@abloatai/humans 0.66.0 → 0.66.1

package/dist/local/SyncClient.d.ts

@@ -57,6 +57,8 @@ export declare class SyncClient extends EventEmitter {
      * {@link SyncClient.getEchoMetrics} exposes its counters.
      */
     private readonly echoTracker;
+    private readonly pendingDeletes;
+    isDeletePending(id: string): boolean;
     private connectionState;
     private isDisposed;
     /**

package/dist/local/SyncClient.js

@@ -69,6 +69,10 @@ export class SyncClient extends EventEmitter {
      * {@link SyncClient.getEchoMetrics} exposes its counters.
      */
     echoTracker = new UnconfirmedWrites();
+    pendingDeletes = new Set();
+    isDeletePending(id) {
+        return this.pendingDeletes.has(id);
+    }
     // Connection state
     connectionState = 'disconnected';
     // Configuration
@@ -237,7 +241,16 @@ export class SyncClient extends EventEmitter {
                     // Guard: if the model was disposed (e.g. by a concurrent DELETE rollback or
                     // cascade), don't re-add it — Object.assign cannot restore the private
                     // isDisposed flag, so the model would be added in a broken state.
-                    if (model.disposed) {
+                    if (model.disposed && transaction.type === 'delete') {
+                        const restored = this.objectPool.createFromData({
+                            ...model.toJSON(),
+                            ...(previousState && typeof previousState === 'object' ? previousState : {}),
+                            __typename: transaction.modelName,
+                        });
+                        if (restored)
+                            this.objectPool.add(restored, ModelScope.live);
+                    }
+                    else if (model.disposed) {
                         // Follow-on of an already-logged permanent error, not its own
                         // problem: the tx that failed has already surfaced the cause in
                         // MutationQueue. Restoring a disposed model is a no-op by
@@ -256,6 +269,8 @@ export class SyncClient extends EventEmitter {
                         this.objectPool.add(model, ModelScope.live);
                     }
                 }
+                if (transaction.type === 'delete')
+                    this.pendingDeletes.delete(transaction.modelId);
                 this.notifyObservers({
                     type: 'rollback',
                     modelType: transaction.modelName,
@@ -876,7 +891,17 @@ export class SyncClient extends EventEmitter {
     delete(model, options) {
         // Clear pending mutations first to prevent "not found" errors on fast delete
         this.mutationQueue.cancelTransactionsForModel(model.id);
-        return this.mutate('delete', model, () => this.objectPool.remove(model.id), options);
+        this.pendingDeletes.add(model.id);
+        this.emit('optimistic:delete', model.id);
+        const confirmation = this.mutate('delete', model, () => this.objectPool.remove(model.id), options);
+        // Confirmation can precede the IndexedDB delta write. Keep the guard until
+        // the persisted remove is applied, except when no durable row exists.
+        void confirmation?.then(async () => {
+            if (!await this.database.getStore(model.getModelName())?.get(model.id)) {
+                this.pendingDeletes.delete(model.id);
+            }
+        }).catch(() => undefined);
+        return confirmation;
     }
     fileUploadContext() {
         return {
@@ -1530,6 +1555,8 @@ export class SyncClient extends EventEmitter {
             // otherwise re-add it for the brief window before the matching delete
             // confirmation lands.
             if (this.echoTracker.consumeEcho(transactionId)) {
+                if (action === 'remove')
+                    this.pendingDeletes.delete(modelId);
                 // A direct assignment can re-enter change tracking while this
                 // optimistic write is in flight. Leaving the acknowledged field dirty
                 // makes conflict resolution preserve it over the next collaborator
@@ -1600,6 +1627,7 @@ export class SyncClient extends EventEmitter {
                 }
                 case 'remove':
                     idsToRemove.push(modelId);
+                    this.pendingDeletes.delete(modelId);
                     break;
                 case 'archive':
                     idsToArchive.push(modelId);

package/dist/local/client/createInternalComponents.js

@@ -68,7 +68,9 @@ export function createInternalComponents(input) {
         // leaves so a late answer cannot overwrite a row the pool already knows to
         // be further along.
         position: syncClient.position,
+        isDeletePending: (id) => syncClient.isDeletePending(id),
     });
+    syncClient.on('optimistic:delete', (id) => hydration.markDeleted(id));
     // Drop the lazy-lane hydration ledger on reconnect. While connected, the
     // WebSocket delta stream keeps hydrated rows fresh so repeat reads serve
     // pure-local with no network; after a drop, deltas may have been missed, so

package/dist/local/sync/OnDemandLoader.d.ts

@@ -66,6 +66,7 @@ export interface OnDemandLoaderOptions {
      * against before a snapshot may overwrite it (see {@link RowWatermarks}).
      */
     readonly position: Pick<LogPositionPort, 'readFloor'>;
+    readonly isDeletePending?: (id: string) => boolean;
 }
 export interface FetchOptions<T> {
     /**
@@ -99,6 +100,8 @@ export interface FetchOptions<T> {
 }
 export declare class OnDemandLoader {
     private readonly opts;
+    private readonly activeReadDeletes;
+    markDeleted(id: string): void;
     private readonly readEvidence;
     private readonly inFlight;
     /**

package/dist/local/sync/OnDemandLoader.js

@@ -47,6 +47,11 @@ function snapshotPosition(raw, evidenceById, readFloorAtIssue) {
 }
 export class OnDemandLoader {
     opts;
+    activeReadDeletes = new Set();
+    markDeleted(id) {
+        for (const deleted of this.activeReadDeletes)
+            deleted.add(id);
+    }
     readEvidence = new WeakMap();
     inFlight = new Map();
     /**
@@ -166,8 +171,9 @@ export class OnDemandLoader {
         // through to the blocking fetch that brings parent and children together;
         // the second open is served by the fast path.
         if (!explicitComplete && !hasExpand) {
-            const local = await this.readLocal(modelName, typename, ModelClass, clauses, hasExpand, expand);
-            if (local.length > 0) {
+            let suppressed = false;
+            const local = await this.readLocal(modelName, typename, ModelClass, clauses, hasExpand, expand, () => { suppressed = true; });
+            if (local.length > 0 || suppressed) {
                 this.scheduleHydratingFetch(queryKey, modelName, typename, clauses, options);
                 return applyLimit(local, options?.limit);
             }
@@ -185,16 +191,30 @@ export class OnDemandLoader {
      * pool from IDB as a side effect. Resolves requested `expand` relations from
      * their own local stores too. Never touches the network.
      */
-    async readLocal(modelName, typename, ModelClass, clauses, hasExpand, expand) {
-        let local = scanPool(this.opts.objectPool, ModelClass, clauses);
+    async readLocal(modelName, typename, ModelClass, clauses, hasExpand, expand, onSuppressed) {
+        let local = scanPool(this.opts.objectPool, ModelClass, clauses)
+            .filter((model) => !this.opts.isDeletePending?.(model.id));
         if (local.length === 0) {
-            const fromIdb = await scanIdb(this.opts.database, typename, clauses);
-            const idbModels = fromIdb
-                .map((raw) => this.hydrateOne(raw, LOCAL, typename))
-                .filter((m) => m !== null);
-            if (idbModels.length > 0) {
-                this.opts.objectPool.addBatch(idbModels, ModelScope.live);
-                local = idbModels;
+            const deleted = new Set();
+            this.activeReadDeletes.add(deleted);
+            try {
+                const fromIdb = await scanIdb(this.opts.database, typename, clauses);
+                if (fromIdb.some((raw) => {
+                    const id = raw && typeof raw === 'object' ? raw.id : undefined;
+                    return typeof id === 'string' && (this.opts.isDeletePending?.(id) || deleted.has(id));
+                })) {
+                    onSuppressed?.();
+                }
+                const idbModels = fromIdb
+                    .map((raw) => this.hydrateOne(raw, LOCAL, typename, { deleted }))
+                    .filter((m) => m !== null);
+                if (idbModels.length > 0) {
+                    this.opts.objectPool.addBatch(idbModels, ModelScope.live);
+                    local = idbModels;
+                }
+            }
+            finally {
+                this.activeReadDeletes.delete(deleted);
             }
         }
         if (hasExpand && expand && local.length > 0) {
@@ -218,32 +238,39 @@ export class OnDemandLoader {
      * revalidation kicked off after an `'unknown'` local hit.
      */
     async fetchFromNetwork(modelName, typename, clauses, options) {
-        const network = await this.queryNetwork(modelName, clauses, options);
-        const networkRows = network.rows;
-        const evidenceById = new Map(network.evidence.map((entry) => [entry.id, entry.stamp]));
-        const acceptedRows = [];
-        const networkModels = networkRows
-            // Strict: a row the server returned whose type name this client never
-            // registered is a genuine schema collision (the pushed schema differs
-            // from the local one). Throw here, naming the cause, rather than silently
-            // dropping the row and failing downstream as `entity_not_found`.
-            .map((raw) => this.hydrateOne(raw, { kind: 'network', position: snapshotPosition(raw, evidenceById, network.position) }, typename, { strict: true, acceptedRows }))
-            .filter((m) => m !== null);
-        for (const model of networkModels) {
-            const stamp = evidenceById.get(model.id);
-            if (stamp === undefined)
-                continue;
-            // The read's evidence, kept for the premise a guarded write may cite;
-            // and the position the pooled row now reflects, for freshness.
-            this.readEvidence.set(model, stamp);
-            this.opts.objectPool.watermarks.advance(model, stamp);
+        const deleted = new Set();
+        this.activeReadDeletes.add(deleted);
+        try {
+            const network = await this.queryNetwork(modelName, clauses, options, deleted);
+            const networkRows = network.rows;
+            const evidenceById = new Map(network.evidence.map((entry) => [entry.id, entry.stamp]));
+            const acceptedRows = [];
+            const networkModels = networkRows
+                // Strict: a row the server returned whose type name this client never
+                // registered is a genuine schema collision (the pushed schema differs
+                // from the local one). Throw here, naming the cause, rather than silently
+                // dropping the row and failing downstream as `entity_not_found`.
+                .map((raw) => this.hydrateOne(raw, { kind: 'network', position: snapshotPosition(raw, evidenceById, network.position) }, typename, { strict: true, acceptedRows, deleted }))
+                .filter((m) => m !== null);
+            for (const model of networkModels) {
+                const stamp = evidenceById.get(model.id);
+                if (stamp === undefined)
+                    continue;
+                // The read's evidence, kept for the premise a guarded write may cite;
+                // and the position the pooled row now reflects, for freshness.
+                this.readEvidence.set(model, stamp);
+                this.opts.objectPool.watermarks.advance(model, stamp);
+            }
+            if (networkModels.length > 0) {
+                this.opts.objectPool.addBatch(networkModels, ModelScope.live);
+                // Persist only accepted snapshots: a stale response must not roll disk back.
+                await this.persistToIdb(modelName, acceptedRows);
+            }
+            return networkModels;
         }
-        if (networkModels.length > 0) {
-            this.opts.objectPool.addBatch(networkModels, ModelScope.live);
-            // Persist only accepted snapshots: a stale response must not roll disk back.
-            await this.persistToIdb(modelName, acceptedRows);
+        finally {
+            this.activeReadDeletes.delete(deleted);
         }
-        return networkModels;
     }
     /**
      * Fires the single background confirm for a query that was just served from
@@ -301,12 +328,19 @@ export class OnDemandLoader {
             const missing = parentIds.filter((pid) => this.opts.objectPool.getByForeignKey(targetTypename, foreignKey, pid).length === 0);
             if (missing.length === 0)
                 continue;
-            const rows = await this.readChildrenLocal(targetTypename, foreignKey, missing);
-            const models = rows
-                .map((raw) => this.hydrateOne(this.stampTypename(raw, targetTypename), LOCAL, targetTypename))
-                .filter((m) => m !== null);
-            if (models.length > 0) {
-                this.opts.objectPool.addBatch(models, ModelScope.live);
+            const deleted = new Set();
+            this.activeReadDeletes.add(deleted);
+            try {
+                const rows = await this.readChildrenLocal(targetTypename, foreignKey, missing);
+                const models = rows
+                    .map((raw) => this.hydrateOne(this.stampTypename(raw, targetTypename), LOCAL, targetTypename, { deleted }))
+                    .filter((m) => m !== null);
+                if (models.length > 0) {
+                    this.opts.objectPool.addBatch(models, ModelScope.live);
+                }
+            }
+            finally {
+                this.activeReadDeletes.delete(deleted);
             }
         }
     }
@@ -358,6 +392,8 @@ export class OnDemandLoader {
         const obj = raw;
         if (typeof obj.id !== 'string')
             return null;
+        if (this.opts.isDeletePending?.(obj.id) || opts?.deleted?.has(obj.id))
+            return null;
         if (this.opts.objectPool.has(obj.id)) {
             // Keep the existing instance alive when a query refreshes it. A query
             // can carry fresher server state after a missed delta, but unlike the
@@ -430,7 +466,7 @@ export class OnDemandLoader {
         void _dropRowVariant;
         return { __typename: typename, ...rest };
     }
-    async queryNetwork(modelName, clauses, options) {
+    async queryNetwork(modelName, clauses, options, deleted) {
         const typename = this.resolveTypename(modelName);
         const orderEntries = options?.orderBy ? Object.entries(options.orderBy) : [];
         const firstOrder = orderEntries[0];
@@ -476,7 +512,7 @@ export class OnDemandLoader {
         // own typed pool, then leave the nested arrays in place on the
         // primary row.
         if (options?.expand && options.expand.length > 0) {
-            await this.hydrateExpanded(modelName, normalized, options.expand, position);
+            await this.hydrateExpanded(modelName, normalized, options.expand, position, deleted);
         }
         return { rows: normalized, evidence, position };
     }
@@ -487,7 +523,7 @@ export class OnDemandLoader {
      * `__typename` field gets mangled by `postgres.camel` (`__typename`
      * → `_Typename`), so the SDK can't trust whatever string lands.
      */
-    async hydrateExpanded(parentModelName, rows, relationNames, position) {
+    async hydrateExpanded(parentModelName, rows, relationNames, position, deleted) {
         const writes = [];
         const parentDef = this.getModelDef(parentModelName);
         // Nested rows carry no evidence of their own; the read floor at issue
@@ -510,7 +546,7 @@ export class OnDemandLoader {
                 const stampedItems = [];
                 for (const item of items) {
                     const stamped = this.stampTypename(item, targetTypename);
-                    const m = this.hydrateOne(stamped, origin, targetTypename, { acceptedRows: stampedItems });
+                    const m = this.hydrateOne(stamped, origin, targetTypename, { acceptedRows: stampedItems, deleted });
                     if (m)
                         models.push(m);
                 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@abloatai/humans",
-  "version": "0.66.0",
+  "version": "0.66.1",
   "description": "The optional human-facing local-state package for Ablo: presence, live queries, and React bindings.",
   "license": "Apache-2.0",
   "type": "module",
@@ -85,7 +85,7 @@
     "directory": "packages/humans"
   },
   "dependencies": {
-    "@abloatai/transaction": "0.66.0",
+    "@abloatai/transaction": "0.66.1",
     "events": "^3.3.0",
     "mobx": "^6.13.7",
     "uuid": "^11.1.0",

package/src/local/SyncClient.ts

@@ -106,6 +106,11 @@ export class SyncClient extends EventEmitter {
    * {@link SyncClient.getEchoMetrics} exposes its counters.
    */
   private readonly echoTracker = new UnconfirmedWrites();
+  private readonly pendingDeletes = new Set<string>();
+
+  isDeletePending(id: string): boolean {
+    return this.pendingDeletes.has(id);
+  }
 
   // Connection state
   private connectionState: 'connected' | 'disconnected' | 'connecting' = 'disconnected';
@@ -312,7 +317,14 @@ export class SyncClient extends EventEmitter {
             // Guard: if the model was disposed (e.g. by a concurrent DELETE rollback or
             // cascade), don't re-add it — Object.assign cannot restore the private
             // isDisposed flag, so the model would be added in a broken state.
-            if (model.disposed) {
+            if (model.disposed && transaction.type === 'delete') {
+              const restored = this.objectPool.createFromData({
+                ...model.toJSON(),
+                ...(previousState && typeof previousState === 'object' ? previousState : {}),
+                __typename: transaction.modelName,
+              });
+              if (restored) this.objectPool.add(restored, ModelScope.live);
+            } else if (model.disposed) {
               // Follow-on of an already-logged permanent error, not its own
               // problem: the tx that failed has already surfaced the cause in
               // MutationQueue. Restoring a disposed model is a no-op by
@@ -330,6 +342,8 @@ export class SyncClient extends EventEmitter {
             }
           }
 
+          if (transaction.type === 'delete') this.pendingDeletes.delete(transaction.modelId);
+
           this.notifyObservers({
             type: 'rollback',
             modelType: transaction.modelName,
@@ -1084,7 +1098,17 @@ export class SyncClient extends EventEmitter {
   delete(model: Model, options?: WriteOptions): Promise<void> | undefined {
     // Clear pending mutations first to prevent "not found" errors on fast delete
     this.mutationQueue.cancelTransactionsForModel(model.id);
-    return this.mutate('delete', model, () => this.objectPool.remove(model.id), options);
+    this.pendingDeletes.add(model.id);
+    this.emit('optimistic:delete', model.id);
+    const confirmation = this.mutate('delete', model, () => this.objectPool.remove(model.id), options);
+    // Confirmation can precede the IndexedDB delta write. Keep the guard until
+    // the persisted remove is applied, except when no durable row exists.
+    void confirmation?.then(async () => {
+      if (!await this.database.getStore(model.getModelName())?.get(model.id)) {
+        this.pendingDeletes.delete(model.id);
+      }
+    }).catch(() => undefined);
+    return confirmation;
   }
 
   private fileUploadContext(): FileUploadContext {
@@ -1871,6 +1895,7 @@ export class SyncClient extends EventEmitter {
       // otherwise re-add it for the brief window before the matching delete
       // confirmation lands.
       if (this.echoTracker.consumeEcho(transactionId)) {
+        if (action === 'remove') this.pendingDeletes.delete(modelId);
         // A direct assignment can re-enter change tracking while this
         // optimistic write is in flight. Leaving the acknowledged field dirty
         // makes conflict resolution preserve it over the next collaborator
@@ -1944,6 +1969,7 @@ export class SyncClient extends EventEmitter {
         }
         case 'remove':
           idsToRemove.push(modelId);
+          this.pendingDeletes.delete(modelId);
           break;
         case 'archive':
           idsToArchive.push(modelId);

package/src/local/client/createInternalComponents.ts

@@ -127,7 +127,9 @@ export function createInternalComponents<S extends SchemaRecord>(
     // leaves so a late answer cannot overwrite a row the pool already knows to
     // be further along.
     position: syncClient.position,
+    isDeletePending: (id) => syncClient.isDeletePending(id),
   });
+  syncClient.on('optimistic:delete', (id: string) => hydration.markDeleted(id));
 
   // Drop the lazy-lane hydration ledger on reconnect. While connected, the
   // WebSocket delta stream keeps hydrated rows fresh so repeat reads serve

package/src/local/sync/OnDemandLoader.ts

@@ -71,6 +71,7 @@ export interface OnDemandLoaderOptions {
    * against before a snapshot may overwrite it (see {@link RowWatermarks}).
    */
   readonly position: Pick<LogPositionPort, 'readFloor'>;
+  readonly isDeletePending?: (id: string) => boolean;
 }
 
 export interface FetchOptions<T> {
@@ -153,6 +154,11 @@ function snapshotPosition(
 }
 
 export class OnDemandLoader {
+  private readonly activeReadDeletes = new Set<Set<string>>();
+
+  markDeleted(id: string): void {
+    for (const deleted of this.activeReadDeletes) deleted.add(id);
+  }
   private readonly readEvidence = new WeakMap<object, number>();
   private readonly inFlight = new Map<string, Promise<Model[]>>();
   /**
@@ -302,8 +308,10 @@ export class OnDemandLoader {
     // through to the blocking fetch that brings parent and children together;
     // the second open is served by the fast path.
     if (!explicitComplete && !hasExpand) {
-      const local = await this.readLocal(modelName, typename, ModelClass, clauses, hasExpand, expand);
-      if (local.length > 0) {
+      let suppressed = false;
+      const local = await this.readLocal(modelName, typename, ModelClass, clauses, hasExpand, expand,
+        () => { suppressed = true; });
+      if (local.length > 0 || suppressed) {
         this.scheduleHydratingFetch(queryKey, modelName, typename, clauses, options);
         return applyLimit(local, options?.limit);
       }
@@ -330,16 +338,30 @@ export class OnDemandLoader {
     clauses: readonly WhereClause[],
     hasExpand: boolean,
     expand: readonly string[] | undefined,
+    onSuppressed?: () => void,
   ): Promise<Model[]> {
-    let local = scanPool(this.opts.objectPool, ModelClass, clauses);
+    let local = scanPool(this.opts.objectPool, ModelClass, clauses)
+      .filter((model) => !this.opts.isDeletePending?.(model.id));
     if (local.length === 0) {
-      const fromIdb = await scanIdb(this.opts.database, typename, clauses);
-      const idbModels = fromIdb
-        .map((raw) => this.hydrateOne(raw, LOCAL, typename))
-        .filter((m): m is Model => m !== null);
-      if (idbModels.length > 0) {
-        this.opts.objectPool.addBatch(idbModels, ModelScope.live);
-        local = idbModels;
+      const deleted = new Set<string>();
+      this.activeReadDeletes.add(deleted);
+      try {
+        const fromIdb = await scanIdb(this.opts.database, typename, clauses);
+        if (fromIdb.some((raw) => {
+          const id = raw && typeof raw === 'object' ? (raw as { id?: unknown }).id : undefined;
+          return typeof id === 'string' && (this.opts.isDeletePending?.(id) || deleted.has(id));
+        })) {
+          onSuppressed?.();
+        }
+        const idbModels = fromIdb
+          .map((raw) => this.hydrateOne(raw, LOCAL, typename, { deleted }))
+          .filter((m): m is Model => m !== null);
+        if (idbModels.length > 0) {
+          this.opts.objectPool.addBatch(idbModels, ModelScope.live);
+          local = idbModels;
+        }
+      } finally {
+        this.activeReadDeletes.delete(deleted);
       }
     }
     if (hasExpand && expand && local.length > 0) {
@@ -370,41 +392,47 @@ export class OnDemandLoader {
     clauses: readonly WhereClause[],
     options: FetchOptions<unknown> | undefined,
   ): Promise<Model[]> {
-    const network = await this.queryNetwork(modelName, clauses, options);
-    const networkRows = network.rows;
-    const evidenceById = new Map(network.evidence.map((entry) => [entry.id, entry.stamp]));
-    const acceptedRows: unknown[] = [];
-    const networkModels = networkRows
-      // Strict: a row the server returned whose type name this client never
-      // registered is a genuine schema collision (the pushed schema differs
-      // from the local one). Throw here, naming the cause, rather than silently
-      // dropping the row and failing downstream as `entity_not_found`.
-      .map((raw) =>
-        this.hydrateOne(
-          raw,
-          { kind: 'network', position: snapshotPosition(raw, evidenceById, network.position) },
-          typename,
-          { strict: true, acceptedRows },
-        ),
-      )
-      .filter((m): m is Model => m !== null);
-
-    for (const model of networkModels) {
-      const stamp = evidenceById.get(model.id);
-      if (stamp === undefined) continue;
-      // The read's evidence, kept for the premise a guarded write may cite;
-      // and the position the pooled row now reflects, for freshness.
-      this.readEvidence.set(model, stamp);
-      this.opts.objectPool.watermarks.advance(model, stamp);
-    }
+    const deleted = new Set<string>();
+    this.activeReadDeletes.add(deleted);
+    try {
+      const network = await this.queryNetwork(modelName, clauses, options, deleted);
+      const networkRows = network.rows;
+      const evidenceById = new Map(network.evidence.map((entry) => [entry.id, entry.stamp]));
+      const acceptedRows: unknown[] = [];
+      const networkModels = networkRows
+        // Strict: a row the server returned whose type name this client never
+        // registered is a genuine schema collision (the pushed schema differs
+        // from the local one). Throw here, naming the cause, rather than silently
+        // dropping the row and failing downstream as `entity_not_found`.
+        .map((raw) =>
+          this.hydrateOne(
+            raw,
+            { kind: 'network', position: snapshotPosition(raw, evidenceById, network.position) },
+            typename,
+            { strict: true, acceptedRows, deleted },
+          ),
+        )
+        .filter((m): m is Model => m !== null);
 
-    if (networkModels.length > 0) {
-      this.opts.objectPool.addBatch(networkModels, ModelScope.live);
-      // Persist only accepted snapshots: a stale response must not roll disk back.
-      await this.persistToIdb(modelName, acceptedRows);
-    }
+      for (const model of networkModels) {
+        const stamp = evidenceById.get(model.id);
+        if (stamp === undefined) continue;
+        // The read's evidence, kept for the premise a guarded write may cite;
+        // and the position the pooled row now reflects, for freshness.
+        this.readEvidence.set(model, stamp);
+        this.opts.objectPool.watermarks.advance(model, stamp);
+      }
+
+      if (networkModels.length > 0) {
+        this.opts.objectPool.addBatch(networkModels, ModelScope.live);
+        // Persist only accepted snapshots: a stale response must not roll disk back.
+        await this.persistToIdb(modelName, acceptedRows);
+      }
 
-    return networkModels;
+      return networkModels;
+    } finally {
+      this.activeReadDeletes.delete(deleted);
+    }
   }
 
   /**
@@ -473,12 +501,18 @@ export class OnDemandLoader {
       );
       if (missing.length === 0) continue;
 
-      const rows = await this.readChildrenLocal(targetTypename, foreignKey, missing);
-      const models = rows
-        .map((raw) => this.hydrateOne(this.stampTypename(raw, targetTypename), LOCAL, targetTypename))
-        .filter((m): m is Model => m !== null);
-      if (models.length > 0) {
-        this.opts.objectPool.addBatch(models, ModelScope.live);
+      const deleted = new Set<string>();
+      this.activeReadDeletes.add(deleted);
+      try {
+        const rows = await this.readChildrenLocal(targetTypename, foreignKey, missing);
+        const models = rows
+          .map((raw) => this.hydrateOne(this.stampTypename(raw, targetTypename), LOCAL, targetTypename, { deleted }))
+          .filter((m): m is Model => m !== null);
+        if (models.length > 0) {
+          this.opts.objectPool.addBatch(models, ModelScope.live);
+        }
+      } finally {
+        this.activeReadDeletes.delete(deleted);
       }
     }
   }
@@ -532,11 +566,12 @@ export class OnDemandLoader {
     raw: unknown,
     origin: HydrationOrigin,
     typename?: string,
-    opts?: { strict?: boolean; acceptedRows?: unknown[] },
+    opts?: { strict?: boolean; acceptedRows?: unknown[]; deleted?: ReadonlySet<string> },
   ): Model | null {
     if (!raw || typeof raw !== 'object') return null;
     const obj = raw as Record<string, unknown>;
     if (typeof obj.id !== 'string') return null;
+    if (this.opts.isDeletePending?.(obj.id) || opts?.deleted?.has(obj.id)) return null;
     if (this.opts.objectPool.has(obj.id)) {
       // Keep the existing instance alive when a query refreshes it. A query
       // can carry fresher server state after a missed delta, but unlike the
@@ -617,6 +652,7 @@ export class OnDemandLoader {
     modelName: string,
     clauses: readonly WhereClause[],
     options: FetchOptions<unknown> | undefined,
+    deleted: ReadonlySet<string>,
   ): Promise<{
     rows: unknown[];
     evidence: readonly { id: string; stamp: number }[];
@@ -672,7 +708,7 @@ export class OnDemandLoader {
     // own typed pool, then leave the nested arrays in place on the
     // primary row.
     if (options?.expand && options.expand.length > 0) {
-      await this.hydrateExpanded(modelName, normalized, options.expand, position);
+      await this.hydrateExpanded(modelName, normalized, options.expand, position, deleted);
     }
     return { rows: normalized, evidence, position };
   }
@@ -689,6 +725,7 @@ export class OnDemandLoader {
     rows: unknown[],
     relationNames: readonly string[],
     position: number,
+    deleted: ReadonlySet<string>,
   ): Promise<void> {
     const writes: Promise<void>[] = [];
     const parentDef = this.getModelDef(parentModelName);
@@ -711,7 +748,7 @@ export class OnDemandLoader {
         const stampedItems: unknown[] = [];
         for (const item of items) {
           const stamped = this.stampTypename(item, targetTypename);
-          const m = this.hydrateOne(stamped, origin, targetTypename, { acceptedRows: stampedItems });
+          const m = this.hydrateOne(stamped, origin, targetTypename, { acceptedRows: stampedItems, deleted });
           if (m) models.push(m);
         }
         if (models.length > 0) {