@spooky-sync/core 0.0.1-canary.283 → 0.0.1-canary.287

package/src/query/lifecycle.saga.ts

@@ -1,11 +1,13 @@
 import type { Saga } from '../kernel/saga';
 import type { Settled, StatementResult } from '../kernel/effects';
 import { fx } from '../kernel/effects';
-import { ACK_GRACE_MS, GC_INTERVAL_MS, TTL_HEARTBEAT_FRACTION } from '../kernel/constants';
-import type { ClientState, QueryEntry } from '../state/client-state';
+import { ACK_GRACE_MS, GC_CHUNK, GC_INTERVAL_MS, TTL_HEARTBEAT_FRACTION, VIEW_RETENTION_MS } from '../kernel/constants';
+import type { IngestRecord } from '../services/stream-processor/index';
+import type { ClientState, QueryEntry, TabRole } from '../state/client-state';
 import * as R from '../state/reducers';
-import { evictable, shortestTtlMs } from '../state/selectors';
+import { evictable, retained, shortestTtlMs } from '../state/selectors';
 import type { SagaEnv } from './env';
+import { parseViewIndex, type ViewIndexRow } from './membership';
 import * as sql from './sql';
 
 /**
@@ -65,37 +67,93 @@ export function* ackPrune(): Saga<void> {
   if (stillAcked) yield fx.timer.set('ack-prune', ACK_GRACE_MS, { type: 'AckPrune' });
 }
 
+/** Every `_00_view` row, parsed. Throws when the read fails. */
+function* readViews(): Saga<ViewIndexRow[]> {
+  const res = (yield fx.local.query(sql.readViewRows())) as unknown[];
+  return parseViewIndex(Array.isArray(res) ? res[0] : undefined);
+}
+
+const indexOf = (rows: ViewIndexRow[]): Map<string, string[]> => new Map(rows.map((r) => [r.key, r.ids]));
+
+/**
+ * Load the durable view index (boot, bucket switch). A failed read leaves it
+ * empty, which fails closed: cold scans paint nothing until the server answers.
+ */
+export function* loadViews(): Saga<void> {
+  try {
+    yield fx.state.update(R.reloadViews(indexOf(yield* readViews())));
+  } catch (error) {
+    yield fx.emit({ type: 'log', level: 'warn', message: 'view index read failed', data: { error } });
+  }
+}
+
+const tableOf = (id: string): string => id.slice(0, id.indexOf(':'));
+
 /**
- * Weekly orphan collection: bodies the store holds that no `_00_view` row
- * names and no outbox item touches are invisible; delete them in chunks.
+ * Orphan collection, `GC_BOOT_DELAY_MS` after boot and then every
+ * `GC_INTERVAL_MS`. Re-reads every `_00_view` row into the index, retires the
+ * rows no query has resolved for `VIEW_RETENTION_MS`, then deletes the bodies
+ * nothing retains (see `retained`) from the store and the circuit, a chunk at
+ * a time. Only a leader or solo tab deletes, and a leader relays the deletes
+ * so followers drop the rows too; a follower only refreshes its index.
  */
 export function* gcTick(): Saga<void> {
+  yield fx.state.wait((s) => s.primed);
   try {
-    const views = (yield fx.local.query(`SELECT ids FROM ${sql.VIEW_TABLE}`)) as unknown[];
-    const rows = Array.isArray(views?.[0]) ? (views[0] as Array<{ ids?: unknown }>) : [];
-    const keep = new Set<string>();
-    for (const row of rows) {
-      if (!Array.isArray(row.ids)) continue;
-      for (const pair of row.ids as Array<[string, number]>) keep.add(pair[0]);
+    const rows = yield* readViews();
+    const [role, bucket, held] = (yield fx.state.read((s) => [
+      s.tabRole,
+      s.bucketId,
+      new Set([...s.queries.values()].map((e) => e.def.viewKey)),
+    ])) as [TabRole, string | null, Set<string>];
+    const now = (yield fx.now()) as number;
+    const expired = role === 'follower' ? [] : rows.filter((r) => !held.has(r.key) && now - r.updatedAt >= VIEW_RETENTION_MS);
+    const retired = new Set<string>();
+    for (let i = 0; i < expired.length; i += GC_CHUNK) {
+      const chunk = expired.slice(i, i + GC_CHUNK);
+      const settled = (yield fx.all(chunk.map((r) => fx.local.delete(sql.VIEW_TABLE, sql.viewRecordId(r.key))))) as Settled[];
+      chunk.forEach((r, j) => settled[j].ok && retired.add(r.key));
     }
-    const state = (yield fx.state.read((s) => s)) as ClientState;
-    for (const item of state.outbox) keep.add(item.recordId);
-    const orphans = [...state.versions.keys()].filter((id) => !keep.has(id) && !id.startsWith('_00_'));
-    const deletes = orphans.map((id) => {
-      const table = id.slice(0, id.indexOf(':'));
-      return fx.local.delete(table, id);
-    });
-    for (let i = 0; i < deletes.length; i += 200) {
-      const settled = (yield fx.all(deletes.slice(i, i + 200))) as Settled[];
-      const done = orphans.slice(i, i + 200).filter((_, j) => settled[j].ok);
-      yield fx.state.update(R.deleteVersions(done));
-      if (done.length > 0) {
-        yield fx.ssp.ingest(done.map((id) => ({ table: id.slice(0, id.indexOf(':')), op: 'DELETE', id, record: {} })));
-      }
-    }
-    yield fx.emit({ type: 'log', level: 'info', message: 'orphan gc done', data: { removed: orphans.length } });
+    yield fx.state.update(R.reloadViews(indexOf(rows.filter((r) => !retired.has(r.key)))));
+    if (role === 'follower') return;
+    const removed = yield* collectOrphans(bucket, role === 'leader');
+    yield fx.emit({ type: 'log', level: 'info', message: 'orphan gc done', data: { removed, retiredViews: retired.size } });
   } catch (error) {
     yield fx.emit({ type: 'log', level: 'warn', message: 'orphan gc failed', data: { error } });
+  } finally {
+    yield fx.timer.set('gc', GC_INTERVAL_MS, { type: 'GcTick' });
+  }
+}
+
+/**
+ * Delete every body nothing retains, `GC_CHUNK` at a time. Each chunk is
+ * re-checked against fresh state (a membership committed meanwhile may name
+ * an id again) and the sweep stops if the bucket moved under it.
+ */
+function* collectOrphans(bucket: string | null, relay: boolean): Saga<number> {
+  const candidates = (yield fx.state.read((s) => {
+    const keep = retained(s);
+    return [...s.versions.keys()].filter((id) => !keep(id));
+  })) as string[];
+  let removed = 0;
+  for (let i = 0; i < candidates.length; i += GC_CHUNK) {
+    const chunk = (yield fx.state.read((s) => {
+      if (!s.primed || s.bucketId !== bucket) return null;
+      const keep = retained(s);
+      return candidates.slice(i, i + GC_CHUNK).filter((id) => s.versions.has(id) && !keep(id));
+    })) as string[] | null;
+    if (chunk === null) break;
+    const settled = (yield fx.all(chunk.map((id) => fx.local.delete(tableOf(id), id)))) as Settled[];
+    const done = chunk.filter((_, j) => settled[j].ok);
+    if (done.length === 0) continue;
+    const records: IngestRecord[] = done.map((id) => ({ table: tableOf(id), op: 'DELETE', id, record: {} }));
+    yield fx.state.update(R.deleteVersions(done));
+    yield fx.ssp.ingest(records);
+    if (relay) yield fx.emit({ type: 'tabs:broadcast', message: { type: 'ingest', records } });
+    removed += done.length;
   }
-  yield fx.timer.set('gc', GC_INTERVAL_MS, { type: 'GcTick' });
+  // A query may have committed a deleted id between its chunk's check and the
+  // delete; with its version gone, the fetch plan pulls it back.
+  if (removed > 0) yield fx.dispatch({ type: 'FetchRows' });
+  return removed;
 }

package/src/query/materialize.saga.test.ts

@@ -1,4 +1,5 @@
 import { describe, expect, it } from 'vitest';
+import { RecordId } from 'surrealdb';
 import { runPure } from '../testing/run-pure';
 import { buildEntry, buildOutboxItem, buildState } from '../testing/build';
 import * as R from '../state/reducers';
@@ -10,8 +11,9 @@ describe('materialize', () => {
     const out = await runPure(materialize('zz'), { state: buildState() });
     expect(out.log.filter((e) => e.kind !== 'state.read')).toHaveLength(0);
   });
+  const vouch = (...ids: string[]) => R.reloadViews(new Map([['other-view', ids]]));
   it('cold: predicate scan through the plan; rows land, dirt clears, subscribers hear once', async () => {
-    const s = R.markDirty(['a'])(buildState([buildEntry({ def: { hash: 'a', plan } })]));
+    const s = R.markDirty(['a'])(buildState([buildEntry({ def: { hash: 'a', plan } })], vouch('thing:1')));
     const out = await runPure(materialize('a'), { state: s, handlers: { 'local.select': (e: any) => (e.plan.ids ? [] : [{ id: 'thing:1' }]) } });
     const en = out.state.queries.get('a')!;
     expect(en.records).toEqual([{ id: 'thing:1' }]);
@@ -24,8 +26,39 @@ describe('materialize', () => {
     expect(again.emitted).toEqual([]);
     expect(again.state.queries.get('a')!.telemetry.updateCount).toBe(1);
   });
-  it('cold window renders the SSP local window; live renders membership with the overlay', async () => {
-    const win = buildState([buildEntry({ def: { hash: 'w', plan: { ...plan, offset: 5 }, surql: 'SELECT * FROM thing LIMIT 5 START 5' }, localArray: [['thing:7', 1]] })]);
+  it('cold: a body no view vouches for (an orphan) does not paint; vouched, optimistic, _00_ and id-less rows do', async () => {
+    const s = buildState(
+      [buildEntry({ def: { hash: 'a', plan } })],
+      vouch('thing:1', 'thing:4'),
+      R.outboxReplace([buildOutboxItem({ id: 'c', type: 'create', recordId: 'thing:3' })])
+    );
+    const scanned = [
+      { id: 'thing:1' },
+      { id: 'thing:2' },
+      { id: 'thing:3' },
+      { id: '_00_user_feature:f' },
+      { name: 'no id' },
+      { id: new RecordId('thing', '4') },
+      { id: new RecordId('thing', '5') },
+    ];
+    const out = await runPure(materialize('a'), { state: s, handlers: { 'local.select': () => scanned } });
+    expect(out.state.queries.get('a')!.records).toEqual([
+      { id: 'thing:1' },
+      { id: 'thing:3' },
+      { id: '_00_user_feature:f' },
+      { name: 'no id' },
+      { id: new RecordId('thing', '4') },
+    ]);
+    // Once the server has answered, membership decides and the index is not consulted.
+    const live = buildState([buildEntry({ def: { hash: 'a', plan }, lifecycle: { phase: 'live' }, remoteArray: [['thing:2', 1]] })]);
+    const l = await runPure(materialize('a'), { state: live, handlers: { 'local.select': (e: any) => e.plan.ids.map((id: any) => ({ id: `${id.table}:${id.id}` })) } });
+    expect(l.state.queries.get('a')!.records).toEqual([{ id: 'thing:2' }]);
+  });
+  it('cold window renders the SSP local window (orphans dropped); live renders membership with the overlay', async () => {
+    const win = buildState(
+      [buildEntry({ def: { hash: 'w', plan: { ...plan, offset: 5 }, surql: 'SELECT * FROM thing LIMIT 5 START 5' }, localArray: [['thing:7', 1], ['thing:8', 1]] })],
+      vouch('thing:7')
+    );
     const w = await runPure(materialize('w'), { state: win, handlers: { 'local.select': (e: any) => e.plan.ids.map((id: any) => ({ id: `${id.table}:${id.id}` })) } });
     expect(w.state.queries.get('w')!.records).toEqual([{ id: 'thing:7' }]);
     const live = buildState(

package/src/query/materialize.saga.ts

@@ -4,26 +4,34 @@ import type { Saga } from '../kernel/saga';
 import { fx } from '../kernel/effects';
 import type { QueryEntry } from '../state/client-state';
 import * as R from '../state/reducers';
-import { overlay } from '../state/selectors';
+import { overlay, vouched } from '../state/selectors';
 import type { Overlay } from '../state/selectors';
-import { isWindowed, materializeEffect, rowsEqual, rowsFromResult } from './materialize';
-import { buildRenderIds, resolveMembership } from './render-set';
+import { isWindowed, materializeEffect, rowKey, rowsEqual, rowsFromResult } from './materialize';
+import { buildRenderIds, paintsCold, resolveMembership } from './render-set';
+
+const NONE: ReadonlySet<string> = new Set();
 
 /**
  * Render one query from state: membership (or a cold scan), the outbox
  * overlay, one local read, then notify subscribers if the rows changed. The
  * only writer of `records`. Runs on the `mat:<hash>` dedupe lane whenever the
- * query is dirty.
+ * query is dirty. Before the server has answered (`cold`) only bodies some
+ * durable view vouches for paint (see `paintsCold`).
  */
 export function* materialize(hash: QueryHash): Saga<void> {
-  const [entry, ov] = (yield fx.state.read((s) => [s.queries.get(hash), overlay(s)])) as [QueryEntry | undefined, Overlay];
+  const [entry, ov, known] = (yield fx.state.read((s) => {
+    const e = s.queries.get(hash);
+    return [e, overlay(s), e?.lifecycle.phase === 'cold' ? vouched(s) : NONE];
+  })) as [QueryEntry | undefined, Overlay, ReadonlySet<string>];
   if (!entry) return;
   const t0 = (yield fx.now()) as number;
   const isWindow = isWindowed(entry.def.surql);
+  const paints = (id: string | null) => id === null || paintsCold(id, known, ov);
+  const coldWindow = entry.lifecycle.phase === 'cold' && isWindow;
   const membership = resolveMembership({
     phase: entry.lifecycle.phase,
     remoteArray: entry.remoteArray,
-    localArray: entry.localArray,
+    localArray: coldWindow ? entry.localArray.filter(([id]) => paints(id)) : entry.localArray,
     isWindow,
   });
   const ids = membership
@@ -36,6 +44,7 @@ export function* materialize(hash: QueryHash): Saga<void> {
   let rows: Record<string, unknown>[];
   try {
     rows = rowsFromResult(effect, yield effect);
+    if (ids === null) rows = rows.filter((row) => paints(rowKey(row)));
   } catch (error) {
     yield fx.state.update(R.compose(R.recordError(hash), R.clearDirty(hash)));
     yield fx.emit({ type: 'log', level: 'warn', message: 'materialize failed', data: { hash, error } });

package/src/query/materialize.test.ts

@@ -1,6 +1,6 @@
 import { describe, expect, it } from 'vitest';
 import { RecordId } from 'surrealdb';
-import { isWindowed, materializeEffect, rowsEqual, rowsFromResult } from './materialize';
+import { isWindowed, materializeEffect, rowKey, rowsEqual, rowsFromResult } from './materialize';
 
 describe('materializeEffect', () => {
   const plan = { table: 'thing', where: [{ field: 'a', op: '=', value: 1 }] } as any;
@@ -48,3 +48,11 @@ describe('materializeEffect', () => {
     expect(isWindowed('SELECT * FROM t LIMIT 10')).toBe(false);
   });
 });
+
+describe('rowKey', () => {
+  it('reads a string id (SQLite) or a RecordId (SurrealDB); null when the row carries none', () => {
+    expect(rowKey({ id: 'thing:1' })).toBe('thing:1');
+    expect(rowKey({ id: new RecordId('thing', '2') })).toBe('thing:2');
+    for (const row of [{ name: 'x' }, { id: null }, { id: { other: 1 } }, null, 5]) expect(rowKey(row)).toBeNull();
+  });
+});

package/src/query/materialize.ts

@@ -1,7 +1,8 @@
 import type { QueryPlan } from '@spooky-sync/query-builder';
+import type { RecordId } from 'surrealdb';
 import type { Effect } from '../kernel/effects';
 import { fx } from '../kernel/effects';
-import { parseRecordIdString } from '../utils/index';
+import { encodeRecordId, parseRecordIdString } from '../utils/index';
 import { buildIdSetPlan, buildIdSetSurql, buildWindowMaterialization } from './window-query';
 
 export interface MaterializeSource {
@@ -36,6 +37,18 @@ export function rowsFromResult(effect: Effect, result: unknown): Record<string,
   return Array.isArray(first) ? (first as Record<string, unknown>[]) : [];
 }
 
+/**
+ * A row's encoded record id: a string on the SQLite engine, a `RecordId` on
+ * the SurrealDB one. `null` for a row that carries none (a projection
+ * without `id`, a `SELECT VALUE`).
+ */
+export function rowKey(row: unknown): string | null {
+  const id = row !== null && typeof row === 'object' ? (row as { id?: unknown }).id : undefined;
+  if (typeof id === 'string') return id;
+  if (id !== null && typeof id === 'object' && 'table' in id && 'id' in id) return encodeRecordId(id as RecordId<string>);
+  return null;
+}
+
 /** Cheap structural equality for the "did the rows change" check. */
 export function rowsEqual(a: ReadonlyArray<unknown>, b: ReadonlyArray<unknown>): boolean {
   if (a === b) return true;

package/src/query/membership.saga.test.ts

@@ -74,7 +74,7 @@ describe('applyMembership', () => {
   });
   it('applied: commits, writes the view row, flips authority once, releases acked items, asks for bodies', async () => {
     const s = buildState(
-      [buildEntry({ def: { hash: 'a', viewKey: 'vk' }, lifecycle: { phase: 'cold' } })],
+      [buildEntry({ def: { hash: 'a', viewKey: 'vk' }, lifecycle: { phase: 'cold' }, subqueryRemoteArray: [['c:1', 1]] })],
       R.outboxReplace([buildOutboxItem({ id: 'm', recordId: 't:1', status: 'acked', ackedAt: 1 })])
     );
     const out = await runPure(applyMembership('a', [['t:1', 1]], ready(1)), { state: s, now: 42, handlers: { 'local.upsert': () => undefined } });
@@ -86,9 +86,11 @@ describe('applyMembership', () => {
       kind: 'local.upsert',
       table: '_00_view',
       id: new RecordId('_00_view', 'vk'),
-      data: { ids: [['t:1', 1]], confirmed: true, updatedAt: 42 },
+      data: { ids: [['t:1', 1]], children: [['c:1', 1]], confirmed: true, updatedAt: 42 },
       mode: 'replace',
     });
+    // The index vouches for what the row now holds: members and children.
+    expect(out.state.views.get('vk')).toEqual(['t:1', 'c:1']);
     expect(out.dispatched).toEqual([{ type: 'FetchRows' }]);
     const second = await runPure(applyMembership('a', [['t:1', 2]], ready(1)), {
       state: out.state,
@@ -116,6 +118,32 @@ describe('applySubqueryChildren', () => {
     const out = await runPure(applySubqueryChildren('a', [['c:2', 1]]), { state: s });
     expect(out.state.queries.get('a')!.subqueryRemoteArray).toEqual([['c:2', 1]]);
     expect(out.dispatched).toEqual([{ type: 'FetchRows' }]);
+    // Cold: no `_00_view` row to record them in, and the index is untouched.
+    expect(out.log.filter((e) => e.kind === 'local.upsert')).toEqual([]);
+    expect(out.state.views.size).toBe(0);
+  });
+  it('a query with a view row records the children there and in the index; a failed write is logged', async () => {
+    const s = buildState([buildEntry({ def: { hash: 'a', viewKey: 'vk' }, lifecycle: { phase: 'live' }, remoteArray: [['t:1', 1]] })]);
+    const out = await runPure(applySubqueryChildren('a', [['c:2', 1]]), { state: s, handlers: { 'local.upsert': () => undefined } });
+    expect(out.log.find((e) => e.kind === 'local.upsert')).toEqual({
+      kind: 'local.upsert',
+      table: '_00_view',
+      id: new RecordId('_00_view', 'vk'),
+      data: { children: [['c:2', 1]] },
+      mode: 'merge',
+    });
+    expect(out.state.views.get('vk')).toEqual(['t:1', 'c:2']);
+    expect(out.dispatched).toEqual([{ type: 'FetchRows' }]);
+    const failed = await runPure(applySubqueryChildren('a', [['c:3', 1]]), {
+      state: s,
+      handlers: {
+        'local.upsert': () => {
+          throw new Error('disk');
+        },
+      },
+    });
+    expect(failed.emitted).toEqual([expect.objectContaining({ level: 'debug', message: 'view row write failed' })]);
+    expect(failed.dispatched).toEqual([{ type: 'FetchRows' }]);
   });
 });
 

package/src/query/membership.saga.ts

@@ -89,7 +89,12 @@ export function* applyMembership(
   if (!wasAuthoritative) yield fx.emit({ type: 'query:authority', hash, known: true });
   const now = (yield fx.now()) as number;
   try {
-    yield fx.local.upsert(sql.VIEW_TABLE, sql.viewRecordId(entry.def.viewKey), sql.viewRow(remoteArray, true, now), 'replace');
+    yield fx.local.upsert(
+      sql.VIEW_TABLE,
+      sql.viewRecordId(entry.def.viewKey),
+      sql.viewRow(remoteArray, entry.subqueryRemoteArray, true, now),
+      'replace'
+    );
   } catch (err) {
     yield fx.emit({ type: 'log', level: 'debug', message: 'view row write failed', data: { hash, err } });
   }
@@ -112,11 +117,22 @@ export function* recoverLostView(hash: QueryHash): Saga<void> {
   yield fx.dispatch({ type: 'RegisterRemote', hash });
 }
 
-/** Replace the subquery child set; bodies follow through the fetch plan. */
+/**
+ * Replace the subquery child set; bodies follow through the fetch plan. A
+ * query with a `_00_view` row (past `cold`) records the children there too,
+ * so the GC keeps their bodies and a cold scan may paint them.
+ */
 export function* applySubqueryChildren(hash: QueryHash, children: RecordVersionArray): Saga<void> {
   const entry = (yield fx.state.read((s) => s.queries.get(hash))) as QueryEntry | undefined;
   if (!entry || recordVersionArraysEqual(entry.subqueryRemoteArray, children)) return;
   yield fx.state.update(R.setSubqueryRemoteArray(hash, children));
+  if (entry.lifecycle.phase !== 'cold') {
+    try {
+      yield fx.local.upsert(sql.VIEW_TABLE, sql.viewRecordId(entry.def.viewKey), { children }, 'merge');
+    } catch (err) {
+      yield fx.emit({ type: 'log', level: 'debug', message: 'view row write failed', data: { hash, err } });
+    }
+  }
   yield fx.dispatch({ type: 'FetchRows' });
 }
 

package/src/query/membership.ts

@@ -16,6 +16,36 @@ export function parseViewRow(row: unknown): DurableView | null {
   return { ids: ids as RecordVersionArray, confirmed: (row as { confirmed?: unknown }).confirmed === true };
 }
 
+/** One `_00_view` row as the view index and the GC see it. */
+export interface ViewIndexRow {
+  key: string;
+  /** Members and subquery children: what the row vouches for. */
+  ids: string[];
+  /** Last time a session resolved the query (0 when the row predates the field). */
+  updatedAt: number;
+}
+
+const pairIds = (pairs: unknown): string[] =>
+  Array.isArray(pairs) ? pairs.filter((p): p is [string, number] => Array.isArray(p) && typeof p[0] === 'string').map((p) => p[0]) : [];
+
+/** `SELECT * FROM _00_view` rows, keyed by view key; junk rows are skipped. */
+export function parseViewIndex(rows: unknown): ViewIndexRow[] {
+  if (!Array.isArray(rows)) return [];
+  const out: ViewIndexRow[] = [];
+  for (const row of rows as Array<Record<string, unknown> | null>) {
+    if (!row || typeof row !== 'object' || !Array.isArray(row.ids)) continue;
+    const id = row.id;
+    const key = typeof id === 'string' ? id.slice(id.indexOf(':') + 1) : String((id as { id?: unknown } | undefined)?.id ?? '');
+    if (!key) continue;
+    out.push({
+      key,
+      ids: [...new Set([...pairIds(row.ids), ...pairIds(row.children)])],
+      updatedAt: typeof row.updatedAt === 'number' ? row.updatedAt : 0,
+    });
+  }
+  return out;
+}
+
 /**
  * "Resolved before": the server answered this query on this device at some
  * point. An unconfirmed empty row cannot be told apart from one written before

package/src/query/render-set.test.ts

@@ -1,5 +1,5 @@
 import { describe, expect, it } from 'vitest';
-import { buildRenderIds, resolveMembership } from './render-set';
+import { buildRenderIds, paintsCold, resolveMembership } from './render-set';
 
 const ov = (writes: string[] = [], deletes: string[] = []) => ({ writes: new Set(writes), deletes: new Set(deletes) });
 
@@ -34,3 +34,14 @@ describe('buildRenderIds', () => {
     expect(buildRenderIds(m, [], ov(), { hasExplicitOrder: false, isWindow: true })).toEqual(['t:b', 't:a']);
   });
 });
+
+describe('paintsCold', () => {
+  it('only vouched bodies, optimistic writes and bookkeeping paint before the server answers', () => {
+    const vouched = new Set(['t:1']);
+    expect(paintsCold('t:1', vouched, ov())).toBe(true);
+    expect(paintsCold('t:2', vouched, ov(['t:2']))).toBe(true);
+    expect(paintsCold('_00_user_feature:f', vouched, ov())).toBe(true);
+    expect(paintsCold('t:3', vouched, ov([], ['t:3']))).toBe(false);
+    expect(paintsCold('t:3', vouched, ov())).toBe(false);
+  });
+});

package/src/query/render-set.ts

@@ -21,6 +21,17 @@ export function resolveMembership(input: RenderInput): RecordVersionArray | null
   return null;
 }
 
+/**
+ * Whether a body may paint before the server has answered (`cold`). One no
+ * durable view vouches for and no optimistic write touches is an orphan:
+ * deleted upstream while no view watched it, or dropped from every view since.
+ * The predicate scan would otherwise resurrect it until the server answers,
+ * and indefinitely offline.
+ */
+export function paintsCold(id: string, vouched: ReadonlySet<string>, overlay: Overlay): boolean {
+  return id.startsWith('_00_') || vouched.has(id) || overlay.writes.has(id);
+}
+
 export interface RenderOptions {
   hasExplicitOrder: boolean;
   isWindow: boolean;

package/src/query/sql.test.ts

@@ -33,7 +33,8 @@ describe('query sql builders (golden against the previous builders)', () => {
   });
   it('view rows and ids', () => {
     expect(sql.viewRecordId('k')).toEqual(new RecordId('_00_view', 'k'));
-    expect(sql.viewRow([['t:1', 1]], true, 5)).toEqual({ ids: [['t:1', 1]], confirmed: true, updatedAt: 5 });
+    expect(sql.viewRow([['t:1', 1]], [['c:1', 2]], true, 5)).toEqual({ ids: [['t:1', 1]], children: [['c:1', 2]], confirmed: true, updatedAt: 5 });
+    expect(sql.readViewRows()).toBe('SELECT * FROM _00_view');
     expect(sql.readLegacyViewRows()).toBe('SELECT * FROM _00_window');
     expect(sql.countViewRows()).toContain('_00_view');
     expect(sql.bodySelect()).toBe('SELECT * FROM $ids');

package/src/query/sql.ts

@@ -11,12 +11,26 @@ export const LEGACY_VIEW_TABLE = '_00_window';
 
 export const viewRecordId = (viewKey: string): RecordId<string> => new RecordId(VIEW_TABLE, viewKey);
 
-export const viewRow = (ids: RecordVersionArray, confirmed: boolean, now: number): Record<string, unknown> => ({
+/**
+ * The durable `_00_view` row: the confirmed membership plus the subquery
+ * children, which the GC must keep and a cold scan may paint as much as the
+ * members.
+ */
+export const viewRow = (
+  ids: RecordVersionArray,
+  children: RecordVersionArray,
+  confirmed: boolean,
+  now: number
+): Record<string, unknown> => ({
   ids,
+  children,
   confirmed,
   updatedAt: now,
 });
 
+/** Every `_00_view` row: the durable view index and the GC read it. */
+export const readViewRows = (): string => `SELECT * FROM ${VIEW_TABLE}`;
+
 /** Copy every legacy `_00_window` row into `_00_view` once. */
 export const readLegacyViewRows = (): string => `SELECT * FROM ${LEGACY_VIEW_TABLE}`;
 export const countViewRows = (): string => `SELECT count() FROM ${VIEW_TABLE} GROUP ALL`;