@cleocode/core 2026.10.4 → 2026.10.5

package/dist/store/sync/sealer.js

@@ -48,13 +48,19 @@
 import { createHash } from 'node:crypto';
 import { naturalRowUid } from '../row-identity.js';
 import { BIRTH_FP_COLUMN, rowIdentitySpec, UID_COLUMN } from '../row-identity-registry.js';
-import { captureTableDef, chunkedObject, enc, SECRET_MARKER, } from './capture.js';
+import { loadFrameIntents, subtractApplyIntents } from './apply-intent.js';
+import { captureTableDef, chunkedObject, enc, SECRET_MARKER, syncSetTables, } from './capture.js';
 import { tickClock, withImmediateTransaction } from './clock-store.js';
-import { isSyncFlagOn, UNRELEASED_FLAGS } from './flags.js';
+import { actorOpOf, clearFieldLeaves, localFrontierUpdates, localLeaves, recordFieldLeaves, setFieldFrontiers, } from './field-leave.js';
+import { isSyncFlagOn, legacyStrandRemedy, legacyStrandsCached, UNRELEASED_FLAGS, } from './flags.js';
+import { mergeGroupsOf } from './merge/rules.js';
 import { netTransaction } from './netting.js';
+import { encText, remapCapture, remapPending } from './remap.js';
 import { activeReplica } from './replica.js';
+import { nextFhlc, upsertRowMeta } from './row-meta.js';
 import { hasTable } from './schema.js';
 import { canonicalJson, decodeEnc } from './sealer-values.js';
+import { snapshotRowUndo, undoEnabled } from './sequencing.js';
 import { markSuspect } from './structural.js';
 import { canonicalStoreTimestamp, timestampColumns } from './timestamps.js';
 export { sealBacklog } from './seal-backlog.js';
@@ -120,6 +126,17 @@ class TableContext {
         const row = this.stmt('SELECT bfp AS f FROM _sync_row_meta WHERE tbl = ? AND uid = ?').get(table, uid);
         return row?.f ?? undefined;
     }
+    /**
+     * A natural row's key as row meta recorded it (refs as uids), for a repair
+     * D whose row is gone (T12987).
+     */
+    metaKey(table, uid) {
+        const row = this.stmt('SELECT key_json AS k FROM _sync_row_meta WHERE tbl = ? AND uid = ?').get(table, uid);
+        if (!row?.k)
+            // @sync-invariant none:input-shape a repair D of a natural row without a recorded key is quarantined, never sealed
+            throw new SealInputError(`${table} ${uid}: orphaned natural row has no recorded key`);
+        return JSON.parse(row.k);
+    }
     /** The live row's uid by its local key (the capture's `rk`). */
     uidByKey(table, rk) {
         const def = this.def(table);
@@ -155,6 +172,7 @@ class TableContext {
         }
         // §2.10: every op's table is in the sync set. A capture of any other table
         // holds its group (reported), never aborts the batch (T13029).
+        // @sync-invariant none:input-shape a capture of a table outside the sync set is quarantined, never sealed
         if (d === null)
             throw new SealInputError(`capture for ${table}, which is not in the sync set`);
         return d;
@@ -176,7 +194,29 @@ class TableContext {
         if (key === null || typeof key === 'object')
             return null;
         const row = this.stmt(`SELECT ${q(UID_COLUMN)} AS u FROM ${q(table)} WHERE ${q(keyColumn)} = ?`).get(key);
-        return row?.u ?? null;
+        if (row !== undefined)
+            return row.u ?? null;
+        return this.deletedUid(table, keyColumn, key);
+    }
+    /**
+     * The uid of a row deleted but not yet sealed, from its live D capture
+     * (T13226). An FK action fires while its parent is already gone: a child's
+     * SET NULL or cascaded D refers to the parent by local key, and only the
+     * parent's own D capture (same transaction, so same frame and batch) still
+     * knows its uid. Single-column local keys only; the latest such D wins.
+     */
+    deletedUid(table, keyColumn, key) {
+        if (this.keyColumns(table).length !== 1 || this.keyColumns(table)[0] !== keyColumn)
+            return null;
+        const rk = JSON.stringify([typeof key === 'string' ? encText(key) : String(key)]);
+        const d = this.stmt(`SELECT uid, json_extract(img, '$.${UID_COLUMN}') AS iu FROM _sync_capture
+       WHERE state = 'live' AND tbl = ? AND op = 'D' AND rk = ? ORDER BY seq DESC LIMIT 1`).get(table, rk);
+        if (!d)
+            return null;
+        if (d.uid !== null)
+            return d.uid;
+        const v = d.iu === null ? null : decodeEnc(d.iu);
+        return typeof v === 'string' ? v : null;
     }
     /**
      * The first live delete of (table, rk) after `seq`, if any (T13041). The
@@ -216,6 +256,7 @@ function columnValue(ctx, def, col, raw) {
         return ref ? ctx.uidOf(ref.table, ref.key, local) : local;
     }
     if (typeof raw !== 'string')
+        // @sync-invariant none:input-shape a malformed capture image is quarantined, never sealed
         throw new SealInputError(`${def.table}.${col}: unexpected image value`);
     if (raw === SECRET_MARKER)
         return undefined;
@@ -224,6 +265,7 @@ function columnValue(ctx, def, col, raw) {
         v = decodeEnc(raw);
     }
     catch (err) {
+        // @sync-invariant none:input-shape an undecodable capture value is quarantined, never sealed
         throw new SealInputError(`${def.table}.${col}: ${err.message}`);
     }
     return wireTimestamp(ctx.timestamps(def.table), col, v);
@@ -316,11 +358,47 @@ function resolveBirthFp(ctx, births, table, uid) {
  * may stay NULL here; the netted op is checked afterwards, so a clear-and-
  * refill pair (K x → NULL, K NULL → y) can net to one K first (N8).
  */
-function buildDraft(ctx, c, births) {
+/**
+ * The uid of an I, U or D capture's row (§2.5 step 3): the capture's own,
+ * else the image's `uid`, else the live row's by local key (unless a later
+ * capture deletes that local row: the live row is then a later
+ * incarnation, T13041), else a natural row's uid from its key.
+ */
+function resolveCaptureUid(ctx, c, img, naturalK) {
+    const def = ctx.def(c.tbl);
+    let uid = c.uid;
+    if (uid === null && def.identity.includes(UID_COLUMN)) {
+        const raw = img[UID_COLUMN];
+        if (typeof raw === 'string')
+            uid = str(decodeEnc(raw)) ?? null;
+    }
+    if (uid === null && !ctx.laterDelete(c.tbl, c.rk, c.seq))
+        uid = ctx.uidByKey(c.tbl, c.rk);
+    // A natural row's uid is a function of its key with references as uids
+    // (T12341 §5.3), so a capture taken before the fill still seals. Symmetric
+    // edges need the fill's twin rule and wait for it (the step-0 fill, S3d).
+    if (uid === null && naturalK)
+        uid = ctx.naturalUid(c.tbl, naturalK);
+    return uid;
+}
+/** The uid a capture is matched to apply intents by (a K: the uid before the re-key). */
+function intentUid(ctx, c) {
+    if (c.op === 'K')
+        return c.uid;
+    const img = JSON.parse(c.img);
+    const natural = ctx.minted(c.tbl) ? undefined : naturalKey(ctx, ctx.def(c.tbl), c.rk);
+    return resolveCaptureUid(ctx, c, img, natural);
+}
+function buildDraft(ctx, c, births, repair = false) {
     const def = ctx.def(c.tbl);
     const img = JSON.parse(c.img);
     const minted = ctx.minted(c.tbl);
-    const natural = !minted ? { k: naturalKey(ctx, def, c.rk) } : {};
+    // A repair D of an orphaned meta row (§4.4, T12987) has no live row and no
+    // local key: its image is empty, and a natural row's key comes from meta.
+    const orphan = repair && c.op === 'D' && c.uid !== null && Object.keys(img).length === 0;
+    const natural = minted
+        ? {}
+        : { k: orphan && c.uid !== null ? ctx.metaKey(c.tbl, c.uid) : naturalKey(ctx, def, c.rk) };
     const base = { t: c.tbl, rk: c.rk, seq: c.seq };
     if (c.op === 'K') {
         const pair = (col) => {
@@ -339,23 +417,7 @@ function buildDraft(ctx, c, births) {
             ...natural,
         };
     }
-    let uid = c.uid;
-    if (uid === null && def.identity.includes(UID_COLUMN)) {
-        const raw = img[UID_COLUMN];
-        if (typeof raw === 'string')
-            uid = str(decodeEnc(raw)) ?? null;
-    }
-    // Resolve a missing uid from the live row by its local key (§2.5 step 3),
-    // unless a later capture deletes that local row: the live row is then a
-    // later incarnation, and this one is resolved by the netting or dropped as
-    // dead (T13041).
-    if (uid === null && !ctx.laterDelete(c.tbl, c.rk, c.seq))
-        uid = ctx.uidByKey(c.tbl, c.rk);
-    // A natural row's uid is a function of its key with references as uids
-    // (T12341 §5.3), so a capture taken before the fill still seals. Symmetric
-    // edges need the fill's twin rule and wait for it (the step-0 fill, S3d).
-    if (uid === null && !minted && natural.k)
-        uid = ctx.naturalUid(c.tbl, natural.k);
+    const uid = resolveCaptureUid(ctx, c, img, natural.k);
     switch (c.op) {
         case 'I': {
             // The uid may have come from the live row (the capture predates the
@@ -374,19 +436,35 @@ function buildDraft(ctx, c, births) {
         case 'U': {
             const a = {};
             const b = {};
+            let unknownBefore = false;
             for (const [col, pair] of Object.entries(img)) {
                 if (ctx.refSources(def.table).has(col))
                     continue;
                 const [before, after] = pair;
                 const nv = columnValue(ctx, def, col, after);
-                const ov = columnValue(ctx, def, col, before);
                 if (nv !== undefined)
                     a[col] = nv;
+                // A JSON null before is a repair U's (§4.4, T12987): only the content
+                // hash was kept, so the before-image is unknown. No trigger writes
+                // one: a NULL value is the text 'NULL'.
+                if (before === null && repair) {
+                    unknownBefore = true;
+                    continue;
+                }
+                const ov = columnValue(ctx, def, col, before);
                 if (ov !== undefined)
                     b[col] = ov;
             }
             const bfp = minted ? resolveBirthFp(ctx, births, c.tbl, uid) : undefined;
-            return { ...base, o: 'U', u: uid, ...(bfp ? { bfp } : {}), ...natural, a, b };
+            return {
+                ...base,
+                o: 'U',
+                u: uid,
+                ...(bfp ? { bfp } : {}),
+                ...natural,
+                a,
+                ...(unknownBefore ? { unknownBefore: true } : { b }),
+            };
         }
         case 'D': {
             const bfp = str(columnValue(ctx, def, BIRTH_FP_COLUMN, img[BIRTH_FP_COLUMN] ?? 'NULL')) ??
@@ -416,6 +494,9 @@ function unsealable(ctx, op) {
     }
     return null;
 }
+// ---------------------------------------------------------------------------
+// Row meta, chash, ledger
+// ---------------------------------------------------------------------------
 /**
  * sha256 of a row's canonical WIRE image (§2.7, M6; T13031): the values an I
  * op of the row would carry, so every replica hashes identical bytes. Secret
@@ -428,6 +509,21 @@ function unsealable(ctx, op) {
 export function rowChash(db, scope, def, uid) {
     return chashOf(new TableContext(db, scope), def, uid);
 }
+/**
+ * A {@link SealerRowView} over `db`, valid while its schema does not change.
+ *
+ * @param db - The store.
+ * @param scope - Its scope.
+ */
+export function sealerRowView(db, scope) {
+    const ctx = new TableContext(db, scope);
+    return {
+        chash: (def, uid) => chashOf(ctx, def, uid),
+        naturalKeyJson: (def, rk) => canonicalJson(naturalKey(ctx, def, rk)),
+        liveBirthFp: (table, uid) => ctx.liveBirthFp(table, uid),
+        naturalUid: (def, rk) => ctx.minted(def.table) ? null : ctx.naturalUid(def.table, naturalKey(ctx, def, rk)),
+    };
+}
 function chashOf(ctx, def, uid) {
     const spec = rowIdentitySpec(ctx.scope, def.table);
     const localKey = new Set(spec?.kind === 'minted' ? spec.key : []);
@@ -453,20 +549,6 @@ function chashOf(ctx, def, uid) {
     }
     return createHash('sha256').update(canonicalJson(wire)).digest('hex');
 }
-function nextFhlc(prev, def, changed, h) {
-    if (!prev)
-        return null;
-    const old = prev.fhlc ? JSON.parse(prev.fhlc) : {};
-    const out = {};
-    for (const col of def.columns) {
-        if (def.identity.includes(col) || changed.includes(col))
-            continue;
-        const at = old[col] ?? prev.hlc;
-        if (at < h)
-            out[col] = at;
-    }
-    return Object.keys(out).length > 0 ? canonicalJson(out) : null;
-}
 // ---------------------------------------------------------------------------
 // sealPending
 // ---------------------------------------------------------------------------
@@ -484,6 +566,13 @@ export function sealPreconditions(db, env, allowUnreleased = false) {
     if (UNRELEASED_FLAGS.has('sync.seal') && !allowUnreleased) {
         return 'sync.seal is unreleased until S3b–S3d land (T13032)';
     }
+    // T13224, T13225: a flag persisted before the store's rows were stranded in
+    // the bare family still never seals a view missing them.
+    // Decided once per data_version, not on every batch (T13319).
+    const strands = legacyStrandsCached(db);
+    if (strands.length > 0) {
+        return `legacy-only store: ${legacyStrandRemedy(db, strands)}`;
+    }
     return null;
 }
 /** Where the sealer's transaction counter is persisted (T13033). */
@@ -627,6 +716,151 @@ function waitingEffect(db, tbl, facts) {
     }
     return n;
 }
+/** Write one `_sync_meta` value (the sealer's own bookkeeping keys). */
+function setSealMeta(db, key, value, atIso) {
+    db.prepare('INSERT INTO _sync_meta (key, value, updated_at) VALUES (?, ?, ?) ' +
+        'ON CONFLICT(key) DO UPDATE SET value = excluded.value, updated_at = excluded.updated_at').run(key, value, atIso);
+}
+/** Set once the sealed-but-unsent ops have been made group-whole (T13233). */
+export const LEGACY_GROUPS_KEY = 'sealer.group_whole_v1';
+/** The merge-group members a U image or op carries part of, and lacks. */
+function missingGroupMembers(def, carried) {
+    return mergeGroupsOf(def.table, def.columns).flatMap((g) => g.some((m) => m in carried) ? g.filter((m) => !(m in carried)) : []);
+}
+/** `enc()` of SQL NULL. */
+const ENC_NULL = 'NULL';
+/**
+ * A column's `enc()` value at the time of capture `c`:
+ * - the before-image of the row's next live U capture that recorded it;
+ * - else, at the row's next I or D capture, its image (which omits NULL
+ *   columns, so a member it does not name was NULL, T13235);
+ * - else the live row; a row that no longer exists held NULL.
+ */
+function encAtCapture(ctx, c, col) {
+    const later = ctx
+        .stmt("SELECT op, img FROM _sync_capture WHERE state = 'live' AND tbl = ? AND rk = ? AND seq > ? ORDER BY seq")
+        .all(c.tbl, c.rk, c.seq);
+    for (const l of later) {
+        if (l.op !== 'U' && l.op !== 'I' && l.op !== 'D')
+            continue;
+        const img = JSON.parse(l.img);
+        if (!(col in img)) {
+            if (l.op === 'U')
+                continue;
+            return ENC_NULL;
+        }
+        const raw = img[col];
+        const v = l.op === 'U' && Array.isArray(raw) ? raw[0] : raw;
+        return typeof v === 'string' ? v : ENC_NULL;
+    }
+    if (c.uid === null)
+        return ENC_NULL;
+    const row = ctx
+        .stmt(`SELECT ${enc(q(col))} AS v FROM main.${q(c.tbl)} WHERE ${q(UID_COLUMN)} = ?`)
+        .get(c.uid);
+    return typeof row?.v === 'string' ? row.v : ENC_NULL;
+}
+/**
+ * Complete the merge groups of U captures the pre-T13222 trigger recorded
+ * (changed columns only, T13233): each missing member is added unchanged
+ * (before = after) with its value at the capture, so the sealed op carries
+ * the whole group instead of being refused by every receiver. A capture
+ * from the current trigger always records whole groups and is untouched.
+ */
+function completeLegacyCaptureGroups(ctx, batch) {
+    return batch.map((c) => {
+        if (c.op !== 'U')
+            return c;
+        const img = JSON.parse(c.img);
+        if (mergeGroupsOf(c.tbl, Object.keys(img)).length === 0)
+            return c;
+        const def = ctx.def(c.tbl);
+        const missing = missingGroupMembers(def, img);
+        if (missing.length === 0)
+            return c;
+        for (const m of missing) {
+            const v = encAtCapture(ctx, c, m);
+            img[m] = [v, v];
+        }
+        return { ...c, img: JSON.stringify(img) };
+    });
+}
+/**
+ * Make sealed-but-unsent U ops group-whole once (T13233): ops sealed from
+ * pre-T13222 captures carry part of a merge group. Only `state = 'sealed'`
+ * transactions are rewritten (in place, `_sync_op.body`): segmented ops have
+ * left the device and inherited ones belong to another replica. A missing
+ * member's value at the op is the before-image of the row's next sealed U
+ * that carries it, or of its next D (which omits NULL columns, so an absent
+ * member was NULL), else the live row's; a row that no longer exists held
+ * NULL. Runs once per store ({@link LEGACY_GROUPS_KEY}), set only when every
+ * op came out whole.
+ *
+ * Per-field HLCs: the completed members travel at the op's HLC, while the
+ * origin's row meta keeps their older field HLC. Group LWW decides on the
+ * group's newest HLC, so merges agree; only a per-field HLC comparison (the
+ * repair diff) can see the difference.
+ *
+ * @returns How many ops were completed.
+ */
+function completeLegacySealedGroups(ctx, atIso) {
+    const db = ctx.db;
+    if (db.prepare('SELECT 1 FROM _sync_meta WHERE key = ?').get(LEGACY_GROUPS_KEY))
+        return 0;
+    const rows = db
+        .prepare("SELECT o.txn, o.idx, o.body FROM _sync_op o JOIN _sync_txn t ON t.txn = o.txn WHERE t.state = 'sealed' ORDER BY t.local_seq, o.idx")
+        .all();
+    const ops = rows.map((r) => ({ ...r, op: JSON.parse(r.body) }));
+    let fixed = 0;
+    let incomplete = 0;
+    ops.forEach((r, i) => {
+        if (r.op.o !== 'U' || !r.op.a)
+            return;
+        if (mergeGroupsOf(r.op.t, Object.keys(r.op.a)).length === 0)
+            return;
+        const def = ctx.def(r.op.t);
+        const missing = missingGroupMembers(def, r.op.a);
+        if (missing.length === 0)
+            return;
+        const a = { ...r.op.a };
+        const b = { ...(r.op.b ?? {}) };
+        for (const m of missing) {
+            // The row's next sealed op that tells: a U carrying the member in `b`,
+            // or a D, whose before-image omits NULL columns (T13235).
+            const next = ops
+                .slice(i + 1)
+                .find((x) => x.op.t === r.op.t &&
+                x.op.u === r.op.u &&
+                (x.op.o === 'D' || (x.op.o === 'U' && x.op.b !== undefined && m in x.op.b)));
+            let v;
+            if (next) {
+                v = next.op.b?.[m] ?? null;
+            }
+            else {
+                const row = ctx
+                    .stmt(`SELECT ${enc(q(m))} AS v FROM main.${q(r.op.t)} WHERE ${q(UID_COLUMN)} = ?`)
+                    .get(r.op.u);
+                // A row that no longer exists held NULL.
+                v = typeof row?.v === 'string' ? columnValue(ctx, def, m, row.v) : null;
+            }
+            if (v === undefined) {
+                incomplete += 1; // a secret member: never sealed whole by this pass
+                continue;
+            }
+            a[m] = v;
+            b[m] = v;
+        }
+        const body = canonicalJson({ ...r.op, a, b });
+        db.prepare('UPDATE _sync_op SET body = ? WHERE txn = ? AND idx = ?').run(body, r.txn, r.idx);
+        r.op = { ...r.op, a, b };
+        fixed += 1;
+    });
+    // Marked done only when every op is whole: an op left partial is retried
+    // on the next seal, never pushed as if the pass had covered it.
+    if (incomplete === 0)
+        setSealMeta(db, LEGACY_GROUPS_KEY, String(fixed), atIso);
+    return fixed;
+}
 function sealInTransaction(db, opts, budget, now) {
     const ctx = new TableContext(db, opts.scope);
     const started = performance.now();
@@ -638,6 +872,8 @@ function sealInTransaction(db, opts, budget, now) {
     let batch = db
         .prepare(`SELECT ${CAPTURE_COLS} FROM _sync_capture WHERE state = 'live' ORDER BY seq LIMIT ?`)
         .all(budget);
+    // T13233: ops sealed from pre-T13222 captures become group-whole, once.
+    completeLegacySealedGroups(ctx, new Date(now()).toISOString());
     if (batch.length === 0)
         return emptyReport(null);
     const lastFrame = batch[batch.length - 1]?.frame ?? null;
@@ -652,6 +888,7 @@ function sealInTransaction(db, opts, budget, now) {
             batch = batch.filter((c) => c.frame !== lastFrame);
         }
     }
+    batch = completeLegacyCaptureGroups(ctx, batch);
     const births = batchBirths(batch);
     // 2. Group: a validated frame is one transaction; anything else a singleton.
     const frames = new Map();
@@ -678,12 +915,6 @@ function sealInTransaction(db, opts, budget, now) {
     // 3–5. Seal each group, in order.
     const meta = {
         get: db.prepare('SELECT hlc, fhlc, version, deleted, key_json, chash, bfp FROM _sync_row_meta WHERE tbl = ? AND uid = ?'),
-        upsert: db.prepare(`INSERT INTO _sync_row_meta (tbl, uid, hlc, fhlc, origin, actor, version, deleted, key_json, chash, bfp)
-       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-       ON CONFLICT (tbl, uid) DO UPDATE SET hlc = excluded.hlc, fhlc = excluded.fhlc,
-         origin = excluded.origin, actor = excluded.actor, version = excluded.version,
-         deleted = excluded.deleted, key_json = coalesce(excluded.key_json, key_json),
-         chash = excluded.chash, bfp = coalesce(excluded.bfp, bfp)`),
         remove: db.prepare('DELETE FROM _sync_row_meta WHERE tbl = ? AND uid = ?'),
         // A re-key moves the row's meta and keeps hlc, fhlc, version and chash
         // (§2.5 step 5, T13031); only the key and birth_fp follow the new uid.
@@ -707,6 +938,10 @@ function sealInTransaction(db, opts, budget, now) {
     const pending = [];
     const touched = new Map();
     const ledgerDelta = new Map();
+    const leaveTable = hasTable(db, '_sync_field_leave');
+    // §3.5 Rule 2 (T13193): while undo is on, each sealed op snapshots its
+    // row's prior merge state, so a rebase rewind restores HLCs with values.
+    const rowUndo = hasTable(db, '_sync_row_undo') && undoEnabled(db);
     const metaFacts = {
         sent: (t, u) => meta.flags.get(t, u)?.sent === 1,
         live: (t, u) => meta.flags.get(t, u)?.deleted === 0,
@@ -720,7 +955,7 @@ function sealInTransaction(db, opts, budget, now) {
     const pointedAt = new Map();
     let dropped = 0;
     const quarantined = [];
-    for (const g of groups) {
+    for (const [gi, g] of groups.entries()) {
         // Bound the time this transaction holds the write lock (T13032).
         if (txns > 0 && performance.now() - started > maxMs)
             break;
@@ -737,24 +972,44 @@ function sealInTransaction(db, opts, budget, now) {
             dead.add(c.seq);
             consumed.add(c.seq);
         }
-        const captures = g.captures
+        let captures = g.captures
             .filter((c) => !dead.has(c.seq))
             .map((c) => (pointedAt.has(c.seq) ? { ...c, uid: pointedAt.get(c.seq) ?? null } : c));
         if (captures.length === 0)
             continue;
         const head = captures[0]?.seq ?? 0;
-        if (g.frame !== null && (g.kind === 'apply' || g.kind === 'rebase')) {
-            // §3.3: an apply or rebase frame is sealed only after its apply intents
-            // are subtracted, which is S5. Until then it waits (T13037).
-            pending.push({ firstSeq: head, reason: `${g.kind} frames wait for S5 intent subtraction` });
+        if (g.frame !== null && g.kind === 'rebase') {
+            // A rebase frame replays rewound local ops (§3.5); it seals with S5's
+            // scoped rebase (T13037).
+            pending.push({ firstSeq: head, reason: 'rebase frames wait for the S5 scoped rebase' });
             break;
         }
+        if (g.frame !== null && g.kind === 'apply') {
+            // §3.3 (T12757): subtract what the apply wrote; only residual fields
+            // seal, as local writes. A removed capture is consumed: the applied row
+            // exists, so the ledger counts it and its chash is refreshed.
+            const sub = subtractApplyIntents(captures, loadFrameIntents(db, g.frame), (c) => intentUid(ctx, c));
+            for (const c of sub.removed) {
+                consumed.add(c.seq);
+                const uid = intentUid(ctx, c);
+                if (c.op === 'I')
+                    ledgerDelta.set(c.tbl, (ledgerDelta.get(c.tbl) ?? 0) + 1);
+                if (c.op === 'D')
+                    ledgerDelta.set(c.tbl, (ledgerDelta.get(c.tbl) ?? 0) - 1);
+                if (uid !== null && (c.op === 'I' || c.op === 'U')) {
+                    touched.set(rowKey(c.tbl, uid), { tbl: c.tbl, uid, rk: c.rk });
+                }
+            }
+            captures = sub.residual;
+            if (captures.length === 0)
+                continue;
+        }
         const capOf = new Map(captures.map((c) => [c.seq, c]));
         let drafts = [];
         let partial = false;
         for (const c of captures) {
             try {
-                drafts.push(buildDraft(ctx, c, births));
+                drafts.push(buildDraft(ctx, c, births, g.kind === 'repair'));
             }
             catch (err) {
                 if (!(err instanceof SealInputError))
@@ -797,15 +1052,46 @@ function sealInTransaction(db, opts, budget, now) {
             meta.remove.run(r.t, r.to);
             meta.move.run(r.to, null, null, r.t, r.from);
         }
+        // §3.3 G (T12779): the stream never learns a dropped re-key's old uid, so
+        // every reference to it that is still pending moves to the new uid: the
+        // other ops of this transaction, the captures still waiting (in this
+        // batch and in the store), and sealed ops not yet in a segment.
+        let txnOps = netted.ops;
+        if (netted.renames.length > 0) {
+            const renamed = new Map(netted.renames.map((r) => [r.from, r.to]));
+            const swap = (vals) => {
+                const out = {};
+                for (const [col, v] of Object.entries(vals)) {
+                    const to = typeof v === 'string' ? renamed.get(v) : undefined;
+                    out[col] = to !== undefined ? to : v;
+                }
+                return out;
+            };
+            txnOps = txnOps.map((op) => ({
+                ...op,
+                ...(op.a !== undefined ? { a: swap(op.a) } : {}),
+                ...(op.b !== undefined ? { b: swap(op.b) } : {}),
+                ...(op.k !== undefined ? { k: swap(op.k) } : {}),
+            }));
+            for (const r of netted.renames) {
+                const remap = { table: r.t, oldUid: r.from, newUid: r.to, newBfp: null };
+                remapPending(db, remap);
+                for (const later of groups.slice(gi + 1)) {
+                    later.captures.forEach((c, i) => {
+                        later.captures[i] = remapCapture(c, remap);
+                    });
+                }
+            }
+        }
         for (const c of captures)
             consumed.add(c.seq);
-        if (netted.ops.length === 0)
+        if (txnOps.length === 0)
             continue; // everything netted away
         localSeq += 1;
         const txn = `${replica}:${localSeq}`;
         // An op's time and local key are its LAST capture's (T13037).
         const at = (op) => capOf.get(op.last) ?? capOf.get(op.seq);
-        const sealedOps = netted.ops.map((op) => {
+        const sealedOps = txnOps.map((op) => {
             const { seq, last, ...rest } = op;
             return {
                 ...rest,
@@ -816,12 +1102,14 @@ function sealInTransaction(db, opts, budget, now) {
         });
         const txnHlc = sealedOps.reduce((m, o) => (o.h > m ? o.h : m), sealedOps[0]?.h ?? '');
         const kind = g.frame !== null && TXN_KINDS.has(g.kind) ? g.kind : 'write';
-        insTxn.run(txn, localSeq, replica, txnHlc, opts.scope, g.frame === null ? 'foreign' : 'accessor', kind, g.actor, g.frame, g.frame === null ? 1 : 0, partial ? 1 : 0, sealedOps.length, now());
+        insTxn.run(txn, localSeq, replica, txnHlc, opts.scope, g.frame === null ? 'foreign' : g.kind === 'repair' ? 'repair' : 'accessor', kind, g.actor, g.frame, g.frame === null ? 1 : 0, partial ? 1 : 0, sealedOps.length, now());
         sealedOps.forEach(({ seq, last, ...op }, i) => {
             const rk = at({ seq, last })?.rk ?? '';
             insOp.run(txn, i, op.t, op.u, op.o, op.h, canonicalJson(op));
             const def = ctx.def(op.t);
             const prev = meta.get.get(op.t, op.u);
+            if (rowUndo)
+                snapshotRowUndo(db, txn, i, op.t, op.u);
             const keyJson = op.k ? canonicalJson(op.k) : null;
             if (op.o === 'K' && op.nu !== undefined) {
                 // A K that keeps its uid changes only birth_fp: its meta stays put.
@@ -831,7 +1119,19 @@ function sealInTransaction(db, opts, budget, now) {
                     meta.move.run(op.nu, keyJson, op.bfp ?? null, op.t, op.u);
                 }
                 else {
-                    meta.upsert.run(op.t, op.nu, op.h, null, replica, g.actor, 1, 0, keyJson, null, op.bfp ?? null);
+                    upsertRowMeta(db, {
+                        tbl: op.t,
+                        uid: op.nu,
+                        hlc: op.h,
+                        fhlc: null,
+                        origin: replica,
+                        actor: g.actor,
+                        version: 1,
+                        deleted: false,
+                        keyJson,
+                        chash: null,
+                        bfp: op.bfp ?? null,
+                    });
                 }
                 touched.delete(rowKey(op.t, op.u));
                 touched.set(rowKey(op.t, op.nu), { tbl: op.t, uid: op.nu, rk });
@@ -847,7 +1147,28 @@ function sealInTransaction(db, opts, budget, now) {
             }
             const changed = op.o === 'U' ? Object.keys(op.a ?? {}) : [];
             const fhlc = op.o === 'U' ? nextFhlc(prev, def, changed, op.h) : null;
-            meta.upsert.run(op.t, op.u, op.h, fhlc, replica, g.actor, (prev?.version ?? 0) + 1, op.o === 'D' ? 1 : 0, keyJson, op.o === 'D' ? (prev?.chash ?? null) : null, op.bfp ?? null);
+            upsertRowMeta(db, {
+                tbl: op.t,
+                uid: op.u,
+                hlc: op.h,
+                fhlc,
+                origin: replica,
+                actor: g.actor,
+                version: (prev?.version ?? 0) + 1,
+                deleted: op.o === 'D',
+                keyJson,
+                chash: op.o === 'D' ? (prev?.chash ?? null) : null,
+                bfp: op.bfp ?? null,
+            });
+            // Explicit leaves of absorbing states, which the merge reads (T12344).
+            if (leaveTable && op.o === 'U') {
+                const leaves = localLeaves(op.t, op, actorOpOf(g.actor));
+                recordFieldLeaves(db, op.t, op.u, leaves);
+                // A local rank-max write joins the stored frontier (T13232).
+                setFieldFrontiers(db, op.t, op.u, localFrontierUpdates(db, op.t, op.u, op, leaves));
+            }
+            if (leaveTable && op.o === 'D')
+                clearFieldLeaves(db, op.t, op.u);
             if (op.o === 'I')
                 ledgerDelta.set(op.t, (ledgerDelta.get(op.t) ?? 0) + 1);
             if (op.o === 'D')
@@ -863,14 +1184,17 @@ function sealInTransaction(db, opts, budget, now) {
             unframed += 1;
     }
     if (localSeq !== firstSeq) {
-        db.prepare('INSERT INTO _sync_meta (key, value, updated_at) VALUES (?, ?, ?) ' +
-            'ON CONFLICT(key) DO UPDATE SET value = excluded.value, updated_at = excluded.updated_at').run(SEAL_COUNTER_KEY, String(localSeq), new Date(now()).toISOString());
+        setSealMeta(db, SEAL_COUNTER_KEY, String(localSeq), new Date(now()).toISOString());
     }
     // Consume the sealed captures (and frames nothing references any more).
     const del = db.prepare('DELETE FROM _sync_capture WHERE seq = ?');
     for (const seq of consumed)
         del.run(seq);
     db.exec("DELETE FROM _sync_frame WHERE NOT EXISTS (SELECT 1 FROM _sync_capture c WHERE c.frame = _sync_frame.frame AND c.state = 'live')");
+    // A frame's apply intents go with it (§3.3, T12757).
+    if (hasTable(db, '_sync_apply_intent')) {
+        db.exec('DELETE FROM _sync_apply_intent WHERE NOT EXISTS (SELECT 1 FROM _sync_frame f WHERE f.frame = _sync_apply_intent.frame)');
+    }
     // chash from the live row, once no live capture of that row remains.
     const stillLive = db.prepare("SELECT 1 FROM _sync_capture WHERE tbl = ? AND rk = ? AND state = 'live' LIMIT 1");
     const setChash = db.prepare('UPDATE _sync_row_meta SET chash = ? WHERE tbl = ? AND uid = ?');
@@ -903,4 +1227,154 @@ function sealInTransaction(db, opts, budget, now) {
         refused: null,
     };
 }
+/** `_sync_meta` key of the sync-set version the row-meta `chash` baseline matches (§2.3a rule 3). */
+export const CHASH_BASELINE_KEY = 'sync.set_version';
+/**
+ * The sync set's version: a hash of every sync-set table's captured columns,
+ * secret columns and references as this store's schema has them (§2.3a,
+ * §2.9). A migration that changes what is captured changes it.
+ *
+ * @param db - The store.
+ * @param scope - Its scope.
+ */
+export function syncSetVersion(db, scope) {
+    const shape = syncSetTables(scope)
+        .sort()
+        .map((table) => {
+        const def = hasTable(db, table) ? captureTableDef(db, scope, table) : undefined;
+        if (!def)
+            return [table, null];
+        return [
+            table,
+            {
+                columns: [...def.columns],
+                secret: [...def.secret].sort(),
+                refs: [...def.refs].map(([col, r]) => [col, r.table, r.key]).sort(),
+            },
+        ];
+    });
+    return createHash('sha256').update(canonicalJson(shape)).digest('hex').slice(0, 32);
+}
+const metaKey = (tbl, uid) => `${tbl}\u0000${uid}`;
+function totalChanges(db) {
+    return db.prepare('SELECT total_changes() AS n').get().n;
+}
+function suspectTables(db) {
+    return new Set(db.prepare("SELECT key FROM _sync_meta WHERE key LIKE 'suspect:%'").all().map((r) => r.key.slice('suspect:'.length)));
+}
+/**
+ * Before a migration pass: which live rows are in baseline (`chash` equals the
+ * live hash under the current schema), and which tables already diverge. Only
+ * in-baseline rows may be re-baselined afterwards; a divergence is an
+ * uncaptured edit the repair diff (S3d) must still see (§2.3a rule 3,
+ * NEW-8).
+ *
+ * @param db - The store, before its first pending migration.
+ * @param scope - Its scope.
+ */
+export function chashBaselineSnapshot(db, scope) {
+    const version = syncSetVersion(db, scope);
+    if (!hasTable(db, '_sync_row_meta') || !hasTable(db, '_sync_meta')) {
+        return {
+            inBaseline: new Set(),
+            divergent: new Set(),
+            suspect: new Set(),
+            changes: totalChanges(db),
+            version,
+        };
+    }
+    const ctx = new TableContext(db, scope);
+    const syncSet = new Set(syncSetTables(scope).filter((t) => hasTable(db, t)));
+    const inBaseline = new Set();
+    const divergent = new Set();
+    // A row with a live capture differs because of a captured edit the sealer
+    // will hash: neither in baseline nor an uncaptured divergence.
+    const liveCapture = hasTable(db, '_sync_capture')
+        ? db.prepare("SELECT 1 FROM _sync_capture WHERE state = 'live' AND tbl = ? AND uid = ? LIMIT 1")
+        : null;
+    for (const m of db
+        .prepare('SELECT tbl, uid, chash FROM _sync_row_meta WHERE deleted = 0')
+        .all()) {
+        if (!syncSet.has(m.tbl))
+            continue;
+        if (liveCapture?.get(m.tbl, m.uid))
+            continue;
+        const def = captureTableDef(db, scope, m.tbl);
+        if (!def)
+            continue;
+        if (chashOf(ctx, def, m.uid) === m.chash)
+            inBaseline.add(metaKey(m.tbl, m.uid));
+        else
+            divergent.add(m.tbl);
+    }
+    return { inBaseline, divergent, suspect: suspectTables(db), changes: totalChanges(db), version };
+}
+/**
+ * Re-baseline `_sync_row_meta.chash` after a migration, emitting nothing
+ * (§2.3a rule 3; B, T12775). A migration's backfill is deterministic and
+ * every replica runs it itself, so its changes must not travel; but the row
+ * meta's content hash would otherwise make the repair diff read every migrated
+ * row as an uncaptured edit.
+ *
+ * Only rows that were in baseline before the pass ({@link ChashSnapshot}) move
+ * to the live hash. A row that already diverged keeps its `chash`, and its
+ * table is marked `suspect:` so the repair diff still emits the edit. A table
+ * already suspect, and a row with a live capture (the sealer will hash it),
+ * are left alone. Live rows only: a tombstone keeps the hash it was deleted
+ * with. When the migration changed no row and the sync-set version did not
+ * move, nothing is re-hashed. Records {@link CHASH_BASELINE_KEY}.
+ *
+ * Runs in the caller's transaction when there is one: the migration bracket
+ * calls it before its COMMIT, so a migration and its re-baseline commit or
+ * roll back together. Otherwise it opens its own `BEGIN IMMEDIATE`.
+ *
+ * @param db - The store.
+ * @param scope - Its scope.
+ * @param snapshot - From {@link chashBaselineSnapshot} before the pass, or the
+ *   previous re-baseline's `snapshot`.
+ */
+export function rebaselineChash(db, scope, snapshot) {
+    const version = syncSetVersion(db, scope);
+    const changes = totalChanges(db);
+    const unchanged = changes === snapshot.changes && version === snapshot.version;
+    if (unchanged || !hasTable(db, '_sync_row_meta') || !hasTable(db, '_sync_meta')) {
+        return { rows: 0, version, snapshot: { ...snapshot, changes, version } };
+    }
+    // Inside the migration's own transaction (the bracket calls it before
+    // COMMIT), so a migration and its re-baseline commit or roll back together.
+    const inTxn = db.isTransaction;
+    const run = (fn) => (inTxn ? fn() : withImmediateTransaction(db, fn));
+    return run(() => {
+        const ctx = new TableContext(db, scope);
+        const skip = new Set([...snapshot.suspect, ...suspectTables(db)]);
+        markSuspect(db, scope, [...snapshot.divergent].filter((t) => !skip.has(t)));
+        const liveCapture = hasTable(db, '_sync_capture')
+            ? db.prepare("SELECT 1 FROM _sync_capture WHERE state = 'live' AND tbl = ? AND uid = ? LIMIT 1")
+            : null;
+        const setChash = db.prepare('UPDATE _sync_row_meta SET chash = ? WHERE tbl = ? AND uid = ?');
+        let rows = 0;
+        for (const m of db
+            .prepare('SELECT tbl, uid, chash FROM _sync_row_meta WHERE deleted = 0')
+            .all()) {
+            if (!snapshot.inBaseline.has(metaKey(m.tbl, m.uid)) || skip.has(m.tbl))
+                continue;
+            if (liveCapture?.get(m.tbl, m.uid))
+                continue;
+            const def = captureTableDef(db, scope, m.tbl);
+            if (!def)
+                continue;
+            const next = chashOf(ctx, def, m.uid);
+            if (next === m.chash)
+                continue;
+            setChash.run(next, m.tbl, m.uid);
+            rows += 1;
+        }
+        setSealMeta(db, CHASH_BASELINE_KEY, version, new Date().toISOString());
+        return {
+            rows,
+            version,
+            snapshot: { ...snapshot, suspect: suspectTables(db), changes: totalChanges(db), version },
+        };
+    });
+}
 //# sourceMappingURL=sealer.js.map