@spooky-sync/core 0.0.1-canary.286 → 0.0.1-canary.288

package/AGENTS.md

@@ -55,6 +55,7 @@ re-materialized from state, never patched in place.
 - **Raw remote calls are gated by the query allowlist.** When the generated schema carries `policy.queryAllowlist: 'warn' | 'enforce'` (from `sync.queryAllowlist` in `sp00ky.yml`), `remoteQuery`, `useRemote` and `queryRaw` throw unless the client config sets `allowRawRemote: true`; builder queries are unaffected. A registration the SSP refuses as not allowlisted (403 `not_allowlisted`) is marked `remote: 'failed'` after one attempt with an error-level log carrying the surql and a `spky generate` hint; the view stays cold (`membershipKnown` false), it is never read as confirmed empty.
 - **`@parent` columns are auto-populated.** Defined in the `.surql` schema as `record<user>` with the `-- @parent` annotation; never write them yourself — they're set from the auth context server-side.
 - **`db.preload` is a registered query.** Resolved before on this device (a `_00_view` row exists) it returns at once; never resolved it waits until the server's membership and every body are local. It holds no subscriber, so it is evicted a ttl after registration unless a view mounts the same query. `refresh`/`staleTime` are ignored; pass `signal` to abort a cold wait.
+- **A never-resolved query paints only vouched rows.** Before the server answers (`cold`), the local predicate scan shows a cached body only if some `_00_view` row names it (as a member or subquery child) or a write for it is in flight. A body no view names is an orphan (deleted upstream while nothing watched it): it stays hidden, and the GC deletes it 30 s after boot and then hourly. A `_00_view` row no query has resolved for 14 days is retired by the same sweep, so that query paints cold again.
 - **A rejected write is not lost.** Application errors roll the local row back (create/update/delete) and move the mutation to `_00_failed_mutations`; the tray API above lists, retries (as a fresh write) or discards it. Network errors keep the row queued.
 
 ## Module map (under `src/`)

package/dist/index.d.ts

@@ -1311,6 +1311,12 @@ interface ClientState {
   readonly membershipReread: ReadonlyMap<QueryHash, number>;
   /** Local body versions (`_00_rv`) by encoded record id. */
   readonly versions: ReadonlyMap<string, number>;
+  /**
+   * What each durable `_00_view` row vouches for, by view key: its members
+   * and subquery children. A body no row names is an orphan: it never paints
+   * before the server answers and the GC deletes it.
+   */
+  readonly views: ReadonlyMap<string, ReadonlyArray<string>>;
   readonly outbox: ReadonlyArray<OutboxItem>;
   readonly pendingWrites: ReadonlyMap<string, PendingWrite>;
   readonly failedCount: number;

package/dist/index.js

@@ -1752,8 +1752,8 @@ function selfAllowlistedVariant(flag, userId) {
 
 //#endregion
 //#region src/modules/devtools/index.ts
-const CORE_VERSION = "0.0.1-canary.286";
-const WASM_VERSION = "0.0.1-canary.286";
+const CORE_VERSION = "0.0.1-canary.288";
+const WASM_VERSION = "0.0.1-canary.288";
 const SURREAL_VERSION = "3.0.3";
 var DevToolsService = class DevToolsService {
 	eventsHistory = [];
@@ -2438,8 +2438,21 @@ const AUTH_READY_RETRY_MS = 500;
 const AUTH_READY_MAX_ATTEMPTS = 10;
 /** Heartbeat at this fraction of the shortest ttl in state. */
 const TTL_HEARTBEAT_FRACTION = .5;
-/** Orphan body garbage collection cadence. */
-const GC_INTERVAL_MS = 10080 * 60 * 1e3;
+/**
+* Orphan body garbage collection: the first sweep waits this long after boot
+* (off the first paint and the first sync round), then repeats on the interval.
+*/
+const GC_BOOT_DELAY_MS = 3e4;
+const GC_INTERVAL_MS = 3600 * 1e3;
+/** Ids deleted per GC step. */
+const GC_CHUNK = 200;
+/**
+* A `_00_view` row no query has resolved for this long stops vouching for its
+* ids (the sweep deletes it, so its bodies can be collected). Each session
+* that resolves a query rewrites its row, so this only retires query shapes
+* the app no longer runs.
+*/
+const VIEW_RETENTION_MS = 336 * 60 * 60 * 1e3;
 /** Rolling telemetry sample window per query. */
 const TELEMETRY_SAMPLE_WINDOW = 100;
 function backoffMs(attempt, base = RETRY_BASE_MS, max = RETRY_MAX_MS) {
@@ -2512,6 +2525,32 @@ const setServerState = (hash, serverState) => (s) => withEntry(s, hash, (e) => e
 * set names: membership has caught up with the write, the overlay's job is
 * done (invariant I7).
 */
+/** What a `_00_view` row holding these arrays vouches for. */
+const vouchedIds = (members, children) => [...new Set([...members.map(([id]) => id), ...children.map(([id]) => id)])];
+const withView = (s, viewKey, ids) => {
+	const views = new Map(s.views);
+	views.set(viewKey, ids);
+	return {
+		...s,
+		views
+	};
+};
+/**
+* Replace the durable view index with a fresh `_00_view` read (boot, bucket
+* switch, GC). An entry of a query in state is kept: its commits update the
+* index as they write the row, so it is never older than the read.
+*/
+const reloadViews = (fromStore) => (s) => {
+	const views = new Map(fromStore);
+	for (const e of s.queries.values()) {
+		const held = s.views.get(e.def.viewKey);
+		if (held) views.set(e.def.viewKey, held);
+	}
+	return {
+		...s,
+		views
+	};
+};
 const commitMembership = (hash, remoteArray, present) => (s) => {
 	const withArray = withEntry(s, hash, (e) => ({
 		...e,
@@ -2522,10 +2561,11 @@ const commitMembership = (hash, remoteArray, present) => (s) => {
 		})
 	}));
 	if (withArray === s) return s;
+	const entry = withArray.queries.get(hash);
 	const named = new Set(remoteArray.map(([id]) => id));
 	const outbox = withArray.outbox.filter((item) => !(item.status === "acked" && named.has(item.recordId)));
 	return {
-		...withArray,
+		...withView(withArray, entry.def.viewKey, vouchedIds(remoteArray, entry.subqueryRemoteArray)),
 		outbox,
 		dirty: addAll(withArray.dirty, [hash])
 	};
@@ -2540,10 +2580,19 @@ const setLocalArray = (hash, localArray) => (s) => {
 		dirty: addAll(next.dirty, [hash])
 	};
 };
-const setSubqueryRemoteArray = (hash, subqueryRemoteArray) => (s) => withEntry(s, hash, (e) => ({
-	...e,
-	subqueryRemoteArray
-}));
+/**
+* Replace a query's subquery child set. A query past `cold` has a `_00_view`
+* row, which records the children too (see `applySubqueryChildren`).
+*/
+const setSubqueryRemoteArray = (hash, subqueryRemoteArray) => (s) => {
+	const next = withEntry(s, hash, (e) => ({
+		...e,
+		subqueryRemoteArray
+	}));
+	const entry = next.queries.get(hash);
+	if (!entry || entry.lifecycle.phase === "cold") return next;
+	return withView(next, entry.def.viewKey, vouchedIds(entry.remoteArray, subqueryRemoteArray));
+};
 const setRecords = (hash, records, changed, materializeMs) => (s) => {
 	const next = withEntry(s, hash, (e) => {
 		const prev = e.telemetry.phaseSamples.localFetch ?? [];
@@ -2844,6 +2893,7 @@ const rebindQuery = (hash, next) => (s) => {
 const clearBucketState = () => (s) => ({
 	...s,
 	versions: /* @__PURE__ */ new Map(),
+	views: /* @__PURE__ */ new Map(),
 	outbox: [],
 	pendingWrites: /* @__PURE__ */ new Map(),
 	dirty: /* @__PURE__ */ new Set(),
@@ -2903,6 +2953,35 @@ function overlay(s) {
 		deletes
 	};
 }
+const vouchedCache = /* @__PURE__ */ new WeakMap();
+/**
+* Every id some durable `_00_view` row vouches for. Memoized on the index,
+* which only changes when a view row does.
+*/
+function vouched(s) {
+	const hit = vouchedCache.get(s.views);
+	if (hit) return hit;
+	const out = /* @__PURE__ */ new Set();
+	for (const ids of s.views.values()) for (const id of ids) out.add(id);
+	vouchedCache.set(s.views, out);
+	return out;
+}
+/**
+* Bodies the GC must keep: `_00_` bookkeeping, anything a durable view
+* vouches for, anything a query in memory names (members or children), and
+* anything a write is still in flight for.
+*/
+function retained(s) {
+	const held = /* @__PURE__ */ new Set();
+	for (const e of s.queries.values()) {
+		for (const [id] of e.remoteArray) held.add(id);
+		for (const [id] of e.subqueryRemoteArray) held.add(id);
+	}
+	for (const item of s.outbox) held.add(item.recordId);
+	for (const write of s.pendingWrites.values()) held.add(write.recordId);
+	const known = vouched(s);
+	return (id) => id.startsWith("_00_") || known.has(id) || held.has(id);
+}
 const pendingDeleteIds = (s) => new Set(s.outbox.filter((i) => i.type === "delete").map((i) => i.recordId));
 const hasAckedWrites = (s) => s.outbox.some((i) => i.status === "acked");
 const pendingMutationCount = (s) => s.outbox.filter((i) => i.status === "pending").length;
@@ -3316,6 +3395,7 @@ function emptyState(init) {
 		registering: /* @__PURE__ */ new Set(),
 		membershipReread: /* @__PURE__ */ new Map(),
 		versions: /* @__PURE__ */ new Map(),
+		views: /* @__PURE__ */ new Map(),
 		outbox: [],
 		pendingWrites: /* @__PURE__ */ new Map(),
 		failedCount: 0,
@@ -3362,6 +3442,24 @@ function parseViewRow(row) {
 		confirmed: row.confirmed === true
 	};
 }
+const pairIds = (pairs) => Array.isArray(pairs) ? pairs.filter((p) => Array.isArray(p) && typeof p[0] === "string").map((p) => p[0]) : [];
+/** `SELECT * FROM _00_view` rows, keyed by view key; junk rows are skipped. */
+function parseViewIndex(rows) {
+	if (!Array.isArray(rows)) return [];
+	const out = [];
+	for (const row of rows) {
+		if (!row || typeof row !== "object" || !Array.isArray(row.ids)) continue;
+		const id = row.id;
+		const key = typeof id === "string" ? id.slice(id.indexOf(":") + 1) : String(id?.id ?? "");
+		if (!key) continue;
+		out.push({
+			key,
+			ids: [...new Set([...pairIds(row.ids), ...pairIds(row.children)])],
+			updatedAt: typeof row.updatedAt === "number" ? row.updatedAt : 0
+		});
+	}
+	return out;
+}
 /**
 * "Resolved before": the server answered this query on this device at some
 * point. An unconfirmed empty row cannot be told apart from one written before
@@ -3634,11 +3732,19 @@ const selfHealDelayMs = (attempt) => Math.min(SELF_HEAL_MAX_MS, SELF_HEAL_BASE_M
 const VIEW_TABLE = "_00_view";
 const LEGACY_VIEW_TABLE = "_00_window";
 const viewRecordId = (viewKey) => new RecordId$1(VIEW_TABLE, viewKey);
-const viewRow = (ids, confirmed, now) => ({
+/**
+* The durable `_00_view` row: the confirmed membership plus the subquery
+* children, which the GC must keep and a cold scan may paint as much as the
+* members.
+*/
+const viewRow = (ids, children, confirmed, now) => ({
 	ids,
+	children,
 	confirmed,
 	updatedAt: now
 });
+/** Every `_00_view` row: the durable view index and the GC read it. */
+const readViewRows = () => `SELECT * FROM ${VIEW_TABLE}`;
 /** Copy every legacy `_00_window` row into `_00_view` once. */
 const readLegacyViewRows = () => `SELECT * FROM ${LEGACY_VIEW_TABLE}`;
 const countViewRows = () => `SELECT count() FROM ${VIEW_TABLE} GROUP ALL`;
@@ -3747,7 +3853,7 @@ function* applyMembership(hash, remoteArray, meta, verifiedRemoval) {
 	});
 	const now = yield fx.now();
 	try {
-		yield fx.local.upsert(VIEW_TABLE, viewRecordId(entry.def.viewKey), viewRow(remoteArray, true, now), "replace");
+		yield fx.local.upsert(VIEW_TABLE, viewRecordId(entry.def.viewKey), viewRow(remoteArray, entry.subqueryRemoteArray, true, now), "replace");
 	} catch (err) {
 		yield fx.emit({
 			type: "log",
@@ -3777,11 +3883,28 @@ function* recoverLostView(hash) {
 		hash
 	});
 }
-/** Replace the subquery child set; bodies follow through the fetch plan. */
+/**
+* Replace the subquery child set; bodies follow through the fetch plan. A
+* query with a `_00_view` row (past `cold`) records the children there too,
+* so the GC keeps their bodies and a cold scan may paint them.
+*/
 function* applySubqueryChildren(hash, children) {
 	const entry = yield fx.state.read((s) => s.queries.get(hash));
 	if (!entry || recordVersionArraysEqual(entry.subqueryRemoteArray, children)) return;
 	yield fx.state.update(setSubqueryRemoteArray(hash, children));
+	if (entry.lifecycle.phase !== "cold") try {
+		yield fx.local.upsert(VIEW_TABLE, viewRecordId(entry.def.viewKey), { children }, "merge");
+	} catch (err) {
+		yield fx.emit({
+			type: "log",
+			level: "debug",
+			message: "view row write failed",
+			data: {
+				hash,
+				err
+			}
+		});
+	}
 	yield fx.dispatch({ type: "FetchRows" });
 }
 const ok = (r) => r.ok;
@@ -4211,42 +4334,65 @@ function* ackPrune() {
 	yield fx.state.update(outboxPruneAcked(now, ACK_GRACE_MS));
 	if (yield fx.state.read((s) => s.outbox.some((i) => i.status === "acked"))) yield fx.timer.set("ack-prune", ACK_GRACE_MS, { type: "AckPrune" });
 }
+/** Every `_00_view` row, parsed. Throws when the read fails. */
+function* readViews() {
+	const res = yield fx.local.query(readViewRows());
+	return parseViewIndex(Array.isArray(res) ? res[0] : void 0);
+}
+const indexOf = (rows) => new Map(rows.map((r) => [r.key, r.ids]));
+/**
+* Load the durable view index (boot, bucket switch). A failed read leaves it
+* empty, which fails closed: cold scans paint nothing until the server answers.
+*/
+function* loadViews() {
+	try {
+		yield fx.state.update(reloadViews(indexOf(yield* readViews())));
+	} catch (error) {
+		yield fx.emit({
+			type: "log",
+			level: "warn",
+			message: "view index read failed",
+			data: { error }
+		});
+	}
+}
+const tableOf$1 = (id) => id.slice(0, id.indexOf(":"));
 /**
-* Weekly orphan collection: bodies the store holds that no `_00_view` row
-* names and no outbox item touches are invisible; delete them in chunks.
+* Orphan collection, `GC_BOOT_DELAY_MS` after boot and then every
+* `GC_INTERVAL_MS`. Re-reads every `_00_view` row into the index, retires the
+* rows no query has resolved for `VIEW_RETENTION_MS`, then deletes the bodies
+* nothing retains (see `retained`) from the store and the circuit, a chunk at
+* a time. Only a leader or solo tab deletes, and a leader relays the deletes
+* so followers drop the rows too; a follower only refreshes its index.
 */
 function* gcTick() {
+	yield fx.state.wait((s) => s.primed);
 	try {
-		const views = yield fx.local.query(`SELECT ids FROM ${VIEW_TABLE}`);
-		const rows = Array.isArray(views?.[0]) ? views[0] : [];
-		const keep = /* @__PURE__ */ new Set();
-		for (const row of rows) {
-			if (!Array.isArray(row.ids)) continue;
-			for (const pair of row.ids) keep.add(pair[0]);
-		}
-		const state = yield fx.state.read((s) => s);
-		for (const item of state.outbox) keep.add(item.recordId);
-		const orphans = [...state.versions.keys()].filter((id) => !keep.has(id) && !id.startsWith("_00_"));
-		const deletes = orphans.map((id) => {
-			const table = id.slice(0, id.indexOf(":"));
-			return fx.local.delete(table, id);
-		});
-		for (let i = 0; i < deletes.length; i += 200) {
-			const settled = yield fx.all(deletes.slice(i, i + 200));
-			const done = orphans.slice(i, i + 200).filter((_, j) => settled[j].ok);
-			yield fx.state.update(deleteVersions(done));
-			if (done.length > 0) yield fx.ssp.ingest(done.map((id) => ({
-				table: id.slice(0, id.indexOf(":")),
-				op: "DELETE",
-				id,
-				record: {}
-			})));
-		}
+		const rows = yield* readViews();
+		const [role, bucket, held] = yield fx.state.read((s) => [
+			s.tabRole,
+			s.bucketId,
+			new Set([...s.queries.values()].map((e) => e.def.viewKey))
+		]);
+		const now = yield fx.now();
+		const expired = role === "follower" ? [] : rows.filter((r) => !held.has(r.key) && now - r.updatedAt >= VIEW_RETENTION_MS);
+		const retired = /* @__PURE__ */ new Set();
+		for (let i = 0; i < expired.length; i += GC_CHUNK) {
+			const chunk = expired.slice(i, i + GC_CHUNK);
+			const settled = yield fx.all(chunk.map((r) => fx.local.delete(VIEW_TABLE, viewRecordId(r.key))));
+			chunk.forEach((r, j) => settled[j].ok && retired.add(r.key));
+		}
+		yield fx.state.update(reloadViews(indexOf(rows.filter((r) => !retired.has(r.key)))));
+		if (role === "follower") return;
+		const removed = yield* collectOrphans(bucket, role === "leader");
 		yield fx.emit({
 			type: "log",
 			level: "info",
 			message: "orphan gc done",
-			data: { removed: orphans.length }
+			data: {
+				removed,
+				retiredViews: retired.size
+			}
 		});
 	} catch (error) {
 		yield fx.emit({
@@ -4255,8 +4401,50 @@ function* gcTick() {
 			message: "orphan gc failed",
 			data: { error }
 		});
+	} finally {
+		yield fx.timer.set("gc", GC_INTERVAL_MS, { type: "GcTick" });
+	}
+}
+/**
+* Delete every body nothing retains, `GC_CHUNK` at a time. Each chunk is
+* re-checked against fresh state (a membership committed meanwhile may name
+* an id again) and the sweep stops if the bucket moved under it.
+*/
+function* collectOrphans(bucket, relay) {
+	const candidates = yield fx.state.read((s) => {
+		const keep = retained(s);
+		return [...s.versions.keys()].filter((id) => !keep(id));
+	});
+	let removed = 0;
+	for (let i = 0; i < candidates.length; i += GC_CHUNK) {
+		const chunk = yield fx.state.read((s) => {
+			if (!s.primed || s.bucketId !== bucket) return null;
+			const keep = retained(s);
+			return candidates.slice(i, i + GC_CHUNK).filter((id) => s.versions.has(id) && !keep(id));
+		});
+		if (chunk === null) break;
+		const settled = yield fx.all(chunk.map((id) => fx.local.delete(tableOf$1(id), id)));
+		const done = chunk.filter((_, j) => settled[j].ok);
+		if (done.length === 0) continue;
+		const records = done.map((id) => ({
+			table: tableOf$1(id),
+			op: "DELETE",
+			id,
+			record: {}
+		}));
+		yield fx.state.update(deleteVersions(done));
+		yield fx.ssp.ingest(records);
+		if (relay) yield fx.emit({
+			type: "tabs:broadcast",
+			message: {
+				type: "ingest",
+				records
+			}
+		});
+		removed += done.length;
 	}
-	yield fx.timer.set("gc", GC_INTERVAL_MS, { type: "GcTick" });
+	if (removed > 0) yield fx.dispatch({ type: "FetchRows" });
+	return removed;
 }
 
 //#endregion
@@ -5215,6 +5403,7 @@ function* boot(env, opts) {
 	yield fx.state.update(setIdentity({ bucketId: bucket }));
 	if (yield fx.service("local.usesSurqlSchema")) yield fx.service("migrator.provision");
 	yield* migrateWindowToView();
+	yield* loadViews();
 	yield fx.dispatch({ type: "WarmBlobs" });
 	yield fx.service("ssp.init");
 	yield fx.service("ssp.setPermissions");
@@ -5234,7 +5423,7 @@ function* boot(env, opts) {
 	yield fx.service("features.init");
 	yield fx.service("releases.init");
 	yield fx.dispatch({ type: "LifecycleTick" });
-	yield fx.dispatch({ type: "GcTick" });
+	yield fx.timer.set("gc", GC_BOOT_DELAY_MS, { type: "GcTick" });
 	yield fx.state.update(setIdentity({ localReady: true }));
 	yield fx.dispatch({ type: "StartRemote" });
 }
@@ -5736,6 +5925,17 @@ function rowsFromResult(effect, result) {
 	const first = Array.isArray(result) ? result[0] : void 0;
 	return Array.isArray(first) ? first : [];
 }
+/**
+* A row's encoded record id: a string on the SQLite engine, a `RecordId` on
+* the SurrealDB one. `null` for a row that carries none (a projection
+* without `id`, a `SELECT VALUE`).
+*/
+function rowKey(row) {
+	const id = row !== null && typeof row === "object" ? row.id : void 0;
+	if (typeof id === "string") return id;
+	if (id !== null && typeof id === "object" && "table" in id && "id" in id) return encodeRecordId(id);
+	return null;
+}
 /** Cheap structural equality for the "did the rows change" check. */
 function rowsEqual(a, b) {
 	if (a === b) return true;
@@ -5757,6 +5957,16 @@ function resolveMembership(input) {
 	return null;
 }
 /**
+* Whether a body may paint before the server has answered (`cold`). One no
+* durable view vouches for and no optimistic write touches is an orphan:
+* deleted upstream while no view watched it, or dropped from every view since.
+* The predicate scan would otherwise resurrect it until the server answers,
+* and indefinitely offline.
+*/
+function paintsCold(id, vouched, overlay) {
+	return id.startsWith("_00_") || vouched.has(id) || overlay.writes.has(id);
+}
+/**
 *   render = (membership ∪ (writes ∩ localView)) − deletes
 *
 * `writes`/`deletes` are the outbox overlay (pending and acked items). The
@@ -5784,21 +5994,32 @@ function buildRenderIds(membership, localView, overlay, opts) {
 
 //#endregion
 //#region src/query/materialize.saga.ts
+const NONE = /* @__PURE__ */ new Set();
 /**
 * Render one query from state: membership (or a cold scan), the outbox
 * overlay, one local read, then notify subscribers if the rows changed. The
 * only writer of `records`. Runs on the `mat:<hash>` dedupe lane whenever the
-* query is dirty.
+* query is dirty. Before the server has answered (`cold`) only bodies some
+* durable view vouches for paint (see `paintsCold`).
 */
 function* materialize(hash) {
-	const [entry, ov] = yield fx.state.read((s) => [s.queries.get(hash), overlay(s)]);
+	const [entry, ov, known] = yield fx.state.read((s) => {
+		const e = s.queries.get(hash);
+		return [
+			e,
+			overlay(s),
+			e?.lifecycle.phase === "cold" ? vouched(s) : NONE
+		];
+	});
 	if (!entry) return;
 	const t0 = yield fx.now();
 	const isWindow = isWindowed(entry.def.surql);
+	const paints = (id) => id === null || paintsCold(id, known, ov);
+	const coldWindow = entry.lifecycle.phase === "cold" && isWindow;
 	const membership = resolveMembership({
 		phase: entry.lifecycle.phase,
 		remoteArray: entry.remoteArray,
-		localArray: entry.localArray,
+		localArray: coldWindow ? entry.localArray.filter(([id]) => paints(id)) : entry.localArray,
 		isWindow
 	});
 	const ids = membership ? buildRenderIds(membership, entry.localArray, ov, {
@@ -5809,6 +6030,7 @@ function* materialize(hash) {
 	let rows;
 	try {
 		rows = rowsFromResult(effect, yield effect);
+		if (ids === null) rows = rows.filter((row) => paints(rowKey(row)));
 	} catch (error) {
 		yield fx.state.update(compose(recordError(hash), clearDirty(hash)));
 		yield fx.emit({
@@ -6118,6 +6340,7 @@ function* tabMessage(env, raw) {
 				});
 			}
 			yield fx.state.update(compose(setVersions(msg.records.filter((r) => r.op !== "DELETE").map((r) => [r.id, typeof r.record?._00_rv === "number" ? r.record._00_rv : 0])), deleteVersions(msg.records.filter((r) => r.op === "DELETE").map((r) => r.id)), ...[...new Set(msg.records.map((r) => r.table))].map((t) => markTableDirty(t))));
+			if (msg.records.some((r) => r.op === "DELETE")) yield fx.dispatch({ type: "FetchRows" });
 			return;
 		case "membership-dirty":
 			if (Array.isArray(msg.hashes)) yield* liveChange(env, msg.hashes);
@@ -6236,6 +6459,7 @@ function* bucketSwitch(env, target, release = null, opts = { clearBlobsOnSignOut
 			data: { error }
 		});
 	}
+	yield* loadViews();
 	yield* rebindQueries();
 	yield* loadOutbox(env);
 	yield fx.dispatch({ type: "EnsureRegistered" });
@@ -12283,6 +12507,8 @@ var TabsCoordinator = class {
 			this.enqueue(async () => {
 				if (this.role === "leader") await this.teardownLeader();
 				else if (this.role === "follower") this.teardownFollower("bucket switch");
+				this.setRole("solo");
+				this.leaderTabId = null;
 				this.bucketId = bucketId;
 				const timeout = setTimeout(() => {
 					this.startResolve = null;
@@ -13787,7 +14013,7 @@ function createTabsCoordinator(config, s, host) {
 	return new TabsCoordinator({
 		tabId: s.tabId,
 		fingerprint: computeTabsFingerprint({
-			coreVersion: "0.0.1-canary.286",
+			coreVersion: "0.0.1-canary.288",
 			schemaHash: hash53(config.schemaSurql),
 			endpoint: config.database.endpoint ?? "",
 			namespace: config.database.namespace,

package/dist/live.js

@@ -1,4 +1,4 @@
-import { A as registerVars, C as heartbeatRowGone, L as sha256Hex, R as queryHashInput, S as heartbeatBatch, a as metaFromRow, b as bodySelect, c as parseDuration, d as parseQueryParams, f as ANON_USER_ID, h as listRefTableFor, j as singleSnapshotSelect, k as registerSelect, l as parseRecordIdString, n as rowOfEdge, p as DEFAULT_REF_MODE, s as encodeRecordId, t as hashOfEdge, u as withTimeout } from "./worker-edges.js";
+import { A as registerSelect, C as heartbeatRowGone, M as singleSnapshotSelect, R as sha256Hex, S as heartbeatBatch, a as metaFromRow, b as bodySelect, c as parseDuration, d as parseQueryParams, f as ANON_USER_ID, h as listRefTableFor, j as registerVars, l as parseRecordIdString, n as rowOfEdge, p as DEFAULT_REF_MODE, s as encodeRecordId, t as hashOfEdge, u as withTimeout, z as queryHashInput } from "./worker-edges.js";
 import { n as decodeTokenClaims } from "./worker-impersonation.js";
 import { RecordId, Surreal } from "surrealdb";
 

package/dist/pure.d.ts

@@ -181,7 +181,14 @@ type Vars = Record<string, unknown>;
 declare const VIEW_TABLE = "_00_view";
 declare const LEGACY_VIEW_TABLE = "_00_window";
 declare const viewRecordId: (viewKey: string) => RecordId<string>;
-declare const viewRow: (ids: RecordVersionArray, confirmed: boolean, now: number) => Record<string, unknown>;
+/**
+ * The durable `_00_view` row: the confirmed membership plus the subquery
+ * children, which the GC must keep and a cold scan may paint as much as the
+ * members.
+ */
+declare const viewRow: (ids: RecordVersionArray, children: RecordVersionArray, confirmed: boolean, now: number) => Record<string, unknown>;
+/** Every `_00_view` row: the durable view index and the GC read it. */
+declare const readViewRows: () => string;
 /** Copy every legacy `_00_window` row into `_00_view` once. */
 declare const readLegacyViewRows: () => string;
 declare const countViewRows: () => string;
@@ -319,4 +326,4 @@ declare function sha256Hex(input: string): Promise<string>;
  */
 declare function queryKey(input: QueryKeyInput, sessionId: string | null): Promise<string>;
 //#endregion
-export { ANON_USER_ID, type Answer, BridgeSignOutMessage, BridgeTokenMessage, DEFAULT_REF_MODE, FAILED, IMPERSONATION_ACCESS, LEGACY_VIEW_TABLE, type ListRefSnapshot, PUSH_PAYLOAD_VERSION, PushNotification, PushNotificationAction, PushOp, PushPayload, PushPayloadKind, PushUrgency, type QueryKeyInput, type QueryMetaRow, type RefMode, RegisterPayload, type SealOptions, type SealedQuery, type SurqlHelper, type TokenClaims, type TxQuery, VIEW_TABLE, WebPushClientMessage, base64UrlToBytes, batchSnapshotSelect, bodySelect, bucketIdForUser, bytesToBase64Url, countViewRows, decodeTokenClaims, dedupeRecordVersions, encodeRecordId, hashOfEdge, heartbeatBatch, heartbeatRowGone, isPushPayload, listRefBatchSelect, listRefSelect, listRefTableFor, metaFromRow, parseDuration, parseQueryParams, parseRecordIdString, queryHashInput, queryKey, queryRowCountBatchSelect, queryRowCountSelect, readLegacyViewRows, registerSelect, registerVars, rowOfEdge, sameBytes, sanitizeUserId, sha256Hex, singleSnapshotSelect, snapshotFromSingle, subqueryListRefSelect, surql, upsertBodiesTx, viewKeyInput, viewRecordId, viewRow };
+export { ANON_USER_ID, type Answer, BridgeSignOutMessage, BridgeTokenMessage, DEFAULT_REF_MODE, FAILED, IMPERSONATION_ACCESS, LEGACY_VIEW_TABLE, type ListRefSnapshot, PUSH_PAYLOAD_VERSION, PushNotification, PushNotificationAction, PushOp, PushPayload, PushPayloadKind, PushUrgency, type QueryKeyInput, type QueryMetaRow, type RefMode, RegisterPayload, type SealOptions, type SealedQuery, type SurqlHelper, type TokenClaims, type TxQuery, VIEW_TABLE, WebPushClientMessage, base64UrlToBytes, batchSnapshotSelect, bodySelect, bucketIdForUser, bytesToBase64Url, countViewRows, decodeTokenClaims, dedupeRecordVersions, encodeRecordId, hashOfEdge, heartbeatBatch, heartbeatRowGone, isPushPayload, listRefBatchSelect, listRefSelect, listRefTableFor, metaFromRow, parseDuration, parseQueryParams, parseRecordIdString, queryHashInput, queryKey, queryRowCountBatchSelect, queryRowCountSelect, readLegacyViewRows, readViewRows, registerSelect, registerVars, rowOfEdge, sameBytes, sanitizeUserId, sha256Hex, singleSnapshotSelect, snapshotFromSingle, subqueryListRefSelect, surql, upsertBodiesTx, viewKeyInput, viewRecordId, viewRow };

package/dist/pure.js

@@ -1,4 +1,4 @@
-import { A as registerVars, C as heartbeatRowGone, D as queryRowCountSelect, E as queryRowCountBatchSelect, F as viewRow, I as surql, L as sha256Hex, M as subqueryListRefSelect, N as upsertBodiesTx, O as readLegacyViewRows, P as viewRecordId, R as queryHashInput, S as heartbeatBatch, T as listRefSelect, _ as LEGACY_VIEW_TABLE, a as metaFromRow, b as bodySelect, c as parseDuration, d as parseQueryParams, f as ANON_USER_ID, g as sanitizeUserId, h as listRefTableFor, i as dedupeRecordVersions, j as singleSnapshotSelect, k as registerSelect, l as parseRecordIdString, m as bucketIdForUser, n as rowOfEdge, o as snapshotFromSingle, p as DEFAULT_REF_MODE, r as FAILED, s as encodeRecordId, t as hashOfEdge, v as VIEW_TABLE, w as listRefBatchSelect, x as countViewRows, y as batchSnapshotSelect, z as viewKeyInput } from "./worker-edges.js";
+import { A as registerSelect, B as viewKeyInput, C as heartbeatRowGone, D as queryRowCountSelect, E as queryRowCountBatchSelect, F as viewRecordId, I as viewRow, L as surql, M as singleSnapshotSelect, N as subqueryListRefSelect, O as readLegacyViewRows, P as upsertBodiesTx, R as sha256Hex, S as heartbeatBatch, T as listRefSelect, _ as LEGACY_VIEW_TABLE, a as metaFromRow, b as bodySelect, c as parseDuration, d as parseQueryParams, f as ANON_USER_ID, g as sanitizeUserId, h as listRefTableFor, i as dedupeRecordVersions, j as registerVars, k as readViewRows, l as parseRecordIdString, m as bucketIdForUser, n as rowOfEdge, o as snapshotFromSingle, p as DEFAULT_REF_MODE, r as FAILED, s as encodeRecordId, t as hashOfEdge, v as VIEW_TABLE, w as listRefBatchSelect, x as countViewRows, y as batchSnapshotSelect, z as queryHashInput } from "./worker-edges.js";
 import { n as decodeTokenClaims, t as IMPERSONATION_ACCESS } from "./worker-impersonation.js";
 import { a as sameBytes, i as isPushPayload, n as base64UrlToBytes, r as bytesToBase64Url, t as PUSH_PAYLOAD_VERSION } from "./worker-types.js";
 
@@ -21,4 +21,4 @@ function queryKey(input, sessionId) {
 }
 
 //#endregion
-export { ANON_USER_ID, DEFAULT_REF_MODE, FAILED, IMPERSONATION_ACCESS, LEGACY_VIEW_TABLE, PUSH_PAYLOAD_VERSION, VIEW_TABLE, base64UrlToBytes, batchSnapshotSelect, bodySelect, bucketIdForUser, bytesToBase64Url, countViewRows, decodeTokenClaims, dedupeRecordVersions, encodeRecordId, hashOfEdge, heartbeatBatch, heartbeatRowGone, isPushPayload, listRefBatchSelect, listRefSelect, listRefTableFor, metaFromRow, parseDuration, parseQueryParams, parseRecordIdString, queryHashInput, queryKey, queryRowCountBatchSelect, queryRowCountSelect, readLegacyViewRows, registerSelect, registerVars, rowOfEdge, sameBytes, sanitizeUserId, sha256Hex, singleSnapshotSelect, snapshotFromSingle, subqueryListRefSelect, surql, upsertBodiesTx, viewKeyInput, viewRecordId, viewRow };
+export { ANON_USER_ID, DEFAULT_REF_MODE, FAILED, IMPERSONATION_ACCESS, LEGACY_VIEW_TABLE, PUSH_PAYLOAD_VERSION, VIEW_TABLE, base64UrlToBytes, batchSnapshotSelect, bodySelect, bucketIdForUser, bytesToBase64Url, countViewRows, decodeTokenClaims, dedupeRecordVersions, encodeRecordId, hashOfEdge, heartbeatBatch, heartbeatRowGone, isPushPayload, listRefBatchSelect, listRefSelect, listRefTableFor, metaFromRow, parseDuration, parseQueryParams, parseRecordIdString, queryHashInput, queryKey, queryRowCountBatchSelect, queryRowCountSelect, readLegacyViewRows, readViewRows, registerSelect, registerVars, rowOfEdge, sameBytes, sanitizeUserId, sha256Hex, singleSnapshotSelect, snapshotFromSingle, subqueryListRefSelect, surql, upsertBodiesTx, viewKeyInput, viewRecordId, viewRow };

package/dist/worker-edges.js

@@ -103,11 +103,19 @@ const surql = {
 const VIEW_TABLE = "_00_view";
 const LEGACY_VIEW_TABLE = "_00_window";
 const viewRecordId = (viewKey) => new RecordId(VIEW_TABLE, viewKey);
-const viewRow = (ids, confirmed, now) => ({
+/**
+* The durable `_00_view` row: the confirmed membership plus the subquery
+* children, which the GC must keep and a cold scan may paint as much as the
+* members.
+*/
+const viewRow = (ids, children, confirmed, now) => ({
 	ids,
+	children,
 	confirmed,
 	updatedAt: now
 });
+/** Every `_00_view` row: the durable view index and the GC read it. */
+const readViewRows = () => `SELECT * FROM ${VIEW_TABLE}`;
 /** Copy every legacy `_00_window` row into `_00_view` once. */
 const readLegacyViewRows = () => `SELECT * FROM ${LEGACY_VIEW_TABLE}`;
 const countViewRows = () => `SELECT count() FROM ${VIEW_TABLE} GROUP ALL`;
@@ -412,4 +420,4 @@ function rowOfEdge(value) {
 }
 
 //#endregion
-export { registerVars as A, heartbeatRowGone as C, queryRowCountSelect as D, queryRowCountBatchSelect as E, viewRow as F, surql as I, sha256Hex as L, subqueryListRefSelect as M, upsertBodiesTx as N, readLegacyViewRows as O, viewRecordId as P, queryHashInput as R, heartbeatBatch as S, listRefSelect as T, LEGACY_VIEW_TABLE as _, metaFromRow as a, bodySelect as b, parseDuration as c, parseQueryParams as d, ANON_USER_ID as f, sanitizeUserId as g, listRefTableFor as h, dedupeRecordVersions as i, singleSnapshotSelect as j, registerSelect as k, parseRecordIdString as l, bucketIdForUser as m, rowOfEdge as n, snapshotFromSingle as o, DEFAULT_REF_MODE as p, FAILED as r, encodeRecordId as s, hashOfEdge as t, withTimeout as u, VIEW_TABLE as v, listRefBatchSelect as w, countViewRows as x, batchSnapshotSelect as y, viewKeyInput as z };
+export { registerSelect as A, viewKeyInput as B, heartbeatRowGone as C, queryRowCountSelect as D, queryRowCountBatchSelect as E, viewRecordId as F, viewRow as I, surql as L, singleSnapshotSelect as M, subqueryListRefSelect as N, readLegacyViewRows as O, upsertBodiesTx as P, sha256Hex as R, heartbeatBatch as S, listRefSelect as T, LEGACY_VIEW_TABLE as _, metaFromRow as a, bodySelect as b, parseDuration as c, parseQueryParams as d, ANON_USER_ID as f, sanitizeUserId as g, listRefTableFor as h, dedupeRecordVersions as i, registerVars as j, readViewRows as k, parseRecordIdString as l, bucketIdForUser as m, rowOfEdge as n, snapshotFromSingle as o, DEFAULT_REF_MODE as p, FAILED as r, encodeRecordId as s, hashOfEdge as t, withTimeout as u, VIEW_TABLE as v, listRefBatchSelect as w, countViewRows as x, batchSnapshotSelect as y, queryHashInput as z };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@spooky-sync/core",
-  "version": "0.0.1-canary.286",
+  "version": "0.0.1-canary.288",
   "type": "module",
   "sideEffects": false,
   "main": "./dist/index.js",
@@ -75,8 +75,8 @@
     }
   },
   "dependencies": {
-    "@spooky-sync/query-builder": "0.0.1-canary.286",
-    "@spooky-sync/ssp-wasm": "0.0.1-canary.286",
+    "@spooky-sync/query-builder": "0.0.1-canary.288",
+    "@spooky-sync/ssp-wasm": "0.0.1-canary.288",
     "@sqlite.org/sqlite-wasm": "3.53.0-build1",
     "@surrealdb/wasm": "^3.0.3",
     "blurhash": "^2.0.5",

package/src/boot/boot.saga.test.ts

@@ -19,7 +19,11 @@ describe('boot', () => {
       'auth.access': () => 'account',
     });
     const out = await runPure(boot(env, { sharedTabs: false }), {
-      handlers: { service: svc.handler, 'local.query': (e: any) => (e.sql.startsWith('SELECT count()') ? [[{ count: 1 }]] : []) },
+      handlers: {
+        service: svc.handler,
+        'local.query': (e: any) =>
+          e.sql.startsWith('SELECT count()') ? [[{ count: 1 }]] : e.sql === 'SELECT * FROM _00_view' ? [[{ id: '_00_view:k', ids: [['t:1', 1]] }]] : [],
+      },
     });
     expect(svc.names()).toEqual([
       'hint.read',
@@ -39,7 +43,10 @@ describe('boot', () => {
     ]);
     expect(svc.calls[1]).toEqual(['local.connect', ['u1']]);
     expect(out.state).toMatchObject({ bucketId: 'u1', userId: 'user:u1', saltUserId: 'user:u1', sessionId: 'salt-1', localReady: true });
-    expect(out.dispatched.map((d) => d.type)).toEqual(['WarmBlobs', 'PrimeCircuit', 'LifecycleTick', 'GcTick', 'StartRemote']);
+    expect(out.dispatched.map((d) => d.type)).toEqual(['WarmBlobs', 'PrimeCircuit', 'LifecycleTick', 'StartRemote']);
+    // The view index is loaded before anything can paint; the first GC waits out the boot.
+    expect(out.state.views).toEqual(new Map([['k', ['t:1']]]));
+    expect(out.timers.get('gc')).toEqual({ ms: 30_000, event: { type: 'GcTick' } });
     expect(svc.names()).not.toContain('remote.connect');
   });
   it('shared tabs: takes the role from the coordinator, or falls back to solo; schemaless engines skip provisioning; anonymous skips session auth', async () => {