@spooky-sync/core 0.0.1-canary.240 → 0.0.1-canary.242

package/dist/sqlite-open.js

@@ -205,6 +205,15 @@ function reviveRow(json) {
 * than as text. `COALESCE` covers a row sharing none of the requested keys,
 * where the subquery yields NULL and `reviveRow` would throw.
 *
+* The one value `je.value` does NOT carry back is a TOP-LEVEL boolean. SQLite
+* has no boolean type, so `json_each` hands `true`/`false` out as the integers
+* 1/0 and `json_group_object` writes integers back. A projected row therefore
+* read `published: 1` where the same row read whole read `published: true`,
+* and every `=== true` in an app turned false the moment a screen painted from
+* the local cache. (A boolean NESTED in an object or array survives: those come
+* back as whole JSON documents, untouched.) `je.type` still knows what it was,
+* so the two boolean types are rebuilt as JSON literals on the way out.
+*
 * Deliberately unaliased, so the emitted statement keeps the exact shape the
 * callers already produce (`FROM "t" WHERE id IN (…)`).
 *
@@ -214,7 +223,7 @@ function reviveRow(json) {
 function projectedDataSql(fields, bind) {
 	const keys = ["id", ...fields];
 	for (const k of keys) bind.push(k);
-	return `COALESCE((SELECT json_group_object(je.key, je.value) FROM json_each(data) je WHERE je.key IN (${keys.map(() => "?").join(", ")})), '{}') AS data`;
+	return `COALESCE((SELECT json_group_object(je.key, CASE je.type WHEN 'true' THEN json('true') WHEN 'false' THEN json('false') ELSE je.value END) FROM json_each(data) je WHERE je.key IN (${keys.map(() => "?").join(", ")})), '{}') AS data`;
 }
 function project(row, fields) {
 	const out = {};

package/dist/types.d.ts

@@ -1,6 +1,5 @@
-import { RecordId } from "surrealdb";
-import { QueryPlan, QueryPlan as QueryPlan$1, RecordId as RecordId$1, SchemaStructure, WhereNode } from "@spooky-sync/query-builder";
-import { Level, Level as Level$1, Logger, LoggerOptions } from "pino";
+import { QueryPlan, QueryPlan as QueryPlan$1, RecordId, SchemaStructure, WhereNode } from "@spooky-sync/query-builder";
+import { Level as Level$1, LoggerOptions } from "pino";
 
 //#region src/events/index.d.ts
 /**
@@ -123,36 +122,11 @@ declare class EventSystem<E extends EventTypeMap> {
   private broadcastEvent;
 }
 //#endregion
-//#region src/modules/sync/events/index.d.ts
-declare const SyncEventTypes: {
-  readonly QueryUpdated: "SYNC_QUERY_UPDATED";
-  readonly RemoteDataIngested: "SYNC_REMOTE_DATA_INGESTED";
-  readonly MutationRolledBack: "SYNC_MUTATION_ROLLED_BACK";
-  readonly SyncHealthChanged: "SYNC_HEALTH_CHANGED";
-};
-type SyncEventTypeMap = {
-  [SyncEventTypes.QueryUpdated]: EventDefinition<typeof SyncEventTypes.QueryUpdated, {
-    queryId: any;
-    localHash?: string;
-    localArray?: RecordVersionArray;
-    remoteHash?: string;
-    remoteArray?: RecordVersionArray;
-    records: Record<string, any>[];
-  }>;
-  [SyncEventTypes.RemoteDataIngested]: EventDefinition<typeof SyncEventTypes.RemoteDataIngested, {
-    records: Record<string, any>[];
-  }>;
-  [SyncEventTypes.MutationRolledBack]: EventDefinition<typeof SyncEventTypes.MutationRolledBack, {
-    eventType: string;
-    recordId: string;
-    error: string;
-  }>;
-  [SyncEventTypes.SyncHealthChanged]: EventDefinition<typeof SyncEventTypes.SyncHealthChanged, SyncHealth>;
-};
-type SyncEventSystem = EventSystem<SyncEventTypeMap>;
-//#endregion
-//#region src/services/logger/index.d.ts
-type Logger$1 = Logger;
+//#region src/utils/surql.d.ts
+interface SealedQuery<T = void> {
+  readonly sql: string;
+  readonly extract: (results: unknown[]) => T;
+}
 //#endregion
 //#region src/services/database/events/index.d.ts
 declare const DatabaseEventTypes: {
@@ -173,12 +147,6 @@ type DatabaseEventTypeMap = {
 };
 type DatabaseEventSystem = EventSystem<DatabaseEventTypeMap>;
 //#endregion
-//#region src/utils/surql.d.ts
-interface SealedQuery<T = void> {
-  readonly sql: string;
-  readonly extract: (results: unknown[]) => T;
-}
-//#endregion
 //#region src/modules/devtools/storage-info.d.ts
 /** Engine-side numbers only the engine can produce (worker round-trips). */
 interface EngineStorageDiagnostics {
@@ -371,33 +339,6 @@ type LocalEngineChoice = 'surrealdb' | 'sqlite' | LocalStore;
 /** Thrown when relation decomposition nests past {@link MAX_RELATION_DEPTH} —
  *  a guard against a cyclic schema producing unbounded fan-out. */
 //#endregion
-//#region src/modules/sync/queue/queue-up.d.ts
-type CreateEvent = {
-  type: 'create';
-  mutation_id: RecordId;
-  record_id: RecordId;
-  data: Record<string, unknown>;
-  record?: Record<string, unknown>;
-  tableName?: string;
-  options?: PushEventOptions;
-};
-type UpdateEvent = {
-  type: 'update';
-  mutation_id: RecordId;
-  record_id: RecordId;
-  data: Record<string, unknown>;
-  record?: Record<string, unknown>;
-  beforeRecord?: Record<string, unknown>;
-  options?: PushEventOptions;
-};
-type DeleteEvent = {
-  type: 'delete';
-  mutation_id: RecordId;
-  record_id: RecordId;
-  options?: PushEventOptions;
-};
-type UpEvent = CreateEvent | UpdateEvent | DeleteEvent;
-//#endregion
 //#region src/types.d.ts
 /**
  * A pino browser transmit object for forwarding logs to an external sink (e.g. OpenTelemetry).
@@ -448,9 +389,11 @@ type QueryTimeToLive = '1m' | '5m' | '10m' | '15m' | '20m' | '25m' | '30m' | '1h
  */
 type PreloadRefresh = 'onUse' | 'background' | 'stale';
 interface PreloadOptions {
-  /** How to refresh when the query is already cached locally. Default `onUse`. */
+  /** Abort a cold preload that is still waiting for the server. */
+  signal?: AbortSignal;
+  /** @deprecated Preload is a registered query now; a warm preload never refetches by itself. Ignored. */
   refresh?: PreloadRefresh;
-  /** For `refresh: 'stale'` — max age before a warm copy is refetched. Default `1h`. */
+  /** @deprecated Ignored. */
   staleTime?: QueryTimeToLive;
 }
 /**
@@ -834,16 +777,16 @@ type RecordVersionArray = Array<[string, number]>;
 interface RecordVersionDiff {
   /** List of records added. */
   added: Array<{
-    id: RecordId$1<string>;
+    id: RecordId<string>;
     version: number;
   }>;
   /** List of records updated. */
   updated: Array<{
-    id: RecordId$1<string>;
+    id: RecordId<string>;
     version: number;
   }>;
   /** List of record IDs removed. */
-  removed: RecordId$1<string>[];
+  removed: RecordId<string>[];
 }
 /**
  * Configuration for a specific query instance.
@@ -851,7 +794,7 @@ interface RecordVersionDiff {
  */
 interface QueryConfig {
   /** The unique ID of the query config record. */
-  id: RecordId$1<string>;
+  id: RecordId<string>;
   /** The SURQL query string. */
   surql: string;
   /**
@@ -878,21 +821,21 @@ interface QueryConfig {
   /**
    * Whether authoritative membership (`remoteArray`) has ever been established
    * for this query — either fetched from `_00_list_ref` this session, or read
-   * back from the durable `_00_window` row on a cold start.
+   * back from the durable `_00_view` row on a cold start.
    *
    * Tri-state matters: "known and empty" must render an empty list, while
    * "never established" has to fall back to a predicate scan of the local store
    * so a query first run on this device still paints offline. A
    * `remoteArray.length === 0` check cannot tell those apart.
    *
-   * On a cold start it is seeded from the durable `_00_window` row when that
+   * On a cold start it is seeded from the durable `_00_view` row when that
    * row is non-empty, or empty but `confirmed` (the server reported zero rows
    * for the query). An unconfirmed empty row is ignored, so a device poisoned
    * by an old client that mirrored unflushed reads still self-heals.
    */
   membershipKnown?: boolean;
   /**
-   * Key of this query's durable `_00_window` membership row: a hash of
+   * Key of this query's durable `_00_view` membership row: a hash of
    * `{surql, params}` WITHOUT the `session::id()` salt that `id` carries, so it
    * survives a reload (which mints a new session id) and a bucket switch.
    * In-memory only.
@@ -1054,7 +997,7 @@ type QueryStatusCallback = (status: QueryStatus) => void;
  * (bucket switch). What the bindings' `isAuthoritative()` mirrors.
  */
 type QueryAuthorityCallback = (known: boolean) => void;
-type MutationCallback = (mutations: UpEvent[]) => void;
+type MutationCallback = (mutations: MutationEvent[]) => void;
 type MutationEventType = 'create' | 'update' | 'delete';
 /**
  * Represents a mutation event (create, update, delete) to be synchronized.
@@ -1063,9 +1006,9 @@ interface MutationEvent {
   /** Example: 'create', 'update', or 'delete'. */
   type: MutationEventType;
   /** unique id of the mutation */
-  mutation_id: RecordId$1<string>;
+  mutation_id: RecordId<string>;
   /** The ID of the record being mutated. */
-  record_id: RecordId$1<string>;
+  record_id: RecordId<string>;
   /** The data payload for create/update operations. */
   data?: any;
   /** The full record data (optional context). */
@@ -1114,4 +1057,4 @@ interface DebounceOptions {
   delay?: number;
 }
 //#endregion
-export { ServerViewMeta as A, TimingPhase as B, QueryTimings as C, RecordVersionDiff as D, RecordVersionArray as E, StorageHealthStatus as F, DatabaseEventSystem as G, UpEvent as H, StoreType as I, SyncEventSystem as J, DatabaseEventTypes as K, SyncHealth as L, Sp00kyQueryResult as M, Sp00kyQueryResultPromise as N, RegistrationTimings as O, StorageHealth as P, SyncHealthConfig as R, QueryTimeToLive as S, ReconnectConfig as T, LocalStore as U, UpdateOptions as V, SealedQuery as W, EventSystem as X, EventDefinition as Y, QueryConfigRecord as _, MATERIALIZATION_SAMPLE_WINDOW as a, QueryStatus as b, MutationEvent as c, PhaseStat as d, PinoTransmit as f, QueryConfig as g, QueryAuthorityCallback as h, Level$1 as i, Sp00kyConfig as j, RunOptions as k, MutationEventType as l, PreloadRefresh as m, DebounceOptions as n, MembershipOutcome as o, PreloadOptions as p, Logger$1 as q, EventSubscriptionOptions as r, MutationCallback as s, ConnectionState as t, PersistenceClient as u, QueryHash as v, QueryUpdateCallback as w, QueryStatusCallback as x, QueryState as y, SyncHealthStatus as z };
+export { ServerViewMeta as A, TimingPhase as B, QueryTimings as C, RecordVersionDiff as D, RecordVersionArray as E, StorageHealthStatus as F, SealedQuery as G, LocalStore as H, StoreType as I, EventDefinition as K, SyncHealth as L, Sp00kyQueryResult as M, Sp00kyQueryResultPromise as N, RegistrationTimings as O, StorageHealth as P, SyncHealthConfig as R, QueryTimeToLive as S, ReconnectConfig as T, DatabaseEventSystem as U, UpdateOptions as V, DatabaseEventTypes as W, QueryConfigRecord as _, MATERIALIZATION_SAMPLE_WINDOW as a, QueryStatus as b, MutationEvent as c, PhaseStat as d, PinoTransmit as f, QueryConfig as g, QueryAuthorityCallback as h, Level$1 as i, Sp00kyConfig as j, RunOptions as k, MutationEventType as l, PreloadRefresh as m, DebounceOptions as n, MembershipOutcome as o, PreloadOptions as p, EventSystem as q, EventSubscriptionOptions as r, MutationCallback as s, ConnectionState as t, PersistenceClient as u, QueryHash as v, QueryUpdateCallback as w, QueryStatusCallback as x, QueryState as y, SyncHealthStatus as z };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@spooky-sync/core",
-  "version": "0.0.1-canary.240",
+  "version": "0.0.1-canary.242",
   "type": "module",
   "sideEffects": false,
   "main": "./dist/index.js",
@@ -19,7 +19,10 @@
     "dev": "tsdown --watch",
     "dev:example": "pnpm dev",
     "build": "tsdown && node scripts/check-broker-bundle.mjs",
-    "test": "vitest"
+    "test": "vitest",
+    "test:run": "vitest run",
+    "test:coverage": "vitest run --coverage",
+    "type-check": "tsc --noEmit"
   },
   "repository": {
     "type": "git",
@@ -60,8 +63,8 @@
     }
   },
   "dependencies": {
-    "@spooky-sync/query-builder": "0.0.1-canary.240",
-    "@spooky-sync/ssp-wasm": "0.0.1-canary.240",
+    "@spooky-sync/query-builder": "0.0.1-canary.242",
+    "@spooky-sync/ssp-wasm": "0.0.1-canary.242",
     "@sqlite.org/sqlite-wasm": "3.53.0-build1",
     "@surrealdb/wasm": "^3.0.3",
     "blurhash": "^2.0.5",
@@ -72,6 +75,7 @@
   },
   "devDependencies": {
     "@types/node": "^22.5.2",
+    "@vitest/coverage-v8": "^3.2.4",
     "tsdown": "^0.12.4",
     "typescript": "^5.6.2",
     "vitest": "^3.2.0"

package/skills/sp00ky-core/SKILL.md

@@ -82,6 +82,15 @@ unsubscribe();
 
 Queries have a time-to-live. Supported values: `'1m'`, `'5m'`, `'10m'` (default), `'15m'`, `'20m'`, `'25m'`, `'30m'`, `'1h'`–`'12h'`, `'1d'`.
 
+### Preloading
+
+`db.preload(query, { signal? })` registers a query without subscribing to it. If
+the server answered this query on this device before (a durable `_00_view` row
+exists) it resolves at once and the rows paint from the local store; otherwise
+it resolves once the server's membership and every record are local. Nothing
+to tear down: the entry is evicted a ttl after registration unless a view mounts
+the same query. `refresh` / `staleTime` are accepted but ignored.
+
 ## Mutations
 
 Mutations are optimistic and automatically synced to the remote SurrealDB instance.
@@ -112,6 +121,15 @@ Use `debounced` option for frequent updates (e.g., live typing):
 - `key: 'recordId'` — Debounce by record ID only (latest write wins, no merge)
 - `key: 'recordId_x_fields'` — Debounce by record ID + changed fields (recommended)
 
+### Failed writes
+
+A push the server rejects (permission, validation) is rolled back locally
+(create, update and delete) and moved to the `_00_failed_mutations` tray in the
+same local transaction. Network errors never do this; they retry. Inspect and
+act on the tray with `db.failedMutationCount`, `db.subscribeToFailedMutations(cb)`,
+`db.listFailedMutations()`, `db.retryFailedMutation(id)` (a fresh optimistic
+write) and `db.discardFailedMutation(id)`.
+
 ## Authentication
 
 See [references/auth.md](references/auth.md) for the full auth API.

package/src/boot/auth-flip.saga.test.ts

@@ -0,0 +1,82 @@
+import { describe, expect, it } from 'vitest';
+import { RecordId } from 'surrealdb';
+import { runPure } from '../testing/run-pure';
+import { fakeServices } from '../testing/services';
+import { buildEntry, buildState } from '../testing/build';
+import * as R from '../state/reducers';
+import { defaultEnv } from '../query/env';
+import { authFlip, persistVerifiedUser } from './auth-flip.saga';
+
+const env = defaultEnv({ tables: [{ name: 'user', columns: { id: {}, email_verified: {} } }] } as any);
+
+describe('authFlip', () => {
+  it('sets identity and $auth before the bucket work, writes the hint, switches, rotates the salt for a new principal, persists the user row', async () => {
+    const released: string[] = [];
+    const svc = fakeServices({
+      'auth.sessionAuthId': () => 'user:abc',
+      'auth.access': () => 'account',
+      'local.currentBucketId': () => 'anon',
+      'local.beginSwitch': () => () => void released.push('gate'),
+      'local.usesSurqlSchema': () => false,
+      'auth.token': () => 'jwt',
+      'auth.currentUser': () => ({ id: new RecordId('user', 'abc'), email_verified: true }),
+    });
+    const state = { ...buildState(), sessionId: 'old', saltUserId: null };
+    const out = await runPure(authFlip(env, 'user:abc'), {
+      state,
+      handlers: { service: svc.handler, 'local.query': () => [], 'local.execute': () => undefined, 'ssp.ingest': () => undefined },
+    });
+    const names = svc.names();
+    expect(names.slice(0, 5)).toEqual(['auth.sessionAuthId', 'auth.access', 'ssp.setSessionAuth', 'hint.write', 'local.currentBucketId']);
+    expect(svc.calls[3]).toEqual(['hint.write', ['abc']]);
+    expect(names).toContain('local.switchStore');
+    expect(names).toContain('crdt.setSessionId');
+    expect(released).toEqual(['gate']);
+    expect(out.state).toMatchObject({ userId: 'user:abc', saltUserId: 'user:abc', sessionId: 'salt-1', bucketId: 'abc' });
+    expect(out.state.versions.get('user:abc')).toBe(1);
+  });
+  it('same principal on the same bucket: no switch, no salt rotation', async () => {
+    const svc = fakeServices({
+      'auth.sessionAuthId': () => 'user:abc',
+      'auth.access': () => 'account',
+      'local.currentBucketId': () => 'abc',
+      'auth.currentUser': () => null,
+    });
+    const state = { ...buildState(), sessionId: 'keep', saltUserId: 'user:abc', bucketId: 'abc' };
+    const out = await runPure(authFlip(env, 'user:abc'), { state, handlers: { service: svc.handler } });
+    expect(svc.names()).not.toContain('local.switchStore');
+    expect(svc.names()).not.toContain('local.beginSwitch');
+    expect(out.state.sessionId).toBe('keep');
+  });
+});
+
+describe('persistVerifiedUser', () => {
+  it('skips when there is no verified row, an unknown table, or a bare id; writes otherwise and logs failures', async () => {
+    for (const row of [null, { id: 'user:x', a: 1 }, { id: new RecordId('user', 'x') }, { id: new RecordId('nope', 'x'), a: 1 }]) {
+      const svc = fakeServices({ 'auth.currentUser': () => row as any });
+      const out = await runPure(persistVerifiedUser(env), { state: buildState(), handlers: { service: svc.handler } });
+      expect(out.log.filter((e) => e.kind === 'local.execute')).toHaveLength(0);
+    }
+    const svc = fakeServices({ 'auth.currentUser': () => ({ id: new RecordId('user', 'x'), email_verified: true, junk: 1 }) });
+    const s = buildState([buildEntry({ def: { hash: 'q', tableName: 'user' } })], R.setVersions([['user:x', 4]]));
+    const out = await runPure(persistVerifiedUser(env), {
+      state: s,
+      handlers: {
+        service: svc.handler,
+        'local.execute': (e: any) => expect(e.vars.content0).toEqual({ email_verified: true, _00_rv: 4 }),
+        'ssp.ingest': (e: any) => expect(e.records[0].record.junk).toBeUndefined(),
+      },
+    });
+    expect(out.state.dirty.has('q')).toBe(true);
+    const failing = await runPure(persistVerifiedUser(env), {
+      state: s,
+      handlers: {
+        service: svc.handler,
+        'local.execute': () => {
+          throw new Error('locked');
+        },
+      },
+    });
+    expect(failing.emitted).toEqual([expect.objectContaining({ level: 'warn' })]);
+  });
+});

package/src/boot/auth-flip.saga.ts

@@ -0,0 +1,62 @@
+import { RecordId } from 'surrealdb';
+import type { Saga } from '../kernel/saga';
+import { fx } from '../kernel/effects';
+import * as R from '../state/reducers';
+import { bucketIdForUser } from '../modules/ref-tables';
+import type { SagaEnv } from '../query/env';
+import { columnsFor } from '../query/env';
+import * as sql from '../query/sql';
+import { encodeRecordId } from '../utils/index';
+import { cleanRecord } from '../utils/parser';
+import { bucketSwitch } from './bucket-switch.saga';
+
+/**
+ * The signed-in principal changed (sign-in, sign-out, boot verification).
+ * Identity first (routing and `$auth` for the local SSP), then the bucket,
+ * then the salt if the principal really changed, then the verified user row.
+ */
+export function* authFlip(env: SagaEnv, userId: string | null): Saga<void> {
+  const authId = (yield fx.service('auth.sessionAuthId')) as string | null;
+  const access = (yield fx.service('auth.access')) as string | null;
+  yield fx.state.update(R.setIdentity({ userId }));
+  yield fx.service('ssp.setSessionAuth', authId, access);
+  const target = bucketIdForUser(userId);
+  yield fx.service('hint.write', target);
+  yield fx.state.update(R.setIdentity({ pendingBucket: target }));
+  const current = (yield fx.service('local.currentBucketId')) as string;
+  const release = current === target ? null : ((yield fx.service('local.beginSwitch')) as () => void);
+  yield* bucketSwitch(env, target, release);
+  const saltUserId = (yield fx.state.read((s) => s.saltUserId)) as string | null;
+  if (authId !== saltUserId) {
+    const salt = (yield fx.id('salt')) as string;
+    yield fx.state.update(R.setIdentity({ sessionId: salt, saltUserId: authId }));
+    yield fx.service('crdt.setSessionId', salt);
+  }
+  yield* persistVerifiedUser(env);
+}
+
+/**
+ * Write the user's own row, as the server just returned it, into the local
+ * store so `user` queries see `email_verified` and friends without waiting
+ * for membership. A field refresh, not a version claim.
+ */
+export function* persistVerifiedUser(env: SagaEnv): Saga<void> {
+  const row = (yield fx.service('auth.currentUser')) as Record<string, unknown> | null;
+  if (!row || !(row.id instanceof RecordId) || Object.keys(row).length <= 1) return;
+  const rid = row.id as RecordId<string>;
+  const table = String(rid.table);
+  const columns = columnsFor(env, table);
+  if (!columns) return;
+  const id = encodeRecordId(rid);
+  const version = ((yield fx.state.read((s) => s.versions.get(id))) as number | undefined) || 1;
+  const cleaned = cleanRecord(columns as never, row);
+  const { id: _id, ...content } = cleaned;
+  try {
+    const tx = sql.upsertBodiesTx([{ id: rid, content: { ...content, _00_rv: version } }]);
+    yield fx.local.execute(tx.query, tx.vars);
+    yield fx.ssp.ingest([{ table, op: 'UPDATE', id, record: { ...cleaned, _00_rv: version } }]);
+    yield fx.state.update(R.compose(R.setVersions([[id, version]]), R.markTableDirty(table)));
+  } catch (error) {
+    yield fx.emit({ type: 'log', level: 'warn', message: 'could not persist the verified user row', data: { error } });
+  }
+}

package/src/boot/boot.saga.test.ts

@@ -0,0 +1,151 @@
+import { describe, expect, it } from 'vitest';
+import { RecordId } from 'surrealdb';
+import { runPure } from '../testing/run-pure';
+import { fakeServices } from '../testing/services';
+import { buildEntry, buildOutboxItem, buildState } from '../testing/build';
+import * as R from '../state/reducers';
+import { defaultEnv } from '../query/env';
+import { boot, migrateWindowToView, pageHide, primeCircuit, startRemote, versionsPrimed, warmBlobs } from './boot.saga';
+
+const env = defaultEnv({ tables: [] } as any);
+
+describe('boot', () => {
+  it('solo: opens the hinted bucket, provisions, starts the SSP, restores the session, mirrors the outbox, flips localReady, hands off to the network', async () => {
+    const svc = fakeServices({
+      'hint.read': () => 'u1',
+      'local.usesSurqlSchema': () => true,
+      'auth.restoreSession': async () => 'user:u1',
+      'auth.sessionAuthId': () => 'user:u1',
+      'auth.access': () => 'account',
+    });
+    const out = await runPure(boot(env, { sharedTabs: false }), {
+      handlers: { service: svc.handler, 'local.query': (e: any) => (e.sql.startsWith('SELECT count()') ? [[{ count: 1 }]] : []) },
+    });
+    expect(svc.names()).toEqual([
+      'hint.read',
+      'local.connect',
+      'local.usesSurqlSchema',
+      'migrator.provision',
+      'ssp.init',
+      'ssp.setPermissions',
+      'auth.restoreSession',
+      'auth.sessionAuthId',
+      'crdt.setSessionId',
+      'auth.access',
+      'ssp.setSessionAuth',
+      'window.attach',
+      'features.init',
+      'releases.init',
+    ]);
+    expect(svc.calls[1]).toEqual(['local.connect', ['u1']]);
+    expect(out.state).toMatchObject({ bucketId: 'u1', userId: 'user:u1', saltUserId: 'user:u1', sessionId: 'salt-1', localReady: true });
+    expect(out.dispatched.map((d) => d.type)).toEqual(['WarmBlobs', 'PrimeCircuit', 'LifecycleTick', 'GcTick', 'StartRemote']);
+    expect(svc.names()).not.toContain('remote.connect');
+  });
+  it('shared tabs: takes the role from the coordinator, or falls back to solo; schemaless engines skip provisioning; anonymous skips session auth', async () => {
+    const leader = fakeServices({ 'hint.read': () => null, 'tabs.start': async () => 'leader', 'local.usesSurqlSchema': () => false, 'auth.restoreSession': async () => null, 'auth.sessionAuthId': () => null });
+    const out = await runPure(boot(env, { sharedTabs: true }), { handlers: { service: leader.handler, 'local.query': () => [] } });
+    expect(out.state.tabRole).toBe('leader');
+    expect(out.state.bucketId).toBe('anon');
+    expect(leader.names()).not.toContain('local.connect');
+    expect(leader.names()).not.toContain('migrator.provision');
+    expect(leader.names()).not.toContain('ssp.setSessionAuth');
+    const fallback = fakeServices({
+      'hint.read': () => 'x',
+      'tabs.start': async () => {
+        throw new Error('no broker');
+      },
+      'local.usesSurqlSchema': () => false,
+      'auth.restoreSession': async () => null,
+      'auth.sessionAuthId': () => null,
+    });
+    const fb = await runPure(boot(env, { sharedTabs: true }), { handlers: { service: fallback.handler, 'local.query': () => [] } });
+    expect(fallback.calls).toContainEqual(['local.connect', ['x']]);
+    expect(fb.emitted).toContainEqual(expect.objectContaining({ level: 'warn' }));
+  });
+});
+
+describe('migrateWindowToView', () => {
+  it('copies legacy rows once, skips when _00_view has rows, tolerates errors and junk', async () => {
+    const upserts: any[] = [];
+    await runPure(migrateWindowToView(), {
+      handlers: {
+        'local.query': (e: any) =>
+          e.sql.startsWith('SELECT count()')
+            ? [[]]
+            : [[{ id: '_00_window:k1', ids: [['t:1', 1]], confirmed: true, updatedAt: 5 }, { id: new RecordId('_00_window', 'k2'), ids: [] }, { id: 'x', ids: 'bad' }, { ids: [] }]],
+        'local.upsert': (e: any) => void upserts.push(e),
+      },
+    });
+    expect(upserts).toEqual([
+      { kind: 'local.upsert', table: '_00_view', id: new RecordId('_00_view', 'k1'), data: { ids: [['t:1', 1]], confirmed: true, updatedAt: 5 }, mode: 'replace' },
+      { kind: 'local.upsert', table: '_00_view', id: new RecordId('_00_view', 'k2'), data: { ids: [], confirmed: false, updatedAt: 0 }, mode: 'replace' },
+    ]);
+    const skipped = await runPure(migrateWindowToView(), { handlers: { 'local.query': () => [[{ count: 3 }]] } });
+    expect(skipped.log.filter((e) => e.kind === 'local.query')).toHaveLength(1);
+    const failing = await runPure(migrateWindowToView(), {
+      handlers: {
+        'local.query': () => {
+          throw new Error('no table');
+        },
+      },
+    });
+    expect(failing.emitted).toEqual([expect.objectContaining({ level: 'debug' })]);
+  });
+});
+
+describe('startRemote / primeCircuit / versionsPrimed / pageHide / warmBlobs', () => {
+  it('startRemote tolerates connect and auth failures and starts the loops', async () => {
+    const svc = fakeServices({
+      'remote.connect': async () => {
+        throw new Error('offline');
+      },
+      'auth.init': async () => {
+        throw new Error('401');
+      },
+    });
+    const out = await runPure(startRemote(), { handlers: { service: svc.handler } });
+    expect(svc.names()).toEqual(['remote.connect', 'supervisor.start', 'auth.init']);
+    expect(out.emitted.filter((e) => e.type === 'log')).toHaveLength(2);
+    expect(out.dispatched.map((d) => d.type)).toEqual(['EnsureRegistered', 'LiveStart', 'PollTick', 'Drain']);
+    const ok = await runPure(startRemote(), { handlers: { service: fakeServices().handler } });
+    expect(ok.emitted).toEqual([]);
+  });
+  it('primeCircuit passes outbox ids and always flips primed', async () => {
+    const svc = fakeServices({ 'ssp.prime': async () => undefined });
+    const s = buildState([], R.outboxReplace([buildOutboxItem({ recordId: 'thing:1' })]));
+    const out = await runPure(primeCircuit(), { state: s, handlers: { service: svc.handler } });
+    expect(svc.calls).toEqual([['ssp.prime', [['thing:1']]]]);
+    expect(out.state.primed).toBe(true);
+    const failing = fakeServices({
+      'ssp.prime': async () => {
+        throw new Error('snapshot');
+      },
+    });
+    const f = await runPure(primeCircuit(), { state: buildState(), handlers: { service: failing.handler } });
+    expect(f.state.primed).toBe(true);
+    expect(f.emitted).toEqual([expect.objectContaining({ level: 'warn' })]);
+  });
+  it('versionsPrimed records versions; pageHide releases registered views; warmBlobs is best-effort', async () => {
+    const v = await runPure(versionsPrimed([['thing:1', 3]]), { state: buildState() });
+    expect(v.state.versions.get('thing:1')).toBe(3);
+    const svc = fakeServices();
+    const s = buildState([buildEntry({ def: { hash: 'a' }, lifecycle: { remote: 'registered' } }), buildEntry({ def: { hash: 'b' } })]);
+    await runPure(pageHide(), { state: s, handlers: { service: svc.handler } });
+    expect(svc.calls).toEqual([['remote.releaseViews', [[new RecordId('_00_query', 'a')]]]]);
+    const none = fakeServices();
+    await runPure(pageHide(), { state: buildState(), handlers: { service: none.handler } });
+    expect(none.calls).toEqual([]);
+    const blobs = fakeServices({
+      'blobs.start': async () => {
+        throw new Error('opfs');
+      },
+    });
+    const w = await runPure(warmBlobs(), { state: { ...buildState(), bucketId: 'u9' }, handlers: { service: blobs.handler } });
+    expect(blobs.calls).toEqual([['blobs.start', ['u9']]]);
+    expect(w.emitted).toEqual([expect.objectContaining({ level: 'warn' })]);
+    const anon = fakeServices({ 'blobs.start': async () => undefined });
+    await runPure(warmBlobs(), { state: buildState(), handlers: { service: anon.handler } });
+    expect(anon.calls).toEqual([['blobs.start', ['anon']]]);
+  });
+});