@spooky-sync/core 0.0.1-canary.171 → 0.0.1-canary.173

package/dist/index.d.ts

@@ -2157,10 +2157,10 @@ declare class Sp00kyClient<S extends SchemaStructure> {
    * Nothing is sent to the server — the `_00_user_feature` assignment is
    * untouched, so clearing restores whatever the server says. Persisted to
    * localStorage, survives reloads, and applies while signed out. Backs the
-   * DevTools Flags tab, and is a convenient hook for tests.
+   * DevTools Access tab, and is a convenient hook for tests.
    *
    * To change a flag for OTHER users you need admin rights (`spky admin add`)
-   * and the DevTools Flags tab, or `spky flag`.
+   * and the DevTools Access tab, or `spky flag`.
    */
   setFeatureOverride(key: string, variant: string | null, payload?: unknown): void;
   /** Drop every local feature flag override set via `setFeatureOverride`. */

package/dist/index.js

@@ -1693,6 +1693,7 @@ function translateStatement(stmt, vars) {
 			};
 		})
 	};
+	if (/^INFO\s+FOR\s+DB(\s+STRUCTURE)?$/i.test(s)) return { kind: "infoForDb" };
 	if (/^(DEFINE|REMOVE|USE|INFO|RETURN|CANCEL|COMMIT|BEGIN)\b/i.test(s)) return { kind: "noop" };
 	let m = /^CREATE\s+ONLY\s+\$(\w+)\s+CONTENT\s+\$(\w+)$/i.exec(s) || /^UPSERT\s+ONLY\s+\$(\w+)\s+REPLACE\s+\$(\w+)$/i.exec(s);
 	if (m) return {
@@ -1701,10 +1702,10 @@ function translateStatement(stmt, vars) {
 		data: asRow(vars[m[2]]),
 		mode: "replace"
 	};
-	m = /^UPSERT\s+ONLY\s+\$(\w+)\s+MERGE\s+\$(\w+)$/i.exec(s) || /^UPDATE\s+ONLY\s+\$(\w+)\s+MERGE\s+\$(\w+)$/i.exec(s);
+	m = idRe(String.raw`^UPSERT\s+ONLY\s+%ID%\s+MERGE\s+\$(\w+)$`).exec(s) || idRe(String.raw`^UPDATE\s+(?:ONLY\s+)?%ID%\s+MERGE\s+\$(\w+)$`).exec(s);
 	if (m) return {
 		kind: "upsert",
-		id: rid(vars[m[1]]),
+		id: idOperand(m[1], vars),
 		data: asRow(vars[m[2]]),
 		mode: "merge"
 	};
@@ -1719,54 +1720,132 @@ function translateStatement(stmt, vars) {
 			mode: "replace"
 		};
 	}
-	m = /^UPDATE\s+\$(\w+)\s+SET\s+(.+?)(\s+RETURN\s+NONE)?$/i.exec(s);
+	m = idRe(String.raw`^UPDATE\s+%ID%\s+SET\s+(.+?)(\s+RETURN\s+NONE)?$`).exec(s);
 	if (m) return {
 		kind: "updateSet",
-		id: rid(vars[m[1]]),
+		id: idOperand(m[1], vars),
 		sets: parseSetClauses(m[2], vars),
 		returnNone: !!m[3]
 	};
-	m = /^DELETE\s+\$(\w+)$/i.exec(s);
-	if (m) return {
-		kind: "delete",
-		id: rid(vars[m[1]])
-	};
 	m = /^DELETE\s+([A-Za-z_]\w*)$/i.exec(s);
 	if (m) return {
 		kind: "deleteAll",
 		table: m[1]
 	};
-	m = /^SELECT\s+(VALUE\s+)?(.+?)\s+FROM\s+ONLY\s+\$(\w+)$/i.exec(s);
+	m = idRe(String.raw`^DELETE\s+%ID%$`).exec(s);
+	if (m) return {
+		kind: "delete",
+		id: idOperand(m[1], vars)
+	};
+	const { head, limit, start } = peelWindow(s, vars);
+	m = /^SELECT\s+count\(\)\s+FROM\s+([A-Za-z_]\w*)(?:\s+WHERE\s+(.+?))?\s+GROUP\s+ALL$/i.exec(head);
+	if (m) return {
+		kind: "count",
+		table: m[1],
+		where: m[2] ? parseWhere(m[2], vars) : void 0
+	};
+	m = idRe(String.raw`^SELECT\s+(VALUE\s+)?(.+?)\s+FROM\s+ONLY\s+%ID%$`).exec(head);
 	if (m) {
 		const value = m[1] ? m[2].trim() : void 0;
 		return {
 			kind: "getById",
-			id: rid(vars[m[3]]),
+			id: idOperand(m[3], vars),
 			select: projFields(m[2], !!m[1]),
 			value
 		};
 	}
-	m = /^SELECT\s+(VALUE\s+)?(.+?)\s+FROM\s+\$(\w+)$/i.exec(s);
+	m = /^SELECT\s+(VALUE\s+)?(.+?)\s+FROM\s+\$(\w+)$/i.exec(head);
 	if (m) {
 		const value = m[1] ? m[2].trim() : void 0;
 		return {
 			kind: "selectByIds",
 			ids: vars[m[3]] ?? [],
 			select: projFields(m[2], !!m[1]),
-			value
+			value,
+			limit,
+			start
 		};
 	}
-	m = /^SELECT\s+(VALUE\s+)?(.+?)\s+FROM\s+([A-Za-z_]\w*)(?:\s+WHERE\s+(.+?))?(?:\s+ORDER\s+BY\s+(.+?))?$/i.exec(s);
+	m = /^SELECT\s+(VALUE\s+)?(.+?)\s+FROM\s+([A-Za-z_]\w*)(?:\s+WHERE\s+(.+?))?(?:\s+ORDER\s+BY\s+(.+?))?$/i.exec(head);
 	if (m) return {
 		kind: "selectTable",
 		table: m[3],
 		where: m[4] ? parseWhere(m[4], vars) : void 0,
 		orderBy: m[5] ? parseOrderBy(m[5]) : void 0,
 		select: projFields(m[2], !!m[1]),
-		value: m[1] ? m[2].trim() : void 0
+		value: m[1] ? m[2].trim() : void 0,
+		limit,
+		start
 	};
 	throw new Error(`SqliteCacheEngine: unsupported SurrealQL for translation: ${stmt}`);
 }
+/**
+* Split a SELECT's trailing `LIMIT n [START m]` off its head.
+*
+* Peeled rather than folded into the SELECT regexes because those match WHERE
+* and ORDER BY lazily: with the window left in place the WHERE group happily
+* expands over `… LIMIT 20`, which is how `SELECT * FROM t LIMIT 20 START 0`
+* ended up unmatched entirely.
+*
+* A tail sitting inside a string literal (`WHERE note = 'LIMIT 5'`) is left
+* alone — an odd quote count in the head means the match is inside a string.
+*/
+function peelWindow(stmt, vars) {
+	let head = stmt;
+	let limit;
+	let start;
+	const peel = (re) => {
+		const m = re.exec(head);
+		if (!m) return void 0;
+		const before = head.slice(0, m.index);
+		if (countQuotes(before) % 2 !== 0) return void 0;
+		head = before;
+		return m[1];
+	};
+	const startTok = peel(/\s+START(?:\s+AT)?\s+(\$?\w+)\s*$/i);
+	const limitTok = peel(/\s+LIMIT(?:\s+BY)?\s+(\$?\w+)\s*$/i);
+	if (startTok !== void 0) start = numOperand(startTok, vars);
+	if (limitTok !== void 0) limit = numOperand(limitTok, vars);
+	return {
+		head,
+		limit,
+		start
+	};
+}
+function countQuotes(s) {
+	let n = 0;
+	for (let i = 0; i < s.length; i++) if (s[i] === "'" && s[i - 1] !== "\\") n++;
+	return n;
+}
+/** A `LIMIT`/`START` operand: a literal integer or a `$var` holding one. */
+function numOperand(token, vars) {
+	const raw = token.startsWith("$") ? vars[token.slice(1)] : token;
+	const n = Number(raw);
+	return Number.isFinite(n) ? n : void 0;
+}
+/**
+* A single-record operand: `$var` or a LITERAL `table:id`.
+*
+* A bare identifier deliberately does NOT match: in SurrealQL that is a table,
+* and `UPDATE game MERGE $x` rewrites every row of `game` — a shape this
+* vocabulary does not implement. Not matching means such a statement reaches
+* the "unsupported SurrealQL" throw instead of quietly writing one row called
+* `game`.
+*/
+const ID_TOKEN = String.raw`(\$\w+|[A-Za-z_]\w*:\S+)`;
+/** Build a statement regex, `%ID%` expanding to {@link ID_TOKEN}. */
+function idRe(pattern) {
+	return new RegExp(pattern.replace("%ID%", ID_TOKEN), "i");
+}
+/**
+* Resolve an {@link ID_TOKEN} match. Literals matter because the DevTools row
+* editor inlines the id (`UPDATE game:abc MERGE $updates`) rather than binding
+* it; `stableKey` treats that string and a `RecordId` identically downstream.
+*/
+function idOperand(token, vars) {
+	const t = token.trim();
+	return t.startsWith("$") ? rid(vars[t.slice(1)]) : t;
+}
 function projFields(proj, isValue) {
 	const p = proj.trim();
 	if (isValue) return void 0;
@@ -2680,14 +2759,44 @@ var SqliteCacheEngine = class {
 					select: op.select,
 					orderBy: op.orderBy
 				});
+				if (op.start !== void 0 || op.limit !== void 0) {
+					const from = op.start ?? 0;
+					rows = rows.slice(from, op.limit === void 0 ? void 0 : from + op.limit);
+				}
 				if (op.value) return rows.map((r) => r[op.value]);
 				return rows;
 			}
 			case "selectTable": {
-				const rows = await this.rawSelectTable(op.table, op.where, op.orderBy);
+				const rows = await this.rawSelectTable(op.table, op.where, op.orderBy, {
+					limit: op.limit,
+					start: op.start
+				});
 				if (op.value) return rows.map((r) => r[op.value]);
 				return op.select ? rows.map((r) => project(r, op.select)) : rows;
 			}
+			case "count": {
+				await this.ensureTable(op.table);
+				const bind = [];
+				let sql = `SELECT COUNT(*) AS n FROM "${op.table}"`;
+				if (op.where && op.where.length > 0) sql += ` WHERE ${renderWhereSql(op.where, bind, {})}`;
+				const { rows } = await this.call("exec", {
+					sql,
+					bind
+				});
+				return [{ count: rows?.[0]?.n ?? 0 }];
+			}
+			case "infoForDb": {
+				const { rows } = await this.call("exec", { sql: "SELECT name FROM sqlite_master WHERE type = 'table' AND name NOT LIKE 'sqlite_%' ORDER BY name" });
+				const tables = {};
+				for (const r of rows ?? []) tables[r.name] = `DEFINE TABLE ${r.name} SCHEMALESS`;
+				return {
+					tables,
+					analyzers: {},
+					functions: {},
+					params: {},
+					users: {}
+				};
+			}
 			case "upsert":
 				await this.upsert(tableOf(op.id), op.id, op.data, op.mode);
 				return pureWriteOpResult(op);
@@ -2774,12 +2883,15 @@ var SqliteCacheEngine = class {
 		}
 		if (stmts.length > 0) await this.call("batch", stmts);
 	}
-	async rawSelectTable(table, where, orderBy) {
+	async rawSelectTable(table, where, orderBy, window) {
 		await this.ensureTable(table);
 		const bind = [];
 		let sql = `SELECT data FROM "${table}"`;
 		if (where && where.length > 0) sql += ` WHERE ${renderWhereSql(where, bind, {})}`;
 		if (orderBy && orderBy.length > 0) sql += renderOrderSql(orderBy);
+		if (window?.limit !== void 0) sql += ` LIMIT ${Number(window.limit)}`;
+		else if (window?.start !== void 0) sql += " LIMIT -1";
+		if (window?.start !== void 0) sql += ` OFFSET ${Number(window.start)}`;
 		return this.execRows(sql, bind);
 	}
 	async transaction(fn) {
@@ -3069,6 +3181,13 @@ function mutationOwnerTabId(mutationId) {
 
 //#endregion
 //#region src/modules/data/index.ts
+/**
+* How many consecutive empty `_00_list_ref` reads it takes to believe a query
+* really is empty, before any non-empty set has been seen this session. One
+* read is the registration race (the SSP flushes a view's initial edges
+* asynchronously); the second comes from the poll a cycle later.
+*/
+const EMPTY_MEMBERSHIP_CONFIRMATIONS = 2;
 /** Push a timing sample (ms) into a rolling window, capped at the sample window. */
 function pushSample(samples, ms) {
 	samples.push(ms);
@@ -3899,9 +4018,25 @@ var DataModule = class {
 			}, "Query to update remote array not found");
 			return;
 		}
+		if (remoteArray.length === 0 && !queryState.config.remoteSeen) {
+			const emptyReads = (queryState.config.emptyReads ?? 0) + 1;
+			queryState.config.emptyReads = emptyReads;
+			if (emptyReads < EMPTY_MEMBERSHIP_CONFIRMATIONS) {
+				this.logger.debug({
+					hash,
+					emptyReads,
+					Category: "sp00ky-client::DataModule::updateQueryRemoteArray"
+				}, "Ignoring unconfirmed empty membership (server may not have flushed list_ref yet)");
+				return;
+			}
+		}
 		const epoch = this.local.epoch;
 		queryState.config.remoteArray = remoteArray;
 		queryState.config.membershipKnown = true;
+		if (remoteArray.length > 0) {
+			queryState.config.remoteSeen = true;
+			queryState.config.emptyReads = 0;
+		}
 		if (queryState.config.membershipKey) await this.writeWindowMembership(queryState.config.membershipKey, remoteArray);
 		try {
 			await this.local.query(surql.seal(surql.updateSet("id", ["remoteArray"])), {
@@ -3951,9 +4086,11 @@ var DataModule = class {
 			config.remoteArray = [];
 			config.subqueryRemoteArray = void 0;
 			config.membershipKnown = false;
+			config.remoteSeen = false;
+			config.emptyReads = 0;
 			if (config.membershipKey) {
 				const durable = await this.getWindowMembership(config.membershipKey);
-				if (durable) {
+				if (durable?.length) {
 					config.remoteArray = durable;
 					config.membershipKnown = true;
 				}
@@ -4381,7 +4518,7 @@ var DataModule = class {
 		};
 		if (membershipKey && !config.remoteArray?.length) {
 			const durable = await this.getWindowMembership(membershipKey);
-			if (durable) {
+			if (durable?.length) {
 				config.remoteArray = durable;
 				config.membershipKnown = true;
 			}
@@ -6577,7 +6714,7 @@ var FlagsAdminService = class {
 		this.deps = deps;
 	}
 	/**
-	* Everything the Flags tab renders, in one round trip per source.
+	* Everything the Access tab renders, in one round trip per source.
 	*
 	* Each section fails independently: a remote read that throws downgrades to
 	* `isAdmin: false` plus an `error`, while local assignments and overrides
@@ -6609,7 +6746,7 @@ var FlagsAdminService = class {
 		try {
 			snapshot.isAdmin = statementRows(await this.deps.remote.query("SELECT VALUE id FROM _00_admin WHERE user = $auth.id LIMIT 1")).length > 0;
 		} catch (err) {
-			snapshot.error = `Could not check admin status: ${message(err)}. If this deployment predates the Flags tab, run \`spky migrate\` (or redeploy) to apply the internal schema.`;
+			snapshot.error = `Could not check admin status: ${message(err)}. If this deployment predates the Access tab, run \`spky migrate\` (or redeploy) to apply the internal schema.`;
 			return snapshot;
 		}
 		if (!snapshot.isAdmin) return snapshot;
@@ -6729,8 +6866,8 @@ function selfAllowlistedVariant(flag, userId) {
 
 //#endregion
 //#region src/modules/devtools/index.ts
-const CORE_VERSION = "0.0.1-canary.171";
-const WASM_VERSION = "0.0.1-canary.171";
+const CORE_VERSION = "0.0.1-canary.173";
+const WASM_VERSION = "0.0.1-canary.173";
 const SURREAL_VERSION = "3.0.3";
 var DevToolsService = class DevToolsService {
 	eventsHistory = [];
@@ -6955,6 +7092,7 @@ var DevToolsService = class DevToolsService {
 			database: {
 				tables: this.localTables.length ? this.localTables : this.schema.tables.map((t) => t.name),
 				tableData: {},
+				engine: this.databaseService.engineKind ?? "custom",
 				storage: this.databaseService.storageHealth ?? {
 					status: "unknown",
 					fallback: false
@@ -7088,7 +7226,7 @@ var DevToolsService = class DevToolsService {
 		return data;
 	}
 	/**
-	* Hand the FeatureFlagModule to the Flags tab so it can read and write local
+	* Hand the FeatureFlagModule to the Access tab so it can read and write local
 	* overrides. Called from `Sp00kyClient` once both are constructed; until then
 	* the override methods are no-ops that report an empty map.
 	*/
@@ -11160,7 +11298,7 @@ var Sp00kyClient = class {
 		return new TabsCoordinator({
 			tabId,
 			fingerprint: computeTabsFingerprint({
-				coreVersion: "0.0.1-canary.171",
+				coreVersion: "0.0.1-canary.173",
 				schemaHash: hash53(this.config.schemaSurql),
 				endpoint: this.config.database.endpoint ?? "",
 				namespace: this.config.database.namespace,
@@ -11506,10 +11644,10 @@ var Sp00kyClient = class {
 	* Nothing is sent to the server — the `_00_user_feature` assignment is
 	* untouched, so clearing restores whatever the server says. Persisted to
 	* localStorage, survives reloads, and applies while signed out. Backs the
-	* DevTools Flags tab, and is a convenient hook for tests.
+	* DevTools Access tab, and is a convenient hook for tests.
 	*
 	* To change a flag for OTHER users you need admin rights (`spky admin add`)
-	* and the DevTools Flags tab, or `spky flag`.
+	* and the DevTools Access tab, or `spky flag`.
 	*/
 	setFeatureOverride(key, variant, payload) {
 		this.featureFlags.setLocalOverride(key, variant, payload);

package/dist/types.d.ts

@@ -815,6 +815,29 @@ interface QueryConfig {
    * `remoteArray.length === 0` check cannot tell those apart.
    */
   membershipKnown?: boolean;
+  /**
+   * Whether a NON-EMPTY id-set has arrived from the server for this query in
+   * this session. Gates whether an empty read may be believed.
+   *
+   * The server publishes `_00_list_ref` asynchronously — the SSP queues a
+   * view's initial edges to a coalescing flusher and returns from
+   * `fn::query::register` before they land — so an empty read right after
+   * registration says nothing about the query being empty. Believing it (and
+   * mirroring it to the durable `_00_window` row) blanked lists and kept them
+   * blank across reloads. Once a real set has been seen, a later empty one is a
+   * genuine transition and must be honoured, or removed rows resurrect.
+   *
+   * In-memory only: a fresh session must re-earn the right to believe empties.
+   */
+  remoteSeen?: boolean;
+  /**
+   * Consecutive empty id-sets read from the server while `remoteSeen` is still
+   * false. Bounds how long an unconfirmed empty may be ignored, so a window
+   * that genuinely emptied while this device was away is believed on the second
+   * read instead of rendering stale rows forever. Reset by any non-empty set.
+   * In-memory only.
+   */
+  emptyReads?: number;
   /**
    * Key of this query's durable `_00_window` membership row: a hash of
    * `{surql, params}` WITHOUT the `session::id()` salt that `id` carries, so it

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@spooky-sync/core",
-  "version": "0.0.1-canary.171",
+  "version": "0.0.1-canary.173",
   "type": "module",
   "sideEffects": false,
   "main": "./dist/index.js",
@@ -60,8 +60,8 @@
     }
   },
   "dependencies": {
-    "@spooky-sync/query-builder": "0.0.1-canary.171",
-    "@spooky-sync/ssp-wasm": "0.0.1-canary.171",
+    "@spooky-sync/query-builder": "0.0.1-canary.173",
+    "@spooky-sync/ssp-wasm": "0.0.1-canary.173",
     "@sqlite.org/sqlite-wasm": "3.53.0-build1",
     "@surrealdb/wasm": "^3.0.3",
     "fast-json-patch": "^3.1.1",

package/src/modules/data/data.membership.test.ts

@@ -280,6 +280,73 @@ describe('membership-authoritative rendering', () => {
       expect(ids(fresh.records)).toEqual(['thread:a', 'thread:b', 'thread:c']);
     });
 
+    it('ignores an empty id-set until a real one has been seen', async () => {
+      // The registration race: the SSP queues a view's initial edges to a
+      // coalescing flusher and returns from `fn::query::register` before they
+      // land, so this read says nothing about the query being empty. Believing
+      // it rendered a blank list AND persisted the blankness.
+      const { dm, state, local, hash } = setup({
+        membershipKey: 'stable-key',
+        remoteArray: [['thread:a', 1]],
+        membershipKnown: true,
+      });
+
+      await dm.updateQueryRemoteArray(hash, []);
+
+      expect(state.config.remoteArray).toEqual([['thread:a', 1]]);
+      expect(local.windowRows.has('stable-key')).toBe(false);
+    });
+
+    it('believes an empty id-set once a non-empty one has arrived', async () => {
+      // The genuine transition — the last row left the window. Honouring it is
+      // what stops a removed row resurrecting from the local body cache.
+      const { dm, state, local, hash } = setup({ membershipKey: 'stable-key' });
+
+      await dm.updateQueryRemoteArray(hash, [['thread:a', 1]]);
+      await dm.updateQueryRemoteArray(hash, []);
+
+      expect(state.config.membershipKnown).toBe(true);
+      expect(state.config.remoteArray).toEqual([]);
+      expect(local.windowRows.get('stable-key')).toMatchObject({ ids: [] });
+    });
+
+    it('believes a repeated empty id-set even with nothing seen this session', async () => {
+      // A window that really did empty while this device was away: the durable
+      // seed must not render forever, so the second read is taken at face value.
+      const { dm, state, hash } = setup({
+        membershipKey: 'stable-key',
+        remoteArray: [['thread:a', 1]],
+        membershipKnown: true,
+      });
+
+      await dm.updateQueryRemoteArray(hash, []);
+      expect(state.config.remoteArray).toEqual([['thread:a', 1]]);
+
+      await dm.updateQueryRemoteArray(hash, []);
+      expect(state.config.remoteArray).toEqual([]);
+    });
+
+    it('does not seed membership from an empty durable row', async () => {
+      // Self-heals devices poisoned before the guard existed: an empty durable
+      // row is indistinguishable from "never had membership", so it must fall
+      // back to the scan rather than paint an empty list.
+      const { dm, local } = setup({ membershipKey: 'stable-key' });
+      local.windowRows.set('stable-key', { ids: [] });
+
+      const fresh = await (dm as any).createNewQuery({
+        recordId: new RecordId('_00_query', 'h-poisoned'),
+        surql: 'SELECT * FROM thread WHERE done = false;',
+        params: {},
+        ttl: '10m',
+        tableName: 'thread',
+        plan,
+        membershipKey: 'stable-key',
+      });
+
+      expect(fresh.config.membershipKnown).toBeFalsy();
+      expect(ids(fresh.records)).toEqual(['thread:a', 'thread:b', 'thread:c']);
+    });
+
     it('derives the membership key without the session salt', async () => {
       const { dm } = setup();
       const key = () => (dm as any).calculateMembershipKey({ surql: 'X', params: {} });

package/src/modules/data/index.ts

@@ -52,6 +52,14 @@ import {
 } from './window-query';
 import { mintMutationId } from './mutation-id';
 
+/**
+ * How many consecutive empty `_00_list_ref` reads it takes to believe a query
+ * really is empty, before any non-empty set has been seen this session. One
+ * read is the registration race (the SSP flushes a view's initial edges
+ * asynchronously); the second comes from the poll a cycle later.
+ */
+const EMPTY_MEMBERSHIP_CONFIRMATIONS = 2;
+
 /** Push a timing sample (ms) into a rolling window, capped at the sample window. */
 function pushSample(samples: number[], ms: number): void {
   samples.push(ms);
@@ -1198,12 +1206,49 @@ export class DataModule<S extends SchemaStructure> {
       );
       return;
     }
+    // An empty id-set is only believable once a real one has arrived in this
+    // session. `_00_list_ref` is published asynchronously — the SSP queues a
+    // view's initial edges to a coalescing flusher and returns from
+    // `fn::query::register` before they land — so an empty read right after
+    // registration is routinely just "not flushed yet", for a query that has
+    // rows. Taking it at face value latched `membershipKnown` on an empty set,
+    // which renders nothing (no scan fallback), and mirrored `[]` into the
+    // durable `_00_window` row, which kept the list blank across reloads.
+    //
+    // Ignoring it entirely (rather than storing `[]` with the latch withheld)
+    // is deliberate: on a cold start `remoteArray` is seeded from the durable
+    // row, and overwriting that with `[]` would blank the very rows the seed
+    // exists to paint. The `_00_list_ref` poll re-reads within ~500ms and
+    // delivers the real set.
+    // Bounded, though: a query seeded from the durable row on a cold start has
+    // `remoteSeen === false`, and if its window really did empty while this
+    // device was away, the server will keep answering `[]`. Believe it on the
+    // second such read — one poll cycle (~500ms) past the flush window — so
+    // stale rows can't render forever.
+    if (remoteArray.length === 0 && !queryState.config.remoteSeen) {
+      const emptyReads = (queryState.config.emptyReads ?? 0) + 1;
+      queryState.config.emptyReads = emptyReads;
+      if (emptyReads < EMPTY_MEMBERSHIP_CONFIRMATIONS) {
+        this.logger.debug(
+          { hash, emptyReads, Category: 'sp00ky-client::DataModule::updateQueryRemoteArray' },
+          'Ignoring unconfirmed empty membership (server may not have flushed list_ref yet)'
+        );
+        return;
+      }
+    }
+
     const epoch = this.local.epoch;
     queryState.config.remoteArray = remoteArray;
     // The single point where authoritative membership arrives (registration and
     // the `_00_list_ref` poll both land here), so it is where "we now know the
     // membership" is latched and where the durable mirror is written.
     queryState.config.membershipKnown = true;
+    if (remoteArray.length > 0) {
+      // Earns the right to believe a later empty set — that transition is a
+      // genuine removal and must be honoured, or removed rows resurrect.
+      queryState.config.remoteSeen = true;
+      queryState.config.emptyReads = 0;
+    }
     if (queryState.config.membershipKey) {
       await this.writeWindowMembership(queryState.config.membershipKey, remoteArray);
     }
@@ -1269,9 +1314,15 @@ export class DataModule<S extends SchemaStructure> {
       // unknown so the first paint falls back to a scan instead of rendering an
       // empty list until the server answers.
       config.membershipKnown = false;
+      // The new bucket's server sets have not been seen yet — an empty read
+      // must be re-confirmed there too.
+      config.remoteSeen = false;
+      config.emptyReads = 0;
       if (config.membershipKey) {
         const durable = await this.getWindowMembership(config.membershipKey);
-        if (durable) {
+        // Length-checked for the same reason as the cold-start read above: an
+        // empty durable row is indistinguishable from "never had membership".
+        if (durable?.length) {
           config.remoteArray = durable;
           config.membershipKnown = true;
         }
@@ -1957,7 +2008,11 @@ export class DataModule<S extends SchemaStructure> {
     // removed row reappearing after a reload, and it works with no network.
     if (membershipKey && !config.remoteArray?.length) {
       const durable = await this.getWindowMembership(membershipKey);
-      if (durable) {
+      // `durable.length` on purpose: an empty durable row cannot be told apart
+      // from one written before this device ever saw a real id-set, and treating
+      // it as known means the first paint is empty with no scan fallback. It
+      // also self-heals devices poisoned by the pre-fix `writeWindowMembership`.
+      if (durable?.length) {
         config.remoteArray = durable;
         config.membershipKnown = true;
       }

package/src/modules/devtools/flags.ts

@@ -150,7 +150,7 @@ export class FlagsAdminService {
   constructor(private deps: FlagsAdminDeps) {}
 
   /**
-   * Everything the Flags tab renders, in one round trip per source.
+   * Everything the Access tab renders, in one round trip per source.
    *
    * Each section fails independently: a remote read that throws downgrades to
    * `isAdmin: false` plus an `error`, while local assignments and overrides
@@ -196,7 +196,7 @@ export class FlagsAdminService {
     } catch (err) {
       // A missing `_00_admin` table means the deployment hasn't applied the
       // internal schema yet. Say so — otherwise it reads as "not an admin".
-      snapshot.error = `Could not check admin status: ${message(err)}. If this deployment predates the Flags tab, run \`spky migrate\` (or redeploy) to apply the internal schema.`;
+      snapshot.error = `Could not check admin status: ${message(err)}. If this deployment predates the Access tab, run \`spky migrate\` (or redeploy) to apply the internal schema.`;
       return snapshot;
     }
 

package/src/modules/devtools/index.ts

@@ -86,7 +86,7 @@ export class DevToolsService implements StreamUpdateReceiver {
   private localTablesFetching = false;
   private localTablesAt = 0;
 
-  // Feature flag admin, backing the panel's Flags tab. The local-override
+  // Feature flag admin, backing the panel's Access tab. The local-override
   // store is injected later (`setFeatureFlagOverrides`) because the
   // FeatureFlagModule is built after this service.
   private featureOverrides: LocalOverrideStore | null = null;
@@ -370,6 +370,10 @@ export class DevToolsService implements StreamUpdateReceiver {
           ? this.localTables
           : this.schema.tables.map((t) => t.name),
         tableData: {},
+        // Which backend answers "Local". The Database explorer labels its source
+        // picker with it and explains translation failures against `sqlite`,
+        // whose SurrealQL vocabulary is a bounded subset.
+        engine: this.databaseService.engineKind ?? 'custom',
         // Durability of the local store. `fallback: true` means persistence was
         // requested but the dataset is actually sitting in RAM.
         storage: this.databaseService.storageHealth ?? { status: 'unknown', fallback: false },
@@ -545,7 +549,7 @@ export class DevToolsService implements StreamUpdateReceiver {
   }
 
   /**
-   * Hand the FeatureFlagModule to the Flags tab so it can read and write local
+   * Hand the FeatureFlagModule to the Access tab so it can read and write local
    * overrides. Called from `Sp00kyClient` once both are constructed; until then
    * the override methods are no-ops that report an empty map.
    */
@@ -558,7 +562,7 @@ export class DevToolsService implements StreamUpdateReceiver {
       (window as any).__00__ = {
         version: this.version,
         getState: () => this.getState(),
-        // ---- Feature flags (Flags tab) --------------------------------
+        // ---- Feature flags (Access tab) --------------------------------
         // Remote reads/writes are admin-gated by SurrealDB, not here: a
         // non-admin gets an empty flag list, and the `fn::feature::*` calls
         // are denied outright. The override methods are purely local and

package/src/services/database/sqlite-cache-engine.ts

@@ -906,14 +906,44 @@ export class SqliteCacheEngine implements LocalStore {
           select: op.select,
           orderBy: op.orderBy,
         });
+        // Windowed in JS, not SQL: the id list is already the whole result set,
+        // and its order is restored after the fetch (see selectByIds).
+        if (op.start !== undefined || op.limit !== undefined) {
+          const from = op.start ?? 0;
+          rows = rows.slice(from, op.limit === undefined ? undefined : from + op.limit);
+        }
         if (op.value) return rows.map((r) => r[op.value!]);
         return rows;
       }
       case 'selectTable': {
-        const rows = await this.rawSelectTable(op.table, op.where, op.orderBy);
+        const rows = await this.rawSelectTable(op.table, op.where, op.orderBy, {
+          limit: op.limit,
+          start: op.start,
+        });
         if (op.value) return rows.map((r) => r[op.value!]);
         return op.select ? rows.map((r) => project(r, op.select!)) : rows;
       }
+      case 'count': {
+        await this.ensureTable(op.table);
+        const bind: unknown[] = [];
+        let sql = `SELECT COUNT(*) AS n FROM "${op.table}"`;
+        if (op.where && op.where.length > 0) sql += ` WHERE ${renderWhereSql(op.where, bind, {})}`;
+        const { rows } = await this.call<{ rows: { n: number }[] }>('exec', { sql, bind });
+        // `GROUP ALL` collapses to a single `{ count }` row on SurrealDB; match
+        // it exactly so callers can read `rows[0].count` on either engine.
+        return [{ count: rows?.[0]?.n ?? 0 }];
+      }
+      case 'infoForDb': {
+        const { rows } = await this.call<{ rows: { name: string }[] }>('exec', {
+          sql: "SELECT name FROM sqlite_master WHERE type = 'table' AND name NOT LIKE 'sqlite_%' ORDER BY name",
+        });
+        // SurrealDB answers with the DEFINE statement per table. Nothing here
+        // parses it (the DevTools explorer only reads the keys), so a truthful
+        // schemaless stand-in beats inventing field definitions.
+        const tables: Record<string, string> = {};
+        for (const r of rows ?? []) tables[r.name] = `DEFINE TABLE ${r.name} SCHEMALESS`;
+        return { tables, analyzers: {}, functions: {}, params: {}, users: {} };
+      }
       case 'upsert':
         await this.upsert(tableOf(op.id), op.id, op.data, op.mode);
         // Cheap return — no read-back. The full merged row is only needed by a
@@ -1018,13 +1048,19 @@ export class SqliteCacheEngine implements LocalStore {
   private async rawSelectTable(
     table: string,
     where?: WhereNode[],
-    orderBy?: OrderBy
+    orderBy?: OrderBy,
+    window?: { limit?: number; start?: number }
   ): Promise<Row[]> {
     await this.ensureTable(table);
     const bind: unknown[] = [];
     let sql = `SELECT data FROM "${table}"`;
     if (where && where.length > 0) sql += ` WHERE ${renderWhereSql(where, bind, {})}`;
     if (orderBy && orderBy.length > 0) sql += renderOrderSql(orderBy);
+    // SQLite has no bare OFFSET, so a START without a LIMIT needs `LIMIT -1`
+    // (its documented "no limit" sentinel) to stay valid SQL.
+    if (window?.limit !== undefined) sql += ` LIMIT ${Number(window.limit)}`;
+    else if (window?.start !== undefined) sql += ' LIMIT -1';
+    if (window?.start !== undefined) sql += ` OFFSET ${Number(window.start)}`;
     return this.execRows(sql, bind);
   }
 

package/src/services/database/sqlite-devtools-queries.integration.test.ts

@@ -0,0 +1,143 @@
+import { describe, it, expect, beforeAll } from 'vitest';
+import sqlite3InitModule from '@sqlite.org/sqlite-wasm';
+import { SqliteCacheEngine } from './sqlite-cache-engine';
+import { stubTransport } from './sqlite-transport.fixture';
+import { serializeRow } from './sqlite-plan-sql';
+import type { Row } from './cache-engine';
+
+/**
+ * Integration: the DevTools Database explorer's statements run end-to-end
+ * (translate → engine SQL → REAL in-memory SQLite, the same
+ * @sqlite.org/sqlite-wasm build the worker loads). The unit test asserts the
+ * translation; this asserts the SQL actually executes and returns the right
+ * rows — the paging window in particular is easy to render into invalid SQLite
+ * (there is no bare OFFSET).
+ */
+
+let db: any;
+
+function makeLogger(): any {
+  const noop = () => {};
+  const l: any = { debug: noop, info: noop, warn: noop, error: noop, trace: noop };
+  l.child = () => l;
+  return l;
+}
+
+/** An engine whose transport is a real SQLite database. */
+function realEngine(): SqliteCacheEngine {
+  const engine = new SqliteCacheEngine({ namespace: 'n', database: 'd' } as any, makeLogger());
+  stubTransport(engine, (type, payload: any) => {
+    switch (type) {
+      case 'open':
+        for (const t of payload.systemTables ?? []) {
+          db.exec({
+            sql: `CREATE TABLE IF NOT EXISTS "${t}" (id TEXT PRIMARY KEY, data TEXT NOT NULL)`,
+          });
+        }
+        return { persisted: true };
+      case 'exec':
+        return {
+          rows: db.exec({
+            sql: payload.sql,
+            bind: payload.bind,
+            rowMode: 'object',
+            returnValue: 'resultRows',
+          }),
+        };
+      case 'run':
+        db.exec({ sql: payload.sql, bind: payload.bind });
+        return {};
+      case 'batch':
+        for (const stmt of payload as { sql: string; bind?: unknown[] }[]) {
+          db.exec({ sql: stmt.sql, bind: stmt.bind });
+        }
+        return {};
+      default:
+        return {};
+    }
+  });
+  return engine;
+}
+
+function seed(table: string, rows: Row[]): void {
+  db.exec({
+    sql: `CREATE TABLE IF NOT EXISTS "${table}" (id TEXT PRIMARY KEY, data TEXT NOT NULL)`,
+  });
+  for (const row of rows) {
+    db.exec({
+      sql: `INSERT INTO "${table}"(id, data) VALUES(?, ?)`,
+      bind: [row.id, serializeRow(row)],
+    });
+  }
+}
+
+beforeAll(async () => {
+  const sqlite3: any = await sqlite3InitModule();
+  db = new sqlite3.oo1.DB(':memory:', 'c');
+  seed(
+    'game_insight',
+    Array.from({ length: 5 }, (_, i) => ({
+      id: `game_insight:${i}`,
+      n: i,
+      tag: i % 2 ? 'odd' : 'even',
+    }))
+  );
+});
+
+describe('DevTools explorer against real SQLite', () => {
+  it('pages a table with LIMIT/START', async () => {
+    const engine = realEngine();
+    await engine.connect('anon');
+
+    const [page1] = await engine.query<[Row[]]>('SELECT * FROM game_insight LIMIT 2 START 0');
+    const [page2] = await engine.query<[Row[]]>('SELECT * FROM game_insight LIMIT 2 START 2');
+    const [tail] = await engine.query<[Row[]]>('SELECT * FROM game_insight LIMIT 20 START 4');
+
+    expect(page1.map((r) => r.id)).toEqual(['game_insight:0', 'game_insight:1']);
+    expect(page2.map((r) => r.id)).toEqual(['game_insight:2', 'game_insight:3']);
+    expect(tail.map((r) => r.id)).toEqual(['game_insight:4']);
+  });
+
+  it('counts rows, with and without a filter', async () => {
+    const engine = realEngine();
+    await engine.connect('anon');
+
+    const [all] = await engine.query<[{ count: number }[]]>(
+      'SELECT count() FROM game_insight GROUP ALL'
+    );
+    const [odd] = await engine.query<[{ count: number }[]]>(
+      "SELECT count() FROM game_insight WHERE tag = 'odd' GROUP ALL"
+    );
+
+    expect(all).toEqual([{ count: 5 }]);
+    expect(odd).toEqual([{ count: 2 }]);
+  });
+
+  it('lists tables via INFO FOR DB', async () => {
+    const engine = realEngine();
+    await engine.connect('anon');
+
+    const [info] = await engine.query<[{ tables: Record<string, string> }]>('INFO FOR DB');
+
+    expect(Object.keys(info.tables)).toContain('game_insight');
+    // Seeded system tables show up too — the panel's "internal" toggle filters
+    // them, the engine must not pre-filter.
+    expect(Object.keys(info.tables)).toContain('_00_query');
+    expect(Object.keys(info.tables).some((t) => t.startsWith('sqlite_'))).toBe(false);
+  });
+
+  it('edits and deletes a row by literal record id', async () => {
+    const engine = realEngine();
+    await engine.connect('anon');
+
+    await engine.query('UPDATE game_insight:1 MERGE $updates', { updates: { tag: 'edited' } });
+    const [edited] = await engine.query<[Row[]]>('SELECT * FROM game_insight LIMIT 20 START 1');
+    expect(edited[0]).toMatchObject({ id: 'game_insight:1', n: 1, tag: 'edited' });
+
+    await engine.query('DELETE game_insight:1');
+    const [after] = await engine.query<[{ count: number }[]]>(
+      'SELECT count() FROM game_insight GROUP ALL'
+    );
+    expect(after).toEqual([{ count: 4 }]);
+  });
+});

package/src/services/database/sqlite-devtools-queries.test.ts

@@ -0,0 +1,154 @@
+import { describe, it, expect } from 'vitest';
+import { SqliteCacheEngine } from './sqlite-cache-engine';
+import { stubTransport } from './sqlite-transport.fixture';
+import { translateSurql } from './surql-translate';
+
+/**
+ * The statements the DevTools Database explorer emits against the LOCAL store.
+ * None of them come from `surql`, so they only ever exercised the SurrealDB
+ * engine: on SQLite the paging read threw "unsupported SurrealQL for
+ * translation: SELECT * FROM game_insight LIMIT 20 START 0", the table list came
+ * back empty (`INFO FOR DB` lowered to a noop) and row edit/delete never
+ * matched (they inline a literal record id).
+ */
+
+function makeLogger(): any {
+  const noop = () => {};
+  const l: any = { debug: noop, info: noop, warn: noop, error: noop, trace: noop };
+  l.child = () => l;
+  return l;
+}
+
+/** Records every exec/run SQL so the paging window can be asserted. */
+function recordingEngine(rows: Record<string, unknown[]> = {}) {
+  const sql: string[] = [];
+  const engine = new SqliteCacheEngine({ namespace: 'n', database: 'd' } as any, makeLogger());
+  stubTransport(engine, (type, payload: any) => {
+    if (type === 'open') return { persisted: true };
+    if (type === 'exec' || type === 'run') {
+      sql.push(payload.sql);
+      for (const [needle, out] of Object.entries(rows)) {
+        if (payload.sql.includes(needle)) return { rows: out };
+      }
+      return { rows: [] };
+    }
+    return {};
+  });
+  return { engine, sql };
+}
+
+describe('DevTools table paging (LIMIT/START)', () => {
+  it('translates the window instead of throwing', () => {
+    const { ops } = translateSurql('SELECT * FROM game_insight LIMIT 20 START 0', {});
+    expect(ops).toEqual([
+      {
+        kind: 'selectTable',
+        table: 'game_insight',
+        where: undefined,
+        orderBy: undefined,
+        select: undefined,
+        value: undefined,
+        limit: 20,
+        start: 0,
+      },
+    ]);
+  });
+
+  it('renders LIMIT/OFFSET in SQL, page 3 of 20', async () => {
+    const { engine, sql } = recordingEngine();
+    await engine.connect('anon');
+    await engine.query('SELECT * FROM game_insight LIMIT 20 START 40');
+    expect(sql.some((s) => /SELECT data FROM "game_insight" LIMIT 20 OFFSET 40$/.test(s))).toBe(
+      true
+    );
+  });
+
+  it('keeps WHERE and ORDER BY alongside the window', () => {
+    const { ops } = translateSurql(
+      'SELECT * FROM game WHERE done = true ORDER BY date desc LIMIT 10 START 30',
+      {}
+    );
+    expect(ops[0]).toMatchObject({
+      kind: 'selectTable',
+      table: 'game',
+      where: [{ field: 'done', op: '=', value: true }],
+      orderBy: [['date', 'desc']],
+      limit: 10,
+      start: 30,
+    });
+  });
+
+  it('leaves a LIMIT that is part of a string literal alone', () => {
+    const { ops } = translateSurql("SELECT * FROM game WHERE note = 'LIMIT 5'", {});
+    expect(ops[0]).toMatchObject({
+      kind: 'selectTable',
+      where: [{ field: 'note', op: '=', value: 'LIMIT 5' }],
+      limit: undefined,
+      start: undefined,
+    });
+  });
+
+  it('a START with no LIMIT still renders valid SQLite', async () => {
+    const { engine, sql } = recordingEngine();
+    await engine.connect('anon');
+    await engine.query('SELECT * FROM game START 5');
+    // SQLite has no bare OFFSET — `LIMIT -1` is its "everything" sentinel.
+    expect(sql.some((s) => s.endsWith('LIMIT -1 OFFSET 5'))).toBe(true);
+  });
+});
+
+describe('DevTools row count', () => {
+  it("answers `SELECT count() FROM t GROUP ALL` in SurrealDB's shape", async () => {
+    const { engine } = recordingEngine({ 'COUNT(*)': [{ n: 137 }] });
+    await engine.connect('anon');
+    const res = await engine.query<[{ count: number }[]]>(
+      'SELECT count() FROM game_insight GROUP ALL'
+    );
+    expect(res[0]).toEqual([{ count: 137 }]);
+  });
+
+  it('counts zero rows as 0, not undefined', async () => {
+    const { engine } = recordingEngine();
+    await engine.connect('anon');
+    const res = await engine.query<[{ count: number }[]]>('SELECT count() FROM empty GROUP ALL');
+    expect(res[0]).toEqual([{ count: 0 }]);
+  });
+});
+
+describe('DevTools table list', () => {
+  it('answers INFO FOR DB from sqlite_master, minus SQLite internals', async () => {
+    const { engine } = recordingEngine({
+      sqlite_master: [{ name: 'game' }, { name: '_00_query' }],
+    });
+    await engine.connect('anon');
+    const [info] = await engine.query<[{ tables: Record<string, string> }]>('INFO FOR DB');
+    expect(Object.keys(info.tables)).toEqual(['game', '_00_query']);
+  });
+});
+
+describe('DevTools row edit / delete (literal record ids)', () => {
+  it('UPDATE <table>:<id> MERGE $updates writes that row', async () => {
+    const { engine, sql } = recordingEngine();
+    await engine.connect('anon');
+    await engine.query('UPDATE game:abc MERGE $updates', { updates: { white: 'hikaru' } });
+    const write = sql.find((s) => s.startsWith('INSERT INTO "game"'));
+    expect(write).toBeDefined();
+    expect(write).toContain('json_patch');
+  });
+
+  it('DELETE <table>:<id> deletes one row, DELETE <table> still clears the table', () => {
+    expect(translateSurql('DELETE game:abc', {}).ops[0]).toEqual({
+      kind: 'delete',
+      id: 'game:abc',
+    });
+    expect(translateSurql('DELETE game', {}).ops[0]).toEqual({ kind: 'deleteAll', table: 'game' });
+  });
+
+  it('refuses a table-wide MERGE rather than writing a row named after the table', () => {
+    // `UPDATE game MERGE $x` means every row of `game` in SurrealQL. Unsupported
+    // here — and it must SAY so, not silently create `game:undefined`.
+    expect(() => translateSurql('UPDATE game MERGE $x', { x: {} })).toThrow(
+      /unsupported SurrealQL/
+    );
+  });
+});

package/src/services/database/surql-translate.ts

@@ -18,8 +18,29 @@ import { stableKey } from './relation-resolver';
 
 export type SqlOp =
   | { kind: 'getById'; id: unknown; select?: string[]; value?: string }
-  | { kind: 'selectByIds'; ids: unknown[]; select?: string[]; orderBy?: OrderBy; value?: string }
-  | { kind: 'selectTable'; table: string; where?: WhereNode[]; orderBy?: OrderBy; select?: string[]; value?: string }
+  | {
+      kind: 'selectByIds';
+      ids: unknown[];
+      select?: string[];
+      orderBy?: OrderBy;
+      value?: string;
+      limit?: number;
+      start?: number;
+    }
+  | {
+      kind: 'selectTable';
+      table: string;
+      where?: WhereNode[];
+      orderBy?: OrderBy;
+      select?: string[];
+      value?: string;
+      limit?: number;
+      start?: number;
+    }
+  /** `SELECT count() FROM t [WHERE …] GROUP ALL` — one `{ count }` row. */
+  | { kind: 'count'; table: string; where?: WhereNode[] }
+  /** `INFO FOR DB` — the table list, in SurrealDB's `{ tables: {…} }` shape. */
+  | { kind: 'infoForDb' }
   | { kind: 'upsert'; id: unknown; data: Row; mode: 'replace' | 'merge' }
   | { kind: 'updateSet'; id: unknown; sets: SetClause[]; returnNone: boolean }
   | { kind: 'delete'; id: unknown }
@@ -95,6 +116,12 @@ function translateStatement(stmt: string, vars: Record<string, unknown>): SqlOp
     return { kind: 'return', entries };
   }
 
+  // `INFO FOR DB` is the ONE INFO statement with a real answer here: the
+  // DevTools Database explorer enumerates tables with it. Answered from
+  // `sqlite_master` (see the engine) instead of being swallowed by the DDL
+  // noop below, which left the explorer with an empty table list.
+  if (/^INFO\s+FOR\s+DB(\s+STRUCTURE)?$/i.test(s)) return { kind: 'infoForDb' };
+
   // ---- schema / session DDL: no-ops on a schemaless engine --------------
   // SQLite creates tables lazily and has no namespaces/DB DDL, so DEFINE /
   // REMOVE / USE / INFO / RETURN statements are safely ignored.
@@ -110,11 +137,13 @@ function translateStatement(stmt: string, vars: Record<string, unknown>): SqlOp
     return { kind: 'upsert', id: rid(vars[m[1]]), data: asRow(vars[m[2]]), mode: 'replace' };
   }
 
+  // The `ONLY` variants come from `surql`; the bare `UPDATE <id> MERGE $x` form
+  // (with a LITERAL record id) is what the DevTools row editor emits.
   m =
-    /^UPSERT\s+ONLY\s+\$(\w+)\s+MERGE\s+\$(\w+)$/i.exec(s) ||
-    /^UPDATE\s+ONLY\s+\$(\w+)\s+MERGE\s+\$(\w+)$/i.exec(s);
+    idRe(String.raw`^UPSERT\s+ONLY\s+%ID%\s+MERGE\s+\$(\w+)$`).exec(s) ||
+    idRe(String.raw`^UPDATE\s+(?:ONLY\s+)?%ID%\s+MERGE\s+\$(\w+)$`).exec(s);
   if (m) {
-    return { kind: 'upsert', id: rid(vars[m[1]]), data: asRow(vars[m[2]]), mode: 'merge' };
+    return { kind: 'upsert', id: idOperand(m[1], vars), data: asRow(vars[m[2]]), mode: 'merge' };
   }
 
   // CREATE ONLY $id SET a = ..., b = ...  (createSet / createMutation)
@@ -126,32 +155,46 @@ function translateStatement(stmt: string, vars: Record<string, unknown>): SqlOp
   }
 
   // UPDATE $id SET a.b = $x, c = $y [RETURN NONE]
-  m = /^UPDATE\s+\$(\w+)\s+SET\s+(.+?)(\s+RETURN\s+NONE)?$/i.exec(s);
+  m = idRe(String.raw`^UPDATE\s+%ID%\s+SET\s+(.+?)(\s+RETURN\s+NONE)?$`).exec(s);
   if (m) {
     return {
       kind: 'updateSet',
-      id: rid(vars[m[1]]),
+      id: idOperand(m[1], vars),
       sets: parseSetClauses(m[2], vars),
       returnNone: !!m[3],
     };
   }
 
-  m = /^DELETE\s+\$(\w+)$/i.exec(s);
-  if (m) return { kind: 'delete', id: rid(vars[m[1]]) };
-
-  m = /^DELETE\s+([A-Za-z_]\w*)$/i.exec(s); // DELETE <table>
+  m = /^DELETE\s+([A-Za-z_]\w*)$/i.exec(s); // DELETE <table> (no `:` — a table)
   if (m) return { kind: 'deleteAll', table: m[1] };
 
+  // DELETE $id, and `DELETE <table>:<id>` from the DevTools row actions.
+  m = idRe(String.raw`^DELETE\s+%ID%$`).exec(s);
+  if (m) return { kind: 'delete', id: idOperand(m[1], vars) };
+
   // ---- reads ------------------------------------------------------------
-  // SELECT [VALUE] <proj> FROM ONLY $id
-  m = /^SELECT\s+(VALUE\s+)?(.+?)\s+FROM\s+ONLY\s+\$(\w+)$/i.exec(s);
+  // The paging tail (`LIMIT n [START m]`) is peeled off first so it can't be
+  // swallowed by the lazily-matched WHERE/ORDER BY groups below. Everything
+  // after this point sees a window-free statement.
+  const { head, limit, start } = peelWindow(s, vars);
+
+  // SELECT count() FROM <table> [WHERE ...] GROUP ALL — the row-count query the
+  // DevTools Database explorer pages with. GROUP ALL is required: without it
+  // SurrealDB counts per row, which is a different result this can't fake.
+  m = /^SELECT\s+count\(\)\s+FROM\s+([A-Za-z_]\w*)(?:\s+WHERE\s+(.+?))?\s+GROUP\s+ALL$/i.exec(head);
+  if (m) {
+    return { kind: 'count', table: m[1], where: m[2] ? parseWhere(m[2], vars) : undefined };
+  }
+
+  // SELECT [VALUE] <proj> FROM ONLY <id>
+  m = idRe(String.raw`^SELECT\s+(VALUE\s+)?(.+?)\s+FROM\s+ONLY\s+%ID%$`).exec(head);
   if (m) {
     const value = m[1] ? m[2].trim() : undefined;
-    return { kind: 'getById', id: rid(vars[m[3]]), select: projFields(m[2], !!m[1]), value };
+    return { kind: 'getById', id: idOperand(m[3], vars), select: projFields(m[2], !!m[1]), value };
   }
 
   // SELECT [VALUE] <proj> FROM $arrayParam
-  m = /^SELECT\s+(VALUE\s+)?(.+?)\s+FROM\s+\$(\w+)$/i.exec(s);
+  m = /^SELECT\s+(VALUE\s+)?(.+?)\s+FROM\s+\$(\w+)$/i.exec(head);
   if (m) {
     const value = m[1] ? m[2].trim() : undefined;
     return {
@@ -159,13 +202,16 @@ function translateStatement(stmt: string, vars: Record<string, unknown>): SqlOp
       ids: (vars[m[3]] as unknown[]) ?? [],
       select: projFields(m[2], !!m[1]),
       value,
+      limit,
+      start,
     };
   }
 
   // SELECT <proj> FROM <table> [WHERE ...] [ORDER BY ...]
-  m = /^SELECT\s+(VALUE\s+)?(.+?)\s+FROM\s+([A-Za-z_]\w*)(?:\s+WHERE\s+(.+?))?(?:\s+ORDER\s+BY\s+(.+?))?$/i.exec(
-    s
-  );
+  m =
+    /^SELECT\s+(VALUE\s+)?(.+?)\s+FROM\s+([A-Za-z_]\w*)(?:\s+WHERE\s+(.+?))?(?:\s+ORDER\s+BY\s+(.+?))?$/i.exec(
+      head
+    );
   if (m) {
     return {
       kind: 'selectTable',
@@ -174,6 +220,8 @@ function translateStatement(stmt: string, vars: Record<string, unknown>): SqlOp
       orderBy: m[5] ? parseOrderBy(m[5]) : undefined,
       select: projFields(m[2], !!m[1]),
       value: m[1] ? m[2].trim() : undefined,
+      limit,
+      start,
     };
   }
 
@@ -182,6 +230,83 @@ function translateStatement(stmt: string, vars: Record<string, unknown>): SqlOp
 
 // ==================== clause parsers ====================
 
+/**
+ * Split a SELECT's trailing `LIMIT n [START m]` off its head.
+ *
+ * Peeled rather than folded into the SELECT regexes because those match WHERE
+ * and ORDER BY lazily: with the window left in place the WHERE group happily
+ * expands over `… LIMIT 20`, which is how `SELECT * FROM t LIMIT 20 START 0`
+ * ended up unmatched entirely.
+ *
+ * A tail sitting inside a string literal (`WHERE note = 'LIMIT 5'`) is left
+ * alone — an odd quote count in the head means the match is inside a string.
+ */
+function peelWindow(
+  stmt: string,
+  vars: Record<string, unknown>
+): { head: string; limit?: number; start?: number } {
+  let head = stmt;
+  let limit: number | undefined;
+  let start: number | undefined;
+
+  const peel = (re: RegExp): string | undefined => {
+    const m = re.exec(head);
+    if (!m) return undefined;
+    const before = head.slice(0, m.index);
+    if (countQuotes(before) % 2 !== 0) return undefined;
+    head = before;
+    return m[1];
+  };
+
+  // START is the outer token, so it comes off first.
+  const startTok = peel(/\s+START(?:\s+AT)?\s+(\$?\w+)\s*$/i);
+  const limitTok = peel(/\s+LIMIT(?:\s+BY)?\s+(\$?\w+)\s*$/i);
+  if (startTok !== undefined) start = numOperand(startTok, vars);
+  if (limitTok !== undefined) limit = numOperand(limitTok, vars);
+  return { head, limit, start };
+}
+
+function countQuotes(s: string): number {
+  let n = 0;
+  for (let i = 0; i < s.length; i++) {
+    if (s[i] === "'" && s[i - 1] !== '\\') n++;
+  }
+  return n;
+}
+
+/** A `LIMIT`/`START` operand: a literal integer or a `$var` holding one. */
+function numOperand(token: string, vars: Record<string, unknown>): number | undefined {
+  const raw = token.startsWith('$') ? vars[token.slice(1)] : token;
+  const n = Number(raw);
+  return Number.isFinite(n) ? n : undefined;
+}
+
+/**
+ * A single-record operand: `$var` or a LITERAL `table:id`.
+ *
+ * A bare identifier deliberately does NOT match: in SurrealQL that is a table,
+ * and `UPDATE game MERGE $x` rewrites every row of `game` — a shape this
+ * vocabulary does not implement. Not matching means such a statement reaches
+ * the "unsupported SurrealQL" throw instead of quietly writing one row called
+ * `game`.
+ */
+const ID_TOKEN = String.raw`(\$\w+|[A-Za-z_]\w*:\S+)`;
+
+/** Build a statement regex, `%ID%` expanding to {@link ID_TOKEN}. */
+function idRe(pattern: string): RegExp {
+  return new RegExp(pattern.replace('%ID%', ID_TOKEN), 'i');
+}
+
+/**
+ * Resolve an {@link ID_TOKEN} match. Literals matter because the DevTools row
+ * editor inlines the id (`UPDATE game:abc MERGE $updates`) rather than binding
+ * it; `stableKey` treats that string and a `RecordId` identically downstream.
+ */
+function idOperand(token: string, vars: Record<string, unknown>): unknown {
+  const t = token.trim();
+  return t.startsWith('$') ? rid(vars[t.slice(1)]) : t;
+}
+
 function projFields(proj: string, isValue: boolean): string[] | undefined {
   const p = proj.trim();
   if (isValue) return undefined; // VALUE returns a scalar, no projection object

package/src/sp00ky.ts

@@ -465,7 +465,7 @@ export class Sp00kyClient<S extends SchemaStructure> {
       this.dataModule
     );
 
-    // Let the DevTools Flags tab read and write local flag overrides. Done
+    // Let the DevTools Access tab read and write local flag overrides. Done
     // here rather than via the constructor because FeatureFlagModule is built
     // above and DevToolsService takes its deps positionally.
     this.devTools.setFeatureFlagOverrides(this.featureFlags);
@@ -1065,10 +1065,10 @@ export class Sp00kyClient<S extends SchemaStructure> {
    * Nothing is sent to the server — the `_00_user_feature` assignment is
    * untouched, so clearing restores whatever the server says. Persisted to
    * localStorage, survives reloads, and applies while signed out. Backs the
-   * DevTools Flags tab, and is a convenient hook for tests.
+   * DevTools Access tab, and is a convenient hook for tests.
    *
    * To change a flag for OTHER users you need admin rights (`spky admin add`)
-   * and the DevTools Flags tab, or `spky flag`.
+   * and the DevTools Access tab, or `spky flag`.
    */
   setFeatureOverride(key: string, variant: string | null, payload?: unknown): void {
     this.featureFlags.setLocalOverride(key, variant, payload);

package/src/types.ts

@@ -488,6 +488,29 @@ export interface QueryConfig {
    * `remoteArray.length === 0` check cannot tell those apart.
    */
   membershipKnown?: boolean;
+  /**
+   * Whether a NON-EMPTY id-set has arrived from the server for this query in
+   * this session. Gates whether an empty read may be believed.
+   *
+   * The server publishes `_00_list_ref` asynchronously — the SSP queues a
+   * view's initial edges to a coalescing flusher and returns from
+   * `fn::query::register` before they land — so an empty read right after
+   * registration says nothing about the query being empty. Believing it (and
+   * mirroring it to the durable `_00_window` row) blanked lists and kept them
+   * blank across reloads. Once a real set has been seen, a later empty one is a
+   * genuine transition and must be honoured, or removed rows resurrect.
+   *
+   * In-memory only: a fresh session must re-earn the right to believe empties.
+   */
+  remoteSeen?: boolean;
+  /**
+   * Consecutive empty id-sets read from the server while `remoteSeen` is still
+   * false. Bounds how long an unconfirmed empty may be ignored, so a window
+   * that genuinely emptied while this device was away is believed on the second
+   * read instead of rendering stale rows forever. Reset by any non-empty set.
+   * In-memory only.
+   */
+  emptyReads?: number;
   /**
    * Key of this query's durable `_00_window` membership row: a hash of
    * `{surql, params}` WITHOUT the `session::id()` salt that `id` carries, so it