@spooky-sync/core 0.0.1-canary.103 → 0.0.1-canary.104

package/dist/index.js

@@ -1,6 +1,6 @@
 import { DateTime, Duration, RecordId, Surreal, Uuid, applyDiagnostics, createRemoteEngines } from "surrealdb";
-import { QueryBuilder, RecordId as RecordId$1 } from "@spooky-sync/query-builder";
 import { createWasmWorkerEngines } from "@surrealdb/wasm";
+import { QueryBuilder, RecordId as RecordId$1, cyrb53 } from "@spooky-sync/query-builder";
 import pino from "pino";
 import init, { Sp00kyProcessor } from "@spooky-sync/ssp-wasm";
 import { LoroDoc } from "loro-crdt";
@@ -9,6 +9,241 @@ import { LoroDoc } from "loro-crdt";
 /** Cap on the rolling materialization-sample window kept per query in memory. */
 const MATERIALIZATION_SAMPLE_WINDOW = 100;
 
+//#endregion
+//#region src/services/database/database.ts
+var AbstractDatabaseService = class {
+	client;
+	logger;
+	events;
+	constructor(client, logger, events) {
+		this.client = client;
+		this.logger = logger.child({ service: "Database" });
+		this.events = events;
+	}
+	getClient() {
+		return this.client;
+	}
+	getEvents() {
+		return this.events;
+	}
+	tx() {
+		return this.client.beginTransaction();
+	}
+	queryQueue = Promise.resolve();
+	/**
+	* Execute a query with serialized execution to prevent WASM transaction issues.
+	*/
+	async query(query, vars) {
+		return new Promise((resolve, reject) => {
+			this.queryQueue = this.queryQueue.then(async () => {
+				const startTime = performance.now();
+				try {
+					this.logger.debug({
+						query,
+						vars,
+						Category: "sp00ky-client::Database::query"
+					}, "Executing query");
+					const result = await this.client.query(query, vars);
+					const duration = performance.now() - startTime;
+					this.events.emit(this.eventType, {
+						query,
+						vars,
+						duration,
+						success: true,
+						timestamp: Date.now()
+					});
+					resolve(result);
+					this.logger.trace({
+						query,
+						result,
+						Category: "sp00ky-client::Database::query"
+					}, "Query executed successfully");
+				} catch (err) {
+					const duration = performance.now() - startTime;
+					this.events.emit(this.eventType, {
+						query,
+						vars,
+						duration,
+						success: false,
+						error: err instanceof Error ? err.message : String(err),
+						timestamp: Date.now()
+					});
+					this.logger.error({
+						query,
+						vars,
+						err,
+						Category: "sp00ky-client::Database::query"
+					}, "Query execution failed");
+					reject(err);
+				}
+			}).catch(() => {});
+		});
+	}
+	async execute(query, vars) {
+		const raw = await this.query(query.sql, vars);
+		return query.extract(raw);
+	}
+	async close() {
+		this.logger.info({ Category: "sp00ky-client::Database::close" }, "Closing database connection");
+		await this.client.close();
+	}
+};
+
+//#endregion
+//#region src/events/index.ts
+/**
+* A type-safe event system that handles subscription, emission (including debouncing), and buffering of events.
+* @template E The EventTypeMap defining all supported events.
+*/
+var EventSystem = class {
+	subscriberId = 0;
+	isProcessing = false;
+	buffer;
+	subscribers;
+	subscribersTypeMap;
+	lastEvents;
+	debouncedEvents;
+	constructor(_eventTypes) {
+		this._eventTypes = _eventTypes;
+		this.buffer = [];
+		this.subscribers = this._eventTypes.reduce((acc, key) => {
+			return Object.assign(acc, { [key]: /* @__PURE__ */ new Map() });
+		}, {});
+		this.lastEvents = {};
+		this.subscribersTypeMap = /* @__PURE__ */ new Map();
+		this.debouncedEvents = /* @__PURE__ */ new Map();
+	}
+	get eventTypes() {
+		return this._eventTypes;
+	}
+	/**
+	* Subscribes a handler to a specific event type.
+	* @param type The event type to subscribe to.
+	* @param handler The function to call when the event occurs.
+	* @param options Subscription options (once, immediately).
+	* @returns A subscription ID that can be used to unsubscribe.
+	*/
+	subscribe(type, handler, options) {
+		const id = this.subscriberId++;
+		this.subscribers[type].set(id, {
+			id,
+			handler,
+			once: options?.once ?? false
+		});
+		this.subscribersTypeMap.set(id, type);
+		if (options?.immediately) {
+			const lastEvent = this.lastEvents[type];
+			if (lastEvent) handler(lastEvent);
+		}
+		return id;
+	}
+	/**
+	* Subscribes a handler to multiple event types.
+	* @param types An array of event types to subscribe to.
+	* @param handler The function to call when any of the events occur.
+	* @param options Subscription options.
+	* @returns An array of subscription IDs.
+	*/
+	subscribeMany(types, handler, options) {
+		return types.map((type) => this.subscribe(type, handler, options));
+	}
+	/**
+	* Unsubscribes a specific subscription by ID.
+	* @param id The subscription ID returned by subscribe().
+	* @returns True if the subscription was found and removed, false otherwise.
+	*/
+	unsubscribe(id) {
+		const type = this.subscribersTypeMap.get(id);
+		if (type) {
+			this.subscribers[type].delete(id);
+			this.subscribersTypeMap.delete(id);
+			return true;
+		}
+		return false;
+	}
+	/**
+	* Emits an event with the given type and payload.
+	* @param type The type of event to emit.
+	* @param payload The data associated with the event.
+	*/
+	emit(type, payload) {
+		const event = {
+			type,
+			payload
+		};
+		this.addEvent(event);
+	}
+	/**
+	* Adds a fully constructed event object to the system.
+	* Similar to emit, but takes the full event object directly.
+	* Supports debouncing if options are provided.
+	* @param event The event object.
+	* @param options Options for the event push (e.g., debouncing).
+	*/
+	addEvent(event, options) {
+		if (options?.debounced) {
+			this.handleDebouncedEvent(event, options.debounced.key, options.debounced.delay);
+			return;
+		}
+		this.buffer.push(event);
+		this.scheduleProcessing();
+	}
+	handleDebouncedEvent(event, key, delay) {
+		if (this.debouncedEvents.has(key)) clearTimeout(this.debouncedEvents.get(key)?.timer);
+		const timer = setTimeout(() => {
+			this.debouncedEvents.delete(key);
+			this.buffer.push(event);
+			this.scheduleProcessing();
+		}, delay);
+		this.debouncedEvents.set(key, {
+			timer,
+			resolve: () => {}
+		});
+	}
+	scheduleProcessing() {
+		if (!this.isProcessing) queueMicrotask(() => this.processEvents());
+	}
+	async processEvents() {
+		if (this.isProcessing) return;
+		this.isProcessing = true;
+		try {
+			while (this.dequeue());
+		} finally {
+			this.isProcessing = false;
+		}
+	}
+	dequeue() {
+		const event = this.buffer.shift();
+		if (!event) return false;
+		this.setLastEvent(event.type, event);
+		this.broadcastEvent(event.type, event);
+		return true;
+	}
+	setLastEvent(type, event) {
+		this.lastEvents[type] = event;
+	}
+	broadcastEvent(type, event) {
+		const subscribers = this.subscribers[type].values();
+		for (const subscriber of subscribers) {
+			subscriber.handler(event);
+			if (subscriber.once) this.unsubscribe(subscriber.id);
+		}
+	}
+};
+function createEventSystem(eventTypes) {
+	return new EventSystem(eventTypes);
+}
+
+//#endregion
+//#region src/services/database/events/index.ts
+const DatabaseEventTypes = {
+	LocalQuery: "DATABASE_LOCAL_QUERY",
+	RemoteQuery: "DATABASE_REMOTE_QUERY"
+};
+function createDatabaseEventSystem() {
+	return createEventSystem([DatabaseEventTypes.LocalQuery, DatabaseEventTypes.RemoteQuery]);
+}
+
 //#endregion
 //#region src/utils/surql.ts
 const surql = {
@@ -221,1718 +456,1852 @@ async function withRetry(logger, operation, retries = 3, delayMs = 100) {
 }
 
 //#endregion
-//#region src/modules/data/window-query.ts
+//#region src/modules/ref-tables.ts
 /**
-* Rewrite a windowed (`LIMIT n START m`, m>0) SELECT so its rows are
-* materialized from an explicit record-id set — the window the SSP already
-* computed — instead of re-running the original query (with its `START m`)
-* against the shared local DB.
-*
-* Why: `DataModule.processStreamUpdate` materializes a query's rows by
-* re-querying the local in-browser SurrealDB with the original surql. For an
-* offset query that re-applies `START m` against the *shared* local store —
-* which, with sparse windowing, may hold only this window's rows — so it skips
-* them all and returns nothing (the "page 2 returns 0 rows" bug). The SSP's
-* materialized view (`StreamUpdate.localArray`) is exactly this window's row
-* ids, so we select those ids directly and re-apply the original `ORDER BY` for
-* stable display order.
-*
-* Returns `null` for non-offset queries (`START` absent or 0) — the caller
-* keeps the normal re-query path, so only the broken case changes behavior.
-*
-* Preserves the `SELECT <projection>` clause and the top-level `ORDER BY`;
-* drops the original `FROM`/`WHERE`/`LIMIT`/`START`. Subqueries inside the
-* projection are preserved verbatim (the scanner is paren/quote aware), with
-* one caveat: SurrealDB v3 drops `*` in the `SELECT *, <subquery> FROM $param`
-* shape — such windowed+subquery queries are rare and were already returning 0,
-* so this is no regression.
+* Sentinel user id for unauthenticated clients when anonymous live queries are
+* enabled. Mirrors `ssp_protocol::ANON_AUTH_ID`. It carries no `user:` prefix
+* so it can never collide with a real user id (those arrive as `user:<id>`);
+* both sides resolve it to the shared `_00_list_ref_anon` table.
 */
-function buildWindowMaterialization(surql, idsParam = "__win") {
-	const kw = scanTopLevelClauses(surql);
-	if (kw.startValue === null || kw.startValue <= 0) return null;
-	if (kw.fromIndex === null) return null;
-	const selectClause = surql.slice(0, kw.fromIndex).trimEnd();
-	let orderBy = "";
-	if (kw.orderByIndex !== null) {
-		const ends = [
-			kw.limitIndex,
-			kw.startIndex,
-			kw.semicolonIndex,
-			surql.length
-		].filter((n) => n !== null && n > kw.orderByIndex);
-		const end = Math.min(...ends);
-		orderBy = " " + surql.slice(kw.orderByIndex, end).trim();
-	}
-	return { query: `${selectClause} FROM $${idsParam}${orderBy}` };
-}
-function scanTopLevelClauses(sql) {
-	const out = {
-		fromIndex: null,
-		orderByIndex: null,
-		limitIndex: null,
-		startIndex: null,
-		startValue: null,
-		semicolonIndex: null
-	};
-	let depth = 0;
-	let inStr = false;
-	for (let i = 0; i < sql.length; i++) {
-		const ch = sql[i];
-		if (inStr) {
-			if (ch === "\\") i++;
-			else if (ch === "'") inStr = false;
-			continue;
-		}
-		if (ch === "'") {
-			inStr = true;
-			continue;
-		}
-		if (ch === "(") {
-			depth++;
-			continue;
-		}
-		if (ch === ")") {
-			depth--;
-			continue;
-		}
-		if (depth !== 0) continue;
-		if (ch === ";" && out.semicolonIndex === null) {
-			out.semicolonIndex = i;
-			continue;
-		}
-		if (!isWordBoundary(sql, i)) continue;
-		if (out.fromIndex === null && matchKeyword(sql, i, "FROM")) {
-			out.fromIndex = i;
-			continue;
-		}
-		if (out.fromIndex === null) continue;
-		if (out.orderByIndex === null && matchKeyword(sql, i, "ORDER BY")) {
-			out.orderByIndex = i;
-			continue;
-		}
-		if (out.limitIndex === null && matchKeyword(sql, i, "LIMIT")) {
-			out.limitIndex = i;
-			continue;
-		}
-		if (out.startIndex === null && matchKeyword(sql, i, "START")) {
-			out.startIndex = i;
-			out.startValue = readNumberAfter(sql, i + 5);
-			continue;
-		}
-	}
-	return out;
-}
-function isWordBoundary(sql, i) {
-	if (i === 0) return true;
-	return !/[A-Za-z0-9_]/.test(sql[i - 1]);
+const ANON_USER_ID = "anon";
+/**
+* Default ref-storage mode for this client build. Mirrors the SSP's
+* default (`RefMode::Dedicated`) so cross-session sync works out of the
+* box.
+*/
+const DEFAULT_REF_MODE = "dedicated";
+/**
+* Sanitize a user record id (e.g. `"user:abc"`) into the segment that
+* goes into a dedicated table name (e.g. `"abc"`). Returns `null` if
+* the id is missing the `user:` prefix or contains characters that
+* aren't valid in a SurrealDB table identifier — the server-side
+* `ssp_protocol::sanitize_user_id` uses the same predicate.
+*
+* Accepts both string ids (`"user:abc"`) and SurrealDB `RecordId`
+* objects (which only stringify cleanly via `.toString()`), since
+* `AuthService` passes the record-id object as-is to its subscribers.
+*/
+function sanitizeUserId(userId) {
+	if (userId === null || userId === void 0) return null;
+	const asString = typeof userId === "string" ? userId : typeof userId.toString === "function" ? userId.toString() : null;
+	if (!asString) return null;
+	const raw = asString.startsWith("user:") ? asString.slice(5) : asString;
+	if (raw.length === 0) return null;
+	if (!/^[A-Za-z0-9_]+$/.test(raw)) return null;
+	return raw;
 }
-function matchKeyword(sql, i, keyword) {
-	const parts = keyword.split(" ");
-	let pos = i;
-	for (let p = 0; p < parts.length; p++) {
-		const word = parts[p];
-		if (sql.slice(pos, pos + word.length).toUpperCase() !== word) return false;
-		pos += word.length;
-		if (p < parts.length - 1) {
-			const wsStart = pos;
-			while (pos < sql.length && /\s/.test(sql[pos])) pos++;
-			if (pos === wsStart) return false;
-		}
-	}
-	return pos >= sql.length || !/[A-Za-z0-9_]/.test(sql[pos]);
+/**
+* Resolve the LOCAL storage bucket id for a user. Every user gets their own
+* IndexedDB-backed local store (`indxdb://sp00ky-<bucketId>`) so cached rows,
+* query state, and the mutation outbox never leak across accounts on a shared
+* device. Signed-out sessions share the `anon` bucket.
+*
+* An id that fails sanitization still gets a DETERMINISTIC per-user bucket
+* (cyrb53 hex of the raw id) — falling back to `anon` here would put an
+* authenticated user in the shared bucket and recreate the cross-user leak.
+*/
+function bucketIdForUser(userId) {
+	if (userId === null || userId === void 0 || userId === ANON_USER_ID) return ANON_USER_ID;
+	const uid = sanitizeUserId(userId);
+	if (uid) return uid;
+	return `u${cyrb53(String(userId)).toString(16)}`;
 }
-function readNumberAfter(sql, from) {
-	let pos = from;
-	while (pos < sql.length && /\s/.test(sql[pos])) pos++;
-	const m = /^\d+/.exec(sql.slice(pos));
-	return m ? parseInt(m[0], 10) : null;
+/**
+* Returns the `_00_list_ref` table name for `(mode, userId)`. Falls
+* back to the global `_00_list_ref` when sanitization fails or in
+* single mode.
+*/
+function listRefTableFor(mode, userId) {
+	if (userId === ANON_USER_ID) return "_00_list_ref_anon";
+	if (mode === "single") return "_00_list_ref";
+	const uid = sanitizeUserId(userId);
+	return uid ? `_00_list_ref_user_${uid}` : "_00_list_ref";
 }
 
 //#endregion
-//#region src/modules/data/index.ts
-/** Push a timing sample (ms) into a rolling window, capped at the sample window. */
-function pushSample(samples, ms) {
-	samples.push(ms);
-	if (samples.length > MATERIALIZATION_SAMPLE_WINDOW) samples.shift();
+//#region src/services/database/local.ts
+/** Thrown when a query carries an `epoch` from before a bucket switch. The
+*  caller's chain read from the previous user's store; its write must be
+*  dropped, not applied to the new bucket. */
+var StaleEpochError = class extends Error {
+	constructor() {
+		super("Local store epoch changed (bucket switch); stale write dropped");
+		this.name = "StaleEpochError";
+	}
+};
+/** Store URL for a local bucket. One IndexedDB store per user (`anon` for
+*  signed-out) so cached rows never leak across accounts on a shared device. */
+function bucketStoreUrl(bucketId) {
+	return `indxdb://${bucketStoreName(bucketId)}`;
 }
-/** Build a {lastMs,p50,p90,p99,count} summary from a rolling sample window. */
-function phaseStatOf(samples, lastMs) {
-	if (samples.length === 0) return {
-		lastMs,
-		p50: null,
-		p90: null,
-		p99: null,
-		count: 0
-	};
-	const sorted = [...samples].sort((a, b) => a - b);
-	const pick = (q) => sorted[Math.min(sorted.length - 1, Math.floor(q * sorted.length))];
-	return {
-		lastMs,
-		p50: pick(.5),
-		p90: pick(.9),
-		p99: pick(.99),
-		count: samples.length
-	};
+/** The IndexedDB database name SurrealDB-WASM derives from the store URL. */
+function bucketStoreName(bucketId) {
+	return `sp00ky-${bucketId}`;
 }
-/**
-* DataModule - Unified query and mutation management
-*
-* Merges the functionality of QueryManager and MutationManager.
-* Uses CacheModule for all storage operations.
-*/
-var DataModule = class {
-	activeQueries = /* @__PURE__ */ new Map();
-	pendingQueries = /* @__PURE__ */ new Map();
-	subscriptions = /* @__PURE__ */ new Map();
-	statusSubscriptions = /* @__PURE__ */ new Map();
-	mutationCallbacks = /* @__PURE__ */ new Set();
-	debounceTimers = /* @__PURE__ */ new Map();
-	logger;
-	/**
-	* Optional observer notified whenever a query's fetch status changes.
-	* Wired by Sp00kyClient to push status changes into DevTools. Kept as a
-	* settable field (rather than a constructor arg) because DevTools is
-	* constructed after DataModule.
-	*/
-	onQueryStatusChange;
+function createLocalSurrealClient(logger) {
+	return new Surreal({
+		codecOptions: { valueDecodeVisitor(value) {
+			if (value instanceof RecordId) return encodeRecordId(value);
+			if (value instanceof DateTime) return value.toDate();
+			return value;
+		} },
+		engines: applyDiagnostics(createWasmWorkerEngines(), ({ key, type, phase, ...other }) => {
+			if (phase === "progress" || phase === "after") logger.trace({
+				...other,
+				key,
+				type,
+				phase,
+				service: "surrealdb:local",
+				Category: "sp00ky-client::LocalDatabaseService::diagnostics"
+			}, `Local SurrealDB diagnostics captured ${type}:${phase}`);
+		})
+	});
+}
+var LocalDatabaseService = class extends AbstractDatabaseService {
+	config;
+	eventType = DatabaseEventTypes.LocalQuery;
+	/** Bucket currently open. Set by `connect`/`switchStore`. */
+	bucketId = ANON_USER_ID;
 	/**
-	* Optional observer invoked when a still-subscribed query's TTL heartbeat
-	* fires (~90% of the TTL). Wired by Sp00kyClient to
-	* `Sp00kySync.heartbeatQuery`, which refreshes the remote `_00_query`
-	* row's `lastActiveAt` so an actively-watched query never expires. Settable
-	* field (not a constructor arg) because the sync engine is wired after
-	* DataModule is constructed — mirrors `onQueryStatusChange`.
+	* Monotonic store generation. Bumped on every `switchStore`. Async chains
+	* that read from the store, await something remote, and then write back
+	* (sync poll, SSP stream updates) capture this at chain start and drop
+	* their write when it no longer matches — a stale-epoch write would land
+	* another user's data in the new bucket.
 	*/
-	onHeartbeat;
+	storeEpoch = 0;
+	/** Gate that `query()`/`execute()` await; closed for the switch window. */
+	gate = Promise.resolve();
+	/** The incoming client while a switch is in flight (for unload cleanup). */
+	pendingSwitchClient = null;
+	constructor(config, logger) {
+		const events = createDatabaseEventSystem();
+		super(createLocalSurrealClient(logger), logger, events);
+		this.config = config;
+	}
+	getConfig() {
+		return this.config;
+	}
+	get currentBucketId() {
+		return this.bucketId;
+	}
+	get epoch() {
+		return this.storeEpoch;
+	}
 	/**
-	* Optional hook fired by {@link deregisterQuery} when an opt-in query (e.g. a
-	* viewport-windowed list cancelling an off-screen window) loses its last
-	* subscriber. Wired by Sp00kyClient to enqueue a `cleanup` down-event, which
-	* tears the remote `_00_query` view down (releasing its `_00_list_ref` edges)
-	* instead of leaving it for the TTL sweep. The local view + state are freed in
-	* {@link finalizeDeregister} only after that remote delete, so a fast
-	* re-subscribe (scroll back) can abort/heal the teardown — see `cleanupQuery`.
+	* Close the query gate for a bucket switch. Every `query()`/`execute()`
+	* issued after this waits until the returned release fn runs — so work
+	* triggered mid-switch (sibling auth subscribers registering queries)
+	* lands on the NEW bucket instead of racing the swap. The migrator uses
+	* `queryUngated()` to provision the new bucket while the gate is closed.
 	*/
-	onDeregister;
-	sessionId = "";
-	currentUserId = null;
-	constructor(cache, local, schema, logger, streamDebounceTime = 50) {
-		this.cache = cache;
-		this.local = local;
-		this.schema = schema;
-		this.streamDebounceTime = streamDebounceTime;
-		this.logger = logger.child({ service: "DataModule" });
+	beginSwitch() {
+		let release;
+		this.gate = new Promise((resolve) => {
+			release = resolve;
+		});
+		return release;
 	}
-	async init(sessionId) {
-		this.sessionId = sessionId;
+	async query(query, vars, opts) {
+		await this.gate;
+		if (opts?.epoch !== void 0 && opts.epoch !== this.storeEpoch) throw new StaleEpochError();
+		return super.query(query, vars);
+	}
+	async execute(query, vars, opts) {
+		const raw = await this.query(query.sql, vars, opts);
+		return query.extract(raw);
+	}
+	/** Gate-bypassing query — ONLY for the switch path itself (schema
+	*  provisioning must run while the gate is closed, or it deadlocks). */
+	queryUngated(query, vars) {
+		return super.query(query, vars);
+	}
+	async connect(bucketId = ANON_USER_ID) {
+		const { namespace, database } = this.getConfig();
+		const store = this.getConfig().store ?? "memory";
+		this.bucketId = bucketId;
+		const storeUrl = store === "memory" ? "mem://" : bucketStoreUrl(bucketId);
 		this.logger.info({
-			sessionId,
-			Category: "sp00ky-client::DataModule::init"
-		}, "DataModule initialized");
+			namespace,
+			database,
+			storeUrl,
+			Category: "sp00ky-client::LocalDatabaseService::connect"
+		}, "Connecting to local database");
+		this.registerUnloadClose();
+		await this.openWithRecovery(this.client, storeUrl, namespace, database, bucketId, store);
 	}
 	/**
-	* Update the session salt used in query-id hashing. Call this when the
-	* SurrealDB session changes (sign-in, sign-out, reconnect). Subsequently
-	* registered queries will get fresh, session-scoped IDs.
+	* Switch the local store to another user's bucket. Opens the NEW bucket on a
+	* second client first (with the same 3-tier recovery), then atomically swaps
+	* `this.client` and closes the old one — a failed open never leaves the
+	* service on a dead client. Bumps the store epoch so in-flight old-bucket
+	* async chains can detect they're stale.
+	*
+	* Callers own the drain/rebind choreography (close the gate, quiesce sync +
+	* timers BEFORE calling this; re-provision + rebind AFTER).
 	*/
-	setSessionId(sessionId) {
-		this.sessionId = sessionId;
-	}
-	/**
-	* Update the authenticated user record id. Pass `null` on sign-out.
-	* Read by `Sp00kySync.listRefTable()` so the LIVE subscription and
-	* the poll route to the same per-user `_00_list_ref_user_<id>` the
-	* SSP writes to.
-	*/
-	setCurrentUserId(userId) {
-		this.currentUserId = userId;
-	}
-	/** Read-only view of the authenticated user id used for per-user
-	* `_00_list_ref` routing. Other modules consult this so they pick the
-	* same table name DataModule does. */
-	getCurrentUserId() {
-		return this.currentUserId;
-	}
-	/**
-	* Register a query and return its hash for subscriptions
-	*/
-	async query(tableName, surqlString, params, ttl) {
-		const hash = await this.calculateHash({
-			surql: surqlString,
-			params
-		});
-		this.logger.debug({
-			hash,
-			Category: "sp00ky-client::DataModule::query"
-		}, "Query Initialization: started");
-		const recordId = new RecordId("_00_query", hash);
-		if (this.activeQueries.has(hash)) {
-			this.logger.debug({
-				hash,
-				Category: "sp00ky-client::DataModule::query"
-			}, "Query Initialization: exists, returning");
-			return hash;
-		}
-		if (this.pendingQueries.has(hash)) {
-			this.logger.debug({
-				hash,
-				Category: "sp00ky-client::DataModule::query"
-			}, "Query Initialization: pending, waiting for existing creation");
-			await this.pendingQueries.get(hash);
-			return hash;
+	async switchStore(bucketId) {
+		if (bucketId === this.bucketId) return;
+		const { namespace, database } = this.getConfig();
+		const store = this.getConfig().store ?? "memory";
+		this.storeEpoch++;
+		if (store === "memory") {
+			try {
+				await this.client.close();
+			} catch {}
+			await this.openStore(this.client, "mem://", namespace, database);
+			this.bucketId = bucketId;
+			this.logger.info({
+				bucketId,
+				Category: "sp00ky-client::LocalDatabaseService::switchStore"
+			}, "Reset in-memory local store for bucket switch");
+			return;
 		}
-		this.logger.debug({
-			hash,
-			Category: "sp00ky-client::DataModule::query"
-		}, "Query Initialization: not found, creating new query");
-		const promise = this.createAndRegisterQuery(hash, recordId, surqlString, params, ttl, tableName);
-		this.pendingQueries.set(hash, promise);
+		const next = createLocalSurrealClient(this.logger);
+		this.pendingSwitchClient = next;
 		try {
-			await promise;
+			await this.openWithRecovery(next, bucketStoreUrl(bucketId), namespace, database, bucketId, store);
 		} finally {
-			this.pendingQueries.delete(hash);
+			this.pendingSwitchClient = null;
 		}
-		return hash;
+		const old = this.client;
+		this.client = next;
+		this.bucketId = bucketId;
+		try {
+			await old.close();
+		} catch {}
+		this.logger.info({
+			bucketId,
+			Category: "sp00ky-client::LocalDatabaseService::switchStore"
+		}, "Switched local store bucket");
 	}
 	/**
-	* Subscribe to query updates
+	* Open `storeUrl` on `client` with tiered recovery:
+	* tier 1 retries the same store (transient idb-handle races — preserves the
+	* cache), tier 2 drops THIS bucket's IndexedDB store and reconnects fresh,
+	* tier 3 falls back to `mem://` for the session. Only ever drops the bucket
+	* being opened — other users' buckets hold their own caches AND un-pushed
+	* mutation outboxes, which must survive another bucket's corruption.
 	*/
-	subscribe(queryHash, callback, options = {}) {
-		if (!this.subscriptions.has(queryHash)) this.subscriptions.set(queryHash, /* @__PURE__ */ new Set());
-		this.subscriptions.get(queryHash)?.add(callback);
-		if (options.immediate) {
-			const query = this.activeQueries.get(queryHash);
-			if (query) callback(query.records);
+	async openWithRecovery(client, storeUrl, namespace, database, bucketId, store) {
+		try {
+			await this.openStore(client, storeUrl, namespace, database);
+			this.logger.info({ Category: "sp00ky-client::LocalDatabaseService::connect" }, "Connected to local database");
+			return;
+		} catch (err) {
+			if (store === "memory" || !isLocalStoreOpenError(err)) {
+				this.logger.error({
+					err,
+					Category: "sp00ky-client::LocalDatabaseService::connect"
+				}, "Failed to connect to local database");
+				throw err;
+			}
+			this.logger.warn({
+				err,
+				Category: "sp00ky-client::LocalDatabaseService::connect"
+			}, "Local IndexedDB store failed to open; retrying before clearing");
 		}
-		return () => {
-			const subs = this.subscriptions.get(queryHash);
-			if (subs) {
-				subs.delete(callback);
-				if (subs.size === 0) this.subscriptions.delete(queryHash);
+		for (let attempt = 1; attempt <= 2; attempt++) {
+			try {
+				await client.close();
+			} catch {}
+			await delay(150 * attempt);
+			try {
+				await this.openStore(client, storeUrl, namespace, database);
+				this.logger.info({
+					attempt,
+					Category: "sp00ky-client::LocalDatabaseService::connect"
+				}, "Connected to local database on retry (cache preserved)");
+				return;
+			} catch (retryErr) {
+				this.logger.warn({
+					err: retryErr,
+					attempt,
+					Category: "sp00ky-client::LocalDatabaseService::connect"
+				}, "Local store retry failed");
 			}
-		};
+		}
+		try {
+			await client.close();
+		} catch {}
+		await dropLocalIndexedDbStores(this.logger, bucketStoreName(bucketId));
+		try {
+			await this.openStore(client, storeUrl, namespace, database);
+			this.logger.info({ Category: "sp00ky-client::LocalDatabaseService::connect" }, "Reconnected to local database after clearing the corrupt store");
+		} catch (retryErr) {
+			this.logger.error({
+				err: retryErr,
+				Category: "sp00ky-client::LocalDatabaseService::connect"
+			}, "Local store still failing after clear; falling back to in-memory");
+			try {
+				await client.close();
+			} catch {}
+			await this.openStore(client, "mem://", namespace, database);
+			this.logger.warn({ Category: "sp00ky-client::LocalDatabaseService::connect" }, "Connected to local database (in-memory fallback)");
+		}
 	}
+	unloadCloseRegistered = false;
 	/**
-	* Subscribe to a query's fetch-status changes (idle/fetching).
-	* With `{ immediate: true }` the callback fires synchronously with the
-	* current status (defaults to `idle` if the query isn't registered yet).
+	* Close the local DB on page unload so the SurrealDB-WASM worker releases its
+	* IndexedDB connection cleanly. Without this, the previous page's connection
+	* lingers; the next load's `client.connect` opens the store but the first
+	* write transaction in `client.use` hits an "IndexedDB error" — which then
+	* (mis)triggered the corrupt-store recovery and WIPED the cache on every
+	* reload, making warm loads as slow as cold ones. `pagehide` is the reliable
+	* unload signal (fires on bfcache + normal navigation); `close()` is async but
+	* the WASM worker initiates the IndexedDB connection teardown synchronously.
+	* Also closes a mid-switch incoming client so its fresh handle doesn't linger.
 	*/
-	subscribeStatus(queryHash, callback, options = {}) {
-		if (!this.statusSubscriptions.has(queryHash)) this.statusSubscriptions.set(queryHash, /* @__PURE__ */ new Set());
-		this.statusSubscriptions.get(queryHash)?.add(callback);
-		if (options.immediate) callback(this.activeQueries.get(queryHash)?.status ?? "idle");
-		return () => {
-			const subs = this.statusSubscriptions.get(queryHash);
-			if (subs) {
-				subs.delete(callback);
-				if (subs.size === 0) this.statusSubscriptions.delete(queryHash);
-			}
+	registerUnloadClose() {
+		if (this.unloadCloseRegistered || typeof window === "undefined") return;
+		this.unloadCloseRegistered = true;
+		const close = () => {
+			try {
+				this.client.close();
+			} catch {}
+			try {
+				this.pendingSwitchClient?.close();
+			} catch {}
 		};
+		window.addEventListener("pagehide", close);
+		window.addEventListener("beforeunload", close);
 	}
-	/**
-	* Set a query's fetch status and notify status observers (DevTools +
-	* `subscribeStatus` listeners). No-op when the status is unchanged or the
-	* query is unknown.
-	*/
-	setQueryStatus(queryHash, status) {
-		const queryState = this.activeQueries.get(queryHash);
-		if (!queryState || queryState.status === status) return;
-		queryState.status = status;
-		this.onQueryStatusChange?.(queryHash, status);
-		const subs = this.statusSubscriptions.get(queryHash);
-		if (subs) for (const callback of subs) callback(status);
-	}
-	/**
-	* Subscribe to mutations (for sync)
-	*/
-	onMutation(callback) {
-		this.mutationCallbacks.add(callback);
-		return () => {
-			this.mutationCallbacks.delete(callback);
-		};
+	async openStore(client, storeUrl, namespace, database) {
+		this.logger.debug({
+			storeUrl,
+			Category: "sp00ky-client::LocalDatabaseService::connect"
+		}, "[LocalDatabaseService] Calling client.connect");
+		await client.connect(storeUrl, {});
+		this.logger.debug({
+			namespace,
+			database,
+			Category: "sp00ky-client::LocalDatabaseService::connect"
+		}, "[LocalDatabaseService] client.connect returned. Calling client.use");
+		await client.use({
+			namespace,
+			database
+		});
+		this.logger.debug({ Category: "sp00ky-client::LocalDatabaseService::connect" }, "[LocalDatabaseService] client.use returned");
 	}
-	/**
-	* Handle stream updates from DBSP (via CacheModule)
-	*/
-	async onStreamUpdate(update) {
-		const { queryHash, op } = update;
-		if (op === "DELETE") {
-			const existing = this.debounceTimers.get(queryHash);
-			if (existing) {
-				clearTimeout(existing);
-				this.debounceTimers.delete(queryHash);
-			}
-			await this.processStreamUpdate(update);
-			return;
-		}
-		if (this.debounceTimers.has(queryHash)) clearTimeout(this.debounceTimers.get(queryHash));
-		const timer = setTimeout(async () => {
-			this.debounceTimers.delete(queryHash);
-			await this.processStreamUpdate(update);
-		}, this.streamDebounceTime);
-		this.debounceTimers.set(queryHash, timer);
+};
+function delay(ms) {
+	return new Promise((resolve) => setTimeout(resolve, ms));
+}
+/** True for the SurrealDB-WASM error raised when its IndexedDB-backed key-value
+*  store can't be opened (corrupt / version-incompatible / blocked). Exported
+*  for unit testing the error-message match. */
+function isLocalStoreOpenError(err) {
+	const msg = (err instanceof Error ? err.message : String(err)).toLowerCase();
+	return msg.includes("indexeddb") || msg.includes("idb error") || msg.includes("key-value store");
+}
+/** Best-effort delete of ONE bucket's IndexedDB store(s). SurrealDB-WASM backs
+*  `indxdb://<name>` with one or more IndexedDB databases whose names include
+*  `<name>`. Scoped to the given store name — never wipe by the bare `sp00ky`
+*  substring, that would take every user's bucket (and their un-pushed mutation
+*  outboxes) down with one corrupt store. Resolves even on error/blocked so
+*  startup can proceed. No-op outside a browser. Exported for unit tests. */
+async function dropLocalIndexedDbStores(logger, storeName) {
+	if (typeof indexedDB === "undefined") return;
+	try {
+		let names = [];
+		if (typeof indexedDB.databases === "function") names = (await indexedDB.databases()).map((d) => d.name).filter((n) => !!n && matchesBucketStore(n, storeName));
+		if (names.length === 0) names = [storeName];
+		await Promise.all(names.map(deleteIndexedDb));
+		logger.info({
+			names,
+			Category: "sp00ky-client::LocalDatabaseService::connect"
+		}, "Cleared local IndexedDB store(s)");
+	} catch (e) {
+		logger.warn({
+			err: e,
+			Category: "sp00ky-client::LocalDatabaseService::connect"
+		}, "Failed to enumerate/clear IndexedDB; proceeding anyway");
 	}
-	async materializeRecords(queryState, sspArray) {
-		const t0 = performance.now();
-		const windowMat = buildWindowMaterialization(queryState.config.surql);
-		let records;
-		if (windowMat) {
-			const winIds = (queryState.config.remoteArray?.length && queryState.config.remoteArray || sspArray?.length && sspArray || queryState.config.localArray || []).map(([id]) => parseRecordIdString(id));
-			const [rows] = await this.local.query(windowMat.query, {
-				...queryState.config.params,
-				__win: winIds
-			});
-			records = rows || [];
-		} else {
-			const [rows] = await this.local.query(queryState.config.surql, queryState.config.params);
-			records = rows || [];
+}
+/** True when idb database `name` belongs to the bucket store `storeName` —
+*  exact match or a derived name (`<storeName>`, `<storeName>-*`, `*<storeName>*`
+*  with a non-alphanumeric boundary so `sp00ky-abc` never matches
+*  `sp00ky-abcdef`'s store). Exported for unit tests. */
+function matchesBucketStore(name, storeName) {
+	const lower = name.toLowerCase();
+	const target = storeName.toLowerCase();
+	const idx = lower.indexOf(target);
+	if (idx === -1) return false;
+	const after = lower[idx + target.length];
+	return after === void 0 || !/[a-z0-9_]/.test(after);
+}
+function deleteIndexedDb(name) {
+	return new Promise((resolve) => {
+		try {
+			const req = indexedDB.deleteDatabase(name);
+			req.onsuccess = () => resolve();
+			req.onerror = () => resolve();
+			req.onblocked = () => resolve();
+		} catch {
+			resolve();
 		}
-		this.recordPhase(queryState, "localFetch", performance.now() - t0);
-		return records;
+	});
+}
+
+//#endregion
+//#region src/services/database/remote.ts
+var RemoteDatabaseService = class extends AbstractDatabaseService {
+	config;
+	eventType = DatabaseEventTypes.RemoteQuery;
+	constructor(config, logger) {
+		const events = createDatabaseEventSystem();
+		super(new Surreal({ engines: applyDiagnostics(createRemoteEngines(), ({ key, type, phase, ...other }) => {
+			if (phase === "progress" || phase === "after") logger.trace({
+				...other,
+				key,
+				type,
+				phase,
+				service: "surrealdb:remote",
+				Category: "sp00ky-client::RemoteDatabaseService::diagnostics"
+			}, `Remote SurrealDB diagnostics captured ${type}:${phase}`);
+		}) }), logger, events);
+		this.config = config;
 	}
-	async processStreamUpdate(update) {
-		const { queryHash, localArray, materializationTimeMs } = update;
-		const queryState = this.activeQueries.get(queryHash);
-		if (!queryState) {
-			this.logger.warn({
-				queryHash,
-				Category: "sp00ky-client::DataModule::onStreamUpdate"
-			}, "Received update for unknown query. Skipping...");
-			return;
-		}
-		if (typeof materializationTimeMs === "number") {
-			queryState.materializationSamples.push(materializationTimeMs);
-			if (queryState.materializationSamples.length > MATERIALIZATION_SAMPLE_WINDOW) queryState.materializationSamples.shift();
-			queryState.lastIngestLatencyMs = materializationTimeMs;
-		}
-		if (typeof update.storeApplyMs === "number") this.recordPhase(queryState, "sspStoreApply", update.storeApplyMs);
-		if (typeof update.circuitStepMs === "number") this.recordPhase(queryState, "sspCircuitStep", update.circuitStepMs);
-		if (typeof update.transformMs === "number") this.recordPhase(queryState, "sspTransform", update.transformMs);
-		const percentiles = this.computeMaterializationPercentiles(queryState.materializationSamples);
-		try {
-			const newRecords = await this.materializeRecords(queryState, localArray);
-			queryState.config.localArray = localArray;
-			const prevJson = JSON.stringify(queryState.records);
-			const newJson = JSON.stringify(newRecords);
-			queryState.records = newRecords;
-			const recordsChanged = prevJson !== newJson;
-			if (recordsChanged) queryState.updateCount++;
-			await this.local.query(surql.seal(surql.updateSet("id", [
-				"localArray",
-				"rowCount",
-				"updateCount",
-				"lastIngestLatency",
-				"materializationP55",
-				"materializationP90",
-				"materializationP99"
-			])), {
-				id: queryState.config.id,
-				localArray,
-				rowCount: localArray.length,
-				updateCount: queryState.updateCount,
-				lastIngestLatency: queryState.lastIngestLatencyMs,
-				materializationP55: percentiles.p55,
-				materializationP90: percentiles.p90,
-				materializationP99: percentiles.p99
-			});
-			if (!recordsChanged) {
-				this.logger.debug({
-					queryHash,
-					Category: "sp00ky-client::DataModule::onStreamUpdate"
-				}, "Query records unchanged, skipping notification");
-				return;
-			}
-			const subscribers = this.subscriptions.get(queryHash);
-			if (subscribers) for (const callback of subscribers) callback(queryState.records);
-			this.logger.debug({
-				queryHash,
-				recordCount: newRecords?.length,
-				Category: "sp00ky-client::DataModule::onStreamUpdate"
-			}, "Query updated from stream");
-		} catch (err) {
-			queryState.errorCount++;
-			this.logger.error({
-				err,
-				queryHash,
-				Category: "sp00ky-client::DataModule::onStreamUpdate"
-			}, "Failed to fetch records for stream update");
+	getConfig() {
+		return this.config;
+	}
+	async connect() {
+		const { endpoint, token, namespace, database } = this.getConfig();
+		if (endpoint) {
+			this.logger.info({
+				endpoint,
+				namespace,
+				database,
+				Category: "sp00ky-client::RemoteDatabaseService::connect"
+			}, "Connecting to remote database");
 			try {
-				await this.local.query(surql.seal(surql.updateSet("id", ["errorCount"])), {
-					id: queryState.config.id,
-					errorCount: queryState.errorCount
+				await this.client.connect(endpoint);
+				await this.client.use({
+					namespace,
+					database
 				});
-			} catch (persistErr) {
-				this.logger.warn({
-					err: persistErr,
-					queryHash,
-					Category: "sp00ky-client::DataModule::onStreamUpdate"
-				}, "Failed to persist incremented errorCount");
+				if (token) {
+					this.logger.debug({ Category: "sp00ky-client::RemoteDatabaseService::connect" }, "Authenticating with token");
+					await this.client.authenticate(token);
+				}
+				this.logger.info({ Category: "sp00ky-client::RemoteDatabaseService::connect" }, "Connected to remote database");
+			} catch (err) {
+				this.logger.error({
+					err,
+					Category: "sp00ky-client::RemoteDatabaseService::connect"
+				}, "Failed to connect to remote database");
+				throw err;
 			}
-		}
+		} else this.logger.warn({ Category: "sp00ky-client::RemoteDatabaseService::connect" }, "No endpoint configured for remote database");
 	}
-	/**
-	* Compute p55/p90/p99 from a rolling window of materialization samples.
-	* Returns nulls for any percentile that has no samples yet so SurrealDB
-	* `option<float>` columns stay NONE rather than 0 before the first ingest.
-	*/
-	computeMaterializationPercentiles(samples) {
-		if (samples.length === 0) return {
-			p55: null,
-			p90: null,
-			p99: null
-		};
-		const sorted = [...samples].sort((a, b) => a - b);
-		const pick = (q) => {
-			return sorted[Math.min(sorted.length - 1, Math.floor(q * sorted.length))];
-		};
-		return {
-			p55: pick(.55),
-			p90: pick(.9),
-			p99: pick(.99)
-		};
+	async signin(params) {
+		return this.client.signin(params);
 	}
-	/** Record a per-phase timing sample (ms) on a query's rolling window. */
-	recordPhase(qs, phase, ms) {
-		if (!Number.isFinite(ms)) return;
-		pushSample(qs.phaseSamples[phase] ?? (qs.phaseSamples[phase] = []), ms);
-		qs.phaseLast[phase] = ms;
+	async signup(params) {
+		return this.client.signup(params);
 	}
-	/** Record the remote record-fetch time (ms) for a query. Called by the sync engine. */
-	recordRemoteFetch(hash, ms) {
-		const qs = this.activeQueries.get(hash);
-		if (qs) this.recordPhase(qs, "remoteFetch", ms);
+	async authenticate(token) {
+		return this.client.authenticate(token);
 	}
-	/**
-	* Record the frontend reconcile time (ms) for a query. Called from `useQuery`
-	* via `Sp00kyClient.reportFrontendTiming` after it applies an update to its store.
-	*/
-	recordFrontendTiming(hash, ms) {
-		const qs = this.activeQueries.get(hash);
-		if (qs) this.recordPhase(qs, "frontend", ms);
+	async invalidate() {
+		return this.client.invalidate();
 	}
-	/**
-	* Build the per-query processing-time breakdown surfaced to the DevTools panel
-	* and the MCP. `ssp` is the WASM-ingest wall time (from `materializationSamples`);
-	* the rest come from the per-phase rolling windows + one-shot registration timings.
-	*/
-	phaseTimings(q) {
-		const stat = (phase) => phaseStatOf(q.phaseSamples[phase] ?? [], q.phaseLast[phase] ?? null);
-		return {
-			ssp: phaseStatOf(q.materializationSamples, q.lastIngestLatencyMs),
-			sspStoreApply: stat("sspStoreApply"),
-			sspCircuitStep: stat("sspCircuitStep"),
-			sspTransform: stat("sspTransform"),
-			localFetch: stat("localFetch"),
-			remoteFetch: stat("remoteFetch"),
-			frontend: stat("frontend"),
-			registration: q.registrationTimings,
-			updateCount: q.updateCount,
-			errorCount: q.errorCount
-		};
+};
+
+//#endregion
+//#region src/services/logger/index.ts
+function createLogger(level = "info", transmit) {
+	const browserConfig = {
+		asObject: true,
+		write: (o) => {
+			console.log(JSON.stringify(o));
+		}
+	};
+	if (transmit) browserConfig.transmit = transmit;
+	return pino({
+		level,
+		browser: browserConfig
+	});
+}
+
+//#endregion
+//#region src/services/database/local-migrator.ts
+const sha1 = async (str) => {
+	const enc = new TextEncoder();
+	const hash = await crypto.subtle.digest("SHA-1", enc.encode(str));
+	return Array.from(new Uint8Array(hash)).map((v) => v.toString(16).padStart(2, "0")).join("");
+};
+var LocalMigrator = class {
+	logger;
+	constructor(localDb, logger) {
+		this.localDb = localDb;
+		this.logger = logger.child({ service: "LocalMigrator" });
+		logger?.child({ service: "LocalMigrator" }) ?? createLogger("info").child({ service: "LocalMigrator" });
 	}
-	/**
-	* Get query state (for sync and devtools)
-	*/
-	getQueryByHash(hash) {
-		return this.activeQueries.get(hash);
+	async provision(schemaSurql) {
+		const hash = await sha1(schemaSurql);
+		const { database } = this.localDb.getConfig();
+		if (await this.isSchemaUpToDate(hash)) {
+			this.logger.info({ Category: "sp00ky-client::LocalMigrator::provision" }, "[Provisioning] Schema is up to date, skipping migration");
+			return;
+		}
+		await this.recreateDatabase(database);
+		const fullSchema = schemaSurql + "\n\n      DEFINE TABLE IF NOT EXISTS _00_stream_processor_state SCHEMALESS PERMISSIONS FOR select, create, update, delete WHERE true;\n      DEFINE TABLE IF NOT EXISTS _00_query SCHEMALESS PERMISSIONS FOR select, create, update, delete WHERE true;\n      DEFINE TABLE IF NOT EXISTS _00_schema SCHEMALESS PERMISSIONS FOR select, create, update, delete WHERE true;\n      DEFINE TABLE IF NOT EXISTS _00_pending_mutations SCHEMALESS PERMISSIONS FOR select, create, update, delete WHERE true;\n    ";
+		const statements = this.splitStatements(fullSchema);
+		for (let i = 0; i < statements.length; i++) {
+			const statement = statements[i];
+			const cleanStatement = statement.replace(/--.*/g, "").trim();
+			if (cleanStatement.toUpperCase().startsWith("DEFINE INDEX")) {
+				this.logger.warn({ Category: "sp00ky-client::LocalMigrator::provision" }, `[Provisioning] Skipping index definition (WASM hang avoidance): ${cleanStatement.substring(0, 50)}...`);
+				continue;
+			}
+			try {
+				this.logger.info({ Category: "sp00ky-client::LocalMigrator::provision" }, `[Provisioning] (${i + 1}/${statements.length}) Executing: ${statement.substring(0, 50)}...`);
+				await this.localDb.queryUngated(statement);
+				this.logger.info({ Category: "sp00ky-client::LocalMigrator::provision" }, `[Provisioning] (${i + 1}/${statements.length}) Done`);
+			} catch (e) {
+				this.logger.error({ Category: "sp00ky-client::LocalMigrator::provision" }, `[Provisioning] (${i + 1}/${statements.length}) Error executing statement: ${statement}`);
+				throw e;
+			}
+		}
+		await this.createHashRecord(hash);
 	}
-	/**
-	* Cold-query guard for instant-hydrate: true when the query exists, hasn't been
-	* hydrated, and has NOT yet fetched its server result (`remoteArray` empty).
-	* We gate on `remoteArray`, not local `records`: a windowed query is often
-	* partially pre-seeded from the circuit (e.g. the dashboard's 5-row preview),
-	* but it still hasn't loaded its own full window from the server — so it should
-	* still hydrate. A warm re-subscribe (remoteArray already populated) is skipped.
-	*/
-	isCold(hash) {
-		const qs = this.activeQueries.get(hash);
-		return !!qs && !qs.hydrated && (qs.config.remoteArray?.length ?? 0) === 0;
+	async isSchemaUpToDate(hash) {
+		try {
+			const [lastSchemaRecord] = await this.localDb.queryUngated(`SELECT hash, created_at FROM ONLY _00_schema ORDER BY created_at DESC LIMIT 1;`);
+			return lastSchemaRecord?.hash === hash;
+		} catch (_error) {
+			return false;
+		}
 	}
-	/**
-	* Walk a hydrated record's fields and append any EMBEDDED child records to
-	* `batch` (recursing for nested related fields). An embedded child is a
-	* value that is itself a record — a non-null object whose `id` is a
-	* `RecordId` — or an array of such records (one-to-many vs one-to-one). A
-	* bare `RecordId` (a foreign-key reference) or any other value is skipped,
-	* so this never mistakes a FK column for an embedded body. Children are
-	* keyed by their own `record.id.table`, versioned by `_00_rv`, and cleaned
-	* to their table's real columns (which strips the alias/related fields).
-	* `seen` dedupes within the batch.
-	*/
-	collectEmbeddedChildren(record, batch, seen) {
-		const isEmbeddedRecord = (v) => !!v && typeof v === "object" && !(v instanceof RecordId) && v.id instanceof RecordId;
-		for (const value of Object.values(record)) {
-			const children = Array.isArray(value) ? value.filter(isEmbeddedRecord) : isEmbeddedRecord(value) ? [value] : [];
-			for (const child of children) {
-				const key = encodeRecordId(child.id);
-				if (seen.has(key)) continue;
-				seen.add(key);
-				this.collectEmbeddedChildren(child, batch, seen);
-				const table = child.id.table.toString();
-				const tableSchema = this.schema.tables.find((t) => t.name === table);
-				batch.push({
-					table,
-					op: "CREATE",
-					record: tableSchema ? cleanRecord(tableSchema.columns, child) : child,
-					version: child._00_rv || 1
-				});
+	async recreateDatabase(database) {
+		try {
+			await this.localDb.queryUngated(`DEFINE DATABASE _00_temp;`);
+		} catch (_e) {}
+		try {
+			await this.localDb.queryUngated(`
+        USE DB _00_temp;
+        REMOVE DATABASE ${database};
+      `);
+		} catch (_e) {}
+		await this.localDb.queryUngated(`
+      DEFINE DATABASE ${database};
+      USE DB ${database};
+    `);
+	}
+	splitStatements(schema) {
+		const statements = [];
+		let current = "";
+		let depth = 0;
+		let inQuote = false;
+		let quoteChar = "";
+		let inComment = false;
+		for (let i = 0; i < schema.length; i++) {
+			const char = schema[i];
+			const nextChar = schema[i + 1];
+			if (inComment) {
+				current += char;
+				if (char === "\n") inComment = false;
+				continue;
+			}
+			if (!inQuote && char === "-" && nextChar === "-") {
+				inComment = true;
+				current += char;
+				continue;
+			}
+			if (inQuote) {
+				current += char;
+				if (char === quoteChar && schema[i - 1] !== "\\") inQuote = false;
+				continue;
+			}
+			if (char === "\"" || char === "'") {
+				inQuote = true;
+				quoteChar = char;
+				current += char;
+				continue;
+			}
+			if (char === "{") {
+				depth++;
+				current += char;
+				continue;
+			}
+			if (char === "}") {
+				depth--;
+				current += char;
+				continue;
+			}
+			if (char === ";" && depth === 0) {
+				if (current.trim().length > 0) statements.push(current.trim());
+				current = "";
+				continue;
 			}
+			current += char;
 		}
+		if (current.trim().length > 0) statements.push(current.trim());
+		return statements;
 	}
-	/**
-	* Instant-hydrate: ingest rows fetched one-shot from the remote (the query's own
-	* surql run directly) so the query DISPLAYS immediately, while the full realtime
-	* registration proceeds in the background. Ingests with versions (`_00_rv`) so the
-	* later `syncRecords` dedup skips re-pulling unchanged bodies, and seeds
-	* `remoteArray` so windowed queries materialize the correct window (no sparse
-	* local-circuit issue). Runs at most once per query (the `hydrated` flag).
-	*/
-	async applyHydration(hash, rows) {
-		const queryState = this.activeQueries.get(hash);
-		if (!queryState) return;
-		queryState.hydrated = true;
-		if (rows.length === 0) return;
-		const tableName = queryState.config.tableName;
-		const batch = rows.map((record) => ({
-			table: tableName,
-			op: "CREATE",
-			record,
-			version: record._00_rv || 1
-		}));
-		const seen = new Set(rows.map((r) => encodeRecordId(r.id)));
-		for (const record of rows) this.collectEmbeddedChildren(record, batch, seen);
-		await this.cache.saveBatch(batch);
-		queryState.config.remoteArray = rows.map((r) => [encodeRecordId(r.id), r._00_rv || 1]);
-		queryState.records = await this.materializeRecords(queryState);
-		const subscribers = this.subscriptions.get(hash);
-		if (subscribers) for (const cb of subscribers) cb(queryState.records);
-	}
-	/** True while ≥1 live subscriber is watching this query (refcount guard). */
-	hasSubscribers(hash) {
-		return (this.subscriptions.get(hash)?.size ?? 0) > 0;
+	async createHashRecord(hash) {
+		await this.localDb.queryUngated(`UPSERT _00_schema SET hash = $hash, created_at = time::now() WHERE hash = $hash;`, { hash });
 	}
-	/**
-	* Opt-in eager teardown for a query whose LAST subscriber just left — used by
-	* viewport-windowed lists to cancel off-screen windows instead of leaving
-	* their remote views to expire on the TTL sweep. No-op while any subscriber
-	* remains (refcount). Only enqueues the remote cleanup here; the local WASM
-	* view + in-memory state are freed in {@link finalizeDeregister} after the
-	* remote delete completes, so a re-subscribe in between aborts/heals it.
-	*
-	* NOTE: most queries should NOT use this — the default keep-alive on
-	* unsubscribe avoids re-registration churn on navigation.
-	*/
-	deregisterQuery(hash) {
-		if (this.hasSubscribers(hash)) return;
-		if (!this.activeQueries.has(hash)) return;
-		this.onDeregister?.(hash);
+};
+
+//#endregion
+//#region src/modules/data/window-query.ts
+/**
+* Rewrite a windowed (`LIMIT n START m`, m>0) SELECT so its rows are
+* materialized from an explicit record-id set — the window the SSP already
+* computed — instead of re-running the original query (with its `START m`)
+* against the shared local DB.
+*
+* Why: `DataModule.processStreamUpdate` materializes a query's rows by
+* re-querying the local in-browser SurrealDB with the original surql. For an
+* offset query that re-applies `START m` against the *shared* local store —
+* which, with sparse windowing, may hold only this window's rows — so it skips
+* them all and returns nothing (the "page 2 returns 0 rows" bug). The SSP's
+* materialized view (`StreamUpdate.localArray`) is exactly this window's row
+* ids, so we select those ids directly and re-apply the original `ORDER BY` for
+* stable display order.
+*
+* Returns `null` for non-offset queries (`START` absent or 0) — the caller
+* keeps the normal re-query path, so only the broken case changes behavior.
+*
+* Preserves the `SELECT <projection>` clause and the top-level `ORDER BY`;
+* drops the original `FROM`/`WHERE`/`LIMIT`/`START`. Subqueries inside the
+* projection are preserved verbatim (the scanner is paren/quote aware), with
+* one caveat: SurrealDB v3 drops `*` in the `SELECT *, <subquery> FROM $param`
+* shape — such windowed+subquery queries are rare and were already returning 0,
+* so this is no regression.
+*/
+function buildWindowMaterialization(surql, idsParam = "__win") {
+	const kw = scanTopLevelClauses(surql);
+	if (kw.startValue === null || kw.startValue <= 0) return null;
+	if (kw.fromIndex === null) return null;
+	const selectClause = surql.slice(0, kw.fromIndex).trimEnd();
+	let orderBy = "";
+	if (kw.orderByIndex !== null) {
+		const ends = [
+			kw.limitIndex,
+			kw.startIndex,
+			kw.semicolonIndex,
+			surql.length
+		].filter((n) => n !== null && n > kw.orderByIndex);
+		const end = Math.min(...ends);
+		orderBy = " " + surql.slice(kw.orderByIndex, end).trim();
 	}
-	/**
-	* Final local teardown after the remote `_00_query` row was deleted: free the
-	* WASM view, heartbeat timer, debounce timer, and in-memory state. Caller
-	* (`cleanupQuery`) guarantees no subscriber remains.
-	*/
-	finalizeDeregister(hash) {
-		const qs = this.activeQueries.get(hash);
-		if (qs?.ttlTimer) {
-			clearTimeout(qs.ttlTimer);
-			qs.ttlTimer = null;
+	return { query: `${selectClause} FROM $${idsParam}${orderBy}` };
+}
+function scanTopLevelClauses(sql) {
+	const out = {
+		fromIndex: null,
+		orderByIndex: null,
+		limitIndex: null,
+		startIndex: null,
+		startValue: null,
+		semicolonIndex: null
+	};
+	let depth = 0;
+	let inStr = false;
+	for (let i = 0; i < sql.length; i++) {
+		const ch = sql[i];
+		if (inStr) {
+			if (ch === "\\") i++;
+			else if (ch === "'") inStr = false;
+			continue;
 		}
-		const debounce = this.debounceTimers.get(hash);
-		if (debounce) {
-			clearTimeout(debounce);
-			this.debounceTimers.delete(hash);
+		if (ch === "'") {
+			inStr = true;
+			continue;
 		}
-		this.cache.unregisterQuery(hash);
-		this.activeQueries.delete(hash);
-		this.subscriptions.delete(hash);
-	}
-	/**
-	* Get query state by id (for sync and devtools)
-	*/
-	getQueryById(id) {
-		return this.activeQueries.get(extractIdPart(id));
-	}
-	/**
-	* Get all active queries (for devtools)
-	*/
-	getActiveQueries() {
-		return Array.from(this.activeQueries.values());
-	}
-	getActiveQueryHashes() {
-		return Array.from(this.activeQueries.keys());
-	}
-	async updateQueryLocalArray(id, localArray) {
-		const queryState = this.activeQueries.get(id);
-		if (!queryState) {
-			this.logger.warn({
-				id,
-				Category: "sp00ky-client::DataModule::updateQueryLocalArray"
-			}, "Query to update local array not found");
-			return;
+		if (ch === "(") {
+			depth++;
+			continue;
+		}
+		if (ch === ")") {
+			depth--;
+			continue;
+		}
+		if (depth !== 0) continue;
+		if (ch === ";" && out.semicolonIndex === null) {
+			out.semicolonIndex = i;
+			continue;
+		}
+		if (!isWordBoundary(sql, i)) continue;
+		if (out.fromIndex === null && matchKeyword(sql, i, "FROM")) {
+			out.fromIndex = i;
+			continue;
+		}
+		if (out.fromIndex === null) continue;
+		if (out.orderByIndex === null && matchKeyword(sql, i, "ORDER BY")) {
+			out.orderByIndex = i;
+			continue;
+		}
+		if (out.limitIndex === null && matchKeyword(sql, i, "LIMIT")) {
+			out.limitIndex = i;
+			continue;
+		}
+		if (out.startIndex === null && matchKeyword(sql, i, "START")) {
+			out.startIndex = i;
+			out.startValue = readNumberAfter(sql, i + 5);
+			continue;
 		}
-		queryState.config.localArray = localArray;
-		await this.local.query(surql.seal(surql.updateSet("id", ["localArray"])), {
-			id: queryState.config.id,
-			localArray
-		});
 	}
-	async updateQueryRemoteArray(hash, remoteArray) {
-		const queryState = this.getQueryByHash(hash);
-		if (!queryState) {
-			this.logger.warn({
-				hash,
-				Category: "sp00ky-client::DataModule::updateQueryRemoteArray"
-			}, "Query to update remote array not found");
-			return;
+	return out;
+}
+function isWordBoundary(sql, i) {
+	if (i === 0) return true;
+	return !/[A-Za-z0-9_]/.test(sql[i - 1]);
+}
+function matchKeyword(sql, i, keyword) {
+	const parts = keyword.split(" ");
+	let pos = i;
+	for (let p = 0; p < parts.length; p++) {
+		const word = parts[p];
+		if (sql.slice(pos, pos + word.length).toUpperCase() !== word) return false;
+		pos += word.length;
+		if (p < parts.length - 1) {
+			const wsStart = pos;
+			while (pos < sql.length && /\s/.test(sql[pos])) pos++;
+			if (pos === wsStart) return false;
 		}
-		queryState.config.remoteArray = remoteArray;
-		await this.local.query(surql.seal(surql.updateSet("id", ["remoteArray"])), {
-			id: queryState.config.id,
-			remoteArray
-		});
 	}
+	return pos >= sql.length || !/[A-Za-z0-9_]/.test(sql[pos]);
+}
+function readNumberAfter(sql, from) {
+	let pos = from;
+	while (pos < sql.length && /\s/.test(sql[pos])) pos++;
+	const m = /^\d+/.exec(sql.slice(pos));
+	return m ? parseInt(m[0], 10) : null;
+}
+
+//#endregion
+//#region src/modules/data/index.ts
+/** Push a timing sample (ms) into a rolling window, capped at the sample window. */
+function pushSample(samples, ms) {
+	samples.push(ms);
+	if (samples.length > MATERIALIZATION_SAMPLE_WINDOW) samples.shift();
+}
+/** Build a {lastMs,p50,p90,p99,count} summary from a rolling sample window. */
+function phaseStatOf(samples, lastMs) {
+	if (samples.length === 0) return {
+		lastMs,
+		p50: null,
+		p90: null,
+		p99: null,
+		count: 0
+	};
+	const sorted = [...samples].sort((a, b) => a - b);
+	const pick = (q) => sorted[Math.min(sorted.length - 1, Math.floor(q * sorted.length))];
+	return {
+		lastMs,
+		p50: pick(.5),
+		p90: pick(.9),
+		p99: pick(.99),
+		count: samples.length
+	};
+}
+/**
+* DataModule - Unified query and mutation management
+*
+* Merges the functionality of QueryManager and MutationManager.
+* Uses CacheModule for all storage operations.
+*/
+var DataModule = class {
+	activeQueries = /* @__PURE__ */ new Map();
+	pendingQueries = /* @__PURE__ */ new Map();
+	subscriptions = /* @__PURE__ */ new Map();
+	statusSubscriptions = /* @__PURE__ */ new Map();
+	mutationCallbacks = /* @__PURE__ */ new Set();
+	debounceTimers = /* @__PURE__ */ new Map();
+	pendingStreamUpdates = /* @__PURE__ */ new Map();
+	fetchDepth = /* @__PURE__ */ new Map();
+	logger;
 	/**
-	* Called after a query's initial sync completes.
-	* Ensures subscribers are notified even if no stream updates fired (e.g. empty result set).
+	* Optional observer notified whenever a query's fetch status changes.
+	* Wired by Sp00kyClient to push status changes into DevTools. Kept as a
+	* settable field (rather than a constructor arg) because DevTools is
+	* constructed after DataModule.
 	*/
-	async notifyQuerySynced(queryHash) {
-		const queryState = this.activeQueries.get(queryHash);
-		if (!queryState) return;
-		const newRecords = await this.materializeRecords(queryState);
-		const changed = JSON.stringify(queryState.records) !== JSON.stringify(newRecords);
-		queryState.records = newRecords;
-		if (changed || queryState.updateCount === 0) {
-			queryState.updateCount++;
-			const subscribers = this.subscriptions.get(queryHash);
-			if (subscribers) for (const callback of subscribers) callback(queryState.records);
-		}
+	onQueryStatusChange;
+	/**
+	* Optional observer invoked when a still-subscribed query's TTL heartbeat
+	* fires (~90% of the TTL). Wired by Sp00kyClient to
+	* `Sp00kySync.heartbeatQuery`, which refreshes the remote `_00_query`
+	* row's `lastActiveAt` so an actively-watched query never expires. Settable
+	* field (not a constructor arg) because the sync engine is wired after
+	* DataModule is constructed — mirrors `onQueryStatusChange`.
+	*/
+	onHeartbeat;
+	/**
+	* Optional hook fired by {@link deregisterQuery} when an opt-in query (e.g. a
+	* viewport-windowed list cancelling an off-screen window) loses its last
+	* subscriber. Wired by Sp00kyClient to enqueue a `cleanup` down-event, which
+	* tears the remote `_00_query` view down (releasing its `_00_list_ref` edges)
+	* instead of leaving it for the TTL sweep. The local view + state are freed in
+	* {@link finalizeDeregister} only after that remote delete, so a fast
+	* re-subscribe (scroll back) can abort/heal the teardown — see `cleanupQuery`.
+	*/
+	onDeregister;
+	sessionId = "";
+	currentUserId = null;
+	constructor(cache, local, schema, logger, streamDebounceTime = 50) {
+		this.cache = cache;
+		this.local = local;
+		this.schema = schema;
+		this.streamDebounceTime = streamDebounceTime;
+		this.logger = logger.child({ service: "DataModule" });
 	}
-	async run(backend, path, data, options) {
-		const route = this.schema.backends?.[backend]?.routes?.[path];
-		if (!route) throw new Error(`Route ${backend}.${path} not found`);
-		const tableName = this.schema.backends?.[backend]?.outboxTable;
-		if (!tableName) throw new Error(`Outbox table for backend ${backend} not found`);
-		const payload = {};
-		for (const argName of Object.keys(route.args)) {
-			const arg = route.args[argName];
-			if (data[argName] === void 0 && arg.optional === false) throw new Error(`Missing required argument ${argName}`);
-			payload[argName] = data[argName];
-		}
-		const record = {
-			path,
-			payload: JSON.stringify(payload),
-			max_retries: options?.max_retries ?? 3,
-			retry_strategy: options?.retry_strategy ?? "linear"
-		};
-		if (options?.timeout != null) record.timeout = options.timeout;
-		if (options?.delay != null) record.delay = options.delay;
-		if (options?.assignedTo) record.assigned_to = options.assignedTo;
-		const recordId = `${tableName}:${generateId()}`;
-		await this.create(recordId, record);
+	async init(sessionId) {
+		this.sessionId = sessionId;
+		this.logger.info({
+			sessionId,
+			Category: "sp00ky-client::DataModule::init"
+		}, "DataModule initialized");
 	}
 	/**
-	* Create a new record
+	* Update the session salt used in query-id hashing. Call this when the
+	* SurrealDB session changes (sign-in, sign-out, reconnect). Subsequently
+	* registered queries will get fresh, session-scoped IDs.
 	*/
-	async create(id, data) {
-		const tableName = extractTablePart(id);
-		const tableSchema = this.schema.tables.find((t) => t.name === tableName);
-		if (!tableSchema) throw new Error(`Table ${tableName} not found`);
-		const rid = parseRecordIdString(id);
-		const params = parseParams(tableSchema.columns, data);
-		const mutationId = parseRecordIdString(`_00_pending_mutations:${Date.now()}`);
-		const dataKeys = Object.keys(params).map((key) => ({
-			key,
-			variable: `data_${key}`
-		}));
-		const prefixedParams = Object.fromEntries(dataKeys.map(({ key, variable }) => [variable, params[key]]));
-		const query = surql.seal(surql.tx([surql.createSet("id", dataKeys), surql.createMutation("create", "mid", "id", "data")]), { resultIndex: 0 });
-		const target = await withRetry(this.logger, () => this.local.execute(query, {
-			id: rid,
-			mid: mutationId,
-			...prefixedParams
-		}));
-		const parsedRecord = parseParams(tableSchema.columns, target);
-		await this.cache.save({
-			table: tableName,
-			op: "CREATE",
-			record: parsedRecord,
-			version: 1
-		}, true);
-		const mutationEvent = {
-			type: "create",
-			mutation_id: mutationId,
-			record_id: rid,
-			data: params,
-			record: target,
-			tableName
-		};
-		for (const callback of this.mutationCallbacks) callback([mutationEvent]);
-		this.logger.debug({
-			id,
-			Category: "sp00ky-client::DataModule::create"
-		}, "Record created");
-		return target;
+	setSessionId(sessionId) {
+		this.sessionId = sessionId;
 	}
 	/**
-	* Update an existing record
+	* Update the authenticated user record id. Pass `null` on sign-out.
+	* Read by `Sp00kySync.listRefTable()` so the LIVE subscription and
+	* the poll route to the same per-user `_00_list_ref_user_<id>` the
+	* SSP writes to.
 	*/
-	async update(table, id, data, options) {
-		const tableName = extractTablePart(id);
-		const tableSchema = this.schema.tables.find((t) => t.name === tableName);
-		if (!tableSchema) throw new Error(`Table ${tableName} not found`);
-		const rid = parseRecordIdString(id);
-		const params = parseParams(tableSchema.columns, data);
-		const mutationId = parseRecordIdString(`_00_pending_mutations:${Date.now()}`);
-		const [beforeRecord] = await withRetry(this.logger, () => this.local.query("SELECT * FROM ONLY $id", { id: rid }));
-		const query = surql.seal(surql.tx([
-			surql.updateSet("id", [{ statement: "_00_rv += 1" }]),
-			surql.let("updated", surql.updateMerge("id", "data")),
-			surql.createMutation("update", "mid", "id", "data"),
-			surql.returnObject([{
-				key: "target",
-				variable: "updated"
-			}])
-		]));
-		const { target } = await withRetry(this.logger, () => this.local.execute(query, {
-			id: rid,
-			mid: mutationId,
-			data: params
-		}));
-		const updatedFields = { id: target.id };
-		for (const key of Object.keys(data)) if (key in target) updatedFields[key] = target[key];
-		if ("_00_rv" in target) updatedFields._00_rv = target._00_rv;
-		this.replaceRecordInQueries(updatedFields);
-		const parsedRecord = parseParams(tableSchema.columns, target);
-		await this.cache.save({
-			table,
-			op: "UPDATE",
-			record: parsedRecord,
-			version: target._00_rv
-		}, true);
-		const pushEventOptions = parseUpdateOptions(id, data, options);
-		const mutationEvent = {
-			type: "update",
-			mutation_id: mutationId,
-			record_id: rid,
-			data: params,
-			record: target,
-			beforeRecord: beforeRecord || void 0,
-			options: pushEventOptions
-		};
-		for (const callback of this.mutationCallbacks) callback([mutationEvent]);
-		this.logger.debug({
-			id,
-			Category: "sp00ky-client::DataModule::update"
-		}, "Record updated");
-		return target;
+	setCurrentUserId(userId) {
+		this.currentUserId = userId;
+	}
+	/** Read-only view of the authenticated user id used for per-user
+	* `_00_list_ref` routing. Other modules consult this so they pick the
+	* same table name DataModule does. */
+	getCurrentUserId() {
+		return this.currentUserId;
 	}
 	/**
-	* Delete a record
+	* Register a query and return its hash for subscriptions
 	*/
-	async delete(table, id) {
-		const tableName = extractTablePart(id);
-		if (!this.schema.tables.find((t) => t.name === tableName)) throw new Error(`Table ${tableName} not found`);
-		const rid = parseRecordIdString(id);
-		const mutationId = parseRecordIdString(`_00_pending_mutations:${Date.now()}`);
-		const [beforeRecords] = await this.local.query("SELECT * FROM ONLY $id", { id: rid });
-		const beforeRecord = beforeRecords ?? {};
-		const query = surql.seal(surql.tx([surql.delete("id"), surql.createMutation("delete", "mid", "id")]));
-		await withRetry(this.logger, () => this.local.execute(query, {
-			id: rid,
-			mid: mutationId
-		}));
-		try {
-			await this.cache.delete(table, id, true, beforeRecord);
-		} catch (err) {
-			this.logger.error({
-				err,
-				id,
-				Category: "sp00ky-client::DataModule::delete"
-			}, "SSP delete-ingest failed; relying on query re-materialize to reflect the delete");
+	async query(tableName, surqlString, params, ttl) {
+		const hash = await this.calculateHash({
+			surql: surqlString,
+			params
+		});
+		this.logger.debug({
+			hash,
+			Category: "sp00ky-client::DataModule::query"
+		}, "Query Initialization: started");
+		const recordId = new RecordId("_00_query", hash);
+		if (this.activeQueries.has(hash)) {
+			this.logger.debug({
+				hash,
+				Category: "sp00ky-client::DataModule::query"
+			}, "Query Initialization: exists, returning");
+			return hash;
 		}
-		for (const [queryHash, queryState] of this.activeQueries) if (queryState.config.tableName === tableName) try {
-			await this.notifyQuerySynced(queryHash);
-		} catch (err) {
-			this.logger.error({
-				err,
-				queryHash,
-				Category: "sp00ky-client::DataModule::delete"
-			}, "notifyQuerySynced failed after delete");
+		if (this.pendingQueries.has(hash)) {
+			this.logger.debug({
+				hash,
+				Category: "sp00ky-client::DataModule::query"
+			}, "Query Initialization: pending, waiting for existing creation");
+			await this.pendingQueries.get(hash);
+			return hash;
 		}
-		const mutationEvent = {
-			type: "delete",
-			mutation_id: mutationId,
-			record_id: rid
-		};
-		for (const callback of this.mutationCallbacks) callback([mutationEvent]);
 		this.logger.debug({
-			id,
-			Category: "sp00ky-client::DataModule::delete"
-		}, "Record deleted");
+			hash,
+			Category: "sp00ky-client::DataModule::query"
+		}, "Query Initialization: not found, creating new query");
+		const promise = this.createAndRegisterQuery(hash, recordId, surqlString, params, ttl, tableName);
+		this.pendingQueries.set(hash, promise);
+		try {
+			await promise;
+		} finally {
+			this.pendingQueries.delete(hash);
+		}
+		return hash;
 	}
 	/**
-	* Rollback a failed optimistic create by deleting the record locally
+	* Subscribe to query updates
 	*/
-	async rollbackCreate(recordId, tableName) {
-		const id = encodeRecordId(recordId);
-		try {
-			await withRetry(this.logger, () => this.local.query("DELETE $id", { id: recordId }));
-			await this.cache.delete(tableName, id, true);
-			this.removeRecordFromQueries(recordId);
-			this.logger.info({
-				id,
-				tableName,
-				Category: "sp00ky-client::DataModule::rollbackCreate"
-			}, "Rolled back optimistic create");
-		} catch (err) {
-			this.logger.error({
-				err,
-				id,
-				tableName,
-				Category: "sp00ky-client::DataModule::rollbackCreate"
-			}, "Failed to rollback create");
+	subscribe(queryHash, callback, options = {}) {
+		if (!this.subscriptions.has(queryHash)) this.subscriptions.set(queryHash, /* @__PURE__ */ new Set());
+		this.subscriptions.get(queryHash)?.add(callback);
+		if (options.immediate) {
+			const query = this.activeQueries.get(queryHash);
+			if (query) callback(query.records);
 		}
+		return () => {
+			const subs = this.subscriptions.get(queryHash);
+			if (subs) {
+				subs.delete(callback);
+				if (subs.size === 0) this.subscriptions.delete(queryHash);
+			}
+		};
 	}
 	/**
-	* Rollback a failed optimistic update by restoring the previous record state
+	* Subscribe to a query's fetch-status changes (idle/fetching).
+	* With `{ immediate: true }` the callback fires synchronously with the
+	* current status (defaults to `idle` if the query isn't registered yet).
 	*/
-	async rollbackUpdate(recordId, tableName, beforeRecord) {
-		const id = encodeRecordId(recordId);
-		try {
-			const { id: _recordId, ...content } = beforeRecord;
-			await withRetry(this.logger, () => this.local.query(surql.seal(surql.upsert("id", "content")), {
-				id: recordId,
-				content
-			}));
-			const tableSchema = this.schema.tables.find((t) => t.name === tableName);
-			const parsedRecord = tableSchema ? parseParams(tableSchema.columns, beforeRecord) : beforeRecord;
-			await this.cache.save({
-				table: tableName,
-				op: "UPDATE",
-				record: parsedRecord,
-				version: beforeRecord._00_rv || 1
-			}, true);
-			await this.replaceRecordInQueries(beforeRecord);
-			this.logger.info({
-				id,
-				tableName,
-				Category: "sp00ky-client::DataModule::rollbackUpdate"
-			}, "Rolled back optimistic update");
-		} catch (err) {
-			this.logger.error({
-				err,
-				id,
-				tableName,
-				Category: "sp00ky-client::DataModule::rollbackUpdate"
-			}, "Failed to rollback update");
+	subscribeStatus(queryHash, callback, options = {}) {
+		if (!this.statusSubscriptions.has(queryHash)) this.statusSubscriptions.set(queryHash, /* @__PURE__ */ new Set());
+		this.statusSubscriptions.get(queryHash)?.add(callback);
+		if (options.immediate) callback(this.activeQueries.get(queryHash)?.status ?? "idle");
+		return () => {
+			const subs = this.statusSubscriptions.get(queryHash);
+			if (subs) {
+				subs.delete(callback);
+				if (subs.size === 0) this.statusSubscriptions.delete(queryHash);
+			}
+		};
+	}
+	/**
+	* Set a query's fetch status and notify status observers (DevTools +
+	* `subscribeStatus` listeners). No-op when the status is unchanged or the
+	* query is unknown.
+	*/
+	setQueryStatus(queryHash, status) {
+		const queryState = this.activeQueries.get(queryHash);
+		if (!queryState || queryState.status === status) return;
+		queryState.status = status;
+		this.onQueryStatusChange?.(queryHash, status);
+		const subs = this.statusSubscriptions.get(queryHash);
+		if (subs) for (const callback of subs) callback(status);
+	}
+	/**
+	* Enter a fetch cycle for a query. Refcounted: registration and concurrent
+	* poll/LIVE sync rounds can overlap on the same hash, and only the OUTERMOST
+	* cycle may flip the status — 0→1 emits `fetching`, and `endFetching`'s 1→0
+	* emits `idle`. Always pair with `endFetching` in a `finally`.
+	*/
+	beginFetching(queryHash) {
+		const depth = this.fetchDepth.get(queryHash) ?? 0;
+		this.fetchDepth.set(queryHash, depth + 1);
+		if (depth === 0) this.setQueryStatus(queryHash, "fetching");
+	}
+	/** Leave a fetch cycle started with {@link beginFetching}; emits `idle` on the last exit. */
+	endFetching(queryHash) {
+		const depth = this.fetchDepth.get(queryHash) ?? 0;
+		if (depth <= 1) {
+			this.fetchDepth.delete(queryHash);
+			this.setQueryStatus(queryHash, "idle");
+			return;
 		}
+		this.fetchDepth.set(queryHash, depth - 1);
 	}
 	/**
-	* Remove a record from all active query states and notify subscribers
+	* Subscribe to mutations (for sync)
 	*/
-	removeRecordFromQueries(recordId) {
-		const encodedId = encodeRecordId(recordId);
-		for (const [queryHash, queryState] of this.activeQueries.entries()) {
-			const index = queryState.records.findIndex((r) => {
-				return (r.id instanceof RecordId ? encodeRecordId(r.id) : String(r.id)) === encodedId;
-			});
-			if (index !== -1) {
-				queryState.records.splice(index, 1);
-				const subscribers = this.subscriptions.get(queryHash);
-				if (subscribers) for (const callback of subscribers) callback(queryState.records);
+	onMutation(callback) {
+		this.mutationCallbacks.add(callback);
+		return () => {
+			this.mutationCallbacks.delete(callback);
+		};
+	}
+	/**
+	* Handle stream updates from DBSP (via CacheModule)
+	*/
+	async onStreamUpdate(update) {
+		const { queryHash, op } = update;
+		if (op === "DELETE") {
+			const existing = this.debounceTimers.get(queryHash);
+			if (existing) {
+				clearTimeout(existing);
+				this.debounceTimers.delete(queryHash);
 			}
+			this.pendingStreamUpdates.delete(queryHash);
+			await this.processStreamUpdate(update);
+			return;
 		}
+		if (this.debounceTimers.has(queryHash)) clearTimeout(this.debounceTimers.get(queryHash));
+		this.pendingStreamUpdates.set(queryHash, update);
+		const timer = setTimeout(async () => {
+			this.debounceTimers.delete(queryHash);
+			this.pendingStreamUpdates.delete(queryHash);
+			await this.processStreamUpdate(update);
+		}, this.streamDebounceTime);
+		this.debounceTimers.set(queryHash, timer);
 	}
-	async createAndRegisterQuery(hash, recordId, surqlString, params, ttl, tableName) {
-		const queryState = await this.createNewQuery({
-			recordId,
-			surql: surqlString,
-			params,
-			ttl,
-			tableName
-		});
+	/**
+	* Process a query's pending (debounced) stream update NOW instead of on the
+	* trailing edge. Called by the sync engine before it flips a query back to
+	* `idle`, so the status change never races ahead of the rows it fetched.
+	* No-op when nothing is pending. The pending entry is removed before the
+	* await so a concurrently-firing timer can't process it twice.
+	*/
+	async flushPendingStreamUpdate(queryHash) {
+		const timer = this.debounceTimers.get(queryHash);
+		if (timer) {
+			clearTimeout(timer);
+			this.debounceTimers.delete(queryHash);
+		}
+		const pending = this.pendingStreamUpdates.get(queryHash);
+		if (!pending) return;
+		this.pendingStreamUpdates.delete(queryHash);
+		await this.processStreamUpdate(pending);
+	}
+	async materializeRecords(queryState, sspArray) {
 		const t0 = performance.now();
-		const { localArray, registrationTimings } = this.cache.registerQuery({
-			queryHash: hash,
-			surql: surqlString,
-			params,
-			ttl: new Duration(ttl),
-			lastActiveAt: /* @__PURE__ */ new Date()
-		});
-		const registrationTime = performance.now() - t0;
-		queryState.registrationTimings = {
-			parseMs: registrationTimings?.parseMs ?? null,
-			planMs: registrationTimings?.planMs ?? null,
-			snapshotMs: registrationTimings?.snapshotMs ?? null,
-			wallMs: registrationTime
-		};
-		await withRetry(this.logger, () => this.local.query(surql.seal(surql.updateSet("id", [
-			"localArray",
-			"registrationTime",
-			"rowCount"
-		])), {
-			id: recordId,
-			localArray,
-			registrationTime,
-			rowCount: localArray.length
-		}));
-		const windowMat = buildWindowMaterialization(surqlString);
-		if (windowMat && localArray.length > 0) try {
-			const winIds = localArray.map(([id]) => parseRecordIdString(id));
-			const [seeded] = await this.local.query(windowMat.query, {
-				...params,
+		const windowMat = buildWindowMaterialization(queryState.config.surql);
+		let records;
+		if (windowMat) {
+			const winIds = (queryState.config.remoteArray?.length && queryState.config.remoteArray || sspArray?.length && sspArray || queryState.config.localArray || []).map(([id]) => parseRecordIdString(id));
+			const [rows] = await this.local.query(windowMat.query, {
+				...queryState.config.params,
 				__win: winIds
 			});
-			queryState.records = seeded || [];
-		} catch (err) {
-			this.logger.warn({
-				err,
-				hash,
-				Category: "sp00ky-client::DataModule::createAndRegisterQuery"
-			}, "Failed to seed windowed initial records from localArray");
+			records = rows || [];
+		} else {
+			const [rows] = await this.local.query(queryState.config.surql, queryState.config.params);
+			records = rows || [];
 		}
-		this.activeQueries.set(hash, queryState);
-		this.startTTLHeartbeat(queryState, hash);
-		this.logger.debug({
-			hash,
-			tableName,
-			recordCount: queryState.records.length,
-			Category: "sp00ky-client::DataModule::query"
-		}, "Query registered");
-		return hash;
+		this.recordPhase(queryState, "localFetch", performance.now() - t0);
+		return records;
 	}
-	async createNewQuery({ recordId, surql: surqlString, params, ttl, tableName }) {
-		const tableSchema = this.schema.tables.find((t) => t.name === tableName);
-		if (!tableSchema) throw new Error(`Table ${tableName} not found`);
-		let [configRecord] = await withRetry(this.logger, () => this.local.query("SELECT * FROM ONLY $id", { id: recordId }));
-		if (!configRecord) {
-			const [createdRecord] = await withRetry(this.logger, () => this.local.query(surql.seal(surql.create("id", "data")), {
-				id: recordId,
-				data: {
-					surql: surqlString,
-					params,
-					localArray: [],
-					remoteArray: [],
-					lastActiveAt: /* @__PURE__ */ new Date(),
-					createdAt: /* @__PURE__ */ new Date(),
-					ttl,
-					tableName,
-					updateCount: 0,
-					rowCount: 0,
-					errorCount: 0
-				}
-			}));
-			configRecord = createdRecord;
-		}
-		const config = {
-			...configRecord,
-			id: recordId,
-			params: parseParams(tableSchema.columns, configRecord.params)
-		};
-		let records = [];
-		if (buildWindowMaterialization(surqlString) === null) try {
-			const [result] = await this.local.query(surqlString, params);
-			records = result || [];
-		} catch (err) {
+	async processStreamUpdate(update) {
+		const { queryHash, localArray, materializationTimeMs } = update;
+		const queryState = this.activeQueries.get(queryHash);
+		if (!queryState) {
 			this.logger.warn({
-				err,
-				Category: "sp00ky-client::DataModule::createNewQuery"
-			}, "Failed to load initial cached records");
+				queryHash,
+				Category: "sp00ky-client::DataModule::onStreamUpdate"
+			}, "Received update for unknown query. Skipping...");
+			return;
 		}
-		const persistedUpdateCount = typeof configRecord?.updateCount === "number" ? configRecord.updateCount : 0;
-		const persistedErrorCount = typeof configRecord?.errorCount === "number" ? configRecord.errorCount : 0;
-		return {
-			config,
-			records,
-			ttlTimer: null,
-			ttlDurationMs: parseDuration(ttl),
-			updateCount: persistedUpdateCount,
-			materializationSamples: [],
-			lastIngestLatencyMs: null,
-			errorCount: persistedErrorCount,
-			status: "idle",
-			phaseSamples: {},
-			phaseLast: {},
-			registrationTimings: {
-				parseMs: null,
-				planMs: null,
-				snapshotMs: null,
-				wallMs: null
+		if (typeof materializationTimeMs === "number") {
+			queryState.materializationSamples.push(materializationTimeMs);
+			if (queryState.materializationSamples.length > MATERIALIZATION_SAMPLE_WINDOW) queryState.materializationSamples.shift();
+			queryState.lastIngestLatencyMs = materializationTimeMs;
+		}
+		if (typeof update.storeApplyMs === "number") this.recordPhase(queryState, "sspStoreApply", update.storeApplyMs);
+		if (typeof update.circuitStepMs === "number") this.recordPhase(queryState, "sspCircuitStep", update.circuitStepMs);
+		if (typeof update.transformMs === "number") this.recordPhase(queryState, "sspTransform", update.transformMs);
+		const percentiles = this.computeMaterializationPercentiles(queryState.materializationSamples);
+		const epoch = this.local.epoch;
+		try {
+			const newRecords = await this.materializeRecords(queryState, localArray);
+			if (epoch !== this.local.epoch) return;
+			queryState.config.localArray = localArray;
+			const prevJson = JSON.stringify(queryState.records);
+			const newJson = JSON.stringify(newRecords);
+			queryState.records = newRecords;
+			const recordsChanged = prevJson !== newJson;
+			if (recordsChanged) {
+				queryState.updateCount++;
+				queryState.lastUpdatedAt = Date.now();
 			}
-		};
-	}
-	async calculateHash(data) {
-		const content = JSON.stringify({
-			...data,
-			sessionId: this.sessionId
-		});
-		const msgBuffer = new TextEncoder().encode(content);
-		const hashBuffer = await crypto.subtle.digest("SHA-256", msgBuffer);
-		return Array.from(new Uint8Array(hashBuffer)).map((b) => b.toString(16).padStart(2, "0")).join("");
-	}
-	startTTLHeartbeat(queryState, hash) {
-		if (queryState.ttlTimer) return;
-		const heartbeatTime = Math.floor(queryState.ttlDurationMs * .9);
-		queryState.ttlTimer = setTimeout(() => {
-			queryState.ttlTimer = null;
-			if ((this.subscriptions.get(hash)?.size ?? 0) === 0) {
+			await this.local.query(surql.seal(surql.updateSet("id", [
+				"localArray",
+				"rowCount",
+				"updateCount",
+				"lastIngestLatency",
+				"materializationP55",
+				"materializationP90",
+				"materializationP99"
+			])), {
+				id: queryState.config.id,
+				localArray,
+				rowCount: localArray.length,
+				updateCount: queryState.updateCount,
+				lastIngestLatency: queryState.lastIngestLatencyMs,
+				materializationP55: percentiles.p55,
+				materializationP90: percentiles.p90,
+				materializationP99: percentiles.p99
+			}, { epoch });
+			if (!recordsChanged) {
 				this.logger.debug({
-					hash,
-					Category: "sp00ky-client::DataModule::startTTLHeartbeat"
-				}, "TTL heartbeat: no subscribers, stopping");
+					queryHash,
+					Category: "sp00ky-client::DataModule::onStreamUpdate"
+				}, "Query records unchanged, skipping notification");
 				return;
 			}
-			this.onHeartbeat?.(hash);
+			const subscribers = this.subscriptions.get(queryHash);
+			if (subscribers) for (const callback of subscribers) callback(queryState.records);
 			this.logger.debug({
-				hash,
-				id: encodeRecordId(queryState.config.id),
-				Category: "sp00ky-client::DataModule::startTTLHeartbeat"
-			}, "TTL heartbeat sent");
-			this.startTTLHeartbeat(queryState, hash);
-		}, heartbeatTime);
-	}
-	async replaceRecordInQueries(record) {
-		for (const [queryHash, queryState] of this.activeQueries.entries()) {
-			const index = queryState.records.findIndex((r) => r.id === record.id);
-			if (index !== -1) {
-				queryState.records[index] = {
-					...queryState.records[index],
-					...record
-				};
-				const subscribers = this.subscriptions.get(queryHash);
-				if (subscribers) for (const callback of subscribers) callback(queryState.records);
+				queryHash,
+				recordCount: newRecords?.length,
+				Category: "sp00ky-client::DataModule::onStreamUpdate"
+			}, "Query updated from stream");
+		} catch (err) {
+			if (err instanceof StaleEpochError) {
+				this.logger.debug({
+					queryHash,
+					Category: "sp00ky-client::DataModule::onStreamUpdate"
+				}, "Dropped stream update from before a bucket switch");
+				return;
+			}
+			queryState.errorCount++;
+			this.logger.error({
+				err,
+				queryHash,
+				Category: "sp00ky-client::DataModule::onStreamUpdate"
+			}, "Failed to fetch records for stream update");
+			try {
+				await this.local.query(surql.seal(surql.updateSet("id", ["errorCount"])), {
+					id: queryState.config.id,
+					errorCount: queryState.errorCount
+				});
+			} catch (persistErr) {
+				this.logger.warn({
+					err: persistErr,
+					queryHash,
+					Category: "sp00ky-client::DataModule::onStreamUpdate"
+				}, "Failed to persist incremented errorCount");
 			}
 		}
 	}
-};
-/**
-* Parse update options to generate push event options
-*/
-function parseUpdateOptions(id, data, options) {
-	let pushEventOptions = {};
-	if (options?.debounced) pushEventOptions = { debounced: {
-		delay: options.debounced !== true ? options.debounced?.delay ?? 200 : 200,
-		key: (options.debounced !== true ? options.debounced?.key ?? id : id) === "recordId_x_fields" ? `${id}::${Object.keys(data).toSorted().join("#")}` : id
-	} };
-	return pushEventOptions;
-}
-
-//#endregion
-//#region src/services/database/database.ts
-var AbstractDatabaseService = class {
-	client;
-	logger;
-	events;
-	constructor(client, logger, events) {
-		this.client = client;
-		this.logger = logger.child({ service: "Database" });
-		this.events = events;
-	}
-	getClient() {
-		return this.client;
-	}
-	getEvents() {
-		return this.events;
-	}
-	tx() {
-		return this.client.beginTransaction();
-	}
-	queryQueue = Promise.resolve();
 	/**
-	* Execute a query with serialized execution to prevent WASM transaction issues.
+	* Compute p55/p90/p99 from a rolling window of materialization samples.
+	* Returns nulls for any percentile that has no samples yet so SurrealDB
+	* `option<float>` columns stay NONE rather than 0 before the first ingest.
 	*/
-	async query(query, vars) {
-		return new Promise((resolve, reject) => {
-			this.queryQueue = this.queryQueue.then(async () => {
-				const startTime = performance.now();
-				try {
-					this.logger.debug({
-						query,
-						vars,
-						Category: "sp00ky-client::Database::query"
-					}, "Executing query");
-					const result = await this.client.query(query, vars);
-					const duration = performance.now() - startTime;
-					this.events.emit(this.eventType, {
-						query,
-						vars,
-						duration,
-						success: true,
-						timestamp: Date.now()
-					});
-					resolve(result);
-					this.logger.trace({
-						query,
-						result,
-						Category: "sp00ky-client::Database::query"
-					}, "Query executed successfully");
-				} catch (err) {
-					const duration = performance.now() - startTime;
-					this.events.emit(this.eventType, {
-						query,
-						vars,
-						duration,
-						success: false,
-						error: err instanceof Error ? err.message : String(err),
-						timestamp: Date.now()
-					});
-					this.logger.error({
-						query,
-						vars,
-						err,
-						Category: "sp00ky-client::Database::query"
-					}, "Query execution failed");
-					reject(err);
-				}
-			}).catch(() => {});
-		});
-	}
-	async execute(query, vars) {
-		const raw = await this.query(query.sql, vars);
-		return query.extract(raw);
-	}
-	async close() {
-		this.logger.info({ Category: "sp00ky-client::Database::close" }, "Closing database connection");
-		await this.client.close();
+	computeMaterializationPercentiles(samples) {
+		if (samples.length === 0) return {
+			p55: null,
+			p90: null,
+			p99: null
+		};
+		const sorted = [...samples].sort((a, b) => a - b);
+		const pick = (q) => {
+			return sorted[Math.min(sorted.length - 1, Math.floor(q * sorted.length))];
+		};
+		return {
+			p55: pick(.55),
+			p90: pick(.9),
+			p99: pick(.99)
+		};
 	}
-};
-
-//#endregion
-//#region src/events/index.ts
-/**
-* A type-safe event system that handles subscription, emission (including debouncing), and buffering of events.
-* @template E The EventTypeMap defining all supported events.
-*/
-var EventSystem = class {
-	subscriberId = 0;
-	isProcessing = false;
-	buffer;
-	subscribers;
-	subscribersTypeMap;
-	lastEvents;
-	debouncedEvents;
-	constructor(_eventTypes) {
-		this._eventTypes = _eventTypes;
-		this.buffer = [];
-		this.subscribers = this._eventTypes.reduce((acc, key) => {
-			return Object.assign(acc, { [key]: /* @__PURE__ */ new Map() });
-		}, {});
-		this.lastEvents = {};
-		this.subscribersTypeMap = /* @__PURE__ */ new Map();
-		this.debouncedEvents = /* @__PURE__ */ new Map();
+	/** Record a per-phase timing sample (ms) on a query's rolling window. */
+	recordPhase(qs, phase, ms) {
+		if (!Number.isFinite(ms)) return;
+		pushSample(qs.phaseSamples[phase] ?? (qs.phaseSamples[phase] = []), ms);
+		qs.phaseLast[phase] = ms;
 	}
-	get eventTypes() {
-		return this._eventTypes;
+	/** Record the remote record-fetch time (ms) for a query. Called by the sync engine. */
+	recordRemoteFetch(hash, ms) {
+		const qs = this.activeQueries.get(hash);
+		if (qs) this.recordPhase(qs, "remoteFetch", ms);
 	}
 	/**
-	* Subscribes a handler to a specific event type.
-	* @param type The event type to subscribe to.
-	* @param handler The function to call when the event occurs.
-	* @param options Subscription options (once, immediately).
-	* @returns A subscription ID that can be used to unsubscribe.
+	* Record the frontend reconcile time (ms) for a query. Called from `useQuery`
+	* via `Sp00kyClient.reportFrontendTiming` after it applies an update to its store.
 	*/
-	subscribe(type, handler, options) {
-		const id = this.subscriberId++;
-		this.subscribers[type].set(id, {
-			id,
-			handler,
-			once: options?.once ?? false
-		});
-		this.subscribersTypeMap.set(id, type);
-		if (options?.immediately) {
-			const lastEvent = this.lastEvents[type];
-			if (lastEvent) handler(lastEvent);
-		}
-		return id;
+	recordFrontendTiming(hash, ms) {
+		const qs = this.activeQueries.get(hash);
+		if (qs) this.recordPhase(qs, "frontend", ms);
 	}
 	/**
-	* Subscribes a handler to multiple event types.
-	* @param types An array of event types to subscribe to.
-	* @param handler The function to call when any of the events occur.
-	* @param options Subscription options.
-	* @returns An array of subscription IDs.
+	* Build the per-query processing-time breakdown surfaced to the DevTools panel
+	* and the MCP. `ssp` is the WASM-ingest wall time (from `materializationSamples`);
+	* the rest come from the per-phase rolling windows + one-shot registration timings.
 	*/
-	subscribeMany(types, handler, options) {
-		return types.map((type) => this.subscribe(type, handler, options));
+	phaseTimings(q) {
+		const stat = (phase) => phaseStatOf(q.phaseSamples[phase] ?? [], q.phaseLast[phase] ?? null);
+		return {
+			ssp: phaseStatOf(q.materializationSamples, q.lastIngestLatencyMs),
+			sspStoreApply: stat("sspStoreApply"),
+			sspCircuitStep: stat("sspCircuitStep"),
+			sspTransform: stat("sspTransform"),
+			localFetch: stat("localFetch"),
+			remoteFetch: stat("remoteFetch"),
+			frontend: stat("frontend"),
+			registration: q.registrationTimings,
+			updateCount: q.updateCount,
+			errorCount: q.errorCount
+		};
 	}
 	/**
-	* Unsubscribes a specific subscription by ID.
-	* @param id The subscription ID returned by subscribe().
-	* @returns True if the subscription was found and removed, false otherwise.
+	* Get query state (for sync and devtools)
 	*/
-	unsubscribe(id) {
-		const type = this.subscribersTypeMap.get(id);
-		if (type) {
-			this.subscribers[type].delete(id);
-			this.subscribersTypeMap.delete(id);
-			return true;
-		}
-		return false;
+	getQueryByHash(hash) {
+		return this.activeQueries.get(hash);
 	}
 	/**
-	* Emits an event with the given type and payload.
-	* @param type The type of event to emit.
-	* @param payload The data associated with the event.
+	* Cold-query guard for instant-hydrate: true when the query exists, hasn't been
+	* hydrated, and has NOT yet fetched its server result (`remoteArray` empty).
+	* We gate on `remoteArray`, not local `records`: a windowed query is often
+	* partially pre-seeded from the circuit (e.g. the dashboard's 5-row preview),
+	* but it still hasn't loaded its own full window from the server — so it should
+	* still hydrate. A warm re-subscribe (remoteArray already populated) is skipped.
 	*/
-	emit(type, payload) {
-		const event = {
-			type,
-			payload
-		};
-		this.addEvent(event);
+	isCold(hash) {
+		const qs = this.activeQueries.get(hash);
+		return !!qs && !qs.hydrated && (qs.config.remoteArray?.length ?? 0) === 0;
 	}
 	/**
-	* Adds a fully constructed event object to the system.
-	* Similar to emit, but takes the full event object directly.
-	* Supports debouncing if options are provided.
-	* @param event The event object.
-	* @param options Options for the event push (e.g., debouncing).
+	* Walk a hydrated record's fields and append any EMBEDDED child records to
+	* `batch` (recursing for nested related fields). An embedded child is a
+	* value that is itself a record — a non-null object whose `id` is a
+	* `RecordId` — or an array of such records (one-to-many vs one-to-one). A
+	* bare `RecordId` (a foreign-key reference) or any other value is skipped,
+	* so this never mistakes a FK column for an embedded body. Children are
+	* keyed by their own `record.id.table`, versioned by `_00_rv`, and cleaned
+	* to their table's real columns (which strips the alias/related fields).
+	* `seen` dedupes within the batch.
 	*/
-	addEvent(event, options) {
-		if (options?.debounced) {
-			this.handleDebouncedEvent(event, options.debounced.key, options.debounced.delay);
-			return;
+	collectEmbeddedChildren(record, batch, seen) {
+		const isEmbeddedRecord = (v) => !!v && typeof v === "object" && !(v instanceof RecordId) && v.id instanceof RecordId;
+		for (const value of Object.values(record)) {
+			const children = Array.isArray(value) ? value.filter(isEmbeddedRecord) : isEmbeddedRecord(value) ? [value] : [];
+			for (const child of children) {
+				const key = encodeRecordId(child.id);
+				if (seen.has(key)) continue;
+				seen.add(key);
+				this.collectEmbeddedChildren(child, batch, seen);
+				const table = child.id.table.toString();
+				const tableSchema = this.schema.tables.find((t) => t.name === table);
+				batch.push({
+					table,
+					op: "CREATE",
+					record: tableSchema ? cleanRecord(tableSchema.columns, child) : child,
+					version: child._00_rv || 1
+				});
+			}
 		}
-		this.buffer.push(event);
-		this.scheduleProcessing();
 	}
-	handleDebouncedEvent(event, key, delay) {
-		if (this.debouncedEvents.has(key)) clearTimeout(this.debouncedEvents.get(key)?.timer);
-		const timer = setTimeout(() => {
-			this.debouncedEvents.delete(key);
-			this.buffer.push(event);
-			this.scheduleProcessing();
-		}, delay);
-		this.debouncedEvents.set(key, {
-			timer,
-			resolve: () => {}
-		});
+	/**
+	* Instant-hydrate: ingest rows fetched one-shot from the remote (the query's own
+	* surql run directly) so the query DISPLAYS immediately, while the full realtime
+	* registration proceeds in the background. Ingests with versions (`_00_rv`) so the
+	* later `syncRecords` dedup skips re-pulling unchanged bodies, and seeds
+	* `remoteArray` so windowed queries materialize the correct window (no sparse
+	* local-circuit issue). Runs at most once per query (the `hydrated` flag).
+	*/
+	async applyHydration(hash, rows) {
+		const queryState = this.activeQueries.get(hash);
+		if (!queryState) return;
+		queryState.hydrated = true;
+		if (rows.length === 0) return;
+		const tableName = queryState.config.tableName;
+		const batch = rows.map((record) => ({
+			table: tableName,
+			op: "CREATE",
+			record,
+			version: record._00_rv || 1
+		}));
+		const seen = new Set(rows.map((r) => encodeRecordId(r.id)));
+		for (const record of rows) this.collectEmbeddedChildren(record, batch, seen);
+		await this.cache.saveBatch(batch);
+		queryState.config.remoteArray = rows.map((r) => [encodeRecordId(r.id), r._00_rv || 1]);
+		queryState.records = await this.materializeRecords(queryState);
+		const subscribers = this.subscriptions.get(hash);
+		if (subscribers) for (const cb of subscribers) cb(queryState.records);
 	}
-	scheduleProcessing() {
-		if (!this.isProcessing) queueMicrotask(() => this.processEvents());
-	}
-	async processEvents() {
-		if (this.isProcessing) return;
-		this.isProcessing = true;
-		try {
-			while (this.dequeue());
-		} finally {
-			this.isProcessing = false;
-		}
-	}
-	dequeue() {
-		const event = this.buffer.shift();
-		if (!event) return false;
-		this.setLastEvent(event.type, event);
-		this.broadcastEvent(event.type, event);
-		return true;
+	/** True while ≥1 live subscriber is watching this query (refcount guard). */
+	hasSubscribers(hash) {
+		return (this.subscriptions.get(hash)?.size ?? 0) > 0;
 	}
-	setLastEvent(type, event) {
-		this.lastEvents[type] = event;
+	/**
+	* Opt-in eager teardown for a query whose LAST subscriber just left — used by
+	* viewport-windowed lists to cancel off-screen windows instead of leaving
+	* their remote views to expire on the TTL sweep. No-op while any subscriber
+	* remains (refcount). Only enqueues the remote cleanup here; the local WASM
+	* view + in-memory state are freed in {@link finalizeDeregister} after the
+	* remote delete completes, so a re-subscribe in between aborts/heals it.
+	*
+	* NOTE: most queries should NOT use this — the default keep-alive on
+	* unsubscribe avoids re-registration churn on navigation.
+	*/
+	deregisterQuery(hash) {
+		if (this.hasSubscribers(hash)) return;
+		if (!this.activeQueries.has(hash)) return;
+		this.onDeregister?.(hash);
 	}
-	broadcastEvent(type, event) {
-		const subscribers = this.subscribers[type].values();
-		for (const subscriber of subscribers) {
-			subscriber.handler(event);
-			if (subscriber.once) this.unsubscribe(subscriber.id);
+	/**
+	* Final local teardown after the remote `_00_query` row was deleted: free the
+	* WASM view, heartbeat timer, debounce timer, and in-memory state. Caller
+	* (`cleanupQuery`) guarantees no subscriber remains.
+	*/
+	finalizeDeregister(hash) {
+		const qs = this.activeQueries.get(hash);
+		if (qs?.ttlTimer) {
+			clearTimeout(qs.ttlTimer);
+			qs.ttlTimer = null;
+		}
+		const debounce = this.debounceTimers.get(hash);
+		if (debounce) {
+			clearTimeout(debounce);
+			this.debounceTimers.delete(hash);
 		}
+		this.pendingStreamUpdates.delete(hash);
+		this.fetchDepth.delete(hash);
+		this.cache.unregisterQuery(hash);
+		this.activeQueries.delete(hash);
+		this.subscriptions.delete(hash);
 	}
-};
-function createEventSystem(eventTypes) {
-	return new EventSystem(eventTypes);
-}
-
-//#endregion
-//#region src/services/database/events/index.ts
-const DatabaseEventTypes = {
-	LocalQuery: "DATABASE_LOCAL_QUERY",
-	RemoteQuery: "DATABASE_REMOTE_QUERY"
-};
-function createDatabaseEventSystem() {
-	return createEventSystem([DatabaseEventTypes.LocalQuery, DatabaseEventTypes.RemoteQuery]);
-}
-
-//#endregion
-//#region src/services/database/local.ts
-var LocalDatabaseService = class extends AbstractDatabaseService {
-	config;
-	eventType = DatabaseEventTypes.LocalQuery;
-	constructor(config, logger) {
-		const events = createDatabaseEventSystem();
-		super(new Surreal({
-			codecOptions: { valueDecodeVisitor(value) {
-				if (value instanceof RecordId) return encodeRecordId(value);
-				if (value instanceof DateTime) return value.toDate();
-				return value;
-			} },
-			engines: applyDiagnostics(createWasmWorkerEngines(), ({ key, type, phase, ...other }) => {
-				if (phase === "progress" || phase === "after") logger.trace({
-					...other,
-					key,
-					type,
-					phase,
-					service: "surrealdb:local",
-					Category: "sp00ky-client::LocalDatabaseService::diagnostics"
-				}, `Local SurrealDB diagnostics captured ${type}:${phase}`);
-			})
-		}), logger, events);
-		this.config = config;
+	/**
+	* Get query state by id (for sync and devtools)
+	*/
+	getQueryById(id) {
+		return this.activeQueries.get(extractIdPart(id));
 	}
-	getConfig() {
-		return this.config;
+	/**
+	* Get all active queries (for devtools)
+	*/
+	getActiveQueries() {
+		return Array.from(this.activeQueries.values());
 	}
-	async connect() {
-		const { namespace, database } = this.getConfig();
-		const store = this.getConfig().store ?? "memory";
-		const storeUrl = store === "memory" ? "mem://" : "indxdb://sp00ky";
-		this.logger.info({
-			namespace,
-			database,
-			storeUrl,
-			Category: "sp00ky-client::LocalDatabaseService::connect"
-		}, "Connecting to local database");
-		this.registerUnloadClose();
-		try {
-			await this.openStore(storeUrl, namespace, database);
-			this.logger.info({ Category: "sp00ky-client::LocalDatabaseService::connect" }, "Connected to local database");
+	getActiveQueryHashes() {
+		return Array.from(this.activeQueries.keys());
+	}
+	async updateQueryLocalArray(id, localArray) {
+		const queryState = this.activeQueries.get(id);
+		if (!queryState) {
+			this.logger.warn({
+				id,
+				Category: "sp00ky-client::DataModule::updateQueryLocalArray"
+			}, "Query to update local array not found");
 			return;
+		}
+		const epoch = this.local.epoch;
+		queryState.config.localArray = localArray;
+		try {
+			await this.local.query(surql.seal(surql.updateSet("id", ["localArray"])), {
+				id: queryState.config.id,
+				localArray
+			}, { epoch });
 		} catch (err) {
-			if (store === "memory" || !isLocalStoreOpenError(err)) {
-				this.logger.error({
-					err,
-					Category: "sp00ky-client::LocalDatabaseService::connect"
-				}, "Failed to connect to local database");
-				throw err;
-			}
-			this.logger.warn({
-				err,
-				Category: "sp00ky-client::LocalDatabaseService::connect"
-			}, "Local IndexedDB store failed to open; retrying before clearing");
+			if (err instanceof StaleEpochError) return;
+			throw err;
 		}
-		for (let attempt = 1; attempt <= 2; attempt++) {
-			try {
-				await this.client.close();
-			} catch {}
-			await delay(150 * attempt);
-			try {
-				await this.openStore(storeUrl, namespace, database);
-				this.logger.info({
-					attempt,
-					Category: "sp00ky-client::LocalDatabaseService::connect"
-				}, "Connected to local database on retry (cache preserved)");
-				return;
-			} catch (retryErr) {
-				this.logger.warn({
-					err: retryErr,
-					attempt,
-					Category: "sp00ky-client::LocalDatabaseService::connect"
-				}, "Local store retry failed");
-			}
+	}
+	async updateQueryRemoteArray(hash, remoteArray) {
+		const queryState = this.getQueryByHash(hash);
+		if (!queryState) {
+			this.logger.warn({
+				hash,
+				Category: "sp00ky-client::DataModule::updateQueryRemoteArray"
+			}, "Query to update remote array not found");
+			return;
 		}
+		const epoch = this.local.epoch;
+		queryState.config.remoteArray = remoteArray;
 		try {
-			await this.client.close();
-		} catch {}
-		await dropLocalIndexedDbStores(this.logger);
-		try {
-			await this.openStore(storeUrl, namespace, database);
-			this.logger.info({ Category: "sp00ky-client::LocalDatabaseService::connect" }, "Reconnected to local database after clearing the corrupt store");
-		} catch (retryErr) {
-			this.logger.error({
-				err: retryErr,
-				Category: "sp00ky-client::LocalDatabaseService::connect"
-			}, "Local store still failing after clear; falling back to in-memory");
-			try {
-				await this.client.close();
-			} catch {}
-			await this.openStore("mem://", namespace, database);
-			this.logger.warn({ Category: "sp00ky-client::LocalDatabaseService::connect" }, "Connected to local database (in-memory fallback)");
+			await this.local.query(surql.seal(surql.updateSet("id", ["remoteArray"])), {
+				id: queryState.config.id,
+				remoteArray
+			}, { epoch });
+		} catch (err) {
+			if (err instanceof StaleEpochError) return;
+			throw err;
 		}
 	}
-	unloadCloseRegistered = false;
 	/**
-	* Close the local DB on page unload so the SurrealDB-WASM worker releases its
-	* IndexedDB connection cleanly. Without this, the previous page's connection
-	* lingers; the next load's `client.connect` opens the store but the first
-	* write transaction in `client.use` hits an "IndexedDB error" — which then
-	* (mis)triggered the corrupt-store recovery and WIPED the cache on every
-	* reload, making warm loads as slow as cold ones. `pagehide` is the reliable
-	* unload signal (fires on bfcache + normal navigation); `close()` is async but
-	* the WASM worker initiates the IndexedDB connection teardown synchronously.
+	* Cancel every armed timer ahead of a local-bucket switch: stream-update
+	* debounce timers (their pending updates carry the OLD bucket's id-sets) and
+	* per-query TTL heartbeats (they'd refresh the previous user's remote
+	* `_00_query` rows under the new session). The rebind re-arms heartbeats.
 	*/
-	registerUnloadClose() {
-		if (this.unloadCloseRegistered || typeof window === "undefined") return;
-		this.unloadCloseRegistered = true;
-		const close = () => {
+	quiesce() {
+		for (const timer of this.debounceTimers.values()) clearTimeout(timer);
+		this.debounceTimers.clear();
+		this.pendingStreamUpdates.clear();
+		this.fetchDepth.clear();
+		for (const queryState of this.activeQueries.values()) if (queryState.ttlTimer) {
+			clearTimeout(queryState.ttlTimer);
+			queryState.ttlTimer = null;
+		}
+	}
+	/**
+	* Re-home every active query in a freshly-opened bucket, KEEPING its hash —
+	* `useQuery` subscriptions are keyed by hash and don't re-register on auth
+	* changes, so the hooks must stay attached. Per query:
+	*   1. reset the sync arrays + hydration flag and drop the previous user's
+	*      records, notifying subscribers with the new-bucket materialization
+	*      (usually empty) so their rows leave the UI immediately;
+	*   2. recreate the `_00_query` row in the new bucket;
+	*   3. re-register the SSP view on the (fresh, post-reset) processor — this
+	*      also rebinds the view to the NEW `$auth` context;
+	*   4. restart the TTL heartbeat.
+	* Returns the hashes so the caller can enqueue remote re-registration, which
+	* refills records from the server via the normal register→sync→notify path.
+	*/
+	async rebindAfterBucketSwitch() {
+		const hashes = [];
+		for (const [hash, queryState] of this.activeQueries.entries()) {
+			const config = queryState.config;
+			config.localArray = [];
+			config.remoteArray = [];
+			config.subqueryRemoteArray = void 0;
+			queryState.hydrated = false;
+			queryState.syncNotified = false;
+			queryState.records = [];
+			this.setQueryStatus(hash, "fetching");
 			try {
-				this.client.close();
-			} catch {}
-		};
-		window.addEventListener("pagehide", close);
-		window.addEventListener("beforeunload", close);
+				await withRetry(this.logger, () => this.local.query(surql.seal(surql.create("id", "data")), {
+					id: config.id,
+					data: {
+						surql: config.surql,
+						params: config.params,
+						localArray: [],
+						remoteArray: [],
+						lastActiveAt: /* @__PURE__ */ new Date(),
+						createdAt: /* @__PURE__ */ new Date(),
+						ttl: config.ttl,
+						tableName: config.tableName,
+						updateCount: queryState.updateCount,
+						rowCount: 0,
+						errorCount: queryState.errorCount
+					}
+				}));
+				const { localArray } = this.cache.registerQuery({
+					queryHash: hash,
+					surql: config.surql,
+					params: config.params,
+					ttl: new Duration(config.ttl),
+					lastActiveAt: /* @__PURE__ */ new Date()
+				});
+				config.localArray = localArray;
+				await this.local.query(surql.seal(surql.updateSet("id", ["localArray", "rowCount"])), {
+					id: config.id,
+					localArray,
+					rowCount: localArray.length
+				});
+			} catch (err) {
+				this.logger.error({
+					err,
+					hash,
+					Category: "sp00ky-client::DataModule::rebindAfterBucketSwitch"
+				}, "Failed to rebind query after bucket switch; remote re-registration will retry");
+			}
+			const subscribers = this.subscriptions.get(hash);
+			if (subscribers) for (const callback of subscribers) callback(queryState.records);
+			this.startTTLHeartbeat(queryState, hash);
+			hashes.push(hash);
+		}
+		return hashes;
 	}
-	async openStore(storeUrl, namespace, database) {
-		this.logger.debug({
-			storeUrl,
-			Category: "sp00ky-client::LocalDatabaseService::connect"
-		}, "[LocalDatabaseService] Calling client.connect");
-		await this.client.connect(storeUrl, {});
-		this.logger.debug({
-			namespace,
-			database,
-			Category: "sp00ky-client::LocalDatabaseService::connect"
-		}, "[LocalDatabaseService] client.connect returned. Calling client.use");
-		await this.client.use({
-			namespace,
-			database
-		});
-		this.logger.debug({ Category: "sp00ky-client::LocalDatabaseService::connect" }, "[LocalDatabaseService] client.use returned");
+	/**
+	* Called after a query's initial sync completes.
+	* Ensures subscribers are notified even if no stream updates fired (e.g. empty result set).
+	*/
+	async notifyQuerySynced(queryHash) {
+		const queryState = this.activeQueries.get(queryHash);
+		if (!queryState) return;
+		const epoch = this.local.epoch;
+		const newRecords = await this.materializeRecords(queryState);
+		if (epoch !== this.local.epoch) return;
+		const changed = JSON.stringify(queryState.records) !== JSON.stringify(newRecords);
+		queryState.records = newRecords;
+		if (changed || !queryState.syncNotified) {
+			queryState.syncNotified = true;
+			queryState.updateCount++;
+			queryState.lastUpdatedAt = Date.now();
+			const subscribers = this.subscriptions.get(queryHash);
+			if (subscribers) for (const callback of subscribers) callback(queryState.records);
+		}
 	}
-};
-function delay(ms) {
-	return new Promise((resolve) => setTimeout(resolve, ms));
-}
-/** True for the SurrealDB-WASM error raised when its IndexedDB-backed key-value
-*  store can't be opened (corrupt / version-incompatible / blocked). Exported
-*  for unit testing the error-message match. */
-function isLocalStoreOpenError(err) {
-	const msg = (err instanceof Error ? err.message : String(err)).toLowerCase();
-	return msg.includes("indexeddb") || msg.includes("idb error") || msg.includes("key-value store");
-}
-/** Best-effort delete of this client's IndexedDB store(s). The persistent local
-*  DB lives at `indxdb://sp00ky`; SurrealDB-WASM backs it with one or more
-*  IndexedDB databases whose names include `sp00ky`. Resolves even on
-*  error/blocked so startup can proceed. No-op outside a browser. */
-async function dropLocalIndexedDbStores(logger) {
-	if (typeof indexedDB === "undefined") return;
-	const remove = (name) => new Promise((resolve) => {
-		try {
-			const req = indexedDB.deleteDatabase(name);
-			req.onsuccess = () => resolve();
-			req.onerror = () => resolve();
-			req.onblocked = () => resolve();
-		} catch {
-			resolve();
+	async run(backend, path, data, options) {
+		const route = this.schema.backends?.[backend]?.routes?.[path];
+		if (!route) throw new Error(`Route ${backend}.${path} not found`);
+		const tableName = this.schema.backends?.[backend]?.outboxTable;
+		if (!tableName) throw new Error(`Outbox table for backend ${backend} not found`);
+		const payload = {};
+		for (const argName of Object.keys(route.args)) {
+			const arg = route.args[argName];
+			if (data[argName] === void 0 && arg.optional === false) throw new Error(`Missing required argument ${argName}`);
+			payload[argName] = data[argName];
 		}
-	});
-	try {
-		let names = [];
-		if (typeof indexedDB.databases === "function") names = (await indexedDB.databases()).map((d) => d.name).filter((n) => !!n && n.toLowerCase().includes("sp00ky"));
-		if (names.length === 0) names = ["sp00ky"];
-		await Promise.all(names.map(remove));
-		logger.info({
-			names,
-			Category: "sp00ky-client::LocalDatabaseService::connect"
-		}, "Cleared local IndexedDB store(s)");
-	} catch (e) {
-		logger.warn({
-			err: e,
-			Category: "sp00ky-client::LocalDatabaseService::connect"
-		}, "Failed to enumerate/clear IndexedDB; proceeding anyway");
-	}
-}
-
-//#endregion
-//#region src/services/database/remote.ts
-var RemoteDatabaseService = class extends AbstractDatabaseService {
-	config;
-	eventType = DatabaseEventTypes.RemoteQuery;
-	constructor(config, logger) {
-		const events = createDatabaseEventSystem();
-		super(new Surreal({ engines: applyDiagnostics(createRemoteEngines(), ({ key, type, phase, ...other }) => {
-			if (phase === "progress" || phase === "after") logger.trace({
-				...other,
-				key,
-				type,
-				phase,
-				service: "surrealdb:remote",
-				Category: "sp00ky-client::RemoteDatabaseService::diagnostics"
-			}, `Remote SurrealDB diagnostics captured ${type}:${phase}`);
-		}) }), logger, events);
-		this.config = config;
-	}
-	getConfig() {
-		return this.config;
-	}
-	async connect() {
-		const { endpoint, token, namespace, database } = this.getConfig();
-		if (endpoint) {
-			this.logger.info({
-				endpoint,
-				namespace,
-				database,
-				Category: "sp00ky-client::RemoteDatabaseService::connect"
-			}, "Connecting to remote database");
-			try {
-				await this.client.connect(endpoint);
-				await this.client.use({
-					namespace,
-					database
-				});
-				if (token) {
-					this.logger.debug({ Category: "sp00ky-client::RemoteDatabaseService::connect" }, "Authenticating with token");
-					await this.client.authenticate(token);
-				}
-				this.logger.info({ Category: "sp00ky-client::RemoteDatabaseService::connect" }, "Connected to remote database");
-			} catch (err) {
-				this.logger.error({
-					err,
-					Category: "sp00ky-client::RemoteDatabaseService::connect"
-				}, "Failed to connect to remote database");
-				throw err;
-			}
-		} else this.logger.warn({ Category: "sp00ky-client::RemoteDatabaseService::connect" }, "No endpoint configured for remote database");
-	}
-	async signin(params) {
-		return this.client.signin(params);
+		const record = {
+			path,
+			payload: JSON.stringify(payload),
+			max_retries: options?.max_retries ?? 3,
+			retry_strategy: options?.retry_strategy ?? "linear"
+		};
+		if (options?.timeout != null) record.timeout = options.timeout;
+		if (options?.delay != null) record.delay = options.delay;
+		if (options?.assignedTo) record.assigned_to = options.assignedTo;
+		const recordId = `${tableName}:${generateId()}`;
+		await this.create(recordId, record);
 	}
-	async signup(params) {
-		return this.client.signup(params);
+	/**
+	* Create a new record
+	*/
+	async create(id, data) {
+		const tableName = extractTablePart(id);
+		const tableSchema = this.schema.tables.find((t) => t.name === tableName);
+		if (!tableSchema) throw new Error(`Table ${tableName} not found`);
+		const rid = parseRecordIdString(id);
+		const params = parseParams(tableSchema.columns, data);
+		const mutationId = parseRecordIdString(`_00_pending_mutations:${Date.now()}`);
+		const dataKeys = Object.keys(params).map((key) => ({
+			key,
+			variable: `data_${key}`
+		}));
+		const prefixedParams = Object.fromEntries(dataKeys.map(({ key, variable }) => [variable, params[key]]));
+		const query = surql.seal(surql.tx([surql.createSet("id", dataKeys), surql.createMutation("create", "mid", "id", "data")]), { resultIndex: 0 });
+		const target = await withRetry(this.logger, () => this.local.execute(query, {
+			id: rid,
+			mid: mutationId,
+			...prefixedParams
+		}));
+		const parsedRecord = parseParams(tableSchema.columns, target);
+		await this.cache.save({
+			table: tableName,
+			op: "CREATE",
+			record: parsedRecord,
+			version: 1
+		}, true);
+		const mutationEvent = {
+			type: "create",
+			mutation_id: mutationId,
+			record_id: rid,
+			data: params,
+			record: target,
+			tableName
+		};
+		for (const callback of this.mutationCallbacks) callback([mutationEvent]);
+		this.logger.debug({
+			id,
+			Category: "sp00ky-client::DataModule::create"
+		}, "Record created");
+		return target;
 	}
-	async authenticate(token) {
-		return this.client.authenticate(token);
+	/**
+	* Update an existing record
+	*/
+	async update(table, id, data, options) {
+		const tableName = extractTablePart(id);
+		const tableSchema = this.schema.tables.find((t) => t.name === tableName);
+		if (!tableSchema) throw new Error(`Table ${tableName} not found`);
+		const rid = parseRecordIdString(id);
+		const params = parseParams(tableSchema.columns, data);
+		const mutationId = parseRecordIdString(`_00_pending_mutations:${Date.now()}`);
+		const [beforeRecord] = await withRetry(this.logger, () => this.local.query("SELECT * FROM ONLY $id", { id: rid }));
+		const query = surql.seal(surql.tx([
+			surql.updateSet("id", [{ statement: "_00_rv += 1" }]),
+			surql.let("updated", surql.updateMerge("id", "data")),
+			surql.createMutation("update", "mid", "id", "data"),
+			surql.returnObject([{
+				key: "target",
+				variable: "updated"
+			}])
+		]));
+		const { target } = await withRetry(this.logger, () => this.local.execute(query, {
+			id: rid,
+			mid: mutationId,
+			data: params
+		}));
+		const updatedFields = { id: target.id };
+		for (const key of Object.keys(data)) if (key in target) updatedFields[key] = target[key];
+		if ("_00_rv" in target) updatedFields._00_rv = target._00_rv;
+		this.replaceRecordInQueries(updatedFields);
+		const parsedRecord = parseParams(tableSchema.columns, target);
+		await this.cache.save({
+			table,
+			op: "UPDATE",
+			record: parsedRecord,
+			version: target._00_rv
+		}, true);
+		const pushEventOptions = parseUpdateOptions(id, data, options);
+		const mutationEvent = {
+			type: "update",
+			mutation_id: mutationId,
+			record_id: rid,
+			data: params,
+			record: target,
+			beforeRecord: beforeRecord || void 0,
+			options: pushEventOptions
+		};
+		for (const callback of this.mutationCallbacks) callback([mutationEvent]);
+		this.logger.debug({
+			id,
+			Category: "sp00ky-client::DataModule::update"
+		}, "Record updated");
+		return target;
 	}
-	async invalidate() {
-		return this.client.invalidate();
+	/**
+	* Delete a record
+	*/
+	async delete(table, id) {
+		const tableName = extractTablePart(id);
+		if (!this.schema.tables.find((t) => t.name === tableName)) throw new Error(`Table ${tableName} not found`);
+		const rid = parseRecordIdString(id);
+		const mutationId = parseRecordIdString(`_00_pending_mutations:${Date.now()}`);
+		const [beforeRecords] = await this.local.query("SELECT * FROM ONLY $id", { id: rid });
+		const beforeRecord = beforeRecords ?? {};
+		const query = surql.seal(surql.tx([surql.delete("id"), surql.createMutation("delete", "mid", "id")]));
+		await withRetry(this.logger, () => this.local.execute(query, {
+			id: rid,
+			mid: mutationId
+		}));
+		try {
+			await this.cache.delete(table, id, true, beforeRecord);
+		} catch (err) {
+			this.logger.error({
+				err,
+				id,
+				Category: "sp00ky-client::DataModule::delete"
+			}, "SSP delete-ingest failed; relying on query re-materialize to reflect the delete");
+		}
+		for (const [queryHash, queryState] of this.activeQueries) if (queryState.config.tableName === tableName) try {
+			await this.notifyQuerySynced(queryHash);
+		} catch (err) {
+			this.logger.error({
+				err,
+				queryHash,
+				Category: "sp00ky-client::DataModule::delete"
+			}, "notifyQuerySynced failed after delete");
+		}
+		const mutationEvent = {
+			type: "delete",
+			mutation_id: mutationId,
+			record_id: rid
+		};
+		for (const callback of this.mutationCallbacks) callback([mutationEvent]);
+		this.logger.debug({
+			id,
+			Category: "sp00ky-client::DataModule::delete"
+		}, "Record deleted");
 	}
-};
-
-//#endregion
-//#region src/services/logger/index.ts
-function createLogger(level = "info", transmit) {
-	const browserConfig = {
-		asObject: true,
-		write: (o) => {
-			console.log(JSON.stringify(o));
+	/**
+	* Rollback a failed optimistic create by deleting the record locally
+	*/
+	async rollbackCreate(recordId, tableName) {
+		const id = encodeRecordId(recordId);
+		try {
+			await withRetry(this.logger, () => this.local.query("DELETE $id", { id: recordId }));
+			await this.cache.delete(tableName, id, true);
+			this.removeRecordFromQueries(recordId);
+			this.logger.info({
+				id,
+				tableName,
+				Category: "sp00ky-client::DataModule::rollbackCreate"
+			}, "Rolled back optimistic create");
+		} catch (err) {
+			this.logger.error({
+				err,
+				id,
+				tableName,
+				Category: "sp00ky-client::DataModule::rollbackCreate"
+			}, "Failed to rollback create");
 		}
-	};
-	if (transmit) browserConfig.transmit = transmit;
-	return pino({
-		level,
-		browser: browserConfig
-	});
-}
-
-//#endregion
-//#region src/services/database/local-migrator.ts
-const sha1 = async (str) => {
-	const enc = new TextEncoder();
-	const hash = await crypto.subtle.digest("SHA-1", enc.encode(str));
-	return Array.from(new Uint8Array(hash)).map((v) => v.toString(16).padStart(2, "0")).join("");
-};
-var LocalMigrator = class {
-	logger;
-	constructor(localDb, logger) {
-		this.localDb = localDb;
-		this.logger = logger.child({ service: "LocalMigrator" });
-		logger?.child({ service: "LocalMigrator" }) ?? createLogger("info").child({ service: "LocalMigrator" });
 	}
-	async provision(schemaSurql) {
-		const hash = await sha1(schemaSurql);
-		const { database } = this.localDb.getConfig();
-		if (await this.isSchemaUpToDate(hash)) {
-			this.logger.info({ Category: "sp00ky-client::LocalMigrator::provision" }, "[Provisioning] Schema is up to date, skipping migration");
-			return;
+	/**
+	* Rollback a failed optimistic update by restoring the previous record state
+	*/
+	async rollbackUpdate(recordId, tableName, beforeRecord) {
+		const id = encodeRecordId(recordId);
+		try {
+			const { id: _recordId, ...content } = beforeRecord;
+			await withRetry(this.logger, () => this.local.query(surql.seal(surql.upsert("id", "content")), {
+				id: recordId,
+				content
+			}));
+			const tableSchema = this.schema.tables.find((t) => t.name === tableName);
+			const parsedRecord = tableSchema ? parseParams(tableSchema.columns, beforeRecord) : beforeRecord;
+			await this.cache.save({
+				table: tableName,
+				op: "UPDATE",
+				record: parsedRecord,
+				version: beforeRecord._00_rv || 1
+			}, true);
+			await this.replaceRecordInQueries(beforeRecord);
+			this.logger.info({
+				id,
+				tableName,
+				Category: "sp00ky-client::DataModule::rollbackUpdate"
+			}, "Rolled back optimistic update");
+		} catch (err) {
+			this.logger.error({
+				err,
+				id,
+				tableName,
+				Category: "sp00ky-client::DataModule::rollbackUpdate"
+			}, "Failed to rollback update");
 		}
-		await this.recreateDatabase(database);
-		const fullSchema = schemaSurql + "\n\n      DEFINE TABLE IF NOT EXISTS _00_stream_processor_state SCHEMALESS PERMISSIONS FOR select, create, update, delete WHERE true;\n      DEFINE TABLE IF NOT EXISTS _00_query SCHEMALESS PERMISSIONS FOR select, create, update, delete WHERE true;\n      DEFINE TABLE IF NOT EXISTS _00_schema SCHEMALESS PERMISSIONS FOR select, create, update, delete WHERE true;\n      DEFINE TABLE IF NOT EXISTS _00_pending_mutations SCHEMALESS PERMISSIONS FOR select, create, update, delete WHERE true;\n    ";
-		const statements = this.splitStatements(fullSchema);
-		for (let i = 0; i < statements.length; i++) {
-			const statement = statements[i];
-			const cleanStatement = statement.replace(/--.*/g, "").trim();
-			if (cleanStatement.toUpperCase().startsWith("DEFINE INDEX")) {
-				this.logger.warn({ Category: "sp00ky-client::LocalMigrator::provision" }, `[Provisioning] Skipping index definition (WASM hang avoidance): ${cleanStatement.substring(0, 50)}...`);
-				continue;
-			}
-			try {
-				this.logger.info({ Category: "sp00ky-client::LocalMigrator::provision" }, `[Provisioning] (${i + 1}/${statements.length}) Executing: ${statement.substring(0, 50)}...`);
-				await this.localDb.query(statement);
-				this.logger.info({ Category: "sp00ky-client::LocalMigrator::provision" }, `[Provisioning] (${i + 1}/${statements.length}) Done`);
-			} catch (e) {
-				this.logger.error({ Category: "sp00ky-client::LocalMigrator::provision" }, `[Provisioning] (${i + 1}/${statements.length}) Error executing statement: ${statement}`);
-				throw e;
+	}
+	/**
+	* Remove a record from all active query states and notify subscribers
+	*/
+	removeRecordFromQueries(recordId) {
+		const encodedId = encodeRecordId(recordId);
+		for (const [queryHash, queryState] of this.activeQueries.entries()) {
+			const index = queryState.records.findIndex((r) => {
+				return (r.id instanceof RecordId ? encodeRecordId(r.id) : String(r.id)) === encodedId;
+			});
+			if (index !== -1) {
+				queryState.records.splice(index, 1);
+				const subscribers = this.subscriptions.get(queryHash);
+				if (subscribers) for (const callback of subscribers) callback(queryState.records);
 			}
 		}
-		await this.createHashRecord(hash);
 	}
-	async isSchemaUpToDate(hash) {
-		try {
-			const [lastSchemaRecord] = await this.localDb.query(`SELECT hash, created_at FROM ONLY _00_schema ORDER BY created_at DESC LIMIT 1;`);
-			return lastSchemaRecord?.hash === hash;
-		} catch (_error) {
-			return false;
+	async createAndRegisterQuery(hash, recordId, surqlString, params, ttl, tableName) {
+		const queryState = await this.createNewQuery({
+			recordId,
+			surql: surqlString,
+			params,
+			ttl,
+			tableName
+		});
+		const t0 = performance.now();
+		const { localArray, registrationTimings } = this.cache.registerQuery({
+			queryHash: hash,
+			surql: surqlString,
+			params,
+			ttl: new Duration(ttl),
+			lastActiveAt: /* @__PURE__ */ new Date()
+		});
+		const registrationTime = performance.now() - t0;
+		queryState.registrationTimings = {
+			parseMs: registrationTimings?.parseMs ?? null,
+			planMs: registrationTimings?.planMs ?? null,
+			snapshotMs: registrationTimings?.snapshotMs ?? null,
+			wallMs: registrationTime
+		};
+		await withRetry(this.logger, () => this.local.query(surql.seal(surql.updateSet("id", [
+			"localArray",
+			"registrationTime",
+			"rowCount"
+		])), {
+			id: recordId,
+			localArray,
+			registrationTime,
+			rowCount: localArray.length
+		}));
+		const windowMat = buildWindowMaterialization(surqlString);
+		if (windowMat && localArray.length > 0) try {
+			const winIds = localArray.map(([id]) => parseRecordIdString(id));
+			const [seeded] = await this.local.query(windowMat.query, {
+				...params,
+				__win: winIds
+			});
+			queryState.records = seeded || [];
+		} catch (err) {
+			this.logger.warn({
+				err,
+				hash,
+				Category: "sp00ky-client::DataModule::createAndRegisterQuery"
+			}, "Failed to seed windowed initial records from localArray");
+		}
+		this.activeQueries.set(hash, queryState);
+		this.startTTLHeartbeat(queryState, hash);
+		this.logger.debug({
+			hash,
+			tableName,
+			recordCount: queryState.records.length,
+			Category: "sp00ky-client::DataModule::query"
+		}, "Query registered");
+		return hash;
+	}
+	async createNewQuery({ recordId, surql: surqlString, params, ttl, tableName }) {
+		const tableSchema = this.schema.tables.find((t) => t.name === tableName);
+		if (!tableSchema) throw new Error(`Table ${tableName} not found`);
+		let [configRecord] = await withRetry(this.logger, () => this.local.query("SELECT * FROM ONLY $id", { id: recordId }));
+		if (!configRecord) {
+			const [createdRecord] = await withRetry(this.logger, () => this.local.query(surql.seal(surql.create("id", "data")), {
+				id: recordId,
+				data: {
+					surql: surqlString,
+					params,
+					localArray: [],
+					remoteArray: [],
+					lastActiveAt: /* @__PURE__ */ new Date(),
+					createdAt: /* @__PURE__ */ new Date(),
+					ttl,
+					tableName,
+					updateCount: 0,
+					rowCount: 0,
+					errorCount: 0
+				}
+			}));
+			configRecord = createdRecord;
+		}
+		const config = {
+			...configRecord,
+			id: recordId,
+			params: parseParams(tableSchema.columns, configRecord.params)
+		};
+		let records = [];
+		if (buildWindowMaterialization(surqlString) === null) try {
+			const [result] = await this.local.query(surqlString, params);
+			records = result || [];
+		} catch (err) {
+			this.logger.warn({
+				err,
+				Category: "sp00ky-client::DataModule::createNewQuery"
+			}, "Failed to load initial cached records");
 		}
+		const persistedUpdateCount = typeof configRecord?.updateCount === "number" ? configRecord.updateCount : 0;
+		const persistedErrorCount = typeof configRecord?.errorCount === "number" ? configRecord.errorCount : 0;
+		return {
+			config,
+			records,
+			ttlTimer: null,
+			ttlDurationMs: parseDuration(ttl),
+			updateCount: persistedUpdateCount,
+			lastUpdatedAt: null,
+			materializationSamples: [],
+			lastIngestLatencyMs: null,
+			errorCount: persistedErrorCount,
+			status: "fetching",
+			phaseSamples: {},
+			phaseLast: {},
+			registrationTimings: {
+				parseMs: null,
+				planMs: null,
+				snapshotMs: null,
+				wallMs: null
+			}
+		};
 	}
-	async recreateDatabase(database) {
-		try {
-			await this.localDb.query(`DEFINE DATABASE _00_temp;`);
-		} catch (_e) {}
-		try {
-			await this.localDb.query(`
-        USE DB _00_temp;
-        REMOVE DATABASE ${database};
-      `);
-		} catch (_e) {}
-		await this.localDb.query(`
-      DEFINE DATABASE ${database};
-      USE DB ${database};
-    `);
+	async calculateHash(data) {
+		const content = JSON.stringify({
+			...data,
+			sessionId: this.sessionId
+		});
+		const msgBuffer = new TextEncoder().encode(content);
+		const hashBuffer = await crypto.subtle.digest("SHA-256", msgBuffer);
+		return Array.from(new Uint8Array(hashBuffer)).map((b) => b.toString(16).padStart(2, "0")).join("");
 	}
-	splitStatements(schema) {
-		const statements = [];
-		let current = "";
-		let depth = 0;
-		let inQuote = false;
-		let quoteChar = "";
-		let inComment = false;
-		for (let i = 0; i < schema.length; i++) {
-			const char = schema[i];
-			const nextChar = schema[i + 1];
-			if (inComment) {
-				current += char;
-				if (char === "\n") inComment = false;
-				continue;
-			}
-			if (!inQuote && char === "-" && nextChar === "-") {
-				inComment = true;
-				current += char;
-				continue;
-			}
-			if (inQuote) {
-				current += char;
-				if (char === quoteChar && schema[i - 1] !== "\\") inQuote = false;
-				continue;
-			}
-			if (char === "\"" || char === "'") {
-				inQuote = true;
-				quoteChar = char;
-				current += char;
-				continue;
-			}
-			if (char === "{") {
-				depth++;
-				current += char;
-				continue;
-			}
-			if (char === "}") {
-				depth--;
-				current += char;
-				continue;
+	startTTLHeartbeat(queryState, hash) {
+		if (queryState.ttlTimer) return;
+		const heartbeatTime = Math.floor(queryState.ttlDurationMs * .9);
+		queryState.ttlTimer = setTimeout(() => {
+			queryState.ttlTimer = null;
+			if ((this.subscriptions.get(hash)?.size ?? 0) === 0) {
+				this.logger.debug({
+					hash,
+					Category: "sp00ky-client::DataModule::startTTLHeartbeat"
+				}, "TTL heartbeat: no subscribers, stopping");
+				return;
 			}
-			if (char === ";" && depth === 0) {
-				if (current.trim().length > 0) statements.push(current.trim());
-				current = "";
-				continue;
+			this.onHeartbeat?.(hash);
+			this.logger.debug({
+				hash,
+				id: encodeRecordId(queryState.config.id),
+				Category: "sp00ky-client::DataModule::startTTLHeartbeat"
+			}, "TTL heartbeat sent");
+			this.startTTLHeartbeat(queryState, hash);
+		}, heartbeatTime);
+	}
+	async replaceRecordInQueries(record) {
+		for (const [queryHash, queryState] of this.activeQueries.entries()) {
+			const index = queryState.records.findIndex((r) => r.id === record.id);
+			if (index !== -1) {
+				queryState.records[index] = {
+					...queryState.records[index],
+					...record
+				};
+				const subscribers = this.subscriptions.get(queryHash);
+				if (subscribers) for (const callback of subscribers) callback(queryState.records);
 			}
-			current += char;
 		}
-		if (current.trim().length > 0) statements.push(current.trim());
-		return statements;
-	}
-	async createHashRecord(hash) {
-		await this.localDb.query(`UPSERT _00_schema SET hash = $hash, created_at = time::now() WHERE hash = $hash;`, { hash });
 	}
 };
+/**
+* Parse update options to generate push event options
+*/
+function parseUpdateOptions(id, data, options) {
+	let pushEventOptions = {};
+	if (options?.debounced) pushEventOptions = { debounced: {
+		delay: options.debounced !== true ? options.debounced?.delay ?? 200 : 200,
+		key: (options.debounced !== true ? options.debounced?.key ?? id : id) === "recordId_x_fields" ? `${id}::${Object.keys(data).toSorted().join("#")}` : id
+	} };
+	return pushEventOptions;
+}
 
 //#endregion
 //#region src/modules/sync/events/index.ts
@@ -2014,6 +2383,17 @@ var UpQueue = class {
 			firstBeforeRecord
 		});
 	}
+	/**
+	* Cancel all pending debounce timers WITHOUT enqueueing their events. Used
+	* on local-bucket switches: the mutation's `_00_pending_mutations` row was
+	* already persisted at mutation time, so dropping the in-memory push only
+	* defers it to that bucket's next `loadFromDatabase` — it must NOT be pushed
+	* now, the remote session already belongs to the next user.
+	*/
+	clearDebounceTimers() {
+		for (const { timer } of this.debouncedMutations.values()) clearTimeout(timer);
+		this.debouncedMutations.clear();
+	}
 	async next(fn, onRollback) {
 		const event = this.queue.shift();
 		if (event) {
@@ -2145,6 +2525,11 @@ var DownQueue = class {
 			payload: { queueSize: this.queue.length }
 		});
 	}
+	/** Drop all queued events (bucket switch: old-bucket register/sync work is
+	*  re-derived after the switch; replaying it would target dead query rows). */
+	clear() {
+		this.queue = [];
+	}
 	async next(fn) {
 		const event = this.queue.shift();
 		if (event) try {
@@ -2494,6 +2879,8 @@ var SyncEngine = class {
 var SyncScheduler = class {
 	isSyncingUp = false;
 	isSyncingDown = false;
+	paused = false;
+	pauseWaiters = [];
 	constructor(upQueue, downQueue, onProcessUp, onProcessDown, logger, onRollback, onSyncOutcome) {
 		this.upQueue = upQueue;
 		this.downQueue = downQueue;
@@ -2521,14 +2908,36 @@ var SyncScheduler = class {
 		this.downQueue.push(event);
 	}
 	/**
+	* Suspend syncing for a local-bucket switch. Refuses new rounds and resolves
+	* once any in-flight round has finished — the pause point is BETWEEN queue
+	* items, never between an item's remote push and its outbox-row delete, so a
+	* processed mutation's `DELETE _00_pending_mutations` always lands in the
+	* store it was read from.
+	*/
+	pause() {
+		this.paused = true;
+		if (!this.isSyncingUp && !this.isSyncingDown) return Promise.resolve();
+		return new Promise((resolve) => this.pauseWaiters.push(resolve));
+	}
+	resume() {
+		this.paused = false;
+		this.syncUp();
+	}
+	maybeResolvePause() {
+		if (!this.paused || this.isSyncingUp || this.isSyncingDown) return;
+		const waiters = this.pauseWaiters;
+		this.pauseWaiters = [];
+		for (const resolve of waiters) resolve();
+	}
+	/**
 	* Process upload queue
 	*/
 	async syncUp() {
-		if (this.isSyncingUp) return;
+		if (this.isSyncingUp || this.paused) return;
 		this.isSyncingUp = true;
 		let processedAny = false;
 		try {
-			while (this.upQueue.size > 0) {
+			while (this.upQueue.size > 0 && !this.paused) {
 				await this.upQueue.next(this.onProcessUp, this.onRollback);
 				processedAny = true;
 			}
@@ -2541,6 +2950,7 @@ var SyncScheduler = class {
 			}, "syncUp halted on a queue error; item re-queued, will retry on next trigger");
 		} finally {
 			this.isSyncingUp = false;
+			this.maybeResolvePause();
 			this.syncDown();
 		}
 	}
@@ -2548,12 +2958,12 @@ var SyncScheduler = class {
 	* Process download queue
 	*/
 	async syncDown() {
-		if (this.isSyncingDown) return;
+		if (this.isSyncingDown || this.paused) return;
 		if (this.upQueue.size > 0) return;
 		this.isSyncingDown = true;
 		let processedAny = false;
 		try {
-			while (this.downQueue.size > 0) {
+			while (this.downQueue.size > 0 && !this.paused) {
 				if (this.upQueue.size > 0) break;
 				await this.downQueue.next(this.onProcessDown);
 				processedAny = true;
@@ -2567,6 +2977,7 @@ var SyncScheduler = class {
 			}, "syncDown halted on a queue error; item re-queued, will retry on next trigger");
 		} finally {
 			this.isSyncingDown = false;
+			this.maybeResolvePause();
 		}
 	}
 	get isSyncing() {
@@ -2574,53 +2985,6 @@ var SyncScheduler = class {
 	}
 };
 
-//#endregion
-//#region src/modules/ref-tables.ts
-/**
-* Sentinel user id for unauthenticated clients when anonymous live queries are
-* enabled. Mirrors `ssp_protocol::ANON_AUTH_ID`. It carries no `user:` prefix
-* so it can never collide with a real user id (those arrive as `user:<id>`);
-* both sides resolve it to the shared `_00_list_ref_anon` table.
-*/
-const ANON_USER_ID = "anon";
-/**
-* Default ref-storage mode for this client build. Mirrors the SSP's
-* default (`RefMode::Dedicated`) so cross-session sync works out of the
-* box.
-*/
-const DEFAULT_REF_MODE = "dedicated";
-/**
-* Sanitize a user record id (e.g. `"user:abc"`) into the segment that
-* goes into a dedicated table name (e.g. `"abc"`). Returns `null` if
-* the id is missing the `user:` prefix or contains characters that
-* aren't valid in a SurrealDB table identifier — the server-side
-* `ssp_protocol::sanitize_user_id` uses the same predicate.
-*
-* Accepts both string ids (`"user:abc"`) and SurrealDB `RecordId`
-* objects (which only stringify cleanly via `.toString()`), since
-* `AuthService` passes the record-id object as-is to its subscribers.
-*/
-function sanitizeUserId(userId) {
-	if (userId === null || userId === void 0) return null;
-	const asString = typeof userId === "string" ? userId : typeof userId.toString === "function" ? userId.toString() : null;
-	if (!asString) return null;
-	const raw = asString.startsWith("user:") ? asString.slice(5) : asString;
-	if (raw.length === 0) return null;
-	if (!/^[A-Za-z0-9_]+$/.test(raw)) return null;
-	return raw;
-}
-/**
-* Returns the `_00_list_ref` table name for `(mode, userId)`. Falls
-* back to the global `_00_list_ref` when sanitization fails or in
-* single mode.
-*/
-function listRefTableFor(mode, userId) {
-	if (userId === ANON_USER_ID) return "_00_list_ref_anon";
-	if (mode === "single") return "_00_list_ref";
-	const uid = sanitizeUserId(userId);
-	return uid ? `_00_list_ref_user_${uid}` : "_00_list_ref";
-}
-
 //#endregion
 //#region src/modules/sync/sync.ts
 /**
@@ -2651,6 +3015,7 @@ var Sp00kySync = class Sp00kySync {
 	liveQueryUnsubscribe = null;
 	listRefPollTimer = null;
 	listRefPollRunning = false;
+	listRefPollInFlight = null;
 	refSyncIntervalMs;
 	listRefIdleStreak = 0;
 	stillRemoteStreaks = /* @__PURE__ */ new Map();
@@ -2831,6 +3196,39 @@ var Sp00kySync = class Sp00kySync {
 		}
 	}
 	/**
+	* Quiesce all sync activity ahead of a local-bucket switch. After this
+	* resolves, nothing in the sync module writes to the local store: the poll
+	* loop is stopped AND its in-flight tick awaited, LIVE is killed, debounce
+	* timers are cancelled (their outbox rows are already persisted), and the
+	* scheduler has drained its in-flight queue item — including that item's
+	* outbox-row delete, which must land in the OLD bucket. Queued down-events
+	* are dropped (they reference old-bucket query rows; the post-switch rebind
+	* re-enqueues registrations). The old user's un-pushed outbox is deliberately
+	* NOT drained: the remote session already belongs to the next user.
+	*/
+	async prepareBucketSwitch() {
+		this.stopSelfHeal();
+		this.stopListRefPoll();
+		if (this.listRefPollInFlight) await this.listRefPollInFlight;
+		await this.killRefLiveQuery();
+		this.upQueue.clearDebounceTimers();
+		await this.scheduler.pause();
+		this.downQueue.clear();
+		this.stillRemoteStreaks.clear();
+		this.logger.info({ Category: "sp00ky-client::Sp00kySync::prepareBucketSwitch" }, "Sync quiesced for bucket switch");
+	}
+	/**
+	* Resume syncing against the freshly-opened bucket: reload the mutation
+	* outbox from ITS `_00_pending_mutations` (the new user's own un-pushed
+	* offline work) and restart the scheduler. LIVE + the list_ref poll restart
+	* via the `setCurrentUserId` call that follows in the auth listener.
+	*/
+	async completeBucketSwitch() {
+		await this.upQueue.loadFromDatabase();
+		this.scheduler.resume();
+		this.logger.info({ Category: "sp00ky-client::Sp00kySync::completeBucketSwitch" }, "Sync resumed after bucket switch");
+	}
+	/**
 	* Push the authenticated user's record id from the parent client's
 	* auth subscription. Tears down the existing `_00_list_ref` LIVE (if
 	* any) and re-registers it under the new user's dedicated table so
@@ -2897,9 +3295,14 @@ var Sp00kySync = class Sp00kySync {
 			this.listRefPollTimer = setTimeout(async () => {
 				if (!this.listRefPollRunning) return;
 				let changed = false;
-				try {
+				const tick = (async () => {
 					changed = await this.pollListRefForActiveQueries();
+				})();
+				this.listRefPollInFlight = tick.catch(() => {});
+				try {
+					await tick;
 				} finally {
+					this.listRefPollInFlight = null;
 					if (!this.listRefPollRunning) return;
 					this.listRefIdleStreak = changed ? 0 : this.listRefIdleStreak + 1;
 					schedule(listRefPollDelayMs({
@@ -3285,7 +3688,7 @@ var Sp00kySync = class Sp00kySync {
 			};
 		}
 		const fetching = diff.added.length + diff.updated.length > 0;
-		if (fetching) this.dataModule.setQueryStatus(hash, "fetching");
+		if (fetching) this.dataModule.beginFetching(hash);
 		try {
 			const { remoteFetchMs, stillRemoteIds } = await this.syncEngine.syncRecords(diff);
 			if (fetching) this.dataModule.recordRemoteFetch(hash, remoteFetchMs);
@@ -3310,7 +3713,18 @@ var Sp00kySync = class Sp00kySync {
 				}
 			}
 		} finally {
-			if (fetching) this.dataModule.setQueryStatus(hash, "idle");
+			if (fetching) {
+				try {
+					await this.dataModule.flushPendingStreamUpdate(hash);
+				} catch (err) {
+					this.logger.warn({
+						err,
+						hash,
+						Category: "sp00ky-client::Sp00kySync::runSyncForQuery"
+					}, "Failed to flush pending stream update before idle");
+				}
+				this.dataModule.endFetching(hash);
+			}
 		}
 	}
 	/**
@@ -3339,6 +3753,7 @@ var Sp00kySync = class Sp00kySync {
 		this.scheduler.enqueueMutation(mutations);
 	}
 	async registerQuery(queryHash) {
+		this.dataModule.beginFetching(queryHash);
 		try {
 			this.logger.debug({
 				queryHash,
@@ -3346,6 +3761,7 @@ var Sp00kySync = class Sp00kySync {
 			}, "Register Query state");
 			await this.createRemoteQuery(queryHash);
 			await this.syncQuery(queryHash);
+			await this.dataModule.flushPendingStreamUpdate(queryHash);
 			await this.dataModule.notifyQuerySynced(queryHash);
 		} catch (e) {
 			this.logger.error({
@@ -3353,6 +3769,8 @@ var Sp00kySync = class Sp00kySync {
 				Category: "sp00ky-client::Sp00kySync::registerQuery"
 			}, "registerQuery error");
 			throw e;
+		} finally {
+			this.dataModule.endFetching(queryHash);
 		}
 	}
 	async createRemoteQuery(queryHash) {
@@ -3515,8 +3933,8 @@ function parseBackendInfo(raw) {
 
 //#endregion
 //#region src/modules/devtools/index.ts
-const CORE_VERSION = "0.0.1-canary.103";
-const WASM_VERSION = "0.0.1-canary.103";
+const CORE_VERSION = "0.0.1-canary.104";
+const WASM_VERSION = "0.0.1-canary.104";
 const SURREAL_VERSION = "3.0.3";
 var DevToolsService = class {
 	eventsHistory = [];
@@ -3572,13 +3990,14 @@ var DevToolsService = class {
 		if (!this.dataManager) return result;
 		this.dataManager.getActiveQueries().forEach((q) => {
 			const queryHash = this.hashString(encodeRecordId(q.config.id));
+			const createdAt = q.config.lastActiveAt instanceof Date ? q.config.lastActiveAt.getTime() : new Date(q.config.lastActiveAt || Date.now()).getTime();
 			result.set(queryHash, {
 				queryHash,
 				status: "active",
 				fetchStatus: q.status,
 				isFetching: q.status === "fetching",
-				createdAt: q.config.lastActiveAt instanceof Date ? q.config.lastActiveAt.getTime() : new Date(q.config.lastActiveAt || Date.now()).getTime(),
-				lastUpdate: Date.now(),
+				createdAt,
+				lastUpdate: q.lastUpdatedAt ?? createdAt,
 				updateCount: q.updateCount,
 				ttl: q.config.ttl,
 				query: q.config.surql,
@@ -4047,6 +4466,8 @@ var StreamProcessorService = class {
 		authId: "",
 		access: ""
 	};
+	stateKeySuffix = "";
+	stateGeneration = 0;
 	constructor(events, db, persistenceClient, logger) {
 		this.events = events;
 		this.db = db;
@@ -4150,10 +4571,34 @@ var StreamProcessorService = class {
 			throw e;
 		}
 	}
+	/** Route the persisted circuit snapshot to a per-bucket key. */
+	setStateKeySuffix(bucketId) {
+		this.stateKeySuffix = bucketId;
+	}
+	stateKey() {
+		return this.stateKeySuffix ? `_00_stream_processor_state:${this.stateKeySuffix}` : "_00_stream_processor_state";
+	}
+	/**
+	* Drop the current WASM processor and start a fresh, empty circuit. Used on
+	* local-bucket switches: the old circuit holds the previous user's rows AND
+	* views registered with the previous `$auth` context, so neither may survive.
+	* Deliberately does NOT `loadState()` — a persisted snapshot references views
+	* under a dead sessionId salt; the DataModule rebind re-registers every live
+	* view against this fresh processor. Caller must re-seed `setPermissions`
+	* afterwards (a fresh circuit default-denies every table).
+	*/
+	async reset() {
+		if (!this.isInitialized) return;
+		this.stateGeneration++;
+		this.batching = false;
+		this.batchBuffer.clear();
+		this.processor = new Sp00kyProcessor();
+		this.logger.info({ Category: "sp00ky-client::StreamProcessorService::reset" }, "Stream processor reset (fresh circuit)");
+	}
 	async loadState() {
 		if (!this.processor) return;
 		try {
-			const result = await this.persistenceClient.get("_00_stream_processor_state");
+			const result = await this.persistenceClient.get(this.stateKey());
 			if (Array.isArray(result) && result.length > 0 && Array.isArray(result[0]) && result[0].length > 0 && result[0][0]?.state) {
 				const state = result[0][0].state;
 				this.logger.info({
@@ -4210,11 +4655,13 @@ var StreamProcessorService = class {
 	}
 	async saveState() {
 		if (!this.processor) return;
+		const generation = this.stateGeneration;
 		try {
 			if (typeof this.processor.save_state === "function") {
 				const state = this.processor.save_state();
+				if (generation !== this.stateGeneration) return;
 				if (state) {
-					await this.persistenceClient.set("_00_stream_processor_state", state);
+					await this.persistenceClient.set(this.stateKey(), state);
 					this.logger.trace({ Category: "sp00ky-client::StreamProcessorService::saveState" }, "State saved");
 				}
 			}
@@ -4457,6 +4904,11 @@ var CacheModule = class {
 	lookup(recordId) {
 		return this.versionLookups[recordId] ?? 0;
 	}
+	/** Drop the version cache on a bucket switch — a stale version would make
+	*  the sync diff skip fetching a body the new bucket legitimately needs. */
+	clearVersionLookups() {
+		this.versionLookups = {};
+	}
 	/**
 	* Save a single record to local DB and ingest into DBSP
 	* Used by mutations (create/update)
@@ -4471,6 +4923,7 @@ var CacheModule = class {
 	*/
 	async saveBatch(records, skipDbInsert = false) {
 		if (records.length === 0) return;
+		const epoch = this.local.epoch;
 		this.logger.debug({
 			count: records.length,
 			Category: "sp00ky-client::CacheModule::saveBatch"
@@ -4498,8 +4951,9 @@ var CacheModule = class {
 						[`content${i}`]: content
 					};
 				}, {});
-				await this.local.execute(query, params);
+				await this.local.execute(query, params, { epoch });
 			}
+			if (this.local.epoch !== epoch) throw new StaleEpochError();
 			const bulk = populatedRecords.map((record) => {
 				const recordId = encodeRecordId(record.record.id);
 				this.versionLookups[recordId] = record.version;
@@ -4516,6 +4970,13 @@ var CacheModule = class {
 				Category: "sp00ky-client::CacheModule::saveBatch"
 			}, "Batch saved successfully");
 		} catch (err) {
+			if (err instanceof StaleEpochError) {
+				this.logger.debug({
+					count: records.length,
+					Category: "sp00ky-client::CacheModule::saveBatch"
+				}, "Dropped batch from before a bucket switch");
+				return;
+			}
 			this.logger.error({
 				err,
 				count: records.length,
@@ -4533,8 +4994,10 @@ var CacheModule = class {
 			id,
 			Category: "sp00ky-client::CacheModule::delete"
 		}, "Deleting record");
+		const epoch = this.local.epoch;
 		try {
-			if (!skipDbDelete) await this.local.query("DELETE $id", { id: parseRecordIdString(id) });
+			if (!skipDbDelete) await this.local.query("DELETE $id", { id: parseRecordIdString(id) }, { epoch });
+			if (this.local.epoch !== epoch) throw new StaleEpochError();
 			delete this.versionLookups[id];
 			this.streamProcessor.ingest(table, "DELETE", id, recordData);
 			this.logger.debug({
@@ -4543,6 +5006,14 @@ var CacheModule = class {
 				Category: "sp00ky-client::CacheModule::delete"
 			}, "Record deleted successfully");
 		} catch (err) {
+			if (err instanceof StaleEpochError) {
+				this.logger.debug({
+					table,
+					id,
+					Category: "sp00ky-client::CacheModule::delete"
+				}, "Dropped delete from before a bucket switch");
+				return;
+			}
 			this.logger.error({
 				err,
 				table,
@@ -4707,7 +5178,14 @@ var CrdtField = class {
 			this.scheduleRemotePush();
 		});
 	}
-	stopSync() {
+	/**
+	* Stop syncing this field. Flushes one final remote push by default so the
+	* last keystrokes aren't lost. Pass `{ flush: false }` on a bucket switch —
+	* the remote session already belongs to the NEXT user, and pushing this
+	* (previous user's) snapshot under it would clobber the record remotely.
+	*/
+	stopSync(options = {}) {
+		const flush = options.flush ?? true;
 		if (this.unsubscribe) {
 			this.unsubscribe();
 			this.unsubscribe = null;
@@ -4716,7 +5194,7 @@ var CrdtField = class {
 			clearTimeout(this.pushTimer);
 			this.pushTimer = null;
 		}
-		if (this.remote && this.recordId) this.pushToRemote();
+		if (flush && this.remote && this.recordId) this.pushToRemote();
 	}
 	importRemote(state) {
 		if (Date.now() - this.lastPushTime < this.remoteDebounceMs + 200) return;
@@ -4937,8 +5415,13 @@ var CrdtManager = class {
 			Category: "sp00ky-client::CrdtManager::close"
 		}, "CrdtField closed");
 	}
-	closeAll() {
-		for (const [_, field] of this.fields) field.stopSync();
+	/**
+	* Close every open field + table LIVE. Fields flush a final remote push by
+	* default; pass `{ flush: false }` on a bucket switch, where that flush
+	* would push the previous user's snapshot under the next user's session.
+	*/
+	closeAll(options = {}) {
+		for (const [_, field] of this.fields) field.stopSync(options);
 		this.fields.clear();
 		for (const table of Array.from(this.liveByTable.keys())) this.killTableSubscription(table);
 	}
@@ -5375,6 +5858,28 @@ var BucketHandle = class {
 		return result;
 	}
 };
+/**
+* Boot hint for which local bucket to open before auth resolves. Written to
+* PLAIN localStorage (never the configured persistenceClient): the surrealdb
+* persistence client stores its keys INSIDE a bucket, and the whole point of
+* the hint is to pick the bucket before any bucket is open. A warm reload of a
+* signed-in user thus opens their own bucket immediately — zero switches.
+* Losing the hint is fail-closed: boot lands on the anon bucket and the auth
+* callback switches to the user's bucket (cache + outbox intact).
+*/
+const LAST_BUCKET_KEY = "sp00ky:last_bucket";
+function readBootBucketHint() {
+	try {
+		return typeof localStorage !== "undefined" ? localStorage.getItem(LAST_BUCKET_KEY) : null;
+	} catch {
+		return null;
+	}
+}
+function writeBootBucketHint(bucketId) {
+	try {
+		if (typeof localStorage !== "undefined") localStorage.setItem(LAST_BUCKET_KEY, bucketId);
+	} catch {}
+}
 var Sp00kyClient = class {
 	local;
 	remote;
@@ -5518,12 +6023,17 @@ var Sp00kyClient = class {
 	async init() {
 		this.logger.info({ Category: "sp00ky-client::Sp00kyClient::init" }, "Sp00kyClient initialization started");
 		try {
-			await this.local.connect();
-			this.logger.debug({ Category: "sp00ky-client::Sp00kyClient::init" }, "Local database connected");
+			const bootBucket = readBootBucketHint() ?? ANON_USER_ID;
+			await this.local.connect(bootBucket);
+			this.logger.debug({
+				bootBucket,
+				Category: "sp00ky-client::Sp00kyClient::init"
+			}, "Local database connected");
 			await this.migrator.provision(this.config.schemaSurql);
 			this.logger.debug({ Category: "sp00ky-client::Sp00kyClient::init" }, "Schema provisioned");
 			await this.remote.connect();
 			this.logger.debug({ Category: "sp00ky-client::Sp00kyClient::init" }, "Remote database connected");
+			this.streamProcessor.setStateKeySuffix(bootBucket);
 			await this.streamProcessor.init();
 			this.streamProcessor.setPermissions(extractSelectPermissions(this.config.schemaSurql));
 			this.logger.debug({ Category: "sp00ky-client::Sp00kyClient::init" }, "StreamProcessor initialized");
@@ -5539,6 +6049,8 @@ var Sp00kyClient = class {
 			this.auth.subscribe(async (userId) => {
 				this.dataModule.setCurrentUserId(userId);
 				this.streamProcessor.setSessionAuth(this.auth.currentUser?.id ? encodeRecordId(this.auth.currentUser.id) : null, this.auth.access);
+				writeBootBucketHint(bucketIdForUser(userId));
+				await this.ensureLocalBucket(userId);
 				const next = await this.fetchSessionId();
 				this.dataModule.setSessionId(next);
 				this.crdtManager.setSessionId(next);
@@ -5564,6 +6076,86 @@ var Sp00kyClient = class {
 			throw e;
 		}
 	}
+	bucketSwitchChain = Promise.resolve();
+	pendingBucketTarget = null;
+	/**
+	* Ensure the local store is this user's bucket, switching if needed. Called
+	* from the auth listener on every auth flip; concurrent calls are chained
+	* and superseded intermediates are skipped (latest target wins).
+	*/
+	ensureLocalBucket(userId) {
+		const target = bucketIdForUser(userId);
+		this.pendingBucketTarget = target;
+		this.bucketSwitchChain = this.bucketSwitchChain.then(async () => {
+			if (this.pendingBucketTarget !== target) return;
+			if (this.local.currentBucketId === target) return;
+			await this.doSwitchBucket(target);
+		});
+		const result = this.bucketSwitchChain;
+		this.bucketSwitchChain = this.bucketSwitchChain.catch(() => {});
+		return result;
+	}
+	/**
+	* The bucket-switch choreography: drain → swap → rebind.
+	*
+	* Drain: sync quiesced (poll/LIVE stopped, in-flight round awaited so its
+	* outbox delete lands in the OLD bucket, debounce timers cancelled),
+	* DataModule timers cleared, CRDT fields closed WITHOUT their final flush
+	* (the remote session already belongs to the next user).
+	*
+	* Swap: gate closes so any local query issued mid-switch (sibling auth
+	* subscribers, FeatureFlagModule) waits and then runs against the NEW
+	* bucket; store swaps open-new-before-close-old; schema provisions
+	* (no-op for a returning bucket); stale `_00_query` rows are wiped (dead
+	* sessionId-salted hashes with stale arrays — record bodies stay warm);
+	* SSP resets to a fresh circuit with re-seeded permissions.
+	*
+	* Rebind: auth token re-persisted (the surrealdb persistence client wrote it
+	* into the OLD bucket's `_00_kv` before this listener ran), active queries
+	* re-homed keeping their hashes, sync resumed on the new bucket's own
+	* outbox, and every query re-registered remotely to refill from the server.
+	*/
+	async doSwitchBucket(target) {
+		this.logger.info({
+			target,
+			from: this.local.currentBucketId,
+			Category: "sp00ky-client::Sp00kyClient::doSwitchBucket"
+		}, "Switching local bucket");
+		await this.sync.prepareBucketSwitch();
+		this.dataModule.quiesce();
+		this.crdtManager.closeAll({ flush: false });
+		const reopen = this.local.beginSwitch();
+		try {
+			await this.local.switchStore(target);
+			await this.migrator.provision(this.config.schemaSurql);
+			await this.local.queryUngated("DELETE _00_query;");
+			this.streamProcessor.setStateKeySuffix(target);
+			await this.streamProcessor.reset();
+			this.streamProcessor.setPermissions(extractSelectPermissions(this.config.schemaSurql));
+			this.cache.clearVersionLookups();
+		} finally {
+			reopen();
+		}
+		if (this.auth.token) try {
+			await this.persistenceClient.set("sp00ky_auth_token", this.auth.token);
+		} catch (e) {
+			this.logger.warn({
+				error: e,
+				Category: "sp00ky-client::Sp00kyClient::doSwitchBucket"
+			}, "Failed to re-persist auth token into the new bucket");
+		}
+		const hashes = await this.dataModule.rebindAfterBucketSwitch();
+		await this.sync.completeBucketSwitch();
+		for (const hash of hashes) this.sync.enqueueDownEvent({
+			type: "register",
+			payload: { hash }
+		});
+		this.logger.info({
+			target,
+			queries: hashes.length,
+			Category: "sp00ky-client::Sp00kyClient::doSwitchBucket"
+		}, "Local bucket switch complete");
+	}
 	async close() {
 		await this.featureFlags.closeAll();
 		this.crdtManager.closeAll();