@spooky-sync/core 0.0.1-canary.205 → 0.0.1-canary.206

package/dist/index.d.ts

@@ -606,6 +606,12 @@ declare class CacheModule implements StreamUpdateReceiver {
  * Merges the functionality of QueryManager and MutationManager.
  * Uses CacheModule for all storage operations.
  */
+/** A `_00_window` row as read back: the id-set and whether the server vouched
+ *  for it (which is what allows an empty set to count as known membership). */
+interface DurableMembership {
+  ids: RecordVersionArray;
+  confirmed: boolean;
+}
 declare class DataModule<S extends SchemaStructure> {
   private cache;
   private local;
@@ -901,11 +907,25 @@ declare class DataModule<S extends SchemaStructure> {
    * authoritative membership on this device. Any read error is treated as
    * "unknown" so a broken row degrades to the predicate scan rather than
    * rendering an empty list.
+   *
+   * `confirmed` is true only for rows written after the server itself vouched
+   * for the set (a non-empty id-set, or an empty one it reported a row count of
+   * zero for, or an empty one that followed a non-empty one in the same
+   * session). Rows written before the marker existed, including the `[]` rows a
+   * pre-`ea56f50e` client mirrored from an unflushed read, read as unconfirmed.
+   */
+  getWindowMembership(key: string): Promise<DurableMembership | null>;
+  /**
+   * Persist the durable membership row. Best-effort: callers must not fail a
+   * sync round because the mirror write failed.
+   *
+   * `confirmed` says whether a cold start may trust this row even when it is
+   * empty. A confirmed empty is a real answer ("the server says this query has
+   * no rows") and stays empty across a reload; an unconfirmed empty is the
+   * retry budget's guess and falls back to the predicate scan on the next boot,
+   * exactly as every empty row did before the marker existed.
    */
-  getWindowMembership(key: string): Promise<RecordVersionArray | null>;
-  /** Persist the durable membership row. Best-effort: callers must not fail a
-   *  sync round because the mirror write failed. */
-  writeWindowMembership(key: string, ids: RecordVersionArray): Promise<void>;
+  writeWindowMembership(key: string, ids: RecordVersionArray, confirmed: boolean): Promise<void>;
   /**
    * Record ids with a mutation still in the outbox, split by direction.
    *

package/dist/index.js

@@ -3321,12 +3321,6 @@ function phaseStatOf(samples, lastMs) {
 		count: samples.length
 	};
 }
-/**
-* DataModule - Unified query and mutation management
-*
-* Merges the functionality of QueryManager and MutationManager.
-* Uses CacheModule for all storage operations.
-*/
 var DataModule = class DataModule {
 	/** Tab identity baked into mutation ids (shared-tabs rollback routing);
 	*  undefined in solo mode, where mutation-id falls back to a session id. */
@@ -4030,23 +4024,42 @@ var DataModule = class DataModule {
 	* authoritative membership on this device. Any read error is treated as
 	* "unknown" so a broken row degrades to the predicate scan rather than
 	* rendering an empty list.
+	*
+	* `confirmed` is true only for rows written after the server itself vouched
+	* for the set (a non-empty id-set, or an empty one it reported a row count of
+	* zero for, or an empty one that followed a non-empty one in the same
+	* session). Rows written before the marker existed, including the `[]` rows a
+	* pre-`ea56f50e` client mirrored from an unflushed read, read as unconfirmed.
 	*/
 	async getWindowMembership(key) {
 		try {
 			const row = await this.local.getById("_00_window", new RecordId("_00_window", key));
 			if (!row || typeof row !== "object") return null;
 			const ids = row.ids;
-			return Array.isArray(ids) ? ids : null;
+			if (!Array.isArray(ids)) return null;
+			return {
+				ids,
+				confirmed: row.confirmed === true
+			};
 		} catch {
 			return null;
 		}
 	}
-	/** Persist the durable membership row. Best-effort: callers must not fail a
-	*  sync round because the mirror write failed. */
-	async writeWindowMembership(key, ids) {
+	/**
+	* Persist the durable membership row. Best-effort: callers must not fail a
+	* sync round because the mirror write failed.
+	*
+	* `confirmed` says whether a cold start may trust this row even when it is
+	* empty. A confirmed empty is a real answer ("the server says this query has
+	* no rows") and stays empty across a reload; an unconfirmed empty is the
+	* retry budget's guess and falls back to the predicate scan on the next boot,
+	* exactly as every empty row did before the marker existed.
+	*/
+	async writeWindowMembership(key, ids, confirmed) {
 		try {
 			await this.local.upsert("_00_window", new RecordId("_00_window", key), {
 				ids,
+				confirmed,
 				updatedAt: Date.now()
 			}, "replace");
 		} catch (err) {
@@ -4205,9 +4218,12 @@ var DataModule = class DataModule {
 			}, "Query to update remote array not found");
 			return;
 		}
+		let confirmed = remoteArray.length > 0 || queryState.config.remoteSeen === true;
 		if (remoteArray.length === 0 && !queryState.config.remoteSeen) {
 			const serverRowCount = opts?.serverRowCount;
-			if (!(serverRowCount === 0)) {
+			const knownEmpty = serverRowCount === 0;
+			confirmed = knownEmpty;
+			if (!knownEmpty) {
 				const emptyReads = (queryState.config.emptyReads ?? 0) + 1;
 				queryState.config.emptyReads = emptyReads;
 				if (!(serverRowCount === null || serverRowCount === void 0 ? emptyReads >= EMPTY_MEMBERSHIP_CONFIRMATIONS : false)) {
@@ -4228,7 +4244,7 @@ var DataModule = class DataModule {
 			queryState.config.remoteSeen = true;
 			queryState.config.emptyReads = 0;
 		}
-		if (queryState.config.membershipKey) await this.writeWindowMembership(queryState.config.membershipKey, remoteArray);
+		if (queryState.config.membershipKey) await this.writeWindowMembership(queryState.config.membershipKey, remoteArray, confirmed);
 		try {
 			await this.local.query(surql.seal(surql.updateSet("id", ["remoteArray"])), {
 				id: queryState.config.id,
@@ -4281,8 +4297,8 @@ var DataModule = class DataModule {
 			config.emptyReads = 0;
 			if (config.membershipKey) {
 				const durable = await this.getWindowMembership(config.membershipKey);
-				if (durable?.length) {
-					config.remoteArray = durable;
+				if (durable && (durable.ids.length > 0 || durable.confirmed)) {
+					config.remoteArray = durable.ids;
 					config.membershipKnown = true;
 				}
 			}
@@ -4712,8 +4728,8 @@ var DataModule = class DataModule {
 		};
 		if (membershipKey && !config.remoteArray?.length) {
 			const durable = await this.getWindowMembership(membershipKey);
-			if (durable?.length) {
-				config.remoteArray = durable;
+			if (durable && (durable.ids.length > 0 || durable.confirmed)) {
+				config.remoteArray = durable.ids;
 				config.membershipKnown = true;
 			}
 		} else if (config.remoteArray?.length) config.membershipKnown = true;
@@ -7337,8 +7353,8 @@ function selfAllowlistedVariant(flag, userId) {
 
 //#endregion
 //#region src/modules/devtools/index.ts
-const CORE_VERSION = "0.0.1-canary.205";
-const WASM_VERSION = "0.0.1-canary.205";
+const CORE_VERSION = "0.0.1-canary.206";
+const WASM_VERSION = "0.0.1-canary.206";
 const SURREAL_VERSION = "3.0.3";
 var DevToolsService = class DevToolsService {
 	eventsHistory = [];
@@ -7439,6 +7455,9 @@ var DevToolsService = class DevToolsService {
 				data: q.records,
 				localArray: q.config.localArray,
 				remoteArray: q.config.remoteArray,
+				membershipKnown: q.config.membershipKnown === true,
+				remoteSeen: q.config.remoteSeen === true,
+				emptyReads: q.config.emptyReads ?? 0,
 				timings: this.dataManager.phaseTimings(q)
 			});
 		});
@@ -12284,7 +12303,7 @@ var Sp00kyClient = class {
 		return new TabsCoordinator({
 			tabId,
 			fingerprint: computeTabsFingerprint({
-				coreVersion: "0.0.1-canary.205",
+				coreVersion: "0.0.1-canary.206",
 				schemaHash: hash53(this.config.schemaSurql),
 				endpoint: this.config.database.endpoint ?? "",
 				namespace: this.config.database.namespace,

package/dist/types.d.ts

@@ -874,6 +874,11 @@ interface QueryConfig {
    * "never established" has to fall back to a predicate scan of the local store
    * so a query first run on this device still paints offline. A
    * `remoteArray.length === 0` check cannot tell those apart.
+   *
+   * On a cold start it is seeded from the durable `_00_window` row when that
+   * row is non-empty, or empty but `confirmed` (the server reported zero rows
+   * for the query). An unconfirmed empty row is ignored, so a device poisoned
+   * by an old client that mirrored unflushed reads still self-heals.
    */
   membershipKnown?: boolean;
   /**
@@ -889,6 +894,9 @@ interface QueryConfig {
    * genuine transition and must be honoured, or removed rows resurrect.
    *
    * In-memory only: a fresh session must re-earn the right to believe empties.
+   * What does persist is the `confirmed` marker on the `_00_window` row, which
+   * an empty set earns when it arrives with a server row count of zero or after
+   * a non-empty set in the same session.
    */
   remoteSeen?: boolean;
   /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@spooky-sync/core",
-  "version": "0.0.1-canary.205",
+  "version": "0.0.1-canary.206",
   "type": "module",
   "sideEffects": false,
   "main": "./dist/index.js",
@@ -60,8 +60,8 @@
     }
   },
   "dependencies": {
-    "@spooky-sync/query-builder": "0.0.1-canary.205",
-    "@spooky-sync/ssp-wasm": "0.0.1-canary.205",
+    "@spooky-sync/query-builder": "0.0.1-canary.206",
+    "@spooky-sync/ssp-wasm": "0.0.1-canary.206",
     "@sqlite.org/sqlite-wasm": "3.53.0-build1",
     "@surrealdb/wasm": "^3.0.3",
     "blurhash": "^2.0.5",

package/src/modules/data/data.membership.test.ts

@@ -77,7 +77,7 @@ function makeLocal(pendingRows: Array<{ recordId: RecordId; mutationType: string
   const bodies = new Map(
     ['a', 'b', 'c'].map((k) => [`thread:${k}`, { id: new RecordId('thread', k), title: k }])
   );
-  const windowRows = new Map<string, { ids: RecordVersionArray }>();
+  const windowRows = new Map<string, { ids: RecordVersionArray; confirmed?: boolean }>();
   const local: any = {
     epoch: 1,
     bodies,
@@ -424,6 +424,67 @@ describe('membership-authoritative rendering', () => {
       expect(state.config.remoteArray).toEqual([]);
     });
 
+    it('marks a non-empty set and a server-confirmed empty set as confirmed', async () => {
+      const { dm, local, hash } = setup({ membershipKey: 'stable-key' });
+
+      await dm.updateQueryRemoteArray(hash, [['thread:a', 1]]);
+      expect(local.windowRows.get('stable-key')).toMatchObject({ confirmed: true });
+
+      // The server reports zero rows: a real answer, durable.
+      await dm.updateQueryRemoteArray(hash, [], { serverRowCount: 0 });
+      expect(local.windowRows.get('stable-key')).toEqual(
+        expect.objectContaining({ ids: [], confirmed: true })
+      );
+    });
+
+    it('marks an empty set that follows a seen set as confirmed', async () => {
+      // Everything the query matched was deleted while this session watched: the
+      // transition is genuine, so the next boot must not resurrect the rows.
+      const { dm, local, hash } = setup({ membershipKey: 'stable-key' });
+      await dm.updateQueryRemoteArray(hash, [['thread:a', 1]]);
+      await dm.updateQueryRemoteArray(hash, [], { serverRowCount: null });
+      expect(local.windowRows.get('stable-key')).toEqual(
+        expect.objectContaining({ ids: [], confirmed: true })
+      );
+    });
+
+    it('leaves the retry-budget empty unconfirmed', async () => {
+      // Two unreadable-row-count empties are believed for this session, but they
+      // are a guess: the durable row must not turn that guess into a permanent
+      // empty list on the next boot.
+      const { dm, local, hash } = setup({
+        membershipKey: 'stable-key',
+        remoteArray: [['thread:a', 1]],
+        membershipKnown: true,
+      });
+      await dm.updateQueryRemoteArray(hash, [], { serverRowCount: null });
+      await dm.updateQueryRemoteArray(hash, [], { serverRowCount: null });
+      expect(local.windowRows.get('stable-key')).toEqual(
+        expect.objectContaining({ ids: [], confirmed: false })
+      );
+    });
+
+    it('seeds a known-empty membership from a confirmed empty durable row', async () => {
+      // The reload after a server-confirmed empty: the list must stay empty
+      // instead of re-admitting every cached body until the next poll blanks it.
+      const { dm, local } = setup({ membershipKey: 'stable-key' });
+      local.windowRows.set('stable-key', { ids: [], confirmed: true });
+
+      const fresh = await (dm as any).createNewQuery({
+        recordId: new RecordId('_00_query', 'h-confirmed-empty'),
+        surql: 'SELECT * FROM thread WHERE done = false;',
+        params: {},
+        ttl: '10m',
+        tableName: 'thread',
+        plan,
+        membershipKey: 'stable-key',
+      });
+
+      expect(fresh.config.membershipKnown).toBe(true);
+      expect(fresh.config.remoteArray).toEqual([]);
+      expect(fresh.records).toEqual([]);
+    });
+
     it('does not seed membership from an empty durable row', async () => {
       // Self-heals devices poisoned before the guard existed: an empty durable
       // row is indistinguishable from "never had membership", so it must fall

package/src/modules/data/data.rebind.test.ts

@@ -122,6 +122,29 @@ describe('DataModule.rebindAfterBucketSwitch', () => {
   });
 });
 
+describe('DataModule.rebindAfterBucketSwitch durable seed', () => {
+  it('seeds a confirmed-empty membership from the new bucket, and ignores an unconfirmed one', async () => {
+    const harness = makeHarness();
+    const { dm, local } = harness as any;
+    const state = makeQueryState('h1', [{ id: 'user:a', name: 'Previous User Row' }]);
+    state.config.membershipKey = 'stable-key';
+    (dm as any).activeQueries.set('h1', state);
+    local.getById = vi.fn(async () => ({ ids: [], confirmed: true }));
+
+    await dm.rebindAfterBucketSwitch();
+    let qs = (dm as any).activeQueries.get('h1') as QueryState;
+    expect(qs.config.membershipKnown).toBe(true);
+    expect(qs.config.remoteArray).toEqual([]);
+    if (qs.ttlTimer) clearTimeout(qs.ttlTimer);
+
+    local.getById = vi.fn(async () => ({ ids: [] }));
+    await dm.rebindAfterBucketSwitch();
+    qs = (dm as any).activeQueries.get('h1') as QueryState;
+    expect(qs.config.membershipKnown).toBe(false);
+    if (qs.ttlTimer) clearTimeout(qs.ttlTimer);
+  });
+});
+
 describe('stale-epoch stream updates', () => {
   it('drops an update whose chain started before a bucket switch', async () => {
     const { dm, local } = makeHarness();

package/src/modules/data/index.ts

@@ -82,6 +82,13 @@ function phaseStatOf(samples: number[], lastMs: number | null): PhaseStat {
  * Merges the functionality of QueryManager and MutationManager.
  * Uses CacheModule for all storage operations.
  */
+/** A `_00_window` row as read back: the id-set and whether the server vouched
+ *  for it (which is what allows an empty set to count as known membership). */
+export interface DurableMembership {
+  ids: RecordVersionArray;
+  confirmed: boolean;
+}
+
 export class DataModule<S extends SchemaStructure> {
   /** Tab identity baked into mutation ids (shared-tabs rollback routing);
    *  undefined in solo mode, where mutation-id falls back to a session id. */
@@ -1161,32 +1168,54 @@ export class DataModule<S extends SchemaStructure> {
   //
   // `_00_window` fixes that: same data, keyed by a session-independent hash, in
   // a table nothing wipes. Mirrors the durable `_00_preload` marker above.
+  //
+  // Row shape: `{ ids, confirmed, updatedAt }`. `confirmed` is the one bit that
+  // lets an EMPTY row be trusted on the next boot (see `getWindowMembership`).
 
   /**
    * Read the durable membership row, or `null` if this query has never had
    * authoritative membership on this device. Any read error is treated as
    * "unknown" so a broken row degrades to the predicate scan rather than
    * rendering an empty list.
+   *
+   * `confirmed` is true only for rows written after the server itself vouched
+   * for the set (a non-empty id-set, or an empty one it reported a row count of
+   * zero for, or an empty one that followed a non-empty one in the same
+   * session). Rows written before the marker existed, including the `[]` rows a
+   * pre-`ea56f50e` client mirrored from an unflushed read, read as unconfirmed.
    */
-  async getWindowMembership(key: string): Promise<RecordVersionArray | null> {
+  async getWindowMembership(key: string): Promise<DurableMembership | null> {
     try {
       const row = await this.local.getById('_00_window', new RecordId('_00_window', key));
       if (!row || typeof row !== 'object') return null;
       const ids = (row as any).ids;
-      return Array.isArray(ids) ? (ids as RecordVersionArray) : null;
+      if (!Array.isArray(ids)) return null;
+      return { ids: ids as RecordVersionArray, confirmed: (row as any).confirmed === true };
     } catch {
       return null;
     }
   }
 
-  /** Persist the durable membership row. Best-effort: callers must not fail a
-   *  sync round because the mirror write failed. */
-  async writeWindowMembership(key: string, ids: RecordVersionArray): Promise<void> {
+  /**
+   * Persist the durable membership row. Best-effort: callers must not fail a
+   * sync round because the mirror write failed.
+   *
+   * `confirmed` says whether a cold start may trust this row even when it is
+   * empty. A confirmed empty is a real answer ("the server says this query has
+   * no rows") and stays empty across a reload; an unconfirmed empty is the
+   * retry budget's guess and falls back to the predicate scan on the next boot,
+   * exactly as every empty row did before the marker existed.
+   */
+  async writeWindowMembership(
+    key: string,
+    ids: RecordVersionArray,
+    confirmed: boolean
+  ): Promise<void> {
     try {
       await this.local.upsert(
         '_00_window',
         new RecordId('_00_window', key),
-        { ids, updatedAt: Date.now() },
+        { ids, confirmed, updatedAt: Date.now() },
         'replace'
       );
     } catch (err) {
@@ -1389,9 +1418,16 @@ export class DataModule<S extends SchemaStructure> {
     // registration, well inside the flush window for a real collection, so
     // "believe it the second time" blanked exactly the lists this guard exists
     // to protect — reported as rows vanishing ~2s after a page load.
+    // Whether this write may be trusted by the NEXT session. Non-empty sets
+    // always; an empty set only when the server stood behind it (a zero row
+    // count, or a real set was seen this session and it is now gone). The
+    // retry-budget path below accepts an empty without that backing and must
+    // stay non-durable, or the poisoned-device self-heal is lost.
+    let confirmed = remoteArray.length > 0 || queryState.config.remoteSeen === true;
     if (remoteArray.length === 0 && !queryState.config.remoteSeen) {
       const serverRowCount = opts?.serverRowCount;
       const knownEmpty = serverRowCount === 0;
+      confirmed = knownEmpty;
       if (!knownEmpty) {
         // Unknown row count still gets a bounded escape hatch, so a server that
         // cannot report one never strands a device on a durable seed forever.
@@ -1429,7 +1465,7 @@ export class DataModule<S extends SchemaStructure> {
       queryState.config.emptyReads = 0;
     }
     if (queryState.config.membershipKey) {
-      await this.writeWindowMembership(queryState.config.membershipKey, remoteArray);
+      await this.writeWindowMembership(queryState.config.membershipKey, remoteArray, confirmed);
     }
     try {
       await this.local.query(
@@ -1499,10 +1535,10 @@ export class DataModule<S extends SchemaStructure> {
       config.emptyReads = 0;
       if (config.membershipKey) {
         const durable = await this.getWindowMembership(config.membershipKey);
-        // Length-checked for the same reason as the cold-start read above: an
-        // empty durable row is indistinguishable from "never had membership".
-        if (durable?.length) {
-          config.remoteArray = durable;
+        // Same rule as the cold-start read: a non-empty row, or an empty one
+        // the server confirmed, is membership; an unmarked empty row is not.
+        if (durable && (durable.ids.length > 0 || durable.confirmed)) {
+          config.remoteArray = durable.ids;
           config.membershipKnown = true;
         }
       }
@@ -2193,12 +2229,16 @@ export class DataModule<S extends SchemaStructure> {
     // removed row reappearing after a reload, and it works with no network.
     if (membershipKey && !config.remoteArray?.length) {
       const durable = await this.getWindowMembership(membershipKey);
-      // `durable.length` on purpose: an empty durable row cannot be told apart
-      // from one written before this device ever saw a real id-set, and treating
-      // it as known means the first paint is empty with no scan fallback. It
-      // also self-heals devices poisoned by the pre-fix `writeWindowMembership`.
-      if (durable?.length) {
-        config.remoteArray = durable;
+      // An empty durable row is trusted only when it carries the `confirmed`
+      // marker, i.e. the server itself reported the query empty. Without it an
+      // empty row cannot be told apart from one written before this device ever
+      // saw a real id-set (or by the pre-`ea56f50e` client that mirrored
+      // unflushed reads), and treating it as known would paint an empty list
+      // with no scan fallback. A confirmed empty is the opposite case: the
+      // server said "no rows", so a reload must stay empty rather than re-admit
+      // every cached body until the next poll blanks it again.
+      if (durable && (durable.ids.length > 0 || durable.confirmed)) {
+        config.remoteArray = durable.ids;
         config.membershipKnown = true;
       }
     } else if (config.remoteArray?.length) {

package/src/modules/devtools/index.ts

@@ -208,6 +208,12 @@ export class DevToolsService implements StreamUpdateReceiver {
         data: q.records,
         localArray: q.config.localArray,
         remoteArray: q.config.remoteArray,
+        // Membership state, so "why is this list empty" is answerable from
+        // the panel: is the server's set known, has a non-empty one been seen
+        // this session, how many empty reads were ignored.
+        membershipKnown: q.config.membershipKnown === true,
+        remoteSeen: q.config.remoteSeen === true,
+        emptyReads: q.config.emptyReads ?? 0,
         // Detailed per-phase processing-time breakdown (SSP sub-phases, local/
         // remote record fetch, frontend reconcile, registration). Flows to both
         // the DevTools panel and the MCP (which returns activeQueries verbatim).

package/src/types.ts

@@ -513,6 +513,11 @@ export interface QueryConfig {
    * "never established" has to fall back to a predicate scan of the local store
    * so a query first run on this device still paints offline. A
    * `remoteArray.length === 0` check cannot tell those apart.
+   *
+   * On a cold start it is seeded from the durable `_00_window` row when that
+   * row is non-empty, or empty but `confirmed` (the server reported zero rows
+   * for the query). An unconfirmed empty row is ignored, so a device poisoned
+   * by an old client that mirrored unflushed reads still self-heals.
    */
   membershipKnown?: boolean;
   /**
@@ -528,6 +533,9 @@ export interface QueryConfig {
    * genuine transition and must be honoured, or removed rows resurrect.
    *
    * In-memory only: a fresh session must re-earn the right to believe empties.
+   * What does persist is the `confirmed` marker on the `_00_window` row, which
+   * an empty set earns when it arrives with a server row count of zero or after
+   * a non-empty set in the same session.
    */
   remoteSeen?: boolean;
   /**