@quereus/sync 4.3.2 → 4.4.1

package/dist/src/sync/sync-manager-impl.d.ts

@@ -5,7 +5,7 @@
  * Delegates to focused sub-modules for snapshot, streaming, and change application.
  */
 import type { KVStore } from '@quereus/store';
-import type { Database, LensDeploymentSnapshot, TransactionCommitBatch } from '@quereus/quereus';
+import type { Database, KeyNormalizerResolver, LensDeploymentSnapshot, TransactionCommitBatch } from '@quereus/quereus';
 import type { GetTableSchemaCallback, TransactionCommitSource } from '../create-sync-module.js';
 import { HLCManager, type HLC } from '../clock/hlc.js';
 import { type SiteId } from '../clock/site.js';
@@ -15,6 +15,7 @@ import { SchemaMigrationStore } from '../metadata/schema-migration.js';
 import { ChangeLogStore } from '../metadata/change-log.js';
 import { QuarantineStore } from '../metadata/quarantine.js';
 import { BasisLifecycleStore, type BasisTableLifecycleRecord } from '../metadata/basis-lifecycle.js';
+import { type PkKeying } from '../metadata/keys.js';
 import type { SyncManager, SnapshotCheckpoint } from './manager.js';
 import type { SyncConfig, ChangeSet, ApplyResult, Snapshot, SnapshotChunk, SnapshotProgress, ApplyToStoreCallback, DropLocalTableCallback, UnknownTableDisposition } from './protocol.js';
 import { SyncEventEmitterImpl } from './events.js';
@@ -49,6 +50,13 @@ export declare class SyncManagerImpl implements SyncManager, SyncContext {
     private readonly getTableSchema?;
     /** Reclaim-by-name callback for the eviction sweep; absent ⇒ sweep is a no-op. */
     private readonly dropLocalTable?;
+    /**
+     * Per-table pk-identity keying resolver (see `metadata/pk-identity.ts`),
+     * threaded into every metadata store so `cv:`/`tb:`/`cl:` keys file under the
+     * row's collation/transform-normalized identity. Raw keying when no
+     * `getTableSchema` oracle was wired (relay-only deployment).
+     */
+    private readonly pkKeying;
     private commitChain;
     private readonly lastBasisHash;
     private unknownTableIgnored;
@@ -72,10 +80,16 @@ export declare class SyncManagerImpl implements SyncManager, SyncContext {
      * @param getTableSchema - Optional callback for getting table schema by name
      * @param dropLocalTable - Optional reclaim-by-name callback for the basis-table
      *   eviction sweep; when absent (e.g. a relay-only coordinator) the sweep is a no-op.
+     * @param keyNormalizerResolver - Optional collation-name → key-normalizer resolver
+     *   (pass the engine's `db.getKeyNormalizerResolver()`), used to build pk-identity
+     *   keys that agree with the database's row identity. When absent, a built-ins-only
+     *   resolver (BINARY/NOCASE/RTRIM) is used, which throws on custom collation names.
      */
-    static create(kv: KVStore, transactionSource: TransactionCommitSource | undefined, config: SyncConfig, syncEvents: SyncEventEmitterImpl, applyToStore?: ApplyToStoreCallback, getTableSchema?: GetTableSchemaCallback, dropLocalTable?: DropLocalTableCallback): Promise<SyncManagerImpl>;
+    static create(kv: KVStore, transactionSource: TransactionCommitSource | undefined, config: SyncConfig, syncEvents: SyncEventEmitterImpl, applyToStore?: ApplyToStoreCallback, getTableSchema?: GetTableSchemaCallback, dropLocalTable?: DropLocalTableCallback, keyNormalizerResolver?: KeyNormalizerResolver): Promise<SyncManagerImpl>;
     getSiteId(): SiteId;
     getCurrentHLC(): HLC;
+    /** See {@link SyncContext.getPkKeying}. */
+    getPkKeying(schema: string, table: string): PkKeying;
     /**
      * Basis-membership oracle for unknown-table detection. `getTableSchema(s,t)
      * === undefined` ⇒ the table is outside the local basis. When no oracle was
@@ -164,6 +178,45 @@ export declare class SyncManagerImpl implements SyncManager, SyncContext {
      * HLC clock state — lands in a single KV batch.
      */
     private handleTransactionCommit;
+    /**
+     * Drop the data events of any table that is no longer in the local basis — the
+     * schema oracle does not know it, typically because this same transaction dropped
+     * it and the schema is already gone by the time the commit group is delivered.
+     * A schemaless table has no sound pk identity (see `metadata/pk-identity.ts`), so
+     * its rows cannot be filed.
+     *
+     * Local capture is therefore best-effort at TABLE granularity: one unknown table
+     * costs only its own rows, never the rest of the transaction (which is what the
+     * handler's top-level catch would do — it aborts recording of every other table's
+     * rows AND the transaction's schema migrations).
+     *
+     * Runs BEFORE the HLC tick, so a transaction whose data is entirely skipped and
+     * that carries no schema events consumes no clock and emits no local change,
+     * mirroring the all-remote echo early-out. Filtering up front also means no event
+     * is ever half-recorded: the throw it replaces could fire *after* a tombstone had
+     * already been staged into the shared `WriteBatch`.
+     *
+     * The gate is basis MEMBERSHIP, not "this transaction dropped the table":
+     * `drop t; create t; insert into t` carries a drop event for `t` yet leaves it in
+     * basis, and its rows must still be captured. `localSchema` is consulted only to
+     * classify the log line — an expected skip reads differently from a table that
+     * vanished for some other reason.
+     *
+     * ONLY the unknown-table case is skipped. Any other keying failure — a pk column
+     * whose collation the wired `keyNormalizerResolver` does not know, say — still
+     * throws out of `recordDataEvent` and fails the transaction loudly; silently
+     * discarding those rows would bury a real misconfiguration.
+     *
+     * A relay-only manager (no `getTableSchema` oracle) reports every table in basis,
+     * so nothing is skipped there.
+     */
+    private filterCapturableDataEvents;
+    /**
+     * Report skipped tables: ONE line per table with its change count, never one per
+     * row. A table this same transaction dropped is expected and logs informationally;
+     * anything else is a warning — the table vanished for some other reason.
+     */
+    private logSkippedTables;
     /**
      * Record one local schema-change event as a migration. Allocates an `opSeq`
      * (via `nextHlc`) only when the event maps to a tracked migration, so
@@ -174,6 +227,11 @@ export declare class SyncManagerImpl implements SyncManager, SyncContext {
     /**
      * Record one local data-change event: a tombstone (delete) or the changed
      * column versions (insert/update). Each recorded fact consumes one `opSeq`.
+     *
+     * All reads of the row's current metadata go overlay-first (`staged`), so a
+     * transaction that touches one row more than once records the same metadata
+     * the equivalent sequence of separate transactions would — and every write
+     * staged into `batch` is noted back into the overlay.
      */
     private recordDataEvent;
     private recordColumnVersions;
@@ -234,8 +292,8 @@ export declare class SyncManagerImpl implements SyncManager, SyncContext {
      * Resolve a change-log entry to the live {@link Change} it references, or
      * `null` when the underlying column version / tombstone is gone — a stale log
      * entry (e.g. a column overwritten, or a row deleted after the entry was
-     * written). The authoritative HLC and value come from the current version, not
-     * the log key.
+     * written). The authoritative HLC, value AND pk come from the current version
+     * record, not the log key — the key carries only the lossy pk identity.
      */
     private resolveLogEntry;
     /**
@@ -315,6 +373,14 @@ export declare class SyncManagerImpl implements SyncManager, SyncContext {
     getPeerSyncState(peerSiteId: SiteId): Promise<HLC | undefined>;
     updatePeerSentState(peerSiteId: SiteId, hlc: HLC): Promise<void>;
     getPeerSentState(peerSiteId: SiteId): Promise<HLC | undefined>;
+    /**
+     * Drop tombstones past the retention horizon, together with the change-log
+     * `delete` entry each one backs. The entry is only an index pointer at the
+     * tombstone ({@link resolveLogEntry} returns null once the tombstone is gone),
+     * so leaving it would accumulate one dead entry per delete the replica has ever
+     * seen — the delete-side twin of the column cleanup in
+     * {@link deleteRowVersionsAndLogEntries}. Both deletions share this batch.
+     */
     pruneTombstones(): Promise<number>;
     /**
      * GC quarantined out-of-basis straggler changes past the retention horizon —

package/dist/src/sync/sync-manager-impl.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sync-manager-impl.d.ts","sourceRoot":"","sources":["../../../src/sync/sync-manager-impl.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAc,MAAM,gBAAgB,CAAC;AAC1D,OAAO,KAAK,EAGX,QAAQ,EACR,sBAAsB,EACtB,sBAAsB,EAGtB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,KAAK,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AAChG,OAAO,EAAE,UAAU,EAAE,KAAK,GAAG,EAAwD,MAAM,iBAAiB,CAAC;AAC7G,OAAO,EAEN,KAAK,MAAM,EAKX,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,kBAAkB,EAAgD,MAAM,+BAA+B,CAAC;AACjH,OAAO,EAAE,cAAc,EAAwB,MAAM,2BAA2B,CAAC;AAEjF,OAAO,EAAE,oBAAoB,EAAwB,MAAM,iCAAiC,CAAC;AAC7F,OAAO,EAAE,cAAc,EAAuB,MAAM,2BAA2B,CAAC;AAChF,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,EACN,mBAAmB,EAOnB,KAAK,yBAAyB,EAE9B,MAAM,gCAAgC,CAAC;AAWxC,OAAO,KAAK,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AACpE,OAAO,KAAK,EACX,UAAU,EACV,SAAS,EAIT,WAAW,EACX,QAAQ,EAGR,aAAa,EACb,gBAAgB,EAChB,oBAAoB,EACpB,sBAAsB,EACtB,uBAAuB,EACvB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAYrD;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAOtD;AA4BD;;;;;GAKG;AACH,qBAAa,eAAgB,YAAW,WAAW,EAAE,WAAW;IAC/D,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,QAAQ,CAAC,cAAc,EAAE,kBAAkB,CAAC;IAC5C,QAAQ,CAAC,UAAU,EAAE,cAAc,CAAC;IACpC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAiB;IAC5C,QAAQ,CAAC,SAAS,EAAE,cAAc,CAAC;IACnC,QAAQ,CAAC,gBAAgB,EAAE,oBAAoB,CAAC;IAChD,QAAQ,CAAC,UAAU,EAAE,eAAe,CAAC;IACrC,QAAQ,CAAC,cAAc,EAAE,mBAAmB,CAAC;IAC7C,QAAQ,CAAC,UAAU,EAAE,oBAAoB,CAAC;IAC1C,QAAQ,CAAC,YAAY,CAAC,EAAE,oBAAoB,CAAC;IAC7C,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAyB;IACzD,kFAAkF;IAClF,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAyB;IAOzD,OAAO,CAAC,WAAW,CAAoC;IAIvD,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA6B;IAI3D,OAAO,CAAC,mBAAmB,CAAK;IAChC,OAAO,CAAC,uBAAuB,CAAK;IACpC,OAAO,CAAC,qBAAqB,CAAK;IAMlC,OAAO,CAAC,mBAAmB,CAAK;IAChC,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAA6B;IAEjE,OAAO;IAyBP;;;;;;;;;;;;;;;OAeG;WACU,MAAM,CAClB,EAAE,EAAE,OAAO,EACX,iBAAiB,EAAE,uBAAuB,GAAG,SAAS,EACtD,MAAM,EAAE,UAAU,EAClB,UAAU,EAAE,oBAAoB,EAChC,YAAY,CAAC,EAAE,oBAAoB,EACnC,cAAc,CAAC,EAAE,sBAAsB,EACvC,cAAc,CAAC,EAAE,sBAAsB,GACrC,OAAO,CAAC,eAAe,CAAC;IAgD3B,SAAS,IAAI,MAAM;IAInB,aAAa,IAAI,GAAG;IAIpB;;;;;OAKG;IACH,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO;IAItD;;;;;;OAMG;IACH,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,GAAG,SAAS;IAIjF;;;OAGG;IACH,kBAAkB,CACjB,WAAW,EAAE,uBAAuB,EACpC,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EACb,WAAW,EAAE,MAAM,GACjB,IAAI;IAcP,oBAAoB,IAAI;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE;IAclI;;;;;;;;;;;;;OAaG;IACG,oBAAoB,CACzB,EAAE,EAAE,QAAQ,EACZ,iBAAiB,EAAE,MAAM,EACzB,QAAQ,EAAE,sBAAsB,GAC9B,OAAO,CAAC,IAAI,CAAC;IA8MV,sBAAsB,IAAI,OAAO,CAAC,yBAAyB,EAAE,CAAC;IAIpE;;;;;;;;;;;;;;OAcG;IACG,uBAAuB,CAAC,GAAG,GAAE,MAAmB,GAAG,OAAO,CAAC,MAAM,CAAC;IA2CxE;;;;;;;;OAQG;IACH,wBAAwB,CAAC,KAAK,EAAE,sBAAsB,GAAG,IAAI;IAM7D;;;;OAIG;IACH,kBAAkB,IAAI,OAAO,CAAC,IAAI,CAAC;IAInC;;;;;;;;;;;OAWG;YACW,uBAAuB;IAsDrC;;;;;OAKG;YACW,qBAAqB;IA0BnC;;;OAGG;YACW,eAAe;YAiDf,oBAAoB;IAsElC;;;;;;;OAOG;IACG,eAAe,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,GAAG,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;IAwC/E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA0CG;YACW,mBAAmB;IAyCjC;;;;;;OAMG;YACW,eAAe;IA6C7B;;;;;;;;;;;OAWG;YACW,iBAAiB;IA8C/B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAsCG;YACW,yBAAyB;IAmBvC;;;;;;;;;;;;;OAaG;YACW,uBAAuB;IA+B/B,YAAY,CAAC,OAAO,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC,WAAW,CAAC;IAIxD,gBAAgB,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAIlE,YAAY,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC;IAoBjE,WAAW,IAAI,OAAO,CAAC,QAAQ,CAAC;IAIhC,aAAa,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAQhD,mBAAmB,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC;IAIhE,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,GAAG,SAAS,CAAC;IAK9D,mBAAmB,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC;IAIhE,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,GAAG,SAAS,CAAC;IAI9D,eAAe,IAAI,OAAO,CAAC,MAAM,CAAC;IAmBxC;;;;;OAKG;IACG,eAAe,IAAI,OAAO,CAAC,MAAM,CAAC;IAKxC,eAAe,IAAI,oBAAoB;IAQhC,iBAAiB,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,aAAa,CAAC,aAAa,CAAC;IAIpE,mBAAmB,CACxB,MAAM,EAAE,aAAa,CAAC,aAAa,CAAC,EACpC,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,gBAAgB,KAAK,IAAI,GAC/C,OAAO,CAAC,IAAI,CAAC;IAIV,qBAAqB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,SAAS,CAAC;IAIjF,oBAAoB,CAAC,UAAU,EAAE,kBAAkB,GAAG,aAAa,CAAC,aAAa,CAAC;CAGzF"}
+{"version":3,"file":"sync-manager-impl.d.ts","sourceRoot":"","sources":["../../../src/sync/sync-manager-impl.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAc,MAAM,gBAAgB,CAAC;AAC1D,OAAO,KAAK,EAGX,QAAQ,EACR,qBAAqB,EACrB,sBAAsB,EACtB,sBAAsB,EAGtB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,KAAK,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AAChG,OAAO,EAAE,UAAU,EAAE,KAAK,GAAG,EAAwD,MAAM,iBAAiB,CAAC;AAC7G,OAAO,EAEN,KAAK,MAAM,EAKX,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,kBAAkB,EAAoD,MAAM,+BAA+B,CAAC;AACrH,OAAO,EAAE,cAAc,EAAwB,MAAM,2BAA2B,CAAC;AAEjF,OAAO,EAAE,oBAAoB,EAAwB,MAAM,iCAAiC,CAAC;AAC7F,OAAO,EAAE,cAAc,EAAuB,MAAM,2BAA2B,CAAC;AAChF,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,EACN,mBAAmB,EAOnB,KAAK,yBAAyB,EAE9B,MAAM,gCAAgC,CAAC;AAExC,OAAO,EASN,KAAK,QAAQ,EACb,MAAM,qBAAqB,CAAC;AAE7B,OAAO,KAAK,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AACpE,OAAO,KAAK,EACX,UAAU,EACV,SAAS,EAIT,WAAW,EACX,QAAQ,EAGR,aAAa,EACb,gBAAgB,EAChB,oBAAoB,EACpB,sBAAsB,EACtB,uBAAuB,EACvB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAarD;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAOtD;AA4BD;;;;;GAKG;AACH,qBAAa,eAAgB,YAAW,WAAW,EAAE,WAAW;IAC/D,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,QAAQ,CAAC,cAAc,EAAE,kBAAkB,CAAC;IAC5C,QAAQ,CAAC,UAAU,EAAE,cAAc,CAAC;IACpC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAiB;IAC5C,QAAQ,CAAC,SAAS,EAAE,cAAc,CAAC;IACnC,QAAQ,CAAC,gBAAgB,EAAE,oBAAoB,CAAC;IAChD,QAAQ,CAAC,UAAU,EAAE,eAAe,CAAC;IACrC,QAAQ,CAAC,cAAc,EAAE,mBAAmB,CAAC;IAC7C,QAAQ,CAAC,UAAU,EAAE,oBAAoB,CAAC;IAC1C,QAAQ,CAAC,YAAY,CAAC,EAAE,oBAAoB,CAAC;IAC7C,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAyB;IACzD,kFAAkF;IAClF,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAyB;IACzD;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAmB;IAO5C,OAAO,CAAC,WAAW,CAAoC;IAIvD,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA6B;IAI3D,OAAO,CAAC,mBAAmB,CAAK;IAChC,OAAO,CAAC,uBAAuB,CAAK;IACpC,OAAO,CAAC,qBAAqB,CAAK;IAMlC,OAAO,CAAC,mBAAmB,CAAK;IAChC,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAA6B;IAEjE,OAAO;IA2BP;;;;;;;;;;;;;;;;;;;OAmBG;WACU,MAAM,CAClB,EAAE,EAAE,OAAO,EACX,iBAAiB,EAAE,uBAAuB,GAAG,SAAS,EACtD,MAAM,EAAE,UAAU,EAClB,UAAU,EAAE,oBAAoB,EAChC,YAAY,CAAC,EAAE,oBAAoB,EACnC,cAAc,CAAC,EAAE,sBAAsB,EACvC,cAAc,CAAC,EAAE,sBAAsB,EACvC,qBAAqB,CAAC,EAAE,qBAAqB,GAC3C,OAAO,CAAC,eAAe,CAAC;IA0E3B,SAAS,IAAI,MAAM;IAInB,aAAa,IAAI,GAAG;IAIpB,2CAA2C;IAC3C,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,QAAQ;IAIpD;;;;;OAKG;IACH,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO;IAItD;;;;;;OAMG;IACH,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,GAAG,SAAS;IAIjF;;;OAGG;IACH,kBAAkB,CACjB,WAAW,EAAE,uBAAuB,EACpC,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EACb,WAAW,EAAE,MAAM,GACjB,IAAI;IAcP,oBAAoB,IAAI;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE;IAclI;;;;;;;;;;;;;OAaG;IACG,oBAAoB,CACzB,EAAE,EAAE,QAAQ,EACZ,iBAAiB,EAAE,MAAM,EACzB,QAAQ,EAAE,sBAAsB,GAC9B,OAAO,CAAC,IAAI,CAAC;IA8MV,sBAAsB,IAAI,OAAO,CAAC,yBAAyB,EAAE,CAAC;IAIpE;;;;;;;;;;;;;;OAcG;IACG,uBAAuB,CAAC,GAAG,GAAE,MAAmB,GAAG,OAAO,CAAC,MAAM,CAAC;IA2CxE;;;;;;;;OAQG;IACH,wBAAwB,CAAC,KAAK,EAAE,sBAAsB,GAAG,IAAI;IAM7D;;;;OAIG;IACH,kBAAkB,IAAI,OAAO,CAAC,IAAI,CAAC;IAInC;;;;;;;;;;;OAWG;YACW,uBAAuB;IA8DrC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+BG;IACH,OAAO,CAAC,0BAA0B;IAmBlC;;;;OAIG;IACH,OAAO,CAAC,gBAAgB;IAqBxB;;;;;OAKG;YACW,qBAAqB;IAgDnC;;;;;;;;OAQG;YACW,eAAe;YA8Df,oBAAoB;IA2ElC;;;;;;;OAOG;IACG,eAAe,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,GAAG,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;IAwC/E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA0CG;YACW,mBAAmB;IAyCjC;;;;;;OAMG;YACW,eAAe;IA6C7B;;;;;;;;;;;OAWG;YACW,iBAAiB;IA8C/B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAsCG;YACW,yBAAyB;IAmBvC;;;;;;;;;;;;;OAaG;YACW,uBAAuB;IA+B/B,YAAY,CAAC,OAAO,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC,WAAW,CAAC;IAIxD,gBAAgB,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAIlE,YAAY,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC;IAoBjE,WAAW,IAAI,OAAO,CAAC,QAAQ,CAAC;IAIhC,aAAa,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAQhD,mBAAmB,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC;IAIhE,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,GAAG,SAAS,CAAC;IAK9D,mBAAmB,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC;IAIhE,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,GAAG,SAAS,CAAC;IAIpE;;;;;;;OAOG;IACG,eAAe,IAAI,OAAO,CAAC,MAAM,CAAC;IA2BxC;;;;;OAKG;IACG,eAAe,IAAI,OAAO,CAAC,MAAM,CAAC;IAKxC,eAAe,IAAI,oBAAoB;IAQhC,iBAAiB,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,aAAa,CAAC,aAAa,CAAC;IAIpE,mBAAmB,CACxB,MAAM,EAAE,aAAa,CAAC,aAAa,CAAC,EACpC,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,gBAAgB,KAAK,IAAI,GAC/C,OAAO,CAAC,IAAI,CAAC;IAIV,qBAAqB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,SAAS,CAAC;IAIjF,oBAAoB,CAAC,UAAU,EAAE,kBAAkB,GAAG,aAAa,CAAC,aAAa,CAAC;CAGzF"}

package/dist/src/sync/sync-manager-impl.js

@@ -14,8 +14,10 @@ import { SchemaMigrationStore, deserializeMigration } from '../metadata/schema-m
 import { ChangeLogStore } from '../metadata/change-log.js';
 import { QuarantineStore } from '../metadata/quarantine.js';
 import { BasisLifecycleStore, classifyBasisLifecycle, basisLifecycleRecordChanged, splitRelKey, parseEvictPolicyTag, isEvictable, quietSince, } from '../metadata/basis-lifecycle.js';
-import { SYNC_KEY_PREFIX, buildAllColumnVersionsScanBounds, buildAllTombstonesScanBounds, buildAllSchemaMigrationsScanBounds, parseColumnVersionKey, parseTombstoneKey, parseSchemaMigrationKey, } from '../metadata/keys.js';
-import { persistHLCStateBatch, toError } from './sync-context.js';
+import { SYNC_KEY_PREFIX, SYNC_METADATA_FORMAT_VERSION, buildAllColumnVersionsScanBounds, buildAllTombstonesScanBounds, buildAllSchemaMigrationsScanBounds, parseColumnVersionKey, parseTombstoneKey, parseSchemaMigrationKey, } from '../metadata/keys.js';
+import { createPkKeyingResolver } from '../metadata/pk-identity.js';
+import { persistHLCStateBatch, toError, deleteRowVersionsAndLogEntries } from './sync-context.js';
+import { StagedTransactionMetadata } from './staged-transaction-metadata.js';
 import { applyChanges as applyChangesImpl, drainHeldChanges as drainHeldChangesImpl, drainReappearedTables } from './change-applicator.js';
 import { buildTransactionChangeSets } from './change-grouping.js';
 import { getSnapshot as getSnapshotImpl, applySnapshot as applySnapshotImpl } from './snapshot.js';
@@ -77,6 +79,13 @@ export class SyncManagerImpl {
     getTableSchema;
     /** Reclaim-by-name callback for the eviction sweep; absent ⇒ sweep is a no-op. */
     dropLocalTable;
+    /**
+     * Per-table pk-identity keying resolver (see `metadata/pk-identity.ts`),
+     * threaded into every metadata store so `cv:`/`tb:`/`cl:` keys file under the
+     * row's collation/transform-normalized identity. Raw keying when no
+     * `getTableSchema` oracle was wired (relay-only deployment).
+     */
+    pkKeying;
     // Tail-promise chain serializing commit recording. Each commit chains onto the
     // prior handler's completion so N+1's dedup reads see N's durable writes,
     // preserving the change-log ordering invariant (docs/sync.md § Transaction-Based
@@ -98,7 +107,7 @@ export class SyncManagerImpl {
     // relay activity, not with distinct stragglers. Bumped in collectForwardableChanges.
     unknownTableRelayed = 0;
     unknownTableByTable = new Map();
-    constructor(kv, config, hlcManager, syncEvents, applyToStore, getTableSchema, dropLocalTable) {
+    constructor(kv, config, hlcManager, syncEvents, applyToStore, getTableSchema, dropLocalTable, keyNormalizerResolver) {
         this.kv = kv;
         this.config = config;
         this.hlcManager = hlcManager;
@@ -106,10 +115,11 @@ export class SyncManagerImpl {
         this.applyToStore = applyToStore;
         this.getTableSchema = getTableSchema;
         this.dropLocalTable = dropLocalTable;
-        this.columnVersions = new ColumnVersionStore(kv);
-        this.tombstones = new TombstoneStore(kv, config.retentionHorizonMs);
+        this.pkKeying = createPkKeyingResolver(getTableSchema, keyNormalizerResolver);
+        this.columnVersions = new ColumnVersionStore(kv, this.pkKeying);
+        this.tombstones = new TombstoneStore(kv, config.retentionHorizonMs, this.pkKeying);
         this.peerStates = new PeerStateStore(kv);
-        this.changeLog = new ChangeLogStore(kv);
+        this.changeLog = new ChangeLogStore(kv, this.pkKeying);
         this.schemaMigrations = new SchemaMigrationStore(kv);
         this.quarantine = new QuarantineStore(kv);
         this.basisLifecycle = new BasisLifecycleStore(kv);
@@ -129,12 +139,35 @@ export class SyncManagerImpl {
      * @param getTableSchema - Optional callback for getting table schema by name
      * @param dropLocalTable - Optional reclaim-by-name callback for the basis-table
      *   eviction sweep; when absent (e.g. a relay-only coordinator) the sweep is a no-op.
+     * @param keyNormalizerResolver - Optional collation-name → key-normalizer resolver
+     *   (pass the engine's `db.getKeyNormalizerResolver()`), used to build pk-identity
+     *   keys that agree with the database's row identity. When absent, a built-ins-only
+     *   resolver (BINARY/NOCASE/RTRIM) is used, which throws on custom collation names.
      */
-    static async create(kv, transactionSource, config, syncEvents, applyToStore, getTableSchema, dropLocalTable) {
+    static async create(kv, transactionSource, config, syncEvents, applyToStore, getTableSchema, dropLocalTable, keyNormalizerResolver) {
         // Load or create site identity
         const siteIdKey = new TextEncoder().encode(SITE_ID_KEY);
         let siteId;
         const existingIdentity = await kv.get(siteIdKey);
+        // Sync-metadata format gate: per-row records are keyed by pk IDENTITY since
+        // format 2 (see SYNC_METADATA_FORMAT_VERSION); older metadata is unreadable
+        // under this layout, and writing new-format records beside it would corrupt
+        // both. A replica with existing identity but a missing/mismatched version
+        // must re-bootstrap from a peer snapshot (docs/sync.md § Metadata format
+        // version) — refuse loudly rather than silently mis-keying.
+        const formatData = await kv.get(SYNC_KEY_PREFIX.FORMAT_VERSION);
+        const storedFormat = formatData ? parseInt(new TextDecoder().decode(formatData), 10) : undefined;
+        if (storedFormat === undefined) {
+            if (existingIdentity) {
+                throw new QuereusError(`Sync metadata predates format version ${SYNC_METADATA_FORMAT_VERSION} (pk-identity keys). `
+                    + `Clear this replica's sync metadata and re-bootstrap from a peer snapshot (docs/sync.md § Metadata format version).`, StatusCode.ERROR);
+            }
+            await kv.put(SYNC_KEY_PREFIX.FORMAT_VERSION, new TextEncoder().encode(String(SYNC_METADATA_FORMAT_VERSION)));
+        }
+        else if (storedFormat !== SYNC_METADATA_FORMAT_VERSION) {
+            throw new QuereusError(`Sync metadata format version ${storedFormat} does not match this build's ${SYNC_METADATA_FORMAT_VERSION}. `
+                + `Clear this replica's sync metadata and re-bootstrap from a peer snapshot (docs/sync.md § Metadata format version).`, StatusCode.ERROR);
+        }
         if (existingIdentity) {
             const identity = deserializeSiteIdentity(existingIdentity);
             siteId = identity.siteId;
@@ -159,7 +192,7 @@ export class SyncManagerImpl {
             };
         }
         const hlcManager = new HLCManager(siteId, hlcState);
-        const manager = new SyncManagerImpl(kv, config, hlcManager, syncEvents, applyToStore, getTableSchema, dropLocalTable);
+        const manager = new SyncManagerImpl(kv, config, hlcManager, syncEvents, applyToStore, getTableSchema, dropLocalTable, keyNormalizerResolver);
         // Capture local changes at the engine transaction boundary: one grouped
         // `onTransactionCommit` batch ⇒ one transaction ⇒ one HLC. The store's
         // per-table emitter is below the transaction boundary and cannot group a
@@ -179,6 +212,10 @@ export class SyncManagerImpl {
     getCurrentHLC() {
         return this.hlcManager.now();
     }
+    /** See {@link SyncContext.getPkKeying}. */
+    getPkKeying(schema, table) {
+        return this.pkKeying(schema, table);
+    }
     /**
      * Basis-membership oracle for unknown-table detection. `getTableSchema(s,t)
      * === undefined` ⇒ the table is outside the local basis. When no oracle was
@@ -535,7 +572,7 @@ export class SyncManagerImpl {
             // (local + remote in one transaction — unusual) records only its local
             // facts; opSeq is assigned only to recorded facts so they stay contiguous.
             const localSchema = batch.schemaEvents.filter(e => !e.remote);
-            const localData = batch.dataEvents.filter(e => !e.remote);
+            const localData = this.filterCapturableDataEvents(batch.dataEvents.filter(e => !e.remote), localSchema);
             if (localSchema.length === 0 && localData.length === 0)
                 return;
             // ONE tick per committed transaction. tick() returns opSeq 0; the closure
@@ -550,13 +587,18 @@ export class SyncManagerImpl {
             };
             const kvBatch = this.kv.batch();
             const changes = [];
+            // Read-your-own-writes overlay: everything staged into kvBatch is noted
+            // here so a later event of the SAME transaction reads its own staged
+            // metadata instead of pre-transaction storage (see
+            // staged-transaction-metadata.ts). Lives for this one commit.
+            const staged = new StagedTransactionMetadata((schema, table) => this.getPkKeying(schema, table));
             // DDL before DML: migrations take the lowest opSeqs.
             const versionCounters = new Map();
             for (const event of localSchema) {
                 await this.recordSchemaMigration(kvBatch, event, nextHlc, versionCounters);
             }
             for (const event of localData) {
-                await this.recordDataEvent(kvBatch, event, nextHlc, changes);
+                await this.recordDataEvent(kvBatch, event, nextHlc, changes, staged);
             }
             // Persist HLC clock state (wallTime/counter only — opSeq is never persisted).
             persistHLCStateBatch(this, kvBatch);
@@ -575,6 +617,75 @@ export class SyncManagerImpl {
             });
         }
     }
+    /**
+     * Drop the data events of any table that is no longer in the local basis — the
+     * schema oracle does not know it, typically because this same transaction dropped
+     * it and the schema is already gone by the time the commit group is delivered.
+     * A schemaless table has no sound pk identity (see `metadata/pk-identity.ts`), so
+     * its rows cannot be filed.
+     *
+     * Local capture is therefore best-effort at TABLE granularity: one unknown table
+     * costs only its own rows, never the rest of the transaction (which is what the
+     * handler's top-level catch would do — it aborts recording of every other table's
+     * rows AND the transaction's schema migrations).
+     *
+     * Runs BEFORE the HLC tick, so a transaction whose data is entirely skipped and
+     * that carries no schema events consumes no clock and emits no local change,
+     * mirroring the all-remote echo early-out. Filtering up front also means no event
+     * is ever half-recorded: the throw it replaces could fire *after* a tombstone had
+     * already been staged into the shared `WriteBatch`.
+     *
+     * The gate is basis MEMBERSHIP, not "this transaction dropped the table":
+     * `drop t; create t; insert into t` carries a drop event for `t` yet leaves it in
+     * basis, and its rows must still be captured. `localSchema` is consulted only to
+     * classify the log line — an expected skip reads differently from a table that
+     * vanished for some other reason.
+     *
+     * ONLY the unknown-table case is skipped. Any other keying failure — a pk column
+     * whose collation the wired `keyNormalizerResolver` does not know, say — still
+     * throws out of `recordDataEvent` and fails the transaction loudly; silently
+     * discarding those rows would bury a real misconfiguration.
+     *
+     * A relay-only manager (no `getTableSchema` oracle) reports every table in basis,
+     * so nothing is skipped there.
+     */
+    filterCapturableDataEvents(events, localSchema) {
+        // NOTE: one oracle lookup per ROW (a schema-map hit today, and dwarfed by the
+        // per-row record work below). If `getTableSchema` ever becomes expensive, memo
+        // the verdict per table for the duration of the transaction.
+        const skipCounts = new Map();
+        const kept = events.filter(event => {
+            if (this.isTableInBasis(event.schemaName, event.tableName))
+                return true;
+            const tableKey = `${event.schemaName}.${event.tableName}`;
+            skipCounts.set(tableKey, (skipCounts.get(tableKey) ?? 0) + 1);
+            return false;
+        });
+        if (skipCounts.size > 0)
+            this.logSkippedTables(skipCounts, localSchema);
+        return kept;
+    }
+    /**
+     * Report skipped tables: ONE line per table with its change count, never one per
+     * row. A table this same transaction dropped is expected and logs informationally;
+     * anything else is a warning — the table vanished for some other reason.
+     */
+    logSkippedTables(skipCounts, localSchema) {
+        const droppedHere = new Set(localSchema
+            .filter(e => e.objectType === 'table' && e.type === 'drop')
+            .map(e => `${e.schemaName}.${e.objectName}`));
+        // NOTE: the only `console.log` in this package (everything else is warn/error) —
+        // an expected skip is not a warning. If the package ever gains a real logger
+        // abstraction, this is the call site that wants an `info` level.
+        for (const [tableKey, count] of skipCounts) {
+            if (droppedHere.has(tableKey)) {
+                console.log(`[Sync] Skipped ${count} change(s) for ${tableKey} — table dropped by the same transaction`);
+            }
+            else {
+                console.warn(`[Sync] Skipped ${count} change(s) for ${tableKey} — table is outside the local basis, so sync pk identity is unresolvable`);
+            }
+        }
+    }
     /**
      * Record one local schema-change event as a migration. Allocates an `opSeq`
      * (via `nextHlc`) only when the event maps to a tracked migration, so
@@ -586,6 +697,24 @@ export class SyncManagerImpl {
         if (!migrationType)
             return;
         const { schemaName, objectName, ddl } = event;
+        // `alter_column` is the only tracked type that legitimately reaches here with
+        // no DDL — create/drop table and add/drop index all carry canonical text (see
+        // the store module's emit sites). The migration below still records and still
+        // advances the schema version (destructiveness comparison depends on it), but
+        // nothing here reaches a peer, so a device that alters a table stays silently
+        // diverged unless an operator sees this.
+        // See tickets/backlog/feat-sync-replicate-alter-table.md.
+        if (migrationType === 'alter_column' && !ddl?.trim()) {
+            console.warn(`[Sync] ${schemaName}.${objectName}: recording an ${migrationType} migration with no DDL — `
+                + `this table alteration will NOT reach other synced devices`);
+        }
+        // NOTE: for an index migration `objectName` is the INDEX name, so this key
+        // is `<schema>.<index name>` — index-vs-index it is unambiguous only because
+        // `SchemaManager.createIndex` enforces index names unique per schema. Two
+        // same-named indexes on different tables would otherwise share one version
+        // counter and suppress each other's migrations. (An index name colliding
+        // with a *table* name still shares a counter — the key carries no object
+        // kind; tracked separately as bug-sync-migration-version-key-ignores-object-kind.)
         const counterKey = `${schemaName}.${objectName}`;
         let version = versionCounters.get(counterKey);
         if (version === undefined) {
@@ -603,8 +732,13 @@ export class SyncManagerImpl {
     /**
      * Record one local data-change event: a tombstone (delete) or the changed
      * column versions (insert/update). Each recorded fact consumes one `opSeq`.
+     *
+     * All reads of the row's current metadata go overlay-first (`staged`), so a
+     * transaction that touches one row more than once records the same metadata
+     * the equivalent sequence of separate transactions would — and every write
+     * staged into `batch` is noted back into the overlay.
      */
-    async recordDataEvent(batch, event, nextHlc, changes) {
+    async recordDataEvent(batch, event, nextHlc, changes, staged) {
         const { schemaName, tableName, type, oldRow, newRow } = event;
         const pk = event.key;
         if (!pk) {
@@ -613,14 +747,16 @@ export class SyncManagerImpl {
         }
         if (type === 'delete') {
             // Dedupe the change-log delete entry the same way columns are deduped: if a
-            // prior tombstone exists for this pk (a delete→reinsert→delete key reuse),
-            // its stale delete entry must go, so at most one delete entry survives per pk
-            // with HLC equal to the current tombstone. This keeps collectChangesSince's
-            // boundary detection (keyed on the log HLC) in lockstep with grouping (keyed
-            // on the resolved tombstone HLC) — see its LOAD-BEARING INVARIANT.
-            const existing = await this.tombstones.getTombstone(schemaName, tableName, pk);
-            if (existing) {
-                this.changeLog.deleteEntryBatch(batch, existing.hlc, 'delete', schemaName, tableName, pk);
+            // prior tombstone exists for this pk (a delete→reinsert→delete key reuse —
+            // staged by this same transaction, or committed), its stale delete entry
+            // must go, so at most one delete entry survives per pk with HLC equal to
+            // the current tombstone. This keeps collectChangesSince's boundary
+            // detection (keyed on the log HLC) in lockstep with grouping (keyed on the
+            // resolved tombstone HLC) — see its LOAD-BEARING INVARIANT.
+            const existingHlc = staged.tombstoneHlc(schemaName, tableName, pk)
+                ?? (await this.tombstones.getTombstone(schemaName, tableName, pk))?.hlc;
+            if (existingHlc) {
+                this.changeLog.deleteEntryBatch(batch, existingHlc, 'delete', schemaName, tableName, pk);
             }
             const hlc = nextHlc();
             // Carry the row's last-known image (the engine `oldRow`) as a best-effort
@@ -630,7 +766,17 @@ export class SyncManagerImpl {
             const priorRow = oldRow ? [...oldRow] : undefined;
             this.tombstones.setTombstoneBatch(batch, schemaName, tableName, pk, hlc, priorRow);
             this.changeLog.recordDeletionBatch(batch, hlc, schemaName, tableName, pk);
-            await this.columnVersions.deleteRowVersions(schemaName, tableName, pk);
+            // The row's column versions die here, so their change-log entries must die
+            // with them — otherwise every deleted row leaves one orphan entry per column
+            // behind forever (see deleteRowVersionsAndLogEntries). The cleanup stages
+            // into this same `batch`, covering cells the transaction itself staged
+            // (batch ordering makes these later removals win), and consults the row's
+            // overlay state — captured BEFORE the notes below reset it.
+            await deleteRowVersionsAndLogEntries(this, batch, schemaName, tableName, pk, {
+                staged: staged.rowState(schemaName, tableName, pk),
+            });
+            staged.noteRowCleared(schemaName, tableName, pk);
+            staged.noteTombstone(schemaName, tableName, pk, hlc);
             const change = {
                 type: 'delete',
                 schema: schemaName,
@@ -642,21 +788,27 @@ export class SyncManagerImpl {
             changes.push(change);
         }
         else if (newRow) {
-            await this.recordColumnVersions(batch, schemaName, tableName, pk, oldRow, newRow, nextHlc, changes);
+            await this.recordColumnVersions(batch, schemaName, tableName, pk, oldRow, newRow, nextHlc, changes, staged);
         }
     }
-    async recordColumnVersions(batch, schemaName, tableName, pk, oldRow, newRow, nextHlc, changes) {
-        const tableSchema = this.getTableSchema?.(schemaName, tableName);
-        const columnNames = tableSchema?.columns?.map(c => c.name);
-        if (!tableSchema && this.getTableSchema) {
-            console.warn(`[Sync] No table schema found for ${schemaName}.${tableName} - using fallback column names`);
-        }
+    async recordColumnVersions(batch, schemaName, tableName, pk, oldRow, newRow, nextHlc, changes, staged) {
+        // `col_${i}` fallback below is the live path for a RELAY-ONLY manager (no
+        // schema oracle at all). An oracle-wired manager can no longer reach here for
+        // a table the oracle does not know — filterCapturableDataEvents skipped it.
+        const columnNames = this.getTableSchema?.(schemaName, tableName)?.columns?.map(c => c.name);
         for (let i = 0; i < newRow.length; i++) {
             const oldValue = oldRow?.[i];
             const newValue = newRow[i];
             if (!oldRow || oldValue !== newValue) {
                 const column = columnNames?.[i] ?? `col_${i}`;
-                const oldVersion = await this.columnVersions.getColumnVersion(schemaName, tableName, pk, column);
+                // Overlay first: a cell this same transaction rewrote reads its staged
+                // version (so the staged entry is the one deduped, and the before-image
+                // chains correctly); one it deleted reads as absent (a reinsert after a
+                // delete records no before-image, exactly like a first write).
+                const stagedCell = staged.columnVersion(schemaName, tableName, pk, column);
+                const oldVersion = stagedCell === null
+                    ? undefined // staged as deleted
+                    : stagedCell ?? await this.columnVersions.getColumnVersion(schemaName, tableName, pk, column);
                 if (oldVersion) {
                     this.changeLog.deleteEntryBatch(batch, oldVersion.hlc, 'column', schemaName, tableName, pk, column);
                 }
@@ -670,6 +822,7 @@ export class SyncManagerImpl {
                 const version = { hlc, value: newValue, ...prior };
                 this.columnVersions.setColumnVersionBatch(batch, schemaName, tableName, pk, column, version);
                 this.changeLog.recordColumnChangeBatch(batch, hlc, schemaName, tableName, pk, column);
+                staged.noteColumnVersion(schemaName, tableName, pk, column, version);
                 const change = {
                     type: 'column',
                     schema: schemaName,
@@ -807,19 +960,19 @@ export class SyncManagerImpl {
      * Resolve a change-log entry to the live {@link Change} it references, or
      * `null` when the underlying column version / tombstone is gone — a stale log
      * entry (e.g. a column overwritten, or a row deleted after the entry was
-     * written). The authoritative HLC and value come from the current version, not
-     * the log key.
+     * written). The authoritative HLC, value AND pk come from the current version
+     * record, not the log key — the key carries only the lossy pk identity.
      */
     async resolveLogEntry(logEntry) {
         if (logEntry.entryType === 'column') {
-            const cv = await this.columnVersions.getColumnVersion(logEntry.schema, logEntry.table, logEntry.pk, logEntry.column);
+            const cv = await this.columnVersions.getColumnVersionByIdentity(logEntry.schema, logEntry.table, logEntry.identity, logEntry.column);
             if (!cv)
                 return null;
             const columnChange = {
                 type: 'column',
                 schema: logEntry.schema,
                 table: logEntry.table,
-                pk: logEntry.pk,
+                pk: cv.pk,
                 column: logEntry.column,
                 value: cv.value,
                 hlc: cv.hlc,
@@ -829,14 +982,14 @@ export class SyncManagerImpl {
             };
             return columnChange;
         }
-        const tombstone = await this.tombstones.getTombstone(logEntry.schema, logEntry.table, logEntry.pk);
+        const tombstone = await this.tombstones.getTombstoneByIdentity(logEntry.schema, logEntry.table, logEntry.identity);
         if (!tombstone)
             return null;
         const deletion = {
             type: 'delete',
             schema: logEntry.schema,
             table: logEntry.table,
-            pk: logEntry.pk,
+            pk: tombstone.pk,
             hlc: tombstone.hlc,
             // Re-emit the stored before-image (spread only when present) so a
             // receiver/relay forwards the origin's last-known row image unchanged.
@@ -870,7 +1023,7 @@ export class SyncManagerImpl {
                 type: 'column',
                 schema: parsed.schema,
                 table: parsed.table,
-                pk: parsed.pk,
+                pk: cv.pk,
                 column: parsed.column,
                 value: cv.value,
                 hlc: cv.hlc,
@@ -890,7 +1043,7 @@ export class SyncManagerImpl {
                 type: 'delete',
                 schema: parsed.schema,
                 table: parsed.table,
-                pk: parsed.pk,
+                pk: tombstone.pk,
                 hlc: tombstone.hlc,
                 ...(tombstone.priorRow !== undefined ? { priorRow: tombstone.priorRow } : {}),
             };
@@ -1041,6 +1194,14 @@ export class SyncManagerImpl {
     async getPeerSentState(peerSiteId) {
         return this.peerStates.getPeerSentState(peerSiteId);
     }
+    /**
+     * Drop tombstones past the retention horizon, together with the change-log
+     * `delete` entry each one backs. The entry is only an index pointer at the
+     * tombstone ({@link resolveLogEntry} returns null once the tombstone is gone),
+     * so leaving it would accumulate one dead entry per delete the replica has ever
+     * seen — the delete-side twin of the column cleanup in
+     * {@link deleteRowVersionsAndLogEntries}. Both deletions share this batch.
+     */
     async pruneTombstones() {
         const now = Date.now();
         let count = 0;
@@ -1050,6 +1211,15 @@ export class SyncManagerImpl {
             const tombstone = deserializeTombstone(entry.value);
             if (now - tombstone.createdAt > this.config.retentionHorizonMs) {
                 batch.delete(entry.key);
+                const parsed = parseTombstoneKey(entry.key);
+                if (parsed) {
+                    // Identity-based delete: the parsed key already carries the identity, so
+                    // no schema (which a since-retired table may no longer have) is needed.
+                    this.changeLog.deleteEntryByIdentityBatch(batch, tombstone.hlc, 'delete', parsed.schema, parsed.table, parsed.identity);
+                }
+                else {
+                    console.warn('[Sync] Unparseable tombstone key during prune — its change-log entry is left orphaned');
+                }
                 count++;
             }
         }