@mason-data/cli 0.7.0 → 0.9.0

package/dist/src/duck/sync.js

@@ -1,4 +1,8 @@
-import { MASON_SCHEMA } from "./store.js";
+import { DEFAULT_MEMORY_RULE, freeBytesAt, MASON_SCHEMA, NO_ROLE_SESSION, pgErrorOf, SessionSetup } from "./store.js";
+/** the session the generated tables' run passes the Mason functions: no slot of the cancel table (src/duck/cancel.ts
+ *  `slotOf`), so never cancelled through it; a stop interrupts the run's connection instead */
+const GENERATED_SESSION = "generated";
+import { GeneratedTables } from "./generated.js";
 import { KeptJsonPaths } from "./kept.js";
 import { DuckDBEnumType, DuckDBListType } from "@duckdb/node-api";
 import { wireColumn } from "./types.js";
@@ -8,9 +12,14 @@ import * as fs from "node:fs";
 import * as path from "node:path";
 import { PgConnection, formatLsn, parseLsn, pgLiteral } from "../cdc/pg-wire.js";
 import { createSlot, currentLsn, dropSlot, readSlot } from "../cdc/source.js";
+import { holdOf } from "./held-types.js";
 import { addCounts, countsText, duckValue, foldInto, noChanges, noCounts, ReplicationStream } from "./stream.js";
 import { didYouMean } from "../lib/did-you-mean.js";
-import { namedPublicationVerdict, readNamedPublication } from "./publication.js";
+import { numericWiderThan } from "../lib/pg-numeric.js";
+import { gapLine, namedPublicationVerdict, readNamedPublication } from "./publication.js";
+import { extensionFailure, loadPostgresSql } from "./extensions.js";
+import { errorCode, errorText, maskPasswordKeyword, messageOf } from "../lib/secret-mask.js";
+import { BIG_TABLE_ROWS, intervalOf, msText, syncedText, syncText, syncWords } from "../lib/table-sync.js";
 export function syncModeOf(env) {
     const v = env.MASON_DUCK_SYNC || "poll";
     if (v !== "poll" && v !== "recopy")
@@ -18,17 +27,70 @@ export function syncModeOf(env) {
     return v;
 }
 /**
- * THE POLL'S ROW LIMIT: in poll mode a table the source estimates at more than this many rows
- * (`AddedTable.rows`, the catalog's estimate; unknown counts as small) is copied and served, but the passes do not poll
- * it. A poll scans its table whole (no index covers xmin) and counts it, and when the counts differ reads every key over
- * the wire: on a test server a 22 M-row table cost the production replica 12 s of scan and 2 s of count at every poll.
- * `mason sync <table>` polls one now (`Sync.pollNow`); `mason start --replication` keeps every table current, whatever
- * its size.
+ * WHEN A POLLED TABLE IS POLLED NEXT: its interval after its last poll ended, stretched to four times that poll's own
+ * time (`nextPollDelayMs`) — so one table's polls never take more than a fifth of the source's time, whatever its
+ * `sync: poll <interval>` says (a 20 s poll of a table set to `poll 5s` waits 80 s).
  */
-export const POLL_ROW_LIMIT = 1_000_000;
-/** why the passes do not keep a table over the limit current (`CopyState.unsynced`) */
-export const OVER_POLL_LIMIT = `over the ${POLL_ROW_LIMIT.toLocaleString("en-US")}-row sync limit`;
-const overPollLimit = (t) => t.rows !== null && t.rows > POLL_ROW_LIMIT;
+export function nextPollAt(endedMs, intervalSeconds, pollMs) {
+    return endedMs + nextPollDelayMs(intervalSeconds * 1000, pollMs);
+}
+/**
+ * HOW LONG THE NEXT PASS WAITS: until the first polled table is due — and at least four times what the last pass took
+ * (its polls, one after another on the writer), so ALL the tables' polls together never take more than a fifth of the
+ * source's time, however many are due at once. Bounded by setTimeout's 2^31 - 1 ms: a later poll is waited for in
+ * steps, a pass that finds nothing due polling nothing.
+ */
+export function passDelayMs(earliestDueMs, nowMs, lastPassMs) {
+    return Math.min(2 ** 31 - 1, Math.max(0, earliestDueMs - nowMs, 4 * lastPassMs));
+}
+/** The least grace a polled or recopied table is given past its interval before it is behind (`keptPromise`): a pass
+ *  attaches the source and queues on the writer, so a poll due now lands a little later. */
+export const POLL_GRACE_FLOOR_SECONDS = 60;
+/** How old a STREAMED table's synced data may be before it is behind (`keptPromise`): an idle healthy stream says it has
+ *  everything the database wrote on the keepalive it asks for every 10 s (src/duck/stream.ts `sendStatus(…, true)`),
+ *  so 120 s is twelve of them, and past `wal_sender_timeout`'s default 60 s: one reconnect never crosses it. */
+export const REPLICATION_BEHIND_SECONDS = 120;
+/**
+ * WHAT A TABLE'S `sync:` PROMISES: the age of its synced data past which it is BEHIND, and the facts that would make it
+ * so now — the one derivation (`Sync.keptOf` calls it; src/cli/readiness.ts `behindOf` compares it with the age at the
+ * moment asked). It reads what the schedule reads (`nextPollAt`'s table poll, `passDelayMs`'s last pass), never a second
+ * measure, and changes neither load rule: it says them.
+ *  - `poll`: its interval plus max(60 s, twice its own last poll this run; 60 s when not measured, as after a start);
+ *  - `recopy`: the run's interval plus max(60 s, twice the last pass);
+ *  - `replication`: `REPLICATION_BEHIND_SECONDS`;
+ *  - `off`: nothing (null): it is as of its last `mason sync`, and never behind.
+ */
+export function keptPromise(o) {
+    if (o.mode === "off")
+        return { promisedSeconds: null, lateWhy: null };
+    if (o.mode === "replication") {
+        return { promisedSeconds: REPLICATION_BEHIND_SECONDS, lateWhy: o.pending !== null ? o.pending : o.notRunning !== null ? `the stream is not running: ${o.notRunning}`
+                : "the stream has not had everything the database wrote since then (the Stream section says its lag)" };
+    }
+    const own = o.mode === "recopy" ? o.lastPassMs : o.lastPollMs;
+    const promisedSeconds = o.intervalSeconds + Math.max(POLL_GRACE_FLOOR_SECONDS, own === null ? 0 : (2 * own) / 1000);
+    const interval = o.intervalSeconds * 1000;
+    const fifth = "to keep the database's load to a fifth";
+    let lateWhy;
+    if (o.pending !== null)
+        lateWhy = o.pending;
+    else if (o.passFailed)
+        lateWhy = `the sync's last pass failed (mason logs --events says why): it is tried again every ${msText(interval)}`;
+    else if (o.mode === "recopy")
+        lateWhy = o.lastPassMs === 0 ? "it is read again whole at the next pass"
+            : `the last pass, which reads every table again whole, took ${msText(o.lastPassMs)}, and Mason waits four times a pass between passes ${fifth}`;
+    else if (4 * o.lastPassMs > interval && 4 * o.lastPassMs >= 4 * (o.lastPollMs ?? 0)) {
+        lateWhy = `every polled table's polls took ${msText(o.lastPassMs)} in the last pass, and Mason waits four times that between passes ${fifth}`;
+    }
+    else if (o.lastPollMs !== null && 4 * o.lastPollMs > interval) {
+        lateWhy = `its own poll took ${msText(o.lastPollMs)}, and Mason waits four times a table's poll before its next ${fifth}`;
+    }
+    else if (o.lastPollMs === null)
+        lateWhy = "it has not been polled since Mason started: it is polled at the next pass";
+    else
+        lateWhy = o.dueMs !== null && o.dueMs > o.now ? `its next poll is due ${clock(o.dueMs)} UTC` : "its poll is due, after the polls of the pass before it";
+    return { promisedSeconds, lateWhy };
+}
 /** a poll asked for that cannot run (`Sync.pollNow`), its reason in the asker's words: `code` is the CLI's failure code */
 export class PollRefused extends Error {
     code;
@@ -38,6 +100,19 @@ export class PollRefused extends Error {
 export class Stopping extends Error {
     constructor() { super("Mason is stopping"); }
 }
+/** How often the slot's WAL is read at most (`streamStatus`): a catalog view's row, on the connection the database's
+ *  position is read on, so never a connection of its own — and never per poll or per batch. */
+export const SLOT_READ_MS = 30_000;
+/** The slot as `readSlot` read it, as `SlotWal` says it. */
+export function slotWalOf(s, name, at) {
+    if (!s.exists)
+        return { error: `replication slot ${name} does not exist on the database (the next pass makes it again)` };
+    const status = s.walStatus === "reserved" || s.walStatus === "extended" || s.walStatus === "unreserved" || s.walStatus === "lost" ? s.walStatus : null;
+    // a lost slot's WAL was freed by Postgres (its restart_lsn is null): it holds none; any other null is not known
+    if (s.retainedBytes === null && status !== "lost")
+        return { error: `replication slot ${name} has no restart position yet: the WAL it holds is not known` };
+    return { walHeldBytes: s.retainedBytes === null ? 0 : Number(s.retainedBytes), walStatus: status, safeWalSizeBytes: s.safeBytes === null ? null : Number(s.safeBytes), at: new Date(at).toISOString() };
+}
 export const ident = (name) => `"${name.replaceAll('"', '""')}"`;
 export const literal = (s) => `'${s.replaceAll("'", "''")}'`;
 export const SRC = "_mason_source";
@@ -90,7 +165,15 @@ export async function writeStaged(w, t, target, stage, where, kept) {
  * never converted in place, but copied again through the normal path (`needsCopy`), serving as it was meanwhile. Found
  * by its constraint (`duckdb_constraints()`), which every copy of that layout carries and no copy of this one does.
  */
-export const RETIRED_LAYOUT = "stored in key order with an index, by an older Mason: copied again in heap order";
+export const RETIRED_LAYOUT = "stored in key order with an index, by an older Mason: read again whole, in heap order";
+/**
+ * A COPY AN OLDER MASON MADE BEFORE A TYPE WAS HELD AS ITS TEXT (src/duck/held-types.ts): a column this Mason holds as the
+ * source's text (a `point`, a `money`, a range) stored as the extension's scan read it (a `point` as a STRUCT). Its
+ * record (`copy_state.columns`) was written by code that did not know the column's kind, so it cannot say so: found by
+ * what the copy physically is (`duckdb_columns()`), copied again through the normal path (`needsCopy`), serving as it
+ * was until its swap; never converted in place.
+ */
+export const HELD_LAYOUT = "stored by an older Mason with a column not held as the source's text: read again whole, each such column as its text";
 /**
  * How long a failed copy waits before it is tried again: four times the attempt, at least 5 minutes, doubled for each
  * failure in a row, at most 6 hours (a copy whose sort failed for good read a production replica whole for
@@ -115,16 +198,16 @@ export function copyOrder(tables) {
  * of a copy that is not coming (the test server: every start said `added <all four tables>: they are copied at the
  * next pass` while all four were copied and streamed from the acknowledged position — read as a long re-copy that never
  * came). ONE line: the tables grouped by state, each group `<n> table(s) <state>: <tables>`, the current ones first,
- * those copied at the next pass last, each with its reason. `kept` is how a current copy is kept so (`keptWords`).
+ * those copied at the next pass last, each with its reason, a current copy with how it is kept so (`keptWords`).
  */
-export function addedText(tables, kept) {
+export function addedText(tables) {
     const groups = new Map();
     for (const t of tables) {
-        const [rank, state] = "copy" in t ? [3, `copied at the next pass (${t.copy})`]
-            : "behind" in t ? [2, `already copied, caught up by one poll first (${t.behind})`]
-                : "refused" in t ? [4, `not copied or streamed (${t.refused})`]
-                    : t.unsynced ? [1, `already copied, NOT kept current (${OVER_POLL_LIMIT}: mason sync polls one now, mason start --replication keeps it current)`]
-                        : [0, `already copied and ${kept}`];
+        const [rank, state] = "copy" in t ? [3, `synced at the next pass (${t.copy})`]
+            : "behind" in t ? [2, `already synced, caught up by one poll first (${t.behind})`]
+                : "refused" in t ? [4, `not synced or streamed (${t.refused})`]
+                    : t.off ? [1, `already synced, ${t.kept}`]
+                        : [0, `already synced and ${t.kept}`];
         const g = groups.get(state) ?? { rank, sources: [] };
         g.sources.push(t.source);
         groups.set(state, g);
@@ -148,6 +231,65 @@ export function chunkPages(pages, rows, targetRows = COPY_CHUNK_ROWS) {
         return COPY_CHUNK_MAX_PAGES;
     return Math.min(COPY_CHUNK_MAX_PAGES, Math.max(1, Math.round(targetRows / (rows / pages))));
 }
+/**
+ * A CHUNK'S OUT-OF-LINE BYTES ARE BOUNDED BY THE MEMORY (issue 96: a table of ~20,000 rows of ~68 KB of `jsonb` out of
+ * line has a heap of a few hundred pages, so its rows ceiling was the whole table, read as ONE chunk, which ran out of
+ * a 7.8 GiB limit). A heap page holds a TOAST pointer of ~20 bytes where the row holds its value, so the rows ceiling
+ * (`chunkPages`, measured on heap rows) cannot see what a chunk reads; the source's catalog can: its TOAST table's bytes
+ * (`pg_table_size` of `reltoastrelid`), a heap page's share of them, read each attempt (`Sync.outOfLineBytes`). The
+ * ceiling is then at most `budget / out-of-line bytes a page` pages, at least one: the budget is the memory limit
+ * (`store.memoryLimitBytes`) times `COPY_CHUNK_MEMORY_SHARE`, shared by the readers that may read at once
+ * (`MASON_COPY_PARALLEL`). A table with nothing out of line gets exactly the rows ceiling.
+ *
+ * MEASURED (DuckDB 2.0.0, `duckdb_memory()` sampled every 50 ms; docs/DESIGN.md "Large values out of line"): a chunk
+ * of `jsonb` held ~5.5 times its bytes on the source while it read (366 MiB for one 67 MB page), one of uncompressed
+ * text 1 to 2 times; so a chunk is given an eighth of the limit, the rest left to the readers beside it, the stream,
+ * the polls and the queries, and a chunk that still runs out goes on smaller (`readChunks`).
+ */
+export const COPY_CHUNK_MEMORY_SHARE = 1 / 8;
+/** the bytes one reader's chunk may read out of line: the memory limit's share (`COPY_CHUNK_MEMORY_SHARE`), split
+ *  between the readers that may read at once */
+export function chunkBudgetBytes(memoryLimitBytes, readers) {
+    return (memoryLimitBytes * COPY_CHUNK_MEMORY_SHARE) / Math.max(1, readers);
+}
+/** THE CEILING of a chunk of a table of `pages` heap pages, about `rows` rows and `outOfLine` bytes out of line
+ *  (its TOAST table's; null: unknown): the rows ceiling (`chunkPages`), held to `budget` bytes out of line, at least
+ *  one page */
+export function chunkCeiling(pages, rows, outOfLine, budget, targetRows = COPY_CHUNK_ROWS) {
+    const byRows = chunkPages(pages, rows, targetRows);
+    if (outOfLine === null || outOfLine <= 0 || pages <= 0)
+        return byRows;
+    return Math.min(byRows, Math.max(1, Math.floor(budget / (outOfLine / pages))));
+}
+/**
+ * NO TABLE IS REFUSED BY ARITHMETIC (fix round 1 of PR 380): whether the engine can write a table's values is the
+ * engine's to say, at the write (53200 at a chunk's read or commit, `readChunks`), never a formula over the source's
+ * catalog. A refusal decided up front from the TOAST bytes in a row group, measured on a few rows of ~100 KB, refused
+ * 140,000 rows of ~2.6 KB through a 128 MB limit that the base synced in one chunk. What stays open: a checkpoint
+ * merging a table's small row groups of LARGE values that do not fit invalidates the database (issue 371).
+ */
+/** WHY A TABLE IS NOT SYNCED IN THIS MEMORY (`readChunks`): its rows, the limit as set, and the ways out — in the
+ *  operator's words, never the engine's own remedies (its threads, its settings) */
+export function tooLargeText(source, what, memoryLimitBytes) {
+    return `the rows of ${source} are too large for the memory the synced data may use: ${what}, in ${humanBytes(memoryLimitBytes)} ` +
+        `(MASON_DUCKDB_MEMORY; unset, ${DEFAULT_MEMORY_RULE}). Raise MASON_DUCKDB_MEMORY and start mason again, or ` +
+        `mason add ${source} --columns … without its widest columns`;
+}
+/** A CHUNK'S RANGE GIVEN BACK to what is left to read (`readChunks`: its chunk ran out of memory and rolled back):
+ *  put among `gaps` in page order and joined to the gaps it meets, so the gaps still tile what no chunk committed —
+ *  no page twice, none skipped */
+export function giveBack(gaps, r) {
+    gaps.push({ ...r });
+    gaps.sort((a, b) => a.first - b.first);
+    for (let i = 0; i + 1 < gaps.length;) {
+        const a = gaps[i], b = gaps[i + 1];
+        if (a.end !== null && a.end === b.first) {
+            gaps.splice(i, 2, { first: a.first, end: b.end });
+            continue;
+        }
+        i++;
+    }
+}
 /**
  * HOW LONG A CHUNK SHOULD TAKE TO READ, in seconds (`MASON_COPY_CHUNK_SECONDS`, 1 to 300, default 12:
  * a laptop copying a 20 M-row table from a database over the internet showed `0 of ~20,126,276 rows` for minutes, then
@@ -163,8 +305,8 @@ export function copyChunkSecondsOf(env) {
         return COPY_CHUNK_SECONDS;
     const n = Number(v);
     if (!/^\d+(\.\d+)?$/.test(v.trim()) || n < COPY_CHUNK_SECONDS_MIN || n > COPY_CHUNK_SECONDS_MAX) {
-        throw new Error(`MASON_COPY_CHUNK_SECONDS=${JSON.stringify(v)} is not a number of seconds from ${COPY_CHUNK_SECONDS_MIN} to ${COPY_CHUNK_SECONDS_MAX}: each of a copy's chunks is sized to take ` +
-            `about that long to read, and a stop reads at most that much again, so set it lower for a copy that moves more often or higher for fewer, larger chunks, or unset it for ${COPY_CHUNK_SECONDS}`);
+        throw new Error(`MASON_COPY_CHUNK_SECONDS=${JSON.stringify(v)} is not a number of seconds from ${COPY_CHUNK_SECONDS_MIN} to ${COPY_CHUNK_SECONDS_MAX}: each of a first sync's chunks is sized to take ` +
+            `about that long to read, and a stop reads at most that much again, so set it lower for a first sync that moves more often or higher for fewer, larger chunks, or unset it for ${COPY_CHUNK_SECONDS}`);
     }
     return n;
 }
@@ -345,7 +487,7 @@ export function copyParallelOf(env) {
         return COPY_PARALLEL;
     const n = Number(v);
     if (!/^\d+$/.test(v.trim()) || n < 1 || n > COPY_PARALLEL_MAX) {
-        throw new Error(`MASON_COPY_PARALLEL=${JSON.stringify(v)} is not a number of readers from 1 to ${COPY_PARALLEL_MAX}: each reads a copy's chunks on a backend of the database's own, ` +
+        throw new Error(`MASON_COPY_PARALLEL=${JSON.stringify(v)} is not a number of readers from 1 to ${COPY_PARALLEL_MAX}: each reads a first sync's chunks on a backend of the database's own, ` +
             `so set it to 1 (one at a time, the lightest on the database) up to ${COPY_PARALLEL_MAX}, or unset it for ${COPY_PARALLEL}`);
     }
     return n;
@@ -362,14 +504,46 @@ export function streamRetryDelayMs(intervalMs, failures) {
 }
 /** what Mason's backends on the source are called (pg_stat_activity.application_name): the copy's readers and the polls */
 export const SOURCE_APPLICATION_NAME = "mason-data";
-/** libpq's keyword form of the source, for DuckDB's ATTACH (a value quoted as libpq reads it) */
-export function libpqString(s) {
-    const v = (x) => `'${String(x).replace(/\\/g, "\\\\").replace(/'/g, "\\'")}'`;
-    return [`host=${v(s.host)}`, `port=${v(s.port)}`, `dbname=${v(s.database)}`, `user=${v(s.user)}`,
-        ...(s.password ? [`password=${v(s.password)}`] : []), `sslmode=${v(s.sslmode)}`, `application_name=${v(SOURCE_APPLICATION_NAME)}`].join(" ");
+/**
+ * THE ENGINE NEVER HOLDS THE SOURCE'S PASSWORD IN A STRING IT REPEATS (issue 599). DuckDB's `postgres` extension
+ * repeats an ATTACH's path whole in its error (`Unable to connect to Postgres at "<path>": …`), and every connection
+ * reads it in `duckdb_databases()`; a run whose source restarted under it wrote `password='…'` to its log, its ledger,
+ * `mason status` and the web page. So the path is `attachPath`'s, which takes nothing but the sslmode, and the
+ * credentials go through the extension's SECRET MANAGER (`sourceSecretSql`): a temporary, in-memory secret of TYPE
+ * postgres, made on the writer's turn just before the ATTACH that names it and dropped right after it, whatever the
+ * ATTACH did (`attach`). Measured on the extension pinned in cli/extensions.json: its error says the path alone,
+ * `duckdb_secrets()` says `password=redacted`, the attachment keeps the credentials it merged at the ATTACH (a copy's
+ * readers and a reconnect after a restart connect with the secret gone), and it quotes each value for libpq itself.
+ * Not PGPASSWORD: the process's environment is every child's, and setting it races the engine's threads reading it.
+ * Whatever a dependency repeats one day, the sync's exits mask it (src/lib/secret-mask.ts).
+ */
+export function attachPath(s) {
+    const v = (x) => `'${x.replace(/\\/g, "\\\\").replace(/'/g, "\\'")}'`;
+    return [`sslmode=${v(s.sslmode)}`, `application_name=${v(SOURCE_APPLICATION_NAME)}`].join(" ");
+}
+/** THE ATTACH THE SYNC RUNS: the secret path's, always. A test that shows the mask alone (tests/integration/duck-secret.itest.ts)
+ *  replaces it through `attachSeamForTest`, which a run never imports: no option, setting or environment reaches it */
+const secretAttachSql = (s) => `ATTACH ${literal(attachPath(s))} AS ${SRC} (TYPE postgres, SECRET ${SOURCE_SECRET}, READ_ONLY)`;
+let attachSqlOf = secretAttachSql;
+export const attachSeamForTest = {
+    /** replaces the ATTACH (null: the secret path's again), for a test's process alone */
+    set(f) { attachSqlOf = f ?? secretAttachSql; },
+};
+/** the secret the ATTACH names: an explicit name, so no other ATTACH takes it (only `__default_postgres` is taken
+ *  unnamed), and a wire session's planned SQL cannot name it */
+export const SOURCE_SECRET = "mason_source_credentials";
+/** the source's credentials as the extension's secret: temporary (in memory, never written to disk) and replaced, its
+ *  password left out when there is none (libpq then reads PGPASSWORD or a pgpass file, as it did before) */
+export function sourceSecretSql(s) {
+    return `CREATE OR REPLACE TEMPORARY SECRET ${SOURCE_SECRET} (TYPE postgres, HOST ${literal(s.host)}, PORT ${literal(String(s.port))}, ` +
+        `DATABASE ${literal(s.database)}, USER ${literal(s.user)}${s.password ? `, PASSWORD ${literal(s.password)}` : ""})`;
 }
 /** a table's columns as a copy is made with them: their names and source types, in order */
-const columnsKey = (columns) => JSON.stringify(columns.map((c) => [c.name, c.type]));
+const columnsKey = (columns) => JSON.stringify(columns.map((c) => {
+    // what the copy holds is part of the shape: a copy made before a column's type was held as its text is read again
+    const hold = holdOf(c.type, c.typeKind);
+    return hold === "same" && c.domain !== true ? [c.name, c.type] : [c.name, c.type, hold, ...(c.domain === true ? ["domain"] : [])];
+}));
 /** `postgres_query` over the attached source: a read of Postgres's own SQL in the DuckDB transaction's snapshot */
 const pq = (sql) => `postgres_query(${literal(SRC)}, ${literal(sql)})`;
 /**
@@ -384,7 +558,17 @@ const pq = (sql) => `postgres_query(${literal(SRC)}, ${literal(sql)})`;
  * differ (`1` beside `1.50`); the copy answers them all with s decimals, also said.
  */
 const NUMERIC_TYPE = /^numeric(?:\((\d+)(?:,\s*(\d+))?\))?$/;
-const WIDER = "mason: a numeric value wider than its copy";
+const WIDER = "mason: a numeric value wider than its synced column";
+/** Whether a ROLLBACK's `e` says the engine had ended the transaction itself ("cannot rollback - no transaction is
+ *  active", after a COMMIT or a read out of memory): a decision, so it reads the raw words (`messageOf`) */
+export function endedTransaction(e) {
+    return /no transaction is active/.test(messageOf(e));
+}
+/** Whether `e` is a numeric of `source` wider than its synced column (`WIDER`): a decision, so it reads the error's raw
+ *  words (`messageOf`), never the words Mason repeats (`errorText`) — the stream's, the catch-up's and the poll's alike */
+export function widerIn(e, source) {
+    return messageOf(e).includes(`${WIDER} [${source}]`);
+}
 /** a source numeric the extension reads as a DOUBLE: no precision, or more than DuckDB's 38 digits */
 function readsAsDouble(type) {
     const m = NUMERIC_TYPE.exec(type);
@@ -398,16 +582,9 @@ function fitsDecimal(column, scale, source, significant) {
     return `CASE WHEN length(${decimals}) > ${scale} OR length(regexp_extract(${v}, '^-?(\\d+)', 1)) > ${38 - scale} ` +
         `OR ${v} IN ('NaN', 'Infinity', '-Infinity') THEN error(${literal(`${WIDER} [${source}]`)}) ELSE ${v} END AS ${v}`;
 }
-/** a numeric's text that does not fit DECIMAL(38, scale): `fitsDecimal`'s rule, for a value the stream brings */
-function widerThan(text, scale, significant) {
-    if (text === "NaN" || text === "Infinity" || text === "-Infinity")
-        return true;
-    const m = /^-?(\d*)(?:\.(\d+))?$/.exec(text);
-    if (m === null)
-        return true;
-    const decimals = significant ? (m[2] ?? "").replace(/0+$/, "") : m[2] ?? "";
-    return decimals.length > scale || m[1].length > 38 - scale;
-}
+/** a numeric's text that does not fit DECIMAL(38, scale): `fitsDecimal`'s rule, for a value the stream brings (the one
+ *  rule, src/lib/pg-numeric.ts `numericWiderThan`) */
+const widerThan = (text, scale, significant) => numericWiderThan(text, scale, significant);
 /** The DuckDB type a copied column is stored as: the extension's own, but a JSON for a json / jsonb (it reads them as text). */
 /** a char(n) column (format_type's `character(n)`): the extension reads its values with the padding trimmed */
 const CHAR_TYPE = /^character\((\d+)\)$/;
@@ -417,10 +594,12 @@ function storedValue(c) {
     return m ? `rpad(${ident(c.name)}, ${m[1]}, ' ')` : ident(c.name);
 }
 function storedType(c, scanned) {
-    return /^jsonb?$/.test(c.type) ? "JSON" : scanned;
+    const hold = holdOf(c.type, c.typeKind);
+    return hold === "text" ? "VARCHAR" : hold === "text[]" ? "VARCHAR[]" : /^jsonb?$/.test(c.type) ? "JSON" : scanned;
 }
-/** the order the queue takes them in: a catch-up is one poll that makes a copied table current */
-const REBUILD_ORDER = ["catch-up", "copy"];
+/** the order the queue takes them in: a catch-up is one poll that makes a copied table current; a generated table's
+ *  re-run reads what the copies hold, so it goes behind them */
+const REBUILD_ORDER = ["catch-up", "copy", "generated"];
 export class Sync {
     store;
     source;
@@ -429,12 +608,24 @@ export class Sync {
     mode;
     /** each polled table's watermark: the snapshot of the last poll that stored it */
     snapshots = new Map();
-    /** how long the last pass took: the next waits four times that, at least the interval */
+    /** how long the last pass took: the next waits at least four times that (its polls' share of the source's time) */
     lastPassMs = 0;
+    /** each polled table's next poll (ms since the epoch: its last poll's end plus its interval, stretched to four times
+     *  that poll — `nextPollDelayMs`); absent: from its last poll's time in the ledger (`dueAt`). One pass polls the
+     *  tables due and the timer waits for the next one due (`nextPassDelay`), never a timer per table: a pass also
+     *  queues the copies and drops removed tables, and attaches the source once for all of it — timers of their own would
+     *  each attach it, and race those for the writer's turn */
+    due = new Map();
+    /** each table's sync as its last poll or copy recorded it (`_mason.poll_state.sync`; null: recorded before syncs were) */
+    recordedSync = new Map();
+    /** the tables whose sync changed since they were last polled (`setTables`): kept, and caught up by ONE poll now */
+    switched = new Set();
+    /** how long each table's last poll took, this run (ms): its next waits four times that, and mason add estimates by it */
+    lastPollMs = new Map();
     /** each table whose copy failed: the failures in a row, and when it is tried again (`copyRetryDelayMs`) */
     retries = new Map();
     /** each copied table in a layout this Mason no longer keeps (`RETIRED_LAYOUT`), found at `open`: copied again */
-    retired = new Set();
+    retired = new Map();
     /** the catalog's own connection (`rebuildSchema`): it sees only what a copy or poll has committed, and is never
      *  held by a copy's statement, so a table is served the moment its copy commits */
     catalog = null;
@@ -442,6 +633,8 @@ export class Sync {
     schemaBuild = Promise.resolve();
     tables = new Map();
     views = [];
+    /** the source's collations (src/cli/preflight.ts), which the catalog declares where it lacks one (`setCollations`) */
+    collations = [];
     states = new Map();
     /** each copied table's columns as its copy was made with them (`columnsKey`): a change copies it again */
     copiedAs = new Map();
@@ -455,10 +648,17 @@ export class Sync {
     attached = false;
     loaded = false;
     stopped = false;
-    /** REPLICATION MODE: the publication and slot it reads (`owned`: the publication is Mason's own, made and kept equal
-     *  to the added tables; else the operator named it, and it is only read — src/duck/publication.ts), the stream while it
-     *  runs, the last commit DuckDB applied */
+    /** REPLICATION: the publication and slot the `replication` tables are read through (`owned`: the publication is
+     *  Mason's own, made and kept equal to the replicated tables; else the operator named it, and it is only read —
+     *  src/duck/publication.ts), null in a run that cannot stream (the demo's); the stream while it runs, the last commit
+     *  DuckDB applied */
     replication;
+    /** told when the slot is made (true) and when it is dropped, verified gone (false): the run records it, so `mason
+     *  destroy` drops what was made by its own name (src/cli/dev.ts) */
+    onReplication;
+    /** the last moment the stream had everything the database wrote (a keepalive with nothing pending, a batch applied):
+     *  a streamed table's copy is current as of then (`keptOf`'s syncedAt) */
+    streamCurrentAt = null;
     stream = null;
     appliedLsn = 0n;
     /** the slot has a row in `_mason.stream_state`: what this copy applied of it is known */
@@ -472,8 +672,13 @@ export class Sync {
     held = new Map();
     /** REPLICATION: what the stream applies, by source — the tables joined, and those held — read at each change */
     streamed = new Map();
+    /** the last `StreamedTable.stay` given (`refreshStreamed`) */
+    lastStay = 0;
     /** a NAMED publication's gaps: each added table it does not carry, with the refusal (neither copied nor streamed) */
     unpublished = new Map();
+    /** the error each table a named publication did not carry was given (`settlePrepared`): cleared by the pass that finds
+     *  it carried again, and by nothing else that pass */
+    gapErrors = new Map();
     /** a named publication that does not publish TRUNCATE has been said (once a run) */
     truncateSaid = false;
     /** the last pass failed: in replication mode it is tried again after the interval, the stream started by it */
@@ -486,12 +691,16 @@ export class Sync {
      *  (a pass kicked sooner leaves it stopped) */
     streamFailures = 0;
     streamAt = 0;
-    /** when each streamed table's rows were last counted for the ledger */
-    countedAt = new Map();
-    /** when each table was last copied or polled (`_mason.poll_state.polled_at`), as an unsynced table's state says it */
+    /** when each copy was last brought current, and how (`Synced`): seeded at `open` from the ledger, moved by every
+     *  swap, poll commit and stream batch */
+    synced = new Map();
+    /** where the sync's failures and notable events go (src/duck/events.ts `SyncEvents.record`): never the writer's turn */
+    onEvent;
+    /** when each table was last copied or polled, its `syncedAt`: `_mason.poll_state.polled_at` and nothing else — the
+     *  value `pollStateSql` wrote is the one set here once its transaction commits, and `readPolledAt` only moves a time
+     *  forward, so nothing moves it back (a time read at the commit stood until that read replaced it: a `syncedAt` that
+     *  went backwards). A copy's is its watermark's, taken before the swap; `copied_at`, after it, is `Synced.at`'s */
     polledAt = new Map();
-    /** the tables over the poll's row limit already said in the log (said once, when first left out) */
-    leftOut = new Set();
     /** the store's writer: the stream's batches, the polls, the source's attachment and every swap, one turn at a time */
     writerLane;
     /** the rebuilds' own connection (`open`): a copy or a catch-up, beside the writer's work */
@@ -505,7 +714,6 @@ export class Sync {
     /** the source attached for this many users (a pass, a rebuild): DETACHed when the last ends (`detach`) */
     sourceUsers = 0;
     currentSchema;
-    database;
     /** what the catalog last built from: replaced (a new object) only when it changes */
     schemaKey = "";
     /** REPLICATION, WHERE THE STREAM IS (`streamStatus`, the stream's log): the changes it applied this run by table, and
@@ -540,15 +748,29 @@ export class Sync {
     catchingUp = null;
     /** the stream's last failure and when it starts again; cleared when it starts */
     streamFailure = null;
+    /** A WHOLE-SYNC FAILURE NOT YET OVER, as its event said it (`table: null`): the stream stopped, over when it next applies
+     *  a batch; the publication and slot could not be made ready, over when a pass makes them so; the database's attach,
+     *  over when an attach succeeds. Its end is a `recovered` event of no table, which lets the next such failure be said again
+     *  (src/duck/events.ts: a failure said word for word within an hour is one event unless it recovered between) */
+    wholeFailure = { stream: null, prepare: null, attach: null };
     /** the database's position as last read (`databasePosition`), and the read in flight */
     dbPosition = null;
+    /** the slot's WAL as last read (`databasePosition`, at most every SLOT_READ_MS), and when */
+    slotWal = null;
     dbPositionRead = null;
     /** THE STORED JSON PATHS (src/duck/kept.ts): every write below computes them; the plans read them */
     kept;
+    /** THE GENERATED TABLES (src/duck/generated.ts): every commit that changes a copy marks them, the rebuild queue runs them */
+    generated;
+    /** the connection their runs read and write on (`open`), set up as a session: what `stop` interrupts */
+    generatedLane = null;
+    /** the generated lane's session set-up: settled before each plan and run (`GeneratedHost.settle`) */
+    generatedSession = null;
+    /** the review's check's own connection and its set-up, never the run's (`GeneratedHost.checkConnection`) */
+    generatedCheck = null;
     constructor(store, source, database, log, intervalMs, mode = "poll", replication = null, options = {}) {
         this.store = store;
         this.source = source;
-        this.database = database;
         this.log = log;
         this.intervalMs = intervalMs;
         this.mode = mode;
@@ -556,16 +778,18 @@ export class Sync {
         this.copyChunkRows = options.copyChunkRows ?? COPY_CHUNK_ROWS;
         this.copyParallel = options.copyParallel ?? COPY_PARALLEL;
         if (!Number.isInteger(this.copyParallel) || this.copyParallel < 1 || this.copyParallel > COPY_PARALLEL_MAX) {
-            throw new Error(`a copy reads with 1 to ${COPY_PARALLEL_MAX} readers, not ${this.copyParallel} (Mason bug: report it; copyParallelOf reads MASON_COPY_PARALLEL)`);
+            throw new Error(`a first sync reads with 1 to ${COPY_PARALLEL_MAX} readers, not ${this.copyParallel} (Mason bug: report it; copyParallelOf reads MASON_COPY_PARALLEL)`);
         }
         this.copyChunkSeconds = options.copyChunkSeconds ?? COPY_CHUNK_SECONDS;
         if (!(this.copyChunkSeconds > 0))
-            throw new Error(`a copy's chunk takes a positive number of seconds, not ${this.copyChunkSeconds} (Mason bug: report it; copyChunkSecondsOf reads MASON_COPY_CHUNK_SECONDS)`);
+            throw new Error(`a first sync's chunk takes a positive number of seconds, not ${this.copyChunkSeconds} (Mason bug: report it; copyChunkSecondsOf reads MASON_COPY_CHUNK_SECONDS)`);
         this.onChunk = options.onChunk;
-        this.diskFree = options.diskFree ?? ((dir) => { const st = fs.statfsSync(dir); return st.bavail * st.bsize; });
+        this.onEvent = options.onEvent ?? (() => undefined);
+        this.diskFree = options.diskFree ?? freeBytesAt;
         if (mode === "replication" && replication === null)
             throw new Error("replication mode needs its slot and publication (Mason bug: report it)");
         this.replication = replication;
+        this.onReplication = options.onReplication;
         this.currentSchema = { database, tables: [] };
         this.writerLane = { conn: store.writer, inFlight: false };
         this.kept = new KeptJsonPaths(store, {
@@ -576,6 +800,55 @@ export class Sync {
             rebuilding: (source) => this.rebuildingNow?.source === source,
             log: (line) => this.log(line),
         }, { enabled: options.json?.enabled ?? true, ...options.json });
+        const generatedLane = () => {
+            if (this.generatedLane === null)
+                throw new Error("the generated tables' connection is not open (Mason bug: report it)");
+            return this.generatedLane;
+        };
+        this.generated = new GeneratedTables(store, {
+            onWriter: (f) => this.onWriter(f),
+            connection: () => generatedLane().conn,
+            settle: async () => {
+                if (this.generatedSession === null)
+                    throw new Error("the generated tables' connection is not open (Mason bug: report it)");
+                await this.generatedSession.settle(NO_ROLE_SESSION);
+            },
+            checkConnection: () => {
+                if (this.generatedCheck === null)
+                    throw new Error("the generated tables' check connection is not open (Mason bug: report it)");
+                return this.generatedCheck.conn;
+            },
+            settleCheck: async () => {
+                if (this.generatedCheck === null)
+                    throw new Error("the generated tables' check connection is not open (Mason bug: report it)");
+                await this.generatedCheck.setup.settle(NO_ROLE_SESSION);
+            },
+            enqueue: (name) => this.enqueue(name, { kind: "generated" }),
+            interruptible: (f) => this.interruptible(generatedLane(), f),
+            added: (name) => this.addedAs(name),
+            syncedAt: (base) => this.synced.get(base)?.at ?? null,
+            rebuildCatalog: () => this.rebuildSchema(),
+            schema: () => this.currentSchema,
+            retryDelayMs: copyRetryDelayMs,
+            stopping: (e) => e instanceof Stopping,
+            log: (line) => this.log(line),
+            event: (e) => this.event(e),
+        }, options.generated ?? {});
+    }
+    /**
+     * A BASE IS THERE WHEN THE CATALOG HOLDS IT (issue 387), the generated tables' `added` (src/duck/generated.ts
+     * `GeneratedHost.added`): `copied` only when the copy is recorded copied AND the catalog's schema (`currentSchema`, what
+     * the listener's catalog is replaced from and every definition is planned over) holds the table; a table the sources
+     * file adds that the catalog does not hold yet is `adding`, whatever its copy's phase. The copy records `copied` before
+     * its rebuild of the catalog (which reads that record), and the rebuild waits behind any other: said `copied` from the
+     * phase alone, a definition planned in between met 42P01 for a synced table and was refused, and a run could be planned
+     * over a catalog without its base. The one place this is decided: the check and `ready` read it.
+     */
+    addedAs(name) {
+        const t = this.tables.get(name);
+        if (t !== undefined)
+            return this.states.get(name)?.phase === "copied" && this.currentSchema.tables.some((x) => x.schema === t.schema && x.name === t.table) ? "copied" : "adding";
+        return this.views.some((v) => `${v.schema ?? "public"}.${v.name}` === name) ? "view" : null;
     }
     /** the rebuilds' connection: open from `open` until `stop` */
     get rebuilder() {
@@ -583,6 +856,30 @@ export class Sync {
             throw new Error("the sync's rebuild connection is not open (Mason bug: report it)");
         return this.rebuilderLane;
     }
+    /** an event of the sync, to its record (src/duck/events.ts), which never throws into the sync; a sink that does is
+     *  said, and the sync goes on (its state and its log line hold what happened) */
+    event(e) {
+        try {
+            this.onEvent(e);
+        }
+        catch (x) {
+            this.log(`the sync's event (${e.kind}${e.table ? ` ${e.table}` : ""}) could not be recorded: ${this.errorText(x)}`);
+        }
+    }
+    /** A CAUGHT ERROR'S WORDS, AS THE SYNC REPEATS THEM (src/lib/secret-mask.ts `errorText`): every engine or driver
+     *  error becomes text here, once, where it enters — a log line, an event, a table's `error`, an answer is built from
+     *  it — a `password=` value masked, nothing else changed (no error the sync meets holds the password: it travels in
+     *  the temporary secret alone, whose own error is never repeated). A decision never reads these words: it reads
+     *  `messageOf`, the raw ones. tests/secret-mask.test.ts holds src/duck/sync.ts and stream.ts to both */
+    errorText(e, o = {}) { return errorText(e, o); }
+    /** a whole-sync failure (`wholeFailure`) is over: said once, as a `recovered` event of no table */
+    recovered(what, words) {
+        const was = this.wholeFailure[what];
+        if (was === null)
+            return;
+        this.wholeFailure[what] = null;
+        this.event({ kind: "recovered", table: null, message: `${words} (it had failed: ${was.split("\n")[0]})` });
+    }
     /** `f` on the writer's next turn: once every job queued before it has ended, so no other job's statement lands inside
      *  its transaction. A job never queues another and waits for it (it would wait for itself) */
     onWriter(f) {
@@ -597,7 +894,9 @@ export class Sync {
         // the re-sort's count of rows written out of key order (in the earlier layout): gone with the key order
         for (const gone of ["written", "counted"])
             await this.store.writer.run(`ALTER TABLE ${MASON_SCHEMA}.copy_state DROP COLUMN IF EXISTS ${gone}`);
-        await this.store.writer.run(`CREATE TABLE IF NOT EXISTS ${MASON_SCHEMA}.poll_state (source VARCHAR PRIMARY KEY, snapshot VARCHAR, polled_at TIMESTAMPTZ)`);
+        await this.store.writer.run(`CREATE TABLE IF NOT EXISTS ${MASON_SCHEMA}.poll_state (source VARCHAR PRIMARY KEY, snapshot VARCHAR, polled_at TIMESTAMPTZ, sync VARCHAR)`);
+        // the sync each table was last polled or copied under (src/lib/table-sync.ts syncText): a change is caught up by one poll
+        await this.store.writer.run(`ALTER TABLE ${MASON_SCHEMA}.poll_state ADD COLUMN IF NOT EXISTS sync VARCHAR`);
         // replication mode's record: per slot, the end of the last commit applied, in the same transaction as its rows
         await this.store.writer.run(`CREATE TABLE IF NOT EXISTS ${MASON_SCHEMA}.stream_state (slot VARCHAR PRIMARY KEY, lsn VARCHAR, applied_at TIMESTAMPTZ)`);
         // the tables copied (or under a new slot) and not yet caught up by their one poll (`behind`), written
@@ -619,10 +918,12 @@ export class Sync {
             this.slotKnown = r.length > 0;
             this.appliedLsn = r.length > 0 ? parseLsn(String(r[0][0])) : 0n;
         }
-        for (const [source, snapshot] of (await this.store.writer.runAndReadAll(`SELECT source, snapshot FROM ${MASON_SCHEMA}.poll_state`)).getRowsJS()) {
+        for (const [source, snapshot, sync] of (await this.store.writer.runAndReadAll(`SELECT source, snapshot, sync FROM ${MASON_SCHEMA}.poll_state`)).getRowsJS()) {
             this.snapshots.set(source, snapshot);
+            this.recordedSync.set(source, sync);
         }
         await this.readPolledAt();
+        await this.scrubLedger();
         const r = await this.store.writer.runAndReadAll(`SELECT source, phase, "rows", bytes, seconds, epoch_ms(copied_at), error, columns::VARCHAR FROM ${MASON_SCHEMA}.copy_state`);
         for (const row of r.getRowsJS()) {
             const [source, phase, rows, bytes, seconds, copiedMs, error, columns] = row;
@@ -635,13 +936,58 @@ export class Sync {
             }
             this.states.set(source, { source, phase: phase === "copying" ? "waiting" : phase, rows: rows === null ? null : Number(rows), bytes: bytes === null ? null : Number(bytes), seconds, copiedAt, error });
         }
+        await this.readSynced();
         await this.findRetired();
         this.removeStageLeftovers();
         // the stored JSON paths, before the catalog serves anything: each served copy's view, what the file holds
         await this.kept.open();
+        // the run's connection is a session's, set up by the one set-up (src/duck/store.ts `SessionSetup`): a plan's SQL reads it
+        const conn = await this.store.instance.connect();
+        this.generatedSession = await SessionSetup.open(conn, GENERATED_SESSION);
+        this.generatedLane = { conn, inFlight: false };
+        const checkConn = await this.store.instance.connect();
+        this.generatedCheck = { conn: checkConn, setup: await SessionSetup.open(checkConn, GENERATED_SESSION) };
+        await this.generated.open();
         this.catalog = await this.store.instance.connect();
         await this.rebuildSchema();
     }
+    /**
+     * THE LEDGER SCRUBBED OF A PASSWORD AN EARLIER MASON WROTE (issue 599): before the engine was given the credentials
+     * as a secret, a failed connection's error held `password='…'`, and every table's error (`copy_state.error`) and every
+     * event (`sync_events.message`) written then kept it, shown by mason status and the web page for as long as they stand.
+     * At every open, those two free-text fields alone are read where they hold a `password=` keyword, its value masked
+     * (`maskPasswordKeyword`: the exact leaked form, never a substring of the password now, which a table's name may hold)
+     * and written back by bound parameters where that changed them, said in the log with the way out: rotate the password.
+     */
+    async scrubLedger() {
+        const w = this.store.writer;
+        const KEYWORD = "%password%=%";
+        let scrubbed = 0;
+        const errors = (await w.runAndReadAll(`SELECT source, error FROM ${MASON_SCHEMA}.copy_state WHERE error ILIKE $1`, [KEYWORD])).getRowsJS();
+        for (const [source, error] of errors) {
+            const masked = maskPasswordKeyword(error);
+            if (masked === error)
+                continue;
+            await w.run(`UPDATE ${MASON_SCHEMA}.copy_state SET error = $1 WHERE source = $2`, [masked, source]);
+            scrubbed++;
+        }
+        // the events' table is SyncEvents' (src/duck/events.ts), opened before the sync by the run; a test's store may have none
+        const events = (await w.runAndReadAll(`SELECT count(*) FROM duckdb_tables() WHERE schema_name = $1 AND table_name = 'sync_events'`, [MASON_SCHEMA])).getRowsJS();
+        if (Number(events[0][0]) > 0) {
+            const rows = (await w.runAndReadAll(`SELECT DISTINCT message FROM ${MASON_SCHEMA}.sync_events WHERE message ILIKE $1`, [KEYWORD])).getRowsJS();
+            for (const [message] of rows) {
+                const masked = maskPasswordKeyword(message);
+                if (masked === message)
+                    continue;
+                const changed = await w.run(`UPDATE ${MASON_SCHEMA}.sync_events SET message = $1 WHERE message = $2`, [masked, message]);
+                scrubbed += changed.rowsChanged;
+            }
+        }
+        if (scrubbed > 0) {
+            this.log(`removed the database's password from ${scrubbed} error row(s) an earlier Mason wrote to its record of the sync (issue 599): ` +
+                `it was shown by mason status, mason logs --events and the web page, and may stand in .mason/*.log files — change the database user's password (ALTER ROLE … PASSWORD), then delete those log files`);
+        }
+    }
     /** the tables the project adds now (its sources file): a new one is copied at the next pass unless its copy is already
      *  here and current (said as its records say it, `addedText`), a removed one dropped.
      *  What it returns is the catalog rebuilt over them (never rejected: a failure is said in the log) */
@@ -655,11 +1001,51 @@ export class Sync {
         const added = tables.filter((t) => !before.has(t.source));
         const removed = [...before.keys()].filter((s) => !this.tables.has(s));
         if (added.length)
-            this.log(addedText(added.map((t) => this.addedStatus(t)), this.keptWords()));
+            this.log(addedText(added.map((t) => this.addedStatus(t))));
+        // A TABLE WHOSE SYNC CHANGED — by mason add --sync now, or by hand since its last poll (the ledger's record) — keeps
+        // its copy and is caught up by ONE poll now, whatever it changed to, then kept as it says: never copied again
+        for (const t of tables) {
+            const now = syncText(this.syncOf(t)), prev = before.get(t.source);
+            const was = prev !== undefined ? syncText(this.syncOf(prev)) : this.recordedSync.get(t.source) ?? null;
+            if (was === null || was === now)
+                continue;
+            this.due.delete(t.source);
+            // recopy copies every table again whatever its sync, and a table whose columns changed too is copied again with
+            // them, its new sync recorded at that copy's swap
+            const copied = this.states.get(t.source)?.phase === "copied" && this.snapshots.has(t.source) && this.copiedAs.get(t.source) === columnsKey(t.columns);
+            if (this.mode === "recopy" || !copied)
+                continue;
+            if (this.replicated(t)) {
+                // INTO THE STREAM (poll or off → replication): caught up by ONE poll with the stream's changes of it held from
+                // just before that poll (`catchUp`), as a slot new to the copy is — once the pass has the publication carry it
+                // (`prepareReplication` runs before the pass queues the catch-up). Marked in `_mason.catch_up`, on the writer's
+                // turn and so before the catch-up starts: the stream acknowledges what it holds, so a run that dies between
+                // the catch-up's poll and the held changes' apply must catch it up again (its recorded sync is already the new)
+                this.switched.delete(t.source);
+                const why = `after its sync changed from ${was}`;
+                if (!this.behind.has(t.source)) {
+                    const mark = { why };
+                    this.behind.set(t.source, mark);
+                    void this.onWriter(() => this.store.writer.run(`INSERT OR REPLACE INTO ${MASON_SCHEMA}.catch_up VALUES (${literal(t.source)}, ${literal(why)}, now())`)).catch((e) => {
+                        // its next start catches it up again only by this row: said, and the mark kept for this run's own catch-up
+                        this.log(`${t.source}: its catch-up could not be recorded (a stop before it ends catches it up again only if its sync changes): ${this.errorText(e)}`);
+                    });
+                }
+            }
+            else {
+                // OUT OF THE STREAM, or between off and poll: it leaves the stream at its next batch (`refreshStreamed`) and the
+                // next pass polls it from its watermark, which every change since is at or past
+                this.switched.add(t.source);
+            }
+            // said, and recorded as the sync's event (src/duck/events.ts): what a table's sync was is history the log alone loses
+            const switched = `sync: ${was} → ${now}: its synced data is kept, and caught up by one poll now${this.replicated(t) ? ", then streamed" : ""}`;
+            this.log(`${t.source}: ${switched}`);
+            this.event({ kind: "sync_changed", table: t.source, message: switched });
+        }
         // loud: the copy goes with the table's entry, and comes back only by reading the source again (the test server: a 53 GB
         // copy, 21 minutes of a production replica, dropped by a project file moved aside)
         if (removed.length)
-            this.log(`removed ${removed.join(", ")}: no longer added, so ${removed.length === 1 ? "its copy is" : "their copies are"} DROPPED at the next pass — mason add copies ${removed.length === 1 ? "it" : "them"} again from the source, whole`);
+            this.log(`removed ${removed.join(", ")}: no longer added, so ${removed.length === 1 ? "its synced data is" : "their synced data is"} DROPPED at the next pass — mason add syncs ${removed.length === 1 ? "it" : "them"} again from the source, whole`);
         for (const t of tables)
             if (!this.states.has(t.source))
                 this.states.set(t.source, { source: t.source, phase: "waiting", rows: null, bytes: t.bytes, seconds: null, copiedAt: null, error: null });
@@ -671,7 +1057,7 @@ export class Sync {
                 this.retries.delete(t.source);
         }
         // the tables copied before are served at once, not after this start's first pass (its copies may take hours)
-        const built = this.rebuildSchema().catch((e) => this.log(`the catalog could not be rebuilt (it is at the next pass): ${e instanceof Error ? e.message : String(e)}`));
+        const built = this.rebuildSchema().catch((e) => this.log(`the catalog could not be rebuilt (it is at the next pass): ${this.errorText(e)}`));
         this.kick();
         return built;
     }
@@ -684,33 +1070,117 @@ export class Sync {
         // a named publication's gap is said again by the pass, which refuses the table by name until its owner adds it
         if (st?.error?.startsWith("replication: "))
             return { source: t.source, refused: firstLine(st.error.slice("replication: ".length)) };
-        const copy = st === undefined ? "never copied"
-            : st.phase === "failed" ? `its last copy failed: ${firstLine(st.error)}`
-                : st.phase !== "copied" ? "its copy has not finished"
-                    : this.retired.has(t.source) ? "its copy is in an older Mason's layout, key order with an index"
-                        : this.copiedAs.get(t.source) !== columnsKey(t.columns) ? "its columns changed"
-                            : !this.snapshots.has(t.source) ? "a numeric value outgrew its copy's DECIMAL"
-                                : null;
+        const copy = st === undefined ? "never synced"
+            : st.phase === "failed" ? `its first sync failed: ${firstLine(st.error)}`
+                : st.phase !== "copied" ? "its first sync has not finished"
+                    : this.retired.has(t.source) ? `it is ${this.retired.get(t.source).short}`
+                        : this.readAgainWhy(t);
         if (copy !== null)
             return { source: t.source, copy };
         const b = this.behind.get(t.source);
         if (b !== undefined)
             return { source: t.source, behind: b.why };
-        if (this.replication !== null && !this.slotKnown)
-            return { source: t.source, behind: `slot ${this.replication.slot} is new to this copy` };
-        return { source: t.source, unsynced: this.mode === "poll" && overPollLimit(t) };
+        if (this.replicated(t) && this.replication !== null && !this.slotKnown)
+            return { source: t.source, behind: `slot ${this.replication.slot} is new to the synced data` };
+        const off = this.mode !== "recopy" && this.syncOf(t).mode === "off";
+        return { source: t.source, kept: this.keptWords(t), off };
     }
-    /** how a copy that is current is kept so, in this run's mode: the start line's words (`addedText`) */
-    keptWords() {
+    /** how a copy that is current is kept so, in this run's mode and by its sync: the start line's words (`addedText`) */
+    keptWords(t) {
         const every = `${Number((this.intervalMs / 1000).toFixed(1))} s`;
-        return this.mode === "replication" ? `streamed from ${formatLsn(this.appliedLsn)}`
-            : this.mode === "poll" ? `polled every ${every}` : `copied again whole every ${every}`;
+        const s = this.syncOf(t);
+        return this.mode === "recopy" ? `read again whole every ${every}`
+            : s.mode === "replication" ? `streamed from ${formatLsn(this.appliedLsn)}`
+                : s.mode === "off" ? `sync: off (read again only by mason sync ${t.source})` : syncWords(s);
+    }
+    /** how a table is kept current, as the sources file says (`AddedTable.sync`); a table with none — a test's — polled at
+     *  the sync's own interval */
+    syncOf(t) {
+        if (t.sync !== undefined)
+            return t.sync;
+        return this.mode === "replication" ? { mode: "replication" } : { mode: "poll", every: intervalOf(this.intervalMs / 1000), seconds: this.intervalMs / 1000 };
+    }
+    /** a table the stream keeps current: its sync is `replication` (never in a run that copies every table again whole) */
+    replicated(t) {
+        return this.mode !== "recopy" && this.syncOf(t).mode === "replication";
+    }
+    /** the added tables the stream keeps current, in the project's order */
+    replicatedTables() {
+        return [...this.tables.values()].filter((t) => this.replicated(t));
+    }
+    /** THE RUN STREAMS NOW: a table's sync is `replication` (the slot is made, or kept, and the stream runs) */
+    streams() {
+        return this.replication !== null && this.replicatedTables().length > 0;
+    }
+    /**
+     * WHEN A TABLE'S NEXT POLL IS DUE (ms since the epoch), or null when none is: a table whose sync changed at once
+     * (`switched`), unless a failed attempt set its next; an `off` one never; a polled one at `due`, else its last poll's
+     * time in the ledger plus its interval (a restart does not poll a table before its interval), else now.
+     */
+    dueAt(t) {
+        const s = this.syncOf(t), d = this.due.get(t.source);
+        if (s.mode !== "poll" && !this.switched.has(t.source))
+            return null;
+        if (d !== undefined)
+            return d;
+        if (this.switched.has(t.source) || s.mode !== "poll")
+            return 0;
+        const at = this.polledAt.get(t.source);
+        return at === undefined ? 0 : Date.parse(at) + s.seconds * 1000;
+    }
+    /** a table polled (by a pass, `mason sync` or its catch-up) in `ms`: its next poll after its interval, stretched to four
+     *  times that poll (`nextPollDelayMs`), and its sync now the one recorded (the poll wrote it, `poll`) */
+    polledNow(t, ms) {
+        const s = this.syncOf(t);
+        this.switched.delete(t.source);
+        this.lastPollMs.set(t.source, ms);
+        this.recordedSync.set(t.source, syncText(s));
+        if (s.mode === "poll")
+            this.due.set(t.source, nextPollAt(Date.now(), s.seconds, ms));
+        else
+            this.due.delete(t.source);
+    }
+    /**
+     * WHAT THIS RUN MEASURED OF A TABLE, for `mason add`'s estimate of what polling it costs the database
+     * (src/cli/source-edit.ts pollCost): its last poll's time, and ONE reader's rate at its copy — the copy reading now,
+     * else the last copy's rows over its time and its readers. Null when nothing of it is measured.
+     */
+    measured(source) {
+        const st = this.states.get(source);
+        const live = this.copyLive.get(source)?.rate?.rowsPerSecond ?? null;
+        const copied = st?.phase === "copied" && st.rows && st.seconds ? st.rows / st.seconds / this.copyParallel : null;
+        const last = this.lastPollMs.get(source) ?? null;
+        return last === null && live === null && copied === null ? null : { lastPollMs: last, copyRowsPerSecond: live ?? copied };
+    }
+    /**
+     * HOW LONG UNTIL THE NEXT PASS, in poll mode (null: none until something kicks one — every table `off`, or nothing
+     * copied yet): a pass that failed, or a table waiting for a copy nothing queued, after the sync's interval; else when
+     * the first polled table is due — and at least four times the last pass took, so the passes' polls together never
+     * take more than a fifth of the source's time. `recopy` copies every table again every interval, stretched the same.
+     */
+    nextPassDelay() {
+        if (this.passFailed || this.waiting())
+            return this.intervalMs;
+        if (this.mode === "recopy")
+            return nextPollDelayMs(this.intervalMs, this.lastPassMs);
+        // a table copying, queued, or owed its catch-up is not polled by a pass (its catch-up polls it, then `rearm`): counted
+        // as due it would run a pass every few ms that polls nothing and attaches the source each time
+        const dues = [...this.tables.values()].filter((t) => this.pollable(t)).flatMap((t) => this.dueAt(t) ?? []);
+        return dues.length ? passDelayMs(Math.min(...dues), Date.now(), this.lastPassMs) : null;
+    }
+    /** a table a pass would poll now if it were due: copied, not queued or rebuilt, and not owed its catch-up */
+    pollable(t) {
+        return !this.needsCopy(t) && !this.behind.has(t.source) && !this.queued.has(t.source) && this.rebuildingNow?.source !== t.source;
     }
     /** the source's views (src/cli/preflight.ts VIEWS_SQL), served over the copied tables: in the catalog from the next
      *  pass. A view over a table that is not copied is left out of it (said in the catalog's log) */
     setViews(views) {
         this.views = views.map((v) => ({ schema: v.schema, name: v.name, definition: v.definition, ...(v.comment ? { description: v.comment } : {}) }));
     }
+    /** the source's collations (src/duck/collation.ts): the catalog declares each it lacks, from the next pass */
+    setCollations(collations) {
+        this.collations = collations.map((c) => ({ schema: c.schema, name: c.name, provider: c.provider, collate: c.collate, locale: c.locale, deterministic: c.deterministic }));
+    }
     /** every table read again from the start: the database was restored to another server (src/cli/dev.ts sourceMove) */
     async rereadAll() {
         // from watermark 0 every row is read and written again; the count check deletes what the new server lacks
@@ -722,7 +1192,7 @@ export class Sync {
         const now = Date.now();
         // in the project's order, whatever order the copies ran and were recorded in (`copyOrder`)
         return [...this.tables.keys()].flatMap((source) => this.states.get(source) ?? [])
-            .map((s) => this.retired.has(s.source) ? { ...s, retired: RETIRED_LAYOUT } : s)
+            .map((s) => { const r = this.retired.get(s.source); return r !== undefined ? { ...s, retired: r.layout } : s; })
             // a copy's chunks as they are NOW: the rows the ones in flight have read by now at the measured rate
             .map((s) => { const l = this.copyLive.get(s.source); return s.phase === "copying" && l !== undefined ? { ...s, progress: copyProgressNow(l, Date.now()) } : s; })
             // how it is kept current, and a table the passes leave as copied, from ONE derivation (`keptOf`)
@@ -731,33 +1201,55 @@ export class Sync {
             if (t === undefined)
                 return s;
             const kept = this.keptOf(t, now);
-            return { ...s, kept, ...(kept.by === "poll" && kept.unsynced !== undefined ? { unsynced: { reason: kept.unsynced, asOf: kept.polledAt } } : {}) };
+            return { ...s, kept };
+        })
+            // when it was last brought current, whether it waits for its catch-up, and whether it is being rebuilt now
+            .map((s) => {
+            const synced = this.synced.get(s.source), behind = this.behind.get(s.source)?.why;
+            const rebuilding = this.rebuildingNow?.source === s.source ? this.rebuildingNow.kind : undefined;
+            return { ...s, ...(synced ? { synced } : {}), ...(behind !== undefined ? { behind } : {}), ...(rebuilding ? { rebuilding } : {}) };
         });
     }
     /**
      * HOW AN ADDED TABLE IS KEPT CURRENT, NOW (`KeptCurrent`): the run's mode, then in replication mode its part in the
-     * stream (`streamTable`, what `streamStatus` says of it) and where the stream is; in poll mode its last poll and
-     * whether the passes leave it as copied. The one place it is derived: `state` carries it to `mason status` and the
-     * listener's EXPLAIN alike.
+     * stream (`streamTable`, what `streamStatus` says of it) and where the stream is; in poll mode its sync, its last copy
+     * or poll and its next. The one place it is derived: `state` carries it to `mason status` and the listener's EXPLAIN
+     * alike.
      */
     keptOf(t, now) {
         const st = this.states.get(t.source);
-        if (this.mode === "poll") {
+        const sync = this.syncOf(t);
+        if (this.mode !== "recopy" && sync.mode !== "replication") {
             const polledAt = this.polledAt.get(t.source) ?? null;
-            // a copy the passes do not keep current now, and why: not copied (waiting, being copied, its copy failed:
-            // `needsCopy` holds for every phase but copied), to be copied again (its columns changed, a numeric outgrew it, a
-            // retired layout), or caught up first (`pass`'s `polled`, and a table not yet caught up on the writer's turn)
-            const pending = this.needsCopy(t) || this.behind.has(t.source) ? this.notStreamedWhy(t.source) : null;
-            return { by: "poll", polledAt, ...(overPollLimit(t) ? { unsynced: OVER_POLL_LIMIT } : {}), ...(pending !== null ? { pending } : {}) };
+            // a copy the passes do not keep current now, and why, from what a poll of it asks (`pollable`): not copied (waiting,
+            // being copied, its copy failed: `needsCopy` holds for every phase but copied), to be copied again (its columns
+            // changed, a numeric outgrew it, a retired layout), caught up first, or its rebuild not ended yet: the moment this
+            // says nothing is pending, `mason sync` of it runs
+            const pending = this.pollable(t) ? null : this.notStreamedWhy(t.source);
+            const next = pending === null ? this.dueAt(t) : null;
+            const promise = keptPromise({ mode: sync.mode === "off" ? "off" : "poll", intervalSeconds: sync.mode === "poll" ? sync.seconds : 0, lastPollMs: this.lastPollMs.get(t.source) ?? null,
+                lastPassMs: this.lastPassMs, pending, notRunning: null, passFailed: this.passFailed, dueMs: next, now });
+            return { by: "poll", sync, syncedAt: polledAt, nextAt: next === null ? null : new Date(Math.max(next, now)).toISOString(), ...(pending !== null ? { pending } : {}), ...promise };
         }
         // copied again whole every pass, whatever its watermark: only a table not copied now (waiting, being copied, its copy
-        // failed) is not kept current
-        if (this.mode === "recopy")
-            return { by: "recopy", copiedAt: st?.copiedAt ?? null, ...(st?.phase !== "copied" ? { pending: this.notStreamedWhy(t.source) } : {}) };
+        // failed) is not kept current; its synced data is as of its copy's watermark (`polled_at`, taken before the swap)
+        if (this.mode === "recopy") {
+            const pending = st?.phase !== "copied" ? this.notStreamedWhy(t.source) : null;
+            const promise = keptPromise({ mode: "recopy", intervalSeconds: this.intervalMs / 1000, lastPollMs: null, lastPassMs: this.lastPassMs, pending, notRunning: null,
+                passFailed: this.passFailed, dueMs: null, now });
+            return { by: "recopy", copiedAt: st?.copiedAt ?? null, syncedAt: this.polledAt.get(t.source) ?? null, ...(pending !== null ? { pending } : {}), ...promise };
+        }
         const s = this.stream;
         const part = this.streamTable(t, now, s);
-        return { by: "replication", slot: this.replication.slot, state: part.state, why: part.why, position: formatLsn(s?.position() ?? this.appliedLsn),
-            lastCommit: this.lastBatch === null ? null : new Date(this.lastBatch.committedAt).toISOString(), notRunning: this.streamDownWhy(s, st) };
+        // current as of its last copy or poll, or — streamed — the last moment the stream had all the database wrote
+        const polled = this.polledAt.get(t.source) ?? null;
+        const streamed = part.state === "streamed" && this.streamCurrentAt !== null ? new Date(this.streamCurrentAt).toISOString() : null;
+        const syncedAt = streamed !== null && (polled === null || streamed > polled) ? streamed : polled;
+        const notRunning = this.streamDownWhy(s, st);
+        const promise = keptPromise({ mode: "replication", intervalSeconds: 0, lastPollMs: null, lastPassMs: this.lastPassMs, pending: part.state === "streamed" ? null : part.why,
+            notRunning, passFailed: false, dueMs: null, now });
+        return { by: "replication", slot: this.replication?.slot ?? "", state: part.state, why: part.why, position: formatLsn(s?.position() ?? this.appliedLsn),
+            lastCommit: this.lastBatch === null ? null : new Date(this.lastBatch.committedAt).toISOString(), notRunning, syncedAt, ...promise };
     }
     /** why the stream is not running, in the reader's words (null: it runs): its last failure and when it starts again; the
      *  replication check a pass failed (`prepareReplication`, recorded on each copy's state); a slot not made yet; a sync
@@ -770,6 +1262,8 @@ export class Sync {
             return `${firstLine(this.streamFailure.error)} · it starts again after ${clock(this.streamFailure.retryAt)} UTC`;
         if (st?.error?.startsWith("replication: "))
             return firstLine(st.error);
+        if (this.replication === null)
+            return "this run reads no slot, so nothing streams it (the demo database has no change log): give its entry sync: poll <interval>";
         if (!this.slotKnown)
             return `slot ${this.replication.slot} is not made yet: it starts once it is`;
         if (this.stopped)
@@ -796,12 +1290,52 @@ export class Sync {
             return { state: "streamed", why: null };
         return { state: "waiting", why: this.notStreamedWhy(t.source) };
     }
-    /** each table's last copy or poll, from the ledger (a copy writes its watermark there too) */
+    /**
+     * Each table's last copy or poll, from the ledger (a copy writes its watermark there too), ONLY EVER FORWARD: this
+     * SELECT's snapshot may be older than a commit on the rebuilds' connection whose time is set while it is answered
+     * (`committed`, `swap`), so what it read never replaces a later time, and a table it does not hold is dropped (removed:
+     * nothing else drops it) only when no such commit gave it a time meanwhile.
+     */
     async readPolledAt() {
+        const asked = new Map(this.polledAt);
         const r = await this.store.writer.runAndReadAll(`SELECT source, epoch_ms(polled_at) FROM ${MASON_SCHEMA}.poll_state WHERE polled_at IS NOT NULL`);
-        this.polledAt.clear();
-        for (const [source, ms] of r.getRowsJS())
-            this.polledAt.set(source, new Date(Number(ms)).toISOString());
+        const ledger = new Map(r.getRowsJS().map(([source, ms]) => [source, new Date(Number(ms)).toISOString()]));
+        for (const [source, at] of this.polledAt)
+            if (!ledger.has(source) && at === asked.get(source))
+                this.polledAt.delete(source);
+        for (const [source, at] of ledger) {
+            const now = this.polledAt.get(source);
+            if (now === undefined || at > now)
+                this.polledAt.set(source, at);
+        }
+    }
+    /**
+     * EACH COPY'S LAST SYNC AS THE LEDGER KEEPS IT, at a start (`Synced`): the swap and every poll write
+     * `poll_state.polled_at` in their own transaction, and a copy's `copied_at` is recorded right after its swap — so a
+     * copy recorded at or after its table's `polled_at` was last brought current by that copy (its time the copy's
+     * `seconds`), else by a poll (its time unknown: null). In replication mode the stream's last batch
+     * (`stream_state.applied_at`) is newer for a table it streamed; a table not caught up is left at its copy, and one the
+     * named publication does not carry (`unpublished`: never streamed, so the stream's time is not its own) at its copy
+     * or poll. `only`: those tables alone, read again (the pass that found them out of the publication), the others'
+     * last sync kept as it is.
+     */
+    async readSynced(only) {
+        const r = await this.store.writer.runAndReadAll(`SELECT p.source, epoch_ms(p.polled_at), epoch_ms(c.copied_at), c.seconds FROM ${MASON_SCHEMA}.poll_state p ` +
+            `LEFT JOIN ${MASON_SCHEMA}.copy_state c USING (source) WHERE p.polled_at IS NOT NULL`);
+        const streamed = this.replication === null ? [] : (await this.store.writer.runAndReadAll(`SELECT epoch_ms(applied_at) FROM ${MASON_SCHEMA}.stream_state ` +
+            `WHERE slot = $1 AND applied_at IS NOT NULL`, [this.replication.slot])).getRowsJS();
+        const streamMs = streamed.length ? Number(streamed[0][0]) : null;
+        if (only === undefined)
+            this.synced.clear();
+        for (const [source, polled, copied, seconds] of r.getRowsJS()) {
+            if (only !== undefined && !only.has(source))
+                continue;
+            const at = Number(polled);
+            const s = copied !== null && Number(copied) >= at ? { at: new Date(Number(copied)).toISOString(), seconds, by: "copy" }
+                : { at: new Date(at).toISOString(), seconds: null, by: "poll" };
+            const streamedIt = !this.behind.has(source) && !this.unpublished.has(source);
+            this.synced.set(source, streamMs !== null && streamMs > Date.parse(s.at) && streamedIt ? { at: new Date(streamMs).toISOString(), seconds: null, by: "stream" } : s);
+        }
     }
     schema() { return this.currentSchema; }
     start() { this.kick(); }
@@ -819,18 +1353,17 @@ export class Sync {
         }
         this.running = this.pass().then(() => { this.passFailed = false; }, (e) => {
             this.passFailed = true;
-            this.log(`sync pass failed: ${e instanceof Error ? e.message : String(e)}`);
+            this.log(`sync pass failed: ${this.errorText(e)}`);
         }).finally(() => {
             this.running = null;
             if (this.stopped)
                 return;
-            // replication mode: the stream keeps the copies current between passes, and a pass runs when the tables change —
-            // or after the interval, when it failed or a table waits for a copy or catch-up nothing has queued (a copy that
-            // failed waits its turn, `copyRetryDelayMs`)
-            if (this.mode !== "replication")
-                this.timer = setTimeout(() => this.kick(), nextPollDelayMs(this.intervalMs, this.lastPassMs));
-            else if (this.passFailed || this.waiting())
-                this.timer = setTimeout(() => this.kick(), this.intervalMs);
+            // when the next polled table is due (`nextPassDelay`) — the stream keeps a replicated table current between passes,
+            // and a pass runs for it when the tables change — or after the interval, when it failed or a table waits for a copy
+            // or catch-up nothing has queued (a copy that failed waits its turn, `copyRetryDelayMs`)
+            const d = this.nextPassDelay();
+            if (d !== null)
+                this.timer = setTimeout(() => this.kick(), d);
         });
     }
     /** an added table needs a copy or a catch-up that is neither queued nor running: a later pass must queue it */
@@ -873,19 +1406,42 @@ export class Sync {
      */
     followUp(source) {
         const t = this.tables.get(source);
-        if (t === undefined || this.stopped || this.unpublished.has(source) || (!this.needsCopy(t) && !this.behind.has(source)))
+        if (t === undefined || this.stopped || this.unpublished.has(source))
+            return;
+        // copied and caught up: polled from now on, so the next pass is timed again (`rearm`)
+        if (!this.needsCopy(t) && !this.behind.has(source)) {
+            this.rearm();
             return;
+        }
         const at = this.retries.get(source)?.at ?? 0;
         if (at > Date.now())
             this.wakeAt(at);
         else
             this.kick();
     }
-    /** one pass, now, and its end awaited (the one running first, if any), and the copies and catch-ups it queued: what
-     *  a test or a reread waits on */
+    /**
+     * THE NEXT PASS TIMED AGAIN, in poll mode, once a table is copied and caught up: a pass that ended while every table
+     * still copied found none due (`nextPassDelay` skips a table that needs its copy) and set no timer, so without this a
+     * table's polls never began. A pass running sets its own when it ends, from the state then.
+     */
+    rearm() {
+        if (this.stopped || this.running !== null)
+            return;
+        const d = this.nextPassDelay();
+        if (d === null)
+            return;
+        if (this.timer !== null)
+            clearTimeout(this.timer);
+        this.timer = setTimeout(() => this.kick(), d);
+    }
+    /** one pass, now, every polled table taken as due (an `off` one is not: it is polled only when asked), and its end
+     *  awaited (the one running first, if any), and the copies and catch-ups it queued: what a test waits on */
     async once() {
         while (this.running !== null)
             await this.running;
+        for (const t of this.tables.values())
+            if (this.syncOf(t).mode === "poll")
+                this.due.set(t.source, 0);
         this.kick();
         if (this.running !== null)
             await this.running;
@@ -893,34 +1449,54 @@ export class Sync {
             await this.rebuilding;
     }
     /**
-     * A POLL OF EXACTLY THESE TABLES, NOW, whatever their size (`mason sync`; a table over POLL_ROW_LIMIT is polled only
-     * so): a pass of its own, queued behind the one running, in one source snapshot as every poll is. Refused by name
-     * (`PollRefused`) for a table not added or not copied yet, and in a run whose copies are kept current another way.
-     * Its failure is its caller's to say: the copies serve as they were, and the passes go on.
+     * A POLL OF EXACTLY THESE TABLES, NOW, whatever their sync says (`mason sync`: an `off` table is read again only so):
+     * a pass of its own, queued behind the one running, in one source snapshot as every poll is; a polled table's next
+     * poll waits its interval from this one. A replicated table is not polled: its answer is where the stream is
+     * (`streamed`), beside the polled ones'. Refused by name (`PollRefused`) for a table not added or not copied yet, and in a run that copies
+     * every table again whole. Its failure is its caller's to say: the copies serve as they were, and the passes go on.
      */
     async pollNow(sources) {
-        if (this.mode !== "poll") {
-            throw new PollRefused("refused", this.mode === "replication" ? "this run keeps every table current by logical replication, so there is nothing to poll"
-                : "this run copies every table again whole at each pass (MASON_DUCK_SYNC=recopy), so there is nothing to poll");
+        // its failure is the command server's answer, sent as it is: a refusal is Mason's own words, any other error's are
+        // made Mason's here (`errorText`), where they leave the sync
+        try {
+            return await this.pollNowOf(sources);
         }
+        catch (e) {
+            throw e instanceof PollRefused || e instanceof Stopping ? e : new Error(this.errorText(e));
+        }
+    }
+    async pollNowOf(sources) {
+        if (this.mode === "recopy")
+            throw new PollRefused("refused", "this run reads every table again whole at each pass (MASON_DUCK_SYNC=recopy), so there is nothing to poll");
         const tables = sources.map((s) => {
             const t = this.tables.get(s);
             if (t === undefined)
                 throw new PollRefused("not_found", `${s} is not added (mason add adds it)${didYouMean(s, [...this.tables.keys()])}`);
             return t;
         });
+        // a replicated table: the stream keeps it current, so nothing to poll — its answer is where the stream is, and its part
+        const said = () => {
+            const now = Date.now(), position = formatLsn(this.stream?.position() ?? this.appliedLsn);
+            return tables.filter((t) => this.replicated(t)).map((t) => { const p = this.streamTable(t, now, this.stream); return { table: t.source, position, state: p.state, why: p.why }; });
+        };
+        const polled = tables.filter((t) => !this.replicated(t));
+        if (polled.length === 0)
+            return { at: new Date().toISOString(), tables: [], streamed: said() };
         while (this.running !== null)
             await this.running;
         if (this.stopped)
             throw new Stopping();
         // asked after the pass ahead of it: that pass may have copied it, or failed its copy
-        for (const t of tables) {
+        for (const t of polled) {
             const st = this.states.get(t.source);
-            if (st?.phase !== "copied" || !this.snapshots.has(t.source) || this.copiedAs.get(t.source) !== columnsKey(t.columns)) {
-                throw new PollRefused("nothing_yet", `${t.source} is not copied yet (${st?.phase === "failed" ? `its copy failed: ${st.error ?? "mason logs says why"}` : "its copy has not finished"}): mason wait waits for it`);
-            }
-            if (this.retired.has(t.source))
-                throw new PollRefused("nothing_yet", `${t.source} is ${RETIRED_LAYOUT} (its copy serves as it was): it is current once copied — mason wait waits for it`);
+            if (st?.phase !== "copied")
+                throw new PollRefused("nothing_yet", `${t.source} is not synced yet (${st?.phase === "failed" ? `its first sync failed: ${st.error ?? "mason logs says why"}` : "its first sync has not finished"}): mason wait waits for it`);
+            const again = this.readAgainWhy(t);
+            if (again !== null)
+                throw new PollRefused("nothing_yet", `${t.source} is being read again whole (${again}): mason wait waits for it`);
+            const r = this.retired.get(t.source);
+            if (r !== undefined)
+                throw new PollRefused("nothing_yet", `${t.source} is ${r.layout} (its synced data serves as it was): it is current once read again — mason wait waits for it`);
             this.refuseRebuilding(t);
         }
         const poll = (async () => {
@@ -928,8 +1504,12 @@ export class Sync {
             try {
                 // a transaction per table, as the passes poll; a table whose rebuild started since it was asked is refused
                 const found = [];
-                for (const t of tables)
-                    found.push(...await this.onWriter(async () => { this.refuseRebuilding(t); return this.poll(this.writerLane, [t]); }));
+                for (const t of polled) {
+                    const f = await this.onWriter(async () => { this.refuseRebuilding(t); return this.poll(this.writerLane, [t]); });
+                    for (const x of f)
+                        this.polledNow(t, x.ms);
+                    found.push(...f);
+                }
                 return found;
             }
             finally {
@@ -937,12 +1517,21 @@ export class Sync {
             }
         })();
         // the pass slot is held until it ends (kick and once queue behind it); its failure reaches the caller through `poll`
-        this.running = poll.then(() => undefined, () => undefined).finally(() => { this.running = null; });
+        // and the next pass timed again as a pass's end times it (`rearm`): a copy that ended meanwhile found the slot held,
+        // and a polled table's next poll moved past the timer set before
+        this.running = poll.then(() => undefined, () => undefined).finally(() => { this.running = null; this.rearm(); });
         const found = await poll;
-        const missing = tables.filter((t) => !found.some((f) => f.table === t.source));
+        // A SYNC BY HAND IS AN EVENT (src/duck/events.ts `synced`), in the words mason sync and the page's Sync now say:
+        // a scheduled poll that succeeds records nothing (one every few seconds would bury the failures), so without it a
+        // person who synced and then read the events found only an older copy, and read it as a sync lost. A replicated
+        // table asked for is answered with the stream's position and records none: nothing was read for it
+        for (const x of found)
+            this.event({ kind: "synced", table: x.table, message: `synced by hand: ${syncedText(x)}` });
+        const missing = polled.filter((t) => !found.some((f) => f.table === t.source));
         if (missing.length)
-            throw new Error(`${missing.map((t) => t.source).join(", ")} has a numeric value wider than its copy's DECIMAL: it is copied again at the next pass, and current once copied`);
-        return { at: new Date().toISOString(), tables: found };
+            throw new Error(`${missing.map((t) => t.source).join(", ")} has a numeric value wider than its synced DECIMAL column: it is read again whole at the next pass, and current once read`);
+        const streamed = said();
+        return { at: new Date().toISOString(), tables: found, ...(streamed.length ? { streamed } : {}) };
     }
     /**
      * The sync stopped: no pass starts, and the one running ends at once — its long statement (a copy's scan, a poll's
@@ -964,14 +1553,14 @@ export class Sync {
         }
         // the stream, the pass and the rebuild end together: a batch waiting for the writer's turn behind a poll must not
         // wait for that poll, so each connection's long statement is interrupted from the start
-        const interrupt = () => { for (const lane of [this.writerLane, this.rebuilderLane, ...this.copyLanes])
+        const interrupt = () => { for (const lane of [this.writerLane, this.rebuilderLane, this.generatedLane, ...this.copyLanes])
             if (lane?.inFlight)
                 lane.conn.interrupt(); };
         const again = setInterval(interrupt, 50);
         interrupt();
         try {
             // none of them rejects: each says its own failure
-            await Promise.all([this.stream?.stop(), this.running, this.rebuilding, this.kept.stop()]);
+            await Promise.all([this.stream?.stop(), this.running, this.rebuilding, this.kept.stop(), this.generated.stop()]);
             await this.writerTurn;
         }
         finally {
@@ -984,14 +1573,20 @@ export class Sync {
         this.catalog = null;
         this.rebuilderLane?.conn.closeSync();
         this.rebuilderLane = null;
+        this.generatedLane?.conn.closeSync();
+        this.generatedLane = null;
+        this.generatedSession = null;
+        // after `generated.stop`, which waited for the review and so for any check on it
+        this.generatedCheck?.conn.closeSync();
+        this.generatedCheck = null;
     }
     /** a poll asked of a table while it is rebuilt or not yet caught up: refused, by name (it is caught up when that ends) */
     refuseRebuilding(t) {
         const now = this.rebuildingNow?.source === t.source ? this.rebuildingNow.kind : null;
         if (now === null && !this.behind.has(t.source))
             return;
-        const doing = now === "copy" ? "being copied again" : `being caught up by one poll ${this.behind.get(t.source)?.why ?? ""}`.trimEnd();
-        throw new PollRefused("nothing_yet", `${t.source} is ${doing} (its copy serves as it was): it is caught up by one poll when that ends, so there is nothing to poll — mason wait waits for it`);
+        const doing = now === "copy" ? "being read again whole" : `being caught up by one poll ${this.behind.get(t.source)?.why ?? ""}`.trimEnd();
+        throw new PollRefused("nothing_yet", `${t.source} is ${doing} (its synced data serves as it was): it is caught up by one poll when that ends, so there is nothing to poll — mason wait waits for it`);
     }
     /** the source's connection, as the sync's own reads and replication make it (never DuckDB's: that is `attach`) */
     pgOptions() {
@@ -1015,7 +1610,7 @@ export class Sync {
         return columns === undefined ? t : { ...t, columns };
     }
     /**
-     * REPLICATION, BEFORE A PASS COPIES: the publication carries every added table, and the slot exists — so a table
+     * REPLICATION, BEFORE A PASS COPIES: the publication carries every replicated table, and the slot exists — so a table
      * copied now has its changes in the stream from before it joins (src/duck/stream.ts "why replaying is safe"). A slot
      * made now, or one this copy has no record of, carries nothing from before it: the tables already copied are caught
      * up by one poll each before the stream applies their changes (`behind`, recorded with the slot in one transaction).
@@ -1024,7 +1619,7 @@ export class Sync {
      */
     async prepareReplication() {
         const r = this.replication;
-        const tables = [...this.tables.values()];
+        const tables = this.replicatedTables();
         const pg = await PgConnection.connect(this.pgOptions());
         try {
             const identities = new Map((await pg.query(`SELECT n.nspname || '.' || c.relname, c.relreplident FROM pg_class c JOIN pg_namespace n ON n.oid = c.relnamespace ` +
@@ -1034,7 +1629,8 @@ export class Sync {
             const nothing = tables.filter((t) => identities.get(t.source) === "n").map((t) => t.source);
             if (nothing.length) {
                 throw new Error(`${nothing.join(", ")} ${nothing.length === 1 ? "has" : "have"} REPLICA IDENTITY NOTHING: a publication carrying ${nothing.length === 1 ? "it" : "them"} ` +
-                    `would make the app's own UPDATEs and DELETEs fail, so Mason does not add ${nothing.length === 1 ? "it" : "them"}. ALTER TABLE … REPLICA IDENTITY DEFAULT, or mason start --poll`);
+                    `would make the app's own UPDATEs and DELETEs fail, so Mason does not replicate ${nothing.length === 1 ? "it" : "them"}. Give ${nothing.length === 1 ? "its entry" : "their entries"} ` +
+                    `sync: poll <interval> (poll 5m) in the sources file, or ALTER TABLE … REPLICA IDENTITY DEFAULT on the database`);
             }
             if (r.owned)
                 await this.ensurePublication(pg, tables, identities);
@@ -1043,7 +1639,7 @@ export class Sync {
             const slot = await readSlot(pg, r.slot);
             let made = false;
             if (slot.exists && slot.walStatus === "lost") {
-                this.log(`replication slot ${r.slot} was invalidated by the database (wal_status lost: it held more WAL than max_slot_wal_keep_size), so changes are missing from it: made again, and the copies caught up by one poll`);
+                this.log(`replication slot ${r.slot} was invalidated by the database (wal_status lost: it held more WAL than max_slot_wal_keep_size), so changes are missing from it: made again, and the synced tables caught up by one poll`);
                 if (slot.active)
                     throw new Error(`replication slot ${r.slot} is lost and still in use by pid ${slot.activePid}`);
                 await dropSlot(pg, r.slot);
@@ -1054,14 +1650,16 @@ export class Sync {
             if (!slot.exists || slot.walStatus === "lost") {
                 const repl = await PgConnection.connect({ ...this.pgOptions(), replication: true });
                 try {
-                    this.log(`made replication slot ${r.slot} at ${await createSlot(repl, r.slot)} (it holds the database's WAL until Mason reads it: mason destroy, or mason start --poll, drops it)`);
+                    this.log(`made replication slot ${r.slot} at ${await createSlot(repl, r.slot)} (it holds the database's WAL until Mason reads it: mason destroy drops it, and so does a sources file in which no table's sync is replication)`);
                 }
                 finally {
                     repl.close();
                 }
                 made = true;
+                this.onReplication?.(true);
             }
             if (made || !this.slotKnown) {
+                // the replicated tables already copied: the slot carries nothing from before it (a polled one is the poll's)
                 const copied = tables.filter((t) => this.states.get(t.source)?.phase === "copied" && this.snapshots.has(t.source));
                 await this.onWriter(async () => {
                     const w = this.store.writer;
@@ -1087,24 +1685,44 @@ export class Sync {
         finally {
             pg.close();
         }
-        // what the last stream's failure said is the past once the publication and slot are as they should be; a table a
-        // named publication does not carry is refused on its own line (a copy it never had is failed), the others go on
-        await this.onWriter(async () => {
-            for (const t of tables) {
-                const st = this.states.get(t.source);
-                const gap = this.unpublished.get(t.source);
-                if (gap !== undefined) {
-                    const error = `replication: ${gap}`;
-                    if (st.error !== error)
-                        this.log(`${t.source} is not copied or streamed: ${error}`);
-                    await this.record({ ...st, phase: st.phase === "copied" ? "copied" : "failed", error });
+        await this.onWriter(() => this.settlePrepared(tables));
+    }
+    /**
+     * WHAT A PASS'S PUBLICATION CHECK SETTLES, ON THE WRITER'S TURN (`prepareReplication`, once the publication and slot are
+     * as they should be): a table a named publication does not carry is refused on its own line (a copy it never had is
+     * failed), the others go on; a table it carries AGAIN has that gap's error cleared, and a table never copied the last
+     * pass's failure to prepare. NOTHING ELSE: a copy whose stream failed, or that the failed preparation left behind, is
+     * current again only once the stream applies a batch with a position (`applyChanges`) — the publication being right
+     * says nothing of whether its changes are in the copy, and a pass runs while the stream waits out its back-off.
+     */
+    async settlePrepared(tables) {
+        for (const t of tables) {
+            const st = this.states.get(t.source);
+            const gap = this.unpublished.get(t.source);
+            if (gap !== undefined) {
+                const error = `replication: ${gap}`;
+                if (st.error !== error) {
+                    this.log(`${t.source} is not synced or streamed: ${error}`);
+                    this.event({ kind: "stream_failed", table: t.source, message: `not synced or streamed: ${error}` });
                 }
-                else if (st.error?.startsWith("replication: "))
-                    await this.record({ ...st, error: null });
+                this.gapErrors.set(t.source, error);
+                await this.record({ ...st, phase: st.phase === "copied" ? "copied" : "failed", error });
+                continue;
             }
-            // a table the publication stopped carrying leaves the stream; one it carries now may join
-            this.refreshStreamed();
-        });
+            const gapClosed = this.gapErrors.get(t.source);
+            this.gapErrors.delete(t.source);
+            if (st.error === null)
+                continue;
+            if (st.error === gapClosed || (st.phase !== "copied" && st.error === this.wholeFailure.prepare))
+                await this.record({ ...st, error: null });
+        }
+        // a table the publication does not carry was never streamed: its last sync is its copy's or its poll's, never
+        // the stream's time a start credited it with (`readSynced` at `open`, before the publication was read)
+        const credited = tables.filter((t) => this.unpublished.has(t.source) && this.synced.get(t.source)?.by === "stream").map((t) => t.source);
+        if (credited.length)
+            await this.readSynced(new Set(credited));
+        // a table the publication stopped carrying leaves the stream; one it carries now may join
+        this.refreshStreamed();
     }
     /**
      * A publication the operator NAMED: read as it is, verified, never created, altered or dropped (src/duck/publication.ts).
@@ -1113,14 +1731,14 @@ export class Sync {
      */
     async verifyPublication(pg, tables, identities) {
         const name = this.replication.publication;
-        const v = namedPublicationVerdict(await readNamedPublication(pg, name, tables, this.database), tables, identities);
+        const v = namedPublicationVerdict(await readNamedPublication(pg, name, tables), tables, identities);
         if (v.refused !== null)
             throw new Error(v.refused);
         this.unpublished.clear();
         for (const [source, m] of v.tables)
             this.unpublished.set(source, m);
         if (v.noTruncate && !this.truncateSaid) {
-            this.log(`publication ${name} does not publish truncate: a TRUNCATE on the database does not reach the copy (the poll's count would see it; mason start --poll)`);
+            this.log(`publication ${name} does not publish truncate: a TRUNCATE on the database does not reach the synced data (the poll's count would see it: sync: poll <interval> on its entry)`);
             this.truncateSaid = true;
         }
     }
@@ -1154,23 +1772,111 @@ export class Sync {
                 throw new Error(`publication ${name} is FOR ALL TABLES: it is not the one Mason made (drop it, or name another project)`);
             await pg.query(`ALTER PUBLICATION ${pgIdent(name)} SET TABLE ${list}`);
             await pg.query(`ALTER PUBLICATION ${pgIdent(name)} SET (publish = 'insert, update, delete, truncate')`);
-            this.log(`re-pointed publication ${name} at ${tables.map((t) => t.source).join(", ")}`);
+            this.log(`re-pointed publication ${name} at ${tables.map((t) => t.source).join(", ")}: the tables whose sync is replication`);
+        }
+        // VERIFIED, never assumed: what the publication carries is what the database says it does
+        const carried = (await pg.query(`SELECT schemaname || '.' || tablename FROM pg_publication_tables WHERE pubname = ${pgLiteral(name)}`)).rows.map((x) => x[0]).sort();
+        const wanted = tables.map((t) => t.source).sort();
+        if (carried.join("\n") !== wanted.join("\n")) {
+            throw new Error(`publication ${name} carries ${carried.join(", ") || "no table"} after it was set to ${wanted.join(", ")} (Mason bug: report it, with mason logs)`);
         }
     }
+    /**
+     * NO TABLE'S SYNC IS REPLICATION ANY MORE (at the start that finds none, or live when the last one leaves): the stream
+     * stopped, the slot dropped — it holds the database's WAL while it exists, read or not — and Mason's own publication
+     * with it (a named one is its owner's: left as it is), each VERIFIED gone; then this copy's record of the slot goes,
+     * so a table replicated again later is caught up by one poll under the slot made anew. Idempotent: what is already
+     * gone is not an error. A failure is the pass's, said, and tried again at the next.
+     */
+    async retireReplication() {
+        const r = this.replication;
+        const s = this.stream;
+        if (s !== null) {
+            await s.stop();
+            if (this.stream === s)
+                this.stream = null;
+        }
+        const pg = await PgConnection.connect(this.pgOptions());
+        const dropped = [];
+        try {
+            // the walsender a stop ended lets the slot go a moment later: waited for, at most 10 s
+            let slot = await readSlot(pg, r.slot);
+            for (let i = 0; slot.exists && slot.active && i < 100; i++) {
+                await new Promise((res) => setTimeout(res, 100));
+                slot = await readSlot(pg, r.slot);
+            }
+            if (slot.exists) {
+                if (slot.active)
+                    throw new Error(`replication slot ${r.slot} is in use by pid ${slot.activePid ?? "?"}, so it cannot be dropped (another Mason over the same project? stop it)`);
+                await dropSlot(pg, r.slot);
+                dropped.push(`replication slot ${r.slot}`);
+            }
+            const hasPub = async () => (await pg.query(`SELECT 1 FROM pg_publication WHERE pubname = ${pgLiteral(r.publication)}`)).rows.length > 0;
+            if (r.owned && await hasPub()) {
+                await pg.query(`DROP PUBLICATION IF EXISTS ${pgIdent(r.publication)}`);
+                dropped.push(`publication ${r.publication}`);
+            }
+            if ((await readSlot(pg, r.slot)).exists)
+                throw new Error(`replication slot ${r.slot} is still there after pg_drop_replication_slot`);
+            if (r.owned && await hasPub())
+                throw new Error(`publication ${r.publication} is still there after DROP PUBLICATION`);
+        }
+        finally {
+            pg.close();
+        }
+        await this.onWriter(async () => {
+            await this.store.writer.run(`DELETE FROM ${MASON_SCHEMA}.stream_state WHERE slot = $1`, [r.slot]);
+            this.slotKnown = false;
+            this.appliedLsn = 0n;
+            this.streamCurrentAt = null;
+            this.refreshStreamed();
+        });
+        this.log(`no table's sync is replication now: ${dropped.length ? `dropped ${dropped.join(" and ")} from ${this.source.database}, verified gone` : `replication slot ${r.slot} was already gone`}` +
+            ` (the slot held the database's WAL)${r.owned ? "" : `; publication ${r.publication} is its owner's, left as it is`} — a table set to sync: replication makes the slot again`);
+        this.onReplication?.(false);
+    }
+    /**
+     * THE STREAM HAS EVERYTHING THE DATABASE WROTE (a keepalive with nothing pending, or a batch flushed): every streamed
+     * table is current as of now (`keptOf`'s syncedAt), and a copied one's replication error (the stream's failure, the
+     * preparation's, from this run or one before) is over — the same proof a batch applied with a position gives
+     * (`applyChanges`), which an idle database never sends: a healthy table kept a run-old stream error for ever, and
+     * `mason wait` read it as failed. Cleared on the writer's turn, one turn at a time.
+     */
+    streamCurrent() {
+        this.streamCurrentAt = Date.now();
+        if (this.clearingStreamErrors)
+            return;
+        const stale = (source) => {
+            const st = this.states.get(source);
+            return st !== undefined && st.phase === "copied" && st.error?.startsWith("replication: ") === true && !this.unpublished.has(source) && !this.held.has(source);
+        };
+        if (![...this.joinedNow].some(stale))
+            return;
+        this.clearingStreamErrors = true;
+        void this.onWriter(async () => {
+            for (const source of this.joinedNow)
+                if (stale(source))
+                    await this.record({ ...this.states.get(source), error: null });
+            this.recovered("stream", "the stream has everything the database wrote again");
+        }).catch((e) => this.log(`replication: a table's stream error could not be cleared (it is cleared at the next batch): ${this.errorText(e)}`))
+            .finally(() => { this.clearingStreamErrors = false; });
+    }
+    clearingStreamErrors = false;
     /**
      * The stream started from the slot's acknowledged position, once the slot is known (a pass's `prepareReplication`),
      * and never stopped by a pass: a copy runs beside it. What it applies is `streamed`, read at each change, so a table
      * joins once caught up and leaves when copied again without a restart.
      */
     startStream() {
-        if (this.stream !== null || this.stopped || this.mode !== "replication" || !this.slotKnown || Date.now() < this.streamAt)
+        if (this.stream !== null || this.stopped || !this.streams() || !this.slotKnown || Date.now() < this.streamAt)
             return;
         const r = this.replication;
         this.refreshStreamed();
         const s = new ReplicationStream({
-            connect: () => PgConnection.connect({ ...this.pgOptions(), replication: true }), slot: r.slot, publication: r.publication, log: (l) => this.log(l),
+            connect: () => PgConnection.connect({ ...this.pgOptions(), replication: true }), slot: r.slot, publication: r.publication, log: (l) => this.log(l), errorText: (e) => this.errorText(e),
             target: { tables: () => this.streamed, apply: (batch, lsn, committedAt) => this.applyStreamed(batch, lsn, committedAt), applied: () => this.appliedLsn,
-                refuse: (source, missing) => this.refuseStreamed(source, missing) },
+                refuse: (source, missing) => this.refuseStreamed(source, missing), current: () => { if (this.stream === s)
+                    this.streamCurrent(); } },
         });
         this.stream = s;
         this.streamFailure = null;
@@ -1182,7 +1888,7 @@ export class Sync {
         }
         const joined = [...this.streamed.keys()].filter((x) => !this.held.has(x));
         this.log(`streaming ${joined.length ? joined.join(", ") : "no table yet"} from slot ${r.slot} (publication ${r.publication}), applied through ${formatLsn(this.appliedLsn)}` +
-            `${joined.length < this.tables.size ? "; a table copied or caught up meanwhile joins it once current" : ""}`);
+            `${joined.length < this.replicatedTables().length ? "; a table synced or caught up meanwhile joins it once current" : ""}`);
         void s.done.then(async (e) => {
             if (this.stream === s)
                 this.stream = null;
@@ -1191,17 +1897,17 @@ export class Sync {
             // a numeric wider than its copy's DECIMAL: that table leaves the stream and is copied again, wider, and the stream
             // goes on at once without it (it joins again caught up from its new copy) — at most three times a run, past which
             // a value the stream keeps replaying is wider than any copy of now
-            const wider = [...this.tables.values()].find((t) => e.message.includes(`${WIDER} [${t.source}]`));
+            const wider = [...this.tables.values()].find((t) => widerIn(e, t.source));
             const n = wider === undefined ? 0 : (this.widened.get(wider.source) ?? 0) + 1;
             if (wider !== undefined && n <= 3) {
                 this.widened.set(wider.source, n);
                 await this.onWriter(async () => { this.snapshots.delete(wider.source); this.refreshStreamed(); });
-                this.log(`replication: ${wider.source} has a numeric value wider than its copy's DECIMAL: it is copied again, then streamed`);
+                this.log(`replication: ${wider.source} has a numeric value wider than its synced DECIMAL column: it is read again whole, then streamed`);
                 this.startStream();
                 this.kick();
                 return;
             }
-            const m = `replication: ${e.message}`;
+            const m = `replication: ${this.errorText(e)}`;
             // a failure that recurs must not restart the stream every second: each restart decodes the slot's WAL again on
             // the source
             this.streamFailures++;
@@ -1209,7 +1915,11 @@ export class Sync {
             // a timer may fire a little early: the pass it kicks starts the stream
             this.streamAt = Date.now() + wait - 50;
             this.streamFailure = { error: m, retryAt: this.streamAt };
-            this.log(`${m} (the stream starts again in ${wait / 1000} s, failure ${this.streamFailures} in a row; the copies serve as they are)`);
+            this.log(`${m} (the stream starts again in ${wait / 1000} s, failure ${this.streamFailures} in a row; the synced tables serve as they are)`);
+            // one event for the stream, never one per table it kept current (each table's error says it); its failures in a
+            // row are left out of the words, so a stream failing for good is one event, not one per restart
+            this.event({ kind: "stream_failed", table: null, message: `${m} (the stream starts again by itself; the synced tables serve as they are)` });
+            this.wholeFailure.stream = m;
             // on the tables the stream kept current when it failed (one being caught up says its own)
             await this.onWriter(async () => { for (const source of this.streamed.keys())
                 if (!this.held.has(source))
@@ -1238,10 +1948,11 @@ export class Sync {
             this.held.delete(source);
             const when = this.backOff(source, 0);
             const pub = this.replication.publication;
-            const m = `replication: the stream no longer carries ${source}'s ${cols}, which its copy holds (a column dropped or renamed on the database, or the publication's column list narrowed), ` +
+            const m = `replication: the stream no longer carries ${source}'s ${cols}, which its synced table holds (a column dropped or renamed on the database, or the publication's column list narrowed), ` +
                 `so its changes are not applied: it is caught up by one poll again after ${when}. The way out: remove ${cols} from its columns in the sources file (mason add ${source} --columns … ` +
-                `picks the columns it has; it is copied again at once)${this.replication.owned ? "" : `, or publish ${missing.length === 1 ? "it" : "them"} again (ALTER PUBLICATION ${pub} …)`}`;
+                `picks the columns it has; it is read again whole at once)${this.replication.owned ? "" : `, or publish ${missing.length === 1 ? "it" : "them"} again (ALTER PUBLICATION ${pub} …)`}`;
             this.log(`${source}: ${m}`);
+            this.event({ kind: "stream_failed", table: source, message: m });
             await this.record({ ...this.states.get(source), error: m });
             this.refreshStreamed();
         });
@@ -1250,18 +1961,22 @@ export class Sync {
      * What the stream applies, made again from the tables' state (on the writer's turn, or before the stream exists): a
      * table copied at its present columns and caught up, and a table being caught up (its changes held, `held`). A table
      * that is not — never copied, being copied again, or not caught up — is skipped: its copy's snapshot, or its catch-up,
-     * covers what the stream passes over (src/duck/stream.ts "why replaying is safe").
+     * covers what the stream passes over (src/duck/stream.ts "why replaying is safe"). A table here since the last refresh
+     * keeps its STAY, a table new here gets one, and `swap` ends it: changes decoded in a stay that ended committed before
+     * what came next, so that copy and its catch-up hold them, and only that stay's are applied (`applyStreamed`).
      */
     refreshStreamed() {
+        const before = new Map(this.streamed);
         this.streamed.clear();
         const now = new Set();
         for (const t of this.tables.values()) {
-            // a table a named publication does not carry is never streamed (`unpublished`): its changes are not in the slot
-            const joined = !this.behind.has(t.source) && !this.needsCopy(t) && !this.unpublished.has(t.source);
+            // a table a named publication does not carry is never streamed (`unpublished`): its changes are not in the slot;
+            // nor one whose sync is not replication (it is polled, or off)
+            const joined = this.replicated(t) && !this.behind.has(t.source) && !this.needsCopy(t) && !this.unpublished.has(t.source);
             // in the COPY's columns: a held table's columns may have changed since its copy began (`asCopied`)
             const c = this.asCopied(t).columns;
             if (joined || this.held.has(t.source)) {
-                this.streamed.set(t.source, { columns: c.map((x) => x.name), key: t.key, generated: c.filter((x) => x.generated).map((x) => x.name), big: t.rows !== null && t.rows > POLL_ROW_LIMIT });
+                this.streamed.set(t.source, { stay: before.get(t.source)?.stay ?? ++this.lastStay, columns: c.map((x) => x.name), key: t.key, generated: c.filter((x) => x.generated).map((x) => x.name), big: t.rows !== null && t.rows > BIG_TABLE_ROWS });
             }
             if (joined)
                 now.add(t.source);
@@ -1270,11 +1985,18 @@ export class Sync {
         // while a stream runs: its start names what it streams. What it returns is the tables whose join was said
         const said = [];
         const s = this.stream;
-        if (s !== null && this.mode === "replication") {
+        if (s !== null) {
             const at = formatLsn(s.position());
-            for (const source of this.joinedNow)
-                if (!now.has(source))
-                    this.log(`${source} leaves the stream at ${at}: ${this.notStreamedWhy(source)}`);
+            for (const source of this.joinedNow) {
+                if (now.has(source))
+                    continue;
+                const t = this.tables.get(source);
+                // its sync changed: what keeps it current now, in the words of the switch
+                const why = t !== undefined && !this.replicated(t)
+                    ? `its sync is ${syncText(this.syncOf(t))} now, so it is caught up by one poll from its watermark${this.syncOf(t).mode === "off" ? ", then read again only by mason sync" : ", then polled"}`
+                    : this.notStreamedWhy(source);
+                this.log(`${source} leaves the stream at ${at}: ${why}`);
+            }
             for (const source of now) {
                 if (this.joinedNow.has(source))
                     continue;
@@ -1296,52 +2018,72 @@ export class Sync {
             return `${why} — after a failure, tried again after ${clock(at)} UTC`;
         const ahead = this.rebuildingNow;
         if (this.queued.has(source) && ahead !== null && ahead.source !== source)
-            return `${why} — queued behind ${ahead.source}'s ${ahead.kind === "copy" ? "copy" : "catch-up"} (one rebuild at a time)`;
+            return `${why} — queued behind ${ahead.source}'s ${ahead.kind === "copy" ? "whole read" : "catch-up"} (one rebuild at a time)`;
         return why;
     }
+    /** why a table whose first sync finished is to be read again whole, or null: what the start's line and mason sync say */
+    readAgainWhy(t) {
+        if (this.copiedAs.get(t.source) !== columnsKey(t.columns))
+            return "its columns changed";
+        return this.snapshots.has(t.source) ? null : "a numeric value outgrew its synced DECIMAL column";
+    }
     notStreamedReason(source) {
         const t = this.tables.get(source);
         if (t === undefined)
-            return "it is no longer added (its copy is dropped)";
+            return "it is no longer added (its synced data is dropped)";
         const gap = this.unpublished.get(source);
         if (gap !== undefined)
-            return gap.split("\n")[0];
+            return gapLine(gap);
         const st = this.states.get(source);
         if (this.copiedAs.has(source) && this.copiedAs.get(source) !== columnsKey(t.columns))
-            return "its columns changed: it is copied again, then caught up by one poll";
+            return "its columns changed: it is read again whole, then caught up by one poll";
         if (st?.phase === "copied" && !this.snapshots.has(source))
-            return "a numeric value outgrew its copy's DECIMAL: it is copied again, wider, then caught up by one poll";
-        if (st?.phase === "copied" && this.retired.has(source))
-            return "its copy is in an older Mason's layout, key order with an index: it is copied again, then caught up by one poll";
+            return "a numeric value outgrew its synced DECIMAL column: it is read again whole, wider, then caught up by one poll";
+        const r = this.retired.get(source);
+        if (st?.phase === "copied" && r !== undefined)
+            return `it is ${r.short}: it is read again whole, then caught up by one poll`;
         // what follows the copy: a catch-up poll, then the stream or the polls; copied again whole, nothing (`keptOf`'s recopy)
-        const joins = this.mode === "recopy" ? "it is kept current once copied" : "it joins once copied and caught up by one poll";
+        const joins = this.mode === "recopy" ? "it is kept current once synced" : "it joins once synced and caught up by one poll";
         if (st?.phase === "copying" || this.rebuildingNow?.source === source && this.rebuildingNow.kind === "copy")
-            return `it is being copied: ${joins}`;
+            return `it is being read whole: ${joins}`;
         if (st?.phase === "failed")
-            return `its copy failed (${(st.error ?? "").split("\n")[0]}): ${joins}`;
+            return `its first sync failed (${(st.error ?? "").split("\n")[0]}): ${joins}`;
         const b = this.behind.get(source);
         if (!this.needsCopy(t) && b !== undefined)
             return `it is caught up by one poll ${b.why} first`;
-        return `it waits for its copy: ${joins}`;
+        // synced, caught up, and not yet polled (`pollable`): its rebuild's last writer's turn, or a rebuild still queued
+        if (st?.phase === "copied") {
+            if (this.rebuildingNow?.source === source)
+                return "its sync is ending: it is kept current from then on";
+            const queued = this.queued.get(source)?.kind;
+            if (queued !== undefined)
+                return queued === "copy" ? `it is queued to be read whole: ${joins}` : "it is queued to be caught up by one poll";
+        }
+        return `it waits for its first sync: ${joins}`;
     }
     /**
      * WHERE THE STREAM IS (`StreamStatus`): its position, the database's, the lag, the last batch, and each added table's
      * part in it with what it applied this run. Null outside replication mode. The database's position costs a
      * connection at most every 5 s (`databasePosition`); everything else is the run's own.
+     *
+     * `refresh: false` NEVER REACHES THE DATABASE: the position and the slot as last read (`database.at`, `slotWal.at` say
+     * when), or "not read yet". What an unauthenticated reader asks with (`GET /metrics`, src/cli/run-server.ts
+     * `metricsFacts`): a scraper's rate, or anyone's loop on the health port, must never become connections and SELECTs
+     * on the source; the usage sampler, `mason status` and `mason wait` keep the reads fresh.
      */
-    async streamStatus() {
-        if (this.mode !== "replication")
+    async streamStatus({ refresh = true } = {}) {
+        if (!this.streams())
             return null;
         const r = this.replication;
         const s = this.stream;
         const position = s?.position() ?? this.appliedLsn;
-        const db = await this.databasePosition();
+        const db = refresh ? await this.databasePosition() : this.dbPosition ?? { error: "not read yet: nothing has asked where the database is since the run began", at: Date.now() };
         const now = Date.now();
         const iso = (ms) => new Date(ms).toISOString();
         // each table's part, as `keptOf` says it for EXPLAIN (`streamTable`), with what it applied this run
-        const tables = [...this.tables.values()].map((t) => ({ table: t.source, ...this.streamTable(t, now, s), applied: { ...(this.appliedCounts.get(t.source) ?? noCounts()) } }));
+        const tables = this.replicatedTables().map((t) => ({ table: t.source, ...this.streamTable(t, now, s), applied: { ...(this.appliedCounts.get(t.source) ?? noCounts()) } }));
         return {
-            slot: r.slot, publication: r.publication, running: s !== null,
+            slot: r.slot, slotWal: this.slotWal?.wal ?? { error: "not read yet: the database did not answer within 3 s" }, publication: r.publication, running: s !== null,
             failure: s === null && this.streamFailure !== null ? { error: this.streamFailure.error, retryAt: iso(this.streamFailure.retryAt) } : null,
             position: formatLsn(position), applied: formatLsn(this.appliedLsn),
             database: "lsn" in db ? { lsn: formatLsn(db.lsn), at: iso(db.at) } : { error: db.error },
@@ -1356,15 +2098,28 @@ export class Sync {
      * wait` asks every second), waited for at most 3 s (the last read is answered meanwhile, with its time). Not the
      * stream's keepalive: that carries the walsender's own read position, not the database's, so it cannot say how far
      * behind the stream is when that matters — while it decodes a backlog. A read that fails is answered as its error.
+     * THE SLOT'S WAL (`SlotWal`) is read on the same connection, at most every SLOT_READ_MS (one row of
+     * pg_replication_slots): what the slot holds on the database's disk, said by `mason status` and sampled by usage.
      */
     async databasePosition() {
         const fresh = this.dbPosition !== null && Date.now() - this.dbPosition.at < 5_000;
         if (!fresh && this.dbPositionRead === null) {
+            const slotDue = this.slotWal === null || Date.now() - this.slotWal.at >= SLOT_READ_MS;
+            const slot = this.replication.slot;
             this.dbPositionRead = (async () => {
                 try {
                     const pg = await PgConnection.connect(this.pgOptions());
                     try {
                         this.dbPosition = { lsn: await currentLsn(pg), at: Date.now() };
+                        if (slotDue) {
+                            // its own failure is the slot's line alone: the position read above stands
+                            try {
+                                this.slotWal = { wal: slotWalOf(await readSlot(pg, slot), slot, Date.now()), at: Date.now() };
+                            }
+                            catch (e) {
+                                this.slotWal = { wal: { error: `the slot could not be read: ${this.errorText(e)}` }, at: Date.now() };
+                            }
+                        }
                     }
                     finally {
                         pg.close();
@@ -1372,7 +2127,10 @@ export class Sync {
                 }
                 catch (e) {
                     // answered as the status's (and the log line's) own words: the position could not be read, and why
-                    this.dbPosition = { error: e instanceof Error ? e.message : String(e), at: Date.now() };
+                    const m = this.errorText(e);
+                    this.dbPosition = { error: m, at: Date.now() };
+                    if (slotDue)
+                        this.slotWal = { wal: { error: `the database could not be reached: ${m}` }, at: Date.now() };
                 }
                 finally {
                     this.dbPositionRead = null;
@@ -1413,10 +2171,10 @@ export class Sync {
             this.refreshStreamed();
             const applied = new Map();
             for (const [name, changes] of batch) {
-                const now = this.streamed.get(name);
-                // decoded in another shape than the copy's now (before it was copied again, a stream left it): what they changed
-                // committed before the new copy's snapshot, so it is in that copy — never written in a shape it does not have
-                if (now === undefined || changes.columns === null || changes.columns.join("\0") !== now.columns.join("\0"))
+                // decoded in a stay that ended (before its table was copied again, or left the stream): what they changed
+                // committed before the next copy's catch-up, so that copy or its catch-up holds it — never written over them, in
+                // a shape the copy may not have, or as an old change after the poll that read a newer one
+                if (this.streamed.get(name)?.stay !== changes.stay)
                     continue;
                 const held = this.held.get(name);
                 if (held !== undefined) {
@@ -1425,7 +2183,7 @@ export class Sync {
                 }
                 applied.set(name, changes);
             }
-            await this.applyChanges(applied, lsn, committedAt);
+            await this.applyChanges(applied, { lsn, committedAt });
         });
     }
     /**
@@ -1436,12 +2194,26 @@ export class Sync {
      * index each of those is a scan of the table's key column, so a batch costs a few scans per table, never one per row. A numeric wider than its copy's DECIMAL is the table's to copy
      * again (`WIDER`), never rounded. A null `lsn` is a piece of a large transaction (src/duck/stream.ts): committed, the
      * position left as it was, so a run that dies before the transaction's last piece applies it again whole. What it
-     * applied is counted by table (`streamStatus`), and the batch's newest commit time kept (null: changes held during a
-     * catch-up, whose time is the batches' that held them).
+     * applied is counted by table (`streamStatus`), and the batch's newest commit time kept.
+     *
+     * `"held"` is THE CHANGES A CATCH-UP HELD, replayed after its poll (`catchUp`): written, and counted, as a batch's are,
+     * but NOT A POSITION of the stream — no `stream_state` row (its LSN and `applied_at` are the batches' that held them),
+     * no table's `synced`, no commit time, and not the stream working again (`streamFailures`): the replay ran on the
+     * writer, whatever the stream is doing (it may be failing).
      */
-    async applyChanges(batch, lsn, committedAt = null) {
+    async applyChanges(batch, from) {
+        const lsn = from === "held" ? null : from.lsn;
+        const committedAt = from === "held" ? null : from.committedAt;
         const w = this.store.writer;
         let source = null;
+        const started = Date.now();
+        // EACH TABLE'S ROWS AFTER THE BATCH, kept current at every batch (it was counted at most every 5 s, so a table's
+        // count missed the batches after one until another came): what its writes added and removed, which DuckDB says
+        // (`rowsChanged`) — never a count(*), which a write by key's deletes make a scan (12 ms on 20 M rows, measured) —
+        // written to the ledger IN the batch's transaction, so a run that dies keeps a count equal to its rows
+        const rowsAfter = new Map();
+        // a batch with a position: its time in the ledger and in this run, ONE value (`Synced`)
+        const position = lsn === null ? null : { lsn, at: new Date().toISOString() };
         await w.run("BEGIN TRANSACTION");
         try {
             for (const [name, changes] of batch) {
@@ -1461,8 +2233,7 @@ export class Sync {
                         throw new Error(`${WIDER} [${name}]: ${c} = ${v}`);
                     return duckValue(v, types.get(c));
                 };
-                if (changes.truncated)
-                    await w.run(`DELETE FROM ${target}`);
+                let delta = changes.truncated ? -Number((await w.run(`DELETE FROM ${target}`)).rowsChanged) : 0;
                 const whole = [];
                 const fetch = [];
                 const gone = [];
@@ -1492,10 +2263,16 @@ export class Sync {
                     source ??= await PgConnection.connect(this.pgOptions());
                     whole.push(...await this.sourceRows(source, t, fetch));
                 }
-                await this.writeByKey(t, target, gone, whole, value);
+                delta += await this.writeByKey(t, target, gone, whole, value);
+                // a copy whose rows the ledger does not know (none should be: its copy counts them) is counted, once
+                const known = this.states.get(name)?.rows ?? null;
+                const rows = known === null ? Number((await w.runAndReadAll(`SELECT count(*) FROM ${target}`)).getRowsJS()[0][0]) : known + delta;
+                if (rows !== known)
+                    await w.run(`UPDATE ${MASON_SCHEMA}.copy_state SET "rows" = $1 WHERE source = $2`, [rows, name]);
+                rowsAfter.set(name, rows);
             }
-            if (lsn !== null)
-                await w.run(`INSERT OR REPLACE INTO ${MASON_SCHEMA}.stream_state VALUES ($1, $2, now())`, [this.replication.slot, formatLsn(lsn)]);
+            if (position !== null)
+                await w.run(`INSERT OR REPLACE INTO ${MASON_SCHEMA}.stream_state VALUES ($1, $2, $3::TIMESTAMPTZ)`, [this.replication.slot, formatLsn(position.lsn), position.at]);
             await w.run("COMMIT");
         }
         catch (e) {
@@ -1507,11 +2284,19 @@ export class Sync {
         }
         if (lsn !== null)
             this.appliedLsn = lsn;
-        this.streamFailures = 0;
+        if (from !== "held")
+            this.streamFailures = 0;
+        // THE STREAM'S FAILURE IS OVER when it applies a batch WITH A POSITION: every table it keeps current is current as of
+        // it. A piece of a large transaction (no position) is not that yet, nor the changes a catch-up held
+        if (lsn !== null)
+            this.recovered("stream", "the stream applies changes again");
         let moved = false;
         for (const [name, changes] of batch) {
             if (!this.tables.has(name))
                 continue;
+            // committed: a generated table over it is behind from here (nothing of this is in the transaction above)
+            if (changes.truncated || changes.keys.size > 0)
+                this.generated.changed(name);
             for (const into of [this.appliedCounts, this.sinceLine]) {
                 const c = into.get(name) ?? noCounts();
                 addCounts(c, changes.counts);
@@ -1521,17 +2306,30 @@ export class Sync {
         }
         if (moved && committedAt !== null && committedAt.getTime() > 0)
             this.lastBatch = { appliedAt: Date.now(), committedAt: committedAt.getTime() };
-        // the ledger's row counts, for mason status: each changed table counted at most every 5 s
-        for (const name of batch.keys()) {
+        // the rows, as the ledger has them now; with a position, a table the batch wrote is current again (its error, if
+        // any, cleared), and so is every table the stream keeps current whose error was the replication's (the stream's
+        // failure, the preparation's): the position covers each of them, changed in the batch or not
+        for (const [name, rows] of rowsAfter) {
             const st = this.states.get(name);
-            if (st === undefined || Date.now() - (this.countedAt.get(name) ?? 0) < 5_000)
+            if (st === undefined)
                 continue;
-            const t = this.tables.get(name);
-            const rows = Number((await w.runAndReadAll(`SELECT count(*) FROM ${ident(t.schema)}.${ident(t.table)}`)).getRowsJS()[0][0]);
-            this.countedAt.set(name, Date.now());
-            if (rows !== st.rows || st.error !== null)
+            if (st.error !== null && lsn !== null)
                 await this.record({ ...st, rows, error: null });
+            else
+                this.states.set(name, { ...st, rows });
         }
+        if (lsn !== null) {
+            for (const source of this.joinedNow) {
+                const st = this.states.get(source);
+                if (st !== undefined && st.phase === "copied" && st.error?.startsWith("replication: "))
+                    await this.record({ ...st, error: null });
+            }
+        }
+        // every table the stream keeps current is current as of this batch's position (`Synced`); a piece of a large
+        // transaction (no position) and the changes a catch-up held are not a position
+        if (position !== null)
+            for (const source of this.joinedNow)
+                this.synced.set(source, { at: position.at, seconds: (Date.now() - started) / 1000, by: "stream" });
     }
     /**
      * Rows an UPDATE left a large value unchanged in, every one carrying the same columns (`carried`, the key among them):
@@ -1561,11 +2359,13 @@ export class Sync {
      * join against the table's key column (`deleteKeys`), then the rows inserted. No copy has a primary key,
      * so there is no `INSERT OR REPLACE`; a key's row is the source's at the batch's end
      * whatever the table held, as replaying needs (src/duck/stream.ts). A table with no key (none can be added:
-     * src/cli/preflight.ts) is only appended to.
+     * src/cli/preflight.ts) is only appended to. Answers what it did to the table's count: the rows inserted less the rows
+     * its deletes removed (DuckDB's own count of each).
      */
     async writeByKey(t, target, gone, whole, value) {
         if (gone.length === 0 && whole.length === 0)
-            return;
+            return 0;
+        let delta = 0;
         const w = this.store.writer;
         const cols = t.columns.map((c) => c.name);
         const list = cols.map(ident).join(", ");
@@ -1583,15 +2383,16 @@ export class Sync {
             }
             if (whole.length)
                 await w.run(`INSERT INTO ${WRITE_KEYS} SELECT ${keys} FROM ${WRITE_ROWS}`);
-            await deleteKeys(w, t, target, WRITE_KEYS, t.key);
+            delta -= await deleteKeys(w, t, target, WRITE_KEYS, t.key);
             await w.run(`DROP TABLE ${WRITE_KEYS}`);
         }
         if (whole.length) {
             // and its stored JSON paths, computed from the rows' JSON (src/duck/kept.ts)
             const stored = this.kept.stored(t.source, ident);
-            await w.run(`INSERT INTO ${target} (${[list, ...stored.names.map(ident)].join(", ")}) SELECT ${[list, ...stored.values].join(", ")} FROM ${WRITE_ROWS}`);
+            delta += Number((await w.run(`INSERT INTO ${target} (${[list, ...stored.names.map(ident)].join(", ")}) SELECT ${[list, ...stored.values].join(", ")} FROM ${WRITE_ROWS}`)).rowsChanged);
             await w.run(`DROP TABLE ${WRITE_ROWS}`);
         }
+        return delta;
     }
     /** a copied table's columns' DuckDB types, as DESCRIBE spells them (what `duckValue` casts a value's text to) */
     async columnTypes(t, target) {
@@ -1667,26 +2468,55 @@ export class Sync {
      *  whose attach throws is not one: it never detaches */
     async attach() {
         if (!this.attached) {
-            // INSTALL fetches the extension from DuckDB's repository the first time on a machine (then ~/.duckdb/extensions):
-            // offline, the first copy fails here saying so — bundling it is the plan's step 3
+            // the extension ships with Mason (src/duck/extensions.ts): a LOAD from the platform's package, nothing downloaded;
+            // without the package, INSTALL fetches it the first time on a machine (then ~/.duckdb/extensions), said once,
+            // and offline the first copy fails here saying why
             if (!this.loaded) {
+                const x = this.store.extensions;
+                if (!x.shipped)
+                    this.log(`Mason's extensions are not installed with it here: ${x.why}. The first sync on this machine downloads its postgres extension`);
                 try {
-                    await this.store.writer.run("INSTALL postgres; LOAD postgres;");
+                    await this.store.writer.run(loadPostgresSql(x));
                 }
                 catch (e) {
-                    throw new Error(`DuckDB could not load its postgres extension: ${e.message}. The first copy on a machine downloads it from ` +
-                        "DuckDB's extension repository (then ~/.duckdb/extensions): connect to the internet once, and the copy is tried again at the next pass");
+                    throw new Error(extensionFailure(x, this.errorText(e)));
                 }
                 this.loaded = true;
             }
-            await this.store.writer.run(`ATTACH ${literal(libpqString(this.source))} AS ${SRC} (TYPE postgres, READ_ONLY)`);
+            const w = this.store.writer;
+            // the engine's own words are never repeated here: its statement held the password (`sourceSecretSql`)
+            try {
+                await w.run(sourceSecretSql(this.source));
+            }
+            // ITS OWN WORDS ARE NEVER REPEATED: the statement held the password, and an error may quote its statement — its
+            // code alone is said (src/lib/secret-mask.ts errorCode)
+            catch (e) {
+                throw new Error(`the database's credentials could not be set up for the sync (Mason bug: report it, with this code; the error's own words are not shown, as its statement held the password): ${errorCode(e) ?? "no code"}`);
+            }
+            // the engine's failure to connect, in Mason's words (`errorText`) where it enters
+            try {
+                await w.run(attachSqlOf(this.source));
+            }
+            catch (e) {
+                throw new Error(this.errorText(e));
+            }
+            finally {
+                // the attachment keeps what it merged; the secret goes at once, whatever the ATTACH did. One left behind is
+                // the instance's, in memory, unreadable (duckdb_secrets() redacts it) and replaced at the next attach: said
+                try {
+                    await w.run(`DROP TEMPORARY SECRET IF EXISTS ${SOURCE_SECRET}`);
+                }
+                catch (e) {
+                    this.log(`the database's credentials could not be removed from memory once it was attached (they stay there, never on disk, until the next attach replaces them): ${this.errorText(e)}`);
+                }
+            }
             this.attached = true;
         }
         this.sourceUsers++;
     }
     /**
      * THE SOURCE IS ATTACHED ONLY WHILE A PASS OR A REBUILD READS IT. An attached database is every connection's — a wire
-     * session's too, and the rebuilds' — and its path is the connection string, password included (`duckdb_databases()`).
+     * session's too, and the rebuilds' — and its path (`duckdb_databases()`) is `attachPath`'s, which holds no credential.
      * A session runs only planned SQL (src/duck/plan.ts PlannedSql), which cannot name it; detached when its last user
      * ends (on the writer's turn, so never under a transaction reading it), it is not there to name either.
      */
@@ -1700,7 +2530,7 @@ export class Sync {
         }
         // the pass's work stands; still attached, the next pass detaches it again (and attach() sees it is attached)
         catch (e) {
-            this.log(`the source could not be detached after the pass (tried again after the next): ${e instanceof Error ? e.message : String(e)}`);
+            this.log(`the source could not be detached after the pass (tried again after the next): ${this.errorText(e)}`);
         }
     }
     /** one pass: every removed table dropped, every added table needing it queued for a copy (step 0: whole, again) or
@@ -1726,40 +2556,76 @@ export class Sync {
             });
             this.snapshots.delete(source);
             this.retries.delete(source);
+            this.due.delete(source);
+            this.lastPollMs.delete(source);
+            this.recordedSync.delete(source);
+            this.switched.delete(source);
             this.retired.delete(source);
             this.copiedAs.delete(source);
             this.copiedColumns.delete(source);
             this.states.delete(source);
-            this.log(`dropped ${source}'s copy: it is no longer added (mason add ${source} copies it again from the source, whole)`);
-        }
-        if (this.tables.size === 0) {
-            await this.rebuildSchema();
-            return;
+            this.synced.delete(source);
+            this.log(`dropped ${source}'s synced data: it is no longer added (mason add ${source} syncs it again from the source, whole)`);
+        }
+        // REPLICATION, as the tables' syncs say: the publication and slot made ready for the replicated tables and the stream
+        // started — or, when none is replicated any more, the slot dropped (verified gone). Its failure is the replicated
+        // tables' alone (not copied, not caught up: `work`), and the pass's, said once the polled tables are polled
+        let replicationFailed = null;
+        let replicationReady = false;
+        for (const source of [...this.unpublished.keys()]) {
+            const t = this.tables.get(source);
+            if (t === undefined || !this.replicated(t))
+                this.unpublished.delete(source);
         }
-        if (this.mode === "replication") {
+        if (this.streams()) {
             try {
                 await this.prepareReplication();
+                replicationReady = true;
             }
             catch (e) {
-                const m = `replication: ${e instanceof Error ? e.message : String(e)}`;
+                // the way out on the table's own line: a failure that names none (a slot the database will not make, a role that
+                // may not replicate) says the line that keeps the tables polled meanwhile — never a bare SQLSTATE's text
+                const said = this.errorText(e);
+                const names = this.replicatedTables().map((t) => t.source);
+                const m = `replication: ${said}${/sync: poll/.test(messageOf(e)) ? "" : ` — ${names.join(", ")} ${names.length === 1 ? "is" : "are"} NOT kept current until it is fixed: ` +
+                    `give ${names.length === 1 ? "its entry" : "their entries"} sync: poll <interval> (poll 5m) in the sources file to poll ${names.length === 1 ? "it" : "them"} instead`}`;
+                this.event({ kind: "stream_failed", table: null, message: m });
+                this.wholeFailure.prepare = m;
                 // a table copied before keeps serving its copy; one never copied is failed, so mason status says why
                 await this.onWriter(async () => {
-                    for (const t of this.tables.values()) {
+                    for (const t of this.replicatedTables()) {
                         const st = this.states.get(t.source);
                         await this.record({ ...st, phase: st.phase === "copied" ? "copied" : "failed", error: m });
                     }
                 });
-                await this.rebuildSchema();
-                throw e;
+                replicationFailed = e;
             }
+            this.recovered("prepare", "the publication and the slot are ready again");
             // the stream starts once the slot is known, and runs from then on whatever the passes and rebuilds do
-            this.startStream();
+            if (replicationReady)
+                this.startStream();
+        }
+        else if (this.replication !== null && (this.slotKnown || this.stream !== null)) {
+            try {
+                await this.retireReplication();
+            }
+            catch (e) {
+                replicationFailed = new Error(`no table's sync is replication now, but replication slot ${this.replication.slot} could not be dropped (it holds the database's WAL; tried again at the next pass): ${this.errorText(e)}`);
+            }
+        }
+        if (this.tables.size === 0) {
+            await this.rebuildSchema();
+            if (replicationFailed !== null)
+                throw replicationFailed;
+            return;
         }
         try {
             await this.onWriter(() => this.attach());
         }
         catch (e) {
-            const m = e instanceof Error ? e.message : String(e);
+            const m = this.errorText(e);
+            this.event({ kind: "source_unreachable", table: null, message: `could not attach the database: ${m}` });
+            this.wholeFailure.attach = m;
             // a table copied before keeps serving its copy (and its place in the catalog): the source being away is its error,
             // not a reason to copy it whole again when the source is back; one never copied is failed
             await this.onWriter(async () => {
@@ -1770,18 +2636,22 @@ export class Sync {
             });
             // the copies serve while the source is away: the catalog lists them (on a fresh start, nothing else has)
             await this.rebuildSchema();
-            throw new Error(`DuckDB could not attach ${this.source.database} on ${this.source.host}:${this.source.port}: ${m}`);
+            throw new Error(`Mason could not attach ${this.source.database} on ${this.source.host}:${this.source.port}: ${m}`);
         }
+        this.recovered("attach", "the database is attached again");
         try {
-            await this.work();
+            await this.work(replicationReady);
         }
         finally {
             await this.onWriter(() => this.detach());
         }
         await this.rebuildSchema();
+        if (replicationFailed !== null)
+            throw replicationFailed;
     }
-    /** a pass's queueing and polls, the source attached */
-    async work() {
+    /** a pass's queueing and polls, the source attached; a replicated table is copied or caught up only once the publication
+     *  carries it and the slot exists (`replicationReady`): its changes are in the stream from before it joins */
+    async work(replicationReady) {
         const started = Date.now();
         // a table never copied (or whose copy failed, or whose copy is out of date) is copied whole, beside the rest: the
         // smallest first (`copyOrder`)
@@ -1794,33 +2664,27 @@ export class Sync {
             // a table the named publication does not carry: copied, nothing would keep it current (prepareReplication)
             if (this.unpublished.has(t.source))
                 continue;
+            if (this.replicated(t) && !replicationReady)
+                continue;
             if (this.mode !== "recopy" && !this.needsCopy(t))
                 continue;
             if (this.queued.has(t.source) || this.rebuildingNow?.source === t.source)
                 continue;
             if (this.states.get(t.source)?.phase === "copied" && this.copiedAs.get(t.source) !== columnsKey(t.columns))
-                this.log(`${t.source}: its columns are not the ones it was copied with: it is copied again`);
+                this.log(`${t.source}: its columns are not the ones it was synced with: it is read again whole`);
             this.enqueue(t.source, { kind: "copy" });
         }
         // a table copied and not yet caught up (a slot new to the copy, or a run that stopped first): its one poll
         for (const source of this.behind.keys()) {
             const t = this.tables.get(source);
             // a failed catch-up waits its turn as a failed copy does (`backOff`); the error it recorded says when
-            if (t !== undefined && !this.needsCopy(t) && (this.retries.get(source)?.at ?? 0) <= Date.now())
+            if (t !== undefined && !this.needsCopy(t) && (this.retries.get(source)?.at ?? 0) <= Date.now() && (!this.replicated(t) || replicationReady))
                 this.enqueue(source, { kind: "catch-up" });
         }
-        // a table whose new columns could not be copied (its copy failed above) is not polled with them
-        const polled = [...this.tables.values()].filter((t) => !this.needsCopy(t));
-        // POLL MODE: a table over the row limit is served as copied and polled only when asked (POLL_ROW_LIMIT, pollNow)
-        const big = this.mode === "poll" ? polled.filter(overPollLimit) : [];
-        for (const t of big.filter((x) => !this.leftOut.has(x.source))) {
-            this.log(`${t.source} (about ${t.rows.toLocaleString("en-US")} rows) is ${OVER_POLL_LIMIT}: it is served as copied, NOT kept current by the poll ` +
-                `(each poll would scan it whole on the database) — mason sync ${t.source} syncs it now; mason start --replication keeps every table current`);
-            this.leftOut.add(t.source);
-        }
-        for (const s of [...this.leftOut].filter((x) => !big.some((t) => t.source === x)))
-            this.leftOut.delete(s);
-        const kept = this.mode === "poll" ? polled.filter((t) => !big.includes(t)) : [];
+        // POLL MODE: the tables due (`dueAt`: a polled one past its interval, one whose sync changed), and not a table whose
+        // new columns could not be copied (its copy failed above): it is not polled with them
+        const now = Date.now();
+        const kept = this.mode !== "recopy" ? [...this.tables.values()].filter((t) => !this.replicated(t) && this.pollable(t) && (this.dueAt(t) ?? Infinity) <= now) : [];
         for (const t of kept) {
             if (this.stopped)
                 break;
@@ -1828,22 +2692,27 @@ export class Sync {
             // or a swap may run between two. A table rebuilt or not yet caught up is not polled (decided on the turn itself);
             // its catch-up polls it
             try {
-                await this.onWriter(async () => { if (this.rebuildingNow?.source !== t.source && !this.behind.has(t.source))
-                    await this.poll(this.writerLane, [t]); });
+                const found = await this.onWriter(async () => this.rebuildingNow?.source !== t.source && !this.behind.has(t.source) ? this.poll(this.writerLane, [t]) : []);
+                for (const f of found)
+                    this.polledNow(t, f.ms);
             }
             catch (e) {
                 if (e instanceof Stopping) {
-                    this.log("poll stopped: Mason is stopping (rolled back; the copies serve as they were)");
+                    this.log("poll stopped: Mason is stopping (rolled back; the synced tables serve as they were)");
                     return;
                 }
+                // tried again after its interval (an `off` table whose sync changed: after the sync's), never at every pass
+                const s = this.syncOf(t);
+                this.due.set(t.source, Date.now() + (s.mode === "poll" ? s.seconds * 1000 : this.intervalMs));
                 // the table serves its copy as it was, and says why it is not current (mason status reads the ledger); the other
                 // tables are polled as ever
-                const m = `the poll failed, and is tried again at the next one (the copy serves as it was): ${e instanceof Error ? e.message : String(e)}`;
+                const m = `the poll failed, and is tried again at the next one (the synced data serves as it was): ${this.errorText(e)}`;
                 this.log(`${t.source}: ${m}`);
+                this.event({ kind: "poll_failed", table: t.source, message: m });
                 await this.onWriter(() => this.record({ ...this.states.get(t.source), error: m }));
             }
         }
-        if (this.mode === "poll")
+        if (this.mode !== "recopy")
             await this.onWriter(() => this.readPolledAt());
         this.lastPassMs = Date.now() - started;
     }
@@ -1867,9 +2736,16 @@ export class Sync {
                 if (next === undefined)
                     return;
                 this.queued.delete(next[0]);
+                // a generated table's run reads no source: nothing is attached and no table is marked as rebuilt
+                const kind = next[1].kind;
+                if (kind === "generated") {
+                    await this.generated.run(next[0]).catch((e) => { if (!(e instanceof Stopping))
+                        throw e; });
+                    continue;
+                }
                 const t = this.tables.get(next[0]);
                 // a catch-up that found a numeric wider than the copy: copied again, next
-                if (t !== undefined && await this.rebuild(t, next[1]) === "copy again")
+                if (t !== undefined && await this.rebuild(t, kind) === "copy again")
                     this.enqueue(t.source, { kind: "copy" });
                 // still needing a copy or a catch-up: a pass now, or when its back-off ends
                 else
@@ -1879,7 +2755,7 @@ export class Sync {
                     this.kick();
             }
         })().catch((e) => {
-            this.log(`a rebuild failed outside its own handling (Mason bug: report it): ${e instanceof Error ? e.stack ?? e.message : String(e)}`);
+            this.log(`a rebuild failed outside its own handling (Mason bug: report it): ${this.errorText(e, { stack: true })}`);
         }).finally(() => {
             this.rebuilding = null;
             // what was queued behind a rebuild that threw is still queued
@@ -1891,9 +2767,9 @@ export class Sync {
      * ONE REBUILD, beside the stream and the polls: the table marked as rebuilt on the writer's turn (from then on no poll
      * starts on it), then its copy on the rebuilds' connection, then — a table left behind by it — its catch-up.
      */
-    async rebuild(t, r) {
+    async rebuild(t, kind) {
         await this.onWriter(async () => {
-            this.rebuildingNow = { source: t.source, kind: r.kind };
+            this.rebuildingNow = { source: t.source, kind };
             this.refreshStreamed();
         });
         let attached = false;
@@ -1904,14 +2780,18 @@ export class Sync {
             }
             catch (e) {
                 // the next pass says the same of every table, and queues it again
-                const m = `could not attach the database: ${e instanceof Error ? e.message : String(e)}`;
-                this.log(`${r.kind} of ${t.source} waits: ${m}`);
+                const m = `could not attach the database: ${this.errorText(e)}`;
+                this.log(`${kind} of ${t.source} waits: ${m}`);
+                this.event({ kind: "source_unreachable", table: t.source, message: `its ${kind} waits: ${m}` });
                 const st = this.states.get(t.source);
                 await this.onWriter(() => this.record({ ...st, phase: st.phase === "copied" ? "copied" : "failed", error: m }));
                 return null;
             }
-            if (r.kind === "copy")
+            if (kind === "copy")
                 await this.copy(t);
+            // the whole read is over, whatever comes next: what the table is said to be doing from here (`notStreamedReason`,
+            // `refuseRebuilding`, `state`'s `rebuilding`)
+            this.rebuildingNow = { source: t.source, kind: "catch-up" };
             // a table its copy left behind (`swap`), or one marked so before: one poll, unless a copy of it comes first — the
             // table as it is added NOW, which may have changed while it was copied (then copied again at once: `followUp`)
             const now = this.tables.get(t.source);
@@ -1936,11 +2816,11 @@ export class Sync {
      * copy (the copy's snapshot), or a slot new to the copy — on the rebuilds'
      * connection, so the stream and the other tables' polls go on meanwhile. In replication mode the stream holds the
      * table's changes from before the poll's snapshot and applies them after it (src/duck/stream.ts "why replaying is
-     * safe"). A table over POLL_ROW_LIMIT is caught up too: the one scan its rebuild costs, not the periodic poll.
+     * safe"). A table whose sync is `off` is caught up too: the one scan its rebuild costs, then nothing until asked.
      */
     async catchUp(t) {
         const mark = this.behind.get(t.source);
-        const replication = this.mode === "replication";
+        const replication = this.replicated(t);
         // J: from the writer's turn on, every batch's changes of this table are held (`applyStreamed`)
         if (replication)
             await this.onWriter(async () => { if (!this.held.has(t.source))
@@ -1953,8 +2833,9 @@ export class Sync {
         // mason status — and is caught up again then: what was held is read again by that poll (still behind, nothing lost)
         const failed = (what, e) => {
             const when = this.backOff(t.source, Date.now() - started);
-            const m = `${what} (the copy serves as it was; it is caught up by one poll again after ${when}): ${e instanceof Error ? e.message : String(e)}`;
+            const m = `${what} (the synced data serves as it was; it is caught up by one poll again after ${when}): ${this.errorText(e)}`;
             this.log(`${t.source}: ${m}`);
+            this.event({ kind: "catch_up_failed", table: t.source, message: m });
             return this.onWriter(() => this.record({ ...this.states.get(t.source), error: m }));
         };
         // the catch-up's poll reads the columns the copy holds (`asCopied`)
@@ -1977,6 +2858,7 @@ export class Sync {
             await release();
             return "copy again";
         }
+        this.polledNow(t, found[0].ms);
         let saidJoin = false;
         if (this.catchingUp?.source === t.source)
             this.catchingUp.phase = "applying";
@@ -1987,15 +2869,15 @@ export class Sync {
             this.held.delete(t.source);
             if (held !== undefined && (held.truncated || held.keys.size > 0)) {
                 try {
-                    await this.applyChanges(new Map([[t.source, held]]), this.appliedLsn);
+                    await this.applyChanges(new Map([[t.source, held]]), "held");
                 }
                 catch (e) {
-                    const m = e instanceof Error ? e.message : String(e);
+                    const m = this.errorText(e);
                     this.refreshStreamed();
                     // a numeric wider than its copy: copied again (`needsCopy`), and caught up after that copy
-                    if (m.includes(`${WIDER} [${t.source}]`)) {
+                    if (widerIn(e, t.source)) {
                         this.snapshots.delete(t.source);
-                        this.log(`${t.source}: the changes the stream held during its catch-up could not be applied: it is copied again, wider (${m})`);
+                        this.log(`${t.source}: the changes the stream held during its catch-up could not be applied: it is read again whole, wider (${m})`);
                         return "copy again";
                     }
                     heldFailure = e;
@@ -2024,9 +2906,10 @@ export class Sync {
             return joined || null;
         if (saidJoin)
             return null;
+        const s = this.syncOf(t);
         const tail = replication ? (this.behind.has(t.source) ? "it is caught up again first (the slot was made again meanwhile)" : "the stream carries what follows once it runs again")
-            : this.mode === "poll" && overPollLimit(t) ? `it is ${OVER_POLL_LIMIT}, so that was one scan for its rebuild, not the periodic poll: served as of now, mason sync ${t.source} syncs it again`
-                : "the poll keeps it current";
+            : s.mode === "off" ? `its sync is off, so it is served as of now: mason sync ${t.source} syncs it again`
+                : `the poll keeps it current (${syncWords(s)})`;
         this.log(`caught up ${t.source} by one poll ${mark.why}: ${tail}`);
         return null;
     }
@@ -2040,12 +2923,15 @@ export class Sync {
     async swap(t, side, o) {
         const w = this.store.writer;
         const target = `${ident(t.schema)}.${ident(t.table)}`;
+        // the copy's time in the ledger and in this run, ONE value, and before `copied_at`, recorded after the swap
+        // (`readSynced`: a copy recorded at or after its polled_at was last brought current by that copy)
+        const at = new Date().toISOString();
         await w.run("BEGIN TRANSACTION");
         try {
             await w.run(`DROP TABLE IF EXISTS ${target}`);
             await w.run(`ALTER TABLE ${side} RENAME TO ${ident(t.table)}`);
             if (o.snapshot !== null)
-                await w.run(`INSERT OR REPLACE INTO ${MASON_SCHEMA}.poll_state VALUES (${literal(t.source)}, ${literal(o.snapshot)}, now())`);
+                await w.run(this.pollStateSql(t, o.snapshot, at));
             if (o.behind !== null)
                 await w.run(`INSERT OR REPLACE INTO ${MASON_SCHEMA}.catch_up VALUES (${literal(t.source)}, ${literal(o.behind)}, now())`);
             // the copy is whole: nothing of it is left to continue
@@ -2059,21 +2945,37 @@ export class Sync {
             await w.run("ROLLBACK");
             throw e;
         }
+        // committed: a new copy, so a generated table over it is behind from here
+        this.generated.changed(t.source);
         // the copy's view of its visible columns, made again (its own transaction: DuckDB writes one database a transaction)
         await this.kept.swapped(t.source);
-        if (o.snapshot !== null)
+        if (o.snapshot !== null) {
             this.snapshots.set(t.source, o.snapshot);
+            this.recordedSync.set(t.source, syncText(this.syncOf(t)));
+            this.switched.delete(t.source);
+            this.due.delete(t.source);
+            // synced as of its copy, said at once (a review finding: until the next pass re-read the ledger, a table just
+            // copied said "never synced"), and the value the ledger holds, so that read moves nothing
+            this.polledAt.set(t.source, at);
+        }
         // the columns this copy holds, from its swap on: what every write to it is shaped by (`asCopied`)
         this.copiedColumns.set(t.source, [...t.columns]);
         if (o.behind !== null) {
             this.behind.set(t.source, { why: o.behind });
-            if (this.mode === "replication")
+            if (this.replicated(t))
                 this.held.set(t.source, noChanges());
         }
         this.retired.delete(t.source);
         this.duckTypes.delete(t.source);
+        // a new copy, a new stay, whatever the columns: what the stream decoded before this moment is not for it
+        this.streamed.delete(t.source);
         this.refreshStreamed();
     }
+    /** a table's watermark, the time and the sync it is polled or copied under (`recordedSync`): ONE row of `_mason.poll_state`.
+     *  `at` is the caller's, an ISO instant (`toISOString`, as `copied_at`), the very value it remembers (`polledAt`) */
+    pollStateSql(t, snapshot, at) {
+        return `INSERT OR REPLACE INTO ${MASON_SCHEMA}.poll_state (source, snapshot, polled_at, sync) VALUES (${literal(t.source)}, ${literal(snapshot)}, ${literal(at)}::TIMESTAMPTZ, ${literal(syncText(this.syncOf(t)))})`;
+    }
     /**
      * One poll of the tables given (the passes and `pollNow` give one at a time), in ONE DuckDB transaction over ONE
      * source snapshot (the module's header), on the lane's connection — the writer's, or the rebuilds' for a catch-up —
@@ -2111,12 +3013,12 @@ export class Sync {
         // (`adds`: the keys a stage still to be written adds to DuckDB's count)
         const reconcile = async (t, target, from, adds = 0n) => {
             const c0 = Date.now();
-            doing = `${t.source}: counting its rows on the source and in DuckDB`;
+            doing = `${t.source}: counting its rows on the source and in the synced table`;
             const counts = (await w.runAndReadAll(`SELECT (SELECT count FROM ${pq(`SELECT count(*) AS count FROM ${from}`)}), (SELECT count(*) FROM ${target})`)).getRowsJS()[0];
             const countMs = Date.now() - c0;
             let deleted = 0;
             if (counts[0] !== counts[1] + adds) {
-                doing = `${t.source}: deleting the keys the source no longer holds (its keys anti-joined with DuckDB's)`;
+                doing = `${t.source}: deleting the keys the source no longer holds (its keys anti-joined with the synced table's)`;
                 const on = t.key.map((k) => `t.${ident(k)} = k.${ident(k)}`).join(" AND ");
                 const gone = await w.run(`DELETE FROM ${target} WHERE rowid IN (SELECT t.rowid FROM ${target} t ANTI JOIN ${pq(`SELECT ${t.key.map(pgIdent).join(", ")} FROM ${from}`)} k ON ${on})`);
                 deleted = Number(gone.rowsChanged);
@@ -2124,6 +3026,9 @@ export class Sync {
             return { rows: Number(counts[0]), deleted, countMs };
         };
         let snapshot = "";
+        // THE POLL'S TIME, ONE VALUE: taken before its snapshot, so `syncedAt` never says more than the rows hold, written
+        // with its watermark (`pollStateSql`) and remembered as written once that commits (`committed`, `polledAt`)
+        const polledAt = new Date().toISOString();
         await w.run("BEGIN TRANSACTION");
         try {
             await this.interruptible(lane, async () => {
@@ -2149,7 +3054,7 @@ export class Sync {
                         `${pq(`SELECT ${pgCols} FROM ${from} WHERE ${xmin8Sql(xmax)} >= ${watermark}`)}) AS polled(${t.columns.map((_, i) => `c${i}`).join(", ")})`)).rowsChanged);
                     if (staged > POLL_PIECE_ROWS) {
                         const c1 = Date.now();
-                        doing = `${t.source}: counting the keys its ${staged} changed row(s) add to DuckDB (the stage anti-joined with DuckDB's keys)`;
+                        doing = `${t.source}: counting the keys its ${staged} changed row(s) add to the synced table (the stage anti-joined with its keys)`;
                         const on = t.key.map((k) => `s.${ident(`c${t.columns.findIndex((c) => c.name === k)}`)} = t.${ident(k)}`).join(" AND ");
                         const adds = (await w.runAndReadAll(`SELECT count(*) FROM ${stage} s ANTI JOIN ${target} t ON ${on}`)).getRowsJS()[0][0];
                         const { rows, deleted, countMs } = await reconcile(t, target, from, adds);
@@ -2162,7 +3067,7 @@ export class Sync {
                     await writeStaged(w, t, target, stage, "", this.kept);
                     const c1 = Date.now();
                     const { rows, deleted, countMs } = await reconcile(t, target, from);
-                    await w.run(`INSERT OR REPLACE INTO ${MASON_SCHEMA}.poll_state VALUES (${literal(t.source)}, ${literal(snapshot)}, now())`);
+                    await w.run(this.pollStateSql(t, snapshot, polledAt));
                     await w.run(`DROP TABLE ${stage}`);
                     timed.push(`${t.source} ${staged} changed in ${c1 - c0} ms, counted in ${countMs} ms${deleted ? `, ${deleted} deleted in ${Date.now() - c1 - countMs} ms` : ""}`);
                     found.push({ table: t.source, changed: staged, deleted, rows, ms: Date.now() - c0 });
@@ -2177,30 +3082,33 @@ export class Sync {
                 await w.run("ROLLBACK");
             }
             catch (r) {
-                this.log(`the poll's ROLLBACK failed too: ${r instanceof Error ? r.message : String(r)}`);
+                this.log(`the poll's ROLLBACK failed too: ${this.errorText(r)}`);
             }
             // a stage made in the rolled-back transaction went with it
             pieced.length = 0;
             // a numeric wider than its copy: that table is copied again (wider) at the next pass, the others polled
             // matched against the tables' own names (a name may hold a space)
-            const wider = e instanceof Error ? tables.find((t) => e.message.includes(`${WIDER} [${t.source}]`))?.source : undefined;
+            const wider = e instanceof Error ? tables.find((t) => widerIn(e, t.source))?.source : undefined;
             if (wider !== undefined && this.snapshots.delete(wider)) {
-                this.log(`poll: ${wider} has a numeric value wider than its copy's DECIMAL: it is copied again at the next pass`);
+                this.log(`poll: ${wider} has a numeric value wider than its synced DECIMAL column: it is read again whole at the next pass`);
                 return [];
             }
             throw named(e);
         }
         // committed: the watermarks and the row counts move together (a pieced table's with its last piece)
-        const committed = async (source, rows) => {
+        // and the table's last sync (`Synced`): the poll's time as the ledger now holds it, and how long THIS table's poll took
+        const committed = async (source, rows, ms) => {
+            this.polledAt.set(source, polledAt);
             const st = this.states.get(source);
             if (st.rows !== rows || st.error !== null)
                 await this.record({ ...st, rows, error: null }, undefined, w);
             this.snapshots.set(source, snapshot);
+            this.synced.set(source, { at: polledAt, seconds: ms / 1000, by: lane === this.writerLane ? "poll" : "catch-up" });
         };
         try {
             for (const [source, rows] of pending)
                 if (!pieced.some((p) => p.t.source === source))
-                    await committed(source, rows);
+                    await committed(source, rows, found.find((f) => f.table === source)?.ms ?? 0);
             this.log(`poll: ${timed.join("; ")}`);
             for (const { t, target, stage, staged, deleted, started } of pieced) {
                 const p0 = Date.now();
@@ -2211,7 +3119,7 @@ export class Sync {
                         doing = `${t.source}: writing piece ${i + 1} of ${n} of its ${staged} changed row(s) by key`;
                         await this.interruptible(lane, () => writeStaged(w, t, target, stage, ` WHERE rowid >= ${i * POLL_PIECE_ROWS} AND rowid < ${(i + 1) * POLL_PIECE_ROWS}`, this.kept));
                         if (i === n - 1) {
-                            await w.run(`INSERT OR REPLACE INTO ${MASON_SCHEMA}.poll_state VALUES (${literal(t.source)}, ${literal(snapshot)}, now())`);
+                            await w.run(this.pollStateSql(t, snapshot, polledAt));
                         }
                         doing = `${t.source}: committing piece ${i + 1} of ${n}`;
                         await w.run("COMMIT");
@@ -2222,7 +3130,7 @@ export class Sync {
                     }
                 }
                 const rows = pending.get(t.source);
-                await committed(t.source, rows);
+                await committed(t.source, rows, Date.now() - started);
                 found.push({ table: t.source, changed: staged, deleted, rows, ms: Date.now() - started });
                 this.log(`poll: ${t.source}: ${staged.toLocaleString("en-US")} changed row(s), written in ${n} pieces in ${Date.now() - p0} ms`);
             }
@@ -2231,6 +3139,10 @@ export class Sync {
             for (const { stage } of pieced)
                 await w.run(`DROP TABLE IF EXISTS ${stage}`);
         }
+        // committed: a generated table over a table that changed is behind from here
+        for (const f of found)
+            if (f.changed > 0 || f.deleted > 0)
+                this.generated.changed(f.table);
         return found;
     }
     /**
@@ -2295,10 +3207,11 @@ export class Sync {
             if (resumed === null) {
                 // the stream (or the other tables' polls) goes on: the slot holds no WAL for this copy, and the table joins once
                 // caught up from the copy's snapshot
-                const beside = this.mode === "replication" ? "beside the stream, which goes on keeping the other tables current: it is streamed once caught up by one poll from the copy's snapshot"
-                    : this.mode === "poll" ? "beside the other tables' polls: it is caught up by one poll from the copy's snapshot once copied" : "beside the other tables";
-                const again = this.retired.has(t.source) ? `, again (its copy is ${RETIRED_LAYOUT})` : "";
-                this.log(`copying ${t.source}${again}: ${t.rows === null ? "rows unknown" : `about ${t.rows} row(s)`}, ${t.bytes} source bytes, ${beside}`);
+                const beside = this.replicated(t) ? "beside the stream, which goes on keeping the other tables current: it is streamed once caught up by one poll from the snapshot it was read at"
+                    : this.mode !== "recopy" ? "beside the other tables' polls: once read, it is caught up by one poll from the snapshot it was read at" : "beside the other tables";
+                const r = this.retired.get(t.source);
+                const again = r !== undefined ? `, again (it is ${r.layout})` : "";
+                this.log(`syncing ${t.source}${again}: ${t.rows === null ? "rows unknown" : `about ${t.rows} row(s)`}, ${t.bytes} source bytes, ${beside}`);
             }
             let read;
             try {
@@ -2308,7 +3221,7 @@ export class Sync {
                 if (!(e instanceof StartOver))
                     throw e;
                 // once: a second reason to start over is the copy's failure
-                this.log(`starting the copy of ${t.source} over, from its first page: ${e.message}`);
+                this.log(`starting the sync of ${t.source} over, from its first page: ${this.errorText(e)}`);
                 kept = await this.forgetCopy(t, side);
                 read = await this.readChunks(t, side, null, (p) => { kept = p; });
             }
@@ -2320,7 +3233,7 @@ export class Sync {
                 const [rows, keys] = (await w.runAndReadAll(`SELECT count(*), count(DISTINCT (${t.key.map(ident).join(", ")})) FROM ${side}`)).getRowsJS()[0];
                 if (rows !== keys) {
                     kept = await this.forgetCopy(t, side);
-                    throw new Error(`its copy holds ${rows} rows but ${keys} distinct keys (Mason bug: report it, with mason logs): it was not swapped in, and is copied again from its first page`);
+                    throw new Error(`its synced data holds ${rows} rows but ${keys} distinct keys (Mason bug: report it, with mason logs): it was not swapped in, and is read again from its first page`);
                 }
             }
             // its stored JSON paths filled, so the table swapped in has every one whole (src/duck/kept.ts fillSide)
@@ -2328,14 +3241,17 @@ export class Sync {
             // THE SWAP, on the writer's turn: one transaction, between two of the stream's or the polls'. It carries the copy's
             // watermark (its first snapshot), removes its progress, and leaves the table behind until its catch-up (none in
             // recopy mode: no poll)
-            await this.onWriter(() => this.swap(t, side, { snapshot: p.snapshot, behind: p.snapshot === null ? null : "after its copy" }));
+            await this.onWriter(() => this.swap(t, side, { snapshot: p.snapshot, behind: p.snapshot === null ? null : "after its whole read" }));
             this.copyLive.delete(t.source);
             kept = null;
             this.retries.delete(t.source);
             const seconds = (Date.now() - started) / 1000;
-            this.log(`copied ${t.source}: ${p.rows} row(s), ${t.bytes} source bytes, in ${seconds.toFixed(2)} s (read in ${read.seconds.toFixed(2)} s` +
+            this.log(`synced ${t.source}: ${p.rows} row(s), ${t.bytes} source bytes, in ${seconds.toFixed(2)} s (read in ${read.seconds.toFixed(2)} s` +
                 `${resumed === null ? "" : `, resumed at page ${readThrough(resumed.done) ?? p.pages} of ${resumed.pages}${pastPages(resumed.done)} with ${resumed.rows} row(s) in`}), stored as the source's scan delivered them, with no index`);
-            await this.record({ source: t.source, phase: "copied", rows: p.rows, bytes: t.bytes, seconds, copiedAt: new Date().toISOString(), error: null }, t.columns, w);
+            const copiedAt = new Date().toISOString();
+            await this.record({ source: t.source, phase: "copied", rows: p.rows, bytes: t.bytes, seconds, copiedAt, error: null }, t.columns, w);
+            this.synced.set(t.source, { at: copiedAt, seconds, by: "copy" });
+            this.event({ kind: "copied", table: t.source, message: `synced: ${p.rows.toLocaleString("en-US")} row(s) in ${seconds.toFixed(2)} s` });
             this.copiedAs.set(t.source, columnsKey(t.columns));
             // in the catalog at once: a pass's other copies may take hours
             await this.rebuildSchema();
@@ -2351,7 +3267,7 @@ export class Sync {
                     k = await this.forgetCopy(t, side);
                 }
                 catch (f) {
-                    this.log(`the copy of ${t.source} could not drop what it began (its next attempt continues it): ${f instanceof Error ? f.message : String(f)}`);
+                    this.log(`the sync of ${t.source} could not drop what it began (its next attempt continues it): ${this.errorText(f)}`);
                 }
             }
             const through = k === null ? null : readThrough(k.done);
@@ -2359,12 +3275,12 @@ export class Sync {
             if (e instanceof Stopping) {
                 // the chunks in flight rolled back: a table never copied continues at the next start, one copied before serves its
                 // copy as it was meanwhile
-                this.log(`copy of ${t.source} stopped: Mason is stopping (${where === null ? "rolled back; it is copied at the next start" : `the chunks in flight rolled back; it continues ${where} at the next start`})`);
+                this.log(`sync of ${t.source} stopped: Mason is stopping (${where === null ? "rolled back; it is synced at the next start" : `the chunks in flight rolled back; it continues ${where} at the next start`})`);
                 if (first)
                     await this.record({ ...was, phase: "waiting", error: null }, undefined, w);
                 return;
             }
-            const m = e instanceof Error ? e.message : String(e);
+            const m = this.errorText(e);
             // tried again after a wait that grows with each failure in a row: a copy failing for good must not read the
             // source at every pass (a 20-minute read of a production replica every 95 minutes) — and then
             // continued where it was, never read again from its first page
@@ -2373,11 +3289,24 @@ export class Sync {
             this.retries.set(t.source, { failures, at });
             const when = `tried again after ${new Date(at).toISOString().slice(11, 16)} UTC (failure ${failures} in a row), or at once when Mason starts again or its columns or key change` +
                 (where === null ? "" : `; it continues ${where}`);
-            this.log(`copy of ${t.source} failed: ${m}; ${when}`);
+            this.log(`sync of ${t.source} failed: ${m}; ${when}`);
+            this.event({ kind: "copy_failed", table: t.source, message: `${m}; ${when}` });
             // a table that was copied keeps serving its last copy; one never copied is failed
             await this.record({ ...this.states.get(t.source), phase: first ? "failed" : "copied", error: `${m} (${when})` }, undefined, w);
         }
     }
+    /** Where the copy's file is, the bytes free there, and what the copies running are projected to add (`DiskStatus`). */
+    diskStatus() {
+        const dir = path.dirname(this.store.file);
+        const needed = [...this.copyLive.values()].map((l) => l.diskNeeded).filter((n) => n !== null);
+        const projectedBytes = needed.length ? Math.round(needed.reduce((a, b) => a + b, 0)) : null;
+        try {
+            return { path: dir, freeBytes: this.diskFree(dir), projectedBytes };
+        }
+        catch (e) {
+            return { path: dir, freeBytes: null, projectedBytes, error: `the free space where the synced data is could not be read: ${this.errorText(e)}` };
+        }
+    }
     /** The DuckDB file's bytes with its write-ahead log's (what a copy adds lands in the log until a checkpoint). */
     fileBytes() {
         let n = 0;
@@ -2392,16 +3321,18 @@ export class Sync {
         }
         return n;
     }
-    /** Why the copy of `t` must stop now — what its pages left would add is more than the disk has free — or null. */
-    diskShort(t, p, disk) {
+    /** Why the copy of `t` must stop now — what its pages left would add is more than the disk has free — or null. What
+     *  it projects is kept on the copy's `live` (`diskStatus` says it). */
+    diskShort(t, p, disk, live) {
         const bytesNow = this.fileBytes();
         const projected = copyDiskProjection({ pages: p.pages, done: p.done, doneAtStart: disk.doneAtStart, bytesAtStart: disk.bytesAtStart, bytesNow });
+        live.diskNeeded = projected?.needed ?? null;
         if (projected === null)
             return null;
         const free = this.diskFree(path.dirname(this.store.file));
         if (projected.needed <= free)
             return null;
-        return `the copy of ${t.source} would need about ${humanBytes(projected.needed)} more on disk than is free (${humanBytes(free)} free where ${this.store.file} is; ` +
+        return `the sync of ${t.source} would need about ${humanBytes(projected.needed)} more on disk than is free (${humanBytes(free)} free where ${this.store.file} is; ` +
             `${pagesRead(p.done, p.pages)} of ${p.pages} pages read, ${humanBytes(bytesNow - disk.bytesAtStart)} added): free some disk, mason remove ${t.source}, or mason add ${t.source} --columns … with fewer columns`;
     }
     /**
@@ -2433,6 +3364,11 @@ export class Sync {
         const named = t.columns.map((c) => ident(c.name)).join(", ");
         const started = Date.now();
         const lanes = [this.rebuilder];
+        // ITS VALUES OUT OF LINE, from the source's catalog (`chunkCeiling`): read once an attempt, before any transaction
+        // of the copy (a begun copy's first read fixes its snapshot); sizing only, so a resumed copy reads it again
+        const outOfLine = await this.interruptible(this.rebuilder, () => this.outOfLineBytes(pgFrom));
+        const limit = this.store.memoryLimitBytes;
+        const ceilingOf = (pages) => chunkCeiling(pages, t.rows, outOfLine, chunkBudgetBytes(limit, this.copyParallel), this.copyChunkRows);
         if (recopy)
             await w.run("BEGIN TRANSACTION");
         try {
@@ -2441,7 +3377,7 @@ export class Sync {
                 if (!recopy)
                     await w.run("BEGIN TRANSACTION");
                 try {
-                    begun = await this.interruptible(this.rebuilder, () => this.beginCopy(t, side, pgFrom));
+                    begun = await this.interruptible(this.rebuilder, () => this.beginCopy(t, side, pgFrom, ceilingOf, outOfLine));
                     if (!recopy) {
                         await this.writeBegun(t, begun);
                         await w.run("COMMIT");
@@ -2462,7 +3398,7 @@ export class Sync {
             // first chunks are a tenth of it, to measure, and every later one is what a reader reads in copyChunkSeconds at
             // the rate measured since — cut from what no committed chunk covers (`copyGaps`, `takeChunk`), so a copy resumed
             // reads exactly the ranges it did not commit, whatever size its chunks were
-            const ceiling = chunkPages(p.pages, t.rows, this.copyChunkRows);
+            const ceiling = ceilingOf(p.pages);
             const gaps = copyGaps(p.done);
             let rate = null;
             // the source's page size, for the bytes a second its readers read (pg_relation_size is in bytes; pages are its unit)
@@ -2480,7 +3416,7 @@ export class Sync {
             const pagesDone = pagesRead(p.done, p.pages);
             const live = { pages: p.pages, chunksDone: p.done.length, pagesDone, rowsDone: p.rows, untaken: gapPages(gaps, p.pages),
                 chunkPages: nextChunkPages(ceiling, null, this.copyChunkSeconds), readers, reading: [], rate: null,
-                rowsPerPage: pagesDone > 0 ? p.rows / pagesDone : t.rows !== null && t.rows > 0 && p.pages > 0 ? t.rows / p.pages : null };
+                rowsPerPage: pagesDone > 0 ? p.rows / pagesDone : t.rows !== null && t.rows > 0 && p.pages > 0 ? t.rows / p.pages : null, diskNeeded: null };
             this.copyLive.set(t.source, live);
             for (let i = 1; i < readers; i++) {
                 const lane = { conn: await this.store.instance.connect(), inFlight: false };
@@ -2495,6 +3431,10 @@ export class Sync {
                     if (l.inFlight)
                         l.conn.interrupt();
             };
+            // OUT OF MEMORY IN A CHUNK (53200, `pgErrorOf`; never 53400, the spill's ceiling, which is disk): its range is given
+            // back (`giveBack`) and the copy reads on with ONE reader (`sole`), each chunk at most half the one that ran out
+            // (`memoryPages`, which only shrinks in an attempt); a one-page chunk read alone that runs out fails the copy
+            let sole = null, memoryPages = Infinity;
             // the chunks since the last minute's line, and how long they took
             let lineAt = Date.now(), chunks = 0, chunkMs = 0;
             const reader = async (lane, k) => {
@@ -2502,8 +3442,10 @@ export class Sync {
                 for (;;) {
                     if (failure !== null)
                         return;
+                    if (sole !== null && sole !== k)
+                        return;
                     const sizedBy = rate;
-                    const range = takeChunk(gaps, p.pages, nextChunkPages(ceiling, sizedBy, this.copyChunkSeconds));
+                    const range = takeChunk(gaps, p.pages, Math.min(memoryPages, nextChunkPages(ceiling, sizedBy, this.copyChunkSeconds)));
                     if (range === undefined)
                         return;
                     const { first, end } = range;
@@ -2511,6 +3453,8 @@ export class Sync {
                     const chunkSize = Math.max(1, (end ?? p.pages) - first);
                     const slot = { since: Date.now(), pages: chunkSize };
                     live.reading.push(slot);
+                    // read with no other chunk in flight, by the one reader the copy reads with
+                    const alone = live.reading.length === 1 && (sole === k || readers === 1);
                     live.untaken = gapPages(gaps, p.pages);
                     live.chunkPages = nextChunkPages(ceiling, rate, this.copyChunkSeconds);
                     const told = { source: t.source, first, end, reader: k, pages: chunkSize, ceiling, sizedBy };
@@ -2535,7 +3479,7 @@ export class Sync {
                             const node = Number((await c.runAndReadAll(`SELECT * FROM ${pq(`SELECT pg_relation_filenode(${pgLiteral(pgFrom)}::regclass)::bigint`)}`)).getRowsJS()[0][0]);
                             filenode ??= node;
                             if (node !== filenode) {
-                                throw new StartOver(`the source rewrote ${t.source} since its copy began (its file changed: a VACUUM FULL, CLUSTER, TRUNCATE or column type change), so its rows moved between pages`);
+                                throw new StartOver(`the source rewrote ${t.source} since its sync began (its file changed: a VACUUM FULL, CLUSTER, TRUNCATE or column type change), so its rows moved between pages`);
                             }
                             const n = Number(r.rowsChanged);
                             await this.onChunk?.({ ...told, rows: n, phase: "read" });
@@ -2572,27 +3516,61 @@ export class Sync {
                         const at = live.reading.indexOf(slot);
                         if (at >= 0)
                             live.reading.splice(at, 1);
-                        if (inTx) {
+                        // rolled back, so its connection reads on: a ROLLBACK out of memory itself (measured, with other readers'
+                        // chunks in flight) is tried again while the others' memory is given back, for about two seconds
+                        let rolledBack = !inTx;
+                        for (let attempt = 0; inTx && !rolledBack; attempt++) {
                             try {
                                 await c.run("ROLLBACK");
+                                rolledBack = true;
                             }
                             catch (r) {
-                                this.log(`a chunk of ${t.source}'s copy could not be rolled back after it failed (its connection is closed with the copy): ${r instanceof Error ? r.message : String(r)}`);
+                                const said = this.errorText(r);
+                                // the engine ended the transaction itself (measured: "cannot rollback - no transaction is active" after a
+                                // COMMIT, or a read, out of memory): nothing of the chunk is left to roll back
+                                if (endedTransaction(r)) {
+                                    rolledBack = true;
+                                    break;
+                                }
+                                if (attempt < 20 && pgErrorOf(r, "").fields.code === "53200") {
+                                    await new Promise((ok) => setTimeout(ok, 100));
+                                    continue;
+                                }
+                                this.log(`a chunk of ${t.source}'s sync could not be rolled back after it failed (its connection is closed with the sync): ${said}`);
+                                break;
+                            }
+                        }
+                        if (failure === null && !recopy && rolledBack && pgErrorOf(e, "").fields.code === "53200") {
+                            giveBack(gaps, range);
+                            live.untaken = gapPages(gaps, p.pages);
+                            if (chunkSize <= 1 && alone) {
+                                const rpp = live.rowsPerPage;
+                                fail(new Error(tooLargeText(t.source, `one page of its table${rpp === null ? "" : ` (about ${Math.max(1, Math.round(rpp)).toLocaleString("en-US")} row(s))`}, read alone, ran out of memory`, limit)));
+                                return;
+                            }
+                            const was = { sole, memoryPages };
+                            sole ??= k;
+                            memoryPages = Math.max(1, Math.min(memoryPages, Math.floor(chunkSize / 2)));
+                            live.readers = 1;
+                            live.chunkPages = Math.min(memoryPages, live.chunkPages);
+                            if (was.sole === null || was.memoryPages !== memoryPages) {
+                                this.log(`a chunk of ${chunkSize} page(s) of ${t.source} ran out of memory: reading on one chunk at a time, ${memoryPages} page(s) each`);
                             }
+                            continue;
                         }
                         fail(e);
                         return;
                     }
                     // STOPPED BEFORE THE DISK FILLS: the chunks committed are kept, the copy fails with the way out and is tried
                     // again as a failed copy is (freed disk is used at the retry, or at once at the next start)
-                    const short = recopy ? null : this.diskShort(t, p, disk);
+                    const short = recopy ? null : this.diskShort(t, p, disk, live);
                     if (short !== null) {
                         fail(new Error(short));
                         return;
                     }
                     const at = readThrough(p.done);
                     if (Date.now() - lineAt >= 60_000 && at !== null) {
-                        this.log(`copying ${t.source}: page ${at} of ${p.pages}${pastPages(p.done)}, ${p.rows.toLocaleString("en-US")} row(s) in; ${chunks} chunk(s) in the last minute on ${readers} reader(s), ` +
+                        this.log(`syncing ${t.source}: page ${at} of ${p.pages}${pastPages(p.done)}, ${p.rows.toLocaleString("en-US")} row(s) in; ${chunks} chunk(s) in the last minute on ${readers} reader(s), ` +
                             `${(chunkMs / chunks / 1000).toFixed(1)} s each` + (rate === null ? "" : `; a reader reads ~${Math.round(rate.rowsPerSecond).toLocaleString("en-US")} rows/s ` +
                             `(${humanBytes(rate.bytesPerSecond)}/s of the table's pages), so the next chunk is ${live.chunkPages} page(s), ~${this.copyChunkSeconds} s (MASON_COPY_CHUNK_SECONDS; at most ${ceiling})`));
                         lineAt = Date.now();
@@ -2608,12 +3586,17 @@ export class Sync {
                         l.conn.interrupt(); }, 50);
             try {
                 await Promise.all(lanes.map((lane, k) => reader(lane, k)));
+                // a range given back once the other readers had finished: the one reader left reads it
+                while (failure === null && sole !== null && gaps.length > 0)
+                    await reader(lanes[sole], sole);
             }
             finally {
                 clearInterval(again);
             }
             if (failure !== null)
                 throw failure.error;
+            if (gaps.length > 0)
+                throw new Error(`the sync of ${t.source} ended with pages ${JSON.stringify(gaps)} unread (Mason bug: report it, with mason logs)`);
             if (recopy)
                 await w.run("COMMIT");
             return { rows: p.rows, seconds: (Date.now() - started) / 1000, progress: p };
@@ -2636,25 +3619,40 @@ export class Sync {
      *  extension's REPEATABLE READ snapshot; its xmin is the copy's watermark, as the change reader records one before its
      *  copy), the exact numerics' widths, the side table (NO KEY: no PRIMARY KEY or UNIQUE, so no index), and the heap's
      *  pages now (`pg_relation_size`, exact where `relpages` is an estimate) */
-    async beginCopy(t, side, pgFrom) {
+    async beginCopy(t, side, pgFrom, ceilingOf, outOfLine) {
         const w = this.rebuilder.conn;
         const snapshot = this.mode !== "recopy" ? (await w.runAndReadAll(`SELECT * FROM ${pq(SNAPSHOT_SQL)}`)).getRowsJS()[0][0] : null;
         const described = await w.runAndReadAll(`DESCRIBE SELECT ${t.columns.map((c) => ident(c.name)).join(", ")} FROM ${SRC}.${ident(t.schema)}.${ident(t.table)}`);
         const scanned = new Map(described.getRowsJS().map((r) => [String(r[0]), String(r[1])]));
+        // a domain's column as its base type reads: the extension's scan of the table does not know a domain
+        const domains = t.columns.filter((c) => c.domain === true);
+        if (domains.length > 0) {
+            const read = await w.runAndReadAll(`DESCRIBE SELECT * FROM ${pq(`SELECT ${domains.map((c) => pgColumnSql(c, new Map(), new Set())).join(", ")} FROM ${pgFrom} LIMIT 0`)}`);
+            for (const r of read.getRowsJS())
+                scanned.set(String(r[0]), String(r[1]));
+        }
         // the numerics the extension would read as doubles: their widths, in the copy's snapshot (NUMERIC_TYPE)
         const exact = await this.exactNumerics(t, scanned, pgFrom);
         const defs = t.columns.map((c) => `${ident(c.name)} ${exact.has(c.name) ? `DECIMAL(38,${exact.get(c.name)})` : storedType(c, scanned.get(c.name) ?? "VARCHAR")}`);
         await w.run(`CREATE SCHEMA IF NOT EXISTS ${ident(t.schema)}`);
         await w.run(`CREATE OR REPLACE TABLE ${side} (${defs.join(", ")})`);
         const pages = Number((await w.runAndReadAll(`SELECT * FROM ${pq(`SELECT (pg_relation_size(${pgLiteral(pgFrom)}::regclass) / current_setting('block_size')::int)::bigint`)}`)).getRowsJS()[0][0]);
-        const ceiling = chunkPages(pages, t.rows, this.copyChunkRows);
+        const ceiling = ceilingOf(pages);
+        const byBytes = ceiling < chunkPages(pages, t.rows, this.copyChunkRows) && outOfLine !== null
+            ? ` for its ${humanBytes(outOfLine)} of values out of line in ${humanBytes(this.store.memoryLimitBytes)} of memory` : "";
         const firstSize = nextChunkPages(ceiling, null, this.copyChunkSeconds);
         const readers = this.mode === "recopy" ? 1 : Math.min(this.copyParallel, Math.max(1, Math.ceil(pages / firstSize)));
-        this.log(`copying ${t.source}${snapshot === null ? "" : ` as of the source's snapshot ${snapshot}: what commits after it is caught up by one poll once copied`}; ` +
-            `${pages} page(s) in chunks sized to ~${this.copyChunkSeconds} s of reading each at the rate measured here (MASON_COPY_CHUNK_SECONDS; at most ${ceiling} page(s)), ` +
+        this.log(`syncing ${t.source}${snapshot === null ? "" : ` as of the source's snapshot ${snapshot}: what commits after it is caught up by one poll once read`}; ` +
+            `${pages} page(s) in chunks sized to ~${this.copyChunkSeconds} s of reading each at the rate measured here (MASON_COPY_CHUNK_SECONDS; at most ${ceiling} page(s)${byBytes}), ` +
             `the first of ${firstSize} page(s) to measure it, ${readers === 1 ? "one at a time" : `${readers} at a time (MASON_COPY_PARALLEL), each a backend on the database`}`);
         return { snapshot, columns: columnsKey(t.columns), exact, filenode: null, pages, done: [], rows: 0 };
     }
+    /** THE SOURCE TABLE'S VALUES OUT OF LINE, in bytes: its TOAST table's (`pg_table_size`, no index), 0 with none; the
+     *  one reading of it (`chunkCeiling`) */
+    async outOfLineBytes(pgFrom) {
+        const r = await this.rebuilder.conn.runAndReadAll(`SELECT * FROM ${pq(`SELECT COALESCE((SELECT pg_table_size(reltoastrelid) FROM pg_class WHERE oid = ${pgLiteral(pgFrom)}::regclass AND reltoastrelid <> 0), 0)::bigint`)}`);
+        return Number(r.getRowsJS()[0][0]);
+    }
     /** what a copy was begun with, in its beginning's transaction (`CopyProgress`) */
     async writeBegun(t, p) {
         await this.rebuilder.conn.run(`INSERT OR REPLACE INTO ${MASON_SCHEMA}.copy_progress VALUES (${literal(t.source)}, ${p.snapshot === null ? "NULL" : literal(p.snapshot)}, ` +
@@ -2676,7 +3674,7 @@ export class Sync {
         const row = r[0];
         if (row === undefined || row[0] === null || row[1] !== columnsKey(t.columns) || !there) {
             if (row !== undefined)
-                this.log(`starting the copy of ${t.source} over, from its first page: ${!there ? "the table it was filling is gone" : row[0] === null ? "it was begun as a recopy" : "its columns are not the ones its copy was begun with"}`);
+                this.log(`starting the sync of ${t.source} over, from its first page: ${!there ? "the table it was filling is gone" : row[0] === null ? "it was begun as a recopy" : "its columns are not the ones its sync was begun with"}`);
             return this.forgetCopy(t, side);
         }
         const chunks = (await w.runAndReadAll(`SELECT first_page, end_page, "rows", filenode FROM ${MASON_SCHEMA}.copy_chunks WHERE source = ${literal(t.source)} ORDER BY first_page`)).getRowsJS();
@@ -2684,8 +3682,8 @@ export class Sync {
         const rows = chunks.reduce((n, c) => n + Number(c[2]), 0);
         const p = { snapshot: row[0], columns: row[1], exact: new Map(JSON.parse(row[2])), filenode: chunks.length ? Number(chunks[0][3]) : null, pages: Number(row[3]), done, rows };
         const at = readThrough(done);
-        this.log(at === null ? `resuming the copy of ${t.source} with every page read (${rows} row(s) in): its swap is next`
-            : `resuming the copy of ${t.source} at page ${at} of ${p.pages}${pastPages(done)}, ${rows} row(s) in, held to its first snapshot ${p.snapshot}: the pages read before are not read again`);
+        this.log(at === null ? `resuming the sync of ${t.source} with every page read (${rows} row(s) in): its swap is next`
+            : `resuming the sync of ${t.source} at page ${at} of ${p.pages}${pastPages(done)}, ${rows} row(s) in, held to its first snapshot ${p.snapshot}: the pages read before are not read again`);
         const now = this.states.get(t.source);
         if (now !== undefined && now.phase === "copying")
             this.states.set(t.source, { ...now, rowsSoFar: rows, rowsEstimate: t.rows });
@@ -2710,7 +3708,7 @@ export class Sync {
                 await w.run(`ALTER TABLE ${MASON_SCHEMA}.copy_progress DROP COLUMN IF EXISTS ${ident(gone)}`);
             await w.run("COMMIT");
             if (moved > 0)
-                this.log(`${moved} copy(ies) in progress were begun by a Mason that read one chunk at a time: each continues where it was`);
+                this.log(`${moved} sync(s) in progress were begun by a Mason that read one chunk at a time: each continues where it was`);
         }
         catch (e) {
             await w.run("ROLLBACK");
@@ -2737,8 +3735,51 @@ export class Sync {
         for (const [source] of r.getRowsJS()) {
             if (this.states.get(source)?.phase !== "copied")
                 continue;
-            this.retired.add(source);
-            this.log(`${source}: its copy is ${RETIRED_LAYOUT} — its rows are sorted on disk, and only the source has them in its own order, so it is read again whole; the copy serves as it was until then`);
+            this.retired.set(source, { layout: RETIRED_LAYOUT, short: "in an older Mason's layout, key order with an index" });
+            this.log(`${source}: it is ${RETIRED_LAYOUT} — its rows are sorted on disk, and only the source has them in its own order, so it is read again whole; its synced data serves as it was until then`);
+        }
+        await this.findHeldLayout();
+    }
+    /**
+     * THE COPIES AN OLDER MASON MADE BEFORE A TYPE WAS HELD AS ITS TEXT (`HELD_LAYOUT`), read at `open` from what each copy
+     * physically is, never from its record alone: a record written before `typeKind` was read says neither that a column
+     * is an enum nor how a held one was stored. Each copied column is held to what `storedType` makes of it now: an ENUM is
+     * an enum (its record completed, so its key is the one a fresh read makes, and it is not read again for nothing); a
+     * column held as its text that is not a VARCHAR (a `point` as the extension's STRUCT) marks the table, said by name and
+     * copied again through the normal path (`needsCopy`), serving as it was until its swap.
+     */
+    async findHeldLayout() {
+        const r = await this.store.writer.runAndReadAll(`SELECT schema_name || '.' || table_name, column_name, data_type FROM duckdb_columns() ` +
+            `WHERE database_name = current_database() AND schema_name <> ${literal(MASON_SCHEMA)}`);
+        const physical = new Map();
+        for (const [source, column, type] of r.getRowsJS()) {
+            const m = physical.get(source) ?? new Map();
+            m.set(column, type);
+            physical.set(source, m);
+        }
+        for (const [source, columns] of this.copiedColumns) {
+            const types = physical.get(source);
+            if (this.states.get(source)?.phase !== "copied" || types === undefined || this.retired.has(source))
+                continue;
+            const mis = [];
+            const completed = columns.map((c) => {
+                const type = types.get(c.name);
+                if (type === undefined)
+                    return c;
+                if (c.typeKind === undefined && type.startsWith("ENUM("))
+                    return { ...c, typeKind: "e" };
+                const hold = holdOf(c.type, c.typeKind);
+                const want = hold === "text" ? "VARCHAR" : hold === "text[]" ? "VARCHAR[]" : null;
+                if (want !== null && type !== want)
+                    mis.push(`${c.name} (${c.type})`);
+                return c;
+            });
+            this.copiedColumns.set(source, completed);
+            this.copiedAs.set(source, columnsKey(completed));
+            if (mis.length === 0)
+                continue;
+            this.retired.set(source, { layout: HELD_LAYOUT, short: `in an older Mason's layout, ${mis.join(", ")} not held as the source's text` });
+            this.log(`${source}: it is ${HELD_LAYOUT} (${mis.join(", ")}) — it is read again whole; its synced data serves as it was until then`);
         }
     }
     /** what a copy of the retired layout left beside the file (in that layout a copy was staged in a file of its own,
@@ -2747,7 +3788,7 @@ export class Sync {
         const dir = path.dirname(this.store.file), base = `${path.basename(this.store.file)}.stage-`;
         for (const f of fs.readdirSync(dir).filter((x) => x.startsWith(base))) {
             fs.rmSync(path.join(dir, f), { recursive: true, force: true });
-            this.log(`removed ${f}: a copy's stage, from an older Mason (a copy now reads the source once, straight into its table)`);
+            this.log(`removed ${f}: a sync's stage, from an older Mason (a sync now reads the source once, straight into its table)`);
         }
     }
     /** The table's numerics the extension would read as doubles, each with the DECIMAL(38, s) scale that holds every value
@@ -2771,11 +3812,11 @@ export class Sync {
             const scale = declared[1] !== undefined ? used ?? 0 : maxScale ?? 0;
             const width = (digits ?? 1) + scale;
             if ((special ?? 0) > 0) {
-                this.log(`${t.source}.${c.name}: ${special} value(s) NaN or Infinity, which DuckDB's DECIMAL cannot hold: copied as a double`);
+                this.log(`${t.source}.${c.name}: ${special} value(s) NaN or Infinity, which the synced table's DECIMAL cannot hold: synced as a double`);
                 return;
             }
             if (scale > 38 || width > 38) {
-                this.log(`${t.source}.${c.name}: values of ${digits ?? 1} digit(s) and ${scale} decimal(s) do not fit DuckDB's DECIMAL(38): copied as a double (15 significant digits)`);
+                this.log(`${t.source}.${c.name}: values of ${digits ?? 1} digit(s) and ${scale} decimal(s) do not fit the synced table's DECIMAL(38): synced as a double (15 significant digits)`);
                 return;
             }
             if (declared[1] === undefined && minScale !== null && minScale !== maxScale)
@@ -2795,6 +3836,12 @@ export class Sync {
      *  writer only on its turn: a statement on a connection lands inside the transaction open there). The table's row is
      *  that flow's alone while it writes it (a rebuild's table is not polled or streamed until caught up) */
     async record(s, columns, c = this.store.writer) {
+        // A COPY CURRENT AGAIN after its poll, catch-up or stream failed (its error cleared by the flow that keeps it current,
+        // never by a copy of it: that is its own `copied` event) — the one place an error is cleared, so the one place said
+        const was = this.states.get(s.source);
+        if (was !== undefined && was.error !== null && s.error === null && was.phase === "copied" && s.phase === "copied" && was.copiedAt === s.copiedAt) {
+            this.event({ kind: "recovered", table: s.source, message: `current again (it had failed: ${was.error.split("\n")[0]})` });
+        }
         this.states.set(s.source, s);
         const v = (x) => x === null ? "NULL" : typeof x === "number" ? String(x) : literal(x);
         const sql = `INSERT OR REPLACE INTO ${MASON_SCHEMA}.copy_state (source, phase, "rows", bytes, seconds, copied_at, error, columns) VALUES (${literal(s.source)}, ${literal(s.phase)}, ${v(s.rows)}, ${v(s.bytes)}, ${v(s.seconds)}, ` +
@@ -2804,7 +3851,7 @@ export class Sync {
             await c.run(sql);
         }
         catch (e) {
-            this.log(`recording ${s.source}'s copy state failed: ${e instanceof Error ? e.message : String(e)}`);
+            this.log(`recording ${s.source}'s sync state failed: ${this.errorText(e)}`);
         }
     }
     /** the catalog rebuilt (`schemaBuilt`), after any rebuild already under way */
@@ -2842,11 +3889,24 @@ export class Sync {
                 ...(uniqueKeys.length ? { uniqueKeys } : {}),
                 ...(t.rowTypeOid !== undefined && columns.length === cols.length ? { rowTypeOid: t.rowTypeOid } : {}) });
         }
-        const views = this.views;
-        const key = JSON.stringify([tables, views]);
+        // ONE SOURCE OF AN ENUM'S LABELS, the synced table's ENUM: a generated table stores the ENUM it was built with, which
+        // a value added since (ALTER TYPE … ADD VALUE, re-copied) is not in, so its column declares the type by the synced
+        // labels; its own only where no synced column has the type
+        const synced = new Map(tables.flatMap((t) => t.columns.flatMap((x) => x.enumLabels !== undefined && x.spelled !== undefined ? [[x.spelled.replace(/\[\]$/, ""), x.enumLabels]] : [])));
+        // each generated table served, as a copy of its output's types: no key, no joins
+        for (const g of this.generated.served()) {
+            const types = await c.prepare(`SELECT * FROM ${ident(g.schema)}.${ident(g.table)} LIMIT 0`);
+            const duckTypes = new Map(Array.from({ length: types.columnCount }, (_, i) => [types.columnName(i), types.columnType(i)]));
+            types.destroySync();
+            const columns = g.columns.filter((x) => duckTypes.has(x.name)).map((x) => pgColumn({ name: x.name, type: x.type, notNull: false, comment: null }, duckTypes.get(x.name), undefined))
+                .map((x) => { const labels = x.enumLabels !== undefined && x.spelled !== undefined ? synced.get(x.spelled.replace(/\[\]$/, "")) : undefined; return labels === undefined ? x : { ...x, enumLabels: labels }; });
+            tables.push({ name: g.table, schema: g.schema, primaryKey: [], columns, joins: [], ...(g.comment !== null ? { description: g.comment } : {}) });
+        }
+        const views = this.views, collations = this.collations;
+        const key = JSON.stringify([tables, views, collations]);
         if (key !== this.schemaKey) {
             this.schemaKey = key;
-            this.currentSchema = { database: this.database, tables, ...(views.length > 0 ? { views } : {}) };
+            this.currentSchema = { database: this.currentSchema.database, tables, ...(views.length > 0 ? { views } : {}), ...(collations.length > 0 ? { collations } : {}) };
         }
     }
 }
@@ -2865,33 +3925,14 @@ async function enumLists(c, table) {
 function pgColumnSql(c, exact, lists) {
     if (exact.has(c.name))
         return `${pgIdent(c.name)}::text AS ${pgIdent(c.name)}`;
-    if (KEPT_ARRAYS.has(c.type) || lists.has(c.name))
+    const hold = holdOf(c.type, c.typeKind);
+    if (KEPT_ARRAYS.has(c.type) || lists.has(c.name) || hold === "text[]")
         return `${pgIdent(c.name)}::text[] AS ${pgIdent(c.name)}`;
-    return pgIdent(c.name);
-}
-/** the OID family a source type is sent in (text for every character type: DuckDB has one VARCHAR) */
-function sourceOid(spelled) {
-    const array = spelled.endsWith("[]");
-    const base = spelled.replace(/\[\]$/, "").replace(/\(.*\)/, "").trim();
-    const oid = {
-        smallint: 21, integer: 23, bigint: 20, real: 700, "double precision": 701, numeric: 1700, text: 25, "character varying": 25, character: 25,
-        boolean: 16, uuid: 2950, date: 1082, "time without time zone": 1083, "timestamp without time zone": 1114, "timestamp with time zone": 1184,
-        interval: 1186, json: 3802, jsonb: 3802, bytea: 17,
-        // held as DuckDB text, declared as themselves: the catalog Postgres resolves their operators (citext's
-        // case-insensitive ones) and the wire sends their OID (src/duck/types.ts)
-        inet: 25, citext: 25,
-    };
-    const o = oid[base];
-    if (o === undefined)
-        return null;
-    return array ? -o : o;
+    if (hold === "text")
+        return `${pgIdent(c.name)}::text AS ${pgIdent(c.name)}`;
+    // a domain's value as its base type, which the extension reads
+    return c.domain === true ? `${pgIdent(c.name)}::${c.type} AS ${pgIdent(c.name)}` : pgIdent(c.name);
 }
-/** the Postgres spelling of the wire's OID: what the catalog says when the source's spelling would disagree with the wire */
-const SPELLING_OF_OID = {
-    21: "smallint", 23: "integer", 20: "bigint", 700: "real", 701: "double precision", 1700: "numeric", 25: "text", 16: "boolean", 2950: "uuid",
-    1082: "date", 1083: "time without time zone", 1114: "timestamp without time zone", 1184: "timestamp with time zone", 1186: "interval", 3802: "jsonb", 17: "bytea",
-};
-const ELEMENT_OF_ARRAY = { 1000: 16, 1001: 17, 1016: 20, 1005: 21, 1007: 23, 1009: 25, 1021: 700, 1022: 701, 1182: 1082, 1183: 1083, 1115: 1114, 1185: 1184, 1187: 1186, 1231: 1700, 2951: 2950, 3807: 3802 };
 const API_TYPE = { 21: "int2", 23: "int4", 20: "int8", 700: "float4", 701: "float8", 1700: "numeric", 25: "text", 16: "bool", 2950: "uuid", 1082: "date", 1184: "timestamptz", 3802: "jsonb" };
 /** an ENUM's labels, of the column or of its list's element; null for any other type */
 function enumLabelsOf(t) {
@@ -2899,28 +3940,30 @@ function enumLabelsOf(t) {
     return own instanceof DuckDBEnumType ? own.values : null;
 }
 /**
- * A copied column in the catalog: the SOURCE's spelling (`numeric(12,2)`, `character varying(255)`) wherever the wire
- * sends that family of type, so a tool sees the source's own types; the wire's type where they differ (an unconstrained
- * `numeric` the extension reads as DOUBLE is `double precision`, an enum is `text`).
+ * A copied column in the catalog: ALWAYS the source's type, as the source spells it (`numeric(12,2)`, `character
+ * varying(255)`, `time with time zone`, `point`), so a tool sees the source's own types whatever the copy holds
+ * (src/duck/held-types.ts) — but for the one the copy computes as another: a `numeric` past DuckDB's DECIMAL, read as
+ * DOUBLE, is `double precision` on the catalog as on the wire (the limits `numeric-over-38-digits`, `numeric-array`).
  */
 function pgColumn(c, duck, now) {
     const wire = wireColumn(c.name, duck).oid;
-    const element = ELEMENT_OF_ARRAY[wire];
-    const wireFamily = element !== undefined ? -element : wire;
-    // an array DuckDB holds as VARCHAR[] whose elements the wire writes as the source's type (src/duck/types.ts: a json's
-    // text, a jsonb's canonical text, an inet's output, a citext's bytes): declared as the source spells it
-    // an enum (or an array of one) DuckDB holds as its ENUM, in the declared order: declared as the source's type, with
-    // its labels, so Postgres orders and compares it by them
+    // an enum (or an array of one) DuckDB holds as its ENUM, in the declared order: declared with its labels, so Postgres
+    // orders and compares it by them
     const labels = enumLabelsOf(duck);
-    const spelled = labels !== null || sourceOid(c.type) === wireFamily || (wire === 1009 && KEPT_ARRAYS.has(c.type)) ? c.type
-        : element !== undefined ? `${SPELLING_OF_OID[element] ?? "text"}[]` : SPELLING_OF_OID[wire] ?? "text";
+    const double = c.type.startsWith("numeric") ? wire === 701 ? "double precision" : wire === 1022 ? "double precision[]" : null : null;
+    const spelled = double ?? c.type;
+    const kind = (now ?? c).typeKind ?? c.typeKind;
+    // a type a database made, held as its text: the catalog declares it as a type with nothing over it
+    const made = c.typeOid !== undefined && labels === null && holdOf(c.type, kind) !== "same" ? kind === "c" ? "row" : true : undefined;
     // `type` is the ClickHouse path's; the catalog reads `spelled`
     const type = API_TYPE[wire] ?? "text";
     const facts = now ?? c;
-    return { name: c.name, type, spelled, ...(c.comment ? { description: c.comment } : {}), ...(labels !== null ? { enumLabels: labels } : {}),
+    return { name: c.name, type, spelled, ...(c.comment ? { description: c.comment } : {}), ...(labels !== null ? { enumLabels: labels } : {}), ...(made !== undefined ? { made } : {}),
         ...(facts.notNull ? { notNull: true } : {}), ...(facts.default !== undefined ? { default: facts.default } : {}),
         ...(facts.identity !== undefined ? { identity: facts.identity } : {}), ...(facts.sequence !== undefined ? { sequence: facts.sequence } : {}),
-        ...(c.typeOid !== undefined && spelled === c.type ? { typeOid: c.typeOid, ...(c.typeArrayOid !== undefined ? { typeArrayOid: c.typeArrayOid } : {}) } : {}) };
+        ...(facts.collation !== undefined ? { collation: facts.collation } : {}),
+        // a number, whatever spelling the column's record kept (an oid is a string in Postgres's JSON, and a copy's columns are JSON)
+        ...(c.typeOid !== undefined && double === null ? { typeOid: Number(c.typeOid), ...(c.typeArrayOid !== undefined ? { typeArrayOid: Number(c.typeArrayOid) } : {}) } : {}) };
 }
 /** a span as the stream's line says it: `2.1 s`, `3 min`, `2 h` */
 function secondsText(ms) {