteSpace(recordKey)) throw new ArgumentException("Value must be non-empty.", nameof(recordKey));
+            if (context == null) throw new ArgumentNullException(nameof(context));
+
+            var descriptor = CultDocumentRegistry.Shared.GetRequired<TDocument>();
+            var resolvedOptions = options ?? new CultMeshPeerSnapshotDocumentOptions();
+            var documentId = string.IsNullOrWhiteSpace(resolvedOptions.DocumentId)
+                ? recordKey
+                : resolvedOptions.DocumentId!;
+            var route = resolvedOptions.RouteHint ?? new CultMeshRouteHint(CultMeshLocalityKind.Network, "CultNet snapshot");
+            var sources = new[]
+            {
+                ProjectionSource(
+                    string.IsNullOrWhiteSpace(resolvedOptions.SourceId) ? recordKey : resolvedOptions.SourceId!,
+                    descriptor.SchemaId,
+                    "CultNet snapshot")
+            };
+            Func<CultMeshQueryContext, Task<TDocument>> latest = async queryContext =>
+                ReadDocumentFromSnapshotResponse<TDocument>(
+                    await snapshot(queryContext).ConfigureAwait(false),
+                    descriptor.SchemaId,
+                    recordKey);
+            var watch = PollingQueryWatcher<CultMeshDocumentQueryParameters, TDocument>(
+                async (_parameters, queryContext) => await latest(queryContext).ConfigureAwait(false),
+                new CultMeshPollingWatchOptions<TDocument>(resolvedOptions.PollInterval));
+
+            return Document<TDocument>(
+                documentId,
+                context,
+                latest,
+                queryContext => watch(CultMeshDocumentQueryParameters.Empty, queryContext),
+                sources,
+                route);
+        }
+
+        /// <summary>
+        /// Creates a typed document handle over one remote CultNet snapshot response provider.
+        /// </summary>
+        public static CultMeshDocumentHandle<TDocument> DocumentFromPeerSnapshot<TDocument>(
+            Func<CultMeshQueryContext, Task<CultNetSnapshotResponseRawMessage>> snapshot,
+            string recordKey,
+            CultMeshVerse verse,
+            CultMeshPeerSnapshotDocumentOptions? options = null)
+            where TDocument : class
+        {
+            if (verse == null) throw new ArgumentNullException(nameof(verse));
+            return DocumentFromPeerSnapshot<TDocument>(snapshot, recordKey, verse.Context, options);
+        }
+
+        /// <summary>
+        /// Creates a typed document handle over one remote CultNet schema endpoint.
+        /// </summary>
+        public static CultMeshDocumentHandle<TDocument> DocumentFromPeerSnapshot<TDocument>(
+            string endpoint,
+            string recordKey,
+            CultMeshVerseContext context,
+            CultMeshPeerSnapshotDocumentOptions? options = null)
+            where TDocument : class
+        {
+            if (string.IsNullOrWhiteSpace(endpoint)) throw new ArgumentException("Value must be non-empty.", nameof(endpoint));
+            var resolvedOptions = options ?? new CultMeshPeerSnapshotDocumentOptions();
+            return DocumentFromPeerSnapshot<TDocument>(
+                queryContext => RequestPeerSnapshotAsync<TDocument>(
+                    () => CultNetSchemaClients.CreateForEndpoint(endpoint, resolvedOptions.Security, resolvedOptions.ConfigureClient),
+                    endpoint,
+                    recordKey,
+                    queryContext,
+                    resolvedOptions),
+                recordKey,
+                context,
+                resolvedOptions);
+        }
+
+        /// <summary>
+        /// Creates a typed document handle over one remote CultNet schema endpoint.
+        /// </summary>
+        public static CultMeshDocumentHandle<TDocument> DocumentFromPeerSnapshot<TDocument>(
+            string endpoint,
+            string recordKey,
+            CultMeshVerse verse,
+            CultMeshPeerSnapshotDocumentOptions? options = null)
+            where TDocument : class
+        {
+            if (verse == null) throw new ArgumentNullException(nameof(verse));
+            return DocumentFromPeerSnapshot<TDocument>(endpoint, recordKey, verse.Context, options);
+        }
+
+        /// <summary>
+        /// Creates a typed document handle over one remote CultNet schema client factory.
+        /// </summary>
+        public static CultMeshDocumentHandle<TDocument> DocumentFromPeerSnapshot<TDocument>(
+            Func<ICultNetSchemaClient> createClient,
+            string endpoint,
+            string recordKey,
+            CultMeshVerseContext context,
+            CultMeshPeerSnapshotDocumentOptions? options = null)
+            where TDocument : class
+        {
+            if (createClient == null) throw new ArgumentNullException(nameof(createClient));
+            if (string.IsNullOrWhiteSpace(endpoint)) throw new ArgumentException("Value must be non-empty.", nameof(endpoint));
+            var resolvedOptions = options ?? new CultMeshPeerSnapshotDocumentOptions();
+            return DocumentFromPeerSnapshot<TDocument>(
+                queryContext => RequestPeerSnapshotAsync<TDocument>(
+                    createClient,
+                    endpoint,
+                    recordKey,
+                    queryContext,
+                    resolvedOptions),
+                recordKey,
+                context,
+                resolvedOptions);
+        }
+
+        /// <summary>
+        /// Creates a typed document handle over one remote CultNet schema client factory.
+        /// </summary>
+        public static CultMeshDocumentHandle<TDocument> DocumentFromPeerSnapshot<TDocument>(
+            Func<ICultNetSchemaClient> createClient,
+            string endpoint,
+            string recordKey,
+            CultMeshVerse verse,
+            CultMeshPeerSnapshotDocumentOptions? options = null)
+            where TDocument : class
+        {
+            if (verse == null) throw new ArgumentNullException(nameof(verse));
+            return DocumentFromPeerSnapshot<TDocument>(createClient, endpoint, recordKey, verse.Context, options);
+        }
+
+        /// <summary>
+        /// Creates a typed document handle directly over one CultMesh node database record.
+        /// </summary>
+        public static CultMeshDocumentHandle<TDocument> Document<TDocument>(
+            CultMeshNode node,
+            CultRecordKey key,
+            CultMeshVerseContext context,
+            string? documentId = null,
+            IEnumerable<CultMeshProjectionSource>? sources = null,
+            CultMeshRouteHint? routeHint = null)
+            where TDocument : class
+        {
+            if (node == null) throw new ArgumentNullException(nameof(node));
+            return Document<TDocument>(node.Database, key, context, documentId, sources, routeHint);
+        }
+
+        /// <summary>
+        /// Creates a typed document handle directly over one CultMesh node database record.
+        /// </summary>
+        public static CultMeshDocumentHandle<TDocument> Document<TDocument>(
+            CultMeshNode node,
+            CultRecordKey key,
+            CultMeshVerse verse,
+            string? documentId = null,
+            IEnumerable<CultMeshProjectionSource>? sources = null,
+            CultMeshRouteHint? routeHint = null)
+            where TDocument : class
+        {
+            if (verse == null) throw new ArgumentNullException(nameof(verse));
+            return Document<TDocument>(node, key, verse.Context, documentId, sources, routeHint);
+        }
+
+        /// <summary>
+        /// Creates a schema-aware catalog over typed document handles.
+        /// </summary>
+        public static CultMeshDocumentCatalog Documents(IEnumerable<ICultMeshDocumentHandle> documents)
+        {
+            return new CultMeshDocumentCatalog(documents);
+        }
+
+        /// <summary>
+        /// Creates a schema-aware catalog over typed document handles.
+        /// </summary>
+        public static CultMeshDocumentCatalog Documents(params ICultMeshDocumentHandle[] documents)
+        {
+            return new CultMeshDocumentCatalog(documents);
+        }
+
+        /// <summary>
+        /// Creates a schema-aware catalog over typed collection handles.
+        /// </summary>
+        public static CultMeshCollectionCatalog Collections(IEnumerable<ICultMeshCollectionHandle> collections)
+        {
+            return new CultMeshCollectionCatalog(collections);
+        }
+
+        /// <summary>
+        /// Creates a schema-aware catalog over typed collection handles.
+        /// </summary>
+        public static CultMeshCollectionCatalog Collections(params ICultMeshCollectionHandle[] collections)
+        {
+            return new CultMeshCollectionCatalog(collections);
+        }
+
+        /// <summary>
+        /// Reads two typed document handles and projects them into one caller-defined view.
+        /// </summary>
+        public static async Task<TResult> LatestAsync<TFirst, TSecond, TResult>(
+            CultMeshDocumentHandle<TFirst> first,
+            CultMeshDocumentHandle<TSecond> second,
+            Func<TFirst, TSecond, TResult> project)
+            where TFirst : class
+            where TSecond : class
+        {
+            if (first == null) throw new ArgumentNullException(nameof(first));
+            if (second == null) throw new ArgumentNullException(nameof(second));
+            if (project == null) throw new ArgumentNullException(nameof(project));
+
+            var firstTask = first.LatestAsync();
+            var secondTask = second.LatestAsync();
+            await Task.WhenAll(firstTask, secondTask).ConfigureAwait(false);
+            return project(
+                await firstTask.ConfigureAwait(false),
+                await secondTask.ConfigureAwait(false));
+        }
+
+        /// <summary>
+        /// Reads three typed document handles and projects them into one caller-defined view.
+        /// </summary>
+        public static async Task<TResult> LatestAsync<TFirst, TSecond, TThird, TResult>(
+            CultMeshDocumentHandle<TFirst> first,
+            CultMeshDocumentHandle<TSecond> second,
+            CultMeshDocumentHandle<TThird> third,
+            Func<TFirst, TSecond, TThird, TResult> project)
+            where TFirst : class
+            where TSecond : class
+            where TThird : class
+        {
+            if (first == null) throw new ArgumentNullException(nameof(first));
+            if (second == null) throw new ArgumentNullException(nameof(second));
+            if (third == null) throw new ArgumentNullException(nameof(third));
+            if (project == null) throw new ArgumentNullException(nameof(project));
+
+            var firstTask = first.LatestAsync();
+            var secondTask = second.LatestAsync();
+            var thirdTask = third.LatestAsync();
+            await Task.WhenAll(firstTask, secondTask, thirdTask).ConfigureAwait(false);
+            return project(
+                await firstTask.ConfigureAwait(false),
+                await secondTask.ConfigureAwait(false),
+                await thirdTask.ConfigureAwait(false));
+        }
+
+        /// <summary>
+        /// Creates a typed collection handle over all local CultCache records assignable to the document type.
+        /// </summary>
+        public static CultMeshCollectionHandle<TDocument> Collection<TDocument>(
+            CultCache cache,
+            string? collectionId = null,
+            IEnumerable<CultMeshProjectionSource>? sources = null,
+            CultMeshRouteHint? routeHint = null)
+            where TDocument : class
+        {
+            if (cache == null) throw new ArgumentNullException(nameof(cache));
+
+            var descriptor = cache.Registry.GetRequired<TDocument>();
+            var sourceList = sources?.ToArray()
+                ?? new[] { ProjectionSource(CollectionId(collectionId, descriptor), descriptor.SchemaId, "CultCache collection") };
+            var route = routeHint ?? new CultMeshRouteHint(CultMeshLocalityKind.InProcess, "CultCache collection");
+            return new CultMeshCollectionHandle<TDocument>(
+                CollectionId(collectionId, descriptor),
+                () => Task.FromResult<IReadOnlyList<TDocument>>(cache.GetAll<TDocument>().ToArray()),
+                () => cache.Watch<TDocument>().Select(change => ToCollectionChange(change, descriptor.SchemaId)),
+                sourceList,
+                route);
+        }
+
+        /// <summary>
+        /// Creates a typed collection handle over the local CultCache record with the supplied CultName.
+        /// </summary>
+        public static CultMeshCollectionHandle<TDocument> CollectionByName<TDocument>(
+            CultCache cache,
+            string name,
+            string? collectionId = null,
+            IEnumerable<CultMeshProjectionSource>? sources = null,
+            CultMeshRouteHint? routeHint = null)
+            where TDocument : class
+        {
+            if (cache == null) throw new ArgumentNullException(nameof(cache));
+            if (string.IsNullOrWhiteSpace(name)) throw new ArgumentException("Value must be non-empty.", nameof(name));
+
+            var descriptor = cache.Registry.GetRequired<TDocument>();
+            var resolvedId = collectionId ?? $"{descriptor.SchemaId}:name:{name}";
+            var sourceList = sources?.ToArray()
+                ?? new[] { ProjectionSource(resolvedId, descriptor.SchemaId, "CultCache named collection") };
+            var route = routeHint ?? new CultMeshRouteHint(CultMeshLocalityKind.InProcess, "CultCache named collection");
+            return new CultMeshCollectionHandle<TDocument>(
+                resolvedId,
+                () => Task.FromResult<IReadOnlyList<TDocument>>(Optional(cache.GetByName<TDocument>(name))),
+                () => cache.Watch<TDocument>()
+                    .Where(change => MatchesName(cache, name, change))
+                    .Select(change => ToCollectionChange(change, descriptor.SchemaId)),
+                sourceList,
+                route);
+        }
+
+        /// <summary>
+        /// Creates a typed collection handle over local CultCache records matched by an indexed value.
+        /// </summary>
+        public static CultMeshCollectionHandle<TDocument> CollectionByIndex<TDocument>(
+            CultCache cache,
+            string alias,
+            string value,
+            string? collectionId = null,
+            IEnumerable<CultMeshProjectionSource>? sources = null,
+            CultMeshRouteHint? routeHint = null)
+            where TDocument : class
+        {
+            if (cache == null) throw new ArgumentNullException(nameof(cache));
+            if (string.IsNullOrWhiteSpace(alias)) throw new ArgumentException("Value must be non-empty.", nameof(alias));
+            if (string.IsNullOrWhiteSpace(value)) throw new ArgumentException("Value must be non-empty.", nameof(value));
+
+            var descriptor = cache.Registry.GetRequired<TDocument>();
+            var resolvedId = collectionId ?? $"{descriptor.SchemaId}:index:{alias}:{value}";
+            var sourceList = sources?.ToArray()
+                ?? new[] { ProjectionSource(resolvedId, descriptor.SchemaId, "CultCache indexed collection") };
+            var route = routeHint ?? new CultMeshRouteHint(CultMeshLocalityKind.InProcess, "CultCache indexed collection");
+            return new CultMeshCollectionHandle<TDocument>(
+                resolvedId,
+                () => Task.FromResult<IReadOnlyList<TDocument>>(Optional(cache.GetByIndex<TDocument>(alias, value))),
+                () => cache.Watch<TDocument>()
+                    .Where(change => MatchesIndex(cache, alias, value, change))
+                    .Select(change => ToCollectionChange(change, descriptor.SchemaId)),
+                sourceList,
+                route);
+        }
+
+        /// <summary>
+        /// Creates a typed collection handle over all distributed CultNet database records assignable to the document type.
+        /// </summary>
+        public static CultMeshCollectionHandle<TDocument> Collection<TDocument>(
+            CultNetDatabase database,
+            string? collectionId = null,
+            IEnumerable<CultMeshProjectionSource>? sources = null,
+            CultMeshRouteHint? routeHint = null)
+            where TDocument : class
+        {
+            if (database == null) throw new ArgumentNullException(nameof(database));
+
+            var descriptor = CultDocumentRegistry.Shared.GetRequired<TDocument>();
+            var sourceList = sources?.ToArray()
+                ?? new[] { ProjectionSource(CollectionId(collectionId, descriptor), descriptor.SchemaId, "CultNet database collection") };
+            var route = routeHint ?? new CultMeshRouteHint(CultMeshLocalityKind.Automatic, "CultNet database collection");
+            return new CultMeshCollectionHandle<TDocument>(
+                CollectionId(collectionId, descriptor),
+                () => Task.FromResult<IReadOnlyList<TDocument>>(database.GetAll<TDocument>().ToArray()),
+                () => database.Watch<TDocument>().Select(ToCollectionChange),
+                sourceList,
+                route);
+        }
+
+        /// <summary>
+        /// Creates a typed collection handle over the distributed CultNet database record with the supplied CultName.
+        /// </summary>
+        public static CultMeshCollectionHandle<TDocument> CollectionByName<TDocument>(
+            CultNetDatabase database,
+            string name,
+            string? collectionId = null,
+            IEnumerable<CultMeshProjectionSource>? sources = null,
+            CultMeshRouteHint? routeHint = null)
+            where TDocument : class
+        {
+            if (database == null) throw new ArgumentNullException(nameof(database));
+            if (string.IsNullOrWhiteSpace(name)) throw new ArgumentException("Value must be non-empty.", nameof(name));
+
+            var descriptor = CultDocumentRegistry.Shared.GetRequired<TDocument>();
+            var resolvedId = collectionId ?? $"{descriptor.SchemaId}:name:{name}";
+            var sourceList = sources?.ToArray()
+                ?? new[] { ProjectionSource(resolvedId, descriptor.SchemaId, "CultNet database named collection") };
+            var route = routeHint ?? new CultMeshRouteHint(CultMeshLocalityKind.Automatic, "CultNet database named collection");
+            return new CultMeshCollectionHandle<TDocument>(
+                resolvedId,
+                () => Task.FromResult<IReadOnlyList<TDocument>>(Optional(database.GetByName<TDocument>(name))),
+                () => database.WatchByName<TDocument>(name).Select(ToCollectionChange),
+                sourceList,
+                route);
+        }
+
+        /// <summary>
+        /// Creates a typed collection handle over distributed CultNet database records matched by an indexed value.
+        /// </summary>
+        public static CultMeshCollectionHandle<TDocument> CollectionByIndex<TDocument>(
+            CultNetDatabase database,
+            string alias,
+            string value,
+            string? collectionId = null,
+            IEnumerable<CultMeshProjectionSource>? sources = null,
+            CultMeshRouteHint? routeHint = null)
+            where TDocument : class
+        {
+            if (database == null) throw new ArgumentNullException(nameof(database));
+            if (string.IsNullOrWhiteSpace(alias)) throw new ArgumentException("Value must be non-empty.", nameof(alias));
+            if (string.IsNullOrWhiteSpace(value)) throw new ArgumentException("Value must be non-empty.", nameof(value));
+
+            var descriptor = CultDocumentRegistry.Shared.GetRequired<TDocument>();
+            var resolvedId = collectionId ?? $"{descriptor.SchemaId}:index:{alias}:{value}";
+            var sourceList = sources?.ToArray()
+                ?? new[] { ProjectionSource(resolvedId, descriptor.SchemaId, "CultNet database indexed collection") };
+            var route = routeHint ?? new CultMeshRouteHint(CultMeshLocalityKind.Automatic, "CultNet database indexed collection");
+            return new CultMeshCollectionHandle<TDocument>(
+                resolvedId,
+                () => Task.FromResult<IReadOnlyList<TDocument>>(Optional(database.GetByIndex<TDocument>(alias, value))),
+                () => database.WatchByIndex<TDocument>(alias, value).Select(ToCollectionChange),
+                sourceList,
+                route);
+        }
+
+        /// <summary>
+        /// Creates a typed collection handle over all CultMesh node database records assignable to the document type.
+        /// </summary>
+        public static CultMeshCollectionHandle<TDocument> Collection<TDocument>(
+            CultMeshNode node,
+            string? collectionId = null,
+            IEnumerable<CultMeshProjectionSource>? sources = null,
+            CultMeshRouteHint? routeHint = null)
+            where TDocument : class
+        {
+            if (node == null) throw new ArgumentNullException(nameof(node));
+            return Collection<TDocument>(node.Database, collectionId, sources, routeHint);
+        }
+
+        /// <summary>
+        /// Creates a typed collection handle over the CultMesh node database record with the supplied CultName.
+        /// </summary>
+        public static CultMeshCollectionHandle<TDocument> CollectionByName<TDocument>(
+            CultMeshNode node,
+            string name,
+            string? collectionId = null,
+            IEnumerable<CultMeshProjectionSource>? sources = null,
+            CultMeshRouteHint? routeHint = null)
+            where TDocument : class
+        {
+            if (node == null) throw new ArgumentNullException(nameof(node));
+            return CollectionByName<TDocument>(node.Database, name, collectionId, sources, routeHint);
+        }
+
+        /// <summary>
+        /// Creates a typed collection handle over CultMesh node database records matched by an indexed value.
+        /// </summary>
+        public static CultMeshCollectionHandle<TDocument> CollectionByIndex<TDocument>(
+            CultMeshNode node,
+            string alias,
+            string value,
+            string? collectionId = null,
+            IEnumerable<CultMeshProjectionSource>? sources = null,
+            CultMeshRouteHint? routeHint = null)
+            where TDocument : class
+        {
+            if (node == null) throw new ArgumentNullException(nameof(node));
+            return CollectionByIndex<TDocument>(node.Database, alias, value, collectionId, sources, routeHint);
+        }
+
+        /// <summary>
+        /// Describes a typed live feed surface for tooling, UI, and diagnostics.
+        /// </summary>
+        public static CultMeshLiveFeedDiagnostic DescribeLiveFeed<TParameters, TResult>(
+            CultMeshLiveFeed<TParameters, TResult> feed)
+        {
+            if (feed == null) throw new ArgumentNullException(nameof(feed));
+            return new CultMeshLiveFeedDiagnostic(feed.FeedId, feed.RouteHint, feed.Sources);
+        }
+
+        /// <summary>
+        /// Describes a typed query surface for tooling, UI, and diagnostics.
+        /// </summary>
+        public static CultMeshQuerySurfaceDiagnostic DescribeQuerySurface<TParameters, TResult>(
+            CultMeshQuerySurface<TParameters, TResult> query)
+        {
+            if (query == null) throw new ArgumentNullException(nameof(query));
+            return new CultMeshQuerySurfaceDiagnostic(query.QueryId, query.RouteHint, query.Sources);
+        }
+
+        /// <summary>
+        /// Describes a typed operation handle for tooling, UI, and diagnostics.
+        /// </summary>
+        public static CultMeshOperationHandleDiagnostic DescribeOperationHandle<TRequest, TResponse>(
+            CultMeshOperationHandle<TRequest, TResponse> operation)
+        {
+            if (operation == null) throw new ArgumentNullException(nameof(operation));
+            return new CultMeshOperationHandleDiagnostic(operation.OperationId);
+        }
+
+        /// <summary>
+        /// Describes a typed state pointer for tooling, UI, and diagnostics.
+        /// </summary>
+        public static CultMeshStatePointerDiagnostic DescribeStatePointer<TValue>(
+            CultMeshStatePointer<TValue> pointer)
+        {
+            if (pointer == null) throw new ArgumentNullException(nameof(pointer));
+            return new CultMeshStatePointerDiagnostic(pointer.PointerId, pointer.RouteHint, pointer.Sources);
+        }
+
+        /// <summary>
+        /// Describes a mutable typed state pointer for tooling, UI, and diagnostics.
+        /// </summary>
+        public static CultMeshStatePointerDiagnostic DescribeStatePointer<TValue>(
+            CultMeshMutableStatePointer<TValue> pointer)
+        {
+            if (pointer == null) throw new ArgumentNullException(nameof(pointer));
+            return new CultMeshStatePointerDiagnostic(pointer.PointerId, pointer.RouteHint, pointer.Sources);
+        }
+
+        /// <summary>
+        /// Describes a native slice view for tooling, UI, and diagnostics.
+        /// </summary>
+        public static CultMeshNativeSliceViewDiagnostic DescribeNativeSliceView(
+            CultMeshNativeSliceViewDescriptor view)
+        {
+            return new CultMeshNativeSliceViewDiagnostic(view);
+        }
+
+        /// <summary>
+        /// Describes a typed projection recipe for tooling, UI, and diagnostics.
+        /// </summary>
+        public static CultMeshProjectionRecipeDiagnostic DescribeProjectionRecipe<TParameters, TResult>(
+            CultMeshProjectionRecipe<TParameters, TResult> recipe)
+        {
+            if (recipe == null) throw new ArgumentNullException(nameof(recipe));
+            return new CultMeshProjectionRecipeDiagnostic(recipe.ProjectionId, recipe.RouteHint, recipe.Sources);
+        }
+
+        /// <summary>
+        /// Describes a typed query surface as one entry in a surface catalog.
+        /// </summary>
+        public static CultMeshSurfaceDiagnostic DescribeSurface<TParameters, TResult>(
+            CultMeshQuerySurface<TParameters, TResult> query)
+        {
+            if (query == null) throw new ArgumentNullException(nameof(query));
+            return new CultMeshSurfaceDiagnostic(CultMeshSurfaceKind.Query, query.QueryId, query.RouteHint, query.Sources);
+        }
+
+        /// <summary>
+        /// Describes a typed operation handle as one entry in a surface catalog.
+        /// </summary>
+        public static CultMeshSurfaceDiagnostic DescribeSurface<TRequest, TResponse>(
+            CultMeshOperationHandle<TRequest, TResponse> operation)
+        {
+            if (operation == null) throw new ArgumentNullException(nameof(operation));
+            return new CultMeshSurfaceDiagnostic(CultMeshSurfaceKind.Operation, operation.OperationId);
+        }
+
+        /// <summary>
+        /// Describes a typed projection recipe as one entry in a surface catalog.
+        /// </summary>
+        public static CultMeshSurfaceDiagnostic DescribeSurface<TParameters, TResult>(
+            CultMeshProjectionRecipe<TParameters, TResult> recipe)
+        {
+            if (recipe == null) throw new ArgumentNullException(nameof(recipe));
+            return new CultMeshSurfaceDiagnostic(CultMeshSurfaceKind.ProjectionRecipe, recipe.ProjectionId, recipe.RouteHint, recipe.Sources);
+        }
+
+        /// <summary>
+        /// Describes a typed live feed as one entry in a surface catalog.
+        /// </summary>
+        public static CultMeshSurfaceDiagnostic DescribeSurface<TParameters, TResult>(
+            CultMeshLiveFeed<TParameters, TResult> feed)
+        {
+            if (feed == null) throw new ArgumentNullException(nameof(feed));
+            return new CultMeshSurfaceDiagnostic(CultMeshSurfaceKind.LiveFeed, feed.FeedId, feed.RouteHint, feed.Sources);
+        }
+
+        /// <summary>
+        /// Describes a typed document handle as one entry in a surface catalog.
+        /// </summary>
+        public static CultMeshSurfaceDiagnostic DescribeSurface(
+            ICultMeshDocumentHandle document)
+        {
+            if (document == null) throw new ArgumentNullException(nameof(document));
+            return new CultMeshSurfaceDiagnostic(
+                CultMeshSurfaceKind.Document,
+                document.DocumentId,
+                document.RouteHint,
+                document.Sources);
+        }
+
+        /// <summary>
+        /// Describes a typed collection handle as one entry in a surface catalog.
+        /// </summary>
+        public static CultMeshSurfaceDiagnostic DescribeSurface<TDocument>(
+            CultMeshCollectionHandle<TDocument> collection)
+            where TDocument : class
+        {
+            if (collection == null) throw new ArgumentNullException(nameof(collection));
+            return new CultMeshSurfaceDiagnostic(
+                CultMeshSurfaceKind.Collection,
+                collection.CollectionId,
+                collection.RouteHint,
+                collection.Sources);
+        }
+
+        /// <summary>
+        /// Describes a typed state pointer as one entry in a surface catalog.
+        /// </summary>
+        public static CultMeshSurfaceDiagnostic DescribeSurface<TValue>(
+            CultMeshStatePointer<TValue> pointer)
+        {
+            if (pointer == null) throw new ArgumentNullException(nameof(pointer));
+            return new CultMeshSurfaceDiagnostic(
+                CultMeshSurfaceKind.StatePointer,
+                pointer.PointerId,
+                pointer.RouteHint,
+                pointer.Sources);
+        }
+
+        /// <summary>
+        /// Describes a mutable typed state pointer as one entry in a surface catalog.
+        /// </summary>
+        public static CultMeshSurfaceDiagnostic DescribeSurface<TValue>(
+            CultMeshMutableStatePointer<TValue> pointer)
+        {
+            if (pointer == null) throw new ArgumentNullException(nameof(pointer));
+            return new CultMeshSurfaceDiagnostic(
+                CultMeshSurfaceKind.StatePointer,
+                pointer.PointerId,
+                pointer.RouteHint,
+                pointer.Sources);
+        }
+
+        /// <summary>
+        /// Describes a native slice view as one entry in a surface catalog.
+        /// </summary>
+        public static CultMeshSurfaceDiagnostic DescribeSurface(
+            CultMeshNativeSliceViewDescriptor view)
+        {
+            if (view == null) throw new ArgumentNullException(nameof(view));
+            return new CultMeshSurfaceDiagnostic(CultMeshSurfaceKind.NativeSliceView, view.ViewId, view.Route);
+        }
+
+        /// <summary>
+        /// Creates a typed surface catalog diagnostic for tooling, UI, and generated bindings.
+        /// </summary>
+        public static CultMeshSurfaceCatalogDiagnostic DescribeSurfaceCatalog(
+            string catalogId,
+            IEnumerable<CultMeshSurfaceDiagnostic> surfaces)
+        {
+            return new CultMeshSurfaceCatalogDiagnostic(catalogId, surfaces);
+        }
+
+        /// <summary>
+        /// Creates a kind-indexed surface catalog diagnostic for generated bindings, UI, and tools.
+        /// </summary>
+        public static CultMeshSurfaceCatalogIndexDiagnostic DescribeSurfaceCatalogIndex(
+            CultMeshSurfaceCatalogDiagnostic catalog)
+        {
+            if (catalog == null) throw new ArgumentNullException(nameof(catalog));
+            return catalog.IndexByKind();
+        }
+
+        /// <summary>
+        /// Creates a timer-backed query watcher for runtimes that do not yet have native reactive transport.
+        /// </summary>
+        public static Func<TParameters, CultMeshQueryContext, R3.Observable<TResult>> PollingQueryWatcher<TParameters, TResult>(
+            Func<TParameters, CultMeshQueryContext, Task<TResult>> sample,
+            CultMeshPollingWatchOptions<TResult>? options = null)
+        {
+            if (sample == null) throw new ArgumentNullException(nameof(sample));
+            var resolvedOptions = options ?? new CultMeshPollingWatchOptions<TResult>();
+            return (parameters, context) => R3.Observable.Create<TResult>(observer =>
+            {
+                var watcher = new CultMeshPollingWatcher<TParameters, TResult>(
+                    sample,
+                    parameters,
+                    context,
+                    resolvedOptions);
+                var subscription = watcher.Observable.Subscribe(observer);
+                return new CultMeshCompositeDisposable(subscription, watcher);
+            });
+        }
+
+        private static async Task<CultNetSnapshotResponseRawMessage> RequestPeerSnapshotAsync<TDocument>(
+            Func<ICultNetSchemaClient> createClient,
+            string endpoint,
+            string recordKey,
+            CultMeshQueryContext context,
+            CultMeshPeerSnapshotDocumentOptions options)
+            where TDocument : class
+        {
+            var descriptor = CultDocumentRegistry.Shared.GetRequired<TDocument>();
+            return await FetchSnapshotAsync(
+                    createClient,
+                    endpoint,
+                    ToSnapshotRequestOptions(
+                        options,
+                        context,
+                        options.SchemaIds ?? new[] { descriptor.SchemaId },
+                        new[] { recordKey }))
+                .ConfigureAwait(false);
+        }
+
+        private static CultMeshSnapshotRequestOptions ToSnapshotRequestOptions(
+            CultMeshPeerSnapshotDocumentOptions options,
+            CultMeshQueryContext context,
+            IReadOnlyList<string>? schemaIds,
+            IReadOnlyList<string>? recordKeys)
+        {
+            return new CultMeshSnapshotRequestOptions
+            {
+                SchemaIds = schemaIds,
+                RecordKeys = recordKeys,
+                ShardId = options.ShardId,
+                ShardEpoch = options.ShardEpoch,
+                ResponseTimeout = options.ResponseTimeout,
+                ConnectTimeout = options.ConnectTimeout,
+                MessageIdPrefix = string.IsNullOrWhiteSpace(options.MessageIdPrefix)
+                    ? $"cultmesh:{context.RuntimeId}:snapshot"
+                    : options.MessageIdPrefix,
+                Security = options.Security,
+                ConfigureClient = options.ConfigureClient,
+                RudpRuntimeId = string.IsNullOrWhiteSpace(options.RudpRuntimeId)
+                    ? context.RuntimeId
+                    : options.RudpRuntimeId,
+                RudpConnectionId = options.RudpConnectionId,
+                RudpConnectPayload = options.RudpConnectPayload,
+                RudpMaxFragmentBytes = options.RudpMaxFragmentBytes,
+                RudpResendDelayMs = options.RudpResendDelayMs
+            };
+        }
+
+        private static TDocument ReadDocumentFromSnapshotResponse<TDocument>(
+            CultNetSnapshotResponseRawMessage response,
+            string schemaId,
+            string recordKey)
+            where TDocument : class
+        {
+            if (response == null) throw new ArgumentNullException(nameof(response));
+            var record = response.Documents.FirstOrDefault(candidate =>
+                    string.Equals(candidate.SchemaId, schemaId, StringComparison.Ordinal) &&
+                    string.Equals(candidate.RecordKey, recordKey, StringComparison.Ordinal))
+                ?? response.Documents.FirstOrDefault(candidate =>
+                    string.Equals(candidate.RecordKey, recordKey, StringComparison.Ordinal) &&
+                    TryDecodeSnapshotDocument(candidate, out TDocument? _))
+                ?? response.Documents.FirstOrDefault(candidate =>
+                    string.Equals(candidate.SchemaId, schemaId, StringComparison.Ordinal))
+                ?? response.Documents.FirstOrDefault(candidate =>
+                    string.Equals(candidate.RecordKey, recordKey, StringComparison.Ordinal));
+            if (record == null)
+            {
+                throw new InvalidOperationException(
+                    $"CultNet snapshot response '{response.MessageId}' did not contain schema '{schemaId}' record '{recordKey}'.");
+            }
+
+            if (!string.Equals(record.PayloadEncoding, "messagepack", StringComparison.Ordinal))
+            {
+                throw new InvalidOperationException(
+                    $"CultNet raw document payloadEncoding must be \"messagepack\", not \"{record.PayloadEncoding}\".");
+            }
+
+            return DecodeSnapshotDocument<TDocument>(record);
+        }
+
+        private static bool TryDecodeSnapshotDocument<TDocument>(
+            CultNetRawDocumentRecord record,
+            out TDocument? document)
+            where TDocument : class
+        {
+            document = null;
+            if (!string.Equals(record.PayloadEncoding, "messagepack", StringComparison.Ordinal))
+                return false;
+
+            try
+            {
+                document = DecodeSnapshotDocument<TDocument>(record);
+                return true;
+            }
+            catch
+            {
+                return false;
+            }
+        }
+
+        private static TDocument DecodeSnapshotDocument<TDocument>(CultNetRawDocumentRecord record)
+            where TDocument : class
+        {
+            return (TDocument)CultDocumentMessagePackSerialization.DeserializeUntyped(
+                typeof(TDocument),
+                record.Payload);
+        }
+
         /// <summary>
         /// Parses a rudp://host:port endpoint into its host/port parts.
         /// </summary>
@@ -321,6 +2831,128 @@ namespace GameCult.Mesh
             return new CultMeshRudpEndpoint(host, uri.Port, $"rudp://{uriHost}:{uri.Port}");
         }
 
+        /// <summary>
+        /// Opens one exact hot-body subscription and advertises every body plane this runtime can
+        /// actually open. The provider derives locality and publishes only the selected plane.
+        /// </summary>
+        public static Task<IReadOnlyList<object>> SubscribeHotBodyAsync(
+            CultNetDatabaseSubscriptionClient subscriptions,
+            IEnumerable<CultMeshBodyTransportKind> supportedBodyTransports,
+            CultMeshHotBodySubscription subscription,
+            CultNetDatabaseSubscriptionDeliveryMode deliveryMode = CultNetDatabaseSubscriptionDeliveryMode.Live)
+        {
+            if (subscriptions == null) throw new ArgumentNullException(nameof(subscriptions));
+            if (supportedBodyTransports == null) throw new ArgumentNullException(nameof(supportedBodyTransports));
+            if (subscription == null) throw new ArgumentNullException(nameof(subscription));
+            var transports = supportedBodyTransports.Distinct().ToArray();
+            if (transports.Length == 0)
+                throw new ArgumentException("At least one readable body transport is required.", nameof(supportedBodyTransports));
+            return subscriptions.SubscribeAsync(
+                subscription.SubscriptionId,
+                recordKeys: subscription.RecordKeys,
+                schemaIds: subscription.SchemaIds,
+                consumerRuntimeId: subscription.ConsumerRuntimeId,
+                bodyIds: new[] { subscription.BodyId },
+                supportedBodyTransports: transports.Select(value => value.ToString()),
+                deliveryMode: deliveryMode);
+        }
+
+        /// <summary>Opens an exact hot-body subscription using a resolver's readable planes.</summary>
+        public static Task<IReadOnlyList<object>> SubscribeHotBodyAsync(
+            CultNetDatabaseSubscriptionClient subscriptions,
+            CultMeshBodyPublicationResolver bodyResolver,
+            CultMeshHotBodySubscription subscription,
+            CultNetDatabaseSubscriptionDeliveryMode deliveryMode = CultNetDatabaseSubscriptionDeliveryMode.Live)
+        {
+            if (bodyResolver == null) throw new ArgumentNullException(nameof(bodyResolver));
+            return SubscribeHotBodyAsync(subscriptions, bodyResolver.SupportedTransports, subscription, deliveryMode);
+        }
+
+        /// <summary>
+        /// Subscribes to one logical body's latest descriptor as ephemeral control state and declares
+        /// demand for the body itself. Body bytes are opened separately through the fastest valid plane.
+        /// </summary>
+        public static async Task<CultMeshLiveBody> SubscribeLiveBodyAsync(
+            CultNetDatabaseSubscriptionClient subscriptions,
+            CultMeshBodyPublicationResolver bodyResolver,
+            CultMeshLiveBodySubscription subscription,
+            CancellationToken cancellationToken = default)
+        {
+            if (subscriptions == null) throw new ArgumentNullException(nameof(subscriptions));
+            if (bodyResolver == null) throw new ArgumentNullException(nameof(bodyResolver));
+            if (subscription == null) throw new ArgumentNullException(nameof(subscription));
+            var transports = bodyResolver.SupportedTransports.Distinct().ToArray();
+            if (transports.Length == 0)
+                throw new InvalidOperationException("The body resolver has no readable transport planes.");
+
+            var liveBody = new CultMeshLiveBody(subscriptions, bodyResolver, subscription);
+            try
+            {
+                var initial = await subscriptions.SubscribeAsync(
+                        subscription.SubscriptionId,
+                        recordKeys: new[] { subscription.PublicationRecordKey },
+                        schemaIds: new[] { CultMeshBodyPublicationSchemaVersions.Publication },
+                        consumerRuntimeId: subscription.ConsumerRuntimeId,
+                        bodyIds: new[] { subscription.BodyId },
+                        supportedBodyTransports: transports.Select(value => value.ToString()),
+                        deliveryMode: CultNetDatabaseSubscriptionDeliveryMode.Live,
+                        cancellationToken: cancellationToken)
+                    .ConfigureAwait(false);
+                var publications = initial.OfType<CultMeshBodyPublicationDocument>().ToArray();
+                if (publications.Length > 1)
+                    throw new InvalidOperationException(
+                        $"Live body subscription '{subscription.SubscriptionId}' expected at most one publication for " +
+                        $"'{subscription.BodyId}' but received {publications.Length}.");
+                if (publications.Length == 1)
+                    liveBody.Initialize(publications[0]);
+                return liveBody;
+            }
+            catch
+            {
+                liveBody.Dispose();
+                throw;
+            }
+        }
+
+        /// <summary>Resolves a CultMesh URI or RUDP endpoint into a concrete RUDP endpoint.</summary>
+        public static CultMeshRudpEndpoint ResolveRudpEndpoint(string endpointOrUri)
+        {
+            if (string.IsNullOrWhiteSpace(endpointOrUri))
+                throw new ArgumentException("Value must be non-empty.", nameof(endpointOrUri));
+            if (!Uri.TryCreate(endpointOrUri, UriKind.Absolute, out var uri))
+                return ParseRudpEndpoint(NormalizeBareRudpEndpoint(endpointOrUri));
+            if (string.Equals(uri.Scheme, "rudp", StringComparison.OrdinalIgnoreCase))
+                return ParseRudpEndpoint(endpointOrUri);
+            if (!string.Equals(uri.Scheme, "cultmesh", StringComparison.OrdinalIgnoreCase))
+                throw new ArgumentException("RUDP endpoint must use the cultmesh:// or rudp:// scheme.", nameof(endpointOrUri));
+            if (string.IsNullOrWhiteSpace(uri.Host))
+                throw new ArgumentException("CultMesh URI must include an authority.", nameof(endpointOrUri));
+
+            var authorityKey = MakeCultMeshAuthorityEnvironmentKey(uri.Host);
+            var endpoint = Environment.GetEnvironmentVariable($"CULTMESH_URI_{authorityKey}_RUDP") ??
+                Environment.GetEnvironmentVariable($"{authorityKey}_CULTMESH_RUDP_ENDPOINT");
+            if (string.IsNullOrWhiteSpace(endpoint))
+                throw new InvalidOperationException(
+                    $"CultMesh URI '{endpointOrUri}' is unresolved. Set CULTMESH_URI_{authorityKey}_RUDP to a rudp:// endpoint.");
+            return ParseRudpEndpoint(endpoint);
+        }
+
+        private static string NormalizeBareRudpEndpoint(string endpoint)
+        {
+            var trimmed = endpoint.Trim();
+            return trimmed.Contains("://", StringComparison.Ordinal) ? trimmed : $"rudp://{trimmed}";
+        }
+
+        private static string MakeCultMeshAuthorityEnvironmentKey(string authority)
+        {
+            var chars = authority.Select(static value =>
+                ((value >= 'a' && value <= 'z') || (value >= 'A' && value <= 'Z') || (value >= '0' && value <= '9'))
+                    ? char.ToUpperInvariant(value)
+                    : '_');
+            var key = string.Concat(chars).Trim('_');
+            return string.IsNullOrWhiteSpace(key) ? "ODIN" : key;
+        }
+
         /// <summary>
         /// Creates a CultNet RUDP server transport with CultMesh-branded defaults.
         /// </summary>
@@ -383,7 +3015,7 @@ namespace GameCult.Mesh
             string endpoint,
             CultMeshRudpSocketOptions? options = null)
         {
-            return CreateRudpClient(runtimeId, connectionId, ParseRudpEndpoint(endpoint), options);
+            return CreateRudpClient(runtimeId, connectionId, ResolveRudpEndpoint(endpoint), options);
         }
 
         /// <summary>
@@ -408,6 +3040,7 @@ namespace GameCult.Mesh
         /// <summary>
         /// Creates a CultNet RUDP client transport from the first peer authorized for a Verse role.
         /// </summary>
+        [Obsolete("Supply CultMeshAuthorityResolver and an explicit authority epoch. This compatibility path denies unverifiable leases.")]
         public static CultNetRudpSocketTransportConnection CreateRudpClientForAuthorizedPeer(
             string runtimeId,
             uint connectionId,
@@ -421,7 +3054,27 @@ namespace GameCult.Mesh
         {
             if (peers == null) throw new ArgumentNullException(nameof(peers));
             if (leases == null) throw new ArgumentNullException(nameof(leases));
-            var peer = peers.FirstAuthorized(verseId, role, leases, shardId, at);
+            var resolver = CultMeshAuthorityResolver.CreateDenyByDefault(leases,
+                at.HasValue ? new CultMeshFixedAuthorityClock(at.Value) : null);
+            return CreateRudpClientForAuthorizedPeer(runtimeId, connectionId, peers, resolver, 0, verseId, role, shardId, null, options);
+        }
+
+        /// <summary>Creates a RUDP client from the first contact accepted by the authority resolver.</summary>
+        public static CultNetRudpSocketTransportConnection CreateRudpClientForAuthorizedPeer(
+            string runtimeId,
+            uint connectionId,
+            CultMeshPeerCatalog peers,
+            CultMeshAuthorityResolver authority,
+            long authorityEpoch,
+            string verseId,
+            string role,
+            string? shardId = null,
+            string? resourceScope = null,
+            CultMeshRudpSocketOptions? options = null)
+        {
+            if (peers == null) throw new ArgumentNullException(nameof(peers));
+            if (authority == null) throw new ArgumentNullException(nameof(authority));
+            var peer = peers.FirstAuthorized(verseId, role, authority, authorityEpoch, shardId, resourceScope);
             if (peer == null)
             {
                 throw new InvalidOperationException($"No authorized RUDP peer for role {role} in Verse {verseId}.");
@@ -484,6 +3137,7 @@ namespace GameCult.Mesh
         /// <summary>
         /// Creates and handshakes a CultNet RUDP client transport from the first peer authorized for a Verse role.
         /// </summary>
+        [Obsolete("Supply CultMeshAuthorityResolver and an explicit authority epoch. This compatibility path denies unverifiable leases.")]
         public static CultNetRudpSocketTransportConnection ConnectRudpClientForAuthorizedPeer(
             string runtimeId,
             uint connectionId,
@@ -497,7 +3151,27 @@ namespace GameCult.Mesh
         {
             if (peers == null) throw new ArgumentNullException(nameof(peers));
             if (leases == null) throw new ArgumentNullException(nameof(leases));
-            var peer = peers.FirstAuthorized(verseId, role, leases, shardId, at);
+            var resolver = CultMeshAuthorityResolver.CreateDenyByDefault(leases,
+                at.HasValue ? new CultMeshFixedAuthorityClock(at.Value) : null);
+            return ConnectRudpClientForAuthorizedPeer(runtimeId, connectionId, peers, resolver, 0, verseId, role, shardId, null, options);
+        }
+
+        /// <summary>Creates and handshakes a RUDP client from the first contact accepted by the authority resolver.</summary>
+        public static CultNetRudpSocketTransportConnection ConnectRudpClientForAuthorizedPeer(
+            string runtimeId,
+            uint connectionId,
+            CultMeshPeerCatalog peers,
+            CultMeshAuthorityResolver authority,
+            long authorityEpoch,
+            string verseId,
+            string role,
+            string? shardId = null,
+            string? resourceScope = null,
+            CultMeshRudpClientOptions? options = null)
+        {
+            if (peers == null) throw new ArgumentNullException(nameof(peers));
+            if (authority == null) throw new ArgumentNullException(nameof(authority));
+            var peer = peers.FirstAuthorized(verseId, role, authority, authorityEpoch, shardId, resourceScope);
             if (peer == null)
             {
                 throw new InvalidOperationException($"No authorized RUDP peer for role {role} in Verse {verseId}.");
@@ -506,6 +3180,14 @@ namespace GameCult.Mesh
             return ConnectRudpClientForPeer(runtimeId, connectionId, peer, options);
         }
 
+        private sealed class CultMeshFixedAuthorityClock : ICultMeshClock
+        {
+            public CultMeshFixedAuthorityClock(DateTimeOffset utcNow) => UtcNow = utcNow;
+            public DateTimeOffset UtcNow { get; }
+            public System.Threading.Tasks.Task DelayAsync(TimeSpan delay, System.Threading.CancellationToken cancellationToken = default) =>
+                System.Threading.Tasks.Task.CompletedTask;
+        }
+
         /// <summary>
         /// Creates a committer for writing quorum simulation facts to a mesh database.
         /// </summary>
@@ -604,5 +3286,261 @@ namespace GameCult.Mesh
             return Dns.GetHostAddresses(host).FirstOrDefault()
                    ?? throw new InvalidOperationException($"Could not resolve RUDP host {host}.");
         }
+
+        private static string ResolveDocumentId(string? documentId, CultRecordKey key)
+        {
+            return string.IsNullOrWhiteSpace(documentId)
+                ? key.Value
+                : documentId!;
+        }
+
+        private static string CollectionId(string? collectionId, CultDocumentDescriptor descriptor)
+        {
+            return string.IsNullOrWhiteSpace(collectionId)
+                ? descriptor.SchemaId
+                : collectionId!;
+        }
+
+        private static IReadOnlyList<TDocument> Optional<TDocument>(TDocument? document)
+            where TDocument : class
+        {
+            return document == null
+                ? Array.Empty<TDocument>()
+                : new[] { document };
+        }
+
+        private static bool MatchesName<TDocument>(
+            CultCache cache,
+            string name,
+            CultCacheDocumentChange<TDocument> change)
+            where TDocument : class
+        {
+            var current = cache.GetByName<TDocument>(name);
+            return (change.Document != null && ReferenceEquals(current, change.Document)) ||
+                   (change.PreviousDocument != null && ReferenceEquals(current, change.PreviousDocument));
+        }
+
+        private static bool MatchesIndex<TDocument>(
+            CultCache cache,
+            string alias,
+            string value,
+            CultCacheDocumentChange<TDocument> change)
+            where TDocument : class
+        {
+            var current = cache.GetByIndex<TDocument>(alias, value);
+            return (change.Document != null && ReferenceEquals(current, change.Document)) ||
+                   (change.PreviousDocument != null && ReferenceEquals(current, change.PreviousDocument));
+        }
+
+        private static CultMeshCollectionChange<TDocument> ToCollectionChange<TDocument>(
+            CultCacheDocumentChange<TDocument> change,
+            string schemaId)
+            where TDocument : class
+        {
+            return new CultMeshCollectionChange<TDocument>(
+                change.Kind switch
+                {
+                    CultCacheDocumentChangeKind.Added => CultMeshCollectionChangeKind.Added,
+                    CultCacheDocumentChangeKind.Updated => CultMeshCollectionChangeKind.Updated,
+                    CultCacheDocumentChangeKind.Removed => CultMeshCollectionChangeKind.Removed,
+                    _ => CultMeshCollectionChangeKind.Updated
+                },
+                change.Key,
+                schemaId,
+                change.Document,
+                change.PreviousDocument);
+        }
+
+        private static CultMeshCollectionChange<TDocument> ToCollectionChange<TDocument>(
+            CultNetDatabaseChange<TDocument> change)
+            where TDocument : class
+        {
+            return new CultMeshCollectionChange<TDocument>(
+                change.Kind switch
+                {
+                    CultNetDatabaseChangeKind.Added => CultMeshCollectionChangeKind.Added,
+                    CultNetDatabaseChangeKind.Updated => CultMeshCollectionChangeKind.Updated,
+                    CultNetDatabaseChangeKind.Removed => CultMeshCollectionChangeKind.Removed,
+                    CultNetDatabaseChangeKind.Predicted => CultMeshCollectionChangeKind.Predicted,
+                    CultNetDatabaseChangeKind.Reconciled => CultMeshCollectionChangeKind.Reconciled,
+                    CultNetDatabaseChangeKind.SchemaMigrated => CultMeshCollectionChangeKind.SchemaMigrated,
+                    CultNetDatabaseChangeKind.Rejected => CultMeshCollectionChangeKind.Rejected,
+                    _ => CultMeshCollectionChangeKind.Updated
+                },
+                change.Key,
+                change.SchemaId,
+                change.Document,
+                change.PreviousDocument,
+                change.Message);
+        }
+
+        private static TDocument ReadRequired<TDocument>(CultCache cache, CultRecordKey key)
+            where TDocument : class =>
+            RequireDocument<TDocument>(cache.Get(key), key);
+
+        private static TDocument RequireDocument<TDocument>(object? untyped, CultRecordKey key)
+            where TDocument : class
+        {
+            if (untyped is TDocument document)
+                return document;
+
+            if (untyped != null && IsSameCultDocumentSchema<TDocument>(untyped.GetType()))
+                return ConvertUntypedDocument<TDocument>(untyped);
+
+            throw new KeyNotFoundException(
+                $"CultMesh document '{key.Value}' was not found as {typeof(TDocument).FullName}.");
+        }
+
+        private static async Task<TDocument> ReadRequiredAsync<TDocument>(
+            CultNetDatabase database,
+            CultRecordKey key)
+            where TDocument : class
+        {
+            var document = await database.GetAsync<TDocument>(key).ConfigureAwait(false);
+            return document
+                   ?? throw new KeyNotFoundException(
+                       $"CultMesh document '{key.Value}' was not found as {typeof(TDocument).FullName}.");
+        }
+
+        private static async Task<TDocument> ReadDatabaseDocumentRequiredAsync<TDocument>(
+            CultNetDatabase database,
+            CultRecordKey key)
+            where TDocument : class
+        {
+            var document = await database.GetAsync<TDocument>(key).ConfigureAwait(false);
+            if (document != null)
+                return document;
+
+            var untyped = database.Cache.Get(key);
+            if (untyped != null && IsSameCultDocumentSchema<TDocument>(untyped.GetType()))
+                return ConvertUntypedDocument<TDocument>(untyped);
+
+            throw new KeyNotFoundException(
+                $"CultMesh document '{key.Value}' was not found as {typeof(TDocument).FullName}.");
+        }
+
+        private static R3.Observable<TDocument> WatchDatabaseRecordAs<TDocument>(
+            CultNetDatabase database,
+            CultRecordKey key)
+            where TDocument : class
+        {
+            var descriptor = CultDocumentRegistry.Shared.GetRequired<TDocument>();
+            return database.WatchAllChanges()
+                .Where(change => TryConvertDatabaseChange(change, key, descriptor, out TDocument? _))
+                .Select(change =>
+                {
+                    TryConvertDatabaseChange(change, key, descriptor, out TDocument? document);
+                    return document!;
+                });
+        }
+
+        private static bool TryConvertDatabaseChange<TDocument>(
+            object change,
+            CultRecordKey key,
+            CultDocumentDescriptor descriptor,
+            out TDocument? document)
+            where TDocument : class
+        {
+            document = null;
+            if (change == null) return false;
+
+            var changeType = change.GetType();
+            if (changeType.GetProperty("Key")?.GetValue(change) is not CultRecordKey changedKey ||
+                !changedKey.Equals(key))
+            {
+                return false;
+            }
+
+            var current = changeType.GetProperty("Document")?.GetValue(change);
+            if (current == null)
+                return false;
+
+            var schemaId = changeType.GetProperty("SchemaId")?.GetValue(change) as string;
+            if (!IsSameCultDocumentSchema(current.GetType(), descriptor, schemaId))
+                return false;
+
+            document = current as TDocument ?? ConvertUntypedDocument<TDocument>(current);
+            return true;
+        }
+
+        private static bool IsSameCultDocumentSchema<TDocument>(Type documentType)
+            where TDocument : class
+        {
+            return IsSameCultDocumentSchema(
+                documentType,
+                CultDocumentRegistry.Shared.GetRequired<TDocument>());
+        }
+
+        private static bool IsSameCultDocumentSchema(
+            Type documentType,
+            CultDocumentDescriptor descriptor,
+            string? schemaId = null)
+        {
+            if (!string.IsNullOrWhiteSpace(schemaId) &&
+                string.Equals(schemaId, descriptor.SchemaId, StringComparison.Ordinal))
+            {
+                return true;
+            }
+
+            CultDocumentDescriptor storedDescriptor;
+            try
+            {
+                storedDescriptor = CultDocumentRegistry.Shared.GetRequired(documentType);
+            }
+            catch (Exception)
+            {
+                return false;
+            }
+
+            return string.Equals(storedDescriptor.SchemaName, descriptor.SchemaName, StringComparison.Ordinal) &&
+                   string.Equals(storedDescriptor.SchemaVersion, descriptor.SchemaVersion, StringComparison.Ordinal);
+        }
+
+        private static TDocument ConvertUntypedDocument<TDocument>(object document)
+            where TDocument : class
+        {
+            var payload = CultDocumentMessagePackSerialization.SerializeUntyped(document, document.GetType());
+            return (TDocument)CultDocumentMessagePackSerialization.DeserializeUntyped(typeof(TDocument), payload);
+        }
+
+        private static object ConvertUntypedDocument(object document, Type targetType)
+        {
+            var payload = CultDocumentMessagePackSerialization.SerializeUntyped(document, document.GetType());
+            return CultDocumentMessagePackSerialization.DeserializeUntyped(targetType, payload);
+        }
+
+        private static async Task PutDatabaseDocumentAsync<TDocument>(
+            CultNetDatabase database,
+            CultRecordKey key,
+            TDocument value,
+            bool predicted)
+            where TDocument : class
+        {
+            var stored = database.Cache.Get(key);
+            object outgoing = value;
+            var outgoingType = typeof(TDocument);
+            if (stored != null &&
+                !outgoingType.IsInstanceOfType(stored) &&
+                IsSameCultDocumentSchema(stored.GetType(), CultDocumentRegistry.Shared.GetRequired<TDocument>()))
+            {
+                outgoing = ConvertUntypedDocument(value, stored.GetType());
+                outgoingType = stored.GetType();
+            }
+
+            var method = typeof(CultNetDatabase)
+                .GetMethods(BindingFlags.Instance | BindingFlags.Public)
+                .Where(candidate => candidate.Name == (predicted
+                    ? nameof(CultNetDatabase.PutPredictedAsync)
+                    : nameof(CultNetDatabase.PutAsync)))
+                .Single(candidate =>
+                    candidate.IsGenericMethodDefinition &&
+                    candidate.GetParameters() is { Length: 2 } parameters &&
+                    parameters[0].ParameterType == typeof(CultRecordKey));
+
+            var task = (Task)method
+                .MakeGenericMethod(outgoingType)
+                .Invoke(database, new object[] { key, outgoing })!;
+            await task.ConfigureAwait(false);
+        }
     }
 }
diff --git a/src/GameCult.Mesh/CultMeshAuthority.cs b/src/GameCult.Mesh/CultMeshAuthority.cs
index ed39b18f..05683317 100644
--- a/src/GameCult.Mesh/CultMeshAuthority.cs
+++ b/src/GameCult.Mesh/CultMeshAuthority.cs
@@ -1,17 +1,15 @@
 using System;
 using System.Collections.Generic;
 using System.Linq;
+using System.Threading;
 
 namespace GameCult.Mesh
 {
-    /// <summary>
-    /// Grants one peer authority to perform roles for a Verse over a bounded interval.
-    /// </summary>
     public sealed class CultMeshAuthorityLease
     {
-        /// <summary>
-        /// Creates an authority lease.
-        /// </summary>
+        public const string CurrentSchemaVersion = "gamecult.mesh.authority_lease.v1";
+        public const string LegacySchemaVersion = "gamecult.mesh.authority_lease.v0";
+
         public CultMeshAuthorityLease(
             string leaseId,
             string verseId,
@@ -21,7 +19,10 @@ namespace GameCult.Mesh
             string issuerRuntimeId,
             DateTimeOffset validFrom,
             DateTimeOffset expiresAt,
-            string? signature = null)
+            string? signature = null,
+            long? authorityEpoch = null,
+            IEnumerable<string>? resourceScopes = null,
+            string? schemaVersion = null)
         {
             LeaseId = RequireNonEmpty(leaseId, nameof(leaseId));
             VerseId = RequireNonEmpty(verseId, nameof(verseId));
@@ -32,109 +33,239 @@ namespace GameCult.Mesh
             ValidFrom = validFrom;
             ExpiresAt = expiresAt;
             Signature = signature;
-            if (expiresAt <= validFrom)
-            {
-                throw new ArgumentException("Lease expiry must be after its valid-from timestamp.", nameof(expiresAt));
-            }
+            AuthorityEpoch = authorityEpoch;
+            ResourceScopes = Clean(resourceScopes);
+            SchemaVersion = schemaVersion ?? (authorityEpoch.HasValue ? CurrentSchemaVersion : LegacySchemaVersion);
+            if (expiresAt <= validFrom) throw new ArgumentException("Lease expiry must be after its valid-from timestamp.", nameof(expiresAt));
+            if (authorityEpoch < 0) throw new ArgumentOutOfRangeException(nameof(authorityEpoch));
         }
 
-        /// <summary>Gets the stable lease id.</summary>
         public string LeaseId { get; }
-        /// <summary>Gets the Verse id governed by the lease.</summary>
         public string VerseId { get; }
-        /// <summary>Gets the peer id receiving authority.</summary>
         public string PeerId { get; }
-        /// <summary>Gets the roles granted by this lease.</summary>
         public IReadOnlyList<string> Roles { get; }
-        /// <summary>Gets shard ids covered by this lease. Empty means every shard in the Verse.</summary>
         public IReadOnlyList<string> ShardIds { get; }
-        /// <summary>Gets the runtime that issued the lease.</summary>
         public string IssuerRuntimeId { get; }
-        /// <summary>Gets the first timestamp when the lease is valid.</summary>
         public DateTimeOffset ValidFrom { get; }
-        /// <summary>Gets the timestamp when the lease expires.</summary>
         public DateTimeOffset ExpiresAt { get; }
-        /// <summary>Gets an optional signature over the lease.</summary>
         public string? Signature { get; }
+        public long? AuthorityEpoch { get; }
+        public IReadOnlyList<string> ResourceScopes { get; }
+        public string SchemaVersion { get; }
 
-        /// <summary>
-        /// Returns whether this lease is valid at the supplied time.
-        /// </summary>
-        public bool IsValidAt(DateTimeOffset at)
-        {
-            return at >= ValidFrom && at < ExpiresAt;
-        }
+        public bool IsValidAt(DateTimeOffset at) => at >= ValidFrom && at < ExpiresAt;
 
-        /// <summary>
-        /// Returns whether this lease covers a peer card, role, and shard.
-        /// </summary>
+        [Obsolete("Authority decisions belong to CultMeshAuthorityResolver. This method denies leases that lack v1 signed authority evidence.")]
         public bool Covers(CultMeshPeerCard peer, string role, string? shardId = null, DateTimeOffset? at = null)
         {
             if (peer == null) throw new ArgumentNullException(nameof(peer));
-            if (string.IsNullOrWhiteSpace(role)) throw new ArgumentException("Value must be non-empty.", nameof(role));
-            var time = at ?? DateTimeOffset.UtcNow;
-            return IsValidAt(time) &&
-                   string.Equals(VerseId, peer.VerseId, StringComparison.Ordinal) &&
-                   string.Equals(PeerId, peer.PeerId, StringComparison.Ordinal) &&
-                   string.Equals(LeaseId, peer.AuthorityLeaseId, StringComparison.Ordinal) &&
-                   Roles.Contains(role, StringComparer.Ordinal) &&
-                   peer.Roles.Contains(role, StringComparer.Ordinal) &&
-                   (string.IsNullOrWhiteSpace(shardId) ||
-                    ShardIds.Count == 0 ||
-                    ShardIds.Contains(shardId!, StringComparer.Ordinal));
+            var resolver = CultMeshAuthorityResolver.CreateDenyByDefault(
+                new SingleLeaseSource(this),
+                at.HasValue ? new FixedClock(at.Value) : CultMeshSystemClock.Instance);
+            return resolver.Resolve(new CultMeshAuthorityRequest(peer, role, shardId, AuthorityEpoch ?? -1)).IsAuthorized;
         }
 
-        private static string[] Clean(IEnumerable<string>? values)
+        private static string[] Clean(IEnumerable<string>? values) =>
+            values?.Where(value => !string.IsNullOrWhiteSpace(value)).Distinct(StringComparer.Ordinal).ToArray() ?? Array.Empty<string>();
+
+        private static string RequireNonEmpty(string value, string paramName) =>
+            string.IsNullOrWhiteSpace(value) ? throw new ArgumentException("Value must be non-empty.", paramName) : value;
+
+        private sealed class SingleLeaseSource : ICultMeshAuthorityLeaseSource
         {
-            return values?.Where(value => !string.IsNullOrWhiteSpace(value)).Distinct(StringComparer.Ordinal).ToArray()
-                ?? Array.Empty<string>();
+            private readonly CultMeshAuthorityLease _lease;
+            public SingleLeaseSource(CultMeshAuthorityLease lease) => _lease = lease;
+            public CultMeshAuthorityLease? Get(string leaseId) => string.Equals(leaseId, _lease.LeaseId, StringComparison.Ordinal) ? _lease : null;
         }
 
-        private static string RequireNonEmpty(string value, string paramName)
+        private sealed class FixedClock : ICultMeshClock
         {
-            return string.IsNullOrWhiteSpace(value)
-                ? throw new ArgumentException("Value must be non-empty.", paramName)
-                : value;
+            public FixedClock(DateTimeOffset now) => UtcNow = now;
+            public DateTimeOffset UtcNow { get; }
+            public System.Threading.Tasks.Task DelayAsync(TimeSpan delay, CancellationToken cancellationToken = default) =>
+                System.Threading.Tasks.Task.CompletedTask;
         }
     }
 
-    /// <summary>
-    /// Local authority lease catalog.
-    /// </summary>
-    public sealed class CultMeshAuthorityLeaseCatalog
+    public interface ICultMeshAuthorityLeaseSource
     {
-        private readonly Dictionary<string, CultMeshAuthorityLease> _leases = new(StringComparer.Ordinal);
+        CultMeshAuthorityLease? Get(string leaseId);
+    }
 
-        /// <summary>Gets all known leases.</summary>
-        public IReadOnlyList<CultMeshAuthorityLease> Leases => _leases.Values.OrderBy(lease => lease.LeaseId, StringComparer.Ordinal).ToArray();
+    public interface ICultMeshAuthoritySignatureVerifier
+    {
+        bool Verify(CultMeshAuthorityLease lease);
+    }
 
-        /// <summary>Adds or replaces an authority lease.</summary>
-        public void Upsert(CultMeshAuthorityLease lease)
+    public interface ICultMeshAuthorityRevocationSource
+    {
+        bool IsRevoked(string leaseId, long authorityEpoch);
+    }
+
+    public enum CultMeshAuthorityDenialReason
+    {
+        None,
+        MissingLeaseReference,
+        LeaseNotFound,
+        UnsupportedLeaseVersion,
+        MissingSignature,
+        InvalidSignature,
+        NotYetValid,
+        Expired,
+        Revoked,
+        VerseMismatch,
+        PeerMismatch,
+        LeaseReferenceMismatch,
+        RoleNotGranted,
+        RoleNotAdvertised,
+        ShardNotGranted,
+        ShardNotAdvertised,
+        EpochMismatch,
+        ResourceScopeNotGranted
+    }
+
+    public sealed class CultMeshAuthorityRequest
+    {
+        public CultMeshAuthorityRequest(CultMeshPeerCard peer, string role, string? shardId, long authorityEpoch, string? resourceScope = null)
         {
-            if (lease == null) throw new ArgumentNullException(nameof(lease));
-            _leases[lease.LeaseId] = lease;
+            Peer = peer ?? throw new ArgumentNullException(nameof(peer));
+            Role = string.IsNullOrWhiteSpace(role) ? throw new ArgumentException("Value must be non-empty.", nameof(role)) : role;
+            if (authorityEpoch < 0) throw new ArgumentOutOfRangeException(nameof(authorityEpoch));
+            ShardId = shardId;
+            AuthorityEpoch = authorityEpoch;
+            ResourceScope = resourceScope;
         }
 
-        /// <summary>Gets a lease by id, if known.</summary>
+        public CultMeshPeerCard Peer { get; }
+        public string Role { get; }
+        public string? ShardId { get; }
+        public long AuthorityEpoch { get; }
+        public string? ResourceScope { get; }
+    }
+
+    public sealed class CultMeshAuthorityDecision
+    {
+        internal CultMeshAuthorityDecision(CultMeshAuthorityRequest request, CultMeshAuthorityLease? lease, CultMeshAuthorityDenialReason reason)
+        {
+            Request = request;
+            Lease = lease;
+            DenialReason = reason;
+        }
+
+        public CultMeshAuthorityRequest Request { get; }
+        public CultMeshAuthorityLease? Lease { get; }
+        public bool IsAuthorized => DenialReason == CultMeshAuthorityDenialReason.None;
+        public CultMeshAuthorityDenialReason DenialReason { get; }
+        public string? LeaseId => Lease?.LeaseId ?? Request.Peer.AuthorityLeaseId;
+        public string? IssuerRuntimeId => Lease?.IssuerRuntimeId;
+    }
+
+    public sealed class CultMeshAuthorityResolver
+    {
+        private readonly ICultMeshAuthorityLeaseSource _leases;
+        private readonly ICultMeshAuthoritySignatureVerifier _signatures;
+        private readonly ICultMeshAuthorityRevocationSource _revocations;
+        private readonly ICultMeshClock _clock;
+        private readonly ICultMeshDiagnosticSink _diagnostics;
+        private long _diagnosticSequence;
+
+        public CultMeshAuthorityResolver(
+            ICultMeshAuthorityLeaseSource leases,
+            ICultMeshAuthoritySignatureVerifier signatures,
+            ICultMeshAuthorityRevocationSource revocations,
+            ICultMeshClock clock,
+            ICultMeshDiagnosticSink? diagnostics = null)
+        {
+            _leases = leases ?? throw new ArgumentNullException(nameof(leases));
+            _signatures = signatures ?? throw new ArgumentNullException(nameof(signatures));
+            _revocations = revocations ?? throw new ArgumentNullException(nameof(revocations));
+            _clock = clock ?? throw new ArgumentNullException(nameof(clock));
+            _diagnostics = diagnostics ?? CultMeshNullDiagnosticSink.Instance;
+        }
+
+        public CultMeshAuthorityDecision Resolve(CultMeshAuthorityRequest request)
+        {
+            if (request == null) throw new ArgumentNullException(nameof(request));
+            var leaseId = request.Peer.AuthorityLeaseId;
+            if (string.IsNullOrWhiteSpace(leaseId)) return Decide(request, null, CultMeshAuthorityDenialReason.MissingLeaseReference);
+            var lease = _leases.Get(leaseId!);
+            if (lease == null) return Decide(request, null, CultMeshAuthorityDenialReason.LeaseNotFound);
+            if (!string.Equals(lease.SchemaVersion, CultMeshAuthorityLease.CurrentSchemaVersion, StringComparison.Ordinal) || !lease.AuthorityEpoch.HasValue)
+                return Decide(request, lease, CultMeshAuthorityDenialReason.UnsupportedLeaseVersion);
+            if (string.IsNullOrWhiteSpace(lease.Signature)) return Decide(request, lease, CultMeshAuthorityDenialReason.MissingSignature);
+            if (!_signatures.Verify(lease)) return Decide(request, lease, CultMeshAuthorityDenialReason.InvalidSignature);
+            if (_clock.UtcNow < lease.ValidFrom) return Decide(request, lease, CultMeshAuthorityDenialReason.NotYetValid);
+            if (_clock.UtcNow >= lease.ExpiresAt) return Decide(request, lease, CultMeshAuthorityDenialReason.Expired);
+            if (_revocations.IsRevoked(lease.LeaseId, lease.AuthorityEpoch.Value)) return Decide(request, lease, CultMeshAuthorityDenialReason.Revoked);
+            if (!string.Equals(lease.VerseId, request.Peer.VerseId, StringComparison.Ordinal)) return Decide(request, lease, CultMeshAuthorityDenialReason.VerseMismatch);
+            if (!string.Equals(lease.PeerId, request.Peer.PeerId, StringComparison.Ordinal)) return Decide(request, lease, CultMeshAuthorityDenialReason.PeerMismatch);
+            if (!string.Equals(lease.LeaseId, leaseId, StringComparison.Ordinal)) return Decide(request, lease, CultMeshAuthorityDenialReason.LeaseReferenceMismatch);
+            if (!lease.Roles.Contains(request.Role, StringComparer.Ordinal)) return Decide(request, lease, CultMeshAuthorityDenialReason.RoleNotGranted);
+            if (!request.Peer.Roles.Contains(request.Role, StringComparer.Ordinal)) return Decide(request, lease, CultMeshAuthorityDenialReason.RoleNotAdvertised);
+            if (!string.IsNullOrWhiteSpace(request.ShardId) && lease.ShardIds.Count != 0 && !lease.ShardIds.Contains(request.ShardId!, StringComparer.Ordinal))
+                return Decide(request, lease, CultMeshAuthorityDenialReason.ShardNotGranted);
+            if (!string.IsNullOrWhiteSpace(request.ShardId) && request.Peer.ShardIds.Count != 0 && !request.Peer.ShardIds.Contains(request.ShardId!, StringComparer.Ordinal))
+                return Decide(request, lease, CultMeshAuthorityDenialReason.ShardNotAdvertised);
+            if (lease.AuthorityEpoch.Value != request.AuthorityEpoch) return Decide(request, lease, CultMeshAuthorityDenialReason.EpochMismatch);
+            if (!string.IsNullOrWhiteSpace(request.ResourceScope) && !lease.ResourceScopes.Contains(request.ResourceScope!, StringComparer.Ordinal))
+                return Decide(request, lease, CultMeshAuthorityDenialReason.ResourceScopeNotGranted);
+            return Decide(request, lease, CultMeshAuthorityDenialReason.None);
+        }
+
+        internal static CultMeshAuthorityResolver CreateDenyByDefault(ICultMeshAuthorityLeaseSource leases, ICultMeshClock? clock = null) =>
+            new CultMeshAuthorityResolver(leases, DenyAllSignatures.Instance, NoRevocations.Instance, clock ?? CultMeshSystemClock.Instance);
+
+        private CultMeshAuthorityDecision Decide(CultMeshAuthorityRequest request, CultMeshAuthorityLease? lease, CultMeshAuthorityDenialReason reason)
+        {
+            var decision = new CultMeshAuthorityDecision(request, lease, reason);
+            _diagnostics.Emit(new CultMeshDiagnosticEvent(
+                Interlocked.Increment(ref _diagnosticSequence), _clock.UtcNow, CultMeshReliabilityOrgan.Authority,
+                CultMeshDiagnosticKind.AuthorityDecision, lease?.LeaseId ?? request.Peer.AuthorityLeaseId ?? "lease:missing",
+                request.Peer.PeerId, decision.IsAuthorized ? "authorized" : "denied", reason.ToString(), lease?.IssuerRuntimeId ?? "",
+                schemaVersion: "gamecult.mesh.authority_decision.v1"));
+            return decision;
+        }
+
+        private sealed class DenyAllSignatures : ICultMeshAuthoritySignatureVerifier
+        {
+            public static DenyAllSignatures Instance { get; } = new DenyAllSignatures();
+            public bool Verify(CultMeshAuthorityLease lease) => false;
+        }
+
+        private sealed class NoRevocations : ICultMeshAuthorityRevocationSource
+        {
+            public static NoRevocations Instance { get; } = new NoRevocations();
+            public bool IsRevoked(string leaseId, long authorityEpoch) => false;
+        }
+    }
+
+    public sealed class CultMeshAuthorityLeaseCatalog : ICultMeshAuthorityLeaseSource
+    {
+        private readonly Dictionary<string, CultMeshAuthorityLease> _leases = new(StringComparer.Ordinal);
+        public IReadOnlyList<CultMeshAuthorityLease> Leases => _leases.Values.OrderBy(lease => lease.LeaseId, StringComparer.Ordinal).ToArray();
+        public void Upsert(CultMeshAuthorityLease lease) { if (lease == null) throw new ArgumentNullException(nameof(lease)); _leases[lease.LeaseId] = lease; }
         public CultMeshAuthorityLease? Get(string leaseId)
         {
             if (string.IsNullOrWhiteSpace(leaseId)) throw new ArgumentException("Value must be non-empty.", nameof(leaseId));
             return _leases.TryGetValue(leaseId, out var lease) ? lease : null;
         }
 
-        /// <summary>
-        /// Returns whether a peer card is authorized for a role and optional shard.
-        /// </summary>
+        [Obsolete("Authority decisions belong to CultMeshAuthorityResolver. This compatibility path denies unsigned and unverifiable leases.")]
         public bool IsAuthorized(CultMeshPeerCard peer, string role, string? shardId = null, DateTimeOffset? at = null)
         {
             if (peer == null) throw new ArgumentNullException(nameof(peer));
-            if (string.IsNullOrWhiteSpace(peer.AuthorityLeaseId))
-            {
-                return false;
-            }
+            var lease = string.IsNullOrWhiteSpace(peer.AuthorityLeaseId) ? null : Get(peer.AuthorityLeaseId!);
+            var epoch = lease?.AuthorityEpoch ?? -1;
+            if (epoch < 0) return false;
+            var resolver = CultMeshAuthorityResolver.CreateDenyByDefault(this, at.HasValue ? new CatalogFixedClock(at.Value) : null);
+            return resolver.Resolve(new CultMeshAuthorityRequest(peer, role, shardId, epoch)).IsAuthorized;
+        }
 
-            return _leases.TryGetValue(peer.AuthorityLeaseId!, out var lease) &&
-                   lease.Covers(peer, role, shardId, at);
+        private sealed class CatalogFixedClock : ICultMeshClock
+        {
+            public CatalogFixedClock(DateTimeOffset now) => UtcNow = now;
+            public DateTimeOffset UtcNow { get; }
+            public System.Threading.Tasks.Task DelayAsync(TimeSpan delay, CancellationToken cancellationToken = default) => System.Threading.Tasks.Task.CompletedTask;
         }
     }
 }
diff --git a/src/GameCult.Mesh/CultMeshAuthorityProof.cs b/src/GameCult.Mesh/CultMeshAuthorityProof.cs
new file mode 100644
index 00000000..d4b2d0c8
--- /dev/null
+++ b/src/GameCult.Mesh/CultMeshAuthorityProof.cs
@@ -0,0 +1,349 @@
+using System;
+using System.Buffers.Binary;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Security.Cryptography;
+using System.Text;
+using GameCult.Networking;
+
+namespace GameCult.Mesh
+{
+    public enum CultMeshAuthorityTrustMode
+    {
+        AuthenticatedRemote,
+        LocalDevelopment
+    }
+
+    public sealed class CultMeshEcdsaP256PublicKey
+    {
+        public CultMeshEcdsaP256PublicKey(string keyId, string x, string y)
+        {
+            KeyId = Require(keyId, nameof(keyId));
+            X = RequireCoordinate(x, nameof(x));
+            Y = RequireCoordinate(y, nameof(y));
+        }
+
+        public string KeyId { get; }
+        public string X { get; }
+        public string Y { get; }
+
+        internal ECDsa CreateVerifier()
+        {
+            var verifier = ECDsa.Create();
+            verifier.ImportParameters(new ECParameters
+            {
+                Curve = ECCurve.NamedCurves.nistP256,
+                Q = new ECPoint { X = Convert.FromBase64String(X), Y = Convert.FromBase64String(Y) }
+            });
+            return verifier;
+        }
+
+        public static CultMeshEcdsaP256PublicKey From(string keyId, ECDsa key)
+        {
+            if (key == null) throw new ArgumentNullException(nameof(key));
+            var parameters = key.ExportParameters(false);
+            return new CultMeshEcdsaP256PublicKey(
+                keyId,
+                Convert.ToBase64String(parameters.Q.X ?? throw new InvalidOperationException("P-256 key has no X coordinate.")),
+                Convert.ToBase64String(parameters.Q.Y ?? throw new InvalidOperationException("P-256 key has no Y coordinate.")));
+        }
+
+        private static string RequireCoordinate(string value, string name)
+        {
+            var required = Require(value, name);
+            byte[] bytes;
+            try { bytes = Convert.FromBase64String(required); }
+            catch (FormatException error) { throw new ArgumentException("P-256 coordinates must be base64.", name, error); }
+            if (bytes.Length != 32) throw new ArgumentException("P-256 coordinates must contain 32 bytes.", name);
+            return required;
+        }
+
+        private static string Require(string value, string name) =>
+            string.IsNullOrWhiteSpace(value) ? throw new ArgumentException("Value must be non-empty.", name) : value.Trim();
+    }
+
+    public sealed class CultMeshRouteCertificate
+    {
+        public CultMeshRouteCertificate(
+            CultMeshEcdsaP256PublicKey providerKey,
+            string odinKeyId,
+            long issuedAtUnixMilliseconds,
+            long expiresAtUnixMilliseconds,
+            string signature)
+        {
+            ProviderKey = providerKey ?? throw new ArgumentNullException(nameof(providerKey));
+            OdinKeyId = string.IsNullOrWhiteSpace(odinKeyId)
+                ? throw new ArgumentException("Odin key identity is required.", nameof(odinKeyId))
+                : odinKeyId.Trim();
+            if (issuedAtUnixMilliseconds < 0) throw new ArgumentOutOfRangeException(nameof(issuedAtUnixMilliseconds));
+            if (expiresAtUnixMilliseconds <= issuedAtUnixMilliseconds) throw new ArgumentOutOfRangeException(nameof(expiresAtUnixMilliseconds));
+            IssuedAtUnixMilliseconds = issuedAtUnixMilliseconds;
+            ExpiresAtUnixMilliseconds = expiresAtUnixMilliseconds;
+            Signature = signature?.Trim() ?? string.Empty;
+        }
+
+        public CultMeshEcdsaP256PublicKey ProviderKey { get; }
+        public string OdinKeyId { get; }
+        public long IssuedAtUnixMilliseconds { get; }
+        public long ExpiresAtUnixMilliseconds { get; }
+        public string Signature { get; }
+    }
+
+    public sealed class CultMeshAuthorityTrustPolicy
+    {
+        private readonly Dictionary<string, CultMeshEcdsaP256PublicKey> _odinRoots;
+
+        public CultMeshAuthorityTrustPolicy(
+            CultMeshAuthorityTrustMode mode,
+            IEnumerable<CultMeshEcdsaP256PublicKey>? odinRoots = null)
+        {
+            Mode = mode;
+            _odinRoots = (odinRoots ?? Array.Empty<CultMeshEcdsaP256PublicKey>())
+                .ToDictionary(key => key.KeyId, StringComparer.Ordinal);
+        }
+
+        public CultMeshAuthorityTrustMode Mode { get; }
+        public IReadOnlyCollection<CultMeshEcdsaP256PublicKey> OdinRoots => _odinRoots.Values;
+
+        /// <summary>Fails closed unless the route is valid under this consumer-owned policy.</summary>
+        public void Validate(string verseId, CultMeshAuthorityRoute route, DateTimeOffset now) =>
+            Verify(verseId, route, now);
+
+        internal CultMeshVerifiedAuthorityRoute Verify(
+            string verseId,
+            CultMeshAuthorityRoute route,
+            DateTimeOffset now)
+        {
+            if (route == null) throw new ArgumentNullException(nameof(route));
+            var certificate = route.Certificate;
+            if (certificate == null || string.IsNullOrWhiteSpace(certificate.Signature))
+            {
+                if (Mode == CultMeshAuthorityTrustMode.LocalDevelopment && IsLoopback(route.Endpoint))
+                    return CultMeshVerifiedAuthorityRoute.Local(route);
+                throw Failure(route, "Remote CultMesh routes require an Odin-signed authority certificate.");
+            }
+            if (!IsProtected(route.Endpoint) &&
+                !(Mode == CultMeshAuthorityTrustMode.LocalDevelopment && IsLoopback(route.Endpoint)))
+                throw Failure(route, "Authenticated remote CultMesh routes require TLS or QUIC channel protection.");
+            if (!_odinRoots.TryGetValue(certificate.OdinKeyId, out var root))
+                throw Failure(route, $"Odin key '{certificate.OdinKeyId}' is not trusted by this consumer.");
+            var nowMs = now.ToUnixTimeMilliseconds();
+            if (nowMs < certificate.IssuedAtUnixMilliseconds || nowMs >= certificate.ExpiresAtUnixMilliseconds)
+                throw Failure(route, "The Odin route certificate is not currently valid.");
+            byte[] signature;
+            try { signature = Convert.FromBase64String(certificate.Signature); }
+            catch (FormatException error) { throw Failure(route, "The Odin route signature is not base64.", error); }
+            if (signature.Length != 64) throw Failure(route, "The Odin route signature is not IEEE P1363 P-256.");
+            using var verifier = root.CreateVerifier();
+            if (!verifier.VerifyData(
+                    CultMeshAuthorityProof.CanonicalRoute(verseId, route),
+                    signature,
+                    HashAlgorithmName.SHA256))
+                throw Failure(route, "The Odin route certificate signature is invalid.");
+            return CultMeshVerifiedAuthorityRoute.Authenticated(route, certificate.ProviderKey);
+        }
+
+        private static bool IsLoopback(string endpoint)
+        {
+            if (!Uri.TryCreate(endpoint, UriKind.Absolute, out var uri)) return false;
+            return uri.IsLoopback ||
+                string.Equals(uri.Host, "localhost", StringComparison.OrdinalIgnoreCase) ||
+                string.Equals(uri.Host, "127.0.0.1", StringComparison.Ordinal) ||
+                string.Equals(uri.Host, "::1", StringComparison.Ordinal);
+        }
+
+        private static bool IsProtected(string endpoint)
+        {
+            if (!Uri.TryCreate(endpoint, UriKind.Absolute, out var uri)) return false;
+            return string.Equals(uri.Scheme, "wss", StringComparison.OrdinalIgnoreCase) ||
+                string.Equals(uri.Scheme, "https", StringComparison.OrdinalIgnoreCase) ||
+                uri.Scheme.IndexOf("quic", StringComparison.OrdinalIgnoreCase) >= 0;
+        }
+
+        private static CultMeshSessionException Failure(CultMeshAuthorityRoute route, string message, Exception? inner = null) =>
+            new CultMeshSessionException(new CultMeshSessionFailure(
+                CultMeshSessionFailureReason.Authentication,
+                message,
+                route.Endpoint), inner);
+    }
+
+    internal sealed class CultMeshVerifiedAuthorityRoute
+    {
+        private CultMeshVerifiedAuthorityRoute(
+            CultMeshAuthorityRoute route,
+            CultMeshEcdsaP256PublicKey? providerKey,
+            bool localDevelopment)
+        {
+            Route = route;
+            ProviderKey = providerKey;
+            IsLocalDevelopment = localDevelopment;
+        }
+
+        public CultMeshAuthorityRoute Route { get; }
+        public CultMeshEcdsaP256PublicKey? ProviderKey { get; }
+        public bool IsLocalDevelopment { get; }
+        public static CultMeshVerifiedAuthorityRoute Authenticated(CultMeshAuthorityRoute route, CultMeshEcdsaP256PublicKey key) => new(route, key, false);
+        public static CultMeshVerifiedAuthorityRoute Local(CultMeshAuthorityRoute route) => new(route, null, true);
+    }
+
+    public sealed class CultMeshSessionProofSigner
+    {
+        private readonly ECDsa _key;
+
+        public CultMeshSessionProofSigner(CultMeshAuthorityRoute route, ECDsa providerPrivateKey)
+        {
+            Route = route ?? throw new ArgumentNullException(nameof(route));
+            _key = providerPrivateKey ?? throw new ArgumentNullException(nameof(providerPrivateKey));
+            var certificate = route.Certificate ?? throw new ArgumentException("A session proof signer requires a certified route.", nameof(route));
+            ProviderKeyId = certificate.ProviderKey.KeyId;
+            var exported = CultMeshEcdsaP256PublicKey.From(ProviderKeyId, _key);
+            if (!string.Equals(exported.X, certificate.ProviderKey.X, StringComparison.Ordinal) ||
+                !string.Equals(exported.Y, certificate.ProviderKey.Y, StringComparison.Ordinal))
+                throw new ArgumentException("Provider private key does not match the certified route key.", nameof(providerPrivateKey));
+        }
+
+        public CultMeshAuthorityRoute Route { get; }
+        public string ProviderKeyId { get; }
+
+        public string Sign(CultMeshSessionOpenMessage request)
+        {
+            var bytes = CultMeshAuthorityProof.CanonicalSession(request, Route.Endpoint);
+            return Convert.ToBase64String(CultMeshAuthorityProof.SignP256(_key, bytes));
+        }
+    }
+
+    public static class CultMeshAuthorityProof
+    {
+        private const string RouteDomain = "gamecult.cultmesh.route-certificate.v1";
+        private const string SessionDomain = "gamecult.cultmesh.session-proof.v1";
+
+        public static CultMeshAuthorityRoute CreateSignedRoute(
+            string verseId,
+            string authorityRuntimeId,
+            string endpoint,
+            IEnumerable<string> protocolIds,
+            int priority,
+            string generation,
+            CultMeshEcdsaP256PublicKey providerKey,
+            string odinKeyId,
+            DateTimeOffset issuedAt,
+            DateTimeOffset expiresAt,
+            ECDsa odinPrivateKey)
+        {
+            if (odinPrivateKey == null) throw new ArgumentNullException(nameof(odinPrivateKey));
+            var unsignedCertificate = new CultMeshRouteCertificate(
+                providerKey,
+                odinKeyId,
+                issuedAt.ToUnixTimeMilliseconds(),
+                expiresAt.ToUnixTimeMilliseconds(),
+                string.Empty);
+            var unsignedRoute = new CultMeshAuthorityRoute(
+                authorityRuntimeId, endpoint, protocolIds, priority, generation, unsignedCertificate);
+            var signature = Convert.ToBase64String(SignP256(
+                odinPrivateKey,
+                CanonicalRoute(verseId, unsignedRoute)));
+            return new CultMeshAuthorityRoute(
+                authorityRuntimeId,
+                endpoint,
+                protocolIds,
+                priority,
+                generation,
+                new CultMeshRouteCertificate(
+                    providerKey,
+                    odinKeyId,
+                    issuedAt.ToUnixTimeMilliseconds(),
+                    expiresAt.ToUnixTimeMilliseconds(),
+                    signature));
+        }
+
+        /// <summary>Verifies both the Odin route certificate and provider nonce proof.</summary>
+        public static bool VerifySessionProof(
+            CultMeshSessionOpenMessage request,
+            CultMeshSessionAcceptedMessage response,
+            string verseId,
+            CultMeshAuthorityRoute route,
+            CultMeshAuthorityTrustPolicy trust,
+            DateTimeOffset now)
+        {
+            if (request == null) throw new ArgumentNullException(nameof(request));
+            if (response == null) throw new ArgumentNullException(nameof(response));
+            if (trust == null) throw new ArgumentNullException(nameof(trust));
+            return VerifySession(request, response, trust.Verify(verseId, route, now));
+        }
+
+        internal static byte[] CanonicalRoute(string verseId, CultMeshAuthorityRoute route)
+        {
+            var certificate = route.Certificate ?? throw new InvalidOperationException("Route certificate is required.");
+            return Canonical(
+                RouteDomain,
+                verseId,
+                route.AuthorityRuntimeId,
+                route.Endpoint,
+                string.Join("\u001f", route.ProtocolIds.OrderBy(value => value, StringComparer.Ordinal)),
+                route.Priority.ToString(System.Globalization.CultureInfo.InvariantCulture),
+                route.Generation,
+                certificate.ProviderKey.KeyId,
+                certificate.ProviderKey.X,
+                certificate.ProviderKey.Y,
+                certificate.OdinKeyId,
+                certificate.IssuedAtUnixMilliseconds.ToString(System.Globalization.CultureInfo.InvariantCulture),
+                certificate.ExpiresAtUnixMilliseconds.ToString(System.Globalization.CultureInfo.InvariantCulture));
+        }
+
+        internal static byte[] CanonicalSession(CultMeshSessionOpenMessage request, string endpoint) => Canonical(
+            SessionDomain,
+            request.ClientNonce ?? string.Empty,
+            request.MessageId ?? string.Empty,
+            request.SourceRuntimeId ?? string.Empty,
+            request.VerseId ?? string.Empty,
+            request.AuthorityRuntimeId ?? string.Empty,
+            request.ProtocolId ?? string.Empty,
+            endpoint ?? string.Empty,
+            request.RouteGeneration ?? string.Empty);
+
+        internal static bool VerifySession(
+            CultMeshSessionOpenMessage request,
+            CultMeshSessionAcceptedMessage response,
+            CultMeshVerifiedAuthorityRoute route)
+        {
+            if (route.IsLocalDevelopment) return true;
+            if (route.ProviderKey == null ||
+                !string.Equals(response.ProviderKeyId, route.ProviderKey.KeyId, StringComparison.Ordinal) ||
+                !string.Equals(response.ClientNonce, request.ClientNonce, StringComparison.Ordinal) ||
+                string.IsNullOrWhiteSpace(response.ProviderSignature))
+                return false;
+            byte[] signature;
+            try { signature = Convert.FromBase64String(response.ProviderSignature); }
+            catch (FormatException) { return false; }
+            if (signature.Length != 64) return false;
+            using var verifier = route.ProviderKey.CreateVerifier();
+            return verifier.VerifyData(
+                CanonicalSession(request, route.Route.Endpoint),
+                signature,
+                HashAlgorithmName.SHA256);
+        }
+
+        internal static byte[] SignP256(ECDsa key, byte[] payload)
+        {
+            var signature = key.SignData(payload, HashAlgorithmName.SHA256);
+            if (signature.Length != 64)
+                throw new CryptographicException("ECDSA provider did not emit IEEE P1363 P-256 signature bytes.");
+            return signature;
+        }
+
+        private static byte[] Canonical(params string[] values)
+        {
+            using var stream = new MemoryStream();
+            var length = new byte[4];
+            foreach (var value in values)
+            {
+                var bytes = Encoding.UTF8.GetBytes(value ?? string.Empty);
+                BinaryPrimitives.WriteInt32BigEndian(length, bytes.Length);
+                stream.Write(length, 0, length.Length);
+                stream.Write(bytes, 0, bytes.Length);
+            }
+            return stream.ToArray();
+        }
+    }
+}
diff --git a/src/GameCult.Mesh/CultMeshBodies.cs b/src/GameCult.Mesh/CultMeshBodies.cs
new file mode 100644
index 00000000..0c740c18
--- /dev/null
+++ b/src/GameCult.Mesh/CultMeshBodies.cs
@@ -0,0 +1,640 @@
+using System;
+using System.IO;
+using System.IO.MemoryMappedFiles;
+using System.Security.Cryptography;
+using System.Collections.Generic;
+using System.Collections.Concurrent;
+using System.Linq;
+using MessagePack;
+
+#nullable enable
+
+namespace GameCult.Mesh
+{
+    public enum CultMeshBodyAccessMode
+    {
+        ReadOnly = 0,
+        ReadWrite = 1
+    }
+
+    public enum CultMeshBodySynchronization
+    {
+        ImmutableSequence = 0,
+        EpochSequence = 1,
+        TripleBuffer = 2
+    }
+
+    public enum CultMeshBodyTransportKind
+    {
+        Network = 0,
+        SharedFileMapping = 1,
+        SharedMemory = 2
+    }
+
+    [MessagePackObject]
+    public sealed class CultMeshBodyDescriptor
+    {
+        [Key(0)] public string BodyId { get; set; } = string.Empty;
+        [Key(1)] public string SchemaId { get; set; } = string.Empty;
+        [Key(2)] public int LayoutVersion { get; set; }
+        [Key(3)] public long ByteSize { get; set; }
+        [Key(4)] public int Capacity { get; set; }
+        [Key(5)] public long ProducerEpoch { get; set; }
+        [Key(6)] public long Sequence { get; set; }
+        [Key(7)] public CultMeshBodyAccessMode AccessMode { get; set; } = CultMeshBodyAccessMode.ReadOnly;
+        [Key(8)] public CultMeshBodySynchronization Synchronization { get; set; } = CultMeshBodySynchronization.ImmutableSequence;
+        [Key(9)] public long LeaseExpiresAtUnixMs { get; set; }
+        [Key(10)] public CultMeshBodyTransportKind TransportKind { get; set; } = CultMeshBodyTransportKind.Network;
+        [Key(11)] public string CapabilityToken { get; set; } = string.Empty;
+        [Key(12)] public string SemanticHash { get; set; } = string.Empty;
+    }
+
+    public sealed class CultMeshBodyValidationRequest
+    {
+        public string BodyId { get; set; } = string.Empty;
+        public string SchemaId { get; set; } = string.Empty;
+        public int LayoutVersion { get; set; }
+        public long ProducerEpoch { get; set; }
+        public long? Sequence { get; set; }
+        public int? Capacity { get; set; }
+        public CultMeshBodyAccessMode AccessMode { get; set; } = CultMeshBodyAccessMode.ReadOnly;
+        public DateTimeOffset NowUtc { get; set; } = DateTimeOffset.UtcNow;
+    }
+
+    public static class CultMeshBodyDescriptorValidator
+    {
+        public static string ComputeSemanticHash(ReadOnlySpan<byte> body)
+        {
+            using var sha256 = SHA256.Create();
+            Span<byte> digest = stackalloc byte[32];
+            if (!sha256.TryComputeHash(body, digest, out var written) || written != digest.Length)
+                throw new CryptographicException("Unable to compute the CultMesh body semantic digest.");
+            return BitConverter.ToString(digest.ToArray())
+                .Replace("-", string.Empty)
+                .ToLowerInvariant();
+        }
+
+        public static void Validate(CultMeshBodyDescriptor descriptor, CultMeshBodyValidationRequest request)
+        {
+            if (descriptor == null) throw new ArgumentNullException(nameof(descriptor));
+            if (request == null) throw new ArgumentNullException(nameof(request));
+            if (string.IsNullOrWhiteSpace(descriptor.BodyId) ||
+                !string.Equals(descriptor.BodyId, request.BodyId, StringComparison.Ordinal))
+                throw new InvalidOperationException("CultMesh body identity mismatch.");
+            if (string.IsNullOrWhiteSpace(descriptor.SchemaId) ||
+                !string.Equals(descriptor.SchemaId, request.SchemaId, StringComparison.Ordinal))
+                throw new InvalidOperationException("CultMesh body schema mismatch.");
+            if (descriptor.LayoutVersion != request.LayoutVersion)
+                throw new InvalidOperationException("CultMesh body layout version mismatch.");
+            if (descriptor.ProducerEpoch != request.ProducerEpoch)
+                throw new InvalidOperationException("CultMesh body producer epoch mismatch.");
+            if (request.Sequence.HasValue && descriptor.Sequence != request.Sequence.Value)
+                throw new InvalidOperationException("CultMesh body sequence mismatch.");
+            if (request.Capacity.HasValue && descriptor.Capacity != request.Capacity.Value)
+                throw new InvalidOperationException("CultMesh body capacity mismatch.");
+            if (descriptor.ByteSize < 0 || descriptor.Capacity < 0)
+                throw new InvalidOperationException("CultMesh body size and logical capacity must be non-negative.");
+            if (descriptor.Sequence < 0)
+                throw new InvalidOperationException("CultMesh body sequence must be non-negative.");
+            if (descriptor.LeaseExpiresAtUnixMs <= request.NowUtc.ToUnixTimeMilliseconds())
+                throw new InvalidOperationException("CultMesh body lease has expired.");
+            if (request.AccessMode != CultMeshBodyAccessMode.ReadOnly ||
+                descriptor.AccessMode != CultMeshBodyAccessMode.ReadOnly)
+                throw new UnauthorizedAccessException("CultMesh body consumers are read-only by default.");
+        }
+    }
+
+    public sealed class CultMeshBodyNegotiationResult
+    {
+        internal CultMeshBodyNegotiationResult(
+            ICultMeshBodyReadLease lease,
+            CultMeshBodyTransportKind preferredTransport,
+            Exception? preferredFailure)
+        {
+            Lease = lease;
+            PreferredTransport = preferredTransport;
+            PreferredFailure = preferredFailure;
+        }
+
+        public ICultMeshBodyReadLease Lease { get; }
+        public CultMeshBodyTransportKind PreferredTransport { get; }
+        public CultMeshBodyTransportKind SelectedTransport => Lease.TransportKind;
+        public Exception? PreferredFailure { get; }
+        public bool UsedFallback => SelectedTransport != PreferredTransport;
+    }
+
+    public interface ICultMeshBodyReadLease : IDisposable
+    {
+        CultMeshBodyDescriptor Descriptor { get; }
+        CultMeshBodyTransportKind TransportKind { get; }
+        byte ReadByte(long offset);
+        int ReadInt32(long offset);
+        long ReadInt64(long offset);
+        float ReadSingle(long offset);
+        double ReadDouble(long offset);
+        int CopyTo(long offset, byte[] destination, int destinationOffset, int count);
+    }
+
+    public interface ICultMeshBodyTransportAdapter
+    {
+        CultMeshBodyTransportKind TransportKind { get; }
+        bool CanOpen(CultMeshBodyDescriptor descriptor);
+        ICultMeshBodyReadLease OpenReadOnly(
+            CultMeshBodyDescriptor descriptor,
+            CultMeshBodyValidationRequest request);
+    }
+
+    public sealed class CultMeshBodyTransportService
+    {
+        private readonly IReadOnlyDictionary<CultMeshBodyTransportKind, ICultMeshBodyTransportAdapter> _adapters;
+        private readonly Func<CultMeshBodyDescriptor, bool> _authorizeProducer;
+        private readonly Func<string, CultMeshBodyDescriptor, bool>? _authorizeNamedProducer;
+
+        /// <summary>Gets locally available body planes in fastest-local-first order.</summary>
+        public IReadOnlyList<CultMeshBodyTransportKind> SupportedTransports => _adapters.Keys
+            .OrderByDescending(TransportPreference)
+            .ToArray();
+
+        public CultMeshBodyTransportService(
+            IEnumerable<ICultMeshBodyTransportAdapter> adapters,
+            Func<CultMeshBodyDescriptor, bool> authorizeProducer)
+        {
+            _adapters = (adapters ?? throw new ArgumentNullException(nameof(adapters)))
+                .ToDictionary(adapter => adapter.TransportKind);
+            _authorizeProducer = authorizeProducer ?? throw new ArgumentNullException(nameof(authorizeProducer));
+        }
+
+        public CultMeshBodyTransportService(
+            IEnumerable<ICultMeshBodyTransportAdapter> adapters,
+            Func<string, CultMeshBodyDescriptor, bool> authorizeProducer)
+        {
+            _adapters = (adapters ?? throw new ArgumentNullException(nameof(adapters)))
+                .ToDictionary(adapter => adapter.TransportKind);
+            _authorizeProducer = _ => true;
+            _authorizeNamedProducer = authorizeProducer ?? throw new ArgumentNullException(nameof(authorizeProducer));
+        }
+
+        public ICultMeshBodyReadLease OpenReadOnly(
+            CultMeshBodyDescriptor preferred,
+            CultMeshBodyDescriptor networkFallback,
+            CultMeshBodyValidationRequest request,
+            out Exception? localFailure)
+        {
+            var result = NegotiateReadOnly(preferred, networkFallback, request);
+            localFailure = result.PreferredFailure;
+            return result.Lease;
+        }
+
+        public CultMeshBodyNegotiationResult NegotiateReadOnly(
+            CultMeshBodyDescriptor preferred,
+            CultMeshBodyDescriptor networkFallback,
+            CultMeshBodyValidationRequest request)
+        {
+            return NegotiateReadOnly(null, new[] { preferred, networkFallback }, request);
+        }
+
+        internal CultMeshBodyNegotiationResult NegotiateReadOnly(
+            string? producerId,
+            CultMeshBodyDescriptor preferred,
+            CultMeshBodyDescriptor networkFallback,
+            CultMeshBodyValidationRequest request)
+        {
+            return NegotiateReadOnly(producerId, new[] { preferred, networkFallback }, request);
+        }
+
+        /// <summary>
+        /// Selects the first representation the consumer can validate and open. Representation order is
+        /// publisher preference; adapter availability and capability validity decide the actual plane.
+        /// </summary>
+        public CultMeshBodyNegotiationResult NegotiateReadOnly(
+            IReadOnlyList<CultMeshBodyDescriptor> representations,
+            CultMeshBodyValidationRequest request) =>
+            NegotiateReadOnly(null, representations, request);
+
+        internal CultMeshBodyNegotiationResult NegotiateReadOnly(
+            string? producerId,
+            IReadOnlyList<CultMeshBodyDescriptor> representations,
+            CultMeshBodyValidationRequest request)
+        {
+            if (representations == null) throw new ArgumentNullException(nameof(representations));
+            if (representations.Count == 0 || representations.Any(value => value == null))
+                throw new ArgumentException("At least one body representation is required.", nameof(representations));
+            var preferred = representations[0];
+            foreach (var representation in representations)
+            {
+                if (!SameLogicalGeneration(preferred, representation))
+                    throw new InvalidOperationException("CultMesh representations describe different logical body generations.");
+                CultMeshBodyDescriptorValidator.Validate(representation, request);
+            }
+            var authorized = _authorizeNamedProducer == null
+                ? _authorizeProducer(preferred)
+                : !string.IsNullOrWhiteSpace(producerId) && _authorizeNamedProducer(producerId!, preferred);
+            if (!authorized)
+                throw new UnauthorizedAccessException("CultMesh body producer is not authorized for this logical body.");
+
+            Exception? preferredFailure = null;
+            foreach (var representation in representations)
+            {
+                try
+                {
+                    if (!_adapters.TryGetValue(representation.TransportKind, out var adapter))
+                        throw new NotSupportedException($"No CultMesh {representation.TransportKind} body adapter is available.");
+                    if (!adapter.CanOpen(representation))
+                        throw new NotSupportedException($"The CultMesh {representation.TransportKind} body adapter declined its descriptor.");
+                    var lease = adapter.OpenReadOnly(representation, request);
+                    return new CultMeshBodyNegotiationResult(
+                        lease,
+                        preferred.TransportKind,
+                        preferredFailure);
+                }
+                catch (Exception error) when (!(error is UnauthorizedAccessException))
+                {
+                    preferredFailure ??= error;
+                }
+            }
+
+            throw new NotSupportedException(
+                "No advertised CultMesh body representation could be opened by this consumer.",
+                preferredFailure);
+        }
+
+        private static bool SameLogicalGeneration(CultMeshBodyDescriptor left, CultMeshBodyDescriptor right) =>
+            string.Equals(left.BodyId, right.BodyId, StringComparison.Ordinal) &&
+            string.Equals(left.SchemaId, right.SchemaId, StringComparison.Ordinal) &&
+            left.LayoutVersion == right.LayoutVersion &&
+            left.ProducerEpoch == right.ProducerEpoch &&
+            left.Sequence == right.Sequence &&
+            left.ByteSize == right.ByteSize &&
+            left.Capacity == right.Capacity &&
+            left.AccessMode == right.AccessMode &&
+            left.Synchronization == right.Synchronization &&
+            string.Equals(left.SemanticHash, right.SemanticHash, StringComparison.Ordinal);
+
+        private static int TransportPreference(CultMeshBodyTransportKind transport) => transport switch
+        {
+            CultMeshBodyTransportKind.SharedMemory => 3,
+            CultMeshBodyTransportKind.SharedFileMapping => 2,
+            _ => 1
+        };
+    }
+
+    public sealed class CultMeshMappedBodyPublisher
+    {
+        private readonly string _rootPath;
+        private readonly TimeSpan _leaseDuration;
+
+        public CultMeshMappedBodyPublisher(string rootPath, TimeSpan? leaseDuration = null)
+        {
+            _rootPath = string.IsNullOrWhiteSpace(rootPath)
+                ? throw new ArgumentException("Mapped body root is required.", nameof(rootPath))
+                : Path.GetFullPath(rootPath);
+            _leaseDuration = leaseDuration ?? TimeSpan.FromSeconds(5);
+            if (_leaseDuration <= TimeSpan.Zero) throw new ArgumentOutOfRangeException(nameof(leaseDuration));
+            Directory.CreateDirectory(_rootPath);
+        }
+
+        public CultMeshBodyDescriptor Publish(
+            string bodyId,
+            string schemaId,
+            int layoutVersion,
+            int logicalCapacity,
+            long producerEpoch,
+            long sequence,
+            ReadOnlySpan<byte> body,
+            DateTimeOffset nowUtc)
+        {
+            if (string.IsNullOrWhiteSpace(bodyId)) throw new ArgumentException("Body identity is required.", nameof(bodyId));
+            if (string.IsNullOrWhiteSpace(schemaId)) throw new ArgumentException("Schema identity is required.", nameof(schemaId));
+            if (layoutVersion < 0) throw new ArgumentOutOfRangeException(nameof(layoutVersion));
+            if (logicalCapacity < 0) throw new ArgumentOutOfRangeException(nameof(logicalCapacity));
+            if (producerEpoch < 0) throw new ArgumentOutOfRangeException(nameof(producerEpoch));
+            if (sequence < 0) throw new ArgumentOutOfRangeException(nameof(sequence));
+
+            var token = CreateCapabilityToken();
+            var finalPath = ResolveTokenPath(token);
+            var temporaryPath = finalPath + ".tmp";
+            using (var stream = new FileStream(temporaryPath, FileMode.CreateNew, FileAccess.Write, FileShare.None))
+                stream.Write(body);
+            File.Move(temporaryPath, finalPath);
+            return new CultMeshBodyDescriptor
+            {
+                BodyId = bodyId,
+                SchemaId = schemaId,
+                LayoutVersion = layoutVersion,
+                ByteSize = body.Length,
+                Capacity = logicalCapacity,
+                ProducerEpoch = producerEpoch,
+                Sequence = sequence,
+                AccessMode = CultMeshBodyAccessMode.ReadOnly,
+                Synchronization = CultMeshBodySynchronization.ImmutableSequence,
+                LeaseExpiresAtUnixMs = nowUtc.Add(_leaseDuration).ToUnixTimeMilliseconds(),
+                TransportKind = CultMeshBodyTransportKind.SharedFileMapping,
+                CapabilityToken = token,
+                SemanticHash = CultMeshBodyDescriptorValidator.ComputeSemanticHash(body)
+            };
+        }
+
+        public void Revoke(CultMeshBodyDescriptor descriptor)
+        {
+            if (descriptor == null || string.IsNullOrWhiteSpace(descriptor.CapabilityToken)) return;
+            var path = ResolveTokenPath(descriptor.CapabilityToken);
+            if (File.Exists(path)) File.Delete(path);
+        }
+
+        private string ResolveTokenPath(string token)
+        {
+            if (token.IndexOfAny(Path.GetInvalidFileNameChars()) >= 0 || token.Contains(".."))
+                throw new InvalidOperationException("Invalid CultMesh body capability token.");
+            var path = Path.GetFullPath(Path.Combine(_rootPath, token + ".body"));
+            if (!path.StartsWith(_rootPath + Path.DirectorySeparatorChar, StringComparison.OrdinalIgnoreCase))
+                throw new InvalidOperationException("CultMesh body token escaped the broker root.");
+            return path;
+        }
+
+        private static string CreateCapabilityToken()
+        {
+            var bytes = new byte[32];
+            using (var random = RandomNumberGenerator.Create()) random.GetBytes(bytes);
+            return BitConverter.ToString(bytes).Replace("-", string.Empty).ToLowerInvariant();
+        }
+    }
+
+    public sealed class CultMeshMappedBodyAdapter : ICultMeshBodyTransportAdapter
+    {
+        private readonly string? _rootPath;
+        private readonly CultMeshVerifiedBodyMappingBroker? _verifiedBodies;
+
+        public CultMeshMappedBodyAdapter(string rootPath) =>
+            _rootPath = Path.GetFullPath(string.IsNullOrWhiteSpace(rootPath)
+                ? throw new ArgumentException("Mapped body root is required.", nameof(rootPath))
+                : rootPath);
+
+        public CultMeshMappedBodyAdapter(CultMeshVerifiedBodyMappingBroker verifiedBodies) =>
+            _verifiedBodies = verifiedBodies ?? throw new ArgumentNullException(nameof(verifiedBodies));
+
+        public CultMeshBodyTransportKind TransportKind => CultMeshBodyTransportKind.SharedFileMapping;
+
+        public bool CanOpen(CultMeshBodyDescriptor descriptor) =>
+            descriptor != null && descriptor.TransportKind == TransportKind;
+
+        public ICultMeshBodyReadLease OpenReadOnly(
+            CultMeshBodyDescriptor descriptor,
+            CultMeshBodyValidationRequest request)
+        {
+            CultMeshBodyDescriptorValidator.Validate(descriptor, request);
+            if (descriptor.TransportKind != CultMeshBodyTransportKind.SharedFileMapping)
+                throw new NotSupportedException($"CultMesh body transport '{descriptor.TransportKind}' is not a file mapping.");
+            if (string.IsNullOrWhiteSpace(descriptor.CapabilityToken))
+                throw new InvalidOperationException("Mapped CultMesh body descriptor has no transport capability token.");
+            var path = _verifiedBodies != null
+                ? _verifiedBodies.Resolve(descriptor.CapabilityToken, request.NowUtc)
+                : ResolvePublisherPath(descriptor.CapabilityToken);
+            var info = new FileInfo(path);
+            if (!info.Exists || info.Length != descriptor.ByteSize)
+                throw new InvalidDataException("Mapped CultMesh body size does not match its descriptor.");
+            return new CultMeshMappedBodyLease(descriptor, path);
+        }
+
+        private string ResolvePublisherPath(string token)
+        {
+            if (token.IndexOfAny(Path.GetInvalidFileNameChars()) >= 0 || token.Contains(".."))
+                throw new UnauthorizedAccessException("Invalid CultMesh body capability token.");
+            var path = Path.GetFullPath(Path.Combine(_rootPath!, token + ".body"));
+            if (!path.StartsWith(_rootPath + Path.DirectorySeparatorChar, StringComparison.OrdinalIgnoreCase))
+                throw new UnauthorizedAccessException("CultMesh body token escaped the broker root.");
+            return path;
+        }
+    }
+
+    public sealed class CultMeshVerifiedBodyMappingBroker
+    {
+        private sealed class Grant
+        {
+            public string Path { get; set; } = string.Empty;
+            public long ExpiresAtUnixMs { get; set; }
+        }
+
+        private readonly string _cacheDirectory;
+        private readonly ConcurrentDictionary<string, Grant> _grants = new(StringComparer.Ordinal);
+
+        public CultMeshVerifiedBodyMappingBroker(string cacheDirectory) =>
+            _cacheDirectory = Path.GetFullPath(string.IsNullOrWhiteSpace(cacheDirectory)
+                ? throw new ArgumentException("Verified body cache directory is required.", nameof(cacheDirectory))
+                : cacheDirectory);
+
+        internal CultMeshBodyDescriptor GrantVerified(
+            string contentHash,
+            string verifiedPath,
+            CultMeshBodyDescriptor networkDescriptor,
+            DateTimeOffset expiresAtUtc)
+        {
+            if (networkDescriptor == null) throw new ArgumentNullException(nameof(networkDescriptor));
+            var expectedPath = Path.Combine(_cacheDirectory, contentHash + ".body");
+            if (!string.Equals(Path.GetFullPath(verifiedPath), expectedPath, StringComparison.OrdinalIgnoreCase))
+                throw new InvalidOperationException("Only the transfer-owned verified body may be mapped.");
+            var info = new FileInfo(expectedPath);
+            if (!info.Exists || info.Length != networkDescriptor.ByteSize)
+                throw new InvalidDataException("Verified CultMesh body size does not match its network descriptor.");
+
+            var token = CreateCapabilityToken();
+            var expiresAtUnixMs = expiresAtUtc.ToUnixTimeMilliseconds();
+            _grants[token] = new Grant { Path = expectedPath, ExpiresAtUnixMs = expiresAtUnixMs };
+            return new CultMeshBodyDescriptor
+            {
+                BodyId = networkDescriptor.BodyId,
+                SchemaId = networkDescriptor.SchemaId,
+                LayoutVersion = networkDescriptor.LayoutVersion,
+                ByteSize = networkDescriptor.ByteSize,
+                Capacity = networkDescriptor.Capacity,
+                ProducerEpoch = networkDescriptor.ProducerEpoch,
+                Sequence = networkDescriptor.Sequence,
+                AccessMode = CultMeshBodyAccessMode.ReadOnly,
+                Synchronization = networkDescriptor.Synchronization,
+                LeaseExpiresAtUnixMs = expiresAtUnixMs,
+                TransportKind = CultMeshBodyTransportKind.SharedFileMapping,
+                CapabilityToken = token,
+                SemanticHash = networkDescriptor.SemanticHash
+            };
+        }
+
+        internal string Resolve(string token, DateTimeOffset nowUtc)
+        {
+            if (!_grants.TryGetValue(token, out var grant))
+                throw new UnauthorizedAccessException("Unknown verified body capability token.");
+            if (grant.ExpiresAtUnixMs <= nowUtc.ToUnixTimeMilliseconds())
+            {
+                _grants.TryRemove(token, out _);
+                throw new InvalidOperationException("Verified body capability has expired.");
+            }
+            return grant.Path;
+        }
+
+        private static string CreateCapabilityToken()
+        {
+            var bytes = new byte[32];
+            using (var random = RandomNumberGenerator.Create()) random.GetBytes(bytes);
+            return BitConverter.ToString(bytes).Replace("-", string.Empty).ToLowerInvariant();
+        }
+    }
+
+    public sealed class CultMeshSharedMemoryBodyAdapter : ICultMeshBodyTransportAdapter
+    {
+        public CultMeshBodyTransportKind TransportKind => CultMeshBodyTransportKind.SharedMemory;
+        public bool CanOpen(CultMeshBodyDescriptor descriptor) =>
+            descriptor != null && descriptor.TransportKind == TransportKind;
+
+        public ICultMeshBodyReadLease OpenReadOnly(
+            CultMeshBodyDescriptor descriptor,
+            CultMeshBodyValidationRequest request)
+        {
+            CultMeshBodyDescriptorValidator.Validate(descriptor, request);
+            if (string.IsNullOrWhiteSpace(descriptor.CapabilityToken))
+                throw new InvalidOperationException("Shared-memory CultMesh body descriptor has no transport capability token.");
+            if (CultMeshFrameBodyPublisher.IsFrameCapability(descriptor.CapabilityToken))
+                return CultMeshFrameBodyPublisher.OpenReadOnly(descriptor);
+            MemoryMappedFile mapping;
+            try
+            {
+                mapping = MemoryMappedFile.OpenExisting(descriptor.CapabilityToken, MemoryMappedFileRights.Read);
+            }
+            catch (FileNotFoundException error)
+            {
+                throw new InvalidDataException("CultMesh shared-memory capability is unavailable or revoked.", error);
+            }
+            try
+            {
+                return new CultMeshMappedBodyLease(descriptor, mapping);
+            }
+            catch
+            {
+                mapping.Dispose();
+                throw;
+            }
+        }
+    }
+
+    public sealed class CultMeshMappedBodyLease : ICultMeshBodyReadLease
+    {
+        private readonly MemoryMappedFile _mapping;
+        private readonly MemoryMappedViewAccessor _view;
+        private bool _disposed;
+
+        internal CultMeshMappedBodyLease(CultMeshBodyDescriptor descriptor, string path)
+            : this(descriptor, MemoryMappedFile.CreateFromFile(path, FileMode.Open, null, 0, MemoryMappedFileAccess.Read))
+        {
+        }
+
+        internal CultMeshMappedBodyLease(
+            CultMeshBodyDescriptor descriptor,
+            MemoryMappedFile mapping,
+            long offset = 0,
+            Action? release = null)
+        {
+            Descriptor = descriptor;
+            _mapping = mapping;
+            _release = release;
+            _view = _mapping.CreateViewAccessor(offset, descriptor.ByteSize, MemoryMappedFileAccess.Read);
+        }
+
+        private readonly Action? _release;
+
+        public CultMeshBodyDescriptor Descriptor { get; }
+        public CultMeshBodyTransportKind TransportKind => Descriptor.TransportKind;
+        public byte ReadByte(long offset) { ValidateRange(offset, 1); return _view.ReadByte(offset); }
+        public int ReadInt32(long offset) { ValidateRange(offset, sizeof(int)); return _view.ReadInt32(offset); }
+        public long ReadInt64(long offset) { ValidateRange(offset, sizeof(long)); return _view.ReadInt64(offset); }
+        public float ReadSingle(long offset) { ValidateRange(offset, sizeof(float)); return _view.ReadSingle(offset); }
+        public double ReadDouble(long offset) { ValidateRange(offset, sizeof(double)); return _view.ReadDouble(offset); }
+        public int CopyTo(long offset, byte[] destination, int destinationOffset, int count)
+        {
+            if (destination == null) throw new ArgumentNullException(nameof(destination));
+            ValidateRange(offset, count);
+            return _view.ReadArray(offset, destination, destinationOffset, count);
+        }
+
+        public void Dispose()
+        {
+            if (_disposed) return;
+            _disposed = true;
+            _view.Dispose();
+            _mapping.Dispose();
+            _release?.Invoke();
+        }
+
+        private void ValidateRange(long offset, long length)
+        {
+            if (_disposed) throw new ObjectDisposedException(nameof(CultMeshMappedBodyLease));
+            if (offset < 0 || length < 0 || offset > Descriptor.ByteSize - length)
+                throw new ArgumentOutOfRangeException(nameof(offset));
+        }
+    }
+
+    public sealed class CultMeshNetworkBodyAdapter : ICultMeshBodyTransportAdapter
+    {
+        private readonly Func<CultMeshBodyDescriptor, byte[]> _fetch;
+        private readonly bool _fetchIsVerified;
+
+        public CultMeshNetworkBodyAdapter(Func<CultMeshBodyDescriptor, byte[]> fetch) =>
+            _fetch = fetch ?? throw new ArgumentNullException(nameof(fetch));
+
+        /// <summary>Uses a session provider that already verifies the response against the descriptor.</summary>
+        public CultMeshNetworkBodyAdapter(CultMeshSessionBodyProvider provider)
+        {
+            if (provider == null) throw new ArgumentNullException(nameof(provider));
+            _fetch = provider.CreateFetchDelegate();
+            _fetchIsVerified = true;
+        }
+
+        public CultMeshBodyTransportKind TransportKind => CultMeshBodyTransportKind.Network;
+        public bool CanOpen(CultMeshBodyDescriptor descriptor) =>
+            descriptor != null && descriptor.TransportKind == TransportKind;
+
+        public ICultMeshBodyReadLease OpenReadOnly(
+            CultMeshBodyDescriptor descriptor,
+            CultMeshBodyValidationRequest request)
+        {
+            CultMeshBodyDescriptorValidator.Validate(descriptor, request);
+            var bytes = _fetch(descriptor) ?? throw new InvalidDataException("CultMesh network body returned no bytes.");
+            if (bytes.LongLength != descriptor.ByteSize)
+                throw new InvalidDataException("CultMesh network body size does not match its descriptor.");
+            if (string.IsNullOrWhiteSpace(descriptor.SemanticHash))
+                throw new InvalidDataException("CultMesh network body descriptor has no semantic digest.");
+            if (!_fetchIsVerified)
+            {
+                var actualHash = CultMeshBodyDescriptorValidator.ComputeSemanticHash(bytes);
+                if (!string.Equals(actualHash, descriptor.SemanticHash, StringComparison.Ordinal))
+                    throw new InvalidDataException("CultMesh network body semantic digest does not match its descriptor.");
+            }
+            return new CultMeshBufferedBodyLease(descriptor, bytes);
+        }
+    }
+
+    internal sealed class CultMeshBufferedBodyLease : ICultMeshBodyReadLease
+    {
+        private byte[] _body;
+        public CultMeshBufferedBodyLease(CultMeshBodyDescriptor descriptor, byte[] body)
+        {
+            Descriptor = descriptor;
+            _body = body;
+        }
+        public CultMeshBodyDescriptor Descriptor { get; }
+        public CultMeshBodyTransportKind TransportKind => CultMeshBodyTransportKind.Network;
+        public byte ReadByte(long offset) { Validate(offset, 1); return _body[(int)offset]; }
+        public int ReadInt32(long offset) { Validate(offset, 4); return BitConverter.ToInt32(_body, (int)offset); }
+        public long ReadInt64(long offset) { Validate(offset, 8); return BitConverter.ToInt64(_body, (int)offset); }
+        public float ReadSingle(long offset) { Validate(offset, 4); return BitConverter.ToSingle(_body, (int)offset); }
+        public double ReadDouble(long offset) { Validate(offset, 8); return BitConverter.ToDouble(_body, (int)offset); }
+        public int CopyTo(long offset, byte[] destination, int destinationOffset, int count)
+        {
+            Validate(offset, count);
+            Buffer.BlockCopy(_body, (int)offset, destination, destinationOffset, count);
+            return count;
+        }
+        public void Dispose() { _body = Array.Empty<byte>(); }
+        private void Validate(long offset, int count)
+        {
+            if (offset < 0 || count < 0 || offset > _body.LongLength - count)
+                throw new ArgumentOutOfRangeException(nameof(offset));
+        }
+    }
+}
diff --git a/src/GameCult.Mesh/CultMeshBodyDemand.cs b/src/GameCult.Mesh/CultMeshBodyDemand.cs
new file mode 100644
index 00000000..2ab90617
--- /dev/null
+++ b/src/GameCult.Mesh/CultMeshBodyDemand.cs
@@ -0,0 +1,428 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using GameCult.Networking;
+
+#nullable enable
+
+namespace GameCult.Mesh
+{
+    /// <summary>
+    /// Declares one logical body demand. CultMesh owns locality detection and transport selection;
+    /// consumers name the body and the planes they can actually read.
+    /// </summary>
+    public sealed class CultMeshLiveBodySubscription
+    {
+        public CultMeshLiveBodySubscription(
+            string subscriptionId,
+            string consumerRuntimeId,
+            string bodyId)
+        {
+            SubscriptionId = Require(subscriptionId, nameof(subscriptionId));
+            ConsumerRuntimeId = Require(consumerRuntimeId, nameof(consumerRuntimeId));
+            BodyId = Require(bodyId, nameof(bodyId));
+        }
+
+        public string SubscriptionId { get; }
+        public string ConsumerRuntimeId { get; }
+        public string BodyId { get; }
+        public string PublicationRecordKey =>
+            CultMeshBodyPublicationDocument.CreateLatestRecordKey(BodyId).Value;
+
+        private static string Require(string value, string parameterName) =>
+            string.IsNullOrWhiteSpace(value)
+                ? throw new ArgumentException("Value is required.", parameterName)
+                : value;
+    }
+
+    /// <summary>
+    /// One ephemeral body subscription. Publication metadata remains reactive control state while
+    /// body bytes stay on the negotiated body plane.
+    /// </summary>
+    public sealed class CultMeshLiveBody : IDisposable
+    {
+        private readonly CultNetDatabaseSubscriptionClient _owner;
+        private readonly CultMeshBodyPublicationResolver _resolver;
+        private readonly CultMeshLiveBodySubscription _subscription;
+        private readonly object _gate = new();
+        private CultMeshBodyPublicationDocument? _current;
+        private bool _hasValue;
+        private bool _disposed;
+
+        internal CultMeshLiveBody(
+            CultNetDatabaseSubscriptionClient owner,
+            CultMeshBodyPublicationResolver resolver,
+            CultMeshLiveBodySubscription subscription)
+        {
+            _owner = owner ?? throw new ArgumentNullException(nameof(owner));
+            _resolver = resolver ?? throw new ArgumentNullException(nameof(resolver));
+            _subscription = subscription ?? throw new ArgumentNullException(nameof(subscription));
+            _owner.Changed += OnChanged;
+        }
+
+        /// <summary>Raised when the provider publishes a new generation descriptor.</summary>
+        public event Action<CultMeshBodyPublicationDocument>? Changed;
+
+        /// <summary>Raised when the provider withdraws the logical body.</summary>
+        public event Action? Removed;
+
+        public string BodyId => _subscription.BodyId;
+
+        public bool HasValue
+        {
+            get { lock (_gate) return _hasValue; }
+        }
+
+        public CultMeshBodyPublicationDocument Current
+        {
+            get
+            {
+                lock (_gate)
+                    return _hasValue
+                        ? _current!
+                        : throw new InvalidOperationException(
+                            $"Live body '{_subscription.BodyId}' is not currently published.");
+            }
+        }
+
+        /// <summary>
+        /// Opens the current generation read-only using the fastest valid advertised representation.
+        /// The caller owns the returned lease and should dispose it before opening a later generation.
+        /// </summary>
+        public CultMeshBodyNegotiationResult OpenCurrentReadOnly(DateTimeOffset? nowUtc = null)
+        {
+            CultMeshBodyPublicationDocument publication;
+            lock (_gate)
+            {
+                if (_disposed) throw new ObjectDisposedException(nameof(CultMeshLiveBody));
+                if (!_hasValue)
+                    throw new InvalidOperationException(
+                        $"Live body '{_subscription.BodyId}' is not currently published.");
+                publication = _current!;
+            }
+
+            return _resolver.NegotiateReadOnly(publication, new CultMeshBodyValidationRequest
+            {
+                BodyId = publication.BodyId,
+                SchemaId = publication.SchemaId,
+                LayoutVersion = publication.LayoutVersion,
+                ProducerEpoch = publication.ProducerEpoch,
+                Sequence = publication.Sequence,
+                Capacity = publication.Capacity,
+                AccessMode = CultMeshBodyAccessMode.ReadOnly,
+                NowUtc = nowUtc ?? DateTimeOffset.UtcNow
+            });
+        }
+
+        internal void Initialize(CultMeshBodyPublicationDocument publication)
+        {
+            CultMeshBodyPublicationValidator.Validate(publication, expectedBodyId: _subscription.BodyId);
+            lock (_gate)
+            {
+                if (_disposed || _hasValue) return;
+                _current = publication;
+                _hasValue = true;
+            }
+        }
+
+        public void Dispose()
+        {
+            lock (_gate)
+            {
+                if (_disposed) return;
+                _disposed = true;
+                _current = null;
+                _hasValue = false;
+            }
+            _owner.Changed -= OnChanged;
+            _owner.Unsubscribe(_subscription.SubscriptionId);
+        }
+
+        private void OnChanged(CultNetReplicatedDocumentChange change)
+        {
+            if (!string.Equals(change.SubscriptionId, _subscription.SubscriptionId, StringComparison.Ordinal) ||
+                !string.Equals(change.RecordKey, _subscription.PublicationRecordKey, StringComparison.Ordinal))
+                return;
+
+            if (string.Equals(change.ChangeKind, "removed", StringComparison.Ordinal))
+            {
+                lock (_gate)
+                {
+                    if (_disposed) return;
+                    _current = null;
+                    _hasValue = false;
+                }
+                Removed?.Invoke();
+                return;
+            }
+
+            if (change.Document is not CultMeshBodyPublicationDocument publication)
+                return;
+            CultMeshBodyPublicationValidator.Validate(publication, expectedBodyId: _subscription.BodyId);
+            lock (_gate)
+            {
+                if (_disposed) return;
+                _current = publication;
+                _hasValue = true;
+            }
+            Changed?.Invoke(publication);
+        }
+    }
+
+    /// <summary>
+    /// One exact hot-body subscription. The view record, latest-publication record, consumer body
+    /// demand, and locally supported planes are one contract so callers cannot accidentally stream
+    /// body bytes through retained document snapshots.
+    /// </summary>
+    public sealed class CultMeshHotBodySubscription
+    {
+        public CultMeshHotBodySubscription(
+            string subscriptionId,
+            string consumerRuntimeId,
+            string viewRecordKey,
+            string viewSchemaId,
+            string bodyId,
+            IEnumerable<string>? additionalRecordKeys = null,
+            IEnumerable<string>? additionalSchemaIds = null)
+        {
+            SubscriptionId = Require(subscriptionId, nameof(subscriptionId));
+            ConsumerRuntimeId = Require(consumerRuntimeId, nameof(consumerRuntimeId));
+            BodyId = Require(bodyId, nameof(bodyId));
+            RecordKeys = new[]
+                {
+                    Require(viewRecordKey, nameof(viewRecordKey)),
+                    CultMeshBodyPublicationDocument.CreateLatestRecordKey(bodyId).Value
+                }
+                .Concat(additionalRecordKeys ?? Array.Empty<string>())
+                .Where(value => !string.IsNullOrWhiteSpace(value))
+                .Distinct(StringComparer.Ordinal)
+                .ToArray();
+            SchemaIds = new[]
+                {
+                    Require(viewSchemaId, nameof(viewSchemaId)),
+                    CultMeshBodyPublicationSchemaVersions.Publication
+                }
+                .Concat(additionalSchemaIds ?? Array.Empty<string>())
+                .Where(value => !string.IsNullOrWhiteSpace(value))
+                .Distinct(StringComparer.Ordinal)
+                .ToArray();
+        }
+
+        public string SubscriptionId { get; }
+        public string ConsumerRuntimeId { get; }
+        public string BodyId { get; }
+        public IReadOnlyList<string> RecordKeys { get; }
+        public IReadOnlyList<string> SchemaIds { get; }
+
+        private static string Require(string value, string parameterName) =>
+            string.IsNullOrWhiteSpace(value)
+                ? throw new ArgumentException("Value is required.", parameterName)
+                : value;
+    }
+
+    /// <summary>Derived transport work for one logical hot body.</summary>
+    public sealed class CultMeshBodyDemandPlan
+    {
+        internal CultMeshBodyDemandPlan(
+            string bodyId,
+            long generation,
+            IReadOnlyList<CultMeshBodyConsumerRoute> consumers)
+        {
+            BodyId = bodyId;
+            Generation = generation;
+            Consumers = consumers;
+            RequiresSharedMemory = consumers.Any(value => value.Transport == CultMeshBodyTransportKind.SharedMemory);
+            RequiresSharedFileMapping = consumers.Any(value => value.Transport == CultMeshBodyTransportKind.SharedFileMapping);
+            RequiresNetwork = consumers.Any(value => value.Transport == CultMeshBodyTransportKind.Network);
+        }
+
+        public string BodyId { get; }
+        /// <summary>
+        /// Monotone generation of the exact routed consumer set. Publishers must rotate any
+        /// retained capability before writing after this value changes.
+        /// </summary>
+        public long Generation { get; }
+        public bool HasConsumers => Consumers.Count > 0;
+        public bool RequiresSharedMemory { get; }
+        public bool RequiresSharedFileMapping { get; }
+        public bool RequiresNetwork { get; }
+        public IReadOnlyList<CultMeshBodyConsumerRoute> Consumers { get; }
+    }
+
+    /// <summary>One consumer's owner-derived route for one logical body.</summary>
+    public sealed class CultMeshBodyConsumerRoute
+    {
+        internal CultMeshBodyConsumerRoute(
+            string consumerRuntimeId,
+            string subscriptionId,
+            CultMeshBodyTransportKind transport)
+        {
+            ConsumerRuntimeId = consumerRuntimeId;
+            SubscriptionId = subscriptionId;
+            Transport = transport;
+        }
+
+        public string ConsumerRuntimeId { get; }
+        public string SubscriptionId { get; }
+        public CultMeshBodyTransportKind Transport { get; }
+    }
+
+    /// <summary>
+    /// Owns the live projection from exact state subscriptions to required body transport planes.
+    /// A same-machine claim is transport evidence only; shared memory is selected only when both
+    /// the server peer and consumer capability agree.
+    /// </summary>
+    public sealed class CultMeshBodyDemandTracker : IDisposable
+    {
+        private readonly CultNetDatabaseSubscriptionServer? _subscriptions;
+        private readonly object _gate = new();
+        private readonly Dictionary<string, CultNetDatabaseSubscriptionDemand> _demands =
+            new(StringComparer.Ordinal);
+        private readonly Dictionary<string, long> _bodyGenerations =
+            new(StringComparer.Ordinal);
+        private bool _disposed;
+
+        public CultMeshBodyDemandTracker(CultNetDatabaseSubscriptionServer subscriptions)
+        {
+            _subscriptions = subscriptions ?? throw new ArgumentNullException(nameof(subscriptions));
+            _subscriptions.DemandChanged += OnDemandChanged;
+        }
+
+        /// <summary>Creates a tracker fed explicitly by a subscription/session control plane.</summary>
+        public CultMeshBodyDemandTracker()
+        {
+        }
+
+        public CultMeshBodyDemandPlan Plan(string bodyId)
+        {
+            if (string.IsNullOrWhiteSpace(bodyId)) throw new ArgumentException("Body identity is required.", nameof(bodyId));
+            lock (_gate)
+            {
+                ThrowIfDisposed();
+                var routes = _demands.Values
+                    .Where(value => value.BodyIds.Contains(bodyId, StringComparer.Ordinal))
+                    .Select(value => Route(value))
+                    .Where(value => value != null)
+                    .Cast<CultMeshBodyConsumerRoute>()
+                    .OrderBy(value => value.ConsumerRuntimeId, StringComparer.Ordinal)
+                    .ThenBy(value => value.SubscriptionId, StringComparer.Ordinal)
+                    .ToArray();
+                return new CultMeshBodyDemandPlan(
+                    bodyId,
+                    _bodyGenerations.TryGetValue(bodyId, out var generation) ? generation : 0,
+                    routes);
+            }
+        }
+
+        public void Dispose()
+        {
+            lock (_gate)
+            {
+                if (_disposed) return;
+                _disposed = true;
+                if (_subscriptions != null) _subscriptions.DemandChanged -= OnDemandChanged;
+                _demands.Clear();
+                _bodyGenerations.Clear();
+            }
+        }
+
+        /// <summary>Applies one active or withdrawn typed body-demand observation.</summary>
+        public void Observe(CultNetDatabaseSubscriptionDemand demand)
+        {
+            if (demand == null) throw new ArgumentNullException(nameof(demand));
+            if (demand.BodyIds.Count == 0) return;
+            var key = demand.ConsumerRuntimeId + "\u001f" + demand.SubscriptionId;
+            lock (_gate)
+            {
+                if (_disposed) return;
+                _demands.TryGetValue(key, out var previous);
+                var affectedBodyIds = (previous?.BodyIds ?? Array.Empty<string>())
+                    .Concat(demand.BodyIds)
+                    .Where(value => !string.IsNullOrWhiteSpace(value))
+                    .Distinct(StringComparer.Ordinal)
+                    .ToArray();
+                var before = affectedBodyIds.ToDictionary(
+                    bodyId => bodyId,
+                    RoutedConsumerSignature,
+                    StringComparer.Ordinal);
+                if (demand.Active) _demands[key] = demand;
+                else _demands.Remove(key);
+                foreach (var bodyId in affectedBodyIds)
+                {
+                    var after = RoutedConsumerSignature(bodyId);
+                    if (string.Equals(before[bodyId], after, StringComparison.Ordinal)) continue;
+                    _bodyGenerations[bodyId] = checked(
+                        (_bodyGenerations.TryGetValue(bodyId, out var generation) ? generation : 0) + 1);
+                }
+            }
+        }
+
+        /// <summary>
+        /// Executes one synchronous capability commit only while the exact routed consumer
+        /// generation remains current. Demand transitions serialize against the callback, so
+        /// either this work linearizes before the transition or it is rejected without running.
+        /// </summary>
+        public bool TryExecuteAtGeneration(string bodyId, long generation, Action action)
+        {
+            if (string.IsNullOrWhiteSpace(bodyId)) throw new ArgumentException("Body identity is required.", nameof(bodyId));
+            if (generation < 0) throw new ArgumentOutOfRangeException(nameof(generation));
+            if (action == null) throw new ArgumentNullException(nameof(action));
+            lock (_gate)
+            {
+                ThrowIfDisposed();
+                var current = _bodyGenerations.TryGetValue(bodyId, out var value) ? value : 0;
+                if (current != generation) return false;
+                action();
+                return true;
+            }
+        }
+
+        private string RoutedConsumerSignature(string bodyId) => string.Join(
+            "\u001e",
+            _demands.Values
+                .Where(value => value.BodyIds.Contains(bodyId, StringComparer.Ordinal))
+                .Select(Route)
+                .Where(value => value != null)
+                .Cast<CultMeshBodyConsumerRoute>()
+                .OrderBy(value => value.ConsumerRuntimeId, StringComparer.Ordinal)
+                .ThenBy(value => value.SubscriptionId, StringComparer.Ordinal)
+                .Select(value => string.Join(
+                    "\u001f",
+                    value.ConsumerRuntimeId,
+                    value.SubscriptionId,
+                    value.Transport.ToString())));
+
+        private void OnDemandChanged(CultNetDatabaseSubscriptionDemand demand) => Observe(demand);
+
+        private static CultMeshBodyConsumerRoute? Route(CultNetDatabaseSubscriptionDemand demand)
+        {
+            var supported = demand.SupportedBodyTransports;
+            if (demand.SameMachine && Supports(supported, CultMeshBodyTransportKind.SharedMemory))
+                return new CultMeshBodyConsumerRoute(
+                    demand.ConsumerRuntimeId,
+                    demand.SubscriptionId,
+                    CultMeshBodyTransportKind.SharedMemory);
+            if (demand.SameMachine && Supports(supported, CultMeshBodyTransportKind.SharedFileMapping))
+                return new CultMeshBodyConsumerRoute(
+                    demand.ConsumerRuntimeId,
+                    demand.SubscriptionId,
+                    CultMeshBodyTransportKind.SharedFileMapping);
+            if (Supports(supported, CultMeshBodyTransportKind.Network))
+                return new CultMeshBodyConsumerRoute(
+                    demand.ConsumerRuntimeId,
+                    demand.SubscriptionId,
+                    CultMeshBodyTransportKind.Network);
+            return null;
+        }
+
+        private static bool Supports(
+            IReadOnlyList<string> supported,
+            CultMeshBodyTransportKind transport) =>
+            supported.Any(value => string.Equals(value, transport.ToString(), StringComparison.OrdinalIgnoreCase));
+
+        private void ThrowIfDisposed()
+        {
+            if (_disposed) throw new ObjectDisposedException(nameof(CultMeshBodyDemandTracker));
+        }
+    }
+}
diff --git a/src/GameCult.Mesh/CultMeshBodyPublications.cs b/src/GameCult.Mesh/CultMeshBodyPublications.cs
new file mode 100644
index 00000000..2358c277
--- /dev/null
+++ b/src/GameCult.Mesh/CultMeshBodyPublications.cs
@@ -0,0 +1,201 @@
+using System;
+using System.Globalization;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Security.Cryptography;
+using System.Text;
+using GameCult.Caching;
+using GameCult.Networking;
+using MessagePack;
+
+namespace GameCult.Mesh
+{
+    public static class CultMeshBodyPublicationSchemaVersions
+    {
+        public const string Publication = "gamecult.mesh.body_publication.v2";
+    }
+
+    public sealed class CultMeshBodyGeneration
+    {
+        public string BodyId { get; set; } = string.Empty;
+        public string ProducerId { get; set; } = string.Empty;
+        public string SchemaId { get; set; } = string.Empty;
+        public int LayoutVersion { get; set; }
+        public int Capacity { get; set; }
+        public long ProducerEpoch { get; set; }
+        public long Sequence { get; set; }
+        public CultMeshBodySynchronization Synchronization { get; set; } = CultMeshBodySynchronization.ImmutableSequence;
+        public long LeaseExpiresAtUnixMs { get; set; }
+    }
+
+    [MessagePackObject]
+    [CultDocument("gamecult.mesh.body_publication", CultMeshBodyPublicationSchemaVersions.Publication)]
+    public sealed class CultMeshBodyPublicationDocument
+    {
+        [Key(0), CultName] public string BodyId { get; set; } = string.Empty;
+        [Key(1), CultIndex] public string ProducerId { get; set; } = string.Empty;
+        [Key(2)] public string SchemaId { get; set; } = string.Empty;
+        [Key(3)] public int LayoutVersion { get; set; }
+        [Key(4)] public long ByteSize { get; set; }
+        [Key(5)] public int Capacity { get; set; }
+        [Key(6)] public long ProducerEpoch { get; set; }
+        [Key(7)] public long Sequence { get; set; }
+        [Key(8)] public CultMeshBodySynchronization Synchronization { get; set; }
+        [Key(9)] public long LivenessExpiresAtUnixMs { get; set; }
+        [Key(10)] public CultMeshBodyDescriptor[] Representations { get; set; } = Array.Empty<CultMeshBodyDescriptor>();
+
+        public static CultRecordKey CreateRecordKey(string bodyId, long producerEpoch, long sequence)
+        {
+            if (string.IsNullOrWhiteSpace(bodyId))
+                throw new ArgumentException("Logical body identity is required.", nameof(bodyId));
+            if (producerEpoch < 0) throw new ArgumentOutOfRangeException(nameof(producerEpoch));
+            if (sequence < 0) throw new ArgumentOutOfRangeException(nameof(sequence));
+            using var stream = new MemoryStream();
+            using (var writer = new BinaryWriter(stream, Encoding.UTF8, leaveOpen: true))
+            {
+                writer.Write(bodyId);
+                writer.Write(producerEpoch);
+                writer.Write(sequence);
+            }
+            using var sha256 = SHA256.Create();
+            var generationId = string.Concat(sha256.ComputeHash(stream.ToArray())
+                .Select(value => value.ToString("x2", CultureInfo.InvariantCulture)));
+            return new CultRecordKey("mesh:body-generation:" + generationId);
+        }
+
+        public static CultRecordKey CreateLatestRecordKey(string bodyId)
+        {
+            if (string.IsNullOrWhiteSpace(bodyId))
+                throw new ArgumentException("Logical body identity is required.", nameof(bodyId));
+            return new CultRecordKey("mesh:body:" + bodyId);
+        }
+
+        [IgnoreMember]
+        public CultRecordKey RecordKey => CreateRecordKey(BodyId, ProducerEpoch, Sequence);
+    }
+
+    public sealed class CultMeshBodyPublicationHandle
+    {
+        public CultMeshBodyPublicationHandle(string bodyId, long producerEpoch, long sequence)
+        {
+            BodyId = string.IsNullOrWhiteSpace(bodyId)
+                ? throw new ArgumentException("Logical body identity is required.", nameof(bodyId))
+                : bodyId;
+            ProducerEpoch = producerEpoch >= 0
+                ? producerEpoch
+                : throw new ArgumentOutOfRangeException(nameof(producerEpoch));
+            Sequence = sequence >= 0
+                ? sequence
+                : throw new ArgumentOutOfRangeException(nameof(sequence));
+            RecordKey = CultMeshBodyPublicationDocument.CreateRecordKey(bodyId, producerEpoch, sequence);
+        }
+
+        public string BodyId { get; }
+        public long ProducerEpoch { get; }
+        public long Sequence { get; }
+        public CultRecordKey RecordKey { get; }
+
+        public void Validate(CultMeshBodyPublicationDocument publication) =>
+            CultMeshBodyPublicationValidator.Validate(publication, BodyId, ProducerEpoch, Sequence, RecordKey);
+    }
+
+    public static class CultMeshBodyPublicationValidator
+    {
+        public static void Validate(
+            CultMeshBodyPublicationDocument publication,
+            string? expectedBodyId = null,
+            long? expectedProducerEpoch = null,
+            long? expectedSequence = null,
+            CultRecordKey? expectedRecordKey = null)
+        {
+            if (publication == null) throw new ArgumentNullException(nameof(publication));
+            if (string.IsNullOrWhiteSpace(publication.BodyId))
+                throw new InvalidOperationException("CultMesh body publication has no logical body identity.");
+            if (expectedBodyId != null && !string.Equals(publication.BodyId, expectedBodyId, StringComparison.Ordinal))
+                throw new InvalidOperationException("CultMesh body publication handle identity mismatch.");
+            if (expectedProducerEpoch.HasValue && publication.ProducerEpoch != expectedProducerEpoch.Value)
+                throw new InvalidOperationException("CultMesh body publication handle producer epoch mismatch.");
+            if (expectedSequence.HasValue && publication.Sequence != expectedSequence.Value)
+                throw new InvalidOperationException("CultMesh body publication handle sequence mismatch.");
+            if (string.IsNullOrWhiteSpace(publication.ProducerId))
+                throw new InvalidOperationException("CultMesh body publication has no producer identity.");
+            if (string.IsNullOrWhiteSpace(publication.SchemaId))
+                throw new InvalidOperationException("CultMesh body publication has no schema identity.");
+            if (publication.LayoutVersion < 0 || publication.ByteSize < 0 || publication.Capacity < 0 ||
+                publication.ProducerEpoch < 0 || publication.Sequence < 0)
+                throw new InvalidOperationException("CultMesh body publication generation values must be non-negative.");
+            if (expectedRecordKey.HasValue && !publication.RecordKey.Equals(expectedRecordKey.Value))
+                throw new InvalidOperationException("CultMesh body publication record key disagrees with its generation envelope.");
+            var representations = publication.Representations ?? Array.Empty<CultMeshBodyDescriptor>();
+            if (representations.Length == 0)
+                throw new InvalidOperationException("CultMesh body publication has no transport representations.");
+            if (representations.Select(value => value?.TransportKind).Distinct().Count() != representations.Length)
+                throw new InvalidOperationException("CultMesh body publication advertises the same transport representation more than once.");
+            foreach (var representation in representations)
+                ValidateDescriptor(publication, representation, representation?.TransportKind.ToString() ?? "missing");
+        }
+
+        private static void ValidateDescriptor(
+            CultMeshBodyPublicationDocument publication,
+            CultMeshBodyDescriptor descriptor,
+            string label)
+        {
+            if (descriptor == null)
+                throw new InvalidOperationException($"CultMesh body publication has no {label} descriptor.");
+            if (!string.Equals(descriptor.BodyId, publication.BodyId, StringComparison.Ordinal) ||
+                !string.Equals(descriptor.SchemaId, publication.SchemaId, StringComparison.Ordinal) ||
+                descriptor.LayoutVersion != publication.LayoutVersion ||
+                descriptor.ByteSize != publication.ByteSize ||
+                descriptor.Capacity != publication.Capacity ||
+                descriptor.ProducerEpoch != publication.ProducerEpoch ||
+                descriptor.Sequence != publication.Sequence ||
+                descriptor.Synchronization != publication.Synchronization ||
+                descriptor.LeaseExpiresAtUnixMs != publication.LivenessExpiresAtUnixMs)
+                throw new InvalidOperationException($"CultMesh {label} descriptor disagrees with its publication envelope.");
+        }
+    }
+
+    public sealed class CultMeshBodyPublicationResolver
+    {
+        private readonly CultMeshBodyTransportService _transport;
+
+        public CultMeshBodyPublicationResolver(CultMeshBodyTransportService transport) =>
+            _transport = transport ?? throw new ArgumentNullException(nameof(transport));
+
+        /// <summary>Gets the body planes this resolver can actually open.</summary>
+        public IReadOnlyList<CultMeshBodyTransportKind> SupportedTransports => _transport.SupportedTransports;
+
+        public ICultMeshBodyReadLease ResolveReadOnly(
+            CultMeshBodyPublicationDocument publication,
+            CultMeshBodyValidationRequest request) =>
+            NegotiateReadOnly(publication, request).Lease;
+
+        public CultMeshBodyNegotiationResult NegotiateReadOnly(
+            CultMeshBodyPublicationDocument publication,
+            CultMeshBodyValidationRequest request)
+        {
+            CultMeshBodyPublicationValidator.Validate(publication);
+            if (request == null) throw new ArgumentNullException(nameof(request));
+            if (publication.LivenessExpiresAtUnixMs <= request.NowUtc.ToUnixTimeMilliseconds())
+                throw new InvalidOperationException("CultMesh body publication is no longer live.");
+            return _transport.NegotiateReadOnly(
+                publication.ProducerId,
+                publication.Representations,
+                request);
+        }
+    }
+
+    public static partial class CultMesh
+    {
+        public static CultNetDocumentRegistry CreateBodyPublicationDocumentRegistry(
+            CultDocumentRegistry? documents = null)
+        {
+            documents ??= CultDocumentRegistry.Shared;
+            return new CultNetDocumentRegistry(documents)
+                .Register(CultNetDocumentBinding.ForDocument<CultMeshBodyPublicationDocument>(documents))
+                .Register(CultNetDocumentBinding.ForDocument<CultMeshCdnArtifactManifest>(documents))
+                .Register(CultNetDocumentBinding.ForDocument<CultMeshCdnArtifactChunk>(documents));
+        }
+    }
+}
diff --git a/src/GameCult.Mesh/CultMeshBodySessions.cs b/src/GameCult.Mesh/CultMeshBodySessions.cs
new file mode 100644
index 00000000..ee946201
--- /dev/null
+++ b/src/GameCult.Mesh/CultMeshBodySessions.cs
@@ -0,0 +1,342 @@
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Security.Cryptography;
+using System.Text;
+using System.Threading;
+using System.Threading.Tasks;
+using GameCult.Networking;
+
+#nullable enable
+
+namespace GameCult.Mesh
+{
+    /// <summary>
+    /// Owns a bounded set of immutable network body generations. This is ephemeral transport state,
+    /// not a CultCache document store and not world truth.
+    /// </summary>
+    public sealed class CultMeshNetworkBodyStore : IDisposable
+    {
+        public const long DefaultMaximumBodyBytes = 16L * 1024L * 1024L;
+        public const int DefaultRetainedGenerations = 8;
+
+        private readonly object _gate = new();
+        private readonly Dictionary<string, Entry> _entries = new(StringComparer.Ordinal);
+        private readonly byte[] _capabilitySecret = new byte[32];
+        private readonly long _maximumBodyBytes;
+        private readonly int _retainedGenerations;
+        private bool _disposed;
+
+        public CultMeshNetworkBodyStore(
+            long maximumBodyBytes = DefaultMaximumBodyBytes,
+            int retainedGenerations = DefaultRetainedGenerations)
+        {
+            if (maximumBodyBytes <= 0) throw new ArgumentOutOfRangeException(nameof(maximumBodyBytes));
+            if (retainedGenerations <= 0) throw new ArgumentOutOfRangeException(nameof(retainedGenerations));
+            _maximumBodyBytes = maximumBodyBytes;
+            _retainedGenerations = retainedGenerations;
+            using var random = RandomNumberGenerator.Create();
+            random.GetBytes(_capabilitySecret);
+        }
+
+        public CultMeshBodyDescriptor Publish(CultMeshBodyGeneration generation, ReadOnlySpan<byte> body)
+        {
+            return PublishCore(generation, body.ToArray());
+        }
+
+        /// <summary>
+        /// Publishes a body buffer by transferring its ownership to the ephemeral store. The caller
+        /// must not mutate the array after this call; this avoids an extra full-frame copy.
+        /// </summary>
+        public CultMeshBodyDescriptor PublishOwned(CultMeshBodyGeneration generation, byte[] body)
+        {
+            if (body == null) throw new ArgumentNullException(nameof(body));
+            return PublishCore(generation, body);
+        }
+
+        private CultMeshBodyDescriptor PublishCore(CultMeshBodyGeneration generation, byte[] bytes)
+        {
+            ValidateGeneration(generation);
+            if (bytes.LongLength > _maximumBodyBytes)
+                throw new InvalidOperationException(
+                    $"CultMesh network body exceeds the configured {_maximumBodyBytes}-byte live-body bound.");
+
+            var hash = CultMeshBodyDescriptorValidator.ComputeSemanticHash(bytes);
+            var token = CapabilityToken(generation);
+            var descriptor = new CultMeshBodyDescriptor
+            {
+                BodyId = generation.BodyId,
+                SchemaId = generation.SchemaId,
+                LayoutVersion = generation.LayoutVersion,
+                ByteSize = bytes.LongLength,
+                Capacity = generation.Capacity,
+                ProducerEpoch = generation.ProducerEpoch,
+                Sequence = generation.Sequence,
+                AccessMode = CultMeshBodyAccessMode.ReadOnly,
+                Synchronization = generation.Synchronization,
+                LeaseExpiresAtUnixMs = generation.LeaseExpiresAtUnixMs,
+                TransportKind = CultMeshBodyTransportKind.Network,
+                CapabilityToken = token,
+                SemanticHash = hash
+            };
+
+            lock (_gate)
+            {
+                ThrowIfDisposed();
+                PruneExpired(DateTimeOffset.UtcNow.ToUnixTimeMilliseconds());
+                if (_entries.TryGetValue(token, out var existing))
+                {
+                    if (!SameDescriptor(existing.Descriptor, descriptor) ||
+                        !string.Equals(existing.Descriptor.SemanticHash, hash, StringComparison.Ordinal))
+                        throw new InvalidOperationException("CultMesh network body generation is immutable.");
+                    Array.Clear(bytes, 0, bytes.Length);
+                    return Clone(existing.Descriptor);
+                }
+
+                _entries.Add(token, new Entry(Clone(descriptor), bytes));
+                TrimOldest();
+                return descriptor;
+            }
+        }
+
+        public bool TryRead(CultMeshBodyReadRequestMessage request, DateTimeOffset nowUtc, out CultMeshBodyDescriptor descriptor, out byte[] body)
+        {
+            if (request == null) throw new ArgumentNullException(nameof(request));
+            lock (_gate)
+            {
+                ThrowIfDisposed();
+                PruneExpired(nowUtc.ToUnixTimeMilliseconds());
+                if (!_entries.TryGetValue(request.CapabilityToken ?? string.Empty, out var entry) ||
+                    !MatchesRequest(entry.Descriptor, request))
+                {
+                    descriptor = new CultMeshBodyDescriptor();
+                    body = Array.Empty<byte>();
+                    return false;
+                }
+                descriptor = Clone(entry.Descriptor);
+                body = (byte[])entry.Body.Clone();
+                return true;
+            }
+        }
+
+        public void Dispose()
+        {
+            lock (_gate)
+            {
+                if (_disposed) return;
+                _disposed = true;
+                foreach (var entry in _entries.Values) Array.Clear(entry.Body, 0, entry.Body.Length);
+                _entries.Clear();
+                Array.Clear(_capabilitySecret, 0, _capabilitySecret.Length);
+            }
+        }
+
+        private string CapabilityToken(CultMeshBodyGeneration generation)
+        {
+            var input = Encoding.UTF8.GetBytes(string.Join("\u001f", generation.ProducerId, generation.BodyId,
+                generation.ProducerEpoch, generation.Sequence));
+            using var hmac = new HMACSHA256(_capabilitySecret);
+            return string.Concat(hmac.ComputeHash(input).Select(value => value.ToString("x2")));
+        }
+
+        private void PruneExpired(long nowUnixMs)
+        {
+            foreach (var key in _entries.Where(pair => pair.Value.Descriptor.LeaseExpiresAtUnixMs <= nowUnixMs)
+                         .Select(pair => pair.Key).ToArray())
+                Remove(key);
+        }
+
+        private void TrimOldest()
+        {
+            while (_entries.Count > _retainedGenerations)
+            {
+                var oldest = _entries.OrderBy(pair => pair.Value.Descriptor.ProducerEpoch)
+                    .ThenBy(pair => pair.Value.Descriptor.Sequence)
+                    .First().Key;
+                Remove(oldest);
+            }
+        }
+
+        private void Remove(string token)
+        {
+            if (!_entries.Remove(token, out var removed)) return;
+            Array.Clear(removed.Body, 0, removed.Body.Length);
+        }
+
+        private static bool MatchesRequest(CultMeshBodyDescriptor descriptor, CultMeshBodyReadRequestMessage request) =>
+            string.Equals(descriptor.CapabilityToken, request.CapabilityToken, StringComparison.Ordinal) &&
+            string.Equals(descriptor.BodyId, request.BodyId, StringComparison.Ordinal) &&
+            string.Equals(descriptor.SchemaId, request.BodySchemaId, StringComparison.Ordinal) &&
+            descriptor.LayoutVersion == request.LayoutVersion &&
+            descriptor.ProducerEpoch == request.ProducerEpoch && descriptor.Sequence == request.Sequence &&
+            descriptor.ByteSize == request.ExpectedSizeBytes &&
+            string.Equals(descriptor.SemanticHash, request.SemanticHash, StringComparison.Ordinal);
+
+        private static bool SameDescriptor(CultMeshBodyDescriptor left, CultMeshBodyDescriptor right) =>
+            left.BodyId == right.BodyId && left.SchemaId == right.SchemaId &&
+            left.LayoutVersion == right.LayoutVersion && left.ByteSize == right.ByteSize &&
+            left.Capacity == right.Capacity && left.ProducerEpoch == right.ProducerEpoch &&
+            left.Sequence == right.Sequence && left.Synchronization == right.Synchronization &&
+            left.LeaseExpiresAtUnixMs == right.LeaseExpiresAtUnixMs;
+
+        private static CultMeshBodyDescriptor Clone(CultMeshBodyDescriptor value) => new()
+        {
+            BodyId = value.BodyId, SchemaId = value.SchemaId, LayoutVersion = value.LayoutVersion,
+            ByteSize = value.ByteSize, Capacity = value.Capacity, ProducerEpoch = value.ProducerEpoch,
+            Sequence = value.Sequence, AccessMode = value.AccessMode, Synchronization = value.Synchronization,
+            LeaseExpiresAtUnixMs = value.LeaseExpiresAtUnixMs, TransportKind = value.TransportKind,
+            CapabilityToken = value.CapabilityToken, SemanticHash = value.SemanticHash
+        };
+
+        private static void ValidateGeneration(CultMeshBodyGeneration generation)
+        {
+            if (generation == null) throw new ArgumentNullException(nameof(generation));
+            if (string.IsNullOrWhiteSpace(generation.BodyId) || string.IsNullOrWhiteSpace(generation.ProducerId) ||
+                string.IsNullOrWhiteSpace(generation.SchemaId))
+                throw new ArgumentException("Body, producer, and schema identities are required.", nameof(generation));
+            if (generation.LayoutVersion < 0 || generation.Capacity < 0 || generation.ProducerEpoch < 0 ||
+                generation.Sequence < 0 || generation.LeaseExpiresAtUnixMs <= 0)
+                throw new ArgumentOutOfRangeException(nameof(generation));
+        }
+
+        private void ThrowIfDisposed()
+        {
+            if (_disposed) throw new ObjectDisposedException(nameof(CultMeshNetworkBodyStore));
+        }
+
+        private sealed class Entry
+        {
+            public Entry(CultMeshBodyDescriptor descriptor, byte[] body) { Descriptor = descriptor; Body = body; }
+            public CultMeshBodyDescriptor Descriptor { get; }
+            public byte[] Body { get; }
+        }
+    }
+
+    /// <summary>Serves capability-bound live bodies directly over an existing CultNet host.</summary>
+    public sealed class CultMeshBodyServer : IDisposable
+    {
+        private readonly ICultNetSchemaServer _server;
+        private readonly CultMeshNetworkBodyStore _bodies;
+        private readonly Func<CultMeshBodyReadRequestMessage, ICultNetSchemaServerPeer, Task> _handler;
+        private bool _disposed;
+
+        public CultMeshBodyServer(ICultNetSchemaServer server, CultMeshNetworkBodyStore bodies)
+        {
+            _server = server ?? throw new ArgumentNullException(nameof(server));
+            _bodies = bodies ?? throw new ArgumentNullException(nameof(bodies));
+            _handler = HandleAsync;
+            _server.OnCultNet(_handler);
+        }
+
+        public void Dispose()
+        {
+            if (_disposed) return;
+            _disposed = true;
+            _server.RemoveCultNetMessageListener<CultMeshBodyReadRequestMessage>(_handler);
+        }
+
+        private Task HandleAsync(CultMeshBodyReadRequestMessage request, ICultNetSchemaServerPeer peer)
+        {
+            var response = new CultMeshBodyReadResponseMessage
+            {
+                MessageId = request?.MessageId ?? string.Empty,
+                CapabilityToken = request?.CapabilityToken ?? string.Empty
+            };
+            try
+            {
+                if (request == null || string.IsNullOrWhiteSpace(request.MessageId))
+                    throw new InvalidDataException("Body read request requires a message identity.");
+                if (!_bodies.TryRead(request, DateTimeOffset.UtcNow, out var descriptor, out var bytes))
+                    throw new FileNotFoundException("Body capability is unavailable or does not match its generation.");
+                response.Found = true;
+                response.BodyId = descriptor.BodyId;
+                response.ProducerEpoch = descriptor.ProducerEpoch;
+                response.Sequence = descriptor.Sequence;
+                response.SizeBytes = descriptor.ByteSize;
+                response.SemanticHash = descriptor.SemanticHash;
+                response.Payload = bytes;
+            }
+            catch (Exception error)
+            {
+                response.Found = false;
+                response.Error = error.GetType().Name + ": " + error.Message;
+                response.Payload = Array.Empty<byte>();
+            }
+            peer.SendCultNet(response);
+            return Task.CompletedTask;
+        }
+    }
+
+    public sealed class CultMeshSessionBodyProviderOptions
+    {
+        public ICultMeshClock Clock { get; set; } = CultMeshSystemClock.Instance;
+        public TimeSpan ResponseTimeout { get; set; } = TimeSpan.FromSeconds(2);
+    }
+
+    /// <summary>Reads live body generations through one reusable identity-first body session.</summary>
+    public sealed class CultMeshSessionBodyProvider
+    {
+        private readonly CultMeshSessionManager _sessions;
+        private readonly CultMeshSessionTarget _target;
+        private readonly CultMeshSessionBodyProviderOptions _options;
+
+        public CultMeshSessionBodyProvider(string providerId, CultMeshSessionManager sessions,
+            CultMeshSessionTarget target, CultMeshSessionBodyProviderOptions? options = null)
+        {
+            ProviderId = string.IsNullOrWhiteSpace(providerId) ? throw new ArgumentException("Provider identity is required.", nameof(providerId)) : providerId;
+            _sessions = sessions ?? throw new ArgumentNullException(nameof(sessions));
+            _target = target ?? throw new ArgumentNullException(nameof(target));
+            _options = options ?? new CultMeshSessionBodyProviderOptions();
+            if (_options.ResponseTimeout <= TimeSpan.Zero) throw new ArgumentOutOfRangeException(nameof(options));
+        }
+
+        public string ProviderId { get; }
+        public Func<CultMeshBodyDescriptor, byte[]> CreateFetchDelegate() =>
+            descriptor => FetchAsync(descriptor).GetAwaiter().GetResult();
+
+        public async Task<byte[]> FetchAsync(CultMeshBodyDescriptor descriptor, CancellationToken cancellationToken = default)
+        {
+            if (descriptor == null) throw new ArgumentNullException(nameof(descriptor));
+            if (descriptor.TransportKind != CultMeshBodyTransportKind.Network)
+                throw new NotSupportedException("Direct body provider requires a network descriptor.");
+            var session = await _sessions.ConnectAsync(_target, CultMeshProtocols.Bodies, cancellationToken).ConfigureAwait(false);
+            var messageId = Guid.NewGuid().ToString("N");
+            var completion = new TaskCompletionSource<CultMeshBodyReadResponseMessage>(TaskCreationOptions.RunContinuationsAsynchronously);
+            using var responseSubscription = session.OnCultNet<CultMeshBodyReadResponseMessage>(response =>
+            {
+                if (string.Equals(response.MessageId, messageId, StringComparison.Ordinal)) completion.TrySetResult(response);
+            });
+            using var errorSubscription = session.OnCultNet<CultNetErrorMessage>(error => completion.TrySetException(new IOException(error.Error)));
+            session.SendCultNet(new CultMeshBodyReadRequestMessage
+            {
+                MessageId = messageId, CapabilityToken = descriptor.CapabilityToken, BodyId = descriptor.BodyId,
+                BodySchemaId = descriptor.SchemaId, LayoutVersion = descriptor.LayoutVersion,
+                ProducerEpoch = descriptor.ProducerEpoch, Sequence = descriptor.Sequence,
+                ExpectedSizeBytes = descriptor.ByteSize, SemanticHash = descriptor.SemanticHash
+            });
+            var response = await WaitAsync(completion.Task, cancellationToken).ConfigureAwait(false);
+            if (!response.Found) throw new FileNotFoundException(
+                $"Body provider '{ProviderId}' rejected '{descriptor.BodyId}' generation {descriptor.Sequence}: {response.Error}");
+            var body = response.Payload ?? Array.Empty<byte>();
+            if (!string.Equals(response.CapabilityToken, descriptor.CapabilityToken, StringComparison.Ordinal) ||
+                !string.Equals(response.BodyId, descriptor.BodyId, StringComparison.Ordinal) ||
+                response.ProducerEpoch != descriptor.ProducerEpoch || response.Sequence != descriptor.Sequence ||
+                response.SizeBytes != descriptor.ByteSize || body.LongLength != descriptor.ByteSize ||
+                !string.Equals(response.SemanticHash, descriptor.SemanticHash, StringComparison.Ordinal) ||
+                !string.Equals(CultMeshBodyDescriptorValidator.ComputeSemanticHash(body), descriptor.SemanticHash, StringComparison.Ordinal))
+                throw new InvalidDataException("Direct body response disagrees with its advertised generation.");
+            return body;
+        }
+
+        private async Task<CultMeshBodyReadResponseMessage> WaitAsync(Task<CultMeshBodyReadResponseMessage> response, CancellationToken cancellationToken)
+        {
+            using var deadlineCancellation = CancellationTokenSource.CreateLinkedTokenSource(cancellationToken);
+            var deadline = _options.Clock.DelayAsync(_options.ResponseTimeout, deadlineCancellation.Token);
+            var completed = await Task.WhenAny(response, deadline).ConfigureAwait(false);
+            if (completed == response) { deadlineCancellation.Cancel(); return await response.ConfigureAwait(false); }
+            cancellationToken.ThrowIfCancellationRequested();
+            throw new TimeoutException($"Timed out fetching live body from provider '{ProviderId}'.");
+        }
+    }
+}
diff --git a/src/GameCult.Mesh/CultMeshCdn.cs b/src/GameCult.Mesh/CultMeshCdn.cs
new file mode 100644
index 00000000..6ea4696f
--- /dev/null
+++ b/src/GameCult.Mesh/CultMeshCdn.cs
@@ -0,0 +1,582 @@
+using System;
+using System.Collections.Generic;
+using System.Globalization;
+using System.IO;
+using System.Linq;
+using System.Security.Cryptography;
+using System.Text;
+using System.Threading.Tasks;
+using GameCult.Caching;
+using GameCult.Networking;
+using MessagePack;
+
+namespace GameCult.Mesh
+{
+    /// <summary>
+    /// Schema versions for CultMesh distributed CDN documents.
+    /// </summary>
+    public static class CultMeshCdnSchemaVersions
+    {
+        /// <summary>Manifest document schema id.</summary>
+        public const string ArtifactManifest = "gamecult.mesh.cdn_artifact_manifest.v1";
+        /// <summary>Chunk document schema id.</summary>
+        public const string ArtifactChunk = "gamecult.mesh.cdn_artifact_chunk.v1";
+    }
+
+    /// <summary>
+    /// Well-known CultMesh CDN artifact kinds.
+    /// </summary>
+    public static class CultMeshCdnArtifactKinds
+    {
+        /// <summary>Game, UI, shader, texture, audio, or data asset payload.</summary>
+        public const string Asset = "asset";
+        /// <summary>Executable build or install/update payload.</summary>
+        public const string Build = "build";
+        /// <summary>Generic packaged payload.</summary>
+        public const string Package = "package";
+    }
+
+    /// <summary>
+    /// Options for packing bytes into CultMesh CDN documents.
+    /// </summary>
+    public sealed class CultMeshCdnPackOptions
+    {
+        /// <summary>Default CDN chunk size.</summary>
+        public const int DefaultChunkSizeBytes = 4 * 1024 * 1024;
+
+        /// <summary>Maximum bytes per content chunk.</summary>
+        public int ChunkSizeBytes { get; set; } = DefaultChunkSizeBytes;
+
+        /// <summary>Artifact kind, such as asset or build.</summary>
+        public string Kind { get; set; } = CultMeshCdnArtifactKinds.Asset;
+
+        /// <summary>Caller-defined artifact version.</summary>
+        public string Version { get; set; } = string.Empty;
+
+        /// <summary>Artifact MIME type.</summary>
+        public string MimeType { get; set; } = "application/octet-stream";
+
+        /// <summary>Search and routing tags copied to the manifest.</summary>
+        public string[] Tags { get; set; } = Array.Empty<string>();
+
+        /// <summary>Caller metadata copied to the manifest.</summary>
+        public Dictionary<string, string> Metadata { get; set; } = new();
+
+        /// <summary>Override manifest creation timestamp in round-trip UTC format.</summary>
+        public string? CreatedAtUtc { get; set; }
+    }
+
+    /// <summary>
+    /// Reference from an artifact manifest to one content-addressed chunk document.
+    /// </summary>
+    [MessagePackObject]
+    public sealed class CultMeshCdnChunkRef
+    {
+        /// <summary>SHA-256 hash of the referenced chunk payload.</summary>
+        [Key(0)]
+        public string ChunkHash { get; set; } = string.Empty;
+
+        /// <summary>Byte offset of this chunk inside the materialized artifact.</summary>
+        [Key(1)]
+        public long Offset { get; set; }
+
+        /// <summary>Number of payload bytes contributed by this chunk.</summary>
+        [Key(2)]
+        public int SizeBytes { get; set; }
+
+        /// <summary>CultCache record key for the referenced chunk document.</summary>
+        [Key(3)]
+        public string RecordKey { get; set; } = string.Empty;
+    }
+
+    /// <summary>
+    /// Content-addressed artifact chunk stored in CultCache and replicated through CultNet.
+    /// </summary>
+    [MessagePackObject]
+    [CultDocument("gamecult.mesh.cdn_artifact_chunk", CultMeshCdnSchemaVersions.ArtifactChunk)]
+    public sealed class CultMeshCdnArtifactChunk
+    {
+        /// <summary>SHA-256 hash of the chunk payload.</summary>
+        [Key(0)]
+        [CultName]
+        public string ChunkHash { get; set; } = string.Empty;
+
+        /// <summary>Payload byte count.</summary>
+        [Key(1)]
+        public int SizeBytes { get; set; }
+
+        /// <summary>Raw chunk payload bytes.</summary>
+        [Key(2)]
+        public byte[] Payload { get; set; } = Array.Empty<byte>();
+
+        /// <summary>Builds the deterministic content-addressed chunk record key.</summary>
+        public static CultRecordKey CreateRecordKey(CultMeshCdnArtifactChunk chunk)
+        {
+            if (chunk == null) throw new ArgumentNullException(nameof(chunk));
+            return CreateRecordKey(chunk.ChunkHash);
+        }
+
+        /// <summary>Builds the deterministic content-addressed chunk record key.</summary>
+        public static CultRecordKey CreateRecordKey(string chunkHash)
+        {
+            return new CultRecordKey("mesh:cdn:chunk:" + CultMeshCdn.NormalizeHash(chunkHash, nameof(chunkHash)));
+        }
+    }
+
+    /// <summary>
+    /// Manifest for one versioned CDN artifact assembled from content-addressed chunks.
+    /// </summary>
+    [MessagePackObject]
+    [CultDocument("gamecult.mesh.cdn_artifact_manifest", CultMeshCdnSchemaVersions.ArtifactManifest)]
+    public sealed class CultMeshCdnArtifactManifest
+    {
+        /// <summary>Stable artifact id, such as a logical asset or build path.</summary>
+        [Key(0)]
+        [CultName]
+        public string ArtifactId { get; set; } = string.Empty;
+
+        /// <summary>Artifact kind, such as asset, build, or package.</summary>
+        [Key(1)]
+        [CultIndex]
+        public string Kind { get; set; } = CultMeshCdnArtifactKinds.Asset;
+
+        /// <summary>Caller-defined artifact version.</summary>
+        [Key(2)]
+        [CultIndex]
+        public string Version { get; set; } = string.Empty;
+
+        /// <summary>SHA-256 hash of the full materialized artifact.</summary>
+        [Key(3)]
+        [CultIndex]
+        public string ContentHash { get; set; } = string.Empty;
+
+        /// <summary>Full materialized artifact size.</summary>
+        [Key(4)]
+        public long SizeBytes { get; set; }
+
+        /// <summary>Artifact MIME type.</summary>
+        [Key(5)]
+        public string MimeType { get; set; } = "application/octet-stream";
+
+        /// <summary>Manifest creation timestamp in round-trip UTC format.</summary>
+        [Key(6)]
+        public string CreatedAtUtc { get; set; } = string.Empty;
+
+        /// <summary>Ordered chunk references needed to materialize the artifact.</summary>
+        [Key(7)]
+        public CultMeshCdnChunkRef[] Chunks { get; set; } = Array.Empty<CultMeshCdnChunkRef>();
+
+        /// <summary>Search and routing tags.</summary>
+        [Key(8)]
+        public string[] Tags { get; set; } = Array.Empty<string>();
+
+        /// <summary>Caller metadata, such as platform or texture channel layout.</summary>
+        [Key(9)]
+        public Dictionary<string, string> Metadata { get; set; } = new();
+
+        /// <summary>Builds the deterministic versioned artifact manifest record key.</summary>
+        public static CultRecordKey CreateRecordKey(CultMeshCdnArtifactManifest manifest)
+        {
+            if (manifest == null) throw new ArgumentNullException(nameof(manifest));
+            return CreateRecordKey(manifest.ArtifactId, manifest.Version, manifest.ContentHash);
+        }
+
+        /// <summary>Builds the deterministic versioned artifact manifest record key.</summary>
+        public static CultRecordKey CreateRecordKey(string artifactId, string version, string contentHash)
+        {
+            var artifactToken = CultMeshCdn.StableToken(artifactId, nameof(artifactId));
+            var versionToken = string.IsNullOrWhiteSpace(version)
+                ? "unversioned"
+                : CultMeshCdn.StableToken(version, nameof(version));
+            return new CultRecordKey(
+                "mesh:cdn:artifact:" + artifactToken + ":" + versionToken + ":" + CultMeshCdn.NormalizeHash(contentHash, nameof(contentHash)));
+        }
+    }
+
+    /// <summary>
+    /// Packed CDN artifact ready to publish into a cache or database.
+    /// </summary>
+    public sealed class CultMeshCdnArtifact
+    {
+        /// <summary>Creates a packed artifact container.</summary>
+        public CultMeshCdnArtifact(
+            CultMeshCdnArtifactManifest manifest,
+            IReadOnlyList<CultMeshCdnArtifactChunk> chunks)
+        {
+            Manifest = manifest ?? throw new ArgumentNullException(nameof(manifest));
+            Chunks = chunks ?? throw new ArgumentNullException(nameof(chunks));
+        }
+
+        /// <summary>Artifact manifest document.</summary>
+        public CultMeshCdnArtifactManifest Manifest { get; }
+
+        /// <summary>Content-addressed chunk documents.</summary>
+        public IReadOnlyList<CultMeshCdnArtifactChunk> Chunks { get; }
+
+        /// <summary>Deterministic manifest record key.</summary>
+        public CultRecordKey ManifestKey => CultMeshCdnArtifactManifest.CreateRecordKey(Manifest);
+
+        /// <summary>All unique record keys required to replicate this artifact.</summary>
+        public IReadOnlyList<CultRecordKey> RecordKeys =>
+            new[] { ManifestKey }.Concat(Chunks.Select(CultMeshCdnArtifactChunk.CreateRecordKey)).Distinct().ToArray();
+    }
+
+    /// <summary>
+    /// Content-addressed byte artifact helpers for distributing assets and builds through CultMesh clients.
+    /// </summary>
+    public static class CultMeshCdn
+    {
+        /// <summary>
+        /// Splits a payload into content-addressed chunk documents and a versioned manifest.
+        /// </summary>
+        public static CultMeshCdnArtifact PackArtifact(
+            string artifactId,
+            byte[] payload,
+            CultMeshCdnPackOptions? options = null)
+        {
+            if (string.IsNullOrWhiteSpace(artifactId))
+            {
+                throw new ArgumentException("Artifact id must be non-empty.", nameof(artifactId));
+            }
+
+            if (payload == null) throw new ArgumentNullException(nameof(payload));
+            options ??= new CultMeshCdnPackOptions();
+            if (options.ChunkSizeBytes <= 0)
+            {
+                throw new ArgumentOutOfRangeException(nameof(options), "ChunkSizeBytes must be greater than zero.");
+            }
+
+            var chunks = new List<CultMeshCdnArtifactChunk>();
+            var refs = new List<CultMeshCdnChunkRef>();
+            for (var offset = 0; offset < payload.Length; offset += options.ChunkSizeBytes)
+            {
+                var count = Math.Min(options.ChunkSizeBytes, payload.Length - offset);
+                var chunkPayload = new byte[count];
+                Buffer.BlockCopy(payload, offset, chunkPayload, 0, count);
+                var chunkHash = HashBytes(chunkPayload);
+                var chunk = new CultMeshCdnArtifactChunk
+                {
+                    ChunkHash = chunkHash,
+                    SizeBytes = count,
+                    Payload = chunkPayload
+                };
+                chunks.Add(chunk);
+                refs.Add(new CultMeshCdnChunkRef
+                {
+                    ChunkHash = chunkHash,
+                    Offset = offset,
+                    SizeBytes = count,
+                    RecordKey = CultMeshCdnArtifactChunk.CreateRecordKey(chunk).Value
+                });
+            }
+
+            if (payload.Length == 0)
+            {
+                var chunkHash = HashBytes(Array.Empty<byte>());
+                var chunk = new CultMeshCdnArtifactChunk
+                {
+                    ChunkHash = chunkHash,
+                    SizeBytes = 0,
+                    Payload = Array.Empty<byte>()
+                };
+                chunks.Add(chunk);
+                refs.Add(new CultMeshCdnChunkRef
+                {
+                    ChunkHash = chunkHash,
+                    Offset = 0,
+                    SizeBytes = 0,
+                    RecordKey = CultMeshCdnArtifactChunk.CreateRecordKey(chunk).Value
+                });
+            }
+
+            var manifest = new CultMeshCdnArtifactManifest
+            {
+                ArtifactId = artifactId,
+                Kind = string.IsNullOrWhiteSpace(options.Kind) ? CultMeshCdnArtifactKinds.Asset : options.Kind,
+                Version = options.Version ?? string.Empty,
+                ContentHash = HashBytes(payload),
+                SizeBytes = payload.LongLength,
+                MimeType = string.IsNullOrWhiteSpace(options.MimeType) ? "application/octet-stream" : options.MimeType,
+                CreatedAtUtc = options.CreatedAtUtc ?? DateTimeOffset.UtcNow.ToString("O", CultureInfo.InvariantCulture),
+                Chunks = refs.ToArray(),
+                Tags = options.Tags ?? Array.Empty<string>(),
+                Metadata = options.Metadata ?? new Dictionary<string, string>()
+            };
+
+            return new CultMeshCdnArtifact(manifest, chunks);
+        }
+
+        /// <summary>
+        /// Publishes all chunk documents and the manifest into a local CultCache.
+        /// </summary>
+        public static async Task<CultMeshCdnArtifactManifest> PublishAsync(
+            CultCache cache,
+            CultMeshCdnArtifact artifact)
+        {
+            if (cache == null) throw new ArgumentNullException(nameof(cache));
+            if (artifact == null) throw new ArgumentNullException(nameof(artifact));
+
+            ValidateArtifact(artifact);
+            foreach (var chunk in artifact.Chunks)
+            {
+                await cache.UpsertAsync(
+                    chunk,
+                    new CultRecordHandle<CultMeshCdnArtifactChunk>(
+                        CultMeshCdnArtifactChunk.CreateRecordKey(chunk))).ConfigureAwait(false);
+            }
+
+            await cache.UpsertAsync(
+                artifact.Manifest,
+                new CultRecordHandle<CultMeshCdnArtifactManifest>(
+                    CultMeshCdnArtifactManifest.CreateRecordKey(artifact.Manifest))).ConfigureAwait(false);
+
+            return artifact.Manifest;
+        }
+
+        /// <summary>
+        /// Publishes all chunk documents and the manifest into a distributed CultNet database.
+        /// </summary>
+        public static async Task<CultMeshCdnArtifactManifest> PublishAsync(
+            CultNetDatabase database,
+            CultMeshCdnArtifact artifact)
+        {
+            if (database == null) throw new ArgumentNullException(nameof(database));
+            if (artifact == null) throw new ArgumentNullException(nameof(artifact));
+
+            ValidateArtifact(artifact);
+            foreach (var chunk in artifact.Chunks)
+            {
+                await database.PutAsync(CultMeshCdnArtifactChunk.CreateRecordKey(chunk), chunk)
+                    .ConfigureAwait(false);
+            }
+
+            await database.PutAsync(CultMeshCdnArtifactManifest.CreateRecordKey(artifact.Manifest), artifact.Manifest)
+                .ConfigureAwait(false);
+            return artifact.Manifest;
+        }
+
+        /// <summary>
+        /// Reassembles and verifies an artifact from a local CultCache.
+        /// </summary>
+        public static byte[] ReadArtifact(CultCache cache, CultMeshCdnArtifactManifest manifest)
+        {
+            if (cache == null) throw new ArgumentNullException(nameof(cache));
+            if (manifest == null) throw new ArgumentNullException(nameof(manifest));
+
+            ValidateManifestShape(manifest);
+            if (manifest.SizeBytes > int.MaxValue)
+            {
+                throw new InvalidDataException("CDN artifact is too large to materialize into one byte array.");
+            }
+            var output = new byte[checked((int)manifest.SizeBytes)];
+            foreach (var reference in manifest.Chunks.OrderBy(chunk => chunk.Offset))
+            {
+                var recordKey = string.IsNullOrWhiteSpace(reference.RecordKey)
+                    ? CultMeshCdnArtifactChunk.CreateRecordKey(reference.ChunkHash)
+                    : new CultRecordKey(reference.RecordKey);
+                var chunk = cache.Get<CultMeshCdnArtifactChunk>(recordKey)
+                    ?? throw new FileNotFoundException("CDN artifact chunk is missing from the cache.", recordKey.Value);
+                ValidateChunk(reference, chunk);
+                Buffer.BlockCopy(chunk.Payload, 0, output, checked((int)reference.Offset), reference.SizeBytes);
+            }
+
+            var actualHash = HashBytes(output);
+            if (!string.Equals(NormalizeHash(manifest.ContentHash, nameof(manifest.ContentHash)), actualHash, StringComparison.Ordinal))
+            {
+                throw new InvalidDataException("CDN artifact content hash does not match its manifest.");
+            }
+
+            return output;
+        }
+
+        /// <summary>
+        /// Reassembles and verifies an artifact from a distributed CultNet database.
+        /// </summary>
+        public static async Task<byte[]> ReadArtifactAsync(
+            CultNetDatabase database,
+            CultMeshCdnArtifactManifest manifest)
+        {
+            if (database == null) throw new ArgumentNullException(nameof(database));
+            if (manifest == null) throw new ArgumentNullException(nameof(manifest));
+
+            var directory = Path.Combine(Path.GetTempPath(), "cultmesh-content", Guid.NewGuid().ToString("N"));
+            try
+            {
+                using var state = new CultCache();
+                var service = new CultMeshContentTransferService(
+                    state,
+                    new[] { new CultMeshDatabaseContentProvider("legacy-database", database) },
+                    new CultMeshContentTransferOptions(directory));
+                var path = await service.FetchAsync(manifest).ConfigureAwait(false);
+                return await File.ReadAllBytesAsync(path).ConfigureAwait(false);
+            }
+            finally
+            {
+                if (Directory.Exists(directory)) Directory.Delete(directory, true);
+            }
+        }
+
+        /// <summary>
+        /// Creates a raw CultNet document registry for CDN manifests and chunks.
+        /// </summary>
+        public static CultNetDocumentRegistry CreateDocumentRegistry(CultDocumentRegistry? documents = null)
+        {
+            documents ??= CultDocumentRegistry.Shared;
+            return new CultNetDocumentRegistry(documents)
+                .Register(CultNetDocumentBinding.ForDocument<CultMeshCdnArtifactManifest>(documents))
+                .Register(CultNetDocumentBinding.ForDocument<CultMeshCdnArtifactChunk>(documents));
+        }
+
+        internal static string HashBytes(byte[] bytes)
+        {
+            using var sha256 = SHA256.Create();
+            var hash = sha256.ComputeHash(bytes);
+            var builder = new StringBuilder(hash.Length * 2);
+            foreach (var value in hash)
+            {
+                builder.Append(value.ToString("x2", CultureInfo.InvariantCulture));
+            }
+
+            return builder.ToString();
+        }
+
+        private static void ValidateArtifact(CultMeshCdnArtifact artifact)
+        {
+            ValidateManifestShape(artifact.Manifest);
+            var expectedRefs = artifact.Chunks
+                .Select(chunk => new
+                {
+                    Hash = HashBytes(chunk.Payload),
+                    ChunkHash = NormalizeHash(chunk.ChunkHash, nameof(chunk.ChunkHash)),
+                    chunk.SizeBytes,
+                    Key = CultMeshCdnArtifactChunk.CreateRecordKey(chunk).Value
+                })
+                .ToArray();
+
+            if (artifact.Manifest.Chunks.Length != expectedRefs.Length)
+            {
+                throw new InvalidDataException("CDN artifact manifest chunk count does not match chunk payloads.");
+            }
+
+            for (var i = 0; i < expectedRefs.Length; i++)
+            {
+                var reference = artifact.Manifest.Chunks[i];
+                var expected = expectedRefs[i];
+                if (!string.Equals(NormalizeHash(reference.ChunkHash, nameof(reference.ChunkHash)), expected.Hash, StringComparison.Ordinal) ||
+                    !string.Equals(expected.ChunkHash, expected.Hash, StringComparison.Ordinal) ||
+                    reference.SizeBytes != expected.SizeBytes ||
+                    !string.Equals(reference.RecordKey, expected.Key, StringComparison.Ordinal))
+                {
+                    throw new InvalidDataException("CDN artifact manifest chunk reference does not match its chunk payload.");
+                }
+            }
+
+            var materialized = new byte[checked((int)artifact.Manifest.SizeBytes)];
+            foreach (var reference in artifact.Manifest.Chunks.OrderBy(chunk => chunk.Offset))
+            {
+                var chunk = artifact.Chunks.First(candidate =>
+                    string.Equals(
+                        CultMeshCdnArtifactChunk.CreateRecordKey(candidate).Value,
+                        reference.RecordKey,
+                        StringComparison.Ordinal));
+                Buffer.BlockCopy(chunk.Payload, 0, materialized, checked((int)reference.Offset), reference.SizeBytes);
+            }
+
+            if (!string.Equals(
+                NormalizeHash(artifact.Manifest.ContentHash, nameof(artifact.Manifest.ContentHash)),
+                HashBytes(materialized),
+                StringComparison.Ordinal))
+            {
+                throw new InvalidDataException("CDN artifact content hash does not match its manifest.");
+            }
+        }
+
+        internal static void ValidateManifest(CultMeshCdnArtifactManifest manifest)
+        {
+            ValidateManifestShape(manifest);
+        }
+
+        private static void ValidateManifestShape(CultMeshCdnArtifactManifest manifest)
+        {
+            if (manifest.SizeBytes < 0)
+            {
+                throw new InvalidDataException("CDN artifact manifest has a negative size.");
+            }
+
+            var expectedOffset = 0L;
+            foreach (var reference in manifest.Chunks.OrderBy(chunk => chunk.Offset))
+            {
+                if (reference.Offset != expectedOffset)
+                {
+                    throw new InvalidDataException("CDN artifact chunks are not contiguous.");
+                }
+
+                if (reference.SizeBytes < 0)
+                {
+                    throw new InvalidDataException("CDN artifact chunk has a negative size.");
+                }
+
+                expectedOffset += reference.SizeBytes;
+            }
+
+            if (expectedOffset != manifest.SizeBytes)
+            {
+                throw new InvalidDataException("CDN artifact chunk sizes do not sum to the manifest size.");
+            }
+        }
+
+        internal static void ValidateChunkPayload(CultMeshCdnChunkRef reference, CultMeshCdnArtifactChunk chunk)
+        {
+            ValidateChunk(reference, chunk);
+        }
+
+        private static void ValidateChunk(CultMeshCdnChunkRef reference, CultMeshCdnArtifactChunk chunk)
+        {
+            if (chunk.Payload.Length != reference.SizeBytes ||
+                chunk.SizeBytes != reference.SizeBytes)
+            {
+                throw new InvalidDataException("CDN artifact chunk payload metadata does not match its manifest reference.");
+            }
+
+            var actualHash = HashBytes(chunk.Payload);
+            if (!string.Equals(NormalizeHash(reference.ChunkHash, nameof(reference.ChunkHash)), actualHash, StringComparison.Ordinal) ||
+                !string.Equals(NormalizeHash(chunk.ChunkHash, nameof(chunk.ChunkHash)), actualHash, StringComparison.Ordinal))
+            {
+                throw new InvalidDataException("CDN artifact chunk hash does not match its payload.");
+            }
+        }
+
+        internal static string NormalizeHash(string hash, string parameterName)
+        {
+            if (string.IsNullOrWhiteSpace(hash))
+            {
+                throw new ArgumentException("Hash must be non-empty.", parameterName);
+            }
+
+            var value = hash.StartsWith("sha256:", StringComparison.OrdinalIgnoreCase)
+                ? hash.Substring("sha256:".Length)
+                : hash;
+            return value.Trim().ToLowerInvariant();
+        }
+
+        internal static string StableToken(string value, string parameterName)
+        {
+            if (string.IsNullOrWhiteSpace(value))
+            {
+                throw new ArgumentException("Value must be non-empty.", parameterName);
+            }
+
+            var normalized = value.Trim().ToLowerInvariant();
+            var builder = new StringBuilder(normalized.Length);
+            foreach (var c in normalized)
+            {
+                builder.Append(char.IsLetterOrDigit(c) || c == '-' || c == '_' || c == '.' ? c : '-');
+            }
+
+            var token = builder.ToString().Trim('-');
+            return string.IsNullOrWhiteSpace(token)
+                ? HashBytes(Encoding.UTF8.GetBytes(value))
+                : token;
+        }
+    }
+}
diff --git a/src/GameCult.Mesh/CultMeshClient.cs b/src/GameCult.Mesh/CultMeshClient.cs
new file mode 100644
index 00000000..5db03ca5
--- /dev/null
+++ b/src/GameCult.Mesh/CultMeshClient.cs
@@ -0,0 +1,1019 @@
+using System;
+using System.Collections.Generic;
+using System.Collections.Concurrent;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using GameCult.Caching;
+using GameCult.Networking;
+using MessagePack;
+using R3;
+
+namespace GameCult.Mesh
+{
+    /// <summary>Configures one application-lifetime CultMesh client.</summary>
+    public sealed class CultMeshClientOptions
+    {
+        /// <summary>Gets or sets the rendezvous endpoints used to bootstrap stable identities.</summary>
+        public IReadOnlyList<string> RendezvousEndpoints { get; set; } = Array.Empty<string>();
+
+        /// <summary>Gets or sets Verse discovery transport and persistence options.</summary>
+        public CultMeshVerseDiscoveryClientOptions Discovery { get; set; } = new();
+
+        /// <summary>Gets or sets session path and diagnostic policy.</summary>
+        public CultMeshSessionManagerOptions Sessions { get; set; } = new();
+
+        /// <summary>Gets or sets schema connectors. Length-prefixed TCP is used by default.</summary>
+        public IReadOnlyList<ICultMeshTransportConnector>? Connectors { get; set; }
+
+        /// <summary>
+        /// Gets or sets streaming content connectors. HTTPS and loopback TCP content
+        /// delivery are used by default; applications may replace them or explicitly add legacy RUDP.
+        /// </summary>
+        public IReadOnlyList<ICultMeshContentTransportConnector>? ContentConnectors { get; set; }
+
+        /// <summary>
+        /// Gets or sets realtime state connectors. No connector is installed implicitly;
+        /// promoted runtimes should register QUIC and may explicitly add a legacy fallback.
+        /// </summary>
+        public IReadOnlyList<ICultMeshRealtimeTransportConnector> RealtimeConnectors { get; set; } =
+            Array.Empty<ICultMeshRealtimeTransportConnector>();
+
+        /// <summary>Gets or sets the deadline before an unanswered subscription intent is replayed.</summary>
+        public TimeSpan SubscriptionResponseTimeout { get; set; } = TimeSpan.FromSeconds(2);
+
+        /// <summary>Gets or sets the deadline for one correlated typed operation response.</summary>
+        public TimeSpan OperationResponseTimeout { get; set; } = TimeSpan.FromSeconds(10);
+    }
+
+    /// <summary>
+    /// Carries one provider-authored operation response. Transport delivery does not by itself
+    /// establish that the provider accepted or committed the requested gameplay change.
+    /// </summary>
+    public sealed class CultMeshOperationResult<TResponse>
+    {
+        internal CultMeshOperationResult(CultNetOperationResponseMessage envelope, TResponse value)
+        {
+            MessageId = envelope.MessageId;
+            ServiceId = envelope.ServiceId;
+            Operation = envelope.Operation;
+            Status = envelope.Status;
+            PayloadSchema = envelope.PayloadSchema;
+            SourceRuntimeId = envelope.SourceRuntimeId;
+            Diagnostics = envelope.Diagnostics ?? Array.Empty<string>();
+            Value = value;
+        }
+
+        /// <summary>Gets the durable caller-supplied idempotency key.</summary>
+        public string MessageId { get; }
+        /// <summary>Gets the provider service that answered.</summary>
+        public string ServiceId { get; }
+        /// <summary>Gets the operation that answered.</summary>
+        public string Operation { get; }
+        /// <summary>Gets the provider-authored operation status.</summary>
+        public string Status { get; }
+        /// <summary>Gets the portable response payload schema.</summary>
+        public string PayloadSchema { get; }
+        /// <summary>Gets the responding runtime identity, when supplied.</summary>
+        public string? SourceRuntimeId { get; }
+        /// <summary>Gets provider or transport diagnostics carried by the response.</summary>
+        public IReadOnlyList<string> Diagnostics { get; }
+        /// <summary>Gets the decoded typed response payload.</summary>
+        public TResponse Value { get; }
+    }
+
+    /// <summary>Correlated framework-level failure returned before a typed domain reply exists.</summary>
+    public sealed class CultMeshRemoteOperationException : Exception
+    {
+        internal CultMeshRemoteOperationException(
+            CultNetOperationResponseMessage envelope,
+            CultNetOperationFailure failure)
+            : base(failure?.Message ?? "CultMesh operation failed.")
+        {
+            Status = envelope?.Status ?? "error";
+            Code = failure?.Code ?? "operation-error";
+            Diagnostics = envelope?.Diagnostics ?? Array.Empty<string>();
+        }
+
+        /// <summary>Gets the provider-authored failure status.</summary>
+        public string Status { get; }
+
+        /// <summary>Gets the stable machine-readable failure code.</summary>
+        public string Code { get; }
+
+        /// <summary>Gets provider diagnostics carried by the response.</summary>
+        public IReadOnlyList<string> Diagnostics { get; }
+    }
+
+    /// <summary>Owns one shared live document subscription until disposed.</summary>
+    public sealed class CultMeshDocumentLease<TDocument> : IDisposable where TDocument : class
+    {
+        private Action? _release;
+
+        internal CultMeshDocumentLease(CultMeshDocumentHandle<TDocument> handle, Action release)
+        {
+            Handle = handle ?? throw new ArgumentNullException(nameof(handle));
+            _release = release ?? throw new ArgumentNullException(nameof(release));
+        }
+
+        /// <summary>Gets the live typed document handle owned by this lease.</summary>
+        public CultMeshDocumentHandle<TDocument> Handle { get; }
+
+        public void Dispose() => Interlocked.Exchange(ref _release, null)?.Invoke();
+    }
+
+    /// <summary>Owns one shared live collection subscription until disposed.</summary>
+    public sealed class CultMeshCollectionLease<TDocument> : IDisposable where TDocument : class
+    {
+        private Action? _release;
+
+        internal CultMeshCollectionLease(CultMeshCollectionHandle<TDocument> handle, Action release)
+        {
+            Handle = handle ?? throw new ArgumentNullException(nameof(handle));
+            _release = release ?? throw new ArgumentNullException(nameof(release));
+        }
+
+        /// <summary>Gets the live typed collection handle owned by this lease.</summary>
+        public CultMeshCollectionHandle<TDocument> Handle { get; }
+
+        public void Dispose() => Interlocked.Exchange(ref _release, null)?.Invoke();
+    }
+
+    /// <summary>
+    /// Owns discovery and reusable sessions for one application lifetime.
+    /// Applications address stable identities; CultMesh owns physical routes and reconnection.
+    /// </summary>
+    public sealed class CultMeshClient : IDisposable
+    {
+        private readonly CultMeshDiscoveryService _discovery;
+        private readonly CultMeshSessionManager _sessions;
+        private readonly TimeSpan _subscriptionResponseTimeout;
+        private readonly TimeSpan _operationResponseTimeout;
+        private readonly ConcurrentDictionary<string, SharedResource> _documents = new(StringComparer.Ordinal);
+        private readonly ConcurrentDictionary<string, SharedResource> _collections = new(StringComparer.Ordinal);
+        private bool _disposed;
+
+        public CultMeshClient(CultMeshClientOptions options)
+        {
+            if (options == null) throw new ArgumentNullException(nameof(options));
+            if (options.SubscriptionResponseTimeout <= TimeSpan.Zero)
+                throw new ArgumentOutOfRangeException(nameof(options.SubscriptionResponseTimeout));
+            if (options.OperationResponseTimeout <= TimeSpan.Zero)
+                throw new ArgumentOutOfRangeException(nameof(options.OperationResponseTimeout));
+            var endpoints = options.RendezvousEndpoints
+                .Where(endpoint => !string.IsNullOrWhiteSpace(endpoint))
+                .Distinct(StringComparer.Ordinal)
+                .ToArray();
+            if (endpoints.Length == 0)
+                throw new ArgumentException("At least one CultMesh rendezvous endpoint is required.", nameof(options));
+
+            var discoveryClient = new CultMeshVerseDiscoveryClient(options.Discovery);
+            _discovery = new CultMeshDiscoveryService(
+                endpoints.Select(endpoint => new RendezvousLookupSource(endpoint, discoveryClient, options.Discovery)),
+                new CultMeshDiscoveryServiceOptions
+                {
+                    Clock = options.Discovery.Clock,
+                    Diagnostics = options.Discovery.Diagnostics,
+                    Store = options.Discovery.DiscoveryStore
+                });
+            _sessions = new CultMeshSessionManager(
+                _discovery,
+                options.Connectors ?? new ICultMeshTransportConnector[]
+                {
+                    new CultMeshTcpSchemaTransportConnector(clock: options.Sessions.Clock)
+                },
+                options.ContentConnectors ?? new ICultMeshContentTransportConnector[]
+                {
+                    new CultMeshHttpsContentTransportConnector(),
+                    new CultMeshTcpContentTransportConnector()
+                },
+                options.RealtimeConnectors,
+                options.Sessions);
+            _subscriptionResponseTimeout = options.SubscriptionResponseTimeout;
+            _operationResponseTimeout = options.OperationResponseTimeout;
+        }
+
+        /// <summary>Connects to one stable Verse/provider target using one application protocol.</summary>
+        public Task<CultMeshSession> ConnectAsync(
+            CultMeshSessionTarget target,
+            CultMeshProtocolId protocol,
+            CancellationToken cancellationToken = default)
+        {
+            ThrowIfDisposed();
+            return _sessions.ConnectAsync(target, protocol, cancellationToken);
+        }
+
+        /// <summary>Connects the reusable realtime state plane for one stable Verse/provider target.</summary>
+        public Task<CultMeshRealtimeSession> ConnectRealtimeAsync(
+            CultMeshSessionTarget target,
+            CancellationToken cancellationToken = default)
+        {
+            ThrowIfDisposed();
+            return _sessions.ConnectRealtimeAsync(target, cancellationToken);
+        }
+
+        /// <summary>Creates a verified-transfer provider over this client's reusable content session owner.</summary>
+        public CultMeshSessionContentProvider ContentProvider(
+            string providerId,
+            CultMeshSessionTarget target)
+        {
+            ThrowIfDisposed();
+            return new CultMeshSessionContentProvider(
+                providerId,
+                _sessions,
+                target);
+        }
+
+        /// <summary>Creates a direct body provider over this client's reusable negotiated session owner.</summary>
+        public CultMeshSessionBodyProvider BodyProvider(
+            string providerId,
+            CultMeshSessionTarget target,
+            CultMeshSessionBodyProviderOptions? options = null)
+        {
+            ThrowIfDisposed();
+            return new CultMeshSessionBodyProvider(
+                providerId,
+                _sessions,
+                target,
+                options);
+        }
+
+        /// <summary>Leases one shared live typed document by stable Verse/provider identity and record key.</summary>
+        public async Task<CultMeshDocumentLease<TDocument>> LeaseDocumentAsync<TDocument>(
+            CultMeshSessionTarget target,
+            string recordKey,
+            CancellationToken cancellationToken = default)
+            where TDocument : class
+        {
+            ThrowIfDisposed();
+            if (target == null) throw new ArgumentNullException(nameof(target));
+            if (string.IsNullOrWhiteSpace(recordKey)) throw new ArgumentException("Record key is required.", nameof(recordKey));
+            var key = target.SessionKey + "\u001f" + typeof(TDocument).AssemblyQualifiedName + "\u001f" + recordKey.Trim();
+            while (true)
+            {
+                var resource = _documents.GetOrAdd(key, _ => new SharedResource(
+                    async owner => await OpenDocumentAsync<TDocument>(target, recordKey.Trim(), owner).ConfigureAwait(false)));
+                if (!resource.TryAcquire())
+                {
+                    RemoveExact(_documents, key, resource);
+                    continue;
+                }
+                try
+                {
+                    var binding = (RemoteDocumentBinding<TDocument>)await AwaitForCallerAsync(resource.Value, cancellationToken)
+                        .ConfigureAwait(false);
+                    return new CultMeshDocumentLease<TDocument>(
+                        binding.Handle,
+                        () => Release(_documents, key, resource));
+                }
+                catch
+                {
+                    Release(_documents, key, resource);
+                    throw;
+                }
+            }
+        }
+
+        /// <summary>Leases a shared live collection by stable Verse/provider identity.</summary>
+        public Task<CultMeshCollectionLease<TDocument>> LeaseCollectionAsync<TDocument>(
+            CultMeshSessionTarget target,
+            CancellationToken cancellationToken)
+            where TDocument : class =>
+            LeaseCollectionAsync<TDocument>(target, includeInitialSnapshot: true, cancellationToken);
+
+        /// <summary>Leases a live collection and optionally skips replaying its initial snapshot.</summary>
+        public async Task<CultMeshCollectionLease<TDocument>> LeaseCollectionAsync<TDocument>(
+            CultMeshSessionTarget target,
+            bool includeInitialSnapshot = true,
+            CancellationToken cancellationToken = default)
+            where TDocument : class
+        {
+            ThrowIfDisposed();
+            if (target == null) throw new ArgumentNullException(nameof(target));
+            var identity = target.SessionKey;
+            var key = identity + "\u001f" + typeof(TDocument).AssemblyQualifiedName + "\u001f" + includeInitialSnapshot;
+            while (true)
+            {
+                var resource = _collections.GetOrAdd(key, _ => new SharedResource(
+                    async owner => await OpenCollectionAsync<TDocument>(target, includeInitialSnapshot, owner).ConfigureAwait(false)));
+                if (!resource.TryAcquire())
+                {
+                    RemoveExact(_collections, key, resource);
+                    continue;
+                }
+                try
+                {
+                    var binding = (RemoteCollectionBinding<TDocument>)await AwaitForCallerAsync(resource.Value, cancellationToken)
+                        .ConfigureAwait(false);
+                    return new CultMeshCollectionLease<TDocument>(
+                        binding.Handle,
+                        () => Release(_collections, key, resource));
+                }
+                catch
+                {
+                    Release(_collections, key, resource);
+                    throw;
+                }
+            }
+        }
+
+        /// <summary>
+        /// Submits one typed document to a provider by stable identity. Submission is uncommitted input;
+        /// only a provider-authored receipt or resulting state can establish acceptance.
+        /// </summary>
+        public async Task SubmitDocumentAsync<TDocument>(
+            CultMeshSessionTarget target,
+            string recordKey,
+            TDocument document,
+            string sourceRuntimeId,
+            string sourceRole,
+            CancellationToken cancellationToken = default)
+            where TDocument : class
+        {
+            ThrowIfDisposed();
+            if (target == null) throw new ArgumentNullException(nameof(target));
+            if (string.IsNullOrWhiteSpace(recordKey)) throw new ArgumentException("Record key is required.", nameof(recordKey));
+            if (document == null) throw new ArgumentNullException(nameof(document));
+            if (string.IsNullOrWhiteSpace(sourceRuntimeId)) throw new ArgumentException("Source runtime identity is required.", nameof(sourceRuntimeId));
+            if (string.IsNullOrWhiteSpace(sourceRole)) throw new ArgumentException("Source role is required.", nameof(sourceRole));
+
+            var cacheRegistry = CultMesh.CreateCultCacheDocumentRegistry(typeof(TDocument));
+            var networkRegistry = CultMesh.CreateCultNetDocumentRegistry(new[] { typeof(TDocument) }, cacheRegistry);
+            var message = networkRegistry.CreateRawDocumentPutMessage(
+                "cultmesh-client-submit-" + Guid.NewGuid().ToString("N"),
+                new CultRecordHandle<TDocument>(new CultRecordKey(recordKey.Trim())),
+                document,
+                new CultNetDocumentMessageOptions
+                {
+                    SourceRuntimeId = sourceRuntimeId.Trim(),
+                    SourceRole = sourceRole.Trim()
+                });
+            var session = await ConnectAsync(target, CultMeshProtocols.Documents, cancellationToken)
+                .ConfigureAwait(false);
+            cancellationToken.ThrowIfCancellationRequested();
+            session.OpenSchemaClient().SendCultNet(message);
+        }
+
+        /// <summary>
+        /// Invokes one typed provider operation through the reusable identity-owned session.
+        /// The caller supplies a durable idempotency key; the returned status and payload remain
+        /// provider-authored evidence rather than client-side authority over canonical state.
+        /// </summary>
+        public async Task<CultMeshOperationResult<TResponse>> InvokeAsync<TRequest, TResponse>(
+            CultMeshSessionTarget target,
+            string serviceId,
+            string operation,
+            string requestSchema,
+            string responseSchema,
+            TRequest request,
+            string sourceRuntimeId,
+            string idempotencyKey,
+            CancellationToken cancellationToken = default)
+        {
+            ThrowIfDisposed();
+            if (target == null) throw new ArgumentNullException(nameof(target));
+            if (string.IsNullOrWhiteSpace(serviceId)) throw new ArgumentException("Service identity is required.", nameof(serviceId));
+            if (string.IsNullOrWhiteSpace(operation)) throw new ArgumentException("Operation identity is required.", nameof(operation));
+            if (string.IsNullOrWhiteSpace(requestSchema)) throw new ArgumentException("Request schema is required.", nameof(requestSchema));
+            if (string.IsNullOrWhiteSpace(responseSchema)) throw new ArgumentException("Response schema is required.", nameof(responseSchema));
+            if (request is null) throw new ArgumentNullException(nameof(request));
+            if (string.IsNullOrWhiteSpace(sourceRuntimeId)) throw new ArgumentException("Source runtime identity is required.", nameof(sourceRuntimeId));
+            if (string.IsNullOrWhiteSpace(idempotencyKey)) throw new ArgumentException("A durable idempotency key is required.", nameof(idempotencyKey));
+
+            var expectedService = serviceId.Trim();
+            var expectedOperation = operation.Trim();
+            var expectedResponseSchema = responseSchema.Trim();
+            var messageId = idempotencyKey.Trim();
+            var message = new CultNetOperationRequestMessage
+            {
+                MessageId = messageId,
+                ServiceId = expectedService,
+                Operation = expectedOperation,
+                PayloadSchema = requestSchema.Trim(),
+                PayloadEncoding = "messagepack-base64",
+                Payload = Convert.ToBase64String(MessagePackSerializer.Serialize(request, CultNetSchemaMessageSerialization.Options)),
+                SourceRuntimeId = sourceRuntimeId.Trim(),
+                TargetRuntimeId = target.AuthorityRuntimeId
+            };
+            using var timeout = CancellationTokenSource.CreateLinkedTokenSource(cancellationToken);
+            timeout.CancelAfter(_operationResponseTimeout);
+            CultNetOperationResponseMessage envelope;
+            try
+            {
+                while (true)
+                {
+                    var session = await ConnectOnlineAsync(target, timeout.Token).ConfigureAwait(false);
+                    var completion = new TaskCompletionSource<CultNetOperationResponseMessage>(
+                        TaskCreationOptions.RunContinuationsAsynchronously);
+                    var pathChanged = new TaskCompletionSource<bool>(TaskCreationOptions.RunContinuationsAsynchronously);
+                    var generation = session.PhysicalGeneration;
+                    using var responseSubscription = session.OnCultNet<CultNetOperationResponseMessage>(response =>
+                    {
+                        if (string.Equals(response.MessageId, messageId, StringComparison.Ordinal))
+                            completion.TrySetResult(response);
+                    });
+                    using var stateSubscription = session.WatchState().Subscribe(state =>
+                    {
+                        if (state.Status != CultMeshSessionStatus.Online || session.PhysicalGeneration != generation)
+                            pathChanged.TrySetResult(true);
+                    });
+                    using var cancellation = timeout.Token.Register(() => completion.TrySetCanceled(timeout.Token));
+                    if (session.State.Status != CultMeshSessionStatus.Online ||
+                        session.PhysicalGeneration != generation)
+                        continue;
+
+                    session.SendCultNet(message);
+                    var finished = await Task.WhenAny(completion.Task, pathChanged.Task).ConfigureAwait(false);
+                    if (finished == completion.Task)
+                    {
+                        envelope = await completion.Task.ConfigureAwait(false);
+                        break;
+                    }
+                    // The operation has a durable idempotency key. A route loss before a
+                    // correlated response replays the same request after replacement finality.
+                }
+            }
+            catch (OperationCanceledException) when (!cancellationToken.IsCancellationRequested)
+            {
+                throw new TimeoutException(
+                    $"CultMesh operation '{expectedService}/{expectedOperation}' did not answer idempotency key '{messageId}' " +
+                    $"within {_operationResponseTimeout}.");
+            }
+            cancellationToken.ThrowIfCancellationRequested();
+            if (!string.Equals(envelope.ServiceId, expectedService, StringComparison.Ordinal) ||
+                !string.Equals(envelope.Operation, expectedOperation, StringComparison.Ordinal))
+                throw new InvalidOperationException("CultMesh operation response did not match the requested service and operation.");
+            if (!string.Equals(envelope.SourceRuntimeId, target.AuthorityRuntimeId, StringComparison.Ordinal))
+                throw new CultMeshSessionException(new CultMeshSessionFailure(
+                    CultMeshSessionFailureReason.Authority,
+                    $"CultMesh operation response came from runtime '{envelope.SourceRuntimeId ?? "(missing)"}', " +
+                    $"not selected authority '{target.AuthorityRuntimeId}'."));
+            if (string.Equals(envelope.PayloadSchema, CultNetOperationServer.FailureSchemaId, StringComparison.Ordinal))
+            {
+                if (!string.Equals(envelope.PayloadEncoding, "messagepack-base64", StringComparison.Ordinal))
+                    throw new InvalidOperationException(
+                        $"CultMesh operation failure returned unsupported payload encoding '{envelope.PayloadEncoding}'.");
+                CultNetOperationFailure failure;
+                try
+                {
+                    failure = MessagePackSerializer.Deserialize<CultNetOperationFailure>(
+                        Convert.FromBase64String(envelope.Payload),
+                        CultNetSchemaMessageSerialization.Options);
+                }
+                catch (Exception error) when (error is FormatException || error is MessagePackSerializationException)
+                {
+                    throw new InvalidOperationException("CultMesh operation failure payload was malformed.", error);
+                }
+                throw new CultMeshRemoteOperationException(envelope, failure);
+            }
+            if (!string.Equals(envelope.PayloadSchema, expectedResponseSchema, StringComparison.Ordinal))
+                throw new InvalidOperationException(
+                    $"CultMesh operation returned payload schema '{envelope.PayloadSchema}', expected '{expectedResponseSchema}'.");
+            if (!string.Equals(envelope.PayloadEncoding, "messagepack-base64", StringComparison.Ordinal))
+                throw new InvalidOperationException(
+                    $"CultMesh operation returned unsupported payload encoding '{envelope.PayloadEncoding}'.");
+            if (string.IsNullOrWhiteSpace(envelope.Status))
+                throw new InvalidOperationException("CultMesh operation response omitted its provider-authored status.");
+
+            TResponse value;
+            try
+            {
+                value = MessagePackSerializer.Deserialize<TResponse>(
+                    Convert.FromBase64String(envelope.Payload),
+                    CultNetSchemaMessageSerialization.Options);
+            }
+            catch (FormatException error)
+            {
+                throw new InvalidOperationException("CultMesh operation response payload was not valid base64.", error);
+            }
+            if (value is null) throw new InvalidOperationException("CultMesh operation response decoded to null.");
+            return new CultMeshOperationResult<TResponse>(envelope, value);
+        }
+
+        private async Task<CultMeshSession> ConnectOnlineAsync(
+            CultMeshSessionTarget target,
+            CancellationToken cancellationToken)
+        {
+            while (true)
+            {
+                var session = await ConnectAsync(target, CultMeshProtocols.Documents, cancellationToken)
+                    .ConfigureAwait(false);
+                if (session.State.Status == CultMeshSessionStatus.Online)
+                    return session;
+
+                var changed = new TaskCompletionSource<bool>(TaskCreationOptions.RunContinuationsAsynchronously);
+                using var subscription = session.WatchState().Subscribe(state =>
+                {
+                    if (state.Status == CultMeshSessionStatus.Online || state.Status == CultMeshSessionStatus.Offline)
+                        changed.TrySetResult(true);
+                });
+                using var cancellation = cancellationToken.Register(() => changed.TrySetCanceled(cancellationToken));
+                if (session.State.Status != CultMeshSessionStatus.Reconnecting)
+                    continue;
+                await changed.Task.ConfigureAwait(false);
+                if (session.State.Status == CultMeshSessionStatus.Online)
+                    return session;
+            }
+        }
+
+        /// <summary>Gets the number of currently leased shared document subscriptions.</summary>
+        public int ActiveDocumentResourceCount => _documents.Count;
+
+        /// <summary>Gets the number of currently leased shared collection subscriptions.</summary>
+        public int ActiveCollectionResourceCount => _collections.Count;
+
+        /// <summary>Reads one typed record once through the reusable document session.</summary>
+        public async Task<TDocument> ReadAsync<TDocument>(
+            CultMeshSessionTarget target,
+            string recordKey,
+            CancellationToken cancellationToken = default)
+            where TDocument : class
+        {
+            ThrowIfDisposed();
+            if (target == null) throw new ArgumentNullException(nameof(target));
+            if (string.IsNullOrWhiteSpace(recordKey)) throw new ArgumentException("Record key is required.", nameof(recordKey));
+            var documents = await ReadManyAsync<TDocument>(target, new[] { recordKey }, cancellationToken)
+                .ConfigureAwait(false);
+            return documents.FirstOrDefault()
+                ?? throw new InvalidOperationException(
+                    $"CultMesh target '{target}' did not publish {typeof(TDocument).FullName} record '{recordKey}'.");
+        }
+
+        /// <summary>Reads one typed record once with an explicit response deadline.</summary>
+        public async Task<TDocument> ReadAsync<TDocument>(
+            CultMeshSessionTarget target,
+            string recordKey,
+            TimeSpan responseTimeout,
+            CancellationToken cancellationToken = default)
+            where TDocument : class
+        {
+            var documents = await ReadManyCoreAsync<TDocument>(
+                    target,
+                    new[] { recordKey },
+                    responseTimeout,
+                    cancellationToken)
+                .ConfigureAwait(false);
+            return documents.FirstOrDefault()
+                ?? throw new InvalidOperationException(
+                    $"CultMesh target '{target}' did not publish {typeof(TDocument).FullName} record '{recordKey}'.");
+        }
+
+        /// <summary>Reads typed records once in one request through the reusable document session.</summary>
+        public async Task<IReadOnlyList<TDocument>> ReadManyAsync<TDocument>(
+            CultMeshSessionTarget target,
+            IReadOnlyList<string> recordKeys,
+            CancellationToken cancellationToken = default)
+            where TDocument : class
+            => await ReadManyCoreAsync<TDocument>(
+                    target,
+                    recordKeys,
+                    TimeSpan.FromSeconds(10),
+                    cancellationToken)
+                .ConfigureAwait(false);
+
+        private async Task<IReadOnlyList<TDocument>> ReadManyCoreAsync<TDocument>(
+            CultMeshSessionTarget target,
+            IReadOnlyList<string> recordKeys,
+            TimeSpan responseTimeout,
+            CancellationToken cancellationToken)
+            where TDocument : class
+        {
+            ThrowIfDisposed();
+            if (target == null) throw new ArgumentNullException(nameof(target));
+            if (recordKeys == null || recordKeys.Count == 0 || recordKeys.Any(string.IsNullOrWhiteSpace))
+                throw new ArgumentException("At least one non-empty record key is required.", nameof(recordKeys));
+            var cacheRegistry = CultMesh.CreateCultCacheDocumentRegistry(typeof(TDocument));
+            var networkRegistry = CultMesh.CreateCultNetDocumentRegistry(new[] { typeof(TDocument) }, cacheRegistry);
+            using var snapshot = await CultMeshSnapshotSession.ConnectAsync(
+                    _sessions,
+                    target,
+                    CultMeshProtocols.Documents,
+                    new CultMeshSnapshotRequestOptions
+                    {
+                        ConnectTimeout = TimeSpan.FromSeconds(5),
+                        ResponseTimeout = responseTimeout,
+                        MessageIdPrefix = "cultmesh-client-read"
+                    },
+                    networkRegistry,
+                    cancellationToken)
+                .ConfigureAwait(false);
+            return await snapshot.FetchDocumentsAsync<TDocument>(
+                    recordKeys: recordKeys,
+                    schemaIds: new[] { cacheRegistry.GetRequired<TDocument>().SchemaId })
+                .ConfigureAwait(false);
+        }
+
+        public void Dispose()
+        {
+            if (_disposed) return;
+            _disposed = true;
+            foreach (var resource in _documents.Values.Concat(_collections.Values).Distinct()) resource.Dispose();
+            _documents.Clear();
+            _collections.Clear();
+            _sessions.Dispose();
+            _discovery.Dispose();
+        }
+
+        private void ThrowIfDisposed()
+        {
+            if (_disposed) throw new ObjectDisposedException(nameof(CultMeshClient));
+        }
+
+        private async Task<object> OpenDocumentAsync<TDocument>(
+            CultMeshSessionTarget target,
+            string recordKey,
+            SharedResource owner)
+            where TDocument : class
+        {
+            var session = await ConnectAsync(target, CultMeshProtocols.Documents).ConfigureAwait(false);
+            var binding = new RemoteDocumentBinding<TDocument>(session, target, recordKey, _subscriptionResponseTimeout);
+            owner.Attach(binding);
+            try
+            {
+                await binding.StartAsync().ConfigureAwait(false);
+                return binding;
+            }
+            catch
+            {
+                owner.Detach(binding);
+                binding.Dispose();
+                throw;
+            }
+        }
+
+        private async Task<object> OpenCollectionAsync<TDocument>(
+            CultMeshSessionTarget target,
+            bool includeInitialSnapshot,
+            SharedResource owner)
+            where TDocument : class
+        {
+            var session = await ConnectAsync(target, CultMeshProtocols.Documents).ConfigureAwait(false);
+            var binding = new RemoteCollectionBinding<TDocument>(session, target, includeInitialSnapshot, _subscriptionResponseTimeout);
+            owner.Attach(binding);
+            try
+            {
+                await binding.StartAsync().ConfigureAwait(false);
+                return binding;
+            }
+            catch
+            {
+                owner.Detach(binding);
+                binding.Dispose();
+                throw;
+            }
+        }
+
+        private static async Task<T> AwaitForCallerAsync<T>(Task<T> shared, CancellationToken cancellationToken)
+        {
+            if (!cancellationToken.CanBeCanceled) return await shared.ConfigureAwait(false);
+            var cancelled = new TaskCompletionSource<bool>(TaskCreationOptions.RunContinuationsAsynchronously);
+            using (cancellationToken.Register(() => cancelled.TrySetResult(true)))
+            {
+                if (await Task.WhenAny(shared, cancelled.Task).ConfigureAwait(false) != shared)
+                    throw new OperationCanceledException(cancellationToken);
+            }
+            return await shared.ConfigureAwait(false);
+        }
+
+        private static void Release(
+            ConcurrentDictionary<string, SharedResource> resources,
+            string key,
+            SharedResource resource)
+        {
+            if (!resource.Release()) return;
+            RemoveExact(resources, key, resource);
+            resource.Dispose();
+        }
+
+        private static void RemoveExact(
+            ConcurrentDictionary<string, SharedResource> resources,
+            string key,
+            SharedResource resource)
+        {
+            ((ICollection<KeyValuePair<string, SharedResource>>)resources)
+                .Remove(new KeyValuePair<string, SharedResource>(key, resource));
+        }
+
+        private sealed class SharedResource : IDisposable
+        {
+            private readonly object _gate = new();
+            private readonly Lazy<Task<object>> _value;
+            private IDisposable? _attached;
+            private int _leases;
+            private bool _retired;
+
+            public SharedResource(Func<SharedResource, Task<object>> open)
+            {
+                if (open == null) throw new ArgumentNullException(nameof(open));
+                _value = new Lazy<Task<object>>(() => open(this), LazyThreadSafetyMode.ExecutionAndPublication);
+            }
+
+            public Task<object> Value => _value.Value;
+
+            public bool TryAcquire()
+            {
+                lock (_gate)
+                {
+                    if (_retired) return false;
+                    _leases++;
+                    return true;
+                }
+            }
+
+            public bool Release()
+            {
+                lock (_gate)
+                {
+                    if (_leases <= 0) return false;
+                    _leases--;
+                    if (_leases != 0) return false;
+                    _retired = true;
+                    return true;
+                }
+            }
+
+            public void Attach(IDisposable resource)
+            {
+                if (resource == null) throw new ArgumentNullException(nameof(resource));
+                lock (_gate)
+                {
+                    if (_retired)
+                    {
+                        resource.Dispose();
+                        throw new ObjectDisposedException(nameof(SharedResource));
+                    }
+                    if (_attached != null) throw new InvalidOperationException("CultMesh shared resource already has a live binding.");
+                    _attached = resource;
+                }
+            }
+
+            public void Detach(IDisposable resource)
+            {
+                lock (_gate)
+                {
+                    if (ReferenceEquals(_attached, resource)) _attached = null;
+                }
+            }
+
+            public void Dispose()
+            {
+                IDisposable? attached;
+                lock (_gate)
+                {
+                    _retired = true;
+                    attached = _attached;
+                    _attached = null;
+                }
+                attached?.Dispose();
+            }
+        }
+
+        private sealed class RemoteDocumentBinding<TDocument> : IDisposable where TDocument : class
+        {
+            private readonly CultMeshSession _session;
+            private readonly string _recordKey;
+            private readonly string _subscriptionId;
+            private readonly CultCache _cache;
+            private readonly CultNetDatabaseSubscriptionClient _subscription;
+            private readonly TimeSpan _responseTimeout;
+            private readonly CancellationTokenSource _lifetime = new();
+            private readonly TaskCompletionSource<bool> _ready = new(TaskCreationOptions.RunContinuationsAsynchronously);
+            private readonly object _subscribeLock = new();
+            private Task? _subscribeTask;
+            private long _subscribedGeneration = -1;
+            private IDisposable? _stateWatch;
+            private bool _disposed;
+
+            public RemoteDocumentBinding(
+                CultMeshSession session,
+                CultMeshSessionTarget target,
+                string recordKey,
+                TimeSpan responseTimeout)
+            {
+                _session = session;
+                _responseTimeout = responseTimeout;
+                _recordKey = recordKey;
+                _subscriptionId = "cultmesh-document:" + target.SessionKey + ":" + recordKey;
+                var cacheRegistry = CultMesh.CreateCultCacheDocumentRegistry(typeof(TDocument));
+                var networkRegistry = CultMesh.CreateCultNetDocumentRegistry(new[] { typeof(TDocument) }, cacheRegistry);
+                _cache = new CultCache(cacheRegistry);
+                _subscription = new CultNetDatabaseSubscriptionClient(session.OpenSchemaClient(), _cache, networkRegistry);
+                Handle = CultMesh.Document<TDocument>(
+                    _cache,
+                    new CultRecordKey(recordKey),
+                    CultMesh.Verse(target.VerseId, "cultmesh-client").Context,
+                    routeHint: new CultMeshRouteHint(CultMeshLocalityKind.Network, target.AuthorityRuntimeId));
+            }
+
+            public CultMeshDocumentHandle<TDocument> Handle { get; }
+
+            public async Task StartAsync()
+            {
+                _stateWatch = _session.WatchState()
+                    .Where(state => state.Status == CultMeshSessionStatus.Online)
+                    .Subscribe(state => { _ = EnsureSubscribedAsync(); });
+                _ = EnsureSubscribedAsync();
+                await _ready.Task.ConfigureAwait(false);
+            }
+
+            private Task EnsureSubscribedAsync()
+            {
+                lock (_subscribeLock)
+                {
+                    var generation = _session.PhysicalGeneration;
+                    if (_subscribedGeneration == generation && _subscribeTask != null) return _subscribeTask;
+                    _subscribedGeneration = generation;
+                    return _subscribeTask = SubscribeAsync();
+                }
+            }
+
+            private async Task SubscribeAsync()
+            {
+                try
+                {
+                    while (!_disposed)
+                    {
+                        using var deadline = CancellationTokenSource.CreateLinkedTokenSource(_lifetime.Token);
+                        deadline.CancelAfter(_responseTimeout);
+                        try
+                        {
+                            await _subscription.SubscribeAsync(
+                                    _subscriptionId,
+                                    recordKeys: new[] { _recordKey },
+                                    schemaIds: new[] { CultDocumentRegistry.Shared.GetRequired<TDocument>().SchemaId },
+                                    cancellationToken: deadline.Token)
+                                .ConfigureAwait(false);
+                            _ready.TrySetResult(true);
+                            return;
+                        }
+                        catch (OperationCanceledException) when (!_lifetime.IsCancellationRequested)
+                        {
+                        }
+                    }
+                }
+                catch (OperationCanceledException) when (_lifetime.IsCancellationRequested)
+                {
+                }
+                catch (ObjectDisposedException) when (_disposed)
+                {
+                }
+            }
+
+            public void Dispose()
+            {
+                if (_disposed) return;
+                _disposed = true;
+                _lifetime.Cancel();
+                _stateWatch?.Dispose();
+                _subscription.Dispose();
+                _ready.TrySetException(new ObjectDisposedException(GetType().FullName));
+                _cache.Dispose();
+                _lifetime.Dispose();
+            }
+        }
+
+        private sealed class RemoteCollectionBinding<TDocument> : IDisposable where TDocument : class
+        {
+            private readonly CultMeshSession _session;
+            private readonly string _subscriptionId;
+            private readonly CultCache _cache;
+            private readonly CultNetDatabaseSubscriptionClient _subscription;
+            private readonly TimeSpan _responseTimeout;
+            private readonly CancellationTokenSource _lifetime = new();
+            private readonly bool _includeInitialSnapshot;
+            private readonly TaskCompletionSource<bool> _ready = new(TaskCreationOptions.RunContinuationsAsynchronously);
+            private readonly object _subscribeLock = new();
+            private Task? _subscribeTask;
+            private long _subscribedGeneration = -1;
+            private IDisposable? _stateWatch;
+            private bool _disposed;
+
+            public RemoteCollectionBinding(
+                CultMeshSession session,
+                CultMeshSessionTarget target,
+                bool includeInitialSnapshot,
+                TimeSpan responseTimeout)
+            {
+                _session = session;
+                _responseTimeout = responseTimeout;
+                _subscriptionId = "cultmesh-collection:" + target.SessionKey + ":" + typeof(TDocument).FullName;
+                _includeInitialSnapshot = includeInitialSnapshot;
+                var cacheRegistry = CultMesh.CreateCultCacheDocumentRegistry(typeof(TDocument));
+                var networkRegistry = CultMesh.CreateCultNetDocumentRegistry(new[] { typeof(TDocument) }, cacheRegistry);
+                _cache = new CultCache(cacheRegistry);
+                _subscription = new CultNetDatabaseSubscriptionClient(session.OpenSchemaClient(), _cache, networkRegistry);
+                Handle = CultMesh.Collection<TDocument>(
+                    _cache,
+                    routeHint: new CultMeshRouteHint(CultMeshLocalityKind.Network, target.AuthorityRuntimeId));
+            }
+
+            public CultMeshCollectionHandle<TDocument> Handle { get; }
+
+            public async Task StartAsync()
+            {
+                _stateWatch = _session.WatchState()
+                    .Where(state => state.Status == CultMeshSessionStatus.Online)
+                    .Subscribe(state => { _ = EnsureSubscribedAsync(); });
+                _ = EnsureSubscribedAsync();
+                await _ready.Task.ConfigureAwait(false);
+            }
+
+            private Task EnsureSubscribedAsync()
+            {
+                lock (_subscribeLock)
+                {
+                    var generation = _session.PhysicalGeneration;
+                    if (_subscribedGeneration == generation && _subscribeTask != null) return _subscribeTask;
+                    _subscribedGeneration = generation;
+                    return _subscribeTask = SubscribeAsync();
+                }
+            }
+
+            private async Task SubscribeAsync()
+            {
+                try
+                {
+                    while (!_disposed)
+                    {
+                        using var deadline = CancellationTokenSource.CreateLinkedTokenSource(_lifetime.Token);
+                        deadline.CancelAfter(_responseTimeout);
+                        try
+                        {
+                            await _subscription.SubscribeAsync(
+                                    _subscriptionId,
+                                    schemaIds: new[] { CultDocumentRegistry.Shared.GetRequired<TDocument>().SchemaId },
+                                    includeSnapshot: _includeInitialSnapshot,
+                                    cancellationToken: deadline.Token)
+                                .ConfigureAwait(false);
+                            _ready.TrySetResult(true);
+                            return;
+                        }
+                        catch (OperationCanceledException) when (!_lifetime.IsCancellationRequested)
+                        {
+                        }
+                    }
+                }
+                catch (OperationCanceledException) when (_lifetime.IsCancellationRequested)
+                {
+                }
+                catch (ObjectDisposedException) when (_disposed)
+                {
+                }
+            }
+
+            public void Dispose()
+            {
+                if (_disposed) return;
+                _disposed = true;
+                _lifetime.Cancel();
+                _stateWatch?.Dispose();
+                _subscription.Dispose();
+                _ready.TrySetException(new ObjectDisposedException(GetType().FullName));
+                _cache.Dispose();
+                _lifetime.Dispose();
+            }
+        }
+
+        private sealed class RendezvousLookupSource : ICultMeshLookupSource
+        {
+            private readonly string _endpoint;
+            private readonly CultMeshVerseDiscoveryClient _client;
+            private readonly CultMeshVerseDiscoveryClientOptions _options;
+
+            public RendezvousLookupSource(
+                string endpoint,
+                CultMeshVerseDiscoveryClient client,
+                CultMeshVerseDiscoveryClientOptions options)
+            {
+                _endpoint = endpoint;
+                _client = client;
+                _options = options;
+            }
+
+            public string SourceId => "rendezvous:" + _endpoint;
+
+            public async Task<IReadOnlyList<CultMeshDiscoveryObservation>> LookupAsync(
+                CultMeshDiscoveryQuery query,
+                CancellationToken cancellationToken = default)
+            {
+                cancellationToken.ThrowIfCancellationRequested();
+                var response = await _client.FetchAsync(
+                    _endpoint,
+                    new CultMeshVerseCatalogRequestMessage
+                    {
+                        VerseIds = query.VerseIds.Count == 0 ? null : query.VerseIds.ToArray(),
+                        TransportVersion = _options.TransportVersion
+                    }).ConfigureAwait(false);
+                cancellationToken.ThrowIfCancellationRequested();
+                var observedAt = _options.Clock.UtcNow;
+                return response.Verses.Select(message => new CultMeshDiscoveryObservation(
+                    message.ToVerseDescriptor(),
+                    SourceId,
+                    observedAt,
+                    observedAt + _options.ObservationTtl,
+                    CultMeshDiscoveryTrust.Unsigned,
+                    response.SchemaVersion)).ToArray();
+            }
+        }
+    }
+}
diff --git a/src/GameCult.Mesh/CultMeshContentSessions.cs b/src/GameCult.Mesh/CultMeshContentSessions.cs
new file mode 100644
index 00000000..890dbfa8
--- /dev/null
+++ b/src/GameCult.Mesh/CultMeshContentSessions.cs
@@ -0,0 +1,279 @@
+using System;
+using System.IO;
+using System.Threading;
+using System.Threading.Tasks;
+using GameCult.Caching;
+using GameCult.Networking;
+
+namespace GameCult.Mesh
+{
+    /// <summary>
+    /// Serves bounded, content-addressed CDN chunks over the CultMesh content protocol.
+    /// Manifests and descriptors remain typed document state; payload bytes do not.
+    /// </summary>
+    public sealed class CultMeshLegacyRudpContentServer : IDisposable
+    {
+        private readonly ICultNetSchemaServer _server;
+        private readonly CultCache _content;
+        private readonly Func<string, bool> _canServeHash;
+        private readonly Func<CultMeshContentChunkRequestMessage, ICultNetSchemaServerPeer, Task> _handler;
+        private bool _disposed;
+
+        /// <summary>Attaches content serving to an existing schema host and provider cache.</summary>
+        public CultMeshLegacyRudpContentServer(
+            ICultNetSchemaServer server,
+            CultCache content,
+            Func<string, bool>? canServeHash = null)
+        {
+            _server = server ?? throw new ArgumentNullException(nameof(server));
+            _content = content ?? throw new ArgumentNullException(nameof(content));
+            _canServeHash = canServeHash ?? (_ => true);
+            _handler = HandleAsync;
+            _server.OnCultNet(_handler);
+        }
+
+        /// <inheritdoc />
+        public void Dispose()
+        {
+            if (_disposed) return;
+            _disposed = true;
+            _server.RemoveCultNetMessageListener<CultMeshContentChunkRequestMessage>(_handler);
+        }
+
+        private Task HandleAsync(
+            CultMeshContentChunkRequestMessage request,
+            ICultNetSchemaServerPeer peer)
+        {
+            var response = new CultMeshContentChunkResponseMessage
+            {
+                MessageId = request?.MessageId ?? string.Empty,
+                ChunkHash = request?.ChunkHash ?? string.Empty
+            };
+            try
+            {
+                if (request == null || string.IsNullOrWhiteSpace(request.MessageId))
+                    throw new InvalidDataException("Content chunk request requires a message identity.");
+                var hash = CultMeshCdn.NormalizeHash(request.ChunkHash, nameof(request.ChunkHash));
+                if (!_canServeHash(hash))
+                    throw new UnauthorizedAccessException("Content access policy rejected the requested hash.");
+                var canonicalKey = CultMeshCdnArtifactChunk.CreateRecordKey(hash);
+                if (!string.IsNullOrWhiteSpace(request.RecordKey) &&
+                    !string.Equals(request.RecordKey, canonicalKey.Value, StringComparison.Ordinal))
+                    throw new InvalidDataException("Content chunk record key disagrees with its content hash.");
+                var chunk = _content.Get<CultMeshCdnArtifactChunk>(canonicalKey)
+                    ?? throw new FileNotFoundException("Content chunk is not available.", canonicalKey.Value);
+                var reference = new CultMeshCdnChunkRef
+                {
+                    ChunkHash = hash,
+                    RecordKey = canonicalKey.Value,
+                    SizeBytes = request.ExpectedSizeBytes
+                };
+                CultMeshCdn.ValidateChunkPayload(reference, chunk);
+                response.Found = true;
+                response.ChunkHash = hash;
+                response.SizeBytes = chunk.SizeBytes;
+                response.Payload = chunk.Payload;
+            }
+            catch (Exception error)
+            {
+                response.Found = false;
+                response.Error = error.GetType().Name + ": " + error.Message;
+                response.Payload = Array.Empty<byte>();
+            }
+            peer.SendCultNet(response);
+            return Task.CompletedTask;
+        }
+    }
+
+    /// <summary>Configures the explicit compatibility path for content over schema-message RUDP.</summary>
+    public sealed class CultMeshLegacyRudpContentTransportOptions
+    {
+        /// <summary>Gets or sets the injected reliability clock.</summary>
+        public ICultMeshClock Clock { get; set; } = CultMeshSystemClock.Instance;
+        /// <summary>Gets or sets the maximum time to wait for one chunk response.</summary>
+        public TimeSpan ResponseTimeout { get; set; } = TimeSpan.FromSeconds(10);
+    }
+
+    /// <summary>
+    /// Explicit low-priority compatibility connector for the retired content-over-RUDP path.
+    /// It is never installed by default.
+    /// </summary>
+    public sealed class CultMeshLegacyRudpContentTransportConnector : ICultMeshContentTransportConnector
+    {
+        public const int LegacyPriority = 10_000;
+        private readonly CultMeshSchemaTransportConnector _schemaConnector;
+        private readonly CultMeshLegacyRudpContentTransportOptions _options;
+
+        public CultMeshLegacyRudpContentTransportConnector(
+            CultMeshLegacyRudpContentTransportOptions? options = null,
+            Func<string, ICultNetSchemaClient>? createClient = null)
+        {
+            _options = options ?? new CultMeshLegacyRudpContentTransportOptions();
+            if (_options.ResponseTimeout <= TimeSpan.Zero)
+                throw new ArgumentOutOfRangeException(nameof(options), "Content response timeout must be positive.");
+            _schemaConnector = new CultMeshSchemaTransportConnector(createClient, _options.Clock, _options.ResponseTimeout);
+        }
+
+        public string ConnectorId => "legacy-rudp-content";
+        public int Priority => LegacyPriority;
+        public bool CanConnect(CultMeshTransportCandidate candidate) =>
+            Uri.TryCreate(candidate.Endpoint, UriKind.Absolute, out var uri) &&
+            string.Equals(uri.Scheme, "rudp", StringComparison.OrdinalIgnoreCase);
+
+        public async Task<ICultMeshContentTransport> ConnectAsync(
+            CultMeshTransportCandidate candidate,
+            CultMeshSessionTarget target,
+            CancellationToken cancellationToken = default)
+        {
+            if (!CanConnect(candidate))
+                throw new NotSupportedException($"Legacy RUDP content connector does not support '{candidate.Endpoint}'.");
+            var client = await _schemaConnector.ConnectAsync(candidate, CultMeshProtocols.Content, cancellationToken)
+                .ConfigureAwait(false);
+            try
+            {
+                await CultMeshSessionIdentityClient.VerifyAsync(
+                    client,
+                    "cultmesh-content-client",
+                    target,
+                    CultMeshProtocols.Content,
+                    candidate,
+                    null,
+                    _options.Clock.UtcNow,
+                    _options.ResponseTimeout,
+                    cancellationToken).ConfigureAwait(false);
+                return new LegacyRudpContentTransport(
+                    candidate.Endpoint, client, _options, target, candidate.Generation);
+            }
+            catch
+            {
+                client.Dispose();
+                throw;
+            }
+        }
+
+        private sealed class LegacyRudpContentTransport : ICultMeshContentTransport, ICultMeshVerifiedTransport
+        {
+            private readonly ICultNetSchemaClient _client;
+            private readonly CultMeshLegacyRudpContentTransportOptions _options;
+            private readonly string _verseId;
+            private readonly string _authorityRuntimeId;
+            private readonly string _routeGeneration;
+            private readonly System.Collections.Concurrent.ConcurrentDictionary<string, TaskCompletionSource<CultMeshContentChunkResponseMessage>> _pending = new(StringComparer.Ordinal);
+            private bool _disposed;
+
+            public LegacyRudpContentTransport(
+                string endpoint,
+                ICultNetSchemaClient client,
+                CultMeshLegacyRudpContentTransportOptions options,
+                CultMeshSessionTarget target,
+                string routeGeneration)
+            {
+                Endpoint = endpoint;
+                _client = client;
+                _options = options;
+                _verseId = target.VerseId;
+                _authorityRuntimeId = target.AuthorityRuntimeId;
+                _routeGeneration = routeGeneration ?? string.Empty;
+                _client.OnCultNet<CultMeshContentChunkResponseMessage>(OnResponse);
+                _client.OnCultNet<CultNetErrorMessage>(OnError);
+            }
+
+            public string TransportId => "legacy-rudp-content";
+            public string Endpoint { get; }
+
+            public bool IsVerifiedFor(
+                string verseId,
+                string authorityRuntimeId,
+                string protocolId,
+                string routeGeneration) =>
+                string.Equals(_verseId, verseId, StringComparison.Ordinal) &&
+                string.Equals(_authorityRuntimeId, authorityRuntimeId, StringComparison.Ordinal) &&
+                string.Equals(CultMeshProtocols.Content.Value, protocolId, StringComparison.Ordinal) &&
+                string.Equals(_routeGeneration, routeGeneration, StringComparison.Ordinal);
+
+            public async Task CopyChunkToAsync(
+                CultMeshCdnChunkRef chunk,
+                Stream destination,
+                CancellationToken cancellationToken = default)
+            {
+                if (_disposed) throw new ObjectDisposedException(nameof(LegacyRudpContentTransport));
+                if (chunk == null) throw new ArgumentNullException(nameof(chunk));
+                if (destination == null) throw new ArgumentNullException(nameof(destination));
+                var hash = CultMeshCdn.NormalizeHash(chunk.ChunkHash, nameof(chunk.ChunkHash));
+                var messageId = Guid.NewGuid().ToString("N");
+                var completion = new TaskCompletionSource<CultMeshContentChunkResponseMessage>(
+                    TaskCreationOptions.RunContinuationsAsynchronously);
+                if (!_pending.TryAdd(messageId, completion))
+                    throw new InvalidOperationException("Duplicate legacy content request identity.");
+                try
+                {
+                    _client.SendCultNet(new CultMeshContentChunkRequestMessage
+                    {
+                        MessageId = messageId,
+                        ChunkHash = hash,
+                        RecordKey = string.IsNullOrWhiteSpace(chunk.RecordKey)
+                            ? CultMeshCdnArtifactChunk.CreateRecordKey(hash).Value
+                            : chunk.RecordKey,
+                        ExpectedSizeBytes = chunk.SizeBytes
+                    });
+                    var response = await WaitForResponseAsync(completion.Task, cancellationToken).ConfigureAwait(false);
+                    if (!response.Found)
+                        throw new FileNotFoundException(
+                            "Legacy RUDP content provider rejected chunk '" + hash + "': " + response.Error,
+                            chunk.RecordKey);
+                    var resolved = new CultMeshCdnArtifactChunk
+                    {
+                        ChunkHash = response.ChunkHash,
+                        SizeBytes = response.SizeBytes,
+                        Payload = response.Payload ?? Array.Empty<byte>()
+                    };
+                    CultMeshCdn.ValidateChunkPayload(chunk, resolved);
+                    await destination.WriteAsync(resolved.Payload, 0, resolved.Payload.Length, cancellationToken)
+                        .ConfigureAwait(false);
+                }
+                finally
+                {
+                    _pending.TryRemove(messageId, out _);
+                }
+            }
+
+            public void Dispose()
+            {
+                if (_disposed) return;
+                _disposed = true;
+                foreach (var completion in _pending.Values)
+                    completion.TrySetException(new ObjectDisposedException(nameof(LegacyRudpContentTransport)));
+                _pending.Clear();
+                _client.Dispose();
+            }
+
+            private void OnResponse(CultMeshContentChunkResponseMessage response)
+            {
+                if (_pending.TryGetValue(response.MessageId ?? string.Empty, out var completion))
+                    completion.TrySetResult(response);
+            }
+
+            private void OnError(CultNetErrorMessage error)
+            {
+                var exception = new IOException(error.Error);
+                foreach (var completion in _pending.Values) completion.TrySetException(exception);
+            }
+
+            private async Task<CultMeshContentChunkResponseMessage> WaitForResponseAsync(
+                Task<CultMeshContentChunkResponseMessage> response,
+                CancellationToken cancellationToken)
+            {
+                using var deadlineCancellation = CancellationTokenSource.CreateLinkedTokenSource(cancellationToken);
+                var deadline = _options.Clock.DelayAsync(_options.ResponseTimeout, deadlineCancellation.Token);
+                var completed = await Task.WhenAny(response, deadline).ConfigureAwait(false);
+                if (completed == response)
+                {
+                    deadlineCancellation.Cancel();
+                    return await response.ConfigureAwait(false);
+                }
+                cancellationToken.ThrowIfCancellationRequested();
+                throw new TimeoutException("Timed out fetching content through the legacy RUDP connector.");
+            }
+        }
+    }
+}
diff --git a/src/GameCult.Mesh/CultMeshContentTransfer.cs b/src/GameCult.Mesh/CultMeshContentTransfer.cs
new file mode 100644
index 00000000..b7f8c505
--- /dev/null
+++ b/src/GameCult.Mesh/CultMeshContentTransfer.cs
@@ -0,0 +1,518 @@
+using System;
+using System.Collections.Concurrent;
+using System.Collections.Generic;
+using System.Globalization;
+using System.IO;
+using System.Linq;
+using System.Security.Cryptography;
+using System.Threading;
+using System.Threading.Tasks;
+using GameCult.Caching;
+using GameCult.Networking;
+using MessagePack;
+
+namespace GameCult.Mesh
+{
+    public static class CultMeshContentTransferSchemaVersions
+    {
+        public const string State = "gamecult.mesh.content_transfer_state.v1";
+    }
+
+    [MessagePackObject]
+    [CultDocument("gamecult.mesh.content_transfer_state", CultMeshContentTransferSchemaVersions.State)]
+    public sealed class CultMeshContentTransferStateDocument
+    {
+        [Key(0), CultName] public string ContentHash { get; set; } = string.Empty;
+        [Key(1)] public string ManifestFingerprint { get; set; } = string.Empty;
+        [Key(2)] public long SizeBytes { get; set; }
+        [Key(3)] public int[] VerifiedChunkIndexes { get; set; } = Array.Empty<int>();
+        [Key(4)] public string UpdatedAtUtc { get; set; } = string.Empty;
+    }
+
+    public interface ICultMeshContentProvider
+    {
+        string ProviderId { get; }
+        Task CopyChunkToAsync(
+            CultMeshCdnChunkRef chunk,
+            Stream destination,
+            CancellationToken cancellationToken = default);
+    }
+
+    public sealed class CultMeshDatabaseContentProvider : ICultMeshContentProvider
+    {
+        private readonly CultNetDatabase _database;
+
+        public CultMeshDatabaseContentProvider(string providerId, CultNetDatabase database)
+        {
+            ProviderId = string.IsNullOrWhiteSpace(providerId) ? throw new ArgumentException("Provider id must be non-empty.", nameof(providerId)) : providerId;
+            _database = database ?? throw new ArgumentNullException(nameof(database));
+        }
+
+        public string ProviderId { get; }
+
+        public async Task CopyChunkToAsync(
+            CultMeshCdnChunkRef chunk,
+            Stream destination,
+            CancellationToken cancellationToken = default)
+        {
+            if (chunk == null) throw new ArgumentNullException(nameof(chunk));
+            if (destination == null) throw new ArgumentNullException(nameof(destination));
+            cancellationToken.ThrowIfCancellationRequested();
+            var key = string.IsNullOrWhiteSpace(chunk.RecordKey)
+                ? CultMeshCdnArtifactChunk.CreateRecordKey(chunk.ChunkHash)
+                : new CultRecordKey(chunk.RecordKey);
+            var result = await _database.GetAsync<CultMeshCdnArtifactChunk>(key).ConfigureAwait(false);
+            cancellationToken.ThrowIfCancellationRequested();
+            if (result == null)
+                throw new FileNotFoundException("CDN artifact chunk is missing from the provider.", key.Value);
+            CultMeshCdn.ValidateChunkPayload(chunk, result);
+            await destination.WriteAsync(result.Payload, 0, result.Payload.Length, cancellationToken).ConfigureAwait(false);
+        }
+    }
+
+    public sealed class CultMeshContentTransferOptions
+    {
+        public const int DefaultMaxConcurrentChunkRequests = 4;
+        public const int MaximumConcurrentChunkRequests = 32;
+
+        public CultMeshContentTransferOptions(string cacheDirectory)
+        {
+            CacheDirectory = string.IsNullOrWhiteSpace(cacheDirectory)
+                ? throw new ArgumentException("Cache directory must be non-empty.", nameof(cacheDirectory))
+                : Path.GetFullPath(cacheDirectory);
+        }
+
+        public string CacheDirectory { get; }
+
+        /// <summary>
+        /// Gets or sets the bounded number of chunk requests that may be in flight per
+        /// content hash while the transfer owner writes and checkpoints in manifest order.
+        /// </summary>
+        public int MaxConcurrentChunkRequests { get; set; } = DefaultMaxConcurrentChunkRequests;
+    }
+
+    /// <summary>
+    /// Binds the transfer owner's atomically committed file to an ephemeral read-only
+    /// mapped-body descriptor for the same logical generation.
+    /// </summary>
+    public sealed class CultMeshMappedContent
+    {
+        internal CultMeshMappedContent(string verifiedPath, CultMeshBodyDescriptor descriptor)
+        {
+            VerifiedPath = string.IsNullOrWhiteSpace(verifiedPath)
+                ? throw new ArgumentException("Verified content path is required.", nameof(verifiedPath))
+                : Path.GetFullPath(verifiedPath);
+            Descriptor = descriptor ?? throw new ArgumentNullException(nameof(descriptor));
+        }
+
+        /// <summary>Gets the immutable file promoted by the content transfer owner.</summary>
+        public string VerifiedPath { get; }
+
+        /// <summary>Gets the opaque mapped-body capability for the same verified file.</summary>
+        public CultMeshBodyDescriptor Descriptor { get; }
+    }
+
+    public sealed class CultMeshContentTransferService
+    {
+        private readonly CultCache _stateCache;
+        private readonly ICultMeshContentProvider[] _providers;
+        private readonly string _cacheDirectory;
+        private readonly int _maxConcurrentChunkRequests;
+        private readonly CultMeshVerifiedBodyMappingBroker? _mappedBodies;
+        private readonly ConcurrentDictionary<string, SemaphoreSlim> _contentLocks = new(StringComparer.Ordinal);
+
+        public CultMeshContentTransferService(
+            CultCache stateCache,
+            IEnumerable<ICultMeshContentProvider> providers,
+            CultMeshContentTransferOptions options,
+            CultMeshVerifiedBodyMappingBroker? mappedBodies = null)
+        {
+            _stateCache = stateCache ?? throw new ArgumentNullException(nameof(stateCache));
+            _providers = providers?.ToArray() ?? throw new ArgumentNullException(nameof(providers));
+            if (_providers.Length == 0) throw new ArgumentException("At least one content provider is required.", nameof(providers));
+            if (_providers.Any(provider => provider == null)) throw new ArgumentException("Content providers cannot contain null entries.", nameof(providers));
+            if (options == null) throw new ArgumentNullException(nameof(options));
+            if (options.MaxConcurrentChunkRequests <= 0 ||
+                options.MaxConcurrentChunkRequests > CultMeshContentTransferOptions.MaximumConcurrentChunkRequests)
+                throw new ArgumentOutOfRangeException(nameof(options),
+                    $"Concurrent chunk request bound must be between 1 and {CultMeshContentTransferOptions.MaximumConcurrentChunkRequests}.");
+            _cacheDirectory = options.CacheDirectory;
+            _maxConcurrentChunkRequests = options.MaxConcurrentChunkRequests;
+            _mappedBodies = mappedBodies;
+        }
+
+        public async Task<CultMeshBodyDescriptor> FetchMappedBodyAsync(
+            CultMeshCdnArtifactManifest manifest,
+            CultMeshBodyDescriptor networkDescriptor,
+            DateTimeOffset nowUtc,
+            TimeSpan leaseDuration,
+            CancellationToken cancellationToken = default)
+        {
+            var mapped = await FetchMappedContentAsync(
+                manifest,
+                networkDescriptor,
+                nowUtc,
+                leaseDuration,
+                cancellationToken).ConfigureAwait(false);
+            return mapped.Descriptor;
+        }
+
+        /// <summary>
+        /// Fetches and atomically verifies one artifact, then grants a mapped read-only
+        /// representation without making the consumer infer the transfer cache path.
+        /// </summary>
+        public async Task<CultMeshMappedContent> FetchMappedContentAsync(
+            CultMeshCdnArtifactManifest manifest,
+            CultMeshBodyDescriptor networkDescriptor,
+            DateTimeOffset nowUtc,
+            TimeSpan leaseDuration,
+            CancellationToken cancellationToken = default)
+        {
+            if (_mappedBodies == null)
+                throw new InvalidOperationException("Verified body mapping is not configured for this transfer service.");
+            if (networkDescriptor == null) throw new ArgumentNullException(nameof(networkDescriptor));
+            if (networkDescriptor.TransportKind != CultMeshBodyTransportKind.Network)
+                throw new ArgumentException("The fallback descriptor must use the network body transport.", nameof(networkDescriptor));
+            if (leaseDuration <= TimeSpan.Zero) throw new ArgumentOutOfRangeException(nameof(leaseDuration));
+            CultMeshCdn.ValidateManifest(manifest);
+            if (networkDescriptor.ByteSize != manifest.SizeBytes)
+                throw new InvalidDataException("CDN manifest size does not match its network body descriptor.");
+
+            var path = await FetchAsync(manifest, cancellationToken).ConfigureAwait(false);
+            var contentHash = CultMeshCdn.NormalizeHash(manifest.ContentHash, nameof(manifest.ContentHash));
+            var requestedExpiry = nowUtc.Add(leaseDuration);
+            var networkExpiry = DateTimeOffset.FromUnixTimeMilliseconds(networkDescriptor.LeaseExpiresAtUnixMs);
+            var expiry = requestedExpiry <= networkExpiry ? requestedExpiry : networkExpiry;
+            if (expiry <= nowUtc) throw new InvalidOperationException("Network body lease has expired.");
+            var descriptor = _mappedBodies.GrantVerified(contentHash, path, networkDescriptor, expiry);
+            return new CultMeshMappedContent(path, descriptor);
+        }
+
+        public async Task<string> FetchAsync(
+            CultMeshCdnArtifactManifest manifest,
+            CancellationToken cancellationToken = default)
+        {
+            if (manifest == null) throw new ArgumentNullException(nameof(manifest));
+            CultMeshCdn.ValidateManifest(manifest);
+
+            var contentHash = CultMeshCdn.NormalizeHash(manifest.ContentHash, nameof(manifest.ContentHash));
+            var contentLock = _contentLocks.GetOrAdd(contentHash, _ => new SemaphoreSlim(1, 1));
+            await contentLock.WaitAsync(cancellationToken).ConfigureAwait(false);
+            try
+            {
+                return await FetchOwnedAsync(manifest, contentHash, cancellationToken).ConfigureAwait(false);
+            }
+            finally
+            {
+                contentLock.Release();
+            }
+        }
+
+        private async Task<string> FetchOwnedAsync(
+            CultMeshCdnArtifactManifest manifest,
+            string contentHash,
+            CancellationToken cancellationToken)
+        {
+            Directory.CreateDirectory(_cacheDirectory);
+            var finalPath = Path.Combine(_cacheDirectory, contentHash + ".body");
+            var partialPath = Path.Combine(_cacheDirectory, "." + contentHash + ".partial");
+            var stateKey = StateKey(contentHash);
+
+            if (File.Exists(finalPath))
+            {
+                if (await HashFileAsync(finalPath, cancellationToken).ConfigureAwait(false) == contentHash)
+                    return finalPath;
+                File.Delete(finalPath);
+            }
+
+            var fingerprint = ManifestFingerprint(manifest);
+            var state = _stateCache.Get<CultMeshContentTransferStateDocument>(stateKey);
+            var verified = RestoreVerifiedState(state, manifest, fingerprint, partialPath);
+
+            using (var stream = new FileStream(
+                       partialPath,
+                       FileMode.OpenOrCreate,
+                       FileAccess.ReadWrite,
+                       FileShare.ReadWrite,
+                       81920,
+                       FileOptions.Asynchronous))
+            {
+                stream.SetLength(manifest.SizeBytes);
+                await stream.FlushAsync(cancellationToken).ConfigureAwait(false);
+            }
+
+            var ordered = manifest.Chunks
+                .Select((chunk, index) => new { Chunk = chunk, Index = index })
+                .OrderBy(item => item.Chunk.Offset)
+                .ToArray();
+            var remaining = ordered.Where(item => !verified.Contains(item.Index)).ToArray();
+            for (var windowStart = 0; windowStart < remaining.Length; windowStart += _maxConcurrentChunkRequests)
+            {
+                cancellationToken.ThrowIfCancellationRequested();
+                var window = remaining
+                    .Skip(windowStart)
+                    .Take(_maxConcurrentChunkRequests)
+                    .Select(item => (Item: item, Copy: CopyVerifiedChunkToPartialAsync(
+                        item.Chunk,
+                        partialPath,
+                        cancellationToken)))
+                    .ToArray();
+                try
+                {
+                    foreach (var pending in window)
+                    {
+                        await pending.Copy.ConfigureAwait(false);
+                        verified.Add(pending.Item.Index);
+                        await SaveStateAsync(
+                            contentHash,
+                            fingerprint,
+                            manifest.SizeBytes,
+                            verified,
+                            stateKey,
+                            flush: false).ConfigureAwait(false);
+                    }
+                    await _stateCache.FlushAsync().ConfigureAwait(false);
+                }
+                catch
+                {
+                    foreach (var pending in window)
+                    {
+                        try
+                        {
+                            await pending.Copy.ConfigureAwait(false);
+                            if (verified.Add(pending.Item.Index))
+                            {
+                                await SaveStateAsync(
+                                    contentHash,
+                                    fingerprint,
+                                    manifest.SizeBytes,
+                                    verified,
+                                    stateKey,
+                                    flush: false).ConfigureAwait(false);
+                            }
+                        }
+                        catch { }
+                    }
+                    await _stateCache.FlushAsync().ConfigureAwait(false);
+                    throw;
+                }
+            }
+
+            cancellationToken.ThrowIfCancellationRequested();
+            var actualHash = await HashFileAsync(partialPath, cancellationToken).ConfigureAwait(false);
+            if (!string.Equals(actualHash, contentHash, StringComparison.Ordinal))
+            {
+                File.Delete(partialPath);
+                _stateCache.Remove(stateKey);
+                await _stateCache.FlushAsync().ConfigureAwait(false);
+                throw new InvalidDataException("CDN artifact content hash does not match its manifest.");
+            }
+
+            PromoteAtomically(partialPath, finalPath);
+            _stateCache.Remove(stateKey);
+            await _stateCache.FlushAsync().ConfigureAwait(false);
+            return finalPath;
+        }
+
+        private HashSet<int> RestoreVerifiedState(
+            CultMeshContentTransferStateDocument? state,
+            CultMeshCdnArtifactManifest manifest,
+            string fingerprint,
+            string partialPath)
+        {
+            if (state == null || !File.Exists(partialPath) ||
+                state.SizeBytes != manifest.SizeBytes ||
+                !string.Equals(state.ManifestFingerprint, fingerprint, StringComparison.Ordinal) ||
+                new FileInfo(partialPath).Length != manifest.SizeBytes)
+            {
+                if (File.Exists(partialPath)) File.Delete(partialPath);
+                return new HashSet<int>();
+            }
+
+            var verified = new HashSet<int>();
+            using var stream = new FileStream(partialPath, FileMode.Open, FileAccess.Read, FileShare.ReadWrite);
+            foreach (var index in state.VerifiedChunkIndexes.Distinct().Where(index => index >= 0 && index < manifest.Chunks.Length))
+            {
+                var reference = manifest.Chunks[index];
+                var bytes = new byte[reference.SizeBytes];
+                stream.Position = reference.Offset;
+                if (stream.Read(bytes, 0, bytes.Length) == bytes.Length &&
+                    string.Equals(CultMeshCdn.HashBytes(bytes), CultMeshCdn.NormalizeHash(reference.ChunkHash, nameof(reference.ChunkHash)), StringComparison.Ordinal))
+                {
+                    verified.Add(index);
+                }
+            }
+
+            return verified;
+        }
+
+        private async Task CopyVerifiedChunkToPartialAsync(
+            CultMeshCdnChunkRef reference,
+            string partialPath,
+            CancellationToken cancellationToken)
+        {
+            var failures = new List<Exception>();
+            foreach (var provider in _providers)
+            {
+                cancellationToken.ThrowIfCancellationRequested();
+                try
+                {
+                    using var partial = new FileStream(
+                        partialPath,
+                        FileMode.Open,
+                        FileAccess.Write,
+                        FileShare.ReadWrite,
+                        81920,
+                        FileOptions.Asynchronous | FileOptions.RandomAccess);
+                    partial.Position = reference.Offset;
+                    using var destination = new BoundedHashingWriteStream(partial, reference.SizeBytes);
+                    await provider.CopyChunkToAsync(reference, destination, cancellationToken).ConfigureAwait(false);
+                    await destination.FlushAsync(cancellationToken).ConfigureAwait(false);
+                    var actualHash = destination.CompleteHash();
+                    var expectedHash = CultMeshCdn.NormalizeHash(reference.ChunkHash, nameof(reference.ChunkHash));
+                    if (!string.Equals(actualHash, expectedHash, StringComparison.Ordinal))
+                        throw new InvalidDataException("CDN artifact chunk hash does not match its manifest.");
+                    return;
+                }
+                catch (Exception error) when (!(error is OperationCanceledException && cancellationToken.IsCancellationRequested))
+                {
+                    failures.Add(new InvalidDataException("Content provider '" + provider.ProviderId + "' could not supply a valid chunk.", error));
+                }
+            }
+
+            throw new AggregateException("No content provider supplied a valid CDN chunk.", failures);
+        }
+
+        private sealed class BoundedHashingWriteStream : Stream
+        {
+            private readonly Stream _destination;
+            private readonly long _expectedBytes;
+            private readonly SHA256 _sha = SHA256.Create();
+            private long _written;
+            private bool _completed;
+
+            public BoundedHashingWriteStream(Stream destination, long expectedBytes)
+            {
+                _destination = destination ?? throw new ArgumentNullException(nameof(destination));
+                if (!destination.CanWrite) throw new ArgumentException("Content destination must be writable.", nameof(destination));
+                if (expectedBytes < 0) throw new ArgumentOutOfRangeException(nameof(expectedBytes));
+                _expectedBytes = expectedBytes;
+            }
+
+            public override bool CanRead => false;
+            public override bool CanSeek => false;
+            public override bool CanWrite => true;
+            public override long Length => throw new NotSupportedException();
+            public override long Position
+            {
+                get => _written;
+                set => throw new NotSupportedException();
+            }
+
+            public override void Flush() => _destination.Flush();
+            public override Task FlushAsync(CancellationToken cancellationToken) =>
+                _destination.FlushAsync(cancellationToken);
+
+            public override void Write(byte[] buffer, int offset, int count)
+            {
+                ValidateWrite(buffer, offset, count);
+                _destination.Write(buffer, offset, count);
+                _sha.TransformBlock(buffer, offset, count, null, 0);
+                _written += count;
+            }
+
+            public override async Task WriteAsync(
+                byte[] buffer,
+                int offset,
+                int count,
+                CancellationToken cancellationToken)
+            {
+                ValidateWrite(buffer, offset, count);
+                await _destination.WriteAsync(buffer, offset, count, cancellationToken).ConfigureAwait(false);
+                _sha.TransformBlock(buffer, offset, count, null, 0);
+                _written += count;
+            }
+
+            public string CompleteHash()
+            {
+                if (_completed) throw new InvalidOperationException("Content destination hash is already complete.");
+                if (_written != _expectedBytes)
+                    throw new EndOfStreamException(
+                        $"Content transport wrote {_written} bytes; expected {_expectedBytes} bytes.");
+                _sha.TransformFinalBlock(Array.Empty<byte>(), 0, 0);
+                _completed = true;
+                return string.Concat(_sha.Hash!.Select(value => value.ToString("x2", CultureInfo.InvariantCulture)));
+            }
+
+            protected override void Dispose(bool disposing)
+            {
+                if (disposing) _sha.Dispose();
+                base.Dispose(disposing);
+            }
+
+            public override int Read(byte[] buffer, int offset, int count) => throw new NotSupportedException();
+            public override long Seek(long offset, SeekOrigin origin) => throw new NotSupportedException();
+            public override void SetLength(long value) => throw new NotSupportedException();
+
+            private void ValidateWrite(byte[] buffer, int offset, int count)
+            {
+                if (_completed) throw new InvalidOperationException("Content destination is already complete.");
+                if (buffer == null) throw new ArgumentNullException(nameof(buffer));
+                if (offset < 0 || count < 0 || offset > buffer.Length - count)
+                    throw new ArgumentOutOfRangeException(nameof(offset));
+                if (_written + count > _expectedBytes)
+                    throw new InvalidDataException(
+                        $"Content transport exceeded its advertised {_expectedBytes}-byte chunk boundary.");
+            }
+        }
+
+        private async Task SaveStateAsync(
+            string contentHash,
+            string fingerprint,
+            long sizeBytes,
+            HashSet<int> verified,
+            CultRecordKey stateKey,
+            bool flush)
+        {
+            var state = new CultMeshContentTransferStateDocument
+            {
+                ContentHash = contentHash,
+                ManifestFingerprint = fingerprint,
+                SizeBytes = sizeBytes,
+                VerifiedChunkIndexes = verified.OrderBy(value => value).ToArray(),
+                UpdatedAtUtc = DateTimeOffset.UtcNow.ToString("O", CultureInfo.InvariantCulture)
+            };
+            await _stateCache.UpsertAsync(typeof(CultMeshContentTransferStateDocument), state, stateKey).ConfigureAwait(false);
+            if (flush) await _stateCache.FlushAsync().ConfigureAwait(false);
+        }
+
+        private static CultRecordKey StateKey(string contentHash) => new CultRecordKey("mesh:content-transfer:" + contentHash);
+
+        private static string ManifestFingerprint(CultMeshCdnArtifactManifest manifest)
+        {
+            var shape = string.Join("|", manifest.Chunks.Select(chunk =>
+                chunk.Offset.ToString(CultureInfo.InvariantCulture) + ":" +
+                chunk.SizeBytes.ToString(CultureInfo.InvariantCulture) + ":" +
+                CultMeshCdn.NormalizeHash(chunk.ChunkHash, nameof(chunk.ChunkHash))));
+            return CultMeshCdn.HashBytes(System.Text.Encoding.UTF8.GetBytes(manifest.SizeBytes.ToString(CultureInfo.InvariantCulture) + "|" + shape));
+        }
+
+        private static async Task<string> HashFileAsync(string path, CancellationToken cancellationToken)
+        {
+            using var stream = new FileStream(path, FileMode.Open, FileAccess.Read, FileShare.Read, 81920, FileOptions.Asynchronous | FileOptions.SequentialScan);
+            using var sha = SHA256.Create();
+            var buffer = new byte[81920];
+            int read;
+            while ((read = await stream.ReadAsync(buffer, 0, buffer.Length, cancellationToken).ConfigureAwait(false)) > 0)
+                sha.TransformBlock(buffer, 0, read, null, 0);
+            sha.TransformFinalBlock(Array.Empty<byte>(), 0, 0);
+            return string.Concat(sha.Hash!.Select(value => value.ToString("x2", CultureInfo.InvariantCulture)));
+        }
+
+        private static void PromoteAtomically(string partialPath, string finalPath)
+        {
+            if (File.Exists(finalPath)) File.Replace(partialPath, finalPath, null);
+            else File.Move(partialPath, finalPath);
+        }
+    }
+}
diff --git a/src/GameCult.Mesh/CultMeshContentTransports.cs b/src/GameCult.Mesh/CultMeshContentTransports.cs
new file mode 100644
index 00000000..891c221a
--- /dev/null
+++ b/src/GameCult.Mesh/CultMeshContentTransports.cs
@@ -0,0 +1,166 @@
+using System;
+using System.IO;
+using System.Threading;
+using System.Threading.Tasks;
+
+namespace GameCult.Mesh
+{
+    /// <summary>
+    /// Moves immutable content bytes for one selected physical path. Content identity,
+    /// verification, checkpoints, and promotion remain owned by
+    /// <see cref="CultMeshContentTransferService"/>.
+    /// </summary>
+    public interface ICultMeshContentTransport : IDisposable
+    {
+        string TransportId { get; }
+        string Endpoint { get; }
+
+        /// <summary>
+        /// Writes exactly one advertised chunk into the caller-owned destination.
+        /// The transport must honor destination backpressure and must not close it.
+        /// </summary>
+        Task CopyChunkToAsync(
+            CultMeshCdnChunkRef chunk,
+            Stream destination,
+            CancellationToken cancellationToken = default);
+    }
+
+    /// <summary>
+    /// Creates physical content transports. Lower priority values are attempted first;
+    /// a fallback tier is not raced against a preferred tier.
+    /// </summary>
+    public interface ICultMeshContentTransportConnector
+    {
+        string ConnectorId { get; }
+        int Priority { get; }
+        bool CanConnect(CultMeshTransportCandidate candidate);
+        Task<ICultMeshContentTransport> ConnectAsync(
+            CultMeshTransportCandidate candidate,
+            CultMeshSessionTarget target,
+            CancellationToken cancellationToken = default);
+    }
+
+    /// <summary>
+    /// Reusable identity-bound content session selected and owned by
+    /// <see cref="CultMeshSessionManager"/>.
+    /// </summary>
+    public sealed class CultMeshContentSession : IDisposable
+    {
+        private readonly object _gate = new();
+        private readonly Action<CultMeshContentSession> _onTransportFailure;
+        private ICultMeshContentTransport _transport;
+        private bool _disposed;
+
+        internal CultMeshContentSession(
+            CultMeshSessionTarget target,
+            ICultMeshContentTransport transport,
+            CultMeshSessionState state,
+            Action<CultMeshContentSession> onTransportFailure)
+        {
+            Target = target ?? throw new ArgumentNullException(nameof(target));
+            _transport = transport ?? throw new ArgumentNullException(nameof(transport));
+            State = state ?? throw new ArgumentNullException(nameof(state));
+            _onTransportFailure = onTransportFailure ?? throw new ArgumentNullException(nameof(onTransportFailure));
+        }
+
+        public CultMeshSessionTarget Target { get; }
+        public CultMeshSessionState State { get; private set; }
+        public string TransportId { get { lock (_gate) return _transport.TransportId; } }
+
+        public async Task CopyChunkToAsync(
+            CultMeshCdnChunkRef chunk,
+            Stream destination,
+            CancellationToken cancellationToken = default)
+        {
+            if (chunk == null) throw new ArgumentNullException(nameof(chunk));
+            if (destination == null) throw new ArgumentNullException(nameof(destination));
+            ICultMeshContentTransport transport;
+            lock (_gate)
+            {
+                ThrowIfDisposed();
+                transport = _transport;
+            }
+            try
+            {
+                await transport.CopyChunkToAsync(chunk, destination, cancellationToken).ConfigureAwait(false);
+            }
+            catch (Exception) when (!cancellationToken.IsCancellationRequested)
+            {
+                _onTransportFailure(this);
+                throw;
+            }
+        }
+
+        internal void Replace(ICultMeshContentTransport transport, CultMeshSessionState state)
+        {
+            if (transport == null) throw new ArgumentNullException(nameof(transport));
+            ICultMeshContentTransport previous;
+            lock (_gate)
+            {
+                ThrowIfDisposed();
+                previous = _transport;
+                _transport = transport;
+                State = state;
+            }
+            previous.Dispose();
+        }
+
+        internal void MarkOffline(CultMeshSessionState state)
+        {
+            lock (_gate)
+            {
+                if (_disposed) return;
+                State = state;
+            }
+        }
+
+        public void Dispose()
+        {
+            ICultMeshContentTransport transport;
+            lock (_gate)
+            {
+                if (_disposed) return;
+                _disposed = true;
+                transport = _transport;
+            }
+            transport.Dispose();
+        }
+
+        private void ThrowIfDisposed()
+        {
+            if (_disposed) throw new ObjectDisposedException(nameof(CultMeshContentSession));
+        }
+    }
+
+    /// <summary>
+    /// Adapts a selected streaming transport to the verified content-transfer source port.
+    /// </summary>
+    public sealed class CultMeshSessionContentProvider : ICultMeshContentProvider
+    {
+        private readonly CultMeshSessionManager _sessions;
+        private readonly CultMeshSessionTarget _target;
+
+        public CultMeshSessionContentProvider(
+            string providerId,
+            CultMeshSessionManager sessions,
+            CultMeshSessionTarget target)
+        {
+            ProviderId = string.IsNullOrWhiteSpace(providerId)
+                ? throw new ArgumentException("Provider identity is required.", nameof(providerId))
+                : providerId;
+            _sessions = sessions ?? throw new ArgumentNullException(nameof(sessions));
+            _target = target ?? throw new ArgumentNullException(nameof(target));
+        }
+
+        public string ProviderId { get; }
+
+        public async Task CopyChunkToAsync(
+            CultMeshCdnChunkRef chunk,
+            Stream destination,
+            CancellationToken cancellationToken = default)
+        {
+            var session = await _sessions.ConnectContentAsync(_target, cancellationToken).ConfigureAwait(false);
+            await session.CopyChunkToAsync(chunk, destination, cancellationToken).ConfigureAwait(false);
+        }
+    }
+}
diff --git a/src/GameCult.Mesh/CultMeshDiscoveryService.cs b/src/GameCult.Mesh/CultMeshDiscoveryService.cs
new file mode 100644
index 00000000..3f108e03
--- /dev/null
+++ b/src/GameCult.Mesh/CultMeshDiscoveryService.cs
@@ -0,0 +1,490 @@
+using System;
+using System.Collections.Concurrent;
+using System.Collections.Generic;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using GameCult.Caching;
+using GameCult.Networking;
+using MessagePack;
+using R3;
+
+namespace GameCult.Mesh
+{
+    public static class CultMeshDiscoverySchemaVersions
+    {
+        public const string State = "gamecult.mesh.discovery_state.v1";
+    }
+
+    public enum CultMeshDiscoveryFreshness
+    {
+        Fresh,
+        Degraded,
+        Stale,
+        Unavailable
+    }
+
+    public enum CultMeshDiscoveryTrust
+    {
+        Rejected,
+        Unsigned,
+        Signed
+    }
+
+    public sealed class CultMeshDiscoveryQuery
+    {
+        /// <param name="endpointId">Stable lookup identity used for caching and diagnostics, never a physical route.</param>
+        /// <param name="verseIds">Optional Verse filter.</param>
+        /// <param name="authorityRuntimeId">Optional provider runtime that each accepted Verse must advertise.</param>
+        public CultMeshDiscoveryQuery(
+            string endpointId,
+            IEnumerable<string>? verseIds = null,
+            string? authorityRuntimeId = null)
+        {
+            EndpointId = Require(endpointId, nameof(endpointId));
+            VerseIds = verseIds?.Where(value => !string.IsNullOrWhiteSpace(value))
+                .Distinct(StringComparer.Ordinal).OrderBy(value => value, StringComparer.Ordinal).ToArray()
+                ?? Array.Empty<string>();
+            AuthorityRuntimeId = string.IsNullOrWhiteSpace(authorityRuntimeId) ? null : authorityRuntimeId.Trim();
+        }
+
+        public string EndpointId { get; }
+        public IReadOnlyList<string> VerseIds { get; }
+        /// <summary>Gets the optional provider runtime constraint for authority-sensitive resolution.</summary>
+        public string? AuthorityRuntimeId { get; }
+
+        private static string Require(string value, string name) =>
+            string.IsNullOrWhiteSpace(value) ? throw new ArgumentException("Value must be non-empty.", name) : value;
+    }
+
+    public sealed class CultMeshDiscoveryObservation
+    {
+        public CultMeshDiscoveryObservation(
+            CultMeshVerseDescriptor candidate,
+            string sourceId,
+            DateTimeOffset observedAtUtc,
+            DateTimeOffset expiresAtUtc,
+            CultMeshDiscoveryTrust trust = CultMeshDiscoveryTrust.Unsigned,
+            string evidence = "")
+        {
+            Candidate = candidate ?? throw new ArgumentNullException(nameof(candidate));
+            SourceId = string.IsNullOrWhiteSpace(sourceId)
+                ? throw new ArgumentException("Value must be non-empty.", nameof(sourceId))
+                : sourceId;
+            if (expiresAtUtc < observedAtUtc) throw new ArgumentOutOfRangeException(nameof(expiresAtUtc));
+            ObservedAtUtc = observedAtUtc;
+            ExpiresAtUtc = expiresAtUtc;
+            Trust = trust;
+            Evidence = evidence ?? "";
+        }
+
+        public CultMeshVerseDescriptor Candidate { get; }
+        public string SourceId { get; }
+        public DateTimeOffset ObservedAtUtc { get; }
+        public DateTimeOffset ExpiresAtUtc { get; }
+        public CultMeshDiscoveryTrust Trust { get; }
+        public string Evidence { get; }
+    }
+
+    public interface ICultMeshLookupSource
+    {
+        string SourceId { get; }
+
+        Task<IReadOnlyList<CultMeshDiscoveryObservation>> LookupAsync(
+            CultMeshDiscoveryQuery query,
+            CancellationToken cancellationToken = default);
+    }
+
+    public interface ICultMeshDiscoveryStore
+    {
+        Task<CultMeshDiscoveryState?> LoadAsync(string endpointId, CancellationToken cancellationToken = default);
+
+        Task SaveAsync(CultMeshDiscoveryState state, CancellationToken cancellationToken = default);
+    }
+
+    public sealed class CultMeshDiscoveryCandidate
+    {
+        public CultMeshDiscoveryCandidate(
+            CultMeshVerseDescriptor descriptor,
+            string sourceId,
+            DateTimeOffset observedAtUtc,
+            DateTimeOffset expiresAtUtc,
+            CultMeshDiscoveryTrust trust)
+        {
+            Descriptor = descriptor ?? throw new ArgumentNullException(nameof(descriptor));
+            SourceId = sourceId ?? "";
+            ObservedAtUtc = observedAtUtc;
+            ExpiresAtUtc = expiresAtUtc;
+            Trust = trust;
+        }
+
+        public CultMeshVerseDescriptor Descriptor { get; }
+        public string SourceId { get; }
+        public DateTimeOffset ObservedAtUtc { get; }
+        public DateTimeOffset ExpiresAtUtc { get; }
+        public CultMeshDiscoveryTrust Trust { get; }
+    }
+
+    public sealed class CultMeshDiscoveryState
+    {
+        public CultMeshDiscoveryState(
+            string endpointId,
+            CultMeshDiscoveryFreshness freshness,
+            IEnumerable<CultMeshDiscoveryCandidate>? candidates,
+            DateTimeOffset evaluatedAtUtc,
+            DateTimeOffset? retryAfterUtc = null,
+            IEnumerable<string>? failedSourceIds = null,
+            string? queryKey = null)
+        {
+            EndpointId = endpointId ?? "";
+            Freshness = freshness;
+            Candidates = candidates?.OrderBy(candidate => candidate.Descriptor.VerseId, StringComparer.Ordinal).ToArray()
+                ?? Array.Empty<CultMeshDiscoveryCandidate>();
+            EvaluatedAtUtc = evaluatedAtUtc;
+            RetryAfterUtc = retryAfterUtc;
+            FailedSourceIds = failedSourceIds?.Distinct(StringComparer.Ordinal).OrderBy(value => value, StringComparer.Ordinal).ToArray()
+                ?? Array.Empty<string>();
+            QueryKey = string.IsNullOrWhiteSpace(queryKey) ? EndpointId : queryKey;
+        }
+
+        public string EndpointId { get; }
+        public CultMeshDiscoveryFreshness Freshness { get; }
+        public IReadOnlyList<CultMeshDiscoveryCandidate> Candidates { get; }
+        public DateTimeOffset EvaluatedAtUtc { get; }
+        public DateTimeOffset? RetryAfterUtc { get; }
+        public IReadOnlyList<string> FailedSourceIds { get; }
+        public string QueryKey { get; }
+    }
+
+    public sealed class CultMeshDiscoveryServiceOptions
+    {
+        public ICultMeshClock Clock { get; set; } = CultMeshSystemClock.Instance;
+        public ICultMeshDiagnosticSink Diagnostics { get; set; } = CultMeshNullDiagnosticSink.Instance;
+        public ICultMeshDiscoveryStore? Store { get; set; }
+        public TimeSpan NegativeTtl { get; set; } = TimeSpan.FromSeconds(30);
+    }
+
+    public sealed class CultMeshDiscoveryService : IDisposable
+    {
+        private readonly ICultMeshLookupSource[] _sources;
+        private readonly CultMeshDiscoveryServiceOptions _options;
+        private readonly ConcurrentDictionary<string, Lazy<Task<CultMeshDiscoveryState>>> _inFlight = new(StringComparer.Ordinal);
+        private readonly ConcurrentDictionary<string, CultMeshDiscoveryState> _states = new(StringComparer.Ordinal);
+        private readonly ConcurrentDictionary<string, byte> _invalidated = new(StringComparer.Ordinal);
+        private readonly Subject<CultMeshDiscoveryState> _updates = new();
+        private long _diagnosticSequence;
+        private bool _disposed;
+
+        public CultMeshDiscoveryService(
+            IEnumerable<ICultMeshLookupSource> sources,
+            CultMeshDiscoveryServiceOptions? options = null)
+        {
+            _sources = sources?.ToArray() ?? throw new ArgumentNullException(nameof(sources));
+            if (_sources.Any(source => source == null)) throw new ArgumentException("Lookup sources cannot contain null.", nameof(sources));
+            _options = options ?? new CultMeshDiscoveryServiceOptions();
+            if (_options.NegativeTtl <= TimeSpan.Zero) throw new ArgumentOutOfRangeException(nameof(options));
+        }
+
+        public Observable<CultMeshDiscoveryState> Watch() => _updates;
+
+        public CultMeshDiscoveryState? Current(string endpointId)
+        {
+            _states.TryGetValue(endpointId, out var state);
+            return state == null ? null : EvaluateAt(state, _options.Clock.UtcNow);
+        }
+
+        /// <summary>
+        /// Invalidates one resolved identity so a transport failure must consult the
+        /// configured rendezvous sources again instead of retrying a fresh-but-dead route.
+        /// </summary>
+        public void Invalidate(CultMeshDiscoveryQuery query)
+        {
+            if (query == null) throw new ArgumentNullException(nameof(query));
+            ThrowIfDisposed();
+            var key = QueryKey(query);
+            _states.TryRemove(key, out _);
+            _invalidated[key] = 0;
+        }
+
+        public async Task<CultMeshDiscoveryState> ResolveAsync(
+            CultMeshDiscoveryQuery query,
+            CancellationToken cancellationToken = default)
+        {
+            if (query == null) throw new ArgumentNullException(nameof(query));
+            ThrowIfDisposed();
+            var lookupKey = QueryKey(query);
+            var lazy = _inFlight.GetOrAdd(
+                lookupKey,
+                _ => new Lazy<Task<CultMeshDiscoveryState>>(
+                    () => ResolveOwnedAsync(query, CancellationToken.None),
+                    LazyThreadSafetyMode.ExecutionAndPublication));
+            var shared = lazy.Value;
+            _ = shared.ContinueWith(
+                completed => _inFlight.TryRemove(lookupKey, out _),
+                CancellationToken.None,
+                TaskContinuationOptions.ExecuteSynchronously,
+                TaskScheduler.Default);
+            return await AwaitForCallerAsync(shared, cancellationToken).ConfigureAwait(false);
+        }
+
+        private static string QueryKey(CultMeshDiscoveryQuery query) =>
+            query.AuthorityRuntimeId == null && query.VerseIds.Count == 0
+                ? query.EndpointId
+                : string.Join(
+                    "\u001f",
+                    new[] { query.EndpointId, query.AuthorityRuntimeId ?? "" }.Concat(query.VerseIds));
+
+        private static async Task<T> AwaitForCallerAsync<T>(Task<T> shared, CancellationToken cancellationToken)
+        {
+            if (!cancellationToken.CanBeCanceled)
+                return await shared.ConfigureAwait(false);
+            var cancelled = new TaskCompletionSource<bool>(TaskCreationOptions.RunContinuationsAsynchronously);
+            using (cancellationToken.Register(() => cancelled.TrySetResult(true)))
+            {
+                if (await Task.WhenAny(shared, cancelled.Task).ConfigureAwait(false) != shared)
+                    throw new OperationCanceledException(cancellationToken);
+            }
+            return await shared.ConfigureAwait(false);
+        }
+
+        private async Task<CultMeshDiscoveryState> ResolveOwnedAsync(
+            CultMeshDiscoveryQuery query,
+            CancellationToken cancellationToken)
+        {
+            var queryKey = QueryKey(query);
+            var previous = await LoadPreviousAsync(queryKey, cancellationToken).ConfigureAwait(false);
+            var now = _options.Clock.UtcNow;
+            if (previous != null &&
+                ((previous.Freshness == CultMeshDiscoveryFreshness.Fresh &&
+                  previous.Candidates.Count > 0 && previous.Candidates.All(candidate => candidate.ExpiresAtUtc > now)) ||
+                 (previous.Freshness == CultMeshDiscoveryFreshness.Unavailable && previous.RetryAfterUtc > now)))
+            {
+                return previous;
+            }
+            var lookups = _sources.Select(source => ObserveSourceAsync(source, query, cancellationToken)).ToArray();
+            var results = await Task.WhenAll(lookups).ConfigureAwait(false);
+            var failures = results.Where(result => result.Error != null).Select(result => result.SourceId).ToArray();
+            var observations = results.SelectMany(result => result.Observations)
+                .Where(observation => query.VerseIds.Count == 0 || query.VerseIds.Contains(observation.Candidate.VerseId, StringComparer.Ordinal))
+                .Where(observation => query.AuthorityRuntimeId == null ||
+                    observation.Candidate.AuthorityRoutes.Any(route =>
+                        string.Equals(route.AuthorityRuntimeId, query.AuthorityRuntimeId, StringComparison.Ordinal)))
+                .ToArray();
+
+            foreach (var rejected in observations.Where(observation => observation.Trust == CultMeshDiscoveryTrust.Rejected))
+            {
+                Emit(CultMeshDiagnosticKind.CandidateRejected, query.EndpointId, rejected.Candidate.VerseId,
+                    "rejected", "trust_rejected", rejected.SourceId);
+            }
+
+            var accepted = observations.Where(observation => observation.Trust != CultMeshDiscoveryTrust.Rejected)
+                .GroupBy(observation => observation.Candidate.VerseId, StringComparer.Ordinal)
+                .Select(group => group
+                    .OrderByDescending(observation => observation.Trust)
+                    .ThenByDescending(observation => observation.ObservedAtUtc)
+                    .First())
+                .Select(observation => new CultMeshDiscoveryCandidate(
+                    observation.Candidate,
+                    observation.SourceId,
+                    observation.ObservedAtUtc,
+                    observation.ExpiresAtUtc,
+                    observation.Trust))
+                .ToArray();
+
+            IReadOnlyList<CultMeshDiscoveryCandidate> candidates = accepted.Length > 0
+                ? accepted
+                : previous?.Candidates ?? Array.Empty<CultMeshDiscoveryCandidate>();
+            var freshCount = candidates.Count(candidate => candidate.ExpiresAtUtc > now);
+            CultMeshDiscoveryFreshness freshness;
+            if (accepted.Length > 0)
+                freshness = freshCount == 0
+                    ? CultMeshDiscoveryFreshness.Stale
+                    : failures.Length > 0 || freshCount < candidates.Count
+                        ? CultMeshDiscoveryFreshness.Degraded
+                        : CultMeshDiscoveryFreshness.Fresh;
+            else if (candidates.Count > 0)
+                freshness = freshCount > 0 ? CultMeshDiscoveryFreshness.Degraded : CultMeshDiscoveryFreshness.Stale;
+            else
+                freshness = CultMeshDiscoveryFreshness.Unavailable;
+
+            var state = new CultMeshDiscoveryState(
+                query.EndpointId,
+                freshness,
+                candidates,
+                now,
+                freshness == CultMeshDiscoveryFreshness.Fresh ? null : now + _options.NegativeTtl,
+                failures,
+                queryKey);
+            _states[queryKey] = state;
+            if (_options.Store != null) await _options.Store.SaveAsync(state, cancellationToken).ConfigureAwait(false);
+            _updates.OnNext(state);
+            Emit(CultMeshDiagnosticKind.DiscoveryObservation, query.EndpointId, query.EndpointId,
+                freshness.ToString().ToLowerInvariant(), failures.Length == 0 ? "" : "source_failure", "discovery-service");
+            return state;
+        }
+
+        private static CultMeshDiscoveryState EvaluateAt(CultMeshDiscoveryState state, DateTimeOffset now)
+        {
+            if (state.Candidates.Count == 0 || state.Freshness == CultMeshDiscoveryFreshness.Unavailable)
+                return state;
+            var freshCount = state.Candidates.Count(candidate => candidate.ExpiresAtUtc > now);
+            var freshness = freshCount == 0
+                ? CultMeshDiscoveryFreshness.Stale
+                : freshCount < state.Candidates.Count || state.FailedSourceIds.Count > 0
+                    ? CultMeshDiscoveryFreshness.Degraded
+                    : CultMeshDiscoveryFreshness.Fresh;
+            return freshness == state.Freshness
+                ? state
+                : new CultMeshDiscoveryState(
+                    state.EndpointId, freshness, state.Candidates, now,
+                    state.RetryAfterUtc, state.FailedSourceIds, state.QueryKey);
+        }
+
+        private async Task<CultMeshDiscoveryState?> LoadPreviousAsync(string queryKey, CancellationToken cancellationToken)
+        {
+            if (_states.TryGetValue(queryKey, out var current)) return current;
+            if (_invalidated.TryRemove(queryKey, out _)) return null;
+            if (_options.Store == null) return null;
+            var stored = await _options.Store.LoadAsync(queryKey, cancellationToken).ConfigureAwait(false);
+            if (stored != null) _states[queryKey] = stored;
+            return stored;
+        }
+
+        private static async Task<LookupResult> ObserveSourceAsync(
+            ICultMeshLookupSource source,
+            CultMeshDiscoveryQuery query,
+            CancellationToken cancellationToken)
+        {
+            try
+            {
+                var observations = await source.LookupAsync(query, cancellationToken).ConfigureAwait(false);
+                return new LookupResult(source.SourceId, observations ?? Array.Empty<CultMeshDiscoveryObservation>(), null);
+            }
+            catch (Exception error) when (!(error is OperationCanceledException && cancellationToken.IsCancellationRequested))
+            {
+                return new LookupResult(source.SourceId, Array.Empty<CultMeshDiscoveryObservation>(), error);
+            }
+        }
+
+        private void Emit(CultMeshDiagnosticKind kind, string operationId, string subjectId, string state, string reason, string source)
+        {
+            _options.Diagnostics.Emit(new CultMeshDiagnosticEvent(
+                Interlocked.Increment(ref _diagnosticSequence), _options.Clock.UtcNow,
+                CultMeshReliabilityOrgan.Discovery, kind, operationId, subjectId, state,
+                reason, source, subjectId, CultMeshDiscoverySchemaVersions.State));
+        }
+
+        public void Dispose()
+        {
+            if (_disposed) return;
+            _disposed = true;
+            _updates.Dispose();
+        }
+
+        private void ThrowIfDisposed()
+        {
+            if (_disposed) throw new ObjectDisposedException(nameof(CultMeshDiscoveryService));
+        }
+
+        private sealed class LookupResult
+        {
+            public LookupResult(string sourceId, IReadOnlyList<CultMeshDiscoveryObservation> observations, Exception? error)
+            {
+                SourceId = sourceId;
+                Observations = observations;
+                Error = error;
+            }
+
+            public string SourceId { get; }
+            public IReadOnlyList<CultMeshDiscoveryObservation> Observations { get; }
+            public Exception? Error { get; }
+        }
+    }
+
+    [MessagePackObject]
+    [CultDocument("gamecult.mesh.discovery_state", CultMeshDiscoverySchemaVersions.State)]
+    public sealed class CultMeshDiscoveryStateDocument
+    {
+        [Key(0), CultName] public string EndpointId { get; set; } = "";
+        [Key(1)] public CultMeshDiscoveryFreshness Freshness { get; set; }
+        [Key(2)] public string EvaluatedAtUtc { get; set; } = "";
+        [Key(3)] public string? RetryAfterUtc { get; set; }
+        [Key(4)] public string[] FailedSourceIds { get; set; } = Array.Empty<string>();
+        [Key(5)] public CultMeshDiscoveryCandidateDocument[] Candidates { get; set; } = Array.Empty<CultMeshDiscoveryCandidateDocument>();
+        [Key(6)] public string QueryKey { get; set; } = "";
+    }
+
+    [MessagePackObject]
+    public sealed class CultMeshDiscoveryCandidateDocument
+    {
+        [Key(0)] public CultMeshVerseDescriptorMessage Descriptor { get; set; } = new CultMeshVerseDescriptorMessage();
+        [Key(1)] public string SourceId { get; set; } = "";
+        [Key(2)] public string ObservedAtUtc { get; set; } = "";
+        [Key(3)] public string ExpiresAtUtc { get; set; } = "";
+        [Key(4)] public CultMeshDiscoveryTrust Trust { get; set; }
+    }
+
+    public sealed class CultMeshCultCacheDiscoveryStore : ICultMeshDiscoveryStore
+    {
+        private readonly CultCache _cache;
+
+        public CultMeshCultCacheDiscoveryStore(CultCache cache)
+        {
+            _cache = cache ?? throw new ArgumentNullException(nameof(cache));
+        }
+
+        public Task<CultMeshDiscoveryState?> LoadAsync(string endpointId, CancellationToken cancellationToken = default)
+        {
+            cancellationToken.ThrowIfCancellationRequested();
+            var document = _cache.Get<CultMeshDiscoveryStateDocument>(Key(endpointId));
+            return Task.FromResult(document == null ? null : FromDocument(document));
+        }
+
+        public async Task SaveAsync(CultMeshDiscoveryState state, CancellationToken cancellationToken = default)
+        {
+            cancellationToken.ThrowIfCancellationRequested();
+            await _cache.UpsertAsync(typeof(CultMeshDiscoveryStateDocument), ToDocument(state), Key(state.QueryKey)).ConfigureAwait(false);
+            await _cache.FlushAsync().ConfigureAwait(false);
+        }
+
+        private static CultRecordKey Key(string endpointId) => new CultRecordKey("mesh:discovery:" + StableToken(endpointId));
+
+        private static string StableToken(string value)
+        {
+            using var sha = System.Security.Cryptography.SHA256.Create();
+            return string.Concat(sha.ComputeHash(System.Text.Encoding.UTF8.GetBytes(value ?? "")).Select(item => item.ToString("x2")));
+        }
+
+        private static CultMeshDiscoveryStateDocument ToDocument(CultMeshDiscoveryState state) => new CultMeshDiscoveryStateDocument
+        {
+            EndpointId = state.EndpointId,
+            Freshness = state.Freshness,
+            EvaluatedAtUtc = state.EvaluatedAtUtc.ToString("O"),
+            RetryAfterUtc = state.RetryAfterUtc?.ToString("O"),
+            FailedSourceIds = state.FailedSourceIds.ToArray(),
+            QueryKey = state.QueryKey,
+            Candidates = state.Candidates.Select(candidate => new CultMeshDiscoveryCandidateDocument
+            {
+                Descriptor = candidate.Descriptor.ToMessage(),
+                SourceId = candidate.SourceId,
+                ObservedAtUtc = candidate.ObservedAtUtc.ToString("O"),
+                ExpiresAtUtc = candidate.ExpiresAtUtc.ToString("O"),
+                Trust = candidate.Trust
+            }).ToArray()
+        };
+
+        private static CultMeshDiscoveryState FromDocument(CultMeshDiscoveryStateDocument document) => new CultMeshDiscoveryState(
+            document.EndpointId,
+            document.Freshness,
+            document.Candidates.Select(candidate => new CultMeshDiscoveryCandidate(
+                candidate.Descriptor.ToVerseDescriptor(),
+                candidate.SourceId,
+                DateTimeOffset.Parse(candidate.ObservedAtUtc, null, System.Globalization.DateTimeStyles.RoundtripKind),
+                DateTimeOffset.Parse(candidate.ExpiresAtUtc, null, System.Globalization.DateTimeStyles.RoundtripKind),
+                candidate.Trust)),
+            DateTimeOffset.Parse(document.EvaluatedAtUtc, null, System.Globalization.DateTimeStyles.RoundtripKind),
+            string.IsNullOrWhiteSpace(document.RetryAfterUtc) ? null : DateTimeOffset.Parse(document.RetryAfterUtc, null, System.Globalization.DateTimeStyles.RoundtripKind),
+            document.FailedSourceIds,
+            string.IsNullOrWhiteSpace(document.QueryKey) ? document.EndpointId : document.QueryKey);
+    }
+}
diff --git a/src/GameCult.Mesh/CultMeshDocumentRegistries.cs b/src/GameCult.Mesh/CultMeshDocumentRegistries.cs
new file mode 100644
index 00000000..352b2641
--- /dev/null
+++ b/src/GameCult.Mesh/CultMeshDocumentRegistries.cs
@@ -0,0 +1,105 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using GameCult.Caching;
+using GameCult.Networking;
+
+namespace GameCult.Mesh
+{
+    public static partial class CultMesh
+    {
+        /// <summary>
+        /// Creates a CultCache document registry and resolves the supplied document types into it.
+        /// </summary>
+        public static CultDocumentRegistry CreateCultCacheDocumentRegistry(params Type[] documentTypes)
+        {
+            return CreateCultCacheDocumentRegistry((IEnumerable<Type>)documentTypes);
+        }
+
+        /// <summary>
+        /// Creates a CultCache document registry and resolves the supplied document types into it.
+        /// </summary>
+        public static CultDocumentRegistry CreateCultCacheDocumentRegistry(IEnumerable<Type> documentTypes)
+        {
+            if (documentTypes == null)
+            {
+                throw new ArgumentNullException(nameof(documentTypes));
+            }
+
+            return CultDocumentRegistry.ForTypes(DistinctDocumentTypes(documentTypes));
+        }
+
+        /// <summary>
+        /// Creates a CultNet document registry with default bindings for the supplied document types.
+        /// </summary>
+        public static CultNetDocumentRegistry CreateCultNetDocumentRegistry(params Type[] documentTypes)
+        {
+            return CreateCultNetDocumentRegistry((IEnumerable<Type>)documentTypes);
+        }
+
+        /// <summary>
+        /// Creates a CultNet document registry with default bindings for the supplied document types.
+        /// </summary>
+        public static CultNetDocumentRegistry CreateCultNetDocumentRegistry(IEnumerable<Type> documentTypes)
+        {
+            return CreateCultNetDocumentRegistry(documentTypes, null);
+        }
+
+        /// <summary>
+        /// Creates a CultNet document registry with default bindings for the supplied document types.
+        /// </summary>
+        public static CultNetDocumentRegistry CreateCultNetDocumentRegistry(
+            IEnumerable<Type> documentTypes,
+            CultDocumentRegistry? documents)
+        {
+            if (documentTypes == null)
+            {
+                throw new ArgumentNullException(nameof(documentTypes));
+            }
+
+            documents ??= CreateCultCacheDocumentRegistry(documentTypes);
+            var registry = new CultNetDocumentRegistry(documents);
+            var descriptors = DistinctDocumentTypes(documentTypes)
+                .Select(documentType => documents.GetRequired(documentType))
+                .ToArray();
+            foreach (var descriptorGroup in descriptors.GroupBy(descriptor => descriptor.SchemaId, StringComparer.Ordinal))
+            {
+                foreach (var descriptor in descriptorGroup.Reverse())
+                {
+                    registry.Register(CultNetDocumentBinding.ForDocument(descriptor.DocumentType, documents));
+                }
+            }
+
+            return registry;
+        }
+
+        /// <summary>
+        /// Creates a CultNet document registry with default bindings for the supplied document types.
+        /// </summary>
+        public static CultNetDocumentRegistry CreateCultNetDocumentRegistry(
+            CultDocumentRegistry documents,
+            params Type[] documentTypes)
+        {
+            return CreateCultNetDocumentRegistry(documentTypes, documents);
+        }
+
+        /// <summary>
+        /// Creates a CultNet document registry with default bindings for the supplied document types.
+        /// </summary>
+        public static CultNetDocumentRegistry CreateCultNetDocumentRegistry(
+            CultDocumentRegistry documents,
+            IEnumerable<Type> documentTypes)
+        {
+            return CreateCultNetDocumentRegistry(documentTypes, documents);
+        }
+
+        private static IEnumerable<Type> DistinctDocumentTypes(IEnumerable<Type> documentTypes)
+        {
+            return documentTypes
+                .Select(documentType => documentType ?? throw new ArgumentException(
+                    "Document type collections cannot contain null entries.",
+                    nameof(documentTypes)))
+                .Distinct();
+        }
+    }
+}
diff --git a/src/GameCult.Mesh/CultMeshEntityPrefabs.cs b/src/GameCult.Mesh/CultMeshEntityPrefabs.cs
new file mode 100644
index 00000000..194c9360
--- /dev/null
+++ b/src/GameCult.Mesh/CultMeshEntityPrefabs.cs
@@ -0,0 +1,395 @@
+using System;
+using System.Collections.Generic;
+using System.Globalization;
+using System.Linq;
+using System.Text;
+using System.Threading.Tasks;
+using GameCult.Caching;
+using GameCult.Networking;
+using MessagePack;
+
+namespace GameCult.Mesh
+{
+    /// <summary>
+    /// Schema versions for portable entity prefab packages.
+    /// </summary>
+    public static class CultMeshEntityPrefabSchemaVersions
+    {
+        /// <summary>Portable prefab package schema id.</summary>
+        public const string Package = "gamecult.mesh.entity_prefab_package.v1";
+    }
+
+    /// <summary>
+    /// Well-known portable prefab node kinds.
+    /// </summary>
+    public static class CultMeshEntityPrefabNodeKinds
+    {
+        /// <summary>Transform-only node.</summary>
+        public const string Empty = "empty";
+        /// <summary>Renderable mesh node.</summary>
+        public const string Mesh = "mesh";
+        /// <summary>Collider node.</summary>
+        public const string Collider = "collider";
+        /// <summary>Particle or projectile effect node.</summary>
+        public const string Effect = "effect";
+        /// <summary>Camera or view anchor node.</summary>
+        public const string Camera = "camera";
+        /// <summary>Runtime attachment point.</summary>
+        public const string Socket = "socket";
+    }
+
+    /// <summary>
+    /// Well-known prefab asset roles.
+    /// </summary>
+    public static class CultMeshEntityPrefabAssetRoles
+    {
+        /// <summary>Mesh geometry payload.</summary>
+        public const string Mesh = "mesh";
+        /// <summary>Texture image payload.</summary>
+        public const string Texture = "texture";
+        /// <summary>Material definition payload.</summary>
+        public const string Material = "material";
+        /// <summary>Animation clip payload.</summary>
+        public const string Animation = "animation";
+        /// <summary>Audio payload.</summary>
+        public const string Audio = "audio";
+    }
+
+    /// <summary>
+    /// Portable transform using Blender/CultMesh source coordinates before runtime lowering.
+    /// </summary>
+    [MessagePackObject]
+    public sealed class CultMeshEntityPrefabTransform
+    {
+        /// <summary>Local position vector.</summary>
+        [Key(0)]
+        public float[] Position { get; set; } = [0f, 0f, 0f];
+
+        /// <summary>Local rotation quaternion.</summary>
+        [Key(1)]
+        public float[] Rotation { get; set; } = [0f, 0f, 0f, 1f];
+
+        /// <summary>Local scale vector.</summary>
+        [Key(2)]
+        public float[] Scale { get; set; } = [1f, 1f, 1f];
+    }
+
+    /// <summary>
+    /// Runtime component intent attached to a portable prefab node.
+    /// </summary>
+    [MessagePackObject]
+    public sealed class CultMeshEntityPrefabComponent
+    {
+        /// <summary>Portable component kind or runtime adapter type.</summary>
+        [Key(0)]
+        public string Type { get; set; } = string.Empty;
+
+        /// <summary>String-valued component properties for runtime-specific lowering.</summary>
+        [Key(1)]
+        public Dictionary<string, string> Properties { get; set; } = new();
+    }
+
+    /// <summary>
+    /// Reference from a prefab package to a CDN artifact manifest.
+    /// </summary>
+    [MessagePackObject]
+    public sealed class CultMeshEntityPrefabAssetRef
+    {
+        /// <summary>Stable source asset id inside the prefab package.</summary>
+        [Key(0)]
+        public string AssetId { get; set; } = string.Empty;
+
+        /// <summary>Semantic role, such as mesh, texture, material, or animation.</summary>
+        [Key(1)]
+        public string Role { get; set; } = string.Empty;
+
+        /// <summary>CultCache record key for the referenced CDN artifact manifest.</summary>
+        [Key(2)]
+        public string CdnManifestRecordKey { get; set; } = string.Empty;
+
+        /// <summary>Full artifact content hash copied from the referenced CDN manifest.</summary>
+        [Key(3)]
+        public string ContentHash { get; set; } = string.Empty;
+
+        /// <summary>Artifact MIME type copied from the referenced CDN manifest.</summary>
+        [Key(4)]
+        public string MimeType { get; set; } = string.Empty;
+
+        /// <summary>Runtime and source metadata for the asset reference.</summary>
+        [Key(5)]
+        public Dictionary<string, string> Metadata { get; set; } = new();
+    }
+
+    /// <summary>
+    /// One node in a portable entity prefab graph.
+    /// </summary>
+    [MessagePackObject]
+    public sealed class CultMeshEntityPrefabNode
+    {
+        /// <summary>Stable node id inside the package.</summary>
+        [Key(0)]
+        public string NodeId { get; set; } = string.Empty;
+
+        /// <summary>Source object name.</summary>
+        [Key(1)]
+        public string Name { get; set; } = string.Empty;
+
+        /// <summary>Optional parent node id.</summary>
+        [Key(2)]
+        public string ParentNodeId { get; set; } = string.Empty;
+
+        /// <summary>Node kind.</summary>
+        [Key(3)]
+        public string Kind { get; set; } = CultMeshEntityPrefabNodeKinds.Empty;
+
+        /// <summary>Local transform.</summary>
+        [Key(4)]
+        public CultMeshEntityPrefabTransform Transform { get; set; } = new();
+
+        /// <summary>Optional mesh asset id used by this node.</summary>
+        [Key(5)]
+        public string MeshAssetId { get; set; } = string.Empty;
+
+        /// <summary>Material asset ids used by this node.</summary>
+        [Key(6)]
+        public string[] MaterialAssetIds { get; set; } = Array.Empty<string>();
+
+        /// <summary>Runtime component intents attached to this node.</summary>
+        [Key(7)]
+        public CultMeshEntityPrefabComponent[] Components { get; set; } = Array.Empty<CultMeshEntityPrefabComponent>();
+
+        /// <summary>Runtime tags copied from source metadata.</summary>
+        [Key(8)]
+        public string[] Tags { get; set; } = Array.Empty<string>();
+
+        /// <summary>Additional source metadata.</summary>
+        [Key(9)]
+        public Dictionary<string, string> Metadata { get; set; } = new();
+    }
+
+    /// <summary>
+    /// Portable entity prefab package authored from a Blender collection and lowerable into multiple runtimes.
+    /// </summary>
+    [MessagePackObject]
+    [CultDocument("gamecult.mesh.entity_prefab_package", CultMeshEntityPrefabSchemaVersions.Package)]
+    public sealed class CultMeshEntityPrefabPackage
+    {
+        /// <summary>Stable logical prefab id.</summary>
+        [Key(0)]
+        [CultName]
+        public string PrefabId { get; set; } = string.Empty;
+
+        /// <summary>Caller-defined package version.</summary>
+        [Key(1)]
+        [CultIndex]
+        public string Version { get; set; } = string.Empty;
+
+        /// <summary>Tool that authored the package, such as Brokkr Blender.</summary>
+        [Key(2)]
+        [CultIndex]
+        public string SourceTool { get; set; } = string.Empty;
+
+        /// <summary>Source scene name or path.</summary>
+        [Key(3)]
+        public string SourceScene { get; set; } = string.Empty;
+
+        /// <summary>Source Blender collection name.</summary>
+        [Key(4)]
+        [CultIndex]
+        public string SourceCollection { get; set; } = string.Empty;
+
+        /// <summary>Stable hash of graph structure and referenced assets.</summary>
+        [Key(5)]
+        [CultIndex]
+        public string ContentHash { get; set; } = string.Empty;
+
+        /// <summary>Package creation timestamp in round-trip UTC format.</summary>
+        [Key(6)]
+        public string CreatedAtUtc { get; set; } = string.Empty;
+
+        /// <summary>Referenced CDN assets.</summary>
+        [Key(7)]
+        public CultMeshEntityPrefabAssetRef[] Assets { get; set; } = Array.Empty<CultMeshEntityPrefabAssetRef>();
+
+        /// <summary>Prefab hierarchy nodes.</summary>
+        [Key(8)]
+        public CultMeshEntityPrefabNode[] Nodes { get; set; } = Array.Empty<CultMeshEntityPrefabNode>();
+
+        /// <summary>Search and routing tags.</summary>
+        [Key(9)]
+        public string[] Tags { get; set; } = Array.Empty<string>();
+
+        /// <summary>Package-level metadata.</summary>
+        [Key(10)]
+        public Dictionary<string, string> Metadata { get; set; } = new();
+
+        /// <summary>Builds the deterministic package record key.</summary>
+        public static CultRecordKey CreateRecordKey(CultMeshEntityPrefabPackage package)
+        {
+            if (package == null) throw new ArgumentNullException(nameof(package));
+            return CreateRecordKey(package.PrefabId, package.Version, package.ContentHash);
+        }
+
+        /// <summary>Builds the deterministic package record key.</summary>
+        public static CultRecordKey CreateRecordKey(string prefabId, string version, string contentHash)
+        {
+            var prefabToken = CultMeshCdn.StableToken(prefabId, nameof(prefabId));
+            var versionToken = string.IsNullOrWhiteSpace(version)
+                ? "unversioned"
+                : CultMeshCdn.StableToken(version, nameof(version));
+            return new CultRecordKey(
+                "mesh:entity-prefab:" + prefabToken + ":" + versionToken + ":" + CultMeshCdn.NormalizeHash(contentHash, nameof(contentHash)));
+        }
+    }
+
+    /// <summary>
+    /// Helpers for publishing and validating portable entity prefab packages.
+    /// </summary>
+    public static class CultMeshEntityPrefabs
+    {
+        /// <summary>
+        /// Computes a stable package content hash from graph structure and referenced asset hashes.
+        /// </summary>
+        public static string ComputeContentHash(CultMeshEntityPrefabPackage package)
+        {
+            if (package == null) throw new ArgumentNullException(nameof(package));
+            var builder = new StringBuilder();
+            builder.Append(package.PrefabId).Append('\u001F')
+                .Append(package.Version).Append('\u001F')
+                .Append(package.SourceTool).Append('\u001F')
+                .Append(package.SourceScene).Append('\u001F')
+                .Append(package.SourceCollection).Append('\u001F');
+
+            foreach (var asset in package.Assets.OrderBy(asset => asset.AssetId, StringComparer.Ordinal))
+            {
+                builder.Append("asset").Append('\u001E')
+                    .Append(asset.AssetId).Append('\u001E')
+                    .Append(asset.Role).Append('\u001E')
+                    .Append(asset.CdnManifestRecordKey).Append('\u001E')
+                    .Append(CultMeshCdn.NormalizeHash(asset.ContentHash, nameof(asset.ContentHash))).Append('\u001E')
+                    .Append(asset.MimeType).Append('\u001E')
+                    .Append(StableMap(asset.Metadata)).Append('\u001F');
+            }
+
+            foreach (var node in package.Nodes.OrderBy(node => node.NodeId, StringComparer.Ordinal))
+            {
+                builder.Append("node").Append('\u001E')
+                    .Append(node.NodeId).Append('\u001E')
+                    .Append(node.Name).Append('\u001E')
+                    .Append(node.ParentNodeId).Append('\u001E')
+                    .Append(node.Kind).Append('\u001E')
+                    .Append(StableFloats(node.Transform.Position)).Append('\u001E')
+                    .Append(StableFloats(node.Transform.Rotation)).Append('\u001E')
+                    .Append(StableFloats(node.Transform.Scale)).Append('\u001E')
+                    .Append(node.MeshAssetId).Append('\u001E')
+                    .Append(string.Join(",", node.MaterialAssetIds.OrderBy(value => value, StringComparer.Ordinal))).Append('\u001E')
+                    .Append(StableComponents(node.Components)).Append('\u001E')
+                    .Append(string.Join(",", node.Tags.OrderBy(value => value, StringComparer.Ordinal))).Append('\u001E')
+                    .Append(StableMap(node.Metadata)).Append('\u001F');
+            }
+
+            builder.Append(string.Join(",", package.Tags.OrderBy(value => value, StringComparer.Ordinal))).Append('\u001F')
+                .Append(StableMap(package.Metadata));
+
+            return CultMeshCdn.HashBytes(Encoding.UTF8.GetBytes(builder.ToString()));
+        }
+
+        /// <summary>
+        /// Stamps the current content hash and creation timestamp on a package.
+        /// </summary>
+        public static CultMeshEntityPrefabPackage FinalizePackage(CultMeshEntityPrefabPackage package)
+        {
+            if (package == null) throw new ArgumentNullException(nameof(package));
+            package.CreatedAtUtc = string.IsNullOrWhiteSpace(package.CreatedAtUtc)
+                ? DateTimeOffset.UtcNow.ToString("O", CultureInfo.InvariantCulture)
+                : package.CreatedAtUtc;
+            package.ContentHash = ComputeContentHash(package);
+            return package;
+        }
+
+        /// <summary>
+        /// Publishes a finalized portable entity prefab package into a local cache.
+        /// </summary>
+        public static async Task<CultMeshEntityPrefabPackage> PublishAsync(
+            CultCache cache,
+            CultMeshEntityPrefabPackage package)
+        {
+            if (cache == null) throw new ArgumentNullException(nameof(cache));
+            if (package == null) throw new ArgumentNullException(nameof(package));
+            ValidatePackage(package);
+            await cache.UpsertAsync(
+                package,
+                new CultRecordHandle<CultMeshEntityPrefabPackage>(
+                    CultMeshEntityPrefabPackage.CreateRecordKey(package))).ConfigureAwait(false);
+            return package;
+        }
+
+        /// <summary>
+        /// Publishes a finalized portable entity prefab package into a distributed CultNet database.
+        /// </summary>
+        public static async Task<CultMeshEntityPrefabPackage> PublishAsync(
+            CultNetDatabase database,
+            CultMeshEntityPrefabPackage package)
+        {
+            if (database == null) throw new ArgumentNullException(nameof(database));
+            if (package == null) throw new ArgumentNullException(nameof(package));
+            ValidatePackage(package);
+            await database.PutAsync(CultMeshEntityPrefabPackage.CreateRecordKey(package), package)
+                .ConfigureAwait(false);
+            return package;
+        }
+
+        /// <summary>
+        /// Creates a raw CultNet document registry for entity prefab packages.
+        /// </summary>
+        public static CultNetDocumentRegistry CreateDocumentRegistry(CultDocumentRegistry? documents = null)
+        {
+            documents ??= CultDocumentRegistry.Shared;
+            return new CultNetDocumentRegistry(documents)
+                .Register(CultNetDocumentBinding.ForDocument<CultMeshEntityPrefabPackage>(documents));
+        }
+
+        /// <summary>
+        /// Creates a raw CultNet document registry for CDN assets and portable entity prefab packages.
+        /// </summary>
+        public static CultNetDocumentRegistry CreateAssetPipelineDocumentRegistry(CultDocumentRegistry? documents = null)
+        {
+            documents ??= CultDocumentRegistry.Shared;
+            return CultMeshCdn.CreateDocumentRegistry(documents)
+                .Register(CultNetDocumentBinding.ForDocument<CultMeshEntityPrefabPackage>(documents));
+        }
+
+        private static void ValidatePackage(CultMeshEntityPrefabPackage package)
+        {
+            if (string.IsNullOrWhiteSpace(package.PrefabId))
+            {
+                throw new ArgumentException("Prefab id must be non-empty.", nameof(package));
+            }
+
+            var expectedHash = ComputeContentHash(package);
+            if (!string.Equals(CultMeshCdn.NormalizeHash(package.ContentHash, nameof(package.ContentHash)), expectedHash, StringComparison.Ordinal))
+            {
+                throw new InvalidOperationException("Entity prefab package content hash does not match its graph.");
+            }
+        }
+
+        private static string StableComponents(IEnumerable<CultMeshEntityPrefabComponent> components)
+        {
+            return string.Join("|", components
+                .OrderBy(component => component.Type, StringComparer.Ordinal)
+                .Select(component => component.Type + "=" + StableMap(component.Properties)));
+        }
+
+        private static string StableFloats(IEnumerable<float> values)
+        {
+            return string.Join(",", values.Select(value => value.ToString("R", CultureInfo.InvariantCulture)));
+        }
+
+        private static string StableMap(Dictionary<string, string> values)
+        {
+            return string.Join("|", values
+                .OrderBy(pair => pair.Key, StringComparer.Ordinal)
+                .Select(pair => pair.Key + "=" + pair.Value));
+        }
+    }
+}
diff --git a/src/GameCult.Mesh/CultMeshFrameBodies.cs b/src/GameCult.Mesh/CultMeshFrameBodies.cs
new file mode 100644
index 00000000..dbf2e235
--- /dev/null
+++ b/src/GameCult.Mesh/CultMeshFrameBodies.cs
@@ -0,0 +1,982 @@
+using System;
+using System.Buffers;
+using System.Collections.Generic;
+using System.IO;
+using System.IO.MemoryMappedFiles;
+using System.Runtime.InteropServices;
+using System.Security.Cryptography;
+using System.Text;
+using System.Threading;
+using Microsoft.Win32.SafeHandles;
+
+#nullable enable
+
+namespace GameCult.Mesh
+{
+    /// <summary>Reports bounded shared-memory frame publication and explicit copy telemetry.</summary>
+    public sealed class CultMeshFrameBodyPublisherStats
+    {
+        internal CultMeshFrameBodyPublisherStats(
+            ulong publishedFrames,
+            ulong blockedWrites,
+            ulong unavoidableCopyCount)
+        {
+            PublishedFrames = publishedFrames;
+            BlockedWrites = blockedWrites;
+            UnavoidableCopyCount = unavoidableCopyCount;
+        }
+
+        /// <summary>Gets the number of atomically committed generations.</summary>
+        public ulong PublishedFrames { get; }
+        /// <summary>Gets the number of write reservations refused by bounded slots.</summary>
+        public ulong BlockedWrites { get; }
+        /// <summary>Gets copies explicitly declared by copy-fallback publication.</summary>
+        public ulong UnavoidableCopyCount { get; }
+    }
+
+    // Owner: this publisher owns mapping lifetime, logical generation, and slot commit.
+    // Consumers own only read leases; mappings, capabilities, and slot selection remain CultMesh state.
+    public sealed class CultMeshFrameBodyPublisher : IDisposable
+    {
+        internal const string CapabilityPrefix = "frame-v2-";
+        internal const int HeaderSize = 512;
+        internal const int SequenceOffset = 8;
+        internal const int ReaderCountOffset = 32;
+        internal const int WriterCountOffset = 48;
+        internal const int ContractHashOffset = 64;
+        internal const int ByteLengthOffset = 128;
+        internal const int LeaseExpiresAtOffset = 144;
+        internal const int SemanticHashOffset = 192;
+        internal const int SemanticHashStride = 64;
+        private readonly object _gate = new();
+        private readonly MemoryMappedFile _mapping;
+        private readonly MemoryMappedViewAccessor _control;
+        private readonly Mutex _mutex;
+        private readonly TimeSpan _leaseDuration;
+        private readonly string _token;
+        private readonly string? _mappingPath;
+        private int _cursor;
+        private long _nextSequence;
+        private ulong _publishedFrames;
+        private ulong _blockedWrites;
+        private ulong _unavoidableCopyCount;
+        private CultMeshFrameBodyWriteLease? _activeWrite;
+        private bool _disposed;
+
+        public CultMeshFrameBodyPublisher(
+            string bodyId,
+            string schemaId,
+            int layoutVersion,
+            int capacity,
+            long producerEpoch,
+            int slotByteLength,
+            TimeSpan? leaseDuration = null)
+        {
+            BodyId = Require(bodyId, nameof(bodyId));
+            SchemaId = Require(schemaId, nameof(schemaId));
+            if (layoutVersion < 0) throw new ArgumentOutOfRangeException(nameof(layoutVersion));
+            if (capacity < 0) throw new ArgumentOutOfRangeException(nameof(capacity));
+            if (producerEpoch < 0) throw new ArgumentOutOfRangeException(nameof(producerEpoch));
+            if (slotByteLength <= 0) throw new ArgumentOutOfRangeException(nameof(slotByteLength));
+            LayoutVersion = layoutVersion;
+            Capacity = capacity;
+            ProducerEpoch = producerEpoch;
+            SlotByteLength = slotByteLength;
+            _leaseDuration = leaseDuration ?? TimeSpan.FromSeconds(5);
+            if (_leaseDuration <= TimeSpan.Zero) throw new ArgumentOutOfRangeException(nameof(leaseDuration));
+            _token = CapabilityPrefix + RandomToken();
+            var mappingByteLength = checked(HeaderSize + CultMeshFrameRegion.SlotCount * slotByteLength);
+            if (RuntimeInformation.IsOSPlatform(OSPlatform.Windows))
+            {
+                _mapping = MemoryMappedFile.CreateNew(MappingName(_token), mappingByteLength);
+            }
+            else
+            {
+                _mappingPath = MappingPath(_token);
+                _mapping = MemoryMappedFile.CreateFromFile(
+                    _mappingPath,
+                    FileMode.CreateNew,
+                    null,
+                    mappingByteLength,
+                    MemoryMappedFileAccess.ReadWrite);
+            }
+            _control = _mapping.CreateViewAccessor(0, HeaderSize, MemoryMappedFileAccess.ReadWrite);
+            _control.Write(0, slotByteLength);
+            _control.Write(4, CultMeshFrameRegion.SlotCount);
+            for (var slot = 0; slot < CultMeshFrameRegion.SlotCount; slot++)
+                _control.Write(SequenceOffset + slot * sizeof(long), -1L);
+            var contractHash = Encoding.ASCII.GetBytes(ContractHash(BodyId, SchemaId, LayoutVersion, Capacity, ProducerEpoch, SlotByteLength));
+            _control.WriteArray(ContractHashOffset, contractHash, 0, contractHash.Length);
+            _mutex = new Mutex(false, MutexName(_token));
+        }
+
+        public string BodyId { get; }
+        public string SchemaId { get; }
+        public int LayoutVersion { get; }
+        public int Capacity { get; }
+        public long ProducerEpoch { get; }
+        public int SlotByteLength { get; }
+
+        public bool TryPublish(ReadOnlySpan<byte> body, DateTimeOffset nowUtc, out CultMeshBodyDescriptor descriptor)
+        {
+            if (body.Length > SlotByteLength) throw new ArgumentOutOfRangeException(nameof(body));
+            if (!TryAcquireWrite(out var write))
+            {
+                descriptor = null!;
+                return false;
+            }
+            using (write)
+            {
+                body.CopyTo(write.Span);
+                descriptor = write.Commit(body.Length, nowUtc, unavoidableCopyCount: 1);
+                return true;
+            }
+        }
+
+        /// <summary>
+        /// Reserves one producer-owned shared-memory slot for direct writes. The caller must commit or dispose the lease.
+        /// </summary>
+        public bool TryAcquireWrite(out CultMeshFrameBodyWriteLease lease)
+        {
+            lock (_gate)
+            {
+                ThrowIfDisposed();
+                if (_activeWrite != null)
+                {
+                    _blockedWrites++;
+                    lease = null!;
+                    return false;
+                }
+
+                var slot = -1;
+                WithMutex(() =>
+                {
+                    for (var attempt = 0; attempt < CultMeshFrameRegion.SlotCount; attempt++)
+                    {
+                        var candidate = (_cursor + attempt) % CultMeshFrameRegion.SlotCount;
+                        if (_control.ReadInt32(ReaderCountOffset + candidate * sizeof(int)) != 0 ||
+                            _control.ReadInt32(WriterCountOffset + candidate * sizeof(int)) != 0)
+                            continue;
+                        _control.Write(WriterCountOffset + candidate * sizeof(int), 1);
+                        slot = candidate;
+                        _cursor = (candidate + 1) % CultMeshFrameRegion.SlotCount;
+                        return;
+                    }
+                });
+                if (slot < 0)
+                {
+                    _blockedWrites++;
+                    lease = null!;
+                    return false;
+                }
+
+                try
+                {
+                    var view = _mapping.CreateViewAccessor(
+                        SlotOffset(slot, SlotByteLength),
+                        SlotByteLength,
+                        MemoryMappedFileAccess.ReadWrite);
+                    lease = new CultMeshFrameBodyWriteLease(this, view, slot, _nextSequence, SlotByteLength);
+                    _activeWrite = lease;
+                    return true;
+                }
+                catch
+                {
+                    WithMutex(() => _control.Write(WriterCountOffset + slot * sizeof(int), 0));
+                    throw;
+                }
+            }
+        }
+
+        internal CultMeshBodyDescriptor Commit(
+            CultMeshFrameBodyWriteLease lease,
+            int byteLength,
+            DateTimeOffset nowUtc,
+            int unavoidableCopyCount)
+        {
+            lock (_gate)
+            {
+                ThrowIfDisposed();
+                if (!ReferenceEquals(_activeWrite, lease) || lease.Sequence != _nextSequence)
+                    throw new InvalidOperationException("The CultMesh frame write lease is stale or is not owned by this publisher.");
+                if (byteLength < 0 || byteLength > SlotByteLength)
+                    throw new ArgumentOutOfRangeException(nameof(byteLength));
+                if (unavoidableCopyCount < 0)
+                    throw new ArgumentOutOfRangeException(nameof(unavoidableCopyCount));
+                var semanticHash = CultMeshBodyDescriptorValidator.ComputeSemanticHash(lease.Span[..byteLength]);
+                WithMutex(() =>
+                {
+                    var writerOffset = WriterCountOffset + lease.SlotIndex * sizeof(int);
+                    if (_control.ReadInt32(writerOffset) != 1 ||
+                        _control.ReadInt32(ReaderCountOffset + lease.SlotIndex * sizeof(int)) != 0)
+                        throw new InvalidOperationException("The CultMesh frame write reservation was lost before commit.");
+                    _control.Write(SequenceOffset + lease.SlotIndex * sizeof(long), lease.Sequence);
+                    _control.Write(ByteLengthOffset + lease.SlotIndex * sizeof(int), byteLength);
+                    _control.Write(LeaseExpiresAtOffset + lease.SlotIndex * sizeof(long), nowUtc.Add(_leaseDuration).ToUnixTimeMilliseconds());
+                    var hashBytes = Encoding.ASCII.GetBytes(semanticHash);
+                    _control.WriteArray(SemanticHashOffset + lease.SlotIndex * SemanticHashStride, hashBytes, 0, hashBytes.Length);
+                    _control.Write(writerOffset, 0);
+                });
+                var descriptor = Descriptor(lease.SlotIndex, byteLength, lease.Sequence, semanticHash, nowUtc);
+                _nextSequence++;
+                _publishedFrames++;
+                _unavoidableCopyCount += (ulong)Math.Max(0, unavoidableCopyCount);
+                _activeWrite = null;
+                lease.Complete();
+                return descriptor;
+            }
+        }
+
+        internal void Abandon(CultMeshFrameBodyWriteLease lease)
+        {
+            lock (_gate)
+            {
+                if (!ReferenceEquals(_activeWrite, lease)) return;
+                if (!_disposed)
+                {
+                    WithMutex(() =>
+                        _control.Write(WriterCountOffset + lease.SlotIndex * sizeof(int), 0));
+                }
+                _activeWrite = null;
+            }
+        }
+
+        /// <summary>Gets current publication, backpressure, and explicit fallback-copy counters.</summary>
+        public CultMeshFrameBodyPublisherStats Stats()
+        {
+            lock (_gate)
+            {
+                ThrowIfDisposed();
+                return new CultMeshFrameBodyPublisherStats(
+                    _publishedFrames,
+                    _blockedWrites,
+                    _unavoidableCopyCount);
+            }
+        }
+
+        private CultMeshBodyDescriptor Descriptor(
+            int slot,
+            int byteLength,
+            long sequence,
+            string semanticHash,
+            DateTimeOffset nowUtc) => new()
+        {
+            BodyId = BodyId, SchemaId = SchemaId, LayoutVersion = LayoutVersion, ByteSize = byteLength,
+            Capacity = Capacity, ProducerEpoch = ProducerEpoch, Sequence = sequence,
+            AccessMode = CultMeshBodyAccessMode.ReadOnly, Synchronization = CultMeshBodySynchronization.TripleBuffer,
+            LeaseExpiresAtUnixMs = nowUtc.Add(_leaseDuration).ToUnixTimeMilliseconds(),
+            TransportKind = CultMeshBodyTransportKind.SharedMemory,
+            CapabilityToken = _token + "." + slot,
+            SemanticHash = semanticHash
+        };
+
+        internal static bool IsFrameCapability(string capability) => capability.StartsWith(CapabilityPrefix, StringComparison.Ordinal);
+
+        internal static ICultMeshBodyReadLease OpenReadOnly(CultMeshBodyDescriptor descriptor)
+        {
+            ParseCapability(descriptor.CapabilityToken, out var token, out var slot);
+            MemoryMappedFile mapping;
+            Mutex mutex;
+            try
+            {
+                mapping = OpenMapping(token);
+                mutex = Mutex.OpenExisting(MutexName(token));
+            }
+            catch (Exception error) when (error is FileNotFoundException || error is WaitHandleCannotBeOpenedException)
+            {
+                throw new InvalidDataException("CultMesh frame capability is unavailable or revoked.", error);
+            }
+            try
+            {
+                int slotByteLength = 0;
+                WithMutex(mutex, () =>
+                {
+                    using var control = mapping.CreateViewAccessor(0, HeaderSize, MemoryMappedFileAccess.ReadWrite);
+                    slotByteLength = control.ReadInt32(0);
+                    if (slot < 0 || slot >= control.ReadInt32(4) || descriptor.ByteSize > slotByteLength)
+                        throw new InvalidDataException("CultMesh frame capability does not match its mapping layout.");
+                    var contractHash = new byte[64];
+                    control.ReadArray(ContractHashOffset, contractHash, 0, contractHash.Length);
+                    var expectedContract = ContractHash(
+                        descriptor.BodyId, descriptor.SchemaId, descriptor.LayoutVersion,
+                        descriptor.Capacity, descriptor.ProducerEpoch, slotByteLength);
+                    if (!string.Equals(Encoding.ASCII.GetString(contractHash), expectedContract, StringComparison.Ordinal) ||
+                        control.ReadInt64(SequenceOffset + slot * sizeof(long)) != descriptor.Sequence)
+                        throw new InvalidOperationException("CultMesh frame generation is stale or belongs to a different body contract.");
+                    var offset = ReaderCountOffset + slot * sizeof(int);
+                    control.Write(offset, checked(control.ReadInt32(offset) + 1));
+                });
+                return new CultMeshMappedBodyLease(
+                    descriptor, mapping, SlotOffset(slot, slotByteLength),
+                    () => ReleaseReader(token, slot));
+            }
+            catch
+            {
+                mapping.Dispose();
+                mutex.Dispose();
+                throw;
+            }
+            finally { mutex.Dispose(); }
+        }
+
+        internal static void ReleaseReader(string token, int slot)
+        {
+            try
+            {
+                using var mapping = OpenMapping(token);
+                using var mutex = Mutex.OpenExisting(MutexName(token));
+                WithMutex(mutex, () =>
+                {
+                    using var control = mapping.CreateViewAccessor(0, HeaderSize, MemoryMappedFileAccess.ReadWrite);
+                    var offset = ReaderCountOffset + slot * sizeof(int);
+                    var readers = control.ReadInt32(offset);
+                    if (readers > 0) control.Write(offset, readers - 1);
+                });
+            }
+            catch (Exception error) when (error is FileNotFoundException || error is WaitHandleCannotBeOpenedException) { }
+        }
+
+        public void Dispose()
+        {
+            lock (_gate)
+            {
+                if (_disposed) return;
+                _disposed = true;
+                _activeWrite?.Invalidate();
+                _activeWrite = null;
+                _control.Dispose();
+                _mapping.Dispose();
+                _mutex.Dispose();
+                if (_mappingPath != null)
+                {
+                    try { File.Delete(_mappingPath); }
+                    catch (IOException) { }
+                    catch (UnauthorizedAccessException) { }
+                }
+            }
+        }
+
+        private void WithMutex(Action action) => WithMutex(_mutex, action);
+        internal static void WithMutex(Mutex mutex, Action action)
+        {
+            mutex.WaitOne();
+            try { action(); }
+            finally { mutex.ReleaseMutex(); }
+        }
+        internal static long SlotOffset(int slot, int slotByteLength) => HeaderSize + (long)slot * slotByteLength;
+        internal static string MappingName(string token) => "cultmesh-map-" + token;
+        internal static string MappingPath(string token) => Path.Combine(Path.GetTempPath(), MappingName(token) + ".map");
+        internal static MemoryMappedFile OpenMapping(string token) =>
+            RuntimeInformation.IsOSPlatform(OSPlatform.Windows)
+                ? MemoryMappedFile.OpenExisting(MappingName(token), MemoryMappedFileRights.ReadWrite)
+                : MemoryMappedFile.CreateFromFile(MappingPath(token), FileMode.Open, null, 0, MemoryMappedFileAccess.ReadWrite);
+        internal static string MutexName(string token) => "cultmesh-lock-" + token;
+        internal static void ParseCapability(string capability, out string token, out int slot)
+        {
+            var separator = capability.LastIndexOf('.');
+            if (separator <= CapabilityPrefix.Length || !int.TryParse(capability.Substring(separator + 1), out slot))
+                throw new UnauthorizedAccessException("Invalid CultMesh frame capability.");
+            token = capability.Substring(0, separator);
+        }
+        private static string RandomToken()
+        {
+            var bytes = new byte[24];
+            using (var random = RandomNumberGenerator.Create()) random.GetBytes(bytes);
+            return BitConverter.ToString(bytes).Replace("-", string.Empty).ToLowerInvariant();
+        }
+        internal static string ContractHash(string bodyId, string schemaId, int layoutVersion, int capacity, long epoch, int slotByteLength) =>
+            CultMeshBodyDescriptorValidator.ComputeSemanticHash(
+                Encoding.UTF8.GetBytes($"{bodyId}\n{schemaId}\n{layoutVersion}\n{capacity}\n{epoch}\n{slotByteLength}"));
+        private void ThrowIfDisposed() { if (_disposed) throw new ObjectDisposedException(nameof(CultMeshFrameBodyPublisher)); }
+        private static string Require(string value, string name) => string.IsNullOrWhiteSpace(value) ? throw new ArgumentException("Value is required.", name) : value;
+    }
+
+    /// <summary>
+    /// Retains one verified shared-memory frame mapping and leases only newer committed generations.
+    /// The control plane is needed for bootstrap and layout changes, not for every frame.
+    /// </summary>
+    public sealed class CultMeshMappedFrameBodyCursor : IDisposable
+    {
+        private readonly CultMeshBodyDescriptor _contract;
+        private readonly string _token;
+        private readonly MemoryMappedFile _mapping;
+        private readonly MemoryMappedViewAccessor _control;
+        private readonly Mutex _mutex;
+        private readonly int _slotByteLength;
+        private long _lastSequence = -1;
+        private bool _disposed;
+
+        public static bool CanOpen(CultMeshBodyDescriptor descriptor) =>
+            descriptor != null &&
+            descriptor.TransportKind == CultMeshBodyTransportKind.SharedMemory &&
+            descriptor.Synchronization == CultMeshBodySynchronization.TripleBuffer &&
+            CultMeshFrameBodyPublisher.IsFrameCapability(descriptor.CapabilityToken);
+
+        public CultMeshMappedFrameBodyCursor(CultMeshBodyDescriptor descriptor)
+        {
+            _contract = descriptor ?? throw new ArgumentNullException(nameof(descriptor));
+            if (!CanOpen(descriptor))
+                throw new ArgumentException("Descriptor is not a mapped CultMesh frame capability.", nameof(descriptor));
+            CultMeshFrameBodyPublisher.ParseCapability(descriptor.CapabilityToken, out _token, out _);
+            try
+            {
+                _mapping = CultMeshFrameBodyPublisher.OpenMapping(_token);
+                _mutex = Mutex.OpenExisting(CultMeshFrameBodyPublisher.MutexName(_token));
+            }
+            catch (Exception error) when (error is FileNotFoundException || error is WaitHandleCannotBeOpenedException)
+            {
+                throw new InvalidDataException("CultMesh frame capability is unavailable or revoked.", error);
+            }
+            try
+            {
+                _control = _mapping.CreateViewAccessor(
+                    0,
+                    CultMeshFrameBodyPublisher.HeaderSize,
+                    MemoryMappedFileAccess.ReadWrite);
+                _slotByteLength = _control.ReadInt32(0);
+                var contractHash = new byte[64];
+                _control.ReadArray(CultMeshFrameBodyPublisher.ContractHashOffset, contractHash, 0, contractHash.Length);
+                var expected = CultMeshFrameBodyPublisher.ContractHash(
+                    descriptor.BodyId,
+                    descriptor.SchemaId,
+                    descriptor.LayoutVersion,
+                    descriptor.Capacity,
+                    descriptor.ProducerEpoch,
+                    _slotByteLength);
+                if (!string.Equals(Encoding.ASCII.GetString(contractHash), expected, StringComparison.Ordinal))
+                    throw new InvalidDataException("CultMesh frame cursor contract does not match its mapping.");
+            }
+            catch
+            {
+                _mapping.Dispose();
+                _mutex.Dispose();
+                throw;
+            }
+        }
+
+        public long LastSequence => _lastSequence;
+
+        public bool TryAcquireLatest(out ICultMeshBodyReadLease lease) =>
+            TryAcquireLatest(DateTimeOffset.UtcNow, out lease);
+
+        public bool TryAcquireLatest(DateTimeOffset nowUtc, out ICultMeshBodyReadLease lease)
+        {
+            if (_disposed) throw new ObjectDisposedException(nameof(CultMeshMappedFrameBodyCursor));
+            var slot = -1;
+            var sequence = -1L;
+            var byteLength = 0;
+            var leaseExpiresAt = 0L;
+            var semanticHash = "";
+            CultMeshFrameBodyPublisher.WithMutex(_mutex, () =>
+            {
+                var slotCount = _control.ReadInt32(4);
+                for (var candidate = 0; candidate < slotCount; candidate++)
+                {
+                    if (_control.ReadInt32(CultMeshFrameBodyPublisher.WriterCountOffset + candidate * sizeof(int)) != 0)
+                        continue;
+                    var candidateSequence = _control.ReadInt64(
+                        CultMeshFrameBodyPublisher.SequenceOffset + candidate * sizeof(long));
+                    if (candidateSequence <= _lastSequence || candidateSequence <= sequence)
+                        continue;
+                    var candidateExpiry = _control.ReadInt64(
+                        CultMeshFrameBodyPublisher.LeaseExpiresAtOffset + candidate * sizeof(long));
+                    var candidateLength = _control.ReadInt32(
+                        CultMeshFrameBodyPublisher.ByteLengthOffset + candidate * sizeof(int));
+                    // A byte-length change means the control-plane layout contract changed.
+                    // Do not expose that generation through a cursor bootstrapped against
+                    // the previous layout; its new descriptor must arrive first.
+                    if (candidateExpiry <= nowUtc.ToUnixTimeMilliseconds() ||
+                        candidateLength != _contract.ByteSize || candidateLength > _slotByteLength)
+                        continue;
+                    slot = candidate;
+                    sequence = candidateSequence;
+                    leaseExpiresAt = candidateExpiry;
+                    byteLength = candidateLength;
+                }
+                if (slot < 0) return;
+                var hashBytes = new byte[CultMeshFrameBodyPublisher.SemanticHashStride];
+                _control.ReadArray(
+                    CultMeshFrameBodyPublisher.SemanticHashOffset + slot * CultMeshFrameBodyPublisher.SemanticHashStride,
+                    hashBytes,
+                    0,
+                    hashBytes.Length);
+                semanticHash = Encoding.ASCII.GetString(hashBytes);
+                var readerOffset = CultMeshFrameBodyPublisher.ReaderCountOffset + slot * sizeof(int);
+                _control.Write(readerOffset, checked(_control.ReadInt32(readerOffset) + 1));
+            });
+            if (slot < 0)
+            {
+                lease = null!;
+                return false;
+            }
+
+            var descriptor = new CultMeshBodyDescriptor
+            {
+                BodyId = _contract.BodyId,
+                SchemaId = _contract.SchemaId,
+                LayoutVersion = _contract.LayoutVersion,
+                ByteSize = byteLength,
+                Capacity = _contract.Capacity,
+                ProducerEpoch = _contract.ProducerEpoch,
+                Sequence = sequence,
+                AccessMode = CultMeshBodyAccessMode.ReadOnly,
+                Synchronization = CultMeshBodySynchronization.TripleBuffer,
+                LeaseExpiresAtUnixMs = leaseExpiresAt,
+                TransportKind = CultMeshBodyTransportKind.SharedMemory,
+                CapabilityToken = _token + "." + slot,
+                SemanticHash = semanticHash
+            };
+            try
+            {
+                var mapping = CultMeshFrameBodyPublisher.OpenMapping(_token);
+                lease = new CultMeshMappedBodyLease(
+                    descriptor,
+                    mapping,
+                    CultMeshFrameBodyPublisher.SlotOffset(slot, _slotByteLength),
+                    () => CultMeshFrameBodyPublisher.ReleaseReader(_token, slot));
+                _lastSequence = sequence;
+                return true;
+            }
+            catch
+            {
+                CultMeshFrameBodyPublisher.ReleaseReader(_token, slot);
+                throw;
+            }
+        }
+
+        public void Dispose()
+        {
+            if (_disposed) return;
+            _disposed = true;
+            _control.Dispose();
+            _mapping.Dispose();
+            _mutex.Dispose();
+        }
+    }
+
+    /// <summary>A bounded producer lease over one directly writable shared-memory frame slot.</summary>
+    public sealed unsafe class CultMeshFrameBodyWriteLease : IDisposable
+    {
+        private CultMeshFrameBodyPublisher? _owner;
+        private readonly MemoryMappedViewAccessor _view;
+        private readonly CultMeshMappedMemoryManager _memory;
+        private bool _completed;
+
+        internal CultMeshFrameBodyWriteLease(
+            CultMeshFrameBodyPublisher owner,
+            MemoryMappedViewAccessor view,
+            int slotIndex,
+            long sequence,
+            int byteLength)
+        {
+            _owner = owner;
+            _view = view;
+            _memory = new CultMeshMappedMemoryManager(view, byteLength);
+            SlotIndex = slotIndex;
+            Sequence = sequence;
+        }
+
+        public int SlotIndex { get; }
+        public long Sequence { get; }
+        public Memory<byte> Memory => _memory.Memory;
+        public Span<byte> Span => Memory.Span;
+
+        public CultMeshBodyDescriptor Commit(
+            int byteLength,
+            DateTimeOffset nowUtc,
+            int unavoidableCopyCount = 0) =>
+            (_owner ?? throw new ObjectDisposedException(nameof(CultMeshFrameBodyWriteLease)))
+            .Commit(this, byteLength, nowUtc, unavoidableCopyCount);
+
+        internal void Complete()
+        {
+            _completed = true;
+            ReleaseResources();
+        }
+
+        internal void Invalidate()
+        {
+            _owner = null;
+            ReleaseResources();
+        }
+
+        public void Dispose()
+        {
+            var owner = Interlocked.Exchange(ref _owner, null);
+            if (!_completed) owner?.Abandon(this);
+            ReleaseResources();
+        }
+
+        private void ReleaseResources()
+        {
+            ((IDisposable)_memory).Dispose();
+            _view.Dispose();
+            _owner = null;
+        }
+    }
+
+    internal sealed unsafe class CultMeshMappedMemoryManager : MemoryManager<byte>
+    {
+        private SafeMemoryMappedViewHandle? _handle;
+        private byte* _pointer;
+        private readonly int _length;
+
+        public CultMeshMappedMemoryManager(MemoryMappedViewAccessor view, int length)
+        {
+            _handle = view.SafeMemoryMappedViewHandle;
+            _length = length;
+            byte* pointer = null;
+            _handle.AcquirePointer(ref pointer);
+            _pointer = pointer + view.PointerOffset;
+        }
+
+        public override Span<byte> GetSpan() =>
+            _handle == null ? throw new ObjectDisposedException(nameof(CultMeshMappedMemoryManager)) : new Span<byte>(_pointer, _length);
+
+        public override MemoryHandle Pin(int elementIndex = 0)
+        {
+            if ((uint)elementIndex > (uint)_length) throw new ArgumentOutOfRangeException(nameof(elementIndex));
+            if (_handle == null) throw new ObjectDisposedException(nameof(CultMeshMappedMemoryManager));
+            return new MemoryHandle(_pointer + elementIndex);
+        }
+
+        public override void Unpin() { }
+
+        protected override void Dispose(bool disposing)
+        {
+            var handle = Interlocked.Exchange(ref _handle, null);
+            if (handle == null) return;
+            handle.ReleasePointer();
+            _pointer = null;
+        }
+    }
+
+    public sealed class CultMeshFrameGeneration
+    {
+        internal CultMeshFrameGeneration(
+            int slotIndex,
+            CultMeshBodyDescriptor descriptor,
+            long timestampNs,
+            long durationNs,
+            int unavoidableCopyCount,
+            IReadOnlyDictionary<string, string>? metadata)
+        {
+            SlotIndex = slotIndex;
+            Descriptor = descriptor;
+            TimestampNs = timestampNs;
+            DurationNs = durationNs;
+            UnavoidableCopyCount = unavoidableCopyCount;
+            Metadata = metadata == null
+                ? new Dictionary<string, string>()
+                : new Dictionary<string, string>(metadata);
+        }
+
+        public int SlotIndex { get; }
+        public CultMeshBodyDescriptor Descriptor { get; }
+        public long TimestampNs { get; }
+        public long DurationNs { get; }
+        public int UnavoidableCopyCount { get; }
+        public IReadOnlyDictionary<string, string> Metadata { get; }
+    }
+
+    public readonly struct CultMeshFrameRegionWriteLease
+    {
+        private readonly CultMeshFrameRegion? _owner;
+        private readonly object? _reservation;
+
+        internal CultMeshFrameRegionWriteLease(
+            CultMeshFrameRegion owner,
+            object reservation,
+            int slotIndex,
+            long sequence,
+            Memory<byte> memory)
+        {
+            _owner = owner;
+            _reservation = reservation;
+            SlotIndex = slotIndex;
+            Sequence = sequence;
+            Memory = memory;
+        }
+
+        public int SlotIndex { get; }
+        public long Sequence { get; }
+        public Memory<byte> Memory { get; }
+        public Span<byte> Span => Memory.Span;
+
+        internal CultMeshFrameGeneration Commit(
+            int byteLength,
+            long timestampNs,
+            long durationNs,
+            int unavoidableCopyCount,
+            IReadOnlyDictionary<string, string>? metadata) =>
+            _owner?.Commit(this, _reservation!, byteLength, timestampNs, durationNs, unavoidableCopyCount, metadata)
+            ?? throw new InvalidOperationException("The frame-region write lease is not valid.");
+    }
+
+    public sealed class CultMeshFrameRegionReadLease : IDisposable
+    {
+        private CultMeshFrameRegion? _owner;
+
+        internal CultMeshFrameRegionReadLease(
+            CultMeshFrameRegion owner,
+            CultMeshFrameGeneration generation,
+            ReadOnlyMemory<byte> memory)
+        {
+            _owner = owner;
+            Generation = generation;
+            Memory = memory;
+        }
+
+        public CultMeshFrameGeneration Generation { get; }
+        public ReadOnlyMemory<byte> Memory { get; }
+        public ReadOnlySpan<byte> Span => Memory.Span;
+
+        public void Dispose() => Interlocked.Exchange(ref _owner, null)?.ReleaseRead(Generation.SlotIndex);
+    }
+
+    public sealed class CultMeshFrameRegionStats
+    {
+        internal CultMeshFrameRegionStats(
+            ulong publishedFrames,
+            ulong droppedFrames,
+            ulong blockedWrites,
+            long latestSequence,
+            ulong unavoidableCopyCount)
+        {
+            PublishedFrames = publishedFrames;
+            DroppedFrames = droppedFrames;
+            BlockedWrites = blockedWrites;
+            LatestSequence = latestSequence;
+            UnavoidableCopyCount = unavoidableCopyCount;
+        }
+
+        public ulong PublishedFrames { get; }
+        public ulong DroppedFrames { get; }
+        public ulong BlockedWrites { get; }
+        public long LatestSequence { get; }
+        public ulong UnavoidableCopyCount { get; }
+    }
+
+    public sealed class CultMeshFrameRegion : IDisposable
+    {
+        public const int SlotCount = 3;
+
+        private readonly object _gate = new();
+        private readonly byte[] _storage;
+        private readonly int[] _readerCounts = new int[SlotCount];
+        private readonly object?[] _writeReservations = new object?[SlotCount];
+        private readonly CultMeshFrameGeneration?[] _generations = new CultMeshFrameGeneration?[SlotCount];
+        private object? _activeWriteReservation;
+        private int _writeCursor;
+        private int _latestSlot = -1;
+        private bool _disposed;
+        private long _nextSequence;
+        private ulong _publishedFrames;
+        private ulong _droppedFrames;
+        private ulong _blockedWrites;
+        private ulong _unavoidableCopyCount;
+
+        public CultMeshFrameRegion(
+            string bodyId,
+            string schemaId,
+            int layoutVersion,
+            int capacity,
+            long producerEpoch,
+            int slotByteLength)
+        {
+            BodyId = Require(bodyId, nameof(bodyId));
+            SchemaId = Require(schemaId, nameof(schemaId));
+            if (layoutVersion < 0) throw new ArgumentOutOfRangeException(nameof(layoutVersion));
+            if (capacity < 0) throw new ArgumentOutOfRangeException(nameof(capacity));
+            if (producerEpoch < 0) throw new ArgumentOutOfRangeException(nameof(producerEpoch));
+            if (slotByteLength <= 0) throw new ArgumentOutOfRangeException(nameof(slotByteLength));
+            LayoutVersion = layoutVersion;
+            Capacity = capacity;
+            ProducerEpoch = producerEpoch;
+            SlotByteLength = slotByteLength;
+            _storage = new byte[checked(SlotCount * slotByteLength)];
+        }
+
+        public string BodyId { get; }
+        public string SchemaId { get; }
+        public int LayoutVersion { get; }
+        public int Capacity { get; }
+        public long ProducerEpoch { get; }
+        public int SlotByteLength { get; }
+
+        public bool TryAcquireWrite(out CultMeshFrameRegionWriteLease lease)
+        {
+            lock (_gate)
+            {
+                ThrowIfDisposed();
+                if (_activeWriteReservation != null)
+                {
+                    _blockedWrites++;
+                    lease = default;
+                    return false;
+                }
+
+                for (var attempt = 0; attempt < SlotCount; attempt++)
+                {
+                    var slotIndex = (_writeCursor + attempt) % SlotCount;
+                    if (_readerCounts[slotIndex] != 0 || _writeReservations[slotIndex] != null)
+                        continue;
+
+                    if (_generations[slotIndex] != null)
+                        _droppedFrames++;
+
+                    var reservation = new object();
+                    _writeReservations[slotIndex] = reservation;
+                    _activeWriteReservation = reservation;
+                    _writeCursor = (slotIndex + 1) % SlotCount;
+                    lease = new CultMeshFrameRegionWriteLease(
+                        this,
+                        reservation,
+                        slotIndex,
+                        _nextSequence,
+                        new Memory<byte>(_storage, slotIndex * SlotByteLength, SlotByteLength));
+                    return true;
+                }
+
+                _blockedWrites++;
+                lease = default;
+                return false;
+            }
+        }
+
+        public CultMeshFrameGeneration Commit(
+            CultMeshFrameRegionWriteLease lease,
+            int byteLength,
+            long timestampNs,
+            long durationNs = 0,
+            int unavoidableCopyCount = 0,
+            IReadOnlyDictionary<string, string>? metadata = null) =>
+            lease.Commit(byteLength, timestampNs, durationNs, unavoidableCopyCount, metadata);
+
+        internal CultMeshFrameGeneration Commit(
+            CultMeshFrameRegionWriteLease lease,
+            object reservation,
+            int byteLength,
+            long timestampNs,
+            long durationNs,
+            int unavoidableCopyCount,
+            IReadOnlyDictionary<string, string>? metadata)
+        {
+            lock (_gate)
+            {
+                ThrowIfDisposed();
+                RequireSlot(lease.SlotIndex);
+                if (!ReferenceEquals(_activeWriteReservation, reservation) ||
+                    !ReferenceEquals(_writeReservations[lease.SlotIndex], reservation) ||
+                    lease.Sequence != _nextSequence)
+                    throw new InvalidOperationException("The frame-region write lease is stale or was already committed.");
+                if (byteLength < 0 || byteLength > SlotByteLength)
+                    throw new ArgumentOutOfRangeException(nameof(byteLength));
+
+                var descriptor = new CultMeshBodyDescriptor
+                {
+                    BodyId = BodyId,
+                    SchemaId = SchemaId,
+                    LayoutVersion = LayoutVersion,
+                    ByteSize = byteLength,
+                    Capacity = Capacity,
+                    ProducerEpoch = ProducerEpoch,
+                    Sequence = _nextSequence,
+                    AccessMode = CultMeshBodyAccessMode.ReadOnly,
+                    Synchronization = CultMeshBodySynchronization.TripleBuffer,
+                    LeaseExpiresAtUnixMs = long.MaxValue,
+                    TransportKind = CultMeshBodyTransportKind.SharedMemory,
+                    SemanticHash = CultMeshBodyDescriptorValidator.ComputeSemanticHash(
+                        lease.Span[..byteLength])
+                };
+                var generation = new CultMeshFrameGeneration(
+                    lease.SlotIndex, descriptor, timestampNs, durationNs, unavoidableCopyCount, metadata);
+
+                _generations[lease.SlotIndex] = generation;
+                _writeReservations[lease.SlotIndex] = null;
+                _activeWriteReservation = null;
+                _latestSlot = lease.SlotIndex;
+                _nextSequence++;
+                _publishedFrames++;
+                _unavoidableCopyCount += (ulong)Math.Max(0, unavoidableCopyCount);
+                return generation;
+            }
+        }
+
+        public bool TryAcquireLatestRead(
+            CultMeshBodyValidationRequest request,
+            out CultMeshFrameRegionReadLease lease)
+        {
+            if (request == null) throw new ArgumentNullException(nameof(request));
+            lock (_gate)
+            {
+                ThrowIfDisposed();
+                if (_latestSlot < 0 || _generations[_latestSlot] == null)
+                {
+                    lease = null!;
+                    return false;
+                }
+
+                var generation = _generations[_latestSlot]!;
+                CultMeshBodyDescriptorValidator.Validate(generation.Descriptor, request);
+                _readerCounts[_latestSlot]++;
+                lease = new CultMeshFrameRegionReadLease(
+                    this,
+                    generation,
+                    new ReadOnlyMemory<byte>(
+                        _storage,
+                        _latestSlot * SlotByteLength,
+                        checked((int)generation.Descriptor.ByteSize)));
+                return true;
+            }
+        }
+
+        public CultMeshFrameRegionStats Stats()
+        {
+            lock (_gate)
+            {
+                ThrowIfDisposed();
+                return new CultMeshFrameRegionStats(
+                    _publishedFrames,
+                    _droppedFrames,
+                    _blockedWrites,
+                    _latestSlot < 0 ? 0 : _generations[_latestSlot]!.Descriptor.Sequence,
+                    _unavoidableCopyCount);
+            }
+        }
+
+        internal void ReleaseRead(int slotIndex)
+        {
+            lock (_gate)
+            {
+                if (_disposed) return;
+                RequireSlot(slotIndex);
+                if (_readerCounts[slotIndex] <= 0)
+                    throw new InvalidOperationException("The frame-region reader lease was released more than once.");
+                _readerCounts[slotIndex]--;
+            }
+        }
+
+        public void Dispose()
+        {
+            lock (_gate)
+            {
+                if (_disposed) return;
+                _disposed = true;
+            }
+        }
+
+        private void ThrowIfDisposed()
+        {
+            if (_disposed) throw new ObjectDisposedException(nameof(CultMeshFrameRegion));
+        }
+
+        private static string Require(string value, string parameterName) =>
+            string.IsNullOrWhiteSpace(value) ? throw new ArgumentException("Value is required.", parameterName) : value;
+
+        private static void RequireSlot(int slotIndex)
+        {
+            if (slotIndex < 0 || slotIndex >= SlotCount) throw new ArgumentOutOfRangeException(nameof(slotIndex));
+        }
+    }
+}
diff --git a/src/GameCult.Mesh/CultMeshGameSession.cs b/src/GameCult.Mesh/CultMeshGameSession.cs
index d34c1860..f9d34f25 100644
--- a/src/GameCult.Mesh/CultMeshGameSession.cs
+++ b/src/GameCult.Mesh/CultMeshGameSession.cs
@@ -28,6 +28,12 @@ namespace GameCult.Mesh
         /// </summary>
         public CultMeshAuthorityLeaseCatalog? AuthorityLeases { get; set; }
 
+        /// <summary>
+        /// Gets or sets the sole authority resolver used by the session. When omitted, the
+        /// session installs a deny-by-default resolver over <see cref="AuthorityLeases"/>.
+        /// </summary>
+        public CultMeshAuthorityResolver? AuthorityResolver { get; set; }
+
         /// <summary>
         /// Gets or sets simulation consensus options.
         /// </summary>
@@ -68,6 +74,7 @@ namespace GameCult.Mesh
             VerseCatalog = options.VerseCatalog ?? new CultMeshVerseCatalog();
             PeerCatalog = options.PeerCatalog ?? new CultMeshPeerCatalog();
             AuthorityLeases = options.AuthorityLeases ?? new CultMeshAuthorityLeaseCatalog();
+            AuthorityResolver = options.AuthorityResolver ?? CultMeshAuthorityResolver.CreateDenyByDefault(AuthorityLeases);
             ObservationHub = new CultNetSimulationObservationHub(options.ConsensusOptions);
             FactCommitter = new CultMeshSimulationFactCommitter(Node.Database);
 
@@ -117,6 +124,9 @@ namespace GameCult.Mesh
         /// </summary>
         public CultMeshAuthorityLeaseCatalog AuthorityLeases { get; }
 
+        /// <summary>Gets the session authority decision owner.</summary>
+        public CultMeshAuthorityResolver AuthorityResolver { get; }
+
         /// <summary>
         /// Gets the session simulation observation hub.
         /// </summary>
diff --git a/src/GameCult.Mesh/CultMeshHttpsContentTransport.cs b/src/GameCult.Mesh/CultMeshHttpsContentTransport.cs
new file mode 100644
index 00000000..d6427470
--- /dev/null
+++ b/src/GameCult.Mesh/CultMeshHttpsContentTransport.cs
@@ -0,0 +1,124 @@
+using System;
+using System.IO;
+using System.Net.Http;
+using System.Threading;
+using System.Threading.Tasks;
+
+namespace GameCult.Mesh
+{
+    /// <summary>
+    /// Opens immutable content over an Odin-certified HTTPS route. Provider
+    /// identity comes from the verified route and TLS endpoint; the transfer
+    /// service remains responsible for checking the advertised chunk hash.
+    /// </summary>
+    public sealed class CultMeshHttpsContentTransportConnector : ICultMeshContentTransportConnector
+    {
+        private readonly Func<HttpMessageHandler> _createHandler;
+
+        public CultMeshHttpsContentTransportConnector(Func<HttpMessageHandler>? createHandler = null)
+        {
+            _createHandler = createHandler ?? (() => new HttpClientHandler());
+        }
+
+        public string ConnectorId => "https-content";
+        public int Priority => 0;
+
+        public bool CanConnect(CultMeshTransportCandidate candidate) =>
+            candidate != null &&
+            Uri.TryCreate(candidate.Endpoint, UriKind.Absolute, out var endpoint) &&
+            string.Equals(endpoint.Scheme, Uri.UriSchemeHttps, StringComparison.OrdinalIgnoreCase);
+
+        public Task<ICultMeshContentTransport> ConnectAsync(
+            CultMeshTransportCandidate candidate,
+            CultMeshSessionTarget target,
+            CancellationToken cancellationToken = default)
+        {
+            if (candidate == null) throw new ArgumentNullException(nameof(candidate));
+            if (target == null) throw new ArgumentNullException(nameof(target));
+            if (!CanConnect(candidate))
+                throw new NotSupportedException($"HTTPS content connector does not support '{candidate.Endpoint}'.");
+            cancellationToken.ThrowIfCancellationRequested();
+            return Task.FromResult<ICultMeshContentTransport>(new CultMeshHttpsContentTransport(
+                candidate.Endpoint,
+                new HttpClient(_createHandler(), disposeHandler: true),
+                target,
+                candidate.Generation));
+        }
+    }
+
+    internal sealed class CultMeshHttpsContentTransport : ICultMeshContentTransport, ICultMeshVerifiedTransport
+    {
+        private readonly HttpClient _client;
+        private readonly CultMeshSessionTarget _target;
+        private readonly string _routeGeneration;
+        private bool _disposed;
+
+        public CultMeshHttpsContentTransport(
+            string endpoint,
+            HttpClient client,
+            CultMeshSessionTarget target,
+            string routeGeneration)
+        {
+            Endpoint = endpoint ?? throw new ArgumentNullException(nameof(endpoint));
+            _client = client ?? throw new ArgumentNullException(nameof(client));
+            _target = target ?? throw new ArgumentNullException(nameof(target));
+            _routeGeneration = routeGeneration ?? string.Empty;
+        }
+
+        public string TransportId => "https-content";
+        public string Endpoint { get; }
+
+        public bool IsVerifiedFor(
+            string verseId,
+            string authorityRuntimeId,
+            string protocolId,
+            string routeGeneration) =>
+            string.Equals(_target.VerseId, verseId, StringComparison.Ordinal) &&
+            string.Equals(_target.AuthorityRuntimeId, authorityRuntimeId, StringComparison.Ordinal) &&
+            string.Equals(CultMeshProtocols.Content.Value, protocolId, StringComparison.Ordinal) &&
+            string.Equals(_routeGeneration, routeGeneration, StringComparison.Ordinal);
+
+        public async Task CopyChunkToAsync(
+            CultMeshCdnChunkRef chunk,
+            Stream destination,
+            CancellationToken cancellationToken = default)
+        {
+            if (_disposed) throw new ObjectDisposedException(nameof(CultMeshHttpsContentTransport));
+            if (chunk == null) throw new ArgumentNullException(nameof(chunk));
+            if (destination == null) throw new ArgumentNullException(nameof(destination));
+            if (!destination.CanWrite) throw new ArgumentException("Content destination must be writable.", nameof(destination));
+
+            var requestUri = BuildChunkUri(Endpoint, chunk);
+            using var response = await _client.GetAsync(
+                requestUri,
+                HttpCompletionOption.ResponseHeadersRead,
+                cancellationToken).ConfigureAwait(false);
+            response.EnsureSuccessStatusCode();
+            if (response.Content.Headers.ContentLength is long contentLength &&
+                contentLength != chunk.SizeBytes)
+            {
+                throw new InvalidDataException(
+                    $"HTTPS content length {contentLength} did not match advertised chunk size {chunk.SizeBytes}.");
+            }
+            using var source = await response.Content.ReadAsStreamAsync().ConfigureAwait(false);
+            await source.CopyToAsync(destination, 81920, cancellationToken).ConfigureAwait(false);
+        }
+
+        public void Dispose()
+        {
+            if (_disposed) return;
+            _disposed = true;
+            _client.Dispose();
+        }
+
+        private static Uri BuildChunkUri(string endpoint, CultMeshCdnChunkRef chunk)
+        {
+            var builder = new UriBuilder(endpoint);
+            var separator = string.IsNullOrWhiteSpace(builder.Query) ? string.Empty : builder.Query.TrimStart('?') + "&";
+            builder.Query = separator +
+                "chunkHash=" + Uri.EscapeDataString(CultMeshCdn.NormalizeHash(chunk.ChunkHash, nameof(chunk.ChunkHash))) +
+                "&recordKey=" + Uri.EscapeDataString(chunk.RecordKey ?? string.Empty);
+            return builder.Uri;
+        }
+    }
+}
diff --git a/src/GameCult.Mesh/CultMeshOperationInvocationRecordFormatter.cs b/src/GameCult.Mesh/CultMeshOperationInvocationRecordFormatter.cs
new file mode 100644
index 00000000..f0426a7c
--- /dev/null
+++ b/src/GameCult.Mesh/CultMeshOperationInvocationRecordFormatter.cs
@@ -0,0 +1,79 @@
+using System;
+using MessagePack;
+using MessagePack.Formatters;
+
+#nullable enable
+
+namespace GameCult.Mesh
+{
+    /// <summary>
+    /// Reads the current structured invocation record and the legacy operation-id string.
+    /// </summary>
+    public sealed class CultMeshOperationInvocationRecordFormatter :
+        IMessagePackFormatter<CultMeshOperationInvocationRecord?>
+    {
+        private const int FieldCount = 5;
+
+        /// <inheritdoc />
+        public void Serialize(
+            ref MessagePackWriter writer,
+            CultMeshOperationInvocationRecord? value,
+            MessagePackSerializerOptions options)
+        {
+            if (value == null)
+            {
+                writer.WriteNil();
+                return;
+            }
+
+            writer.WriteArrayHeader(FieldCount);
+            writer.Write(value.OperationId);
+            writer.Write(value.SchemaId);
+            writer.Write(value.RouteKind);
+            writer.Write(value.RouteDescription);
+            writer.Write(value.IdempotencyKey);
+        }
+
+        /// <inheritdoc />
+        public CultMeshOperationInvocationRecord? Deserialize(
+            ref MessagePackReader reader,
+            MessagePackSerializerOptions options)
+        {
+            if (reader.TryReadNil())
+                return new CultMeshOperationInvocationRecord();
+
+            if (reader.NextMessagePackType == MessagePackType.String)
+                return new CultMeshOperationInvocationRecord(reader.ReadString());
+
+            if (reader.NextMessagePackType != MessagePackType.Array)
+                throw new MessagePackSerializationException(
+                    $"CultMesh operation invocation must be a string or array, not {reader.NextMessagePackType}.");
+
+            options.Security.DepthStep(ref reader);
+            try
+            {
+                var fields = reader.ReadArrayHeader();
+                var operationId = ReadString(ref reader, fields, 0);
+                var schemaId = ReadString(ref reader, fields, 1);
+                var routeKind = ReadString(ref reader, fields, 2);
+                var routeDescription = ReadString(ref reader, fields, 3);
+                var idempotencyKey = ReadString(ref reader, fields, 4);
+                for (var index = FieldCount; index < fields; index++)
+                    reader.Skip();
+                return new CultMeshOperationInvocationRecord(
+                    operationId,
+                    schemaId,
+                    routeKind,
+                    routeDescription,
+                    idempotencyKey);
+            }
+            finally
+            {
+                reader.Depth--;
+            }
+        }
+
+        private static string ReadString(ref MessagePackReader reader, int fields, int index) =>
+            index < fields ? reader.ReadString() ?? "" : "";
+    }
+}
diff --git a/src/GameCult.Mesh/CultMeshPeerExchange.cs b/src/GameCult.Mesh/CultMeshPeerExchange.cs
index 67e294fd..c3045c0d 100644
--- a/src/GameCult.Mesh/CultMeshPeerExchange.cs
+++ b/src/GameCult.Mesh/CultMeshPeerExchange.cs
@@ -1,6 +1,7 @@
 using System;
 using System.Collections.Generic;
 using System.Linq;
+using System.Threading;
 using System.Threading.Tasks;
 using GameCult.Networking;
 using R3;
@@ -191,23 +192,40 @@ namespace GameCult.Mesh
         }
 
         /// <summary>Finds peers that advertise a Verse role and are authorized by the supplied lease catalog.</summary>
+        [Obsolete("Supply CultMeshAuthorityResolver and an explicit authority epoch. This compatibility path denies unverifiable leases.")]
         public IReadOnlyList<CultMeshPeerCard> FindAuthorized(
             string verseId,
             string role,
             CultMeshAuthorityLeaseCatalog leases,
             string? shardId = null,
             DateTimeOffset? at = null)
+        {
+            if (leases == null) throw new ArgumentNullException(nameof(leases));
+            var resolver = CultMeshAuthorityResolver.CreateDenyByDefault(leases,
+                at.HasValue ? new PeerCatalogFixedClock(at.Value) : null);
+            return FindAuthorized(verseId, role, resolver, 0, shardId);
+        }
+
+        /// <summary>Finds contact candidates accepted by the authority resolver.</summary>
+        public IReadOnlyList<CultMeshPeerCard> FindAuthorized(
+            string verseId,
+            string role,
+            CultMeshAuthorityResolver resolver,
+            long authorityEpoch,
+            string? shardId = null,
+            string? resourceScope = null)
         {
             ThrowIfDisposed();
             if (string.IsNullOrWhiteSpace(verseId)) throw new ArgumentException("Value must be non-empty.", nameof(verseId));
             if (string.IsNullOrWhiteSpace(role)) throw new ArgumentException("Value must be non-empty.", nameof(role));
-            if (leases == null) throw new ArgumentNullException(nameof(leases));
+            if (resolver == null) throw new ArgumentNullException(nameof(resolver));
             return Find(verseId, role)
-                .Where(peer => leases.IsAuthorized(peer, role, shardId, at))
+                .Where(peer => resolver.Resolve(new CultMeshAuthorityRequest(peer, role, shardId, authorityEpoch, resourceScope)).IsAuthorized)
                 .ToArray();
         }
 
         /// <summary>Returns the first peer that advertises a Verse role and is authorized by the supplied lease catalog.</summary>
+        [Obsolete("Supply CultMeshAuthorityResolver and an explicit authority epoch. This compatibility path denies unverifiable leases.")]
         public CultMeshPeerCard? FirstAuthorized(
             string verseId,
             string role,
@@ -218,6 +236,18 @@ namespace GameCult.Mesh
             return FindAuthorized(verseId, role, leases, shardId, at).FirstOrDefault();
         }
 
+        /// <summary>Returns the first contact candidate accepted by the authority resolver.</summary>
+        public CultMeshPeerCard? FirstAuthorized(
+            string verseId,
+            string role,
+            CultMeshAuthorityResolver resolver,
+            long authorityEpoch,
+            string? shardId = null,
+            string? resourceScope = null)
+        {
+            return FindAuthorized(verseId, role, resolver, authorityEpoch, shardId, resourceScope).FirstOrDefault();
+        }
+
         /// <inheritdoc />
         public void Dispose()
         {
@@ -238,6 +268,13 @@ namespace GameCult.Mesh
                 throw new ObjectDisposedException(nameof(CultMeshPeerCatalog));
             }
         }
+
+        private sealed class PeerCatalogFixedClock : ICultMeshClock
+        {
+            public PeerCatalogFixedClock(DateTimeOffset utcNow) => UtcNow = utcNow;
+            public DateTimeOffset UtcNow { get; }
+            public Task DelayAsync(TimeSpan delay, CancellationToken cancellationToken = default) => Task.CompletedTask;
+        }
     }
 
     /// <summary>
@@ -343,6 +380,12 @@ namespace GameCult.Mesh
         /// Defaults to endpoint selection: rudp:// uses RUDP and cultnet:// uses LiteNetLib.
         /// </summary>
         public Func<ICultNetSchemaClient>? CreateClient { get; set; }
+
+        /// <summary>Gets or sets the shared CultMesh session owner.</summary>
+        public CultMeshSessionManager? Sessions { get; set; }
+
+        /// <summary>Gets or sets the clock used by managed response deadlines.</summary>
+        public ICultMeshClock Clock { get; set; } = CultMeshSystemClock.Instance;
     }
 
     /// <summary>
@@ -401,6 +444,38 @@ namespace GameCult.Mesh
             return await WaitForResponseAsync(completion.Task, endpoint).ConfigureAwait(false);
         }
 
+        /// <summary>Fetches peer cards through the shared session owner.</summary>
+        public async Task<CultMeshPeerExchangeResponseMessage> FetchAsync(
+            CultMeshSessionTarget target,
+            CultMeshPeerExchangeRequestMessage request,
+            CancellationToken cancellationToken = default)
+        {
+            if (target == null) throw new ArgumentNullException(nameof(target));
+            if (request == null) throw new ArgumentNullException(nameof(request));
+            if (string.IsNullOrWhiteSpace(request.VerseId)) throw new ArgumentException("Peer exchange requires a verseId.", nameof(request));
+            if (!string.Equals(request.VerseId, target.VerseId, StringComparison.Ordinal))
+                throw new ArgumentException("Peer exchange request Verse must match its session target.", nameof(request));
+            var sessions = _options.Sessions ?? throw new InvalidOperationException("Managed peer exchange requires a CultMeshSessionManager.");
+            var session = await sessions.ConnectAsync(target, CultMeshProtocols.PeerExchange, cancellationToken).ConfigureAwait(false);
+            var messageId = Guid.NewGuid().ToString("N");
+            var completion = new TaskCompletionSource<CultMeshPeerExchangeResponseMessage>(TaskCreationOptions.RunContinuationsAsynchronously);
+            using var responseSubscription = session.OnCultNet<CultMeshPeerExchangeResponseMessage>(response =>
+            {
+                if (string.Equals(response.MessageId, messageId, StringComparison.Ordinal)) completion.TrySetResult(response);
+            });
+            using var errorSubscription = session.OnCultNet<CultNetErrorMessage>(error =>
+                completion.TrySetException(new InvalidOperationException(error.Error)));
+            session.SendCultNet(new CultMeshPeerExchangeRequestMessage
+            {
+                MessageId = messageId,
+                VerseId = request.VerseId,
+                Roles = request.Roles,
+                KnownPeerIds = request.KnownPeerIds,
+                Limit = request.Limit
+            });
+            return await WaitForManagedResponseAsync(completion.Task, target, cancellationToken).ConfigureAwait(false);
+        }
+
         /// <summary>
         /// Fetches peer cards from endpoints and upserts every response into a local peer catalog.
         /// </summary>
@@ -465,5 +540,20 @@ namespace GameCult.Mesh
 
             return await responseTask.ConfigureAwait(false);
         }
+
+        private async Task<CultMeshPeerExchangeResponseMessage> WaitForManagedResponseAsync(
+            Task<CultMeshPeerExchangeResponseMessage> responseTask,
+            CultMeshSessionTarget target,
+            CancellationToken cancellationToken)
+        {
+            var timeout = _options.Clock.DelayAsync(_options.ResponseTimeout, cancellationToken);
+            var completed = await Task.WhenAny(responseTask, timeout).ConfigureAwait(false);
+            if (completed != responseTask)
+            {
+                cancellationToken.ThrowIfCancellationRequested();
+                throw new TimeoutException($"Timed out waiting for peer exchange response from {target}.");
+            }
+            return await responseTask.ConfigureAwait(false);
+        }
     }
 }
diff --git a/src/GameCult.Mesh/CultMeshPrimitives.cs b/src/GameCult.Mesh/CultMeshPrimitives.cs
new file mode 100644
index 00000000..58723950
--- /dev/null
+++ b/src/GameCult.Mesh/CultMeshPrimitives.cs
@@ -0,0 +1,4225 @@
+using System;
+using System.Collections;
+using System.Collections.Generic;
+using System.Globalization;
+using System.Linq;
+using System.Linq.Expressions;
+using System.Reflection;
+using System.Threading;
+using System.Threading.Tasks;
+using GameCult.Caching;
+using GameCult.Caching.MessagePack;
+using MessagePack;
+using R3;
+
+namespace GameCult.Mesh
+{
+    /// <summary>
+    /// Describes the route CultMesh used or should prefer for a typed operation, query, pointer, or native view.
+    /// </summary>
+    public enum CultMeshLocalityKind
+    {
+        /// <summary>Let CultMesh choose the fastest valid route.</summary>
+        Automatic,
+        /// <summary>The target is in the same process.</summary>
+        InProcess,
+        /// <summary>The target is available through a shared CultCache slab or native shared memory view.</summary>
+        SharedMemory,
+        /// <summary>The target is reachable through local inter-process transport.</summary>
+        Ipc,
+        /// <summary>The target is reachable through a network Verse route.</summary>
+        Network,
+        /// <summary>The target is hosted in or exposed to a WebAssembly runtime.</summary>
+        Wasm
+    }
+
+    /// <summary>
+    /// Names a CultMesh locality decision without exposing transport plumbing to application code.
+    /// </summary>
+    public sealed class CultMeshRouteHint
+    {
+        /// <summary>Creates a route hint.</summary>
+        public CultMeshRouteHint(CultMeshLocalityKind kind = CultMeshLocalityKind.Automatic, string? description = null)
+        {
+            Kind = kind;
+            Description = description;
+        }
+
+        /// <summary>Gets the requested or observed locality kind.</summary>
+        public CultMeshLocalityKind Kind { get; }
+
+        /// <summary>Gets optional human-facing route diagnostics.</summary>
+        public string? Description { get; }
+
+        /// <summary>Gets the default automatic route hint.</summary>
+        public static CultMeshRouteHint Automatic { get; } = new();
+    }
+
+    /// <summary>
+    /// Flat, transport-friendly fields for a CultMesh route hint.
+    /// </summary>
+    [MessagePackObject]
+    [MessagePackFormatter(typeof(CultMeshRouteRecordFormatter))]
+    public sealed class CultMeshRouteRecord
+    {
+        /// <summary>Creates flat route fields.</summary>
+        [SerializationConstructor]
+        public CultMeshRouteRecord(string? kind = null, string? description = null)
+        {
+            Kind = kind ?? "";
+            Description = description ?? "";
+        }
+
+        /// <summary>Gets the serialized route locality kind.</summary>
+        [Key(0)] public string Kind { get; }
+
+        /// <summary>Gets the serialized route description.</summary>
+        [Key(1)] public string Description { get; }
+
+        /// <summary>Creates flat route fields from a route hint.</summary>
+        public static CultMeshRouteRecord FromRoute(CultMeshRouteHint? routeHint)
+        {
+            var route = routeHint ?? CultMeshRouteHint.Automatic;
+            return new CultMeshRouteRecord(route.Kind.ToString(), route.Description);
+        }
+
+        /// <summary>Rehydrates flat route fields into a route hint.</summary>
+        public CultMeshRouteHint ToRoute(CultMeshRouteHint? fallback = null)
+        {
+            var fallbackRoute = fallback ?? CultMeshRouteHint.Automatic;
+            return new CultMeshRouteHint(
+                ParseKind(Kind, fallbackRoute.Kind),
+                string.IsNullOrWhiteSpace(Description) ? fallbackRoute.Description : Description);
+        }
+
+        private static CultMeshLocalityKind ParseKind(string? value, CultMeshLocalityKind fallback)
+        {
+            if (string.IsNullOrWhiteSpace(value))
+                return fallback;
+
+            if (Enum.TryParse<CultMeshLocalityKind>(value, ignoreCase: true, out var parsed))
+                return parsed;
+
+            var normalized = value.Replace("-", "", StringComparison.Ordinal);
+            foreach (CultMeshLocalityKind candidate in Enum.GetValues(typeof(CultMeshLocalityKind)))
+            {
+                if (string.Equals(candidate.ToString(), normalized, StringComparison.OrdinalIgnoreCase))
+                    return candidate;
+            }
+
+            return fallback;
+        }
+    }
+
+    /// <summary>
+    /// Shared Verse invocation context used by generated domain sugar.
+    /// </summary>
+    public sealed class CultMeshVerseContext
+    {
+        /// <summary>Creates a Verse context.</summary>
+        public CultMeshVerseContext(
+            string verseId,
+            string runtimeId,
+            CultMeshRouteHint? routeHint = null,
+            IEnumerable<CultMeshAuthorityClaim>? claims = null)
+        {
+            VerseId = RequireNonEmpty(verseId, nameof(verseId));
+            RuntimeId = RequireNonEmpty(runtimeId, nameof(runtimeId));
+            RouteHint = routeHint ?? CultMeshRouteHint.Automatic;
+            Claims = claims?.ToArray() ?? Array.Empty<CultMeshAuthorityClaim>();
+        }
+
+        /// <summary>Gets the semantic Verse id.</summary>
+        public string VerseId { get; }
+
+        /// <summary>Gets the runtime using the Verse.</summary>
+        public string RuntimeId { get; }
+
+        /// <summary>Gets the preferred route for generated operations and queries.</summary>
+        public CultMeshRouteHint RouteHint { get; }
+
+        /// <summary>Gets authority claims carried by generated operations.</summary>
+        public IReadOnlyList<CultMeshAuthorityClaim> Claims { get; }
+
+        /// <summary>Returns a copy with one additional authority claim.</summary>
+        public CultMeshVerseContext WithClaim(CultMeshAuthorityClaim claim)
+        {
+            if (claim == null) throw new ArgumentNullException(nameof(claim));
+            return new CultMeshVerseContext(VerseId, RuntimeId, RouteHint, Claims.Concat(new[] { claim }));
+        }
+
+        /// <summary>Returns a copy with the supplied route hint.</summary>
+        public CultMeshVerseContext WithRoute(CultMeshRouteHint routeHint)
+        {
+            if (routeHint == null) throw new ArgumentNullException(nameof(routeHint));
+            return new CultMeshVerseContext(VerseId, RuntimeId, routeHint, Claims);
+        }
+
+        /// <summary>Creates a typed operation context from the Verse context.</summary>
+        public CultMeshOperationContext OperationContext(string? idempotencyKey = null)
+        {
+            return new CultMeshOperationContext(RuntimeId, Claims, RouteHint, idempotencyKey);
+        }
+
+        /// <summary>Creates a typed query context from the Verse context.</summary>
+        public CultMeshQueryContext QueryContext()
+        {
+            return new CultMeshQueryContext(RuntimeId, RouteHint);
+        }
+
+        private static string RequireNonEmpty(string value, string paramName)
+        {
+            return string.IsNullOrWhiteSpace(value)
+                ? throw new ArgumentException("Value must be non-empty.", paramName)
+                : value;
+        }
+    }
+
+    /// <summary>
+    /// Managed Verse handle that generated domain packages can bind to.
+    /// </summary>
+    public sealed class CultMeshVerse
+    {
+        /// <summary>Creates a managed Verse handle.</summary>
+        public CultMeshVerse(CultMeshVerseContext context)
+        {
+            Context = context ?? throw new ArgumentNullException(nameof(context));
+        }
+
+        /// <summary>Gets the Verse context shared by generated domain sugar.</summary>
+        public CultMeshVerseContext Context { get; }
+
+        /// <summary>Gets the semantic Verse id.</summary>
+        public string VerseId => Context.VerseId;
+
+        /// <summary>Gets the runtime using the Verse.</summary>
+        public string RuntimeId => Context.RuntimeId;
+
+        /// <summary>Binds this Verse to a generated domain facade.</summary>
+        public TSchema Use<TSchema>(Func<CultMeshVerseContext, TSchema> schemaFactory)
+        {
+            if (schemaFactory == null) throw new ArgumentNullException(nameof(schemaFactory));
+            return schemaFactory(Context);
+        }
+
+        /// <summary>Returns a Verse handle with one additional authority claim.</summary>
+        public CultMeshVerse WithClaim(CultMeshAuthorityClaim claim)
+        {
+            return new CultMeshVerse(Context.WithClaim(claim));
+        }
+
+        /// <summary>Returns a Verse handle with the supplied route hint.</summary>
+        public CultMeshVerse WithRoute(CultMeshRouteHint routeHint)
+        {
+            return new CultMeshVerse(Context.WithRoute(routeHint));
+        }
+
+        /// <summary>Creates a typed operation context from this Verse.</summary>
+        public CultMeshOperationContext OperationContext(string? idempotencyKey = null)
+        {
+            return Context.OperationContext(idempotencyKey);
+        }
+
+        /// <summary>Creates a typed query context from this Verse.</summary>
+        public CultMeshQueryContext QueryContext()
+        {
+            return Context.QueryContext();
+        }
+
+        /// <summary>Binds an operation handle to this Verse.</summary>
+        public CultMeshBoundOperationHandle<TRequest, TResponse> BindOperation<TRequest, TResponse>(
+            CultMeshOperationHandle<TRequest, TResponse> operation)
+        {
+            return new CultMeshBoundOperationHandle<TRequest, TResponse>(Context, operation);
+        }
+
+        /// <summary>Binds a query surface to this Verse.</summary>
+        public CultMeshBoundQuerySurface<TParameters, TResult> BindQuery<TParameters, TResult>(
+            CultMeshQuerySurface<TParameters, TResult> query)
+        {
+            return new CultMeshBoundQuerySurface<TParameters, TResult>(Context, query);
+        }
+
+        /// <summary>Binds a live feed to this Verse.</summary>
+        public CultMeshBoundLiveFeed<TParameters, TResult> BindLiveFeed<TParameters, TResult>(
+            CultMeshLiveFeed<TParameters, TResult> feed)
+        {
+            return new CultMeshBoundLiveFeed<TParameters, TResult>(Context, feed);
+        }
+
+        /// <summary>Binds a state pointer to this Verse.</summary>
+        public CultMeshBoundStatePointer<TValue> BindStatePointer<TValue>(
+            CultMeshStatePointer<TValue> pointer)
+        {
+            return new CultMeshBoundStatePointer<TValue>(Context, pointer);
+        }
+
+        /// <summary>Binds a mutable state pointer to this Verse.</summary>
+        public CultMeshBoundMutableStatePointer<TValue> BindMutableStatePointer<TValue>(
+            CultMeshMutableStatePointer<TValue> pointer)
+        {
+            return new CultMeshBoundMutableStatePointer<TValue>(Context, pointer);
+        }
+    }
+
+    /// <summary>
+    /// Describes a runtime authority claim attached to a typed operation.
+    /// </summary>
+    public sealed class CultMeshAuthorityClaim
+    {
+        /// <summary>Creates an authority claim.</summary>
+        public CultMeshAuthorityClaim(string role, string? shardId = null, string? leaseId = null)
+        {
+            Role = RequireNonEmpty(role, nameof(role));
+            ShardId = shardId;
+            LeaseId = leaseId;
+        }
+
+        /// <summary>Gets the role or claim kind being asserted.</summary>
+        public string Role { get; }
+
+        /// <summary>Gets the optional shard covered by the claim.</summary>
+        public string? ShardId { get; }
+
+        /// <summary>Gets the optional lease id backing the claim.</summary>
+        public string? LeaseId { get; }
+
+        private static string RequireNonEmpty(string value, string paramName)
+        {
+            return string.IsNullOrWhiteSpace(value)
+                ? throw new ArgumentException("Value must be non-empty.", paramName)
+                : value;
+        }
+    }
+
+    /// <summary>
+    /// Context supplied when invoking a typed CultMesh operation.
+    /// </summary>
+    public sealed class CultMeshOperationContext
+    {
+        /// <summary>Creates an operation context.</summary>
+        public CultMeshOperationContext(
+            string runtimeId,
+            IEnumerable<CultMeshAuthorityClaim>? claims = null,
+            CultMeshRouteHint? routeHint = null,
+            string? idempotencyKey = null)
+        {
+            RuntimeId = RequireNonEmpty(runtimeId, nameof(runtimeId));
+            Claims = claims?.ToArray() ?? Array.Empty<CultMeshAuthorityClaim>();
+            RouteHint = routeHint ?? CultMeshRouteHint.Automatic;
+            IdempotencyKey = idempotencyKey;
+        }
+
+        /// <summary>Gets the runtime invoking the operation.</summary>
+        public string RuntimeId { get; }
+
+        /// <summary>Gets authority claims attached to the operation.</summary>
+        public IReadOnlyList<CultMeshAuthorityClaim> Claims { get; }
+
+        /// <summary>Gets the preferred route for the operation.</summary>
+        public CultMeshRouteHint RouteHint { get; }
+
+        /// <summary>Gets an optional operation idempotency key.</summary>
+        public string? IdempotencyKey { get; }
+
+        /// <summary>Creates an operation context for a runtime.</summary>
+        public static CultMeshOperationContext ForRuntime(string runtimeId)
+        {
+            return new CultMeshOperationContext(runtimeId);
+        }
+
+        /// <summary>Returns a copy with one additional authority claim.</summary>
+        public CultMeshOperationContext WithClaim(CultMeshAuthorityClaim claim)
+        {
+            if (claim == null) throw new ArgumentNullException(nameof(claim));
+            return new CultMeshOperationContext(RuntimeId, Claims.Concat(new[] { claim }), RouteHint, IdempotencyKey);
+        }
+
+        /// <summary>Returns a copy with the supplied route hint.</summary>
+        public CultMeshOperationContext WithRoute(CultMeshRouteHint routeHint)
+        {
+            if (routeHint == null) throw new ArgumentNullException(nameof(routeHint));
+            return new CultMeshOperationContext(RuntimeId, Claims, routeHint, IdempotencyKey);
+        }
+
+        /// <summary>Returns a copy with the supplied idempotency key.</summary>
+        public CultMeshOperationContext WithIdempotencyKey(string idempotencyKey)
+        {
+            return new CultMeshOperationContext(
+                RuntimeId,
+                Claims,
+                RouteHint,
+                RequireNonEmpty(idempotencyKey, nameof(idempotencyKey)));
+        }
+
+        private static string RequireNonEmpty(string value, string paramName)
+        {
+            return string.IsNullOrWhiteSpace(value)
+                ? throw new ArgumentException("Value must be non-empty.", paramName)
+                : value;
+        }
+    }
+
+    /// <summary>
+    /// Receipt returned by a typed CultMesh operation.
+    /// </summary>
+    public sealed class CultMeshOperationReceipt
+    {
+        /// <summary>Creates an operation receipt.</summary>
+        public CultMeshOperationReceipt(
+            string operationId,
+            bool accepted,
+            CultMeshRouteHint? route = null,
+            string? diagnostic = null)
+        {
+            OperationId = RequireNonEmpty(operationId, nameof(operationId));
+            Accepted = accepted;
+            Route = route ?? CultMeshRouteHint.Automatic;
+            Diagnostic = diagnostic;
+        }
+
+        /// <summary>Gets the semantic operation id.</summary>
+        public string OperationId { get; }
+
+        /// <summary>Gets whether the operation was accepted by the target authority boundary.</summary>
+        public bool Accepted { get; }
+
+        /// <summary>Gets the route used for the operation.</summary>
+        public CultMeshRouteHint Route { get; }
+
+        /// <summary>Gets optional operation diagnostics.</summary>
+        public string? Diagnostic { get; }
+
+        private static string RequireNonEmpty(string value, string paramName)
+        {
+            return string.IsNullOrWhiteSpace(value)
+                ? throw new ArgumentException("Value must be non-empty.", paramName)
+                : value;
+        }
+    }
+
+    /// <summary>
+    /// Method-shaped handle for a typed CultMesh operation.
+    /// </summary>
+    public sealed class CultMeshOperationHandle<TRequest, TResponse>
+    {
+        private readonly Func<TRequest, CultMeshOperationContext, Task<TResponse>> _invoke;
+
+        /// <summary>Creates an operation handle.</summary>
+        public CultMeshOperationHandle(
+            string operationId,
+            Func<TRequest, CultMeshOperationContext, Task<TResponse>> invoke)
+        {
+            OperationId = RequireNonEmpty(operationId, nameof(operationId));
+            _invoke = invoke ?? throw new ArgumentNullException(nameof(invoke));
+        }
+
+        /// <summary>Gets the semantic operation id.</summary>
+        public string OperationId { get; }
+
+        /// <summary>Invokes the typed operation.</summary>
+        public Task<TResponse> InvokeAsync(TRequest request, CultMeshOperationContext context)
+        {
+            if (context == null) throw new ArgumentNullException(nameof(context));
+            return _invoke(request, context);
+        }
+
+        /// <summary>Invokes the typed operation for one runtime using default context.</summary>
+        public Task<TResponse> InvokeAsync(TRequest request, string runtimeId)
+        {
+            return InvokeAsync(request, CultMeshOperationContext.ForRuntime(runtimeId));
+        }
+
+        /// <summary>Binds this operation to a Verse context.</summary>
+        public CultMeshBoundOperationHandle<TRequest, TResponse> Bind(CultMeshVerseContext context)
+        {
+            return new CultMeshBoundOperationHandle<TRequest, TResponse>(context, this);
+        }
+
+        /// <summary>Binds this operation to a Verse.</summary>
+        public CultMeshBoundOperationHandle<TRequest, TResponse> Bind(CultMeshVerse verse)
+        {
+            if (verse == null) throw new ArgumentNullException(nameof(verse));
+            return Bind(verse.Context);
+        }
+
+        private static string RequireNonEmpty(string value, string paramName)
+        {
+            return string.IsNullOrWhiteSpace(value)
+                ? throw new ArgumentException("Value must be non-empty.", paramName)
+                : value;
+        }
+    }
+
+    /// <summary>
+    /// Operation handle pre-bound to a Verse so generated domain sugar can invoke without context plumbing.
+    /// </summary>
+    public sealed class CultMeshBoundOperationHandle<TRequest, TResponse>
+    {
+        /// <summary>Creates a Verse-bound operation handle.</summary>
+        public CultMeshBoundOperationHandle(
+            CultMeshVerseContext context,
+            CultMeshOperationHandle<TRequest, TResponse> operation)
+        {
+            Context = context ?? throw new ArgumentNullException(nameof(context));
+            Operation = operation ?? throw new ArgumentNullException(nameof(operation));
+        }
+
+        /// <summary>Gets the bound Verse context.</summary>
+        public CultMeshVerseContext Context { get; }
+
+        /// <summary>Gets the underlying operation handle.</summary>
+        public CultMeshOperationHandle<TRequest, TResponse> Operation { get; }
+
+        /// <summary>Gets the semantic operation id.</summary>
+        public string OperationId => Operation.OperationId;
+
+        /// <summary>Invokes the operation through the bound Verse.</summary>
+        public Task<TResponse> InvokeAsync(TRequest request, string? idempotencyKey = null)
+        {
+            return Operation.InvokeAsync(request, Context.OperationContext(idempotencyKey));
+        }
+    }
+
+    /// <summary>
+    /// Context supplied when executing a typed CultMesh query surface.
+    /// </summary>
+    public sealed class CultMeshQueryContext
+    {
+        /// <summary>Creates a query context.</summary>
+        public CultMeshQueryContext(string runtimeId, CultMeshRouteHint? routeHint = null)
+        {
+            RuntimeId = RequireNonEmpty(runtimeId, nameof(runtimeId));
+            RouteHint = routeHint ?? CultMeshRouteHint.Automatic;
+        }
+
+        /// <summary>Gets the runtime executing the query.</summary>
+        public string RuntimeId { get; }
+
+        /// <summary>Gets the preferred route for the query.</summary>
+        public CultMeshRouteHint RouteHint { get; }
+
+        /// <summary>Creates a query context for a runtime.</summary>
+        public static CultMeshQueryContext ForRuntime(string runtimeId)
+        {
+            return new CultMeshQueryContext(runtimeId);
+        }
+
+        /// <summary>Returns a copy with the supplied route hint.</summary>
+        public CultMeshQueryContext WithRoute(CultMeshRouteHint routeHint)
+        {
+            if (routeHint == null) throw new ArgumentNullException(nameof(routeHint));
+            return new CultMeshQueryContext(RuntimeId, routeHint);
+        }
+
+        private static string RequireNonEmpty(string value, string paramName)
+        {
+            return string.IsNullOrWhiteSpace(value)
+                ? throw new ArgumentException("Value must be non-empty.", paramName)
+                : value;
+        }
+    }
+
+    /// <summary>
+    /// Fluent builder for typed operation context. This is sugar over <see cref="CultMeshOperationContext"/>,
+    /// intended for call sites that should read like native Verse operations instead of transport setup.
+    /// </summary>
+    public sealed class CultMeshOperationContextBuilder
+    {
+        private readonly string _runtimeId;
+        private readonly List<CultMeshAuthorityClaim> _claims = new();
+        private CultMeshRouteHint _routeHint = CultMeshRouteHint.Automatic;
+        private string? _idempotencyKey;
+
+        /// <summary>Creates a builder for one runtime.</summary>
+        public CultMeshOperationContextBuilder(string runtimeId)
+        {
+            _runtimeId = RequireNonEmpty(runtimeId, nameof(runtimeId));
+        }
+
+        /// <summary>Adds an authority claim.</summary>
+        public CultMeshOperationContextBuilder Claim(string role, string? shardId = null, string? leaseId = null)
+        {
+            _claims.Add(new CultMeshAuthorityClaim(role, shardId, leaseId));
+            return this;
+        }
+
+        /// <summary>Adds an authority claim.</summary>
+        public CultMeshOperationContextBuilder Claim(CultMeshAuthorityClaim claim)
+        {
+            _claims.Add(claim ?? throw new ArgumentNullException(nameof(claim)));
+            return this;
+        }
+
+        /// <summary>Adds many authority claims.</summary>
+        public CultMeshOperationContextBuilder Claims(IEnumerable<CultMeshAuthorityClaim> claims)
+        {
+            if (claims == null) throw new ArgumentNullException(nameof(claims));
+            _claims.AddRange(claims);
+            return this;
+        }
+
+        /// <summary>Sets the preferred route hint.</summary>
+        public CultMeshOperationContextBuilder Route(CultMeshLocalityKind kind, string? description = null)
+        {
+            _routeHint = new CultMeshRouteHint(kind, description);
+            return this;
+        }
+
+        /// <summary>Sets the operation idempotency key.</summary>
+        public CultMeshOperationContextBuilder Idempotency(string idempotencyKey)
+        {
+            _idempotencyKey = RequireNonEmpty(idempotencyKey, nameof(idempotencyKey));
+            return this;
+        }
+
+        /// <summary>Creates the immutable operation context.</summary>
+        public CultMeshOperationContext Build()
+        {
+            return new CultMeshOperationContext(_runtimeId, _claims, _routeHint, _idempotencyKey);
+        }
+
+        private static string RequireNonEmpty(string value, string paramName)
+        {
+            return string.IsNullOrWhiteSpace(value)
+                ? throw new ArgumentException("Value must be non-empty.", paramName)
+                : value;
+        }
+    }
+
+    /// <summary>
+    /// Fluent builder for typed query context.
+    /// </summary>
+    public sealed class CultMeshQueryContextBuilder
+    {
+        private readonly string _runtimeId;
+        private CultMeshRouteHint _routeHint = CultMeshRouteHint.Automatic;
+
+        /// <summary>Creates a builder for one runtime.</summary>
+        public CultMeshQueryContextBuilder(string runtimeId)
+        {
+            _runtimeId = RequireNonEmpty(runtimeId, nameof(runtimeId));
+        }
+
+        /// <summary>Sets the preferred route hint.</summary>
+        public CultMeshQueryContextBuilder Route(CultMeshLocalityKind kind, string? description = null)
+        {
+            _routeHint = new CultMeshRouteHint(kind, description);
+            return this;
+        }
+
+        /// <summary>Creates the immutable query context.</summary>
+        public CultMeshQueryContext Build()
+        {
+            return new CultMeshQueryContext(_runtimeId, _routeHint);
+        }
+
+        private static string RequireNonEmpty(string value, string paramName)
+        {
+            return string.IsNullOrWhiteSpace(value)
+                ? throw new ArgumentException("Value must be non-empty.", paramName)
+                : value;
+        }
+    }
+
+    /// <summary>
+    /// Typed derived-state query surface.
+    /// </summary>
+    public sealed class CultMeshQuerySurface<TParameters, TResult>
+    {
+        private readonly Func<TParameters, CultMeshQueryContext, Task<TResult>> _execute;
+        private readonly Func<TParameters, CultMeshQueryContext, Observable<TResult>>? _watch;
+
+        /// <summary>Creates a query surface.</summary>
+        public CultMeshQuerySurface(
+            string queryId,
+            Func<TParameters, CultMeshQueryContext, Task<TResult>> execute,
+            Func<TParameters, CultMeshQueryContext, Observable<TResult>>? watch = null,
+            IEnumerable<CultMeshProjectionSource>? sources = null,
+            CultMeshRouteHint? routeHint = null)
+        {
+            QueryId = RequireNonEmpty(queryId, nameof(queryId));
+            _execute = execute ?? throw new ArgumentNullException(nameof(execute));
+            _watch = watch;
+            Sources = sources?.ToArray() ?? Array.Empty<CultMeshProjectionSource>();
+            RouteHint = routeHint ?? CultMeshRouteHint.Automatic;
+        }
+
+        /// <summary>Gets the semantic query id.</summary>
+        public string QueryId { get; }
+
+        /// <summary>Gets the typed state sources this query depends on, when known.</summary>
+        public IReadOnlyList<CultMeshProjectionSource> Sources { get; }
+
+        /// <summary>Gets the preferred or observed route for the query.</summary>
+        public CultMeshRouteHint RouteHint { get; }
+
+        /// <summary>Executes the query once.</summary>
+        public Task<TResult> ExecuteAsync(TParameters parameters, CultMeshQueryContext context)
+        {
+            if (context == null) throw new ArgumentNullException(nameof(context));
+            return _execute(parameters, context);
+        }
+
+        /// <summary>Executes the query once for one runtime using default context.</summary>
+        public Task<TResult> ExecuteAsync(TParameters parameters, string runtimeId)
+        {
+            return ExecuteAsync(parameters, CultMeshQueryContext.ForRuntime(runtimeId));
+        }
+
+        /// <summary>Watches query results when the surface supports reactive execution.</summary>
+        public Observable<TResult> Watch(TParameters parameters, CultMeshQueryContext context)
+        {
+            if (context == null) throw new ArgumentNullException(nameof(context));
+            if (_watch == null)
+            {
+                throw new NotSupportedException($"Query surface '{QueryId}' does not support reactive watches.");
+            }
+
+            return _watch(parameters, context);
+        }
+
+        /// <summary>Binds this query surface to a Verse context.</summary>
+        public CultMeshBoundQuerySurface<TParameters, TResult> Bind(CultMeshVerseContext context)
+        {
+            return new CultMeshBoundQuerySurface<TParameters, TResult>(context, this);
+        }
+
+        /// <summary>Binds this query surface to a Verse.</summary>
+        public CultMeshBoundQuerySurface<TParameters, TResult> Bind(CultMeshVerse verse)
+        {
+            if (verse == null) throw new ArgumentNullException(nameof(verse));
+            return Bind(verse.Context);
+        }
+
+        private static string RequireNonEmpty(string value, string paramName)
+        {
+            return string.IsNullOrWhiteSpace(value)
+                ? throw new ArgumentException("Value must be non-empty.", paramName)
+                : value;
+        }
+    }
+
+    /// <summary>
+    /// Query surface pre-bound to a Verse so generated domain sugar can execute without context plumbing.
+    /// </summary>
+    public sealed class CultMeshBoundQuerySurface<TParameters, TResult>
+    {
+        /// <summary>Creates a Verse-bound query surface.</summary>
+        public CultMeshBoundQuerySurface(
+            CultMeshVerseContext context,
+            CultMeshQuerySurface<TParameters, TResult> query)
+        {
+            Context = context ?? throw new ArgumentNullException(nameof(context));
+            Query = query ?? throw new ArgumentNullException(nameof(query));
+        }
+
+        /// <summary>Gets the bound Verse context.</summary>
+        public CultMeshVerseContext Context { get; }
+
+        /// <summary>Gets the underlying query surface.</summary>
+        public CultMeshQuerySurface<TParameters, TResult> Query { get; }
+
+        /// <summary>Gets the semantic query id.</summary>
+        public string QueryId => Query.QueryId;
+
+        /// <summary>Gets the typed state sources this query depends on, when known.</summary>
+        public IReadOnlyList<CultMeshProjectionSource> Sources => Query.Sources;
+
+        /// <summary>Gets the preferred or observed route for the query.</summary>
+        public CultMeshRouteHint RouteHint => Query.RouteHint;
+
+        /// <summary>Executes the query through the bound Verse.</summary>
+        public Task<TResult> ExecuteAsync(TParameters parameters)
+        {
+            return Query.ExecuteAsync(parameters, Context.QueryContext());
+        }
+
+        /// <summary>Watches query results through the bound Verse.</summary>
+        public Observable<TResult> Watch(TParameters parameters)
+        {
+            return Query.Watch(parameters, Context.QueryContext());
+        }
+    }
+
+    /// <summary>
+    /// Typed live view surface for composed client snapshots.
+    /// </summary>
+    public sealed class CultMeshLiveFeed<TParameters, TResult>
+    {
+        private readonly Func<TParameters, CultMeshQueryContext, Task<TResult>> _snapshot;
+        private readonly Func<TParameters, CultMeshQueryContext, Observable<TResult>>? _watch;
+
+        /// <summary>Creates a live feed surface.</summary>
+        public CultMeshLiveFeed(
+            string feedId,
+            Func<TParameters, CultMeshQueryContext, Task<TResult>> snapshot,
+            Func<TParameters, CultMeshQueryContext, Observable<TResult>>? watch = null,
+            IEnumerable<CultMeshProjectionSource>? sources = null,
+            CultMeshRouteHint? routeHint = null)
+        {
+            FeedId = RequireNonEmpty(feedId, nameof(feedId));
+            _snapshot = snapshot ?? throw new ArgumentNullException(nameof(snapshot));
+            _watch = watch;
+            Sources = sources?.ToArray() ?? Array.Empty<CultMeshProjectionSource>();
+            RouteHint = routeHint ?? CultMeshRouteHint.Automatic;
+        }
+
+        /// <summary>Gets the semantic feed id.</summary>
+        public string FeedId { get; }
+
+        /// <summary>Gets the typed state sources this live feed depends on, when known.</summary>
+        public IReadOnlyList<CultMeshProjectionSource> Sources { get; }
+
+        /// <summary>Gets the preferred or observed route for the feed.</summary>
+        public CultMeshRouteHint RouteHint { get; }
+
+        /// <summary>Reads one coherent feed snapshot.</summary>
+        public Task<TResult> SnapshotAsync(TParameters parameters, CultMeshQueryContext context)
+        {
+            if (context == null) throw new ArgumentNullException(nameof(context));
+            return _snapshot(parameters, ResolveContext(context));
+        }
+
+        /// <summary>Reads one coherent feed snapshot for one runtime using default context.</summary>
+        public Task<TResult> SnapshotAsync(TParameters parameters, string runtimeId)
+        {
+            return SnapshotAsync(parameters, CultMeshQueryContext.ForRuntime(runtimeId));
+        }
+
+        /// <summary>Watches coherent feed snapshots when the feed supports reactive execution.</summary>
+        public Observable<TResult> Watch(TParameters parameters, CultMeshQueryContext context)
+        {
+            if (context == null) throw new ArgumentNullException(nameof(context));
+            if (_watch == null)
+            {
+                throw new NotSupportedException($"Live feed '{FeedId}' does not support reactive watches.");
+            }
+
+            return _watch(parameters, ResolveContext(context));
+        }
+
+        /// <summary>Binds this live feed to a Verse context.</summary>
+        public CultMeshBoundLiveFeed<TParameters, TResult> Bind(CultMeshVerseContext context)
+        {
+            return new CultMeshBoundLiveFeed<TParameters, TResult>(context, this);
+        }
+
+        /// <summary>Binds this live feed to a Verse.</summary>
+        public CultMeshBoundLiveFeed<TParameters, TResult> Bind(CultMeshVerse verse)
+        {
+            if (verse == null) throw new ArgumentNullException(nameof(verse));
+            return Bind(verse.Context);
+        }
+
+        private CultMeshQueryContext ResolveContext(CultMeshQueryContext context)
+        {
+            return context.RouteHint.Kind == CultMeshLocalityKind.Automatic &&
+                   RouteHint.Kind != CultMeshLocalityKind.Automatic
+                ? context.WithRoute(RouteHint)
+                : context;
+        }
+
+        private static string RequireNonEmpty(string value, string paramName)
+        {
+            return string.IsNullOrWhiteSpace(value)
+                ? throw new ArgumentException("Value must be non-empty.", paramName)
+                : value;
+        }
+    }
+
+    /// <summary>
+    /// Live feed pre-bound to a Verse so generated domain sugar can snapshot or watch without context plumbing.
+    /// </summary>
+    public sealed class CultMeshBoundLiveFeed<TParameters, TResult>
+    {
+        /// <summary>Creates a Verse-bound live feed.</summary>
+        public CultMeshBoundLiveFeed(
+            CultMeshVerseContext context,
+            CultMeshLiveFeed<TParameters, TResult> feed)
+        {
+            Context = context ?? throw new ArgumentNullException(nameof(context));
+            Feed = feed ?? throw new ArgumentNullException(nameof(feed));
+        }
+
+        /// <summary>Gets the bound Verse context.</summary>
+        public CultMeshVerseContext Context { get; }
+
+        /// <summary>Gets the underlying live feed.</summary>
+        public CultMeshLiveFeed<TParameters, TResult> Feed { get; }
+
+        /// <summary>Gets the semantic feed id.</summary>
+        public string FeedId => Feed.FeedId;
+
+        /// <summary>Gets the typed state sources this live feed depends on, when known.</summary>
+        public IReadOnlyList<CultMeshProjectionSource> Sources => Feed.Sources;
+
+        /// <summary>Gets the preferred or observed route for the feed.</summary>
+        public CultMeshRouteHint RouteHint => Feed.RouteHint;
+
+        /// <summary>Reads one coherent feed snapshot through the bound Verse.</summary>
+        public Task<TResult> SnapshotAsync(TParameters parameters)
+        {
+            return Feed.SnapshotAsync(parameters, Context.QueryContext());
+        }
+
+        /// <summary>Watches coherent feed snapshots through the bound Verse.</summary>
+        public Observable<TResult> Watch(TParameters parameters)
+        {
+            return Feed.Watch(parameters, Context.QueryContext());
+        }
+    }
+
+    /// <summary>
+    /// Empty parameter object for document handles that expose one typed document as a live feed.
+    /// </summary>
+    public readonly struct CultMeshDocumentQueryParameters
+    {
+        /// <summary>Gets the singleton empty document query.</summary>
+        public static CultMeshDocumentQueryParameters Empty { get; } = new();
+    }
+
+    /// <summary>
+    /// Inspectable typed document handle exposed by CultMesh.
+    /// </summary>
+    public interface ICultMeshDocumentHandle
+    {
+        /// <summary>Gets the CLR document type presented by this handle.</summary>
+        Type DocumentType { get; }
+
+        /// <summary>Gets the semantic document id.</summary>
+        string DocumentId { get; }
+
+        /// <summary>Gets the stable CultCache schema name.</summary>
+        string SchemaName { get; }
+
+        /// <summary>Gets the stable CultCache schema version.</summary>
+        string SchemaVersion { get; }
+
+        /// <summary>Gets the content-derived schema identifier.</summary>
+        string SchemaId { get; }
+
+        /// <summary>Gets the preferred or observed route for document access.</summary>
+        CultMeshRouteHint RouteHint { get; }
+
+        /// <summary>Gets typed state sources this document handle depends on, when known.</summary>
+        IReadOnlyList<CultMeshProjectionSource> Sources { get; }
+
+        /// <summary>Gets whether this handle can replace the underlying document value.</summary>
+        bool CanReplace { get; }
+
+        /// <summary>Gets whether this handle can submit a client prediction for the underlying document value.</summary>
+        bool CanSubmitPrediction { get; }
+
+        /// <summary>Creates a same-schema alias presentation for another CLR document type.</summary>
+        CultMeshDocumentHandle<TAlias> AsSchemaAlias<TAlias>() where TAlias : class;
+    }
+
+    /// <summary>
+    /// Typed reactive document handle with schema-aware alias conversion.
+    /// </summary>
+    public sealed class CultMeshDocumentHandle<TDocument> : ICultMeshDocumentHandle
+        where TDocument : class
+    {
+        private static readonly CultDocumentDescriptor Descriptor =
+            CultDocumentRegistry.Shared.GetRequired<TDocument>();
+
+        private readonly CultMeshBoundLiveFeed<CultMeshDocumentQueryParameters, TDocument> _feed;
+        private readonly Func<TDocument, Task>? _replace;
+        private readonly Func<TDocument, Task>? _submitPrediction;
+        // Set only over a CultCache record, whose changes carry the cache's Sequence.
+        private readonly Func<Observable<CultCacheDocumentChange<TDocument>>>? _recordChanges;
+        private readonly Func<(TDocument Document, long Sequence)>? _sequencedLatest;
+
+        /// <summary>Creates a document handle from a Verse-bound live feed.</summary>
+        public CultMeshDocumentHandle(
+            CultMeshBoundLiveFeed<CultMeshDocumentQueryParameters, TDocument> feed,
+            Func<TDocument, Task>? replace = null,
+            Func<TDocument, Task>? submitPrediction = null)
+        {
+            _feed = feed ?? throw new ArgumentNullException(nameof(feed));
+            _replace = replace;
+            _submitPrediction = submitPrediction;
+        }
+
+        internal CultMeshDocumentHandle(
+            CultMeshBoundLiveFeed<CultMeshDocumentQueryParameters, TDocument> feed,
+            Func<TDocument, Task> replace,
+            Func<Observable<CultCacheDocumentChange<TDocument>>> recordChanges,
+            Func<(TDocument Document, long Sequence)> sequencedLatest)
+            : this(feed, replace)
+        {
+            _recordChanges = recordChanges;
+            _sequencedLatest = sequencedLatest;
+        }
+
+        /// <summary>Gets the semantic document id.</summary>
+        public string DocumentId => _feed.FeedId;
+
+        /// <summary>Gets the CLR document type presented by this handle.</summary>
+        public Type DocumentType => typeof(TDocument);
+
+        /// <summary>Gets the stable CultCache schema name.</summary>
+        public string SchemaName => Descriptor.SchemaName;
+
+        /// <summary>Gets the stable CultCache schema version.</summary>
+        public string SchemaVersion => Descriptor.SchemaVersion;
+
+        /// <summary>Gets the content-derived schema identifier.</summary>
+        public string SchemaId => Descriptor.SchemaId;
+
+        /// <summary>Gets the preferred or observed route for document access.</summary>
+        public CultMeshRouteHint RouteHint => _feed.RouteHint;
+
+        /// <summary>Gets typed state sources this document handle depends on, when known.</summary>
+        public IReadOnlyList<CultMeshProjectionSource> Sources => _feed.Sources;
+
+        /// <summary>Gets the bound Verse context.</summary>
+        public CultMeshVerseContext Context => _feed.Context;
+
+        /// <summary>Gets the underlying live feed used by this document handle.</summary>
+        public CultMeshLiveFeed<CultMeshDocumentQueryParameters, TDocument> Feed => _feed.Feed;
+
+        /// <summary>Gets whether this handle can replace the underlying document value.</summary>
+        public bool CanReplace => _replace != null;
+
+        /// <summary>Gets whether this handle can submit a client prediction for the underlying document value.</summary>
+        public bool CanSubmitPrediction => _submitPrediction != null;
+
+        /// <summary>Reads one coherent document snapshot.</summary>
+        public Task<TDocument> LatestAsync()
+        {
+            return _feed.SnapshotAsync(CultMeshDocumentQueryParameters.Empty);
+        }
+
+        /// <summary>Reads the latest document snapshot synchronously for host APIs that cannot be async.</summary>
+        public TDocument Latest()
+        {
+            return LatestAsync().ConfigureAwait(false).GetAwaiter().GetResult();
+        }
+
+        /// <summary>Watches coherent document snapshots.</summary>
+        public Observable<TDocument> Watch()
+        {
+            return _feed.Watch(CultMeshDocumentQueryParameters.Empty);
+        }
+
+        /// <summary>Subscribes to coherent document snapshots.</summary>
+        public IDisposable Watch(Action<TDocument> onNext)
+        {
+            if (onNext == null) throw new ArgumentNullException(nameof(onNext));
+            return Watch().Subscribe(onNext);
+        }
+
+        // Latest-value mirrors: a cache-backed handle passes each snapshot's Sequence; other sources pass null.
+        internal IDisposable WatchSequenced(Action<TDocument, long?> onNext) => _recordChanges == null
+            ? Watch(document => onNext(document, null))
+            : _recordChanges()
+                .Where(change => change.Document != null)
+                .Subscribe(change => onNext(change.Document!, change.Sequence));
+
+        // A mirror subscribes first, then adopts under its own gate. A cache-backed handle reads synchronously there, so
+        // its Sequence is at or above every change the mirror has applied and a later straggler at or below it drops.
+        internal async Task<T> AdoptLatestAsync<T>(object gate, Func<TDocument, long?, T> adopt)
+        {
+            if (_sequencedLatest != null)
+            {
+                lock (gate)
+                {
+                    var (document, sequence) = _sequencedLatest();
+                    return adopt(document, sequence);
+                }
+            }
+
+            var latest = await LatestAsync().ConfigureAwait(false);
+            lock (gate)
+                return adopt(latest, null);
+        }
+
+        /// <summary>
+        /// Projects one typed document field into a stable reactive state pointer. The expression is
+        /// structural metadata: only member access and constant collection indices are accepted.
+        /// </summary>
+        public CultMeshStatePointer<TValue> Field<TValue>(Expression<Func<TDocument, TValue>> field)
+        {
+            if (field == null) throw new ArgumentNullException(nameof(field));
+            var path = CultMeshFieldPath.Parse(field.Body, field.Parameters[0]);
+            var read = field.Compile();
+            return new CultMeshStatePointer<TValue>(
+                DocumentId + "#" + path,
+                async context => read(await Feed
+                    .SnapshotAsync(CultMeshDocumentQueryParameters.Empty, context)
+                    .ConfigureAwait(false)),
+                context => Feed
+                    .Watch(CultMeshDocumentQueryParameters.Empty, context)
+                    .Select(read),
+                RouteHint,
+                Sources);
+        }
+
+        /// <summary>Replaces the underlying document when this handle is backed by mutable state.</summary>
+        public Task ReplaceAsync(TDocument value)
+        {
+            if (value == null) throw new ArgumentNullException(nameof(value));
+            if (_replace == null)
+            {
+                throw new NotSupportedException($"Document handle '{DocumentId}' is read-only.");
+            }
+
+            return _replace(value);
+        }
+
+        /// <summary>Submits a locally predicted document value when this handle is backed by client-authoritative state.</summary>
+        public Task SubmitPredictionAsync(TDocument value)
+        {
+            if (value == null) throw new ArgumentNullException(nameof(value));
+            if (_submitPrediction == null)
+            {
+                throw new NotSupportedException($"Document handle '{DocumentId}' does not accept client predictions.");
+            }
+
+            return _submitPrediction(value);
+        }
+
+        /// <summary>Gets an explicit authoritative replacement writer for this document.</summary>
+        public CultMeshDocumentWriter<TDocument> AuthoritativeWriter()
+        {
+            if (_replace == null)
+                throw new NotSupportedException($"Document handle '{DocumentId}' is read-only.");
+            return new CultMeshDocumentWriter<TDocument>(
+                this,
+                CultMeshDocumentWriteKind.AuthoritativeReplacement,
+                _replace);
+        }
+
+        /// <summary>Gets an explicit client prediction writer for this document.</summary>
+        public CultMeshDocumentWriter<TDocument> PredictionWriter()
+        {
+            if (_submitPrediction == null)
+                throw new NotSupportedException($"Document handle '{DocumentId}' does not accept client predictions.");
+            return new CultMeshDocumentWriter<TDocument>(
+                this,
+                CultMeshDocumentWriteKind.Prediction,
+                _submitPrediction);
+        }
+
+        /// <summary>Creates a read-only in-memory mirror updated by the document watch.</summary>
+        public async Task<CultMeshObservedDocument<TDocument>> ObserveAsync()
+        {
+            var observed = new CultMeshObservedDocument<TDocument>(this);
+            await observed.StartAsync().ConfigureAwait(false);
+            return observed;
+        }
+
+        /// <summary>Creates a read-only in-memory mirror synchronously.</summary>
+        public CultMeshObservedDocument<TDocument> Observe()
+        {
+            return ObserveAsync().ConfigureAwait(false).GetAwaiter().GetResult();
+        }
+
+        /// <summary>Creates a same-schema alias presentation for another CLR document type.</summary>
+        public CultMeshDocumentHandle<TAlias> AsSchemaAlias<TAlias>() where TAlias : class
+        {
+            var aliasDescriptor = CultDocumentRegistry.Shared.GetRequired<TAlias>();
+            if (!string.Equals(Descriptor.SchemaName, aliasDescriptor.SchemaName, StringComparison.Ordinal) ||
+                !string.Equals(Descriptor.SchemaVersion, aliasDescriptor.SchemaVersion, StringComparison.Ordinal))
+            {
+                throw new InvalidOperationException(
+                    $"Document type {typeof(TAlias).FullName} uses schema '{aliasDescriptor.SchemaName}' " +
+                    $"version '{aliasDescriptor.SchemaVersion}', but handle '{DocumentId}' exposes " +
+                    $"schema '{SchemaName}' version '{SchemaVersion}'.");
+            }
+
+            var aliasFeed = new CultMeshLiveFeed<CultMeshDocumentQueryParameters, TAlias>(
+                DocumentId,
+                async (parameters, context) => ConvertDocument<TDocument, TAlias>(
+                    await Feed.SnapshotAsync(parameters, context).ConfigureAwait(false)),
+                (parameters, context) => Feed
+                    .Watch(parameters, context)
+                    .Select(ConvertDocument<TDocument, TAlias>),
+                Sources,
+                RouteHint);
+
+            Func<TAlias, Task>? replace = _replace == null
+                ? null
+                : value => _replace(ConvertDocument<TAlias, TDocument>(value));
+            Func<TAlias, Task>? submitPrediction = _submitPrediction == null
+                ? null
+                : value => _submitPrediction(ConvertDocument<TAlias, TDocument>(value));
+
+            return new CultMeshDocumentHandle<TAlias>(aliasFeed.Bind(Context), replace, submitPrediction);
+        }
+
+        internal static TDocumentValue CloneDocument<TDocumentValue>(TDocumentValue document)
+            where TDocumentValue : class
+        {
+            if (document == null) throw new ArgumentNullException(nameof(document));
+            var payload = CultDocumentMessagePackSerialization.SerializeUntyped(document, typeof(TDocumentValue));
+            return (TDocumentValue)CultDocumentMessagePackSerialization.DeserializeUntyped(
+                typeof(TDocumentValue),
+                payload);
+        }
+
+        private static class CultMeshFieldPath
+        {
+            public static string Parse(Expression expression, ParameterExpression root)
+            {
+                var segments = new Stack<string>();
+                while (expression != root)
+                {
+                    if (expression is MemberExpression member)
+                    {
+                        segments.Push(member.Member.Name);
+                        expression = member.Expression
+                            ?? throw Invalid();
+                        continue;
+                    }
+
+                    if (expression is MethodCallExpression call &&
+                        call.Method.Name == "get_Item" &&
+                        call.Object != null &&
+                        call.Arguments.Count == 1)
+                    {
+                        segments.Push("[" + ConstantIndex(call.Arguments[0]) + "]");
+                        expression = call.Object;
+                        continue;
+                    }
+
+                    if (expression is BinaryExpression binary && binary.NodeType == ExpressionType.ArrayIndex)
+                    {
+                        segments.Push("[" + ConstantIndex(binary.Right) + "]");
+                        expression = binary.Left;
+                        continue;
+                    }
+
+                    throw Invalid();
+                }
+
+                if (segments.Count == 0) throw Invalid();
+                var path = string.Empty;
+                foreach (var segment in segments)
+                    path += segment.StartsWith("[", StringComparison.Ordinal) || path.Length == 0
+                        ? segment
+                        : "." + segment;
+                return path;
+            }
+
+            private static string ConstantIndex(Expression expression)
+            {
+                if (expression is ConstantExpression constant && constant.Value != null)
+                    return Convert.ToString(constant.Value, CultureInfo.InvariantCulture)!;
+                throw Invalid();
+            }
+
+            private static ArgumentException Invalid() => new(
+                "CultMesh field selectors may contain only member access and constant collection indices.",
+                "field");
+        }
+
+        internal static TTarget ConvertDocument<TSource, TTarget>(TSource document)
+            where TSource : class
+            where TTarget : class
+        {
+            if (document == null) throw new ArgumentNullException(nameof(document));
+            if (document is TTarget alreadyTyped)
+            {
+                return alreadyTyped;
+            }
+
+            var payload = CultDocumentMessagePackSerialization.SerializeUntyped(document, typeof(TSource));
+            return (TTarget)CultDocumentMessagePackSerialization.DeserializeUntyped(typeof(TTarget), payload);
+        }
+    }
+
+    /// <summary>
+    /// A read-only local mirror of a watched typed document. Observation never acquires a write
+    /// capability and never polls or serializes the document while idle.
+    /// </summary>
+    public sealed class CultMeshObservedDocument<TDocument> : IDisposable
+        where TDocument : class
+    {
+        private readonly object _gate = new();
+        private IDisposable? _subscription;
+        private TDocument _current;
+        private long _appliedSequence;
+        private bool _disposed;
+
+        internal CultMeshObservedDocument(CultMeshDocumentHandle<TDocument> document)
+        {
+            Document = document ?? throw new ArgumentNullException(nameof(document));
+            _current = null!;
+        }
+
+        /// <summary>Gets the underlying read/watch handle.</summary>
+        public CultMeshDocumentHandle<TDocument> Document { get; }
+
+        /// <summary>
+        /// Gets the current borrowed snapshot. Treat the object graph as read-only; local mutation
+        /// cannot publish and is replaced by the next canonical snapshot.
+        /// </summary>
+        public TDocument Current
+        {
+            get
+            {
+                lock (_gate)
+                {
+                    ThrowIfDisposed();
+                    return _current;
+                }
+            }
+        }
+
+        internal async Task StartAsync()
+        {
+            _subscription = Document.WatchSequenced(ApplyCanonicalSnapshot);
+            try
+            {
+                await RefreshAsync().ConfigureAwait(false);
+            }
+            catch
+            {
+                Dispose();
+                throw;
+            }
+        }
+
+        /// <summary>Reads and adopts a fresh canonical snapshot.</summary>
+        public Task<TDocument> RefreshAsync()
+        {
+            ThrowIfDisposed();
+            return Document.AdoptLatestAsync(_gate, (latest, sequence) =>
+            {
+                ThrowIfDisposed();
+                _current = CultMeshDocumentHandle<TDocument>.CloneDocument(latest);
+                _appliedSequence = sequence ?? _appliedSequence;
+                return _current;
+            });
+        }
+
+        /// <inheritdoc />
+        public void Dispose()
+        {
+            lock (_gate)
+            {
+                if (_disposed)
+                    return;
+                _disposed = true;
+            }
+
+            _subscription?.Dispose();
+        }
+
+        private void ApplyCanonicalSnapshot(TDocument canonical, long? sequence)
+        {
+            if (canonical == null)
+                return;
+            var next = CultMeshDocumentHandle<TDocument>.CloneDocument(canonical);
+            lock (_gate)
+            {
+                if (_disposed || sequence <= _appliedSequence)
+                    return;
+                _appliedSequence = sequence ?? _appliedSequence;
+                _current = next;
+            }
+        }
+
+        private void ThrowIfDisposed()
+        {
+            if (_disposed)
+                throw new ObjectDisposedException(nameof(CultMeshObservedDocument<TDocument>));
+        }
+    }
+
+    /// <summary>Names the one immutable authority path selected by a document writer.</summary>
+    public enum CultMeshDocumentWriteKind
+    {
+        /// <summary>The writer replaces canonical state through its owning provider.</summary>
+        AuthoritativeReplacement,
+
+        /// <summary>The writer submits a client prediction or candidate for validation.</summary>
+        Prediction
+    }
+
+    /// <summary>
+    /// An explicit, immutable write capability for one typed document. A writer never switches
+    /// between authoritative replacement and prediction based on runtime availability.
+    /// </summary>
+    public sealed class CultMeshDocumentWriter<TDocument>
+        where TDocument : class
+    {
+        private readonly Func<TDocument, Task> _write;
+
+        internal CultMeshDocumentWriter(
+            CultMeshDocumentHandle<TDocument> document,
+            CultMeshDocumentWriteKind kind,
+            Func<TDocument, Task> write)
+        {
+            Document = document ?? throw new ArgumentNullException(nameof(document));
+            Kind = kind;
+            _write = write ?? throw new ArgumentNullException(nameof(write));
+        }
+
+        /// <summary>Gets the document read/watch handle paired with this writer.</summary>
+        public CultMeshDocumentHandle<TDocument> Document { get; }
+
+        /// <summary>Gets the immutable authority path selected for this writer.</summary>
+        public CultMeshDocumentWriteKind Kind { get; }
+
+        /// <summary>Writes one value through this writer's named authority path.</summary>
+        public Task WriteAsync(TDocument value)
+        {
+            if (value == null) throw new ArgumentNullException(nameof(value));
+            return _write(value);
+        }
+
+        /// <summary>Reads, transforms, and writes through this writer's named authority path.</summary>
+        public async Task<TDocument> UpdateAsync(Func<TDocument, TDocument> update)
+        {
+            if (update == null) throw new ArgumentNullException(nameof(update));
+            var next = update(await Document.LatestAsync().ConfigureAwait(false));
+            await WriteAsync(next).ConfigureAwait(false);
+            return next;
+        }
+
+        /// <summary>Reads, transforms, and writes through this writer's named authority path.</summary>
+        public async Task<TDocument> UpdateAsync(Func<TDocument, Task<TDocument>> update)
+        {
+            if (update == null) throw new ArgumentNullException(nameof(update));
+            var next = await update(await Document.LatestAsync().ConfigureAwait(false)).ConfigureAwait(false);
+            await WriteAsync(next).ConfigureAwait(false);
+            return next;
+        }
+
+        /// <summary>Creates an explicitly writable reactive mirror.</summary>
+        public async Task<CultMeshReactiveDocument<TDocument>> ReactiveAsync(
+            CultMeshReactiveDocumentOptions? options = null)
+        {
+            var reactive = new CultMeshReactiveDocument<TDocument>(this, options);
+            await reactive.StartAsync().ConfigureAwait(false);
+            return reactive;
+        }
+
+        /// <summary>Creates an explicitly writable reactive mirror synchronously.</summary>
+        public CultMeshReactiveDocument<TDocument> Reactive(CultMeshReactiveDocumentOptions? options = null)
+        {
+            return ReactiveAsync(options).ConfigureAwait(false).GetAwaiter().GetResult();
+        }
+    }
+
+    /// <summary>
+    /// Configures a managed CultMesh reactive document mirror.
+    /// </summary>
+    public sealed class CultMeshReactiveDocumentOptions
+    {
+        /// <summary>
+        /// Gets or sets the write coalescing window. The default approximates a frame boundary for non-Unity hosts.
+        /// </summary>
+        public TimeSpan FlushDelay { get; set; } = TimeSpan.FromMilliseconds(16);
+
+        /// <summary>
+        /// Gets or sets the clock that owns delayed flush scheduling. Tests and deterministic hosts may
+        /// replace the system clock without introducing a second scheduler abstraction.
+        /// </summary>
+        public ICultMeshClock Clock { get; set; } = CultMeshSystemClock.Instance;
+
+        /// <summary>Gets or sets whether canonical snapshots replace dirty local predictions immediately.</summary>
+        public bool ReplaceDirtyCurrentOnCanonicalSnapshot { get; set; }
+    }
+
+    /// <summary>
+    /// Captures a canonical snapshot that arrived while the local reactive document had an outstanding prediction.
+    /// </summary>
+    public sealed class CultMeshReactiveDocumentReconciliation<TDocument>
+        where TDocument : class
+    {
+        internal CultMeshReactiveDocumentReconciliation(
+            TDocument canonical,
+            TDocument predicted,
+            IReadOnlyDictionary<string, object?> delta,
+            int version,
+            DateTimeOffset receivedAt)
+        {
+            Canonical = canonical;
+            Predicted = predicted;
+            Delta = delta ?? throw new ArgumentNullException(nameof(delta));
+            Version = version;
+            ReceivedAt = receivedAt;
+        }
+
+        /// <summary>Gets the monotonically increasing reconciliation version for this reactive document.</summary>
+        public int Version { get; }
+
+        /// <summary>Gets the authoritative canonical document snapshot.</summary>
+        public TDocument Canonical { get; }
+
+        /// <summary>Gets the locally predicted document snapshot that was active when the canonical value arrived.</summary>
+        public TDocument Predicted { get; }
+
+        /// <summary>
+        /// Gets the predicted-vs-canonical member delta. Numeric members store predicted minus canonical;
+        /// non-numeric members store the predicted value.
+        /// </summary>
+        public IReadOnlyDictionary<string, object?> Delta { get; }
+
+        /// <summary>Gets when the canonical snapshot was received.</summary>
+        public DateTimeOffset ReceivedAt { get; }
+    }
+
+    /// <summary>
+    /// Managed typed document mirror that coalesces explicit local edits through one selected writer.
+    /// </summary>
+    public sealed class CultMeshReactiveDocument<TDocument> : IDisposable
+        where TDocument : class
+    {
+        private static readonly CultMeshComparableMember[] ComparableMembers =
+            GetComparableMembers(typeof(TDocument)).ToArray();
+        private readonly CultMeshDocumentWriter<TDocument> _writer;
+        private readonly CultMeshDocumentHandle<TDocument> _document;
+        private readonly CultMeshReactiveDocumentOptions _options;
+        private readonly object _gate = new();
+        private IDisposable? _subscription;
+        private CancellationTokenSource? _flushDelayCancellation;
+        private TDocument _current;
+        private bool _dirty;
+        private bool _flushQueued;
+        private bool _flushing;
+        private bool _disposed;
+        private long _appliedSequence;
+        private int _reconciliationVersion;
+
+        internal CultMeshReactiveDocument(
+            CultMeshDocumentWriter<TDocument> writer,
+            CultMeshReactiveDocumentOptions? options)
+        {
+            _writer = writer ?? throw new ArgumentNullException(nameof(writer));
+            _document = writer.Document;
+            _current = null!;
+            _options = options ?? new CultMeshReactiveDocumentOptions();
+        }
+
+        /// <summary>Gets the immutable write capability selected for this mirror.</summary>
+        public CultMeshDocumentWriter<TDocument> Writer => _writer;
+
+        /// <summary>Gets the underlying document handle.</summary>
+        public CultMeshDocumentHandle<TDocument> Document => _document;
+
+        /// <summary>
+        /// Gets a cloned local snapshot. Mutating the returned object cannot mutate or publish the mirror;
+        /// use <see cref="Update"/> or <see cref="ReplaceLocal"/> for edits.
+        /// </summary>
+        public TDocument Snapshot
+        {
+            get
+            {
+                lock (_gate)
+                {
+                    ThrowIfDisposed();
+                    return CultMeshDocumentHandle<TDocument>.CloneDocument(_current);
+                }
+            }
+        }
+
+        /// <summary>Gets whether local edits are waiting to be sent.</summary>
+        public bool IsDirty
+        {
+            get
+            {
+                lock (_gate)
+                    return _dirty;
+            }
+        }
+
+        /// <summary>Gets the most recent reconciliation snapshot, when a canonical value arrived during local prediction.</summary>
+        public CultMeshReactiveDocumentReconciliation<TDocument>? Reconciliation { get; private set; }
+
+        internal async Task StartAsync()
+        {
+            _subscription = _document.WatchSequenced(ApplyCanonicalSnapshot);
+            try
+            {
+                await RefreshAsync().ConfigureAwait(false);
+            }
+            catch
+            {
+                Dispose();
+                throw;
+            }
+        }
+
+        /// <summary>Mutates the current value and schedules a coalesced prediction or replacement.</summary>
+        public TDocument Update(Action<TDocument> update)
+        {
+            if (update == null) throw new ArgumentNullException(nameof(update));
+            ThrowIfDisposed();
+            lock (_gate)
+            {
+                update(_current);
+                _dirty = true;
+                ScheduleFlushLocked();
+                return CultMeshDocumentHandle<TDocument>.CloneDocument(_current);
+            }
+        }
+
+        /// <summary>Replaces the current local value and schedules a coalesced prediction or replacement.</summary>
+        public TDocument ReplaceLocal(TDocument value)
+        {
+            if (value == null) throw new ArgumentNullException(nameof(value));
+            ThrowIfDisposed();
+            lock (_gate)
+            {
+                _current = CultMeshDocumentHandle<TDocument>.CloneDocument(value);
+                _dirty = true;
+                ScheduleFlushLocked();
+                return CultMeshDocumentHandle<TDocument>.CloneDocument(_current);
+            }
+        }
+
+        /// <summary>Reads a fresh canonical snapshot and adopts it as the current value.</summary>
+        public Task<TDocument> RefreshAsync()
+        {
+            ThrowIfDisposed();
+            return _document.AdoptLatestAsync(_gate, (latest, sequence) =>
+            {
+                _current = CultMeshDocumentHandle<TDocument>.CloneDocument(latest);
+                _appliedSequence = sequence ?? _appliedSequence;
+                _dirty = false;
+                Reconciliation = null;
+                return CultMeshDocumentHandle<TDocument>.CloneDocument(_current);
+            });
+        }
+
+        /// <summary>Immediately sends the latest local dirty value, if any, through the document authority shape.</summary>
+        public async Task FlushAsync()
+        {
+            TDocument predicted;
+            lock (_gate)
+            {
+                ThrowIfDisposed();
+                if (!_dirty)
+                    return;
+                if (_flushing)
+                {
+                    _flushQueued = true;
+                    return;
+                }
+
+                CancelScheduledFlushLocked();
+                _flushing = true;
+                _dirty = false;
+                predicted = CultMeshDocumentHandle<TDocument>.CloneDocument(_current);
+            }
+
+            try
+            {
+                await _writer.WriteAsync(predicted).ConfigureAwait(false);
+            }
+            finally
+            {
+                var shouldFlushAgain = false;
+                lock (_gate)
+                {
+                    _flushing = false;
+                    shouldFlushAgain = _flushQueued || _dirty;
+                    _flushQueued = false;
+                }
+
+                if (shouldFlushAgain)
+                    await FlushAsync().ConfigureAwait(false);
+            }
+        }
+
+        /// <summary>Clears the most recent reconciliation metadata.</summary>
+        public void ClearReconciliation()
+        {
+            ThrowIfDisposed();
+            Reconciliation = null;
+        }
+
+        /// <inheritdoc />
+        public void Dispose()
+        {
+            lock (_gate)
+            {
+                if (_disposed)
+                    return;
+                _disposed = true;
+                CancelScheduledFlushLocked();
+            }
+
+            _subscription?.Dispose();
+        }
+
+        private void ApplyCanonicalSnapshot(TDocument canonical, long? sequence)
+        {
+            if (canonical == null)
+                return;
+
+            lock (_gate)
+            {
+                if (_disposed || sequence <= _appliedSequence)
+                    return;
+                _appliedSequence = sequence ?? _appliedSequence;
+
+                TDocument? replacement = null;
+                if (_dirty || _flushing)
+                {
+                    var delta = CreateReconciliationDelta(_current, canonical);
+                    if (delta.Count == 0)
+                    {
+                        Reconciliation = null;
+                        if (!_options.ReplaceDirtyCurrentOnCanonicalSnapshot)
+                            return;
+                    }
+                    else
+                    {
+                        var nextCanonical = CultMeshDocumentHandle<TDocument>.CloneDocument(canonical);
+                        var predicted = CultMeshDocumentHandle<TDocument>.CloneDocument(_current);
+                        replacement = nextCanonical;
+                        Reconciliation = new CultMeshReactiveDocumentReconciliation<TDocument>(
+                            nextCanonical,
+                            predicted,
+                            delta,
+                            ++_reconciliationVersion,
+                            DateTimeOffset.UtcNow);
+                        if (!_options.ReplaceDirtyCurrentOnCanonicalSnapshot)
+                            return;
+                    }
+                }
+
+                _current = replacement ?? CultMeshDocumentHandle<TDocument>.CloneDocument(canonical);
+                Reconciliation = null;
+            }
+        }
+
+        private void ScheduleFlushLocked()
+        {
+            if (_options.FlushDelay <= TimeSpan.Zero)
+            {
+                _ = Task.Run(FlushAsync);
+                return;
+            }
+
+            CancelScheduledFlushLocked();
+            var cancellation = new CancellationTokenSource();
+            _flushDelayCancellation = cancellation;
+            _ = FlushAfterDelayAsync(cancellation);
+        }
+
+        private async Task FlushAfterDelayAsync(CancellationTokenSource cancellation)
+        {
+            try
+            {
+                await _options.Clock.DelayAsync(_options.FlushDelay, cancellation.Token).ConfigureAwait(false);
+                lock (_gate)
+                {
+                    if (_disposed || cancellation.IsCancellationRequested)
+                        return;
+                }
+
+                await FlushAsync().ConfigureAwait(false);
+            }
+            catch (OperationCanceledException) when (cancellation.IsCancellationRequested)
+            {
+            }
+            finally
+            {
+                lock (_gate)
+                {
+                    if (ReferenceEquals(_flushDelayCancellation, cancellation))
+                        _flushDelayCancellation = null;
+                }
+
+                cancellation.Dispose();
+            }
+        }
+
+        private void CancelScheduledFlushLocked()
+        {
+            var cancellation = _flushDelayCancellation;
+            _flushDelayCancellation = null;
+            if (cancellation == null)
+                return;
+
+            cancellation.Cancel();
+        }
+
+        private static IReadOnlyDictionary<string, object?> CreateReconciliationDelta(
+            TDocument predicted,
+            TDocument canonical)
+        {
+            var delta = new Dictionary<string, object?>(StringComparer.Ordinal);
+            foreach (var member in ComparableMembers)
+            {
+                var predictedValue = member.GetValue(predicted);
+                var canonicalValue = member.GetValue(canonical);
+                if (CultMeshValuesEqual(predictedValue, canonicalValue))
+                    continue;
+
+                delta[member.Name] = TryCreateNumericDelta(predictedValue, canonicalValue, out var numericDelta)
+                    ? numericDelta
+                    : predictedValue;
+            }
+
+            return delta;
+        }
+
+        private static IEnumerable<CultMeshComparableMember> GetComparableMembers(Type documentType)
+        {
+            foreach (var property in documentType.GetProperties(BindingFlags.Instance | BindingFlags.Public))
+            {
+                if (property.GetMethod == null || property.GetIndexParameters().Length != 0)
+                    continue;
+                yield return new CultMeshComparableMember(property.Name, property.GetValue);
+            }
+
+            foreach (var field in documentType.GetFields(BindingFlags.Instance | BindingFlags.Public))
+            {
+                yield return new CultMeshComparableMember(field.Name, field.GetValue);
+            }
+        }
+
+        private static bool TryCreateNumericDelta(object? predicted, object? canonical, out object? delta)
+        {
+            delta = null;
+            if (predicted == null || canonical == null)
+                return false;
+            var predictedType = Nullable.GetUnderlyingType(predicted.GetType()) ?? predicted.GetType();
+            var canonicalType = Nullable.GetUnderlyingType(canonical.GetType()) ?? canonical.GetType();
+            if (!IsNumericType(predictedType) || !IsNumericType(canonicalType))
+                return false;
+
+            delta = Convert.ToDouble(predicted, CultureInfo.InvariantCulture) -
+                Convert.ToDouble(canonical, CultureInfo.InvariantCulture);
+            return true;
+        }
+
+        private static bool IsNumericType(Type type)
+        {
+            if (type.IsEnum)
+                return false;
+            return Type.GetTypeCode(type) switch
+            {
+                TypeCode.Byte or
+                TypeCode.SByte or
+                TypeCode.UInt16 or
+                TypeCode.UInt32 or
+                TypeCode.UInt64 or
+                TypeCode.Int16 or
+                TypeCode.Int32 or
+                TypeCode.Int64 or
+                TypeCode.Decimal or
+                TypeCode.Double or
+                TypeCode.Single => true,
+                _ => false
+            };
+        }
+
+        private static bool CultMeshValuesEqual(object? left, object? right)
+        {
+            if (ReferenceEquals(left, right))
+                return true;
+            if (left == null || right == null)
+                return false;
+            if (left.Equals(right))
+                return true;
+            if (left is string || right is string)
+                return false;
+            if (left is IEnumerable leftEnumerable && right is IEnumerable rightEnumerable)
+                return leftEnumerable.Cast<object?>().SequenceEqual(rightEnumerable.Cast<object?>());
+            return false;
+        }
+
+        private void ThrowIfDisposed()
+        {
+            if (_disposed)
+                throw new ObjectDisposedException(nameof(CultMeshReactiveDocument<TDocument>));
+        }
+
+        private readonly struct CultMeshComparableMember
+        {
+            public CultMeshComparableMember(string name, Func<object, object?> getValue)
+            {
+                Name = name;
+                GetValue = getValue;
+            }
+
+            public string Name { get; }
+
+            public Func<object, object?> GetValue { get; }
+        }
+    }
+
+    /// <summary>
+    /// Schema-aware lookup table for typed CultMesh document handles.
+    /// </summary>
+    public sealed class CultMeshDocumentCatalog
+    {
+        private readonly IReadOnlyList<ICultMeshDocumentHandle> _documents;
+        private readonly IReadOnlyDictionary<Type, ICultMeshDocumentHandle> _documentsByType;
+        private readonly IReadOnlyDictionary<string, ICultMeshDocumentHandle> _documentsBySchema;
+
+        /// <summary>Creates a document catalog from known handles.</summary>
+        public CultMeshDocumentCatalog(IEnumerable<ICultMeshDocumentHandle> documents)
+        {
+            if (documents == null) throw new ArgumentNullException(nameof(documents));
+
+            var documentList = documents
+                .Where(document => document != null)
+                .ToArray();
+            var byType = new Dictionary<Type, ICultMeshDocumentHandle>();
+            var bySchema = new Dictionary<string, ICultMeshDocumentHandle>(StringComparer.Ordinal);
+            foreach (var document in documentList)
+            {
+                byType[document.DocumentType] = document;
+                if (!string.IsNullOrWhiteSpace(document.SchemaId))
+                    bySchema[document.SchemaId] = document;
+                if (!string.IsNullOrWhiteSpace(document.SchemaVersion))
+                    bySchema[document.SchemaVersion] = document;
+                if (!string.IsNullOrWhiteSpace(document.SchemaName))
+                    bySchema[document.SchemaName] = document;
+            }
+
+            _documents = documentList;
+            _documentsByType = byType;
+            _documentsBySchema = bySchema;
+        }
+
+        /// <summary>Gets the handles in this catalog.</summary>
+        public IReadOnlyList<ICultMeshDocumentHandle> Documents => _documents;
+
+        /// <summary>Looks up a document handle by schema id, shared schema name, or schema version.</summary>
+        public bool TryGetDocumentBySchema(
+            string schema,
+            out ICultMeshDocumentHandle document)
+        {
+            if (!string.IsNullOrWhiteSpace(schema) &&
+                _documentsBySchema.TryGetValue(schema, out document!))
+            {
+                return true;
+            }
+
+            document = null!;
+            return false;
+        }
+
+        /// <summary>Looks up a document handle by schema id, shared schema name, or schema version.</summary>
+        public ICultMeshDocumentHandle DocumentBySchema(string schema)
+        {
+            if (TryGetDocumentBySchema(schema, out var document))
+                return document;
+
+            throw new NotSupportedException(
+                $"CultMesh document catalog does not expose a document for schema '{schema}'.");
+        }
+
+        /// <summary>Looks up a typed document handle by CLR type or same-schema alias.</summary>
+        public bool TryGetDocument<TDocument>(
+            out CultMeshDocumentHandle<TDocument> document)
+            where TDocument : class
+        {
+            if (_documentsByType.TryGetValue(typeof(TDocument), out var untypedDocument) &&
+                untypedDocument is CultMeshDocumentHandle<TDocument> typedDocument)
+            {
+                document = typedDocument;
+                return true;
+            }
+
+            var descriptor = CultDocumentRegistry.Shared.GetRequired<TDocument>();
+            if (_documentsBySchema.TryGetValue(descriptor.SchemaVersion, out var schemaDocument) ||
+                _documentsBySchema.TryGetValue(descriptor.SchemaName, out schemaDocument!))
+            {
+                if (schemaDocument is CultMeshDocumentHandle<TDocument> schemaTypedDocument)
+                {
+                    document = schemaTypedDocument;
+                    return true;
+                }
+
+                document = schemaDocument.AsSchemaAlias<TDocument>();
+                return true;
+            }
+
+            document = null!;
+            return false;
+        }
+
+        /// <summary>Looks up a typed document handle by CLR type or same-schema alias.</summary>
+        public CultMeshDocumentHandle<TDocument> Document<TDocument>()
+            where TDocument : class
+        {
+            if (TryGetDocument<TDocument>(out var document))
+                return document;
+
+            throw new NotSupportedException(
+                $"CultMesh document catalog does not expose a document for {typeof(TDocument).FullName}.");
+        }
+
+        /// <summary>Reads one typed document snapshot by CLR type or same-schema alias.</summary>
+        public Task<TDocument> LatestAsync<TDocument>()
+            where TDocument : class
+        {
+            return Document<TDocument>().LatestAsync();
+        }
+
+        /// <summary>Reads one typed document synchronously by CLR type or same-schema alias.</summary>
+        public TDocument Latest<TDocument>()
+            where TDocument : class
+        {
+            return Document<TDocument>().Latest();
+        }
+
+        /// <summary>Gets whether one typed document can be replaced by CLR type or same-schema alias.</summary>
+        public bool CanReplace<TDocument>()
+            where TDocument : class
+        {
+            return TryGetDocument<TDocument>(out var document) && document.CanReplace;
+        }
+
+        /// <summary>Replaces one typed document by CLR type or same-schema alias.</summary>
+        public Task ReplaceAsync<TDocument>(TDocument value)
+            where TDocument : class
+        {
+            return Document<TDocument>().ReplaceAsync(value);
+        }
+
+        /// <summary>Gets whether one typed document can submit client predictions by CLR type or same-schema alias.</summary>
+        public bool CanSubmitPrediction<TDocument>()
+            where TDocument : class
+        {
+            return TryGetDocument<TDocument>(out var document) && document.CanSubmitPrediction;
+        }
+
+        /// <summary>Submits a client prediction for one typed document by CLR type or same-schema alias.</summary>
+        public Task SubmitPredictionAsync<TDocument>(TDocument value)
+            where TDocument : class
+        {
+            return Document<TDocument>().SubmitPredictionAsync(value);
+        }
+
+        /// <summary>Gets an explicit authoritative writer by CLR type or same-schema alias.</summary>
+        public CultMeshDocumentWriter<TDocument> AuthoritativeWriter<TDocument>()
+            where TDocument : class
+        {
+            return Document<TDocument>().AuthoritativeWriter();
+        }
+
+        /// <summary>Gets an explicit prediction writer by CLR type or same-schema alias.</summary>
+        public CultMeshDocumentWriter<TDocument> PredictionWriter<TDocument>()
+            where TDocument : class
+        {
+            return Document<TDocument>().PredictionWriter();
+        }
+
+        /// <summary>Watches one typed document by CLR type or same-schema alias.</summary>
+        public Observable<TDocument> Watch<TDocument>()
+            where TDocument : class
+        {
+            return Document<TDocument>().Watch();
+        }
+
+        /// <summary>Subscribes to one typed document by CLR type or same-schema alias.</summary>
+        public IDisposable Watch<TDocument>(Action<TDocument> onNext)
+            where TDocument : class
+        {
+            return Document<TDocument>().Watch(onNext);
+        }
+
+    }
+
+    /// <summary>
+    /// Inspectable typed collection handle exposed by CultMesh.
+    /// </summary>
+    public interface ICultMeshCollectionHandle
+    {
+        /// <summary>Gets the CLR document type presented by this collection.</summary>
+        Type DocumentType { get; }
+
+        /// <summary>Gets the semantic collection id.</summary>
+        string CollectionId { get; }
+
+        /// <summary>Gets the stable CultCache schema name.</summary>
+        string SchemaName { get; }
+
+        /// <summary>Gets the stable CultCache schema version.</summary>
+        string SchemaVersion { get; }
+
+        /// <summary>Gets the content-derived schema identifier.</summary>
+        string SchemaId { get; }
+
+        /// <summary>Gets the preferred or observed route for collection access.</summary>
+        CultMeshRouteHint RouteHint { get; }
+
+        /// <summary>Gets typed state sources this collection handle depends on, when known.</summary>
+        IReadOnlyList<CultMeshProjectionSource> Sources { get; }
+
+        /// <summary>Creates a same-schema alias presentation for another CLR document type.</summary>
+        CultMeshCollectionHandle<TAlias> AsSchemaAlias<TAlias>() where TAlias : class;
+    }
+
+    /// <summary>
+    /// Schema-aware lookup table for typed CultMesh collection handles.
+    /// </summary>
+    public sealed class CultMeshCollectionCatalog
+    {
+        private readonly IReadOnlyList<ICultMeshCollectionHandle> _collections;
+        private readonly IReadOnlyDictionary<Type, ICultMeshCollectionHandle> _collectionsByType;
+        private readonly IReadOnlyDictionary<string, ICultMeshCollectionHandle> _collectionsBySchema;
+
+        /// <summary>Creates a collection catalog from known handles.</summary>
+        public CultMeshCollectionCatalog(IEnumerable<ICultMeshCollectionHandle> collections)
+        {
+            if (collections == null) throw new ArgumentNullException(nameof(collections));
+
+            var collectionList = collections
+                .Where(collection => collection != null)
+                .ToArray();
+            var byType = new Dictionary<Type, ICultMeshCollectionHandle>();
+            var bySchema = new Dictionary<string, ICultMeshCollectionHandle>(StringComparer.Ordinal);
+            foreach (var collection in collectionList)
+            {
+                byType[collection.DocumentType] = collection;
+                if (!string.IsNullOrWhiteSpace(collection.SchemaId))
+                    bySchema[collection.SchemaId] = collection;
+                if (!string.IsNullOrWhiteSpace(collection.SchemaVersion))
+                    bySchema[collection.SchemaVersion] = collection;
+                if (!string.IsNullOrWhiteSpace(collection.SchemaName))
+                    bySchema[collection.SchemaName] = collection;
+            }
+
+            _collections = collectionList;
+            _collectionsByType = byType;
+            _collectionsBySchema = bySchema;
+        }
+
+        /// <summary>Gets the handles in this catalog.</summary>
+        public IReadOnlyList<ICultMeshCollectionHandle> Collections => _collections;
+
+        /// <summary>Looks up a collection handle by schema id, shared schema name, or schema version.</summary>
+        public bool TryGetCollectionBySchema(
+            string schema,
+            out ICultMeshCollectionHandle collection)
+        {
+            if (!string.IsNullOrWhiteSpace(schema) &&
+                _collectionsBySchema.TryGetValue(schema, out collection!))
+            {
+                return true;
+            }
+
+            collection = null!;
+            return false;
+        }
+
+        /// <summary>Looks up a collection handle by schema id, shared schema name, or schema version.</summary>
+        public ICultMeshCollectionHandle CollectionBySchema(string schema)
+        {
+            if (TryGetCollectionBySchema(schema, out var collection))
+                return collection;
+
+            throw new NotSupportedException(
+                $"CultMesh collection catalog does not expose a collection for schema '{schema}'.");
+        }
+
+        /// <summary>Looks up a typed collection handle by CLR type or same-schema alias.</summary>
+        public bool TryGetCollection<TDocument>(
+            out CultMeshCollectionHandle<TDocument> collection)
+            where TDocument : class
+        {
+            if (_collectionsByType.TryGetValue(typeof(TDocument), out var untypedCollection) &&
+                untypedCollection is CultMeshCollectionHandle<TDocument> typedCollection)
+            {
+                collection = typedCollection;
+                return true;
+            }
+
+            var descriptor = CultDocumentRegistry.Shared.GetRequired<TDocument>();
+            if (_collectionsBySchema.TryGetValue(descriptor.SchemaId, out var schemaCollection) ||
+                _collectionsBySchema.TryGetValue(descriptor.SchemaVersion, out schemaCollection!) ||
+                _collectionsBySchema.TryGetValue(descriptor.SchemaName, out schemaCollection!))
+            {
+                if (schemaCollection is CultMeshCollectionHandle<TDocument> schemaTypedCollection)
+                {
+                    collection = schemaTypedCollection;
+                    return true;
+                }
+
+                collection = schemaCollection.AsSchemaAlias<TDocument>();
+                return true;
+            }
+
+            collection = null!;
+            return false;
+        }
+
+        /// <summary>Looks up a typed collection handle by CLR type or same-schema alias.</summary>
+        public CultMeshCollectionHandle<TDocument> Collection<TDocument>()
+            where TDocument : class
+        {
+            if (TryGetCollection<TDocument>(out var collection))
+                return collection;
+
+            throw new NotSupportedException(
+                $"CultMesh collection catalog does not expose a collection for {typeof(TDocument).FullName}.");
+        }
+
+        /// <summary>Reads one typed collection snapshot by CLR type or same-schema alias.</summary>
+        public Task<IReadOnlyList<TDocument>> LatestAsync<TDocument>()
+            where TDocument : class
+        {
+            return Collection<TDocument>().LatestAsync();
+        }
+
+        /// <summary>Watches one typed collection by CLR type or same-schema alias.</summary>
+        public Observable<CultMeshCollectionChange<TDocument>> WatchChanges<TDocument>()
+            where TDocument : class
+        {
+            return Collection<TDocument>().WatchChanges();
+        }
+
+        /// <summary>Subscribes to one typed collection by CLR type or same-schema alias.</summary>
+        public IDisposable WatchChanges<TDocument>(Action<CultMeshCollectionChange<TDocument>> onNext)
+            where TDocument : class
+        {
+            return Collection<TDocument>().WatchChanges(onNext);
+        }
+    }
+
+    /// <summary>
+    /// Describes how a CultMesh collection document changed.
+    /// </summary>
+    public enum CultMeshCollectionChangeKind
+    {
+        /// <summary>A document was added.</summary>
+        Added,
+        /// <summary>A document was updated.</summary>
+        Updated,
+        /// <summary>A document was removed.</summary>
+        Removed,
+        /// <summary>A local prediction was published before authority accepted it.</summary>
+        Predicted,
+        /// <summary>A predicted document was reconciled with authority.</summary>
+        Reconciled,
+        /// <summary>A document was accepted through schema migration.</summary>
+        SchemaMigrated,
+        /// <summary>A document change was rejected.</summary>
+        Rejected
+    }
+
+    /// <summary>
+    /// One typed document change observed through a CultMesh collection handle.
+    /// </summary>
+    public sealed class CultMeshCollectionChange<TDocument>
+        where TDocument : class
+    {
+        /// <summary>Creates a collection change.</summary>
+        public CultMeshCollectionChange(
+            CultMeshCollectionChangeKind kind,
+            CultRecordKey key,
+            string schemaId,
+            TDocument? document,
+            TDocument? previousDocument,
+            string? message = null)
+        {
+            Kind = kind;
+            Key = key;
+            SchemaId = schemaId ?? "";
+            Document = document;
+            PreviousDocument = previousDocument;
+            Message = message;
+        }
+
+        /// <summary>Gets the change kind.</summary>
+        public CultMeshCollectionChangeKind Kind { get; }
+
+        /// <summary>Gets the changed record key.</summary>
+        public CultRecordKey Key { get; }
+
+        /// <summary>Gets the schema id of the changed document.</summary>
+        public string SchemaId { get; }
+
+        /// <summary>Gets the current document, when present.</summary>
+        public TDocument? Document { get; }
+
+        /// <summary>Gets the previous document, when present.</summary>
+        public TDocument? PreviousDocument { get; }
+
+        /// <summary>Gets an optional rejection or diagnostic message.</summary>
+        public string? Message { get; }
+    }
+
+    /// <summary>
+    /// Typed reactive collection handle with schema-aware alias conversion.
+    /// </summary>
+    public sealed class CultMeshCollectionHandle<TDocument> : ICultMeshCollectionHandle
+        where TDocument : class
+    {
+        private static readonly CultDocumentDescriptor Descriptor =
+            CultDocumentRegistry.Shared.GetRequired<TDocument>();
+
+        private readonly Func<Task<IReadOnlyList<TDocument>>> _latest;
+        private readonly Func<Observable<CultMeshCollectionChange<TDocument>>> _watchChanges;
+
+        /// <summary>Creates a collection handle.</summary>
+        public CultMeshCollectionHandle(
+            string collectionId,
+            Func<Task<IReadOnlyList<TDocument>>> latest,
+            Func<Observable<CultMeshCollectionChange<TDocument>>> watchChanges,
+            IEnumerable<CultMeshProjectionSource>? sources = null,
+            CultMeshRouteHint? routeHint = null)
+        {
+            CollectionId = string.IsNullOrWhiteSpace(collectionId)
+                ? throw new ArgumentException("Value must be non-empty.", nameof(collectionId))
+                : collectionId;
+            _latest = latest ?? throw new ArgumentNullException(nameof(latest));
+            _watchChanges = watchChanges ?? throw new ArgumentNullException(nameof(watchChanges));
+            Sources = sources?.ToArray() ?? Array.Empty<CultMeshProjectionSource>();
+            RouteHint = routeHint ?? CultMeshRouteHint.Automatic;
+        }
+
+        /// <summary>Gets the semantic collection id.</summary>
+        public string CollectionId { get; }
+
+        /// <summary>Gets the CLR document type presented by this collection.</summary>
+        public Type DocumentType => typeof(TDocument);
+
+        /// <summary>Gets the stable CultCache schema name.</summary>
+        public string SchemaName => Descriptor.SchemaName;
+
+        /// <summary>Gets the stable CultCache schema version.</summary>
+        public string SchemaVersion => Descriptor.SchemaVersion;
+
+        /// <summary>Gets the content-derived schema identifier.</summary>
+        public string SchemaId => Descriptor.SchemaId;
+
+        /// <summary>Gets the preferred or observed route for collection access.</summary>
+        public CultMeshRouteHint RouteHint { get; }
+
+        /// <summary>Gets typed state sources this collection handle depends on, when known.</summary>
+        public IReadOnlyList<CultMeshProjectionSource> Sources { get; }
+
+        /// <summary>Reads one coherent collection snapshot.</summary>
+        public Task<IReadOnlyList<TDocument>> LatestAsync()
+        {
+            return _latest();
+        }
+
+        /// <summary>Watches typed collection changes.</summary>
+        public Observable<CultMeshCollectionChange<TDocument>> WatchChanges()
+        {
+            return _watchChanges();
+        }
+
+        /// <summary>Subscribes to typed collection changes.</summary>
+        public IDisposable WatchChanges(Action<CultMeshCollectionChange<TDocument>> onNext)
+        {
+            if (onNext == null) throw new ArgumentNullException(nameof(onNext));
+            return WatchChanges().Subscribe(onNext);
+        }
+
+        /// <summary>Creates a same-schema alias presentation for another CLR document type.</summary>
+        public CultMeshCollectionHandle<TAlias> AsSchemaAlias<TAlias>() where TAlias : class
+        {
+            var aliasDescriptor = CultDocumentRegistry.Shared.GetRequired<TAlias>();
+            if (!string.Equals(Descriptor.SchemaName, aliasDescriptor.SchemaName, StringComparison.Ordinal) ||
+                !string.Equals(Descriptor.SchemaVersion, aliasDescriptor.SchemaVersion, StringComparison.Ordinal))
+            {
+                throw new InvalidOperationException(
+                    $"Document type {typeof(TAlias).FullName} uses schema '{aliasDescriptor.SchemaName}' " +
+                    $"version '{aliasDescriptor.SchemaVersion}', but collection '{CollectionId}' exposes " +
+                    $"schema '{SchemaName}' version '{SchemaVersion}'.");
+            }
+
+            return new CultMeshCollectionHandle<TAlias>(
+                CollectionId,
+                async () => (await LatestAsync().ConfigureAwait(false))
+                    .Select(ConvertDocument<TDocument, TAlias>)
+                    .ToArray(),
+                () => WatchChanges().Select(change => new CultMeshCollectionChange<TAlias>(
+                    change.Kind,
+                    change.Key,
+                    change.SchemaId,
+                    change.Document == null ? null : ConvertDocument<TDocument, TAlias>(change.Document),
+                    change.PreviousDocument == null ? null : ConvertDocument<TDocument, TAlias>(change.PreviousDocument),
+                    change.Message)),
+                Sources,
+                RouteHint);
+        }
+
+        private static TTarget ConvertDocument<TSource, TTarget>(TSource document)
+            where TSource : class
+            where TTarget : class
+        {
+            if (document == null) throw new ArgumentNullException(nameof(document));
+            if (document is TTarget alreadyTyped)
+            {
+                return alreadyTyped;
+            }
+
+            var payload = CultDocumentMessagePackSerialization.SerializeUntyped(document, typeof(TSource));
+            return (TTarget)CultDocumentMessagePackSerialization.DeserializeUntyped(typeof(TTarget), payload);
+        }
+    }
+
+    /// <summary>
+    /// Inspectable metadata for a typed live feed surface.
+    /// </summary>
+    public sealed class CultMeshLiveFeedDiagnostic
+    {
+        /// <summary>Creates live feed diagnostics.</summary>
+        public CultMeshLiveFeedDiagnostic(
+            string feedId,
+            CultMeshRouteHint? routeHint = null,
+            IEnumerable<CultMeshProjectionSource>? sources = null)
+        {
+            FeedId = RequireNonEmpty(feedId, nameof(feedId));
+            RouteHint = routeHint ?? CultMeshRouteHint.Automatic;
+            Sources = sources?.ToArray() ?? Array.Empty<CultMeshProjectionSource>();
+        }
+
+        /// <summary>Gets the semantic feed id.</summary>
+        public string FeedId { get; }
+
+        /// <summary>Gets the preferred or observed route for the feed.</summary>
+        public CultMeshRouteHint RouteHint { get; }
+
+        /// <summary>Gets the typed state sources this live feed depends on, when known.</summary>
+        public IReadOnlyList<CultMeshProjectionSource> Sources { get; }
+
+        private static string RequireNonEmpty(string value, string paramName)
+        {
+            return string.IsNullOrWhiteSpace(value)
+                ? throw new ArgumentException("Value must be non-empty.", paramName)
+                : value;
+        }
+    }
+
+    /// <summary>
+    /// Inspectable metadata for a typed query surface.
+    /// </summary>
+    public sealed class CultMeshQuerySurfaceDiagnostic
+    {
+        /// <summary>Creates query surface diagnostics.</summary>
+        public CultMeshQuerySurfaceDiagnostic(
+            string queryId,
+            CultMeshRouteHint? routeHint = null,
+            IEnumerable<CultMeshProjectionSource>? sources = null)
+        {
+            QueryId = RequireNonEmpty(queryId, nameof(queryId));
+            RouteHint = routeHint ?? CultMeshRouteHint.Automatic;
+            Sources = sources?.ToArray() ?? Array.Empty<CultMeshProjectionSource>();
+        }
+
+        /// <summary>Gets the semantic query id.</summary>
+        public string QueryId { get; }
+
+        /// <summary>Gets the preferred or observed route for the query.</summary>
+        public CultMeshRouteHint RouteHint { get; }
+
+        /// <summary>Gets the typed state sources this query depends on, when known.</summary>
+        public IReadOnlyList<CultMeshProjectionSource> Sources { get; }
+
+        private static string RequireNonEmpty(string value, string paramName)
+        {
+            return string.IsNullOrWhiteSpace(value)
+                ? throw new ArgumentException("Value must be non-empty.", paramName)
+                : value;
+        }
+    }
+
+    /// <summary>
+    /// Inspectable metadata for a typed operation handle.
+    /// </summary>
+    public sealed class CultMeshOperationHandleDiagnostic
+    {
+        /// <summary>Creates operation handle diagnostics.</summary>
+        public CultMeshOperationHandleDiagnostic(string operationId)
+        {
+            OperationId = RequireNonEmpty(operationId, nameof(operationId));
+        }
+
+        /// <summary>Gets the semantic operation id.</summary>
+        public string OperationId { get; }
+
+        private static string RequireNonEmpty(string value, string paramName)
+        {
+            return string.IsNullOrWhiteSpace(value)
+                ? throw new ArgumentException("Value must be non-empty.", paramName)
+                : value;
+        }
+    }
+
+    /// <summary>
+    /// Inspectable metadata for a typed state pointer.
+    /// </summary>
+    public sealed class CultMeshStatePointerDiagnostic
+    {
+        /// <summary>Creates state pointer diagnostics.</summary>
+        public CultMeshStatePointerDiagnostic(
+            string pointerId,
+            CultMeshRouteHint? routeHint = null,
+            IEnumerable<CultMeshProjectionSource>? sources = null)
+        {
+            PointerId = RequireNonEmpty(pointerId, nameof(pointerId));
+            RouteHint = routeHint ?? CultMeshRouteHint.Automatic;
+            Sources = sources?.ToArray() ?? Array.Empty<CultMeshProjectionSource>();
+        }
+
+        /// <summary>Gets the semantic pointer id.</summary>
+        public string PointerId { get; }
+
+        /// <summary>Gets the preferred or observed route for pointer resolution.</summary>
+        public CultMeshRouteHint RouteHint { get; }
+
+        /// <summary>Gets typed state sources this pointer depends on, when known.</summary>
+        public IReadOnlyList<CultMeshProjectionSource> Sources { get; }
+
+        private static string RequireNonEmpty(string value, string paramName)
+        {
+            return string.IsNullOrWhiteSpace(value)
+                ? throw new ArgumentException("Value must be non-empty.", paramName)
+                : value;
+        }
+    }
+
+    /// <summary>
+    /// Inspectable metadata for a typed projection recipe.
+    /// </summary>
+    public sealed class CultMeshProjectionRecipeDiagnostic
+    {
+        /// <summary>Creates projection recipe diagnostics.</summary>
+        public CultMeshProjectionRecipeDiagnostic(
+            string projectionId,
+            CultMeshRouteHint? routeHint = null,
+            IEnumerable<CultMeshProjectionSource>? sources = null)
+        {
+            ProjectionId = RequireNonEmpty(projectionId, nameof(projectionId));
+            RouteHint = routeHint ?? CultMeshRouteHint.Automatic;
+            Sources = sources?.ToArray() ?? Array.Empty<CultMeshProjectionSource>();
+        }
+
+        /// <summary>Gets the semantic projection id.</summary>
+        public string ProjectionId { get; }
+
+        /// <summary>Gets the preferred or observed route for the projection.</summary>
+        public CultMeshRouteHint RouteHint { get; }
+
+        /// <summary>Gets the typed state sources this projection depends on, when known.</summary>
+        public IReadOnlyList<CultMeshProjectionSource> Sources { get; }
+
+        private static string RequireNonEmpty(string value, string paramName)
+        {
+            return string.IsNullOrWhiteSpace(value)
+                ? throw new ArgumentException("Value must be non-empty.", paramName)
+                : value;
+        }
+    }
+
+    /// <summary>
+    /// Names the kind of typed surface described in a CultMesh surface catalog.
+    /// </summary>
+    public enum CultMeshSurfaceKind
+    {
+        /// <summary>A typed derived-state query surface.</summary>
+        Query,
+
+        /// <summary>A reusable typed projection recipe.</summary>
+        ProjectionRecipe,
+
+        /// <summary>A coherent live view feed.</summary>
+        LiveFeed,
+
+        /// <summary>A typed operation handle.</summary>
+        Operation,
+
+        /// <summary>A typed reactive document handle.</summary>
+        Document,
+
+        /// <summary>A typed reactive collection handle.</summary>
+        Collection,
+
+        /// <summary>A typed pointer to Verse state.</summary>
+        StatePointer,
+
+        /// <summary>A native slice or slab view.</summary>
+        NativeSliceView
+    }
+
+    /// <summary>
+    /// One inspectable typed surface advertised by a runtime.
+    /// </summary>
+    public sealed class CultMeshSurfaceDiagnostic
+    {
+        /// <summary>Creates a surface diagnostic.</summary>
+        public CultMeshSurfaceDiagnostic(
+            CultMeshSurfaceKind kind,
+            string surfaceId,
+            CultMeshRouteHint? routeHint = null,
+            IEnumerable<CultMeshProjectionSource>? sources = null)
+        {
+            Kind = kind;
+            SurfaceId = RequireNonEmpty(surfaceId, nameof(surfaceId));
+            RouteHint = routeHint ?? CultMeshRouteHint.Automatic;
+            Sources = sources?.ToArray() ?? Array.Empty<CultMeshProjectionSource>();
+        }
+
+        /// <summary>Gets the kind of surface.</summary>
+        public CultMeshSurfaceKind Kind { get; }
+
+        /// <summary>Gets the semantic surface id.</summary>
+        public string SurfaceId { get; }
+
+        /// <summary>Gets the preferred or observed route for the surface.</summary>
+        public CultMeshRouteHint RouteHint { get; }
+
+        /// <summary>Gets typed state sources this surface depends on, when known.</summary>
+        public IReadOnlyList<CultMeshProjectionSource> Sources { get; }
+
+        private static string RequireNonEmpty(string value, string paramName)
+        {
+            return string.IsNullOrWhiteSpace(value)
+                ? throw new ArgumentException("Value must be non-empty.", paramName)
+                : value;
+        }
+    }
+
+    /// <summary>
+    /// Inspectable catalog of typed surfaces exposed by a runtime or generated binding.
+    /// </summary>
+    public sealed class CultMeshSurfaceCatalogDiagnostic
+    {
+        /// <summary>Creates a surface catalog diagnostic.</summary>
+        public CultMeshSurfaceCatalogDiagnostic(
+            string catalogId,
+            IEnumerable<CultMeshSurfaceDiagnostic> surfaces)
+        {
+            CatalogId = RequireNonEmpty(catalogId, nameof(catalogId));
+            Surfaces = (surfaces ?? throw new ArgumentNullException(nameof(surfaces))).ToArray();
+        }
+
+        /// <summary>Gets the semantic catalog id.</summary>
+        public string CatalogId { get; }
+
+        /// <summary>Gets the advertised typed surfaces.</summary>
+        public IReadOnlyList<CultMeshSurfaceDiagnostic> Surfaces { get; }
+
+        /// <summary>Finds a surface by semantic id.</summary>
+        public CultMeshSurfaceDiagnostic? Find(string surfaceId)
+        {
+            if (string.IsNullOrWhiteSpace(surfaceId)) return null;
+            return Surfaces.FirstOrDefault(surface => string.Equals(surface.SurfaceId, surfaceId, StringComparison.Ordinal));
+        }
+
+        /// <summary>Finds surfaces by kind in catalog order.</summary>
+        public IReadOnlyList<CultMeshSurfaceDiagnostic> FindByKind(CultMeshSurfaceKind kind)
+        {
+            return Surfaces.Where(surface => surface.Kind == kind).ToArray();
+        }
+
+        /// <summary>Groups surfaces by kind for generated bindings and tooling.</summary>
+        public CultMeshSurfaceCatalogIndexDiagnostic IndexByKind()
+        {
+            return new CultMeshSurfaceCatalogIndexDiagnostic(this);
+        }
+
+        private static string RequireNonEmpty(string value, string paramName)
+        {
+            return string.IsNullOrWhiteSpace(value)
+                ? throw new ArgumentException("Value must be non-empty.", paramName)
+                : value;
+        }
+    }
+
+    /// <summary>
+    /// Kind-indexed view of a typed surface catalog for generated bindings, UI runtimes, and tools.
+    /// </summary>
+    public sealed class CultMeshSurfaceCatalogIndexDiagnostic
+    {
+        /// <summary>Creates a kind-indexed catalog diagnostic.</summary>
+        public CultMeshSurfaceCatalogIndexDiagnostic(CultMeshSurfaceCatalogDiagnostic catalog)
+        {
+            if (catalog == null) throw new ArgumentNullException(nameof(catalog));
+            CatalogId = catalog.CatalogId;
+            Queries = catalog.FindByKind(CultMeshSurfaceKind.Query);
+            ProjectionRecipes = catalog.FindByKind(CultMeshSurfaceKind.ProjectionRecipe);
+            LiveFeeds = catalog.FindByKind(CultMeshSurfaceKind.LiveFeed);
+            Operations = catalog.FindByKind(CultMeshSurfaceKind.Operation);
+            Documents = catalog.FindByKind(CultMeshSurfaceKind.Document);
+            Collections = catalog.FindByKind(CultMeshSurfaceKind.Collection);
+            StatePointers = catalog.FindByKind(CultMeshSurfaceKind.StatePointer);
+            NativeSliceViews = catalog.FindByKind(CultMeshSurfaceKind.NativeSliceView);
+        }
+
+        /// <summary>Gets the semantic catalog id.</summary>
+        public string CatalogId { get; }
+
+        /// <summary>Gets typed derived-state query surfaces.</summary>
+        public IReadOnlyList<CultMeshSurfaceDiagnostic> Queries { get; }
+
+        /// <summary>Gets reusable typed projection recipes.</summary>
+        public IReadOnlyList<CultMeshSurfaceDiagnostic> ProjectionRecipes { get; }
+
+        /// <summary>Gets coherent live view feeds.</summary>
+        public IReadOnlyList<CultMeshSurfaceDiagnostic> LiveFeeds { get; }
+
+        /// <summary>Gets typed operation handles.</summary>
+        public IReadOnlyList<CultMeshSurfaceDiagnostic> Operations { get; }
+
+        /// <summary>Gets typed reactive document handles.</summary>
+        public IReadOnlyList<CultMeshSurfaceDiagnostic> Documents { get; }
+
+        /// <summary>Gets typed reactive collection handles.</summary>
+        public IReadOnlyList<CultMeshSurfaceDiagnostic> Collections { get; }
+
+        /// <summary>Gets typed pointers to Verse state.</summary>
+        public IReadOnlyList<CultMeshSurfaceDiagnostic> StatePointers { get; }
+
+        /// <summary>Gets native slice or slab views.</summary>
+        public IReadOnlyList<CultMeshSurfaceDiagnostic> NativeSliceViews { get; }
+    }
+
+    /// <summary>
+    /// Options for a polling watch fallback over a typed query or live feed snapshot.
+    /// </summary>
+    public sealed class CultMeshPollingWatchOptions<TResult>
+    {
+        /// <summary>Creates polling watch options.</summary>
+        public CultMeshPollingWatchOptions(
+            TimeSpan? interval = null,
+            bool emitInitial = true,
+            IEqualityComparer<TResult>? comparer = null)
+        {
+            Interval = interval ?? TimeSpan.FromMilliseconds(50);
+            if (Interval <= TimeSpan.Zero)
+            {
+                throw new ArgumentOutOfRangeException(nameof(interval), "Polling interval must be positive.");
+            }
+
+            EmitInitial = emitInitial;
+            Comparer = comparer ?? EqualityComparer<TResult>.Default;
+        }
+
+        /// <summary>Gets the polling interval.</summary>
+        public TimeSpan Interval { get; }
+
+        /// <summary>Gets whether the first sampled value should be emitted.</summary>
+        public bool EmitInitial { get; }
+
+        /// <summary>Gets the equality comparer used to suppress unchanged samples.</summary>
+        public IEqualityComparer<TResult> Comparer { get; }
+    }
+
+    /// <summary>
+    /// Timer-backed fallback watcher for runtimes that do not yet have native reactive transport.
+    /// </summary>
+    internal sealed class CultMeshPollingWatcher<TParameters, TResult> : IDisposable
+    {
+        private readonly Func<TParameters, CultMeshQueryContext, Task<TResult>> _sample;
+        private readonly CultMeshPollingWatchOptions<TResult> _options;
+        private readonly Subject<TResult> _subject = new();
+        private readonly Timer _timer;
+        private readonly object _gate = new();
+        private readonly TParameters _parameters;
+        private readonly CultMeshQueryContext _context;
+        private TResult? _last;
+        private bool _hasLast;
+        private bool _running;
+        private bool _disposed;
+
+        public CultMeshPollingWatcher(
+            Func<TParameters, CultMeshQueryContext, Task<TResult>> sample,
+            TParameters parameters,
+            CultMeshQueryContext context,
+            CultMeshPollingWatchOptions<TResult> options)
+        {
+            _sample = sample ?? throw new ArgumentNullException(nameof(sample));
+            _parameters = parameters;
+            _context = context ?? throw new ArgumentNullException(nameof(context));
+            _options = options ?? throw new ArgumentNullException(nameof(options));
+            _timer = new Timer(OnTimer, null, TimeSpan.Zero, _options.Interval);
+        }
+
+        public Observable<TResult> Observable => _subject;
+
+        public void Dispose()
+        {
+            lock (_gate)
+            {
+                if (_disposed)
+                {
+                    return;
+                }
+
+                _disposed = true;
+            }
+
+            _timer.Dispose();
+            _subject.Dispose();
+        }
+
+        private void OnTimer(object? _)
+        {
+            lock (_gate)
+            {
+                if (_disposed || _running)
+                {
+                    return;
+                }
+
+                _running = true;
+            }
+
+            _ = SampleAsync();
+        }
+
+        private async Task SampleAsync()
+        {
+            try
+            {
+                var next = await _sample(_parameters, _context).ConfigureAwait(false);
+                var shouldEmit = false;
+                lock (_gate)
+                {
+                    if (_disposed)
+                    {
+                        return;
+                    }
+
+                    shouldEmit = _hasLast
+                        ? !_options.Comparer.Equals(_last!, next)
+                        : _options.EmitInitial;
+                    _last = next;
+                    _hasLast = true;
+                }
+
+                if (shouldEmit)
+                {
+                    _subject.OnNext(next);
+                }
+            }
+            finally
+            {
+                lock (_gate)
+                {
+                    _running = false;
+                }
+            }
+        }
+    }
+
+    internal sealed class CultMeshCompositeDisposable : IDisposable
+    {
+        private readonly IDisposable[] _disposables;
+        private int _disposed;
+
+        public CultMeshCompositeDisposable(params IDisposable[] disposables)
+        {
+            _disposables = disposables ?? throw new ArgumentNullException(nameof(disposables));
+        }
+
+        public void Dispose()
+        {
+            if (Interlocked.Exchange(ref _disposed, 1) != 0)
+            {
+                return;
+            }
+
+            foreach (var disposable in _disposables)
+            {
+                disposable.Dispose();
+            }
+        }
+    }
+
+    /// <summary>
+    /// Typed pointer to Verse state that UI surfaces and tools can resolve and watch.
+    /// </summary>
+    public sealed class CultMeshStatePointer<T>
+    {
+        private readonly Func<CultMeshQueryContext, Task<T?>> _resolve;
+        private readonly Func<CultMeshQueryContext, Observable<T>> _watch;
+
+        /// <summary>Creates a state pointer.</summary>
+        public CultMeshStatePointer(
+            string pointerId,
+            Func<Task<T?>> resolve,
+            Func<Observable<T>> watch,
+            CultMeshRouteHint? routeHint = null,
+            IEnumerable<CultMeshProjectionSource>? sources = null)
+            : this(
+                pointerId,
+                _ => (resolve ?? throw new ArgumentNullException(nameof(resolve)))(),
+                _ => (watch ?? throw new ArgumentNullException(nameof(watch)))(),
+                routeHint,
+                sources)
+        {
+        }
+
+        /// <summary>Creates a state pointer that can resolve through a Verse query context.</summary>
+        public CultMeshStatePointer(
+            string pointerId,
+            Func<CultMeshQueryContext, Task<T?>> resolve,
+            Func<CultMeshQueryContext, Observable<T>> watch,
+            CultMeshRouteHint? routeHint = null,
+            IEnumerable<CultMeshProjectionSource>? sources = null)
+        {
+            PointerId = RequireNonEmpty(pointerId, nameof(pointerId));
+            _resolve = resolve ?? throw new ArgumentNullException(nameof(resolve));
+            _watch = watch ?? throw new ArgumentNullException(nameof(watch));
+            RouteHint = routeHint ?? CultMeshRouteHint.Automatic;
+            Sources = sources?.ToArray() ?? Array.Empty<CultMeshProjectionSource>();
+        }
+
+        /// <summary>Gets the semantic pointer id.</summary>
+        public string PointerId { get; }
+
+        /// <summary>Gets the preferred or observed route for pointer resolution.</summary>
+        public CultMeshRouteHint RouteHint { get; }
+
+        /// <summary>Gets typed state sources this pointer depends on, when known.</summary>
+        public IReadOnlyList<CultMeshProjectionSource> Sources { get; }
+
+        /// <summary>Resolves the pointer once.</summary>
+        public Task<T?> ResolveAsync()
+        {
+            return ResolveAsync(CultMeshQueryContext.ForRuntime("local"));
+        }
+
+        /// <summary>Resolves the pointer once through a query context.</summary>
+        public Task<T?> ResolveAsync(CultMeshQueryContext context)
+        {
+            if (context == null) throw new ArgumentNullException(nameof(context));
+            return _resolve(ResolveContext(context));
+        }
+
+        /// <summary>Resolves the pointer once for one runtime using default context.</summary>
+        public Task<T?> ResolveAsync(string runtimeId)
+        {
+            return ResolveAsync(CultMeshQueryContext.ForRuntime(runtimeId));
+        }
+
+        /// <summary>Watches resolved values for this pointer.</summary>
+        public Observable<T> Watch()
+        {
+            return Watch(CultMeshQueryContext.ForRuntime("local"));
+        }
+
+        /// <summary>Watches resolved values for this pointer through a query context.</summary>
+        public Observable<T> Watch(CultMeshQueryContext context)
+        {
+            if (context == null) throw new ArgumentNullException(nameof(context));
+            return _watch(ResolveContext(context));
+        }
+
+        /// <summary>Binds this pointer to a Verse context.</summary>
+        public CultMeshBoundStatePointer<T> Bind(CultMeshVerseContext context)
+        {
+            return new CultMeshBoundStatePointer<T>(context, this);
+        }
+
+        /// <summary>Binds this pointer to a Verse.</summary>
+        public CultMeshBoundStatePointer<T> Bind(CultMeshVerse verse)
+        {
+            if (verse == null) throw new ArgumentNullException(nameof(verse));
+            return Bind(verse.Context);
+        }
+
+        private CultMeshQueryContext ResolveContext(CultMeshQueryContext context)
+        {
+            return context.RouteHint.Kind == CultMeshLocalityKind.Automatic &&
+                   RouteHint.Kind != CultMeshLocalityKind.Automatic
+                ? context.WithRoute(RouteHint)
+                : context;
+        }
+
+        private static string RequireNonEmpty(string value, string paramName)
+        {
+            return string.IsNullOrWhiteSpace(value)
+                ? throw new ArgumentException("Value must be non-empty.", paramName)
+                : value;
+        }
+    }
+
+    /// <summary>
+    /// State pointer pre-bound to a Verse so UI/tool runtimes can resolve state without context plumbing.
+    /// </summary>
+    public sealed class CultMeshBoundStatePointer<T>
+    {
+        /// <summary>Creates a Verse-bound state pointer.</summary>
+        public CultMeshBoundStatePointer(
+            CultMeshVerseContext context,
+            CultMeshStatePointer<T> pointer)
+        {
+            Context = context ?? throw new ArgumentNullException(nameof(context));
+            Pointer = pointer ?? throw new ArgumentNullException(nameof(pointer));
+        }
+
+        /// <summary>Gets the bound Verse context.</summary>
+        public CultMeshVerseContext Context { get; }
+
+        /// <summary>Gets the underlying state pointer.</summary>
+        public CultMeshStatePointer<T> Pointer { get; }
+
+        /// <summary>Gets the semantic pointer id.</summary>
+        public string PointerId => Pointer.PointerId;
+
+        /// <summary>Gets typed state sources this pointer depends on, when known.</summary>
+        public IReadOnlyList<CultMeshProjectionSource> Sources => Pointer.Sources;
+
+        /// <summary>Gets the preferred or observed route for pointer resolution.</summary>
+        public CultMeshRouteHint RouteHint => Pointer.RouteHint;
+
+        /// <summary>Resolves the pointer through the bound Verse.</summary>
+        public Task<T?> ResolveAsync()
+        {
+            return Pointer.ResolveAsync(Context.QueryContext());
+        }
+
+        /// <summary>Watches the pointer through the bound Verse.</summary>
+        public Observable<T> Watch()
+        {
+            return Pointer.Watch(Context.QueryContext());
+        }
+    }
+
+    /// <summary>
+    /// Typed pointer to Verse state that UI surfaces and tools can resolve, watch, and replace.
+    /// </summary>
+    public sealed class CultMeshMutableStatePointer<T>
+    {
+        private readonly Func<CultMeshQueryContext, Task<T?>> _resolve;
+        private readonly Func<CultMeshQueryContext, Observable<T>> _watch;
+        private readonly Func<CultMeshQueryContext, T, Task> _replace;
+
+        /// <summary>Creates a mutable state pointer.</summary>
+        public CultMeshMutableStatePointer(
+            string pointerId,
+            Func<Task<T?>> resolve,
+            Func<Observable<T>> watch,
+            Func<T, Task> replace,
+            CultMeshRouteHint? routeHint = null,
+            IEnumerable<CultMeshProjectionSource>? sources = null)
+            : this(
+                pointerId,
+                _ => (resolve ?? throw new ArgumentNullException(nameof(resolve)))(),
+                _ => (watch ?? throw new ArgumentNullException(nameof(watch)))(),
+                (_, value) => (replace ?? throw new ArgumentNullException(nameof(replace)))(value),
+                routeHint,
+                sources)
+        {
+        }
+
+        /// <summary>Creates a mutable state pointer that can operate through a Verse query context.</summary>
+        public CultMeshMutableStatePointer(
+            string pointerId,
+            Func<CultMeshQueryContext, Task<T?>> resolve,
+            Func<CultMeshQueryContext, Observable<T>> watch,
+            Func<CultMeshQueryContext, T, Task> replace,
+            CultMeshRouteHint? routeHint = null,
+            IEnumerable<CultMeshProjectionSource>? sources = null)
+        {
+            PointerId = RequireNonEmpty(pointerId, nameof(pointerId));
+            _resolve = resolve ?? throw new ArgumentNullException(nameof(resolve));
+            _watch = watch ?? throw new ArgumentNullException(nameof(watch));
+            _replace = replace ?? throw new ArgumentNullException(nameof(replace));
+            RouteHint = routeHint ?? CultMeshRouteHint.Automatic;
+            Sources = sources?.ToArray() ?? Array.Empty<CultMeshProjectionSource>();
+        }
+
+        /// <summary>Gets the semantic pointer id.</summary>
+        public string PointerId { get; }
+
+        /// <summary>Gets the preferred or observed route for pointer access.</summary>
+        public CultMeshRouteHint RouteHint { get; }
+
+        /// <summary>Gets typed state sources this pointer depends on, when known.</summary>
+        public IReadOnlyList<CultMeshProjectionSource> Sources { get; }
+
+        /// <summary>Resolves the pointer once.</summary>
+        public Task<T?> ResolveAsync()
+        {
+            return ResolveAsync(CultMeshQueryContext.ForRuntime("local"));
+        }
+
+        /// <summary>Resolves the pointer once.</summary>
+        public Task<T?> ReadAsync()
+        {
+            return ResolveAsync();
+        }
+
+        /// <summary>Resolves the pointer once through a query context.</summary>
+        public Task<T?> ResolveAsync(CultMeshQueryContext context)
+        {
+            if (context == null) throw new ArgumentNullException(nameof(context));
+            return _resolve(ResolveContext(context));
+        }
+
+        /// <summary>Resolves the pointer once through a query context.</summary>
+        public Task<T?> ReadAsync(CultMeshQueryContext context)
+        {
+            return ResolveAsync(context);
+        }
+
+        /// <summary>Resolves the pointer once for one runtime using default context.</summary>
+        public Task<T?> ResolveAsync(string runtimeId)
+        {
+            return ResolveAsync(CultMeshQueryContext.ForRuntime(runtimeId));
+        }
+
+        /// <summary>Resolves the pointer once for one runtime using default context.</summary>
+        public Task<T?> ReadAsync(string runtimeId)
+        {
+            return ResolveAsync(runtimeId);
+        }
+
+        /// <summary>Replaces the pointed state value.</summary>
+        public Task ReplaceAsync(T value)
+        {
+            return ReplaceAsync(value, CultMeshQueryContext.ForRuntime("local"));
+        }
+
+        /// <summary>Replaces the pointed state value through a query context.</summary>
+        public Task ReplaceAsync(T value, CultMeshQueryContext context)
+        {
+            if (value == null) throw new ArgumentNullException(nameof(value));
+            if (context == null) throw new ArgumentNullException(nameof(context));
+            return _replace(ResolveContext(context), value);
+        }
+
+        /// <summary>Replaces the pointed state value for one runtime using default context.</summary>
+        public Task ReplaceAsync(T value, string runtimeId)
+        {
+            return ReplaceAsync(value, CultMeshQueryContext.ForRuntime(runtimeId));
+        }
+
+        /// <summary>Watches resolved values for this pointer.</summary>
+        public Observable<T> Watch()
+        {
+            return Watch(CultMeshQueryContext.ForRuntime("local"));
+        }
+
+        /// <summary>Watches resolved values for this pointer through a query context.</summary>
+        public Observable<T> Watch(CultMeshQueryContext context)
+        {
+            if (context == null) throw new ArgumentNullException(nameof(context));
+            return _watch(ResolveContext(context));
+        }
+
+        /// <summary>Views this mutable pointer as a read/watch state pointer.</summary>
+        public CultMeshStatePointer<T> AsStatePointer()
+        {
+            return new CultMeshStatePointer<T>(
+                PointerId,
+                (Func<CultMeshQueryContext, Task<T?>>)ResolveAsync,
+                (Func<CultMeshQueryContext, Observable<T>>)Watch,
+                RouteHint,
+                Sources);
+        }
+
+        /// <summary>Binds this pointer to a Verse context.</summary>
+        public CultMeshBoundMutableStatePointer<T> Bind(CultMeshVerseContext context)
+        {
+            return new CultMeshBoundMutableStatePointer<T>(context, this);
+        }
+
+        /// <summary>Binds this pointer to a Verse.</summary>
+        public CultMeshBoundMutableStatePointer<T> Bind(CultMeshVerse verse)
+        {
+            if (verse == null) throw new ArgumentNullException(nameof(verse));
+            return Bind(verse.Context);
+        }
+
+        private CultMeshQueryContext ResolveContext(CultMeshQueryContext context)
+        {
+            return context.RouteHint.Kind == CultMeshLocalityKind.Automatic &&
+                   RouteHint.Kind != CultMeshLocalityKind.Automatic
+                ? context.WithRoute(RouteHint)
+                : context;
+        }
+
+        private static string RequireNonEmpty(string value, string paramName)
+        {
+            return string.IsNullOrWhiteSpace(value)
+                ? throw new ArgumentException("Value must be non-empty.", paramName)
+                : value;
+        }
+    }
+
+    /// <summary>
+    /// Mutable state pointer pre-bound to a Verse so UI/tool runtimes can read, watch, and replace state without context plumbing.
+    /// </summary>
+    public sealed class CultMeshBoundMutableStatePointer<T>
+    {
+        /// <summary>Creates a Verse-bound mutable state pointer.</summary>
+        public CultMeshBoundMutableStatePointer(
+            CultMeshVerseContext context,
+            CultMeshMutableStatePointer<T> pointer)
+        {
+            Context = context ?? throw new ArgumentNullException(nameof(context));
+            Pointer = pointer ?? throw new ArgumentNullException(nameof(pointer));
+        }
+
+        /// <summary>Gets the bound Verse context.</summary>
+        public CultMeshVerseContext Context { get; }
+
+        /// <summary>Gets the underlying mutable state pointer.</summary>
+        public CultMeshMutableStatePointer<T> Pointer { get; }
+
+        /// <summary>Gets the semantic pointer id.</summary>
+        public string PointerId => Pointer.PointerId;
+
+        /// <summary>Gets typed state sources this pointer depends on, when known.</summary>
+        public IReadOnlyList<CultMeshProjectionSource> Sources => Pointer.Sources;
+
+        /// <summary>Gets the preferred or observed route for pointer access.</summary>
+        public CultMeshRouteHint RouteHint => Pointer.RouteHint;
+
+        /// <summary>Resolves the pointer through the bound Verse.</summary>
+        public Task<T?> ResolveAsync()
+        {
+            return Pointer.ResolveAsync(Context.QueryContext());
+        }
+
+        /// <summary>Resolves the pointer through the bound Verse.</summary>
+        public Task<T?> ReadAsync()
+        {
+            return ResolveAsync();
+        }
+
+        /// <summary>Replaces the pointer value through the bound Verse.</summary>
+        public Task ReplaceAsync(T value)
+        {
+            return Pointer.ReplaceAsync(value, Context.QueryContext());
+        }
+
+        /// <summary>Watches the pointer through the bound Verse.</summary>
+        public Observable<T> Watch()
+        {
+            return Pointer.Watch(Context.QueryContext());
+        }
+
+        /// <summary>Views this mutable pointer as a read/watch state pointer bound to the same Verse.</summary>
+        public CultMeshBoundStatePointer<T> AsStatePointer()
+        {
+            return new CultMeshBoundStatePointer<T>(Context, Pointer.AsStatePointer());
+        }
+    }
+
+    /// <summary>
+    /// Describes one typed source consumed by a projection recipe.
+    /// </summary>
+    public sealed class CultMeshProjectionSource
+    {
+        /// <summary>Creates a projection source descriptor.</summary>
+        public CultMeshProjectionSource(string sourceId, string? schemaId = null, string? description = null)
+        {
+            SourceId = RequireNonEmpty(sourceId, nameof(sourceId));
+            SchemaId = schemaId;
+            Description = description;
+        }
+
+        /// <summary>Gets the semantic source id, such as a state pointer, document handle, or native view id.</summary>
+        public string SourceId { get; }
+
+        /// <summary>Gets the optional schema id for the source.</summary>
+        public string? SchemaId { get; }
+
+        /// <summary>Gets optional human-facing source diagnostics.</summary>
+        public string? Description { get; }
+
+        private static string RequireNonEmpty(string value, string paramName)
+        {
+            return string.IsNullOrWhiteSpace(value)
+                ? throw new ArgumentException("Value must be non-empty.", paramName)
+                : value;
+        }
+    }
+
+    /// <summary>
+    /// Resolves string state references embedded in portable UI/tool surfaces through a named CultMesh resolver.
+    /// </summary>
+    public sealed class CultMeshStateRefResolver
+    {
+        private readonly Func<string, CultMeshQueryContext, string?> _resolve;
+
+        /// <summary>Creates a state-reference resolver.</summary>
+        public CultMeshStateRefResolver(
+            string resolverId,
+            Func<string, CultMeshQueryContext, string?> resolve,
+            IEnumerable<CultMeshProjectionSource>? sources = null,
+            CultMeshRouteHint? routeHint = null)
+        {
+            ResolverId = RequireNonEmpty(resolverId, nameof(resolverId));
+            _resolve = resolve ?? throw new ArgumentNullException(nameof(resolve));
+            Sources = sources?.ToArray() ?? Array.Empty<CultMeshProjectionSource>();
+            RouteHint = routeHint ?? CultMeshRouteHint.Automatic;
+        }
+
+        /// <summary>Gets the semantic resolver id.</summary>
+        public string ResolverId { get; }
+
+        /// <summary>Gets the source state read by the resolver.</summary>
+        public IReadOnlyList<CultMeshProjectionSource> Sources { get; }
+
+        /// <summary>Gets the preferred route for resolving state refs.</summary>
+        public CultMeshRouteHint RouteHint { get; }
+
+        /// <summary>Gets an empty resolver that always returns an empty string.</summary>
+        public static CultMeshStateRefResolver Empty { get; } =
+            new("cultmesh.state_refs.empty", (_stateRef, _context) => "");
+
+        /// <summary>Resolves a state ref using a local query context.</summary>
+        public string Resolve(string stateRef)
+        {
+            return Resolve(stateRef, CultMeshQueryContext.ForRuntime("local"));
+        }
+
+        /// <summary>Resolves a state ref using a runtime id.</summary>
+        public string Resolve(string stateRef, string runtimeId)
+        {
+            return Resolve(stateRef, CultMeshQueryContext.ForRuntime(runtimeId));
+        }
+
+        /// <summary>Resolves a state ref using an explicit query context.</summary>
+        public string Resolve(string stateRef, CultMeshQueryContext context)
+        {
+            if (string.IsNullOrWhiteSpace(stateRef))
+                return "";
+            if (context == null) throw new ArgumentNullException(nameof(context));
+            return _resolve(stateRef, ResolveContext(context)) ?? "";
+        }
+
+        /// <summary>Attempts to resolve a non-empty value.</summary>
+        public bool TryResolve(string stateRef, out string value)
+        {
+            value = Resolve(stateRef);
+            return !string.IsNullOrEmpty(value);
+        }
+
+        /// <summary>Attempts to resolve a non-empty value.</summary>
+        public bool TryResolve(string stateRef, CultMeshQueryContext context, out string value)
+        {
+            value = Resolve(stateRef, context);
+            return !string.IsNullOrEmpty(value);
+        }
+
+        /// <summary>Creates a resolver that falls back to another resolver when this resolver returns empty.</summary>
+        public CultMeshStateRefResolver Or(CultMeshStateRefResolver fallback)
+        {
+            if (fallback == null) throw new ArgumentNullException(nameof(fallback));
+            return new CultMeshStateRefResolver(
+                ResolverId + "|" + fallback.ResolverId,
+                (stateRef, context) =>
+                {
+                    var value = Resolve(stateRef, context);
+                    return string.IsNullOrEmpty(value)
+                        ? fallback.Resolve(stateRef, context)
+                        : value;
+                },
+                Sources.Concat(fallback.Sources),
+                RouteHint.Kind == CultMeshLocalityKind.Automatic ? fallback.RouteHint : RouteHint);
+        }
+
+        /// <summary>Returns the legacy function shape for existing surface renderers.</summary>
+        public Func<string, string> AsFunc()
+        {
+            return Resolve;
+        }
+
+        private CultMeshQueryContext ResolveContext(CultMeshQueryContext context)
+        {
+            if (context.RouteHint.Kind != CultMeshLocalityKind.Automatic || RouteHint.Kind == CultMeshLocalityKind.Automatic)
+                return context;
+
+            return context.WithRoute(RouteHint);
+        }
+
+        private static string RequireNonEmpty(string value, string paramName)
+        {
+            return string.IsNullOrWhiteSpace(value)
+                ? throw new ArgumentException("Value must be non-empty.", paramName)
+                : value;
+        }
+    }
+
+    /// <summary>
+    /// Diagnostics for a named CultMesh state-reference resolver.
+    /// </summary>
+    public sealed class CultMeshStateRefResolverDiagnostic
+    {
+        /// <summary>Creates a state-reference resolver diagnostic.</summary>
+        public CultMeshStateRefResolverDiagnostic(
+            string resolverId,
+            CultMeshRouteHint routeHint,
+            IEnumerable<CultMeshProjectionSource>? sources = null)
+        {
+            ResolverId = RequireNonEmpty(resolverId, nameof(resolverId));
+            RouteHint = routeHint ?? CultMeshRouteHint.Automatic;
+            Sources = sources?.ToArray() ?? Array.Empty<CultMeshProjectionSource>();
+        }
+
+        /// <summary>Gets the semantic resolver id.</summary>
+        public string ResolverId { get; }
+
+        /// <summary>Gets the preferred route for resolving refs.</summary>
+        public CultMeshRouteHint RouteHint { get; }
+
+        /// <summary>Gets source state used by the resolver.</summary>
+        public IReadOnlyList<CultMeshProjectionSource> Sources { get; }
+
+        private static string RequireNonEmpty(string value, string paramName)
+        {
+            return string.IsNullOrWhiteSpace(value)
+                ? throw new ArgumentException("Value must be non-empty.", paramName)
+                : value;
+        }
+    }
+
+    /// <summary>
+    /// Describes one UI/tool surface property bound to a typed CultMesh state pointer.
+    /// </summary>
+    public sealed class CultMeshStateBindingDescriptor
+    {
+        /// <summary>Creates a state binding descriptor.</summary>
+        public CultMeshStateBindingDescriptor(
+            string targetProp,
+            string pointerId,
+            string? sourceId = null,
+            string? schemaId = null,
+            CultMeshRouteHint? routeHint = null,
+            string? bindingName = null,
+            string? documentId = null,
+            string? fieldPath = null,
+            string? valueKind = null,
+            string? accessMode = null,
+            string? authority = null,
+            string? writeCommand = null)
+        {
+            TargetProp = RequireNonEmpty(targetProp, nameof(targetProp));
+            PointerId = RequireNonEmpty(pointerId, nameof(pointerId));
+            SourceId = sourceId;
+            SchemaId = schemaId;
+            RouteHint = routeHint ?? CultMeshRouteHint.Automatic;
+            BindingName = bindingName ?? "";
+            DocumentId = documentId ?? "";
+            FieldPath = fieldPath ?? "";
+            ValueKind = valueKind ?? "";
+            AccessMode = accessMode ?? "";
+            Authority = authority ?? "";
+            WriteCommand = writeCommand ?? "";
+        }
+
+        /// <summary>Gets the component property receiving the resolved state value.</summary>
+        public string TargetProp { get; }
+
+        /// <summary>Gets the semantic CultMesh state pointer id.</summary>
+        public string PointerId { get; }
+
+        /// <summary>Gets the optional source document, cache, native view, or daemon source id.</summary>
+        public string? SourceId { get; }
+
+        /// <summary>Gets the optional schema id for the source state.</summary>
+        public string? SchemaId { get; }
+
+        /// <summary>Gets the preferred route for resolving and watching the binding.</summary>
+        public CultMeshRouteHint RouteHint { get; }
+
+        /// <summary>Gets the stable renderer-facing name used to capture this binding in an operation.</summary>
+        public string BindingName { get; }
+
+        /// <summary>Gets the optional identity of the provider-owned backing document.</summary>
+        public string DocumentId { get; }
+
+        /// <summary>Gets the optional typed field path inside the backing document.</summary>
+        public string FieldPath { get; }
+
+        /// <summary>Gets the optional portable value kind.</summary>
+        public string ValueKind { get; }
+
+        /// <summary>Gets the optional read, write, read-write, or local-draft access mode.</summary>
+        public string AccessMode { get; }
+
+        /// <summary>Gets the authority responsible for accepting writes to this binding.</summary>
+        public string Authority { get; }
+
+        /// <summary>Gets the optional typed operation id used for direct writes.</summary>
+        public string WriteCommand { get; }
+
+        /// <summary>Creates a binding from an existing state pointer.</summary>
+        public static CultMeshStateBindingDescriptor FromPointer<TValue>(
+            string targetProp,
+            CultMeshStatePointer<TValue> pointer)
+        {
+            if (pointer == null) throw new ArgumentNullException(nameof(pointer));
+            var source = pointer.Sources.FirstOrDefault();
+            return new CultMeshStateBindingDescriptor(
+                targetProp,
+                pointer.PointerId,
+                source?.SourceId,
+                source?.SchemaId,
+                pointer.RouteHint);
+        }
+
+        private static string RequireNonEmpty(string value, string paramName)
+        {
+            return string.IsNullOrWhiteSpace(value)
+                ? throw new ArgumentException("Value must be non-empty.", paramName)
+                : value;
+        }
+    }
+
+    /// <summary>
+    /// Transport-friendly fields for a typed state binding descriptor.
+    /// </summary>
+    [MessagePackObject]
+    public sealed class CultMeshStateBindingRecord
+    {
+        /// <summary>Creates a state binding record.</summary>
+        [SerializationConstructor]
+        public CultMeshStateBindingRecord(
+            string? targetProp = null,
+            string? pointerId = null,
+            string? sourceId = null,
+            string? schemaId = null,
+            string? routeKind = null,
+            string? routeDescription = null,
+            string? bindingName = null,
+            string? documentId = null,
+            string? fieldPath = null,
+            string? valueKind = null,
+            string? accessMode = null,
+            string? authority = null,
+            string? writeCommand = null)
+        {
+            TargetProp = string.IsNullOrWhiteSpace(targetProp) ? "value" : targetProp!;
+            PointerId = pointerId ?? "";
+            SourceId = sourceId ?? "";
+            SchemaId = schemaId ?? "";
+            RouteKind = routeKind ?? "";
+            RouteDescription = routeDescription ?? "";
+            BindingName = bindingName ?? "";
+            DocumentId = documentId ?? "";
+            FieldPath = fieldPath ?? "";
+            ValueKind = valueKind ?? "";
+            AccessMode = accessMode ?? "";
+            Authority = authority ?? "";
+            WriteCommand = writeCommand ?? "";
+        }
+
+        /// <summary>Gets the component property receiving the resolved state value.</summary>
+        [Key(0)] public string TargetProp { get; }
+
+        /// <summary>Gets the semantic CultMesh state pointer id.</summary>
+        [Key(1)] public string PointerId { get; }
+
+        /// <summary>Gets the source document, cache, native view, or daemon source id.</summary>
+        [Key(2)] public string SourceId { get; }
+
+        /// <summary>Gets the source schema id.</summary>
+        [Key(3)] public string SchemaId { get; }
+
+        /// <summary>Gets the flattened route kind.</summary>
+        [Key(4)] public string RouteKind { get; }
+
+        /// <summary>Gets the flattened route description.</summary>
+        [Key(5)] public string RouteDescription { get; }
+
+        [Key(6)] public string BindingName { get; }
+        [Key(7)] public string DocumentId { get; }
+        [Key(8)] public string FieldPath { get; }
+        [Key(9)] public string ValueKind { get; }
+        [Key(10)] public string AccessMode { get; }
+        [Key(11)] public string Authority { get; }
+        [Key(12)] public string WriteCommand { get; }
+
+        /// <summary>Creates transport-friendly fields from a state binding descriptor.</summary>
+        public static CultMeshStateBindingRecord FromBinding(CultMeshStateBindingDescriptor? binding)
+        {
+            var route = CultMeshRouteRecord.FromRoute(binding?.RouteHint);
+            return new CultMeshStateBindingRecord(
+                binding?.TargetProp,
+                binding?.PointerId,
+                binding?.SourceId,
+                binding?.SchemaId,
+                route.Kind,
+                route.Description,
+                binding?.BindingName,
+                binding?.DocumentId,
+                binding?.FieldPath,
+                binding?.ValueKind,
+                binding?.AccessMode,
+                binding?.Authority,
+                binding?.WriteCommand);
+        }
+
+        /// <summary>Rehydrates this record as a state binding descriptor.</summary>
+        public CultMeshStateBindingDescriptor ToBinding(
+            CultMeshRouteHint? fallbackRouteHint = null,
+            string? fallbackTargetProp = null)
+        {
+            var targetProp = string.IsNullOrWhiteSpace(TargetProp)
+                ? (string.IsNullOrWhiteSpace(fallbackTargetProp) ? "value" : fallbackTargetProp!)
+                : TargetProp;
+            var pointerId = string.IsNullOrWhiteSpace(PointerId)
+                ? $"{targetProp}.unknown"
+                : PointerId;
+            var route = new CultMeshRouteRecord(RouteKind, RouteDescription)
+                .ToRoute(fallbackRouteHint ?? CultMeshRouteHint.Automatic);
+
+            return new CultMeshStateBindingDescriptor(
+                targetProp,
+                pointerId,
+                SourceId,
+                SchemaId,
+                route,
+                BindingName,
+                DocumentId,
+                FieldPath,
+                ValueKind,
+                AccessMode,
+                Authority,
+                WriteCommand);
+        }
+    }
+
+    /// <summary>
+    /// Describes one UI/tool command bound to a typed CultMesh operation.
+    /// </summary>
+    public sealed class CultMeshOperationBindingDescriptor
+    {
+        /// <summary>Creates an operation binding descriptor.</summary>
+        public CultMeshOperationBindingDescriptor(
+            string operationId,
+            string? label = null,
+            string? schemaId = null,
+            CultMeshRouteHint? routeHint = null)
+        {
+            OperationId = RequireNonEmpty(operationId, nameof(operationId));
+            Label = label ?? "";
+            SchemaId = schemaId ?? "";
+            RouteHint = routeHint ?? CultMeshRouteHint.Automatic;
+        }
+
+        /// <summary>Gets the semantic CultMesh operation id.</summary>
+        public string OperationId { get; }
+
+        /// <summary>Gets the human-facing command label.</summary>
+        public string Label { get; }
+
+        /// <summary>Gets the optional request schema id for the operation.</summary>
+        public string SchemaId { get; }
+
+        /// <summary>Gets the preferred route for invoking the operation.</summary>
+        public CultMeshRouteHint RouteHint { get; }
+
+        /// <summary>Creates a binding from an existing typed operation handle.</summary>
+        public static CultMeshOperationBindingDescriptor FromOperation<TRequest, TResponse>(
+            CultMeshOperationHandle<TRequest, TResponse> operation,
+            string? label = null,
+            string? schemaId = null,
+            CultMeshRouteHint? routeHint = null)
+        {
+            if (operation == null) throw new ArgumentNullException(nameof(operation));
+            return new CultMeshOperationBindingDescriptor(
+                operation.OperationId,
+                label,
+                schemaId,
+                routeHint);
+        }
+
+        private static string RequireNonEmpty(string value, string paramName)
+        {
+            return string.IsNullOrWhiteSpace(value)
+                ? throw new ArgumentException("Value must be non-empty.", paramName)
+                : value;
+        }
+    }
+
+    /// <summary>
+    /// Transport-friendly fields for a typed operation binding descriptor.
+    /// </summary>
+    [MessagePackObject]
+    public sealed class CultMeshOperationBindingRecord
+    {
+        /// <summary>Creates an operation binding record.</summary>
+        [SerializationConstructor]
+        public CultMeshOperationBindingRecord(
+            string? operationId = null,
+            string? label = null,
+            string? schemaId = null,
+            string? routeKind = null,
+            string? routeDescription = null)
+        {
+            OperationId = operationId ?? "";
+            Label = label ?? "";
+            SchemaId = schemaId ?? "";
+            RouteKind = routeKind ?? "";
+            RouteDescription = routeDescription ?? "";
+        }
+
+        /// <summary>Gets the semantic CultMesh operation id.</summary>
+        [Key(0)] public string OperationId { get; }
+
+        /// <summary>Gets the human-facing command label.</summary>
+        [Key(1)] public string Label { get; }
+
+        /// <summary>Gets the optional request schema id for the operation.</summary>
+        [Key(2)] public string SchemaId { get; }
+
+        /// <summary>Gets the flattened route kind.</summary>
+        [Key(3)] public string RouteKind { get; }
+
+        /// <summary>Gets the flattened route description.</summary>
+        [Key(4)] public string RouteDescription { get; }
+
+        /// <summary>Creates transport-friendly fields from an operation binding descriptor.</summary>
+        public static CultMeshOperationBindingRecord FromBinding(CultMeshOperationBindingDescriptor? binding)
+        {
+            var route = CultMeshRouteRecord.FromRoute(binding?.RouteHint);
+            return new CultMeshOperationBindingRecord(
+                binding?.OperationId,
+                binding?.Label,
+                binding?.SchemaId,
+                route.Kind,
+                route.Description);
+        }
+
+        /// <summary>Rehydrates this record as an operation binding descriptor.</summary>
+        public CultMeshOperationBindingDescriptor ToBinding(
+            CultMeshRouteHint? fallbackRouteHint = null,
+            string? fallbackOperationId = null)
+        {
+            var operationId = string.IsNullOrWhiteSpace(OperationId)
+                ? (fallbackOperationId ?? "")
+                : OperationId;
+            var route = new CultMeshRouteRecord(RouteKind, RouteDescription)
+                .ToRoute(fallbackRouteHint ?? CultMeshRouteHint.Automatic);
+
+            return new CultMeshOperationBindingDescriptor(
+                operationId,
+                Label,
+                SchemaId,
+                route);
+        }
+    }
+
+    /// <summary>
+    /// Describes one concrete invocation of a typed CultMesh operation.
+    /// </summary>
+    public sealed class CultMeshOperationInvocationDescriptor
+    {
+        /// <summary>Creates an operation invocation descriptor.</summary>
+        public CultMeshOperationInvocationDescriptor(
+            string operationId,
+            string? schemaId = null,
+            CultMeshRouteHint? routeHint = null,
+            string? idempotencyKey = null)
+        {
+            OperationId = RequireNonEmpty(operationId, nameof(operationId));
+            SchemaId = schemaId ?? "";
+            RouteHint = routeHint ?? CultMeshRouteHint.Automatic;
+            IdempotencyKey = idempotencyKey;
+        }
+
+        /// <summary>Gets the semantic CultMesh operation id being invoked.</summary>
+        public string OperationId { get; }
+
+        /// <summary>Gets the optional request schema id for the operation.</summary>
+        public string SchemaId { get; }
+
+        /// <summary>Gets the preferred route for invoking the operation.</summary>
+        public CultMeshRouteHint RouteHint { get; }
+
+        /// <summary>Gets an optional caller-provided idempotency key.</summary>
+        public string? IdempotencyKey { get; }
+
+        /// <summary>Creates an invocation from an advertised operation binding.</summary>
+        public static CultMeshOperationInvocationDescriptor FromBinding(
+            CultMeshOperationBindingDescriptor binding,
+            string? idempotencyKey = null)
+        {
+            if (binding == null) throw new ArgumentNullException(nameof(binding));
+            return new CultMeshOperationInvocationDescriptor(
+                binding.OperationId,
+                binding.SchemaId,
+                binding.RouteHint,
+                idempotencyKey);
+        }
+
+        /// <summary>Creates an invocation from an existing typed operation handle.</summary>
+        public static CultMeshOperationInvocationDescriptor FromOperation<TRequest, TResponse>(
+            CultMeshOperationHandle<TRequest, TResponse> operation,
+            string? schemaId = null,
+            CultMeshRouteHint? routeHint = null,
+            string? idempotencyKey = null)
+        {
+            if (operation == null) throw new ArgumentNullException(nameof(operation));
+            return new CultMeshOperationInvocationDescriptor(
+                operation.OperationId,
+                schemaId,
+                routeHint,
+                idempotencyKey);
+        }
+
+        private static string RequireNonEmpty(string value, string paramName)
+        {
+            return string.IsNullOrWhiteSpace(value)
+                ? throw new ArgumentException("Value must be non-empty.", paramName)
+                : value;
+        }
+    }
+
+    /// <summary>
+    /// Flat, transport-friendly fields for a concrete CultMesh operation invocation.
+    /// </summary>
+    [MessagePackObject]
+    [MessagePackFormatter(typeof(CultMeshOperationInvocationRecordFormatter))]
+    public sealed class CultMeshOperationInvocationRecord
+    {
+        /// <summary>Creates flat operation invocation fields.</summary>
+        [SerializationConstructor]
+        public CultMeshOperationInvocationRecord(
+            string? operationId = null,
+            string? schemaId = null,
+            string? routeKind = null,
+            string? routeDescription = null,
+            string? idempotencyKey = null)
+        {
+            OperationId = operationId ?? "";
+            SchemaId = schemaId ?? "";
+            RouteKind = routeKind ?? "";
+            RouteDescription = routeDescription ?? "";
+            IdempotencyKey = idempotencyKey ?? "";
+        }
+
+        /// <summary>Gets the semantic CultMesh operation id.</summary>
+        [Key(0)]
+        public string OperationId { get; }
+
+        /// <summary>Gets the optional request schema id.</summary>
+        [Key(1)]
+        public string SchemaId { get; }
+
+        /// <summary>Gets the serialized route locality kind.</summary>
+        [Key(2)]
+        public string RouteKind { get; }
+
+        /// <summary>Gets the serialized route description.</summary>
+        [Key(3)]
+        public string RouteDescription { get; }
+
+        /// <summary>Gets the serialized idempotency key.</summary>
+        [Key(4)]
+        public string IdempotencyKey { get; }
+
+        /// <summary>Creates flat fields from a typed invocation descriptor.</summary>
+        public static CultMeshOperationInvocationRecord FromInvocation(
+            CultMeshOperationInvocationDescriptor? invocation,
+            string? fallbackOperationId = null,
+            string? fallbackSchemaId = null,
+            CultMeshRouteHint? fallbackRouteHint = null,
+            string? fallbackIdempotencyKey = null)
+        {
+            var route = CultMeshRouteRecord.FromRoute(invocation?.RouteHint ?? fallbackRouteHint);
+            return new CultMeshOperationInvocationRecord(
+                string.IsNullOrWhiteSpace(invocation?.OperationId) ? fallbackOperationId : invocation!.OperationId,
+                string.IsNullOrWhiteSpace(invocation?.SchemaId) ? fallbackSchemaId : invocation!.SchemaId,
+                route.Kind,
+                route.Description,
+                string.IsNullOrWhiteSpace(invocation?.IdempotencyKey) ? fallbackIdempotencyKey : invocation!.IdempotencyKey);
+        }
+
+        /// <summary>Rehydrates the flat fields into a typed invocation descriptor.</summary>
+        public CultMeshOperationInvocationDescriptor ToInvocation(
+            string? fallbackOperationId = null,
+            string? fallbackSchemaId = null,
+            CultMeshRouteHint? fallbackRouteHint = null,
+            string? fallbackIdempotencyKey = null)
+        {
+            var operationId = string.IsNullOrWhiteSpace(OperationId) ? fallbackOperationId : OperationId;
+            if (string.IsNullOrWhiteSpace(operationId))
+                throw new InvalidOperationException("CultMesh operation invocation fields do not contain an operation id.");
+
+            var route = new CultMeshRouteRecord(RouteKind, RouteDescription)
+                .ToRoute(fallbackRouteHint);
+
+            return new CultMeshOperationInvocationDescriptor(
+                operationId!,
+                string.IsNullOrWhiteSpace(SchemaId) ? fallbackSchemaId : SchemaId,
+                route,
+                string.IsNullOrWhiteSpace(IdempotencyKey) ? fallbackIdempotencyKey : IdempotencyKey);
+        }
+    }
+
+    /// <summary>
+    /// Shared payload value carried by one concrete CultMesh operation invocation.
+    /// </summary>
+    public sealed class CultMeshOperationPayload : IReadOnlyDictionary<string, string>
+    {
+        private static readonly IReadOnlyDictionary<string, string> EmptyFields =
+            new Dictionary<string, string>(0, StringComparer.Ordinal);
+
+        private readonly IReadOnlyDictionary<string, string> _fields;
+
+        /// <summary>Creates an empty operation payload.</summary>
+        public CultMeshOperationPayload()
+            : this(EmptyFields)
+        {
+        }
+
+        /// <summary>Creates an operation payload from string-compatible fields.</summary>
+        public CultMeshOperationPayload(IEnumerable<KeyValuePair<string, string>>? fields)
+        {
+            if (fields == null)
+            {
+                _fields = EmptyFields;
+                return;
+            }
+
+            var copy = new Dictionary<string, string>(StringComparer.Ordinal);
+            foreach (var field in fields)
+            {
+                if (string.IsNullOrWhiteSpace(field.Key))
+                    continue;
+                copy[field.Key] = field.Value ?? "";
+            }
+
+            _fields = copy;
+        }
+
+        /// <summary>Gets the empty operation payload.</summary>
+        public static CultMeshOperationPayload Empty { get; } = new();
+
+        /// <summary>Gets the payload field names.</summary>
+        public IEnumerable<string> Keys => _fields.Keys;
+
+        /// <summary>Gets the payload field values.</summary>
+        public IEnumerable<string> Values => _fields.Values;
+
+        /// <summary>Gets the number of payload fields.</summary>
+        public int Count => _fields.Count;
+
+        /// <summary>Gets a payload field by name.</summary>
+        public string this[string key] => _fields[key];
+
+        /// <summary>Gets whether the payload contains a field.</summary>
+        public bool ContainsKey(string key)
+        {
+            return _fields.ContainsKey(key);
+        }
+
+        /// <summary>Tries to read a raw string field.</summary>
+        public bool TryGetValue(string key, out string value)
+        {
+            return _fields.TryGetValue(key, out value);
+        }
+
+        /// <summary>Reads a raw string field with a default value.</summary>
+        public string GetString(string key, string defaultValue = "")
+        {
+            return _fields.TryGetValue(key, out var value) ? value ?? defaultValue : defaultValue;
+        }
+
+        /// <summary>Reads an integer field using invariant parsing.</summary>
+        public int GetInt32(string key, int defaultValue = 0)
+        {
+            return int.TryParse(GetString(key), NumberStyles.Integer, CultureInfo.InvariantCulture, out var value)
+                ? value
+                : defaultValue;
+        }
+
+        /// <summary>Reads a floating point field using invariant parsing.</summary>
+        public double GetDouble(string key, double defaultValue = 0)
+        {
+            return double.TryParse(GetString(key), NumberStyles.Float, CultureInfo.InvariantCulture, out var value)
+                ? value
+                : defaultValue;
+        }
+
+        /// <summary>Reads a boolean field using common CultMesh surface spellings.</summary>
+        public bool GetBoolean(string key, bool defaultValue = false)
+        {
+            var value = GetString(key);
+            if (string.Equals(value, "true", StringComparison.OrdinalIgnoreCase) ||
+                string.Equals(value, "1", StringComparison.Ordinal) ||
+                string.Equals(value, "yes", StringComparison.OrdinalIgnoreCase) ||
+                string.Equals(value, "on", StringComparison.OrdinalIgnoreCase))
+                return true;
+            if (string.Equals(value, "false", StringComparison.OrdinalIgnoreCase) ||
+                string.Equals(value, "0", StringComparison.Ordinal) ||
+                string.Equals(value, "no", StringComparison.OrdinalIgnoreCase) ||
+                string.Equals(value, "off", StringComparison.OrdinalIgnoreCase))
+                return false;
+            return defaultValue;
+        }
+
+        /// <summary>Returns a copy with one field overwritten.</summary>
+        public CultMeshOperationPayload With(string key, string value)
+        {
+            if (string.IsNullOrWhiteSpace(key))
+                throw new ArgumentException("Value must be non-empty.", nameof(key));
+            var copy = new Dictionary<string, string>(_fields, StringComparer.Ordinal)
+            {
+                [key] = value ?? ""
+            };
+            return new CultMeshOperationPayload(copy);
+        }
+
+        /// <summary>Copies payload fields into a mutable dictionary.</summary>
+        public Dictionary<string, string> ToDictionary(IEqualityComparer<string>? comparer = null)
+        {
+            var copy = new Dictionary<string, string>(comparer ?? StringComparer.Ordinal);
+            foreach (var field in _fields)
+                copy[field.Key] = field.Value ?? "";
+            return copy;
+        }
+
+        /// <summary>Creates a payload from string-compatible fields.</summary>
+        public static CultMeshOperationPayload FromStrings(IEnumerable<KeyValuePair<string, string>>? fields)
+        {
+            return new CultMeshOperationPayload(fields);
+        }
+
+        /// <inheritdoc />
+        public IEnumerator<KeyValuePair<string, string>> GetEnumerator()
+        {
+            return _fields.GetEnumerator();
+        }
+
+        /// <inheritdoc />
+        System.Collections.IEnumerator System.Collections.IEnumerable.GetEnumerator()
+        {
+            return GetEnumerator();
+        }
+    }
+
+    /// <summary>
+    /// Names a reusable projection from typed source state into derived state.
+    /// </summary>
+    public sealed class CultMeshProjectionRecipe<TParameters, TResult>
+    {
+        private readonly Func<TParameters, CultMeshQueryContext, Task<TResult>> _project;
+        private readonly Func<TParameters, CultMeshQueryContext, Observable<TResult>>? _watch;
+
+        /// <summary>Creates a projection recipe.</summary>
+        public CultMeshProjectionRecipe(
+            string projectionId,
+            IEnumerable<CultMeshProjectionSource> sources,
+            Func<TParameters, CultMeshQueryContext, Task<TResult>> project,
+            CultMeshRouteHint? routeHint = null,
+            Func<TParameters, CultMeshQueryContext, Observable<TResult>>? watch = null)
+        {
+            ProjectionId = RequireNonEmpty(projectionId, nameof(projectionId));
+            Sources = sources?.ToArray() ?? throw new ArgumentNullException(nameof(sources));
+            _project = project ?? throw new ArgumentNullException(nameof(project));
+            RouteHint = routeHint ?? CultMeshRouteHint.Automatic;
+            _watch = watch;
+        }
+
+        /// <summary>Gets the semantic projection id.</summary>
+        public string ProjectionId { get; }
+
+        /// <summary>Gets the typed state sources this projection depends on.</summary>
+        public IReadOnlyList<CultMeshProjectionSource> Sources { get; }
+
+        /// <summary>Gets the preferred or observed route for the projection.</summary>
+        public CultMeshRouteHint RouteHint { get; }
+
+        /// <summary>Projects derived state once.</summary>
+        public Task<TResult> ProjectAsync(TParameters parameters, CultMeshQueryContext context)
+        {
+            if (context == null) throw new ArgumentNullException(nameof(context));
+            return _project(parameters, ResolveContext(context));
+        }
+
+        /// <summary>Projects derived state once for one runtime using default context.</summary>
+        public Task<TResult> ProjectAsync(TParameters parameters, string runtimeId)
+        {
+            return ProjectAsync(parameters, CultMeshQueryContext.ForRuntime(runtimeId));
+        }
+
+        /// <summary>Watches projection results when the recipe supports reactive execution.</summary>
+        public Observable<TResult> Watch(TParameters parameters, CultMeshQueryContext context)
+        {
+            if (context == null) throw new ArgumentNullException(nameof(context));
+            if (_watch == null)
+            {
+                throw new NotSupportedException($"Projection recipe '{ProjectionId}' does not support reactive watches.");
+            }
+
+            return _watch(parameters, ResolveContext(context));
+        }
+
+        /// <summary>Views this projection recipe as a typed query surface.</summary>
+        public CultMeshQuerySurface<TParameters, TResult> AsQuerySurface()
+        {
+            return new CultMeshQuerySurface<TParameters, TResult>(
+                ProjectionId,
+                ProjectAsync,
+                _watch == null ? null : Watch,
+                Sources,
+                RouteHint);
+        }
+
+        private CultMeshQueryContext ResolveContext(CultMeshQueryContext context)
+        {
+            return context.RouteHint.Kind == CultMeshLocalityKind.Automatic &&
+                   RouteHint.Kind != CultMeshLocalityKind.Automatic
+                ? context.WithRoute(RouteHint)
+                : context;
+        }
+
+        private static string RequireNonEmpty(string value, string paramName)
+        {
+            return string.IsNullOrWhiteSpace(value)
+                ? throw new ArgumentException("Value must be non-empty.", paramName)
+                : value;
+        }
+    }
+
+    /// <summary>
+    /// Describes one column in a native CultMesh slice view.
+    /// </summary>
+    public sealed class CultMeshNativeSliceColumn
+    {
+        /// <summary>Creates a native slice column descriptor.</summary>
+        public CultMeshNativeSliceColumn(string name, string valueType, int elementSizeBytes)
+        {
+            Name = RequireNonEmpty(name, nameof(name));
+            ValueType = RequireNonEmpty(valueType, nameof(valueType));
+            if (elementSizeBytes <= 0)
+            {
+                throw new ArgumentOutOfRangeException(nameof(elementSizeBytes), "Element size must be positive.");
+            }
+
+            ElementSizeBytes = elementSizeBytes;
+        }
+
+        /// <summary>Gets the column name.</summary>
+        public string Name { get; }
+
+        /// <summary>Gets the schema value type for each element.</summary>
+        public string ValueType { get; }
+
+        /// <summary>Gets the size of one element in bytes.</summary>
+        public int ElementSizeBytes { get; }
+
+        /// <summary>Creates a native slice column descriptor for an unmanaged CLR value type.</summary>
+        public static CultMeshNativeSliceColumn For<TValue>(string name) where TValue : unmanaged
+        {
+            return new CultMeshNativeSliceColumn(name, typeof(TValue).FullName ?? typeof(TValue).Name, SizeOf<TValue>());
+        }
+
+        private static int SizeOf<TValue>() where TValue : unmanaged
+        {
+            return System.Runtime.InteropServices.Marshal.SizeOf<TValue>();
+        }
+
+        private static string RequireNonEmpty(string value, string paramName)
+        {
+            return string.IsNullOrWhiteSpace(value)
+                ? throw new ArgumentException("Value must be non-empty.", paramName)
+                : value;
+        }
+    }
+
+    /// <summary>
+    /// Describes a typed native slice view exposed by CultMesh.
+    /// </summary>
+    public sealed class CultMeshNativeSliceViewDescriptor
+    {
+        /// <summary>Creates a native slice view descriptor.</summary>
+        public CultMeshNativeSliceViewDescriptor(
+            string viewId,
+            string schemaId,
+            int rowCount,
+            IEnumerable<CultMeshNativeSliceColumn> columns,
+            CultMeshRouteHint? route = null,
+            string? nativeHandle = null)
+        {
+            ViewId = RequireNonEmpty(viewId, nameof(viewId));
+            SchemaId = RequireNonEmpty(schemaId, nameof(schemaId));
+            if (rowCount < 0)
+            {
+                throw new ArgumentOutOfRangeException(nameof(rowCount), "Row count cannot be negative.");
+            }
+
+            RowCount = rowCount;
+            Columns = columns?.ToArray() ?? throw new ArgumentNullException(nameof(columns));
+            Route = route ?? CultMeshRouteHint.Automatic;
+            NativeHandle = nativeHandle;
+        }
+
+        /// <summary>Gets the semantic view id.</summary>
+        public string ViewId { get; }
+
+        /// <summary>Gets the schema id for the rows in this view.</summary>
+        public string SchemaId { get; }
+
+        /// <summary>Gets the number of rows in this view.</summary>
+        public int RowCount { get; }
+
+        /// <summary>Gets column descriptors in view order.</summary>
+        public IReadOnlyList<CultMeshNativeSliceColumn> Columns { get; }
+
+        /// <summary>Gets the route that exposes this view.</summary>
+        public CultMeshRouteHint Route { get; }
+
+        /// <summary>Gets an optional runtime-specific native handle.</summary>
+        public string? NativeHandle { get; }
+
+        /// <summary>Gets the estimated byte stride for one row when all columns are densely packed.</summary>
+        public int DenseRowStrideBytes => Columns.Sum(column => column.ElementSizeBytes);
+
+        /// <summary>Finds a column descriptor by name.</summary>
+        public CultMeshNativeSliceColumn? FindColumn(string name)
+        {
+            if (string.IsNullOrWhiteSpace(name)) throw new ArgumentException("Value must be non-empty.", nameof(name));
+            return Columns.FirstOrDefault(column => string.Equals(column.Name, name, StringComparison.Ordinal));
+        }
+
+        private static string RequireNonEmpty(string value, string paramName)
+        {
+            return string.IsNullOrWhiteSpace(value)
+                ? throw new ArgumentException("Value must be non-empty.", paramName)
+                : value;
+        }
+    }
+
+    /// <summary>
+    /// Inspectable metadata for a native slice view.
+    /// </summary>
+    public sealed class CultMeshNativeSliceViewDiagnostic
+    {
+        /// <summary>Creates native slice view diagnostics.</summary>
+        public CultMeshNativeSliceViewDiagnostic(CultMeshNativeSliceViewDescriptor view)
+        {
+            if (view == null) throw new ArgumentNullException(nameof(view));
+            ViewId = view.ViewId;
+            SchemaId = view.SchemaId;
+            RowCount = view.RowCount;
+            Columns = view.Columns.ToArray();
+            Route = view.Route;
+            NativeHandle = view.NativeHandle;
+            DenseRowStrideBytes = view.DenseRowStrideBytes;
+        }
+
+        /// <summary>Gets the semantic view id.</summary>
+        public string ViewId { get; }
+
+        /// <summary>Gets the schema id for rows in this view.</summary>
+        public string SchemaId { get; }
+
+        /// <summary>Gets the row count advertised by this view.</summary>
+        public int RowCount { get; }
+
+        /// <summary>Gets column descriptors in view order.</summary>
+        public IReadOnlyList<CultMeshNativeSliceColumn> Columns { get; }
+
+        /// <summary>Gets the route that exposes this view.</summary>
+        public CultMeshRouteHint Route { get; }
+
+        /// <summary>Gets an optional runtime-specific native handle.</summary>
+        public string? NativeHandle { get; }
+
+        /// <summary>Gets the estimated byte stride for one densely packed row.</summary>
+        public int DenseRowStrideBytes { get; }
+    }
+}
diff --git a/src/GameCult.Mesh/CultMeshProviderSessionWire.cs b/src/GameCult.Mesh/CultMeshProviderSessionWire.cs
new file mode 100644
index 00000000..03f3a70c
--- /dev/null
+++ b/src/GameCult.Mesh/CultMeshProviderSessionWire.cs
@@ -0,0 +1,522 @@
+using System;
+using System.Globalization;
+using GameCult.Networking;
+using MessagePack;
+
+namespace GameCult.Mesh
+{
+    /// <summary>
+    /// Canonical CultNet service, operation, payload-schema, and status identifiers for
+    /// the CultMesh provider-session control plane.
+    /// </summary>
+    public static class CultMeshProviderSessionWireContract
+    {
+        /// <summary>The CultNet service id.</summary>
+        public const string ServiceId = "gamecult.mesh.provider_session";
+
+        /// <summary>The registration operation.</summary>
+        public const string RegisterOperation = "provider.register";
+        /// <summary>The lease-renewal operation.</summary>
+        public const string RenewOperation = "provider.renew";
+        /// <summary>The publication-put operation.</summary>
+        public const string PublicationPutOperation = "provider.publication.put";
+        /// <summary>The publication-delete operation.</summary>
+        public const string PublicationDeleteOperation = "provider.publication.delete";
+        /// <summary>The command-receipt-put operation.</summary>
+        public const string ReceiptPutOperation = "provider.receipt.put";
+        /// <summary>The provider-withdrawal operation.</summary>
+        public const string WithdrawOperation = "provider.withdraw";
+
+        /// <summary>The registration payload schema.</summary>
+        public const string RegistrationSchema = "gamecult.mesh.provider_registration.v1";
+        /// <summary>The provider-lease payload schema.</summary>
+        public const string LeaseSchema = "gamecult.mesh.provider_lease.v1";
+        /// <summary>The lease-renewal payload schema.</summary>
+        public const string LeaseRenewalSchema = "gamecult.mesh.provider_lease_renewal.v1";
+        /// <summary>The publication-put payload schema.</summary>
+        public const string PublicationPutSchema = "gamecult.mesh.provider_publication_put.v1";
+        /// <summary>The publication-delete payload schema.</summary>
+        public const string PublicationDeleteSchema = "gamecult.mesh.provider_publication_delete.v1";
+        /// <summary>The broker-to-provider command document schema.</summary>
+        public const string CommandSchema = "gamecult.mesh.provider_command.v1";
+        /// <summary>The command-receipt-put payload schema.</summary>
+        public const string ReceiptPutSchema = "gamecult.mesh.provider_receipt_put.v1";
+        /// <summary>The provider-withdrawal payload schema.</summary>
+        public const string WithdrawalSchema = "gamecult.mesh.provider_withdrawal.v1";
+        /// <summary>The accepted-mutation response payload schema.</summary>
+        public const string MutationAcceptanceSchema = "gamecult.mesh.provider_mutation_acceptance.v1";
+
+        /// <summary>The successful application status.</summary>
+        public const string OkStatus = "ok";
+        /// <summary>The identity or generation conflict status.</summary>
+        public const string ConflictStatus = "conflict";
+        /// <summary>The expired-lease status.</summary>
+        public const string ExpiredStatus = "expired";
+        /// <summary>The authority-denied status.</summary>
+        public const string DeniedStatus = "denied";
+        /// <summary>The invalid-request status.</summary>
+        public const string InvalidStatus = "invalid";
+        /// <summary>The CultNet inner-payload encoding.</summary>
+        public const string PayloadEncoding = "messagepack-base64";
+    }
+
+    /// <summary>
+    /// Carries provider authorization evidence and a transport-owned connection
+    /// generation in an RUDP Connect packet. The token is not a session id.
+    /// </summary>
+    [MessagePackObject]
+    public sealed class CultMeshProviderConnectEvidenceWire
+    {
+        /// <summary>Gets or sets the fresh id minted for this physical connection.</summary>
+        [Key("clientSessionId")] public string ClientSessionId { get; set; } = string.Empty;
+        /// <summary>Gets or sets the optional signed provider authorization token.</summary>
+        [Key("sessionToken")] public string? SessionToken { get; set; }
+    }
+
+    /// <summary>Requests a fenced provider lease from the provider-session broker.</summary>
+    [MessagePackObject]
+    public sealed class CultMeshProviderRegistrationWire
+    {
+        /// <summary>Gets or sets the stable provider identity.</summary>
+        [Key("providerId")] public string ProviderId { get; set; } = string.Empty;
+        /// <summary>Gets or sets the provider process generation.</summary>
+        [Key("serviceInstanceId")] public string ServiceInstanceId { get; set; } = string.Empty;
+        /// <summary>Gets or sets the advertised endpoint identity.</summary>
+        [Key("endpointId")] public string EndpointId { get; set; } = string.Empty;
+        /// <summary>Gets or sets the Verse identity.</summary>
+        [Key("verseId")] public string VerseId { get; set; } = string.Empty;
+        /// <summary>Gets or sets the requested lease duration in milliseconds.</summary>
+        [Key("requestedLeaseDurationMs")] public int RequestedLeaseDurationMs { get; set; }
+        /// <summary>Gets or sets the optional authority lease authorizing registration.</summary>
+        [Key("authorityLeaseId")] public string? AuthorityLeaseId { get; set; }
+    }
+
+    /// <summary>Identifies the provider generation authorized by a broker lease.</summary>
+    [MessagePackObject]
+    public sealed class CultMeshProviderLeaseWire
+    {
+        /// <summary>Gets or sets the stable provider identity.</summary>
+        [Key("providerId")] public string ProviderId { get; set; } = string.Empty;
+        /// <summary>Gets or sets the authorized provider process generation.</summary>
+        [Key("serviceInstanceId")] public string ServiceInstanceId { get; set; } = string.Empty;
+        /// <summary>Gets or sets the authorized endpoint identity.</summary>
+        [Key("endpointId")] public string EndpointId { get; set; } = string.Empty;
+        /// <summary>Gets or sets the authorized Verse identity.</summary>
+        [Key("verseId")] public string VerseId { get; set; } = string.Empty;
+        /// <summary>Gets or sets the unique fencing lease id.</summary>
+        [Key("leaseId")] public string LeaseId { get; set; } = string.Empty;
+        /// <summary>Gets or sets the RFC3339 lease validity start.</summary>
+        [Key("validFromUtc")] public string ValidFromUtc { get; set; } = string.Empty;
+        /// <summary>Gets or sets the RFC3339 lease expiry.</summary>
+        [Key("expiresAtUtc")] public string ExpiresAtUtc { get; set; } = string.Empty;
+    }
+
+    /// <summary>Requests replacement of an active provider lease.</summary>
+    [MessagePackObject]
+    public sealed class CultMeshProviderLeaseRenewalWire
+    {
+        /// <summary>Gets or sets the lease being replaced.</summary>
+        [Key("leaseId")] public string LeaseId { get; set; } = string.Empty;
+        /// <summary>Gets or sets the requested replacement duration in milliseconds.</summary>
+        [Key("requestedLeaseDurationMs")] public int RequestedLeaseDurationMs { get; set; }
+    }
+
+    /// <summary>Publishes one typed document under an active provider lease.</summary>
+    [MessagePackObject]
+    public sealed class CultMeshProviderPublicationPutWire
+    {
+        /// <summary>Gets or sets the active provider lease.</summary>
+        [Key("leaseId")] public string LeaseId { get; set; } = string.Empty;
+        /// <summary>Gets or sets the provider-owned publication identity.</summary>
+        [Key("publicationId")] public string PublicationId { get; set; } = string.Empty;
+        /// <summary>Gets or sets the exact typed CultNet document.</summary>
+        [Key("document")] public CultNetRawDocumentRecord Document { get; set; } = new CultNetRawDocumentRecord();
+    }
+
+    /// <summary>Deletes one exact provider-owned publication tuple.</summary>
+    [MessagePackObject]
+    public sealed class CultMeshProviderPublicationDeleteWire
+    {
+        /// <summary>Gets or sets the active provider lease.</summary>
+        [Key("leaseId")] public string LeaseId { get; set; } = string.Empty;
+        /// <summary>Gets or sets the provider-owned publication identity.</summary>
+        [Key("publicationId")] public string PublicationId { get; set; } = string.Empty;
+        /// <summary>Gets or sets the exact published schema id.</summary>
+        [Key("schemaId")] public string SchemaId { get; set; } = string.Empty;
+        /// <summary>Gets or sets the exact published record key.</summary>
+        [Key("recordKey")] public string RecordKey { get; set; } = string.Empty;
+    }
+
+    /// <summary>A retained command routed from the broker to one provider generation.</summary>
+    [MessagePackObject]
+    public sealed class CultMeshProviderCommandWire
+    {
+        /// <summary>Gets or sets the stable command identity.</summary>
+        [Key("commandId")] public string CommandId { get; set; } = string.Empty;
+        /// <summary>Gets or sets the provider-defined command kind.</summary>
+        [Key("commandKind")] public string CommandKind { get; set; } = string.Empty;
+        /// <summary>Gets or sets the target provider identity.</summary>
+        [Key("providerId")] public string ProviderId { get; set; } = string.Empty;
+        /// <summary>Gets or sets the target provider process generation.</summary>
+        [Key("serviceInstanceId")] public string ServiceInstanceId { get; set; } = string.Empty;
+        /// <summary>Gets or sets the typed command payload value.</summary>
+        [Key("payload")] public object? Payload { get; set; }
+    }
+
+    /// <summary>The exactly-once outcome of one provider command.</summary>
+    [MessagePackObject]
+    public sealed class CultMeshProviderCommandReceiptWire
+    {
+        /// <summary>Gets or sets the stable receipt identity.</summary>
+        [Key("receiptId")] public string ReceiptId { get; set; } = string.Empty;
+        /// <summary>Gets or sets the completed command identity.</summary>
+        [Key("commandId")] public string CommandId { get; set; } = string.Empty;
+        /// <summary>Gets or sets the completed command kind.</summary>
+        [Key("commandKind")] public string CommandKind { get; set; } = string.Empty;
+        /// <summary>Gets or sets the provider identity.</summary>
+        [Key("providerId")] public string ProviderId { get; set; } = string.Empty;
+        /// <summary>Gets or sets the provider process generation.</summary>
+        [Key("serviceInstanceId")] public string ServiceInstanceId { get; set; } = string.Empty;
+        /// <summary>Gets or sets applied, rejected, or failed.</summary>
+        [Key("state")] public string State { get; set; } = string.Empty;
+        /// <summary>Gets or sets the RFC3339 completion time.</summary>
+        [Key("completedAtUtc")] public string CompletedAtUtc { get; set; } = string.Empty;
+        /// <summary>Gets or sets the optional typed result value.</summary>
+        [Key("result")] public object? Result { get; set; }
+        /// <summary>Gets or sets the optional bounded failure detail.</summary>
+        [Key("error")] public string? Error { get; set; }
+    }
+
+    /// <summary>Submits a durable command receipt under an active provider lease.</summary>
+    [MessagePackObject]
+    public sealed class CultMeshProviderReceiptPutWire
+    {
+        /// <summary>Gets or sets the active provider lease.</summary>
+        [Key("leaseId")] public string LeaseId { get; set; } = string.Empty;
+        /// <summary>Gets or sets the durable command receipt.</summary>
+        [Key("receipt")] public CultMeshProviderCommandReceiptWire Receipt { get; set; } = new CultMeshProviderCommandReceiptWire();
+    }
+
+    /// <summary>Withdraws the provider generation identified by a lease.</summary>
+    [MessagePackObject]
+    public sealed class CultMeshProviderWithdrawalWire
+    {
+        /// <summary>Gets or sets the lease whose owned publications must be withdrawn.</summary>
+        [Key("leaseId")] public string LeaseId { get; set; } = string.Empty;
+    }
+
+    /// <summary>Confirms broker acceptance of one provider-session mutation.</summary>
+    [MessagePackObject]
+    public sealed class CultMeshProviderMutationAcceptanceWire
+    {
+        /// <summary>Gets or sets the RFC3339 broker acceptance time.</summary>
+        [Key("acceptedAtUtc")] public string AcceptedAtUtc { get; set; } = string.Empty;
+        /// <summary>Gets or sets the accepted lease identity, when applicable.</summary>
+        [Key("leaseId")] public string? LeaseId { get; set; }
+        /// <summary>Gets or sets the accepted publication identity, when applicable.</summary>
+        [Key("publicationId")] public string? PublicationId { get; set; }
+        /// <summary>Gets or sets the accepted command identity, when applicable.</summary>
+        [Key("commandId")] public string? CommandId { get; set; }
+        /// <summary>Gets or sets the accepted receipt identity, when applicable.</summary>
+        [Key("receiptId")] public string? ReceiptId { get; set; }
+    }
+
+    /// <summary>
+    /// Encodes provider-session payloads inside the existing CultNet operation envelope.
+    /// Transport acknowledgement is deliberately not treated as application acceptance.
+    /// </summary>
+    public static class CultMeshProviderSessionWire
+    {
+        private static readonly MessagePackSerializerOptions Options =
+            MessagePackSerializerOptions.Standard.WithSecurity(MessagePackSecurity.UntrustedData);
+
+        /// <summary>Encodes one validated provider-session value as MessagePack base64.</summary>
+        public static string EncodePayload<T>(T value)
+        {
+            if (value == null) throw new ArgumentNullException(nameof(value));
+            Validate(value);
+            return Convert.ToBase64String(MessagePackSerializer.Serialize(value, Options));
+        }
+
+        /// <summary>Decodes and validates one MessagePack-base64 provider-session value.</summary>
+        public static T DecodePayload<T>(string payload)
+        {
+            RequireText(payload, nameof(payload));
+            byte[] bytes;
+            try
+            {
+                bytes = Convert.FromBase64String(payload);
+            }
+            catch (FormatException exception)
+            {
+                throw new ArgumentException("Provider-session payload must be MessagePack base64.", nameof(payload), exception);
+            }
+
+            var value = MessagePackSerializer.Deserialize<T>(bytes, Options);
+            if (value == null) throw new MessagePackSerializationException("Provider-session payload decoded to null.");
+            Validate(value);
+            return value;
+        }
+
+        /// <summary>Encodes provider RUDP Connect evidence as a named MessagePack map.</summary>
+        public static byte[] EncodeConnectEvidence(CultMeshProviderConnectEvidenceWire evidence)
+        {
+            if (evidence == null) throw new ArgumentNullException(nameof(evidence));
+            Validate(evidence);
+            return MessagePackSerializer.Serialize(evidence, Options);
+        }
+
+        /// <summary>Decodes and validates provider RUDP Connect evidence.</summary>
+        public static CultMeshProviderConnectEvidenceWire DecodeConnectEvidence(byte[] payload)
+        {
+            if (payload == null) throw new ArgumentNullException(nameof(payload));
+            var evidence = MessagePackSerializer.Deserialize<CultMeshProviderConnectEvidenceWire>(payload, Options);
+            if (evidence == null) throw new MessagePackSerializationException("Provider Connect evidence decoded to null.");
+            Validate(evidence);
+            return evidence;
+        }
+
+        /// <summary>Decodes a retained provider command carried as a raw CultNet document.</summary>
+        public static CultMeshProviderCommandWire DecodeCommandDocument(CultNetRawDocumentRecord document)
+        {
+            if (document == null) throw new ArgumentNullException(nameof(document));
+            if (!string.Equals(document.SchemaId, CultMeshProviderSessionWireContract.CommandSchema, StringComparison.Ordinal))
+                throw new ArgumentException($"Expected provider command schema '{CultMeshProviderSessionWireContract.CommandSchema}'.", nameof(document));
+            if (!string.Equals(document.PayloadEncoding, "messagepack", StringComparison.Ordinal))
+                throw new ArgumentException("Provider command document must use MessagePack.", nameof(document));
+            var command = MessagePackSerializer.Deserialize<CultMeshProviderCommandWire>(document.Payload, Options);
+            if (command == null) throw new MessagePackSerializationException("Provider command decoded to null.");
+            Validate(command);
+            return command;
+        }
+
+        /// <summary>Creates a canonical provider-session CultNet operation request.</summary>
+        public static CultNetOperationRequestMessage CreateRequest<T>(
+            string messageId,
+            string operation,
+            string payloadSchema,
+            T payload,
+            string? sourceRuntimeId = null,
+            string? targetRuntimeId = null)
+        {
+            RequireText(messageId, nameof(messageId));
+            ValidateOperation(operation, payloadSchema);
+            return new CultNetOperationRequestMessage
+            {
+                MessageId = messageId,
+                ServiceId = CultMeshProviderSessionWireContract.ServiceId,
+                Operation = operation,
+                PayloadSchema = payloadSchema,
+                PayloadEncoding = CultMeshProviderSessionWireContract.PayloadEncoding,
+                Payload = EncodePayload(payload),
+                SourceRuntimeId = sourceRuntimeId,
+                TargetRuntimeId = targetRuntimeId
+            };
+        }
+
+        /// <summary>Validates an operation request envelope and decodes its typed payload.</summary>
+        public static T DecodeRequest<T>(
+            CultNetOperationRequestMessage request,
+            string expectedOperation,
+            string expectedPayloadSchema)
+        {
+            if (request == null) throw new ArgumentNullException(nameof(request));
+            RequireEnvelope(request.ServiceId, request.Operation, request.PayloadSchema, request.PayloadEncoding,
+                expectedOperation, expectedPayloadSchema);
+            return DecodePayload<T>(request.Payload);
+        }
+
+        /// <summary>Creates a correlated application-level operation response.</summary>
+        public static CultNetOperationResponseMessage CreateResponse<T>(
+            CultNetOperationRequestMessage request,
+            string status,
+            string payloadSchema,
+            T payload,
+            string? sourceRuntimeId = null)
+        {
+            if (request == null) throw new ArgumentNullException(nameof(request));
+            ValidateStatus(status);
+            return new CultNetOperationResponseMessage
+            {
+                MessageId = RequireText(request.MessageId, nameof(request.MessageId)),
+                ServiceId = CultMeshProviderSessionWireContract.ServiceId,
+                Operation = RequireText(request.Operation, nameof(request.Operation)),
+                Status = status,
+                PayloadSchema = RequireText(payloadSchema, nameof(payloadSchema)),
+                PayloadEncoding = CultMeshProviderSessionWireContract.PayloadEncoding,
+                Payload = EncodePayload(payload),
+                SourceRuntimeId = sourceRuntimeId
+            };
+        }
+
+        /// <summary>Validates an operation response envelope and decodes its typed payload.</summary>
+        public static T DecodeResponse<T>(
+            CultNetOperationResponseMessage response,
+            string expectedOperation,
+            string expectedPayloadSchema)
+        {
+            if (response == null) throw new ArgumentNullException(nameof(response));
+            ValidateStatus(response.Status);
+            RequireEnvelope(response.ServiceId, response.Operation, response.PayloadSchema, response.PayloadEncoding,
+                expectedOperation, expectedPayloadSchema);
+            return DecodePayload<T>(response.Payload);
+        }
+
+        /// <summary>Validates the invariants of a known provider-session wire value.</summary>
+        public static void Validate<T>(T value)
+        {
+            switch (value)
+            {
+                case CultMeshProviderConnectEvidenceWire evidence:
+                    RequireText(evidence.ClientSessionId, nameof(evidence.ClientSessionId));
+                    RequireOptionalText(evidence.SessionToken, nameof(evidence.SessionToken));
+                    break;
+                case CultMeshProviderRegistrationWire registration:
+                    RequireIdentity(registration.ProviderId, registration.ServiceInstanceId, registration.EndpointId, registration.VerseId);
+                    RequirePositive(registration.RequestedLeaseDurationMs, nameof(registration.RequestedLeaseDurationMs));
+                    RequireOptionalText(registration.AuthorityLeaseId, nameof(registration.AuthorityLeaseId));
+                    break;
+                case CultMeshProviderLeaseWire lease:
+                    RequireIdentity(lease.ProviderId, lease.ServiceInstanceId, lease.EndpointId, lease.VerseId);
+                    RequireText(lease.LeaseId, nameof(lease.LeaseId));
+                    var validFrom = RequireTimestamp(lease.ValidFromUtc, nameof(lease.ValidFromUtc));
+                    var expiresAt = RequireTimestamp(lease.ExpiresAtUtc, nameof(lease.ExpiresAtUtc));
+                    if (expiresAt <= validFrom) throw new ArgumentException("Provider lease must expire after validFromUtc.");
+                    break;
+                case CultMeshProviderLeaseRenewalWire renewal:
+                    RequireText(renewal.LeaseId, nameof(renewal.LeaseId));
+                    RequirePositive(renewal.RequestedLeaseDurationMs, nameof(renewal.RequestedLeaseDurationMs));
+                    break;
+                case CultMeshProviderPublicationPutWire publication:
+                    RequireText(publication.LeaseId, nameof(publication.LeaseId));
+                    RequireText(publication.PublicationId, nameof(publication.PublicationId));
+                    if (publication.Document == null) throw new ArgumentException("Provider publication document is required.");
+                    RequireText(publication.Document.SchemaId, nameof(publication.Document.SchemaId));
+                    RequireText(publication.Document.RecordKey, nameof(publication.Document.RecordKey));
+                    if (!string.Equals(publication.Document.PayloadEncoding, "messagepack", StringComparison.Ordinal))
+                        throw new ArgumentException("Provider publication document must use MessagePack.");
+                    break;
+                case CultMeshProviderPublicationDeleteWire deletion:
+                    RequireText(deletion.LeaseId, nameof(deletion.LeaseId));
+                    RequireText(deletion.PublicationId, nameof(deletion.PublicationId));
+                    RequireText(deletion.SchemaId, nameof(deletion.SchemaId));
+                    RequireText(deletion.RecordKey, nameof(deletion.RecordKey));
+                    break;
+                case CultMeshProviderCommandWire command:
+                    RequireText(command.CommandId, nameof(command.CommandId));
+                    RequireText(command.CommandKind, nameof(command.CommandKind));
+                    RequireText(command.ProviderId, nameof(command.ProviderId));
+                    RequireText(command.ServiceInstanceId, nameof(command.ServiceInstanceId));
+                    break;
+                case CultMeshProviderCommandReceiptWire receipt:
+                    RequireText(receipt.ReceiptId, nameof(receipt.ReceiptId));
+                    RequireText(receipt.CommandId, nameof(receipt.CommandId));
+                    RequireText(receipt.CommandKind, nameof(receipt.CommandKind));
+                    RequireText(receipt.ProviderId, nameof(receipt.ProviderId));
+                    RequireText(receipt.ServiceInstanceId, nameof(receipt.ServiceInstanceId));
+                    ValidateReceiptState(receipt.State);
+                    RequireTimestamp(receipt.CompletedAtUtc, nameof(receipt.CompletedAtUtc));
+                    RequireOptionalText(receipt.Error, nameof(receipt.Error));
+                    break;
+                case CultMeshProviderReceiptPutWire receiptPut:
+                    RequireText(receiptPut.LeaseId, nameof(receiptPut.LeaseId));
+                    if (receiptPut.Receipt == null) throw new ArgumentException("Provider receipt is required.");
+                    Validate(receiptPut.Receipt);
+                    break;
+                case CultMeshProviderWithdrawalWire withdrawal:
+                    RequireText(withdrawal.LeaseId, nameof(withdrawal.LeaseId));
+                    break;
+                case CultMeshProviderMutationAcceptanceWire acceptance:
+                    RequireTimestamp(acceptance.AcceptedAtUtc, nameof(acceptance.AcceptedAtUtc));
+                    RequireOptionalText(acceptance.LeaseId, nameof(acceptance.LeaseId));
+                    RequireOptionalText(acceptance.PublicationId, nameof(acceptance.PublicationId));
+                    RequireOptionalText(acceptance.CommandId, nameof(acceptance.CommandId));
+                    RequireOptionalText(acceptance.ReceiptId, nameof(acceptance.ReceiptId));
+                    break;
+            }
+        }
+
+        private static void RequireEnvelope(
+            string serviceId,
+            string operation,
+            string payloadSchema,
+            string payloadEncoding,
+            string expectedOperation,
+            string expectedPayloadSchema)
+        {
+            if (!string.Equals(serviceId, CultMeshProviderSessionWireContract.ServiceId, StringComparison.Ordinal))
+                throw new ArgumentException($"Expected provider-session service '{CultMeshProviderSessionWireContract.ServiceId}'.");
+            if (!string.Equals(operation, expectedOperation, StringComparison.Ordinal))
+                throw new ArgumentException($"Expected provider-session operation '{expectedOperation}'.");
+            if (!string.Equals(payloadSchema, expectedPayloadSchema, StringComparison.Ordinal))
+                throw new ArgumentException($"Expected provider-session payload schema '{expectedPayloadSchema}'.");
+            if (!string.Equals(payloadEncoding, CultMeshProviderSessionWireContract.PayloadEncoding, StringComparison.Ordinal))
+                throw new ArgumentException("Provider-session operation payload must use MessagePack base64.");
+        }
+
+        private static void ValidateOperation(string operation, string payloadSchema)
+        {
+            var expectedSchema = operation switch
+            {
+                CultMeshProviderSessionWireContract.RegisterOperation => CultMeshProviderSessionWireContract.RegistrationSchema,
+                CultMeshProviderSessionWireContract.RenewOperation => CultMeshProviderSessionWireContract.LeaseRenewalSchema,
+                CultMeshProviderSessionWireContract.PublicationPutOperation => CultMeshProviderSessionWireContract.PublicationPutSchema,
+                CultMeshProviderSessionWireContract.PublicationDeleteOperation => CultMeshProviderSessionWireContract.PublicationDeleteSchema,
+                CultMeshProviderSessionWireContract.ReceiptPutOperation => CultMeshProviderSessionWireContract.ReceiptPutSchema,
+                CultMeshProviderSessionWireContract.WithdrawOperation => CultMeshProviderSessionWireContract.WithdrawalSchema,
+                _ => throw new ArgumentException($"Unsupported provider-session operation '{operation}'.", nameof(operation))
+            };
+            if (!string.Equals(payloadSchema, expectedSchema, StringComparison.Ordinal))
+                throw new ArgumentException($"Operation '{operation}' requires payload schema '{expectedSchema}'.", nameof(payloadSchema));
+        }
+
+        private static void ValidateStatus(string status)
+        {
+            if (status != CultMeshProviderSessionWireContract.OkStatus &&
+                status != CultMeshProviderSessionWireContract.ConflictStatus &&
+                status != CultMeshProviderSessionWireContract.ExpiredStatus &&
+                status != CultMeshProviderSessionWireContract.DeniedStatus &&
+                status != CultMeshProviderSessionWireContract.InvalidStatus)
+                throw new ArgumentException($"Unsupported provider-session status '{status}'.", nameof(status));
+        }
+
+        private static void ValidateReceiptState(string state)
+        {
+            if (state != "applied" && state != "rejected" && state != "failed")
+                throw new ArgumentException($"Unsupported provider receipt state '{state}'.", nameof(state));
+        }
+
+        private static void RequireIdentity(string providerId, string serviceInstanceId, string endpointId, string verseId)
+        {
+            RequireText(providerId, nameof(providerId));
+            RequireText(serviceInstanceId, nameof(serviceInstanceId));
+            RequireText(endpointId, nameof(endpointId));
+            RequireText(verseId, nameof(verseId));
+        }
+
+        private static string RequireText(string value, string name)
+        {
+            if (string.IsNullOrWhiteSpace(value)) throw new ArgumentException("Value must be non-empty.", name);
+            return value;
+        }
+
+        private static void RequireOptionalText(string? value, string name)
+        {
+            if (value != null && string.IsNullOrWhiteSpace(value))
+                throw new ArgumentException("Optional value must be null or non-empty.", name);
+        }
+
+        private static void RequirePositive(int value, string name)
+        {
+            if (value <= 0) throw new ArgumentOutOfRangeException(name, "Value must be positive.");
+        }
+
+        private static DateTimeOffset RequireTimestamp(string value, string name)
+        {
+            RequireText(value, name);
+            if (!DateTimeOffset.TryParse(value, CultureInfo.InvariantCulture, DateTimeStyles.RoundtripKind, out var timestamp))
+                throw new ArgumentException("Value must be an RFC3339 timestamp.", name);
+            return timestamp;
+        }
+    }
+}
diff --git a/src/GameCult.Mesh/CultMeshRealtimeTransports.cs b/src/GameCult.Mesh/CultMeshRealtimeTransports.cs
new file mode 100644
index 00000000..d37b7381
--- /dev/null
+++ b/src/GameCult.Mesh/CultMeshRealtimeTransports.cs
@@ -0,0 +1,154 @@
+using System;
+using System.Threading;
+using System.Threading.Tasks;
+
+namespace GameCult.Mesh
+{
+    /// <summary>Delivery semantics requested from a realtime state transport.</summary>
+    public enum CultMeshRealtimeDelivery
+    {
+        ReliableOrdered,
+        LatestOnly,
+        Unreliable
+    }
+
+    /// <summary>
+    /// Transport-neutral realtime state frame. Schema identity and logical generation
+    /// remain stable when the physical connector changes.
+    /// </summary>
+    public sealed class CultMeshRealtimeFrame
+    {
+        public string ChannelId { get; set; } = string.Empty;
+        public string SchemaId { get; set; } = string.Empty;
+        public string BodyId { get; set; } = string.Empty;
+        public long ProducerEpoch { get; set; }
+        public long Sequence { get; set; }
+        public CultMeshRealtimeDelivery Delivery { get; set; }
+        public ReadOnlyMemory<byte> Payload { get; set; }
+
+        internal void Validate()
+        {
+            if (string.IsNullOrWhiteSpace(ChannelId))
+                throw new InvalidOperationException("Realtime channel identity is required.");
+            if (string.IsNullOrWhiteSpace(SchemaId))
+                throw new InvalidOperationException("Realtime schema identity is required.");
+            if (string.IsNullOrWhiteSpace(BodyId))
+                throw new InvalidOperationException("Realtime body identity is required.");
+            if (ProducerEpoch < 0 || Sequence < 0)
+                throw new InvalidOperationException("Realtime epoch and sequence must be non-negative.");
+        }
+    }
+
+    /// <summary>
+    /// Bidirectional realtime state plane. Commands, receipts, manifests, and other
+    /// registered schema documents do not travel through this port.
+    /// </summary>
+    public interface ICultMeshRealtimeTransport : IDisposable
+    {
+        string TransportId { get; }
+        string Endpoint { get; }
+        Task SendAsync(CultMeshRealtimeFrame frame, CancellationToken cancellationToken = default);
+        Task<CultMeshRealtimeFrame> ReceiveAsync(CancellationToken cancellationToken = default);
+    }
+
+    /// <summary>Creates a realtime state transport, normally QUIC streams/datagrams.</summary>
+    public interface ICultMeshRealtimeTransportConnector
+    {
+        string ConnectorId { get; }
+        int Priority { get; }
+        bool CanConnect(CultMeshTransportCandidate candidate);
+        Task<ICultMeshRealtimeTransport> ConnectAsync(
+            CultMeshTransportCandidate candidate,
+            CultMeshSessionTarget target,
+            CancellationToken cancellationToken = default);
+    }
+
+    /// <summary>Reusable identity-bound realtime state session.</summary>
+    public sealed class CultMeshRealtimeSession : IDisposable
+    {
+        private readonly object _gate = new();
+        private readonly Action<CultMeshRealtimeSession> _onTransportFailure;
+        private ICultMeshRealtimeTransport _transport;
+        private bool _disposed;
+
+        internal CultMeshRealtimeSession(
+            CultMeshSessionTarget target,
+            ICultMeshRealtimeTransport transport,
+            CultMeshSessionState state,
+            Action<CultMeshRealtimeSession> onTransportFailure)
+        {
+            Target = target ?? throw new ArgumentNullException(nameof(target));
+            _transport = transport ?? throw new ArgumentNullException(nameof(transport));
+            State = state ?? throw new ArgumentNullException(nameof(state));
+            _onTransportFailure = onTransportFailure ?? throw new ArgumentNullException(nameof(onTransportFailure));
+        }
+
+        public CultMeshSessionTarget Target { get; }
+        public CultMeshSessionState State { get; private set; }
+        public string TransportId { get { lock (_gate) return _transport.TransportId; } }
+
+        public async Task SendAsync(
+            CultMeshRealtimeFrame frame,
+            CancellationToken cancellationToken = default)
+        {
+            if (frame == null) throw new ArgumentNullException(nameof(frame));
+            frame.Validate();
+            var transport = GetTransport();
+            try
+            {
+                await transport.SendAsync(frame, cancellationToken).ConfigureAwait(false);
+            }
+            catch (Exception) when (!cancellationToken.IsCancellationRequested)
+            {
+                _onTransportFailure(this);
+                throw;
+            }
+        }
+
+        public async Task<CultMeshRealtimeFrame> ReceiveAsync(CancellationToken cancellationToken = default)
+        {
+            var transport = GetTransport();
+            try
+            {
+                var frame = await transport.ReceiveAsync(cancellationToken).ConfigureAwait(false);
+                frame.Validate();
+                return frame;
+            }
+            catch (Exception) when (!cancellationToken.IsCancellationRequested)
+            {
+                _onTransportFailure(this);
+                throw;
+            }
+        }
+
+        internal void MarkOffline(CultMeshSessionState state)
+        {
+            lock (_gate)
+            {
+                if (_disposed) return;
+                State = state;
+            }
+        }
+
+        public void Dispose()
+        {
+            ICultMeshRealtimeTransport transport;
+            lock (_gate)
+            {
+                if (_disposed) return;
+                _disposed = true;
+                transport = _transport;
+            }
+            transport.Dispose();
+        }
+
+        private ICultMeshRealtimeTransport GetTransport()
+        {
+            lock (_gate)
+            {
+                if (_disposed) throw new ObjectDisposedException(nameof(CultMeshRealtimeSession));
+                return _transport;
+            }
+        }
+    }
+}
diff --git a/src/GameCult.Mesh/CultMeshRealtimeWireProtocol.cs b/src/GameCult.Mesh/CultMeshRealtimeWireProtocol.cs
new file mode 100644
index 00000000..d0925f12
--- /dev/null
+++ b/src/GameCult.Mesh/CultMeshRealtimeWireProtocol.cs
@@ -0,0 +1,93 @@
+using System;
+using System.Buffers.Binary;
+using System.IO;
+using System.Text;
+
+namespace GameCult.Mesh
+{
+    /// <summary>
+    /// Stable CultMesh realtime frame encoding shared by managed and native QUIC connectors.
+    /// QUIC stream framing remains transport-owned; this codec owns only typed frame bytes.
+    /// </summary>
+    public static class CultMeshRealtimeWireProtocol
+    {
+        public const string ApplicationProtocolName = "cultmesh-state-v1";
+        public const long ConnectionCloseCode = 0x43554c54;
+        public const long StreamAbortCode = 0x53544154;
+        public const byte ReliableStream = 1;
+        public const byte LatestOnlyStream = 2;
+        public const int MaximumFrameBytes = 64 * 1024 * 1024;
+        public const int MaximumEncodedFrameBytes = MaximumFrameBytes + 37 + (3 * ushort.MaxValue);
+
+        private const uint Magic = 0x31545343;
+        private const int FixedHeaderBytes = 37;
+
+        public static byte[] EncodeFrame(CultMeshRealtimeFrame frame)
+        {
+            if (frame == null) throw new ArgumentNullException(nameof(frame));
+            frame.Validate();
+            var channel = Encoding.UTF8.GetBytes(frame.ChannelId);
+            var schema = Encoding.UTF8.GetBytes(frame.SchemaId);
+            var body = Encoding.UTF8.GetBytes(frame.BodyId);
+            if (channel.Length > ushort.MaxValue || schema.Length > ushort.MaxValue || body.Length > ushort.MaxValue)
+                throw new InvalidDataException("Realtime frame identity exceeds the QUIC wire limit.");
+            if (frame.Payload.Length > MaximumFrameBytes)
+                throw new InvalidDataException("Realtime frame payload exceeds the QUIC wire limit.");
+
+            var result = new byte[checked(FixedHeaderBytes + channel.Length + schema.Length + body.Length + frame.Payload.Length)];
+            var span = result.AsSpan();
+            BinaryPrimitives.WriteUInt32LittleEndian(span, Magic);
+            span[4] = (byte)frame.Delivery;
+            BinaryPrimitives.WriteInt64LittleEndian(span.Slice(5), frame.ProducerEpoch);
+            BinaryPrimitives.WriteInt64LittleEndian(span.Slice(13), frame.Sequence);
+            BinaryPrimitives.WriteUInt16LittleEndian(span.Slice(21), (ushort)channel.Length);
+            BinaryPrimitives.WriteUInt16LittleEndian(span.Slice(23), (ushort)schema.Length);
+            BinaryPrimitives.WriteUInt16LittleEndian(span.Slice(25), (ushort)body.Length);
+            BinaryPrimitives.WriteInt32LittleEndian(span.Slice(27), frame.Payload.Length);
+            BinaryPrimitives.WriteInt32LittleEndian(span.Slice(31), FixedHeaderBytes);
+            BinaryPrimitives.WriteUInt16LittleEndian(span.Slice(35), 1);
+            var offset = FixedHeaderBytes;
+            channel.CopyTo(span.Slice(offset)); offset += channel.Length;
+            schema.CopyTo(span.Slice(offset)); offset += schema.Length;
+            body.CopyTo(span.Slice(offset)); offset += body.Length;
+            frame.Payload.Span.CopyTo(span.Slice(offset));
+            return result;
+        }
+
+        public static CultMeshRealtimeFrame DecodeFrame(byte[] bytes)
+        {
+            if (bytes == null) throw new ArgumentNullException(nameof(bytes));
+            if (bytes.Length < FixedHeaderBytes) throw new InvalidDataException("Realtime frame header is truncated.");
+            var span = bytes.AsSpan();
+            if (BinaryPrimitives.ReadUInt32LittleEndian(span) != Magic)
+                throw new InvalidDataException("Realtime frame magic is invalid.");
+            if (BinaryPrimitives.ReadUInt16LittleEndian(span.Slice(35)) != 1 ||
+                BinaryPrimitives.ReadInt32LittleEndian(span.Slice(31)) != FixedHeaderBytes)
+                throw new InvalidDataException("Realtime frame wire version is unsupported.");
+            var delivery = (CultMeshRealtimeDelivery)span[4];
+            if (delivery < CultMeshRealtimeDelivery.ReliableOrdered || delivery > CultMeshRealtimeDelivery.Unreliable)
+                throw new InvalidDataException("Realtime frame delivery mode is invalid.");
+            var channelLength = BinaryPrimitives.ReadUInt16LittleEndian(span.Slice(21));
+            var schemaLength = BinaryPrimitives.ReadUInt16LittleEndian(span.Slice(23));
+            var bodyLength = BinaryPrimitives.ReadUInt16LittleEndian(span.Slice(25));
+            var payloadLength = BinaryPrimitives.ReadInt32LittleEndian(span.Slice(27));
+            var expected = checked(FixedHeaderBytes + channelLength + schemaLength + bodyLength + payloadLength);
+            if (payloadLength < 0 || expected != bytes.Length)
+                throw new InvalidDataException("Realtime frame length is invalid.");
+            var offset = FixedHeaderBytes;
+            var channel = Encoding.UTF8.GetString(bytes, offset, channelLength); offset += channelLength;
+            var schema = Encoding.UTF8.GetString(bytes, offset, schemaLength); offset += schemaLength;
+            var body = Encoding.UTF8.GetString(bytes, offset, bodyLength); offset += bodyLength;
+            return new CultMeshRealtimeFrame
+            {
+                ChannelId = channel,
+                SchemaId = schema,
+                BodyId = body,
+                ProducerEpoch = BinaryPrimitives.ReadInt64LittleEndian(span.Slice(5)),
+                Sequence = BinaryPrimitives.ReadInt64LittleEndian(span.Slice(13)),
+                Delivery = delivery,
+                Payload = bytes.AsMemory(offset, payloadLength)
+            };
+        }
+    }
+}
diff --git a/src/GameCult.Mesh/CultMeshReliabilityDiagnostics.cs b/src/GameCult.Mesh/CultMeshReliabilityDiagnostics.cs
new file mode 100644
index 00000000..5391c77e
--- /dev/null
+++ b/src/GameCult.Mesh/CultMeshReliabilityDiagnostics.cs
@@ -0,0 +1,183 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Reflection;
+using System.Threading;
+using System.Threading.Tasks;
+
+namespace GameCult.Mesh
+{
+    /// <summary>
+    /// Clock used by CultMesh reliability owners.
+    /// </summary>
+    public interface ICultMeshClock
+    {
+        DateTimeOffset UtcNow { get; }
+
+        Task DelayAsync(TimeSpan delay, CancellationToken cancellationToken = default);
+    }
+
+    /// <summary>
+    /// Wall clock used outside deterministic tests.
+    /// </summary>
+    public sealed class CultMeshSystemClock : ICultMeshClock
+    {
+        public static CultMeshSystemClock Instance { get; } = new CultMeshSystemClock();
+
+        private CultMeshSystemClock()
+        {
+        }
+
+        public DateTimeOffset UtcNow => DateTimeOffset.UtcNow;
+
+        public Task DelayAsync(TimeSpan delay, CancellationToken cancellationToken = default)
+        {
+            return Task.Delay(delay, cancellationToken);
+        }
+    }
+
+    public enum CultMeshReliabilityOrgan
+    {
+        Discovery,
+        Session,
+        Authority,
+        ContentTransfer,
+        Stream
+    }
+
+    public enum CultMeshDiagnosticKind
+    {
+        DiscoveryObservation,
+        CandidateRejected,
+        ConnectionAttempt,
+        PathChanged,
+        RetryDecision,
+        AuthorityDecision,
+        VerifiedRange,
+        StreamGap
+    }
+
+    /// <summary>
+    /// One bounded operational observation emitted by a CultMesh reliability owner.
+    /// </summary>
+    public sealed class CultMeshDiagnosticEvent
+    {
+        public CultMeshDiagnosticEvent(
+            long sequence,
+            DateTimeOffset observedAtUtc,
+            CultMeshReliabilityOrgan organ,
+            CultMeshDiagnosticKind kind,
+            string operationId,
+            string subjectId,
+            string state,
+            string reasonCode = "",
+            string sourceId = "",
+            string endpoint = "",
+            string schemaVersion = "",
+            string libraryVersion = "")
+        {
+            if (sequence < 0) throw new ArgumentOutOfRangeException(nameof(sequence));
+            Sequence = sequence;
+            ObservedAtUtc = observedAtUtc;
+            Organ = organ;
+            Kind = kind;
+            OperationId = operationId ?? "";
+            SubjectId = subjectId ?? "";
+            State = state ?? "";
+            ReasonCode = reasonCode ?? "";
+            SourceId = sourceId ?? "";
+            Endpoint = endpoint ?? "";
+            SchemaVersion = schemaVersion ?? "";
+            LibraryVersion = string.IsNullOrWhiteSpace(libraryVersion)
+                ? CultMeshLibraryVersion.Current
+                : libraryVersion;
+        }
+
+        public long Sequence { get; }
+        public DateTimeOffset ObservedAtUtc { get; }
+        public CultMeshReliabilityOrgan Organ { get; }
+        public CultMeshDiagnosticKind Kind { get; }
+        public string OperationId { get; }
+        public string SubjectId { get; }
+        public string State { get; }
+        public string ReasonCode { get; }
+        public string SourceId { get; }
+        public string Endpoint { get; }
+        public string SchemaVersion { get; }
+        public string LibraryVersion { get; }
+    }
+
+    public interface ICultMeshDiagnosticSink
+    {
+        void Emit(CultMeshDiagnosticEvent diagnostic);
+    }
+
+    public sealed class CultMeshNullDiagnosticSink : ICultMeshDiagnosticSink
+    {
+        public static CultMeshNullDiagnosticSink Instance { get; } = new CultMeshNullDiagnosticSink();
+
+        private CultMeshNullDiagnosticSink()
+        {
+        }
+
+        public void Emit(CultMeshDiagnosticEvent diagnostic)
+        {
+        }
+    }
+
+    /// <summary>
+    /// Bounded diagnostic projection suitable for inspection and tests.
+    /// </summary>
+    public sealed class CultMeshDiagnosticBuffer : ICultMeshDiagnosticSink
+    {
+        private readonly object _gate = new object();
+        private readonly Queue<CultMeshDiagnosticEvent> _events;
+
+        public CultMeshDiagnosticBuffer(int capacity = 256)
+        {
+            if (capacity <= 0) throw new ArgumentOutOfRangeException(nameof(capacity));
+            Capacity = capacity;
+            _events = new Queue<CultMeshDiagnosticEvent>(capacity);
+        }
+
+        public int Capacity { get; }
+
+        public IReadOnlyList<CultMeshDiagnosticEvent> Snapshot()
+        {
+            lock (_gate)
+            {
+                return _events.ToArray();
+            }
+        }
+
+        public void Emit(CultMeshDiagnosticEvent diagnostic)
+        {
+            if (diagnostic == null) throw new ArgumentNullException(nameof(diagnostic));
+            lock (_gate)
+            {
+                while (_events.Count >= Capacity)
+                {
+                    _events.Dequeue();
+                }
+                _events.Enqueue(diagnostic);
+            }
+        }
+    }
+
+    public static class CultMeshLibraryVersion
+    {
+        public static string Current { get; } = Resolve();
+
+        private static string Resolve()
+        {
+            var assembly = typeof(CultMeshLibraryVersion).Assembly;
+            var informational = assembly
+                .GetCustomAttributes(typeof(AssemblyInformationalVersionAttribute), false)
+                .OfType<AssemblyInformationalVersionAttribute>()
+                .FirstOrDefault()?.InformationalVersion;
+            return string.IsNullOrWhiteSpace(informational)
+                ? assembly.GetName().Version?.ToString() ?? "unknown"
+                : informational;
+        }
+    }
+}
diff --git a/src/GameCult.Mesh/CultMeshRouteRecordFormatter.cs b/src/GameCult.Mesh/CultMeshRouteRecordFormatter.cs
new file mode 100644
index 00000000..d0df7ebe
--- /dev/null
+++ b/src/GameCult.Mesh/CultMeshRouteRecordFormatter.cs
@@ -0,0 +1,54 @@
+using MessagePack;
+using MessagePack.Formatters;
+
+#nullable enable
+
+namespace GameCult.Mesh
+{
+    /// <summary>
+    /// Reads current structured route records and legacy locality strings.
+    /// </summary>
+    public sealed class CultMeshRouteRecordFormatter : IMessagePackFormatter<CultMeshRouteRecord?>
+    {
+        private const int FieldCount = 2;
+
+        public void Serialize(ref MessagePackWriter writer, CultMeshRouteRecord? value, MessagePackSerializerOptions options)
+        {
+            if (value == null)
+            {
+                writer.WriteNil();
+                return;
+            }
+
+            writer.WriteArrayHeader(FieldCount);
+            writer.Write(value.Kind);
+            writer.Write(value.Description);
+        }
+
+        public CultMeshRouteRecord? Deserialize(ref MessagePackReader reader, MessagePackSerializerOptions options)
+        {
+            if (reader.TryReadNil())
+                return new CultMeshRouteRecord();
+            if (reader.NextMessagePackType == MessagePackType.String)
+                return new CultMeshRouteRecord(reader.ReadString(), "");
+            if (reader.NextMessagePackType != MessagePackType.Array)
+                throw new MessagePackSerializationException(
+                    $"CultMesh route must be a string or array, not {reader.NextMessagePackType}.");
+
+            options.Security.DepthStep(ref reader);
+            try
+            {
+                var fields = reader.ReadArrayHeader();
+                var kind = fields > 0 ? reader.ReadString() ?? "" : "";
+                var description = fields > 1 ? reader.ReadString() ?? "" : "";
+                for (var index = FieldCount; index < fields; index++)
+                    reader.Skip();
+                return new CultMeshRouteRecord(kind, description);
+            }
+            finally
+            {
+                reader.Depth--;
+            }
+        }
+    }
+}
diff --git a/src/GameCult.Mesh/CultMeshSessionIdentity.cs b/src/GameCult.Mesh/CultMeshSessionIdentity.cs
new file mode 100644
index 00000000..3fad99f9
--- /dev/null
+++ b/src/GameCult.Mesh/CultMeshSessionIdentity.cs
@@ -0,0 +1,283 @@
+using System;
+using System.Collections.Generic;
+using System.Collections.Concurrent;
+using System.Linq;
+using System.Security.Cryptography;
+using System.Threading;
+using System.Threading.Tasks;
+using GameCult.Networking;
+
+namespace GameCult.Mesh
+{
+    /// <summary>
+    /// Optional transport proof surfaced by connectors that already authenticate
+    /// the peer during their native handshake. Other schema clients must complete
+    /// the portable CultMesh handshake before use.
+    /// </summary>
+    public interface ICultMeshVerifiedSchemaClient
+    {
+        bool IsVerifiedFor(
+            string verseId,
+            string authorityRuntimeId,
+            string protocolId,
+            string routeGeneration);
+    }
+
+    /// <summary>
+    /// Proof exposed by content and realtime transports after their native or
+    /// portable handshake has bound the physical channel to an Odin route.
+    /// </summary>
+    public interface ICultMeshVerifiedTransport
+    {
+        bool IsVerifiedFor(
+            string verseId,
+            string authorityRuntimeId,
+            string protocolId,
+            string routeGeneration);
+    }
+
+    internal static class CultMeshTransportIdentity
+    {
+        public static void RequireVerified(
+            object transport,
+            CultMeshSessionTarget target,
+            CultMeshProtocolId protocol,
+            CultMeshTransportCandidate candidate)
+        {
+            if (transport is ICultMeshVerifiedTransport verified &&
+                verified.IsVerifiedFor(
+                    target.VerseId,
+                    target.AuthorityRuntimeId,
+                    protocol.Value,
+                    candidate.Generation))
+                return;
+            throw new CultMeshSessionException(new CultMeshSessionFailure(
+                CultMeshSessionFailureReason.Authority,
+                $"Transport did not prove CultMesh authority '{target}' for protocol '{protocol}'.",
+                candidate.Endpoint));
+        }
+    }
+
+    /// <summary>
+    /// Owns the server side of the transport-neutral CultMesh session identity
+    /// handshake. Application messages are not authority proof; providers attach
+    /// this gate to every schema transport they advertise.
+    /// </summary>
+    public sealed class CultMeshSessionIdentityServer : IDisposable
+    {
+        private readonly ICultNetSchemaServer _server;
+        private readonly string _authorityRuntimeId;
+        private readonly HashSet<string> _verseIds;
+        private readonly HashSet<string> _protocolIds;
+        private readonly HashSet<string> _routeGenerations;
+        private readonly Dictionary<string, CultMeshSessionProofSigner> _proofSigners;
+        private readonly ConcurrentDictionary<ICultNetSchemaServerPeer, string> _acceptedPeers = new();
+        private readonly Func<CultMeshSessionOpenMessage, ICultNetSchemaServerPeer, Task> _handler;
+        private readonly ICultNetSchemaServerPeerLifecycle? _peerLifecycle;
+        private bool _disposed;
+
+        public CultMeshSessionIdentityServer(
+            ICultNetSchemaServer server,
+            string authorityRuntimeId,
+            IEnumerable<string> verseIds,
+            IEnumerable<string> protocolIds,
+            IEnumerable<string> routeGenerations,
+            IEnumerable<CultMeshSessionProofSigner>? proofSigners = null)
+        {
+            _server = server ?? throw new ArgumentNullException(nameof(server));
+            _authorityRuntimeId = Require(authorityRuntimeId, nameof(authorityRuntimeId));
+            _verseIds = Clean(verseIds, nameof(verseIds));
+            _protocolIds = Clean(protocolIds, nameof(protocolIds));
+            _routeGenerations = Clean(routeGenerations, nameof(routeGenerations));
+            _proofSigners = (proofSigners ?? Array.Empty<CultMeshSessionProofSigner>())
+                .ToDictionary(signer => signer.Route.Generation, StringComparer.Ordinal);
+            _handler = HandleAsync;
+            _server.OnCultNet(_handler);
+            _peerLifecycle = server as ICultNetSchemaServerPeerLifecycle;
+            if (_peerLifecycle != null)
+                _peerLifecycle.PeerDisconnected += ForgetPeer;
+        }
+
+        /// <summary>
+        /// Resolves the runtime identity established by this peer's accepted session-open handshake.
+        /// Application ingress must use this transport-bound value instead of trusting payload identity fields.
+        /// </summary>
+        public bool TryGetSourceRuntimeId(ICultNetSchemaServerPeer peer, out string sourceRuntimeId) =>
+            _acceptedPeers.TryGetValue(peer, out sourceRuntimeId!);
+
+        public void Dispose()
+        {
+            if (_disposed) return;
+            _disposed = true;
+            _server.RemoveCultNetMessageListener<CultMeshSessionOpenMessage>(_handler);
+            if (_peerLifecycle != null)
+                _peerLifecycle.PeerDisconnected -= ForgetPeer;
+            _acceptedPeers.Clear();
+        }
+
+        private Task HandleAsync(CultMeshSessionOpenMessage request, ICultNetSchemaServerPeer peer)
+        {
+            var error = Validate(request);
+            if (error == null)
+                error = BindPeer(peer, request.SourceRuntimeId);
+            _proofSigners.TryGetValue(request.RouteGeneration ?? string.Empty, out var signer);
+            peer.SendCultNet(new CultMeshSessionAcceptedMessage
+            {
+                MessageId = request.MessageId ?? string.Empty,
+                Accepted = error == null,
+                VerseId = request.VerseId ?? string.Empty,
+                AuthorityRuntimeId = _authorityRuntimeId,
+                ProtocolId = request.ProtocolId ?? string.Empty,
+                RouteGeneration = request.RouteGeneration ?? string.Empty,
+                ClientNonce = request.ClientNonce ?? string.Empty,
+                ProviderKeyId = error == null ? signer?.ProviderKeyId ?? string.Empty : string.Empty,
+                ProviderSignature = error == null && signer != null ? signer.Sign(request) : string.Empty,
+                Error = error
+            });
+            return Task.CompletedTask;
+        }
+
+        private void ForgetPeer(ICultNetSchemaServerPeer peer) => _acceptedPeers.TryRemove(peer, out _);
+
+        private string? BindPeer(ICultNetSchemaServerPeer peer, string sourceRuntimeId)
+        {
+            if (_acceptedPeers.TryGetValue(peer, out var established))
+                return string.Equals(established, sourceRuntimeId, StringComparison.Ordinal)
+                    ? null
+                    : "session-source-runtime-rebind-forbidden";
+            return _acceptedPeers.TryAdd(peer, sourceRuntimeId)
+                ? null
+                : BindPeer(peer, sourceRuntimeId);
+        }
+
+        private string? Validate(CultMeshSessionOpenMessage request)
+        {
+            if (string.IsNullOrWhiteSpace(request.MessageId)) return "session-message-id-required";
+            if (string.IsNullOrWhiteSpace(request.SourceRuntimeId)) return "source-runtime-id-required";
+            if (!TryNonce(request.ClientNonce)) return "client-nonce-invalid";
+            if (!string.Equals(request.AuthorityRuntimeId, _authorityRuntimeId, StringComparison.Ordinal))
+                return "target-runtime-mismatch";
+            if (!_verseIds.Contains(request.VerseId ?? string.Empty)) return "verse-not-served";
+            if (!_protocolIds.Contains(request.ProtocolId ?? string.Empty)) return "protocol-not-served";
+            if (!_routeGenerations.Contains(request.RouteGeneration ?? string.Empty)) return "route-generation-not-served";
+            return null;
+        }
+
+        private static bool TryNonce(string? value)
+        {
+            if (string.IsNullOrWhiteSpace(value)) return false;
+            try { return Convert.FromBase64String(value).Length == 32; }
+            catch (FormatException) { return false; }
+        }
+
+        private static HashSet<string> Clean(IEnumerable<string> values, string name)
+        {
+            if (values == null) throw new ArgumentNullException(name);
+            var result = new HashSet<string>(
+                values.Where(value => !string.IsNullOrWhiteSpace(value)).Select(value => value.Trim()),
+                StringComparer.Ordinal);
+            if (result.Count == 0) throw new ArgumentException("At least one identity is required.", name);
+            return result;
+        }
+
+        private static string Require(string value, string name) =>
+            string.IsNullOrWhiteSpace(value)
+                ? throw new ArgumentException("Value must be non-empty.", name)
+                : value.Trim();
+    }
+
+    internal static class CultMeshSessionIdentityClient
+    {
+        public static async Task VerifyAsync(
+            ICultNetSchemaClient client,
+            string sourceRuntimeId,
+            CultMeshSessionTarget target,
+            CultMeshProtocolId protocol,
+            CultMeshTransportCandidate candidate,
+            CultMeshAuthorityTrustPolicy? trust,
+            DateTimeOffset now,
+            TimeSpan timeout,
+            CancellationToken cancellationToken = default)
+        {
+            if (client == null) throw new ArgumentNullException(nameof(client));
+            if (candidate == null) throw new ArgumentNullException(nameof(candidate));
+            var route = candidate.AuthorityRoute ?? new CultMeshAuthorityRoute(
+                target.AuthorityRuntimeId,
+                candidate.Endpoint,
+                new[] { protocol.Value },
+                candidate.Priority,
+                candidate.Generation);
+            var verifiedRoute = candidate.VerifiedAuthority ??
+                (trust ?? throw new CultMeshSessionException(new CultMeshSessionFailure(
+                    CultMeshSessionFailureReason.Authentication,
+                    "No consumer trust policy verified this CultMesh route.",
+                    candidate.Endpoint))).Verify(target.VerseId, route, now);
+            if (client is ICultMeshVerifiedSchemaClient verified)
+            {
+                if (!verified.IsVerifiedFor(
+                    target.VerseId,
+                    target.AuthorityRuntimeId,
+                    protocol.Value,
+                    candidate.Generation))
+                {
+                    throw new CultMeshSessionException(new CultMeshSessionFailure(
+                        CultMeshSessionFailureReason.Authority,
+                        $"Native transport identity did not match CultMesh target '{target}' for '{protocol}'."));
+                }
+                // Native identity is sufficient only for an explicitly selected
+                // loopback development route. Remote schema sessions still prove
+                // possession of the provider key certified by Odin.
+                if (verifiedRoute.IsLocalDevelopment) return;
+            }
+            var messageId = Guid.NewGuid().ToString("N");
+            var nonce = new byte[32];
+            using (var random = RandomNumberGenerator.Create()) random.GetBytes(nonce);
+            var completion = new TaskCompletionSource<CultMeshSessionAcceptedMessage>(
+                TaskCreationOptions.RunContinuationsAsynchronously);
+            client.OnCultNet<CultMeshSessionAcceptedMessage>(response =>
+            {
+                if (string.Equals(response.MessageId, messageId, StringComparison.Ordinal))
+                    completion.TrySetResult(response);
+            });
+            var request = new CultMeshSessionOpenMessage
+            {
+                MessageId = messageId,
+                SourceRuntimeId = sourceRuntimeId,
+                VerseId = target.VerseId,
+                AuthorityRuntimeId = target.AuthorityRuntimeId,
+                ProtocolId = protocol.Value,
+                RouteGeneration = candidate.Generation,
+                ClientNonce = Convert.ToBase64String(nonce)
+            };
+            client.SendCultNet(request);
+
+            using var deadline = CancellationTokenSource.CreateLinkedTokenSource(cancellationToken);
+            deadline.CancelAfter(timeout);
+            var cancelled = new TaskCompletionSource<bool>(TaskCreationOptions.RunContinuationsAsynchronously);
+            using (deadline.Token.Register(() => cancelled.TrySetResult(true)))
+            {
+                if (await Task.WhenAny(completion.Task, cancelled.Task).ConfigureAwait(false) != completion.Task)
+                {
+                    cancellationToken.ThrowIfCancellationRequested();
+                    throw new CultMeshSessionException(new CultMeshSessionFailure(
+                        CultMeshSessionFailureReason.Timeout,
+                        $"Timed out verifying authority runtime '{target.AuthorityRuntimeId}'."));
+                }
+            }
+
+            var accepted = await completion.Task.ConfigureAwait(false);
+            if (!accepted.Accepted ||
+                !string.Equals(accepted.VerseId, target.VerseId, StringComparison.Ordinal) ||
+                !string.Equals(accepted.AuthorityRuntimeId, target.AuthorityRuntimeId, StringComparison.Ordinal) ||
+                !string.Equals(accepted.ProtocolId, protocol.Value, StringComparison.Ordinal) ||
+                !string.Equals(accepted.RouteGeneration, candidate.Generation, StringComparison.Ordinal) ||
+                !CultMeshAuthorityProof.VerifySession(request, accepted, verifiedRoute))
+            {
+                throw new CultMeshSessionException(new CultMeshSessionFailure(
+                    CultMeshSessionFailureReason.Authority,
+                    $"Route did not prove CultMesh authority '{target}' for protocol '{protocol}': " +
+                    (accepted.Error ?? "identity-mismatch")));
+            }
+        }
+    }
+}
diff --git a/src/GameCult.Mesh/CultMeshSessions.cs b/src/GameCult.Mesh/CultMeshSessions.cs
new file mode 100644
index 00000000..9768dfd5
--- /dev/null
+++ b/src/GameCult.Mesh/CultMeshSessions.cs
@@ -0,0 +1,1220 @@
+using System;
+using System.Collections.Concurrent;
+using System.Collections.Generic;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using GameCult.Networking;
+using R3;
+
+namespace GameCult.Mesh
+{
+    public sealed class CultMeshRuntimeId : IEquatable<CultMeshRuntimeId>
+    {
+        private CultMeshRuntimeId(string value) { Value = value; }
+        public string Value { get; }
+        public static CultMeshRuntimeId Parse(string value) => new CultMeshRuntimeId(
+            string.IsNullOrWhiteSpace(value) ? throw new FormatException("CultMesh runtime identity must be non-empty.") : value.Trim());
+        public bool Equals(CultMeshRuntimeId? other) => other != null && string.Equals(Value, other.Value, StringComparison.Ordinal);
+        public override bool Equals(object? obj) => Equals(obj as CultMeshRuntimeId);
+        public override int GetHashCode() => StringComparer.Ordinal.GetHashCode(Value);
+        public override string ToString() => Value;
+    }
+
+    /// <summary>
+    /// Identifies one provider inside one Verse. Odin resolves this stable pair to
+    /// disposable physical routes; neither value is a socket address.
+    /// </summary>
+    public sealed class CultMeshSessionTarget : IEquatable<CultMeshSessionTarget>
+    {
+        /// <summary>Creates one stable provider target inside one Verse.</summary>
+        public CultMeshSessionTarget(string verseId, string authorityRuntimeId)
+        {
+            VerseId = string.IsNullOrWhiteSpace(verseId)
+                ? throw new ArgumentException("Verse identity is required.", nameof(verseId))
+                : verseId.Trim();
+            AuthorityRuntimeId = CultMeshRuntimeId.Parse(authorityRuntimeId).Value;
+        }
+
+        /// <summary>Gets the stable Verse identity.</summary>
+        public string VerseId { get; }
+        /// <summary>Gets the stable authority runtime identity advertised by that Verse.</summary>
+        public string AuthorityRuntimeId { get; }
+        /// <summary>Compatibility projection. Use <see cref="AuthorityRuntimeId"/>.</summary>
+        [Obsolete("Use AuthorityRuntimeId. Provider identity is not a physical endpoint.")]
+        public string ProviderRuntimeId => AuthorityRuntimeId;
+        internal string SessionKey => VerseId + "\u001f" + AuthorityRuntimeId;
+
+        public bool Equals(CultMeshSessionTarget? other) =>
+            other != null &&
+            string.Equals(VerseId, other.VerseId, StringComparison.Ordinal) &&
+            string.Equals(AuthorityRuntimeId, other.AuthorityRuntimeId, StringComparison.Ordinal);
+        public override bool Equals(object? obj) => Equals(obj as CultMeshSessionTarget);
+        public override int GetHashCode() => HashCode.Combine(
+            StringComparer.Ordinal.GetHashCode(VerseId),
+            StringComparer.Ordinal.GetHashCode(AuthorityRuntimeId));
+        public override string ToString() => VerseId + "/" + AuthorityRuntimeId;
+    }
+
+    public sealed class CultMeshProtocolId : IEquatable<CultMeshProtocolId>
+    {
+        public CultMeshProtocolId(string value) { Value = string.IsNullOrWhiteSpace(value) ? throw new ArgumentException("Protocol identity is required.", nameof(value)) : value; }
+        public string Value { get; }
+        public bool Equals(CultMeshProtocolId? other) => other != null && string.Equals(Value, other.Value, StringComparison.Ordinal);
+        public override bool Equals(object? obj) => Equals(obj as CultMeshProtocolId);
+        public override int GetHashCode() => StringComparer.Ordinal.GetHashCode(Value);
+        public override string ToString() => Value;
+    }
+
+    public static class CultMeshProtocols
+    {
+        public static CultMeshProtocolId Documents { get; } = new CultMeshProtocolId("cultmesh.documents.v1");
+        public static CultMeshProtocolId Content { get; } = new CultMeshProtocolId("cultmesh.content.v1");
+        public static CultMeshProtocolId Bodies { get; } = new CultMeshProtocolId("cultmesh.bodies.v1");
+        public static CultMeshProtocolId Discovery { get; } = new CultMeshProtocolId("cultmesh.discovery.v1");
+        public static CultMeshProtocolId PeerExchange { get; } = new CultMeshProtocolId("cultmesh.peer_exchange.v1");
+        public static CultMeshProtocolId Subscriptions { get; } = new CultMeshProtocolId("cultmesh.subscriptions.v1");
+        public static CultMeshProtocolId RealtimeState { get; } = new CultMeshProtocolId("cultmesh.realtime_state.v1");
+    }
+
+    public enum CultMeshTransportPathKind { Direct, Relay, Tunnel }
+
+    public sealed class CultMeshTransportCandidate
+    {
+        public CultMeshTransportCandidate(
+            string endpoint,
+            CultMeshTransportPathKind pathKind = CultMeshTransportPathKind.Direct,
+            int priority = 0,
+            string authorityRuntimeId = "",
+            string generation = "",
+            CultMeshAuthorityRoute? authorityRoute = null)
+        {
+            Endpoint = string.IsNullOrWhiteSpace(endpoint) ? throw new ArgumentException("Physical endpoint is required.", nameof(endpoint)) : endpoint;
+            PathKind = pathKind;
+            Priority = priority;
+            AuthorityRuntimeId = authorityRuntimeId?.Trim() ?? string.Empty;
+            Generation = generation?.Trim() ?? string.Empty;
+            AuthorityRoute = authorityRoute;
+        }
+        public string Endpoint { get; }
+        public CultMeshTransportPathKind PathKind { get; }
+        public int Priority { get; }
+        public string AuthorityRuntimeId { get; }
+        public string Generation { get; }
+        public CultMeshAuthorityRoute? AuthorityRoute { get; }
+        internal CultMeshVerifiedAuthorityRoute? VerifiedAuthority { get; private set; }
+        internal CultMeshTransportCandidate WithVerifiedAuthority(CultMeshVerifiedAuthorityRoute verified)
+        {
+            VerifiedAuthority = verified ?? throw new ArgumentNullException(nameof(verified));
+            return this;
+        }
+    }
+
+    public enum CultMeshSessionStatus { Connecting, Online, Degraded, Reconnecting, Offline }
+    public enum CultMeshSessionFailureReason { Resolution, Authentication, Transport, Protocol, Timeout, Cancellation, Authority, UnsupportedPath }
+
+    public sealed class CultMeshSessionFailure
+    {
+        public CultMeshSessionFailure(CultMeshSessionFailureReason reason, string message, string endpoint = "")
+        {
+            Reason = reason;
+            Message = message ?? "";
+            Endpoint = endpoint ?? "";
+        }
+        public CultMeshSessionFailureReason Reason { get; }
+        public string Message { get; }
+        public string Endpoint { get; }
+    }
+
+    public sealed class CultMeshSessionState
+    {
+        public CultMeshSessionState(
+            CultMeshSessionStatus status,
+            DateTimeOffset observedAtUtc,
+            CultMeshTransportCandidate? path = null,
+            CultMeshSessionFailure? failure = null)
+        {
+            Status = status;
+            ObservedAtUtc = observedAtUtc;
+            Path = path;
+            Failure = failure;
+        }
+        public CultMeshSessionStatus Status { get; }
+        public DateTimeOffset ObservedAtUtc { get; }
+        public CultMeshTransportCandidate? Path { get; }
+        public CultMeshSessionFailure? Failure { get; }
+    }
+
+    public sealed class CultMeshSessionException : Exception
+    {
+        public CultMeshSessionException(CultMeshSessionFailure failure, Exception? inner = null)
+            : base(failure?.Message, inner) { Failure = failure ?? throw new ArgumentNullException(nameof(failure)); }
+        public CultMeshSessionFailure Failure { get; }
+    }
+
+    public interface ICultMeshTransportConnector
+    {
+        string ConnectorId { get; }
+        int Priority { get; }
+        bool CanConnect(CultMeshTransportCandidate candidate);
+        Task<ICultNetSchemaClient> ConnectAsync(
+            CultMeshTransportCandidate candidate,
+            CultMeshProtocolId protocol,
+            CancellationToken cancellationToken = default);
+    }
+
+    /// <summary>
+    /// Connects exact URI routes through a caller-supplied URI-capable CultNet client.
+    /// This keeps transport packages outside CultMesh while preserving advertised paths.
+    /// </summary>
+    public sealed class CultMeshUriSchemaTransportConnector : ICultMeshTransportConnector
+    {
+        private readonly HashSet<string> _schemes;
+        private readonly Func<string, ICultNetUriSchemaClient> _createClient;
+
+        public CultMeshUriSchemaTransportConnector(
+            string connectorId,
+            IEnumerable<string> schemes,
+            Func<string, ICultNetUriSchemaClient> createClient,
+            int priority = 0)
+        {
+            if (string.IsNullOrWhiteSpace(connectorId))
+                throw new ArgumentException("Connector identity is required.", nameof(connectorId));
+            ConnectorId = connectorId.Trim();
+            _schemes = new HashSet<string>(
+                (schemes ?? throw new ArgumentNullException(nameof(schemes)))
+                    .Where(value => !string.IsNullOrWhiteSpace(value))
+                    .Select(value => value.Trim()),
+                StringComparer.OrdinalIgnoreCase);
+            if (_schemes.Count == 0)
+                throw new ArgumentException("At least one URI scheme is required.", nameof(schemes));
+            _createClient = createClient ?? throw new ArgumentNullException(nameof(createClient));
+            Priority = priority;
+        }
+
+        public string ConnectorId { get; }
+        public int Priority { get; }
+
+        public bool CanConnect(CultMeshTransportCandidate candidate) =>
+            candidate != null &&
+            Uri.TryCreate(candidate.Endpoint, UriKind.Absolute, out var uri) &&
+            _schemes.Contains(uri.Scheme);
+
+        public async Task<ICultNetSchemaClient> ConnectAsync(
+            CultMeshTransportCandidate candidate,
+            CultMeshProtocolId protocol,
+            CancellationToken cancellationToken = default)
+        {
+            if (!CanConnect(candidate))
+                throw new NotSupportedException($"Connector '{ConnectorId}' does not support '{candidate?.Endpoint}'.");
+            var endpoint = new Uri(candidate.Endpoint, UriKind.Absolute);
+            var client = _createClient(candidate.Endpoint)
+                ?? throw new InvalidOperationException($"Connector '{ConnectorId}' returned no schema client.");
+            try
+            {
+                await client.ConnectAsync(endpoint, cancellationToken).ConfigureAwait(false);
+                return client;
+            }
+            catch
+            {
+                client.Dispose();
+                throw;
+            }
+        }
+    }
+
+    /// <summary>
+    /// Explicit compatibility connector for the previous RUDP/LiteNetLib schema lanes.
+    /// Prefer <see cref="CultMeshTcpSchemaTransportConnector"/> for registered schemas.
+    /// </summary>
+    public sealed class CultMeshSchemaTransportConnector : ICultMeshTransportConnector
+    {
+        private readonly Func<string, ICultNetSchemaClient> _createClient;
+        private readonly ICultMeshClock _clock;
+        private readonly TimeSpan _connectTimeout;
+
+        public CultMeshSchemaTransportConnector(
+            Func<string, ICultNetSchemaClient>? createClient = null,
+            ICultMeshClock? clock = null,
+            TimeSpan? connectTimeout = null)
+        {
+            _createClient = createClient ?? (endpoint => CultNetSchemaClients.CreateForEndpoint(endpoint));
+            _clock = clock ?? CultMeshSystemClock.Instance;
+            _connectTimeout = connectTimeout ?? TimeSpan.FromSeconds(5);
+        }
+
+        public string ConnectorId => "legacy-datagram-schema";
+        public int Priority => 10_000;
+        public bool CanConnect(CultMeshTransportCandidate candidate) =>
+            Uri.TryCreate(candidate.Endpoint, UriKind.Absolute, out var uri) &&
+            (string.Equals(uri.Scheme, "rudp", StringComparison.OrdinalIgnoreCase) ||
+             string.Equals(uri.Scheme, "cultnet", StringComparison.OrdinalIgnoreCase));
+
+        public async Task<ICultNetSchemaClient> ConnectAsync(
+            CultMeshTransportCandidate candidate,
+            CultMeshProtocolId protocol,
+            CancellationToken cancellationToken = default)
+        {
+            if (!CanConnect(candidate)) throw new NotSupportedException($"Unsupported CultNet endpoint '{candidate.Endpoint}'.");
+            var client = _createClient(candidate.Endpoint);
+            try
+            {
+                var (host, port) = CultNetSchemaWriteForwarder.ParseEndpoint(candidate.Endpoint);
+                client.Connect(host, port);
+                var deadline = _clock.UtcNow + _connectTimeout;
+                while (!client.Connected)
+                {
+                    cancellationToken.ThrowIfCancellationRequested();
+                    if (_clock.UtcNow >= deadline)
+                        throw new TimeoutException($"Timed out connecting to '{candidate.Endpoint}'.");
+                    await _clock.DelayAsync(TimeSpan.FromMilliseconds(25), cancellationToken).ConfigureAwait(false);
+                }
+                return client;
+            }
+            catch
+            {
+                client.Dispose();
+                throw;
+            }
+        }
+    }
+
+    /// <summary>Preferred connector for registered schema, command, receipt, and manifest traffic.</summary>
+    public sealed class CultMeshTcpSchemaTransportConnector : ICultMeshTransportConnector
+    {
+        private readonly Func<string, ICultNetSchemaClient> _createClient;
+        private readonly ICultMeshClock _clock;
+        private readonly TimeSpan _connectTimeout;
+
+        public CultMeshTcpSchemaTransportConnector(
+            Func<string, ICultNetSchemaClient>? createClient = null,
+            ICultMeshClock? clock = null,
+            TimeSpan? connectTimeout = null)
+        {
+            _createClient = createClient ?? (_ => CultNetSchemaClients.CreateTcpFramed());
+            _clock = clock ?? CultMeshSystemClock.Instance;
+            _connectTimeout = connectTimeout ?? TimeSpan.FromSeconds(5);
+        }
+
+        public string ConnectorId => "tcp-schema";
+        public int Priority => 0;
+        public bool CanConnect(CultMeshTransportCandidate candidate) =>
+            Uri.TryCreate(candidate.Endpoint, UriKind.Absolute, out var uri) &&
+            string.Equals(uri.Scheme, "cultnet+tcp", StringComparison.OrdinalIgnoreCase);
+
+        public async Task<ICultNetSchemaClient> ConnectAsync(
+            CultMeshTransportCandidate candidate,
+            CultMeshProtocolId protocol,
+            CancellationToken cancellationToken = default)
+        {
+            if (!CanConnect(candidate))
+                throw new NotSupportedException($"TCP schema connector does not support '{candidate.Endpoint}'.");
+            var client = _createClient(candidate.Endpoint);
+            try
+            {
+                var (host, port) = CultNetSchemaWriteForwarder.ParseEndpoint(candidate.Endpoint);
+                client.Connect(host, port);
+                var deadline = _clock.UtcNow + _connectTimeout;
+                while (!client.Connected)
+                {
+                    cancellationToken.ThrowIfCancellationRequested();
+                    if (_clock.UtcNow >= deadline)
+                        throw new TimeoutException($"Timed out connecting to '{candidate.Endpoint}'.");
+                    await _clock.DelayAsync(TimeSpan.FromMilliseconds(25), cancellationToken).ConfigureAwait(false);
+                }
+                return client;
+            }
+            catch
+            {
+                client.Dispose();
+                throw;
+            }
+        }
+    }
+
+    public sealed class CultMeshSession : IDisposable
+    {
+        private readonly Subject<CultMeshSessionState> _states = new();
+        private readonly ManagedSchemaChannel _channel;
+        private long _physicalGeneration;
+        private bool _disposed;
+        internal CultMeshSession(CultMeshSessionTarget target, CultMeshProtocolId protocol, ICultNetSchemaClient channel, CultMeshSessionState state)
+        {
+            Target = target;
+            Protocol = protocol;
+            _channel = new ManagedSchemaChannel(channel);
+            State = state;
+        }
+        public CultMeshSessionTarget Target { get; }
+        public CultMeshProtocolId Protocol { get; }
+        internal ICultNetSchemaClient Channel => _channel;
+        public CultMeshSessionState State { get; private set; }
+        internal long PhysicalGeneration => Interlocked.Read(ref _physicalGeneration);
+        public Observable<CultMeshSessionState> WatchState() => _states;
+        public ICultNetSchemaClient OpenSchemaClient() => new SessionSchemaClient(this);
+        public void SendCultNet<T>(T message) where T : ICultNetSchemaMessage => Channel.SendCultNet(message);
+        public IDisposable OnCultNet<T>(Action<T> callback) where T : ICultNetSchemaMessage
+        {
+            if (callback == null) throw new ArgumentNullException(nameof(callback));
+            return _channel.Subscribe(callback);
+        }
+        internal void Transition(CultMeshSessionState state) { State = state; _states.OnNext(state); }
+        internal void ReplacePhysicalChannel(ICultNetSchemaClient channel)
+        {
+            _channel.Replace(channel);
+            Interlocked.Increment(ref _physicalGeneration);
+        }
+        public void Dispose()
+        {
+            if (_disposed) return;
+            _disposed = true;
+            _channel.Dispose();
+            _states.Dispose();
+        }
+
+        private sealed class ManagedSchemaChannel : ICultNetSchemaClient
+        {
+            private readonly object _gate = new();
+            private readonly Dictionary<Type, IChannelRegistration> _registrations = new();
+            private ICultNetSchemaClient _physical;
+            private bool _disposed;
+
+            public ManagedSchemaChannel(ICultNetSchemaClient physical) =>
+                _physical = physical ?? throw new ArgumentNullException(nameof(physical));
+
+            public bool Connected { get { lock (_gate) return !_disposed && _physical.Connected; } }
+            public void Connect(string host, int port)
+            {
+                lock (_gate)
+                {
+                    ThrowIfDisposed();
+                    _physical.Connect(host, port);
+                }
+            }
+            public void SendCultNet<T>(T message) where T : ICultNetSchemaMessage
+            {
+                lock (_gate)
+                {
+                    ThrowIfDisposed();
+                    _physical.SendCultNet(message);
+                }
+            }
+            public void OnCultNet<T>(Action<T> callback) where T : ICultNetSchemaMessage
+            {
+                _ = Subscribe(callback);
+            }
+            public IDisposable Subscribe<T>(Action<T> callback) where T : ICultNetSchemaMessage
+            {
+                if (callback == null) throw new ArgumentNullException(nameof(callback));
+                lock (_gate)
+                {
+                    ThrowIfDisposed();
+                    if (!_registrations.TryGetValue(typeof(T), out var existing))
+                    {
+                        var created = new ChannelRegistration<T>();
+                        created.Attach(_physical);
+                        _registrations.Add(typeof(T), created);
+                        existing = created;
+                    }
+                    return ((ChannelRegistration<T>)existing).Subscribe(callback);
+                }
+            }
+            public void Replace(ICultNetSchemaClient physical)
+            {
+                if (physical == null) throw new ArgumentNullException(nameof(physical));
+                ICultNetSchemaClient previous;
+                lock (_gate)
+                {
+                    ThrowIfDisposed();
+                    previous = _physical;
+                    foreach (var registration in _registrations.Values) registration.Attach(physical);
+                    _physical = physical;
+                }
+                previous.Dispose();
+            }
+            public void Dispose()
+            {
+                ICultNetSchemaClient physical;
+                lock (_gate)
+                {
+                    if (_disposed) return;
+                    _disposed = true;
+                    physical = _physical;
+                    foreach (var registration in _registrations.Values) registration.Dispose();
+                    _registrations.Clear();
+                }
+                physical.Dispose();
+            }
+            private void ThrowIfDisposed() { if (_disposed) throw new ObjectDisposedException(nameof(ManagedSchemaChannel)); }
+
+            private interface IChannelRegistration : IDisposable { void Attach(ICultNetSchemaClient physical); }
+            private sealed class ChannelRegistration<T> : IChannelRegistration where T : ICultNetSchemaMessage
+            {
+                private readonly object _gate = new();
+                private readonly Dictionary<long, Action<T>> _callbacks = new();
+                private long _nextId;
+                private bool _disposed;
+
+                public IDisposable Subscribe(Action<T> callback)
+                {
+                    lock (_gate)
+                    {
+                        if (_disposed) throw new ObjectDisposedException(nameof(ChannelRegistration<T>));
+                        var id = ++_nextId;
+                        _callbacks.Add(id, callback);
+                        return new Subscription(this, id);
+                    }
+                }
+
+                public void Attach(ICultNetSchemaClient physical) => physical.OnCultNet<T>(Dispatch);
+
+                public void Dispose()
+                {
+                    lock (_gate)
+                    {
+                        _disposed = true;
+                        _callbacks.Clear();
+                    }
+                }
+
+                private void Dispatch(T message)
+                {
+                    Action<T>[] callbacks;
+                    lock (_gate) callbacks = _callbacks.Values.ToArray();
+                    foreach (var callback in callbacks) callback(message);
+                }
+
+                private void Unsubscribe(long id)
+                {
+                    lock (_gate) _callbacks.Remove(id);
+                }
+
+                private sealed class Subscription : IDisposable
+                {
+                    private ChannelRegistration<T>? _owner;
+                    private readonly long _id;
+
+                    public Subscription(ChannelRegistration<T> owner, long id)
+                    {
+                        _owner = owner;
+                        _id = id;
+                    }
+
+                    public void Dispose() => Interlocked.Exchange(ref _owner, null)?.Unsubscribe(_id);
+                }
+            }
+        }
+
+        private sealed class SessionSchemaClient : ICultNetSchemaClient
+        {
+            private readonly CultMeshSession _session;
+            private readonly ConcurrentBag<IDisposable> _registrations = new();
+            private bool _disposed;
+            public SessionSchemaClient(CultMeshSession session) { _session = session; }
+            public bool Connected => !_disposed && _session.State.Status == CultMeshSessionStatus.Online;
+            public void Connect(string host, int port)
+            {
+                if (_disposed) throw new ObjectDisposedException(nameof(SessionSchemaClient));
+                if (!Connected) throw new InvalidOperationException("The managed CultMesh session is not online.");
+            }
+            public void SendCultNet<T>(T message) where T : ICultNetSchemaMessage
+            {
+                if (_disposed) throw new ObjectDisposedException(nameof(SessionSchemaClient));
+                _session.SendCultNet(message);
+            }
+            public void OnCultNet<T>(Action<T> callback) where T : ICultNetSchemaMessage
+            {
+                if (_disposed) throw new ObjectDisposedException(nameof(SessionSchemaClient));
+                _registrations.Add(_session.OnCultNet(callback));
+            }
+            public void Dispose()
+            {
+                if (_disposed) return;
+                _disposed = true;
+                foreach (var registration in _registrations) registration.Dispose();
+            }
+        }
+    }
+
+    public sealed class CultMeshSessionManagerOptions
+    {
+        public ICultMeshClock Clock { get; set; } = CultMeshSystemClock.Instance;
+        public ICultMeshDiagnosticSink Diagnostics { get; set; } = CultMeshNullDiagnosticSink.Instance;
+        public int MaxRacedCandidates { get; set; } = 2;
+        public string RuntimeId { get; set; } = "cultmesh-client";
+        public TimeSpan IdentityHandshakeTimeout { get; set; } = TimeSpan.FromSeconds(5);
+        /// <summary>Gets or sets the consumer-owned trust roots and explicit local-development policy.</summary>
+        public CultMeshAuthorityTrustPolicy Trust { get; set; } = new(
+            CultMeshAuthorityTrustMode.AuthenticatedRemote);
+    }
+
+    public sealed class CultMeshSessionManager : IDisposable
+    {
+        private readonly CultMeshDiscoveryService _discovery;
+        private readonly ICultMeshTransportConnector[] _connectors;
+        private readonly ICultMeshContentTransportConnector[] _contentConnectors;
+        private readonly ICultMeshRealtimeTransportConnector[] _realtimeConnectors;
+        private readonly CultMeshSessionManagerOptions _options;
+        private readonly ConcurrentDictionary<string, Lazy<Task<CultMeshSession>>> _sessions = new(StringComparer.Ordinal);
+        private readonly ConcurrentDictionary<string, Lazy<Task<CultMeshContentSession>>> _contentSessions = new(StringComparer.Ordinal);
+        private readonly ConcurrentDictionary<string, Lazy<Task<CultMeshRealtimeSession>>> _realtimeSessions = new(StringComparer.Ordinal);
+        private long _diagnosticSequence;
+        private bool _disposed;
+
+        public CultMeshSessionManager(
+            CultMeshDiscoveryService discovery,
+            IEnumerable<ICultMeshTransportConnector> connectors,
+            CultMeshSessionManagerOptions? options = null)
+            : this(
+                discovery,
+                connectors,
+                Array.Empty<ICultMeshContentTransportConnector>(),
+                Array.Empty<ICultMeshRealtimeTransportConnector>(),
+                options)
+        {
+        }
+
+        public CultMeshSessionManager(
+            CultMeshDiscoveryService discovery,
+            IEnumerable<ICultMeshTransportConnector> connectors,
+            IEnumerable<ICultMeshContentTransportConnector> contentConnectors,
+            CultMeshSessionManagerOptions? options = null)
+            : this(
+                discovery,
+                connectors,
+                contentConnectors,
+                Array.Empty<ICultMeshRealtimeTransportConnector>(),
+                options)
+        {
+        }
+
+        public CultMeshSessionManager(
+            CultMeshDiscoveryService discovery,
+            IEnumerable<ICultMeshTransportConnector> connectors,
+            IEnumerable<ICultMeshContentTransportConnector> contentConnectors,
+            IEnumerable<ICultMeshRealtimeTransportConnector> realtimeConnectors,
+            CultMeshSessionManagerOptions? options = null)
+        {
+            _discovery = discovery ?? throw new ArgumentNullException(nameof(discovery));
+            _connectors = connectors?.ToArray() ?? throw new ArgumentNullException(nameof(connectors));
+            _contentConnectors = contentConnectors?.ToArray() ?? throw new ArgumentNullException(nameof(contentConnectors));
+            _realtimeConnectors = realtimeConnectors?.ToArray() ?? throw new ArgumentNullException(nameof(realtimeConnectors));
+            if (_contentConnectors.Any(connector => connector == null))
+                throw new ArgumentException("Content transport connectors cannot contain null entries.", nameof(contentConnectors));
+            if (_realtimeConnectors.Any(connector => connector == null))
+                throw new ArgumentException("Realtime transport connectors cannot contain null entries.", nameof(realtimeConnectors));
+            _options = options ?? new CultMeshSessionManagerOptions();
+            if (_options.MaxRacedCandidates <= 0) throw new ArgumentOutOfRangeException(nameof(options));
+            if (string.IsNullOrWhiteSpace(_options.RuntimeId)) throw new ArgumentException("Client runtime identity is required.", nameof(options));
+            if (_options.IdentityHandshakeTimeout <= TimeSpan.Zero) throw new ArgumentOutOfRangeException(nameof(options));
+        }
+
+        public async Task<CultMeshSession> ConnectAsync(
+            CultMeshSessionTarget target,
+            CultMeshProtocolId protocol,
+            CancellationToken cancellationToken = default)
+        {
+            if (target == null) throw new ArgumentNullException(nameof(target));
+            if (protocol == null) throw new ArgumentNullException(nameof(protocol));
+            ThrowIfDisposed();
+            var key = target.SessionKey + "\u001f" + protocol.Value;
+            while (true)
+            {
+                var lazy = _sessions.GetOrAdd(key, _ => new Lazy<Task<CultMeshSession>>(
+                    () => ConnectOwnedAsync(key, target, protocol), LazyThreadSafetyMode.ExecutionAndPublication));
+                try
+                {
+                    var session = await AwaitForCallerAsync(lazy.Value, cancellationToken).ConfigureAwait(false);
+                    if (session.State.Status != CultMeshSessionStatus.Offline) return session;
+                    _sessions.TryRemove(key, out _);
+                }
+                catch
+                {
+                    _sessions.TryRemove(key, out _);
+                    throw;
+                }
+            }
+        }
+
+        /// <summary>
+        /// Connects one reusable streaming content plane by stable Verse/provider identity.
+        /// Preferred connector tiers are exhausted before legacy fallback tiers are attempted.
+        /// </summary>
+        public async Task<CultMeshContentSession> ConnectContentAsync(
+            CultMeshSessionTarget target,
+            CancellationToken cancellationToken = default)
+        {
+            if (target == null) throw new ArgumentNullException(nameof(target));
+            ThrowIfDisposed();
+            var key = target.SessionKey;
+            while (true)
+            {
+                var lazy = _contentSessions.GetOrAdd(key, _ => new Lazy<Task<CultMeshContentSession>>(
+                    () => ConnectContentOwnedAsync(key, target), LazyThreadSafetyMode.ExecutionAndPublication));
+                try
+                {
+                    var session = await AwaitForCallerAsync(lazy.Value, cancellationToken).ConfigureAwait(false);
+                    if (session.State.Status != CultMeshSessionStatus.Offline) return session;
+                    _contentSessions.TryRemove(key, out _);
+                }
+                catch
+                {
+                    _contentSessions.TryRemove(key, out _);
+                    throw;
+                }
+            }
+        }
+
+        private async Task<CultMeshContentSession> ConnectContentOwnedAsync(
+            string key,
+            CultMeshSessionTarget target)
+        {
+            var result = await ResolveContentPathAsync(target).ConfigureAwait(false);
+            var session = new CultMeshContentSession(
+                target,
+                result.Transport,
+                new CultMeshSessionState(CultMeshSessionStatus.Online, _options.Clock.UtcNow, result.Candidate),
+                failed => InvalidateContentSession(key, failed));
+            Emit(target, CultMeshProtocols.Content, "online", result.Candidate.Endpoint);
+            return session;
+        }
+
+        private async Task<ConnectedContentPath> ResolveContentPathAsync(CultMeshSessionTarget target)
+        {
+            if (_contentConnectors.Length == 0)
+                throw Failure(
+                    CultMeshSessionFailureReason.UnsupportedPath,
+                    "No streaming content connectors are configured. Register the TCP content connector or the explicit legacy RUDP connector.");
+
+            var discovery = await _discovery.ResolveAsync(new CultMeshDiscoveryQuery(
+                target.AuthorityRuntimeId,
+                new[] { target.VerseId },
+                target.AuthorityRuntimeId)).ConfigureAwait(false);
+            var candidates = BoundCandidates(discovery, target, CultMeshProtocols.Content);
+            var routes = candidates
+                .SelectMany(candidate => _contentConnectors
+                    .Where(connector => connector.CanConnect(candidate))
+                    .Select(connector => new ContentRoute(candidate, connector)))
+                .OrderBy(route => route.Connector.Priority)
+                .ThenBy(route => route.Candidate.Priority)
+                .ToArray();
+            if (routes.Length == 0)
+                throw Failure(
+                    CultMeshSessionFailureReason.UnsupportedPath,
+                    $"No streaming content connector supports an advertised route for '{target}'.");
+
+            var failures = new List<Exception>();
+            foreach (var tier in routes.GroupBy(route => route.Connector.Priority).OrderBy(group => group.Key))
+            {
+                var attempts = tier.Take(_options.MaxRacedCandidates)
+                    .Select(route => ConnectContentCandidateAsync(target, route))
+                    .ToList();
+                while (attempts.Count > 0)
+                {
+                    var completed = await Task.WhenAny(attempts).ConfigureAwait(false);
+                    attempts.Remove(completed);
+                    try
+                    {
+                        var result = await completed.ConfigureAwait(false);
+                        foreach (var loser in attempts)
+                            _ = loser.ContinueWith(task =>
+                            {
+                                if (task.Status == TaskStatus.RanToCompletion) task.Result.Transport.Dispose();
+                            }, TaskScheduler.Default);
+                        return result;
+                    }
+                    catch (Exception error)
+                    {
+                        failures.Add(error);
+                    }
+                }
+            }
+
+            var last = failures.LastOrDefault();
+            var reason = last is CultMeshSessionException typed
+                ? typed.Failure.Reason
+                : last is TimeoutException
+                    ? CultMeshSessionFailureReason.Timeout
+                    : CultMeshSessionFailureReason.Transport;
+            throw Failure(
+                reason,
+                $"No streaming content path connected for '{target}'.",
+                last);
+        }
+
+        private static async Task<ConnectedContentPath> ConnectContentCandidateAsync(
+            CultMeshSessionTarget target,
+            ContentRoute route)
+        {
+            var transport = await route.Connector.ConnectAsync(route.Candidate, target).ConfigureAwait(false);
+            try
+            {
+                CultMeshTransportIdentity.RequireVerified(
+                    transport, target, CultMeshProtocols.Content, route.Candidate);
+                return new ConnectedContentPath(route.Candidate, transport);
+            }
+            catch
+            {
+                transport.Dispose();
+                throw;
+            }
+        }
+
+        private void InvalidateContentSession(string key, CultMeshContentSession session)
+        {
+            session.MarkOffline(new CultMeshSessionState(
+                CultMeshSessionStatus.Offline,
+                _options.Clock.UtcNow,
+                session.State.Path,
+                new CultMeshSessionFailure(
+                    CultMeshSessionFailureReason.Transport,
+                    "The selected streaming content transport failed.",
+                    session.State.Path?.Endpoint ?? string.Empty)));
+            if (_contentSessions.TryRemove(key, out var removed) &&
+                removed.IsValueCreated && removed.Value.Status == TaskStatus.RanToCompletion)
+                removed.Value.Result.Dispose();
+            Emit(session.Target, CultMeshProtocols.Content, "offline", session.State.Path?.Endpoint ?? string.Empty);
+        }
+
+        /// <summary>
+        /// Connects the realtime state plane. No connector is implied: promoted runtimes
+        /// register QUIC explicitly, while RUDP compatibility remains opt-in.
+        /// </summary>
+        public async Task<CultMeshRealtimeSession> ConnectRealtimeAsync(
+            CultMeshSessionTarget target,
+            CancellationToken cancellationToken = default)
+        {
+            if (target == null) throw new ArgumentNullException(nameof(target));
+            ThrowIfDisposed();
+            var key = target.SessionKey;
+            while (true)
+            {
+                var lazy = _realtimeSessions.GetOrAdd(key, _ => new Lazy<Task<CultMeshRealtimeSession>>(
+                    () => ConnectRealtimeOwnedAsync(key, target), LazyThreadSafetyMode.ExecutionAndPublication));
+                try
+                {
+                    var session = await AwaitForCallerAsync(lazy.Value, cancellationToken).ConfigureAwait(false);
+                    if (session.State.Status != CultMeshSessionStatus.Offline) return session;
+                    _realtimeSessions.TryRemove(key, out _);
+                }
+                catch
+                {
+                    _realtimeSessions.TryRemove(key, out _);
+                    throw;
+                }
+            }
+        }
+
+        private async Task<CultMeshRealtimeSession> ConnectRealtimeOwnedAsync(
+            string key,
+            CultMeshSessionTarget target)
+        {
+            var result = await ResolveRealtimePathAsync(target).ConfigureAwait(false);
+            var session = new CultMeshRealtimeSession(
+                target,
+                result.Transport,
+                new CultMeshSessionState(CultMeshSessionStatus.Online, _options.Clock.UtcNow, result.Candidate),
+                failed => InvalidateRealtimeSession(key, failed));
+            Emit(target, CultMeshProtocols.RealtimeState, "online", result.Candidate.Endpoint);
+            return session;
+        }
+
+        private async Task<ConnectedRealtimePath> ResolveRealtimePathAsync(CultMeshSessionTarget target)
+        {
+            if (_realtimeConnectors.Length == 0)
+                throw Failure(
+                    CultMeshSessionFailureReason.UnsupportedPath,
+                    "No realtime state connectors are configured. Register a QUIC connector explicitly.");
+
+            var discovery = await _discovery.ResolveAsync(new CultMeshDiscoveryQuery(
+                target.AuthorityRuntimeId,
+                new[] { target.VerseId },
+                target.AuthorityRuntimeId)).ConfigureAwait(false);
+            var routes = BoundCandidates(discovery, target, CultMeshProtocols.RealtimeState)
+                .SelectMany(candidate => _realtimeConnectors
+                    .Where(connector => connector.CanConnect(candidate))
+                    .Select(connector => new RealtimeRoute(candidate, connector)))
+                .OrderBy(route => route.Connector.Priority)
+                .ThenBy(route => route.Candidate.Priority)
+                .ToArray();
+            if (routes.Length == 0)
+                throw Failure(
+                    CultMeshSessionFailureReason.UnsupportedPath,
+                    $"No realtime connector supports an advertised route for '{target}'.");
+
+            var failures = new List<Exception>();
+            foreach (var tier in routes.GroupBy(route => route.Connector.Priority).OrderBy(group => group.Key))
+            {
+                var attempts = tier.Take(_options.MaxRacedCandidates)
+                    .Select(route => ConnectRealtimeCandidateAsync(target, route))
+                    .ToList();
+                while (attempts.Count > 0)
+                {
+                    var completed = await Task.WhenAny(attempts).ConfigureAwait(false);
+                    attempts.Remove(completed);
+                    try
+                    {
+                        var result = await completed.ConfigureAwait(false);
+                        foreach (var loser in attempts)
+                            _ = loser.ContinueWith(task =>
+                            {
+                                if (task.Status == TaskStatus.RanToCompletion) task.Result.Transport.Dispose();
+                            }, TaskScheduler.Default);
+                        return result;
+                    }
+                    catch (Exception error)
+                    {
+                        failures.Add(error);
+                    }
+                }
+            }
+
+            var last = failures.LastOrDefault();
+            var reason = last is CultMeshSessionException typed
+                ? typed.Failure.Reason
+                : last is TimeoutException
+                    ? CultMeshSessionFailureReason.Timeout
+                    : CultMeshSessionFailureReason.Transport;
+            throw Failure(
+                reason,
+                $"No realtime state path connected for '{target}'.",
+                last);
+        }
+
+        private static async Task<ConnectedRealtimePath> ConnectRealtimeCandidateAsync(
+            CultMeshSessionTarget target,
+            RealtimeRoute route)
+        {
+            var transport = await route.Connector.ConnectAsync(route.Candidate, target).ConfigureAwait(false);
+            try
+            {
+                CultMeshTransportIdentity.RequireVerified(
+                    transport, target, CultMeshProtocols.RealtimeState, route.Candidate);
+                return new ConnectedRealtimePath(route.Candidate, transport);
+            }
+            catch
+            {
+                transport.Dispose();
+                throw;
+            }
+        }
+
+        private void InvalidateRealtimeSession(string key, CultMeshRealtimeSession session)
+        {
+            var endpoint = session.State.Path?.Endpoint ?? string.Empty;
+            session.MarkOffline(new CultMeshSessionState(
+                CultMeshSessionStatus.Offline,
+                _options.Clock.UtcNow,
+                session.State.Path,
+                new CultMeshSessionFailure(
+                    CultMeshSessionFailureReason.Transport,
+                    "The selected realtime state transport failed.",
+                    endpoint)));
+            if (_realtimeSessions.TryRemove(key, out var removed) &&
+                removed.IsValueCreated && removed.Value.Status == TaskStatus.RanToCompletion)
+                removed.Value.Result.Dispose();
+            Emit(session.Target, CultMeshProtocols.RealtimeState, "offline", endpoint);
+        }
+
+        private async Task<CultMeshSession> ConnectOwnedAsync(string key, CultMeshSessionTarget target, CultMeshProtocolId protocol)
+        {
+            var result = await ResolveConnectedPathAsync(target, protocol).ConfigureAwait(false);
+            var session = new CultMeshSession(target, protocol, result.Client,
+                new CultMeshSessionState(CultMeshSessionStatus.Online, _options.Clock.UtcNow, result.Candidate));
+            ObservePhysicalFailure(key, session, result);
+            Emit(target, protocol, "online", result.Candidate.Endpoint);
+            return session;
+        }
+
+        private async Task<ConnectedPath> ResolveConnectedPathAsync(CultMeshSessionTarget target, CultMeshProtocolId protocol)
+        {
+            var discovery = await _discovery.ResolveAsync(new CultMeshDiscoveryQuery(
+                target.AuthorityRuntimeId,
+                new[] { target.VerseId },
+                target.AuthorityRuntimeId)).ConfigureAwait(false);
+            var candidates = BoundCandidates(discovery, target, protocol);
+            var routes = candidates
+                .SelectMany(candidate => _connectors
+                    .Where(connector => connector.CanConnect(candidate))
+                    .Select(connector => new SchemaRoute(candidate, connector)))
+                .OrderBy(route => route.Connector.Priority)
+                .ThenBy(route => route.Candidate.Priority)
+                .ToArray();
+            if (candidates.Length == 0)
+                throw Failure(CultMeshSessionFailureReason.Resolution, $"No route candidates for '{target}'.");
+            if (routes.Length == 0)
+                throw Failure(
+                    CultMeshSessionFailureReason.Transport,
+                    $"No transport path connected for '{target}' and protocol '{protocol}'.",
+                    Failure(
+                        CultMeshSessionFailureReason.UnsupportedPath,
+                        $"No registered connector supports an advertised route for '{target}'."));
+
+            var failures = new List<Exception>();
+            foreach (var tier in routes.GroupBy(route => route.Connector.Priority).OrderBy(group => group.Key))
+            {
+                var attempts = tier.Take(_options.MaxRacedCandidates)
+                    .Select(route => ConnectCandidateAsync(target, route, protocol))
+                    .ToList();
+                while (attempts.Count > 0)
+                {
+                    var completed = await Task.WhenAny(attempts).ConfigureAwait(false);
+                    attempts.Remove(completed);
+                    try
+                    {
+                        var result = await completed.ConfigureAwait(false);
+                        foreach (var loser in attempts)
+                            _ = loser.ContinueWith(task => { if (task.Status == TaskStatus.RanToCompletion) task.Result.Client.Dispose(); }, TaskScheduler.Default);
+                        return result;
+                    }
+                    catch (Exception error) { failures.Add(error); }
+                }
+            }
+            var last = failures.LastOrDefault();
+            var reason = last is CultMeshSessionException typed
+                ? typed.Failure.Reason
+                : last is TimeoutException
+                    ? CultMeshSessionFailureReason.Timeout
+                    : CultMeshSessionFailureReason.Transport;
+            throw Failure(reason,
+                $"No transport path connected for '{target}' and protocol '{protocol}'.", last);
+        }
+
+        private void ObservePhysicalFailure(string key, CultMeshSession session, ConnectedPath path)
+        {
+            if (path.Client is not ICultNetSchemaClientHealth health) return;
+            _ = health.BackgroundFailure.ContinueWith(
+                task => ReconnectOwnedAsync(key, session, path, task),
+                CancellationToken.None,
+                TaskContinuationOptions.ExecuteSynchronously,
+                TaskScheduler.Default).Unwrap();
+        }
+
+        private async Task ReconnectOwnedAsync(
+            string key,
+            CultMeshSession session,
+            ConnectedPath failedPath,
+            Task<Exception> failureTask)
+        {
+            if (_disposed || session.State.Status == CultMeshSessionStatus.Offline) return;
+            var error = failureTask.Status == TaskStatus.RanToCompletion ? failureTask.Result : failureTask.Exception;
+            var failure = new CultMeshSessionFailure(
+                CultMeshSessionFailureReason.Transport,
+                error?.Message ?? "Transport background loop stopped.",
+                failedPath.Candidate.Endpoint);
+            session.Transition(new CultMeshSessionState(
+                CultMeshSessionStatus.Reconnecting,
+                _options.Clock.UtcNow,
+                failedPath.Candidate,
+                failure));
+            Emit(session.Target, session.Protocol, "reconnecting", failedPath.Candidate.Endpoint);
+            try
+            {
+                _discovery.Invalidate(new CultMeshDiscoveryQuery(
+                    session.Target.AuthorityRuntimeId,
+                    new[] { session.Target.VerseId },
+                    session.Target.AuthorityRuntimeId));
+                var replacement = await ResolveConnectedPathAsync(session.Target, session.Protocol).ConfigureAwait(false);
+                session.ReplacePhysicalChannel(replacement.Client);
+                session.Transition(new CultMeshSessionState(
+                    CultMeshSessionStatus.Online,
+                    _options.Clock.UtcNow,
+                    replacement.Candidate));
+                ObservePhysicalFailure(key, session, replacement);
+                Emit(session.Target, session.Protocol, "online", replacement.Candidate.Endpoint);
+            }
+            catch (Exception reconnectError)
+            {
+                session.Transition(new CultMeshSessionState(
+                    CultMeshSessionStatus.Offline,
+                    _options.Clock.UtcNow,
+                    failedPath.Candidate,
+                    new CultMeshSessionFailure(
+                        reconnectError is CultMeshSessionException typed ? typed.Failure.Reason : CultMeshSessionFailureReason.Transport,
+                        reconnectError.Message,
+                        failedPath.Candidate.Endpoint)));
+                _sessions.TryRemove(key, out _);
+                Emit(session.Target, session.Protocol, "offline", failedPath.Candidate.Endpoint);
+            }
+        }
+
+        private async Task<ConnectedPath> ConnectCandidateAsync(
+            CultMeshSessionTarget target,
+            SchemaRoute route,
+            CultMeshProtocolId protocol)
+        {
+            var client = await route.Connector.ConnectAsync(route.Candidate, protocol).ConfigureAwait(false);
+            try
+            {
+                await CultMeshSessionIdentityClient.VerifyAsync(
+                    client,
+                    _options.RuntimeId,
+                    target,
+                    protocol,
+                    route.Candidate,
+                    _options.Trust,
+                    _options.Clock.UtcNow,
+                    _options.IdentityHandshakeTimeout).ConfigureAwait(false);
+                return new ConnectedPath(route.Candidate, client);
+            }
+            catch
+            {
+                client.Dispose();
+                throw;
+            }
+        }
+
+        private static async Task<T> AwaitForCallerAsync<T>(Task<T> shared, CancellationToken cancellationToken)
+        {
+            if (!cancellationToken.CanBeCanceled) return await shared.ConfigureAwait(false);
+            var cancelled = new TaskCompletionSource<bool>(TaskCreationOptions.RunContinuationsAsynchronously);
+            using (cancellationToken.Register(() => cancelled.TrySetResult(true)))
+            {
+                if (await Task.WhenAny(shared, cancelled.Task).ConfigureAwait(false) != shared)
+                    throw new OperationCanceledException(cancellationToken);
+            }
+            return await shared.ConfigureAwait(false);
+        }
+
+        private CultMeshSessionException Failure(CultMeshSessionFailureReason reason, string message, Exception? inner = null) =>
+            new CultMeshSessionException(new CultMeshSessionFailure(reason, message), inner);
+
+        private CultMeshTransportCandidate[] BoundCandidates(
+            CultMeshDiscoveryState discovery,
+            CultMeshSessionTarget target,
+            CultMeshProtocolId protocol)
+        {
+            var routes = discovery.Candidates
+                .SelectMany(candidate => candidate.Descriptor.AuthorityRoutes)
+                .Where(route => string.Equals(
+                    route.AuthorityRuntimeId,
+                    target.AuthorityRuntimeId,
+                    StringComparison.Ordinal))
+                .Where(route => route.Supports(protocol))
+                .ToArray();
+            var verified = new List<CultMeshTransportCandidate>();
+            var rejected = new List<Exception>();
+            foreach (var route in routes)
+            {
+                try
+                {
+                    verified.Add(new CultMeshTransportCandidate(
+                        route.Endpoint,
+                        priority: route.Priority,
+                        authorityRuntimeId: route.AuthorityRuntimeId,
+                        generation: route.Generation,
+                        authorityRoute: route)
+                    .WithVerifiedAuthority(_options.Trust.Verify(
+                        target.VerseId,
+                        route,
+                        _options.Clock.UtcNow)));
+                }
+                catch (CultMeshSessionException error)
+                {
+                    rejected.Add(error);
+                }
+            }
+            if (verified.Count == 0 && rejected.Count > 0)
+            {
+                throw Failure(
+                    CultMeshSessionFailureReason.Authentication,
+                    $"No trusted route remained for CultMesh target '{target}' and protocol '{protocol}'.",
+                    new AggregateException(rejected));
+            }
+            return verified
+                .GroupBy(candidate => candidate.Endpoint, StringComparer.Ordinal)
+                .Select(group => group.OrderBy(candidate => candidate.Priority).First())
+                .OrderBy(candidate => candidate.Priority)
+                .ThenBy(candidate => candidate.Endpoint, StringComparer.Ordinal)
+                .ToArray();
+        }
+
+        private void Emit(CultMeshSessionTarget target, CultMeshProtocolId protocol, string state, string path)
+        {
+            _options.Diagnostics.Emit(new CultMeshDiagnosticEvent(
+                Interlocked.Increment(ref _diagnosticSequence), _options.Clock.UtcNow,
+                CultMeshReliabilityOrgan.Session, CultMeshDiagnosticKind.PathChanged,
+                target.SessionKey + ":" + protocol.Value, target.AuthorityRuntimeId, state,
+                sourceId: "session-manager", endpoint: path));
+        }
+
+        public void Dispose()
+        {
+            if (_disposed) return;
+            _disposed = true;
+            foreach (var lazy in _sessions.Values)
+                if (lazy.IsValueCreated && lazy.Value.Status == TaskStatus.RanToCompletion) lazy.Value.Result.Dispose();
+            _sessions.Clear();
+            foreach (var lazy in _contentSessions.Values)
+                if (lazy.IsValueCreated && lazy.Value.Status == TaskStatus.RanToCompletion) lazy.Value.Result.Dispose();
+            _contentSessions.Clear();
+            foreach (var lazy in _realtimeSessions.Values)
+                if (lazy.IsValueCreated && lazy.Value.Status == TaskStatus.RanToCompletion) lazy.Value.Result.Dispose();
+            _realtimeSessions.Clear();
+        }
+
+        private void ThrowIfDisposed() { if (_disposed) throw new ObjectDisposedException(nameof(CultMeshSessionManager)); }
+
+        private sealed class ConnectedPath
+        {
+            public ConnectedPath(CultMeshTransportCandidate candidate, ICultNetSchemaClient client) { Candidate = candidate; Client = client; }
+            public CultMeshTransportCandidate Candidate { get; }
+            public ICultNetSchemaClient Client { get; }
+        }
+
+        private sealed class ConnectedContentPath
+        {
+            public ConnectedContentPath(CultMeshTransportCandidate candidate, ICultMeshContentTransport transport)
+            {
+                Candidate = candidate;
+                Transport = transport;
+            }
+            public CultMeshTransportCandidate Candidate { get; }
+            public ICultMeshContentTransport Transport { get; }
+        }
+
+        private sealed class SchemaRoute
+        {
+            public SchemaRoute(CultMeshTransportCandidate candidate, ICultMeshTransportConnector connector)
+            {
+                Candidate = candidate;
+                Connector = connector;
+            }
+            public CultMeshTransportCandidate Candidate { get; }
+            public ICultMeshTransportConnector Connector { get; }
+        }
+
+        private sealed class ContentRoute
+        {
+            public ContentRoute(CultMeshTransportCandidate candidate, ICultMeshContentTransportConnector connector)
+            {
+                Candidate = candidate;
+                Connector = connector;
+            }
+            public CultMeshTransportCandidate Candidate { get; }
+            public ICultMeshContentTransportConnector Connector { get; }
+        }
+
+        private sealed class ConnectedRealtimePath
+        {
+            public ConnectedRealtimePath(CultMeshTransportCandidate candidate, ICultMeshRealtimeTransport transport)
+            {
+                Candidate = candidate;
+                Transport = transport;
+            }
+            public CultMeshTransportCandidate Candidate { get; }
+            public ICultMeshRealtimeTransport Transport { get; }
+        }
+
+        private sealed class RealtimeRoute
+        {
+            public RealtimeRoute(CultMeshTransportCandidate candidate, ICultMeshRealtimeTransportConnector connector)
+            {
+                Candidate = candidate;
+                Connector = connector;
+            }
+            public CultMeshTransportCandidate Candidate { get; }
+            public ICultMeshRealtimeTransportConnector Connector { get; }
+        }
+    }
+}
diff --git a/src/GameCult.Mesh/CultMeshSimulationFacts.cs b/src/GameCult.Mesh/CultMeshSimulationFacts.cs
index 6efa8711..11c7d296 100644
--- a/src/GameCult.Mesh/CultMeshSimulationFacts.cs
+++ b/src/GameCult.Mesh/CultMeshSimulationFacts.cs
@@ -13,6 +13,7 @@ namespace GameCult.Mesh
     /// Committed simulation fact derived from witness consensus.
     /// </summary>
     [CultDocument("gamecult.mesh.simulation_fact", "gamecult.mesh.simulation_fact.v1")]
+    [MessagePackObject]
     public sealed class CultMeshSimulationFact
     {
         /// <summary>
diff --git a/src/GameCult.Mesh/CultMeshSingleFileDocuments.cs b/src/GameCult.Mesh/CultMeshSingleFileDocuments.cs
new file mode 100644
index 00000000..5e2295df
--- /dev/null
+++ b/src/GameCult.Mesh/CultMeshSingleFileDocuments.cs
@@ -0,0 +1,339 @@
+using System;
+using System.Buffers;
+using System.IO;
+using System.Linq;
+using System.Security.Cryptography;
+using GameCult.Caching;
+using GameCult.Caching.MessagePack;
+using MessagePack;
+
+namespace GameCult.Mesh
+{
+    /// <summary>
+    /// Schema metadata used when publishing one raw document payload as a CultCache single-file snapshot.
+    /// </summary>
+    public sealed class CultMeshSingleFileDocumentSchema
+    {
+        /// <summary>
+        /// Creates schema metadata for a single-file document publication.
+        /// </summary>
+        public CultMeshSingleFileDocumentSchema(string schemaId, string schemaName, string schemaVersion)
+        {
+            if (string.IsNullOrWhiteSpace(schemaId)) throw new ArgumentException("Value must be non-empty.", nameof(schemaId));
+            if (string.IsNullOrWhiteSpace(schemaName)) throw new ArgumentException("Value must be non-empty.", nameof(schemaName));
+            if (string.IsNullOrWhiteSpace(schemaVersion)) throw new ArgumentException("Value must be non-empty.", nameof(schemaVersion));
+
+            SchemaId = schemaId;
+            SchemaName = schemaName;
+            SchemaVersion = schemaVersion;
+        }
+
+        /// <summary>
+        /// Gets the content-derived schema identifier.
+        /// </summary>
+        public string SchemaId { get; }
+
+        /// <summary>
+        /// Gets the stable schema name.
+        /// </summary>
+        public string SchemaName { get; }
+
+        /// <summary>
+        /// Gets the schema version.
+        /// </summary>
+        public string SchemaVersion { get; }
+
+        /// <summary>
+        /// Gets or sets an optional canonical schema description.
+        /// </summary>
+        public string CanonicalSchemaJson { get; set; } = string.Empty;
+
+        /// <summary>
+        /// Gets or sets compatible schema identifiers accepted for this document.
+        /// </summary>
+        public string[] CompatibleSchemaIds { get; set; } = Array.Empty<string>();
+
+        internal CultSchemaCatalogEntry ToCatalogEntry(byte[] payload)
+        {
+            return new CultSchemaCatalogEntry
+            {
+                SchemaId = SchemaId,
+                SchemaName = SchemaName,
+                SchemaVersion = SchemaVersion,
+                ContentHash = StableHash(payload),
+                CanonicalSchemaJson = CanonicalSchemaJson,
+                CompatibleSchemaIds = CompatibleSchemaIds
+                    .Append(SchemaId)
+                    .Where(candidate => !string.IsNullOrWhiteSpace(candidate))
+                    .Distinct(StringComparer.Ordinal)
+                    .ToArray(),
+                Members = Array.Empty<CultSchemaMemberCatalogEntry>()
+            };
+        }
+
+        private static string StableHash(byte[] payload)
+        {
+            if (payload == null || payload.Length == 0)
+                return "empty";
+
+            using var sha = SHA256.Create();
+            return BitConverter.ToString(sha.ComputeHash(payload)).Replace("-", "", StringComparison.Ordinal).ToLowerInvariant();
+        }
+    }
+
+    public static partial class CultMesh
+    {
+        /// <summary>
+        /// Writes one typed document as a canonical single-file MessagePack CultCache snapshot.
+        /// </summary>
+        public static void WriteSingleFileDocument<TDocument>(
+            string path,
+            CultRecordKey key,
+            TDocument document,
+            string? storedAt = null,
+            CultDocumentRegistry? registry = null)
+            where TDocument : class
+        {
+            if (document == null) throw new ArgumentNullException(nameof(document));
+
+            var resolvedRegistry = registry ?? CultDocumentRegistry.Shared;
+            var descriptor = resolvedRegistry.GetRequired<TDocument>();
+            WriteSingleFileDocumentPayload(
+                path,
+                key,
+                descriptor.ToCatalogEntry(),
+                storedAt,
+                CultDocumentMessagePackSerialization.SerializeUntyped(document, typeof(TDocument)));
+        }
+
+        /// <summary>
+        /// Reads one typed document from a single-file MessagePack CultCache snapshot.
+        /// </summary>
+        public static TDocument ReadSingleFileDocument<TDocument>(
+            string path,
+            CultRecordKey key,
+            CultDocumentRegistry? registry = null)
+            where TDocument : class
+        {
+            var resolvedRegistry = registry ?? CultDocumentRegistry.Shared;
+            var descriptor = resolvedRegistry.GetRequired<TDocument>();
+            var payload = ReadSingleFileDocumentPayload(path, key, descriptor.SchemaId);
+            return (TDocument)CultDocumentMessagePackSerialization.DeserializeUntyped(typeof(TDocument), payload);
+        }
+
+        /// <summary>
+        /// Writes one raw document payload as a canonical single-file MessagePack CultCache snapshot.
+        /// </summary>
+        public static void WriteSingleFileDocumentPayload(
+            string path,
+            CultRecordKey key,
+            CultMeshSingleFileDocumentSchema schema,
+            string? storedAt,
+            byte[] payload)
+        {
+            if (schema == null) throw new ArgumentNullException(nameof(schema));
+            WriteSingleFileDocumentPayload(path, key, schema.ToCatalogEntry(payload), storedAt, payload);
+        }
+
+        /// <summary>
+        /// Reads one raw document payload from a single-file MessagePack CultCache snapshot.
+        /// </summary>
+        public static byte[] ReadSingleFileDocumentPayload(
+            string path,
+            CultRecordKey key,
+            string expectedSchemaId)
+        {
+            if (string.IsNullOrWhiteSpace(path)) throw new ArgumentException("Value must be non-empty.", nameof(path));
+            if (string.IsNullOrWhiteSpace(expectedSchemaId)) throw new ArgumentException("Value must be non-empty.", nameof(expectedSchemaId));
+
+            var snapshot = ReadSingleFileSnapshot(path);
+            var record = snapshot.Records.SingleOrDefault(candidate => string.Equals(candidate.Key, key.Value, StringComparison.Ordinal))
+                ?? throw new InvalidDataException($"CultCache document '{path}' does not contain record '{key.Value}'.");
+
+            if (!string.Equals(record.SchemaId, expectedSchemaId, StringComparison.Ordinal))
+            {
+                throw new InvalidDataException(
+                    $"CultCache document '{path}' record '{key.Value}' has schema '{record.SchemaId}', expected '{expectedSchemaId}'.");
+            }
+
+            if (!PublishesSchema(snapshot.SchemaCatalog, expectedSchemaId))
+            {
+                throw new InvalidDataException(
+                    $"CultCache document '{path}' does not publish schema '{expectedSchemaId}' in its catalog.");
+            }
+
+            return record.Payload;
+        }
+
+        /// <summary>
+        /// Reads the only raw document payload from a single-file MessagePack CultCache snapshot.
+        /// </summary>
+        public static byte[] ReadSingleFileDocumentPayload(
+            string path,
+            string expectedSchemaId)
+        {
+            if (string.IsNullOrWhiteSpace(path)) throw new ArgumentException("Value must be non-empty.", nameof(path));
+            if (string.IsNullOrWhiteSpace(expectedSchemaId)) throw new ArgumentException("Value must be non-empty.", nameof(expectedSchemaId));
+
+            var snapshot = ReadSingleFileSnapshot(path);
+            if (snapshot.Records.Length != 1)
+            {
+                throw new InvalidDataException(
+                    $"CultCache document '{path}' must contain exactly one record.");
+            }
+
+            var record = snapshot.Records[0];
+            if (!string.Equals(record.SchemaId, expectedSchemaId, StringComparison.Ordinal))
+            {
+                throw new InvalidDataException(
+                    $"CultCache document '{path}' has schema '{record.SchemaId}', expected '{expectedSchemaId}'.");
+            }
+
+            if (!PublishesSchema(snapshot.SchemaCatalog, expectedSchemaId))
+            {
+                throw new InvalidDataException(
+                    $"CultCache document '{path}' does not publish schema '{expectedSchemaId}' in its catalog.");
+            }
+
+            return record.Payload;
+        }
+
+        private static void WriteSingleFileDocumentPayload(
+            string path,
+            CultRecordKey key,
+            CultSchemaCatalogEntry catalogEntry,
+            string? storedAt,
+            byte[] payload)
+        {
+            if (string.IsNullOrWhiteSpace(path)) throw new ArgumentException("Value must be non-empty.", nameof(path));
+            if (catalogEntry == null) throw new ArgumentNullException(nameof(catalogEntry));
+            if (string.IsNullOrWhiteSpace(catalogEntry.SchemaId))
+                throw new ArgumentException("Catalog entry must include a schema id.", nameof(catalogEntry));
+
+            payload ??= Array.Empty<byte>();
+            var snapshot = new CultPersistedStoreSnapshot
+            {
+                SchemaCatalog = new[] { catalogEntry },
+                Records = new[]
+                {
+                    new CultPersistedRecord
+                    {
+                        Key = key.Value,
+                        SchemaId = catalogEntry.SchemaId,
+                        StoredAt = string.IsNullOrWhiteSpace(storedAt) ? DateTimeOffset.UtcNow.ToString("O") : storedAt!,
+                        Payload = payload
+                    }
+                }
+            };
+
+            var directory = Path.GetDirectoryName(path);
+            if (!string.IsNullOrWhiteSpace(directory))
+                Directory.CreateDirectory(directory);
+
+            WriteFileAtomically(path, CultDocumentMessagePackSerialization.SerializeSnapshot(snapshot));
+        }
+
+        private static CultPersistedStoreSnapshot ReadSingleFileSnapshot(string path)
+        {
+            var bytes = File.ReadAllBytes(path);
+            try
+            {
+                return CultDocumentMessagePackSerialization.DeserializeSnapshot(bytes);
+            }
+            catch (Exception ex) when (ex is MessagePackSerializationException or InvalidOperationException)
+            {
+                return ReadLegacySingleFileSnapshot(bytes);
+            }
+        }
+
+        private static CultPersistedStoreSnapshot ReadLegacySingleFileSnapshot(byte[] bytes)
+        {
+            var reader = new MessagePackReader(bytes);
+            var fieldCount = reader.ReadArrayHeader();
+            var snapshot = new CultPersistedStoreSnapshot();
+            if (fieldCount > 0)
+                snapshot.FormatVersion = reader.ReadString() ?? "cultcache.store.v1";
+
+            if (fieldCount > 1)
+            {
+                var catalogCount = reader.ReadArrayHeader();
+                snapshot.SchemaCatalog = new CultSchemaCatalogEntry[catalogCount];
+                for (var index = 0; index < catalogCount; index++)
+                    snapshot.SchemaCatalog[index] = ReadLegacySchemaCatalogEntry(ref reader);
+            }
+
+            if (fieldCount > 2)
+            {
+                var recordCount = reader.ReadArrayHeader();
+                snapshot.Records = new CultPersistedRecord[recordCount];
+                for (var index = 0; index < recordCount; index++)
+                    snapshot.Records[index] = ReadLegacyPersistedRecord(ref reader);
+            }
+
+            for (var index = 3; index < fieldCount; index++)
+                reader.Skip();
+
+            return snapshot;
+        }
+
+        private static CultSchemaCatalogEntry ReadLegacySchemaCatalogEntry(ref MessagePackReader reader)
+        {
+            var fieldCount = reader.ReadArrayHeader();
+            var entry = new CultSchemaCatalogEntry();
+            if (fieldCount > 0) entry.SchemaId = reader.ReadString() ?? string.Empty;
+            if (fieldCount > 1) entry.SchemaName = reader.ReadString() ?? string.Empty;
+            if (fieldCount > 2) entry.SchemaVersion = reader.ReadString() ?? string.Empty;
+            if (fieldCount > 3) entry.CanonicalSchemaJson = reader.ReadString() ?? string.Empty;
+            if (fieldCount > 4) reader.Skip();
+            if (fieldCount > 5) entry.ContentHash = reader.ReadString() ?? string.Empty;
+            if (fieldCount > 6)
+            {
+                var memberCount = reader.ReadArrayHeader();
+                for (var index = 0; index < memberCount; index++)
+                    reader.Skip();
+            }
+
+            for (var index = 7; index < fieldCount; index++)
+                reader.Skip();
+
+            entry.CompatibleSchemaIds = string.IsNullOrWhiteSpace(entry.SchemaId)
+                ? Array.Empty<string>()
+                : new[] { entry.SchemaId };
+            entry.Members = Array.Empty<CultSchemaMemberCatalogEntry>();
+            return entry;
+        }
+
+        private static CultPersistedRecord ReadLegacyPersistedRecord(ref MessagePackReader reader)
+        {
+            var fieldCount = reader.ReadArrayHeader();
+            var record = new CultPersistedRecord();
+            if (fieldCount > 0) record.Key = reader.ReadString() ?? string.Empty;
+            if (fieldCount > 1) record.SchemaId = reader.ReadString() ?? string.Empty;
+            if (fieldCount > 2) record.StoredAt = reader.ReadString() ?? string.Empty;
+            if (fieldCount > 3)
+            {
+                var payload = reader.ReadBytes();
+                record.Payload = payload.HasValue ? payload.Value.ToArray() : Array.Empty<byte>();
+            }
+            for (var index = 4; index < fieldCount; index++)
+                reader.Skip();
+            return record;
+        }
+
+        private static bool PublishesSchema(CultSchemaCatalogEntry[] catalog, string schemaId)
+        {
+            return catalog.Any(entry =>
+                string.Equals(entry.SchemaId, schemaId, StringComparison.Ordinal) ||
+                entry.CompatibleSchemaIds.Any(candidate => string.Equals(candidate, schemaId, StringComparison.Ordinal)));
+        }
+
+        private static void WriteFileAtomically(string path, byte[] bytes)
+        {
+            var tempPath = path + ".tmp";
+            File.WriteAllBytes(tempPath, bytes);
+            if (File.Exists(path))
+                File.Delete(path);
+            File.Move(tempPath, path);
+        }
+    }
+}
diff --git a/src/GameCult.Mesh/CultMeshSnapshots.cs b/src/GameCult.Mesh/CultMeshSnapshots.cs
new file mode 100644
index 00000000..d40eef03
--- /dev/null
+++ b/src/GameCult.Mesh/CultMeshSnapshots.cs
@@ -0,0 +1,1090 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using GameCult.Caching;
+using GameCult.Caching.MessagePack;
+using GameCult.Networking;
+using MessagePack;
+
+namespace GameCult.Mesh
+{
+    /// <summary>
+    /// Options for one scoped CultNet snapshot request.
+    /// </summary>
+    public sealed class CultMeshSnapshotRequestOptions
+    {
+        /// <summary>Gets or sets schema ids to request. Empty means no schema filter.</summary>
+        public IReadOnlyList<string>? SchemaIds { get; set; }
+
+        /// <summary>Gets or sets record keys to request. Empty means no record-key filter.</summary>
+        public IReadOnlyList<string>? RecordKeys { get; set; }
+
+        /// <summary>Gets or sets the target shard id, when the endpoint is shard-aware.</summary>
+        public string? ShardId { get; set; }
+
+        /// <summary>Gets or sets the target shard epoch, when the endpoint is shard-aware.</summary>
+        public long? ShardEpoch { get; set; }
+
+        /// <summary>Gets or sets the response timeout.</summary>
+        public TimeSpan ResponseTimeout { get; set; } = TimeSpan.FromSeconds(5);
+
+        /// <summary>Gets or sets the connection timeout.</summary>
+        public TimeSpan ConnectTimeout { get; set; } = TimeSpan.FromSeconds(5);
+
+        /// <summary>Gets or sets the message id prefix used for snapshot requests.</summary>
+        public string? MessageIdPrefix { get; set; }
+
+        /// <summary>Gets or sets client security options for endpoint-created LiteNetLib clients.</summary>
+        public ClientSecurityOptions? Security { get; set; }
+
+        /// <summary>Gets or sets a callback used to configure endpoint-created LiteNetLib clients.</summary>
+        public Action<Client>? ConfigureClient { get; set; }
+
+        /// <summary>Gets or sets a custom schema client factory.</summary>
+        public Func<ICultNetSchemaClient>? CreateClient { get; set; }
+
+        /// <summary>Gets or sets the runtime id used by endpoint-created RUDP clients.</summary>
+        public string? RudpRuntimeId { get; set; }
+
+        /// <summary>Gets or sets the connection id used by endpoint-created RUDP clients.</summary>
+        public uint RudpConnectionId { get; set; } = 0x43554c54;
+
+        /// <summary>Gets or sets the connect payload used by endpoint-created RUDP clients.</summary>
+        public string RudpConnectPayload { get; set; } = "cultnet-schema-rudp";
+
+        /// <summary>Gets or sets the maximum fragment size used by endpoint-created RUDP clients.</summary>
+        public int RudpMaxFragmentBytes { get; set; } = 1024;
+
+        /// <summary>Gets or sets the resend delay used by endpoint-created RUDP clients.</summary>
+        public long RudpResendDelayMs { get; set; } = 25;
+    }
+
+    /// <summary>
+    /// Reuses one connected CultNet schema client for an ordered sequence of snapshot requests.
+    /// </summary>
+    public sealed class CultMeshSnapshotSession : IDisposable
+    {
+        private readonly string _endpoint;
+        private readonly CultMeshSnapshotRequestOptions _defaults;
+        private readonly ICultNetSchemaClient _client;
+        private readonly CultMeshSession? _sharedSession;
+        private readonly IDisposable? _responseSubscription;
+        private readonly IDisposable? _errorSubscription;
+        private readonly CultNetDocumentRegistry _registry;
+        private readonly SemaphoreSlim _requests = new(1, 1);
+        private readonly object _completionLock = new();
+        private TaskCompletionSource<CultNetSnapshotResponseRawMessage>? _completion;
+        private string? _messageId;
+        private bool _disposed;
+
+        internal CultMeshSnapshotSession(
+            string endpoint,
+            CultMeshSnapshotRequestOptions options,
+            CultNetDocumentRegistry? registry)
+        {
+            _endpoint = string.IsNullOrWhiteSpace(endpoint)
+                ? throw new ArgumentException("Value must be non-empty.", nameof(endpoint))
+                : endpoint;
+            _defaults = CultMesh.CloneSnapshotRequestOptions(options);
+            _registry = registry ?? new CultNetDocumentRegistry();
+            _client = CultMesh.CreateSnapshotClient(endpoint, _defaults)();
+            _client.OnCultNet<CultNetSnapshotResponseRawMessage>(OnResponse);
+            _client.OnCultNet<CultNetErrorMessage>(OnError);
+            var (host, port) = CultNetSchemaWriteForwarder.ParseEndpoint(endpoint);
+            _client.Connect(host, port);
+        }
+
+        private CultMeshSnapshotSession(
+            CultMeshSession session,
+            CultMeshSnapshotRequestOptions options,
+            CultNetDocumentRegistry? registry)
+        {
+            _sharedSession = session ?? throw new ArgumentNullException(nameof(session));
+            _endpoint = session.State.Path?.Endpoint ?? session.Target.AuthorityRuntimeId;
+            _defaults = CultMesh.CloneSnapshotRequestOptions(options);
+            _registry = registry ?? new CultNetDocumentRegistry();
+            _client = session.Channel;
+            _responseSubscription = session.OnCultNet<CultNetSnapshotResponseRawMessage>(OnResponse);
+            _errorSubscription = session.OnCultNet<CultNetErrorMessage>(OnError);
+        }
+
+        public static async Task<CultMeshSnapshotSession> ConnectAsync(
+            CultMeshSessionManager sessions,
+            CultMeshSessionTarget target,
+            CultMeshSnapshotRequestOptions options,
+            CultNetDocumentRegistry? registry = null,
+            CancellationToken cancellationToken = default)
+        {
+            if (sessions == null) throw new ArgumentNullException(nameof(sessions));
+            var session = await sessions.ConnectAsync(target, CultMeshProtocols.Documents, cancellationToken).ConfigureAwait(false);
+            return new CultMeshSnapshotSession(session, options ?? new CultMeshSnapshotRequestOptions(), registry);
+        }
+
+        public static async Task<CultMeshSnapshotSession> ConnectAsync(
+            CultMeshSessionManager sessions,
+            CultMeshSessionTarget target,
+            CultMeshProtocolId protocol,
+            CultMeshSnapshotRequestOptions options,
+            CultNetDocumentRegistry? registry = null,
+            CancellationToken cancellationToken = default)
+        {
+            if (sessions == null) throw new ArgumentNullException(nameof(sessions));
+            var session = await sessions.ConnectAsync(target, protocol, cancellationToken).ConfigureAwait(false);
+            return new CultMeshSnapshotSession(session, options ?? new CultMeshSnapshotRequestOptions(), registry);
+        }
+
+        /// <summary>Fetches one raw snapshot while retaining the underlying endpoint connection.</summary>
+        public async Task<CultNetSnapshotResponseRawMessage> FetchSnapshotAsync(
+            IReadOnlyList<string>? schemaIds = null,
+            IReadOnlyList<string>? recordKeys = null)
+        {
+            ThrowIfDisposed();
+            await _requests.WaitAsync().ConfigureAwait(false);
+            try
+            {
+                await CultMesh.WaitForSnapshotClientConnectionAsync(
+                        _client,
+                        _endpoint,
+                        _defaults.ConnectTimeout,
+                        (_client as ICultNetSchemaClientHealth)?.BackgroundFailure)
+                    .ConfigureAwait(false);
+                var options = CultMesh.CloneSnapshotRequestOptions(_defaults);
+                options.SchemaIds = schemaIds ?? options.SchemaIds;
+                options.RecordKeys = recordKeys ?? options.RecordKeys;
+                var messageId = CultMesh.CreateSnapshotMessageId(options);
+                var completion = new TaskCompletionSource<CultNetSnapshotResponseRawMessage>(
+                    TaskCreationOptions.RunContinuationsAsynchronously);
+                lock (_completionLock)
+                {
+                    _messageId = messageId;
+                    _completion = completion;
+                }
+                _client.SendCultNet(new CultNetSnapshotRequestMessage
+                {
+                    MessageId = messageId,
+                    SchemaIds = CultMesh.CleanSnapshotFilter(options.SchemaIds),
+                    RecordKeys = CultMesh.CleanSnapshotFilter(options.RecordKeys),
+                    ShardId = string.IsNullOrWhiteSpace(options.ShardId) ? null : options.ShardId,
+                    ShardEpoch = options.ShardEpoch
+                });
+                return await CultMesh.WaitForSnapshotResponseAsync(
+                        completion.Task,
+                        _endpoint,
+                        options,
+                        messageId,
+                        (_client as ICultNetSchemaClientHealth)?.BackgroundFailure)
+                    .ConfigureAwait(false);
+            }
+            finally
+            {
+                lock (_completionLock)
+                {
+                    _messageId = null;
+                    _completion = null;
+                }
+                _requests.Release();
+            }
+        }
+
+        /// <summary>Fetches and decodes typed documents over the retained endpoint connection.</summary>
+        public async Task<IReadOnlyList<TDocument>> FetchDocumentsAsync<TDocument>(
+            IReadOnlyList<string>? recordKeys = null,
+            IReadOnlyList<string>? schemaIds = null)
+            where TDocument : class
+        {
+            var descriptor = CultDocumentRegistry.Shared.GetRequired<TDocument>();
+            var resolvedSchemas = schemaIds ?? (recordKeys is { Count: > 0 } ? null : new[] { descriptor.SchemaId });
+            var snapshot = await FetchSnapshotAsync(resolvedSchemas, recordKeys).ConfigureAwait(false);
+            return CultMesh.DecodeSnapshotDocuments<TDocument>(snapshot, _registry);
+        }
+
+        /// <summary>Closes the retained endpoint connection and rejects any active request.</summary>
+        public void Dispose()
+        {
+            if (_disposed) return;
+            _disposed = true;
+            lock (_completionLock)
+                _completion?.TrySetException(new ObjectDisposedException(nameof(CultMeshSnapshotSession)));
+            _responseSubscription?.Dispose();
+            _errorSubscription?.Dispose();
+            if (_sharedSession == null) _client.Dispose();
+            _requests.Dispose();
+        }
+
+        private void OnResponse(CultNetSnapshotResponseRawMessage response)
+        {
+            lock (_completionLock)
+            {
+                if (string.Equals(response.MessageId, _messageId, StringComparison.Ordinal))
+                    _completion?.TrySetResult(response);
+            }
+        }
+
+        private void OnError(CultNetErrorMessage error)
+        {
+            lock (_completionLock)
+                _completion?.TrySetException(new InvalidOperationException(error.Error));
+        }
+
+        private void ThrowIfDisposed()
+        {
+            if (_disposed) throw new ObjectDisposedException(nameof(CultMeshSnapshotSession));
+        }
+    }
+
+    /// <summary>
+    /// Options for a typed remote snapshot surface bound to one CultNet endpoint.
+    /// </summary>
+    public sealed class CultMeshSnapshotEndpointOptions
+    {
+        /// <summary>Gets or sets the Verse context used by handles from this endpoint.</summary>
+        public CultMeshVerseContext? Context { get; set; }
+
+        /// <summary>Gets or sets the document registry used for raw snapshot payload decoding.</summary>
+        public CultNetDocumentRegistry? DocumentRegistry { get; set; }
+
+        /// <summary>Gets or sets request options applied to each snapshot fetch.</summary>
+        public CultMeshSnapshotRequestOptions? Request { get; set; }
+
+        /// <summary>Gets or sets the source id advertised by diagnostics. Defaults to the endpoint.</summary>
+        public string? SourceId { get; set; }
+
+        /// <summary>Gets or sets the route hint for resulting handles.</summary>
+        public CultMeshRouteHint? RouteHint { get; set; }
+
+        /// <summary>Gets or sets the polling interval for watch fallback.</summary>
+        public TimeSpan PollInterval { get; set; } = TimeSpan.FromMilliseconds(250);
+    }
+
+    /// <summary>
+    /// Describes one typed document handle to bind from a snapshot endpoint.
+    /// </summary>
+    public interface ICultMeshSnapshotDocumentBinding
+    {
+        /// <summary>Gets the CLR document type requested by this binding.</summary>
+        Type DocumentType { get; }
+
+        /// <summary>Gets the remote record key to read.</summary>
+        string RecordKey { get; }
+
+        /// <summary>Gets the optional semantic document id for the resulting handle.</summary>
+        string? DocumentId { get; }
+
+        /// <summary>Binds this document request to an endpoint-backed handle.</summary>
+        ICultMeshDocumentHandle Bind(CultMeshSnapshotEndpoint endpoint);
+
+        /// <summary>Binds this document request to an endpoint-backed handle that syncs into a local node before returning values.</summary>
+        ICultMeshDocumentHandle BindSynced(CultMeshSnapshotEndpoint endpoint, CultMeshNode node, bool flush);
+    }
+
+    /// <summary>
+    /// Describes one typed document handle to bind from a snapshot endpoint.
+    /// </summary>
+    public sealed class CultMeshSnapshotDocumentBinding<TDocument> : ICultMeshSnapshotDocumentBinding
+        where TDocument : class
+    {
+        internal CultMeshSnapshotDocumentBinding(string recordKey, string? documentId)
+        {
+            RecordKey = string.IsNullOrWhiteSpace(recordKey)
+                ? throw new ArgumentException("Value must be non-empty.", nameof(recordKey))
+                : recordKey;
+            DocumentId = documentId;
+        }
+
+        /// <inheritdoc />
+        public Type DocumentType => typeof(TDocument);
+
+        /// <inheritdoc />
+        public string RecordKey { get; }
+
+        /// <inheritdoc />
+        public string? DocumentId { get; }
+
+        /// <inheritdoc />
+        public ICultMeshDocumentHandle Bind(CultMeshSnapshotEndpoint endpoint)
+        {
+            if (endpoint == null) throw new ArgumentNullException(nameof(endpoint));
+            return endpoint.Document<TDocument>(RecordKey, DocumentId);
+        }
+
+        /// <inheritdoc />
+        public ICultMeshDocumentHandle BindSynced(CultMeshSnapshotEndpoint endpoint, CultMeshNode node, bool flush)
+        {
+            if (endpoint == null) throw new ArgumentNullException(nameof(endpoint));
+            return endpoint.SyncedDocument<TDocument>(node, RecordKey, DocumentId, flush);
+        }
+    }
+
+    /// <summary>
+    /// Result from syncing a remote snapshot into a local CultMesh node.
+    /// </summary>
+    public sealed class CultMeshSnapshotSyncResult
+    {
+        internal CultMeshSnapshotSyncResult(
+            CultNetSnapshotResponseRawMessage snapshot,
+            IReadOnlyList<object> appliedDocuments)
+        {
+            Snapshot = snapshot ?? throw new ArgumentNullException(nameof(snapshot));
+            AppliedDocuments = appliedDocuments ?? throw new ArgumentNullException(nameof(appliedDocuments));
+        }
+
+        /// <summary>Gets the raw snapshot that was fetched from the endpoint.</summary>
+        public CultNetSnapshotResponseRawMessage Snapshot { get; }
+
+        /// <summary>Gets the documents applied into the local node cache.</summary>
+        public IReadOnlyList<object> AppliedDocuments { get; }
+
+        /// <summary>Gets the number of documents applied into the local node cache.</summary>
+        public int AppliedCount => AppliedDocuments.Count;
+
+        /// <summary>Gets the source shard log sequence reported by the snapshot, when present.</summary>
+        public long ShardLogSequence => Snapshot.ShardLogSequence ?? 0L;
+    }
+
+    /// <summary>
+    /// Snapshot endpoint view with a local node sync policy already bound.
+    /// </summary>
+    public sealed class CultMeshSyncedSnapshotEndpoint
+    {
+        internal CultMeshSyncedSnapshotEndpoint(
+            CultMeshSnapshotEndpoint endpoint,
+            CultMeshNode node,
+            bool flush)
+        {
+            Endpoint = endpoint ?? throw new ArgumentNullException(nameof(endpoint));
+            Node = node ?? throw new ArgumentNullException(nameof(node));
+            Flush = flush;
+        }
+
+        /// <summary>Gets the remote endpoint that provides snapshots.</summary>
+        public CultMeshSnapshotEndpoint Endpoint { get; }
+
+        /// <summary>Gets the local node snapshots are synced into.</summary>
+        public CultMeshNode Node { get; }
+
+        /// <summary>Gets whether each sync should flush the local node afterward.</summary>
+        public bool Flush { get; }
+
+        /// <summary>Creates a typed document handle that syncs into the local node before returning values.</summary>
+        public CultMeshDocumentHandle<TDocument> Document<TDocument>(
+            string recordKey,
+            string? documentId = null)
+            where TDocument : class
+        {
+            return Endpoint.SyncedDocument<TDocument>(Node, recordKey, documentId, Flush);
+        }
+
+        /// <summary>Creates a schema-aware catalog from typed endpoint bindings that sync into the local node before returning values.</summary>
+        public CultMeshDocumentCatalog Documents(params ICultMeshSnapshotDocumentBinding[] documents)
+        {
+            return Endpoint.SyncedDocuments(Node, Flush, documents);
+        }
+    }
+
+    /// <summary>
+    /// Typed snapshot surface for one remote CultNet endpoint.
+    /// </summary>
+    public sealed class CultMeshSnapshotEndpoint
+    {
+        internal CultMeshSnapshotEndpoint(string endpoint, CultMeshSnapshotEndpointOptions? options)
+        {
+            Endpoint = string.IsNullOrWhiteSpace(endpoint)
+                ? throw new ArgumentException("Value must be non-empty.", nameof(endpoint))
+                : endpoint;
+
+            var resolvedOptions = options ?? new CultMeshSnapshotEndpointOptions();
+            Context = resolvedOptions.Context ?? CultMesh.Verse("remote", "cultmesh-snapshot-client").Context;
+            DocumentRegistry = resolvedOptions.DocumentRegistry ?? new CultNetDocumentRegistry();
+            Request = CloneSnapshotRequestOptions(resolvedOptions.Request);
+            RouteHint = resolvedOptions.RouteHint ?? new CultMeshRouteHint(CultMeshLocalityKind.Network, Endpoint);
+            SourceId = string.IsNullOrWhiteSpace(resolvedOptions.SourceId) ? Endpoint : resolvedOptions.SourceId!;
+            PollInterval = resolvedOptions.PollInterval;
+        }
+
+        /// <summary>Gets the endpoint this typed surface reads from.</summary>
+        public string Endpoint { get; }
+
+        /// <summary>Gets the Verse context used by document handles from this endpoint.</summary>
+        public CultMeshVerseContext Context { get; }
+
+        /// <summary>Gets the document registry used for raw snapshot payload decoding.</summary>
+        public CultNetDocumentRegistry DocumentRegistry { get; }
+
+        /// <summary>Gets request options applied to each snapshot fetch.</summary>
+        public CultMeshSnapshotRequestOptions Request { get; }
+
+        /// <summary>Gets the source id advertised by diagnostics.</summary>
+        public string SourceId { get; }
+
+        /// <summary>Gets the route hint for resulting handles.</summary>
+        public CultMeshRouteHint RouteHint { get; }
+
+        /// <summary>Gets the polling interval for watch fallback.</summary>
+        public TimeSpan PollInterval { get; }
+
+        /// <summary>Returns a view of this endpoint whose typed document handles sync into the supplied local node.</summary>
+        public CultMeshSyncedSnapshotEndpoint SyncTo(CultMeshNode node, bool flush = false)
+        {
+            return new CultMeshSyncedSnapshotEndpoint(this, node, flush);
+        }
+
+        /// <summary>Fetches one raw snapshot with this endpoint's configured request policy.</summary>
+        public Task<CultNetSnapshotResponseRawMessage> FetchSnapshotAsync(
+            IReadOnlyList<string>? schemaIds = null,
+            IReadOnlyList<string>? recordKeys = null)
+        {
+            return CultMesh.FetchSnapshotAsync(Endpoint, CreateRequest(schemaIds, recordKeys));
+        }
+
+        /// <summary>Fetches one snapshot and applies it into the node's cache.</summary>
+        public async Task<CultMeshSnapshotSyncResult> SyncSnapshotAsync(
+            CultMeshNode node,
+            IReadOnlyList<string>? schemaIds = null,
+            IReadOnlyList<string>? recordKeys = null,
+            bool flush = false)
+        {
+            if (node == null) throw new ArgumentNullException(nameof(node));
+
+            var snapshot = await FetchSnapshotAsync(schemaIds, recordKeys).ConfigureAwait(false);
+            var applied = await node.Database.Documents.ApplyRawSnapshotResponseAsync(node.Cache, snapshot)
+                .ConfigureAwait(false);
+            if (flush)
+                await node.FlushAsync().ConfigureAwait(false);
+
+            return new CultMeshSnapshotSyncResult(snapshot, applied);
+        }
+
+        /// <summary>Fetches and decodes documents assignable to the requested type or matching its schema.</summary>
+        public Task<IReadOnlyList<TDocument>> FetchDocumentsAsync<TDocument>(
+            IReadOnlyList<string>? recordKeys = null,
+            IReadOnlyList<string>? schemaIds = null)
+            where TDocument : class
+        {
+            var descriptor = CultDocumentRegistry.Shared.GetRequired<TDocument>();
+            return CultMesh.FetchSnapshotDocumentsAsync<TDocument>(
+                Endpoint,
+                CreateRequest(ResolveDefaultSchemaFilter(schemaIds, recordKeys, descriptor), recordKeys),
+                DocumentRegistry);
+        }
+
+        /// <summary>Fetches typed documents and syncs their raw snapshot into the node's cache.</summary>
+        public async Task<IReadOnlyList<TDocument>> SyncDocumentsAsync<TDocument>(
+            CultMeshNode node,
+            IReadOnlyList<string>? recordKeys = null,
+            IReadOnlyList<string>? schemaIds = null,
+            bool flush = false)
+            where TDocument : class
+        {
+            if (node == null) throw new ArgumentNullException(nameof(node));
+
+            var descriptor = CultDocumentRegistry.Shared.GetRequired<TDocument>();
+            var result = await SyncSnapshotAsync(
+                    node,
+                    ResolveDefaultSchemaFilter(schemaIds, recordKeys, descriptor),
+                    recordKeys,
+                    flush)
+                .ConfigureAwait(false);
+            return CultMesh.DecodeSnapshotDocuments<TDocument>(result.Snapshot, DocumentRegistry);
+        }
+
+        /// <summary>Fetches one typed document by record key.</summary>
+        public async Task<TDocument> FetchDocumentAsync<TDocument>(string recordKey)
+            where TDocument : class
+        {
+            if (string.IsNullOrWhiteSpace(recordKey)) throw new ArgumentException("Value must be non-empty.", nameof(recordKey));
+            var documents = await FetchDocumentsAsync<TDocument>(new[] { recordKey }).ConfigureAwait(false);
+            return documents.FirstOrDefault()
+                ?? throw new InvalidOperationException(
+                    $"CultNet snapshot endpoint '{Endpoint}' did not return {typeof(TDocument).FullName} record '{recordKey}'.");
+        }
+
+        /// <summary>Fetches one typed document by record key and syncs it into the node's cache.</summary>
+        public async Task<TDocument> SyncDocumentAsync<TDocument>(
+            CultMeshNode node,
+            string recordKey,
+            bool flush = false)
+            where TDocument : class
+        {
+            if (string.IsNullOrWhiteSpace(recordKey)) throw new ArgumentException("Value must be non-empty.", nameof(recordKey));
+            var documents = await SyncDocumentsAsync<TDocument>(node, new[] { recordKey }, flush: flush)
+                .ConfigureAwait(false);
+            return documents.FirstOrDefault()
+                ?? throw new InvalidOperationException(
+                    $"CultNet snapshot endpoint '{Endpoint}' did not return {typeof(TDocument).FullName} record '{recordKey}'.");
+        }
+
+        /// <summary>Creates a typed document handle that fetches one endpoint record and syncs it into a local node before returning values.</summary>
+        public CultMeshDocumentHandle<TDocument> SyncedDocument<TDocument>(
+            CultMeshNode node,
+            string recordKey,
+            string? documentId = null,
+            bool flush = false)
+            where TDocument : class
+        {
+            if (node == null) throw new ArgumentNullException(nameof(node));
+            if (string.IsNullOrWhiteSpace(recordKey)) throw new ArgumentException("Value must be non-empty.", nameof(recordKey));
+            var descriptor = CultDocumentRegistry.Shared.GetRequired<TDocument>();
+            var sources = new[]
+            {
+                CultMesh.ProjectionSource($"{SourceId}:{recordKey}", descriptor.SchemaId, "synced CultNet snapshot endpoint")
+            };
+            var watch = CultMesh.PollingQueryWatcher<CultMeshDocumentQueryParameters, TDocument>(
+                async (_parameters, _context) => await SyncDocumentAsync<TDocument>(node, recordKey, flush).ConfigureAwait(false),
+                new CultMeshPollingWatchOptions<TDocument>(PollInterval));
+
+            return CultMesh.Document<TDocument>(
+                string.IsNullOrWhiteSpace(documentId) ? recordKey : documentId!,
+                Context,
+                _ => SyncDocumentAsync<TDocument>(node, recordKey, flush),
+                queryContext => watch(CultMeshDocumentQueryParameters.Empty, queryContext),
+                sources,
+                RouteHint);
+        }
+
+        /// <summary>Creates a typed document handle over one remote endpoint record.</summary>
+        public CultMeshDocumentHandle<TDocument> Document<TDocument>(
+            string recordKey,
+            string? documentId = null)
+            where TDocument : class
+        {
+            if (string.IsNullOrWhiteSpace(recordKey)) throw new ArgumentException("Value must be non-empty.", nameof(recordKey));
+            var descriptor = CultDocumentRegistry.Shared.GetRequired<TDocument>();
+            var sources = new[]
+            {
+                CultMesh.ProjectionSource($"{SourceId}:{recordKey}", descriptor.SchemaId, "CultNet snapshot endpoint")
+            };
+            var watch = CultMesh.PollingQueryWatcher<CultMeshDocumentQueryParameters, TDocument>(
+                async (_parameters, _context) => await FetchDocumentAsync<TDocument>(recordKey).ConfigureAwait(false),
+                new CultMeshPollingWatchOptions<TDocument>(PollInterval));
+
+            return CultMesh.Document<TDocument>(
+                string.IsNullOrWhiteSpace(documentId) ? recordKey : documentId!,
+                Context,
+                _ => FetchDocumentAsync<TDocument>(recordKey),
+                queryContext => watch(CultMeshDocumentQueryParameters.Empty, queryContext),
+                sources,
+                RouteHint);
+        }
+
+        /// <summary>Creates a schema-aware catalog over endpoint-backed document handles.</summary>
+        public CultMeshDocumentCatalog Documents(params ICultMeshDocumentHandle[] documents)
+        {
+            return CultMesh.Documents(documents);
+        }
+
+        /// <summary>Creates a schema-aware catalog from endpoint-backed typed document bindings.</summary>
+        public CultMeshDocumentCatalog Documents(params ICultMeshSnapshotDocumentBinding[] documents)
+        {
+            if (documents == null) throw new ArgumentNullException(nameof(documents));
+            return CultMesh.Documents(documents.Select(document =>
+            {
+                if (document == null) throw new ArgumentNullException(nameof(documents));
+                return document.Bind(this);
+            }));
+        }
+
+        /// <summary>Creates a schema-aware catalog from typed endpoint bindings that sync into a local node before returning values.</summary>
+        public CultMeshDocumentCatalog SyncedDocuments(
+            CultMeshNode node,
+            params ICultMeshSnapshotDocumentBinding[] documents)
+        {
+            return SyncedDocuments(node, flush: false, documents);
+        }
+
+        /// <summary>Creates a schema-aware catalog from typed endpoint bindings that sync into a local node before returning values.</summary>
+        public CultMeshDocumentCatalog SyncedDocuments(
+            CultMeshNode node,
+            bool flush = false,
+            params ICultMeshSnapshotDocumentBinding[] documents)
+        {
+            if (node == null) throw new ArgumentNullException(nameof(node));
+            if (documents == null) throw new ArgumentNullException(nameof(documents));
+            return CultMesh.Documents(documents.Select(document =>
+            {
+                if (document == null) throw new ArgumentNullException(nameof(documents));
+                return document.BindSynced(this, node, flush);
+            }));
+        }
+
+        private CultMeshSnapshotRequestOptions CreateRequest(
+            IReadOnlyList<string>? schemaIds,
+            IReadOnlyList<string>? recordKeys)
+        {
+            var request = CloneSnapshotRequestOptions(Request);
+            request.SchemaIds = schemaIds ?? request.SchemaIds;
+            request.RecordKeys = recordKeys ?? request.RecordKeys;
+            if (string.IsNullOrWhiteSpace(request.RudpRuntimeId))
+                request.RudpRuntimeId = Context.RuntimeId;
+            if (string.IsNullOrWhiteSpace(request.MessageIdPrefix))
+                request.MessageIdPrefix = $"cultmesh:{Context.RuntimeId}:snapshot";
+            return request;
+        }
+
+        private static IReadOnlyList<string>? ResolveDefaultSchemaFilter(
+            IReadOnlyList<string>? schemaIds,
+            IReadOnlyList<string>? recordKeys,
+            CultDocumentDescriptor descriptor)
+        {
+            if (schemaIds != null)
+                return schemaIds;
+
+            return recordKeys is { Count: > 0 }
+                ? null
+                : new[] { descriptor.SchemaId };
+        }
+
+        private static CultMeshSnapshotRequestOptions CloneSnapshotRequestOptions(CultMeshSnapshotRequestOptions? source)
+        {
+            if (source == null)
+                return new CultMeshSnapshotRequestOptions();
+
+            return new CultMeshSnapshotRequestOptions
+            {
+                SchemaIds = source.SchemaIds,
+                RecordKeys = source.RecordKeys,
+                ShardId = source.ShardId,
+                ShardEpoch = source.ShardEpoch,
+                ResponseTimeout = source.ResponseTimeout,
+                ConnectTimeout = source.ConnectTimeout,
+                MessageIdPrefix = source.MessageIdPrefix,
+                Security = source.Security,
+                ConfigureClient = source.ConfigureClient,
+                CreateClient = source.CreateClient,
+                RudpRuntimeId = source.RudpRuntimeId,
+                RudpConnectionId = source.RudpConnectionId,
+                RudpConnectPayload = source.RudpConnectPayload,
+                RudpMaxFragmentBytes = source.RudpMaxFragmentBytes,
+                RudpResendDelayMs = source.RudpResendDelayMs
+            };
+        }
+    }
+
+    public static partial class CultMesh
+    {
+        /// <summary>
+        /// Binds one CultNet endpoint as a typed snapshot surface.
+        /// </summary>
+        public static CultMeshSnapshotEndpoint SnapshotEndpoint(
+            string endpoint,
+            CultMeshSnapshotEndpointOptions? options = null)
+        {
+            return new CultMeshSnapshotEndpoint(endpoint, options);
+        }
+
+        /// <summary>
+        /// Opens one reusable CultNet snapshot connection for ordered bulk document transfer.
+        /// </summary>
+        public static CultMeshSnapshotSession SnapshotSession(
+            string endpoint,
+            CultMeshSnapshotRequestOptions? options = null,
+            CultNetDocumentRegistry? registry = null)
+        {
+            return new CultMeshSnapshotSession(
+                endpoint,
+                options ?? new CultMeshSnapshotRequestOptions(),
+                registry);
+        }
+
+        /// <summary>
+        /// Describes one typed document to bind from a CultMesh snapshot endpoint.
+        /// </summary>
+        public static CultMeshSnapshotDocumentBinding<TDocument> SnapshotDocument<TDocument>(
+            string recordKey,
+            string? documentId = null)
+            where TDocument : class
+        {
+            return new CultMeshSnapshotDocumentBinding<TDocument>(recordKey, documentId);
+        }
+
+        /// <summary>
+        /// Fetches one typed snapshot document and syncs it into a local node in one call.
+        /// </summary>
+        public static Task<TDocument> SyncDocumentFromPeerSnapshotAsync<TDocument>(
+            CultMeshNode node,
+            string endpoint,
+            string recordKey,
+            CultMeshSnapshotEndpointOptions? options = null,
+            bool flush = false)
+            where TDocument : class
+        {
+            if (node == null) throw new ArgumentNullException(nameof(node));
+            if (string.IsNullOrWhiteSpace(endpoint)) throw new ArgumentException("Value must be non-empty.", nameof(endpoint));
+            if (string.IsNullOrWhiteSpace(recordKey)) throw new ArgumentException("Value must be non-empty.", nameof(recordKey));
+
+            return SnapshotEndpoint(endpoint, options).SyncDocumentAsync<TDocument>(node, recordKey, flush);
+        }
+
+        /// <summary>
+        /// Fetches one typed snapshot document through a caller-provided schema client and syncs it into a local node in one call.
+        /// </summary>
+        public static Task<TDocument> SyncDocumentFromPeerSnapshotAsync<TDocument>(
+            CultMeshNode node,
+            Func<ICultNetSchemaClient> createClient,
+            string endpoint,
+            string recordKey,
+            CultMeshSnapshotEndpointOptions? options = null,
+            bool flush = false)
+            where TDocument : class
+        {
+            if (node == null) throw new ArgumentNullException(nameof(node));
+            if (createClient == null) throw new ArgumentNullException(nameof(createClient));
+            if (string.IsNullOrWhiteSpace(endpoint)) throw new ArgumentException("Value must be non-empty.", nameof(endpoint));
+            if (string.IsNullOrWhiteSpace(recordKey)) throw new ArgumentException("Value must be non-empty.", nameof(recordKey));
+
+            var request = CloneSnapshotFacadeRequestOptions(options?.Request);
+            request.CreateClient = createClient;
+            var resolvedOptions = new CultMeshSnapshotEndpointOptions
+            {
+                Context = options?.Context,
+                DocumentRegistry = options?.DocumentRegistry,
+                Request = request,
+                SourceId = options?.SourceId,
+                RouteHint = options?.RouteHint,
+                PollInterval = options?.PollInterval ?? TimeSpan.FromMilliseconds(250)
+            };
+            return SnapshotEndpoint(endpoint, resolvedOptions).SyncDocumentAsync<TDocument>(node, recordKey, flush);
+        }
+
+        private static CultMeshSnapshotRequestOptions CloneSnapshotFacadeRequestOptions(CultMeshSnapshotRequestOptions? source)
+        {
+            if (source == null)
+                return new CultMeshSnapshotRequestOptions();
+
+            return new CultMeshSnapshotRequestOptions
+            {
+                SchemaIds = source.SchemaIds,
+                RecordKeys = source.RecordKeys,
+                ShardId = source.ShardId,
+                ShardEpoch = source.ShardEpoch,
+                ResponseTimeout = source.ResponseTimeout,
+                ConnectTimeout = source.ConnectTimeout,
+                MessageIdPrefix = source.MessageIdPrefix,
+                Security = source.Security,
+                ConfigureClient = source.ConfigureClient,
+                CreateClient = source.CreateClient,
+                RudpRuntimeId = source.RudpRuntimeId,
+                RudpConnectionId = source.RudpConnectionId,
+                RudpConnectPayload = source.RudpConnectPayload,
+                RudpMaxFragmentBytes = source.RudpMaxFragmentBytes,
+                RudpResendDelayMs = source.RudpResendDelayMs
+            };
+        }
+
+        /// <summary>
+        /// Fetches one scoped raw CultNet snapshot from an endpoint.
+        /// </summary>
+        public static Task<CultNetSnapshotResponseRawMessage> FetchSnapshotAsync(
+            string endpoint,
+            CultMeshSnapshotRequestOptions? options = null)
+        {
+            if (string.IsNullOrWhiteSpace(endpoint)) throw new ArgumentException("Value must be non-empty.", nameof(endpoint));
+            var resolvedOptions = options ?? new CultMeshSnapshotRequestOptions();
+            return FetchSnapshotAsync(CreateSnapshotClient(endpoint, resolvedOptions), endpoint, resolvedOptions);
+        }
+
+        /// <summary>
+        /// Fetches one scoped raw CultNet snapshot through a caller-provided schema client factory.
+        /// </summary>
+        public static async Task<CultNetSnapshotResponseRawMessage> FetchSnapshotAsync(
+            Func<ICultNetSchemaClient> createClient,
+            string endpoint,
+            CultMeshSnapshotRequestOptions? options = null)
+        {
+            if (createClient == null) throw new ArgumentNullException(nameof(createClient));
+            if (string.IsNullOrWhiteSpace(endpoint)) throw new ArgumentException("Value must be non-empty.", nameof(endpoint));
+
+            var resolvedOptions = options ?? new CultMeshSnapshotRequestOptions();
+            var messageId = CreateSnapshotMessageId(resolvedOptions);
+            var completion = new TaskCompletionSource<CultNetSnapshotResponseRawMessage>(
+                TaskCreationOptions.RunContinuationsAsynchronously);
+            using var client = createClient();
+            client.OnCultNet<CultNetSnapshotResponseRawMessage>(response =>
+            {
+                if (string.Equals(response.MessageId, messageId, StringComparison.Ordinal))
+                    completion.TrySetResult(response);
+            });
+            client.OnCultNet<CultNetErrorMessage>(error =>
+                completion.TrySetException(new InvalidOperationException(error.Error)));
+
+            var (host, port) = CultNetSchemaWriteForwarder.ParseEndpoint(endpoint);
+            client.Connect(host, port);
+            await WaitForSnapshotClientConnectionAsync(
+                    client,
+                    endpoint,
+                    resolvedOptions.ConnectTimeout,
+                    (client as ICultNetSchemaClientHealth)?.BackgroundFailure)
+                .ConfigureAwait(false);
+            client.SendCultNet(new CultNetSnapshotRequestMessage
+            {
+                MessageId = messageId,
+                SchemaIds = CleanSnapshotFilter(resolvedOptions.SchemaIds),
+                RecordKeys = CleanSnapshotFilter(resolvedOptions.RecordKeys),
+                ShardId = string.IsNullOrWhiteSpace(resolvedOptions.ShardId) ? null : resolvedOptions.ShardId,
+                ShardEpoch = resolvedOptions.ShardEpoch
+            });
+
+            return await WaitForSnapshotResponseAsync(
+                    completion.Task,
+                    endpoint,
+                    resolvedOptions,
+                    messageId,
+                    (client as ICultNetSchemaClientHealth)?.BackgroundFailure)
+                .ConfigureAwait(false);
+        }
+
+        /// <summary>
+        /// Fetches a scoped raw CultNet snapshot and applies it into the node's cache.
+        /// </summary>
+        public static async Task<IReadOnlyList<object>> ApplySnapshotAsync(
+            CultMeshNode node,
+            string endpoint,
+            CultMeshSnapshotRequestOptions? options = null)
+        {
+            if (node == null) throw new ArgumentNullException(nameof(node));
+            var snapshot = await FetchSnapshotAsync(endpoint, options).ConfigureAwait(false);
+            return await node.Database.Documents.ApplyRawSnapshotResponseAsync(node.Cache, snapshot).ConfigureAwait(false);
+        }
+
+        /// <summary>
+        /// Fetches a scoped raw CultNet snapshot and decodes documents assignable to the requested type.
+        /// </summary>
+        public static async Task<IReadOnlyList<TDocument>> FetchSnapshotDocumentsAsync<TDocument>(
+            string endpoint,
+            CultMeshSnapshotRequestOptions? options = null,
+            CultNetDocumentRegistry? registry = null)
+            where TDocument : class
+        {
+            var snapshot = await FetchSnapshotAsync(endpoint, options).ConfigureAwait(false);
+            return DecodeSnapshotDocuments<TDocument>(snapshot, registry ?? new CultNetDocumentRegistry());
+        }
+
+        internal static Func<ICultNetSchemaClient> CreateSnapshotClient(
+            string endpoint,
+            CultMeshSnapshotRequestOptions options)
+        {
+            if (options.CreateClient != null)
+                return options.CreateClient;
+
+            return () =>
+            {
+                if (Uri.TryCreate(endpoint, UriKind.Absolute, out var uri) &&
+                    string.Equals(uri.Scheme, "rudp", StringComparison.OrdinalIgnoreCase))
+                {
+                    return CultNetSchemaClients.CreateRudp(
+                        string.IsNullOrWhiteSpace(options.RudpRuntimeId)
+                            ? "cultmesh-snapshot-client"
+                            : options.RudpRuntimeId!,
+                        options.RudpConnectionId,
+                        options.RudpConnectPayload,
+                        options.RudpMaxFragmentBytes,
+                        options.RudpResendDelayMs);
+                }
+
+                return CultNetSchemaClients.CreateForEndpoint(endpoint, options.Security, options.ConfigureClient);
+            };
+        }
+
+        internal static CultMeshSnapshotRequestOptions CloneSnapshotRequestOptions(
+            CultMeshSnapshotRequestOptions? source)
+        {
+            if (source == null) return new CultMeshSnapshotRequestOptions();
+            return new CultMeshSnapshotRequestOptions
+            {
+                SchemaIds = source.SchemaIds,
+                RecordKeys = source.RecordKeys,
+                ShardId = source.ShardId,
+                ShardEpoch = source.ShardEpoch,
+                ResponseTimeout = source.ResponseTimeout,
+                ConnectTimeout = source.ConnectTimeout,
+                MessageIdPrefix = source.MessageIdPrefix,
+                Security = source.Security,
+                ConfigureClient = source.ConfigureClient,
+                CreateClient = source.CreateClient,
+                RudpRuntimeId = source.RudpRuntimeId,
+                RudpConnectionId = source.RudpConnectionId,
+                RudpConnectPayload = source.RudpConnectPayload,
+                RudpMaxFragmentBytes = source.RudpMaxFragmentBytes,
+                RudpResendDelayMs = source.RudpResendDelayMs
+            };
+        }
+
+        internal static string CreateSnapshotMessageId(CultMeshSnapshotRequestOptions options)
+        {
+            var prefix = string.IsNullOrWhiteSpace(options.MessageIdPrefix)
+                ? "cultmesh:snapshot"
+                : options.MessageIdPrefix!;
+            return $"{prefix}:{Guid.NewGuid():N}";
+        }
+
+        internal static async Task WaitForSnapshotClientConnectionAsync(
+            ICultNetSchemaClient client,
+            string endpoint,
+            TimeSpan timeout,
+            Task<Exception>? backgroundFailure = null)
+        {
+            var deadline = DateTimeOffset.UtcNow + timeout;
+            while (!client.Connected)
+            {
+                if (backgroundFailure?.IsCompleted == true)
+                {
+                    var error = await backgroundFailure.ConfigureAwait(false);
+                    throw new InvalidOperationException(
+                        $"CultNet snapshot client failed while connecting to {endpoint}.",
+                        error);
+                }
+                if (DateTimeOffset.UtcNow >= deadline)
+                    throw new TimeoutException($"Timed out connecting to CultNet snapshot endpoint {endpoint}.");
+
+                await Task.Delay(TimeSpan.FromMilliseconds(25)).ConfigureAwait(false);
+            }
+        }
+
+        internal static async Task<CultNetSnapshotResponseRawMessage> WaitForSnapshotResponseAsync(
+            Task<CultNetSnapshotResponseRawMessage> responseTask,
+            string endpoint,
+            CultMeshSnapshotRequestOptions options,
+            string messageId,
+            Task<Exception>? backgroundFailure = null)
+        {
+            var timeoutTask = Task.Delay(options.ResponseTimeout);
+            var completed = backgroundFailure == null
+                ? await Task.WhenAny(responseTask, timeoutTask).ConfigureAwait(false)
+                : await Task.WhenAny(responseTask, timeoutTask, backgroundFailure).ConfigureAwait(false);
+            if (completed == backgroundFailure)
+            {
+                var error = await backgroundFailure.ConfigureAwait(false);
+                throw new InvalidOperationException(
+                    $"CultNet snapshot client failed while waiting for response '{messageId}' from {endpoint}.",
+                    error);
+            }
+            if (completed != responseTask)
+            {
+                throw new TimeoutException(
+                    $"Timed out waiting for CultNet snapshot response '{messageId}' from {endpoint} " +
+                    $"for schemas [{string.Join(", ", CleanSnapshotFilter(options.SchemaIds) ?? Array.Empty<string>())}] " +
+                    $"and records [{string.Join(", ", CleanSnapshotFilter(options.RecordKeys) ?? Array.Empty<string>())}].");
+            }
+
+            return await responseTask.ConfigureAwait(false);
+        }
+
+        internal static string[]? CleanSnapshotFilter(IReadOnlyList<string>? values)
+        {
+            if (values is not { Count: > 0 })
+                return null;
+
+            var filtered = values
+                .Where(value => !string.IsNullOrWhiteSpace(value))
+                .Distinct(StringComparer.Ordinal)
+                .ToArray();
+            return filtered.Length == 0 ? null : filtered;
+        }
+
+        internal static IReadOnlyList<TDocument> DecodeSnapshotDocuments<TDocument>(
+            CultNetSnapshotResponseRawMessage snapshot,
+            CultNetDocumentRegistry registry)
+            where TDocument : class
+        {
+            if (snapshot == null) throw new ArgumentNullException(nameof(snapshot));
+            if (registry == null) throw new ArgumentNullException(nameof(registry));
+
+            var descriptor = CultDocumentRegistry.Shared.GetRequired<TDocument>();
+            var documents = new List<TDocument>(snapshot.Documents.Length);
+            foreach (var record in snapshot.Documents)
+            {
+                if (record == null)
+                    continue;
+
+                var binding = registry.GetBySchemaId(record.SchemaId);
+                var canDeserializeWithBinding =
+                    binding != null &&
+                    typeof(TDocument).IsAssignableFrom(binding.DocumentType);
+                var canDeserializeAsSchemaAlias =
+                    string.Equals(record.SchemaId, descriptor.SchemaId, StringComparison.Ordinal) ||
+                    (binding != null && IsSameCultDocumentSchema(binding.DocumentType, descriptor)) ||
+                    RawSnapshotPayloadMatchesSchema(record.Payload, descriptor);
+                if (!canDeserializeWithBinding && !canDeserializeAsSchemaAlias)
+                    continue;
+
+                if (!string.Equals(record.PayloadEncoding, "messagepack", StringComparison.Ordinal))
+                {
+                    throw new InvalidOperationException(
+                        $"CultNet raw document payloadEncoding must be \"messagepack\", not \"{record.PayloadEncoding}\".");
+                }
+
+                if (binding != null)
+                {
+                    var decoded = binding.PayloadDeserializer(record.Payload);
+                    documents.Add(decoded is TDocument typed
+                        ? typed
+                        : ConvertUntypedDocument<TDocument>(decoded));
+                }
+                else
+                {
+                    documents.Add((TDocument)CultDocumentMessagePackSerialization.DeserializeUntyped(typeof(TDocument), record.Payload));
+                }
+            }
+
+            return documents;
+        }
+
+        private static bool RawSnapshotPayloadMatchesSchema(
+            byte[] payload,
+            CultDocumentDescriptor descriptor)
+        {
+            var schemaVersion = TryReadSchemaVersion(payload);
+            if (string.IsNullOrWhiteSpace(schemaVersion))
+                return false;
+
+            if (string.Equals(schemaVersion, descriptor.SchemaVersion, StringComparison.Ordinal))
+                return true;
+
+            var schemaName = InferSchemaName(schemaVersion!);
+            return !string.IsNullOrWhiteSpace(schemaName) &&
+                   string.Equals(schemaName, descriptor.SchemaName, StringComparison.Ordinal);
+        }
+
+        private static string? TryReadSchemaVersion(byte[] payload)
+        {
+            try
+            {
+                var array = MessagePackSerializer.Deserialize<object[]>(payload, CultNetSchemaMessageSerialization.Options);
+                if (array.Length > 0 && array[0] is string schemaVersion)
+                    return schemaVersion;
+            }
+            catch (Exception)
+            {
+                // Fall through to map decoding; different runtimes may encode object-like payloads.
+            }
+
+            try
+            {
+                var map = MessagePackSerializer.Deserialize<IReadOnlyDictionary<string, object?>>(payload, CultNetSchemaMessageSerialization.Options);
+                if (map.TryGetValue("schemaVersion", out var schemaVersion) && schemaVersion is string schemaVersionText)
+                    return schemaVersionText;
+                if (map.TryGetValue("schema_version", out var snakeSchemaVersion) && snakeSchemaVersion is string snakeSchemaVersionText)
+                    return snakeSchemaVersionText;
+            }
+            catch (Exception)
+            {
+                return null;
+            }
+
+            return null;
+        }
+
+        private static string? InferSchemaName(string schemaVersion)
+        {
+            var marker = schemaVersion.LastIndexOf(".v", StringComparison.Ordinal);
+            if (marker <= 0 || marker + 2 >= schemaVersion.Length)
+                return null;
+
+            var version = schemaVersion.Substring(marker + 2);
+            return version.All(char.IsDigit)
+                ? schemaVersion.Substring(0, marker)
+                : null;
+        }
+    }
+}
diff --git a/src/GameCult.Mesh/CultMeshStreaming.cs b/src/GameCult.Mesh/CultMeshStreaming.cs
index ba3dcfd6..51876200 100644
--- a/src/GameCult.Mesh/CultMeshStreaming.cs
+++ b/src/GameCult.Mesh/CultMeshStreaming.cs
@@ -1,5 +1,4 @@
 using System;
-using System.Buffers;
 using System.Collections.Generic;
 using System.Linq;
 using System.Threading;
@@ -264,43 +263,43 @@ namespace GameCult.Mesh
 
     public readonly struct CultMeshFrameWriteLease
     {
-        internal CultMeshFrameWriteLease(int slotIndex, ulong sequence, Memory<byte> memory)
+        private readonly CultMeshFrameRegionWriteLease _lease;
+
+        internal CultMeshFrameWriteLease(CultMeshFrameRegionWriteLease lease)
         {
-            SlotIndex = slotIndex;
-            Sequence = sequence;
-            Memory = memory;
+            _lease = lease;
         }
 
-        public int SlotIndex { get; }
-        public ulong Sequence { get; }
-        public Memory<byte> Memory { get; }
+        public int SlotIndex => _lease.SlotIndex;
+        public ulong Sequence => checked((ulong)_lease.Sequence);
+        public Memory<byte> Memory => _lease.Memory;
         public Span<byte> Span => Memory.Span;
+
+        internal CultMeshFrameRegionWriteLease RegionLease => _lease;
     }
 
     public readonly struct CultMeshFrameReadLease : IDisposable
     {
-        private readonly CultMeshSharedMemoryFrameRing? _owner;
+        private readonly CultMeshFrameRegionReadLease? _lease;
 
         internal CultMeshFrameReadLease(
-            CultMeshSharedMemoryFrameRing owner,
-            int slotIndex,
+            CultMeshFrameRegionReadLease lease,
             CultMeshStreamFrameHandle handle,
-            ReadOnlyMemory<byte> memory)
+            int slotIndex)
         {
-            _owner = owner;
+            _lease = lease;
             SlotIndex = slotIndex;
             Handle = handle;
-            Memory = memory;
         }
 
         public int SlotIndex { get; }
         public CultMeshStreamFrameHandle Handle { get; }
-        public ReadOnlyMemory<byte> Memory { get; }
+        public ReadOnlyMemory<byte> Memory => _lease?.Memory ?? ReadOnlyMemory<byte>.Empty;
         public ReadOnlySpan<byte> Span => Memory.Span;
 
         public void Dispose()
         {
-            _owner?.ReleaseRead(SlotIndex);
+            _lease?.Dispose();
         }
     }
 
@@ -338,59 +337,33 @@ namespace GameCult.Mesh
 
     public sealed class CultMeshSharedMemoryFrameRing : IDisposable
     {
-        private readonly byte[] _storage;
-        private readonly int[] _readerCounts;
-        private readonly CultMeshStreamFrameHandle?[] _handles;
-        private int _writeCursor;
-        private int _latestSlot = -1;
-        private int _disposed;
-        private ulong _nextSequence;
-        private ulong _publishedFrames;
-        private ulong _droppedFrames;
-        private ulong _blockedWrites;
-        private ulong _unavoidableCopyCount;
+        private readonly CultMeshFrameRegion _region;
 
         public CultMeshSharedMemoryFrameRing(string streamId, int slotCount, int slotByteLength)
         {
             StreamId = RequireNonEmpty(streamId, nameof(streamId));
-            if (slotCount <= 0) throw new ArgumentOutOfRangeException(nameof(slotCount));
-            if (slotByteLength <= 0) throw new ArgumentOutOfRangeException(nameof(slotByteLength));
-            SlotByteLength = slotByteLength;
-            _storage = ArrayPool<byte>.Shared.Rent(checked(slotCount * slotByteLength));
-            _readerCounts = new int[slotCount];
-            _handles = new CultMeshStreamFrameHandle?[slotCount];
+            if (slotCount != CultMeshFrameRegion.SlotCount)
+                throw new ArgumentOutOfRangeException(nameof(slotCount), "CultMesh frame regions use exactly three slots.");
+            _region = new CultMeshFrameRegion(
+                streamId,
+                $"{streamId}.frame",
+                layoutVersion: 1,
+                capacity: slotByteLength,
+                producerEpoch: 0,
+                slotByteLength);
         }
 
         public string StreamId { get; }
-        public int SlotCount => _handles.Length;
-        public int SlotByteLength { get; }
+        public int SlotCount => CultMeshFrameRegion.SlotCount;
+        public int SlotByteLength => _region.SlotByteLength;
 
         public bool TryAcquireWriteSlot(out CultMeshFrameWriteLease lease)
         {
-            ThrowIfDisposed();
-
-            for (var attempt = 0; attempt < SlotCount; attempt++)
+            if (_region.TryAcquireWrite(out var regionLease))
             {
-                var slotIndex = (_writeCursor + attempt) % SlotCount;
-                if (Volatile.Read(ref _readerCounts[slotIndex]) != 0)
-                {
-                    continue;
-                }
-
-                if (_handles[slotIndex] != null)
-                {
-                    _droppedFrames++;
-                }
-
-                _writeCursor = (slotIndex + 1) % SlotCount;
-                lease = new CultMeshFrameWriteLease(
-                    slotIndex,
-                    _nextSequence,
-                    new Memory<byte>(_storage, slotIndex * SlotByteLength, SlotByteLength));
+                lease = new CultMeshFrameWriteLease(regionLease);
                 return true;
             }
-
-            _blockedWrites++;
             lease = default;
             return false;
         }
@@ -403,29 +376,9 @@ namespace GameCult.Mesh
             int unavoidableCopyCount = 0,
             IReadOnlyDictionary<string, string>? metadata = null)
         {
-            ThrowIfDisposed();
-            RequireSlot(lease.SlotIndex);
-            if (byteLength < 0 || byteLength > SlotByteLength)
-            {
-                throw new ArgumentOutOfRangeException(nameof(byteLength));
-            }
-
-            _unavoidableCopyCount += (ulong)Math.Max(0, unavoidableCopyCount);
-            var handle = new CultMeshStreamFrameHandle(
-                StreamId,
-                lease.Sequence,
-                timestampNs,
-                CultMeshStreamBodyTransport.SharedMemory,
-                durationNs,
-                byteLength,
-                resourceKey: $"{StreamId}:slot:{lease.SlotIndex}",
-                unavoidableCopyCount: unavoidableCopyCount,
-                metadata: metadata);
-            _handles[lease.SlotIndex] = handle;
-            _latestSlot = lease.SlotIndex;
-            _nextSequence = lease.Sequence + 1;
-            _publishedFrames++;
-            return handle;
+            var generation = _region.Commit(
+                lease.RegionLease, byteLength, timestampNs, durationNs, unavoidableCopyCount, metadata);
+            return ToHandle(generation);
         }
 
         public bool TryPublishCopy(
@@ -434,7 +387,6 @@ namespace GameCult.Mesh
             long durationNs,
             out CultMeshStreamFrameHandle handle)
         {
-            ThrowIfDisposed();
             if (bytes.Length > SlotByteLength)
             {
                 throw new ArgumentOutOfRangeException(nameof(bytes));
@@ -453,79 +405,51 @@ namespace GameCult.Mesh
 
         public bool TryAcquireLatestRead(out CultMeshFrameReadLease lease)
         {
-            ThrowIfDisposed();
-            var slotIndex = Volatile.Read(ref _latestSlot);
-            if (slotIndex < 0)
+            var request = new CultMeshBodyValidationRequest
+            {
+                BodyId = _region.BodyId,
+                SchemaId = _region.SchemaId,
+                LayoutVersion = _region.LayoutVersion,
+                ProducerEpoch = _region.ProducerEpoch,
+                Capacity = _region.Capacity,
+                AccessMode = CultMeshBodyAccessMode.ReadOnly
+            };
+            if (!_region.TryAcquireLatestRead(request, out var regionLease))
             {
                 lease = default;
                 return false;
             }
-
-            var handle = _handles[slotIndex];
-            if (handle == null)
-            {
-                lease = default;
-                return false;
-            }
-
-            Interlocked.Increment(ref _readerCounts[slotIndex]);
-            lease = new CultMeshFrameReadLease(
-                this,
-                slotIndex,
-                handle,
-                new ReadOnlyMemory<byte>(_storage, slotIndex * SlotByteLength, handle.ByteLength));
+            var generation = regionLease.Generation;
+            lease = new CultMeshFrameReadLease(regionLease, ToHandle(generation), generation.SlotIndex);
             return true;
         }
 
         public CultMeshSharedMemoryFrameRingStats Stats()
         {
-            ThrowIfDisposed();
-            var latest = _latestSlot < 0 ? 0 : _handles[_latestSlot]?.Sequence ?? 0;
+            var stats = _region.Stats();
             return new CultMeshSharedMemoryFrameRingStats(
                 StreamId,
                 SlotCount,
                 SlotByteLength,
-                _publishedFrames,
-                _droppedFrames,
-                _blockedWrites,
-                latest,
-                _unavoidableCopyCount);
+                stats.PublishedFrames,
+                stats.DroppedFrames,
+                stats.BlockedWrites,
+                checked((ulong)stats.LatestSequence),
+                stats.UnavoidableCopyCount);
         }
 
-        internal void ReleaseRead(int slotIndex)
-        {
-            if (Volatile.Read(ref _disposed) != 0)
-            {
-                return;
-            }
+        public void Dispose() => _region.Dispose();
 
-            RequireSlot(slotIndex);
-            Interlocked.Decrement(ref _readerCounts[slotIndex]);
-        }
-
-        public void Dispose()
-        {
-            if (Interlocked.Exchange(ref _disposed, 1) == 0)
-            {
-                ArrayPool<byte>.Shared.Return(_storage);
-            }
-        }
-
-        private void ThrowIfDisposed()
-        {
-            if (Volatile.Read(ref _disposed) != 0)
-            {
-                throw new ObjectDisposedException(nameof(CultMeshSharedMemoryFrameRing));
-            }
-        }
-
-        private void RequireSlot(int slotIndex)
-        {
-            if (slotIndex < 0 || slotIndex >= SlotCount)
-            {
-                throw new ArgumentOutOfRangeException(nameof(slotIndex));
-            }
-        }
+        private CultMeshStreamFrameHandle ToHandle(CultMeshFrameGeneration generation) => new(
+            StreamId,
+            checked((ulong)generation.Descriptor.Sequence),
+            generation.TimestampNs,
+            CultMeshStreamBodyTransport.SharedMemory,
+            generation.DurationNs,
+            checked((int)generation.Descriptor.ByteSize),
+            resourceKey: $"{StreamId}:slot:{generation.SlotIndex}",
+            unavoidableCopyCount: generation.UnavoidableCopyCount,
+            metadata: generation.Metadata);
     }
 
     public sealed class CultMeshStreamCatalog
diff --git a/src/GameCult.Mesh/CultMeshTcpContentTransport.cs b/src/GameCult.Mesh/CultMeshTcpContentTransport.cs
new file mode 100644
index 00000000..dcb07feb
--- /dev/null
+++ b/src/GameCult.Mesh/CultMeshTcpContentTransport.cs
@@ -0,0 +1,567 @@
+using System;
+using System.Buffers.Binary;
+using System.Collections.Concurrent;
+using System.IO;
+using System.Net;
+using System.Net.Sockets;
+using System.Threading;
+using System.Threading.Tasks;
+using GameCult.Caching;
+using GameCult.Networking;
+
+namespace GameCult.Mesh
+{
+    /// <summary>Identity served by one dedicated content listener.</summary>
+    public sealed class CultMeshTcpContentServerOptions
+    {
+        public string VerseId { get; set; } = string.Empty;
+        public string AuthorityRuntimeId { get; set; } = string.Empty;
+        public string RouteGeneration { get; set; } = string.Empty;
+        public CultMeshSessionProofSigner? ProofSigner { get; set; }
+
+        internal void Validate()
+        {
+            if (string.IsNullOrWhiteSpace(VerseId)) throw new InvalidOperationException("Content Verse identity is required.");
+            if (string.IsNullOrWhiteSpace(AuthorityRuntimeId)) throw new InvalidOperationException("Content authority runtime identity is required.");
+            if (string.IsNullOrWhiteSpace(RouteGeneration)) throw new InvalidOperationException("Content route generation is required.");
+        }
+    }
+
+    /// <summary>Creates dedicated TCP streams for immutable CultMesh content.</summary>
+    public sealed class CultMeshTcpContentTransportConnector : ICultMeshContentTransportConnector
+    {
+        public const string Scheme = "cultmesh-content+tcp";
+        private readonly TimeSpan _connectTimeout;
+        private int _connectCount;
+
+        public CultMeshTcpContentTransportConnector(TimeSpan? connectTimeout = null)
+        {
+            _connectTimeout = connectTimeout ?? TimeSpan.FromSeconds(5);
+            if (_connectTimeout <= TimeSpan.Zero) throw new ArgumentOutOfRangeException(nameof(connectTimeout));
+        }
+
+        public string ConnectorId => "tcp-content";
+        public int Priority => 0;
+        public int ConnectCount => Volatile.Read(ref _connectCount);
+
+        public bool CanConnect(CultMeshTransportCandidate candidate) =>
+            TryParseEndpoint(candidate?.Endpoint, out _, out _);
+
+        public async Task<ICultMeshContentTransport> ConnectAsync(
+            CultMeshTransportCandidate candidate,
+            CultMeshSessionTarget target,
+            CancellationToken cancellationToken = default)
+        {
+            if (candidate == null) throw new ArgumentNullException(nameof(candidate));
+            if (target == null) throw new ArgumentNullException(nameof(target));
+            if (!TryParseEndpoint(candidate.Endpoint, out var host, out var port))
+                throw new NotSupportedException($"TCP content connector does not support '{candidate.Endpoint}'.");
+
+            var client = new TcpClient();
+            using var timeout = CancellationTokenSource.CreateLinkedTokenSource(cancellationToken);
+            timeout.CancelAfter(_connectTimeout);
+            try
+            {
+                await CultMeshTcpContentWire.AwaitAsync(client.ConnectAsync(host, port), timeout.Token)
+                    .ConfigureAwait(false);
+                await CultMeshTcpContentWire.VerifyAuthorityAsync(
+                    client.GetStream(), target, candidate, timeout.Token).ConfigureAwait(false);
+                Interlocked.Increment(ref _connectCount);
+                return new CultMeshTcpContentTransport(candidate.Endpoint, client, target, candidate.Generation);
+            }
+            catch
+            {
+                client.Dispose();
+                throw;
+            }
+        }
+
+        internal static bool TryParseEndpoint(string? endpoint, out string host, out int port)
+        {
+            host = string.Empty;
+            port = 0;
+            if (!Uri.TryCreate(endpoint, UriKind.Absolute, out var uri) ||
+                !string.Equals(uri.Scheme, Scheme, StringComparison.OrdinalIgnoreCase) ||
+                string.IsNullOrWhiteSpace(uri.Host) || uri.Port <= 0)
+                return false;
+            host = uri.Host;
+            port = uri.Port;
+            return true;
+        }
+    }
+
+    internal sealed class CultMeshTcpContentTransport : ICultMeshContentTransport, ICultMeshVerifiedTransport
+    {
+        private readonly TcpClient _client;
+        private readonly NetworkStream _stream;
+        private readonly SemaphoreSlim _sendLock = new(1, 1);
+        private readonly ConcurrentDictionary<string, PendingCopy> _pending = new(StringComparer.Ordinal);
+        private readonly CancellationTokenSource _shutdown = new();
+        private readonly Task _receiveLoop;
+        private readonly string _verseId;
+        private readonly string _authorityRuntimeId;
+        private readonly string _routeGeneration;
+        private bool _disposed;
+
+        public CultMeshTcpContentTransport(
+            string endpoint,
+            TcpClient client,
+            CultMeshSessionTarget target,
+            string routeGeneration)
+        {
+            Endpoint = endpoint;
+            _client = client ?? throw new ArgumentNullException(nameof(client));
+            _verseId = target?.VerseId ?? throw new ArgumentNullException(nameof(target));
+            _authorityRuntimeId = target.AuthorityRuntimeId;
+            _routeGeneration = routeGeneration ?? string.Empty;
+            _stream = client.GetStream();
+            _receiveLoop = ReceiveLoopAsync(_shutdown.Token);
+        }
+
+        public string TransportId => "tcp-content";
+        public string Endpoint { get; }
+
+        public bool IsVerifiedFor(
+            string verseId,
+            string authorityRuntimeId,
+            string protocolId,
+            string routeGeneration) =>
+            string.Equals(_verseId, verseId, StringComparison.Ordinal) &&
+            string.Equals(_authorityRuntimeId, authorityRuntimeId, StringComparison.Ordinal) &&
+            string.Equals(CultMeshProtocols.Content.Value, protocolId, StringComparison.Ordinal) &&
+            string.Equals(_routeGeneration, routeGeneration, StringComparison.Ordinal);
+
+        public async Task CopyChunkToAsync(
+            CultMeshCdnChunkRef chunk,
+            Stream destination,
+            CancellationToken cancellationToken = default)
+        {
+            if (_disposed) throw new ObjectDisposedException(nameof(CultMeshTcpContentTransport));
+            if (chunk == null) throw new ArgumentNullException(nameof(chunk));
+            if (destination == null) throw new ArgumentNullException(nameof(destination));
+            if (!destination.CanWrite) throw new ArgumentException("Content destination must be writable.", nameof(destination));
+
+            var messageId = Guid.NewGuid().ToString("N");
+            var completion = new TaskCompletionSource<bool>(TaskCreationOptions.RunContinuationsAsynchronously);
+            var pending = new PendingCopy(destination, completion, cancellationToken);
+            if (!_pending.TryAdd(messageId, pending))
+                throw new InvalidOperationException("Duplicate TCP content request identity.");
+            try
+            {
+                var request = new CultMeshContentChunkRequestMessage
+                {
+                    MessageId = messageId,
+                    ChunkHash = CultMeshCdn.NormalizeHash(chunk.ChunkHash, nameof(chunk.ChunkHash)),
+                    RecordKey = string.IsNullOrWhiteSpace(chunk.RecordKey)
+                        ? CultMeshCdnArtifactChunk.CreateRecordKey(chunk.ChunkHash).Value
+                        : chunk.RecordKey,
+                    ExpectedSizeBytes = chunk.SizeBytes
+                };
+                var payload = CultNetSchemaMessageSerialization.Serialize(request);
+                await _sendLock.WaitAsync(cancellationToken).ConfigureAwait(false);
+                try
+                {
+                    await CultMeshTcpContentWire.WriteFrameAsync(_stream, payload, cancellationToken).ConfigureAwait(false);
+                }
+                finally
+                {
+                    _sendLock.Release();
+                }
+                await CultMeshTcpContentWire.AwaitAsync(completion.Task, cancellationToken).ConfigureAwait(false);
+            }
+            finally
+            {
+                _pending.TryRemove(messageId, out _);
+                pending.Dispose();
+            }
+        }
+
+        public void Dispose()
+        {
+            if (_disposed) return;
+            _disposed = true;
+            _shutdown.Cancel();
+            _client.Dispose();
+            var error = new ObjectDisposedException(nameof(CultMeshTcpContentTransport));
+            foreach (var pending in _pending.Values) pending.Completion.TrySetException(error);
+            _pending.Clear();
+            _sendLock.Dispose();
+            _shutdown.Dispose();
+        }
+
+        private async Task ReceiveLoopAsync(CancellationToken cancellationToken)
+        {
+            try
+            {
+                while (!cancellationToken.IsCancellationRequested)
+                {
+                    var headerBytes = await CultMeshTcpContentWire.ReadFrameAsync(_stream, cancellationToken).ConfigureAwait(false);
+                    var response = CultNetSchemaMessageSerialization.Deserialize(headerBytes) as CultMeshContentChunkResponseMessage
+                        ?? throw new InvalidDataException("TCP content response used an unexpected schema.");
+                    if (!_pending.TryGetValue(response.MessageId ?? string.Empty, out var pending))
+                        throw new InvalidDataException("TCP content response did not match an active request.");
+                    if (!response.Found)
+                    {
+                        pending.Completion.TrySetException(new FileNotFoundException(response.Error, response.ChunkHash));
+                        continue;
+                    }
+                    await CultMeshTcpContentWire.CopyExactlyAsync(
+                        _stream,
+                        pending.Destination,
+                        response.SizeBytes,
+                        pending.CancellationToken).ConfigureAwait(false);
+                    pending.Completion.TrySetResult(true);
+                }
+            }
+            catch (Exception error) when (!_disposed)
+            {
+                foreach (var pending in _pending.Values) pending.Completion.TrySetException(error);
+            }
+        }
+
+        private sealed class PendingCopy : IDisposable
+        {
+            private readonly CancellationTokenRegistration _registration;
+
+            public PendingCopy(
+                Stream destination,
+                TaskCompletionSource<bool> completion,
+                CancellationToken cancellationToken)
+            {
+                Destination = destination;
+                Completion = completion;
+                CancellationToken = cancellationToken;
+                _registration = cancellationToken.Register(() => completion.TrySetCanceled(cancellationToken));
+            }
+
+            public Stream Destination { get; }
+            public TaskCompletionSource<bool> Completion { get; }
+            public CancellationToken CancellationToken { get; }
+            public void Dispose() => _registration.Dispose();
+        }
+    }
+
+    /// <summary>
+    /// Serves content-addressed chunks over a dedicated TCP byte stream. Typed headers
+    /// remain CultNet schema messages; chunk bytes are streamed outside those messages.
+    /// </summary>
+    public sealed class CultMeshTcpContentServer : IDisposable
+    {
+        private readonly TcpListener _listener;
+        private readonly Func<string, CultMeshCdnArtifactChunk?> _resolveChunk;
+        private readonly Func<string, bool> _canServeHash;
+        private readonly CultMeshTcpContentServerOptions _options;
+        private readonly CancellationTokenSource _shutdown = new();
+        private readonly ConcurrentDictionary<TcpClient, byte> _clients = new();
+        private readonly Task _acceptLoop;
+        private long _chunkRequestsServed;
+        private bool _disposed;
+
+        public CultMeshTcpContentServer(
+            TcpListener listener,
+            CultCache content,
+            CultMeshTcpContentServerOptions options,
+            Func<string, bool>? canServeHash = null)
+            : this(listener, CreateCacheResolver(content), options, canServeHash)
+        {
+        }
+
+        /// <summary>
+        /// Starts a dedicated TCP content server over provider-owned immutable chunks.
+        /// The resolver receives a normalized SHA-256 hash and may return <see langword="null"/>
+        /// when that chunk is unavailable.
+        /// </summary>
+        public CultMeshTcpContentServer(
+            TcpListener listener,
+            Func<string, CultMeshCdnArtifactChunk?> resolveChunk,
+            CultMeshTcpContentServerOptions options,
+            Func<string, bool>? canServeHash = null)
+        {
+            _listener = listener ?? throw new ArgumentNullException(nameof(listener));
+            _resolveChunk = resolveChunk ?? throw new ArgumentNullException(nameof(resolveChunk));
+            _options = options ?? throw new ArgumentNullException(nameof(options));
+            _options.Validate();
+            _canServeHash = canServeHash ?? (_ => true);
+            _listener.Start();
+            _acceptLoop = AcceptLoopAsync(_shutdown.Token);
+        }
+
+        public IPEndPoint LocalEndPoint => (IPEndPoint)_listener.LocalEndpoint;
+        public long ChunkRequestsServed => Interlocked.Read(ref _chunkRequestsServed);
+
+        public void Dispose()
+        {
+            if (_disposed) return;
+            _disposed = true;
+            _shutdown.Cancel();
+            _listener.Stop();
+            foreach (var client in _clients.Keys) client.Dispose();
+            _clients.Clear();
+            _shutdown.Dispose();
+        }
+
+        private async Task AcceptLoopAsync(CancellationToken cancellationToken)
+        {
+            try
+            {
+                while (!cancellationToken.IsCancellationRequested)
+                {
+                    var client = await _listener.AcceptTcpClientAsync().ConfigureAwait(false);
+                    _clients.TryAdd(client, 0);
+                    _ = ServeClientAsync(client, cancellationToken);
+                }
+            }
+            catch (Exception) when (_disposed || cancellationToken.IsCancellationRequested)
+            {
+            }
+        }
+
+        private async Task ServeClientAsync(TcpClient client, CancellationToken cancellationToken)
+        {
+            try
+            {
+                using var stream = client.GetStream();
+                if (!await AcceptAuthorityAsync(stream, cancellationToken).ConfigureAwait(false)) return;
+                while (!cancellationToken.IsCancellationRequested)
+                {
+                    var requestBytes = await CultMeshTcpContentWire.ReadFrameAsync(stream, cancellationToken).ConfigureAwait(false);
+                    var request = CultNetSchemaMessageSerialization.Deserialize(requestBytes) as CultMeshContentChunkRequestMessage
+                        ?? throw new InvalidDataException("TCP content request used an unexpected schema.");
+                    await SendChunkAsync(stream, request, cancellationToken).ConfigureAwait(false);
+                }
+            }
+            catch (Exception) when (_disposed || cancellationToken.IsCancellationRequested || !client.Connected)
+            {
+            }
+            finally
+            {
+                _clients.TryRemove(client, out _);
+                client.Dispose();
+            }
+        }
+
+        private async Task<bool> AcceptAuthorityAsync(Stream stream, CancellationToken cancellationToken)
+        {
+            var requestBytes = await CultMeshTcpContentWire.ReadFrameAsync(stream, cancellationToken).ConfigureAwait(false);
+            var request = CultNetSchemaMessageSerialization.Deserialize(requestBytes) as CultMeshSessionOpenMessage
+                ?? throw new InvalidDataException("TCP content session did not begin with an authority handshake.");
+            var accepted = !string.IsNullOrWhiteSpace(request.MessageId) &&
+                !string.IsNullOrWhiteSpace(request.SourceRuntimeId) &&
+                IsNonce(request.ClientNonce) &&
+                string.Equals(request.VerseId, _options.VerseId, StringComparison.Ordinal) &&
+                string.Equals(request.AuthorityRuntimeId, _options.AuthorityRuntimeId, StringComparison.Ordinal) &&
+                string.Equals(request.ProtocolId, CultMeshProtocols.Content.Value, StringComparison.Ordinal) &&
+                string.Equals(request.RouteGeneration, _options.RouteGeneration, StringComparison.Ordinal);
+            var response = new CultMeshSessionAcceptedMessage
+            {
+                MessageId = request.MessageId,
+                Accepted = accepted,
+                VerseId = _options.VerseId,
+                AuthorityRuntimeId = _options.AuthorityRuntimeId,
+                ProtocolId = CultMeshProtocols.Content.Value,
+                RouteGeneration = _options.RouteGeneration,
+                ClientNonce = request.ClientNonce ?? string.Empty,
+                ProviderKeyId = accepted ? _options.ProofSigner?.ProviderKeyId ?? string.Empty : string.Empty,
+                ProviderSignature = accepted && _options.ProofSigner != null
+                    ? _options.ProofSigner.Sign(request)
+                    : string.Empty,
+                Error = accepted ? null : "Content session target does not match this authority route."
+            };
+            await CultMeshTcpContentWire.WriteFrameAsync(
+                stream,
+                CultNetSchemaMessageSerialization.Serialize(response),
+                cancellationToken).ConfigureAwait(false);
+            return accepted;
+        }
+
+        private static bool IsNonce(string? value)
+        {
+            if (string.IsNullOrWhiteSpace(value)) return false;
+            try { return Convert.FromBase64String(value).Length == 32; }
+            catch (FormatException) { return false; }
+        }
+
+        private async Task SendChunkAsync(
+            Stream stream,
+            CultMeshContentChunkRequestMessage request,
+            CancellationToken cancellationToken)
+        {
+            var response = new CultMeshContentChunkResponseMessage
+            {
+                MessageId = request.MessageId,
+                ChunkHash = request.ChunkHash,
+                Payload = Array.Empty<byte>()
+            };
+            CultMeshCdnArtifactChunk? chunk = null;
+            try
+            {
+                if (string.IsNullOrWhiteSpace(request.MessageId))
+                    throw new InvalidDataException("Content chunk request requires a message identity.");
+                var hash = CultMeshCdn.NormalizeHash(request.ChunkHash, nameof(request.ChunkHash));
+                if (!_canServeHash(hash))
+                    throw new UnauthorizedAccessException("Content access policy rejected the requested hash.");
+                var key = CultMeshCdnArtifactChunk.CreateRecordKey(hash);
+                if (!string.IsNullOrWhiteSpace(request.RecordKey) &&
+                    !string.Equals(request.RecordKey, key.Value, StringComparison.Ordinal))
+                    throw new InvalidDataException("Content chunk record key disagrees with its content hash.");
+                chunk = _resolveChunk(hash)
+                    ?? throw new FileNotFoundException("Content chunk is not available.", key.Value);
+                CultMeshCdn.ValidateChunkPayload(new CultMeshCdnChunkRef
+                {
+                    ChunkHash = hash,
+                    RecordKey = key.Value,
+                    SizeBytes = request.ExpectedSizeBytes
+                }, chunk);
+                response.Found = true;
+                response.ChunkHash = hash;
+                response.SizeBytes = chunk.SizeBytes;
+                Interlocked.Increment(ref _chunkRequestsServed);
+            }
+            catch (Exception error)
+            {
+                response.Found = false;
+                response.Error = error.GetType().Name + ": " + error.Message;
+            }
+
+            await CultMeshTcpContentWire.WriteFrameAsync(
+                stream,
+                CultNetSchemaMessageSerialization.Serialize(response),
+                cancellationToken).ConfigureAwait(false);
+            if (chunk != null)
+            {
+                await stream.WriteAsync(chunk.Payload, 0, chunk.Payload.Length, cancellationToken).ConfigureAwait(false);
+                await stream.FlushAsync(cancellationToken).ConfigureAwait(false);
+            }
+        }
+
+        private static Func<string, CultMeshCdnArtifactChunk?> CreateCacheResolver(CultCache content)
+        {
+            if (content == null) throw new ArgumentNullException(nameof(content));
+            return hash => content.Get<CultMeshCdnArtifactChunk>(CultMeshCdnArtifactChunk.CreateRecordKey(hash));
+        }
+    }
+
+    internal static class CultMeshTcpContentWire
+    {
+        private const int HeaderBytes = 4;
+        private const int MaximumHeaderBytes = 1024 * 1024;
+
+        public static async Task AwaitAsync(Task task, CancellationToken cancellationToken)
+        {
+            if (!cancellationToken.CanBeCanceled)
+            {
+                await task.ConfigureAwait(false);
+                return;
+            }
+            var cancelled = new TaskCompletionSource<bool>(TaskCreationOptions.RunContinuationsAsynchronously);
+            using (cancellationToken.Register(() => cancelled.TrySetResult(true)))
+            {
+                if (await Task.WhenAny(task, cancelled.Task).ConfigureAwait(false) != task)
+                    throw new OperationCanceledException(cancellationToken);
+            }
+            await task.ConfigureAwait(false);
+        }
+
+        public static async Task WriteFrameAsync(
+            Stream stream,
+            byte[] payload,
+            CancellationToken cancellationToken)
+        {
+            if (payload.Length > MaximumHeaderBytes)
+                throw new InvalidDataException("TCP content control frame exceeds its size bound.");
+            var header = new byte[HeaderBytes];
+            BinaryPrimitives.WriteUInt32BigEndian(header, checked((uint)payload.Length));
+            await stream.WriteAsync(header, 0, header.Length, cancellationToken).ConfigureAwait(false);
+            await stream.WriteAsync(payload, 0, payload.Length, cancellationToken).ConfigureAwait(false);
+            await stream.FlushAsync(cancellationToken).ConfigureAwait(false);
+        }
+
+        public static async Task VerifyAuthorityAsync(
+            Stream stream,
+            CultMeshSessionTarget target,
+            CultMeshTransportCandidate candidate,
+            CancellationToken cancellationToken)
+        {
+            var request = new CultMeshSessionOpenMessage
+            {
+                MessageId = Guid.NewGuid().ToString("N"),
+                SourceRuntimeId = "cultmesh-content-client",
+                VerseId = target.VerseId,
+                AuthorityRuntimeId = target.AuthorityRuntimeId,
+                ProtocolId = CultMeshProtocols.Content.Value,
+                RouteGeneration = candidate.Generation,
+                ClientNonce = CreateNonce()
+            };
+            await WriteFrameAsync(stream, CultNetSchemaMessageSerialization.Serialize(request), cancellationToken)
+                .ConfigureAwait(false);
+            var responseBytes = await ReadFrameAsync(stream, cancellationToken).ConfigureAwait(false);
+            var response = CultNetSchemaMessageSerialization.Deserialize(responseBytes) as CultMeshSessionAcceptedMessage
+                ?? throw new InvalidDataException("TCP content authority handshake returned an unexpected schema.");
+            if (!string.Equals(response.MessageId, request.MessageId, StringComparison.Ordinal) ||
+                !response.Accepted ||
+                !string.Equals(response.VerseId, target.VerseId, StringComparison.Ordinal) ||
+                !string.Equals(response.AuthorityRuntimeId, target.AuthorityRuntimeId, StringComparison.Ordinal) ||
+                !string.Equals(response.ProtocolId, CultMeshProtocols.Content.Value, StringComparison.Ordinal) ||
+                !string.Equals(response.RouteGeneration, candidate.Generation, StringComparison.Ordinal) ||
+                candidate.VerifiedAuthority == null ||
+                !CultMeshAuthorityProof.VerifySession(request, response, candidate.VerifiedAuthority))
+                throw new CultMeshSessionException(new CultMeshSessionFailure(
+                    CultMeshSessionFailureReason.Authority,
+                    response.Error ?? "TCP content endpoint did not prove the selected authority route.",
+                    candidate.Endpoint));
+        }
+
+        private static string CreateNonce()
+        {
+            var nonce = new byte[32];
+            using (var random = System.Security.Cryptography.RandomNumberGenerator.Create()) random.GetBytes(nonce);
+            return Convert.ToBase64String(nonce);
+        }
+
+        public static async Task<byte[]> ReadFrameAsync(Stream stream, CancellationToken cancellationToken)
+        {
+            var header = new byte[HeaderBytes];
+            await ReadExactlyAsync(stream, header, cancellationToken).ConfigureAwait(false);
+            var size = checked((int)BinaryPrimitives.ReadUInt32BigEndian(header));
+            if (size <= 0 || size > MaximumHeaderBytes)
+                throw new InvalidDataException("TCP content control frame has an invalid size.");
+            var payload = new byte[size];
+            await ReadExactlyAsync(stream, payload, cancellationToken).ConfigureAwait(false);
+            return payload;
+        }
+
+        public static async Task CopyExactlyAsync(
+            Stream source,
+            Stream destination,
+            long bytes,
+            CancellationToken cancellationToken)
+        {
+            if (bytes < 0) throw new InvalidDataException("TCP content body size cannot be negative.");
+            var buffer = new byte[81920];
+            var remaining = bytes;
+            while (remaining > 0)
+            {
+                var requested = (int)Math.Min(buffer.Length, remaining);
+                var read = await source.ReadAsync(buffer, 0, requested, cancellationToken).ConfigureAwait(false);
+                if (read == 0) throw new EndOfStreamException();
+                await destination.WriteAsync(buffer, 0, read, cancellationToken).ConfigureAwait(false);
+                remaining -= read;
+            }
+        }
+
+        private static async Task ReadExactlyAsync(
+            Stream stream,
+            byte[] buffer,
+            CancellationToken cancellationToken)
+        {
+            var offset = 0;
+            while (offset < buffer.Length)
+            {
+                var read = await stream.ReadAsync(buffer, offset, buffer.Length - offset, cancellationToken)
+                    .ConfigureAwait(false);
+                if (read == 0) throw new EndOfStreamException();
+                offset += read;
+            }
+        }
+    }
+}
diff --git a/src/GameCult.Mesh/CultMeshVerse.cs b/src/GameCult.Mesh/CultMeshVerse.cs
index 547a46ec..003dc161 100644
--- a/src/GameCult.Mesh/CultMeshVerse.cs
+++ b/src/GameCult.Mesh/CultMeshVerse.cs
@@ -91,6 +91,57 @@ namespace GameCult.Mesh
         }
     }
 
+    /// <summary>
+    /// Binds one authoritative runtime to one physical route. This relationship is
+    /// the routing authority; the legacy endpoint/runtime lists are projections only.
+    /// </summary>
+    public sealed class CultMeshAuthorityRoute
+    {
+        public CultMeshAuthorityRoute(
+            string authorityRuntimeId,
+            string endpoint,
+            IEnumerable<string>? protocolIds = null,
+            int priority = 0,
+            string? generation = null,
+            CultMeshRouteCertificate? certificate = null)
+        {
+            AuthorityRuntimeId = RequireNonEmpty(authorityRuntimeId, nameof(authorityRuntimeId));
+            Endpoint = RequireNonEmpty(endpoint, nameof(endpoint));
+            ProtocolIds = Clean(protocolIds);
+            if (priority < 0) throw new ArgumentOutOfRangeException(nameof(priority));
+            Priority = priority;
+            Generation = string.IsNullOrWhiteSpace(generation)
+                ? AuthorityRuntimeId + "@" + Endpoint
+                : generation!.Trim();
+            Certificate = certificate;
+        }
+
+        public string AuthorityRuntimeId { get; }
+        public string Endpoint { get; }
+        public IReadOnlyList<string> ProtocolIds { get; }
+        public int Priority { get; }
+        public string Generation { get; }
+        /// <summary>Gets the optional Odin-signed binding from this route to its provider key.</summary>
+        public CultMeshRouteCertificate? Certificate { get; }
+
+        public bool Supports(CultMeshProtocolId protocol) =>
+            protocol != null &&
+            (ProtocolIds.Count == 0 || ProtocolIds.Contains(protocol.Value, StringComparer.Ordinal));
+
+        private static string[] Clean(IEnumerable<string>? values) =>
+            values?.Where(value => !string.IsNullOrWhiteSpace(value))
+                .Select(value => value.Trim())
+                .Distinct(StringComparer.Ordinal)
+                .OrderBy(value => value, StringComparer.Ordinal)
+                .ToArray()
+            ?? Array.Empty<string>();
+
+        private static string RequireNonEmpty(string value, string paramName) =>
+            string.IsNullOrWhiteSpace(value)
+                ? throw new ArgumentException("Value must be non-empty.", paramName)
+                : value.Trim();
+    }
+
     /// <summary>
     /// Describes one CultMesh Verse: a rule-bearing consensus graph.
     /// </summary>
@@ -107,14 +158,36 @@ namespace GameCult.Mesh
             IEnumerable<string>? discoveryEndpoints = null,
             IEnumerable<string>? authorityRuntimeIds = null,
             string? parentVerseId = null,
-            string? description = null)
+            string? description = null,
+            IEnumerable<CultMeshAuthorityRoute>? authorityRoutes = null)
         {
             VerseId = RequireNonEmpty(verseId, nameof(verseId));
             DisplayName = RequireNonEmpty(displayName, nameof(displayName));
             AuthorityModel = authorityModel;
             Compatibility = compatibility ?? throw new ArgumentNullException(nameof(compatibility));
-            DiscoveryEndpoints = Clean(discoveryEndpoints);
-            AuthorityRuntimeIds = Clean(authorityRuntimeIds);
+            var legacyEndpoints = Clean(discoveryEndpoints);
+            var legacyRuntimeIds = Clean(authorityRuntimeIds);
+            var suppliedRoutes = authorityRoutes?.ToArray();
+            if (suppliedRoutes?.Any(route => route == null) == true)
+                throw new ArgumentException("Authority routes cannot contain null.", nameof(authorityRoutes));
+            if (suppliedRoutes != null && (legacyEndpoints.Length > 0 || legacyRuntimeIds.Length > 0))
+                throw new ArgumentException(
+                    "Supply bound authority routes or legacy endpoint/runtime lists, never both.",
+                    nameof(authorityRoutes));
+            if (suppliedRoutes == null && legacyEndpoints.Length > 0 && legacyRuntimeIds.Length > 1)
+                throw new InvalidOperationException(
+                    "Legacy Verse routing with multiple authority runtimes is ambiguous. " +
+                    "Publish explicit CultMeshAuthorityRoute bindings.");
+
+            AuthorityRoutes = NormalizeRoutes(suppliedRoutes ??
+                (legacyRuntimeIds.Length == 1
+                    ? legacyEndpoints.Select(endpoint => new CultMeshAuthorityRoute(legacyRuntimeIds[0], endpoint))
+                    : Array.Empty<CultMeshAuthorityRoute>()));
+            DiscoveryEndpoints = AuthorityRoutes.Count > 0
+                ? AuthorityRoutes.Select(route => route.Endpoint).Distinct(StringComparer.Ordinal).ToArray()
+                : legacyEndpoints;
+            AuthorityRuntimeIds = AuthorityRoutes.Select(route => route.AuthorityRuntimeId)
+                .Distinct(StringComparer.Ordinal).OrderBy(value => value, StringComparer.Ordinal).ToArray();
             ParentVerseId = parentVerseId;
             Description = description;
         }
@@ -143,6 +216,8 @@ namespace GameCult.Mesh
         /// Gets known authoritative runtime ids, when authority is cluster-shaped.
         /// </summary>
         public IReadOnlyList<string> AuthorityRuntimeIds { get; }
+        /// <summary>Gets exact authority-to-route bindings used for identity-sensitive resolution.</summary>
+        public IReadOnlyList<CultMeshAuthorityRoute> AuthorityRoutes { get; }
         /// <summary>
         /// Gets the parent Verse id for subscribed overlays or branches.
         /// </summary>
@@ -177,10 +252,29 @@ namespace GameCult.Mesh
 
         private static string[] Clean(IEnumerable<string>? values)
         {
-            return values?.Where(value => !string.IsNullOrWhiteSpace(value)).Distinct(StringComparer.Ordinal).ToArray()
+            return values?.Where(value => !string.IsNullOrWhiteSpace(value))
+                .Select(value => value.Trim())
+                .Distinct(StringComparer.Ordinal)
+                .ToArray()
                 ?? Array.Empty<string>();
         }
 
+        private static CultMeshAuthorityRoute[] NormalizeRoutes(IEnumerable<CultMeshAuthorityRoute> routes)
+        {
+            return routes
+                .GroupBy(route => new
+                {
+                    route.AuthorityRuntimeId,
+                    route.Endpoint,
+                    Protocols = string.Join("\u001f", route.ProtocolIds)
+                })
+                .Select(group => group.OrderBy(route => route.Priority).First())
+                .OrderBy(route => route.Priority)
+                .ThenBy(route => route.AuthorityRuntimeId, StringComparer.Ordinal)
+                .ThenBy(route => route.Endpoint, StringComparer.Ordinal)
+                .ToArray();
+        }
+
         private static string RequireNonEmpty(string value, string paramName)
         {
             if (string.IsNullOrWhiteSpace(value))
diff --git a/src/GameCult.Mesh/CultMeshVerseDiscovery.cs b/src/GameCult.Mesh/CultMeshVerseDiscovery.cs
index 9ada1691..1e98fc16 100644
--- a/src/GameCult.Mesh/CultMeshVerseDiscovery.cs
+++ b/src/GameCult.Mesh/CultMeshVerseDiscovery.cs
@@ -1,6 +1,7 @@
 using System;
 using System.Collections.Generic;
 using System.Linq;
+using System.Threading;
 using System.Threading.Tasks;
 using GameCult.Networking;
 
@@ -32,6 +33,24 @@ namespace GameCult.Mesh
                 },
                 DiscoveryEndpoints = verse.DiscoveryEndpoints.ToArray(),
                 AuthorityRuntimeIds = verse.AuthorityRuntimeIds.ToArray(),
+                AuthorityRoutes = verse.AuthorityRoutes.Select(route => new CultMeshAuthorityRouteMessage
+                {
+                    AuthorityRuntimeId = route.AuthorityRuntimeId,
+                    Endpoint = route.Endpoint,
+                    ProtocolIds = route.ProtocolIds.ToArray(),
+                    Priority = route.Priority,
+                    Generation = route.Generation,
+                    Certificate = route.Certificate == null ? null : new CultMeshRouteCertificateMessage
+                    {
+                        ProviderKeyId = route.Certificate.ProviderKey.KeyId,
+                        ProviderPublicKeyX = route.Certificate.ProviderKey.X,
+                        ProviderPublicKeyY = route.Certificate.ProviderKey.Y,
+                        OdinKeyId = route.Certificate.OdinKeyId,
+                        IssuedAtUnixMilliseconds = route.Certificate.IssuedAtUnixMilliseconds,
+                        ExpiresAtUnixMilliseconds = route.Certificate.ExpiresAtUnixMilliseconds,
+                        Signature = route.Certificate.Signature
+                    }
+                }).ToArray(),
                 ParentVerseId = verse.ParentVerseId,
                 Description = verse.Description
             };
@@ -49,6 +68,21 @@ namespace GameCult.Mesh
                 out var parsed)
                 ? parsed
                 : CultMeshVerseAuthorityModel.SubscribedOverlay;
+            var routes = message.AuthorityRoutes?.Select(route => new CultMeshAuthorityRoute(
+                route.AuthorityRuntimeId,
+                route.Endpoint,
+                route.ProtocolIds,
+                route.Priority,
+                route.Generation,
+                route.Certificate == null ? null : new CultMeshRouteCertificate(
+                    new CultMeshEcdsaP256PublicKey(
+                        route.Certificate.ProviderKeyId,
+                        route.Certificate.ProviderPublicKeyX,
+                        route.Certificate.ProviderPublicKeyY),
+                    route.Certificate.OdinKeyId,
+                    route.Certificate.IssuedAtUnixMilliseconds,
+                    route.Certificate.ExpiresAtUnixMilliseconds,
+                    route.Certificate.Signature))).ToArray();
             return new CultMeshVerseDescriptor(
                 message.VerseId,
                 message.DisplayName,
@@ -59,10 +93,38 @@ namespace GameCult.Mesh
                     message.Compatibility.CompatibleVerseIds,
                     message.Compatibility.RequiredPluginIds,
                     message.Compatibility.OptionalPluginIds),
-                message.DiscoveryEndpoints,
-                message.AuthorityRuntimeIds,
+                routes is { Length: > 0 } ? null : message.DiscoveryEndpoints,
+                routes is { Length: > 0 } ? null : message.AuthorityRuntimeIds,
                 message.ParentVerseId,
-                message.Description);
+                message.Description,
+                routes is { Length: > 0 } ? routes : null);
+        }
+
+        /// <summary>Creates the canonical filtered Verse catalog response for any CultNet transport adapter.</summary>
+        public static CultMeshVerseCatalogResponseMessage CreateCatalogResponse(
+            CultMeshVerseCatalog catalog,
+            CultMeshVerseCatalogRequestMessage request)
+        {
+            if (catalog == null) throw new ArgumentNullException(nameof(catalog));
+            if (request == null) throw new ArgumentNullException(nameof(request));
+            var verseIds = request.VerseIds == null || request.VerseIds.Length == 0
+                ? null
+                : new HashSet<string>(request.VerseIds, StringComparer.Ordinal);
+            return new CultMeshVerseCatalogResponseMessage
+            {
+                MessageId = string.IsNullOrWhiteSpace(request.MessageId)
+                    ? Guid.NewGuid().ToString("N")
+                    : request.MessageId,
+                Verses = catalog.Verses
+                    .Where(verse => verseIds == null || verseIds.Contains(verse.VerseId))
+                    .Where(verse => string.IsNullOrWhiteSpace(request.TransportVersion) ||
+                                    string.Equals(
+                                        verse.Compatibility.TransportVersion,
+                                        request.TransportVersion,
+                                        StringComparison.Ordinal))
+                    .Select(verse => verse.ToMessage())
+                    .ToArray()
+            };
         }
     }
 
@@ -92,24 +154,7 @@ namespace GameCult.Mesh
         /// </summary>
         public CultMeshVerseCatalogResponseMessage CreateResponse(CultMeshVerseCatalogRequestMessage request)
         {
-            if (request == null) throw new ArgumentNullException(nameof(request));
-            var verseIds = request.VerseIds == null || request.VerseIds.Length == 0
-                ? null
-                : new HashSet<string>(request.VerseIds, StringComparer.Ordinal);
-            var verses = _catalog.Verses
-                .Where(verse => verseIds == null || verseIds.Contains(verse.VerseId))
-                .Where(verse => string.IsNullOrWhiteSpace(request.TransportVersion) ||
-                                string.Equals(verse.Compatibility.TransportVersion, request.TransportVersion, StringComparison.Ordinal))
-                .Select(verse => verse.ToMessage())
-                .ToArray();
-
-            return new CultMeshVerseCatalogResponseMessage
-            {
-                MessageId = string.IsNullOrWhiteSpace(request.MessageId)
-                    ? Guid.NewGuid().ToString("N")
-                    : request.MessageId,
-                Verses = verses
-            };
+            return CultMeshVerseMessages.CreateCatalogResponse(_catalog, request);
         }
 
         /// <inheritdoc />
@@ -161,6 +206,30 @@ namespace GameCult.Mesh
         /// Defaults to endpoint selection: rudp:// uses RUDP and cultnet:// uses LiteNetLib.
         /// </summary>
         public Func<ICultNetSchemaClient>? CreateClient { get; set; }
+
+        /// <summary>
+        /// Gets or sets an endpoint-aware client factory for external transport packages.
+        /// When present, this owns discovery transport selection for each exact Odin route.
+        /// </summary>
+        public Func<string, ICultNetSchemaClient>? CreateClientForEndpoint { get; set; }
+
+        /// <summary>Gets or sets the clock that owns discovery deadlines.</summary>
+        public ICultMeshClock Clock { get; set; } = CultMeshSystemClock.Instance;
+
+        /// <summary>Gets or sets the bounded operational diagnostic sink.</summary>
+        public ICultMeshDiagnosticSink Diagnostics { get; set; } = CultMeshNullDiagnosticSink.Instance;
+
+        /// <summary>Gets or sets the identity of this bootstrap lookup source.</summary>
+        public string SourceId { get; set; } = "configured-bootstrap";
+
+        /// <summary>Gets or sets the CultMesh transport contract requested from rendezvous.</summary>
+        public string TransportVersion { get; set; } = "cultmesh.v0";
+
+        /// <summary>Gets or sets how long a successful compatibility observation remains fresh.</summary>
+        public TimeSpan ObservationTtl { get; set; } = TimeSpan.FromMinutes(5);
+
+        /// <summary>Gets or sets the persistent last-known-good discovery store.</summary>
+        public ICultMeshDiscoveryStore? DiscoveryStore { get; set; }
     }
 
     /// <summary>
@@ -169,6 +238,7 @@ namespace GameCult.Mesh
     public sealed class CultMeshVerseDiscoveryClient
     {
         private readonly CultMeshVerseDiscoveryClientOptions _options;
+        private long _diagnosticSequence;
 
         /// <summary>
         /// Creates a Verse discovery client.
@@ -176,6 +246,8 @@ namespace GameCult.Mesh
         public CultMeshVerseDiscoveryClient(CultMeshVerseDiscoveryClientOptions? options = null)
         {
             _options = options ?? new CultMeshVerseDiscoveryClientOptions();
+            if (_options.ObservationTtl <= TimeSpan.Zero)
+                throw new ArgumentOutOfRangeException(nameof(options), "Discovery observation TTL must be greater than zero.");
         }
 
         /// <summary>
@@ -186,7 +258,6 @@ namespace GameCult.Mesh
             CultMeshVerseCatalogRequestMessage? request = null)
         {
             if (string.IsNullOrWhiteSpace(endpoint)) throw new ArgumentException("Value must be non-empty.", nameof(endpoint));
-            var (host, port) = CultNetSchemaWriteForwarder.ParseEndpoint(endpoint);
             var messageId = Guid.NewGuid().ToString("N");
             var completion = new TaskCompletionSource<CultMeshVerseCatalogResponseMessage>(
                 TaskCreationOptions.RunContinuationsAsynchronously);
@@ -202,16 +273,44 @@ namespace GameCult.Mesh
             client.OnCultNet<CultNetErrorMessage>(error =>
                 completion.TrySetException(new InvalidOperationException(error.Error)));
 
-            client.Connect(host, port);
-            await WaitForConnectionAsync(client, endpoint).ConfigureAwait(false);
-            client.SendCultNet(new CultMeshVerseCatalogRequestMessage
+            Emit(CultMeshDiagnosticKind.ConnectionAttempt, messageId, endpoint, "connecting");
+            try
             {
-                MessageId = messageId,
-                TransportVersion = request?.TransportVersion,
-                VerseIds = request?.VerseIds
-            });
+                if (client is ICultNetUriSchemaClient uriClient)
+                    await uriClient.ConnectAsync(new Uri(endpoint)).ConfigureAwait(false);
+                else
+                {
+                    var (host, port) = CultNetSchemaWriteForwarder.ParseEndpoint(endpoint);
+                    client.Connect(host, port);
+                }
+                var backgroundFailure = (client as ICultNetSchemaClientHealth)?.BackgroundFailure;
+                await WaitForConnectionAsync(client, endpoint, backgroundFailure).ConfigureAwait(false);
+                client.SendCultNet(new CultMeshVerseCatalogRequestMessage
+                {
+                    MessageId = messageId,
+                    TransportVersion = request?.TransportVersion,
+                    VerseIds = request?.VerseIds
+                });
 
-            return await WaitForResponseAsync(completion.Task, endpoint).ConfigureAwait(false);
+                var response = await WaitForResponseAsync(completion.Task, endpoint, backgroundFailure).ConfigureAwait(false);
+                Emit(
+                    CultMeshDiagnosticKind.DiscoveryObservation,
+                    messageId,
+                    endpoint,
+                    "fresh",
+                    schemaVersion: response.SchemaVersion);
+                return response;
+            }
+            catch (Exception error) when (!(error is OperationCanceledException))
+            {
+                Emit(
+                    CultMeshDiagnosticKind.CandidateRejected,
+                    messageId,
+                    endpoint,
+                    "unavailable",
+                    ReasonCode(error));
+                throw;
+            }
         }
 
         /// <summary>
@@ -225,46 +324,74 @@ namespace GameCult.Mesh
             if (catalog == null) throw new ArgumentNullException(nameof(catalog));
             if (endpoints == null) throw new ArgumentNullException(nameof(endpoints));
 
-            var count = 0;
-            foreach (var endpoint in endpoints.Where(value => !string.IsNullOrWhiteSpace(value)).Distinct(StringComparer.Ordinal))
-            {
-                var response = await FetchAsync(endpoint, new CultMeshVerseCatalogRequestMessage
+            var eligible = endpoints.Where(value => !string.IsNullOrWhiteSpace(value))
+                .Distinct(StringComparer.Ordinal).OrderBy(value => value, StringComparer.Ordinal).ToArray();
+            if (eligible.Length == 0) return 0;
+            var identity = "compatibility:" + (transportVersion ?? "any") + ":" + string.Join("|", eligible);
+            using var service = new CultMeshDiscoveryService(
+                eligible.Select(endpoint => new CompatibilityLookupSource(this, endpoint, transportVersion)),
+                new CultMeshDiscoveryServiceOptions
                 {
-                    TransportVersion = transportVersion
-                }).ConfigureAwait(false);
-                catalog.Upsert(response);
-                count += response.Verses.Length;
+                    Clock = _options.Clock,
+                    Diagnostics = _options.Diagnostics,
+                    Store = _options.DiscoveryStore
+                });
+            var state = await service.ResolveAsync(new CultMeshDiscoveryQuery(identity)).ConfigureAwait(false);
+            foreach (var candidate in state.Candidates)
+            {
+                catalog.Upsert(candidate.Descriptor);
             }
 
-            return count;
+            return state.Candidates.Count;
         }
 
         private ICultNetSchemaClient CreateClient(string endpoint)
         {
-            return _options.CreateClient?.Invoke()
+            return _options.CreateClientForEndpoint?.Invoke(endpoint)
+                   ?? _options.CreateClient?.Invoke()
                    ?? CultNetSchemaClients.CreateForEndpoint(endpoint, _options.Security, _options.ConfigureClient);
         }
 
-        private async Task WaitForConnectionAsync(ICultNetSchemaClient client, string endpoint)
+        private async Task WaitForConnectionAsync(
+            ICultNetSchemaClient client,
+            string endpoint,
+            Task<Exception>? backgroundFailure)
         {
-            var deadline = DateTimeOffset.UtcNow + _options.ConnectTimeout;
+            var deadline = _options.Clock.UtcNow + _options.ConnectTimeout;
             while (!client.Connected)
             {
-                if (DateTimeOffset.UtcNow >= deadline)
+                if (backgroundFailure?.IsCompleted == true)
+                {
+                    var error = await backgroundFailure.ConfigureAwait(false);
+                    throw new InvalidOperationException(
+                        $"Verse discovery client failed while connecting to {endpoint}.",
+                        error);
+                }
+                if (_options.Clock.UtcNow >= deadline)
                 {
                     throw new TimeoutException($"Timed out connecting to Verse discovery endpoint {endpoint}.");
                 }
 
-                await Task.Delay(TimeSpan.FromMilliseconds(25)).ConfigureAwait(false);
+                await _options.Clock.DelayAsync(TimeSpan.FromMilliseconds(25)).ConfigureAwait(false);
             }
         }
 
         private async Task<CultMeshVerseCatalogResponseMessage> WaitForResponseAsync(
             Task<CultMeshVerseCatalogResponseMessage> responseTask,
-            string endpoint)
+            string endpoint,
+            Task<Exception>? backgroundFailure)
         {
-            var timeoutTask = Task.Delay(_options.ResponseTimeout);
-            var completed = await Task.WhenAny(responseTask, timeoutTask).ConfigureAwait(false);
+            var timeoutTask = _options.Clock.DelayAsync(_options.ResponseTimeout);
+            var completed = backgroundFailure == null
+                ? await Task.WhenAny(responseTask, timeoutTask).ConfigureAwait(false)
+                : await Task.WhenAny(responseTask, timeoutTask, backgroundFailure).ConfigureAwait(false);
+            if (completed == backgroundFailure)
+            {
+                var error = await backgroundFailure.ConfigureAwait(false);
+                throw new InvalidOperationException(
+                    $"Verse discovery client failed while waiting for a response from {endpoint}.",
+                    error);
+            }
             if (completed != responseTask)
             {
                 throw new TimeoutException($"Timed out waiting for Verse discovery response from {endpoint}.");
@@ -272,5 +399,68 @@ namespace GameCult.Mesh
 
             return await responseTask.ConfigureAwait(false);
         }
+
+        private void Emit(
+            CultMeshDiagnosticKind kind,
+            string operationId,
+            string endpoint,
+            string state,
+            string reasonCode = "",
+            string schemaVersion = "")
+        {
+            _options.Diagnostics.Emit(new CultMeshDiagnosticEvent(
+                Interlocked.Increment(ref _diagnosticSequence),
+                _options.Clock.UtcNow,
+                CultMeshReliabilityOrgan.Discovery,
+                kind,
+                operationId,
+                endpoint,
+                state,
+                reasonCode,
+                _options.SourceId,
+                endpoint,
+                schemaVersion));
+        }
+
+        private static string ReasonCode(Exception error)
+        {
+            if (error is TimeoutException) return "timeout";
+            if (error is InvalidOperationException) return "transport_failure";
+            return "lookup_failure";
+        }
+
+        private sealed class CompatibilityLookupSource : ICultMeshLookupSource
+        {
+            private readonly CultMeshVerseDiscoveryClient _owner;
+            private readonly string _endpoint;
+            private readonly string? _transportVersion;
+
+            public CompatibilityLookupSource(CultMeshVerseDiscoveryClient owner, string endpoint, string? transportVersion)
+            {
+                _owner = owner;
+                _endpoint = endpoint;
+                _transportVersion = transportVersion;
+            }
+
+            public string SourceId => _endpoint;
+
+            public async Task<IReadOnlyList<CultMeshDiscoveryObservation>> LookupAsync(
+                CultMeshDiscoveryQuery query,
+                CancellationToken cancellationToken = default)
+            {
+                cancellationToken.ThrowIfCancellationRequested();
+                var response = await _owner.FetchAsync(
+                    _endpoint,
+                    new CultMeshVerseCatalogRequestMessage { TransportVersion = _transportVersion }).ConfigureAwait(false);
+                var observedAt = _owner._options.Clock.UtcNow;
+                return response.Verses.Select(message => new CultMeshDiscoveryObservation(
+                    message.ToVerseDescriptor(),
+                    SourceId,
+                    observedAt,
+                    observedAt + _owner._options.ObservationTtl,
+                    CultMeshDiscoveryTrust.Unsigned,
+                    response.SchemaVersion)).ToArray();
+            }
+        }
     }
 }
diff --git a/src/GameCult.Mesh/GameCult.Mesh.csproj b/src/GameCult.Mesh/GameCult.Mesh.csproj
index c9904d28..898fa54f 100644
--- a/src/GameCult.Mesh/GameCult.Mesh.csproj
+++ b/src/GameCult.Mesh/GameCult.Mesh.csproj
@@ -4,6 +4,7 @@
     <PackageId>GameCult.Mesh</PackageId>
     <PackageTags>game;distributed;realtime;mesh;database;simulation;consensus</PackageTags>
     <PackageReadmeFile>README.md</PackageReadmeFile>
+    <AllowUnsafeBlocks>true</AllowUnsafeBlocks>
   </PropertyGroup>
 
   <ItemGroup>
diff --git a/src/GameCult.Mesh/README.md b/src/GameCult.Mesh/README.md
index 5bd3b1a0..8acb6c9d 100644
--- a/src/GameCult.Mesh/README.md
+++ b/src/GameCult.Mesh/README.md
@@ -18,12 +18,25 @@ simulation observations.
 ## First Node
 
 ```csharp
+using GameCult.Caching;
 using GameCult.Mesh;
+using GameCult.Networking;
 
-using var node = await CultMesh.StartNodeAsync("world.ccmp");
+// CounterState is the typed document defined in the getting-started tutorial.
+var documents = new CultNetDocumentRegistry()
+    .Register(CultNetDocumentBinding.ForDocument<CounterState>());
+using var node = await CultMesh.StartNodeAsync("world.cc", new CultMeshNodeOptions
+{
+    DatabaseOptions = new CultNetDatabaseOptions
+    {
+        RuntimeId = "counter-provider",
+        DocumentRegistry = documents
+    }
+});
 
-var player = await node.Database.GetAsync<PlayerData>(playerKey);
-await node.Database.PutAsync(playerKey, player);
+var key = new CultRecordKey("counter:main");
+await node.Database.PutAsync(key, new CounterState { CounterId = key.Value });
+var counter = await node.Database.GetAsync<CounterState>(key);
 ```
 
 If you want one inspectable path that starts with a durable local cache file and
@@ -32,11 +45,63 @@ ends with a typed read/write through the public CultMesh surface, see
 If you want the lower-level typed-to-raw handoff that CultNet moves across the
 wire, see [docs/typed-document-path.md](docs/typed-document-path.md).
 
+## Eve / CultUI Surfaces
+
+CultMesh supplies the typed state and operation binding descriptors used by Eve.
+The renderer-neutral `GameCult.Eve.Surface` package in the Eve repository owns
+the portable surface document and fluent builder. Add that package when a daemon
+publishes UI; do not add EveUnity to the provider. The emitted document carries
+typed CultMesh operation bindings, state bindings, style tokens, and embedded
+surface slots while remaining independent of any lowering runtime.
+
+```csharp
+using GameCult.Eve.Surface;
+using GameCult.Mesh;
+
+var menu = EveSurface.Create("aetheria.main_menu.root")
+    .Provider("aetheria", "game.menu")
+    .TitleSubtitle("AETHERIA", "TERMINUS")
+    .ButtonColumn("aetheria.main_menu.root.actions", actions => actions
+        .Button("Continue", "aetheria.main_menu.root.continue")
+        .Button("New Game", "aetheria.main_menu.root.new_game")
+        .Button("Settings", "aetheria.main_menu.root.show_settings")
+        .Button("Quit", "aetheria.main_menu.root.quit"))
+    .Style("font.title.family", "Montserrat")
+    .Style("font.body.family", "Ubuntu")
+    .Build();
+```
+
+Forms accept typed CultMesh descriptors at authoring time and flatten them into
+MessagePack-safe Eve records in the document:
+
+```csharp
+var setName = CultMesh.OperationBinding(
+    "settings.player.name.set",
+    "Set Player Name",
+    "gamecult.settings.name.v1");
+
+var playerName = new CultMeshStateBindingDescriptor(
+    "value",
+    "player.settings.name",
+    "global:aetheria.player_settings.v1",
+    "gamecult.aetheria.player_settings.v1");
+
+var settings = EveSurface.Create("aetheria.main_menu.player_settings")
+    .Form("aetheria.main_menu.player_settings.form", form => form
+        .Text("Name", "Meta", setName, playerName))
+    .Build();
+```
+
+Nested UI is expressed with `surface.slot` components and
+`EveEmbeddedDocumentSlot` records. A runtime lowers the parent surface, resolves
+the child document through CultMesh, and renders the embedded document without
+the renderer becoming the owner of that UI.
+
 Enable durable authoritative shard logs when a node should serve replica
 catch-up after restart:
 
 ```csharp
-using var node = await CultMesh.StartNodeAsync("world.ccmp", new CultMeshNodeOptions
+using var node = await CultMesh.StartNodeAsync("world.cc", new CultMeshNodeOptions
 {
     EnableDurableShardLogs = true
 });
@@ -45,6 +110,23 @@ using var node = await CultMesh.StartNodeAsync("world.ccmp", new CultMeshNodeOpt
 If `ShardLogPath` is omitted, CultMesh stores logs beside the cache under
 `world.cultmesh/shard-logs`.
 
+## Distributed CDN
+
+CultMesh can distribute signed, content-addressed game assets through the same
+typed document lane as gameplay state. Asset manifests, chunks, and portable
+entity prefab packages are CultCache documents that can be replicated by
+CultNet snapshots, shard logs, central servers, LAN peers, or opted-out-capable
+internet peer caches.
+
+This is the canonical asset pipeline target for Aetheria. Brokkr-authored
+Blender prefab snapshots deploy into `CultMeshEntityPrefabPackage` documents
+that reference CDN artifact manifests for meshes, textures, materials, and
+other payloads. Unity and TypeScript clients should unpack the same package
+graph rather than maintaining separate Unity-prefab and Electron asset formats.
+
+See [docs/distributed-cdn.md](docs/distributed-cdn.md) for document shapes,
+publish/read helpers, peer asset sharing policy, and the Brokkr prefab flow.
+
 ## Verses
 
 A Verse is a rule-bearing consensus graph. Aetheria Main can be a
@@ -155,16 +237,52 @@ the record.
 
 ```csharp
 var db = node.Database;
+var input = CultMesh.Document<PlayerInput>(db, inputKey, verse);
 
-await db.PutPredictedAsync(inputKey, inputState);
+await input.SubmitPredictionAsync(inputState);
 
-using var sub = db.WatchRecord<PlayerInput>(inputKey)
-    .Subscribe(change =>
+using var sub = input.Watch()
+    .Subscribe(latest =>
     {
-        ReconcilePrediction(change);
+        ReconcilePrediction(latest);
     });
 ```
 
+Read-only CultCache publications can be lifted into the same document handle
+shape without local store plumbing:
+
+```csharp
+var health = CultMesh.DocumentFromSingleFile<DaemonHealth>(
+    "daemon-publication.cc",
+    new CultRecordKey("daemon:aetheria.health.v1"),
+    verse);
+
+using var healthSub = health.Watch().Subscribe(RenderHealth);
+var latestHealth = await health.LatestAsync();
+```
+
+`DocumentFromStore<T>()` accepts any `CacheBackingStore`; both helpers pull,
+decode, resolve persisted schema metadata, and poll for updates behind the
+`CultMeshDocumentHandle<T>` surface.
+Use `DocumentFromPublication<T>()` when the caller should provide a configured
+source instead of branching between local files, backing stores, and remote
+CultNet snapshots itself.
+
+When the remote snapshot should hydrate a local node, use the direct sync
+facade and keep the rest of the code on local typed handles:
+
+```csharp
+var syncedHealth = await CultMesh.SyncDocumentFromPeerSnapshotAsync<DaemonHealthUi>(
+    node,
+    "cultnet://daemon.local:3075",
+    "daemon:aetheria.health.v1",
+    new CultMeshSnapshotEndpointOptions { DocumentRegistry = daemonRegistry });
+
+var localHealth = await node
+    .Document<DaemonHealthUi>("daemon:aetheria.health.v1", verse)
+    .LatestAsync();
+```
+
 ## Game Session
 
 `CultMeshGameSession` wires the common gameplay loop: local catalogs,
@@ -220,6 +338,17 @@ player.Value!.Health = 90;
 await player.CommitAsync();
 ```
 
+Remote publications use the same document handle shape:
+
+```csharp
+var health = CultMesh.DocumentFromPeerSnapshot<DaemonHealthDocument>(
+    "cultnet://daemon.local:3075",
+    "daemon:aetheria.health.v1",
+    verse);
+
+var latest = await health.LatestAsync();
+```
+
 The physical cache table remains SoA for CPU-local scans:
 
 ```csharp
@@ -268,6 +397,52 @@ runtime-native storage: shared D3D12 textures, shared memory rings, platform GPU
 handles, DMA buffers, or paged CultCache fallbacks when a zero-copy transport is
 not available.
 
+For entity SoA and other CPU-visible hot state, subscribe to the exact control
+records and logical bodies the lowerer consumes. The subscription advertises
+the transports the runtime can import; the provider's demand tracker selects
+the cheapest mutually usable representation. A same-machine consumer normally
+receives one shared-memory bootstrap descriptor, then observes later commits
+through the mapped ring header. Per-frame CultNet documents are neither needed
+nor desirable.
+
+The mapped ring uses a named memory map on Windows and a capability-named,
+publisher-owned temporary backing file on Unix. This distinction belongs to
+the CultMesh adapter; providers and consumers use the same descriptor/cursor
+contract on both platforms.
+
+```csharp
+using var entities = await CultMesh.SubscribeLiveBodyAsync(
+    subscriptions,
+    bodyResolver,
+    new CultMeshLiveBodySubscription(
+        "pilot-entities",
+        "eve-unity",
+        "eve:entity-soa:aetheria.daemon:pilot"));
+
+using var input = await subscriptions.SubscribeLiveValueAsync<EveInputCapabilityDocument>(
+    "pilot-input",
+    "eve:input:aetheria.daemon:pilot");
+
+// Open after each descriptor change. CultMesh chooses shared memory, shared-file
+// mapping, or network from observed locality and the resolver's real adapters.
+if (entities.HasValue && input.HasValue)
+{
+    using var frame = entities.OpenCurrentReadOnly().Lease;
+    Present(frame, input.Current);
+}
+```
+
+`CultMeshLiveBody` watches only the small latest-publication record and declares
+the logical body demand. It never routes the body through the subscription
+snapshot. `CultNetLiveValue<T>` does the corresponding job for exact scalar or
+small structured state without creating a renderer-owned replica cache. Both
+subscriptions may begin before the provider's first publication: `HasValue`
+remains false while the retained demand stays active, then the first typed value
+arrives through the normal reactive change path.
+
+Snapshots remain bootstrap and recovery machinery. Reactive document changes
+carry small control state; mapped or negotiated network bodies carry hot data.
+
 ```csharp
 using GameCult.Mesh;
 
@@ -331,5 +506,6 @@ hot frame bodies remain in the cheapest storage both endpoints can share.
 - [Public API](docs/public-api.md)
 - [Durable Node Quickstart](docs/durable-node-quickstart.md)
 - [Typed Document Path](docs/typed-document-path.md)
+- [Distributed CDN Documents](docs/distributed-cdn.md)
 - [Research Notes](docs/research.md)
 - [Verse Model](docs/verses.md)
diff --git a/src/GameCult.Mesh/docs/browser-verse-transport.md b/src/GameCult.Mesh/docs/browser-verse-transport.md
new file mode 100644
index 00000000..fcfde998
--- /dev/null
+++ b/src/GameCult.Mesh/docs/browser-verse-transport.md
@@ -0,0 +1,221 @@
+# Browser Verse Transport Boundary
+
+Date: 2026-08-17
+
+## Status
+
+This is the implementation map for the browser Verse boundary.
+`samples/eve-two-runtime` remains the clean package-consumer/jsdom checkpoint.
+`samples/eve-browser-network` runs a durable C# provider, a real Chromium Eve
+lowerer, an independent C# headless observer, and a separate local Odin fixture
+over binary loopback CultNet WebSocket routes under an explicit
+`local-development` trust policy. It proves one canonical
+command effect, idempotent retry, shared observation, provider restart on a new
+physical route, browser rediscovery, retained lease resubscription, and a second
+canonical command after reconnection.
+
+The current substrate has a browser client boundary and local live proof, but
+not a complete public Verse proof:
+
+- `cultmesh-ts` is a Node package and imports `node:dgram` at its root;
+- `cultnet-ts/contracts` is the browser-safe contract entrypoint; the package
+  root still includes Node transport, filesystem, crypto, stream, and UDP
+  modules and must not enter browser bundles;
+- C# and TypeScript now share `cultnet.database_subscribe.v0`,
+  `cultnet.database_unsubscribe.v0`, and `cultnet.database_change_raw.v0`;
+  `cultmesh-browser` consumes those messages as explicit document leases;
+- `cultmesh-browser` owns stable identity, route refresh, resubscription, and
+  typed operation correlation without exposing direct document writes;
+- `CultMeshBrowserOdinRendezvous` resolves stable Verse/provider identity with
+  `cultmesh.verse_catalog_request.v0` and
+  `cultmesh.verse_catalog_response.v0`; application callbacks no longer need to
+  smuggle provider URLs into the browser client;
+- `CultMeshBrowserClient` owns the final authority gate: remote use requires a
+  consumer-pinned Odin P-256 root, an Odin-signed route certificate, `wss://`,
+  and provider possession proof over a fresh nonce. A catalog source cannot
+  bypass that gate by returning a route-shaped object;
+- Kotlin has a channel-aware WebSocket transport adapter, TypeScript has the
+  browser client, and `GameCult.Networking.WebSockets` provides the bounded C#
+  schema server host adapter;
+- Hermodr can lower Odin state into a browser, but it is an infrastructure
+  runtime, not the clean-consumer game API;
+- the sample's separate local Odin fixture serves the production Verse-catalog
+  contract and is restarted with a changed provider route; the same Chromium
+  client automatically rediscovers that route.
+- the sample validates its surface against Eve's canonical TypeScript contract,
+  but its provider still carries a minimal local C# DTO mirror. The
+  released-artifact gate requires the renderer-neutral C# Eve surface contract
+  as an independently consumable Eve artifact; Unity must not be that contract's
+  package owner.
+
+## Authority Map
+
+Owner:
+
+- CultNet owns binary WebSocket framing and schema-v0 message validation.
+- CultMesh owns stable Verse/provider identity, document leases,
+  subscriptions, route replacement, and command/receipt correlation.
+- Odin owns discovery of the current `wss://` candidate for a stable Verse and
+  provider identity.
+- The provider daemon owns application state, operations, receipts, and the Eve
+  surface.
+- Eve owns surface and command contracts; the browser lowerer owns DOM only.
+
+Inputs:
+
+- an Odin-discovered route certificate and consumer-configured Odin root;
+- stable Verse and provider identities;
+- provider key possession over a fresh client nonce;
+- requested schema ids and record keys;
+- typed operation invocations and idempotency keys;
+- canonical CultNet schema-v0 MessagePack messages.
+
+Outputs:
+
+- leased typed document snapshots and live changes;
+- typed operation receipts;
+- explicit connection/session diagnostics;
+- deterministic unsubscribe and disposal;
+- route replacement without changing provider or document identity.
+
+Derived state:
+
+- browser caches, DOM trees, loading/error presentation, and optimistic visual
+  affordances are projections only;
+- a socket URL is a disposable discovery candidate, never provider identity;
+- reconnect status is observable session state, not application truth.
+
+Forbidden writers:
+
+- browser lowerers cannot mutate provider documents directly;
+- Hermodr, service workers, renderer caches, and app-specific HTTP endpoints
+  cannot become alternate gameplay authorities;
+- no JSON polling API may mirror the database as a second state system;
+- `node:dgram`, Node streams, filesystem stores, and Node crypto cannot enter a
+  browser bundle;
+- a late socket, stale subscription generation, or reconnect replay cannot
+  overwrite a newer session;
+- application code cannot own reconnect sleeps, endpoint ranking, or
+  resubscription loops.
+
+Shared paths:
+
+- initial load, live update, reconnect, tab background/resume, command retry,
+  and provider route rotation all use one CultMesh document-lease/session path;
+- browser, Unity, headless C#, and future native clients consume the same
+  provider-owned documents and receipts;
+- every command crosses the same typed operation boundary regardless of which
+  Eve lowerer emitted it.
+
+Deletion line:
+
+- the jsdom checkpoint remains labeled as a Node-hosted DOM proof;
+- browser applications import `cultmesh-browser` and
+  `cultnet-ts/contracts`, never the Node-only package roots;
+- subscription messages remain one shared schema contract across the C# and
+  TypeScript catalogs;
+- the real provider adapter must consume the canonical WebSocket message lane;
+  no sample-only WebSocket protocol is permitted.
+
+## Required Runtime Shape
+
+The browser-facing package must be importable by a standards-mode browser or a
+normal bundler without Node polyfills. It exposes a narrow API shaped like:
+
+```ts
+const mesh = await CultMeshBrowserClient.connect({
+  rendezvous: odin,
+  verseId: "sample.counter",
+  providerId: "sample.counter-provider",
+  runtimeId: "sample.browser",
+});
+
+using surface = await mesh.leaseRawDocument({
+  schemaId: "gamecult.eve.surface.v1",
+  recordKey: "eve:surface:counter",
+});
+surface.watch(record => render(decodeCultNetPayload(record)));
+
+const receipt = await mesh.invoke({
+  serviceId: "sample.counter",
+  operation: "increment",
+  payloadSchema: "sample.increment.v1",
+  payload: {},
+  idempotencyKey: crypto.randomUUID(),
+});
+```
+
+The names are illustrative. The ownership is not: application code supplies
+identity and intent; CultMesh owns route/session continuity; the provider owns
+the result.
+
+## Wire Contract
+
+WebSocket carries binary MessagePack CultNet schema-v0 messages. The first
+implementation must support:
+
+- `cultnet.hello.v0`;
+- authentication/session verification;
+- `cultnet.snapshot_request.v0` and
+  `cultnet.snapshot_response_raw.v0`;
+- `cultnet.database_subscribe.v0`,
+  `cultnet.database_unsubscribe.v0`, and
+  `cultnet.database_change_raw.v0`;
+- `cultnet.operation_request.v0` and
+  `cultnet.operation_response.v0`;
+- `cultmesh.verse_catalog_request.v0` and
+  `cultmesh.verse_catalog_response.v0` on the Odin route;
+- `cultnet.error.v0`.
+
+The WebSocket frame is a transport body, not a second message schema. Payload
+size, queue depth, subscription count, and command rate are bounded. Schema,
+identity, authority, and idempotency validation happen before provider code.
+
+## Acceptance Gate
+
+Current executable coverage from `scripts/verify-eve-browser-network.mjs`:
+
+- authenticated binary C# WebSocket provider;
+- separate local Odin fixture using the canonical Verse-catalog messages;
+- real Chromium and retained C# headless consumers, both discovered through
+  the same Odin identity;
+- shared surface and counter document leases;
+- Eve button to typed operation to provider receipt to shared state;
+- duplicate idempotency key produces one effect;
+- provider restart on a different physical port rehydrates the `.cc` state;
+- the retained browser lease rediscovers through Odin and resubscribes;
+- the retained C# client independently rediscovers, resubscribes, invokes the
+  second command through `CultMeshClient.InvokeAsync`, and receives the
+  provider-authored receipt without application transport or reconnect code;
+- Chromium observes the C# command's canonical state and receipt chronology;
+- 10,000 typed no-op operations traverse the retained C# WebSocket session;
+  the gate records throughput, p99, post-GC managed growth, and private-memory
+  movement without growing provider state;
+- generated browser bundle contains no `node:` builtin import.
+
+The full public Verse gate still requires the deployed Odin daemon rather than
+the local contract fixture and released-artifact-only .NET consumption. The
+source-contract gate runs on Windows and Linux CI.
+
+From an empty temporary consumer using packed/released artifacts only:
+
+1. start a provider daemon with one durable counter document and one validated
+   Eve surface;
+2. advertise it by stable identity through a local Odin fixture or real Odin;
+3. connect one real Chromium page and one C# headless client;
+4. lease the same surface and counter document in both runtimes;
+5. click the browser button and require one provider-authored canonical receipt;
+6. observe the same state version and receipt id in both clients;
+7. disconnect or rotate the physical WebSocket endpoint, then require both
+   leases to resume without application reconnect code;
+8. invoke from C# after route replacement and require Chromium to observe the
+   same provider-authored state and receipt;
+9. restart the provider and prove state plus receipt persistence;
+10. run a non-persistent operation workload long enough to falsify retained
+   callback or managed-heap growth;
+11. reject malformed schemas, direct document writes, duplicate command
+   effects, stale subscription generations, and unsupported authority;
+12. inspect the browser bundle and fail if it contains Node builtin imports.
+
+The gate runs on Windows and Linux. A screenshot is useful presentation
+evidence, but the receipt/state chronology is the authority proof.
diff --git a/src/GameCult.Mesh/docs/content-sessions.md b/src/GameCult.Mesh/docs/content-sessions.md
new file mode 100644
index 00000000..313a21cf
--- /dev/null
+++ b/src/GameCult.Mesh/docs/content-sessions.md
@@ -0,0 +1,63 @@
+# CultMesh content sessions
+
+Large immutable artifacts use CultMesh content sessions. Typed snapshots carry
+manifests, body descriptors, leases, and progress; they do not carry artifact
+payloads.
+
+The provider attaches one generic content server to its existing CultNet
+schema host:
+
+```csharp
+using var content = new CultMeshContentServer(schemaServer, providerCache);
+```
+
+The consumer creates a provider over its existing identity-first session
+manager, then gives that provider to the transfer owner:
+
+```csharp
+var target = new CultMeshSessionTarget(
+    "aetheria.public",
+    "service:aetheria.daemon");
+var provider = mesh.ContentProvider(
+    "aetheria.daemon",
+    target);
+
+var transfer = new CultMeshContentTransferService(
+    transferStateCache,
+    new[] { provider },
+    new CultMeshContentTransferOptions(cacheDirectory));
+
+var verifiedBodyPath = await transfer.FetchAsync(manifest, cancellationToken);
+```
+
+`CultMeshContentTransferService` remains the only owner of verified partial
+state and final cache promotion. It validates each chunk, resumes durable work,
+verifies the complete SHA-256 identity, and atomically publishes
+`<content-hash>.body`. The session provider owns no cache truth and does not
+implement a second retry, failover, or promotion policy.
+
+For local consumers, configure `CultMeshVerifiedBodyMappingBroker` and call
+`FetchMappedContentAsync`. The result binds the transfer owner's verified path
+to the mapped descriptor, so consumers do not infer cache filenames. The older
+`FetchMappedBodyAsync` shape delegates to the same owner when only the
+descriptor is needed. Mapping failure remains observable and falls back through
+the equivalent network descriptor without changing logical identity.
+
+The content protocol uses one bounded response per manifest chunk. A snapshot
+response containing `gamecult.mesh.cdn_artifact_chunk.v1` payload records is a
+legacy transport path and must not be used for bulk delivery.
+
+The transfer owner may keep a bounded window of requests in flight per content
+hash (four by default, never more than 32). Candidate chunks can arrive out of
+order, but only the transfer owner writes them, and it flushes and checkpoints
+them in manifest-offset order. If one request fails, the owner observes the
+rest of that window before returning; fetched-but-uncommitted bytes never become
+trusted resume state. Concurrent artifacts have independent windows.
+
+RUDP schema hosts drain immediately available transport work with
+`PollAvailableAsync`, and the managed schema client pump applies the same
+bounded-drain rule. Transport packets, including fragments, ACKs, and connection
+traffic, count as progress without impersonating an application message or
+paying one operating-system scheduler delay per packet. Reliable sends are
+paced in one 32-packet acknowledgement window rather than one fragment at a
+time.
diff --git a/src/GameCult.Mesh/docs/cross-runtime-primitives-roadmap.md b/src/GameCult.Mesh/docs/cross-runtime-primitives-roadmap.md
new file mode 100644
index 00000000..93fb3f3c
--- /dev/null
+++ b/src/GameCult.Mesh/docs/cross-runtime-primitives-roadmap.md
@@ -0,0 +1,298 @@
+# CultMesh Cross-Runtime Primitives Roadmap
+
+CultMesh should feel like a cozy typed runtime, not a transport kit with good
+manners. Application code should read as native state and native operations in
+every runtime, while CultMesh chooses the fastest valid path: in-process,
+shared memory, IPC, network, or WASM.
+
+In this roadmap, "primitive" does not mean "tiny DTO" or local convenience
+wrapper. It means a reusable cross-runtime developer affordance promoted into
+the shared library layer: the abstraction, metadata, generated bindings,
+runtime routing, diagnostics, and fast path that make an obvious state operation
+feel native everywhere. A `Rect` value is a primitive; so is a typed viewport
+query surface that can execute against an in-process daemon, a shared CultCache
+slab, a remote Verse peer, or a browser/WASM host without changing the caller's
+API.
+
+This roadmap is the shared-layer backlog for abstractions that Aetheria,
+Brokkr, Odin, Eve, Bifrost, Unity, Electron, Rust, and browser clients should
+all be able to use without cloning local facade code.
+
+## Design Rule
+
+If two runtimes need the same semantic shape, hoist it into CultMesh or the
+adjacent CultLib foundation layer. Do not leave it as an Aetheria-only wrapper,
+an Electron preload convention, a Unity bridge helper, or an MCP-specific
+adapter.
+
+CultMesh should be expansive enough to absorb repeated developer-experience
+patterns, not just repeated serialization shapes. When Aetheria, Brokkr, Odin,
+Bifrost, Eve, Ymir, VoidBot, Unity, TS, Rust, or browser clients all want the
+same kind of state pointer, operation, query, watch, authority claim, native
+view, or surface binding, that is evidence of a missing shared primitive. The
+domain package keeps the nouns and policy; CultMesh owns the managed, cozy
+machinery that makes those nouns feel magical and run very fast.
+
+The application layer may name domain operations:
+
+```ts
+await verse.aetheria.zone(zoneId).pilot(entityId).move(CultMesh.vec2(1, 0));
+```
+
+The shared layer must own the reusable primitives that make that sugar possible:
+typed state pointers, operation handles, query surfaces, authority claims,
+projection recipes, native slab descriptors, watches, and generated binding
+metadata.
+
+The test is whether a downstream runtime can say the domain thing directly. If
+the caller has to remember record keys, schema ids, MessagePack slots, endpoint
+paths, IPC channel names, local publication files, cache filenames, queue names,
+or whether the target is local/remote/WASM, the shared primitive is not cozy
+enough yet.
+
+## Managed Magic Contract
+
+Every promoted primitive should carry both a high-level developer promise and a
+low-level performance promise:
+
+| Promise | Requirement |
+| --- | --- |
+| Native-feeling API | Public calls look like typed domain state, operations, queries, or views rather than transport instructions. |
+| One semantic surface | C#, TypeScript, Rust, browser/WASM, Unity, Eve/CultUI, and tool runtimes use the same conceptual API even when adapters differ. |
+| Fastest valid route | The runtime can choose in-process calls, shared slabs, IPC, RUDP/network, copied snapshots, or WASM views without creating a second application API. |
+| Typed safety | State, operation payloads, query parameters, results, authority claims, receipts, and view columns are generated or strongly typed. |
+| Reactive by default | Values that can change expose watch/subscription semantics with explicit lifetime and backpressure behavior. |
+| Inspectable | Diagnostics can explain the chosen route, authority decision, schema version, cache source, native handle, and copy/fallback cost. |
+| Portable fallback | Remote or browser clients keep the same semantic surface when zero-copy locality is unavailable. |
+
+## Primitive Families
+
+| Primitive family | Shared responsibility | First consumers |
+| --- | --- | --- |
+| Typed state pointer | A stable typed reference to Verse state that can resolve, watch, and be embedded in Eve/CultUI surfaces. | Eve, Bifrost MCP, Unity inspectors, RTS panels |
+| State binding descriptor | Surface metadata that binds a UI/tool prop to a typed CultMesh state pointer with source schema and route hints. | Eve/CultUI, Bifrost MCP, Unity inspectors, RTS status panels |
+| Typed operation handle | Method-shaped invocation with typed request/response, authority claims, idempotency, route hints, and receipts. | Aetheria pilot/commander verbs, Brokkr editor tools |
+| Operation binding descriptor | Surface metadata that binds a UI/tool command to a typed CultMesh operation id with request schema and route hints. | Eve/CultUI, Bifrost MCP, Unity controls, RTS command panels |
+| Operation invocation descriptor | Concrete UI/tool invocation metadata that preserves operation id, request schema, route hints, and idempotency across renderer boundaries. | Eve/CultUI lowerers, Unity UI Toolkit, RTS panels, Bifrost tools |
+| Operation payload | Shared invocation field bag with typed scalar readers, copy-on-write updates, and legacy string-field ingestion while generated request schemas take over. | Eve/CultUI lowerers, Unity UI Toolkit, RTS panels, Bifrost tools |
+| Typed query surface | Derived-state query with typed parameters and result, callable locally or remotely without exposing transport. | Aetheria objects/gravity/selection/inventory viewports |
+| Projection recipe | Declarative composition of typed documents into a named local projection, cacheable and watchable by clients. | Unity render shell, Electron RTS map, browser CultMesh-only clients |
+| Authority scope | Runtime claim, lease, witness, or delegated simulation ownership expressed as typed policy state. | Trusted co-op, future quorum/witness modes |
+| Native slice view | Typed SoA/slab view descriptors that map to Unity `NativeArray<T>`, Rust slices, C# spans, or browser typed arrays. | Aetheria render state, Ymir physics state |
+| Schema-generated binding | Cross-runtime generated metadata for document slots, enum ids, schema ids, and ergonomic method surfaces. | C#, TypeScript, Rust, WASM |
+| Reactive watch | Subscription primitive over typed documents, pointers, queries, and native views with disposal/backpressure semantics. | CultUI, Unity presentation caches, RTS status panels |
+| Managed Verse context | Shared `verse.use(schema)` binding context carrying runtime id, route hints, and authority claims into generated domain operations and queries. | Unity client, RTS client, browser-only CultMesh clients, Rust rebuild |
+| Verse-bound surface | Operation, query, and live-feed handles bound once to a Verse context so generated facades call domain methods without repeatedly materializing transport contexts. | Aetheria RTS facade, Unity facade generation, Rust/WASM bindings |
+| Schema-stamped cache recovery | Directory-backed CultCache records may recover missing hot-manifest catalog entries from schema-version metadata embedded in the cold payload, then resolve by shared schema name. | Aetheria persisted Verse state, long-lived daemon stores, editor/runtime co-deployment |
+
+## Required Sugar Shape
+
+The shared primitives should let domain packages expose APIs that look like
+state, not transport.
+
+TypeScript target:
+
+```ts
+const verse = await CultMesh.connectVerse("starbridge");
+const aetheria = verse.use(Aetheria);
+
+const viewport = await aetheria.zone(zoneId)
+  .objects()
+  .visibleTo(controlledUnits)
+  .within(CultMesh.rectFromBounds(-400, -250, 400, 250))
+  .query();
+
+await aetheria.entity(ravenId)
+  .pilot()
+  .move(CultMesh.vec2(1, 0), { claim: "pilot-control" });
+```
+
+C# target:
+
+```csharp
+var verse = await CultMesh.ConnectVerseAsync("starbridge");
+var aetheria = verse.Use(AetheriaRuntime.Schema);
+
+var viewport = await aetheria.Zone(zoneId)
+    .Objects()
+    .VisibleTo(controlledUnits)
+    .Within(CultRect.FromBounds(-400, -250, 400, 250))
+    .QueryAsync();
+
+await aetheria.Entity(ravenId)
+    .Pilot()
+    .MoveAsync(CultVec2.Right, claim: "pilot-control");
+```
+
+Current seed:
+
+```csharp
+var verse = await CultMesh.ConnectVerseAsync(
+    "starbridge",
+    "unity-raven",
+    new CultMeshRouteHint(CultMeshLocalityKind.SharedMemory, "co-located Verse"),
+    new[] { new CultMeshAuthorityClaim("pilot-control", shardId: "zone:raven") });
+
+var aetheria = verse.Use(context => new AetheriaGeneratedFacade(context));
+await aetheria.Entity(ravenId).Pilot.MoveAsync(CultVec2.Right);
+```
+
+```ts
+const verse = await CultMesh.connectVerse("starbridge", "browser-starfire", {
+  routeHint: CultMesh.routeHint("network", "remote Verse peer"),
+  claims: [CultMesh.authorityClaim("commander-control", { shardId: "zone:frontier" })],
+});
+
+const aetheria = verse.use((context) => new AetheriaGeneratedFacade(context));
+await aetheria.entity(ravenId).pilot.move(CultMesh.vec2(1, 0));
+```
+
+Generated facades should split Verse views by locality and bind surfaces once:
+
+```ts
+const queryVerse = verse.withRoute("shared-memory", statePath);
+const commandVerse = verse
+  .withRoute("network", endpoint)
+  .withClaim("commander-control", { shardId: "aetheria.local" });
+
+const objectsViewport = CultMesh.bindQuery(queryVerse, queries.objectsViewport);
+const setMoveVector = CultMesh.bindOperation(commandVerse, operations.setMoveVector);
+
+await objectsViewport.execute(viewport);
+await setMoveVector.invoke({ actorEntityKey, directionX: 1, directionY: 0 });
+```
+
+That seed is intentionally context-only. Discovery, authority negotiation,
+transport selection, native slabs, and WASM adapters can grow behind the same
+Verse handle without forcing Unity, Electron, browser, or Rust clients to learn
+a second public API.
+
+Rust/WASM target:
+
+```rust
+let verse = CultMesh::connect_verse("starbridge").await?;
+let aetheria = verse.use_schema(aetheria::schema());
+
+let viewport = aetheria
+    .zone(zone_id)
+    .objects()
+    .visible_to(&controlled_units)
+    .within(CultRect::from_bounds(-400.0, -250.0, 400.0, 250.0))
+    .query()
+    .await?;
+```
+
+These examples are intentionally aspirational. They are the shape the primitive
+families must support; Aetheria should not keep bespoke client facades once the
+shared layer can express the same semantics.
+
+## Staged Build
+
+1. Stabilize handle descriptors.
+   `CultMeshStatePointer<T>`, `CultMeshOperationHandle<TRequest, TResponse>`,
+   `CultMeshQuerySurface<TParameters, TResult>`,
+   `CultMeshProjectionRecipe<TParameters, TResult>`, `CultMeshRouteHint`, and
+   `CultMeshNativeSliceViewDescriptor` are the current seed. Keep them small,
+   serializable where useful, and mirrored across C# and TypeScript. Bound
+   operation, query, and live-feed wrappers are the first managed layer above
+   those descriptors; generated facades should prefer them over ad hoc
+   `OperationContext` / `QueryContext` plumbing.
+
+2. Add generated binding descriptors.
+   Domain packages should generate schema ids, slots, enum ids, state pointer
+   factories, query handles, and operation handles from the same source
+   contract. Hand-entered MessagePack slot maps are compatibility debt.
+
+3. Grow projection recipes.
+   The seed now names source state, route hints, projection execution, and
+   query-surface conversion. Next it should add generated source handles, local
+   cache keys, invalidation/watch behavior, and native-view output where
+   applicable. This turns Aetheria `ObjectsViewport`, `GravityViewport`,
+   selection, inventory, stats, station stock, and authority status into
+   portable CultMesh surfaces.
+
+4. Add transparent state refs for UI runtimes.
+   Eve/CultUI surfaces may carry a typed `CultMeshStatePointer<T>` instead of a
+   JSON blob or string state ref. The UI runtime resolves and watches it using
+   the local Verse node, with Bifrost/Odin using the same pointer semantics for
+   MCP tools. State pointers now carry route hints and typed source metadata in
+   both C# and TypeScript, so a surface catalog can advertise where a pointer
+   resolves and which schema-backed document/source it depends on instead of
+   leaking daemon-specific resolver conventions. They also bind to a Verse like
+   operations, queries, and live feeds: `CultMesh.StatePointer(...)` /
+   `CultMesh.statePointer(...)` create pointers, and
+   `CultMesh.bindStatePointer(...)` / `verse.BindStatePointer(...)` produce a
+   bound pointer that resolves and watches through the Verse query context
+   instead of requiring UI or tool hosts to rebuild runtime-id and route
+   plumbing. Mutable document-style handles use the same shared shape:
+   `CultMeshMutableStatePointer<T>` / `CultMesh.mutableStatePointer(...)`
+   add typed replacement to the read/watch state pointer contract so tools,
+   editor surfaces, and authorized clients do not grow private
+   `Document<T>` wrappers. `CultMeshStateBindingDescriptor` / `CultMesh.stateBinding(...)`
+   now hoists the repeatable "component prop -> state pointer" shape into the
+   shared layer, including pointer id, source id, schema id, and route hint.
+   Eve documents, Unity inspectors, browser panels, and Bifrost tools should
+   carry this descriptor instead of inventing local `stateRef` string props.
+   `CultMeshOperationBindingDescriptor` / `CultMesh.operationBinding(...)`
+   applies the same rule to controls: a UI command advertises a typed operation
+   id, optional request schema, label, and route hint instead of making
+   `command` and `transport` strings the canonical API.
+
+5. Add native slab adapters.
+   `CultMeshNativeSliceViewDescriptor` must map to Unity `NativeArray<T>`, C#
+   `ReadOnlySpan<T>`, Rust slices, and TS typed arrays where locality permits.
+   The descriptor names the column and value type; runtime adapters own handles,
+   fences, and unavoidable copy accounting.
+
+6. Add authority-aware routing.
+   Operation/query invocation should accept authority claims and route hints,
+   then choose local, shared-memory, IPC, network, or WASM execution without
+   exposing a second public API for each route.
+
+7. Add cross-runtime conformance tests.
+   The same primitive examples must pass in C# and TypeScript first, then Rust.
+   Aetheria client tests should assert against these shared primitives rather
+   than against private Unity/Electron bridges.
+
+8. Harden durable cache ergonomics.
+   Directory-backed CultCache stores should behave like managed state, not
+   fragile manifest bookkeeping. A missing catalog entry in the hot manifest
+   must not strand a readable cold record when the payload carries a schema
+   version. The C# directory store now infers a minimal catalog entry from a
+   schema-stamped payload and resolves by schema name, with regression coverage
+   in `GameCult.Caching.Tests`. The TypeScript and Rust single-file MessagePack
+   stores now perform the same schema-stamped recovery at the snapshot boundary,
+   and both cache runtimes normalize recovered schema-name envelopes back to the
+   registered public document type before hydration. Python now mirrors the
+   same managed recovery path for stores and raw CultNet replication helpers,
+   and the TypeScript inspector reports recovered schema names instead of
+   leaking stale manifest ids. Keep this parity intact before relying on
+   long-lived cross-runtime Verse stores.
+
+## Aetheria Pressure Tests
+
+Aetheria should exercise the roadmap in this order:
+
+1. Sector map and Starbridge session summary as typed state pointers.
+2. Objects/gravity viewport split as typed query surfaces.
+3. Selected object, inventory, station stock, and current stats as projection
+   recipes.
+4. Pilot movement, targeting, equipment activation, docking, repair, cooling,
+   salvage, and commander verbs as typed operation handles.
+5. Zone render and Ymir physics views as native slice descriptors.
+6. Eve/CultUI panels that embed state pointers and operation handles instead of
+   local payload maps.
+7. Unity and RTS clients consuming the same generated domain sugar.
+
+## Stop Lines
+
+- Do not add new public Aetheria command facades unless they can be expressed as
+  typed CultMesh operation handles.
+- Do not add new viewport APIs unless they can be expressed as typed CultMesh
+  query surfaces or projection recipes.
+- Do not add new UI state-ref strings when a typed state pointer would express
+  the same thing.
+- Do not add native memory sharing as a Unity-only bridge; describe the slab in
+  CultMesh and let Unity be one adapter.
+- Do not accept runtime parity by convention. C#, TypeScript, and Rust need
+  shared generated contracts or explicit conformance tests.
diff --git a/src/GameCult.Mesh/docs/distributed-cdn.md b/src/GameCult.Mesh/docs/distributed-cdn.md
new file mode 100644
index 00000000..85acfb31
--- /dev/null
+++ b/src/GameCult.Mesh/docs/distributed-cdn.md
@@ -0,0 +1,191 @@
+# Distributed CDN Documents
+
+CultMesh CDN artifacts use typed CultCache storage and a separate managed
+content-delivery session. Manifests may travel through snapshots or shard logs;
+artifact payload chunks remain in provider storage and cross the network through
+`cultmesh.content.v1`. Unity, TypeScript, and other runtimes consume the same
+manifest and verification contract without making snapshots a bulk byte lane.
+
+This is the canonical path for moving Aetheria assets into CultLib. Starbridge
+Unity and Starbridge Electron should consume the same records so UI textures,
+map icons, environment layers, shaders, and build payloads do not fork by
+client.
+
+## Feature Overview
+
+The CDN feature has four layers:
+
+1. `CultMeshCdnArtifactManifest` describes one versioned payload.
+2. `CultMeshCdnArtifactChunk` stores content-addressed payload bytes.
+3. `CultMeshEntityPrefabPackage` describes a portable entity/prefab graph and
+   references CDN artifact manifests for meshes, textures, materials, animation,
+   audio, or other runtime payloads.
+4. Mesh asset sharing moves those signed manifests and chunks through central
+   servers, LAN peers, or internet peers without granting peers authority over
+   game state.
+
+This is not a Unity asset bundle system and not a raw FBX distribution system.
+Blender is the authoring ground truth for entity prefabs. Brokkr can mirror a
+legacy Unity prefab into Blender for migration, but the deployed CDN artifact is
+the Brokkr/Blender-authored snapshot lowered into CultMesh documents.
+
+Typical flow:
+
+1. Unity publishes a one-time `brokkr.unity.prefab_mirror_snapshot.v0` for an
+   existing prefab.
+2. Brokkr Blender imports that snapshot into a collection so artists can
+   configure renderable entity requirements in Blender.
+3. Brokkr Blender publishes a `brokkr.prefab.snapshot.v0` deploy snapshot from
+   the collection.
+4. A deployer packages referenced meshes, textures, and materials as CDN
+   artifacts.
+5. The deployer writes a `CultMeshEntityPrefabPackage` that references those CDN
+   artifact manifests.
+6. Unity, TypeScript, and later clients fetch the same package and lower it into
+   their runtime entity/component model.
+
+## Document Shape
+
+`CultMeshCdnArtifactManifest` is the versioned asset handle. It carries:
+
+- `ArtifactId`: logical id, such as `aetheria/ui/icons/minimap`.
+- `Kind`: `asset`, `build`, or `package`.
+- `Version`: caller-defined release or content version.
+- `ContentHash`: SHA-256 of the full materialized payload.
+- `SizeBytes`: full payload size.
+- `MimeType`: byte interpretation hint.
+- `Chunks`: ordered `CultMeshCdnChunkRef` placements.
+- `Tags` and `Metadata`: routing and domain hints.
+
+`CultMeshCdnArtifactChunk` is content-addressed by SHA-256. It carries only the
+chunk hash, byte count, and raw payload. Placement is deliberately in the
+manifest reference, so equal chunk bytes can be reused across assets and build
+updates.
+
+## Runtime Contract
+
+Clients should:
+
+1. Fetch or receive a manifest by record key, tag, or index.
+2. Give it to `CultMeshContentTransferService` with one or more content providers.
+3. Let that owner request missing chunks through managed content sessions.
+4. Use only the atomically promoted `<content-hash>.body` returned after chunk
+   and full-body verification.
+5. Interpret bytes according to `MimeType` plus domain metadata.
+
+Single-channel data stays single-channel. For example, a gravity map can use
+raw bytes with metadata such as `channels=r32` instead of pretending to be an
+RGBA texture.
+
+## Mesh Asset Sharing Policy
+
+CultMesh asset distribution is allowed to use installed clients as a peer asset
+cache because Aetheria cannot assume enough central infrastructure to serve all
+game files authoritatively. This must be visible to players and configurable in
+the client, but the initial product policy is opt-out rather than opt-in.
+
+The default policy should be:
+
+- Local cache is always enabled.
+- LAN asset sharing is enabled by default.
+- Internet peer asset sharing is enabled by default for signed asset chunks and
+  prefab packages.
+- Executable or build-update seeding is disabled by default until the UX and
+  signing story is mature.
+- Uploading is disabled or heavily throttled during gameplay.
+- Uploading has conservative default rate and daily caps.
+- Metered, cellular, battery-constrained, VPN, or corporate-network cases should
+  disable or throttle peer upload when detectable.
+- The client must expose a clear `Do not upload game assets to other players`
+  control.
+- The client must expose telemetry: cache size, current upload/download rate,
+  bytes served to peers, and bytes received from peers.
+
+Suggested runtime configuration:
+
+```csharp
+var policy = new MeshAssetSharingPolicy
+{
+    EnabledByDefault = true,
+    AllowLanPeers = true,
+    AllowInternetPeers = true,
+    AllowBuildArtifacts = false,
+    DisableDuringGameplay = true,
+    DisableOnMeteredNetwork = true,
+    RequireSignedManifests = true,
+    ShowStatusTelemetry = true
+};
+```
+
+Peers are never trusted as authority. They only serve bytes. Every chunk is
+content-addressed, every artifact is reconstructed from a manifest, and game
+clients must verify hashes and signatures before using the result.
+
+## C# Publishing
+
+```csharp
+var artifact = CultMesh.PackCdnArtifact(
+    "aetheria/environment/gravity/ragnarok",
+    gravityBytes,
+    new CultMeshCdnPackOptions
+    {
+        Kind = CultMeshCdnArtifactKinds.Asset,
+        Version = "2026.06.27",
+        MimeType = "application/octet-stream",
+        Tags = ["aetheria", "environment", "gravity"],
+        Metadata =
+        {
+            ["channels"] = "r32",
+            ["width"] = "1024",
+            ["height"] = "1024"
+        }
+    });
+
+await CultMesh.PublishCdnArtifactAsync(node.Cache, artifact);
+```
+
+For build distribution, use the same API with `Kind = CultMeshCdnArtifactKinds.Build`
+and metadata such as `platform=windows-x64` or `channel=internal`.
+
+## CultNet Publication And Delivery
+
+Publish manifests and chunks into the provider cache:
+
+```csharp
+await CultMesh.PublishCdnArtifactAsync(providerCache, artifact);
+using var contentServer = new CultMeshContentServer(schemaServer, providerCache);
+```
+
+Snapshots may publish the manifest record, catalog, and body-control documents.
+They must not publish `CultMeshCdnArtifactChunk` payload records for bulk
+delivery. Consumers use `CultMeshSessionContentProvider` and
+`CultMeshContentTransferService`; C# remains the reference implementation for
+record keys, hashing, resumability, and atomic promotion.
+
+## Entity Prefabs
+
+Entity prefabs are distributed as Brokkr-authored snapshots, then deployed into
+portable CultMesh prefab packages. Brokkr's Blender UI publishes
+`brokkr.prefab.snapshot.v0` records for a collection-scoped prefab. A deployer
+can consume that snapshot, publish meshes/textures/material payloads as CDN
+artifacts, and write a `CultMeshEntityPrefabPackage` that references those
+artifact manifests.
+
+That keeps Blender as the authoring ground truth while avoiding Unity prefab
+files as the interchange format. Unity, TypeScript, and later runtimes unpack
+the same package graph into their native entity/component model.
+
+## Client Responsibilities
+
+Unity and TypeScript clients should implement the same rules:
+
+- Fetch prefab packages by record key, tag, or version catalog.
+- Fetch every referenced artifact manifest, then delegate payload transfer to
+  the generic content-transfer owner.
+- Verify signed manifests before trusting package membership.
+- Verify chunk hashes and full artifact hashes before import.
+- Cache artifacts locally by content hash.
+- Lower package nodes into local runtime objects without writing back Unity-owned
+  or Electron-owned prefab truth.
+- Respect `MeshAssetSharingPolicy` for peer upload, status telemetry, and
+  opt-out behavior.
diff --git a/src/GameCult.Mesh/docs/document-write-authority.md b/src/GameCult.Mesh/docs/document-write-authority.md
new file mode 100644
index 00000000..0d8d8a68
--- /dev/null
+++ b/src/GameCult.Mesh/docs/document-write-authority.md
@@ -0,0 +1,86 @@
+# CultMesh Document Write Authority
+
+CultMesh document reads, authoritative replacements, and client predictions are
+different capabilities. A generic setter cannot choose between them without
+hiding an authority decision from the caller.
+
+## Authority map
+
+Owner:
+
+- `CultMeshDocumentHandle<T>` owns typed snapshot and watch access;
+- an authoritative writer owns canonical replacement capability;
+- a prediction writer owns candidate/prediction submission capability;
+- `CultMeshReactiveDocument<T>` owns only a local editable mirror and its
+  coalescing schedule.
+
+Inputs:
+
+- a bound typed live feed;
+- an optional authoritative replacement delegate;
+- an optional prediction delegate;
+- explicit local mutations made through the reactive document API.
+
+Outputs:
+
+- coherent typed snapshots and watches;
+- authoritative replacements only through an explicitly requested
+  authoritative writer;
+- predictions only through an explicitly requested prediction writer;
+- one coalesced write for each explicit burst of local mutations.
+
+Derived state:
+
+- the reactive snapshot is a local mirror, not canonical truth;
+- reconciliation metadata compares a pending local write with an incoming
+  canonical snapshot;
+- debounce timers schedule already-declared work and never inspect documents
+  for undeclared mutations.
+
+Forbidden writers:
+
+- `SetAsync` may not select prediction or replacement based on whichever
+  delegate happens to exist;
+- reading or watching a document may not start serialization polling;
+- mutating an exposed object graph may not silently become a network write;
+- alias conversion may not erase which writer was selected.
+
+Shared paths:
+
+- direct edits, nested edits, automation, and UI bindings use `Update` or
+  `ReplaceLocal` on the same reactive mirror;
+- explicit flush and debounced flush use the same selected writer;
+- canonical watch updates and refresh use the same snapshot adoption path.
+
+Cut line:
+
+- remove `CanSet`, `SetAsync`, and ambiguous `UpdateAsync`/`ReactiveAsync`
+  entry points from document handles and catalogs;
+- obtain either an authoritative writer or a prediction writer before editing;
+- remove change-detection timers and full-document idle serialization;
+- expose cloned snapshots so callers cannot mutate the live mirror behind the
+  mutation boundary.
+
+## Required proof
+
+- a handle carrying both capabilities cannot write until the caller selects a
+  writer;
+- authoritative and prediction writers reach only their named delegates;
+- nested edits made through `Update` are coalesced and published;
+- direct mutation of a returned snapshot cannot publish;
+- an idle reactive document creates no periodic detection work;
+- scheduling 1, 100, or 1,000 reactive documents creates zero idle work, and
+  editing one percent schedules only that one percent;
+- canonical reconciliation and in-flight edits remain deterministic.
+
+Run the cross-runtime scheduling gate from a CultLib checkout:
+
+```powershell
+powershell -ExecutionPolicy Bypass -File scripts/verify-reactive-document-scaling.ps1
+```
+
+The gate runs the C#, TypeScript, and Python implementations against the same
+1/100/1,000-document cases. It proves ownership and scheduling proportionality;
+it does not claim allocation, payload-size, or end-to-end latency budgets. Those
+need a separate measured benchmark against representative document bodies and
+real transports.
diff --git a/src/GameCult.Mesh/docs/durable-node-quickstart.md b/src/GameCult.Mesh/docs/durable-node-quickstart.md
index 3d08ae0f..f85fac97 100644
--- a/src/GameCult.Mesh/docs/durable-node-quickstart.md
+++ b/src/GameCult.Mesh/docs/durable-node-quickstart.md
@@ -55,7 +55,7 @@ var key = new CultRecordKey("note:intro");
 var documents = new CultNetDocumentRegistry()
     .Register(CultNetDocumentBinding.ForDocument<MeshNote>());
 
-using (var node = await CultMesh.CreateNodeAsync("world.ccmp", new CultMeshNodeOptions
+using (var node = await CultMesh.CreateNodeAsync("world.cc", new CultMeshNodeOptions
 {
     DatabaseOptions = new CultNetDatabaseOptions
     {
@@ -76,7 +76,7 @@ using (var node = await CultMesh.CreateNodeAsync("world.ccmp", new CultMeshNodeO
     await node.FlushAsync();
 }
 
-using (var reopened = await CultMesh.CreateNodeAsync("world.ccmp", new CultMeshNodeOptions
+using (var reopened = await CultMesh.CreateNodeAsync("world.cc", new CultMeshNodeOptions
 {
     DatabaseOptions = new CultNetDatabaseOptions
     {
@@ -92,7 +92,7 @@ using (var reopened = await CultMesh.CreateNodeAsync("world.ccmp", new CultMeshN
 
 What happened:
 
-1. `CultMesh.CreateNodeAsync("world.ccmp", ...)` opened a durable CultCache
+1. `CultMesh.CreateNodeAsync("world.cc", ...)` opened a durable CultCache
    snapshot file and wrapped it in a CultMesh node.
 2. `node.Database.PutAsync(...)` wrote a typed document through the public
    CultMesh database surface.
@@ -105,7 +105,7 @@ What happened:
 
 If you peel this path apart, the authority split stays simple:
 
-- CultCache: `world.ccmp`, schema ids, record keys, typed document payloads,
+- CultCache: `world.cc`, schema ids, record keys, typed document payloads,
   local indexes, flush/load
 - CultNet: `CultNetDocumentRegistry`, raw document puts/snapshots,
   subscriptions, shard routing, transport-facing replication
diff --git a/src/GameCult.Mesh/docs/getting-started/01-persist-typed-state.md b/src/GameCult.Mesh/docs/getting-started/01-persist-typed-state.md
new file mode 100644
index 00000000..f7924ec8
--- /dev/null
+++ b/src/GameCult.Mesh/docs/getting-started/01-persist-typed-state.md
@@ -0,0 +1,68 @@
+# 1. Persist The Counter
+
+The tutorial builds one application all the way through: a provider-owned
+counter, an Increment operation, one browser lowerer, and one C# headless
+client. Start with the state the provider actually owns.
+
+```csharp
+using GameCult.Caching;
+using GameCult.Caching.MessagePack;
+using GameCult.Mesh;
+using GameCult.Networking;
+using MessagePack;
+
+[CultDocument("sample.counter_state", "sample.counter_state.v1")]
+[MessagePackObject]
+public sealed class CounterState
+{
+    [Key(0)] public string CounterId { get; set; } = "";
+    [Key(1)] public int Count { get; set; }
+}
+```
+
+Open a `.cc` node, register the document once, and write through its database
+boundary:
+
+```csharp
+var key = new CultRecordKey("counter:main");
+var documentTypes = new[] { typeof(CounterState) };
+var registry = CultMesh.CreateCultCacheDocumentRegistry(documentTypes);
+var documents = CultMesh.CreateCultNetDocumentRegistry(documentTypes, registry);
+using var node = await CultMesh.CreateNodeAsync("counter.cc", new CultMeshNodeOptions
+{
+    StartServer = false,
+    CacheOptions = new CultCacheOpenOptions { Registry = registry },
+    DatabaseOptions = new CultNetDatabaseOptions
+    {
+        RuntimeId = "sample.counter-daemon",
+        DocumentRegistry = documents
+    }
+});
+
+await node.Database.PutAsync(key, new CounterState
+{
+    CounterId = key.Value,
+    Count = 0
+});
+await node.FlushAsync();
+```
+
+CultCache owns durable local truth. CultNet owns the portable schema mapping.
+CultMesh exposes the database and later carries subscriptions and operations.
+The renderer owns none of them.
+
+The executable provider adds its receipt index to this document so the counter
+mutation and idempotency decision are committed together. See
+[`samples/eve-browser-network/Program.cs`](../../../../samples/eve-browser-network/Program.cs)
+for the exact running type and transaction.
+
+Fast persistence check:
+
+```powershell
+dotnet test tests/GameCult.Networking.Tests/GameCult.Networking.Tests.csproj --filter FullyQualifiedName~CultMeshNode_CanRoundTrip_DurableTypedDocument_Through_PublicDatabaseSurface
+```
+
+This check proves the local typed state boundary. Chapter 4 boots the real
+provider and proves the same state across Chromium and C# after restart.
+
+Next: [connect a client by stable identity](02-connect-by-identity.md).
diff --git a/src/GameCult.Mesh/docs/getting-started/02-connect-by-identity.md b/src/GameCult.Mesh/docs/getting-started/02-connect-by-identity.md
new file mode 100644
index 00000000..47905fec
--- /dev/null
+++ b/src/GameCult.Mesh/docs/getting-started/02-connect-by-identity.md
@@ -0,0 +1,151 @@
+# 2. Connect A Client By Stable Identity
+
+Clients address a live session by stable Verse/provider identity. In this tutorial,
+`sample.counter` is the Verse id and `sample.counter-daemon` is the authority
+runtime Odin currently advertises for it. Application clients pass that typed
+pair, never a socket address and never one ambiguous string that might mean
+either identity. A product may expose only a Verse choice to its user; its
+selection owner then resolves the provider runtime from Odin's descriptor before
+opening the session. Discovery owns the current physical routes, and the session
+manager owns connection reuse, path rotation, and transport failure state.
+Each Odin route binds that authority runtime to one endpoint, protocol set, and
+generation. For a remote Verse, Odin signs that exact tuple and the provider's
+P-256 public key. The client pins an Odin root from its own configuration, then
+requires the connected provider to sign a fresh client nonce. A route cannot
+become usable by merely repeating the expected Verse and runtime strings.
+
+```csharp
+using GameCult.Mesh;
+using GameCult.Networking.WebSockets;
+
+var odinEndpoint = Environment.GetEnvironmentVariable("ODIN_ENDPOINT")
+    ?? throw new InvalidOperationException("Set ODIN_ENDPOINT to the configured rendezvous route.");
+const string verseId = "sample.counter";
+var target = new CultMeshSessionTarget(verseId, "sample.counter-daemon");
+using var timeout = new CancellationTokenSource(TimeSpan.FromSeconds(30));
+var cancellationToken = timeout.Token;
+var odinRoot = new CultMeshEcdsaP256PublicKey(
+    Environment.GetEnvironmentVariable("ODIN_ROOT_KEY_ID")
+        ?? throw new InvalidOperationException("Set ODIN_ROOT_KEY_ID."),
+    Environment.GetEnvironmentVariable("ODIN_ROOT_P256_X")
+        ?? throw new InvalidOperationException("Set ODIN_ROOT_P256_X."),
+    Environment.GetEnvironmentVariable("ODIN_ROOT_P256_Y")
+        ?? throw new InvalidOperationException("Set ODIN_ROOT_P256_Y."));
+using var mesh = new CultMeshClient(new CultMeshClientOptions
+{
+    RendezvousEndpoints = new[] { odinEndpoint },
+    Discovery = new CultMeshVerseDiscoveryClientOptions
+    {
+        CreateClientForEndpoint = _ => new CultNetWebSocketSchemaClient()
+    },
+    Sessions = new CultMeshSessionManagerOptions
+    {
+        Trust = new CultMeshAuthorityTrustPolicy(
+            CultMeshAuthorityTrustMode.AuthenticatedRemote,
+            new[] { odinRoot })
+    },
+    Connectors = new ICultMeshTransportConnector[]
+    {
+        new CultMeshUriSchemaTransportConnector(
+            "cultnet-websocket",
+            new[] { "wss" },
+            _ => new CultNetWebSocketSchemaClient())
+    }
+});
+
+using var counterLease = await mesh.LeaseDocumentAsync<CounterState>(
+    target,
+    "counter:main",
+    cancellationToken);
+var counter = counterLease.Handle;
+
+using var counterWatch = counter.Watch(value =>
+    Console.WriteLine($"Count: {value.Count}"));
+```
+
+`CounterState` is the application document from chapter 1. Eve documents enter
+in chapter 3, where the sample installs the renderer-neutral Eve contract
+package explicitly. This identity/session API does not depend on a UI runtime.
+
+Keep `mesh` for the application lifetime and dispose each document lease when
+the consuming screen or system closes. Leases for the same identity share one
+subscription. The document handle is stable while leased: when
+Odin advertises a new physical route after a partition, CultMesh migrates the
+session, restores the server-side subscription, refreshes the typed snapshot,
+and continues the same watch.
+
+Open a session directly only when implementing infrastructure that needs
+protocol-level state or diagnostics:
+
+```csharp
+var session = await mesh.ConnectAsync(
+    target,
+    CultMeshProtocols.Documents,
+    cancellationToken);
+
+using var stateWatch = session.WatchState().Subscribe(state =>
+    Console.WriteLine($"{state.Status}: {state.Path?.Endpoint}"));
+```
+
+Application code does not reconnect, sleep, rank endpoints, or replace the
+session. Those decisions belong to CultMesh.
+
+For a deliberately local, moddable Verse, select the exception explicitly and
+use only in-process or loopback routes:
+
+```csharp
+Sessions = new CultMeshSessionManagerOptions
+{
+    Trust = new CultMeshAuthorityTrustPolicy(CultMeshAuthorityTrustMode.LocalDevelopment)
+}
+```
+
+`LocalDevelopment` never accepts an unsigned non-loopback route. Verse names,
+provider names, and Odin wire fields cannot turn this exception on. Remote
+routes require a trusted Odin signature, provider nonce proof, certificate
+validity, and a protected channel.
+
+The remote example requires both `GameCult.Mesh` and
+`GameCult.Networking.WebSockets` at the same CultLib package version. Core
+CultMesh does not silently install a network stack: the consumer chooses the
+secure connector and its TLS policy. The default TCP connector exists for the
+explicit loopback-development case and cannot satisfy authenticated-remote
+trust.
+
+An authenticated provider receives an Odin-certified route and its matching
+provider private key from deployment configuration. It attaches the proof gate
+to the same WSS schema server before publishing the route:
+
+```csharp
+using var identity = new CultMeshSessionIdentityServer(
+    schemaServer,
+    authorityRuntimeId: "sample.counter-daemon",
+    verseIds: new[] { "sample.counter" },
+    protocolIds: new[] { CultMeshProtocols.Documents.Value },
+    routeGenerations: new[] { certifiedRoute.Generation },
+    proofSigners: new[] { new CultMeshSessionProofSigner(certifiedRoute, providerPrivateKey) });
+```
+
+`certifiedRoute` is the exact signed route Odin publishes. The provider never
+holds Odin's signing key, and an unsigned WSS route is still untrusted.
+
+Fast session-management check (this uses controlled transports; it is not the
+network proof):
+
+```powershell
+dotnet test tests/GameCult.Mesh.Tests/GameCult.Mesh.Tests.csproj --filter FullyQualifiedName~CultMeshSessionManagerTests
+```
+
+The local checkpoint in chapter 4 additionally advertises a better-priority
+endpoint for the wrong authority runtime. Both the C# and browser clients must
+ignore it, verify the intended peer, survive route replacement, and reject
+wrong-source operation responses.
+
+Advanced hosts may inject lookup sources, connectors, clocks, persistence, and
+diagnostics through the lower-level discovery and session APIs. Application
+features should not need them.
+
+Chapter 4 runs the real network chronology and proves that the retained lease
+survives Odin moving `sample.counter` to a new physical provider route.
+
+Next: [publish one Eve surface to multiple runtimes](03-publish-an-eve-surface.md).
diff --git a/src/GameCult.Mesh/docs/getting-started/03-publish-an-eve-surface.md b/src/GameCult.Mesh/docs/getting-started/03-publish-an-eve-surface.md
new file mode 100644
index 00000000..5cb5b742
--- /dev/null
+++ b/src/GameCult.Mesh/docs/getting-started/03-publish-an-eve-surface.md
@@ -0,0 +1,142 @@
+# 3. Publish One Eve Surface To Multiple Runtimes
+
+An Eve application publishes one provider advertisement and one or more typed
+surface documents through CultMesh. Browser, Unity, Electron, Flutter, and
+other clients discover the same advertisement and lower only the capabilities
+they support.
+
+The authority split is fixed:
+
+- provider daemon: live application state, command handling, receipts, assets;
+- Eve: surface, command, binding, embedding, and plugin contracts;
+- CultMesh: discovery, sessions, document delivery, and asset transfer;
+- runtime: native rendering, input sampling, and platform lifecycle.
+
+A runtime configuration contains identity and selection constraints, not a
+copy of provider behavior:
+
+```text
+rendezvous: odin
+provider: aetheria.daemon
+surface kind: interactive-world
+runtime capabilities: unity-scene + eve-fields
+```
+
+EveUnity currently expresses this through
+`EveUnityCultMeshPlayableWorldProvider.Configure(...)`. Its provider discovery,
+advertisement snapshot, live snapshots, and subscriptions share one managed
+CultMesh document session. Other runtime lowerers must preserve the same
+boundary: they may reject or report unsupported capabilities, but they may not
+import provider internals.
+
+## The Application-Owned Part
+
+Install the renderer-neutral `GameCult.Eve.Surface` package in the provider.
+Do not install EveUnity or the browser lowerer there. A provider defines typed
+state, one typed operation transaction, and one Eve surface. CultNet envelope
+encoding is framework work. This complete method builds the surface document;
+it has no hidden transport or state variables:
+
+```csharp
+using GameCult.Eve.Surface;
+using GameCult.Mesh;
+
+static EveSurfaceDocument CreateCounterSurface()
+{
+    var route = new CultMeshRouteHint(CultMeshLocalityKind.Network, "cultmesh");
+    var count = new CultMeshStateBindingDescriptor(
+        "value",
+        "sample.counter.count",
+        "sample.counter_state:counter:main",
+        "sample.counter_state.v1",
+        route);
+    var increment = CultMesh.OperationBinding(
+        "sample.counter.increment",
+        "Increment",
+        "sample.increment.v1",
+        route);
+
+    return EveSurface.Create("sample.counter")
+        .Provider("sample.counter-ui", "sample.daemon")
+        .Title("CultMesh browser counter")
+        .RootColumn("counter.root", root => root
+            .Metric("counter.value", "Canonical count", "0", count)
+            .Button("counter.increment", "Increment", increment))
+        .Build();
+}
+```
+
+The operation handler owns validation, idempotency, state mutation, and its
+durable receipt. `CultNetOperationServer` owns only route/schema checks and
+typed envelope serialization. The complete, compiling provider transaction—including
+the schema server, typed request/receipt types, and exactly-once mutation—is in
+[`samples/eve-browser-network/Program.cs`](../../../../samples/eve-browser-network/Program.cs);
+it contains no hand-written operation base64 or MessagePack dispatch switch.
+
+## Multi-Runtime Checkpoint
+
+Run the same provider and connect at least two lowerers. Both must report the
+same provider id, surface id, surface version, and command receipt ids. Native
+pixels may differ; provider truth may not.
+
+The complete checkpoint is executable from CultLib:
+
+```powershell
+cd CultLib
+pwsh -File ./scripts/verify-eve-getting-started.ps1
+```
+
+This one command runs clean .NET and TypeScript package-artifact checkpoints,
+then the real browser/C# network checkpoint. They remain separate programs
+because they prove different boundaries; the developer should not have to
+orchestrate them.
+
+The .NET layer packs CultLib's managed dependency graph and
+`GameCult.Eve.Surface`, then restores and runs an empty project whose only
+GameCult dependency is `PackageReference Include="GameCult.Eve.Surface"`.
+This proves the renderer-neutral provider contract does not require a sibling
+Eve or CultLib source tree after packaging.
+
+The real-process C# sample is then rebuilt from that same temporary NuGet feed.
+The source project references in its `.csproj` are contributor convenience only
+and are disabled by the checkpoint; they are not the consumer contract.
+
+The first layer builds and packs `cultcache-ts`, `cultnet-ts`, `cultmesh-ts`,
+`@gamecult/eve-contracts`, and `@gamecult/eve-browser-lowering`, installs the
+tarballs into an empty temporary consumer, and runs
+`samples/eve-two-runtime/sample.mjs`. Eve's generated runtime validators reject
+an invalid surface or receipt before either enters the store. One provider-owned
+counter surface is lowered into a jsdom DOM host and observed by an independent
+headless CultMesh observer. A DOM command crosses the typed operation boundary,
+both consumers converge on the same state and canonical receipt identity, a
+duplicate idempotency key is not applied twice, and the state plus receipt
+survive reopening the `.cc` store.
+
+The second layer runs a durable C# provider, a wrong-authority decoy, a separate
+local Odin fixture, a real Chromium Eve lowerer, and an independent C# headless observer over binary
+CultNet WebSocket lanes. The open browser resolves the `sample.counter` Verse
+through the canonical catalog, rejects the decoy route, survives its provider
+restarting on a different route, and resubscribes. The retained C# client then invokes a second typed operation
+through `CultMeshClient.InvokeAsync`; Chromium and C# observe the same
+provider-authored state and receipt chronology. The same retained C# session
+then completes 10,000 typed no-op operations under explicit p99 and post-GC
+managed-memory gates, so the tutorial pressure-tests the API it teaches.
+
+Current verification for the Unity consumer remains:
+
+```powershell
+cd ../EveUnity
+pwsh -File ./scripts/run-release-consumer-tests.ps1
+```
+
+The artifact layer proves clean package consumption, canonical Eve contract
+validation, and two independent lowering/observation consumers inside Node. It
+does **not** prove the network layer; the second program owns that evidence.
+
+The network program is
+[`samples/eve-browser-network`](../../../../samples/eve-browser-network/README.md).
+Run it separately only while diagnosing that layer. A smoke against the
+deployed Odin daemon remains a separate infrastructure gate. Its owner map
+and full acceptance contract are recorded in
+[`browser-verse-transport.md`](../browser-verse-transport.md).
+
diff --git a/src/GameCult.Mesh/docs/getting-started/04-run-the-multiruntime-game.md b/src/GameCult.Mesh/docs/getting-started/04-run-the-multiruntime-game.md
new file mode 100644
index 00000000..ce18fdb3
--- /dev/null
+++ b/src/GameCult.Mesh/docs/getting-started/04-run-the-multiruntime-game.md
@@ -0,0 +1,67 @@
+# 4. Run The Multi-Runtime Game
+
+The counter is now one small multiplayer game:
+
+- a C# provider owns `CounterState`, Increment, idempotency, receipts, the
+  `.cc` store, and the Eve surface;
+- Chromium discovers that provider through Odin, lowers the surface, and
+  invokes Increment;
+- an independent C# client leases the same counter and invokes through the same
+  typed operation boundary;
+- both clients remain attached when Odin moves the Verse to a replacement
+  physical provider route.
+- a better-priority route bound to another runtime remains unreachable to both
+  clients throughout the chronology.
+
+Run the whole chronology from the CultLib checkout:
+
+```powershell
+pwsh -File ./scripts/verify-eve-getting-started.ps1
+```
+
+The command owns setup and teardown. Do not start Odin, the provider, or the
+browser by hand. A successful run prints two JSON records followed by:
+
+```text
+Eve getting-started verification passed: clean .NET and TypeScript artifacts, DOM and headless convergence, real Chromium and C# clients, Odin discovery, receipts, persistence, and route replacement.
+```
+
+## What The Command Proves
+
+The first checkpoint packs the CultLib managed dependency closure and Eve's C#
+surface contract, then restores and runs an empty .NET project using only the
+resulting `GameCult.Eve.Surface` package. The second checkpoint packs the
+TypeScript CultCache, CultNet, CultMesh, and Eve
+packages, installs those artifacts into an empty temporary consumer, and proves
+DOM/headless convergence plus `.cc` reopen. This rejects a sample that only
+works through repository-relative source imports.
+
+The third checkpoint boots separate Odin, intended provider, wrong-authority
+decoy provider, Chromium, and C# headless processes. Its C# application is built
+from the temporary NuGet feed produced by the first checkpoint, not sibling
+project references. Chromium performs the first increment. The provider then restarts on
+a different route, Odin advertises the replacement, and the retained clients
+resubscribe without application reconnect code. C# performs the second
+increment. Both clients must observe count 2 and both canonical receipt ids.
+
+Finally, the retained C# session sends 10,000 typed no-op operations. The gate
+records throughput, p99 latency, managed-heap growth, and private-memory growth.
+It fails at 250 ms p99 or more than 8 MiB post-GC managed growth.
+
+## What It Does Not Prove
+
+The included Odin is a real CultNet Verse-catalog provider but still a local
+fixture. It does not prove deployed GameCult infrastructure. The package layer
+uses packed checkout artifacts until the package owners publish the named npm
+packages. Those are explicit release gates, not reasons to put endpoint or
+source-tree fallbacks into application code.
+
+The process harness lives in
+[`samples/eve-browser-network`](../../../../samples/eve-browser-network/README.md).
+Application code should copy the typed state, operation, and Eve composition
+shape—not its benchmark flags or fixture orchestration.
+
+For a TypeScript provider daemon, continue with the
+[`CultMeshProviderSession` guide](../../../../packages/cultmesh-ts/README.md#long-lived-providers).
+That lifecycle is an alternative provider runtime for the same ownership
+model, not a fifth chapter that changes this tutorial into a different product.
diff --git a/src/GameCult.Mesh/docs/getting-started/README.md b/src/GameCult.Mesh/docs/getting-started/README.md
new file mode 100644
index 00000000..66ded7a4
--- /dev/null
+++ b/src/GameCult.Mesh/docs/getting-started/README.md
@@ -0,0 +1,72 @@
+# CultMesh And Eve Getting Started
+
+This series builds one typed application state and presents it through multiple
+Eve runtimes. It is maintained as an API acceptance test: examples use public
+APIs, name the owner of each decision, and include a verification checkpoint.
+
+Application consumers install released packages and do not need the source
+repositories. This checkout also contains a maintainer checkpoint that creates
+the same clean consumers from local package artifacts:
+
+```powershell
+pwsh -File ./scripts/verify-eve-getting-started.ps1
+```
+
+The maintainer command takes an explicit `-EveRoot` when Eve is not a sibling:
+
+```powershell
+pwsh -File ./scripts/verify-eve-getting-started.ps1 -EveRoot D:\src\Eve
+```
+
+It installs missing build dependencies and runs three explicit evidence layers.
+First it packs the
+CultLib managed dependency closure plus `GameCult.Eve.Surface`, then restores
+and runs an empty .NET consumer using only `PackageReference`. Next it packs the five
+TypeScript packages into another empty temporary consumer, validates the Eve surface
+and receipt, executes one idempotent counter command, proves a DOM lowerer and
+headless observer converge, and reopens the durable `.cc` store. Then it boots a
+durable C# provider, local Odin fixture, real Chromium lowerer, and independent
+C# client. Chromium invokes before provider replacement; C# invokes afterward.
+Both retained clients prove discovery by identity, canonical receipts, provider
+restart on another route, rejection of a better-priority wrong-authority route,
+resubscription, and durable convergence. The retained
+C# session also completes 10,000 non-persistent typed operations under p99 and
+post-GC managed-memory gates.
+Set `CHROME_PATH` only when no installed Chrome, Chromium, Edge, or Playwright
+Chromium can be found automatically.
+
+Follow the chapters in order:
+
+1. [Persist typed application state](01-persist-typed-state.md)
+2. [Connect a client by stable identity](02-connect-by-identity.md)
+3. [Publish one Eve surface to multiple runtimes](03-publish-an-eve-surface.md)
+4. [Run the multi-runtime game](04-run-the-multiruntime-game.md)
+
+The intended application shape is small:
+
+```text
+provider daemon -> typed CultCache documents -> CultMesh advertisement
+                                               |
+                      +------------------------+--------------------+
+                      |                        |                    |
+                 Eve browser              EveUnity          another lowerer
+                      |                        |                    |
+                 player input             player input       headless / AI
+```
+
+The provider owns live truth. Eve owns the surface contract. Each runtime owns
+native projection. CultMesh owns discovery and connection continuity.
+
+## Maintenance Contract
+
+- A chapter must not tell an application to choose physical endpoints, build a
+  reconnect loop, or duplicate provider state.
+- Code must compile against the package version named by the release that
+  publishes it.
+- Every release changing a demonstrated API must update this series in the same
+  pull request.
+- A setup step that depends on repository internals is an API defect, not
+  acceptable tutorial folklore.
+- The maintainer command may read owner checkouts to create packages. Every
+  sample process it launches must consume those package artifacts rather than
+  compiling through sibling project references.
diff --git a/src/GameCult.Mesh/docs/postmortem-2026-07-cultmesh-bulk-rudp.md b/src/GameCult.Mesh/docs/postmortem-2026-07-cultmesh-bulk-rudp.md
new file mode 100644
index 00000000..8ac88910
--- /dev/null
+++ b/src/GameCult.Mesh/docs/postmortem-2026-07-cultmesh-bulk-rudp.md
@@ -0,0 +1,609 @@
+# Postmortem: CultMesh bulk content over custom RUDP
+
+**Incident window:** 2026-07-12 through 2026-07-19
+
+**Detected:** 2026-07-19 during the released EveUnity/Aetheria cold-cache witness
+
+**Scope:** CultMesh Phase 4 content delivery and the physical transport assumptions beneath it
+
+**Status:** architectural cause identified; RUDP tuning stopped; replacement data planes not yet integrated
+
+## Executive summary
+
+The CultMesh reliability migration correctly moved discovery, session reuse,
+authority, content verification, resumable state, and final cache promotion out
+of applications and renderers. It failed at the boundary between those control
+planes and physical byte delivery.
+
+The canonical plan stated that the existing RUDP implementation already
+covered acknowledgement, resend, ordering, duplicate suppression,
+fragmentation, timeout, and bounded pending work. It therefore said the first
+migration target was not a transport rewrite. That sequencing was reasonable
+while CultMesh lacked identity-first sessions: replacing the wire first would
+have preserved caller-owned reconnect and topology policy.
+
+The mistake came later. Once `CultMeshSessionManager` existed, the condition
+named by the plan for adopting Iroh or QUIC had been satisfied. Instead of
+benchmarking and attaching a proven content stream at that boundary, Phase 4
+introduced `CultMeshContentChunkRequestMessage` and
+`CultMeshContentChunkResponseMessage` over the existing schema session. The
+response embedded each raw chunk payload and therefore sent bulk bytes through
+the custom RUDP fragmentation and retransmission engine.
+
+This preserved schema identity and moved cache authority to the correct owner,
+but it did not produce the intended data plane. It changed the envelope around
+the bytes while leaving the physical bottleneck intact.
+
+The failure was not detected promptly because the gates proved eventual
+delivery and ownership, not transport fitness:
+
+- the initial content-session test used an in-memory schema client and server;
+- the deterministic hostile-network harness tested its own schedule but was
+  not connected to the public content path or a physical connector;
+- the later real-UDP regression allowed one MiB to take nearly ten seconds;
+- the released cold witness allowed the artifact to finish under a 300-second
+  deadline;
+- no test compared goodput, wire amplification, copies, or allocation against
+  TCP, QUIC, Iroh, or a same-machine mapping baseline;
+- `SharedFileMapping` in witness output described mapping the client cache
+  after the network transfer, not direct access to a provider-owned local body.
+
+The result was a locally reliable but grossly inefficient bulk path. A
+56,204,750-byte released Aetheria body caused 105,911,320 daemon transmit bytes
+in one cold witness. A later controlled parity run emitted 129,241,066 server
+bytes and delivered only 10.1 MiB/s, while the same body moved and verified at
+250.7 MiB/s over TCP and 71.1 MiB/s over .NET's MsQuic-backed QUIC stream. An
+existing mapped file opened in 10.9 ms without transferring the body.
+
+The ownership migration is not discarded. The physical content connector and
+its gates must be replaced. CultNet remains the typed schema and dispatch
+substrate; it must not imply that every payload belongs inside the custom RUDP
+message plane.
+
+## Was the branch following the plan?
+
+Yes, substantially—and that is why this incident cannot be dismissed as one
+implementation ignoring good documentation.
+
+| Plan commitment | Branch result | Verdict |
+| --- | --- | --- |
+| Stable identity and shared sessions before transport replacement | Discovery and session owners were implemented before content migration | Followed |
+| Authority independent of contact and transport success | A mandatory resolver and provider/body authorization were added | Followed |
+| One verified content-transfer owner | Resume state, range verification, failover, hashing, and atomic promotion moved into `CultMeshContentTransferService` | Followed |
+| Remove renderer-owned chunk and cache authority | EveUnity delegates transfer and only lowers the verified result | Followed |
+| Bounded adaptive concurrency | A fixed four-request window was added; adaptation was explicitly deferred | Partial |
+| Caller-provided streaming destinations and backpressure | Not implemented before the managed content session became the released default | Not followed |
+| Real consumer plus hostile-network proof at phase closure | A real released consumer ran, but the hostile harness did not drive that physical path | Not followed |
+| Borrow QUIC/Iroh boundaries before dependencies | Connector/session/body boundaries were borrowed | Followed |
+| Consider Iroh or QUIC after the boundary and harness exist | The prerequisite existed, but no mandatory comparison or adoption decision occurred | Missed transition |
+| Public surface becomes smaller and more obvious | Application ownership shrank, but the physical RUDP machinery expanded | Mixed |
+
+The plan also lacked a throughput, amplification, flow-control, copy-budget, or
+comparative transport gate. Consequently, the branch could follow much of the
+written plan and still release an unfit bulk path. This is both a plan defect
+and an execution defect:
+
+- **Plan defect:** it treated RUDP feature completeness as a sufficient reason
+  to defer physical transport evaluation and did not define the evaluation
+  trigger or fitness budget.
+- **Execution defect:** once repeated cold failures supplied contrary evidence,
+  the work kept repairing RUDP locally instead of reopening the premise.
+
+## User-visible impact
+
+- A same-machine Aetheria daemon and Unity client copied a provider-owned asset
+  bundle through UDP instead of opening an authorized mapped body.
+- The 0.3.91 released Unity test took 54.803 seconds. File timestamps place the
+  56,204,750-byte body promotion roughly 31 seconds after partial creation.
+- The 0.3.92/CultLib 1.0.33 witness reduced the Unity test to 36.028 seconds and
+  body transfer to roughly 12 seconds, but daemon transmit volume rose to
+  105,911,320 bytes. The apparent speedup came partly from more aggressive
+  packet emission and retransmission.
+- Cold startup competed with transient gameplay state and initially allowed a
+  live body publication lease to expire before subscription.
+- Release and witness effort was repeatedly spent changing drains, sleeps,
+  ACK handling, request windows, and lifecycle ordering rather than selecting
+  the intended data plane.
+- Remote behavior under real latency, loss, and bandwidth contention remains
+  unproven and is likely worse than loopback evidence.
+
+Content hashes, incremental chunk verification, final SHA-256 verification,
+and atomic promotion prevented corrupted or partial bodies from becoming cache
+truth. The incident is a performance and architecture failure, not known data
+corruption.
+
+## Intended architecture
+
+The reliability plan's durable intent was:
+
+1. stable endpoint identity rather than application-owned physical endpoints;
+2. shared long-lived sessions rather than request-scoped clients;
+3. authority independent of contact and transport success;
+4. content identity independent of provider and location;
+5. verified resumable transfer owned outside renderers;
+6. negotiated local mappings and remote streams behind the same body identity;
+7. Iroh/QUIC lessons expressed in boundaries before dependencies were adopted.
+
+The intended phrase “CultNet as the transport substrate” meant that registered
+schemas, typed envelopes, dispatch, and diagnostics remain portable across
+transport connectors. It did not require every body byte to be serialized as a
+schema-message field or fragmented by CultNet's RUDP implementation.
+
+## What was implemented
+
+The following pieces match the plan and remain useful:
+
+- `CultMeshDiscoveryService` owns route observations and freshness.
+- `CultMeshSessionManager` owns identity-first connection reuse and path state.
+- `CultMeshAuthorityResolver` separates contact from authorization.
+- `CultMeshContentTransferService` owns partial files, verified ranges,
+  provider failover, final hashing, and atomic cache promotion.
+- content hashes remain independent of provider identity and location.
+- body publications preserve schema, layout, producer epoch, sequence, access,
+  lease, and transport representations.
+- exact reactive subscriptions and SoA demand avoid broad per-frame snapshots.
+- verified client cache files can be mapped without allocating another managed
+  body after transfer.
+
+The incorrect slice was the managed content session:
+
+```text
+manifest chunk
+  -> CultMeshContentChunkRequestMessage
+  -> CultMeshContentChunkResponseMessage.Payload
+  -> MessagePack schema frame
+  -> custom RUDP fragmentation
+  -> per-packet ACK/resend/reassembly
+  -> managed byte[] chunk
+  -> verified partial file
+```
+
+The desired path is:
+
+```text
+typed content request / authorized body capability
+  -> CultMesh session selects an advertised physical plane
+  -> same machine: provider-owned mapped file/shared memory
+  -> remote: proven independent byte stream/range fetch
+  -> existing verified partial/final promotion owner
+```
+
+Registered schemas remain the control language. They identify the body, hash,
+range, lease, stream, progress, cancellation, and receipt. They do not need to
+contain the body itself.
+
+## Timeline
+
+### Before the migration plan
+
+- **2026-06-14 to 2026-06-17:** commits `8ce89688` through `1c85eabe`
+  introduced the C# transport port, custom RUDP reliability core, socket
+  transport, fragmentation, schema ergonomics, reconnect support, and a
+  multi-peer listener.
+- **2026-07-10 to 2026-07-12:** snapshot connection reuse and large-snapshot
+  fixes made RUDP the working physical path for the first Aetheria witness.
+
+### Reliability migration
+
+- **2026-07-12, `f0b5e103`:** the canonical reliability plan was committed. It
+  explicitly treated low-level RUDP reliability as present and deferred Iroh or
+  QUIC until session ownership and a failure harness existed.
+- **2026-07-12, `fc65e25f`:** Phase 0 added a deterministic fault scheduler and
+  diagnostics. The harness could replay hostile events, but it was not wired to
+  the public content transfer or actual transport connectors.
+- **2026-07-13, `b9f17a71`:** `CultMeshContentTransferService` correctly took
+  ownership of resumable verification and atomic promotion.
+- **2026-07-14, `7d571402`:** the decisive wrong fork. Managed content sessions
+  embedded chunk bytes in typed schema responses over the existing session.
+  The primary test used an in-memory loopback transport and therefore proved
+  ownership and message shape without exercising RUDP.
+- **2026-07-14, `a311cbe8`:** fixed request concurrency and RUDP polling to
+  improve throughput. The plan explicitly deferred adaptive scheduling and
+  streaming destinations instead of reopening physical-plane selection.
+- **2026-07-14, `b943fa7e`:** a 13,006,384-byte cold run completing under the
+  unchanged 300-second deadline was recorded as content-session delivery proof.
+- **2026-07-16, `25231429`:** a physical RUDP content test was finally added.
+  Its one-MiB payload only had to finish within ten seconds. It recorded wire
+  statistics on failure but asserted no goodput or lossless amplification
+  budget.
+- **2026-07-16, `15bffc6d`:** a 46,412,384-byte released cold witness was
+  recorded as proof while explicitly acknowledging that the managed session
+  still copied and fragmented the body.
+- **2026-07-17 to 2026-07-19:** ACK synchronization, concurrent session
+  serialization, exact body demand, reactive delivery, and live subscription
+  work made the path more correct under concurrency. None tested whether RUDP
+  deserved to carry bulk bytes.
+- **2026-07-19, `2afec5c5`:** per-32-packet `Thread.Sleep(1)` calls were replaced
+  by `Thread.Yield`. The cold transfer became faster while wire volume nearly
+  doubled, revealing that the system was flooding loopback rather than
+  controlling flow.
+- **2026-07-19, `ee0fb235`:** the first dedicated transport parity harness
+  compared the Aetheria-sized public content path with mapped-file, TCP, and
+  MsQuic-backed QUIC baselines. The result rejected further RUDP bulk tuning.
+
+## Detection
+
+The incident surfaced only after the released-package witness became fully
+cold and provider-owned assets grew to 56,204,750 bytes. Earlier warm-cache
+runs bypassed transfer. Earlier cold runs were framed as timeout/reliability
+problems rather than fitness problems.
+
+The decisive signals were:
+
+1. transfer duration remained many seconds on loopback;
+2. removing scheduler sleeps reduced duration but drove daemon transmit volume
+   to almost twice the body size in the released witness;
+3. the dedicated parity harness showed a stable order-of-magnitude gap;
+4. opening an existing provider body locally required milliseconds and no
+   transfer, proving that the same-machine witness was selecting the wrong
+   plane before RUDP performance even mattered.
+
+## Root cause
+
+### Primary cause: capability was mistaken for fitness
+
+The plan listed ACK, resend, ordering, duplicate suppression, fragmentation,
+timeout, and bounded pending work and concluded that transport replacement was
+not the first target. Those properties can establish eventual reliable message
+delivery. They do not establish congestion control, receiver flow control,
+packet pacing, batching, stream multiplexing, loss recovery quality, or bulk
+goodput.
+
+The custom RUDP path had a 32-packet acknowledgement mask, 1,024-byte fragments,
+managed per-fragment bookkeeping, and no congestion window tied to receiver
+progress. A sender could emit multiple 256-KiB chunk responses concurrently.
+Yielding after 32 sends yielded CPU time; it did not create backpressure or
+wait for acknowledgement progress.
+
+### Secondary cause: “CultNet substrate” was underspecified
+
+The plan did not say plainly enough that CultNet owns typed schema semantics
+independently of physical transport. Implementers treated “preserve CultNet as
+the transport substrate” as a reason to carry content through the available
+RUDP schema channel. This collapsed two distinct claims:
+
+- CultNet documents and registered schemas remain the portable protocol.
+- the current CultNet RUDP implementation is suitable for every payload class.
+
+Only the first claim was required.
+
+### Secondary cause: the QUIC/Iroh adoption trigger had no gate
+
+The plan correctly warned against adopting Iroh or QUIC before session and
+failure boundaries existed. It did not define a mandatory decision point once
+those boundaries existed. Phase 2 delivered the connector/session seam, but
+Phase 4 did not require candidate transports to pass a fitness comparison
+before becoming the content default.
+
+The deferral therefore became sticky. “Not yet” silently became “continue using
+RUDP.”
+
+### Secondary cause: evidence harnesses observed the wrong layer
+
+Phase 0's deterministic network proved that a fault schedule could replay
+loss, duplication, delay, reordering, partition, corruption, endpoint rotation,
+and restart. It did not drive the RUDP socket transport, session manager, or
+content transfer service. A self-test of the harness was treated as sufficient
+foundation for later phase proof.
+
+The first managed-content test used an in-memory schema bridge. It proved that
+content did not use snapshot records, sessions were reused, hashes matched, and
+warm cache avoided another request. It could not reveal fragmentation cost,
+socket flooding, resend amplification, scheduling delays, or contention with
+other messages.
+
+The later physical test's ten-second bound for one MiB was a hang detector, not
+a performance contract. The 300-second released witness deadline was likewise
+a liveness ceiling, not a native-experience gate.
+
+### Secondary cause: local failures were repaired locally
+
+Each symptom had a plausible narrow explanation:
+
+- snapshot payloads starved peers;
+- poll loops slept after control packets;
+- fragment sends slept per packet;
+- ACKs fell outside the rolling mask;
+- concurrent publishers mutated one reliability session;
+- content subscription leases expired during cold loading.
+
+The fixes were individually defensible and often necessary for small-message
+correctness. Together they kept attention inside RUDP. No rule required a
+transport parity check after two transport-level fixes failed to produce an
+acceptable cold path.
+
+This is the process failure described by the project's Jenga warning: the
+machine supplied enough local context to justify each patch while withholding
+the comparative evidence needed to question the owner.
+
+### Secondary cause: post-transfer mapping obscured pre-transfer cost
+
+The witness reported `SharedFileMapping` because EveUnity mapped the verified
+client cache file before loading the Unity bundle. That was true at the body
+lease layer, but incomplete at the user-visible layer: the provider-owned file
+had already crossed RUDP into the client cache.
+
+The metric did not lie, but it observed the wrong interval. No durable witness
+fact distinguished:
+
+- provider-owned same-machine mapping with zero body transfer;
+- client-cache mapping after remote delivery;
+- managed network-buffer fallback.
+
+### Secondary cause: the plan became both specification and evidence ledger
+
+The plan accumulated phase body maps, implementation notes, witness results,
+and partial-proof language in the same document that still contained the
+original `Cut first`, `Build`, and `Gate` contracts. That made useful progress
+visible, but it blurred the difference between these two statements:
+
+- a coherent slice of the phase has evidence;
+- the phase's closure contract has been satisfied.
+
+In Phase 4, content ownership, verification, and released-consumer delivery had
+evidence while adaptive scheduling, caller-provided streaming destinations,
+backpressure, hostile-network coverage of the real physical path, and transport
+fitness remained open. The document could therefore tell an increasingly
+convincing success story without forcing the remaining gate failures back to
+the top of the decision process.
+
+Evidence belongs beside the plan, but phase status must be derived only from an
+explicit closure checklist. A partial proof may close a named slice; it cannot
+silently weaken the parent phase gate.
+
+## Five whys
+
+1. **Why was Aetheria cold asset delivery slow?**
+
+   The provider sent a large immutable body as thousands of reliable UDP
+   fragments with heavy retransmission and managed per-packet work.
+
+2. **Why was bulk content sent through that path?**
+
+   Phase 4 represented chunks as typed request/response schema messages on the
+   existing CultMesh session.
+
+3. **Why was the existing session assumed suitable?**
+
+   The plan equated implemented reliability features with transport fitness and
+   deferred Iroh/QUIC until the session boundary existed.
+
+4. **Why was the assumption not revisited after the boundary existed?**
+
+   There was no mandatory transport parity gate, and every test emphasized
+   ownership, eventual completion, or failure recovery rather than comparative
+   goodput and amplification.
+
+5. **Why did repeated fixes not trigger redesign?**
+
+   The workflow classified each failure as another RUDP correctness defect and
+   rewarded a passing witness under generous timeouts. It lacked an escalation
+   rule that says repeated physical-transport repairs reopen transport
+   selection.
+
+## What went well
+
+- Content identity, verification, restart state, provider failover, and atomic
+  promotion were moved to a coherent owner and survived the incident.
+- The released-package witness eventually exercised a truly cold cache and
+  exposed the problem at the user-visible boundary.
+- Daemon transport counters made wire amplification observable.
+- The later parity harness reused the public transfer path instead of comparing
+  only synthetic packet loops.
+- The unreleased two-chunk/Sleep(0) tuning experiment was reverted rather than
+  released after it showed improved duration with unacceptable wire behavior.
+- The plan had preserved a transport connector boundary, so replacing the
+  physical plane does not require returning authority to EveUnity or Aetheria.
+
+## What went poorly
+
+- Research direction was treated as future inspiration after its adoption
+  prerequisite had already been met.
+- The deterministic failure harness was not integrated with the systems whose
+  reliability it purported to de-risk.
+- “Large” tests used 128 KiB, 700 KiB, or one MiB while the consumer used 13 to
+  56 MiB artifacts.
+- Test thresholds detected hangs but certified them as performance proof.
+- Lossless wire amplification was not a release gate.
+- The cold witness separated gameplay from content for valid lifecycle reasons,
+  but that separation also reduced pressure to make cold startup feel native.
+- Plan updates faithfully described partial slices yet allowed “proven” wording
+  before the full Phase 4 build and gate lists were complete.
+- The same-machine deployment advertised and selected network delivery before
+  mapping the resulting client cache.
+
+## Corrective architecture
+
+### Owner
+
+`CultMeshSessionManager` owns physical-plane selection for an endpoint identity
+and application protocol. `CultMeshContentTransferService` owns verification,
+resume state, and final promotion. A selected transport connector owns byte
+movement. CultNet schema dispatch owns none of the physical reliability policy.
+
+### Inputs
+
+- stable endpoint and provider identity;
+- authorized content hash, byte size, ranges, and lease;
+- provider-advertised physical candidates;
+- consumer-supported candidates;
+- same-machine evidence;
+- platform capabilities and measured connector health.
+
+### Outputs
+
+- same-machine: an authorized provider-owned mapped file or shared-memory body;
+- remote: an independent proven stream/range fetch feeding the transfer owner;
+- typed progress, cancellation, failure, and receipt state over CultNet.
+
+### Derived state
+
+Selected plane, endpoint address, stream identifiers, byte progress, path
+health, and performance telemetry are derived. They do not alter content hash,
+provider authority, or cache truth.
+
+### Forbidden writers
+
+- schema-message helpers cannot embed bulk body payloads;
+- renderers cannot choose physical endpoints or write final cache entries;
+- a body adapter cannot confer provider authority;
+- RUDP retry, chunk-window, or timeout tuning cannot make RUDP the preferred
+  bulk plane;
+- a client-cache mapping cannot claim same-machine zero-copy provenance.
+
+### Shared paths
+
+Every remote connector terminates in the existing verified-range and atomic
+promotion primitives. Local mapping and remote fallback preserve the same body
+identity, schema/layout, epoch/sequence, access mode, and lease semantics.
+
+### Deletion line
+
+1. Stop adding bulk-performance behavior to custom RUDP.
+2. Prevent `CultMeshContentChunkResponseMessage.Payload` from being the default
+   content body path.
+3. Make RUDP an explicit compatibility/control candidate, not the implicit
+   connector for `cultmesh.content.v1`.
+4. Delete RUDP content serving once every released consumer negotiates local
+   mapping or a dedicated remote stream.
+5. Retain RUDP only for payload classes whose own fitness gates justify it;
+   eventual cleanup may remove the custom reliability engine entirely.
+
+## Corrective actions
+
+### Completed
+
+- [x] Add `tools/GameCult.TransportParity` using the public CultMesh transfer
+  owner and Aetheria-sized payloads.
+- [x] Compare mapped-file open, TCP stream, MsQuic-backed QUIC stream, and
+  CultMesh RUDP on the same host.
+- [x] Record duration, goodput, and RUDP server wire bytes.
+- [x] Stop and revert the unreleased request-window/pacing experiment.
+- [x] Amend the reliability plan with the physical body-plane ownership cut.
+
+### Required before another bulk transport release
+
+- [ ] Make same-machine evidence select a provider-owned mapped body before any
+  network fetch.
+- [ ] Attach at least one proven remote stream connector behind
+  `CultMeshSessionManager` and the content protocol identity.
+- [ ] Keep content request, authorization, range, progress, cancellation, and
+  receipt state typed while moving body bytes out of schema response payloads.
+- [ ] Integrate the deterministic hostile-network schedule with the actual
+  connector and public content transfer path.
+- [ ] Exercise Aetheria-sized payloads, not only unit-sized fixtures.
+- [ ] Add cold and warm released-consumer witnesses that report plane
+  provenance, bytes sent, bytes copied, promotion time, and total lowering time.
+- [ ] Prove remote cancellation, range resume, provider failover, and corruption
+  recovery over the selected stream.
+- [ ] Define and enforce platform packaging for Unity, daemon, TypeScript, and
+  other promoted runtimes before making the connector the public default.
+
+### Required transport fitness gates
+
+The precise budgets may be tightened as deployment data accumulates, but a
+candidate cannot become the default without all of these categories:
+
+- **Comparative goodput:** integrated verified transfer measured against the
+  same connector's raw stream baseline on the same host and route.
+- **Lossless amplification:** total wire bytes bounded relative to body bytes;
+  success alone is insufficient.
+- **Small-message latency:** control messages and receipts remain responsive
+  while a body transfers.
+- **Backpressure:** sender progress follows receiver and destination capacity;
+  thread yields and timeout retries are not accepted as flow control.
+- **Hostile network:** loss, duplication, reordering, latency, partition,
+  reconnect, and path change drive the actual public path.
+- **Memory/copy budget:** allocation and copy counts distinguish provider-owned
+  mapping, streamed promotion, client-cache mapping, and managed fallback.
+- **User-visible cold start:** a released generic client lowers the world within
+  an explicit experience budget; a multi-minute timeout is only a deadlock
+  guard.
+
+### Escalation rule
+
+After two fixes in the physical transport layer for the same consumer outcome,
+work stops and transport selection is reopened against dedicated baselines.
+Further local transport repair requires evidence that the current connector
+still satisfies its fitness budget. This is not a ban on fixing bugs; it
+prevents repeated correctness patches from impersonating architectural proof.
+
+## Plan amendments
+
+The reliability plan should now be read with these corrections:
+
+1. “CultNet as transport substrate” means typed schema identity, framing,
+   dispatch, diagnostics, and connector contracts. It does not bless a single
+   physical transport for all payloads.
+2. Implemented ACK/resend/fragmentation is evidence of reliable-message
+   capability, not evidence of bulk, realtime, or media fitness.
+3. Once the session connector boundary exists, physical candidates must pass a
+   workload-specific parity gate before a consumer migration closes.
+4. Typed control state and body transport are separate. Registered schemas make
+   the control plane smaller; they do not require body bytes to become document
+   fields.
+5. Same-machine mapping is selected before transfer. Mapping a cache file after
+   transfer is a useful lowering optimization but not zero-copy delivery.
+6. A phase slice may be recorded as partial evidence, but “proven” and “closed”
+   require the complete build list, gates, real consumer, and performance
+   evidence relevant to that slice.
+
+## Evidence
+
+### Source and history
+
+- Canonical plan: `src/GameCult.Mesh/docs/reliability-migration-plan.md`, commit
+  `f0b5e103`.
+- Managed content session fork: commit `7d571402`.
+- Fixed request concurrency and drain work: commit `a311cbe8`.
+- First physical one-MiB RUDP content regression: commit `25231429`.
+- Scheduler-yield release: commit `2afec5c5`.
+- Dedicated parity harness and initial body-plane correction: commit
+  `ee0fb235`.
+
+### Released witness
+
+- EveUnity `artifacts/cold-release-0391/results.xml`: 54.803-second Unity test.
+- EveUnity `artifacts/cold-release-0392/results.xml`: 36.028-second Unity test.
+- EveUnity `artifacts/cold-release-0392/aetheria-daemon.log`: final daemon
+  counters `rx=3903892 tx=105911320` for the cold run.
+- Both witness documents report a 56,204,750-byte provider asset and
+  `SharedFileMapping`; the mapping occurred after network promotion into the
+  client cache.
+
+### Parity harness
+
+- Payload: 56,204,750 bytes.
+- Existing mapped file: 10.9 ms to open and touch; no body transfer.
+- TCP plus file write and SHA-256 verification: 213.8 ms, 250.7 MiB/s.
+- MsQuic-backed QUIC plus file write and SHA-256 verification: 753.4 ms,
+  71.1 MiB/s; repeated runs reached 87.0 to 107.4 MiB/s.
+- CultMesh RUDP public content transfer: 5,322.9 ms, 10.1 MiB/s,
+  129,241,066 server bytes; repeated runs reached 10.1 to 13.0 MiB/s.
+
+## Accountability
+
+Git author identity does not distinguish human-authored work from agent work in
+this repository, so this postmortem does not infer personal authorship from the
+commit metadata. The failure belongs to the engineering process and especially
+to the agent execution that kept accepting narrow transport repairs as progress
+toward the user's native-experience requirement.
+
+The user explicitly warned that cold asset delivery was not healthy enough to
+claim, that larger timeouts must not conceal it, and that the daemon architecture
+could not cost game performance. The eventual switch from “times out” to
+“finishes before the deadline” did not satisfy those constraints. The agent
+should have introduced comparative transport evidence at the first Phase 4
+physical failure, not after several releases and witness iterations.
+
+## Closing statement
+
+The reliability migration did not fail because it learned from Iroh and QUIC.
+It failed because it stopped at their control-plane lessons after building the
+seam where their transport machinery was meant to attach.
+
+The repair is not to discard the new discovery, session, authority, transfer,
+or body ownership. It is to finish the architecture: keep registered schemas as
+the small typed language of CultNet, attach proven physical transports beneath
+the session boundary, and make every promoted plane prove that it deserves the
+workload before a released consumer depends on it.
diff --git a/src/GameCult.Mesh/docs/public-api.md b/src/GameCult.Mesh/docs/public-api.md
index 6089d331..df1735b6 100644
--- a/src/GameCult.Mesh/docs/public-api.md
+++ b/src/GameCult.Mesh/docs/public-api.md
@@ -50,8 +50,12 @@ not the brand surface.
 ### Verses
 
 `CultMeshVerseDescriptor` describes a rule-bearing consensus graph. It includes
-transport compatibility, rules hash, authority model, discovery endpoints,
-known authority runtimes, optional parent Verse id, and plugin requirements.
+transport compatibility, rules hash, authority model, exact authority-route
+bindings, optional parent Verse id, and plugin requirements. Each route binds
+an authority runtime to one endpoint, protocol set, priority, and generation.
+The old endpoint/runtime arrays are derived projections; a legacy descriptor
+with several authority runtimes is rejected because it cannot identify which
+runtime owns which route.
 
 `CultMeshVerseCatalog` is the local reactive catalog for discovered Verses.
 It can publish discovery updates and find compatible transfer targets.
@@ -87,6 +91,419 @@ whether a peer card is authorized for a requested role and shard. This keeps
 peer exchange separate from authority instead of letting contact gossip mutate
 the world.
 
+### Cross-Runtime Primitives
+
+These are the first shared primitives for the cozy typed Verse surface that
+projects like Aetheria should build on instead of inventing daemon-specific
+adapters:
+
+In CultMesh, a primitive can be more than a data shape. Useful state-access
+patterns should graduate into shared managed affordances: typed handles,
+generated binding metadata, route selection, authority context, watches,
+diagnostics, and native-view descriptors that let each runtime use the same
+semantic API. The domain package names the thing; CultMesh supplies the fast,
+portable machinery that makes it feel native.
+
+- `CultMeshStatePointer<T>` is a typed pointer to Verse state that UI surfaces,
+  tools, and clients can resolve or watch without string state-ref plumbing.
+  `CultMesh.StatePointer(...)` creates simple or context-aware pointers.
+  Pointers carry source descriptors and route hints, and
+  `CultMesh.DescribeStatePointer(...)` exposes that metadata for catalogs and
+  inspectors. Context-aware pointers can bind with `Bind(...)`,
+  `CultMesh.BindStatePointer(...)`, or `CultMeshVerse.BindStatePointer(...)`,
+  producing a Verse-bound handle that resolves and watches through the shared
+  Verse query context instead of forcing UI/tool code to rebuild route plumbing.
+- `CultMeshMutableStatePointer<T>` extends the same state pointer shape with a
+  typed `ReplaceAsync(...)` operation for authoritative document handles,
+  editor tools, and UI surfaces that intentionally write state. It keeps the
+  read/watch/replace trio in CultMesh instead of letting each domain package
+  invent private document wrappers. `CultMesh.MutableStatePointer(...)`,
+  `CultMesh.BindMutableStatePointer(...)`, and
+  `CultMeshVerse.BindMutableStatePointer(...)` preserve the same Verse context,
+  route hints, source diagnostics, and state-binding metadata as read-only
+  pointers.
+- `CultMeshStateRefResolver` is the shared bridge for UI/tool surfaces that
+  still receive state references from authored Eve/CultUI documents. Resolvers
+  are named, composable, carry source descriptors and route hints, and expose
+  diagnostics through `CultMesh.DescribeStateRefResolver(...)`. Legacy
+  `Func<string, string>` lowerers can use `AsFunc()` while generated surfaces
+  migrate to typed state pointers and binding descriptors.
+- `CultMeshStateBindingDescriptor` and `CultMeshStateBindingRecord` are the
+  UI/tool state edge. Live surfaces bind a component prop to a typed state
+  pointer; persistence and transport boundaries use
+  `CultMesh.StateBindingRecord(...)` instead of local pointer-field copies or
+  route parsers.
+- `CultMeshOperationHandle<TRequest, TResponse>` is a method-shaped operation
+  handle. `CultMeshOperationContext`, `CultMeshAuthorityClaim`, and
+  `CultMeshOperationReceipt` carry runtime identity, authority metadata,
+  route hints, idempotency, acceptance, and diagnostics.
+  `CultMesh.DescribeOperationHandle(...)` exposes the operation id for surface
+  catalogs and generated tooling. `Bind(...)`, `CultMesh.BindOperation(...)`,
+  and `CultMeshVerse.BindOperation(...)` produce Verse-bound handles so
+  generated domain facades can invoke without re-threading context plumbing at
+  every call site.
+- `CultMeshOperationBindingDescriptor`, `CultMeshOperationBindingRecord`,
+  `CultMeshOperationInvocationDescriptor`, `CultMeshOperationInvocationRecord`,
+  and `CultMeshOperationPayload` are the UI/tool operation edge. Live surfaces
+  carry typed operation identity and scalar payload reads; persistence and
+  transport boundaries use `CultMesh.OperationBindingRecord(...)`,
+  `CultMesh.OperationInvocationRecord(...)`, and
+  `CultMeshOperationPayload.ToDictionary()` instead of local route parsers or
+  ad-hoc payload maps.
+- `CultMeshQuerySurface<TParameters, TResult>` is a typed derived-state query
+  surface. Query execution can be local, remote, shared-memory, IPC, or
+  WASM-routed while preserving the same semantic API. Query surfaces can also
+  carry source descriptors, route hints, and reactive watches so tools and UI
+  runtimes can inspect what state a generated query depends on, which route it
+  prefers, and subscribe without inventing polling glue. Query surfaces can be
+  bound with `Bind(...)`, `CultMesh.BindQuery(...)`, or
+  `CultMeshVerse.BindQuery(...)`.
+- `CultMeshLiveFeed<TParameters, TResult>` is a typed live view surface for
+  composed client snapshots such as an RTS viewport plus selection, health, and
+  authority panels. It gives clients one `snapshot(...)` / `watch(...)` handle
+  while preserving source descriptors and route defaults. Live feeds can be
+  bound with `Bind(...)`, `CultMesh.BindLiveFeed(...)`, or
+  `CultMeshVerse.BindLiveFeed(...)`.
+- `CultMeshDocumentHandle<TDocument>` is the typed reactive document edge for
+  CultCache/CultNet state. It exposes document metadata, one coherent
+  `LatestAsync()` read, a `Watch()` stream, and `ReplaceAsync(...)` when the
+  handle is backed by mutable state. Distributed `CultNetDatabase` handles also
+  expose `SubmitPredictionAsync(...)`, which applies a local prediction through
+  the database's configured client-authority scope and later reconciles through
+  the normal shard log. Callers can bind a projected live feed, a local
+  `CultCache` record, a distributed `CultNetDatabase` record, or a
+  `CultMeshNode` record through the same surface instead of walking transport
+  and projection layers themselves. Same-schema CLR aliases can be requested
+  directly from node/database/snapshot surfaces; CultMesh resolves the canonical
+  registered document by shared `[CultDocument(schemaName, schemaVersion)]`
+  identity and uses the shared CultCache MessagePack codec for
+  read/watch/replace/prediction conversion. `AsSchemaAlias<TAlias>()` remains
+  available when a caller already has a handle and wants to project it.
+- `CultMeshDocumentCatalog` is the schema-aware lookup edge for a set of
+  document handles. It indexes handles by CLR document type, schema name, and
+  schema version, and resolves same-schema CLR aliases by delegating to
+  `CultMeshDocumentHandle<TDocument>.AsSchemaAlias<TAlias>()`. Domain facades
+  can expose `Document<T>()`, `DocumentBySchema(...)`, `LatestAsync<T>()`, and
+  `Watch<T>()` without owning schema dictionaries or alias serializers. Mutable
+  facades can also call `ReplaceAsync<T>(...)` or
+  `SubmitPredictionAsync<T>(...)` directly on the catalog when they only need
+  the schema-aliased operation and not the intermediate handle.
+- `CultMeshCollectionHandle<TDocument>` is the typed reactive edge for
+  multi-record state. It exposes one `LatestAsync()` collection snapshot and a
+  `WatchChanges()` stream while hiding whether the backing source is an
+  in-process `CultCache`, a distributed `CultNetDatabase`, or a `CultMeshNode`.
+  Collection handles can represent all records of a document type, a named
+  document view, or an indexed value view, and they support the same
+  same-schema CLR alias conversion as document handles.
+- `CultMeshCollectionCatalog` is the collection sibling of
+  `CultMeshDocumentCatalog`. It indexes typed collection handles by CLR
+  document type, schema id, schema name, and schema version, then exposes
+  `Collection<T>()`, `LatestAsync<T>()`, and `WatchChanges<T>()` so domain
+  facades can publish typed multi-record state without maintaining parallel
+  schema lookup tables.
+- `CultMeshProjectionRecipe<TParameters, TResult>` names a reusable projection
+  from typed source state into derived state. It records source handles,
+  route hints, and projection execution, and can be exposed as a typed query
+  surface. Reactive projection recipes preserve their watcher when exposed as
+  query surfaces. When a caller supplies an automatic query context, the recipe
+  route becomes the default; explicit caller routes still win.
+- `CultMeshNativeSliceViewDescriptor` and `CultMeshNativeSliceColumn` describe
+  typed native views for co-located runtimes such as Unity Burst jobs, Rust
+  slices, or browser typed arrays. `CultMesh.DescribeNativeSliceView(...)`
+  exposes the full view id, schema id, row count, columns, route, native handle,
+  and dense stride for tools and adapters.
+- `CultMeshFrameBodyPublisher` and `CultMeshMappedFrameBodyCursor` carry
+  fixed-layout hot bodies through a triple-buffered memory mapping. Producers
+  reserve a writable slot and commit in place; consumers retain one bootstrap
+  capability and acquire only newer read leases. Windows uses a named memory
+  map; Unix uses a private file-backed map because .NET does not support named
+  maps there. The capability and cursor API is identical, and publisher
+  disposal revokes new opens and removes the Unix backing file. `Stats()` reports committed
+  frames, blocked writes, and unavoidable copies. Direct slot writes report
+  zero copies; the convenience `TryPublish(ReadOnlySpan<byte>)` path reports
+  one explicit fallback copy instead of laundering it as zero-copy transport.
+- `CultMeshRouteHint`, `CultMeshRouteRecord`, and `CultMeshLocalityKind` name
+  locality choices without forcing application code to choose transport-specific
+  APIs. `CultMesh.RouteRecord(...)` is the shared way to flatten and rehydrate
+  route kind/description fields at persisted document, UI, tool, and transport
+  boundaries.
+
+These types are intentionally small handles and descriptors. Generated bindings
+and runtime adapters should compose them into domain sugar such as
+`verse.aetheria().entity(id).pilot().move(...)`,
+`zone.objects().visibleTo(units).within(rect)`, and
+`renderView.AsNativeArrays()`.
+
+The C# helpers already support the first layer of that shape:
+
+```csharp
+var context = CultMeshOperationContext
+    .ForRuntime("unity-raven")
+    .WithClaim(new CultMeshAuthorityClaim("pilot-control", shardId: "zone:local-rts"))
+    .WithRoute(new CultMeshRouteHint(CultMeshLocalityKind.InProcess));
+
+await moveOperation.InvokeAsync(moveRequest, context);
+```
+
+Generated facades should bind surfaces once to the correct Verse view:
+
+```csharp
+var queryVerse = verse.WithRoute(new CultMeshRouteHint(CultMeshLocalityKind.SharedMemory));
+var commandVerse = verse.WithRoute(new CultMeshRouteHint(CultMeshLocalityKind.Network));
+
+var visibleObjects = queryVerse.BindQuery(objectsViewport);
+var movePilot = commandVerse.BindOperation(setMoveVector);
+
+var objects = await visibleObjects.ExecuteAsync(viewportRequest);
+await movePilot.InvokeAsync(moveRequest, idempotencyKey);
+```
+
+A single typed document can be surfaced the same way. The caller asks for the
+typed view it wants; if that type is a same-schema alias of the registered
+canonical document, CultMesh still opens the correct backing record:
+
+```csharp
+var stockForUi = CultMesh.Document<StationStockUiDocument>(
+    node,
+    new CultRecordKey("station:starbridge:stock"),
+    verse);
+
+var stock = await stockForUi.LatestAsync();
+using var watch = stockForUi.Watch(RenderStock);
+await stockForUi.SetAsync(updatedStockFromUi);
+```
+
+Projected or derived documents can use the same handle shape with explicit
+snapshot/watch delegates:
+
+```csharp
+var cockpit = CultMesh.Document(
+    "aetheria.ship.cockpit.current",
+    verse,
+    context => cockpitStore.LatestAsync(context),
+    context => cockpitStore.Watch(context),
+    sources: new[]
+    {
+        CultMesh.ProjectionSource(
+            "pilot:cockpit",
+            schemaId: "gamecult.aetheria.cockpit_state.v1")
+    });
+
+var current = await cockpit.LatestAsync();
+using var subscription = cockpit.Watch(next => RenderCockpit(next));
+
+var daemonAlias = cockpit.AsSchemaAlias<DaemonCockpitState>();
+```
+
+Remote CultNet snapshots use the same document handle surface. The caller names
+the endpoint, record key, and typed document; CultMesh owns the snapshot request
+id, response filtering, raw MessagePack payload decode, route metadata, and
+polling watch fallback:
+
+```csharp
+var remoteHealth = CultMesh.DocumentFromPeerSnapshot<DaemonHealthUiDocument>(
+    "cultnet://daemon.local:3075",
+    "daemon:aetheria.health.v1",
+    verse);
+
+var uiHealth = await remoteHealth.LatestAsync();
+```
+
+Snapshot requests are record-key-first so same logical documents can still be
+read when another runtime generated a different schema id for a compatible
+schema alias. The decode path prefers exact schema id matches when present and
+falls back to the requested record key. Ask for the runtime-facing alias type
+directly; `AsSchemaAlias<TAlias>()` is for adapting handles that were already
+constructed elsewhere.
+
+A domain facade can still collect existing handles into one schema-aware
+catalog when it is composing pre-built surfaces:
+
+```csharp
+var documents = CultMesh.Documents(
+    currentDocking,
+    stationRefit,
+    zoneContacts);
+
+var refit = await documents.LatestAsync<StationRefitDocument>();
+var uiDocking = documents.Document<CurrentDockingUiDocument>();
+var bySchema = documents.DocumentBySchema("gamecult.aetheria.station_refit.v1");
+```
+
+Typed collections use the same one-call style:
+
+```csharp
+var allies = CultMesh.CollectionByIndex<PlayerShipDocument>(
+    node,
+    "Faction",
+    "au");
+
+var currentAllies = await allies.LatestAsync();
+using var changes = allies.WatchChanges(change => UpdateRoster(change));
+
+var uiAllies = allies.AsSchemaAlias<PlayerShipUiDocument>();
+
+var collections = CultMesh.Collections(allies);
+var uiRoster = await collections.LatestAsync<PlayerShipUiDocument>();
+using var uiRosterChanges = collections.WatchChanges<PlayerShipUiDocument>(RenderRoster);
+```
+
+```ts
+const queryVerse = verse.withRoute("shared-memory", statePath);
+const commandVerse = verse
+  .withRoute("network", endpoint)
+  .withClaim("commander-control", { shardId: "aetheria.local" });
+
+const visibleObjects = CultMesh.bindQuery(queryVerse, queries.objectsViewport);
+const movePilot = CultMesh.bindOperation(commandVerse, operations.setMoveVector);
+
+const objects = await visibleObjects.execute(viewportRequest);
+await movePilot.invoke({ actorEntityKey, directionX: 1, directionY: 0 });
+```
+
+TypeScript runtimes expose the same document and collection handle shape:
+
+```ts
+const station = await CultMesh.startNode(statePath, {
+  documents: [stationStockDocument, currentDockingDocument],
+});
+
+const stock = station.document(stationStockUiDocument, "station:starbridge:stock");
+const docking = station.document(currentDockingDocument, "player:raven:docking");
+const catalog = CultMesh.documents(stock, docking);
+
+const currentStock = await stock.latest();
+const unsubscribe = stock.watch(next => renderStock(next));
+await stock.set(updatedStock);
+unsubscribe();
+
+const pilots = station.collection(playerShipUiDocument);
+const currentPilots = await pilots.latest();
+const stopRoster = pilots.watchChanges(change => refreshRoster(change));
+
+const remoteHealth = CultMesh.documentFromPeerSnapshot(
+  () => daemonPeer,
+  daemonHealthUiDocument,
+  "daemon:aetheria.health.v1",
+);
+const health = await remoteHealth.latest();
+```
+
+Projected, remote, shared-memory, IPC, WASM, and local-cache documents all use
+the same C# and TS handle contract. The caller names the typed document or
+collection it wants; the handle owns route defaults, snapshot reads, reactive
+watches, schema alias validation, prediction submission, and replacement when
+the backing source supports those mutations. Generated Aetheria and Ymir
+facades should bind those handles to a Verse once and keep transport, quorum,
+and cache mechanics behind CultMesh.
+
+Native view descriptors can name unmanaged columns without hand-entered byte
+sizes:
+
+```csharp
+var view = new CultMeshNativeSliceViewDescriptor(
+    "aetheria.zone.render",
+    "gamecult.aetheria.render_body.v1",
+    rowCount,
+    new[]
+    {
+        CultMeshNativeSliceColumn.For<CultVec2>("position"),
+        CultMeshNativeSliceColumn.For<CultVec2>("velocity")
+    },
+    new CultMeshRouteHint(CultMeshLocalityKind.SharedMemory));
+```
+
+Projection recipes give local projection code a shared shape before it becomes
+runtime-specific glue:
+
+```csharp
+var objectsViewport = CultMesh.ProjectionRecipe<ViewportRequest, ObjectsViewport>(
+    "aetheria.zone.objects.visible",
+    new[]
+    {
+        CultMesh.ProjectionSource("daemon:aetheria.frame.latest.v1", "gamecult.aetheria.daemon_frame.v1"),
+        CultMesh.ProjectionSource("daemon:aetheria.authority.policy.v1")
+    },
+    (request, context) => ProjectObjectsAsync(request, context),
+    new CultMeshRouteHint(CultMeshLocalityKind.SharedMemory));
+
+var query = objectsViewport.AsQuerySurface();
+```
+
+Calling `query.ExecuteAsync(request, "unity-raven")` inherits the recipe's
+shared-memory route. Calling it with a `CultMeshQueryContext` that already names
+`Network`, `Ipc`, `Wasm`, or another route uses the caller's route instead.
+`query.Sources` and `query.RouteHint` preserve the recipe metadata for
+diagnostics, tooling, and UI/MCP surfaces. If the projection supports reactive
+execution, `query.Watch(...)` / `query.watch(...)` keeps the same projection
+route resolution, so a browser map tab, Unity renderer, Eve surface, or MCP
+tool can subscribe through the same typed query affordance it uses for one-shot
+reads.
+
+`CultMesh.DescribeQuerySurface(...)` and
+`CultMesh.DescribeProjectionRecipe(...)` expose the same metadata in a stable
+diagnostic shape for generated clients, Eve/CultUI inspectors, MCP tools, and
+surface catalogs. Tooling should ask CultMesh for these descriptors instead of
+copying source lists and route hints by convention.
+`CultMesh.DescribeSurface(...)` and `CultMesh.DescribeSurfaceCatalog(...)`
+collect query surfaces, projection recipes, live feeds, operations, document
+handles, collection handles, state pointers, and native views into one
+inspectable catalog for a runtime or generated binding package. Documents are
+advertised by document id, collections by collection id, state pointers by
+pointer id, and native slice views by view id and route while the full column
+layout stays in `CultMeshNativeSliceViewDescriptor`.
+Catalog diagnostics support exact id lookup and kind filtering so tools can
+discover, for example, every operation or native view without local scan
+conventions. `CultMesh.DescribeSurfaceCatalogIndex(...)` / TS
+`CultMesh.surfaceCatalogIndex(...)` promotes that grouping into a shared
+diagnostic shape with `queries`, `projectionRecipes`, `liveFeeds`,
+`operations`, `documents`, `collections`, `statePointers`, and
+`nativeSliceViews`, so generated bindings and tools can ask for the semantic
+bucket they need without copying catalog scan logic.
+
+Live feeds compose several query surfaces into one client-facing snapshot
+without making the UI own refresh loops:
+
+```csharp
+var viewportFeed = CultMesh.LiveFeed<ViewportRequest, RtsViewportSnapshot>(
+    "aetheria.rts.viewport.feed",
+    (request, context) => SnapshotViewportAsync(request, context),
+    (request, context) => WatchViewport(request, context),
+    new[]
+    {
+        CultMesh.ProjectionSource("daemon:aetheria.frame.latest.v1"),
+        CultMesh.ProjectionSource("daemon:aetheria.health.latest.v1")
+    },
+    new CultMeshRouteHint(CultMeshLocalityKind.SharedMemory));
+
+var feedDiagnostics = CultMesh.DescribeLiveFeed(viewportFeed);
+```
+
+When a runtime has a snapshot path before it has native reactive transport,
+`CultMesh.PollingQueryWatcher(...)` provides a disposable watch adapter:
+
+```csharp
+var feed = CultMesh.LiveFeed<ViewportRequest, RtsViewportSnapshot>(
+    "aetheria.rts.viewport.feed",
+    SnapshotViewportAsync,
+    CultMesh.PollingQueryWatcher<ViewportRequest, RtsViewportSnapshot>(
+        SnapshotViewportAsync,
+        new CultMeshPollingWatchOptions<RtsViewportSnapshot>(
+            TimeSpan.FromMilliseconds(50))));
+```
+
+The polling adapter is intentionally a bridge primitive: application UI code
+still receives a typed `Watch(...)` handle, and the sampling loop can later be
+replaced by shared-memory, IPC, network, or WASM-native reactivity without
+changing renderer call sites.
+
+The staged roadmap for growing these handles into the cross-runtime developer
+experience lives in `docs/cross-runtime-primitives-roadmap.md`. When a project
+discovers a reusable state-ref, operation, query, projection, authority, watch,
+surface-binding, schema-generation, routing, diagnostic, or native-slab
+abstraction, it should graduate into that roadmap and then into the shared
+CultMesh/CultLib layer instead of remaining a private bridge.
+
 ### RUDP Helpers
 
 `CultMesh.ParseRudpEndpoint(...)`, `CreateRudpServer(...)`,
@@ -99,6 +516,15 @@ helpers parse endpoint contact hints and choose authorized peers;
 `GameCult.Networking` still owns the RUDP packet codec, session state, resend,
 fragmentation, and channel semantics.
 
+TypeScript runtimes can also wrap a CultNet peer snapshot as a normal document
+handle with `CultMesh.documentFromPeerSnapshot(...)`. The caller supplies the
+peer or peer factory, document definition or schema id, and record key; CultMesh
+sends the snapshot request, waits for the matching response, decodes the raw
+MessagePack document, and returns the same `latest()`/`watch()` document surface
+used by local cache and single-file documents. Exact schema ids are preferred,
+but record-key publications remain readable when two runtimes alias the same
+logical document through different schema names.
+
 ### Shard Authority
 
 Each shard has one primary writer for now. Non-primary writes are rejected or
@@ -108,12 +534,31 @@ explicitly forwarded. Stale epochs fail loudly.
 
 Consumers subscribe to typed document changes through `CultNetDatabase` watch
 methods. Subscriptions receive domain changes rather than storage envelopes.
+Exact remote values use `SubscribeLiveValueAsync<T>(...)`; they remain ephemeral
+and own their unsubscribe lifetime. Hot body state uses
+`CultMesh.SubscribeLiveBodyAsync(...)`: the reactive value is only the current
+body descriptor, while `OpenCurrentReadOnly()` negotiates shared memory,
+shared-file mapping, or network from observed locality and available adapters.
+Same-machine bodies are opened from the mapped producer slab. Remote live bodies
+are capability-bound and read through one reusable `cultmesh.bodies.v1` session;
+they are not packed into CultCache or CDN records. `CultMeshClient.BodyProvider(...)`
+creates that verified network adapter without exposing session machinery to the
+consumer. Body bytes never become subscription snapshot payload. Either subscription may
+legitimately start with `HasValue == false`; it remains active until the provider
+publishes the exact record, avoiding a startup retry loop or broad snapshot.
+`CultNetDatabaseSubscriptionServer.DemandChanged` exposes the exact requested
+record and schema set as well as optional body negotiation. A provider can
+therefore materialize a computed record only while it has consumers. The watch
+is installed before demand is announced, so the first publication travels as a
+normal live change and does not require a bootstrap snapshot.
 
 ### Client Prediction
 
 `CultNetClientAuthorityScope` declares input documents a runtime may predict.
-`PutPredictedAsync` writes local state and emits `Predicted`. When the
-authoritative log arrives, the database emits `Reconciled`.
+CultMesh document handles opened over a `CultNetDatabase` expose
+`SubmitPredictionAsync(...)`, which writes local state and emits `Predicted`
+through the configured database authority policy. When the authoritative log
+arrives, the database emits `Reconciled`.
 
 ### Replica Catch-Up
 
diff --git a/src/GameCult.Mesh/docs/reliability-migration-plan.md b/src/GameCult.Mesh/docs/reliability-migration-plan.md
new file mode 100644
index 00000000..47e1b190
--- /dev/null
+++ b/src/GameCult.Mesh/docs/reliability-migration-plan.md
@@ -0,0 +1,1256 @@
+# CultMesh Reliability Migration Plan
+
+Incident record: [CultMesh bulk content over custom RUDP, July 2026](postmortem-2026-07-cultmesh-bulk-rudp.md).
+
+Physical-plane authority: [CultMesh transport planes](transport-planes.md).
+
+## Objective
+
+CultMesh should give an application one typed, watchable route to a Verse,
+service, document, content object, or stream without making that application own
+bootstrap discovery, physical topology, reconnect loops, refresh polling, or
+transfer recovery.
+
+The migration preserves CultCache as the typed persistence substrate and
+CultNet as the transport substrate. It moves reliability policy out of callers
+and the broad `CultMesh` convenience facade into six explicit organs:
+
+1. discovery control plane
+2. connection and session manager
+3. authority resolver
+4. content transfer scheduler
+5. stream control plane
+6. negotiated body transport
+
+This is an ownership migration, not a new layer wrapped around the existing
+caller-driven machinery. Each phase cuts an obsolete decision path before its
+replacement becomes the public default.
+
+## Current Body
+
+| Organ | Current owner | Current output | Reliability gap |
+| --- | --- | --- | --- |
+| Typed persistence | CultCache | Documents, indexes, watches, `.cc` state | Not the owner of network freshness or authority |
+| Wire transport | CultNet | Schema messages, RUDP sessions, framed transports | Connection supervision and path policy are caller-owned |
+| Node composition | `CultMeshNode` over `CultNetHost` | Database, server, cache, document handles | Facade appears to own more lifecycle than it does |
+| Verse discovery | Discovery client plus caller-owned catalogs | Verse descriptors | Sequential, fail-fast, request-scoped, no durable freshness |
+| Peer exchange | Peer client plus mutable peer catalog | Contact candidates | Last-write-wins, no intrinsic expiry or provenance |
+| Authority | Lease catalog plus caller composition | Authorized peer selection | Optional composition; peer contact and trust are too easy to conflate |
+| CDN | Manifest/chunk helpers | Verified complete byte arrays | No resumable transfer, provider selection, scheduling, or eviction |
+| Streaming | In-process stream catalog | Negotiation and latest local frame handles | No distributed liveness, epochs, gaps, backpressure, or failover |
+
+The low-level RUDP implementation already covers acknowledgement, resend,
+ordering, duplicate suppression, fragmentation, timeout, and bounded pending
+work. The first migration target is therefore not a transport rewrite. It is
+the missing control plane that keeps discovery results, sessions, and transfers
+usable while endpoints fail or move.
+
+## Target Authority Map
+
+### Local persistence hydration
+
+**Owner:** the attached CultCache backing store owns durable record discovery;
+the consuming service owns its working-set selector.
+
+**Inputs:** an indexed manifest containing record key, schema identity, and
+commit time; an explicit metadata predicate supplied at open or at a later
+subscription boundary.
+
+**Outputs:** only selected typed documents enter the live cache. Record payload
+pages outside the working set remain durable and unopened. Indexed stores may
+hydrate an additional selection without replaying or evicting the existing hot
+set; non-indexed stores retain the correct full-pull fallback.
+
+**Derived state:** hydrated keys, dirty keys, and migration reports are local
+backing-store state. The manifest index remains the durable catalog even when a
+consumer has only a narrow working set in memory.
+
+**Forbidden writers:** service boot code must not scan page directories or
+deserialize broad snapshots to discover keys. A filtered flush must not delete
+unsubscribed records, and implicit global assembly discovery must not expand an
+explicit service registry.
+
+**Cut line:** directory manifests now carry metadata-only record indexes;
+explicit registries contain exactly the requested document types; selective
+pulls use the same indexed authority instead of reopening the store through a
+second compatibility path.
+
+### Discovery control plane
+
+**Owner:** `CultMeshDiscoveryService`.
+
+**Inputs:** endpoint or service identity, Verse constraints, configured
+bootstrap sources, Odin publications, LAN sources, optional DNS/DHT sources,
+clock, persistent discovery store, and source-specific lookup ports.
+
+**Outputs:** a watchable stream of signed route candidates with source,
+observed time, expiry, capabilities, transport kind, and health evidence.
+
+**Derived state:** preferred ordering, stale/degraded status, source health,
+and negative lookup cache entries.
+
+**Forbidden writers:** discovery transports, UI runtimes, peer gossip, and
+bootstrap configuration must not directly replace the resolved candidate set.
+They may only submit observations to the discovery owner.
+
+**Demotion:** `CultMeshVerseCatalog` and `CultMeshPeerCatalog` are no longer
+owners of current reachability. They become typed projections of discovery
+state for inspection and compatibility.
+
+### Connection and session manager
+
+**Owner:** `CultMeshSessionManager`.
+
+**Inputs:** stable Verse/provider identity, application protocol identity,
+discovery candidate stream, transport connectors, path policy, clock, and retry
+policy.
+
+**Outputs:** a reusable `CultMeshSession` with typed connection state, chosen
+path, protocol channel, diagnostics, and watches for state/path changes.
+
+**Derived state:** candidate ranking, backoff, circuit state, relay/direct
+preference, path migration, and last failure.
+
+**Forbidden writers:** snapshot helpers, applications, renderers, and content
+downloaders must not create their own reconnect loops or decide which endpoint
+is currently healthy.
+
+**Demotion:** physical endpoint strings are no longer application routing
+authority. They are candidates observed by discovery. Request-scoped schema
+clients become a compatibility path that delegates to a session.
+
+### Authority resolver
+
+**Owner:** `CultMeshAuthorityResolver`.
+
+**Inputs:** peer observations, signed leases, Verse policy, shard epoch,
+revocations, requested role, and requested resource scope.
+
+**Outputs:** an authorized endpoint identity and scope, or a typed denial with
+the evidence used to decide it.
+
+**Derived state:** currently valid role and shard assignments.
+
+**Forbidden writers:** peer catalogs, transport success, caches, and UI state
+must never confer authority.
+
+**Demotion:** an advertised peer card is only contact evidence. It is never an
+authorization result.
+
+#### Phase 3 body map
+
+**Owner:** `CultMeshAuthorityResolver` is the only component that decides
+whether a peer may act. Decisions are evaluated on demand and are never cached
+as grants.
+
+**Inputs:** `CultMeshAuthorityRequest`, an `ICultMeshAuthorityLeaseSource`, an
+`ICultMeshAuthoritySignatureVerifier`, an
+`ICultMeshAuthorityRevocationSource`, the current authority epoch, and an
+injected `ICultMeshClock`.
+
+**Outputs:** `CultMeshAuthorityDecision`, carrying either the accepted lease
+evidence identifiers or one typed denial reason. Authority diagnostics carry
+lease, peer, and issuer identifiers but never signature material.
+
+**Derived state:** peer selection is a projection over contact candidates and
+fresh resolver decisions. The lease catalog is only a mutable evidence source;
+the peer catalog is only a contact source.
+
+**Forbidden writers:** lease replacement, peer-card publication, successful
+transport connection, cached presence, and wall-clock defaults cannot grant or
+restore authority. Revocation and epoch policy remain outside both catalogs.
+
+**Shared paths:** gameplay sessions expose their resolver; peer selection and
+both privileged RUDP creation paths call that resolver. Compatibility overloads
+delegate to the same resolver with deny-by-default signature policy.
+
+**Cut line:** `CultMeshAuthorityLease.Covers`,
+`CultMeshAuthorityLeaseCatalog.IsAuthorized`, and catalog-owned
+`FindAuthorized`/`FirstAuthorized` no longer contain authorization logic.
+Version-zero or unsigned leases are not reinterpreted as trusted epoch-zero
+leases. Callers must supply a version-one lease, explicit epoch, signature
+verifier, and revocation source.
+
+**Compatibility inventory:** the old lease/catalog peer-selection and RUDP
+overloads remain source-compatible for migration, but cannot authorize because
+they have no signature-verification authority. They delegate to a
+deny-by-default resolver and should be replaced by resolver-taking overloads.
+
+### Content transfer scheduler
+
+**Owner:** `CultMeshContentTransferService`.
+
+**Inputs:** content hash or artifact manifest, provider observations,
+authorized sessions, cache, range/chunk verifier, transfer policy, bandwidth
+budget, and cancellation.
+
+**Outputs:** incrementally verified ranges, durable resume state, progress
+events, and an atomically committed complete artifact.
+
+**Derived state:** missing ranges, provider score, retry schedule, parallelism,
+and eviction eligibility.
+
+**Forbidden writers:** renderers and application packages must not implement
+their own chunk loops, partial-file conventions, provider failover, or final
+cache commit.
+
+**Demotion:** CDN manifests describe content. They do not own provider
+selection or prove signer authority merely by containing valid hashes.
+
+### Stream control plane
+
+**Owner:** `CultMeshStreamService`.
+
+**Inputs:** publisher identity and lease, stream descriptor, epoch, clock
+evidence, subscriber constraints, available body transports, and session
+health.
+
+**Outputs:** stream subscriptions with negotiated body transport, explicit
+sequence/gap state, liveness, priority, expiry, and failover events.
+
+**Derived state:** preferred publisher, body transport, copy budget, buffered
+window, and obsolete-object cancellation.
+
+**Forbidden writers:** a shared texture, memory ring, QUIC stream, renderer, or
+latest-frame cache must not own stream identity or publisher liveness.
+
+**Demotion:** the current in-process stream catalog becomes a local projection
+and body adapter. It is not the distributed stream registry.
+
+### Negotiated body transport
+
+**Owner:** `CultMeshBodyTransportService` owns representation negotiation and
+the lifetime of transport-specific body access. It does not own body identity,
+publisher authority, content integrity, or application semantics.
+
+**Inputs:** a typed body descriptor, authorized producer lease, consumer
+capabilities, locality evidence, schema/layout support, transport adapters,
+clock, and access policy.
+
+**Outputs:** a read-only body lease by default, bound to one logical body
+identity, schema/layout version, producer epoch, sequence, and negotiated
+transport. Local peers may receive an OS-handle capability token; remote peers
+receive the same typed body through the network representation.
+
+**Derived state:** transport preference, local/remote eligibility, mapped
+region or file-handle lifetime, slot availability, and lease expiry.
+
+**Forbidden writers:** process IDs, virtual addresses, mapping names, OS
+handles, and transport endpoints cannot become logical identity. A successful
+mapping cannot authorize a producer, extend a lease, bless content, or permit a
+consumer to mutate the body.
+
+**Demotion:** shared-memory regions and file mappings are body adapters. They
+do not become a local message bus, alternate discovery plane, or source of
+authority.
+
+## Shared Public Shape
+
+The target API is identity-first and watchable:
+
+```csharp
+await using var session = await mesh.ConnectAsync(
+    new CultMeshSessionTarget("yggdrasil.public", "odin:yggdrasil"),
+    CultMeshProtocols.Documents,
+    cancellationToken);
+
+await foreach (var state in session.WatchStateAsync(cancellationToken))
+    diagnostics.Render(state);
+
+var document = session.Document<DaemonHealth>("daemon:mimir.health.v1");
+await foreach (var current in document.WatchAsync(cancellationToken))
+    Render(current);
+```
+
+Content retrieval uses a separate owner:
+
+```csharp
+await foreach (var progress in mesh.Content.FetchAsync(
+    manifest.ContentHash,
+    destination,
+    cancellationToken))
+{
+    Render(progress);
+}
+```
+
+The convenience facade may expose these entry points, but it delegates to
+long-lived injected services. It does not contain their policy.
+
+## Phase 0: Evidence and Failure Harness
+
+Before changing ownership, establish probes at the layer where callers observe
+failure.
+
+### Build
+
+- Introduce injectable clocks, lookup sources, transport connectors, and fault
+  schedules for the new organs.
+- Add a deterministic network harness capable of loss, duplication,
+  reordering, latency, partition, endpoint rotation, corruption, and restart.
+- Define typed diagnostic events for discovery observations, candidate
+  rejection, connection attempts, path changes, retry decisions, authority
+  decisions, verified ranges, and stream gaps.
+- Record served library/schema versions in diagnostics so stale deployments
+  cannot impersonate protocol defects.
+
+### Gate
+
+- Existing RUDP and Mesh suites remain green.
+- A failing discovery timeline can be reproduced deterministically.
+- Tests can observe the public session/document state, not only internal
+  counters.
+- Diagnostics have bounded cost and can be disabled or sampled on hot paths.
+
+### Phase 0 Body Map
+
+**Owner:** reliability organs own their clocks and emit typed observations;
+`CultMeshDiagnosticBuffer` owns only a bounded inspection projection.
+
+**Inputs:** injected `ICultMeshClock`, organ state transitions, endpoint and
+source identity, reason code, and served schema/library version.
+
+**Outputs:** ordered `CultMeshDiagnosticEvent` observations. The deterministic
+test network emits scheduled packet deliveries under loss, duplication,
+reordering, latency, partition, endpoint rotation, corruption, and restart.
+
+**Derived state:** diagnostic sequence and the bounded recent-event window.
+Neither confers reachability, authority, or retry policy.
+
+**Forbidden writers:** diagnostic sinks and fault harnesses cannot choose a
+route, mutate discovery candidates, authorize a peer, or repair a session.
+
+**Shared paths:** the existing Verse discovery client now uses the injected
+clock for connection and response deadlines and emits the same typed timeline
+for success, timeout, and transport failure.
+
+**Cut line:** wall-clock reads and unobservable timeout delays have been removed
+from Verse discovery. Caller-owned catalog mutation and endpoint sequencing
+remain compatibility authority until Phase 1 replaces and demotes them.
+
+**Verification layer:** tests observe the emitted discovery timeline and served
+version, while the deterministic network harness proves exact replay of every
+required hostile-network action.
+
+## Phase Closure Contract
+
+Every implementation phase must close with all of the following:
+
+- **Visible outcome:** name the consumer behavior that improved, including its
+  behavior during failure rather than only after recovery.
+- **Authority reduction:** identify the old writer, loop, registry, or cache
+  opinion that was deleted or demoted.
+- **State transition:** document what survives restart, what is reconstructed,
+  and how existing durable state is migrated or ignored.
+- **Compatibility inventory:** list every remaining caller of a compatibility
+  surface and the condition for deleting that surface.
+- **Rollback:** roll back the consumer to the previous complete owner as one
+  unit. Never run old and new owners concurrently behind a flag that lets both
+  decide current state.
+- **Body map:** update owner, inputs, outputs, derived state, forbidden writers,
+  shared paths, cut line, and verification evidence before closing the phase.
+- **Proof:** migrate at least one real consumer and pass the hostile-network
+  cases relevant to the phase.
+
+Wire compatibility and API compatibility are tracked separately. A wire shim
+may preserve an external protocol while delegating all policy to the new owner.
+An API shim may preserve a call shape while delegating to the new service. A
+shim may not retain endpoint choice, retry policy, cache truth, or authority.
+
+## Phase 1: Discovery Ownership
+
+### Cut first
+
+- Stop discovery clients from mutating caller-owned catalogs directly.
+- Stop multi-endpoint lookup from being sequential and fail-fast.
+- Stop transient lookup failure from replacing last-known-good results with an
+  empty set.
+
+### Build
+
+- Add a narrow `ICultMeshLookupSource` port returning asynchronous candidate
+  observations with provenance and freshness.
+- Query eligible sources concurrently and merge results by stable endpoint
+  identity.
+- Deduplicate concurrent lookups for the same identity.
+- Persist last-known-good candidates and explicit positive/negative expiry in
+  CultCache.
+- Expose fresh, stale, degraded, and unavailable states distinctly.
+- Make Odin the default service/rendezvous source without making Odin the owner
+  of provider state.
+
+### Compatibility
+
+Existing `DiscoverAsync` methods delegate to the discovery service, take a
+snapshot of its current projection, and retain their result shapes. They do not
+retain an independent endpoint loop or catalog opinion.
+
+### Gate
+
+- One dead source does not discard successful results from other sources.
+- Restart reconstructs last-known-good state with preserved provenance.
+- Expired results remain inspectable but cannot masquerade as fresh.
+- Concurrent callers share lookup work without stealing results from one
+  another.
+- A poisoned or unsigned observation cannot override an accepted signed
+  candidate.
+
+### Phase 1 Body Map
+
+**Owner:** `CultMeshDiscoveryService` owns current candidate observations,
+freshness, source failures, positive/negative expiry, and shared in-flight
+lookup work for a stable identity plus constraints.
+
+**Inputs:** `ICultMeshLookupSource` observations, injected clock, optional
+`ICultMeshDiscoveryStore`, query identity/Verse constraints, and caller-local
+cancellation.
+
+**Outputs:** watchable `CultMeshDiscoveryState` projections with fresh,
+degraded, stale, or unavailable status; persisted
+`gamecult.mesh.discovery_state.v1` last-known-good documents; typed diagnostic
+events.
+
+**Derived state:** failed-source lists, retry-after time, candidate ordering,
+and legacy `CultMeshVerseCatalog` contents. The catalog is no longer a lookup
+writer.
+
+**Forbidden writers:** lookup sources cannot replace the candidate set, caller
+cancellation cannot cancel shared lookup work, and rejected observations cannot
+override accepted candidates.
+
+**Shared paths:** direct service callers and compatibility `DiscoverAsync`
+both use concurrent source lookup and the same freshness merge. Compatibility
+projects the service result into the old catalog only after resolution.
+
+**Cut line:** sequential fail-fast endpoint lookup and per-response catalog
+mutation have been removed from Verse discovery. Physical endpoint lookup
+remains available only as a compatibility source observation.
+
+**State transition:** restart loads the typed CultCache discovery document.
+Expired candidates remain inspectable as stale; unavailable results retain a
+bounded negative expiry before sources are queried again.
+
+**Compatibility inventory:** `AetheriaRuntimeVerseDiscovery` remains the only
+known caller of `DiscoverAsync(catalog, endpoints)`. It receives the service
+projection now and should migrate to watching `CultMeshDiscoveryState` during
+the Phase 2 Aetheria session migration.
+
+**Rollback:** revert the service, store document, and compatibility delegation
+as one unit. Do not run sequential catalog mutation alongside service-owned
+resolution.
+
+**Proof:** Mesh tests cover concurrent good/dead sources, shared in-flight work,
+caller-local cancellation, negative expiry, signed precedence, stale-on-error,
+public state watches, and CultCache restart reconstruction. Networking tests
+prove the compatibility method retains a good concurrent source.
+
+## Phase 2: Long-Lived Sessions
+
+### Cut first
+
+- Remove direct request-scoped client creation from snapshot, Verse discovery,
+  and peer-exchange implementations.
+- Remove application-owned reconnect and endpoint-selection loops from the
+  first migrated consumer.
+
+### Build
+
+- Introduce `ICultMeshTransportConnector` and a session manager keyed by
+  endpoint identity plus application protocol.
+- Reuse in-flight connection attempts and established sessions.
+- Race eligible physical candidates under a bounded policy.
+- Provide typed reason codes for resolution, authentication, transport,
+  protocol, timeout, cancellation, and authority failures.
+- Expose watchable online, degraded, reconnecting, and offline states.
+- Keep relay/tunnel/direct choice behind the connector boundary.
+- Replace ambiguous physical schemes with typed transport candidates. Logical
+  `cultmesh://` routes remain identity/service references.
+
+### First consumer
+
+Migrate Aetheria runtime discovery or EveUnity provider discovery end to end.
+The selected consumer must no longer block a main thread, clear good state on a
+transient outage, or hand-assemble snapshot options from physical topology.
+
+### Gate
+
+- Endpoint rotation does not change application identity or document handles.
+- A partition produces degraded/stale state before unavailable state according
+  to explicit policy.
+- Reconnect does not duplicate subscriptions or operations.
+- UDP denial exercises a supported relay/tunnel/fallback path or emits a precise
+  unsupported-path result.
+- The legacy request path cannot open a second competing session.
+
+### Phase 2 Body Map
+
+**Owner:** `CultMeshSessionManager` owns physical path selection, replacement,
+and reconnect. A live document or collection binding owns only its logical
+subscription intent and readiness promise.
+
+**Inputs:** stable endpoint and protocol identity, discovery candidates,
+connector results, session state transitions, typed schema and record filters,
+and client disposal.
+
+**Outputs:** one reusable logical session, subscription replay on each new
+online physical incarnation, cache-backed typed handles, and readiness after
+the first successful snapshot from any incarnation.
+
+**Derived state:** physical client identity and generation, attempt count,
+cached snapshots, and online/reconnecting/offline projections. The session
+increments the generation only after replacing its physical channel. A binding
+may coalesce duplicate subscription attempts within that generation, but a
+pending request from an older generation cannot suppress replay. No individual
+request owns the logical handle. Within one healthy generation, an unanswered
+subscribe request expires on the client policy deadline and the binding
+replays the same idempotent subscription intent; the caller does not own this
+retry loop.
+
+**Forbidden writers:** bindings and schema clients cannot choose endpoints,
+replace channels, reconnect, or declare session state. An abandoned initial
+subscribe request cannot block a replacement request from satisfying logical
+readiness.
+
+**Shared paths:** initial open and reconnect both use session-manager path
+resolution. Document and collection activation both replay the same binding
+intent once per physical generation when the logical session returns online.
+
+**Cut line:** the initial subscribe no longer runs before reconnect observation,
+and a per-binding semaphore no longer lets an unanswered physical request hold
+all later replay attempts. Bindings become client-owned resources before
+waiting for readiness, so disposal terminates pending opens.
+
+**Verification layer:** Mesh tests lose the first document and collection
+snapshot, fail the physical client, and prove the replacement snapshot opens
+the same logical handle exactly once. A disposal test proves a pending open
+cannot survive its owning client. Another test drops a subscription response
+without dropping the physical path and proves the same binding becomes ready
+after bounded replay. The Aetheria/EveUnity witness proves provider
+discovery, live SoA state, commands, receipts, and assets through the migrated
+session path.
+
+### Phase 2 TypeScript provider-lifecycle slice
+
+**Owner:** `CultMeshProviderSession` owns one TypeScript provider's discovery
+registration, lease renewal, physical reconnect, desired typed publication
+replay, command dispatch, receipt publication, and explicit withdrawal. It is
+keyed by provider, service-instance, endpoint, and Verse identity; those
+identities are never collapsed.
+
+**Inputs:** an injected `CultMeshProviderTransport`, stable provider identity,
+lease/reconnect policy, desired typed publications, domain command handlers, a
+required durable receipt store, and an injected scheduler.
+
+**Outputs:** watchable connecting/active/reconnecting/withdrawing/stopped
+state, current lease evidence, ordered document publication, a durable typed
+receipt outbox, and withdrawal of the lease plus remaining publications.
+
+**Derived state:** reconnect attempt, backoff, current physical connection, and
+the in-flight duplicate-command set. Pending receipt delivery is derived from
+the durable receipt store, not volatile session memory. Provider state, Eve surface semantics,
+command effects, endpoint discovery evidence, and body-producer identity are
+not derived by the session.
+
+**Forbidden writers:** renderers, HTML exporters, and scheduled projection
+scripts may not register providers, renew leases, reconnect, publish receipts,
+or withdraw provider state. A transport connection cannot mutate provider
+domain state or treat successful delivery as authorization.
+
+**Shared paths:** initial connect and reconnect both register, subscribe, and
+replay the same desired publication set. Live publication updates use one
+serialized lane, so an older update cannot arrive after a newer one. Duplicate
+command deliveries share one in-flight transaction and later deliveries reuse
+the durable receipt. A receipt is stored before publication and marked only
+after acceptance; reconnect drains pending receipts before command intake.
+
+**Cut line:** TypeScript one-shot RUDP publication helpers remain low-level
+compatibility surfaces, not provider lifecycle owners. VoidBot's swarm renderer
+is the first identified obsolete owner; its provider catalog mutation,
+publication, reconnect, and receipt paths must be deleted when it adopts this
+session. That consumer migration is still open and must not run both owners.
+
+**Verification layer:** deterministic TypeScript tests prove initial
+registration, renewal, stable publication order, reconnect and replay,
+duplicate receipt reuse, explicit withdrawal, and the negative stop-during-
+registration timeline, durable receipt replay, observer isolation, conflicting
+command IDs, and exception-safe shutdown. The empty-consumer tarball smoke proves the session is
+present in the installable `cultmesh-ts` package. A live Odin transport adapter
+and the VoidBot migration remain required for the production proof.
+
+## Phase 3: Authority as a Mandatory Boundary
+
+### Cut first
+
+- Remove helpers that select an advertised peer for authoritative work without
+  an authority decision.
+- Prevent transport success or catalog presence from being treated as trust.
+
+### Build
+
+- Resolve authority through one injected resolver before opening privileged
+  document, operation, shard, or publisher routes.
+- Verify signatures, scope, epoch, validity interval, and revocation policy.
+- Publish authority diagnostics without leaking secret material.
+- Make authorization results short-lived derived state, never durable truth.
+
+### Gate
+
+- Expired, revoked, wrong-Verse, wrong-role, and wrong-shard leases are rejected.
+- A newer peer card cannot revive an expired lease.
+- Cache replay and clock movement cannot grant authority.
+- Manual and programmatic operations use the same authority primitive.
+
+## Phase 4: Verified Content Transfer
+
+### Phase 4 first-slice body map
+
+**Owner:** `CultMeshContentTransferService` owns verified partial state and the
+only promotion path into the completed content cache. Work is serialized and
+shared by normalized content hash; provider identity is never part of content
+identity or the destination name.
+
+**Inputs:** a validated CDN manifest, ordered `ICultMeshContentProvider`
+observations, a typed CultCache checkpoint store, a canonical cache directory,
+and caller cancellation.
+
+**Outputs:** a complete read-only-by-convention body path named by SHA-256, or
+a failure with no completed body. `gamecult.mesh.content_transfer_state.v1`
+records verified chunk indexes keyed by content hash.
+
+**Derived state:** missing chunks, provider failover order, deterministic
+partial-file path, manifest fingerprint, and completed cache path. A provider
+success is evidence only for the returned chunk; it does not confer publisher
+authority.
+
+**Forbidden writers:** callers, renderers, providers, manifests, and the legacy
+async CDN reader cannot publish a final body or mark a range verified. CultCache
+checkpoint claims are rehashed against the partial body before reuse.
+
+**Shared paths:** direct transfers and the legacy distributed-database reader
+both pass through the same chunk verification, full-hash verification, and
+atomic promotion primitive. Concurrent requests for one hash share the same
+per-content transfer lock and verified work.
+
+**Cut line:** the legacy distributed reader no longer owns a sequential chunk
+loop or whole-artifact allocation. The transfer owner now opens a bounded
+per-content request window while preserving one ordered writer/checkpointer.
+Adaptive scheduling, quotas, pinning, signer policy, arbitrary streaming
+destinations, and cleanup scheduling remain later Phase 4 work.
+
+**State transition:** each verified chunk flushes a typed checkpoint. Restart
+rehydrates that record, rehashes every claimed range, and fetches corrupt or
+unclaimed chunks again. Completion verifies the entire partial file, atomically
+promotes it, and removes the checkpoint. Cancellation leaves only re-verifiable
+partial state.
+
+**Verification layer:** focused tests cover durable cancellation/restart,
+provider corruption and failover, forged checkpoint rejection, final-hash
+failure, atomic visibility, concurrent request coalescing, bounded concurrent
+fetch, ordered checkpointing under out-of-order completion, and observation of
+the whole request window after an early failure. Existing CDN tests cover the
+compatibility reader.
+
+### Phase 4 managed content-session slice
+
+**Owner:** `CultMeshContentTransferService` still owns verification, resumable
+state, provider failover, and atomic promotion. `CultMeshSessionContentProvider`
+owns only one bounded request/response projection over a reusable
+`cultmesh.content.v1` session; `CultMeshContentServer` owns only serving
+canonical content-addressed chunks from provider storage.
+
+**Inputs:** stable provider endpoint identity, the shared session manager, a
+validated manifest chunk reference, provider CultCache content, response
+deadline, and caller cancellation.
+
+**Outputs:** one manifest-bound chunk response to the transfer service. The
+session manager retains connection/reconnect/path authority, and the transfer
+service decides whether the response becomes verified partial state.
+
+**Derived state:** request correlation identities and content-session physical
+channels. Neither is content identity, authority evidence, or cache truth.
+
+**Forbidden writers:** snapshot servers cannot embed artifact payloads in raw
+document responses; the session provider cannot write partial/final files,
+mark ranges verified, choose a replacement endpoint, or authorize a producer.
+
+**Shared paths:** every cold network chunk enters the same incremental and
+final verification path used by database and test providers. Concurrent chunks
+borrow the same logical content session.
+
+**Cut line:** bulk CDN bytes no longer require
+`CultNetSnapshotResponseRawMessage` records. Snapshots retain manifests and
+descriptors; the managed content protocol carries bounded payload responses.
+
+**Verification layer:** Mesh tests transfer a multi-chunk body through one
+managed session, assert zero snapshot requests, assert warm committed reuse
+without another network request, and round-trip both wire messages through the
+schema dispatcher. RUDP schema hosts and managed clients distinguish transport
+progress from dispatched messages and drain bounded available work without
+idle sleeps. Wire sends cooperatively yield after each 32-packet acknowledgement
+window without sleeping for a Windows scheduler quantum; a real UDP
+content-session test transfers a four-chunk, one-megabyte request window through
+the public transfer owner within its ten-second regression bound.
+The released EveUnity/Aetheria `cold-start-lowering` run now promotes the
+46,412,384-byte bundle to its exact SHA-256 `.body` under the unchanged
+300-second deadline with no partial left behind. It starts with zero bodies,
+lowers the provider-owned world after promotion, and proves pilot/map camera
+separation. The separate `full-session-gameplay` profile starts a fresh warm
+daemon session and proves combat, destruction-created canonical loot, Ymir
+contact collection, and exactly-once cargo mutation. This split is deliberate:
+cold download latency does not own the lifetime of transient gameplay objects.
+Content-session delivery and product lifecycle are proven without claiming a
+mapped/zero-copy transfer; the managed session still copies and fragments the
+body in process.
+
+### Phase 4 transport parity and body-plane cut
+
+**Owner:** CultMesh negotiation selects a body transport from provider-owned
+capabilities and consumer demand. The selected transport owns byte movement;
+`CultMeshContentTransferService` continues to own content identity, resumable
+verification, and atomic cache promotion. TCP owns remote immutable content;
+CultNet RUDP does not own bulk-body performance.
+
+**Inputs:** content hash and size, provider-advertised transport candidates,
+consumer-supported transports, same-machine evidence, and platform support.
+
+**Outputs:** an authorized mapped body for same-machine deployments, or a
+dedicated TCP byte stream feeding the existing verification/promotion owner.
+Schemas, commands, receipts, and manifests use framed TCP CultNet messages.
+Realtime state uses a separately negotiated QUIC stream or datagram and is not
+smuggled through either snapshots or the immutable-content stream.
+
+**Derived state:** selected plane, physical endpoint, mapped-file descriptor,
+stream progress, and transport telemetry. None can change content identity,
+provider authority, or the final verified cache record.
+
+**Forbidden writers:** applications and renderers cannot choose an unadvertised
+path or turn a local filesystem path into authority. Snapshot and schema-message
+helpers cannot regain ownership of immutable body bytes. A remote stream cannot
+publish a completed body without the transfer owner's hash verification and
+atomic promotion.
+
+**Shared paths:** every remote plane terminates in the same partial-file,
+checkpoint, final-hash, and promotion primitives. Same-machine mapping uses the
+same advertised content hash and provider authorization but does not copy the
+body merely to prove that two processes inhabit one machine.
+
+**Cut line:** request-window and scheduler-yield tuning is not the bulk-content
+roadmap. RUDP remains a compatibility fallback while dedicated stream and local
+mapping planes are integrated. The old fallback stays unable to become the
+preferred same-machine or remote bulk plane through timing tweaks.
+
+**Parity evidence:** `tools/GameCult.TransportParity` measures the public
+CultMesh RUDP content path against file mapping, TCP, and .NET's MsQuic-backed
+QUIC stream with the Aetheria 56,204,750-byte body size. On the 2026-07-19
+Windows development host, a representative released-source run opened the
+existing mapped body in 10.9 ms, moved and verified it over TCP in 213.8 ms
+(250.7 MiB/s), moved and verified it over QUIC in 753.4 ms (71.1 MiB/s), and
+moved it through CultMesh RUDP in 5,322.9 ms (10.1 MiB/s) while emitting
+129,241,066 server bytes. Repeated QUIC runs reached 87.0-107.4 MiB/s; repeated
+RUDP runs reached 10.1-13.0 MiB/s. This is a plane-selection result, not a case
+for a more elaborate home-grown congestion controller.
+
+**Dedicated references:** .NET's stable `System.Net.Quic` API delegates to
+MsQuic on supported platforms:
+https://learn.microsoft.com/dotnet/fundamentals/networking/quic/quic-overview.
+MsQuic publishes its performance methodology and dashboard at
+https://microsoft.github.io/msquic/. Valve GameNetworkingSockets remains a
+candidate for the cross-platform realtime message plane because it provides
+reliable/unreliable messages, acknowledgement vectors, fragmentation,
+congestion behavior, encryption, and priority lanes:
+https://github.com/ValveSoftware/GameNetworkingSockets.
+
+### Phase 5 verified CDN mapped-body slice
+
+**Owner:** `CultMeshContentTransferService` remains the sole writer and promoter
+of completed CDN bodies. `CultMeshVerifiedBodyMappingBroker` owns only ephemeral,
+opaque capability-to-file grants for those completed bodies. Body negotiation
+and producer authorization remain owned by `CultMeshBodyTransportService`.
+
+**Inputs:** the atomically committed `<sha256>.body` path returned by transfer,
+the equivalent network body descriptor, and a bounded lease.
+
+**Outputs:** a read-only file-mapping descriptor for the same logical generation.
+Multiple consumers map the same completed cache file and therefore share the OS
+page cache; no process-sized byte array or republished body file is created.
+`CultMeshMappedContent` binds that descriptor to the exact final path returned
+by the transfer owner, so runtime lowerers never reconstruct cache layout.
+
+**Derived state:** opaque capability tokens and their expiry. Tokens are neither
+content hashes nor paths and do not confer producer authority or content trust.
+
+**Forbidden writers:** the mapping broker and adapter cannot create, promote,
+rename, repair, or map partial/checkpoint files. `CultMeshMappedBodyPublisher`
+is not used for verified CDN content.
+
+**Shared paths:** local and network descriptors preserve body identity,
+schema/layout, capacity, producer epoch, sequence, and byte size. Local open
+failure is observed by body negotiation and falls back to that network
+representation.
+
+**Cut line:** there is no second CDN publication path. Mapping is granted only
+after the transfer owner returns its verified final file. The compatibility
+descriptor-only method delegates to the path-and-descriptor result rather than
+repeating transfer or cache-path policy.
+
+### Cut first
+
+- Delete the first consumer-owned CDN chunk loop and partial-file convention.
+- Stop requiring whole-artifact allocation before verification or delivery.
+
+### Build
+
+- Preserve content identity independently of provider and location.
+- Add durable partial-transfer state keyed by content hash and verified range.
+- Fetch missing ranges/chunks with bounded adaptive concurrency.
+- Select and fail over between eligible providers without changing artifact
+  identity.
+- Verify incrementally and commit completed artifacts atomically.
+- Support caller-provided streaming destinations and backpressure.
+- Add manifest signer policy separately from content hash integrity.
+- Define cache quota, pinning, eviction, and partial-transfer cleanup.
+
+### Gate
+
+- Restart resumes verified work without rereading corrupt or incomplete ranges
+  as trusted.
+- Provider failure moves remaining work to another provider.
+- Corruption identifies the failing range/provider and retries within policy.
+- Concurrent requests for one artifact share verified work.
+- Cancellation leaves a valid resumable checkpoint or removes unusable partial
+  state.
+- The old renderer-owned downloader can no longer write the final cache entry.
+
+## Phase 5: Negotiated Zero-Copy Data Plane
+
+CultNet/CultMesh remains the control plane for identity, discovery, schemas,
+capabilities, leases, epochs, liveness, receipts, and body-transport
+negotiation. The existing network representation remains the remote path and
+the fallback whenever local negotiation, handle transfer, schema validation,
+or lease validation fails.
+
+### Cut first
+
+- Stop embedding process-local mapping names, process IDs, virtual addresses,
+  or native handles in logical body identity.
+- Stop local body adapters from interpreting transport access as producer
+  authority or content validity.
+- Do not create a general shared-memory message bus for reactive documents,
+  commands, advertisements, or receipts.
+
+### Body contract
+
+Define one typed shared-body descriptor containing:
+
+- logical body identity
+- schema identity and layout version
+- byte size and logical capacity
+- producer epoch and body sequence
+- access mode
+- synchronization method
+- lease expiry
+- transport kind
+- an opaque OS-handle capability token when negotiated locally
+
+The capability token is scoped, expiring transport material. It is never
+serialized as durable identity. The same descriptor semantics must bind a
+local shared-memory body and its remote network representation.
+
+### Build order
+
+1. Define the transport-neutral typed body descriptor, lease, adapter ports,
+   and validation rules.
+2. Negotiate shared-memory capability and exchange OS handles through an
+   authenticated platform adapter; retain network fallback.
+3. Map immutable CultMesh CDN artifacts as content-addressed, file-backed,
+   read-only bodies keyed by verified hash so processes share OS page cache.
+4. Map fixed-capacity, schema-versioned SoA frame regions using triple
+   buffering or an epoch/sequence protocol. Consumers receive read-only views,
+   detect stale epochs, and never receive raw pointers.
+5. Add local/remote equivalence, fallback, reconnect, crash, corruption, and
+   conformance tests.
+6. Profile copy volume, latency, memory pressure, page-cache reuse, frame
+   drops, and lease contention under real EveUnity/Aetheria workloads.
+7. Decide from measurements whether ordinary local control traffic merits a
+   separate shared-memory lane. Do not build that lane as part of this phase.
+
+### Frame-region authority
+
+**Owner:** `CultMeshFrameRegion` is the sole owner of one fixed-capacity,
+schema/layout-versioned, producer-epoch-bound triple buffer. It owns slot
+storage, write reservations, reader protection, publication metadata, latest
+generation selection, sequence advancement, and contention statistics.
+
+**Inputs:** logical body identity, schema identity, layout version, logical
+capacity, producer epoch, slot byte length, frame bytes, and commit metadata.
+The bounded producer contract permits at most one outstanding write reservation
+for the region, so sequence assignment and slot reservation cannot diverge.
+
+**Outputs:** bounded write leases, immutable generation descriptors, read-only
+consumer leases, and owner-derived statistics. Publication installs bytes and
+metadata as one locked commit and advances sequence exactly once.
+
+**Derived state:** `CultMeshSharedMemoryFrameRing` handles and statistics are
+compatibility projections of region generations. Capability tokens remain
+transport material and do not participate in frame identity or generation
+validation.
+
+**Forbidden writers:** the compatibility ring has no slot buffers, cursors,
+reader counts, latest-slot state, frame-handle catalog, sequence counter, or
+independent commit path.
+
+**Shared paths:** direct SoA writes, compatibility zero-copy writes, and
+compatibility copy publication all reserve and commit through
+`CultMeshFrameRegion`. Direct and compatibility reads acquire the same owner
+lease and release the same reader count.
+
+**Cut line:** the former ring-owned arrays and counters are removed. A frame
+region always has exactly three slots; construction with another slot count is
+rejected rather than creating a second buffering model.
+
+### Required invariants
+
+- Only an explicitly authorized producer may publish or advance a body.
+- Consumers are read-only unless a distinct contract explicitly grants write
+  authority.
+- Producer or broker death invalidates leases without requiring cooperative
+  cleanup from the dead process.
+- A producer cannot overwrite a slot while any valid consumer lease protects
+  it.
+- Schema/layout, producer epoch, and sequence mismatches are rejected before
+  bytes are interpreted.
+- Reconnect creates a new validated lease and cannot reinterpret stale mapped
+  memory from an earlier producer epoch.
+- Content hash integrity remains distinct from publisher identity and
+  authority.
+- Negotiation failure is observable and falls back to the network body without
+  changing logical body identity.
+
+### Phase 5 local/remote conformance slice
+
+**Owner:** `CultMeshBodyTransportService` owns representation selection for one
+validated logical generation. Each transport adapter owns only acquisition and
+pre-interpretation validation of its representation. Producer authorization is
+an independent input to negotiation; a valid digest never grants authority.
+
+**Inputs:** equivalent local and network descriptors, the consumer's expected
+body identity/schema/layout/capacity/epoch/sequence, an authorized-producer
+decision, registered transport adapters, and network bytes carrying the
+descriptor-bound semantic digest.
+
+**Outputs:** one read-only lease for the selected representation plus a typed
+negotiation result that records the selected transport and any rejected local
+attempt. Local and network leases expose the same logical descriptor fields and
+semantic bytes.
+
+**Derived state:** local preference, adapter availability, and fallback reason
+are negotiation state only. Capability tokens and network fetch details remain
+transport material and cannot alter logical body identity.
+
+**Invariants:** both descriptors must agree on body identity, schema, layout,
+byte size, capacity, producer epoch, sequence, synchronization, access mode,
+and semantic digest before either representation is opened. Lease expiry is
+representation lifetime, validated independently for each descriptor; it is
+not logical generation identity because a local broker may issue a shorter
+capability lease than the network representation.
+Expected schema, layout, capacity, epoch, and sequence are validated before a
+network fetch. Fetched network bytes are digest-verified before a lease is
+created or any typed read is possible. Digest integrity does not authorize the
+publisher.
+
+**Forbidden writers:** adapters, fallback handling, capability material,
+network payloads, and integrity checks cannot rewrite logical identity or grant
+producer authority. A failed local adapter cannot repair, mutate, or reinterpret
+the network descriptor.
+
+**Shared paths:** successful local open and network fallback use the same
+logical-generation equivalence check and consumer validation request. Direct
+network consumption uses the same pre-interpretation descriptor and digest
+validation as fallback consumption.
+
+**Cut line:** replace exception-only fallback reporting with a typed negotiation
+result while retaining the existing overload as a delegating compatibility
+surface. Add only descriptor-bound semantic integrity; do not add a shared-memory
+control bus, content-authority inference, reconnect policy, or profiling hooks.
+
+**Verification layer:** conformance tests compare descriptor semantics and full
+bytes across file mapping, shared memory where supported, direct network, and
+network fallback. Negative tests prove stale schema/epoch/sequence are rejected
+before fetch, corrupt network bytes never produce a lease, local failure is
+reported, fallback preserves identity, and authorization is evaluated separately
+from content integrity.
+
+### Phase 5 exact-demand body map
+
+**Owner:** `CultMeshBodyDemandTracker` owns the live derivation from retained,
+exact database subscriptions to the transport representations a producer must
+publish. The provider owns body contents. A body adapter owns only access to
+one representation. A renderer owns none of those decisions.
+
+**Inputs:** consumer runtime identity, exact logical body IDs, advertised
+consumer transport capabilities, and server-observed peer locality. A
+same-machine claim selects shared memory only when the transport peer is
+actually loopback and the consumer explicitly supports shared memory. When
+named shared memory is unavailable but the consumer can map files, the same
+locality proof selects shared-file mapping before network.
+
+**Outputs:** a per-body plan requiring shared memory, network, both, or no
+publication. Producers use that plan before allocating, copying, hashing, or
+packaging a representation.
+
+**Derived state:** transport preference and publication work are notification
+state derived from active subscriptions. Heavy database snapshots remain
+bootstrap/recovery state. They are not a frame delivery mechanism.
+
+**Forbidden writers:** providers cannot infer demand from renderer identity;
+renderers cannot choose a provider-specific plane; CDN publication cannot run
+unconditionally beside a local mapped write; body descriptors cannot create
+stream demand merely by existing.
+
+**Shared paths:** subscribe, resubscribe, replacement, explicit unsubscribe,
+and server disposal all update the same typed demand projection. Stable peer
+identity, not per-message wrapper identity, keys subscription lifetime.
+
+Exact reactive document demand carries the requested record and schema set even
+when no hot body is involved. Providers may use that demand to materialize
+computed documents lazily; the subscription watch exists before activation is
+reported, so frame zero is delivered on the live path. Dynamic state is not
+forced back through a broad snapshot merely because the record did not exist at
+subscribe time.
+
+The client installs the declared delivery mode before sending the subscription.
+A provider may publish synchronously from demand activation, so a live change
+can correctly precede the empty bootstrap acknowledgement without briefly
+becoming durable replica state.
+
+`CultMesh.SubscribeLiveBodyAsync(...)` is the narrow public construction path.
+Its `CultMeshLiveBodySubscription` names only the logical body, consumer, and
+subscription lifetime. `CultMeshLiveBody` owns the ephemeral latest-publication
+value and opens the current generation through the fastest valid representation
+the resolver can actually import. Layout and other small state are independent
+exact reactive values, so changing one variable does not redeliver an unrelated
+view document or body. A subscription may predate frame zero: absence is an
+uninitialized live value, not a failed subscription, and demand remains active
+until the first descriptor arrives.
+
+`CultMesh.SubscribeHotBodyAsync(...)` remains the grouped compatibility path. Its
+`CultMeshHotBodySubscription` keeps the exact view record, the body's stable
+latest-publication record, consumer identity, and logical body demand in one
+contract. The local `CultMeshBodyTransportService` contributes only adapters it
+can actually open, ordered shared-memory first; the server combines those
+capabilities with observed peer locality. Applications do not hand-assemble
+transport-name arrays or request one snapshot per frame. Hot-body subscriptions
+default to `Live`: their exact initial metadata is decoded for bootstrap, then
+subsequent layout/publication changes remain ephemeral notifications. Durable
+cache replication is an explicit opt-in for consumers that actually own a
+replica requirement.
+
+### Reactive document delivery body map
+
+**Owner:** the subscription declaration owns whether a selected typed document
+is durable replica state or an ephemeral live value. The provider still owns
+the value; the transport and renderer own neither its persistence nor meaning.
+
+**Inputs:** exact record/schema filters and an explicit
+`CultNetDatabaseSubscriptionDeliveryMode`. `ReplicateToCache` materializes
+bootstrap and durable state before notification. `Live` validates and decodes
+the same typed payload, then notifies the subscriber without a replica write.
+High-rate body subscriptions select `Live` by default; general database
+subscriptions retain the durable default because CultMesh cannot infer their
+ownership contract.
+
+**Outputs:** both modes produce the same typed initial values and change event.
+Only durable replication mutates the consumer's CultCache.
+
+`CultNetDatabaseSubscriptionClient.SubscribeLiveValueAsync<T>(...)` is the
+single-record ergonomic path. Its `CultNetLiveValue<T>` owns the exact
+record/schema filter, current value, typed change/removal notifications, and
+unsubscribe lifetime. Consumers no longer need a process-wide change handler,
+an object type switch, or a renderer-local replica cache to model one reactive
+variable. The value may start absent and become initialized on its first matching
+change without resubscribing.
+
+**Derived state:** renderer-local presentation and reactive variables are
+derived from live notifications. They are not database records merely because
+CultNet carried them.
+
+**Forbidden writers:** renderers and products cannot add polling, keepalive
+writes, or broad snapshots to repair callback latency. Ephemeral receipts,
+input facts, and frame-layout notifications cannot silently become disk-backed
+replica history.
+
+**Shared paths:** exact subscription filters, wire schema validation,
+deserialization, unsubscribe, disconnect cleanup, and body-demand negotiation
+are identical in both modes. Only the final materialization decision differs.
+
+**Cut line:** `CultNetDatabaseSubscriptionClient` no longer requires every
+received document to complete a CultCache write before the consumer may see it.
+Durable documents retain the existing replica path; live values bypass it.
+
+**Cut line:** local frame publication writes directly into a mapped write lease
+and commits its descriptor. The compatibility byte-array publisher is copy-in
+only. The current remote frame representation may still use the verified CDN
+body path when remote demand exists; Phase 6 must replace that expiry-sensitive
+traffic with a stream/datagram body plane rather than enlarging snapshot or CDN
+timeouts.
+
+### RUDP session mutation body map
+
+**Owner:** each socket transport binding serializes access to its own RUDP
+reliability session. The server owns one serialization gate per peer; a client
+connection owns one gate for its session.
+
+**Inputs:** concurrent typed publication, command and receipt sends, inbound
+ACK/data processing, handshake state, timeout checks, and resend polling.
+
+**Outputs:** one coherent packet sequence and fragment stream per peer, with
+reliable-packet bookkeeping updated in the same critical section as packet
+creation and transmission.
+
+**Derived state:** schema messages, database subscriptions, and Eve reactive
+variables are consumers of the reliable control plane. They do not own packet
+ordering and must not serialize their own publication loops.
+
+**Forbidden writers:** daemon schedulers, renderers, and provider sessions
+cannot mutate `CultNetRudpSession` directly or add retries, replacement
+snapshots, and artificial publication delays to compensate for concurrent
+transport calls.
+
+**Shared paths:** application send, receive/ACK, resend, connect, disconnect,
+ping, and timeout inspection all enter through the same per-session gate.
+Fragments belonging to one logical send are emitted before another thread may
+allocate sequence numbers for that peer.
+
+**Cut line:** all socket-backed `CultNetRudpSession` mutation is behind the
+transport-owned gate. Product code no longer has to choose between concurrent
+simulation publication and reliable delivery.
+
+Reliable control messages larger than the RUDP receive mask explicitly
+acknowledge the packet just received. A retransmit older than the rolling
+32-packet summary can therefore always leave the sender queue; the rolling mask
+remains useful for piggyback acknowledgements but is not allowed to strand a
+fragment indefinitely.
+
+### Gate
+
+- Two local consumers map one verified CDN artifact without duplicate process
+  copies and observe identical content identity through the network fallback.
+- An EveUnity consumer reads successive SoA generations without torn frames,
+  raw pointers, or overwrite of a leased slot.
+- Producer crash, lease expiry, schema upgrade, epoch rollover, and reconnect
+  all reject stale mappings before interpretation.
+- A forged handle token, unauthorized producer, writable consumer request, or
+  valid hash from an unauthorized publisher cannot cross its respective
+  authority boundary.
+- Local and remote conformance packs expose the same typed body lifecycle and
+  semantic payload.
+
+## Phase 6: Distributed Stream Control
+
+### Cut first
+
+- Stop treating process-local descriptor presence or a latest frame handle as
+  publisher liveness.
+- Stop allowing body adapters to overwrite stream ownership.
+
+### Build
+
+- Add publisher leases and monotonically increasing epochs.
+- Model streams as named tracks containing independently schedulable groups or
+  objects rather than one immortal ordered byte stream.
+- Separate reliable control state from expiry-sensitive media bodies.
+- Express sequence gaps, end-of-stream, cancellation, and subscriber priority.
+- Negotiate shared memory or GPU handles locally and network streams/datagrams
+  remotely through the same control state.
+- Define failover and clock-confidence policy explicitly.
+
+### Gate
+
+- Publisher death is detected without relying on missing frames alone.
+- A stale publisher cannot overwrite a newer epoch.
+- Congestion cancels obsolete media work without blocking current control
+  state.
+- Loss and reordering produce explicit gaps rather than silent frame history
+  corruption.
+- Local zero-copy and remote fallback paths expose the same stream identity and
+  lifecycle.
+
+## Phase 7: Consumer Convergence and API Reduction
+
+Migrate consumers in increasing order of operational risk:
+
+1. one diagnostic/tooling consumer
+2. Aetheria runtime discovery
+3. EveUnity provider discovery and live documents
+4. EveUnity asset delivery
+5. Mimir media routes
+6. remaining Odin/Bifrost/VoidBot command and state paths
+
+For each consumer:
+
+- inventory local discovery, refresh, reconnect, chunk, and topology code
+- delete the local owner before adopting the shared service
+- preserve domain policy in the consumer
+- verify the full failure timeline
+- record the removed physical configuration knobs
+
+After two production consumers use the new services, reduce the broad static
+facade. Keep small discoverable entry points and move specialist controls onto
+the service or session that owns them. Do not expose the internal workflow as
+another forest of static helpers.
+
+## Cross-Runtime Contract
+
+C#, Rust, TypeScript, Kotlin, Unity, and browser runtimes share semantic state,
+not necessarily identical implementation machinery. The portable contract must
+cover:
+
+- stable endpoint and protocol identity
+- discovery candidate and provenance
+- freshness and connection state
+- typed failure reasons
+- authority decision evidence
+- content transfer progress and verified ranges
+- shared-body identity, schema/layout, epoch/sequence, access, lease, and
+  transport negotiation
+- stream descriptor, publisher epoch, subscription, and gap state
+
+These are typed CultNet/CultMesh documents. JSON is permitted only for schema
+publication, inspection, or non-CultNet boundaries.
+
+## Research Direction
+
+The implementation should borrow boundaries before dependencies:
+
+- Iroh: stable endpoint identity, concurrent address lookup, shared sessions,
+  relay reachability floor, direct-path upgrade, and watchable path state.
+- Iroh Blobs/Bao: content identity independent of provider, incremental range
+  verification, and resumable transfer.
+- IPFS delegated routing: provider lookup separated from retrieval, provenance,
+  positive/negative freshness, and stale-on-error semantics.
+- QUIC: independent cancelable streams, datagrams, and path migration.
+- Media over QUIC: tracks, groups, object expiry, priority, explicit gaps, and
+  fetch versus subscribe semantics.
+
+Iroh or QUIC may become a transport connector after the session boundary and
+failure harness exist. Adopting either before that point would replace a wire
+body while preserving the split control plane.
+
+## Completion Conditions
+
+The migration is complete only when:
+
+- applications connect using stable identity and protocol rather than physical
+  endpoint choreography
+- discovery retains and labels last-known-good state across transient failure
+- one owner supervises connection reuse, reconnect, failover, and path state
+- peer contact cannot confer authority
+- CDN consumers request verified content instead of implementing chunk loops
+- local CDN and SoA consumers negotiate zero-copy bodies without changing
+  logical identity, authority, or remote behavior
+- stream identity and liveness survive changes in body transport
+- old discovery, session, transfer, and stream decision paths cannot override
+  the new owners
+- failure timelines and visible consumer state agree
+- CultMesh's public surface is smaller and more obvious than before the
+  migration
diff --git a/src/GameCult.Mesh/docs/transport-planes.md b/src/GameCult.Mesh/docs/transport-planes.md
new file mode 100644
index 00000000..fea2b69b
--- /dev/null
+++ b/src/GameCult.Mesh/docs/transport-planes.md
@@ -0,0 +1,152 @@
+# CultMesh Transport Planes
+
+CultMesh selects a transport per workload. It does not ask one wire protocol to
+be equally good at files, realtime state, and same-machine memory access.
+
+## Authority map
+
+**Owner:** `CultMeshSessionManager` selects an advertised route through a
+registered connector for each traffic class. A connector owns only its physical
+connection and byte movement.
+
+**Inputs:** stable Verse/authority-runtime identity, exact Odin-bound physical
+routes with protocol and generation,
+connector support and priority, caller cancellation, and locality evidence for
+body negotiation.
+
+**Outputs:**
+
+| Workload | Preferred plane | Contract |
+| --- | --- | --- |
+| Schemas, commands, receipts, manifests | TCP | `cultnet+tcp://` through `ICultMeshTransportConnector` |
+| Immutable chunks and other file-shaped bodies | TCP byte stream | `cultmesh-content+tcp://` through `ICultMeshContentTransportConnector` |
+| Realtime state | QUIC streams or datagrams | `ICultMeshRealtimeTransportConnector` with an explicit delivery mode |
+| Same-machine SoA and large bodies | mapped/shared memory | body transport negotiation |
+
+The TCP content plane sends typed CultNet request and response headers, then
+streams raw chunk bytes outside the schema envelope. The transfer service owns
+range hashing, resume checkpoints, provider failover, full-body verification,
+and atomic promotion regardless of the selected content connector.
+`CultMeshClient` installs the TCP schema and TCP content connectors by default.
+Passing explicit connector lists replaces those defaults.
+
+Realtime frames declare whether they require reliable ordered delivery,
+latest-only delivery, or unreliable delivery. The optional
+`GameCult.Mesh.Quic` package provides the .NET 10/MsQuic connector and server.
+It maps reliable ordered frames to one persistent stream and latest-only frames
+to independent streams with keyed `(producer epoch, sequence)` pending-state
+replacement. Its
+`System.Net.Quic` adapter fails closed for unreliable frames because that API
+does not expose QUIC datagrams. `GameCult.Mesh.Quic.Native` owns the generic
+Unity/client boundary through the MsQuic C API. The Unity package carries its
+managed connector and the pinned Windows x64 Schannel runtime; consumers
+register `CultMeshNativeQuicRealtimeTransportConnector`, then ask CultMesh for
+the advertised realtime route. The connector currently receives provider state
+and fails closed if used to send; commands and receipts remain on the typed TCP
+control plane. No RUDP implementation is installed implicitly in its place.
+
+Local mapped bodies remain the first state plane. A consumer opens the
+advertised mapping when it is actually reachable; otherwise it connects to the
+advertised QUIC route. Latest-only receivers must replace pending generations
+per body rather than queueing render debt.
+
+Provider simulation owns state generation, not socket completion. Latest-only
+broadcast enqueues into a keyed, coalescing outbox owned by each physical peer
+and returns without waiting for network delivery. The peer's transport worker
+owns stream writes and eviction after disconnect or send failure. Thus a slow,
+stalled, or departed client cannot backpressure a simulation tick, while a
+healthy peer still converges on the newest generation. Reliable-ordered
+broadcast remains completion-bearing because dropping or replacing it would
+violate its declared delivery contract; caller cancellation can stop that
+operation.
+
+**Derived state:** connector choice, physical endpoint, connection health, and
+transport diagnostics. None of these grant provider authority or become content
+identity.
+
+Before a schema, content, or realtime session becomes online, consumer-owned
+trust verifies an Odin-signed route certificate binding Verse, authority
+runtime, protocol set, endpoint, generation, validity interval, and provider
+P-256 key. Schema and content lanes then require a fresh client nonce signed by
+that provider key. QUIC uses the signed endpoint plus its TLS
+endpoint/certificate proof. A connector that returns bytes without this chain
+is rejected; racing every endpoint in a Verse descriptor is not route
+selection. Unsigned traffic exists only under an explicitly selected
+`LocalDevelopment` policy and only for in-process or loopback routes.
+
+Route and session signatures use ECDSA P-256 with SHA-256 and fixed-width IEEE
+P1363 `r || s` encoding, matching browser WebCrypto. Their canonical
+transcripts are ordered UTF-8 fields prefixed by four-byte big-endian lengths;
+serializer bytes are never signature authority.
+
+**Forbidden writers:** applications and renderers do not choose unadvertised
+endpoints, implement reconnect loops, or bypass verification. Schema messages
+must not carry bulk bodies. RUDP/LiteNetLib cannot become an implicit default
+for any traffic class. QUIC does not own schemas or immutable files merely
+because it can transport bytes.
+
+**Shared paths:** exact route resolution and peer verification remain common.
+Each traffic
+class has its own connector set, connection cache, priority tiers, and failure
+state. All content connectors feed the same transfer and promotion owner.
+
+**Cut line:** the former RUDP content server is
+`CultMeshLegacyRudpContentServer`, and its connector must be registered
+explicitly. It has basement priority and exists for compatibility and parity
+measurement. The legacy datagram schema connector is likewise explicit and
+lower priority than TCP. Existing hot-state publishers that still package
+payloads as schema messages must move to the realtime connector contract; the
+new seam does not pretend that migration has already occurred.
+
+## Security and release gate
+
+The current TCP control and content connectors are plaintext and therefore
+restricted to explicit loopback development. They cannot carry an authenticated
+remote session. Adding TLS must not move
+discovery, authorization, content verification, or application semantics into
+the TCP adapter.
+
+The QUIC adapter always uses TLS 1.3. Its certificate validation callback is
+given the advertised endpoint identity so the consumer can bind transport
+authentication to provider authorization. Test-only trust-all callbacks are not
+a release configuration. A trusted discovery record may carry
+`cert-sha256=<fingerprint>` on its QUIC route; absent a caller validator, the
+connector accepts a self-signed provider certificate only when that pin matches.
+The native client uses MsQuic's deferred-certificate contract: it completes the
+pin decision through `ConnectionCertificateValidationComplete` and returns
+`QUIC_STATUS_PENDING` from the certificate event. Transport failures report the
+MsQuic status, wire error, loaded runtime path, and pre-connect event sequence.
+
+## Local parity evidence
+
+The native suite can also connect to an independently running managed provider
+by setting `CULTMESH_NATIVE_EXTERNAL_ENDPOINT` to its advertised pinned QUIC
+route. This keeps the managed server and native client in separate processes,
+so one process-local MsQuic DLL cannot counterfeit cross-runtime parity.
+
+On 2026-07-19, the parity harness moved a 13 MiB payload on loopback using
+1 MiB content chunks. Raw TCP reached 127.4 MiB/s, verified CultMesh TCP content
+reached 59.0 MiB/s, raw MsQuic reached 51.5 MiB/s, and legacy CultMesh RUDP
+reached 10.7 MiB/s while emitting 18,112,867 wire bytes. CultMesh TCP includes
+chunk hashing, durable checkpoints, final hashing, and atomic promotion, so this
+is not a claim of raw protocol parity. It is a repeatable workload comparison
+and leaves the remaining framework overhead visible.
+
+The same harness now has a state-only workload. On 2026-07-19, 1,000 latest-only
+frames with 16 KiB payloads produced the following loopback result:
+
+| Plane | Offered rate | Delivered | Highest generation | Settled time |
+| --- | ---: | ---: | ---: | ---: |
+| CultMesh QUIC latest-only | 23.8 MiB/s | 989 / 1,000 | 999 | 655.4 ms |
+| CultNet RUDP latest | 45.6 MiB/s | 373 / 1,000 | 516 | 602.7 ms |
+
+Offered rate measures publisher-side enqueue/write completion, not successful
+delivery. RUDP accepted bytes faster but failed to deliver the terminal
+generation after a 250 ms drain; that is a delivery failure, not useful
+throughput. QUIC's reliable independent streams reached the terminal generation
+while the receiver coalesced eleven superseded frames. Reproduce the workload
+with:
+
+```text
+dotnet run --project tools/GameCult.TransportParity -- --state-only --state-bytes 16384 --state-frames 1000
+```
diff --git a/src/GameCult.Mesh/docs/typed-document-path.md b/src/GameCult.Mesh/docs/typed-document-path.md
index 3ee3183c..aab47930 100644
--- a/src/GameCult.Mesh/docs/typed-document-path.md
+++ b/src/GameCult.Mesh/docs/typed-document-path.md
@@ -109,7 +109,7 @@ messages directly.
 ```csharp
 using GameCult.Mesh;
 
-using var node = await CultMesh.CreateNodeAsync("world.ccmp", new CultMeshNodeOptions
+using var node = await CultMesh.CreateNodeAsync("world.cc", new CultMeshNodeOptions
 {
     DatabaseOptions = new CultNetDatabaseOptions
     {
diff --git a/src/GameCult.Mesh/docs/verses.md b/src/GameCult.Mesh/docs/verses.md
index 656dcfaf..fbd9a522 100644
--- a/src/GameCult.Mesh/docs/verses.md
+++ b/src/GameCult.Mesh/docs/verses.md
@@ -21,8 +21,10 @@ The same transport can carry many Verses:
   subscribed overlay
 - `Compatibility`: transport version, rules hash, compatible Verse ids, and
   plugin requirements
-- `DiscoveryEndpoints`: endpoints where nodes for the Verse can be found
-- `AuthorityRuntimeIds`: known authoritative runtimes when cluster-shaped
+- `AuthorityRoutes`: exact authority-runtime, endpoint, protocol, priority, and
+  generation bindings. This is the routing authority.
+- `DiscoveryEndpoints`: read-only endpoint projection for legacy inspection
+- `AuthorityRuntimeIds`: read-only authority projection for legacy inspection
 - `ParentVerseId`: source Verse for overlays or branches
 
 ## Compatibility
@@ -57,6 +59,13 @@ static config, cloud discovery, peer gossip, or mod portals. It does not care
 where the descriptor came from. That keeps discovery pluggable while the Verse
 model stays stable.
 
+An endpoint and an authority id are not two independent facts. A descriptor
+with explicit routes binds them. The legacy parallel arrays are accepted only
+when exactly one authority runtime exists; a multi-authority legacy descriptor
+is ambiguous and fails closed. Session establishment then requires the selected
+physical route to prove the exact Verse, authority runtime, protocol, and route
+generation before the session becomes online.
+
 Peer exchange is the torrent-shaped layer under Verse discovery. A Verse
 catalog says which graph exists; a peer catalog says which nodes can currently
 serve or observe parts of that graph. Peer cards can advertise discovery,
diff --git a/src/GameCult.Networking.WebSockets/CultNetWebSocketMessageIO.cs b/src/GameCult.Networking.WebSockets/CultNetWebSocketMessageIO.cs
new file mode 100644
index 00000000..de10a66e
--- /dev/null
+++ b/src/GameCult.Networking.WebSockets/CultNetWebSocketMessageIO.cs
@@ -0,0 +1,46 @@
+using System;
+using System.IO;
+using System.Net.WebSockets;
+using System.Threading;
+using System.Threading.Tasks;
+
+namespace GameCult.Networking.WebSockets;
+
+internal static class CultNetWebSocketMessageIO
+{
+    public static Task SendAsync(WebSocket socket, byte[] payload, CancellationToken cancellationToken) =>
+        socket.SendAsync(new ArraySegment<byte>(payload), WebSocketMessageType.Binary, true, cancellationToken);
+
+    public static async Task<byte[]?> ReceiveAsync(
+        WebSocket socket,
+        int maxMessageBytes,
+        CancellationToken cancellationToken)
+    {
+        var segment = new byte[Math.Min(16 * 1024, maxMessageBytes)];
+        using var message = new MemoryStream();
+        while (true)
+        {
+            var result = await socket.ReceiveAsync(new ArraySegment<byte>(segment), cancellationToken)
+                .ConfigureAwait(false);
+            if (result.MessageType == WebSocketMessageType.Close) return null;
+            if (result.MessageType != WebSocketMessageType.Binary)
+            {
+                await socket.CloseAsync(
+                    WebSocketCloseStatus.InvalidMessageType,
+                    "CultNet requires binary MessagePack WebSocket messages.",
+                    cancellationToken).ConfigureAwait(false);
+                return null;
+            }
+            if (message.Length + result.Count > maxMessageBytes)
+            {
+                await socket.CloseAsync(
+                    WebSocketCloseStatus.MessageTooBig,
+                    "CultNet message exceeds the configured maximum.",
+                    cancellationToken).ConfigureAwait(false);
+                return null;
+            }
+            message.Write(segment, 0, result.Count);
+            if (result.EndOfMessage) return message.ToArray();
+        }
+    }
+}
diff --git a/src/GameCult.Networking.WebSockets/CultNetWebSocketSchemaClient.cs b/src/GameCult.Networking.WebSockets/CultNetWebSocketSchemaClient.cs
new file mode 100644
index 00000000..394fe207
--- /dev/null
+++ b/src/GameCult.Networking.WebSockets/CultNetWebSocketSchemaClient.cs
@@ -0,0 +1,166 @@
+using System.Collections.Concurrent;
+using System.Net.WebSockets;
+using GameCult.Networking;
+
+namespace GameCult.Networking.WebSockets;
+
+/// <summary>Schema-v0 client over a binary WebSocket route.</summary>
+public sealed class CultNetWebSocketSchemaClient : ICultNetUriSchemaClient, ICultNetSchemaClientHealth
+{
+    private readonly ConcurrentDictionary<Type, List<Delegate>> _handlers = new();
+    private readonly object _handlerGate = new();
+    private readonly SemaphoreSlim _sendGate = new(1, 1);
+    private readonly CancellationTokenSource _shutdown = new();
+    private readonly TaskCompletionSource<Exception> _backgroundFailure = new(
+        TaskCreationOptions.RunContinuationsAsynchronously);
+    private readonly Action<ClientWebSocketOptions>? _configure;
+    private readonly int _maxMessageBytes;
+    private ClientWebSocket? _socket;
+    private bool _disposed;
+
+    /// <summary>Creates a binary WebSocket schema client.</summary>
+    public CultNetWebSocketSchemaClient(
+        Action<ClientWebSocketOptions>? configure = null,
+        int maxMessageBytes = 4 * 1024 * 1024)
+    {
+        if (maxMessageBytes <= 0) throw new ArgumentOutOfRangeException(nameof(maxMessageBytes));
+        _configure = configure;
+        _maxMessageBytes = maxMessageBytes;
+    }
+
+    /// <inheritdoc />
+    public bool Connected => !_disposed && _socket?.State == WebSocketState.Open;
+
+    /// <inheritdoc />
+    public Task<Exception> BackgroundFailure => _backgroundFailure.Task;
+
+    /// <inheritdoc />
+    public void Connect(string host, int port)
+    {
+        if (string.IsNullOrWhiteSpace(host)) throw new ArgumentException("Host is required.", nameof(host));
+        if (port <= 0 || port > 65535) throw new ArgumentOutOfRangeException(nameof(port));
+        ConnectAsync(new Uri($"ws://{host}:{port}/cultmesh"), CancellationToken.None)
+            .GetAwaiter().GetResult();
+    }
+
+    /// <summary>Connects to an exact WebSocket route.</summary>
+    public async Task ConnectAsync(Uri endpoint, CancellationToken cancellationToken = default)
+    {
+        if (endpoint == null) throw new ArgumentNullException(nameof(endpoint));
+        if (endpoint.Scheme is not ("ws" or "wss"))
+            throw new ArgumentException("CultNet WebSocket endpoint must use ws:// or wss://.", nameof(endpoint));
+        ThrowIfDisposed();
+        if (_socket != null) throw new InvalidOperationException("CultNet WebSocket client is already connected.");
+        var socket = new ClientWebSocket();
+        _configure?.Invoke(socket.Options);
+        try
+        {
+            await socket.ConnectAsync(endpoint, cancellationToken).ConfigureAwait(false);
+            _socket = socket;
+            _ = ReceiveLoopAsync(socket, _shutdown.Token);
+        }
+        catch
+        {
+            socket.Dispose();
+            throw;
+        }
+    }
+
+    /// <inheritdoc />
+    public void SendCultNet<T>(T message) where T : ICultNetSchemaMessage
+    {
+        if (message == null) throw new ArgumentNullException(nameof(message));
+        ThrowIfDisposed();
+        var socket = _socket;
+        if (socket?.State != WebSocketState.Open)
+            throw new InvalidOperationException("CultNet WebSocket client is not connected.");
+        var payload = CultNetSchemaMessageSerialization.Serialize(message);
+        if (payload.Length > _maxMessageBytes)
+            throw new InvalidOperationException(
+                $"CultNet message exceeds the {_maxMessageBytes}-byte WebSocket limit.");
+        _sendGate.Wait();
+        try
+        {
+            CultNetWebSocketMessageIO.SendAsync(socket, payload, _shutdown.Token).GetAwaiter().GetResult();
+        }
+        finally
+        {
+            _sendGate.Release();
+        }
+    }
+
+    /// <inheritdoc />
+    public void OnCultNet<T>(Action<T> callback) where T : ICultNetSchemaMessage
+    {
+        if (callback == null) throw new ArgumentNullException(nameof(callback));
+        ThrowIfDisposed();
+        lock (_handlerGate)
+        {
+            if (!_handlers.TryGetValue(typeof(T), out var handlers))
+                _handlers[typeof(T)] = handlers = new List<Delegate>();
+            handlers.Add(callback);
+        }
+    }
+
+    /// <inheritdoc />
+    public void Dispose()
+    {
+        if (_disposed) return;
+        _disposed = true;
+        _shutdown.Cancel();
+        var socket = _socket;
+        _socket = null;
+        try
+        {
+            if (socket?.State is WebSocketState.Open or WebSocketState.CloseReceived)
+            {
+                using var closeTimeout = new CancellationTokenSource(TimeSpan.FromSeconds(1));
+                socket.CloseAsync(WebSocketCloseStatus.NormalClosure, "CultNet client disposed", closeTimeout.Token)
+                    .GetAwaiter().GetResult();
+            }
+        }
+        catch (Exception error) when (error is WebSocketException or OperationCanceledException)
+        {
+            socket?.Abort();
+        }
+        socket?.Dispose();
+        _sendGate.Dispose();
+        _shutdown.Dispose();
+    }
+
+    private async Task ReceiveLoopAsync(WebSocket socket, CancellationToken cancellationToken)
+    {
+        try
+        {
+            while (!_disposed && socket.State == WebSocketState.Open && !cancellationToken.IsCancellationRequested)
+            {
+                var payload = await CultNetWebSocketMessageIO.ReceiveAsync(socket, _maxMessageBytes, cancellationToken)
+                    .ConfigureAwait(false);
+                if (payload == null) return;
+                Dispatch(CultNetSchemaMessageSerialization.Deserialize(payload));
+            }
+        }
+        catch (OperationCanceledException) when (cancellationToken.IsCancellationRequested)
+        {
+        }
+        catch (Exception error) when (!_disposed)
+        {
+            _backgroundFailure.TrySetResult(error);
+        }
+    }
+
+    private void Dispatch(ICultNetSchemaMessage message)
+    {
+        Delegate[] handlers;
+        lock (_handlerGate)
+            handlers = _handlers.TryGetValue(message.GetType(), out var registered)
+                ? registered.ToArray()
+                : Array.Empty<Delegate>();
+        foreach (var handler in handlers) handler.DynamicInvoke(message);
+    }
+
+    private void ThrowIfDisposed()
+    {
+        if (_disposed) throw new ObjectDisposedException(nameof(CultNetWebSocketSchemaClient));
+    }
+}
diff --git a/src/GameCult.Networking.WebSockets/CultNetWebSocketSchemaServer.cs b/src/GameCult.Networking.WebSockets/CultNetWebSocketSchemaServer.cs
new file mode 100644
index 00000000..fa2728d8
--- /dev/null
+++ b/src/GameCult.Networking.WebSockets/CultNetWebSocketSchemaServer.cs
@@ -0,0 +1,222 @@
+using System.Collections.Concurrent;
+using System.Net;
+using System.Net.WebSockets;
+using GameCult.Networking;
+using Microsoft.AspNetCore.Builder;
+using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.Routing;
+
+namespace GameCult.Networking.WebSockets;
+
+/// <summary>Controls the bounded CultNet schema-v0 WebSocket endpoint.</summary>
+public sealed class CultNetWebSocketEndpointOptions
+{
+    /// <summary>Maximum accepted binary CultNet message size.</summary>
+    public int MaxMessageBytes { get; init; } = 4 * 1024 * 1024;
+
+    /// <summary>
+    /// Authorizes the HTTP upgrade before it can become a CultNet peer. Production hosts
+    /// should bind this to their authenticated session middleware.
+    /// </summary>
+    public Func<HttpContext, ValueTask<bool>>? AuthorizeAsync { get; init; }
+
+    /// <summary>Allows an unauthenticated endpoint for explicit local development only.</summary>
+    public bool AllowAnonymousDevelopment { get; init; }
+}
+
+/// <summary>
+/// Adapts one binary WebSocket endpoint to the transport-neutral CultNet schema server port.
+/// The host owns HTTP, TLS, and authentication; this adapter owns bounded binary message
+/// assembly, schema validation, handler dispatch, peer lifetime, and serialized sends.
+/// </summary>
+public sealed class CultNetWebSocketSchemaServer :
+    ICultNetSchemaServer,
+    ICultNetSchemaServerPeerLifecycle,
+    IAsyncDisposable
+{
+    private readonly ConcurrentDictionary<Type, Delegate> _handlers = new();
+    private readonly ConcurrentDictionary<WebSocketPeer, byte> _peers = new();
+    private bool _disposed;
+
+    /// <inheritdoc />
+    public event Action<ICultNetSchemaServerPeer>? PeerDisconnected;
+
+    /// <summary>Gets the active upgraded peer count.</summary>
+    public int PeerCount => _peers.Count;
+
+    /// <inheritdoc />
+    public void OnCultNet<TMessage>(Func<TMessage, ICultNetSchemaServerPeer, Task> callback)
+        where TMessage : ICultNetSchemaMessage
+    {
+        ArgumentNullException.ThrowIfNull(callback);
+        ThrowIfDisposed();
+        _handlers[typeof(TMessage)] = callback;
+    }
+
+    /// <inheritdoc />
+    public void RemoveCultNetMessageListener<TMessage>(Delegate callback)
+        where TMessage : ICultNetSchemaMessage
+    {
+        if (_handlers.TryGetValue(typeof(TMessage), out var existing) && existing == callback)
+            _handlers.TryRemove(typeof(TMessage), out _);
+    }
+
+    /// <summary>Serves one already-authorized WebSocket until it closes.</summary>
+    public async Task AcceptAsync(
+        WebSocket socket,
+        EndPoint? remoteEndPoint = null,
+        int maxMessageBytes = 4 * 1024 * 1024,
+        CancellationToken cancellationToken = default)
+    {
+        ArgumentNullException.ThrowIfNull(socket);
+        ThrowIfDisposed();
+        if (maxMessageBytes <= 0) throw new ArgumentOutOfRangeException(nameof(maxMessageBytes));
+        var peer = new WebSocketPeer(socket, remoteEndPoint, maxMessageBytes);
+        if (!_peers.TryAdd(peer, 0)) throw new InvalidOperationException("CultNet WebSocket peer already exists.");
+        try
+        {
+            while (!_disposed && socket.State == WebSocketState.Open && !cancellationToken.IsCancellationRequested)
+            {
+                var payload = await CultNetWebSocketMessageIO.ReceiveAsync(socket, maxMessageBytes, cancellationToken)
+                    .ConfigureAwait(false);
+                if (payload == null) break;
+                var message = CultNetSchemaMessageSerialization.Deserialize(payload);
+                if (!_handlers.TryGetValue(message.GetType(), out var handler)) continue;
+                if (handler.DynamicInvoke(message, peer) is Task task) await task.ConfigureAwait(false);
+            }
+        }
+        catch (OperationCanceledException) when (cancellationToken.IsCancellationRequested)
+        {
+        }
+        finally
+        {
+            if (_peers.TryRemove(peer, out _)) PeerDisconnected?.Invoke(peer);
+            await peer.DisposeAsync().ConfigureAwait(false);
+        }
+    }
+
+    /// <inheritdoc />
+    public async ValueTask DisposeAsync()
+    {
+        if (_disposed) return;
+        _disposed = true;
+        var peers = _peers.Keys.ToArray();
+        _peers.Clear();
+        foreach (var peer in peers)
+        {
+            PeerDisconnected?.Invoke(peer);
+            await peer.DisposeAsync().ConfigureAwait(false);
+        }
+        _handlers.Clear();
+    }
+
+    private void ThrowIfDisposed()
+    {
+        ObjectDisposedException.ThrowIf(_disposed, this);
+    }
+
+    private sealed class WebSocketPeer :
+        ICultNetSchemaServerPeer,
+        ICultNetSchemaServerPeerLocation,
+        IAsyncDisposable
+    {
+        private readonly WebSocket _socket;
+        private readonly SemaphoreSlim _sendGate = new(1, 1);
+        private readonly int _maxMessageBytes;
+        private bool _disposed;
+
+        public WebSocketPeer(WebSocket socket, EndPoint? remoteEndPoint, int maxMessageBytes)
+        {
+            _socket = socket;
+            RemoteEndPoint = remoteEndPoint;
+            _maxMessageBytes = maxMessageBytes;
+        }
+
+        public EndPoint? RemoteEndPoint { get; }
+
+        public void SendCultNet<TMessage>(TMessage message) where TMessage : ICultNetSchemaMessage
+        {
+            ArgumentNullException.ThrowIfNull(message);
+            if (_disposed || _socket.State != WebSocketState.Open)
+                throw new InvalidOperationException("CultNet WebSocket peer is not open.");
+            var payload = CultNetSchemaMessageSerialization.Serialize(message);
+            if (payload.Length > _maxMessageBytes)
+                throw new InvalidOperationException(
+                    $"CultNet message exceeds the {_maxMessageBytes}-byte WebSocket limit.");
+            _sendGate.Wait();
+            try
+            {
+                CultNetWebSocketMessageIO.SendAsync(_socket, payload, CancellationToken.None)
+                    .GetAwaiter().GetResult();
+            }
+            finally
+            {
+                _sendGate.Release();
+            }
+        }
+
+        public async ValueTask DisposeAsync()
+        {
+            if (_disposed) return;
+            _disposed = true;
+            try
+            {
+                if (_socket.State is WebSocketState.Open or WebSocketState.CloseReceived)
+                {
+                    using var closeTimeout = new CancellationTokenSource(TimeSpan.FromSeconds(1));
+                    await _socket.CloseAsync(WebSocketCloseStatus.NormalClosure, "CultNet peer closed", closeTimeout.Token)
+                        .ConfigureAwait(false);
+                }
+            }
+            catch (Exception error) when (error is WebSocketException or OperationCanceledException)
+            {
+                _socket.Abort();
+            }
+            _socket.Dispose();
+            _sendGate.Dispose();
+        }
+    }
+}
+
+/// <summary>ASP.NET Core endpoint mapping for the CultNet WebSocket schema server.</summary>
+public static class CultNetWebSocketEndpointRouteBuilderExtensions
+{
+    /// <summary>Maps one authenticated binary CultNet WebSocket endpoint.</summary>
+    public static IEndpointConventionBuilder MapCultNetWebSocket(
+        this IEndpointRouteBuilder endpoints,
+        string pattern,
+        CultNetWebSocketSchemaServer server,
+        CultNetWebSocketEndpointOptions options)
+    {
+        ArgumentNullException.ThrowIfNull(endpoints);
+        ArgumentException.ThrowIfNullOrWhiteSpace(pattern);
+        ArgumentNullException.ThrowIfNull(server);
+        ArgumentNullException.ThrowIfNull(options);
+        if (options.MaxMessageBytes <= 0) throw new ArgumentOutOfRangeException(nameof(options.MaxMessageBytes));
+        if (options.AuthorizeAsync == null && !options.AllowAnonymousDevelopment)
+            throw new InvalidOperationException(
+                "CultNet WebSocket endpoints require AuthorizeAsync unless AllowAnonymousDevelopment is explicitly enabled.");
+
+        return endpoints.Map(pattern, async context =>
+        {
+            if (!context.WebSockets.IsWebSocketRequest)
+            {
+                context.Response.StatusCode = StatusCodes.Status426UpgradeRequired;
+                return;
+            }
+            if (options.AuthorizeAsync != null && !await options.AuthorizeAsync(context).ConfigureAwait(false))
+            {
+                context.Response.StatusCode = StatusCodes.Status401Unauthorized;
+                return;
+            }
+            using var socket = await context.WebSockets.AcceptWebSocketAsync().ConfigureAwait(false);
+            await server.AcceptAsync(
+                socket,
+                context.Connection.RemoteIpAddress == null
+                    ? null
+                    : new IPEndPoint(context.Connection.RemoteIpAddress, context.Connection.RemotePort),
+                options.MaxMessageBytes,
+                context.RequestAborted).ConfigureAwait(false);
+        });
+    }
+}
diff --git a/src/GameCult.Networking.WebSockets/GameCult.Networking.WebSockets.csproj b/src/GameCult.Networking.WebSockets/GameCult.Networking.WebSockets.csproj
new file mode 100644
index 00000000..fb8e0bd5
--- /dev/null
+++ b/src/GameCult.Networking.WebSockets/GameCult.Networking.WebSockets.csproj
@@ -0,0 +1,19 @@
+<Project Sdk="Microsoft.NET.Sdk">
+  <PropertyGroup>
+    <TargetFramework></TargetFramework>
+    <TargetFrameworks>net10.0;netstandard2.1</TargetFrameworks>
+    <ImplicitUsings>enable</ImplicitUsings>
+    <Nullable>enable</Nullable>
+    <Description>CultNet schema-v0 WebSocket host adapter for browser and web runtimes</Description>
+    <PackageId>GameCult.Networking.WebSockets</PackageId>
+    <PackageTags>game;networking;websocket;cultnet;cultmesh</PackageTags>
+  </PropertyGroup>
+  <ItemGroup Condition="'$(TargetFramework)' == 'net10.0'">
+    <ProjectReference Include="..\GameCult.Networking\GameCult.Networking.csproj" />
+    <FrameworkReference Include="Microsoft.AspNetCore.App" />
+  </ItemGroup>
+  <ItemGroup Condition="'$(TargetFramework)' == 'netstandard2.1'">
+    <ProjectReference Include="..\GameCult.Networking\GameCult.Networking.csproj" />
+    <Compile Remove="CultNetWebSocketSchemaServer.cs" />
+  </ItemGroup>
+</Project>
diff --git a/src/GameCult.Networking/Contracts/cultnet.database-change-raw.schema.json b/src/GameCult.Networking/Contracts/cultnet.database-change-raw.schema.json
new file mode 100644
index 00000000..dd650fa0
--- /dev/null
+++ b/src/GameCult.Networking/Contracts/cultnet.database-change-raw.schema.json
@@ -0,0 +1,24 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://github.com/GameCult/cultnet-ts/contracts/cultnet.database-change-raw.schema.json",
+  "title": "CultNet Raw Database Change Message",
+  "type": "object",
+  "required": ["schemaVersion", "messageId", "subscriptionId", "changeKind"],
+  "additionalProperties": false,
+  "properties": {
+    "schemaVersion": { "const": "cultnet.database_change_raw.v0" },
+    "messageId": { "type": "string", "minLength": 1 },
+    "subscriptionId": { "type": "string", "minLength": 1 },
+    "changeKind": { "enum": ["added", "updated", "removed"] },
+    "document": { "$ref": "./cultnet.raw-document-record.schema.json" },
+    "recordKey": { "type": "string", "minLength": 1 },
+    "schemaId": { "type": "string", "minLength": 1 }
+  },
+  "allOf": [
+    {
+      "if": { "properties": { "changeKind": { "const": "removed" } } },
+      "then": { "required": ["recordKey", "schemaId"] },
+      "else": { "required": ["document"] }
+    }
+  ]
+}
diff --git a/src/GameCult.Networking/Contracts/cultnet.database-subscribe.schema.json b/src/GameCult.Networking/Contracts/cultnet.database-subscribe.schema.json
new file mode 100644
index 00000000..08304199
--- /dev/null
+++ b/src/GameCult.Networking/Contracts/cultnet.database-subscribe.schema.json
@@ -0,0 +1,19 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://github.com/GameCult/cultnet-ts/contracts/cultnet.database-subscribe.schema.json",
+  "title": "CultNet Database Subscribe Message",
+  "type": "object",
+  "required": ["schemaVersion", "messageId", "subscriptionId", "includeSnapshot"],
+  "additionalProperties": false,
+  "properties": {
+    "schemaVersion": { "const": "cultnet.database_subscribe.v0" },
+    "messageId": { "type": "string", "minLength": 1 },
+    "subscriptionId": { "type": "string", "minLength": 1 },
+    "schemaIds": { "type": "array", "items": { "type": "string", "minLength": 1 } },
+    "recordKeys": { "type": "array", "items": { "type": "string", "minLength": 1 } },
+    "includeSnapshot": { "type": "boolean" },
+    "consumerRuntimeId": { "type": "string", "minLength": 1 },
+    "bodyIds": { "type": "array", "items": { "type": "string", "minLength": 1 } },
+    "supportedBodyTransports": { "type": "array", "items": { "type": "string", "minLength": 1 } }
+  }
+}
diff --git a/src/GameCult.Networking/Contracts/cultnet.database-unsubscribe.schema.json b/src/GameCult.Networking/Contracts/cultnet.database-unsubscribe.schema.json
new file mode 100644
index 00000000..7d4b0855
--- /dev/null
+++ b/src/GameCult.Networking/Contracts/cultnet.database-unsubscribe.schema.json
@@ -0,0 +1,13 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://github.com/GameCult/cultnet-ts/contracts/cultnet.database-unsubscribe.schema.json",
+  "title": "CultNet Database Unsubscribe Message",
+  "type": "object",
+  "required": ["schemaVersion", "messageId", "subscriptionId"],
+  "additionalProperties": false,
+  "properties": {
+    "schemaVersion": { "const": "cultnet.database_unsubscribe.v0" },
+    "messageId": { "type": "string", "minLength": 1 },
+    "subscriptionId": { "type": "string", "minLength": 1 }
+  }
+}
diff --git a/src/GameCult.Networking/Contracts/cultnet.operation-request.schema.json b/src/GameCult.Networking/Contracts/cultnet.operation-request.schema.json
new file mode 100644
index 00000000..07cd9d8d
--- /dev/null
+++ b/src/GameCult.Networking/Contracts/cultnet.operation-request.schema.json
@@ -0,0 +1,19 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://github.com/GameCult/cultnet-ts/contracts/cultnet.operation-request.schema.json",
+  "title": "CultNet Operation Request",
+  "type": "object",
+  "required": ["schemaVersion", "messageId", "serviceId", "operation", "payloadSchema", "payload"],
+  "additionalProperties": false,
+  "properties": {
+    "schemaVersion": { "const": "cultnet.operation_request.v0" },
+    "messageId": { "type": "string", "minLength": 1 },
+    "serviceId": { "type": "string", "minLength": 1 },
+    "operation": { "type": "string", "minLength": 1 },
+    "payloadSchema": { "type": "string", "minLength": 1 },
+    "payloadEncoding": { "const": "messagepack-base64" },
+    "payload": { "type": "string", "minLength": 1, "contentEncoding": "base64" },
+    "sourceRuntimeId": { "type": "string", "minLength": 1 },
+    "targetRuntimeId": { "type": "string", "minLength": 1 }
+  }
+}
diff --git a/src/GameCult.Networking/Contracts/cultnet.operation-response.schema.json b/src/GameCult.Networking/Contracts/cultnet.operation-response.schema.json
new file mode 100644
index 00000000..c3be917d
--- /dev/null
+++ b/src/GameCult.Networking/Contracts/cultnet.operation-response.schema.json
@@ -0,0 +1,20 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://github.com/GameCult/cultnet-ts/contracts/cultnet.operation-response.schema.json",
+  "title": "CultNet Operation Response",
+  "type": "object",
+  "required": ["schemaVersion", "messageId", "serviceId", "operation", "status", "payloadSchema", "payload"],
+  "additionalProperties": false,
+  "properties": {
+    "schemaVersion": { "const": "cultnet.operation_response.v0" },
+    "messageId": { "type": "string", "minLength": 1 },
+    "serviceId": { "type": "string", "minLength": 1 },
+    "operation": { "type": "string", "minLength": 1 },
+    "status": { "type": "string", "minLength": 1 },
+    "payloadSchema": { "type": "string", "minLength": 1 },
+    "payloadEncoding": { "const": "messagepack-base64" },
+    "payload": { "type": "string", "minLength": 1, "contentEncoding": "base64" },
+    "diagnostics": { "type": "array", "items": { "type": "string" } },
+    "sourceRuntimeId": { "type": "string", "minLength": 1 }
+  }
+}
diff --git a/src/GameCult.Networking/CultNetDatabase.cs b/src/GameCult.Networking/CultNetDatabase.cs
index 83c34b82..996e85f5 100644
--- a/src/GameCult.Networking/CultNetDatabase.cs
+++ b/src/GameCult.Networking/CultNetDatabase.cs
@@ -2,6 +2,7 @@ using System;
 using System.Collections.Generic;
 using System.Linq;
 using System.Reflection;
+using System.Threading;
 using System.Threading.Tasks;
 using GameCult.Caching;
 using R3;
@@ -43,6 +44,58 @@ namespace GameCult.Networking
         Reconciled
     }
 
+    internal static class CultNetSchemaAliasMatching
+    {
+        public static bool MatchesAny(IReadOnlyList<string> candidates, string schemaId)
+        {
+            return candidates.Count == 0 ||
+                   candidates.Any(candidate => Matches(candidate, schemaId));
+        }
+
+        public static bool MatchesAny(IReadOnlyList<string> candidates, CultDocumentDescriptor descriptor)
+        {
+            return candidates.Count == 0 ||
+                   candidates.Any(candidate => Matches(candidate, descriptor));
+        }
+
+        public static bool Matches(string candidate, string schemaId)
+        {
+            if (string.Equals(candidate, schemaId, StringComparison.Ordinal))
+                return true;
+
+            var candidateName = InferSchemaName(candidate) ?? candidate;
+            var schemaName = InferSchemaName(schemaId) ?? schemaId;
+            return string.Equals(candidateName, schemaName, StringComparison.Ordinal);
+        }
+
+        public static bool Matches(string candidate, CultDocumentDescriptor descriptor)
+        {
+            if (string.Equals(candidate, descriptor.SchemaId, StringComparison.Ordinal) ||
+                string.Equals(candidate, descriptor.SchemaName, StringComparison.Ordinal) ||
+                string.Equals(candidate, descriptor.SchemaVersion, StringComparison.Ordinal))
+                return true;
+
+            if (descriptor.ToCatalogEntry().CompatibleSchemaIds.Any(compatible =>
+                    string.Equals(candidate, compatible, StringComparison.Ordinal)))
+                return true;
+
+            var candidateName = InferSchemaName(candidate) ?? candidate;
+            return string.Equals(candidateName, descriptor.SchemaName, StringComparison.Ordinal);
+        }
+
+        private static string? InferSchemaName(string schemaId)
+        {
+            var marker = schemaId.LastIndexOf(".v", StringComparison.Ordinal);
+            if (marker <= 0 || marker + 2 >= schemaId.Length)
+                return null;
+
+            var version = schemaId.Substring(marker + 2);
+            return version.All(char.IsDigit)
+                ? schemaId.Substring(0, marker)
+                : null;
+        }
+    }
+
     /// <summary>
     /// Declares which documents this runtime may predict locally before authoritative commit.
     /// </summary>
@@ -80,7 +133,14 @@ namespace GameCult.Networking
         internal bool Matches(string runtimeId, string schemaId, CultRecordKey key)
         {
             return string.Equals(OwnerRuntimeId, runtimeId, StringComparison.Ordinal) &&
-                   (SchemaIds.Count == 0 || SchemaIds.Contains(schemaId, StringComparer.Ordinal)) &&
+                   CultNetSchemaAliasMatching.MatchesAny(SchemaIds, schemaId) &&
+                   (string.IsNullOrEmpty(KeyPrefix) || key.Value.StartsWith(KeyPrefix!, StringComparison.Ordinal));
+        }
+
+        internal bool Matches(string runtimeId, CultDocumentDescriptor descriptor, CultRecordKey key)
+        {
+            return string.Equals(OwnerRuntimeId, runtimeId, StringComparison.Ordinal) &&
+                   CultNetSchemaAliasMatching.MatchesAny(SchemaIds, descriptor) &&
                    (string.IsNullOrEmpty(KeyPrefix) || key.Value.StartsWith(KeyPrefix!, StringComparison.Ordinal));
         }
     }
@@ -182,7 +242,15 @@ namespace GameCult.Networking
 
         internal bool Matches(string schemaId, CultRecordKey key)
         {
-            var schemaMatches = SchemaIds.Count == 0 || SchemaIds.Contains(schemaId, StringComparer.Ordinal);
+            var schemaMatches = CultNetSchemaAliasMatching.MatchesAny(SchemaIds, schemaId);
+            var keyMatches = string.IsNullOrEmpty(KeyPrefix) ||
+                             key.Value.StartsWith(KeyPrefix!, StringComparison.Ordinal);
+            return schemaMatches && keyMatches;
+        }
+
+        internal bool Matches(CultDocumentDescriptor descriptor, CultRecordKey key)
+        {
+            var schemaMatches = CultNetSchemaAliasMatching.MatchesAny(SchemaIds, descriptor);
             var keyMatches = string.IsNullOrEmpty(KeyPrefix) ||
                              key.Value.StartsWith(KeyPrefix!, StringComparison.Ordinal);
             return schemaMatches && keyMatches;
@@ -436,6 +504,22 @@ namespace GameCult.Networking
         /// </summary>
         public IReadOnlyList<CultNetClientAuthorityScope> ClientAuthorityScopes => _clientAuthorityScopes;
 
+        /// <summary>Gets whether this database instance can authoritatively replace the document at a key.</summary>
+        public bool CanWriteAuthoritatively<T>(CultRecordKey key) where T : class
+        {
+            ThrowIfDisposed();
+            var descriptor = _cache.Registry.GetRequired<T>();
+            return ResolveShardInternal(descriptor, key).IsPrimary;
+        }
+
+        /// <summary>Gets whether this database instance can submit a prediction for the document at a key.</summary>
+        public bool CanSubmitPrediction<T>(CultRecordKey key) where T : class
+        {
+            ThrowIfDisposed();
+            var descriptor = _cache.Registry.GetRequired<T>();
+            return _clientAuthorityScopes.Any(scope => scope.Matches(_runtimeId, descriptor, key));
+        }
+
         /// <summary>
         /// Gets mutation log entries for a shard after the supplied sequence.
         /// </summary>
@@ -529,7 +613,7 @@ namespace GameCult.Networking
                 var key = GetTrackedKey(document, documentType);
                 if (string.IsNullOrWhiteSpace(key.Value) ||
                     !shard.Matches(descriptor.SchemaId, key) ||
-                    (requestedSchemaIds != null && !requestedSchemaIds.Contains(descriptor.SchemaId)) ||
+                    (requestedSchemaIds != null && !MatchesRequestedSchema(descriptor, requestedSchemaIds)) ||
                     (requestedRecordKeys != null && !requestedRecordKeys.Contains(key.Value)))
                 {
                     continue;
@@ -593,7 +677,7 @@ namespace GameCult.Networking
             foreach (var document in response.Documents.Where(document => ShardMatchesRawDocument(shard, document)))
             {
                 var key = new CultRecordKey(document.RecordKey);
-                var descriptor = _cache.Registry.GetRequiredBySchemaId(document.SchemaId);
+                var descriptor = _documents.ResolveDescriptorForRawDocument(document);
                 var previous = _cache.Get(key);
                 var applied = await _documents.ApplyRawDocumentPutMessageAsync(
                     _cache,
@@ -608,7 +692,7 @@ namespace GameCult.Networking
                     descriptor.DocumentType,
                     previous == null ? CultNetDatabaseChangeKind.Added : CultNetDatabaseChangeKind.Updated,
                     key,
-                    document.SchemaId,
+                    descriptor.SchemaId,
                     shard,
                     applied,
                     previous);
@@ -687,18 +771,30 @@ namespace GameCult.Networking
         }
 
         /// <summary>
-        /// Opens a reactive POCO presentation for one distributed CultCache document.
+        /// Gets all documents assignable to the requested type.
         /// </summary>
-        public CultManagedDocument<T> Document<T>(CultRecordKey key) where T : class
+        public IEnumerable<T> GetAll<T>() where T : class
         {
             ThrowIfDisposed();
-            return new CultManagedDocument<T>(
-                key,
-                () => _cache.Get<T>(key),
-                async value => { await PutAsync(key, value).ConfigureAwait(false); },
-                WatchRecord<T>(key)
-                    .Where(change => change.Document != null)
-                    .Select(change => change.Document!));
+            return _cache.GetAll<T>();
+        }
+
+        /// <summary>
+        /// Gets a typed document by its CultName value.
+        /// </summary>
+        public T? GetByName<T>(string name) where T : class
+        {
+            ThrowIfDisposed();
+            return _cache.GetByName<T>(name);
+        }
+
+        /// <summary>
+        /// Gets a typed document by an indexed value.
+        /// </summary>
+        public T? GetByIndex<T>(string alias, string value) where T : class
+        {
+            ThrowIfDisposed();
+            return _cache.GetByIndex<T>(alias, value);
         }
 
         /// <summary>
@@ -709,26 +805,30 @@ namespace GameCult.Networking
             ThrowIfDisposed();
             if (document == null) throw new ArgumentNullException(nameof(document));
 
-            var descriptor = _cache.Registry.GetRequired<T>();
-            var shard = ResolveShardInternal(descriptor.SchemaId, key);
+            var descriptor = _cache.Registry.GetRequired(document.GetType());
+            var shard = ResolveShardInternal(descriptor, key);
             EnsurePrimary(shard, descriptor.SchemaId, key);
 
             var previous = _cache.Get<T>(key);
             var handle = await _cache.UpsertAsync(document, new CultRecordHandle<T>(key)).ConfigureAwait(false);
-            AppendMutationLogEntry(
-                shard,
-                previous == null ? CultNetDatabaseChangeKind.Added : CultNetDatabaseChangeKind.Updated,
-                key,
-                descriptor.SchemaId,
-                document,
-                previous);
-            Publish(new CultNetDatabaseChange<T>(
-                previous == null ? CultNetDatabaseChangeKind.Added : CultNetDatabaseChangeKind.Updated,
-                key,
-                descriptor.SchemaId,
-                shard,
-                document,
-                previous));
+            void PublishCommittedPut()
+            {
+                AppendMutationLogEntry(
+                    shard,
+                    previous == null ? CultNetDatabaseChangeKind.Added : CultNetDatabaseChangeKind.Updated,
+                    key,
+                    descriptor.SchemaId,
+                    document,
+                    previous);
+                Publish(new CultNetDatabaseChange<T>(
+                    previous == null ? CultNetDatabaseChangeKind.Added : CultNetDatabaseChangeKind.Updated,
+                    key,
+                    descriptor.SchemaId,
+                    shard,
+                    document,
+                    previous));
+            }
+            PublishCommittedPut();
             return handle;
         }
 
@@ -740,9 +840,9 @@ namespace GameCult.Networking
             ThrowIfDisposed();
             if (document == null) throw new ArgumentNullException(nameof(document));
 
-            var descriptor = _cache.Registry.GetRequired<T>();
-            var shard = ResolveShardInternal(descriptor.SchemaId, key);
-            EnsureClientAuthority(descriptor.SchemaId, key);
+            var descriptor = _cache.Registry.GetRequired(document.GetType());
+            var shard = ResolveShardInternal(descriptor, key);
+            EnsureClientAuthority(descriptor, key);
 
             var previous = _cache.Get<T>(key);
             var handle = await _cache.UpsertAsync(document, new CultRecordHandle<T>(key)).ConfigureAwait(false);
@@ -764,27 +864,31 @@ namespace GameCult.Networking
         {
             ThrowIfDisposed();
             var descriptor = _cache.Registry.GetRequired<T>();
-            var shard = ResolveShardInternal(descriptor.SchemaId, key);
+            var shard = ResolveShardInternal(descriptor, key);
             EnsurePrimary(shard, descriptor.SchemaId, key);
 
             var previous = _cache.Get<T>(key);
             if (previous != null)
             {
                 _cache.Remove(new CultRecordHandle<T>(key));
-                AppendMutationLogEntry(
-                    shard,
-                    CultNetDatabaseChangeKind.Removed,
-                    key,
-                    descriptor.SchemaId,
-                    document: null,
-                    previousDocument: previous);
-                Publish(new CultNetDatabaseChange<T>(
-                    CultNetDatabaseChangeKind.Removed,
-                    key,
-                    descriptor.SchemaId,
-                    shard,
-                    document: null,
-                    previousDocument: previous));
+                void PublishCommittedDelete()
+                {
+                    AppendMutationLogEntry(
+                        shard,
+                        CultNetDatabaseChangeKind.Removed,
+                        key,
+                        descriptor.SchemaId,
+                        document: null,
+                        previousDocument: previous);
+                    Publish(new CultNetDatabaseChange<T>(
+                        CultNetDatabaseChangeKind.Removed,
+                        key,
+                        descriptor.SchemaId,
+                        shard,
+                        document: null,
+                        previousDocument: previous));
+                }
+                PublishCommittedDelete();
             }
 
             return Task.CompletedTask;
@@ -803,38 +907,45 @@ namespace GameCult.Networking
             }
 
             var key = new CultRecordKey(message.Document.RecordKey);
-            var shard = ResolveShardInternal(message.Document.SchemaId, key);
-            EnsurePrimary(shard, message.Document.SchemaId, key, message.ShardEpoch);
-            var descriptor = _cache.Registry.GetRequiredBySchemaId(message.Document.SchemaId);
+            var descriptor = _documents.ResolveDescriptorForRawDocument(message.Document);
+            var shard = ResolveShardInternal(descriptor, key);
+            EnsurePrimary(shard, descriptor.SchemaId, key, message.ShardEpoch);
             var previous = _cache.Get(key);
             var document = await _documents.ApplyRawDocumentPutMessageAsync(_cache, message).ConfigureAwait(false);
             var kind = previous == null ? CultNetDatabaseChangeKind.Added : CultNetDatabaseChangeKind.Updated;
             var predictionKey = PredictionKey(descriptor.SchemaId, key);
-            if (_predictedDocuments.Remove(predictionKey))
+            var reconcilesPrediction = _predictedDocuments.ContainsKey(predictionKey);
+            if (reconcilesPrediction)
             {
                 kind = CultNetDatabaseChangeKind.Reconciled;
             }
 
-            AppendMutationLogEntry(
-                shard,
-                kind == CultNetDatabaseChangeKind.Reconciled ? CultNetDatabaseChangeKind.Updated : kind,
-                key,
-                descriptor.SchemaId,
-                document,
-                previous,
-                new CultNetShardLogEntryMessage
-                {
-                    ChangeKind = previous == null ? "added" : "updated",
-                    Put = message
-                });
-            PublishUntyped(
-                descriptor.DocumentType,
-                kind,
-                key,
-                descriptor.SchemaId,
-                shard,
-                document,
-                previous);
+            void PublishCommittedPut()
+            {
+                if (reconcilesPrediction)
+                    _predictedDocuments.Remove(predictionKey);
+                AppendMutationLogEntry(
+                    shard,
+                    kind == CultNetDatabaseChangeKind.Reconciled ? CultNetDatabaseChangeKind.Updated : kind,
+                    key,
+                    descriptor.SchemaId,
+                    document,
+                    previous,
+                    new CultNetShardLogEntryMessage
+                    {
+                        ChangeKind = previous == null ? "added" : "updated",
+                        Put = message
+                    });
+                PublishUntyped(
+                    descriptor.DocumentType,
+                    kind,
+                    key,
+                    descriptor.SchemaId,
+                    shard,
+                    document,
+                    previous);
+            }
+            PublishCommittedPut();
             return document;
         }
 
@@ -847,9 +958,9 @@ namespace GameCult.Networking
             if (message == null) throw new ArgumentNullException(nameof(message));
 
             var key = new CultRecordKey(message.RecordKey);
-            var shard = ResolveShardInternal(message.SchemaId, key);
-            EnsurePrimary(shard, message.SchemaId, key, message.ShardEpoch);
-            var descriptor = _cache.Registry.GetRequiredBySchemaId(message.SchemaId);
+            var descriptor = _documents.ResolveDescriptorForSchemaId(message.SchemaId);
+            var shard = ResolveShardInternal(descriptor, key);
+            EnsurePrimary(shard, descriptor.SchemaId, key, message.ShardEpoch);
             var previous = _cache.Get(key);
             if (previous == null)
             {
@@ -857,26 +968,30 @@ namespace GameCult.Networking
             }
 
             _cache.Remove(key);
-            AppendMutationLogEntry(
-                shard,
-                CultNetDatabaseChangeKind.Removed,
-                key,
-                descriptor.SchemaId,
-                document: null,
-                previousDocument: previous,
-                wireEntry: new CultNetShardLogEntryMessage
-                {
-                    ChangeKind = "removed",
-                    Delete = message
-                });
-            PublishUntyped(
-                descriptor.DocumentType,
-                CultNetDatabaseChangeKind.Removed,
-                key,
-                descriptor.SchemaId,
-                shard,
-                document: null,
-                previousDocument: previous);
+            void PublishCommittedDelete()
+            {
+                AppendMutationLogEntry(
+                    shard,
+                    CultNetDatabaseChangeKind.Removed,
+                    key,
+                    descriptor.SchemaId,
+                    document: null,
+                    previousDocument: previous,
+                    wireEntry: new CultNetShardLogEntryMessage
+                    {
+                        ChangeKind = "removed",
+                        Delete = message
+                    });
+                PublishUntyped(
+                    descriptor.DocumentType,
+                    CultNetDatabaseChangeKind.Removed,
+                    key,
+                    descriptor.SchemaId,
+                    shard,
+                    document: null,
+                    previousDocument: previous);
+            }
+            PublishCommittedDelete();
             return Task.CompletedTask;
         }
 
@@ -1019,7 +1134,7 @@ namespace GameCult.Networking
             var key = current != null
                 ? GetTrackedKey(current, documentType)
                 : new CultRecordKey(string.Empty);
-            var shard = ResolveShardInternal(descriptor.SchemaId, key);
+            var shard = ResolveShardInternal(descriptor, key);
             var changeType = typeof(CultNetDatabaseChange<>).MakeGenericType(documentType);
             var change = Activator.CreateInstance(
                 changeType,
@@ -1061,7 +1176,7 @@ namespace GameCult.Networking
                 var documentType = document.GetType();
                 var descriptor = _cache.Registry.GetRequired(documentType);
                 var key = GetTrackedKey(document, documentType);
-                if (!string.IsNullOrWhiteSpace(key.Value) && shard.Matches(descriptor.SchemaId, key))
+                if (!string.IsNullOrWhiteSpace(key.Value) && shard.Matches(descriptor, key))
                 {
                     yield return new TrackedShardDocument(documentType, descriptor.SchemaId, key, document);
                 }
@@ -1070,10 +1185,22 @@ namespace GameCult.Networking
 
         private bool ShardMatchesRawDocument(CultNetShardDescriptor shard, CultNetRawDocumentRecord document)
         {
-            return document != null &&
-                   !string.IsNullOrWhiteSpace(document.SchemaId) &&
-                   !string.IsNullOrWhiteSpace(document.RecordKey) &&
-                   shard.Matches(document.SchemaId, new CultRecordKey(document.RecordKey));
+            if (document == null ||
+                string.IsNullOrWhiteSpace(document.SchemaId) ||
+                string.IsNullOrWhiteSpace(document.RecordKey))
+            {
+                return false;
+            }
+
+            try
+            {
+                var descriptor = _documents.ResolveDescriptorForRawDocument(document);
+                return shard.Matches(descriptor, new CultRecordKey(document.RecordKey));
+            }
+            catch (InvalidOperationException)
+            {
+                return false;
+            }
         }
 
         private void RemoveTrackedDocument(Type documentType, CultRecordKey key)
@@ -1222,7 +1349,7 @@ namespace GameCult.Networking
             }
 
             var key = new CultRecordKey(message.Document.RecordKey);
-            var descriptor = _cache.Registry.GetRequiredBySchemaId(message.Document.SchemaId);
+            var descriptor = _documents.ResolveDescriptorForRawDocument(message.Document);
             var previous = _cache.Get(key);
             var document = await _documents.ApplyRawDocumentPutMessageAsync(_cache, message).ConfigureAwait(false);
             var kind = ChangeKindFromWire(entry.ChangeKind);
@@ -1414,6 +1541,20 @@ namespace GameCult.Networking
                 "not_client_authority");
         }
 
+        private void EnsureClientAuthority(CultDocumentDescriptor descriptor, CultRecordKey key)
+        {
+            if (_clientAuthorityScopes.Any(scope => scope.Matches(_runtimeId, descriptor, key)))
+            {
+                return;
+            }
+
+            var shard = ResolveShardInternal(descriptor, key);
+            throw new CultNetShardAuthorityException(
+                shard,
+                $"Runtime '{_runtimeId}' does not have client prediction authority for schema '{descriptor.SchemaId}' key '{key.Value}'.",
+                "not_client_authority");
+        }
+
         private static string PredictionKey(string schemaId, CultRecordKey key)
         {
             return $"{schemaId}:{key.Value}";
@@ -1449,6 +1590,11 @@ namespace GameCult.Networking
             return _shards.FirstOrDefault(shard => shard.Matches(schemaId, key)) ?? _shards[0];
         }
 
+        private CultNetShardDescriptor ResolveShardInternal(CultDocumentDescriptor descriptor, CultRecordKey key)
+        {
+            return _shards.FirstOrDefault(shard => shard.Matches(descriptor, key)) ?? _shards[0];
+        }
+
         private static void EnsurePrimary(CultNetShardDescriptor shard, string schemaId, CultRecordKey key, long? expectedEpoch = null)
         {
             if (expectedEpoch.HasValue && expectedEpoch.Value != shard.Epoch)
@@ -1470,15 +1616,12 @@ namespace GameCult.Networking
                 "not_primary");
         }
 
-        private static bool MatchesCatalogFilter(
+        private bool MatchesCatalogFilter(
             CultNetShardDescriptor shard,
             IReadOnlyList<string>? schemaIds,
             IReadOnlyList<CultRecordKey>? recordKeys)
         {
-            var schemaMatches = schemaIds == null ||
-                                schemaIds.Count == 0 ||
-                                shard.SchemaIds.Count == 0 ||
-                                schemaIds.Any(schemaId => shard.SchemaIds.Contains(schemaId, StringComparer.Ordinal));
+            var schemaMatches = SchemaMatchesCatalogFilter(shard, schemaIds);
             var keyMatches = recordKeys == null ||
                              recordKeys.Count == 0 ||
                              recordKeys.Any(key => string.IsNullOrEmpty(shard.KeyPrefix) ||
@@ -1486,6 +1629,64 @@ namespace GameCult.Networking
             return schemaMatches && keyMatches;
         }
 
+        private bool SchemaMatchesCatalogFilter(
+            CultNetShardDescriptor shard,
+            IReadOnlyList<string>? schemaIds)
+        {
+            if (schemaIds == null || schemaIds.Count == 0 || shard.SchemaIds.Count == 0)
+                return true;
+
+            var requestedSchemaIds = schemaIds.ToHashSet(StringComparer.Ordinal);
+            if (shard.SchemaIds.Any(requestedSchemaIds.Contains))
+                return true;
+
+            foreach (var shardSchemaId in shard.SchemaIds)
+            {
+                try
+                {
+                    if (MatchesRequestedSchema(_cache.Registry.GetRequiredBySchemaId(shardSchemaId), requestedSchemaIds))
+                        return true;
+                }
+                catch (InvalidOperationException)
+                {
+                    // Shards can advertise schemas that are not loaded in this process.
+                }
+            }
+
+            return false;
+        }
+
+        private static bool MatchesRequestedSchema(
+            CultDocumentDescriptor descriptor,
+            ISet<string> requestedSchemaIds)
+        {
+            if (requestedSchemaIds.Count == 0)
+                return true;
+
+            if (requestedSchemaIds.Contains(descriptor.SchemaId))
+                return true;
+
+            if (descriptor.ToCatalogEntry().CompatibleSchemaIds.Any(requestedSchemaIds.Contains))
+                return true;
+
+            return requestedSchemaIds
+                .Select(InferSchemaName)
+                .Where(schemaName => !string.IsNullOrWhiteSpace(schemaName))
+                .Any(schemaName => string.Equals(schemaName, descriptor.SchemaName, StringComparison.Ordinal));
+        }
+
+        private static string? InferSchemaName(string schemaVersion)
+        {
+            var marker = schemaVersion.LastIndexOf(".v", StringComparison.Ordinal);
+            if (marker <= 0 || marker + 2 >= schemaVersion.Length)
+                return null;
+
+            var version = schemaVersion.Substring(marker + 2);
+            return version.All(char.IsDigit)
+                ? schemaVersion.Substring(0, marker)
+                : null;
+        }
+
         internal static CultNetShardDescriptorMessage ToMessage(CultNetShardDescriptor shard)
         {
             return new CultNetShardDescriptorMessage
diff --git a/src/GameCult.Networking/CultNetDatabaseServer.cs b/src/GameCult.Networking/CultNetDatabaseServer.cs
index df8dbbbf..c2926da3 100644
--- a/src/GameCult.Networking/CultNetDatabaseServer.cs
+++ b/src/GameCult.Networking/CultNetDatabaseServer.cs
@@ -303,6 +303,14 @@ namespace GameCult.Networking
                     RecordKeys = message.RecordKeys
                 }));
             }
+            else
+            {
+                peer.SendCultNet(new CultNetSnapshotResponseRawMessage
+                {
+                    MessageId = message.MessageId,
+                    Documents = Array.Empty<CultNetRawDocumentRecord>()
+                });
+            }
 
             return Task.CompletedTask;
         }
@@ -344,7 +352,10 @@ namespace GameCult.Networking
             var changeType = change.GetType();
             var key = (CultRecordKey)(changeType.GetProperty("Key")?.GetValue(change) ?? new CultRecordKey(string.Empty));
             var schemaId = (string?)changeType.GetProperty("SchemaId")?.GetValue(change) ?? string.Empty;
-            if (!Matches(request, schemaId, key))
+            var documentType = changeType.IsGenericType ? changeType.GetGenericArguments()[0] : null;
+            var descriptor = documentType == null ? null : _database.Cache.Registry.GetRequired(documentType);
+            var binding = documentType == null ? null : _database.Documents.GetByDocumentType(documentType);
+            if (!Matches(request, schemaId, key, descriptor, binding))
             {
                 return null;
             }
@@ -387,17 +398,75 @@ namespace GameCult.Networking
             return ((CultNetDocumentPutRawMessage)message!).Document;
         }
 
-        private static bool Matches(CultNetDatabaseSubscribeMessage request, string schemaId, CultRecordKey key)
+        private static bool Matches(
+            CultNetDatabaseSubscribeMessage request,
+            string schemaId,
+            CultRecordKey key,
+            CultDocumentDescriptor? descriptor,
+            CultNetDocumentBinding? binding)
         {
-            var schemaMatches = request.SchemaIds == null ||
-                                request.SchemaIds.Length == 0 ||
-                                request.SchemaIds.Contains(schemaId, StringComparer.Ordinal);
+            var schemaMatches = MatchesSchema(request.SchemaIds, schemaId, descriptor, binding);
             var keyMatches = request.RecordKeys == null ||
                              request.RecordKeys.Length == 0 ||
                              request.RecordKeys.Contains(key.Value, StringComparer.Ordinal);
             return schemaMatches && keyMatches;
         }
 
+        private static bool MatchesSchema(
+            string[]? requestedSchemaIds,
+            string schemaId,
+            CultDocumentDescriptor? descriptor,
+            CultNetDocumentBinding? binding)
+        {
+            if (requestedSchemaIds == null || requestedSchemaIds.Length == 0)
+            {
+                return true;
+            }
+
+            var requested = requestedSchemaIds.ToHashSet(StringComparer.Ordinal);
+            if (requested.Contains(schemaId))
+            {
+                return true;
+            }
+
+            if (descriptor == null)
+            {
+                return false;
+            }
+
+            if (requested.Contains(descriptor.SchemaId) ||
+                requested.Contains(descriptor.SchemaName) ||
+                requested.Contains(descriptor.SchemaVersion) ||
+                (binding != null && requested.Contains(binding.SchemaId)))
+            {
+                return true;
+            }
+
+            if (descriptor.ToCatalogEntry().CompatibleSchemaIds.Any(requested.Contains))
+            {
+                return true;
+            }
+
+            return requested
+                .Select(InferSchemaName)
+                .Where(schemaName => !string.IsNullOrWhiteSpace(schemaName))
+                .Any(schemaName => string.Equals(schemaName, descriptor.SchemaName, StringComparison.Ordinal));
+        }
+
+        private static string? InferSchemaName(string schemaVersion)
+        {
+            var marker = schemaVersion.LastIndexOf(".v", StringComparison.Ordinal);
+            if (marker <= 0 || marker + 2 >= schemaVersion.Length)
+            {
+                return null;
+            }
+
+            var version = schemaVersion.Substring(marker + 2);
+            return version.All(char.IsDigit)
+                ? schemaVersion.Substring(0, marker)
+                : null;
+        }
+
         private static string SubscriptionKey(NetPeer peer, string subscriptionId)
         {
             return $"{peer.Id}:{subscriptionId}";
diff --git a/src/GameCult.Networking/CultNetDatabaseSubscriptionClient.cs b/src/GameCult.Networking/CultNetDatabaseSubscriptionClient.cs
new file mode 100644
index 00000000..db1e2907
--- /dev/null
+++ b/src/GameCult.Networking/CultNetDatabaseSubscriptionClient.cs
@@ -0,0 +1,410 @@
+using System;
+using System.Collections.Concurrent;
+using System.Collections.Generic;
+using System.Linq;
+using System.Reflection;
+using System.Threading;
+using System.Threading.Tasks;
+using GameCult.Caching;
+
+namespace GameCult.Networking
+{
+    /// <summary>Controls whether subscription payloads become replica state or remain ephemeral typed events.</summary>
+    public enum CultNetDatabaseSubscriptionDeliveryMode
+    {
+        /// <summary>Decode each payload and write it into the local CultCache before notifying observers.</summary>
+        ReplicateToCache,
+        /// <summary>Decode each payload and notify observers without writing replica state.</summary>
+        Live
+    }
+
+    /// <summary>
+    /// Replicates selected remote database records into a local typed CultCache over one retained session.
+    /// </summary>
+    public sealed class CultNetDatabaseSubscriptionClient : IDisposable
+    {
+        private readonly ICultNetSchemaClient _client;
+        private readonly CultCache _cache;
+        private readonly CultNetDocumentRegistry _documents;
+        private readonly ConcurrentDictionary<string, PendingSubscription> _initialSnapshots = new();
+        private readonly ConcurrentDictionary<string, CultNetDatabaseSubscriptionDeliveryMode> _deliveryModes =
+            new(StringComparer.Ordinal);
+        private readonly object _queueLock = new();
+        private Task _queue = Task.CompletedTask;
+        private bool _disposed;
+
+        public CultNetDatabaseSubscriptionClient(
+            ICultNetSchemaClient client,
+            CultCache cache,
+            CultNetDocumentRegistry documents)
+        {
+            _client = client ?? throw new ArgumentNullException(nameof(client));
+            _cache = cache ?? throw new ArgumentNullException(nameof(cache));
+            _documents = documents ?? throw new ArgumentNullException(nameof(documents));
+            _client.OnCultNet<CultNetSnapshotResponseRawMessage>(HandleSnapshot);
+            _client.OnCultNet<CultNetDatabaseChangeRawMessage>(HandleChange);
+        }
+
+        /// <summary>Raised after a live change has been applied to the local typed cache.</summary>
+        public event Action<CultNetReplicatedDocumentChange>? Changed;
+
+        /// <summary>Gets the local reactive cache receiving replicated documents.</summary>
+        public CultCache Cache => _cache;
+
+        /// <summary>Completes if the retained transport pump terminates with an unrecoverable error.</summary>
+        public Task<Exception>? BackgroundFailure =>
+            (_client as RudpCultNetSchemaClient)?.BackgroundFailure;
+
+        /// <summary>
+        /// Subscribes to one exact typed record as an ephemeral reactive value. The returned value
+        /// owns filtering and unsubscribe; no received payload is written into the local cache.
+        /// </summary>
+        public async Task<CultNetLiveValue<TDocument>> SubscribeLiveValueAsync<TDocument>(
+            string subscriptionId,
+            string recordKey,
+            CancellationToken cancellationToken = default)
+            where TDocument : class
+        {
+            if (string.IsNullOrWhiteSpace(recordKey))
+                throw new ArgumentException("Record key is required.", nameof(recordKey));
+            var schemaId = _documents.GetByDocumentType(typeof(TDocument))?.SchemaId ??
+                _cache.Registry.GetRequired<TDocument>().SchemaId;
+            var value = new CultNetLiveValue<TDocument>(this, subscriptionId, recordKey);
+            try
+            {
+                var initial = await SubscribeAsync(
+                        subscriptionId,
+                        recordKeys: new[] { recordKey },
+                        schemaIds: new[] { schemaId },
+                        deliveryMode: CultNetDatabaseSubscriptionDeliveryMode.Live,
+                        cancellationToken: cancellationToken)
+                    .ConfigureAwait(false);
+                var documents = initial.OfType<TDocument>().ToArray();
+                if (documents.Length > 1)
+                    throw new InvalidOperationException(
+                        $"Live value subscription '{subscriptionId}' expected at most one '{schemaId}' record '{recordKey}' but received {documents.Length}.");
+                if (documents.Length == 1)
+                    value.Initialize(documents[0]);
+                return value;
+            }
+            catch
+            {
+                value.Dispose();
+                throw;
+            }
+        }
+
+        /// <summary>
+        /// Starts a remote subscription and waits until its initial matching snapshot is in the local cache.
+        /// </summary>
+        public Task<IReadOnlyList<object>> SubscribeAsync(
+            string subscriptionId,
+            IEnumerable<string>? recordKeys = null,
+            IEnumerable<string>? schemaIds = null,
+            bool includeSnapshot = true,
+            CancellationToken cancellationToken = default,
+            string? consumerRuntimeId = null,
+            IEnumerable<string>? bodyIds = null,
+            IEnumerable<string>? supportedBodyTransports = null,
+            CultNetDatabaseSubscriptionDeliveryMode deliveryMode = CultNetDatabaseSubscriptionDeliveryMode.ReplicateToCache)
+        {
+            if (_disposed) throw new ObjectDisposedException(nameof(CultNetDatabaseSubscriptionClient));
+            if (!_client.Connected) throw new InvalidOperationException("CultNet schema client must be connected before subscribing.");
+            if (string.IsNullOrWhiteSpace(subscriptionId)) throw new ArgumentException("Subscription id is required.", nameof(subscriptionId));
+
+            var messageId = Guid.NewGuid().ToString("N");
+            var completion = new TaskCompletionSource<IReadOnlyList<object>>(TaskCreationOptions.RunContinuationsAsynchronously);
+            if (!_initialSnapshots.TryAdd(messageId, new PendingSubscription(subscriptionId, deliveryMode, completion)))
+                throw new InvalidOperationException($"Duplicate database subscription message id '{messageId}'.");
+            _deliveryModes[subscriptionId] = deliveryMode;
+
+            CancellationTokenRegistration cancellation = default;
+            if (cancellationToken.CanBeCanceled)
+            {
+                cancellation = cancellationToken.Register(() =>
+                {
+                    if (_initialSnapshots.TryRemove(messageId, out var pending))
+                        pending.Completion.TrySetCanceled(cancellationToken);
+                });
+                _ = completion.Task.ContinueWith(
+                    _ => cancellation.Dispose(),
+                    CancellationToken.None,
+                    TaskContinuationOptions.ExecuteSynchronously,
+                    TaskScheduler.Default);
+            }
+
+            try
+            {
+                _client.SendCultNet(new CultNetDatabaseSubscribeMessage
+                {
+                    MessageId = messageId,
+                    SubscriptionId = subscriptionId,
+                    RecordKeys = recordKeys?.Where(value => !string.IsNullOrWhiteSpace(value)).Distinct(StringComparer.Ordinal).ToArray(),
+                    SchemaIds = schemaIds?.Where(value => !string.IsNullOrWhiteSpace(value)).Distinct(StringComparer.Ordinal).ToArray(),
+                    IncludeSnapshot = includeSnapshot,
+                    ConsumerRuntimeId = consumerRuntimeId,
+                    BodyIds = bodyIds?.Where(value => !string.IsNullOrWhiteSpace(value)).Distinct(StringComparer.Ordinal).ToArray(),
+                    SupportedBodyTransports = supportedBodyTransports?
+                        .Where(value => !string.IsNullOrWhiteSpace(value))
+                        .Distinct(StringComparer.OrdinalIgnoreCase)
+                        .ToArray()
+                });
+            }
+            catch
+            {
+                _deliveryModes.TryRemove(subscriptionId, out _);
+                if (_initialSnapshots.TryRemove(messageId, out var pending))
+                    pending.Completion.TrySetException(new InvalidOperationException("CultNet subscription request could not be sent."));
+                throw;
+            }
+            return completion.Task;
+        }
+
+        /// <summary>Stops one live remote subscription.</summary>
+        public void Unsubscribe(string subscriptionId)
+        {
+            if (_disposed) return;
+            if (string.IsNullOrWhiteSpace(subscriptionId)) throw new ArgumentException("Subscription id is required.", nameof(subscriptionId));
+            _deliveryModes.TryRemove(subscriptionId, out _);
+            _client.SendCultNet(new CultNetDatabaseUnsubscribeMessage
+            {
+                MessageId = Guid.NewGuid().ToString("N"),
+                SubscriptionId = subscriptionId
+            });
+        }
+
+        public void Dispose()
+        {
+            if (_disposed) return;
+            _disposed = true;
+            foreach (var pending in _initialSnapshots.Values)
+                pending.Completion.TrySetException(new ObjectDisposedException(nameof(CultNetDatabaseSubscriptionClient)));
+            _initialSnapshots.Clear();
+            _deliveryModes.Clear();
+            _client.Dispose();
+        }
+
+        private void HandleSnapshot(CultNetSnapshotResponseRawMessage message)
+        {
+            Enqueue(async () =>
+            {
+                if (!_initialSnapshots.TryRemove(message.MessageId, out var pending)) return;
+                try
+                {
+                    IReadOnlyList<object> applied;
+                    if (pending.DeliveryMode == CultNetDatabaseSubscriptionDeliveryMode.Live)
+                    {
+                        applied = message.Documents.Select(_documents.DeserializeRawDocument).ToArray();
+                    }
+                    else
+                    {
+                        applied = await _documents.ApplyRawSnapshotResponseAsync(_cache, message).ConfigureAwait(false);
+                    }
+                    pending.Completion.TrySetResult(applied);
+                }
+                catch (Exception error)
+                {
+                    pending.Completion.TrySetException(error);
+                }
+            });
+        }
+
+        private void HandleChange(CultNetDatabaseChangeRawMessage message)
+        {
+            Enqueue(async () =>
+            {
+                var deliveryMode = _deliveryModes.TryGetValue(message.SubscriptionId, out var configured)
+                    ? configured
+                    : CultNetDatabaseSubscriptionDeliveryMode.ReplicateToCache;
+                if (string.Equals(message.ChangeKind, "removed", StringComparison.Ordinal))
+                {
+                    if (deliveryMode == CultNetDatabaseSubscriptionDeliveryMode.ReplicateToCache)
+                        await DeleteAsync(message).ConfigureAwait(false);
+                    Changed?.Invoke(new CultNetReplicatedDocumentChange(
+                        message.SubscriptionId,
+                        "removed",
+                        message.RecordKey ?? string.Empty,
+                        message.SchemaId ?? string.Empty,
+                        null));
+                    return;
+                }
+
+                if (message.Document == null) return;
+                var document = deliveryMode == CultNetDatabaseSubscriptionDeliveryMode.Live
+                    ? _documents.DeserializeRawDocument(message.Document)
+                    : await _documents.ApplyRawDocumentPutMessageAsync(
+                        _cache,
+                        new CultNetDocumentPutRawMessage
+                        {
+                            MessageId = message.MessageId,
+                            Document = message.Document
+                        }).ConfigureAwait(false);
+                Changed?.Invoke(new CultNetReplicatedDocumentChange(
+                    message.SubscriptionId,
+                    message.ChangeKind,
+                    message.Document.RecordKey,
+                    message.Document.SchemaId,
+                    document));
+            });
+        }
+
+        private Task DeleteAsync(CultNetDatabaseChangeRawMessage message)
+        {
+            if (string.IsNullOrWhiteSpace(message.RecordKey) || string.IsNullOrWhiteSpace(message.SchemaId)) return Task.CompletedTask;
+            _documents.ResolveDescriptorForSchemaId(message.SchemaId!);
+            _cache.Remove(new CultRecordKey(message.RecordKey!));
+            return Task.CompletedTask;
+        }
+
+        private void Enqueue(Func<Task> operation)
+        {
+            lock (_queueLock)
+            {
+                _queue = _queue.ContinueWith(
+                    _ => operation(),
+                    TaskScheduler.Default).Unwrap();
+            }
+        }
+
+        private sealed class PendingSubscription
+        {
+            public PendingSubscription(
+                string subscriptionId,
+                CultNetDatabaseSubscriptionDeliveryMode deliveryMode,
+                TaskCompletionSource<IReadOnlyList<object>> completion)
+            {
+                SubscriptionId = subscriptionId;
+                DeliveryMode = deliveryMode;
+                Completion = completion;
+            }
+
+            public string SubscriptionId { get; }
+            public CultNetDatabaseSubscriptionDeliveryMode DeliveryMode { get; }
+            public TaskCompletionSource<IReadOnlyList<object>> Completion { get; }
+        }
+    }
+
+    /// <summary>One exact typed remote record kept as an ephemeral current value.</summary>
+    public sealed class CultNetLiveValue<TDocument> : IDisposable where TDocument : class
+    {
+        private readonly CultNetDatabaseSubscriptionClient _owner;
+        private readonly string _subscriptionId;
+        private readonly string _recordKey;
+        private readonly object _gate = new();
+        private TDocument? _current;
+        private bool _hasValue;
+        private bool _disposed;
+
+        internal CultNetLiveValue(
+            CultNetDatabaseSubscriptionClient owner,
+            string subscriptionId,
+            string recordKey)
+        {
+            _owner = owner ?? throw new ArgumentNullException(nameof(owner));
+            _subscriptionId = string.IsNullOrWhiteSpace(subscriptionId)
+                ? throw new ArgumentException("Subscription id is required.", nameof(subscriptionId))
+                : subscriptionId;
+            _recordKey = recordKey;
+            _owner.Changed += OnChanged;
+        }
+
+        /// <summary>Raised when the provider publishes a new typed value.</summary>
+        public event Action<TDocument>? Changed;
+
+        /// <summary>Raised when the provider removes the selected record.</summary>
+        public event Action? Removed;
+
+        /// <summary>Gets whether the selected record currently exists.</summary>
+        public bool HasValue
+        {
+            get { lock (_gate) return _hasValue; }
+        }
+
+        /// <summary>Gets the current value, or fails when the record has not been published.</summary>
+        public TDocument Current
+        {
+            get
+            {
+                lock (_gate)
+                    return _hasValue
+                        ? _current!
+                        : throw new InvalidOperationException(
+                            $"Live value '{_recordKey}' is not currently published.");
+            }
+        }
+
+        internal void Initialize(TDocument document)
+        {
+            lock (_gate)
+            {
+                if (_disposed || _hasValue) return;
+                _current = document;
+                _hasValue = true;
+            }
+        }
+
+        public void Dispose()
+        {
+            lock (_gate)
+            {
+                if (_disposed) return;
+                _disposed = true;
+            }
+            _owner.Changed -= OnChanged;
+            _owner.Unsubscribe(_subscriptionId);
+        }
+
+        private void OnChanged(CultNetReplicatedDocumentChange change)
+        {
+            if (!string.Equals(change.SubscriptionId, _subscriptionId, StringComparison.Ordinal) ||
+                !string.Equals(change.RecordKey, _recordKey, StringComparison.Ordinal))
+                return;
+
+            if (string.Equals(change.ChangeKind, "removed", StringComparison.Ordinal))
+            {
+                lock (_gate)
+                {
+                    if (_disposed) return;
+                    _current = null;
+                    _hasValue = false;
+                }
+                Removed?.Invoke();
+                return;
+            }
+
+            if (change.Document is not TDocument document)
+                return;
+            lock (_gate)
+            {
+                if (_disposed) return;
+                _current = document;
+                _hasValue = true;
+            }
+            Changed?.Invoke(document);
+        }
+    }
+
+    /// <summary>Describes one typed document change after local replication.</summary>
+    public sealed class CultNetReplicatedDocumentChange
+    {
+        public CultNetReplicatedDocumentChange(
+            string subscriptionId,
+            string changeKind,
+            string recordKey,
+            string schemaId,
+            object? document)
+        {
+            SubscriptionId = subscriptionId;
+            ChangeKind = changeKind;
+            RecordKey = recordKey;
+            SchemaId = schemaId;
+            Document = document;
+        }
+
+        public string SubscriptionId { get; }
+        public string ChangeKind { get; }
+        public string RecordKey { get; }
+        public string SchemaId { get; }
+        public object? Document { get; }
+    }
+}
diff --git a/src/GameCult.Networking/CultNetDatabaseSubscriptionServer.cs b/src/GameCult.Networking/CultNetDatabaseSubscriptionServer.cs
new file mode 100644
index 00000000..3d284556
--- /dev/null
+++ b/src/GameCult.Networking/CultNetDatabaseSubscriptionServer.cs
@@ -0,0 +1,629 @@
+using System;
+using System.Collections.Concurrent;
+using System.Collections.Generic;
+using System.Linq;
+using System.Reflection;
+using System.Runtime.CompilerServices;
+using System.Net;
+using System.Threading.Tasks;
+using GameCult.Caching;
+using R3;
+
+namespace GameCult.Networking
+{
+    /// <summary>
+    /// Publishes live database changes through any schema-v0 server transport.
+    /// Optional record projection runs after authorization and owns both initial
+    /// snapshot and live-update delivery for a peer.
+    /// </summary>
+    public sealed class CultNetDatabaseSubscriptionServer : IDisposable
+    {
+        private readonly ICultNetSchemaServer _server;
+        private readonly CultNetDatabase _database;
+        private readonly Func<CultNetDatabaseSubscribeMessage, ICultNetSchemaServerPeer, Task> _subscribe;
+        private readonly Func<CultNetDatabaseUnsubscribeMessage, ICultNetSchemaServerPeer, Task> _unsubscribe;
+        private readonly Func<CultNetDatabaseSubscribeMessage, ICultNetSchemaServerPeer, bool>? _authorizeRequest;
+        private readonly Func<CultNetDatabaseSubscribeMessage, ICultNetSchemaServerPeer, string, string, bool>? _authorizeRecord;
+        private readonly Func<CultNetDatabaseSubscribeMessage, ICultNetSchemaServerPeer, CultNetRawDocumentRecord, CultNetRawDocumentRecord?>? _projectRecord;
+        private readonly ICultNetSchemaServerPeerLifecycle? _peerLifecycle;
+        private readonly ConcurrentDictionary<SubscriptionKey, IDisposable> _subscriptions =
+            new ConcurrentDictionary<SubscriptionKey, IDisposable>(SubscriptionKeyComparer.Instance);
+        private readonly ConcurrentDictionary<SubscriptionKey, CultNetDatabaseSubscribeMessage> _requests =
+            new ConcurrentDictionary<SubscriptionKey, CultNetDatabaseSubscribeMessage>(SubscriptionKeyComparer.Instance);
+        private readonly ConcurrentDictionary<SubscriptionKey, SubscriptionProjectionState> _projections =
+            new ConcurrentDictionary<SubscriptionKey, SubscriptionProjectionState>(SubscriptionKeyComparer.Instance);
+        private readonly object _lifecycleGate = new();
+        private bool _disposed;
+
+        /// <summary>Attaches live database subscription handlers to a schema server.</summary>
+        public CultNetDatabaseSubscriptionServer(
+            ICultNetSchemaServer server,
+            CultNetDatabase database,
+            Func<CultNetDatabaseSubscribeMessage, ICultNetSchemaServerPeer, bool>? authorizeRequest = null,
+            Func<CultNetDatabaseSubscribeMessage, ICultNetSchemaServerPeer, string, string, bool>? authorizeRecord = null,
+            Func<CultNetDatabaseSubscribeMessage, ICultNetSchemaServerPeer, CultNetRawDocumentRecord, CultNetRawDocumentRecord?>? projectRecord = null)
+        {
+            _server = server ?? throw new ArgumentNullException(nameof(server));
+            _database = database ?? throw new ArgumentNullException(nameof(database));
+            _authorizeRequest = authorizeRequest;
+            _authorizeRecord = authorizeRecord;
+            _projectRecord = projectRecord;
+            _subscribe = HandleSubscribeAsync;
+            _unsubscribe = HandleUnsubscribeAsync;
+            _server.OnCultNet(_subscribe);
+            _server.OnCultNet(_unsubscribe);
+            _peerLifecycle = server as ICultNetSchemaServerPeerLifecycle;
+            if (_peerLifecycle != null)
+                _peerLifecycle.PeerDisconnected += HandlePeerDisconnected;
+        }
+
+        /// <summary>
+        /// Raised when an exact subscription is activated or withdrawn. Providers can use
+        /// the requested records and schemas to materialize reactive state only while a
+        /// consumer needs it; body publishers additionally use the negotiated body route.
+        /// </summary>
+        public event Action<CultNetDatabaseSubscriptionDemand>? DemandChanged;
+
+        /// <summary>
+        /// Re-evaluates every live peer projection against current authorization and source state.
+        /// Records that lost visibility are explicitly removed and body demand is withdrawn while
+        /// the request is unauthorized. The subscription intent remains available for a later
+        /// authorized generation on the same established peer.
+        /// </summary>
+        public void Reconcile()
+        {
+            lock (_lifecycleGate)
+            {
+                if (_disposed) return;
+                foreach (var entry in _requests.ToArray())
+                    Reconcile(entry.Key, entry.Value);
+            }
+        }
+
+        /// <summary>Detaches handlers and releases all active watches.</summary>
+        public void Dispose()
+        {
+            lock (_lifecycleGate)
+            {
+                if (_disposed) return;
+                _disposed = true;
+                _server.RemoveCultNetMessageListener<CultNetDatabaseSubscribeMessage>(_subscribe);
+                _server.RemoveCultNetMessageListener<CultNetDatabaseUnsubscribeMessage>(_unsubscribe);
+                if (_peerLifecycle != null)
+                    _peerLifecycle.PeerDisconnected -= HandlePeerDisconnected;
+                foreach (var entry in _subscriptions.ToArray())
+                    Withdraw(entry.Key, sendRemovals: false, forgetRequest: true);
+                _subscriptions.Clear();
+                _requests.Clear();
+                _projections.Clear();
+            }
+        }
+
+        private void HandlePeerDisconnected(ICultNetSchemaServerPeer peer)
+        {
+            lock (_lifecycleGate)
+            {
+                foreach (var key in _subscriptions.Keys.Where(candidate =>
+                             SubscriptionKeyComparer.SamePeer(candidate.Peer, peer)).ToArray())
+                    Withdraw(key, sendRemovals: false, forgetRequest: true);
+            }
+        }
+
+        private Task HandleSubscribeAsync(CultNetDatabaseSubscribeMessage request, ICultNetSchemaServerPeer peer)
+        {
+            var subscriptionId = string.IsNullOrWhiteSpace(request.SubscriptionId)
+                ? request.MessageId
+                : request.SubscriptionId;
+            if (string.IsNullOrWhiteSpace(subscriptionId))
+            {
+                peer.SendCultNet(new CultNetErrorMessage { Error = "Database subscription requires a subscriptionId or messageId." });
+                return Task.CompletedTask;
+            }
+            if (_authorizeRequest?.Invoke(request, peer) == false)
+            {
+                peer.SendCultNet(new CultNetErrorMessage { Error = "Database subscription is not authorized for this peer." });
+                return Task.CompletedTask;
+            }
+
+            lock (_lifecycleGate)
+            {
+                var key = new SubscriptionKey(peer, subscriptionId);
+                Withdraw(key, sendRemovals: true, forgetRequest: true);
+                var projection = new SubscriptionProjectionState();
+                _projections[key] = projection;
+                _requests[key] = request;
+                try
+                {
+                    _subscriptions[key] = Watch(request, subscriptionId, peer, key);
+                    if (request.IncludeSnapshot)
+                    {
+                        var snapshot = CreateProjectedSnapshot(request, peer);
+                        foreach (var entry in snapshot.BySourceRecordKey)
+                            projection.DeliveredBySourceRecordKey[entry.Key] = entry.Value;
+                        peer.SendCultNet(new CultNetSnapshotResponseRawMessage
+                        {
+                            MessageId = request.MessageId,
+                            Documents = snapshot.Documents
+                        });
+                    }
+                    else
+                    {
+                        peer.SendCultNet(new CultNetSnapshotResponseRawMessage
+                        {
+                            MessageId = request.MessageId,
+                            Documents = Array.Empty<CultNetRawDocumentRecord>()
+                        });
+                    }
+                    PublishDemand(request, key, active: true);
+                    projection.DemandActive = true;
+                }
+                catch
+                {
+                    Withdraw(key, sendRemovals: false, forgetRequest: true);
+                    throw;
+                }
+            }
+            return Task.CompletedTask;
+        }
+
+        private Task HandleUnsubscribeAsync(CultNetDatabaseUnsubscribeMessage request, ICultNetSchemaServerPeer peer)
+        {
+            var subscriptionId = string.IsNullOrWhiteSpace(request.SubscriptionId)
+                ? request.MessageId
+                : request.SubscriptionId;
+            if (!string.IsNullOrWhiteSpace(subscriptionId))
+            {
+                var key = new SubscriptionKey(peer, subscriptionId);
+                lock (_lifecycleGate)
+                    Withdraw(key, sendRemovals: false, forgetRequest: true);
+            }
+            return Task.CompletedTask;
+        }
+
+        private void PublishDemand(
+            CultNetDatabaseSubscribeMessage request,
+            SubscriptionKey key,
+            bool active)
+        {
+            DemandChanged?.Invoke(new CultNetDatabaseSubscriptionDemand(
+                string.IsNullOrWhiteSpace(request.ConsumerRuntimeId) ? key.Id : request.ConsumerRuntimeId!,
+                key.Id,
+                (request.RecordKeys ?? Array.Empty<string>())
+                    .Where(value => !string.IsNullOrWhiteSpace(value))
+                    .Distinct(StringComparer.Ordinal)
+                    .ToArray(),
+                (request.SchemaIds ?? Array.Empty<string>())
+                    .Where(value => !string.IsNullOrWhiteSpace(value))
+                    .Distinct(StringComparer.Ordinal)
+                    .ToArray(),
+                (request.BodyIds ?? Array.Empty<string>())
+                    .Where(value => !string.IsNullOrWhiteSpace(value))
+                    .Distinct(StringComparer.Ordinal)
+                    .ToArray(),
+                (request.SupportedBodyTransports ?? Array.Empty<string>())
+                    .Where(value => !string.IsNullOrWhiteSpace(value))
+                    .Distinct(StringComparer.OrdinalIgnoreCase)
+                    .ToArray(),
+                IsSameMachine(key.Peer),
+                active));
+        }
+
+        private static bool IsSameMachine(ICultNetSchemaServerPeer peer)
+        {
+            if (peer is ICultNetSchemaServerPeerLocation located && located.RemoteEndPoint is IPEndPoint ip)
+                return IPAddress.IsLoopback(ip.Address);
+            return false;
+        }
+
+        private IDisposable Watch(
+            CultNetDatabaseSubscribeMessage request,
+            string subscriptionId,
+            ICultNetSchemaServerPeer peer,
+            SubscriptionKey key)
+        {
+            return _database.WatchAllChanges().Subscribe(change =>
+            {
+                lock (_lifecycleGate)
+                {
+                    if (_disposed || !_requests.ContainsKey(key) || !_projections.TryGetValue(key, out var projection))
+                        return;
+                    if (_authorizeRequest?.Invoke(request, peer) == false)
+                    {
+                        Reconcile(key, request);
+                        return;
+                    }
+
+                    var sourceRecordKey = ResolveChangeRecordKey(change);
+                    var message = CreateAuthorizedChange(change, request, subscriptionId, peer);
+                    var projected = message?.Document;
+                    if (projected != null && _projectRecord != null)
+                        projected = _projectRecord(request, peer, projected);
+                    ApplyProjectedChange(
+                        projection,
+                        sourceRecordKey,
+                        projected,
+                        peer,
+                        subscriptionId);
+                }
+            });
+        }
+
+        private void Reconcile(SubscriptionKey key, CultNetDatabaseSubscribeMessage request)
+        {
+            if (!_projections.TryGetValue(key, out var projection)) return;
+            var authorized = _authorizeRequest?.Invoke(request, key.Peer) != false;
+            var next = authorized
+                ? CreateProjectedSnapshot(request, key.Peer)
+                : ProjectedSnapshot.Empty;
+
+            foreach (var previous in projection.DeliveredBySourceRecordKey.ToArray())
+            {
+                if (!next.BySourceRecordKey.TryGetValue(previous.Key, out var current))
+                {
+                    SendRemoval(key.Peer, key.Id, previous.Value);
+                    continue;
+                }
+                if (!string.Equals(previous.Value.RecordKey, current.RecordKey, StringComparison.Ordinal) ||
+                    !string.Equals(previous.Value.SchemaId, current.SchemaId, StringComparison.Ordinal))
+                {
+                    SendRemoval(key.Peer, key.Id, previous.Value);
+                    SendUpsert(key.Peer, key.Id, current, added: true);
+                }
+                else if (!Equivalent(previous.Value, current))
+                {
+                    SendUpsert(key.Peer, key.Id, current, added: false);
+                }
+            }
+            foreach (var current in next.BySourceRecordKey)
+            {
+                if (!projection.DeliveredBySourceRecordKey.ContainsKey(current.Key))
+                    SendUpsert(key.Peer, key.Id, current.Value, added: true);
+            }
+
+            projection.DeliveredBySourceRecordKey.Clear();
+            foreach (var current in next.BySourceRecordKey)
+                projection.DeliveredBySourceRecordKey[current.Key] = current.Value;
+
+            if (projection.DemandActive != authorized)
+            {
+                projection.DemandActive = authorized;
+                PublishDemand(request, key, authorized);
+            }
+        }
+
+        private ProjectedSnapshot CreateProjectedSnapshot(
+            CultNetDatabaseSubscribeMessage request,
+            ICultNetSchemaServerPeer peer)
+        {
+            var snapshot = _database.Documents.CreateRawSnapshotResponse(
+                _database.Cache,
+                request.MessageId,
+                new CultNetSnapshotRequestMessage
+                {
+                    MessageId = request.MessageId,
+                    SchemaIds = request.SchemaIds,
+                    RecordKeys = request.RecordKeys
+                });
+            var bySourceRecordKey = new Dictionary<string, CultNetRawDocumentRecord>(StringComparer.Ordinal);
+            var projectedRecordKeys = new HashSet<string>(StringComparer.Ordinal);
+            foreach (var source in snapshot.Documents)
+            {
+                var sourceRecordKey = source.RecordKey;
+                if (_authorizeRecord?.Invoke(request, peer, sourceRecordKey, source.SchemaId) == false)
+                    continue;
+                var projected = _projectRecord == null ? source : _projectRecord(request, peer, source);
+                if (projected == null) continue;
+                if (!projectedRecordKeys.Add(projected.RecordKey))
+                    throw new InvalidOperationException(
+                        $"Database subscription projection produced duplicate record key '{projected.RecordKey}'.");
+                bySourceRecordKey[sourceRecordKey] = projected;
+            }
+            return new ProjectedSnapshot(bySourceRecordKey);
+        }
+
+        private void ApplyProjectedChange(
+            SubscriptionProjectionState projection,
+            string sourceRecordKey,
+            CultNetRawDocumentRecord? current,
+            ICultNetSchemaServerPeer peer,
+            string subscriptionId)
+        {
+            projection.DeliveredBySourceRecordKey.TryGetValue(sourceRecordKey, out var previous);
+            if (current == null)
+            {
+                if (previous != null)
+                {
+                    projection.DeliveredBySourceRecordKey.Remove(sourceRecordKey);
+                    SendRemoval(peer, subscriptionId, previous);
+                }
+                return;
+            }
+            if (previous == null)
+            {
+                projection.DeliveredBySourceRecordKey[sourceRecordKey] = current;
+                SendUpsert(peer, subscriptionId, current, added: true);
+                return;
+            }
+            if (!string.Equals(previous.RecordKey, current.RecordKey, StringComparison.Ordinal) ||
+                !string.Equals(previous.SchemaId, current.SchemaId, StringComparison.Ordinal))
+            {
+                SendRemoval(peer, subscriptionId, previous);
+                projection.DeliveredBySourceRecordKey[sourceRecordKey] = current;
+                SendUpsert(peer, subscriptionId, current, added: true);
+                return;
+            }
+            if (!Equivalent(previous, current))
+            {
+                projection.DeliveredBySourceRecordKey[sourceRecordKey] = current;
+                SendUpsert(peer, subscriptionId, current, added: false);
+            }
+        }
+
+        private static string ResolveChangeRecordKey(object change)
+        {
+            var value = change.GetType().GetProperty("Key")?.GetValue(change);
+            return value is CultRecordKey key ? key.Value : string.Empty;
+        }
+
+        private static bool Equivalent(CultNetRawDocumentRecord left, CultNetRawDocumentRecord right) =>
+            string.Equals(left.SchemaId, right.SchemaId, StringComparison.Ordinal) &&
+            string.Equals(left.SchemaName, right.SchemaName, StringComparison.Ordinal) &&
+            string.Equals(left.SchemaVersion, right.SchemaVersion, StringComparison.Ordinal) &&
+            string.Equals(left.SchemaContentHash, right.SchemaContentHash, StringComparison.Ordinal) &&
+            string.Equals(left.RecordKey, right.RecordKey, StringComparison.Ordinal) &&
+            string.Equals(left.PayloadEncoding, right.PayloadEncoding, StringComparison.Ordinal) &&
+            left.Payload.SequenceEqual(right.Payload) &&
+            string.Equals(left.SourceRuntimeId, right.SourceRuntimeId, StringComparison.Ordinal) &&
+            string.Equals(left.SourceAgentId, right.SourceAgentId, StringComparison.Ordinal) &&
+            string.Equals(left.SourceRole, right.SourceRole, StringComparison.Ordinal);
+
+        private static void SendUpsert(
+            ICultNetSchemaServerPeer peer,
+            string subscriptionId,
+            CultNetRawDocumentRecord document,
+            bool added) =>
+            peer.SendCultNet(new CultNetDatabaseChangeRawMessage
+            {
+                MessageId = Guid.NewGuid().ToString("N"),
+                SubscriptionId = subscriptionId,
+                ChangeKind = added ? "added" : "updated",
+                Document = document
+            });
+
+        private static void SendRemoval(
+            ICultNetSchemaServerPeer peer,
+            string subscriptionId,
+            CultNetRawDocumentRecord document) =>
+            peer.SendCultNet(new CultNetDatabaseChangeRawMessage
+            {
+                MessageId = Guid.NewGuid().ToString("N"),
+                SubscriptionId = subscriptionId,
+                ChangeKind = "removed",
+                RecordKey = document.RecordKey,
+                SchemaId = document.SchemaId
+            });
+
+        private void Withdraw(SubscriptionKey key, bool sendRemovals, bool forgetRequest)
+        {
+            if (_subscriptions.TryRemove(key, out var subscription))
+                subscription.Dispose();
+            if (_projections.TryRemove(key, out var projection))
+            {
+                if (sendRemovals)
+                {
+                    foreach (var delivered in projection.DeliveredBySourceRecordKey.Values)
+                        SendRemoval(key.Peer, key.Id, delivered);
+                }
+                if (projection.DemandActive && _requests.TryGetValue(key, out var activeRequest))
+                    PublishDemand(activeRequest, key, active: false);
+            }
+            if (forgetRequest)
+                _requests.TryRemove(key, out _);
+        }
+
+        private CultNetDatabaseChangeRawMessage? CreateAuthorizedChange(
+            object change,
+            CultNetDatabaseSubscribeMessage request,
+            string subscriptionId,
+            ICultNetSchemaServerPeer peer)
+        {
+            return CreateChangeCore(change, request, subscriptionId, (recordKey, schemaId) =>
+                _authorizeRecord?.Invoke(request, peer, recordKey, schemaId) != false);
+        }
+
+        private CultNetDatabaseChangeRawMessage? CreateChange(
+            object change,
+            CultNetDatabaseSubscribeMessage request,
+            string subscriptionId)
+        {
+            return CreateChangeCore(change, request, subscriptionId, (_, _) => true);
+        }
+
+        private CultNetDatabaseChangeRawMessage? CreateChangeCore(
+            object change,
+            CultNetDatabaseSubscribeMessage request,
+            string subscriptionId,
+            Func<string, string, bool> authorizeRecord)
+        {
+            var changeType = change.GetType();
+            var key = (CultRecordKey)(changeType.GetProperty("Key")?.GetValue(change) ?? new CultRecordKey(""));
+            if (request.RecordKeys is { Length: > 0 } && !request.RecordKeys.Contains(key.Value, StringComparer.Ordinal))
+                return null;
+
+            var kind = (CultNetDatabaseChangeKind)(changeType.GetProperty("Kind")?.GetValue(change) ?? CultNetDatabaseChangeKind.Updated);
+            var document = changeType.GetProperty("Document")?.GetValue(change);
+            if (kind == CultNetDatabaseChangeKind.Removed || document == null)
+            {
+                var previous = changeType.GetProperty("PreviousDocument")?.GetValue(change);
+                var schemaId = ResolveWireSchemaId(previous, (string?)changeType.GetProperty("SchemaId")?.GetValue(change) ?? "");
+                if (!MatchesRequestedSchema(request.SchemaIds, previous, schemaId))
+                    return null;
+                if (!authorizeRecord(key.Value, schemaId))
+                    return null;
+                return new CultNetDatabaseChangeRawMessage
+                {
+                    MessageId = Guid.NewGuid().ToString("N"),
+                    SubscriptionId = subscriptionId,
+                    ChangeKind = "removed",
+                    RecordKey = key.Value,
+                    SchemaId = schemaId
+                };
+            }
+
+            var raw = CreateRawRecord(key, document);
+            if (!MatchesRequestedSchema(request.SchemaIds, document, raw.SchemaId))
+                return null;
+            if (!authorizeRecord(key.Value, raw.SchemaId))
+                return null;
+            return new CultNetDatabaseChangeRawMessage
+            {
+                MessageId = Guid.NewGuid().ToString("N"),
+                SubscriptionId = subscriptionId,
+                ChangeKind = kind == CultNetDatabaseChangeKind.Added ? "added" : "updated",
+                Document = raw
+            };
+        }
+
+        private string ResolveWireSchemaId(object? document, string fallback)
+        {
+            if (document == null) return fallback;
+            return _database.Documents.GetByDocumentType(document.GetType())?.SchemaId ?? fallback;
+        }
+
+        private bool MatchesRequestedSchema(string[]? requestedSchemaIds, object? document, string wireSchemaId)
+        {
+            if (requestedSchemaIds is not { Length: > 0 }) return true;
+            if (requestedSchemaIds.Contains(wireSchemaId, StringComparer.Ordinal)) return true;
+            return document != null && CultNetSchemaAliasMatching.MatchesAny(
+                requestedSchemaIds,
+                _database.Cache.Registry.GetRequired(document.GetType()));
+        }
+
+        private CultNetRawDocumentRecord CreateRawRecord(CultRecordKey key, object document)
+        {
+            var method = typeof(CultNetDocumentRegistry)
+                .GetMethods(BindingFlags.Public | BindingFlags.Instance)
+                .Single(candidate => candidate.Name == nameof(CultNetDocumentRegistry.CreateRawDocumentPutMessage) &&
+                                     candidate.IsGenericMethodDefinition);
+            var documentType = document.GetType();
+            var handle = Activator.CreateInstance(
+                typeof(CultRecordHandle<>).MakeGenericType(documentType),
+                new object[] { key });
+            var put = method.MakeGenericMethod(documentType)
+                .Invoke(_database.Documents, new[] { Guid.NewGuid().ToString("N"), handle, document, null });
+            return ((CultNetDocumentPutRawMessage)put!).Document;
+        }
+
+        private sealed class SubscriptionProjectionState
+        {
+            public Dictionary<string, CultNetRawDocumentRecord> DeliveredBySourceRecordKey { get; } =
+                new(StringComparer.Ordinal);
+            public bool DemandActive { get; set; }
+        }
+
+        private sealed class ProjectedSnapshot
+        {
+            public ProjectedSnapshot(Dictionary<string, CultNetRawDocumentRecord> bySourceRecordKey)
+            {
+                BySourceRecordKey = bySourceRecordKey;
+                Documents = bySourceRecordKey.Values.ToArray();
+            }
+
+            public static ProjectedSnapshot Empty { get; } =
+                new(new Dictionary<string, CultNetRawDocumentRecord>(StringComparer.Ordinal));
+            public Dictionary<string, CultNetRawDocumentRecord> BySourceRecordKey { get; }
+            public CultNetRawDocumentRecord[] Documents { get; }
+        }
+
+        private sealed class SubscriptionKey
+        {
+            public SubscriptionKey(ICultNetSchemaServerPeer peer, string id)
+            {
+                Peer = peer;
+                Id = id;
+            }
+            public ICultNetSchemaServerPeer Peer { get; }
+            public string Id { get; }
+        }
+
+        private sealed class SubscriptionKeyComparer : IEqualityComparer<SubscriptionKey>
+        {
+            public static SubscriptionKeyComparer Instance { get; } = new SubscriptionKeyComparer();
+            public bool Equals(SubscriptionKey? x, SubscriptionKey? y) =>
+                x != null && y != null && SamePeer(x.Peer, y.Peer) && string.Equals(x.Id, y.Id, StringComparison.Ordinal);
+            public int GetHashCode(SubscriptionKey value) =>
+                (PeerHash(value.Peer) * 397) ^ StringComparer.Ordinal.GetHashCode(value.Id);
+
+            internal static bool SamePeer(ICultNetSchemaServerPeer left, ICultNetSchemaServerPeer right)
+            {
+                if (ReferenceEquals(left, right)) return true;
+                if (left is RudpCultNetSchemaServerPeer leftRudp && right is RudpCultNetSchemaServerPeer rightRudp)
+                    return ReferenceEquals(leftRudp.TransportPeer, rightRudp.TransportPeer);
+                if (left is CultNetServerPeer leftLite && right is CultNetServerPeer rightLite)
+                    return ReferenceEquals(leftLite.Peer, rightLite.Peer);
+                return false;
+            }
+
+            private static int PeerHash(ICultNetSchemaServerPeer peer)
+            {
+                if (peer is RudpCultNetSchemaServerPeer rudp)
+                    return RuntimeHelpers.GetHashCode(rudp.TransportPeer);
+                if (peer is CultNetServerPeer lite)
+                    return RuntimeHelpers.GetHashCode(lite.Peer);
+                return RuntimeHelpers.GetHashCode(peer);
+            }
+        }
+    }
+
+    /// <summary>One active or withdrawn exact state subscription and its optional hot-body route.</summary>
+    public sealed class CultNetDatabaseSubscriptionDemand
+    {
+        public CultNetDatabaseSubscriptionDemand(
+            string consumerRuntimeId,
+            string subscriptionId,
+            IReadOnlyList<string> bodyIds,
+            IReadOnlyList<string> supportedBodyTransports,
+            bool sameMachine,
+            bool active)
+            : this(
+                consumerRuntimeId,
+                subscriptionId,
+                Array.Empty<string>(),
+                Array.Empty<string>(),
+                bodyIds,
+                supportedBodyTransports,
+                sameMachine,
+                active)
+        {
+        }
+
+        public CultNetDatabaseSubscriptionDemand(
+            string consumerRuntimeId,
+            string subscriptionId,
+            IReadOnlyList<string> recordKeys,
+            IReadOnlyList<string> schemaIds,
+            IReadOnlyList<string> bodyIds,
+            IReadOnlyList<string> supportedBodyTransports,
+            bool sameMachine,
+            bool active)
+        {
+            ConsumerRuntimeId = consumerRuntimeId;
+            SubscriptionId = subscriptionId;
+            RecordKeys = recordKeys;
+            SchemaIds = schemaIds;
+            BodyIds = bodyIds;
+            SupportedBodyTransports = supportedBodyTransports;
+            SameMachine = sameMachine;
+            Active = active;
+        }
+
+        public string ConsumerRuntimeId { get; }
+        public string SubscriptionId { get; }
+        public IReadOnlyList<string> RecordKeys { get; }
+        public IReadOnlyList<string> SchemaIds { get; }
+        public IReadOnlyList<string> BodyIds { get; }
+        public IReadOnlyList<string> SupportedBodyTransports { get; }
+        public bool SameMachine { get; }
+        public bool Active { get; }
+    }
+}
diff --git a/src/GameCult.Networking/CultNetDocumentRegistry.cs b/src/GameCult.Networking/CultNetDocumentRegistry.cs
index d6446b2d..4a5d314e 100644
--- a/src/GameCult.Networking/CultNetDocumentRegistry.cs
+++ b/src/GameCult.Networking/CultNetDocumentRegistry.cs
@@ -5,6 +5,7 @@ using System.Linq;
 using System.Threading.Tasks;
 using GameCult.Caching;
 using GameCult.Caching.MessagePack;
+using MessagePack;
 
 namespace GameCult.Networking
 {
@@ -79,7 +80,8 @@ namespace GameCult.Networking
             Func<byte[], T>? payloadDeserializer = null)
             where T : class
         {
-            var descriptor = (registry ?? CultDocumentRegistry.Shared).GetRequired<T>();
+            var documents = registry ?? CultDocumentRegistry.Shared;
+            var descriptor = documents.GetRequired<T>();
             return new CultNetDocumentBinding(
                 typeof(T),
                 string.IsNullOrWhiteSpace(schemaId) ? descriptor.SchemaId : schemaId!,
@@ -88,11 +90,48 @@ namespace GameCult.Networking
                     var typed = (T)document;
                     return payloadSerializer != null
                         ? payloadSerializer(typed)
-                        : CultDocumentMessagePackSerialization.Serialize(typed);
+                        : CultDocumentMessagePackSerialization.SerializeUntyped(typed, typeof(T), documents);
                 },
                 payload => payloadDeserializer != null
                     ? payloadDeserializer(payload)
-                    : CultDocumentMessagePackSerialization.Deserialize<T>(payload));
+                    : (T)CultDocumentMessagePackSerialization.DeserializeUntyped(typeof(T), payload, documents));
+        }
+
+        /// <summary>
+        /// Creates a document binding for a CultCache document type discovered at runtime.
+        /// </summary>
+        public static CultNetDocumentBinding ForDocument(
+            Type documentType,
+            CultDocumentRegistry? registry = null,
+            string? schemaId = null,
+            Func<object, byte[]>? payloadSerializer = null,
+            Func<byte[], object>? payloadDeserializer = null)
+        {
+            if (documentType == null)
+            {
+                throw new ArgumentNullException(nameof(documentType));
+            }
+
+            var documents = registry ?? CultDocumentRegistry.Shared;
+            var descriptor = documents.GetRequired(documentType);
+            return new CultNetDocumentBinding(
+                documentType,
+                string.IsNullOrWhiteSpace(schemaId) ? descriptor.SchemaId : schemaId!,
+                document =>
+                {
+                    if (!documentType.IsInstanceOfType(document))
+                    {
+                        throw new InvalidOperationException(
+                            $"Document payload type {document.GetType().FullName} is not assignable to {documentType.FullName}.");
+                    }
+
+                    return payloadSerializer != null
+                        ? payloadSerializer(document)
+                        : CultDocumentMessagePackSerialization.SerializeUntyped(document, documentType, documents);
+                },
+                payload => payloadDeserializer != null
+                    ? payloadDeserializer(payload)
+                    : CultDocumentMessagePackSerialization.DeserializeUntyped(documentType, payload, documents));
         }
     }
 
@@ -187,6 +226,9 @@ namespace GameCult.Networking
                 Document = new CultNetRawDocumentRecord
                 {
                     SchemaId = binding.SchemaId,
+                    SchemaName = descriptor.SchemaName,
+                    SchemaVersion = descriptor.SchemaVersion,
+                    SchemaContentHash = descriptor.ContentHash,
                     RecordKey = handle.Key.Value,
                     StoredAt = storedAt,
                     PayloadEncoding = "messagepack",
@@ -233,7 +275,7 @@ namespace GameCult.Networking
             var storedAt = ResolveStoredAt(options);
 
             var documents = new List<CultNetRawDocumentRecord>();
-            foreach (var document in cache.AllEntries)
+            void AddDocument(object document, string key)
             {
                 var descriptor = _documents.GetRequired(document.GetType());
                 var binding = GetByDocumentType(document.GetType()) ??
@@ -243,37 +285,21 @@ namespace GameCult.Networking
                                   value => CultDocumentMessagePackSerialization.SerializeUntyped(value, value.GetType()),
                                   payload => CultDocumentMessagePackSerialization.DeserializeUntyped(document.GetType(), payload));
 
-                if (requestedSchemaIds != null && !requestedSchemaIds.Contains(descriptor.SchemaId))
+                if (requestedSchemaIds != null && !MatchesRequestedSchema(descriptor, binding, requestedSchemaIds))
                 {
-                    if (!requestedSchemaIds.Contains(binding.SchemaId))
-                    {
-                        continue;
-                    }
+                    return;
                 }
-
-                var handleMethod = typeof(CultCache)
-                    .GetMethod(nameof(CultCache.TryGetHandle))!
-                    .MakeGenericMethod(document.GetType());
-                var handleObject = handleMethod.Invoke(cache, new[] { document });
-                if (handleObject == null)
-                {
-                    continue;
-                }
-
-                var keyProperty = handleObject.GetType().GetProperty("Value");
-                var handleValue = keyProperty?.GetValue(handleObject) ?? handleObject;
-                var recordKeyProperty = handleValue.GetType().GetProperty("Key");
-                var recordKey = recordKeyProperty?.GetValue(handleValue);
-                var valueProperty = recordKey?.GetType().GetProperty("Value");
-                var key = (string?)(valueProperty?.GetValue(recordKey)) ?? string.Empty;
                 if (requestedRecordKeys != null && !requestedRecordKeys.Contains(key))
                 {
-                    continue;
+                    return;
                 }
 
                 documents.Add(new CultNetRawDocumentRecord
                 {
                     SchemaId = binding.SchemaId,
+                    SchemaName = descriptor.SchemaName,
+                    SchemaVersion = descriptor.SchemaVersion,
+                    SchemaContentHash = descriptor.ContentHash,
                     RecordKey = key,
                     StoredAt = storedAt,
                     PayloadEncoding = "messagepack",
@@ -285,6 +311,36 @@ namespace GameCult.Networking
                 });
             }
 
+            if (requestedRecordKeys != null)
+            {
+                foreach (var key in requestedRecordKeys)
+                {
+                    var document = cache.Get(new CultRecordKey(key));
+                    if (document != null)
+                        AddDocument(document, key);
+                }
+            }
+            else
+            {
+                foreach (var document in cache.AllEntries)
+                {
+                    var handleMethod = typeof(CultCache)
+                        .GetMethod(nameof(CultCache.TryGetHandle))!
+                        .MakeGenericMethod(document.GetType());
+                    var handleObject = handleMethod.Invoke(cache, new[] { document });
+                    if (handleObject == null)
+                        continue;
+
+                    var keyProperty = handleObject.GetType().GetProperty("Value");
+                    var handleValue = keyProperty?.GetValue(handleObject) ?? handleObject;
+                    var recordKeyProperty = handleValue.GetType().GetProperty("Key");
+                    var recordKey = recordKeyProperty?.GetValue(handleValue);
+                    var valueProperty = recordKey?.GetType().GetProperty("Value");
+                    var key = (string?)(valueProperty?.GetValue(recordKey)) ?? string.Empty;
+                    AddDocument(document, key);
+                }
+            }
+
             return new CultNetSnapshotResponseRawMessage
             {
                 MessageId = RequireNonEmpty(messageId, nameof(messageId)),
@@ -304,17 +360,8 @@ namespace GameCult.Networking
                 throw new ArgumentException("CultNet raw document message is missing its document payload.", nameof(message));
             }
 
-            ValidateRawDocumentRecord(message.Document);
-            var binding = GetBySchemaId(message.Document.SchemaId);
-            var descriptor = binding != null
-                ? _documents.GetRequired(binding.DocumentType)
-                : _documents.GetRequiredBySchemaId(message.Document.SchemaId);
-            binding ??= new CultNetDocumentBinding(
-                descriptor.DocumentType,
-                descriptor.SchemaId,
-                value => CultDocumentMessagePackSerialization.SerializeUntyped(value, value.GetType()),
-                payload => CultDocumentMessagePackSerialization.DeserializeUntyped(descriptor.DocumentType, payload));
-            var document = binding.PayloadDeserializer(message.Document.Payload);
+            var document = DeserializeRawDocument(message.Document);
+            var descriptor = ResolveDescriptorForRawDocument(message.Document);
 
             var addMethod = typeof(CultCache).GetMethod(nameof(CultCache.AddAsync))!
                 .MakeGenericMethod(descriptor.DocumentType);
@@ -325,6 +372,26 @@ namespace GameCult.Networking
             return document;
         }
 
+        /// <summary>
+        /// Decodes one validated raw document without materializing it in a CultCache replica.
+        /// Use this for ephemeral reactive subscriptions whose callback is the consumer.
+        /// </summary>
+        public object DeserializeRawDocument(CultNetRawDocumentRecord document)
+        {
+            if (document == null) throw new ArgumentNullException(nameof(document));
+            ValidateRawDocumentRecord(document);
+            var binding = GetBySchemaId(document.SchemaId);
+            var descriptor = binding != null
+                ? _documents.GetRequired(binding.DocumentType)
+                : ResolveDescriptorForRawDocument(document);
+            binding ??= new CultNetDocumentBinding(
+                descriptor.DocumentType,
+                descriptor.SchemaId,
+                value => CultDocumentMessagePackSerialization.SerializeUntyped(value, value.GetType()),
+                payload => CultDocumentMessagePackSerialization.DeserializeUntyped(descriptor.DocumentType, payload));
+            return binding.PayloadDeserializer(document.Payload);
+        }
+
         /// <summary>
         /// Applies a raw document put message and returns the typed document.
         /// </summary>
@@ -358,6 +425,151 @@ namespace GameCult.Networking
             return applied;
         }
 
+        internal CultDocumentDescriptor ResolveDescriptorForRawDocument(CultNetRawDocumentRecord document)
+        {
+            try
+            {
+                return ResolveDescriptorForSchemaId(document.SchemaId);
+            }
+            catch (InvalidOperationException) when (TryResolveDescriptorByPayloadSchema(document.Payload) is { } descriptor)
+            {
+                return descriptor;
+            }
+        }
+
+        internal CultDocumentDescriptor ResolveDescriptorForSchemaId(string schemaId)
+        {
+            try
+            {
+                return _documents.GetRequiredBySchemaId(schemaId);
+            }
+            catch (InvalidOperationException) when (TryResolveDescriptorBySchemaAlias(schemaId) is { } descriptor)
+            {
+                return descriptor;
+            }
+        }
+
+        private CultDocumentDescriptor? TryResolveDescriptorBySchemaAlias(string schemaId)
+        {
+            if (string.IsNullOrWhiteSpace(schemaId))
+                return null;
+
+            var candidates = ResolvePayloadSchemaCandidates().ToArray();
+            var descriptor = candidates.FirstOrDefault(candidate =>
+                string.Equals(candidate.SchemaId, schemaId, StringComparison.Ordinal) ||
+                string.Equals(candidate.SchemaName, schemaId, StringComparison.Ordinal) ||
+                string.Equals(candidate.SchemaVersion, schemaId, StringComparison.Ordinal) ||
+                candidate.ToCatalogEntry().CompatibleSchemaIds.Any(compatible =>
+                    string.Equals(compatible, schemaId, StringComparison.Ordinal)));
+            if (descriptor != null)
+                return descriptor;
+
+            var schemaName = InferSchemaName(schemaId);
+            return string.IsNullOrWhiteSpace(schemaName)
+                ? null
+                : candidates.FirstOrDefault(candidate =>
+                    string.Equals(candidate.SchemaName, schemaName, StringComparison.Ordinal));
+        }
+
+        private CultDocumentDescriptor? TryResolveDescriptorByPayloadSchema(byte[] payload)
+        {
+            var schemaVersion = TryReadSchemaVersion(payload);
+            if (string.IsNullOrWhiteSpace(schemaVersion))
+                return null;
+
+            var candidates = ResolvePayloadSchemaCandidates().ToArray();
+            var descriptor = candidates.FirstOrDefault(candidate =>
+                string.Equals(candidate.SchemaVersion, schemaVersion, StringComparison.Ordinal));
+            if (descriptor != null)
+                return descriptor;
+
+            var schemaName = InferSchemaName(schemaVersion!);
+            return string.IsNullOrWhiteSpace(schemaName)
+                ? null
+                : candidates.FirstOrDefault(candidate =>
+                    string.Equals(candidate.SchemaName, schemaName, StringComparison.Ordinal));
+        }
+
+        private IEnumerable<CultDocumentDescriptor> ResolvePayloadSchemaCandidates()
+        {
+            if (_bindingsBySchemaId.Count == 0 && _bindingsByType.Count == 0)
+                return _documents.AllDescriptors;
+
+            return _bindingsBySchemaId.Values
+                .Concat(_bindingsByType.Values)
+                .Select(binding => _documents.GetRequired(binding.DocumentType))
+                .GroupBy(descriptor => descriptor.DocumentType)
+                .Select(group => group.First());
+        }
+
+        private static bool MatchesRequestedSchema(
+            CultDocumentDescriptor descriptor,
+            CultNetDocumentBinding binding,
+            ISet<string> requestedSchemaIds)
+        {
+            if (requestedSchemaIds.Count == 0)
+                return true;
+
+            if (requestedSchemaIds.Contains(descriptor.SchemaId) ||
+                requestedSchemaIds.Contains(binding.SchemaId))
+                return true;
+
+            if (descriptor.ToCatalogEntry().CompatibleSchemaIds.Any(requestedSchemaIds.Contains))
+                return true;
+
+            return requestedSchemaIds
+                .Select(InferSchemaName)
+                .Where(schemaName => !string.IsNullOrWhiteSpace(schemaName))
+                .Any(schemaName => string.Equals(schemaName, descriptor.SchemaName, StringComparison.Ordinal));
+        }
+
+        private static string? TryReadSchemaVersion(byte[] payload)
+        {
+            try
+            {
+                var array = MessagePackSerializer.Deserialize<object[]>(
+                    payload,
+                    CultNetSchemaMessageSerialization.Options);
+                if (array.Length > 0 && array[0] is string schemaVersion)
+                    return schemaVersion;
+            }
+            catch (Exception)
+            {
+                // Fall through to map decoding; different runtimes may encode object-like payloads.
+            }
+
+            try
+            {
+                var map = MessagePackSerializer.Deserialize<IReadOnlyDictionary<string, object?>>(
+                    payload,
+                    CultNetSchemaMessageSerialization.Options);
+                if (map.TryGetValue("schemaVersion", out var schemaVersion) &&
+                    schemaVersion is string schemaVersionText)
+                    return schemaVersionText;
+                if (map.TryGetValue("schema_version", out var snakeSchemaVersion) &&
+                    snakeSchemaVersion is string snakeSchemaVersionText)
+                    return snakeSchemaVersionText;
+            }
+            catch (Exception)
+            {
+                return null;
+            }
+
+            return null;
+        }
+
+        private static string? InferSchemaName(string schemaVersion)
+        {
+            var marker = schemaVersion.LastIndexOf(".v", StringComparison.Ordinal);
+            if (marker <= 0 || marker + 2 >= schemaVersion.Length)
+                return null;
+
+            var version = schemaVersion.Substring(marker + 2);
+            return version.All(char.IsDigit)
+                ? schemaVersion.Substring(0, marker)
+                : null;
+        }
+
         /// <summary>
         /// Applies all typed documents from a raw snapshot response.
         /// </summary>
diff --git a/src/GameCult.Networking/CultNetLocal.cs b/src/GameCult.Networking/CultNetLocal.cs
index a134cfcf..87942ce8 100644
--- a/src/GameCult.Networking/CultNetLocal.cs
+++ b/src/GameCult.Networking/CultNetLocal.cs
@@ -1,4 +1,5 @@
 using System;
+using System.Diagnostics;
 using System.Linq;
 using System.Threading.Tasks;
 using GameCult.Caching;
@@ -99,7 +100,7 @@ namespace GameCult.Networking
         /// </summary>
         public Task FlushAsync(bool soft = false)
         {
-            return Cache.FlushAsync(soft);
+            return Cache.FlushAsync();
         }
 
         /// <summary>
@@ -130,12 +131,28 @@ namespace GameCult.Networking
             }
 
             options ??= new CultNetHostOptions();
+            var traceStartup = string.Equals(
+                Environment.GetEnvironmentVariable("CULTMESH_TRACE_STARTUP_PHASES"),
+                "1",
+                StringComparison.Ordinal);
+            var startupPhase = Stopwatch.StartNew();
+            void Trace(string phase)
+            {
+                if (traceStartup)
+                    Console.WriteLine($"CultMesh local-host phase {phase} took {startupPhase.Elapsed.TotalMilliseconds:0.###}ms.");
+                startupPhase.Restart();
+            }
+
             var cache = await CultCacheMessagePack.OpenAsync(cachePath, options.CacheOptions).ConfigureAwait(false);
+            Trace("cache-open");
             var store = cache.BackingStores.OfType<SingleFileMessagePackBackingStore>().FirstOrDefault();
             var server = new Server(cache, options.Security ?? ServerSecurityOptions.Development());
+            Trace("server");
             var databaseOptions = options.DatabaseOptions ?? new CultNetDatabaseOptions();
             var database = new CultNetDatabase(cache, databaseOptions);
+            Trace("database");
             var databaseServer = new CultNetDatabaseServer(server, database, options.DatabaseServerOptions);
+            Trace("database-server");
             options.ConfigureServer?.Invoke(server);
 
             var host = new CultNetHost(cache, store, server, database, databaseServer);
@@ -143,6 +160,7 @@ namespace GameCult.Networking
             {
                 host.Start();
             }
+            Trace("server-start");
 
             return host;
         }
diff --git a/src/GameCult.Networking/CultNetOperationServer.cs b/src/GameCult.Networking/CultNetOperationServer.cs
new file mode 100644
index 00000000..27b52c55
--- /dev/null
+++ b/src/GameCult.Networking/CultNetOperationServer.cs
@@ -0,0 +1,358 @@
+using System;
+using System.Collections.Generic;
+using System.Threading.Tasks;
+using MessagePack;
+
+namespace GameCult.Networking
+{
+    /// <summary>Portable failure payload for operation routing and envelope validation.</summary>
+    [MessagePackObject]
+    public sealed class CultNetOperationFailure
+    {
+        /// <summary>Gets or sets the stable machine-readable failure code.</summary>
+        [Key("code")] public string Code { get; set; } = "operation-error";
+
+        /// <summary>Gets or sets the human-readable failure description.</summary>
+        [Key("message")] public string Message { get; set; } = "CultNet operation failed.";
+    }
+
+    /// <summary>
+    /// Typed application input delivered through one CultNet operation envelope.
+    /// The message id is the caller's idempotency key; the application transaction
+    /// remains responsible for applying it exactly once.
+    /// </summary>
+    public sealed class CultNetOperationContext<TRequest>
+    {
+        internal CultNetOperationContext(CultNetOperationRequestMessage envelope, TRequest value)
+        {
+            Envelope = envelope ?? throw new ArgumentNullException(nameof(envelope));
+            Value = value;
+        }
+
+        /// <summary>Gets the decoded application request.</summary>
+        public TRequest Value { get; }
+
+        /// <summary>Gets the durable caller-supplied idempotency key.</summary>
+        public string IdempotencyKey => Envelope.MessageId;
+
+        /// <summary>Gets the calling runtime identity, when supplied.</summary>
+        public string? SourceRuntimeId => Envelope.SourceRuntimeId;
+
+        /// <summary>Gets the optional target runtime identity.</summary>
+        public string? TargetRuntimeId => Envelope.TargetRuntimeId;
+
+        /// <summary>Gets the original transport-neutral envelope for diagnostics.</summary>
+        public CultNetOperationRequestMessage Envelope { get; }
+    }
+
+    /// <summary>Provider-authored typed result for one CultNet operation.</summary>
+    public sealed class CultNetOperationReply<TResponse>
+    {
+        /// <summary>Creates one provider-authored typed reply.</summary>
+        public CultNetOperationReply(
+            string status,
+            TResponse value,
+            IEnumerable<string>? diagnostics = null)
+        {
+            Status = RequireNonEmpty(status, nameof(status));
+            Value = value;
+            Diagnostics = diagnostics == null ? Array.Empty<string>() : new List<string>(diagnostics).ToArray();
+        }
+
+        /// <summary>Gets the provider-authored operation status.</summary>
+        public string Status { get; }
+
+        /// <summary>Gets the typed response payload.</summary>
+        public TResponse Value { get; }
+
+        /// <summary>Gets provider-authored diagnostics.</summary>
+        public IReadOnlyList<string> Diagnostics { get; }
+
+        /// <summary>Creates an accepted typed reply.</summary>
+        public static CultNetOperationReply<TResponse> Accepted(TResponse value) => new("accepted", value);
+
+        /// <summary>Creates a rejected typed reply whose payload remains schema-valid.</summary>
+        public static CultNetOperationReply<TResponse> Rejected(
+            TResponse value,
+            params string[] diagnostics) => new("rejected", value, diagnostics);
+
+        private static string RequireNonEmpty(string value, string paramName) =>
+            string.IsNullOrWhiteSpace(value)
+                ? throw new ArgumentException("Value must be non-empty.", paramName)
+                : value.Trim();
+    }
+
+    /// <summary>
+    /// Transport-neutral typed dispatcher for CultNet application operations.
+    /// It owns envelope validation and serialization only; registered handlers own
+    /// domain validation, idempotency, state mutation, and durable receipts.
+    /// </summary>
+    public sealed class CultNetOperationServer : IDisposable
+    {
+        /// <summary>Schema used by correlated framework-level operation failures.</summary>
+        public const string FailureSchemaId = "gamecult.cultnet.operation_failure.v1";
+
+        private const string PayloadEncoding = "messagepack-base64";
+        private readonly ICultNetSchemaServer _server;
+        private readonly string? _sourceRuntimeId;
+        private readonly Dictionary<Route, IBinding> _bindings = new();
+        private readonly Func<CultNetOperationRequestMessage, ICultNetSchemaServerPeer, Task> _handler;
+        private bool _disposed;
+
+        /// <summary>Attaches one typed operation dispatcher to a schema server.</summary>
+        public CultNetOperationServer(ICultNetSchemaServer server, string? sourceRuntimeId = null)
+        {
+            _server = server ?? throw new ArgumentNullException(nameof(server));
+            _sourceRuntimeId = string.IsNullOrWhiteSpace(sourceRuntimeId) ? null : sourceRuntimeId!.Trim();
+            _handler = HandleAsync;
+            _server.OnCultNet(_handler);
+        }
+
+        /// <summary>
+        /// Registers one typed operation. Duplicate service/operation routes are rejected.
+        /// </summary>
+        public CultNetOperationServer Register<TRequest, TResponse>(
+            string serviceId,
+            string operation,
+            string requestSchema,
+            string responseSchema,
+            Func<CultNetOperationContext<TRequest>, Task<CultNetOperationReply<TResponse>>> handler)
+        {
+            ThrowIfDisposed();
+            var route = new Route(serviceId, operation);
+            if (_bindings.ContainsKey(route))
+                throw new InvalidOperationException($"CultNet operation '{route}' is already registered.");
+            _bindings.Add(route, new Binding<TRequest, TResponse>(
+                route,
+                requestSchema,
+                responseSchema,
+                handler ?? throw new ArgumentNullException(nameof(handler)),
+                _sourceRuntimeId));
+            return this;
+        }
+
+        /// <summary>
+        /// Registers one typed operation whose successful handler result is always accepted.
+        /// </summary>
+        public CultNetOperationServer Register<TRequest, TResponse>(
+            string serviceId,
+            string operation,
+            string requestSchema,
+            string responseSchema,
+            Func<CultNetOperationContext<TRequest>, Task<TResponse>> handler)
+        {
+            if (handler == null) throw new ArgumentNullException(nameof(handler));
+            return Register<TRequest, TResponse>(
+                serviceId,
+                operation,
+                requestSchema,
+                responseSchema,
+                async context => CultNetOperationReply<TResponse>.Accepted(await handler(context).ConfigureAwait(false)));
+        }
+
+        /// <inheritdoc />
+        public void Dispose()
+        {
+            if (_disposed) return;
+            _disposed = true;
+            _server.RemoveCultNetMessageListener<CultNetOperationRequestMessage>(_handler);
+            _bindings.Clear();
+        }
+
+        private async Task HandleAsync(CultNetOperationRequestMessage request, ICultNetSchemaServerPeer peer)
+        {
+            if (_disposed) return;
+            if (request == null) throw new ArgumentNullException(nameof(request));
+            if (peer == null) throw new ArgumentNullException(nameof(peer));
+            if (_sourceRuntimeId != null &&
+                !string.Equals(request.TargetRuntimeId, _sourceRuntimeId, StringComparison.Ordinal))
+            {
+                peer.SendCultNet(Failure(
+                    request,
+                    "denied",
+                    "target-runtime-mismatch",
+                    $"Operation targeted runtime '{request.TargetRuntimeId ?? "(missing)"}', not '{_sourceRuntimeId}'."));
+                return;
+            }
+
+            Route route;
+            try
+            {
+                route = new Route(request.ServiceId, request.Operation);
+            }
+            catch (ArgumentException error)
+            {
+                peer.SendCultNet(Failure(request, "invalid", "invalid-route", error.Message));
+                return;
+            }
+
+            if (!_bindings.TryGetValue(route, out var binding))
+            {
+                peer.SendCultNet(Failure(
+                    request,
+                    "unsupported",
+                    "operation-not-registered",
+                    $"CultNet operation '{route}' is not registered."));
+                return;
+            }
+
+            try
+            {
+                peer.SendCultNet(await binding.InvokeAsync(request).ConfigureAwait(false));
+            }
+            catch (RequestException error)
+            {
+                peer.SendCultNet(Failure(request, "invalid", error.Code, error.Message));
+            }
+            catch (Exception error)
+            {
+                peer.SendCultNet(Failure(
+                    request,
+                    "error",
+                    "handler-failed",
+                    $"CultNet operation '{route}' failed: {error.Message}"));
+            }
+        }
+
+        private CultNetOperationResponseMessage Failure(
+            CultNetOperationRequestMessage request,
+            string status,
+            string code,
+            string message)
+        {
+            return new CultNetOperationResponseMessage
+            {
+                MessageId = request.MessageId ?? "",
+                ServiceId = request.ServiceId ?? "",
+                Operation = request.Operation ?? "",
+                Status = status,
+                PayloadSchema = FailureSchemaId,
+                PayloadEncoding = PayloadEncoding,
+                Payload = Convert.ToBase64String(MessagePackSerializer.Serialize(
+                    new CultNetOperationFailure { Code = code, Message = message },
+                    CultNetSchemaMessageSerialization.Options)),
+                Diagnostics = new[] { message },
+                SourceRuntimeId = _sourceRuntimeId
+            };
+        }
+
+        private void ThrowIfDisposed()
+        {
+            if (_disposed) throw new ObjectDisposedException(nameof(CultNetOperationServer));
+        }
+
+        private interface IBinding
+        {
+            Task<CultNetOperationResponseMessage> InvokeAsync(CultNetOperationRequestMessage request);
+        }
+
+        private sealed class Binding<TRequest, TResponse> : IBinding
+        {
+            private readonly Route _route;
+            private readonly string _requestSchema;
+            private readonly string _responseSchema;
+            private readonly Func<CultNetOperationContext<TRequest>, Task<CultNetOperationReply<TResponse>>> _handler;
+            private readonly string? _sourceRuntimeId;
+
+            public Binding(
+                Route route,
+                string requestSchema,
+                string responseSchema,
+                Func<CultNetOperationContext<TRequest>, Task<CultNetOperationReply<TResponse>>> handler,
+                string? sourceRuntimeId)
+            {
+                _route = route;
+                _requestSchema = RequireNonEmpty(requestSchema, nameof(requestSchema));
+                _responseSchema = RequireNonEmpty(responseSchema, nameof(responseSchema));
+                _handler = handler;
+                _sourceRuntimeId = sourceRuntimeId;
+            }
+
+            public async Task<CultNetOperationResponseMessage> InvokeAsync(CultNetOperationRequestMessage request)
+            {
+                if (string.IsNullOrWhiteSpace(request.MessageId))
+                    throw new RequestException("missing-idempotency-key", "CultNet operation omitted its idempotency key.");
+                if (!string.Equals(request.PayloadSchema, _requestSchema, StringComparison.Ordinal))
+                    throw new RequestException(
+                        "request-schema-mismatch",
+                        $"CultNet operation '{_route}' expected payload schema '{_requestSchema}', got '{request.PayloadSchema}'.");
+                if (!string.Equals(request.PayloadEncoding, PayloadEncoding, StringComparison.Ordinal))
+                    throw new RequestException(
+                        "request-encoding-mismatch",
+                        $"CultNet operation '{_route}' expected payload encoding '{PayloadEncoding}', got '{request.PayloadEncoding}'.");
+
+                TRequest value;
+                try
+                {
+                    value = MessagePackSerializer.Deserialize<TRequest>(
+                        Convert.FromBase64String(request.Payload),
+                        CultNetSchemaMessageSerialization.Options);
+                }
+                catch (FormatException error)
+                {
+                    throw new RequestException("request-payload-invalid", "CultNet operation payload was not valid base64.", error);
+                }
+                catch (MessagePackSerializationException error)
+                {
+                    throw new RequestException("request-payload-invalid", "CultNet operation payload was not valid MessagePack.", error);
+                }
+                if (value == null) throw new RequestException("request-payload-null", "CultNet operation payload decoded to null.");
+
+                var reply = await _handler(new CultNetOperationContext<TRequest>(request, value)).ConfigureAwait(false)
+                    ?? throw new InvalidOperationException("CultNet operation handler returned no reply.");
+                if (reply.Value == null) throw new InvalidOperationException("CultNet operation handler returned a null payload.");
+                return new CultNetOperationResponseMessage
+                {
+                    MessageId = request.MessageId,
+                    ServiceId = _route.ServiceId,
+                    Operation = _route.Operation,
+                    Status = reply.Status,
+                    PayloadSchema = _responseSchema,
+                    PayloadEncoding = PayloadEncoding,
+                    Payload = Convert.ToBase64String(MessagePackSerializer.Serialize(
+                        reply.Value,
+                        CultNetSchemaMessageSerialization.Options)),
+                    Diagnostics = new List<string>(reply.Diagnostics).ToArray(),
+                    SourceRuntimeId = _sourceRuntimeId
+                };
+            }
+        }
+
+        private sealed class RequestException : Exception
+        {
+            public RequestException(string code, string message, Exception? inner = null)
+                : base(message, inner)
+            {
+                Code = code;
+            }
+
+            public string Code { get; }
+        }
+
+        private readonly struct Route : IEquatable<Route>
+        {
+            public Route(string serviceId, string operation)
+            {
+                ServiceId = RequireNonEmpty(serviceId, nameof(serviceId));
+                Operation = RequireNonEmpty(operation, nameof(operation));
+            }
+
+            public string ServiceId { get; }
+            public string Operation { get; }
+
+            public bool Equals(Route other) =>
+                string.Equals(ServiceId, other.ServiceId, StringComparison.Ordinal) &&
+                string.Equals(Operation, other.Operation, StringComparison.Ordinal);
+
+            public override bool Equals(object? value) => value is Route route && Equals(route);
+            public override int GetHashCode() =>
+                (StringComparer.Ordinal.GetHashCode(ServiceId) * 397) ^ StringComparer.Ordinal.GetHashCode(Operation);
+            public override string ToString() => ServiceId + "/" + Operation;
+        }
+
+        private static string RequireNonEmpty(string value, string paramName) =>
+            string.IsNullOrWhiteSpace(value)
+                ? throw new ArgumentException("Value must be non-empty.", paramName)
+                : value.Trim();
+    }
+}
diff --git a/src/GameCult.Networking/CultNetRudpSchemaServer.cs b/src/GameCult.Networking/CultNetRudpSchemaServer.cs
index 6021dced..1abce308 100644
--- a/src/GameCult.Networking/CultNetRudpSchemaServer.cs
+++ b/src/GameCult.Networking/CultNetRudpSchemaServer.cs
@@ -1,11 +1,29 @@
 using System;
 using System.Collections.Concurrent;
+using System.Collections.Generic;
 using System.Net;
 using System.Net.Sockets;
 using System.Threading.Tasks;
 
 namespace GameCult.Networking
 {
+    /// <summary>
+    /// Result of a bounded non-blocking RUDP schema-server drain.
+    /// </summary>
+    public readonly struct RudpCultNetSchemaPollResult
+    {
+        public RudpCultNetSchemaPollResult(int transportItemsConsumed, int messagesDispatched)
+        {
+            TransportItemsConsumed = transportItemsConsumed;
+            MessagesDispatched = messagesDispatched;
+        }
+
+        /// <summary>Gets transport work consumed, including ACK and connection control packets.</summary>
+        public int TransportItemsConsumed { get; }
+        /// <summary>Gets application schema messages dispatched.</summary>
+        public int MessagesDispatched { get; }
+    }
+
     /// <summary>
     /// Options for hosting schema-v0 messages over the native CultNet RUDP listener.
     /// </summary>
@@ -52,7 +70,7 @@ namespace GameCult.Networking
     /// <summary>
     /// Peer context for a schema-v0 RUDP server.
     /// </summary>
-    public sealed class RudpCultNetSchemaServerPeer : ICultNetSchemaServerPeer
+    public sealed class RudpCultNetSchemaServerPeer : ICultNetSchemaServerPeer, ICultNetSchemaServerPeerLocation
     {
         private readonly RudpCultNetSchemaServer _server;
 
@@ -86,7 +104,7 @@ namespace GameCult.Networking
     /// <summary>
     /// Multi-peer schema-v0 host over the native CultNet RUDP transport.
     /// </summary>
-    public sealed class RudpCultNetSchemaServer : ICultNetSchemaServer, IDisposable
+    public sealed class RudpCultNetSchemaServer : ICultNetSchemaServer, ICultNetSchemaServerPeerLifecycle, IDisposable
     {
         private readonly Socket _socket;
         private readonly CultNetRudpSocketTransportServer _transport;
@@ -120,6 +138,7 @@ namespace GameCult.Networking
                 MaxPendingReliablePackets = options.MaxPendingReliablePackets,
                 AcceptPayload = options.AcceptPayload
             });
+            _transport.PeerDisconnected += OnTransportPeerDisconnected;
         }
 
         /// <summary>
@@ -137,6 +156,14 @@ namespace GameCult.Networking
         /// </summary>
         public CultNetTransportStats Stats => _transport.Stats;
 
+        /// <summary>
+        /// Gets the currently tracked RUDP peers.
+        /// </summary>
+        public IReadOnlyCollection<CultNetRudpSocketServerPeer> Peers => _transport.Peers;
+
+        /// <inheritdoc />
+        public event Action<ICultNetSchemaServerPeer>? PeerDisconnected;
+
         /// <summary>
         /// Registers a schema-v0 handler.
         /// </summary>
@@ -217,13 +244,37 @@ namespace GameCult.Networking
         /// </summary>
         public async Task<bool> PollOnceAsync()
         {
-            var delivered = _transport.ReceiveOnce();
-            _transport.PollResends();
-            if (delivered == null || !string.Equals(delivered.Frame.ChannelId, "schema", StringComparison.Ordinal))
+            if (!_transport.TryReceiveOnce(out var delivered) || delivered == null)
             {
                 return false;
             }
 
+            return await DispatchAsync(delivered).ConfigureAwait(false);
+        }
+
+        /// <summary>
+        /// Drains up to <paramref name="maxTransportItems"/> immediately available transport work items.
+        /// Control packets count as progress so callers only idle when the transport is actually empty.
+        /// </summary>
+        public async Task<RudpCultNetSchemaPollResult> PollAvailableAsync(int maxTransportItems)
+        {
+            if (maxTransportItems <= 0) throw new ArgumentOutOfRangeException(nameof(maxTransportItems));
+            var consumed = 0;
+            var dispatched = 0;
+            while (consumed < maxTransportItems && _transport.TryReceiveOnce(out var delivered))
+            {
+                consumed++;
+                if (delivered != null && await DispatchAsync(delivered).ConfigureAwait(false))
+                    dispatched++;
+            }
+            return new RudpCultNetSchemaPollResult(consumed, dispatched);
+        }
+
+        private async Task<bool> DispatchAsync(CultNetRudpSocketServerFrame delivered)
+        {
+            if (!string.Equals(delivered.Frame.ChannelId, "schema", StringComparison.Ordinal))
+                return false;
+
             var message = CultNetSchemaMessageSerialization.Deserialize(delivered.Frame.Payload);
             if (!_handlers.TryGetValue(message.GetType(), out var handler) || handler == null)
             {
@@ -255,7 +306,13 @@ namespace GameCult.Networking
             }
 
             _disposed = true;
+            _transport.PeerDisconnected -= OnTransportPeerDisconnected;
             _transport.Dispose();
         }
+
+        private void OnTransportPeerDisconnected(CultNetRudpSocketServerPeer peer)
+        {
+            PeerDisconnected?.Invoke(new RudpCultNetSchemaServerPeer(this, peer));
+        }
     }
 }
diff --git a/src/GameCult.Networking/CultNetSchemaClient.cs b/src/GameCult.Networking/CultNetSchemaClient.cs
index 7cc87537..5c6117aa 100644
--- a/src/GameCult.Networking/CultNetSchemaClient.cs
+++ b/src/GameCult.Networking/CultNetSchemaClient.cs
@@ -6,6 +6,7 @@ using System.Net;
 using System.Net.Sockets;
 using System.Text;
 using System.Threading;
+using System.Threading.Tasks;
 
 namespace GameCult.Networking
 {
@@ -37,6 +38,28 @@ namespace GameCult.Networking
             where T : ICultNetSchemaMessage;
     }
 
+    /// <summary>
+    /// Schema client that connects to one exact advertised URI, including its path.
+    /// Host/port-only connection is retained for legacy transports; rendezvous and
+    /// route-aware clients should prefer this contract when available.
+    /// </summary>
+    public interface ICultNetUriSchemaClient : ICultNetSchemaClient
+    {
+        /// <summary>Connects to the exact advertised schema endpoint.</summary>
+        Task ConnectAsync(Uri endpoint, CancellationToken cancellationToken = default);
+    }
+
+    /// <summary>
+    /// Exposes terminal failure of a schema client's background transport work.
+    /// </summary>
+    public interface ICultNetSchemaClientHealth
+    {
+        /// <summary>
+        /// Completes if the client's background transport loop terminates unexpectedly.
+        /// </summary>
+        Task<Exception> BackgroundFailure { get; }
+    }
+
     /// <summary>
     /// LiteNetLib-backed implementation of the CultNet schema client port.
     /// </summary>
@@ -91,7 +114,7 @@ namespace GameCult.Networking
     /// <summary>
     /// RUDP-backed implementation of the CultNet schema client port.
     /// </summary>
-    public sealed class RudpCultNetSchemaClient : ICultNetSchemaClient
+    public sealed class RudpCultNetSchemaClient : ICultNetSchemaClient, ICultNetSchemaClientHealth
     {
         private readonly string _runtimeId;
         private readonly uint _connectionId;
@@ -100,6 +123,8 @@ namespace GameCult.Networking
         private readonly long _resendDelayMs;
         private readonly ConcurrentDictionary<Type, List<Delegate>> _handlers = new();
         private readonly object _handlerLock = new();
+        private readonly TaskCompletionSource<Exception> _backgroundFailure = new(
+            TaskCreationOptions.RunContinuationsAsynchronously);
         private CultNetRudpSocketTransportConnection? _transport;
         private Thread? _pumpThread;
         private volatile bool _disposed;
@@ -125,6 +150,9 @@ namespace GameCult.Networking
         /// <inheritdoc />
         public bool Connected => _transport?.Connected == true;
 
+        /// <inheritdoc />
+        public Task<Exception> BackgroundFailure => _backgroundFailure.Task;
+
         /// <inheritdoc />
         public void Connect(string host, int port)
         {
@@ -136,8 +164,15 @@ namespace GameCult.Networking
                 ? parsed
                 : Dns.GetHostAddresses(host)[0];
             var socket = new Socket(AddressFamily.InterNetwork, SocketType.Dgram, ProtocolType.Udp);
-            socket.Bind(new IPEndPoint(IPAddress.Any, 0));
+            socket.Bind(new IPEndPoint(
+                IPAddress.IsLoopback(remoteAddress) ? IPAddress.Loopback : IPAddress.Any,
+                0));
             socket.ReceiveTimeout = 20;
+            if (string.Equals(Environment.GetEnvironmentVariable("CULTNET_TRACE_RUDP"), "1", StringComparison.Ordinal))
+            {
+                Console.Error.WriteLine(
+                    $"CultNet RUDP client bind local={socket.LocalEndPoint} remote={remoteAddress}:{port} runtime={_runtimeId}");
+            }
             _transport = new CultNetRudpSocketTransportConnection(new CultNetRudpSocketTransportOptions
             {
                 RuntimeId = _runtimeId,
@@ -182,41 +217,68 @@ namespace GameCult.Networking
         /// <inheritdoc />
         public void Dispose()
         {
+            if (_disposed)
+            {
+                return;
+            }
+
+            var transport = _transport;
+            if (transport?.Connected == true)
+            {
+                try
+                {
+                    transport.Disconnect(Encoding.UTF8.GetBytes("schema-client-disposed"));
+                }
+                catch (SocketException)
+                {
+                }
+                catch (ObjectDisposedException)
+                {
+                }
+            }
+
             _disposed = true;
-            _transport?.Dispose();
+            transport?.Dispose();
+            var pumpThread = _pumpThread;
+            if (pumpThread != null && pumpThread != Thread.CurrentThread)
+            {
+                pumpThread.Join(TimeSpan.FromMilliseconds(250));
+            }
         }
 
         private void Pump()
         {
-            while (!_disposed)
+            try
             {
-                var transport = _transport;
-                if (transport == null)
+                while (!_disposed)
                 {
-                    return;
-                }
+                    var transport = _transport;
+                    if (transport == null)
+                    {
+                        return;
+                    }
 
-                ICultNetSchemaMessage? message;
-                try
-                {
-                    message = transport.ReceiveSchemaMessageOnce();
+                    var consumed = 0;
+                    while (consumed < 256 && transport.TryReceiveOnce(out var frame))
+                    {
+                        consumed++;
+                        if (frame != null && string.Equals(frame.ChannelId, "schema", StringComparison.Ordinal))
+                            Dispatch(CultNetSchemaMessageSerialization.Deserialize(frame.Payload));
+                    }
                     transport.PollResends();
+                    if (consumed == 0)
+                        Thread.Sleep(1);
                 }
-                catch (ObjectDisposedException) when (_disposed)
-                {
-                    return;
-                }
-                catch (SocketException) when (_disposed)
-                {
-                    return;
-                }
-
-                if (message != null)
-                {
-                    Dispatch(message);
-                }
-
-                Thread.Sleep(5);
+            }
+            catch (ObjectDisposedException) when (_disposed)
+            {
+            }
+            catch (SocketException) when (_disposed)
+            {
+            }
+            catch (Exception error)
+            {
+                _backgroundFailure.TrySetResult(error);
             }
         }
 
@@ -267,6 +329,9 @@ namespace GameCult.Networking
             return new RudpCultNetSchemaClient(runtimeId, connectionId, connectPayload, maxFragmentBytes, resendDelayMs);
         }
 
+        /// <summary>Creates the length-prefixed TCP schema client.</summary>
+        public static ICultNetSchemaClient CreateTcpFramed() => new TcpFramedCultNetSchemaClient();
+
         /// <summary>
         /// Creates the default schema client adapter for an advertised endpoint URI.
         /// </summary>
@@ -290,12 +355,18 @@ namespace GameCult.Networking
                 return CreateRudp();
             }
 
+            if (string.Equals(uri.Scheme, "cultnet+tcp", StringComparison.OrdinalIgnoreCase))
+            {
+                return CreateTcpFramed();
+            }
+
             if (string.Equals(uri.Scheme, "cultnet", StringComparison.OrdinalIgnoreCase))
             {
                 return CreateLiteNetLib(security, configureClient);
             }
 
-            throw new FormatException($"CultNet endpoint '{endpoint}' must use cultnet://host:port or rudp://host:port.");
+            throw new FormatException(
+                $"CultNet endpoint '{endpoint}' must use cultnet+tcp://host:port, cultnet://host:port, or rudp://host:port.");
         }
     }
 }
diff --git a/src/GameCult.Networking/CultNetSchemaMessageSerialization.cs b/src/GameCult.Networking/CultNetSchemaMessageSerialization.cs
index 5e9431b4..e712beef 100644
--- a/src/GameCult.Networking/CultNetSchemaMessageSerialization.cs
+++ b/src/GameCult.Networking/CultNetSchemaMessageSerialization.cs
@@ -55,6 +55,8 @@ namespace GameCult.Networking
                 CultNetSchemaVersions.Error => Deserialize<CultNetErrorMessage>(payload),
                 CultNetSchemaVersions.SampleChangeName => Deserialize<CultNetSampleChangeNameMessage>(payload),
                 CultNetSchemaVersions.SampleChat => Deserialize<CultNetSampleChatMessage>(payload),
+                CultNetSchemaVersions.OperationRequest => Deserialize<CultNetOperationRequestMessage>(payload),
+                CultNetSchemaVersions.OperationResponse => Deserialize<CultNetOperationResponseMessage>(payload),
                 CultNetSchemaVersions.DocumentDelete => Deserialize<CultNetDocumentDeleteMessage>(payload),
                 CultNetSchemaVersions.DocumentPutRaw => Deserialize<CultNetDocumentPutRawMessage>(payload),
                 CultNetSchemaVersions.SnapshotRequest => Deserialize<CultNetSnapshotRequestMessage>(payload),
@@ -70,8 +72,14 @@ namespace GameCult.Networking
                 CultNetSchemaVersions.SimulationConsensusCandidate => Deserialize<CultNetSimulationConsensusCandidateMessage>(payload),
                 CultNetSchemaVersions.VerseCatalogRequest => Deserialize<CultMeshVerseCatalogRequestMessage>(payload),
                 CultNetSchemaVersions.VerseCatalogResponse => Deserialize<CultMeshVerseCatalogResponseMessage>(payload),
+                CultNetSchemaVersions.SessionOpen => Deserialize<CultMeshSessionOpenMessage>(payload),
+                CultNetSchemaVersions.SessionAccepted => Deserialize<CultMeshSessionAcceptedMessage>(payload),
                 CultNetSchemaVersions.PeerExchangeRequest => Deserialize<CultMeshPeerExchangeRequestMessage>(payload),
                 CultNetSchemaVersions.PeerExchangeResponse => Deserialize<CultMeshPeerExchangeResponseMessage>(payload),
+                CultNetSchemaVersions.ContentChunkRequest => Deserialize<CultMeshContentChunkRequestMessage>(payload),
+                CultNetSchemaVersions.ContentChunkResponse => Deserialize<CultMeshContentChunkResponseMessage>(payload),
+                CultNetSchemaVersions.BodyReadRequest => Deserialize<CultMeshBodyReadRequestMessage>(payload),
+                CultNetSchemaVersions.BodyReadResponse => Deserialize<CultMeshBodyReadResponseMessage>(payload),
                 CultNetSchemaVersions.SchemaCatalogRequest => Deserialize<CultNetSchemaCatalogRequestMessage>(payload),
                 CultNetSchemaVersions.SchemaCatalogResponse => Deserialize<CultNetSchemaCatalogResponseMessage>(payload),
                 _ => throw new MessagePackSerializationException(
diff --git a/src/GameCult.Networking/CultNetSchemaMessages.cs b/src/GameCult.Networking/CultNetSchemaMessages.cs
index ccac3dbf..56370207 100644
--- a/src/GameCult.Networking/CultNetSchemaMessages.cs
+++ b/src/GameCult.Networking/CultNetSchemaMessages.cs
@@ -56,6 +56,14 @@ namespace GameCult.Networking
         /// </summary>
         public const string SampleChat = "cultnet.sample.chat.v0";
         /// <summary>
+        /// Generic typed service operation request contract identifier.
+        /// </summary>
+        public const string OperationRequest = "cultnet.operation_request.v0";
+        /// <summary>
+        /// Generic typed service operation response contract identifier.
+        /// </summary>
+        public const string OperationResponse = "cultnet.operation_response.v0";
+        /// <summary>
         /// document delete contract identifier.
         /// </summary>
         public const string DocumentDelete = "cultnet.document_delete.v0";
@@ -127,6 +135,10 @@ namespace GameCult.Networking
         /// CultMesh Verse catalog response contract identifier.
         /// </summary>
         public const string VerseCatalogResponse = "cultmesh.verse_catalog_response.v0";
+        /// <summary>CultMesh session identity request contract identifier.</summary>
+        public const string SessionOpen = "cultmesh.session_open.v2";
+        /// <summary>CultMesh verified session identity response contract identifier.</summary>
+        public const string SessionAccepted = "cultmesh.session_accepted.v2";
         /// <summary>
         /// CultMesh peer exchange request contract identifier.
         /// </summary>
@@ -135,6 +147,22 @@ namespace GameCult.Networking
         /// CultMesh peer exchange response contract identifier.
         /// </summary>
         public const string PeerExchangeResponse = "cultmesh.peer_exchange_response.v0";
+        /// <summary>
+        /// CultMesh content chunk request contract identifier.
+        /// </summary>
+        public const string ContentChunkRequest = "cultmesh.content_chunk_request.v1";
+        /// <summary>
+        /// CultMesh content chunk response contract identifier.
+        /// </summary>
+        public const string ContentChunkResponse = "cultmesh.content_chunk_response.v1";
+        /// <summary>
+        /// CultMesh ephemeral body read request contract identifier.
+        /// </summary>
+        public const string BodyReadRequest = "cultmesh.body_read_request.v1";
+        /// <summary>
+        /// CultMesh ephemeral body read response contract identifier.
+        /// </summary>
+        public const string BodyReadResponse = "cultmesh.body_read_response.v1";
     }
 
     /// <summary>
@@ -519,6 +547,60 @@ namespace GameCult.Networking
         [Key("text")] public string Text { get; set; } = string.Empty;
     }
 
+    /// <summary>
+    /// Invokes one typed operation on an advertised service.
+    /// </summary>
+    [MessagePackObject]
+    public class CultNetOperationRequestMessage : ICultNetSchemaMessage
+    {
+        /// <summary>Gets or sets the wire schema version.</summary>
+        [Key("schemaVersion")] public string SchemaVersion { get; set; } = CultNetSchemaVersions.OperationRequest;
+        /// <summary>Gets or sets the correlation id.</summary>
+        [Key("messageId")] public string MessageId { get; set; } = string.Empty;
+        /// <summary>Gets or sets the advertised service id.</summary>
+        [Key("serviceId")] public string ServiceId { get; set; } = string.Empty;
+        /// <summary>Gets or sets the requested operation.</summary>
+        [Key("operation")] public string Operation { get; set; } = string.Empty;
+        /// <summary>Gets or sets the inner payload schema.</summary>
+        [Key("payloadSchema")] public string PayloadSchema { get; set; } = string.Empty;
+        /// <summary>Gets or sets the inner payload encoding.</summary>
+        [Key("payloadEncoding")] public string PayloadEncoding { get; set; } = "messagepack-base64";
+        /// <summary>Gets or sets the encoded inner payload.</summary>
+        [Key("payload")] public string Payload { get; set; } = string.Empty;
+        /// <summary>Gets or sets the calling runtime id.</summary>
+        [Key("sourceRuntimeId")] public string? SourceRuntimeId { get; set; }
+        /// <summary>Gets or sets an optional target runtime id.</summary>
+        [Key("targetRuntimeId")] public string? TargetRuntimeId { get; set; }
+    }
+
+    /// <summary>
+    /// Returns the correlated result of one typed service operation.
+    /// </summary>
+    [MessagePackObject]
+    public class CultNetOperationResponseMessage : ICultNetSchemaMessage
+    {
+        /// <summary>Gets or sets the wire schema version.</summary>
+        [Key("schemaVersion")] public string SchemaVersion { get; set; } = CultNetSchemaVersions.OperationResponse;
+        /// <summary>Gets or sets the request correlation id.</summary>
+        [Key("messageId")] public string MessageId { get; set; } = string.Empty;
+        /// <summary>Gets or sets the advertised service id.</summary>
+        [Key("serviceId")] public string ServiceId { get; set; } = string.Empty;
+        /// <summary>Gets or sets the completed operation.</summary>
+        [Key("operation")] public string Operation { get; set; } = string.Empty;
+        /// <summary>Gets or sets the operation status.</summary>
+        [Key("status")] public string Status { get; set; } = string.Empty;
+        /// <summary>Gets or sets the inner payload schema.</summary>
+        [Key("payloadSchema")] public string PayloadSchema { get; set; } = string.Empty;
+        /// <summary>Gets or sets the inner payload encoding.</summary>
+        [Key("payloadEncoding")] public string PayloadEncoding { get; set; } = "messagepack-base64";
+        /// <summary>Gets or sets the encoded inner payload.</summary>
+        [Key("payload")] public string Payload { get; set; } = string.Empty;
+        /// <summary>Gets or sets transport-level diagnostics.</summary>
+        [Key("diagnostics")] public string[] Diagnostics { get; set; } = Array.Empty<string>();
+        /// <summary>Gets or sets the responding runtime id.</summary>
+        [Key("sourceRuntimeId")] public string? SourceRuntimeId { get; set; }
+    }
+
     /// <summary>
     /// Raw document record carried over CultNet.
     /// </summary>
@@ -530,6 +612,18 @@ namespace GameCult.Networking
         /// </summary>
         [Key("schemaId")] public string SchemaId { get; set; } = string.Empty;
         /// <summary>
+        /// Gets or sets the stable schema family name when the publisher has a typed descriptor.
+        /// </summary>
+        [Key("schemaName")] public string? SchemaName { get; set; }
+        /// <summary>
+        /// Gets or sets the portable versioned schema contract when the publisher has a typed descriptor.
+        /// </summary>
+        [Key("schemaVersion")] public string? SchemaVersion { get; set; }
+        /// <summary>
+        /// Gets or sets the canonical schema content hash when the publisher has a typed descriptor.
+        /// </summary>
+        [Key("schemaContentHash")] public string? SchemaContentHash { get; set; }
+        /// <summary>
         /// Gets or sets the record key.
         /// </summary>
         [Key("recordKey")] public string RecordKey { get; set; } = string.Empty;
@@ -717,6 +811,18 @@ namespace GameCult.Networking
         /// Gets or sets whether the server should send a matching snapshot before live changes.
         /// </summary>
         [Key("includeSnapshot")] public bool IncludeSnapshot { get; set; } = true;
+        /// <summary>
+        /// Gets or sets the stable consumer runtime identity used for subscription diagnostics and body-plane demand.
+        /// </summary>
+        [Key("consumerRuntimeId")] public string? ConsumerRuntimeId { get; set; }
+        /// <summary>
+        /// Gets or sets logical hot-body identities needed by this exact state subscription.
+        /// </summary>
+        [Key("bodyIds")] public string[]? BodyIds { get; set; }
+        /// <summary>
+        /// Gets or sets body transports the consumer can open, ordered by consumer preference.
+        /// </summary>
+        [Key("supportedBodyTransports")] public string[]? SupportedBodyTransports { get; set; }
     }
 
     /// <summary>
@@ -1077,6 +1183,37 @@ namespace GameCult.Networking
         }
     }
 
+    /// <summary>Requests an identity-bound CultMesh session before application traffic begins.</summary>
+    [MessagePackObject]
+    public class CultMeshSessionOpenMessage : ICultNetSchemaMessage
+    {
+        [Key("schemaVersion")] public string SchemaVersion { get; set; } = CultNetSchemaVersions.SessionOpen;
+        [Key("messageId")] public string MessageId { get; set; } = string.Empty;
+        [Key("sourceRuntimeId")] public string SourceRuntimeId { get; set; } = string.Empty;
+        [Key("verseId")] public string VerseId { get; set; } = string.Empty;
+        [Key("authorityRuntimeId")] public string AuthorityRuntimeId { get; set; } = string.Empty;
+        [Key("protocolId")] public string ProtocolId { get; set; } = string.Empty;
+        [Key("routeGeneration")] public string RouteGeneration { get; set; } = string.Empty;
+        [Key("clientNonce")] public string ClientNonce { get; set; } = string.Empty;
+    }
+
+    /// <summary>Accepts or rejects a CultMesh session with the server's actual identity.</summary>
+    [MessagePackObject]
+    public class CultMeshSessionAcceptedMessage : ICultNetSchemaMessage
+    {
+        [Key("schemaVersion")] public string SchemaVersion { get; set; } = CultNetSchemaVersions.SessionAccepted;
+        [Key("messageId")] public string MessageId { get; set; } = string.Empty;
+        [Key("accepted")] public bool Accepted { get; set; }
+        [Key("verseId")] public string VerseId { get; set; } = string.Empty;
+        [Key("authorityRuntimeId")] public string AuthorityRuntimeId { get; set; } = string.Empty;
+        [Key("protocolId")] public string ProtocolId { get; set; } = string.Empty;
+        [Key("routeGeneration")] public string RouteGeneration { get; set; } = string.Empty;
+        [Key("clientNonce")] public string ClientNonce { get; set; } = string.Empty;
+        [Key("providerKeyId")] public string ProviderKeyId { get; set; } = string.Empty;
+        [Key("providerSignature")] public string ProviderSignature { get; set; } = string.Empty;
+        [Key("error")] public string? Error { get; set; }
+    }
+
     /// <summary>
     /// Requests known CultMesh Verses from a peer.
     /// </summary>
@@ -1152,6 +1289,11 @@ namespace GameCult.Networking
         /// </summary>
         [Key("authorityRuntimeIds")] public string[] AuthorityRuntimeIds { get; set; } = Array.Empty<string>();
         /// <summary>
+        /// Gets or sets exact authoritative-runtime route bindings. This is the
+        /// routing authority; the parallel legacy arrays are projections only.
+        /// </summary>
+        [Key("authorityRoutes")] public CultMeshAuthorityRouteMessage[] AuthorityRoutes { get; set; } = Array.Empty<CultMeshAuthorityRouteMessage>();
+        /// <summary>
         /// Gets or sets the parent Verse id for overlays or branches.
         /// </summary>
         [Key("parentVerseId")] public string? ParentVerseId { get; set; }
@@ -1161,6 +1303,30 @@ namespace GameCult.Networking
         [Key("description")] public string? Description { get; set; }
     }
 
+    /// <summary>Wire representation of one authority-bound CultMesh route.</summary>
+    [MessagePackObject]
+    public class CultMeshAuthorityRouteMessage
+    {
+        [Key("authorityRuntimeId")] public string AuthorityRuntimeId { get; set; } = string.Empty;
+        [Key("endpoint")] public string Endpoint { get; set; } = string.Empty;
+        [Key("protocolIds")] public string[] ProtocolIds { get; set; } = Array.Empty<string>();
+        [Key("priority")] public int Priority { get; set; }
+        [Key("generation")] public string Generation { get; set; } = string.Empty;
+        [Key("certificate")] public CultMeshRouteCertificateMessage? Certificate { get; set; }
+    }
+
+    [MessagePackObject]
+    public class CultMeshRouteCertificateMessage
+    {
+        [Key("providerKeyId")] public string ProviderKeyId { get; set; } = string.Empty;
+        [Key("providerPublicKeyX")] public string ProviderPublicKeyX { get; set; } = string.Empty;
+        [Key("providerPublicKeyY")] public string ProviderPublicKeyY { get; set; } = string.Empty;
+        [Key("odinKeyId")] public string OdinKeyId { get; set; } = string.Empty;
+        [Key("issuedAtUnixMilliseconds")] public long IssuedAtUnixMilliseconds { get; set; }
+        [Key("expiresAtUnixMilliseconds")] public long ExpiresAtUnixMilliseconds { get; set; }
+        [Key("signature")] public string Signature { get; set; } = string.Empty;
+    }
+
     /// <summary>
     /// Wire representation of CultMesh Verse compatibility.
     /// </summary>
@@ -1241,6 +1407,82 @@ namespace GameCult.Networking
         [Key("peers")] public CultMeshPeerCardMessage[] Peers { get; set; } = Array.Empty<CultMeshPeerCardMessage>();
     }
 
+    /// <summary>
+    /// Requests one bounded content-addressed chunk over a managed CultMesh content session.
+    /// </summary>
+    [MessagePackObject]
+    public class CultMeshContentChunkRequestMessage : ICultNetSchemaMessage
+    {
+        /// <summary>Gets or sets the wire schema identity.</summary>
+        [Key("schemaVersion")] public string SchemaVersion { get; set; } = CultNetSchemaVersions.ContentChunkRequest;
+        /// <summary>Gets or sets the request correlation identity.</summary>
+        [Key("messageId")] public string MessageId { get; set; } = string.Empty;
+        /// <summary>Gets or sets the canonical SHA-256 chunk identity.</summary>
+        [Key("chunkHash")] public string ChunkHash { get; set; } = string.Empty;
+        /// <summary>Gets or sets the optional canonical CultCache record key.</summary>
+        [Key("recordKey")] public string RecordKey { get; set; } = string.Empty;
+        /// <summary>Gets or sets the manifest-bound expected payload size.</summary>
+        [Key("expectedSizeBytes")] public int ExpectedSizeBytes { get; set; }
+    }
+
+    /// <summary>
+    /// Returns one bounded content-addressed chunk without publishing it as snapshot state.
+    /// </summary>
+    [MessagePackObject]
+    public class CultMeshContentChunkResponseMessage : ICultNetSchemaMessage
+    {
+        /// <summary>Gets or sets the wire schema identity.</summary>
+        [Key("schemaVersion")] public string SchemaVersion { get; set; } = CultNetSchemaVersions.ContentChunkResponse;
+        /// <summary>Gets or sets the matching request correlation identity.</summary>
+        [Key("messageId")] public string MessageId { get; set; } = string.Empty;
+        /// <summary>Gets or sets whether a validated chunk is present.</summary>
+        [Key("found")] public bool Found { get; set; }
+        /// <summary>Gets or sets the canonical SHA-256 chunk identity.</summary>
+        [Key("chunkHash")] public string ChunkHash { get; set; } = string.Empty;
+        /// <summary>Gets or sets the payload byte count.</summary>
+        [Key("sizeBytes")] public int SizeBytes { get; set; }
+        /// <summary>Gets or sets the bounded content payload.</summary>
+        [Key("payload")] public byte[] Payload { get; set; } = Array.Empty<byte>();
+        /// <summary>Gets or sets a typed-boundary failure description when the chunk is unavailable.</summary>
+        [Key("error")] public string Error { get; set; } = string.Empty;
+    }
+
+    /// <summary>
+    /// Requests one immutable body generation from its capability owner. Body bytes travel on this
+    /// dedicated plane; they are never database snapshot records.
+    /// </summary>
+    [MessagePackObject]
+    public class CultMeshBodyReadRequestMessage : ICultNetSchemaMessage
+    {
+        [Key("schemaVersion")] public string SchemaVersion { get; set; } = CultNetSchemaVersions.BodyReadRequest;
+        [Key("messageId")] public string MessageId { get; set; } = string.Empty;
+        [Key("capabilityToken")] public string CapabilityToken { get; set; } = string.Empty;
+        [Key("bodyId")] public string BodyId { get; set; } = string.Empty;
+        [Key("bodySchemaId")] public string BodySchemaId { get; set; } = string.Empty;
+        [Key("layoutVersion")] public int LayoutVersion { get; set; }
+        [Key("producerEpoch")] public long ProducerEpoch { get; set; }
+        [Key("sequence")] public long Sequence { get; set; }
+        [Key("expectedSizeBytes")] public long ExpectedSizeBytes { get; set; }
+        [Key("semanticHash")] public string SemanticHash { get; set; } = string.Empty;
+    }
+
+    /// <summary>Returns one bounded immutable body generation directly to its subscriber.</summary>
+    [MessagePackObject]
+    public class CultMeshBodyReadResponseMessage : ICultNetSchemaMessage
+    {
+        [Key("schemaVersion")] public string SchemaVersion { get; set; } = CultNetSchemaVersions.BodyReadResponse;
+        [Key("messageId")] public string MessageId { get; set; } = string.Empty;
+        [Key("found")] public bool Found { get; set; }
+        [Key("capabilityToken")] public string CapabilityToken { get; set; } = string.Empty;
+        [Key("bodyId")] public string BodyId { get; set; } = string.Empty;
+        [Key("producerEpoch")] public long ProducerEpoch { get; set; }
+        [Key("sequence")] public long Sequence { get; set; }
+        [Key("sizeBytes")] public long SizeBytes { get; set; }
+        [Key("semanticHash")] public string SemanticHash { get; set; } = string.Empty;
+        [Key("payload")] public byte[] Payload { get; set; } = Array.Empty<byte>();
+        [Key("error")] public string Error { get; set; } = string.Empty;
+    }
+
     /// <summary>
     /// Wire representation of a CultMesh peer candidate.
     /// </summary>
diff --git a/src/GameCult.Networking/CultNetSchemaRegistry.cs b/src/GameCult.Networking/CultNetSchemaRegistry.cs
index baa20b5b..4fc68a13 100644
--- a/src/GameCult.Networking/CultNetSchemaRegistry.cs
+++ b/src/GameCult.Networking/CultNetSchemaRegistry.cs
@@ -322,6 +322,20 @@ namespace GameCult.Networking
                 WireContracts = new[] { CultNetWireContracts.SchemaV0, CultNetWireContracts.GameCultNetworkingV0 }
             },
             new SchemaResourceSpec
+            {
+                FileName = "cultnet.operation-request.schema.json",
+                Kind = "wire_message",
+                SchemaVersion = CultNetSchemaVersions.OperationRequest,
+                WireContracts = new[] { CultNetWireContracts.SchemaV0 }
+            },
+            new SchemaResourceSpec
+            {
+                FileName = "cultnet.operation-response.schema.json",
+                Kind = "wire_message",
+                SchemaVersion = CultNetSchemaVersions.OperationResponse,
+                WireContracts = new[] { CultNetWireContracts.SchemaV0 }
+            },
+            new SchemaResourceSpec
             {
                 FileName = "cultnet.document-delete.schema.json",
                 Kind = "wire_message",
@@ -356,6 +370,27 @@ namespace GameCult.Networking
                 WireContracts = new[] { CultNetWireContracts.SchemaV0 }
             },
             new SchemaResourceSpec
+            {
+                FileName = "cultnet.database-subscribe.schema.json",
+                Kind = "wire_message",
+                SchemaVersion = CultNetSchemaVersions.DatabaseSubscribe,
+                WireContracts = new[] { CultNetWireContracts.SchemaV0 }
+            },
+            new SchemaResourceSpec
+            {
+                FileName = "cultnet.database-unsubscribe.schema.json",
+                Kind = "wire_message",
+                SchemaVersion = CultNetSchemaVersions.DatabaseUnsubscribe,
+                WireContracts = new[] { CultNetWireContracts.SchemaV0 }
+            },
+            new SchemaResourceSpec
+            {
+                FileName = "cultnet.database-change-raw.schema.json",
+                Kind = "wire_message",
+                SchemaVersion = CultNetSchemaVersions.DatabaseChangeRaw,
+                WireContracts = new[] { CultNetWireContracts.SchemaV0 }
+            },
+            new SchemaResourceSpec
             {
                 FileName = "cultnet.schema-descriptor.schema.json",
                 Kind = "shared_contract",
diff --git a/src/GameCult.Networking/CultNetSchemaServerGroup.cs b/src/GameCult.Networking/CultNetSchemaServerGroup.cs
new file mode 100644
index 00000000..91a8484d
--- /dev/null
+++ b/src/GameCult.Networking/CultNetSchemaServerGroup.cs
@@ -0,0 +1,97 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Threading.Tasks;
+
+namespace GameCult.Networking
+{
+    /// <summary>
+    /// Presents one logical CultNet schema server over several physical transports.
+    /// It owns handler fan-out and peer-lifecycle aggregation, but never owns or
+    /// disposes the transport servers themselves.
+    /// </summary>
+    public sealed class CultNetSchemaServerGroup :
+        ICultNetSchemaServer,
+        ICultNetSchemaServerPeerLifecycle,
+        IDisposable
+    {
+        private readonly IReadOnlyList<ICultNetSchemaServer> _servers;
+        private readonly IReadOnlyList<ICultNetSchemaServerPeerLifecycle> _lifecycles;
+        private bool _disposed;
+
+        /// <summary>Creates one logical server from two or more transport servers.</summary>
+        public CultNetSchemaServerGroup(params ICultNetSchemaServer[] servers)
+        {
+            if (servers == null) throw new ArgumentNullException(nameof(servers));
+            if (servers.Length < 2)
+                throw new ArgumentException("A CultNet schema server group requires at least two transports.", nameof(servers));
+            if (servers.Any(server => server == null))
+                throw new ArgumentException("A CultNet schema server group cannot contain a null transport.", nameof(servers));
+            for (var left = 0; left < servers.Length; left++)
+            for (var right = left + 1; right < servers.Length; right++)
+            {
+                if (ReferenceEquals(servers[left], servers[right]))
+                    throw new ArgumentException("A CultNet schema server group cannot contain the same transport twice.", nameof(servers));
+            }
+
+            _servers = Array.AsReadOnly(servers.ToArray());
+            _lifecycles = Array.AsReadOnly(servers.OfType<ICultNetSchemaServerPeerLifecycle>().ToArray());
+            foreach (var lifecycle in _lifecycles) lifecycle.PeerDisconnected += ForwardPeerDisconnected;
+        }
+
+        /// <inheritdoc />
+        public event Action<ICultNetSchemaServerPeer>? PeerDisconnected;
+
+        /// <inheritdoc />
+        public void OnCultNet<TMessage>(Func<TMessage, ICultNetSchemaServerPeer, Task> callback)
+            where TMessage : ICultNetSchemaMessage
+        {
+            if (callback == null) throw new ArgumentNullException(nameof(callback));
+            ThrowIfDisposed();
+            var registered = 0;
+            try
+            {
+                foreach (var server in _servers)
+                {
+                    server.OnCultNet(callback);
+                    registered++;
+                }
+            }
+            catch
+            {
+                for (var index = 0; index < registered; index++)
+                    _servers[index].RemoveCultNetMessageListener<TMessage>(callback);
+                throw;
+            }
+        }
+
+        /// <inheritdoc />
+        public void RemoveCultNetMessageListener<TMessage>(Delegate callback)
+            where TMessage : ICultNetSchemaMessage
+        {
+            if (callback == null) throw new ArgumentNullException(nameof(callback));
+            if (_disposed) return;
+            foreach (var server in _servers) server.RemoveCultNetMessageListener<TMessage>(callback);
+        }
+
+        /// <summary>
+        /// Detaches lifecycle forwarding. The physical transports retain their
+        /// independent ownership and must be disposed by their creator.
+        /// </summary>
+        public void Dispose()
+        {
+            if (_disposed) return;
+            _disposed = true;
+            foreach (var lifecycle in _lifecycles) lifecycle.PeerDisconnected -= ForwardPeerDisconnected;
+            PeerDisconnected = null;
+        }
+
+        private void ForwardPeerDisconnected(ICultNetSchemaServerPeer peer) =>
+            PeerDisconnected?.Invoke(peer);
+
+        private void ThrowIfDisposed()
+        {
+            if (_disposed) throw new ObjectDisposedException(nameof(CultNetSchemaServerGroup));
+        }
+    }
+}
diff --git a/src/GameCult.Networking/CultNetSchemaServerPort.cs b/src/GameCult.Networking/CultNetSchemaServerPort.cs
index 58ab2fdc..e3670ba1 100644
--- a/src/GameCult.Networking/CultNetSchemaServerPort.cs
+++ b/src/GameCult.Networking/CultNetSchemaServerPort.cs
@@ -1,4 +1,5 @@
 using System;
+using System.Net;
 using System.Threading.Tasks;
 
 namespace GameCult.Networking
@@ -32,4 +33,22 @@ namespace GameCult.Networking
         void RemoveCultNetMessageListener<TMessage>(Delegate callback)
             where TMessage : ICultNetSchemaMessage;
     }
+
+    /// <summary>Optional physical peer location used for locality-sensitive transport negotiation.</summary>
+    public interface ICultNetSchemaServerPeerLocation
+    {
+        /// <summary>Gets the remote physical endpoint when the transport exposes one.</summary>
+        EndPoint? RemoteEndPoint { get; }
+    }
+
+    /// <summary>
+    /// Optional transport-neutral peer lifetime surface for stateful service bridges.
+    /// </summary>
+    public interface ICultNetSchemaServerPeerLifecycle
+    {
+        /// <summary>
+        /// Raised after a peer session is no longer able to receive service output.
+        /// </summary>
+        event Action<ICultNetSchemaServerPeer> PeerDisconnected;
+    }
 }
diff --git a/src/GameCult.Networking/CultNetShardReplication.cs b/src/GameCult.Networking/CultNetShardReplication.cs
index 88eaac7a..5bc452f2 100644
--- a/src/GameCult.Networking/CultNetShardReplication.cs
+++ b/src/GameCult.Networking/CultNetShardReplication.cs
@@ -516,6 +516,16 @@ namespace GameCult.Networking
         /// </summary>
         public TimeSpan ResponseTimeout { get; set; } = TimeSpan.FromSeconds(5);
 
+        /// <summary>
+        /// Gets or sets schema ids to request. Null or empty requests every schema allowed by the shard.
+        /// </summary>
+        public IReadOnlyList<string>? SchemaIds { get; set; }
+
+        /// <summary>
+        /// Gets or sets record keys to request. Null or empty requests every record allowed by the shard/schema filter.
+        /// </summary>
+        public IReadOnlyList<string>? RecordKeys { get; set; }
+
         /// <summary>
         /// Gets or sets a callback used to customize each ephemeral fetch client.
         /// </summary>
@@ -569,7 +579,8 @@ namespace GameCult.Networking
             client.SendCultNet(new CultNetSnapshotRequestMessage
             {
                 MessageId = messageId,
-                SchemaIds = shard.SchemaIds.Count == 0 ? null : shard.SchemaIds.ToArray(),
+                SchemaIds = ResolveRequestedSchemaIds(shard),
+                RecordKeys = ResolveRequestedRecordKeys(),
                 ShardId = shard.ShardId,
                 ShardEpoch = shard.Epoch
             });
@@ -583,6 +594,33 @@ namespace GameCult.Networking
                    ?? CultNetSchemaClients.CreateForEndpoint(endpoint, _options.Security, _options.ConfigureClient);
         }
 
+        private string[]? ResolveRequestedSchemaIds(CultNetShardDescriptor shard)
+        {
+            if (_options.SchemaIds is { Count: > 0 })
+            {
+                return _options.SchemaIds
+                    .Where(value => !string.IsNullOrWhiteSpace(value))
+                    .Distinct(StringComparer.Ordinal)
+                    .ToArray();
+            }
+
+            return shard.SchemaIds.Count == 0 ? null : shard.SchemaIds.ToArray();
+        }
+
+        private string[]? ResolveRequestedRecordKeys()
+        {
+            if (_options.RecordKeys is not { Count: > 0 })
+            {
+                return null;
+            }
+
+            var recordKeys = _options.RecordKeys
+                .Where(value => !string.IsNullOrWhiteSpace(value))
+                .Distinct(StringComparer.Ordinal)
+                .ToArray();
+            return recordKeys.Length == 0 ? null : recordKeys;
+        }
+
         private async Task WaitForConnectionAsync(ICultNetSchemaClient client, string endpoint)
         {
             var deadline = DateTimeOffset.UtcNow + _options.ConnectTimeout;
diff --git a/src/GameCult.Networking/CultNetShardWriteForwarding.cs b/src/GameCult.Networking/CultNetShardWriteForwarding.cs
index 44cb4582..b2b9e7a2 100644
--- a/src/GameCult.Networking/CultNetShardWriteForwarding.cs
+++ b/src/GameCult.Networking/CultNetShardWriteForwarding.cs
@@ -112,7 +112,8 @@ namespace GameCult.Networking
                 !IsSupportedSchemaEndpointScheme(uri.Scheme) ||
                 string.IsNullOrWhiteSpace(uri.Host))
             {
-                throw new FormatException($"CultNet endpoint '{endpoint}' must use cultnet://host:port or rudp://host:port.");
+                throw new FormatException(
+                    $"CultNet endpoint '{endpoint}' must use cultnet+tcp://host:port, cultnet://host:port, or rudp://host:port.");
             }
 
             return (uri.Host, uri.IsDefaultPort ? 3075 : uri.Port);
@@ -135,7 +136,8 @@ namespace GameCult.Networking
 
         private static bool IsSupportedSchemaEndpointScheme(string scheme)
         {
-            return string.Equals(scheme, "cultnet", StringComparison.OrdinalIgnoreCase) ||
+            return string.Equals(scheme, "cultnet+tcp", StringComparison.OrdinalIgnoreCase) ||
+                   string.Equals(scheme, "cultnet", StringComparison.OrdinalIgnoreCase) ||
                    string.Equals(scheme, "rudp", StringComparison.OrdinalIgnoreCase);
         }
 
diff --git a/src/GameCult.Networking/CultNetTcpSchemaTransport.cs b/src/GameCult.Networking/CultNetTcpSchemaTransport.cs
new file mode 100644
index 00000000..15935b87
--- /dev/null
+++ b/src/GameCult.Networking/CultNetTcpSchemaTransport.cs
@@ -0,0 +1,237 @@
+using System;
+using System.Collections.Concurrent;
+using System.Collections.Generic;
+using System.Net;
+using System.Net.Sockets;
+using System.Threading;
+using System.Threading.Tasks;
+
+namespace GameCult.Networking
+{
+    /// <summary>Schema-v0 client over the length-prefixed TCP lane.</summary>
+    public sealed class TcpFramedCultNetSchemaClient : ICultNetSchemaClient, ICultNetSchemaClientHealth
+    {
+        private readonly ConcurrentDictionary<Type, List<Delegate>> _handlers = new();
+        private readonly object _handlerGate = new();
+        private readonly object _sendGate = new();
+        private readonly TaskCompletionSource<Exception> _backgroundFailure = new(
+            TaskCreationOptions.RunContinuationsAsynchronously);
+        private readonly CancellationTokenSource _shutdown = new();
+        private TcpClient? _client;
+        private TcpFramedTransportConnection? _transport;
+        private bool _disposed;
+
+        public bool Connected => !_disposed && _client?.Connected == true;
+        public Task<Exception> BackgroundFailure => _backgroundFailure.Task;
+
+        public void Connect(string host, int port)
+        {
+            if (_disposed) throw new ObjectDisposedException(nameof(TcpFramedCultNetSchemaClient));
+            if (_client != null) throw new InvalidOperationException("TCP schema client is already connected.");
+            var client = new TcpClient();
+            try
+            {
+                client.Connect(host, port);
+                _client = client;
+                _transport = new TcpFramedTransportConnection(
+                    client.GetStream(),
+                    CultNetTransportProfiles.CreateTcpFramed("csharp-tcp-schema-client"));
+                _ = ReceiveLoopAsync(_shutdown.Token);
+            }
+            catch
+            {
+                client.Dispose();
+                throw;
+            }
+        }
+
+        public void SendCultNet<T>(T message) where T : ICultNetSchemaMessage
+        {
+            if (_disposed) throw new ObjectDisposedException(nameof(TcpFramedCultNetSchemaClient));
+            var transport = _transport ?? throw new InvalidOperationException("TCP schema client is not connected.");
+            var payload = CultNetSchemaMessageSerialization.Serialize(message);
+            lock (_sendGate)
+                transport.SendAsync("schema", payload, _shutdown.Token).GetAwaiter().GetResult();
+        }
+
+        public void OnCultNet<T>(Action<T> callback) where T : ICultNetSchemaMessage
+        {
+            if (callback == null) throw new ArgumentNullException(nameof(callback));
+            lock (_handlerGate)
+            {
+                if (!_handlers.TryGetValue(typeof(T), out var handlers))
+                    _handlers[typeof(T)] = handlers = new List<Delegate>();
+                handlers.Add(callback);
+            }
+        }
+
+        public void Dispose()
+        {
+            if (_disposed) return;
+            _disposed = true;
+            _shutdown.Cancel();
+            _client?.Dispose();
+            _shutdown.Dispose();
+        }
+
+        private async Task ReceiveLoopAsync(CancellationToken cancellationToken)
+        {
+            try
+            {
+                var transport = _transport!;
+                while (!cancellationToken.IsCancellationRequested)
+                {
+                    var frame = await transport.ReceiveAsync(cancellationToken).ConfigureAwait(false);
+                    var message = CultNetSchemaMessageSerialization.Deserialize(frame.Payload);
+                    Dispatch(message);
+                }
+            }
+            catch (Exception error) when (!_disposed)
+            {
+                _backgroundFailure.TrySetResult(error);
+            }
+        }
+
+        private void Dispatch(ICultNetSchemaMessage message)
+        {
+            Delegate[] handlers;
+            lock (_handlerGate)
+                handlers = _handlers.TryGetValue(message.GetType(), out var registered)
+                    ? registered.ToArray()
+                    : Array.Empty<Delegate>();
+            foreach (var handler in handlers) handler.DynamicInvoke(message);
+        }
+    }
+
+    /// <summary>Schema-v0 server over the length-prefixed TCP lane.</summary>
+    public sealed class TcpFramedCultNetSchemaServer : ICultNetSchemaServer, ICultNetSchemaServerPeerLifecycle, IDisposable
+    {
+        private readonly TcpListener _listener;
+        private readonly ConcurrentDictionary<Type, Delegate> _handlers = new();
+        private readonly ConcurrentDictionary<TcpPeer, byte> _peers = new();
+        private readonly CancellationTokenSource _shutdown = new();
+        private readonly TaskCompletionSource<Exception> _backgroundFailure = new(
+            TaskCreationOptions.RunContinuationsAsynchronously);
+        private bool _disposed;
+
+        public TcpFramedCultNetSchemaServer(TcpListener listener)
+        {
+            _listener = listener ?? throw new ArgumentNullException(nameof(listener));
+            _listener.Start();
+            _ = AcceptLoopAsync(_shutdown.Token);
+        }
+
+        public event Action<ICultNetSchemaServerPeer>? PeerDisconnected;
+        /// <summary>Raised when one peer connection fails without stopping the listener.</summary>
+        public event Action<EndPoint?, Exception>? PeerFailed;
+        /// <summary>Gets the bound TCP endpoint.</summary>
+        public IPEndPoint LocalEndPoint => (IPEndPoint)_listener.LocalEndpoint;
+        /// <summary>Gets the number of active TCP peers.</summary>
+        public int PeerCount => _peers.Count;
+        /// <summary>Completes if the background accept loop fails.</summary>
+        public Task<Exception> BackgroundFailure => _backgroundFailure.Task;
+
+        public void OnCultNet<TMessage>(Func<TMessage, ICultNetSchemaServerPeer, Task> callback)
+            where TMessage : ICultNetSchemaMessage
+        {
+            if (callback == null) throw new ArgumentNullException(nameof(callback));
+            _handlers[typeof(TMessage)] = callback;
+        }
+
+        public void RemoveCultNetMessageListener<TMessage>(Delegate callback)
+            where TMessage : ICultNetSchemaMessage
+        {
+            if (_handlers.TryGetValue(typeof(TMessage), out var existing) && existing == callback)
+                _handlers.TryRemove(typeof(TMessage), out _);
+        }
+
+        public void Dispose()
+        {
+            if (_disposed) return;
+            _disposed = true;
+            _shutdown.Cancel();
+            _listener.Stop();
+            foreach (var peer in _peers.Keys) peer.Dispose();
+            _peers.Clear();
+            _shutdown.Dispose();
+        }
+
+        private async Task AcceptLoopAsync(CancellationToken cancellationToken)
+        {
+            try
+            {
+                while (!cancellationToken.IsCancellationRequested)
+                {
+                    var client = await _listener.AcceptTcpClientAsync().ConfigureAwait(false);
+                    var peer = new TcpPeer(client);
+                    _peers.TryAdd(peer, 0);
+                    _ = ServePeerAsync(peer, cancellationToken);
+                }
+            }
+            catch (Exception) when (_disposed || cancellationToken.IsCancellationRequested)
+            {
+            }
+            catch (Exception error)
+            {
+                _backgroundFailure.TrySetResult(error);
+            }
+        }
+
+        private async Task ServePeerAsync(TcpPeer peer, CancellationToken cancellationToken)
+        {
+            try
+            {
+                while (!cancellationToken.IsCancellationRequested)
+                {
+                    var frame = await peer.Transport.ReceiveAsync(cancellationToken).ConfigureAwait(false);
+                    var message = CultNetSchemaMessageSerialization.Deserialize(frame.Payload);
+                    if (_handlers.TryGetValue(message.GetType(), out var handler))
+                    {
+                        var result = handler.DynamicInvoke(message, peer) as Task;
+                        if (result != null) await result.ConfigureAwait(false);
+                    }
+                }
+            }
+            catch (Exception) when (_disposed || cancellationToken.IsCancellationRequested || !peer.Connected)
+            {
+            }
+            catch (Exception error)
+            {
+                PeerFailed?.Invoke(peer.RemoteEndPoint, error);
+            }
+            finally
+            {
+                if (_peers.TryRemove(peer, out _)) PeerDisconnected?.Invoke(peer);
+                peer.Dispose();
+            }
+        }
+
+        private sealed class TcpPeer : ICultNetSchemaServerPeer, ICultNetSchemaServerPeerLocation, IDisposable
+        {
+            private readonly TcpClient _client;
+            private readonly object _sendGate = new();
+            private readonly EndPoint? _remoteEndPoint;
+
+            public TcpPeer(TcpClient client)
+            {
+                _client = client;
+                _remoteEndPoint = client.Client.RemoteEndPoint;
+                Transport = new TcpFramedTransportConnection(
+                    client.GetStream(),
+                    CultNetTransportProfiles.CreateTcpFramed("csharp-tcp-schema-server"));
+            }
+
+            public bool Connected => _client.Connected;
+            public EndPoint? RemoteEndPoint => _remoteEndPoint;
+            public TcpFramedTransportConnection Transport { get; }
+
+            public void SendCultNet<TMessage>(TMessage message) where TMessage : ICultNetSchemaMessage
+            {
+                var payload = CultNetSchemaMessageSerialization.Serialize(message);
+                lock (_sendGate) Transport.SendAsync("schema", payload).GetAwaiter().GetResult();
+            }
+
+            public void Dispose() => _client.Dispose();
+        }
+    }
+}
diff --git a/src/GameCult.Networking/CultNetTransport.cs b/src/GameCult.Networking/CultNetTransport.cs
index b4517204..f549f735 100644
--- a/src/GameCult.Networking/CultNetTransport.cs
+++ b/src/GameCult.Networking/CultNetTransport.cs
@@ -723,6 +723,10 @@ namespace GameCult.Networking
         /// </summary>
         public IReadOnlyList<CultNetRudpDeliveredFrame> Delivered { get; set; } = Array.Empty<CultNetRudpDeliveredFrame>();
         /// <summary>
+        /// Gets or sets queued reliable packets admitted by newly received acknowledgements.
+        /// </summary>
+        public IReadOnlyList<CultNetRudpPacket> ReadyToSend { get; set; } = Array.Empty<CultNetRudpPacket>();
+        /// <summary>
         /// Gets or sets an optional immediate reply packet.
         /// </summary>
         public CultNetRudpPacket? Reply { get; set; }
@@ -865,6 +869,9 @@ namespace GameCult.Networking
     /// </summary>
     public sealed class CultNetRudpSession
     {
+        /// <summary>Maximum reliable packets admitted to the wire before acknowledgements advance the window.</summary>
+        public const int ReliableSendWindowPackets = 32;
+        private const int ReceivedSequenceWindow = 4096;
         private sealed class PendingReliablePacket
         {
             public CultNetRudpPacket Packet { get; set; } = new CultNetRudpPacket();
@@ -887,13 +894,17 @@ namespace GameCult.Networking
         }
 
         private uint _nextSequence;
+        private readonly Dictionary<string, uint> _nextSequencedByChannel = new Dictionary<string, uint>(StringComparer.Ordinal);
         private ushort _nextFragmentId = 1;
         private readonly int? _maxPendingReliablePackets;
-        private bool _connected;
+        private volatile bool _connected;
         private long? _lastReceivedAtMs;
         private uint? _highestReceivedSequence;
         private readonly HashSet<uint> _receivedSequences = new HashSet<uint>();
+        private readonly Dictionary<string, uint> _latestSequencedByChannel = new Dictionary<string, uint>(StringComparer.Ordinal);
+        private readonly object _pendingReliableGate = new object();
         private readonly Dictionary<uint, PendingReliablePacket> _pendingReliable = new Dictionary<uint, PendingReliablePacket>();
+        private readonly Queue<CultNetRudpPacket> _queuedReliable = new Queue<CultNetRudpPacket>();
         private readonly Dictionary<string, uint> _orderedNextSequenceByChannel = new Dictionary<string, uint>(StringComparer.Ordinal);
         private readonly Dictionary<string, SortedDictionary<uint, PendingOrderedFrame>> _orderedBuffers =
             new Dictionary<string, SortedDictionary<uint, PendingOrderedFrame>>(StringComparer.Ordinal);
@@ -935,7 +946,28 @@ namespace GameCult.Networking
         /// <summary>
         /// Gets reliable packet sequences awaiting acknowledgement.
         /// </summary>
-        public IReadOnlyList<uint> PendingReliableSequences => _pendingReliable.Keys.OrderBy(value => value).ToArray();
+        public IReadOnlyList<uint> PendingReliableSequences
+        {
+            get
+            {
+                lock (_pendingReliableGate)
+                {
+                    return _pendingReliable.Keys.OrderBy(value => value).ToArray();
+                }
+            }
+        }
+
+        /// <summary>Gets the number of reliable packets waiting for admission to the wire.</summary>
+        public int QueuedReliablePacketCount
+        {
+            get { lock (_pendingReliableGate) return _queuedReliable.Count; }
+        }
+
+        /// <summary>Gets all reliable packets that have not yet been acknowledged.</summary>
+        public int OutstandingReliablePacketCount
+        {
+            get { lock (_pendingReliableGate) return _pendingReliable.Count + _queuedReliable.Count; }
+        }
 
         /// <summary>
         /// Creates a reliable ordered connect packet.
@@ -972,6 +1004,12 @@ namespace GameCult.Networking
         /// </summary>
         public CultNetRudpPacket Send(string channelId, byte[] payload, CultNetRudpSendOptions? options = null)
         {
+            options ??= new CultNetRudpSendOptions();
+            lock (_pendingReliableGate)
+            {
+                if (options.Reliable && _pendingReliable.Count >= ReliableSendWindowPackets)
+                    throw new InvalidOperationException("RUDP reliable send window is full; receive acknowledgements before sending.");
+            }
             return SendMany(channelId, payload, options).First();
         }
 
@@ -986,6 +1024,10 @@ namespace GameCult.Networking
             }
 
             options ??= new CultNetRudpSendOptions();
+            if (options.Ordered && !options.Reliable)
+            {
+                throw new InvalidOperationException("RUDP ordered delivery requires reliability.");
+            }
             payload ??= Array.Empty<byte>();
             if (maxFragmentBytes.HasValue && maxFragmentBytes.Value <= 0)
             {
@@ -1019,13 +1061,11 @@ namespace GameCult.Networking
                         fragmentId,
                         (ushort)index,
                         (ushort)fragmentCount);
-                    if (fragmentPacket.Reliable)
-                    {
-                        TrackReliable(fragmentPacket, options.NowMs);
-                    }
                     packets.Add(fragmentPacket);
                 }
-                return packets;
+                return options.Reliable
+                    ? AdmitReliablePackets(packets, options.NowMs)
+                    : packets;
             }
 
             EnsureReliableCapacity(options.Reliable ? 1 : 0);
@@ -1038,7 +1078,7 @@ namespace GameCult.Networking
                 options.Sequenced);
             if (packet.Reliable)
             {
-                TrackReliable(packet, options.NowMs);
+                return AdmitReliablePackets(new[] { packet }, options.NowMs);
             }
             return new[] { packet };
         }
@@ -1050,6 +1090,7 @@ namespace GameCult.Networking
         {
             RequireConnection(packet);
             ApplyAcknowledgements(packet);
+            var readyToSend = PromoteQueuedReliable(nowMs);
             _lastReceivedAtMs = nowMs;
             var expectedSequenceIfUninitialized = _highestReceivedSequence.HasValue
                 ? _highestReceivedSequence.Value + 1
@@ -1059,14 +1100,14 @@ namespace GameCult.Networking
             {
                 RememberReceived(packet.Sequence);
                 _connected = true;
-                return new CultNetRudpReceiveResult();
+                return new CultNetRudpReceiveResult { ReadyToSend = readyToSend };
             }
 
             if (packet.PacketType == CultNetRudpPacketType.Ping)
             {
-                RememberReceived(packet.Sequence);
                 return new CultNetRudpReceiveResult
                 {
+                    ReadyToSend = readyToSend,
                     Reply = CreatePacket(
                         CultNetRudpPacketType.Pong,
                         "control",
@@ -1079,9 +1120,10 @@ namespace GameCult.Networking
 
             if (packet.PacketType == CultNetRudpPacketType.Ack || packet.PacketType == CultNetRudpPacketType.Pong)
             {
-                RememberReceived(packet.Sequence);
                 return new CultNetRudpReceiveResult
                 {
+                    Delivered = Array.Empty<CultNetRudpDeliveredFrame>(),
+                    ReadyToSend = readyToSend,
                     Pong = packet.PacketType == CultNetRudpPacketType.Pong,
                     PongPayload = packet.PacketType == CultNetRudpPacketType.Pong
                         ? packet.Payload ?? Array.Empty<byte>()
@@ -1091,10 +1133,10 @@ namespace GameCult.Networking
 
             if (packet.PacketType == CultNetRudpPacketType.Disconnect)
             {
-                RememberReceived(packet.Sequence);
                 _connected = false;
                 return new CultNetRudpReceiveResult
                 {
+                    ReadyToSend = readyToSend,
                     Disconnected = true,
                     DisconnectReason = packet.Payload ?? Array.Empty<byte>()
                 };
@@ -1102,24 +1144,43 @@ namespace GameCult.Networking
 
             if (packet.PacketType != CultNetRudpPacketType.Data)
             {
-                return new CultNetRudpReceiveResult();
+                return new CultNetRudpReceiveResult { ReadyToSend = readyToSend };
             }
 
-            var duplicate = _receivedSequences.Contains(packet.Sequence);
-            RememberReceived(packet.Sequence);
+            var duplicate = packet.Reliable
+                && (_receivedSequences.Contains(packet.Sequence)
+                    || (_highestReceivedSequence.HasValue
+                        && packet.Sequence < _highestReceivedSequence.Value
+                        && _highestReceivedSequence.Value - packet.Sequence >= ReceivedSequenceWindow));
+            if (packet.Reliable)
+            {
+                RememberReceived(packet.Sequence);
+            }
             if (duplicate)
             {
-                return new CultNetRudpReceiveResult();
+                return new CultNetRudpReceiveResult { ReadyToSend = readyToSend };
             }
 
             var reassembled = Reassemble(packet);
             if (reassembled == null)
             {
-                return new CultNetRudpReceiveResult();
+                return new CultNetRudpReceiveResult { ReadyToSend = readyToSend };
+            }
+
+            if (!reassembled.Ordered && packet.Sequenced)
+            {
+                var newestSequence = reassembled.NextSequence - 1;
+                if (_latestSequencedByChannel.TryGetValue(reassembled.Frame.ChannelId, out var latestSequence)
+                    && newestSequence <= latestSequence)
+                {
+                    return new CultNetRudpReceiveResult { ReadyToSend = readyToSend };
+                }
+                _latestSequencedByChannel[reassembled.Frame.ChannelId] = newestSequence;
             }
 
             return new CultNetRudpReceiveResult
             {
+                ReadyToSend = readyToSend,
                 Delivered = reassembled.Ordered
                     ? DeliverOrdered(reassembled.Frame, reassembled.NextSequence, expectedSequenceIfUninitialized)
                     : new[] { reassembled.Frame }
@@ -1129,9 +1190,36 @@ namespace GameCult.Networking
         /// <summary>
         /// Creates a packet carrying the current acknowledgement state.
         /// </summary>
-        public CultNetRudpPacket CreateAck()
+        public CultNetRudpPacket CreateAck(uint? acknowledgedSequence = null)
         {
-            return CreatePacket(CultNetRudpPacketType.Ack, "control", Array.Empty<byte>(), reliable: false, ordered: false, sequenced: false);
+            var (ack, ackMask) = AckState();
+            if (acknowledgedSequence.HasValue)
+            {
+                ack = acknowledgedSequence.Value;
+                ackMask = 0;
+            }
+            return new CultNetRudpPacket
+            {
+                PacketType = CultNetRudpPacketType.Ack,
+                ConnectionId = ConnectionId,
+                Sequence = 0,
+                Ack = ack,
+                AckMask = ackMask,
+                ChannelId = "control",
+                Payload = Array.Empty<byte>()
+            };
+        }
+
+        /// <summary>
+        /// Creates a cumulative acknowledgement when the received packet is inside the
+        /// acknowledgement horizon, or an exact acknowledgement for an older retransmit.
+        /// </summary>
+        public CultNetRudpPacket CreateAckForReceived(uint receivedSequence)
+        {
+            var (ack, _) = AckState();
+            return ack >= receivedSequence && ack - receivedSequence <= 32
+                ? CreateAck()
+                : CreateAck(receivedSequence);
         }
 
         /// <summary>
@@ -1174,12 +1262,15 @@ namespace GameCult.Networking
         public IReadOnlyList<CultNetRudpPacket> DueResends(long nowMs)
         {
             var due = new List<CultNetRudpPacket>();
-            foreach (var pending in _pendingReliable.Values)
+            lock (_pendingReliableGate)
             {
-                if (nowMs - pending.LastSentAtMs >= ResendDelayMs)
+                foreach (var pending in _pendingReliable.Values)
                 {
-                    pending.LastSentAtMs = nowMs;
-                    due.Add(ClonePacket(pending.Packet));
+                    if (nowMs - pending.LastSentAtMs >= ResendDelayMs)
+                    {
+                        pending.LastSentAtMs = nowMs;
+                        due.Add(ClonePacket(pending.Packet));
+                    }
                 }
             }
 
@@ -1208,8 +1299,24 @@ namespace GameCult.Networking
             ushort fragmentIndex,
             ushort fragmentCount)
         {
-            var sequence = _nextSequence;
-            _nextSequence = checked(_nextSequence + 1);
+            uint sequence;
+            if (reliable)
+            {
+                sequence = _nextSequence;
+                _nextSequence = checked(_nextSequence + 1);
+            }
+            else if (sequenced)
+            {
+                if (!_nextSequencedByChannel.TryGetValue(channelId, out sequence))
+                {
+                    sequence = 1;
+                }
+                _nextSequencedByChannel[channelId] = checked(sequence + 1);
+            }
+            else
+            {
+                sequence = 0;
+            }
             var (ack, ackMask) = AckState();
             return new CultNetRudpPacket
             {
@@ -1231,11 +1338,62 @@ namespace GameCult.Networking
 
         private void TrackReliable(CultNetRudpPacket packet, long nowMs)
         {
-            _pendingReliable[packet.Sequence] = new PendingReliablePacket
+            lock (_pendingReliableGate)
             {
-                Packet = ClonePacket(packet),
-                LastSentAtMs = nowMs
-            };
+                _pendingReliable[packet.Sequence] = new PendingReliablePacket
+                {
+                    Packet = ClonePacket(packet),
+                    LastSentAtMs = nowMs
+                };
+            }
+        }
+
+        private IReadOnlyList<CultNetRudpPacket> AdmitReliablePackets(
+            IReadOnlyList<CultNetRudpPacket> packets,
+            long nowMs)
+        {
+            lock (_pendingReliableGate)
+            {
+                var available = Math.Max(0, ReliableSendWindowPackets - _pendingReliable.Count);
+                var ready = new List<CultNetRudpPacket>(Math.Min(available, packets.Count));
+                foreach (var packet in packets)
+                {
+                    if (ready.Count < available)
+                    {
+                        _pendingReliable[packet.Sequence] = new PendingReliablePacket
+                        {
+                            Packet = ClonePacket(packet),
+                            LastSentAtMs = nowMs
+                        };
+                        ready.Add(packet);
+                    }
+                    else
+                    {
+                        _queuedReliable.Enqueue(ClonePacket(packet));
+                    }
+                }
+                return ready;
+            }
+        }
+
+        private IReadOnlyList<CultNetRudpPacket> PromoteQueuedReliable(long nowMs)
+        {
+            lock (_pendingReliableGate)
+            {
+                var available = Math.Max(0, ReliableSendWindowPackets - _pendingReliable.Count);
+                var ready = new List<CultNetRudpPacket>(Math.Min(available, _queuedReliable.Count));
+                while (ready.Count < available && _queuedReliable.Count > 0)
+                {
+                    var packet = _queuedReliable.Dequeue();
+                    _pendingReliable[packet.Sequence] = new PendingReliablePacket
+                    {
+                        Packet = ClonePacket(packet),
+                        LastSentAtMs = nowMs
+                    };
+                    ready.Add(packet);
+                }
+                return ready;
+            }
         }
 
         private void EnsureReliableCapacity(int packetCount)
@@ -1245,20 +1403,26 @@ namespace GameCult.Networking
                 return;
             }
 
-            if (_pendingReliable.Count + packetCount > _maxPendingReliablePackets.Value)
+            lock (_pendingReliableGate)
             {
-                throw new InvalidOperationException("RUDP reliable send queue is full.");
+                if (_pendingReliable.Count + _queuedReliable.Count + packetCount > _maxPendingReliablePackets.Value)
+                {
+                    throw new InvalidOperationException("RUDP reliable send queue is full.");
+                }
             }
         }
 
         private void ApplyAcknowledgements(CultNetRudpPacket packet)
         {
-            _pendingReliable.Remove(packet.Ack);
-            for (var bit = 0; bit < 32; bit++)
+            lock (_pendingReliableGate)
             {
-                if ((packet.AckMask & (1u << bit)) != 0 && packet.Ack > bit)
+                _pendingReliable.Remove(packet.Ack);
+                for (var bit = 0; bit < 32; bit++)
                 {
-                    _pendingReliable.Remove(packet.Ack - (uint)bit - 1);
+                    if ((packet.AckMask & (1u << bit)) != 0 && packet.Ack > bit)
+                    {
+                        _pendingReliable.Remove(packet.Ack - (uint)bit - 1);
+                    }
                 }
             }
         }
@@ -1270,6 +1434,13 @@ namespace GameCult.Networking
             {
                 _highestReceivedSequence = sequence;
             }
+            if (_receivedSequences.Count > ReceivedSequenceWindow)
+            {
+                var keepFrom = (_highestReceivedSequence ?? sequence) >= ReceivedSequenceWindow - 1
+                    ? (_highestReceivedSequence ?? sequence) - (uint)(ReceivedSequenceWindow - 1)
+                    : 0;
+                _receivedSequences.RemoveWhere(received => received < keepFrom);
+            }
         }
 
         private (uint Ack, uint AckMask) AckState()
@@ -1485,8 +1656,14 @@ namespace GameCult.Networking
     /// </summary>
     public sealed class CultNetRudpSocketTransportConnection : IDisposable
     {
+        private const int MinimumReceiveBufferBytes = 4 * 1024 * 1024;
+        // One acknowledgement carries the preceding 32-packet receive mask.
+        // Pace at that transport window instead of sleeping after every fragment;
+        // a one-millisecond sleep can consume a full scheduler quantum on Windows.
+        private const int WireBurstPackets = 32;
         private readonly Socket _socket;
         private readonly CultNetRudpSession _session;
+        private readonly object _sessionGate = new object();
         private readonly CultNetRudpSocketMode _mode;
         private readonly int? _maxFragmentBytes;
         private readonly CultNetTransportStats _stats = new CultNetTransportStats();
@@ -1503,6 +1680,8 @@ namespace GameCult.Networking
             if (options == null) throw new ArgumentNullException(nameof(options));
             if (string.IsNullOrWhiteSpace(options.RuntimeId)) throw new ArgumentException("Runtime id is required.", nameof(options));
             _socket = options.Socket ?? throw new ArgumentNullException(nameof(options.Socket));
+            if (_socket.ReceiveBufferSize < MinimumReceiveBufferBytes)
+                _socket.ReceiveBufferSize = MinimumReceiveBufferBytes;
             _mode = options.Mode;
             _remoteEndPoint = options.RemoteEndPoint;
             _maxFragmentBytes = options.MaxFragmentBytes;
@@ -1537,7 +1716,7 @@ namespace GameCult.Networking
         /// <summary>
         /// Gets whether the RUDP handshake has completed.
         /// </summary>
-        public bool Connected => _session.Connected;
+        public bool Connected { get { lock (_sessionGate) return _session.Connected; } }
 
         /// <summary>
         /// Gets a snapshot of the current transfer counters.
@@ -1573,7 +1752,8 @@ namespace GameCult.Networking
                 throw new InvalidOperationException("Only a client RUDP socket transport can initiate connect.");
             }
 
-            SendPacket(_session.CreateConnect(NowMs(), payload ?? Array.Empty<byte>()));
+            lock (_sessionGate)
+                SendPacket(_session.CreateConnect(NowMs(), payload ?? Array.Empty<byte>()));
         }
 
         /// <summary>
@@ -1634,13 +1814,51 @@ namespace GameCult.Networking
         /// </summary>
         public void Send(string channelId, byte[] payload)
         {
-            foreach (var packet in _session.SendMany(channelId, payload, ChannelSendOptions(channelId), _maxFragmentBytes))
-            {
-                SendPacket(packet);
-            }
+            lock (_sessionGate)
+                SendPackets(_session.SendMany(channelId, payload, ChannelSendOptions(channelId), _maxFragmentBytes));
             _stats.FramesSent++;
         }
 
+        /// <summary>
+        /// Pumps acknowledgements and resends until every queued reliable packet is acknowledged.
+        /// </summary>
+        public void FlushReliable(TimeSpan? timeout = null)
+        {
+            var deadline = DateTimeOffset.UtcNow.Add(timeout ?? TimeSpan.FromSeconds(30));
+            var preserved = new List<CultNetTransportFrame>();
+            while (_deliveredFrames.Count > 0)
+                preserved.Add(_deliveredFrames.Dequeue());
+            try
+            {
+                while (true)
+                {
+                    lock (_sessionGate)
+                    {
+                        if (_session.OutstandingReliablePacketCount == 0)
+                            return;
+                    }
+                    if (DateTimeOffset.UtcNow >= deadline)
+                    {
+                        int outstanding;
+                        lock (_sessionGate)
+                            outstanding = _session.OutstandingReliablePacketCount;
+                        throw new TimeoutException($"RUDP reliable flush timed out with {outstanding} packets outstanding.");
+                    }
+                    if (TryReceiveOnce(out var delivered) && delivered != null)
+                        preserved.Add(delivered);
+                    PollResends();
+                    Thread.Sleep(5);
+                }
+            }
+            finally
+            {
+                while (_deliveredFrames.Count > 0)
+                    preserved.Add(_deliveredFrames.Dequeue());
+                foreach (var frame in preserved)
+                    _deliveredFrames.Enqueue(frame);
+            }
+        }
+
         /// <summary>
         /// Sends a reliable ordered schema-channel payload.
         /// </summary>
@@ -1790,7 +2008,8 @@ namespace GameCult.Networking
         /// </summary>
         public void Disconnect(byte[]? reason = null)
         {
-            SendPacket(_session.CreateDisconnect(reason ?? Array.Empty<byte>()));
+            lock (_sessionGate)
+                SendPacket(_session.CreateDisconnect(reason ?? Array.Empty<byte>()));
         }
 
         /// <summary>
@@ -1798,7 +2017,8 @@ namespace GameCult.Networking
         /// </summary>
         public void Ping(byte[]? payload = null)
         {
-            SendPacket(_session.CreatePing(payload ?? Array.Empty<byte>()));
+            lock (_sessionGate)
+                SendPacket(_session.CreatePing(payload ?? Array.Empty<byte>()));
         }
 
         /// <summary>
@@ -1806,19 +2026,33 @@ namespace GameCult.Networking
         /// </summary>
         public bool CheckTimeout(long timeoutMs)
         {
-            return _session.CheckTimeout(NowMs(), timeoutMs);
+            lock (_sessionGate)
+                return _session.CheckTimeout(NowMs(), timeoutMs);
         }
 
         /// <summary>
         /// Polls the UDP socket once and returns the next delivered transport frame if one is available.
         /// </summary>
         public CultNetTransportFrame? ReceiveOnce()
+        {
+            TryReceiveOnce(out var delivered);
+            return delivered;
+        }
+
+        /// <summary>
+        /// Consumes one available transport work item and reports progress independently
+        /// of whether that packet completed an application frame.
+        /// </summary>
+        public bool TryReceiveOnce(out CultNetTransportFrame? delivered)
         {
             if (_deliveredFrames.Count > 0)
             {
-                return _deliveredFrames.Dequeue();
+                delivered = _deliveredFrames.Dequeue();
+                return true;
             }
 
+            delivered = null;
+
             var buffer = new byte[65535];
             EndPoint remote = new IPEndPoint(IPAddress.Any, 0);
             int received;
@@ -1826,7 +2060,7 @@ namespace GameCult.Networking
             {
                 if (!_socket.Poll(0, SelectMode.SelectRead))
                 {
-                    return null;
+                    return false;
                 }
 
                 received = _socket.ReceiveFrom(buffer, ref remote);
@@ -1835,7 +2069,15 @@ namespace GameCult.Networking
                 error.SocketErrorCode == SocketError.WouldBlock ||
                 error.SocketErrorCode == SocketError.TimedOut)
             {
-                return null;
+                return false;
+            }
+            catch (SocketException error) when (
+                error.SocketErrorCode == SocketError.ConnectionReset ||
+                error.SocketErrorCode == SocketError.ConnectionAborted ||
+                error.SocketErrorCode == SocketError.Shutdown)
+            {
+                DisconnectReason = Array.Empty<byte>();
+                return false;
             }
 
             _stats.BytesReceived += received;
@@ -1845,22 +2087,31 @@ namespace GameCult.Networking
             }
             else if (!_remoteEndPoint.Equals(remote))
             {
-                return null;
+                return true;
             }
 
             var wire = new byte[received];
             Array.Copy(buffer, wire, received);
             var packet = CultNetRudpPacketCodec.Decode(wire);
+            TracePacket("rx", packet, received, remote);
             if (_mode == CultNetRudpSocketMode.Server && packet.PacketType == CultNetRudpPacketType.Connect)
             {
-                SendPacket(_session.AcceptConnect(packet, NowMs()));
-                return null;
+                lock (_sessionGate)
+                    SendPacket(_session.AcceptConnect(packet, NowMs()));
+                return true;
             }
 
-            var result = _session.Receive(packet, NowMs());
-            if (result.Reply != null)
+            CultNetRudpReceiveResult result;
+            CultNetRudpPacket? acknowledgement = null;
+            lock (_sessionGate)
             {
-                SendPacket(result.Reply);
+                result = _session.Receive(packet, NowMs());
+                if (result.Reply != null)
+                    SendPacket(result.Reply);
+                SendPackets(result.ReadyToSend);
+                if (packet.PacketType == CultNetRudpPacketType.Accept ||
+                    packet.PacketType == CultNetRudpPacketType.Data)
+                    acknowledgement = _session.CreateAckForReceived(packet.Sequence);
             }
             if (result.Pong)
             {
@@ -1869,7 +2120,7 @@ namespace GameCult.Networking
             if (result.Disconnected)
             {
                 DisconnectReason = result.DisconnectReason;
-                return null;
+                return true;
             }
 
             foreach (var frame in result.Delivered)
@@ -1882,13 +2133,11 @@ namespace GameCult.Networking
                 _stats.FramesReceived++;
             }
 
-            var delivered = _deliveredFrames.Count > 0 ? _deliveredFrames.Dequeue() : null;
-            if (packet.PacketType == CultNetRudpPacketType.Accept || delivered != null)
-            {
-                SendPacket(_session.CreateAck());
-            }
+            delivered = _deliveredFrames.Count > 0 ? _deliveredFrames.Dequeue() : null;
+            if (acknowledgement != null)
+                SendPacket(acknowledgement);
 
-            return delivered;
+            return true;
         }
 
         /// <summary>
@@ -1896,9 +2145,19 @@ namespace GameCult.Networking
         /// </summary>
         public void PollResends()
         {
-            foreach (var packet in _session.DueResends(NowMs()))
+            if (_socket.Poll(0, SelectMode.SelectRead))
+                return;
+            lock (_sessionGate)
+                SendPackets(_session.DueResends(NowMs()));
+        }
+
+        private void SendPackets(IReadOnlyList<CultNetRudpPacket> packets)
+        {
+            for (var index = 0; index < packets.Count; index++)
             {
-                SendPacket(packet);
+                SendPacket(packets[index]);
+                if ((index + 1) % WireBurstPackets == 0 && index + 1 < packets.Count)
+                    Thread.Yield();
             }
         }
 
@@ -1924,6 +2183,18 @@ namespace GameCult.Networking
             var wire = CultNetRudpPacketCodec.Encode(packet);
             var sent = _socket.SendTo(wire, _remoteEndPoint);
             _stats.BytesSent += sent;
+            TracePacket("tx", packet, sent, _remoteEndPoint);
+        }
+
+        private static void TracePacket(string direction, CultNetRudpPacket packet, int bytes, EndPoint? endpoint)
+        {
+            if (!string.Equals(Environment.GetEnvironmentVariable("CULTNET_TRACE_RUDP"), "1", StringComparison.Ordinal))
+            {
+                return;
+            }
+
+            Console.Error.WriteLine(
+                $"CultNet RUDP {direction} type={packet.PacketType} seq={packet.Sequence} ack={packet.Ack} bytes={bytes} endpoint={endpoint}");
         }
 
         private static CultNetRudpSendOptions ChannelSendOptions(string channelId)
@@ -2004,6 +2275,7 @@ namespace GameCult.Networking
         }
 
         internal CultNetRudpSession Session { get; }
+        internal object SessionGate { get; } = new object();
 
         /// <summary>
         /// Gets the UDP endpoint for this peer.
@@ -2012,7 +2284,11 @@ namespace GameCult.Networking
         /// <summary>
         /// Gets whether the peer RUDP handshake has completed.
         /// </summary>
-        public bool Connected => Session.Connected;
+        public bool Connected { get { lock (SessionGate) return Session.Connected; } }
+        /// <summary>
+        /// Gets the number of reliable packets still awaiting acknowledgement.
+        /// </summary>
+        public int PendingReliablePacketCount { get { lock (SessionGate) return Session.OutstandingReliablePacketCount; } }
         /// <summary>
         /// Gets the last transport-level remote disconnect reason, if one was received.
         /// </summary>
@@ -2039,6 +2315,10 @@ namespace GameCult.Networking
     /// </summary>
     public sealed class CultNetRudpSocketTransportServer : IDisposable
     {
+        private const int MinimumReceiveBufferBytes = 4 * 1024 * 1024;
+        // Keep server response pacing aligned with the 32-packet ACK mask. Large
+        // content responses otherwise pay one Windows scheduler quantum per 1 KiB.
+        private const int WireBurstPackets = 32;
         private readonly Socket _socket;
         private readonly uint _connectionId;
         private readonly uint _initialSequence;
@@ -2059,6 +2339,8 @@ namespace GameCult.Networking
             if (options == null) throw new ArgumentNullException(nameof(options));
             if (string.IsNullOrWhiteSpace(options.RuntimeId)) throw new ArgumentException("Runtime id is required.", nameof(options));
             _socket = options.Socket ?? throw new ArgumentNullException(nameof(options.Socket));
+            if (_socket.ReceiveBufferSize < MinimumReceiveBufferBytes)
+                _socket.ReceiveBufferSize = MinimumReceiveBufferBytes;
             _connectionId = options.ConnectionId;
             _initialSequence = options.InitialSequence;
             _resendDelayMs = options.ResendDelayMs;
@@ -2091,6 +2373,11 @@ namespace GameCult.Networking
         /// </summary>
         public IReadOnlyCollection<CultNetRudpSocketServerPeer> Peers => _peers.Values.ToArray();
 
+        /// <summary>
+        /// Raised when a tracked peer closes its RUDP session.
+        /// </summary>
+        public event Action<CultNetRudpSocketServerPeer>? PeerDisconnected;
+
         /// <summary>
         /// Gets a snapshot of the current transfer counters.
         /// </summary>
@@ -2102,10 +2389,8 @@ namespace GameCult.Networking
         public void Send(CultNetRudpSocketServerPeer peer, string channelId, byte[] payload)
         {
             if (peer == null) throw new ArgumentNullException(nameof(peer));
-            foreach (var packet in peer.Session.SendMany(channelId, payload, ChannelSendOptions(channelId), _maxFragmentBytes))
-            {
-                SendPacket(peer.RemoteEndPoint, packet);
-            }
+            lock (peer.SessionGate)
+                SendPackets(peer, peer.Session.SendMany(channelId, payload, ChannelSendOptions(channelId), _maxFragmentBytes));
             _stats.FramesSent++;
         }
 
@@ -2139,12 +2424,25 @@ namespace GameCult.Networking
         /// Polls the UDP socket once and returns the next delivered peer frame if one is available.
         /// </summary>
         public CultNetRudpSocketServerFrame? ReceiveOnce()
+        {
+            TryReceiveOnce(out var delivered);
+            return delivered;
+        }
+
+        /// <summary>
+        /// Consumes one available transport work item and reports whether transport progress was made,
+        /// independently of whether that work item completed an application frame.
+        /// </summary>
+        public bool TryReceiveOnce(out CultNetRudpSocketServerFrame? delivered)
         {
             if (_deliveredFrames.Count > 0)
             {
-                return _deliveredFrames.Dequeue();
+                delivered = _deliveredFrames.Dequeue();
+                return true;
             }
 
+            delivered = null;
+
             var buffer = new byte[65535];
             EndPoint remote = new IPEndPoint(IPAddress.Any, 0);
             int received;
@@ -2152,7 +2450,7 @@ namespace GameCult.Networking
             {
                 if (!_socket.Poll(0, SelectMode.SelectRead))
                 {
-                    return null;
+                    return false;
                 }
 
                 received = _socket.ReceiveFrom(buffer, ref remote);
@@ -2161,7 +2459,14 @@ namespace GameCult.Networking
                 error.SocketErrorCode == SocketError.WouldBlock ||
                 error.SocketErrorCode == SocketError.TimedOut)
             {
-                return null;
+                return false;
+            }
+            catch (SocketException error) when (
+                error.SocketErrorCode == SocketError.ConnectionReset ||
+                error.SocketErrorCode == SocketError.ConnectionAborted ||
+                error.SocketErrorCode == SocketError.Shutdown)
+            {
+                return false;
             }
 
             _stats.BytesReceived += received;
@@ -2175,12 +2480,12 @@ namespace GameCult.Networking
             }
             catch (InvalidOperationException)
             {
-                return null;
+                return true;
             }
 
             if (packet.ConnectionId != _connectionId)
             {
-                return null;
+                return true;
             }
 
             var peerKey = RemoteKey(remote);
@@ -2196,25 +2501,33 @@ namespace GameCult.Networking
                         MaxPendingReliablePackets = _maxPendingReliablePackets
                     }));
                 _peers[peerKey] = peer;
-                SendPacket(peer.RemoteEndPoint, peer.Session.AcceptConnect(packet, NowMs(), _acceptPayload));
-                return null;
+                lock (peer.SessionGate)
+                    SendPacket(peer.RemoteEndPoint, peer.Session.AcceptConnect(packet, NowMs(), _acceptPayload));
+                return true;
             }
 
             if (!_peers.TryGetValue(peerKey, out var existingPeer))
             {
-                return null;
+                return true;
             }
 
-            var result = existingPeer.Session.Receive(packet, NowMs());
-            if (result.Reply != null)
+            CultNetRudpReceiveResult result;
+            CultNetRudpPacket? acknowledgement = null;
+            lock (existingPeer.SessionGate)
             {
-                SendPacket(existingPeer.RemoteEndPoint, result.Reply);
+                result = existingPeer.Session.Receive(packet, NowMs());
+                if (result.Reply != null)
+                    SendPacket(existingPeer.RemoteEndPoint, result.Reply);
+                SendPackets(existingPeer, result.ReadyToSend);
+                if (packet.PacketType == CultNetRudpPacketType.Data)
+                    acknowledgement = existingPeer.Session.CreateAckForReceived(packet.Sequence);
             }
             if (result.Disconnected)
             {
                 existingPeer.DisconnectReason = result.DisconnectReason;
                 _peers.Remove(peerKey);
-                return null;
+                PeerDisconnected?.Invoke(existingPeer);
+                return true;
             }
 
             foreach (var frame in result.Delivered)
@@ -2231,13 +2544,11 @@ namespace GameCult.Networking
                 _stats.FramesReceived++;
             }
 
-            var delivered = _deliveredFrames.Count > 0 ? _deliveredFrames.Dequeue() : null;
-            if (packet.PacketType == CultNetRudpPacketType.Data || delivered != null)
-            {
-                SendPacket(existingPeer.RemoteEndPoint, existingPeer.Session.CreateAck());
-            }
+            delivered = _deliveredFrames.Count > 0 ? _deliveredFrames.Dequeue() : null;
+            if (acknowledgement != null)
+                SendPacket(existingPeer.RemoteEndPoint, acknowledgement);
 
-            return delivered;
+            return true;
         }
 
         /// <summary>
@@ -2245,12 +2556,22 @@ namespace GameCult.Networking
         /// </summary>
         public void PollResends()
         {
+            if (_socket.Poll(0, SelectMode.SelectRead))
+                return;
             foreach (var peer in _peers.Values.ToArray())
             {
-                foreach (var packet in peer.Session.DueResends(NowMs()))
-                {
-                    SendPacket(peer.RemoteEndPoint, packet);
-                }
+                lock (peer.SessionGate)
+                    SendPackets(peer, peer.Session.DueResends(NowMs()));
+            }
+        }
+
+        private void SendPackets(CultNetRudpSocketServerPeer peer, IReadOnlyList<CultNetRudpPacket> packets)
+        {
+            for (var index = 0; index < packets.Count; index++)
+            {
+                SendPacket(peer.RemoteEndPoint, packets[index]);
+                if ((index + 1) % WireBurstPackets == 0 && index + 1 < packets.Count)
+                    Thread.Yield();
             }
         }
 
diff --git a/src/GameCult.Networking/GameCult.Networking.csproj b/src/GameCult.Networking/GameCult.Networking.csproj
index f275484f..0d63f94c 100644
--- a/src/GameCult.Networking/GameCult.Networking.csproj
+++ b/src/GameCult.Networking/GameCult.Networking.csproj
@@ -7,10 +7,8 @@
     <ProjectReference Include="..\GameCult.Logging\GameCult.Logging.csproj" />
     <ProjectReference Include="..\GameCult.Caching\GameCult.Caching.csproj" />
     <ProjectReference Include="..\GameCult.Caching.MessagePack\GameCult.Caching.MessagePack.csproj" />
-    <ProjectReference Include="..\GameCult.Caching.MessagePack.Generator\GameCult.Caching.MessagePack.Generator.csproj"
-                      OutputItemType="Analyzer"
-                      ReferenceOutputAssembly="false" />
     <PackageReference Include="MessagePack" Version="3.1.7" />
+    <PackageReference Include="MessagePackAnalyzer" Version="3.1.7" PrivateAssets="all" />
     <PackageReference Include="System.Text.Json" Version="9.0.10" />
     <PackageReference Include="R3" Version="1.3.0" />
     <PackageReference Include="LiteNetLib" Version="2.1.2" />
diff --git a/src/GameCult.Networking/PlayerData.cs b/src/GameCult.Networking/PlayerData.cs
index 997db848..ade82c0f 100644
--- a/src/GameCult.Networking/PlayerData.cs
+++ b/src/GameCult.Networking/PlayerData.cs
@@ -8,6 +8,7 @@ namespace GameCult.Networking
     /// Basic player account document used by the sample networking stack.
     /// </summary>
     [CultDocument("gamecult.player_data", "gamecult.player_data.v2")]
+    [MessagePackObject]
     public class PlayerData
     {
         /// <summary>
diff --git a/src/GameCult.Networking/README.md b/src/GameCult.Networking/README.md
index c7c4792f..de8496d3 100644
--- a/src/GameCult.Networking/README.md
+++ b/src/GameCult.Networking/README.md
@@ -390,6 +390,48 @@ peer lookup and handshake before returning the same RUDP transport. Packet
 semantics, schema-channel send/receive helpers, and reconnect state still live
 in `GameCult.Networking`.
 
+## Typed Operations
+
+`CultNetOperationServer` attaches typed application handlers to any
+`ICultNetSchemaServer`. It owns route/schema validation, MessagePack envelope
+encoding, correlation, and framework failure replies. The application handler
+owns domain validation, state mutation, idempotency, and durable receipts:
+
+```csharp
+using var operations = new CultNetOperationServer(schemaServer, "counter.provider")
+    .Register<IncrementRequest, IncrementReceipt>(
+        "counter",
+        "counter.increment",
+        "counter.increment_request.v1",
+        "counter.increment_receipt.v1",
+        command => IncrementExactlyOnceAsync(
+            command.IdempotencyKey,
+            command.Value));
+```
+
+Returning `CultNetOperationReply<T>.Rejected(...)` preserves a schema-valid
+domain receipt and status. Unknown routes, malformed payloads, and schema
+mismatches return the correlated `gamecult.cultnet.operation_failure.v1`
+payload; `CultMeshClient.InvokeAsync` raises
+`CultMeshRemoteOperationException` immediately instead of timing out. The
+browser client raises the equivalent `CultMeshBrowserOperationError` with the
+same status and failure code.
+
+## Browser WebSocket Host
+
+`GameCult.Networking.WebSockets` keeps ASP.NET Core hosting out of the
+netstandard CultNet core while adapting an authenticated binary WebSocket to
+the same `ICultNetSchemaServer` and `ICultNetSchemaClient` ports. A host calls
+`UseWebSockets()` and maps `MapCultNetWebSocket(...)` with an authorization
+predicate. Anonymous use requires the explicit `AllowAnonymousDevelopment`
+opt-in. Text frames and messages over the configured size bound are closed
+before schema dispatch.
+
+The matching `CultNetWebSocketSchemaClient` is suitable for C# headless and
+service consumers. Browser applications use `cultmesh-browser`, which owns
+stable Verse/provider identity, document leases, resubscription, and operation
+correlation above the raw WebSocket route.
+
 ## Important Constraints
 
 - `Server` currently centers on `PlayerData` as the built-in account model.
diff --git a/src/GameCult.Networking/Server.cs b/src/GameCult.Networking/Server.cs
index 4400c95d..616f9ccd 100644
--- a/src/GameCult.Networking/Server.cs
+++ b/src/GameCult.Networking/Server.cs
@@ -3,6 +3,7 @@ using System.Collections.Concurrent;
 using System.Collections.Generic;
 using System.Diagnostics;
 using System.Linq;
+using System.Net;
 using System.Text.RegularExpressions;
 using System.Threading.Tasks;
 using GameCult.Caching;
@@ -17,7 +18,7 @@ namespace GameCult.Networking
     /// <summary>
     /// Hosts the server-side authentication, session, and message dispatch pipeline.
     /// </summary>
-    public class Server : ICultNetSchemaServer, IDisposable
+    public class Server : ICultNetSchemaServer, ICultNetSchemaServerPeerLifecycle, IDisposable
     {
         private const string EmailPattern =
             @"^([0-9a-zA-Z]([\+\-_\.][0-9a-zA-Z]+)*)+@(([0-9a-zA-Z][-\w]*[0-9a-zA-Z]*\.)+[a-zA-Z0-9]{2,17})$";
@@ -45,6 +46,9 @@ namespace GameCult.Networking
         private ILogger _logger = new NullLogger();
         private bool _disposed;
 
+        /// <inheritdoc />
+        public event Action<ICultNetSchemaServerPeer>? PeerDisconnected;
+
         /// <summary>
         /// Gets or sets the logger used by the server.
         /// </summary>
@@ -378,7 +382,9 @@ namespace GameCult.Networking
             listener.PeerDisconnectedEvent += (peer, info) =>
             {
                 Logger.LogInfo($"User Disconnected: {peer.Address}");
+                var context = GetPeerContext(peer);
                 _users.TryRemove(peer.Id, out _);
+                PeerDisconnected?.Invoke(context);
             };
 
             listener.NetworkLatencyUpdateEvent += (peer, latency) =>
@@ -815,7 +821,7 @@ namespace GameCult.Networking
     /// <summary>
     /// Transport-aware server peer context for built-in CultNet service bodies.
     /// </summary>
-    public sealed class CultNetServerPeer : ICultNetSchemaServerPeer
+    public sealed class CultNetServerPeer : ICultNetSchemaServerPeer, ICultNetSchemaServerPeerLocation
     {
         internal CultNetServerPeer(NetPeer peer, LiteNetLibTransportConnection transport)
         {
@@ -828,6 +834,9 @@ namespace GameCult.Networking
         /// </summary>
         public NetPeer Peer { get; }
 
+        /// <inheritdoc />
+        public EndPoint RemoteEndPoint => new IPEndPoint(Peer.Address, Peer.Port);
+
         /// <summary>
         /// Gets the channel-aware LiteNetLib transport adapter for this peer.
         /// </summary>
diff --git a/src/GameCult.Unity/Assets/Caching/Editor/CultCacheStudioDrawers.cs b/src/GameCult.Unity/Assets/Caching/Editor/CultCacheStudioDrawers.cs
new file mode 100644
index 00000000..12eed25e
--- /dev/null
+++ b/src/GameCult.Unity/Assets/Caching/Editor/CultCacheStudioDrawers.cs
@@ -0,0 +1,444 @@
+using System;
+using System.Collections;
+using System.Collections.Generic;
+using System.Linq;
+using System.Reflection;
+using GameCult.Caching;
+using UnityEditor;
+using UnityEngine;
+using Object = UnityEngine.Object;
+
+namespace GameCult.Unity.Caching.Editor
+{
+    // An IMGUI drawer claimed through [CultInspectorDrawer]. A change returns the new value and sets GUI.changed, as IMGUI
+    // controls do; only a frame that reports a change is saved. Mutating value in place without GUI.changed is not saved
+    // reliably: it lingers in the edit copy until some later change saves it. A drawer that throws discards the whole
+    // frame's edit copy, so nothing it or any other drawer did that frame is saved. type is the value's declared type.
+    // member is the member the value belongs to, also for list elements and dictionary keys and values, and null for a
+    // bare value. inspector.DrawDefault hands the value back to built-in drawing; inspector.DrawValue draws a sub-value
+    // with claims.
+    public interface ICultInspectorDrawer
+    {
+        object Draw(CultInspector inspector, string label, Type type, object value, MemberInfo member);
+    }
+
+    // The IMGUI lowering of CultInspectorModel. The model decides members, metadata, shapes, drawer claims and edit
+    // rules; this class draws them and hands every change back through the model.
+    public sealed class CultInspector
+    {
+        private static CultInspectorDrawerClaims _claims;
+        private static readonly Dictionary<Type, ICultInspectorDrawer> DrawerInstances = new Dictionary<Type, ICultInspectorDrawer>();
+        private static GUIStyle _errorStyle;
+
+        private readonly Dictionary<string, bool> _foldouts = new Dictionary<string, bool>(StringComparer.Ordinal);
+        private readonly Dictionary<string, string> _notices = new Dictionary<string, string>(StringComparer.Ordinal);
+        private string _path = string.Empty;
+        private Type _document;
+        private bool _drawerFailed;
+
+        internal CultInspector(CultInspectorModel model)
+        {
+            Model = model;
+        }
+
+        public CultInspectorModel Model { get; }
+
+        public IReadOnlyList<CultStoredDocument> Records { get; internal set; } = Array.Empty<CultStoredDocument>();
+
+        private static GUIStyle ErrorStyle => _errorStyle ??= new GUIStyle(EditorStyles.label) { normal = { textColor = new Color(1f, .35f, .3f) } };
+
+        private static CultInspectorDrawerClaims Claims
+        {
+            get
+            {
+                if (_claims != null) return _claims;
+                _claims = new CultInspectorDrawerClaims(TypeCache.GetTypesWithAttribute<CultInspectorDrawerAttribute>(), typeof(ICultInspectorDrawer));
+                foreach (var error in _claims.Errors) Debug.LogError(error);
+                return _claims;
+            }
+        }
+
+        // False when a drawer threw: the edit copy may hold part of its in-place mutation and must be discarded, not saved.
+        internal bool DrawDocument(CultInspectorEdit edit)
+        {
+            _drawerFailed = false;
+            _document = edit.Document.GetType();
+            DrawMembers(edit.Document, edit.Source.Descriptor.DocumentType, edit.Source.Key.Value);
+            return !_drawerFailed;
+        }
+
+        // Draws a sub-value of the value being drawn, claims applied.
+        public object DrawValue(string label, Type type, object value, MemberInfo member)
+        {
+            return DrawValue(label, type, value, member, _path + "/" + label);
+        }
+
+        // Built-in drawing for a value, ignoring drawer claims on it.
+        public object DrawDefault(string label, Type type, object value, MemberInfo member)
+        {
+            var shape = Model.ShapeOf(type);
+            var metadata = Model.MetadataOf(member);
+            switch (shape.Kind)
+            {
+                case CultInspectorValueKind.String:
+                    return DrawString(label, value as string, metadata);
+                case CultInspectorValueKind.Integer:
+                    return DrawInteger(label, type, value, metadata);
+                case CultInspectorValueKind.Float:
+                    if (type == typeof(double)) return EditorGUILayout.DoubleField(label, value is double d ? d : 0d);
+                    var f = value is float single ? single : 0f;
+                    return metadata.Range == null ? EditorGUILayout.FloatField(label, f) : EditorGUILayout.Slider(label, f, metadata.Range.Min, metadata.Range.Max);
+                case CultInspectorValueKind.Bool:
+                    return EditorGUILayout.Toggle(label, value is bool b && b);
+                case CultInspectorValueKind.Enum:
+                    var current = value as Enum ?? (Enum)Enum.ToObject(type, 0);
+                    return type.IsDefined(typeof(FlagsAttribute), false) ? EditorGUILayout.EnumFlagsField(label, current) : EditorGUILayout.EnumPopup(label, current);
+                case CultInspectorValueKind.RecordRef:
+                    return DrawRecordRef(label, type, value);
+                case CultInspectorValueKind.List:
+                    return DrawList(label, shape, value, member);
+                case CultInspectorValueKind.Dictionary:
+                    return DrawDictionary(label, shape, value as IDictionary, member);
+                case CultInspectorValueKind.Union:
+                    return DrawUnion(label, shape, value);
+                case CultInspectorValueKind.Nested:
+                    return DrawNested(label, type, value);
+                default:
+                    return typeof(Object).IsAssignableFrom(type)
+                        ? EditorGUILayout.ObjectField(label, value as Object, type, false)
+                        : ErrorRow(label, shape.Reason, value);
+            }
+        }
+
+        private object DrawValue(string label, Type type, object value, MemberInfo member, string path)
+        {
+            var outer = _path;
+            _path = path;
+            try
+            {
+                var claim = Claims.Resolve(type, member);
+                if (claim.Conflict != null) return ErrorRow(label, "no drawer: " + claim.Conflict, value);
+                if (claim.Drawer == null) return DrawDefault(label, type, value, member);
+                var changed = GUI.changed;
+                try
+                {
+                    return Drawer(claim.Drawer).Draw(this, label, type, value, member);
+                }
+                catch (ExitGUIException)
+                {
+                    throw;
+                }
+                catch (Exception exception)
+                {
+                    GUI.changed = changed;
+                    _drawerFailed = true;
+                    return ErrorRow(label, claim.Drawer.Name + " failed: " + exception.Message + " Nothing edited this frame was saved.", value);
+                }
+            }
+            finally
+            {
+                _path = outer;
+            }
+        }
+
+        private static ICultInspectorDrawer Drawer(Type type)
+        {
+            if (!DrawerInstances.TryGetValue(type, out var drawer))
+                DrawerInstances[type] = drawer = (ICultInspectorDrawer)Activator.CreateInstance(type);
+            return drawer;
+        }
+
+        private void DrawMembers(object target, Type type, string path)
+        {
+            foreach (var member in Model.MembersOf(type))
+            {
+                if (member.Metadata.Hidden) continue;
+                using (new EditorGUI.DisabledScope(member.IsReadOnly))
+                {
+                    EditorGUI.BeginChangeCheck();
+                    var next = DrawValue(LabelOf(member), member.ValueType, member.GetValue(target), member.Member, path + "." + member.Name);
+                    if (EditorGUI.EndChangeCheck() && !member.IsReadOnly) member.SetValue(target, next);
+                }
+            }
+        }
+
+        private static string DrawString(string label, string value, CultInspectorMetadata metadata)
+        {
+            if (metadata.AssetPath != null)
+            {
+                var assetType = metadata.AssetPath.AssetType != null && typeof(Object).IsAssignableFrom(metadata.AssetPath.AssetType) ? metadata.AssetPath.AssetType : typeof(Object);
+                var asset = string.IsNullOrEmpty(value) ? null : AssetDatabase.LoadAssetAtPath(value, assetType);
+                var next = EditorGUILayout.ObjectField(label, asset, assetType, false);
+                return next == asset ? value : next == null ? string.Empty : AssetDatabase.GetAssetPath(next);
+            }
+
+            var textArea = metadata.TextArea;
+            if (textArea == null) return EditorGUILayout.TextField(label, value ?? string.Empty);
+            EditorGUILayout.LabelField(label);
+            return EditorGUILayout.TextArea(value ?? string.Empty,
+                GUILayout.MinHeight(Mathf.Max(textArea.MinLines, 1) * EditorGUIUtility.singleLineHeight),
+                GUILayout.MaxHeight(Mathf.Max(textArea.MaxLines, textArea.MinLines, 1) * EditorGUIUtility.singleLineHeight));
+        }
+
+        private object DrawInteger(string label, Type type, object value, CultInspectorMetadata metadata)
+        {
+            var current = value == null ? 0L : Convert.ToInt64(value);
+            if (type == typeof(int) && metadata.Range != null)
+                return EditorGUILayout.IntSlider(label, (int)current, Mathf.RoundToInt(metadata.Range.Min), Mathf.RoundToInt(metadata.Range.Max));
+            var next = EditorGUILayout.LongField(label, current);
+            return next == current && value != null ? value : Model.NarrowInteger(type, next);
+        }
+
+        private object DrawRecordRef(string label, Type type, object value)
+        {
+            var key = CultInspectorModel.RecordKey(value);
+            var candidates = Model.RecordCandidates(type, Records);
+            var index = 0;
+            var names = new string[candidates.Count + 1];
+            for (var i = 0; i < candidates.Count; i++)
+            {
+                names[i + 1] = CultInspectorModel.RecordLabel(candidates[i]);
+                if (candidates[i].Key.Value == key) index = i + 1;
+            }
+
+            names[0] = index == 0 && key.Length > 0 ? "Missing " + key : "None";
+            var next = key;
+            using (new EditorGUILayout.HorizontalScope())
+            {
+                var picked = EditorGUILayout.Popup(label, index, names);
+                var indent = EditorGUI.indentLevel;
+                EditorGUI.indentLevel = 0;
+                var typed = EditorGUILayout.DelayedTextField(key, GUILayout.Width(120));
+                EditorGUI.indentLevel = indent;
+                if (picked != index) next = picked == 0 ? string.Empty : candidates[picked - 1].Key.Value;
+                else if (typed != key) next = typed;
+            }
+
+            return next == key ? value : Model.CreateRecordRef(type, next);
+        }
+
+        private object DrawDictionary(string label, CultInspectorShape shape, IDictionary dictionary, MemberInfo member)
+        {
+            var path = _path;
+            var entries = new List<KeyValuePair<object, object>>();
+            if (dictionary != null)
+            {
+                var enumerator = dictionary.GetEnumerator();
+                while (enumerator.MoveNext()) entries.Add(new KeyValuePair<object, object>(enumerator.Key, enumerator.Value));
+            }
+
+            if (!Foldout(path, label + " (" + entries.Count + ")")) return dictionary;
+            EditorGUI.indentLevel++;
+            var changed = false;
+            var remove = -1;
+            for (var i = 0; i < entries.Count; i++)
+            {
+                using (new EditorGUILayout.HorizontalScope())
+                {
+                    using (new EditorGUILayout.VerticalScope())
+                    {
+                        EditorGUI.BeginChangeCheck();
+                        var key = DrawValue("Key", shape.KeyType, entries[i].Key, member, path + "{" + i + "}.key");
+                        var item = DrawValue("Value", shape.ValueType, entries[i].Value, member, path + "{" + i + "}.value");
+                        if (EditorGUI.EndChangeCheck())
+                        {
+                            key = Model.ReplaceKey(_document, shape.Type, entries.Select(e => e.Key).ToArray(), i, key, out var notice);
+                            Notice(path, notice);
+                            entries[i] = new KeyValuePair<object, object>(key, item);
+                            changed = true;
+                        }
+                    }
+
+                    if (GUILayout.Button("-", GUILayout.Width(20))) remove = i;
+                }
+            }
+
+            if (remove >= 0)
+            {
+                entries.RemoveAt(remove);
+                changed = true;
+            }
+
+            if (Add(shape.ValueType, path, out var created))
+            {
+                var fresh = Model.FreshKey(_document, shape.Type, entries.Select(e => e.Key).ToArray(), Records, out var notice);
+                Notice(path, notice);
+                if (fresh != null)
+                {
+                    entries.Add(new KeyValuePair<object, object>(fresh, created));
+                    changed = true;
+                }
+            }
+
+            DrawNotice(path);
+            EditorGUI.indentLevel--;
+            return changed ? Model.BuildDictionary(shape.Type, entries) : dictionary;
+        }
+
+        private object DrawList(string label, CultInspectorShape shape, object value, MemberInfo member)
+        {
+            var path = _path;
+            var element = shape.ElementType;
+            var items = new List<object>();
+            if (value is IEnumerable enumerable)
+                foreach (var item in enumerable) items.Add(item);
+
+            if (!Foldout(path, label + " [" + items.Count + "]")) return value;
+            EditorGUI.indentLevel++;
+            var changed = false;
+            var remove = -1;
+            for (var i = 0; i < items.Count; i++)
+            {
+                using (new EditorGUILayout.HorizontalScope())
+                {
+                    using (new EditorGUILayout.VerticalScope())
+                    {
+                        EditorGUI.BeginChangeCheck();
+                        var next = DrawValue("Element " + i, element, items[i], member, path + "[" + i + "]");
+                        if (EditorGUI.EndChangeCheck())
+                        {
+                            items[i] = next;
+                            changed = true;
+                        }
+                    }
+
+                    if (GUILayout.Button("-", GUILayout.Width(20))) remove = i;
+                }
+            }
+
+            if (remove >= 0)
+            {
+                items.RemoveAt(remove);
+                changed = true;
+            }
+
+            if (Add(element, path, out var created))
+            {
+                items.Add(created);
+                changed = true;
+            }
+
+            DrawNotice(path);
+            EditorGUI.indentLevel--;
+            return changed ? Model.BuildList(shape.Type, items) : value;
+        }
+
+        private object DrawUnion(string label, CultInspectorShape shape, object value)
+        {
+            var path = _path;
+            var choices = shape.UnionChoices;
+            var index = value == null ? 0 : IndexOf(choices, value.GetType()) + 1;
+            var names = choices.Select(u => u.Name).Prepend(value == null || index > 0 ? "None" : value.GetType().Name + " (not a declared union)").ToArray();
+
+            bool expanded;
+            using (new EditorGUILayout.HorizontalScope())
+            {
+                expanded = Foldout(path, label, GUILayout.Width(EditorGUIUtility.labelWidth));
+                var indent = EditorGUI.indentLevel;
+                EditorGUI.indentLevel = 0;
+                var picked = EditorGUILayout.Popup(index, names);
+                EditorGUI.indentLevel = indent;
+                if (picked != index)
+                {
+                    string notice = null;
+                    value = picked == 0 ? null : Model.CreateElement(shape.Type, choices[picked - 1], out notice) ?? value;
+                    Notice(path, notice);
+                }
+            }
+
+            DrawNotice(path);
+            if (!expanded || value == null) return value;
+            EditorGUI.indentLevel++;
+            DrawMembers(value, value.GetType(), path);
+            EditorGUI.indentLevel--;
+            return value;
+        }
+
+        private object DrawNested(string label, Type type, object value)
+        {
+            var path = _path;
+            if (value == null)
+            {
+                using (new EditorGUILayout.HorizontalScope())
+                {
+                    EditorGUILayout.LabelField(label, "null");
+                    var created = Model.CreateDefault(type);
+                    if (created != null && GUILayout.Button("Create", GUILayout.Width(56))) value = created;
+                }
+
+                return value;
+            }
+
+            if (!Foldout(path, label)) return value;
+            EditorGUI.indentLevel++;
+            DrawMembers(value, type, path);
+            EditorGUI.indentLevel--;
+            return value;
+        }
+
+        // Foldouts stay usable inside disabled scopes so read-only data can still be browsed. Expanding is view state:
+        // it never counts as a change, so it never upserts.
+        private bool Foldout(string path, string label, params GUILayoutOption[] options)
+        {
+            _foldouts.TryGetValue(path, out var expanded);
+            var enabled = GUI.enabled;
+            var changed = GUI.changed;
+            GUI.enabled = true;
+            expanded = EditorGUI.Foldout(EditorGUILayout.GetControlRect(false, options), expanded, label, true);
+            GUI.enabled = enabled;
+            GUI.changed = changed;
+            _foldouts[path] = expanded;
+            return expanded;
+        }
+
+        // The add control under a list or dictionary: a button when the model offers the element type itself, a popup of
+        // a union's declared subtypes otherwise. True with the model's new value once one is picked and made.
+        private bool Add(Type elementType, string path, out object created)
+        {
+            created = null;
+            var choices = Model.ElementChoices(elementType);
+            Type choice;
+            if (choices.Count == 1 && choices[0] == elementType)
+            {
+                choice = GUILayout.Button("Add") ? elementType : null;
+            }
+            else
+            {
+                var picked = EditorGUILayout.Popup("Add", 0, choices.Select(c => c.Name).Prepend("...").ToArray());
+                choice = picked > 0 ? choices[picked - 1] : null;
+            }
+
+            if (choice == null) return false;
+            created = Model.CreateElement(elementType, choice, out var notice);
+            Notice(path, notice);
+            return notice == null;
+        }
+
+        // The model's notice for the control at path, kept until that control's next answer.
+        private void Notice(string path, string notice)
+        {
+            if (notice == null) _notices.Remove(path);
+            else _notices[path] = notice;
+        }
+
+        private void DrawNotice(string path)
+        {
+            if (_notices.TryGetValue(path, out var notice)) EditorGUILayout.HelpBox(notice, MessageType.Warning);
+        }
+
+        private static object ErrorRow(string label, string message, object value)
+        {
+            EditorGUILayout.LabelField(label, message, ErrorStyle);
+            return value;
+        }
+
+        private static int IndexOf(IReadOnlyList<Type> types, Type type)
+        {
+            for (var i = 0; i < types.Count; i++)
+                if (types[i] == type) return i;
+            return -1;
+        }
+
+        private static string LabelOf(CultInspectorMember member) => member.Metadata.Label ?? ObjectNames.NicifyVariableName(member.Name);
+    }
+}
diff --git a/src/GameCult.Unity/Assets/Caching/Editor/CultCacheStudioDrawers.cs.meta b/src/GameCult.Unity/Assets/Caching/Editor/CultCacheStudioDrawers.cs.meta
new file mode 100644
index 00000000..a0d1bbf1
--- /dev/null
+++ b/src/GameCult.Unity/Assets/Caching/Editor/CultCacheStudioDrawers.cs.meta
@@ -0,0 +1,2 @@
+fileFormatVersion: 2
+guid: 06d55de1c539404b9a935871a8a3a334
diff --git a/src/GameCult.Unity/Assets/Caching/Editor/CultCacheStudioWindow.cs b/src/GameCult.Unity/Assets/Caching/Editor/CultCacheStudioWindow.cs
index e50ff1e6..6c9fedf8 100644
--- a/src/GameCult.Unity/Assets/Caching/Editor/CultCacheStudioWindow.cs
+++ b/src/GameCult.Unity/Assets/Caching/Editor/CultCacheStudioWindow.cs
@@ -1,37 +1,38 @@
 using System;
-using System.Collections;
-using System.Collections.Generic;
-using System.Globalization;
 using System.IO;
 using System.Linq;
-using System.Reflection;
-using System.Threading.Tasks;
-using GameCult.Unity.Caching;
+using GameCult.Caching;
+using GameCult.Caching.MessagePack;
 using UnityEditor;
 using UnityEngine;
-using Object = UnityEngine.Object;
 
 namespace GameCult.Unity.Caching.Editor
 {
-    /// <summary>
-    /// Unity editor window for inspecting and editing CultCache .cc stores.
-    /// </summary>
     public sealed class CultCacheStudioWindow : EditorWindow
     {
         private const string LastPathKey = "GameCult.CultCacheStudio.LastPath";
 
-        private readonly Dictionary<string, bool> _foldouts = new Dictionary<string, bool>(StringComparer.Ordinal);
-        private object _cache;
+        private CultCache _cache;
+        private CultInspectorModel _model;
+        private CultInspector _inspector;
+        private CultInspectorEdit _edit;
+        private CultStoredDocument[] _records = Array.Empty<CultStoredDocument>();
         private string _path = string.Empty;
+        private bool _directory;
+        private bool _readOnly;
         private string _search = string.Empty;
-        private string _selectedKey = string.Empty;
         private Type _selectedType;
+        private string _selectedKey;
         private Vector2 _typeScroll;
         private Vector2 _recordScroll;
         private Vector2 _inspectorScroll;
-        private string _status = "Open a .cc file to begin.";
+        private string _status = "Open a CultCache store to begin.";
         private MessageType _statusType = MessageType.Info;
 
+        private bool ReadOnly => _cache.BackingStores.Any(store => store.IsReadOnly);
+
+        private static string ProjectRoot => Path.GetDirectoryName(Path.GetFullPath(Application.dataPath));
+
         [MenuItem("GameCult/CultCache Studio")]
         public static void Open()
         {
@@ -43,34 +44,27 @@ namespace GameCult.Unity.Caching.Editor
             _path = EditorPrefs.GetString(LastPathKey, string.Empty);
         }
 
+        // Disposing never flushes; unsaved edits are dropped on close and on script reload.
+        private void OnDisable()
+        {
+            CloseStore();
+        }
+
         private void OnGUI()
         {
             DrawToolbar();
-            EditorGUILayout.Space(6);
-
-            if (!CultCacheBridge.IsAvailable)
-            {
-                EditorGUILayout.HelpBox(
-                    "CultCache Studio needs GameCult.Caching and GameCult.Caching.MessagePack loaded in this Unity project.",
-                    MessageType.Warning);
-            }
-
-            if (!string.IsNullOrWhiteSpace(_status))
-            {
-                EditorGUILayout.HelpBox(_status, _statusType);
-            }
-
-            if (_cache == null)
-            {
-                DrawClosedState();
-                return;
-            }
+            if (!string.IsNullOrEmpty(_status)) EditorGUILayout.HelpBox(_status, _statusType);
+            if (_cache == null) return;
+            if (ReadOnly)
+                EditorGUILayout.HelpBox("Read-only store: " + _path + " was opened read-only. Adding, deleting, editing and saving are disabled.", MessageType.Warning);
 
+            _records = _cache.AllStoredDocuments.ToArray();
+            _inspector.Records = _records;
             using (new EditorGUILayout.HorizontalScope())
             {
-                DrawTypeColumn();
-                DrawRecordColumn();
-                DrawInspectorColumn();
+                DrawTypes();
+                DrawRecords();
+                DrawInspector();
             }
         }
 
@@ -78,91 +72,59 @@ namespace GameCult.Unity.Caching.Editor
         {
             using (new EditorGUILayout.HorizontalScope(EditorStyles.toolbar))
             {
-                GUILayout.Label("Path", GUILayout.Width(32));
                 _path = GUILayout.TextField(_path, EditorStyles.toolbarTextField, GUILayout.MinWidth(180));
-
-                using (new EditorGUI.DisabledScope(!CultCacheBridge.IsAvailable))
+                _directory = GUILayout.Toggle(_directory, "Directory", EditorStyles.toolbarButton, GUILayout.Width(62));
+                _readOnly = GUILayout.Toggle(_readOnly, "Read Only", EditorStyles.toolbarButton, GUILayout.Width(66));
+                if (GUILayout.Button("Open", EditorStyles.toolbarButton, GUILayout.Width(44))) Browse(false);
+                using (new EditorGUI.DisabledScope(_readOnly || _directory))
                 {
-                    if (GUILayout.Button("Open", EditorStyles.toolbarButton, GUILayout.Width(52)))
-                    {
-                        BrowseAndOpen();
-                    }
-
-                    if (GUILayout.Button("New", EditorStyles.toolbarButton, GUILayout.Width(44)))
-                    {
-                        BrowseAndCreate();
-                    }
+                    if (GUILayout.Button(new GUIContent("New", "Creates a writable single-file store. Turn off Read Only and Directory to enable."),
+                            EditorStyles.toolbarButton, GUILayout.Width(40)))
+                        Browse(true);
                 }
 
                 using (new EditorGUI.DisabledScope(_cache == null))
                 {
-                    if (GUILayout.Button("Reload", EditorStyles.toolbarButton, GUILayout.Width(58)))
+                    if (GUILayout.Button("Reload", EditorStyles.toolbarButton, GUILayout.Width(52)) && ConfirmDiscard()) OpenStore(_path, false);
+                    using (new EditorGUI.DisabledScope(_cache == null || ReadOnly || !_cache.IsDirty))
                     {
-                        ReloadCurrent();
+                        if (GUILayout.Button("Save", EditorStyles.toolbarButton, GUILayout.Width(40))) Save();
                     }
 
-                    if (GUILayout.Button("Save", EditorStyles.toolbarButton, GUILayout.Width(48)))
+                    if (GUILayout.Button("Close", EditorStyles.toolbarButton, GUILayout.Width(44)) && ConfirmDiscard())
                     {
-                        SaveCurrent();
+                        CloseStore();
+                        SetStatus("Closed " + _path + ".", MessageType.Info);
+                        GUIUtility.ExitGUI();
                     }
                 }
 
                 GUILayout.FlexibleSpace();
                 if (_cache != null)
-                {
-                    GUILayout.Label(CultCacheBridge.IsDirty(_cache) ? "Dirty" : "Saved", EditorStyles.miniLabel, GUILayout.Width(42));
-                }
+                    GUILayout.Label(ReadOnly ? "Read Only" : _cache.IsDirty ? "Dirty" : "Saved", EditorStyles.miniBoldLabel);
             }
         }
 
-        private void DrawClosedState()
+        private void DrawTypes()
         {
-            GUILayout.FlexibleSpace();
-            using (new EditorGUILayout.HorizontalScope())
+            using (new EditorGUILayout.VerticalScope(GUILayout.Width(240)))
             {
-                GUILayout.FlexibleSpace();
-                using (new EditorGUILayout.VerticalScope(GUILayout.Width(420)))
-                {
-                    EditorGUILayout.LabelField("CultCache Studio", EditorStyles.boldLabel);
-                    EditorGUILayout.LabelField("Open or create a .cc file to inspect registered CultCache documents.");
-                    EditorGUILayout.Space(8);
-                    using (new EditorGUI.DisabledScope(!CultCacheBridge.IsAvailable))
-                    {
-                        if (GUILayout.Button("Open .cc File", GUILayout.Height(32)))
-                        {
-                            BrowseAndOpen();
-                        }
-
-                        if (GUILayout.Button("Create .cc File", GUILayout.Height(28)))
-                        {
-                            BrowseAndCreate();
-                        }
-                    }
-                }
-
-                GUILayout.FlexibleSpace();
-            }
-
-            GUILayout.FlexibleSpace();
-        }
-
-        private void DrawTypeColumn()
-        {
-            using (new EditorGUILayout.VerticalScope(GUILayout.Width(250), GUILayout.ExpandHeight(true)))
-            {
-                EditorGUILayout.LabelField("Document Types", EditorStyles.boldLabel);
                 _search = EditorGUILayout.TextField(_search, EditorStyles.toolbarSearchField);
-                _typeScroll = EditorGUILayout.BeginScrollView(_typeScroll, GUI.skin.box);
-
-                foreach (var descriptor in FilteredDescriptors())
+                _typeScroll = EditorGUILayout.BeginScrollView(_typeScroll);
+                foreach (var descriptor in _cache.Registry.AllDescriptors)
                 {
-                    var count = RecordsFor(descriptor.DocumentType).Count();
-                    var label = descriptor.SchemaName + " (" + count.ToString(CultureInfo.InvariantCulture) + ")";
-                    var style = _selectedType == descriptor.DocumentType ? EditorStyles.toolbarButton : EditorStyles.miniButton;
-                    if (GUILayout.Button(label, style))
+                    var type = descriptor.DocumentType;
+                    if (_search.Length > 0 &&
+                        descriptor.SchemaName.IndexOf(_search, StringComparison.OrdinalIgnoreCase) < 0 &&
+                        type.Name.IndexOf(_search, StringComparison.OrdinalIgnoreCase) < 0)
+                        continue;
+
+                    var count = _model.RecordCandidates(typeof(CultRecordRef<>).MakeGenericType(type), _records).Count;
+                    var label = descriptor.SchemaName + (descriptor.IsGlobal ? count == 0 ? " (absent)" : " (global)" : " (" + count + ")");
+                    if (GUILayout.Toggle(_selectedType == type, label, EditorStyles.miniButton) && _selectedType != type)
                     {
-                        _selectedType = descriptor.DocumentType;
-                        _selectedKey = string.Empty;
+                        _selectedType = type;
+                        _selectedKey = null;
                     }
                 }
 
@@ -170,445 +132,250 @@ namespace GameCult.Unity.Caching.Editor
             }
         }
 
-        private void DrawRecordColumn()
+        private void DrawRecords()
         {
-            using (new EditorGUILayout.VerticalScope(GUILayout.Width(280), GUILayout.ExpandHeight(true)))
+            using (new EditorGUILayout.VerticalScope(GUILayout.Width(260)))
             {
+                var descriptor = _selectedType == null ? null : _cache.Registry.GetRequired(_selectedType);
+                var selected = Selected();
+                var cannotAdd = descriptor == null || ReadOnly || !_model.CanCreate(_selectedType);
                 using (new EditorGUILayout.HorizontalScope())
                 {
-                    EditorGUILayout.LabelField("Records", EditorStyles.boldLabel);
-                    using (new EditorGUI.DisabledScope(_selectedType == null || _selectedType.GetConstructor(Type.EmptyTypes) == null))
+                    using (new EditorGUI.DisabledScope(cannotAdd || descriptor.IsGlobal))
                     {
-                        if (GUILayout.Button("Add", GUILayout.Width(56)))
-                        {
-                            AddSelectedTypeRecord();
-                        }
+                        if (GUILayout.Button("Add", EditorStyles.miniButtonLeft)) Add();
+                    }
+
+                    using (new EditorGUI.DisabledScope(selected == null || selected.Descriptor.IsGlobal || ReadOnly))
+                    {
+                        if (GUILayout.Button("Duplicate", EditorStyles.miniButtonMid)) Duplicate(selected);
+                    }
+
+                    using (new EditorGUI.DisabledScope(selected == null || ReadOnly))
+                    {
+                        if (GUILayout.Button("Delete", EditorStyles.miniButtonRight)) Delete(selected);
                     }
                 }
 
-                _recordScroll = EditorGUILayout.BeginScrollView(_recordScroll, GUI.skin.box);
-                if (_selectedType == null)
+                _recordScroll = EditorGUILayout.BeginScrollView(_recordScroll);
+                if (descriptor == null)
                 {
                     EditorGUILayout.LabelField("Select a document type.");
                 }
                 else
                 {
-                    foreach (var record in RecordsFor(_selectedType))
+                    var records = _model.RecordCandidates(typeof(CultRecordRef<>).MakeGenericType(_selectedType), _records);
+                    if (descriptor.IsGlobal && records.Count == 0)
                     {
-                        var style = string.Equals(_selectedKey, record.Key, StringComparison.Ordinal)
-                            ? EditorStyles.toolbarButton
-                            : EditorStyles.miniButton;
-                        if (GUILayout.Button(GetRecordLabel(record), style))
+                        using (new EditorGUILayout.HorizontalScope())
                         {
-                            _selectedKey = record.Key;
+                            EditorGUILayout.LabelField("Global is absent.");
+                            using (new EditorGUI.DisabledScope(cannotAdd))
+                            {
+                                if (GUILayout.Button("Create", GUILayout.Width(56))) Add();
+                            }
                         }
                     }
+
+                    foreach (var record in records)
+                    {
+                        var label = CultInspectorModel.RecordLabel(record);
+                        var text = record.Descriptor.DocumentType == _selectedType ? label : label + "  <" + record.Descriptor.DocumentType.Name + ">";
+                        if (GUILayout.Toggle(_selectedKey == record.Key.Value, text, EditorStyles.miniButton)) _selectedKey = record.Key.Value;
+                    }
                 }
 
                 EditorGUILayout.EndScrollView();
             }
         }
 
-        private void DrawInspectorColumn()
+        private void DrawInspector()
         {
-            using (new EditorGUILayout.VerticalScope(GUILayout.ExpandWidth(true), GUILayout.ExpandHeight(true)))
+            using (new EditorGUILayout.VerticalScope(GUILayout.ExpandWidth(true)))
             {
-                var record = SelectedRecord();
-                using (new EditorGUILayout.HorizontalScope())
-                {
-                    EditorGUILayout.LabelField("Inspector", EditorStyles.boldLabel);
-                    using (new EditorGUI.DisabledScope(record == null))
-                    {
-                        if (GUILayout.Button("Delete", GUILayout.Width(64)))
-                        {
-                            DeleteSelectedRecord();
-                            return;
-                        }
-                    }
-                }
-
-                _inspectorScroll = EditorGUILayout.BeginScrollView(_inspectorScroll, GUI.skin.box);
+                var record = Selected();
                 if (record == null)
                 {
                     EditorGUILayout.LabelField("Select a record.");
-                    EditorGUILayout.EndScrollView();
                     return;
                 }
 
-                EditorGUILayout.SelectableLabel(record.Descriptor.SchemaName, EditorStyles.boldLabel, GUILayout.Height(EditorGUIUtility.singleLineHeight));
-                EditorGUILayout.SelectableLabel("Key: " + record.Key, EditorStyles.miniLabel, GUILayout.Height(EditorGUIUtility.singleLineHeight));
-                EditorGUILayout.SelectableLabel("Stored: " + record.StoredAt, EditorStyles.miniLabel, GUILayout.Height(EditorGUIUtility.singleLineHeight));
-                EditorGUILayout.Space(8);
+                EditorGUILayout.LabelField(record.Descriptor.SchemaName + "  " + record.Descriptor.DocumentType.Name, EditorStyles.boldLabel);
+                EditorGUILayout.SelectableLabel("Key " + record.Key.Value + "   Stored " + record.StoredAt, EditorStyles.miniLabel, GUILayout.Height(EditorGUIUtility.singleLineHeight));
+                _inspectorScroll = EditorGUILayout.BeginScrollView(_inspectorScroll);
 
-                EditorGUI.BeginChangeCheck();
-                DrawDocument(record.Document, record.Descriptor.DocumentType, record.Descriptor.SchemaName);
-                if (EditorGUI.EndChangeCheck())
+                // Drawers edit the edit's private copy. A commit spends the edit, admitted or refused, and the next frame
+                // begins a new one from whatever record the cache then holds. The copy is held here and kept only by a frame
+                // that drew to the end with no drawer failing: a claimed drawer that threw, a built-in drawing exception, or
+                // an ExitGUIException all leave _edit null, so a half-made in-place mutation is never committed later.
+                var edit = _edit != null && _edit.IsFor(record) ? _edit : _model.BeginEdit(record);
+                _edit = null;
+                var readOnly = ReadOnly;
+                using (new EditorGUI.DisabledScope(readOnly))
                 {
-                    UpsertRecord(record);
+                    EditorGUI.BeginChangeCheck();
+                    var drawn = _inspector.DrawDocument(edit);
+                    var changed = EditorGUI.EndChangeCheck();
+                    if (drawn)
+                    {
+                        _edit = edit;
+                        if (changed && !readOnly && !edit.Commit(_cache, out var error)) SetStatus(error, MessageType.Error);
+                    }
                 }
 
                 EditorGUILayout.EndScrollView();
             }
         }
 
-        private IEnumerable<DescriptorInfo> FilteredDescriptors()
+        private CultStoredDocument Selected()
         {
-            var descriptors = CultCacheBridge.GetDescriptors(_cache);
-            if (string.IsNullOrWhiteSpace(_search))
+            return _selectedKey == null ? null : _records.FirstOrDefault(r => r.Key.Value == _selectedKey);
+        }
+
+        // Dialogs start in the last store's folder, or the project root; never under Assets.
+        private void Browse(bool create)
+        {
+            if (!ConfirmDiscard()) return;
+            var last = string.IsNullOrEmpty(_path) ? null : Path.GetDirectoryName(FullPathOrNull(_path) ?? string.Empty);
+            var directory = !string.IsNullOrEmpty(last) && Directory.Exists(last) && !InsideAssets(last) ? last : ProjectRoot;
+            var path = create
+                ? EditorUtility.SaveFilePanel("New CultCache store", directory, "GameData", "cc")
+                : EditorUtility.OpenFilePanel("Open CultCache store", directory, _directory ? "" : "cc");
+            if (!string.IsNullOrEmpty(path)) OpenStore(path, create);
+            GUIUtility.ExitGUI();
+        }
+
+        // New writes an empty single-file store outside Assets and never touches an existing path; directory stores and
+        // read-only opens are refused because neither writes a store on creation. Game data never lives under Assets:
+        // Unity would import and manage it, and CultCache exists so Unity does not manage game data.
+        private void OpenStore(string path, bool create)
+        {
+            var exists = File.Exists(path) || Directory.Exists(DirectoryMessagePackBackingStore.DefaultRecordDirectoryPath(path));
+            var insideAssets = InsideAssets(path);
+            string refusal = null;
+            if (create && (_readOnly || _directory))
+                refusal = "New creates writable single-file stores only; turn off Read Only and Directory. Nothing was created.";
+            else if (create && insideAssets)
+                refusal = "New refuses " + path + ": game data does not live under Assets, where Unity imports and manages files, and CultCache exists so Unity does not manage game data. Choose a folder outside " + Application.dataPath + ". Nothing was created.";
+            else if (create && exists)
+                refusal = path + " already exists; nothing was created or replaced. Use Open to edit it.";
+            else if (!create && !File.Exists(path))
+                refusal = "No store at " + path + ".";
+            if (refusal != null)
             {
-                return descriptors;
-            }
-
-            return descriptors.Where(descriptor =>
-                descriptor.SchemaName.IndexOf(_search, StringComparison.OrdinalIgnoreCase) >= 0 ||
-                descriptor.DocumentType.Name.IndexOf(_search, StringComparison.OrdinalIgnoreCase) >= 0);
-        }
-
-        private IEnumerable<RecordInfo> RecordsFor(Type type)
-        {
-            return CultCacheBridge.GetStoredDocuments(_cache)
-                .Where(record => type.IsAssignableFrom(record.Descriptor.DocumentType))
-                .OrderBy(GetRecordLabel, StringComparer.Ordinal);
-        }
-
-        private RecordInfo SelectedRecord()
-        {
-            if (_cache == null || string.IsNullOrEmpty(_selectedKey))
-            {
-                return null;
-            }
-
-            return CultCacheBridge.GetStoredDocuments(_cache)
-                .FirstOrDefault(record => string.Equals(record.Key, _selectedKey, StringComparison.Ordinal));
-        }
-
-        private string GetRecordLabel(RecordInfo record)
-        {
-            var namedMember = record.Descriptor.Members.FirstOrDefault(member => member.IsName);
-            if (namedMember != null)
-            {
-                var member = FindInspectableMember(record.Descriptor.DocumentType, namedMember.MemberName);
-                if (member != null)
-                {
-                    var value = member.GetValue(record.Document);
-                    if (value != null && !string.IsNullOrWhiteSpace(value.ToString()))
-                    {
-                        return value + " [" + record.Key + "]";
-                    }
-                }
-            }
-
-            return record.Key;
-        }
-
-        private void DrawDocument(object target, Type type, string path)
-        {
-            foreach (var member in GetInspectableMembers(type))
-            {
-                if (member.GetCustomAttribute<CultInspectorHiddenAttribute>() != null)
-                {
-                    continue;
-                }
-
-                var current = member.GetValue(target);
-                var readOnly = member.GetCustomAttribute<CultInspectorReadOnlyAttribute>() != null || member.IsReadOnly;
-                using (new EditorGUI.DisabledScope(readOnly))
-                {
-                    var next = DrawValue(GetLabel(member), member.MemberType, current, member, path + "." + member.Name);
-                    if (!readOnly && !Equals(current, next))
-                    {
-                        member.SetValue(target, next);
-                    }
-                }
-            }
-        }
-
-        private object DrawValue(string label, Type type, object value, InspectableMember member, string path)
-        {
-            if (type == typeof(string)) return DrawString(label, value as string, member);
-            if (type == typeof(int))
-            {
-                var range = member.GetCustomAttribute<CultInspectorRangeAttribute>();
-                return range == null
-                    ? EditorGUILayout.IntField(label, value == null ? 0 : (int)value)
-                    : EditorGUILayout.IntSlider(label, value == null ? 0 : (int)value, Mathf.RoundToInt(range.Min), Mathf.RoundToInt(range.Max));
-            }
-
-            if (type == typeof(uint)) return (uint)Math.Max(0L, EditorGUILayout.LongField(label, value == null ? 0L : Convert.ToInt64(value, CultureInfo.InvariantCulture)));
-            if (type == typeof(long)) return EditorGUILayout.LongField(label, value == null ? 0L : (long)value);
-            if (type == typeof(float))
-            {
-                var range = member.GetCustomAttribute<CultInspectorRangeAttribute>();
-                return range == null
-                    ? EditorGUILayout.FloatField(label, value == null ? 0f : (float)value)
-                    : EditorGUILayout.Slider(label, value == null ? 0f : (float)value, range.Min, range.Max);
-            }
-
-            if (type == typeof(double)) return EditorGUILayout.DoubleField(label, value == null ? 0d : (double)value);
-            if (type == typeof(bool)) return EditorGUILayout.Toggle(label, value != null && (bool)value);
-            if (type.IsEnum) return EditorGUILayout.EnumPopup(label, value == null ? (Enum)Enum.GetValues(type).GetValue(0) : (Enum)value);
-            if (type == typeof(Vector2)) return EditorGUILayout.Vector2Field(label, value == null ? Vector2.zero : (Vector2)value);
-            if (type == typeof(Vector3)) return EditorGUILayout.Vector3Field(label, value == null ? Vector3.zero : (Vector3)value);
-            if (type == typeof(Color)) return EditorGUILayout.ColorField(label, value == null ? Color.white : (Color)value);
-            if (typeof(Object).IsAssignableFrom(type)) return EditorGUILayout.ObjectField(label, value as Object, type, false);
-            if (CultCacheBridge.IsCultRecordRef(type)) return CultCacheBridge.DrawRecordRef(label, type, value);
-            if (type.IsArray || typeof(IList).IsAssignableFrom(type)) return DrawList(label, type, value, member, path);
-            if (type.IsClass || IsMutableStruct(type)) return DrawNestedObject(label, type, value, path);
-
-            using (new EditorGUI.DisabledScope(true))
-            {
-                EditorGUILayout.TextField(label, value == null ? string.Empty : value.ToString());
-            }
-
-            return value;
-        }
-
-        private string DrawString(string label, string value, InspectableMember member)
-        {
-            var assetPath = member.GetCustomAttribute<CultInspectorAssetPathAttribute>();
-            if (assetPath != null)
-            {
-                var assetType = assetPath.AssetType == null || !typeof(Object).IsAssignableFrom(assetPath.AssetType)
-                    ? typeof(Object)
-                    : assetPath.AssetType;
-                var asset = string.IsNullOrEmpty(value) ? null : AssetDatabase.LoadAssetAtPath(value, assetType);
-                var nextAsset = EditorGUILayout.ObjectField(label, asset, assetType, false);
-                return nextAsset == null ? string.Empty : AssetDatabase.GetAssetPath(nextAsset);
-            }
-
-            var textArea = member.GetCustomAttribute<CultInspectorTextAreaAttribute>();
-            if (textArea != null)
-            {
-                EditorGUILayout.LabelField(label);
-                return EditorGUILayout.TextArea(value ?? string.Empty, GUILayout.MinHeight(Mathf.Max(textArea.MinLines, 1) * EditorGUIUtility.singleLineHeight));
-            }
-
-            return EditorGUILayout.TextField(label, value ?? string.Empty);
-        }
-
-        private object DrawList(string label, Type type, object value, InspectableMember member, string path)
-        {
-            if (!Foldout(path, label)) return value;
-
-            var elementType = GetListElementType(type);
-            var list = ToMutableList(elementType, value);
-            EditorGUI.indentLevel++;
-            var size = Mathf.Max(0, EditorGUILayout.IntField("Size", list.Count));
-            while (list.Count < size) list.Add(CreateDefaultValue(elementType));
-            while (list.Count > size) list.RemoveAt(list.Count - 1);
-
-            for (var index = 0; index < list.Count; index++)
-            {
-                using (new EditorGUILayout.HorizontalScope())
-                {
-                    list[index] = DrawValue("Element " + index.ToString(CultureInfo.InvariantCulture), elementType, list[index], member, path + "[" + index.ToString(CultureInfo.InvariantCulture) + "]");
-                    if (GUILayout.Button("-", GUILayout.Width(24)))
-                    {
-                        list.RemoveAt(index);
-                        index--;
-                    }
-                }
-            }
-
-            if (GUILayout.Button("Add " + elementType.Name)) list.Add(CreateDefaultValue(elementType));
-            EditorGUI.indentLevel--;
-            return FromMutableList(type, elementType, list);
-        }
-
-        private object DrawNestedObject(string label, Type type, object value, string path)
-        {
-            var expanded = Foldout(path, label);
-            if (value == null && type.GetConstructor(Type.EmptyTypes) != null) value = Activator.CreateInstance(type);
-            if (!expanded || value == null) return value;
-            EditorGUI.indentLevel++;
-            DrawDocument(value, type, path);
-            EditorGUI.indentLevel--;
-            return value;
-        }
-
-        private bool Foldout(string key, string label)
-        {
-            bool expanded;
-            _foldouts.TryGetValue(key, out expanded);
-            expanded = EditorGUILayout.Foldout(expanded, label, true);
-            _foldouts[key] = expanded;
-            return expanded;
-        }
-
-        private IEnumerable<InspectableMember> GetInspectableMembers(Type type)
-        {
-            var descriptor = CultCacheBridge.GetDescriptor(_cache, type);
-            var byName = descriptor.Members.ToDictionary(member => member.MemberName, StringComparer.Ordinal);
-            return type.GetMembers(BindingFlags.Instance | BindingFlags.Public | BindingFlags.NonPublic)
-                .Select(InspectableMember.TryCreate)
-                .Where(member => member != null && byName.ContainsKey(member.Name))
-                .OrderBy(member => member.GetCustomAttribute<CultInspectorOrderAttribute>() == null
-                    ? byName[member.Name].Slot
-                    : member.GetCustomAttribute<CultInspectorOrderAttribute>().Order)
-                .ThenBy(member => byName[member.Name].Slot)
-                .ThenBy(member => member.Name, StringComparer.Ordinal);
-        }
-
-        private static InspectableMember FindInspectableMember(Type type, string name)
-        {
-            return type.GetMembers(BindingFlags.Instance | BindingFlags.Public | BindingFlags.NonPublic)
-                .Select(InspectableMember.TryCreate)
-                .FirstOrDefault(member => member != null && string.Equals(member.Name, name, StringComparison.Ordinal));
-        }
-
-        private static string GetLabel(InspectableMember member)
-        {
-            var label = member.GetCustomAttribute<CultInspectorLabelAttribute>();
-            return label == null || string.IsNullOrWhiteSpace(label.Label)
-                ? ObjectNames.NicifyVariableName(member.Name)
-                : label.Label;
-        }
-
-        private static Type GetListElementType(Type type)
-        {
-            if (type.IsArray) return type.GetElementType();
-            return type.IsGenericType ? type.GetGenericArguments()[0] : typeof(object);
-        }
-
-        private static IList ToMutableList(Type elementType, object value)
-        {
-            var result = (IList)Activator.CreateInstance(typeof(List<>).MakeGenericType(elementType));
-            var source = value as IEnumerable;
-            if (source != null)
-            {
-                foreach (var item in source) result.Add(item);
-            }
-
-            return result;
-        }
-
-        private static object FromMutableList(Type listType, Type elementType, IList list)
-        {
-            if (listType.IsArray)
-            {
-                var array = Array.CreateInstance(elementType, list.Count);
-                for (var index = 0; index < list.Count; index++) array.SetValue(list[index], index);
-                return array;
-            }
-
-            if (listType.IsAssignableFrom(list.GetType())) return list;
-            var target = listType.GetConstructor(Type.EmptyTypes) == null ? null : Activator.CreateInstance(listType) as IList;
-            if (target == null) return list;
-            foreach (var item in list) target.Add(item);
-            return target;
-        }
-
-        private static object CreateDefaultValue(Type type)
-        {
-            if (type == typeof(string)) return string.Empty;
-            if (type.IsValueType) return Activator.CreateInstance(type);
-            return type.GetConstructor(Type.EmptyTypes) == null ? null : Activator.CreateInstance(type);
-        }
-
-        private static bool IsMutableStruct(Type type)
-        {
-            return type.IsValueType && !type.IsPrimitive && !type.IsEnum;
-        }
-
-        private void BrowseAndOpen()
-        {
-            var start = string.IsNullOrEmpty(_path) ? Application.dataPath : Path.GetDirectoryName(_path);
-            var selected = EditorUtility.OpenFilePanel("Open CultCache", start, "cc");
-            if (!string.IsNullOrEmpty(selected))
-            {
-                _path = selected;
-                OpenPath(true);
-            }
-        }
-
-        private void BrowseAndCreate()
-        {
-            var start = string.IsNullOrEmpty(_path) ? Application.dataPath : Path.GetDirectoryName(_path);
-            var selected = EditorUtility.SaveFilePanel("Create CultCache", start, "GameData", "cc");
-            if (!string.IsNullOrEmpty(selected))
-            {
-                _path = selected;
-                OpenPath(false);
-                SaveCurrent();
-            }
-        }
-
-        private void OpenPath(bool pullOnOpen)
-        {
-            try
-            {
-                _cache = CultCacheBridge.Open(_path, pullOnOpen);
-                _selectedType = CultCacheBridge.GetDescriptors(_cache).FirstOrDefault()?.DocumentType;
-                _selectedKey = string.Empty;
-                EditorPrefs.SetString(LastPathKey, _path);
-                SetStatus("Opened " + _path, MessageType.Info);
-            }
-            catch (Exception ex)
-            {
-                _cache = null;
-                SetStatus("Failed to open CultCache: " + ex.GetBaseException().Message, MessageType.Error);
-            }
-        }
-
-        private void ReloadCurrent()
-        {
-            if (string.IsNullOrWhiteSpace(_path))
-            {
-                SetStatus("No .cc path selected.", MessageType.Warning);
+                SetStatus(refusal, MessageType.Error);
                 return;
             }
 
-            OpenPath(true);
+            CloseStore();
+            try
+            {
+                _cache = CultCacheMessagePack.Create(path, new CultCacheOpenOptions { ReadOnly = !create && _readOnly, UseDirectoryStore = !create && _directory });
+                if (create)
+                {
+                    _cache.BackingStores[0].PushAll();
+                    if (!File.Exists(path)) throw new IOException("the store wrote no file");
+                }
+
+                _model = CultCacheMessagePack.CreateInspectorModel(_cache.Registry);
+                _inspector = new CultInspector(_model);
+                _path = path;
+                EditorPrefs.SetString(LastPathKey, path);
+                var opened = (create ? "Created " : "Opened ") + path + (_cache.BackingStores[0] is DirectoryMessagePackBackingStore ? " (directory store)." : ".");
+                if (insideAssets)
+                    SetStatus(opened + " This store is under Assets, where Unity imports and manages files; game data belongs outside Assets.", MessageType.Warning);
+                else
+                    SetStatus(opened, MessageType.Info);
+            }
+            catch (Exception exception)
+            {
+                CloseStore();
+                SetStatus("Failed to open " + path + ": " + exception.GetBaseException().Message, MessageType.Error);
+            }
         }
 
-        private void SaveCurrent()
+        private static bool InsideAssets(string path)
+        {
+            var full = FullPathOrNull(path);
+            var assets = FullPathOrNull(Application.dataPath)?.TrimEnd(Path.DirectorySeparatorChar, Path.AltDirectorySeparatorChar);
+            return full != null && assets != null &&
+                   (full.Equals(assets, StringComparison.OrdinalIgnoreCase) ||
+                    full.StartsWith(assets + Path.DirectorySeparatorChar, StringComparison.OrdinalIgnoreCase));
+        }
+
+        private static string FullPathOrNull(string path)
         {
             try
             {
-                CultCacheBridge.Flush(_cache);
-                SetStatus("Saved " + _path, MessageType.Info);
+                return Path.GetFullPath(path);
             }
-            catch (Exception ex)
+            catch (Exception)
             {
-                SetStatus("Failed to save CultCache: " + ex.GetBaseException().Message, MessageType.Error);
+                return null;
             }
         }
 
-        private void AddSelectedTypeRecord()
+        private void CloseStore()
+        {
+            _cache?.Dispose();
+            _cache = null;
+            _model = null;
+            _inspector = null;
+            _edit = null;
+            _records = Array.Empty<CultStoredDocument>();
+            _selectedKey = null;
+        }
+
+        private bool ConfirmDiscard()
+        {
+            return _cache == null || !_cache.IsDirty ||
+                   EditorUtility.DisplayDialog("CultCache Studio", "Discard unsaved changes to " + _path + "?", "Discard", "Cancel");
+        }
+
+        private void Save()
+        {
+            Run("Saved " + _path + ".", () => _cache.FlushAsync().GetAwaiter().GetResult());
+        }
+
+        private void Add()
+        {
+            var type = _selectedType;
+            // The model decides whether the type can be made; its notice is the refusal.
+            Run("Added " + type.Name + ".", () => _selectedKey = _cache.UpsertAsync(type,
+                _model.CreateElement(type, type, out var notice) ?? throw new InvalidOperationException(notice)).GetAwaiter().GetResult().Value);
+            GUIUtility.ExitGUI();
+        }
+
+        private void Duplicate(CultStoredDocument record)
+        {
+            var type = record.Descriptor.DocumentType;
+            Run("Duplicated " + CultInspectorModel.RecordLabel(record) + ".", () =>
+                _selectedKey = _cache.UpsertAsync(type, _model.Clone(record.Document, type)).GetAwaiter().GetResult().Value);
+            GUIUtility.ExitGUI();
+        }
+
+        private void Delete(CultStoredDocument record)
+        {
+            var label = CultInspectorModel.RecordLabel(record);
+            if (!EditorUtility.DisplayDialog("CultCache Studio", "Delete " + label + "?", "Delete", "Cancel")) return;
+            Run("Deleted " + label + ".", () =>
+            {
+                _cache.Remove(record.Key);
+                _selectedKey = null;
+            });
+            GUIUtility.ExitGUI();
+        }
+
+        private void Run(string success, Action action)
         {
             try
             {
-                var document = Activator.CreateInstance(_selectedType);
-                _selectedKey = CultCacheBridge.Upsert(_cache, _selectedType, document, null);
-                SetStatus("Added " + _selectedType.Name + ".", MessageType.Info);
+                action();
+                if (success != null) SetStatus(success, MessageType.Info);
             }
-            catch (Exception ex)
+            catch (Exception exception)
             {
-                SetStatus("Failed to add record: " + ex.GetBaseException().Message, MessageType.Error);
-            }
-        }
-
-        private void DeleteSelectedRecord()
-        {
-            if (string.IsNullOrEmpty(_selectedKey)) return;
-            if (!EditorUtility.DisplayDialog("Delete CultCache Record", "Delete record " + _selectedKey + "?", "Delete", "Cancel")) return;
-            if (CultCacheBridge.Remove(_cache, _selectedKey))
-            {
-                _selectedKey = string.Empty;
-                SetStatus("Deleted record.", MessageType.Info);
-            }
-        }
-
-        private void UpsertRecord(RecordInfo record)
-        {
-            try
-            {
-                CultCacheBridge.Upsert(_cache, record.Descriptor.DocumentType, record.Document, record.Key);
-                SetStatus("Edited " + record.Descriptor.SchemaName + ". Save to persist.", MessageType.Info);
-            }
-            catch (Exception ex)
-            {
-                SetStatus("Failed to apply edit: " + ex.GetBaseException().Message, MessageType.Error);
+                SetStatus(exception.GetBaseException().Message, MessageType.Error);
             }
         }
 
@@ -618,230 +385,5 @@ namespace GameCult.Unity.Caching.Editor
             _statusType = type;
             Repaint();
         }
-
-        private sealed class InspectableMember
-        {
-            private readonly FieldInfo _field;
-            private readonly PropertyInfo _property;
-
-            private InspectableMember(FieldInfo field)
-            {
-                _field = field;
-                Name = field.Name;
-                MemberType = field.FieldType;
-                IsReadOnly = field.IsInitOnly || field.IsLiteral;
-            }
-
-            private InspectableMember(PropertyInfo property)
-            {
-                _property = property;
-                Name = property.Name;
-                MemberType = property.PropertyType;
-                IsReadOnly = property.GetSetMethod(true) == null;
-            }
-
-            public string Name { get; }
-            public Type MemberType { get; }
-            public bool IsReadOnly { get; }
-
-            public static InspectableMember TryCreate(MemberInfo member)
-            {
-                var field = member as FieldInfo;
-                if (field != null && !field.IsStatic) return new InspectableMember(field);
-                var property = member as PropertyInfo;
-                return property != null && property.GetIndexParameters().Length == 0 && property.GetGetMethod(true) != null
-                    ? new InspectableMember(property)
-                    : null;
-            }
-
-            public T GetCustomAttribute<T>() where T : Attribute
-            {
-                return _field != null ? _field.GetCustomAttribute<T>(true) : _property.GetCustomAttribute<T>(true);
-            }
-
-            public object GetValue(object target)
-            {
-                return _field != null ? _field.GetValue(target) : _property.GetValue(target, null);
-            }
-
-            public void SetValue(object target, object value)
-            {
-                if (_field != null) _field.SetValue(target, value);
-                else _property.SetValue(target, value, null);
-            }
-        }
-
-        private static class CultCacheBridge
-        {
-            private static readonly Type CacheType = FindType("GameCult.Caching.CultCache");
-            private static readonly Type OpenOptionsType = FindType("GameCult.Caching.MessagePack.CultCacheOpenOptions");
-            private static readonly Type MessagePackType = FindType("GameCult.Caching.MessagePack.CultCacheMessagePack");
-            private static readonly Type RecordKeyType = FindType("GameCult.Caching.CultRecordKey");
-
-            public static bool IsAvailable => CacheType != null && OpenOptionsType != null && MessagePackType != null && RecordKeyType != null;
-
-            public static object Open(string path, bool pullOnOpen)
-            {
-                EnsureAvailable();
-                var options = Activator.CreateInstance(OpenOptionsType);
-                OpenOptionsType.GetProperty("PullOnOpen").SetValue(options, pullOnOpen, null);
-                var method = MessagePackType.GetMethod("OpenAsync", new[] { typeof(string), OpenOptionsType });
-                var task = (Task)method.Invoke(null, new[] { path, options });
-                task.GetAwaiter().GetResult();
-                return task.GetType().GetProperty("Result").GetValue(task, null);
-            }
-
-            public static bool IsDirty(object cache)
-            {
-                return cache != null && (bool)CacheType.GetProperty("IsDirty").GetValue(cache, null);
-            }
-
-            public static IEnumerable<DescriptorInfo> GetDescriptors(object cache)
-            {
-                if (cache == null) return Enumerable.Empty<DescriptorInfo>();
-                var registry = CacheType.GetProperty("Registry").GetValue(cache, null);
-                var descriptors = (IEnumerable)registry.GetType().GetProperty("AllDescriptors").GetValue(registry, null);
-                return descriptors.Cast<object>().Select(DescriptorInfo.From).ToArray();
-            }
-
-            public static DescriptorInfo GetDescriptor(object cache, Type documentType)
-            {
-                var registry = CacheType.GetProperty("Registry").GetValue(cache, null);
-                var method = registry.GetType().GetMethod("GetRequired", new[] { typeof(Type) });
-                return DescriptorInfo.From(method.Invoke(registry, new object[] { documentType }));
-            }
-
-            public static IEnumerable<RecordInfo> GetStoredDocuments(object cache)
-            {
-                if (cache == null) return Enumerable.Empty<RecordInfo>();
-                var records = (IEnumerable)CacheType.GetProperty("AllStoredDocuments").GetValue(cache, null);
-                return records.Cast<object>().Select(RecordInfo.From).ToArray();
-            }
-
-            public static string Upsert(object cache, Type documentType, object document, string key)
-            {
-                var method = CacheType.GetMethod("UpsertAsync", new[] { typeof(Type), typeof(object), typeof(Nullable<>).MakeGenericType(RecordKeyType) });
-                var keyObject = string.IsNullOrEmpty(key) ? null : CreateRecordKey(key);
-                var task = (Task)method.Invoke(cache, new[] { documentType, document, keyObject });
-                task.GetAwaiter().GetResult();
-                var result = task.GetType().GetProperty("Result").GetValue(task, null);
-                return GetKeyValue(result);
-            }
-
-            public static bool Remove(object cache, string key)
-            {
-                var method = CacheType.GetMethod("Remove", new[] { RecordKeyType });
-                return (bool)method.Invoke(cache, new[] { CreateRecordKey(key) });
-            }
-
-            public static void Flush(object cache)
-            {
-                var method = CacheType.GetMethod("FlushAsync", new[] { typeof(bool) });
-                var task = (Task)method.Invoke(cache, new object[] { false });
-                task.GetAwaiter().GetResult();
-            }
-
-            public static bool IsCultRecordRef(Type type)
-            {
-                return type.IsGenericType && type.GetGenericTypeDefinition().FullName == "GameCult.Caching.CultRecordRef`1";
-            }
-
-            public static object DrawRecordRef(string label, Type type, object value)
-            {
-                var keyProperty = type.GetProperty("Key");
-                var currentKey = keyProperty == null || value == null ? string.Empty : GetKeyValue(keyProperty.GetValue(value, null));
-                var nextKey = EditorGUILayout.TextField(label, currentKey);
-                return string.Equals(currentKey, nextKey, StringComparison.Ordinal)
-                    ? value
-                    : Activator.CreateInstance(type, CreateRecordKey(nextKey));
-            }
-
-            private static object CreateRecordKey(string key)
-            {
-                return Activator.CreateInstance(RecordKeyType, key ?? string.Empty);
-            }
-
-            private static string GetKeyValue(object key)
-            {
-                return key == null ? string.Empty : (string)RecordKeyType.GetProperty("Value").GetValue(key, null);
-            }
-
-            private static void EnsureAvailable()
-            {
-                if (!IsAvailable)
-                {
-                    throw new InvalidOperationException("GameCult.Caching and GameCult.Caching.MessagePack are not loaded.");
-                }
-            }
-
-            private static Type FindType(string fullName)
-            {
-                return AppDomain.CurrentDomain.GetAssemblies()
-                    .Where(assembly => !assembly.IsDynamic)
-                    .Select(assembly => assembly.GetType(fullName, false))
-                    .FirstOrDefault(type => type != null);
-            }
-        }
-
-        private sealed class DescriptorInfo
-        {
-            public object Raw;
-            public Type DocumentType;
-            public string SchemaName;
-            public CatalogMemberInfo[] Members;
-
-            public static DescriptorInfo From(object raw)
-            {
-                var type = raw.GetType();
-                var catalog = type.GetMethod("ToCatalogEntry").Invoke(raw, null);
-                var members = (IEnumerable)catalog.GetType().GetProperty("Members").GetValue(catalog, null);
-                return new DescriptorInfo
-                {
-                    Raw = raw,
-                    DocumentType = (Type)type.GetProperty("DocumentType").GetValue(raw, null),
-                    SchemaName = (string)type.GetProperty("SchemaName").GetValue(raw, null),
-                    Members = members.Cast<object>().Select(CatalogMemberInfo.From).ToArray()
-                };
-            }
-        }
-
-        private sealed class CatalogMemberInfo
-        {
-            public string MemberName;
-            public int Slot;
-            public bool IsName;
-
-            public static CatalogMemberInfo From(object raw)
-            {
-                var type = raw.GetType();
-                return new CatalogMemberInfo
-                {
-                    MemberName = (string)type.GetProperty("MemberName").GetValue(raw, null),
-                    Slot = (int)type.GetProperty("Slot").GetValue(raw, null),
-                    IsName = (bool)type.GetProperty("IsName").GetValue(raw, null)
-                };
-            }
-        }
-
-        private sealed class RecordInfo
-        {
-            public string Key;
-            public string StoredAt;
-            public DescriptorInfo Descriptor;
-            public object Document;
-
-            public static RecordInfo From(object raw)
-            {
-                var type = raw.GetType();
-                var key = type.GetProperty("Key").GetValue(raw, null);
-                return new RecordInfo
-                {
-                    Key = (string)key.GetType().GetProperty("Value").GetValue(key, null),
-                    StoredAt = (string)type.GetProperty("StoredAt").GetValue(raw, null),
-                    Descriptor = DescriptorInfo.From(type.GetProperty("Descriptor").GetValue(raw, null)),
-                    Document = type.GetProperty("Document").GetValue(raw, null)
-                };
-            }
-        }
     }
 }
diff --git a/src/GameCult.Unity/Assets/Caching/Editor/GameCult.Unity.Caching.Editor.asmdef b/src/GameCult.Unity/Assets/Caching/Editor/GameCult.Unity.Caching.Editor.asmdef
index be5589c6..0a5b140d 100644
--- a/src/GameCult.Unity/Assets/Caching/Editor/GameCult.Unity.Caching.Editor.asmdef
+++ b/src/GameCult.Unity/Assets/Caching/Editor/GameCult.Unity.Caching.Editor.asmdef
@@ -2,7 +2,7 @@
     "name": "GameCult.Unity.Caching.Editor",
     "rootNamespace": "GameCult.Unity.Caching.Editor",
     "references": [
-        "GameCult.Unity.Caching"
+        "GameCult.CultLib"
     ],
     "includePlatforms": [
         "Editor"
diff --git a/src/GameCult.Unity/Assets/Caching/README.md b/src/GameCult.Unity/Assets/Caching/README.md
index 84b24084..a5ea3d92 100644
--- a/src/GameCult.Unity/Assets/Caching/README.md
+++ b/src/GameCult.Unity/Assets/Caching/README.md
@@ -1,35 +1,129 @@
 # GameCult CultCache Unity Tools
 
-`org.gamecult.caching.unity` provides Unity editor tooling for opening,
-inspecting, editing, and saving CultCache `.cc` stores.
+`org.gamecult.caching.unity` is the Unity editor surface over CultCache: open a
+store, browse its documents, edit them, save.
 
-The package is intentionally a Unity editor surface over `GameCult.Caching`.
-CultCache owns document identity, schema descriptors, persistence, dirty state,
-and flush behavior. The editor window owns selection, presentation, and edit
-commands.
+CultCache owns document identity, schema descriptors, persistence, dirty state
+and flush. `CultInspectorModel` (in `GameCult.Caching`) owns what an inspector
+shows and which edits it may make. The Studio window owns selection, the
+toolbar and IMGUI widgets. It references `GameCult.Caching` and
+`GameCult.Caching.MessagePack` at compile time through the
+`org.gamecult.cultlib` package (assembly `GameCult.CultLib`).
 
 ## Use
 
-1. Reference `GameCult.Caching`, `GameCult.Caching.MessagePack`, and this UPM
-   package from the Unity project that declares your `[CultDocument]` classes.
-2. Open Unity's `GameCult/CultCache Studio` menu.
-3. Open or create a `.cc` file.
-4. Select a document type, select a record, edit fields, then save explicitly.
+1. Add this package; it depends on `org.gamecult.cultlib`.
+2. Open `GameCult/CultCache Studio`.
+3. `Open` a `.cc` store. `Directory` opens a directory store (a manifest beside
+   its `.records` folder; an existing one is detected without the toggle).
+   `Read Only` opens the store read-only. `New` creates an empty writable
+   single-file store; it is disabled while `Read Only` or `Directory` is on and
+   refuses a path that already exists.
+4. Pick a document type, then a record. Edits upsert into the cache as you make
+   them; the toolbar shows `Dirty` until `Save` flushes the store.
 
-The editor discovers registered CultCache document descriptors from the same
-registry used by runtime code. It does not require document classes to inherit
-from Unity types or storage base classes.
+Game data stores do not live under the project's `Assets` folder: Unity would
+import and manage them, and CultCache exists so Unity does not manage game
+data. `New` refuses a path under `Assets`, `Open` warns about one, and the file
+dialogs start in the last store's folder or the project root.
+
+Document types come from the cache's `CultDocumentRegistry`. A type lists its
+own records and those of its subclasses, by `[CultName]` with the key as
+fallback. `Add`, `Duplicate` and `Delete` act on the selected type and record.
+A `[CultGlobal]` type with no record shows as absent with a `Create` action; the
+Studio never creates one on its own.
+
+Opening a store never writes it, directory stores included. Closing or
+reloading scripts drops unsaved edits.
+
+## Inspection Model
+
+`CultInspectorModel` is engine-free and lives beside the inspector attributes
+in `GameCult.Caching`; `CultCacheMessagePack.CreateInspectorModel` builds it
+over a `.cc` store's codec. It gives the member list of a type (registry
+catalog slots, `CultInspector*` metadata, whether a member is assignable), the
+shape of any value (string, integer, float, bool, enum, `CultRecordRef<T>` with
+its candidate records, rank-1 list or array, dictionary, `[Union]` with only
+its declared subtypes, nested keyed object, struct edited in place through its
+public fields, or its settable properties when it has none, or unsupported with a reason), drawer claim resolution
+(`CultInspectorDrawerClaims`), and the edit decisions: the key a dictionary
+entry keeps and the notice when a key is refused (null, an empty record
+reference, a duplicate: serialized the same as another key under the owning
+document's serializer or equal by the rebuilt dictionary type's default
+comparer, or a key that document cannot serialize), the fresh key an added entry gets, what a new list
+element, dictionary value or union pick may be, and how an integer edit clamps
+to its type. Edits work on a copy (`CultInspectorEdit`): a refused upsert
+leaves the cached object unchanged. The Studio is one lowering of that model
+and owns only widgets and layout; a runtime CultUI panel needs only its own
+renderer and drawers to show and edit the same documents under the same rules.
+
+## Drawers
+
+Built in: every model shape above. A struct without `[Key]` members is edited
+in place. With public fields it folds out to those fields only (readonly ones
+read-only), so aliasing properties such as `Quaternion.eulerAngles` or
+`Rect.min` add no rows; without public fields it folds out to its public
+properties with a setter, `init` ones read-only (record structs and CultMath
+matrices work as written). Get-only properties are never shown. Unity object
+references draw as object fields. A value no drawer claims and no shape covers
+shows a red error row with the model's reason, as does a multi-dimensional
+array.
+
+A project adds or overrides a drawer with an editor class. `Claimed` is either
+a value type (an open generic definition claims every closed form) or an
+attribute type, which claims every member carrying it. Attribute claims win
+over type claims, which win over built-in drawing. A claim two drawers make is
+used by neither: both are logged and the member shows the error row.
+
+A drawer returns the new value and lets its IMGUI controls set `GUI.changed`;
+only a frame that reports a change is saved. Mutating the value in place
+without reporting a change is not saved reliably. A drawer that throws shows
+an error row and discards that frame's edit copy, so nothing edited in that
+frame is saved.
+
+```csharp
+using System;
+using System.Reflection;
+using GameCult.Caching;
+using GameCult.Unity.Caching.Editor;
+using UnityEditor;
+using UnityEngine;
+
+// Lives beside the documents; an attribute needs no Unity reference.
+public sealed class ColorAttribute : Attribute
+{
+}
+
+// Draws a "#RRGGBBAA" string member as a color field.
+[CultInspectorDrawer(typeof(ColorAttribute))]
+public sealed class ColorDrawer : ICultInspectorDrawer
+{
+    public object Draw(CultInspector inspector, string label, Type type, object value, MemberInfo member)
+    {
+        if (type != typeof(string))
+            return inspector.DrawDefault(label, type, value, member);
+        ColorUtility.TryParseHtmlString(value as string ?? string.Empty, out var color);
+        var next = EditorGUILayout.ColorField(label, color);
+        return next == color ? value : "#" + ColorUtility.ToHtmlStringRGBA(next);
+    }
+}
+```
+
+`Draw` receives the value's declared type and the member it belongs to, also
+for list elements and dictionary keys and values, so an attribute drawer
+checks the type it is handed. `inspector.DrawDefault` hands a value back to
+built-in drawing; `inspector.DrawValue` draws a sub-value with claims applied.
 
 ## Inspector Annotations
 
-Domain classes can opt into nicer Unity editor rendering with attributes from
-`GameCult.Unity.Caching`:
+The annotations live in `GameCult.Caching`, so headless shared models carry
+them without referencing Unity.
 
 ```csharp
 using GameCult.Caching;
-using GameCult.Unity.Caching;
 using MessagePack;
 
+[MessagePackObject]
 [CultDocument("game.item", "game.item.v1")]
 public sealed class ItemData
 {
@@ -47,27 +141,20 @@ public sealed class ItemData
     public string Notes = string.Empty;
 
     [Key(3)]
-    [CultInspectorAssetPath(typeof(UnityEngine.Texture2D))]
+    [CultInspectorAssetPath]
     public string IconPath = string.Empty;
 }
 ```
 
-Available annotations:
-
 - `CultInspectorLabel`
 - `CultInspectorHidden`
 - `CultInspectorReadOnly`
 - `CultInspectorOrder`
 - `CultInspectorTextArea`
 - `CultInspectorRange`
-- `CultInspectorAssetPath`
-
-## Current Scope
-
-The first studio pass supports local `.cc` files, explicit save/reload, adding
-records with parameterless constructors, deleting records, primitive fields,
-enums, strings, lists/arrays, nested objects, Unity object references, asset
-path pickers, and `CultRecordRef<T>` key editing.
+- `CultInspectorAssetPath` (optional engine asset `Type`, named by the
+  consumer; the Studio uses it when it is a `UnityEngine.Object` type)
+- `CultInspectorDrawer` (on drawer classes)
 
 CultMesh collaboration should feed the same CultCache mutation surface rather
 than becoming a second owner for document state.
diff --git a/src/GameCult.Unity/Assets/Caching/Runtime.meta b/src/GameCult.Unity/Assets/Caching/Runtime.meta
deleted file mode 100644
index 5142c828..00000000
--- a/src/GameCult.Unity/Assets/Caching/Runtime.meta
+++ /dev/null
@@ -1,3 +0,0 @@
-fileFormatVersion: 2
-guid: 5a7d06cb8f1e491785b3ae24034f1121
-timeCreated: 1779630000
diff --git a/src/GameCult.Unity/Assets/Caching/Runtime/CultCacheInspectorAttributes.cs.meta b/src/GameCult.Unity/Assets/Caching/Runtime/CultCacheInspectorAttributes.cs.meta
deleted file mode 100644
index ecc92c68..00000000
--- a/src/GameCult.Unity/Assets/Caching/Runtime/CultCacheInspectorAttributes.cs.meta
+++ /dev/null
@@ -1,3 +0,0 @@
-fileFormatVersion: 2
-guid: 8871d3eb346242e3b0acfd6da5108676
-timeCreated: 1779630000
diff --git a/src/GameCult.Unity/Assets/Caching/Runtime/GameCult.Unity.Caching.asmdef b/src/GameCult.Unity/Assets/Caching/Runtime/GameCult.Unity.Caching.asmdef
deleted file mode 100644
index 6e7e12a6..00000000
--- a/src/GameCult.Unity/Assets/Caching/Runtime/GameCult.Unity.Caching.asmdef
+++ /dev/null
@@ -1,14 +0,0 @@
-{
-    "name": "GameCult.Unity.Caching",
-    "rootNamespace": "GameCult.Unity.Caching",
-    "references": [],
-    "includePlatforms": [],
-    "excludePlatforms": [],
-    "allowUnsafeCode": false,
-    "overrideReferences": false,
-    "precompiledReferences": [],
-    "autoReferenced": true,
-    "defineConstraints": [],
-    "versionDefines": [],
-    "noEngineReferences": true
-}
diff --git a/src/GameCult.Unity/Assets/Caching/package.json b/src/GameCult.Unity/Assets/Caching/package.json
index b08a3ce5..dff80c97 100644
--- a/src/GameCult.Unity/Assets/Caching/package.json
+++ b/src/GameCult.Unity/Assets/Caching/package.json
@@ -1,7 +1,7 @@
 {
     "name": "org.gamecult.caching.unity",
     "displayName": "GameCult CultCache Unity Tools",
-    "version": "1.0.0",
+    "version": "1.2.0",
     "unity": "2021.3",
     "description": "Unity editor tooling for inspecting and editing CultCache .cc stores.",
     "keywords": [
@@ -9,6 +9,9 @@
         "Editor",
         "Data"
     ],
+    "dependencies": {
+        "org.gamecult.cultlib": "1.0.57"
+    },
     "license": "MIT",
     "category": "Scripting"
 }
diff --git a/src/GameCult.Unity/Assets/UI/UI.txt b/src/GameCult.Unity/Assets/UI/UI.txt
deleted file mode 100644
index 8789f73a..00000000
--- a/src/GameCult.Unity/Assets/UI/UI.txt
+++ /dev/null
@@ -1,2917 +0,0 @@
-
-
-// E:\Projects\CultLib\src\GameCult.Unity\Assets\UI\Attributes.cs
-
-using System;
-
-namespace GameCult.Unity.UI
-{
-    [AttributeUsage(AttributeTargets.All, Inherited = false)]
-    public class InspectableAttribute : Attribute { }
-
-    [AttributeUsage(AttributeTargets.Field | AttributeTargets.Property)]
-    public abstract class PreferredInspectorAttribute : InspectableAttribute { }
-    
-    public class InspectableReadOnlyLabelAttribute : PreferredInspectorAttribute { }
-
-    public class InspectableRangedFloatAttribute : PreferredInspectorAttribute
-    {
-        public readonly float Min, Max;
-
-        public InspectableRangedFloatAttribute(float min, float max)
-        {
-            Min = min;
-            Max = max;
-        }
-    }
-
-    public class InspectableRangedIntAttribute : PreferredInspectorAttribute
-    {
-        public readonly int Min, Max;
-
-        public InspectableRangedIntAttribute(int min, int max)
-        {
-            Min = min;
-            Max = max;
-        }
-    }
-
-    public class InspectableIncrementIntAttribute : PreferredInspectorAttribute
-    {
-        public readonly int Min, Max;
-
-        public InspectableIncrementIntAttribute(int min, int max)
-        {
-            Min = min;
-            Max = max;
-        }
-    }
-}
-
-// E:\Projects\CultLib\src\GameCult.Unity\Assets\UI\ColorConversion.cs
-
-using Unity.Mathematics;
-using UnityEngine;
-using static Unity.Mathematics.math;
-
-namespace GameCult.Unity.UI
-{
-    // Color conversion functions from https://www.chilliant.com/rgb2hsv.html
-    public static class ColorConversion
-    {
-        private static float Epsilon = 1e-10f;
-
-        public static float3 HUEtoRGB(in float h)
-        {
-            float R = abs(h * 6 - 3) - 1;
-            float G = 2 - abs(h * 6 - 2);
-            float B = 2 - abs(h * 6 - 4);
-            return saturate(float3(R,G,B));
-        }
-
-        public static float3 RGBtoHCV(in float3 rgb)
-        {
-            // Based on work by Sam Hocevar and Emil Persson
-            float4 P = (rgb.y < rgb.z) ? float4(rgb.zy, -1.0f, 2.0f/3.0f) : float4(rgb.yz, 0.0f, -1.0f/3.0f);
-            float4 Q = (rgb.x < P.x) ? float4(P.xyw, rgb.x) : float4(rgb.x, P.yzx);
-            float C = Q.x - min(Q.w, Q.y);
-            float H = abs((Q.w - Q.y) / (6 * C + Epsilon) + Q.z);
-            return float3(H, C, Q.x);
-        }
-
-        public static float3 HSVtoRGB(in float3 hsv)
-        {
-            float3 rgb = HUEtoRGB(hsv.x);
-            return ((rgb - 1) * hsv.y + 1) * hsv.z;
-        }
-
-        public static float3 HSLtoRGB(in float3 hsl)
-        {
-            float3 RGB = HUEtoRGB(hsl.x);
-            float C = (1 - abs(2 * hsl.z - 1)) * hsl.y;
-            return (RGB - 0.5f) * C + hsl.z;
-        }
-
-        // The weights of RGB contributions to luminance.
-        // Should sum to unity.
-        private static float3 HCYwts = float3(0.299f, 0.587f, 0.114f);
- 
-        public static float3 HCYtoRGB(float3 hcy)
-        {
-            float3 RGB = HUEtoRGB(hcy.x);
-            float Z = dot(RGB, HCYwts);
-            if (hcy.z < Z)
-            {
-                hcy.y *= hcy.z / Z;
-            }
-            else if (Z < 1)
-            {
-                hcy.y *= (1 - hcy.z) / (1 - Z);
-            }
-            return (RGB - Z) * hcy.y + hcy.z;
-        }
-
-        public static float3 RGBtoHSV(in float3 rgb)
-        {
-            float3 HCV = RGBtoHCV(rgb);
-            float S = HCV.y / (HCV.z + Epsilon);
-            return float3(HCV.x, S, HCV.z);
-        }
-
-        public static float3 RGBtoHSL(in float3 rgb)
-        {
-            float3 HCV = RGBtoHCV(rgb);
-            float L = HCV.z - HCV.y * 0.5f;
-            float S = HCV.y / (1 - abs(L * 2 - 1) + Epsilon);
-            return float3(HCV.x, S, L);
-        }
-
-        public static float3 RGBtoHCY(in float3 rgb)
-        {
-            // Corrected by David Schaeffer
-            float3 HCV = RGBtoHCV(rgb);
-            float Y = dot(rgb, HCYwts);
-            float Z = dot(HUEtoRGB(HCV.x), HCYwts);
-            if (Y < Z)
-            {
-                HCV.y *= Z / (Epsilon + Y);
-            }
-            else
-            {
-                HCV.y *= (1 - Z) / (Epsilon + 1 - Y);
-            }
-            return float3(HCV.x, HCV.y, Y);
-        }
-
-        public static Color ToColor(this float3 color) => new Color(color.x, color.y, color.z);
-        public static float3 ToFloat3(this Color color) => new float3(color.r, color.g, color.b);
-    }
-}
-
-// E:\Projects\CultLib\src\GameCult.Unity\Assets\UI\DisplayOptions.cs
-
-using TMPro;
-
-namespace GameCult.Unity.UI
-{
-    public class DisplayOptions
-    {
-        public TextAlignmentOptions? TextAlignment { get; }
-        public VerticalAlignmentOptions? VerticalAlignment { get; }
-        public float? LayoutPriority { get; }
-        public float? LayoutHeight { get; }
-        public float? TextSize { get; }
-        public bool Interactable { get; }
-        public bool PlaceInContext { get; }
-        
-        public DisplayOptions(bool placeInContext = true, 
-            bool interactable = true, 
-            float? layoutHeight = null, 
-            float? textSize = null,
-            float? layoutPriority = null,
-            VerticalAlignmentOptions? verticalAlignment = null,
-            TextAlignmentOptions? textAlignment = null)
-        {
-            PlaceInContext = placeInContext;
-            LayoutHeight = layoutHeight;
-            Interactable = interactable;
-            TextSize = textSize;
-            LayoutPriority = layoutPriority;
-            VerticalAlignment = verticalAlignment;
-            TextAlignment = textAlignment;
-        }
-    }
-}
-
-// E:\Projects\CultLib\src\GameCult.Unity\Assets\UI\Generator.cs
-
-using System;
-using System.Collections.Generic;
-using System.Linq;
-using System.Linq.Expressions;
-using System.Reflection;
-using GameCult.Unity.UI.Components;
-using UnityEngine;
-using ZLinq;
-
-namespace GameCult.Unity.UI
-{
-    public class Generator : ResolverComponent, IUIContext
-    {
-        [SerializeField] private float inspectorLabelPriority = 3;
-        [SerializeField] private float inspectorFieldPriority = 2;
-        [SerializeField] private ReflectiveResolver? resolver;
-        [SerializeField] private RectTransform? contentRoot;
-        protected event Action<GameObject>? OnPropertyAdded;
-        protected event Action? RefreshPropertyValues;
-        
-        protected List<GameObject> Elements { get; } = new();
-        public IUIResolver Resolver => resolver ?? throw new NullReferenceException("Generator doesn't have an assigned resolver.");
-        public Action? Refresh
-        {
-            get => RefreshPropertyValues;
-            set => RefreshPropertyValues = value;
-        }
-
-        public RectTransform ContentRoot => contentRoot ?? (RectTransform)transform;
-        public Canvas Canvas => GetComponentInParent<Canvas>();
-        public RectTransform CanvasRoot => (RectTransform)Canvas.transform;
-        
-        public void Inspect(object obj, bool inspectableOnly = false, bool recursive = true)
-        {
-            var members = obj.GetType().GetMembers(BindingFlags.Public | BindingFlags.Instance);
-            foreach (var member in members)
-            {
-                var inspectable = member.GetCustomAttribute<InspectableAttribute>();
-                if (inspectable == null && inspectableOnly) continue;
-                var preferred = inspectable as PreferredInspectorAttribute;
-                switch (member)
-                {
-                    case FieldInfo field:
-                    {
-                        var type = field.FieldType;
-                        var handler = Resolver.ResolveField(type, preferred);
-                        // If there's a handler for this field and attribute type, use that
-                        if (handler != null)
-                        {
-                            var group = Resolver.Resolve<HorizontalGroup>()?.Configure(this);
-                            if (group == null) continue;
-                            Resolver.Resolve<Label>()?.Configure(group, member.Name);
-                            handler.ConfigureForMember(group, obj, field);
-                        }
-                        else
-                        {
-                            // No field handler found;
-                            // If recursion is enabled and the field is a class marked inspectable or if we don't care,
-                            // Generate a foldout and then inspect recursively inside the foldout
-                            if (recursive && field.FieldType.IsClass &&
-                                (!inspectableOnly || field.FieldType.GetCustomAttribute<InspectableAttribute>() != null))
-                            {
-                                var foldout = Resolver.Resolve<GeneratorFoldout>();
-                                if (foldout != null)
-                                {
-                                    foldout.Title = member.Name;
-                                    foldout.Inspect(field.GetValue(obj), inspectableOnly, recursive);
-                                }
-                            }
-                            // If all else fails, just display the ToString
-                            else this.AddLabelInspector(member.Name, () => field.GetValue(obj)?.ToString() ?? "Null");
-                        }
-                        continue;
-                    }
-                    case PropertyInfo property:
-                    {
-                        var type = property.PropertyType;
-                        var isReadOnly = !property.CanWrite;
-                        PreferredInspectorAttribute? usedAttr = preferred;
-                        if (isReadOnly && preferred == null && IsDisplayablePrimitive(type))
-                        {
-                            usedAttr = new InspectableReadOnlyLabelAttribute();
-                        }
-
-                        var handler = Resolver.ResolveField(type, usedAttr);
-                        if (handler != null)
-                        {
-                            var group = Resolver.Resolve<HorizontalGroup>()?.Configure(this);
-                            if (group == null) continue;
-                            Resolver.Resolve<Label>()?.Configure(group, member.Name);
-                            handler.ConfigureForMember(group, obj, property);
-                        }
-                        else
-                        {
-                            if (recursive && property.PropertyType.IsClass &&
-                                (!inspectableOnly || property.PropertyType.GetCustomAttribute<InspectableAttribute>() != null))
-                            {
-                                var foldout = Resolver.Resolve<GeneratorFoldout>();
-                                if (foldout != null)
-                                {
-                                    foldout.Title = member.Name;
-                                    foldout.Inspect(property.GetValue(obj), inspectableOnly, recursive);
-                                }
-                            }
-                            else this.AddLabelInspector(member.Name, () => property.GetValue(obj)?.ToString() ?? "Null");
-                        }
-                        continue;
-                    }
-                }
-            }
-        }
-
-        private static bool IsDisplayablePrimitive(Type type)
-        {
-            return type.IsPrimitive || type == typeof(string) || type == typeof(decimal);
-        }
-        
-        public virtual void Update()
-        {
-            RefreshValues();
-        }
-        
-        protected void RefreshValues()
-        {
-            RefreshPropertyValues?.Invoke();
-        }
-        
-        public void Register(GameObject go)
-        {
-            Elements.Add(go);
-            OnPropertyAdded?.Invoke(go);
-        }
-
-        public void Clear()
-        {
-            foreach(var element in Elements)
-                Destroy(element);
-            Elements.Clear();
-        }
-    }
-}
-
-// E:\Projects\CultLib\src\GameCult.Unity\Assets\UI\GeneratorPanel.cs
-
-using TMPro;
-using UnityEngine;
-
-namespace GameCult.Unity.UI
-{
-    public class GeneratorPanel : Generator
-    {
-        [SerializeField] private TextMeshProUGUI? title;
-        
-        public string Title
-        {
-            set
-            {
-                if (title is not null) title.text = value;
-            }
-        }
-
-        public void TitleSubtitle(string title, string subtitle) => Title = $"{title}\n<smallcaps><size=50%>{subtitle}";
-    }
-}
-
-// E:\Projects\CultLib\src\GameCult.Unity\Assets\UI\Interfaces.cs
-
-using System;
-using System.Collections.Generic;
-using System.Reflection;
-using GameCult.Unity.UI.Components;
-using TMPro;
-using UnityEngine;
-using UnityEngine.UI;
-
-namespace GameCult.Unity.UI
-{
-    public interface IFieldHandler
-    {
-        int Priority { get; }
-        bool CanHandle(Type type, PreferredInspectorAttribute? attr);
-        void ConfigureForMember(IUIContext context, object target, MemberInfo member, DisplayOptions? displayOptions = null);
-    }
-
-    public interface IUIResolver
-    {
-        // For general field generation (reflection, attributes, etc.)
-        IFieldHandler? ResolveField(Type type, PreferredInspectorAttribute? attr);
-
-        // For declarative, known-type composition
-        T? Resolve<T>(string? prefabName = null) where T : ResolverComponent;
-    }
-
-    public interface IUIContext
-    {
-        IUIResolver Resolver { get; }
-        RectTransform ContentRoot { get; }
-        Canvas Canvas { get; }
-        RectTransform CanvasRoot { get; }
-        void Register(GameObject go);
-        Action? Refresh { get; set; }
-        // DisplayOptions InspectorLabelDisplayOptions { get; }
-        // DisplayOptions InspectorFieldDisplayOptions { get; }
-    }
-    
-    public interface ILayoutElement
-    {
-        public LayoutElement? LayoutElement { get; }
-    }
-
-    public interface ITextElement
-    {
-        public TextMeshProUGUI? Text { get; }
-    }
-
-    public interface IMultipleTextElement
-    {
-        public IEnumerable<TextMeshProUGUI> Text { get; }
-    }
-
-    public static class DisplayOptionsExtensions
-    {
-        public static void ApplyLayoutOptions(this ILayoutElement layoutElement, DisplayOptions? displayOptions)
-        {
-            if(displayOptions == null || layoutElement.LayoutElement == null) return;
-            
-            if(displayOptions.LayoutPriority != null) layoutElement.LayoutElement.flexibleWidth = displayOptions.LayoutPriority.Value;
-            if(displayOptions.LayoutHeight != null) layoutElement.LayoutElement.minHeight = displayOptions.LayoutHeight.Value;
-        }
-        
-        public static void ApplyTextOptions(this ITextElement textElement, DisplayOptions? displayOptions)
-        {
-            if(displayOptions == null || textElement.Text is null) return;
-            
-            if(displayOptions.TextAlignment != null) textElement.Text.alignment = displayOptions.TextAlignment.Value;
-            if(displayOptions.VerticalAlignment != null) textElement.Text.verticalAlignment = displayOptions.VerticalAlignment.Value;
-            if(displayOptions.TextSize != null) textElement.Text.fontSize = displayOptions.TextSize.Value;
-        }
-        
-        public static void ApplyTextOptions(this IMultipleTextElement textElement, DisplayOptions? displayOptions)
-        {
-            if(displayOptions == null) return;
-            
-            foreach(var text in textElement.Text)
-            {
-                if (displayOptions.TextAlignment != null) text.alignment = displayOptions.TextAlignment.Value;
-                if (displayOptions.VerticalAlignment != null) text.verticalAlignment = displayOptions.VerticalAlignment.Value;
-                if (displayOptions.TextSize != null) text.fontSize = displayOptions.TextSize.Value;
-            }
-        }
-    }
-}
-
-// E:\Projects\CultLib\src\GameCult.Unity\Assets\UI\MainMenu.cs
-
-using System;
-using GameCult.Unity.UI.Components;
-using UnityEngine;
-using static Unity.Mathematics.math;
-
-namespace GameCult.Unity.UI
-{
-    public class MainMenu : MonoBehaviour
-    {
-        [SerializeField] private Prototype? panelPrototype;
-        [SerializeField] private float fadeTime = .5f;
-        [SerializeField] private float fadeDistance = 512;
-        [SerializeField] private float fadeAlphaExponent = 2;
-        [SerializeField] private float fadePositionExponent = 2;
-
-        private (GeneratorPanel panel, CanvasGroup group) _currentMenu, _nextMenu;
-        private bool _fadeFromRight;
-        private float _fadeLerp;
-        private bool _fading;
-        private Vector3 _panelPosition;
-        //private Task<DatabaseCache> _databaseLoad;
-    
-        void Start()
-        {
-            // Start loading the database in the background 'cause it takes a few seconds
-            //_databaseLoad = Task.Run(() => ActionGameManager.Database);
-            
-            if(panelPrototype == null)
-            {
-                gameObject.SetActive(false);
-                return;
-            }
-        
-            _panelPosition = panelPrototype.transform.position;
-        
-            var panel1 = panelPrototype.Instantiate<GeneratorPanel>();
-            _currentMenu = (panel1, panel1.GetComponent<CanvasGroup>());
-        
-            var panel2 = panelPrototype.Instantiate<GeneratorPanel>();
-            _nextMenu = (panel2, panel2.GetComponent<CanvasGroup>());
-
-            _currentMenu.panel.gameObject.SetActive(false);
-            //_saveDirectory = ActionGameManager.GameDataDirectory.CreateSubdirectory("Saves");
-        
-            ShowMain();
-            Fade(true);
-        }
-
-        private void Update()
-        {
-            if (_fading)
-            {
-                _fadeLerp += Time.deltaTime / fadeTime;
-
-                _currentMenu.panel.transform.position = 
-                    _panelPosition + (_fadeFromRight ? Vector3.left : Vector3.right) * (fadeDistance * pow(_fadeLerp, fadePositionExponent));
-                _nextMenu.panel.transform.position = 
-                    _panelPosition + (_fadeFromRight ? Vector3.right : Vector3.left) * (fadeDistance * pow(1-_fadeLerp, fadePositionExponent));
-                _currentMenu.group.alpha = pow(1 - _fadeLerp, fadeAlphaExponent);
-                _nextMenu.group.alpha = pow(_fadeLerp, fadeAlphaExponent);
-            
-                if (_fadeLerp > 1)
-                {
-                    _fading = false;
-                    _currentMenu.panel.gameObject.SetActive(false);
-                    (_currentMenu, _nextMenu) = (_nextMenu, _currentMenu);
-                }
-            }
-        }
-        
-        private void Fade(bool fromRight)
-        {
-            _nextMenu.panel.gameObject.SetActive(true);
-            _nextMenu.group.alpha = 0;
-            _fading = true;
-            _fadeLerp = 0;
-            _fadeFromRight = fromRight;
-        }
-
-        private void ShowMain()
-        {
-            _nextMenu.panel.Clear();
-            _nextMenu.panel.TitleSubtitle("CultUI", "Runtime UI Composition");
-            _nextMenu.panel.AddTextButton("Demos",
-                () =>
-                {
-                    ShowDemos();
-                    Fade(true);
-                });
-            _nextMenu.panel.AddTextButton("Settings",
-                () =>
-                {
-                    ShowSettings();
-                    Fade(true);
-                });
-            _nextMenu.panel.AddTextButton("Quit", Application.Quit);
-        }
-
-        private void ShowDemos()
-        {
-            _nextMenu.panel.Clear();
-            _nextMenu.panel.TitleSubtitle("CultUI", "Demos");
-            _nextMenu.panel.AddTextButton("Procedural Inspector",
-                () =>
-                {
-                    ShowProceduralInspectorDemo();
-                    Fade(true);
-                });
-            _nextMenu.panel.AddTextButton("Back",
-                () =>
-                {
-                    ShowMain();
-                    Fade(false);
-                });
-        }
-
-        private void ShowProceduralInspectorDemo()
-        {
-            _nextMenu.panel.Clear();
-            _nextMenu.panel.TitleSubtitle("CultUI", "Code Inspector");
-            _nextMenu.panel.AddLabel("For the common task of inspector-style menus with a label and a field, " +
-                                     "CultUI offers convenient extensions " +
-                                     "which compose a label and a field handler within a horizontal scope. " +
-                                     "This can be great for options menus or in-game properties panels.");
-            _nextMenu.panel.AddLabelInspector("Read-only String", () => $"{Time.time:F1}");
-            var testString = "Test String";
-            _nextMenu.panel.AddStringInspector("String", () => testString, s => testString = s);
-            var testFloat = 10f;
-            _nextMenu.panel.AddFloatInspector("Float", () => testFloat, f => testFloat = f);
-            var testRangedFloat = 10f;
-            _nextMenu.panel.AddRangedFloatInspector("Ranged Float", () => testRangedFloat, f => testRangedFloat = f, 0, 100);
-            var testBool = true;
-            _nextMenu.panel.AddBoolInspector("Bool", () => testBool, b => testBool = b);
-            var testIncrement = 3;
-            _nextMenu.panel.AddIncrementIntInspector("Increment Int", () => testIncrement, i => testIncrement = i, 0, 5);
-            _nextMenu.panel.AddButtonInspector("Button", "Click me!", () => Debug.Log("Button Clicked!"));
-            var testEnum = Animals.Dog;
-            _nextMenu.panel.AddEnumInspector("Enum", () => testEnum, e => testEnum = e);
-            var testFlags = AnimalTraits.HasFur;
-            _nextMenu.panel.AddFlagsEnumInspector("Flags", () => testFlags, f => testFlags = f);
-            _nextMenu.panel.AddTextButton("Back",
-                () =>
-                {
-                    ShowDemos();
-                    Fade(false);
-                });
-        }
-        
-        [Flags]
-        enum AnimalTraits
-        {
-            None = 0,
-            HasFur = 1,
-            CanFly = 2,
-            CanSwim = 4,
-            IsVenomous = 8,
-            Nocturnal = 16
-        }
-
-        private enum Animals
-        {
-            Dog,
-            Cat,
-            Bird
-        }
-
-        private void ShowSettings()
-        {
-            _nextMenu.panel.Clear();
-            _nextMenu.panel.Title = "Settings";
-            _nextMenu.panel.AddTextButton("Gameplay",
-                () =>
-                {
-                    ShowGameplaySettings();
-                    Fade(true);
-                });
-            _nextMenu.panel.AddTextButton("Graphics",
-                () =>
-                {
-                    ShowGraphicsSettings();
-                    Fade(true);
-                });
-            _nextMenu.panel.AddTextButton("Input",
-                () =>
-                {
-                    ShowInputSettings();
-                    Fade(true);
-                });
-            _nextMenu.panel.AddTextButton("Audio",
-                () =>
-                {
-                    ShowAudioSettings();
-                    Fade(true);
-                });
-            _nextMenu.panel.AddTextButton("Back",
-                () =>
-                {
-                    ShowMain();
-                    Fade(false);
-                });
-        }
-    
-        private void ShowGameplaySettings()
-        {
-            _nextMenu.panel.Clear();
-            _nextMenu.panel.TitleSubtitle("Gameplay", "Settings");
-            _nextMenu.panel.AddTextButton("Back",
-                () =>
-                {
-                    ShowSettings();
-                    Fade(false);
-                });
-        }
-
-        private void ShowGraphicsSettings()
-        {
-            _nextMenu.panel.Clear();
-            _nextMenu.panel.TitleSubtitle("Graphics", "Settings");
-            _nextMenu.panel.AddTextButton("Back",
-                () =>
-                {
-                    ShowSettings();
-                    Fade(false);
-                });
-        }
-
-        private void ShowInputSettings()
-        {
-            _nextMenu.panel.Clear();
-            _nextMenu.panel.TitleSubtitle("Input", "Settings");
-            _nextMenu.panel.AddTextButton("Back",
-                () =>
-                {
-                    ShowSettings();
-                    Fade(false);
-                });
-        }
-
-        private void ShowAudioSettings()
-        {
-            _nextMenu.panel.Clear();
-            _nextMenu.panel.TitleSubtitle("Audio", "Settings");
-            _nextMenu.panel.AddTextButton("Back",
-                () =>
-                {
-                    ShowSettings();
-                    Fade(false);
-                });
-        }
-    }
-}
-
-// E:\Projects\CultLib\src\GameCult.Unity\Assets\UI\Prototype.cs
-
-using System;
-using System.Collections.Generic;
-using UnityEngine;
-
-namespace GameCult.Unity.UI
-{
-    /// <summary>
-    /// Convenience helper that lets you create "prototype" GameObjects in-scene which act like prefabs:<br/>
-    ///   - The prototype (root) exists in the scene and deactivates itself on start.<br/>
-    ///   - You can Instantiate&lt;T&gt;() to get an active copy in the same parent/transform space.<br/>
-    ///   - When finished, call ReturnToPool() on the instance to return it to the prototype's pool
-    ///     so it can be reused instead of being destroyed and recreated.
-    /// </summary>
-    public class Prototype : MonoBehaviour
-    {
-        /// <summary>
-        /// Fired when an instance is returned into the prototype's pool (after it is deactivated).
-        /// </summary>
-        public event Action? OnReturnToPool;
-
-        // True when this component is the prototype/root (i.e. not a pooled instance).
-        public bool IsPrototype => _rootPrototype is null;
-
-        // Always returns the prototype/root for this object. If this object is the prototype, it returns itself.
-        public Prototype RootPrototype => _rootPrototype ?? this;
-
-        private void Start()
-        {
-            // Prototype objects remain inactive in the scene by default.
-            if (IsPrototype)
-                gameObject.SetActive(false);
-        }
-
-        private void OnDestroy()
-        {
-            // When the prototype is destroyed, clean up pooled instances too.
-            if (_instancePool != null)
-            {
-                foreach (var instance in _instancePool)
-                    Destroy(instance.gameObject);
-            }
-        }
-
-        /// <summary>
-        /// Instantiate a copy of this Prototype and return the requested component T from the instance.
-        /// If there is an available instance in the pool, reuse it.
-        /// </summary>
-        public T Instantiate<T>() where T : Component
-        {
-            Prototype instance;
-
-            // Re-use from pool if possible (pool belongs to the prototype/root).
-            var poolOwner = RootPrototype;
-            if (poolOwner._instancePool != null && poolOwner._instancePool.Count > 0)
-            {
-                var lastIndex = poolOwner._instancePool.Count - 1;
-                instance = poolOwner._instancePool[lastIndex];
-                poolOwner._instancePool.RemoveAt(lastIndex);
-                instance.transform.SetAsLastSibling();
-            }
-            else
-            {
-                // Create a fresh instance from this object (clone entire GameObject).
-                // Place it under the same parent as the prototype.
-                instance = UnityEngine.Object.Instantiate(this, transform.parent, false);
-
-                // For UI RectTransforms, copy anchors/pivot/sizeDelta so layout matches.
-                if (transform is RectTransform protoRT &&
-                    instance.transform is RectTransform instRT)
-                {
-                    instRT.anchorMin = protoRT.anchorMin;
-                    instRT.anchorMax = protoRT.anchorMax;
-                    instRT.pivot = protoRT.pivot;
-                    instRT.sizeDelta = protoRT.sizeDelta;
-                }
-
-                // Match local transform values exactly.
-                instance.transform.localPosition = transform.localPosition;
-                instance.transform.localRotation = transform.localRotation;
-                instance.transform.localScale = transform.localScale;
-
-                // Mark this new copy as an instance of this prototype.
-                instance._rootPrototype = this;
-            }
-
-            instance.gameObject.SetActive(true);
-            return instance.GetComponent<T>();
-        }
-
-        /// <summary>
-        /// Return this instance to its prototype's pool for reuse.
-        /// Can only be called on an instance (not on the prototype/root itself).
-        /// </summary>
-        public void ReturnToPool()
-        {
-            if (IsPrototype)
-            {
-                Debug.LogError($"Cannot ReturnToPool: '{name}' appears to be the prototype root (it has no root prototype). " +
-                               "Only instantiated instances can be returned to a pool.");
-                Destroy(gameObject);
-                return;
-            }
-
-            // Move instance back under the prototype's parent and add to pool.
-            transform.SetParent(RootPrototype.transform.parent);
-            RootPrototype.AddToPool(this);
-
-            // Clear any handlers to avoid leaking references while pooled.
-            OnReturnToPool = null;
-        }
-
-        /// <summary>
-        /// Get the requested component on the prototype (if this is the prototype) or on the root prototype.
-        /// </summary>
-        public T GetOriginal<T>()
-        {
-            return RootPrototype.GetComponent<T>();
-        }
-
-        /// <summary>
-        /// Adds an instance back into this prototype's pool.
-        /// This method is internal to the prototype; it should only be called on the prototype/root.
-        /// </summary>
-        private void AddToPool(Prototype instance)
-        {
-            if (!IsPrototype)
-            {
-                Debug.LogError($"Attempting to add '{instance.name}' to the pool of '{name}', but '{name}' is not the prototype root.");
-                // still attempt to add to the real root if available
-                if (_rootPrototype is not null)
-                {
-                    _rootPrototype.AddToPool(instance);
-                    return;
-                }
-            }
-
-            instance.gameObject.SetActive(false);
-
-            _instancePool ??= new List<Prototype>();
-            _instancePool.Add(instance);
-
-            // Notify any subscribers that this instance has returned to the pool.
-            instance.OnReturnToPool?.Invoke();
-        }
-
-        // Reference to the prototype/root. Non-null on instances; null on the prototype itself.
-        private Prototype? _rootPrototype;
-
-        // Pool of instances owned by the prototype/root.
-        private List<Prototype>? _instancePool;
-    }
-}
-
-// E:\Projects\CultLib\src\GameCult.Unity\Assets\UI\ReflectiveResolver.cs
-
-using System;
-using System.Collections.Generic;
-using System.Linq;
-using GameCult.Unity.UI.Components;
-using UnityEngine;
-using Object = UnityEngine.Object;
-
-namespace GameCult.Unity.UI
-{
-    [CreateAssetMenu(menuName="Inspector/Reflective Resolver")]
-    public class ReflectiveResolver : ScriptableObject, IUIResolver
-    {
-        [SerializeField] private List<LayoutComponent> fieldPrefabs = new();
-        [SerializeField] private List<ResolverComponent> componentPrefabs = new();
-
-        private List<IFieldHandler> _handlers = new();
-
-        private void Awake()
-        {
-            foreach (var prefab in fieldPrefabs)
-            {
-                if (prefab is not IFieldHandler)
-                {
-                    Debug.LogWarning($"Prefab {prefab.gameObject.name} in Field Prefabs is not IFieldHandler");
-                }
-                _handlers.Add((IFieldHandler)prefab);
-            }
-            _handlers = _handlers.OrderByDescending(h => h.Priority).ToList();
-        }
-
-        public IFieldHandler? ResolveField(Type type, PreferredInspectorAttribute? attribute)
-        {
-            var match = _handlers.FirstOrDefault(h => h.CanHandle(type, attribute));
-            if (match != null) return (IFieldHandler)Instantiate((LayoutComponent)match);
-            Debug.LogWarning($"{name} unable to resolve {type}" +
-                             (attribute != null ? $" with attribute {attribute.GetType().Name}" : ""));
-            return null;
-        }
-
-        public T? Resolve<T>(string? prefabName = null) where T : ResolverComponent
-        {
-            foreach (var component in componentPrefabs)
-            {
-                if (component is T t && (prefabName==null || t.gameObject.name.StartsWith(prefabName))) return Instantiate(t);
-            }
-            foreach (var field in fieldPrefabs)
-            {
-                if (field is T t && (prefabName==null || t.gameObject.name.StartsWith(prefabName))) return Instantiate(t);
-            }
-            
-            Debug.LogWarning($"{name} unable to resolve {typeof(T).Name}" + (prefabName != null ? $" with name {prefabName}" : ""));
-
-            return null;
-        }
-    }
-}
-
-// E:\Projects\CultLib\src\GameCult.Unity\Assets\UI\StringExtensions.cs
-
-using System.Text.RegularExpressions;
-
-namespace GameCult.Unity.UI
-{
-    public static class StringExtensions
-    {
-        public static string SplitCamelCase( this string str )
-        {
-            return Regex.Replace( 
-                Regex.Replace( 
-                    str, 
-                    @"(\P{Ll})(\P{Ll}\p{Ll})", 
-                    "$1 $2" 
-                ), 
-                @"(\p{Ll})(\P{Ll})", 
-                "$1 $2" 
-            );
-        }
-    }
-}
-
-// E:\Projects\CultLib\src\GameCult.Unity\Assets\UI\Components\BoolField.cs
-
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at https://mozilla.org/MPL/2.0/. */
-
-using System;
-using System.Reflection;
-using TMPro;
-using UnityEngine;
-using UnityEngine.Serialization;
-using UnityEngine.UI;
-
-namespace GameCult.Unity.UI.Components
-{
-    public class BoolField : LayoutComponent, IFieldHandler
-    {
-        [SerializeField] private Toggle? toggle;
-
-        public int Priority => 10;
-
-        public bool CanHandle(Type type, PreferredInspectorAttribute? attr) =>
-            type == typeof(bool) && attr == null;
-
-        public void ConfigureForMember(IUIContext context, object target, MemberInfo member, DisplayOptions? options = null)
-        {
-            Func<bool> read;
-            Action<bool> write;
-            switch (member)
-            {
-                case FieldInfo field:
-                    read = () => (bool)field.GetValue(target);
-                    write = b => field.SetValue(target, b);
-                    break;
-                case PropertyInfo property:
-                    read = () => (bool)property.GetValue(target);
-                    write = b => property.SetValue(target, b);
-                    break;
-                default:
-                    return;
-            }
-            Configure(context, read, write, options);
-        }
-
-        public BoolField Configure(IUIContext context, Func<bool> read, Action<bool> write, DisplayOptions? displayOptions = null)
-        {
-            if(displayOptions is not { PlaceInContext: true })
-                transform.SetParent(context.ContentRoot, false);
-            context.Register(gameObject);
-            if (toggle is null) return this;
-            toggle.isOn = read();
-            toggle.onValueChanged.AddListener(b => write(b));
-            
-            toggle.interactable = displayOptions?.Interactable??true;
-            this.ApplyLayoutOptions(displayOptions);
-
-            context.Refresh += () => toggle.isOn = read();
-            return this;
-        }
-    }
-
-    public static class BoolFieldGeneratorExtension
-    {
-        public static void AddBoolInspector(this IUIContext context,
-            string label,
-            Func<bool> read,
-            Action<bool> write,
-            string? prefabName = null) =>
-            context.Resolver.Resolve<HorizontalGroup>()?.Configure(context, 
-                context.Resolver.Resolve<Label>()?.Configure(context, label),
-                context.Resolver.Resolve<BoolField>(prefabName)?.Configure(context, read, write));
-        
-        public static void AddBoolField(this IUIContext context,
-            Func<bool> read,
-            Action<bool> write,
-            string? prefabName = null,
-            DisplayOptions? displayOptions = null) =>
-            context.Resolver.Resolve<BoolField>(prefabName)?.Configure(context, read, write, displayOptions);
-    }
-}
-
-// E:\Projects\CultLib\src\GameCult.Unity\Assets\UI\Components\ButtonField.cs
-
-// E:\Projects\CultLib\src\GameCult.Unity\Assets\UI\Components\ButtonField.cs
-
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at https://mozilla.org/MPL/2.0/. */
-
-using System;
-using System.Reflection;
-using TMPro;
-using UnityEngine;
-using UnityEngine.Serialization;
-using UnityEngine.UI;
-
-namespace GameCult.Unity.UI.Components
-{
-    public class ButtonField : LayoutComponent, IFieldHandler, ITextElement
-    {
-        [SerializeField] private TextMeshProUGUI? buttonLabel;
-        [SerializeField] private Button? button;
-
-        public int Priority => 10;
-
-        public TextMeshProUGUI? Text => buttonLabel;
-
-        public bool CanHandle(Type type, PreferredInspectorAttribute? attr) =>
-            type == typeof(Action);
-
-        public void ConfigureForMember(IUIContext context, object target, MemberInfo member, DisplayOptions? displayOptions = null)
-        {
-            Action action;
-            switch (member)
-            {
-                case FieldInfo field:
-                    action = (Action)field.GetValue(target);
-                    break;
-                case PropertyInfo property:
-                    action = (Action)property.GetValue(target);
-                    break;
-                default:
-                    return;
-            }
-            Configure(context, member.Name, action, displayOptions);
-        }
-
-        public ButtonField Configure(IUIContext context, string labelText, Action onClick, DisplayOptions? displayOptions = null)
-        {
-            if(displayOptions is not { PlaceInContext: true })
-                transform.SetParent(context.ContentRoot, false);
-            context.Register(gameObject);
-            if (buttonLabel is null || button is null) return this;
-            buttonLabel.text = labelText;
-            button.onClick.AddListener(() => onClick());
-            
-            button.interactable = displayOptions?.Interactable??true;
-            this.ApplyLayoutOptions(displayOptions);
-            this.ApplyTextOptions(displayOptions);
-
-            return this;
-        }
-
-        public Component Component => this;
-    }
-
-    public static class ButtonFieldGeneratorExtension
-    {
-        public static void AddButtonInspector(this IUIContext context,
-            string label,
-            string buttonLabel,
-            Action onClick,
-            string? prefabName = null) =>
-            context.Resolver.Resolve<HorizontalGroup>()?.Configure(context, 
-                context.Resolver.Resolve<Label>()?.Configure(context, label),
-                context.Resolver.Resolve<ButtonField>(prefabName)?.Configure(context, buttonLabel, onClick));
-
-        public static void AddButton(this IUIContext context,
-            string label,
-            Action onClick,
-            DisplayOptions? displayOptions = null,
-            string? prefabName = null) =>
-            context.Resolver.Resolve<ButtonField>(prefabName)?.Configure(context, label, onClick, displayOptions);
-    }
-}
-
-// E:\Projects\CultLib\src\GameCult.Unity\Assets\UI\Components\ClickCatcher.cs
-
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at https://mozilla.org/MPL/2.0/. */
-
-using R3;
-using UnityEngine.EventSystems;
-
-namespace GameCult.Unity.UI.Components
-{
-	public class ClickCatcher : ResolverComponent, IPointerEnterHandler, IPointerExitHandler, IPointerDownHandler, IPointerClickHandler
-	{
-		public float dragDistance = 25f;
-		
-		public bool PointerIsInside { get; private set; }
-	
-		public Subject<PointerEventData> OnEnter = new Subject<PointerEventData>();
-		public Subject<PointerEventData> OnExit = new Subject<PointerEventData>();
-		public Subject<PointerEventData> OnClick = new Subject<PointerEventData>();
-		public Subject<PointerEventData> OnDown = new Subject<PointerEventData>();
-	
-		public void OnPointerEnter(PointerEventData eventData)
-		{
-			//Debug.Log("Pointer Entered");
-			OnEnter.OnNext(eventData);
-			PointerIsInside = true;
-		}
-
-		public void OnPointerExit(PointerEventData eventData)
-		{
-			//Debug.Log("Pointer Exited");
-			OnExit.OnNext(eventData);
-			PointerIsInside = false;
-		}
-
-		public void OnPointerDown(PointerEventData eventData)
-		{
-			OnDown.OnNext(eventData);
-		}
-
-		public void OnPointerClick(PointerEventData eventData)
-		{
-			if((eventData.pressPosition - eventData.position).sqrMagnitude < dragDistance)
-				OnClick.OnNext(eventData);
-		}
-
-		private void OnDestroy()
-		{
-			OnEnter.Dispose();
-			OnExit.Dispose();
-			OnClick.Dispose();
-			OnDown.Dispose();
-		}
-	}
-}
-
-// E:\Projects\CultLib\src\GameCult.Unity\Assets\UI\Components\ColorModal.cs
-
-using System;
-using System.Collections.Generic;
-using System.Linq;
-using TMPro;
-using Unity.Mathematics;
-using UnityEngine;
-using UnityEngine.UI;
-using static GameCult.Unity.UI.ColorConversion;
-using static Unity.Mathematics.math;
-#pragma warning disable CS8618 // Non-nullable field must contain a non-null value when exiting constructor. Consider adding the 'required' modifier or declaring as nullable.
-
-namespace GameCult.Unity.UI.Components
-{
-    public class ColorModal : Modal
-    {
-        private static readonly int Mode = Shader.PropertyToID("_Mode");
-        private static readonly int H = Shader.PropertyToID("_H");
-        private static readonly int S = Shader.PropertyToID("_S");
-        private static readonly int V = Shader.PropertyToID("_V");
-        private static readonly int Value = Shader.PropertyToID("_Value");
-        [SerializeField] private ConstrainedSlider2D colorCircle;
-        [SerializeField] private Slider hueSlider;
-        [SerializeField] private Slider satSlider;
-        [SerializeField] private Slider valSlider;
-        [SerializeField] private EnumField modeEnum;
-        [SerializeField] private TMP_InputField hexStringField;
-        [SerializeField] private Image circleImage;
-        [SerializeField] private Image previewImage;
-        [SerializeField] private List<Image> sliderBackgrounds = new();
-        [SerializeField] private List<Image> sliderHandles = new();
-        [SerializeField] private List<Image> sliderHandleOutlines = new();
-        [SerializeField] private List<Material> circleMaterials = new();
-        [SerializeField] private List<Material> hueSliderMaterials = new();
-        [SerializeField] private List<Material> satSliderMaterials = new();
-        [SerializeField] private List<Material> valSliderMaterials = new();
-
-        private Color _color = Color.red;
-        private float3 _hsv;
-        private ColorMode _mode = ColorMode.HSV;
-        
-        private float3 HSV
-        {
-            get => _hsv;
-            set
-            {
-                _hsv = value;
-                circleImage.material.SetFloat(Value, _hsv.z);
-                foreach (var image in sliderBackgrounds)
-                {
-                    image.material.SetFloat(H, _hsv.x);
-                    image.material.SetFloat(S, _hsv.y);
-                    image.material.SetFloat(V, _hsv.z);
-                }
-
-                colorCircle.Value = PolarToRect(_hsv.xy);
-                hueSlider.value = _hsv.x;
-                satSlider.value = _hsv.y;
-                valSlider.value = _hsv.z;
-                RefreshColor();
-            }
-        }
-
-        private Color Color
-        {
-            get => _color;
-            set
-            {
-                _color = value;
-                foreach (var handle in sliderHandles)
-                {
-                    handle.color = value;
-                }
-                previewImage.color = value;
-                RefreshHex();
-            }
-        }
-
-        private float2 RectToPolar(float2 rect)
-        {
-            var offset = rect * 2 - float2(1,1);
-            return float2(atan2(offset.y, -offset.x) / PI2 + .5f, length(offset));
-        }
-
-        private float2 PolarToRect(float2 polar)
-        {
-            float angle = (polar.x - 0.5f) * PI2;
-            float r = polar.y;
-            var offset = float2(-r * cos(angle), r * sin(angle));
-            return (offset + float2(1,1)) / 2;
-        }
-
-        private void RefreshColor()
-        {
-            Color = _mode switch
-            {
-                ColorMode.HSV => HSVtoRGB(HSV).ToColor().gamma,
-                ColorMode.HSL => HSLtoRGB(HSV).ToColor().gamma,
-                ColorMode.HCY => HCYtoRGB(HSV).ToColor().gamma,
-                _ => throw new ArgumentOutOfRangeException()
-            };
-        }
-
-        private void RefreshHSV()
-        {
-            HSV = _mode switch
-            {
-                ColorMode.HSV => RGBtoHSV(_color.linear.ToFloat3()),
-                ColorMode.HSL => RGBtoHSL(_color.linear.ToFloat3()),
-                ColorMode.HCY => RGBtoHCY(_color.linear.ToFloat3()),
-                _ => throw new ArgumentOutOfRangeException()
-            };
-        }
-        
-        private void RefreshHex() => hexStringField.text = '#' + ColorUtility.ToHtmlStringRGB(Color);
-
-        private void SetColorMode(ColorMode mode)
-        {
-            circleImage.material = circleMaterials[(int)mode];
-            sliderBackgrounds[0].material = hueSliderMaterials[(int)mode];
-            sliderBackgrounds[1].material = satSliderMaterials[(int)mode];
-            sliderBackgrounds[2].material = valSliderMaterials[(int)mode];
-        }
-        
-        // BUG: This should work, but neither setting the mode integer or shader keywords actually affects the material
-        // private void SetColorMode(Material mat, ColorMode mode)
-        // {
-        //     mat.SetInteger("_Mode", (int)mode);
-        //     var enumType = typeof(ColorMode);
-        //     var names = Enum.GetNames(enumType);
-        //     var values = Enum.GetValues(enumType);
-        //     for (var i = 0; i < names.Length; i++)
-        //     {
-        //         if((ColorMode)values.GetValue(i) == mode)
-        //         {
-        //             mat.EnableKeyword("_Mode_" + names[i]);
-        //             Debug.Log($"Enabling keyword {"_Mode_" + names[i]} on {mat.name}");
-        //         }
-        //         else
-        //         {
-        //             mat.DisableKeyword("_Mode_" + names[i]);
-        //             Debug.Log($"Disabling keyword {"_Mode_" + names[i]} on {mat.name}");
-        //         }
-        //     }
-        // }
-        
-        private void OnEnable()
-        {
-            colorCircle.ConstrainFunction = v =>
-            {
-                var offset = v * 2 - Vector2.one;
-                if (offset.sqrMagnitude > 1) offset = offset.normalized;
-                return (offset + Vector2.one) / 2;
-            };
-            colorCircle.OnValueChanged.AddListener(v => HSV = float3(RectToPolar(v),_hsv.z));
-            hueSlider.onValueChanged.AddListener(h => HSV = float3(h, _hsv.yz));
-            satSlider.onValueChanged.AddListener(s => HSV = float3(_hsv.x, s, _hsv.z));
-            valSlider.onValueChanged.AddListener(v => HSV = float3(_hsv.xy, v));
-            
-            var enumType = typeof(ColorMode);
-            var names = Enum.GetNames(enumType);
-            var values = Enum.GetValues(enumType);
-            modeEnum.Configure(this,
-                () => Array.IndexOf(values, _mode),
-                i =>
-                {
-                    _mode = (ColorMode)values.GetValue(i);
-                    SetColorMode(_mode);
-                    RefreshHSV();
-                }, names, new DisplayOptions(placeInContext:false));
-            RefreshHSV();
-            
-            hexStringField.onEndEdit.AddListener(s =>
-            {
-                if(ColorUtility.TryParseHtmlString(s, out Color color))
-                {
-                    Color = color;
-                    RefreshHSV();
-                }
-                else
-                    RefreshHex();
-            });
-            RefreshHex();
-        }
-
-        enum ColorMode
-        {
-            HSV,
-            HSL,
-            HCY
-        }
-    }
-}
-
-// E:\Projects\CultLib\src\GameCult.Unity\Assets\UI\Components\ConstrainedSlider2D.cs
-
-using System;
-using UnityEditor;
-using UnityEngine;
-using UnityEngine.Events;
-using UnityEngine.EventSystems;
-using UnityEngine.UI;
-
-namespace GameCult.Unity.UI.Components
-{
-    /// <summary>
-    /// A UI element similar to Slider but allowing free 2D movement of the handle within a rect,
-    /// constrained by an external validation function.
-    /// </summary>
-    /// <remarks>
-    /// The handle RectTransform is driven by the ConstrainedHandle. The position is normalized (0-1) in both axes.
-    /// An external Func<Vector2, Vector2> can be provided via constrainFunction to validate/constrain positions (e.g., to a circle for HSV picker).
-    /// When a change to the handle value occurs, a callback is sent to any registered listeners of UI.ConstrainedHandle.onValueChanged.
-    /// </remarks>
-    [AddComponentMenu("UI/Constrained Slider 2D")]
-    [ExecuteAlways]
-    [RequireComponent(typeof(RectTransform))]
-    public class ConstrainedSlider2D : Selectable, IDragHandler, IInitializePotentialDragHandler, ICanvasElement
-    {
-        [Serializable]
-        public class ConstrainedSlider2DEvent : UnityEvent<Vector2> { }
-
-        [SerializeField]
-        private RectTransform? handleRect;
-
-        public RectTransform? HandleRect
-        {
-            get => handleRect;
-            set
-            {
-                if (handleRect == value) return;
-                handleRect = value;
-                UpdateCachedReferences();
-                UpdateVisuals();
-            }
-        }
-
-        [Space]
-
-        [SerializeField]
-        private ConstrainedSlider2DEvent onValueChanged = new ConstrainedSlider2DEvent();
-
-        public ConstrainedSlider2DEvent OnValueChanged
-        {
-            get => onValueChanged;
-            set => onValueChanged = value;
-        }
-
-        /// <summary>
-        /// External function to constrain the normalized position (Vector2 in [0,1] range).
-        /// Defaults to identity (no constraint).
-        /// </summary>
-        public System.Func<Vector2, Vector2> ConstrainFunction { get; set; } = pos => pos;
-
-        // Private fields
-        private RectTransform? _handleContainerRect;
-        private Vector2 _offset = Vector2.zero;
-
-        // field is never assigned warning
-#pragma warning disable 649
-        private DrivenRectTransformTracker _tracker;
-#pragma warning restore 649
-
-        // This "delayed" mechanism is required for case 1037681.
-        private bool _delayedUpdateVisuals;
-
-        [SerializeField]
-        protected Vector2 value = new(0.5f, 0.5f);
-
-        /// <summary>
-        /// Normalized value (0-1 in both axes) representing handle position fraction within the container.
-        /// </summary>
-        public virtual Vector2 Value
-        {
-            get => value;
-            set => Set(value);
-        }
-
-        public virtual void SetValueWithoutNotify(Vector2 input)
-        {
-            Set(input, false);
-        }
-
-        protected ConstrainedSlider2D() { }
-
-#if UNITY_EDITOR
-        protected override void OnValidate()
-        {
-            base.OnValidate();
-
-            // OnValidate is called before OnEnable. We need to make sure not to touch any other objects before OnEnable is run.
-            if (IsActive())
-            {
-                UpdateCachedReferences();
-                // Update rects in next update since other things might affect them even if value didn't change.
-                _delayedUpdateVisuals = true;
-            }
-
-            if (!PrefabUtility.IsPartOfPrefabAsset(this) && !Application.isPlaying)
-                CanvasUpdateRegistry.RegisterCanvasElementForLayoutRebuild(this);
-        }
-#endif
-
-        public virtual void Rebuild(CanvasUpdate executing)
-        {
-#if UNITY_EDITOR
-            if (executing == CanvasUpdate.Prelayout)
-                OnValueChanged.Invoke(Value);
-#endif
-        }
-
-        /// <summary>
-        /// See ICanvasElement.LayoutComplete
-        /// </summary>
-        public virtual void LayoutComplete() { }
-
-        /// <summary>
-        /// See ICanvasElement.GraphicUpdateComplete
-        /// </summary>
-        public virtual void GraphicUpdateComplete() { }
-
-        protected override void OnEnable()
-        {
-            base.OnEnable();
-            UpdateCachedReferences();
-            Set(value, false);
-            // Update rects since they need to be initialized correctly.
-            UpdateVisuals();
-#if UNITY_EDITOR
-            Undo.undoRedoEvent -= OnUndoRedoEvent;
-            Undo.undoRedoEvent += OnUndoRedoEvent;
-#endif
-        }
-
-        protected override void OnDisable()
-        {
-#if UNITY_EDITOR
-            Undo.undoRedoEvent -= OnUndoRedoEvent;
-#endif
-            _tracker.Clear();
-            base.OnDisable();
-        }
-
-        /// <summary>
-        /// Update the rect based on the delayed update visuals.
-        /// Got around issue of calling SendMessage from OnValidate.
-        /// </summary>
-        protected virtual void Update()
-        {
-            if (_delayedUpdateVisuals)
-            {
-                _delayedUpdateVisuals = false;
-                Set(value, false);
-                UpdateVisuals();
-            }
-        }
-
-        protected override void OnDidApplyAnimationProperties()
-        {
-            Vector2 animatedValue = ComputeValueFromVisuals();
-            if (animatedValue != value)
-            {
-                value = animatedValue;
-                OnValueChanged.Invoke(value);
-            }
-            base.OnDidApplyAnimationProperties();
-        }
-
-        private Vector2 ComputeValueFromVisuals()
-        {
-            if (_handleContainerRect is null || handleRect is null) return value;
-            Vector2 size = _handleContainerRect.rect.size;
-            if (size == Vector2.zero) return value;
-            Vector2 delta = handleRect.anchoredPosition;
-            return new Vector2(
-                delta.x / size.x + 0.5f,
-                delta.y / size.y + 0.5f
-            );
-        }
-
-        void UpdateCachedReferences()
-        {
-            if (handleRect && handleRect != (RectTransform)transform)
-            {
-                _handleContainerRect = handleRect.parent as RectTransform;
-            }
-            else
-            {
-                handleRect = null;
-                _handleContainerRect = null;
-            }
-        }
-
-        protected virtual void Set(Vector2 input, bool sendCallback = true)
-        {
-            // Apply constraint and clamp
-            Vector2 newValue = ConstrainFunction(input);
-            newValue.x = Mathf.Clamp01(newValue.x);
-            newValue.y = Mathf.Clamp01(newValue.y);
-
-            if (value == newValue)
-                return;
-
-            value = newValue;
-            UpdateVisuals();
-            if (sendCallback)
-            {
-                UISystemProfilerApi.AddMarker("ConstrainedHandle.value", this);
-                onValueChanged.Invoke(newValue);
-            }
-        }
-
-        protected override void OnRectTransformDimensionsChange()
-        {
-            base.OnRectTransformDimensionsChange();
-
-            // This can be invoked before OnEnable is called. So we shouldn't be accessing other objects before OnEnable is called.
-            if (!IsActive())
-                return;
-
-            UpdateVisuals();
-        }
-
-#if UNITY_EDITOR
-        void OnUndoRedoEvent(in UndoRedoInfo undo)
-        {
-            UpdateVisuals();
-        }
-#endif
-
-        // Force-update the handle. Useful if you've changed the properties and want it to update visually.
-        private void UpdateVisuals()
-        {
-#if UNITY_EDITOR
-            if (!Application.isPlaying)
-                UpdateCachedReferences();
-#endif
-
-            _tracker.Clear();
-
-            if (_handleContainerRect != null && handleRect != null)
-            {
-                _tracker.Add(this, handleRect, DrivenTransformProperties.AnchoredPosition);
-                Vector2 size = _handleContainerRect.rect.size;
-                if (size != Vector2.zero)
-                {
-                    Vector2 delta = (value - new Vector2(0.5f, 0.5f)) * size;
-                    handleRect.anchoredPosition = delta;
-                }
-            }
-        }
-
-        // Update the handle's position based on the mouse.
-        void UpdateDrag(PointerEventData eventData, Camera cam)
-        {
-            RectTransform? containerRect = _handleContainerRect;
-            if (containerRect == null) return;
-
-            if (!RectTransformUtility.ScreenPointToLocalPointInRectangle(containerRect, eventData.position, cam, out var localCursor))
-                return;
-
-            Vector2 candidateAnchored = localCursor - _offset;
-            Vector2 size = containerRect.rect.size;
-            if (size == Vector2.zero) return;
-
-            Vector2 candidateNorm = new Vector2(
-                candidateAnchored.x / size.x + 0.5f,
-                candidateAnchored.y / size.y + 0.5f
-            );
-
-            // Apply constraint here as well for drag consistency
-            Vector2 constrainedNorm = ConstrainFunction(candidateNorm);
-            constrainedNorm.x = Mathf.Clamp01(constrainedNorm.x);
-            constrainedNorm.y = Mathf.Clamp01(constrainedNorm.y);
-
-            Value = constrainedNorm;
-        }
-
-        private bool MayDrag(PointerEventData eventData)
-        {
-            return IsActive() && IsInteractable() && eventData.button == PointerEventData.InputButton.Left;
-        }
-
-        public override void OnPointerDown(PointerEventData eventData)
-        {
-            if (!MayDrag(eventData))
-                return;
-
-            base.OnPointerDown(eventData);
-
-            _offset = Vector2.zero;
-            Camera cam = eventData.pressEventCamera;
-            if (handleRect != null && RectTransformUtility.RectangleContainsScreenPoint(handleRect, eventData.pointerPressRaycast.screenPosition, cam))
-            {
-                if (RectTransformUtility.ScreenPointToLocalPointInRectangle(handleRect, eventData.pointerPressRaycast.screenPosition, cam, out var localMousePos))
-                    _offset = localMousePos;
-            }
-            else
-            {
-                // Outside the handle - jump to this point instead
-                UpdateDrag(eventData, cam);
-            }
-        }
-
-        public virtual void OnDrag(PointerEventData eventData)
-        {
-            if (!MayDrag(eventData))
-                return;
-            UpdateDrag(eventData, eventData.pressEventCamera);
-        }
-
-        public override void OnMove(AxisEventData eventData)
-        {
-            if (!IsActive() || !IsInteractable())
-            {
-                base.OnMove(eventData);
-                return;
-            }
-
-            Set(value + eventData.moveVector * .05f);
-        }
-
-        public virtual void OnInitializePotentialDrag(PointerEventData eventData)
-        {
-            eventData.useDragThreshold = false;
-        }
-    }
-}
-
-// E:\Projects\CultLib\src\GameCult.Unity\Assets\UI\Components\EnumField.cs
-
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at https://mozilla.org/MPL/2.0/. */
-
-using System;
-using System.Reflection;
-using TMPro;
-using UnityEngine;
-using UnityEngine.Serialization;
-using UnityEngine.UI;
-
-namespace GameCult.Unity.UI.Components
-{
-    public class EnumField : LayoutComponent, IFieldHandler, ITextElement
-    {
-        [SerializeField] private Button? dropdown;
-        [SerializeField] private TextMeshProUGUI? dropdownLabel;
-
-        public TextMeshProUGUI? Text => dropdownLabel;
-        
-        public int Priority => 10;
-        
-        public bool CanHandle(Type type, PreferredInspectorAttribute? attr) =>
-            type.IsEnum && type.GetCustomAttribute<FlagsAttribute>() == null;
-
-        public void ConfigureForMember(IUIContext context, object target, MemberInfo member, DisplayOptions? displayOptions = null)
-        {
-            var fieldType = member is FieldInfo fi ? fi.FieldType : ((PropertyInfo)member).PropertyType;
-            var names = Enum.GetNames(fieldType);
-            var values = Enum.GetValues(fieldType);
-            
-            Configure(context, () =>
-            {
-                if(member is FieldInfo field) return Array.IndexOf(values, field.GetValue(target));
-                if(member is PropertyInfo property) return Array.IndexOf(values, property.GetValue(target));
-                return 0;
-            },i =>
-            {
-                if(member is FieldInfo field) field.SetValue(target, values.GetValue(i));
-                if(member is PropertyInfo property) property.SetValue(target, values.GetValue(i));
-            }, names, displayOptions);
-        }
-
-        public EnumField Configure(IUIContext context, Func<int> read, Action<int> write, string[] options, DisplayOptions? displayOptions = null)
-        {
-            if(displayOptions is not { PlaceInContext: true })
-                transform.SetParent(context.ContentRoot, false);
-            context.Register(gameObject);
-            
-            if (dropdownLabel is null || dropdown is null) return this;
-            
-            dropdown.onClick.AddListener(() =>
-            {
-                var modal = context.ShowModal();
-                if (modal == null) return;
-                for (var i = 0; i < options.Length; i++)
-                {
-                    var i1 = i;
-                    modal.Resolver.Resolve<ButtonField>("Enum")?.Configure(modal, options[i], () =>
-                    {
-                        write(i1);
-                        Destroy(modal.gameObject);
-                    });
-                }
-                modal.AlignVertical((RectTransform)dropdown.transform);
-            });
-
-            dropdown.interactable = displayOptions?.Interactable ?? true;
-            this.ApplyLayoutOptions(displayOptions);
-            this.ApplyTextOptions(displayOptions);
-            
-            context.Refresh += () => dropdownLabel.text = options[read()];
-            return this;
-        }
-    }
-
-    public static class EnumFieldGeneratorExtension
-    {
-        public static void AddEnumInspector(this IUIContext context,
-            string label,
-            Func<int> read,
-            Action<int> write,
-            string[] options,
-            string? prefabName = null) =>
-            context.Resolver.Resolve<HorizontalGroup>()?.Configure(context, 
-                context.Resolver.Resolve<Label>()?.Configure(context, label),
-                context.Resolver.Resolve<EnumField>(prefabName)?.Configure(context, read, write, options));
-
-        public static void AddEnumInspector<TEnum>(this IUIContext context,
-            string label,
-            Func<TEnum> read,
-            Action<TEnum> write,
-            string? prefabName = null) where TEnum : Enum
-        {
-            var enumType = typeof(TEnum);
-            var names = Enum.GetNames(enumType);
-            var values = Enum.GetValues(enumType);
-            context.Resolver.Resolve<HorizontalGroup>()?.Configure(context,
-                context.Resolver.Resolve<Label>()?.Configure(context, label),
-                context.Resolver.Resolve<EnumField>(prefabName)?.Configure(context,
-                    () => Array.IndexOf(values, read()),
-                    i => write((TEnum)values.GetValue(i)), names));
-        }
-        
-        public static void AddEnumField(this IUIContext context,
-            Func<int> read,
-            Action<int> write,
-            string[] options,
-            string? prefabName = null) =>
-            context.Resolver.Resolve<EnumField>(prefabName)?.Configure(context, read, write, options);
-
-        public static void AddEnumField<TEnum>(this IUIContext context,
-            Func<TEnum> read,
-            Action<TEnum> write,
-            string? prefabName = null) where TEnum : Enum
-        {
-            var enumType = typeof(TEnum);
-            var names = Enum.GetNames(enumType);
-            var values = Enum.GetValues(enumType);
-            context.Resolver.Resolve<EnumField>(prefabName)?.Configure(context, 
-                () => Array.IndexOf(values, read()),
-                i => write((TEnum)values.GetValue(i)), names);
-        }
-    }
-}
-
-// E:\Projects\CultLib\src\GameCult.Unity\Assets\UI\Components\GeneratorFoldout.cs
-
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at https://mozilla.org/MPL/2.0/. */
-
-using System;
-using System.Reflection;
-using TMPro;
-using UnityEngine;
-using UnityEngine.UI;
-
-namespace GameCult.Unity.UI.Components
-{
-    public class GeneratorFoldout : Generator, IFieldHandler, ILayoutElement, ITextElement
-    {
-        [SerializeField] private TextMeshProUGUI? label;
-        [SerializeField] private Image? foldoutIcon;
-        [SerializeField] private Button? button;
-        [SerializeField] private VerticalLayoutGroup? layoutGroup;
-        [SerializeField] private LayoutElement? layoutElement;
-        [SerializeField] private float foldoutRotationDamping = 10f;
-        [SerializeField] private int foldedPadding = -8;
-        [SerializeField] private int expandedPadding = 8;
-        public event Action<bool>? OnExpand;
-
-        private bool _expanded;
-        private float _targetFoldoutRotation;
-        private float _foldoutRotation;
-
-        public TextMeshProUGUI? Text => label;
-
-        public LayoutElement? LayoutElement => layoutElement;
-
-        public string Title
-        {
-            set
-            {
-                if (label != null) label.text = value;
-            }
-        }
-
-        public bool Expanded => _expanded;
-
-        public new void Awake()
-        {
-            button?.onClick.AddListener(ToggleExpand);
-            OnPropertyAdded += go => go.SetActive(_expanded);
-        }
-
-        public override void Update()
-        {
-            RefreshValues();
-            _foldoutRotation =
-                Mathf.Lerp(_foldoutRotation, _targetFoldoutRotation, foldoutRotationDamping * Time.deltaTime);
-            if (foldoutIcon is not null) foldoutIcon.transform.localRotation = Quaternion.Euler(0, 0, _foldoutRotation);
-        }
-
-        public void ToggleExpand() => SetExpanded(!_expanded, false);
-
-        public void SetExpanded(bool expanded, bool force)
-        {
-            _expanded = expanded;
-            if (layoutGroup != null)
-            {
-                var padding = layoutGroup.padding;
-                padding = new RectOffset(padding.left, padding.right, padding.top, _expanded ? expandedPadding : foldedPadding);
-                layoutGroup.padding = padding;
-            }
-
-            foreach (var property in Elements) property.SetActive(_expanded);
-            _targetFoldoutRotation = _expanded ? -90 : 0;
-            if (force)
-            {
-                _foldoutRotation = _targetFoldoutRotation;
-                if (foldoutIcon != null) foldoutIcon.transform.localRotation = Quaternion.Euler(0, 0, _foldoutRotation);
-            }
-            OnExpand?.Invoke(_expanded);
-        }
-
-        public int Priority => 10;
-        
-        public bool CanHandle(Type type, PreferredInspectorAttribute? attr) => 
-            type.IsEnum && type.GetCustomAttribute<FlagsAttribute>() != null;
-
-        public void ConfigureForMember(IUIContext context, object target, MemberInfo member, DisplayOptions? displayOptions = null)
-        {
-            if(displayOptions is not { PlaceInContext: true })
-                transform.SetParent(context.ContentRoot, false);
-            context.Register(gameObject);
-            if (label is null || button is null) return;
-            var type = member is FieldInfo fi ? fi.FieldType : ((PropertyInfo)member).PropertyType;
-            label.text = type.Name.SplitCamelCase();
-            var names = Enum.GetNames(type);
-            var values = Enum.GetValues(type);
-
-            // Get current bitfield as ulong for flexibility
-            Func<ulong> read = () => Convert.ToUInt64(member is FieldInfo f ? f.GetValue(target)
-                : ((PropertyInfo)member).GetValue(target));
-
-            // Build one checkbox per flag
-            foreach (var val in values)
-            {
-                ulong bit = Convert.ToUInt64(val);
-                string flagName = Enum.GetName(type, val) ?? "Default";
-
-                if (bit == 0)
-                {
-                    // Handle "None" specially
-                    this.AddBoolInspector(flagName,
-                        () => Convert.ToUInt64(read()) == 0,
-                        b =>
-                        {
-                            if (b)
-                            {
-                                // Setting "None" clears all bits
-                                var newEnum = Enum.ToObject(type, 0);
-                                if (member is FieldInfo f2) f2.SetValue(target, newEnum);
-                                else if (member is PropertyInfo p2) p2.SetValue(target, newEnum);
-                            }
-                            // Unsetting None is a no-op
-                        });
-                }
-                else
-                {
-                    this.AddBoolInspector(flagName,
-                        () => (read() & bit) != 0,
-                        b =>
-                        {
-                            ulong value = Convert.ToUInt64(read());
-                            if (b) value |= bit;
-                            else value &= ~bit;
-
-                            var newEnum = Enum.ToObject(type, value);
-                            if (member is FieldInfo f2) f2.SetValue(target, newEnum);
-                            else if (member is PropertyInfo p2) p2.SetValue(target, newEnum);
-                        });
-                }
-            }
-            
-            button.interactable = displayOptions?.Interactable??true;
-            this.ApplyLayoutOptions(displayOptions);
-            this.ApplyTextOptions(displayOptions);
-        }
-        
-        public GeneratorFoldout Configure<TEnum>(IUIContext context, Func<TEnum> read, Action<TEnum> write, DisplayOptions? displayOptions = null) where TEnum : Enum
-        {
-            if(displayOptions is not { PlaceInContext: true })
-                transform.SetParent(context.ContentRoot, false);
-            context.Register(gameObject);
-            if (label is null || button is null) return this;
-            label.text = typeof(TEnum).Name.SplitCamelCase();
-
-            foreach (TEnum val in Enum.GetValues(typeof(TEnum)))
-            {
-                ulong bit = Convert.ToUInt64(val);
-                string flagName = Enum.GetName(typeof(TEnum), val) ?? "Default";
-
-                if (bit == 0)
-                {
-                    this.AddBoolInspector(flagName,
-                        () => Convert.ToUInt64(read()) == 0,
-                        b =>
-                        {
-                            if (b)
-                            {
-                                write((TEnum)Enum.ToObject(typeof(TEnum), 0UL));
-                            }
-                        });
-                }
-                else
-                {
-                    this.AddBoolInspector(flagName,
-                        () => (Convert.ToUInt64(read()) & bit) != 0,
-                        b =>
-                        {
-                            ulong value = Convert.ToUInt64(read());
-                            if (b) value |= bit;
-                            else value &= ~bit;
-                            write((TEnum)Enum.ToObject(typeof(TEnum), value));
-                        });
-                }
-            }
-            
-            button.interactable = displayOptions?.Interactable??true;
-            this.ApplyLayoutOptions(displayOptions);
-            this.ApplyTextOptions(displayOptions);
-
-            return this;
-        }
-
-        public GeneratorFoldout Configure(IUIContext context, string labelText, DisplayOptions? displayOptions = null, params LayoutComponent[] children)
-        {
-            transform.SetParent(context.ContentRoot, false);
-            context.Register(gameObject);
-            
-            if (label is null || button is null) return this;
-            label.text = labelText;
-            button.interactable = displayOptions?.Interactable??true;
-            this.ApplyLayoutOptions(displayOptions);
-            this.ApplyTextOptions(displayOptions);
-            
-            foreach (var component in children)
-            {
-                if (component != null) AddComponent(component);
-            }
-            
-            return this;
-        }
-
-        public void AddComponent(LayoutComponent component)
-        {
-            component.transform.SetParent(ContentRoot, false);
-        }
-    }
-    public static class EnumGeneratorExtensions
-    {
-        public static void AddFlagsEnumInspector<TEnum>(
-            this IUIContext context, string label,
-            Func<TEnum> read, Action<TEnum> write)
-            where TEnum : Enum =>
-            context.Resolver.Resolve<HorizontalGroup>()?.Configure(context, 
-                context.Resolver.Resolve<Label>()?.Configure(context, label),
-            context.Resolver.Resolve<GeneratorFoldout>()?.Configure(context, read, write));
-    }
-}
-
-// E:\Projects\CultLib\src\GameCult.Unity\Assets\UI\Components\HorizontalGroup.cs
-
-using System;
-using UnityEngine;
-using UnityEngine.UI;
-#pragma warning disable CS8602 // Dereference of a possibly null reference.
-
-namespace GameCult.Unity.UI.Components
-{
-    public class HorizontalGroup : ResolverComponent, IUIContext
-    {
-        [SerializeField] private HorizontalLayoutGroup? layoutGroup;
-        private IUIContext? _parentContext;
-        
-        public IUIResolver Resolver => _parentContext.Resolver;
-        public RectTransform ContentRoot => (RectTransform)transform;
-        public Canvas Canvas => _parentContext.Canvas;
-        public RectTransform CanvasRoot => _parentContext.CanvasRoot;
-        public void Register(GameObject go) => _parentContext.Register(go);
-
-        public Action? Refresh
-        {
-            get => _parentContext.Refresh;
-            set => _parentContext.Refresh = value;
-        }
-
-        // public DisplayOptions InspectorLabelDisplayOptions => _parentContext.InspectorLabelDisplayOptions;
-        // public DisplayOptions InspectorFieldDisplayOptions => _parentContext.InspectorFieldDisplayOptions;
-
-        public HorizontalGroup Configure(IUIContext context, params ILayoutElement?[] children)
-        {
-            _parentContext = context;
-            transform.SetParent(context.ContentRoot, false);
-            context.Register(gameObject);
-            
-            foreach (var component in children)
-            {
-                if (component != null) AddComponent(component);
-            }
-
-            return this;
-        }
-
-        public void AddComponent(ILayoutElement component)
-        {
-            component.LayoutElement?.transform.SetParent(ContentRoot, false);
-        }
-    }
-}
-
-// E:\Projects\CultLib\src\GameCult.Unity\Assets\UI\Components\IncrementField.cs
-
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at https://mozilla.org/MPL/2.0/. */
-
-using System;
-using System.Reflection;
-using TMPro;
-using UnityEngine;
-using UnityEngine.UI;
-
-namespace GameCult.Unity.UI.Components
-{
-    public class IncrementField : LayoutComponent, IFieldHandler, ITextElement
-    {
-        [SerializeField] private TextMeshProUGUI? value;
-        [SerializeField] private Button? increment;
-        [SerializeField] private Button? decrement;
-
-        public int Priority => 100;
-
-        public TextMeshProUGUI? Text => value;
-
-        public bool CanHandle(Type type, PreferredInspectorAttribute? attr) =>
-            type == typeof(int) && attr is InspectableIncrementIntAttribute;
-
-        public void ConfigureForMember(IUIContext context, object target, MemberInfo member, DisplayOptions? displayOptions = null)
-        {
-            Func<int> read;
-            Action<int> write;
-            switch (member)
-            {
-                case FieldInfo field:
-                    read = () => (int)field.GetValue(target);
-                    write = i => field.SetValue(target, i);
-                    break;
-                case PropertyInfo property:
-                    read = () => (int)property.GetValue(target);
-                    write = i => property.SetValue(target, i);
-                    break;
-                default:
-                    return;
-            }
-            var range = member.GetCustomAttribute<InspectableIncrementIntAttribute>();
-            Configure(context, read, write, range.Min, range.Max, displayOptions);
-        }
-
-        public IncrementField Configure(IUIContext context,
-            Func<int> read,
-            Action<int> write,
-            int min,
-            int max,
-            DisplayOptions? displayOptions = null)
-        {
-            if(displayOptions is not { PlaceInContext: true })
-                transform.SetParent(context.ContentRoot, false);
-            context.Register(gameObject);
-            
-            if (value is null || increment is null || decrement is null) return this;
-            
-            value.text = read().ToString();
-            increment.onClick.AddListener(() => write(Mathf.Min(read() + 1, max)));
-            decrement.onClick.AddListener(() => write(Mathf.Max(read() - 1, min)));
-
-            context.Refresh += () =>
-            {
-                var val = read();
-                value.text = val.ToString();
-                increment.interactable = val < max;
-                decrement.interactable = val > min;
-            };
-            
-            this.ApplyLayoutOptions(displayOptions);
-            this.ApplyTextOptions(displayOptions);
-            
-            return this;
-        }
-    }
-
-    public static class IncrementFieldGeneratorExtension
-    {
-        public static void AddIncrementIntInspector(this IUIContext context,
-            string label,
-            Func<int> read,
-            Action<int> write,
-            int min,
-            int max,
-            string? prefabName = null) =>
-            context.Resolver.Resolve<HorizontalGroup>()?.Configure(context,
-                context.Resolver.Resolve<Label>()?.Configure(context, label),
-                context.Resolver.Resolve<IncrementField>(prefabName)?.Configure(context, read, write, min, max));
-        
-        public static void AddIncrementIntField(this IUIContext context,
-            string label,
-            Func<int> read,
-            Action<int> write,
-            int min,
-            int max,
-            string? prefabName = null) =>
-            context.Resolver.Resolve<IncrementField>(prefabName)?.Configure(context, read, write, min, max);
-    }
-}
-
-// E:\Projects\CultLib\src\GameCult.Unity\Assets\UI\Components\InputField.cs
-
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at https://mozilla.org/MPL/2.0/. */
-
-using System;
-using System.Collections.Generic;
-using System.Linq;
-using System.Reflection;
-using TMPro;
-using UnityEngine;
-
-namespace GameCult.Unity.UI.Components
-{
-    public class InputField : LayoutComponent, IFieldHandler, IMultipleTextElement
-    {
-        [SerializeField] private TMP_InputField? inputField;
-        [SerializeField] private TextMeshProUGUI[]? textMeshes;
-
-        public int Priority => 10;
-
-        public IEnumerable<TextMeshProUGUI> Text => textMeshes ?? Enumerable.Empty<TextMeshProUGUI>();
-
-        public bool CanHandle(Type type, PreferredInspectorAttribute? attr) =>
-            (type == typeof(string) || type == typeof(int) || type == typeof(float)) && attr == null;
-
-        public void ConfigureForMember(IUIContext context, object target, MemberInfo member, DisplayOptions? displayOptions = null)
-        {
-            var type = member switch
-            {
-                FieldInfo field => field.FieldType,
-                PropertyInfo property => property.PropertyType,
-                _ => null
-            };
-
-            if (type == null) return;
-
-            if (type == typeof(string))
-            {
-                Func<string> read;
-                Action<string> write;
-                switch (member)
-                {
-                    case FieldInfo field:
-                        read = () => (string)field.GetValue(target);
-                        write = s => field.SetValue(target, s);
-                        break;
-                    case PropertyInfo property:
-                        read = () => (string)property.GetValue(target);
-                        write = s => property.SetValue(target, s);
-                        break;
-                    default:
-                        return;
-                }
-                Configure(context, read, write);
-            }
-            else if (type == typeof(int))
-            {
-                Func<int> read;
-                Action<int> write;
-                switch (member)
-                {
-                    case FieldInfo field:
-                        read = () => (int)field.GetValue(target);
-                        write = i => field.SetValue(target, i);
-                        break;
-                    case PropertyInfo property:
-                        read = () => (int)property.GetValue(target);
-                        write = i => property.SetValue(target, i);
-                        break;
-                    default:
-                        return;
-                }
-                Configure(context, read, write);
-            }
-            else if (type == typeof(float))
-            {
-                Func<float> read;
-                Action<float> write;
-                switch (member)
-                {
-                    case FieldInfo field:
-                        read = () => (float)field.GetValue(target);
-                        write = f => field.SetValue(target, f);
-                        break;
-                    case PropertyInfo property:
-                        read = () => (float)property.GetValue(target);
-                        write = f => property.SetValue(target, f);
-                        break;
-                    default:
-                        return;
-                }
-                Configure(context, read, write);
-            }
-        }
-
-        public InputField Configure(IUIContext context, Func<string> read, Action<string> write, DisplayOptions? displayOptions = null)
-        {
-            if(displayOptions is not { PlaceInContext: true })
-                transform.SetParent(context.ContentRoot, false);
-            context.Register(gameObject);
-            if (inputField is null) return this;
-            inputField.contentType = TMP_InputField.ContentType.Standard;
-            inputField.text = read() ?? string.Empty;
-            inputField.onValueChanged.AddListener(v => write(v));
-
-            context.Refresh += () =>
-            {
-                var val = read() ?? string.Empty;
-                if (inputField.text != val) inputField.text = val;
-            };
-            
-            this.ApplyLayoutOptions(displayOptions);
-            this.ApplyTextOptions(displayOptions);
-            
-            return this;
-        }
-
-        public InputField Configure(IUIContext context, Func<int> read, Action<int> write, DisplayOptions? displayOptions = null)
-        {
-            if(displayOptions is not { PlaceInContext: true })
-                transform.SetParent(context.ContentRoot, false);
-            context.Register(gameObject);
-            if (inputField is null) return this;
-            inputField.contentType = TMP_InputField.ContentType.IntegerNumber;
-            inputField.text = read().ToString();
-            inputField.onValueChanged.AddListener(v =>
-            {
-                if (int.TryParse(v, out var i)) write(i);
-            });
-
-            context.Refresh += () =>
-            {
-                var val = read();
-                if (int.TryParse(inputField.text, out var existing) && existing != val)
-                    inputField.text = val.ToString();
-            };
-            
-            this.ApplyLayoutOptions(displayOptions);
-            this.ApplyTextOptions(displayOptions);
-
-            return this;
-        }
-
-        public InputField Configure(IUIContext context, Func<float> read, Action<float> write, DisplayOptions? displayOptions = null)
-        {
-            if(displayOptions is not { PlaceInContext: true })
-                transform.SetParent(context.ContentRoot, false);
-            context.Register(gameObject);
-            if (inputField is null) return this;
-            inputField.contentType = TMP_InputField.ContentType.DecimalNumber;
-            inputField.text = read().ToString("0.###");
-            inputField.onValueChanged.AddListener(v => write(float.Parse(v)));
-
-            context.Refresh += () =>
-            {
-                var val = read();
-                if (float.TryParse(inputField.text, out var existing) && Mathf.Abs(existing-val) < .001)
-                    inputField.text = val.ToString("0.###");
-            };
-            
-            this.ApplyLayoutOptions(displayOptions);
-            this.ApplyTextOptions(displayOptions);
-
-            return this;
-        }
-    }
-
-    public static class InputFieldGeneratorExtension
-    {
-        public static void AddStringInspector(this IUIContext context,
-            string label,
-            Func<string> read,
-            Action<string> write,
-            string? prefabName = null) =>
-            context.Resolver.Resolve<HorizontalGroup>()?.Configure(context,
-                context.Resolver.Resolve<Label>()?.Configure(context, label),
-                context.Resolver.Resolve<InputField>(prefabName)?.Configure(context, read, write));
-
-        public static void AddIntInspector(this IUIContext context,
-            string label,
-            Func<int> read,
-            Action<int> write,
-            string? prefabName = null) =>
-            context.Resolver.Resolve<HorizontalGroup>()?.Configure(context,
-                context.Resolver.Resolve<Label>()?.Configure(context, label),
-                context.Resolver.Resolve<InputField>(prefabName)?.Configure(context, read, write));
-
-        public static void AddFloatInspector(this IUIContext context,
-            string label,
-            Func<float> read,
-            Action<float> write,
-            string? prefabName = null) =>
-            context.Resolver.Resolve<HorizontalGroup>()?.Configure(context,
-                context.Resolver.Resolve<Label>()?.Configure(context, label),
-                context.Resolver.Resolve<InputField>(prefabName)?.Configure(context, read, write));
-        
-        public static void AddStringField(this IUIContext context,
-            Func<string> read,
-            Action<string> write,
-            DisplayOptions? displayOptions = null,
-            string? prefabName = null) =>
-            context.Resolver.Resolve<InputField>(prefabName)?.Configure(context, read, write);
-
-        public static void AddIntField(this IUIContext context,
-            Func<int> read,
-            Action<int> write,
-            DisplayOptions? displayOptions = null,
-            string? prefabName = null) =>
-            context.Resolver.Resolve<InputField>(prefabName)?.Configure(context, read, write);
-
-        public static void AddFloatField(this IUIContext context,
-            Func<float> read,
-            Action<float> write,
-            DisplayOptions? displayOptions = null,
-            string? prefabName = null) =>
-            context.Resolver.Resolve<InputField>(prefabName)?.Configure(context, read, write);
-    }
-}
-
-// E:\Projects\CultLib\src\GameCult.Unity\Assets\UI\Components\Label.cs
-
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at https://mozilla.org/MPL/2.0/. */
-
-using System;
-using System.Globalization;
-using System.Reflection;
-using TMPro;
-using UnityEngine;
-using UnityEngine.Serialization;
-
-namespace GameCult.Unity.UI.Components
-{
-    public class Label : LayoutComponent, IFieldHandler, ITextElement
-    {
-        [SerializeField] protected TextMeshProUGUI? label;
-        
-        public int Priority => 100;
-
-        public TextMeshProUGUI? Text => label;
-        
-        public bool CanHandle(Type type, PreferredInspectorAttribute? attr) =>
-            attr is InspectableReadOnlyLabelAttribute;
-
-        public void ConfigureForMember(IUIContext context, object target, MemberInfo member, DisplayOptions? displayOptions = null)
-        {
-            Type memberType;
-            Func<object> getValue;
-            switch (member)
-            {
-                case FieldInfo field:
-                    memberType = field.FieldType;
-                    getValue = () => field.GetValue(target);
-                    break;
-                case PropertyInfo property:
-                    memberType = property.PropertyType;
-                    getValue = () => property.GetValue(target);
-                    break;
-                default:
-                    return;
-            }
-
-            string FormattedRead()
-            {
-                var val = getValue();
-                if (val == null) return "Null";
-                return FormatValue(val, memberType);
-            }
-
-            Configure(context, FormattedRead, displayOptions);
-        }
-        
-        private string FormatValue(object val, Type type)
-        {
-            if (type == typeof(float))
-            {
-                return ((float)val).ToString("F3", CultureInfo.InvariantCulture);
-            }
-
-            if (type == typeof(double))
-            {
-                return ((double)val).ToString("F3", CultureInfo.InvariantCulture);
-            }
-
-            if (type == typeof(decimal))
-            {
-                return ((decimal)val).ToString("F3", CultureInfo.InvariantCulture);
-            }
-
-            return val.ToString();
-        }
-
-        public Label Configure(IUIContext context, Func<string> read, DisplayOptions? displayOptions = null)
-        {
-            if(displayOptions is not { PlaceInContext: true })
-                transform.SetParent(context.ContentRoot, false);
-            context.Register(gameObject);
-            if (label is null) return this;
-            label.text = read();
-
-            context.Refresh += () => label.text = read();
-            
-            this.ApplyLayoutOptions(displayOptions);
-            this.ApplyTextOptions(displayOptions);
-            
-            return this;
-        }
-
-        public Label Configure(IUIContext context, string labelText, DisplayOptions? displayOptions = null)
-        {
-            if(displayOptions is not { PlaceInContext: true })
-                transform.SetParent(context.ContentRoot, false);
-            context.Register(gameObject);
-            if (label is null) return this;
-            label.text = labelText;
-            
-            this.ApplyLayoutOptions(displayOptions);
-            this.ApplyTextOptions(displayOptions);
-
-            return this;
-        }
-    }
-
-    public static class LabelFieldGeneratorExtension
-    {
-        public static void AddLabelInspector(this IUIContext context,
-            string label,
-            Func<string> read) =>
-            context.Resolver.Resolve<HorizontalGroup>()?.Configure(context,
-                context.Resolver.Resolve<Label>()?.Configure(context, label),
-                context.Resolver.Resolve<Label>("Value")?.Configure(context, read));
-        
-        public static void AddLabel(this IUIContext context, Func<string> read, string? prefabName = null) =>
-            context.Resolver.Resolve<Label>(prefabName)?.Configure(context, read);
-        
-        public static void AddLabel(this IUIContext context, string label, string? prefabName = null) =>
-            context.Resolver.Resolve<Label>(prefabName)?.Configure(context, label);
-    }
-}
-
-// E:\Projects\CultLib\src\GameCult.Unity\Assets\UI\Components\LayoutComponent.cs
-
-using UnityEngine;
-using UnityEngine.UI;
-
-namespace GameCult.Unity.UI.Components
-{
-    public class LayoutComponent : ResolverComponent, ILayoutElement
-    {
-        [SerializeField] private LayoutElement? layoutElement;
-        
-        public float LayoutPriority
-        {
-            set
-            {
-                if (layoutElement != null) layoutElement.flexibleWidth = value;
-            }
-        }
-
-        public LayoutElement? LayoutElement => layoutElement;
-    }
-}
-
-// E:\Projects\CultLib\src\GameCult.Unity\Assets\UI\Components\Modal.cs
-
-using System;
-using System.Collections;
-using R3;
-using UnityEngine;
-using UnityEngine.UI;
-using Object = UnityEngine.Object;
-
-namespace GameCult.Unity.UI.Components
-{
-    /// <summary>
-    /// Generic modal UI element that can either center itself
-    /// or align to another RectTransform while staying within screen bounds.
-    /// </summary>
-    [RequireComponent(typeof(RectTransform))]
-    public class Modal : Generator
-    {
-        public event Action? BeforeDestroy;
-        [SerializeField] protected VerticalLayoutGroup? layoutGroup;
-
-        /// <summary>
-        /// Positions the modal below the given element (or above if there's no space), matching its width
-        /// </summary>
-        public void AlignVertical(RectTransform alignToElement)
-        {
-            var rectTransform = (RectTransform)transform;
-
-            LayoutRebuilder.ForceRebuildLayoutImmediate(rectTransform);
-            var modalSize = rectTransform.rect.size;
-
-            var pivot = rectTransform.pivot;
-
-            pivot.x = 0;
-            var scaleFactor = Canvas.scaleFactor;
-            var corners = new Vector3[4];
-            alignToElement.GetWorldCorners(corners);
-            var pivotTop = corners[0].y > modalSize.y * scaleFactor;
-            pivot.y = pivotTop ? 1 : 0;
-            rectTransform.pivot = pivot;
-            var delta = alignToElement.sizeDelta;
-            if (layoutGroup != null)
-                delta.x = alignToElement.sizeDelta.x + (layoutGroup.padding.left + layoutGroup.padding.right);
-            rectTransform.sizeDelta = delta;
-            rectTransform.position = pivotTop ? corners[0] : corners[1];
-            if (layoutGroup != null)
-                rectTransform.anchoredPosition += Vector2.left * layoutGroup.padding.left;
-        }
-
-        /// <summary>
-        /// Positions the modal along the right or left edge,
-        /// pivoting down or up, respectively, according to available space
-        /// </summary>
-        public void AlignEdge(RectTransform alignToElement)
-        {
-            var rectTransform = (RectTransform)transform;
-
-            LayoutRebuilder.ForceRebuildLayoutImmediate(rectTransform);
-            var modalSize = rectTransform.rect.size;
-            var canvasRect = CanvasRoot.rect;
-
-            var pivot = rectTransform.pivot;
-
-            var scaleFactor = Canvas.scaleFactor;
-            var corners = new Vector3[4];
-            alignToElement.GetWorldCorners(corners);
-            // Is there enough space for the element to drop down from the upper edge?
-            var pivotTop = corners[2].y > modalSize.y * scaleFactor;
-            pivot.y = pivotTop ? 1 : 0;
-            // Is there enough space for the modal to sit on the right side?
-            var pivotRight = corners[2].x / scaleFactor + modalSize.x < canvasRect.x;
-            pivot.x = pivotRight ? 1 : 0;
-            rectTransform.pivot = pivot;
-            rectTransform.position = pivotTop ? corners[0] : corners[1];
-        }
-
-        public void Center()
-        {
-            var rect = (RectTransform)transform;
-            rect.pivot = new Vector2(.5f,.5f);
-            rect.anchoredPosition = Vector2.zero;
-        }
-
-        private void OnDestroy()
-        {
-            BeforeDestroy?.Invoke();
-        }
-    }
-    
-    public static class ModalGeneratorExtensions
-    {
-        /// <summary>
-        /// Spawns a modal. Automatically creates and wires a click catcher that closes both.
-        /// </summary>
-        public static Modal? ShowModal(
-            this IUIContext context)
-        {
-            // Instantiate click catcher behind modal
-            var catcher = context.Resolver.Resolve<ClickCatcher>();
-            if (catcher == null) return null;
-            catcher.transform.SetParent(context.CanvasRoot, false);
-            catcher.transform.SetAsLastSibling();
-
-            // Instantiate modal on top
-            var modal = context.Resolver.Resolve<Modal>();
-            if (modal == null) return null;
-            modal.transform.SetParent(context.CanvasRoot, false);
-            modal.transform.SetAsLastSibling();
-            
-            // If modal is ever destroyed, also destroy click catcher
-            modal.BeforeDestroy += () => Object.Destroy(catcher.gameObject);
-
-            // Hook up dismissal
-            catcher.OnClick.Subscribe(_ => Object.Destroy(modal.gameObject));
-
-            return modal;
-        }
-    }
-
-}
-
-// E:\Projects\CultLib\src\GameCult.Unity\Assets\UI\Components\ResolverComponent.cs
-
-using UnityEngine;
-
-namespace GameCult.Unity.UI.Components
-{
-    public class ResolverComponent : MonoBehaviour
-    {
-    
-    }
-}
-
-// E:\Projects\CultLib\src\GameCult.Unity\Assets\UI\Components\SliderField.cs
-
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at https://mozilla.org/MPL/2.0/. */
-
-using System;
-using System.Reflection;
-using TMPro;
-using UnityEngine;
-using UnityEngine.UI;
-
-namespace GameCult.Unity.UI.Components
-{
-    public class SliderField : LayoutComponent, IFieldHandler
-    {
-        [SerializeField] private Slider? slider;
-
-        public int Priority => 100;
-
-        public bool CanHandle(Type type, PreferredInspectorAttribute? attr) =>
-            (type == typeof(float) && attr is InspectableRangedFloatAttribute) ||
-            (type == typeof(int) && attr is InspectableRangedIntAttribute);
-
-        public void ConfigureForMember(IUIContext context, object target, MemberInfo member, DisplayOptions? displayOptions = null)
-        {
-            var type = member switch
-            {
-                FieldInfo field => field.FieldType,
-                PropertyInfo property => property.PropertyType,
-                _ => null
-            };
-
-            if (type == null) return;
-            
-            if (type == typeof(float))
-            {
-                Func<float> read;
-                Action<float> write;
-                switch (member)
-                {
-                    case FieldInfo field:
-                        read = () => (float)field.GetValue(target);
-                        write = f => field.SetValue(target, f);
-                        break;
-                    case PropertyInfo property:
-                        read = () => (float)property.GetValue(target);
-                        write = f => property.SetValue(target, f);
-                        break;
-                    default:
-                        return;
-                }
-
-                var range = member.GetCustomAttribute<InspectableRangedFloatAttribute>();
-                Configure(context, read, write, range.Min, range.Max, displayOptions);
-            }
-            else if (type == typeof(int))
-            {
-                Func<int> read;
-                Action<int> write;
-                switch (member)
-                {
-                    case FieldInfo field:
-                        read = () => (int)field.GetValue(target);
-                        write = i => field.SetValue(target, i);
-                        break;
-                    case PropertyInfo property:
-                        read = () => (int)property.GetValue(target);
-                        write = i => property.SetValue(target, i);
-                        break;
-                    default:
-                        return;
-                }
-
-                var range = member.GetCustomAttribute<InspectableRangedIntAttribute>();
-                Configure(context, read, write, range.Min, range.Max, displayOptions);
-            }
-        }
-
-        public SliderField Configure(IUIContext context, Func<float> read, Action<float> write, float min, float max, DisplayOptions? displayOptions = null)
-        {
-            if(displayOptions is not { PlaceInContext: true })
-                transform.SetParent(context.ContentRoot, false);
-            context.Register(gameObject);
-            if (slider is null) return this;
-            slider.wholeNumbers = false;
-            slider.minValue = min;
-            slider.maxValue = max;
-            slider.value = read();
-            slider.onValueChanged.AddListener(f => write(f));
-
-            context.Refresh += () => slider.value = read();
-            
-            this.ApplyLayoutOptions(displayOptions);
-            
-            return this;
-        }
-
-        public SliderField Configure(IUIContext context, Func<int> read, Action<int> write, int min, int max, DisplayOptions? displayOptions = null)
-        {
-            if(displayOptions is not { PlaceInContext: true })
-                transform.SetParent(context.ContentRoot, false);
-            context.Register(gameObject);
-            if (slider is null) return this;
-            slider.wholeNumbers = true;
-            slider.minValue = min;
-            slider.maxValue = max;
-            slider.value = read();
-            slider.onValueChanged.AddListener(f => write(Mathf.RoundToInt(f)));
-
-            context.Refresh += () => slider.value = read();
-            
-            this.ApplyLayoutOptions(displayOptions);
-            
-            return this;
-        }
-    }
-
-    public static class RangedFloatFieldGeneratorExtension
-    {
-        public static void AddRangedFloatInspector(this IUIContext context,
-            string label,
-            Func<float> read,
-            Action<float> write,
-            float min,
-            float max,
-            string? prefabName = null) =>
-            context.Resolver.Resolve<HorizontalGroup>()?.Configure(context,
-                context.Resolver.Resolve<Label>()?.Configure(context, label),
-                context.Resolver.Resolve<SliderField>(prefabName)?.Configure(context, read, write, min, max));
-
-        public static void AddRangedIntInspector(this IUIContext context,
-            string label,
-            Func<int> read,
-            Action<int> write,
-            int min,
-            int max,
-            string? prefabName = null) =>
-            context.Resolver.Resolve<HorizontalGroup>()?.Configure(context,
-                context.Resolver.Resolve<Label>()?.Configure(context, label),
-                context.Resolver.Resolve<SliderField>(prefabName)?.Configure(context, read, write, min, max));
-        
-        public static void AddRangedFloatField(this IUIContext context,
-            Func<float> read,
-            Action<float> write,
-            float min,
-            float max,
-            DisplayOptions? displayOptions = null,
-            string? prefabName = null) =>
-            context.Resolver.Resolve<SliderField>(prefabName)?.Configure(context, read, write, min, max, displayOptions);
-        
-        public static void AddRangedIntField(this IUIContext context,
-            Func<int> read,
-            Action<int> write,
-            int min,
-            int max,
-            DisplayOptions? displayOptions = null,
-            string? prefabName = null) =>
-            context.Resolver.Resolve<SliderField>(prefabName)?.Configure(context, read, write, min, max, displayOptions);
-    }
-}
-
-// E:\Projects\CultLib\src\GameCult.Unity\Assets\UI\Components\TextButton.cs
-
-using System;
-using TMPro;
-using UnityEngine;
-using UnityEngine.EventSystems;
-using UnityEngine.UI;
-using static Unity.Mathematics.math;
-
-namespace GameCult.Unity.UI.Components
-{
-    public class TextButton : LayoutComponent, IPointerEnterHandler, IPointerExitHandler, ITextElement
-    {
-        [SerializeField] private Button? button;
-        [SerializeField] private TextMeshProUGUI? label;
-        [SerializeField] private float animationDuration;
-        [SerializeField] private float hoverSpacing;
-
-        private float _lerp;
-        private bool _hovering;
-
-        public TextMeshProUGUI? Text => label;
-
-        private void Update()
-        {
-            _lerp = saturate(_lerp + Time.deltaTime / animationDuration * (button is { interactable: true } && _hovering ? 1 : -1));
-            if (label is not null) label.characterSpacing = hoverSpacing * _lerp;
-        }
-
-        public void OnPointerEnter(PointerEventData eventData)
-        {
-            _hovering = true;
-        }
-
-        public void OnPointerExit(PointerEventData eventData)
-        {
-            _hovering = false;
-        }
-
-        public TextButton Configure(IUIContext context, string labelText, Action onClick, DisplayOptions? displayOptions = null)
-        {
-            if(displayOptions is not { PlaceInContext: true })
-                transform.SetParent(context.ContentRoot, false);
-            context.Register(gameObject);
-            if(button is null || label is null) return this;
-            
-            label.text = labelText;
-            button.onClick.AddListener(() => onClick());
-            
-            button.interactable = displayOptions?.Interactable??true;
-            this.ApplyLayoutOptions(displayOptions);
-            this.ApplyTextOptions(displayOptions);
-
-            return this;
-        }
-    }
-
-    public static class TextButtonGeneratorExtensions
-    {
-        public static void AddTextButton(this IUIContext context, string label, Action onClick, DisplayOptions? displayOptions = null) =>
-            context.Resolver.Resolve<TextButton>()?.Configure(context, label, onClick, displayOptions);
-    }
-}
diff --git a/tests/GameCult.Caching.ConsumerBuild/GameCult.Caching.ConsumerBuild.csproj b/tests/GameCult.Caching.ConsumerBuild/GameCult.Caching.ConsumerBuild.csproj
new file mode 100644
index 00000000..6401cb6c
--- /dev/null
+++ b/tests/GameCult.Caching.ConsumerBuild/GameCult.Caching.ConsumerBuild.csproj
@@ -0,0 +1,12 @@
+<Project Sdk="Microsoft.NET.Sdk">
+  <PropertyGroup>
+    <OutputType>Exe</OutputType>
+    <TargetFramework>net10.0</TargetFramework>
+    <Nullable>enable</Nullable>
+    <IsPackable>false</IsPackable>
+  </PropertyGroup>
+
+  <ItemGroup>
+    <ProjectReference Include="..\..\src\GameCult.Caching.MessagePack\GameCult.Caching.MessagePack.csproj" />
+  </ItemGroup>
+</Project>
diff --git a/tests/GameCult.Caching.ConsumerBuild/Program.cs b/tests/GameCult.Caching.ConsumerBuild/Program.cs
new file mode 100644
index 00000000..b0f15973
--- /dev/null
+++ b/tests/GameCult.Caching.ConsumerBuild/Program.cs
@@ -0,0 +1,14 @@
+using System.Collections.Generic;
+using GameCult.Caching;
+using MessagePack;
+
+// RefKeyedDictionaryCompilesInAConsumer: this project building is the test.
+System.Console.WriteLine(new ConsumerFaction().Standing.Count);
+
+[CultDocument("tests.consumer_faction", "tests.consumer_faction.v1")]
+[MessagePackObject]
+public sealed class ConsumerFaction
+{
+    [Key(0)] [CultName] public string Name { get; set; } = string.Empty;
+    [Key(1)] public Dictionary<CultRecordRef<ConsumerFaction>, float> Standing { get; set; } = new();
+}
diff --git a/tests/GameCult.Caching.InteropPeer/GameCult.Caching.InteropPeer.csproj b/tests/GameCult.Caching.InteropPeer/GameCult.Caching.InteropPeer.csproj
index 9a28830c..bd0f9ac7 100644
--- a/tests/GameCult.Caching.InteropPeer/GameCult.Caching.InteropPeer.csproj
+++ b/tests/GameCult.Caching.InteropPeer/GameCult.Caching.InteropPeer.csproj
@@ -8,9 +8,6 @@
 
   <ItemGroup>
     <ProjectReference Include="..\..\src\GameCult.Caching.MessagePack\GameCult.Caching.MessagePack.csproj" />
-    <ProjectReference Include="..\..\src\GameCult.Caching.MessagePack.Generator\GameCult.Caching.MessagePack.Generator.csproj"
-                      OutputItemType="Analyzer"
-                      ReferenceOutputAssembly="false" />
     <PackageReference Include="MessagePack" Version="3.1.7" />
   </ItemGroup>
 </Project>
diff --git a/tests/GameCult.Caching.InteropPeer/Program.cs b/tests/GameCult.Caching.InteropPeer/Program.cs
index 5de07335..11dadaad 100644
--- a/tests/GameCult.Caching.InteropPeer/Program.cs
+++ b/tests/GameCult.Caching.InteropPeer/Program.cs
@@ -16,10 +16,18 @@ static async Task<int> ProgramMainAsync(string[] args)
     {
         if (args.Length == 0)
         {
-            throw new InvalidOperationException("Expected mode: write | read");
+            throw new InvalidOperationException("Expected mode: write | read | write-routed <catalog.cc> <run.cc>");
         }
 
         var mode = args[0];
+        if (mode == "write-routed")
+        {
+            if (args.Length != 3)
+                throw new InvalidOperationException("Expected: write-routed <catalog.cc> <run.cc>");
+            WriteRouted(args[1], args[2]);
+            return 0;
+        }
+
         var options = ParseArgs(args.Skip(1).ToArray());
         var file = RequireArg(options, "file");
         switch (mode)
@@ -69,6 +77,32 @@ static async Task ReadAsync(string file)
     WriteJsonLine(note);
 }
 
+// Two routed single-file stores: each file is a complete single-store snapshot holding only its own type.
+static void WriteRouted(string catalogFile, string runFile)
+{
+    using var cache = new CultCache();
+    cache.AddBackingStore(new SingleFileMessagePackBackingStore(catalogFile), typeof(CultCacheInteropNote));
+    cache.AddBackingStore(new SingleFileMessagePackBackingStore(runFile), typeof(CultCacheInteropRunNote));
+    var note = new CultCacheInteropNote
+    {
+        DocumentId = "note:csharp-routed",
+        AuthorRuntimeId = "csharp",
+        Title = "csharp wrote a routed catalog note",
+        Body = "One home store per document type.",
+        Tags = ["csharp", "routed"]
+    };
+    var runNote = new CultCacheInteropRunNote
+    {
+        DocumentId = "run-note:csharp-routed",
+        AuthorRuntimeId = "csharp",
+        Body = "The run store holds only run records."
+    };
+    cache.UpsertAsync(note, new CultRecordHandle<CultCacheInteropNote>(new CultRecordKey(note.DocumentId)));
+    cache.UpsertAsync(runNote, new CultRecordHandle<CultCacheInteropRunNote>(new CultRecordKey(runNote.DocumentId)));
+    cache.FlushAllBackingStores();
+    WriteJsonLine(note);
+}
+
 static CultCache BuildCache(string file)
 {
     var cache = new CultCache();
@@ -132,3 +166,13 @@ public sealed class CultCacheInteropNote
     [Key(4)] public string Body { get; set; } = string.Empty;
     [Key(5)] public string[] Tags { get; set; } = Array.Empty<string>();
 }
+
+[CultDocument("cultcache.interop-run-note", "cultcache.interop_run_note.v1")]
+[MessagePackObject]
+public sealed class CultCacheInteropRunNote
+{
+    [Key(0)] public string SchemaVersion { get; set; } = "cultcache.interop_run_note.v1";
+    [Key(1)] [CultName] public string DocumentId { get; set; } = string.Empty;
+    [Key(2)] public string AuthorRuntimeId { get; set; } = string.Empty;
+    [Key(3)] public string Body { get; set; } = string.Empty;
+}
diff --git a/tests/GameCult.Caching.Tests/AssemblyInfo.cs b/tests/GameCult.Caching.Tests/AssemblyInfo.cs
new file mode 100644
index 00000000..f3a1dfa1
--- /dev/null
+++ b/tests/GameCult.Caching.Tests/AssemblyInfo.cs
@@ -0,0 +1,44 @@
+#nullable enable
+using GameCult.Caching.MessagePack;
+using GameCult.Caching.Tests;
+using MessagePack;
+using MessagePack.Formatters;
+
+[assembly: CultCacheFormatterResolver(typeof(PairResolver))]
+
+namespace GameCult.Caching.Tests
+{
+    public struct Pair
+    {
+        public float A;
+        public float B;
+    }
+
+    public sealed class PairResolver : IFormatterResolver
+    {
+        public static readonly IFormatterResolver Instance = new PairResolver();
+
+        public IMessagePackFormatter<T>? GetFormatter<T>()
+        {
+            return typeof(T) == typeof(Pair) ? (IMessagePackFormatter<T>)(object)PairFormatter.Instance : null;
+        }
+
+        private sealed class PairFormatter : IMessagePackFormatter<Pair>
+        {
+            public static readonly PairFormatter Instance = new();
+
+            public void Serialize(ref MessagePackWriter writer, Pair value, MessagePackSerializerOptions options)
+            {
+                writer.WriteArrayHeader(2);
+                writer.Write(value.A);
+                writer.Write(value.B);
+            }
+
+            public Pair Deserialize(ref MessagePackReader reader, MessagePackSerializerOptions options)
+            {
+                if (reader.ReadArrayHeader() != 2) throw new MessagePackSerializationException("Pair is a two-element array.");
+                return new Pair { A = reader.ReadSingle(), B = reader.ReadSingle() };
+            }
+        }
+    }
+}
diff --git a/tests/GameCult.Caching.Tests/BackingStoreTests.cs b/tests/GameCult.Caching.Tests/BackingStoreTests.cs
index e08a2ebc..86613c52 100644
--- a/tests/GameCult.Caching.Tests/BackingStoreTests.cs
+++ b/tests/GameCult.Caching.Tests/BackingStoreTests.cs
@@ -2,6 +2,8 @@
 using System;
 using System.IO;
 using System.Linq;
+using System.Reflection;
+using System.Threading;
 using System.Threading.Tasks;
 using GameCult.Caching;
 using GameCult.Caching.MessagePack;
@@ -54,6 +56,106 @@ namespace GameCult.Caching.Tests
             }
         }
 
+        [Test]
+        public async Task SingleFileMessagePackBackingStore_PullAll_SeesFileCreatedAfterReaderOpened()
+        {
+            var filePath = Path.Combine(Path.GetTempPath(), $"cultlib-tests-{Guid.NewGuid():N}.msgpack");
+
+            try
+            {
+                var readCache = new CultCache();
+                readCache.AddBackingStore(new SingleFileMessagePackBackingStore(filePath));
+                await readCache.PullAllBackingStoresAsync();
+
+                var observedChanges = 0;
+                using var subscription = readCache.Watch<NamedTestEntry>()
+                    .Subscribe(_ => observedChanges++);
+
+                var writeStore = new SingleFileMessagePackBackingStore(filePath);
+                var writeCache = new CultCache();
+                writeCache.AddBackingStore(writeStore);
+                var handle = await writeCache.AddAsync(new NamedTestEntry
+                {
+                    Name = "external-writer",
+                    Value = "visible-after-refresh"
+                });
+                writeStore.PushAll();
+
+                await readCache.PullAllBackingStoresAsync();
+
+                Assert.That(readCache.Get<NamedTestEntry>(handle.Key)?.Value, Is.EqualTo("visible-after-refresh"));
+                Assert.That(observedChanges, Is.EqualTo(1));
+
+                await readCache.PullAllBackingStoresAsync();
+                Assert.That(observedChanges, Is.EqualTo(1), "an unchanged snapshot must not replay its documents");
+
+                await writeCache.UpsertAsync(new NamedTestEntry
+                {
+                    Name = "external-writer",
+                    Value = "updated-once"
+                }, handle);
+                writeStore.PushAll();
+                await readCache.PullAllBackingStoresAsync();
+
+                Assert.That(readCache.Get<NamedTestEntry>(handle.Key)?.Value, Is.EqualTo("updated-once"));
+                Assert.That(observedChanges, Is.EqualTo(2));
+            }
+            finally
+            {
+                if (File.Exists(filePath))
+                {
+                    File.Delete(filePath);
+                }
+            }
+        }
+
+        [Test]
+        public async Task SingleFileMessagePackBackingStore_PullAll_DoesNotEraseUnflushedLocalMutations()
+        {
+            var filePath = Path.Combine(Path.GetTempPath(), $"cultlib-tests-{Guid.NewGuid():N}.msgpack");
+
+            try
+            {
+                using (var seed = await CultCacheMessagePack.OpenAsync(filePath))
+                {
+                    await seed.UpsertAsync(new NamedTestEntry
+                    {
+                        Name = "persisted",
+                        Value = "before-local-write"
+                    });
+                    await seed.FlushAsync();
+                }
+
+                CultRecordHandle<NamedTestEntry> localHandle;
+                using (var cache = await CultCacheMessagePack.OpenAsync(filePath))
+                {
+                    localHandle = await cache.UpsertAsync(new NamedTestEntry
+                    {
+                        Name = "local",
+                        Value = "must-survive-pull"
+                    });
+
+                    Assert.That(cache.IsDirty, Is.True);
+                    await cache.PullAllBackingStoresAsync();
+
+                    Assert.That(cache.Get<NamedTestEntry>(localHandle.Key)?.Value,
+                        Is.EqualTo("must-survive-pull"));
+                    Assert.That(cache.IsDirty, Is.True,
+                        "pulling a clean disk snapshot must not pardon staged local mutations");
+                    await cache.FlushAsync();
+                }
+
+                using var reopened = await CultCacheMessagePack.OpenAsync(filePath);
+                Assert.That(reopened.Get<NamedTestEntry>(localHandle.Key)?.Value,
+                    Is.EqualTo("must-survive-pull"));
+            }
+            finally
+            {
+                if (File.Exists(filePath))
+                    File.Delete(filePath);
+            }
+        }
+
         [Test]
         public async Task CultCache_DirtyState_Tracks_Mutations_And_ExplicitFlush()
         {
@@ -76,14 +178,11 @@ namespace GameCult.Caching.Tests
 
                 Assert.That(cache.IsDirty, Is.True);
                 Assert.That(store.IsDirty, Is.True);
-                Assert.That(cache.LastSuccessfulFlushAtUtc, Is.Null);
 
                 cache.FlushAllBackingStores();
 
                 Assert.That(cache.IsDirty, Is.False);
                 Assert.That(store.IsDirty, Is.False);
-                Assert.That(cache.LastSuccessfulFlushAtUtc, Is.Not.Null);
-                Assert.That(store.LastSuccessfulFlushAtUtc, Is.Not.Null);
             }
             finally
             {
@@ -111,8 +210,10 @@ namespace GameCult.Caching.Tests
                 cache.Dispose();
 
                 var reopened = await CultCacheMessagePack.OpenAsync(filePath);
-                Assert.That(reopened.TryGet(handle.Key, out NamedTestEntry? loaded), Is.True);
-                Assert.That(loaded!.Value, Is.EqualTo("magic"));
+                Assert.That(reopened.TryGet<NamedTestEntry>(handle.Key, out var loaded), Is.True);
+                Assert.That(loaded?.Value, Is.EqualTo("magic"));
+                Assert.That(reopened.TryGet<NamedTestEntry>(new CultRecordKey("absent"), out var missing), Is.False);
+                Assert.That(missing, Is.Null);
             }
             finally
             {
@@ -123,44 +224,6 @@ namespace GameCult.Caching.Tests
             }
         }
 
-        [Test]
-        public async Task CultCacheManagedDocument_Keeps_Poco_Surface_And_Updates_Soa_Storage()
-        {
-            var cache = new CultCache();
-            var aliceKey = new CultRecordKey("entity:alice");
-            var managed = cache.Document<TransformEntry>(aliceKey);
-            TransformEntry? observed = null;
-            using var subscription = managed.Watch().Subscribe(value => observed = value);
-
-            await managed.ReplaceAsync(new TransformEntry
-            {
-                Name = "alice",
-                PositionX = 1.5f,
-                PositionY = 2.5f,
-                Health = 90
-            });
-            await cache.UpsertAsync(new TransformEntry
-            {
-                Name = "bob",
-                PositionX = 3.5f,
-                PositionY = 4.5f,
-                Health = 80
-            }, new CultRecordHandle<TransformEntry>(new CultRecordKey("entity:bob")));
-
-            managed.Value!.Health = 70;
-            await managed.CommitAsync();
-
-            var table = cache.Soa<TransformEntry>();
-
-            Assert.That(table.Count, Is.EqualTo(2));
-            Assert.That(table.Keys.Select(key => key.Value).ToArray(), Is.EqualTo(new[] { "entity:alice", "entity:bob" }));
-            Assert.That(table.Column<float>(nameof(TransformEntry.PositionX)).Span.ToArray(), Is.EqualTo(new[] { 1.5f, 3.5f }));
-            Assert.That(table.Column<float>(nameof(TransformEntry.PositionY)).Span.ToArray(), Is.EqualTo(new[] { 2.5f, 4.5f }));
-            Assert.That(table.Column<int>(nameof(TransformEntry.Health)).Span.ToArray(), Is.EqualTo(new[] { 70, 80 }));
-            Assert.That(observed, Is.Not.Null);
-            Assert.That(observed!.Health, Is.EqualTo(70));
-        }
-
         [Test]
         public async Task DirectoryMessagePackBackingStore_Writes_Record_Pages_Without_Rewriting_Cold_Records()
         {
@@ -221,6 +284,467 @@ namespace GameCult.Caching.Tests
             }
         }
 
+        [Test]
+        public async Task DirectoryMessagePackBackingStore_Open_CreatesNothing_UntilAWrite()
+        {
+            var root = Path.Combine(Path.GetTempPath(), $"cultlib-tests-{Guid.NewGuid():N}");
+            Directory.CreateDirectory(root);
+            var filePath = Path.Combine(root, "store.cc");
+            var recordsPath = DirectoryMessagePackBackingStore.DefaultRecordDirectoryPath(filePath);
+
+            try
+            {
+                foreach (var readOnly in new[] { true, false })
+                {
+                    using (await CultCacheMessagePack.OpenAsync(filePath, new CultCacheOpenOptions { UseDirectoryStore = true, ReadOnly = readOnly }))
+                    {
+                    }
+
+                    Assert.That(Directory.GetFileSystemEntries(root), Is.Empty,
+                        $"opening a missing directory store (read-only {readOnly}) created files");
+                }
+
+                Directory.CreateDirectory(recordsPath);
+                foreach (var readOnly in new[] { true, false })
+                {
+                    using (var cache = await CultCacheMessagePack.OpenAsync(filePath, new CultCacheOpenOptions { UseDirectoryStore = true, ReadOnly = readOnly }))
+                    {
+                        Assert.That(cache.AllStoredDocuments, Is.Empty);
+                    }
+
+                    Assert.That(Directory.GetFileSystemEntries(recordsPath), Is.Empty,
+                        $"opening a manifest-less directory store (read-only {readOnly}) created a lock");
+                    Assert.That(File.Exists(filePath), Is.False);
+                }
+
+                using (var writer = await CultCacheMessagePack.OpenAsync(filePath, new CultCacheOpenOptions { UseDirectoryStore = true }))
+                {
+                    await writer.UpsertAsync(new NamedTestEntry { Name = "first-write", Value = "creates the store" });
+                    await writer.FlushAsync();
+                }
+
+                Assert.That(File.Exists(filePath), Is.True);
+                Assert.That(File.Exists(Path.Combine(recordsPath, ".commit.lock")), Is.True);
+                Assert.That(Directory.GetFiles(recordsPath, "*.msgpack"), Has.Length.EqualTo(1));
+            }
+            finally
+            {
+                if (Directory.Exists(root)) Directory.Delete(root, recursive: true);
+            }
+        }
+
+        [Test]
+        public async Task CultCacheMessagePack_OpenAsync_HydratesPersistedGlobal()
+        {
+            var filePath = Path.Combine(Path.GetTempPath(), $"cultlib-tests-{Guid.NewGuid():N}.cc");
+            var recordsPath = DirectoryMessagePackBackingStore.DefaultRecordDirectoryPath(filePath);
+            var registry = CultDocumentRegistry.ForTypes(new[] { typeof(GlobalTestEntry) });
+
+            try
+            {
+                using (var seed = await CultCacheMessagePack.OpenAsync(
+                           filePath,
+                           new CultCacheOpenOptions { Registry = registry, UseDirectoryStore = true }))
+                {
+                    Assert.That(seed.GetGlobal<GlobalTestEntry>(), Is.Null, "opening a store invented a global");
+                    await seed.UpsertAsync(new GlobalTestEntry { Value = "durable authority" });
+                    await seed.FlushAsync();
+                }
+
+                using var reopened = await CultCacheMessagePack.OpenAsync(
+                    filePath,
+                    new CultCacheOpenOptions { Registry = registry, UseDirectoryStore = true });
+
+                Assert.That(reopened.GetGlobal<GlobalTestEntry>()?.Value, Is.EqualTo("durable authority"));
+                Assert.That(reopened.IsDirty, Is.False, "hydrating a global staged a write");
+            }
+            finally
+            {
+                if (File.Exists(filePath)) File.Delete(filePath);
+                if (Directory.Exists(recordsPath)) Directory.Delete(recordsPath, recursive: true);
+            }
+        }
+
+        [Test]
+        public async Task DirectoryMessagePackBackingStore_CleanFlush_DoesNotRewriteManifest()
+        {
+            var filePath = Path.Combine(Path.GetTempPath(), $"cultlib-tests-{Guid.NewGuid():N}.cc");
+            var recordsPath = DirectoryMessagePackBackingStore.DefaultRecordDirectoryPath(filePath);
+
+            try
+            {
+                using (var seed = await CultCacheMessagePack.OpenAsync(
+                           filePath,
+                           new CultCacheOpenOptions { UseDirectoryStore = true }))
+                {
+                    await seed.UpsertAsync(new NamedTestEntry
+                    {
+                        Name = "clean-flush",
+                        Value = "must-remain-durable"
+                    });
+                    await seed.FlushAsync();
+                }
+
+                using var cache = await CultCacheMessagePack.OpenAsync(
+                    filePath,
+                    new CultCacheOpenOptions { UseDirectoryStore = true });
+                Assert.That(cache.IsDirty, Is.False);
+
+                using (new FileStream(filePath, FileMode.Open, FileAccess.Read, FileShare.Read))
+                {
+                    Assert.That(async () => await cache.FlushAsync(), Throws.Nothing,
+                        "a clean indexed store must not touch its durable manifest");
+                }
+
+                Assert.That(cache.IsDirty, Is.False);
+            }
+            finally
+            {
+                if (File.Exists(filePath)) File.Delete(filePath);
+                if (Directory.Exists(recordsPath)) Directory.Delete(recordsPath, recursive: true);
+            }
+        }
+
+        [Test]
+        public async Task DirectoryMessagePackBackingStore_Manifest_Indexes_Pages_By_Content_Hash_Only()
+        {
+            var filePath = Path.Combine(Path.GetTempPath(), $"cultlib-tests-{Guid.NewGuid():N}.cc");
+            var recordsPath = DirectoryMessagePackBackingStore.DefaultRecordDirectoryPath(filePath);
+
+            try
+            {
+                CultRecordHandle<NamedTestEntry> hot;
+                CultRecordHandle<NamedTestEntry> cold;
+                using (var seed = await CultCacheMessagePack.OpenAsync(
+                           filePath,
+                           new CultCacheOpenOptions { UseDirectoryStore = true }))
+                {
+                    hot = await seed.UpsertAsync(new NamedTestEntry { Name = "hot", Value = "hydrate-me" });
+                    cold = await seed.UpsertAsync(new NamedTestEntry
+                    {
+                        Name = "cold",
+                        Value = new string('c', 1024 * 1024)
+                    });
+                    await seed.FlushAsync();
+                }
+
+                var manifest = CultDocumentMessagePackSerialization.DeserializeSnapshot(File.ReadAllBytes(filePath));
+                Assert.That(manifest.FormatVersion, Is.EqualTo("cultcache.store.v4.directory-content-addressed-pages"));
+                Assert.That(manifest.Records, Has.Length.EqualTo(2));
+                Assert.That(manifest.Records.All(record => record.Payload.Length == 32), Is.True,
+                    "the hot index carries only the SHA-256 page identity, never the document body");
+
+                using var reopened = await CultCacheMessagePack.OpenAsync(
+                    filePath,
+                    new CultCacheOpenOptions { UseDirectoryStore = true });
+                Assert.That(reopened.Get<NamedTestEntry>(hot.Key)?.Value, Is.EqualTo("hydrate-me"));
+                Assert.That(reopened.Get<NamedTestEntry>(cold.Key)?.Value.Length, Is.EqualTo(1024 * 1024));
+            }
+            finally
+            {
+                if (File.Exists(filePath))
+                    File.Delete(filePath);
+                if (Directory.Exists(recordsPath))
+                    Directory.Delete(recordsPath, recursive: true);
+            }
+        }
+
+        [Test]
+        public async Task DirectoryMessagePackBackingStore_ConcurrentInstances_MergeUnderOneCommitLease()
+        {
+            var filePath = Path.Combine(Path.GetTempPath(), $"cultlib-tests-{Guid.NewGuid():N}.cc");
+            var recordsPath = DirectoryMessagePackBackingStore.DefaultRecordDirectoryPath(filePath);
+            try
+            {
+                var firstStore = new DirectoryMessagePackBackingStore(filePath, recordsPath);
+                var firstCache = new CultCache();
+                firstCache.AddBackingStore(firstStore);
+                var secondStore = new DirectoryMessagePackBackingStore(filePath, recordsPath);
+                var secondCache = new CultCache();
+                secondCache.AddBackingStore(secondStore);
+                var first = await firstCache.UpsertAsync(new NamedTestEntry { Name = "first-process", Value = "one" });
+                var second = await secondCache.UpsertAsync(new NamedTestEntry { Name = "second-process", Value = "two" });
+
+                await Task.WhenAll(
+                    Task.Run(() => firstStore.PushAll()),
+                    Task.Run(() => secondStore.PushAll()));
+
+                using var reopened = await CultCacheMessagePack.OpenAsync(
+                    filePath,
+                    new CultCacheOpenOptions { UseDirectoryStore = true });
+                Assert.That(reopened.Get<NamedTestEntry>(first.Key)?.Value, Is.EqualTo("one"));
+                Assert.That(reopened.Get<NamedTestEntry>(second.Key)?.Value, Is.EqualTo("two"));
+            }
+            finally
+            {
+                if (File.Exists(filePath)) File.Delete(filePath);
+                if (Directory.Exists(recordsPath)) Directory.Delete(recordsPath, recursive: true);
+            }
+        }
+
+        [Test]
+        public async Task DirectoryMessagePackBackingStore_ReleasesGenerationLeaseBeforePublishingObservers()
+        {
+            var filePath = Path.Combine(Path.GetTempPath(), $"cultlib-tests-{Guid.NewGuid():N}.cc");
+            var recordsPath = DirectoryMessagePackBackingStore.DefaultRecordDirectoryPath(filePath);
+            try
+            {
+                var readerStore = new DirectoryMessagePackBackingStore(filePath, recordsPath);
+                var readerCache = new CultCache();
+                readerCache.AddBackingStore(readerStore);
+
+                var writerStore = new DirectoryMessagePackBackingStore(filePath, recordsPath);
+                var writerCache = new CultCache();
+                writerCache.AddBackingStore(writerStore);
+                await writerCache.UpsertAsync(new NamedTestEntry { Name = "source", Value = "one" });
+                writerStore.PushAll();
+
+                var observerRan = false;
+                using var subscription = readerCache.Watch<NamedTestEntry>().Subscribe(_ =>
+                {
+                    if (observerRan)
+                        return;
+                    observerRan = true;
+                    readerCache.UpsertAsync(new NamedTestEntry { Name = "observer", Value = "two" })
+                        .GetAwaiter()
+                        .GetResult();
+                    readerStore.PushAll();
+                });
+
+                Assert.That(() => readerStore.PullAll(), Throws.Nothing);
+                Assert.That(observerRan, Is.True);
+                using var reopened = await CultCacheMessagePack.OpenAsync(
+                    filePath,
+                    new CultCacheOpenOptions { UseDirectoryStore = true });
+                Assert.That(reopened.GetAll<NamedTestEntry>().Select(value => value.Name),
+                    Is.EquivalentTo(new[] { "source", "observer" }));
+            }
+            finally
+            {
+                if (File.Exists(filePath)) File.Delete(filePath);
+                if (Directory.Exists(recordsPath)) Directory.Delete(recordsPath, recursive: true);
+            }
+        }
+
+        [Test]
+        public async Task DirectoryMessagePackBackingStore_PullsOnlyExternalRecordDeltas()
+        {
+            var filePath = Path.Combine(Path.GetTempPath(), $"cultlib-tests-{Guid.NewGuid():N}.cc");
+            var recordsPath = DirectoryMessagePackBackingStore.DefaultRecordDirectoryPath(filePath);
+
+            try
+            {
+                using var reader = await CultCacheMessagePack.OpenAsync(
+                    filePath,
+                    new CultCacheOpenOptions { UseDirectoryStore = true });
+                var observedChanges = 0;
+                using var subscription = reader.Watch<NamedTestEntry>().Subscribe(_ => observedChanges++);
+
+                using var writer = await CultCacheMessagePack.OpenAsync(
+                    filePath,
+                    new CultCacheOpenOptions { UseDirectoryStore = true });
+                var handle = await writer.UpsertAsync(new NamedTestEntry
+                {
+                    Name = "external-command",
+                    Value = "once"
+                });
+                await writer.FlushAsync();
+
+                await reader.PullAllBackingStoresAsync();
+                await reader.PullAllBackingStoresAsync();
+
+                Assert.That(reader.Get<NamedTestEntry>(handle.Key)?.Value, Is.EqualTo("once"));
+                Assert.That(observedChanges, Is.EqualTo(1), "unchanged paged records must not replay");
+            }
+            finally
+            {
+                if (File.Exists(filePath))
+                    File.Delete(filePath);
+                if (Directory.Exists(recordsPath))
+                    Directory.Delete(recordsPath, recursive: true);
+            }
+        }
+
+        [Test]
+        public async Task DirectoryMessagePackBackingStore_PullAll_PreservesUnflushedLocalKeys()
+        {
+            var filePath = Path.Combine(Path.GetTempPath(), $"cultlib-tests-{Guid.NewGuid():N}.cc");
+            var recordsPath = DirectoryMessagePackBackingStore.DefaultRecordDirectoryPath(filePath);
+
+            try
+            {
+                using (var seed = await CultCacheMessagePack.OpenAsync(
+                           filePath,
+                           new CultCacheOpenOptions { UseDirectoryStore = true }))
+                {
+                    await seed.UpsertAsync(new NamedTestEntry
+                    {
+                        Name = "persisted",
+                        Value = "before-local-write"
+                    });
+                    await seed.FlushAsync();
+                }
+
+                CultRecordHandle<NamedTestEntry> localHandle;
+                using (var cache = await CultCacheMessagePack.OpenAsync(
+                           filePath,
+                           new CultCacheOpenOptions { UseDirectoryStore = true }))
+                {
+                    localHandle = await cache.UpsertAsync(new NamedTestEntry
+                    {
+                        Name = "local",
+                        Value = "must-survive-pull"
+                    });
+
+                    await cache.PullAllBackingStoresAsync();
+
+                    Assert.That(cache.Get<NamedTestEntry>(localHandle.Key)?.Value,
+                        Is.EqualTo("must-survive-pull"));
+                    Assert.That(cache.IsDirty, Is.True);
+                    await cache.FlushAsync();
+                }
+
+                using var reopened = await CultCacheMessagePack.OpenAsync(
+                    filePath,
+                    new CultCacheOpenOptions { UseDirectoryStore = true });
+                Assert.That(reopened.Get<NamedTestEntry>(localHandle.Key)?.Value,
+                    Is.EqualTo("must-survive-pull"));
+            }
+            finally
+            {
+                if (File.Exists(filePath))
+                    File.Delete(filePath);
+                if (Directory.Exists(recordsPath))
+                    Directory.Delete(recordsPath, recursive: true);
+            }
+        }
+
+        // A store copied without its lock gives a reader no lease; a writer then commits between the reader's manifest read
+        // and its page reads, either replacing a page the reader named (it vanishes) or only adding a key (the manifest moves).
+        [TestCase(true)]
+        [TestCase(false)]
+        public async Task DirectoryMessagePackBackingStore_UnlockedLoad_Reloads_When_A_Writer_Commits_Mid_Load(bool replaceReadPage)
+        {
+            var filePath = Path.Combine(Path.GetTempPath(), $"cultlib-tests-{Guid.NewGuid():N}.cc");
+            var recordsPath = DirectoryMessagePackBackingStore.DefaultRecordDirectoryPath(filePath);
+
+            try
+            {
+                CultRecordKey seeded;
+                using (var seed = await CultCacheMessagePack.OpenAsync(filePath, new CultCacheOpenOptions { UseDirectoryStore = true }))
+                {
+                    seeded = (await seed.UpsertAsync(new NamedTestEntry { Name = "copied", Value = "before" })).Key;
+                    await seed.FlushAsync();
+                }
+
+                // Attached while the lock exists, so the only unleased load is the pull below.
+                var readerStore = new DirectoryMessagePackBackingStore(filePath, recordsPath);
+                var reader = new CultCache();
+                reader.AddBackingStore(readerStore);
+                await reader.PullAllBackingStoresAsync();
+                File.Delete(Path.Combine(recordsPath, ".commit.lock"));
+                var committed = new System.Collections.Generic.List<CultRecordKey>();
+                // The writer is another cache, so it commits from another thread: a thread holds one cache's gate at a time.
+                // It commits under every unleased read, so only a retry that takes the lease its commit created can settle.
+                readerStore.UnleasedManifestRead = () =>
+                {
+                    Task.Run(async () =>
+                    {
+                        using var writer = CultCacheMessagePack.Create(filePath, new CultCacheOpenOptions { UseDirectoryStore = true });
+                        var document = new NamedTestEntry { Name = "writer", Value = "after" };
+                        committed.Add(replaceReadPage
+                            ? await writer.UpsertAsync(typeof(NamedTestEntry), document, seeded)
+                            : (await writer.UpsertAsync(document)).Key);
+                        await writer.FlushAsync();
+                    }).GetAwaiter().GetResult();
+                };
+
+                await reader.PullAllBackingStoresAsync();
+
+                Assert.That(committed, Has.Count.EqualTo(1), "the writer committed once; the retry held the lease");
+                Assert.That(reader.Get<NamedTestEntry>(committed[0])?.Value, Is.EqualTo("after"), "the reader reloaded the writer's generation");
+            }
+            finally
+            {
+                if (File.Exists(filePath)) File.Delete(filePath);
+                if (Directory.Exists(recordsPath)) Directory.Delete(recordsPath, recursive: true);
+            }
+        }
+
+        [Test]
+        public async Task DirectoryMessagePackBackingStore_UnlockedLoad_Throws_Corruption_Under_An_Unmoved_Manifest()
+        {
+            var filePath = Path.Combine(Path.GetTempPath(), $"cultlib-tests-{Guid.NewGuid():N}.cc");
+            var recordsPath = DirectoryMessagePackBackingStore.DefaultRecordDirectoryPath(filePath);
+
+            try
+            {
+                using (var seed = await CultCacheMessagePack.OpenAsync(filePath, new CultCacheOpenOptions { UseDirectoryStore = true }))
+                {
+                    await seed.UpsertAsync(new NamedTestEntry { Name = "copied", Value = "before" });
+                    await seed.FlushAsync();
+                }
+
+                var readerStore = new DirectoryMessagePackBackingStore(filePath, recordsPath);
+                var reader = new CultCache();
+                reader.AddBackingStore(readerStore);
+                File.Delete(Path.Combine(recordsPath, ".commit.lock"));
+                File.WriteAllBytes(Directory.GetFiles(recordsPath, "*.msgpack").Single(), new byte[] { 1, 2, 3 });
+                var loads = 0;
+                readerStore.UnleasedManifestRead = () => loads++;
+
+                var thrown = Assert.CatchAsync(() => reader.PullAllBackingStoresAsync())!;
+
+                Assert.That(loads, Is.EqualTo(1), "corruption is not retried as a race");
+                Assert.That(thrown, Is.TypeOf<InvalidDataException>(), "the page's failure, not Parallel.For's wrapper");
+                Assert.That(thrown.Message, Does.Contain("does not match its committed content hash"));
+            }
+            finally
+            {
+                if (File.Exists(filePath)) File.Delete(filePath);
+                if (Directory.Exists(recordsPath)) Directory.Delete(recordsPath, recursive: true);
+            }
+        }
+
+        [Test]
+        public async Task DirectoryMessagePackBackingStore_Deletion_Commits_While_Locked_Old_Page_Remains_An_Orphan()
+        {
+            var filePath = Path.Combine(Path.GetTempPath(), $"cultlib-tests-{Guid.NewGuid():N}.cc");
+            var recordsPath = DirectoryMessagePackBackingStore.DefaultRecordDirectoryPath(filePath);
+
+            try
+            {
+                var store = new DirectoryMessagePackBackingStore(filePath, recordsPath);
+                var cache = new CultCache();
+                cache.AddBackingStore(store);
+                var handle = await cache.AddAsync(new NamedTestEntry { Name = "delete", Value = "durable" });
+                store.PushAll();
+                var recordPath = Directory.GetFiles(recordsPath, "*.msgpack").Single();
+                Assert.That(cache.Remove(handle.Key), Is.True);
+
+                using (new FileStream(recordPath, FileMode.Open, FileAccess.Read, FileShare.Read))
+                {
+                    Assert.That(() => store.PushAll(), Throws.Nothing);
+                    Assert.That(File.Exists(recordPath), Is.True);
+                }
+
+                Assert.That(store.IsDirty, Is.False);
+                var compacted = CultDocumentMessagePackSerialization.DeserializeSnapshot(File.ReadAllBytes(filePath));
+                Assert.That(compacted.SchemaCatalog, Is.Empty);
+                Assert.That(compacted.Records, Is.Empty);
+                var reader = new CultCache();
+                reader.AddBackingStore(new DirectoryMessagePackBackingStore(filePath, recordsPath));
+                await reader.PullAllBackingStoresAsync();
+                Assert.That(reader.GetAll<NamedTestEntry>(), Is.Empty,
+                    "a reader must not resurrect an orphaned page left by another process");
+            }
+            finally
+            {
+                if (File.Exists(filePath)) File.Delete(filePath);
+                if (Directory.Exists(recordsPath)) Directory.Delete(recordsPath, recursive: true);
+            }
+        }
+
         [Test]
         public async Task CultCache_RuntimeType_Upsert_Snapshot_And_Remove_Work_For_Editor_Tooling()
         {
@@ -247,6 +771,37 @@ namespace GameCult.Caching.Tests
             Assert.That(cache.Remove(key), Is.False);
         }
 
+        [Test]
+        public async Task CultCache_GetAll_Tracks_Upsert_Replacement_And_Removal()
+        {
+            var cache = new CultCache();
+            var key = new CultRecordKey("typed-index:named");
+            await cache.UpsertAsync(typeof(NamedTestEntry), new NamedTestEntry
+            {
+                Name = "indexed",
+                Value = "first"
+            }, key);
+            await cache.UpsertAsync(typeof(AlternateNamedTestEntry), new AlternateNamedTestEntry
+            {
+                Name = "unrelated"
+            }, new CultRecordKey("typed-index:unrelated"));
+
+            var initial = cache.GetAll<NamedTestEntry>().Single();
+            Assert.That(cache.TryGetHandle(initial)?.Key, Is.EqualTo(key));
+            Assert.That(initial.Value, Is.EqualTo("first"));
+
+            await cache.UpsertAsync(typeof(NamedTestEntry), new NamedTestEntry
+            {
+                Name = "indexed",
+                Value = "second"
+            }, key);
+            var replaced = cache.GetAll<NamedTestEntry>().Single();
+            Assert.That(replaced.Value, Is.EqualTo("second"));
+
+            Assert.That(cache.Remove(key), Is.True);
+            Assert.That(cache.GetAll<NamedTestEntry>(), Is.Empty);
+        }
+
         [Test]
         public async Task CultCache_FlushOnDispose_Persists_When_Enabled()
         {
@@ -292,8 +847,8 @@ namespace GameCult.Caching.Tests
         {
             var reference = new CultRecordRef<NamedTestEntry>(new CultRecordKey("record-1"));
 
-            var payload = CultDocumentMessagePackSerialization.Serialize(reference);
-            var roundTrip = CultDocumentMessagePackSerialization.Deserialize<CultRecordRef<NamedTestEntry>>(payload);
+            var payload = MessagePackSerializer.Serialize(reference, CultDocumentMessagePackSerialization.Options);
+            var roundTrip = MessagePackSerializer.Deserialize<CultRecordRef<NamedTestEntry>>(payload, CultDocumentMessagePackSerialization.Options);
 
             Assert.That(roundTrip.Key.Value, Is.EqualTo("record-1"));
         }
@@ -302,52 +857,35 @@ namespace GameCult.Caching.Tests
         public void MessagePackSerialization_Rejects_InvalidPayload()
         {
             Assert.That(
-                () => CultDocumentMessagePackSerialization.Deserialize<CultRecordRef<NamedTestEntry>>(new byte[] { 0xC1 }),
+                () => MessagePackSerializer.Deserialize<CultRecordRef<NamedTestEntry>>(new byte[] { 0xC1 }, CultDocumentMessagePackSerialization.Options),
                 Throws.TypeOf<MessagePackSerializationException>());
         }
 
         [Test]
-        public void GeneratedMetadataProvider_Emits_AttributedDocuments_And_References()
+        public void Registry_Describes_AttributedDocuments_And_References()
         {
-            var providers = typeof(NamedTestEntry).Assembly
-                .GetCustomAttributes(typeof(CultGeneratedDocumentMetadataProviderAttribute), false)
-                .Cast<CultGeneratedDocumentMetadataProviderAttribute>()
-                .ToArray();
-
-            Assert.That(providers, Is.Not.Empty);
-
-            var definitions = providers
-                .SelectMany(provider =>
-                    ((ICultGeneratedDocumentMetadataProvider)Activator.CreateInstance(provider.ProviderType)!)
-                    .GetDocumentDefinitions())
-                .ToArray();
-
-            var named = definitions.Single(definition => definition.DocumentType == typeof(NamedTestEntry));
+            var named = CultDocumentRegistry.Shared.GetRequired<NamedTestEntry>();
             Assert.That(named.SchemaName, Is.EqualTo("tests.named_entry"));
             Assert.That(named.NameMember, Is.EqualTo(nameof(NamedTestEntry.Name)));
 
-            var referenceHolder = definitions.Single(definition => definition.DocumentType == typeof(ReferenceHolderEntry));
-            var parentMember = referenceHolder.Members.Single(member => member.MemberName == nameof(ReferenceHolderEntry.Parent));
+            var parentMember = CultDocumentRegistry.Shared.GetRequired<ReferenceHolderEntry>().ToCatalogEntry().Members
+                .Single(member => member.MemberName == nameof(ReferenceHolderEntry.Parent));
             Assert.That(parentMember.IsReference, Is.True);
             Assert.That(parentMember.TargetSchemaName, Is.EqualTo("tests.named_entry"));
             Assert.That(parentMember.TypeName, Does.Contain("CultRecordRef"));
         }
 
         [Test]
-        public void GeneratedMetadataProvider_Emits_Payload_Codecs_For_Plain_CultDocuments()
+        public void Plain_CultDocument_Payload_RoundTrips()
         {
-            var descriptor = CultDocumentRegistry.Shared.GetRequired<NamedTestEntry>();
             var original = new NamedTestEntry
             {
                 Name = "Teeth",
                 Value = "slot-array"
             };
 
-            Assert.That(descriptor.GeneratedPayloadSerializer, Is.Not.Null);
-            Assert.That(descriptor.GeneratedPayloadDeserializer, Is.Not.Null);
-
-            var payload = descriptor.GeneratedPayloadSerializer!(original);
-            var roundTrip = (NamedTestEntry)descriptor.GeneratedPayloadDeserializer!(payload);
+            var payload = CultDocumentMessagePackSerialization.SerializeUntyped(original, typeof(NamedTestEntry));
+            var roundTrip = (NamedTestEntry)CultDocumentMessagePackSerialization.DeserializeUntyped(typeof(NamedTestEntry), payload);
 
             Assert.That(roundTrip.Name, Is.EqualTo("Teeth"));
             Assert.That(roundTrip.Value, Is.EqualTo("slot-array"));
@@ -384,8 +922,6 @@ namespace GameCult.Caching.Tests
 
             var roundTripRecord = CultDocumentMessagePackSerialization.DeserializePersistedRecord(
                 CultDocumentMessagePackSerialization.SerializePersistedRecord(record));
-            var roundTripCatalog = CultDocumentMessagePackSerialization.DeserializeSchemaCatalog(
-                CultDocumentMessagePackSerialization.SerializeSchemaCatalog(catalog));
             var roundTripSnapshot = CultDocumentMessagePackSerialization.DeserializeSnapshot(
                 CultDocumentMessagePackSerialization.SerializeSnapshot(snapshot));
 
@@ -393,7 +929,7 @@ namespace GameCult.Caching.Tests
             Assert.That(roundTripRecord.SchemaId, Is.EqualTo("schema-1"));
             Assert.That(roundTripRecord.StoredAt, Is.EqualTo("2026-05-08T12:00:00Z"));
             Assert.That(roundTripRecord.Payload, Is.EqualTo(record.Payload));
-            Assert.That(roundTripCatalog.Single().CompatibleSchemaIds, Is.EqualTo(catalog.Single().CompatibleSchemaIds));
+            Assert.That(roundTripSnapshot.SchemaCatalog.Single().CompatibleSchemaIds, Is.EqualTo(catalog.Single().CompatibleSchemaIds));
             Assert.That(roundTripSnapshot.FormatVersion, Is.EqualTo("cultcache.store.v1"));
             Assert.That(roundTripSnapshot.SchemaCatalog.Single().SchemaName, Is.EqualTo("tests.named_entry"));
             Assert.That(roundTripSnapshot.Records.Single().Key, Is.EqualTo("record-1"));
@@ -462,13 +998,167 @@ namespace GameCult.Caching.Tests
                 Throws.TypeOf<InvalidOperationException>().With.Message.Contains("changed target schema"));
         }
 
+        [Test]
+        public async Task CultCache_Commit_Hides_Batch_Until_The_Directory_Store_Has_Committed_It()
+        {
+            var root = Path.Combine(Path.GetTempPath(), $"cultcache-commit-{Guid.NewGuid():N}");
+            var manifest = Path.Combine(root, "state.cc");
+            Directory.CreateDirectory(root);
+            try
+            {
+                using var cache = new CultCache();
+                cache.AddBackingStore(new DirectoryMessagePackBackingStore(manifest));
+                var firstKey = new CultRecordKey("commit:first");
+                var secondKey = new CultRecordKey("commit:second");
+                var observed = 0;
+                using var subscription = cache.Watch<NamedTestEntry>().Subscribe(_ => observed++);
+
+                var committed = cache.Commit(batch =>
+                {
+                    batch.Upsert(new NamedTestEntry { Name = "first", Value = "one" }, new CultRecordHandle<NamedTestEntry>(firstKey));
+                    Assert.That(cache.Get<NamedTestEntry>(firstKey), Is.Null);
+                    Assert.That(File.Exists(manifest), Is.False);
+                    batch.Upsert(new NamedTestEntry { Name = "second", Value = "two" }, new CultRecordHandle<NamedTestEntry>(secondKey));
+                    Assert.That(observed, Is.Zero);
+                });
+
+                Assert.That(committed, Is.True);
+                Assert.That(cache.Get<NamedTestEntry>(firstKey)?.Value, Is.EqualTo("one"));
+                Assert.That(cache.Get<NamedTestEntry>(secondKey)?.Value, Is.EqualTo("two"));
+                Assert.That(observed, Is.EqualTo(2));
+                Assert.That(cache.IsDirty, Is.False);
+
+                using var reopened = new CultCache();
+                reopened.AddBackingStore(new DirectoryMessagePackBackingStore(manifest));
+                Assert.That(reopened.Get<NamedTestEntry>(firstKey)?.Value, Is.EqualTo("one"));
+                Assert.That(reopened.Get<NamedTestEntry>(secondKey)?.Value, Is.EqualTo("two"));
+                await Task.CompletedTask;
+            }
+            finally
+            {
+                if (Directory.Exists(root)) Directory.Delete(root, recursive: true);
+            }
+        }
+
+        [Test]
+        public void CultCache_Commit_Stage_Failure_Cannot_Leak_Into_Later_Commit()
+        {
+            var root = Path.Combine(Path.GetTempPath(), $"cultcache-abort-{Guid.NewGuid():N}");
+            var manifest = Path.Combine(root, "state.cc");
+            Directory.CreateDirectory(root);
+            try
+            {
+                using var cache = new CultCache();
+                cache.AddBackingStore(new DirectoryMessagePackBackingStore(manifest));
+                var abortedKey = new CultRecordKey("commit:aborted");
+                var committedKey = new CultRecordKey("commit:committed");
+                var observed = 0;
+                using var subscription = cache.Watch<NamedTestEntry>().Subscribe(_ => observed++);
+
+                Assert.Throws<InvalidOperationException>(() => cache.Commit(batch =>
+                {
+                    batch.Upsert(new NamedTestEntry { Name = "aborted", Value = "must-not-leak" }, new CultRecordHandle<NamedTestEntry>(abortedKey));
+                    throw new InvalidOperationException("abort probe");
+                }));
+
+                Assert.That(cache.Get<NamedTestEntry>(abortedKey), Is.Null);
+                Assert.That(observed, Is.Zero);
+                Assert.That(cache.Commit(batch =>
+                    batch.Upsert(new NamedTestEntry { Name = "committed", Value = "survives" }, new CultRecordHandle<NamedTestEntry>(committedKey))), Is.True);
+                Assert.That(observed, Is.EqualTo(1));
+
+                using var reopened = new CultCache();
+                reopened.AddBackingStore(new DirectoryMessagePackBackingStore(manifest));
+                Assert.That(reopened.Get<NamedTestEntry>(abortedKey), Is.Null);
+                Assert.That(reopened.Get<NamedTestEntry>(committedKey)?.Value, Is.EqualTo("survives"));
+            }
+            finally
+            {
+                if (Directory.Exists(root)) Directory.Delete(root, recursive: true);
+            }
+        }
+
+        [Test]
+        public void CultCache_Commit_Batch_Used_After_Commit_Throws()
+        {
+            var root = Path.Combine(Path.GetTempPath(), $"cultcache-escaped-batch-{Guid.NewGuid():N}");
+            var manifest = Path.Combine(root, "state.cc");
+            Directory.CreateDirectory(root);
+            try
+            {
+                using var cache = new CultCache();
+                cache.AddBackingStore(new DirectoryMessagePackBackingStore(manifest));
+                var committedKey = new CultRecordKey("commit:committed-parent");
+                var escapedKey = new CultRecordKey("commit:escaped-child");
+                CultCacheBatch? escaped = null;
+
+                cache.Commit(batch =>
+                {
+                    batch.Upsert(new NamedTestEntry { Name = "parent", Value = "committed" }, new CultRecordHandle<NamedTestEntry>(committedKey));
+                    escaped = batch;
+                });
+
+                Assert.That(
+                    () => escaped!.Upsert(new NamedTestEntry { Name = "child", Value = "must-fail" }, new CultRecordHandle<NamedTestEntry>(escapedKey)),
+                    Throws.TypeOf<InvalidOperationException>().With.Message.Contains("already been committed"));
+                Assert.That(cache.Get<NamedTestEntry>(committedKey)?.Value, Is.EqualTo("committed"));
+                Assert.That(cache.Get<NamedTestEntry>(escapedKey), Is.Null);
+
+                using var reopened = new CultCache();
+                reopened.AddBackingStore(new DirectoryMessagePackBackingStore(manifest));
+                Assert.That(reopened.Get<NamedTestEntry>(committedKey)?.Value, Is.EqualTo("committed"));
+                Assert.That(reopened.Get<NamedTestEntry>(escapedKey), Is.Null);
+            }
+            finally
+            {
+                if (Directory.Exists(root)) Directory.Delete(root, recursive: true);
+            }
+        }
+
+        [Test]
+        public void CultCache_Commit_Observer_Writes_In_A_New_Commit()
+        {
+            var root = Path.Combine(Path.GetTempPath(), $"cultcache-observer-commit-{Guid.NewGuid():N}");
+            var manifest = Path.Combine(root, "state.cc");
+            Directory.CreateDirectory(root);
+            try
+            {
+                using var cache = new CultCache();
+                cache.AddBackingStore(new DirectoryMessagePackBackingStore(manifest));
+                var firstKey = new CultRecordKey("commit:observer-source");
+                var secondKey = new CultRecordKey("commit:observer-write");
+                using var subscription = cache.Watch<NamedTestEntry>().Subscribe(change =>
+                {
+                    if (!change.Key.Equals(firstKey)) return;
+                    cache.Commit(batch => batch.Upsert(
+                        new NamedTestEntry { Name = "observer", Value = "separate-commit" },
+                        new CultRecordHandle<NamedTestEntry>(secondKey)));
+                });
+
+                cache.Commit(batch => batch.Upsert(
+                    new NamedTestEntry { Name = "source", Value = "committed-first" },
+                    new CultRecordHandle<NamedTestEntry>(firstKey)));
+
+                Assert.That(cache.Get<NamedTestEntry>(secondKey)?.Value, Is.EqualTo("separate-commit"));
+                using var reopened = new CultCache();
+                reopened.AddBackingStore(new DirectoryMessagePackBackingStore(manifest));
+                Assert.That(reopened.Get<NamedTestEntry>(firstKey)?.Value, Is.EqualTo("committed-first"));
+                Assert.That(reopened.Get<NamedTestEntry>(secondKey)?.Value, Is.EqualTo("separate-commit"));
+            }
+            finally
+            {
+                if (Directory.Exists(root)) Directory.Delete(root, recursive: true);
+            }
+        }
+
         private const string NamedFixtureCanonicalSchemaJson =
             "{\"schemaName\":\"tests.named_entry\",\"schemaVersion\":\"tests.named_entry.v1\",\"members\":[{\"slot\":0,\"name\":\"Name\",\"type\":\"System.String\",\"isReference\":false,\"many\":false,\"targetSchemaName\":null,\"indexAlias\":null,\"isName\":true},{\"slot\":1,\"name\":\"Value\",\"type\":\"System.String\",\"isReference\":false,\"many\":false,\"targetSchemaName\":null,\"indexAlias\":null,\"isName\":false}]}";
         private const string NamedFixtureSchemaId = "sha256:e7b97801b94190f3159012ede45b0069bb09ebf7920f7432c971bc86a0e08de8";
         private const string NamedFixtureContentHash = "sha256:23150930afcc1d84f0cb3012ccc2debcb9b4685f62083033bbaab0083f1e832e";
-        private const string ReferenceFixtureSchemaId = "sha256:bd85064961cc74565fb73e3ccbc4217cfba4dc4869e365a08bea4f704739bd8f";
+        private const string ReferenceFixtureSchemaId = "sha256:4ec0c52c7581c04777525af72f805b10705212ffd0138f3bff1eb4bcd1d0f23c";
 
         [CultDocument("tests.named_entry", "tests.named_entry.v1")]
+        [MessagePackObject(AllowPrivate = true)]
         internal sealed class NamedTestEntry
         {
             [Key(0)]
@@ -479,7 +1169,17 @@ namespace GameCult.Caching.Tests
             public string Value = string.Empty;
         }
 
+        [CultDocument("tests.global_entry", "tests.global_entry.v1")]
+        [MessagePackObject(AllowPrivate = true)]
+        [CultGlobal]
+        internal sealed class GlobalTestEntry
+        {
+            [Key(0)]
+            public string Value = "schema default";
+        }
+
         [CultDocument("tests.reference_holder", "tests.reference_holder.v1")]
+        [MessagePackObject(AllowPrivate = true)]
         internal sealed class ReferenceHolderEntry
         {
             [Key(0)]
@@ -490,24 +1190,8 @@ namespace GameCult.Caching.Tests
             public CultRecordRef<NamedTestEntry> Parent = new(new CultRecordKey("parent"));
         }
 
-        [CultDocument("tests.transform_entry", "tests.transform_entry.v1")]
-        internal sealed class TransformEntry
-        {
-            [Key(0)]
-            [CultName]
-            public string Name = string.Empty;
-
-            [Key(1)]
-            public float PositionX;
-
-            [Key(2)]
-            public float PositionY;
-
-            [Key(3)]
-            public int Health;
-        }
-
         [CultDocument("tests.named_entry", "tests.named_entry.v2")]
+        [MessagePackObject(AllowPrivate = true)]
         internal sealed class NamedTestEntryAdditive
         {
             [Key(0)]
@@ -522,6 +1206,7 @@ namespace GameCult.Caching.Tests
         }
 
         [CultDocument("tests.named_entry", "tests.named_entry.v3")]
+        [MessagePackObject(AllowPrivate = true)]
         internal sealed class NamedTestEntryRemoved
         {
             [Key(0)]
@@ -530,6 +1215,7 @@ namespace GameCult.Caching.Tests
         }
 
         [CultDocument("tests.named_entry", "tests.named_entry.v4")]
+        [MessagePackObject(AllowPrivate = true)]
         internal sealed class NamedTestEntryTypeMismatch
         {
             [Key(0)]
@@ -541,6 +1227,7 @@ namespace GameCult.Caching.Tests
         }
 
         [CultDocument("tests.alt_named_entry", "tests.alt_named_entry.v1")]
+        [MessagePackObject(AllowPrivate = true)]
         internal sealed class AlternateNamedTestEntry
         {
             [Key(0)]
@@ -549,6 +1236,7 @@ namespace GameCult.Caching.Tests
         }
 
         [CultDocument("tests.reference_holder", "tests.reference_holder.v2")]
+        [MessagePackObject(AllowPrivate = true)]
         internal sealed class ReferenceHolderRetargetedEntry
         {
             [Key(0)]
diff --git a/tests/GameCult.Caching.Tests/ConditionalCommitTests.cs b/tests/GameCult.Caching.Tests/ConditionalCommitTests.cs
new file mode 100644
index 00000000..adfd67e3
--- /dev/null
+++ b/tests/GameCult.Caching.Tests/ConditionalCommitTests.cs
@@ -0,0 +1,977 @@
+#nullable enable
+using System;
+using System.Collections.Concurrent;
+using System.IO;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using GameCult.Caching;
+using GameCult.Caching.MessagePack;
+using MessagePack;
+using NUnit.Framework;
+using R3;
+
+namespace GameCult.Caching.Tests
+{
+    public class ConditionalCommitTests
+    {
+        private static readonly CultRecordKey Key = new("counter");
+        private string _directory = string.Empty;
+
+        [SetUp]
+        public void CreateDirectory()
+        {
+            _directory = Path.Combine(Path.GetTempPath(), $"cultlib-conditional-{Guid.NewGuid():N}");
+            Directory.CreateDirectory(_directory);
+        }
+
+        [TearDown]
+        public void DeleteDirectory()
+        {
+            if (Directory.Exists(_directory))
+                Directory.Delete(_directory, recursive: true);
+        }
+
+        [Test]
+        public void StaleExpectFailsWithNothingChanged() => StaleExpect(SingleFile(PathOf("store.cc")));
+
+        [Test]
+        public void ExpectNullIsCreateOnce() => CreateOnce(SingleFile(PathOf("store.cc")));
+
+        [Test]
+        public void PerEntryCommitSurvivesUnrelatedWrite() => UnrelatedWrite(SingleFile(PathOf("store.cc")));
+
+        [Test]
+        public void ExpectUnchangedFailsOnUnrelatedInsert() => UnrelatedInsert(SingleFile(PathOf("store.cc")));
+
+        [Test]
+        public void DirectoryStoreHonorsConditions()
+        {
+            StaleExpect(DirectoryStore(PathOf("stale.cc")));
+            CreateOnce(DirectoryStore(PathOf("create.cc")));
+            UnrelatedWrite(DirectoryStore(PathOf("unrelated.cc")));
+            UnrelatedInsert(DirectoryStore(PathOf("insert.cc")));
+        }
+
+        // The lock is a FileShare.None handle, which excludes another handle in this process exactly as it does one in
+        // another process, so two store instances on two threads prove the property without a process boundary.
+        [Test]
+        public void TwoWritersRacingExactlyOneWins()
+        {
+            const int n = 100;
+            var store = SingleFile(PathOf("race.cc"));
+            Create(store, 0);
+            using var a = store.Open();
+            using var b = store.Open();
+
+            Assert.That(Increment(a), Is.True);
+            Assert.That(Increment(b), Is.False, "b observed before a committed and still won");
+            b.PullAllBackingStoresAsync();
+            Assert.That(Increment(b), Is.True);
+            Assert.That(Increment(a), Is.False, "a committed over b's newer record from its stale view");
+
+            var racers = new[] { a, b }.Select(cache => Task.Run(() =>
+            {
+                var wins = 0;
+                var mismatches = 0;
+                for (var attempt = 0; wins < n && attempt < 50 * n; attempt++)
+                {
+                    cache.PullAllBackingStoresAsync();
+                    if (Increment(cache))
+                        wins++;
+                    else
+                        mismatches++;
+                }
+
+                return (Wins: wins, Mismatches: mismatches);
+            })).ToArray();
+            Assert.That(Task.WaitAll(racers, TimeSpan.FromMinutes(2)), Is.True, "the racers did not finish");
+
+            Assert.That(racers.Select(racer => racer.Result.Wins), Is.All.EqualTo(n));
+            Assert.That(racers.Sum(racer => racer.Result.Mismatches), Is.GreaterThan(0), "the writers never actually raced");
+            using var reader = store.Open();
+            Assert.That(reader.Get<Counter>(Key)!.Value, Is.EqualTo(2 + 2 * n));
+        }
+
+        [Test]
+        public void TryCommitReportsContended()
+        {
+            var path = PathOf("contended.cc");
+            var store = SingleFile(path);
+            Create(store, 0);
+            using var cache = store.Open();
+            var before = File.ReadAllBytes(path);
+            Task<bool> waiting;
+
+            using (new FileStream(path + ".lock", FileMode.OpenOrCreate, FileAccess.ReadWrite, FileShare.None))
+            {
+                Assert.That(cache.TryCommit(batch => batch.Upsert(new Counter { Name = "x" }, new CultRecordHandle<Counter>(new CultRecordKey("x")))),
+                    Is.EqualTo(CultCommitOutcome.Contended));
+                Assert.That(File.ReadAllBytes(path), Is.EqualTo(before));
+                Assert.That(cache.Get(new CultRecordKey("x")), Is.Null);
+
+                waiting = Task.Run(() => cache.Commit(batch => batch.Upsert(new Counter { Name = "y" }, new CultRecordHandle<Counter>(new CultRecordKey("y")))));
+                Assert.That(waiting.Wait(200), Is.False, "Commit did not wait for the held lock");
+            }
+
+            Assert.That(waiting.Wait(TimeSpan.FromSeconds(10)) && waiting.Result, Is.True);
+            Assert.That(cache.Get(new CultRecordKey("y")), Is.Not.Null);
+        }
+
+        [Test]
+        public void TryCommitIsNotContendedByAConcurrentReader()
+        {
+            var path = PathOf("reader.cc");
+            var store = SingleFile(path);
+            Create(store, 0);
+            using var cache = store.Open();
+            var handle = new CultRecordHandle<Counter>(new CultRecordKey("read-under"));
+            var running = true;
+            var reads = 0;
+            using var started = new ManualResetEventSlim();
+            var reading = Task.Run(() =>
+            {
+                started.Set();
+                while (Volatile.Read(ref running))
+                {
+                    _ = cache.AllStoredDocuments.Count();
+                    Interlocked.Increment(ref reads);
+                }
+            });
+
+            try
+            {
+                Assert.That(started.Wait(TimeSpan.FromSeconds(10)), Is.True);
+                for (var i = 0; i < 200; i++)
+                    Assert.That(cache.TryCommit(batch => batch.Upsert(new Counter { Name = "read-under", Value = i }, handle)),
+                        Is.EqualTo(CultCommitOutcome.Committed), $"attempt {i} lost to a reader, not a writer");
+            }
+            finally
+            {
+                Volatile.Write(ref running, false);
+                Assert.That(reading.Wait(TimeSpan.FromSeconds(10)), Is.True);
+            }
+
+            Assert.That(reads, Is.GreaterThan(0));
+            using (new FileStream(path + ".lock", FileMode.OpenOrCreate, FileAccess.ReadWrite, FileShare.None))
+                Assert.That(cache.TryCommit(batch => batch.Upsert(new Counter { Name = "read-under" }, handle)),
+                    Is.EqualTo(CultCommitOutcome.Contended));
+        }
+
+        [Test]
+        public void PushAllWaitsForHeldStoreLock()
+        {
+            var path = PathOf("push-wait.cc");
+            using var cache = SingleFile(path).Open();
+            cache.UpsertAsync(new Counter { Name = "pushed" }, new CultRecordHandle<Counter>(Key));
+            Task flush;
+
+            using (new FileStream(path + ".lock", FileMode.OpenOrCreate, FileAccess.ReadWrite, FileShare.None))
+            {
+                flush = Task.Run(() => cache.FlushAllBackingStores());
+                Assert.That(flush.Wait(150), Is.False, "PushAll did not wait for the held store lock");
+                Assert.That(File.Exists(path), Is.False);
+            }
+
+            Assert.That(flush.Wait(TimeSpan.FromSeconds(10)), Is.True);
+            using var reader = SingleFile(path).Open();
+            Assert.That(reader.Get(Key), Is.Not.Null);
+        }
+
+        [Test]
+        public void CommitWaitsForHeldStoreLock()
+        {
+            var path = PathOf("commit-wait.cc");
+            using var cache = SingleFile(path).Open();
+            Task<bool> commit;
+
+            using (new FileStream(path + ".lock", FileMode.OpenOrCreate, FileAccess.ReadWrite, FileShare.None))
+            {
+                commit = Task.Run(() => CreateCommit(cache, 7));
+                Assert.That(commit.Wait(150), Is.False, "Commit did not wait for the held store lock");
+                Assert.That(File.Exists(path), Is.False);
+            }
+
+            Assert.That(commit.Wait(TimeSpan.FromSeconds(10)), Is.True);
+            Assert.That(commit.Result, Is.True);
+            using var reader = SingleFile(path).Open();
+            Assert.That(reader.Get<Counter>(Key)!.Value, Is.EqualTo(7));
+        }
+
+        [Test]
+        public void PlainFlushNeverInterleaves()
+        {
+            var path = PathOf("interleave.cc");
+            var store = SingleFile(path);
+            Create(store, 0);
+            using var flusher = store.Open();
+            using var committer = store.Open();
+            var running = true;
+            var reads = 0;
+
+            var flushing = Task.Run(() =>
+            {
+                for (var i = 0; i < 50; i++)
+                {
+                    flusher.UpsertAsync(new Counter { Name = "flushed", Value = i }, new CultRecordHandle<Counter>(new CultRecordKey("flushed")));
+                    flusher.FlushAllBackingStores();
+                }
+            });
+            var committing = Task.Run(() =>
+            {
+                for (var i = 0; i < 50; i++)
+                {
+                    var key = new CultRecordKey($"committed:{i}");
+                    committer.Commit(batch =>
+                    {
+                        batch.Expect(key, null);
+                        batch.Upsert(new Counter { Name = key.Value, Value = i }, new CultRecordHandle<Counter>(key));
+                    });
+                }
+            });
+            var reading = Task.Run(() =>
+            {
+                while (Volatile.Read(ref running))
+                {
+                    byte[] bytes;
+                    try
+                    {
+                        using var stream = new FileStream(path, FileMode.Open, FileAccess.Read, FileShare.ReadWrite | FileShare.Delete);
+                        using var buffer = new MemoryStream();
+                        stream.CopyTo(buffer);
+                        bytes = buffer.ToArray();
+                    }
+                    catch (IOException)
+                    {
+                        // An open that loses to a replace in flight (moved away, or held by the replace) is not a read.
+                        continue;
+                    }
+
+                    CultDocumentMessagePackSerialization.DeserializeSnapshot(bytes);
+                    reads++;
+                }
+            });
+
+            Assert.That(Task.WaitAll(new[] { flushing, committing }, TimeSpan.FromMinutes(2)), Is.True, "the writers did not finish");
+            Volatile.Write(ref running, false);
+            Assert.That(() => reading.Wait(TimeSpan.FromSeconds(10)), Throws.Nothing);
+            Assert.That(reads, Is.GreaterThan(0));
+        }
+
+        [Test]
+        public void StoredAtIsStrictlyIncreasingPerKey()
+        {
+            using var cache = SingleFile(PathOf("stamps.cc")).Open();
+            var stamps = new string[1000];
+            for (var i = 0; i < stamps.Length; i++)
+            {
+                cache.UpsertAsync(new Counter { Name = "stamped", Value = i }, new CultRecordHandle<Counter>(Key));
+                stamps[i] = cache.AllStoredDocuments.Single().StoredAt;
+            }
+
+            Assert.That(stamps.Distinct().Count(), Is.EqualTo(stamps.Length));
+            var instants = stamps.Select(stamp => DateTimeOffset.Parse(stamp, null, System.Globalization.DateTimeStyles.RoundtripKind)).ToArray();
+            Assert.That(instants.Zip(instants.Skip(1), (earlier, later) => later > earlier), Is.All.True);
+        }
+
+        [Test]
+        public void DirtyStoreRefusesConditionalCommit()
+        {
+            using var cache = SingleFile(PathOf("dirty.cc")).Open();
+            cache.UpsertAsync(new Counter { Name = "staged" });
+
+            Assert.That(() => cache.Commit(batch =>
+            {
+                batch.Expect(Key, null);
+                batch.Upsert(new Counter { Name = "counter" }, new CultRecordHandle<Counter>(Key));
+            }), Throws.InvalidOperationException.With.Message.Contains("flush"));
+            Assert.That(cache.Get(Key), Is.Null);
+        }
+
+        [Test]
+        public void CrossStoreConditionalBatchThrowsBeforeAnyStore()
+        {
+            using var cache = new CultCache(Registry);
+            cache.AddBackingStore(new SingleFileMessagePackBackingStore(PathOf("counters.cc")), typeof(Counter));
+            cache.AddBackingStore(new SingleFileMessagePackBackingStore(PathOf("tallies.cc")), typeof(Tally));
+
+            Assert.That(() => cache.Commit(batch =>
+            {
+                batch.Expect(Key, null);
+                batch.Upsert(new Counter { Name = "counter" }, new CultRecordHandle<Counter>(Key));
+                batch.Upsert(new Tally { Name = "tally" }, new CultRecordHandle<Tally>(new CultRecordKey("tally")));
+            }), Throws.InvalidOperationException.With.Message.Contains("one home store"));
+            Assert.That(System.IO.Directory.GetFiles(_directory), Is.Empty, "a store file or lock file was touched");
+        }
+
+        // Cache A pulls and upserts on two threads while cache B commits to the same directory store; the pull's load
+        // callback and the upsert's push must take the cache gate and the store lock in one order. A is not disposed on
+        // failure because a deadlocked gate would hang the test thread too.
+        [Test]
+        public void PullAndUpsertOnDirectoryStoreDoNotDeadlock()
+        {
+            var store = DirectoryStore(PathOf("deadlock.cc"));
+            var a = store.Open();
+            using var b = store.Open();
+            var pulling = Task.Run(() =>
+            {
+                for (var i = 0; i < 300; i++)
+                    a.PullAllBackingStoresAsync();
+            });
+            var upserting = Task.Run(() =>
+            {
+                for (var i = 0; i < 3000; i++)
+                    a.UpsertAsync(new Counter { Name = $"a:{i}" }, new CultRecordHandle<Counter>(new CultRecordKey($"a:{i}")));
+            });
+            var writing = Task.Run(() =>
+            {
+                for (var i = 0; i < 150; i++)
+                {
+                    b.UpsertAsync(new Counter { Name = $"b:{i}" }, new CultRecordHandle<Counter>(new CultRecordKey($"b:{i}")));
+                    b.FlushAllBackingStores();
+                }
+            });
+
+            Assert.That(Task.WaitAll(new[] { pulling, upserting, writing }, TimeSpan.FromSeconds(60)), Is.True, "pull and upsert deadlocked");
+            a.Dispose();
+        }
+
+        [Test]
+        public void RepullNeverErasesAStagedWrite()
+        {
+            var path = PathOf("repull.cc");
+            Create(SingleFile(path), 0);
+            var store = new PausingStore(path);
+            using var cache = new CultCache(Registry);
+            cache.AddBackingStore(store);
+            var staged = new CultRecordKey("staged");
+
+            using (var release = new ManualResetEventSlim())
+            {
+                store.Pause = release;
+                try
+                {
+                    var pulling = Task.Run(() => cache.PullAllBackingStoresAsync());
+                    Assert.That(store.Entered.Wait(TimeSpan.FromSeconds(10)), Is.True, "the pull never read the file");
+                    using var started = new ManualResetEventSlim();
+                    var writing = Task.Run(() =>
+                    {
+                        started.Set();
+                        return cache.UpsertAsync(new Counter { Name = "staged" }, new CultRecordHandle<Counter>(staged));
+                    });
+                    Assert.That(started.Wait(TimeSpan.FromSeconds(10)), Is.True, "the writer never started");
+                    writing.Wait(200);
+                    Assert.That(store.PushedWhilePaused, Is.False, "a write reached the store while the pull held the gate");
+                    store.Pause = null;
+                    release.Set();
+                    Assert.That(Task.WaitAll(new Task[] { pulling, writing }, TimeSpan.FromSeconds(10)), Is.True);
+                }
+                finally
+                {
+                    store.Pause = null;
+                    release.Set();
+                }
+            }
+
+            Assert.That(cache.Get(staged), Is.Not.Null, "the re-pull erased a staged write from the cache");
+            cache.FlushAllBackingStores();
+            using var reader = SingleFile(path).Open();
+            Assert.That(reader.Get(staged), Is.Not.Null, "the flush after the re-pull lost the staged write");
+        }
+
+        // The pull pauses inside the directory store's own page load, under the commit lease.
+        [Test]
+        public void RepullNeverErasesAStagedWriteOnDirectoryStore()
+        {
+            var store = DirectoryStore(PathOf("repull-dir.cc"));
+            using (var seed = store.Open())
+                Assert.That(seed.Commit(batch => batch.Upsert(new Slow { Name = "slow", Blocks = true })), Is.True);
+            using var cache = store.Open();
+            var staged = new CultRecordKey("staged");
+
+            using (var release = new ManualResetEventSlim())
+            {
+                Slow.Entered.Reset();
+                Slow.ReadWhilePaused = false;
+                Slow.Pause = release;
+                try
+                {
+                    var pulling = Task.Run(() => cache.PullAllBackingStoresAsync());
+                    Assert.That(Slow.Entered.Wait(TimeSpan.FromSeconds(10)), Is.True, "the pull never loaded a page");
+                    // Admitting the write indexes its name under the gate, so a write that gets past the gate reads it while paused.
+                    using var started = new ManualResetEventSlim();
+                    var writing = Task.Run(() =>
+                    {
+                        started.Set();
+                        return cache.UpsertAsync(new Slow { Name = "staged" }, new CultRecordHandle<Slow>(staged));
+                    });
+                    Assert.That(started.Wait(TimeSpan.FromSeconds(10)), Is.True, "the writer never started");
+                    writing.Wait(200);
+                    Assert.That(Slow.ReadWhilePaused, Is.False, "a write was admitted while the pull held the gate");
+                    Slow.Pause = null;
+                    release.Set();
+                    Assert.That(Task.WaitAll(new Task[] { pulling, writing }, TimeSpan.FromSeconds(10)), Is.True);
+                }
+                finally
+                {
+                    Slow.Pause = null;
+                    release.Set();
+                }
+            }
+
+            Assert.That(cache.Get(staged), Is.Not.Null, "the re-pull erased a staged write from the cache");
+            cache.FlushAllBackingStores();
+            using var reader = store.Open();
+            Assert.That(reader.Get(staged), Is.Not.Null, "the flush after the re-pull lost the staged write");
+        }
+
+        // Gate sharing is what makes a direct store call wait for its cache's I/O instead of interleaving with it.
+        [Test]
+        public void DirectCallsOnAnAttachedStoreShareTheCacheGate()
+        {
+            var path = PathOf("direct.cc");
+            Create(SingleFile(path), 0);
+            var store = new PausingStore(path);
+            using var cache = new CultCache(Registry);
+            cache.AddBackingStore(store);
+
+            using var release = new ManualResetEventSlim();
+            store.Pause = release;
+            try
+            {
+                var pulling = Task.Run(() => cache.PullAllBackingStoresAsync());
+                Assert.That(store.Entered.Wait(TimeSpan.FromSeconds(10)), Is.True, "the pull never read the file");
+                var pushing = Task.Run(() => store.PushAll());
+                Assert.That(pushing.Wait(200), Is.False, "a direct PushAll ran while the cache's pull held the gate");
+                store.Pause = null;
+                release.Set();
+                Assert.That(Task.WaitAll(new[] { pulling, pushing }, TimeSpan.FromSeconds(10)), Is.True);
+            }
+            finally
+            {
+                // A failed assert must not leave the pull parked on the gate that Dispose needs.
+                store.Pause = null;
+                release.Set();
+            }
+        }
+
+        [Test]
+        public void ObserverDoesNotRunUnderTheGate()
+        {
+            var path = PathOf("observer.cc");
+            using var cache = SingleFile(path).Open();
+            var gated = new System.Collections.Concurrent.ConcurrentQueue<string>();
+            var seen = 0;
+            using var subscription = cache.Watch<Counter>().Subscribe(change =>
+            {
+                Interlocked.Increment(ref seen);
+                if (!Task.Run(() => cache.Get(change.Key)).Wait(TimeSpan.FromSeconds(5)))
+                    gated.Enqueue(change.Key.Value);
+            });
+
+            cache.UpsertAsync(new Counter { Name = "upserted" }, new CultRecordHandle<Counter>(new CultRecordKey("upserted")));
+            Assert.That(cache.Commit(batch => batch.Upsert(new Counter { Name = "committed" }, new CultRecordHandle<Counter>(new CultRecordKey("committed")))), Is.True);
+            using (var other = SingleFile(path).Open())
+                Assert.That(other.Commit(batch => batch.Upsert(new Counter { Name = "pulled" }, new CultRecordHandle<Counter>(new CultRecordKey("pulled")))), Is.True);
+            cache.PullAllBackingStoresAsync();
+
+            Assert.That(seen, Is.EqualTo(3));
+            Assert.That(gated, Is.Empty, "an observer ran while the cache gate was held");
+        }
+
+        [Test]
+        public void ThrowingOnUpdateHandlerDoesNotResurrectDeletedRecord()
+        {
+            var store = SingleFile(PathOf("resurrect.cc"));
+            var doomed = new CultRecordKey("doomed");
+            var later = new CultRecordKey("later");
+            using (var seed = store.Open())
+                Assert.That(seed.Commit(batch =>
+                {
+                    batch.Upsert(new Counter { Name = "doomed" }, new CultRecordHandle<Counter>(doomed));
+                    batch.Upsert(new Counter { Name = "kept" });
+                }), Is.True);
+            using var a = store.Open();
+            using (var b = store.Open())
+            {
+                Assert.That(b.Remove(doomed), Is.True);
+                b.FlushAllBackingStores();
+            }
+
+            var throwing = true;
+            a.OnUpdate += (_, _) =>
+            {
+                if (throwing)
+                    throw new InvalidOperationException("observer failed");
+            };
+            Assert.That(() => a.PullAllBackingStoresAsync(), Throws.InvalidOperationException.With.Message.EqualTo("observer failed"));
+            throwing = false;
+            Assert.That(a.Get(doomed), Is.Null);
+
+            a.UpsertAsync(new Counter { Name = "later" }, new CultRecordHandle<Counter>(later));
+            a.FlushAllBackingStores();
+            using var reader = store.Open();
+            Assert.That(reader.Get(later), Is.Not.Null);
+            Assert.That(reader.Get(doomed), Is.Null, "a throwing observer left the store holding a record the cache dropped");
+        }
+
+        [Test]
+        public void OwnChangeIsPublishedBeforeWriteReturns()
+        {
+            using var cache = SingleFile(PathOf("own.cc")).Open();
+            var published = new ConcurrentDictionary<string, int>();
+            using var subscription = cache.Watch<Counter>().Subscribe(change => published[change.Key.Value] = Environment.CurrentManagedThreadId);
+            var late = 0;
+            var writers = Enumerable.Range(0, 4).Select(t => Task.Run(() =>
+            {
+                for (var i = 0; i < 3000; i++)
+                {
+                    var key = $"{t}:{i}";
+                    cache.UpsertAsync(new Counter { Name = key }, new CultRecordHandle<Counter>(new CultRecordKey(key)));
+                    if (!published.TryGetValue(key, out var thread) || thread != Environment.CurrentManagedThreadId)
+                        Interlocked.Increment(ref late);
+                }
+            })).ToArray();
+
+            Assert.That(Task.WaitAll(writers, TimeSpan.FromSeconds(60)), Is.True);
+            Assert.That(late, Is.Zero, "a write returned before its own change was published on its thread");
+            Assert.That(published.Count, Is.EqualTo(12000));
+        }
+
+        [Test]
+        public void ThrowingObserverDoesNotLoseOtherChanges()
+        {
+            var store = DirectoryStore(PathOf("throwing.cc"));
+            using var a = store.Open();
+            using var other = store.Open();
+            var loads = 0;
+            var armed = 0;
+            a.OnUpdate += (_, _) =>
+            {
+                Interlocked.Increment(ref loads);
+                if (Interlocked.Exchange(ref armed, 0) == 1)
+                    throw new InvalidOperationException("observer failed");
+            };
+            var published = new ConcurrentDictionary<string, int>();
+            using var subscription = a.Watch<Counter>().Subscribe(change => published[change.Key.Value] = Environment.CurrentManagedThreadId);
+
+            var failed = 0;
+            var late = 0;
+            using var stop = new CancellationTokenSource();
+            var writing = Task.Run(() =>
+            {
+                for (var i = 0; !stop.IsCancellationRequested; i++)
+                {
+                    var key = $"w:{i}";
+                    try
+                    {
+                        a.UpsertAsync(new Counter { Name = key }, new CultRecordHandle<Counter>(new CultRecordKey(key)));
+                        if (!published.TryGetValue(key, out var thread) || thread != Environment.CurrentManagedThreadId)
+                            Interlocked.Increment(ref late);
+                    }
+                    catch (Exception)
+                    {
+                        Interlocked.Increment(ref failed);
+                    }
+                }
+            });
+
+            try
+            {
+                for (var pull = 0; pull < 50; pull++)
+                {
+                    var first = new CultRecordKey($"first:{pull}");
+                    var second = new CultRecordKey($"second:{pull}");
+                    Assert.That(other.Commit(batch =>
+                    {
+                        batch.Upsert(new Counter { Name = first.Value }, new CultRecordHandle<Counter>(first));
+                        batch.Upsert(new Counter { Name = second.Value }, new CultRecordHandle<Counter>(second));
+                    }), Is.True);
+                    Interlocked.Exchange(ref armed, 1);
+                    Assert.That(() => a.PullAllBackingStoresAsync(), Throws.InvalidOperationException.With.Message.EqualTo("observer failed"), $"pull {pull}");
+                    Assert.That(loads, Is.EqualTo(2 * (pull + 1)), $"pull {pull} lost a change after its observer threw");
+                    Assert.That(published.ContainsKey(second.Value), Is.True, $"pull {pull} never published its second record");
+                }
+            }
+            finally
+            {
+                stop.Cancel();
+                Assert.That(writing.Wait(TimeSpan.FromSeconds(10)), Is.True);
+            }
+
+            Assert.That(failed, Is.Zero, "an unrelated write threw another call's observer exception");
+            Assert.That(late, Is.Zero, "an unrelated write returned before its change was published");
+        }
+
+        [Test]
+        public void UnconditionalCommitIsLastWriterWinsLikeFlush()
+        {
+            var committed = LastWriter(SingleFile(PathOf("commit.cc")), (cache, key) =>
+                Assert.That(cache.Commit(batch => batch.Upsert(new Counter { Name = key.Value }, new CultRecordHandle<Counter>(key))), Is.True));
+            var flushed = LastWriter(SingleFile(PathOf("flush.cc")), (cache, key) =>
+            {
+                cache.UpsertAsync(new Counter { Name = key.Value }, new CultRecordHandle<Counter>(key));
+                cache.FlushAllBackingStores();
+            });
+
+            Assert.That(committed, Is.EqualTo(new[] { "a", "x" }), "an unconditional commit kept a record its cache never saw");
+            Assert.That(committed, Is.EqualTo(flushed));
+
+            // A directory store's flush lands staged keys onto the current manifest, and its commit does exactly the same.
+            var directoryCommitted = LastWriter(DirectoryStore(PathOf("commit-dir.cc")), (cache, key) =>
+                Assert.That(cache.Commit(batch => batch.Upsert(new Counter { Name = key.Value }, new CultRecordHandle<Counter>(key))), Is.True));
+            var directoryFlushed = LastWriter(DirectoryStore(PathOf("flush-dir.cc")), (cache, key) =>
+            {
+                cache.UpsertAsync(new Counter { Name = key.Value }, new CultRecordHandle<Counter>(key));
+                cache.FlushAllBackingStores();
+            });
+            Assert.That(directoryCommitted, Is.EqualTo(new[] { "a", "c", "x" }), "a directory commit dropped a key another writer added");
+            Assert.That(directoryCommitted, Is.EqualTo(directoryFlushed));
+        }
+
+        [Test]
+        public void UnconditionalCommitPersistsStagedWrites()
+        {
+            var path = PathOf("staged.cc");
+            using var cache = SingleFile(path).Open();
+            cache.UpsertAsync(new Counter { Name = "s" }, new CultRecordHandle<Counter>(new CultRecordKey("s")));
+            Assert.That(cache.Commit(batch => batch.Upsert(new Counter { Name = "y" }, new CultRecordHandle<Counter>(new CultRecordKey("y")))), Is.True);
+
+            Assert.That(cache.IsDirty, Is.False);
+            using var reader = SingleFile(path).Open();
+            Assert.That(reader.AllStoredDocuments.Select(stored => stored.Key.Value), Is.EqualTo(new[] { "s", "y" }));
+        }
+
+        [Test]
+        public void OpeningACorruptStoreThrowsAndLeavesItUntouched()
+        {
+            foreach (var store in new[] { SingleFile(PathOf("corrupt.cc")), DirectoryStore(PathOf("corrupt-dir.cc")) })
+            {
+                File.WriteAllBytes(store.Path, new byte[] { 0xC1, 0x00, 0xFF, 0x13 });
+                Assert.That(() => store.Open(), Throws.Exception, $"{store.Path}: a corrupt store opened");
+                Assert.That(File.ReadAllBytes(store.Path), Is.EqualTo(new byte[] { 0xC1, 0x00, 0xFF, 0x13 }), $"{store.Path}: opening rewrote a corrupt store");
+            }
+
+            var unknown = PathOf("unknown-schema.cc");
+            using (var writer = SingleFile(unknown).Open())
+            {
+                writer.UpsertAsync(new Tally { Name = "t" });
+                writer.FlushAllBackingStores();
+            }
+
+            var bytes = File.ReadAllBytes(unknown);
+            using var narrow = new CultCache(CultDocumentRegistry.ForTypes(new[] { typeof(Counter) }));
+            Assert.That(() => narrow.AddBackingStore(new SingleFileMessagePackBackingStore(unknown)), Throws.Exception, "a store with an unknown schema opened");
+            Assert.That(File.ReadAllBytes(unknown), Is.EqualTo(bytes), "opening rewrote a store with an unknown schema");
+        }
+
+        // A pulls {a}; B commits c; A writes x. Returns the keys on disk afterwards.
+        private static string[] LastWriter(StoreFactory store, Action<CultCache, CultRecordKey> write)
+        {
+            using (var seed = store.Open())
+                Assert.That(seed.Commit(batch => batch.Upsert(new Counter { Name = "a" }, new CultRecordHandle<Counter>(new CultRecordKey("a")))), Is.True);
+            using var a = store.Open();
+            using (var b = store.Open())
+                Assert.That(b.Commit(batch => batch.Upsert(new Counter { Name = "c" }, new CultRecordHandle<Counter>(new CultRecordKey("c")))), Is.True);
+            write(a, new CultRecordKey("x"));
+            using var reader = store.Open();
+            return reader.AllStoredDocuments.Select(stored => stored.Key.Value).ToArray();
+        }
+
+        private static void StaleExpect(StoreFactory store)
+        {
+            Create(store, 0);
+            using var a = store.Open();
+            using var b = store.Open();
+            Assert.That(Increment(a), Is.True);
+            var before = File.ReadAllBytes(store.Path);
+            var observedByB = b.Get<Counter>(Key)!;
+            var changes = 0;
+            using var subscription = b.Watch<Counter>().Subscribe(_ => changes++);
+
+            Assert.That(Commit(b, observedByB, 100), Is.False, $"{store.Path}: b's stale Expect committed");
+            Assert.That(File.ReadAllBytes(store.Path), Is.EqualTo(before));
+            Assert.That(b.Get<Counter>(Key), Is.SameAs(observedByB));
+            Assert.That(b.IsDirty, Is.False);
+            Assert.That(changes, Is.Zero);
+        }
+
+        private static void CreateOnce(StoreFactory store)
+        {
+            using var a = store.Open();
+            using var b = store.Open();
+            Assert.That(CreateCommit(a, 1), Is.True);
+            Assert.That(CreateCommit(b, 2), Is.False, $"{store.Path}: a second create-once commit won");
+            using var reader = store.Open();
+            Assert.That(reader.Get<Counter>(Key)!.Value, Is.EqualTo(1));
+        }
+
+        private static void UnrelatedWrite(StoreFactory store)
+        {
+            Create(store, 0);
+            using var a = store.Open();
+            using var b = store.Open();
+            Assert.That(a.Commit(batch => batch.Upsert(new Counter { Name = "b" }, new CultRecordHandle<Counter>(new CultRecordKey("b")))), Is.True);
+
+            Assert.That(Increment(b), Is.True, $"{store.Path}: an unrelated write failed a per-entry condition");
+            using var reader = store.Open();
+            Assert.That(reader.Get<Counter>(Key)!.Value, Is.EqualTo(1));
+            Assert.That(reader.Get(new CultRecordKey("b")), Is.Not.Null, $"{store.Path}: the commit dropped a record it never loaded");
+        }
+
+        private static void UnrelatedInsert(StoreFactory store)
+        {
+            Create(store, 0);
+            using var a = store.Open();
+            using var b = store.Open();
+            Assert.That(a.Commit(batch => batch.Upsert(new Counter { Name = "c" }, new CultRecordHandle<Counter>(new CultRecordKey("c")))), Is.True);
+
+            Assert.That(b.Commit(batch =>
+            {
+                batch.ExpectUnchanged();
+                batch.Upsert(new Counter { Name = "counter", Value = 5 }, new CultRecordHandle<Counter>(Key));
+            }), Is.False, $"{store.Path}: ExpectUnchanged ignored an insert");
+        }
+
+        private static void Create(StoreFactory store, int value)
+        {
+            using var cache = store.Open();
+            Assert.That(CreateCommit(cache, value), Is.True);
+        }
+
+        private static bool CreateCommit(CultCache cache, int value) => cache.Commit(batch =>
+        {
+            batch.Expect(Key, null);
+            batch.Upsert(new Counter { Name = "counter", Value = value }, new CultRecordHandle<Counter>(Key));
+        });
+
+        private static bool Increment(CultCache cache)
+        {
+            var observed = cache.Get<Counter>(Key)!;
+            return Commit(cache, observed, observed.Value + 1);
+        }
+
+        private static bool Commit(CultCache cache, Counter observed, int value) => cache.Commit(batch =>
+        {
+            batch.Expect(Key, observed);
+            batch.Upsert(new Counter { Name = "counter", Value = value }, new CultRecordHandle<Counter>(Key));
+        });
+
+        // One writer's delivery is parked in an observer; other writers, whose observers write the same cache, finish.
+        // The cache is not disposed on failure because a stuck delivery would hang disposal too.
+        [Test]
+        public void ObserverWritingTheSameCacheDoesNotWaitOnOtherDeliveries()
+        {
+            var cache = new CultCache(Registry);
+            using var release = new ManualResetEventSlim();
+            using var parked = new ManualResetEventSlim();
+            using var park = cache.Watch<Counter>().Subscribe(change =>
+            {
+                if (change.Key.Value != "parked") return;
+                parked.Set();
+                release.Wait(TimeSpan.FromSeconds(30));
+            });
+            using var tallies = cache.Watch<Counter>().Subscribe(change =>
+                cache.UpsertAsync(new Tally { Name = $"t:{change.Key.Value}" }, new CultRecordHandle<Tally>(new CultRecordKey($"t:{change.Key.Value}"))));
+
+            var parkedWriter = Task.Run(() => cache.UpsertAsync(new Counter { Name = "parked" }, new CultRecordHandle<Counter>(new CultRecordKey("parked"))));
+            Assert.That(parked.Wait(TimeSpan.FromSeconds(5)), Is.True);
+            var writers = Enumerable.Range(0, 8).Select(thread => Task.Run(() =>
+            {
+                for (var i = 0; i < 100; i++)
+                    cache.UpsertAsync(new Counter { Name = $"c:{thread}", Value = i }, new CultRecordHandle<Counter>(new CultRecordKey($"c:{thread}")));
+            })).ToArray();
+            var finished = Task.WaitAll(writers, TimeSpan.FromSeconds(10));
+            release.Set();
+
+            Assert.That(finished, Is.True, "a writer waited on another thread's delivery");
+            Assert.That(parkedWriter.Wait(TimeSpan.FromSeconds(10)), Is.True);
+            cache.Dispose();
+        }
+
+        // Ordered by Sequence, each change replaces the document installed by the change before it.
+        [Test]
+        public void SequenceIncreasesInAdmissionOrder()
+        {
+            using var cache = new CultCache(Registry);
+            var key = new CultRecordKey("ordered");
+            var observed = new ConcurrentBag<CultCacheDocumentChange<Counter>>();
+            using var subscription = cache.Watch<Counter>().Subscribe(observed.Add);
+
+            var writers = Enumerable.Range(0, 8).Select(_ => Task.Run(() =>
+            {
+                for (var i = 0; i < 2000; i++)
+                    cache.UpsertAsync(new Counter { Name = "ordered", Value = i }, new CultRecordHandle<Counter>(key));
+            })).ToArray();
+
+            Assert.That(Task.WaitAll(writers, TimeSpan.FromSeconds(60)), Is.True);
+            var ordered = observed.OrderBy(change => change.Sequence).ToArray();
+            Assert.That(ordered, Has.Length.EqualTo(16000));
+            Assert.That(ordered.Select(change => change.Sequence).Distinct().Count(), Is.EqualTo(16000), "a Sequence repeated");
+            var broken = Enumerable.Range(1, ordered.Length - 1)
+                .FirstOrDefault(i => !ReferenceEquals(ordered[i].PreviousDocument, ordered[i - 1].Document));
+            Assert.That(broken, Is.EqualTo(0), "a change's previous document is not the one installed by the next-lower Sequence");
+        }
+
+        // Each read must hold the document of the highest-Sequence change at or below the read's Sequence.
+        [Test]
+        public void SequencedReadReflectsEveryChangeAtOrBelowItsSequence()
+        {
+            using var cache = new CultCache(Registry);
+            var key = new CultRecordKey("sequenced");
+            var handle = new CultRecordHandle<Counter>(key);
+            var changes = new ConcurrentBag<CultCacheDocumentChange<Counter>>();
+            using var subscription = cache.Watch<Counter>().Subscribe(changes.Add);
+            cache.UpsertAsync(new Counter { Name = "sequenced", Value = -1 }, handle);
+
+            var reads = new ConcurrentBag<(object? Document, long Sequence)>();
+            var writers = Enumerable.Range(0, 4).Select(_ => Task.Run(() =>
+            {
+                for (var i = 0; i < 2000; i++)
+                    cache.UpsertAsync(new Counter { Name = "sequenced", Value = i }, handle);
+            })).ToArray();
+            var readers = Enumerable.Range(0, 4).Select(_ => Task.Run(() =>
+            {
+                while (!writers.All(writer => writer.IsCompleted))
+                    reads.Add(cache.GetWithSequence(key));
+            })).ToArray();
+
+            Assert.That(Task.WaitAll(writers.Concat(readers).ToArray(), TimeSpan.FromSeconds(60)), Is.True);
+            var ordered = changes.OrderBy(change => change.Sequence).ToArray();
+            var sequences = ordered.Select(change => change.Sequence).ToArray();
+            Assert.That(reads, Is.Not.Empty);
+            foreach (var (document, sequence) in reads)
+            {
+                var index = Array.BinarySearch(sequences, sequence);
+                Assert.That(index, Is.GreaterThanOrEqualTo(0), "a read's Sequence names no admitted change");
+                Assert.That(document, Is.SameAs(ordered[index].Document), $"read at Sequence {sequence} missed a change at or below it");
+            }
+        }
+
+        private string PathOf(string fileName) => System.IO.Path.Combine(_directory, fileName);
+
+        private static readonly CultDocumentRegistry Registry = CultDocumentRegistry.ForTypes(new[] { typeof(Counter), typeof(Tally), typeof(Slow) });
+
+        private static StoreFactory SingleFile(string path) => new(path, () => new SingleFileMessagePackBackingStore(path));
+
+        private static StoreFactory DirectoryStore(string path) => new(path, () => new DirectoryMessagePackBackingStore(path));
+
+        // Pauses a pull between reading the file and handing the records to the cache.
+        private sealed class PausingStore : SingleFileMessagePackBackingStore
+        {
+            public PausingStore(string path) : base(path)
+            {
+            }
+
+            public ManualResetEventSlim? Pause;
+            public readonly ManualResetEventSlim Entered = new();
+            public volatile bool Paused;
+            public volatile bool PushedWhilePaused;
+
+            public override void Push(CultStoredDocument entry)
+            {
+                if (Paused)
+                    PushedWhilePaused = true;
+                base.Push(entry);
+            }
+
+            protected override CultPersistedStoreSnapshot DeserializeSnapshot(byte[] data)
+            {
+                var snapshot = base.DeserializeSnapshot(data);
+                if (Pause is { } pause)
+                {
+                    Paused = true;
+                    Entered.Set();
+                    pause.Wait();
+                    Paused = false;
+                }
+
+                return snapshot;
+            }
+        }
+
+        private sealed class StoreFactory
+        {
+            private readonly Func<CacheBackingStore> _create;
+
+            public StoreFactory(string path, Func<CacheBackingStore> create)
+            {
+                Path = path;
+                _create = create;
+            }
+
+            public string Path { get; }
+
+            public CultCache Open()
+            {
+                var cache = new CultCache(Registry);
+                cache.AddBackingStore(_create());
+                return cache;
+            }
+        }
+
+        [CultDocument("tests.conditional_counter", "tests.conditional_counter.v1")]
+        [MessagePackObject(AllowPrivate = true)]
+        internal sealed class Counter
+        {
+            [Key(0)]
+            [CultName]
+            public string Name = string.Empty;
+
+            [Key(1)]
+            public int Value;
+        }
+
+        [CultDocument("tests.conditional_tally", "tests.conditional_tally.v1")]
+        [MessagePackObject(AllowPrivate = true)]
+        internal sealed class Tally
+        {
+            [Key(0)]
+            [CultName]
+            public string Name = string.Empty;
+        }
+
+        // Loading a record with Blocks set waits on Pause, which parks a directory pull inside its page load.
+        [CultDocument("tests.conditional_slow", "tests.conditional_slow.v1")]
+        [MessagePackObject(AllowPrivate = true)]
+        internal sealed class Slow
+        {
+            internal static volatile ManualResetEventSlim? Pause;
+            internal static readonly ManualResetEventSlim Entered = new();
+            internal static volatile bool Paused;
+            internal static volatile bool ReadWhilePaused;
+            [IgnoreMember] private bool _blocks;
+            [IgnoreMember] private string _name = string.Empty;
+
+            [Key(0)]
+            [CultName]
+            public string Name
+            {
+                get
+                {
+                    if (Paused)
+                        ReadWhilePaused = true;
+                    return _name;
+                }
+                set => _name = value;
+            }
+
+            [Key(1)]
+            public bool Blocks
+            {
+                get => _blocks;
+                set
+                {
+                    _blocks = value;
+                    if (value && Pause is { } pause)
+                    {
+                        Paused = true;
+                        Entered.Set();
+                        pause.Wait();
+                        Paused = false;
+                    }
+                }
+            }
+        }
+    }
+}
diff --git a/tests/GameCult.Caching.Tests/CultDocumentRegistryTests.cs b/tests/GameCult.Caching.Tests/CultDocumentRegistryTests.cs
new file mode 100644
index 00000000..2e061f47
--- /dev/null
+++ b/tests/GameCult.Caching.Tests/CultDocumentRegistryTests.cs
@@ -0,0 +1,155 @@
+using System;
+using System.Linq;
+using System.Reflection;
+using System.Reflection.Emit;
+using System.Threading.Tasks;
+using NUnit.Framework;
+
+namespace GameCult.Caching.Tests;
+
+[TestFixture]
+public sealed class CultDocumentRegistryTests
+{
+    [Test]
+    public void ForTypesContainsOnlyExplicitDocuments()
+    {
+        var requested = CreateDocumentType("explicit", "tests.registry.explicit", "v1");
+        var unrelated = CreateDocumentType("unrelated", "tests.registry.unrelated", "v1");
+
+        var registry = CultDocumentRegistry.ForTypes(new[] { requested, requested });
+
+        Assert.That(registry.AllDescriptors.Select(value => value.DocumentType), Is.EqualTo(new[] { requested }));
+        Assert.That(registry.AllDescriptors.Any(value => value.DocumentType == unrelated), Is.False);
+    }
+
+    [Test]
+    public void IdenticalTypeRegistrationIsIdempotent()
+    {
+        var registry = new CultDocumentRegistry();
+        var type = CreateDocumentType("idempotent", "tests.registry.idempotent", "v1");
+
+        var first = registry.GetRequired(type);
+        var second = registry.GetRequired(type);
+
+        Assert.That(second, Is.SameAs(first));
+    }
+
+    [Test]
+    public void ExactWireCompatibleAliasRegistersByTypeWithOneCanonicalSchemaDescriptor()
+    {
+        var registry = new CultDocumentRegistry();
+        var firstType = CreateDocumentType("alias_owner", "tests.registry.alias", "v1");
+        var aliasType = CreateDocumentType("alias_claimant", "tests.registry.alias", "v1");
+
+        var canonical = registry.GetRequired(firstType);
+        var alias = registry.GetRequired(aliasType);
+
+        Assert.Multiple(() =>
+        {
+            Assert.That(alias.DocumentType, Is.EqualTo(aliasType));
+            Assert.That(alias.SchemaId, Is.EqualTo(canonical.SchemaId));
+            Assert.That(registry.GetRequired(aliasType), Is.SameAs(alias));
+            Assert.That(registry.GetRequiredBySchemaId(canonical.SchemaId), Is.SameAs(canonical));
+            Assert.That(
+                registry.AllDescriptors.Count(descriptor => descriptor.SchemaId == canonical.SchemaId),
+                Is.EqualTo(2));
+        });
+    }
+
+    [Test]
+    public void DifferentVersionsSharingSchemaNameRegisterWithoutReflectionOrderSelection()
+    {
+        var registry = new CultDocumentRegistry();
+        var firstType = CreateDocumentType("version_one", "tests.registry.versioned", "v1");
+        var secondType = CreateDocumentType("version_two", "tests.registry.versioned", "v2");
+
+        var first = registry.GetRequired(firstType);
+        var second = registry.GetRequired(secondType);
+
+        Assert.Multiple(() =>
+        {
+            Assert.That(registry.GetRequiredBySchemaId(first.SchemaId), Is.SameAs(first));
+            Assert.That(registry.GetRequiredBySchemaId(second.SchemaId), Is.SameAs(second));
+        });
+
+        var persisted = new CultSchemaCatalogEntry
+        {
+            SchemaId = "tests.registry.versioned.unknown",
+            SchemaName = "tests.registry.versioned",
+            SchemaVersion = "legacy"
+        };
+        Assert.That(
+            () => registry.ResolvePersistedSchema(persisted.SchemaId, new[] { persisted }),
+            Throws.TypeOf<InvalidOperationException>()
+                .With.Message.Contains("ambiguous across local versions")
+                .And.Message.Contains("v1")
+                .And.Message.Contains("v2"));
+    }
+
+    [Test]
+    public void IncompatibleTypesClaimingSameSchemaNameAndVersionFailBeforeMutation()
+    {
+        var registry = new CultDocumentRegistry();
+        var firstType = CreateDocumentType("layout_owner", "tests.registry.layout_collision", "v1");
+        var secondType = CreateDocumentType(
+            "layout_claimant",
+            "tests.registry.layout_collision",
+            "v1",
+            addStringField: true);
+        var first = registry.GetRequired(firstType);
+
+        Assert.That(
+            () => registry.GetRequired(secondType),
+            Throws.TypeOf<InvalidOperationException>()
+                .With.Message.Contains("schema name 'tests.registry.layout_collision' version 'v1'")
+                .And.Message.Contains(firstType.FullName)
+                .And.Message.Contains(secondType.FullName));
+        Assert.That(registry.GetRequiredBySchemaId(first.SchemaId), Is.SameAs(first));
+        Assert.That(registry.AllDescriptors.Any(descriptor => descriptor.DocumentType == secondType), Is.False);
+    }
+
+    [Test]
+    public void ConcurrentRefreshAndReadsObserveCompleteRegistrySnapshots()
+    {
+        var registry = new CultDocumentRegistry();
+        var type = CreateDocumentType("refresh_visible", "tests.registry.refresh_visible", "v1");
+        var descriptor = registry.GetRequired(type);
+
+        Parallel.For(0, 20, _ =>
+        {
+            registry.Refresh();
+            Assert.That(registry.GetRequired(type).SchemaId, Is.EqualTo(descriptor.SchemaId));
+            Assert.That(registry.GetRequiredBySchemaId(descriptor.SchemaId).SchemaId, Is.EqualTo(descriptor.SchemaId));
+        });
+    }
+
+    private static Type CreateDocumentType(
+        string typeName,
+        string schemaName,
+        string schemaVersion,
+        bool addStringField = false)
+    {
+        var assembly = AssemblyBuilder.DefineDynamicAssembly(
+            new AssemblyName("GameCult.Caching.RegistryTests." + Guid.NewGuid().ToString("N")),
+            AssemblyBuilderAccess.Run);
+        var module = assembly.DefineDynamicModule("main");
+        var type = module.DefineType(
+            typeName,
+            TypeAttributes.Class | TypeAttributes.Public | TypeAttributes.Sealed);
+        var attributeConstructor = typeof(CultDocumentAttribute).GetConstructor(new[] { typeof(string), typeof(string) })!;
+        type.SetCustomAttribute(new CustomAttributeBuilder(
+            attributeConstructor,
+            new object[] { schemaName, schemaVersion }));
+        type.SetCustomAttribute(new CustomAttributeBuilder(
+            typeof(global::MessagePack.MessagePackObjectAttribute).GetConstructor(new[] { typeof(bool) })!,
+            new object[] { false }));
+        if (addStringField)
+        {
+            type.DefineField("Value", typeof(string), FieldAttributes.Public).SetCustomAttribute(new CustomAttributeBuilder(
+                typeof(global::MessagePack.KeyAttribute).GetConstructor(new[] { typeof(int) })!,
+                new object[] { 0 }));
+        }
+
+        return type.CreateType()!;
+    }
+}
diff --git a/tests/GameCult.Caching.Tests/CultInspectorModelTests.cs b/tests/GameCult.Caching.Tests/CultInspectorModelTests.cs
new file mode 100644
index 00000000..c5fd8cb1
--- /dev/null
+++ b/tests/GameCult.Caching.Tests/CultInspectorModelTests.cs
@@ -0,0 +1,442 @@
+#nullable enable
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Reflection;
+using System.Threading.Tasks;
+using GameCult.Caching.MessagePack;
+using MessagePack;
+using NUnit.Framework;
+
+namespace GameCult.Caching.Tests
+{
+    public class CultInspectorModelTests
+    {
+        private static readonly CultDocumentRegistry Registry =
+            CultDocumentRegistry.ForTypes(new[] { typeof(InspectItem), typeof(InspectOther), typeof(InspectFixed) });
+
+        private static CultInspectorModel Model() => CultCacheMessagePack.CreateInspectorModel(Registry);
+
+        private static CultRecordRef<InspectItem> Ref(string key) => new CultRecordRef<InspectItem>(new CultRecordKey(key));
+
+        [Test]
+        public void MembersFollowTheCatalogWithTheirMetadata()
+        {
+            var members = Model().MembersOf(typeof(InspectItem));
+
+            Assert.That(members.Select(member => member.Name),
+                Is.EqualTo(new[] { "Value", "Name", "Secret", "Locked", "Shape", "Links", "Numbers" }), "order first, then slot");
+            Assert.That(members.Single(member => member.Name == "Name").Metadata.Label, Is.EqualTo("Display Name"));
+            Assert.That(members.Single(member => member.Name == "Name").IsReadOnly, Is.False);
+            Assert.That(members.Single(member => member.Name == "Value").Metadata.Range!.Max, Is.EqualTo(10f));
+            Assert.That(members.Single(member => member.Name == "Secret").Metadata.Hidden, Is.True);
+            Assert.That(members.Single(member => member.Name == "Locked").IsReadOnly, Is.True);
+
+            var id = Model().MembersOf(typeof(InspectFixed)).Single();
+            Assert.That(id.IsAssignable, Is.False, "a get-only member its constructor fills cannot be assigned");
+            Assert.That(id.IsReadOnly, Is.True);
+
+            var hidden = Model().MembersOf(typeof(InspectHider)).Single();
+            Assert.That(hidden.Member.DeclaringType, Is.EqualTo(typeof(InspectHider)), "a `new` member is its most-derived declaration");
+            Assert.That(hidden.ValueType, Is.EqualTo(typeof(string)));
+        }
+
+        [Test]
+        public void ClaimsResolveAttributeThenTypeThenBuiltIn()
+        {
+            var claims = new CultInspectorDrawerClaims(
+                new[] { typeof(MarkDrawer), typeof(IntDrawer), typeof(ListDrawer), typeof(StringDrawerA), typeof(StringDrawerB), typeof(NotADrawer) },
+                typeof(IFakeDrawer));
+            FieldInfo Field(string name) => typeof(ClaimHost).GetField(name)!;
+
+            Assert.That(claims.Resolve(typeof(int), Field(nameof(ClaimHost.Marked))).Drawer, Is.EqualTo(typeof(MarkDrawer)));
+            Assert.That(claims.Resolve(typeof(int), Field(nameof(ClaimHost.Plain))).Drawer, Is.EqualTo(typeof(IntDrawer)),
+                "an invalid drawer claiming int does not contest the valid one");
+            Assert.That(claims.Resolve(typeof(List<float>), null).Drawer, Is.EqualTo(typeof(ListDrawer)));
+            Assert.That(claims.Resolve(typeof(float), null).Drawer, Is.Null);
+            Assert.That(claims.Resolve(typeof(float), null).Conflict, Is.Null);
+
+            var contested = claims.Resolve(typeof(string), null);
+            Assert.That(contested.Drawer, Is.Null);
+            Assert.That(contested.Conflict, Does.Contain(nameof(StringDrawerA)).And.Contain(nameof(StringDrawerB)));
+            Assert.That(claims.Errors.Any(error => error.Contains(nameof(NotADrawer))), Is.True);
+            Assert.That(claims.Errors.Any(error => error.Contains(nameof(StringDrawerA)) && error.Contains(nameof(StringDrawerB))), Is.True);
+        }
+
+        [Test]
+        public void ElementChoicesAreTheDeclaredUnionSubtypesOrTheTypeItself()
+        {
+            var model = Model();
+
+            Assert.That(model.ShapeOf(typeof(InspectShape)).Kind, Is.EqualTo(CultInspectorValueKind.Union));
+            Assert.That(model.ElementChoices(typeof(InspectShape)), Is.EqualTo(new[] { typeof(InspectCircle) }));
+            Assert.That(model.CreateElement(typeof(InspectShape), typeof(InspectCircle), out var made), Is.InstanceOf<InspectCircle>());
+            Assert.That(made, Is.Null);
+            Assert.That(() => model.CreateElement(typeof(InspectShape), typeof(InspectSquare), out _), Throws.ArgumentException,
+                "an undeclared subtype is not a choice");
+
+            Assert.That(model.ElementChoices(typeof(List<int>)), Is.EqualTo(new[] { typeof(List<int>) }));
+            Assert.That(model.CreateElement(typeof(List<int>), typeof(List<int>), out _), Is.EqualTo(new List<int>()));
+
+            Assert.That(model.CreateElement(typeof(InspectPicky), typeof(InspectNeedsArgs), out var refused), Is.Null);
+            Assert.That(refused, Does.Contain("parameterless"));
+            Assert.That(model.CreateElement(typeof(InspectNeedsArgs), typeof(InspectNeedsArgs), out var bare), Is.Null);
+            Assert.That(bare, Does.Contain("parameterless"), "a plain element type that cannot be made says so; nothing is added");
+            Assert.That(model.CreateElement(typeof(int?), typeof(int?), out var nullable), Is.Null);
+            Assert.That(nullable, Is.Null, "null is a Nullable<T> element, not a failure");
+
+            Assert.That(model.CreateElement(typeof(InspectShape), typeof(InspectShape), out var @abstract), Is.Null);
+            Assert.That(@abstract, Does.Contain("abstract"), "a union's own type cannot be made; it says so instead of throwing");
+            Assert.That(new[] { typeof(InspectShape), typeof(InspectNeedsArgs), typeof(IList<int>) }.Any(model.CanCreate), Is.False);
+            Assert.That(new[] { typeof(InspectItem), typeof(string), typeof(int[]), typeof(IDictionary<string, int>), typeof(InspectOpenStruct) }.All(model.CanCreate), Is.True);
+        }
+
+        [Test]
+        public void IntegerEditsClampToTheirType()
+        {
+            var model = Model();
+
+            Assert.That(model.NarrowInteger(typeof(byte), 300), Is.TypeOf<byte>().And.EqualTo(byte.MaxValue));
+            Assert.That(model.NarrowInteger(typeof(sbyte), -300), Is.TypeOf<sbyte>().And.EqualTo(sbyte.MinValue));
+            Assert.That(model.NarrowInteger(typeof(uint), -1), Is.TypeOf<uint>().And.EqualTo(0u));
+            Assert.That(model.NarrowInteger(typeof(int), 42), Is.TypeOf<int>().And.EqualTo(42));
+            Assert.That(() => model.NarrowInteger(typeof(float), 1), Throws.ArgumentException);
+        }
+
+        [Test]
+        public async Task RecordRefCandidatesAreRecordsAssignableToTheTarget()
+        {
+            using var cache = new CultCache(Registry);
+            var a = await cache.UpsertAsync(typeof(InspectItem), new InspectItem { Name = "a" });
+            var b = await cache.UpsertAsync(typeof(InspectItem), new InspectItem { Name = "b" });
+            await cache.UpsertAsync(typeof(InspectOther), new InspectOther { Name = "o" });
+
+            var candidates = Model().RecordCandidates(typeof(CultRecordRef<InspectItem>), cache.AllStoredDocuments);
+
+            Assert.That(candidates.Select(candidate => candidate.Key), Is.EqualTo(new[] { a, b }));
+            Assert.That(CultInspectorModel.RecordKey(default(CultRecordRef<InspectItem>)), Is.EqualTo(string.Empty));
+            Assert.That(CultInspectorModel.RecordKey(new CultRecordRef<InspectItem>(a)), Is.EqualTo(a.Value));
+        }
+
+        [Test]
+        public async Task DictionaryKeysRefuseNullEmptyReferencesAndDuplicates()
+        {
+            var model = Model();
+            var links = typeof(Dictionary<CultRecordRef<InspectItem>, int>);
+            var keys = new object?[] { Ref("a"), Ref("b") };
+            string? Refusal(object? candidate)
+            {
+                var kept = model.ReplaceKey(typeof(InspectItem),links, keys, 0, candidate, out var notice);
+                Assert.That(kept, Is.EqualTo(notice == null ? candidate : keys[0]), "a refused key keeps the entry's key");
+                return notice;
+            }
+
+            Assert.That(Refusal(Ref("")), Does.Contain("empty"));
+            Assert.That(Refusal(default(CultRecordRef<InspectItem>)), Does.Contain("empty"), "null and \"\" are one empty reference");
+            Assert.That(Refusal(Ref("b")), Does.Contain("duplicate").And.Contain("entry 0"));
+            Assert.That(Refusal(null), Does.Contain("null"));
+            Assert.That(Refusal(Ref("c")), Is.Null);
+
+            // An entry an old store left with an empty reference key keeps it through an edit of its value.
+            Assert.That(model.ReplaceKey(typeof(InspectItem),links, new object?[] { Ref(""), Ref("b") }, 0, default(CultRecordRef<InspectItem>), out var unchanged),
+                Is.EqualTo(default(CultRecordRef<InspectItem>)));
+            Assert.That(unchanged, Is.Null, "an unchanged key is never refused");
+
+            using var cache = new CultCache(Registry);
+            var first = await cache.UpsertAsync(typeof(InspectItem), new InspectItem { Name = "first" });
+            var second = await cache.UpsertAsync(typeof(InspectItem), new InspectItem { Name = "second" });
+            var fresh = model.FreshKey(typeof(InspectItem),links, new object?[] { new CultRecordRef<InspectItem>(first) }, cache.AllStoredDocuments, out _);
+            Assert.That(CultInspectorModel.RecordKey(fresh), Is.EqualTo(second.Value));
+            Assert.That(model.FreshKey(typeof(InspectItem),links, new object?[] { new CultRecordRef<InspectItem>(first), new CultRecordRef<InspectItem>(second) },
+                cache.AllStoredDocuments, out var none), Is.Null);
+            Assert.That(none, Does.Contain("No unused"));
+        }
+
+        [Test]
+        public void DictionaryKeysAgreeWithTheDictionaryComparer()
+        {
+            var model = Model();
+            var doubles = typeof(Dictionary<double, int>);
+            var keys = new object?[] { 0.0, 1.0 };
+
+            Assert.That(model.ReplaceKey(typeof(InspectItem),doubles, keys, 1, -0.0, out var notice), Is.EqualTo(1.0));
+            Assert.That(notice, Does.Contain("duplicate"), "-0.0 serializes apart from 0.0 but Equals it");
+            Assert.That(() => model.BuildDictionary(doubles, keys.Select(key => new KeyValuePair<object?, object?>(key, 0))), Throws.Nothing);
+            Assert.That(model.FreshKey(typeof(InspectItem),doubles, new object?[] { -0.0 }, Array.Empty<CultStoredDocument>(), out _), Is.Null,
+                "the default 0.0 is taken by -0.0");
+            Assert.That(model.ReplaceKey(typeof(InspectItem),doubles, new object?[] { 0.0 }, 0, -0.0, out _), Is.EqualTo(-0.0), "a key may replace itself");
+        }
+
+        [Test]
+        public void DictionaryKeysCompareBySerializedValueNotText()
+        {
+            var model = Model();
+            var dictionary = typeof(Dictionary<InspectKey, int>);
+
+            Assert.That(model.FreshKey(typeof(InspectItem),dictionary, new object?[] { new InspectKey(1) }, Array.Empty<CultStoredDocument>(), out _),
+                Is.EqualTo(new InspectKey(0)), "keys whose text collides are still distinct keys");
+            Assert.That(model.ReplaceKey(typeof(InspectItem),dictionary, new object?[] { new InspectKey(1), new InspectKey(2) }, 1, new InspectKey(3), out var notice),
+                Is.EqualTo(new InspectKey(3)));
+            Assert.That(notice, Is.Null);
+        }
+
+        // Pair's formatter is declared only by this test assembly (AssemblyInfo). A key's bytes come from its owning document's
+        // options, so a document here stores it and a document from an assembly declaring no resolver cannot.
+        [Test]
+        public void DictionaryKeysSerializeUnderTheOwningDocument()
+        {
+            var model = Model();
+            var pairs = typeof(Dictionary<Pair, int>);
+            var keys = new object?[] { new Pair { A = 1 }, new Pair { A = 2 } };
+
+            Assert.That(model.ReplaceKey(typeof(InspectItem), pairs, keys, 1, new Pair { A = 3 }, out var accepted), Is.EqualTo(new Pair { A = 3 }));
+            Assert.That(accepted, Is.Null);
+            Assert.That(model.ReplaceKey(typeof(object), pairs, keys, 1, new Pair { A = 3 }, out var refused), Is.EqualTo(keys[1]),
+                "a key its document cannot serialize is refused, not compared by text");
+            Assert.That(refused, Does.Contain("cannot serialize"));
+            Assert.That(model.FreshKey(typeof(object), pairs, new object?[] { new Pair { A = 1 } }, Array.Empty<CultStoredDocument>(), out var none), Is.Null);
+            Assert.That(none, Does.Contain("cannot serialize"));
+        }
+
+        [Test]
+        public async Task RefusedCommitLeavesTheCachedDocumentUnchanged()
+        {
+            var filePath = Path.Combine(Path.GetTempPath(), $"cultlib-tests-{Guid.NewGuid():N}.cc");
+            try
+            {
+                using (var seed = CultCacheMessagePack.Create(filePath, new CultCacheOpenOptions { Registry = Registry }))
+                {
+                    await seed.UpsertAsync(typeof(InspectItem), new InspectItem { Name = "original", Numbers = { 1, 2 } });
+                    await seed.FlushAsync();
+                }
+
+                var model = Model();
+                using var readOnly = CultCacheMessagePack.Create(filePath, new CultCacheOpenOptions { Registry = Registry, ReadOnly = true });
+                var record = readOnly.AllStoredDocuments.Single();
+                var edit = model.BeginEdit(record);
+                Assert.That(edit.Document, Is.Not.SameAs(record.Document));
+                ((InspectItem)edit.Document).Name = "changed";
+                ((InspectItem)edit.Document).Numbers.Add(3);
+
+                Assert.That(edit.Commit(readOnly, out var error), Is.False);
+                Assert.That(error, Is.Not.Null.And.Not.Empty);
+                Assert.That(readOnly.Get<InspectItem>(record.Key)!.Name, Is.EqualTo("original"));
+                Assert.That(readOnly.Get<InspectItem>(record.Key)!.Numbers, Is.EqualTo(new[] { 1, 2 }));
+                Assert.That(edit.IsFor(record), Is.False, "a commit spends the edit");
+
+                using var writable = new CultCache(Registry);
+                var key = await writable.UpsertAsync(typeof(InspectItem), new InspectItem { Name = "original" });
+                var stored = writable.AllStoredDocuments.Single();
+                var accepted = model.BeginEdit(stored);
+                ((InspectItem)accepted.Document).Name = "changed";
+                Assert.That(accepted.Commit(writable, out _), Is.True);
+                Assert.That(writable.Get<InspectItem>(key)!.Name, Is.EqualTo("changed"));
+                Assert.That(((InspectItem)stored.Document).Name, Is.EqualTo("original"), "the replaced object was never mutated");
+            }
+            finally
+            {
+                if (File.Exists(filePath)) File.Delete(filePath);
+            }
+        }
+
+        [Test]
+        public void ShapesClassifyCollectionsStructsAndMultiDimensionalArrays()
+        {
+            var model = Model();
+
+            Assert.That(model.ShapeOf(typeof(float[,])).Kind, Is.EqualTo(CultInspectorValueKind.Unsupported));
+            Assert.That(model.ShapeOf(typeof(float[,])).Reason, Does.Contain("multi-dimensional"));
+            Assert.That(model.ShapeOf(typeof(List<int>)).ElementType, Is.EqualTo(typeof(int)));
+            Assert.That(model.BuildList(typeof(float[]), new object?[] { 1f, 2f }), Is.EqualTo(new[] { 1f, 2f }));
+
+            var open = model.ShapeOf(typeof(InspectOpenStruct));
+            Assert.That(open.Kind, Is.EqualTo(CultInspectorValueKind.Nested));
+            Assert.That(open.Members.Select(member => member.Name), Is.EqualTo(new[] { "x", "y" }));
+            Assert.That(open.Members.All(member => member.IsAssignable), Is.True);
+            (string, bool)[] Rows(Type type) => model.ShapeOf(type).Members.Select(member => (member.Name, member.IsReadOnly)).ToArray();
+            Assert.That(Rows(typeof(InspectMixedStruct)), Is.EqualTo(new[] { ("x", false), ("y", true) }),
+                "a struct with public fields shows only them; its settable properties are aliases, not rows");
+            Assert.That(Rows(typeof(InspectPropertyStruct)), Is.EqualTo(new[] { ("Settable", false), ("Initable", true) }),
+                "without public fields, settable properties are rows; init is read-only; get-only is not a row");
+            Assert.That(Rows(typeof(InspectRecordStruct)), Is.EqualTo(new[] { ("A", false), ("B", false) }));
+            Assert.That(Rows(typeof(InspectReadonlyRecordStruct)), Is.EqualTo(new[] { ("A", true), ("B", true) }));
+            object boxed = new InspectRecordStruct(1, 2f);
+            model.ShapeOf(typeof(InspectRecordStruct)).Members[0].SetValue(boxed, 5);
+            Assert.That(((InspectRecordStruct)boxed).A, Is.EqualTo(5), "a property edit lands in the boxed struct in place");
+
+            Assert.That(model.ShapeOf(typeof(IDictionary<string, int>)).Kind, Is.EqualTo(CultInspectorValueKind.Dictionary));
+            Assert.That(model.BuildDictionary(typeof(IDictionary<string, int>), new[] { new KeyValuePair<object?, object?>("a", 1) }),
+                Is.EqualTo(new Dictionary<string, int> { ["a"] = 1 }));
+        }
+
+        [CultDocument("tests.inspect_item", "tests.inspect_item.v1")]
+        [MessagePackObject]
+        public sealed class InspectItem
+        {
+            [Key(0)] [CultName] [CultInspectorLabel("Display Name")]
+            public string Name = string.Empty;
+
+            [Key(1)] [CultInspectorRange(0, 10)] [CultInspectorOrder(-1)]
+            public int Value;
+
+            [Key(2)] [CultInspectorHidden]
+            public string Secret = string.Empty;
+
+            [Key(3)] [CultInspectorReadOnly]
+            public string Locked = string.Empty;
+
+            [Key(4)]
+            public InspectShape? Shape;
+
+            [Key(5)]
+            public Dictionary<CultRecordRef<InspectItem>, int> Links = new Dictionary<CultRecordRef<InspectItem>, int>();
+
+            [Key(6)]
+            public List<int> Numbers = new List<int>();
+        }
+
+        [CultDocument("tests.inspect_other", "tests.inspect_other.v1")]
+        [MessagePackObject]
+        public sealed class InspectOther
+        {
+            [Key(0)] [CultName]
+            public string Name = string.Empty;
+        }
+
+        [CultDocument("tests.inspect_fixed", "tests.inspect_fixed.v1")]
+        [MessagePackObject]
+        public sealed class InspectFixed
+        {
+            [SerializationConstructor]
+            public InspectFixed(string id)
+            {
+                Id = id;
+            }
+
+            [Key(0)]
+            public string Id { get; }
+        }
+
+        [Union(0, typeof(InspectCircle))]
+        public abstract class InspectShape
+        {
+        }
+
+        [MessagePackObject]
+        public sealed class InspectCircle : InspectShape
+        {
+            [Key(0)]
+            public float Radius;
+        }
+
+        [MessagePackObject]
+        public sealed class InspectSquare : InspectShape
+        {
+            [Key(0)]
+            public float Side;
+        }
+
+        [MessagePackObject]
+        public class InspectHidden
+        {
+            [Key(0)]
+            public int Value;
+        }
+
+        [MessagePackObject]
+        public sealed class InspectHider : InspectHidden
+        {
+            [Key(0)]
+            public new string Value = string.Empty;
+        }
+
+        [Union(0, typeof(InspectNeedsArgs))]
+        public abstract class InspectPicky
+        {
+        }
+
+        public sealed class InspectNeedsArgs : InspectPicky
+        {
+            public InspectNeedsArgs(int side)
+            {
+            }
+        }
+
+        public struct InspectOpenStruct
+        {
+            public float x;
+            public float y;
+            public float Length => x + y;
+        }
+
+        public struct InspectMixedStruct
+        {
+            public float x;
+            public readonly float y;
+            public float Alias { get => x; set => x = value; }
+        }
+
+        public struct InspectPropertyStruct
+        {
+            public int Settable { get; set; }
+            public int Initable { get; init; }
+            public int Computed => Settable + 1;
+        }
+
+        public record struct InspectRecordStruct(int A, float B);
+
+        public readonly record struct InspectReadonlyRecordStruct(int A, float B);
+
+        [MessagePackObject]
+        public readonly record struct InspectKey([property: Key(0)] int Value)
+        {
+            public override string ToString() => "key";
+        }
+
+        public interface IFakeDrawer
+        {
+        }
+
+        [AttributeUsage(AttributeTargets.Field)]
+        public sealed class InspectMarkAttribute : Attribute
+        {
+        }
+
+        public sealed class ClaimHost
+        {
+            [InspectMark] public int Marked;
+            public int Plain;
+        }
+
+        [CultInspectorDrawer(typeof(InspectMarkAttribute))]
+        public sealed class MarkDrawer : IFakeDrawer
+        {
+        }
+
+        [CultInspectorDrawer(typeof(int))]
+        public sealed class IntDrawer : IFakeDrawer
+        {
+        }
+
+        [CultInspectorDrawer(typeof(List<>))]
+        public sealed class ListDrawer : IFakeDrawer
+        {
+        }
+
+        [CultInspectorDrawer(typeof(string))]
+        public sealed class StringDrawerA : IFakeDrawer
+        {
+        }
+
+        [CultInspectorDrawer(typeof(string))]
+        public sealed class StringDrawerB : IFakeDrawer
+        {
+        }
+
+        [CultInspectorDrawer(typeof(int))]
+        public sealed class NotADrawer
+        {
+        }
+    }
+}
diff --git a/tests/GameCult.Caching.Tests/DirectoryStoreDurabilityTests.cs b/tests/GameCult.Caching.Tests/DirectoryStoreDurabilityTests.cs
new file mode 100644
index 00000000..41ef46ad
--- /dev/null
+++ b/tests/GameCult.Caching.Tests/DirectoryStoreDurabilityTests.cs
@@ -0,0 +1,242 @@
+#nullable enable
+using System;
+using System.IO;
+using System.Linq;
+using System.Security.Cryptography;
+using System.Threading.Tasks;
+using GameCult.Caching;
+using GameCult.Caching.MessagePack;
+using MessagePack;
+using NUnit.Framework;
+
+namespace GameCult.Caching.Tests
+{
+    // Faults come from real file locks, not from probes in the store.
+    public class DirectoryStoreDurabilityTests
+    {
+        private const string FixedStoredAt = "2026-09-13T00:00:00.0000000+00:00";
+        private static readonly CultDocumentRegistry Registry = CultDocumentRegistry.ForTypes(new[] { typeof(Page) });
+        private string _directory = string.Empty;
+        private string _manifest = string.Empty;
+        private string _records = string.Empty;
+
+        [SetUp]
+        public void CreateDirectory()
+        {
+            _directory = Path.Combine(Path.GetTempPath(), $"cultlib-durability-{Guid.NewGuid():N}");
+            Directory.CreateDirectory(_directory);
+            _manifest = Path.Combine(_directory, "store.cc");
+            _records = DirectoryMessagePackBackingStore.DefaultRecordDirectoryPath(_manifest);
+        }
+
+        [TearDown]
+        public void DeleteDirectory()
+        {
+            if (Directory.Exists(_directory))
+                Directory.Delete(_directory, recursive: true);
+        }
+
+        [Test]
+        public async Task FailedManifestReplaceKeepsPreviousGeneration()
+        {
+            using var cache = Open(out _);
+            var key = await cache.UpsertAsync(typeof(Page), new Page { Name = "a", Text = "one" });
+            cache.FlushAllBackingStores();
+            await cache.UpsertAsync(typeof(Page), new Page { Name = "a", Text = "two" }, key);
+
+            using (new FileStream(_manifest, FileMode.Open, FileAccess.Read, FileShare.Read))
+            {
+                Assert.That(() => cache.FlushAllBackingStores(),
+                    Throws.InstanceOf<IOException>().Or.InstanceOf<UnauthorizedAccessException>());
+            }
+
+            Assert.That(cache.IsDirty, Is.True);
+            using (var reader = Open(out _))
+                Assert.That(reader.Get<Page>(key)?.Text, Is.EqualTo("one"));
+
+            cache.FlushAllBackingStores();
+            using var reopened = Open(out _);
+            Assert.That(reopened.Get<Page>(key)?.Text, Is.EqualTo("two"));
+        }
+
+        [Test]
+        public void SameStoredAtDifferentPayloadWritesADistinctPage()
+        {
+            using var cache = Open(out var store);
+            var key = new CultRecordKey("page");
+            var descriptor = Registry.GetRequired<Page>();
+
+            store.Push(new CultStoredDocument(key, FixedStoredAt, descriptor, new Page { Name = "p", Text = "first" }));
+            store.PushAll();
+            var firstIdentity = ManifestRecord(key).Payload;
+            store.Push(new CultStoredDocument(key, FixedStoredAt, descriptor, new Page { Name = "p", Text = "second" }));
+            store.PushAll();
+            var secondIdentity = ManifestRecord(key).Payload;
+
+            Assert.That(secondIdentity, Is.Not.EqualTo(firstIdentity));
+            Assert.That(File.Exists(PagePath(secondIdentity)), Is.True);
+            using var reader = Open(out _);
+            Assert.That(reader.Get<Page>(key)?.Text, Is.EqualTo("second"));
+        }
+
+        [Test]
+        public void FlushWritesPagesBeforeManifest()
+        {
+            using var cache = Open(out var store);
+            var key = new CultRecordKey("page");
+            var descriptor = Registry.GetRequired<Page>();
+            store.Push(new CultStoredDocument(key, FixedStoredAt, descriptor, new Page { Name = "p", Text = "first" }));
+            store.PushAll();
+            var before = File.ReadAllBytes(_manifest);
+
+            const string nextStoredAt = "2026-09-13T00:00:01.0000000+00:00";
+            var next = new Page { Name = "p", Text = "second" };
+            var page = CultDocumentMessagePackSerialization.SerializePersistedRecord(new CultPersistedRecord
+            {
+                Key = key.Value,
+                SchemaId = descriptor.SchemaId,
+                StoredAt = nextStoredAt,
+                Payload = CultDocumentMessagePackSerialization.SerializeUntyped(next, typeof(Page), Registry)
+            });
+            using (var sha = SHA256.Create())
+                Directory.CreateDirectory(PagePath(sha.ComputeHash(page)));
+
+            store.Push(new CultStoredDocument(key, nextStoredAt, descriptor, next));
+            Assert.That(() => store.PushAll(), Throws.InstanceOf<IOException>().Or.InstanceOf<UnauthorizedAccessException>());
+
+            Assert.That(File.ReadAllBytes(_manifest), Is.EqualTo(before), "the manifest was written although its page was not");
+            using var reader = Open(out _);
+            Assert.That(reader.Get<Page>(key)?.Text, Is.EqualTo("first"));
+        }
+
+        [Test]
+        public void PullAllWaitsForHeldCommitLease()
+        {
+            using var cache = Open(out var store);
+            Task pull;
+            using (HoldLease())
+            {
+                pull = Task.Run(() => store.PullAll());
+                Assert.That(pull.Wait(100), Is.False, "PullAll did not wait for the commit lease");
+            }
+
+            Assert.That(pull.Wait(TimeSpan.FromSeconds(10)), Is.True);
+        }
+
+        [Test]
+        public async Task MutationBlockedBehindFlushStaysDirty()
+        {
+            using var cache = Open(out var store);
+            var first = await cache.UpsertAsync(typeof(Page), new Page { Name = "a" });
+            Task flush;
+            Task<CultRecordKey> mutation;
+            using (HoldLease())
+            {
+                flush = Task.Run(() => cache.FlushAllBackingStores());
+                Assert.That(flush.Wait(100), Is.False);
+                mutation = Task.Run(() => cache.UpsertAsync(typeof(Page), new Page { Name = "b" }));
+                Assert.That(mutation.Wait(100), Is.False, "a mutation ran while the flush held the store");
+            }
+
+            Assert.That(Task.WaitAll(new Task[] { flush, mutation }, TimeSpan.FromSeconds(10)), Is.True);
+            Assert.That(store.IsDirty, Is.True, "the flush pardoned a mutation it did not write");
+            using (var reader = Open(out _))
+            {
+                Assert.That(reader.Get(first), Is.Not.Null);
+                Assert.That(reader.Get(mutation.Result), Is.Null);
+            }
+
+            cache.FlushAllBackingStores();
+            using var reopened = Open(out _);
+            Assert.That(reopened.Get(mutation.Result), Is.Not.Null);
+        }
+
+        [Test]
+        public async Task FlushNeverOpensUnchangedPages()
+        {
+            using var cache = Open(out var store);
+            var first = await cache.UpsertAsync(typeof(Page), new Page { Name = "a" });
+            cache.FlushAllBackingStores();
+            var page = Directory.GetFiles(_records, "*.msgpack").Single();
+
+            using (new FileStream(page, FileMode.Open, FileAccess.Read, FileShare.None))
+            {
+                await cache.UpsertAsync(typeof(Page), new Page { Name = "b" });
+                Assert.That(() => cache.FlushAllBackingStores(), Throws.Nothing);
+            }
+
+            Assert.That(store.IsDirty, Is.False);
+            using var reader = Open(out _);
+            Assert.That(reader.GetAll<Page>().Count(), Is.EqualTo(2));
+            Assert.That(reader.Get(first), Is.Not.Null);
+        }
+
+        [Test]
+        public async Task MissingManifestIgnoresOrphanPagesAndFlushDeletesThem()
+        {
+            Directory.CreateDirectory(_records);
+            var orphan = Path.Combine(_records, new string('a', 64) + ".msgpack");
+            File.WriteAllBytes(orphan, new byte[] { 0x91, 0xA1, 0x78 });
+
+            using var cache = Open(out _);
+            Assert.That(cache.AllEntries, Is.Empty);
+            await cache.UpsertAsync(typeof(Page), new Page { Name = "a" });
+            cache.FlushAllBackingStores();
+
+            Assert.That(File.Exists(orphan), Is.False);
+            Assert.That(Directory.GetFiles(_records, "*.msgpack"), Has.Length.EqualTo(1));
+        }
+
+        [Test]
+        public async Task TamperedPageFailsLoadNamingPage()
+        {
+            using (var cache = Open(out _))
+            {
+                await cache.UpsertAsync(typeof(Page), new Page { Name = "a", Text = "honest" });
+                cache.FlushAllBackingStores();
+            }
+
+            var page = Directory.GetFiles(_records, "*.msgpack").Single();
+            var bytes = File.ReadAllBytes(page);
+            bytes[bytes.Length - 1] ^= 0xFF;
+            File.WriteAllBytes(page, bytes);
+
+            using var reader = new CultCache(Registry);
+            Assert.That(() => reader.AddBackingStore(new DirectoryMessagePackBackingStore(_manifest)),
+                Throws.Exception.With.Message.Contains(page));
+            Assert.That(reader.AllEntries, Is.Empty);
+        }
+
+        private CultCache Open(out DirectoryMessagePackBackingStore store)
+        {
+            var cache = new CultCache(Registry);
+            store = new DirectoryMessagePackBackingStore(_manifest);
+            cache.AddBackingStore(store);
+            return cache;
+        }
+
+        private FileStream HoldLease()
+        {
+            Directory.CreateDirectory(_records);
+            return new FileStream(Path.Combine(_records, ".commit.lock"), FileMode.OpenOrCreate, FileAccess.ReadWrite, FileShare.None);
+        }
+
+        private CultPersistedRecord ManifestRecord(CultRecordKey key) =>
+            CultDocumentMessagePackSerialization.DeserializeSnapshot(File.ReadAllBytes(_manifest)).Records.Single(record => record.Key == key.Value);
+
+        private string PagePath(byte[] identity) =>
+            Path.Combine(_records, BitConverter.ToString(identity).Replace("-", string.Empty).ToLowerInvariant() + ".msgpack");
+
+        [CultDocument("tests.durability_page", "tests.durability_page.v1")]
+        [MessagePackObject(AllowPrivate = true)]
+        internal sealed class Page
+        {
+            [Key(0)]
+            [CultName]
+            public string Name = string.Empty;
+
+            [Key(1)]
+            public string Text = string.Empty;
+        }
+    }
+}
diff --git a/tests/GameCult.Caching.Tests/DocumentShapeTests.cs b/tests/GameCult.Caching.Tests/DocumentShapeTests.cs
new file mode 100644
index 00000000..c34834ca
--- /dev/null
+++ b/tests/GameCult.Caching.Tests/DocumentShapeTests.cs
@@ -0,0 +1,487 @@
+#nullable enable
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Reflection;
+using System.Reflection.Emit;
+using GameCult.Caching;
+using GameCult.Caching.MessagePack;
+using MessagePack;
+using NUnit.Framework;
+
+namespace GameCult.Caching.Tests
+{
+    // Accepted shapes are ordinary test types. Rejected shapes are emitted into a dynamic assembly, which registry discovery skips,
+    // so a refused shape cannot break a registry built from the loaded assemblies.
+    public class DocumentShapeTests
+    {
+        private const string NonPublicSetter = "has a non-public set accessor; MessagePack writes it but never reads it back without AllowPrivate, so make the setter public or add [MessagePackObject(AllowPrivate = true)].";
+        private const string Unkeyed = "has no [Key]; MessagePack requires [Key(n)] or [IgnoreMember] on every public member, so mark it one or the other.";
+        private const string ReadonlyUnfilled = "is a readonly field that no constructor fills; MessagePack writes it but never reads it back, so give the constructor MessagePack calls a parameter at position {0}, drop readonly, or add [MessagePackObject(AllowPrivate = true)].";
+        private const string DivergentOverride ="overrides {0} with a different [Key] or [IgnoreMember]; MessagePack reads the base declaration's, so an override must repeat or omit them.";
+
+        private static readonly ModuleBuilder Rejected = AssemblyBuilder
+            .DefineDynamicAssembly(new AssemblyName("RejectedShapes"), AssemblyBuilderAccess.Run)
+            .DefineDynamicModule("RejectedShapes");
+
+        [Test]
+        public void FlatKeyedDocument()
+        {
+            Accept(new Plain { Name = "p", Maybe = 7, Tint = Color.Blue, Tags = { "a" }, Counts = { ["x"] = 1 }, Skip = 9 });
+            var members = CultDocumentRegistry.ForTypes(new[] { typeof(Plain) }).GetRequired<Plain>().ToCatalogEntry().Members;
+            Assert.That(members.Select(member => $"{member.Slot}:{member.MemberName}"), Is.EqualTo(new[] { "0:Name", "1:Maybe", "2:Tint", "3:Tags", "4:Counts" }));
+        }
+
+        [Test]
+        public void NameAndIndexOnABaseSharedByTwoDocuments()
+        {
+            Accept(new Gear { Name = "helm", Slot = "head" });
+            Accept(new Weapon { Name = "lance", Slot = "hand", Damage = 4 });
+            var registry = CultDocumentRegistry.ForTypes(new[] { typeof(Gear), typeof(Weapon) });
+            foreach (var type in new[] { typeof(Gear), typeof(Weapon) })
+            {
+                var descriptor = registry.GetRequired(type);
+                var members = descriptor.ToCatalogEntry().Members;
+                Assert.That(descriptor.NameMember, Is.EqualTo("Name"), type.Name);
+                Assert.That(members.Single(member => member.MemberName == "Slot").IndexAlias, Is.EqualTo("slot"), type.Name);
+            }
+
+            Assert.That(registry.GetRequired<Weapon>().ToCatalogEntry().Members.Select(member => member.Slot), Is.EqualTo(new[] { 0, 1, 2 }));
+        }
+
+        [Test]
+        public void OverrideKeepsBaseKey()
+        {
+            var payload = Accept(new OvrSame { Name = "n", X = 3, Z = 5 });
+
+            // Captured from MessagePack's DynamicObjectResolver: [Name, X, Z].
+            Assert.That(Convert.ToHexString(payload), Is.EqualTo("93A16E0305"));
+        }
+
+        [Test]
+        public void NotAMessagePackObject()
+        {
+            var type = Rejected.DefineType("NoObject", TypeAttributes.Public);
+            type.SetCustomAttribute(new CustomAttributeBuilder(
+                typeof(CultDocumentAttribute).GetConstructor(new[] { typeof(string), typeof(string) })!, new object[] { "shape.no_object", "shape.no_object.v1" }));
+            Field(type, "Name", typeof(string), Key(0));
+            Reject(type.CreateType()!, "Cult document NoObject is not a MessagePack object; add [MessagePackObject] so MessagePack serializes its [Key(n)] members.");
+        }
+
+        [Test]
+        public void NonPublicWithoutAllowPrivate()
+        {
+            var type = Rejected.DefineType("Hidden", TypeAttributes.NotPublic);
+            type.SetCustomAttribute(new CustomAttributeBuilder(
+                typeof(CultDocumentAttribute).GetConstructor(new[] { typeof(string), typeof(string) })!, new object[] { "shape.hidden", "shape.hidden.v1" }));
+            type.SetCustomAttribute(new CustomAttributeBuilder(typeof(MessagePackObjectAttribute).GetConstructor(new[] { typeof(bool) })!, new object[] { false }));
+            Field(type, "Name", typeof(string), Key(0));
+            Reject(type.CreateType()!, "Cult document Hidden is not public; MessagePack serializes a non-public type only with [MessagePackObject(AllowPrivate = true)], so make it public or set AllowPrivate.");
+        }
+
+        [Test]
+        public void AllowPrivateWithUnmarkedNonPublicMember()
+        {
+            var type = Rejected.DefineType("PrivateField", TypeAttributes.NotPublic);
+            type.SetCustomAttribute(new CustomAttributeBuilder(
+                typeof(CultDocumentAttribute).GetConstructor(new[] { typeof(string), typeof(string) })!, new object[] { "shape.private_field", "shape.private_field.v1" }));
+            type.SetCustomAttribute(new CustomAttributeBuilder(
+                typeof(MessagePackObjectAttribute).GetConstructor(new[] { typeof(bool) })!, new object[] { false },
+                new[] { typeof(MessagePackObjectAttribute).GetProperty(nameof(MessagePackObjectAttribute.AllowPrivate))! }, new object[] { true }));
+            Field(type, "Name", typeof(string), Key(0));
+            type.DefineField("_cache", typeof(int), FieldAttributes.Private);
+            Reject(type.CreateType()!, "Cult document PrivateField member PrivateField._cache is non-public; [MessagePackObject(AllowPrivate = true)] makes MessagePack read it, so mark it [IgnoreMember].");
+        }
+
+        [Test]
+        public void NonPublicWithAllowPrivateRoundTrips()
+        {
+            var payload = Accept(new InternalNote { Name = "n", Count = 2 });
+            Assert.That(Convert.ToHexString(payload), Is.EqualTo("92A16E02"));
+        }
+
+        [Test]
+        public void UnkeyedMember()
+        {
+            var type = Document("Unkeyed");
+            Field(type, "Name", typeof(string), Key(0));
+            Field(type, "Count", typeof(int));
+            Reject(type.CreateType()!, "Cult document Unkeyed member Count " + Unkeyed);
+        }
+
+        // MessagePack's DynamicObjectResolver reads the base declaration: it throws "key is duplicated" for this shape.
+        [Test]
+        public void OverrideReKeyed()
+        {
+            var baseType = Rejected.DefineType("OvrDiffBase", TypeAttributes.Public);
+            Property(baseType, "Name", MethodAttributes.Virtual, MethodAttributes.Public, Key(0));
+            var type = Document("OvrDiff", baseType.CreateType());
+            Property(type, "Name", MethodAttributes.Virtual, MethodAttributes.Public, Key(2));
+            Property(type, "X", 0, MethodAttributes.Public, Key(1));
+            Property(type, "Y", 0, MethodAttributes.Public, Key(0));
+            Reject(type.CreateType()!, "Cult document OvrDiff member OvrDiff.Name " + string.Format(DivergentOverride, "OvrDiffBase.Name"));
+        }
+
+        // MessagePack's DynamicObjectResolver keeps the base [Key(1)] and serializes Name despite the override's [IgnoreMember].
+        [Test]
+        public void OverrideIgnored()
+        {
+            var baseType = Rejected.DefineType("OvrIgnoreBase", TypeAttributes.Public);
+            Property(baseType, "Name", MethodAttributes.Virtual, MethodAttributes.Public, Key(1));
+            var type = Document("OvrIgnore", baseType.CreateType());
+            Property(type, "Name", MethodAttributes.Virtual, MethodAttributes.Public, new CustomAttributeBuilder(typeof(IgnoreMemberAttribute).GetConstructor(Type.EmptyTypes)!, Array.Empty<object>()));
+            Property(type, "X", 0, MethodAttributes.Public, Key(0));
+            Reject(type.CreateType()!, "Cult document OvrIgnore member OvrIgnore.Name " + string.Format(DivergentOverride, "OvrIgnoreBase.Name"));
+        }
+
+        [Test]
+        public void NewHiddenField()
+        {
+            var baseType = Rejected.DefineType("NewFieldBase", TypeAttributes.Public);
+            Field(baseType, "Name", typeof(string), Key(0));
+            var type = Document("NewField", baseType.CreateType());
+            Field(type, "Name", typeof(string), Key(0));
+            Field(type, "X", typeof(int), Key(1));
+            Reject(type.CreateType()!, "Cult document NewField members NewField.Name and NewFieldBase.Name share [Key(0)]; every persisted member needs a distinct [Key(n)].");
+        }
+
+        [Test]
+        public void NewHiddenProperty()
+        {
+            var baseType = Rejected.DefineType("NewPropBase", TypeAttributes.Public);
+            Property(baseType, "Name", 0, MethodAttributes.Public, Key(0));
+            var type = Document("NewProp", baseType.CreateType());
+            Property(type, "Name", 0, MethodAttributes.Public, Key(0));
+            Property(type, "X", 0, MethodAttributes.Public, Key(1));
+            Reject(type.CreateType()!, "Cult document NewProp members NewProp.Name and NewPropBase.Name share [Key(0)]; every persisted member needs a distinct [Key(n)].");
+        }
+
+        [Test]
+        public void DuplicateSlot()
+        {
+            var type = Document("Dup");
+            Field(type, "B", typeof(int), Key(0));
+            Field(type, "A", typeof(int), Key(0));
+            Reject(type.CreateType()!, "Cult document Dup members Dup.A and Dup.B share [Key(0)]; every persisted member needs a distinct [Key(n)].");
+        }
+
+        [Test]
+        public void InheritedPrivateSetter()
+        {
+            var baseType = Rejected.DefineType("PrivSetBase", TypeAttributes.Public);
+            Property(baseType, "Name", 0, MethodAttributes.Private, Key(0));
+            var type = Document("PrivSetDerived", baseType.CreateType());
+            Property(type, "X", 0, MethodAttributes.Public, Key(1));
+            Reject(type.CreateType()!, "Cult document PrivSetDerived member Name " + NonPublicSetter);
+        }
+
+        // Without AllowPrivate MessagePack writes Name through the public getter and loads it back as null.
+        [Test]
+        public void InternalSetterWithoutAllowPrivate()
+        {
+            var type = Document("InternalSetter");
+            Property(type, "Name", 0, MethodAttributes.Assembly, Key(0));
+            Reject(type.CreateType()!, "Cult document InternalSetter member Name " + NonPublicSetter);
+        }
+
+        // Without AllowPrivate MessagePack neither writes nor reads a non-public member, [Key] or not.
+        [Test]
+        public void KeyedNonPublicMemberWithoutAllowPrivate()
+        {
+            var type = Document("KeyedPrivate");
+            Field(type, "Name", typeof(string), Key(0));
+            type.DefineField("_secret", typeof(int), FieldAttributes.Private).SetCustomAttribute(Key(1));
+            Reject(type.CreateType()!, "Cult document KeyedPrivate member KeyedPrivate._secret is non-public; MessagePack skips it silently, so [Key] on a non-public member requires [MessagePackObject(AllowPrivate = true)].");
+        }
+
+        // The shape of `class PrimaryCtor(int p)`: MessagePack throws "can't find matched constructor" on first serialize.
+        [Test]
+        public void AllowPrivatePrimaryConstructor()
+        {
+            var type = Rejected.DefineType("PrimaryCtor", TypeAttributes.NotPublic);
+            type.SetCustomAttribute(new CustomAttributeBuilder(
+                typeof(CultDocumentAttribute).GetConstructor(new[] { typeof(string), typeof(string) })!, new object[] { "shape.primary_ctor", "shape.primary_ctor.v1" }));
+            type.SetCustomAttribute(new CustomAttributeBuilder(
+                typeof(MessagePackObjectAttribute).GetConstructor(new[] { typeof(bool) })!, new object[] { false },
+                new[] { typeof(MessagePackObjectAttribute).GetProperty(nameof(MessagePackObjectAttribute.AllowPrivate))! }, new object[] { true }));
+            Field(type, "Name", typeof(string), Key(0));
+            var il = type.DefineConstructor(MethodAttributes.Public, CallingConventions.HasThis, new[] { typeof(int) }).GetILGenerator();
+            il.Emit(OpCodes.Ldarg_0);
+            il.Emit(OpCodes.Call, typeof(object).GetConstructor(Type.EmptyTypes)!);
+            il.Emit(OpCodes.Ret);
+            Reject(type.CreateType()!, "Cult document PrimaryCtor has no constructor MessagePack can call; add a parameterless constructor (public unless AllowPrivate), or one whose parameters take the [Key(0)], [Key(1)], ... members in order.");
+        }
+
+        [Test]
+        public void AllowPrivateSettersRoundTrip()
+        {
+            Assert.That(Convert.ToHexString(Accept(PrivateSetterNote.Make("n"))), Is.EqualTo("91A16E"));
+            Assert.That(Convert.ToHexString(Accept(new InitOnlyNote { Name = "n" })), Is.EqualTo("91A16E"));
+            Assert.That(Convert.ToHexString(Accept(new InternalSetterNote { Name = "n" })), Is.EqualTo("91A16E"));
+        }
+
+        // MessagePack fills a get-only property through the longest constructor whose parameters take the keyed members by position.
+        [Test]
+        public void GetOnlyPropertyFilledByConstructor()
+        {
+            Assert.That(Convert.ToHexString(Accept(new GetOnlyNote("n", 2))), Is.EqualTo("92A16E02"));
+            AssertSlots<GetOnlyNote>("0:Name", "1:Count");
+        }
+
+        // The three-parameter constructor has no member at position 2, so MessagePack falls back to the one-parameter constructor.
+        [Test]
+        public void ReadonlyFieldFilledByConstructor()
+        {
+            Assert.That(Convert.ToHexString(Accept(new ReadonlyNote("n") { Count = 3 })), Is.EqualTo("92A16E03"));
+            AssertSlots<ReadonlyNote>("0:Name", "1:Count");
+        }
+
+        // Under AllowPrivate MessagePack writes a readonly field directly; no constructor has to fill it.
+        [Test]
+        public void ReadonlyFieldUnderAllowPrivate()
+        {
+            var sample = new ReadonlyPrivateNote();
+            typeof(ReadonlyPrivateNote).GetField(nameof(ReadonlyPrivateNote.Name))!.SetValue(sample, "n");
+            Assert.That(Convert.ToHexString(Accept(sample)), Is.EqualTo("91A16E"));
+            Assert.That(((ReadonlyPrivateNote)CultDocumentMessagePackSerialization.DeserializeUntyped(
+                typeof(ReadonlyPrivateNote), Accept(sample), CultDocumentRegistry.ForTypes(new[] { typeof(ReadonlyPrivateNote) }))).Name, Is.EqualTo("n"));
+            AssertSlots<ReadonlyPrivateNote>("0:Name");
+        }
+
+        // MessagePack throws "all public members must mark KeyAttribute or IgnoreMemberAttribute" for this shape.
+        [Test]
+        public void UnkeyedGetOnlyProperty()
+        {
+            var type = Document("UnkeyedGetter");
+            Field(type, "Name", typeof(string), Key(0));
+            GetOnlyProperty(type, "Upper");
+            Reject(type.CreateType()!, "Cult document UnkeyedGetter member Upper " + Unkeyed);
+        }
+
+        // MessagePack writes Label and loads it back as the default: only the parameterless constructor exists.
+        [Test]
+        public void GetOnlyPropertyNoConstructorFills()
+        {
+            var type = Document("GetterUnfilled");
+            Field(type, "Name", typeof(string), Key(0));
+            GetOnlyProperty(type, "Label", Key(1));
+            Reject(type.CreateType()!, "Cult document GetterUnfilled member Label is a get-only property that no constructor fills; MessagePack writes it but never reads it back, so give the constructor MessagePack calls a parameter at position 1, add a setter, or mark it [IgnoreMember].");
+        }
+
+        // Without AllowPrivate MessagePack writes Name and loads it back as the field initializer's value.
+        [Test]
+        public void ReadonlyFieldNoConstructorFills()
+        {
+            var type = Document("ReadonlyUnfilled");
+            type.DefineField("Name", typeof(string), FieldAttributes.Public | FieldAttributes.InitOnly).SetCustomAttribute(Key(0));
+            Reject(type.CreateType()!, "Cult document ReadonlyUnfilled member Name " + string.Format(ReadonlyUnfilled, 0));
+        }
+
+        // MessagePack picks the one-parameter constructor, which fills Name but not Other; Other loads back as its default.
+        [Test]
+        public void ReadonlyFieldBeyondPickedConstructor()
+        {
+            var type = Document("ReadonlyBeyond");
+            var name = type.DefineField("Name", typeof(string), FieldAttributes.Public | FieldAttributes.InitOnly);
+            name.SetCustomAttribute(Key(0));
+            type.DefineField("Other", typeof(string), FieldAttributes.Public | FieldAttributes.InitOnly).SetCustomAttribute(Key(1));
+            var il = type.DefineConstructor(MethodAttributes.Public, CallingConventions.HasThis, new[] { typeof(string) }).GetILGenerator();
+            il.Emit(OpCodes.Ldarg_0);
+            il.Emit(OpCodes.Call, typeof(object).GetConstructor(Type.EmptyTypes)!);
+            il.Emit(OpCodes.Ldarg_0);
+            il.Emit(OpCodes.Ldarg_1);
+            il.Emit(OpCodes.Stfld, name);
+            il.Emit(OpCodes.Ret);
+            Reject(type.CreateType()!, "Cult document ReadonlyBeyond member Other " + string.Format(ReadonlyUnfilled, 1));
+        }
+
+        [Test]
+        public void StringKey()
+        {
+            var type = Document("StringKeyed");
+            Property(type, "Name", 0, MethodAttributes.Public, new CustomAttributeBuilder(typeof(KeyAttribute).GetConstructor(new[] { typeof(string) })!, new object[] { "name" }));
+            Reject(type.CreateType()!, "Cult document StringKeyed member Name has a string [Key]; string keys are not supported; use integer [Key(n)].");
+        }
+
+        private static byte[] Accept(object sample)
+        {
+            var type = sample.GetType();
+            var registry = CultDocumentRegistry.ForTypes(new[] { type });
+            var expected = MessagePackSerializer.Serialize(type, sample, CultDocumentMessagePackSerialization.OptionsFor(type.Assembly));
+            var payload = CultDocumentMessagePackSerialization.SerializeUntyped(sample, type, registry);
+            var decoded = CultDocumentMessagePackSerialization.DeserializeUntyped(type, payload, registry);
+            Assert.That(Convert.ToHexString(payload), Is.EqualTo(Convert.ToHexString(expected)), $"{type.Name}: payload");
+            Assert.That(Convert.ToHexString(CultDocumentMessagePackSerialization.SerializeUntyped(decoded, type, registry)), Is.EqualTo(Convert.ToHexString(payload)), $"{type.Name}: round trip");
+            return payload;
+        }
+
+        private static void AssertSlots<T>(params string[] expected) where T : class =>
+            Assert.That(CultDocumentRegistry.ForTypes(new[] { typeof(T) }).GetRequired<T>().ToCatalogEntry().Members.Select(member => $"{member.Slot}:{member.MemberName}"), Is.EqualTo(expected));
+
+        private static void GetOnlyProperty(TypeBuilder type, string name, params CustomAttributeBuilder[] attributes)
+        {
+            var backing = type.DefineField("_" + name, typeof(string), FieldAttributes.Private);
+            backing.SetCustomAttribute(new CustomAttributeBuilder(typeof(IgnoreMemberAttribute).GetConstructor(Type.EmptyTypes)!, Array.Empty<object>()));
+            var getter = type.DefineMethod("get_" + name, MethodAttributes.Public | MethodAttributes.SpecialName | MethodAttributes.HideBySig, typeof(string), Type.EmptyTypes);
+            var il = getter.GetILGenerator();
+            il.Emit(OpCodes.Ldarg_0);
+            il.Emit(OpCodes.Ldfld, backing);
+            il.Emit(OpCodes.Ret);
+            var property = type.DefineProperty(name, PropertyAttributes.None, typeof(string), null);
+            property.SetGetMethod(getter);
+            foreach (var attribute in attributes) property.SetCustomAttribute(attribute);
+        }
+
+        private static void Reject(Type type, string expected) =>
+            Assert.That(Assert.Throws<InvalidOperationException>(() => CultDocumentRegistry.ForTypes(new[] { type }))!.Message, Is.EqualTo(expected));
+
+        private static CustomAttributeBuilder Key(int slot) =>
+            new(typeof(KeyAttribute).GetConstructor(new[] { typeof(int) })!, new object[] { slot });
+
+        private static TypeBuilder Document(string name, Type? parent = null)
+        {
+            var type = Rejected.DefineType(name, TypeAttributes.Public, parent);
+            type.SetCustomAttribute(new CustomAttributeBuilder(
+                typeof(CultDocumentAttribute).GetConstructor(new[] { typeof(string), typeof(string) })!,
+                new object[] { "shape." + name, "shape." + name + ".v1" }));
+            type.SetCustomAttribute(new CustomAttributeBuilder(typeof(MessagePackObjectAttribute).GetConstructor(new[] { typeof(bool) })!, new object[] { false }));
+            return type;
+        }
+
+        private static void Field(TypeBuilder type, string name, Type fieldType, params CustomAttributeBuilder[] attributes)
+        {
+            var field = type.DefineField(name, fieldType, FieldAttributes.Public);
+            foreach (var attribute in attributes) field.SetCustomAttribute(attribute);
+        }
+
+        private static void Property(TypeBuilder type, string name, MethodAttributes shape, MethodAttributes setterAccess, params CustomAttributeBuilder[] attributes)
+        {
+            var propertyType = typeof(string);
+            var backing = type.DefineField("_" + name, propertyType, FieldAttributes.Private);
+            var getter = type.DefineMethod("get_" + name, MethodAttributes.Public | MethodAttributes.SpecialName | MethodAttributes.HideBySig | shape, propertyType, Type.EmptyTypes);
+            var il = getter.GetILGenerator();
+            il.Emit(OpCodes.Ldarg_0);
+            il.Emit(OpCodes.Ldfld, backing);
+            il.Emit(OpCodes.Ret);
+            var setter = type.DefineMethod("set_" + name, setterAccess | MethodAttributes.SpecialName | MethodAttributes.HideBySig | shape, null, new[] { propertyType });
+            il = setter.GetILGenerator();
+            il.Emit(OpCodes.Ldarg_0);
+            il.Emit(OpCodes.Ldarg_1);
+            il.Emit(OpCodes.Stfld, backing);
+            il.Emit(OpCodes.Ret);
+            var property = type.DefineProperty(name, PropertyAttributes.None, propertyType, null);
+            property.SetGetMethod(getter);
+            property.SetSetMethod(setter);
+            foreach (var attribute in attributes) property.SetCustomAttribute(attribute);
+        }
+
+        public enum Color { Red, Blue }
+
+        [CultDocument("shape.plain", "shape.plain.v1")]
+        [MessagePackObject]
+        public class Plain
+        {
+            [Key(0)] [CultName] public string Name { get; set; } = "";
+            [Key(1)] public int? Maybe;
+            [Key(2)] public Color Tint { get; set; }
+            [Key(3)] public List<string> Tags = new();
+            [Key(4)] public Dictionary<string, int> Counts { get; set; } = new();
+            [IgnoreMember] public int Skip { get; set; }
+        }
+
+        [CultDocument("shape.gear", "shape.gear.v1")]
+        [MessagePackObject]
+        public class Gear
+        {
+            [Key(0)] [CultName] public string Name { get; set; } = "";
+            [Key(1)] [CultIndex("slot")] public string Slot { get; set; } = "";
+        }
+
+        [CultDocument("shape.weapon", "shape.weapon.v1")]
+        [MessagePackObject]
+        public sealed class Weapon : Gear
+        {
+            [Key(2)] public int Damage { get; set; }
+        }
+
+        [CultDocument("shape.internal_note", "shape.internal_note.v1")]
+        [MessagePackObject(AllowPrivate = true)]
+        internal sealed class InternalNote
+        {
+            [Key(0)] public string Name = "";
+            [Key(1)] public int Count;
+        }
+
+        [CultDocument("shape.private_setter", "shape.private_setter.v1")]
+        [MessagePackObject(AllowPrivate = true)]
+        internal sealed class PrivateSetterNote
+        {
+            [Key(0)] public string Name { get; private set; } = "";
+
+            public static PrivateSetterNote Make(string name) => new() { Name = name };
+        }
+
+        [CultDocument("shape.init_only", "shape.init_only.v1")]
+        [MessagePackObject(AllowPrivate = true)]
+        internal sealed class InitOnlyNote
+        {
+            [Key(0)] public string Name { get; init; } = "";
+        }
+
+        [CultDocument("shape.internal_setter", "shape.internal_setter.v1")]
+        [MessagePackObject(AllowPrivate = true)]
+        internal sealed class InternalSetterNote
+        {
+            [Key(0)] public string Name { get; internal set; } = "";
+        }
+
+        [CultDocument("shape.get_only", "shape.get_only.v1")]
+        [MessagePackObject]
+        public sealed class GetOnlyNote
+        {
+            public GetOnlyNote(string name, int count)
+            {
+                Name = name;
+                Count = count;
+            }
+
+            [Key(0)] public string Name { get; }
+            [Key(1)] public int Count { get; set; }
+        }
+
+        [CultDocument("shape.readonly", "shape.readonly.v1")]
+        [MessagePackObject]
+        public sealed class ReadonlyNote
+        {
+            public ReadonlyNote() => Name = "";
+            public ReadonlyNote(string name) => Name = name;
+            public ReadonlyNote(string name, int count, string extra) => Name = name;
+
+            [Key(0)] public readonly string Name;
+            [Key(1)] public int Count { get; set; }
+        }
+
+        [CultDocument("shape.readonly_private", "shape.readonly_private.v1")]
+        [MessagePackObject(AllowPrivate = true)]
+        internal sealed class ReadonlyPrivateNote
+        {
+            [Key(0)] public readonly string Name = "init";
+        }
+
+        [MessagePackObject]
+        public class OvrSameBase
+        {
+            [Key(0)] public virtual string Name { get; set; } = "";
+            [Key(2)] public virtual int Z { get; set; }
+        }
+
+        [CultDocument("shape.ovr_same", "shape.ovr_same.v1")]
+        [MessagePackObject]
+        public sealed class OvrSame : OvrSameBase
+        {
+            [Key(0)] public override string Name { get; set; } = "";
+            public override int Z { get; set; }
+            [Key(1)] public int X { get; set; }
+        }
+    }
+}
diff --git a/tests/GameCult.Caching.Tests/Fixtures/.gitattributes b/tests/GameCult.Caching.Tests/Fixtures/.gitattributes
new file mode 100644
index 00000000..98ee91e2
--- /dev/null
+++ b/tests/GameCult.Caching.Tests/Fixtures/.gitattributes
@@ -0,0 +1,4 @@
+# Store fixtures are byte-exact and content-addressed; never convert line endings.
+* binary
+*.md text
+.gitattributes text
diff --git a/tests/GameCult.Caching.Tests/Fixtures/pre-cut2/README.md b/tests/GameCult.Caching.Tests/Fixtures/pre-cut2/README.md
new file mode 100644
index 00000000..2ba005f2
--- /dev/null
+++ b/tests/GameCult.Caching.Tests/Fixtures/pre-cut2/README.md
@@ -0,0 +1,29 @@
+# Pre-Cut 2 store fixtures
+
+Bytes written by CultLib commit `0db1fe5` ("Apply Soul fixes to the store
+composition docs and routing tests"), the last commit before Cut 2 changed the
+MessagePack stores. They prove stores written before Cut 2 still open.
+
+Produced from a temporary git worktree at `0db1fe5`: a throwaway NUnit fixture
+in that worktree's `tests/GameCult.Caching.Tests`, referencing its own Caching
+projects and generator, upserted three records into a fresh `CultCache` and
+called `FlushAllBackingStores()`. The worktree was removed afterwards.
+
+- `directory-v4/store.cc` plus `directory-v4/store.cc.records/*.msgpack`:
+  `new DirectoryMessagePackBackingStore(manifest)`, format
+  `cultcache.store.v4.directory-content-addressed-pages`. The empty
+  `.commit.lock` lease file was not copied.
+- `single-file-v1/store.msgpack`: `new SingleFileMessagePackBackingStore(file)`,
+  format `cultcache.store.v1`.
+
+Both stores hold the same records. Document types are defined identically in
+`../../PreCut2FixtureDocuments.cs`:
+
+| Key | Type (schema) | Values |
+| --- | --- | --- |
+| `item:anvil` | `PreCut2FixtureItem` (`fixtures.precut2.item.v1`) | `Name = "anvil"`, `Count = 3` |
+| `item:bellows` | `PreCut2FixtureItem` (`fixtures.precut2.item.v1`) | `Name = "bellows"`, `Count = 42` |
+| `note:origin` | `PreCut2FixtureNote` (`fixtures.precut2.note.v1`) | `Text = "written before cut 2"` |
+
+Do not regenerate these from a newer commit; their value is that they predate
+Cut 2. Tests copy them to a temp directory before opening.
diff --git a/tests/GameCult.Caching.Tests/Fixtures/pre-cut2/directory-v4/store.cc b/tests/GameCult.Caching.Tests/Fixtures/pre-cut2/directory-v4/store.cc
new file mode 100644
index 00000000..8dda080c
Binary files /dev/null and b/tests/GameCult.Caching.Tests/Fixtures/pre-cut2/directory-v4/store.cc differ
diff --git a/tests/GameCult.Caching.Tests/Fixtures/pre-cut2/directory-v4/store.cc.records/26abbda63fe4c502d2ec3ec61481d08abb8d7c46b93d1641c5376058c7791ed6.msgpack b/tests/GameCult.Caching.Tests/Fixtures/pre-cut2/directory-v4/store.cc.records/26abbda63fe4c502d2ec3ec61481d08abb8d7c46b93d1641c5376058c7791ed6.msgpack
new file mode 100644
index 00000000..ec8ad267
--- /dev/null
+++ b/tests/GameCult.Caching.Tests/Fixtures/pre-cut2/directory-v4/store.cc.records/26abbda63fe4c502d2ec3ec61481d08abb8d7c46b93d1641c5376058c7791ed6.msgpack
@@ -0,0 +1 @@
+��note:origin�Gsha256:670deacd06aedb90235e6bd873674c10467a05b4adcd62dbc019279efcbcbb11�!2026-09-13T15:14:36.4547792+00:00���written before cut 2
\ No newline at end of file
diff --git a/tests/GameCult.Caching.Tests/Fixtures/pre-cut2/directory-v4/store.cc.records/538952c2d5f600e672b4184d9fc00cf6d4c01a23593138a2eab02d710e79d6f8.msgpack b/tests/GameCult.Caching.Tests/Fixtures/pre-cut2/directory-v4/store.cc.records/538952c2d5f600e672b4184d9fc00cf6d4c01a23593138a2eab02d710e79d6f8.msgpack
new file mode 100644
index 00000000..d2e1758d
--- /dev/null
+++ b/tests/GameCult.Caching.Tests/Fixtures/pre-cut2/directory-v4/store.cc.records/538952c2d5f600e672b4184d9fc00cf6d4c01a23593138a2eab02d710e79d6f8.msgpack
@@ -0,0 +1 @@
+��item:anvil�Gsha256:88d3fdf0a927acf3b163940d8f8c7fe62b3316542ce771a67ec8bc038f594788�!2026-09-13T15:14:36.4534706+00:00���anvil
\ No newline at end of file
diff --git a/tests/GameCult.Caching.Tests/Fixtures/pre-cut2/directory-v4/store.cc.records/7724612992b5cda71fd6a663e30c5e115819fc978c9ea677ebb76d69505a26e1.msgpack b/tests/GameCult.Caching.Tests/Fixtures/pre-cut2/directory-v4/store.cc.records/7724612992b5cda71fd6a663e30c5e115819fc978c9ea677ebb76d69505a26e1.msgpack
new file mode 100644
index 00000000..9468d489
--- /dev/null
+++ b/tests/GameCult.Caching.Tests/Fixtures/pre-cut2/directory-v4/store.cc.records/7724612992b5cda71fd6a663e30c5e115819fc978c9ea677ebb76d69505a26e1.msgpack
@@ -0,0 +1,2 @@
+��item:bellows�Gsha256:88d3fdf0a927acf3b163940d8f8c7fe62b3316542ce771a67ec8bc038f594788�!2026-09-13T15:14:36.4547616+00:00�
+��bellows*
\ No newline at end of file
diff --git a/tests/GameCult.Caching.Tests/Fixtures/pre-cut2/single-file-v1/store.msgpack b/tests/GameCult.Caching.Tests/Fixtures/pre-cut2/single-file-v1/store.msgpack
new file mode 100644
index 00000000..3e740551
Binary files /dev/null and b/tests/GameCult.Caching.Tests/Fixtures/pre-cut2/single-file-v1/store.msgpack differ
diff --git a/tests/GameCult.Caching.Tests/GameCult.Caching.Tests.csproj b/tests/GameCult.Caching.Tests/GameCult.Caching.Tests.csproj
index 6e8ec411..d98c076f 100644
--- a/tests/GameCult.Caching.Tests/GameCult.Caching.Tests.csproj
+++ b/tests/GameCult.Caching.Tests/GameCult.Caching.Tests.csproj
@@ -9,9 +9,10 @@
   <ItemGroup>
     <ProjectReference Include="..\..\src\GameCult.Caching\GameCult.Caching.csproj" />
     <ProjectReference Include="..\..\src\GameCult.Caching.MessagePack\GameCult.Caching.MessagePack.csproj" />
-    <ProjectReference Include="..\..\src\GameCult.Caching.MessagePack.Generator\GameCult.Caching.MessagePack.Generator.csproj"
-                      OutputItemType="Analyzer"
-                      ReferenceOutputAssembly="false" />
+  </ItemGroup>
+
+  <ItemGroup>
+    <None Include="Fixtures\**\*" CopyToOutputDirectory="PreserveNewest" />
   </ItemGroup>
 
   <ItemGroup>
diff --git a/tests/GameCult.Caching.Tests/PreCut2FixtureDocuments.cs b/tests/GameCult.Caching.Tests/PreCut2FixtureDocuments.cs
new file mode 100644
index 00000000..9f9ab7dc
--- /dev/null
+++ b/tests/GameCult.Caching.Tests/PreCut2FixtureDocuments.cs
@@ -0,0 +1,25 @@
+using GameCult.Caching;
+using MessagePack;
+
+namespace GameCult.Caching.Tests
+{
+    [CultDocument("fixtures.precut2.item", "fixtures.precut2.item.v1")]
+    [MessagePackObject(AllowPrivate = true)]
+    internal sealed class PreCut2FixtureItem
+    {
+        [Key(0)]
+        [CultName]
+        public string Name = string.Empty;
+
+        [Key(1)]
+        public int Count;
+    }
+
+    [CultDocument("fixtures.precut2.note", "fixtures.precut2.note.v1")]
+    [MessagePackObject(AllowPrivate = true)]
+    internal sealed class PreCut2FixtureNote
+    {
+        [Key(0)]
+        public string Text = string.Empty;
+    }
+}
diff --git a/tests/GameCult.Caching.Tests/PreCut2StoreFormatTests.cs b/tests/GameCult.Caching.Tests/PreCut2StoreFormatTests.cs
new file mode 100644
index 00000000..6089b94e
--- /dev/null
+++ b/tests/GameCult.Caching.Tests/PreCut2StoreFormatTests.cs
@@ -0,0 +1,119 @@
+#nullable enable
+using System;
+using System.IO;
+using System.Threading.Tasks;
+using GameCult.Caching;
+using GameCult.Caching.MessagePack;
+using NUnit.Framework;
+
+namespace GameCult.Caching.Tests
+{
+    public class PreCut2StoreFormatTests
+    {
+        private static string FixtureRoot =>
+            Path.Combine(TestContext.CurrentContext.TestDirectory, "Fixtures", "pre-cut2");
+
+        private static string CopyFixture(string name)
+        {
+            var target = Path.Combine(Path.GetTempPath(), $"cultlib-precut2-{Guid.NewGuid():N}");
+            var source = Path.Combine(FixtureRoot, name);
+            foreach (var file in Directory.GetFiles(source, "*", SearchOption.AllDirectories))
+            {
+                var destination = Path.Combine(target, Path.GetRelativePath(source, file));
+                Directory.CreateDirectory(Path.GetDirectoryName(destination)!);
+                File.Copy(file, destination);
+            }
+            return target;
+        }
+
+        private static void AssertFixtureRecords(CultCache cache)
+        {
+            Assert.That(cache.Get<PreCut2FixtureItem>(new CultRecordKey("item:anvil")), Is.Not.Null);
+            Assert.That(cache.Get<PreCut2FixtureItem>(new CultRecordKey("item:anvil"))!.Name, Is.EqualTo("anvil"));
+            Assert.That(cache.Get<PreCut2FixtureItem>(new CultRecordKey("item:anvil"))!.Count, Is.EqualTo(3));
+            Assert.That(cache.Get<PreCut2FixtureItem>(new CultRecordKey("item:bellows"))?.Name, Is.EqualTo("bellows"));
+            Assert.That(cache.Get<PreCut2FixtureItem>(new CultRecordKey("item:bellows"))?.Count, Is.EqualTo(42));
+            Assert.That(cache.Get<PreCut2FixtureNote>(new CultRecordKey("note:origin"))?.Text,
+                Is.EqualTo("written before cut 2"));
+            Assert.That(cache.GetAll<PreCut2FixtureItem>(), Has.Length.EqualTo(2));
+            Assert.That(cache.GetAll<PreCut2FixtureNote>(), Has.Length.EqualTo(1));
+        }
+
+        [Test]
+        public async Task DirectoryStoreOpensV4ManifestWrittenBeforeCut2()
+        {
+            var root = CopyFixture("directory-v4");
+            try
+            {
+                var manifest = Path.Combine(root, "store.cc");
+                Assert.That(CultDocumentMessagePackSerialization.DeserializeSnapshot(File.ReadAllBytes(manifest)).FormatVersion,
+                    Is.EqualTo("cultcache.store.v4.directory-content-addressed-pages"));
+
+                using var cache = new CultCache();
+                cache.AddBackingStore(new DirectoryMessagePackBackingStore(manifest));
+                await cache.PullAllBackingStoresAsync();
+
+                AssertFixtureRecords(cache);
+            }
+            finally
+            {
+                if (Directory.Exists(root)) Directory.Delete(root, recursive: true);
+            }
+        }
+
+        [Test]
+        public async Task SingleFileOpensV1SnapshotWrittenBeforeCut2()
+        {
+            var root = CopyFixture("single-file-v1");
+            try
+            {
+                var file = Path.Combine(root, "store.msgpack");
+                Assert.That(CultDocumentMessagePackSerialization.DeserializeSnapshot(File.ReadAllBytes(file)).FormatVersion,
+                    Is.EqualTo("cultcache.store.v1"));
+
+                using var cache = new CultCache();
+                cache.AddBackingStore(new SingleFileMessagePackBackingStore(file));
+                await cache.PullAllBackingStoresAsync();
+
+                AssertFixtureRecords(cache);
+            }
+            finally
+            {
+                if (Directory.Exists(root)) Directory.Delete(root, recursive: true);
+            }
+        }
+
+        // Format strings taken from DirectoryMessagePackBackingStore.cs at 0db1fe5.
+        [TestCase("cultcache.store.v1")]
+        [TestCase("cultcache.store.v1.directory")]
+        [TestCase("cultcache.store.v2.directory-indexed")]
+        [TestCase("cultcache.store.v3.directory-immutable-pages")]
+        public void DirectoryStoreRefusesNonV4Manifest(string formatVersion)
+        {
+            var root = Path.Combine(Path.GetTempPath(), $"cultlib-refuse-{Guid.NewGuid():N}");
+            var manifest = Path.Combine(root, "store.cc");
+            Directory.CreateDirectory(root);
+            try
+            {
+                var bytes = CultDocumentMessagePackSerialization.SerializeSnapshot(new CultPersistedStoreSnapshot
+                {
+                    FormatVersion = formatVersion,
+                    SchemaCatalog = Array.Empty<CultSchemaCatalogEntry>(),
+                    Records = Array.Empty<CultPersistedRecord>()
+                });
+                File.WriteAllBytes(manifest, bytes);
+
+                using var cache = new CultCache();
+
+                Assert.That(() => cache.AddBackingStore(new DirectoryMessagePackBackingStore(manifest)),
+                    Throws.TypeOf<InvalidOperationException>().With.Message.Contains(formatVersion));
+                Assert.That(cache.BackingStores, Is.Empty);
+                Assert.That(File.ReadAllBytes(manifest), Is.EqualTo(bytes));
+            }
+            finally
+            {
+                if (Directory.Exists(root)) Directory.Delete(root, recursive: true);
+            }
+        }
+    }
+}
diff --git a/tests/GameCult.Caching.Tests/README.md b/tests/GameCult.Caching.Tests/README.md
index 1b1c49a3..c8361303 100644
--- a/tests/GameCult.Caching.Tests/README.md
+++ b/tests/GameCult.Caching.Tests/README.md
@@ -1,15 +1,41 @@
 # GameCult.Caching.Tests
 
 `GameCult.Caching.Tests` contains NUnit tests for the caching library and its
-single-file MessagePack persistence path.
+MessagePack persistence stores.
 
 ## Scope
 
 The tests currently cover:
 
-- `SingleFileMessagePackBackingStore` round-trips
-- explicit Cult document payload codecs
-- hand-written MessagePack store snapshot/record/catalog serialization
+- `SingleFileMessagePackBackingStore` round-trips, external pulls, and the
+  dirty-pull guard
+- `DirectoryMessagePackBackingStore` with the
+  `cultcache.store.v4.directory-content-addressed-pages` manifest: page writes,
+  clean flushes, concurrent writers under the commit lease, external deltas,
+  unflushed local keys, orphaned pages, and observers running after the lease
+  is released
+- `CultCacheMessagePack.OpenAsync`, persisted globals, dirty state, and flush on
+  dispose
+- cache lookups (`Get`, `GetAll`, runtime-type upserts)
+- `CultCache.Commit` batches on a directory store: visibility after the store
+  commits, abandoned stages, sealed batches, observers committing again
+- Cult document payloads, registry shape rejections, canonical schema fixtures,
+  and schema drift reports
+- hand-written MessagePack snapshot and record serialization
+- `StoreRoutingTests`: the store-composition contract (routing, attachment is
+  hydration, read-only stores, global singletons, assignable lookups, batches,
+  all-or-nothing loads)
+- `ConditionalCommitTests`: `Expect`, `ExpectUnchanged`, `TryCommit`, the
+  single-file lock, strictly increasing `storedAt`, and the same conditions on a
+  directory store
+- `DirectoryStoreDurabilityTests`: failed manifest replace, content-addressed
+  pages, the commit lease, orphan pages and tampered pages, with faults from
+  real file locks
+- `PreCut2StoreFormatTests`: stores written before Cut 2 still open
+
+Selective hydration, the directory store's stage probes, pre-v4 directory
+formats, and the SoA table are no longer in the tree; the SoA table is parked
+at `parked/cultcache-soa` (`docs/parked-features.md`).
 
 ## Run
 
diff --git a/tests/GameCult.Caching.Tests/SerializationOptionsTests.cs b/tests/GameCult.Caching.Tests/SerializationOptionsTests.cs
new file mode 100644
index 00000000..7127f574
--- /dev/null
+++ b/tests/GameCult.Caching.Tests/SerializationOptionsTests.cs
@@ -0,0 +1,175 @@
+#nullable enable
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Reflection;
+using System.Reflection.Emit;
+using System.Threading.Tasks;
+using GameCult.Caching;
+using GameCult.Caching.MessagePack;
+using MessagePack;
+using MessagePack.Formatters;
+using NUnit.Framework;
+
+namespace GameCult.Caching.Tests
+{
+    public class SerializationOptionsTests
+    {
+        // Captured on CultLib 825b4f7, before per-assembly options.
+        private const string InteropNotePayloadHex =
+            "96B963756C7463616368652E696E7465726F705F6E6F74652E7631AB6E6F74653A637368617270A6637368617270BD6373686172702077726F746520612043756C744361636865206E6F7465D9245468652076312073746F726520666F726D61742069732074686520636F6E74726163742E92A6637368617270A7696E7465726F70";
+
+        [Test]
+        public void InteropNoteBytesUnchanged()
+        {
+            var registry = CultDocumentRegistry.ForTypes(new[] { typeof(OptionsInteropNote) });
+            var note = new OptionsInteropNote
+            {
+                DocumentId = "note:csharp",
+                AuthorRuntimeId = "csharp",
+                Title = "csharp wrote a CultCache note",
+                Body = "The v1 store format is the contract.",
+                Tags = new[] { "csharp", "interop" }
+            };
+
+            var payload = CultDocumentMessagePackSerialization.SerializeUntyped(note, typeof(OptionsInteropNote), registry);
+
+            Assert.That(Convert.ToHexString(payload), Is.EqualTo(InteropNotePayloadHex));
+        }
+
+        [Test]
+        public async Task RefKeyedDictionaryRoundTrips()
+        {
+            var path = Path.Combine(Path.GetTempPath(), $"cultlib-refkeyed-{Guid.NewGuid():N}.cc");
+            var registry = CultDocumentRegistry.ForTypes(new[] { typeof(RefKeyedHolder) });
+            var alpha = new CultRecordRef<RefKeyedHolder>(new CultRecordKey("alpha"));
+            var beta = new CultRecordRef<RefKeyedHolder>(new CultRecordKey("beta"));
+            try
+            {
+                using (var cache = new CultCache(registry))
+                {
+                    cache.AddBackingStore(new SingleFileMessagePackBackingStore(path));
+                    await cache.UpsertAsync(
+                        new RefKeyedHolder { Name = "holder", Weights = new() { [alpha] = 0.25f, [beta] = 2f } },
+                        new CultRecordHandle<RefKeyedHolder>(new CultRecordKey("holder")));
+                    cache.FlushAllBackingStores();
+                }
+
+                using var reopened = new CultCache(registry);
+                reopened.AddBackingStore(new SingleFileMessagePackBackingStore(path));
+                await reopened.PullAllBackingStoresAsync();
+                var loaded = reopened.Get<RefKeyedHolder>(new CultRecordKey("holder"));
+
+                Assert.That(loaded, Is.Not.Null);
+                Assert.That(loaded!.Weights[new CultRecordRef<RefKeyedHolder>(new CultRecordKey("alpha"))], Is.EqualTo(0.25f));
+                Assert.That(loaded.Weights[new CultRecordRef<RefKeyedHolder>(new CultRecordKey("beta"))], Is.EqualTo(2f));
+            }
+            finally
+            {
+                if (File.Exists(path)) File.Delete(path);
+            }
+        }
+
+        [Test]
+        public void DeclaredResolverEncodesValueTypeAsPositionalArray()
+        {
+            var registry = CultDocumentRegistry.ForTypes(new[] { typeof(PairHolder) });
+            var holder = new PairHolder { Name = "pair", Value = new Pair { A = 1.5f, B = -2f } };
+
+            var payload = CultDocumentMessagePackSerialization.SerializeUntyped(holder, typeof(PairHolder), registry);
+
+            var reader = new MessagePackReader(payload);
+            Assert.That(reader.ReadArrayHeader(), Is.EqualTo(2));
+            reader.Skip();
+            Assert.That(reader.ReadArrayHeader(), Is.EqualTo(2));
+            Assert.That(reader.ReadSingle(), Is.EqualTo(1.5f));
+            Assert.That(reader.ReadSingle(), Is.EqualTo(-2f));
+            var decoded = (PairHolder)CultDocumentMessagePackSerialization.DeserializeUntyped(typeof(PairHolder), payload, registry);
+            Assert.That(decoded.Value, Is.EqualTo(holder.Value));
+        }
+
+        [Test]
+        public void UnknownAssemblyGetsBaseOptions()
+        {
+            Assert.That(CultDocumentMessagePackSerialization.OptionsFor(typeof(object).Assembly),
+                Is.SameAs(CultDocumentMessagePackSerialization.Options));
+            Assert.That(CultDocumentMessagePackSerialization.Options.Resolver.GetFormatter<Pair>(), Is.Null);
+            Assert.That(CultDocumentMessagePackSerialization.OptionsFor(typeof(Pair).Assembly),
+                Is.SameAs(CultDocumentMessagePackSerialization.OptionsFor(typeof(Pair).Assembly)));
+            Assert.That(CultDocumentMessagePackSerialization.OptionsFor(typeof(Pair).Assembly).Resolver.GetFormatter<Pair>(), Is.Not.Null);
+        }
+
+        // GenericHolder<Pair> lives in an assembly that declares a resolver writing Pair as [B, A]; Pair's own assembly writes [A, B].
+        [Test]
+        public void GenericDocumentUsesItsOwnAssemblyResolvers()
+        {
+            var assembly = AssemblyBuilder.DefineDynamicAssembly(new AssemblyName("GenericHolders"), AssemblyBuilderAccess.Run, new[]
+            {
+                new CustomAttributeBuilder(typeof(CultCacheFormatterResolverAttribute).GetConstructor(new[] { typeof(Type) })!, new object[] { typeof(ReversedPairResolver) })
+            });
+            var builder = assembly.DefineDynamicModule("GenericHolders").DefineType("GenericHolder`1", TypeAttributes.Public | TypeAttributes.Sealed);
+            var parameter = builder.DefineGenericParameters("T")[0];
+            builder.SetCustomAttribute(new CustomAttributeBuilder(
+                typeof(CultDocumentAttribute).GetConstructor(new[] { typeof(string), typeof(string) })!, new object[] { "tests.generic_holder", "tests.generic_holder.v1" }));
+            builder.SetCustomAttribute(new CustomAttributeBuilder(typeof(MessagePackObjectAttribute).GetConstructor(new[] { typeof(bool) })!, new object[] { false }));
+            builder.DefineField("Value", parameter, FieldAttributes.Public)
+                .SetCustomAttribute(new CustomAttributeBuilder(typeof(KeyAttribute).GetConstructor(new[] { typeof(int) })!, new object[] { 0 }));
+            var type = builder.CreateType()!.MakeGenericType(typeof(Pair));
+            var registry = CultDocumentRegistry.ForTypes(new[] { type });
+            var holder = Activator.CreateInstance(type)!;
+            type.GetField("Value")!.SetValue(holder, new Pair { A = 1.5f, B = -2f });
+
+            var payload = CultDocumentMessagePackSerialization.SerializeUntyped(holder, type, registry);
+
+            Assert.That(type.Assembly, Is.Not.SameAs(typeof(Pair).Assembly));
+            var reader = new MessagePackReader(payload);
+            Assert.That(reader.ReadArrayHeader(), Is.EqualTo(1));
+            Assert.That(reader.ReadArrayHeader(), Is.EqualTo(2));
+            Assert.That(reader.ReadSingle(), Is.EqualTo(-2f), "Pair's own assembly resolver was used instead of the document's");
+            Assert.That(reader.ReadSingle(), Is.EqualTo(1.5f));
+            var decoded = CultDocumentMessagePackSerialization.DeserializeUntyped(type, payload, registry);
+            Assert.That(type.GetField("Value")!.GetValue(decoded), Is.EqualTo(new Pair { A = 1.5f, B = -2f }));
+        }
+
+        public sealed class ReversedPairResolver : IFormatterResolver
+        {
+            public static readonly IFormatterResolver Instance = new ReversedPairResolver();
+            public IMessagePackFormatter<T>? GetFormatter<T>() => typeof(T) == typeof(Pair) ? (IMessagePackFormatter<T>)(object)new ReversedPairFormatter() : null;
+        }
+
+        public sealed class ReversedPairFormatter : IMessagePackFormatter<Pair>
+        {
+            public void Serialize(ref MessagePackWriter writer, Pair value, MessagePackSerializerOptions options) { writer.WriteArrayHeader(2); writer.Write(value.B); writer.Write(value.A); }
+            public Pair Deserialize(ref MessagePackReader reader, MessagePackSerializerOptions options) { reader.ReadArrayHeader(); var b = reader.ReadSingle(); return new Pair { A = reader.ReadSingle(), B = b }; }
+        }
+
+        [CultDocument("tests.pair_holder", "tests.pair_holder.v1")]
+        [MessagePackObject]
+        public sealed class PairHolder
+        {
+            [Key(0)] public string Name = string.Empty;
+            [Key(1)] public Pair Value;
+        }
+
+        [CultDocument("cultcache.interop-note", "cultcache.interop_note.v1")]
+        [MessagePackObject]
+        public sealed class OptionsInteropNote
+        {
+            [Key(0)] public string SchemaVersion { get; set; } = "cultcache.interop_note.v1";
+            [Key(1)] [CultName] public string DocumentId { get; set; } = string.Empty;
+            [Key(2)] public string AuthorRuntimeId { get; set; } = string.Empty;
+            [Key(3)] public string Title { get; set; } = string.Empty;
+            [Key(4)] public string Body { get; set; } = string.Empty;
+            [Key(5)] public string[] Tags { get; set; } = Array.Empty<string>();
+        }
+
+        [CultDocument("tests.ref_keyed_holder", "tests.ref_keyed_holder.v1")]
+        [MessagePackObject]
+        public sealed class RefKeyedHolder
+        {
+            [Key(0)] [CultName] public string Name = string.Empty;
+            [Key(1)] public Dictionary<CultRecordRef<RefKeyedHolder>, float> Weights = new();
+        }
+    }
+}
diff --git a/tests/GameCult.Caching.Tests/StoreRoutingTests.cs b/tests/GameCult.Caching.Tests/StoreRoutingTests.cs
new file mode 100644
index 00000000..fc99f01f
--- /dev/null
+++ b/tests/GameCult.Caching.Tests/StoreRoutingTests.cs
@@ -0,0 +1,819 @@
+#nullable enable
+using System;
+using System.IO;
+using System.Linq;
+using System.Threading.Tasks;
+using GameCult.Caching;
+using GameCult.Caching.MessagePack;
+using MessagePack;
+using NUnit.Framework;
+using R3;
+
+namespace GameCult.Caching.Tests
+{
+    // The contract is src/GameCult.Caching/Contracts/cultcache-store-composition.md.
+    public class StoreRoutingTests
+    {
+        private string _directory = string.Empty;
+
+        [SetUp]
+        public void CreateDirectory()
+        {
+            _directory = Path.Combine(Path.GetTempPath(), $"cultlib-routing-{Guid.NewGuid():N}");
+            Directory.CreateDirectory(_directory);
+        }
+
+        [TearDown]
+        public void DeleteDirectory()
+        {
+            if (Directory.Exists(_directory))
+                Directory.Delete(_directory, recursive: true);
+        }
+
+        [Test]
+        public async Task LoadingNeverWritesASecondStore()
+        {
+            var registry = Registry();
+            var first = PathOf("a.cc");
+            var second = PathOf("b.cc");
+            await Seed(first, registry, new RoutingNote { Name = "note", Text = "seeded" });
+
+            using var cache = new CultCache(registry);
+            cache.AddBackingStore(new SingleFileMessagePackBackingStore(first));
+            await cache.PullAllBackingStoresAsync();
+            cache.AddBackingStore(new SingleFileMessagePackBackingStore(second), typeof(RoutingOther));
+            await cache.FlushAsync();
+
+            Assert.That(File.Exists(second), Is.False, "attaching a store and flushing without a mutation wrote it");
+        }
+
+        [Test]
+        public async Task UpsertWeaponThroughGearHandleReloadsAsWeapon()
+        {
+            var registry = CultDocumentRegistry.ForTypes(new[] { typeof(RoutingGear), typeof(RoutingWeapon) });
+            var path = PathOf("gear.cc");
+            var handle = new CultRecordHandle<RoutingGear>(new CultRecordKey("lance"));
+
+            using (var cache = new CultCache(registry))
+            {
+                cache.AddBackingStore(new SingleFileMessagePackBackingStore(path));
+                await cache.UpsertAsync<RoutingGear>(new RoutingWeapon { Name = "lance", Damage = 12 }, handle);
+                cache.FlushAllBackingStores();
+            }
+
+            using var reopened = new CultCache(registry);
+            reopened.AddBackingStore(new SingleFileMessagePackBackingStore(path));
+            await reopened.PullAllBackingStoresAsync();
+            var loaded = reopened.Get(handle.Key);
+
+            Assert.That(loaded, Is.InstanceOf<RoutingWeapon>(), "the handle's type parameter chose the schema");
+            Assert.That(((RoutingWeapon)loaded!).Damage, Is.EqualTo(12));
+            Assert.That(((RoutingWeapon)loaded!).Name, Is.EqualTo("lance"), "the inherited member did not round-trip");
+        }
+
+        [Test]
+        public async Task GetByNameMatchesAssignableTypes()
+        {
+            using var cache = new CultCache(CultDocumentRegistry.ForTypes(new[] { typeof(RoutingLeaf) }));
+            await cache.UpsertAsync(new RoutingLeaf { Name = "alpha" });
+
+            Assert.That(cache.GetByName<RoutingBase>("alpha"), Is.InstanceOf<RoutingLeaf>());
+        }
+
+        [Test]
+        public async Task WatchMatchesAssignableTypes()
+        {
+            using var cache = new CultCache(CultDocumentRegistry.ForTypes(new[] { typeof(RoutingLeaf) }));
+            var changes = 0;
+            using var subscription = cache.Watch<RoutingBase>().Subscribe(_ => changes++);
+
+            await cache.UpsertAsync(new RoutingLeaf { Name = "alpha" });
+
+            Assert.That(changes, Is.EqualTo(1));
+        }
+
+        [Test]
+        public async Task GetGlobalMatchesAssignableTypes()
+        {
+            using var cache = new CultCache(GlobalRegistry());
+            await cache.UpsertAsync(new RoutingGlobal { Value = "explicit" });
+
+            Assert.That((cache.GetGlobal<RoutingGlobalBase>() as RoutingGlobal)?.Value, Is.EqualTo("explicit"));
+        }
+
+        [Test]
+        public void ConstructingACacheInventsNothing()
+        {
+            using var cache = new CultCache(GlobalRegistry());
+
+            Assert.That(cache.AllEntries, Is.Empty);
+        }
+
+        [Test]
+        public async Task AttachThenFlushLeavesASeededFileByteIdentical()
+        {
+            var path = PathOf("seeded.cc");
+            var key = await Seed(
+                path,
+                CultDocumentRegistry.ForTypes(new[] { typeof(RoutingNote) }),
+                new RoutingNote { Name = "note", Text = "seeded" });
+            var before = File.ReadAllBytes(path);
+
+            using var cache = new CultCache(GlobalRegistry(typeof(RoutingNote)));
+            cache.AddBackingStore(new SingleFileMessagePackBackingStore(path));
+            await cache.PullAllBackingStoresAsync();
+            await cache.FlushAsync();
+
+            Assert.Multiple(() =>
+            {
+                Assert.That(cache.Get<RoutingNote>(key)?.Text, Is.EqualTo("seeded"), "the seeded record did not load");
+                Assert.That(File.ReadAllBytes(path), Is.EqualTo(before), "loading and flushing rewrote the file");
+            });
+        }
+
+        [Test]
+        public void RefusedPushLeavesNothingInMemory()
+        {
+            using var cache = new CultCache(CultDocumentRegistry.ForTypes(new[] { typeof(RoutingNote) }));
+            cache.AddBackingStore(new RefusingStore(PathOf("refusing.cc")));
+            var key = new CultRecordKey("refused");
+            var changes = 0;
+            using var subscription = cache.Watch<RoutingNote>().Subscribe(_ => changes++);
+
+            Assert.That(
+                async () => await cache.UpsertAsync(typeof(RoutingNote), new RoutingNote { Name = "refused" }, key),
+                Throws.InvalidOperationException);
+            Assert.That(cache.Get(key), Is.Null, "the store refused the write but the cache kept the document");
+            Assert.That(changes, Is.Zero, "the store refused the write but the cache published a change");
+        }
+
+        [Test]
+        public async Task RoutedStoresWriteTheSameBytesAsSingleStores()
+        {
+            var registry = Registry();
+            var note = new CultRecordKey("note");
+            var other = new CultRecordKey("other");
+
+            using (var routed = new CultCache(registry))
+            {
+                routed.AddBackingStore(new SingleFileMessagePackBackingStore(PathOf("catalog.cc")), typeof(RoutingNote));
+                routed.AddBackingStore(new SingleFileMessagePackBackingStore(PathOf("run.cc")), typeof(RoutingOther));
+                await routed.UpsertAsync(typeof(RoutingNote), new RoutingNote { Name = "n", Text = "catalog" }, note);
+                await routed.UpsertAsync(typeof(RoutingOther), new RoutingOther { Name = "o", Text = "run" }, other);
+                await routed.FlushAsync();
+            }
+
+            await Seed(PathOf("catalog-alone.cc"), registry, new RoutingNote { Name = "n", Text = "catalog" }, note);
+            await Seed(PathOf("run-alone.cc"), registry, new RoutingOther { Name = "o", Text = "run" }, other);
+
+            Assert.That(Normalized(PathOf("catalog.cc")), Is.EqualTo(Normalized(PathOf("catalog-alone.cc"))));
+            Assert.That(Normalized(PathOf("run.cc")), Is.EqualTo(Normalized(PathOf("run-alone.cc"))));
+        }
+
+        [Test]
+        public async Task CatalogRecordNeverLandsInRunStore()
+        {
+            var registry = Registry();
+            using var cache = new CultCache(registry);
+            var catalog = new SingleFileMessagePackBackingStore(PathOf("catalog.cc"));
+            var run = new SingleFileMessagePackBackingStore(PathOf("run.cc"));
+            cache.AddBackingStore(catalog, typeof(RoutingNote));
+            cache.AddBackingStore(run, typeof(RoutingOther));
+
+            await cache.UpsertAsync(new RoutingNote { Name = "n", Text = "catalog" });
+
+            Assert.That(catalog.IsDirty, Is.True);
+            Assert.That(run.IsDirty, Is.False);
+            await cache.FlushAsync();
+            Assert.That(File.Exists(PathOf("run.cc")), Is.False);
+            Assert.That(Snapshot(PathOf("catalog.cc")).Records, Has.Length.EqualTo(1));
+        }
+
+        [Test]
+        public void AttachAfterDirtyThrows()
+        {
+            var registry = Registry();
+            using var cache = new CultCache(registry);
+            var store = new SingleFileMessagePackBackingStore(PathOf("dirty.cc"));
+            store.Push(new CultStoredDocument(new CultRecordKey("staged"), FixedStoredAt, registry.GetRequired<RoutingNote>(), new RoutingNote()));
+
+            Assert.That(() => cache.AddBackingStore(store), Throws.InvalidOperationException.With.Message.Contains("staged writes"));
+            Assert.That(cache.BackingStores, Is.Empty);
+        }
+
+        [Test]
+        public void SecondUntypedStoreThrows()
+        {
+            using var cache = new CultCache(Registry());
+            cache.AddBackingStore(new SingleFileMessagePackBackingStore(PathOf("a.cc")));
+
+            Assert.That(() => cache.AddBackingStore(new SingleFileMessagePackBackingStore(PathOf("b.cc"))),
+                Throws.InvalidOperationException.With.Message.Contains("second untyped store"));
+            Assert.That(cache.BackingStores, Has.Count.EqualTo(1));
+        }
+
+        [Test]
+        public void DuplicateHomeTypeThrows()
+        {
+            using var cache = new CultCache(Registry());
+            cache.AddBackingStore(new SingleFileMessagePackBackingStore(PathOf("a.cc")), typeof(RoutingNote));
+
+            Assert.That(() => cache.AddBackingStore(new SingleFileMessagePackBackingStore(PathOf("b.cc")), typeof(RoutingNote)),
+                Throws.InvalidOperationException.With.Message.Contains("already routed"));
+            Assert.That(cache.BackingStores, Has.Count.EqualTo(1));
+        }
+
+        [Test]
+        public void WriteWithoutHomeThrows()
+        {
+            var registry = CultDocumentRegistry.ForTypes(new[] { typeof(RoutingNote), typeof(RoutingOther), typeof(RoutingGear) });
+            using var cache = new CultCache(registry);
+            var notes = new SingleFileMessagePackBackingStore(PathOf("notes.cc"));
+            var gear = new SingleFileMessagePackBackingStore(PathOf("gear.cc"));
+            cache.AddBackingStore(notes, typeof(RoutingNote));
+            cache.AddBackingStore(gear, typeof(RoutingGear));
+            var key = new CultRecordKey("homeless");
+
+            Assert.That(async () => await cache.UpsertAsync(typeof(RoutingOther), new RoutingOther(), key),
+                Throws.InvalidOperationException.With.Message.Contains("No backing store is home"));
+            Assert.That(notes.IsDirty, Is.False);
+            Assert.That(gear.IsDirty, Is.False);
+            Assert.That(cache.Get(key), Is.Null);
+        }
+
+        [Test]
+        public async Task ForeignRecordIsRefusedOnLoad()
+        {
+            var registry = Registry();
+            var runPath = PathOf("run.cc");
+            var key = await Seed(runPath, registry, new RoutingNote { Name = "n", Text = "misplaced" });
+            using var cache = new CultCache(registry);
+            cache.AddBackingStore(new SingleFileMessagePackBackingStore(PathOf("catalog.cc")), typeof(RoutingNote));
+
+            var refusal = Assert.Throws<InvalidOperationException>(() =>
+                cache.AddBackingStore(new SingleFileMessagePackBackingStore(runPath), typeof(RoutingOther)));
+
+            Assert.That(refusal!.Message, Does.Contain(key.Value).And.Contain(runPath).And.Contain(PathOf("catalog.cc")));
+            Assert.That(cache.AllEntries, Is.Empty);
+            Assert.That(cache.BackingStores, Has.Count.EqualTo(1));
+        }
+
+        [Test]
+        public async Task KeyCannotMoveToAnotherStoreOnWrite()
+        {
+            var registry = Registry();
+            var catalogPath = PathOf("catalog.cc");
+            var runPath = PathOf("run.cc");
+            var key = new CultRecordKey("shared-key");
+            using var cache = new CultCache(registry);
+            var run = new SingleFileMessagePackBackingStore(runPath);
+            cache.AddBackingStore(new SingleFileMessagePackBackingStore(catalogPath), typeof(RoutingNote));
+            cache.AddBackingStore(run, typeof(RoutingOther));
+            await cache.UpsertAsync(typeof(RoutingNote), new RoutingNote { Name = "n", Text = "catalog" }, key);
+            await cache.FlushAsync();
+            var before = File.ReadAllBytes(catalogPath);
+
+            var single = Assert.Throws<InvalidOperationException>(() =>
+                cache.UpsertAsync(typeof(RoutingOther), new RoutingOther { Name = "o", Text = "run" }, key));
+            var batched = Assert.Throws<InvalidOperationException>(() =>
+                cache.Commit(batch => batch.Upsert(typeof(RoutingOther), new RoutingOther { Name = "o", Text = "run" }, key)));
+            await cache.FlushAsync();
+
+            Assert.That(single!.Message, Does.Contain(key.Value).And.Contain(catalogPath).And.Contain(runPath));
+            Assert.That(batched!.Message, Is.EqualTo(single.Message));
+            Assert.That(run.IsDirty, Is.False);
+            Assert.That(File.Exists(runPath), Is.False);
+            Assert.That(File.ReadAllBytes(catalogPath), Is.EqualTo(before));
+            Assert.That(cache.Get<RoutingNote>(key)?.Text, Is.EqualTo("catalog"));
+        }
+
+        [Test]
+        public void KeyLoadedFromTwoStoresIsRefused()
+        {
+            var registry = Registry();
+            var catalogPath = PathOf("catalog.cc");
+            var runPath = PathOf("run.cc");
+            var key = new CultRecordKey("shared-key");
+            WriteRecords(catalogPath, registry, (key.Value, FixedStoredAt, new RoutingNote { Name = "n", Text = "catalog" }));
+            WriteRecords(runPath, registry, (key.Value, FixedStoredAt, new RoutingOther { Name = "o", Text = "run" }));
+            var runBefore = File.ReadAllBytes(runPath);
+            using var cache = new CultCache(registry);
+            cache.AddBackingStore(new SingleFileMessagePackBackingStore(catalogPath), typeof(RoutingNote));
+            var changes = 0;
+            using var subscription = cache.Watch<object>().Subscribe(_ => changes++);
+
+            var refusal = Assert.Throws<InvalidOperationException>(() =>
+                cache.AddBackingStore(new SingleFileMessagePackBackingStore(runPath), typeof(RoutingOther)));
+
+            Assert.That(refusal!.Message, Does.Contain(key.Value).And.Contain(catalogPath).And.Contain(runPath));
+            Assert.That(cache.BackingStores, Has.Count.EqualTo(1));
+            Assert.That(cache.AllEntries.Count(), Is.EqualTo(1));
+            Assert.That(cache.Get<RoutingNote>(key)?.Text, Is.EqualTo("catalog"));
+            Assert.That(changes, Is.Zero);
+            Assert.That(File.ReadAllBytes(runPath), Is.EqualTo(runBefore));
+        }
+
+        [Test]
+        public async Task LateRouteOverAdmittedTypeThrows()
+        {
+            var registry = Registry();
+            var untypedPath = PathOf("untyped.cc");
+            var routedPath = PathOf("notes.cc");
+            var key = await Seed(untypedPath, registry, new RoutingNote { Name = "n", Text = "admitted" });
+
+            using (var cache = new CultCache(registry))
+            {
+                var untyped = new SingleFileMessagePackBackingStore(untypedPath);
+                cache.AddBackingStore(untyped);
+
+                var refusal = Assert.Throws<InvalidOperationException>(() =>
+                    cache.AddBackingStore(new SingleFileMessagePackBackingStore(routedPath), typeof(RoutingNote)));
+
+                Assert.That(refusal!.Message, Does.Contain(untypedPath).And.Contain(routedPath));
+                Assert.That(cache.Get<RoutingNote>(key)?.Text, Is.EqualTo("admitted"));
+                Assert.That(cache.AllEntries.Count(), Is.EqualTo(1));
+                Assert.That(untyped.IsDirty, Is.False);
+            }
+
+            // Routed stores first, the untyped store last. The untyped store holds a type no route claims; a Note in it
+            // would be a foreign record (ForeignRecordIsRefusedOnLoad).
+            File.Move(untypedPath, routedPath);
+            var otherKey = await Seed(untypedPath, registry, new RoutingOther { Name = "o", Text = "untyped" });
+            using var ordered = new CultCache(registry);
+            ordered.AddBackingStore(new SingleFileMessagePackBackingStore(routedPath), typeof(RoutingNote));
+            Assert.That(() => ordered.AddBackingStore(new SingleFileMessagePackBackingStore(untypedPath)), Throws.Nothing);
+            Assert.That(ordered.Get<RoutingNote>(key)?.Text, Is.EqualTo("admitted"));
+            Assert.That(ordered.Get<RoutingOther>(otherKey)?.Text, Is.EqualTo("untyped"));
+        }
+
+        [Test]
+        public async Task ReadOnlyStoreRefusesWrites()
+        {
+            var registry = Registry();
+            var path = PathOf("catalog.cc");
+            await Seed(path, registry, new RoutingNote { Name = "n", Text = "authored" });
+            var before = File.ReadAllBytes(path);
+            using var cache = new CultCache(registry);
+            var store = new SingleFileMessagePackBackingStore(path, readOnly: true);
+            cache.AddBackingStore(store);
+            var key = new CultRecordKey("new");
+
+            Assert.That(async () => await cache.UpsertAsync(typeof(RoutingNote), new RoutingNote(), key),
+                Throws.InvalidOperationException.With.Message.Contains("read-only"));
+            Assert.That(() => store.PushAll(), Throws.InvalidOperationException.With.Message.Contains(path));
+            Assert.That(File.ReadAllBytes(path), Is.EqualTo(before));
+            Assert.That(cache.Get(key), Is.Null);
+            Assert.That(cache.IsDirty, Is.False);
+            Assert.That(File.Exists(path + ".lock"), Is.False);
+        }
+
+        [Test]
+        public async Task ReadOnlyStoreIsNotFlushed()
+        {
+            var registry = Registry();
+            var catalogPath = PathOf("catalog.cc");
+            await Seed(catalogPath, registry, new RoutingNote { Name = "n", Text = "authored" });
+            var before = File.ReadAllBytes(catalogPath);
+            using var cache = new CultCache(registry);
+            cache.AddBackingStore(new SingleFileMessagePackBackingStore(catalogPath, readOnly: true), typeof(RoutingNote));
+            cache.AddBackingStore(new SingleFileMessagePackBackingStore(PathOf("run.cc")), typeof(RoutingOther));
+
+            await cache.UpsertAsync(new RoutingOther { Name = "o", Text = "run" });
+            await cache.FlushAsync();
+
+            Assert.That(File.ReadAllBytes(catalogPath), Is.EqualTo(before));
+            Assert.That(File.Exists(catalogPath + ".lock"), Is.False);
+            Assert.That(Snapshot(PathOf("run.cc")).Records, Has.Length.EqualTo(1));
+            Assert.That(cache.IsDirty, Is.False);
+        }
+
+        [Test]
+        public async Task GlobalSingletonIsEnforced()
+        {
+            var registry = GlobalRegistry();
+            using (var cache = new CultCache(registry))
+            {
+                await cache.UpsertAsync(new RoutingGlobal { Value = "first" });
+
+                Assert.That(async () => await cache.UpsertAsync(typeof(RoutingGlobal), new RoutingGlobal { Value = "second" }, new CultRecordKey("second")),
+                    Throws.InvalidOperationException.With.Message.Contains("is a global"));
+                Assert.That(cache.AllEntries.Count(), Is.EqualTo(1));
+            }
+
+            var path = PathOf("two-globals.cc");
+            WriteRecords(path, registry,
+                ("global:one", FixedStoredAt, new RoutingGlobal { Value = "one" }),
+                ("global:two", FixedStoredAt, new RoutingGlobal { Value = "two" }));
+            using var reader = new CultCache(registry);
+            Assert.That(() => reader.AddBackingStore(new SingleFileMessagePackBackingStore(path)),
+                Throws.InvalidOperationException.With.Message.Contains("is a global"));
+            Assert.That(reader.AllEntries, Is.Empty);
+        }
+
+        [Test]
+        public async Task GetByIndexMatchesAssignableTypes()
+        {
+            using var cache = new CultCache(CultDocumentRegistry.ForTypes(new[] { typeof(RoutingIndexedLeaf), typeof(RoutingIndexedTwin) }));
+            var leaf = await cache.UpsertAsync(typeof(RoutingIndexedLeaf), new RoutingIndexedLeaf { Code = "alpha" });
+
+            Assert.That(cache.GetByIndex<RoutingIndexedBase>("code", "alpha"), Is.InstanceOf<RoutingIndexedLeaf>(),
+                "an index declared on a base member resolves through the base type");
+
+            var twin = await cache.UpsertAsync(typeof(RoutingIndexedTwin), new RoutingIndexedTwin { Code = "alpha" });
+
+            Assert.That(() => cache.GetByIndex<RoutingIndexedBase>("code", "alpha"),
+                Throws.InvalidOperationException.With.Message.Contains(leaf.Value).And.Message.Contains(twin.Value));
+            Assert.That(cache.GetByIndex<RoutingIndexedLeaf>("code", "alpha"), Is.InstanceOf<RoutingIndexedLeaf>());
+        }
+
+        [Test]
+        public async Task AmbiguousAssignableLookupThrows()
+        {
+            using var cache = new CultCache(CultDocumentRegistry.ForTypes(new[] { typeof(RoutingLeaf), typeof(RoutingLeafTwin) }));
+            var leaf = await cache.UpsertAsync(typeof(RoutingLeaf), new RoutingLeaf { Name = "alpha" });
+            var twin = await cache.UpsertAsync(typeof(RoutingLeafTwin), new RoutingLeafTwin { Name = "alpha" });
+
+            Assert.That(() => cache.GetByName<RoutingBase>("alpha"),
+                Throws.InvalidOperationException.With.Message.Contains(leaf.Value).And.Message.Contains(twin.Value));
+            Assert.That(cache.GetByName<RoutingLeaf>("alpha"), Is.Not.Null);
+        }
+
+        [Test]
+        public void BatchIsAllOrNothingOnStoreFailure()
+        {
+            var registry = Registry();
+            var path = PathOf("batch.cc");
+            using var cache = new CultCache(registry);
+            cache.AddBackingStore(new SingleFileMessagePackBackingStore(path));
+            cache.Commit(batch => batch.Upsert(new RoutingNote { Name = "a" }, new CultRecordHandle<RoutingNote>(new CultRecordKey("a"))));
+            var before = File.ReadAllBytes(path);
+            var changes = 0;
+            using var subscription = cache.Watch<RoutingNote>().Subscribe(_ => changes++);
+
+            using (new FileStream(path, FileMode.Open, FileAccess.Read, FileShare.Read))
+            {
+                Assert.That(() => cache.Commit(batch =>
+                {
+                    batch.Upsert(new RoutingNote { Name = "b1" }, new CultRecordHandle<RoutingNote>(new CultRecordKey("b1")));
+                    batch.Upsert(new RoutingNote { Name = "b2" }, new CultRecordHandle<RoutingNote>(new CultRecordKey("b2")));
+                }), Throws.InstanceOf<IOException>().Or.InstanceOf<UnauthorizedAccessException>());
+            }
+
+            Assert.That(cache.Get(new CultRecordKey("b1")), Is.Null);
+            Assert.That(cache.Get(new CultRecordKey("b2")), Is.Null);
+            Assert.That(File.ReadAllBytes(path), Is.EqualTo(before));
+            Assert.That(cache.IsDirty, Is.False);
+            Assert.That(changes, Is.Zero);
+        }
+
+        [Test]
+        public void BatchAcrossTwoHomesThrows()
+        {
+            var registry = Registry();
+            using var cache = new CultCache(registry);
+            var catalog = new SingleFileMessagePackBackingStore(PathOf("catalog.cc"));
+            var run = new SingleFileMessagePackBackingStore(PathOf("run.cc"));
+            cache.AddBackingStore(catalog, typeof(RoutingNote));
+            cache.AddBackingStore(run, typeof(RoutingOther));
+
+            Assert.That(() => cache.Commit(batch =>
+            {
+                batch.Upsert(new RoutingNote { Name = "n" }, new CultRecordHandle<RoutingNote>(new CultRecordKey("n")));
+                batch.Upsert(new RoutingOther { Name = "o" }, new CultRecordHandle<RoutingOther>(new CultRecordKey("o")));
+            }), Throws.InvalidOperationException.With.Message.Contains("one home store"));
+
+            Assert.That(catalog.IsDirty, Is.False);
+            Assert.That(run.IsDirty, Is.False);
+            Assert.That(cache.Get(new CultRecordKey("n")), Is.Null);
+            Assert.That(cache.Get(new CultRecordKey("o")), Is.Null);
+            Assert.That(Directory.GetFiles(_directory), Is.Empty);
+        }
+
+        [Test]
+        public void BatchObserversSeeOnlyCommittedRecords()
+        {
+            var registry = Registry();
+            using var cache = new CultCache(registry);
+            var changes = 0;
+            var changesWhenStoreCommitted = -1;
+            cache.AddBackingStore(new ObservingStore(PathOf("observed.cc"), () => changesWhenStoreCommitted = changes));
+            using var subscription = cache.Watch<RoutingNote>().Subscribe(_ => changes++);
+
+            cache.Commit(batch =>
+            {
+                batch.Upsert(new RoutingNote { Name = "one" }, new CultRecordHandle<RoutingNote>(new CultRecordKey("one")));
+                batch.Upsert(new RoutingNote { Name = "two" }, new CultRecordHandle<RoutingNote>(new CultRecordKey("two")));
+                Assert.That(changes, Is.Zero);
+            });
+
+            Assert.That(changesWhenStoreCommitted, Is.Zero, "a change was published before the store committed");
+            Assert.That(changes, Is.EqualTo(2));
+            Assert.That(() => cache.Commit(batch =>
+            {
+                batch.Upsert(new RoutingNote { Name = "three" }, new CultRecordHandle<RoutingNote>(new CultRecordKey("three")));
+                throw new InvalidOperationException("abandoned");
+            }), Throws.InvalidOperationException);
+            Assert.That(changes, Is.EqualTo(2));
+        }
+
+        [Test]
+        public async Task BatchReadsSeeCommittedStateOnly()
+        {
+            using var cache = new CultCache(Registry());
+            cache.AddBackingStore(new SingleFileMessagePackBackingStore(PathOf("reads.cc")));
+            var key = await cache.UpsertAsync(typeof(RoutingNote), new RoutingNote { Name = "n", Text = "committed" });
+            await cache.FlushAsync();
+
+            cache.Commit(batch =>
+            {
+                batch.Upsert(typeof(RoutingNote), new RoutingNote { Name = "n", Text = "staged" }, key);
+                Assert.That(cache.Get<RoutingNote>(key)?.Text, Is.EqualTo("committed"));
+            });
+
+            Assert.That(cache.Get<RoutingNote>(key)?.Text, Is.EqualTo("staged"));
+        }
+
+        [Test]
+        public async Task SingleUpsertAndBatchShareOneAdmissionPath()
+        {
+            using var cache = new CultCache(GlobalRegistry());
+            await cache.UpsertAsync(new RoutingGlobal { Value = "first" });
+            var second = new CultRecordKey("second");
+
+            var single = Assert.Throws<InvalidOperationException>(() =>
+                cache.UpsertAsync(typeof(RoutingGlobal), new RoutingGlobal { Value = "second" }, second));
+            var batched = Assert.Throws<InvalidOperationException>(() =>
+                cache.Commit(batch => batch.Upsert(typeof(RoutingGlobal), new RoutingGlobal { Value = "second" }, second)));
+
+            Assert.That(batched!.Message, Is.EqualTo(single!.Message));
+            Assert.That(cache.Get(second), Is.Null);
+        }
+
+        [Test]
+        public void PullAllAdmissionFailureLeavesStoreAndCacheConsistent()
+        {
+            var registry = GlobalRegistry(typeof(RoutingNote));
+            var path = PathOf("pull.cc");
+            WriteRecords(path, registry,
+                ("note:1", "2026-01-01T00:00:00.0000000+00:00", new RoutingNote { Name = "1", Text = "old" }),
+                ("global:one", FixedStoredAt, new RoutingGlobal { Value = "one" }));
+            using var cache = new CultCache(registry);
+            cache.AddBackingStore(new SingleFileMessagePackBackingStore(path));
+
+            WriteRecords(path, registry,
+                ("note:1", "2026-01-02T00:00:00.0000000+00:00", new RoutingNote { Name = "1", Text = "new" }),
+                ("note:2", "2026-01-02T00:00:00.0000000+00:00", new RoutingNote { Name = "2", Text = "arrived" }),
+                ("global:one", FixedStoredAt, new RoutingGlobal { Value = "one" }),
+                ("global:two", FixedStoredAt, new RoutingGlobal { Value = "two" }));
+            Assert.That(async () => await cache.PullAllBackingStoresAsync(), Throws.InvalidOperationException);
+            Assert.That(cache.Get<RoutingNote>(new CultRecordKey("note:1"))?.Text, Is.EqualTo("old"));
+            Assert.That(cache.Get(new CultRecordKey("note:2")), Is.Null);
+
+            WriteRecords(path, registry,
+                ("note:1", "2026-01-02T00:00:00.0000000+00:00", new RoutingNote { Name = "1", Text = "new" }),
+                ("note:2", "2026-01-02T00:00:00.0000000+00:00", new RoutingNote { Name = "2", Text = "arrived" }),
+                ("global:one", FixedStoredAt, new RoutingGlobal { Value = "one" }));
+            cache.PullAllBackingStoresAsync();
+            Assert.That(cache.Get<RoutingNote>(new CultRecordKey("note:1"))?.Text, Is.EqualTo("new"),
+                "the refused pull left the store believing it already held the new record");
+            Assert.That(cache.Get<RoutingNote>(new CultRecordKey("note:2"))?.Text, Is.EqualTo("arrived"));
+        }
+
+        [Test]
+        public void StoreAttachedToSecondCacheThrows()
+        {
+            var registry = Registry();
+            var store = new SingleFileMessagePackBackingStore(PathOf("shared.cc"));
+            using var first = new CultCache(registry);
+            using var second = new CultCache(registry);
+            first.AddBackingStore(store);
+
+            Assert.That(() => second.AddBackingStore(store), Throws.InvalidOperationException.With.Message.Contains("already attached"));
+            Assert.That(second.BackingStores, Is.Empty);
+        }
+
+        [Test]
+        public void PullAllPullsEveryStoreWhenAHandlerThrows()
+        {
+            var registry = Registry();
+            var notes = PathOf("notes.cc");
+            var others = PathOf("others.cc");
+            const string before = "2026-01-01T00:00:00.0000000+00:00";
+            const string after = "2026-01-02T00:00:00.0000000+00:00";
+            WriteRecords(notes, registry, ("note", before, new RoutingNote { Name = "note", Text = "old" }));
+            WriteRecords(others, registry, ("other", before, new RoutingOther { Name = "other", Text = "old" }));
+            using var cache = new CultCache(registry);
+            cache.AddBackingStore(new SingleFileMessagePackBackingStore(notes), typeof(RoutingNote));
+            cache.AddBackingStore(new SingleFileMessagePackBackingStore(others), typeof(RoutingOther));
+
+            WriteRecords(notes, registry, ("note", after, new RoutingNote { Name = "note", Text = "new" }));
+            WriteRecords(others, registry, ("other", after, new RoutingOther { Name = "other", Text = "new" }));
+            cache.OnUpdate += (_, document) =>
+            {
+                if (document is RoutingNote)
+                    throw new InvalidOperationException("handler refuses notes");
+            };
+
+            Assert.That(() => cache.PullAllBackingStoresAsync(), Throws.InvalidOperationException.With.Message.Contains("handler refuses notes"));
+            Assert.That(cache.Get<RoutingOther>(new CultRecordKey("other"))?.Text, Is.EqualTo("new"), "the second store was not pulled");
+        }
+
+        [Test]
+        public async Task NestedHoldOnAnotherCacheThrows()
+        {
+            var registry = Registry();
+            using var second = new CultCache(registry);
+            using var first = new CultCache(registry);
+            first.AddBackingStore(new NestingStore(PathOf("nesting.cc"), () => second.UpsertAsync(new RoutingOther { Name = "other" })));
+            await first.UpsertAsync(new RoutingNote { Name = "note" });
+
+            Assert.That(() => first.FlushAllBackingStores(), Throws.InvalidOperationException.With.Message.Contains("another cache's hold"));
+            Assert.That(second.AllEntries, Is.Empty);
+        }
+
+        private const string FixedStoredAt = "2026-09-13T00:00:00.0000000+00:00";
+
+        private string PathOf(string fileName) => Path.Combine(_directory, fileName);
+
+        private static CultDocumentRegistry Registry() =>
+            CultDocumentRegistry.ForTypes(new[] { typeof(RoutingNote), typeof(RoutingOther) });
+
+        private static CultDocumentRegistry GlobalRegistry(params Type[] others) =>
+            CultDocumentRegistry.ForTypes(new[] { typeof(RoutingGlobal) }.Concat(others));
+
+        private static async Task<CultRecordKey> Seed(string path, CultDocumentRegistry registry, object document, CultRecordKey? key = null)
+        {
+            using var cache = new CultCache(registry);
+            cache.AddBackingStore(new SingleFileMessagePackBackingStore(path));
+            var written = await cache.UpsertAsync(document.GetType(), document, key);
+            cache.FlushAllBackingStores();
+            File.Delete(path + ".lock");
+            return written;
+        }
+
+        private static void WriteRecords(string path, CultDocumentRegistry registry, params (string Key, string StoredAt, object Document)[] records)
+        {
+            var descriptors = records.Select(record => registry.GetRequired(record.Document.GetType())).ToArray();
+            var snapshot = new CultPersistedStoreSnapshot
+            {
+                SchemaCatalog = descriptors.Distinct().Select(descriptor => descriptor.ToCatalogEntry()).ToArray(),
+                Records = records.Select((record, index) => new CultPersistedRecord
+                {
+                    Key = record.Key,
+                    SchemaId = descriptors[index].SchemaId,
+                    StoredAt = record.StoredAt,
+                    Payload = CultDocumentMessagePackSerialization.SerializeUntyped(record.Document, record.Document.GetType(), registry)
+                }).ToArray()
+            };
+            File.WriteAllBytes(path, CultDocumentMessagePackSerialization.SerializeSnapshot(snapshot));
+        }
+
+        private static CultPersistedStoreSnapshot Snapshot(string path) =>
+            CultDocumentMessagePackSerialization.DeserializeSnapshot(File.ReadAllBytes(path));
+
+        private static byte[] Normalized(string path)
+        {
+            var snapshot = Snapshot(path);
+            foreach (var record in snapshot.Records)
+                record.StoredAt = FixedStoredAt;
+            return CultDocumentMessagePackSerialization.SerializeSnapshot(snapshot);
+        }
+
+        private sealed class RefusingStore : SingleFileMessagePackBackingStore
+        {
+            public RefusingStore(string filePath) : base(filePath)
+            {
+            }
+
+            public override void Push(CultStoredDocument entry) =>
+                throw new InvalidOperationException("RefusingStore refuses every write.");
+        }
+
+        private sealed class NestingStore : SingleFileMessagePackBackingStore
+        {
+            private readonly Action _nested;
+
+            public NestingStore(string filePath, Action nested) : base(filePath)
+            {
+                _nested = nested;
+            }
+
+            public override void PushAll()
+            {
+                _nested();
+                base.PushAll();
+            }
+        }
+
+        private sealed class ObservingStore : SingleFileMessagePackBackingStore
+        {
+            private readonly Action _committed;
+
+            public ObservingStore(string filePath, Action committed) : base(filePath)
+            {
+                _committed = committed;
+            }
+
+            public override CultCommitOutcome CommitBatch(CultCommitRequest request, bool wait)
+            {
+                var outcome = base.CommitBatch(request, wait);
+                _committed();
+                return outcome;
+            }
+        }
+
+        [CultDocument("tests.routing_note", "tests.routing_note.v1")]
+        [MessagePackObject(AllowPrivate = true)]
+        internal sealed class RoutingNote
+        {
+            [Key(0)]
+            [CultName]
+            public string Name = string.Empty;
+
+            [Key(1)]
+            public string Text = string.Empty;
+        }
+
+        [CultDocument("tests.routing_other", "tests.routing_other.v1")]
+        [MessagePackObject(AllowPrivate = true)]
+        internal sealed class RoutingOther
+        {
+            [Key(0)]
+            [CultName]
+            public string Name = string.Empty;
+
+            [Key(1)]
+            public string Text = string.Empty;
+        }
+
+        [CultDocument("tests.routing_gear", "tests.routing_gear.v1")]
+        [MessagePackObject]
+        public class RoutingGear
+        {
+            [Key(0)]
+            public string Name = string.Empty;
+        }
+
+        [CultDocument("tests.routing_weapon", "tests.routing_weapon.v1")]
+        [MessagePackObject]
+        public sealed class RoutingWeapon : RoutingGear
+        {
+            [Key(1)]
+            public int Damage;
+        }
+
+        internal abstract class RoutingBase
+        {
+        }
+
+        [CultDocument("tests.routing_leaf", "tests.routing_leaf.v1")]
+        [MessagePackObject(AllowPrivate = true)]
+        internal sealed class RoutingLeaf : RoutingBase
+        {
+            [Key(0)]
+            [CultName]
+            public string Name = string.Empty;
+        }
+
+        [CultDocument("tests.routing_leaf_twin", "tests.routing_leaf_twin.v1")]
+        [MessagePackObject(AllowPrivate = true)]
+        internal sealed class RoutingLeafTwin : RoutingBase
+        {
+            [Key(0)]
+            [CultName]
+            public string Name = string.Empty;
+        }
+
+        internal abstract class RoutingIndexedBase
+        {
+            [Key(0)]
+            [CultIndex("code")]
+            public string Code = string.Empty;
+        }
+
+        [CultDocument("tests.routing_indexed_leaf", "tests.routing_indexed_leaf.v1")]
+        [MessagePackObject(AllowPrivate = true)]
+        internal sealed class RoutingIndexedLeaf : RoutingIndexedBase
+        {
+        }
+
+        [CultDocument("tests.routing_indexed_twin", "tests.routing_indexed_twin.v1")]
+        [MessagePackObject(AllowPrivate = true)]
+        internal sealed class RoutingIndexedTwin : RoutingIndexedBase
+        {
+        }
+
+        internal abstract class RoutingGlobalBase
+        {
+        }
+
+        [CultDocument("tests.routing_global", "tests.routing_global.v1")]
+        [MessagePackObject(AllowPrivate = true)]
+        [CultGlobal]
+        internal sealed class RoutingGlobal : RoutingGlobalBase
+        {
+            [Key(0)]
+            public string Value = "schema default";
+        }
+    }
+}
diff --git a/tests/GameCult.Geometry.Tests/GeometryDocumentTests.cs b/tests/GameCult.Geometry.Tests/GeometryDocumentTests.cs
index 1723b852..302f53f3 100644
--- a/tests/GameCult.Geometry.Tests/GeometryDocumentTests.cs
+++ b/tests/GameCult.Geometry.Tests/GeometryDocumentTests.cs
@@ -3,17 +3,72 @@ using GameCult.Caching;
 using GameCult.Caching.MessagePack;
 using GameCult.Mesh;
 using GameCult.Networking;
+using MessagePack;
 using NUnit.Framework;
 using R3;
 using System;
 using System.Collections.Generic;
 using System.IO;
+using System.Text.Json;
 using System.Threading.Tasks;
 
 namespace GameCult.Geometry.Tests
 {
     public sealed class GeometryDocumentTests
     {
+        [Test]
+        public void GeometryPrimitives_CanonicalizeAndIntersect()
+        {
+            var viewport = new CultRect(8f, 4f, -8f, -4f);
+
+            viewport.Min.Should().Be(new CultVec2(-8f, -4f));
+            viewport.Max.Should().Be(new CultVec2(8f, 4f));
+            viewport.Center.Should().Be(CultVec2.Zero);
+            viewport.Contains(new CultVec2(2f, 3f)).Should().BeTrue();
+            viewport.Intersects(new CultRect(7f, 3f, 10f, 5f)).Should().BeTrue();
+            viewport.Intersects(new CultRect(9f, 5f, 10f, 6f)).Should().BeFalse();
+
+            var gravityBrush = new CultCircle(new CultVec2(10f, 0f), 3f);
+            gravityBrush.Intersects(viewport).Should().BeTrue();
+            gravityBrush.Contains(new CultVec2(12f, 0f)).Should().BeTrue();
+            gravityBrush.Contains(new CultVec2(14f, 0f)).Should().BeFalse();
+        }
+
+        [Test]
+        public void GeometryPrimitives_PreserveWholeVectorsForSoaAndPhysicsQueries()
+        {
+            var sphere = new CultSphere(new CultVec3(1f, 2f, 3f), 5f);
+
+            sphere.Contains(new CultVec3(1f, 6f, 3f)).Should().BeTrue();
+            sphere.Contains(new CultVec3(1f, 8f, 3f)).Should().BeFalse();
+            sphere.Center.Xy.Should().Be(new CultVec2(1f, 2f));
+            sphere.Center.Xz.Should().Be(new CultVec2(1f, 3f));
+            sphere.XyCircle.Bounds.Should().Be(new CultRect(-4f, -3f, 6f, 7f));
+        }
+
+        [Test]
+        public void GeometryPrimitives_RoundTripThroughMessagePack()
+        {
+            var rect = new CultRect(new CultVec2(5f, -2f), new CultVec2(-1f, 7f));
+            var payload = MessagePackSerializer.Serialize(rect);
+            var decoded = MessagePackSerializer.Deserialize<CultRect>(payload);
+
+            decoded.Should().Be(rect);
+            decoded.Min.Should().Be(new CultVec2(-1f, -2f));
+            decoded.Max.Should().Be(new CultVec2(5f, 7f));
+        }
+
+        [Test]
+        public void GeometryPrimitives_JsonOmitsComputedConvenienceProperties()
+        {
+            var json = JsonSerializer.Serialize(new CultVec3(1f, 2f, 3f));
+
+            json.Should().Be("""{"X":1,"Y":2,"Z":3}""");
+            json.Should().NotContain("LengthSquared");
+            json.Should().NotContain("Xy");
+            json.Should().NotContain("Xz");
+        }
+
         [Test]
         public void GeometryDocuments_Register_AsCultCacheSchemas()
         {
@@ -66,8 +121,8 @@ namespace GameCult.Geometry.Tests
         {
             var chunk = SampleChunk();
 
-            var payload = CultDocumentMessagePackSerialization.Serialize(chunk);
-            var decoded = CultDocumentMessagePackSerialization.Deserialize<CultGeometryChunkArtifact>(payload);
+            var payload = CultDocumentMessagePackSerialization.SerializeUntyped(chunk, typeof(CultGeometryChunkArtifact));
+            var decoded = (CultGeometryChunkArtifact)CultDocumentMessagePackSerialization.DeserializeUntyped(typeof(CultGeometryChunkArtifact), payload);
 
             decoded.ChunkId.Should().Be(chunk.ChunkId);
             decoded.RenderMesh.TriangleCount.Should().Be(1);
@@ -95,7 +150,7 @@ namespace GameCult.Geometry.Tests
         public void RustExportedDomainDocument_DecodesWithStableCultCacheKey()
         {
             var payload = File.ReadAllBytes(FixturePath("ragnarok-domain.msgpack"));
-            var domain = CultDocumentMessagePackSerialization.Deserialize<CultGeometryDomainDocument>(payload);
+            var domain = (CultGeometryDomainDocument)CultDocumentMessagePackSerialization.DeserializeUntyped(typeof(CultGeometryDomainDocument), payload);
 
             domain.DomainId.Should().Be("ragnarok-column");
             domain.Root.Children.Should().NotBeEmpty();
@@ -108,7 +163,7 @@ namespace GameCult.Geometry.Tests
         public void RustExportedChunkArtifact_DecodesWithStableCultCacheKey()
         {
             var payload = File.ReadAllBytes(FixturePath("ragnarok-first-chunk.msgpack"));
-            var chunk = CultDocumentMessagePackSerialization.Deserialize<CultGeometryChunkArtifact>(payload);
+            var chunk = (CultGeometryChunkArtifact)CultDocumentMessagePackSerialization.DeserializeUntyped(typeof(CultGeometryChunkArtifact), payload);
 
             chunk.ChunkId.Should().StartWith("chunk/");
             chunk.RenderMesh.TriangleCount.Should().BeGreaterThan(0);
@@ -137,7 +192,7 @@ namespace GameCult.Geometry.Tests
                 chunk,
                 new CultNetDocumentMessageOptions
                 {
-                    SourceRuntimeId = "vg-csg",
+                    SourceRuntimeId = "gamecult.geometry.csg",
                     SourceRole = "geometry-worker",
                     Tags = ["ragnarok", "chunk"]
                 });
@@ -227,7 +282,7 @@ namespace GameCult.Geometry.Tests
                     StartServer = false,
                     DatabaseOptions = new CultNetDatabaseOptions
                     {
-                        RuntimeId = "unity-runtime",
+                        RuntimeId = "godot-runtime",
                         DocumentRegistry = registry
                     }
                 }))
@@ -259,7 +314,7 @@ namespace GameCult.Geometry.Tests
             {
                 DomainId = "ragnarok-column",
                 RootKey = "ragnarok-column",
-                SourceRuntime = "vg-csg",
+                SourceRuntime = "gamecult.geometry.csg",
                 CreatedAt = "2026-05-29T00:00:00.0000000Z",
                 Root = new CultGeometryDomainNode
                 {
@@ -304,6 +359,7 @@ namespace GameCult.Geometry.Tests
             return Path.Combine(
                 TestContext.CurrentContext.TestDirectory,
                 "Fixtures",
+                // Immutable interoperability fixtures emitted before the CSG package rename.
                 "vg-csg-ragnarok",
                 fileName);
         }
diff --git a/tests/GameCult.Geometry.Tests/IsoSurfaceTests.cs b/tests/GameCult.Geometry.Tests/IsoSurfaceTests.cs
new file mode 100644
index 00000000..90d5f7f6
--- /dev/null
+++ b/tests/GameCult.Geometry.Tests/IsoSurfaceTests.cs
@@ -0,0 +1,89 @@
+using System;
+using FluentAssertions;
+using NUnit.Framework;
+
+namespace GameCult.Geometry.Tests
+{
+    [TestFixture]
+    public sealed class IsoSurfaceTests
+    {
+        [TestCase(-1f)]
+        [TestCase(1f)]
+        public void Uniform_field_has_no_surface(float value)
+        {
+            var samples = Filled(2, value);
+
+            var mesh = CultGeometryIsoSurface.Extract(samples);
+
+            mesh.Positions.Should().BeEmpty();
+            mesh.Normals.Should().BeEmpty();
+            mesh.Indices.Should().BeEmpty();
+        }
+
+        [Test]
+        public void Plane_field_interpolates_to_the_isovalue_and_faces_outward()
+        {
+            var samples = new float[2, 2, 2];
+            for (var y = 0; y < 2; y++)
+            for (var z = 0; z < 2; z++)
+            {
+                samples[0, y, z] = -0.5f;
+                samples[1, y, z] = 0.5f;
+            }
+
+            var mesh = CultGeometryIsoSurface.Extract(samples);
+
+            mesh.TriangleCount.Should().BeGreaterThan(0);
+            for (var index = 0; index < mesh.Positions.Length; index += 3)
+            {
+                mesh.Positions[index].Should().BeApproximately(0.5f, 1e-6f);
+            }
+
+            for (var index = 0; index < mesh.Normals.Length; index += 3)
+            {
+                mesh.Normals[index].Should().BeApproximately(1f, 1e-6f);
+                mesh.Normals[index + 1].Should().BeApproximately(0f, 1e-6f);
+                mesh.Normals[index + 2].Should().BeApproximately(0f, 1e-6f);
+            }
+        }
+
+        [Test]
+        public void Extraction_is_deterministic_and_applies_origin_and_cell_size()
+        {
+            var samples = new float[2, 2, 2];
+            samples[0, 0, 0] = -1f;
+            samples[1, 0, 0] = 1f;
+            samples[0, 1, 0] = 1f;
+            samples[1, 1, 0] = 1f;
+            samples[0, 0, 1] = 1f;
+            samples[1, 0, 1] = 1f;
+            samples[0, 1, 1] = 1f;
+            samples[1, 1, 1] = 1f;
+
+            var first = CultGeometryIsoSurface.Extract(samples, origin: new CultVec3(10f, 20f, 30f), cellSize: 2f);
+            var second = CultGeometryIsoSurface.Extract(samples, origin: new CultVec3(10f, 20f, 30f), cellSize: 2f);
+
+            second.Positions.Should().Equal(first.Positions);
+            second.Normals.Should().Equal(first.Normals);
+            second.Indices.Should().Equal(first.Indices);
+            first.Positions.Should().OnlyContain(value => value >= 10f);
+        }
+
+        [Test]
+        public void Invalid_field_shape_is_rejected()
+        {
+            Action act = () => CultGeometryIsoSurface.Extract(new float[1, 2, 2]);
+
+            act.Should().Throw<ArgumentException>();
+        }
+
+        private static float[,,] Filled(int size, float value)
+        {
+            var samples = new float[size, size, size];
+            for (var x = 0; x < size; x++)
+            for (var y = 0; y < size; y++)
+            for (var z = 0; z < size; z++) samples[x, y, z] = value;
+            return samples;
+        }
+    }
+}
diff --git a/tests/GameCult.Mesh.Quic.Native.Tests/CultMeshNativeQuicRealtimeTransportTests.cs b/tests/GameCult.Mesh.Quic.Native.Tests/CultMeshNativeQuicRealtimeTransportTests.cs
new file mode 100644
index 00000000..7eb99edc
--- /dev/null
+++ b/tests/GameCult.Mesh.Quic.Native.Tests/CultMeshNativeQuicRealtimeTransportTests.cs
@@ -0,0 +1,177 @@
+using System.Net;
+using System.Net.Quic;
+using System.Security.Cryptography;
+using System.Security.Cryptography.X509Certificates;
+using FluentAssertions;
+using GameCult.Mesh.Quic;
+using GameCult.Mesh.Quic.Native;
+using NUnit.Framework;
+
+namespace GameCult.Mesh.Quic.Native.Tests;
+
+[TestFixture]
+public sealed class CultMeshNativeQuicRealtimeTransportTests
+{
+    [Test]
+    public async Task NativeConnectorReceivesFromExternalManagedProvider()
+    {
+        var endpoint = Environment.GetEnvironmentVariable("CULTMESH_NATIVE_EXTERNAL_ENDPOINT");
+        if (string.IsNullOrWhiteSpace(endpoint))
+            Assert.Ignore("Set CULTMESH_NATIVE_EXTERNAL_ENDPOINT to exercise cross-process native/managed parity.");
+
+        var connector = new CultMeshNativeQuicRealtimeTransportConnector();
+        using var client = await connector.ConnectAsync(
+            new CultMeshTransportCandidate(endpoint!),
+            new CultMeshSessionTarget("aetheria", "aetheria.local"));
+        using var timeout = new CancellationTokenSource(TimeSpan.FromSeconds(10));
+        var frame = await client.ReceiveAsync(timeout.Token);
+
+        client.TransportId.Should().Be("msquic-native-realtime");
+        frame.SchemaId.Should().NotBeNullOrWhiteSpace();
+        frame.BodyId.Should().NotBeNullOrWhiteSpace();
+        frame.Payload.Should().NotBeEmpty();
+    }
+
+    [Test]
+    public async Task NativeConnectorAuthenticatesAndReceivesLatestOnlyFrame()
+    {
+        if (!OperatingSystem.IsWindows() || !QuicListener.IsSupported)
+            Assert.Ignore("Native MsQuic integration requires Windows QUIC support.");
+        using var certificate = CreateCertificate();
+        await using var server = await CultMeshQuicRealtimeServer.ListenAsync(new CultMeshQuicRealtimeServerOptions
+        {
+            ListenEndPoint = new IPEndPoint(IPAddress.Loopback, 0),
+            ServerCertificate = certificate
+        });
+        var pin = Convert.ToHexString(SHA256.HashData(certificate.RawData));
+        var endpoint = $"cultmesh-state+quic://127.0.0.1:{server.LocalEndPoint.Port}?cert-sha256={pin}";
+        var connector = new CultMeshNativeQuicRealtimeTransportConnector();
+
+        using var client = await connector.ConnectAsync(
+            new CultMeshTransportCandidate(endpoint),
+            new CultMeshSessionTarget("aetheria", "aetheria.local"));
+        var expected = new CultMeshRealtimeFrame
+        {
+            ChannelId = "aetheria.entities",
+            SchemaId = "gamecult.aetheria.entity_soa.v1",
+            BodyId = "aetheria.entities.current-zone",
+            ProducerEpoch = 17,
+            Sequence = 23,
+            Delivery = CultMeshRealtimeDelivery.LatestOnly,
+            Payload = new byte[] { 1, 3, 3, 7 }
+        };
+        await WaitUntilAsync(() => server.ConnectionCount == 1);
+        await server.BroadcastAsync(expected);
+
+        using var timeout = new CancellationTokenSource(TimeSpan.FromSeconds(5));
+        var actual = await client.ReceiveAsync(timeout.Token);
+
+        client.TransportId.Should().Be("msquic-native-realtime");
+        actual.ChannelId.Should().Be(expected.ChannelId);
+        actual.SchemaId.Should().Be(expected.SchemaId);
+        actual.BodyId.Should().Be(expected.BodyId);
+        actual.ProducerEpoch.Should().Be(expected.ProducerEpoch);
+        actual.Sequence.Should().Be(expected.Sequence);
+        actual.Delivery.Should().Be(CultMeshRealtimeDelivery.LatestOnly);
+        actual.Payload.ToArray().Should().Equal(expected.Payload.ToArray());
+    }
+
+    [Test]
+    public async Task NativeConnectorRejectsWrongAdvertisedPin()
+    {
+        if (!OperatingSystem.IsWindows() || !QuicListener.IsSupported)
+            Assert.Ignore("Native MsQuic integration requires Windows QUIC support.");
+        using var certificate = CreateCertificate();
+        await using var server = await CultMeshQuicRealtimeServer.ListenAsync(new CultMeshQuicRealtimeServerOptions
+        {
+            ListenEndPoint = new IPEndPoint(IPAddress.Loopback, 0),
+            ServerCertificate = certificate
+        });
+        var connector = new CultMeshNativeQuicRealtimeTransportConnector();
+        var endpoint = $"cultmesh-state+quic://127.0.0.1:{server.LocalEndPoint.Port}?cert-sha256={new string('0', 64)}";
+
+        var connect = () => connector.ConnectAsync(
+            new CultMeshTransportCandidate(endpoint),
+            new CultMeshSessionTarget("aetheria", "aetheria.local"));
+
+        await connect.Should().ThrowAsync<IOException>()
+            .WithMessage("*certificate*pin*");
+    }
+
+    [Test]
+    public async Task NativeClientDepartureCannotBreakProviderBroadcast()
+    {
+        if (!OperatingSystem.IsWindows() || !QuicListener.IsSupported)
+            Assert.Ignore("Native MsQuic integration requires Windows QUIC support.");
+        using var certificate = CreateCertificate();
+        await using var server = await CultMeshQuicRealtimeServer.ListenAsync(new CultMeshQuicRealtimeServerOptions
+        {
+            ListenEndPoint = new IPEndPoint(IPAddress.Loopback, 0),
+            ServerCertificate = certificate
+        });
+        var pin = Convert.ToHexString(SHA256.HashData(certificate.RawData));
+        var endpoint = $"cultmesh-state+quic://127.0.0.1:{server.LocalEndPoint.Port}?cert-sha256={pin}";
+        var connector = new CultMeshNativeQuicRealtimeTransportConnector();
+        var departedClient = await connector.ConnectAsync(
+            new CultMeshTransportCandidate(endpoint),
+            new CultMeshSessionTarget("aetheria", "aetheria.local"));
+        using var healthyClient = await connector.ConnectAsync(
+            new CultMeshTransportCandidate(endpoint),
+            new CultMeshSessionTarget("aetheria", "aetheria.local"));
+        await WaitUntilAsync(() => server.ConnectionCount == 2);
+        await server.BroadcastAsync(Frame(sequence: 1));
+        using var receiveTimeout = new CancellationTokenSource(TimeSpan.FromSeconds(5));
+        await departedClient.ReceiveAsync(receiveTimeout.Token);
+        await healthyClient.ReceiveAsync(receiveTimeout.Token);
+
+        departedClient.Dispose();
+
+        for (var sequence = 2; sequence <= 100; sequence++)
+            await server.BroadcastAsync(Frame(sequence)).WaitAsync(TimeSpan.FromSeconds(1));
+
+        CultMeshRealtimeFrame received;
+        do
+        {
+            received = await healthyClient.ReceiveAsync(receiveTimeout.Token);
+        }
+        while (received.Sequence < 100);
+
+        received.Sequence.Should().Be(100,
+            "a departed observer cannot stall provider publication or starve healthy peers");
+    }
+
+    private static CultMeshRealtimeFrame Frame(long sequence) => new()
+    {
+        ChannelId = "aetheria.entities",
+        SchemaId = "gamecult.aetheria.entity_soa.v1",
+        BodyId = "aetheria.entities.current-zone",
+        ProducerEpoch = 17,
+        Sequence = sequence,
+        Delivery = CultMeshRealtimeDelivery.LatestOnly,
+        Payload = new byte[] { 1, 3, 3, 7 }
+    };
+
+    private static async Task WaitUntilAsync(Func<bool> predicate)
+    {
+        using var timeout = new CancellationTokenSource(TimeSpan.FromSeconds(5));
+        while (!predicate())
+            await Task.Delay(10, timeout.Token);
+    }
+
+    private static X509Certificate2 CreateCertificate()
+    {
+        using var key = RSA.Create(2048);
+        var request = new CertificateRequest(
+            "CN=localhost",
+            key,
+            HashAlgorithmName.SHA256,
+            RSASignaturePadding.Pkcs1);
+        request.CertificateExtensions.Add(new X509BasicConstraintsExtension(false, false, 0, false));
+        request.CertificateExtensions.Add(new X509KeyUsageExtension(X509KeyUsageFlags.DigitalSignature, false));
+        request.CertificateExtensions.Add(new X509SubjectKeyIdentifierExtension(request.PublicKey, false));
+        using var generated = request.CreateSelfSigned(
+            DateTimeOffset.UtcNow.AddMinutes(-1),
+            DateTimeOffset.UtcNow.AddMinutes(10));
+        return X509CertificateLoader.LoadPkcs12(generated.Export(X509ContentType.Pfx), null);
+    }
+}
diff --git a/tests/GameCult.Mesh.Quic.Native.Tests/GameCult.Mesh.Quic.Native.Tests.csproj b/tests/GameCult.Mesh.Quic.Native.Tests/GameCult.Mesh.Quic.Native.Tests.csproj
new file mode 100644
index 00000000..fc232add
--- /dev/null
+++ b/tests/GameCult.Mesh.Quic.Native.Tests/GameCult.Mesh.Quic.Native.Tests.csproj
@@ -0,0 +1,30 @@
+<Project Sdk="Microsoft.NET.Sdk">
+  <PropertyGroup>
+    <TargetFramework>net10.0</TargetFramework>
+    <IsPackable>false</IsPackable>
+    <ImplicitUsings>enable</ImplicitUsings>
+    <Nullable>enable</Nullable>
+    <NoWarn>$(NoWarn);CA1416</NoWarn>
+    <NativeQuicOutput>$(MSBuildThisFileDirectory)..\..\artifacts\quic-native-test</NativeQuicOutput>
+  </PropertyGroup>
+  <ItemGroup>
+    <ProjectReference Include="..\..\src\GameCult.Mesh.Quic\GameCult.Mesh.Quic.csproj" />
+    <ProjectReference Include="..\..\src\GameCult.Mesh.Quic.Native\GameCult.Mesh.Quic.Native.csproj" />
+  </ItemGroup>
+  <ItemGroup>
+    <PackageReference Include="NUnit" Version="4.*" />
+    <PackageReference Include="NUnit3TestAdapter" Version="6.2.0" />
+    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="18.4.0" />
+    <PackageReference Include="FluentAssertions" Version="8.9.0" />
+  </ItemGroup>
+  <Target Name="BuildNativeQuicTestRuntime" BeforeTargets="Build" Condition="'$(OS)' == 'Windows_NT'">
+    <Exec Command="&quot;$(SystemRoot)\System32\WindowsPowerShell\v1.0\powershell.exe&quot; -NoProfile -ExecutionPolicy Bypass -File &quot;$(MSBuildThisFileDirectory)..\..\scripts\build-quic-native.ps1&quot; -Configuration Debug -OutputDirectory &quot;$(NativeQuicOutput)&quot;" />
+  </Target>
+  <Target Name="CopyNativeQuicTestRuntime" AfterTargets="Build" Condition="'$(OS)' == 'Windows_NT'">
+    <ItemGroup>
+      <NativeQuicRuntime Include="$(NativeQuicOutput)\gamecult_mesh_quic_native.dll" />
+      <NativeQuicRuntime Include="$(NativeQuicOutput)\msquic.dll" />
+    </ItemGroup>
+    <Copy SourceFiles="@(NativeQuicRuntime)" DestinationFolder="$(OutDir)" />
+  </Target>
+</Project>
diff --git a/tests/GameCult.Mesh.Quic.Tests/CultMeshQuicRealtimeTransportTests.cs b/tests/GameCult.Mesh.Quic.Tests/CultMeshQuicRealtimeTransportTests.cs
new file mode 100644
index 00000000..ef739411
--- /dev/null
+++ b/tests/GameCult.Mesh.Quic.Tests/CultMeshQuicRealtimeTransportTests.cs
@@ -0,0 +1,269 @@
+using System.Net;
+using System.Net.Quic;
+using System.Security.Cryptography;
+using System.Security.Cryptography.X509Certificates;
+using FluentAssertions;
+using NUnit.Framework;
+
+namespace GameCult.Mesh.Quic.Tests;
+
+[TestFixture]
+public sealed class CultMeshQuicRealtimeTransportTests
+{
+    [Test]
+    public async Task ConnectorNegotiatesAgainstAPlainMsQuicListener()
+    {
+        if (!QuicListener.IsSupported) Assert.Ignore("MsQuic is unavailable on this test host.");
+        var protocol = new System.Net.Security.SslApplicationProtocol("cultmesh-state-v1");
+        using var certificate = CreateCertificate();
+        await using var listener = await QuicListener.ListenAsync(new QuicListenerOptions
+        {
+            ListenEndPoint = new IPEndPoint(IPAddress.Loopback, 0),
+            ApplicationProtocols = new List<System.Net.Security.SslApplicationProtocol> { protocol },
+            ConnectionOptionsCallback = (_, _, _) => ValueTask.FromResult(new QuicServerConnectionOptions
+            {
+                DefaultCloseErrorCode = 0,
+                DefaultStreamErrorCode = 0,
+                ServerAuthenticationOptions = new System.Net.Security.SslServerAuthenticationOptions
+                {
+                    ApplicationProtocols = new List<System.Net.Security.SslApplicationProtocol> { protocol },
+                    EnabledSslProtocols = System.Security.Authentication.SslProtocols.Tls13,
+                    ServerCertificate = certificate
+                }
+            })
+        });
+        var accept = listener.AcceptConnectionAsync().AsTask();
+        var connector = new CultMeshQuicRealtimeTransportConnector(new CultMeshQuicRealtimeConnectorOptions
+        {
+            ApplicationProtocol = protocol,
+            ValidateProviderCertificate = (_, _, _, _) => true
+        });
+        using var client = await connector.ConnectAsync(
+            new CultMeshTransportCandidate($"cultmesh-state+quic://127.0.0.1:{listener.LocalEndPoint.Port}"),
+            new CultMeshSessionTarget("aetheria", "service:aetheria.daemon"));
+        await using var serverConnection = await accept;
+
+        client.TransportId.Should().Be("msquic-realtime");
+    }
+
+    [Test]
+    public async Task AdvertisedCertificatePinAuthenticatesASelfSignedProvider()
+    {
+        if (!QuicListener.IsSupported) Assert.Ignore("MsQuic is unavailable on this test host.");
+        using var certificate = CreateCertificate();
+        await using var server = await CultMeshQuicRealtimeServer.ListenAsync(new CultMeshQuicRealtimeServerOptions
+        {
+            ListenEndPoint = new IPEndPoint(IPAddress.Loopback, 0),
+            ServerCertificate = certificate
+        });
+        var pin = Convert.ToHexString(SHA256.HashData(certificate.RawData));
+        var endpoint = $"{CultMeshQuicRealtimeTransportConnector.Scheme}://127.0.0.1:{server.LocalEndPoint.Port}?cert-sha256={pin}";
+        var connector = new CultMeshQuicRealtimeTransportConnector();
+
+        using var client = await connector.ConnectAsync(
+            new CultMeshTransportCandidate(endpoint),
+            new CultMeshSessionTarget("aetheria", "service:aetheria.daemon"));
+
+        client.TransportId.Should().Be("msquic-realtime");
+        await WaitUntilAsync(() => server.ConnectionCount == 1);
+    }
+
+    [Test]
+    public async Task ReliableOrderedFramesShareAnOrderedStreamInBothDirections()
+    {
+        if (!QuicListener.IsSupported) Assert.Ignore("MsQuic is unavailable on this test host.");
+        using var certificate = CreateCertificate();
+        await using var server = await CultMeshQuicRealtimeServer.ListenAsync(new CultMeshQuicRealtimeServerOptions
+        {
+            ListenEndPoint = new IPEndPoint(IPAddress.Loopback, 0),
+            ServerCertificate = certificate
+        });
+        var runtimeId = CultMeshRuntimeId.Parse("service:aetheria.daemon");
+        var target = new CultMeshSessionTarget("aetheria", runtimeId.Value);
+        using var sessions = CreateSessions(server, out var validatedIdentity);
+        CultMeshRealtimeSession session;
+        try
+        {
+            session = await sessions.ConnectRealtimeAsync(target);
+        }
+        catch when (server.BackgroundFailure.IsCompleted)
+        {
+            throw new InvalidOperationException("QUIC server accept loop failed.", await server.BackgroundFailure);
+        }
+        await WaitUntilAsync(() => server.ConnectionCount == 1);
+
+        await session.SendAsync(Frame(1, CultMeshRealtimeDelivery.ReliableOrdered));
+        await session.SendAsync(Frame(2, CultMeshRealtimeDelivery.ReliableOrdered));
+        var firstAtServer = await server.ReceiveAsync().WaitAsync(TimeSpan.FromSeconds(5));
+        var secondAtServer = await server.ReceiveAsync().WaitAsync(TimeSpan.FromSeconds(5));
+
+        await server.BroadcastAsync(Frame(3, CultMeshRealtimeDelivery.ReliableOrdered));
+        await server.BroadcastAsync(Frame(4, CultMeshRealtimeDelivery.ReliableOrdered));
+        var firstAtClient = await session.ReceiveAsync().WaitAsync(TimeSpan.FromSeconds(5));
+        var secondAtClient = await session.ReceiveAsync().WaitAsync(TimeSpan.FromSeconds(5));
+
+        new[] { firstAtServer.Sequence, secondAtServer.Sequence }.Should().Equal(1, 2);
+        new[] { firstAtClient.Sequence, secondAtClient.Sequence }.Should().Equal(3, 4);
+        firstAtClient.Payload.ToArray().Should().Equal(3, 4, 5);
+        validatedIdentity.Value.Should().Be(runtimeId.Value);
+    }
+
+    [Test]
+    public async Task LatestOnlyCoalescesPendingStateAndDropsOlderGenerations()
+    {
+        if (!QuicListener.IsSupported) Assert.Ignore("MsQuic is unavailable on this test host.");
+        using var certificate = CreateCertificate();
+        await using var server = await CultMeshQuicRealtimeServer.ListenAsync(new CultMeshQuicRealtimeServerOptions
+        {
+            ListenEndPoint = new IPEndPoint(IPAddress.Loopback, 0),
+            ServerCertificate = certificate
+        });
+        var runtimeId = CultMeshRuntimeId.Parse("service:aetheria.daemon");
+        var target = new CultMeshSessionTarget("aetheria", runtimeId.Value);
+        using var sessions = CreateSessions(server, out _);
+        var session = await sessions.ConnectRealtimeAsync(target);
+        await WaitUntilAsync(() => server.ConnectionCount == 1);
+
+        await server.BroadcastAsync(Frame(100, CultMeshRealtimeDelivery.LatestOnly, producerEpoch: 7));
+        await server.BroadcastAsync(Frame(0, CultMeshRealtimeDelivery.LatestOnly, producerEpoch: 8));
+        await Task.Delay(100);
+        var latest = await session.ReceiveAsync().WaitAsync(TimeSpan.FromSeconds(5));
+        await server.BroadcastAsync(Frame(999, CultMeshRealtimeDelivery.LatestOnly, producerEpoch: 7));
+        using var staleDeadline = new CancellationTokenSource(TimeSpan.FromMilliseconds(300));
+        Func<Task> receiveStale = () => session.ReceiveAsync(staleDeadline.Token);
+
+        latest.ProducerEpoch.Should().Be(8);
+        latest.Sequence.Should().Be(0);
+        await receiveStale.Should().ThrowAsync<OperationCanceledException>(
+            "a late older generation must not twitch the consumer backwards");
+    }
+
+    [Test]
+    public async Task UnreliableDeliveryFailsClosedUntilANativeDatagramConnectorExists()
+    {
+        if (!QuicListener.IsSupported) Assert.Ignore("MsQuic is unavailable on this test host.");
+        using var certificate = CreateCertificate();
+        await using var server = await CultMeshQuicRealtimeServer.ListenAsync(new CultMeshQuicRealtimeServerOptions
+        {
+            ListenEndPoint = new IPEndPoint(IPAddress.Loopback, 0),
+            ServerCertificate = certificate
+        });
+        var runtimeId = CultMeshRuntimeId.Parse("service:aetheria.daemon");
+        var target = new CultMeshSessionTarget("aetheria", runtimeId.Value);
+        using var sessions = CreateSessions(server, out _);
+        var session = await sessions.ConnectRealtimeAsync(target);
+
+        Func<Task> send = () => session.SendAsync(Frame(1, CultMeshRealtimeDelivery.Unreliable));
+
+        await send.Should().ThrowAsync<NotSupportedException>().WithMessage("*datagrams*");
+        session.State.Status.Should().Be(CultMeshSessionStatus.Offline);
+    }
+
+    private static CultMeshSessionManager CreateSessions(
+        CultMeshQuicRealtimeServer server,
+        out IdentityObservation validatedIdentity)
+    {
+        validatedIdentity = new IdentityObservation();
+        var observation = validatedIdentity;
+        var endpoint = $"{CultMeshQuicRealtimeTransportConnector.Scheme}://127.0.0.1:{server.LocalEndPoint.Port}";
+        var discovery = new CultMeshDiscoveryService(new[] { new RouteSource(endpoint) });
+        var connector = new CultMeshQuicRealtimeTransportConnector(new CultMeshQuicRealtimeConnectorOptions
+        {
+            ValidateProviderCertificate = (identity, _, _, _) =>
+            {
+                observation.Value = identity.Value;
+                return true;
+            }
+        });
+        return new CultMeshSessionManager(
+            discovery,
+            Array.Empty<ICultMeshTransportConnector>(),
+            Array.Empty<ICultMeshContentTransportConnector>(),
+            new ICultMeshRealtimeTransportConnector[] { connector },
+            new CultMeshSessionManagerOptions
+            {
+                Trust = new CultMeshAuthorityTrustPolicy(CultMeshAuthorityTrustMode.LocalDevelopment)
+            });
+    }
+
+    private static CultMeshRealtimeFrame Frame(
+        long sequence,
+        CultMeshRealtimeDelivery delivery,
+        long producerEpoch = 7) => new()
+    {
+        ChannelId = "aetheria.entities",
+        SchemaId = "eve.entity_soa.v1",
+        BodyId = "body:aetheria:entities",
+        ProducerEpoch = producerEpoch,
+        Sequence = sequence,
+        Delivery = delivery,
+        Payload = new byte[] { 3, 4, 5 }
+    };
+
+    private static X509Certificate2 CreateCertificate()
+    {
+        using var key = RSA.Create(2048);
+        var request = new CertificateRequest(
+            "CN=localhost",
+            key,
+            HashAlgorithmName.SHA256,
+            RSASignaturePadding.Pkcs1);
+        request.CertificateExtensions.Add(new X509BasicConstraintsExtension(false, false, 0, false));
+        request.CertificateExtensions.Add(new X509KeyUsageExtension(X509KeyUsageFlags.DigitalSignature, false));
+        request.CertificateExtensions.Add(new X509EnhancedKeyUsageExtension(
+            new OidCollection { new("1.3.6.1.5.5.7.3.1") },
+            false));
+        var names = new SubjectAlternativeNameBuilder();
+        names.AddDnsName("localhost");
+        names.AddIpAddress(IPAddress.Loopback);
+        request.CertificateExtensions.Add(names.Build());
+        request.CertificateExtensions.Add(new X509SubjectKeyIdentifierExtension(request.PublicKey, false));
+        using var certificate = request.CreateSelfSigned(
+            DateTimeOffset.UtcNow.AddMinutes(-1),
+            DateTimeOffset.UtcNow.AddHours(1));
+        return X509CertificateLoader.LoadPkcs12(certificate.Export(X509ContentType.Pfx), null);
+    }
+
+    private static async Task WaitUntilAsync(Func<bool> predicate)
+    {
+        var deadline = DateTime.UtcNow.AddSeconds(5);
+        while (!predicate())
+        {
+            if (DateTime.UtcNow >= deadline) throw new TimeoutException("Timed out waiting for QUIC connection state.");
+            await Task.Delay(10);
+        }
+    }
+
+    private sealed class RouteSource(string endpoint) : ICultMeshLookupSource
+    {
+        public string SourceId => "quic-test";
+
+        public Task<IReadOnlyList<CultMeshDiscoveryObservation>> LookupAsync(
+            CultMeshDiscoveryQuery query,
+            CancellationToken cancellationToken = default)
+        {
+            var now = DateTimeOffset.UtcNow;
+            IReadOnlyList<CultMeshDiscoveryObservation> result = new[]
+            {
+                new CultMeshDiscoveryObservation(
+                    new CultMeshVerseDescriptor(
+                        "aetheria",
+                        "Aetheria",
+                        CultMeshVerseAuthorityModel.OperatorCluster,
+                        new CultMeshVerseCompatibility("cultmesh.v1", "test"),
+                        new[] { endpoint },
+                        new[] { "service:aetheria.daemon" }),
+                    SourceId,
+                    now,
+                    now.AddMinutes(1),
+                    CultMeshDiscoveryTrust.Signed)
+            };
+            return Task.FromResult(result);
+        }
+    }
+
+    private sealed class IdentityObservation
+    {
+        public string? Value { get; set; }
+    }
+}
diff --git a/tests/GameCult.Mesh.Quic.Tests/GameCult.Mesh.Quic.Tests.csproj b/tests/GameCult.Mesh.Quic.Tests/GameCult.Mesh.Quic.Tests.csproj
new file mode 100644
index 00000000..44a808f3
--- /dev/null
+++ b/tests/GameCult.Mesh.Quic.Tests/GameCult.Mesh.Quic.Tests.csproj
@@ -0,0 +1,23 @@
+<Project Sdk="Microsoft.NET.Sdk">
+  <PropertyGroup>
+    <TargetFramework>net10.0</TargetFramework>
+    <IsPackable>false</IsPackable>
+    <RootNamespace>GameCult.Mesh.Quic.Tests</RootNamespace>
+    <ImplicitUsings>enable</ImplicitUsings>
+    <Nullable>enable</Nullable>
+    <NoWarn>$(NoWarn);CA1416</NoWarn>
+  </PropertyGroup>
+  <ItemGroup>
+    <ProjectReference Include="..\..\src\GameCult.Mesh.Quic\GameCult.Mesh.Quic.csproj" />
+  </ItemGroup>
+  <ItemGroup>
+    <PackageReference Include="coverlet.msbuild" Version="10.0.0">
+      <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
+      <PrivateAssets>all</PrivateAssets>
+    </PackageReference>
+    <PackageReference Include="NUnit" Version="4.*" />
+    <PackageReference Include="NUnit3TestAdapter" Version="6.2.0" />
+    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="18.4.0" />
+    <PackageReference Include="FluentAssertions" Version="8.9.0" />
+  </ItemGroup>
+</Project>
diff --git a/tests/GameCult.Mesh.Tests/CultMeshAuthorityProofTests.cs b/tests/GameCult.Mesh.Tests/CultMeshAuthorityProofTests.cs
new file mode 100644
index 00000000..42f02297
--- /dev/null
+++ b/tests/GameCult.Mesh.Tests/CultMeshAuthorityProofTests.cs
@@ -0,0 +1,407 @@
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Net;
+using System.Net.Http;
+using System.Security.Cryptography;
+using System.Text;
+using System.Threading;
+using System.Threading.Tasks;
+using FluentAssertions;
+using GameCult.Networking;
+using NUnit.Framework;
+
+namespace GameCult.Mesh.Tests;
+
+public sealed class CultMeshAuthorityProofTests
+{
+    private static readonly DateTimeOffset Now = DateTimeOffset.FromUnixTimeMilliseconds(1_800_000_000_000);
+
+    [Test]
+    public void SignedRouteBindsEveryAuthorityFieldToConsumerTrust()
+    {
+        using var odin = ECDsa.Create(ECCurve.NamedCurves.nistP256);
+        using var provider = ECDsa.Create(ECCurve.NamedCurves.nistP256);
+        var route = SignedRoute(odin, provider);
+        var trust = Trust(odin);
+
+        trust.Validate("aetheria", route, Now);
+        var wireRoundTrip = new CultMeshVerseDescriptor(
+                "aetheria",
+                "Aetheria",
+                CultMeshVerseAuthorityModel.OperatorCluster,
+                new CultMeshVerseCompatibility("cultmesh.v0", "rules"),
+                authorityRoutes: new[] { route })
+            .ToMessage()
+            .ToVerseDescriptor()
+            .AuthorityRoutes[0];
+        trust.Validate("aetheria", wireRoundTrip, Now);
+        wireRoundTrip.Certificate!.ProviderKey.KeyId.Should().Be("provider-1");
+
+        Action mutatedEndpoint = () => trust.Validate("aetheria", new CultMeshAuthorityRoute(
+            route.AuthorityRuntimeId,
+            "wss://evil.example/mesh",
+            route.ProtocolIds,
+            route.Priority,
+            route.Generation,
+            route.Certificate), Now);
+        mutatedEndpoint.Should().Throw<CultMeshSessionException>()
+            .Which.Failure.Reason.Should().Be(CultMeshSessionFailureReason.Authentication);
+    }
+
+    [Test]
+    public void RemoteTrustRejectsUnknownExpiredAndUnsignedRoutes()
+    {
+        using var odin = ECDsa.Create(ECCurve.NamedCurves.nistP256);
+        using var provider = ECDsa.Create(ECCurve.NamedCurves.nistP256);
+        using var stranger = ECDsa.Create(ECCurve.NamedCurves.nistP256);
+        var route = SignedRoute(odin, provider);
+
+        Action unknownRoot = () => Trust(stranger).Validate("aetheria", route, Now);
+        Action expired = () => Trust(odin).Validate("aetheria", route, Now.AddHours(2));
+        Action unsigned = () => Trust(odin).Validate("aetheria", new CultMeshAuthorityRoute(
+            "aetheria-daemon", "wss://provider.example/mesh",
+            new[] { CultMeshProtocols.Documents.Value }, generation: "generation-1"), Now);
+
+        unknownRoot.Should().Throw<CultMeshSessionException>();
+        expired.Should().Throw<CultMeshSessionException>();
+        unsigned.Should().Throw<CultMeshSessionException>();
+    }
+
+    [Test]
+    public void UnsignedRouteRequiresExplicitLoopbackDevelopmentPolicy()
+    {
+        var local = new CultMeshAuthorityRoute(
+            "aetheria-daemon", "rudp://127.0.0.1:3076",
+            new[] { CultMeshProtocols.Documents.Value }, generation: "local");
+        var remote = new CultMeshAuthorityRoute(
+            "aetheria-daemon", "rudp://192.0.2.10:3076",
+            new[] { CultMeshProtocols.Documents.Value }, generation: "remote");
+        var policy = new CultMeshAuthorityTrustPolicy(CultMeshAuthorityTrustMode.LocalDevelopment);
+
+        policy.Validate("aetheria", local, Now);
+        Action remoteAttempt = () => policy.Validate("aetheria", remote, Now);
+        remoteAttempt.Should().Throw<CultMeshSessionException>();
+    }
+
+    [Test]
+    public void ProviderProofRejectsCredentialFreeEchoAndNonceReplay()
+    {
+        using var odin = ECDsa.Create(ECCurve.NamedCurves.nistP256);
+        using var provider = ECDsa.Create(ECCurve.NamedCurves.nistP256);
+        var route = SignedRoute(odin, provider);
+        var trust = Trust(odin);
+        var signer = new CultMeshSessionProofSigner(route, provider);
+        var request = Request("nonce-a");
+        var signed = Accepted(request, signer.Sign(request));
+
+        CultMeshAuthorityProof.VerifySessionProof(request, signed, "aetheria", route, trust, Now).Should().BeTrue();
+
+        var echo = Accepted(request, string.Empty);
+        CultMeshAuthorityProof.VerifySessionProof(request, echo, "aetheria", route, trust, Now).Should().BeFalse();
+
+        var replayedRequest = Request("nonce-b");
+        CultMeshAuthorityProof.VerifySessionProof(replayedRequest, signed, "aetheria", route, trust, Now).Should().BeFalse();
+    }
+
+    [Test]
+    public async Task SessionManagerRejectsPeerThatOnlyEchoesCertifiedIdentityStrings()
+    {
+        using var odin = ECDsa.Create(ECCurve.NamedCurves.nistP256);
+        using var provider = ECDsa.Create(ECCurve.NamedCurves.nistP256);
+        var now = DateTimeOffset.UtcNow;
+        var route = CultMeshAuthorityProof.CreateSignedRoute(
+            "aetheria", "aetheria-daemon", "wss://provider.example/mesh",
+            new[] { CultMeshProtocols.Documents.Value }, 0, "generation-live",
+            CultMeshEcdsaP256PublicKey.From("provider-live", provider), "odin-live",
+            now.AddMinutes(-1), now.AddMinutes(5), odin);
+        var descriptor = new CultMeshVerseDescriptor(
+            "aetheria", "Aetheria", CultMeshVerseAuthorityModel.OperatorCluster,
+            new CultMeshVerseCompatibility("cultmesh.v0", "rules"),
+            authorityRoutes: new[] { route });
+        using var discovery = new CultMeshDiscoveryService(new[] { new SignedRouteSource(descriptor) });
+        using var manager = new CultMeshSessionManager(
+            discovery,
+            new[] { new EchoConnector() },
+            new CultMeshSessionManagerOptions
+            {
+                Trust = new CultMeshAuthorityTrustPolicy(
+                    CultMeshAuthorityTrustMode.AuthenticatedRemote,
+                    new[] { CultMeshEcdsaP256PublicKey.From("odin-live", odin) })
+            });
+
+        Func<Task> connect = async () => await manager.ConnectAsync(
+            new CultMeshSessionTarget("aetheria", "aetheria-daemon"),
+            CultMeshProtocols.Documents);
+
+        (await connect.Should().ThrowAsync<CultMeshSessionException>())
+            .Which.Failure.Reason.Should().Be(CultMeshSessionFailureReason.Authority);
+    }
+
+    [Test]
+    public async Task SessionManagerRejectsOnlyThePoisonedRouteAndUsesCertifiedFallback()
+    {
+        using var odin = ECDsa.Create(ECCurve.NamedCurves.nistP256);
+        using var provider = ECDsa.Create(ECCurve.NamedCurves.nistP256);
+        var now = DateTimeOffset.UtcNow;
+        var valid = CultMeshAuthorityProof.CreateSignedRoute(
+            "aetheria", "aetheria-daemon", "wss://provider.example/mesh",
+            new[] { CultMeshProtocols.Documents.Value }, 10, "generation-valid",
+            CultMeshEcdsaP256PublicKey.From("provider-valid", provider), "odin-valid",
+            now.AddMinutes(-1), now.AddMinutes(5), odin);
+        var poisoned = new CultMeshAuthorityRoute(
+            "aetheria-daemon", "wss://poison.example/mesh",
+            new[] { CultMeshProtocols.Documents.Value }, priority: 0, generation: "generation-poisoned");
+        var descriptor = new CultMeshVerseDescriptor(
+            "aetheria", "Aetheria", CultMeshVerseAuthorityModel.OperatorCluster,
+            new CultMeshVerseCompatibility("cultmesh.v0", "rules"),
+            authorityRoutes: new[] { poisoned, valid });
+        using var discovery = new CultMeshDiscoveryService(new[] { new SignedRouteSource(descriptor) });
+        var signer = new CultMeshSessionProofSigner(valid, provider);
+        var connector = new SigningConnector(signer);
+        using var manager = new CultMeshSessionManager(
+            discovery,
+            new[] { connector },
+            new CultMeshSessionManagerOptions
+            {
+                Trust = new CultMeshAuthorityTrustPolicy(
+                    CultMeshAuthorityTrustMode.AuthenticatedRemote,
+                    new[] { CultMeshEcdsaP256PublicKey.From("odin-valid", odin) })
+            });
+
+        var session = await manager.ConnectAsync(
+            new CultMeshSessionTarget("aetheria", "aetheria-daemon"),
+            CultMeshProtocols.Documents);
+
+        session.State.Path!.Endpoint.Should().Be(valid.Endpoint);
+        connector.Attempts.Should().Equal(valid.Endpoint);
+    }
+
+    [Test]
+    public async Task AuthenticatedRemoteContentUsesCertifiedHttpsAndStreamsTheAdvertisedChunk()
+    {
+        using var odin = ECDsa.Create(ECCurve.NamedCurves.nistP256);
+        using var provider = ECDsa.Create(ECCurve.NamedCurves.nistP256);
+        var payload = Encoding.UTF8.GetBytes("certified-content");
+        var route = CultMeshAuthorityProof.CreateSignedRoute(
+            "aetheria", "aetheria-daemon", "https://provider.example/cultmesh/content",
+            new[] { CultMeshProtocols.Content.Value }, 0, "content-generation",
+            CultMeshEcdsaP256PublicKey.From("provider-content", provider), "odin-content",
+            Now.AddMinutes(-1), Now.AddMinutes(5), odin);
+        var descriptor = new CultMeshVerseDescriptor(
+            "aetheria", "Aetheria", CultMeshVerseAuthorityModel.OperatorCluster,
+            new CultMeshVerseCompatibility("cultmesh.v0", "rules"),
+            authorityRoutes: new[] { route });
+        using var discovery = new CultMeshDiscoveryService(new[] { new SignedRouteSource(descriptor) });
+        var handler = new FixedContentHandler(payload);
+        using var manager = new CultMeshSessionManager(
+            discovery,
+            Array.Empty<ICultMeshTransportConnector>(),
+            new ICultMeshContentTransportConnector[]
+            {
+                new CultMeshHttpsContentTransportConnector(() => handler)
+            },
+            new CultMeshSessionManagerOptions
+            {
+                Trust = new CultMeshAuthorityTrustPolicy(
+                    CultMeshAuthorityTrustMode.AuthenticatedRemote,
+                    new[] { CultMeshEcdsaP256PublicKey.From("odin-content", odin) }),
+                Clock = new FixedClock(Now)
+            });
+
+        var session = await manager.ConnectContentAsync(
+            new CultMeshSessionTarget("aetheria", "aetheria-daemon"));
+        using var destination = new MemoryStream();
+        await session.CopyChunkToAsync(new CultMeshCdnChunkRef
+        {
+            ChunkHash = Convert.ToHexString(SHA256.HashData(payload)).ToLowerInvariant(),
+            RecordKey = "cdn:chunk:certified",
+            SizeBytes = payload.Length
+        }, destination);
+
+        destination.ToArray().Should().Equal(payload);
+        handler.RequestUri.Should().NotBeNull();
+        handler.RequestUri!.Scheme.Should().Be(Uri.UriSchemeHttps);
+        handler.RequestUri.Query.Should().Contain("chunkHash=").And.Contain("recordKey=");
+    }
+
+    private static CultMeshAuthorityRoute SignedRoute(ECDsa odin, ECDsa provider) =>
+        CultMeshAuthorityProof.CreateSignedRoute(
+            "aetheria",
+            "aetheria-daemon",
+            "wss://provider.example/mesh",
+            new[] { CultMeshProtocols.Documents.Value },
+            0,
+            "generation-1",
+            CultMeshEcdsaP256PublicKey.From("provider-1", provider),
+            "odin-root-1",
+            Now.AddMinutes(-1),
+            Now.AddHours(1),
+            odin);
+
+    private static CultMeshAuthorityTrustPolicy Trust(ECDsa odin) => new(
+        CultMeshAuthorityTrustMode.AuthenticatedRemote,
+        new[] { CultMeshEcdsaP256PublicKey.From("odin-root-1", odin) });
+
+    private static GameCult.Networking.CultMeshSessionOpenMessage Request(string nonceLabel)
+    {
+        using var hash = SHA256.Create();
+        return new GameCult.Networking.CultMeshSessionOpenMessage
+        {
+            MessageId = "message-1",
+            SourceRuntimeId = "browser-1",
+            VerseId = "aetheria",
+            AuthorityRuntimeId = "aetheria-daemon",
+            ProtocolId = CultMeshProtocols.Documents.Value,
+            RouteGeneration = "generation-1",
+            ClientNonce = Convert.ToBase64String(hash.ComputeHash(System.Text.Encoding.UTF8.GetBytes(nonceLabel)))
+        };
+    }
+
+    private static GameCult.Networking.CultMeshSessionAcceptedMessage Accepted(
+        GameCult.Networking.CultMeshSessionOpenMessage request,
+        string signature) => new()
+        {
+            MessageId = request.MessageId,
+            Accepted = true,
+            VerseId = request.VerseId,
+            AuthorityRuntimeId = request.AuthorityRuntimeId,
+            ProtocolId = request.ProtocolId,
+            RouteGeneration = request.RouteGeneration,
+            ClientNonce = request.ClientNonce,
+            ProviderKeyId = "provider-1",
+            ProviderSignature = signature
+        };
+
+    private sealed class SignedRouteSource : ICultMeshLookupSource
+    {
+        private readonly CultMeshVerseDescriptor _descriptor;
+        public SignedRouteSource(CultMeshVerseDescriptor descriptor) => _descriptor = descriptor;
+        public string SourceId => "signed-odin";
+        public Task<IReadOnlyList<CultMeshDiscoveryObservation>> LookupAsync(
+            CultMeshDiscoveryQuery query,
+            CancellationToken cancellationToken = default) =>
+            Task.FromResult<IReadOnlyList<CultMeshDiscoveryObservation>>(new[]
+            {
+                new CultMeshDiscoveryObservation(
+                    _descriptor, SourceId, DateTimeOffset.UtcNow,
+                    DateTimeOffset.UtcNow.AddMinutes(1), CultMeshDiscoveryTrust.Signed)
+            });
+    }
+
+    private sealed class EchoConnector : ICultMeshTransportConnector
+    {
+        public string ConnectorId => "credential-free-echo";
+        public int Priority => 0;
+        public bool CanConnect(CultMeshTransportCandidate candidate) => true;
+        public Task<ICultNetSchemaClient> ConnectAsync(
+            CultMeshTransportCandidate candidate,
+            CultMeshProtocolId protocol,
+            CancellationToken cancellationToken = default) =>
+            Task.FromResult<ICultNetSchemaClient>(new EchoClient());
+    }
+
+    private sealed class EchoClient : ICultNetSchemaClient
+    {
+        private Action<CultMeshSessionAcceptedMessage>? _accepted;
+        public bool Connected => true;
+        public void Connect(string host, int port) { }
+        public void SendCultNet<T>(T message) where T : ICultNetSchemaMessage
+        {
+            if (message is not CultMeshSessionOpenMessage request) return;
+            _accepted?.Invoke(new CultMeshSessionAcceptedMessage
+            {
+                MessageId = request.MessageId,
+                Accepted = true,
+                VerseId = request.VerseId,
+                AuthorityRuntimeId = request.AuthorityRuntimeId,
+                ProtocolId = request.ProtocolId,
+                RouteGeneration = request.RouteGeneration,
+                ClientNonce = request.ClientNonce,
+                ProviderKeyId = "provider-live",
+                ProviderSignature = string.Empty
+            });
+        }
+        public void OnCultNet<T>(Action<T> callback) where T : ICultNetSchemaMessage
+        {
+            if (typeof(T) == typeof(CultMeshSessionAcceptedMessage))
+                _accepted = response => callback((T)(object)response);
+        }
+        public void Dispose() { }
+    }
+
+    private sealed class SigningConnector : ICultMeshTransportConnector
+    {
+        private readonly CultMeshSessionProofSigner _signer;
+        public SigningConnector(CultMeshSessionProofSigner signer) => _signer = signer;
+        public List<string> Attempts { get; } = new();
+        public string ConnectorId => "signed-provider";
+        public int Priority => 0;
+        public bool CanConnect(CultMeshTransportCandidate candidate) => true;
+        public Task<ICultNetSchemaClient> ConnectAsync(
+            CultMeshTransportCandidate candidate,
+            CultMeshProtocolId protocol,
+            CancellationToken cancellationToken = default)
+        {
+            Attempts.Add(candidate.Endpoint);
+            return Task.FromResult<ICultNetSchemaClient>(new SigningClient(_signer));
+        }
+    }
+
+    private sealed class SigningClient : ICultNetSchemaClient
+    {
+        private readonly CultMeshSessionProofSigner _signer;
+        private Action<CultMeshSessionAcceptedMessage>? _accepted;
+        public SigningClient(CultMeshSessionProofSigner signer) => _signer = signer;
+        public bool Connected => true;
+        public void Connect(string host, int port) { }
+        public void SendCultNet<T>(T message) where T : ICultNetSchemaMessage
+        {
+            if (message is not CultMeshSessionOpenMessage request) return;
+            _accepted?.Invoke(new CultMeshSessionAcceptedMessage
+            {
+                MessageId = request.MessageId,
+                Accepted = true,
+                VerseId = request.VerseId,
+                AuthorityRuntimeId = request.AuthorityRuntimeId,
+                ProtocolId = request.ProtocolId,
+                RouteGeneration = request.RouteGeneration,
+                ClientNonce = request.ClientNonce,
+                ProviderKeyId = _signer.ProviderKeyId,
+                ProviderSignature = _signer.Sign(request)
+            });
+        }
+        public void OnCultNet<T>(Action<T> callback) where T : ICultNetSchemaMessage
+        {
+            if (typeof(T) == typeof(CultMeshSessionAcceptedMessage))
+                _accepted = response => callback((T)(object)response);
+        }
+        public void Dispose() { }
+    }
+
+    private sealed class FixedContentHandler : HttpMessageHandler
+    {
+        private readonly byte[] _payload;
+        public FixedContentHandler(byte[] payload) => _payload = payload;
+        public Uri? RequestUri { get; private set; }
+
+        protected override Task<HttpResponseMessage> SendAsync(
+            HttpRequestMessage request,
+            CancellationToken cancellationToken)
+        {
+            RequestUri = request.RequestUri;
+            return Task.FromResult(new HttpResponseMessage(HttpStatusCode.OK)
+            {
+                Content = new ByteArrayContent(_payload)
+            });
+        }
+    }
+
+    private sealed class FixedClock : ICultMeshClock
+    {
+        public FixedClock(DateTimeOffset now) => UtcNow = now;
+        public DateTimeOffset UtcNow { get; }
+        public Task DelayAsync(TimeSpan delay, CancellationToken cancellationToken = default) =>
+            Task.Delay(delay, cancellationToken);
+    }
+}
diff --git a/tests/GameCult.Mesh.Tests/CultMeshAuthorityResolverTests.cs b/tests/GameCult.Mesh.Tests/CultMeshAuthorityResolverTests.cs
new file mode 100644
index 00000000..d05fa93f
--- /dev/null
+++ b/tests/GameCult.Mesh.Tests/CultMeshAuthorityResolverTests.cs
@@ -0,0 +1,208 @@
+#nullable enable
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using FluentAssertions;
+using NUnit.Framework;
+
+namespace GameCult.Mesh.Tests;
+
+public sealed class CultMeshAuthorityResolverTests
+{
+    private static readonly DateTimeOffset Now = new(2026, 7, 13, 12, 0, 0, TimeSpan.Zero);
+
+    [Test]
+    public void Resolve_AcceptsSignedLeaseWithExactScopeAndEpoch()
+    {
+        var fixture = CreateFixture();
+        var decision = fixture.Resolver.Resolve(fixture.Request());
+
+        decision.IsAuthorized.Should().BeTrue();
+        decision.DenialReason.Should().Be(CultMeshAuthorityDenialReason.None);
+        decision.LeaseId.Should().Be("lease:pilot");
+        decision.IssuerRuntimeId.Should().Be("odin");
+    }
+
+    [TestCase(null, CultMeshAuthorityDenialReason.MissingSignature)]
+    [TestCase("bad-signature", CultMeshAuthorityDenialReason.InvalidSignature)]
+    public void Resolve_RejectsMissingOrInvalidSignature(string? signature, CultMeshAuthorityDenialReason expected)
+    {
+        var fixture = CreateFixture(signature: signature);
+        fixture.Resolver.Resolve(fixture.Request()).DenialReason.Should().Be(expected);
+    }
+
+    [Test]
+    public void Resolve_RejectsLegacyUnsignedLeaseInsteadOfTreatingItAsEpochZero()
+    {
+        var catalog = new CultMeshAuthorityLeaseCatalog();
+        var lease = new CultMeshAuthorityLease("legacy", "verse", "peer", new[] { "pilot" }, null, "odin", Now.AddMinutes(-1), Now.AddMinutes(1));
+        catalog.Upsert(lease);
+        var peer = new CultMeshPeerCard("peer", "verse", Array.Empty<string>(), new[] { "pilot" }, authorityLeaseId: "legacy");
+        var resolver = new CultMeshAuthorityResolver(catalog, new SignatureVerifier(), new Revocations(), new ManualClock(Now));
+
+        resolver.Resolve(new CultMeshAuthorityRequest(peer, "pilot", null, 0)).DenialReason
+            .Should().Be(CultMeshAuthorityDenialReason.UnsupportedLeaseVersion);
+#pragma warning disable CS0618
+        catalog.IsAuthorized(peer, "pilot", at: Now).Should().BeFalse();
+#pragma warning restore CS0618
+    }
+
+    [Test]
+    public void Resolve_UsesInjectedClockForNotYetValidAndExpiry()
+    {
+        var fixture = CreateFixture(validFrom: Now.AddMinutes(1), expiresAt: Now.AddMinutes(2));
+        fixture.Resolver.Resolve(fixture.Request()).DenialReason.Should().Be(CultMeshAuthorityDenialReason.NotYetValid);
+        fixture.Clock.Advance(TimeSpan.FromMinutes(1));
+        fixture.Resolver.Resolve(fixture.Request()).IsAuthorized.Should().BeTrue();
+        fixture.Clock.Advance(TimeSpan.FromMinutes(1));
+        fixture.Resolver.Resolve(fixture.Request()).DenialReason.Should().Be(CultMeshAuthorityDenialReason.Expired);
+    }
+
+    [Test]
+    public void Resolve_RejectsRevokedLeaseAndCatalogReplacementCannotReviveIt()
+    {
+        var fixture = CreateFixture(revoked: true);
+        fixture.Resolver.Resolve(fixture.Request()).DenialReason.Should().Be(CultMeshAuthorityDenialReason.Revoked);
+
+        fixture.Catalog.Upsert(CreateLease(signature: "valid-replacement"));
+        fixture.Resolver.Resolve(fixture.Request()).DenialReason.Should().Be(CultMeshAuthorityDenialReason.Revoked);
+    }
+
+    [Test]
+    public void Resolve_CatalogReplacementCannotOverrideEpochPolicy()
+    {
+        var fixture = CreateFixture();
+        fixture.Catalog.Upsert(new CultMeshAuthorityLease(
+            "lease:pilot", "verse:aetheria", "peer:pilot", new[] { "pilot" }, new[] { "shard:a" }, "odin",
+            Now.AddMinutes(-1), Now.AddMinutes(1), "valid-new-epoch", 8, new[] { "body:world" }));
+
+        fixture.Resolver.Resolve(fixture.Request()).DenialReason.Should().Be(CultMeshAuthorityDenialReason.EpochMismatch);
+    }
+
+    [Test]
+    public void Resolve_ClockMovementExpiresLeaseWithoutCatalogMutation()
+    {
+        var fixture = CreateFixture(expiresAt: Now.AddSeconds(1));
+        fixture.Resolver.Resolve(fixture.Request()).IsAuthorized.Should().BeTrue();
+        fixture.Clock.Advance(TimeSpan.FromSeconds(1));
+        fixture.Resolver.Resolve(fixture.Request()).DenialReason.Should().Be(CultMeshAuthorityDenialReason.Expired);
+    }
+
+    [Test]
+    public void Resolve_ReportsDistinctScopeDenials()
+    {
+        AssertDenied(CreateFixture(peerVerse: "other").Request(), CreateFixture(peerVerse: "other").Resolver, CultMeshAuthorityDenialReason.VerseMismatch);
+        AssertDenied(CreateFixture(peerId: "other").Request(), CreateFixture(peerId: "other").Resolver, CultMeshAuthorityDenialReason.PeerMismatch);
+        AssertDenied(CreateFixture(requestRole: "trade").Request(), CreateFixture(requestRole: "trade").Resolver, CultMeshAuthorityDenialReason.RoleNotGranted);
+        AssertDenied(CreateFixture(requestShard: "shard:b").Request(), CreateFixture(requestShard: "shard:b").Resolver, CultMeshAuthorityDenialReason.ShardNotGranted);
+        AssertDenied(CreateFixture(requestEpoch: 8).Request(), CreateFixture(requestEpoch: 8).Resolver, CultMeshAuthorityDenialReason.EpochMismatch);
+        AssertDenied(CreateFixture(requestScope: "body:other").Request(), CreateFixture(requestScope: "body:other").Resolver, CultMeshAuthorityDenialReason.ResourceScopeNotGranted);
+    }
+
+    [Test]
+    public void Resolve_NewPeerPublicationCannotReviveExpiredAuthority()
+    {
+        var fixture = CreateFixture(expiresAt: Now);
+        fixture.CatalogPeers.Upsert(fixture.Peer);
+        fixture.CatalogPeers.FindAuthorized("verse:aetheria", "pilot", fixture.Resolver, 7, "shard:a", "body:world").Should().BeEmpty();
+
+        fixture.CatalogPeers.Upsert(new CultMeshPeerCard("peer:pilot", "verse:aetheria", Array.Empty<string>(), new[] { "pilot" }, new[] { "shard:a" }, authorityLeaseId: "lease:pilot"));
+        fixture.CatalogPeers.FindAuthorized("verse:aetheria", "pilot", fixture.Resolver, 7, "shard:a", "body:world").Should().BeEmpty();
+    }
+
+    [Test]
+    public void Resolve_NewPeerPublicationCannotReviveRevokedAuthority()
+    {
+        var fixture = CreateFixture(revoked: true);
+        fixture.CatalogPeers.Upsert(fixture.Peer);
+        fixture.CatalogPeers.FindAuthorized("verse:aetheria", "pilot", fixture.Resolver, 7, "shard:a", "body:world").Should().BeEmpty();
+
+        fixture.CatalogPeers.Upsert(new CultMeshPeerCard("peer:pilot", "verse:aetheria", Array.Empty<string>(), new[] { "pilot" }, new[] { "shard:a" }, authorityLeaseId: "lease:pilot"));
+        fixture.CatalogPeers.FindAuthorized("verse:aetheria", "pilot", fixture.Resolver, 7, "shard:a", "body:world").Should().BeEmpty();
+    }
+
+    [Test]
+    public void Diagnostics_CarryEvidenceIdentifiersButNeverSignatureMaterial()
+    {
+        var fixture = CreateFixture(signature: "super-secret-signature");
+        fixture.Resolver.Resolve(fixture.Request());
+
+        var diagnostic = fixture.Diagnostics.Snapshot().Should().ContainSingle().Subject;
+        diagnostic.OperationId.Should().Be("lease:pilot");
+        diagnostic.SubjectId.Should().Be("peer:pilot");
+        diagnostic.SourceId.Should().Be("odin");
+        string.Join("|", diagnostic.OperationId, diagnostic.SubjectId, diagnostic.SourceId, diagnostic.ReasonCode, diagnostic.Endpoint)
+            .Should().NotContain("super-secret-signature");
+    }
+
+    [Test]
+    public void PeerSelectionAndPrivilegedRudpHelpersUseResolverDecision()
+    {
+        var fixture = CreateFixture();
+        fixture.CatalogPeers.Upsert(fixture.Peer);
+        fixture.CatalogPeers.FirstAuthorized("verse:aetheria", "pilot", fixture.Resolver, 7, "shard:a", "body:world")
+            .Should().BeSameAs(fixture.Peer);
+
+#pragma warning disable CS0618
+        fixture.CatalogPeers.FirstAuthorized("verse:aetheria", "pilot", fixture.Catalog, "shard:a", Now).Should().BeNull();
+        Action legacy = () => CultMesh.CreateRudpClientForAuthorizedPeer("client", 1, fixture.CatalogPeers, fixture.Catalog, "verse:aetheria", "pilot", "shard:a", Now);
+#pragma warning restore CS0618
+        legacy.Should().Throw<InvalidOperationException>().WithMessage("No authorized RUDP peer*");
+
+        Action resolved = () => CultMesh.CreateRudpClientForAuthorizedPeer("client", 1, fixture.CatalogPeers, fixture.Resolver, 7, "verse:aetheria", "pilot", "shard:a", "body:world");
+        resolved.Should().Throw<InvalidOperationException>().WithMessage("Peer peer:pilot does not advertise a RUDP endpoint.");
+    }
+
+    private static void AssertDenied(CultMeshAuthorityRequest request, CultMeshAuthorityResolver resolver, CultMeshAuthorityDenialReason reason) =>
+        resolver.Resolve(request).DenialReason.Should().Be(reason);
+
+    private static Fixture CreateFixture(
+        string? signature = "valid-signature", DateTimeOffset? validFrom = null, DateTimeOffset? expiresAt = null,
+        bool revoked = false, string peerId = "peer:pilot", string peerVerse = "verse:aetheria",
+        string requestRole = "pilot", string requestShard = "shard:a", long requestEpoch = 7, string requestScope = "body:world")
+    {
+        var catalog = new CultMeshAuthorityLeaseCatalog();
+        catalog.Upsert(CreateLease(signature, validFrom, expiresAt));
+        var clock = new ManualClock(Now);
+        var revocations = new Revocations(revoked ? new[] { ("lease:pilot", 7L) } : null);
+        var diagnostics = new CultMeshDiagnosticBuffer();
+        var resolver = new CultMeshAuthorityResolver(catalog, new SignatureVerifier(), revocations, clock, diagnostics);
+        var peer = new CultMeshPeerCard(peerId, peerVerse, Array.Empty<string>(), new[] { "pilot" }, new[] { "shard:a" }, authorityLeaseId: "lease:pilot");
+        return new Fixture(catalog, new CultMeshPeerCatalog(), clock, diagnostics, resolver, peer, requestRole, requestShard, requestEpoch, requestScope);
+    }
+
+    private static CultMeshAuthorityLease CreateLease(string? signature = "valid-signature", DateTimeOffset? validFrom = null, DateTimeOffset? expiresAt = null) =>
+        new("lease:pilot", "verse:aetheria", "peer:pilot", new[] { "pilot" }, new[] { "shard:a" }, "odin",
+            validFrom ?? Now.AddMinutes(-1), expiresAt ?? Now.AddMinutes(1), signature, 7, new[] { "body:world" });
+
+    private sealed record Fixture(
+        CultMeshAuthorityLeaseCatalog Catalog, CultMeshPeerCatalog CatalogPeers, ManualClock Clock,
+        CultMeshDiagnosticBuffer Diagnostics, CultMeshAuthorityResolver Resolver, CultMeshPeerCard Peer,
+        string Role, string Shard, long Epoch, string Scope)
+    {
+        public CultMeshAuthorityRequest Request() => new(Peer, Role, Shard, Epoch, Scope);
+    }
+
+    private sealed class SignatureVerifier : ICultMeshAuthoritySignatureVerifier
+    {
+        public bool Verify(CultMeshAuthorityLease lease) => lease.Signature?.StartsWith("valid", StringComparison.Ordinal) == true;
+    }
+
+    private sealed class Revocations : ICultMeshAuthorityRevocationSource
+    {
+        private readonly HashSet<(string, long)> _revoked;
+        public Revocations(IEnumerable<(string, long)>? revoked = null) => _revoked = revoked?.ToHashSet() ?? new();
+        public bool IsRevoked(string leaseId, long authorityEpoch) => _revoked.Contains((leaseId, authorityEpoch));
+    }
+
+    private sealed class ManualClock : ICultMeshClock
+    {
+        public ManualClock(DateTimeOffset now) => UtcNow = now;
+        public DateTimeOffset UtcNow { get; private set; }
+        public Task DelayAsync(TimeSpan delay, CancellationToken cancellationToken = default) { Advance(delay); return Task.CompletedTask; }
+        public void Advance(TimeSpan duration) => UtcNow += duration;
+    }
+}
diff --git a/tests/GameCult.Mesh.Tests/CultMeshBodyPublicationTests.cs b/tests/GameCult.Mesh.Tests/CultMeshBodyPublicationTests.cs
new file mode 100644
index 00000000..eb8eca2e
--- /dev/null
+++ b/tests/GameCult.Mesh.Tests/CultMeshBodyPublicationTests.cs
@@ -0,0 +1,401 @@
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Net;
+using System.Net.Sockets;
+using System.Threading;
+using System.Threading.Tasks;
+using FluentAssertions;
+using GameCult.Caching;
+using GameCult.Networking;
+using NUnit.Framework;
+
+#nullable enable
+
+namespace GameCult.Mesh.Tests;
+
+public sealed class CultMeshBodyPublicationTests
+{
+    private string _root = null!;
+
+    [SetUp]
+    public void SetUp() =>
+        _root = Path.Combine(Path.GetTempPath(), "cultmesh-body-publications", Guid.NewGuid().ToString("N"));
+
+    [TearDown]
+    public void TearDown()
+    {
+        if (Directory.Exists(_root)) Directory.Delete(_root, true);
+    }
+
+    [Test]
+    public void TypedDocument_RoundTripsAndRegistersWithGenerationKey()
+    {
+        var now = DateTimeOffset.UtcNow;
+        var publication = Publication(new byte[] { 1, 2, 3, 4 }, now);
+        var path = Path.Combine(_root, "publication.cc");
+        var handle = Handle(publication);
+
+        CultMesh.WriteSingleFileDocument(path, handle.RecordKey, publication);
+        var restored = CultMesh.ReadSingleFileDocument<CultMeshBodyPublicationDocument>(path, handle.RecordKey);
+        var registry = CultMesh.CreateBodyPublicationDocumentRegistry();
+
+        handle.Validate(restored);
+        restored.Should().BeEquivalentTo(publication);
+        registry.GetByDocumentType(typeof(CultMeshBodyPublicationDocument)).Should().NotBeNull();
+        handle.RecordKey.Should().Be(CultMeshBodyPublicationDocument.CreateRecordKey(
+            publication.BodyId, publication.ProducerEpoch, publication.Sequence));
+        handle.RecordKey.Should().NotBe(CultMeshBodyPublicationDocument.CreateLatestRecordKey(publication.BodyId));
+    }
+
+    [Test]
+    public async System.Threading.Tasks.Task GenerationRecords_PreserveNWhenNPlusOneIsPublished()
+    {
+        var now = DateTimeOffset.UtcNow;
+        var first = Publication(new byte[] { 1, 2, 3, 4 }, now);
+        var second = Publication(new byte[] { 5, 6, 7, 8 }, now);
+        second.Sequence++;
+        foreach (var representation in second.Representations) representation.Sequence++;
+        var cache = new CultCache();
+
+        await cache.UpsertAsync(first, new CultRecordHandle<CultMeshBodyPublicationDocument>(first.RecordKey));
+        await cache.UpsertAsync(second, new CultRecordHandle<CultMeshBodyPublicationDocument>(second.RecordKey));
+
+        var restoredFirst = cache.Get<CultMeshBodyPublicationDocument>(first.RecordKey);
+        restoredFirst.Should().NotBeNull();
+        Handle(first).Validate(restoredFirst!);
+        restoredFirst!.Sequence.Should().Be(42);
+        cache.Get<CultMeshBodyPublicationDocument>(second.RecordKey)!.Sequence.Should().Be(43);
+    }
+
+    [Test]
+    public void GenerationHandle_RejectsLatestOrDifferentGenerationEnvelope()
+    {
+        var publication = Publication(new byte[4], DateTimeOffset.UtcNow);
+        var staleLatestKey = CultMeshBodyPublicationDocument.CreateLatestRecordKey(publication.BodyId);
+        var next = Publication(new byte[4], DateTimeOffset.UtcNow);
+        next.Sequence++;
+        foreach (var representation in next.Representations) representation.Sequence++;
+
+        Action staleLatest = () => CultMeshBodyPublicationValidator.Validate(
+            publication, publication.BodyId, publication.ProducerEpoch, publication.Sequence, staleLatestKey);
+        Action substituted = () => Handle(publication).Validate(next);
+
+        staleLatest.Should().Throw<InvalidOperationException>().WithMessage("*record key*");
+        substituted.Should().Throw<InvalidOperationException>().WithMessage("*sequence*");
+    }
+
+    [Test]
+    public void Resolver_UsesPreferredLocalRepresentation()
+    {
+        var now = DateTimeOffset.UtcNow;
+        var bytes = BitConverter.GetBytes(12.5f);
+        var publication = Publication(bytes, now);
+        var resolver = Resolver(bytes, (producer, _) => producer == "aetheria");
+
+        using var lease = resolver.ResolveReadOnly(publication, Request(publication, now));
+
+        lease.TransportKind.Should().Be(CultMeshBodyTransportKind.SharedFileMapping);
+        lease.ReadSingle(0).Should().Be(12.5f);
+    }
+
+    [Test]
+    public void Resolver_AcceptsLocalOnlyPublicationWithoutInventingNetworkWork()
+    {
+        var now = DateTimeOffset.UtcNow;
+        var bytes = BitConverter.GetBytes(21.25f);
+        var publication = Publication(bytes, now);
+        publication.Representations = new[] { publication.Representations[0] };
+        var fetched = false;
+        var resolver = Resolver(bytes, (_, _) => true, () => fetched = true);
+
+        using var lease = resolver.ResolveReadOnly(publication, Request(publication, now));
+
+        lease.TransportKind.Should().Be(publication.Representations[0].TransportKind);
+        lease.ReadSingle(0).Should().Be(21.25f);
+        fetched.Should().BeFalse();
+    }
+
+    [Test]
+    public void Resolver_FallsBackToEquivalentNetworkRepresentation()
+    {
+        var now = DateTimeOffset.UtcNow;
+        var bytes = new byte[] { 4, 8, 15, 16 };
+        var publication = Publication(bytes, now);
+        new CultMeshMappedBodyPublisher(_root).Revoke(publication.Representations[0]);
+
+        var result = Resolver(bytes, (_, _) => true).NegotiateReadOnly(publication, Request(publication, now));
+        using var lease = result.Lease;
+
+        result.UsedFallback.Should().BeTrue();
+        lease.TransportKind.Should().Be(CultMeshBodyTransportKind.Network);
+    }
+
+    [TestCase("body")]
+    [TestCase("schema")]
+    [TestCase("capacity")]
+    [TestCase("epoch")]
+    [TestCase("sequence")]
+    [TestCase("liveness")]
+    public void Resolver_RejectsDescriptorThatDisagreesWithEnvelope(string field)
+    {
+        var now = DateTimeOffset.UtcNow;
+        var publication = Publication(new byte[4], now);
+        var descriptor = publication.Representations[1];
+        if (field == "body") descriptor.BodyId += ":wrong";
+        if (field == "schema") descriptor.SchemaId += ".wrong";
+        if (field == "capacity") descriptor.Capacity++;
+        if (field == "epoch") descriptor.ProducerEpoch++;
+        if (field == "sequence") descriptor.Sequence++;
+        if (field == "liveness") descriptor.LeaseExpiresAtUnixMs++;
+
+        Action resolve = () => Resolver(new byte[4], (_, _) => true)
+            .ResolveReadOnly(publication, Request(publication, now));
+
+        resolve.Should().Throw<InvalidOperationException>().WithMessage("*envelope*");
+    }
+
+    [Test]
+    public void Resolver_RejectsUnauthorizedProducerBeforeOpeningTransport()
+    {
+        var now = DateTimeOffset.UtcNow;
+        var publication = Publication(new byte[4], now);
+        var fetched = false;
+        var resolver = Resolver(new byte[4], (producer, _) =>
+        {
+            producer.Should().Be("aetheria");
+            return false;
+        }, () => fetched = true);
+
+        Action resolve = () => resolver.ResolveReadOnly(publication, Request(publication, now));
+
+        resolve.Should().Throw<UnauthorizedAccessException>();
+        fetched.Should().BeFalse();
+    }
+
+    [Test]
+    public void Resolver_RejectsExpiredPublicationAndStaleRequestedGeneration()
+    {
+        var now = DateTimeOffset.UtcNow;
+        var publication = Publication(new byte[4], now);
+        var resolver = Resolver(new byte[4], (_, _) => true);
+
+        Action expired = () => resolver.ResolveReadOnly(publication, Request(publication, now.AddMinutes(2)));
+        expired.Should().Throw<InvalidOperationException>().WithMessage("*live*");
+
+        var stale = Request(publication, now);
+        stale.ProducerEpoch--;
+        Action wrongGeneration = () => resolver.ResolveReadOnly(publication, stale);
+        wrongGeneration.Should().Throw<InvalidOperationException>().WithMessage("*epoch*");
+    }
+
+    [Test]
+    public async Task LiveBody_SubscriptionKeepsBytesOffTheSnapshotAndOpensTheBestPlane()
+    {
+        var now = DateTimeOffset.UtcNow;
+        var bytes = new byte[] { 3, 1, 4, 1, 5, 9 };
+        var publication = Publication(bytes, now);
+        var cache = new CultCache();
+        var documents = CultMesh.CreateBodyPublicationDocumentRegistry(cache.Registry);
+        var transport = new BodyPublicationSchemaClient(publication, documents);
+        using var subscriptions = new CultNetDatabaseSubscriptionClient(transport, cache, documents);
+
+        using var body = await CultMesh.SubscribeLiveBodyAsync(
+            subscriptions,
+            Resolver(bytes, (_, _) => true),
+            new CultMeshLiveBodySubscription("pilot-body", "eve-unity", publication.BodyId));
+
+        transport.Subscribe.Should().NotBeNull();
+        transport.Subscribe!.RecordKeys.Should().Equal(
+            CultMeshBodyPublicationDocument.CreateLatestRecordKey(publication.BodyId).Value);
+        transport.Subscribe.SchemaIds.Should().Equal(CultMeshBodyPublicationSchemaVersions.Publication);
+        transport.Subscribe.BodyIds.Should().Equal(publication.BodyId);
+        transport.Subscribe.ConsumerRuntimeId.Should().Be("eve-unity");
+        cache.Get<CultMeshBodyPublicationDocument>(
+            CultMeshBodyPublicationDocument.CreateLatestRecordKey(publication.BodyId)).Should().BeNull(
+            "live descriptor control state must not become a renderer-owned replica");
+
+        using var opened = body.OpenCurrentReadOnly(now).Lease;
+        opened.TransportKind.Should().Be(CultMeshBodyTransportKind.SharedFileMapping);
+        var restored = new byte[bytes.Length];
+        opened.CopyTo(0, restored, 0, restored.Length).Should().Be(bytes.Length);
+        restored.Should().Equal(bytes);
+    }
+
+    [Test]
+    public async Task LiveBody_SubscriptionCanPrecedeTheFirstProviderPublication()
+    {
+        var now = DateTimeOffset.UtcNow;
+        var bytes = new byte[] { 2, 7, 1, 8 };
+        var publication = Publication(bytes, now);
+        var sourceCache = new CultCache();
+        var sourceDocuments = CultMesh.CreateBodyPublicationDocumentRegistry(sourceCache.Registry);
+        var sourceDatabase = new CultNetDatabase(sourceCache, new CultNetDatabaseOptions
+        {
+            DocumentRegistry = sourceDocuments
+        });
+        using var socket = new Socket(AddressFamily.InterNetwork, SocketType.Dgram, ProtocolType.Udp);
+        socket.Bind(new IPEndPoint(IPAddress.Loopback, 0));
+        using var server = new RudpCultNetSchemaServer(new RudpCultNetSchemaServerOptions
+        {
+            RuntimeId = "live-body-before-publication-server",
+            Socket = socket
+        });
+        using var serverSubscriptions = new CultNetDatabaseSubscriptionServer(server, sourceDatabase);
+        using var cancellation = new CancellationTokenSource();
+        var serverThread = new Thread(() =>
+        {
+            while (!cancellation.IsCancellationRequested)
+            {
+                _ = server.PollOnceAsync().GetAwaiter().GetResult();
+                Thread.Sleep(1);
+            }
+        }) { IsBackground = true };
+        serverThread.Start();
+
+        var targetCache = new CultCache();
+        var documents = CultMesh.CreateBodyPublicationDocumentRegistry(targetCache.Registry);
+        var transport = CultNetSchemaClients.CreateRudp("live-body-before-publication-client");
+        using var subscriptions = new CultNetDatabaseSubscriptionClient(transport, targetCache, documents);
+        transport.Connect("127.0.0.1", server.LocalEndPoint.Port);
+        var connectedBy = DateTimeOffset.UtcNow + TimeSpan.FromSeconds(2);
+        while (!transport.Connected && DateTimeOffset.UtcNow < connectedBy)
+            await Task.Delay(5);
+        transport.Connected.Should().BeTrue();
+
+        using var body = await CultMesh.SubscribeLiveBodyAsync(
+            subscriptions,
+            Resolver(bytes, (_, _) => true),
+            new CultMeshLiveBodySubscription("pilot-body", "eve-unity", publication.BodyId));
+
+        body.HasValue.Should().BeFalse(
+            "body demand must remain active while the producer has not published frame zero yet");
+        var changed = new TaskCompletionSource<CultMeshBodyPublicationDocument>(
+            TaskCreationOptions.RunContinuationsAsynchronously);
+        body.Changed += value => changed.TrySetResult(value);
+
+        await sourceDatabase.PutAsync(
+            CultMeshBodyPublicationDocument.CreateLatestRecordKey(publication.BodyId),
+            publication);
+        var completed = await Task.WhenAny(changed.Task, Task.Delay(TimeSpan.FromSeconds(2)));
+
+        cancellation.Cancel();
+        completed.Should().Be(changed.Task);
+        body.HasValue.Should().BeTrue();
+        body.Current.Should().BeEquivalentTo(publication);
+        using var opened = body.OpenCurrentReadOnly(now).Lease;
+        opened.TransportKind.Should().Be(CultMeshBodyTransportKind.SharedFileMapping);
+    }
+
+    private CultMeshBodyPublicationDocument Publication(byte[] bytes, DateTimeOffset now)
+    {
+        var local = new CultMeshMappedBodyPublisher(_root, TimeSpan.FromMinutes(1))
+            .Publish("aetheria:entities", "eve.entity_soa.v1", 2, 128, 7, 42, bytes, now);
+        return new CultMeshBodyPublicationDocument
+        {
+            BodyId = local.BodyId,
+            ProducerId = "aetheria",
+            SchemaId = local.SchemaId,
+            LayoutVersion = local.LayoutVersion,
+            ByteSize = local.ByteSize,
+            Capacity = local.Capacity,
+            ProducerEpoch = local.ProducerEpoch,
+            Sequence = local.Sequence,
+            Synchronization = local.Synchronization,
+            LivenessExpiresAtUnixMs = local.LeaseExpiresAtUnixMs,
+            Representations = new[] { local, Network(local) }
+        };
+    }
+
+    private CultMeshBodyPublicationResolver Resolver(
+        byte[] bytes,
+        Func<string, CultMeshBodyDescriptor, bool> authorize,
+        Action? fetched = null) =>
+        new(new CultMeshBodyTransportService(
+            new ICultMeshBodyTransportAdapter[]
+            {
+                new CultMeshMappedBodyAdapter(_root),
+                new CultMeshNetworkBodyAdapter(_ => { fetched?.Invoke(); return bytes; })
+            },
+            authorize));
+
+    private static CultMeshBodyPublicationHandle Handle(CultMeshBodyPublicationDocument publication) =>
+        new(publication.BodyId, publication.ProducerEpoch, publication.Sequence);
+
+    private static CultMeshBodyValidationRequest Request(
+        CultMeshBodyPublicationDocument publication,
+        DateTimeOffset now) => new()
+    {
+        BodyId = publication.BodyId,
+        SchemaId = publication.SchemaId,
+        LayoutVersion = publication.LayoutVersion,
+        ProducerEpoch = publication.ProducerEpoch,
+        Sequence = publication.Sequence,
+        Capacity = publication.Capacity,
+        AccessMode = CultMeshBodyAccessMode.ReadOnly,
+        NowUtc = now
+    };
+
+    private static CultMeshBodyDescriptor Network(CultMeshBodyDescriptor local) => new()
+    {
+        BodyId = local.BodyId,
+        SchemaId = local.SchemaId,
+        LayoutVersion = local.LayoutVersion,
+        ByteSize = local.ByteSize,
+        Capacity = local.Capacity,
+        ProducerEpoch = local.ProducerEpoch,
+        Sequence = local.Sequence,
+        AccessMode = local.AccessMode,
+        Synchronization = local.Synchronization,
+        LeaseExpiresAtUnixMs = local.LeaseExpiresAtUnixMs,
+        TransportKind = CultMeshBodyTransportKind.Network,
+        CapabilityToken = "cultnet:body:aetheria:entities:7:42",
+        SemanticHash = local.SemanticHash
+    };
+
+    private sealed class BodyPublicationSchemaClient : ICultNetSchemaClient
+    {
+        private readonly CultMeshBodyPublicationDocument _publication;
+        private readonly CultNetDocumentRegistry _documents;
+        private readonly List<Action<CultNetSnapshotResponseRawMessage>> _snapshots = new();
+
+        public BodyPublicationSchemaClient(
+            CultMeshBodyPublicationDocument publication,
+            CultNetDocumentRegistry documents)
+        {
+            _publication = publication;
+            _documents = documents;
+        }
+
+        public bool Connected => true;
+        public CultNetDatabaseSubscribeMessage? Subscribe { get; private set; }
+        public void Connect(string host, int port) { }
+
+        public void SendCultNet<T>(T message) where T : ICultNetSchemaMessage
+        {
+            if (message is not CultNetDatabaseSubscribeMessage subscribe)
+                return;
+            Subscribe = subscribe;
+            var put = _documents.CreateRawDocumentPutMessage(
+                "body-publication",
+                new CultRecordHandle<CultMeshBodyPublicationDocument>(
+                    CultMeshBodyPublicationDocument.CreateLatestRecordKey(_publication.BodyId)),
+                _publication);
+            var response = new CultNetSnapshotResponseRawMessage
+            {
+                MessageId = subscribe.MessageId,
+                Documents = new[] { put.Document }
+            };
+            foreach (var snapshot in _snapshots.ToArray()) snapshot(response);
+        }
+
+        public void OnCultNet<T>(Action<T> callback) where T : ICultNetSchemaMessage
+        {
+            if (typeof(T) == typeof(CultNetSnapshotResponseRawMessage))
+                _snapshots.Add(response => callback((T)(object)response));
+        }
+
+        public void Dispose() { }
+    }
+}
diff --git a/tests/GameCult.Mesh.Tests/CultMeshBodySessionTests.cs b/tests/GameCult.Mesh.Tests/CultMeshBodySessionTests.cs
new file mode 100644
index 00000000..803a055d
--- /dev/null
+++ b/tests/GameCult.Mesh.Tests/CultMeshBodySessionTests.cs
@@ -0,0 +1,227 @@
+using System;
+using System.Collections.Generic;
+using System.Diagnostics;
+using System.Net;
+using System.Net.Sockets;
+using System.Threading;
+using System.Threading.Tasks;
+using FluentAssertions;
+using GameCult.Networking;
+using NUnit.Framework;
+
+namespace GameCult.Mesh.Tests;
+
+[TestFixture]
+public sealed class CultMeshBodySessionTests
+{
+    [Test]
+    public async Task LiveBodySessionTransfersVerifiedGenerationWithoutSnapshotRecords()
+    {
+        var bytes = new byte[384_000];
+        for (var index = 0; index < bytes.Length; index++) bytes[index] = (byte)(index % 251);
+        using var store = new CultMeshNetworkBodyStore();
+        var descriptor = store.Publish(Generation(sequence: 7), bytes);
+        var server = new LoopbackServer();
+        using var bodyServer = new CultMeshBodyServer(server, store);
+        var client = new LoopbackClient(server);
+        var connector = new LoopbackConnector(client);
+        using var discovery = new CultMeshDiscoveryService(new[] { new RouteSource() });
+        using var sessions = new CultMeshSessionManager(discovery, new[] { connector }, CultMeshTestTrust.LocalSessions);
+        var provider = new CultMeshSessionBodyProvider(
+            "aetheria.daemon", sessions, new CultMeshSessionTarget("aetheria", "aetheria.daemon"));
+
+        var received = await provider.FetchAsync(descriptor);
+
+        received.Should().Equal(bytes);
+        client.BodyRequestCount.Should().Be(1);
+        client.SnapshotRequestCount.Should().Be(0,
+            "live body bytes must never enter database snapshot machinery");
+        connector.ConnectCount.Should().Be(1);
+    }
+
+    [Test]
+    public async Task RudpBodySessionTransfersOneHotGenerationWithoutDatabaseRoundTrip()
+    {
+        var bytes = new byte[384_000];
+        for (var index = 0; index < bytes.Length; index++) bytes[index] = (byte)(index % 251);
+        using var store = new CultMeshNetworkBodyStore();
+        var descriptor = store.Publish(Generation(sequence: 11), bytes);
+        using var socket = new Socket(AddressFamily.InterNetwork, SocketType.Dgram, ProtocolType.Udp);
+        socket.Bind(new IPEndPoint(IPAddress.Loopback, 0));
+        using var server = new RudpCultNetSchemaServer(new RudpCultNetSchemaServerOptions
+        {
+            RuntimeId = "cultmesh-body-rudp-test", Socket = socket, MaxFragmentBytes = 1024,
+            MaxPendingReliablePackets = 8192
+        });
+        var endpoint = $"rudp://127.0.0.1:{server.LocalEndPoint.Port}";
+        using var identityServer = new CultMeshSessionIdentityServer(
+            server,
+            "aetheria.daemon",
+            new[] { "aetheria" },
+            new[] { CultMeshProtocols.Bodies.Value },
+            new[] { "aetheria.daemon@" + endpoint });
+        using var bodyServer = new CultMeshBodyServer(server, store);
+        using var pumpCancellation = new CancellationTokenSource();
+        var pump = Task.Run(async () =>
+        {
+            while (!pumpCancellation.IsCancellationRequested)
+            {
+                var progress = await server.PollAvailableAsync(256);
+                server.PollResends();
+                if (progress.TransportItemsConsumed == 0) await Task.Delay(1, pumpCancellation.Token);
+            }
+        });
+        using var discovery = new CultMeshDiscoveryService(new[] { new RouteSource(endpoint) });
+        using var sessions = new CultMeshSessionManager(discovery,
+            new ICultMeshTransportConnector[] { new CultMeshSchemaTransportConnector() }, CultMeshTestTrust.LocalSessions);
+        var provider = new CultMeshSessionBodyProvider("aetheria.daemon", sessions,
+            new CultMeshSessionTarget("aetheria", "aetheria.daemon"),
+            new CultMeshSessionBodyProviderOptions { ResponseTimeout = TimeSpan.FromSeconds(10) });
+
+        var elapsed = Stopwatch.StartNew();
+        byte[] received;
+        try { received = await provider.FetchAsync(descriptor); }
+        finally
+        {
+            pumpCancellation.Cancel();
+            try { await pump; } catch (OperationCanceledException) { }
+        }
+        elapsed.Stop();
+
+        received.Should().Equal(bytes);
+        elapsed.Elapsed.Should().BeLessThan(TimeSpan.FromSeconds(5));
+    }
+
+    [Test]
+    public void NetworkBodyStoreRejectsGenerationMetadataThatDoesNotMatchCapability()
+    {
+        using var store = new CultMeshNetworkBodyStore();
+        var descriptor = store.Publish(Generation(sequence: 3), new byte[] { 1, 2, 3 });
+        var request = Request(descriptor);
+        request.Sequence++;
+
+        store.TryRead(request, DateTimeOffset.UtcNow, out _, out _).Should().BeFalse();
+    }
+
+    [Test]
+    public void BodyWireMessagesRoundTripThroughSchemaDispatcher()
+    {
+        using var store = new CultMeshNetworkBodyStore();
+        var descriptor = store.Publish(Generation(sequence: 9), new byte[] { 1, 2, 3 });
+        var request = Request(descriptor);
+        var response = new CultMeshBodyReadResponseMessage
+        {
+            MessageId = request.MessageId, Found = true, CapabilityToken = descriptor.CapabilityToken,
+            BodyId = descriptor.BodyId, ProducerEpoch = descriptor.ProducerEpoch,
+            Sequence = descriptor.Sequence, SizeBytes = 3, SemanticHash = descriptor.SemanticHash,
+            Payload = new byte[] { 1, 2, 3 }
+        };
+
+        CultNetSchemaMessageSerialization.Deserialize(CultNetSchemaMessageSerialization.Serialize(request))
+            .Should().BeEquivalentTo(request);
+        CultNetSchemaMessageSerialization.Deserialize(CultNetSchemaMessageSerialization.Serialize(response))
+            .Should().BeEquivalentTo(response);
+    }
+
+    private static CultMeshBodyGeneration Generation(long sequence) => new()
+    {
+        BodyId = "eve:entity-soa:aetheria.daemon:pilot", ProducerId = "aetheria.daemon",
+        SchemaId = "gamecult.eve.entity_soa.body.v2", LayoutVersion = 3, Capacity = 4096,
+        ProducerEpoch = 2, Sequence = sequence, Synchronization = CultMeshBodySynchronization.TripleBuffer,
+        LeaseExpiresAtUnixMs = DateTimeOffset.UtcNow.AddMinutes(1).ToUnixTimeMilliseconds()
+    };
+
+    private static CultMeshBodyReadRequestMessage Request(CultMeshBodyDescriptor descriptor) => new()
+    {
+        MessageId = Guid.NewGuid().ToString("N"), CapabilityToken = descriptor.CapabilityToken,
+        BodyId = descriptor.BodyId, BodySchemaId = descriptor.SchemaId, LayoutVersion = descriptor.LayoutVersion,
+        ProducerEpoch = descriptor.ProducerEpoch, Sequence = descriptor.Sequence,
+        ExpectedSizeBytes = descriptor.ByteSize, SemanticHash = descriptor.SemanticHash
+    };
+
+    private sealed class RouteSource : ICultMeshLookupSource
+    {
+        private readonly string _endpoint;
+        public RouteSource(string endpoint = "rudp://127.0.0.13:3076") => _endpoint = endpoint;
+        public string SourceId => "test";
+        public Task<IReadOnlyList<CultMeshDiscoveryObservation>> LookupAsync(CultMeshDiscoveryQuery query,
+            CancellationToken cancellationToken = default)
+        {
+            var now = DateTimeOffset.UtcNow;
+            return Task.FromResult<IReadOnlyList<CultMeshDiscoveryObservation>>(new[]
+            {
+                new CultMeshDiscoveryObservation(new CultMeshVerseDescriptor("aetheria", "Aetheria",
+                    CultMeshVerseAuthorityModel.OperatorCluster, new CultMeshVerseCompatibility("cultmesh.v1", "rules"),
+                    new[] { _endpoint }, new[] { "aetheria.daemon" }), SourceId, now, now.AddMinutes(1), CultMeshDiscoveryTrust.Signed)
+            });
+        }
+    }
+
+    private sealed class LoopbackConnector : ICultMeshTransportConnector
+    {
+        private readonly ICultNetSchemaClient _client;
+        public LoopbackConnector(ICultNetSchemaClient client) => _client = client;
+        public string ConnectorId => "loopback";
+        public int Priority => 0;
+        public int ConnectCount { get; private set; }
+        public bool CanConnect(CultMeshTransportCandidate candidate) => true;
+        public Task<ICultNetSchemaClient> ConnectAsync(CultMeshTransportCandidate candidate, CultMeshProtocolId protocol,
+            CancellationToken cancellationToken = default)
+        {
+            protocol.Should().Be(CultMeshProtocols.Bodies);
+            ConnectCount++;
+            return Task.FromResult(_client);
+        }
+    }
+
+    private sealed class LoopbackServer : ICultNetSchemaServer
+    {
+        private readonly Dictionary<Type, Delegate> _handlers = new();
+        public void OnCultNet<T>(Func<T, ICultNetSchemaServerPeer, Task> callback) where T : ICultNetSchemaMessage =>
+            _handlers[typeof(T)] = callback;
+        public void RemoveCultNetMessageListener<T>(Delegate callback) where T : ICultNetSchemaMessage =>
+            _handlers.Remove(typeof(T));
+        public Task Dispatch<T>(T message, ICultNetSchemaServerPeer peer) where T : ICultNetSchemaMessage =>
+            ((Func<T, ICultNetSchemaServerPeer, Task>)_handlers[typeof(T)])(message, peer);
+    }
+
+    private sealed class LoopbackClient : ICultNetSchemaClient, ICultMeshVerifiedSchemaClient
+    {
+        private readonly LoopbackServer _server;
+        private readonly Dictionary<Type, List<Delegate>> _handlers = new();
+        public LoopbackClient(LoopbackServer server) => _server = server;
+        public bool Connected => true;
+        public int BodyRequestCount { get; private set; }
+        public int SnapshotRequestCount { get; private set; }
+        public void Connect(string host, int port) { }
+        public void SendCultNet<T>(T message) where T : ICultNetSchemaMessage
+        {
+            if (message is CultMeshBodyReadRequestMessage body)
+            {
+                BodyRequestCount++;
+                _server.Dispatch(body, new LoopbackPeer(this)).GetAwaiter().GetResult();
+            }
+            else if (message is CultNetSnapshotRequestMessage) SnapshotRequestCount++;
+        }
+        public void OnCultNet<T>(Action<T> callback) where T : ICultNetSchemaMessage
+        {
+            if (!_handlers.TryGetValue(typeof(T), out var values)) _handlers[typeof(T)] = values = new List<Delegate>();
+            values.Add(callback);
+        }
+        public void Emit<T>(T message) where T : ICultNetSchemaMessage
+        {
+            if (_handlers.TryGetValue(typeof(T), out var values))
+                foreach (var value in values.ToArray()) ((Action<T>)value)(message);
+        }
+        public void Dispose() { }
+        public bool IsVerifiedFor(string verseId, string authorityRuntimeId, string protocolId, string routeGeneration) =>
+            verseId == "aetheria" && authorityRuntimeId == "aetheria.daemon";
+    }
+
+    private sealed class LoopbackPeer : ICultNetSchemaServerPeer
+    {
+        private readonly LoopbackClient _client;
+        public LoopbackPeer(LoopbackClient client) => _client = client;
+        public void SendCultNet<T>(T message) where T : ICultNetSchemaMessage => _client.Emit(message);
+    }
+}
diff --git a/tests/GameCult.Mesh.Tests/CultMeshBodyTransportTests.cs b/tests/GameCult.Mesh.Tests/CultMeshBodyTransportTests.cs
new file mode 100644
index 00000000..131bcf24
--- /dev/null
+++ b/tests/GameCult.Mesh.Tests/CultMeshBodyTransportTests.cs
@@ -0,0 +1,544 @@
+using System;
+using System.IO;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using FluentAssertions;
+using NUnit.Framework;
+using System.IO.MemoryMappedFiles;
+using GameCult.Networking;
+
+namespace GameCult.Mesh.Tests;
+
+public sealed class CultMeshBodyTransportTests
+{
+    private string _root = null!;
+
+    [SetUp]
+    public void SetUp()
+    {
+        _root = Path.Combine(Path.GetTempPath(), "cultmesh-body-tests", Guid.NewGuid().ToString("N"));
+    }
+
+    [TearDown]
+    public void TearDown()
+    {
+        if (Directory.Exists(_root)) Directory.Delete(_root, recursive: true);
+    }
+
+    [Test]
+    public void MappedBody_IsReadOnlyAndPreservesLogicalIdentityAcrossTransportMaterial()
+    {
+        var publisher = new CultMeshMappedBodyPublisher(_root, TimeSpan.FromMinutes(1));
+        var now = DateTimeOffset.UtcNow;
+        var firstBytes = BitConverter.GetBytes(12.5f);
+        var secondBytes = BitConverter.GetBytes(13.5f);
+
+        var first = publisher.Publish("aetheria:pilot-entities", "eve.entity_soa.v1", 1, 128, 7, 40, firstBytes, now);
+        var second = publisher.Publish("aetheria:pilot-entities", "eve.entity_soa.v1", 1, 128, 7, 41, secondBytes, now);
+
+        first.BodyId.Should().Be(second.BodyId);
+        first.CapabilityToken.Should().NotBe(second.CapabilityToken);
+        first.AccessMode.Should().Be(CultMeshBodyAccessMode.ReadOnly);
+        using var lease = new CultMeshMappedBodyAdapter(_root).OpenReadOnly(first, Request(first, now));
+        lease.ReadSingle(0).Should().Be(12.5f);
+        lease.Descriptor.Sequence.Should().Be(40);
+    }
+
+    [Test]
+    public void Validation_RejectsExpiredEpochLayoutAndWritableConsumption()
+    {
+        var publisher = new CultMeshMappedBodyPublisher(_root, TimeSpan.FromSeconds(1));
+        var now = DateTimeOffset.UtcNow;
+        var descriptor = publisher.Publish("body", "schema", 2, 4, 9, 1, new byte[4], now);
+        var adapter = new CultMeshMappedBodyAdapter(_root);
+
+        Action expired = () => adapter.OpenReadOnly(descriptor, Request(descriptor, now.AddSeconds(2)));
+        expired.Should().Throw<InvalidOperationException>().WithMessage("*expired*");
+
+        var wrongEpoch = Request(descriptor, now);
+        wrongEpoch.ProducerEpoch++;
+        Action epoch = () => adapter.OpenReadOnly(descriptor, wrongEpoch);
+        epoch.Should().Throw<InvalidOperationException>().WithMessage("*epoch*");
+
+        var writable = Request(descriptor, now);
+        writable.AccessMode = CultMeshBodyAccessMode.ReadWrite;
+        Action write = () => adapter.OpenReadOnly(descriptor, writable);
+        write.Should().Throw<UnauthorizedAccessException>();
+    }
+
+    [Test]
+    public void CapabilityToken_CannotEscapeBrokerRoot()
+    {
+        var descriptor = new CultMeshBodyDescriptor
+        {
+            BodyId = "body",
+            SchemaId = "schema",
+            LayoutVersion = 1,
+            ByteSize = 4,
+            Capacity = 4,
+            ProducerEpoch = 1,
+            Sequence = 1,
+            LeaseExpiresAtUnixMs = DateTimeOffset.UtcNow.AddMinutes(1).ToUnixTimeMilliseconds(),
+            TransportKind = CultMeshBodyTransportKind.SharedFileMapping,
+            CapabilityToken = ".." + Path.DirectorySeparatorChar + "outside"
+        };
+        Action open = () => new CultMeshMappedBodyAdapter(_root).OpenReadOnly(
+            descriptor,
+            Request(descriptor, DateTimeOffset.UtcNow));
+        open.Should().Throw<UnauthorizedAccessException>();
+    }
+
+    [Test]
+    public void Negotiation_FallsBackToEquivalentNetworkBody_WhenLocalMappingFails()
+    {
+        var now = DateTimeOffset.UtcNow;
+        var bytes = BitConverter.GetBytes(42.25f);
+        var publisher = new CultMeshMappedBodyPublisher(_root, TimeSpan.FromMinutes(1));
+        var local = publisher.Publish("body", "schema", 1, bytes.Length, 3, 8, bytes, now);
+        publisher.Revoke(local);
+        var network = new CultMeshBodyDescriptor
+        {
+            BodyId = local.BodyId,
+            SchemaId = local.SchemaId,
+            LayoutVersion = local.LayoutVersion,
+            ByteSize = local.ByteSize,
+            Capacity = local.Capacity,
+            ProducerEpoch = local.ProducerEpoch,
+            Sequence = local.Sequence,
+            AccessMode = CultMeshBodyAccessMode.ReadOnly,
+            Synchronization = local.Synchronization,
+            LeaseExpiresAtUnixMs = local.LeaseExpiresAtUnixMs,
+            TransportKind = CultMeshBodyTransportKind.Network,
+            SemanticHash = local.SemanticHash
+        };
+        var service = new CultMeshBodyTransportService(
+            new ICultMeshBodyTransportAdapter[]
+            {
+                new CultMeshMappedBodyAdapter(_root),
+                new CultMeshNetworkBodyAdapter(_ => bytes)
+            },
+            _ => true);
+
+        var result = service.NegotiateReadOnly(local, network, Request(local, now));
+        using var lease = result.Lease;
+
+        result.PreferredFailure.Should().BeOfType<InvalidDataException>();
+        result.UsedFallback.Should().BeTrue();
+        result.PreferredTransport.Should().Be(CultMeshBodyTransportKind.SharedFileMapping);
+        result.SelectedTransport.Should().Be(CultMeshBodyTransportKind.Network);
+        lease.TransportKind.Should().Be(CultMeshBodyTransportKind.Network);
+        lease.Descriptor.BodyId.Should().Be(local.BodyId);
+        lease.ReadSingle(0).Should().Be(42.25f);
+    }
+
+    [Test]
+    public void LocalAndNetworkRepresentationsExposeTheSameLogicalContractAndSemanticBytes()
+    {
+        var now = DateTimeOffset.UtcNow;
+        var bytes = new byte[] { 1, 3, 5, 7, 9, 11 };
+        var local = new CultMeshMappedBodyPublisher(_root, TimeSpan.FromMinutes(1))
+            .Publish("body", "schema.v2", 2, 64, 5, 12, bytes, now);
+        var network = NetworkRepresentation(local);
+        var request = Request(local, now);
+
+        using var localLease = new CultMeshMappedBodyAdapter(_root).OpenReadOnly(local, request);
+        using var networkLease = new CultMeshNetworkBodyAdapter(_ => bytes).OpenReadOnly(network, request);
+
+        networkLease.Descriptor.Should().BeEquivalentTo(localLease.Descriptor, options => options
+            .Excluding(value => value.TransportKind)
+            .Excluding(value => value.CapabilityToken));
+        ReadAll(localLease).Should().Equal(bytes);
+        ReadAll(networkLease).Should().Equal(bytes);
+    }
+
+    [Test]
+    public void MissingPreferredAdapterProducesObservableFallbackReason()
+    {
+        var now = DateTimeOffset.UtcNow;
+        var bytes = new byte[] { 4, 8, 15, 16, 23, 42 };
+        var local = new CultMeshMappedBodyPublisher(_root, TimeSpan.FromMinutes(1))
+            .Publish("body", "schema", 1, bytes.Length, 3, 8, bytes, now);
+        var network = NetworkRepresentation(local);
+        var service = new CultMeshBodyTransportService(
+            new ICultMeshBodyTransportAdapter[] { new CultMeshNetworkBodyAdapter(_ => bytes) },
+            _ => true);
+
+        var result = service.NegotiateReadOnly(local, network, Request(local, now));
+        using var lease = result.Lease;
+
+        result.UsedFallback.Should().BeTrue();
+        result.PreferredFailure.Should().BeOfType<NotSupportedException>();
+        result.PreferredFailure!.Message.Should().Contain("adapter is available");
+        lease.TransportKind.Should().Be(CultMeshBodyTransportKind.Network);
+    }
+
+    [TestCase("schema")]
+    [TestCase("epoch")]
+    [TestCase("sequence")]
+    public void NegotiationRejectsStaleLogicalGenerationBeforeFetchingNetworkBytes(string staleField)
+    {
+        var now = DateTimeOffset.UtcNow;
+        var bytes = new byte[] { 2, 4, 6, 8 };
+        var local = new CultMeshMappedBodyPublisher(_root, TimeSpan.FromMinutes(1))
+            .Publish("body", "schema", 1, 4, 3, 8, bytes, now);
+        var network = NetworkRepresentation(local);
+        var request = Request(local, now);
+        if (staleField == "schema") request.SchemaId = "stale";
+        if (staleField == "epoch") request.ProducerEpoch--;
+        if (staleField == "sequence") request.Sequence--;
+        var fetched = false;
+        var service = new CultMeshBodyTransportService(
+            new ICultMeshBodyTransportAdapter[]
+            {
+                new CultMeshMappedBodyAdapter(_root),
+                new CultMeshNetworkBodyAdapter(_ => { fetched = true; return bytes; })
+            },
+            _ => true);
+
+        Action open = () => service.NegotiateReadOnly(local, network, request);
+
+        open.Should().Throw<InvalidOperationException>();
+        fetched.Should().BeFalse();
+    }
+
+    [Test]
+    public void NetworkRepresentationRejectsCorruptBytesBeforeCreatingAReadableLease()
+    {
+        var now = DateTimeOffset.UtcNow;
+        var bytes = new byte[] { 10, 20, 30, 40 };
+        var local = new CultMeshMappedBodyPublisher(_root, TimeSpan.FromMinutes(1))
+            .Publish("body", "schema", 1, 4, 3, 8, bytes, now);
+        var network = NetworkRepresentation(local);
+        var corrupt = new byte[] { 10, 20, 30, 41 };
+
+        Action open = () => new CultMeshNetworkBodyAdapter(_ => corrupt)
+            .OpenReadOnly(network, Request(network, now));
+
+        open.Should().Throw<InvalidDataException>().WithMessage("*semantic digest*");
+    }
+
+    [Test]
+    public void Negotiation_RejectsUnauthorizedProducerBeforeOpeningAnyRepresentation()
+    {
+        var now = DateTimeOffset.UtcNow;
+        var bytes = new byte[4];
+        var local = new CultMeshMappedBodyPublisher(_root, TimeSpan.FromMinutes(1))
+            .Publish("body", "schema", 1, 4, 3, 8, bytes, now);
+        var network = new CultMeshBodyDescriptor
+        {
+            BodyId = local.BodyId, SchemaId = local.SchemaId, LayoutVersion = 1,
+            ByteSize = 4, Capacity = 4, ProducerEpoch = 3, Sequence = 8,
+            LeaseExpiresAtUnixMs = local.LeaseExpiresAtUnixMs,
+            TransportKind = CultMeshBodyTransportKind.Network,
+            SemanticHash = local.SemanticHash
+        };
+        var service = new CultMeshBodyTransportService(
+            new ICultMeshBodyTransportAdapter[]
+            {
+                new CultMeshMappedBodyAdapter(_root),
+                new CultMeshNetworkBodyAdapter(_ => bytes)
+            },
+            _ => false);
+        Action open = () => service.OpenReadOnly(local, network, Request(local, now), out _);
+        open.Should().Throw<UnauthorizedAccessException>();
+    }
+
+    [Test]
+    [Platform("Win")]
+    public void SharedMemoryAdapter_OpensOpaqueCapabilityReadOnly()
+    {
+        var token = "CultMesh.Body.Test." + Guid.NewGuid().ToString("N");
+        using var mapping = MemoryMappedFile.CreateNew(token, 8, MemoryMappedFileAccess.ReadWrite);
+        using (var writer = mapping.CreateViewAccessor(0, 8, MemoryMappedFileAccess.Write)) writer.Write(0, 99L);
+        var now = DateTimeOffset.UtcNow;
+        var descriptor = new CultMeshBodyDescriptor
+        {
+            BodyId = "body", SchemaId = "schema", LayoutVersion = 1,
+            ByteSize = 8, Capacity = 8, ProducerEpoch = 4, Sequence = 2,
+            LeaseExpiresAtUnixMs = now.AddMinutes(1).ToUnixTimeMilliseconds(),
+            TransportKind = CultMeshBodyTransportKind.SharedMemory,
+            CapabilityToken = token
+        };
+
+        using var lease = new CultMeshSharedMemoryBodyAdapter().OpenReadOnly(descriptor, Request(descriptor, now));
+
+        lease.ReadInt64(0).Should().Be(99);
+        lease.TransportKind.Should().Be(CultMeshBodyTransportKind.SharedMemory);
+    }
+
+    [Test]
+    public void FramePublisher_DirectWriteLeaseCommitsMappedBytesWithoutCompatibilityCopy()
+    {
+        using var publisher = new CultMeshFrameBodyPublisher(
+            "aetheria:entities",
+            "gamecult.eve.entity_soa.body.v2",
+            layoutVersion: 2,
+            capacity: 128,
+            producerEpoch: 7,
+            slotByteLength: 64,
+            leaseDuration: TimeSpan.FromMinutes(1));
+        publisher.TryAcquireWrite(out var write).Should().BeTrue();
+        using (write)
+        {
+            BitConverter.TryWriteBytes(write.Span, 42.5f).Should().BeTrue();
+            var descriptor = write.Commit(sizeof(float), DateTimeOffset.UtcNow);
+            using var read = new CultMeshSharedMemoryBodyAdapter().OpenReadOnly(
+                descriptor,
+                Request(descriptor, DateTimeOffset.UtcNow));
+
+            descriptor.Sequence.Should().Be(0);
+            descriptor.SemanticHash.Should().NotBeNullOrWhiteSpace();
+            read.ReadSingle(0).Should().Be(42.5f);
+        }
+    }
+
+    [Test]
+    public void FramePublisher_AbandonedWriteDoesNotAdvanceGenerationOrHoldSlot()
+    {
+        using var publisher = new CultMeshFrameBodyPublisher(
+            "aetheria:entities",
+            "gamecult.eve.entity_soa.body.v2",
+            layoutVersion: 2,
+            capacity: 128,
+            producerEpoch: 7,
+            slotByteLength: 64);
+        publisher.TryAcquireWrite(out var abandoned).Should().BeTrue();
+        abandoned.Dispose();
+
+        publisher.TryAcquireWrite(out var replacement).Should().BeTrue();
+        using (replacement)
+        {
+            replacement.Span[0] = 23;
+            var descriptor = replacement.Commit(1, DateTimeOffset.UtcNow);
+            descriptor.Sequence.Should().Be(0);
+        }
+    }
+
+    [Test]
+    public void BodyDemand_SelectsSharedMemoryLocallyAndNetworkRemotelyWithoutDuplicateFallbackWork()
+    {
+        using var tracker = new CultMeshBodyDemandTracker();
+        tracker.Plan("eve:entity-soa:aetheria.daemon:pilot").Generation.Should().Be(0);
+        tracker.Observe(Demand("unity-local", "local", sameMachine: true));
+        tracker.Plan("eve:entity-soa:aetheria.daemon:pilot").Generation.Should().Be(1);
+        tracker.Observe(Demand("unity-remote", "remote", sameMachine: false));
+
+        var mixed = tracker.Plan("eve:entity-soa:aetheria.daemon:pilot");
+
+        mixed.HasConsumers.Should().BeTrue();
+        mixed.RequiresSharedMemory.Should().BeTrue();
+        mixed.RequiresNetwork.Should().BeTrue();
+        mixed.Consumers.Should().ContainSingle(value =>
+            value.ConsumerRuntimeId == "unity-local" &&
+            value.Transport == CultMeshBodyTransportKind.SharedMemory);
+        mixed.Consumers.Should().ContainSingle(value =>
+            value.ConsumerRuntimeId == "unity-remote" &&
+            value.Transport == CultMeshBodyTransportKind.Network);
+
+        tracker.Observe(Demand("unity-remote", "remote", sameMachine: false, active: false));
+        var localOnly = tracker.Plan("eve:entity-soa:aetheria.daemon:pilot");
+        localOnly.Generation.Should().Be(3);
+        localOnly.RequiresSharedMemory.Should().BeTrue();
+        localOnly.RequiresNetwork.Should().BeFalse();
+
+        tracker.Observe(Demand("unity-local", "local", sameMachine: true, active: false));
+        tracker.Plan("eve:entity-soa:aetheria.daemon:pilot").Generation.Should().Be(4);
+        tracker.Observe(Demand("unity-local", "local", sameMachine: true));
+        tracker.Plan("eve:entity-soa:aetheria.daemon:pilot").Generation.Should().Be(5);
+    }
+
+    [Test]
+    public async Task BodyDemand_GenerationGuardLinearizesCommitAgainstWithdrawal()
+    {
+        const string bodyId = "eve:entity-soa:aetheria.daemon:pilot";
+        using var tracker = new CultMeshBodyDemandTracker();
+        tracker.Observe(Demand("unity-local", "local", sameMachine: true));
+        var activeGeneration = tracker.Plan(bodyId).Generation;
+        using var commitEntered = new ManualResetEventSlim();
+        using var releaseCommit = new ManualResetEventSlim();
+        var committed = false;
+
+        var commit = Task.Run(() => tracker.TryExecuteAtGeneration(
+            bodyId,
+            activeGeneration,
+            () =>
+            {
+                commitEntered.Set();
+                releaseCommit.Wait();
+                committed = true;
+            }));
+        commitEntered.Wait(TimeSpan.FromSeconds(5)).Should().BeTrue();
+
+        var withdrawal = Task.Run(() =>
+            tracker.Observe(Demand("unity-local", "local", sameMachine: true, active: false)));
+        await Task.Delay(50);
+        withdrawal.IsCompleted.Should().BeFalse(
+            "a withdrawal must serialize after an already-linearized synchronous commit");
+
+        releaseCommit.Set();
+        (await commit).Should().BeTrue();
+        await withdrawal;
+        committed.Should().BeTrue();
+        tracker.Plan(bodyId).Generation.Should().BeGreaterThan(activeGeneration);
+
+        var staleCallbackRan = false;
+        tracker.TryExecuteAtGeneration(bodyId, activeGeneration, () => staleCallbackRan = true)
+            .Should().BeFalse();
+        staleCallbackRan.Should().BeFalse(
+            "work prepared for a withdrawn demand generation must be discarded before commit");
+    }
+
+    [Test]
+    public void BodyDemand_UnknownLocalityFailsTowardNetworkAndUnsupportedDemandCreatesNoRoute()
+    {
+        using var tracker = new CultMeshBodyDemandTracker();
+        tracker.Observe(Demand("unknown", "network", sameMachine: false));
+        tracker.Observe(new CultNetDatabaseSubscriptionDemand(
+            "unsupported",
+            "unsupported",
+            new[] { "eve:entity-soa:aetheria.daemon:pilot" },
+            new[] { CultMeshBodyTransportKind.SharedMemory.ToString() },
+            sameMachine: false,
+            active: true));
+
+        var plan = tracker.Plan("eve:entity-soa:aetheria.daemon:pilot");
+
+        plan.RequiresSharedMemory.Should().BeFalse();
+        plan.RequiresNetwork.Should().BeTrue();
+        plan.Consumers.Should().ContainSingle().Which.ConsumerRuntimeId.Should().Be("unknown");
+    }
+
+    [Test]
+    public void BodyDemand_UsesSharedFileMappingAsTheSameMachineFallback()
+    {
+        using var tracker = new CultMeshBodyDemandTracker();
+        tracker.Observe(new CultNetDatabaseSubscriptionDemand(
+            "unity-local",
+            "mapped-local",
+            new[] { "eve:entity-soa:aetheria.daemon:pilot" },
+            new[]
+            {
+                CultMeshBodyTransportKind.SharedFileMapping.ToString(),
+                CultMeshBodyTransportKind.Network.ToString()
+            },
+            sameMachine: true,
+            active: true));
+
+        var plan = tracker.Plan("eve:entity-soa:aetheria.daemon:pilot");
+
+        plan.RequiresSharedMemory.Should().BeFalse();
+        plan.RequiresSharedFileMapping.Should().BeTrue();
+        plan.RequiresNetwork.Should().BeFalse();
+        plan.Consumers.Should().ContainSingle().Which.Transport
+            .Should().Be(CultMeshBodyTransportKind.SharedFileMapping);
+    }
+
+    [Test]
+    public void LiveBodySubscriptionNamesOnlyTheReactiveDescriptorAndLogicalBodyDemand()
+    {
+        var subscription = new CultMeshLiveBodySubscription(
+            "pilot-entities",
+            "eve-unity",
+            "eve:body:pilot");
+
+        subscription.SubscriptionId.Should().Be("pilot-entities");
+        subscription.ConsumerRuntimeId.Should().Be("eve-unity");
+        subscription.BodyId.Should().Be("eve:body:pilot");
+        subscription.PublicationRecordKey.Should().Be(
+            CultMeshBodyPublicationDocument.CreateLatestRecordKey("eve:body:pilot").Value);
+        typeof(CultMesh).GetMethod(nameof(CultMesh.SubscribeLiveBodyAsync))!
+            .ReturnType.Should().Be(typeof(Task<CultMeshLiveBody>));
+    }
+
+    [Test]
+    public void HotBodySubscriptionKeepsViewPublicationAndDemandInOneExactContract()
+    {
+        var subscription = new CultMeshHotBodySubscription(
+            "pilot-world",
+            "eve-unity",
+            "eve:view:pilot",
+            "gamecult.eve.entity_soa_view.v2",
+            "eve:body:pilot",
+            new[] { "eve:field:gravity" },
+            new[] { "gamecult.eve.fields_splats.v1" });
+
+        subscription.RecordKeys.Should().Equal(
+            "eve:view:pilot",
+            CultMeshBodyPublicationDocument.CreateLatestRecordKey("eve:body:pilot").Value,
+            "eve:field:gravity");
+        subscription.SchemaIds.Should().Equal(
+            "gamecult.eve.entity_soa_view.v2",
+            CultMeshBodyPublicationSchemaVersions.Publication,
+            "gamecult.eve.fields_splats.v1");
+        subscription.BodyId.Should().Be("eve:body:pilot");
+        subscription.ConsumerRuntimeId.Should().Be("eve-unity");
+    }
+
+    [Test]
+    public void HotBodySubscriptionsDefaultToEphemeralLiveDelivery()
+    {
+        var overloads = typeof(CultMesh).GetMethods()
+            .Where(method => method.Name == nameof(CultMesh.SubscribeHotBodyAsync))
+            .ToArray();
+
+        overloads.Should().HaveCount(2);
+        foreach (var overload in overloads)
+        {
+            var deliveryMode = overload.GetParameters().Single(parameter =>
+                parameter.ParameterType == typeof(CultNetDatabaseSubscriptionDeliveryMode));
+            deliveryMode.DefaultValue.Should().Be(CultNetDatabaseSubscriptionDeliveryMode.Live);
+        }
+    }
+
+    private static CultMeshBodyValidationRequest Request(CultMeshBodyDescriptor descriptor, DateTimeOffset now) => new()
+    {
+        BodyId = descriptor.BodyId,
+        SchemaId = descriptor.SchemaId,
+        LayoutVersion = descriptor.LayoutVersion,
+        ProducerEpoch = descriptor.ProducerEpoch,
+        Sequence = descriptor.Sequence,
+        Capacity = descriptor.Capacity,
+        AccessMode = CultMeshBodyAccessMode.ReadOnly,
+        NowUtc = now
+    };
+
+    private static CultNetDatabaseSubscriptionDemand Demand(
+        string runtimeId,
+        string subscriptionId,
+        bool sameMachine,
+        bool active = true) => new(
+        runtimeId,
+        subscriptionId,
+        new[] { "eve:entity-soa:aetheria.daemon:pilot" },
+        new[]
+        {
+            CultMeshBodyTransportKind.SharedMemory.ToString(),
+            CultMeshBodyTransportKind.Network.ToString()
+        },
+        sameMachine,
+        active);
+
+    private static CultMeshBodyDescriptor NetworkRepresentation(CultMeshBodyDescriptor descriptor) => new()
+    {
+        BodyId = descriptor.BodyId,
+        SchemaId = descriptor.SchemaId,
+        LayoutVersion = descriptor.LayoutVersion,
+        ByteSize = descriptor.ByteSize,
+        Capacity = descriptor.Capacity,
+        ProducerEpoch = descriptor.ProducerEpoch,
+        Sequence = descriptor.Sequence,
+        AccessMode = descriptor.AccessMode,
+        Synchronization = descriptor.Synchronization,
+        LeaseExpiresAtUnixMs = descriptor.LeaseExpiresAtUnixMs,
+        TransportKind = CultMeshBodyTransportKind.Network,
+        SemanticHash = descriptor.SemanticHash
+    };
+
+    private static byte[] ReadAll(ICultMeshBodyReadLease lease)
+    {
+        var bytes = new byte[lease.Descriptor.ByteSize];
+        lease.CopyTo(0, bytes, 0, bytes.Length);
+        return bytes;
+    }
+}
diff --git a/tests/GameCult.Mesh.Tests/CultMeshCdnTests.cs b/tests/GameCult.Mesh.Tests/CultMeshCdnTests.cs
new file mode 100644
index 00000000..9a28a164
--- /dev/null
+++ b/tests/GameCult.Mesh.Tests/CultMeshCdnTests.cs
@@ -0,0 +1,123 @@
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Text;
+using System.Threading.Tasks;
+using FluentAssertions;
+using GameCult.Caching;
+using GameCult.Networking;
+using NUnit.Framework;
+
+namespace GameCult.Mesh.Tests;
+
+public sealed class CultMeshCdnTests
+{
+    [Test]
+    public async Task Artifact_PacksPublishesAndReassembles_FromCultCache()
+    {
+        var cache = new CultCache();
+        var payload = Encoding.UTF8.GetBytes("abcdefghijklmnopqrstuvwxyz");
+        var artifact = CultMesh.PackCdnArtifact(
+            "aetheria/ui/icons/minimap-pack",
+            payload,
+            new CultMeshCdnPackOptions
+            {
+                ChunkSizeBytes = 8,
+                Version = "2026.06.27",
+                MimeType = "application/octet-stream",
+                Tags = ["aetheria", "ui"],
+                Metadata = new Dictionary<string, string>
+                {
+                    ["channel"] = "dev"
+                }
+            });
+
+        artifact.Manifest.Kind.Should().Be(CultMeshCdnArtifactKinds.Asset);
+        artifact.Manifest.SizeBytes.Should().Be(payload.Length);
+        artifact.Manifest.Chunks.Should().HaveCount(4);
+        artifact.Manifest.Chunks.Select(chunk => chunk.Offset).Should().Equal(0, 8, 16, 24);
+        artifact.Manifest.Chunks.Select(chunk => chunk.SizeBytes).Should().Equal(8, 8, 8, 2);
+
+        var manifest = await CultMesh.PublishCdnArtifactAsync(cache, artifact);
+        var manifestKey = CultMeshCdnArtifactManifest.CreateRecordKey(manifest);
+        cache.Get<CultMeshCdnArtifactManifest>(manifestKey).Should().NotBeNull();
+
+        var roundTrip = CultMesh.ReadCdnArtifact(cache, manifest);
+        roundTrip.Should().Equal(payload);
+    }
+
+    [Test]
+    public async Task BuildArtifact_Replicates_ThroughCultNetRawSnapshot()
+    {
+        var sourceCache = new CultCache();
+        var targetCache = new CultCache();
+        var registry = CultMesh.CreateCdnDocumentRegistry(sourceCache.Registry);
+        var payload = Encoding.UTF8.GetBytes("starbridge-build-update");
+        var artifact = CultMesh.PackCdnArtifact(
+            "starbridge/windows/client",
+            payload,
+            new CultMeshCdnPackOptions
+            {
+                ChunkSizeBytes = 7,
+                Kind = CultMeshCdnArtifactKinds.Build,
+                Version = "0.4.0-preview",
+                Tags = ["starbridge", "build"],
+                Metadata = new Dictionary<string, string>
+                {
+                    ["platform"] = "windows-x64"
+                }
+            });
+        var manifest = await CultMesh.PublishCdnArtifactAsync(sourceCache, artifact);
+        var manifestSchemaId = sourceCache.Registry.GetRequired<CultMeshCdnArtifactManifest>().SchemaId;
+        var chunkSchemaId = sourceCache.Registry.GetRequired<CultMeshCdnArtifactChunk>().SchemaId;
+        var recordKeys = artifact.RecordKeys.Select(key => key.Value).ToArray();
+
+        var request = registry.CreateSnapshotRequest(
+            "cdn-snapshot-request",
+            schemaIds: [manifestSchemaId, chunkSchemaId],
+            recordKeys: recordKeys);
+        var response = registry.CreateRawSnapshotResponse(sourceCache, "cdn-snapshot", request);
+
+        response.Documents.Should().HaveCount(artifact.Chunks.Count + 1);
+        response.Documents.Select(document => document.RecordKey).Should().BeEquivalentTo(recordKeys);
+
+        await registry.ApplyRawSnapshotResponseAsync(targetCache, response);
+        var replicatedManifest = targetCache.Get<CultMeshCdnArtifactManifest>(
+            CultMeshCdnArtifactManifest.CreateRecordKey(manifest));
+        replicatedManifest.Should().NotBeNull();
+        replicatedManifest!.Kind.Should().Be(CultMeshCdnArtifactKinds.Build);
+        replicatedManifest.Metadata["platform"].Should().Be("windows-x64");
+
+        var roundTrip = CultMesh.ReadCdnArtifact(targetCache, replicatedManifest);
+        roundTrip.Should().Equal(payload);
+    }
+
+    [Test]
+    public async Task ArtifactRead_RejectsTamperedChunkPayload()
+    {
+        var cache = new CultCache();
+        var artifact = CultMesh.PackCdnArtifact(
+            "aetheria/gravity/layer0",
+            [1, 1, 2, 3, 5, 8],
+            new CultMeshCdnPackOptions
+            {
+                ChunkSizeBytes = 3,
+                Metadata = new Dictionary<string, string>
+                {
+                    ["channels"] = "r32"
+                }
+            });
+        var manifest = await CultMesh.PublishCdnArtifactAsync(cache, artifact);
+        var firstChunk = artifact.Chunks[0];
+        firstChunk.Payload[0] = 99;
+        await cache.UpsertAsync(
+            firstChunk,
+            new CultRecordHandle<CultMeshCdnArtifactChunk>(
+                CultMeshCdnArtifactChunk.CreateRecordKey(firstChunk)));
+
+        Action read = () => CultMesh.ReadCdnArtifact(cache, manifest);
+        read.Should().Throw<InvalidDataException>()
+            .WithMessage("*chunk hash*");
+    }
+}
diff --git a/tests/GameCult.Mesh.Tests/CultMeshClientTests.cs b/tests/GameCult.Mesh.Tests/CultMeshClientTests.cs
new file mode 100644
index 00000000..dcabf6e6
--- /dev/null
+++ b/tests/GameCult.Mesh.Tests/CultMeshClientTests.cs
@@ -0,0 +1,692 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using FluentAssertions;
+using GameCult.Caching;
+using GameCult.Networking;
+using MessagePack;
+using NUnit.Framework;
+
+namespace GameCult.Mesh.Tests;
+
+public sealed class CultMeshClientTests
+{
+    private static CultMeshSessionTarget Target => new("aetheria", "aetheria-daemon");
+
+    [Test]
+    public void Construction_RequiresOneRendezvousEndpoint()
+    {
+        var create = () => new CultMeshClient(new CultMeshClientOptions());
+
+        create.Should().Throw<ArgumentException>()
+            .WithMessage("*rendezvous endpoint*");
+    }
+
+    [Test]
+    public async Task Connect_ResolvesStableIdentityAndReusesOneSession()
+    {
+        var discoveryClients = 0;
+        var connector = new RecordingConnector();
+        using var mesh = new CultMeshClient(new CultMeshClientOptions
+        {
+            RendezvousEndpoints = new[] { "rudp://odin:3076" },
+            Discovery = new CultMeshVerseDiscoveryClientOptions
+            {
+                CreateClient = () =>
+                {
+                    Interlocked.Increment(ref discoveryClients);
+                    return new RendezvousClient();
+                }
+            },
+            Sessions = CultMeshTestTrust.LocalSessions,
+            Connectors = new[] { connector }
+        });
+
+        var first = await mesh.ConnectAsync(Target, CultMeshProtocols.Documents);
+        var second = await mesh.ConnectAsync(Target, CultMeshProtocols.Documents);
+
+        first.Should().BeSameAs(second);
+        first.Target.Should().Be(Target);
+        first.State.Path!.Endpoint.Should().Be("rudp://127.0.0.1:3081");
+        discoveryClients.Should().Be(1);
+        connector.ConnectCount.Should().Be(1);
+    }
+
+    [Test]
+    public async Task Connect_RejectsProviderNotAdvertisedBySelectedVerseBeforeTransport()
+    {
+        var connector = new RecordingConnector();
+        using var mesh = new CultMeshClient(new CultMeshClientOptions
+        {
+            RendezvousEndpoints = new[] { "rudp://odin:3076" },
+            Discovery = new CultMeshVerseDiscoveryClientOptions { CreateClient = () => new RendezvousClient() },
+            Sessions = CultMeshTestTrust.LocalSessions,
+            Connectors = new[] { connector }
+        });
+
+        Func<Task> connect = async () => await mesh.ConnectAsync(
+            new CultMeshSessionTarget("aetheria", "forged-provider"),
+            CultMeshProtocols.Documents);
+
+        var failure = await connect.Should().ThrowAsync<CultMeshSessionException>();
+        failure.Which.Failure.Reason.Should().Be(CultMeshSessionFailureReason.Resolution);
+        connector.ConnectCount.Should().Be(0,
+            "a valid Verse route must not authorize an unadvertised provider identity");
+    }
+
+    [Test]
+    public async Task Document_ReplicatesTypedRecordBehindOneIntentDeclaration()
+    {
+        var connector = new DocumentConnector();
+        using var mesh = new CultMeshClient(new CultMeshClientOptions
+        {
+            RendezvousEndpoints = new[] { "rudp://odin:3076" },
+            Discovery = new CultMeshVerseDiscoveryClientOptions { CreateClient = () => new RendezvousClient() },
+            Sessions = CultMeshTestTrust.LocalSessions,
+            Connectors = new[] { connector }
+        });
+
+        using var firstLease = await mesh.LeaseDocumentAsync<ClientTestDocument>(Target, "surface:pilot");
+        using var secondLease = await mesh.LeaseDocumentAsync<ClientTestDocument>(Target, "surface:pilot");
+        var first = firstLease.Handle;
+        var second = secondLease.Handle;
+
+        first.Should().BeSameAs(second);
+        (await first.LatestAsync()).Text.Should().Be("pilot surface 1");
+        connector.SubscribeCount.Should().Be(1);
+    }
+
+    [Test]
+    public async Task Document_ReplaysSubscriptionAndRefreshesSameHandleAfterReconnect()
+    {
+        var connector = new DocumentConnector();
+        using var mesh = new CultMeshClient(new CultMeshClientOptions
+        {
+            RendezvousEndpoints = new[] { "rudp://odin:3076" },
+            Discovery = new CultMeshVerseDiscoveryClientOptions { CreateClient = () => new RendezvousClient() },
+            Sessions = CultMeshTestTrust.LocalSessions,
+            Connectors = new[] { connector }
+        });
+        using var lease = await mesh.LeaseDocumentAsync<ClientTestDocument>(Target, "surface:pilot");
+        var document = lease.Handle;
+
+        connector.Clients[0].Fail(new InvalidOperationException("path lost"));
+        await WaitUntilAsync(() => connector.Clients.Count == 2 && connector.Clients[1].SubscribeCount == 1);
+        await WaitForTextAsync(document, "pilot surface 2");
+
+        (await document.LatestAsync()).Text.Should().Be("pilot surface 2");
+        connector.Clients[0].SubscribeCount.Should().Be(1);
+        connector.Clients[1].SubscribeCount.Should().Be(1);
+    }
+
+    [Test]
+    public async Task Document_InitialReadinessCanBeSatisfiedByReconnectReplay()
+    {
+        var connector = new DocumentConnector { SuppressFirstSnapshot = true };
+        using var mesh = new CultMeshClient(new CultMeshClientOptions
+        {
+            RendezvousEndpoints = new[] { "rudp://odin:3076" },
+            Discovery = new CultMeshVerseDiscoveryClientOptions { CreateClient = () => new RendezvousClient() },
+            Sessions = CultMeshTestTrust.LocalSessions,
+            Connectors = new[] { connector }
+        });
+
+        var opening = mesh.LeaseDocumentAsync<ClientTestDocument>(Target, "surface:pilot");
+        await WaitUntilAsync(() => connector.Clients.Count == 1 && connector.Clients[0].SubscribeCount == 1);
+        connector.Clients[0].Fail(new InvalidOperationException("path lost before initial snapshot"));
+
+        using var lease = await opening;
+        var document = lease.Handle;
+
+        (await document.LatestAsync()).Text.Should().Be("pilot surface 2");
+        connector.Clients.Should().HaveCount(2);
+        connector.Clients[1].SubscribeCount.Should().Be(1);
+    }
+
+    [Test]
+    public async Task Document_ReplaysUnansweredIntentOnSamePhysicalSession()
+    {
+        var connector = new DocumentConnector { SuppressFirstSubscriptionSnapshot = true };
+        using var mesh = new CultMeshClient(new CultMeshClientOptions
+        {
+            RendezvousEndpoints = new[] { "rudp://odin:3076" },
+            Discovery = new CultMeshVerseDiscoveryClientOptions { CreateClient = () => new RendezvousClient() },
+            Sessions = CultMeshTestTrust.LocalSessions,
+            Connectors = new[] { connector },
+            SubscriptionResponseTimeout = TimeSpan.FromMilliseconds(20)
+        });
+
+        using var lease = await mesh.LeaseDocumentAsync<ClientTestDocument>(Target, "surface:pilot");
+        var document = lease.Handle;
+
+        (await document.LatestAsync()).Text.Should().Be("pilot surface 1");
+        connector.Clients.Should().ContainSingle();
+        connector.Clients[0].SubscribeCount.Should().Be(2);
+    }
+
+    [Test]
+    public async Task Collection_ReplicatesAllDocumentsOfTypedSchema()
+    {
+        var connector = new DocumentConnector();
+        using var mesh = new CultMeshClient(new CultMeshClientOptions
+        {
+            RendezvousEndpoints = new[] { "rudp://odin:3076" },
+            Discovery = new CultMeshVerseDiscoveryClientOptions { CreateClient = () => new RendezvousClient() },
+            Sessions = CultMeshTestTrust.LocalSessions,
+            Connectors = new[] { connector }
+        });
+
+        using var lease = await mesh.LeaseCollectionAsync<ClientTestDocument>(Target);
+        var collection = lease.Handle;
+
+        (await collection.LatestAsync()).Should().ContainSingle()
+            .Which.Text.Should().Be("pilot surface 1");
+        connector.SubscribeCount.Should().Be(1);
+    }
+
+    [Test]
+    public async Task Collection_InitialReadinessCanBeSatisfiedByReconnectReplay()
+    {
+        var connector = new DocumentConnector { SuppressFirstSnapshot = true };
+        using var mesh = new CultMeshClient(new CultMeshClientOptions
+        {
+            RendezvousEndpoints = new[] { "rudp://odin:3076" },
+            Discovery = new CultMeshVerseDiscoveryClientOptions { CreateClient = () => new RendezvousClient() },
+            Sessions = CultMeshTestTrust.LocalSessions,
+            Connectors = new[] { connector }
+        });
+
+        var opening = mesh.LeaseCollectionAsync<ClientTestDocument>(Target);
+        await WaitUntilAsync(() => connector.Clients.Count == 1 && connector.Clients[0].SubscribeCount == 1);
+        connector.Clients[0].Fail(new InvalidOperationException("path lost before initial collection snapshot"));
+
+        using var lease = await opening;
+        var collection = lease.Handle;
+
+        (await collection.LatestAsync()).Should().ContainSingle()
+            .Which.Text.Should().Be("pilot surface 2");
+        connector.Clients.Should().HaveCount(2);
+        connector.Clients[1].SubscribeCount.Should().Be(1);
+    }
+
+    [Test]
+    public async Task Document_ResourceIsSharedAndReleasedWithLastLease()
+    {
+        var connector = new DocumentConnector();
+        using var mesh = new CultMeshClient(new CultMeshClientOptions
+        {
+            RendezvousEndpoints = new[] { "rudp://odin:3076" },
+            Discovery = new CultMeshVerseDiscoveryClientOptions { CreateClient = () => new RendezvousClient() },
+            Sessions = CultMeshTestTrust.LocalSessions,
+            Connectors = new[] { connector }
+        });
+
+        var first = await mesh.LeaseDocumentAsync<ClientTestDocument>(Target, "surface:pilot");
+        var second = await mesh.LeaseDocumentAsync<ClientTestDocument>(Target, "surface:pilot");
+        mesh.ActiveDocumentResourceCount.Should().Be(1);
+
+        first.Dispose();
+        mesh.ActiveDocumentResourceCount.Should().Be(1);
+        second.Dispose();
+        mesh.ActiveDocumentResourceCount.Should().Be(0);
+
+        using var replacement = await mesh.LeaseDocumentAsync<ClientTestDocument>(Target, "surface:pilot");
+        replacement.Handle.Should().NotBeSameAs(first.Handle);
+        connector.SubscribeCount.Should().Be(2);
+    }
+
+    [Test]
+    public async Task Document_OneHundredThousandDistinctLeaseCyclesLeaveNoResourcesOrCallbacks()
+    {
+        const int leaseCount = 100_000;
+        var connector = new DocumentConnector();
+        using var mesh = new CultMeshClient(new CultMeshClientOptions
+        {
+            RendezvousEndpoints = new[] { "rudp://odin:3076" },
+            Discovery = new CultMeshVerseDiscoveryClientOptions { CreateClient = () => new RendezvousClient() },
+            Sessions = CultMeshTestTrust.LocalSessions,
+            Connectors = new[] { connector }
+        });
+
+        for (var index = 0; index < leaseCount; index++)
+        {
+            var recordKey = "surface:churn:" + index;
+            using var lease = await mesh.LeaseDocumentAsync<ClientTestDocument>(Target, recordKey);
+            (await lease.Handle.LatestAsync()).Id.Should().Be(recordKey);
+        }
+
+        mesh.ActiveDocumentResourceCount.Should().Be(0);
+        mesh.ActiveCollectionResourceCount.Should().Be(0);
+        connector.Clients.Should().ContainSingle();
+        connector.Clients[0].HandlerRegistrationCount.Should().Be(2,
+            "one physical handler per message type must serve every logical lease");
+    }
+
+    [Test]
+    public async Task SubmitDocument_SendsUncommittedInputThroughStableIdentitySession()
+    {
+        var connector = new DocumentConnector();
+        using var mesh = new CultMeshClient(new CultMeshClientOptions
+        {
+            RendezvousEndpoints = new[] { "rudp://odin:3076" },
+            Discovery = new CultMeshVerseDiscoveryClientOptions { CreateClient = () => new RendezvousClient() },
+            Sessions = CultMeshTestTrust.LocalSessions,
+            Connectors = new[] { connector }
+        });
+        var request = new ClientTestDocument { Id = "command:1", Text = "move" };
+
+        await mesh.SubmitDocumentAsync(
+            Target,
+            request.Id,
+            request,
+            sourceRuntimeId: "pilot-one",
+            sourceRole: "pilot");
+
+        connector.Clients.Should().ContainSingle();
+        var submitted = connector.Clients[0].Submitted.Should().ContainSingle().Subject;
+        submitted.Document.RecordKey.Should().Be("command:1");
+        submitted.Document.SourceRuntimeId.Should().Be("pilot-one");
+        submitted.Document.SourceRole.Should().Be("pilot");
+    }
+
+    [Test]
+    public async Task InvokeOperation_CorrelatesProviderReceiptThroughStableIdentitySession()
+    {
+        var connector = new DocumentConnector();
+        using var mesh = new CultMeshClient(new CultMeshClientOptions
+        {
+            RendezvousEndpoints = new[] { "rudp://odin:3076" },
+            Discovery = new CultMeshVerseDiscoveryClientOptions { CreateClient = () => new RendezvousClient() },
+            Sessions = CultMeshTestTrust.LocalSessions,
+            Connectors = new[] { connector }
+        });
+
+        var result = await mesh.InvokeAsync<ClientOperationRequest, ClientOperationReceipt>(
+            Target,
+            "tests.counter",
+            "tests.counter.increment",
+            "tests.counter.increment_request.v1",
+            "tests.counter.increment_receipt.v1",
+            new ClientOperationRequest { Amount = 2 },
+            sourceRuntimeId: "pilot-one",
+            idempotencyKey: "pilot-command-1");
+
+        result.MessageId.Should().Be("pilot-command-1");
+        result.Status.Should().Be("accepted");
+        result.SourceRuntimeId.Should().Be("aetheria-daemon");
+        result.Value.ReceiptId.Should().Be("receipt:pilot-command-1");
+        result.Value.Count.Should().Be(2);
+        connector.Clients.Should().ContainSingle();
+        connector.Clients[0].Operations.Should().ContainSingle()
+            .Which.SourceRuntimeId.Should().Be("pilot-one");
+    }
+
+    [Test]
+    public async Task InvokeOperation_ReplaysSameIdempotencyKeyAfterRouteLossBeforeReceipt()
+    {
+        var connector = new DocumentConnector { FailFirstOperationBeforeResponse = true };
+        using var mesh = new CultMeshClient(new CultMeshClientOptions
+        {
+            RendezvousEndpoints = new[] { "rudp://odin:3076" },
+            Discovery = new CultMeshVerseDiscoveryClientOptions { CreateClient = () => new RendezvousClient() },
+            Sessions = CultMeshTestTrust.LocalSessions,
+            Connectors = new[] { connector },
+            OperationResponseTimeout = TimeSpan.FromSeconds(2)
+        });
+
+        var result = await mesh.InvokeAsync<ClientOperationRequest, ClientOperationReceipt>(
+            Target,
+            "tests.counter",
+            "tests.counter.increment",
+            "tests.counter.increment_request.v1",
+            "tests.counter.increment_receipt.v1",
+            new ClientOperationRequest { Amount = 2 },
+            sourceRuntimeId: "pilot-one",
+            idempotencyKey: "pilot-command-route-loss");
+
+        result.Value.ReceiptId.Should().Be("receipt:pilot-command-route-loss");
+        connector.Clients.Should().HaveCount(2);
+        connector.Clients.SelectMany(client => client.Operations)
+            .Select(operation => operation.MessageId)
+            .Should().Equal("pilot-command-route-loss", "pilot-command-route-loss");
+    }
+
+    [Test]
+    public async Task InvokeOperation_ThrowsCorrelatedFrameworkFailureWithoutTimingOut()
+    {
+        var connector = new DocumentConnector { RejectOperations = true };
+        using var mesh = new CultMeshClient(new CultMeshClientOptions
+        {
+            RendezvousEndpoints = new[] { "rudp://odin:3076" },
+            Discovery = new CultMeshVerseDiscoveryClientOptions { CreateClient = () => new RendezvousClient() },
+            Sessions = CultMeshTestTrust.LocalSessions,
+            Connectors = new[] { connector },
+            OperationResponseTimeout = TimeSpan.FromSeconds(5)
+        });
+
+        Func<Task> invoke = async () => await mesh.InvokeAsync<ClientOperationRequest, ClientOperationReceipt>(
+            Target,
+            "tests.counter",
+            "tests.counter.increment",
+            "wrong.request.v1",
+            "tests.counter.increment_receipt.v1",
+            new ClientOperationRequest { Amount = 2 },
+            sourceRuntimeId: "pilot-one",
+            idempotencyKey: "pilot-command-invalid");
+
+        var failure = await invoke.Should().ThrowAsync<CultMeshRemoteOperationException>();
+        failure.Which.Status.Should().Be("invalid");
+        failure.Which.Code.Should().Be("request-schema-mismatch");
+        failure.Which.Message.Should().Contain("expected payload schema");
+        connector.Clients.Should().ContainSingle();
+        connector.Clients[0].Operations.Should().ContainSingle();
+    }
+
+    [Test]
+    public async Task InvokeOperation_RejectsReceiptFromAnotherRuntime()
+    {
+        var connector = new DocumentConnector { ResponseSourceRuntimeId = "intruder-daemon" };
+        using var mesh = new CultMeshClient(new CultMeshClientOptions
+        {
+            RendezvousEndpoints = new[] { "rudp://odin:3076" },
+            Discovery = new CultMeshVerseDiscoveryClientOptions { CreateClient = () => new RendezvousClient() },
+            Sessions = CultMeshTestTrust.LocalSessions,
+            Connectors = new[] { connector }
+        });
+
+        Func<Task> invoke = async () => await mesh.InvokeAsync<ClientOperationRequest, ClientOperationReceipt>(
+            Target,
+            "tests.counter",
+            "tests.counter.increment",
+            "tests.counter.increment_request.v1",
+            "tests.counter.increment_receipt.v1",
+            new ClientOperationRequest { Amount = 2 },
+            sourceRuntimeId: "pilot-one",
+            idempotencyKey: "pilot-command-wrong-source");
+
+        var failure = await invoke.Should().ThrowAsync<CultMeshSessionException>();
+        failure.Which.Failure.Reason.Should().Be(CultMeshSessionFailureReason.Authority);
+    }
+
+    [Test]
+    public async Task Dispose_TerminatesDocumentWaitingForInitialSnapshot()
+    {
+        var connector = new DocumentConnector { SuppressFirstSnapshot = true };
+        var mesh = new CultMeshClient(new CultMeshClientOptions
+        {
+            RendezvousEndpoints = new[] { "rudp://odin:3076" },
+            Discovery = new CultMeshVerseDiscoveryClientOptions { CreateClient = () => new RendezvousClient() },
+            Sessions = CultMeshTestTrust.LocalSessions,
+            Connectors = new[] { connector }
+        });
+        var opening = mesh.LeaseDocumentAsync<ClientTestDocument>(Target, "surface:pilot");
+        await WaitUntilAsync(() => connector.Clients.Count == 1 && connector.Clients[0].SubscribeCount == 1);
+
+        mesh.Dispose();
+
+        Func<Task> awaitOpening = async () => await opening;
+        await awaitOpening.Should().ThrowAsync<ObjectDisposedException>();
+    }
+
+    private sealed class RendezvousClient : ICultNetSchemaClient
+    {
+        private readonly List<Action<CultMeshVerseCatalogResponseMessage>> _handlers = new();
+        public bool Connected => true;
+        public void Connect(string host, int port) { }
+        public void SendCultNet<T>(T message) where T : ICultNetSchemaMessage
+        {
+            var request = (CultMeshVerseCatalogRequestMessage)(object)message;
+            var response = new CultMeshVerseCatalogResponseMessage
+            {
+                MessageId = request.MessageId,
+                Verses = new[]
+                {
+                    new CultMeshVerseDescriptor(
+                        "aetheria",
+                        "Aetheria",
+                        CultMeshVerseAuthorityModel.OperatorCluster,
+                        new CultMeshVerseCompatibility("cultmesh.v0", "rules"),
+                        new[] { "rudp://127.0.0.1:3081" },
+                        new[] { "aetheria-daemon" }).ToMessage()
+                }
+            };
+            foreach (var handler in _handlers.ToArray()) handler(response);
+        }
+        public void OnCultNet<T>(Action<T> callback) where T : ICultNetSchemaMessage
+        {
+            if (typeof(T) == typeof(CultMeshVerseCatalogResponseMessage))
+                _handlers.Add(response => callback((T)(object)response));
+        }
+        public void Dispose() { }
+    }
+
+    private sealed class RecordingConnector : ICultMeshTransportConnector
+    {
+        private int _connectCount;
+        public string ConnectorId => "test";
+        public int Priority => 0;
+        public int ConnectCount => Volatile.Read(ref _connectCount);
+        public bool CanConnect(CultMeshTransportCandidate candidate) => true;
+        public Task<ICultNetSchemaClient> ConnectAsync(
+            CultMeshTransportCandidate candidate,
+            CultMeshProtocolId protocol,
+            CancellationToken cancellationToken = default)
+        {
+            Interlocked.Increment(ref _connectCount);
+            return Task.FromResult<ICultNetSchemaClient>(new ConnectedClient());
+        }
+    }
+
+    private sealed class ConnectedClient : ICultNetSchemaClient, ICultMeshVerifiedSchemaClient
+    {
+        public bool Connected => true;
+        public void Connect(string host, int port) { }
+        public void SendCultNet<T>(T message) where T : ICultNetSchemaMessage { }
+        public void OnCultNet<T>(Action<T> callback) where T : ICultNetSchemaMessage { }
+        public void Dispose() { }
+        public bool IsVerifiedFor(string verseId, string authorityRuntimeId, string protocolId, string routeGeneration) =>
+            verseId == "aetheria" && authorityRuntimeId == "aetheria-daemon";
+    }
+
+    private sealed class DocumentConnector : ICultMeshTransportConnector
+    {
+        public List<DocumentClient> Clients { get; } = new();
+        public bool SuppressFirstSnapshot { get; set; }
+        public bool SuppressFirstSubscriptionSnapshot { get; set; }
+        public bool RejectOperations { get; set; }
+        public bool FailFirstOperationBeforeResponse { get; set; }
+        public string ResponseSourceRuntimeId { get; set; } = "aetheria-daemon";
+        public string ConnectorId => "document-test";
+        public int Priority => 0;
+        public int SubscribeCount => Clients.Sum(client => client.SubscribeCount);
+        public bool CanConnect(CultMeshTransportCandidate candidate) => true;
+        public Task<ICultNetSchemaClient> ConnectAsync(
+            CultMeshTransportCandidate candidate,
+            CultMeshProtocolId protocol,
+            CancellationToken cancellationToken = default)
+        {
+            var client = new DocumentClient(
+                "pilot surface " + (Clients.Count + 1),
+                snapshotsToSuppress: SuppressFirstSnapshot && Clients.Count == 0
+                    ? int.MaxValue
+                    : SuppressFirstSubscriptionSnapshot && Clients.Count == 0 ? 1 : 0,
+                rejectOperations: RejectOperations,
+                failOperationBeforeResponse: FailFirstOperationBeforeResponse && Clients.Count == 0,
+                responseSourceRuntimeId: ResponseSourceRuntimeId);
+            Clients.Add(client);
+            return Task.FromResult<ICultNetSchemaClient>(client);
+        }
+    }
+
+    private sealed class DocumentClient : ICultNetSchemaClient, ICultNetSchemaClientHealth, ICultMeshVerifiedSchemaClient
+    {
+        private readonly List<Action<CultNetSnapshotResponseRawMessage>> _snapshots = new();
+        private readonly List<Action<CultNetOperationResponseMessage>> _operationResponses = new();
+        private readonly CultNetDocumentRegistry _documents;
+        private readonly string _text;
+        private readonly TaskCompletionSource<Exception> _failure = new(TaskCreationOptions.RunContinuationsAsynchronously);
+        private readonly bool _rejectOperations;
+        private bool _failOperationBeforeResponse;
+        private readonly string _responseSourceRuntimeId;
+        private int _snapshotsToSuppress;
+        public DocumentClient(
+            string text,
+            int snapshotsToSuppress = 0,
+            bool rejectOperations = false,
+            bool failOperationBeforeResponse = false,
+            string responseSourceRuntimeId = "aetheria-daemon")
+        {
+            _text = text;
+            _snapshotsToSuppress = snapshotsToSuppress;
+            _rejectOperations = rejectOperations;
+            _failOperationBeforeResponse = failOperationBeforeResponse;
+            _responseSourceRuntimeId = responseSourceRuntimeId;
+            var cache = CultMesh.CreateCultCacheDocumentRegistry(typeof(ClientTestDocument));
+            _documents = CultMesh.CreateCultNetDocumentRegistry(new[] { typeof(ClientTestDocument) }, cache);
+        }
+        public bool Connected => true;
+        public Task<Exception> BackgroundFailure => _failure.Task;
+        public int SubscribeCount { get; private set; }
+        public int HandlerRegistrationCount { get; private set; }
+        public List<CultNetDocumentPutRawMessage> Submitted { get; } = new();
+        public List<CultNetOperationRequestMessage> Operations { get; } = new();
+        public void Connect(string host, int port) { }
+        public void SendCultNet<T>(T message) where T : ICultNetSchemaMessage
+        {
+            if (message is CultNetDocumentPutRawMessage submitted)
+            {
+                Submitted.Add(submitted);
+                return;
+            }
+            if (message is CultNetOperationRequestMessage operation)
+            {
+                operation.TargetRuntimeId.Should().Be("aetheria-daemon");
+                Operations.Add(operation);
+                if (_failOperationBeforeResponse)
+                {
+                    _failOperationBeforeResponse = false;
+                    Fail(new InvalidOperationException("path lost before operation receipt"));
+                    return;
+                }
+                if (_rejectOperations)
+                {
+                    var failure = new CultNetOperationFailure
+                    {
+                        Code = "request-schema-mismatch",
+                        Message = "CultNet operation expected payload schema tests.counter.increment_request.v1."
+                    };
+                    var rejected = new CultNetOperationResponseMessage
+                    {
+                        MessageId = operation.MessageId,
+                        ServiceId = operation.ServiceId,
+                        Operation = operation.Operation,
+                        Status = "invalid",
+                        PayloadSchema = CultNetOperationServer.FailureSchemaId,
+                        Payload = Convert.ToBase64String(MessagePackSerializer.Serialize(
+                            failure,
+                            CultNetSchemaMessageSerialization.Options)),
+                        Diagnostics = new[] { failure.Message },
+                        SourceRuntimeId = _responseSourceRuntimeId
+                    };
+                    foreach (var handler in _operationResponses.ToArray()) handler(rejected);
+                    return;
+                }
+                var decodedRequest = MessagePackSerializer.Deserialize<ClientOperationRequest>(
+                    Convert.FromBase64String(operation.Payload),
+                    CultNetSchemaMessageSerialization.Options);
+                var receipt = new ClientOperationReceipt
+                {
+                    ReceiptId = "receipt:" + operation.MessageId,
+                    Count = decodedRequest.Amount
+                };
+                var operationResponse = new CultNetOperationResponseMessage
+                {
+                    MessageId = operation.MessageId,
+                    ServiceId = operation.ServiceId,
+                    Operation = operation.Operation,
+                    Status = "accepted",
+                    PayloadSchema = "tests.counter.increment_receipt.v1",
+                    Payload = Convert.ToBase64String(MessagePackSerializer.Serialize(
+                        receipt,
+                        CultNetSchemaMessageSerialization.Options)),
+                    SourceRuntimeId = _responseSourceRuntimeId
+                };
+                foreach (var handler in _operationResponses.ToArray()) handler(operationResponse);
+                return;
+            }
+            if (message is not CultNetDatabaseSubscribeMessage request) return;
+            SubscribeCount++;
+            if (_snapshotsToSuppress > 0)
+            {
+                _snapshotsToSuppress--;
+                return;
+            }
+            var recordKey = request.RecordKeys?.SingleOrDefault() ?? "surface:pilot";
+            var put = _documents.CreateRawDocumentPutMessage(
+                "test-put",
+                new CultRecordHandle<ClientTestDocument>(new CultRecordKey(recordKey)),
+                new ClientTestDocument { Id = recordKey, Text = _text });
+            var response = new CultNetSnapshotResponseRawMessage
+            {
+                MessageId = request.MessageId,
+                Documents = new[] { put.Document }
+            };
+            foreach (var handler in _snapshots.ToArray()) handler(response);
+        }
+        public void OnCultNet<T>(Action<T> callback) where T : ICultNetSchemaMessage
+        {
+            HandlerRegistrationCount++;
+            if (typeof(T) == typeof(CultNetSnapshotResponseRawMessage))
+                _snapshots.Add(response => callback((T)(object)response));
+            if (typeof(T) == typeof(CultNetOperationResponseMessage))
+                _operationResponses.Add(response => callback((T)(object)response));
+        }
+        public void Dispose() { }
+        public void Fail(Exception error) => _failure.TrySetResult(error);
+        public bool IsVerifiedFor(string verseId, string authorityRuntimeId, string protocolId, string routeGeneration) =>
+            verseId == "aetheria" && authorityRuntimeId == "aetheria-daemon";
+    }
+
+    private static async Task WaitUntilAsync(Func<bool> condition)
+    {
+        var deadline = DateTime.UtcNow + TimeSpan.FromSeconds(2);
+        while (!condition() && DateTime.UtcNow < deadline) await Task.Delay(1);
+        condition().Should().BeTrue();
+    }
+
+    private static async Task WaitForTextAsync(
+        CultMeshDocumentHandle<ClientTestDocument> document,
+        string expected)
+    {
+        var deadline = DateTime.UtcNow + TimeSpan.FromSeconds(2);
+        while (DateTime.UtcNow < deadline)
+        {
+            if (string.Equals((await document.LatestAsync()).Text, expected, StringComparison.Ordinal)) return;
+            await Task.Delay(1);
+        }
+        (await document.LatestAsync()).Text.Should().Be(expected);
+    }
+
+    [CultDocument("tests.cultmesh_client_document", "tests.cultmesh_client_document.v1")]
+    [MessagePackObject]
+    public sealed class ClientTestDocument
+    {
+        [Key(0), CultName] public string Id { get; set; } = string.Empty;
+        [Key(1)] public string Text { get; set; } = string.Empty;
+    }
+
+    [MessagePackObject]
+    public sealed class ClientOperationRequest
+    {
+        [Key("amount")] public int Amount { get; set; }
+    }
+
+    [MessagePackObject]
+    public sealed class ClientOperationReceipt
+    {
+        [Key("receiptId")] public string ReceiptId { get; set; } = string.Empty;
+        [Key("count")] public int Count { get; set; }
+    }
+}
diff --git a/tests/GameCult.Mesh.Tests/CultMeshContentSessionTests.cs b/tests/GameCult.Mesh.Tests/CultMeshContentSessionTests.cs
new file mode 100644
index 00000000..6ec0548f
--- /dev/null
+++ b/tests/GameCult.Mesh.Tests/CultMeshContentSessionTests.cs
@@ -0,0 +1,336 @@
+using System;
+using System.Collections.Generic;
+using System.Diagnostics;
+using System.IO;
+using System.Linq;
+using System.Net;
+using System.Net.Sockets;
+using System.Threading;
+using System.Threading.Tasks;
+using FluentAssertions;
+using GameCult.Caching;
+using GameCult.Networking;
+using NUnit.Framework;
+
+namespace GameCult.Mesh.Tests;
+
+[TestFixture]
+public sealed class CultMeshContentSessionTests
+{
+    private const string RouteGeneration = "content-test-route-1";
+    private string _directory = null!;
+
+    [SetUp]
+    public void SetUp() =>
+        _directory = Path.Combine(Path.GetTempPath(), "cultmesh-content-session-tests", Guid.NewGuid().ToString("N"));
+
+    [TearDown]
+    public void TearDown()
+    {
+        if (Directory.Exists(_directory)) Directory.Delete(_directory, true);
+    }
+
+    [Test]
+    public async Task TcpContentSessionStreamsLargeBodyAndReusesCommittedBody()
+    {
+        var payload = Enumerable.Range(0, 700_000).Select(value => (byte)(value % 251)).ToArray();
+        var artifact = CultMesh.PackCdnArtifact("aetheria/world/windows", payload);
+        var providerChunks = artifact.Chunks.ToDictionary(
+            chunk => (chunk.ChunkHash.StartsWith("sha256:", StringComparison.OrdinalIgnoreCase)
+                ? chunk.ChunkHash.Substring("sha256:".Length)
+                : chunk.ChunkHash).Trim().ToLowerInvariant(),
+            StringComparer.Ordinal);
+        using var contentServer = new CultMeshTcpContentServer(
+            new TcpListener(IPAddress.Loopback, 0),
+            hash => providerChunks.TryGetValue(hash, out var chunk) ? chunk : null,
+            new CultMeshTcpContentServerOptions
+            {
+                VerseId = "aetheria",
+                AuthorityRuntimeId = "aetheria.daemon",
+                RouteGeneration = RouteGeneration
+            });
+        var endpoint = $"{CultMeshTcpContentTransportConnector.Scheme}://127.0.0.1:{contentServer.LocalEndPoint.Port}";
+        var connector = new CultMeshTcpContentTransportConnector();
+        using var discovery = new CultMeshDiscoveryService(new[] { new RouteSource(endpoint) });
+        using var sessions = new CultMeshSessionManager(
+            discovery,
+            Array.Empty<ICultMeshTransportConnector>(),
+            new ICultMeshContentTransportConnector[] { connector }, CultMeshTestTrust.LocalSessions);
+        var provider = new CultMeshSessionContentProvider(
+            "aetheria.daemon",
+            sessions,
+            new CultMeshSessionTarget("aetheria", "aetheria.daemon"));
+        using var transferState = new CultCache(CultMesh.CreateCultCacheDocumentRegistry(
+            typeof(CultMeshContentTransferStateDocument)));
+        var transfer = new CultMeshContentTransferService(
+            transferState,
+            new[] { provider },
+            new CultMeshContentTransferOptions(_directory));
+
+        var first = await transfer.FetchAsync(artifact.Manifest);
+        var requestsAfterCold = contentServer.ChunkRequestsServed;
+        var second = await transfer.FetchAsync(artifact.Manifest);
+
+        File.ReadAllBytes(first).Should().Equal(payload);
+        second.Should().Be(first);
+        requestsAfterCold.Should().Be(artifact.Manifest.Chunks.Length);
+        contentServer.ChunkRequestsServed.Should().Be(requestsAfterCold,
+            "a committed verified body is the warm-cache authority");
+        connector.ConnectCount.Should().Be(1,
+            "all chunk requests borrow one identity-first content session");
+    }
+
+    [Test]
+    public async Task TcpContentSessionRejectsEndpointServingAnotherAuthority()
+    {
+        using var content = new CultCache(CultMesh.CreateCultCacheDocumentRegistry(
+            typeof(CultMeshCdnArtifactManifest), typeof(CultMeshCdnArtifactChunk)));
+        using var contentServer = new CultMeshTcpContentServer(
+            new TcpListener(IPAddress.Loopback, 0),
+            content,
+            new CultMeshTcpContentServerOptions
+            {
+                VerseId = "aetheria",
+                AuthorityRuntimeId = "intruder.daemon",
+                RouteGeneration = RouteGeneration
+            });
+        var endpoint = $"{CultMeshTcpContentTransportConnector.Scheme}://127.0.0.1:{contentServer.LocalEndPoint.Port}";
+        using var discovery = new CultMeshDiscoveryService(new[] { new RouteSource(endpoint) });
+        using var sessions = new CultMeshSessionManager(
+            discovery,
+            Array.Empty<ICultMeshTransportConnector>(),
+            new ICultMeshContentTransportConnector[] { new CultMeshTcpContentTransportConnector() }, CultMeshTestTrust.LocalSessions);
+
+        Func<Task> connect = async () => await sessions.ConnectContentAsync(
+            new CultMeshSessionTarget("aetheria", "aetheria.daemon"));
+
+        var error = await connect.Should().ThrowAsync<CultMeshSessionException>();
+        error.Which.Failure.Reason.Should().Be(CultMeshSessionFailureReason.Authority);
+    }
+
+    [Test]
+    public async Task RudpContentSessionCarriesConcurrentChunkWindowWithoutPerFragmentSchedulerDelay()
+    {
+        var payload = Enumerable.Range(0, 1024 * 1024).Select(value => (byte)(value % 251)).ToArray();
+        var artifact = CultMesh.PackCdnArtifact("aetheria/world/rudp", payload);
+        using var providerCache = new CultCache(CultMesh.CreateCultCacheDocumentRegistry(
+            typeof(CultMeshCdnArtifactManifest), typeof(CultMeshCdnArtifactChunk)));
+        await CultMeshCdn.PublishAsync(providerCache, artifact);
+        using var socket = new Socket(AddressFamily.InterNetwork, SocketType.Dgram, ProtocolType.Udp);
+        socket.Bind(new IPEndPoint(IPAddress.Loopback, 0));
+        using var wireServer = new RudpCultNetSchemaServer(new RudpCultNetSchemaServerOptions
+        {
+            RuntimeId = "cultmesh-content-rudp-test",
+            Socket = socket,
+            MaxFragmentBytes = 1024,
+            MaxPendingReliablePackets = 8192
+        });
+        using var contentServer = new CultMeshLegacyRudpContentServer(wireServer, providerCache);
+        using var identityServer = new CultMeshSessionIdentityServer(
+            wireServer,
+            "aetheria.daemon",
+            new[] { "aetheria" },
+            new[] { CultMeshProtocols.Content.Value },
+            new[] { RouteGeneration });
+        using var pumpCancellation = new CancellationTokenSource();
+        var pump = Task.Run(async () =>
+        {
+            while (!pumpCancellation.IsCancellationRequested)
+            {
+                var progress = await wireServer.PollAvailableAsync(256);
+                wireServer.PollResends();
+                if (progress.TransportItemsConsumed == 0)
+                    await Task.Delay(1, pumpCancellation.Token);
+            }
+        });
+
+        var endpoint = $"rudp://127.0.0.1:{wireServer.LocalEndPoint.Port}";
+        using var discovery = new CultMeshDiscoveryService(new[] { new RouteSource(endpoint) });
+        var connector = new CultMeshLegacyRudpContentTransportConnector(
+            new CultMeshLegacyRudpContentTransportOptions { ResponseTimeout = TimeSpan.FromSeconds(20) });
+        using var sessions = new CultMeshSessionManager(
+            discovery,
+            Array.Empty<ICultMeshTransportConnector>(),
+            new ICultMeshContentTransportConnector[] { connector }, CultMeshTestTrust.LocalSessions);
+        var provider = new CultMeshSessionContentProvider(
+            "aetheria.daemon",
+            sessions,
+            new CultMeshSessionTarget("aetheria", "aetheria.daemon"));
+        using var transferState = new CultCache(CultMesh.CreateCultCacheDocumentRegistry(
+            typeof(CultMeshContentTransferStateDocument)));
+        var transfer = new CultMeshContentTransferService(
+            transferState,
+            new[] { provider },
+            new CultMeshContentTransferOptions(_directory));
+
+        var elapsed = Stopwatch.StartNew();
+        string path;
+        try
+        {
+            path = await transfer.FetchAsync(artifact.Manifest);
+        }
+        catch (Exception error)
+        {
+            var stats = wireServer.Stats;
+            Assert.Fail(
+                $"RUDP content transfer failed after {elapsed.Elapsed}; " +
+                $"server sent {stats.BytesSent} bytes and received {stats.BytesReceived} bytes; " +
+                $"pump status is {pump.Status}: {error}");
+            return;
+        }
+        finally
+        {
+            pumpCancellation.Cancel();
+            try { await pump; }
+            catch (OperationCanceledException) { }
+        }
+        elapsed.Stop();
+
+        File.ReadAllBytes(path).Should().Equal(payload);
+        elapsed.Elapsed.Should().BeLessThan(TimeSpan.FromSeconds(10),
+            "a bounded content request window must not pay one scheduler quantum per RUDP fragment");
+    }
+
+    [Test]
+    public void ContentWireMessagesRoundTripThroughTheSchemaDispatcher()
+    {
+        var request = new CultMeshContentChunkRequestMessage
+        {
+            MessageId = "request-1",
+            ChunkHash = new string('a', 64),
+            RecordKey = "mesh:cdn:chunk:" + new string('a', 64),
+            ExpectedSizeBytes = 42
+        };
+        var response = new CultMeshContentChunkResponseMessage
+        {
+            MessageId = "request-1",
+            Found = true,
+            ChunkHash = new string('a', 64),
+            SizeBytes = 3,
+            Payload = new byte[] { 1, 2, 3 }
+        };
+
+        CultNetSchemaMessageSerialization.Deserialize(CultNetSchemaMessageSerialization.Serialize(request))
+            .Should().BeEquivalentTo(request);
+        CultNetSchemaMessageSerialization.Deserialize(CultNetSchemaMessageSerialization.Serialize(response))
+            .Should().BeEquivalentTo(response);
+    }
+
+    private sealed class RouteSource : ICultMeshLookupSource
+    {
+        private readonly string _endpoint;
+
+        public RouteSource(string endpoint = "rudp://127.0.0.14:3076") => _endpoint = endpoint;
+
+        public string SourceId => "test-rendezvous";
+
+        public Task<IReadOnlyList<CultMeshDiscoveryObservation>> LookupAsync(
+            CultMeshDiscoveryQuery query,
+            CancellationToken cancellationToken = default)
+        {
+            var now = DateTimeOffset.UtcNow;
+            return Task.FromResult<IReadOnlyList<CultMeshDiscoveryObservation>>(new[]
+            {
+                new CultMeshDiscoveryObservation(
+                    new CultMeshVerseDescriptor(
+                        "aetheria",
+                        "Aetheria",
+                        CultMeshVerseAuthorityModel.OperatorCluster,
+                        new CultMeshVerseCompatibility("cultmesh.v1", "rules"),
+                        authorityRoutes: new[]
+                        {
+                            new CultMeshAuthorityRoute(
+                                "aetheria.daemon",
+                                _endpoint,
+                                new[] { CultMeshProtocols.Content.Value },
+                                generation: RouteGeneration)
+                        }),
+                    SourceId,
+                    now,
+                    now.AddMinutes(1),
+                    CultMeshDiscoveryTrust.Signed)
+            });
+        }
+    }
+
+    private sealed class LoopbackConnector : ICultMeshTransportConnector
+    {
+        private readonly ICultNetSchemaClient _client;
+        private int _connectCount;
+        public LoopbackConnector(ICultNetSchemaClient client) => _client = client;
+        public string ConnectorId => "loopback";
+        public int Priority => 0;
+        public int ConnectCount => Volatile.Read(ref _connectCount);
+        public bool CanConnect(CultMeshTransportCandidate candidate) => true;
+        public Task<ICultNetSchemaClient> ConnectAsync(
+            CultMeshTransportCandidate candidate,
+            CultMeshProtocolId protocol,
+            CancellationToken cancellationToken = default)
+        {
+            Interlocked.Increment(ref _connectCount);
+            protocol.Should().Be(CultMeshProtocols.Content);
+            return Task.FromResult(_client);
+        }
+    }
+
+    private sealed class LoopbackSchemaServer : ICultNetSchemaServer
+    {
+        private readonly Dictionary<Type, Delegate> _handlers = new();
+
+        public void OnCultNet<TMessage>(Func<TMessage, ICultNetSchemaServerPeer, Task> callback)
+            where TMessage : ICultNetSchemaMessage => _handlers[typeof(TMessage)] = callback;
+
+        public void RemoveCultNetMessageListener<TMessage>(Delegate callback)
+            where TMessage : ICultNetSchemaMessage => _handlers.Remove(typeof(TMessage));
+
+        public Task DispatchAsync<TMessage>(TMessage message, ICultNetSchemaServerPeer peer)
+            where TMessage : ICultNetSchemaMessage =>
+            ((Func<TMessage, ICultNetSchemaServerPeer, Task>)_handlers[typeof(TMessage)])(message, peer);
+    }
+
+    private sealed class LoopbackSchemaClient : ICultNetSchemaClient, ICultMeshVerifiedSchemaClient
+    {
+        private readonly LoopbackSchemaServer _server;
+        private readonly Dictionary<Type, List<Delegate>> _handlers = new();
+        public LoopbackSchemaClient(LoopbackSchemaServer server) => _server = server;
+        public bool Connected => true;
+        public int ContentRequestCount { get; private set; }
+        public int SnapshotRequestCount { get; private set; }
+        public void Connect(string host, int port) { }
+        public void SendCultNet<T>(T message) where T : ICultNetSchemaMessage
+        {
+            if (message is CultMeshContentChunkRequestMessage content)
+            {
+                ContentRequestCount++;
+                _server.DispatchAsync(content, new LoopbackPeer(this)).GetAwaiter().GetResult();
+            }
+            else if (message is CultNetSnapshotRequestMessage)
+            {
+                SnapshotRequestCount++;
+                throw new InvalidOperationException("Content session attempted to use a snapshot request.");
+            }
+        }
+        public void OnCultNet<T>(Action<T> callback) where T : ICultNetSchemaMessage
+        {
+            if (!_handlers.TryGetValue(typeof(T), out var handlers))
+                _handlers[typeof(T)] = handlers = new List<Delegate>();
+            handlers.Add(callback);
+        }
+        public void Dispose() { }
+        public bool IsVerifiedFor(string verseId, string authorityRuntimeId, string protocolId, string routeGeneration) =>
+            verseId == "aetheria" && authorityRuntimeId == "aetheria.daemon";
+        public void Emit<T>(T message) where T : ICultNetSchemaMessage
+        {
+            if (!_handlers.TryGetValue(typeof(T), out var handlers)) return;
+            foreach (var handler in handlers.ToArray()) ((Action<T>)handler)(message);
+        }
+    }
+
+    private sealed class LoopbackPeer : ICultNetSchemaServerPeer
+    {
+        private readonly LoopbackSchemaClient _client;
+        public LoopbackPeer(LoopbackSchemaClient client) => _client = client;
+        public void SendCultNet<TMessage>(TMessage message) where TMessage : ICultNetSchemaMessage =>
+            _client.Emit(message);
+    }
+}
diff --git a/tests/GameCult.Mesh.Tests/CultMeshContentTransferTests.cs b/tests/GameCult.Mesh.Tests/CultMeshContentTransferTests.cs
new file mode 100644
index 00000000..6b5212c3
--- /dev/null
+++ b/tests/GameCult.Mesh.Tests/CultMeshContentTransferTests.cs
@@ -0,0 +1,412 @@
+using System;
+using System.Collections.Concurrent;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using FluentAssertions;
+using GameCult.Caching;
+using GameCult.Caching.MessagePack;
+using NUnit.Framework;
+
+namespace GameCult.Mesh.Tests;
+
+[TestFixture]
+public sealed class CultMeshContentTransferTests
+{
+    private string _directory = null!;
+
+    [SetUp]
+    public void SetUp()
+    {
+        _directory = Path.Combine(Path.GetTempPath(), "cultmesh-transfer-tests", Guid.NewGuid().ToString("N"));
+    }
+
+    [TearDown]
+    public void TearDown()
+    {
+        if (Directory.Exists(_directory)) Directory.Delete(_directory, true);
+    }
+
+    [Test]
+    public async Task FetchAsync_VerifiesChunksAndAtomicallyPublishesFinalBody()
+    {
+        var artifact = Artifact("verified", 4);
+        using var cache = Cache();
+        var provider = new FakeProvider("source", artifact.Chunks);
+        var service = Service(cache, provider);
+
+        var path = await service.FetchAsync(artifact.Manifest);
+
+        File.ReadAllBytes(path).Should().Equal(Payload());
+        Directory.GetFiles(_directory, "*.partial").Should().BeEmpty();
+        cache.Get<CultMeshContentTransferStateDocument>(StateKey(artifact.Manifest)).Should().BeNull();
+    }
+
+    [Test]
+    public async Task FetchAsync_FailsOverAfterProviderCorruption()
+    {
+        var artifact = Artifact("failover", 4);
+        using var cache = Cache();
+        var corrupt = artifact.Chunks.Select(Clone).ToArray();
+        corrupt[0].Payload[0] ^= 0xff;
+        var first = new FakeProvider("corrupt", corrupt);
+        var second = new FakeProvider("good", artifact.Chunks);
+
+        var path = await Service(cache, first, second).FetchAsync(artifact.Manifest);
+
+        File.ReadAllBytes(path).Should().Equal(Payload());
+        first.Requests.Should().ContainKey(artifact.Manifest.Chunks[0].ChunkHash);
+        second.Requests.Should().ContainKey(artifact.Manifest.Chunks[0].ChunkHash);
+    }
+
+    [Test]
+    public async Task FetchAsync_CancellationLeavesVerifiedCheckpointAndResumeSkipsIt()
+    {
+        var artifact = Artifact("resume", 4);
+        var statePath = Path.Combine(_directory, "transfer-state.cc");
+        using var cache = DurableCache(statePath);
+        using var cancellation = new CancellationTokenSource();
+        var provider = new FakeProvider("source", artifact.Chunks) { BlockFromRequest = 2 };
+        var service = Service(cache, provider);
+        var fetch = service.FetchAsync(artifact.Manifest, cancellation.Token);
+
+        await WaitUntilAsync(() => cache.Get<CultMeshContentTransferStateDocument>(StateKey(artifact.Manifest))?.VerifiedChunkIndexes.Length == 1);
+        cancellation.Cancel();
+        await FluentActions.Awaiting(() => fetch).Should().ThrowAsync<OperationCanceledException>();
+        File.Exists(Path.Combine(_directory, artifact.Manifest.ContentHash + ".body")).Should().BeFalse();
+        cache.Dispose();
+
+        using var restoredCache = DurableCache(statePath);
+        await restoredCache.PullAllBackingStoresAsync();
+        restoredCache.Get<CultMeshContentTransferStateDocument>(StateKey(artifact.Manifest))
+            .Should().NotBeNull("the verified checkpoint must survive a cache restart");
+        var resumedProvider = new FakeProvider("resume", artifact.Chunks);
+        var path = await Service(restoredCache, resumedProvider).FetchAsync(artifact.Manifest);
+
+        File.ReadAllBytes(path).Should().Equal(Payload());
+        resumedProvider.Requests.Should().NotContainKey(artifact.Manifest.Chunks[0].ChunkHash);
+    }
+
+    [Test]
+    public async Task FetchAsync_RejectsForgedCheckpointAfterRehashingClaimedChunks()
+    {
+        var artifact = Artifact("forged", 4);
+        using var cache = Cache();
+        using var cancellation = new CancellationTokenSource();
+        var firstProvider = new FakeProvider("first", artifact.Chunks) { BlockFromRequest = 2 };
+        var firstFetch = Service(cache, firstProvider).FetchAsync(artifact.Manifest, cancellation.Token);
+        await WaitUntilAsync(() => cache.Get<CultMeshContentTransferStateDocument>(StateKey(artifact.Manifest))?.VerifiedChunkIndexes.Length == 1);
+        cancellation.Cancel();
+        await FluentActions.Awaiting(() => firstFetch).Should().ThrowAsync<OperationCanceledException>();
+
+        var partial = Path.Combine(_directory, "." + artifact.Manifest.ContentHash + ".partial");
+        var bytes = File.ReadAllBytes(partial);
+        bytes[0] ^= 0xff;
+        File.WriteAllBytes(partial, bytes);
+
+        var provider = new FakeProvider("source", artifact.Chunks);
+        await Service(cache, provider).FetchAsync(artifact.Manifest);
+
+        provider.Requests.Values.Sum().Should().Be(artifact.Chunks.Count);
+        File.ReadAllBytes(Path.Combine(_directory, artifact.Manifest.ContentHash + ".body")).Should().Equal(Payload());
+    }
+
+    [Test]
+    public async Task FetchAsync_FinalHashFailurePublishesNoBodyOrTrustedCheckpoint()
+    {
+        var artifact = Artifact("wrong-final", 4);
+        artifact.Manifest.ContentHash = new string('0', 64);
+        using var cache = Cache();
+
+        await FluentActions.Awaiting(() => Service(cache, new FakeProvider("source", artifact.Chunks)).FetchAsync(artifact.Manifest))
+            .Should().ThrowAsync<InvalidDataException>();
+
+        File.Exists(Path.Combine(_directory, new string('0', 64) + ".body")).Should().BeFalse();
+        cache.Get<CultMeshContentTransferStateDocument>(new CultRecordKey("mesh:content-transfer:" + new string('0', 64))).Should().BeNull();
+    }
+
+    [Test]
+    public async Task FetchAsync_ConcurrentRequestsShareVerifiedWork()
+    {
+        var artifact = Artifact("shared", 4);
+        using var cache = Cache();
+        var provider = new FakeProvider("source", artifact.Chunks) { DelayMilliseconds = 20 };
+        var service = Service(cache, provider);
+
+        var paths = await Task.WhenAll(service.FetchAsync(artifact.Manifest), service.FetchAsync(artifact.Manifest));
+
+        paths[0].Should().Be(paths[1]);
+        provider.Requests.Values.Sum().Should().Be(artifact.Chunks.Count);
+    }
+
+    [Test]
+    public async Task FetchAsync_PipelinesRequestsWithinConfiguredBoundAndCommitsInManifestOrder()
+    {
+        var artifact = Artifact("pipelined", 2);
+        using var cache = Cache();
+        var provider = new FakeProvider("source", artifact.Chunks)
+        {
+            DelayMilliseconds = 40,
+            BlockedChunkHash = artifact.Chunks[0].ChunkHash
+        };
+        var service = new CultMeshContentTransferService(
+            cache,
+            new[] { provider },
+            new CultMeshContentTransferOptions(_directory) { MaxConcurrentChunkRequests = 3 });
+
+        var fetch = service.FetchAsync(artifact.Manifest);
+        try
+        {
+            await provider.BlockedChunkRequested.Task.WaitAsync(TimeSpan.FromSeconds(2));
+            await WaitUntilAsync(() => provider.Requests.Values.Sum() >= 3 && provider.ActiveRequests == 1);
+
+            var pendingState = cache.Get<CultMeshContentTransferStateDocument>(StateKey(artifact.Manifest));
+            (pendingState?.VerifiedChunkIndexes ?? Array.Empty<int>()).Should().BeEmpty(
+                "later chunks may finish fetching but cannot be checkpointed ahead of the first manifest chunk");
+        }
+        finally
+        {
+            provider.ReleaseBlockedChunk();
+        }
+        var path = await fetch;
+
+        File.ReadAllBytes(path).Should().Equal(Payload());
+        provider.MaxConcurrentRequests.Should().Be(3);
+        provider.Requests.Values.Sum().Should().Be(artifact.Chunks.Count);
+        cache.Get<CultMeshContentTransferStateDocument>(StateKey(artifact.Manifest)).Should().BeNull();
+    }
+
+    [Test]
+    public void Constructor_RejectsNonPositiveConcurrentChunkBound()
+    {
+        using var cache = Cache();
+        var options = new CultMeshContentTransferOptions(_directory) { MaxConcurrentChunkRequests = 0 };
+
+        FluentActions.Invoking(() => new CultMeshContentTransferService(
+                cache,
+                new[] { new FakeProvider("source", Array.Empty<CultMeshCdnArtifactChunk>()) },
+                options))
+            .Should().Throw<ArgumentOutOfRangeException>();
+    }
+
+    [Test]
+    public async Task FetchAsync_CheckpointsVerifiedWindowPeersWhenEarlierFetchFails()
+    {
+        var artifact = Artifact("failed-window", 2);
+        using var cache = Cache();
+        var provider = new FakeProvider("source", artifact.Chunks)
+        {
+            DelayMilliseconds = 80,
+            FailedChunkHash = artifact.Chunks[0].ChunkHash
+        };
+        var service = new CultMeshContentTransferService(
+            cache,
+            new[] { provider },
+            new CultMeshContentTransferOptions(_directory) { MaxConcurrentChunkRequests = 3 });
+
+        await FluentActions.Awaiting(() => service.FetchAsync(artifact.Manifest))
+            .Should().ThrowAsync<InvalidDataException>();
+
+        provider.ActiveRequests.Should().Be(0, "the failed window must observe every task before returning");
+        cache.Get<CultMeshContentTransferStateDocument>(StateKey(artifact.Manifest))!
+            .VerifiedChunkIndexes.Should().Equal(1, 2);
+        File.Exists(Path.Combine(_directory, artifact.Manifest.ContentHash + ".body")).Should().BeFalse();
+    }
+
+    [Test]
+    public async Task FetchMappedBodyAsync_MapsOnlyCommittedBodyForMultipleConsumersAndFallsBackToNetwork()
+    {
+        var artifact = Artifact("mapped", 4);
+        using var cache = Cache();
+        var broker = new CultMeshVerifiedBodyMappingBroker(_directory);
+        var service = new CultMeshContentTransferService(
+            cache,
+            new[] { new FakeProvider("source", artifact.Chunks) },
+            new CultMeshContentTransferOptions(_directory),
+            broker);
+        var now = DateTimeOffset.UtcNow;
+        var network = NetworkDescriptor(artifact, now);
+
+        var firstContent = await service.FetchMappedContentAsync(
+            artifact.Manifest, network, now, TimeSpan.FromMinutes(1));
+        var first = firstContent.Descriptor;
+        var second = await service.FetchMappedBodyAsync(artifact.Manifest, network, now, TimeSpan.FromMinutes(1));
+
+        first.Should().BeEquivalentTo(second, options => options.Excluding(value => value.CapabilityToken));
+        firstContent.VerifiedPath.Should().Be(Path.Combine(_directory, artifact.Manifest.ContentHash + ".body"));
+        first.CapabilityToken.Should().NotBe(artifact.Manifest.ContentHash);
+        first.CapabilityToken.Should().NotContain(Path.DirectorySeparatorChar.ToString());
+        first.CapabilityToken.Should().NotContain(Path.AltDirectorySeparatorChar.ToString());
+        Directory.GetFiles(_directory, "*.body").Should().ContainSingle()
+            .Which.Should().Be(Path.Combine(_directory, artifact.Manifest.ContentHash + ".body"));
+        Directory.GetFiles(_directory, "*.partial").Should().BeEmpty();
+
+        var adapter = new CultMeshMappedBodyAdapter(broker);
+        using (var firstLease = adapter.OpenReadOnly(first, Request(first, now)))
+        using (var secondLease = adapter.OpenReadOnly(second, Request(second, now)))
+        {
+            var firstBytes = new byte[first.ByteSize];
+            var secondBytes = new byte[second.ByteSize];
+            firstLease.CopyTo(0, firstBytes, 0, firstBytes.Length);
+            secondLease.CopyTo(0, secondBytes, 0, secondBytes.Length);
+            firstBytes.Should().Equal(Payload());
+            secondBytes.Should().Equal(Payload());
+        }
+
+        File.Delete(Path.Combine(_directory, artifact.Manifest.ContentHash + ".body"));
+        var transport = new CultMeshBodyTransportService(
+            new ICultMeshBodyTransportAdapter[]
+            {
+                adapter,
+                new CultMeshNetworkBodyAdapter(_ => Payload())
+            },
+            _ => true);
+
+        using var fallback = transport.OpenReadOnly(first, network, Request(first, now), out var localFailure);
+
+        localFailure.Should().BeOfType<InvalidDataException>();
+        fallback.TransportKind.Should().Be(CultMeshBodyTransportKind.Network);
+        fallback.Descriptor.BodyId.Should().Be(first.BodyId);
+    }
+
+    private CultMeshContentTransferService Service(CultCache cache, params ICultMeshContentProvider[] providers) =>
+        new(cache, providers, new CultMeshContentTransferOptions(_directory));
+
+    private static CultCache Cache()
+    {
+        var registry = CultMesh.CreateCultCacheDocumentRegistry(typeof(CultMeshContentTransferStateDocument));
+        return new CultCache(registry);
+    }
+
+    private static CultCache DurableCache(string path)
+    {
+        var cache = Cache();
+        cache.AddBackingStore(new SingleFileMessagePackBackingStore(path));
+        return cache;
+    }
+
+    private static CultMeshCdnArtifact Artifact(string id, int chunkSize) =>
+        CultMesh.PackCdnArtifact(id, Payload(), new CultMeshCdnPackOptions { ChunkSizeBytes = chunkSize });
+
+    private static byte[] Payload() => Enumerable.Range(0, 19).Select(value => (byte)(value + 1)).ToArray();
+
+    private static CultRecordKey StateKey(CultMeshCdnArtifactManifest manifest) =>
+        new("mesh:content-transfer:" + manifest.ContentHash);
+
+    private static CultMeshBodyDescriptor NetworkDescriptor(CultMeshCdnArtifact artifact, DateTimeOffset now) => new()
+    {
+        BodyId = artifact.Manifest.ArtifactId,
+        SchemaId = "gamecult.mesh.cdn-artifact.v1",
+        LayoutVersion = 1,
+        ByteSize = artifact.Manifest.SizeBytes,
+        Capacity = checked((int)artifact.Manifest.SizeBytes),
+        ProducerEpoch = 4,
+        Sequence = 7,
+        AccessMode = CultMeshBodyAccessMode.ReadOnly,
+        Synchronization = CultMeshBodySynchronization.ImmutableSequence,
+        LeaseExpiresAtUnixMs = now.AddMinutes(2).ToUnixTimeMilliseconds(),
+        TransportKind = CultMeshBodyTransportKind.Network,
+        SemanticHash = artifact.Manifest.ContentHash
+    };
+
+    private static CultMeshBodyValidationRequest Request(CultMeshBodyDescriptor descriptor, DateTimeOffset now) => new()
+    {
+        BodyId = descriptor.BodyId,
+        SchemaId = descriptor.SchemaId,
+        LayoutVersion = descriptor.LayoutVersion,
+        ProducerEpoch = descriptor.ProducerEpoch,
+        Sequence = descriptor.Sequence,
+        Capacity = descriptor.Capacity,
+        AccessMode = CultMeshBodyAccessMode.ReadOnly,
+        NowUtc = now
+    };
+
+    private static CultMeshCdnArtifactChunk Clone(CultMeshCdnArtifactChunk chunk) => new()
+    {
+        ChunkHash = chunk.ChunkHash,
+        SizeBytes = chunk.SizeBytes,
+        Payload = chunk.Payload.ToArray()
+    };
+
+    private static async Task WaitUntilAsync(Func<bool> predicate)
+    {
+        var deadline = DateTime.UtcNow.AddSeconds(5);
+        while (!predicate())
+        {
+            if (DateTime.UtcNow >= deadline) throw new TimeoutException("Condition was not observed.");
+            await Task.Delay(10);
+        }
+    }
+
+    private sealed class FakeProvider : ICultMeshContentProvider
+    {
+        private readonly Dictionary<string, CultMeshCdnArtifactChunk> _chunks;
+        private int _requestCount;
+        private int _activeRequests;
+        private int _maxConcurrentRequests;
+        private readonly TaskCompletionSource<bool> _releaseBlockedChunk = new(TaskCreationOptions.RunContinuationsAsynchronously);
+
+        public FakeProvider(string providerId, IEnumerable<CultMeshCdnArtifactChunk> chunks)
+        {
+            ProviderId = providerId;
+            _chunks = chunks.ToDictionary(chunk => chunk.ChunkHash, Clone, StringComparer.Ordinal);
+        }
+
+        public string ProviderId { get; }
+        public ConcurrentDictionary<string, int> Requests { get; } = new(StringComparer.Ordinal);
+        public int BlockFromRequest { get; set; } = int.MaxValue;
+        public int DelayMilliseconds { get; set; }
+        public string? BlockedChunkHash { get; set; }
+        public string? FailedChunkHash { get; set; }
+        public TaskCompletionSource<bool> BlockedChunkRequested { get; } = new(TaskCreationOptions.RunContinuationsAsynchronously);
+        public int ActiveRequests => Volatile.Read(ref _activeRequests);
+        public int MaxConcurrentRequests => Volatile.Read(ref _maxConcurrentRequests);
+
+        public void ReleaseBlockedChunk() => _releaseBlockedChunk.TrySetResult(true);
+
+        public async Task CopyChunkToAsync(
+            CultMeshCdnChunkRef chunk,
+            Stream destination,
+            CancellationToken cancellationToken = default)
+        {
+            Requests.AddOrUpdate(chunk.ChunkHash, 1, (_, count) => count + 1);
+            var request = Interlocked.Increment(ref _requestCount);
+            var active = Interlocked.Increment(ref _activeRequests);
+            UpdateMaximum(ref _maxConcurrentRequests, active);
+            try
+            {
+                if (request >= BlockFromRequest)
+                    await Task.Delay(Timeout.Infinite, cancellationToken);
+                if (string.Equals(chunk.ChunkHash, FailedChunkHash, StringComparison.Ordinal))
+                    throw new InvalidDataException("Synthetic chunk failure.");
+                if (string.Equals(chunk.ChunkHash, BlockedChunkHash, StringComparison.Ordinal))
+                {
+                    BlockedChunkRequested.TrySetResult(true);
+                    await _releaseBlockedChunk.Task.WaitAsync(cancellationToken);
+                }
+                if (DelayMilliseconds > 0)
+                    await Task.Delay(DelayMilliseconds, cancellationToken);
+                if (!_chunks.TryGetValue(chunk.ChunkHash, out var value))
+                    throw new FileNotFoundException("Synthetic content chunk is missing.", chunk.RecordKey);
+                await destination.WriteAsync(value.Payload, cancellationToken);
+            }
+            finally
+            {
+                Interlocked.Decrement(ref _activeRequests);
+            }
+        }
+
+        private static void UpdateMaximum(ref int maximum, int candidate)
+        {
+            var observed = Volatile.Read(ref maximum);
+            while (candidate > observed)
+            {
+                var previous = Interlocked.CompareExchange(ref maximum, candidate, observed);
+                if (previous == observed) return;
+                observed = previous;
+            }
+        }
+    }
+}
diff --git a/tests/GameCult.Mesh.Tests/CultMeshDeterministicNetwork.cs b/tests/GameCult.Mesh.Tests/CultMeshDeterministicNetwork.cs
new file mode 100644
index 00000000..5573204a
--- /dev/null
+++ b/tests/GameCult.Mesh.Tests/CultMeshDeterministicNetwork.cs
@@ -0,0 +1,131 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+
+#nullable enable
+
+namespace GameCult.Mesh.Tests;
+
+internal enum CultMeshFaultKind
+{
+    Drop,
+    Duplicate,
+    Delay,
+    Reorder,
+    Partition,
+    Corrupt,
+    RotateEndpoint,
+    Restart
+}
+
+internal sealed record CultMeshFault(
+    long SendOrdinal,
+    CultMeshFaultKind Kind,
+    TimeSpan Delay = default,
+    string Endpoint = "");
+
+internal sealed record CultMeshTestPacket(
+    long SendOrdinal,
+    string Endpoint,
+    byte[] Payload,
+    DateTimeOffset DeliverAtUtc,
+    long DeliveryOrdinal);
+
+/// <summary>
+/// Transport-neutral hostile-network harness. Delivery is driven only by the
+/// injected clock and schedule, so a failure timeline is exactly replayable.
+/// </summary>
+internal sealed class CultMeshDeterministicNetwork
+{
+    private readonly Func<DateTimeOffset> _utcNow;
+    private readonly Dictionary<long, CultMeshFault[]> _faults;
+    private readonly List<CultMeshTestPacket> _pending = new();
+    private long _sendOrdinal;
+    private long _deliveryOrdinal;
+    private bool _partitioned;
+    private string _endpoint;
+
+    public CultMeshDeterministicNetwork(
+        Func<DateTimeOffset> utcNow,
+        string endpoint,
+        IEnumerable<CultMeshFault>? faults = null)
+    {
+        _utcNow = utcNow ?? throw new ArgumentNullException(nameof(utcNow));
+        _endpoint = endpoint ?? throw new ArgumentNullException(nameof(endpoint));
+        _faults = (faults ?? Array.Empty<CultMeshFault>())
+            .GroupBy(fault => fault.SendOrdinal)
+            .ToDictionary(group => group.Key, group => group.ToArray());
+    }
+
+    public int RestartCount { get; private set; }
+
+    public string Endpoint => _endpoint;
+
+    public void Send(byte[] payload)
+    {
+        if (payload == null) throw new ArgumentNullException(nameof(payload));
+        var ordinal = ++_sendOrdinal;
+        var copies = 1;
+        var delay = TimeSpan.Zero;
+        var reorder = false;
+        var dropped = false;
+        var bytes = payload.ToArray();
+
+        foreach (var fault in _faults.GetValueOrDefault(ordinal, Array.Empty<CultMeshFault>()))
+        {
+            switch (fault.Kind)
+            {
+                case CultMeshFaultKind.Drop:
+                    dropped = true;
+                    break;
+                case CultMeshFaultKind.Duplicate:
+                    copies++;
+                    break;
+                case CultMeshFaultKind.Delay:
+                    delay += fault.Delay;
+                    break;
+                case CultMeshFaultKind.Reorder:
+                    reorder = true;
+                    break;
+                case CultMeshFaultKind.Partition:
+                    _partitioned = !_partitioned;
+                    break;
+                case CultMeshFaultKind.Corrupt:
+                    if (bytes.Length > 0) bytes[0] ^= 0xff;
+                    break;
+                case CultMeshFaultKind.RotateEndpoint:
+                    _endpoint = fault.Endpoint;
+                    break;
+                case CultMeshFaultKind.Restart:
+                    _pending.Clear();
+                    _partitioned = false;
+                    RestartCount++;
+                    break;
+            }
+        }
+
+        if (dropped || _partitioned) return;
+        for (var copy = 0; copy < copies; copy++)
+        {
+            var deliveryOrdinal = ++_deliveryOrdinal;
+            _pending.Add(new CultMeshTestPacket(
+                ordinal,
+                _endpoint,
+                bytes.ToArray(),
+                _utcNow() + delay,
+                reorder ? -deliveryOrdinal : deliveryOrdinal));
+        }
+    }
+
+    public IReadOnlyList<CultMeshTestPacket> ReceiveAvailable()
+    {
+        var now = _utcNow();
+        var available = _pending
+            .Where(packet => packet.DeliverAtUtc <= now)
+            .OrderBy(packet => packet.DeliverAtUtc)
+            .ThenBy(packet => packet.DeliveryOrdinal)
+            .ToArray();
+        foreach (var packet in available) _pending.Remove(packet);
+        return available;
+    }
+}
diff --git a/tests/GameCult.Mesh.Tests/CultMeshDiscoveryServiceTests.cs b/tests/GameCult.Mesh.Tests/CultMeshDiscoveryServiceTests.cs
new file mode 100644
index 00000000..2313a5bd
--- /dev/null
+++ b/tests/GameCult.Mesh.Tests/CultMeshDiscoveryServiceTests.cs
@@ -0,0 +1,347 @@
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using FluentAssertions;
+using GameCult.Caching;
+using GameCult.Caching.MessagePack;
+using NUnit.Framework;
+using R3;
+
+namespace GameCult.Mesh.Tests;
+
+public sealed class CultMeshDiscoveryServiceTests
+{
+    [Test]
+    public async Task Resolve_QueriesSourcesConcurrentlyAndKeepsSuccessfulResult()
+    {
+        var clock = new ManualClock(new DateTimeOffset(2026, 7, 12, 20, 0, 0, TimeSpan.Zero));
+        var bothStarted = new TaskCompletionSource(TaskCreationOptions.RunContinuationsAsynchronously);
+        var started = 0;
+        async Task<IReadOnlyList<CultMeshDiscoveryObservation>> Lookup(bool fail)
+        {
+            if (Interlocked.Increment(ref started) == 2) bothStarted.TrySetResult();
+            await bothStarted.Task;
+            if (fail) throw new IOException("source offline");
+            return new[] { Observation("aetheria", "good", clock, TimeSpan.FromMinutes(1), CultMeshDiscoveryTrust.Signed) };
+        }
+
+        using var service = new CultMeshDiscoveryService(
+            new[]
+            {
+                new DelegateSource("dead", _ => Lookup(true)),
+                new DelegateSource("good", _ => Lookup(false))
+            },
+            new CultMeshDiscoveryServiceOptions { Clock = clock });
+        var observed = new List<CultMeshDiscoveryState>();
+        using var subscription = service.Watch().Subscribe(state => observed.Add(state));
+
+        var state = await service.ResolveAsync(new CultMeshDiscoveryQuery("odin:aetheria"));
+
+        state.Freshness.Should().Be(CultMeshDiscoveryFreshness.Degraded);
+        state.Candidates.Should().ContainSingle().Which.Descriptor.VerseId.Should().Be("aetheria");
+        state.FailedSourceIds.Should().Equal("dead");
+        observed.Should().ContainSingle().Which.Should().BeSameAs(state);
+    }
+
+    [Test]
+    public async Task Resolve_SharesInflightLookupAcrossConcurrentCallers()
+    {
+        var clock = new ManualClock(new DateTimeOffset(2026, 7, 12, 20, 0, 0, TimeSpan.Zero));
+        var release = new TaskCompletionSource(TaskCreationOptions.RunContinuationsAsynchronously);
+        var source = new DelegateSource("odin", async _ =>
+        {
+            await release.Task;
+            return new[] { Observation("aetheria", "odin", clock, TimeSpan.FromMinutes(1), CultMeshDiscoveryTrust.Signed) };
+        });
+        using var service = new CultMeshDiscoveryService(new[] { source }, new CultMeshDiscoveryServiceOptions { Clock = clock });
+        var query = new CultMeshDiscoveryQuery("odin:aetheria");
+
+        var first = service.ResolveAsync(query);
+        var second = service.ResolveAsync(query);
+        await WaitUntilAsync(() => source.LookupCount == 1);
+        release.TrySetResult();
+        var states = await Task.WhenAll(first, second);
+
+        source.LookupCount.Should().Be(1);
+        states[0].Should().BeSameAs(states[1]);
+    }
+
+    [Test]
+    public async Task Resolve_CallerCancellationDoesNotCancelSharedLookup()
+    {
+        var clock = new ManualClock(new DateTimeOffset(2026, 7, 12, 20, 0, 0, TimeSpan.Zero));
+        var release = new TaskCompletionSource(TaskCreationOptions.RunContinuationsAsynchronously);
+        var source = new DelegateSource("odin", async _ =>
+        {
+            await release.Task;
+            return new[] { Observation("aetheria", "odin", clock, TimeSpan.FromMinutes(1), CultMeshDiscoveryTrust.Signed) };
+        });
+        using var service = new CultMeshDiscoveryService(new[] { source }, new CultMeshDiscoveryServiceOptions { Clock = clock });
+        using var cancelledCaller = new CancellationTokenSource();
+        var query = new CultMeshDiscoveryQuery("odin:aetheria");
+
+        var cancelled = service.ResolveAsync(query, cancelledCaller.Token);
+        var survivor = service.ResolveAsync(query);
+        await WaitUntilAsync(() => source.LookupCount == 1);
+        cancelledCaller.Cancel();
+        Assert.ThrowsAsync<OperationCanceledException>(async () => await cancelled);
+        release.TrySetResult();
+
+        (await survivor).Candidates.Should().ContainSingle();
+        source.LookupCount.Should().Be(1);
+    }
+
+    [Test]
+    public async Task Resolve_HonorsNegativeExpiryWithoutRepeatingLookup()
+    {
+        var clock = new ManualClock(new DateTimeOffset(2026, 7, 12, 20, 0, 0, TimeSpan.Zero));
+        var source = new DelegateSource("odin", _ =>
+            Task.FromException<IReadOnlyList<CultMeshDiscoveryObservation>>(new IOException("offline")));
+        using var service = new CultMeshDiscoveryService(
+            new[] { source },
+            new CultMeshDiscoveryServiceOptions { Clock = clock, NegativeTtl = TimeSpan.FromSeconds(30) });
+        var query = new CultMeshDiscoveryQuery("odin:aetheria");
+
+        (await service.ResolveAsync(query)).Freshness.Should().Be(CultMeshDiscoveryFreshness.Unavailable);
+        (await service.ResolveAsync(query)).Freshness.Should().Be(CultMeshDiscoveryFreshness.Unavailable);
+        source.LookupCount.Should().Be(1);
+
+        clock.Advance(TimeSpan.FromSeconds(31));
+        await service.ResolveAsync(query);
+        source.LookupCount.Should().Be(2);
+    }
+
+    [Test]
+    public async Task Resolve_KeepsDifferentlyConstrainedProjectionsIsolated()
+    {
+        var clock = new ManualClock(new DateTimeOffset(2026, 7, 12, 20, 0, 0, TimeSpan.Zero));
+        var source = new DelegateSource("odin", _ => Task.FromResult<IReadOnlyList<CultMeshDiscoveryObservation>>(
+            new[]
+            {
+                Observation("aetheria", "odin", clock, TimeSpan.FromMinutes(1), CultMeshDiscoveryTrust.Signed),
+                Observation("norn", "odin", clock, TimeSpan.FromMinutes(1), CultMeshDiscoveryTrust.Signed)
+            }));
+        using var service = new CultMeshDiscoveryService(new[] { source }, new CultMeshDiscoveryServiceOptions { Clock = clock });
+
+        var aetheria = await service.ResolveAsync(new CultMeshDiscoveryQuery("odin:games", new[] { "aetheria" }));
+        var norn = await service.ResolveAsync(new CultMeshDiscoveryQuery("odin:games", new[] { "norn" }));
+
+        aetheria.Candidates.Select(candidate => candidate.Descriptor.VerseId).Should().Equal("aetheria");
+        norn.Candidates.Select(candidate => candidate.Descriptor.VerseId).Should().Equal("norn");
+        aetheria.QueryKey.Should().NotBe(norn.QueryKey);
+        source.LookupCount.Should().Be(2);
+    }
+
+    [Test]
+    public async Task Resolve_PreservesExpiredLastKnownGoodAsStaleAfterFailure()
+    {
+        var clock = new ManualClock(new DateTimeOffset(2026, 7, 12, 20, 0, 0, TimeSpan.Zero));
+        var failing = false;
+        var source = new DelegateSource("odin", _ => failing
+            ? Task.FromException<IReadOnlyList<CultMeshDiscoveryObservation>>(new IOException("partition"))
+            : Task.FromResult<IReadOnlyList<CultMeshDiscoveryObservation>>(
+                new[] { Observation("aetheria", "odin", clock, TimeSpan.FromSeconds(5), CultMeshDiscoveryTrust.Signed) }));
+        using var service = new CultMeshDiscoveryService(new[] { source }, new CultMeshDiscoveryServiceOptions { Clock = clock });
+        var query = new CultMeshDiscoveryQuery("odin:aetheria");
+
+        (await service.ResolveAsync(query)).Freshness.Should().Be(CultMeshDiscoveryFreshness.Fresh);
+        clock.Advance(TimeSpan.FromSeconds(6));
+        failing = true;
+        var stale = await service.ResolveAsync(query);
+
+        stale.Freshness.Should().Be(CultMeshDiscoveryFreshness.Stale);
+        stale.Candidates.Should().ContainSingle().Which.Descriptor.VerseId.Should().Be("aetheria");
+    }
+
+    [Test]
+    public async Task Current_DerivesStaleStateImmediatelyAfterCandidateExpiry()
+    {
+        var clock = new ManualClock(new DateTimeOffset(2026, 7, 12, 20, 0, 0, TimeSpan.Zero));
+        using var service = new CultMeshDiscoveryService(
+            new[]
+            {
+                new DelegateSource("odin", _ => Task.FromResult<IReadOnlyList<CultMeshDiscoveryObservation>>(
+                    new[] { Observation("aetheria", "odin", clock, TimeSpan.FromSeconds(5), CultMeshDiscoveryTrust.Signed) }))
+            },
+            new CultMeshDiscoveryServiceOptions { Clock = clock });
+        await service.ResolveAsync(new CultMeshDiscoveryQuery("odin:aetheria"));
+
+        clock.Advance(TimeSpan.FromSeconds(6));
+
+        service.Current("odin:aetheria")!.Freshness.Should().Be(CultMeshDiscoveryFreshness.Stale);
+    }
+
+    [Test]
+    public async Task Resolve_SignedCandidateCannotBeOverriddenByRejectedObservation()
+    {
+        var clock = new ManualClock(new DateTimeOffset(2026, 7, 12, 20, 0, 0, TimeSpan.Zero));
+        var signed = Observation("aetheria", "odin", clock, TimeSpan.FromMinutes(1), CultMeshDiscoveryTrust.Signed, "rudp://trusted:3076");
+        var poisoned = Observation("aetheria", "gossip", clock, TimeSpan.FromMinutes(2), CultMeshDiscoveryTrust.Rejected, "rudp://poison:3076");
+        using var service = new CultMeshDiscoveryService(
+            new[]
+            {
+                new DelegateSource("odin", _ => Task.FromResult<IReadOnlyList<CultMeshDiscoveryObservation>>(new[] { signed })),
+                new DelegateSource("gossip", _ => Task.FromResult<IReadOnlyList<CultMeshDiscoveryObservation>>(new[] { poisoned }))
+            },
+            new CultMeshDiscoveryServiceOptions { Clock = clock });
+
+        var state = await service.ResolveAsync(new CultMeshDiscoveryQuery("odin:aetheria"));
+
+        state.Candidates.Should().ContainSingle();
+        state.Candidates[0].SourceId.Should().Be("odin");
+        state.Candidates[0].Descriptor.DiscoveryEndpoints.Should().Equal("rudp://trusted:3076");
+    }
+
+    [Test]
+    public async Task CultCacheStore_ReconstructsLastKnownGoodAfterRestart()
+    {
+        var root = Path.Combine(Path.GetTempPath(), "cultmesh-discovery-" + Guid.NewGuid().ToString("N"));
+        Directory.CreateDirectory(root);
+        var path = Path.Combine(root, "discovery.cc");
+        try
+        {
+            var clock = new ManualClock(new DateTimeOffset(2026, 7, 12, 20, 0, 0, TimeSpan.Zero));
+            using (var cache = new CultCache())
+            {
+                cache.AddBackingStore(new SingleFileMessagePackBackingStore(path));
+                using var writer = new CultMeshDiscoveryService(
+                    new[]
+                    {
+                        new DelegateSource("odin", _ => Task.FromResult<IReadOnlyList<CultMeshDiscoveryObservation>>(
+                            new[] { Observation("aetheria", "odin", clock, TimeSpan.FromMinutes(1), CultMeshDiscoveryTrust.Signed) }))
+                    },
+                    new CultMeshDiscoveryServiceOptions { Clock = clock, Store = new CultMeshCultCacheDiscoveryStore(cache) });
+                (await writer.ResolveAsync(new CultMeshDiscoveryQuery("odin:aetheria"))).Freshness
+                    .Should().Be(CultMeshDiscoveryFreshness.Fresh);
+            }
+
+            clock.Advance(TimeSpan.FromMinutes(2));
+            using var restoredCache = new CultCache();
+            restoredCache.AddBackingStore(new SingleFileMessagePackBackingStore(path));
+            await restoredCache.PullAllBackingStoresAsync();
+            using var reader = new CultMeshDiscoveryService(
+                new[] { new DelegateSource("odin", _ => Task.FromException<IReadOnlyList<CultMeshDiscoveryObservation>>(new IOException("offline"))) },
+                new CultMeshDiscoveryServiceOptions { Clock = clock, Store = new CultMeshCultCacheDiscoveryStore(restoredCache) });
+
+            var restored = await reader.ResolveAsync(new CultMeshDiscoveryQuery("odin:aetheria"));
+            restored.Freshness.Should().Be(CultMeshDiscoveryFreshness.Stale);
+            restored.Candidates.Should().ContainSingle().Which.SourceId.Should().Be("odin");
+        }
+        finally
+        {
+            if (Directory.Exists(root)) Directory.Delete(root, recursive: true);
+        }
+    }
+
+    [Test]
+    public async Task Invalidate_BypassesFreshMemoryAndPersistedRoutesForTheNextLookup()
+    {
+        var clock = new ManualClock(new DateTimeOffset(2026, 8, 18, 0, 0, 0, TimeSpan.Zero));
+        var route = "rudp://first:3076";
+        var source = new DelegateSource("odin", _ => Task.FromResult<IReadOnlyList<CultMeshDiscoveryObservation>>(
+            new[] { Observation("aetheria", "odin", clock, TimeSpan.FromMinutes(5), CultMeshDiscoveryTrust.Signed, route) }));
+        using var cache = new CultCache();
+        using var service = new CultMeshDiscoveryService(
+            new[] { source },
+            new CultMeshDiscoveryServiceOptions
+            {
+                Clock = clock,
+                Store = new CultMeshCultCacheDiscoveryStore(cache)
+            });
+        var query = new CultMeshDiscoveryQuery("aetheria", new[] { "aetheria" });
+
+        var first = await service.ResolveAsync(query);
+        route = "rudp://second:3076";
+        service.Invalidate(query);
+        var second = await service.ResolveAsync(query);
+
+        first.Candidates.Single().Descriptor.DiscoveryEndpoints.Should().Equal("rudp://first:3076");
+        second.Candidates.Single().Descriptor.DiscoveryEndpoints.Should().Equal("rudp://second:3076");
+        source.LookupCount.Should().Be(2);
+    }
+
+    [Test]
+    public async Task Resolve_RejectsVerseRouteThatDoesNotAdvertiseRequestedProvider()
+    {
+        var clock = new ManualClock(new DateTimeOffset(2026, 8, 18, 0, 0, 0, TimeSpan.Zero));
+        var source = new DelegateSource("odin", _ => Task.FromResult<IReadOnlyList<CultMeshDiscoveryObservation>>(
+            new[] { Observation("aetheria", "odin", clock, TimeSpan.FromMinutes(1), CultMeshDiscoveryTrust.Signed) }));
+        using var service = new CultMeshDiscoveryService(
+            new[] { source },
+            new CultMeshDiscoveryServiceOptions { Clock = clock });
+
+        var state = await service.ResolveAsync(new CultMeshDiscoveryQuery(
+            "forged-provider",
+            new[] { "aetheria" },
+            "forged-provider"));
+
+        state.Freshness.Should().Be(CultMeshDiscoveryFreshness.Unavailable);
+        state.Candidates.Should().BeEmpty();
+    }
+
+    private static CultMeshDiscoveryObservation Observation(
+        string verseId,
+        string sourceId,
+        ManualClock clock,
+        TimeSpan ttl,
+        CultMeshDiscoveryTrust trust,
+        string endpoint = "rudp://aetheria:3076") => new(
+        new CultMeshVerseDescriptor(
+            verseId,
+            "Aetheria",
+            CultMeshVerseAuthorityModel.OperatorCluster,
+            new CultMeshVerseCompatibility("cultmesh.v0", "rules"),
+            new[] { endpoint },
+            new[] { "aetheria" }),
+        sourceId,
+        clock.UtcNow,
+        clock.UtcNow + ttl,
+        trust);
+
+    private static async Task WaitUntilAsync(Func<bool> condition)
+    {
+        var deadline = DateTime.UtcNow + TimeSpan.FromSeconds(2);
+        while (!condition() && DateTime.UtcNow < deadline) await Task.Delay(1);
+        condition().Should().BeTrue();
+    }
+
+    private sealed class DelegateSource : ICultMeshLookupSource
+    {
+        private readonly Func<CultMeshDiscoveryQuery, Task<IReadOnlyList<CultMeshDiscoveryObservation>>> _lookup;
+
+        public DelegateSource(string sourceId, Func<CultMeshDiscoveryQuery, Task<IReadOnlyList<CultMeshDiscoveryObservation>>> lookup)
+        {
+            SourceId = sourceId;
+            _lookup = lookup;
+        }
+
+        public string SourceId { get; }
+        public int LookupCount => Volatile.Read(ref _lookupCount);
+
+        public Task<IReadOnlyList<CultMeshDiscoveryObservation>> LookupAsync(
+            CultMeshDiscoveryQuery query,
+            CancellationToken cancellationToken = default)
+        {
+            Interlocked.Increment(ref _lookupCount);
+            return _lookup(query);
+        }
+
+        private int _lookupCount;
+    }
+
+    private sealed class ManualClock : ICultMeshClock
+    {
+        public ManualClock(DateTimeOffset utcNow) => UtcNow = utcNow;
+        public DateTimeOffset UtcNow { get; private set; }
+        public Task DelayAsync(TimeSpan delay, CancellationToken cancellationToken = default)
+        {
+            cancellationToken.ThrowIfCancellationRequested();
+            UtcNow += delay;
+            return Task.CompletedTask;
+        }
+        public void Advance(TimeSpan duration) => UtcNow += duration;
+    }
+}
diff --git a/tests/GameCult.Mesh.Tests/CultMeshEntityPrefabTests.cs b/tests/GameCult.Mesh.Tests/CultMeshEntityPrefabTests.cs
new file mode 100644
index 00000000..ec8bbcf7
--- /dev/null
+++ b/tests/GameCult.Mesh.Tests/CultMeshEntityPrefabTests.cs
@@ -0,0 +1,197 @@
+using System.Collections.Generic;
+using System.Linq;
+using System.Text;
+using System.Threading.Tasks;
+using FluentAssertions;
+using GameCult.Caching;
+using NUnit.Framework;
+
+namespace GameCult.Mesh.Tests;
+
+public sealed class CultMeshEntityPrefabTests
+{
+    [Test]
+    public async Task EntityPrefabPackage_PublishesBrokkrAuthoredGraph_WithCdnAssetRefs()
+    {
+        var cache = new CultCache();
+        var meshArtifact = CultMesh.PackCdnArtifact(
+            "aetheria/prefabs/ships/scout/mesh/body",
+            Encoding.UTF8.GetBytes("portable-mesh-bytes"),
+            new CultMeshCdnPackOptions
+            {
+                Version = "authoring-1",
+                MimeType = "model/gltf-binary",
+                Tags = ["brokkr", "mesh"],
+            });
+        var textureArtifact = CultMesh.PackCdnArtifact(
+            "aetheria/prefabs/ships/scout/texture/albedo",
+            Encoding.UTF8.GetBytes("texture-bytes"),
+            new CultMeshCdnPackOptions
+            {
+                Version = "authoring-1",
+                MimeType = "image/png",
+                Tags = ["brokkr", "texture"],
+            });
+        await CultMesh.PublishCdnArtifactAsync(cache, meshArtifact);
+        await CultMesh.PublishCdnArtifactAsync(cache, textureArtifact);
+
+        var package = CultMesh.FinalizeEntityPrefabPackage(new CultMeshEntityPrefabPackage
+        {
+            PrefabId = "aetheria/entity/ship/scout",
+            Version = "authoring-1",
+            SourceTool = "brokkr.blender",
+            SourceScene = "ships.blend",
+            SourceCollection = "prefab.ship.scout",
+            Tags = ["aetheria", "ship", "brokkr"],
+            Assets =
+            [
+                AssetRef("mesh.body", CultMeshEntityPrefabAssetRoles.Mesh, meshArtifact.Manifest),
+                AssetRef("texture.albedo", CultMeshEntityPrefabAssetRoles.Texture, textureArtifact.Manifest)
+            ],
+            Nodes =
+            [
+                new CultMeshEntityPrefabNode
+                {
+                    NodeId = "root",
+                    Name = "Scout",
+                    Kind = CultMeshEntityPrefabNodeKinds.Empty,
+                    Tags = ["entity-root"],
+                    Components =
+                    [
+                        new CultMeshEntityPrefabComponent
+                        {
+                            Type = "aetheria.ship",
+                            Properties = new Dictionary<string, string>
+                            {
+                                ["hullClass"] = "scout"
+                            }
+                        }
+                    ]
+                },
+                new CultMeshEntityPrefabNode
+                {
+                    NodeId = "body",
+                    Name = "Body",
+                    ParentNodeId = "root",
+                    Kind = CultMeshEntityPrefabNodeKinds.Mesh,
+                    MeshAssetId = "mesh.body",
+                    MaterialAssetIds = ["texture.albedo"],
+                    Transform = new CultMeshEntityPrefabTransform
+                    {
+                        Position = [0f, 0f, 0f],
+                        Rotation = [0f, 0f, 0f, 1f],
+                        Scale = [1f, 1f, 1f]
+                    }
+                }
+            ],
+            Metadata = new Dictionary<string, string>
+            {
+                ["authoringAxis"] = "blender",
+                ["runtimeLowering"] = "unity,ts"
+            }
+        });
+
+        await CultMesh.PublishEntityPrefabPackageAsync(cache, package);
+
+        var key = CultMeshEntityPrefabPackage.CreateRecordKey(package);
+        var stored = cache.Get<CultMeshEntityPrefabPackage>(key);
+        stored.Should().NotBeNull();
+        stored!.SourceTool.Should().Be("brokkr.blender");
+        stored.SourceCollection.Should().Be("prefab.ship.scout");
+        stored.Nodes.Should().Contain(node => node.Kind == CultMeshEntityPrefabNodeKinds.Mesh);
+        stored.Assets.Select(asset => asset.CdnManifestRecordKey)
+            .Should()
+            .Contain(meshArtifact.ManifestKey.Value)
+            .And.Contain(textureArtifact.ManifestKey.Value);
+    }
+
+    [Test]
+    public async Task EntityPrefabPackage_ReplicatesWithReferencedCdnArtifacts_ThroughRawSnapshot()
+    {
+        var sourceCache = new CultCache();
+        var targetCache = new CultCache();
+        var registry = CultMesh.CreateAssetPipelineDocumentRegistry(sourceCache.Registry);
+        var meshArtifact = CultMesh.PackCdnArtifact(
+            "aetheria/prefabs/projectiles/bolt/mesh",
+            Encoding.UTF8.GetBytes("bolt-mesh"),
+            new CultMeshCdnPackOptions { Version = "v1", MimeType = "model/gltf-binary" });
+        await CultMesh.PublishCdnArtifactAsync(sourceCache, meshArtifact);
+
+        var package = CultMesh.FinalizeEntityPrefabPackage(new CultMeshEntityPrefabPackage
+        {
+            PrefabId = "aetheria/entity/projectile/bolt",
+            Version = "v1",
+            SourceTool = "brokkr.blender",
+            SourceScene = "projectiles.blend",
+            SourceCollection = "prefab.projectile.bolt",
+            Assets = [AssetRef("mesh", CultMeshEntityPrefabAssetRoles.Mesh, meshArtifact.Manifest)],
+            Nodes =
+            [
+                new CultMeshEntityPrefabNode
+                {
+                    NodeId = "bolt",
+                    Name = "Bolt",
+                    Kind = CultMeshEntityPrefabNodeKinds.Mesh,
+                    MeshAssetId = "mesh",
+                    Components =
+                    [
+                        new CultMeshEntityPrefabComponent
+                        {
+                            Type = "aetheria.projectile",
+                            Properties = new Dictionary<string, string>
+                            {
+                                ["damage"] = "10"
+                            }
+                        }
+                    ]
+                }
+            ]
+        });
+        await CultMesh.PublishEntityPrefabPackageAsync(sourceCache, package);
+
+        var packageSchema = sourceCache.Registry.GetRequired<CultMeshEntityPrefabPackage>().SchemaId;
+        var manifestSchema = sourceCache.Registry.GetRequired<CultMeshCdnArtifactManifest>().SchemaId;
+        var chunkSchema = sourceCache.Registry.GetRequired<CultMeshCdnArtifactChunk>().SchemaId;
+        var recordKeys = new[] { CultMeshEntityPrefabPackage.CreateRecordKey(package) }
+            .Concat(meshArtifact.RecordKeys)
+            .Select(key => key.Value)
+            .ToArray();
+
+        var request = registry.CreateSnapshotRequest(
+            "entity-prefab-request",
+            schemaIds: [packageSchema, manifestSchema, chunkSchema],
+            recordKeys: recordKeys);
+        var response = registry.CreateRawSnapshotResponse(sourceCache, "entity-prefab-response", request);
+
+        response.Documents.Should().HaveCount(meshArtifact.Chunks.Count + 2);
+        await registry.ApplyRawSnapshotResponseAsync(targetCache, response);
+
+        var replicatedPackage = targetCache.Get<CultMeshEntityPrefabPackage>(
+            CultMeshEntityPrefabPackage.CreateRecordKey(package));
+        replicatedPackage.Should().NotBeNull();
+        replicatedPackage!.Nodes.Single().Components.Single().Type.Should().Be("aetheria.projectile");
+
+        var meshManifest = targetCache.Get<CultMeshCdnArtifactManifest>(meshArtifact.ManifestKey);
+        meshManifest.Should().NotBeNull();
+        CultMesh.ReadCdnArtifact(targetCache, meshManifest!).Should().Equal(Encoding.UTF8.GetBytes("bolt-mesh"));
+    }
+
+    private static CultMeshEntityPrefabAssetRef AssetRef(
+        string assetId,
+        string role,
+        CultMeshCdnArtifactManifest manifest)
+    {
+        return new CultMeshEntityPrefabAssetRef
+        {
+            AssetId = assetId,
+            Role = role,
+            CdnManifestRecordKey = CultMeshCdnArtifactManifest.CreateRecordKey(manifest).Value,
+            ContentHash = manifest.ContentHash,
+            MimeType = manifest.MimeType,
+            Metadata = new Dictionary<string, string>
+            {
+                ["sourceArtifactId"] = manifest.ArtifactId
+            }
+        };
+    }
+}
diff --git a/tests/GameCult.Mesh.Tests/CultMeshFrameBodyTests.cs b/tests/GameCult.Mesh.Tests/CultMeshFrameBodyTests.cs
new file mode 100644
index 00000000..2c6114bd
--- /dev/null
+++ b/tests/GameCult.Mesh.Tests/CultMeshFrameBodyTests.cs
@@ -0,0 +1,378 @@
+using System;
+using System.Collections.Concurrent;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Threading.Tasks;
+using FluentAssertions;
+using NUnit.Framework;
+
+namespace GameCult.Mesh.Tests;
+
+[TestFixture]
+public sealed class CultMeshFrameBodyTests
+{
+    [Test]
+    public void CrossProcessPublisherOpensReadOnlyBytesAndProtectsLeasedSlot()
+    {
+        using var publisher = Publisher();
+        publisher.TryPublish(new byte[] { 1, 2, 3 }, DateTimeOffset.UtcNow, out var first).Should().BeTrue();
+        var adapter = new CultMeshSharedMemoryBodyAdapter();
+        using var lease = adapter.OpenReadOnly(first, Request(first));
+        var bytes = new byte[3];
+        lease.CopyTo(0, bytes, 0, bytes.Length).Should().Be(3);
+        bytes.Should().Equal(1, 2, 3);
+
+        publisher.TryPublish(new byte[] { 4 }, DateTimeOffset.UtcNow, out var second).Should().BeTrue();
+        publisher.TryPublish(new byte[] { 5 }, DateTimeOffset.UtcNow, out var third).Should().BeTrue();
+        publisher.TryPublish(new byte[] { 6 }, DateTimeOffset.UtcNow, out var fourth).Should().BeTrue();
+        fourth.CapabilityToken.Should().NotBe(first.CapabilityToken);
+        lease.ReadByte(0).Should().Be(1);
+    }
+
+    [Test]
+    public void PublisherTelemetryDistinguishesDirectWritesFromCopyFallback()
+    {
+        using var publisher = Publisher();
+        publisher.TryPublish(new byte[] { 1, 2, 3 }, DateTimeOffset.UtcNow, out _).Should().BeTrue();
+
+        publisher.TryAcquireWrite(out var direct).Should().BeTrue();
+        direct.Span[..3].Fill(7);
+        direct.Commit(3, DateTimeOffset.UtcNow);
+
+        var stats = publisher.Stats();
+        stats.PublishedFrames.Should().Be(2);
+        stats.BlockedWrites.Should().Be(0);
+        stats.UnavoidableCopyCount.Should().Be(1);
+    }
+
+    [Test]
+    public void MappedCursorObservesNewGenerationsWithoutNewControlDescriptors()
+    {
+        using var publisher = Publisher();
+        publisher.TryPublish(new byte[] { 1, 2, 3 }, DateTimeOffset.UtcNow, out var bootstrap).Should().BeTrue();
+        using var cursor = new CultMeshMappedFrameBodyCursor(bootstrap);
+
+        cursor.TryAcquireLatest(out var first).Should().BeTrue();
+        using (first)
+        {
+            first.Descriptor.Sequence.Should().Be(bootstrap.Sequence);
+            first.ReadByte(0).Should().Be(1);
+        }
+        cursor.TryAcquireLatest(out _).Should().BeFalse();
+
+        publisher.TryPublish(new byte[] { 9, 8, 7 }, DateTimeOffset.UtcNow, out _).Should().BeTrue();
+
+        cursor.TryAcquireLatest(out var second).Should().BeTrue();
+        using (second)
+        {
+            second.Descriptor.Sequence.Should().Be(bootstrap.Sequence + 1);
+            second.Descriptor.ByteSize.Should().Be(3);
+            second.ReadByte(0).Should().Be(9);
+        }
+        cursor.TryAcquireLatest(out _).Should().BeFalse();
+    }
+
+    [Test]
+    public void MappedCursorWaitsForNewControlContractWhenFrameLengthChanges()
+    {
+        using var publisher = Publisher();
+        publisher.TryPublish(new byte[] { 1 }, DateTimeOffset.UtcNow, out var bootstrap).Should().BeTrue();
+        using var cursor = new CultMeshMappedFrameBodyCursor(bootstrap);
+        cursor.TryAcquireLatest(out var first).Should().BeTrue();
+        first.Dispose();
+
+        publisher.TryPublish(new byte[] { 2, 3 }, DateTimeOffset.UtcNow, out _).Should().BeTrue();
+
+        cursor.TryAcquireLatest(out _).Should().BeFalse();
+    }
+
+    [Test]
+    public void MappedCursorReaderLeaseProtectsItsSlotUntilDisposed()
+    {
+        using var publisher = Publisher();
+        publisher.TryPublish(new byte[] { 1 }, DateTimeOffset.UtcNow, out var bootstrap).Should().BeTrue();
+        using var cursor = new CultMeshMappedFrameBodyCursor(bootstrap);
+        cursor.TryAcquireLatest(out var protectedRead).Should().BeTrue();
+
+        publisher.TryPublish(new byte[] { 2 }, DateTimeOffset.UtcNow, out _).Should().BeTrue();
+        publisher.TryPublish(new byte[] { 3 }, DateTimeOffset.UtcNow, out _).Should().BeTrue();
+        publisher.TryPublish(new byte[] { 4 }, DateTimeOffset.UtcNow, out var fourth).Should().BeTrue();
+
+        fourth.CapabilityToken.Should().NotBe(bootstrap.CapabilityToken);
+        protectedRead.ReadByte(0).Should().Be(1);
+        protectedRead.Dispose();
+    }
+
+    [Test]
+    public void MappedCursorIgnoresExpiredGenerations()
+    {
+        var publishedAt = DateTimeOffset.UtcNow;
+        using var publisher = new CultMeshFrameBodyPublisher(
+            "body",
+            "tests.frame.v2",
+            layoutVersion: 2,
+            capacity: 64,
+            producerEpoch: 9,
+            slotByteLength: 64,
+            leaseDuration: TimeSpan.FromMilliseconds(10));
+        publisher.TryPublish(new byte[] { 42 }, publishedAt, out var bootstrap).Should().BeTrue();
+        using var cursor = new CultMeshMappedFrameBodyCursor(bootstrap);
+
+        cursor.TryAcquireLatest(publishedAt.AddMilliseconds(11), out _).Should().BeFalse();
+    }
+
+    [TestCase("wrong", 2, 9)]
+    [TestCase("tests.frame.v2", 1, 9)]
+    [TestCase("tests.frame.v2", 2, 8)]
+    public void CrossProcessOpenRejectsStaleSchemaLayoutOrEpoch(string schema, int layout, long epoch)
+    {
+        using var publisher = Publisher();
+        publisher.TryPublish(new byte[] { 42 }, DateTimeOffset.UtcNow, out var descriptor).Should().BeTrue();
+        var request = Request(descriptor);
+        request.SchemaId = schema;
+        request.LayoutVersion = layout;
+        request.ProducerEpoch = epoch;
+
+        Action open = () => new CultMeshSharedMemoryBodyAdapter().OpenReadOnly(descriptor, request);
+        open.Should().Throw<InvalidOperationException>();
+    }
+
+    [Test]
+    public void ReusedSlotRejectsItsStaleGenerationDescriptor()
+    {
+        using var publisher = Publisher();
+        publisher.TryPublish(new byte[] { 1 }, DateTimeOffset.UtcNow, out var stale).Should().BeTrue();
+        publisher.TryPublish(new byte[] { 2 }, DateTimeOffset.UtcNow, out _).Should().BeTrue();
+        publisher.TryPublish(new byte[] { 3 }, DateTimeOffset.UtcNow, out _).Should().BeTrue();
+        publisher.TryPublish(new byte[] { 4 }, DateTimeOffset.UtcNow, out _).Should().BeTrue();
+
+        Action open = () => new CultMeshSharedMemoryBodyAdapter().OpenReadOnly(stale, Request(stale));
+        open.Should().Throw<InvalidOperationException>().WithMessage("*stale*");
+    }
+
+    [Test]
+    public void CleanupRevokesNewOpensAndDisposedLeaseIsInvalid()
+    {
+        var publisher = Publisher();
+        publisher.TryPublish(new byte[] { 42 }, DateTimeOffset.UtcNow, out var descriptor).Should().BeTrue();
+        var adapter = new CultMeshSharedMemoryBodyAdapter();
+        var lease = adapter.OpenReadOnly(descriptor, Request(descriptor));
+        lease.Dispose();
+        Action readDisposed = () => lease.ReadByte(0);
+        readDisposed.Should().Throw<ObjectDisposedException>();
+
+        publisher.Dispose();
+        Action reopen = () => adapter.OpenReadOnly(descriptor, Request(descriptor));
+        reopen.Should().Throw<InvalidDataException>();
+    }
+
+    [Test]
+    public void UnixPublisherOwnsAndDeletesItsFileBackedMap()
+    {
+        if (OperatingSystem.IsWindows())
+            Assert.Ignore("Windows uses a named memory map rather than a backing file.");
+
+        var publisher = Publisher();
+        publisher.TryPublish(new byte[] { 42 }, DateTimeOffset.UtcNow, out var descriptor).Should().BeTrue();
+        var token = descriptor.CapabilityToken[..descriptor.CapabilityToken.LastIndexOf('.')];
+        var path = Path.Combine(Path.GetTempPath(), "cultmesh-map-" + token + ".map");
+        File.Exists(path).Should().BeTrue();
+
+        publisher.Dispose();
+
+        File.Exists(path).Should().BeFalse();
+    }
+
+    [Test]
+    public void PublishesOneAtomicSchemaVersionedGenerationPerCommit()
+    {
+        using var region = Region();
+        region.TryAcquireWrite(out var write).Should().BeTrue();
+        write.Sequence.Should().Be(0);
+        write.Span[..4].Fill(7);
+
+        var generation = region.Commit(
+            write,
+            4,
+            timestampNs: 12,
+            metadata: new Dictionary<string, string> { ["plane"] = "positions" });
+
+        generation.Descriptor.Sequence.Should().Be(0);
+        generation.Descriptor.SchemaId.Should().Be("tests.frame.v2");
+        generation.Descriptor.LayoutVersion.Should().Be(2);
+        generation.Descriptor.Capacity.Should().Be(64);
+        generation.Descriptor.ProducerEpoch.Should().Be(9);
+        generation.Descriptor.Synchronization.Should().Be(CultMeshBodySynchronization.TripleBuffer);
+        generation.Descriptor.AccessMode.Should().Be(CultMeshBodyAccessMode.ReadOnly);
+        region.Stats().PublishedFrames.Should().Be(1);
+
+        Action duplicate = () => region.Commit(write, 4, timestampNs: 13);
+        duplicate.Should().Throw<InvalidOperationException>().WithMessage("*stale or was already committed*");
+        region.Stats().PublishedFrames.Should().Be(1);
+    }
+
+    [Test]
+    public void RefusesASecondOutstandingWriteAndRecoversAfterCommit()
+    {
+        using var region = Region();
+
+        region.TryAcquireWrite(out var first).Should().BeTrue();
+        first.Sequence.Should().Be(0);
+        region.TryAcquireWrite(out _).Should().BeFalse();
+
+        first.Span[0] = 10;
+        region.Commit(first, 1, timestampNs: 1).Descriptor.Sequence.Should().Be(0);
+
+        region.TryAcquireWrite(out var second).Should().BeTrue();
+        second.Sequence.Should().Be(1);
+        second.Span[0] = 11;
+        region.Commit(second, 1, timestampNs: 2).Descriptor.Sequence.Should().Be(1);
+
+        region.TryAcquireWrite(out var third).Should().BeTrue();
+        third.Sequence.Should().Be(2);
+        region.Stats().BlockedWrites.Should().Be(1);
+    }
+
+    [Test]
+    public void RefusesWritesWhenEverySlotHasAReaderLease()
+    {
+        using var region = Region();
+        var reads = new CultMeshFrameRegionReadLease[3];
+        for (var sequence = 0; sequence < 3; sequence++)
+        {
+            region.TryAcquireWrite(out var write).Should().BeTrue();
+            write.Span[0] = (byte)sequence;
+            region.Commit(write, 1, sequence);
+            region.TryAcquireLatestRead(Request(sequence), out reads[sequence]).Should().BeTrue();
+        }
+
+        region.TryAcquireWrite(out _).Should().BeFalse();
+        region.Stats().BlockedWrites.Should().Be(1);
+
+        reads[1].Dispose();
+        region.TryAcquireWrite(out var available).Should().BeTrue();
+        available.SlotIndex.Should().Be(1);
+        reads[0].Dispose();
+        reads[2].Dispose();
+    }
+
+    [TestCase("wrong", "tests.frame.v2", 2, 9, 64, 0)]
+    [TestCase("body", "tests.frame.v1", 2, 9, 64, 0)]
+    [TestCase("body", "tests.frame.v2", 1, 9, 64, 0)]
+    [TestCase("body", "tests.frame.v2", 2, 8, 64, 0)]
+    [TestCase("body", "tests.frame.v2", 2, 9, 63, 0)]
+    [TestCase("body", "tests.frame.v2", 2, 9, 64, 1)]
+    public void RejectsMismatchedGenerationBeforeExposingBytes(
+        string bodyId,
+        string schemaId,
+        int layoutVersion,
+        long epoch,
+        int capacity,
+        long sequence)
+    {
+        using var region = Region();
+        region.TryAcquireWrite(out var write).Should().BeTrue();
+        write.Span[0] = 42;
+        region.Commit(write, 1, 0);
+        var request = new CultMeshBodyValidationRequest
+        {
+            BodyId = bodyId,
+            SchemaId = schemaId,
+            LayoutVersion = layoutVersion,
+            ProducerEpoch = epoch,
+            Capacity = capacity,
+            Sequence = sequence,
+            AccessMode = CultMeshBodyAccessMode.ReadOnly
+        };
+
+        Action read = () => region.TryAcquireLatestRead(request, out _);
+
+        read.Should().Throw<InvalidOperationException>();
+    }
+
+    [Test]
+    public void ReadLeaseIsReadOnlyAndProtectsItsBytesAcrossLaterCommits()
+    {
+        using var region = Region();
+        region.TryAcquireWrite(out var first).Should().BeTrue();
+        first.Span[..4].Fill(11);
+        region.Commit(first, 4, 0);
+        region.TryAcquireLatestRead(Request(0), out var protectedRead).Should().BeTrue();
+
+        for (var value = 12; value <= 13; value++)
+        {
+            region.TryAcquireWrite(out var write).Should().BeTrue();
+            write.Span[..4].Fill((byte)value);
+            region.Commit(write, 4, value);
+        }
+
+        protectedRead.Span.ToArray().Should().OnlyContain(value => value == 11);
+        protectedRead.Dispose();
+    }
+
+    [Test]
+    public async Task ConcurrentReadersNeverObserveTornBytesOrMetadata()
+    {
+        using var region = Region();
+        var failures = new ConcurrentQueue<string>();
+
+        for (var sequence = 0; sequence < 200; sequence++)
+        {
+            CultMeshFrameRegionWriteLease write;
+            while (!region.TryAcquireWrite(out write))
+                await Task.Yield();
+            var marker = (byte)(sequence % 251 + 1);
+            write.Span[..64].Fill(marker);
+            region.Commit(
+                write,
+                64,
+                sequence,
+                metadata: new Dictionary<string, string> { ["marker"] = marker.ToString() });
+
+            var readers = Enumerable.Range(0, 4).Select(_ => Task.Run(() =>
+            {
+                if (!region.TryAcquireLatestRead(Request(), out var read)) return;
+                using (read)
+                {
+                    var expected = byte.Parse(read.Generation.Metadata["marker"]);
+                    if (read.Span.ToArray().Any(value => value != expected))
+                        failures.Enqueue($"Torn generation {read.Generation.Descriptor.Sequence}");
+                }
+            }));
+            await Task.WhenAll(readers);
+        }
+
+        failures.Should().BeEmpty();
+        region.Stats().PublishedFrames.Should().Be(200);
+        region.Stats().LatestSequence.Should().Be(199);
+    }
+
+    private static CultMeshFrameRegion Region() =>
+        new("body", "tests.frame.v2", layoutVersion: 2, capacity: 64, producerEpoch: 9, slotByteLength: 64);
+
+    private static CultMeshFrameBodyPublisher Publisher() =>
+        new("body", "tests.frame.v2", layoutVersion: 2, capacity: 64, producerEpoch: 9, slotByteLength: 64);
+
+    private static CultMeshBodyValidationRequest Request(CultMeshBodyDescriptor descriptor) => new()
+    {
+        BodyId = descriptor.BodyId,
+        SchemaId = descriptor.SchemaId,
+        LayoutVersion = descriptor.LayoutVersion,
+        ProducerEpoch = descriptor.ProducerEpoch,
+        Capacity = descriptor.Capacity,
+        Sequence = descriptor.Sequence,
+        AccessMode = CultMeshBodyAccessMode.ReadOnly
+    };
+
+    private static CultMeshBodyValidationRequest Request(long? sequence = null) => new()
+    {
+        BodyId = "body",
+        SchemaId = "tests.frame.v2",
+        LayoutVersion = 2,
+        ProducerEpoch = 9,
+        Capacity = 64,
+        Sequence = sequence,
+        AccessMode = CultMeshBodyAccessMode.ReadOnly
+    };
+}
diff --git a/tests/GameCult.Mesh.Tests/CultMeshProviderSessionWireTests.cs b/tests/GameCult.Mesh.Tests/CultMeshProviderSessionWireTests.cs
new file mode 100644
index 00000000..75125148
--- /dev/null
+++ b/tests/GameCult.Mesh.Tests/CultMeshProviderSessionWireTests.cs
@@ -0,0 +1,250 @@
+using System;
+using System.Collections.Generic;
+using GameCult.Networking;
+using MessagePack;
+using NUnit.Framework;
+
+namespace GameCult.Mesh.Tests;
+
+[TestFixture]
+public sealed class CultMeshProviderSessionWireTests
+{
+    private const string RegistrationGolden = "hqpwcm92aWRlcklkqGFldGhlcmlhsXNlcnZpY2VJbnN0YW5jZUlkq2FldGhlcmlhLTQyqmVuZHBvaW50SWSvYWV0aGVyaWEtcHVibGljp3ZlcnNlSWSmcHVibGljuHJlcXVlc3RlZExlYXNlRHVyYXRpb25Nc811MLBhdXRob3JpdHlMZWFzZUlkq2F1dGhvcml0eS03";
+    private const string ConnectEvidenceGolden = "gq9jbGllbnRTZXNzaW9uSWSyYWV0aGVyaWEtY2xpZW50LTQyrHNlc3Npb25Ub2tlbrJvZGluLXNlc3Npb24tdG9rZW4=";
+    private const string TokenlessConnectEvidenceGolden = "gq9jbGllbnRTZXNzaW9uSWSyYWV0aGVyaWEtY2xpZW50LTQyrHNlc3Npb25Ub2tlbsA=";
+
+    [Test]
+    public void ConnectEvidence_SeparatesTransportGenerationFromAuthorityToken()
+    {
+        var encoded = CultMeshProviderSessionWire.EncodeConnectEvidence(
+            new CultMeshProviderConnectEvidenceWire
+            {
+                ClientSessionId = "aetheria-client-42",
+                SessionToken = "odin-session-token"
+            });
+        var decoded = CultMeshProviderSessionWire.DecodeConnectEvidence(encoded);
+
+        Assert.Multiple(() =>
+        {
+            Assert.That(Convert.ToBase64String(encoded), Is.EqualTo(ConnectEvidenceGolden),
+                "C#, TypeScript, and Rust must emit the same Connect evidence map");
+            Assert.That(decoded.ClientSessionId, Is.EqualTo("aetheria-client-42"));
+            Assert.That(decoded.SessionToken, Is.EqualTo("odin-session-token"));
+            Assert.That(
+                Convert.ToBase64String(CultMeshProviderSessionWire.EncodeConnectEvidence(
+                    new CultMeshProviderConnectEvidenceWire { ClientSessionId = "aetheria-client-42" })),
+                Is.EqualTo(TokenlessConnectEvidenceGolden));
+        });
+    }
+
+    [Test]
+    public void Registration_RoundTrips_InsideCanonicalCultNetOperationEnvelope()
+    {
+        var registration = new CultMeshProviderRegistrationWire
+        {
+            ProviderId = "aetheria",
+            ServiceInstanceId = "aetheria-42",
+            EndpointId = "aetheria-public",
+            VerseId = "public",
+            RequestedLeaseDurationMs = 30_000,
+            AuthorityLeaseId = "authority-7"
+        };
+
+        var request = CultMeshProviderSessionWire.CreateRequest(
+            "register-1",
+            CultMeshProviderSessionWireContract.RegisterOperation,
+            CultMeshProviderSessionWireContract.RegistrationSchema,
+            registration,
+            sourceRuntimeId: "aetheria-42",
+            targetRuntimeId: "odin");
+        var envelopeBytes = CultNetSchemaMessageSerialization.Serialize(request);
+        var decodedEnvelope = (CultNetOperationRequestMessage)CultNetSchemaMessageSerialization.Deserialize(envelopeBytes);
+        var decoded = CultMeshProviderSessionWire.DecodeRequest<CultMeshProviderRegistrationWire>(
+            decodedEnvelope,
+            CultMeshProviderSessionWireContract.RegisterOperation,
+            CultMeshProviderSessionWireContract.RegistrationSchema);
+
+        Assert.Multiple(() =>
+        {
+            Assert.That(CultMeshProviderSessionWire.EncodePayload(registration), Is.EqualTo(RegistrationGolden),
+                "C# and TypeScript must emit the same canonical registration payload");
+            Assert.That(decodedEnvelope.ServiceId, Is.EqualTo("gamecult.mesh.provider_session"));
+            Assert.That(decodedEnvelope.PayloadEncoding, Is.EqualTo("messagepack-base64"));
+            Assert.That(decoded.ProviderId, Is.EqualTo("aetheria"));
+            Assert.That(decoded.ServiceInstanceId, Is.EqualTo("aetheria-42"));
+            Assert.That(decoded.EndpointId, Is.EqualTo("aetheria-public"));
+            Assert.That(decoded.VerseId, Is.EqualTo("public"));
+            Assert.That(decoded.RequestedLeaseDurationMs, Is.EqualTo(30_000));
+            Assert.That(decoded.AuthorityLeaseId, Is.EqualTo("authority-7"));
+        });
+    }
+
+    [Test]
+    public void PublicationPut_RoundTrips_ExactRawDocumentTuple()
+    {
+        var publication = new CultMeshProviderPublicationPutWire
+        {
+            LeaseId = "lease-1",
+            PublicationId = "surface:pilot",
+            Document = new CultNetRawDocumentRecord
+            {
+                SchemaId = "gamecult.eve.surface.v1",
+                RecordKey = "eve:surface:pilot",
+                StoredAt = "2026-07-14T12:00:00Z",
+                PayloadEncoding = "messagepack",
+                Payload = [0x81, 0xA2, 0x69, 0x64, 0x01],
+                SourceRuntimeId = "aetheria-42"
+            }
+        };
+
+        var encoded = CultMeshProviderSessionWire.EncodePayload(publication);
+        var decoded = CultMeshProviderSessionWire.DecodePayload<CultMeshProviderPublicationPutWire>(encoded);
+
+        Assert.Multiple(() =>
+        {
+            Assert.That(decoded.LeaseId, Is.EqualTo("lease-1"));
+            Assert.That(decoded.PublicationId, Is.EqualTo("surface:pilot"));
+            Assert.That(decoded.Document.SchemaId, Is.EqualTo("gamecult.eve.surface.v1"));
+            Assert.That(decoded.Document.RecordKey, Is.EqualTo("eve:surface:pilot"));
+            Assert.That(decoded.Document.Payload, Is.EqualTo(publication.Document.Payload));
+        });
+    }
+
+    [Test]
+    public void CommandAndReceipt_UseCamelCaseMessagePackMaps()
+    {
+        var command = new CultMeshProviderCommandWire
+        {
+            CommandId = "cmd-7",
+            CommandKind = "pilot.thrust",
+            ProviderId = "aetheria",
+            ServiceInstanceId = "aetheria-42",
+            Payload = new Dictionary<string, object> { ["axis"] = 0.75 }
+        };
+        var receiptPut = new CultMeshProviderReceiptPutWire
+        {
+            LeaseId = "lease-1",
+            Receipt = new CultMeshProviderCommandReceiptWire
+            {
+                ReceiptId = "receipt-7",
+                CommandId = command.CommandId,
+                CommandKind = command.CommandKind,
+                ProviderId = command.ProviderId,
+                ServiceInstanceId = command.ServiceInstanceId,
+                State = "applied",
+                CompletedAtUtc = "2026-07-14T12:01:02.345Z",
+                Result = new Dictionary<string, object> { ["accepted"] = true }
+            }
+        };
+
+        var encodedCommand = CultMeshProviderSessionWire.EncodePayload(command);
+        var encodedReceipt = CultMeshProviderSessionWire.EncodePayload(receiptPut);
+        var decodedCommand = CultMeshProviderSessionWire.DecodePayload<CultMeshProviderCommandWire>(encodedCommand);
+        var decodedReceipt = CultMeshProviderSessionWire.DecodePayload<CultMeshProviderReceiptPutWire>(encodedReceipt);
+        var decodedCommandDocument = CultMeshProviderSessionWire.DecodeCommandDocument(new CultNetRawDocumentRecord
+        {
+            SchemaId = CultMeshProviderSessionWireContract.CommandSchema,
+            RecordKey = "provider-command:aetheria:aetheria-42:cmd-7",
+            PayloadEncoding = "messagepack",
+            Payload = Convert.FromBase64String(encodedCommand)
+        });
+        var commandJson = MessagePackSerializer.ConvertToJson(Convert.FromBase64String(encodedCommand));
+        var receiptJson = MessagePackSerializer.ConvertToJson(Convert.FromBase64String(encodedReceipt));
+
+        Assert.Multiple(() =>
+        {
+            Assert.That(commandJson, Does.Contain("\"commandId\""));
+            Assert.That(commandJson, Does.Contain("\"commandKind\""));
+            Assert.That(commandJson, Does.Contain("\"serviceInstanceId\""));
+            Assert.That(commandJson, Does.Contain("\"payload\""));
+            Assert.That(decodedCommand.CommandKind, Is.EqualTo("pilot.thrust"));
+            Assert.That(decodedCommand.Payload, Is.Not.Null);
+            Assert.That(decodedCommandDocument.CommandId, Is.EqualTo("cmd-7"));
+            Assert.That(receiptJson, Does.Contain("\"completedAtUtc\""));
+            Assert.That(receiptJson, Does.Contain("\"receiptId\""));
+            Assert.That(receiptJson, Does.Contain("\"result\""));
+            Assert.That(decodedReceipt.Receipt.State, Is.EqualTo("applied"));
+            Assert.That(decodedReceipt.Receipt.Result, Is.Not.Null);
+        });
+    }
+
+    [Test]
+    public void LeaseResponse_RoundTrips_WithApplicationAcceptance()
+    {
+        var request = CultMeshProviderSessionWire.CreateRequest(
+            "register-1",
+            CultMeshProviderSessionWireContract.RegisterOperation,
+            CultMeshProviderSessionWireContract.RegistrationSchema,
+            new CultMeshProviderRegistrationWire
+            {
+                ProviderId = "aetheria",
+                ServiceInstanceId = "aetheria-42",
+                EndpointId = "public",
+                VerseId = "verse",
+                RequestedLeaseDurationMs = 10_000
+            });
+        var response = CultMeshProviderSessionWire.CreateResponse(
+            request,
+            CultMeshProviderSessionWireContract.OkStatus,
+            CultMeshProviderSessionWireContract.LeaseSchema,
+            new CultMeshProviderLeaseWire
+            {
+                ProviderId = "aetheria",
+                ServiceInstanceId = "aetheria-42",
+                EndpointId = "public",
+                VerseId = "verse",
+                LeaseId = "lease-2",
+                ValidFromUtc = "2026-07-14T12:00:00Z",
+                ExpiresAtUtc = "2026-07-14T12:00:10Z"
+            },
+            sourceRuntimeId: "odin");
+
+        var lease = CultMeshProviderSessionWire.DecodeResponse<CultMeshProviderLeaseWire>(
+            response,
+            CultMeshProviderSessionWireContract.RegisterOperation,
+            CultMeshProviderSessionWireContract.LeaseSchema);
+
+        Assert.That(response.Status, Is.EqualTo("ok"));
+        Assert.That(lease.LeaseId, Is.EqualTo("lease-2"));
+        Assert.That(lease.ExpiresAtUtc, Is.EqualTo("2026-07-14T12:00:10Z"));
+    }
+
+    [Test]
+    public void Validation_RejectsSplitAuthorityAndMalformedLifecycleState()
+    {
+        Assert.Multiple(() =>
+        {
+            Assert.That(
+                () => CultMeshProviderSessionWire.CreateRequest(
+                    "bad-schema",
+                    CultMeshProviderSessionWireContract.RegisterOperation,
+                    CultMeshProviderSessionWireContract.PublicationPutSchema,
+                    new CultMeshProviderRegistrationWire()),
+                Throws.ArgumentException);
+            Assert.That(
+                () => CultMeshProviderSessionWire.EncodePayload(new CultMeshProviderLeaseWire
+                {
+                    ProviderId = "provider",
+                    ServiceInstanceId = "instance",
+                    EndpointId = "endpoint",
+                    VerseId = "verse",
+                    LeaseId = "lease",
+                    ValidFromUtc = "2026-07-14T12:00:10Z",
+                    ExpiresAtUtc = "2026-07-14T12:00:00Z"
+                }),
+                Throws.ArgumentException);
+            Assert.That(
+                () => CultMeshProviderSessionWire.EncodePayload(new CultMeshProviderCommandReceiptWire
+                {
+                    ReceiptId = "receipt",
+                    CommandId = "command",
+                    CommandKind = "kind",
+                    ProviderId = "provider",
+                    ServiceInstanceId = "instance",
+                    State = "maybe",
+                    CompletedAtUtc = "2026-07-14T12:00:00Z"
+                }),
+                Throws.ArgumentException);
+        });
+    }
+}
diff --git a/tests/GameCult.Mesh.Tests/CultMeshReliabilityDiagnosticsTests.cs b/tests/GameCult.Mesh.Tests/CultMeshReliabilityDiagnosticsTests.cs
new file mode 100644
index 00000000..d40ee4e0
--- /dev/null
+++ b/tests/GameCult.Mesh.Tests/CultMeshReliabilityDiagnosticsTests.cs
@@ -0,0 +1,118 @@
+using System;
+using System.Linq;
+using System.Text;
+using System.Threading;
+using System.Threading.Tasks;
+using FluentAssertions;
+using NUnit.Framework;
+
+namespace GameCult.Mesh.Tests;
+
+public sealed class CultMeshReliabilityDiagnosticsTests
+{
+    [Test]
+    public void DiagnosticBuffer_IsBoundedAndCarriesServedVersion()
+    {
+        var clock = new TestClock(new DateTimeOffset(2026, 7, 12, 18, 0, 0, TimeSpan.Zero));
+        var diagnostics = new CultMeshDiagnosticBuffer(capacity: 2);
+
+        for (var sequence = 1; sequence <= 3; sequence++)
+        {
+            diagnostics.Emit(new CultMeshDiagnosticEvent(
+                sequence,
+                clock.UtcNow,
+                CultMeshReliabilityOrgan.Discovery,
+                CultMeshDiagnosticKind.DiscoveryObservation,
+                "lookup:aetheria",
+                "aetheria",
+                sequence == 3 ? "degraded" : "fresh",
+                schemaVersion: "gamecult.mesh.discovery_diagnostic.v1"));
+            clock.Advance(TimeSpan.FromSeconds(1));
+        }
+
+        var snapshot = diagnostics.Snapshot();
+        snapshot.Select(item => item.Sequence).Should().Equal(2, 3);
+        snapshot[^1].State.Should().Be("degraded");
+        snapshot[^1].LibraryVersion.Should().Be(CultMeshLibraryVersion.Current);
+        snapshot[^1].LibraryVersion.Should().NotBeNullOrWhiteSpace();
+        snapshot[^1].SchemaVersion.Should().Be("gamecult.mesh.discovery_diagnostic.v1");
+    }
+
+    [Test]
+    public void DeterministicNetwork_ReplaysLossDuplicationReorderingLatencyAndCorruption()
+    {
+        var clock = new TestClock(new DateTimeOffset(2026, 7, 12, 18, 0, 0, TimeSpan.Zero));
+        var network = new CultMeshDeterministicNetwork(
+            () => clock.UtcNow,
+            "rudp://first:3076",
+            new[]
+            {
+                new CultMeshFault(1, CultMeshFaultKind.Drop),
+                new CultMeshFault(2, CultMeshFaultKind.Duplicate),
+                new CultMeshFault(2, CultMeshFaultKind.Delay, TimeSpan.FromSeconds(2)),
+                new CultMeshFault(3, CultMeshFaultKind.Reorder),
+                new CultMeshFault(3, CultMeshFaultKind.Corrupt)
+            });
+
+        network.Send(Encoding.UTF8.GetBytes("lost"));
+        network.Send(Encoding.UTF8.GetBytes("twice"));
+        network.Send(new byte[] { 0x01, 0x02 });
+
+        var immediate = network.ReceiveAvailable();
+        immediate.Should().ContainSingle();
+        immediate[0].SendOrdinal.Should().Be(3);
+        immediate[0].Payload.Should().Equal(0xfe, 0x02);
+
+        clock.Advance(TimeSpan.FromSeconds(2));
+        var delayed = network.ReceiveAvailable();
+        delayed.Should().HaveCount(2);
+        delayed.Select(packet => Encoding.UTF8.GetString(packet.Payload)).Should().OnlyContain(value => value == "twice");
+    }
+
+    [Test]
+    public void DeterministicNetwork_ReplaysPartitionEndpointRotationAndRestart()
+    {
+        var clock = new TestClock(new DateTimeOffset(2026, 7, 12, 18, 0, 0, TimeSpan.Zero));
+        var network = new CultMeshDeterministicNetwork(
+            () => clock.UtcNow,
+            "rudp://first:3076",
+            new[]
+            {
+                new CultMeshFault(1, CultMeshFaultKind.Partition),
+                new CultMeshFault(2, CultMeshFaultKind.Partition),
+                new CultMeshFault(2, CultMeshFaultKind.RotateEndpoint, Endpoint: "rudp://second:3076"),
+                new CultMeshFault(3, CultMeshFaultKind.Restart)
+            });
+
+        network.Send(new byte[] { 1 });
+        network.Send(new byte[] { 2 });
+        network.ReceiveAvailable().Should().ContainSingle().Which.Endpoint.Should().Be("rudp://second:3076");
+
+        network.Send(new byte[] { 3 });
+        network.RestartCount.Should().Be(1);
+        network.Endpoint.Should().Be("rudp://second:3076");
+        network.ReceiveAvailable().Should().ContainSingle().Which.Payload.Should().Equal(3);
+    }
+
+    private sealed class TestClock : ICultMeshClock
+    {
+        public TestClock(DateTimeOffset utcNow)
+        {
+            UtcNow = utcNow;
+        }
+
+        public DateTimeOffset UtcNow { get; private set; }
+
+        public Task DelayAsync(TimeSpan delay, CancellationToken cancellationToken = default)
+        {
+            cancellationToken.ThrowIfCancellationRequested();
+            Advance(delay);
+            return Task.CompletedTask;
+        }
+
+        public void Advance(TimeSpan duration)
+        {
+            UtcNow += duration;
+        }
+    }
+}
diff --git a/tests/GameCult.Mesh.Tests/CultMeshSessionManagerTests.cs b/tests/GameCult.Mesh.Tests/CultMeshSessionManagerTests.cs
new file mode 100644
index 00000000..40fdfe15
--- /dev/null
+++ b/tests/GameCult.Mesh.Tests/CultMeshSessionManagerTests.cs
@@ -0,0 +1,587 @@
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using FluentAssertions;
+using GameCult.Networking;
+using NUnit.Framework;
+using R3;
+
+namespace GameCult.Mesh.Tests;
+
+public sealed class CultMeshSessionManagerTests
+{
+    private static CultMeshSessionTarget Target => new("aetheria", "aetheria-daemon");
+
+    [Test]
+    public async Task Connect_ResolvesOnlyTheRequestedVerseIdentity()
+    {
+        var clock = new ManualSessionClock();
+        using var discovery = new CultMeshDiscoveryService(
+            new[] { new MultiVerseRouteSource(clock) },
+            new CultMeshDiscoveryServiceOptions { Clock = clock });
+        CultMeshTransportCandidate? connected = null;
+        var connector = new FakeConnector((candidate, _) =>
+        {
+            connected = candidate;
+            return Task.FromResult<ICultNetSchemaClient>(new FakeSchemaClient());
+        });
+        using var manager = new CultMeshSessionManager(discovery, new[] { connector }, CultMeshTestTrust.LocalSessionsWithClock(clock));
+
+        await manager.ConnectAsync(Target, CultMeshProtocols.Documents);
+
+        connected.Should().NotBeNull();
+        connected!.Endpoint.Should().Be("rudp://127.0.0.1:3076");
+    }
+
+    [Test]
+    public async Task Connect_ReusesInflightAndEstablishedSession()
+    {
+        var clock = new ManualSessionClock();
+        using var discovery = Discovery(clock, () => new[] { "rudp://127.0.0.2:3076" });
+        var release = new TaskCompletionSource(TaskCreationOptions.RunContinuationsAsynchronously);
+        var connector = new FakeConnector(async (_, _) => { await release.Task; return new FakeSchemaClient(); });
+        using var manager = new CultMeshSessionManager(discovery, new[] { connector }, CultMeshTestTrust.LocalSessionsWithClock(clock));
+        var target = Target;
+
+        var first = manager.ConnectAsync(target, CultMeshProtocols.Documents);
+        var second = manager.ConnectAsync(target, CultMeshProtocols.Documents);
+        await WaitUntilAsync(() => connector.ConnectCount == 1);
+        release.TrySetResult();
+        var sessions = await Task.WhenAll(first, second);
+        var third = await manager.ConnectAsync(target, CultMeshProtocols.Documents);
+
+        sessions[0].Should().BeSameAs(sessions[1]).And.BeSameAs(third);
+        connector.ConnectCount.Should().Be(1);
+    }
+
+    [Test]
+    public async Task Connect_RacesPathsAndDisposesSuccessfulLoser()
+    {
+        var clock = new ManualSessionClock();
+        using var discovery = Discovery(clock, () => new[] { "rudp://127.0.0.3:3076", "rudp://127.0.0.4:3076" });
+        var slowRelease = new TaskCompletionSource(TaskCreationOptions.RunContinuationsAsynchronously);
+        var slowClient = new FakeSchemaClient();
+        var fastClient = new FakeSchemaClient();
+        var connector = new FakeConnector(async (candidate, _) =>
+        {
+            if (candidate.Endpoint.Contains("127.0.0.3")) { await slowRelease.Task; return slowClient; }
+            return fastClient;
+        });
+        using var manager = new CultMeshSessionManager(discovery, new[] { connector }, CultMeshTestTrust.LocalSessionsWithClock(clock));
+
+        var session = await manager.ConnectAsync(Target, CultMeshProtocols.Documents);
+        session.State.Path!.Endpoint.Should().Be("rudp://127.0.0.4:3076");
+        slowRelease.TrySetResult();
+        await WaitUntilAsync(() => slowClient.DisposeCount == 1);
+        fastClient.DisposeCount.Should().Be(0);
+    }
+
+    [Test]
+    public async Task Connect_NeverAttemptsRouteBoundToAnotherAuthority()
+    {
+        var clock = new ManualSessionClock();
+        var descriptor = new CultMeshVerseDescriptor(
+            "aetheria",
+            "Aetheria",
+            CultMeshVerseAuthorityModel.OperatorCluster,
+            new CultMeshVerseCompatibility("cultmesh.v0", "rules"),
+            authorityRoutes: new[]
+            {
+                new CultMeshAuthorityRoute("decoy-daemon", "rudp://127.0.0.5:3076"),
+                new CultMeshAuthorityRoute("aetheria-daemon", "rudp://127.0.0.6:3076")
+            });
+        using var discovery = new CultMeshDiscoveryService(
+            new[] { new StaticRouteSource(clock, descriptor) },
+            new CultMeshDiscoveryServiceOptions { Clock = clock });
+        var attempts = new List<string>();
+        var connector = new FakeConnector((candidate, _) =>
+        {
+            attempts.Add(candidate.Endpoint);
+            return Task.FromResult<ICultNetSchemaClient>(new FakeSchemaClient());
+        });
+        using var manager = new CultMeshSessionManager(discovery, new[] { connector }, CultMeshTestTrust.LocalSessions);
+
+        var session = await manager.ConnectAsync(Target, CultMeshProtocols.Documents);
+
+        session.State.Path!.Endpoint.Should().Be("rudp://127.0.0.6:3076");
+        attempts.Should().Equal("rudp://127.0.0.6:3076");
+    }
+
+    [Test]
+    public void Connect_RejectsRouteWhoseNativeIdentityDoesNotMatchTarget()
+    {
+        var clock = new ManualSessionClock();
+        using var discovery = Discovery(clock, () => new[] { "rudp://127.0.0.5:3076" });
+        var connector = new FakeConnector((_, _) =>
+            Task.FromResult<ICultNetSchemaClient>(new NativeMismatchClient()));
+        using var manager = new CultMeshSessionManager(discovery, new[] { connector }, CultMeshTestTrust.LocalSessions);
+
+        var error = Assert.ThrowsAsync<CultMeshSessionException>(() =>
+            manager.ConnectAsync(Target, CultMeshProtocols.Documents));
+
+        error!.Failure.Reason.Should().Be(CultMeshSessionFailureReason.Authority);
+    }
+
+    [Test]
+    public void Connect_RejectsPortableHandshakeFromWrongRuntime()
+    {
+        var clock = new ManualSessionClock();
+        using var discovery = Discovery(clock, () => new[] { "rudp://127.0.0.5:3076" });
+        var connector = new FakeConnector((_, _) =>
+            Task.FromResult<ICultNetSchemaClient>(new HandshakeSchemaClient("decoy-daemon")));
+        using var manager = new CultMeshSessionManager(discovery, new[] { connector }, CultMeshTestTrust.LocalSessions);
+
+        var error = Assert.ThrowsAsync<CultMeshSessionException>(() =>
+            manager.ConnectAsync(Target, CultMeshProtocols.Documents));
+
+        error!.Failure.Reason.Should().Be(CultMeshSessionFailureReason.Authority);
+    }
+
+    [Test]
+    public void Descriptor_RejectsAmbiguousLegacyMultiAuthorityRoutes()
+    {
+        var action = () => new CultMeshVerseDescriptor(
+            "aetheria",
+            "Aetheria",
+            CultMeshVerseAuthorityModel.OperatorCluster,
+            new CultMeshVerseCompatibility("cultmesh.v0", "rules"),
+            discoveryEndpoints: new[] { "rudp://127.0.0.7:3076" },
+            authorityRuntimeIds: new[] { "authority-a", "authority-b" });
+
+        action.Should().Throw<InvalidOperationException>().WithMessage("*ambiguous*");
+    }
+
+    [Test]
+    public async Task Connect_CallerCancellationDoesNotCancelSharedAttempt()
+    {
+        var clock = new ManualSessionClock();
+        using var discovery = Discovery(clock, () => new[] { "rudp://127.0.0.2:3076" });
+        var release = new TaskCompletionSource(TaskCreationOptions.RunContinuationsAsynchronously);
+        var connector = new FakeConnector(async (_, token) =>
+        {
+            token.CanBeCanceled.Should().BeFalse();
+            await release.Task;
+            return new FakeSchemaClient();
+        });
+        using var manager = new CultMeshSessionManager(discovery, new[] { connector }, CultMeshTestTrust.LocalSessionsWithClock(clock));
+        using var cancellation = new CancellationTokenSource();
+        var target = Target;
+
+        var cancelled = manager.ConnectAsync(target, CultMeshProtocols.Documents, cancellation.Token);
+        var survivor = manager.ConnectAsync(target, CultMeshProtocols.Documents);
+        await WaitUntilAsync(() => connector.ConnectCount == 1);
+        cancellation.Cancel();
+        Assert.ThrowsAsync<OperationCanceledException>(async () => await cancelled);
+        release.TrySetResult();
+
+        (await survivor).State.Status.Should().Be(CultMeshSessionStatus.Online);
+        connector.ConnectCount.Should().Be(1);
+    }
+
+    [Test]
+    public async Task BackgroundFailureMigratesSameSessionAcrossEndpointRotation()
+    {
+        var clock = new ManualSessionClock();
+        var route = "rudp://127.0.0.8:3076";
+        using var discovery = Discovery(clock, () => new[] { route }, TimeSpan.FromSeconds(5));
+        var clients = new List<FakeSchemaClient>();
+        var connector = new FakeConnector((_, _) =>
+        {
+            var client = new FakeSchemaClient();
+            clients.Add(client);
+            return Task.FromResult<ICultNetSchemaClient>(client);
+        });
+        using var manager = new CultMeshSessionManager(discovery, new[] { connector }, CultMeshTestTrust.LocalSessionsWithClock(clock));
+        var target = Target;
+        var first = await manager.ConnectAsync(target, CultMeshProtocols.Documents);
+        var states = new List<CultMeshSessionStatus>();
+        using var stateWatch = first.WatchState().Subscribe(state => states.Add(state.Status));
+        using var schemaLease = first.OpenSchemaClient();
+        var deliveries = 0;
+        schemaLease.OnCultNet<CultNetErrorMessage>(_ => deliveries++);
+        clients[0].Emit(new CultNetErrorMessage { Error = "before rotation" });
+
+        route = "rudp://127.0.0.9:3076";
+        clients[0].Fail(new IOException("partition"));
+        await WaitUntilAsync(() => first.State.Status == CultMeshSessionStatus.Online && connector.ConnectCount == 2);
+        var second = await manager.ConnectAsync(target, CultMeshProtocols.Documents);
+        clients[1].Emit(new CultNetErrorMessage { Error = "after rotation" });
+
+        second.Should().BeSameAs(first);
+        second.State.Path!.Endpoint.Should().Be("rudp://127.0.0.9:3076");
+        states.Should().ContainInOrder(CultMeshSessionStatus.Reconnecting, CultMeshSessionStatus.Online);
+        connector.ConnectCount.Should().Be(2);
+        clients[0].DisposeCount.Should().Be(1);
+        deliveries.Should().Be(2);
+    }
+
+    [Test]
+    public async Task UriConnectorPreservesTheAdvertisedPath()
+    {
+        var client = new FakeUriSchemaClient();
+        var connector = new CultMeshUriSchemaTransportConnector(
+            "websocket",
+            new[] { "ws", "wss" },
+            _ => client);
+        var candidate = new CultMeshTransportCandidate("wss://odin.example/game/cultmesh?generation=7");
+
+        var connected = await connector.ConnectAsync(candidate, CultMeshProtocols.Documents);
+
+        connected.Should().BeSameAs(client);
+        client.Endpoint.Should().Be(new Uri(candidate.Endpoint));
+    }
+
+    [Test]
+    public void Connect_ReportsUnsupportedPathPrecisely()
+    {
+        var clock = new ManualSessionClock();
+        using var discovery = Discovery(clock, () => new[] { "quic://127.0.0.10:443" });
+        using var manager = new CultMeshSessionManager(discovery, Array.Empty<ICultMeshTransportConnector>(), CultMeshTestTrust.LocalSessionsWithClock(clock));
+
+        var error = Assert.ThrowsAsync<CultMeshSessionException>(() =>
+            manager.ConnectAsync(Target, CultMeshProtocols.Documents));
+
+        error!.Failure.Reason.Should().Be(CultMeshSessionFailureReason.Transport);
+        error.InnerException.Should().BeOfType<CultMeshSessionException>()
+            .Which.Failure.Reason.Should().Be(CultMeshSessionFailureReason.UnsupportedPath);
+    }
+
+    [Test]
+    public async Task SnapshotSessionsBorrowOneManagedChannelAndDisposeRegistrationsIndependently()
+    {
+        var clock = new ManualSessionClock();
+        using var discovery = Discovery(clock, () => new[] { "rudp://127.0.0.2:3076" });
+        var client = new RespondingSchemaClient();
+        var connector = new FakeConnector((_, _) => Task.FromResult<ICultNetSchemaClient>(client));
+        using var manager = new CultMeshSessionManager(discovery, new[] { connector }, CultMeshTestTrust.LocalSessionsWithClock(clock));
+        var target = Target;
+        using var first = await CultMeshSnapshotSession.ConnectAsync(manager, target, new CultMeshSnapshotRequestOptions());
+        using var second = await CultMeshSnapshotSession.ConnectAsync(manager, target, new CultMeshSnapshotRequestOptions());
+
+        (await first.FetchSnapshotAsync()).MessageId.Should().NotBeEmpty();
+        first.Dispose();
+        (await second.FetchSnapshotAsync()).MessageId.Should().NotBeEmpty();
+
+        connector.ConnectCount.Should().Be(1);
+        client.DisposeCount.Should().Be(0);
+        client.SentCount.Should().Be(2);
+    }
+
+    [Test]
+    public async Task PeerExchangeBorrowsManagedProtocolSessionAcrossRequests()
+    {
+        var clock = new ManualSessionClock();
+        using var discovery = Discovery(clock, () => new[] { "rudp://127.0.0.2:3076" });
+        var client = new PeerExchangeSchemaClient();
+        var connector = new FakeConnector((_, _) => Task.FromResult<ICultNetSchemaClient>(client));
+        using var manager = new CultMeshSessionManager(discovery, new[] { connector }, CultMeshTestTrust.LocalSessionsWithClock(clock));
+        var exchange = new CultMeshPeerExchangeClient(new CultMeshPeerExchangeClientOptions { Sessions = manager, Clock = clock });
+        var target = Target;
+
+        var first = await exchange.FetchAsync(target, new CultMeshPeerExchangeRequestMessage { VerseId = "aetheria" });
+        var second = await exchange.FetchAsync(target, new CultMeshPeerExchangeRequestMessage { VerseId = "aetheria" });
+
+        first.Peers.Single().PeerId.Should().Be("peer-a");
+        second.Peers.Single().PeerId.Should().Be("peer-a");
+        connector.ConnectCount.Should().Be(1);
+        client.SentCount.Should().Be(2);
+    }
+
+    [Test]
+    public async Task SchemaClientLeasesDisposeHandlersWithoutClosingSession()
+    {
+        var clock = new ManualSessionClock();
+        using var discovery = Discovery(clock, () => new[] { "rudp://127.0.0.2:3076" });
+        var client = new LeaseSchemaClient();
+        var connector = new FakeConnector((_, _) => Task.FromResult<ICultNetSchemaClient>(client));
+        using var manager = new CultMeshSessionManager(discovery, new[] { connector }, CultMeshTestTrust.LocalSessionsWithClock(clock));
+        var session = await manager.ConnectAsync(Target, CultMeshProtocols.Subscriptions);
+        using var first = session.OpenSchemaClient();
+        using var second = session.OpenSchemaClient();
+        var firstCount = 0;
+        var secondCount = 0;
+        first.OnCultNet<CultNetErrorMessage>(_ => firstCount++);
+        second.OnCultNet<CultNetErrorMessage>(_ => secondCount++);
+
+        client.Emit(new CultNetErrorMessage { Error = "first" });
+        first.Dispose();
+        client.Emit(new CultNetErrorMessage { Error = "second" });
+
+        firstCount.Should().Be(1);
+        secondCount.Should().Be(2);
+        client.DisposeCount.Should().Be(0);
+        session.State.Status.Should().Be(CultMeshSessionStatus.Online);
+    }
+
+    private static CultMeshDiscoveryService Discovery(
+        ManualSessionClock clock,
+        Func<string[]> endpoints,
+        TimeSpan? ttl = null)
+    {
+        return new CultMeshDiscoveryService(
+            new[] { new RouteSource(clock, endpoints, ttl ?? TimeSpan.FromMinutes(1)) },
+            new CultMeshDiscoveryServiceOptions { Clock = clock });
+    }
+
+    private static async Task WaitUntilAsync(Func<bool> condition)
+    {
+        var deadline = DateTime.UtcNow + TimeSpan.FromSeconds(2);
+        while (!condition() && DateTime.UtcNow < deadline) await Task.Delay(1);
+        condition().Should().BeTrue();
+    }
+
+    private sealed class RouteSource : ICultMeshLookupSource
+    {
+        private readonly ManualSessionClock _clock;
+        private readonly Func<string[]> _endpoints;
+        private readonly TimeSpan _ttl;
+        public RouteSource(ManualSessionClock clock, Func<string[]> endpoints, TimeSpan ttl) { _clock = clock; _endpoints = endpoints; _ttl = ttl; }
+        public string SourceId => "odin";
+        public Task<IReadOnlyList<CultMeshDiscoveryObservation>> LookupAsync(CultMeshDiscoveryQuery query, CancellationToken cancellationToken = default) =>
+            Task.FromResult<IReadOnlyList<CultMeshDiscoveryObservation>>(new[]
+            {
+                new CultMeshDiscoveryObservation(
+                    new CultMeshVerseDescriptor("aetheria", "Aetheria", CultMeshVerseAuthorityModel.OperatorCluster,
+                        new CultMeshVerseCompatibility("cultmesh.v0", "rules"), _endpoints(), new[] { "aetheria-daemon" }),
+                    SourceId, _clock.UtcNow, _clock.UtcNow + _ttl, CultMeshDiscoveryTrust.Signed)
+            });
+    }
+
+    private sealed class MultiVerseRouteSource : ICultMeshLookupSource
+    {
+        private readonly ManualSessionClock _clock;
+        public MultiVerseRouteSource(ManualSessionClock clock) => _clock = clock;
+        public string SourceId => "odin";
+
+        public Task<IReadOnlyList<CultMeshDiscoveryObservation>> LookupAsync(
+            CultMeshDiscoveryQuery query,
+            CancellationToken cancellationToken = default)
+        {
+            var expires = _clock.UtcNow.AddMinutes(1);
+            return Task.FromResult<IReadOnlyList<CultMeshDiscoveryObservation>>(new[]
+            {
+                Observation("norn", "rudp://127.0.0.11:3076", expires),
+                Observation("aetheria", "rudp://127.0.0.1:3076", expires)
+            });
+        }
+
+        private CultMeshDiscoveryObservation Observation(string verseId, string endpoint, DateTimeOffset expires) =>
+            new(
+                new CultMeshVerseDescriptor(
+                    verseId,
+                    verseId,
+                    CultMeshVerseAuthorityModel.OperatorCluster,
+                    new CultMeshVerseCompatibility("cultmesh.v0", "rules"),
+                    new[] { endpoint },
+                    new[] { "aetheria-daemon" }),
+                SourceId,
+                _clock.UtcNow,
+                expires,
+                CultMeshDiscoveryTrust.Signed);
+    }
+
+    private sealed class StaticRouteSource : ICultMeshLookupSource
+    {
+        private readonly ManualSessionClock _clock;
+        private readonly CultMeshVerseDescriptor _descriptor;
+        public StaticRouteSource(ManualSessionClock clock, CultMeshVerseDescriptor descriptor)
+        {
+            _clock = clock;
+            _descriptor = descriptor;
+        }
+        public string SourceId => "odin";
+        public Task<IReadOnlyList<CultMeshDiscoveryObservation>> LookupAsync(
+            CultMeshDiscoveryQuery query,
+            CancellationToken cancellationToken = default) =>
+            Task.FromResult<IReadOnlyList<CultMeshDiscoveryObservation>>(new[]
+            {
+                new CultMeshDiscoveryObservation(
+                    _descriptor,
+                    SourceId,
+                    _clock.UtcNow,
+                    _clock.UtcNow.AddMinutes(1),
+                    CultMeshDiscoveryTrust.Signed)
+            });
+    }
+
+    private sealed class FakeConnector : ICultMeshTransportConnector
+    {
+        private readonly Func<CultMeshTransportCandidate, CancellationToken, Task<ICultNetSchemaClient>> _connect;
+        private int _connectCount;
+        public FakeConnector(Func<CultMeshTransportCandidate, CancellationToken, Task<ICultNetSchemaClient>> connect) { _connect = connect; }
+        public string ConnectorId => "fake";
+        public int Priority => 0;
+        public int ConnectCount => Volatile.Read(ref _connectCount);
+        public bool CanConnect(CultMeshTransportCandidate candidate) => true;
+        public Task<ICultNetSchemaClient> ConnectAsync(CultMeshTransportCandidate candidate, CultMeshProtocolId protocol, CancellationToken cancellationToken = default)
+        {
+            Interlocked.Increment(ref _connectCount);
+            return _connect(candidate, cancellationToken);
+        }
+    }
+
+    private sealed class FakeSchemaClient : ICultNetSchemaClient, ICultNetSchemaClientHealth, ICultMeshVerifiedSchemaClient
+    {
+        private readonly TaskCompletionSource<Exception> _failure = new(TaskCreationOptions.RunContinuationsAsynchronously);
+        private readonly List<Action<CultNetErrorMessage>> _handlers = new();
+        private int _disposeCount;
+        public bool Connected => true;
+        public Task<Exception> BackgroundFailure => _failure.Task;
+        public int DisposeCount => Volatile.Read(ref _disposeCount);
+        public void Connect(string host, int port) { }
+        public void SendCultNet<T>(T message) where T : ICultNetSchemaMessage { }
+        public void OnCultNet<T>(Action<T> callback) where T : ICultNetSchemaMessage
+        {
+            if (typeof(T) == typeof(CultNetErrorMessage))
+                _handlers.Add(message => callback((T)(object)message));
+        }
+        public void Dispose() => Interlocked.Increment(ref _disposeCount);
+        public bool IsVerifiedFor(string verseId, string authorityRuntimeId, string protocolId, string routeGeneration) =>
+            verseId == "aetheria" && authorityRuntimeId == "aetheria-daemon";
+        public void Fail(Exception error) => _failure.TrySetResult(error);
+        public void Emit(CultNetErrorMessage message) { foreach (var handler in _handlers.ToArray()) handler(message); }
+    }
+
+    private sealed class FakeUriSchemaClient : ICultNetUriSchemaClient
+    {
+        public bool Connected => Endpoint != null;
+        public Uri? Endpoint { get; private set; }
+        public void Connect(string host, int port) => throw new AssertionException("URI connection was not used.");
+        public Task ConnectAsync(Uri endpoint, CancellationToken cancellationToken = default)
+        {
+            cancellationToken.ThrowIfCancellationRequested();
+            Endpoint = endpoint;
+            return Task.CompletedTask;
+        }
+        public void SendCultNet<T>(T message) where T : ICultNetSchemaMessage { }
+        public void OnCultNet<T>(Action<T> callback) where T : ICultNetSchemaMessage { }
+        public void Dispose() { }
+    }
+
+    private sealed class NativeMismatchClient : ICultNetSchemaClient, ICultMeshVerifiedSchemaClient
+    {
+        public bool Connected => true;
+        public void Connect(string host, int port) { }
+        public void SendCultNet<T>(T message) where T : ICultNetSchemaMessage { }
+        public void OnCultNet<T>(Action<T> callback) where T : ICultNetSchemaMessage { }
+        public bool IsVerifiedFor(string verseId, string authorityRuntimeId, string protocolId, string routeGeneration) => false;
+        public void Dispose() { }
+    }
+
+    private sealed class HandshakeSchemaClient : ICultNetSchemaClient
+    {
+        private readonly string _actualRuntimeId;
+        private readonly List<Action<CultMeshSessionAcceptedMessage>> _handlers = new();
+        public HandshakeSchemaClient(string actualRuntimeId) => _actualRuntimeId = actualRuntimeId;
+        public bool Connected => true;
+        public void Connect(string host, int port) { }
+        public void SendCultNet<T>(T message) where T : ICultNetSchemaMessage
+        {
+            if (message is not CultMeshSessionOpenMessage request) return;
+            var response = new CultMeshSessionAcceptedMessage
+            {
+                MessageId = request.MessageId,
+                Accepted = true,
+                VerseId = request.VerseId,
+                AuthorityRuntimeId = _actualRuntimeId,
+                ProtocolId = request.ProtocolId,
+                RouteGeneration = request.RouteGeneration
+            };
+            foreach (var handler in _handlers.ToArray()) handler(response);
+        }
+        public void OnCultNet<T>(Action<T> callback) where T : ICultNetSchemaMessage
+        {
+            if (typeof(T) == typeof(CultMeshSessionAcceptedMessage))
+                _handlers.Add(message => callback((T)(object)message));
+        }
+        public void Dispose() { }
+    }
+
+    private sealed class RespondingSchemaClient : ICultNetSchemaClient, ICultMeshVerifiedSchemaClient
+    {
+        private readonly List<Action<CultNetSnapshotResponseRawMessage>> _handlers = new();
+        private int _disposeCount;
+        public bool Connected => true;
+        public int DisposeCount => Volatile.Read(ref _disposeCount);
+        public int SentCount { get; private set; }
+        public void Connect(string host, int port) { }
+        public void SendCultNet<T>(T message) where T : ICultNetSchemaMessage
+        {
+            SentCount++;
+            var request = (CultNetSnapshotRequestMessage)(object)message;
+            var response = new CultNetSnapshotResponseRawMessage
+            {
+                MessageId = request.MessageId,
+                Documents = Array.Empty<CultNetRawDocumentRecord>()
+            };
+            foreach (var handler in _handlers.ToArray()) handler(response);
+        }
+        public void OnCultNet<T>(Action<T> callback) where T : ICultNetSchemaMessage
+        {
+            if (typeof(T) == typeof(CultNetSnapshotResponseRawMessage))
+                _handlers.Add(message => callback((T)(object)message));
+        }
+        public void Dispose() => Interlocked.Increment(ref _disposeCount);
+        public bool IsVerifiedFor(string verseId, string authorityRuntimeId, string protocolId, string routeGeneration) =>
+            verseId == "aetheria" && authorityRuntimeId == "aetheria-daemon";
+    }
+
+    private sealed class PeerExchangeSchemaClient : ICultNetSchemaClient, ICultMeshVerifiedSchemaClient
+    {
+        private readonly List<Action<CultMeshPeerExchangeResponseMessage>> _handlers = new();
+        public bool Connected => true;
+        public int SentCount { get; private set; }
+        public void Connect(string host, int port) { }
+        public void SendCultNet<T>(T message) where T : ICultNetSchemaMessage
+        {
+            SentCount++;
+            var request = (CultMeshPeerExchangeRequestMessage)(object)message;
+            var response = new CultMeshPeerExchangeResponseMessage
+            {
+                MessageId = request.MessageId,
+                Peers = new[]
+                {
+                    new CultMeshPeerCard("peer-a", request.VerseId, new[] { "rudp://127.0.0.12:3076" }).ToMessage()
+                }
+            };
+            foreach (var handler in _handlers.ToArray()) handler(response);
+        }
+        public void OnCultNet<T>(Action<T> callback) where T : ICultNetSchemaMessage
+        {
+            if (typeof(T) == typeof(CultMeshPeerExchangeResponseMessage))
+                _handlers.Add(message => callback((T)(object)message));
+        }
+        public void Dispose() { }
+        public bool IsVerifiedFor(string verseId, string authorityRuntimeId, string protocolId, string routeGeneration) =>
+            verseId == "aetheria" && authorityRuntimeId == "aetheria-daemon";
+    }
+
+    private sealed class LeaseSchemaClient : ICultNetSchemaClient, ICultMeshVerifiedSchemaClient
+    {
+        private readonly List<Action<CultNetErrorMessage>> _handlers = new();
+        private int _disposeCount;
+        public bool Connected => true;
+        public int DisposeCount => Volatile.Read(ref _disposeCount);
+        public void Connect(string host, int port) { }
+        public void SendCultNet<T>(T message) where T : ICultNetSchemaMessage { }
+        public void OnCultNet<T>(Action<T> callback) where T : ICultNetSchemaMessage
+        {
+            if (typeof(T) == typeof(CultNetErrorMessage))
+                _handlers.Add(message => callback((T)(object)message));
+        }
+        public void Emit(CultNetErrorMessage message) { foreach (var handler in _handlers.ToArray()) handler(message); }
+        public void Dispose() => Interlocked.Increment(ref _disposeCount);
+        public bool IsVerifiedFor(string verseId, string authorityRuntimeId, string protocolId, string routeGeneration) =>
+            verseId == "aetheria" && authorityRuntimeId == "aetheria-daemon";
+    }
+
+    private sealed class ManualSessionClock : ICultMeshClock
+    {
+        public DateTimeOffset UtcNow { get; private set; } = new DateTimeOffset(2026, 7, 12, 21, 0, 0, TimeSpan.Zero);
+        public Task DelayAsync(TimeSpan delay, CancellationToken cancellationToken = default) { cancellationToken.ThrowIfCancellationRequested(); UtcNow += delay; return Task.CompletedTask; }
+        public void Advance(TimeSpan delay) => UtcNow += delay;
+    }
+}
diff --git a/tests/GameCult.Mesh.Tests/CultMeshStreamingTests.cs b/tests/GameCult.Mesh.Tests/CultMeshStreamingTests.cs
index 4278d621..584569e6 100644
--- a/tests/GameCult.Mesh.Tests/CultMeshStreamingTests.cs
+++ b/tests/GameCult.Mesh.Tests/CultMeshStreamingTests.cs
@@ -1,8 +1,15 @@
 using System;
+using System.Buffers;
+using System.Collections.Generic;
 using System.IO;
+using System.Linq;
+using System.Threading;
 using System.Threading.Tasks;
 using FluentAssertions;
 using GameCult.Caching;
+using GameCult.Caching.MessagePack;
+using GameCult.Networking;
+using MessagePack;
 using NUnit.Framework;
 using R3;
 
@@ -11,50 +18,3629 @@ namespace GameCult.Mesh.Tests;
 public sealed class CultMeshStreamingTests
 {
     [Test]
-    public async Task ManagedDocument_Commits_Through_MeshDatabase_And_Watches_Networked_Updates()
+    public async Task TypedOperationHandle_CarriesAuthorityAndRouteContext()
     {
-        var filePath = Path.Combine(Path.GetTempPath(), $"cultmesh-managed-{Guid.NewGuid():N}.ccmp");
+        var handle = new CultMeshOperationHandle<MeshMoveRequest, CultMeshOperationReceipt>(
+            "aetheria.entity.pilot.move",
+            (request, context) => Task.FromResult(new CultMeshOperationReceipt(
+                "aetheria.entity.pilot.move",
+                accepted: request.EntityId == 7 &&
+                          context.Claims.Count == 1 &&
+                          context.Claims[0].Role == "pilot-control" &&
+                          context.RouteHint.Kind == CultMeshLocalityKind.InProcess,
+                context.RouteHint)));
+
+        var receipt = await handle.InvokeAsync(
+            new MeshMoveRequest(7, 1, -1),
+            CultMeshOperationContext
+                .ForRuntime("unity-raven")
+                .WithClaim(new CultMeshAuthorityClaim("pilot-control", shardId: "zone:local-rts"))
+                .WithRoute(new CultMeshRouteHint(CultMeshLocalityKind.InProcess, "co-located daemon"))
+                .WithIdempotencyKey("move-7-001"));
+
+        receipt.Accepted.Should().BeTrue();
+        receipt.Route.Kind.Should().Be(CultMeshLocalityKind.InProcess);
+
+        var diagnostic = CultMesh.DescribeOperationHandle(handle);
+        diagnostic.OperationId.Should().Be("aetheria.entity.pilot.move");
+    }
+
+    [Test]
+    public void ContextBuilders_MakeTypedHandleCallsReadLikeVerseOperations()
+    {
+        var operationContext = CultMesh.OperationContextFor("unity-raven")
+            .Claim("pilot-control", shardId: "zone:local-rts", leaseId: "lease:raven")
+            .Route(CultMeshLocalityKind.SharedMemory, "co-located daemon")
+            .Idempotency("move-7-001")
+            .Build();
+
+        operationContext.RuntimeId.Should().Be("unity-raven");
+        operationContext.Claims.Should().ContainSingle();
+        operationContext.Claims[0].Role.Should().Be("pilot-control");
+        operationContext.Claims[0].ShardId.Should().Be("zone:local-rts");
+        operationContext.Claims[0].LeaseId.Should().Be("lease:raven");
+        operationContext.RouteHint.Kind.Should().Be(CultMeshLocalityKind.SharedMemory);
+        operationContext.IdempotencyKey.Should().Be("move-7-001");
+
+        var queryContext = CultMesh.QueryContextFor("browser-starfire")
+            .Route(CultMeshLocalityKind.Wasm, "browser-local projection")
+            .Build();
+
+        queryContext.RuntimeId.Should().Be("browser-starfire");
+        queryContext.RouteHint.Kind.Should().Be(CultMeshLocalityKind.Wasm);
+        queryContext.RouteHint.Description.Should().Be("browser-local projection");
+    }
+
+    [Test]
+    public async Task VerseContext_LetsGeneratedDomainSugarUseSharedTypedContexts()
+    {
+        var verse = await CultMesh.ConnectVerseAsync(
+            "starbridge",
+            "unity-raven",
+            new CultMeshRouteHint(CultMeshLocalityKind.SharedMemory, "co-located Verse"),
+            new[] { new CultMeshAuthorityClaim("pilot-control", shardId: "zone:raven", leaseId: "lease:raven") });
+        var commandVerse = verse.WithRoute(new CultMeshRouteHint(CultMeshLocalityKind.Network, "remote command route"));
+
+        var aetheria = commandVerse.Use(context => new MeshAetheriaDomain(context));
+        var receipt = await aetheria.Entity(7).Pilot.MoveAsync(new MeshVec2(1, 0), "move:raven:1");
+        var viewport = await aetheria.Zone("zone:raven").Objects.VisibleWithinAsync(new MeshViewportRequest(-16, 16));
+
+        verse.VerseId.Should().Be("starbridge");
+        verse.RuntimeId.Should().Be("unity-raven");
+        verse.QueryContext().RouteHint.Kind.Should().Be(CultMeshLocalityKind.SharedMemory);
+        commandVerse.OperationContext("move:raven:2").RouteHint.Kind.Should().Be(CultMeshLocalityKind.Network);
+        commandVerse.OperationContext("move:raven:2").IdempotencyKey.Should().Be("move:raven:2");
+        receipt.OperationId.Should().Be("aetheria.entity.pilot.move");
+        receipt.Accepted.Should().BeTrue();
+        receipt.Route.Kind.Should().Be(CultMeshLocalityKind.Network);
+        viewport.Should().Equal("unity-raven:zone:raven:-16:16:Network");
+    }
+
+    [Test]
+    public async Task QuerySurfaceAndStatePointer_ExposeTypedReactiveState()
+    {
+        var query = new CultMeshQuerySurface<MeshViewportRequest, string[]>(
+            "aetheria.zone.objects.visible",
+            (request, context) => Task.FromResult(new[] { $"{context.RuntimeId}:{request.MinX}:{request.MaxX}" }));
+
+        var queryResult = await query.ExecuteAsync(
+            new MeshViewportRequest(-8, 8),
+            CultMeshQueryContext.ForRuntime("browser-starfire"));
+
+        queryResult.Should().Equal("browser-starfire:-8:8");
+
+        var queryDiagnostic = CultMesh.DescribeQuerySurface(query);
+        queryDiagnostic.QueryId.Should().Be("aetheria.zone.objects.visible");
+        queryDiagnostic.RouteHint.Kind.Should().Be(CultMeshLocalityKind.Automatic);
+        queryDiagnostic.Sources.Should().BeEmpty();
+
+        var subject = new Subject<string>();
+        var pointer = CultMesh.StatePointer(
+            "aetheria.selection.current",
+            () => Task.FromResult("entity:station:0"),
+            () => subject,
+            new CultMeshRouteHint(CultMeshLocalityKind.SharedMemory, "co-located selection cache"),
+            new[]
+            {
+                CultMesh.ProjectionSource(
+                    "daemon:aetheria.selection.current.v1",
+                    schemaId: "gamecult.aetheria.selection.v1")
+            });
+
+        string observed = null!;
+        using var subscription = pointer.Watch().Subscribe(value => observed = value);
+
+        (await pointer.ResolveAsync()).Should().Be("entity:station:0");
+        subject.OnNext("entity:pawn:7");
+        observed.Should().Be("entity:pawn:7");
+
+        var pointerDiagnostic = CultMesh.DescribeStatePointer(pointer);
+        pointerDiagnostic.PointerId.Should().Be("aetheria.selection.current");
+        pointerDiagnostic.RouteHint.Kind.Should().Be(CultMeshLocalityKind.SharedMemory);
+        pointerDiagnostic.Sources.Should().ContainSingle().Which.SchemaId.Should().Be("gamecult.aetheria.selection.v1");
+    }
+
+    [Test]
+    public async Task StatePointer_CanBindToVerseContextForUiAndTools()
+    {
+        var subject = new Subject<string>();
+        var pointer = CultMesh.StatePointer(
+            "aetheria.daemon.frame.latest",
+            context => Task.FromResult($"{context.RuntimeId}:{context.RouteHint.Kind}"),
+            context => subject.Select(value => $"{context.RuntimeId}:{value}:{context.RouteHint.Kind}"),
+            new CultMeshRouteHint(CultMeshLocalityKind.SharedMemory, "co-located daemon frame"),
+            new[]
+            {
+                CultMesh.ProjectionSource(
+                    "daemon:aetheria.frame.latest.v1",
+                    schemaId: "gamecult.aetheria.daemon_frame.v1")
+            });
+
+        var verse = CultMesh.Verse(
+            "aetheria.local",
+            "bifrost-tool",
+            new CultMeshRouteHint(CultMeshLocalityKind.Ipc, "tool bridge"));
+        var bound = verse.BindStatePointer(pointer);
+
+        (await bound.ResolveAsync()).Should().Be("bifrost-tool:Ipc");
+
+        string observed = null!;
+        using var subscription = bound.Watch().Subscribe(value => observed = value);
+        subject.OnNext("frame:12");
+
+        bound.PointerId.Should().Be("aetheria.daemon.frame.latest");
+        bound.Sources.Should().ContainSingle().Which.SchemaId.Should().Be("gamecult.aetheria.daemon_frame.v1");
+        observed.Should().Be("bifrost-tool:frame:12:Ipc");
+    }
+
+    [Test]
+    public async Task MutableStatePointer_HoistsReadWatchReplaceDocumentHandles()
+    {
+        var subject = new Subject<string>();
+        var stored = "frame:0";
+        var observedContexts = new List<string>();
+        var pointer = CultMesh.MutableStatePointer(
+            "aetheria.daemon.frame.latest",
+            context =>
+            {
+                observedContexts.Add($"read:{context.RuntimeId}:{context.RouteHint.Kind}");
+                return Task.FromResult<string?>(stored);
+            },
+            context => subject.Select(value => $"{context.RuntimeId}:{value}:{context.RouteHint.Kind}"),
+            (context, value) =>
+            {
+                observedContexts.Add($"replace:{context.RuntimeId}:{context.RouteHint.Kind}");
+                stored = value;
+                subject.OnNext(value);
+                return Task.CompletedTask;
+            },
+            new CultMeshRouteHint(CultMeshLocalityKind.SharedMemory, "co-located daemon frame"),
+            new[]
+            {
+                CultMesh.ProjectionSource(
+                    "daemon:aetheria.frame.latest.v1",
+                    schemaId: "gamecult.aetheria.daemon_frame.v1")
+            });
+
+        var verse = CultMesh.Verse(
+            "aetheria.local",
+            "unity-raven",
+            new CultMeshRouteHint(CultMeshLocalityKind.Ipc, "tool bridge"));
+        var bound = verse.BindMutableStatePointer(pointer);
+
+        string observed = null!;
+        using var subscription = bound.Watch().Subscribe(value => observed = value);
+
+        (await bound.ReadAsync()).Should().Be("frame:0");
+        await bound.ReplaceAsync("frame:1");
+
+        stored.Should().Be("frame:1");
+        observed.Should().Be("unity-raven:frame:1:Ipc");
+        observedContexts.Should().Equal("read:unity-raven:Ipc", "replace:unity-raven:Ipc");
+
+        var diagnostic = CultMesh.DescribeStatePointer(pointer);
+        diagnostic.PointerId.Should().Be("aetheria.daemon.frame.latest");
+        diagnostic.RouteHint.Kind.Should().Be(CultMeshLocalityKind.SharedMemory);
+
+        var binding = CultMesh.StateBinding("frame", pointer);
+        binding.PointerId.Should().Be("aetheria.daemon.frame.latest");
+        binding.SchemaId.Should().Be("gamecult.aetheria.daemon_frame.v1");
+    }
+
+    [Test]
+    public void StateBindingDescriptor_BindsUiPropsToTypedStatePointers()
+    {
+        var pointer = CultMesh.StatePointer(
+            "aetheria.selection.current",
+            () => Task.FromResult("entity:station:0"),
+            () => new Subject<string>(),
+            new CultMeshRouteHint(CultMeshLocalityKind.SharedMemory, "co-located selection cache"),
+            new[]
+            {
+                CultMesh.ProjectionSource(
+                    "daemon:aetheria.selection.current.v1",
+                    schemaId: "gamecult.aetheria.selection.v1")
+            });
+
+        var binding = CultMesh.StateBinding("value", pointer);
+        var explicitBinding = CultMesh.StateBinding(
+            "label",
+            "aetheria.selection.label",
+            sourceId: "daemon:aetheria.selection.label.v1",
+            schemaId: "gamecult.aetheria.selection_label.v1",
+            routeHint: new CultMeshRouteHint(CultMeshLocalityKind.Ipc, "tool bridge"));
+
+        binding.TargetProp.Should().Be("value");
+        binding.PointerId.Should().Be("aetheria.selection.current");
+        binding.SourceId.Should().Be("daemon:aetheria.selection.current.v1");
+        binding.SchemaId.Should().Be("gamecult.aetheria.selection.v1");
+        binding.RouteHint.Kind.Should().Be(CultMeshLocalityKind.SharedMemory);
+        binding.RouteHint.Description.Should().Be("co-located selection cache");
+
+        explicitBinding.TargetProp.Should().Be("label");
+        explicitBinding.PointerId.Should().Be("aetheria.selection.label");
+        explicitBinding.SourceId.Should().Be("daemon:aetheria.selection.label.v1");
+        explicitBinding.SchemaId.Should().Be("gamecult.aetheria.selection_label.v1");
+        explicitBinding.RouteHint.Kind.Should().Be(CultMeshLocalityKind.Ipc);
+    }
+
+    [Test]
+    public void StateBindingRecord_FlattensAndRehydratesPointerBindingFields()
+    {
+        var binding = CultMesh.StateBinding(
+            "status",
+            "aetheria.current.status",
+            sourceId: "daemon:aetheria.frame.latest.v1",
+            schemaId: "gamecult.aetheria.daemon_frame.v1",
+            routeHint: new CultMeshRouteHint(CultMeshLocalityKind.SharedMemory, "co-located frame slab"));
+
+        var record = CultMesh.StateBindingRecord(binding);
+        record.TargetProp.Should().Be("status");
+        record.PointerId.Should().Be("aetheria.current.status");
+        record.SourceId.Should().Be("daemon:aetheria.frame.latest.v1");
+        record.SchemaId.Should().Be("gamecult.aetheria.daemon_frame.v1");
+        record.RouteKind.Should().Be(nameof(CultMeshLocalityKind.SharedMemory));
+        record.RouteDescription.Should().Be("co-located frame slab");
+
+        var fromTypescript = CultMesh.StateBindingRecord(
+            "value",
+            "aetheria.selection.current",
+            "daemon:aetheria.selection.current.v1",
+            "gamecult.aetheria.selection.v1",
+            "shared-memory",
+            "browser-adjacent cache").ToBinding();
+
+        fromTypescript.TargetProp.Should().Be("value");
+        fromTypescript.PointerId.Should().Be("aetheria.selection.current");
+        fromTypescript.SourceId.Should().Be("daemon:aetheria.selection.current.v1");
+        fromTypescript.SchemaId.Should().Be("gamecult.aetheria.selection.v1");
+        fromTypescript.RouteHint.Kind.Should().Be(CultMeshLocalityKind.SharedMemory);
+        fromTypescript.RouteHint.Description.Should().Be("browser-adjacent cache");
+    }
+
+    [Test]
+    public void StateBindingRecord_PreservesEditableFieldIdentityAndAuthority()
+    {
+        var binding = CultMesh.StateBinding(
+            "value",
+            "ghostlight.session-zero.composer",
+            sourceId: "session-zero:draft-7",
+            schemaId: "session_zero.v1",
+            routeHint: new CultMeshRouteHint(CultMeshLocalityKind.Network, "Ghostlight provider"),
+            bindingName: "composer.message",
+            documentId: "session-zero:draft-7",
+            fieldPath: "channels.private.messages.pending",
+            valueKind: "string",
+            accessMode: "local-draft",
+            authority: "SessionZeroKernel",
+            writeCommand: "edit.value");
+
+        var record = CultMesh.StateBindingRecord(binding);
+        record.BindingName.Should().Be("composer.message");
+        record.FieldPath.Should().Be("channels.private.messages.pending");
+        record.AccessMode.Should().Be("local-draft");
+        var restored = record.ToBinding();
+        restored.BindingName.Should().Be(binding.BindingName);
+        restored.DocumentId.Should().Be(binding.DocumentId);
+        restored.FieldPath.Should().Be(binding.FieldPath);
+        restored.ValueKind.Should().Be(binding.ValueKind);
+        restored.AccessMode.Should().Be(binding.AccessMode);
+        restored.Authority.Should().Be(binding.Authority);
+        restored.WriteCommand.Should().Be(binding.WriteCommand);
+    }
+
+    [Test]
+    public void OperationBindingDescriptor_BindsUiCommandsToTypedOperations()
+    {
+        var operation = new CultMeshOperationHandle<MeshMoveRequest, CultMeshOperationReceipt>(
+            "aetheria.entity.pilot.move",
+            (_request, _context) => Task.FromResult(new CultMeshOperationReceipt("aetheria.entity.pilot.move", true)));
+
+        var binding = CultMesh.OperationBinding(
+            operation,
+            label: "Move",
+            schemaId: "gamecult.aetheria.pilot_move.v1",
+            routeHint: new CultMeshRouteHint(CultMeshLocalityKind.Network, "remote Verse peer"));
+        var explicitBinding = CultMesh.OperationBinding(
+            "aetheria.surface.refresh",
+            label: "Refresh");
+
+        binding.OperationId.Should().Be("aetheria.entity.pilot.move");
+        binding.Label.Should().Be("Move");
+        binding.SchemaId.Should().Be("gamecult.aetheria.pilot_move.v1");
+        binding.RouteHint.Kind.Should().Be(CultMeshLocalityKind.Network);
+        binding.RouteHint.Description.Should().Be("remote Verse peer");
+
+        explicitBinding.OperationId.Should().Be("aetheria.surface.refresh");
+        explicitBinding.Label.Should().Be("Refresh");
+        explicitBinding.SchemaId.Should().Be("");
+        explicitBinding.RouteHint.Kind.Should().Be(CultMeshLocalityKind.Automatic);
+    }
+
+    [Test]
+    public void OperationBindingRecord_FlattensAndRehydratesSurfaceCommandFields()
+    {
+        var binding = CultMesh.OperationBinding(
+            "aetheria.entity.pilot.move",
+            label: "Move",
+            schemaId: "gamecult.aetheria.pilot_move.v1",
+            routeHint: new CultMeshRouteHint(CultMeshLocalityKind.Network, "remote Verse peer"));
+
+        var record = CultMesh.OperationBindingRecord(binding);
+        record.OperationId.Should().Be("aetheria.entity.pilot.move");
+        record.Label.Should().Be("Move");
+        record.SchemaId.Should().Be("gamecult.aetheria.pilot_move.v1");
+        record.RouteKind.Should().Be(nameof(CultMeshLocalityKind.Network));
+        record.RouteDescription.Should().Be("remote Verse peer");
+
+        var fromTypescript = CultMesh.OperationBindingRecord(
+            "aetheria.surface.refresh",
+            "Refresh",
+            "gamecult.aetheria.refresh.v1",
+            "in-process",
+            "embedded UI runtime").ToBinding();
+
+        fromTypescript.OperationId.Should().Be("aetheria.surface.refresh");
+        fromTypescript.Label.Should().Be("Refresh");
+        fromTypescript.SchemaId.Should().Be("gamecult.aetheria.refresh.v1");
+        fromTypescript.RouteHint.Kind.Should().Be(CultMeshLocalityKind.InProcess);
+        fromTypescript.RouteHint.Description.Should().Be("embedded UI runtime");
+    }
+
+    [Test]
+    public void OperationInvocationDescriptor_CarriesTypedOperationIdentityThroughUiRequests()
+    {
+        var binding = CultMesh.OperationBinding(
+            "aetheria.entity.pilot.move",
+            label: "Move",
+            schemaId: "gamecult.aetheria.pilot_move.v1",
+            routeHint: new CultMeshRouteHint(CultMeshLocalityKind.Ipc, "local Verse node"));
+
+        var invocation = CultMesh.OperationInvocation(binding, idempotencyKey: "move:42");
+        var explicitInvocation = CultMesh.OperationInvocation(
+            "aetheria.surface.refresh",
+            routeHint: new CultMeshRouteHint(CultMeshLocalityKind.Network, "remote Verse peer"));
+
+        invocation.OperationId.Should().Be("aetheria.entity.pilot.move");
+        invocation.SchemaId.Should().Be("gamecult.aetheria.pilot_move.v1");
+        invocation.RouteHint.Kind.Should().Be(CultMeshLocalityKind.Ipc);
+        invocation.RouteHint.Description.Should().Be("local Verse node");
+        invocation.IdempotencyKey.Should().Be("move:42");
+
+        explicitInvocation.OperationId.Should().Be("aetheria.surface.refresh");
+        explicitInvocation.SchemaId.Should().Be("");
+        explicitInvocation.RouteHint.Kind.Should().Be(CultMeshLocalityKind.Network);
+        explicitInvocation.IdempotencyKey.Should().BeNull();
+    }
+
+    [Test]
+    public void OperationPayload_ReadsCommonSurfaceScalarFields()
+    {
+        var payload = CultMesh.OperationPayload(
+            ("value", "42.5"),
+            ("tierIndex", "3"),
+            ("enabled", "on"),
+            ("name", "Starfire"));
+        var updated = payload.With("enabled", "false");
+
+        payload.GetString("name").Should().Be("Starfire");
+        payload.GetString("missing", "fallback").Should().Be("fallback");
+        payload.GetInt32("tierIndex", -1).Should().Be(3);
+        payload.GetInt32("missing", -1).Should().Be(-1);
+        payload.GetDouble("value", -1).Should().Be(42.5);
+        payload.GetBoolean("enabled").Should().BeTrue();
+        updated.GetBoolean("enabled", true).Should().BeFalse();
+        updated.GetString("name").Should().Be("Starfire");
+        payload.GetBoolean("missing", true).Should().BeTrue();
+        payload.Should().ContainKey("value");
+        payload.Count.Should().Be(4);
+    }
+
+    [Test]
+    public void OperationInvocationRecord_FlattensAndRehydratesTransportFields()
+    {
+        var invocation = CultMesh.OperationInvocation(
+            "aetheria.entity.pilot.move",
+            "gamecult.aetheria.pilot_move.v1",
+            new CultMeshRouteHint(CultMeshLocalityKind.Ipc, "local Verse node"),
+            "move:42");
+
+        var record = CultMesh.OperationInvocationRecord(invocation);
+        var restored = record.ToInvocation(
+            fallbackOperationId: "fallback.operation",
+            fallbackSchemaId: "fallback.schema",
+            fallbackRouteHint: new CultMeshRouteHint(CultMeshLocalityKind.Network, "fallback route"));
+        var fallback = CultMesh.OperationInvocationRecord(
+                operationId: "",
+                schemaId: "",
+                routeKind: "not-a-route",
+                routeDescription: "",
+                idempotencyKey: "")
+            .ToInvocation(
+                fallbackOperationId: "fallback.operation",
+                fallbackSchemaId: "fallback.schema",
+                fallbackRouteHint: new CultMeshRouteHint(CultMeshLocalityKind.Network, "fallback route"),
+                fallbackIdempotencyKey: "fallback-key");
+        var payloadFields = CultMesh.OperationPayload(("value", "Raven")).ToDictionary();
+
+        record.OperationId.Should().Be("aetheria.entity.pilot.move");
+        record.SchemaId.Should().Be("gamecult.aetheria.pilot_move.v1");
+        record.RouteKind.Should().Be("Ipc");
+        record.RouteDescription.Should().Be("local Verse node");
+        record.IdempotencyKey.Should().Be("move:42");
+        restored.OperationId.Should().Be("aetheria.entity.pilot.move");
+        restored.SchemaId.Should().Be("gamecult.aetheria.pilot_move.v1");
+        restored.RouteHint.Kind.Should().Be(CultMeshLocalityKind.Ipc);
+        restored.IdempotencyKey.Should().Be("move:42");
+        fallback.OperationId.Should().Be("fallback.operation");
+        fallback.SchemaId.Should().Be("fallback.schema");
+        fallback.RouteHint.Kind.Should().Be(CultMeshLocalityKind.Network);
+        fallback.RouteHint.Description.Should().Be("fallback route");
+        fallback.IdempotencyKey.Should().Be("fallback-key");
+        payloadFields["value"].Should().Be("Raven");
+    }
+
+    [Test]
+    public void OperationInvocationRecord_ReadsLegacyStringAndWritesStructuredRecord()
+    {
+        var legacyPayload = MessagePackSerializer.Serialize(
+            "aetheria.entity.pilot.move",
+            CultDocumentMessagePackSerialization.Options);
+        var restored = MessagePackSerializer.Deserialize<CultMeshOperationInvocationRecord>(
+            legacyPayload,
+            CultDocumentMessagePackSerialization.Options);
+        var currentPayload = MessagePackSerializer.Serialize(
+            restored,
+            CultDocumentMessagePackSerialization.Options);
+        var reader = new MessagePackReader(currentPayload);
+
+        restored.OperationId.Should().Be("aetheria.entity.pilot.move");
+        restored.SchemaId.Should().BeEmpty();
+        restored.RouteKind.Should().BeEmpty();
+        restored.IdempotencyKey.Should().BeEmpty();
+        reader.ReadArrayHeader().Should().Be(5);
+        reader.ReadString().Should().Be("aetheria.entity.pilot.move");
+    }
+
+    [Test]
+    public void RouteRecord_ReadsLegacyStringAndWritesStructuredRecord()
+    {
+        var legacyPayload = MessagePackSerializer.Serialize(
+            "SharedMemory",
+            CultDocumentMessagePackSerialization.Options);
+        var restored = MessagePackSerializer.Deserialize<CultMeshRouteRecord>(
+            legacyPayload,
+            CultDocumentMessagePackSerialization.Options);
+        var currentPayload = MessagePackSerializer.Serialize(
+            restored,
+            CultDocumentMessagePackSerialization.Options);
+        var reader = new MessagePackReader(currentPayload);
+
+        restored.Kind.Should().Be("SharedMemory");
+        restored.Description.Should().BeEmpty();
+        reader.ReadArrayHeader().Should().Be(2);
+        reader.ReadString().Should().Be("SharedMemory");
+    }
+
+    [Test]
+    public void RouteRecord_FlattensAndParsesCrossRuntimeRouteKinds()
+    {
+        var record = CultMesh.RouteRecord(new CultMeshRouteHint(CultMeshLocalityKind.SharedMemory, "co-located slab"));
+        var restored = record.ToRoute();
+        var fromTypescript = CultMesh.RouteRecord("in-process", "").ToRoute(
+            new CultMeshRouteHint(CultMeshLocalityKind.Network, "fallback route"));
+        var fallback = CultMesh.RouteRecord("not-real", "").ToRoute(
+            new CultMeshRouteHint(CultMeshLocalityKind.Ipc, "fallback route"));
+
+        record.Kind.Should().Be("SharedMemory");
+        record.Description.Should().Be("co-located slab");
+        restored.Kind.Should().Be(CultMeshLocalityKind.SharedMemory);
+        restored.Description.Should().Be("co-located slab");
+        fromTypescript.Kind.Should().Be(CultMeshLocalityKind.InProcess);
+        fromTypescript.Description.Should().Be("fallback route");
+        fallback.Kind.Should().Be(CultMeshLocalityKind.Ipc);
+        fallback.Description.Should().Be("fallback route");
+    }
+
+    [Test]
+    public void StateRefResolver_ComposesNamedSurfaceResolution()
+    {
+        var route = new CultMeshRouteHint(CultMeshLocalityKind.InProcess, "embedded renderer");
+        var daemon = CultMesh.StateRefResolver(
+            "aetheria.daemon.refs",
+            (stateRef, context) => stateRef == "aetheria.daemon/frame/id"
+                ? $"{context.RuntimeId}:{context.RouteHint.Kind}:42"
+                : "",
+            new[]
+            {
+                CultMesh.ProjectionSource(
+                    "daemon:aetheria.frame.latest.v1",
+                    schemaId: "gamecult.aetheria.daemon_frame.v1")
+            },
+            route);
+        var itemStats = CultMesh.StateRefResolver(
+            "aetheria.item_stats.refs",
+            stateRef => stateRef == "aetheria.item_stats/laser/damage" ? "12.5" : "");
+        var resolver = daemon.Or(itemStats);
+
+        resolver.Resolve(
+                "aetheria.daemon/frame/id",
+                CultMesh.QueryContextFor("unity-raven")
+                    .Route(CultMeshLocalityKind.Network, "remote peer")
+                    .Build())
+            .Should()
+            .Be("unity-raven:Network:42");
+        resolver.Resolve("aetheria.item_stats/laser/damage").Should().Be("12.5");
+        resolver.TryResolve("missing", out var missing).Should().BeFalse();
+        missing.Should().Be("");
+        resolver.AsFunc()("aetheria.item_stats/laser/damage").Should().Be("12.5");
+
+        var diagnostic = CultMesh.DescribeStateRefResolver(resolver);
+        diagnostic.ResolverId.Should().Be("aetheria.daemon.refs|aetheria.item_stats.refs");
+        diagnostic.RouteHint.Kind.Should().Be(CultMeshLocalityKind.InProcess);
+        diagnostic.Sources.Should().ContainSingle();
+        diagnostic.Sources[0].SchemaId.Should().Be("gamecult.aetheria.daemon_frame.v1");
+    }
+
+    [Test]
+    public async Task ProjectionRecipe_NamesSourcesAndCanBecomeQuerySurface()
+    {
+        var recipe = CultMesh.ProjectionRecipe<MeshViewportRequest, string[]>(
+            "aetheria.zone.objects.visible",
+            new[]
+            {
+                CultMesh.ProjectionSource(
+                    "daemon:aetheria.frame.latest.v1",
+                    schemaId: "gamecult.aetheria.daemon_frame.v1",
+                    description: "latest daemon frame"),
+                CultMesh.ProjectionSource(
+                    "daemon:aetheria.authority.policy.v1",
+                    schemaId: "gamecult.aetheria.authority_policy.v1")
+            },
+            (request, context) => Task.FromResult(new[]
+            {
+                $"{context.RuntimeId}:{request.MinX}:{request.MaxX}:{context.RouteHint.Kind}"
+            }),
+            new CultMeshRouteHint(CultMeshLocalityKind.SharedMemory, "co-located frame slab"));
+
+        recipe.Sources.Should().HaveCount(2);
+        recipe.Sources[0].SourceId.Should().Be("daemon:aetheria.frame.latest.v1");
+        recipe.RouteHint.Kind.Should().Be(CultMeshLocalityKind.SharedMemory);
+
+        var recipeDiagnostic = CultMesh.DescribeProjectionRecipe(recipe);
+        recipeDiagnostic.ProjectionId.Should().Be("aetheria.zone.objects.visible");
+        recipeDiagnostic.RouteHint.Description.Should().Be("co-located frame slab");
+        recipeDiagnostic.Sources.Should().HaveCount(2);
+        recipeDiagnostic.Sources[0].SchemaId.Should().Be("gamecult.aetheria.daemon_frame.v1");
+        recipeDiagnostic.Sources.Should().NotBeSameAs(recipe.Sources);
+
+        var result = await recipe.ProjectAsync(
+            new MeshViewportRequest(-16, 16),
+            CultMesh.QueryContextFor("browser-starfire")
+                .Route(CultMeshLocalityKind.Wasm, "browser-local projection")
+                .Build());
+
+        result.Should().Equal("browser-starfire:-16:16:Wasm");
+
+        var query = recipe.AsQuerySurface();
+        var queryResult = await query.ExecuteAsync(
+            new MeshViewportRequest(-4, 4),
+            "unity-raven");
+
+        query.QueryId.Should().Be(recipe.ProjectionId);
+        query.Sources.Should().HaveCount(2);
+        query.Sources[0].SchemaId.Should().Be("gamecult.aetheria.daemon_frame.v1");
+        query.RouteHint.Kind.Should().Be(CultMeshLocalityKind.SharedMemory);
+        queryResult.Should().Equal("unity-raven:-4:4:SharedMemory");
+
+        var queryDiagnostic = CultMesh.DescribeQuerySurface(query);
+        queryDiagnostic.QueryId.Should().Be("aetheria.zone.objects.visible");
+        queryDiagnostic.RouteHint.Kind.Should().Be(CultMeshLocalityKind.SharedMemory);
+        queryDiagnostic.Sources.Should().HaveCount(2);
+        queryDiagnostic.Sources.Should().NotBeSameAs(query.Sources);
+    }
+
+    [Test]
+    public async Task LiveFeed_DescribesAndWatchesCoherentClientSnapshots()
+    {
+        var subject = new Subject<string>();
+        var feed = CultMesh.LiveFeed<MeshViewportRequest, string>(
+            "aetheria.rts.viewport.feed",
+            (request, context) => Task.FromResult(
+                $"{context.RuntimeId}:{request.MinX}:{request.MaxX}:{context.RouteHint.Kind}"),
+            (_request, context) => subject.Select(value => $"{context.RuntimeId}:{value}:{context.RouteHint.Kind}"),
+            new[]
+            {
+                CultMesh.ProjectionSource(
+                    "daemon:aetheria.frame.latest.v1",
+                    schemaId: "gamecult.aetheria.daemon_frame.v1"),
+                CultMesh.ProjectionSource(
+                    "daemon:aetheria.health.latest.v1",
+                    schemaId: "gamecult.aetheria.daemon_health.v1")
+            },
+            new CultMeshRouteHint(CultMeshLocalityKind.SharedMemory, "co-located RTS cache"));
+
+        feed.FeedId.Should().Be("aetheria.rts.viewport.feed");
+        feed.Sources.Should().HaveCount(2);
+        feed.Sources[0].SchemaId.Should().Be("gamecult.aetheria.daemon_frame.v1");
+        feed.RouteHint.Kind.Should().Be(CultMeshLocalityKind.SharedMemory);
+
+        var diagnostic = CultMesh.DescribeLiveFeed(feed);
+        diagnostic.FeedId.Should().Be("aetheria.rts.viewport.feed");
+        diagnostic.RouteHint.Description.Should().Be("co-located RTS cache");
+        diagnostic.Sources.Should().HaveCount(2);
+        diagnostic.Sources[1].SourceId.Should().Be("daemon:aetheria.health.latest.v1");
+        diagnostic.Sources.Should().NotBeSameAs(feed.Sources);
+
+        var inherited = await feed.SnapshotAsync(
+            new MeshViewportRequest(-32, 32),
+            "browser-starfire");
+
+        inherited.Should().Be("browser-starfire:-32:32:SharedMemory");
+
+        var explicitRoute = await feed.SnapshotAsync(
+            new MeshViewportRequest(-32, 32),
+            CultMesh.QueryContextFor("unity-raven")
+                .Route(CultMeshLocalityKind.InProcess, "embedded Verse")
+                .Build());
+
+        explicitRoute.Should().Be("unity-raven:-32:32:InProcess");
+
+        string observed = null!;
+        using var subscription = feed
+            .Watch(new MeshViewportRequest(-1, 1), CultMeshQueryContext.ForRuntime("browser-starfire"))
+            .Subscribe(value => observed = value);
+
+        subject.OnNext("frame:42");
+        observed.Should().Be("browser-starfire:frame:42:SharedMemory");
+    }
+
+    [Test]
+    public async Task DocumentHandle_ExposesTypedSnapshotsAndSameSchemaAliases()
+    {
+        var subject = new Subject<MeshNoteDocument>();
+        var route = new CultMeshRouteHint(CultMeshLocalityKind.SharedMemory, "co-located document slab");
+        var sources = new[]
+        {
+            CultMesh.ProjectionSource(
+                "daemon:mesh.note.current",
+                schemaId: "tests.mesh_note.v1")
+        };
+        var context = CultMesh.Verse("starbridge", "unity-pilot", route).Context;
+        var current = new MeshNoteDocument
+        {
+            Schema = "tests.mesh_note.v1",
+            Text = "primary",
+            Revision = 1
+        };
+
+        var handle = CultMesh.Document(
+            "mesh.note.current",
+            context,
+            _ => Task.FromResult(current),
+            _ => subject,
+            sources,
+            route);
+
+        handle.DocumentId.Should().Be("mesh.note.current");
+        handle.DocumentType.Should().Be(typeof(MeshNoteDocument));
+        handle.SchemaName.Should().Be("tests.mesh_note");
+        handle.SchemaVersion.Should().Be("tests.mesh_note.v1");
+        handle.RouteHint.Kind.Should().Be(CultMeshLocalityKind.SharedMemory);
+        handle.Sources.Should().ContainSingle().Which.SourceId.Should().Be("daemon:mesh.note.current");
+
+        var snapshot = await handle.LatestAsync();
+        snapshot.Text.Should().Be("primary");
+        handle.Latest().Text.Should().Be("primary");
+
+        var alias = handle.AsSchemaAlias<MeshNoteAliasDocument>();
+        var aliasSnapshot = await alias.LatestAsync();
+        alias.Latest().Text.Should().Be("primary");
+        alias.DocumentId.Should().Be(handle.DocumentId);
+        alias.SchemaName.Should().Be(handle.SchemaName);
+        alias.SchemaVersion.Should().Be(handle.SchemaVersion);
+        aliasSnapshot.Text.Should().Be("primary");
+        aliasSnapshot.Revision.Should().Be(1);
+
+        MeshNoteAliasDocument observed = null!;
+        using var subscription = alias.Watch(value => observed = value);
+        subject.OnNext(new MeshNoteDocument
+        {
+            Schema = "tests.mesh_note.v1",
+            Text = "reactive",
+            Revision = 2
+        });
+
+        observed.Text.Should().Be("reactive");
+        observed.Revision.Should().Be(2);
+    }
+
+    [Test]
+    public async Task DocumentHandle_Field_ProjectsTypedReactiveStateWithoutRepublishingSurfaceTrees()
+    {
+        var subject = new Subject<MeshNoteDocument>();
+        var route = new CultMeshRouteHint(CultMeshLocalityKind.SharedMemory, "co-located document slab");
+        var current = new MeshNoteDocument
+        {
+            Schema = "tests.mesh_note.v1",
+            Text = "initial",
+            Revision = 1
+        };
+        var handle = CultMesh.Document(
+            "mesh.note.current",
+            CultMesh.Verse("starbridge", "unity-pilot", route),
+            _ => Task.FromResult(current),
+            _ => subject,
+            routeHint: route);
+
+        var text = handle.Field(value => value.Text);
+
+        text.PointerId.Should().Be("mesh.note.current#Text");
+        text.RouteHint.Kind.Should().Be(CultMeshLocalityKind.SharedMemory);
+        (await text.ResolveAsync()).Should().Be("initial");
+        string observed = null!;
+        using var subscription = text.Watch().Subscribe(value => observed = value);
+        subject.OnNext(new MeshNoteDocument
+        {
+            Schema = "tests.mesh_note.v1",
+            Text = "reactive",
+            Revision = 2
+        });
+        observed.Should().Be("reactive");
+    }
+
+    [Test]
+    public void DocumentHandle_RejectsAliasTypesWithDifferentSchemaIdentity()
+    {
+        var handle = CultMesh.Document(
+            "mesh.note.current",
+            CultMesh.Verse("starbridge", "unity-pilot"),
+            _ => Task.FromResult(new MeshNoteDocument
+            {
+                Schema = "tests.mesh_note.v1",
+                Text = "primary",
+                Revision = 1
+            }),
+            _ => new Subject<MeshNoteDocument>());
+
+        Action act = () => handle.AsSchemaAlias<MeshOtherDocument>();
+
+        act.Should()
+            .Throw<InvalidOperationException>()
+            .WithMessage("*tests.mesh_other*tests.mesh_note*");
+    }
+
+    [Test]
+    public async Task DocumentCatalog_IndexesHandlesByTypeAndSchemaAlias()
+    {
+        var current = new MeshNoteDocument
+        {
+            Schema = "tests.mesh_note.v1",
+            Text = "catalog-primary",
+            Revision = 3
+        };
+        var handle = CultMesh.Document(
+            "mesh.note.current",
+            CultMesh.Verse("starbridge", "unity-pilot"),
+            _ => Task.FromResult(current),
+            _ => new Subject<MeshNoteDocument>());
+        var catalog = CultMesh.Documents(handle);
+
+        catalog.Documents.Should().ContainSingle().Which.Should().BeSameAs(handle);
+        catalog.TryGetDocument<MeshNoteDocument>(out var exact).Should().BeTrue();
+        exact.Should().BeSameAs(handle);
+        catalog.TryGetDocumentBySchema("tests.mesh_note.v1", out var byVersion).Should().BeTrue();
+        byVersion.Should().BeSameAs(handle);
+        catalog.DocumentBySchema("tests.mesh_note").Should().BeSameAs(handle);
+        catalog.DocumentBySchema(CultDocumentRegistry.Shared.GetRequired<MeshNoteDocument>().SchemaId)
+            .Should()
+            .BeSameAs(handle);
+
+        catalog.TryGetDocument<MeshNoteAliasDocument>(out var alias).Should().BeTrue();
+        alias.DocumentId.Should().Be(handle.DocumentId);
+        alias.SchemaName.Should().Be(handle.SchemaName);
+        alias.SchemaVersion.Should().Be(handle.SchemaVersion);
+
+        var aliasSnapshot = await catalog.LatestAsync<MeshNoteAliasDocument>();
+        aliasSnapshot.Text.Should().Be("catalog-primary");
+        aliasSnapshot.Revision.Should().Be(3);
+        catalog.Latest<MeshNoteAliasDocument>().Text.Should().Be("catalog-primary");
+    }
+
+    [Test]
+    public async Task DocumentHelpers_ProjectLatestSnapshotsFromMultipleHandles()
+    {
+        var primary = CultMesh.Document(
+            "mesh.note.primary",
+            CultMesh.Verse("starbridge", "unity-pilot"),
+            _ => Task.FromResult(new MeshNoteDocument
+            {
+                Schema = "tests.mesh_note.v1",
+                Text = "alpha",
+                Revision = 3
+            }),
+            _ => new Subject<MeshNoteDocument>());
+        var secondary = CultMesh.Document(
+            "mesh.note.secondary",
+            CultMesh.Verse("starbridge", "unity-pilot"),
+            _ => Task.FromResult(new MeshOtherDocument
+            {
+                Schema = "tests.mesh_other.v1",
+                Text = "beta"
+            }),
+            _ => new Subject<MeshOtherDocument>());
+
+        var projected = await CultMesh.LatestAsync(
+            primary,
+            secondary,
+            (first, second) => $"{first.Text}:{first.Revision}:{second.Text}");
+
+        projected.Should().Be("alpha:3:beta");
+    }
+
+    [Test]
+    public async Task DocumentHandle_ReadsWatchesAndReplacesCultCacheRecords()
+    {
+        var cache = new CultCache();
+        var key = new CultRecordKey("mesh-note:cache");
+        await cache.UpsertAsync(new MeshNoteDocument
+        {
+            Schema = "tests.mesh_note.v1",
+            Text = "cache-initial",
+            Revision = 1
+        }, new CultRecordHandle<MeshNoteDocument>(key));
+
+        var handle = CultMesh.Document<MeshNoteDocument>(
+            cache,
+            key,
+            CultMesh.Verse("starbridge", "unity-pilot"));
+        var alias = handle.AsSchemaAlias<MeshNoteAliasDocument>();
+
+        handle.CanReplace.Should().BeTrue();
+        alias.CanReplace.Should().BeTrue();
+        handle.CanSubmitPrediction.Should().BeFalse();
+        alias.CanSubmitPrediction.Should().BeFalse();
+        handle.DocumentId.Should().Be(key.Value);
+        handle.Sources.Should().ContainSingle().Which.SchemaId.Should().Be(handle.SchemaId);
+
+        var snapshot = await alias.LatestAsync();
+        snapshot.Text.Should().Be("cache-initial");
+
+        MeshNoteAliasDocument observed = null!;
+        using var subscription = alias.Watch(value => observed = value);
+        await alias.ReplaceAsync(new MeshNoteAliasDocument
+        {
+            Schema = "tests.mesh_note.v1",
+            Text = "cache-replaced",
+            Revision = 2
+        });
+
+        cache.Get<MeshNoteDocument>(key)!.Text.Should().Be("cache-replaced");
+        observed.Text.Should().Be("cache-replaced");
+        observed.Revision.Should().Be(2);
+
+        var catalog = CultMesh.Documents(handle);
+        catalog.CanReplace<MeshNoteAliasDocument>().Should().BeTrue();
+        await catalog.ReplaceAsync(new MeshNoteAliasDocument
+        {
+            Schema = "tests.mesh_note.v1",
+            Text = "cache-catalog-replaced",
+            Revision = 3
+        });
+        cache.Get<MeshNoteDocument>(key)!.Text.Should().Be("cache-catalog-replaced");
+
+        Func<Task> act = () => alias.SubmitPredictionAsync(new MeshNoteAliasDocument
+        {
+            Schema = "tests.mesh_note.v1",
+            Text = "cache-predicted",
+            Revision = 4
+        });
+        await act.Should().ThrowAsync<NotSupportedException>();
+    }
+
+    [Test]
+    public async Task DocumentHandle_SubmitsPredictionsThroughCultNetDatabase()
+    {
+        var cache = new CultCache();
+        var schemaId = CultDocumentRegistry.Shared.GetRequired<MeshNoteDocument>().SchemaId;
+        var database = new CultNetDatabase(cache, new CultNetDatabaseOptions
+        {
+            RuntimeId = "pilot-a",
+            Shards = new[]
+            {
+                new CultNetShardDescriptor(
+                    "pilot-inputs",
+                    "server",
+                    epoch: 1,
+                    isPrimary: false,
+                    schemaIds: new[] { schemaId },
+                    keyPrefix: "input:")
+            },
+            ClientAuthorityScopes = new[]
+            {
+                new CultNetClientAuthorityScope(
+                    "pilot-a",
+                    schemaIds: new[] { schemaId },
+                    keyPrefix: "input:pilot-a")
+            }
+        });
+        var key = new CultRecordKey("input:pilot-a:thermal");
+
+        var handle = CultMesh.Document<MeshNoteDocument>(
+            database,
+            key,
+            CultMesh.Verse("starbridge", "pilot-a"));
+        var alias = handle.AsSchemaAlias<MeshNoteAliasDocument>();
+
+        handle.CanReplace.Should().BeFalse();
+        alias.CanReplace.Should().BeFalse();
+        alias.CanSubmitPrediction.Should().BeTrue();
+        var catalog = CultMesh.Documents(handle);
+        catalog.CanSubmitPrediction<MeshNoteAliasDocument>().Should().BeTrue();
+        var predictionWriter = catalog.PredictionWriter<MeshNoteAliasDocument>();
+        predictionWriter.Kind.Should().Be(CultMeshDocumentWriteKind.Prediction);
+
+        MeshNoteDocument observed = null!;
+        using var subscription = handle.Watch(value => observed = value);
+        await predictionWriter.WriteAsync(new MeshNoteAliasDocument
+        {
+            Schema = "tests.mesh_note.v1",
+            Text = "predicted-thermal",
+            Revision = 5
+        });
+
+        cache.Get<MeshNoteDocument>(key)!.Text.Should().Be("predicted-thermal");
+        observed.Text.Should().Be("predicted-thermal");
+        observed.Revision.Should().Be(5);
+        (await handle.LatestAsync()).Text.Should().Be("predicted-thermal");
+
+        var updated = await alias.PredictionWriter().UpdateAsync(value => new MeshNoteAliasDocument
+        {
+            Schema = value.Schema,
+            Text = "updated-as-prediction",
+            Revision = value.Revision + 1
+        });
+        updated.Text.Should().Be("updated-as-prediction");
+        cache.Get<MeshNoteDocument>(key)!.Revision.Should().Be(6);
+    }
+
+    [Test]
+    public async Task ReactiveDocument_CoalescesLocalEditsIntoOnePrediction()
+    {
+        var subject = new Subject<MeshNoteDocument>();
+        var current = new MeshNoteDocument
+        {
+            Schema = "tests.mesh_note.v1",
+            Text = "initial",
+            Revision = 1
+        };
+        var predictions = new List<MeshNoteDocument>();
+        var handle = CultMesh.Document(
+            "mesh.note.reactive",
+            CultMesh.Verse("starbridge", "pilot-a"),
+            _ => Task.FromResult(current),
+            _ => subject,
+            value =>
+            {
+                current = value;
+                subject.OnNext(value);
+                return Task.CompletedTask;
+            },
+            value =>
+            {
+                predictions.Add(value);
+                current = value;
+                subject.OnNext(value);
+                return Task.CompletedTask;
+            });
+        var catalog = CultMesh.Documents(handle);
+
+        using var reactive = await catalog.PredictionWriter<MeshNoteAliasDocument>().ReactiveAsync(
+            new CultMeshReactiveDocumentOptions
+            {
+                FlushDelay = TimeSpan.FromMinutes(1)
+            });
+
+        reactive.Snapshot.Text.Should().Be("initial");
+        reactive.Update(document =>
+        {
+            document.Text = "first-local-edit";
+            document.Revision++;
+        });
+        reactive.Update(document =>
+        {
+            document.Text = "second-local-edit";
+            document.Revision++;
+        });
+
+        predictions.Should().BeEmpty();
+
+        await reactive.FlushAsync();
+
+        predictions.Should().ContainSingle();
+        predictions[0].Text.Should().Be("second-local-edit");
+        predictions[0].Revision.Should().Be(3);
+        current.Text.Should().Be("second-local-edit");
+    }
+
+    [Test]
+    public async Task ReactiveDocument_TracksCanonicalSnapshotDuringDirtyPrediction()
+    {
+        var subject = new Subject<MeshNoteDocument>();
+        var current = new MeshNoteDocument
+        {
+            Schema = "tests.mesh_note.v1",
+            Text = "initial",
+            Revision = 1
+        };
+        var handle = CultMesh.Document(
+            "mesh.note.reconciliation",
+            CultMesh.Verse("starbridge", "pilot-a"),
+            _ => Task.FromResult(current),
+            _ => subject,
+            value =>
+            {
+                current = value;
+                subject.OnNext(value);
+                return Task.CompletedTask;
+            });
+
+        using var reactive = await handle.AuthoritativeWriter().ReactiveAsync(
+            new CultMeshReactiveDocumentOptions
+            {
+                FlushDelay = TimeSpan.FromMinutes(1)
+            });
+
+        reactive.Update(document =>
+        {
+            document.Text = "local-prediction";
+            document.Revision = 2;
+        });
+
+        subject.OnNext(new MeshNoteDocument
+        {
+            Schema = "tests.mesh_note.v1",
+            Text = "canonical-correction",
+            Revision = 7
+        });
+
+        reactive.Snapshot.Text.Should().Be("local-prediction");
+        reactive.Reconciliation.Should().NotBeNull();
+        reactive.Reconciliation!.Version.Should().Be(1);
+        reactive.Reconciliation!.Canonical.Text.Should().Be("canonical-correction");
+        reactive.Reconciliation.Predicted.Text.Should().Be("local-prediction");
+        reactive.Reconciliation.Delta.Should().ContainKey(nameof(MeshNoteDocument.Text));
+        reactive.Reconciliation.Delta[nameof(MeshNoteDocument.Text)].Should().Be("local-prediction");
+        reactive.Reconciliation.Delta.Should().ContainKey(nameof(MeshNoteDocument.Revision));
+        reactive.Reconciliation.Delta[nameof(MeshNoteDocument.Revision)].Should().Be(-5.0);
+    }
+
+    [Test]
+    public async Task ReactiveDocument_AutoFlushesOnceAfterDebounceWindow()
+    {
+        var subject = new Subject<MeshNoteDocument>();
+        var current = new MeshNoteDocument
+        {
+            Schema = "tests.mesh_note.v1",
+            Text = "initial",
+            Revision = 1
+        };
+        var predictions = new List<MeshNoteDocument>();
+        var handle = CultMesh.Document(
+            "mesh.note.reactive.debounce",
+            CultMesh.Verse("starbridge", "pilot-a"),
+            _ => Task.FromResult(current),
+            _ => subject,
+            value =>
+            {
+                current = value;
+                subject.OnNext(value);
+                return Task.CompletedTask;
+            },
+            value =>
+            {
+                predictions.Add(value);
+                current = value;
+                subject.OnNext(value);
+                return Task.CompletedTask;
+            });
+
+        using var reactive = await handle.PredictionWriter().ReactiveAsync(
+            new CultMeshReactiveDocumentOptions
+            {
+                FlushDelay = TimeSpan.FromMilliseconds(25)
+            });
+
+        reactive.Update(document =>
+        {
+            document.Text = "coalesced-one";
+            document.Revision++;
+        });
+        reactive.Update(document =>
+        {
+            document.Text = "coalesced-two";
+            document.Revision++;
+        });
+
+        await WaitForAsync(() => predictions.Count == 1);
+
+        predictions[0].Text.Should().Be("coalesced-two");
+        predictions[0].Revision.Should().Be(3);
+        reactive.IsDirty.Should().BeFalse();
+    }
+
+    [Test]
+    public async Task ReactiveDocument_CoalescesExplicitMemberUpdates()
+    {
+        var subject = new Subject<MeshNoteDocument>();
+        var current = new MeshNoteDocument
+        {
+            Schema = "tests.mesh_note.v1",
+            Text = "initial",
+            Revision = 1
+        };
+        var predictions = new List<MeshNoteDocument>();
+        var handle = CultMesh.Document(
+            "mesh.note.reactive.direct-members",
+            CultMesh.Verse("starbridge", "pilot-a"),
+            _ => Task.FromResult(current),
+            _ => subject,
+            value =>
+            {
+                current = value;
+                subject.OnNext(value);
+                return Task.CompletedTask;
+            },
+            value =>
+            {
+                predictions.Add(value);
+                current = value;
+                subject.OnNext(value);
+                return Task.CompletedTask;
+            });
+
+        using var reactive = await handle.PredictionWriter().ReactiveAsync(
+            new CultMeshReactiveDocumentOptions
+            {
+                FlushDelay = TimeSpan.FromMilliseconds(25)
+            });
+
+        reactive.Update(document => document.Text = "explicit-member-one");
+        reactive.Update(document =>
+        {
+            document.Text = "explicit-member-two";
+            document.Revision = 2;
+        });
+
+        await WaitForAsync(() => predictions.Count == 1);
+
+        predictions[0].Text.Should().Be("explicit-member-two");
+        predictions[0].Revision.Should().Be(2);
+        current.Text.Should().Be("explicit-member-two");
+        reactive.IsDirty.Should().BeFalse();
+    }
+
+    [Test]
+    public async Task ReactiveDocument_QueuesExplicitEditsWhileFlushIsInFlight()
+    {
+        var subject = new Subject<MeshNoteDocument>();
+        var current = new MeshNoteDocument
+        {
+            Schema = "tests.mesh_note.v1",
+            Text = "initial",
+            Revision = 1
+        };
+        var firstPredictionStarted = new TaskCompletionSource(TaskCreationOptions.RunContinuationsAsynchronously);
+        var releaseFirstPrediction = new TaskCompletionSource(TaskCreationOptions.RunContinuationsAsynchronously);
+        var predictions = new List<MeshNoteDocument>();
+        var handle = CultMesh.Document(
+            "mesh.note.reactive.in-flight",
+            CultMesh.Verse("starbridge", "pilot-a"),
+            _ => Task.FromResult(current),
+            _ => subject,
+            value =>
+            {
+                current = value;
+                subject.OnNext(value);
+                return Task.CompletedTask;
+            },
+            async value =>
+            {
+                predictions.Add(value);
+                if (predictions.Count == 1)
+                {
+                    firstPredictionStarted.SetResult();
+                    await releaseFirstPrediction.Task.ConfigureAwait(false);
+                }
+
+                current = value;
+                subject.OnNext(value);
+            });
+
+        using var reactive = await handle.PredictionWriter().ReactiveAsync(
+            new CultMeshReactiveDocumentOptions
+            {
+                FlushDelay = TimeSpan.FromMinutes(1)
+            });
+
+        reactive.Update(document =>
+        {
+            document.Text = "first-in-flight";
+            document.Revision = 2;
+        });
+        var flushTask = reactive.FlushAsync();
+        await firstPredictionStarted.Task;
+
+        reactive.Update(document =>
+        {
+            document.Text = "second-after-flight-started";
+            document.Revision = 3;
+        });
+        releaseFirstPrediction.SetResult();
+
+        await flushTask;
+
+        predictions.Should().HaveCount(2);
+        predictions.Select(document => document.Text).Should().Equal(
+            "first-in-flight",
+            "second-after-flight-started");
+        current.Text.Should().Be("second-after-flight-started");
+        current.Revision.Should().Be(3);
+        reactive.IsDirty.Should().BeFalse();
+    }
+
+    [Test]
+    public async Task ReactiveDocument_UsesReplacementWhenPredictionIsUnavailable()
+    {
+        var subject = new Subject<MeshNoteDocument>();
+        var current = new MeshNoteDocument
+        {
+            Schema = "tests.mesh_note.v1",
+            Text = "initial",
+            Revision = 1
+        };
+        var replacements = new List<MeshNoteDocument>();
+        var handle = CultMesh.Document(
+            "mesh.note.reactive.replace",
+            CultMesh.Verse("starbridge", "daemon"),
+            _ => Task.FromResult(current),
+            _ => subject,
+            value =>
+            {
+                replacements.Add(value);
+                current = value;
+                subject.OnNext(value);
+                return Task.CompletedTask;
+            });
+
+        using var reactive = await handle.AuthoritativeWriter().ReactiveAsync(
+            new CultMeshReactiveDocumentOptions
+            {
+                FlushDelay = TimeSpan.FromMinutes(1)
+            });
+
+        reactive.Update(document =>
+        {
+            document.Text = "authoritative-replace";
+            document.Revision = 10;
+        });
+        await reactive.FlushAsync();
+
+        replacements.Should().ContainSingle();
+        replacements[0].Text.Should().Be("authoritative-replace");
+        current.Revision.Should().Be(10);
+    }
+
+    [Test]
+    public void ReactiveDocument_ReadOnlyHandleRejectsWriterSelection()
+    {
+        var current = new MeshNoteDocument
+        {
+            Schema = "tests.mesh_note.v1",
+            Text = "initial",
+            Revision = 1
+        };
+        var handle = CultMesh.Document(
+            "mesh.note.reactive.readonly",
+            CultMesh.Verse("starbridge", "observer"),
+            _ => Task.FromResult(current),
+            _ => new Subject<MeshNoteDocument>());
+
+        Action authoritative = () => handle.AuthoritativeWriter();
+        Action prediction = () => handle.PredictionWriter();
+
+        authoritative.Should().Throw<NotSupportedException>();
+        prediction.Should().Throw<NotSupportedException>();
+    }
+
+    [Test]
+    public async Task ObservedDocument_WatchesWithoutWriteCapabilityOrIdleTimer()
+    {
+        var subject = new Subject<MeshNoteDocument>();
+        var current = new MeshNoteDocument
+        {
+            Schema = "tests.mesh_note.v1",
+            Text = "initial",
+            Revision = 1
+        };
+        var handle = CultMesh.Document(
+            "mesh.note.observed.readonly",
+            CultMesh.Verse("starbridge", "observer"),
+            _ => Task.FromResult(current),
+            _ => subject);
+
+        using var observed = await handle.ObserveAsync();
+        observed.Current.Text.Should().Be("initial");
+        typeof(CultMeshObservedDocument<MeshNoteDocument>)
+            .GetFields(System.Reflection.BindingFlags.Instance | System.Reflection.BindingFlags.NonPublic)
+            .Should()
+            .NotContain(field => field.FieldType == typeof(System.Threading.Timer));
+
+        subject.OnNext(new MeshNoteDocument
+        {
+            Schema = "tests.mesh_note.v1",
+            Text = "canonical-update",
+            Revision = 2
+        });
+
+        observed.Current.Text.Should().Be("canonical-update");
+        observed.Current.Revision.Should().Be(2);
+    }
+
+    // The older of two racing writes is parked in an earlier observer until the newer one has been applied.
+    [Test]
+    public async Task WatchRecordIgnoresStaleSequence()
+    {
+        var cache = new CultCache();
+        var key = new CultRecordKey("mesh-note:stale-sequence");
+        var handle = new CultRecordHandle<MeshNoteDocument>(key);
+        MeshNoteDocument Note(string text, int revision) =>
+            new() { Schema = "tests.mesh_note.v1", Text = text, Revision = revision };
+        await cache.UpsertAsync(Note("initial", 1), handle);
+        using var release = new System.Threading.ManualResetEventSlim();
+        using var parked = new System.Threading.ManualResetEventSlim();
+        using var park = cache.WatchRecord<MeshNoteDocument>(key).Subscribe(change =>
+        {
+            if (change.Document?.Revision != 2) return;
+            parked.Set();
+            release.Wait(TimeSpan.FromSeconds(30));
+        });
+        using var observed = await CultMesh.Document<MeshNoteDocument>(cache, key).ObserveAsync();
+
+        var older = Task.Run(() => cache.UpsertAsync(Note("older", 2), handle));
+        parked.Wait(TimeSpan.FromSeconds(5)).Should().BeTrue();
+        var newer = Task.Run(() => cache.UpsertAsync(Note("newer", 3), handle));
+        var newerFinished = newer.Wait(TimeSpan.FromSeconds(10));
+        release.Set();
+
+        newerFinished.Should().BeTrue("a writer waited on another thread's delivery");
+        older.Wait(TimeSpan.FromSeconds(10)).Should().BeTrue();
+        observed.Current.Text.Should().Be("newer");
+        cache.Dispose();
+    }
+
+    // A batch parks in an observer of another key before publishing its (older) target-key change; the mirror is
+    // created after a newer write landed, then the straggler is delivered.
+    [TestCase(false)]
+    [TestCase(true)]
+    public async Task ObserveAfterNewerSnapshotIgnoresStraggler(bool reactive)
+    {
+        var cache = new CultCache();
+        var key = new CultRecordKey("mesh-note:straggler");
+        var other = new CultRecordKey("mesh-note:straggler-other");
+        await cache.UpsertAsync(Note("initial", 1), new CultRecordHandle<MeshNoteDocument>(key));
+        using var release = new ManualResetEventSlim();
+        using var parked = new ManualResetEventSlim();
+        using var park = cache.WatchRecord<MeshNoteDocument>(other).Subscribe(_ =>
+        {
+            parked.Set();
+            release.Wait(TimeSpan.FromSeconds(30));
+        });
+
+        var batch = Task.Run(() => cache.Commit(stage =>
+        {
+            stage.Upsert(Note("other", 1), new CultRecordHandle<MeshNoteDocument>(other));
+            stage.Upsert(Note("older", 2), new CultRecordHandle<MeshNoteDocument>(key));
+        }));
+        parked.Wait(TimeSpan.FromSeconds(5)).Should().BeTrue();
+        await cache.UpsertAsync(Note("newer", 3), new CultRecordHandle<MeshNoteDocument>(key));
+        var (mirror, text, _) = await Mirror(cache, key, reactive);
+        release.Set();
+
+        batch.Wait(TimeSpan.FromSeconds(10)).Should().BeTrue();
+        text().Should().Be("newer");
+        mirror.Dispose();
+        cache.Dispose();
+    }
+
+    // The mirror's own delivery of the newer write is parked too, so only the refresh saw it before the straggler.
+    [TestCase(false)]
+    [TestCase(true)]
+    public async Task RefreshIgnoresStragglerOlderThanSnapshot(bool reactive)
+    {
+        var cache = new CultCache();
+        var key = new CultRecordKey("mesh-note:refresh-straggler");
+        var other = new CultRecordKey("mesh-note:refresh-straggler-other");
+        await cache.UpsertAsync(Note("initial", 1), new CultRecordHandle<MeshNoteDocument>(key));
+        using var releaseOlder = new ManualResetEventSlim();
+        using var olderParked = new ManualResetEventSlim();
+        using var releaseNewer = new ManualResetEventSlim();
+        using var newerParked = new ManualResetEventSlim();
+        using var parkOlder = cache.WatchRecord<MeshNoteDocument>(other).Subscribe(_ =>
+        {
+            olderParked.Set();
+            releaseOlder.Wait(TimeSpan.FromSeconds(30));
+        });
+        using var parkNewer = cache.WatchRecord<MeshNoteDocument>(key).Subscribe(change =>
+        {
+            if (change.Document?.Text != "newer") return;
+            newerParked.Set();
+            releaseNewer.Wait(TimeSpan.FromSeconds(30));
+        });
+        var (mirror, text, refresh) = await Mirror(cache, key, reactive);
+
+        var batch = Task.Run(() => cache.Commit(stage =>
+        {
+            stage.Upsert(Note("other", 1), new CultRecordHandle<MeshNoteDocument>(other));
+            stage.Upsert(Note("older", 2), new CultRecordHandle<MeshNoteDocument>(key));
+        }));
+        olderParked.Wait(TimeSpan.FromSeconds(5)).Should().BeTrue();
+        var newer = Task.Run(() => cache.UpsertAsync(Note("newer", 3), new CultRecordHandle<MeshNoteDocument>(key)));
+        newerParked.Wait(TimeSpan.FromSeconds(5)).Should().BeTrue();
+        await refresh();
+        releaseOlder.Set();
+        batch.Wait(TimeSpan.FromSeconds(10)).Should().BeTrue();
+        text().Should().Be("newer");
+        releaseNewer.Set();
+
+        newer.Wait(TimeSpan.FromSeconds(10)).Should().BeTrue();
+        text().Should().Be("newer");
+        mirror.Dispose();
+        cache.Dispose();
+    }
+
+    private static MeshNoteDocument Note(string text, int revision) =>
+        new() { Schema = "tests.mesh_note.v1", Text = text, Revision = revision };
+
+    private static async Task<(IDisposable Mirror, Func<string> Text, Func<Task> Refresh)> Mirror(
+        CultCache cache, CultRecordKey key, bool reactive)
+    {
+        var handle = CultMesh.Document<MeshNoteDocument>(cache, key);
+        if (reactive)
+        {
+            var mirror = await handle.AuthoritativeWriter().ReactiveAsync();
+            return (mirror, () => mirror.Snapshot.Text, () => mirror.RefreshAsync());
+        }
+
+        var observed = await handle.ObserveAsync();
+        return (observed, () => observed.Current.Text, () => observed.RefreshAsync());
+    }
+
+    [Test]
+    public async Task ReactiveDocument_DisposeSuppressesScheduledFlush()
+    {
+        var subject = new Subject<MeshNoteDocument>();
+        var current = new MeshNoteDocument
+        {
+            Schema = "tests.mesh_note.v1",
+            Text = "initial",
+            Revision = 1
+        };
+        var predictions = new List<MeshNoteDocument>();
+        var handle = CultMesh.Document(
+            "mesh.note.reactive.dispose",
+            CultMesh.Verse("starbridge", "pilot-a"),
+            _ => Task.FromResult(current),
+            _ => subject,
+            value =>
+            {
+                current = value;
+                subject.OnNext(value);
+                return Task.CompletedTask;
+            },
+            value =>
+            {
+                predictions.Add(value);
+                current = value;
+                subject.OnNext(value);
+                return Task.CompletedTask;
+            });
+
+        var reactive = await handle.PredictionWriter().ReactiveAsync(
+            new CultMeshReactiveDocumentOptions
+            {
+                FlushDelay = TimeSpan.FromMilliseconds(25)
+            });
+        reactive.Update(document => document.Text = "disposed-before-flush");
+        reactive.Dispose();
+
+        await Task.Delay(100);
+
+        predictions.Should().BeEmpty();
+    }
+
+    [Test]
+    public async Task ReactiveDocument_CanAdoptCanonicalSnapshotWhileDirty()
+    {
+        var subject = new Subject<MeshNoteDocument>();
+        var current = new MeshNoteDocument
+        {
+            Schema = "tests.mesh_note.v1",
+            Text = "initial",
+            Revision = 1
+        };
+        var handle = CultMesh.Document(
+            "mesh.note.reactive.adopt-canonical",
+            CultMesh.Verse("starbridge", "pilot-a"),
+            _ => Task.FromResult(current),
+            _ => subject,
+            value =>
+            {
+                current = value;
+                subject.OnNext(value);
+                return Task.CompletedTask;
+            });
+
+        using var reactive = await handle.AuthoritativeWriter().ReactiveAsync(
+            new CultMeshReactiveDocumentOptions
+            {
+                FlushDelay = TimeSpan.FromMinutes(1),
+                ReplaceDirtyCurrentOnCanonicalSnapshot = true
+            });
+        reactive.Update(document => document.Text = "local-prediction");
+
+        subject.OnNext(new MeshNoteDocument
+        {
+            Schema = "tests.mesh_note.v1",
+            Text = "canonical-wins",
+            Revision = 9
+        });
+
+        reactive.Snapshot.Text.Should().Be("canonical-wins");
+        reactive.Snapshot.Revision.Should().Be(9);
+        reactive.Reconciliation.Should().BeNull();
+    }
+
+    [Test]
+    public async Task ReactiveDocument_RefreshClearsDirtyLocalState()
+    {
+        var current = new MeshNoteDocument
+        {
+            Schema = "tests.mesh_note.v1",
+            Text = "initial",
+            Revision = 1
+        };
+        var replacements = new List<MeshNoteDocument>();
+        var handle = CultMesh.Document(
+            "mesh.note.reactive.refresh",
+            CultMesh.Verse("starbridge", "pilot-a"),
+            _ => Task.FromResult(current),
+            _ => new Subject<MeshNoteDocument>(),
+            value =>
+            {
+                replacements.Add(value);
+                current = value;
+                return Task.CompletedTask;
+            });
+
+        using var reactive = await handle.AuthoritativeWriter().ReactiveAsync(
+            new CultMeshReactiveDocumentOptions
+            {
+                FlushDelay = TimeSpan.FromMinutes(1)
+            });
+        reactive.Update(document => document.Text = "local-dirty");
+        current = new MeshNoteDocument
+        {
+            Schema = "tests.mesh_note.v1",
+            Text = "fresh-canonical",
+            Revision = 5
+        };
+
+        await reactive.RefreshAsync();
+        await reactive.FlushAsync();
+
+        reactive.Snapshot.Text.Should().Be("fresh-canonical");
+        reactive.IsDirty.Should().BeFalse();
+        replacements.Should().BeEmpty();
+    }
+
+    [Test]
+    public async Task ReactiveDocument_SyncsSameSchemaAliasesAcrossRuntimeHandles()
+    {
+        var cache = new CultCache();
+        var schemaId = CultDocumentRegistry.Shared.GetRequired<MeshNoteDocument>().SchemaId;
+        var database = new CultNetDatabase(cache, new CultNetDatabaseOptions
+        {
+            RuntimeId = "pilot-a",
+            Shards = new[]
+            {
+                new CultNetShardDescriptor(
+                    "pilot-inputs",
+                    "server",
+                    epoch: 1,
+                    isPrimary: false,
+                    schemaIds: new[] { schemaId },
+                    keyPrefix: "input:")
+            },
+            ClientAuthorityScopes = new[]
+            {
+                new CultNetClientAuthorityScope(
+                    "pilot-a",
+                    schemaIds: new[] { schemaId },
+                    keyPrefix: "input:pilot-a")
+            }
+        });
+        var key = new CultRecordKey("input:pilot-a:reactive");
+        await cache.UpsertAsync(new MeshNoteDocument
+        {
+            Schema = "tests.mesh_note.v1",
+            Text = "initial",
+            Revision = 1
+        }, new CultRecordHandle<MeshNoteDocument>(key));
+
+        var pilotHandle = CultMesh.Document<MeshNoteDocument>(
+            database,
+            key,
+            CultMesh.Verse("starbridge", "pilot-a"));
+        var commanderHandle = CultMesh.Document<MeshNoteDocument>(
+            database,
+            key,
+            CultMesh.Verse("starbridge", "commander-rts"));
+        var observedByCommander = new List<MeshNoteAliasDocument>();
+        using var commanderSubscription = commanderHandle
+            .AsSchemaAlias<MeshNoteAliasDocument>()
+            .Watch(observedByCommander.Add);
+        using var pilotReactive = await CultMesh
+            .Documents(pilotHandle)
+            .PredictionWriter<MeshNoteAliasDocument>()
+            .ReactiveAsync(
+                new CultMeshReactiveDocumentOptions
+                {
+                    FlushDelay = TimeSpan.FromMinutes(1)
+                });
+
+        pilotReactive.Update(document =>
+        {
+            document.Text = "pilot-predicted";
+            document.Revision = 2;
+        });
+        await pilotReactive.FlushAsync();
+
+        await WaitForAsync(() => observedByCommander.Any(document => document.Text == "pilot-predicted"));
+
+        commanderHandle.Context.RuntimeId.Should().Be("commander-rts");
+        observedByCommander.Last().Revision.Should().Be(2);
+        (await commanderHandle.AsSchemaAlias<MeshNoteAliasDocument>().LatestAsync()).Text.Should().Be("pilot-predicted");
+    }
+
+    [Test]
+    public async Task ReactiveDocument_TwoRuntimeManagedDocumentsSyncThroughDatabase()
+    {
+        var cache = new CultCache();
+        var schemaId = CultDocumentRegistry.Shared.GetRequired<MeshNoteDocument>().SchemaId;
+        var database = new CultNetDatabase(cache, new CultNetDatabaseOptions
+        {
+            RuntimeId = "pilot-a",
+            Shards = new[]
+            {
+                new CultNetShardDescriptor(
+                    "pilot-inputs",
+                    "server",
+                    epoch: 1,
+                    isPrimary: false,
+                    schemaIds: new[] { schemaId },
+                    keyPrefix: "input:")
+            },
+            ClientAuthorityScopes = new[]
+            {
+                new CultNetClientAuthorityScope(
+                    "pilot-a",
+                    schemaIds: new[] { schemaId },
+                    keyPrefix: "input:pilot-a")
+            }
+        });
+        var key = new CultRecordKey("input:pilot-a:co-op");
+        await cache.UpsertAsync(new MeshNoteDocument
+        {
+            Schema = "tests.mesh_note.v1",
+            Text = "initial",
+            Revision = 1
+        }, new CultRecordHandle<MeshNoteDocument>(key));
+
+        var pilotHandle = CultMesh.Document<MeshNoteDocument>(
+            database,
+            key,
+            CultMesh.Verse("starbridge", "pilot-a"));
+        var commanderHandle = CultMesh.Document<MeshNoteDocument>(
+            database,
+            key,
+            CultMesh.Verse("starbridge", "commander-rts"));
+        MeshNoteAliasDocument commanderSnapshot = null!;
+        using var commanderSubscription = commanderHandle
+            .AsSchemaAlias<MeshNoteAliasDocument>()
+            .Watch(value => commanderSnapshot = value);
+        using var pilotReactive = await pilotHandle
+            .AsSchemaAlias<MeshNoteAliasDocument>()
+            .PredictionWriter()
+            .ReactiveAsync(new CultMeshReactiveDocumentOptions
+            {
+                FlushDelay = TimeSpan.FromMinutes(1)
+            });
+
+        pilotReactive.Update(document =>
+        {
+            document.Text = "pilot-first-touch";
+            document.Revision++;
+        });
+        pilotReactive.Update(document =>
+        {
+            document.Text = "pilot-coalesced-order";
+            document.Revision++;
+        });
+        await pilotReactive.FlushAsync();
+
+        await WaitForAsync(() => commanderSnapshot?.Text == "pilot-coalesced-order");
+
+        pilotReactive.IsDirty.Should().BeFalse();
+        commanderHandle.Context.RuntimeId.Should().Be("commander-rts");
+        commanderSnapshot.Revision.Should().Be(3);
+        cache.Get<MeshNoteDocument>(key)!.Text.Should().Be("pilot-coalesced-order");
+    }
+
+    [Test]
+    public async Task NodeDocument_OpensExplicitPredictionWriterForSameSchemaAlias()
+    {
+        var schemaId = CultDocumentRegistry.Shared.GetRequired<MeshNoteDocument>().SchemaId;
+        using var temp = new TemporaryDirectory();
+        using var node = await CultMesh.CreateNodeAsync(
+            Path.Combine(temp.Path, "node-reactive-alias.ccmp"),
+            new CultMeshNodeOptions
+            {
+                StartServer = false,
+                DatabaseOptions = new CultNetDatabaseOptions
+                {
+                    RuntimeId = "pilot-a",
+                    Shards = new[]
+                    {
+                        new CultNetShardDescriptor(
+                            "pilot-inputs",
+                            "server",
+                            epoch: 1,
+                            isPrimary: false,
+                            schemaIds: new[] { schemaId },
+                            keyPrefix: "input:")
+                    },
+                    ClientAuthorityScopes = new[]
+                    {
+                        new CultNetClientAuthorityScope(
+                            "pilot-a",
+                            schemaIds: new[] { schemaId },
+                            keyPrefix: "input:pilot-a")
+                    }
+                }
+            });
+        var key = new CultRecordKey("input:pilot-a:node-reactive");
+        await node.Cache.UpsertAsync(new MeshNoteDocument
+        {
+            Schema = "tests.mesh_note.v1",
+            Text = "node-initial",
+            Revision = 1
+        }, new CultRecordHandle<MeshNoteDocument>(key));
+
+        using var pilotReactive = await node
+            .Document<MeshNoteAliasDocument>(key, CultMesh.Verse("starbridge", "pilot-a"))
+            .PredictionWriter()
+            .ReactiveAsync(new CultMeshReactiveDocumentOptions
+            {
+                FlushDelay = TimeSpan.FromMinutes(1)
+            });
+        var commanderHandle = node.Document<MeshNoteDocument>(
+            key.Value,
+            CultMesh.Verse("starbridge", "commander-rts"));
+        var observedByCommander = new List<MeshNoteDocument>();
+        using var commanderSubscription = commanderHandle.Watch(observedByCommander.Add);
+
+        pilotReactive.Update(document =>
+        {
+            document.Text = "node-one-call-prediction";
+            document.Revision = 2;
+        });
+        await pilotReactive.FlushAsync();
+
+        await WaitForAsync(() => observedByCommander.Any(document => document.Text == "node-one-call-prediction"));
+        pilotReactive.Document.DocumentId.Should().Be(key.Value);
+        pilotReactive.Document.Context.RuntimeId.Should().Be("pilot-a");
+        node.Cache.Get<MeshNoteDocument>(key)!.Text.Should().Be("node-one-call-prediction");
+        (await commanderHandle.AsSchemaAlias<MeshNoteAliasDocument>().LatestAsync()).Revision.Should().Be(2);
+    }
+
+    [Test]
+    public async Task SyncedSnapshotEndpointObservesCanonicalCorrectionAcrossRuntimeBoundary()
+    {
+        var sourceCache = new CultCache();
+        var registry = new CultNetDocumentRegistry(CultDocumentRegistry.Shared);
+        registry.Register(CultNetDocumentBinding.ForDocument<MeshNoteDocument>(sourceCache.Registry));
+        var key = new CultRecordKey("mesh-note:remote-correction");
+        await sourceCache.UpsertAsync(new MeshNoteDocument
+        {
+            Schema = "tests.mesh_note.v1",
+            Text = "initial",
+            Revision = 1
+        }, new CultRecordHandle<MeshNoteDocument>(key));
+        var endpoint = "cultnet://remote-correction.test:3080";
+        var surface = CultMesh.SnapshotEndpoint(
+            endpoint,
+            new CultMeshSnapshotEndpointOptions
+            {
+                Context = CultMesh.Verse("starbridge", "unity-pilot").Context,
+                DocumentRegistry = registry,
+                PollInterval = TimeSpan.FromMilliseconds(10),
+                Request = new CultMeshSnapshotRequestOptions
+                {
+                    CreateClient = () => new MeshSnapshotSchemaClient(request =>
+                        registry.CreateRawSnapshotResponse(sourceCache, request.MessageId, request))
+                }
+            });
+
+        using var temp = new TemporaryDirectory();
+        using var node = await CultMesh.CreateNodeAsync(
+            Path.Combine(temp.Path, "pilot-runtime.ccmp"),
+            new CultMeshNodeOptions
+            {
+                StartServer = false,
+                CacheOptions = new CultCacheOpenOptions
+                {
+                    Registry = sourceCache.Registry
+                },
+                DatabaseOptions = new CultNetDatabaseOptions
+                {
+                    DocumentRegistry = registry
+                }
+        });
+        var handle = surface.SyncTo(node).Document<MeshNoteAliasDocument>(key.Value);
+        MeshNoteAliasDocument observed = null!;
+        using var subscription = handle.Watch(value => observed = value);
+        await sourceCache.UpsertAsync(new MeshNoteDocument
+        {
+            Schema = "tests.mesh_note.v1",
+            Text = "remote-authority-correction",
+            Revision = 7
+        }, new CultRecordHandle<MeshNoteDocument>(key));
+
+        await WaitForAsync(() => observed?.Text == "remote-authority-correction");
+
+        observed.Revision.Should().Be(7);
+        node.Cache.Get<MeshNoteDocument>(key)!.Text.Should().Be("remote-authority-correction");
+    }
+
+    [Test]
+    public async Task ReactiveDocument_FreshRuntimeReconstructsFromSyncedSnapshotEndpoint()
+    {
+        var sourceCache = new CultCache();
+        var registry = new CultNetDocumentRegistry(CultDocumentRegistry.Shared);
+        registry.Register(CultNetDocumentBinding.ForDocument<MeshNoteDocument>(sourceCache.Registry));
+        var key = new CultRecordKey("mesh-note:runtime-reconnect");
+        await sourceCache.UpsertAsync(new MeshNoteDocument
+        {
+            Schema = "tests.mesh_note.v1",
+            Text = "before-crash",
+            Revision = 1
+        }, new CultRecordHandle<MeshNoteDocument>(key));
+        var endpoint = "cultnet://runtime-reconnect.test:3081";
+        var surface = CultMesh.SnapshotEndpoint(
+            endpoint,
+            new CultMeshSnapshotEndpointOptions
+            {
+                Context = CultMesh.Verse("starbridge", "unity-reconnected").Context,
+                DocumentRegistry = registry,
+                Request = new CultMeshSnapshotRequestOptions
+                {
+                    CreateClient = () => new MeshSnapshotSchemaClient(request =>
+                        registry.CreateRawSnapshotResponse(sourceCache, request.MessageId, request))
+                }
+            });
+
+        using var temp = new TemporaryDirectory();
+        using (var crashedRuntime = await CultMesh.CreateNodeAsync(
+                   Path.Combine(temp.Path, "crashed-runtime.ccmp"),
+                   new CultMeshNodeOptions
+                   {
+                       StartServer = false,
+                       CacheOptions = new CultCacheOpenOptions
+                       {
+                           Registry = sourceCache.Registry
+                       },
+                       DatabaseOptions = new CultNetDatabaseOptions
+                       {
+                           DocumentRegistry = registry
+                       }
+                   }))
+        {
+            var stale = await surface.SyncTo(crashedRuntime).Document<MeshNoteAliasDocument>(key.Value).LatestAsync();
+            stale.Text.Should().Be("before-crash");
+        }
+
+        await sourceCache.UpsertAsync(new MeshNoteDocument
+        {
+            Schema = "tests.mesh_note.v1",
+            Text = "after-reboot-authority",
+            Revision = 4
+        }, new CultRecordHandle<MeshNoteDocument>(key));
+        using var freshRuntime = await CultMesh.CreateNodeAsync(
+            Path.Combine(temp.Path, "fresh-runtime.ccmp"),
+            new CultMeshNodeOptions
+            {
+                StartServer = false,
+                CacheOptions = new CultCacheOpenOptions
+                {
+                    Registry = sourceCache.Registry
+                },
+                DatabaseOptions = new CultNetDatabaseOptions
+                {
+                    DocumentRegistry = registry
+                }
+            });
+        var reconstructed = await surface
+            .SyncTo(freshRuntime)
+            .Documents(CultMesh.SnapshotDocument<MeshNoteDocument>(key.Value))
+            .LatestAsync<MeshNoteAliasDocument>();
+
+        reconstructed.Text.Should().Be("after-reboot-authority");
+        reconstructed.Revision.Should().Be(4);
+        freshRuntime.Cache.Get<MeshNoteDocument>(key)!.Text.Should().Be("after-reboot-authority");
+    }
+
+    [Test]
+    public async Task ReactiveDocument_ReadOnlySnapshotEndpointRefreshRecoversAfterRejectedLocalEdit()
+    {
+        var sourceCache = new CultCache();
+        var registry = new CultNetDocumentRegistry(CultDocumentRegistry.Shared);
+        registry.Register(CultNetDocumentBinding.ForDocument<MeshNoteDocument>(sourceCache.Registry));
+        var key = new CultRecordKey("mesh-note:readonly-refresh");
+        await sourceCache.UpsertAsync(new MeshNoteDocument
+        {
+            Schema = "tests.mesh_note.v1",
+            Text = "initial",
+            Revision = 1
+        }, new CultRecordHandle<MeshNoteDocument>(key));
+        var endpoint = "cultnet://readonly-refresh.test:3082";
+        var surface = CultMesh.SnapshotEndpoint(
+            endpoint,
+            new CultMeshSnapshotEndpointOptions
+            {
+                Context = CultMesh.Verse("starbridge", "observer").Context,
+                DocumentRegistry = registry,
+                Request = new CultMeshSnapshotRequestOptions
+                {
+                    CreateClient = () => new MeshSnapshotSchemaClient(request =>
+                        registry.CreateRawSnapshotResponse(sourceCache, request.MessageId, request))
+                }
+            });
+
+        using var temp = new TemporaryDirectory();
+        using var node = await CultMesh.CreateNodeAsync(
+            Path.Combine(temp.Path, "observer-runtime.ccmp"),
+            new CultMeshNodeOptions
+            {
+                StartServer = false,
+                CacheOptions = new CultCacheOpenOptions
+                {
+                    Registry = sourceCache.Registry
+                },
+                DatabaseOptions = new CultNetDatabaseOptions
+                {
+                    DocumentRegistry = registry
+                }
+            });
+        var readOnlyHandle = surface
+            .SyncTo(node)
+            .Document<MeshNoteAliasDocument>(key.Value);
+        readOnlyHandle.CanReplace.Should().BeFalse();
+        readOnlyHandle.CanSubmitPrediction.Should().BeFalse();
+
+        await sourceCache.UpsertAsync(new MeshNoteDocument
+        {
+            Schema = "tests.mesh_note.v1",
+            Text = "fresh-authority",
+            Revision = 5
+        }, new CultRecordHandle<MeshNoteDocument>(key));
+        var refreshed = await readOnlyHandle.LatestAsync();
+
+        refreshed.Text.Should().Be("fresh-authority");
+        node.Cache.Get<MeshNoteDocument>(key)!.Revision.Should().Be(5);
+    }
+
+    [Test]
+    public async Task ReactiveDocument_SnapshotMutationCannotPublish()
+    {
+        var subject = new Subject<MeshNoteDocument>();
+        var current = new MeshNoteDocument
+        {
+            Schema = "tests.mesh_note.v1",
+            Text = "initial",
+            Revision = 1
+        };
+        var predictions = new List<MeshNoteDocument>();
+        var handle = CultMesh.Document(
+            "mesh.note.reactive.mark-dirty",
+            CultMesh.Verse("starbridge", "pilot-a"),
+            _ => Task.FromResult(current),
+            _ => subject,
+            value =>
+            {
+                current = value;
+                subject.OnNext(value);
+                return Task.CompletedTask;
+            },
+            value =>
+            {
+                predictions.Add(value);
+                current = value;
+                subject.OnNext(value);
+                return Task.CompletedTask;
+            });
+
+        using var reactive = await handle.PredictionWriter().ReactiveAsync(
+            new CultMeshReactiveDocumentOptions
+            {
+                FlushDelay = TimeSpan.FromMinutes(1)
+            });
+
+        var escapedSnapshot = reactive.Snapshot;
+        escapedSnapshot.Text = "must-not-publish";
+        escapedSnapshot.Revision = 12;
+        await reactive.FlushAsync();
+
+        predictions.Should().BeEmpty();
+        reactive.Snapshot.Text.Should().Be("initial");
+        reactive.IsDirty.Should().BeFalse();
+    }
+
+    [Test]
+    public async Task ReactiveDocument_IdleMirrorDoesNotPublishUntilExplicitUpdate()
+    {
+        var subject = new Subject<MeshNoteDocument>();
+        var current = new MeshNoteDocument
+        {
+            Schema = "tests.mesh_note.v1",
+            Text = "initial",
+            Revision = 1
+        };
+        var predictions = new List<MeshNoteDocument>();
+        var handle = CultMesh.Document(
+            "mesh.note.reactive.direct-member-auto",
+            CultMesh.Verse("starbridge", "pilot-a"),
+            _ => Task.FromResult(current),
+            _ => subject,
+            value =>
+            {
+                current = value;
+                subject.OnNext(value);
+                return Task.CompletedTask;
+            },
+            value =>
+            {
+                predictions.Add(value);
+                current = value;
+                subject.OnNext(value);
+                return Task.CompletedTask;
+            });
+
+        using var reactive = await handle.PredictionWriter().ReactiveAsync(
+            new CultMeshReactiveDocumentOptions
+            {
+                FlushDelay = TimeSpan.FromMilliseconds(10)
+            });
+
+        await Task.Delay(75);
+        predictions.Should().BeEmpty();
+
+        reactive.Update(document =>
+        {
+            document.Text = "explicit-member-edit";
+            document.Revision = 3;
+        });
+
+        await WaitForAsync(() => predictions.Count == 1);
+
+        predictions[0].Text.Should().Be("explicit-member-edit");
+        predictions[0].Revision.Should().Be(3);
+        reactive.IsDirty.Should().BeFalse();
+    }
+
+    [TestCase(1)]
+    [TestCase(100)]
+    [TestCase(1000)]
+    public async Task ReactiveDocument_SchedulingScalesWithChangedDocumentsOnly(int documentCount)
+    {
+        var clock = new BlockingCountClock();
+        var reactiveDocuments = new List<CultMeshReactiveDocument<MeshNoteDocument>>(documentCount);
 
         try
         {
-            using var node = await CultMesh.CreateNodeAsync(
-                filePath,
-                new CultMeshNodeOptions { StartServer = false });
-            var key = new CultRecordKey("player:alice");
-            var document = node.Database.Document<MeshManagedPlayer>(key);
-            MeshManagedPlayer observed = null!;
-            using var subscription = document.Watch().Subscribe(value => observed = value);
-
-            await document.ReplaceAsync(new MeshManagedPlayer
+            for (var index = 0; index < documentCount; index++)
             {
-                Name = "alice",
-                PositionX = 4,
-                Health = 100
-            });
-            await node.Database.PutAsync(key, new MeshManagedPlayer
-            {
-                Name = "alice",
-                PositionX = 8,
-                Health = 75
-            });
+                var subject = new Subject<MeshNoteDocument>();
+                var current = new MeshNoteDocument
+                {
+                    Schema = "tests.mesh_note.v1",
+                    Text = $"initial-{index}",
+                    Revision = 1
+                };
+                var handle = CultMesh.Document(
+                    $"mesh.note.reactive.scale.{index}",
+                    CultMesh.Verse("scale", "test"),
+                    _ => Task.FromResult(current),
+                    _ => subject,
+                    value =>
+                    {
+                        current = value;
+                        subject.OnNext(value);
+                        return Task.CompletedTask;
+                    });
 
-            document.Value.Should().NotBeNull();
-            document.Value!.Health.Should().Be(75);
-            observed.Should().NotBeNull();
-            observed!.PositionX.Should().Be(8);
-            node.Cache.Soa<MeshManagedPlayer>().Column<int>(nameof(MeshManagedPlayer.Health)).Span.ToArray()
-                .Should()
-                .Equal(75);
+                reactiveDocuments.Add(await handle.AuthoritativeWriter().ReactiveAsync(
+                    new CultMeshReactiveDocumentOptions
+                    {
+                        Clock = clock,
+                        FlushDelay = TimeSpan.FromSeconds(1)
+                    }));
+            }
+
+            clock.DelayCount.Should().Be(0, "idle reactive documents must not schedule background work");
+
+            var changedDocumentCount = Math.Max(1, documentCount / 100);
+            for (var index = 0; index < changedDocumentCount; index++)
+            {
+                reactiveDocuments[index].Update(document =>
+                {
+                    document.Text = $"changed-{index}";
+                    document.Revision++;
+                });
+            }
+
+            clock.DelayCount.Should().Be(
+                changedDocumentCount,
+                "flush scheduling must be proportional to explicitly changed documents");
+            reactiveDocuments.Count(document => document.IsDirty).Should().Be(changedDocumentCount);
         }
         finally
         {
-            if (File.Exists(filePath))
-            {
-                File.Delete(filePath);
-            }
+            foreach (var reactiveDocument in reactiveDocuments)
+                reactiveDocument.Dispose();
         }
     }
 
+    [Test]
+    public async Task ReactiveDocument_ReplaceLocalFlushesWholeDocument()
+    {
+        var subject = new Subject<MeshNoteDocument>();
+        var current = new MeshNoteDocument
+        {
+            Schema = "tests.mesh_note.v1",
+            Text = "initial",
+            Revision = 1
+        };
+        var predictions = new List<MeshNoteDocument>();
+        var handle = CultMesh.Document(
+            "mesh.note.reactive.direct-member-flush",
+            CultMesh.Verse("starbridge", "pilot-a"),
+            _ => Task.FromResult(current),
+            _ => subject,
+            value =>
+            {
+                current = value;
+                subject.OnNext(value);
+                return Task.CompletedTask;
+            },
+            value =>
+            {
+                predictions.Add(value);
+                current = value;
+                subject.OnNext(value);
+                return Task.CompletedTask;
+            });
+
+        using var reactive = await handle.PredictionWriter().ReactiveAsync(
+            new CultMeshReactiveDocumentOptions
+            {
+                FlushDelay = TimeSpan.FromMinutes(1)
+            });
+
+        reactive.ReplaceLocal(new MeshNoteDocument
+        {
+            Schema = "tests.mesh_note.v1",
+            Text = "whole-document-replacement",
+            Revision = 4
+        });
+        await reactive.FlushAsync();
+
+        predictions.Should().ContainSingle();
+        predictions[0].Text.Should().Be("whole-document-replacement");
+        predictions[0].Revision.Should().Be(4);
+    }
+
+    [Test]
+    public async Task ReactiveDocument_CleanFlushDoesNotWrite()
+    {
+        var current = new MeshNoteDocument
+        {
+            Schema = "tests.mesh_note.v1",
+            Text = "initial",
+            Revision = 1
+        };
+        var writes = 0;
+        var handle = CultMesh.Document(
+            "mesh.note.reactive.clean-flush",
+            CultMesh.Verse("starbridge", "pilot-a"),
+            _ => Task.FromResult(current),
+            _ => new Subject<MeshNoteDocument>(),
+            value =>
+            {
+                writes++;
+                current = value;
+                return Task.CompletedTask;
+            });
+
+        using var reactive = await handle.AuthoritativeWriter().ReactiveAsync();
+
+        await reactive.FlushAsync();
+
+        writes.Should().Be(0);
+        reactive.IsDirty.Should().BeFalse();
+    }
+
+    [Test]
+    public async Task ReactiveDocument_FlushesAgainWhenEditedDuringInFlightFlush()
+    {
+        var subject = new Subject<MeshNoteDocument>();
+        var current = new MeshNoteDocument
+        {
+            Schema = "tests.mesh_note.v1",
+            Text = "initial",
+            Revision = 1
+        };
+        var allowFirstWrite = new TaskCompletionSource<bool>();
+        var firstWriteStarted = new TaskCompletionSource<bool>();
+        var predictions = new List<MeshNoteDocument>();
+        var handle = CultMesh.Document(
+            "mesh.note.reactive.in-flight",
+            CultMesh.Verse("starbridge", "pilot-a"),
+            _ => Task.FromResult(current),
+            _ => subject,
+            value =>
+            {
+                current = value;
+                subject.OnNext(value);
+                return Task.CompletedTask;
+            },
+            async value =>
+            {
+                predictions.Add(value);
+                if (predictions.Count == 1)
+                {
+                    firstWriteStarted.SetResult(true);
+                    await allowFirstWrite.Task.ConfigureAwait(false);
+                }
+
+                current = value;
+                subject.OnNext(value);
+            });
+
+        using var reactive = await handle.PredictionWriter().ReactiveAsync(
+            new CultMeshReactiveDocumentOptions
+            {
+                FlushDelay = TimeSpan.FromMinutes(1)
+            });
+        reactive.Update(document =>
+        {
+            document.Text = "first";
+            document.Revision = 2;
+        });
+        var flush = reactive.FlushAsync();
+        await firstWriteStarted.Task;
+
+        reactive.Update(document =>
+        {
+            document.Text = "second";
+            document.Revision = 3;
+        });
+        allowFirstWrite.SetResult(true);
+        await flush;
+
+        predictions.Should().HaveCount(2);
+        predictions[0].Text.Should().Be("first");
+        predictions[1].Text.Should().Be("second");
+        current.Revision.Should().Be(3);
+    }
+
+    [Test]
+    public async Task ReactiveDocument_DebouncesBurstUpdatesIntoOnePrediction()
+    {
+        var subject = new Subject<MeshNoteDocument>();
+        var current = new MeshNoteDocument
+        {
+            Schema = "tests.mesh_note.v1",
+            Text = "initial",
+            Revision = 1
+        };
+        var predictions = new List<MeshNoteDocument>();
+        var handle = CultMesh.Document(
+            "mesh.note.reactive.burst",
+            CultMesh.Verse("starbridge", "pilot-a"),
+            _ => Task.FromResult(current),
+            _ => subject,
+            value =>
+            {
+                current = value;
+                subject.OnNext(value);
+                return Task.CompletedTask;
+            },
+            value =>
+            {
+                predictions.Add(value);
+                current = value;
+                subject.OnNext(value);
+                return Task.CompletedTask;
+            });
+
+        using var reactive = await handle.PredictionWriter().ReactiveAsync(
+            new CultMeshReactiveDocumentOptions
+            {
+                FlushDelay = TimeSpan.FromMilliseconds(35)
+            });
+
+        for (var i = 0; i < 5; i++)
+        {
+            reactive.Update(document =>
+            {
+                document.Text = $"burst-{i}";
+                document.Revision++;
+            });
+        }
+
+        await WaitForAsync(() => predictions.Count == 1);
+
+        predictions[0].Text.Should().Be("burst-4");
+        predictions[0].Revision.Should().Be(6);
+        reactive.IsDirty.Should().BeFalse();
+    }
+
+    [Test]
+    public async Task ReactiveDocument_ExplicitEditsDuringInFlightFlushQueueLatestPrediction()
+    {
+        var subject = new Subject<MeshNoteDocument>();
+        var current = new MeshNoteDocument
+        {
+            Schema = "tests.mesh_note.v1",
+            Text = "initial",
+            Revision = 1
+        };
+        var allowFirstWrite = new TaskCompletionSource<bool>();
+        var firstWriteStarted = new TaskCompletionSource<bool>();
+        var predictions = new List<MeshNoteDocument>();
+        var handle = CultMesh.Document(
+            "mesh.note.reactive.direct-in-flight",
+            CultMesh.Verse("starbridge", "pilot-a"),
+            _ => Task.FromResult(current),
+            _ => subject,
+            value =>
+            {
+                current = value;
+                subject.OnNext(value);
+                return Task.CompletedTask;
+            },
+            async value =>
+            {
+                predictions.Add(value);
+                if (predictions.Count == 1)
+                {
+                    firstWriteStarted.SetResult(true);
+                    await allowFirstWrite.Task.ConfigureAwait(false);
+                }
+
+                current = value;
+                subject.OnNext(value);
+            });
+
+        using var reactive = await handle.PredictionWriter().ReactiveAsync(
+            new CultMeshReactiveDocumentOptions
+            {
+                FlushDelay = TimeSpan.FromMinutes(1)
+            });
+        reactive.Update(document =>
+        {
+            document.Text = "first-explicit";
+            document.Revision = 2;
+        });
+        var flush = reactive.FlushAsync();
+        await firstWriteStarted.Task;
+
+        reactive.Update(document =>
+        {
+            document.Text = "second-explicit";
+            document.Revision = 3;
+        });
+        allowFirstWrite.SetResult(true);
+        await flush;
+
+        predictions.Should().HaveCount(2);
+        predictions[0].Text.Should().Be("first-explicit");
+        predictions[1].Text.Should().Be("second-explicit");
+        reactive.IsDirty.Should().BeFalse();
+    }
+
+    [Test]
+    public async Task ReactiveDocument_CanonicalEchoClearsOutstandingPredictionWithoutDelta()
+    {
+        var subject = new Subject<MeshNoteDocument>();
+        var current = new MeshNoteDocument
+        {
+            Schema = "tests.mesh_note.v1",
+            Text = "initial",
+            Revision = 1
+        };
+        var handle = CultMesh.Document(
+            "mesh.note.reactive.canonical-echo",
+            CultMesh.Verse("starbridge", "pilot-a"),
+            _ => Task.FromResult(current),
+            _ => subject,
+            value =>
+            {
+                current = value;
+                subject.OnNext(value);
+                return Task.CompletedTask;
+            },
+            value =>
+            {
+                current = value;
+                subject.OnNext(value);
+                return Task.CompletedTask;
+            });
+
+        using var reactive = await handle.PredictionWriter().ReactiveAsync(
+            new CultMeshReactiveDocumentOptions
+            {
+                FlushDelay = TimeSpan.FromMinutes(1)
+            });
+        reactive.Update(document =>
+        {
+            document.Text = "accepted";
+            document.Revision = 2;
+        });
+
+        await reactive.FlushAsync();
+
+        reactive.Snapshot.Text.Should().Be("accepted");
+        reactive.Reconciliation.Should().BeNull();
+        reactive.IsDirty.Should().BeFalse();
+    }
+
+    [Test]
+    public async Task DocumentHandle_ReadsSchemaPublicationsFromSingleFileStores()
+    {
+        using var directory = new TemporaryDirectory();
+        var filePath = Path.Combine(directory.Path, "publication.ccmp");
+        var key = new CultRecordKey("mesh-note:publication");
+
+        var writerCache = new CultCache();
+        writerCache.AddBackingStore(new SingleFileMessagePackBackingStore(filePath));
+        await writerCache.UpsertAsync(typeof(MeshPublicationNoteDocument), new MeshPublicationNoteDocument
+        {
+            Schema = "tests.mesh_publication_note.v1",
+            Text = "published",
+            Revision = 1
+        }, key);
+        writerCache.FlushAllBackingStores();
+        File.Exists(filePath).Should().BeTrue();
+
+        var directReadCache = new CultCache();
+        directReadCache.AddBackingStore(new SingleFileMessagePackBackingStore(filePath));
+        await directReadCache.PullAllBackingStoresAsync();
+        directReadCache.Get<MeshPublicationNoteDocument>(key)!.Text.Should().Be("published");
+
+        var handle = CultMesh.DocumentFromPublication<MeshPublicationNoteDocument>(
+            CultMeshDocumentPublicationSource.SingleFile(filePath),
+            key,
+            CultMesh.Verse("starbridge", "unity-pilot"),
+            new CultMeshStoreDocumentOptions
+            {
+                DocumentId = "daemon:tests.mesh_note.latest",
+                SourceId = "daemon:tests.mesh_note.latest.v1",
+                PollInterval = TimeSpan.FromMilliseconds(10)
+            });
+        var observed = new List<MeshPublicationNoteDocument>();
+        using var subscription = handle.Watch(value => observed.Add(value));
+
+        (await handle.LatestAsync()).Text.Should().Be("published");
+        handle.CanReplace.Should().BeFalse();
+        handle.CanSubmitPrediction.Should().BeFalse();
+        handle.DocumentId.Should().Be("daemon:tests.mesh_note.latest");
+        handle.RouteHint.Kind.Should().Be(CultMeshLocalityKind.SharedMemory);
+        handle.Sources.Should().ContainSingle().Which.SourceId.Should().Be("daemon:tests.mesh_note.latest.v1");
+
+        var republisher = new CultCache();
+        republisher.AddBackingStore(new SingleFileMessagePackBackingStore(filePath));
+        await republisher.UpsertAsync(typeof(MeshPublicationNoteDocument), new MeshPublicationNoteDocument
+        {
+            Schema = "tests.mesh_publication_note.v1",
+            Text = "republished",
+            Revision = 2
+        }, key);
+        republisher.FlushAllBackingStores();
+
+        await WaitForAsync(() => observed.Any(value => value.Text == "republished"));
+        (await handle.LatestAsync()).Revision.Should().Be(2);
+    }
+
+    [Test]
+    public async Task SingleFileDocumentHelpers_RoundTripTypedDocuments()
+    {
+        using var directory = new TemporaryDirectory();
+        var filePath = Path.Combine(directory.Path, "single-document.ccmp");
+        var key = new CultRecordKey("mesh-note:single-document");
+
+        CultMesh.WriteSingleFileDocument(
+            filePath,
+            key,
+            new MeshPublicationNoteDocument
+            {
+                Schema = "tests.mesh_publication_note.v1",
+                Text = "published-directly",
+                Revision = 3
+            },
+            storedAt: "2026-06-27T12:00:00.0000000Z");
+
+        var document = CultMesh.ReadSingleFileDocument<MeshPublicationNoteDocument>(filePath, key);
+
+        document.Text.Should().Be("published-directly");
+        document.Revision.Should().Be(3);
+
+        var cache = new CultCache();
+        cache.AddBackingStore(new SingleFileMessagePackBackingStore(filePath));
+        await cache.PullAllBackingStoresAsync();
+        cache.Get<MeshPublicationNoteDocument>(key)!.Text.Should().Be("published-directly");
+    }
+
+    [Test]
+    public void SingleFileDocumentHelpers_ReadLegacySingleDocumentSnapshots()
+    {
+        using var directory = new TemporaryDirectory();
+        var filePath = Path.Combine(directory.Path, "legacy-single-document.ccmp");
+        var key = new CultRecordKey("mesh-note:legacy-single-document");
+        var descriptor = CultDocumentRegistry.Shared.GetRequired<MeshPublicationNoteDocument>();
+        var payload = CultDocumentMessagePackSerialization.SerializeUntyped(new MeshPublicationNoteDocument
+        {
+            Schema = "tests.mesh_publication_note.v1",
+            Text = "legacy-published",
+            Revision = 4
+        }, typeof(MeshPublicationNoteDocument));
+
+        File.WriteAllBytes(filePath, WriteLegacySingleDocumentSnapshot(
+            key.Value,
+            descriptor.SchemaId,
+            descriptor.SchemaName,
+            descriptor.SchemaVersion,
+            "2026-06-27T12:00:00.0000000Z",
+            payload));
+
+        var document = CultMesh.ReadSingleFileDocument<MeshPublicationNoteDocument>(filePath, key);
+
+        document.Text.Should().Be("legacy-published");
+        document.Revision.Should().Be(4);
+    }
+
+    [Test]
+    public async Task DocumentHandle_ReadsRemotePeerSnapshotsAsTypedDocuments()
+    {
+        var cache = new CultCache();
+        var key = new CultRecordKey("mesh-note:remote");
+        await cache.UpsertAsync(new MeshNoteDocument
+        {
+            Schema = "tests.mesh_note.v1",
+            Text = "remote-snapshot",
+            Revision = 9
+        }, new CultRecordHandle<MeshNoteDocument>(key));
+        var registry = new CultNetDocumentRegistry(CultDocumentRegistry.Shared)
+            .Register(CultNetDocumentBinding.ForDocument<MeshNoteDocument>(CultDocumentRegistry.Shared));
+        var requests = new List<CultNetSnapshotRequestMessage>();
+
+        var handle = CultMesh.DocumentFromPublication<MeshNoteAliasDocument>(
+            CultMeshDocumentPublicationSource.PeerSnapshot(
+                () => new MeshSnapshotSchemaClient(request =>
+                {
+                    requests.Add(request);
+                    return registry.CreateRawSnapshotResponse(cache, request.MessageId, request);
+                }),
+                "cultnet://snapshot.test:3075"),
+            key,
+            CultMesh.Verse("starbridge", "unity-pilot"),
+            peerOptions: new CultMeshPeerSnapshotDocumentOptions
+            {
+                PollInterval = TimeSpan.FromMilliseconds(10),
+                MessageIdPrefix = "mesh-test-snapshot"
+            });
+        var catalog = CultMesh.Documents(handle);
+
+        var snapshot = await handle.LatestAsync();
+
+        snapshot.Text.Should().Be("remote-snapshot");
+        snapshot.Revision.Should().Be(9);
+        handle.DocumentType.Should().Be(typeof(MeshNoteAliasDocument));
+        handle.RouteHint.Kind.Should().Be(CultMeshLocalityKind.Network);
+        handle.Sources.Should().ContainSingle().Which.SourceId.Should().Be(key.Value);
+        requests.Should().ContainSingle();
+        requests[0].SchemaIds.Should().ContainSingle().Which
+            .Should().Be(CultDocumentRegistry.Shared.GetRequired<MeshNoteDocument>().SchemaId);
+        requests[0].RecordKeys.Should().ContainSingle().Which.Should().Be(key.Value);
+        (await catalog.LatestAsync<MeshNoteAliasDocument>()).Text.Should().Be("remote-snapshot");
+
+        var aliasSchemaHandle = CultMesh.DocumentFromPeerSnapshot<MeshNoteAliasDocument>(
+            _ => Task.FromResult(new CultNetSnapshotResponseRawMessage
+            {
+                MessageId = "alias-schema",
+                Documents = new[]
+                {
+                    new CultNetRawDocumentRecord
+                    {
+                        SchemaId = "remote.generated.mesh_note_alias.v99",
+                        RecordKey = key.Value,
+                        StoredAt = DateTimeOffset.UtcNow.ToString("O"),
+                        PayloadEncoding = "messagepack",
+                        Payload = CultDocumentMessagePackSerialization.SerializeUntyped(
+                            new MeshNoteDocument
+                            {
+                                Schema = "tests.mesh_note.v1",
+                                Text = "record-key-fallback",
+                                Revision = 10
+                            },
+                            typeof(MeshNoteDocument))
+                    }
+                }
+            }),
+            key.Value,
+            CultMesh.Verse("starbridge", "unity-pilot"));
+
+        (await aliasSchemaHandle.LatestAsync()).Text.Should().Be("record-key-fallback");
+
+        var mixedAliasSchemaHandle = CultMesh.DocumentFromPeerSnapshot<MeshNoteAliasDocument>(
+            _ => Task.FromResult(new CultNetSnapshotResponseRawMessage
+            {
+                MessageId = "alias-schema-with-neighbor",
+                Documents = new[]
+                {
+                    new CultNetRawDocumentRecord
+                    {
+                        SchemaId = CultDocumentRegistry.Shared.GetRequired<MeshNoteDocument>().SchemaId,
+                        RecordKey = "mesh-note:other",
+                        StoredAt = DateTimeOffset.UtcNow.ToString("O"),
+                        PayloadEncoding = "messagepack",
+                        Payload = CultDocumentMessagePackSerialization.SerializeUntyped(
+                            new MeshNoteDocument
+                            {
+                                Schema = "tests.mesh_note.v1",
+                                Text = "wrong-schema-neighbor",
+                                Revision = 11
+                            },
+                            typeof(MeshNoteDocument))
+                    },
+                    new CultNetRawDocumentRecord
+                    {
+                        SchemaId = "remote.generated.mesh_note_alias.v100",
+                        RecordKey = key.Value,
+                        StoredAt = DateTimeOffset.UtcNow.ToString("O"),
+                        PayloadEncoding = "messagepack",
+                        Payload = CultDocumentMessagePackSerialization.SerializeUntyped(
+                            new MeshNoteDocument
+                            {
+                                Schema = "tests.mesh_note.v1",
+                                Text = "compatible-record-key",
+                                Revision = 12
+                            },
+                            typeof(MeshNoteDocument))
+                    }
+                }
+            }),
+            key.Value,
+            CultMesh.Verse("starbridge", "unity-pilot"));
+
+        (await mixedAliasSchemaHandle.LatestAsync()).Text.Should().Be("compatible-record-key");
+    }
+
+    [Test]
+    public async Task PublicationHelpers_BindConfiguredDocumentsIntoCatalog()
+    {
+        using var directory = new TemporaryDirectory();
+        var firstPath = Path.Combine(directory.Path, "first.ccmp");
+        var secondPath = Path.Combine(directory.Path, "second.ccmp");
+        var firstKey = new CultRecordKey("mesh-note:publication-catalog-first");
+        var secondKey = new CultRecordKey("mesh-note:publication-catalog-second");
+        var firstWriter = new CultCache();
+        firstWriter.AddBackingStore(new SingleFileMessagePackBackingStore(firstPath));
+        await firstWriter.UpsertAsync(typeof(MeshPublicationNoteDocument), new MeshPublicationNoteDocument
+        {
+            Schema = "tests.mesh_publication_note.v1",
+            Text = "first source",
+            Revision = 21
+        }, firstKey);
+        firstWriter.FlushAllBackingStores();
+        var secondWriter = new CultCache();
+        secondWriter.AddBackingStore(new SingleFileMessagePackBackingStore(secondPath));
+        await secondWriter.UpsertAsync(new MeshNoteDocument
+        {
+            Schema = "tests.mesh_note.v1",
+            Text = "second source",
+            Revision = 22
+        }, new CultRecordHandle<MeshNoteDocument>(secondKey));
+        secondWriter.FlushAllBackingStores();
+
+        var catalog = CultMesh.DocumentsFromPublication(
+            CultMeshDocumentPublicationSource.SingleFile(firstPath),
+            new ICultMeshPublicationDocumentBinding[]
+            {
+                CultMesh.PublicationDocument<MeshPublicationNoteDocument>(
+                    firstKey,
+                    documentId: "daemon:first"),
+                CultMesh.PublicationDocument<MeshNoteAliasDocument>(
+                    secondKey,
+                    documentId: "daemon:second",
+                    source: CultMeshDocumentPublicationSource.SingleFile(secondPath))
+            },
+            CultMesh.Verse("starbridge", "unity-catalog"),
+            new CultMeshStoreDocumentOptions
+            {
+                RouteHint = new CultMeshRouteHint(CultMeshLocalityKind.SharedMemory, "publication catalog"),
+                PollInterval = TimeSpan.FromMilliseconds(10)
+            });
+
+        catalog.Documents.Select(document => document.DocumentId).Should().Equal("daemon:first", "daemon:second");
+        (await catalog.LatestAsync<MeshPublicationNoteDocument>()).Text.Should().Be("first source");
+        (await catalog.LatestAsync<MeshNoteAliasDocument>()).Text.Should().Be("second source");
+        catalog.Document<MeshNoteDocument>().DocumentId.Should().Be("daemon:second");
+        catalog.Document<MeshPublicationNoteDocument>().RouteHint.Description.Should().Be("publication catalog");
+        catalog.Document<MeshNoteAliasDocument>().Sources.Should().ContainSingle().Which.SourceId.Should().Be("daemon:second");
+    }
+
+    [Test]
+    public async Task PublicationHelpers_SyncConfiguredDocumentsIntoLocalCatalog()
+    {
+        using var directory = new TemporaryDirectory();
+        var firstPath = Path.Combine(directory.Path, "sync-first.ccmp");
+        var secondPath = Path.Combine(directory.Path, "sync-second.ccmp");
+        var firstKey = new CultRecordKey("mesh-note:publication-sync-catalog-first");
+        var secondKey = new CultRecordKey("mesh-note:publication-sync-catalog-second");
+        var firstWriter = new CultCache();
+        firstWriter.AddBackingStore(new SingleFileMessagePackBackingStore(firstPath));
+        await firstWriter.UpsertAsync(typeof(MeshPublicationNoteDocument), new MeshPublicationNoteDocument
+        {
+            Schema = "tests.mesh_publication_note.v1",
+            Text = "first synced source",
+            Revision = 31
+        }, firstKey);
+        firstWriter.FlushAllBackingStores();
+        var secondWriter = new CultCache();
+        secondWriter.AddBackingStore(new SingleFileMessagePackBackingStore(secondPath));
+        await secondWriter.UpsertAsync(new MeshNoteDocument
+        {
+            Schema = "tests.mesh_note.v1",
+            Text = "second synced source",
+            Revision = 32
+        }, new CultRecordHandle<MeshNoteDocument>(secondKey));
+        secondWriter.FlushAllBackingStores();
+        using var node = await CultMesh.CreateNodeAsync(
+            Path.Combine(directory.Path, "target.ccmp"),
+            new CultMeshNodeOptions
+            {
+                StartServer = false
+            });
+
+        var catalog = await CultMesh.SyncDocumentsFromPublicationAsync(
+            node,
+            CultMeshDocumentPublicationSource.SingleFile(firstPath),
+            new ICultMeshPublicationDocumentBinding[]
+            {
+                CultMesh.PublicationDocument<MeshPublicationNoteDocument>(
+                    firstKey,
+                    documentId: "local:first"),
+                CultMesh.PublicationDocument<MeshNoteAliasDocument>(
+                    secondKey,
+                    documentId: "local:second",
+                    source: CultMeshDocumentPublicationSource.SingleFile(secondPath))
+            },
+            CultMesh.Verse("starbridge", "unity-sync-catalog"),
+            new CultMeshStoreDocumentOptions
+            {
+                PollInterval = TimeSpan.FromMilliseconds(10)
+            });
+
+        catalog.Documents.Select(document => document.DocumentId).Should().Equal("local:first", "local:second");
+        (await catalog.LatestAsync<MeshPublicationNoteDocument>()).Text.Should().Be("first synced source");
+        (await catalog.LatestAsync<MeshNoteAliasDocument>()).Text.Should().Be("second synced source");
+        node.Cache.Get<MeshPublicationNoteDocument>(firstKey)!.Revision.Should().Be(31);
+        (await node.Document<MeshNoteDocument>(secondKey, CultMesh.Verse("starbridge", "unity-sync-catalog"))
+            .LatestAsync()).Text.Should().Be("second synced source");
+        (await node.Document<MeshNoteAliasDocument>(secondKey, CultMesh.Verse("starbridge", "unity-sync-catalog"))
+            .LatestAsync()).Revision.Should().Be(32);
+    }
+
+    [Test]
+    public async Task PublicationHelpers_SyncConfiguredPeerSourceIntoLocalNodeAlias()
+    {
+        var sourceCache = new CultCache();
+        var registry = new CultNetDocumentRegistry(CultDocumentRegistry.Shared);
+        registry.Register(CultNetDocumentBinding.ForDocument<MeshNoteDocument>(sourceCache.Registry));
+        var key = new CultRecordKey("mesh-note:publication-sync-alias");
+        await sourceCache.UpsertAsync(new MeshNoteDocument
+        {
+            Schema = "tests.mesh_note.v1",
+            Text = "publication-synced",
+            Revision = 51
+        }, new CultRecordHandle<MeshNoteDocument>(key));
+        var requests = new List<CultNetSnapshotRequestMessage>();
+        var verse = CultMesh.Verse("starbridge", "unity-support");
+        using var node = await CultMesh.CreateNodeAsync(
+            Path.Combine(Path.GetTempPath(), $"cultmesh-publication-sync-alias-{Guid.NewGuid():N}.ccmp"),
+            new CultMeshNodeOptions
+            {
+                StartServer = false,
+                CacheOptions = new CultCacheOpenOptions
+                {
+                    Registry = sourceCache.Registry
+                },
+                DatabaseOptions = new CultNetDatabaseOptions
+                {
+                    DocumentRegistry = registry
+                }
+            });
+
+        var synced = await CultMesh.SyncDocumentFromPublicationAsync<MeshNoteAliasDocument>(
+            node,
+            CultMeshDocumentPublicationSource.PeerSnapshot(
+                () => new MeshSnapshotSchemaClient(request =>
+                {
+                    requests.Add(request);
+                    return registry.CreateRawSnapshotResponse(sourceCache, request.MessageId, request);
+                }),
+                "cultnet://publication-sync.test:3075"),
+            key,
+            verse,
+            peerOptions: new CultMeshPeerSnapshotDocumentOptions
+            {
+                MessageIdPrefix = "mesh-test-publication-sync",
+                PollInterval = TimeSpan.FromMilliseconds(10)
+            });
+        var localAlias = await node.Document<MeshNoteAliasDocument>(key, verse).LatestAsync();
+
+        synced.Text.Should().Be("publication-synced");
+        synced.Revision.Should().Be(51);
+        localAlias.Text.Should().Be("publication-synced");
+        localAlias.Revision.Should().Be(51);
+        requests.Should().ContainSingle().Which.RecordKeys.Should().Equal(key.Value);
+    }
+
+    [Test]
+    public async Task SnapshotHelpers_FetchApplyAndDecodeScopedSnapshots()
+    {
+        var sourceCache = new CultCache();
+        var targetCache = new CultCache();
+        var registry = new CultNetDocumentRegistry(CultDocumentRegistry.Shared);
+        registry.Register(CultNetDocumentBinding.ForDocument<MeshPublicationNoteDocument>(sourceCache.Registry));
+        var key = new CultRecordKey("mesh-note:snapshot-helper");
+        await sourceCache.UpsertAsync(new MeshPublicationNoteDocument
+        {
+            Schema = "tests.mesh_publication_note.v1",
+            Text = "snapshot-helper",
+            Revision = 11
+        }, new CultRecordHandle<MeshPublicationNoteDocument>(key));
+        var requests = new List<CultNetSnapshotRequestMessage>();
+        var endpoint = "cultnet://snapshot-helper.test:3075";
+        var options = new CultMeshSnapshotRequestOptions
+        {
+            RecordKeys = new[] { key.Value },
+            ShardId = "primary",
+            ShardEpoch = 7,
+            MessageIdPrefix = "mesh-test-scoped-snapshot",
+            CreateClient = () => new MeshSnapshotSchemaClient(request =>
+            {
+                requests.Add(request);
+                return registry.CreateRawSnapshotResponse(sourceCache, request.MessageId, request);
+            })
+        };
+
+        var snapshot = await CultMesh.FetchSnapshotAsync(endpoint, options);
+        var decoded = await CultMesh.FetchSnapshotDocumentsAsync<MeshPublicationNoteDocument>(
+            endpoint,
+            options,
+            registry);
+        using var node = await CultMesh.CreateNodeAsync(
+            Path.Combine(Path.GetTempPath(), $"cultmesh-snapshot-helper-{Guid.NewGuid():N}.ccmp"),
+            new CultMeshNodeOptions
+            {
+                StartServer = false,
+                CacheOptions = new CultCacheOpenOptions
+                {
+                    Registry = targetCache.Registry
+                },
+                DatabaseOptions = new CultNetDatabaseOptions
+                {
+                    DocumentRegistry = registry
+                }
+            });
+        var applied = await CultMesh.ApplySnapshotAsync(node, endpoint, options);
+
+        snapshot.Documents.Should().ContainSingle().Which.RecordKey.Should().Be(key.Value);
+        decoded.Should().ContainSingle().Which.Text.Should().Be("snapshot-helper");
+        applied.Should().ContainSingle();
+        node.Cache.Get<MeshPublicationNoteDocument>(key)!.Revision.Should().Be(11);
+        requests.Should().HaveCount(3);
+        requests.Should().OnlyContain(request =>
+            request.RecordKeys!.SequenceEqual(new[] { key.Value }) &&
+            request.ShardId == "primary" &&
+            request.ShardEpoch == 7 &&
+            request.MessageId.StartsWith("mesh-test-scoped-snapshot:", StringComparison.Ordinal));
+    }
+
+    [Test]
+    public async Task SnapshotHelpers_SurfaceBackgroundClientFailureBeforeTimeout()
+    {
+        var options = new CultMeshSnapshotRequestOptions
+        {
+            ResponseTimeout = TimeSpan.FromSeconds(30),
+            RecordKeys = new[] { "eve:surface:test" },
+            CreateClient = () => new FailedBackgroundSchemaClient(
+                new FormatException("malformed fragment"))
+        };
+
+        Func<Task> act = async () => await CultMesh.FetchSnapshotAsync(
+            "rudp://127.0.0.1:3075",
+            options);
+
+        var failure = await act.Should().ThrowAsync<InvalidOperationException>();
+        failure.Which.InnerException.Should().BeOfType<FormatException>();
+        failure.Which.Message.Should().Contain("127.0.0.1:3075");
+    }
+
+    [Test]
+    public async Task SnapshotHelpers_SurfaceBackgroundClientFailureWhileConnecting()
+    {
+        var options = new CultMeshSnapshotRequestOptions
+        {
+            ConnectTimeout = TimeSpan.FromSeconds(30),
+            CreateClient = () => new FailedBackgroundSchemaClient(
+                new FormatException("malformed handshake"),
+                connected: false)
+        };
+
+        Func<Task> act = async () => await CultMesh.FetchSnapshotAsync(
+            "rudp://127.0.0.1:3075",
+            options);
+
+        var failure = await act.Should().ThrowAsync<InvalidOperationException>();
+        failure.Which.InnerException.Should().BeOfType<FormatException>();
+        failure.Which.Message.Should().Contain("connecting");
+    }
+
+    [Test]
+    public async Task SnapshotHelpers_DecodeSameSchemaAliasFromForeignSchemaId()
+    {
+        var key = new CultRecordKey("mesh-note:snapshot-alias-foreign-schema");
+        var snapshot = new CultNetSnapshotResponseRawMessage
+        {
+            MessageId = "foreign-schema",
+            Documents = new[]
+            {
+                new CultNetRawDocumentRecord
+                {
+                    SchemaId = "runtime.generated.mesh-note.ui.42",
+                    RecordKey = key.Value,
+                    StoredAt = DateTimeOffset.UtcNow.ToString("O"),
+                    PayloadEncoding = "messagepack",
+                    Payload = CultDocumentMessagePackSerialization.SerializeUntyped(
+                        new MeshNoteDocument
+                        {
+                            Schema = "tests.mesh_note.v1",
+                            Text = "foreign-schema-alias",
+                            Revision = 44
+                        },
+                        typeof(MeshNoteDocument))
+                }
+            }
+        };
+
+        var documents = await CultMesh.FetchSnapshotDocumentsAsync<MeshNoteAliasDocument>(
+            "cultnet://foreign-schema.test:3075",
+            new CultMeshSnapshotRequestOptions
+            {
+                RecordKeys = new[] { key.Value },
+                CreateClient = () => new MeshSnapshotSchemaClient(request =>
+                {
+                    snapshot.MessageId = request.MessageId;
+                    return snapshot;
+                })
+            },
+            new CultNetDocumentRegistry());
+
+        documents.Should().ContainSingle().Which.Text.Should().Be("foreign-schema-alias");
+    }
+
+    [Test]
+    public async Task SnapshotEndpoint_SyncsCompatibleForeignSchemaIdIntoLocalCache()
+    {
+        var key = new CultRecordKey("mesh-note:snapshot-sync-foreign-schema");
+        var snapshot = new CultNetSnapshotResponseRawMessage
+        {
+            MessageId = "foreign-schema-sync",
+            Documents = new[]
+            {
+                new CultNetRawDocumentRecord
+                {
+                    SchemaId = "runtime.generated.mesh-note.ui.84",
+                    RecordKey = key.Value,
+                    StoredAt = DateTimeOffset.UtcNow.ToString("O"),
+                    PayloadEncoding = "messagepack",
+                    Payload = CultDocumentMessagePackSerialization.SerializeUntyped(
+                        new MeshNoteDocument
+                        {
+                            Schema = "tests.mesh_note.v1",
+                            Text = "foreign-schema-synced",
+                            Revision = 45
+                        },
+                        typeof(MeshNoteDocument))
+                }
+            }
+        };
+        var cacheRegistry = CultMesh.CreateCultCacheDocumentRegistry(
+            typeof(MeshNoteDocument),
+            typeof(MeshNoteAliasDocument));
+        var registry = CultMesh.CreateCultNetDocumentRegistry(
+            new[] { typeof(MeshNoteDocument), typeof(MeshNoteAliasDocument) },
+            cacheRegistry);
+        var endpoint = CultMesh.SnapshotEndpoint(
+            "cultnet://foreign-schema.test:3075",
+            new CultMeshSnapshotEndpointOptions
+            {
+                DocumentRegistry = registry,
+                Request = new CultMeshSnapshotRequestOptions
+                {
+                    CreateClient = () => new MeshSnapshotSchemaClient(request =>
+                    {
+                        snapshot.MessageId = request.MessageId;
+                        return snapshot;
+                    })
+                }
+            });
+        using var node = await CultMesh.CreateNodeAsync(
+            Path.Combine(Path.GetTempPath(), $"cultmesh-foreign-schema-sync-{Guid.NewGuid():N}.ccmp"),
+            new CultMeshNodeOptions
+            {
+                StartServer = false,
+                CacheOptions = new CultCacheOpenOptions
+                {
+                    Registry = cacheRegistry
+                },
+                DatabaseOptions = new CultNetDatabaseOptions
+                {
+                    DocumentRegistry = registry
+                }
+            });
+
+        var synced = await endpoint.SyncDocumentAsync<MeshNoteAliasDocument>(node, key.Value);
+
+        synced.Text.Should().Be("foreign-schema-synced");
+        node.Cache.Get<MeshNoteDocument>(key)!.Text.Should().Be("foreign-schema-synced");
+        node.Cache.Get<MeshNoteDocument>(key)!.Revision.Should().Be(45);
+    }
+
+    [Test]
+    public async Task SnapshotFacade_SyncsRemoteDocumentIntoLocalNodeWithSameSchemaAlias()
+    {
+        var sourceCache = new CultCache();
+        var registry = new CultNetDocumentRegistry(CultDocumentRegistry.Shared);
+        registry.Register(CultNetDocumentBinding.ForDocument<MeshNoteDocument>(sourceCache.Registry));
+        var key = new CultRecordKey("mesh-note:facade-sync-alias");
+        await sourceCache.UpsertAsync(new MeshNoteDocument
+        {
+            Schema = "tests.mesh_note.v1",
+            Text = "facade-synced",
+            Revision = 46
+        }, new CultRecordHandle<MeshNoteDocument>(key));
+        var requests = new List<CultNetSnapshotRequestMessage>();
+        using var node = await CultMesh.CreateNodeAsync(
+            Path.Combine(Path.GetTempPath(), $"cultmesh-facade-sync-alias-{Guid.NewGuid():N}.ccmp"),
+            new CultMeshNodeOptions
+            {
+                StartServer = false,
+                CacheOptions = new CultCacheOpenOptions
+                {
+                    Registry = sourceCache.Registry
+                },
+                DatabaseOptions = new CultNetDatabaseOptions
+                {
+                    DocumentRegistry = registry
+                }
+            });
+
+        var synced = await CultMesh.SyncDocumentFromPeerSnapshotAsync<MeshNoteAliasDocument>(
+            node,
+            () => new MeshSnapshotSchemaClient(request =>
+            {
+                requests.Add(request);
+                return registry.CreateRawSnapshotResponse(sourceCache, request.MessageId, request);
+            }),
+            "cultnet://facade-sync.test:3075",
+            key.Value,
+            new CultMeshSnapshotEndpointOptions
+            {
+                DocumentRegistry = registry,
+                Context = CultMesh.Verse("starbridge", "unity-raven").Context
+            });
+        var localAlias = await node.Document<MeshNoteAliasDocument>(key.Value, CultMesh.Verse("starbridge", "unity-raven"))
+            .LatestAsync();
+
+        synced.Text.Should().Be("facade-synced");
+        synced.Revision.Should().Be(46);
+        localAlias.Text.Should().Be("facade-synced");
+        node.Cache.Get<MeshNoteDocument>(key)!.Revision.Should().Be(46);
+        requests.Should().ContainSingle().Which.RecordKeys.Should().Equal(key.Value);
+    }
+
+    [Test]
+    public async Task SnapshotSession_ReusesOneConnectedClientAcrossOrderedRequests()
+    {
+        var sourceCache = new CultCache();
+        var registry = new CultNetDocumentRegistry(CultDocumentRegistry.Shared);
+        registry.Register(CultNetDocumentBinding.ForDocument<MeshNoteDocument>(sourceCache.Registry));
+        var firstKey = new CultRecordKey("mesh-note:session-first");
+        var secondKey = new CultRecordKey("mesh-note:session-second");
+        await sourceCache.UpsertAsync(
+            new MeshNoteDocument { Schema = "tests.mesh_note.v1", Text = "first", Revision = 1 },
+            new CultRecordHandle<MeshNoteDocument>(firstKey));
+        await sourceCache.UpsertAsync(
+            new MeshNoteDocument { Schema = "tests.mesh_note.v1", Text = "second", Revision = 2 },
+            new CultRecordHandle<MeshNoteDocument>(secondKey));
+        var client = new MeshSnapshotSchemaClient(request =>
+            registry.CreateRawSnapshotResponse(sourceCache, request.MessageId, request));
+
+        using var session = CultMesh.SnapshotSession(
+            "cultnet://session.test:3075",
+            new CultMeshSnapshotRequestOptions { CreateClient = () => client },
+            registry);
+        var first = await session.FetchDocumentsAsync<MeshNoteDocument>(new[] { firstKey.Value });
+        var second = await session.FetchDocumentsAsync<MeshNoteDocument>(new[] { secondKey.Value });
+
+        client.ConnectCount.Should().Be(1);
+        first.Should().ContainSingle().Which.Text.Should().Be("first");
+        second.Should().ContainSingle().Which.Text.Should().Be("second");
+    }
+
+    [Test]
+    public async Task DocumentRegistryHelpers_CreateTypedNetworkRegistriesForAliases()
+    {
+        var sourceCache = new CultCache();
+        var cacheRegistry = CultMesh.CreateCultCacheDocumentRegistry(
+            typeof(MeshNoteDocument),
+            typeof(MeshNoteAliasDocument));
+        var networkRegistry = CultMesh.CreateCultNetDocumentRegistry(
+            new[] { typeof(MeshNoteDocument), typeof(MeshNoteAliasDocument) },
+            cacheRegistry);
+        var key = new CultRecordKey("mesh-note:registry-helper");
+        await sourceCache.UpsertAsync(new MeshNoteDocument
+        {
+            Schema = "tests.mesh_note.v1",
+            Text = "registry-helper",
+            Revision = 23
+        }, new CultRecordHandle<MeshNoteDocument>(key));
+        var endpoint = "cultnet://registry-helper.test:3077";
+
+        var documents = await CultMesh.FetchSnapshotDocumentsAsync<MeshNoteAliasDocument>(
+            endpoint,
+            new CultMeshSnapshotRequestOptions
+            {
+                RecordKeys = new[] { key.Value },
+                CreateClient = () => new MeshSnapshotSchemaClient(request =>
+                    networkRegistry.CreateRawSnapshotResponse(sourceCache, request.MessageId, request))
+            },
+            networkRegistry);
+
+        var schemaId = cacheRegistry.GetRequired<MeshNoteDocument>().SchemaId;
+        cacheRegistry.GetRequired<MeshNoteAliasDocument>().SchemaId.Should().Be(schemaId);
+        networkRegistry.GetByDocumentType(typeof(MeshNoteDocument)).Should().NotBeNull();
+        networkRegistry.GetByDocumentType(typeof(MeshNoteAliasDocument)).Should().NotBeNull();
+        networkRegistry.GetBySchemaId(schemaId)!.DocumentType.Should().Be(typeof(MeshNoteDocument));
+        documents.Should().ContainSingle().Which.Text.Should().Be("registry-helper");
+    }
+
+    [Test]
+    public async Task SnapshotEndpoint_ProvidesTypedHandlesAndSchemaAliases()
+    {
+        var sourceCache = new CultCache();
+        var registry = new CultNetDocumentRegistry(CultDocumentRegistry.Shared);
+        registry.Register(CultNetDocumentBinding.ForDocument<MeshNoteDocument>(sourceCache.Registry));
+        var key = new CultRecordKey("mesh-note:snapshot-endpoint");
+        await sourceCache.UpsertAsync(new MeshNoteDocument
+        {
+            Schema = "tests.mesh_note.v1",
+            Text = "snapshot-endpoint",
+            Revision = 19
+        }, new CultRecordHandle<MeshNoteDocument>(key));
+        var requests = new List<CultNetSnapshotRequestMessage>();
+        var endpoint = "cultnet://snapshot-endpoint.test:3076";
+        var surface = CultMesh.SnapshotEndpoint(
+            endpoint,
+            new CultMeshSnapshotEndpointOptions
+            {
+                Context = CultMesh.Verse("starbridge", "browser-starfire").Context,
+                DocumentRegistry = registry,
+                Request = new CultMeshSnapshotRequestOptions
+                {
+                    ShardId = "primary",
+                    ShardEpoch = 9,
+                    CreateClient = () => new MeshSnapshotSchemaClient(request =>
+                    {
+                        requests.Add(request);
+                        return registry.CreateRawSnapshotResponse(sourceCache, request.MessageId, request);
+                    })
+                }
+            });
+
+        var fetchedAlias = await surface.FetchDocumentAsync<MeshNoteAliasDocument>(key.Value);
+        using var node = await CultMesh.CreateNodeAsync(
+            Path.Combine(Path.GetTempPath(), $"cultmesh-snapshot-endpoint-{Guid.NewGuid():N}.ccmp"),
+            new CultMeshNodeOptions
+            {
+                StartServer = false,
+                CacheOptions = new CultCacheOpenOptions
+                {
+                    Registry = sourceCache.Registry
+                },
+                DatabaseOptions = new CultNetDatabaseOptions
+                {
+                    DocumentRegistry = registry
+                }
+            });
+        var syncedAlias = await surface.SyncDocumentAsync<MeshNoteAliasDocument>(node, key.Value);
+        var aliasHandle = surface.Document<MeshNoteAliasDocument>(key.Value);
+        var aliasLatest = await aliasHandle.LatestAsync();
+        var catalog = surface.Documents(
+            CultMesh.SnapshotDocument<MeshNoteDocument>(key.Value, "daemon:mesh-note:snapshot-endpoint"));
+        var catalogAlias = await catalog.LatestAsync<MeshNoteAliasDocument>();
+        await sourceCache.UpsertAsync(new MeshNoteDocument
+        {
+            Schema = "tests.mesh_note.v1",
+            Text = "snapshot-endpoint-synced",
+            Revision = 20
+        }, new CultRecordHandle<MeshNoteDocument>(key));
+        var syncedEndpoint = surface.SyncTo(node);
+        var syncedHandle = syncedEndpoint.Document<MeshNoteAliasDocument>(key.Value);
+        var syncedLatest = await syncedHandle.LatestAsync();
+        await sourceCache.UpsertAsync(new MeshNoteDocument
+        {
+            Schema = "tests.mesh_note.v1",
+            Text = "snapshot-endpoint-catalog-synced",
+            Revision = 21
+        }, new CultRecordHandle<MeshNoteDocument>(key));
+        var syncedCatalog = syncedEndpoint.Documents(
+            CultMesh.SnapshotDocument<MeshNoteDocument>(key.Value));
+        var syncedCatalogAlias = await syncedCatalog.LatestAsync<MeshNoteAliasDocument>();
+
+        fetchedAlias.Text.Should().Be("snapshot-endpoint");
+        syncedAlias.Text.Should().Be("snapshot-endpoint");
+        aliasLatest.Revision.Should().Be(19);
+        catalog.Document<MeshNoteDocument>().DocumentId.Should().Be("daemon:mesh-note:snapshot-endpoint");
+        catalogAlias.Text.Should().Be("snapshot-endpoint");
+        syncedLatest.Text.Should().Be("snapshot-endpoint-synced");
+        node.Cache.Get<MeshNoteDocument>(key)!.Revision.Should().Be(21);
+        syncedCatalogAlias.Text.Should().Be("snapshot-endpoint-catalog-synced");
+        requests.Should().HaveCount(6);
+        requests.Should().OnlyContain(request =>
+            request.SchemaIds == null &&
+            request.RecordKeys!.SequenceEqual(new[] { key.Value }) &&
+            request.ShardId == "primary" &&
+            request.ShardEpoch == 9 &&
+            request.MessageId.StartsWith("cultmesh:browser-starfire:snapshot:", StringComparison.Ordinal));
+    }
+
+    [Test]
+    public async Task CollectionHandle_ReadsAndWatchesDatabaseCollectionsByIndex()
+    {
+        var cache = new CultCache();
+        var database = new CultNetDatabase(cache);
+        var teamId = Guid.NewGuid().ToString("D");
+        var collection = CultMesh.CollectionByIndex<MeshIndexedPlayer>(
+            database,
+            "TeamId",
+            teamId);
+        var changes = new List<CultMeshCollectionChange<MeshIndexedPlayer>>();
+        using var subscription = collection.WatchChanges(change => changes.Add(change));
+
+        await database.PutAsync(
+            new CultRecordKey("player:one"),
+            new MeshIndexedPlayer
+            {
+                Name = "One",
+                TeamId = teamId,
+                Score = 10
+            });
+        await database.PutAsync(
+            new CultRecordKey("player:two"),
+            new MeshIndexedPlayer
+            {
+                Name = "Two",
+                TeamId = Guid.NewGuid().ToString("D"),
+                Score = 20
+            });
+
+        collection.CollectionId.Should().Contain(teamId);
+        collection.SchemaName.Should().Be("tests.mesh_indexed_player");
+        collection.RouteHint.Kind.Should().Be(CultMeshLocalityKind.Automatic);
+        collection.Sources.Should().ContainSingle().Which.SchemaId.Should().Be(collection.SchemaId);
+
+        var snapshot = await collection.LatestAsync();
+        snapshot.Should().ContainSingle().Which.Name.Should().Be("One");
+        changes.Should().ContainSingle();
+        changes[0].Kind.Should().Be(CultMeshCollectionChangeKind.Added);
+        changes[0].Document!.Name.Should().Be("One");
+    }
+
+    [Test]
+    public async Task CollectionHandle_SupportsSameSchemaAliases()
+    {
+        var cache = new CultCache();
+        await cache.UpsertAsync(
+            new MeshNoteDocument
+            {
+                Schema = "tests.mesh_note.v1",
+                Text = "collection-alias",
+                Revision = 4
+            },
+            new CultRecordHandle<MeshNoteDocument>(new CultRecordKey("mesh-note:collection")));
+
+        var collection = CultMesh.Collection<MeshNoteDocument>(cache);
+        var alias = collection.AsSchemaAlias<MeshNoteAliasDocument>();
+        var catalog = CultMesh.Collections(collection);
+
+        alias.CollectionId.Should().Be(collection.CollectionId);
+        alias.SchemaName.Should().Be(collection.SchemaName);
+        catalog.Collections.Should().ContainSingle().Which.Should().BeSameAs(collection);
+        catalog.TryGetCollection<MeshNoteAliasDocument>(out var catalogAlias).Should().BeTrue();
+        catalogAlias.CollectionId.Should().Be(collection.CollectionId);
+        catalog.TryGetCollectionBySchema("tests.mesh_note.v1", out var byVersion).Should().BeTrue();
+        byVersion.Should().BeSameAs(collection);
+        catalog.CollectionBySchema("tests.mesh_note").Should().BeSameAs(collection);
+        catalog.CollectionBySchema(CultDocumentRegistry.Shared.GetRequired<MeshNoteDocument>().SchemaId)
+            .Should()
+            .BeSameAs(collection);
+
+        var snapshot = await alias.LatestAsync();
+        snapshot.Should().ContainSingle().Which.Text.Should().Be("collection-alias");
+        var catalogSnapshot = await catalog.LatestAsync<MeshNoteAliasDocument>();
+        catalogSnapshot.Should().ContainSingle().Which.Revision.Should().Be(4);
+
+        CultMeshCollectionChange<MeshNoteAliasDocument> observed = null!;
+        using var subscription = catalog.WatchChanges<MeshNoteAliasDocument>(change => observed = change);
+        await cache.UpsertAsync(
+            new MeshNoteDocument
+            {
+                Schema = "tests.mesh_note.v1",
+                Text = "collection-alias-updated",
+                Revision = 5
+            },
+            new CultRecordHandle<MeshNoteDocument>(new CultRecordKey("mesh-note:collection")));
+
+        observed.Kind.Should().Be(CultMeshCollectionChangeKind.Updated);
+        observed.Document!.Text.Should().Be("collection-alias-updated");
+        observed.Document.Revision.Should().Be(5);
+        observed.PreviousDocument!.Text.Should().Be("collection-alias");
+    }
+
+    [Test]
+    public async Task DocumentHandle_ReplacesThroughCultMeshNodeDatabase()
+    {
+        using var directory = new TemporaryDirectory();
+        using var node = await CultMesh.CreateNodeAsync(
+            Path.Combine(directory.Path, "mesh-node.cc"),
+            new CultMeshNodeOptions
+            {
+                DatabaseOptions = new CultNetDatabaseOptions
+                {
+                    RuntimeId = "node-runtime",
+                    Shards = new[]
+                    {
+                        new CultNetShardDescriptor(
+                            "mesh",
+                            "node-runtime",
+                            epoch: 1,
+                            isPrimary: true,
+                            schemaIds: new[] { CultDocumentRegistry.Shared.GetRequired<MeshNoteDocument>().SchemaId })
+                    }
+                },
+                StartServer = false
+            });
+        var key = new CultRecordKey("mesh-note:node");
+
+        var handle = CultMesh.Document<MeshNoteDocument>(
+            node,
+            key,
+            CultMesh.Verse("starbridge", "unity-pilot"));
+        var alias = handle.AsSchemaAlias<MeshNoteAliasDocument>();
+
+        MeshNoteDocument observed = null!;
+        using var subscription = handle.Watch(value => observed = value);
+        await alias.ReplaceAsync(new MeshNoteAliasDocument
+        {
+            Schema = "tests.mesh_note.v1",
+            Text = "node-replaced",
+            Revision = 3
+        });
+
+        var snapshot = await handle.LatestAsync();
+        snapshot.Text.Should().Be("node-replaced");
+        observed.Text.Should().Be("node-replaced");
+        observed.Revision.Should().Be(3);
+    }
+
+    [Test]
+    public void SurfaceCatalog_DescribesTypedRuntimeSurfaces()
+    {
+        var route = new CultMeshRouteHint(CultMeshLocalityKind.SharedMemory, "co-located frame slab");
+        var sources = new[]
+        {
+            CultMesh.ProjectionSource(
+                "daemon:aetheria.frame.latest.v1",
+                schemaId: "gamecult.aetheria.daemon_frame.v1")
+        };
+        var query = new CultMeshQuerySurface<MeshViewportRequest, string[]>(
+            "aetheria.zone.objects.visible",
+            (_request, _context) => Task.FromResult(Array.Empty<string>()),
+            sources: sources,
+            routeHint: route);
+        var feed = CultMesh.LiveFeed<MeshViewportRequest, string>(
+            "aetheria.rts.viewport.feed",
+            (_request, _context) => Task.FromResult("frame"),
+            sources: sources,
+            routeHint: route);
+        var operation = new CultMeshOperationHandle<MeshMoveRequest, CultMeshOperationReceipt>(
+            "aetheria.entity.pilot.move",
+            (_request, _context) => Task.FromResult(new CultMeshOperationReceipt("aetheria.entity.pilot.move", true)));
+        var pointer = CultMesh.StatePointer(
+            "aetheria.selection.current",
+            async () => "entity:ship:1",
+            () => new Subject<string>(),
+            route,
+            sources);
+        var document = CultMesh.Document(
+            "daemon:aetheria.frame.latest.v1",
+            CultMesh.Verse("aetheria.local", "unity-raven").Context,
+            _context => Task.FromResult(new MeshNoteDocument { Schema = "frame", Text = "current", Revision = 1 }),
+            _context => new Subject<MeshNoteDocument>(),
+            sources,
+            route);
+        var collection = new CultMeshCollectionHandle<MeshNoteDocument>(
+            "daemon:aetheria.contacts.v1",
+            () => Task.FromResult<IReadOnlyList<MeshNoteDocument>>(Array.Empty<MeshNoteDocument>()),
+            () => new Subject<CultMeshCollectionChange<MeshNoteDocument>>(),
+            sources,
+            route);
+        var nativeView = new CultMeshNativeSliceViewDescriptor(
+            "aetheria.zone.render",
+            "gamecult.aetheria.render_body.v1",
+            rowCount: 128,
+            new[] { CultMeshNativeSliceColumn.For<MeshVec2>("position") },
+            route);
+
+        var catalog = CultMesh.DescribeSurfaceCatalog(
+            "gamecult.aetheria.rts.surfaces.v1",
+            new[]
+            {
+                CultMesh.DescribeSurface(query),
+                CultMesh.DescribeSurface(feed),
+                CultMesh.DescribeSurface(operation),
+                CultMesh.DescribeSurface(document),
+                CultMesh.DescribeSurface(collection),
+                CultMesh.DescribeSurface(pointer),
+                CultMesh.DescribeSurface(nativeView)
+            });
+
+        catalog.CatalogId.Should().Be("gamecult.aetheria.rts.surfaces.v1");
+        catalog.Surfaces.Should().HaveCount(7);
+        catalog.Surfaces[0].Kind.Should().Be(CultMeshSurfaceKind.Query);
+        catalog.Surfaces[0].SurfaceId.Should().Be("aetheria.zone.objects.visible");
+        catalog.Surfaces[0].RouteHint.Kind.Should().Be(CultMeshLocalityKind.SharedMemory);
+        catalog.Surfaces[0].Sources.Should().HaveCount(1);
+        catalog.Find("aetheria.rts.viewport.feed")!.Kind.Should().Be(CultMeshSurfaceKind.LiveFeed);
+        catalog.Find("aetheria.entity.pilot.move")!.Kind.Should().Be(CultMeshSurfaceKind.Operation);
+        catalog.Find("daemon:aetheria.frame.latest.v1")!.Kind.Should().Be(CultMeshSurfaceKind.Document);
+        catalog.Find("daemon:aetheria.contacts.v1")!.Kind.Should().Be(CultMeshSurfaceKind.Collection);
+        catalog.Find("aetheria.selection.current")!.Kind.Should().Be(CultMeshSurfaceKind.StatePointer);
+        catalog.Find("aetheria.selection.current")!.RouteHint.Kind.Should().Be(CultMeshLocalityKind.SharedMemory);
+        catalog.Find("aetheria.selection.current")!.Sources.Should().ContainSingle();
+        catalog.Find("aetheria.zone.render")!.Kind.Should().Be(CultMeshSurfaceKind.NativeSliceView);
+        catalog.Find("aetheria.zone.render")!.RouteHint.Kind.Should().Be(CultMeshLocalityKind.SharedMemory);
+        catalog.Find("missing").Should().BeNull();
+        catalog.FindByKind(CultMeshSurfaceKind.Operation)
+            .Should()
+            .ContainSingle()
+            .Which
+            .SurfaceId
+            .Should()
+            .Be("aetheria.entity.pilot.move");
+        catalog.FindByKind(CultMeshSurfaceKind.Query).Should().ContainSingle();
+
+        var index = CultMesh.DescribeSurfaceCatalogIndex(catalog);
+        index.CatalogId.Should().Be(catalog.CatalogId);
+        index.Queries.Should().ContainSingle().Which.SurfaceId.Should().Be("aetheria.zone.objects.visible");
+        index.LiveFeeds.Should().ContainSingle().Which.SurfaceId.Should().Be("aetheria.rts.viewport.feed");
+        index.Operations.Should().ContainSingle().Which.SurfaceId.Should().Be("aetheria.entity.pilot.move");
+        index.Documents.Should().ContainSingle().Which.SurfaceId.Should().Be("daemon:aetheria.frame.latest.v1");
+        index.Collections.Should().ContainSingle().Which.SurfaceId.Should().Be("daemon:aetheria.contacts.v1");
+        index.StatePointers.Should().ContainSingle().Which.SurfaceId.Should().Be("aetheria.selection.current");
+        index.NativeSliceViews.Should().ContainSingle().Which.SurfaceId.Should().Be("aetheria.zone.render");
+        index.ProjectionRecipes.Should().BeEmpty();
+    }
+
+    [Test]
+    public async Task PollingQueryWatcher_TurnsSnapshotsIntoReactiveFeed()
+    {
+        var frameId = 0;
+        var observed = new List<int>();
+        var feed = CultMesh.LiveFeed<MeshViewportRequest, int>(
+            "aetheria.rts.viewport.feed",
+            (_request, _context) => Task.FromResult(frameId),
+            CultMesh.PollingQueryWatcher<MeshViewportRequest, int>(
+                (_request, _context) => Task.FromResult(frameId),
+                new CultMeshPollingWatchOptions<int>(TimeSpan.FromMilliseconds(5))));
+
+        using (feed
+            .Watch(new MeshViewportRequest(-1, 1), CultMeshQueryContext.ForRuntime("browser-starfire"))
+            .Subscribe(value => observed.Add(value)))
+        {
+            await Task.Delay(35);
+            frameId = 1;
+            await Task.Delay(35);
+            frameId = 1;
+            await Task.Delay(25);
+            frameId = 2;
+            await Task.Delay(35);
+        }
+
+        frameId = 3;
+        await Task.Delay(25);
+
+        observed.Should().Equal(0, 1, 2);
+    }
+
+    [Test]
+    public void NativeSliceDescriptor_DescribesSharedColumnsWithoutOpeningTransport()
+    {
+        var descriptor = new CultMeshNativeSliceViewDescriptor(
+            "aetheria.zone.render",
+            "gamecult.aetheria.render_body.v1",
+            rowCount: 128,
+            new[]
+            {
+                CultMeshNativeSliceColumn.For<MeshVec2>("position"),
+                CultMeshNativeSliceColumn.For<MeshVec2>("velocity")
+            },
+            new CultMeshRouteHint(CultMeshLocalityKind.SharedMemory, "CultCache slab"),
+            nativeHandle: "cultcache-slab:aetheria-zone-render");
+
+        descriptor.Route.Kind.Should().Be(CultMeshLocalityKind.SharedMemory);
+        descriptor.Columns.Should().HaveCount(2);
+        descriptor.Columns[0].Name.Should().Be("position");
+        descriptor.DenseRowStrideBytes.Should().Be(16);
+        descriptor.FindColumn("velocity")!.ElementSizeBytes.Should().Be(8);
+
+        var diagnostic = CultMesh.DescribeNativeSliceView(descriptor);
+        diagnostic.ViewId.Should().Be("aetheria.zone.render");
+        diagnostic.SchemaId.Should().Be("gamecult.aetheria.render_body.v1");
+        diagnostic.RowCount.Should().Be(128);
+        diagnostic.Route.Kind.Should().Be(CultMeshLocalityKind.SharedMemory);
+        diagnostic.NativeHandle.Should().Be("cultcache-slab:aetheria-zone-render");
+        diagnostic.DenseRowStrideBytes.Should().Be(16);
+        diagnostic.Columns.Should().HaveCount(2);
+        diagnostic.Columns.Should().NotBeSameAs(descriptor.Columns);
+    }
+
     [Test]
     public void NegotiatesGpuTextureStreamsWithoutForcingCopies()
     {
@@ -132,7 +3718,7 @@ public sealed class CultMeshStreamingTests
     public void SharedMemoryRingPublishesWritableSlotsWithoutInternalCopies()
     {
         var catalog = CatalogWithByteStream();
-        using var ring = catalog.CreateSharedMemoryRing("mimir:leap:depth", slotCount: 2, slotByteLength: 16);
+        using var ring = catalog.CreateSharedMemoryRing("mimir:leap:depth", slotCount: 3, slotByteLength: 16);
 
         ring.TryAcquireWriteSlot(out var write).Should().BeTrue();
         ReadOnlySpan<byte> seed = stackalloc byte[] { 1, 2, 3, 4 };
@@ -159,7 +3745,7 @@ public sealed class CultMeshStreamingTests
     public void SharedMemoryRingDoesNotOverwriteSlotsHeldByReaders()
     {
         var catalog = CatalogWithByteStream();
-        using var ring = catalog.CreateSharedMemoryRing("mimir:leap:depth", slotCount: 1, slotByteLength: 8);
+        using var ring = catalog.CreateSharedMemoryRing("mimir:leap:depth", slotCount: 3, slotByteLength: 8);
 
         ring.TryAcquireWriteSlot(out var firstWrite).Should().BeTrue();
         firstWrite.Span[0] = 11;
@@ -167,26 +3753,36 @@ public sealed class CultMeshStreamingTests
 
         ring.TryAcquireLatestRead(out var read).Should().BeTrue();
 
+        ring.TryAcquireWriteSlot(out var secondWrite).Should().BeTrue();
+        ring.CommitWriteSlot(secondWrite, timestampNs: 2, byteLength: 1);
+        ring.TryAcquireWriteSlot(out var thirdWrite).Should().BeTrue();
+        ring.CommitWriteSlot(thirdWrite, timestampNs: 3, byteLength: 1);
+        ring.TryAcquireLatestRead(out var thirdRead).Should().BeTrue();
+        ring.TryAcquireWriteSlot(out var overwriteSecond).Should().BeTrue();
+        ring.CommitWriteSlot(overwriteSecond, timestampNs: 4, byteLength: 1);
+        ring.TryAcquireLatestRead(out var secondRead).Should().BeTrue();
         ring.TryAcquireWriteSlot(out _).Should().BeFalse();
         ring.Stats().BlockedWrites.Should().Be(1);
 
         read.Dispose();
+        thirdRead.Dispose();
+        secondRead.Dispose();
 
-        ring.TryAcquireWriteSlot(out var secondWrite).Should().BeTrue();
-        secondWrite.Span[0] = 12;
-        ring.CommitWriteSlot(secondWrite, timestampNs: 2, byteLength: 1);
+        ring.TryAcquireWriteSlot(out var fifthWrite).Should().BeTrue();
+        fifthWrite.Span[0] = 12;
+        ring.CommitWriteSlot(fifthWrite, timestampNs: 5, byteLength: 1);
 
         var stats = ring.Stats();
-        stats.PublishedFrames.Should().Be(2);
-        stats.DroppedFrames.Should().Be(1);
-        stats.LatestSequence.Should().Be(1);
+        stats.PublishedFrames.Should().Be(5);
+        stats.DroppedFrames.Should().Be(2);
+        stats.LatestSequence.Should().Be(4);
     }
 
     [Test]
     public void CopyPublishMarksFallbackCopiesExplicitly()
     {
         var catalog = CatalogWithByteStream();
-        using var ring = catalog.CreateSharedMemoryRing("mimir:leap:depth", slotCount: 2, slotByteLength: 8);
+        using var ring = catalog.CreateSharedMemoryRing("mimir:leap:depth", slotCount: 3, slotByteLength: 8);
 
         ring.TryPublishCopy(stackalloc byte[] { 5, 6, 7 }, timestampNs: 10, durationNs: 2, out var handle)
             .Should()
@@ -196,6 +3792,39 @@ public sealed class CultMeshStreamingTests
         ring.Stats().UnavoidableCopyCount.Should().Be(1);
     }
 
+    private static byte[] WriteLegacySingleDocumentSnapshot(
+        string key,
+        string schemaId,
+        string schemaName,
+        string schemaVersion,
+        string storedAt,
+        byte[] payload)
+    {
+        var buffer = new ArrayBufferWriter<byte>();
+        var writer = new MessagePackWriter(buffer);
+
+        writer.WriteArrayHeader(3);
+        writer.Write("cultcache.store.v1");
+        writer.WriteArrayHeader(1);
+        writer.WriteArrayHeader(7);
+        writer.Write(schemaId);
+        writer.Write(schemaName);
+        writer.Write(schemaVersion);
+        writer.Write("Legacy Aetheria single document");
+        writer.Write(storedAt);
+        writer.Write("legacy-hash");
+        writer.WriteArrayHeader(0);
+        writer.WriteArrayHeader(1);
+        writer.WriteArrayHeader(4);
+        writer.Write(key);
+        writer.Write(schemaId);
+        writer.Write(storedAt);
+        writer.Write(payload);
+        writer.Flush();
+
+        return buffer.WrittenSpan.ToArray();
+    }
+
     private static CultMeshStreamCatalog CatalogWithByteStream()
     {
         var catalog = CultMesh.CreateStreamCatalog();
@@ -209,16 +3838,338 @@ public sealed class CultMeshStreamingTests
         return catalog;
     }
 
-    [CultDocument("tests.mesh_managed_player", "tests.mesh_managed_player.v1")]
-    private sealed class MeshManagedPlayer
+    private static async Task WaitForAsync(Func<bool> predicate)
     {
-        [MessagePack.Key(0)]
-        public string Name = string.Empty;
+        var deadline = DateTimeOffset.UtcNow.AddSeconds(2);
+        while (DateTimeOffset.UtcNow < deadline)
+        {
+            if (predicate())
+            {
+                return;
+            }
 
-        [MessagePack.Key(1)]
-        public float PositionX;
+            await Task.Delay(20);
+        }
 
-        [MessagePack.Key(2)]
-        public int Health;
+        predicate().Should().BeTrue();
+    }
+
+    private sealed class TemporaryDirectory : IDisposable
+    {
+        public TemporaryDirectory()
+        {
+            Path = System.IO.Path.Combine(
+                System.IO.Path.GetTempPath(),
+                "cultmesh-tests-" + Guid.NewGuid().ToString("N"));
+            Directory.CreateDirectory(Path);
+        }
+
+        public string Path { get; }
+
+        public void Dispose()
+        {
+            if (Directory.Exists(Path))
+            {
+                Directory.Delete(Path, recursive: true);
+            }
+        }
+    }
+
+    [CultDocument("tests.mesh_indexed_player", "tests.mesh_indexed_player.v1")]
+    [MessagePackObject(AllowPrivate = true)]
+    internal sealed class MeshIndexedPlayer
+    {
+        [Key(0)]
+        public string Name { get; set; } = string.Empty;
+
+        [Key(1)]
+        [CultIndex]
+        public string TeamId { get; set; } = string.Empty;
+
+        [Key(2)]
+        public int Score { get; set; }
+    }
+
+    [CultDocument("tests.mesh_note", "tests.mesh_note.v1")]
+    [MessagePackObject(AllowPrivate = true)]
+    internal sealed class MeshNoteDocument
+    {
+        [Key(0)]
+        public string Schema { get; set; } = string.Empty;
+
+        [Key(1)]
+        public string Text { get; set; } = string.Empty;
+
+        [Key(2)]
+        public int Revision { get; set; }
+    }
+
+    [CultDocument("tests.mesh_note", "tests.mesh_note.v1")]
+    [MessagePackObject(AllowPrivate = true)]
+    internal sealed class MeshNoteAliasDocument
+    {
+        [Key(0)]
+        public string Schema { get; set; } = string.Empty;
+
+        [Key(1)]
+        public string Text { get; set; } = string.Empty;
+
+        [Key(2)]
+        public int Revision { get; set; }
+    }
+
+    [CultDocument("tests.mesh_publication_note", "tests.mesh_publication_note.v1")]
+    [MessagePackObject(AllowPrivate = true)]
+    internal sealed class MeshPublicationNoteDocument
+    {
+        [Key(0)]
+        public string Schema { get; set; } = string.Empty;
+
+        [Key(1)]
+        public string Text { get; set; } = string.Empty;
+
+        [Key(2)]
+        public int Revision { get; set; }
+    }
+
+    [CultDocument("tests.mesh_other", "tests.mesh_other.v1")]
+    [MessagePackObject(AllowPrivate = true)]
+    internal sealed class MeshOtherDocument
+    {
+        [Key(0)]
+        public string Schema { get; set; } = string.Empty;
+
+        [Key(1)]
+        public string Text { get; set; } = string.Empty;
+    }
+}
+
+public readonly struct MeshMoveRequest
+{
+    public MeshMoveRequest(int entityId, float x, float y)
+    {
+        EntityId = entityId;
+        X = x;
+        Y = y;
+    }
+
+    public int EntityId { get; }
+    public float X { get; }
+    public float Y { get; }
+}
+
+public readonly struct MeshViewportRequest
+{
+    public MeshViewportRequest(float minX, float maxX)
+    {
+        MinX = minX;
+        MaxX = maxX;
+    }
+
+    public float MinX { get; }
+    public float MaxX { get; }
+}
+
+public readonly struct MeshVec2
+{
+    public MeshVec2(float x, float y)
+    {
+        X = x;
+        Y = y;
+    }
+
+    public float X { get; }
+    public float Y { get; }
+}
+
+public sealed class MeshAetheriaDomain
+{
+    private readonly CultMeshVerseContext _context;
+
+    public MeshAetheriaDomain(CultMeshVerseContext context)
+    {
+        _context = context;
+    }
+
+    public MeshEntityFacade Entity(int entityId)
+    {
+        return new MeshEntityFacade(_context, entityId);
+    }
+
+    public MeshZoneFacade Zone(string zoneId)
+    {
+        return new MeshZoneFacade(_context, zoneId);
+    }
+}
+
+public sealed class MeshEntityFacade
+{
+    public MeshEntityFacade(CultMeshVerseContext context, int entityId)
+    {
+        Pilot = new MeshPilotFacade(context, entityId);
+    }
+
+    public MeshPilotFacade Pilot { get; }
+}
+
+public sealed class MeshPilotFacade
+{
+    private readonly int _entityId;
+    private readonly CultMeshBoundOperationHandle<MeshMoveRequest, CultMeshOperationReceipt> _move;
+
+    public MeshPilotFacade(CultMeshVerseContext context, int entityId)
+    {
+        _entityId = entityId;
+        _move = CultMesh.BindOperation(
+            context,
+            new CultMeshOperationHandle<MeshMoveRequest, CultMeshOperationReceipt>(
+            "aetheria.entity.pilot.move",
+            (request, context) => Task.FromResult(new CultMeshOperationReceipt(
+                "aetheria.entity.pilot.move",
+                accepted: request.EntityId == _entityId &&
+                          Math.Abs(request.X) > 0 &&
+                          context.Claims.Any(claim => claim.Role == "pilot-control"),
+                context.RouteHint))));
+    }
+
+    public Task<CultMeshOperationReceipt> MoveAsync(MeshVec2 direction, string idempotencyKey)
+    {
+        return _move.InvokeAsync(
+            new MeshMoveRequest(_entityId, direction.X, direction.Y),
+            idempotencyKey);
+    }
+}
+
+public sealed class MeshZoneFacade
+{
+    public MeshZoneFacade(CultMeshVerseContext context, string zoneId)
+    {
+        Objects = new MeshObjectsFacade(context, zoneId);
+    }
+
+    public MeshObjectsFacade Objects { get; }
+}
+
+public sealed class MeshObjectsFacade
+{
+    private readonly string _zoneId;
+    private readonly CultMeshBoundQuerySurface<MeshViewportRequest, string[]> _visibleObjects;
+
+    public MeshObjectsFacade(CultMeshVerseContext context, string zoneId)
+    {
+        _zoneId = zoneId;
+        _visibleObjects = CultMesh.BindQuery(
+            context,
+            new CultMeshQuerySurface<MeshViewportRequest, string[]>(
+            "aetheria.zone.objects.visible",
+            (parameters, context) => Task.FromResult(new[]
+            {
+                $"{context.RuntimeId}:{_zoneId}:{parameters.MinX}:{parameters.MaxX}:{context.RouteHint.Kind}"
+            })));
+    }
+
+    public Task<string[]> VisibleWithinAsync(MeshViewportRequest request)
+    {
+        return _visibleObjects.ExecuteAsync(request);
+    }
+}
+
+internal sealed class MeshSnapshotSchemaClient : ICultNetSchemaClient
+{
+    private readonly Func<CultNetSnapshotRequestMessage, CultNetSnapshotResponseRawMessage> _respond;
+    private readonly List<Action<CultNetSnapshotResponseRawMessage>> _snapshotHandlers = new();
+    private readonly List<Action<CultNetErrorMessage>> _errorHandlers = new();
+
+    public MeshSnapshotSchemaClient(
+        Func<CultNetSnapshotRequestMessage, CultNetSnapshotResponseRawMessage> respond)
+    {
+        _respond = respond;
+    }
+
+    public bool Connected { get; private set; }
+    public int ConnectCount { get; private set; }
+
+    public void Connect(string host, int port)
+    {
+        ConnectCount++;
+        Connected = true;
+    }
+
+    public void SendCultNet<T>(T message) where T : ICultNetSchemaMessage
+    {
+        if (message is not CultNetSnapshotRequestMessage request)
+        {
+            foreach (var handler in _errorHandlers)
+            {
+                handler(new CultNetErrorMessage { Error = $"Unexpected message {typeof(T).Name}." });
+            }
+
+            return;
+        }
+
+        var response = _respond(request);
+        foreach (var handler in _snapshotHandlers)
+        {
+            handler(response);
+        }
+    }
+
+    public void OnCultNet<T>(Action<T> callback) where T : ICultNetSchemaMessage
+    {
+        if (typeof(T) == typeof(CultNetSnapshotResponseRawMessage))
+        {
+            _snapshotHandlers.Add(message => callback((T)(object)message));
+        }
+        else if (typeof(T) == typeof(CultNetErrorMessage))
+        {
+            _errorHandlers.Add(message => callback((T)(object)message));
+        }
+    }
+
+    public void Dispose()
+    {
+    }
+}
+
+internal sealed class FailedBackgroundSchemaClient : ICultNetSchemaClient, ICultNetSchemaClientHealth
+{
+    private readonly bool _connected;
+
+    public FailedBackgroundSchemaClient(Exception error, bool connected = true)
+    {
+        _connected = connected;
+        BackgroundFailure = Task.FromResult(error);
+    }
+
+    public bool Connected { get; private set; }
+    public Task<Exception> BackgroundFailure { get; }
+
+    public void Connect(string host, int port) => Connected = _connected;
+
+    public void SendCultNet<T>(T message) where T : ICultNetSchemaMessage
+    {
+    }
+
+    public void OnCultNet<T>(Action<T> callback) where T : ICultNetSchemaMessage
+    {
+    }
+
+    public void Dispose()
+    {
+    }
+}
+
+internal sealed class BlockingCountClock : ICultMeshClock
+{
+    private int _delayCount;
+
+    public DateTimeOffset UtcNow => DateTimeOffset.UnixEpoch;
+
+    public int DelayCount => Volatile.Read(ref _delayCount);
+
+    public Task DelayAsync(TimeSpan delay, CancellationToken cancellationToken = default)
+    {
+        Interlocked.Increment(ref _delayCount);
+        return Task.Delay(Timeout.InfiniteTimeSpan, cancellationToken);
     }
 }
diff --git a/tests/GameCult.Mesh.Tests/CultMeshTestTrust.cs b/tests/GameCult.Mesh.Tests/CultMeshTestTrust.cs
new file mode 100644
index 00000000..2356462d
--- /dev/null
+++ b/tests/GameCult.Mesh.Tests/CultMeshTestTrust.cs
@@ -0,0 +1,18 @@
+namespace GameCult.Mesh.Tests;
+
+internal static class CultMeshTestTrust
+{
+    internal static CultMeshAuthorityTrustPolicy LocalPolicy { get; } =
+        new(CultMeshAuthorityTrustMode.LocalDevelopment);
+
+    internal static CultMeshSessionManagerOptions LocalSessions => new()
+    {
+        Trust = LocalPolicy
+    };
+
+    internal static CultMeshSessionManagerOptions LocalSessionsWithClock(ICultMeshClock clock) => new()
+    {
+        Clock = clock,
+        Trust = LocalPolicy
+    };
+}
diff --git a/tests/GameCult.Mesh.Tests/CultMeshTransportModularityTests.cs b/tests/GameCult.Mesh.Tests/CultMeshTransportModularityTests.cs
new file mode 100644
index 00000000..e5d3867e
--- /dev/null
+++ b/tests/GameCult.Mesh.Tests/CultMeshTransportModularityTests.cs
@@ -0,0 +1,360 @@
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Net;
+using System.Net.Sockets;
+using System.Threading;
+using System.Threading.Tasks;
+using FluentAssertions;
+using GameCult.Caching;
+using GameCult.Networking;
+using NUnit.Framework;
+
+namespace GameCult.Mesh.Tests;
+
+[TestFixture]
+public sealed class CultMeshTransportModularityTests
+{
+    private const string RouteGeneration = "transport-modularity-route-1";
+    [Test]
+    public async Task SchemaSessionPrefersTcpTierWithoutTouchingLegacyDatagrams()
+    {
+        using var server = new TcpFramedCultNetSchemaServer(new TcpListener(IPAddress.Loopback, 0));
+        using var identity = new CultMeshSessionIdentityServer(
+            server,
+            "aetheria.daemon",
+            new[] { "aetheria" },
+            new[] { CultMeshProtocols.Documents.Value },
+            new[] { RouteGeneration });
+        server.OnCultNet<CultNetHelloMessage>((message, peer) =>
+        {
+            identity.TryGetSourceRuntimeId(peer, out var sourceRuntimeId).Should().BeTrue(
+                "application ingress must only trust a runtime identity bound by the session-open handshake");
+            peer.SendCultNet(new CultNetErrorMessage { Error = $"tcp:{message.RuntimeId}:{sourceRuntimeId}" });
+            return Task.CompletedTask;
+        });
+        var tcpEndpoint = $"cultnet+tcp://127.0.0.1:{server.LocalEndPoint.Port}";
+        var legacy = new RejectingLegacySchemaConnector();
+        using var discovery = new CultMeshDiscoveryService(new[]
+        {
+            new RouteSource("rudp://127.0.0.1:9", tcpEndpoint)
+        });
+        using var sessions = new CultMeshSessionManager(
+            discovery,
+            new ICultMeshTransportConnector[]
+            {
+                legacy,
+                new CultMeshTcpSchemaTransportConnector()
+            }, CultMeshTestTrust.LocalSessions);
+
+        var session = await sessions.ConnectAsync(
+            new CultMeshSessionTarget("aetheria", "aetheria.daemon"),
+            CultMeshProtocols.Documents);
+        var response = new TaskCompletionSource<CultNetErrorMessage>(TaskCreationOptions.RunContinuationsAsynchronously);
+        using var subscription = session.OnCultNet<CultNetErrorMessage>(message => response.TrySetResult(message));
+        session.SendCultNet(new CultNetHelloMessage { RuntimeId = "eve-unity" });
+        var received = await response.Task.WaitAsync(TimeSpan.FromSeconds(5));
+
+        session.State.Path!.Endpoint.Should().Be(tcpEndpoint);
+        received.Error.Should().Be("tcp:eve-unity:cultmesh-client");
+        legacy.ConnectCount.Should().Be(0,
+            "a lower transport tier is fallback, not a race against the preferred TCP tier");
+    }
+
+    [Test]
+    public async Task ContentSessionPrefersTcpAndStreamsOutsideSchemaPayloads()
+    {
+        var payload = new byte[512 * 1024];
+        new Random(1234).NextBytes(payload);
+        var artifact = CultMesh.PackCdnArtifact("transport/modularity", payload);
+        using var content = new CultCache(CultMesh.CreateCultCacheDocumentRegistry(
+            typeof(CultMeshCdnArtifactManifest), typeof(CultMeshCdnArtifactChunk)));
+        await CultMeshCdn.PublishAsync(content, artifact);
+        using var server = new CultMeshTcpContentServer(
+            new TcpListener(IPAddress.Loopback, 0),
+            content,
+            new CultMeshTcpContentServerOptions
+            {
+                VerseId = "aetheria",
+                AuthorityRuntimeId = "aetheria.daemon",
+                RouteGeneration = RouteGeneration
+            });
+        var tcpEndpoint = $"{CultMeshTcpContentTransportConnector.Scheme}://127.0.0.1:{server.LocalEndPoint.Port}";
+        var legacy = new RejectingLegacyContentConnector();
+        using var discovery = new CultMeshDiscoveryService(new[]
+        {
+            new RouteSource("rudp://127.0.0.1:9", tcpEndpoint)
+        });
+        using var sessions = new CultMeshSessionManager(
+            discovery,
+            Array.Empty<ICultMeshTransportConnector>(),
+            new ICultMeshContentTransportConnector[]
+            {
+                legacy,
+                new CultMeshTcpContentTransportConnector()
+            }, CultMeshTestTrust.LocalSessions);
+
+        var session = await sessions.ConnectContentAsync(new CultMeshSessionTarget("aetheria", "aetheria.daemon"));
+        using var destination = new MemoryStream();
+        await session.CopyChunkToAsync(artifact.Manifest.Chunks[0], destination);
+
+        session.TransportId.Should().Be("tcp-content");
+        destination.ToArray().Should().Equal(artifact.Chunks[0].Payload);
+        legacy.ConnectCount.Should().Be(0);
+    }
+
+    [Test]
+    public async Task ContentSessionFailsClosedWithoutAnExplicitConnector()
+    {
+        using var discovery = new CultMeshDiscoveryService(new[]
+        {
+            new RouteSource("rudp://127.0.0.1:3076")
+        });
+        using var sessions = new CultMeshSessionManager(
+            discovery,
+            Array.Empty<ICultMeshTransportConnector>(), CultMeshTestTrust.LocalSessions);
+
+        Func<Task> connect = async () => await sessions.ConnectContentAsync(
+            new CultMeshSessionTarget("aetheria", "aetheria.daemon"));
+
+        await connect.Should().ThrowAsync<CultMeshSessionException>()
+            .WithMessage("*No streaming content connectors are configured*");
+    }
+
+    [Test]
+    public async Task RealtimeSessionUsesDedicatedQuicShapedConnectorContract()
+    {
+        var connector = new LoopbackRealtimeConnector();
+        using var discovery = new CultMeshDiscoveryService(new[]
+        {
+            new RouteSource("cultmesh-state+quic://127.0.0.1:3077")
+        });
+        using var sessions = new CultMeshSessionManager(
+            discovery,
+            Array.Empty<ICultMeshTransportConnector>(),
+            Array.Empty<ICultMeshContentTransportConnector>(),
+            new ICultMeshRealtimeTransportConnector[] { connector }, CultMeshTestTrust.LocalSessions);
+        var session = await sessions.ConnectRealtimeAsync(
+            new CultMeshSessionTarget("aetheria", "aetheria.daemon"));
+        var sent = new CultMeshRealtimeFrame
+        {
+            ChannelId = "aetheria.entities",
+            SchemaId = "eve.entity_soa.v1",
+            BodyId = "body:aetheria:entities",
+            ProducerEpoch = 7,
+            Sequence = 42,
+            Delivery = CultMeshRealtimeDelivery.LatestOnly,
+            Payload = new byte[] { 1, 2, 3 }
+        };
+
+        await session.SendAsync(sent);
+        var received = await session.ReceiveAsync();
+
+        session.TransportId.Should().Be("test-quic-state");
+        received.Should().BeSameAs(sent);
+        connector.ConnectCount.Should().Be(1);
+    }
+
+    [Test]
+    public async Task RealtimeSessionFailsClosedWithoutAnExplicitConnector()
+    {
+        using var discovery = new CultMeshDiscoveryService(new[]
+        {
+            new RouteSource("rudp://127.0.0.1:3076")
+        });
+        using var sessions = new CultMeshSessionManager(
+            discovery,
+            Array.Empty<ICultMeshTransportConnector>(), CultMeshTestTrust.LocalSessions);
+
+        Func<Task> connect = async () => await sessions.ConnectRealtimeAsync(
+            new CultMeshSessionTarget("aetheria", "aetheria.daemon"));
+
+        await connect.Should().ThrowAsync<CultMeshSessionException>()
+            .WithMessage("*No realtime state connectors are configured*");
+    }
+
+    [Test]
+    public async Task RealtimeSessionRejectsConnectedTransportWithoutAuthorityProof()
+    {
+        using var discovery = new CultMeshDiscoveryService(new[]
+        {
+            new RouteSource("cultmesh-state+quic://127.0.0.1:3076")
+        });
+        using var sessions = new CultMeshSessionManager(
+            discovery,
+            Array.Empty<ICultMeshTransportConnector>(),
+            Array.Empty<ICultMeshContentTransportConnector>(),
+            new ICultMeshRealtimeTransportConnector[] { new UnverifiedRealtimeConnector() }, CultMeshTestTrust.LocalSessions);
+
+        Func<Task> connect = async () => await sessions.ConnectRealtimeAsync(
+            new CultMeshSessionTarget("aetheria", "aetheria.daemon"));
+
+        var error = await connect.Should().ThrowAsync<CultMeshSessionException>();
+        error.Which.Failure.Reason.Should().Be(CultMeshSessionFailureReason.Authority);
+    }
+
+    private sealed class RouteSource : ICultMeshLookupSource
+    {
+        private readonly string[] _endpoints;
+
+        public RouteSource(params string[] endpoints) => _endpoints = endpoints;
+        public string SourceId => "transport-modularity-test";
+
+        public Task<IReadOnlyList<CultMeshDiscoveryObservation>> LookupAsync(
+            CultMeshDiscoveryQuery query,
+            CancellationToken cancellationToken = default)
+        {
+            var now = DateTimeOffset.UtcNow;
+            return Task.FromResult<IReadOnlyList<CultMeshDiscoveryObservation>>(new[]
+            {
+                new CultMeshDiscoveryObservation(
+                    new CultMeshVerseDescriptor(
+                        "aetheria",
+                        "Aetheria",
+                        CultMeshVerseAuthorityModel.OperatorCluster,
+                        new CultMeshVerseCompatibility("cultmesh.v1", "rules"),
+                        authorityRoutes: _endpoints.Select(endpoint => new CultMeshAuthorityRoute(
+                            "aetheria.daemon",
+                            endpoint,
+                            protocolIds: null,
+                            generation: RouteGeneration))),
+                    SourceId,
+                    now,
+                    now.AddMinutes(1),
+                    CultMeshDiscoveryTrust.Signed)
+            });
+        }
+    }
+
+    private sealed class RejectingLegacySchemaConnector : ICultMeshTransportConnector
+    {
+        private int _connectCount;
+        public string ConnectorId => "test-legacy-schema";
+        public int Priority => 10_000;
+        public int ConnectCount => Volatile.Read(ref _connectCount);
+        public bool CanConnect(CultMeshTransportCandidate candidate) =>
+            candidate.Endpoint.StartsWith("rudp://", StringComparison.OrdinalIgnoreCase);
+        public Task<ICultNetSchemaClient> ConnectAsync(
+            CultMeshTransportCandidate candidate,
+            CultMeshProtocolId protocol,
+            CancellationToken cancellationToken = default)
+        {
+            Interlocked.Increment(ref _connectCount);
+            throw new InvalidOperationException("Legacy schema connector should not be touched.");
+        }
+    }
+
+    private sealed class RejectingLegacyContentConnector : ICultMeshContentTransportConnector
+    {
+        private int _connectCount;
+        public string ConnectorId => "test-legacy-content";
+        public int Priority => 10_000;
+        public int ConnectCount => Volatile.Read(ref _connectCount);
+        public bool CanConnect(CultMeshTransportCandidate candidate) =>
+            candidate.Endpoint.StartsWith("rudp://", StringComparison.OrdinalIgnoreCase);
+        public Task<ICultMeshContentTransport> ConnectAsync(
+            CultMeshTransportCandidate candidate,
+            CultMeshSessionTarget target,
+            CancellationToken cancellationToken = default)
+        {
+            Interlocked.Increment(ref _connectCount);
+            throw new InvalidOperationException("Legacy content connector should not be touched.");
+        }
+    }
+
+    private sealed class LoopbackRealtimeConnector : ICultMeshRealtimeTransportConnector
+    {
+        private int _connectCount;
+        public string ConnectorId => "test-quic-state";
+        public int Priority => 0;
+        public int ConnectCount => Volatile.Read(ref _connectCount);
+        public bool CanConnect(CultMeshTransportCandidate candidate) =>
+            candidate.Endpoint.StartsWith("cultmesh-state+quic://", StringComparison.OrdinalIgnoreCase);
+        public Task<ICultMeshRealtimeTransport> ConnectAsync(
+            CultMeshTransportCandidate candidate,
+            CultMeshSessionTarget target,
+            CancellationToken cancellationToken = default)
+        {
+            Interlocked.Increment(ref _connectCount);
+            return Task.FromResult<ICultMeshRealtimeTransport>(
+                new LoopbackRealtimeTransport(candidate.Endpoint, target, candidate.Generation));
+        }
+    }
+
+    private sealed class UnverifiedRealtimeConnector : ICultMeshRealtimeTransportConnector
+    {
+        public string ConnectorId => "unverified-realtime";
+        public int Priority => 0;
+        public bool CanConnect(CultMeshTransportCandidate candidate) => true;
+        public Task<ICultMeshRealtimeTransport> ConnectAsync(
+            CultMeshTransportCandidate candidate,
+            CultMeshSessionTarget target,
+            CancellationToken cancellationToken = default) =>
+            Task.FromResult<ICultMeshRealtimeTransport>(new UnverifiedRealtimeTransport(candidate.Endpoint));
+    }
+
+    private sealed class UnverifiedRealtimeTransport : ICultMeshRealtimeTransport
+    {
+        public UnverifiedRealtimeTransport(string endpoint) => Endpoint = endpoint;
+        public string TransportId => "unverified-realtime";
+        public string Endpoint { get; }
+        public Task SendAsync(CultMeshRealtimeFrame frame, CancellationToken cancellationToken = default) =>
+            Task.CompletedTask;
+        public Task<CultMeshRealtimeFrame> ReceiveAsync(CancellationToken cancellationToken = default) =>
+            Task.FromException<CultMeshRealtimeFrame>(new InvalidOperationException());
+        public void Dispose() { }
+    }
+
+    private sealed class LoopbackRealtimeTransport : ICultMeshRealtimeTransport, ICultMeshVerifiedTransport
+    {
+        private readonly Queue<CultMeshRealtimeFrame> _frames = new();
+        private readonly SemaphoreSlim _available = new(0);
+        private bool _disposed;
+
+        private readonly CultMeshSessionTarget _target;
+        private readonly string _routeGeneration;
+
+        public LoopbackRealtimeTransport(
+            string endpoint,
+            CultMeshSessionTarget target,
+            string routeGeneration)
+        {
+            Endpoint = endpoint;
+            _target = target;
+            _routeGeneration = routeGeneration;
+        }
+        public string TransportId => "test-quic-state";
+        public string Endpoint { get; }
+
+        public bool IsVerifiedFor(
+            string verseId,
+            string authorityRuntimeId,
+            string protocolId,
+            string routeGeneration) =>
+            string.Equals(_target.VerseId, verseId, StringComparison.Ordinal) &&
+            string.Equals(_target.AuthorityRuntimeId, authorityRuntimeId, StringComparison.Ordinal) &&
+            string.Equals(CultMeshProtocols.RealtimeState.Value, protocolId, StringComparison.Ordinal) &&
+            string.Equals(_routeGeneration, routeGeneration, StringComparison.Ordinal);
+
+        public Task SendAsync(CultMeshRealtimeFrame frame, CancellationToken cancellationToken = default)
+        {
+            if (_disposed) throw new ObjectDisposedException(nameof(LoopbackRealtimeTransport));
+            lock (_frames) _frames.Enqueue(frame);
+            _available.Release();
+            return Task.CompletedTask;
+        }
+
+        public async Task<CultMeshRealtimeFrame> ReceiveAsync(CancellationToken cancellationToken = default)
+        {
+            await _available.WaitAsync(cancellationToken);
+            lock (_frames) return _frames.Dequeue();
+        }
+
+        public void Dispose()
+        {
+            _disposed = true;
+            _available.Dispose();
+        }
+    }
+}
diff --git a/tests/GameCult.Mesh.Tests/GameCult.Mesh.Tests.csproj b/tests/GameCult.Mesh.Tests/GameCult.Mesh.Tests.csproj
index 14e99d63..292e42df 100644
--- a/tests/GameCult.Mesh.Tests/GameCult.Mesh.Tests.csproj
+++ b/tests/GameCult.Mesh.Tests/GameCult.Mesh.Tests.csproj
@@ -15,7 +15,7 @@
       <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
       <PrivateAssets>all</PrivateAssets>
     </PackageReference>
-    <PackageReference Include="NUnit" Version="4.*" />
+    <PackageReference Include="NUnit" Version="4.6.1" />
     <PackageReference Include="NUnit3TestAdapter" Version="6.2.0" />
     <PackageReference Include="Microsoft.NET.Test.Sdk" Version="18.4.0" />
     <PackageReference Include="FluentAssertions" Version="8.9.0" />
diff --git a/tests/GameCult.Networking.InteropPeer/GameCult.Networking.InteropPeer.csproj b/tests/GameCult.Networking.InteropPeer/GameCult.Networking.InteropPeer.csproj
index 04736cd4..2a782a72 100644
--- a/tests/GameCult.Networking.InteropPeer/GameCult.Networking.InteropPeer.csproj
+++ b/tests/GameCult.Networking.InteropPeer/GameCult.Networking.InteropPeer.csproj
@@ -8,9 +8,6 @@
 
   <ItemGroup>
     <ProjectReference Include="..\..\src\GameCult.Networking\GameCult.Networking.csproj" />
-    <ProjectReference Include="..\..\src\GameCult.Caching.MessagePack.Generator\GameCult.Caching.MessagePack.Generator.csproj"
-                      OutputItemType="Analyzer"
-                      ReferenceOutputAssembly="false" />
     <PackageReference Include="MessagePack" Version="3.1.7" />
   </ItemGroup>
 </Project>
diff --git a/tests/GameCult.Networking.InteropPeer/Program.cs b/tests/GameCult.Networking.InteropPeer/Program.cs
index 953ee097..d4c8fab7 100644
--- a/tests/GameCult.Networking.InteropPeer/Program.cs
+++ b/tests/GameCult.Networking.InteropPeer/Program.cs
@@ -1490,6 +1490,7 @@ static class InteropPeerShared
 }
 
 [CultDocument(InteropPeerShared.InteropDocumentType, InteropPeerShared.InteropSchemaVersion)]
+[MessagePackObject]
 public sealed class CultNetInteropNote
 {
     [Key(0)] public string SchemaVersion { get; set; } = InteropPeerShared.InteropSchemaVersion;
diff --git a/tests/GameCult.Networking.Tests/CultNetDocumentBindingResolverTests.cs b/tests/GameCult.Networking.Tests/CultNetDocumentBindingResolverTests.cs
new file mode 100644
index 00000000..72af09c9
--- /dev/null
+++ b/tests/GameCult.Networking.Tests/CultNetDocumentBindingResolverTests.cs
@@ -0,0 +1,68 @@
+using GameCult.Caching;
+using GameCult.Caching.MessagePack;
+using GameCult.Networking;
+using MessagePack;
+using MessagePack.Formatters;
+using NUnit.Framework;
+
+[assembly: CultCacheFormatterResolver(typeof(GameCult.Networking.Tests.BindingPairResolver))]
+
+namespace GameCult.Networking.Tests
+{
+    public class CultNetDocumentBindingResolverTests
+    {
+        [Test]
+        public void TypedBindingUsesTheDocumentAssemblyResolver()
+        {
+            var registry = CultDocumentRegistry.ForTypes(new[] { typeof(BindingPairDocument) });
+            var binding = CultNetDocumentBinding.ForDocument<BindingPairDocument>(registry);
+
+            var payload = binding.PayloadSerializer(new BindingPairDocument { Name = "p", Value = new BindingPair { A = 1.5f, B = -2f } });
+            var decoded = (BindingPairDocument)binding.PayloadDeserializer(payload);
+
+            Assert.That(decoded.Name, Is.EqualTo("p"));
+            Assert.That(decoded.Value.A, Is.EqualTo(1.5f));
+            Assert.That(decoded.Value.B, Is.EqualTo(-2f));
+        }
+    }
+
+    public struct BindingPair
+    {
+        public float A;
+        public float B;
+    }
+
+    [CultDocument("tests.binding_pair", "tests.binding_pair.v1")]
+    [MessagePackObject]
+    public sealed class BindingPairDocument
+    {
+        [Key(0)] [CultName] public string Name = string.Empty;
+        [Key(1)] public BindingPair Value;
+    }
+
+    public sealed class BindingPairResolver : IFormatterResolver
+    {
+        public static readonly IFormatterResolver Instance = new BindingPairResolver();
+
+        public IMessagePackFormatter<T>? GetFormatter<T>() =>
+            typeof(T) == typeof(BindingPair) ? (IMessagePackFormatter<T>)(object)PairFormatter.Instance : null;
+
+        private sealed class PairFormatter : IMessagePackFormatter<BindingPair>
+        {
+            public static readonly PairFormatter Instance = new();
+
+            public void Serialize(ref MessagePackWriter writer, BindingPair value, MessagePackSerializerOptions options)
+            {
+                writer.WriteArrayHeader(2);
+                writer.Write(value.A);
+                writer.Write(value.B);
+            }
+
+            public BindingPair Deserialize(ref MessagePackReader reader, MessagePackSerializerOptions options)
+            {
+                reader.ReadArrayHeader();
+                return new BindingPair { A = reader.ReadSingle(), B = reader.ReadSingle() };
+            }
+        }
+    }
+}
diff --git a/tests/GameCult.Networking.Tests/CultNetOperationServerTests.cs b/tests/GameCult.Networking.Tests/CultNetOperationServerTests.cs
new file mode 100644
index 00000000..ca36a2f4
--- /dev/null
+++ b/tests/GameCult.Networking.Tests/CultNetOperationServerTests.cs
@@ -0,0 +1,241 @@
+#nullable enable
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Threading.Tasks;
+using MessagePack;
+using NUnit.Framework;
+
+namespace GameCult.Networking.Tests
+{
+    [TestFixture]
+    public sealed class CultNetOperationServerTests
+    {
+        [Test]
+        public async Task DispatchesTypedRequestAndCorrelatedReplyWithoutEnvelopePlumbing()
+        {
+            var transport = new FakeServer();
+            var peer = new FakePeer();
+            CultNetOperationContext<AddRequest>? observed = null;
+            using var operations = new CultNetOperationServer(transport, "sample.provider")
+                .Register<AddRequest, AddReceipt>(
+                    "sample.counter",
+                    "sample.counter.add",
+                    "sample.add.v1",
+                    "sample.add_receipt.v1",
+                    context =>
+                    {
+                        observed = context;
+                        return Task.FromResult(new AddReceipt { Count = context.Value.Amount + 4 });
+                    });
+
+            await transport.DispatchAsync(Request(new AddRequest { Amount = 3 }), peer);
+
+            var response = peer.Messages.OfType<CultNetOperationResponseMessage>().Single();
+            var receipt = MessagePackSerializer.Deserialize<AddReceipt>(
+                Convert.FromBase64String(response.Payload),
+                CultNetSchemaMessageSerialization.Options);
+            Assert.Multiple(() =>
+            {
+                Assert.That(observed!.Value.Amount, Is.EqualTo(3));
+                Assert.That(observed.IdempotencyKey, Is.EqualTo("command-7"));
+                Assert.That(observed.SourceRuntimeId, Is.EqualTo("sample.browser"));
+                Assert.That(response.MessageId, Is.EqualTo("command-7"));
+                Assert.That(response.ServiceId, Is.EqualTo("sample.counter"));
+                Assert.That(response.Operation, Is.EqualTo("sample.counter.add"));
+                Assert.That(response.Status, Is.EqualTo("accepted"));
+                Assert.That(response.PayloadSchema, Is.EqualTo("sample.add_receipt.v1"));
+                Assert.That(response.SourceRuntimeId, Is.EqualTo("sample.provider"));
+                Assert.That(receipt.Count, Is.EqualTo(7));
+            });
+        }
+
+        [Test]
+        public async Task PreservesTypedRejectionAndDiagnostics()
+        {
+            var transport = new FakeServer();
+            var peer = new FakePeer();
+            using var operations = new CultNetOperationServer(transport)
+                .Register<AddRequest, AddReceipt>(
+                    "sample.counter",
+                    "sample.counter.add",
+                    "sample.add.v1",
+                    "sample.add_receipt.v1",
+                    _ => Task.FromResult(CultNetOperationReply<AddReceipt>.Rejected(
+                        new AddReceipt { Count = 4 },
+                        "counter is locked")));
+
+            await transport.DispatchAsync(Request(new AddRequest { Amount = 3 }), peer);
+
+            var response = peer.Messages.OfType<CultNetOperationResponseMessage>().Single();
+            Assert.That(response.Status, Is.EqualTo("rejected"));
+            Assert.That(response.Diagnostics, Is.EqualTo(new[] { "counter is locked" }));
+            Assert.That(
+                MessagePackSerializer.Deserialize<AddReceipt>(
+                    Convert.FromBase64String(response.Payload),
+                    CultNetSchemaMessageSerialization.Options).Count,
+                Is.EqualTo(4));
+        }
+
+        [Test]
+        public async Task RejectsRequestAddressedToAnotherRuntimeBeforeApplicationHandler()
+        {
+            var transport = new FakeServer();
+            var peer = new FakePeer();
+            var calls = 0;
+            using var operations = new CultNetOperationServer(transport, "sample.provider")
+                .Register<AddRequest, AddReceipt>(
+                    "sample.counter",
+                    "sample.counter.add",
+                    "sample.add.v1",
+                    "sample.add_receipt.v1",
+                    context =>
+                    {
+                        calls++;
+                        return Task.FromResult(new AddReceipt { Count = context.Value.Amount });
+                    });
+            var request = Request(new AddRequest { Amount = 3 });
+            request.TargetRuntimeId = "other.provider";
+
+            await transport.DispatchAsync(request, peer);
+
+            Assert.That(calls, Is.Zero);
+            var response = peer.Messages.OfType<CultNetOperationResponseMessage>().Single();
+            var failure = MessagePackSerializer.Deserialize<CultNetOperationFailure>(
+                Convert.FromBase64String(response.Payload),
+                CultNetSchemaMessageSerialization.Options);
+            Assert.Multiple(() =>
+            {
+                Assert.That(response.Status, Is.EqualTo("denied"));
+                Assert.That(failure.Code, Is.EqualTo("target-runtime-mismatch"));
+                Assert.That(response.SourceRuntimeId, Is.EqualTo("sample.provider"));
+            });
+        }
+
+        [Test]
+        public async Task RejectsWrongSchemaBeforeApplicationHandler()
+        {
+            var transport = new FakeServer();
+            var peer = new FakePeer();
+            var calls = 0;
+            using var operations = new CultNetOperationServer(transport)
+                .Register<AddRequest, AddReceipt>(
+                    "sample.counter",
+                    "sample.counter.add",
+                    "sample.add.v1",
+                    "sample.add_receipt.v1",
+                    context =>
+                    {
+                        calls++;
+                        return Task.FromResult(new AddReceipt { Count = context.Value.Amount });
+                    });
+            var request = Request(new AddRequest { Amount = 3 });
+            request.PayloadSchema = "wrong.v1";
+
+            await transport.DispatchAsync(request, peer);
+
+            Assert.That(calls, Is.Zero);
+            var response = peer.Messages.OfType<CultNetOperationResponseMessage>().Single();
+            var failure = MessagePackSerializer.Deserialize<CultNetOperationFailure>(
+                Convert.FromBase64String(response.Payload),
+                CultNetSchemaMessageSerialization.Options);
+            Assert.Multiple(() =>
+            {
+                Assert.That(response.MessageId, Is.EqualTo("command-7"));
+                Assert.That(response.Status, Is.EqualTo("invalid"));
+                Assert.That(response.PayloadSchema, Is.EqualTo(CultNetOperationServer.FailureSchemaId));
+                Assert.That(failure.Code, Is.EqualTo("request-schema-mismatch"));
+                Assert.That(failure.Message, Does.Contain("expected payload schema 'sample.add.v1'"));
+            });
+        }
+
+        [Test]
+        public void RejectsDuplicateRouteAndDetachesOnDispose()
+        {
+            var transport = new FakeServer();
+            var operations = new CultNetOperationServer(transport);
+            operations.Register<AddRequest, AddReceipt>(
+                "sample.counter",
+                "sample.counter.add",
+                "sample.add.v1",
+                "sample.add_receipt.v1",
+                context => Task.FromResult(new AddReceipt { Count = context.Value.Amount }));
+
+            Assert.That(() => operations.Register<AddRequest, AddReceipt>(
+                    "sample.counter",
+                    "sample.counter.add",
+                    "sample.add.v1",
+                    "sample.add_receipt.v1",
+                    context => Task.FromResult(new AddReceipt { Count = context.Value.Amount })),
+                Throws.InvalidOperationException);
+            Assert.That(transport.HasHandler<CultNetOperationRequestMessage>(), Is.True);
+
+            operations.Dispose();
+
+            Assert.That(transport.HasHandler<CultNetOperationRequestMessage>(), Is.False);
+            Assert.That(() => operations.Register<AddRequest, AddReceipt>(
+                    "sample.counter",
+                    "sample.counter.add",
+                    "sample.add.v1",
+                    "sample.add_receipt.v1",
+                    context => Task.FromResult(new AddReceipt { Count = context.Value.Amount })),
+                Throws.TypeOf<ObjectDisposedException>());
+        }
+
+        private static CultNetOperationRequestMessage Request(AddRequest value) => new()
+        {
+            MessageId = "command-7",
+            ServiceId = "sample.counter",
+            Operation = "sample.counter.add",
+            PayloadSchema = "sample.add.v1",
+            PayloadEncoding = "messagepack-base64",
+            Payload = Convert.ToBase64String(MessagePackSerializer.Serialize(
+                value,
+                CultNetSchemaMessageSerialization.Options)),
+            SourceRuntimeId = "sample.browser",
+            TargetRuntimeId = "sample.provider"
+        };
+
+        [MessagePackObject]
+        public sealed class AddRequest
+        {
+            [Key(0)] public int Amount { get; set; }
+        }
+
+        [MessagePackObject]
+        public sealed class AddReceipt
+        {
+            [Key(0)] public int Count { get; set; }
+        }
+
+        private sealed class FakeServer : ICultNetSchemaServer
+        {
+            private readonly Dictionary<Type, Delegate> _handlers = new();
+
+            public void OnCultNet<TMessage>(Func<TMessage, ICultNetSchemaServerPeer, Task> callback)
+                where TMessage : ICultNetSchemaMessage => _handlers[typeof(TMessage)] = callback;
+
+            public void RemoveCultNetMessageListener<TMessage>(Delegate callback)
+                where TMessage : ICultNetSchemaMessage
+            {
+                if (_handlers.TryGetValue(typeof(TMessage), out var current) && current == callback)
+                    _handlers.Remove(typeof(TMessage));
+            }
+
+            public bool HasHandler<TMessage>() where TMessage : ICultNetSchemaMessage =>
+                _handlers.ContainsKey(typeof(TMessage));
+
+            public Task DispatchAsync<TMessage>(TMessage message, ICultNetSchemaServerPeer peer)
+                where TMessage : ICultNetSchemaMessage =>
+                ((Func<TMessage, ICultNetSchemaServerPeer, Task>)_handlers[typeof(TMessage)])(message, peer);
+        }
+
+        private sealed class FakePeer : ICultNetSchemaServerPeer
+        {
+            public List<ICultNetSchemaMessage> Messages { get; } = new();
+
+            public void SendCultNet<TMessage>(TMessage message) where TMessage : ICultNetSchemaMessage =>
+                Messages.Add(message);
+        }
+    }
+}
diff --git a/tests/GameCult.Networking.Tests/CultNetSchemaServerGroupTests.cs b/tests/GameCult.Networking.Tests/CultNetSchemaServerGroupTests.cs
new file mode 100644
index 00000000..79e7e14f
--- /dev/null
+++ b/tests/GameCult.Networking.Tests/CultNetSchemaServerGroupTests.cs
@@ -0,0 +1,101 @@
+#nullable enable
+using System;
+using System.Collections.Generic;
+using System.Threading.Tasks;
+using NUnit.Framework;
+
+namespace GameCult.Networking.Tests
+{
+    [TestFixture]
+    public sealed class CultNetSchemaServerGroupTests
+    {
+        [Test]
+        public async Task RegistersAndRemovesTheSameLogicalHandlerAcrossTransports()
+        {
+            var tcp = new FakeServer();
+            var webSocket = new FakeServer();
+            using var group = new CultNetSchemaServerGroup(tcp, webSocket);
+            var received = new List<string>();
+            Func<CultNetHelloMessage, ICultNetSchemaServerPeer, Task> handler = (message, _) =>
+            {
+                received.Add(message.RuntimeId);
+                return Task.CompletedTask;
+            };
+
+            group.OnCultNet(handler);
+            await tcp.DispatchAsync(new CultNetHelloMessage { RuntimeId = "tcp" });
+            await webSocket.DispatchAsync(new CultNetHelloMessage { RuntimeId = "websocket" });
+            group.RemoveCultNetMessageListener<CultNetHelloMessage>(handler);
+
+            Assert.That(received, Is.EqualTo(new[] { "tcp", "websocket" }));
+            Assert.That(tcp.HasHandler<CultNetHelloMessage>(), Is.False);
+            Assert.That(webSocket.HasHandler<CultNetHelloMessage>(), Is.False);
+        }
+
+        [Test]
+        public void AggregatesPeerLifetimeWithoutTakingTransportOwnership()
+        {
+            var tcp = new FakeServer();
+            var webSocket = new FakeServer();
+            var group = new CultNetSchemaServerGroup(tcp, webSocket);
+            var peer = new FakePeer();
+            var disconnected = new List<ICultNetSchemaServerPeer>();
+            group.PeerDisconnected += disconnected.Add;
+
+            tcp.Disconnect(peer);
+            webSocket.Disconnect(peer);
+            group.Dispose();
+            tcp.Disconnect(peer);
+
+            Assert.That(disconnected, Is.EqualTo(new[] { peer, peer }));
+            Assert.That(tcp.Disposed, Is.False);
+            Assert.That(webSocket.Disposed, Is.False);
+        }
+
+        [Test]
+        public void RejectsAGroupThatDoesNotActuallyAddASecondTransport()
+        {
+            var server = new FakeServer();
+            Assert.Multiple(() =>
+            {
+                Assert.That(() => new CultNetSchemaServerGroup(server), Throws.ArgumentException);
+                Assert.That(() => new CultNetSchemaServerGroup(server, server), Throws.ArgumentException);
+            });
+        }
+
+        private sealed class FakeServer :
+            ICultNetSchemaServer,
+            ICultNetSchemaServerPeerLifecycle
+        {
+            private readonly Dictionary<Type, Delegate> _handlers = new();
+            public bool Disposed { get; private set; }
+            public event Action<ICultNetSchemaServerPeer>? PeerDisconnected;
+
+            public void OnCultNet<TMessage>(Func<TMessage, ICultNetSchemaServerPeer, Task> callback)
+                where TMessage : ICultNetSchemaMessage =>
+                _handlers[typeof(TMessage)] = callback;
+
+            public void RemoveCultNetMessageListener<TMessage>(Delegate callback)
+                where TMessage : ICultNetSchemaMessage
+            {
+                if (_handlers.TryGetValue(typeof(TMessage), out var current) && current == callback)
+                    _handlers.Remove(typeof(TMessage));
+            }
+
+            public bool HasHandler<TMessage>() where TMessage : ICultNetSchemaMessage =>
+                _handlers.ContainsKey(typeof(TMessage));
+
+            public Task DispatchAsync<TMessage>(TMessage message) where TMessage : ICultNetSchemaMessage =>
+                ((Func<TMessage, ICultNetSchemaServerPeer, Task>)_handlers[typeof(TMessage)])(message, new FakePeer());
+
+            public void Disconnect(ICultNetSchemaServerPeer peer) => PeerDisconnected?.Invoke(peer);
+        }
+
+        private sealed class FakePeer : ICultNetSchemaServerPeer
+        {
+            public void SendCultNet<TMessage>(TMessage message) where TMessage : ICultNetSchemaMessage
+            {
+            }
+        }
+    }
+}
diff --git a/tests/GameCult.Networking.Tests/NetworkingTests.cs b/tests/GameCult.Networking.Tests/NetworkingTests.cs
index 6564ee24..756e55a3 100644
--- a/tests/GameCult.Networking.Tests/NetworkingTests.cs
+++ b/tests/GameCult.Networking.Tests/NetworkingTests.cs
@@ -1,5 +1,6 @@
 #nullable enable
 using System;
+using System.Collections.Concurrent;
 using System.Collections.Generic;
 using System.IO;
 using System.Linq;
@@ -431,6 +432,27 @@ namespace GameCult.Networking.Tests
                 Is.EqualTo(new int?[] { 64, 64, 64 }));
         }
 
+        [Test]
+        public void CultNetSchemaMessageSerialization_RoundTrips_OperationEnvelope()
+        {
+            var request = new CultNetOperationRequestMessage
+            {
+                MessageId = "plugin-42",
+                ServiceId = "sai.vn",
+                Operation = "project",
+                PayloadSchema = "gamecult.eve.plugin_abi.request.v1",
+                Payload = "gaZzY2hlbWHEJ2dhbWVjdWx0LmV2ZS5wbHVnaW5fYWJpLnJlcXVlc3QudjE=",
+                SourceRuntimeId = "eve-unity"
+            };
+
+            var payload = CultNetSchemaMessageSerialization.Serialize(request);
+            var roundTrip = (CultNetOperationRequestMessage)CultNetSchemaMessageSerialization.Deserialize(payload);
+
+            Assert.That(roundTrip.MessageId, Is.EqualTo(request.MessageId));
+            Assert.That(roundTrip.ServiceId, Is.EqualTo("sai.vn"));
+            Assert.That(roundTrip.PayloadSchema, Is.EqualTo("gamecult.eve.plugin_abi.request.v1"));
+        }
+
         [Test]
         public void LiteNetLibTransportProfile_AdvertisesLegacyAndSchemaChannels()
         {
@@ -682,9 +704,15 @@ namespace GameCult.Networking.Tests
             Assert.That(client.PendingReliableSequences, Is.Empty);
 
             var ack = client.CreateAck();
+            Assert.That(ack.Sequence, Is.Zero);
             Assert.That(ack.Ack, Is.EqualTo(100));
             server.Receive(ack, 30);
             Assert.That(server.PendingReliableSequences, Is.Empty);
+            var firstData = client.Send(
+                "schema",
+                Encoding.UTF8.GetBytes("after-ack"),
+                new CultNetRudpSendOptions { Reliable = true, Ordered = true });
+            Assert.That(firstData.Sequence, Is.EqualTo(2));
         }
 
         [Test]
@@ -746,6 +774,102 @@ namespace GameCult.Networking.Tests
             Assert.That(session.DueResends(250), Is.Empty);
         }
 
+        [Test]
+        public void RudpSession_ExplicitlyAcknowledgesRetransmitsOlderThanTheReceiveMask()
+        {
+            var sender = new CultNetRudpSession(new CultNetRudpSessionOptions
+            {
+                ConnectionId = 991,
+                InitialSequence = 1,
+                ResendDelayMs = 10
+            });
+            var receiver = new CultNetRudpSession(new CultNetRudpSessionOptions
+            {
+                ConnectionId = 991,
+                InitialSequence = 500
+            });
+            sender.Receive(new CultNetRudpPacket
+                { PacketType = CultNetRudpPacketType.Accept, ConnectionId = 991, Sequence = 400, ChannelId = "control" });
+            receiver.Receive(new CultNetRudpPacket
+                { PacketType = CultNetRudpPacketType.Accept, ConnectionId = 991, Sequence = 0, ChannelId = "control" });
+
+            var oldPacket = sender.Send(
+                "snapshot",
+                new byte[] { 1 },
+                new CultNetRudpSendOptions { Reliable = true, Ordered = true, NowMs = 0 });
+            receiver.Receive(oldPacket);
+            foreach (var sequence in Enumerable.Range(2, 40).Select(value => (uint)value))
+            {
+                receiver.Receive(new CultNetRudpPacket
+                {
+                    PacketType = CultNetRudpPacketType.Data,
+                    ConnectionId = 991,
+                    Sequence = sequence,
+                    ChannelId = "activity",
+                    Reliable = true,
+                    Ordered = false,
+                    Payload = new[] { (byte)sequence }
+                });
+            }
+
+            sender.Receive(receiver.CreateAck());
+            Assert.That(sender.PendingReliableSequences.First(), Is.EqualTo(1u));
+
+            var oldRetransmit = sender.DueResends(10).Single(packet => packet.Sequence == 1);
+            receiver.Receive(oldRetransmit);
+            var exactAck = receiver.CreateAckForReceived(oldRetransmit.Sequence);
+            Assert.That(exactAck.Ack, Is.EqualTo(oldRetransmit.Sequence));
+            Assert.That(exactAck.AckMask, Is.Zero);
+            sender.Receive(exactAck);
+
+            Assert.That(sender.PendingReliableSequences, Does.Not.Contain(1u));
+        }
+
+        [Test]
+        public async Task RudpSession_ResendsAndAcknowledgementsCanRunConcurrently()
+        {
+            var session = new CultNetRudpSession(new CultNetRudpSessionOptions
+            {
+                ConnectionId = 100,
+                InitialSequence = 1,
+                ResendDelayMs = 1
+            });
+            session.Receive(new CultNetRudpPacket
+            {
+                PacketType = CultNetRudpPacketType.Accept,
+                ConnectionId = 100,
+                Sequence = 5000,
+                ChannelId = "control"
+            });
+            var packets = Enumerable.Range(0, CultNetRudpSession.ReliableSendWindowPackets)
+                .Select(index => session.Send("schema", Encoding.UTF8.GetBytes(index.ToString()),
+                    new CultNetRudpSendOptions { Reliable = true, Ordered = true, NowMs = 0 }))
+                .ToArray();
+
+            await Task.WhenAll(
+                Task.Run(() =>
+                {
+                    for (var now = 1; now <= 1000; now++)
+                        _ = session.DueResends(now);
+                }),
+                Task.Run(() =>
+                {
+                    foreach (var packet in packets)
+                    {
+                        session.Receive(new CultNetRudpPacket
+                        {
+                            PacketType = CultNetRudpPacketType.Ack,
+                            ConnectionId = 100,
+                            Sequence = 5001,
+                            Ack = packet.Sequence,
+                            ChannelId = "control"
+                        });
+                    }
+                }));
+
+            Assert.That(session.PendingReliableSequences, Is.Empty);
+        }
+
         [Test]
         public void RudpSession_PingsAndDetectsReceiveTimeout()
         {
@@ -776,6 +900,75 @@ namespace GameCult.Networking.Tests
             Assert.That(client.Connected, Is.False);
         }
 
+        [Test]
+        public void RudpSession_LossyPacketsCannotCreateReliableOrderedGaps()
+        {
+            var client = new CultNetRudpSession(new CultNetRudpSessionOptions { ConnectionId = 198, InitialSequence = 1 });
+            var server = new CultNetRudpSession(new CultNetRudpSessionOptions { ConnectionId = 198, InitialSequence = 100 });
+            var connect = client.CreateConnect(0);
+            var accept = server.AcceptConnect(connect, 1);
+            client.Receive(accept, 2);
+
+            var ping = client.CreatePing(Encoding.UTF8.GetBytes("pulse"));
+            var pong = server.Receive(ping, 3).Reply!;
+            var realtime = server.Send("realtime", Encoding.UTF8.GetBytes("discarded realtime"));
+            var latest = server.Send(
+                "latest",
+                Encoding.UTF8.GetBytes("discarded latest state"),
+                new CultNetRudpSendOptions { Sequenced = true });
+            var schema = server.Send(
+                "schema",
+                Encoding.UTF8.GetBytes("committed response"),
+                new CultNetRudpSendOptions { Reliable = true, Ordered = true });
+
+            Assert.That(ping.Sequence, Is.Zero);
+            Assert.That(pong.Sequence, Is.Zero);
+            Assert.That(realtime.Sequence, Is.Zero);
+            Assert.That(latest.Sequence, Is.EqualTo(1));
+            Assert.That(schema.Sequence, Is.EqualTo(accept.Sequence + 1));
+            Assert.That(
+                client.Receive(schema, 4).Delivered.Select(frame => Encoding.UTF8.GetString(frame.Payload)).ToArray(),
+                Is.EqualTo(new[] { "committed response" }));
+        }
+
+        [Test]
+        public void RudpSession_UnreliableSequencedDeliveryIsScopedToItsChannel()
+        {
+            var sender = new CultNetRudpSession(new CultNetRudpSessionOptions { ConnectionId = 197, InitialSequence = 50 });
+            var receiver = new CultNetRudpSession(new CultNetRudpSessionOptions { ConnectionId = 197, InitialSequence = 100 });
+            var connect = sender.CreateConnect(0);
+            var accept = receiver.AcceptConnect(connect, 1);
+            sender.Receive(accept, 2);
+            var older = sender.Send("latest", Encoding.UTF8.GetBytes("older"), new CultNetRudpSendOptions { Sequenced = true });
+            var newer = sender.Send("latest", Encoding.UTF8.GetBytes("newer"), new CultNetRudpSendOptions { Sequenced = true });
+
+            Assert.That(older.Sequence, Is.EqualTo(1));
+            Assert.That(newer.Sequence, Is.EqualTo(2));
+            Assert.That(
+                receiver.Receive(newer, 3).Delivered.Select(frame => Encoding.UTF8.GetString(frame.Payload)).ToArray(),
+                Is.EqualTo(new[] { "newer" }));
+            Assert.That(receiver.Receive(older, 4).Delivered, Is.Empty);
+        }
+
+        [Test]
+        public void RudpSession_RejectsUnreliableOrderedDelivery()
+        {
+            var session = new CultNetRudpSession(new CultNetRudpSessionOptions { ConnectionId = 196 });
+            session.Receive(new CultNetRudpPacket
+            {
+                PacketType = CultNetRudpPacketType.Accept,
+                ConnectionId = 196,
+                Sequence = 50,
+                ChannelId = "control"
+            });
+            var error = Assert.Throws<InvalidOperationException>(() =>
+                session.Send(
+                    "schema",
+                    Encoding.UTF8.GetBytes("cannot order what will not retransmit"),
+                    new CultNetRudpSendOptions { Ordered = true }));
+            Assert.That(error!.Message, Does.Contain("ordered delivery requires reliability"));
+        }
+
         [Test]
         public void RudpSession_BoundsPendingReliablePacketsBeforeEnqueue()
         {
@@ -907,6 +1100,52 @@ namespace GameCult.Networking.Tests
             Assert.That(delivered[0].Sequence, Is.EqualTo(packets[0].Sequence));
         }
 
+        [Test]
+        public void RudpSession_AdvancesLargeFragmentSetsThroughBoundedReliableWindow()
+        {
+            const uint connectionId = 457;
+            var sender = new CultNetRudpSession(new CultNetRudpSessionOptions
+            {
+                ConnectionId = connectionId,
+                InitialSequence = 1,
+                ResendDelayMs = 25
+            });
+            var receiver = new CultNetRudpSession(new CultNetRudpSessionOptions
+            {
+                ConnectionId = connectionId,
+                InitialSequence = 100,
+                ResendDelayMs = 25
+            });
+            sender.Receive(new CultNetRudpPacket { PacketType = CultNetRudpPacketType.Accept, ConnectionId = connectionId, Sequence = 0, ChannelId = "control" });
+            receiver.Receive(new CultNetRudpPacket { PacketType = CultNetRudpPacketType.Accept, ConnectionId = connectionId, Sequence = 0, ChannelId = "control" });
+
+            var fragmentCount = CultNetRudpSession.ReliableSendWindowPackets + 17;
+            var payload = Enumerable.Range(0, fragmentCount * 8).Select(index => (byte)(index % 251)).ToArray();
+            var wire = new Queue<CultNetRudpPacket>(sender.SendMany(
+                "schema",
+                payload,
+                new CultNetRudpSendOptions { Reliable = true, Ordered = true, NowMs = 1 },
+                maxFragmentBytes: 8));
+            Assert.That(wire, Has.Count.EqualTo(CultNetRudpSession.ReliableSendWindowPackets));
+            Assert.That(sender.PendingReliableSequences, Has.Count.EqualTo(wire.Count));
+            Assert.That(sender.QueuedReliablePacketCount, Is.EqualTo(17));
+
+            var delivered = new List<CultNetRudpDeliveredFrame>();
+            while (wire.Count > 0)
+            {
+                var admitted = wire.Count;
+                for (var index = 0; index < admitted; index++)
+                    delivered.AddRange(receiver.Receive(wire.Dequeue(), 2).Delivered);
+                var acknowledged = sender.Receive(receiver.CreateAck(), 3);
+                foreach (var ready in acknowledged.ReadyToSend)
+                    wire.Enqueue(ready);
+            }
+
+            Assert.That(sender.OutstandingReliablePacketCount, Is.Zero);
+            Assert.That(delivered, Has.Count.EqualTo(1));
+            Assert.That(delivered[0].Payload, Is.EqualTo(payload));
+        }
+
         [Test]
         public void RudpSocketTransport_HandshakesAndCarriesReliableOrderedSchemaFrames()
         {
@@ -951,6 +1190,7 @@ namespace GameCult.Networking.Tests
             Assert.That(server.Profile.Transports[0].Protocol, Is.EqualTo("rudp"));
             Assert.That(client.Stats.FramesSent, Is.EqualTo(1));
             Assert.That(server.Stats.FramesReceived, Is.EqualTo(1));
+
         }
 
         [Test]
@@ -1128,6 +1368,7 @@ namespace GameCult.Networking.Tests
                 MaxFragmentBytes = 1024
             });
             var serverDone = new TaskCompletionSource(TaskCreationOptions.RunContinuationsAsynchronously);
+            var controlProgressObserved = 0;
             server.OnCultNet<CultNetSchemaCatalogRequestMessage>((request, peer) =>
             {
                 peer.SendCultNet(new CultNetSchemaCatalogResponseMessage
@@ -1153,8 +1394,11 @@ namespace GameCult.Networking.Tests
                 {
                     while (!serverDone.Task.IsCompleted)
                     {
-                        _ = server.PollOnceAsync().GetAwaiter().GetResult();
-                        Thread.Sleep(5);
+                        var poll = server.PollAvailableAsync(64).GetAwaiter().GetResult();
+                        if (poll.TransportItemsConsumed > poll.MessagesDispatched)
+                            Interlocked.Exchange(ref controlProgressObserved, 1);
+                        if (poll.TransportItemsConsumed == 0)
+                            Thread.Sleep(5);
                     }
                 }
                 catch (Exception error)
@@ -1185,6 +1429,1079 @@ namespace GameCult.Networking.Tests
             Assert.That(response.MessageId, Is.EqualTo("rudp-schema-host-test"));
             Assert.That(response.Schemas.Single().SchemaId, Is.EqualTo("rudp.schema.host"));
             Assert.That(server.Profile.Transports[0].Protocol, Is.EqualTo("rudp"));
+            Assert.That(Volatile.Read(ref controlProgressObserved), Is.EqualTo(1),
+                "connection and ACK traffic must count as transport progress without impersonating an application message");
+        }
+
+        [Test]
+        public void RudpCultNetSchemaServer_RejectsNonPositiveDrainBound()
+        {
+            using var server = new RudpCultNetSchemaServer(new RudpCultNetSchemaServerOptions
+            {
+                Socket = BindUdpSocket()
+            });
+
+            Assert.ThrowsAsync<ArgumentOutOfRangeException>(() => server.PollAvailableAsync(0));
+        }
+
+        [Test]
+        public async Task RudpCultNetSchemaServer_AcceptsSequentialShortLivedClients()
+        {
+            using var server = new RudpCultNetSchemaServer(new RudpCultNetSchemaServerOptions
+            {
+                RuntimeId = "csharp-rudp-sequential-host",
+                Socket = BindUdpSocket(),
+                MaxFragmentBytes = 1024
+            });
+            server.OnCultNet<CultNetSchemaCatalogRequestMessage>((request, peer) =>
+                peer.SendCultNet(new CultNetSchemaCatalogResponseMessage
+                {
+                    MessageId = request.MessageId,
+                    Schemas = Array.Empty<CultNetSchemaDescriptor>()
+                }));
+
+            using var cancellation = new CancellationTokenSource();
+            var serverThread = new Thread(() =>
+            {
+                while (!cancellation.IsCancellationRequested)
+                {
+                    _ = server.PollOnceAsync().GetAwaiter().GetResult();
+                    Thread.Sleep(1);
+                }
+            }) { IsBackground = true };
+            serverThread.Start();
+
+            async Task FetchOnce(string messageId)
+            {
+                using var client = CultNetSchemaClients.CreateRudp(runtimeId: $"client-{messageId}");
+                var completion = new TaskCompletionSource<CultNetSchemaCatalogResponseMessage>(
+                    TaskCreationOptions.RunContinuationsAsynchronously);
+                client.OnCultNet<CultNetSchemaCatalogResponseMessage>(response => completion.TrySetResult(response));
+                client.Connect("127.0.0.1", server.LocalEndPoint.Port);
+                await WaitUntilAsync(() => client.Connected, TimeSpan.FromSeconds(2));
+                client.SendCultNet(new CultNetSchemaCatalogRequestMessage { MessageId = messageId });
+                var response = await AwaitWithTimeout(completion.Task, TimeSpan.FromSeconds(2));
+                Assert.That(response.MessageId, Is.EqualTo(messageId));
+            }
+
+            await FetchOnce("first");
+            await WaitUntilAsync(() => server.Peers.Count == 0, TimeSpan.FromSeconds(2));
+            await FetchOnce("second");
+            cancellation.Cancel();
+        }
+
+        // A batch is a value: nothing staged in it reaches CultNet observers before the store commits it. A put made
+        // while a batch is being staged is its own write, not part of the batch.
+        [Test]
+        public void CultNetPutInsideCommitPublishesOnlyAfterCommit()
+        {
+            var path = Path.Combine(Path.GetTempPath(), $"cultnet-commit-{Guid.NewGuid():N}.cc");
+            try
+            {
+                var cache = new CultCache();
+                cache.AddBackingStore(new SingleFileMessagePackBackingStore(path));
+                var database = new CultNetDatabase(cache);
+                var published = new List<CultRecordKey>();
+                using var subscription = database.Watch<NetworkSchemaNote>().Subscribe(change => published.Add(change.Key));
+                var batched = new CultRecordKey("tests:commit:batched");
+                var put = new CultRecordKey("tests:commit:put");
+
+                Assert.That(cache.Commit(batch =>
+                {
+                    batch.Upsert(new NetworkSchemaNote { Schema = "tests.networking_note.v1", Text = "batched" }, new CultRecordHandle<NetworkSchemaNote>(batched));
+                    database.PutAsync(put, new NetworkSchemaNote { Schema = "tests.networking_note.v1", Text = "put" }).GetAwaiter().GetResult();
+                    Assert.That(published, Is.EqualTo(new[] { put }), "a record staged in the batch was published before the store committed it");
+                    Assert.That(cache.Get(batched), Is.Null);
+                }), Is.True);
+
+                Assert.That(published, Is.EqualTo(new[] { put }));
+                Assert.That(cache.Get<NetworkSchemaNote>(batched)?.Text, Is.EqualTo("batched"));
+                var reopened = new CultCache();
+                reopened.AddBackingStore(new SingleFileMessagePackBackingStore(path));
+                Assert.That(reopened.Get<NetworkSchemaNote>(batched)?.Text, Is.EqualTo("batched"));
+                Assert.That(reopened.Get<NetworkSchemaNote>(put)?.Text, Is.EqualTo("put"));
+            }
+            finally
+            {
+                if (File.Exists(path)) File.Delete(path);
+                if (File.Exists(path + ".lock")) File.Delete(path + ".lock");
+            }
+        }
+
+        [Test]
+        public async Task DatabaseSubscriptionServer_StreamsRecordChangesOverRudp()
+        {
+            var cache = new CultCache();
+            var database = new CultNetDatabase(cache);
+            using var server = new RudpCultNetSchemaServer(new RudpCultNetSchemaServerOptions
+            {
+                RuntimeId = "database-subscription-server",
+                Socket = BindUdpSocket()
+            });
+            using var subscriptions = new CultNetDatabaseSubscriptionServer(server, database);
+            using var cancellation = new CancellationTokenSource();
+            var serverThread = new Thread(() =>
+            {
+                while (!cancellation.IsCancellationRequested)
+                {
+                    _ = server.PollOnceAsync().GetAwaiter().GetResult();
+                    Thread.Sleep(1);
+                }
+            }) { IsBackground = true };
+            serverThread.Start();
+
+            using var client = CultNetSchemaClients.CreateRudp("database-subscription-client");
+            var subscribed = new TaskCompletionSource<CultNetSnapshotResponseRawMessage>(
+                TaskCreationOptions.RunContinuationsAsynchronously);
+            var changed = new TaskCompletionSource<CultNetDatabaseChangeRawMessage>(
+                TaskCreationOptions.RunContinuationsAsynchronously);
+            client.OnCultNet<CultNetSnapshotResponseRawMessage>(message => subscribed.TrySetResult(message));
+            client.OnCultNet<CultNetDatabaseChangeRawMessage>(message => changed.TrySetResult(message));
+            client.Connect("127.0.0.1", server.LocalEndPoint.Port);
+            await WaitUntilAsync(() => client.Connected, TimeSpan.FromSeconds(2));
+            const string recordKey = "tests:subscription:note";
+            client.SendCultNet(new CultNetDatabaseSubscribeMessage
+            {
+                MessageId = "subscribe-note",
+                SubscriptionId = "note",
+                RecordKeys = [recordKey],
+                IncludeSnapshot = true
+            });
+            await AwaitWithTimeout(subscribed.Task, TimeSpan.FromSeconds(2));
+
+            await database.PutAsync(new CultRecordKey(recordKey), new NetworkSchemaNote
+            {
+                Schema = "tests.networking_note.v1",
+                Text = "live"
+            });
+            var update = await AwaitWithTimeout(changed.Task, TimeSpan.FromSeconds(2));
+
+            cancellation.Cancel();
+            Assert.That(update.SubscriptionId, Is.EqualTo("note"));
+            Assert.That(update.ChangeKind, Is.EqualTo("added"));
+            Assert.That(update.Document, Is.Not.Null);
+            Assert.That(update.Document!.RecordKey, Is.EqualTo(recordKey));
+        }
+
+        [Test]
+        public async Task DatabaseSubscriptionServer_AuthorizesRequestAndFiltersSnapshotAndLiveRecords()
+        {
+            var cache = new CultCache();
+            var database = new CultNetDatabase(cache);
+            using var server = new RudpCultNetSchemaServer(new RudpCultNetSchemaServerOptions
+            {
+                RuntimeId = "database-authorized-subscription-server",
+                Socket = BindUdpSocket()
+            });
+            using var subscriptions = new CultNetDatabaseSubscriptionServer(
+                server,
+                database,
+                authorizeRequest: (request, _) => request.ConsumerRuntimeId == "allowed-runtime",
+                authorizeRecord: (_, _, recordKey, _) => recordKey.StartsWith("tests:public:", StringComparison.Ordinal),
+                projectRecord: (request, _, record) =>
+                {
+                    record.SourceRuntimeId = "projection:" + request.ConsumerRuntimeId;
+                    return record;
+                });
+            using var cancellation = new CancellationTokenSource();
+            var serverThread = new Thread(() =>
+            {
+                while (!cancellation.IsCancellationRequested)
+                {
+                    _ = server.PollOnceAsync().GetAwaiter().GetResult();
+                    Thread.Sleep(1);
+                }
+            }) { IsBackground = true };
+            serverThread.Start();
+
+            await database.PutAsync(new CultRecordKey("tests:public:initial"), new NetworkSchemaNote
+            {
+                Schema = "tests.networking_note.v1",
+                Text = "public-initial"
+            });
+            await database.PutAsync(new CultRecordKey("tests:private:initial"), new NetworkSchemaNote
+            {
+                Schema = "tests.networking_note.v1",
+                Text = "private-initial"
+            });
+
+            using var client = CultNetSchemaClients.CreateRudp("database-authorized-subscription-client");
+            var subscribed = new TaskCompletionSource<CultNetSnapshotResponseRawMessage>(
+                TaskCreationOptions.RunContinuationsAsynchronously);
+            var changed = new TaskCompletionSource<CultNetDatabaseChangeRawMessage>(
+                TaskCreationOptions.RunContinuationsAsynchronously);
+            client.OnCultNet<CultNetSnapshotResponseRawMessage>(message => subscribed.TrySetResult(message));
+            client.OnCultNet<CultNetDatabaseChangeRawMessage>(message => changed.TrySetResult(message));
+            client.Connect("127.0.0.1", server.LocalEndPoint.Port);
+            await WaitUntilAsync(() => client.Connected, TimeSpan.FromSeconds(2));
+            client.SendCultNet(new CultNetDatabaseSubscribeMessage
+            {
+                MessageId = "subscribe-authorized",
+                SubscriptionId = "authorized",
+                ConsumerRuntimeId = "allowed-runtime",
+                IncludeSnapshot = true
+            });
+
+            var snapshot = await AwaitWithTimeout(subscribed.Task, TimeSpan.FromSeconds(2));
+            Assert.That(snapshot.Documents.Select(document => document.RecordKey),
+                Is.EqualTo(new[] { "tests:public:initial" }));
+            Assert.That(snapshot.Documents.Single().SourceRuntimeId, Is.EqualTo("projection:allowed-runtime"));
+
+            await database.PutAsync(new CultRecordKey("tests:private:live"), new NetworkSchemaNote
+            {
+                Schema = "tests.networking_note.v1",
+                Text = "private-live"
+            });
+            await database.PutAsync(new CultRecordKey("tests:public:live"), new NetworkSchemaNote
+            {
+                Schema = "tests.networking_note.v1",
+                Text = "public-live"
+            });
+            var update = await AwaitWithTimeout(changed.Task, TimeSpan.FromSeconds(2));
+
+            cancellation.Cancel();
+            Assert.That(update.Document, Is.Not.Null);
+            Assert.That(update.Document!.RecordKey, Is.EqualTo("tests:public:live"));
+            Assert.That(update.Document.SourceRuntimeId, Is.EqualTo("projection:allowed-runtime"));
+        }
+
+        [Test]
+        public async Task DatabaseSubscriptionServer_ReconcilesDeliveredProjectionAndBodyDemandWhenAuthorityChanges()
+        {
+            const string sourceRecordKey = "tests:authority:source";
+            const string bodyId = "tests:authority:body";
+            var authorized = true;
+            var projectionName = "one";
+            var sourceCache = new CultCache();
+            var sourceDatabase = new CultNetDatabase(sourceCache);
+            await sourceDatabase.PutAsync(new CultRecordKey(sourceRecordKey), new NetworkSchemaNote
+            {
+                Schema = "tests.networking_note.v1",
+                Text = "initial"
+            });
+            using var server = new RudpCultNetSchemaServer(new RudpCultNetSchemaServerOptions
+            {
+                RuntimeId = "database-reconciled-subscription-server",
+                Socket = BindUdpSocket()
+            });
+            using var subscriptions = new CultNetDatabaseSubscriptionServer(
+                server,
+                sourceDatabase,
+                authorizeRequest: (_, _) => authorized,
+                authorizeRecord: (_, _, _, _) => authorized,
+                projectRecord: (_, _, record) =>
+                {
+                    record.RecordKey = $"tests:authority:projected:{projectionName}";
+                    return record;
+                });
+            using var bodyDemand = new CultMeshBodyDemandTracker(subscriptions);
+            using var cancellation = new CancellationTokenSource();
+            var serverThread = new Thread(() =>
+            {
+                while (!cancellation.IsCancellationRequested)
+                {
+                    _ = server.PollOnceAsync().GetAwaiter().GetResult();
+                    Thread.Sleep(1);
+                }
+            }) { IsBackground = true };
+            serverThread.Start();
+
+            var targetCache = new CultCache();
+            var targetDocuments = new CultNetDocumentRegistry(targetCache.Registry)
+                .Register(CultNetDocumentBinding.ForDocument<NetworkSchemaNote>(targetCache.Registry));
+            var transport = CultNetSchemaClients.CreateRudp("database-reconciled-subscription-client");
+            using var client = new CultNetDatabaseSubscriptionClient(transport, targetCache, targetDocuments);
+            var changes = new ConcurrentQueue<CultNetReplicatedDocumentChange>();
+            client.Changed += changes.Enqueue;
+            transport.Connect("127.0.0.1", server.LocalEndPoint.Port);
+            await WaitUntilAsync(() => transport.Connected, TimeSpan.FromSeconds(2));
+            await AwaitWithTimeout(
+                client.SubscribeAsync(
+                    "authority",
+                    recordKeys: [sourceRecordKey],
+                    consumerRuntimeId: "authority-client",
+                    bodyIds: [bodyId],
+                    supportedBodyTransports: [CultMeshBodyTransportKind.SharedMemory.ToString()]),
+                TimeSpan.FromSeconds(2));
+            Assert.That(targetCache.Get(new CultRecordKey("tests:authority:projected:one")), Is.Not.Null);
+            Assert.That(bodyDemand.Plan(bodyId).HasConsumers, Is.True);
+
+            projectionName = "two";
+            subscriptions.Reconcile();
+            await WaitUntilAsync(
+                () => targetCache.Get(new CultRecordKey("tests:authority:projected:one")) == null &&
+                      targetCache.Get(new CultRecordKey("tests:authority:projected:two")) != null,
+                TimeSpan.FromSeconds(2));
+            Assert.That(changes.Any(change => change.ChangeKind == "removed" &&
+                change.RecordKey == "tests:authority:projected:one"), Is.True);
+            Assert.That(changes.Any(change => change.ChangeKind == "added" &&
+                change.RecordKey == "tests:authority:projected:two"), Is.True);
+
+            authorized = false;
+            subscriptions.Reconcile();
+            await WaitUntilAsync(
+                () => targetCache.Get(new CultRecordKey("tests:authority:projected:two")) == null,
+                TimeSpan.FromSeconds(2));
+            Assert.That(bodyDemand.Plan(bodyId).HasConsumers, Is.False);
+            var changeCountAfterRevocation = changes.Count;
+            await sourceDatabase.PutAsync(new CultRecordKey(sourceRecordKey), new NetworkSchemaNote
+            {
+                Schema = "tests.networking_note.v1",
+                Text = "must-not-escape"
+            });
+            await Task.Delay(100);
+            cancellation.Cancel();
+
+            Assert.That(changes.Count, Is.EqualTo(changeCountAfterRevocation));
+            Assert.That(targetCache.Get(new CultRecordKey("tests:authority:projected:two")), Is.Null);
+        }
+
+        [Test]
+        public async Task DatabaseSubscriptionServer_ProjectsBodyDemandAndWithdrawalFromExactSubscription()
+        {
+            var database = new CultNetDatabase(new CultCache());
+            using var server = new RudpCultNetSchemaServer(new RudpCultNetSchemaServerOptions
+            {
+                RuntimeId = "database-body-demand-server",
+                Socket = BindUdpSocket()
+            });
+            using var subscriptions = new CultNetDatabaseSubscriptionServer(server, database);
+            var active = new TaskCompletionSource<CultNetDatabaseSubscriptionDemand>(
+                TaskCreationOptions.RunContinuationsAsynchronously);
+            var withdrawn = new TaskCompletionSource<CultNetDatabaseSubscriptionDemand>(
+                TaskCreationOptions.RunContinuationsAsynchronously);
+            subscriptions.DemandChanged += demand =>
+            {
+                if (demand.Active) active.TrySetResult(demand);
+                else withdrawn.TrySetResult(demand);
+            };
+            using var cancellation = new CancellationTokenSource();
+            var serverThread = new Thread(() =>
+            {
+                while (!cancellation.IsCancellationRequested)
+                {
+                    _ = server.PollOnceAsync().GetAwaiter().GetResult();
+                    Thread.Sleep(1);
+                }
+            }) { IsBackground = true };
+            serverThread.Start();
+
+            using var client = CultNetSchemaClients.CreateRudp("database-body-demand-client");
+            client.Connect("127.0.0.1", server.LocalEndPoint.Port);
+            await WaitUntilAsync(() => client.Connected, TimeSpan.FromSeconds(2));
+            client.SendCultNet(new CultNetDatabaseSubscribeMessage
+            {
+                MessageId = "subscribe-body",
+                SubscriptionId = "world-body",
+                RecordKeys = ["world:entities", "mesh:body:world:latest"],
+                ConsumerRuntimeId = "eve-unity",
+                BodyIds = ["world"],
+                SupportedBodyTransports = ["SharedMemory", "Network"],
+                IncludeSnapshot = false
+            });
+
+            var observed = await AwaitWithTimeout(active.Task, TimeSpan.FromSeconds(2));
+            Assert.That(observed.ConsumerRuntimeId, Is.EqualTo("eve-unity"));
+            Assert.That(observed.SubscriptionId, Is.EqualTo("world-body"));
+            Assert.That(observed.RecordKeys, Is.EqualTo(new[] { "world:entities", "mesh:body:world:latest" }));
+            Assert.That(observed.SchemaIds, Is.Empty);
+            Assert.That(observed.BodyIds, Is.EqualTo(new[] { "world" }));
+            Assert.That(observed.SupportedBodyTransports, Is.EqualTo(new[] { "SharedMemory", "Network" }));
+            Assert.That(observed.SameMachine, Is.True);
+
+            client.SendCultNet(new CultNetDatabaseUnsubscribeMessage
+            {
+                MessageId = "unsubscribe-body",
+                SubscriptionId = "world-body"
+            });
+            var removed = await AwaitWithTimeout(withdrawn.Task, TimeSpan.FromSeconds(2));
+            cancellation.Cancel();
+            Assert.That(removed.ConsumerRuntimeId, Is.EqualTo("eve-unity"));
+            Assert.That(removed.Active, Is.False);
+        }
+
+        // A load's delivery reaches a subscription observer that needs the lifecycle gate while a subscribe's demand
+        // handler, holding that gate, writes the same cache. Nothing is disposed on failure: disposal would hang too.
+        [Test]
+        public async Task SubscriptionDemandHandlerWritingCacheDuringDeliveryDoesNotDeadlock()
+        {
+            var path = Path.Combine(Path.GetTempPath(), $"cultlib-demand-{Guid.NewGuid():N}.cc");
+            using (var seed = new CultCache())
+            {
+                seed.AddBackingStore(new SingleFileMessagePackBackingStore(path));
+                await seed.UpsertAsync(new NetworkSchemaNote { Schema = "tests.networking_note.v1", Text = "loaded" },
+                    new CultRecordHandle<NetworkSchemaNote>(new CultRecordKey("demand:loaded")));
+                seed.FlushAllBackingStores();
+            }
+
+            var cache = new CultCache();
+            var delivering = new ManualResetEventSlim();
+            cache.OnUpdate += (_, _) => delivering.Set();
+            var database = new CultNetDatabase(cache);
+            var server = new RudpCultNetSchemaServer(new RudpCultNetSchemaServerOptions
+            {
+                RuntimeId = "demand-write-server",
+                Socket = BindUdpSocket()
+            });
+            var subscriptions = new CultNetDatabaseSubscriptionServer(server, database);
+            var written = new TaskCompletionSource<bool>(TaskCreationOptions.RunContinuationsAsynchronously);
+            subscriptions.DemandChanged += demand =>
+            {
+                if (!demand.Active) return;
+                _ = Task.Run(() => cache.AddBackingStore(new SingleFileMessagePackBackingStore(path)));
+                if (!delivering.Wait(TimeSpan.FromSeconds(5)))
+                {
+                    written.TrySetException(new TimeoutException("the load never started delivering"));
+                    return;
+                }
+                cache.UpsertAsync(new NetworkSchemaNote { Schema = "tests.networking_note.v1", Text = "demanded" },
+                    new CultRecordHandle<NetworkSchemaNote>(new CultRecordKey("demand:written"))).GetAwaiter().GetResult();
+                written.TrySetResult(true);
+            };
+            using var cancellation = new CancellationTokenSource();
+            var serverThread = new Thread(() =>
+            {
+                while (!cancellation.IsCancellationRequested)
+                {
+                    _ = server.PollOnceAsync().GetAwaiter().GetResult();
+                    Thread.Sleep(1);
+                }
+            }) { IsBackground = true };
+            serverThread.Start();
+
+            using var client = CultNetSchemaClients.CreateRudp("demand-write-client");
+            client.Connect("127.0.0.1", server.LocalEndPoint.Port);
+            await WaitUntilAsync(() => client.Connected, TimeSpan.FromSeconds(2));
+            client.SendCultNet(new CultNetDatabaseSubscribeMessage
+            {
+                MessageId = "subscribe-demand-write",
+                SubscriptionId = "demand-write",
+                RecordKeys = ["demand:other"],
+                IncludeSnapshot = false
+            });
+
+            var finished = await Task.WhenAny(written.Task, Task.Delay(TimeSpan.FromSeconds(10))) == written.Task;
+            cancellation.Cancel();
+            Assert.That(finished, Is.True, "the demand handler's cache write deadlocked with the load's delivery");
+            await written.Task;
+            serverThread.Join();
+            subscriptions.Dispose();
+            server.Dispose();
+            database.Dispose();
+            cache.Dispose();
+            File.Delete(path);
+        }
+
+        [Test]
+        public async Task DatabaseSubscriptionServer_ClassifiesLoopbackTcpDemandAsSameMachine()
+        {
+            var database = new CultNetDatabase(new CultCache());
+            using var server = new TcpFramedCultNetSchemaServer(new TcpListener(IPAddress.Loopback, 0));
+            using var subscriptions = new CultNetDatabaseSubscriptionServer(server, database);
+            var active = new TaskCompletionSource<CultNetDatabaseSubscriptionDemand>(
+                TaskCreationOptions.RunContinuationsAsynchronously);
+            subscriptions.DemandChanged += demand =>
+            {
+                if (demand.Active) active.TrySetResult(demand);
+            };
+            using var client = new TcpFramedCultNetSchemaClient();
+            client.Connect("127.0.0.1", server.LocalEndPoint.Port);
+            client.SendCultNet(new CultNetDatabaseSubscribeMessage
+            {
+                MessageId = "subscribe-tcp-body",
+                SubscriptionId = "world-body",
+                ConsumerRuntimeId = "eve-unity",
+                BodyIds = ["world"],
+                SupportedBodyTransports = ["SharedMemory", "Network"],
+                IncludeSnapshot = false
+            });
+
+            var observed = await AwaitWithTimeout(active.Task, TimeSpan.FromSeconds(2));
+
+            Assert.That(observed.SameMachine, Is.True);
+            Assert.That(observed.BodyIds, Is.EqualTo(new[] { "world" }));
+        }
+
+        [Test]
+        public async Task DatabaseSubscriptionServer_ProjectsExactReactiveStateDemandWithoutBodyDemand()
+        {
+            var database = new CultNetDatabase(new CultCache());
+            using var server = new RudpCultNetSchemaServer(new RudpCultNetSchemaServerOptions
+            {
+                RuntimeId = "database-reactive-demand-server",
+                Socket = BindUdpSocket()
+            });
+            using var subscriptions = new CultNetDatabaseSubscriptionServer(server, database);
+            var active = new TaskCompletionSource<CultNetDatabaseSubscriptionDemand>(
+                TaskCreationOptions.RunContinuationsAsynchronously);
+            subscriptions.DemandChanged += demand =>
+            {
+                if (demand.Active) active.TrySetResult(demand);
+            };
+            using var cancellation = new CancellationTokenSource();
+            var serverThread = new Thread(() =>
+            {
+                while (!cancellation.IsCancellationRequested)
+                {
+                    _ = server.PollOnceAsync().GetAwaiter().GetResult();
+                    Thread.Sleep(1);
+                }
+            }) { IsBackground = true };
+            serverThread.Start();
+
+            using var client = CultNetSchemaClients.CreateRudp("database-reactive-demand-client");
+            client.Connect("127.0.0.1", server.LocalEndPoint.Port);
+            await WaitUntilAsync(() => client.Connected, TimeSpan.FromSeconds(2));
+            client.SendCultNet(new CultNetDatabaseSubscribeMessage
+            {
+                MessageId = "subscribe-reactive",
+                SubscriptionId = "fog-field",
+                RecordKeys = ["world:field:fog"],
+                SchemaIds = ["gamecult.fields.splats.v1"],
+                ConsumerRuntimeId = "eve-unity",
+                IncludeSnapshot = false
+            });
+
+            var observed = await AwaitWithTimeout(active.Task, TimeSpan.FromSeconds(2));
+            cancellation.Cancel();
+            Assert.That(observed.RecordKeys, Is.EqualTo(new[] { "world:field:fog" }));
+            Assert.That(observed.SchemaIds, Is.EqualTo(new[] { "gamecult.fields.splats.v1" }));
+            Assert.That(observed.BodyIds, Is.Empty);
+        }
+
+        [Test]
+        public async Task DatabaseSubscriptionServer_WithdrawsDemandWhenPeerDisconnects()
+        {
+            var database = new CultNetDatabase(new CultCache());
+            using var server = new RudpCultNetSchemaServer(new RudpCultNetSchemaServerOptions
+            {
+                RuntimeId = "database-disconnect-demand-server",
+                Socket = BindUdpSocket()
+            });
+            using var subscriptions = new CultNetDatabaseSubscriptionServer(server, database);
+            var active = new TaskCompletionSource<CultNetDatabaseSubscriptionDemand>(
+                TaskCreationOptions.RunContinuationsAsynchronously);
+            var withdrawn = new TaskCompletionSource<CultNetDatabaseSubscriptionDemand>(
+                TaskCreationOptions.RunContinuationsAsynchronously);
+            subscriptions.DemandChanged += demand =>
+            {
+                if (demand.Active) active.TrySetResult(demand);
+                else withdrawn.TrySetResult(demand);
+            };
+            using var cancellation = new CancellationTokenSource();
+            var serverThread = new Thread(() =>
+            {
+                while (!cancellation.IsCancellationRequested)
+                {
+                    _ = server.PollOnceAsync().GetAwaiter().GetResult();
+                    Thread.Sleep(1);
+                }
+            }) { IsBackground = true };
+            serverThread.Start();
+
+            using var client = CultNetSchemaClients.CreateRudp("database-disconnect-demand-client");
+            client.Connect("127.0.0.1", server.LocalEndPoint.Port);
+            await WaitUntilAsync(() => client.Connected, TimeSpan.FromSeconds(2));
+            client.SendCultNet(new CultNetDatabaseSubscribeMessage
+            {
+                MessageId = "subscribe-disconnect-body",
+                SubscriptionId = "disconnect-world-body",
+                ConsumerRuntimeId = "eve-unity",
+                BodyIds = ["world"],
+                SupportedBodyTransports = ["SharedMemory"],
+                IncludeSnapshot = false
+            });
+            await AwaitWithTimeout(active.Task, TimeSpan.FromSeconds(2));
+
+            client.Dispose();
+            var removed = await AwaitWithTimeout(withdrawn.Task, TimeSpan.FromSeconds(2));
+            await WaitUntilAsync(() => server.Peers.Count == 0, TimeSpan.FromSeconds(2));
+            cancellation.Cancel();
+
+            Assert.That(removed.SubscriptionId, Is.EqualTo("disconnect-world-body"));
+            Assert.That(removed.Active, Is.False);
+        }
+
+        [Test]
+        public async Task DatabaseSubscriptionClient_ReplicatesInitialAndLiveTypedDocumentsOverRudp()
+        {
+            var sourceCache = new CultCache();
+            var sourceDatabase = new CultNetDatabase(sourceCache);
+            const string recordKey = "tests:subscription-client:note";
+            await sourceDatabase.PutAsync(new CultRecordKey(recordKey), new NetworkSchemaNote
+            {
+                Schema = "tests.networking_note.v1",
+                Text = "initial"
+            });
+            using var server = new RudpCultNetSchemaServer(new RudpCultNetSchemaServerOptions
+            {
+                RuntimeId = "database-subscription-client-server",
+                Socket = BindUdpSocket()
+            });
+            using var subscriptions = new CultNetDatabaseSubscriptionServer(server, sourceDatabase);
+            using var cancellation = new CancellationTokenSource();
+            var serverThread = new Thread(() =>
+            {
+                while (!cancellation.IsCancellationRequested)
+                {
+                    _ = server.PollOnceAsync().GetAwaiter().GetResult();
+                    Thread.Sleep(1);
+                }
+            }) { IsBackground = true };
+            serverThread.Start();
+
+            var targetCache = new CultCache();
+            var targetDocuments = new CultNetDocumentRegistry(targetCache.Registry)
+                .Register(CultNetDocumentBinding.ForDocument<NetworkSchemaNote>(targetCache.Registry));
+            var transport = CultNetSchemaClients.CreateRudp("database-subscription-client");
+            using var client = new CultNetDatabaseSubscriptionClient(transport, targetCache, targetDocuments);
+            transport.Connect("127.0.0.1", server.LocalEndPoint.Port);
+            await WaitUntilAsync(() => transport.Connected, TimeSpan.FromSeconds(2));
+
+            var initial = await AwaitWithTimeout(
+                client.SubscribeAsync("notes", recordKeys: new[] { recordKey }),
+                TimeSpan.FromSeconds(2));
+            Assert.That(initial.OfType<NetworkSchemaNote>().Single().Text, Is.EqualTo("initial"));
+            Assert.That(targetCache.Get(new CultRecordKey(recordKey)), Is.TypeOf<NetworkSchemaNote>());
+
+            var changed = new TaskCompletionSource<CultNetReplicatedDocumentChange>(TaskCreationOptions.RunContinuationsAsynchronously);
+            client.Changed += change => changed.TrySetResult(change);
+            await sourceDatabase.PutAsync(new CultRecordKey(recordKey), new NetworkSchemaNote
+            {
+                Schema = "tests.networking_note.v1",
+                Text = "live"
+            });
+            var update = await AwaitWithTimeout(changed.Task, TimeSpan.FromSeconds(2));
+
+            cancellation.Cancel();
+            Assert.That(update.SubscriptionId, Is.EqualTo("notes"));
+            Assert.That(update.Document, Is.TypeOf<NetworkSchemaNote>());
+            Assert.That(((NetworkSchemaNote)targetCache.Get(new CultRecordKey(recordKey))!).Text, Is.EqualTo("live"));
+        }
+
+        [Test]
+        public async Task DatabaseSubscriptionClient_LiveDeliveryDecodesWithoutWritingReplicaState()
+        {
+            var sourceCache = new CultCache();
+            var sourceDatabase = new CultNetDatabase(sourceCache);
+            const string recordKey = "tests:subscription-client:live-note";
+            await sourceDatabase.PutAsync(new CultRecordKey(recordKey), new NetworkSchemaNote
+            {
+                Schema = "tests.networking_note.v1",
+                Text = "initial"
+            });
+            using var server = new RudpCultNetSchemaServer(new RudpCultNetSchemaServerOptions
+            {
+                RuntimeId = "database-live-subscription-server",
+                Socket = BindUdpSocket()
+            });
+            using var subscriptions = new CultNetDatabaseSubscriptionServer(server, sourceDatabase);
+            using var cancellation = new CancellationTokenSource();
+            var serverThread = new Thread(() =>
+            {
+                while (!cancellation.IsCancellationRequested)
+                {
+                    _ = server.PollOnceAsync().GetAwaiter().GetResult();
+                    Thread.Sleep(1);
+                }
+            }) { IsBackground = true };
+            serverThread.Start();
+
+            var targetCache = new CultCache();
+            var targetDocuments = new CultNetDocumentRegistry(targetCache.Registry)
+                .Register(CultNetDocumentBinding.ForDocument<NetworkSchemaNote>(targetCache.Registry));
+            var transport = CultNetSchemaClients.CreateRudp("database-live-subscription-client");
+            using var client = new CultNetDatabaseSubscriptionClient(transport, targetCache, targetDocuments);
+            transport.Connect("127.0.0.1", server.LocalEndPoint.Port);
+            await WaitUntilAsync(() => transport.Connected, TimeSpan.FromSeconds(2));
+
+            var initial = await AwaitWithTimeout(
+                client.SubscribeAsync(
+                    "live-notes",
+                    recordKeys: new[] { recordKey },
+                    deliveryMode: CultNetDatabaseSubscriptionDeliveryMode.Live),
+                TimeSpan.FromSeconds(2));
+            Assert.That(initial.OfType<NetworkSchemaNote>().Single().Text, Is.EqualTo("initial"));
+            Assert.That(targetCache.Get(new CultRecordKey(recordKey)), Is.Null);
+
+            var changed = new TaskCompletionSource<CultNetReplicatedDocumentChange>(TaskCreationOptions.RunContinuationsAsynchronously);
+            client.Changed += change => changed.TrySetResult(change);
+            await sourceDatabase.PutAsync(new CultRecordKey(recordKey), new NetworkSchemaNote
+            {
+                Schema = "tests.networking_note.v1",
+                Text = "live"
+            });
+            var update = await AwaitWithTimeout(changed.Task, TimeSpan.FromSeconds(2));
+
+            cancellation.Cancel();
+            Assert.That(((NetworkSchemaNote)update.Document!).Text, Is.EqualTo("live"));
+            Assert.That(targetCache.Get(new CultRecordKey(recordKey)), Is.Null);
+        }
+
+        [Test]
+        public async Task DatabaseSubscriptionClient_LiveValueOwnsExactFilteringCurrentValueAndUnsubscribe()
+        {
+            var sourceCache = new CultCache();
+            var sourceDatabase = new CultNetDatabase(sourceCache);
+            const string recordKey = "tests:subscription-client:reactive-note";
+            using var server = new RudpCultNetSchemaServer(new RudpCultNetSchemaServerOptions
+            {
+                RuntimeId = "database-live-value-server",
+                Socket = BindUdpSocket()
+            });
+            using var subscriptions = new CultNetDatabaseSubscriptionServer(server, sourceDatabase);
+            using var cancellation = new CancellationTokenSource();
+            var serverThread = new Thread(() =>
+            {
+                while (!cancellation.IsCancellationRequested)
+                {
+                    _ = server.PollOnceAsync().GetAwaiter().GetResult();
+                    Thread.Sleep(1);
+                }
+            }) { IsBackground = true };
+            serverThread.Start();
+
+            var targetCache = new CultCache();
+            var targetDocuments = new CultNetDocumentRegistry(targetCache.Registry)
+                .Register(CultNetDocumentBinding.ForDocument<NetworkSchemaNote>(targetCache.Registry));
+            var transport = CultNetSchemaClients.CreateRudp("database-live-value-client");
+            using var client = new CultNetDatabaseSubscriptionClient(transport, targetCache, targetDocuments);
+            transport.Connect("127.0.0.1", server.LocalEndPoint.Port);
+            await WaitUntilAsync(() => transport.Connected, TimeSpan.FromSeconds(2));
+
+            using var value = await AwaitWithTimeout(
+                client.SubscribeLiveValueAsync<NetworkSchemaNote>("reactive-note", recordKey),
+                TimeSpan.FromSeconds(2));
+            Assert.That(value.HasValue, Is.False);
+            Assert.That(targetCache.Get(new CultRecordKey(recordKey)), Is.Null);
+
+            var changed = new TaskCompletionSource<NetworkSchemaNote>(TaskCreationOptions.RunContinuationsAsynchronously);
+            value.Changed += document => changed.TrySetResult(document);
+            await sourceDatabase.PutAsync(new CultRecordKey(recordKey), new NetworkSchemaNote
+            {
+                Schema = "tests.networking_note.v1",
+                Text = "initial"
+            });
+            var update = await AwaitWithTimeout(changed.Task, TimeSpan.FromSeconds(2));
+
+            Assert.That(update.Text, Is.EqualTo("initial"));
+            Assert.That(value.Current.Text, Is.EqualTo("initial"));
+            Assert.That(targetCache.Get(new CultRecordKey(recordKey)), Is.Null);
+
+            var updated = new TaskCompletionSource<NetworkSchemaNote>(TaskCreationOptions.RunContinuationsAsynchronously);
+            value.Changed += document => updated.TrySetResult(document);
+            await sourceDatabase.PutAsync(new CultRecordKey(recordKey), new NetworkSchemaNote
+            {
+                Schema = "tests.networking_note.v1",
+                Text = "updated"
+            });
+            update = await AwaitWithTimeout(updated.Task, TimeSpan.FromSeconds(2));
+
+            cancellation.Cancel();
+            Assert.That(update.Text, Is.EqualTo("updated"));
+            Assert.That(value.Current.Text, Is.EqualTo("updated"));
+        }
+
+        [Test]
+        public async Task DatabaseSubscriptionClient_ReceivesProviderMaterializedValueFromExactDemand()
+        {
+            var sourceDatabase = new CultNetDatabase(new CultCache());
+            const string recordKey = "tests:subscription-client:demanded-note";
+            using var server = new RudpCultNetSchemaServer(new RudpCultNetSchemaServerOptions
+            {
+                RuntimeId = "database-demanded-value-server",
+                Socket = BindUdpSocket()
+            });
+            using var subscriptions = new CultNetDatabaseSubscriptionServer(server, sourceDatabase);
+            subscriptions.DemandChanged += demand =>
+            {
+                if (!demand.Active || !demand.RecordKeys.Contains(recordKey, StringComparer.Ordinal))
+                    return;
+                sourceDatabase.PutAsync(new CultRecordKey(recordKey), new NetworkSchemaNote
+                {
+                    Schema = "tests.networking_note.v1",
+                    Text = "materialized-on-demand"
+                }).GetAwaiter().GetResult();
+            };
+            using var cancellation = new CancellationTokenSource();
+            var serverThread = new Thread(() =>
+            {
+                while (!cancellation.IsCancellationRequested)
+                {
+                    _ = server.PollOnceAsync().GetAwaiter().GetResult();
+                    Thread.Sleep(1);
+                }
+            }) { IsBackground = true };
+            serverThread.Start();
+
+            var targetCache = new CultCache();
+            var targetDocuments = new CultNetDocumentRegistry(targetCache.Registry)
+                .Register(CultNetDocumentBinding.ForDocument<NetworkSchemaNote>(targetCache.Registry));
+            var transport = CultNetSchemaClients.CreateRudp("database-demanded-value-client");
+            using var client = new CultNetDatabaseSubscriptionClient(transport, targetCache, targetDocuments);
+            transport.Connect("127.0.0.1", server.LocalEndPoint.Port);
+            await WaitUntilAsync(() => transport.Connected, TimeSpan.FromSeconds(2));
+
+            using var value = await AwaitWithTimeout(
+                client.SubscribeLiveValueAsync<NetworkSchemaNote>("demanded-note", recordKey),
+                TimeSpan.FromSeconds(2));
+            await WaitUntilAsync(() => value.HasValue, TimeSpan.FromSeconds(2));
+
+            cancellation.Cancel();
+            Assert.That(value.Current.Text, Is.EqualTo("materialized-on-demand"));
+            Assert.That(targetCache.Get(new CultRecordKey(recordKey)), Is.Null);
+        }
+
+        [Test]
+        public async Task DatabaseSubscription_FiltersLiveChangesByWireSchemaBinding()
+        {
+            const string recordKey = "tests:subscription-client:wire-note";
+            const string wireSchema = "tests.wire_note.v1";
+            var sourceCache = new CultCache();
+            var sourceDocuments = new CultNetDocumentRegistry(sourceCache.Registry)
+                .Register(CultNetDocumentBinding.ForDocument<NetworkSchemaNote>(sourceCache.Registry, wireSchema));
+            using var sourceDatabase = new CultNetDatabase(sourceCache, new CultNetDatabaseOptions
+            {
+                DocumentRegistry = sourceDocuments
+            });
+            using var server = new RudpCultNetSchemaServer(new RudpCultNetSchemaServerOptions
+            {
+                RuntimeId = "database-wire-schema-subscription-server",
+                Socket = BindUdpSocket()
+            });
+            using var subscriptions = new CultNetDatabaseSubscriptionServer(server, sourceDatabase);
+            using var cancellation = new CancellationTokenSource();
+            var serverThread = new Thread(() =>
+            {
+                while (!cancellation.IsCancellationRequested)
+                {
+                    _ = server.PollOnceAsync().GetAwaiter().GetResult();
+                    Thread.Sleep(1);
+                }
+            }) { IsBackground = true };
+            serverThread.Start();
+
+            var targetCache = new CultCache();
+            var targetDocuments = new CultNetDocumentRegistry(targetCache.Registry)
+                .Register(CultNetDocumentBinding.ForDocument<NetworkSchemaNote>(targetCache.Registry, wireSchema));
+            var transport = CultNetSchemaClients.CreateRudp("database-wire-schema-subscription-client");
+            using var client = new CultNetDatabaseSubscriptionClient(transport, targetCache, targetDocuments);
+            transport.Connect("127.0.0.1", server.LocalEndPoint.Port);
+            await WaitUntilAsync(() => transport.Connected, TimeSpan.FromSeconds(2));
+            await AwaitWithTimeout(
+                client.SubscribeAsync("wire-notes", recordKeys: [recordKey], schemaIds: [wireSchema]),
+                TimeSpan.FromSeconds(2));
+            var changed = new TaskCompletionSource<CultNetReplicatedDocumentChange>(TaskCreationOptions.RunContinuationsAsynchronously);
+            client.Changed += change => changed.TrySetResult(change);
+
+            await sourceDatabase.PutAsync(new CultRecordKey(recordKey), new NetworkSchemaNote
+            {
+                Schema = "tests.networking_note.v1",
+                Text = "wire-live"
+            });
+            var update = await AwaitWithTimeout(changed.Task, TimeSpan.FromSeconds(2));
+
+            cancellation.Cancel();
+            Assert.That(update.SchemaId, Is.EqualTo(wireSchema));
+            Assert.That(((NetworkSchemaNote)update.Document!).Text, Is.EqualTo("wire-live"));
+        }
+
+        [Test]
+        public void DatabaseSubscription_FiltersCanonicalWireChangesByRequestedSchemaAlias()
+        {
+            var cache = new CultCache();
+            var documents = new CultNetDocumentRegistry(cache.Registry)
+                .Register(CultNetDocumentBinding.ForDocument<NetworkSchemaNote>(cache.Registry));
+            using var database = new CultNetDatabase(cache, new CultNetDatabaseOptions
+            {
+                DocumentRegistry = documents
+            });
+            using var server = new RudpCultNetSchemaServer(new RudpCultNetSchemaServerOptions
+            {
+                RuntimeId = "database-schema-alias-subscription-server",
+                Socket = BindUdpSocket()
+            });
+            using var subscriptions = new CultNetDatabaseSubscriptionServer(server, database);
+            var descriptor = cache.Registry.GetRequired<NetworkSchemaNote>();
+            var change = new CultNetDatabaseChange<NetworkSchemaNote>(
+                CultNetDatabaseChangeKind.Added,
+                new CultRecordKey("tests:subscription-client:alias-note"),
+                descriptor.SchemaId,
+                database.Shards[0],
+                new NetworkSchemaNote { Schema = "tests.networking_note.v1", Text = "alias-live" },
+                previousDocument: null);
+            var method = typeof(CultNetDatabaseSubscriptionServer).GetMethod(
+                "CreateChange",
+                BindingFlags.Instance | BindingFlags.NonPublic)!;
+
+            var message = (CultNetDatabaseChangeRawMessage?)method.Invoke(subscriptions, new object[]
+            {
+                change,
+                new CultNetDatabaseSubscribeMessage
+                {
+                    SubscriptionId = "alias-notes",
+                    SchemaIds = ["tests.networking_note.v1"],
+                    RecordKeys = ["tests:subscription-client:alias-note"]
+                },
+                "alias-notes"
+            });
+
+            Assert.That(message, Is.Not.Null);
+            Assert.That(message!.Document!.SchemaId, Is.EqualTo(descriptor.SchemaId));
+            Assert.That(message.Document.SchemaName, Is.EqualTo(descriptor.SchemaName));
+            Assert.That(message.Document.SchemaVersion, Is.EqualTo(descriptor.SchemaVersion));
+            Assert.That(message.Document.SchemaContentHash, Is.EqualTo(descriptor.ContentHash));
+        }
+
+        [Test]
+        public async Task RudpCultNetSchemaServer_DeliversLargeSnapshotResponse()
+        {
+            using var server = new RudpCultNetSchemaServer(new RudpCultNetSchemaServerOptions
+            {
+                RuntimeId = "csharp-rudp-large-snapshot-host",
+                Socket = BindUdpSocket(),
+                MaxFragmentBytes = 1024,
+                MaxPendingReliablePackets = 1024
+            });
+            var responseCompletion = new TaskCompletionSource<CultNetSnapshotResponseRawMessage>(
+                TaskCreationOptions.RunContinuationsAsynchronously);
+            var serverFailure = new TaskCompletionSource<Exception>(TaskCreationOptions.RunContinuationsAsynchronously);
+            server.OnCultNet<CultNetSnapshotRequestMessage>((request, peer) => peer.SendCultNet(
+                new CultNetSnapshotResponseRawMessage
+                {
+                    MessageId = request.MessageId,
+                    Documents =
+                    [
+                        new CultNetRawDocumentRecord
+                        {
+                            SchemaId = "test.large.snapshot.v1",
+                            RecordKey = "test:large:snapshot",
+                            PayloadEncoding = "messagepack",
+                            Payload = Enumerable.Range(0, 128 * 1024)
+                                .Select(index => (byte)(index % 251)).ToArray()
+                        }
+                    ]
+                }));
+
+            using var cancellation = new CancellationTokenSource();
+            var serverThread = new Thread(() =>
+            {
+                try
+                {
+                    while (!cancellation.IsCancellationRequested)
+                    {
+                        _ = server.PollOnceAsync().GetAwaiter().GetResult();
+                        Thread.Sleep(1);
+                    }
+                }
+                catch (Exception error) { serverFailure.TrySetResult(error); }
+            }) { IsBackground = true };
+            serverThread.Start();
+
+            using var client = CultNetSchemaClients.CreateRudp(
+                runtimeId: "csharp-rudp-large-snapshot-client",
+                maxFragmentBytes: 1024);
+            client.OnCultNet<CultNetSnapshotResponseRawMessage>(response => responseCompletion.TrySetResult(response));
+            client.Connect("127.0.0.1", server.LocalEndPoint.Port);
+            await WaitUntilAsync(() => client.Connected, TimeSpan.FromSeconds(2));
+            client.SendCultNet(new CultNetSnapshotRequestMessage
+            {
+                MessageId = "large-snapshot",
+                SchemaIds = ["test.large.snapshot.v1"],
+                RecordKeys = ["test:large:snapshot"]
+            });
+
+            var completed = await Task.WhenAny(responseCompletion.Task, serverFailure.Task, Task.Delay(5000));
+            if (completed == serverFailure.Task) throw await serverFailure.Task;
+            if (completed != responseCompletion.Task)
+                Assert.Fail($"Large snapshot timed out; server sent {server.Stats.BytesSent} bytes, received {server.Stats.BytesReceived} bytes, transports {server.Profile.Transports.Count()}.");
+            var response = await AwaitWithTimeout(responseCompletion.Task, TimeSpan.FromMilliseconds(1));
+            await WaitUntilAsync(
+                () => server.Peers.Count == 1 && server.Peers.Single().PendingReliablePacketCount == 0,
+                TimeSpan.FromSeconds(2));
+            cancellation.Cancel();
+            Assert.That(response.Documents, Has.Length.EqualTo(1));
+            Assert.That(response.Documents[0].Payload, Has.Length.EqualTo(128 * 1024));
+            Assert.That(server.Stats.BytesSent, Is.LessThan(512 * 1024),
+                "A lossless large response must not remain trapped in the reliable resend queue.");
+        }
+
+        [Test]
+        public async Task RudpCultNetSchemaServer_SerializesConcurrentFragmentedSendsPerPeer()
+        {
+            const int publisherCount = 4;
+            const int messagesPerPublisher = 4;
+            const int expectedMessages = publisherCount * messagesPerPublisher;
+            using var server = new RudpCultNetSchemaServer(new RudpCultNetSchemaServerOptions
+            {
+                RuntimeId = "csharp-rudp-concurrent-publish-host",
+                Socket = BindUdpSocket(),
+                MaxFragmentBytes = 512,
+                MaxPendingReliablePackets = 1024
+            });
+            var receivedIds = new ConcurrentDictionary<string, byte>();
+            var receivedAll = new TaskCompletionSource<bool>(TaskCreationOptions.RunContinuationsAsynchronously);
+            var serverFailure = new TaskCompletionSource<Exception>(TaskCreationOptions.RunContinuationsAsynchronously);
+
+            using var cancellation = new CancellationTokenSource();
+            var serverThread = new Thread(() =>
+            {
+                try
+                {
+                    while (!cancellation.IsCancellationRequested)
+                    {
+                        _ = server.PollOnceAsync().GetAwaiter().GetResult();
+                        Thread.Sleep(1);
+                    }
+                }
+                catch (Exception error) { serverFailure.TrySetResult(error); }
+            }) { IsBackground = true };
+            serverThread.Start();
+
+            using var client = CultNetSchemaClients.CreateRudp(
+                runtimeId: "csharp-rudp-concurrent-publish-client",
+                maxFragmentBytes: 512);
+            client.OnCultNet<CultNetSnapshotResponseRawMessage>(response =>
+            {
+                if (receivedIds.TryAdd(response.MessageId, 0) && receivedIds.Count == expectedMessages)
+                    receivedAll.TrySetResult(true);
+            });
+            client.Connect("127.0.0.1", server.LocalEndPoint.Port);
+            await WaitUntilAsync(() => client.Connected && server.Peers.Count == 1, TimeSpan.FromSeconds(2));
+            var peer = server.Peers.Single();
+            using var sendBarrier = new Barrier(publisherCount);
+
+            await Task.WhenAll(Enumerable.Range(0, publisherCount).Select(publisher => Task.Run(() =>
+            {
+                sendBarrier.SignalAndWait();
+                for (var message = 0; message < messagesPerPublisher; message++)
+                {
+                    var messageId = $"publisher-{publisher}-message-{message}";
+                    server.SendCultNet(peer, new CultNetSnapshotResponseRawMessage
+                    {
+                        MessageId = messageId,
+                        Documents =
+                        [
+                            new CultNetRawDocumentRecord
+                            {
+                                SchemaId = "test.concurrent.publish.v1",
+                                RecordKey = $"test:concurrent:{messageId}",
+                                PayloadEncoding = "messagepack",
+                                Payload = Enumerable.Range(0, 4 * 1024)
+                                    .Select(index => (byte)((index + publisher + message) % 251)).ToArray()
+                            }
+                        ]
+                    });
+                }
+            })));
+
+            var completed = await Task.WhenAny(receivedAll.Task, serverFailure.Task, Task.Delay(5000));
+            if (completed == serverFailure.Task) throw await serverFailure.Task;
+            if (completed != receivedAll.Task)
+                Assert.Fail($"Concurrent publish timed out after receiving {receivedIds.Count} of {expectedMessages} logical messages.");
+            cancellation.Cancel();
+
+            Assert.That(receivedIds.Count, Is.EqualTo(expectedMessages));
         }
 
         [Test]
@@ -1750,6 +3067,59 @@ namespace GameCult.Networking.Tests
             Assert.That(changes[0].Document!.Username, Is.EqualTo("Raw"));
         }
 
+        [Test]
+        public async Task CultNetDatabase_ApplyRawPut_ResolvesForeignSchemaIdFromPayload()
+        {
+            var cache = new CultCache();
+            var registry = new CultNetDocumentRegistry(cache.Registry)
+                .Register(CultNetDocumentBinding.ForDocument<NetworkSchemaNote>(cache.Registry));
+            var descriptor = cache.Registry.GetRequired<NetworkSchemaNote>();
+            var shard = new CultNetShardDescriptor(
+                "network-notes",
+                "runtime-a",
+                epoch: 3,
+                isPrimary: true,
+                schemaIds: [descriptor.SchemaId],
+                keyPrefix: "network-note:",
+                primaryEndpoints: ["cultnet://runtime-a:3075"]);
+            var database = new CultNetDatabase(cache, new CultNetDatabaseOptions
+            {
+                DocumentRegistry = registry,
+                Shards = [shard]
+            });
+            var key = new CultRecordKey("network-note:foreign-schema-put");
+            var changes = new List<CultNetDatabaseChange<NetworkSchemaNote>>();
+            using var subscription = database.WatchRecord<NetworkSchemaNote>(key)
+                .Subscribe(change => changes.Add(change));
+            var message = new CultNetDocumentPutRawMessage
+            {
+                MessageId = "put-foreign-schema",
+                ShardId = shard.ShardId,
+                ShardEpoch = shard.Epoch,
+                Document = new CultNetRawDocumentRecord
+                {
+                    SchemaId = "runtime.generated.network-note.ui.42",
+                    RecordKey = key.Value,
+                    StoredAt = DateTimeOffset.UtcNow.ToString("O"),
+                    PayloadEncoding = "messagepack",
+                    Payload = CultDocumentMessagePackSerialization.SerializeUntyped(new NetworkSchemaNote
+                    {
+                        Schema = "tests.networking_note.v1",
+                        Text = "payload-routed",
+                        Revision = 5
+                    }, typeof(NetworkSchemaNote))
+                }
+            };
+
+            var applied = await database.ApplyPutAsync(message);
+
+            Assert.That(applied, Is.TypeOf<NetworkSchemaNote>());
+            Assert.That(cache.Get<NetworkSchemaNote>(key)!.Text, Is.EqualTo("payload-routed"));
+            Assert.That(changes, Has.Count.EqualTo(1));
+            Assert.That(changes[0].SchemaId, Is.EqualTo(descriptor.SchemaId));
+            Assert.That(changes[0].Document!.Revision, Is.EqualTo(5));
+        }
+
         [Test]
         public async Task CultNetDatabaseServer_Creates_Filtered_SnapshotResponse()
         {
@@ -1784,6 +3154,216 @@ namespace GameCult.Networking.Tests
             Assert.That(response.Documents[0].Payload, Is.EqualTo(SerializePlayerDataPayload(player)));
         }
 
+        [Test]
+        public async Task CultNetDatabaseServer_Creates_SnapshotResponse_ForCompatibleSchemaAlias()
+        {
+            var cache = new CultCache();
+            var registry = new CultNetDocumentRegistry(cache.Registry)
+                .Register(CultNetDocumentBinding.ForDocument<NetworkSchemaNote>(cache.Registry));
+            var database = new CultNetDatabase(cache, new CultNetDatabaseOptions
+            {
+                DocumentRegistry = registry
+            });
+            using var server = new Server(cache, DevelopmentServerSecurity);
+            using var databaseServer = new CultNetDatabaseServer(server, database);
+            var key = new CultRecordKey("network-note:alias-snapshot");
+            var note = new NetworkSchemaNote
+            {
+                Schema = "tests.networking_note.v1",
+                Text = "alias snapshot",
+                Revision = 7
+            };
+            await database.PutAsync(key, note);
+
+            var response = databaseServer.CreateSnapshotResponse(registry.CreateSnapshotRequest(
+                "snapshot-alias-request",
+                schemaIds: ["tests.networking_note.v1"],
+                recordKeys: [key.Value]));
+
+            Assert.That(response.Documents, Has.Length.EqualTo(1));
+            Assert.That(response.Documents[0].RecordKey, Is.EqualTo(key.Value));
+            Assert.That(response.Documents[0].Payload, Is.EqualTo(CultDocumentMessagePackSerialization.SerializeUntyped(note, note.GetType())));
+        }
+
+        [Test]
+        public async Task CultNetDatabase_Creates_ShardSnapshotResponse_ForCompatibleSchemaAlias()
+        {
+            var cache = new CultCache();
+            var registry = new CultNetDocumentRegistry(cache.Registry)
+                .Register(CultNetDocumentBinding.ForDocument<NetworkSchemaNote>(cache.Registry));
+            var descriptor = cache.Registry.GetRequired<NetworkSchemaNote>();
+            var shard = new CultNetShardDescriptor(
+                "network-notes",
+                "runtime-a",
+                epoch: 4,
+                isPrimary: true,
+                schemaIds: [descriptor.SchemaId],
+                keyPrefix: "network-note:",
+                primaryEndpoints: ["cultnet://runtime-a:3075"]);
+            var database = new CultNetDatabase(cache, new CultNetDatabaseOptions
+            {
+                DocumentRegistry = registry,
+                Shards = [shard]
+            });
+            var key = new CultRecordKey("network-note:alias-shard-snapshot");
+            var note = new NetworkSchemaNote
+            {
+                Schema = "tests.networking_note.v1",
+                Text = "alias shard snapshot",
+                Revision = 8
+            };
+            await database.PutAsync(key, note);
+
+            var response = database.CreateShardSnapshotResponse(
+                shard,
+                "snapshot-shard-alias-request",
+                registry.CreateSnapshotRequest(
+                    "snapshot-shard-alias-request",
+                    schemaIds: ["tests.networking_note.v1"],
+                    recordKeys: [key.Value]));
+
+            Assert.That(response.Documents, Has.Length.EqualTo(1));
+            Assert.That(response.Documents[0].RecordKey, Is.EqualTo(key.Value));
+            Assert.That(response.Documents[0].Payload, Is.EqualTo(CultDocumentMessagePackSerialization.SerializeUntyped(note, note.GetType())));
+        }
+
+        [Test]
+        public async Task CultNetDatabase_Routes_TypedWrite_ToShardSchemaAlias()
+        {
+            var cache = new CultCache();
+            var registry = new CultNetDocumentRegistry(cache.Registry)
+                .Register(CultNetDocumentBinding.ForDocument<NetworkSchemaNote>(cache.Registry));
+            var database = new CultNetDatabase(cache, new CultNetDatabaseOptions
+            {
+                DocumentRegistry = registry,
+                Shards =
+                [
+                    new CultNetShardDescriptor(
+                        "wrong-network-notes",
+                        "runtime-b",
+                        epoch: 1,
+                        isPrimary: false,
+                        schemaIds: ["other.note.v1"],
+                        keyPrefix: "network-note:"),
+                    new CultNetShardDescriptor(
+                        "network-notes",
+                        "runtime-a",
+                        epoch: 2,
+                        isPrimary: true,
+                        schemaIds: ["tests.networking_note.v1"],
+                        keyPrefix: "network-note:")
+                ]
+            });
+            var key = new CultRecordKey("network-note:alias-routed-write");
+
+            await database.PutAsync(key, new NetworkSchemaNote
+            {
+                Schema = "tests.networking_note.v1",
+                Text = "typed write routed by alias",
+                Revision = 12
+            });
+
+            Assert.That(cache.Get<NetworkSchemaNote>(key)!.Text, Is.EqualTo("typed write routed by alias"));
+            Assert.That(database.GetMutationLog("network-notes"), Has.Count.EqualTo(1));
+            Assert.That(database.GetMutationLog("wrong-network-notes"), Is.Empty);
+        }
+
+        [Test]
+        public async Task CultNetDatabase_Applies_Delete_BySchemaAlias()
+        {
+            var cache = new CultCache();
+            var registry = new CultNetDocumentRegistry(cache.Registry)
+                .Register(CultNetDocumentBinding.ForDocument<NetworkSchemaNote>(cache.Registry));
+            var database = new CultNetDatabase(cache, new CultNetDatabaseOptions
+            {
+                DocumentRegistry = registry,
+                Shards =
+                [
+                    new CultNetShardDescriptor(
+                        "wrong-network-notes",
+                        "runtime-b",
+                        epoch: 1,
+                        isPrimary: false,
+                        schemaIds: ["other.note.v1"],
+                        keyPrefix: "network-note:"),
+                    new CultNetShardDescriptor(
+                        "network-notes",
+                        "runtime-a",
+                        epoch: 2,
+                        isPrimary: true,
+                        schemaIds: ["tests.networking_note.v1"],
+                        keyPrefix: "network-note:")
+                ]
+            });
+            var key = new CultRecordKey("network-note:alias-delete");
+            await database.PutAsync(key, new NetworkSchemaNote
+            {
+                Schema = "tests.networking_note.v1",
+                Text = "delete through alias",
+                Revision = 13
+            });
+
+            await database.ApplyDeleteAsync(new CultNetDocumentDeleteMessage
+            {
+                MessageId = "delete-alias",
+                SchemaId = "tests.networking_note.v1",
+                RecordKey = key.Value,
+                ShardId = "network-notes",
+                ShardEpoch = 2
+            });
+
+            Assert.That(cache.Get<NetworkSchemaNote>(key), Is.Null);
+            Assert.That(database.GetMutationLog("network-notes").Last().Kind, Is.EqualTo(CultNetDatabaseChangeKind.Removed));
+            Assert.That(database.GetMutationLog("wrong-network-notes"), Is.Empty);
+        }
+
+        [Test]
+        public async Task CultNetDatabase_Predicts_ClientOwnedInput_ThroughSchemaAliasScope()
+        {
+            var cache = new CultCache();
+            var registry = new CultNetDocumentRegistry(cache.Registry)
+                .Register(CultNetDocumentBinding.ForDocument<NetworkSchemaNote>(cache.Registry));
+            var database = new CultNetDatabase(cache, new CultNetDatabaseOptions
+            {
+                RuntimeId = "pilot-a",
+                DocumentRegistry = registry,
+                Shards =
+                [
+                    new CultNetShardDescriptor(
+                        "wrong-network-inputs",
+                        "server",
+                        epoch: 1,
+                        isPrimary: false,
+                        schemaIds: ["other.note.v1"],
+                        keyPrefix: "network-input:"),
+                    new CultNetShardDescriptor(
+                        "network-inputs",
+                        "server",
+                        epoch: 1,
+                        isPrimary: false,
+                        schemaIds: ["tests.networking_note.v1"],
+                        keyPrefix: "network-input:")
+                ],
+                ClientAuthorityScopes =
+                [
+                    new CultNetClientAuthorityScope(
+                        "pilot-a",
+                        schemaIds: ["tests.networking_note.v1"],
+                        keyPrefix: "network-input:pilot-a")
+                ]
+            });
+            var key = new CultRecordKey("network-input:pilot-a:alias-prediction");
+
+            await database.PutPredictedAsync(key, new NetworkSchemaNote
+            {
+                Schema = "tests.networking_note.v1",
+                Text = "predicted through alias scope",
+                Revision = 1
+            });
+
+            Assert.That(cache.Get<NetworkSchemaNote>(key)!.Text, Is.EqualTo("predicted through alias scope"));
+        }
+
         [Test]
         public void CultNetDatabaseServer_Creates_Filtered_ShardCatalogResponse()
         {
@@ -1829,6 +3409,16 @@ namespace GameCult.Networking.Tests
             Assert.That(response.Shards[0].Epoch, Is.EqualTo(3));
             Assert.That(response.Shards[0].PrimaryEndpoints, Is.EqualTo(["cultnet://runtime-a:3075"]));
             Assert.That(response.Shards[0].ReadReplicaEndpoints, Is.EqualTo(["cultnet://edge-a:3075"]));
+
+            var aliasResponse = databaseServer.CreateShardCatalogResponse(new CultNetShardCatalogRequestMessage
+            {
+                MessageId = "catalog-players-alias",
+                SchemaIds = ["gamecult.player_data.v2"],
+                RecordKeys = ["player:one"]
+            });
+
+            Assert.That(aliasResponse.Shards, Has.Length.EqualTo(1));
+            Assert.That(aliasResponse.Shards[0].ShardId, Is.EqualTo("players"));
         }
 
         [Test]
@@ -2216,6 +3806,71 @@ namespace GameCult.Networking.Tests
             Assert.That(response.Verses.Single().VerseId, Is.EqualTo("local"));
         }
 
+        [Test]
+        public async Task CultMeshVerseDiscoveryClient_ReportsDeterministicConnectionFailureTimeline()
+        {
+            var clock = new ManualCultMeshClock(new DateTimeOffset(2026, 7, 12, 18, 0, 0, TimeSpan.Zero));
+            var diagnostics = new CultMeshDiagnosticBuffer();
+            var client = new CultMeshVerseDiscoveryClient(new CultMeshVerseDiscoveryClientOptions
+            {
+                CreateClient = () => new NeverConnectedSchemaClient(),
+                Clock = clock,
+                Diagnostics = diagnostics,
+                SourceId = "test-bootstrap",
+                ConnectTimeout = TimeSpan.FromMilliseconds(50)
+            });
+
+            var error = Assert.ThrowsAsync<TimeoutException>(() =>
+                client.FetchAsync("rudp://unavailable.example.test:4075"));
+            Assert.That(error!.Message, Does.Contain("unavailable.example.test"));
+
+            var timeline = diagnostics.Snapshot();
+            Assert.That(timeline.Select(item => item.Kind), Is.EqualTo(new[]
+            {
+                CultMeshDiagnosticKind.ConnectionAttempt,
+                CultMeshDiagnosticKind.CandidateRejected
+            }));
+            Assert.That(timeline[0].ObservedAtUtc, Is.EqualTo(new DateTimeOffset(2026, 7, 12, 18, 0, 0, TimeSpan.Zero)));
+            Assert.That(timeline[1].ObservedAtUtc, Is.EqualTo(new DateTimeOffset(2026, 7, 12, 18, 0, 0, 50, TimeSpan.Zero)));
+            Assert.That(timeline[1].State, Is.EqualTo("unavailable"));
+            Assert.That(timeline[1].ReasonCode, Is.EqualTo("timeout"));
+            Assert.That(timeline[1].SourceId, Is.EqualTo("test-bootstrap"));
+            Assert.That(timeline[1].LibraryVersion, Is.Not.Empty);
+        }
+
+        [Test]
+        public async Task CultMeshVerseDiscoveryClient_CompatibilityDiscoveryKeepsGoodConcurrentSource()
+        {
+            var clients = new ConcurrentQueue<ICultNetSchemaClient>();
+            clients.Enqueue(new NeverConnectedSchemaClient());
+            clients.Enqueue(new CapturingSchemaClient(message =>
+            {
+                var request = (CultMeshVerseCatalogRequestMessage)message;
+                return new CultMeshVerseCatalogResponseMessage
+                {
+                    MessageId = request.MessageId,
+                    Verses = [new CultMeshVerseDescriptor(
+                        "aetheria", "Aetheria", CultMeshVerseAuthorityModel.OperatorCluster,
+                        new CultMeshVerseCompatibility("cultmesh.v0", "rules"),
+                        discoveryEndpoints: ["rudp://aetheria:3076"]).ToMessage()]
+                };
+            }));
+            var client = new CultMeshVerseDiscoveryClient(new CultMeshVerseDiscoveryClientOptions
+            {
+                CreateClient = () => clients.TryDequeue(out var next) ? next : throw new InvalidOperationException("Unexpected client."),
+                Clock = new ManualCultMeshClock(new DateTimeOffset(2026, 7, 12, 18, 0, 0, TimeSpan.Zero)),
+                ConnectTimeout = TimeSpan.FromMilliseconds(50)
+            });
+            using var catalog = new CultMeshVerseCatalog();
+
+            var count = await client.DiscoverAsync(
+                catalog,
+                new[] { "rudp://dead.example.test:4075", "rudp://good.example.test:4075" });
+
+            Assert.That(count, Is.EqualTo(1));
+            Assert.That(catalog.Verses.Single().VerseId, Is.EqualTo("aetheria"));
+        }
+
         [Test]
         public async Task CultMeshPeerExchangeClient_Uses_SchemaClientPort()
         {
@@ -2338,8 +3993,19 @@ namespace GameCult.Networking.Tests
                 "Aetheria",
                 CultMeshVerseAuthorityModel.OperatorCluster,
                 new CultMeshVerseCompatibility("cultmesh.v0", vanillaRules),
-                discoveryEndpoints: ["cultmesh://aetheria.example.test:3075"],
-                authorityRuntimeIds: ["gc-us-east", "gc-eu-west"]);
+                authorityRoutes:
+                [
+                    new CultMeshAuthorityRoute(
+                        "gc-us-east",
+                        "cultmesh://us-east.aetheria.example.test:3075",
+                        [CultMeshProtocols.Documents.Value],
+                        generation: "east-1"),
+                    new CultMeshAuthorityRoute(
+                        "gc-eu-west",
+                        "cultmesh://eu-west.aetheria.example.test:3075",
+                        [CultMeshProtocols.Documents.Value],
+                        generation: "west-1")
+                ]);
             var modded = new CultMeshVerseDescriptor(
                 "aetheria-skylands",
                 "Aetheria: Skylands",
@@ -2506,10 +4172,15 @@ namespace GameCult.Networking.Tests
         }
 
         [Test]
-        public void CultMeshAuthorityLeaseCatalog_Authorizes_PeerRoleAndShard()
+        public void CultMeshAuthorityResolver_Authorizes_PeerRoleAndShard()
         {
             var now = DateTimeOffset.Parse("2026-05-20T12:00:00.0000000Z");
             var catalog = CultMesh.CreateAuthorityLeaseCatalog();
+            var resolver = new CultMeshAuthorityResolver(
+                catalog,
+                new AcceptingAuthoritySignatureVerifier(),
+                new NoAuthorityRevocations(),
+                new ManualCultMeshClock(now));
             using var peers = CultMesh.CreatePeerCatalog();
             var peer = new CultMeshPeerCard(
                 "peer-primary",
@@ -2520,7 +4191,8 @@ namespace GameCult.Networking.Tests
                 authorityLeaseId: "lease-primary");
             peers.Upsert(peer);
 
-            Assert.That(peers.FindAuthorized("aetheria-main", CultMeshPeerRoles.ShardPrimary, catalog, "players-us-east", now), Is.Empty);
+            Assert.That(peers.FindAuthorized(
+                "aetheria-main", CultMeshPeerRoles.ShardPrimary, resolver, 1, "players-us-east"), Is.Empty);
             catalog.Upsert(new CultMeshAuthorityLease(
                 "lease-primary",
                 "aetheria-main",
@@ -2530,15 +4202,30 @@ namespace GameCult.Networking.Tests
                 "gc-operator",
                 now.AddMinutes(-5),
                 now.AddMinutes(5),
-                signature: "sig"));
+                signature: "sig",
+                authorityEpoch: 1));
 
-            Assert.That(catalog.IsAuthorized(peer, CultMeshPeerRoles.ShardPrimary, "players-us-east", now), Is.True);
-            Assert.That(peers.FindAuthorized("aetheria-main", CultMeshPeerRoles.ShardPrimary, catalog, "players-us-east", now).Single(), Is.SameAs(peer));
-            Assert.That(peers.FirstAuthorized("aetheria-main", CultMeshPeerRoles.ShardPrimary, catalog, "players-us-east", now), Is.SameAs(peer));
-            Assert.That(peers.FirstAuthorized("aetheria-main", CultMeshPeerRoles.ReadReplica, catalog, "players-us-east", now), Is.Null);
-            Assert.That(catalog.IsAuthorized(peer, CultMeshPeerRoles.ShardPrimary, "players-eu", now), Is.False);
-            Assert.That(catalog.IsAuthorized(peer, CultMeshPeerRoles.ReadReplica, "players-us-east", now), Is.False);
-            Assert.That(catalog.IsAuthorized(peer, CultMeshPeerRoles.ShardPrimary, "players-us-east", now.AddMinutes(6)), Is.False);
+            Assert.That(resolver.Resolve(new CultMeshAuthorityRequest(
+                peer, CultMeshPeerRoles.ShardPrimary, "players-us-east", 1)).IsAuthorized, Is.True);
+            Assert.That(peers.FindAuthorized(
+                "aetheria-main", CultMeshPeerRoles.ShardPrimary, resolver, 1, "players-us-east").Single(), Is.SameAs(peer));
+            Assert.That(peers.FirstAuthorized(
+                "aetheria-main", CultMeshPeerRoles.ShardPrimary, resolver, 1, "players-us-east"), Is.SameAs(peer));
+            Assert.That(peers.FirstAuthorized(
+                "aetheria-main", CultMeshPeerRoles.ReadReplica, resolver, 1, "players-us-east"), Is.Null);
+            Assert.That(resolver.Resolve(new CultMeshAuthorityRequest(
+                peer, CultMeshPeerRoles.ShardPrimary, "players-eu", 1)).IsAuthorized, Is.False);
+            Assert.That(resolver.Resolve(new CultMeshAuthorityRequest(
+                peer, CultMeshPeerRoles.ReadReplica, "players-us-east", 1)).IsAuthorized, Is.False);
+#pragma warning disable CS0618
+            Assert.That(catalog.IsAuthorized(peer, CultMeshPeerRoles.ShardPrimary, "players-us-east", now), Is.False);
+#pragma warning restore CS0618
+        }
+
+        [Test]
+        public void CultMeshRudpClient_DefaultBindAllowsRemoteRoutes()
+        {
+            Assert.That(new CultMeshRudpSocketOptions().BindHost, Is.EqualTo("0.0.0.0"));
         }
 
         [Test]
@@ -2564,6 +4251,11 @@ namespace GameCult.Networking.Tests
             using var peers = CultMesh.CreatePeerCatalog();
             var leases = CultMesh.CreateAuthorityLeaseCatalog();
             var now = DateTimeOffset.UtcNow;
+            var authority = new CultMeshAuthorityResolver(
+                leases,
+                new AcceptingAuthoritySignatureVerifier(),
+                new NoAuthorityRevocations(),
+                new ManualCultMeshClock(now));
             var peer = new CultMeshPeerCard(
                 "csharp-cultmesh-rudp-server",
                 "local",
@@ -2576,10 +4268,10 @@ namespace GameCult.Networking.Tests
                 "csharp-cultmesh-rudp-client",
                 connectionId,
                 peers,
-                leases,
+                authority,
+                1,
                 "local",
                 "schema",
-                at: now,
                 options: new CultMeshRudpSocketOptions
                 {
                     ResendDelayMs = 25,
@@ -2595,7 +4287,9 @@ namespace GameCult.Networking.Tests
                 [],
                 "csharp-authority",
                 now.AddSeconds(-1),
-                now.AddSeconds(30)));
+                now.AddSeconds(30),
+                signature: "sig",
+                authorityEpoch: 1));
 
             using var serverPumpCts = new CancellationTokenSource();
             var serverPump = Task.Run(() =>
@@ -2612,10 +4306,10 @@ namespace GameCult.Networking.Tests
                 "csharp-cultmesh-rudp-client",
                 connectionId,
                 peers,
-                leases,
+                authority,
+                1,
                 "local",
                 "schema",
-                at: now,
                 options: new CultMeshRudpClientOptions
                 {
                     ConnectPayload = Encoding.UTF8.GetBytes("join"),
@@ -3903,6 +5597,57 @@ namespace GameCult.Networking.Tests
             Assert.That(message.Document!.Payload, Is.EqualTo(SerializePlayerDataPayload(player)));
         }
 
+        [Test]
+        public void CultNetDatabaseServer_Creates_Filtered_SubscriptionChange_ForSchemaAlias()
+        {
+            var cache = new CultCache();
+            var registry = new CultNetDocumentRegistry(cache.Registry)
+                .Register(CultNetDocumentBinding.ForDocument<NetworkSchemaNote>(cache.Registry));
+            var database = new CultNetDatabase(cache, new CultNetDatabaseOptions
+            {
+                DocumentRegistry = registry
+            });
+            using var server = new Server(cache, DevelopmentServerSecurity);
+            using var databaseServer = new CultNetDatabaseServer(server, database);
+            var key = new CultRecordKey("network-note:alias-change");
+            var note = new NetworkSchemaNote
+            {
+                Schema = "tests.networking_note.v1",
+                Text = "alias change",
+                Revision = 11
+            };
+            var descriptor = cache.Registry.GetRequired<NetworkSchemaNote>();
+            var change = new CultNetDatabaseChange<NetworkSchemaNote>(
+                CultNetDatabaseChangeKind.Added,
+                key,
+                descriptor.SchemaId,
+                database.Shards[0],
+                note,
+                previousDocument: null);
+            var method = typeof(CultNetDatabaseServer).GetMethod(
+                "CreateChangeMessage",
+                BindingFlags.Instance | BindingFlags.NonPublic)!;
+
+            var message = (CultNetDatabaseChangeRawMessage?)method.Invoke(databaseServer, new object[]
+            {
+                change,
+                "sub-alias",
+                new CultNetDatabaseSubscribeMessage
+                {
+                    SubscriptionId = "sub-alias",
+                    SchemaIds = ["tests.networking_note.v1"],
+                    RecordKeys = [key.Value]
+                }
+            });
+
+            Assert.That(message, Is.Not.Null);
+            Assert.That(message!.SubscriptionId, Is.EqualTo("sub-alias"));
+            Assert.That(message.ChangeKind, Is.EqualTo("added"));
+            Assert.That(message.Document, Is.Not.Null);
+            Assert.That(message.Document!.SchemaId, Is.EqualTo(descriptor.SchemaId));
+            Assert.That(message.Document.Payload, Is.EqualTo(CultDocumentMessagePackSerialization.SerializeUntyped(note, note.GetType())));
+        }
+
         [Test]
         public void CultNetSchemaRegistry_BuiltInCatalog_AdvertisesRawLane_AndSharedGhostlightContract()
         {
@@ -3917,6 +5662,12 @@ namespace GameCult.Networking.Tests
                 schema => schema.SchemaVersion == CultNetSchemaVersions.DocumentPutRaw);
             var rawSnapshot = Array.Find(response.Schemas,
                 schema => schema.SchemaVersion == CultNetSchemaVersions.SnapshotResponseRaw);
+            var subscribe = Array.Find(response.Schemas,
+                schema => schema.SchemaVersion == CultNetSchemaVersions.DatabaseSubscribe);
+            var unsubscribe = Array.Find(response.Schemas,
+                schema => schema.SchemaVersion == CultNetSchemaVersions.DatabaseUnsubscribe);
+            var change = Array.Find(response.Schemas,
+                schema => schema.SchemaVersion == CultNetSchemaVersions.DatabaseChangeRaw);
             var ghostlight = Array.Find(response.Schemas,
                 schema => schema.SchemaVersion == "ghostlight.agent_state.v0");
             var transportProfile = Array.Find(response.Schemas,
@@ -3930,6 +5681,13 @@ namespace GameCult.Networking.Tests
             Assert.That(rawSnapshot, Is.Not.Null);
             Assert.That(rawSnapshot!.SchemaJson, Does.Contain("cultnet.snapshot_response_raw.v0"));
 
+            Assert.That(subscribe, Is.Not.Null);
+            Assert.That(subscribe!.SchemaJson, Does.Contain("cultnet.database_subscribe.v0"));
+            Assert.That(unsubscribe, Is.Not.Null);
+            Assert.That(unsubscribe!.SchemaJson, Does.Contain("cultnet.database_unsubscribe.v0"));
+            Assert.That(change, Is.Not.Null);
+            Assert.That(change!.SchemaJson, Does.Contain("cultnet.database_change_raw.v0"));
+
             Assert.That(ghostlight, Is.Not.Null);
             Assert.That(ghostlight!.DocumentType, Is.EqualTo("ghostlight.agent-state"));
             Assert.That(ghostlight.Kind, Is.EqualTo("document_payload"));
@@ -4126,6 +5884,20 @@ namespace GameCult.Networking.Tests
             public string Body { get; set; } = string.Empty;
         }
 
+        [CultDocument("tests.networking_note", "tests.networking_note.v1")]
+        [MessagePack.MessagePackObject]
+        public sealed class NetworkSchemaNote
+        {
+            [MessagePack.Key(0)]
+            public string Schema { get; set; } = string.Empty;
+
+            [MessagePack.Key(1)]
+            public string Text { get; set; } = string.Empty;
+
+            [MessagePack.Key(2)]
+            public int Revision { get; set; }
+        }
+
         private sealed class EnvironmentVariableScope : IDisposable
         {
             private readonly (string Name, string? Value)[] _originalValues;
@@ -4274,6 +6046,56 @@ namespace GameCult.Networking.Tests
             }
         }
 
+        private sealed class NeverConnectedSchemaClient : ICultNetSchemaClient
+        {
+            public bool Connected => false;
+
+            public void Connect(string host, int port)
+            {
+            }
+
+            public void SendCultNet<T>(T message) where T : ICultNetSchemaMessage
+            {
+                throw new InvalidOperationException("A disconnected client cannot send.");
+            }
+
+            public void OnCultNet<T>(Action<T> callback) where T : ICultNetSchemaMessage
+            {
+            }
+
+            public void Dispose()
+            {
+            }
+        }
+
+        private sealed class ManualCultMeshClock : ICultMeshClock
+        {
+            public ManualCultMeshClock(DateTimeOffset utcNow)
+            {
+                UtcNow = utcNow;
+            }
+
+            public DateTimeOffset UtcNow { get; private set; }
+
+            public Task DelayAsync(TimeSpan delay, CancellationToken cancellationToken = default)
+            {
+                cancellationToken.ThrowIfCancellationRequested();
+                UtcNow += delay;
+                return Task.CompletedTask;
+            }
+        }
+
+        private sealed class AcceptingAuthoritySignatureVerifier : ICultMeshAuthoritySignatureVerifier
+        {
+            public bool Verify(CultMeshAuthorityLease lease) =>
+                string.Equals(lease.Signature, "sig", StringComparison.Ordinal);
+        }
+
+        private sealed class NoAuthorityRevocations : ICultMeshAuthorityRevocationSource
+        {
+            public bool IsRevoked(string leaseId, long authorityEpoch) => false;
+        }
+
         [MessagePack.MessagePackObject]
         public sealed class PlayerDataPayload
         {
diff --git a/tests/GameCult.Networking.Tests/lcov.info b/tests/GameCult.Networking.Tests/lcov.info
deleted file mode 100644
index e3ad6370..00000000
--- a/tests/GameCult.Networking.Tests/lcov.info
+++ /dev/null
@@ -1,2537 +0,0 @@
-SF:e:\Projects\CultLib\src\GameCult.Caching\ReflectionExtensions.cs
-FN:12,System.Type[] ReflectionExtensions::GetAllInterfaceClasses(System.Type)
-FNDA:0,System.Type[] ReflectionExtensions::GetAllInterfaceClasses(System.Type)
-DA:13,0
-DA:14,0
-DA:15,0
-DA:16,0
-DA:17,0
-DA:18,0
-BRDA:14,32,0,0
-BRDA:14,32,1,0
-BRDA:17,6,0,0
-BRDA:17,6,1,0
-FN:22,System.Type[] ReflectionExtensions::GetParentTypes(System.Type)
-FNDA:0,System.Type[] ReflectionExtensions::GetParentTypes(System.Type)
-DA:23,0
-DA:24,0
-DA:25,0
-DA:26,0
-DA:27,0
-BRDA:24,14,0,0
-BRDA:24,14,1,0
-FN:55,System.Type[] ReflectionExtensions::GetAllChildClasses(System.Type)
-FNDA:0,System.Type[] ReflectionExtensions::GetAllChildClasses(System.Type)
-DA:56,0
-DA:57,0
-DA:58,0
-DA:59,0
-DA:60,0
-DA:61,0
-BRDA:57,14,0,0
-BRDA:57,14,1,0
-FN:64,System.Type[] ReflectionExtensions::GetAllGenericChildClasses(System.Type)
-FNDA:0,System.Type[] ReflectionExtensions::GetAllGenericChildClasses(System.Type)
-DA:65,0
-DA:66,0
-DA:67,0
-DA:68,0
-DA:69,0
-DA:70,0
-BRDA:66,32,0,0
-BRDA:66,32,1,0
-FN:72,System.Boolean ReflectionExtensions::IsAssignableToGenericType(System.Type,System.Type)
-FNDA:0,System.Boolean ReflectionExtensions::IsAssignableToGenericType(System.Type,System.Type)
-DA:73,0
-DA:74,0
-DA:76,0
-DA:77,0
-DA:78,0
-DA:79,0
-DA:80,0
-DA:82,0
-DA:83,0
-DA:85,0
-DA:86,0
-DA:88,0
-DA:89,0
-BRDA:76,66,1,0
-BRDA:78,28,0,0
-BRDA:78,28,1,0
-BRDA:78,50,0,0
-BRDA:78,50,1,0
-BRDA:76,66,0,0
-BRDA:82,74,0,0
-BRDA:82,74,1,0
-BRDA:82,95,0,0
-BRDA:82,95,1,0
-BRDA:86,120,0,0
-BRDA:86,120,1,0
-FN:91,System.String ReflectionExtensions::SplitCamelCase(System.String)
-FNDA:0,System.String ReflectionExtensions::SplitCamelCase(System.String)
-DA:92,0
-DA:93,0
-DA:94,0
-DA:95,0
-DA:96,0
-DA:97,0
-DA:98,0
-DA:99,0
-DA:100,0
-DA:101,0
-DA:102,0
-FN:104,System.String ReflectionExtensions::FormatTypeName(System.String)
-FNDA:0,System.String ReflectionExtensions::FormatTypeName(System.String)
-DA:105,0
-DA:106,0
-DA:107,0
-DA:108,0
-DA:109,0
-BRDA:106,13,0,0
-BRDA:106,13,1,0
-FN:111,System.String ReflectionExtensions::GetFullName(System.Type)
-FNDA:0,System.String ReflectionExtensions::GetFullName(System.Type)
-DA:112,0
-DA:113,0
-DA:114,0
-DA:116,0
-DA:117,0
-DA:118,0
-DA:119,0
-BRDA:113,12,0,0
-BRDA:113,12,1,0
-BRDA:118,12,0,0
-BRDA:118,12,1,0
-FN:10,System.Void ReflectionExtensions::.cctor()
-FNDA:0,System.Void ReflectionExtensions::.cctor()
-DA:11,0
-DA:20,0
-DA:54,0
-DA:63,0
-FN:29,System.Boolean ReflectionExtensions/<GetParents>d__4::MoveNext()
-FNDA:0,System.Boolean ReflectionExtensions/<GetParents>d__4::MoveNext()
-DA:30,0
-DA:32,0
-DA:33,0
-DA:34,0
-DA:37,0
-DA:40,0
-DA:41,0
-DA:42,0
-DA:43,0
-DA:46,0
-DA:47,0
-DA:48,0
-DA:49,0
-DA:50,0
-DA:51,0
-DA:52,0
-BRDA:32,69,0,0
-BRDA:32,69,1,0
-BRDA:40,213,1,0
-BRDA:40,213,0,0
-BRDA:47,302,1,0
-BRDA:47,302,0,0
-LF:79
-LH:0
-BRF:34
-BRH:0
-FNF:10
-FNH:0
-end_of_record
-SF:e:\Projects\CultLib\obj\src\GameCult.Caching\Debug\netstandard2.1\MessagePack.SourceGenerator\MessagePack.SourceGenerator.MessagePackGenerator\MessagePack.GeneratedMessagePackResolver.g.cs
-FN:21,MessagePack.Formatters.IMessagePackFormatter`1<T> MessagePack.GeneratedMessagePackResolver::GetFormatter()
-FNDA:0,MessagePack.Formatters.IMessagePackFormatter`1<T> MessagePack.GeneratedMessagePackResolver::GetFormatter()
-DA:22,0
-DA:23,0
-DA:24,0
-FN:16,System.Void MessagePack.GeneratedMessagePackResolver::.ctor()
-FNDA:0,System.Void MessagePack.GeneratedMessagePackResolver::.ctor()
-DA:17,0
-DA:18,0
-DA:19,0
-FN:14,System.Void MessagePack.GeneratedMessagePackResolver::.cctor()
-FNDA:0,System.Void MessagePack.GeneratedMessagePackResolver::.cctor()
-DA:15,0
-FN:30,System.Void MessagePack.GeneratedMessagePackResolver/FormatterCache`1::.cctor()
-FNDA:0,System.Void MessagePack.GeneratedMessagePackResolver/FormatterCache`1::.cctor()
-DA:31,0
-DA:32,0
-DA:33,0
-DA:34,0
-DA:35,0
-DA:36,0
-DA:37,0
-BRDA:33,23,0,0
-BRDA:33,23,1,0
-FN:53,System.Object MessagePack.GeneratedMessagePackResolver/GeneratedMessagePackResolverGetFormatterHelper::GetFormatter(System.Type)
-FNDA:0,System.Object MessagePack.GeneratedMessagePackResolver/GeneratedMessagePackResolverGetFormatterHelper::GetFormatter(System.Type)
-DA:54,0
-DA:55,0
-DA:56,0
-DA:57,0
-DA:59,0
-DA:60,0
-DA:61,0
-DA:62,0
-DA:65,0
-DA:66,0
-DA:67,0
-DA:69,0
-DA:70,0
-DA:74,0
-DA:75,0
-BRDA:55,16,0,0
-BRDA:57,26,1,0
-BRDA:57,26,2,0
-BRDA:57,26,3,0
-BRDA:57,26,0,0
-BRDA:55,16,1,0
-BRDA:65,83,0,0
-BRDA:65,83,1,0
-BRDA:65,110,0,0
-BRDA:67,122,1,0
-BRDA:67,122,0,0
-BRDA:65,110,1,0
-FN:41,System.Void MessagePack.GeneratedMessagePackResolver/GeneratedMessagePackResolverGetFormatterHelper::.cctor()
-FNDA:0,System.Void MessagePack.GeneratedMessagePackResolver/GeneratedMessagePackResolverGetFormatterHelper::.cctor()
-DA:42,0
-DA:43,0
-DA:44,0
-DA:45,0
-DA:46,0
-DA:47,0
-DA:48,0
-DA:49,0
-DA:50,0
-DA:51,0
-LF:39
-LH:0
-BRF:14
-BRH:0
-FNF:6
-FNH:0
-end_of_record
-SF:e:\Projects\CultLib\obj\src\GameCult.Caching\Debug\netstandard2.1\MessagePack.SourceGenerator\MessagePack.SourceGenerator.MessagePackGenerator\Formatters.MessagePack.GeneratedMessagePackResolver.GameCult.Caching.DatabaseLinkFormatter`1.g.cs
-FN:18,System.Void MessagePack.GeneratedMessagePackResolver/GameCult/Caching/DatabaseLinkFormatter`1::Serialize(MessagePack.MessagePackWriter&,GameCult.Caching.DatabaseLink`1<T>,MessagePack.MessagePackSerializerOptions)
-FNDA:0,System.Void MessagePack.GeneratedMessagePackResolver/GameCult/Caching/DatabaseLinkFormatter`1::Serialize(MessagePack.MessagePackWriter&,GameCult.Caching.DatabaseLink`1<T>,MessagePack.MessagePackSerializerOptions)
-DA:19,0
-DA:20,0
-DA:21,0
-DA:22,0
-DA:23,0
-DA:26,0
-DA:27,0
-DA:28,0
-DA:29,0
-BRDA:20,7,0,0
-BRDA:20,7,1,0
-FN:31,GameCult.Caching.DatabaseLink`1<T> MessagePack.GeneratedMessagePackResolver/GameCult/Caching/DatabaseLinkFormatter`1::Deserialize(MessagePack.MessagePackReader&,MessagePack.MessagePackSerializerOptions)
-FNDA:0,GameCult.Caching.DatabaseLink`1<T> MessagePack.GeneratedMessagePackResolver/GameCult/Caching/DatabaseLinkFormatter`1::Deserialize(MessagePack.MessagePackReader&,MessagePack.MessagePackSerializerOptions)
-DA:32,0
-DA:33,0
-DA:34,0
-DA:35,0
-DA:38,0
-DA:39,0
-DA:40,0
-DA:41,0
-DA:43,0
-DA:44,0
-DA:45,0
-DA:48,0
-DA:49,0
-DA:51,0
-DA:52,0
-DA:54,0
-DA:56,0
-DA:57,0
-DA:58,0
-BRDA:33,9,0,0
-BRDA:33,9,1,0
-BRDA:43,116,1,0
-BRDA:45,66,1,0
-BRDA:45,66,0,0
-BRDA:43,116,0,0
-LF:28
-LH:0
-BRF:8
-BRH:0
-FNF:2
-FNH:0
-end_of_record
-SF:e:\Projects\CultLib\obj\src\GameCult.Caching\Debug\netstandard2.1\MessagePack.SourceGenerator\MessagePack.SourceGenerator.MessagePackGenerator\Formatters.MessagePack.GeneratedMessagePackResolver.GameCult.Caching.DatabaseLinkBaseFormatter.g.cs
-FN:17,System.Void MessagePack.GeneratedMessagePackResolver/GameCult/Caching/DatabaseLinkBaseFormatter::Serialize(MessagePack.MessagePackWriter&,GameCult.Caching.DatabaseLinkBase,MessagePack.MessagePackSerializerOptions)
-FNDA:0,System.Void MessagePack.GeneratedMessagePackResolver/GameCult/Caching/DatabaseLinkBaseFormatter::Serialize(MessagePack.MessagePackWriter&,GameCult.Caching.DatabaseLinkBase,MessagePack.MessagePackSerializerOptions)
-DA:18,0
-DA:19,0
-DA:20,0
-DA:21,0
-DA:22,0
-DA:25,0
-DA:26,0
-DA:27,0
-DA:28,0
-BRDA:19,7,0,0
-BRDA:19,7,1,0
-FN:30,GameCult.Caching.DatabaseLinkBase MessagePack.GeneratedMessagePackResolver/GameCult/Caching/DatabaseLinkBaseFormatter::Deserialize(MessagePack.MessagePackReader&,MessagePack.MessagePackSerializerOptions)
-FNDA:0,GameCult.Caching.DatabaseLinkBase MessagePack.GeneratedMessagePackResolver/GameCult/Caching/DatabaseLinkBaseFormatter::Deserialize(MessagePack.MessagePackReader&,MessagePack.MessagePackSerializerOptions)
-DA:31,0
-DA:32,0
-DA:33,0
-DA:34,0
-DA:37,0
-DA:38,0
-DA:39,0
-DA:40,0
-DA:42,0
-DA:43,0
-DA:44,0
-DA:47,0
-DA:48,0
-DA:50,0
-DA:51,0
-DA:53,0
-DA:55,0
-DA:56,0
-DA:57,0
-BRDA:32,9,0,0
-BRDA:32,9,1,0
-BRDA:42,116,1,0
-BRDA:44,66,1,0
-BRDA:44,66,0,0
-BRDA:42,116,0,0
-LF:28
-LH:0
-BRF:8
-BRH:0
-FNF:2
-FNH:0
-end_of_record
-SF:e:\Projects\CultLib\obj\src\GameCult.Caching\Debug\netstandard2.1\MessagePack.SourceGenerator\MessagePack.SourceGenerator.MessagePackGenerator\Formatters.MessagePack.GeneratedMessagePackResolver.GameCult.Caching.PlayerDataFormatter.g.cs
-FN:17,System.Void MessagePack.GeneratedMessagePackResolver/GameCult/Caching/PlayerDataFormatter::Serialize(MessagePack.MessagePackWriter&,GameCult.Caching.PlayerData,MessagePack.MessagePackSerializerOptions)
-FNDA:0,System.Void MessagePack.GeneratedMessagePackResolver/GameCult/Caching/PlayerDataFormatter::Serialize(MessagePack.MessagePackWriter&,GameCult.Caching.PlayerData,MessagePack.MessagePackSerializerOptions)
-DA:18,0
-DA:19,0
-DA:20,0
-DA:21,0
-DA:22,0
-DA:25,0
-DA:26,0
-DA:27,0
-DA:28,0
-DA:29,0
-DA:30,0
-DA:31,0
-DA:32,0
-BRDA:19,7,0,0
-BRDA:19,7,1,0
-FN:34,GameCult.Caching.PlayerData MessagePack.GeneratedMessagePackResolver/GameCult/Caching/PlayerDataFormatter::Deserialize(MessagePack.MessagePackReader&,MessagePack.MessagePackSerializerOptions)
-FNDA:0,GameCult.Caching.PlayerData MessagePack.GeneratedMessagePackResolver/GameCult/Caching/PlayerDataFormatter::Deserialize(MessagePack.MessagePackReader&,MessagePack.MessagePackSerializerOptions)
-DA:35,0
-DA:36,0
-DA:37,0
-DA:38,0
-DA:41,0
-DA:42,0
-DA:43,0
-DA:44,0
-DA:46,0
-DA:47,0
-DA:48,0
-DA:51,0
-DA:52,0
-DA:54,0
-DA:55,0
-DA:57,0
-DA:58,0
-DA:60,0
-DA:61,0
-DA:63,0
-DA:64,0
-DA:66,0
-DA:67,0
-DA:69,0
-DA:71,0
-DA:72,0
-DA:73,0
-BRDA:36,9,0,0
-BRDA:36,9,1,0
-BRDA:46,222,1,0
-BRDA:48,72,1,0
-BRDA:48,72,2,0
-BRDA:48,72,3,0
-BRDA:48,72,4,0
-BRDA:48,72,5,0
-BRDA:48,72,0,0
-BRDA:46,222,0,0
-LF:40
-LH:0
-BRF:12
-BRH:0
-FNF:2
-FNH:0
-end_of_record
-SF:e:\Projects\CultLib\obj\src\GameCult.Caching\Debug\netstandard2.1\MessagePack.SourceGenerator\MessagePack.SourceGenerator.MessagePackGenerator\Formatters.MessagePack.GeneratedMessagePackResolver.GameCult.Caching.DatabaseEntryFormatter.g.cs
-FN:28,System.Void MessagePack.GeneratedMessagePackResolver/GameCult/Caching/DatabaseEntryFormatter::Serialize(MessagePack.MessagePackWriter&,GameCult.Caching.DatabaseEntry,MessagePack.MessagePackSerializerOptions)
-FNDA:0,System.Void MessagePack.GeneratedMessagePackResolver/GameCult/Caching/DatabaseEntryFormatter::Serialize(MessagePack.MessagePackWriter&,GameCult.Caching.DatabaseEntry,MessagePack.MessagePackSerializerOptions)
-DA:29,0
-DA:31,0
-DA:32,0
-DA:33,0
-DA:34,0
-DA:35,0
-DA:38,0
-DA:39,0
-DA:41,0
-DA:44,0
-DA:47,0
-DA:48,0
-BRDA:31,2,0,0
-BRDA:31,2,1,0
-BRDA:31,33,0,0
-BRDA:35,69,1,0
-BRDA:31,33,1,0
-BRDA:35,69,0,0
-FN:50,GameCult.Caching.DatabaseEntry MessagePack.GeneratedMessagePackResolver/GameCult/Caching/DatabaseEntryFormatter::Deserialize(MessagePack.MessagePackReader&,MessagePack.MessagePackSerializerOptions)
-FNDA:0,GameCult.Caching.DatabaseEntry MessagePack.GeneratedMessagePackResolver/GameCult/Caching/DatabaseEntryFormatter::Deserialize(MessagePack.MessagePackReader&,MessagePack.MessagePackSerializerOptions)
-DA:51,0
-DA:52,0
-DA:53,0
-DA:54,0
-DA:57,0
-DA:58,0
-DA:59,0
-DA:62,0
-DA:63,0
-DA:65,0
-DA:66,0
-DA:67,0
-DA:68,0
-DA:70,0
-DA:71,0
-DA:74,0
-DA:75,0
-DA:77,0
-DA:78,0
-DA:81,0
-DA:82,0
-DA:83,0
-BRDA:52,9,0,0
-BRDA:52,9,1,0
-BRDA:57,35,0,0
-BRDA:57,35,1,0
-BRDA:65,90,0,0
-BRDA:65,90,1,0
-BRDA:71,107,1,0
-BRDA:71,107,0,0
-FN:15,System.Void MessagePack.GeneratedMessagePackResolver/GameCult/Caching/DatabaseEntryFormatter::.ctor()
-FNDA:0,System.Void MessagePack.GeneratedMessagePackResolver/GameCult/Caching/DatabaseEntryFormatter::.ctor()
-DA:16,0
-DA:17,0
-DA:18,0
-DA:19,0
-DA:20,0
-DA:21,0
-DA:22,0
-DA:23,0
-DA:24,0
-DA:25,0
-DA:26,0
-LF:45
-LH:0
-BRF:14
-BRH:0
-FNF:3
-FNH:0
-end_of_record
-SF:e:\Projects\CultLib\src\GameCult.Caching\CultCache.cs
-FN:71,GameCult.Logging.ILogger GameCult.Caching.CultCache::get_Logger()
-FNDA:0,GameCult.Logging.ILogger GameCult.Caching.CultCache::get_Logger()
-DA:72,0
-FN:72,System.Void GameCult.Caching.CultCache::set_Logger(GameCult.Logging.ILogger)
-FNDA:0,System.Void GameCult.Caching.CultCache::set_Logger(GameCult.Logging.ILogger)
-DA:73,0
-BRDA:73,3,0,0
-BRDA:73,3,1,0
-FN:75,System.Collections.Generic.IEnumerable`1<GameCult.Caching.DatabaseEntry> GameCult.Caching.CultCache::get_AllEntries()
-FNDA:0,System.Collections.Generic.IEnumerable`1<GameCult.Caching.DatabaseEntry> GameCult.Caching.CultCache::get_AllEntries()
-DA:76,0
-FN:98,System.Void GameCult.Caching.CultCache::AddBackingStore(GameCult.Caching.CacheBackingStore,System.Type[])
-FNDA:0,System.Void GameCult.Caching.CultCache::AddBackingStore(GameCult.Caching.CacheBackingStore,System.Type[])
-DA:99,0
-DA:100,0
-DA:101,0
-DA:102,0
-DA:103,0
-DA:104,0
-DA:106,0
-DA:107,0
-DA:108,0
-DA:109,0
-DA:110,0
-DA:111,0
-DA:112,0
-DA:113,0
-DA:114,0
-DA:115,0
-DA:116,0
-DA:117,0
-DA:118,0
-DA:119,0
-DA:120,0
-DA:121,0
-DA:122,0
-DA:123,0
-DA:124,0
-DA:125,0
-DA:126,0
-DA:127,0
-DA:128,0
-DA:129,0
-DA:130,0
-DA:131,0
-DA:132,0
-DA:133,0
-DA:134,0
-DA:135,0
-DA:136,0
-DA:137,0
-DA:138,0
-DA:139,0
-DA:140,0
-DA:141,0
-DA:142,0
-DA:143,0
-DA:144,0
-DA:145,0
-DA:146,0
-DA:147,0
-BRDA:100,28,0,0
-BRDA:103,90,1,0
-BRDA:103,90,0,0
-BRDA:100,28,1,0
-BRDA:107,142,1,0
-BRDA:107,142,0,0
-BRDA:140,33,0,0
-BRDA:140,33,1,0
-BRDA:144,68,0,0
-BRDA:144,68,1,0
-FN:246,System.Void GameCult.Caching.CultCache::Add(GameCult.Caching.DatabaseEntry,GameCult.Caching.CacheBackingStore)
-FNDA:0,System.Void GameCult.Caching.CultCache::Add(GameCult.Caching.DatabaseEntry,GameCult.Caching.CacheBackingStore)
-DA:247,0
-DA:249,0
-DA:250,0
-DA:251,0
-DA:252,0
-DA:253,0
-FN:254,System.Boolean GameCult.Caching.CultCache::IsGlobal(GameCult.Caching.DatabaseEntry)
-FNDA:0,System.Boolean GameCult.Caching.CultCache::IsGlobal(GameCult.Caching.DatabaseEntry)
-DA:255,0
-FN:257,System.Void GameCult.Caching.CultCache::AddAll(System.Collections.Generic.IEnumerable`1<GameCult.Caching.DatabaseEntry>)
-FNDA:0,System.Void GameCult.Caching.CultCache::AddAll(System.Collections.Generic.IEnumerable`1<GameCult.Caching.DatabaseEntry>)
-DA:258,0
-DA:259,0
-DA:260,0
-DA:261,0
-DA:262,0
-DA:263,0
-BRDA:259,35,1,0
-BRDA:259,35,0,0
-FN:265,GameCult.Caching.DatabaseEntry GameCult.Caching.CultCache::Get(System.Guid)
-FNDA:0,GameCult.Caching.DatabaseEntry GameCult.Caching.CultCache::Get(System.Guid)
-DA:266,0
-DA:267,0
-DA:268,0
-DA:269,0
-FN:271,T GameCult.Caching.CultCache::Get(System.Guid)
-FNDA:0,T GameCult.Caching.CultCache::Get(System.Guid)
-DA:272,0
-DA:273,0
-DA:274,0
-FN:276,GameCult.Caching.DatabaseEntry GameCult.Caching.CultCache::GetGlobal(System.Type)
-FNDA:0,GameCult.Caching.DatabaseEntry GameCult.Caching.CultCache::GetGlobal(System.Type)
-DA:277,0
-DA:278,0
-DA:279,0
-DA:280,0
-FN:282,T GameCult.Caching.CultCache::GetGlobal()
-FNDA:0,T GameCult.Caching.CultCache::GetGlobal()
-DA:283,0
-DA:284,0
-DA:285,0
-FN:287,System.Collections.Generic.IEnumerable`1<GameCult.Caching.DatabaseEntry> GameCult.Caching.CultCache::GetAll(System.Type)
-FNDA:0,System.Collections.Generic.IEnumerable`1<GameCult.Caching.DatabaseEntry> GameCult.Caching.CultCache::GetAll(System.Type)
-DA:288,0
-DA:289,0
-DA:290,0
-BRDA:289,15,0,0
-BRDA:289,15,1,0
-FN:292,System.Collections.Generic.IEnumerable`1<T> GameCult.Caching.CultCache::GetAll()
-FNDA:0,System.Collections.Generic.IEnumerable`1<T> GameCult.Caching.CultCache::GetAll()
-DA:293,0
-DA:294,0
-DA:295,0
-BRDA:294,24,0,0
-BRDA:294,24,1,0
-FN:297,System.Nullable`1<System.Guid> GameCult.Caching.CultCache::GetIdByName(System.String)
-FNDA:0,System.Nullable`1<System.Guid> GameCult.Caching.CultCache::GetIdByName(System.String)
-DA:298,0
-DA:299,0
-DA:300,0
-DA:301,0
-DA:302,0
-DA:303,0
-BRDA:300,26,0,0
-BRDA:300,26,1,0
-BRDA:300,42,0,0
-BRDA:300,42,1,0
-FN:305,T GameCult.Caching.CultCache::GetByName(System.String)
-FNDA:0,T GameCult.Caching.CultCache::GetByName(System.String)
-DA:306,0
-DA:307,0
-DA:308,0
-BRDA:307,16,0,0
-BRDA:307,16,1,0
-FN:314,System.Void GameCult.Caching.CultCache::RegisterIndex(System.String)
-FNDA:0,System.Void GameCult.Caching.CultCache::RegisterIndex(System.String)
-DA:315,0
-DA:316,0
-DA:317,0
-DA:318,0
-DA:319,0
-DA:321,0
-DA:324,0
-DA:325,0
-DA:326,0
-DA:327,0
-DA:328,0
-DA:329,0
-DA:330,0
-DA:331,0
-DA:333,0
-DA:334,0
-DA:336,0
-BRDA:318,53,1,0
-BRDA:325,112,0,0
-BRDA:325,112,1,0
-BRDA:318,53,0,0
-BRDA:327,13,0,0
-BRDA:327,13,1,0
-BRDA:327,25,0,0
-BRDA:327,25,1,0
-FN:339,System.Nullable`1<System.Guid> GameCult.Caching.CultCache::GetIdByIndex(System.String,System.String)
-FNDA:0,System.Nullable`1<System.Guid> GameCult.Caching.CultCache::GetIdByIndex(System.String,System.String)
-DA:340,0
-DA:341,0
-DA:342,0
-DA:343,0
-DA:344,0
-DA:345,0
-BRDA:342,33,0,0
-BRDA:342,33,1,0
-BRDA:342,49,0,0
-BRDA:342,49,1,0
-FN:348,T GameCult.Caching.CultCache::GetByIndex(System.String,System.String)
-FNDA:0,T GameCult.Caching.CultCache::GetByIndex(System.String,System.String)
-DA:349,0
-DA:350,0
-DA:351,0
-BRDA:350,17,0,0
-BRDA:350,17,1,0
-FN:353,System.Void GameCult.Caching.CultCache::Remove(GameCult.Caching.DatabaseEntry,GameCult.Caching.CacheBackingStore)
-FNDA:0,System.Void GameCult.Caching.CultCache::Remove(GameCult.Caching.DatabaseEntry,GameCult.Caching.CacheBackingStore)
-DA:354,0
-DA:355,0
-DA:356,0
-DA:357,0
-DA:358,0
-DA:359,0
-DA:361,0
-DA:362,0
-DA:363,0
-DA:364,0
-DA:365,0
-DA:366,0
-DA:367,0
-DA:368,0
-DA:369,0
-DA:370,0
-DA:371,0
-DA:372,0
-DA:373,0
-DA:374,0
-DA:375,0
-DA:376,0
-DA:378,0
-DA:379,0
-DA:380,0
-DA:381,0
-DA:382,0
-DA:383,0
-DA:384,0
-DA:385,0
-DA:386,0
-DA:387,0
-DA:388,0
-DA:389,0
-DA:390,0
-BRDA:356,34,1,0
-BRDA:357,55,0,0
-BRDA:357,55,1,0
-BRDA:357,71,0,0
-BRDA:357,71,1,0
-BRDA:358,105,0,0
-BRDA:358,105,1,0
-BRDA:362,175,1,0
-BRDA:364,156,0,0
-BRDA:364,156,1,0
-BRDA:362,175,0,0
-BRDA:368,260,1,0
-BRDA:370,236,0,0
-BRDA:370,236,1,0
-BRDA:368,260,0,0
-BRDA:373,270,0,0
-BRDA:373,270,1,0
-BRDA:373,293,0,0
-BRDA:373,293,1,0
-BRDA:378,331,0,0
-BRDA:380,438,1,0
-BRDA:383,393,0,0
-BRDA:383,393,1,0
-BRDA:380,438,0,0
-BRDA:356,34,0,0
-BRDA:378,331,1,0
-FN:392,System.Void GameCult.Caching.CultCache::Dispose()
-FNDA:0,System.Void GameCult.Caching.CultCache::Dispose()
-DA:393,0
-DA:394,0
-DA:395,0
-DA:396,0
-DA:397,0
-DA:398,0
-BRDA:394,53,1,0
-BRDA:395,37,0,0
-BRDA:395,37,1,0
-BRDA:394,53,0,0
-BRDA:396,137,1,0
-BRDA:397,120,0,0
-BRDA:397,120,1,0
-BRDA:396,137,0,0
-FN:52,System.Void GameCult.Caching.CultCache::.ctor()
-FNDA:0,System.Void GameCult.Caching.CultCache::.ctor()
-DA:53,0
-DA:57,0
-DA:58,0
-DA:59,0
-DA:60,0
-DA:61,0
-DA:62,0
-DA:63,0
-DA:65,0
-DA:67,0
-DA:68,0
-DA:78,0
-DA:79,0
-DA:80,0
-DA:82,0
-DA:83,0
-DA:84,0
-DA:85,0
-DA:86,0
-DA:87,0
-DA:88,0
-DA:89,0
-DA:91,0
-DA:92,0
-DA:93,0
-DA:94,0
-DA:95,0
-DA:96,0
-BRDA:82,278,1,0
-BRDA:85,190,0,0
-BRDA:85,190,1,0
-BRDA:91,247,0,0
-BRDA:91,247,1,0
-BRDA:82,278,0,0
-FN:150,System.Threading.Tasks.Task GameCult.Caching.CultCache/<>c::<PullAllBackingStoresAsync>b__21_0(GameCult.Caching.CacheBackingStore)
-FNDA:0,System.Threading.Tasks.Task GameCult.Caching.CultCache/<>c::<PullAllBackingStoresAsync>b__21_0(GameCult.Caching.CacheBackingStore)
-DA:151,0
-FN:151,System.Threading.Tasks.Task GameCult.Caching.CultCache/<>c::<PullAllBackingStoresAsync>b__21_1(GameCult.Caching.CacheBackingStore)
-FNDA:0,System.Threading.Tasks.Task GameCult.Caching.CultCache/<>c::<PullAllBackingStoresAsync>b__21_1(GameCult.Caching.CacheBackingStore)
-DA:152,0
-FN:202,ConcurrentCollections.ConcurrentHashSet`1<GameCult.Caching.DatabaseEntry> GameCult.Caching.CultCache/<>c::<AddAsync>b__22_1(System.Type)
-FNDA:0,ConcurrentCollections.ConcurrentHashSet`1<GameCult.Caching.DatabaseEntry> GameCult.Caching.CultCache/<>c::<AddAsync>b__22_1(System.Type)
-DA:203,0
-FN:169,GameCult.Caching.DatabaseEntry GameCult.Caching.CultCache/<>c__DisplayClass22_0::<AddAsync>b__0(System.Type,GameCult.Caching.DatabaseEntry)
-FNDA:0,GameCult.Caching.DatabaseEntry GameCult.Caching.CultCache/<>c__DisplayClass22_0::<AddAsync>b__0(System.Type,GameCult.Caching.DatabaseEntry)
-DA:170,0
-DA:171,0
-DA:172,0
-DA:174,0
-DA:175,0
-DA:176,0
-BRDA:171,7,0,0
-BRDA:171,7,1,0
-FN:236,System.Void GameCult.Caching.CultCache/<>c__DisplayClass22_0::<AddAsync>b__3()
-FNDA:0,System.Void GameCult.Caching.CultCache/<>c__DisplayClass22_0::<AddAsync>b__3()
-DA:237,0
-FN:234,System.Void GameCult.Caching.CultCache/<>c__DisplayClass22_1::<AddAsync>b__2()
-FNDA:0,System.Void GameCult.Caching.CultCache/<>c__DisplayClass22_1::<AddAsync>b__2()
-DA:235,0
-FN:157,System.Void GameCult.Caching.CultCache/<AddAsync>d__22::MoveNext()
-FNDA:0,System.Void GameCult.Caching.CultCache/<AddAsync>d__22::MoveNext()
-DA:158,0
-DA:159,0
-DA:161,0
-DA:164,0
-DA:166,0
-DA:167,0
-DA:168,0
-DA:169,0
-DA:173,0
-DA:179,0
-DA:180,0
-DA:182,0
-DA:183,0
-DA:184,0
-DA:185,0
-DA:188,0
-DA:189,0
-DA:190,0
-DA:191,0
-DA:192,0
-DA:193,0
-DA:194,0
-DA:195,0
-DA:196,0
-DA:197,0
-DA:198,0
-DA:199,0
-DA:200,0
-DA:202,0
-DA:204,0
-DA:205,0
-DA:206,0
-DA:207,0
-DA:208,0
-DA:212,0
-DA:213,0
-DA:214,0
-DA:215,0
-DA:218,0
-DA:219,0
-DA:220,0
-DA:221,0
-DA:222,0
-DA:223,0
-DA:224,0
-DA:225,0
-DA:226,0
-DA:227,0
-DA:228,0
-DA:229,0
-DA:233,0
-DA:234,0
-DA:236,0
-DA:238,0
-DA:239,0
-DA:240,0
-DA:242,0
-DA:243,0
-DA:244,0
-BRDA:159,80,0,0
-BRDA:159,80,1,0
-BRDA:164,157,0,0
-BRDA:164,157,1,0
-BRDA:166,195,0,0
-BRDA:166,195,1,0
-BRDA:179,266,0,0
-BRDA:182,295,0,0
-BRDA:182,295,1,0
-BRDA:182,337,0,0
-BRDA:182,337,1,0
-BRDA:188,403,0,0
-BRDA:190,626,1,0
-BRDA:193,513,0,0
-BRDA:193,513,1,0
-BRDA:190,626,0,0
-BRDA:188,403,1,0
-BRDA:179,266,1,0
-BRDA:204,962,1,0
-BRDA:206,894,0,0
-BRDA:206,894,1,0
-BRDA:204,962,0,0
-BRDA:212,999,0,0
-BRDA:212,999,1,0
-BRDA:212,1041,0,0
-BRDA:212,1041,1,0
-BRDA:218,1121,0,0
-BRDA:220,1363,1,0
-BRDA:223,1236,0,0
-BRDA:223,1236,1,0
-BRDA:220,1363,0,0
-BRDA:218,1121,1,0
-BRDA:234,1504,0,0
-BRDA:234,1504,1,0
-BRDA:236,1643,0,0
-BRDA:236,1643,1,0
-BRDA:236,1679,0,0
-BRDA:236,1679,1,0
-FN:149,System.Void GameCult.Caching.CultCache/<PullAllBackingStoresAsync>d__21::MoveNext()
-FNDA:0,System.Void GameCult.Caching.CultCache/<PullAllBackingStoresAsync>d__21::MoveNext()
-DA:150,0
-DA:153,0
-DA:154,0
-DA:155,0
-FN:411,GameCult.Logging.ILogger GameCult.Caching.CacheBackingStore::get_Logger()
-FNDA:0,GameCult.Logging.ILogger GameCult.Caching.CacheBackingStore::get_Logger()
-DA:412,0
-FN:412,System.Void GameCult.Caching.CacheBackingStore::set_Logger(GameCult.Logging.ILogger)
-FNDA:0,System.Void GameCult.Caching.CacheBackingStore::set_Logger(GameCult.Logging.ILogger)
-DA:413,0
-BRDA:413,3,0,0
-BRDA:413,3,1,0
-FN:427,R3.Subject`1<GameCult.Caching.DatabaseEntry> GameCult.Caching.CacheBackingStore::get_EntryAdded()
-FNDA:0,R3.Subject`1<GameCult.Caching.DatabaseEntry> GameCult.Caching.CacheBackingStore::get_EntryAdded()
-DA:428,0
-FN:428,R3.Subject`1<GameCult.Caching.DatabaseEntry> GameCult.Caching.CacheBackingStore::get_EntryDeleted()
-FNDA:0,R3.Subject`1<GameCult.Caching.DatabaseEntry> GameCult.Caching.CacheBackingStore::get_EntryDeleted()
-DA:429,0
-FN:429,R3.Subject`1<GameCult.Caching.DatabaseEntry> GameCult.Caching.CacheBackingStore::get_EntryUpdated()
-FNDA:0,R3.Subject`1<GameCult.Caching.DatabaseEntry> GameCult.Caching.CacheBackingStore::get_EntryUpdated()
-DA:430,0
-FN:434,System.Void GameCult.Caching.CacheBackingStore::SubscribeTo(GameCult.Caching.CacheBackingStore)
-FNDA:0,System.Void GameCult.Caching.CacheBackingStore::SubscribeTo(GameCult.Caching.CacheBackingStore)
-DA:435,0
-DA:436,0
-DA:437,0
-DA:438,0
-DA:439,0
-FN:407,System.Void GameCult.Caching.CacheBackingStore::.ctor()
-FNDA:0,System.Void GameCult.Caching.CacheBackingStore::.ctor()
-DA:408,0
-DA:416,0
-DA:417,0
-DA:418,0
-DA:419,0
-DA:420,0
-DA:421,0
-DA:432,0
-FN:443,System.IO.DirectoryInfo GameCult.Caching.MultiFileBackingStore::get_RootDirectory()
-FNDA:0,System.IO.DirectoryInfo GameCult.Caching.MultiFileBackingStore::get_RootDirectory()
-DA:444,0
-FN:463,System.IO.DirectoryInfo GameCult.Caching.MultiFileBackingStore::GetDirectoryForType(System.Type)
-FNDA:0,System.IO.DirectoryInfo GameCult.Caching.MultiFileBackingStore::GetDirectoryForType(System.Type)
-DA:464,0
-DA:465,0
-DA:466,0
-DA:467,0
-DA:468,0
-DA:469,0
-DA:470,0
-DA:471,0
-DA:472,0
-DA:473,0
-DA:474,0
-BRDA:467,63,1,0
-BRDA:467,40,0,0
-BRDA:467,40,1,0
-BRDA:467,63,0,0
-FN:476,System.Void GameCult.Caching.MultiFileBackingStore::PullAll()
-FNDA:0,System.Void GameCult.Caching.MultiFileBackingStore::PullAll()
-DA:477,0
-DA:478,0
-DA:480,0
-DA:481,0
-DA:482,0
-DA:483,0
-DA:485,0
-DA:486,0
-DA:487,0
-DA:488,0
-DA:489,0
-DA:490,0
-DA:491,0
-DA:492,0
-DA:493,0
-DA:494,0
-DA:495,0
-DA:496,0
-DA:497,0
-BRDA:478,17,1,0
-BRDA:480,264,1,0
-BRDA:482,238,1,0
-BRDA:482,238,0,0
-BRDA:480,264,0,0
-BRDA:478,17,0,0
-FN:499,System.String GameCult.Caching.MultiFileBackingStore::GetFileName(GameCult.Caching.DatabaseEntry)
-FNDA:0,System.String GameCult.Caching.MultiFileBackingStore::GetFileName(GameCult.Caching.DatabaseEntry)
-DA:500,0
-DA:501,0
-DA:503,0
-DA:504,0
-DA:505,0
-DA:506,0
-BRDA:501,9,0,0
-BRDA:501,9,1,0
-BRDA:503,72,1,0
-BRDA:503,72,0,0
-FN:508,System.Void GameCult.Caching.MultiFileBackingStore::Push(GameCult.Caching.DatabaseEntry)
-FNDA:0,System.Void GameCult.Caching.MultiFileBackingStore::Push(GameCult.Caching.DatabaseEntry)
-DA:509,0
-DA:510,0
-DA:511,0
-DA:512,0
-DA:513,0
-DA:514,0
-DA:515,0
-DA:516,0
-FN:518,System.Void GameCult.Caching.MultiFileBackingStore::Delete(GameCult.Caching.DatabaseEntry)
-FNDA:0,System.Void GameCult.Caching.MultiFileBackingStore::Delete(GameCult.Caching.DatabaseEntry)
-DA:519,0
-DA:520,0
-DA:521,0
-DA:522,0
-DA:523,0
-DA:524,0
-DA:525,0
-DA:526,0
-DA:527,0
-DA:528,0
-DA:529,0
-DA:530,0
-DA:531,0
-BRDA:520,20,0,0
-BRDA:528,116,0,0
-BRDA:528,116,1,0
-BRDA:520,20,1,0
-FN:533,System.Void GameCult.Caching.MultiFileBackingStore::PushAll(System.Boolean)
-FNDA:0,System.Void GameCult.Caching.MultiFileBackingStore::PushAll(System.Boolean)
-DA:534,0
-DA:535,0
-DA:536,0
-BRDA:535,43,1,0
-BRDA:535,43,0,0
-FN:538,System.Void GameCult.Caching.MultiFileBackingStore::ObserveChanges()
-FNDA:0,System.Void GameCult.Caching.MultiFileBackingStore::ObserveChanges()
-DA:539,0
-DA:540,0
-DA:541,0
-DA:543,0
-DA:544,0
-DA:545,0
-DA:546,0
-DA:547,0
-DA:548,0
-DA:551,0
-DA:552,0
-DA:554,0
-DA:555,0
-DA:556,0
-DA:557,0
-DA:558,0
-DA:559,0
-DA:560,0
-DA:561,0
-DA:562,0
-DA:563,0
-DA:564,0
-DA:565,0
-DA:566,0
-BRDA:540,12,0,0
-BRDA:540,12,1,0
-FN:568,System.Void GameCult.Caching.MultiFileBackingStore::HandleFileCreation(System.String)
-FNDA:0,System.Void GameCult.Caching.MultiFileBackingStore::HandleFileCreation(System.String)
-DA:569,0
-DA:571,0
-DA:572,0
-DA:573,0
-DA:574,0
-DA:575,0
-DA:576,0
-DA:577,0
-DA:578,0
-DA:579,0
-DA:580,0
-DA:581,0
-FN:583,System.Void GameCult.Caching.MultiFileBackingStore::HandleFileChange(System.String)
-FNDA:0,System.Void GameCult.Caching.MultiFileBackingStore::HandleFileChange(System.String)
-DA:584,0
-DA:586,0
-DA:587,0
-DA:588,0
-DA:589,0
-DA:590,0
-DA:591,0
-DA:592,0
-DA:593,0
-DA:594,0
-DA:595,0
-DA:596,0
-FN:598,System.Void GameCult.Caching.MultiFileBackingStore::HandleFileRemoval(System.String)
-FNDA:0,System.Void GameCult.Caching.MultiFileBackingStore::HandleFileRemoval(System.String)
-DA:599,0
-DA:601,0
-DA:603,0
-DA:604,0
-DA:605,0
-DA:608,0
-DA:609,0
-DA:610,0
-DA:611,0
-DA:612,0
-DA:614,0
-DA:616,0
-DA:617,0
-DA:618,0
-DA:619,0
-DA:620,0
-DA:621,0
-DA:622,0
-DA:623,0
-DA:624,0
-DA:625,0
-DA:626,0
-BRDA:603,18,0,0
-BRDA:608,54,0,0
-BRDA:608,54,1,0
-BRDA:603,18,1,0
-FN:629,System.Type GameCult.Caching.MultiFileBackingStore::GetTypeFromPath(System.String)
-FNDA:0,System.Type GameCult.Caching.MultiFileBackingStore::GetTypeFromPath(System.String)
-DA:630,0
-DA:631,0
-DA:633,0
-DA:634,0
-DA:635,0
-DA:636,0
-DA:637,0
-DA:638,0
-DA:639,0
-DA:640,0
-DA:641,0
-BRDA:631,15,0,0
-BRDA:631,15,1,0
-BRDA:633,149,1,0
-BRDA:635,49,0,0
-BRDA:635,49,1,0
-BRDA:636,98,0,0
-BRDA:636,98,1,0
-BRDA:633,129,0,0
-BRDA:633,129,1,0
-BRDA:633,149,0,0
-FN:644,GameCult.Caching.DatabaseEntry GameCult.Caching.MultiFileBackingStore::CreateStubEntry(System.Guid,System.Type)
-FNDA:0,GameCult.Caching.DatabaseEntry GameCult.Caching.MultiFileBackingStore::CreateStubEntry(System.Guid,System.Type)
-DA:645,0
-DA:646,0
-DA:647,0
-DA:648,0
-DA:649,0
-BRDA:647,34,0,0
-BRDA:647,34,1,0
-FN:651,System.Void GameCult.Caching.MultiFileBackingStore::Dispose()
-FNDA:0,System.Void GameCult.Caching.MultiFileBackingStore::Dispose()
-DA:652,0
-DA:653,0
-DA:654,0
-DA:655,0
-BRDA:653,8,0,0
-BRDA:653,8,1,0
-BRDA:654,26,0,0
-BRDA:654,26,1,0
-FN:444,System.Void GameCult.Caching.MultiFileBackingStore::.ctor(System.String)
-FNDA:0,System.Void GameCult.Caching.MultiFileBackingStore::.ctor(System.String)
-DA:445,0
-DA:446,0
-DA:454,0
-DA:455,0
-DA:456,0
-DA:457,0
-DA:458,0
-DA:459,0
-DA:460,0
-DA:461,0
-BRDA:457,97,1,0
-BRDA:457,97,0,0
-FN:659,System.IO.FileInfo GameCult.Caching.SingleFileBackingStore::get_FileInfo()
-FNDA:0,System.IO.FileInfo GameCult.Caching.SingleFileBackingStore::get_FileInfo()
-DA:660,0
-FN:670,System.Void GameCult.Caching.SingleFileBackingStore::PullAll()
-FNDA:0,System.Void GameCult.Caching.SingleFileBackingStore::PullAll()
-DA:671,0
-DA:672,0
-DA:674,0
-DA:675,0
-DA:676,0
-DA:677,0
-DA:678,0
-DA:679,0
-BRDA:672,17,1,0
-BRDA:674,95,1,0
-BRDA:672,17,0,0
-BRDA:674,95,0,0
-FN:681,System.Void GameCult.Caching.SingleFileBackingStore::Push(GameCult.Caching.DatabaseEntry)
-FNDA:0,System.Void GameCult.Caching.SingleFileBackingStore::Push(GameCult.Caching.DatabaseEntry)
-DA:682,0
-DA:683,0
-DA:684,0
-DA:685,0
-DA:686,0
-FN:688,System.Void GameCult.Caching.SingleFileBackingStore::Delete(GameCult.Caching.DatabaseEntry)
-FNDA:0,System.Void GameCult.Caching.SingleFileBackingStore::Delete(GameCult.Caching.DatabaseEntry)
-DA:689,0
-DA:690,0
-DA:691,0
-DA:692,0
-DA:693,0
-DA:694,0
-DA:695,0
-BRDA:690,22,0,0
-BRDA:690,22,1,0
-FN:697,System.Void GameCult.Caching.SingleFileBackingStore::PushAll(System.Boolean)
-FNDA:0,System.Void GameCult.Caching.SingleFileBackingStore::PushAll(System.Boolean)
-DA:698,0
-DA:699,0
-DA:700,0
-DA:701,0
-FN:664,System.Void GameCult.Caching.SingleFileBackingStore::.ctor(System.String)
-FNDA:0,System.Void GameCult.Caching.SingleFileBackingStore::.ctor(System.String)
-DA:665,0
-DA:666,0
-DA:667,0
-DA:668,0
-LF:470
-LH:0
-BRF:178
-BRH:0
-FNF:57
-FNH:0
-end_of_record
-SF:e:\Projects\CultLib\src\GameCult.Caching\DatabaseEntry.cs
-FN:18,System.Int32 GameCult.Caching.DatabaseEntry::GetHashCode()
-FNDA:0,System.Int32 GameCult.Caching.DatabaseEntry::GetHashCode()
-DA:19,0
-DA:20,0
-DA:21,0
-FN:23,System.Boolean GameCult.Caching.DatabaseEntry::Equals(System.Object)
-FNDA:0,System.Boolean GameCult.Caching.DatabaseEntry::Equals(System.Object)
-DA:24,0
-DA:25,0
-DA:26,0
-DA:27,0
-BRDA:25,14,0,0
-BRDA:25,14,1,0
-FN:15,System.Void GameCult.Caching.DatabaseEntry::.ctor()
-FNDA:0,System.Void GameCult.Caching.DatabaseEntry::.ctor()
-DA:16,0
-FN:33,T GameCult.Caching.DatabaseLink`1::get_Value()
-FNDA:0,T GameCult.Caching.DatabaseLink`1::get_Value()
-DA:34,0
-FN:63,System.String GameCult.Caching.PlayerData::get_EntryName()
-FNDA:0,System.String GameCult.Caching.PlayerData::get_EntryName()
-DA:64,0
-FN:64,System.Void GameCult.Caching.PlayerData::set_EntryName(System.String)
-FNDA:0,System.Void GameCult.Caching.PlayerData::set_EntryName(System.String)
-DA:65,0
-LF:11
-LH:0
-BRF:2
-BRH:0
-FNF:6
-FNH:0
-end_of_record
-SF:e:\Projects\CultLib\src\GameCult.Logging\ConsoleLogger.cs
-FN:6,System.Void GameCult.Logging.ConsoleLogger::LogInfo(System.String)
-FNDA:0,System.Void GameCult.Logging.ConsoleLogger::LogInfo(System.String)
-DA:7,0
-FN:8,System.Void GameCult.Logging.ConsoleLogger::LogWarning(System.String)
-FNDA:0,System.Void GameCult.Logging.ConsoleLogger::LogWarning(System.String)
-DA:9,0
-DA:10,0
-DA:11,0
-DA:12,0
-FN:14,System.Void GameCult.Logging.ConsoleLogger::LogError(System.String)
-FNDA:0,System.Void GameCult.Logging.ConsoleLogger::LogError(System.String)
-DA:15,0
-DA:16,0
-DA:17,0
-DA:18,0
-FN:20,System.Void GameCult.Logging.ConsoleLogger::LogDebug(System.String)
-FNDA:0,System.Void GameCult.Logging.ConsoleLogger::LogDebug(System.String)
-DA:21,0
-DA:22,0
-DA:23,0
-BRDA:22,19,0,0
-BRDA:22,19,1,0
-LF:12
-LH:0
-BRF:2
-BRH:0
-FNF:4
-FNH:0
-end_of_record
-SF:e:\Projects\CultLib\src\GameCult.Logging\FileLogger.cs
-FN:15,System.Void GameCult.Logging.FileLogger::Append(System.String,System.String)
-FNDA:0,System.Void GameCult.Logging.FileLogger::Append(System.String,System.String)
-DA:16,0
-DA:17,0
-DA:18,0
-FN:19,System.Void GameCult.Logging.FileLogger::LogInfo(System.String)
-FNDA:0,System.Void GameCult.Logging.FileLogger::LogInfo(System.String)
-DA:20,0
-FN:20,System.Void GameCult.Logging.FileLogger::LogWarning(System.String)
-FNDA:0,System.Void GameCult.Logging.FileLogger::LogWarning(System.String)
-DA:21,0
-FN:21,System.Void GameCult.Logging.FileLogger::LogError(System.String)
-FNDA:0,System.Void GameCult.Logging.FileLogger::LogError(System.String)
-DA:22,0
-FN:22,System.Void GameCult.Logging.FileLogger::LogDebug(System.String)
-FNDA:0,System.Void GameCult.Logging.FileLogger::LogDebug(System.String)
-DA:23,0
-FN:9,System.Void GameCult.Logging.FileLogger::.ctor(System.String)
-FNDA:0,System.Void GameCult.Logging.FileLogger::.ctor(System.String)
-DA:10,0
-DA:11,0
-DA:12,0
-DA:13,0
-LF:11
-LH:0
-BRF:0
-BRH:0
-FNF:6
-FNH:0
-end_of_record
-SF:e:\Projects\CultLib\src\GameCult.Logging\ILogger.cs
-FN:13,System.Void GameCult.Logging.NullLogger::LogInfo(System.String)
-FNDA:0,System.Void GameCult.Logging.NullLogger::LogInfo(System.String)
-DA:14,0
-FN:14,System.Void GameCult.Logging.NullLogger::LogWarning(System.String)
-FNDA:0,System.Void GameCult.Logging.NullLogger::LogWarning(System.String)
-DA:15,0
-FN:15,System.Void GameCult.Logging.NullLogger::LogError(System.String)
-FNDA:0,System.Void GameCult.Logging.NullLogger::LogError(System.String)
-DA:16,0
-FN:16,System.Void GameCult.Logging.NullLogger::LogDebug(System.String)
-FNDA:0,System.Void GameCult.Logging.NullLogger::LogDebug(System.String)
-DA:17,0
-LF:4
-LH:0
-BRF:0
-BRH:0
-FNF:4
-FNH:0
-end_of_record
-SF:e:\Projects\CultLib\obj\src\GameCult.Networking\Debug\netstandard2.1\MessagePack.SourceGenerator\MessagePack.SourceGenerator.MessagePackGenerator\MessagePack.GeneratedMessagePackResolver.g.cs
-FN:21,MessagePack.Formatters.IMessagePackFormatter`1<T> MessagePack.GeneratedMessagePackResolver::GetFormatter()
-FNDA:0,MessagePack.Formatters.IMessagePackFormatter`1<T> MessagePack.GeneratedMessagePackResolver::GetFormatter()
-DA:22,0
-DA:23,0
-DA:24,0
-FN:16,System.Void MessagePack.GeneratedMessagePackResolver::.ctor()
-FNDA:0,System.Void MessagePack.GeneratedMessagePackResolver::.ctor()
-DA:17,0
-DA:18,0
-DA:19,0
-FN:14,System.Void MessagePack.GeneratedMessagePackResolver::.cctor()
-FNDA:0,System.Void MessagePack.GeneratedMessagePackResolver::.cctor()
-DA:15,0
-FN:30,System.Void MessagePack.GeneratedMessagePackResolver/FormatterCache`1::.cctor()
-FNDA:0,System.Void MessagePack.GeneratedMessagePackResolver/FormatterCache`1::.cctor()
-DA:31,0
-DA:32,0
-DA:33,0
-DA:34,0
-DA:35,0
-DA:36,0
-DA:37,0
-BRDA:33,23,0,0
-BRDA:33,23,1,0
-FN:54,System.Object MessagePack.GeneratedMessagePackResolver/GeneratedMessagePackResolverGetFormatterHelper::GetFormatter(System.Type)
-FNDA:0,System.Object MessagePack.GeneratedMessagePackResolver/GeneratedMessagePackResolverGetFormatterHelper::GetFormatter(System.Type)
-DA:55,0
-DA:56,0
-DA:57,0
-DA:58,0
-DA:60,0
-DA:61,0
-DA:62,0
-DA:63,0
-DA:64,0
-DA:65,0
-DA:66,0
-DA:67,0
-DA:68,0
-DA:72,0
-DA:73,0
-BRDA:56,16,0,0
-BRDA:58,24,1,0
-BRDA:58,24,2,0
-BRDA:58,24,3,0
-BRDA:58,24,4,0
-BRDA:58,24,5,0
-BRDA:58,24,6,0
-BRDA:58,24,7,0
-BRDA:58,24,8,0
-BRDA:58,24,0,0
-BRDA:56,16,1,0
-FN:41,System.Void MessagePack.GeneratedMessagePackResolver/GeneratedMessagePackResolverGetFormatterHelper::.cctor()
-FNDA:0,System.Void MessagePack.GeneratedMessagePackResolver/GeneratedMessagePackResolverGetFormatterHelper::.cctor()
-DA:42,0
-DA:43,0
-DA:44,0
-DA:45,0
-DA:46,0
-DA:47,0
-DA:48,0
-DA:49,0
-DA:50,0
-DA:51,0
-DA:52,0
-LF:40
-LH:0
-BRF:13
-BRH:0
-FNF:6
-FNH:0
-end_of_record
-SF:e:\Projects\CultLib\obj\src\GameCult.Networking\Debug\netstandard2.1\MessagePack.SourceGenerator\MessagePack.SourceGenerator.MessagePackGenerator\Formatters.MessagePack.GeneratedMessagePackResolver.GameCult.PongReborn.Scripts.Networking.ChangeNameMessageFormatter.g.cs
-FN:19,System.Void MessagePack.GeneratedMessagePackResolver/GameCult/PongReborn/Scripts/Networking/ChangeNameMessageFormatter::Serialize(MessagePack.MessagePackWriter&,GameCult.PongReborn.Scripts.Networking.ChangeNameMessage,MessagePack.MessagePackSerializerOptions)
-FNDA:0,System.Void MessagePack.GeneratedMessagePackResolver/GameCult/PongReborn/Scripts/Networking/ChangeNameMessageFormatter::Serialize(MessagePack.MessagePackWriter&,GameCult.PongReborn.Scripts.Networking.ChangeNameMessage,MessagePack.MessagePackSerializerOptions)
-DA:20,0
-DA:21,0
-DA:22,0
-DA:23,0
-DA:24,0
-DA:27,0
-DA:28,0
-DA:29,0
-DA:30,0
-BRDA:21,7,0,0
-BRDA:21,7,1,0
-FN:32,GameCult.PongReborn.Scripts.Networking.ChangeNameMessage MessagePack.GeneratedMessagePackResolver/GameCult/PongReborn/Scripts/Networking/ChangeNameMessageFormatter::Deserialize(MessagePack.MessagePackReader&,MessagePack.MessagePackSerializerOptions)
-FNDA:0,GameCult.PongReborn.Scripts.Networking.ChangeNameMessage MessagePack.GeneratedMessagePackResolver/GameCult/PongReborn/Scripts/Networking/ChangeNameMessageFormatter::Deserialize(MessagePack.MessagePackReader&,MessagePack.MessagePackSerializerOptions)
-DA:33,0
-DA:34,0
-DA:35,0
-DA:36,0
-DA:39,0
-DA:40,0
-DA:41,0
-DA:42,0
-DA:44,0
-DA:45,0
-DA:46,0
-DA:49,0
-DA:50,0
-DA:52,0
-DA:53,0
-DA:55,0
-DA:57,0
-DA:58,0
-DA:59,0
-BRDA:34,9,0,0
-BRDA:34,9,1,0
-BRDA:44,116,1,0
-BRDA:46,66,1,0
-BRDA:46,66,0,0
-BRDA:44,116,0,0
-LF:28
-LH:0
-BRF:8
-BRH:0
-FNF:2
-FNH:0
-end_of_record
-SF:e:\Projects\CultLib\obj\src\GameCult.Networking\Debug\netstandard2.1\MessagePack.SourceGenerator\MessagePack.SourceGenerator.MessagePackGenerator\Formatters.MessagePack.GeneratedMessagePackResolver.GameCult.PongReborn.Scripts.Networking.ChatMessageFormatter.g.cs
-FN:19,System.Void MessagePack.GeneratedMessagePackResolver/GameCult/PongReborn/Scripts/Networking/ChatMessageFormatter::Serialize(MessagePack.MessagePackWriter&,GameCult.PongReborn.Scripts.Networking.ChatMessage,MessagePack.MessagePackSerializerOptions)
-FNDA:0,System.Void MessagePack.GeneratedMessagePackResolver/GameCult/PongReborn/Scripts/Networking/ChatMessageFormatter::Serialize(MessagePack.MessagePackWriter&,GameCult.PongReborn.Scripts.Networking.ChatMessage,MessagePack.MessagePackSerializerOptions)
-DA:20,0
-DA:21,0
-DA:22,0
-DA:23,0
-DA:24,0
-DA:27,0
-DA:28,0
-DA:29,0
-DA:30,0
-BRDA:21,7,0,0
-BRDA:21,7,1,0
-FN:32,GameCult.PongReborn.Scripts.Networking.ChatMessage MessagePack.GeneratedMessagePackResolver/GameCult/PongReborn/Scripts/Networking/ChatMessageFormatter::Deserialize(MessagePack.MessagePackReader&,MessagePack.MessagePackSerializerOptions)
-FNDA:0,GameCult.PongReborn.Scripts.Networking.ChatMessage MessagePack.GeneratedMessagePackResolver/GameCult/PongReborn/Scripts/Networking/ChatMessageFormatter::Deserialize(MessagePack.MessagePackReader&,MessagePack.MessagePackSerializerOptions)
-DA:33,0
-DA:34,0
-DA:35,0
-DA:36,0
-DA:39,0
-DA:40,0
-DA:41,0
-DA:42,0
-DA:44,0
-DA:45,0
-DA:46,0
-DA:49,0
-DA:50,0
-DA:52,0
-DA:53,0
-DA:55,0
-DA:57,0
-DA:58,0
-DA:59,0
-BRDA:34,9,0,0
-BRDA:34,9,1,0
-BRDA:44,116,1,0
-BRDA:46,66,1,0
-BRDA:46,66,0,0
-BRDA:44,116,0,0
-LF:28
-LH:0
-BRF:8
-BRH:0
-FNF:2
-FNH:0
-end_of_record
-SF:e:\Projects\CultLib\obj\src\GameCult.Networking\Debug\netstandard2.1\MessagePack.SourceGenerator\MessagePack.SourceGenerator.MessagePackGenerator\Formatters.MessagePack.GeneratedMessagePackResolver.GameCult.PongReborn.Scripts.Networking.ErrorMessageFormatter.g.cs
-FN:19,System.Void MessagePack.GeneratedMessagePackResolver/GameCult/PongReborn/Scripts/Networking/ErrorMessageFormatter::Serialize(MessagePack.MessagePackWriter&,GameCult.PongReborn.Scripts.Networking.ErrorMessage,MessagePack.MessagePackSerializerOptions)
-FNDA:0,System.Void MessagePack.GeneratedMessagePackResolver/GameCult/PongReborn/Scripts/Networking/ErrorMessageFormatter::Serialize(MessagePack.MessagePackWriter&,GameCult.PongReborn.Scripts.Networking.ErrorMessage,MessagePack.MessagePackSerializerOptions)
-DA:20,0
-DA:21,0
-DA:22,0
-DA:23,0
-DA:24,0
-DA:27,0
-DA:28,0
-DA:29,0
-DA:30,0
-BRDA:21,7,0,0
-BRDA:21,7,1,0
-FN:32,GameCult.PongReborn.Scripts.Networking.ErrorMessage MessagePack.GeneratedMessagePackResolver/GameCult/PongReborn/Scripts/Networking/ErrorMessageFormatter::Deserialize(MessagePack.MessagePackReader&,MessagePack.MessagePackSerializerOptions)
-FNDA:0,GameCult.PongReborn.Scripts.Networking.ErrorMessage MessagePack.GeneratedMessagePackResolver/GameCult/PongReborn/Scripts/Networking/ErrorMessageFormatter::Deserialize(MessagePack.MessagePackReader&,MessagePack.MessagePackSerializerOptions)
-DA:33,0
-DA:34,0
-DA:35,0
-DA:36,0
-DA:39,0
-DA:40,0
-DA:41,0
-DA:42,0
-DA:44,0
-DA:45,0
-DA:46,0
-DA:49,0
-DA:50,0
-DA:52,0
-DA:53,0
-DA:55,0
-DA:57,0
-DA:58,0
-DA:59,0
-BRDA:34,9,0,0
-BRDA:34,9,1,0
-BRDA:44,116,1,0
-BRDA:46,66,1,0
-BRDA:46,66,0,0
-BRDA:44,116,0,0
-LF:28
-LH:0
-BRF:8
-BRH:0
-FNF:2
-FNH:0
-end_of_record
-SF:e:\Projects\CultLib\obj\src\GameCult.Networking\Debug\netstandard2.1\MessagePack.SourceGenerator\MessagePack.SourceGenerator.MessagePackGenerator\Formatters.MessagePack.GeneratedMessagePackResolver.GameCult.PongReborn.Scripts.Networking.LoginMessageFormatter.g.cs
-FN:19,System.Void MessagePack.GeneratedMessagePackResolver/GameCult/PongReborn/Scripts/Networking/LoginMessageFormatter::Serialize(MessagePack.MessagePackWriter&,GameCult.PongReborn.Scripts.Networking.LoginMessage,MessagePack.MessagePackSerializerOptions)
-FNDA:0,System.Void MessagePack.GeneratedMessagePackResolver/GameCult/PongReborn/Scripts/Networking/LoginMessageFormatter::Serialize(MessagePack.MessagePackWriter&,GameCult.PongReborn.Scripts.Networking.LoginMessage,MessagePack.MessagePackSerializerOptions)
-DA:20,0
-DA:21,0
-DA:22,0
-DA:23,0
-DA:24,0
-DA:27,0
-DA:28,0
-DA:29,0
-DA:30,0
-DA:31,0
-BRDA:21,7,0,0
-BRDA:21,7,1,0
-FN:33,GameCult.PongReborn.Scripts.Networking.LoginMessage MessagePack.GeneratedMessagePackResolver/GameCult/PongReborn/Scripts/Networking/LoginMessageFormatter::Deserialize(MessagePack.MessagePackReader&,MessagePack.MessagePackSerializerOptions)
-FNDA:0,GameCult.PongReborn.Scripts.Networking.LoginMessage MessagePack.GeneratedMessagePackResolver/GameCult/PongReborn/Scripts/Networking/LoginMessageFormatter::Deserialize(MessagePack.MessagePackReader&,MessagePack.MessagePackSerializerOptions)
-DA:34,0
-DA:35,0
-DA:36,0
-DA:37,0
-DA:40,0
-DA:41,0
-DA:42,0
-DA:44,0
-DA:45,0
-DA:46,0
-DA:49,0
-DA:50,0
-DA:52,0
-DA:53,0
-DA:55,0
-DA:56,0
-DA:58,0
-DA:59,0
-DA:61,0
-DA:63,0
-DA:64,0
-DA:65,0
-BRDA:35,9,0,0
-BRDA:35,9,1,0
-BRDA:44,174,1,0
-BRDA:46,61,1,0
-BRDA:46,61,2,0
-BRDA:46,61,3,0
-BRDA:46,61,0,0
-BRDA:44,174,0,0
-LF:32
-LH:0
-BRF:10
-BRH:0
-FNF:2
-FNH:0
-end_of_record
-SF:e:\Projects\CultLib\obj\src\GameCult.Networking\Debug\netstandard2.1\MessagePack.SourceGenerator\MessagePack.SourceGenerator.MessagePackGenerator\Formatters.MessagePack.GeneratedMessagePackResolver.GameCult.PongReborn.Scripts.Networking.LoginSuccessMessageFormatter.g.cs
-FN:19,System.Void MessagePack.GeneratedMessagePackResolver/GameCult/PongReborn/Scripts/Networking/LoginSuccessMessageFormatter::Serialize(MessagePack.MessagePackWriter&,GameCult.PongReborn.Scripts.Networking.LoginSuccessMessage,MessagePack.MessagePackSerializerOptions)
-FNDA:0,System.Void MessagePack.GeneratedMessagePackResolver/GameCult/PongReborn/Scripts/Networking/LoginSuccessMessageFormatter::Serialize(MessagePack.MessagePackWriter&,GameCult.PongReborn.Scripts.Networking.LoginSuccessMessage,MessagePack.MessagePackSerializerOptions)
-DA:20,0
-DA:21,0
-DA:22,0
-DA:23,0
-DA:24,0
-DA:27,0
-DA:28,0
-DA:29,0
-DA:30,0
-BRDA:21,7,0,0
-BRDA:21,7,1,0
-FN:32,GameCult.PongReborn.Scripts.Networking.LoginSuccessMessage MessagePack.GeneratedMessagePackResolver/GameCult/PongReborn/Scripts/Networking/LoginSuccessMessageFormatter::Deserialize(MessagePack.MessagePackReader&,MessagePack.MessagePackSerializerOptions)
-FNDA:0,GameCult.PongReborn.Scripts.Networking.LoginSuccessMessage MessagePack.GeneratedMessagePackResolver/GameCult/PongReborn/Scripts/Networking/LoginSuccessMessageFormatter::Deserialize(MessagePack.MessagePackReader&,MessagePack.MessagePackSerializerOptions)
-DA:33,0
-DA:34,0
-DA:35,0
-DA:36,0
-DA:39,0
-DA:40,0
-DA:41,0
-DA:43,0
-DA:44,0
-DA:45,0
-DA:48,0
-DA:49,0
-DA:51,0
-DA:52,0
-DA:54,0
-DA:55,0
-DA:57,0
-DA:59,0
-DA:60,0
-DA:61,0
-BRDA:34,9,0,0
-BRDA:34,9,1,0
-BRDA:43,143,1,0
-BRDA:45,61,0,0
-BRDA:45,61,1,0
-BRDA:45,68,1,0
-BRDA:45,68,0,0
-BRDA:43,143,0,0
-LF:29
-LH:0
-BRF:10
-BRH:0
-FNF:2
-FNH:0
-end_of_record
-SF:e:\Projects\CultLib\obj\src\GameCult.Networking\Debug\netstandard2.1\MessagePack.SourceGenerator\MessagePack.SourceGenerator.MessagePackGenerator\Formatters.MessagePack.GeneratedMessagePackResolver.GameCult.PongReborn.Scripts.Networking.RegisterMessageFormatter.g.cs
-FN:19,System.Void MessagePack.GeneratedMessagePackResolver/GameCult/PongReborn/Scripts/Networking/RegisterMessageFormatter::Serialize(MessagePack.MessagePackWriter&,GameCult.PongReborn.Scripts.Networking.RegisterMessage,MessagePack.MessagePackSerializerOptions)
-FNDA:0,System.Void MessagePack.GeneratedMessagePackResolver/GameCult/PongReborn/Scripts/Networking/RegisterMessageFormatter::Serialize(MessagePack.MessagePackWriter&,GameCult.PongReborn.Scripts.Networking.RegisterMessage,MessagePack.MessagePackSerializerOptions)
-DA:20,0
-DA:21,0
-DA:22,0
-DA:23,0
-DA:24,0
-DA:27,0
-DA:28,0
-DA:29,0
-DA:30,0
-DA:31,0
-DA:32,0
-BRDA:21,7,0,0
-BRDA:21,7,1,0
-FN:34,GameCult.PongReborn.Scripts.Networking.RegisterMessage MessagePack.GeneratedMessagePackResolver/GameCult/PongReborn/Scripts/Networking/RegisterMessageFormatter::Deserialize(MessagePack.MessagePackReader&,MessagePack.MessagePackSerializerOptions)
-FNDA:0,GameCult.PongReborn.Scripts.Networking.RegisterMessage MessagePack.GeneratedMessagePackResolver/GameCult/PongReborn/Scripts/Networking/RegisterMessageFormatter::Deserialize(MessagePack.MessagePackReader&,MessagePack.MessagePackSerializerOptions)
-DA:35,0
-DA:36,0
-DA:37,0
-DA:38,0
-DA:41,0
-DA:42,0
-DA:43,0
-DA:45,0
-DA:46,0
-DA:47,0
-DA:50,0
-DA:51,0
-DA:53,0
-DA:54,0
-DA:56,0
-DA:57,0
-DA:59,0
-DA:60,0
-DA:62,0
-DA:63,0
-DA:65,0
-DA:67,0
-DA:68,0
-DA:69,0
-BRDA:36,9,0,0
-BRDA:36,9,1,0
-BRDA:45,204,1,0
-BRDA:47,64,1,0
-BRDA:47,64,2,0
-BRDA:47,64,3,0
-BRDA:47,64,4,0
-BRDA:47,64,0,0
-BRDA:45,204,0,0
-LF:35
-LH:0
-BRF:11
-BRH:0
-FNF:2
-FNH:0
-end_of_record
-SF:e:\Projects\CultLib\obj\src\GameCult.Networking\Debug\netstandard2.1\MessagePack.SourceGenerator\MessagePack.SourceGenerator.MessagePackGenerator\Formatters.MessagePack.GeneratedMessagePackResolver.GameCult.PongReborn.Scripts.Networking.VerifyMessageFormatter.g.cs
-FN:19,System.Void MessagePack.GeneratedMessagePackResolver/GameCult/PongReborn/Scripts/Networking/VerifyMessageFormatter::Serialize(MessagePack.MessagePackWriter&,GameCult.PongReborn.Scripts.Networking.VerifyMessage,MessagePack.MessagePackSerializerOptions)
-FNDA:0,System.Void MessagePack.GeneratedMessagePackResolver/GameCult/PongReborn/Scripts/Networking/VerifyMessageFormatter::Serialize(MessagePack.MessagePackWriter&,GameCult.PongReborn.Scripts.Networking.VerifyMessage,MessagePack.MessagePackSerializerOptions)
-DA:20,0
-DA:21,0
-DA:22,0
-DA:23,0
-DA:24,0
-DA:27,0
-DA:28,0
-DA:29,0
-DA:30,0
-BRDA:21,7,0,0
-BRDA:21,7,1,0
-FN:32,GameCult.PongReborn.Scripts.Networking.VerifyMessage MessagePack.GeneratedMessagePackResolver/GameCult/PongReborn/Scripts/Networking/VerifyMessageFormatter::Deserialize(MessagePack.MessagePackReader&,MessagePack.MessagePackSerializerOptions)
-FNDA:0,GameCult.PongReborn.Scripts.Networking.VerifyMessage MessagePack.GeneratedMessagePackResolver/GameCult/PongReborn/Scripts/Networking/VerifyMessageFormatter::Deserialize(MessagePack.MessagePackReader&,MessagePack.MessagePackSerializerOptions)
-DA:33,0
-DA:34,0
-DA:35,0
-DA:36,0
-DA:39,0
-DA:40,0
-DA:41,0
-DA:43,0
-DA:44,0
-DA:45,0
-DA:48,0
-DA:49,0
-DA:51,0
-DA:52,0
-DA:54,0
-DA:55,0
-DA:57,0
-DA:59,0
-DA:60,0
-DA:61,0
-BRDA:34,9,0,0
-BRDA:34,9,1,0
-BRDA:43,143,1,0
-BRDA:45,61,0,0
-BRDA:45,61,1,0
-BRDA:45,68,1,0
-BRDA:45,68,0,0
-BRDA:43,143,0,0
-LF:29
-LH:0
-BRF:10
-BRH:0
-FNF:2
-FNH:0
-end_of_record
-SF:e:\Projects\CultLib\obj\src\GameCult.Networking\Debug\netstandard2.1\MessagePack.SourceGenerator\MessagePack.SourceGenerator.MessagePackGenerator\Formatters.MessagePack.GeneratedMessagePackResolver.GameCult.PongReborn.Scripts.Networking.MessageFormatter.g.cs
-FN:40,System.Void MessagePack.GeneratedMessagePackResolver/GameCult/PongReborn/Scripts/Networking/MessageFormatter::Serialize(MessagePack.MessagePackWriter&,GameCult.PongReborn.Scripts.Networking.Message,MessagePack.MessagePackSerializerOptions)
-FNDA:0,System.Void MessagePack.GeneratedMessagePackResolver/GameCult/PongReborn/Scripts/Networking/MessageFormatter::Serialize(MessagePack.MessagePackWriter&,GameCult.PongReborn.Scripts.Networking.Message,MessagePack.MessagePackSerializerOptions)
-DA:41,0
-DA:43,0
-DA:44,0
-DA:45,0
-DA:46,0
-DA:47,0
-DA:50,0
-DA:51,0
-DA:53,0
-DA:54,0
-DA:56,0
-DA:57,0
-DA:59,0
-DA:60,0
-DA:62,0
-DA:63,0
-DA:65,0
-DA:66,0
-DA:68,0
-DA:71,0
-DA:74,0
-DA:75,0
-BRDA:43,2,0,0
-BRDA:43,2,1,0
-BRDA:43,33,0,0
-BRDA:47,72,1,0
-BRDA:47,72,2,0
-BRDA:47,72,3,0
-BRDA:47,72,4,0
-BRDA:47,72,5,0
-BRDA:47,72,6,0
-BRDA:43,33,1,0
-BRDA:47,72,0,0
-FN:77,GameCult.PongReborn.Scripts.Networking.Message MessagePack.GeneratedMessagePackResolver/GameCult/PongReborn/Scripts/Networking/MessageFormatter::Deserialize(MessagePack.MessagePackReader&,MessagePack.MessagePackSerializerOptions)
-FNDA:0,GameCult.PongReborn.Scripts.Networking.Message MessagePack.GeneratedMessagePackResolver/GameCult/PongReborn/Scripts/Networking/MessageFormatter::Deserialize(MessagePack.MessagePackReader&,MessagePack.MessagePackSerializerOptions)
-DA:78,0
-DA:79,0
-DA:80,0
-DA:81,0
-DA:84,0
-DA:85,0
-DA:86,0
-DA:89,0
-DA:90,0
-DA:92,0
-DA:93,0
-DA:94,0
-DA:95,0
-DA:97,0
-DA:98,0
-DA:101,0
-DA:102,0
-DA:104,0
-DA:105,0
-DA:107,0
-DA:108,0
-DA:110,0
-DA:111,0
-DA:113,0
-DA:114,0
-DA:116,0
-DA:117,0
-DA:119,0
-DA:120,0
-DA:123,0
-DA:124,0
-DA:125,0
-BRDA:79,9,0,0
-BRDA:79,9,1,0
-BRDA:84,35,0,0
-BRDA:84,35,1,0
-BRDA:92,90,0,0
-BRDA:92,90,1,0
-BRDA:98,107,1,0
-BRDA:98,107,2,0
-BRDA:98,107,3,0
-BRDA:98,107,4,0
-BRDA:98,107,5,0
-BRDA:98,107,6,0
-BRDA:98,107,0,0
-FN:17,System.Void MessagePack.GeneratedMessagePackResolver/GameCult/PongReborn/Scripts/Networking/MessageFormatter::.ctor()
-FNDA:0,System.Void MessagePack.GeneratedMessagePackResolver/GameCult/PongReborn/Scripts/Networking/MessageFormatter::.ctor()
-DA:18,0
-DA:19,0
-DA:20,0
-DA:21,0
-DA:22,0
-DA:23,0
-DA:24,0
-DA:25,0
-DA:26,0
-DA:27,0
-DA:28,0
-DA:29,0
-DA:30,0
-DA:31,0
-DA:32,0
-DA:33,0
-DA:34,0
-DA:35,0
-DA:36,0
-DA:37,0
-DA:38,0
-LF:75
-LH:0
-BRF:24
-BRH:0
-FNF:3
-FNH:0
-end_of_record
-SF:e:\Projects\CultLib\src\GameCult.Networking\Client.cs
-FN:29,GameCult.Logging.ILogger GameCult.PongReborn.Scripts.Networking.Client::get_Logger()
-FNDA:0,GameCult.Logging.ILogger GameCult.PongReborn.Scripts.Networking.Client::get_Logger()
-DA:30,0
-FN:30,System.Void GameCult.PongReborn.Scripts.Networking.Client::set_Logger(GameCult.Logging.ILogger)
-FNDA:0,System.Void GameCult.PongReborn.Scripts.Networking.Client::set_Logger(GameCult.Logging.ILogger)
-DA:31,0
-BRDA:31,3,0,0
-BRDA:31,3,1,0
-FN:33,System.Int32 GameCult.PongReborn.Scripts.Networking.Client::get_Ping()
-FNDA:0,System.Int32 GameCult.PongReborn.Scripts.Networking.Client::get_Ping()
-DA:34,0
-FN:34,System.Boolean GameCult.PongReborn.Scripts.Networking.Client::get_Verified()
-FNDA:0,System.Boolean GameCult.PongReborn.Scripts.Networking.Client::get_Verified()
-DA:35,0
-FN:35,System.Boolean GameCult.PongReborn.Scripts.Networking.Client::get_Connected()
-FNDA:0,System.Boolean GameCult.PongReborn.Scripts.Networking.Client::get_Connected()
-DA:36,0
-FN:43,System.Void GameCult.PongReborn.Scripts.Networking.Client::Send(T)
-FNDA:0,System.Void GameCult.PongReborn.Scripts.Networking.Client::Send(T)
-DA:44,0
-DA:45,0
-DA:46,0
-DA:47,0
-DA:48,0
-DA:49,0
-DA:50,0
-DA:51,0
-DA:52,0
-DA:53,0
-DA:54,0
-DA:55,0
-BRDA:45,9,0,0
-BRDA:47,21,0,0
-BRDA:47,34,0,0
-BRDA:47,47,0,0
-BRDA:47,21,1,0
-BRDA:47,34,1,0
-BRDA:47,47,1,0
-BRDA:47,68,0,0
-BRDA:47,68,1,0
-BRDA:45,9,1,0
-FN:57,System.Void GameCult.PongReborn.Scripts.Networking.Client::ClearMessageListeners()
-FNDA:0,System.Void GameCult.PongReborn.Scripts.Networking.Client::ClearMessageListeners()
-DA:58,0
-DA:59,0
-DA:60,0
-FN:62,System.Void GameCult.PongReborn.Scripts.Networking.Client::AddMessageListener(System.Action`1<T>)
-FNDA:0,System.Void GameCult.PongReborn.Scripts.Networking.Client::AddMessageListener(System.Action`1<T>)
-DA:63,0
-DA:64,0
-DA:66,0
-DA:67,0
-DA:68,0
-DA:69,0
-DA:70,0
-DA:71,0
-DA:72,0
-DA:73,0
-DA:74,0
-BRDA:72,21,0,0
-BRDA:72,21,1,0
-FN:76,System.Void GameCult.PongReborn.Scripts.Networking.Client::RemoveMessageListener(System.Action`1<T>)
-FNDA:0,System.Void GameCult.PongReborn.Scripts.Networking.Client::RemoveMessageListener(System.Action`1<T>)
-DA:77,0
-DA:78,0
-DA:79,0
-DA:80,0
-DA:81,0
-DA:82,0
-DA:83,0
-BRDA:78,26,0,0
-BRDA:78,26,1,0
-FN:85,System.Void GameCult.PongReborn.Scripts.Networking.Client::Login(System.String,System.String)
-FNDA:0,System.Void GameCult.PongReborn.Scripts.Networking.Client::Login(System.String,System.String)
-DA:86,0
-DA:87,0
-DA:88,0
-DA:89,0
-DA:90,0
-DA:91,0
-DA:92,0
-DA:93,0
-DA:94,0
-DA:95,0
-DA:96,0
-DA:97,0
-DA:98,0
-DA:99,0
-DA:100,0
-DA:101,0
-DA:102,0
-BRDA:87,12,0,0
-BRDA:89,24,0,0
-BRDA:89,24,1,0
-BRDA:89,36,0,0
-BRDA:89,36,1,0
-BRDA:99,100,0,0
-BRDA:99,100,1,0
-BRDA:87,12,1,0
-BRDA:101,126,0,0
-BRDA:101,126,1,0
-FN:104,System.Void GameCult.PongReborn.Scripts.Networking.Client::Register(System.String,System.String,System.String)
-FNDA:0,System.Void GameCult.PongReborn.Scripts.Networking.Client::Register(System.String,System.String,System.String)
-DA:105,0
-DA:106,0
-DA:107,0
-DA:108,0
-DA:109,0
-DA:110,0
-DA:111,0
-DA:112,0
-DA:113,0
-DA:114,0
-DA:115,0
-DA:116,0
-DA:117,0
-DA:118,0
-DA:119,0
-DA:120,0
-DA:121,0
-DA:122,0
-DA:123,0
-DA:124,0
-DA:125,0
-DA:126,0
-BRDA:106,12,0,0
-BRDA:108,29,0,0
-BRDA:110,41,0,0
-BRDA:110,41,1,0
-BRDA:110,53,0,0
-BRDA:110,53,1,0
-BRDA:121,135,0,0
-BRDA:121,135,1,0
-BRDA:108,29,1,0
-BRDA:123,161,0,0
-BRDA:123,161,1,0
-BRDA:106,12,1,0
-BRDA:125,187,0,0
-BRDA:125,187,1,0
-FN:128,System.Void GameCult.PongReborn.Scripts.Networking.Client::Connect(System.String,System.Int32)
-FNDA:0,System.Void GameCult.PongReborn.Scripts.Networking.Client::Connect(System.String,System.Int32)
-DA:129,0
-DA:130,0
-DA:131,0
-DA:133,0
-DA:134,0
-DA:135,0
-DA:136,0
-DA:137,0
-DA:138,0
-DA:139,0
-DA:140,0
-DA:141,0
-DA:142,0
-DA:143,0
-DA:144,0
-DA:145,0
-DA:146,0
-DA:147,0
-DA:148,0
-DA:149,0
-DA:150,0
-DA:151,0
-DA:152,0
-DA:153,0
-DA:154,0
-DA:155,0
-DA:156,0
-DA:157,0
-DA:158,0
-DA:159,0
-DA:160,0
-DA:161,0
-DA:162,0
-DA:163,0
-DA:164,0
-DA:165,0
-DA:166,0
-DA:167,0
-DA:168,0
-DA:169,0
-DA:170,0
-DA:171,0
-DA:172,0
-DA:173,0
-DA:174,0
-DA:175,0
-DA:176,0
-DA:178,0
-DA:179,0
-DA:180,0
-DA:181,0
-DA:182,0
-DA:183,0
-DA:184,0
-DA:185,0
-DA:186,0
-DA:187,0
-DA:189,0
-DA:190,0
-DA:191,0
-DA:192,0
-DA:193,0
-DA:194,0
-DA:196,0
-DA:197,0
-DA:198,0
-FN:39,System.Void GameCult.PongReborn.Scripts.Networking.Client::<.ctor>b__21_0(System.String)
-FNDA:0,System.Void GameCult.PongReborn.Scripts.Networking.Client::<.ctor>b__21_0(System.String)
-DA:40,0
-FN:19,System.Void GameCult.PongReborn.Scripts.Networking.Client::.ctor()
-FNDA:0,System.Void GameCult.PongReborn.Scripts.Networking.Client::.ctor()
-DA:20,0
-DA:26,0
-DA:38,0
-DA:39,0
-DA:41,0
-LF:149
-LH:0
-BRF:54
-BRH:0
-FNF:14
-FNH:0
-end_of_record
-SF:e:\Projects\CultLib\src\GameCult.Networking\Messages.cs
-FN:16,LiteNetLib.NetPeer GameCult.PongReborn.Scripts.Networking.Message::get_Peer()
-FNDA:0,LiteNetLib.NetPeer GameCult.PongReborn.Scripts.Networking.Message::get_Peer()
-DA:17,0
-LF:1
-LH:0
-BRF:0
-BRH:0
-FNF:1
-FNH:0
-end_of_record
-SF:e:\Projects\CultLib\src\GameCult.Networking\NetPeerExtensions.cs
-FN:8,System.Void GameCult.PongReborn.Scripts.Networking.NetPeerExtensions::Send(LiteNetLib.NetPeer,T)
-FNDA:0,System.Void GameCult.PongReborn.Scripts.Networking.NetPeerExtensions::Send(LiteNetLib.NetPeer,T)
-DA:9,0
-DA:10,0
-DA:11,0
-LF:3
-LH:0
-BRF:0
-BRH:0
-FNF:1
-FNH:0
-end_of_record
-SF:e:\Projects\CultLib\src\GameCult.Networking\Secret.cs
-FN:15,System.Byte[] GameCult.PongReborn.Scripts.Networking.Secret::get_NewNonce()
-FNDA:0,System.Byte[] GameCult.PongReborn.Scripts.Networking.Secret::get_NewNonce()
-DA:16,0
-DA:17,0
-DA:18,0
-DA:19,0
-DA:20,0
-FN:23,System.Byte[] GameCult.PongReborn.Scripts.Networking.Secret::EncryptString(System.String,System.Byte[])
-FNDA:0,System.Byte[] GameCult.PongReborn.Scripts.Networking.Secret::EncryptString(System.String,System.Byte[])
-DA:24,0
-DA:25,0
-DA:26,0
-DA:27,0
-BRDA:25,9,0,0
-BRDA:25,9,1,0
-FN:29,System.Byte[] GameCult.PongReborn.Scripts.Networking.Secret::EncryptBytes(System.Byte[],System.Byte[])
-FNDA:0,System.Byte[] GameCult.PongReborn.Scripts.Networking.Secret::EncryptBytes(System.Byte[],System.Byte[])
-DA:30,0
-DA:31,0
-DA:32,0
-DA:34,0
-DA:35,0
-DA:36,0
-DA:37,0
-DA:38,0
-DA:39,0
-DA:40,0
-DA:41,0
-DA:42,0
-BRDA:31,2,0,0
-BRDA:31,5,0,0
-BRDA:31,2,1,0
-BRDA:31,5,1,0
-BRDA:31,32,0,0
-BRDA:31,32,1,0
-FN:44,System.String GameCult.PongReborn.Scripts.Networking.Secret::DecryptString(System.Byte[],System.Byte[])
-FNDA:0,System.String GameCult.PongReborn.Scripts.Networking.Secret::DecryptString(System.Byte[],System.Byte[])
-DA:45,0
-DA:46,0
-DA:47,0
-DA:48,0
-DA:49,0
-BRDA:46,2,0,0
-BRDA:46,5,0,0
-BRDA:46,2,1,0
-BRDA:46,5,1,0
-BRDA:46,30,0,0
-BRDA:46,30,1,0
-FN:51,System.Byte[] GameCult.PongReborn.Scripts.Networking.Secret::DecryptBytes(System.Byte[],System.Byte[])
-FNDA:0,System.Byte[] GameCult.PongReborn.Scripts.Networking.Secret::DecryptBytes(System.Byte[],System.Byte[])
-DA:52,0
-DA:53,0
-DA:54,0
-DA:56,0
-DA:57,0
-DA:58,0
-DA:59,0
-DA:60,0
-DA:61,0
-DA:62,0
-BRDA:53,2,0,0
-BRDA:53,17,0,0
-BRDA:53,20,0,0
-BRDA:53,2,1,0
-BRDA:53,17,1,0
-BRDA:53,20,1,0
-BRDA:53,47,0,0
-BRDA:53,47,1,0
-FN:9,System.Void GameCult.PongReborn.Scripts.Networking.Secret::.cctor()
-FNDA:0,System.Void GameCult.PongReborn.Scripts.Networking.Secret::.cctor()
-DA:10,0
-DA:11,0
-LF:38
-LH:0
-BRF:22
-BRH:0
-FNF:6
-FNH:0
-end_of_record
-SF:e:\Projects\CultLib\src\GameCult.Networking\Server.cs
-FN:39,GameCult.Logging.ILogger GameCult.PongReborn.Scripts.Networking.Server::get_Logger()
-FNDA:0,GameCult.Logging.ILogger GameCult.PongReborn.Scripts.Networking.Server::get_Logger()
-DA:40,0
-FN:40,System.Void GameCult.PongReborn.Scripts.Networking.Server::set_Logger(GameCult.Logging.ILogger)
-FNDA:0,System.Void GameCult.PongReborn.Scripts.Networking.Server::set_Logger(GameCult.Logging.ILogger)
-DA:41,0
-BRDA:41,3,0,0
-BRDA:41,3,1,0
-FN:43,System.Single GameCult.PongReborn.Scripts.Networking.Server::get_Time()
-FNDA:0,System.Single GameCult.PongReborn.Scripts.Networking.Server::get_Time()
-DA:44,0
-FN:53,System.Boolean GameCult.PongReborn.Scripts.Networking.Server::IsValidEmail(System.String)
-FNDA:0,System.Boolean GameCult.PongReborn.Scripts.Networking.Server::IsValidEmail(System.String)
-DA:54,0
-FN:54,System.Boolean GameCult.PongReborn.Scripts.Networking.Server::IsValidUsername(System.String)
-FNDA:0,System.Boolean GameCult.PongReborn.Scripts.Networking.Server::IsValidUsername(System.String)
-DA:55,0
-FN:57,System.Void GameCult.PongReborn.Scripts.Networking.Server::ClearMessageListeners()
-FNDA:0,System.Void GameCult.PongReborn.Scripts.Networking.Server::ClearMessageListeners()
-DA:58,0
-DA:59,0
-DA:60,0
-FN:62,System.Void GameCult.PongReborn.Scripts.Networking.Server::AddMessageListener(System.Action`1<T>)
-FNDA:0,System.Void GameCult.PongReborn.Scripts.Networking.Server::AddMessageListener(System.Action`1<T>)
-DA:63,0
-DA:64,0
-DA:66,0
-DA:67,0
-DA:68,0
-DA:69,0
-DA:70,0
-DA:71,0
-DA:72,0
-DA:73,0
-DA:74,0
-BRDA:72,21,0,0
-BRDA:72,21,1,0
-FN:76,System.Void GameCult.PongReborn.Scripts.Networking.Server::RemoveMessageListener(System.Action`1<T>)
-FNDA:0,System.Void GameCult.PongReborn.Scripts.Networking.Server::RemoveMessageListener(System.Action`1<T>)
-DA:77,0
-DA:78,0
-DA:79,0
-DA:80,0
-DA:81,0
-DA:82,0
-DA:83,0
-BRDA:78,26,0,0
-BRDA:78,26,1,0
-FN:85,System.Void GameCult.PongReborn.Scripts.Networking.Server::Stop()
-FNDA:0,System.Void GameCult.PongReborn.Scripts.Networking.Server::Stop()
-DA:86,0
-DA:87,0
-DA:88,0
-FN:90,System.Void GameCult.PongReborn.Scripts.Networking.Server::Start()
-FNDA:0,System.Void GameCult.PongReborn.Scripts.Networking.Server::Start()
-DA:91,0
-DA:92,0
-DA:94,0
-DA:95,0
-DA:96,0
-DA:97,0
-DA:98,0
-DA:99,0
-DA:100,0
-DA:102,0
-DA:104,0
-DA:105,0
-DA:106,0
-DA:107,0
-DA:108,0
-DA:109,0
-DA:110,0
-DA:112,0
-DA:113,0
-DA:114,0
-DA:115,0
-DA:116,0
-DA:118,0
-DA:119,0
-DA:120,0
-DA:121,0
-DA:122,0
-DA:123,0
-DA:124,0
-DA:125,0
-DA:126,0
-DA:128,0
-DA:129,0
-DA:130,0
-DA:131,0
-DA:132,0
-DA:134,0
-DA:135,0
-DA:136,0
-DA:137,0
-DA:138,0
-DA:139,0
-DA:140,0
-DA:141,0
-DA:142,0
-DA:143,0
-DA:144,0
-DA:145,0
-DA:146,0
-DA:147,0
-DA:148,0
-DA:149,0
-DA:150,0
-DA:151,0
-DA:152,0
-DA:153,0
-DA:154,0
-DA:155,0
-DA:156,0
-DA:157,0
-DA:158,0
-DA:159,0
-DA:160,0
-DA:161,0
-DA:162,0
-DA:163,0
-DA:164,0
-DA:165,0
-DA:166,0
-DA:167,0
-DA:168,0
-DA:169,0
-DA:170,0
-DA:171,0
-DA:172,0
-DA:173,0
-DA:174,0
-DA:175,0
-DA:176,0
-DA:177,0
-DA:178,0
-DA:179,0
-DA:180,0
-DA:181,0
-DA:182,0
-DA:183,0
-DA:184,0
-DA:185,0
-DA:186,0
-DA:187,0
-DA:188,0
-DA:189,0
-DA:190,0
-DA:191,0
-DA:192,0
-DA:193,0
-DA:194,0
-DA:195,0
-DA:196,0
-DA:197,0
-DA:198,0
-DA:199,0
-DA:200,0
-DA:201,0
-DA:202,0
-DA:203,0
-DA:204,0
-DA:205,0
-DA:206,0
-DA:207,0
-DA:208,0
-DA:209,0
-DA:210,0
-DA:211,0
-DA:212,0
-DA:213,0
-DA:214,0
-DA:215,0
-DA:216,0
-DA:217,0
-DA:218,0
-DA:219,0
-DA:220,0
-DA:221,0
-DA:222,0
-DA:223,0
-DA:224,0
-DA:225,0
-DA:226,0
-DA:227,0
-DA:228,0
-DA:229,0
-DA:230,0
-DA:231,0
-DA:232,0
-DA:233,0
-DA:234,0
-DA:235,0
-DA:236,0
-DA:237,0
-DA:238,0
-DA:239,0
-DA:240,0
-DA:241,0
-DA:242,0
-DA:243,0
-DA:244,0
-DA:245,0
-DA:246,0
-DA:247,0
-DA:248,0
-DA:249,0
-DA:250,0
-DA:251,0
-DA:252,0
-DA:253,0
-DA:254,0
-DA:255,0
-DA:256,0
-DA:257,0
-DA:258,0
-DA:259,0
-DA:260,0
-DA:261,0
-DA:262,0
-DA:263,0
-DA:264,0
-DA:265,0
-DA:266,0
-DA:267,0
-DA:268,0
-DA:269,0
-DA:270,0
-DA:271,0
-DA:272,0
-DA:273,0
-DA:274,0
-DA:275,0
-DA:277,0
-DA:278,0
-DA:279,0
-DA:280,0
-DA:281,0
-DA:282,0
-DA:283,0
-DA:284,0
-DA:285,0
-DA:286,0
-DA:287,0
-DA:288,0
-DA:289,0
-DA:290,0
-DA:291,0
-DA:292,0
-DA:293,0
-DA:294,0
-DA:295,0
-DA:297,0
-DA:298,0
-FN:299,System.Boolean GameCult.PongReborn.Scripts.Networking.Server::IsVerified(GameCult.PongReborn.Scripts.Networking.User)
-FNDA:0,System.Boolean GameCult.PongReborn.Scripts.Networking.Server::IsVerified(GameCult.PongReborn.Scripts.Networking.User)
-DA:300,0
-BRDA:300,1,0,0
-BRDA:300,1,1,0
-FN:302,GameCult.Caching.PlayerData GameCult.PongReborn.Scripts.Networking.Server::SessionData(GameCult.PongReborn.Scripts.Networking.User)
-FNDA:0,GameCult.Caching.PlayerData GameCult.PongReborn.Scripts.Networking.Server::SessionData(GameCult.PongReborn.Scripts.Networking.User)
-DA:303,0
-BRDA:303,7,0,0
-BRDA:303,7,1,0
-FN:305,System.Boolean GameCult.PongReborn.Scripts.Networking.Server::CheckRateLimit(System.String)
-FNDA:0,System.Boolean GameCult.PongReborn.Scripts.Networking.Server::CheckRateLimit(System.String)
-DA:306,0
-DA:307,0
-DA:308,0
-DA:309,0
-DA:310,0
-DA:311,0
-DA:312,0
-DA:313,0
-DA:314,0
-DA:315,0
-DA:316,0
-DA:317,0
-DA:318,0
-DA:319,0
-DA:321,0
-DA:322,0
-BRDA:315,41,1,0
-BRDA:315,17,0,0
-BRDA:315,17,1,0
-BRDA:315,41,0,0
-FN:324,System.Guid GameCult.PongReborn.Scripts.Networking.Server::GenerateSessionGuid()
-FNDA:0,System.Guid GameCult.PongReborn.Scripts.Networking.Server::GenerateSessionGuid()
-DA:325,0
-DA:326,0
-DA:328,0
-DA:329,0
-FN:331,System.Void GameCult.PongReborn.Scripts.Networking.Server::CleanupExpiredSessions()
-FNDA:0,System.Void GameCult.PongReborn.Scripts.Networking.Server::CleanupExpiredSessions()
-DA:332,0
-DA:333,0
-DA:334,0
-DA:335,0
-DA:336,0
-DA:337,0
-DA:338,0
-DA:339,0
-DA:340,0
-DA:341,0
-DA:342,0
-DA:343,0
-DA:344,0
-DA:345,0
-BRDA:333,185,1,0
-BRDA:335,74,0,0
-BRDA:338,118,0,0
-BRDA:338,118,1,0
-BRDA:338,142,0,0
-BRDA:338,142,1,0
-BRDA:335,74,1,0
-BRDA:333,185,0,0
-FN:50,System.Void GameCult.PongReborn.Scripts.Networking.Server::<.ctor>b__19_0(R3.Unit)
-FNDA:0,System.Void GameCult.PongReborn.Scripts.Networking.Server::<.ctor>b__19_0(R3.Unit)
-DA:51,0
-FN:27,System.Void GameCult.PongReborn.Scripts.Networking.Server::.ctor(GameCult.Caching.CultCache)
-FNDA:0,System.Void GameCult.PongReborn.Scripts.Networking.Server::.ctor(GameCult.Caching.CultCache)
-DA:28,0
-DA:29,0
-DA:30,0
-DA:31,0
-DA:32,0
-DA:36,0
-DA:46,0
-DA:47,0
-DA:48,0
-DA:49,0
-DA:50,0
-DA:52,0
-LF:277
-LH:0
-BRF:94
-BRH:0
-FNF:17
-FNH:0
-end_of_record
\ No newline at end of file
diff --git a/tests/GameCult.Networking.WebSockets.Tests/CultNetWebSocketSchemaServerTests.cs b/tests/GameCult.Networking.WebSockets.Tests/CultNetWebSocketSchemaServerTests.cs
new file mode 100644
index 00000000..74fc2f59
--- /dev/null
+++ b/tests/GameCult.Networking.WebSockets.Tests/CultNetWebSocketSchemaServerTests.cs
@@ -0,0 +1,95 @@
+using System.Net;
+using GameCult.Networking.WebSockets;
+using Microsoft.AspNetCore.Builder;
+using Microsoft.AspNetCore.Hosting;
+using Microsoft.AspNetCore.Hosting.Server;
+using Microsoft.AspNetCore.Hosting.Server.Features;
+using Microsoft.Extensions.DependencyInjection;
+using NUnit.Framework;
+
+namespace GameCult.Networking.Tests;
+
+[TestFixture]
+public sealed class CultNetWebSocketSchemaServerTests
+{
+    [Test]
+    public async Task BinarySchemaMessage_RoundTrips_ThroughAuthenticatedHostAdapter()
+    {
+        var builder = WebApplication.CreateSlimBuilder();
+        builder.WebHost.ConfigureKestrel(options => options.Listen(IPAddress.Loopback, 0));
+        await using var server = new CultNetWebSocketSchemaServer();
+        server.OnCultNet<CultNetHelloMessage>((message, peer) =>
+        {
+            peer.SendCultNet(new CultNetHelloMessage
+            {
+                RuntimeId = "csharp-websocket-provider",
+                RuntimeKind = "provider",
+                DisplayName = message.RuntimeId
+            });
+            return Task.CompletedTask;
+        });
+        var app = builder.Build();
+        app.UseWebSockets();
+        app.MapCultNetWebSocket("/cultmesh", server, new CultNetWebSocketEndpointOptions
+        {
+            AuthorizeAsync = context => ValueTask.FromResult(
+                string.Equals(context.Request.Headers.Authorization, "Bearer test-session", StringComparison.Ordinal))
+        });
+        await app.StartAsync();
+        try
+        {
+            var address = app.Services.GetRequiredService<IServer>()
+                .Features.Get<IServerAddressesFeature>()!.Addresses.Single();
+            var endpoint = new Uri(address.Replace("http://", "ws://", StringComparison.Ordinal) + "/cultmesh");
+            using var client = new CultNetWebSocketSchemaClient(options =>
+                options.SetRequestHeader("Authorization", "Bearer test-session"));
+            var received = new TaskCompletionSource<CultNetHelloMessage>(
+                TaskCreationOptions.RunContinuationsAsynchronously);
+            client.OnCultNet<CultNetHelloMessage>(message => received.TrySetResult(message));
+            await client.ConnectAsync(endpoint);
+            client.SendCultNet(new CultNetHelloMessage
+            {
+                RuntimeId = "browser-consumer",
+                RuntimeKind = "browser"
+            });
+            var response = await received.Task.WaitAsync(TimeSpan.FromSeconds(2));
+            Assert.Multiple(() =>
+            {
+                Assert.That(response.RuntimeId, Is.EqualTo("csharp-websocket-provider"));
+                Assert.That(response.DisplayName, Is.EqualTo("browser-consumer"));
+                Assert.That(server.PeerCount, Is.EqualTo(1));
+            });
+            client.Dispose();
+            await WaitUntilAsync(() => server.PeerCount == 0);
+        }
+        finally
+        {
+            await app.StopAsync();
+            await app.DisposeAsync();
+        }
+    }
+
+    [Test]
+    public void Endpoint_Requires_Explicit_Authentication_Or_Development_OptIn()
+    {
+        var builder = WebApplication.CreateSlimBuilder();
+        var app = builder.Build();
+        using var server = new AsyncDisposableScope(new CultNetWebSocketSchemaServer());
+        Assert.That(
+            () => app.MapCultNetWebSocket("/cultmesh", server.Value, new CultNetWebSocketEndpointOptions()),
+            Throws.InvalidOperationException.With.Message.Contains("AuthorizeAsync"));
+    }
+
+    private static async Task WaitUntilAsync(Func<bool> condition)
+    {
+        using var timeout = new CancellationTokenSource(TimeSpan.FromSeconds(2));
+        while (!condition()) await Task.Delay(10, timeout.Token);
+    }
+
+    private sealed class AsyncDisposableScope : IDisposable
+    {
+        public AsyncDisposableScope(CultNetWebSocketSchemaServer value) => Value = value;
+        public CultNetWebSocketSchemaServer Value { get; }
+        public void Dispose() => Value.DisposeAsync().AsTask().GetAwaiter().GetResult();
+    }
+}
diff --git a/tests/GameCult.Networking.WebSockets.Tests/GameCult.Networking.WebSockets.Tests.csproj b/tests/GameCult.Networking.WebSockets.Tests/GameCult.Networking.WebSockets.Tests.csproj
new file mode 100644
index 00000000..eec44ecd
--- /dev/null
+++ b/tests/GameCult.Networking.WebSockets.Tests/GameCult.Networking.WebSockets.Tests.csproj
@@ -0,0 +1,17 @@
+<Project Sdk="Microsoft.NET.Sdk">
+  <PropertyGroup>
+    <TargetFramework>net10.0</TargetFramework>
+    <IsPackable>false</IsPackable>
+    <ImplicitUsings>enable</ImplicitUsings>
+    <Nullable>enable</Nullable>
+  </PropertyGroup>
+  <ItemGroup>
+    <ProjectReference Include="..\..\src\GameCult.Networking.WebSockets\GameCult.Networking.WebSockets.csproj" />
+    <FrameworkReference Include="Microsoft.AspNetCore.App" />
+  </ItemGroup>
+  <ItemGroup>
+    <PackageReference Include="NUnit" Version="4.*" />
+    <PackageReference Include="NUnit3TestAdapter" Version="6.2.0" />
+    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="18.4.0" />
+  </ItemGroup>
+</Project>
diff --git a/tools/GameCult.Mesh.PerformanceProbe/GameCult.Mesh.PerformanceProbe.csproj b/tools/GameCult.Mesh.PerformanceProbe/GameCult.Mesh.PerformanceProbe.csproj
new file mode 100644
index 00000000..4a073fe7
--- /dev/null
+++ b/tools/GameCult.Mesh.PerformanceProbe/GameCult.Mesh.PerformanceProbe.csproj
@@ -0,0 +1,11 @@
+<Project Sdk="Microsoft.NET.Sdk">
+  <PropertyGroup>
+    <OutputType>Exe</OutputType>
+    <TargetFramework>net10.0</TargetFramework>
+    <ImplicitUsings>enable</ImplicitUsings>
+    <Nullable>enable</Nullable>
+  </PropertyGroup>
+  <ItemGroup>
+    <ProjectReference Include="..\..\src\GameCult.Mesh\GameCult.Mesh.csproj" />
+  </ItemGroup>
+</Project>
diff --git a/tools/GameCult.Mesh.PerformanceProbe/Program.cs b/tools/GameCult.Mesh.PerformanceProbe/Program.cs
new file mode 100644
index 00000000..0a367d36
--- /dev/null
+++ b/tools/GameCult.Mesh.PerformanceProbe/Program.cs
@@ -0,0 +1,307 @@
+using System.Diagnostics;
+using System.Text.Json;
+using GameCult.Caching;
+using GameCult.Caching.MessagePack;
+using GameCult.Mesh;
+using MessagePack;
+using R3;
+
+var quick = args.Contains("--quick", StringComparer.OrdinalIgnoreCase);
+var idleDuration = quick ? TimeSpan.FromMilliseconds(250) : TimeSpan.FromSeconds(10);
+var activeDuration = quick ? TimeSpan.FromMilliseconds(500) : TimeSpan.FromSeconds(10);
+var documentCounts = quick ? new[] { 1, 100, 1_000 } : new[] { 1, 100, 1_000 };
+var results = new List<ProbeResult>();
+
+foreach (var documentCount in documentCounts)
+    results.Add(await MeasureAsync(documentCount, idleDuration, activeDuration));
+var hotBody = await MeasureHotBodyAsync(activeDuration);
+
+Console.WriteLine(JsonSerializer.Serialize(new
+{
+    workload = new
+    {
+        documentCounts,
+        payloadBytes = 16 * 1024,
+        idleSeconds = idleDuration.TotalSeconds,
+        activeSeconds = activeDuration.TotalSeconds,
+        updateRateHz = 60,
+        changedFraction = 0.01
+    },
+    results,
+    hotBody
+}, new JsonSerializerOptions { WriteIndented = true }));
+
+return results.All(result =>
+        result.ActualPublishes == result.ExpectedPublishes &&
+        result.PayloadBytesPublished > 0 &&
+        result.AllocationToPayloadRatio < 10 &&
+        result.P99PublishLatencyMilliseconds < 250) &&
+    hotBody.ActualFrames == hotBody.ExpectedFrames &&
+    hotBody.UnavoidableCopyCount == 0 &&
+    hotBody.BlockedWrites == 0 &&
+    hotBody.P99RoundTripMilliseconds < 250
+    ? 0
+    : 1;
+
+static async Task<HotBodyProbeResult> MeasureHotBodyAsync(TimeSpan activeDuration)
+{
+    const int payloadBytes = 16 * 1024;
+    using var publisher = new CultMeshFrameBodyPublisher(
+        "performance:hot-body",
+        "gamecult.mesh.performance_hot_body.v1",
+        layoutVersion: 1,
+        capacity: payloadBytes,
+        producerEpoch: 1,
+        slotByteLength: payloadBytes,
+        leaseDuration: TimeSpan.FromMinutes(1));
+    if (!publisher.TryAcquireWrite(out var bootstrapWrite))
+        throw new InvalidOperationException("Hot-body probe could not reserve its bootstrap slot.");
+    CultMeshBodyDescriptor bootstrap;
+    using (bootstrapWrite)
+    {
+        bootstrapWrite.Span[..payloadBytes].Fill(1);
+        bootstrap = bootstrapWrite.Commit(payloadBytes, DateTimeOffset.UtcNow);
+    }
+    using var cursor = new CultMeshMappedFrameBodyCursor(bootstrap);
+    if (!cursor.TryAcquireLatest(out var bootstrapRead))
+        throw new InvalidOperationException("Hot-body probe could not acquire its bootstrap generation.");
+    bootstrapRead.Dispose();
+
+    ForceCollection();
+    using var process = Process.GetCurrentProcess();
+    process.Refresh();
+    var allocatedStart = GC.GetTotalAllocatedBytes(precise: true);
+    var privateBytesStart = process.PrivateMemorySize64;
+    var cpuStart = process.TotalProcessorTime;
+    var clock = Stopwatch.StartNew();
+    var frameInterval = TimeSpan.FromSeconds(1.0 / 60.0);
+    var latencies = new List<double>();
+    var frames = 0;
+    while (clock.Elapsed < activeDuration)
+    {
+        var started = Stopwatch.GetTimestamp();
+        if (!publisher.TryAcquireWrite(out var write))
+            throw new InvalidOperationException("Hot-body probe encountered unexpected write backpressure.");
+        var marker = (byte)(frames % 251 + 1);
+        using (write)
+        {
+            write.Span[..payloadBytes].Fill(marker);
+            write.Commit(payloadBytes, DateTimeOffset.UtcNow);
+        }
+        if (!cursor.TryAcquireLatest(out var read))
+            throw new InvalidOperationException("Hot-body cursor missed a committed generation.");
+        using (read)
+        {
+            if (read.Descriptor.ByteSize != payloadBytes || read.ReadByte(0) != marker || read.ReadByte(payloadBytes - 1) != marker)
+                throw new InvalidOperationException("Hot-body cursor observed torn or mismatched bytes.");
+        }
+        latencies.Add(Stopwatch.GetElapsedTime(started).TotalMilliseconds);
+        frames++;
+        var remaining = frameInterval * frames - clock.Elapsed;
+        if (remaining > TimeSpan.Zero) await Task.Delay(remaining);
+    }
+
+    process.Refresh();
+    var stats = publisher.Stats();
+    var ordered = latencies.OrderBy(value => value).ToArray();
+    return new HotBodyProbeResult(
+        ExpectedFrames: frames + 1,
+        ActualFrames: checked((int)stats.PublishedFrames),
+        PayloadBytes: payloadBytes,
+        P50RoundTripMilliseconds: Percentile(ordered, 0.50),
+        P95RoundTripMilliseconds: Percentile(ordered, 0.95),
+        P99RoundTripMilliseconds: Percentile(ordered, 0.99),
+        AllocatedBytes: GC.GetTotalAllocatedBytes(precise: true) - allocatedStart,
+        PrivateBytesBefore: privateBytesStart,
+        PrivateBytesAfter: process.PrivateMemorySize64,
+        CpuMilliseconds: (process.TotalProcessorTime - cpuStart).TotalMilliseconds,
+        BlockedWrites: stats.BlockedWrites,
+        UnavoidableCopyCount: stats.UnavoidableCopyCount);
+}
+
+static async Task<ProbeResult> MeasureAsync(
+    int documentCount,
+    TimeSpan idleDuration,
+    TimeSpan activeDuration)
+{
+    var payload = new string('x', 16 * 1024);
+    var changedDocumentCount = Math.Max(1, documentCount / 100);
+    var subjects = new Subject<PerformanceDocument>[documentCount];
+    var reactive = new CultMeshReactiveDocument<PerformanceDocument>[documentCount];
+    var publishSignals = new TaskCompletionSource<bool>?[documentCount];
+    var updateStartedAt = new long[documentCount];
+    var latencies = new List<double>();
+    var measurementClock = Stopwatch.StartNew();
+    long payloadBytesPublished = 0;
+    var publishes = 0;
+
+    for (var index = 0; index < documentCount; index++)
+    {
+        var documentIndex = index;
+        var current = new PerformanceDocument
+        {
+            Id = "performance:" + index,
+            Payload = payload,
+            Revision = 1
+        };
+        var subject = new Subject<PerformanceDocument>();
+        subjects[index] = subject;
+        var handle = CultMesh.Document(
+            "performance:" + index,
+            CultMesh.Verse("performance", "probe"),
+            _ => Task.FromResult(current),
+            _ => subject,
+            value =>
+            {
+                Interlocked.Add(
+                    ref payloadBytesPublished,
+                    CultDocumentMessagePackSerialization.SerializeUntyped(value, typeof(PerformanceDocument)).Length);
+                lock (latencies)
+                {
+                    latencies.Add(Stopwatch.GetElapsedTime(updateStartedAt[documentIndex]).TotalMilliseconds);
+                }
+                Interlocked.Increment(ref publishes);
+                current = value;
+                subject.OnNext(value);
+                publishSignals[documentIndex]?.TrySetResult(true);
+                return Task.CompletedTask;
+            });
+        reactive[index] = await handle.AuthoritativeWriter().ReactiveAsync(
+            new CultMeshReactiveDocumentOptions { FlushDelay = TimeSpan.Zero });
+    }
+
+    try
+    {
+        ForceCollection();
+        var process = Process.GetCurrentProcess();
+        var idleAllocatedStart = GC.GetTotalAllocatedBytes(precise: true);
+        var idleCpuStart = process.TotalProcessorTime;
+        var idleThreadsStart = process.Threads.Count;
+        await Task.Delay(idleDuration);
+        process.Refresh();
+        var idleAllocatedBytes = GC.GetTotalAllocatedBytes(precise: true) - idleAllocatedStart;
+        var idleCpu = process.TotalProcessorTime - idleCpuStart;
+        var idleThreadsEnd = process.Threads.Count;
+
+        ForceCollection();
+        var activeAllocatedStart = GC.GetTotalAllocatedBytes(precise: true);
+        var activeCpuStart = process.TotalProcessorTime;
+        var activeThreadsStart = process.Threads.Count;
+        var activeClock = Stopwatch.StartNew();
+        var frameInterval = TimeSpan.FromSeconds(1.0 / 60.0);
+        var frames = 0;
+        while (activeClock.Elapsed < activeDuration)
+        {
+            var completions = new Task[changedDocumentCount];
+            for (var index = 0; index < changedDocumentCount; index++)
+            {
+                var completion = new TaskCompletionSource<bool>(TaskCreationOptions.RunContinuationsAsynchronously);
+                publishSignals[index] = completion;
+                updateStartedAt[index] = Stopwatch.GetTimestamp();
+                reactive[index].Update(document => document.Revision++);
+                completions[index] = completion.Task;
+            }
+            await Task.WhenAll(completions);
+            frames++;
+            var nextFrameAt = frameInterval * frames;
+            var remaining = nextFrameAt - activeClock.Elapsed;
+            if (remaining > TimeSpan.Zero) await Task.Delay(remaining);
+        }
+
+        process.Refresh();
+        var activeAllocatedBytes = GC.GetTotalAllocatedBytes(precise: true) - activeAllocatedStart;
+        var activeCpu = process.TotalProcessorTime - activeCpuStart;
+        var measuredActiveSeconds = activeClock.Elapsed.TotalSeconds;
+        var activeThreadsEnd = process.Threads.Count;
+        double[] orderedLatencies;
+        lock (latencies) orderedLatencies = latencies.OrderBy(value => value).ToArray();
+
+        return new ProbeResult(
+            documentCount,
+            changedDocumentCount,
+            frames,
+            frames * changedDocumentCount,
+            publishes,
+            payloadBytesPublished,
+            idleAllocatedBytes,
+            idleCpu.TotalMilliseconds,
+            idleThreadsStart,
+            idleThreadsEnd,
+            activeAllocatedBytes,
+            activeCpu.TotalMilliseconds,
+            activeThreadsStart,
+            activeThreadsEnd,
+            activeAllocatedBytes / measuredActiveSeconds,
+            payloadBytesPublished / measuredActiveSeconds,
+            (double)activeAllocatedBytes / payloadBytesPublished,
+            Percentile(orderedLatencies, 0.50),
+            Percentile(orderedLatencies, 0.95),
+            Percentile(orderedLatencies, 0.99),
+            measurementClock.Elapsed.TotalSeconds);
+    }
+    finally
+    {
+        foreach (var document in reactive) document.Dispose();
+        foreach (var subject in subjects) subject.Dispose();
+    }
+}
+
+static double Percentile(double[] ordered, double percentile)
+{
+    if (ordered.Length == 0) return 0;
+    var index = (int)Math.Ceiling(percentile * ordered.Length) - 1;
+    return ordered[Math.Clamp(index, 0, ordered.Length - 1)];
+}
+
+static void ForceCollection()
+{
+    GC.Collect();
+    GC.WaitForPendingFinalizers();
+    GC.Collect();
+}
+
+internal sealed record ProbeResult(
+    int DocumentCount,
+    int ChangedDocumentCount,
+    int Frames,
+    int ExpectedPublishes,
+    int ActualPublishes,
+    long PayloadBytesPublished,
+    long IdleAllocatedBytes,
+    double IdleCpuMilliseconds,
+    int IdleThreadsStart,
+    int IdleThreadsEnd,
+    long ActiveAllocatedBytes,
+    double ActiveCpuMilliseconds,
+    int ActiveThreadsStart,
+    int ActiveThreadsEnd,
+    double ActiveAllocatedBytesPerSecond,
+    double PublishedPayloadBytesPerSecond,
+    double AllocationToPayloadRatio,
+    double P50PublishLatencyMilliseconds,
+    double P95PublishLatencyMilliseconds,
+    double P99PublishLatencyMilliseconds,
+    double ScenarioWallSeconds);
+
+internal sealed record HotBodyProbeResult(
+    int ExpectedFrames,
+    int ActualFrames,
+    int PayloadBytes,
+    double P50RoundTripMilliseconds,
+    double P95RoundTripMilliseconds,
+    double P99RoundTripMilliseconds,
+    long AllocatedBytes,
+    long PrivateBytesBefore,
+    long PrivateBytesAfter,
+    double CpuMilliseconds,
+    ulong BlockedWrites,
+    ulong UnavoidableCopyCount);
+
+[CultDocument("gamecult.mesh.performance_probe", "gamecult.mesh.performance_probe.v1")]
+[MessagePackObject]
+public sealed class PerformanceDocument
+{
+    [Key(0), CultName] public string Id { get; set; } = string.Empty;
+    [Key(1)] public string Payload { get; set; } = string.Empty;
+    [Key(2)] public int Revision { get; set; }
+}
diff --git a/tools/GameCult.TransportParity/GameCult.TransportParity.csproj b/tools/GameCult.TransportParity/GameCult.TransportParity.csproj
new file mode 100644
index 00000000..e4b704da
--- /dev/null
+++ b/tools/GameCult.TransportParity/GameCult.TransportParity.csproj
@@ -0,0 +1,12 @@
+<Project Sdk="Microsoft.NET.Sdk">
+  <PropertyGroup>
+    <OutputType>Exe</OutputType>
+    <TargetFramework>net10.0</TargetFramework>
+    <ImplicitUsings>enable</ImplicitUsings>
+    <Nullable>enable</Nullable>
+  </PropertyGroup>
+  <ItemGroup>
+    <ProjectReference Include="..\..\src\GameCult.Mesh\GameCult.Mesh.csproj" />
+    <ProjectReference Include="..\..\src\GameCult.Mesh.Quic\GameCult.Mesh.Quic.csproj" />
+  </ItemGroup>
+</Project>
diff --git a/tools/GameCult.TransportParity/Program.cs b/tools/GameCult.TransportParity/Program.cs
new file mode 100644
index 00000000..04c71dfe
--- /dev/null
+++ b/tools/GameCult.TransportParity/Program.cs
@@ -0,0 +1,554 @@
+using System.Diagnostics;
+using System.Buffers.Binary;
+using System.IO.MemoryMappedFiles;
+using System.Net;
+using System.Net.Quic;
+using System.Net.Security;
+using System.Net.Sockets;
+using System.Security.Authentication;
+using System.Security.Cryptography;
+using System.Security.Cryptography.X509Certificates;
+using GameCult.Caching;
+using GameCult.Mesh;
+using GameCult.Mesh.Quic;
+using GameCult.Networking;
+
+var payloadBytes = ReadPayloadBytes(args);
+var payload = new byte[payloadBytes];
+new Random(0xAE7E).NextBytes(payload);
+var expectedHash = Convert.ToHexString(SHA256.HashData(payload));
+
+Console.WriteLine($"payloadBytes={payloadBytes} quicSupported={QuicListener.IsSupported}");
+if (!args.Contains("--state-only", StringComparer.Ordinal))
+{
+    Print(MeasureMappedFile(payload));
+    var tcp = await MeasureTcpAsync(payload, expectedHash);
+    Print(tcp);
+    Print(await MeasureCultMeshTcpAsync(payload));
+
+    if (QuicListener.IsSupported)
+        Print(await MeasureQuicAsync(payload, expectedHash));
+    else
+        Console.WriteLine("plane=quic status=unsupported");
+
+    Print(await MeasureCultMeshRudpAsync(payload));
+}
+
+var statePayloadBytes = ReadPositiveOption(args, "--state-bytes", 16 * 1024);
+var stateFrameCount = ReadPositiveOption(args, "--state-frames", 1_000);
+Console.WriteLine($"statePayloadBytes={statePayloadBytes} stateFrames={stateFrameCount}");
+if (QuicListener.IsSupported)
+    PrintState(await MeasureCultMeshQuicStateAsync(statePayloadBytes, stateFrameCount));
+else
+    Console.WriteLine("plane=cultmesh-quic-latest status=unsupported");
+PrintState(await MeasureCultNetRudpLatestStateAsync(statePayloadBytes, stateFrameCount));
+
+static int ReadPayloadBytes(string[] args)
+{
+    const int defaultBytes = 56_204_750;
+    var index = Array.IndexOf(args, "--bytes");
+    if (index < 0) return defaultBytes;
+    if (index + 1 >= args.Length || !int.TryParse(args[index + 1], out var bytes) || bytes <= 0)
+        throw new ArgumentException("--bytes requires a positive 32-bit integer.");
+    return bytes;
+}
+
+static int ReadPositiveOption(string[] args, string option, int defaultValue)
+{
+    var index = Array.IndexOf(args, option);
+    if (index < 0) return defaultValue;
+    if (index + 1 >= args.Length || !int.TryParse(args[index + 1], out var value) || value <= 0)
+        throw new ArgumentException($"{option} requires a positive 32-bit integer.");
+    return value;
+}
+
+static void Print(Result result) =>
+    Console.WriteLine(
+        $"plane={result.Plane} elapsedMs={result.Elapsed.TotalMilliseconds:F1} " +
+        (result.GoodputMiBps.HasValue ? $"goodputMiBps={result.GoodputMiBps.Value:F1}" : "") +
+        (result.WireBytes.HasValue ? $" wireBytes={result.WireBytes.Value}" : string.Empty));
+
+static void PrintState(StateResult result) =>
+    Console.WriteLine(
+        $"plane={result.Plane} sendElapsedMs={result.SendElapsed.TotalMilliseconds:F1} " +
+        $"settledElapsedMs={result.SettledElapsed.TotalMilliseconds:F1} " +
+        $"offeredMiBps={result.OfferedMiBps:F1} deliveredFrames={result.DeliveredFrames}/{result.SentFrames} " +
+        $"highestSequence={result.HighestSequence}" +
+        (result.WireBytes.HasValue ? $" wireBytes={result.WireBytes.Value}" : string.Empty));
+
+static Result MeasureMappedFile(byte[] payload)
+{
+    var source = TempPath("mapped-source");
+    File.WriteAllBytes(source, payload);
+    var elapsed = Stopwatch.StartNew();
+    try
+    {
+        using var mapping = MemoryMappedFile.CreateFromFile(
+            source, FileMode.Open, null, 0, MemoryMappedFileAccess.Read);
+        using var view = mapping.CreateViewAccessor(0, 0, MemoryMappedFileAccess.Read);
+        if (view.ReadByte(0) != payload[0] || view.ReadByte(payload.LongLength - 1) != payload[^1])
+            throw new InvalidDataException("Mapped body did not expose the provider file.");
+        elapsed.Stop();
+        return Result.CreateOpen("mapped-file-open", elapsed.Elapsed);
+    }
+    finally
+    {
+        File.Delete(source);
+    }
+}
+
+static async Task<Result> MeasureTcpAsync(byte[] payload, string expectedHash)
+{
+    using var listener = new TcpListener(IPAddress.Loopback, 0);
+    listener.Start();
+    var endpoint = (IPEndPoint)listener.LocalEndpoint;
+    var server = Task.Run(async () =>
+    {
+        using var peer = await listener.AcceptTcpClientAsync();
+        await peer.GetStream().WriteAsync(payload);
+        peer.Client.Shutdown(SocketShutdown.Send);
+    });
+
+    var output = TempPath("tcp");
+    var elapsed = Stopwatch.StartNew();
+    using (var client = new TcpClient())
+    {
+        await client.ConnectAsync(endpoint.Address, endpoint.Port);
+        await using var file = new FileStream(output, FileMode.CreateNew, FileAccess.Write, FileShare.None,
+            1024 * 1024, FileOptions.Asynchronous | FileOptions.SequentialScan);
+        await client.GetStream().CopyToAsync(file);
+        await file.FlushAsync();
+    }
+    await server;
+    VerifyAndDelete(output, expectedHash);
+    elapsed.Stop();
+    return Result.Create("tcp", payload.LongLength, elapsed.Elapsed);
+}
+
+static async Task<Result> MeasureQuicAsync(byte[] payload, string expectedHash)
+{
+    var protocol = new SslApplicationProtocol("cultmesh-parity");
+    using var certificate = CreateCertificate();
+    await using var listener = await QuicListener.ListenAsync(new QuicListenerOptions
+    {
+        ListenEndPoint = new IPEndPoint(IPAddress.Loopback, 0),
+        ApplicationProtocols = [protocol],
+        ConnectionOptionsCallback = (_, _, _) => ValueTask.FromResult(new QuicServerConnectionOptions
+        {
+            DefaultCloseErrorCode = 0,
+            DefaultStreamErrorCode = 0,
+            ServerAuthenticationOptions = new SslServerAuthenticationOptions
+            {
+                ApplicationProtocols = [protocol],
+                EnabledSslProtocols = SslProtocols.Tls13,
+                ServerCertificate = certificate
+            }
+        })
+    });
+
+    var server = Task.Run(async () =>
+    {
+        await using var connection = await listener.AcceptConnectionAsync();
+        await using var stream = await connection.OpenOutboundStreamAsync(QuicStreamType.Unidirectional);
+        await stream.WriteAsync(payload);
+        stream.CompleteWrites();
+        await stream.WritesClosed;
+    });
+
+    var output = TempPath("quic");
+    var elapsed = Stopwatch.StartNew();
+    await using (var connection = await QuicConnection.ConnectAsync(new QuicClientConnectionOptions
+    {
+        RemoteEndPoint = listener.LocalEndPoint,
+        DefaultCloseErrorCode = 0,
+        DefaultStreamErrorCode = 0,
+        MaxInboundUnidirectionalStreams = 1,
+        ClientAuthenticationOptions = new SslClientAuthenticationOptions
+        {
+            ApplicationProtocols = [protocol],
+            EnabledSslProtocols = SslProtocols.Tls13,
+            RemoteCertificateValidationCallback = (_, _, _, _) => true
+        }
+    }))
+    await using (var stream = await connection.AcceptInboundStreamAsync())
+    await using (var file = new FileStream(output, FileMode.CreateNew, FileAccess.Write, FileShare.None,
+        1024 * 1024, FileOptions.Asynchronous | FileOptions.SequentialScan))
+    {
+        await stream.CopyToAsync(file);
+        await file.FlushAsync();
+    }
+    await server;
+    VerifyAndDelete(output, expectedHash);
+    elapsed.Stop();
+    return Result.Create("quic-msquic", payload.LongLength, elapsed.Elapsed);
+}
+
+static async Task<StateResult> MeasureCultMeshQuicStateAsync(int payloadBytes, int frameCount)
+{
+    using var certificate = CreateCertificate();
+    await using var server = await CultMeshQuicRealtimeServer.ListenAsync(
+        new CultMeshQuicRealtimeServerOptions
+        {
+            ListenEndPoint = new IPEndPoint(IPAddress.Loopback, 0),
+            ServerCertificate = certificate
+        });
+    var endpoint = $"{CultMeshQuicRealtimeTransportConnector.Scheme}://127.0.0.1:{server.LocalEndPoint.Port}";
+    using var discovery = new CultMeshDiscoveryService([new RouteSource(endpoint)]);
+    using var sessions = new CultMeshSessionManager(
+        discovery,
+        Array.Empty<ICultMeshTransportConnector>(),
+        Array.Empty<ICultMeshContentTransportConnector>(),
+        [new CultMeshQuicRealtimeTransportConnector(new CultMeshQuicRealtimeConnectorOptions
+        {
+            ValidateProviderCertificate = (_, _, _, _) => true
+        })],
+        LocalDevelopmentSessions());
+    var session = await sessions.ConnectRealtimeAsync(
+        new CultMeshSessionTarget("parity", "service:parity.provider"));
+    var deadline = DateTime.UtcNow.AddSeconds(5);
+    while (server.ConnectionCount == 0)
+    {
+        if (DateTime.UtcNow >= deadline) throw new TimeoutException("QUIC state client did not connect.");
+        await Task.Delay(1);
+    }
+
+    var receivedFrames = 0;
+    var highestSequence = -1L;
+    using var receiveDeadline = new CancellationTokenSource(TimeSpan.FromSeconds(30));
+    var receive = Task.Run(async () =>
+    {
+        while (true)
+        {
+            var frame = await session.ReceiveAsync(receiveDeadline.Token);
+            receivedFrames++;
+            highestSequence = Math.Max(highestSequence, frame.Sequence);
+            if (frame.ProducerEpoch == 1 && frame.Sequence == frameCount - 1) return;
+        }
+    });
+    var payload = new byte[payloadBytes];
+    var elapsed = Stopwatch.StartNew();
+    for (var sequence = 0; sequence < frameCount; sequence++)
+    {
+        await server.BroadcastAsync(new CultMeshRealtimeFrame
+        {
+            ChannelId = "parity.entities",
+            SchemaId = "parity.entity_soa.v1",
+            BodyId = "body:parity:entities",
+            ProducerEpoch = 1,
+            Sequence = sequence,
+            Delivery = CultMeshRealtimeDelivery.LatestOnly,
+            Payload = payload
+        });
+    }
+    var sendElapsed = elapsed.Elapsed;
+    await receive;
+    elapsed.Stop();
+    return StateResult.Create(
+        "cultmesh-quic-latest",
+        payloadBytes,
+        frameCount,
+        receivedFrames,
+        highestSequence,
+        sendElapsed,
+        elapsed.Elapsed);
+}
+
+static async Task<StateResult> MeasureCultNetRudpLatestStateAsync(int payloadBytes, int frameCount)
+{
+    using var serverSocket = BindUdpSocket();
+    using var clientSocket = BindUdpSocket();
+    const uint connectionId = 0x50415249;
+    using var server = new CultNetRudpSocketTransportConnection(new CultNetRudpSocketTransportOptions
+    {
+        RuntimeId = "parity-rudp-server",
+        Socket = serverSocket,
+        Mode = CultNetRudpSocketMode.Server,
+        ConnectionId = connectionId,
+        InitialSequence = 100,
+        MaxFragmentBytes = 1024
+    });
+    using var client = new CultNetRudpSocketTransportConnection(new CultNetRudpSocketTransportOptions
+    {
+        RuntimeId = "parity-rudp-client",
+        Socket = clientSocket,
+        Mode = CultNetRudpSocketMode.Client,
+        RemoteEndPoint = serverSocket.LocalEndPoint,
+        ConnectionId = connectionId,
+        InitialSequence = 1,
+        MaxFragmentBytes = 1024
+    });
+    client.Connect("parity");
+    var handshakeDeadline = DateTime.UtcNow.AddSeconds(5);
+    while (!client.Connected || !server.Connected)
+    {
+        server.ReceiveOnce();
+        client.ReceiveOnce();
+        if (DateTime.UtcNow >= handshakeDeadline) throw new TimeoutException("RUDP state peers did not connect.");
+    }
+
+    var receivedFrames = 0;
+    var highestSequence = -1L;
+    using var receiveDeadline = new CancellationTokenSource();
+    var receive = Task.Run(() =>
+    {
+        while (!receiveDeadline.IsCancellationRequested)
+        {
+            var frame = server.ReceiveOnce();
+            if (frame == null) continue;
+            receivedFrames++;
+            highestSequence = Math.Max(highestSequence, BinaryPrimitives.ReadInt64LittleEndian(frame.Payload));
+        }
+    });
+    var payload = new byte[Math.Max(payloadBytes, sizeof(long))];
+    var elapsed = Stopwatch.StartNew();
+    for (var sequence = 0; sequence < frameCount; sequence++)
+    {
+        BinaryPrimitives.WriteInt64LittleEndian(payload, sequence);
+        client.SendLatest(payload);
+    }
+    var sendElapsed = elapsed.Elapsed;
+    await Task.Delay(250);
+    receiveDeadline.Cancel();
+    await receive;
+    elapsed.Stop();
+    return StateResult.Create(
+        "cultnet-rudp-latest",
+        payload.Length,
+        frameCount,
+        receivedFrames,
+        highestSequence,
+        sendElapsed,
+        elapsed.Elapsed,
+        client.Stats.BytesSent);
+}
+
+static async Task<Result> MeasureCultMeshRudpAsync(byte[] payload)
+{
+    var artifact = CultMesh.PackCdnArtifact(
+        "parity/body", payload, new CultMeshCdnPackOptions { ChunkSizeBytes = 1024 * 1024 });
+    using var providerCache = new CultCache(CultMesh.CreateCultCacheDocumentRegistry(
+        typeof(CultMeshCdnArtifactManifest), typeof(CultMeshCdnArtifactChunk)));
+    await CultMeshCdn.PublishAsync(providerCache, artifact);
+
+    using var socket = new Socket(AddressFamily.InterNetwork, SocketType.Dgram, ProtocolType.Udp);
+    socket.Bind(new IPEndPoint(IPAddress.Loopback, 0));
+    using var wireServer = new RudpCultNetSchemaServer(new RudpCultNetSchemaServerOptions
+    {
+        RuntimeId = "cultmesh-transport-parity",
+        Socket = socket,
+        MaxFragmentBytes = 1024,
+        MaxPendingReliablePackets = 8192
+    });
+    using var contentServer = new CultMeshLegacyRudpContentServer(wireServer, providerCache);
+    using var identityServer = new CultMeshSessionIdentityServer(
+        wireServer,
+        "service:parity.provider",
+        ["parity"],
+        [CultMeshProtocols.Content.Value],
+        ["parity-route-1"]);
+    using var pumpCancellation = new CancellationTokenSource();
+    var pump = Task.Run(async () =>
+    {
+        while (!pumpCancellation.IsCancellationRequested)
+        {
+            var progress = await wireServer.PollAvailableAsync(256);
+            wireServer.PollResends();
+            if (progress.TransportItemsConsumed == 0)
+                await Task.Delay(1, pumpCancellation.Token);
+        }
+    });
+
+    var endpoint = $"rudp://127.0.0.1:{wireServer.LocalEndPoint.Port}";
+    using var discovery = new CultMeshDiscoveryService([new RouteSource(endpoint)]);
+    using var sessions = new CultMeshSessionManager(
+        discovery,
+        Array.Empty<ICultMeshTransportConnector>(),
+        [new CultMeshLegacyRudpContentTransportConnector(
+            new CultMeshLegacyRudpContentTransportOptions { ResponseTimeout = TimeSpan.FromMinutes(2) })],
+        LocalDevelopmentSessions());
+    var provider = new CultMeshSessionContentProvider(
+        "parity.provider", sessions, new CultMeshSessionTarget("parity", "service:parity.provider"));
+    var directory = Path.Combine(Path.GetTempPath(), "cultmesh-transport-parity", Guid.NewGuid().ToString("N"));
+    using var transferState = new CultCache(CultMesh.CreateCultCacheDocumentRegistry(
+        typeof(CultMeshContentTransferStateDocument)));
+    var transfer = new CultMeshContentTransferService(
+        transferState, [provider], new CultMeshContentTransferOptions(directory));
+
+    var elapsed = Stopwatch.StartNew();
+    try
+    {
+        var path = await transfer.FetchAsync(artifact.Manifest);
+        elapsed.Stop();
+        if (!File.ReadAllBytes(path).AsSpan().SequenceEqual(payload))
+            throw new InvalidDataException("CultMesh RUDP payload did not match source.");
+        return Result.Create("cultmesh-rudp", payload.LongLength, elapsed.Elapsed, wireServer.Stats.BytesSent);
+    }
+    finally
+    {
+        pumpCancellation.Cancel();
+        try { await pump; } catch (OperationCanceledException) { }
+        if (Directory.Exists(directory)) Directory.Delete(directory, true);
+    }
+}
+
+static async Task<Result> MeasureCultMeshTcpAsync(byte[] payload)
+{
+    var artifact = CultMesh.PackCdnArtifact(
+        "parity/body", payload, new CultMeshCdnPackOptions { ChunkSizeBytes = 1024 * 1024 });
+    using var providerCache = new CultCache(CultMesh.CreateCultCacheDocumentRegistry(
+        typeof(CultMeshCdnArtifactManifest), typeof(CultMeshCdnArtifactChunk)));
+    await CultMeshCdn.PublishAsync(providerCache, artifact);
+
+    using var contentServer = new CultMeshTcpContentServer(
+        new TcpListener(IPAddress.Loopback, 0),
+        providerCache,
+        new CultMeshTcpContentServerOptions
+        {
+            VerseId = "parity",
+            AuthorityRuntimeId = "service:parity.provider",
+            RouteGeneration = "parity-route-1"
+        });
+    var endpoint = $"{CultMeshTcpContentTransportConnector.Scheme}://127.0.0.1:{contentServer.LocalEndPoint.Port}";
+    using var discovery = new CultMeshDiscoveryService([new RouteSource(endpoint)]);
+    using var sessions = new CultMeshSessionManager(
+        discovery,
+        Array.Empty<ICultMeshTransportConnector>(),
+        [new CultMeshTcpContentTransportConnector()],
+        LocalDevelopmentSessions());
+    var provider = new CultMeshSessionContentProvider(
+        "parity.provider", sessions, new CultMeshSessionTarget("parity", "service:parity.provider"));
+    var directory = Path.Combine(Path.GetTempPath(), "cultmesh-transport-parity", Guid.NewGuid().ToString("N"));
+    using var transferState = new CultCache(CultMesh.CreateCultCacheDocumentRegistry(
+        typeof(CultMeshContentTransferStateDocument)));
+    var transfer = new CultMeshContentTransferService(
+        transferState, [provider], new CultMeshContentTransferOptions(directory));
+
+    var elapsed = Stopwatch.StartNew();
+    try
+    {
+        var path = await transfer.FetchAsync(artifact.Manifest);
+        elapsed.Stop();
+        if (!File.ReadAllBytes(path).AsSpan().SequenceEqual(payload))
+            throw new InvalidDataException("CultMesh TCP payload did not match source.");
+        return Result.Create("cultmesh-tcp-content", payload.LongLength, elapsed.Elapsed);
+    }
+    finally
+    {
+        if (Directory.Exists(directory)) Directory.Delete(directory, true);
+    }
+}
+
+static X509Certificate2 CreateCertificate()
+{
+    using var key = RSA.Create(2048);
+    var request = new CertificateRequest("CN=localhost", key, HashAlgorithmName.SHA256, RSASignaturePadding.Pkcs1);
+    request.CertificateExtensions.Add(new X509BasicConstraintsExtension(false, false, 0, false));
+    request.CertificateExtensions.Add(new X509KeyUsageExtension(X509KeyUsageFlags.DigitalSignature, false));
+    request.CertificateExtensions.Add(new X509EnhancedKeyUsageExtension(
+        new OidCollection { new("1.3.6.1.5.5.7.3.1") }, false));
+    var names = new SubjectAlternativeNameBuilder();
+    names.AddDnsName("localhost");
+    names.AddIpAddress(IPAddress.Loopback);
+    request.CertificateExtensions.Add(names.Build());
+    request.CertificateExtensions.Add(new X509SubjectKeyIdentifierExtension(request.PublicKey, false));
+    using var certificate = request.CreateSelfSigned(
+        DateTimeOffset.UtcNow.AddMinutes(-1), DateTimeOffset.UtcNow.AddHours(1));
+    return X509CertificateLoader.LoadPkcs12(certificate.Export(X509ContentType.Pfx), null);
+}
+
+static string TempPath(string plane) =>
+    Path.Combine(Path.GetTempPath(), $"cultmesh-parity-{plane}-{Guid.NewGuid():N}.body");
+
+static CultMeshSessionManagerOptions LocalDevelopmentSessions() => new()
+{
+    Trust = new CultMeshAuthorityTrustPolicy(CultMeshAuthorityTrustMode.LocalDevelopment)
+};
+
+static Socket BindUdpSocket()
+{
+    var socket = new Socket(AddressFamily.InterNetwork, SocketType.Dgram, ProtocolType.Udp);
+    socket.Bind(new IPEndPoint(IPAddress.Loopback, 0));
+    socket.ReceiveTimeout = 20;
+    return socket;
+}
+
+static void VerifyAndDelete(string path, string expectedHash)
+{
+    try
+    {
+        using var input = File.OpenRead(path);
+        var actualHash = Convert.ToHexString(SHA256.HashData(input));
+        if (!actualHash.Equals(expectedHash, StringComparison.Ordinal))
+            throw new InvalidDataException($"Body hash mismatch: expected {expectedHash}, got {actualHash}.");
+    }
+    finally
+    {
+        File.Delete(path);
+    }
+}
+
+internal sealed class RouteSource(string endpoint) : ICultMeshLookupSource
+{
+    public string SourceId => "parity-route";
+
+    public Task<IReadOnlyList<CultMeshDiscoveryObservation>> LookupAsync(
+        CultMeshDiscoveryQuery query, CancellationToken cancellationToken = default)
+    {
+        var now = DateTimeOffset.UtcNow;
+        IReadOnlyList<CultMeshDiscoveryObservation> observations =
+        [
+            new(
+                new CultMeshVerseDescriptor(
+                    "parity", "Transport parity", CultMeshVerseAuthorityModel.OperatorCluster,
+                    new CultMeshVerseCompatibility("cultmesh.v1", "parity"),
+                    authorityRoutes:
+                    [
+                        new CultMeshAuthorityRoute(
+                            "service:parity.provider",
+                            endpoint,
+                            generation: "parity-route-1")
+                    ]),
+                SourceId, now, now.AddMinutes(1), CultMeshDiscoveryTrust.Signed)
+        ];
+        return Task.FromResult(observations);
+    }
+}
+
+internal sealed record Result(string Plane, TimeSpan Elapsed, double? GoodputMiBps, long? WireBytes)
+{
+    public static Result Create(string plane, long bytes, TimeSpan elapsed, long? wireBytes = null) =>
+        new(plane, elapsed, bytes / 1024d / 1024d / elapsed.TotalSeconds, wireBytes);
+
+    public static Result CreateOpen(string plane, TimeSpan elapsed) =>
+        new(plane, elapsed, null, null);
+}
+
+internal sealed record StateResult(
+    string Plane,
+    int SentFrames,
+    int DeliveredFrames,
+    long HighestSequence,
+    TimeSpan SendElapsed,
+    TimeSpan SettledElapsed,
+    double OfferedMiBps,
+    long? WireBytes)
+{
+    public static StateResult Create(
+        string plane,
+        int payloadBytes,
+        int sentFrames,
+        int deliveredFrames,
+        long highestSequence,
+        TimeSpan sendElapsed,
+        TimeSpan settledElapsed,
+        long? wireBytes = null) =>
+        new(
+            plane,
+            sentFrames,
+            deliveredFrames,
+            highestSequence,
+            sendElapsed,
+            settledElapsed,
+            (long)payloadBytes * sentFrames / 1024d / 1024d / sendElapsed.TotalSeconds,
+            wireBytes);
+}
diff --git a/tools/GameCult.TransportParity/README.md b/tools/GameCult.TransportParity/README.md
new file mode 100644
index 00000000..2b7daeeb
--- /dev/null
+++ b/tools/GameCult.TransportParity/README.md
@@ -0,0 +1,25 @@
+# CultMesh transport parity harness
+
+This harness compares the current public CultMesh content-session path with
+dedicated byte streams under the same loopback conditions and payload size.
+It is evidence for transport-plane selection, not a production transport.
+
+The measured paths are:
+
+- Authorized same-machine file mapping open and first/last-byte access. The
+  provider body is created before the timer because it already exists in the
+  real deployment.
+- CultMesh content transfer over CultNet RUDP, including chunk verification,
+  partial-file writes, final SHA-256 verification, and atomic promotion.
+- TCP stream to a file, followed by SHA-256 verification.
+- QUIC stream to a file, followed by SHA-256 verification. .NET delegates QUIC
+  to MsQuic on supported platforms.
+
+Run the Aetheria-sized comparison with:
+
+```powershell
+dotnet run --project tools/GameCult.TransportParity -c Release -- --bytes 56204750
+```
+
+The default payload is 56,204,750 bytes. Results report elapsed time,
+application goodput, and RUDP wire bytes where available.
diff --git a/unity/org.gamecult.cultlib/README.md b/unity/org.gamecult.cultlib/README.md
new file mode 100644
index 00000000..8aeaf53e
--- /dev/null
+++ b/unity/org.gamecult.cultlib/README.md
@@ -0,0 +1,22 @@
+# CultLib for Unity
+
+This package is generated from the CultLib .NET projects. It carries the same
+CultCache, CultNet, and CultMesh assemblies consumed through NuGet by normal
+.NET applications, staged as Unity-compatible managed plugins. Windows x64
+builds also receive the native MsQuic realtime connector and its Schannel
+runtime; the Microsoft license is included under `Third Party Notices`.
+
+Build it with `scripts/build-unity-package.ps1`. Do not edit generated plugin
+assemblies in the package output.
+
+Install version `1.0.41` through Unity Package Manager with:
+
+```text
+https://github.com/GameCult/CultLib.git?path=/unity/org.gamecult.cultlib#cultlib-unity-v1.0.41
+```
+
+CultMesh chooses mapped memory for reachable same-machine bodies and advertised
+QUIC for remote realtime state. Applications register the packaged
+`CultMeshNativeQuicRealtimeTransportConnector`; they do not load or configure
+MsQuic directly. Schemas, commands, receipts, and immutable content remain on
+their typed control/content planes.
diff --git a/unity/org.gamecult.cultlib/README.md.meta b/unity/org.gamecult.cultlib/README.md.meta
new file mode 100644
index 00000000..922e4cf5
--- /dev/null
+++ b/unity/org.gamecult.cultlib/README.md.meta
@@ -0,0 +1,7 @@
+fileFormatVersion: 2
+guid: 2b8db24da98fc9f4598cf8b817e105f2
+TextScriptImporter:
+  externalObjects: {}
+  userData: 
+  assetBundleName: 
+  assetBundleVariant: 
diff --git a/unity/org.gamecult.cultlib/Runtime.meta b/unity/org.gamecult.cultlib/Runtime.meta
new file mode 100644
index 00000000..4d0c8a68
--- /dev/null
+++ b/unity/org.gamecult.cultlib/Runtime.meta
@@ -0,0 +1,8 @@
+fileFormatVersion: 2
+guid: edb94eed225101a4db752a0d16cea921
+folderAsset: yes
+DefaultImporter:
+  externalObjects: {}
+  userData: 
+  assetBundleName: 
+  assetBundleVariant: 
diff --git a/unity/org.gamecult.cultlib/Runtime/GameCult.CultLib.asmdef b/unity/org.gamecult.cultlib/Runtime/GameCult.CultLib.asmdef
new file mode 100644
index 00000000..bd13cb38
--- /dev/null
+++ b/unity/org.gamecult.cultlib/Runtime/GameCult.CultLib.asmdef
@@ -0,0 +1,40 @@
+{
+  "name": "GameCult.CultLib",
+  "rootNamespace": "GameCult",
+  "references": [],
+  "includePlatforms": [],
+  "excludePlatforms": [],
+  "allowUnsafeCode": false,
+  "overrideReferences": true,
+  "precompiledReferences": [
+    "ConcurrentCollections.dll",
+    "GameCult.Caching.dll",
+    "GameCult.Caching.MessagePack.dll",
+    "GameCult.Logging.dll",
+    "GameCult.Mesh.dll",
+    "GameCult.Mesh.Quic.Native.dll",
+    "GameCult.Networking.dll",
+    "GameCult.Networking.WebSockets.dll",
+    "Isopoh.Cryptography.Argon2.dll",
+    "Isopoh.Cryptography.Blake2b.dll",
+    "Isopoh.Cryptography.SecureArray.dll",
+    "LiteNetLib.dll",
+    "MessagePack.Annotations.dll",
+    "MessagePack.dll",
+    "Microsoft.Bcl.AsyncInterfaces.dll",
+    "Microsoft.Bcl.TimeProvider.dll",
+    "Microsoft.NET.StringTools.dll",
+    "R3.dll",
+    "System.Collections.Immutable.dll",
+    "System.ComponentModel.Annotations.dll",
+    "System.IO.Pipelines.dll",
+    "System.Runtime.CompilerServices.Unsafe.dll",
+    "System.Text.Encodings.Web.dll",
+    "System.Text.Json.dll",
+    "System.Threading.Channels.dll"
+  ],
+  "autoReferenced": true,
+  "defineConstraints": [],
+  "versionDefines": [],
+  "noEngineReferences": true
+}
diff --git a/unity/org.gamecult.cultlib/Runtime/GameCult.CultLib.asmdef.meta b/unity/org.gamecult.cultlib/Runtime/GameCult.CultLib.asmdef.meta
new file mode 100644
index 00000000..c13b8090
--- /dev/null
+++ b/unity/org.gamecult.cultlib/Runtime/GameCult.CultLib.asmdef.meta
@@ -0,0 +1,7 @@
+fileFormatVersion: 2
+guid: 3e407de226115f94ba908048a746bc6a
+AssemblyDefinitionImporter:
+  externalObjects: {}
+  userData: 
+  assetBundleName: 
+  assetBundleVariant: 
diff --git a/unity/org.gamecult.cultlib/Runtime/Plugins.meta b/unity/org.gamecult.cultlib/Runtime/Plugins.meta
new file mode 100644
index 00000000..a8a10739
--- /dev/null
+++ b/unity/org.gamecult.cultlib/Runtime/Plugins.meta
@@ -0,0 +1,8 @@
+fileFormatVersion: 2
+guid: b9f82503ba2895e4ebd479843e1166d4
+folderAsset: yes
+DefaultImporter:
+  externalObjects: {}
+  userData: 
+  assetBundleName: 
+  assetBundleVariant: 
diff --git a/unity/org.gamecult.cultlib/Runtime/Plugins/ConcurrentCollections.dll b/unity/org.gamecult.cultlib/Runtime/Plugins/ConcurrentCollections.dll
new file mode 100644
index 00000000..5ee53e7b
Binary files /dev/null and b/unity/org.gamecult.cultlib/Runtime/Plugins/ConcurrentCollections.dll differ
diff --git a/unity/org.gamecult.cultlib/Runtime/Plugins/ConcurrentCollections.dll.meta b/unity/org.gamecult.cultlib/Runtime/Plugins/ConcurrentCollections.dll.meta
new file mode 100644
index 00000000..f9560315
--- /dev/null
+++ b/unity/org.gamecult.cultlib/Runtime/Plugins/ConcurrentCollections.dll.meta
@@ -0,0 +1,2 @@
+fileFormatVersion: 2
+guid: f880b96b8e22ac1408906f489576a000
\ No newline at end of file
diff --git a/unity/org.gamecult.cultlib/Runtime/Plugins/GameCult.Caching.MessagePack.dll b/unity/org.gamecult.cultlib/Runtime/Plugins/GameCult.Caching.MessagePack.dll
new file mode 100644
index 00000000..4cc54615
Binary files /dev/null and b/unity/org.gamecult.cultlib/Runtime/Plugins/GameCult.Caching.MessagePack.dll differ
diff --git a/unity/org.gamecult.cultlib/Runtime/Plugins/GameCult.Caching.MessagePack.dll.meta b/unity/org.gamecult.cultlib/Runtime/Plugins/GameCult.Caching.MessagePack.dll.meta
new file mode 100644
index 00000000..bee72153
--- /dev/null
+++ b/unity/org.gamecult.cultlib/Runtime/Plugins/GameCult.Caching.MessagePack.dll.meta
@@ -0,0 +1,2 @@
+fileFormatVersion: 2
+guid: 23257a51a272a664bb0c26b1e0a6e7dd
\ No newline at end of file
diff --git a/unity/org.gamecult.cultlib/Runtime/Plugins/GameCult.Caching.MessagePack.pdb b/unity/org.gamecult.cultlib/Runtime/Plugins/GameCult.Caching.MessagePack.pdb
new file mode 100644
index 00000000..2e12b402
Binary files /dev/null and b/unity/org.gamecult.cultlib/Runtime/Plugins/GameCult.Caching.MessagePack.pdb differ
diff --git a/unity/org.gamecult.cultlib/Runtime/Plugins/GameCult.Caching.MessagePack.pdb.meta b/unity/org.gamecult.cultlib/Runtime/Plugins/GameCult.Caching.MessagePack.pdb.meta
new file mode 100644
index 00000000..d9371c35
--- /dev/null
+++ b/unity/org.gamecult.cultlib/Runtime/Plugins/GameCult.Caching.MessagePack.pdb.meta
@@ -0,0 +1,7 @@
+fileFormatVersion: 2
+guid: 8ca1876fa3785214a8a783952674d3a5
+DefaultImporter:
+  externalObjects: {}
+  userData: 
+  assetBundleName: 
+  assetBundleVariant: 
diff --git a/unity/org.gamecult.cultlib/Runtime/Plugins/GameCult.Caching.dll b/unity/org.gamecult.cultlib/Runtime/Plugins/GameCult.Caching.dll
new file mode 100644
index 00000000..21961499
Binary files /dev/null and b/unity/org.gamecult.cultlib/Runtime/Plugins/GameCult.Caching.dll differ
diff --git a/unity/org.gamecult.cultlib/Runtime/Plugins/GameCult.Caching.dll.meta b/unity/org.gamecult.cultlib/Runtime/Plugins/GameCult.Caching.dll.meta
new file mode 100644
index 00000000..eccf738b
--- /dev/null
+++ b/unity/org.gamecult.cultlib/Runtime/Plugins/GameCult.Caching.dll.meta
@@ -0,0 +1,2 @@
+fileFormatVersion: 2
+guid: 8ef416d2e8fd6634aa3e6c68e37d5c3b
\ No newline at end of file
diff --git a/unity/org.gamecult.cultlib/Runtime/Plugins/GameCult.Caching.pdb b/unity/org.gamecult.cultlib/Runtime/Plugins/GameCult.Caching.pdb
new file mode 100644
index 00000000..240474d4
Binary files /dev/null and b/unity/org.gamecult.cultlib/Runtime/Plugins/GameCult.Caching.pdb differ
diff --git a/unity/org.gamecult.cultlib/Runtime/Plugins/GameCult.Caching.pdb.meta b/unity/org.gamecult.cultlib/Runtime/Plugins/GameCult.Caching.pdb.meta
new file mode 100644
index 00000000..012b54ff
--- /dev/null
+++ b/unity/org.gamecult.cultlib/Runtime/Plugins/GameCult.Caching.pdb.meta
@@ -0,0 +1,7 @@
+fileFormatVersion: 2
+guid: b79cc22ab985ab24e930f69fad16a319
+DefaultImporter:
+  externalObjects: {}
+  userData: 
+  assetBundleName: 
+  assetBundleVariant: 
diff --git a/unity/org.gamecult.cultlib/Runtime/Plugins/GameCult.Logging.dll b/unity/org.gamecult.cultlib/Runtime/Plugins/GameCult.Logging.dll
new file mode 100644
index 00000000..4b95bd57
Binary files /dev/null and b/unity/org.gamecult.cultlib/Runtime/Plugins/GameCult.Logging.dll differ
diff --git a/unity/org.gamecult.cultlib/Runtime/Plugins/GameCult.Logging.dll.meta b/unity/org.gamecult.cultlib/Runtime/Plugins/GameCult.Logging.dll.meta
new file mode 100644
index 00000000..9fb0bc47
--- /dev/null
+++ b/unity/org.gamecult.cultlib/Runtime/Plugins/GameCult.Logging.dll.meta
@@ -0,0 +1,2 @@
+fileFormatVersion: 2
+guid: 4a1456bd88290184e953dd63b4744746
\ No newline at end of file
diff --git a/unity/org.gamecult.cultlib/Runtime/Plugins/GameCult.Logging.pdb b/unity/org.gamecult.cultlib/Runtime/Plugins/GameCult.Logging.pdb
new file mode 100644
index 00000000..93e24784
Binary files /dev/null and b/unity/org.gamecult.cultlib/Runtime/Plugins/GameCult.Logging.pdb differ
diff --git a/unity/org.gamecult.cultlib/Runtime/Plugins/GameCult.Logging.pdb.meta b/unity/org.gamecult.cultlib/Runtime/Plugins/GameCult.Logging.pdb.meta
new file mode 100644
index 00000000..8a0a8b47
--- /dev/null
+++ b/unity/org.gamecult.cultlib/Runtime/Plugins/GameCult.Logging.pdb.meta
@@ -0,0 +1,7 @@
+fileFormatVersion: 2
+guid: 852ef8a785d7ca246b8f20402cc823af
+DefaultImporter:
+  externalObjects: {}
+  userData: 
+  assetBundleName: 
+  assetBundleVariant: 
diff --git a/unity/org.gamecult.cultlib/Runtime/Plugins/GameCult.Mesh.Quic.Native.dll b/unity/org.gamecult.cultlib/Runtime/Plugins/GameCult.Mesh.Quic.Native.dll
new file mode 100644
index 00000000..27b9ad0e
Binary files /dev/null and b/unity/org.gamecult.cultlib/Runtime/Plugins/GameCult.Mesh.Quic.Native.dll differ
diff --git a/unity/org.gamecult.cultlib/Runtime/Plugins/GameCult.Mesh.Quic.Native.dll.meta b/unity/org.gamecult.cultlib/Runtime/Plugins/GameCult.Mesh.Quic.Native.dll.meta
new file mode 100644
index 00000000..6b480da1
--- /dev/null
+++ b/unity/org.gamecult.cultlib/Runtime/Plugins/GameCult.Mesh.Quic.Native.dll.meta
@@ -0,0 +1,2 @@
+fileFormatVersion: 2
+guid: 1e20e41f50c44a8686f75c1ff37a90bc
diff --git a/unity/org.gamecult.cultlib/Runtime/Plugins/GameCult.Mesh.Quic.Native.pdb b/unity/org.gamecult.cultlib/Runtime/Plugins/GameCult.Mesh.Quic.Native.pdb
new file mode 100644
index 00000000..1b12e02e
Binary files /dev/null and b/unity/org.gamecult.cultlib/Runtime/Plugins/GameCult.Mesh.Quic.Native.pdb differ
diff --git a/unity/org.gamecult.cultlib/Runtime/Plugins/GameCult.Mesh.Quic.Native.pdb.meta b/unity/org.gamecult.cultlib/Runtime/Plugins/GameCult.Mesh.Quic.Native.pdb.meta
new file mode 100644
index 00000000..74c502dc
--- /dev/null
+++ b/unity/org.gamecult.cultlib/Runtime/Plugins/GameCult.Mesh.Quic.Native.pdb.meta
@@ -0,0 +1,2 @@
+fileFormatVersion: 2
+guid: 60ee118957cc478aa3143932787387d0
diff --git a/unity/org.gamecult.cultlib/Runtime/Plugins/GameCult.Mesh.dll b/unity/org.gamecult.cultlib/Runtime/Plugins/GameCult.Mesh.dll
new file mode 100644
index 00000000..a37e9873
Binary files /dev/null and b/unity/org.gamecult.cultlib/Runtime/Plugins/GameCult.Mesh.dll differ
diff --git a/unity/org.gamecult.cultlib/Runtime/Plugins/GameCult.Mesh.dll.meta b/unity/org.gamecult.cultlib/Runtime/Plugins/GameCult.Mesh.dll.meta
new file mode 100644
index 00000000..ddb4324a
--- /dev/null
+++ b/unity/org.gamecult.cultlib/Runtime/Plugins/GameCult.Mesh.dll.meta
@@ -0,0 +1,2 @@
+fileFormatVersion: 2
+guid: 2c7a76cd922e31d4583312019df184cd
\ No newline at end of file
diff --git a/unity/org.gamecult.cultlib/Runtime/Plugins/GameCult.Mesh.pdb b/unity/org.gamecult.cultlib/Runtime/Plugins/GameCult.Mesh.pdb
new file mode 100644
index 00000000..da5d6496
Binary files /dev/null and b/unity/org.gamecult.cultlib/Runtime/Plugins/GameCult.Mesh.pdb differ
diff --git a/unity/org.gamecult.cultlib/Runtime/Plugins/GameCult.Mesh.pdb.meta b/unity/org.gamecult.cultlib/Runtime/Plugins/GameCult.Mesh.pdb.meta
new file mode 100644
index 00000000..82222234
--- /dev/null
+++ b/unity/org.gamecult.cultlib/Runtime/Plugins/GameCult.Mesh.pdb.meta
@@ -0,0 +1,7 @@
+fileFormatVersion: 2
+guid: 48679dc4ff2c05349a2985a7fc05f055
+DefaultImporter:
+  externalObjects: {}
+  userData: 
+  assetBundleName: 
+  assetBundleVariant: 
diff --git a/unity/org.gamecult.cultlib/Runtime/Plugins/GameCult.Networking.WebSockets.dll b/unity/org.gamecult.cultlib/Runtime/Plugins/GameCult.Networking.WebSockets.dll
new file mode 100644
index 00000000..ceadb3c6
Binary files /dev/null and b/unity/org.gamecult.cultlib/Runtime/Plugins/GameCult.Networking.WebSockets.dll differ
diff --git a/unity/org.gamecult.cultlib/Runtime/Plugins/GameCult.Networking.WebSockets.dll.meta b/unity/org.gamecult.cultlib/Runtime/Plugins/GameCult.Networking.WebSockets.dll.meta
new file mode 100644
index 00000000..3679db12
--- /dev/null
+++ b/unity/org.gamecult.cultlib/Runtime/Plugins/GameCult.Networking.WebSockets.dll.meta
@@ -0,0 +1,2 @@
+fileFormatVersion: 2
+guid: 78372006a7d6494ca38f58a78eb535a8
diff --git a/unity/org.gamecult.cultlib/Runtime/Plugins/GameCult.Networking.dll b/unity/org.gamecult.cultlib/Runtime/Plugins/GameCult.Networking.dll
new file mode 100644
index 00000000..7dfdce21
Binary files /dev/null and b/unity/org.gamecult.cultlib/Runtime/Plugins/GameCult.Networking.dll differ
diff --git a/unity/org.gamecult.cultlib/Runtime/Plugins/GameCult.Networking.dll.meta b/unity/org.gamecult.cultlib/Runtime/Plugins/GameCult.Networking.dll.meta
new file mode 100644
index 00000000..bce59270
--- /dev/null
+++ b/unity/org.gamecult.cultlib/Runtime/Plugins/GameCult.Networking.dll.meta
@@ -0,0 +1,2 @@
+fileFormatVersion: 2
+guid: 8fda0421bc995bc42af3f81e76f4d007
\ No newline at end of file
diff --git a/unity/org.gamecult.cultlib/Runtime/Plugins/GameCult.Networking.pdb b/unity/org.gamecult.cultlib/Runtime/Plugins/GameCult.Networking.pdb
new file mode 100644
index 00000000..72a7f705
Binary files /dev/null and b/unity/org.gamecult.cultlib/Runtime/Plugins/GameCult.Networking.pdb differ
diff --git a/unity/org.gamecult.cultlib/Runtime/Plugins/GameCult.Networking.pdb.meta b/unity/org.gamecult.cultlib/Runtime/Plugins/GameCult.Networking.pdb.meta
new file mode 100644
index 00000000..c9d40d66
--- /dev/null
+++ b/unity/org.gamecult.cultlib/Runtime/Plugins/GameCult.Networking.pdb.meta
@@ -0,0 +1,7 @@
+fileFormatVersion: 2
+guid: 596077e93808e9f49bdf7ebac67de766
+DefaultImporter:
+  externalObjects: {}
+  userData: 
+  assetBundleName: 
+  assetBundleVariant: 
diff --git a/unity/org.gamecult.cultlib/Runtime/Plugins/Isopoh.Cryptography.Argon2.dll b/unity/org.gamecult.cultlib/Runtime/Plugins/Isopoh.Cryptography.Argon2.dll
new file mode 100644
index 00000000..ac61f4a3
Binary files /dev/null and b/unity/org.gamecult.cultlib/Runtime/Plugins/Isopoh.Cryptography.Argon2.dll differ
diff --git a/unity/org.gamecult.cultlib/Runtime/Plugins/Isopoh.Cryptography.Argon2.dll.meta b/unity/org.gamecult.cultlib/Runtime/Plugins/Isopoh.Cryptography.Argon2.dll.meta
new file mode 100644
index 00000000..b9cf54b7
--- /dev/null
+++ b/unity/org.gamecult.cultlib/Runtime/Plugins/Isopoh.Cryptography.Argon2.dll.meta
@@ -0,0 +1,2 @@
+fileFormatVersion: 2
+guid: 17b2e6bd24808de45ad3b8e54edc7323
\ No newline at end of file
diff --git a/unity/org.gamecult.cultlib/Runtime/Plugins/Isopoh.Cryptography.Blake2b.dll b/unity/org.gamecult.cultlib/Runtime/Plugins/Isopoh.Cryptography.Blake2b.dll
new file mode 100644
index 00000000..d58f40dd
Binary files /dev/null and b/unity/org.gamecult.cultlib/Runtime/Plugins/Isopoh.Cryptography.Blake2b.dll differ
diff --git a/unity/org.gamecult.cultlib/Runtime/Plugins/Isopoh.Cryptography.Blake2b.dll.meta b/unity/org.gamecult.cultlib/Runtime/Plugins/Isopoh.Cryptography.Blake2b.dll.meta
new file mode 100644
index 00000000..d3346285
--- /dev/null
+++ b/unity/org.gamecult.cultlib/Runtime/Plugins/Isopoh.Cryptography.Blake2b.dll.meta
@@ -0,0 +1,2 @@
+fileFormatVersion: 2
+guid: f83afb6d59b7cff4c811e8143551a4b3
\ No newline at end of file
diff --git a/unity/org.gamecult.cultlib/Runtime/Plugins/Isopoh.Cryptography.SecureArray.dll b/unity/org.gamecult.cultlib/Runtime/Plugins/Isopoh.Cryptography.SecureArray.dll
new file mode 100644
index 00000000..681dddaf
Binary files /dev/null and b/unity/org.gamecult.cultlib/Runtime/Plugins/Isopoh.Cryptography.SecureArray.dll differ
diff --git a/unity/org.gamecult.cultlib/Runtime/Plugins/Isopoh.Cryptography.SecureArray.dll.meta b/unity/org.gamecult.cultlib/Runtime/Plugins/Isopoh.Cryptography.SecureArray.dll.meta
new file mode 100644
index 00000000..e52456eb
--- /dev/null
+++ b/unity/org.gamecult.cultlib/Runtime/Plugins/Isopoh.Cryptography.SecureArray.dll.meta
@@ -0,0 +1,2 @@
+fileFormatVersion: 2
+guid: 6dcfab1f2b97d23488edbf115900b75b
\ No newline at end of file
diff --git a/unity/org.gamecult.cultlib/Runtime/Plugins/LiteNetLib.dll b/unity/org.gamecult.cultlib/Runtime/Plugins/LiteNetLib.dll
new file mode 100644
index 00000000..e804751b
Binary files /dev/null and b/unity/org.gamecult.cultlib/Runtime/Plugins/LiteNetLib.dll differ
diff --git a/unity/org.gamecult.cultlib/Runtime/Plugins/LiteNetLib.dll.meta b/unity/org.gamecult.cultlib/Runtime/Plugins/LiteNetLib.dll.meta
new file mode 100644
index 00000000..ca771147
--- /dev/null
+++ b/unity/org.gamecult.cultlib/Runtime/Plugins/LiteNetLib.dll.meta
@@ -0,0 +1,2 @@
+fileFormatVersion: 2
+guid: e508a094e7b02144fb4411478dcf4896
\ No newline at end of file
diff --git a/unity/org.gamecult.cultlib/Runtime/Plugins/MessagePack.Annotations.dll b/unity/org.gamecult.cultlib/Runtime/Plugins/MessagePack.Annotations.dll
new file mode 100644
index 00000000..3c580eb9
Binary files /dev/null and b/unity/org.gamecult.cultlib/Runtime/Plugins/MessagePack.Annotations.dll differ
diff --git a/unity/org.gamecult.cultlib/Runtime/Plugins/MessagePack.Annotations.dll.meta b/unity/org.gamecult.cultlib/Runtime/Plugins/MessagePack.Annotations.dll.meta
new file mode 100644
index 00000000..f6e9a62d
--- /dev/null
+++ b/unity/org.gamecult.cultlib/Runtime/Plugins/MessagePack.Annotations.dll.meta
@@ -0,0 +1,2 @@
+fileFormatVersion: 2
+guid: 17cc07dfceb06bd49a729f38ff4c3f5e
\ No newline at end of file
diff --git a/unity/org.gamecult.cultlib/Runtime/Plugins/MessagePack.dll b/unity/org.gamecult.cultlib/Runtime/Plugins/MessagePack.dll
new file mode 100644
index 00000000..4d9a7fd5
Binary files /dev/null and b/unity/org.gamecult.cultlib/Runtime/Plugins/MessagePack.dll differ
diff --git a/unity/org.gamecult.cultlib/Runtime/Plugins/MessagePack.dll.meta b/unity/org.gamecult.cultlib/Runtime/Plugins/MessagePack.dll.meta
new file mode 100644
index 00000000..46c36f26
--- /dev/null
+++ b/unity/org.gamecult.cultlib/Runtime/Plugins/MessagePack.dll.meta
@@ -0,0 +1,2 @@
+fileFormatVersion: 2
+guid: d57884c5b8f53f7419f9ba9f4f2fb664
\ No newline at end of file
diff --git a/unity/org.gamecult.cultlib/Runtime/Plugins/Microsoft.Bcl.AsyncInterfaces.dll b/unity/org.gamecult.cultlib/Runtime/Plugins/Microsoft.Bcl.AsyncInterfaces.dll
new file mode 100644
index 00000000..9bfce56a
Binary files /dev/null and b/unity/org.gamecult.cultlib/Runtime/Plugins/Microsoft.Bcl.AsyncInterfaces.dll differ
diff --git a/unity/org.gamecult.cultlib/Runtime/Plugins/Microsoft.Bcl.AsyncInterfaces.dll.meta b/unity/org.gamecult.cultlib/Runtime/Plugins/Microsoft.Bcl.AsyncInterfaces.dll.meta
new file mode 100644
index 00000000..434ac3d1
--- /dev/null
+++ b/unity/org.gamecult.cultlib/Runtime/Plugins/Microsoft.Bcl.AsyncInterfaces.dll.meta
@@ -0,0 +1,2 @@
+fileFormatVersion: 2
+guid: 10d2556f4688f824a9765c16e4eedb7f
\ No newline at end of file
diff --git a/unity/org.gamecult.cultlib/Runtime/Plugins/Microsoft.Bcl.TimeProvider.dll b/unity/org.gamecult.cultlib/Runtime/Plugins/Microsoft.Bcl.TimeProvider.dll
new file mode 100644
index 00000000..d5b34447
Binary files /dev/null and b/unity/org.gamecult.cultlib/Runtime/Plugins/Microsoft.Bcl.TimeProvider.dll differ
diff --git a/unity/org.gamecult.cultlib/Runtime/Plugins/Microsoft.Bcl.TimeProvider.dll.meta b/unity/org.gamecult.cultlib/Runtime/Plugins/Microsoft.Bcl.TimeProvider.dll.meta
new file mode 100644
index 00000000..0836ae97
--- /dev/null
+++ b/unity/org.gamecult.cultlib/Runtime/Plugins/Microsoft.Bcl.TimeProvider.dll.meta
@@ -0,0 +1,2 @@
+fileFormatVersion: 2
+guid: 715cbdde1cc7f2145999fc2384c30d42
\ No newline at end of file
diff --git a/unity/org.gamecult.cultlib/Runtime/Plugins/Microsoft.NET.StringTools.dll b/unity/org.gamecult.cultlib/Runtime/Plugins/Microsoft.NET.StringTools.dll
new file mode 100644
index 00000000..9a0ab6db
Binary files /dev/null and b/unity/org.gamecult.cultlib/Runtime/Plugins/Microsoft.NET.StringTools.dll differ
diff --git a/unity/org.gamecult.cultlib/Runtime/Plugins/Microsoft.NET.StringTools.dll.meta b/unity/org.gamecult.cultlib/Runtime/Plugins/Microsoft.NET.StringTools.dll.meta
new file mode 100644
index 00000000..d955eae2
--- /dev/null
+++ b/unity/org.gamecult.cultlib/Runtime/Plugins/Microsoft.NET.StringTools.dll.meta
@@ -0,0 +1,2 @@
+fileFormatVersion: 2
+guid: 3db2e13fd5852ae41a07b3f3b353b4fe
\ No newline at end of file
diff --git a/unity/org.gamecult.cultlib/Runtime/Plugins/R3.dll b/unity/org.gamecult.cultlib/Runtime/Plugins/R3.dll
new file mode 100644
index 00000000..e6cfd80c
Binary files /dev/null and b/unity/org.gamecult.cultlib/Runtime/Plugins/R3.dll differ
diff --git a/unity/org.gamecult.cultlib/Runtime/Plugins/R3.dll.meta b/unity/org.gamecult.cultlib/Runtime/Plugins/R3.dll.meta
new file mode 100644
index 00000000..fe59858f
--- /dev/null
+++ b/unity/org.gamecult.cultlib/Runtime/Plugins/R3.dll.meta
@@ -0,0 +1,2 @@
+fileFormatVersion: 2
+guid: 1cf850b088f3e0449910470efe36d45e
\ No newline at end of file
diff --git a/unity/org.gamecult.cultlib/Runtime/Plugins/System.Collections.Immutable.dll b/unity/org.gamecult.cultlib/Runtime/Plugins/System.Collections.Immutable.dll
new file mode 100644
index 00000000..30822887
Binary files /dev/null and b/unity/org.gamecult.cultlib/Runtime/Plugins/System.Collections.Immutable.dll differ
diff --git a/unity/org.gamecult.cultlib/Runtime/Plugins/System.Collections.Immutable.dll.meta b/unity/org.gamecult.cultlib/Runtime/Plugins/System.Collections.Immutable.dll.meta
new file mode 100644
index 00000000..e0a6e951
--- /dev/null
+++ b/unity/org.gamecult.cultlib/Runtime/Plugins/System.Collections.Immutable.dll.meta
@@ -0,0 +1,2 @@
+fileFormatVersion: 2
+guid: 05a638a393287b645bc025be25b70e52
\ No newline at end of file
diff --git a/unity/org.gamecult.cultlib/Runtime/Plugins/System.ComponentModel.Annotations.dll b/unity/org.gamecult.cultlib/Runtime/Plugins/System.ComponentModel.Annotations.dll
new file mode 100644
index 00000000..a5adedd3
Binary files /dev/null and b/unity/org.gamecult.cultlib/Runtime/Plugins/System.ComponentModel.Annotations.dll differ
diff --git a/unity/org.gamecult.cultlib/Runtime/Plugins/System.ComponentModel.Annotations.dll.meta b/unity/org.gamecult.cultlib/Runtime/Plugins/System.ComponentModel.Annotations.dll.meta
new file mode 100644
index 00000000..3de3c413
--- /dev/null
+++ b/unity/org.gamecult.cultlib/Runtime/Plugins/System.ComponentModel.Annotations.dll.meta
@@ -0,0 +1,2 @@
+fileFormatVersion: 2
+guid: ad5cea3c2c2da9445bf53ebd31ecd0dd
\ No newline at end of file
diff --git a/unity/org.gamecult.cultlib/Runtime/Plugins/System.IO.Pipelines.dll b/unity/org.gamecult.cultlib/Runtime/Plugins/System.IO.Pipelines.dll
new file mode 100644
index 00000000..419be266
Binary files /dev/null and b/unity/org.gamecult.cultlib/Runtime/Plugins/System.IO.Pipelines.dll differ
diff --git a/unity/org.gamecult.cultlib/Runtime/Plugins/System.IO.Pipelines.dll.meta b/unity/org.gamecult.cultlib/Runtime/Plugins/System.IO.Pipelines.dll.meta
new file mode 100644
index 00000000..f8b4b136
--- /dev/null
+++ b/unity/org.gamecult.cultlib/Runtime/Plugins/System.IO.Pipelines.dll.meta
@@ -0,0 +1,2 @@
+fileFormatVersion: 2
+guid: 79183527f5bbdc344aa9a20251f06ec0
\ No newline at end of file
diff --git a/unity/org.gamecult.cultlib/Runtime/Plugins/System.Runtime.CompilerServices.Unsafe.dll b/unity/org.gamecult.cultlib/Runtime/Plugins/System.Runtime.CompilerServices.Unsafe.dll
new file mode 100644
index 00000000..491a80a9
Binary files /dev/null and b/unity/org.gamecult.cultlib/Runtime/Plugins/System.Runtime.CompilerServices.Unsafe.dll differ
diff --git a/unity/org.gamecult.cultlib/Runtime/Plugins/System.Runtime.CompilerServices.Unsafe.dll.meta b/unity/org.gamecult.cultlib/Runtime/Plugins/System.Runtime.CompilerServices.Unsafe.dll.meta
new file mode 100644
index 00000000..e7ac5b7b
--- /dev/null
+++ b/unity/org.gamecult.cultlib/Runtime/Plugins/System.Runtime.CompilerServices.Unsafe.dll.meta
@@ -0,0 +1,2 @@
+fileFormatVersion: 2
+guid: 38e3f463e2e9d29439283b08c4e65582
\ No newline at end of file
diff --git a/unity/org.gamecult.cultlib/Runtime/Plugins/System.Text.Encodings.Web.dll b/unity/org.gamecult.cultlib/Runtime/Plugins/System.Text.Encodings.Web.dll
new file mode 100644
index 00000000..cf5ba2f0
Binary files /dev/null and b/unity/org.gamecult.cultlib/Runtime/Plugins/System.Text.Encodings.Web.dll differ
diff --git a/unity/org.gamecult.cultlib/Runtime/Plugins/System.Text.Encodings.Web.dll.meta b/unity/org.gamecult.cultlib/Runtime/Plugins/System.Text.Encodings.Web.dll.meta
new file mode 100644
index 00000000..5f6acdb8
--- /dev/null
+++ b/unity/org.gamecult.cultlib/Runtime/Plugins/System.Text.Encodings.Web.dll.meta
@@ -0,0 +1,2 @@
+fileFormatVersion: 2
+guid: d3d961cf372840746b08ad34ae89b9db
\ No newline at end of file
diff --git a/unity/org.gamecult.cultlib/Runtime/Plugins/System.Text.Json.dll b/unity/org.gamecult.cultlib/Runtime/Plugins/System.Text.Json.dll
new file mode 100644
index 00000000..fd78060e
Binary files /dev/null and b/unity/org.gamecult.cultlib/Runtime/Plugins/System.Text.Json.dll differ
diff --git a/unity/org.gamecult.cultlib/Runtime/Plugins/System.Text.Json.dll.meta b/unity/org.gamecult.cultlib/Runtime/Plugins/System.Text.Json.dll.meta
new file mode 100644
index 00000000..2ed620fd
--- /dev/null
+++ b/unity/org.gamecult.cultlib/Runtime/Plugins/System.Text.Json.dll.meta
@@ -0,0 +1,2 @@
+fileFormatVersion: 2
+guid: a1420294c34762748bb0a2f0b555ed67
\ No newline at end of file
diff --git a/unity/org.gamecult.cultlib/Runtime/Plugins/System.Threading.Channels.dll b/unity/org.gamecult.cultlib/Runtime/Plugins/System.Threading.Channels.dll
new file mode 100644
index 00000000..60b45fba
Binary files /dev/null and b/unity/org.gamecult.cultlib/Runtime/Plugins/System.Threading.Channels.dll differ
diff --git a/unity/org.gamecult.cultlib/Runtime/Plugins/System.Threading.Channels.dll.meta b/unity/org.gamecult.cultlib/Runtime/Plugins/System.Threading.Channels.dll.meta
new file mode 100644
index 00000000..05b73ea3
--- /dev/null
+++ b/unity/org.gamecult.cultlib/Runtime/Plugins/System.Threading.Channels.dll.meta
@@ -0,0 +1,2 @@
+fileFormatVersion: 2
+guid: efdbf01b8e904904989d4ac4ac55a471
\ No newline at end of file
diff --git a/unity/org.gamecult.cultlib/Runtime/Plugins/x86_64.meta b/unity/org.gamecult.cultlib/Runtime/Plugins/x86_64.meta
new file mode 100644
index 00000000..5046eeba
--- /dev/null
+++ b/unity/org.gamecult.cultlib/Runtime/Plugins/x86_64.meta
@@ -0,0 +1,8 @@
+fileFormatVersion: 2
+guid: c098a8f906144352a0eb7a5f47403c8d
+folderAsset: yes
+DefaultImporter:
+  externalObjects: {}
+  userData:
+  assetBundleName:
+  assetBundleVariant:
diff --git a/unity/org.gamecult.cultlib/Runtime/Plugins/x86_64/gamecult_mesh_quic_native.dll b/unity/org.gamecult.cultlib/Runtime/Plugins/x86_64/gamecult_mesh_quic_native.dll
new file mode 100644
index 00000000..fb2fc96d
Binary files /dev/null and b/unity/org.gamecult.cultlib/Runtime/Plugins/x86_64/gamecult_mesh_quic_native.dll differ
diff --git a/unity/org.gamecult.cultlib/Runtime/Plugins/x86_64/gamecult_mesh_quic_native.dll.meta b/unity/org.gamecult.cultlib/Runtime/Plugins/x86_64/gamecult_mesh_quic_native.dll.meta
new file mode 100644
index 00000000..cfeb2bd8
--- /dev/null
+++ b/unity/org.gamecult.cultlib/Runtime/Plugins/x86_64/gamecult_mesh_quic_native.dll.meta
@@ -0,0 +1,34 @@
+fileFormatVersion: 2
+guid: 9e0e0968e84b477f88232232ef261598
+PluginImporter:
+  externalObjects: {}
+  serializedVersion: 2
+  iconMap: {}
+  executionOrder: {}
+  defineConstraints: []
+  isPreloaded: 0
+  isOverridable: 0
+  isExplicitlyReferenced: 0
+  validateReferences: 1
+  platformData:
+  - first:
+      Any:
+    second:
+      enabled: 0
+      settings: {}
+  - first:
+      Editor: Editor
+    second:
+      enabled: 1
+      settings:
+        CPU: x86_64
+        DefaultValueInitialized: true
+  - first:
+      Standalone: Win
+    second:
+      enabled: 1
+      settings:
+        CPU: x86_64
+  userData:
+  assetBundleName:
+  assetBundleVariant:
diff --git a/unity/org.gamecult.cultlib/Runtime/Plugins/x86_64/msquic.dll b/unity/org.gamecult.cultlib/Runtime/Plugins/x86_64/msquic.dll
new file mode 100644
index 00000000..ffd41afa
Binary files /dev/null and b/unity/org.gamecult.cultlib/Runtime/Plugins/x86_64/msquic.dll differ
diff --git a/unity/org.gamecult.cultlib/Runtime/Plugins/x86_64/msquic.dll.meta b/unity/org.gamecult.cultlib/Runtime/Plugins/x86_64/msquic.dll.meta
new file mode 100644
index 00000000..789b12e6
--- /dev/null
+++ b/unity/org.gamecult.cultlib/Runtime/Plugins/x86_64/msquic.dll.meta
@@ -0,0 +1,34 @@
+fileFormatVersion: 2
+guid: 401ec45df4724af1bca3e78fd39f44de
+PluginImporter:
+  externalObjects: {}
+  serializedVersion: 2
+  iconMap: {}
+  executionOrder: {}
+  defineConstraints: []
+  isPreloaded: 0
+  isOverridable: 0
+  isExplicitlyReferenced: 0
+  validateReferences: 1
+  platformData:
+  - first:
+      Any:
+    second:
+      enabled: 0
+      settings: {}
+  - first:
+      Editor: Editor
+    second:
+      enabled: 1
+      settings:
+        CPU: x86_64
+        DefaultValueInitialized: true
+  - first:
+      Standalone: Win
+    second:
+      enabled: 1
+      settings:
+        CPU: x86_64
+  userData:
+  assetBundleName:
+  assetBundleVariant:
diff --git a/unity/org.gamecult.cultlib/Third Party Notices.meta b/unity/org.gamecult.cultlib/Third Party Notices.meta
new file mode 100644
index 00000000..3715b97f
--- /dev/null
+++ b/unity/org.gamecult.cultlib/Third Party Notices.meta	
@@ -0,0 +1,8 @@
+fileFormatVersion: 2
+guid: 145c68c2b4bb4adf8af4944b0f5c57b1
+folderAsset: yes
+DefaultImporter:
+  externalObjects: {}
+  userData:
+  assetBundleName:
+  assetBundleVariant:
diff --git a/unity/org.gamecult.cultlib/Third Party Notices/MSQUIC-LICENSE.txt b/unity/org.gamecult.cultlib/Third Party Notices/MSQUIC-LICENSE.txt
new file mode 100644
index 00000000..63447fd8
--- /dev/null
+++ b/unity/org.gamecult.cultlib/Third Party Notices/MSQUIC-LICENSE.txt	
@@ -0,0 +1,21 @@
+Copyright (c) Microsoft Corporation.
+
+MIT License
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED *AS IS*, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
\ No newline at end of file
diff --git a/unity/org.gamecult.cultlib/Third Party Notices/MSQUIC-LICENSE.txt.meta b/unity/org.gamecult.cultlib/Third Party Notices/MSQUIC-LICENSE.txt.meta
new file mode 100644
index 00000000..dabf2ce4
--- /dev/null
+++ b/unity/org.gamecult.cultlib/Third Party Notices/MSQUIC-LICENSE.txt.meta	
@@ -0,0 +1,7 @@
+fileFormatVersion: 2
+guid: 0f648ff709b44e29af0e8f284e661890
+TextScriptImporter:
+  externalObjects: {}
+  userData:
+  assetBundleName:
+  assetBundleVariant:
diff --git a/unity/org.gamecult.cultlib/package.json b/unity/org.gamecult.cultlib/package.json
new file mode 100644
index 00000000..fd173021
--- /dev/null
+++ b/unity/org.gamecult.cultlib/package.json
@@ -0,0 +1,11 @@
+{
+  "name": "org.gamecult.cultlib",
+  "displayName": "CultLib",
+  "version": "1.0.56",
+  "unity": "2021.3",
+  "description": "CultCache, CultNet, and CultMesh managed runtime assemblies for Unity.",
+  "license": "MIT",
+  "author": {
+    "name": "GameCult"
+  }
+}
diff --git a/unity/org.gamecult.cultlib/package.json.meta b/unity/org.gamecult.cultlib/package.json.meta
new file mode 100644
index 00000000..e012cbe0
--- /dev/null
+++ b/unity/org.gamecult.cultlib/package.json.meta
@@ -0,0 +1,7 @@
+fileFormatVersion: 2
+guid: 3ab8a5e0e58ddab49b1f95b542806037
+PackageManifestImporter:
+  externalObjects: {}
+  userData: 
+  assetBundleName: 
+  assetBundleVariant: