@spooky-sync/core 0.0.1-canary.192 → 0.0.1-canary.193

package/dist/index.d.ts

@@ -1180,6 +1180,13 @@ declare class Sp00kySync<S extends SchemaStructure> {
   private startSelfHeal;
   private scheduleSelfHeal;
   private stopSelfHeal;
+  /**
+   * Release a deregistered query's remote view immediately instead of leaving
+   * it to the TTL sweep. Off by default; see the reasoning in
+   * {@link cleanupQuery}. Kept as a field rather than deleted so the eager path
+   * can be re-enabled in a test once the subquery-body repair path exists.
+   */
+  private readonly releaseQueriesEagerly;
   constructor(local: LocalStore, remote: RemoteDatabaseService, cache: CacheModule, dataModule: DataModule<S>, schema: S, logger: Logger$1, options?: Sp00kySyncOptions);
   /**
    * Initializes the synchronization system.

package/dist/index.js

@@ -5784,6 +5784,13 @@ var Sp00kySync = class Sp00kySync {
 		}
 		this.selfHealAttempts = 0;
 	}
+	/**
+	* Release a deregistered query's remote view immediately instead of leaving
+	* it to the TTL sweep. Off by default; see the reasoning in
+	* {@link cleanupQuery}. Kept as a field rather than deleted so the eager path
+	* can be re-enabled in a test once the subquery-body repair path exists.
+	*/
+	releaseQueriesEagerly = false;
 	constructor(local, remote, cache, dataModule, schema, logger, options) {
 		this.local = local;
 		this.remote = remote;
@@ -6676,13 +6683,15 @@ var Sp00kySync = class Sp00kySync {
 		const queryState = this.dataModule.getQueryByHash(queryHash);
 		if (!queryState) return;
 		if (this.dataModule.hasSubscribers(queryHash)) return;
-		await this.remote.query("fn::query::unsubscribe($id)", { id: queryState.config.id });
-		if (this.dataModule.hasSubscribers(queryHash)) {
-			this.enqueueDownEvent({
-				type: "register",
-				payload: { hash: queryHash }
-			});
-			return;
+		if (this.releaseQueriesEagerly) {
+			await this.remote.query("fn::query::unsubscribe($id)", { id: queryState.config.id });
+			if (this.dataModule.hasSubscribers(queryHash)) {
+				this.enqueueDownEvent({
+					type: "register",
+					payload: { hash: queryHash }
+				});
+				return;
+			}
 		}
 		this.dataModule.finalizeDeregister(queryHash);
 	}
@@ -7003,8 +7012,8 @@ function selfAllowlistedVariant(flag, userId) {
 
 //#endregion
 //#region src/modules/devtools/index.ts
-const CORE_VERSION = "0.0.1-canary.192";
-const WASM_VERSION = "0.0.1-canary.192";
+const CORE_VERSION = "0.0.1-canary.193";
+const WASM_VERSION = "0.0.1-canary.193";
 const SURREAL_VERSION = "3.0.3";
 var DevToolsService = class DevToolsService {
 	eventsHistory = [];
@@ -11435,7 +11444,7 @@ var Sp00kyClient = class {
 		return new TabsCoordinator({
 			tabId,
 			fingerprint: computeTabsFingerprint({
-				coreVersion: "0.0.1-canary.192",
+				coreVersion: "0.0.1-canary.193",
 				schemaHash: hash53(this.config.schemaSurql),
 				endpoint: this.config.database.endpoint ?? "",
 				namespace: this.config.database.namespace,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@spooky-sync/core",
-  "version": "0.0.1-canary.192",
+  "version": "0.0.1-canary.193",
   "type": "module",
   "sideEffects": false,
   "main": "./dist/index.js",
@@ -60,8 +60,8 @@
     }
   },
   "dependencies": {
-    "@spooky-sync/query-builder": "0.0.1-canary.192",
-    "@spooky-sync/ssp-wasm": "0.0.1-canary.192",
+    "@spooky-sync/query-builder": "0.0.1-canary.193",
+    "@spooky-sync/ssp-wasm": "0.0.1-canary.193",
     "@sqlite.org/sqlite-wasm": "3.53.0-build1",
     "@surrealdb/wasm": "^3.0.3",
     "fast-json-patch": "^3.1.1",

package/src/modules/sync/sync.cleanup.test.ts

@@ -47,15 +47,26 @@ function makeSync(opts: { hasSubscribers?: boolean[] } = {}) {
 describe('cleanupQuery — releasing a possibly-shared view', () => {
   beforeEach(() => vi.clearAllMocks());
 
-  it('releases through fn::query::unsubscribe, never a bare DELETE', async () => {
-    const { remote, run, queryId } = makeSync();
+  it('does not touch the remote view at all; the TTL sweep reclaims it', async () => {
+    // Eager release is deliberately disabled. It was inert for months (the
+    // table granted no delete permission), and making it real turned every
+    // best-effort guard misfire into a live delete of the row and all its
+    // edges. TTL remains the only reclamation that has actually run.
+    const { remote, run } = makeSync();
+
+    await run('h1');
+
+    expect(remote.query).not.toHaveBeenCalled();
+  });
+
+  it('never issues a bare DELETE', async () => {
+    // Belt and braces: if the eager path is ever re-enabled, it must go through
+    // the refcounted `fn::query::unsubscribe`, never a raw DELETE, which would
+    // tear the view out from under other sessions sharing the row.
+    const { remote, run } = makeSync();
 
     await run('h1');
 
-    expect(remote.query).toHaveBeenCalledWith('fn::query::unsubscribe($id)', {
-      id: queryId,
-    });
-    // The regression that would blank other tabs' lists.
     const sql = remote.query.mock.calls.map((c: any[]) => c[0]).join('\n');
     expect(sql).not.toMatch(/\bDELETE\b/i);
   });
@@ -80,21 +91,19 @@ describe('cleanupQuery — releasing a possibly-shared view', () => {
     expect(finalizeDeregister).not.toHaveBeenCalled();
   });
 
-  it('re-registers if a subscriber reappeared during the release await', async () => {
-    // Someone scrolled back / re-subscribed while the round trip was in flight.
-    // Re-registering covers both outcomes: recreate the view if we were the
-    // last subscriber, or re-add ourselves to `subscribers` if it survived.
-    const { finalizeDeregister, enqueueDownEvent, run } = makeSync({
+  it('still frees local state when a subscriber reappears mid-cleanup', async () => {
+    // With no remote round trip there is no window to lose a re-subscribe in,
+    // so this collapses to the ordinary local free. The remote view survives
+    // regardless (TTL owns it), which is precisely why the reappearing
+    // subscriber is safe: a re-register finds the row still there.
+    const { remote, finalizeDeregister, run } = makeSync({
       hasSubscribers: [false, true],
     });
 
     await run('h1');
 
-    expect(enqueueDownEvent).toHaveBeenCalledWith({
-      type: 'register',
-      payload: { hash: 'h1' },
-    });
-    expect(finalizeDeregister).not.toHaveBeenCalled();
+    expect(remote.query).not.toHaveBeenCalled();
+    expect(finalizeDeregister).toHaveBeenCalledWith('h1');
   });
 
   it('is tolerant of an already torn-down query', async () => {

package/src/modules/sync/sync.ts

@@ -424,6 +424,14 @@ export class Sp00kySync<S extends SchemaStructure> {
     this.selfHealAttempts = 0;
   }
 
+  /**
+   * Release a deregistered query's remote view immediately instead of leaving
+   * it to the TTL sweep. Off by default; see the reasoning in
+   * {@link cleanupQuery}. Kept as a field rather than deleted so the eager path
+   * can be re-enabled in a test once the subquery-body repair path exists.
+   */
+  private readonly releaseQueriesEagerly = false;
+
   constructor(
     private local: LocalStore,
     private remote: RemoteDatabaseService,
@@ -1771,17 +1779,41 @@ export class Sp00kySync<S extends SchemaStructure> {
     // Re-subscribed before the queued cleanup ran → keep everything as-is.
     if (this.dataModule.hasSubscribers(queryHash)) return;
 
-    await this.remote.query('fn::query::unsubscribe($id)', {
-      id: queryState.config.id,
-    });
+    // EAGER REMOTE RELEASE IS DISABLED. Deliberate, and not a leak: the TTL
+    // sweep reclaims the row and its edges on `lastActiveAt + ttl`, which is the
+    // ONLY reclamation that has ever actually run in production.
+    //
+    // Until canary.190 `_00_query` granted no delete permission, so the bare
+    // `DELETE $id` this used to issue affected zero rows. .190 granted delete
+    // and .191 wired `fn::query::unsubscribe`, which made teardown real for the
+    // first time -- and the guards above are best-effort by construction
+    // (`hasSubscribers` can be momentarily false during a rebind or a windowed
+    // list re-flow). Every misfire that had been silently inert for months
+    // became a live delete of the row AND every `_00_list_ref` edge on it.
+    //
+    // That matches a report of chat suddenly rendering raw record ids instead
+    // of users, with the message list re-flowing underneath. Server state was
+    // measured intact at the time (`rowCount` equalled the actual edge count on
+    // every row), so the damage is on the client side of a teardown, not in the
+    // materialization.
+    //
+    // Re-enable only together with a repair path that can re-fetch subquery
+    // child bodies whose `subqueryRemoteArray` entry claims they are already
+    // synced -- otherwise a torn-down-and-recreated view never restores the
+    // related records it dropped, because the idempotence check skips them.
+    if (this.releaseQueriesEagerly) {
+      await this.remote.query('fn::query::unsubscribe($id)', {
+        id: queryState.config.id,
+      });
 
-    // Re-subscribed while we awaited the release → re-register. Covers both
-    // outcomes: if we were the last subscriber the remote view is gone and this
-    // recreates it, and if it survived for other sessions this re-adds us to
-    // `subscribers` so our heartbeats keep counting.
-    if (this.dataModule.hasSubscribers(queryHash)) {
-      this.enqueueDownEvent({ type: 'register', payload: { hash: queryHash } });
-      return;
+      // Re-subscribed while we awaited the release → re-register. Covers both
+      // outcomes: if we were the last subscriber the remote view is gone and
+      // this recreates it, and if it survived for other sessions this re-adds
+      // us to `subscribers` so our heartbeats keep counting.
+      if (this.dataModule.hasSubscribers(queryHash)) {
+        this.enqueueDownEvent({ type: 'register', payload: { hash: queryHash } });
+        return;
+      }
     }
 
     // No subscribers throughout → safe to free the local view + state.