@cavelang/query 0.35.0 → 0.36.1

package/src/bounded.ts

@@ -2,6 +2,8 @@ import { Value } from '@cavelang/core'
 import type { Store } from '@cavelang/store/adapter'
 import * as Compile from './compile.ts'
 import * as Pattern from './pattern.ts'
+import { captureOptions, capturePattern } from './capture.ts'
+import { readSnapshot } from './read-snapshot.ts'
 
 export type { Match, Options } from './compile.ts'
 export type { Window } from './compile.ts'
@@ -29,14 +31,26 @@ const storeAtBoundary = (store: Store, options: Compile.Options): Store => {
 const execute = (
   store: Store,
   pattern: Pattern.t,
-  options: Compile.Options = {}
+  options: Compile.Options = {},
+  positions?: WeakMap<object, number>
+): Compile.Window => {
+  // Use the same caller values for historical vocabulary, SQL and post-filters.
+  options = captureOptions(options)
+  return readSnapshot(store, () => executeCaptured(store, pattern, options, positions))
+}
+
+const executeCaptured = (
+  store: Store,
+  pattern: Pattern.t,
+  options: Compile.Options,
+  positions?: WeakMap<object, number>
 ): Compile.Window => {
   if (pattern.payload.kind !== 'attribute' || pattern.payload.value.kind !== 'term') {
-    return Compile.window(storeAtBoundary(store, options), pattern, options)
+    return Compile.window(storeAtBoundary(store, options), pattern, options, positions)
   }
   const value = Value.parse(pattern.payload.value.text)
   if (value.kind !== 'number' || value.num === undefined) {
-    return Compile.window(storeAtBoundary(store, options), pattern, options)
+    return Compile.window(storeAtBoundary(store, options), pattern, options, positions)
   }
   const expectedNum = value.num
   const filter: Pattern.Filter = {
@@ -54,7 +68,7 @@ const execute = (
   }
   const expectedUnit = value.unit ?? null
   const expectedApprox = value.approx ? 1 : 0
-  const result = Compile.window(storeAtBoundary(store, options), normalized, options)
+  const result = Compile.window(storeAtBoundary(store, options), normalized, options, positions)
   return { ...result, matches: result.matches.filter(match => {
     const row = match.row
     return row !== undefined &&
@@ -67,18 +81,19 @@ const execute = (
 export const window = (
   store: Store,
   pattern: Pattern.t,
-  options: Compile.Options = {}
-): Compile.Window => execute(store, pattern, options)
+  options: Compile.Options = {},
+  positions?: WeakMap<object, number>
+): Compile.Window => execute(store, pattern, options, positions)
 
 export const match = (
   store: Store,
   pattern: Pattern.t,
   options: Compile.Options = {}
-): Compile.Match[] => execute(store, pattern, options).matches
+): Compile.Match[] => execute(store, capturePattern(pattern), options).matches
 
 export const query = (
   store: Store,
   input: string,
   options: Compile.Options = {}
 ): Compile.Match[] =>
-  match(store, Pattern.parse(input), options)
+  execute(store, Pattern.parse(input), options).matches

package/src/capture.ts

@@ -0,0 +1,59 @@
+import type { Options } from './compile.ts'
+import type * as Pattern from './pattern.ts'
+
+const slot = (value: Pattern.Slot): Pattern.Slot => {
+  switch (value.kind) {
+    case 'wildcard': return { kind: 'wildcard' }
+    case 'var': return { kind: 'var', name: value.name }
+    case 'term': return { kind: 'term', text: value.text }
+  }
+}
+
+const verb = (value: Pattern.VerbSlot): Pattern.VerbSlot => {
+  switch (value.kind) {
+    case 'wildcard': return { kind: 'wildcard' }
+    case 'var': return { kind: 'var', name: value.name }
+    case 'verb': return { kind: 'verb', name: value.name, transitive: value.transitive }
+  }
+}
+
+const payload = (value: Pattern.PayloadPattern): Pattern.PayloadPattern => {
+  switch (value.kind) {
+    case 'any': return { kind: 'any' }
+    case 'object': return { kind: 'object', object: slot(value.object) }
+    case 'attribute': return { kind: 'attribute', attribute: value.attribute, value: slot(value.value) }
+  }
+}
+
+const filter = (value: Pattern.Filter): Pattern.Filter => {
+  switch (value.field) {
+    case 'conf': return { field: 'conf', op: value.op, value: value.value }
+    case 'tag': return { field: 'tag', op: value.op, key: value.key, value: value.value }
+    case 'context': return { field: 'context', op: value.op, value: value.value }
+    case 'value': return { field: 'value', op: value.op, value: value.value, unit: value.unit }
+    case 'tx': return { field: 'tx', op: value.op, value: value.value }
+  }
+}
+
+/** Capture caller-owned AST fields before numeric detection or SQL compilation. */
+export const capturePattern = (value: Pattern.t): Pattern.t => ({
+  subject: slot(value.subject),
+  verb: verb(value.verb),
+  payload: payload(value.payload),
+  negated: value.negated,
+  contexts: [...value.contexts],
+  tags: value.tags.map(tag => ({ key: tag.key, value: tag.value })),
+  filters: value.filters.map(filter),
+})
+
+/** Capture caller-owned query options before database callbacks can change them. */
+export const captureOptions = (options: Options): Options => ({
+  all: options.all,
+  aliases: options.aliases,
+  asOf: options.asOf,
+  at: options.at,
+  resolve: options.resolve,
+  limit: options.limit,
+  offset: options.offset,
+  support: options.support,
+})

package/src/compile.ts

@@ -24,6 +24,7 @@ import { Registry } from '@cavelang/canonical'
 import { QuerySql, Resolve, Row } from '@cavelang/store/adapter'
 import type { Store } from '@cavelang/store/adapter'
 import * as Pattern from './pattern.ts'
+import { assertQueryUnicode } from './unicode.ts'
 
 /**
  * One storage-oriented query solution. `row`/`rows` expose SQLite-shaped
@@ -49,9 +50,9 @@ export type Match = {
 }
 
 export type Options = {
-  /** Maximum rows SQLite may return. Prefer the snapshot-aware page API for continuations. */
+  /** Positive safe-integer row bound. Prefer the snapshot-aware page API for continuations. */
   readonly limit?: number
-  /** Internal SQL offset used by the snapshot-aware page API. */
+  /** Non-negative safe-integer SQL offset used by the snapshot-aware page API. */
   readonly offset?: number
   /** Match all appended rows, not only current beliefs. */
   readonly all?: boolean
@@ -198,18 +199,33 @@ type Compiled = {
 
 const bounded = (compiled: Compiled, options: Options): Compiled => {
   if (options.limit === undefined) return compiled
-  if (!Number.isInteger(options.limit) || options.limit < 1 ||
-      !Number.isInteger(options.offset ?? 0) || (options.offset ?? 0) < 0) {
-    throw new Error('CAVE-Q: limit must be positive and offset must be non-negative')
+  const offset = options.offset === undefined ? 0 : options.offset
+  if (!Number.isSafeInteger(options.limit) || options.limit < 1 ||
+      !Number.isSafeInteger(offset) || offset < 0) {
+    throw new Error('CAVE-Q: limit must be a positive safe integer and offset must be a non-negative safe integer')
   }
   return {
     ...compiled,
     sql: `${compiled.sql}\nLIMIT ? OFFSET ?`,
-    params: [...compiled.params, options.limit, options.offset ?? 0]
+    params: [...compiled.params, options.limit, offset]
   }
 }
 
 export const compile = (pattern: Pattern.t, registry: Registry.t, options: Options, policy?: readonly Resolve.Entry[]): Compiled => {
+  // Structured callers can bypass Pattern.parse; validate every string-bearing
+  // slot and filter before SQL parameters or traversal state are constructed.
+  const parts = [pattern.subject, pattern.verb, pattern.payload, ...pattern.tags, ...pattern.filters,
+    ...pattern.payload.kind === 'object' ? [pattern.payload.object] :
+      pattern.payload.kind === 'attribute' ? [pattern.payload.value] : []]
+  for (const part of parts) {
+    if (Reflect.get(part, 'kind') === 'var' && Reflect.get(part, 'name') === '') {
+      throw new Error('CAVE-Q: variable requires a name after ?; use _ for a wildcard')
+    }
+    for (const field of ['text', 'name', 'attribute', 'key', 'value', 'unit']) {
+      assertQueryUnicode(Reflect.get(part, field))
+    }
+  }
+  for (const context of pattern.contexts) assertQueryUnicode(context)
   // Inverse resolution (spec §12.1): swap the pattern's endpoint slots and
   // query the primary verb.
   let verb = pattern.verb
@@ -309,72 +325,90 @@ export const compile = (pattern: Pattern.t, registry: Registry.t, options: Optio
       )
     }
   }
-  for (const context of pattern.contexts) {
-    conditions.push('EXISTS (SELECT 1 FROM cave_context x WHERE x.claim_id = c.id AND x.context = ?)')
-    params.push(context)
-  }
-  for (const tag of pattern.tags) {
-    if (tag.value === undefined) {
-      conditions.push('EXISTS (SELECT 1 FROM cave_tag t WHERE t.claim_id = c.id AND t.key = ? AND t.value IS NULL)')
-      params.push(tag.key)
+  // Keep ordinary indexed lookups direct; only large lists need a bound array
+  // to avoid SQLite's expression-depth and parameter limits.
+  if (pattern.contexts.length <= 16) {
+    for (const context of pattern.contexts) {
+      conditions.push('EXISTS (SELECT 1 FROM cave_context x WHERE x.claim_id = c.id AND x.context = ?)')
+      params.push(context)
+    }
+  } else {
+    conditions.push(`NOT EXISTS (SELECT 1 FROM json_each(?) required
+      WHERE NOT EXISTS (SELECT 1 FROM cave_context x
+        WHERE x.claim_id = c.id AND x.context = required.value))`)
+    params.push(JSON.stringify(pattern.contexts))
+  }
+  if (pattern.tags.length <= 16) {
+    for (const tag of pattern.tags) {
+      if (tag.value === undefined) {
+        conditions.push('EXISTS (SELECT 1 FROM cave_tag t WHERE t.claim_id = c.id AND t.key = ? AND t.value IS NULL)')
+        params.push(tag.key)
+      } else {
+        conditions.push('EXISTS (SELECT 1 FROM cave_tag t WHERE t.claim_id = c.id AND t.key = ? AND t.value = ?)')
+        params.push(tag.key, tag.value)
+      }
+    }
+  } else {
+    conditions.push(`NOT EXISTS (SELECT 1 FROM json_each(?) required
+      WHERE NOT EXISTS (SELECT 1 FROM cave_tag t WHERE t.claim_id = c.id
+        AND t.key = json_extract(required.value, '$[0]')
+        AND t.value IS json_extract(required.value, '$[1]')))`)
+    params.push(JSON.stringify(pattern.tags.map(tag => [tag.key, tag.value ?? null])))
+  }
+  // Small lists retain direct predicates. Larger lists group the finite set
+  // of SQL predicate shapes and bind each group's operands as JSON rows.
+  const filterGroups = new Map<string, (string | number)[][]>()
+  const addFilter = (sql: string, values: (string | number)[]): void => {
+    if (pattern.filters.length <= 16) {
+      conditions.push(sql)
+      for (const value of values) params.push(value)
     } else {
-      conditions.push('EXISTS (SELECT 1 FROM cave_tag t WHERE t.claim_id = c.id AND t.key = ? AND t.value = ?)')
-      params.push(tag.key, tag.value)
+      let group = filterGroups.get(sql)
+      if (group === undefined) { group = []; filterGroups.set(sql, group) }
+      group.push(values)
     }
   }
   for (const filter of pattern.filters) {
     switch (filter.field) {
       case 'conf':
-        conditions.push(`c.conf ${filter.op} ?`)
-        params.push(filter.value)
+        addFilter(`c.conf ${filter.op} ?`, [filter.value])
         break
       case 'tag':
         if (filter.value === undefined) {
-          conditions.push('EXISTS (SELECT 1 FROM cave_tag t WHERE t.claim_id = c.id AND t.key = ?)')
-          params.push(filter.key)
+          addFilter('EXISTS (SELECT 1 FROM cave_tag t WHERE t.claim_id = c.id AND t.key = ?)', [filter.key])
         } else {
-          conditions.push('EXISTS (SELECT 1 FROM cave_tag t WHERE t.claim_id = c.id AND t.key = ? AND t.value = ?)')
-          params.push(filter.key, filter.value)
+          addFilter('EXISTS (SELECT 1 FROM cave_tag t WHERE t.claim_id = c.id AND t.key = ? AND t.value = ?)', [filter.key, filter.value])
         }
         break
       case 'context':
-        conditions.push('EXISTS (SELECT 1 FROM cave_context x WHERE x.claim_id = c.id AND x.context = ?)')
-        params.push(filter.value)
+        addFilter('EXISTS (SELECT 1 FROM cave_context x WHERE x.claim_id = c.id AND x.context = ?)', [filter.value])
         break
       case 'value':
-        conditions.push(`c.value_num ${filter.op} ?`)
-        params.push(filter.value)
+        addFilter(`c.value_num ${filter.op} ?`, [filter.value])
         if (filter.unit !== undefined) {
-          conditions.push('c.value_unit = ?')
-          params.push(filter.unit)
+          addFilter('c.value_unit = ?', [filter.unit])
         }
         break
       case 'tx': {
         const { lo, hi } = txBounds(filter.value)
         switch (filter.op) {
           case '>':
-            conditions.push('c.tx >= ?')
-            params.push(hi)
+            addFilter('c.tx >= ?', [hi])
             break
           case '>=':
-            conditions.push('c.tx >= ?')
-            params.push(lo)
+            addFilter('c.tx >= ?', [lo])
             break
           case '<':
-            conditions.push('c.tx < ?')
-            params.push(lo)
+            addFilter('c.tx < ?', [lo])
             break
           case '<=':
-            conditions.push('c.tx < ?')
-            params.push(hi)
+            addFilter('c.tx < ?', [hi])
             break
           case '=':
-            conditions.push('(c.tx >= ? AND c.tx < ?)')
-            params.push(lo, hi)
+            addFilter('(c.tx >= ? AND c.tx < ?)', [lo, hi])
             break
           case '!=':
-            conditions.push('(c.tx < ? OR c.tx >= ?)')
-            params.push(lo, hi)
+            addFilter('(c.tx < ? OR c.tx >= ?)', [lo, hi])
             break
         }
         break
@@ -382,6 +416,16 @@ export const compile = (pattern: Pattern.t, registry: Registry.t, options: Optio
     }
   }
 
+  for (const [predicate, values] of filterGroups) {
+    let index = 0
+    // These predicates are compiler-owned SQL; question marks are operands.
+    const bound = predicate.replace(/\?/g, () => `json_extract(required_filter.value, '$[${index++}]')`)
+    // A NULL comparison fails a WHERE requirement too; NOT alone would lose it.
+    conditions.push(`NOT EXISTS (SELECT 1 FROM json_each(?) required_filter
+      WHERE (${bound}) IS NOT TRUE)`)
+    params.push(JSON.stringify(values))
+  }
+
   // Positive patterns match supported beliefs: a retracted (@ 0%) current
   // belief has no current support (§9.3) and is skipped — mirroring the
   // transitive CTE and store traversal — unless the query asks about
@@ -390,15 +434,18 @@ export const compile = (pattern: Pattern.t, registry: Registry.t, options: Optio
     conditions.push('c.conf > 0')
   }
 
-  const base = baseSql(options, policy)
+  // Bounded direct reads benefit from tuple membership instead of joining
+  // wide current rows. Retain both identity columns and the complete historical
+  // source: post-filters must never revive older revisions or retractions.
+  const base = options.limit !== undefined && options.all !== true && options.resolve !== true ?
+    `SELECT c.* FROM cave_claim c WHERE (c.claim_key, c.tx) IN (
+      SELECT claim_key, MAX(tx) FROM ${claimsSql(options.asOf)} GROUP BY claim_key)` :
+    baseSql(options, policy)
   const withClause = aliases ? `WITH RECURSIVE ${aliasPairSql(options.asOf)} ` : ''
   const sql = `${withClause}SELECT c.* FROM (${base}) c WHERE ${conditions.join(' AND ')} ORDER BY c.tx`
   const bind = (row: Record<string, unknown>): Record<string, string> => {
-    const bindings: Record<string, string> = {}
-    for (const [name, columns] of varColumns) {
-      bindings[name] = String(row[columns[0]!])
-    }
-    return bindings
+    return Object.fromEntries([...varColumns].map(([name, columns]) =>
+      [name, String(row[columns[0]!])]))
   }
   const valueVars = [...varColumns]
     .filter(([, columns]) => columns[0] === 'value_text')
@@ -519,14 +566,10 @@ ${aliasedSelect}
 ${conditions.length > 0 ? `WHERE ${conditions.join(' AND ')}` : ''}
 ORDER BY src, dst`
   const bind = (row: Record<string, unknown>): Record<string, string> => {
-    const bindings: Record<string, string> = {}
-    if (subjectSlot.kind === 'var') {
-      bindings[subjectSlot.name] = String(row['src'])
-    }
-    if (objectSlot?.kind === 'var') {
-      bindings[objectSlot.name] = String(row['dst'])
+    return {
+      ...subjectSlot.kind === 'var' ? { [subjectSlot.name]: String(row['src']) } : {},
+      ...objectSlot?.kind === 'var' ? { [objectSlot.name]: String(row['dst']) } : {}
     }
-    return bindings
   }
   return { sql, params, bind, transitive: true, valueVars: [] }
 }
@@ -588,7 +631,7 @@ export type Window = {
   readonly scanned: number
 }
 
-const run = (store: Store, pattern: Pattern.t, options: Options = {}): Window => {
+const run = (store: Store, pattern: Pattern.t, options: Options = {}, positions?: WeakMap<object, number>): Window => {
   const instant = options.at === undefined ? undefined : Time.parseInstant(options.at)
   if (options.at !== undefined && instant === undefined) {
     throw new Error(
@@ -604,6 +647,9 @@ const run = (store: Store, pattern: Pattern.t, options: Options = {}): Window =>
     throw new Error('CAVE-Q: at does not compose with transitive patterns — hop edges are not valid-time filtered (spec §32.4)')
   }
   const rows = store.db.prepare(compiled.sql).all(...compiled.params) as Record<string, unknown>[]
+  // Pagination needs original positions after post-filters discard rows.
+  // Keep this optional so ordinary queries allocate no position index.
+  if (positions !== undefined) rows.forEach((row, index) => positions.set(row, index))
   if (compiled.transitive && options.support === true) {
     // One match per distinct (src, dst) pair, its supporting edge rows
     // attached; under aliases identical binding sets still collapse to
@@ -676,8 +722,8 @@ const run = (store: Store, pattern: Pattern.t, options: Options = {}): Window =>
 }
 
 /** Execute one SQL window and report how many pre-filter rows it consumed. */
-export const window = (store: Store, pattern: Pattern.t, options: Options = {}): Window =>
-  run(store, pattern, options)
+export const window = (store: Store, pattern: Pattern.t, options: Options = {}, positions?: WeakMap<object, number>): Window =>
+  run(store, pattern, options, positions)
 
 export const match = (store: Store, pattern: Pattern.t, options: Options = {}): Match[] =>
   run(store, pattern, options).matches

package/src/page.ts

@@ -2,12 +2,13 @@
 
 import { QuerySql } from '@cavelang/store/adapter'
 import type { Store } from '@cavelang/store/adapter'
-import { Value } from '@cavelang/core'
+import { Uuidv7, Value } from '@cavelang/core'
 import type { Options } from './compile.ts'
 import { queryRecords } from './record.ts'
 import { of as recordOf } from './record.ts'
 import type { t as QueryRecord } from './record.ts'
 import { window } from './bounded.ts'
+import { readSnapshot } from './read-snapshot.ts'
 import * as Pattern from './pattern.ts'
 
 export const format = 'cave.query-page' as const
@@ -29,7 +30,8 @@ export type Page = {
   readonly next?: string
 }
 
-type Cursor = { readonly v: 1, readonly fingerprint: string, readonly snapshot: string, readonly offset: number }
+type Revision = readonly [number, number, number, number]
+type Cursor = { readonly v: 2, readonly fingerprint: string, readonly snapshot: string, readonly offset: number, readonly revision: Revision }
 
 const fingerprint = (input: string, options: PageOptions, limit: number): string => {
   const text = JSON.stringify({
@@ -52,11 +54,13 @@ const encodeCursor = (cursor: Cursor): string => encodeURIComponent(JSON.stringi
 const decodeCursor = (text: string): Cursor => {
   try {
     const value = JSON.parse(decodeURIComponent(text)) as Partial<Cursor>
-    if (value.v !== 1 || typeof value.fingerprint !== 'string' || typeof value.snapshot !== 'string' ||
-        !Number.isInteger(value.offset) || value.offset! < 0) throw new Error('invalid')
+    if (value.v !== 2 || typeof value.fingerprint !== 'string' || typeof value.snapshot !== 'string' ||
+        !Uuidv7.is(value.snapshot) || !Number.isSafeInteger(value.offset) || value.offset! < 0 ||
+        !Array.isArray(value.revision) || value.revision.length !== 4 ||
+        !value.revision.every(entry => Number.isSafeInteger(entry) && entry >= 0)) throw new Error('invalid')
     return value as Cursor
   } catch {
-    throw new Error('CAVE-Q: invalid pagination cursor')
+    throw new Error('CAVE-Q: invalid pagination cursor; restart from the first page')
   }
 }
 
@@ -68,9 +72,44 @@ const snapshotOf = (store: Store, asOf: string | undefined): null | string => {
   return typeof row?.['tx'] === 'string' ? row['tx'] : null
 }
 
+/**
+ * Detect changes to an append-only historical universe, including edges from
+ * future parents attached to old rows. This deliberately covers all touching
+ * lineage, beyond vocabulary alone. One statement reads both sets consistently;
+ * wholly future rows and edges are irrelevant.
+ * Local rowid tails supplement counts and keep the token constant-sized.
+ */
+const revisionOf = (store: Store, snapshot: string): Revision => {
+  const value = store.db.prepare(`
+    SELECT
+      (SELECT COUNT(*) FROM cave_claim WHERE tx <= ?) AS claims,
+      (SELECT COALESCE(MAX(rowid), 0) FROM cave_claim WHERE tx <= ?) AS claim_tail,
+      COUNT(*) AS edges, COALESCE(MAX(e.rowid), 0) AS edge_tail
+    FROM cave_edge e
+    WHERE EXISTS (SELECT 1 FROM cave_claim c WHERE c.id = e.parent_id AND c.tx <= ?)
+       OR EXISTS (SELECT 1 FROM cave_claim c WHERE c.id = e.child_id AND c.tx <= ?)
+  `).get(snapshot, snapshot, snapshot, snapshot) as { claims: number, claim_tail: number, edges: number, edge_tail: number }
+  return [value.claims, value.claim_tail, value.edges, value.edge_tail]
+}
+
+const sameRevision = (a: Revision, b: Revision): boolean => a.every((value, i) => value === b[i])
+const changedSnapshot = (): never => { throw new Error('CAVE-Q: pagination snapshot changed; restart from the first page') }
+
 /** Read one SQL-bounded page frozen at the first page's transaction boundary. */
 export const page = (store: Store, input: string, options: PageOptions = {}): Page => {
-  const limit = options.limit ?? defaultLimit
+  // Read the declared fields once, including inherited/non-enumerable values.
+  // Fingerprinting, snapshot selection and SQL must use the same options even
+  // when the caller supplies accessors whose values can change between reads.
+  options = {
+    all: options.all,
+    aliases: options.aliases,
+    asOf: options.asOf,
+    at: options.at,
+    resolve: options.resolve,
+    limit: options.limit,
+    cursor: options.cursor,
+  }
+  const limit = options.limit === undefined ? defaultLimit : options.limit
   if (!Number.isInteger(limit) || limit < 1 || limit > maxLimit) {
     throw new Error(`CAVE-Q: page limit must be an integer from 1 to ${maxLimit}`)
   }
@@ -80,10 +119,17 @@ export const page = (store: Store, input: string, options: PageOptions = {}): Pa
     throw new Error('CAVE-Q: pagination cursor does not match this query and its options')
   }
   const snapshot = cursor?.snapshot ?? snapshotOf(store, options.asOf)
-  if (snapshot === null) return { format, version, snapshot, matches: [] }
-  const offset = cursor?.offset ?? 0
   const { cursor: _cursor, limit: _limit, ...queryOptions } = options
   const pattern = Pattern.parse(input)
+  if (snapshot === null) {
+    // Use ordinary compilation/validation even when no rows exist at the
+    // requested boundary. A bounded read avoids a separate validation policy.
+    window(store, pattern, { ...queryOptions, limit: 1 })
+    return { format, version, snapshot, matches: [] }
+  }
+  const revision = revisionOf(store, snapshot)
+  if (cursor !== undefined && !sameRevision(cursor.revision, revision)) changedSnapshot()
+  const offset = cursor?.offset ?? 0
   const exactNumeric = pattern.payload.kind === 'attribute' && pattern.payload.value.kind === 'term' &&
     Value.parse(pattern.payload.value.text).kind === 'number'
   let matches: readonly QueryRecord[]
@@ -99,51 +145,63 @@ export const page = (store: Store, input: string, options: PageOptions = {}): Pa
     if (found.length > limit) nextOffset = offset + limit
   } else {
     // Valid-time coverage and exact numeric approximation checks happen
-    // after SQLite returns. Consume one SQL row at a time so a rejected row
-    // advances the cursor while the first match of the next page does not.
-    const found: QueryRecord[] = []
-    let rawOffset = offset
-    let scanned = 0
-    const scanBudget = Math.max(defaultLimit, limit)
-    let exhausted = false
-    while (found.length < limit && scanned < scanBudget) {
-      const result = window(store, pattern, {
-        ...queryOptions,
-        asOf: snapshot,
-        limit: 1,
-        offset: rawOffset,
-      })
-      if (result.scanned === 0) {
-        exhausted = true
-        break
+    // after SQLite returns. Original row positions let a full candidate
+    // batch stop at the last selected match without consuming later rows.
+    matches = readSnapshot(store, () => {
+      const found: QueryRecord[] = []
+      let rawOffset = offset
+      let scanned = 0
+      const scanBudget = Math.max(defaultLimit, limit)
+      let exhausted = false
+      let unread = false
+      while (found.length < limit && scanned < scanBudget) {
+        const positions = new WeakMap<object, number>()
+        const result = window(store, pattern, {
+          ...queryOptions,
+          asOf: snapshot,
+          limit: scanBudget - scanned,
+          offset: rawOffset,
+        }, positions)
+        if (result.scanned === 0) {
+          exhausted = true
+          break
+        }
+        const selected = result.matches.slice(0, limit - found.length)
+        for (const match of selected) found.push(recordOf(store, match))
+        // This path has physical rows: valid-time transitive queries are
+        // rejected, and exact numeric patterns are attribute queries.
+        const consumed = found.length === limit
+          ? positions.get(selected.at(-1)!.row!)! + 1 : result.scanned
+        rawOffset += consumed
+        scanned += consumed
+        unread = consumed < result.scanned
       }
-      if (result.matches.length > 0) {
-        found.push(recordOf(store, result.matches[0]!))
+      if (unread) nextOffset = rawOffset
+      else if (!exhausted) {
+        // A single bounded probe distinguishes a genuinely finished page from
+        // one that filled its match/scan budget. It need not pass post-filters:
+        // the continuation resumes before it and applies them normally.
+        const probe = window(store, pattern, {
+          ...queryOptions,
+          asOf: snapshot,
+          limit: 1,
+          offset: rawOffset,
+        })
+        if (probe.scanned > 0) nextOffset = rawOffset
       }
-      rawOffset += result.scanned
-      scanned += result.scanned
-    }
-    if (!exhausted) {
-      // A single bounded probe distinguishes a genuinely finished page from
-      // one that filled its match/scan budget. It need not pass post-filters:
-      // the continuation resumes before it and applies them normally.
-      const probe = window(store, pattern, {
-        ...queryOptions,
-        asOf: snapshot,
-        limit: 1,
-        offset: rawOffset,
-      })
-      if (probe.scanned > 0) nextOffset = rawOffset
-    }
-    matches = found
+      return found
+    })
   }
+  // No mixed result escapes if a peer or callback changes history while the
+  // page's SQL windows and record projections are being evaluated.
+  if (!sameRevision(revision, revisionOf(store, snapshot))) changedSnapshot()
   return {
     format,
     version,
     snapshot,
     matches,
     ...nextOffset === undefined ? {} : {
-      next: encodeCursor({ v: 1, fingerprint: expected, snapshot, offset: nextOffset })
+      next: encodeCursor({ v: 2, fingerprint: expected, snapshot, offset: nextOffset, revision })
     }
   }
 }