@spooky-sync/core 0.0.1-canary.205 → 0.0.1-canary.207

package/src/modules/sync/sync.tabs.test.ts

@@ -0,0 +1,249 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { RecordId } from 'surrealdb';
+import { Sp00kySync } from './sync';
+import type { IngestTuple } from '../../services/tabs/protocol';
+
+// Shared-tabs sync roles. A follower's optimistic write used to enter only
+// its own circuit: the leader and every other follower learned of it after the
+// server round-trip, through a LIVE event SurrealDB v3 sometimes drops. Now the
+// follower posts the ingested tuples to the leader, which feeds its own circuit
+// and fans them out (excluding the origin), and the leader tells every follower
+// when a push settled so the row does not blink out of the render set.
+
+function makeLogger(): any {
+  const logger: any = {
+    child: () => logger,
+    debug: () => {},
+    info: () => {},
+    warn: () => {},
+    error: () => {},
+    trace: () => {},
+  };
+  return logger;
+}
+
+const tuple = (op: IngestTuple['op'], id = 'thread:c'): IngestTuple => ({
+  table: 'thread',
+  op,
+  id,
+  record: { id, _00_rv: 1 },
+});
+
+function makeSync() {
+  const queryId = new RecordId('_00_query', 'h1');
+  const queryState: any = {
+    config: {
+      id: queryId,
+      localArray: [['thread:a', 1]],
+      remoteArray: [['thread:a', 1]],
+      membershipKnown: true,
+      membershipKey: 'stable-key',
+    },
+  };
+  const updateQueryRemoteArray = vi.fn(async (_h: string, next: any) => {
+    queryState.config.remoteArray = next;
+  });
+  const dataModule: any = {
+    getQueryById: vi.fn((id: RecordId) => (String(id.id) === 'h1' ? queryState : undefined)),
+    getQueryByHash: vi.fn().mockReturnValue(queryState),
+    updateQueryRemoteArray,
+    notifyQuerySynced: vi.fn().mockResolvedValue(undefined),
+    notifyTableQueries: vi.fn().mockResolvedValue(undefined),
+    noteWriteSettled: vi.fn(),
+    getActiveQueryHashes: () => ['h1'],
+    getPendingRecordIds: async () => ({ writes: new Set(), deletes: new Set() }),
+  };
+  const cache: any = { applyRelayedIngest: vi.fn() };
+  const sync = new Sp00kySync(
+    {} as any,
+    { query: vi.fn() } as any,
+    cache,
+    dataModule,
+    {} as any,
+    makeLogger()
+  );
+  (sync as any).runSyncForQuery = vi.fn().mockResolvedValue(undefined);
+  (sync as any).upQueue.enqueueFromDatabase = vi.fn().mockResolvedValue(undefined);
+  (sync as any).scheduler.enqueueMutation = vi.fn();
+
+  const hub: any = {
+    onFollowerMessage: null,
+    relayIngest: vi.fn(),
+    broadcast: vi.fn(),
+    sendTo: vi.fn(),
+  };
+  const forwarder: any = {
+    onLeaderMessage: null,
+    mutationEnqueued: vi.fn(),
+    ingest: vi.fn(),
+  };
+  return { sync, cache, dataModule, hub, forwarder, queryState, updateQueryRemoteArray };
+}
+
+describe('shared-tabs leader', () => {
+  beforeEach(() => vi.clearAllMocks());
+
+  it('applies a follower ingest to its own circuit and relays it to the other followers', () => {
+    const { sync, cache, hub } = makeSync();
+    sync.promoteToLeader(hub);
+    const tuples = [tuple('CREATE')];
+
+    hub.onFollowerMessage('tab-2', { type: 'ingest', tuples });
+
+    expect(cache.applyRelayedIngest).toHaveBeenCalledWith(tuples);
+    expect(hub.relayIngest).toHaveBeenCalledWith(tuples, 'tab-2');
+  });
+
+  it('re-materializes the table queries for a relayed DELETE', async () => {
+    const { sync, dataModule, hub } = makeSync();
+    sync.promoteToLeader(hub);
+
+    hub.onFollowerMessage('tab-2', { type: 'ingest', tuples: [tuple('DELETE')] });
+    await Promise.resolve();
+
+    expect(dataModule.notifyTableQueries).toHaveBeenCalledWith('thread');
+  });
+
+  it('does not re-materialize for a relayed CREATE/UPDATE (the stream update covers it)', async () => {
+    const { sync, dataModule, hub } = makeSync();
+    sync.promoteToLeader(hub);
+
+    hub.onFollowerMessage('tab-2', { type: 'ingest', tuples: [tuple('UPDATE')] });
+    await Promise.resolve();
+
+    expect(dataModule.notifyTableQueries).not.toHaveBeenCalled();
+  });
+
+  it('treats a follower write as activity for the poll backoff', () => {
+    const { sync, hub } = makeSync();
+    sync.promoteToLeader(hub);
+
+    (sync as any).listRefIdleStreak = 7;
+    hub.onFollowerMessage('tab-2', { type: 'ingest', tuples: [tuple('CREATE')] });
+    expect((sync as any).listRefIdleStreak).toBe(0);
+
+    (sync as any).listRefIdleStreak = 7;
+    hub.onFollowerMessage('tab-2', {
+      type: 'mutation-enqueued',
+      mutationId: '_00_pending_mutations:1_0001_tab-2',
+    });
+    expect((sync as any).listRefIdleStreak).toBe(0);
+    expect((sync as any).upQueue.enqueueFromDatabase).toHaveBeenCalledWith(
+      '_00_pending_mutations:1_0001_tab-2'
+    );
+  });
+
+  it('notes a settled mutation locally and broadcasts it to every follower', () => {
+    const { sync, dataModule, hub } = makeSync();
+    sync.promoteToLeader(hub);
+
+    (sync as any).handleMutationSettled({
+      type: 'create',
+      mutation_id: new RecordId('_00_pending_mutations', '1_0001_tab-2'),
+      record_id: new RecordId('thread', 'c'),
+    });
+
+    expect(dataModule.noteWriteSettled).toHaveBeenCalledWith('thread:c', 'create');
+    expect(hub.broadcast).toHaveBeenCalledWith({
+      type: 'mutation-settled',
+      mutationId: '_00_pending_mutations:1_0001_tab-2',
+      recordId: 'thread:c',
+      eventType: 'create',
+    });
+  });
+
+  it('solo: a settled mutation is noted locally with no hub to broadcast on', () => {
+    const { sync, dataModule } = makeSync();
+    (sync as any).handleMutationSettled({
+      type: 'update',
+      mutation_id: new RecordId('_00_pending_mutations', '1_0001_solo'),
+      record_id: new RecordId('thread', 'c'),
+    });
+    expect(dataModule.noteWriteSettled).toHaveBeenCalledWith('thread:c', 'update');
+  });
+});
+
+describe('shared-tabs follower', () => {
+  beforeEach(() => vi.clearAllMocks());
+
+  it('starts the local settled-write grace on mutation-settled', () => {
+    const { sync, dataModule, forwarder } = makeSync();
+    sync.demoteToFollower(forwarder);
+
+    forwarder.onLeaderMessage({
+      type: 'mutation-settled',
+      mutationId: '_00_pending_mutations:1_0001_tab-1',
+      recordId: 'thread:c',
+      eventType: 'delete',
+    });
+
+    expect(dataModule.noteWriteSettled).toHaveBeenCalledWith('thread:c', 'delete');
+  });
+
+  it('feeds a relayed ingest to the local circuit', async () => {
+    const { sync, cache, dataModule, forwarder } = makeSync();
+    sync.demoteToFollower(forwarder);
+    const tuples = [tuple('DELETE')];
+
+    forwarder.onLeaderMessage({ type: 'ingest-relay', tuples, leadershipId: 1, seq: 1 });
+    await Promise.resolve();
+
+    expect(cache.applyRelayedIngest).toHaveBeenCalledWith(tuples);
+    expect(dataModule.notifyTableQueries).toHaveBeenCalledWith('thread');
+  });
+
+  it('applies a relayed list_ref change for one of its own queries', async () => {
+    const { sync, forwarder, updateQueryRemoteArray } = makeSync();
+    sync.demoteToFollower(forwarder);
+
+    forwarder.onLeaderMessage({
+      type: 'list-ref-change',
+      action: 'CREATE',
+      queryId: '_00_query:h1',
+      recordId: 'thread:c',
+      version: 1,
+      parent: false,
+    });
+    await new Promise((r) => setTimeout(r, 0));
+
+    expect(updateQueryRemoteArray).toHaveBeenCalledWith('h1', [
+      ['thread:a', 1],
+      ['thread:c', 1],
+    ]);
+    expect((sync as any).runSyncForQuery).toHaveBeenCalled();
+  });
+
+  it('ignores a relayed list_ref change for another tab query', async () => {
+    const { sync, forwarder, updateQueryRemoteArray } = makeSync();
+    sync.demoteToFollower(forwarder);
+
+    forwarder.onLeaderMessage({
+      type: 'list-ref-change',
+      action: 'CREATE',
+      queryId: '_00_query:foreign',
+      recordId: 'thread:c',
+      version: 1,
+      parent: false,
+    });
+    await new Promise((r) => setTimeout(r, 0));
+
+    expect(updateQueryRemoteArray).not.toHaveBeenCalled();
+    expect((sync as any).runSyncForQuery).not.toHaveBeenCalled();
+  });
+
+  it('forwards mutation ids to the leader instead of queueing locally', async () => {
+    const { sync, forwarder } = makeSync();
+    sync.demoteToFollower(forwarder);
+
+    await sync.enqueueMutation([
+      {
+        type: 'create',
+        mutation_id: new RecordId('_00_pending_mutations', '1_0001_tab-2'),
+        record_id: new RecordId('thread', 'c'),
+      } as any,
+    ]);
+
+    expect(forwarder.mutationEnqueued).toHaveBeenCalledWith('_00_pending_mutations:1_0001_tab-2');
+    expect((sync as any).scheduler.enqueueMutation).not.toHaveBeenCalled();
+  });
+});

package/src/modules/sync/sync.ts

@@ -43,6 +43,7 @@ import {
 import { ANON_USER_ID, DEFAULT_REF_MODE, listRefTableFor, RefMode } from '../ref-tables';
 import { mutationOwnerTabId } from '../data/mutation-id';
 import type { LeaderSyncHub, SyncForwarder } from '../../services/tabs/coordinator';
+import type { IngestTuple } from '../../services/tabs/protocol';
 import { parseRecordIdString } from '../../utils/index';
 
 /**
@@ -562,13 +563,24 @@ export class Sp00kySync<S extends SchemaStructure> {
     this.forwarder = null;
     this.leaderDutiesInFlight = null;
     hub.onFollowerMessage = (tabId, msg) => {
-      void tabId;
       switch (msg.type) {
         case 'sync-hello':
           break;
         case 'mutation-enqueued':
+          // A write is activity: snap the poll back to its base cadence so the
+          // membership for it lands fast even if LIVE drops the event.
+          this.listRefIdleStreak = 0;
           void this.enqueueForwardedMutation(msg.mutationId);
           break;
+        case 'ingest':
+          // A follower's optimistic write. The row is already in the shared
+          // store; feed this tab's circuit and fan it out to every OTHER
+          // follower, so the write shows up everywhere in one hop instead of
+          // after the server round-trip (which also depends on LIVE delivery).
+          this.applyRelayedIngest(msg.tuples);
+          hub.relayIngest(msg.tuples, tabId);
+          this.listRefIdleStreak = 0;
+          break;
         case 'request-poll':
           this.listRefIdleStreak = 0;
           break;
@@ -617,6 +629,17 @@ export class Sp00kySync<S extends SchemaStructure> {
     void this.killRefLiveQuery();
     forwarder.onLeaderMessage = (msg) => {
       switch (msg.type) {
+        case 'ingest-relay':
+          this.applyRelayedIngest(msg.tuples);
+          break;
+        case 'mutation-settled':
+          // The leader pushed a write and deleted its outbox row from the
+          // shared store. Without this the row would leave this tab's render
+          // set (it is in neither membership nor pending writes) until the
+          // relayed `_00_list_ref` event lands: the blink the leader itself
+          // is already protected from by `handleMutationSettled`.
+          this.dataModule.noteWriteSettled(msg.recordId, msg.eventType);
+          break;
         case 'list-ref-change':
           void this.applyRelayedListRefChange(msg).catch((err) => {
             this.logger.error(
@@ -633,8 +656,8 @@ export class Sp00kySync<S extends SchemaStructure> {
           });
           break;
         default:
-          // db-ready and ingest-relay are handled by the engine/cache wiring
-          // in Sp00kyClient before messages reach this handler.
+          // db-ready is consumed by the coordinator's attach handshake before
+          // the sync handler is installed.
           break;
       }
     };
@@ -673,6 +696,26 @@ export class Sp00kySync<S extends SchemaStructure> {
     await this.upQueue.enqueueFromDatabase(mutationId);
   }
 
+  /**
+   * Tuples another tab already committed to the shared store: feed them to
+   * THIS tab's circuit (no local write). A DELETE additionally forces a
+   * re-materialize of the table's queries, exactly as the writing tab does
+   * for itself, because the SSP may not emit a view update for it.
+   */
+  private applyRelayedIngest(tuples: IngestTuple[]): void {
+    this.cache.applyRelayedIngest(tuples);
+    const deletedTables = new Set<string>();
+    for (const t of tuples) if (t.op === 'DELETE') deletedTables.add(t.table);
+    for (const table of deletedTables) {
+      void this.dataModule.notifyTableQueries(table).catch((err) => {
+        this.logger.warn(
+          { err, table, Category: 'sp00ky-client::Sp00kySync::applyRelayedIngest' },
+          'Re-materialize after relayed delete failed'
+        );
+      });
+    }
+  }
+
   /** A relayed `_00_list_ref` LIVE event: resolve against THIS tab's queries
    *  and run the exact same handling the LIVE subscription would have. */
   private async applyRelayedListRefChange(msg: {
@@ -1282,8 +1325,19 @@ export class Sp00kySync<S extends SchemaStructure> {
     // until the next poll tick, which is up to 5s of showing a deleted row. This
     // also persists the durable `_00_window` mirror, so the removal survives a
     // reload with no network.
-    if (existing.config.membershipKnown && (diff.removed.length || diff.added.length)) {
-      const next = applyRecordVersionDiff(existing.config.remoteArray ?? [], diff);
+    //
+    // Derived from the raw action, NOT from `diff`: `createDiffFromDbOp` is
+    // empty when the circuit already holds the row at this version, which is
+    // every tab that ingested the write optimistically (its own, or one
+    // relayed from another tab). The fetch is rightly skipped then, but the
+    // membership still has to be recorded, or the row lives on the
+    // settled-write grace alone until the poll catches it.
+    if (existing.config.membershipKnown) {
+      const membershipDiff: RecordVersionDiff =
+        action === 'DELETE'
+          ? { added: [], updated: [], removed: [recordId] }
+          : { added: [{ id: recordId, version }], updated: [], removed: [] };
+      const next = applyRecordVersionDiff(existing.config.remoteArray ?? [], membershipDiff);
       if (!recordVersionArraysEqual(next, existing.config.remoteArray ?? [])) {
         await this.dataModule.updateQueryRemoteArray(hash, next);
       }
@@ -1437,7 +1491,18 @@ export class Sp00kySync<S extends SchemaStructure> {
    * vanish, and return, while every other client showed it throughout.
    */
   private handleMutationSettled(event: UpEvent): void {
-    this.dataModule.noteWriteSettled(encodeRecordId(event.record_id), event.type);
+    const recordId = encodeRecordId(event.record_id);
+    this.dataModule.noteWriteSettled(recordId, event.type);
+    // Shared-tabs: the outbox row just left the SHARED store, so every
+    // follower rendering the row as a pending write has the same gap. All of
+    // them, not just the owner: any tab whose query matched the row was
+    // showing it through `pendingWrites`.
+    this.hub?.broadcast({
+      type: 'mutation-settled',
+      mutationId: encodeRecordId(event.mutation_id),
+      recordId,
+      eventType: event.type,
+    });
   }
 
   private async handleRollback(event: UpEvent, error: Error): Promise<void> {

package/src/services/tabs/coordinator.test.ts

@@ -1,7 +1,12 @@
 import { describe, it, expect, beforeEach, afterEach } from 'vitest';
 import { handleConnect, __resetBrokerForTests } from './tabs-broker-worker';
-import { installBrokerGlobals, installFakeLocks } from './fake-ports.fixture';
-import { TabsCoordinator, type CoordinatorHooks, type LeaderSyncHub, type SyncForwarder } from './coordinator';
+import { fakeChannel, flush, installBrokerGlobals, installFakeLocks } from './fake-ports.fixture';
+import {
+  TabsCoordinator,
+  SyncForwarder,
+  type CoordinatorHooks,
+  type LeaderSyncHub,
+} from './coordinator';
 import type { StorageHealth } from '../../types';
 import type { LeaderToFollowerMessage } from './protocol';
 
@@ -156,6 +161,117 @@ describe('TabsCoordinator integration', () => {
     await a.coordinator.stop();
   });
 
+  // A follower's optimistic write must reach the leader (which ingests it and
+  // fans it out) in one hop. Before this, only the mutation id was forwarded
+  // and every other tab waited on the server round-trip + LIVE delivery.
+  it('forwards a follower ingest to the leader hub tagged with the origin tab', async () => {
+    const a = makeCoordinator('tab-1');
+    await a.coordinator.start('anon');
+    const b = makeCoordinator('tab-2');
+    await b.coordinator.start('anon');
+
+    const seen: { tabId: string; msg: unknown }[] = [];
+    a.log.hub!.onFollowerMessage = (tabId, msg) => seen.push({ tabId, msg });
+    const tuples = [{ table: 'game', op: 'CREATE' as const, id: 'game:9', record: { id: 'game:9' } }];
+    b.log.forwarder!.ingest(tuples);
+    await new Promise((r) => setTimeout(r, 20));
+
+    const ingest = seen.filter((s) => (s.msg as { type: string }).type === 'ingest');
+    expect(ingest).toHaveLength(1);
+    expect(ingest[0].tabId).toBe('tab-2');
+    expect((ingest[0].msg as { tuples: unknown }).tuples).toEqual(tuples);
+    await b.coordinator.stop();
+    await a.coordinator.stop();
+  });
+
+  it('fan-out with exceptTabId skips the origin follower and reaches the others', async () => {
+    const a = makeCoordinator('tab-1');
+    await a.coordinator.start('anon');
+    const b = makeCoordinator('tab-2');
+    await b.coordinator.start('anon');
+    const c = makeCoordinator('tab-3');
+    await c.coordinator.start('anon');
+
+    const seenB: LeaderToFollowerMessage[] = [];
+    const seenC: LeaderToFollowerMessage[] = [];
+    b.log.forwarder!.onLeaderMessage = (msg) => seenB.push(msg);
+    c.log.forwarder!.onLeaderMessage = (msg) => seenC.push(msg);
+    a.log.hub!.relayIngest(
+      [{ table: 'game', op: 'CREATE', id: 'game:9', record: { id: 'game:9' } }],
+      'tab-2'
+    );
+    await new Promise((r) => setTimeout(r, 20));
+
+    expect(seenB.filter((m) => m.type === 'ingest-relay')).toHaveLength(0);
+    expect(seenC.filter((m) => m.type === 'ingest-relay')).toHaveLength(1);
+    await c.coordinator.stop();
+    await b.coordinator.stop();
+    await a.coordinator.stop();
+  });
+
+  // Unlike a mutation notify, an ingest is NOT queued across a leaderless
+  // window: the next leader primes its circuit from the shared store, which
+  // already holds the row, and a stale replay would put an older `_00_rv` in
+  // its version memo.
+  it('drops an ingest while detached instead of queueing it', async () => {
+    const forwarder = new SyncForwarder('tab-x');
+    forwarder.ingest([{ table: 'game', op: 'CREATE', id: 'game:1', record: { id: 'game:1' } }]);
+
+    const { port1, port2 } = fakeChannel();
+    const seen: { type: string }[] = [];
+    port2.onmessage = (ev) => {
+      seen.push(ev.data as { type: string });
+    };
+    forwarder.rebind(port1 as unknown as MessagePort);
+    await flush();
+
+    expect(seen.map((m) => m.type)).toEqual(['sync-hello']);
+    forwarder.unbind();
+  });
+
+  // Relay traffic that lands between `db-ready` and the sync hooks being
+  // installed (the store adopt is async) used to hit a null handler on a
+  // first attach and vanish.
+  it('buffers leader messages that land before the follower hooks are installed', async () => {
+    const a = makeCoordinator('tab-1');
+    await a.coordinator.start('anon');
+
+    let adoptStartedResolve!: () => void;
+    const adoptStartedP = new Promise<void>((r) => {
+      adoptStartedResolve = r;
+    });
+    let releaseAdopt!: () => void;
+    const adoptGate = new Promise<void>((r) => {
+      releaseAdopt = r;
+    });
+    const seen: LeaderToFollowerMessage[] = [];
+    const b = makeCoordinator('tab-2', {
+      async adoptAttached() {
+        adoptStartedResolve();
+        await adoptGate;
+      },
+      becomeSyncFollower(forwarder) {
+        forwarder.onLeaderMessage = (msg) => seen.push(msg);
+      },
+    });
+    const started = b.coordinator.start('anon');
+    await adoptStartedP;
+    a.log.hub!.broadcast({
+      type: 'mutation-settled',
+      mutationId: '_00_pending_mutations:1_0001_tab-1',
+      recordId: 'game:1',
+      eventType: 'create',
+    });
+    await new Promise((r) => setTimeout(r, 20));
+    expect(seen).toHaveLength(0);
+
+    releaseAdopt();
+    await started;
+    expect(seen.map((m) => m.type)).toEqual(['mutation-settled']);
+    await b.coordinator.stop();
+    await a.coordinator.stop();
+  });
+
   it('promotes the follower when the leader stops (failover)', async () => {
     const a = makeCoordinator('tab-1');
     await a.coordinator.start('anon');

package/src/services/tabs/coordinator.ts

@@ -201,6 +201,18 @@ export class SyncForwarder {
   mutationEnqueued(mutationId: string): void {
     this.post({ type: 'mutation-enqueued', mutationId });
   }
+  /** An optimistic write this tab just ingested. Deliberately NOT queued while
+   *  detached: a new leader primes its circuit from the shared store, which
+   *  already holds the row, and replaying a stale tuple at it later would put
+   *  an older `_00_rv` in its version memo. */
+  ingest(tuples: IngestTuple[]): void {
+    if (!this.port) return;
+    try {
+      this.port.postMessage({ type: 'ingest', tuples });
+    } catch {
+      /* dead port; broker re-mints */
+    }
+  }
   requestPoll(): void {
     this.post({ type: 'request-poll' });
   }
@@ -545,6 +557,12 @@ export class TabsCoordinator {
     const forwarder = this.forwarder;
     await new Promise<void>((resolve) => {
       let adopted = false;
+      let attached = false;
+      // Relay traffic that lands between `db-ready` and the sync hooks being
+      // installed (the store adopt is async). Held and replayed, not dropped:
+      // on a first attach there is no previous handler, so an ingest-relay or
+      // settled notice in that window used to vanish.
+      const pending: LeaderToFollowerMessage[] = [];
       const previousHandler = forwarder.onLeaderMessage;
       forwarder.onLeaderMessage = (msg) => {
         if (msg.type === 'db-ready' && !adopted) {
@@ -557,11 +575,18 @@ export class TabsCoordinator {
             })
             .then(() => {
               this.deps.hooks.becomeSyncFollower(forwarder);
+              attached = true;
+              const backlog = pending.splice(0);
+              for (const m of backlog) forwarder.onLeaderMessage?.(m);
               this.setRole('follower');
               resolve();
             });
           return;
         }
+        if (!attached) {
+          pending.push(msg);
+          return;
+        }
         previousHandler?.(msg);
       };
       forwarder.rebind(syncPort);

package/src/services/tabs/protocol.ts

@@ -215,7 +215,13 @@ export type FollowerToLeaderMessage =
    *  leader should drain it. Idempotent; a new leader's loadFromDatabase is
    *  the backstop for a notify lost in a failover window. */
   | { type: 'mutation-enqueued'; mutationId: string }
-  | { type: 'request-poll' };
+  | { type: 'request-poll' }
+  /** An optimistic write this follower committed to the SHARED store and
+   *  ingested into its own circuit. The leader ingests it (no DB write, the
+   *  row is already there) and fans it out to every OTHER follower as
+   *  `ingest-relay`, so a follower's write lands in every tab in one hop
+   *  instead of after the server round-trip. */
+  | { type: 'ingest'; tuples: IngestTuple[] };
 
 export type LeaderToFollowerMessage =
   | { type: 'db-ready'; leadershipId: number; bucketId: string; storageHealth: StorageHealth }
@@ -239,4 +245,14 @@ export type LeaderToFollowerMessage =
       recordId: string;
       eventType: 'create' | 'update' | 'delete';
       error: string;
+    }
+  /** The leader's drain pushed a mutation and deleted its outbox row from the
+   *  SHARED store. Every follower starts its settled-write grace so a row it
+   *  was rendering as a pending write does not blink out before its
+   *  `_00_list_ref` membership arrives. */
+  | {
+      type: 'mutation-settled';
+      mutationId: string;
+      recordId: string;
+      eventType: 'create' | 'update' | 'delete';
     };

package/src/sp00ky.ts

@@ -673,20 +673,18 @@ export class Sp00kyClient<S extends SchemaStructure> {
       resumeSyncLeaderDuties: () => this.sync.resumeLeaderDuties(),
       becomeSyncFollower: (forwarder) => {
         this.streamProcessor.setPersistenceEnabled(false);
-        this.cache.setIngestRelay(null);
+        // A follower's own mutations go to the leader, which ingests them and
+        // fans them out to the other followers: one hop, no server round-trip.
+        // Only the mutation path relays; this tab's sync fetches are the
+        // leader's data coming back and must not be re-broadcast.
+        this.cache.setIngestRelay((tuples) => forwarder.ingest(tuples), {
+          localWritesOnly: true,
+        });
         this.sync.setTabContext('follower', tabId);
         this.dataModule.setTabId(tabId);
+        // Installs the whole syncPort handler: ingest-relay, list_ref relay,
+        // settled writes, rollbacks.
         this.sync.demoteToFollower(forwarder);
-        // demoteToFollower installed the sync-level handler (list_ref relay,
-        // rollbacks); layer the cache-level ingest relay in front of it.
-        const inner = forwarder.onLeaderMessage;
-        forwarder.onLeaderMessage = (msg) => {
-          if (msg.type === 'ingest-relay') {
-            this.cache.applyRelayedIngest(msg.tuples);
-            return;
-          }
-          inner?.(msg);
-        };
       },
       becomeSyncSolo: () => {
         this.streamProcessor.setPersistenceEnabled(true);

package/src/types.ts

@@ -513,6 +513,11 @@ export interface QueryConfig {
    * "never established" has to fall back to a predicate scan of the local store
    * so a query first run on this device still paints offline. A
    * `remoteArray.length === 0` check cannot tell those apart.
+   *
+   * On a cold start it is seeded from the durable `_00_window` row when that
+   * row is non-empty, or empty but `confirmed` (the server reported zero rows
+   * for the query). An unconfirmed empty row is ignored, so a device poisoned
+   * by an old client that mirrored unflushed reads still self-heals.
    */
   membershipKnown?: boolean;
   /**
@@ -528,6 +533,9 @@ export interface QueryConfig {
    * genuine transition and must be honoured, or removed rows resurrect.
    *
    * In-memory only: a fresh session must re-earn the right to believe empties.
+   * What does persist is the `confirmed` marker on the `_00_window` row, which
+   * an empty set earns when it arrives with a server row count of zero or after
+   * a non-empty set in the same session.
    */
   remoteSeen?: boolean;
   /**