@homie-rocks/studio 0.46.0 → 0.46.3

package/worker/saves-shell.mjs

@@ -321,6 +321,25 @@ export const SAVES_SHELL_JS = `${PASSKEY_JS}
     });
   }
 
+  /**
+   * This browser's guest signed in to an account that had some of the same keys with other values, and no rule of
+   * the game's combined them on the server (mergeSaves): the account's stayed, and the sign-in answered with the
+   * guest's. Each is an ordinary conflict, the guest's value (mine) against the account's (theirs), so a game with
+   * onConflict keeps or merges it. Never a server: key: a browser cannot write one.
+   */
+  function keptByAccount(adopted, guestCopy) {
+    var asked = [];
+    ((adopted && adopted.kept) || []).forEach(function (k) {
+      var key = String(k.key);
+      if (k.game !== GAME || key.indexOf('server:') === 0 || !KEY.test(key)) return;
+      var mine = k.value !== undefined ? k.value : guestCopy[key];
+      if (mine === undefined || mine === null) return;
+      var c = S.cache[key];
+      asked.push(resolve(key, { op: 'set', v: mine }, { value: c ? c.v : null, version: c ? c.ver : 0 }, false));
+    });
+    if (asked.length) Promise.all(asked).then(function () { flush(); });
+  }
+
   addEventListener('online', function () { online(true); S.backoff = 0; flush(); });
   addEventListener('offline', function () { online(false); });
   document.addEventListener('visibilitychange', function () { if (document.visibilityState === 'hidden') flush(true); });
@@ -385,9 +404,10 @@ export const SAVES_SHELL_JS = `${PASSKEY_JS}
     };
     inn.onclick = function () {
       busy(true); said.className = 'said'; said.textContent = 'Follow your device…';
-      flush().then(function () { return P.signIn(); }).then(function (r) {
+      var guestCopy = {};
+      flush().then(function () { guestCopy = snapshot(); return P.signIn(); }).then(function (r) {
         setPlayer({ id: r.player.id, name: r.player.name, guest: false, owner: r.player.owner }, false);
-        return refresh().then(function () { tell('player', { player: me(), cache: snapshot() }); close(); });
+        return refresh().then(function () { tell('player', { player: me(), cache: snapshot() }); close(); keptByAccount(r.adopted, guestCopy); });
       }).catch(function (e) { said.className = 'said bad'; said.textContent = e && e.name ? P.said(e) : (e && e.message) || 'That did not work.'; busy(false); P.prime('in', '/api/player/signin/options'); });
     };
   }

package/worker/saves.mjs

@@ -13,6 +13,10 @@
  * `homie-studio storage add`) a value up to 1 MiB goes to R2 instead (4 MiB a game per player), under a random
  * object key that the public /media/ route refuses. Keys are 1 to 64 of A-Z a-z 0-9 _ . : -.
  * A write is atomic per key, not across keys: keep a character in ONE key.
+ *
+ * A GUEST WHO SIGNS IN to an account that already has saves loses nothing: adoptGuest combines a key both have by
+ * the game's declared rules (mergeSaves), in the sign-in's one transaction, and a room's record that lands late for
+ * the guest's id follows them (appendServerRecord). Two rows under game '' are that bookkeeping, nobody's save.
  */
 import { randomToken } from './webauthn.mjs';
 
@@ -234,7 +238,7 @@ export async function fallenList(env, game, { limit = 20, player = null } = {})
 
 /** Everything this player has in every game, for their export (values included, large ones from R2). */
 export async function playerData(env, player) {
-  const rows = (await env.DB.prepare('SELECT game, key, value, bytes, version, updated_at, blob FROM saves WHERE player = ?1 ORDER BY game, key').bind(player).all()).results ?? [];
+  const rows = (await env.DB.prepare("SELECT game, key, value, bytes, version, updated_at, blob FROM saves WHERE player = ?1 AND game != '' ORDER BY game, key").bind(player).all()).results ?? [];
   const stats = (await env.DB.prepare('SELECT game, name, n, updated_at FROM player_stats WHERE player = ?1 ORDER BY game, name').bind(player).all()).results ?? [];
   const mem = (await env.DB.prepare('SELECT game, character, player_name, summary, at FROM memorials WHERE player = ?1 ORDER BY at').bind(player).all()).results ?? [];
   const games = {};
@@ -255,54 +259,313 @@ export async function playerData(env, player) {
 
 /** Per game: keys, bytes and the last write, for the owner's view of a player (never the values). */
 export async function savesSummary(env, player) {
-  const rows = (await env.DB.prepare('SELECT game, COUNT(*) AS keys, SUM(bytes) AS bytes, MAX(updated_at) AS at FROM saves WHERE player = ?1 GROUP BY game').bind(player).all()).results ?? [];
+  const rows = (await env.DB.prepare("SELECT game, COUNT(*) AS keys, SUM(bytes) AS bytes, MAX(updated_at) AS at FROM saves WHERE player = ?1 AND game != '' GROUP BY game").bind(player).all()).results ?? [];
   return rows.map((r) => ({ game: r.game, keys: Number(r.keys), bytes: Number(r.bytes) || 0, updatedAt: Number(r.at) || null }));
 }
 
-/** The statements that delete a player's saves, stats and memorials (and their large saves' objects, after). */
+/**
+ * The statements that delete a player's saves, stats and memorials (and their large saves' objects, after). The
+ * forwarding rows of the guests this account once adopted go too, found by the account's own `server:from:` rows,
+ * so no row is left pointing at a player who is gone.
+ */
 export async function dropPlayerData(env, player) {
-  const blobs = (await env.DB.prepare('SELECT value, blob FROM saves WHERE player = ?1 AND blob = 1').bind(player).all()).results ?? [];
+  const rows = (await env.DB.prepare("SELECT game, key, value, blob FROM saves WHERE player = ?1 AND (blob = 1 OR game = '')").bind(player).all()).results ?? [];
+  const guests = rows.filter((r) => r.game === '' && String(r.key).startsWith(FROM_KEY)).map((r) => String(r.key).slice(FROM_KEY.length));
+  const moved = [];
+  for (let i = 0; i < guests.length; i += 50) {
+    const ids = guests.slice(i, i + 50);
+    moved.push(env.DB.prepare(`DELETE FROM saves WHERE game = '' AND key = '${MOVED_KEY}' AND player IN (${ids.map((_, n) => `?${n + 1}`).join(', ')})`).bind(...ids));
+  }
   return {
     statements: [
       env.DB.prepare('DELETE FROM saves WHERE player = ?1').bind(player),
       env.DB.prepare('DELETE FROM player_stats WHERE player = ?1').bind(player),
       env.DB.prepare('DELETE FROM memorials WHERE player = ?1').bind(player),
+      ...moved,
     ],
-    after: () => dropBlobs(env, blobs.map(blobKey)),
+    after: () => dropBlobs(env, rows.map(blobKey)),
+  };
+}
+
+/* ------------------------------------------------------------------ a guest signs in to their account */
+
+/** Where an adopted guest went: saves row (guest, '', 'server:moved') = {"to": account, "at": ms}. */
+const MOVED_KEY = 'server:moved';
+/** The way back, kept with the account so deleting it finds those rows by key: (account, '', 'server:from:<guest>'). */
+const FROM_KEY = 'server:from:';
+/** What the guard's deliberate SQLite error is recognised by (json_extract of text that is not JSON). */
+const CHANGED = /malformed JSON/i;
+const ADOPT_TRIES = 4;
+const KEPT_BYTES = 256 * 1024;
+/** The shape appendServerRecord itself writes: { matches: [{ id, endedAt, … }] }, newest 100. */
+const RECORDS = Object.freeze({ rule: 'union', union: 'matches', by: 'id', order: 'endedAt', keep: 100 });
+const SAVE_RULES = ['account', 'guest', 'newer', 'larger', 'smaller', 'sum', 'union'];
+const STAT_RULES = ['account', 'guest', 'larger', 'smaller', 'sum'];
+const STAT_SQL = { sum: 'player_stats.n + excluded.n', larger: 'max(player_stats.n, excluded.n)', smaller: 'min(player_stats.n, excluded.n)', guest: 'excluded.n' };
+
+/** game id → { saves, stats }, each { exact: Map, prefix: [[prefix, rule]] longest first }. */
+const merges = new Map();
+
+function ruleOf(raw, where, stat) {
+  if (typeof raw === 'function' && !stat) return { rule: 'function', fn: raw };
+  if (typeof raw === 'string' && (stat ? STAT_RULES : SAVE_RULES).includes(raw)) return raw === 'union' ? RECORDS : { rule: raw };
+  if (!stat && raw && typeof raw === 'object') {
+    if (typeof raw.union === 'string' && raw.union) return { rule: 'union', union: raw.union, by: typeof raw.by === 'string' && raw.by ? raw.by : 'id', order: typeof raw.order === 'string' && raw.order ? raw.order : null, keep: Number.isInteger(raw.keep) && raw.keep > 0 ? raw.keep : null };
+    if ((raw.rule === 'larger' || raw.rule === 'smaller') && typeof raw.by === 'string' && raw.by) return { rule: raw.rule, by: raw.by };
+    if (typeof raw.rule === 'string' && SAVE_RULES.includes(raw.rule)) return ruleOf(raw.rule, where, stat);
+  }
+  throw new Error(`mergeSaves: ${where} is not a rule (${(stat ? STAT_RULES : [...SAVE_RULES, '{ union, by, order, keep }', '{ rule, by }', 'a function']).join(', ')})`);
+}
+
+function patternsOf(obj, where, stat) {
+  const exact = new Map(); const prefix = [];
+  if (obj && typeof obj === 'object') for (const [name, raw] of Object.entries(obj)) {
+    const rule = ruleOf(raw, `${where}['${name}']`, stat);
+    if (name.endsWith('*')) prefix.push([name.slice(0, -1), rule]); else exact.set(name, rule);
+  }
+  prefix.sort((a, b) => b[0].length - a[0].length);
+  return { exact, prefix };
+}
+
+/** The rule for one key or stat: its exact name first, then the longest `prefix*` that fits. */
+const ruleFor = (set, name) => (set ? set.exact.get(name) ?? set.prefix.find(([p]) => name.startsWith(p))?.[1] ?? null : null);
+
+/**
+ * How a guest's saves and stats combine with the account's when the guest signs in to an account that already has
+ * the same key (saves/SAVES.md, "When a guest signs in to their account"). The studio's Worker calls it once, at
+ * load:
+ *
+ *   import { mergeSaves } from '@homie-rocks/studio/worker';
+ *   mergeSaves({ '<game id>': { saves: { '<key or prefix*>': rule }, stats: { '<name or prefix*>': rule } } });
+ *
+ * A save rule is 'account', 'guest', 'newer', 'larger', 'smaller', 'sum', 'union', { rule: 'larger' | 'smaller', by },
+ * { union, by, order, keep } or a function (guest, account, ctx) => value. A stat rule is 'account', 'guest',
+ * 'larger', 'smaller' or 'sum'. A rule that is none of these throws here, naming it, so a typing mistake never
+ * turns into a lost save later. Returns the number of games.
+ */
+export function mergeSaves(table) {
+  merges.clear();
+  if (!table || typeof table !== 'object') return 0;
+  for (const [game, entry] of Object.entries(table)) {
+    if (!entry || typeof entry !== 'object') continue;
+    merges.set(game, { saves: patternsOf(entry.saves, `${game}.saves`, false), stats: patternsOf(entry.stats, `${game}.stats`, true) });
+  }
+  return merges.size;
+}
+
+const isObject = (v) => v !== null && typeof v === 'object' && !Array.isArray(v);
+const isNumber = (v) => typeof v === 'number' && Number.isFinite(v);
+/** Newest first, then by id: the order of a server record's list (appendServerRecord and a union use the same). */
+const newestFirst = (order, by) => (a, b) => ((Number(b[order]) || 0) - (Number(a[order]) || 0)) || String(a[by]).localeCompare(String(b[by]));
+
+function sameValue(a, b) {
+  if (a === b) return true;
+  if (a === null || b === null || typeof a !== 'object' || typeof b !== 'object' || Array.isArray(a) !== Array.isArray(b)) return false;
+  const ka = Object.keys(a); const kb = Object.keys(b);
+  return ka.length === kb.length && ka.every((k) => Object.hasOwn(b, k) && sameValue(a[k], b[k]));
+}
+
+/** The account's object with its list joined to the guest's by id (the account's entry wins), or undefined. */
+function unionOf(guest, account, { union, by, order, keep }, ids = (id) => typeof id === 'string' || isNumber(id)) {
+  if (!isObject(guest) || !isObject(account) || !Array.isArray(guest[union]) || !Array.isArray(account[union])) return undefined;
+  const seen = new Set(); const list = [];
+  for (const entry of [...account[union], ...guest[union]]) {
+    if (!isObject(entry) || !ids(entry[by])) return undefined;
+    const id = String(entry[by]);
+    if (seen.has(id)) continue;
+    seen.add(id); list.push(entry);
+  }
+  if (order) list.sort(newestFirst(order, by));
+  return { ...account, [union]: keep ? list.slice(0, keep) : list };
+}
+
+/** One declared rule on one key: { pick: 'account' | 'guest' }, { value, list? } or { failed: why }. */
+async function applyRule(rule, guest, account, ctx) {
+  if (rule.rule === 'account' || rule.rule === 'guest') return { pick: rule.rule };
+  if (rule.rule === 'newer') return { pick: ctx.guest.updatedAt > ctx.account.updatedAt ? 'guest' : 'account' };
+  if (rule.rule === 'larger' || rule.rule === 'smaller') {
+    const g = rule.by ? (isObject(guest) ? guest[rule.by] : undefined) : guest;
+    const a = rule.by ? (isObject(account) ? account[rule.by] : undefined) : account;
+    if (!isNumber(g) || !isNumber(a)) return { failed: 'the two values are not numbers to compare' };
+    return { pick: (rule.rule === 'larger' ? g > a : g < a) ? 'guest' : 'account' };
+  }
+  if (rule.rule === 'sum') {
+    if (isNumber(guest) && isNumber(account)) return { value: guest + account };
+    if (!isObject(guest) || !isObject(account)) return { failed: 'the two values are not numbers or objects to add' };
+    const out = { ...guest, ...account };
+    for (const [k, n] of Object.entries(guest)) if (isNumber(n) && isNumber(account[k])) out[k] = n + account[k];
+    return { value: out };
+  }
+  if (rule.rule === 'union') {
+    const value = unionOf(guest, account, rule);
+    return value === undefined ? { failed: `the two values do not both hold a list of objects under '${rule.union}', each with '${rule.by}'` } : { value, list: rule.union };
+  }
+  try {
+    const value = await rule.fn(structuredClone(guest), structuredClone(account), ctx);
+    return value === undefined ? { failed: 'the function returned nothing' } : { value };
+  } catch (e) { return { failed: `the function threw: ${String(e?.message ?? e).slice(0, 200)}` }; }
+}
+
+/** A merged value as the text to store, a list cut from its end until it fits; null when it cannot be stored. */
+function fitted(value, list) {
+  let text;
+  try { text = JSON.stringify(value); } catch { return null; }
+  if (text === undefined) return null;
+  if (list && bytesOf(text) > SAVE_LIMITS.valueBytes) {
+    const kept = [...value[list]];
+    while (bytesOf(text) > SAVE_LIMITS.valueBytes && kept.length > 1) { kept.pop(); text = JSON.stringify({ ...value, [list]: kept }); }
+  }
+  return bytesOf(text) > SAVE_LIMITS.valueBytes ? null : text;
+}
+
+/**
+ * What one key both players have becomes: { took: 'same' } (nothing to do), { took: 'account', rule? } (the
+ * account's stays, by a declared rule), { took: 'guest', rule } (the guest's row replaces it), { took: 'merged',
+ * rule, text } (a new value), or { took: 'kept', rule?, error? } (no rule could combine them: the account's stays
+ * and the guest's value goes back to the browser).
+ */
+async function outcomeOf(rule, guest, account, ctx) {
+  const settle = (out, name) => {
+    if (out.pick) return sameValue(guest, account) ? { took: 'same' } : { took: out.pick, rule: name };
+    const text = fitted(out.value, out.list);
+    if (text === null) return { failed: 'the merged value is not JSON that fits a save' };
+    const value = JSON.parse(text);
+    if (sameValue(value, account)) return sameValue(guest, account) ? { took: 'same' } : { took: 'account', rule: name };
+    return sameValue(value, guest) ? { took: 'guest', rule: name } : { took: 'merged', rule: name, text };
   };
+  let failed = null;
+  if (rule) {
+    const out = await applyRule(rule, guest, account, ctx);
+    const done = out.failed ? out : settle(out, rule.rule);
+    if (!done.failed) return done;
+    failed = { rule: rule.rule, error: done.failed };
+  }
+  if (sameValue(guest, account)) return { took: 'same' };
+  // The toolkit's own record shape: nothing but this can ever combine a `server:` record, so it needs no rule.
+  const records = unionOf(guest, account, { ...RECORDS, keep: ctx.key.startsWith('server:') ? RECORDS.keep : null }, (id) => typeof id === 'string');
+  if (records !== undefined) { const done = settle({ value: records, list: RECORDS.union }, 'union'); if (!done.failed) return done; }
+  return { took: 'kept', ...(failed ?? {}) };
 }
 
 /**
- * A guest signs in to an account they already have: the account keeps what it has, and whatever only the guest
- * had moves over (saves of keys the account lacks, stats it lacks, the guest's memorials). Statements for one
- * batch, and the guest's large saves that the account already had (to drop after).
+ * A guest signs in to an account they already have. Whatever only the guest had moves over (saves, stats,
+ * memorials). A save both have is combined by the game's declared rule (mergeSaves); with no rule, two server
+ * records are joined by id, and for anything else the account's stays and the guest's value is reported (`kept`),
+ * so the play page can hand it to the game's onConflict. A stat both have keeps the account's number unless a rule
+ * says otherwise.
+ *
+ * Statements for ONE batch (a transaction), computed from one read. A guard per clashing key, and one inside the
+ * move for the set of clashing keys, make the batch fail when a room wrote a record to either player in between
+ * (adoptGuest reads again and retries). The move also leaves the guest's forwarding row for a record that lands
+ * late (appendServerRecord follows it). `plain: true` is the last resort: no guards and no merging.
  */
-export async function adoptStatements(env, from, to) {
-  const clash = (await env.DB.prepare('SELECT g.value, g.blob FROM saves g JOIN saves a ON a.player = ?2 AND a.game = g.game AND a.key = g.key WHERE g.player = ?1 AND g.blob = 1').bind(from, to).all()).results ?? [];
+export async function adoptStatements(env, from, to, { plain = false } = {}) {
+  const now = Date.now();
+  const clash = (await env.DB.prepare(`SELECT 0 AS stat, g.game AS game, g.key AS key, g.value AS gv, g.bytes AS gbytes, g.version AS gver, g.updated_at AS gat, g.blob AS gblob, a.value AS av, a.version AS aver, a.updated_at AS aat, a.blob AS ablob FROM saves g JOIN saves a ON a.player = ?2 AND a.game = g.game AND a.key = g.key WHERE g.player = ?1
+    UNION ALL SELECT 1, g.game, g.name, g.n, 0, 0, g.updated_at, 0, a.n, 0, a.updated_at, 0 FROM player_stats g JOIN player_stats a ON a.player = ?2 AND a.game = g.game AND a.name = g.name WHERE g.player = ?1`).bind(from, to).all()).results ?? [];
+  const pairs = clash.filter((c) => Number(c.stat) === 0);
+  const report = { merged: [], moved: 0, kept: [], stats: { merged: [], kept: [] } };
+  if (plain) report.fallback = true;
+  const guards = []; const writes = []; const drop = [];
+  let keptBytes = 0;
+  for (const c of pairs) {
+    const guestBlob = blobKey({ value: c.gv, blob: c.gblob }); const accountBlob = blobKey({ value: c.av, blob: c.ablob });
+    let out = { took: 'same' };
+    let guest;
+    if (guestBlob || accountBlob || c.gv !== c.av) {
+      guest = await valueOf(env, { value: c.gv, blob: c.gblob });
+      const account = await valueOf(env, { value: c.av, blob: c.ablob });
+      const ctx = { game: c.game, key: c.key, guest: { updatedAt: Number(c.gat), version: Number(c.gver) }, account: { updatedAt: Number(c.aat), version: Number(c.aver) } };
+      out = plain ? (sameValue(guest, account) ? { took: 'same' } : { took: 'kept' }) : await outcomeOf(ruleFor(merges.get(c.game)?.saves, c.key), guest, account, ctx);
+    }
+    if (!plain) guards.push(env.DB.prepare(`SELECT json_extract(CASE WHEN (SELECT COUNT(*) FROM saves WHERE game = ?3 AND key = ?4 AND ((player = ?1 AND version = ?5 AND updated_at = ?6) OR (player = ?2 AND version = ?7 AND updated_at = ?8))) = 2 THEN '0' ELSE 'saves changed during sign-in' END, '$')`).bind(from, to, c.game, c.key, Number(c.gver), Number(c.gat), Number(c.aver), Number(c.aat)));
+    if (out.took === 'guest') {
+      // The guest's row as it is (a large one keeps its object); the account's own large object goes.
+      writes.push(env.DB.prepare('UPDATE saves SET (value, bytes, blob) = (SELECT value, bytes, blob FROM saves WHERE player = ?1 AND game = ?3 AND key = ?4), version = version + 1, updated_at = ?5 WHERE player = ?2 AND game = ?3 AND key = ?4').bind(from, to, c.game, c.key, now));
+      drop.push(accountBlob);
+    } else if (out.took === 'merged') {
+      writes.push(env.DB.prepare('UPDATE saves SET value = ?4, bytes = ?5, version = version + 1, updated_at = ?6, blob = 0 WHERE player = ?1 AND game = ?2 AND key = ?3').bind(to, c.game, c.key, out.text, bytesOf(out.text), now));
+      drop.push(guestBlob, accountBlob);
+    } else drop.push(guestBlob);
+    if (out.took === 'kept') {
+      const entry = { game: c.game, key: c.key };
+      if (keptBytes + Number(c.gbytes) <= KEPT_BYTES) { keptBytes += Number(c.gbytes); entry.value = guest; } else entry.truncated = true;
+      if (out.rule) { entry.rule = out.rule; entry.error = out.error; }
+      report.kept.push(entry);
+    } else if (out.took !== 'same') report.merged.push({ game: c.game, key: c.key, rule: out.rule, took: out.took });
+  }
+  for (const c of clash) {
+    if (Number(c.stat) !== 1) continue;
+    const rule = plain ? null : ruleFor(merges.get(c.game)?.stats, c.key)?.rule ?? null;
+    if (rule && STAT_SQL[rule]) {
+      writes.push(env.DB.prepare(`INSERT INTO player_stats (player, game, name, n, updated_at) SELECT ?2, game, name, n, ?5 FROM player_stats WHERE player = ?1 AND game = ?3 AND name = ?4 ON CONFLICT(player, game, name) DO UPDATE SET n = ${STAT_SQL[rule]}, updated_at = excluded.updated_at`).bind(from, to, c.game, c.key, now));
+    }
+    if (rule) report.stats.merged.push({ game: c.game, name: c.key, rule });
+    else if (Number(c.gv) !== Number(c.av)) report.stats.kept.push({ game: c.game, name: c.key, value: Number(c.gv) });
+  }
+  // One statement moves what only the guest had and leaves the forwarding rows; unless `plain`, the forwarding
+  // row's value is also the guard: it stops being JSON, and the batch fails, when the clashing keys are no longer
+  // the ones read above.
+  const moved = JSON.stringify({ to, at: now });
+  const guard = plain ? '?3' : `json_extract(CASE WHEN (SELECT COUNT(*) FROM saves g JOIN saves a ON a.player = ?2 AND a.game = g.game AND a.key = g.key WHERE g.player = ?1) = ?6 THEN ?3 ELSE 'saves changed during sign-in' END, '$')`;
+  const move = env.DB.prepare(`INSERT OR IGNORE INTO saves (player, game, key, value, bytes, version, updated_at, blob) SELECT ?1, '', '${MOVED_KEY}', ${guard}, ?4, 1, ?5, 0 UNION ALL SELECT ?2, '', '${FROM_KEY}' || ?1, '1', 1, 1, ?5, 0 UNION ALL SELECT ?2, game, key, value, bytes, version, updated_at, blob FROM saves WHERE player = ?1 AND game != '' RETURNING game`)
+    .bind(...[from, to, moved, bytesOf(moved), now], ...(plain ? [] : [pairs.length]));
   return {
     statements: [
-      env.DB.prepare('INSERT OR IGNORE INTO saves (player, game, key, value, bytes, version, updated_at, blob) SELECT ?2, game, key, value, bytes, version, updated_at, blob FROM saves WHERE player = ?1').bind(from, to),
+      ...guards, ...writes, move,
       env.DB.prepare('INSERT OR IGNORE INTO player_stats (player, game, name, n, updated_at) SELECT ?2, game, name, n, updated_at FROM player_stats WHERE player = ?1').bind(from, to),
       env.DB.prepare('UPDATE memorials SET player = ?2 WHERE player = ?1').bind(from, to),
-      env.DB.prepare('DELETE FROM saves WHERE player = ?1').bind(from),
+      env.DB.prepare("DELETE FROM saves WHERE player = ?1 AND game != ''").bind(from),
       env.DB.prepare('DELETE FROM player_stats WHERE player = ?1').bind(from),
     ],
-    after: () => dropBlobs(env, clash.map(blobKey)),
+    move, report, plain,
+    after: () => dropBlobs(env, drop),
   };
 }
 
+/**
+ * Adopt a guest into an account in ONE batch, exactly once: `around(statements)` returns the whole batch (the
+ * sign-in's own writes around the adoption's). When a room wrote to either player between the read and the batch,
+ * the guard fails the batch, nothing is written, and it is read and tried again; after a few such tries the plain
+ * statements run (the account keeps a key both have, reported with `fallback: true`) rather than refusing the
+ * sign-in. Returns what happened: { merged, moved, kept, stats: { merged, kept }, fallback? }.
+ */
+export async function adoptGuest(env, from, to, around = (statements) => statements) {
+  for (let attempt = 0; ; attempt++) {
+    const plan = await adoptStatements(env, from, to, { plain: attempt >= ADOPT_TRIES - 1 });
+    const batch = around(plan.statements);
+    let results;
+    try { results = await env.DB.batch(batch); } catch (e) {
+      if (plan.plain || !CHANGED.test(String(e?.message ?? e))) throw e;
+      continue;
+    }
+    plan.report.moved = (results?.[batch.indexOf(plan.move)]?.results ?? []).filter((r) => r.game !== '').length;
+    await plan.after();
+    return plan.report;
+  }
+}
+
 /** Server-only, idempotent bounded round receipts. Optimistic versions also
- * serialize simultaneous rooms without dropping either room's result. */
+ * serialize simultaneous rooms without dropping either room's result. A player who was a guest and has since
+ * signed in to their account is followed there (the forwarding row adoptStatements leaves), in the same query
+ * that reads the record. */
 export async function appendServerRecord(env,player,game,key,record){
- if(!key.startsWith('server:')||!SAVE_KEY.test(key)||typeof record.id!=='string')throw new Error('invalid server record');
- for(let attempt=0;attempt<16;attempt++){
-  const old=await getSave(env,player,game,key),matches=Array.isArray(old.value?.matches)?old.value.matches:[];
+ if(!game||!key.startsWith('server:')||!SAVE_KEY.test(key)||typeof record.id!=='string')throw new Error('invalid server record');
+ for(let attempt=0,hops=0;attempt<16;attempt++){
+  const rows=(await env.DB.prepare(`SELECT game,value,version,blob FROM saves WHERE player=?1 AND ((game=?2 AND key=?3) OR (game='' AND key='${MOVED_KEY}'))`).bind(player,game,key).all()).results??[];
+  const moved=rows.find(r=>r.game==='');
+  if(moved){
+   let to=null;try{to=JSON.parse(moved.value)?.to;}catch{to=null;}
+   if(typeof to!=='string'||!to||to===player||++hops>4)throw new Error('server record forwarding');
+   player=to;attempt--;continue;
+  }
+  const row=rows[0]??null,old={value:row?await valueOf(env,row):null,version:row?Number(row.version):0},matches=Array.isArray(old.value?.matches)?old.value.matches:[];
   if(matches.some(r=>r.id===record.id))return;
-  const kept=[record,...matches].sort((a,b)=>b.endedAt-a.endedAt||a.id.localeCompare(b.id)).slice(0,100);
+  const kept=[record,...matches].sort(newestFirst(RECORDS.order,RECORDS.by)).slice(0,RECORDS.keep);
   let value=JSON.stringify({v:1,matches:kept}),bytes=bytesOf(value);
   while(bytes>SAVE_LIMITS.valueBytes&&kept.length>1){kept.pop();value=JSON.stringify({v:1,matches:kept});bytes=bytesOf(value);}
   if(bytes>SAVE_LIMITS.valueBytes)throw new Error('server record size');
-  const result=old.version?await env.DB.prepare('UPDATE saves SET value=?4,bytes=?5,version=version+1,updated_at=?6 WHERE player=?1 AND game=?2 AND key=?3 AND version=?7 RETURNING version').bind(player,game,key,value,bytes,Date.now(),old.version).first():await env.DB.prepare('INSERT INTO saves(player,game,key,value,bytes,version,updated_at,blob) VALUES(?1,?2,?3,?4,?5,1,?6,0) ON CONFLICT(player,game,key) DO NOTHING RETURNING version').bind(player,game,key,value,bytes,Date.now()).first();
+  const result=old.version?await env.DB.prepare('UPDATE saves SET value=?4,bytes=?5,version=version+1,updated_at=?6 WHERE player=?1 AND game=?2 AND key=?3 AND version=?7 RETURNING version').bind(player,game,key,value,bytes,Date.now(),old.version).first():await env.DB.prepare(`INSERT INTO saves(player,game,key,value,bytes,version,updated_at,blob) SELECT ?1,?2,?3,?4,?5,1,?6,0 WHERE NOT EXISTS(SELECT 1 FROM saves WHERE player=?1 AND game='' AND key='${MOVED_KEY}') ON CONFLICT(player,game,key) DO NOTHING RETURNING version`).bind(player,game,key,value,bytes,Date.now()).first();
   if(result)return;
  }
  throw new Error('server record conflict; retry the durable outbox');

package/worker/version.mjs

@@ -1,2 +1,2 @@
 /** The @homie-rocks/studio version this Worker code is (package.json's; a test keeps them equal). Cache-busts /_homie/site.js. */
-export const STUDIO_VERSION_TAG = '0.46.0';
+export const STUDIO_VERSION_TAG = '0.46.3';

package/worker/world-wire.mjs

@@ -0,0 +1,110 @@
+/**
+ * The world between the room and a Gate (0.46.2).
+ *
+ * The room used to send every Gate the whole world as JSON each tick: 150 KB for a thousand players, to sixteen
+ * Gates, each of which parsed it. Most of that text was six numbers a body (where it is, how fast, which way), and
+ * the rest (its fields, its seat) changes rarely. So the motion goes as one block of numbers, the same block for
+ * every Gate, and each Gate is told only the rest of a body when it has changed since that Gate last heard: about
+ * 33 KB a tick for a thousand players, and one string to read. The numbers are exact: 32-bit when every one of
+ * them is (a rules host's are), 64-bit when any is not. The block travels inside the frame, as base64: a frame
+ * of bytes beside the text would have to arrive just before it, and not every path between two objects keeps a
+ * binary frame and the text after it together (a local run of 300 players lost four links that way).
+ *
+ * `worldSource()` belongs to the room, one for all its Gate links. `worldSink()` belongs to a Gate.
+ */
+const sameValue = (a, b) => {
+  if (a === b) return true;
+  if (Array.isArray(a) && Array.isArray(b)) { if (a.length !== b.length) return false; for (let i = 0; i < a.length; i++) if (!sameValue(a[i], b[i])) return false; return true; }
+  if (a === null || b === null || typeof a !== 'object' || typeof b !== 'object') return false;
+  return JSON.stringify(a) === JSON.stringify(b);
+};
+/** Everything of a body but its motion: the same unless a field, a revision, a seat or a driver changed. */
+const sameTail = (a, b) => {
+  if (a.length !== b.length || a[1] !== b[1] || a[2] !== b[2] || a[6] !== b[6]) return false;
+  for (let i = 7; i < a.length; i++) if (!sameValue(a[i], b[i])) return false;
+  return true;
+};
+const base64 = (bytes) => { let text = ''; for (let i = 0; i < bytes.length; i += 0x8000) text += String.fromCharCode.apply(null, bytes.subarray(i, i + 0x8000)); return btoa(text); };
+const bytesOf = (text) => { const raw = atob(text), out = new Uint8Array(raw.length); for (let i = 0; i < raw.length; i++) out[i] = raw.charCodeAt(i); return out; };
+const numbers = (v) => Array.isArray(v) && v.every((n) => typeof n === 'number' && Number.isFinite(n));
+
+export function worldSource() {
+  const known = new Map();
+  let seq = 0, orderSeq = 0, restSeq = 0, ids = null, restText = null, last = null, lastOut = null;
+  return {
+    /** Once a world, whichever link asks first: the block of motion, and what changed since the world before. */
+    encode(snap) {
+      if (snap === last) return lastOut;
+      const entities = snap.d?.[1];
+      // A world this cannot carry exactly (no bodies array, a body without three vectors of one size) goes as it is.
+      const dims = entities?.[0]?.[3]?.length ?? 2;
+      if (!Array.isArray(entities) || !entities.every((e) => Array.isArray(e) && e.length >= 9 && typeof e[0] === 'string' && numbers(e[3]) && numbers(e[4]) && numbers(e[5]) && e[3].length === dims && e[4].length === dims && e[5].length === dims)) { last = snap; lastOut = null; return null; }
+      seq += 1;
+      const n = entities.length, width = dims * 3, wide = new Float64Array(n * width), order = new Array(n), changed = [];
+      let same = ids !== null && ids.length === n, narrow = true;
+      for (let i = 0; i < n; i++) {
+        const e = entities[i], id = e[0]; order[i] = id;
+        if (same && ids[i] !== id) same = false;
+        for (let a = 0; a < dims; a++) { wide[i * width + a] = e[3][a]; wide[i * width + dims + a] = e[4][a]; wide[i * width + 2 * dims + a] = e[5][a]; }
+        const held = known.get(id);
+        if (!held) { known.set(id, { row: e, changed: seq }); changed.push(i); }
+        else { if (held.row !== e && !sameTail(held.row, e)) { held.changed = seq; changed.push(i); } held.row = e; }
+      }
+      if (!same) {
+        orderSeq = seq;
+        if (known.size > n) { const live = new Set(order); for (const id of known.keys()) if (!live.has(id)) known.delete(id); }
+      }
+      ids = order;
+      for (let i = 0; i < wide.length; i++) if (Math.fround(wide[i]) !== wide[i]) { narrow = false; break; }
+      const text = snap.d.length > 2 ? JSON.stringify(snap.d.slice(2)) : '';
+      if (text !== restText) { restText = text; restSeq = seq; }
+      last = snap;
+      const motion = narrow ? Float32Array.from(wide).buffer : wide.buffer;
+      lastOut = { seq, n, dims, narrow, motion, block: base64(new Uint8Array(motion)), entities, changed, control: new Map((snap.c ?? []).map((row) => [row[0], row])), snap };
+      return lastOut;
+    },
+    /** What one Gate needs beside the block: the bodies whose rest changed since world `synced`, and its own players' control rows. */
+    header(world, synced, seats) {
+      const { snap, entities } = world, tails = [];
+      const tail = (i) => { const e = entities[i].slice(); e[3] = e[4] = e[5] = 0; tails.push([i, e]); };
+      if (synced === world.seq - 1) for (const i of world.changed) tail(i);
+      else for (let i = 0; i < entities.length; i++) if (known.get(entities[i][0]).changed > synced) tail(i);
+      const c = [];
+      for (const seat of seats) { const row = world.control.get(seat); if (row) c.push(row); }
+      return {
+        k: snap.k, st: snap.st, ...(snap.e !== undefined ? { e: snap.e } : {}), round: snap.d[0], c,
+        w: { seq: world.seq, n: world.n, dims: world.dims, narrow: world.narrow, ...(orderSeq > synced ? { ids } : {}), tails, ...(restSeq > synced ? { rest: snap.d.slice(2) } : {}) },
+      };
+    },
+  };
+}
+
+export function worldSink() {
+  let ids = [], tails = [], rest = [];
+  return {
+    /** The world a header and its block describe, as the room held it. Throws when they do not fit each other. */
+    decode(header, block64) {
+      const w = header.w;
+      if (w.ids) {
+        const held = new Map(ids.map((id, i) => [id, tails[i]]));
+        ids = w.ids; tails = ids.map((id) => held.get(id));
+      }
+      for (const [i, tail] of w.tails) tails[i] = tail;
+      if (w.rest) rest = w.rest;
+      const width = w.dims * 3, bytes = typeof block64 === 'string' ? bytesOf(block64) : null;
+      if (!bytes || ids.length !== w.n || bytes.length !== w.n * width * (w.narrow ? 4 : 8)) throw new Error(`world block does not fit its header (${bytes?.length} bytes for ${w.n} bodies, ${ids.length} known)`);
+      const block = bytes.buffer;
+      const a = w.narrow ? new Float32Array(block) : new Float64Array(block), entities = new Array(w.n), d = w.dims;
+      for (let i = 0; i < w.n; i++) {
+        const tail = tails[i];
+        if (!tail) throw new Error('world names a body this Gate was never told of');
+        const row = tail.slice(), o = i * width;
+        row[3] = d === 2 ? [a[o], a[o + 1]] : [a[o], a[o + 1], a[o + 2]];
+        row[4] = d === 2 ? [a[o + d], a[o + d + 1]] : [a[o + d], a[o + d + 1], a[o + d + 2]];
+        row[5] = d === 2 ? [a[o + 2 * d], a[o + 2 * d + 1]] : [a[o + 2 * d], a[o + 2 * d + 1], a[o + 2 * d + 2]];
+        entities[i] = row;
+      }
+      return { k: header.k, st: header.st, ...(header.e !== undefined ? { e: header.e } : {}), d: [header.round, entities, ...rest], c: header.c };
+    },
+  };
+}