@spooky-sync/core 0.0.1-canary.283 → 0.0.1-canary.287

package/AGENTS.md

@@ -55,6 +55,7 @@ re-materialized from state, never patched in place.
 - **Raw remote calls are gated by the query allowlist.** When the generated schema carries `policy.queryAllowlist: 'warn' | 'enforce'` (from `sync.queryAllowlist` in `sp00ky.yml`), `remoteQuery`, `useRemote` and `queryRaw` throw unless the client config sets `allowRawRemote: true`; builder queries are unaffected. A registration the SSP refuses as not allowlisted (403 `not_allowlisted`) is marked `remote: 'failed'` after one attempt with an error-level log carrying the surql and a `spky generate` hint; the view stays cold (`membershipKnown` false), it is never read as confirmed empty.
 - **`@parent` columns are auto-populated.** Defined in the `.surql` schema as `record<user>` with the `-- @parent` annotation; never write them yourself — they're set from the auth context server-side.
 - **`db.preload` is a registered query.** Resolved before on this device (a `_00_view` row exists) it returns at once; never resolved it waits until the server's membership and every body are local. It holds no subscriber, so it is evicted a ttl after registration unless a view mounts the same query. `refresh`/`staleTime` are ignored; pass `signal` to abort a cold wait.
+- **A never-resolved query paints only vouched rows.** Before the server answers (`cold`), the local predicate scan shows a cached body only if some `_00_view` row names it (as a member or subquery child) or a write for it is in flight. A body no view names is an orphan (deleted upstream while nothing watched it): it stays hidden, and the GC deletes it 30 s after boot and then hourly. A `_00_view` row no query has resolved for 14 days is retired by the same sweep, so that query paints cold again.
 - **A rejected write is not lost.** Application errors roll the local row back (create/update/delete) and move the mutation to `_00_failed_mutations`; the tray API above lists, retries (as a fresh write) or discards it. Network errors keep the row queued.
 
 ## Module map (under `src/`)

package/dist/index.d.ts

@@ -1311,6 +1311,12 @@ interface ClientState {
   readonly membershipReread: ReadonlyMap<QueryHash, number>;
   /** Local body versions (`_00_rv`) by encoded record id. */
   readonly versions: ReadonlyMap<string, number>;
+  /**
+   * What each durable `_00_view` row vouches for, by view key: its members
+   * and subquery children. A body no row names is an orphan: it never paints
+   * before the server answers and the GC deletes it.
+   */
+  readonly views: ReadonlyMap<string, ReadonlyArray<string>>;
   readonly outbox: ReadonlyArray<OutboxItem>;
   readonly pendingWrites: ReadonlyMap<string, PendingWrite>;
   readonly failedCount: number;

package/dist/index.js

@@ -1,4 +1,4 @@
-import { a as renderOrderSql, c as serializeRow, i as projectedDataSql, l as resolveRelations, o as renderWhereSql, r as project, s as reviveRow, t as PROMOTION_OPEN_OPTIONS, u as stableKey } from "./sqlite-open.js";
+import { a as renderOrderSql, c as serializeMergeRow, d as stableKey, i as projectedDataSql, l as serializeRow, o as renderWhereSql, r as project, s as reviveRow, t as PROMOTION_OPEN_OPTIONS, u as resolveRelations } from "./sqlite-open.js";
 import { QueryBuilder, RecordId, baseFieldOfParam, cyrb53 } from "@spooky-sync/query-builder";
 import { DateTime, Duration, RecordId as RecordId$1, Surreal, Uuid, applyDiagnostics, createRemoteEngines } from "surrealdb";
 import pino from "pino";
@@ -448,6 +448,34 @@ function cleanRecord(tableSchema, record) {
 	return cleaned;
 }
 /**
+* The OPTIONAL schema columns a full server row does not carry, each mapped to
+* `undefined`, for spreading into a body that is landed with MERGE.
+*
+* The server omits an optional field that is unset (`UPDATE t UNSET club`
+* leaves no `club` key in `SELECT *` or the SSP body), and MERGE keeps every
+* key the patch does not mention, so without this the local store held on to
+* a cleared value forever. `undefined` is the one representation both engines
+* read as "remove": the SurrealDB SDK encodes it as NONE, which MERGE removes
+* (NULL would be a type error on an `option<record<...>>` field), and the
+* SQLite engine turns it into the `null` member that `json_patch` removes (see
+* `serializeMergeRow`).
+*
+* Required columns are left alone. A SCHEMAFULL server cannot hold NONE in
+* one, so its absence means the row was not readable in full (a field
+* permission), not that it was cleared, and NONE in a typed local store is a
+* coercion error that would fail the whole chunk's transaction. `id` and the
+* local-only `_00_*` bookkeeping are never touched.
+*/
+function absentOptionalColumns(tableSchema, record) {
+	const cleared = {};
+	if (!tableSchema) return cleared;
+	for (const [key, column] of Object.entries(tableSchema)) {
+		if (key === "id" || key.startsWith("_00_") || column?.optional !== true) continue;
+		if (record[key] === void 0) cleared[key] = void 0;
+	}
+	return cleared;
+}
+/**
 * Parse a RECORD's fields against the table schema. Anything the schema does not
 * know is dropped, which is what keeps a stray field out of a write.
 */
@@ -1724,8 +1752,8 @@ function selfAllowlistedVariant(flag, userId) {
 
 //#endregion
 //#region src/modules/devtools/index.ts
-const CORE_VERSION = "0.0.1-canary.283";
-const WASM_VERSION = "0.0.1-canary.283";
+const CORE_VERSION = "0.0.1-canary.287";
+const WASM_VERSION = "0.0.1-canary.287";
 const SURREAL_VERSION = "3.0.3";
 var DevToolsService = class DevToolsService {
 	eventsHistory = [];
@@ -2410,8 +2438,21 @@ const AUTH_READY_RETRY_MS = 500;
 const AUTH_READY_MAX_ATTEMPTS = 10;
 /** Heartbeat at this fraction of the shortest ttl in state. */
 const TTL_HEARTBEAT_FRACTION = .5;
-/** Orphan body garbage collection cadence. */
-const GC_INTERVAL_MS = 10080 * 60 * 1e3;
+/**
+* Orphan body garbage collection: the first sweep waits this long after boot
+* (off the first paint and the first sync round), then repeats on the interval.
+*/
+const GC_BOOT_DELAY_MS = 3e4;
+const GC_INTERVAL_MS = 3600 * 1e3;
+/** Ids deleted per GC step. */
+const GC_CHUNK = 200;
+/**
+* A `_00_view` row no query has resolved for this long stops vouching for its
+* ids (the sweep deletes it, so its bodies can be collected). Each session
+* that resolves a query rewrites its row, so this only retires query shapes
+* the app no longer runs.
+*/
+const VIEW_RETENTION_MS = 336 * 60 * 60 * 1e3;
 /** Rolling telemetry sample window per query. */
 const TELEMETRY_SAMPLE_WINDOW = 100;
 function backoffMs(attempt, base = RETRY_BASE_MS, max = RETRY_MAX_MS) {
@@ -2484,6 +2525,32 @@ const setServerState = (hash, serverState) => (s) => withEntry(s, hash, (e) => e
 * set names: membership has caught up with the write, the overlay's job is
 * done (invariant I7).
 */
+/** What a `_00_view` row holding these arrays vouches for. */
+const vouchedIds = (members, children) => [...new Set([...members.map(([id]) => id), ...children.map(([id]) => id)])];
+const withView = (s, viewKey, ids) => {
+	const views = new Map(s.views);
+	views.set(viewKey, ids);
+	return {
+		...s,
+		views
+	};
+};
+/**
+* Replace the durable view index with a fresh `_00_view` read (boot, bucket
+* switch, GC). An entry of a query in state is kept: its commits update the
+* index as they write the row, so it is never older than the read.
+*/
+const reloadViews = (fromStore) => (s) => {
+	const views = new Map(fromStore);
+	for (const e of s.queries.values()) {
+		const held = s.views.get(e.def.viewKey);
+		if (held) views.set(e.def.viewKey, held);
+	}
+	return {
+		...s,
+		views
+	};
+};
 const commitMembership = (hash, remoteArray, present) => (s) => {
 	const withArray = withEntry(s, hash, (e) => ({
 		...e,
@@ -2494,10 +2561,11 @@ const commitMembership = (hash, remoteArray, present) => (s) => {
 		})
 	}));
 	if (withArray === s) return s;
+	const entry = withArray.queries.get(hash);
 	const named = new Set(remoteArray.map(([id]) => id));
 	const outbox = withArray.outbox.filter((item) => !(item.status === "acked" && named.has(item.recordId)));
 	return {
-		...withArray,
+		...withView(withArray, entry.def.viewKey, vouchedIds(remoteArray, entry.subqueryRemoteArray)),
 		outbox,
 		dirty: addAll(withArray.dirty, [hash])
 	};
@@ -2512,10 +2580,19 @@ const setLocalArray = (hash, localArray) => (s) => {
 		dirty: addAll(next.dirty, [hash])
 	};
 };
-const setSubqueryRemoteArray = (hash, subqueryRemoteArray) => (s) => withEntry(s, hash, (e) => ({
-	...e,
-	subqueryRemoteArray
-}));
+/**
+* Replace a query's subquery child set. A query past `cold` has a `_00_view`
+* row, which records the children too (see `applySubqueryChildren`).
+*/
+const setSubqueryRemoteArray = (hash, subqueryRemoteArray) => (s) => {
+	const next = withEntry(s, hash, (e) => ({
+		...e,
+		subqueryRemoteArray
+	}));
+	const entry = next.queries.get(hash);
+	if (!entry || entry.lifecycle.phase === "cold") return next;
+	return withView(next, entry.def.viewKey, vouchedIds(entry.remoteArray, subqueryRemoteArray));
+};
 const setRecords = (hash, records, changed, materializeMs) => (s) => {
 	const next = withEntry(s, hash, (e) => {
 		const prev = e.telemetry.phaseSamples.localFetch ?? [];
@@ -2816,6 +2893,7 @@ const rebindQuery = (hash, next) => (s) => {
 const clearBucketState = () => (s) => ({
 	...s,
 	versions: /* @__PURE__ */ new Map(),
+	views: /* @__PURE__ */ new Map(),
 	outbox: [],
 	pendingWrites: /* @__PURE__ */ new Map(),
 	dirty: /* @__PURE__ */ new Set(),
@@ -2875,6 +2953,35 @@ function overlay(s) {
 		deletes
 	};
 }
+const vouchedCache = /* @__PURE__ */ new WeakMap();
+/**
+* Every id some durable `_00_view` row vouches for. Memoized on the index,
+* which only changes when a view row does.
+*/
+function vouched(s) {
+	const hit = vouchedCache.get(s.views);
+	if (hit) return hit;
+	const out = /* @__PURE__ */ new Set();
+	for (const ids of s.views.values()) for (const id of ids) out.add(id);
+	vouchedCache.set(s.views, out);
+	return out;
+}
+/**
+* Bodies the GC must keep: `_00_` bookkeeping, anything a durable view
+* vouches for, anything a query in memory names (members or children), and
+* anything a write is still in flight for.
+*/
+function retained(s) {
+	const held = /* @__PURE__ */ new Set();
+	for (const e of s.queries.values()) {
+		for (const [id] of e.remoteArray) held.add(id);
+		for (const [id] of e.subqueryRemoteArray) held.add(id);
+	}
+	for (const item of s.outbox) held.add(item.recordId);
+	for (const write of s.pendingWrites.values()) held.add(write.recordId);
+	const known = vouched(s);
+	return (id) => id.startsWith("_00_") || known.has(id) || held.has(id);
+}
 const pendingDeleteIds = (s) => new Set(s.outbox.filter((i) => i.type === "delete").map((i) => i.recordId));
 const hasAckedWrites = (s) => s.outbox.some((i) => i.status === "acked");
 const pendingMutationCount = (s) => s.outbox.filter((i) => i.status === "pending").length;
@@ -3288,6 +3395,7 @@ function emptyState(init) {
 		registering: /* @__PURE__ */ new Set(),
 		membershipReread: /* @__PURE__ */ new Map(),
 		versions: /* @__PURE__ */ new Map(),
+		views: /* @__PURE__ */ new Map(),
 		outbox: [],
 		pendingWrites: /* @__PURE__ */ new Map(),
 		failedCount: 0,
@@ -3334,6 +3442,24 @@ function parseViewRow(row) {
 		confirmed: row.confirmed === true
 	};
 }
+const pairIds = (pairs) => Array.isArray(pairs) ? pairs.filter((p) => Array.isArray(p) && typeof p[0] === "string").map((p) => p[0]) : [];
+/** `SELECT * FROM _00_view` rows, keyed by view key; junk rows are skipped. */
+function parseViewIndex(rows) {
+	if (!Array.isArray(rows)) return [];
+	const out = [];
+	for (const row of rows) {
+		if (!row || typeof row !== "object" || !Array.isArray(row.ids)) continue;
+		const id = row.id;
+		const key = typeof id === "string" ? id.slice(id.indexOf(":") + 1) : String(id?.id ?? "");
+		if (!key) continue;
+		out.push({
+			key,
+			ids: [...new Set([...pairIds(row.ids), ...pairIds(row.children)])],
+			updatedAt: typeof row.updatedAt === "number" ? row.updatedAt : 0
+		});
+	}
+	return out;
+}
 /**
 * "Resolved before": the server answered this query on this device at some
 * point. An unconfirmed empty row cannot be told apart from one written before
@@ -3606,11 +3732,19 @@ const selfHealDelayMs = (attempt) => Math.min(SELF_HEAL_MAX_MS, SELF_HEAL_BASE_M
 const VIEW_TABLE = "_00_view";
 const LEGACY_VIEW_TABLE = "_00_window";
 const viewRecordId = (viewKey) => new RecordId$1(VIEW_TABLE, viewKey);
-const viewRow = (ids, confirmed, now) => ({
+/**
+* The durable `_00_view` row: the confirmed membership plus the subquery
+* children, which the GC must keep and a cold scan may paint as much as the
+* members.
+*/
+const viewRow = (ids, children, confirmed, now) => ({
 	ids,
+	children,
 	confirmed,
 	updatedAt: now
 });
+/** Every `_00_view` row: the durable view index and the GC read it. */
+const readViewRows = () => `SELECT * FROM ${VIEW_TABLE}`;
 /** Copy every legacy `_00_window` row into `_00_view` once. */
 const readLegacyViewRows = () => `SELECT * FROM ${LEGACY_VIEW_TABLE}`;
 const countViewRows = () => `SELECT count() FROM ${VIEW_TABLE} GROUP ALL`;
@@ -3719,7 +3853,7 @@ function* applyMembership(hash, remoteArray, meta, verifiedRemoval) {
 	});
 	const now = yield fx.now();
 	try {
-		yield fx.local.upsert(VIEW_TABLE, viewRecordId(entry.def.viewKey), viewRow(remoteArray, true, now), "replace");
+		yield fx.local.upsert(VIEW_TABLE, viewRecordId(entry.def.viewKey), viewRow(remoteArray, entry.subqueryRemoteArray, true, now), "replace");
 	} catch (err) {
 		yield fx.emit({
 			type: "log",
@@ -3749,11 +3883,28 @@ function* recoverLostView(hash) {
 		hash
 	});
 }
-/** Replace the subquery child set; bodies follow through the fetch plan. */
+/**
+* Replace the subquery child set; bodies follow through the fetch plan. A
+* query with a `_00_view` row (past `cold`) records the children there too,
+* so the GC keeps their bodies and a cold scan may paint them.
+*/
 function* applySubqueryChildren(hash, children) {
 	const entry = yield fx.state.read((s) => s.queries.get(hash));
 	if (!entry || recordVersionArraysEqual(entry.subqueryRemoteArray, children)) return;
 	yield fx.state.update(setSubqueryRemoteArray(hash, children));
+	if (entry.lifecycle.phase !== "cold") try {
+		yield fx.local.upsert(VIEW_TABLE, viewRecordId(entry.def.viewKey), { children }, "merge");
+	} catch (err) {
+		yield fx.emit({
+			type: "log",
+			level: "debug",
+			message: "view row write failed",
+			data: {
+				hash,
+				err
+			}
+		});
+	}
 	yield fx.dispatch({ type: "FetchRows" });
 }
 const ok = (r) => r.ok;
@@ -4183,42 +4334,65 @@ function* ackPrune() {
 	yield fx.state.update(outboxPruneAcked(now, ACK_GRACE_MS));
 	if (yield fx.state.read((s) => s.outbox.some((i) => i.status === "acked"))) yield fx.timer.set("ack-prune", ACK_GRACE_MS, { type: "AckPrune" });
 }
+/** Every `_00_view` row, parsed. Throws when the read fails. */
+function* readViews() {
+	const res = yield fx.local.query(readViewRows());
+	return parseViewIndex(Array.isArray(res) ? res[0] : void 0);
+}
+const indexOf = (rows) => new Map(rows.map((r) => [r.key, r.ids]));
+/**
+* Load the durable view index (boot, bucket switch). A failed read leaves it
+* empty, which fails closed: cold scans paint nothing until the server answers.
+*/
+function* loadViews() {
+	try {
+		yield fx.state.update(reloadViews(indexOf(yield* readViews())));
+	} catch (error) {
+		yield fx.emit({
+			type: "log",
+			level: "warn",
+			message: "view index read failed",
+			data: { error }
+		});
+	}
+}
+const tableOf$1 = (id) => id.slice(0, id.indexOf(":"));
 /**
-* Weekly orphan collection: bodies the store holds that no `_00_view` row
-* names and no outbox item touches are invisible; delete them in chunks.
+* Orphan collection, `GC_BOOT_DELAY_MS` after boot and then every
+* `GC_INTERVAL_MS`. Re-reads every `_00_view` row into the index, retires the
+* rows no query has resolved for `VIEW_RETENTION_MS`, then deletes the bodies
+* nothing retains (see `retained`) from the store and the circuit, a chunk at
+* a time. Only a leader or solo tab deletes, and a leader relays the deletes
+* so followers drop the rows too; a follower only refreshes its index.
 */
 function* gcTick() {
+	yield fx.state.wait((s) => s.primed);
 	try {
-		const views = yield fx.local.query(`SELECT ids FROM ${VIEW_TABLE}`);
-		const rows = Array.isArray(views?.[0]) ? views[0] : [];
-		const keep = /* @__PURE__ */ new Set();
-		for (const row of rows) {
-			if (!Array.isArray(row.ids)) continue;
-			for (const pair of row.ids) keep.add(pair[0]);
-		}
-		const state = yield fx.state.read((s) => s);
-		for (const item of state.outbox) keep.add(item.recordId);
-		const orphans = [...state.versions.keys()].filter((id) => !keep.has(id) && !id.startsWith("_00_"));
-		const deletes = orphans.map((id) => {
-			const table = id.slice(0, id.indexOf(":"));
-			return fx.local.delete(table, id);
-		});
-		for (let i = 0; i < deletes.length; i += 200) {
-			const settled = yield fx.all(deletes.slice(i, i + 200));
-			const done = orphans.slice(i, i + 200).filter((_, j) => settled[j].ok);
-			yield fx.state.update(deleteVersions(done));
-			if (done.length > 0) yield fx.ssp.ingest(done.map((id) => ({
-				table: id.slice(0, id.indexOf(":")),
-				op: "DELETE",
-				id,
-				record: {}
-			})));
-		}
+		const rows = yield* readViews();
+		const [role, bucket, held] = yield fx.state.read((s) => [
+			s.tabRole,
+			s.bucketId,
+			new Set([...s.queries.values()].map((e) => e.def.viewKey))
+		]);
+		const now = yield fx.now();
+		const expired = role === "follower" ? [] : rows.filter((r) => !held.has(r.key) && now - r.updatedAt >= VIEW_RETENTION_MS);
+		const retired = /* @__PURE__ */ new Set();
+		for (let i = 0; i < expired.length; i += GC_CHUNK) {
+			const chunk = expired.slice(i, i + GC_CHUNK);
+			const settled = yield fx.all(chunk.map((r) => fx.local.delete(VIEW_TABLE, viewRecordId(r.key))));
+			chunk.forEach((r, j) => settled[j].ok && retired.add(r.key));
+		}
+		yield fx.state.update(reloadViews(indexOf(rows.filter((r) => !retired.has(r.key)))));
+		if (role === "follower") return;
+		const removed = yield* collectOrphans(bucket, role === "leader");
 		yield fx.emit({
 			type: "log",
 			level: "info",
 			message: "orphan gc done",
-			data: { removed: orphans.length }
+			data: {
+				removed,
+				retiredViews: retired.size
+			}
 		});
 	} catch (error) {
 		yield fx.emit({
@@ -4227,8 +4401,50 @@ function* gcTick() {
 			message: "orphan gc failed",
 			data: { error }
 		});
+	} finally {
+		yield fx.timer.set("gc", GC_INTERVAL_MS, { type: "GcTick" });
 	}
-	yield fx.timer.set("gc", GC_INTERVAL_MS, { type: "GcTick" });
+}
+/**
+* Delete every body nothing retains, `GC_CHUNK` at a time. Each chunk is
+* re-checked against fresh state (a membership committed meanwhile may name
+* an id again) and the sweep stops if the bucket moved under it.
+*/
+function* collectOrphans(bucket, relay) {
+	const candidates = yield fx.state.read((s) => {
+		const keep = retained(s);
+		return [...s.versions.keys()].filter((id) => !keep(id));
+	});
+	let removed = 0;
+	for (let i = 0; i < candidates.length; i += GC_CHUNK) {
+		const chunk = yield fx.state.read((s) => {
+			if (!s.primed || s.bucketId !== bucket) return null;
+			const keep = retained(s);
+			return candidates.slice(i, i + GC_CHUNK).filter((id) => s.versions.has(id) && !keep(id));
+		});
+		if (chunk === null) break;
+		const settled = yield fx.all(chunk.map((id) => fx.local.delete(tableOf$1(id), id)));
+		const done = chunk.filter((_, j) => settled[j].ok);
+		if (done.length === 0) continue;
+		const records = done.map((id) => ({
+			table: tableOf$1(id),
+			op: "DELETE",
+			id,
+			record: {}
+		}));
+		yield fx.state.update(deleteVersions(done));
+		yield fx.ssp.ingest(records);
+		if (relay) yield fx.emit({
+			type: "tabs:broadcast",
+			message: {
+				type: "ingest",
+				records
+			}
+		});
+		removed += done.length;
+	}
+	if (removed > 0) yield fx.dispatch({ type: "FetchRows" });
+	return removed;
 }
 
 //#endregion
@@ -5187,6 +5403,7 @@ function* boot(env, opts) {
 	yield fx.state.update(setIdentity({ bucketId: bucket }));
 	if (yield fx.service("local.usesSurqlSchema")) yield fx.service("migrator.provision");
 	yield* migrateWindowToView();
+	yield* loadViews();
 	yield fx.dispatch({ type: "WarmBlobs" });
 	yield fx.service("ssp.init");
 	yield fx.service("ssp.setPermissions");
@@ -5206,7 +5423,7 @@ function* boot(env, opts) {
 	yield fx.service("features.init");
 	yield fx.service("releases.init");
 	yield fx.dispatch({ type: "LifecycleTick" });
-	yield fx.dispatch({ type: "GcTick" });
+	yield fx.timer.set("gc", GC_BOOT_DELAY_MS, { type: "GcTick" });
 	yield fx.state.update(setIdentity({ localReady: true }));
 	yield fx.dispatch({ type: "StartRemote" });
 }
@@ -5485,6 +5702,7 @@ function* landChunk(env, requested, rows, versions, state, epoch) {
 		bodies.push({
 			id: rid,
 			content: {
+				...absentOptionalColumns(columns, row),
 				...content,
 				_00_rv: version
 			}
@@ -5707,6 +5925,17 @@ function rowsFromResult(effect, result) {
 	const first = Array.isArray(result) ? result[0] : void 0;
 	return Array.isArray(first) ? first : [];
 }
+/**
+* A row's encoded record id: a string on the SQLite engine, a `RecordId` on
+* the SurrealDB one. `null` for a row that carries none (a projection
+* without `id`, a `SELECT VALUE`).
+*/
+function rowKey(row) {
+	const id = row !== null && typeof row === "object" ? row.id : void 0;
+	if (typeof id === "string") return id;
+	if (id !== null && typeof id === "object" && "table" in id && "id" in id) return encodeRecordId(id);
+	return null;
+}
 /** Cheap structural equality for the "did the rows change" check. */
 function rowsEqual(a, b) {
 	if (a === b) return true;
@@ -5728,6 +5957,16 @@ function resolveMembership(input) {
 	return null;
 }
 /**
+* Whether a body may paint before the server has answered (`cold`). One no
+* durable view vouches for and no optimistic write touches is an orphan:
+* deleted upstream while no view watched it, or dropped from every view since.
+* The predicate scan would otherwise resurrect it until the server answers,
+* and indefinitely offline.
+*/
+function paintsCold(id, vouched, overlay) {
+	return id.startsWith("_00_") || vouched.has(id) || overlay.writes.has(id);
+}
+/**
 *   render = (membership ∪ (writes ∩ localView)) − deletes
 *
 * `writes`/`deletes` are the outbox overlay (pending and acked items). The
@@ -5755,21 +5994,32 @@ function buildRenderIds(membership, localView, overlay, opts) {
 
 //#endregion
 //#region src/query/materialize.saga.ts
+const NONE = /* @__PURE__ */ new Set();
 /**
 * Render one query from state: membership (or a cold scan), the outbox
 * overlay, one local read, then notify subscribers if the rows changed. The
 * only writer of `records`. Runs on the `mat:<hash>` dedupe lane whenever the
-* query is dirty.
+* query is dirty. Before the server has answered (`cold`) only bodies some
+* durable view vouches for paint (see `paintsCold`).
 */
 function* materialize(hash) {
-	const [entry, ov] = yield fx.state.read((s) => [s.queries.get(hash), overlay(s)]);
+	const [entry, ov, known] = yield fx.state.read((s) => {
+		const e = s.queries.get(hash);
+		return [
+			e,
+			overlay(s),
+			e?.lifecycle.phase === "cold" ? vouched(s) : NONE
+		];
+	});
 	if (!entry) return;
 	const t0 = yield fx.now();
 	const isWindow = isWindowed(entry.def.surql);
+	const paints = (id) => id === null || paintsCold(id, known, ov);
+	const coldWindow = entry.lifecycle.phase === "cold" && isWindow;
 	const membership = resolveMembership({
 		phase: entry.lifecycle.phase,
 		remoteArray: entry.remoteArray,
-		localArray: entry.localArray,
+		localArray: coldWindow ? entry.localArray.filter(([id]) => paints(id)) : entry.localArray,
 		isWindow
 	});
 	const ids = membership ? buildRenderIds(membership, entry.localArray, ov, {
@@ -5780,6 +6030,7 @@ function* materialize(hash) {
 	let rows;
 	try {
 		rows = rowsFromResult(effect, yield effect);
+		if (ids === null) rows = rows.filter((row) => paints(rowKey(row)));
 	} catch (error) {
 		yield fx.state.update(compose(recordError(hash), clearDirty(hash)));
 		yield fx.emit({
@@ -6089,6 +6340,7 @@ function* tabMessage(env, raw) {
 				});
 			}
 			yield fx.state.update(compose(setVersions(msg.records.filter((r) => r.op !== "DELETE").map((r) => [r.id, typeof r.record?._00_rv === "number" ? r.record._00_rv : 0])), deleteVersions(msg.records.filter((r) => r.op === "DELETE").map((r) => r.id)), ...[...new Set(msg.records.map((r) => r.table))].map((t) => markTableDirty(t))));
+			if (msg.records.some((r) => r.op === "DELETE")) yield fx.dispatch({ type: "FetchRows" });
 			return;
 		case "membership-dirty":
 			if (Array.isArray(msg.hashes)) yield* liveChange(env, msg.hashes);
@@ -6207,6 +6459,7 @@ function* bucketSwitch(env, target, release = null, opts = { clearBlobsOnSignOut
 			data: { error }
 		});
 	}
+	yield* loadViews();
 	yield* rebindQueries();
 	yield* loadOutbox(env);
 	yield fx.dispatch({ type: "EnsureRegistered" });
@@ -9310,7 +9563,7 @@ var SqliteCacheEngine = class {
 		await this.ensureTable(table);
 		const key = stableKey(id);
 		if (mode === "merge") {
-			const full = serializeRow({
+			const { insert, patch } = serializeMergeRow({
 				...data,
 				id: key
 			});
@@ -9318,8 +9571,8 @@ var SqliteCacheEngine = class {
 				sql: `INSERT INTO "${table}"(id, data) VALUES(?, ?) ON CONFLICT(id) DO UPDATE SET data = json_patch(data, ?)`,
 				bind: [
 					key,
-					full,
-					full
+					insert,
+					patch
 				]
 			});
 			return;
@@ -9496,7 +9749,7 @@ var SqliteCacheEngine = class {
 			const key = stableKey(op.id);
 			ensure(t);
 			if (op.mode === "merge") {
-				const full = serializeRow({
+				const { insert, patch } = serializeMergeRow({
 					...op.data,
 					id: key
 				});
@@ -9504,8 +9757,8 @@ var SqliteCacheEngine = class {
 					sql: `INSERT INTO "${t}"(id, data) VALUES(?, ?) ON CONFLICT(id) DO UPDATE SET data = json_patch(data, ?)`,
 					bind: [
 						key,
-						full,
-						full
+						insert,
+						patch
 					]
 				});
 			} else stmts.push({
@@ -13758,7 +14011,7 @@ function createTabsCoordinator(config, s, host) {
 	return new TabsCoordinator({
 		tabId: s.tabId,
 		fingerprint: computeTabsFingerprint({
-			coreVersion: "0.0.1-canary.283",
+			coreVersion: "0.0.1-canary.287",
 			schemaHash: hash53(config.schemaSurql),
 			endpoint: config.database.endpoint ?? "",
 			namespace: config.database.namespace,

package/dist/live.js

@@ -1,4 +1,4 @@
-import { A as registerVars, C as heartbeatRowGone, L as sha256Hex, R as queryHashInput, S as heartbeatBatch, a as metaFromRow, b as bodySelect, c as parseDuration, d as parseQueryParams, f as ANON_USER_ID, h as listRefTableFor, j as singleSnapshotSelect, k as registerSelect, l as parseRecordIdString, n as rowOfEdge, p as DEFAULT_REF_MODE, s as encodeRecordId, t as hashOfEdge, u as withTimeout } from "./worker-edges.js";
+import { A as registerSelect, C as heartbeatRowGone, M as singleSnapshotSelect, R as sha256Hex, S as heartbeatBatch, a as metaFromRow, b as bodySelect, c as parseDuration, d as parseQueryParams, f as ANON_USER_ID, h as listRefTableFor, j as registerVars, l as parseRecordIdString, n as rowOfEdge, p as DEFAULT_REF_MODE, s as encodeRecordId, t as hashOfEdge, u as withTimeout, z as queryHashInput } from "./worker-edges.js";
 import { n as decodeTokenClaims } from "./worker-impersonation.js";
 import { RecordId, Surreal } from "surrealdb";
 

package/dist/pure.d.ts

@@ -181,7 +181,14 @@ type Vars = Record<string, unknown>;
 declare const VIEW_TABLE = "_00_view";
 declare const LEGACY_VIEW_TABLE = "_00_window";
 declare const viewRecordId: (viewKey: string) => RecordId<string>;
-declare const viewRow: (ids: RecordVersionArray, confirmed: boolean, now: number) => Record<string, unknown>;
+/**
+ * The durable `_00_view` row: the confirmed membership plus the subquery
+ * children, which the GC must keep and a cold scan may paint as much as the
+ * members.
+ */
+declare const viewRow: (ids: RecordVersionArray, children: RecordVersionArray, confirmed: boolean, now: number) => Record<string, unknown>;
+/** Every `_00_view` row: the durable view index and the GC read it. */
+declare const readViewRows: () => string;
 /** Copy every legacy `_00_window` row into `_00_view` once. */
 declare const readLegacyViewRows: () => string;
 declare const countViewRows: () => string;
@@ -319,4 +326,4 @@ declare function sha256Hex(input: string): Promise<string>;
  */
 declare function queryKey(input: QueryKeyInput, sessionId: string | null): Promise<string>;
 //#endregion
-export { ANON_USER_ID, type Answer, BridgeSignOutMessage, BridgeTokenMessage, DEFAULT_REF_MODE, FAILED, IMPERSONATION_ACCESS, LEGACY_VIEW_TABLE, type ListRefSnapshot, PUSH_PAYLOAD_VERSION, PushNotification, PushNotificationAction, PushOp, PushPayload, PushPayloadKind, PushUrgency, type QueryKeyInput, type QueryMetaRow, type RefMode, RegisterPayload, type SealOptions, type SealedQuery, type SurqlHelper, type TokenClaims, type TxQuery, VIEW_TABLE, WebPushClientMessage, base64UrlToBytes, batchSnapshotSelect, bodySelect, bucketIdForUser, bytesToBase64Url, countViewRows, decodeTokenClaims, dedupeRecordVersions, encodeRecordId, hashOfEdge, heartbeatBatch, heartbeatRowGone, isPushPayload, listRefBatchSelect, listRefSelect, listRefTableFor, metaFromRow, parseDuration, parseQueryParams, parseRecordIdString, queryHashInput, queryKey, queryRowCountBatchSelect, queryRowCountSelect, readLegacyViewRows, registerSelect, registerVars, rowOfEdge, sameBytes, sanitizeUserId, sha256Hex, singleSnapshotSelect, snapshotFromSingle, subqueryListRefSelect, surql, upsertBodiesTx, viewKeyInput, viewRecordId, viewRow };
+export { ANON_USER_ID, type Answer, BridgeSignOutMessage, BridgeTokenMessage, DEFAULT_REF_MODE, FAILED, IMPERSONATION_ACCESS, LEGACY_VIEW_TABLE, type ListRefSnapshot, PUSH_PAYLOAD_VERSION, PushNotification, PushNotificationAction, PushOp, PushPayload, PushPayloadKind, PushUrgency, type QueryKeyInput, type QueryMetaRow, type RefMode, RegisterPayload, type SealOptions, type SealedQuery, type SurqlHelper, type TokenClaims, type TxQuery, VIEW_TABLE, WebPushClientMessage, base64UrlToBytes, batchSnapshotSelect, bodySelect, bucketIdForUser, bytesToBase64Url, countViewRows, decodeTokenClaims, dedupeRecordVersions, encodeRecordId, hashOfEdge, heartbeatBatch, heartbeatRowGone, isPushPayload, listRefBatchSelect, listRefSelect, listRefTableFor, metaFromRow, parseDuration, parseQueryParams, parseRecordIdString, queryHashInput, queryKey, queryRowCountBatchSelect, queryRowCountSelect, readLegacyViewRows, readViewRows, registerSelect, registerVars, rowOfEdge, sameBytes, sanitizeUserId, sha256Hex, singleSnapshotSelect, snapshotFromSingle, subqueryListRefSelect, surql, upsertBodiesTx, viewKeyInput, viewRecordId, viewRow };

package/dist/pure.js

@@ -1,4 +1,4 @@
-import { A as registerVars, C as heartbeatRowGone, D as queryRowCountSelect, E as queryRowCountBatchSelect, F as viewRow, I as surql, L as sha256Hex, M as subqueryListRefSelect, N as upsertBodiesTx, O as readLegacyViewRows, P as viewRecordId, R as queryHashInput, S as heartbeatBatch, T as listRefSelect, _ as LEGACY_VIEW_TABLE, a as metaFromRow, b as bodySelect, c as parseDuration, d as parseQueryParams, f as ANON_USER_ID, g as sanitizeUserId, h as listRefTableFor, i as dedupeRecordVersions, j as singleSnapshotSelect, k as registerSelect, l as parseRecordIdString, m as bucketIdForUser, n as rowOfEdge, o as snapshotFromSingle, p as DEFAULT_REF_MODE, r as FAILED, s as encodeRecordId, t as hashOfEdge, v as VIEW_TABLE, w as listRefBatchSelect, x as countViewRows, y as batchSnapshotSelect, z as viewKeyInput } from "./worker-edges.js";
+import { A as registerSelect, B as viewKeyInput, C as heartbeatRowGone, D as queryRowCountSelect, E as queryRowCountBatchSelect, F as viewRecordId, I as viewRow, L as surql, M as singleSnapshotSelect, N as subqueryListRefSelect, O as readLegacyViewRows, P as upsertBodiesTx, R as sha256Hex, S as heartbeatBatch, T as listRefSelect, _ as LEGACY_VIEW_TABLE, a as metaFromRow, b as bodySelect, c as parseDuration, d as parseQueryParams, f as ANON_USER_ID, g as sanitizeUserId, h as listRefTableFor, i as dedupeRecordVersions, j as registerVars, k as readViewRows, l as parseRecordIdString, m as bucketIdForUser, n as rowOfEdge, o as snapshotFromSingle, p as DEFAULT_REF_MODE, r as FAILED, s as encodeRecordId, t as hashOfEdge, v as VIEW_TABLE, w as listRefBatchSelect, x as countViewRows, y as batchSnapshotSelect, z as queryHashInput } from "./worker-edges.js";
 import { n as decodeTokenClaims, t as IMPERSONATION_ACCESS } from "./worker-impersonation.js";
 import { a as sameBytes, i as isPushPayload, n as base64UrlToBytes, r as bytesToBase64Url, t as PUSH_PAYLOAD_VERSION } from "./worker-types.js";
 
@@ -21,4 +21,4 @@ function queryKey(input, sessionId) {
 }
 
 //#endregion
-export { ANON_USER_ID, DEFAULT_REF_MODE, FAILED, IMPERSONATION_ACCESS, LEGACY_VIEW_TABLE, PUSH_PAYLOAD_VERSION, VIEW_TABLE, base64UrlToBytes, batchSnapshotSelect, bodySelect, bucketIdForUser, bytesToBase64Url, countViewRows, decodeTokenClaims, dedupeRecordVersions, encodeRecordId, hashOfEdge, heartbeatBatch, heartbeatRowGone, isPushPayload, listRefBatchSelect, listRefSelect, listRefTableFor, metaFromRow, parseDuration, parseQueryParams, parseRecordIdString, queryHashInput, queryKey, queryRowCountBatchSelect, queryRowCountSelect, readLegacyViewRows, registerSelect, registerVars, rowOfEdge, sameBytes, sanitizeUserId, sha256Hex, singleSnapshotSelect, snapshotFromSingle, subqueryListRefSelect, surql, upsertBodiesTx, viewKeyInput, viewRecordId, viewRow };
+export { ANON_USER_ID, DEFAULT_REF_MODE, FAILED, IMPERSONATION_ACCESS, LEGACY_VIEW_TABLE, PUSH_PAYLOAD_VERSION, VIEW_TABLE, base64UrlToBytes, batchSnapshotSelect, bodySelect, bucketIdForUser, bytesToBase64Url, countViewRows, decodeTokenClaims, dedupeRecordVersions, encodeRecordId, hashOfEdge, heartbeatBatch, heartbeatRowGone, isPushPayload, listRefBatchSelect, listRefSelect, listRefTableFor, metaFromRow, parseDuration, parseQueryParams, parseRecordIdString, queryHashInput, queryKey, queryRowCountBatchSelect, queryRowCountSelect, readLegacyViewRows, readViewRows, registerSelect, registerVars, rowOfEdge, sameBytes, sanitizeUserId, sha256Hex, singleSnapshotSelect, snapshotFromSingle, subqueryListRefSelect, surql, upsertBodiesTx, viewKeyInput, viewRecordId, viewRow };