@spooky-sync/core 0.0.1-canary.320 → 0.0.1-canary.322

package/src/query/list-ref-live.integration.test.ts

@@ -0,0 +1,203 @@
+import { Socket } from 'node:net';
+import { afterEach, beforeAll, beforeEach, describe, expect, it } from 'vitest';
+import { Surreal, type Uuid } from 'surrealdb';
+import { ANON_LIST_REF_TABLE } from '../modules/ref-tables';
+import { liveEndpoint } from '../live/index';
+import { hashOfEdge } from '../utils/edges';
+import { listRefLive } from './sql';
+
+/**
+ * Every signed-out session shares `_00_list_ref_anon`. Each one's LIVE must
+ * carry only its own edges, including after a reconnect, when its views' edges
+ * still name the socket that registered them.
+ *
+ * Runs against a real SurrealDB, because the filter rests on how SurrealDB
+ * evaluates a LIVE WHERE (`session::id()` in the subscriber's session, a bound
+ * param kept with the LIVE). Boot one first, e.g.:
+ *   docker run -d --name spooky-surreal-it -p 18011:8000 \
+ *     surrealdb/surrealdb:v3.1.5 start --user root --pass root --allow-all memory
+ *
+ * Needs SurrealDB 3.1 or later: 3.0.x sends no LIVE notification for a write
+ * that follows a `LET` in the same request, which is how the SSP writes every
+ * edge (and how these tests write them).
+ *
+ * Override the endpoint with SURREAL_IT_ENDPOINT. Skips if unreachable. The
+ * Dart twin is `packages/spooky_core/test/integration/anon_live_isolation_test.dart`.
+ */
+const endpoint = liveEndpoint(process.env.SURREAL_IT_ENDPOINT ?? 'ws://127.0.0.1:18011');
+const NS = 'it';
+
+// What the SSP and the CLI define (`ensure_anon_table`, `_00_query`).
+const SCHEMA = `
+DEFINE TABLE OVERWRITE item SCHEMALESS PERMISSIONS FOR select WHERE true;
+DEFINE TABLE OVERWRITE _00_query SCHEMALESS
+  PERMISSIONS FOR select, create, update, delete
+    WHERE auth_id = 'anon' OR ($auth.id != NONE AND auth_id = <string>$auth.id);
+DEFINE TABLE OVERWRITE _00_list_ref_anon SCHEMALESS
+  PERMISSIONS FOR select WHERE true, FOR create, update WHERE false, FOR delete WHERE false;
+DEFINE FIELD OVERWRITE in ON TABLE _00_list_ref_anon TYPE record;
+DEFINE FIELD OVERWRITE out ON TABLE _00_list_ref_anon TYPE record;
+DEFINE FIELD OVERWRITE clientId ON TABLE _00_list_ref_anon TYPE string;
+DEFINE FIELD OVERWRITE auth_id ON TABLE _00_list_ref_anon TYPE string DEFAULT '';
+DEFINE FIELD OVERWRITE version ON TABLE _00_list_ref_anon TYPE int;
+CREATE item:1 SET name = 'one';
+CREATE item:2 SET name = 'two';
+CREATE item:3 SET name = 'three';
+`;
+
+// The SSP's own statements (`build_edge_batch`): the edge takes the view's
+// clientId at write time.
+const VIEW =
+  "LET $from0 = type::record('_00_query', $q); LET $cid0 = (SELECT VALUE clientId FROM $from0 LIMIT 1)[0];";
+
+interface Heard {
+  action: string;
+  value: Record<string, unknown>;
+}
+
+const waitFor = async (pred: () => boolean, ms = 3_000): Promise<void> => {
+  const deadline = Date.now() + ms;
+  while (!pred() && Date.now() < deadline) await new Promise((r) => setTimeout(r, 25));
+};
+const settle = () => new Promise((r) => setTimeout(r, 300));
+
+describe('anonymous list_ref LIVE (real SurrealDB)', () => {
+  let root: Surreal;
+  let database = '';
+  let reachable = false;
+  const open: Surreal[] = [];
+
+  // A plain TCP probe: the SDK never rejects a connect to a refused port.
+  beforeAll(async () => {
+    const url = new URL(endpoint);
+    reachable = await new Promise<boolean>((resolve) => {
+      const socket = new Socket();
+      const done = (ok: boolean) => {
+        socket.destroy();
+        resolve(ok);
+      };
+      socket.setTimeout(1_000, () => done(false));
+      socket.once('error', () => done(false));
+      socket.connect(Number(url.port || 80), url.hostname, () => done(true));
+    });
+  });
+
+  beforeEach(async () => {
+    if (!reachable) return;
+    database = `anon_live_${Date.now()}_${Math.random().toString(36).slice(2, 8)}`;
+    root = new Surreal();
+    await root.connect(endpoint, { reconnect: false });
+    await root.signin({ username: 'root', password: 'root' });
+    await root.use({ namespace: NS, database });
+    await root.query(SCHEMA);
+  });
+
+  afterEach(async () => {
+    if (!reachable) return;
+    for (const db of open.splice(0)) await db.close().catch(() => undefined);
+    await root.query(`REMOVE DATABASE ${database}`).catch(() => undefined);
+    await root.close();
+  });
+
+  /** A signed-out socket and its `session::id()`. */
+  async function guest(): Promise<[Surreal, string]> {
+    const db = new Surreal();
+    open.push(db);
+    await db.connect(endpoint, { reconnect: false });
+    await db.use({ namespace: NS, database });
+    const [sid] = (await db.query('RETURN <string>session::id()')) as [string];
+    return [db, sid];
+  }
+
+  /** Open the client's anonymous LIVE and collect what it hears. */
+  async function listen(db: Surreal, earlier: string[] = []): Promise<Heard[]> {
+    const stmt = listRefLive(ANON_LIST_REF_TABLE, { inlineBodies: true, sessionIds: earlier });
+    const [uuid] = (await db.query(stmt.sql, stmt.vars)) as [Uuid];
+    const live = await db.liveOf(uuid);
+    const got: Heard[] = [];
+    live.subscribe((message) => {
+      if (message.action !== 'KILLED')
+        got.push({ action: message.action, value: message.value as Record<string, unknown> });
+    });
+    return got;
+  }
+
+  const register = (q: string, sid: string) =>
+    root.query("UPSERT type::record('_00_query', $q) SET clientId = $sid, auth_id = 'anon'", {
+      q,
+      sid,
+    });
+  const relate = (q: string, item: string) =>
+    root.query(
+      `${VIEW} RELATE $from0->_00_list_ref_anon->${item} SET version = 1, clientId = $cid0, auth_id = 'anon'`,
+      { q }
+    );
+  const bump = (q: string, item: string, version: number, restamp = true) =>
+    root.query(
+      `${VIEW} UPDATE (SELECT VALUE id FROM ${item}<-_00_list_ref_anon WHERE in = $from0) SET version = ${version}${restamp ? ', clientId = $cid0 ?? clientId' : ''} RETURN NONE`,
+      { q }
+    );
+  const remove = (q: string, item: string) =>
+    root.query(
+      `${VIEW} DELETE (SELECT VALUE id FROM ${item}<-_00_list_ref_anon WHERE in = $from0)`,
+      { q }
+    );
+
+  const heard = (got: Heard[]) =>
+    got
+      .map((m) => `${m.action} ${hashOfEdge(m.value)} ${(m.value.out as { name?: string }).name}`)
+      .join(', ');
+
+  it("two anonymous sessions do not hear each other's edges", async (ctx) => {
+    if (!reachable) ctx.skip();
+    const [a, sidA] = await guest();
+    const [b, sidB] = await guest();
+    await register('qa', sidA);
+    await register('qb', sidB);
+    const gotA = await listen(a);
+    const gotB = await listen(b);
+
+    await relate('qa', 'item:1');
+    await relate('qb', 'item:2');
+    await bump('qa', 'item:1', 2);
+    await waitFor(() => gotA.length >= 2 && gotB.length >= 1);
+    await settle();
+
+    // The body still rides along (`FETCH out`).
+    expect(heard(gotA)).toBe('CREATE qa one, UPDATE qa one');
+    expect(heard(gotB)).toBe('CREATE qb two');
+  });
+
+  it('after a reconnect the new socket still hears the edges its old one registered, and a bystander hears none of it', async (ctx) => {
+    if (!reachable) ctx.skip();
+    const [a, sidA] = await guest();
+    const [b, sidB] = await guest();
+    await register('qa', sidA);
+    await register('qb', sidB);
+    await relate('qa', 'item:1');
+    await relate('qa', 'item:2');
+    const gotB = await listen(b);
+
+    // New socket, new session id. The view stays registered under the old one
+    // until the client re-registers it.
+    await a.close();
+    const [a2, sidA2] = await guest();
+    const gotA2 = await listen(a2, [sidA]);
+
+    // An SSP that does not restamp: the edge keeps naming the old socket.
+    await bump('qa', 'item:1', 2, false);
+    await waitFor(() => gotA2.length >= 1);
+    expect(heard(gotA2)).toBe('UPDATE qa one');
+
+    // Re-registered: the view, and from now on each edge it bumps, names the
+    // new socket. An edge nothing bumped still names the old one when it goes.
+    await register('qa', sidA2);
+    await bump('qa', 'item:1', 3);
+    await remove('qa', 'item:2');
+    await relate('qa', 'item:3');
+    await waitFor(() => gotA2.length >= 4);
+    await settle();
+    expect(heard(gotA2)).toBe('UPDATE qa one, UPDATE qa one, DELETE qa two, CREATE qa three');
+    expect(gotB).toEqual([]);
+  });
+});

package/src/query/membership.saga.test.ts

@@ -159,7 +159,7 @@ describe('readMembership', () => {
       state: s,
       handlers: {
         'remote.query': (e: any) => {
-          expect(e.sql.startsWith('SELECT out, version FROM _00_list_ref WHERE in = $in')).toBe(true);
+          expect(e.sql.startsWith('SELECT out, version FROM $in->_00_list_ref WHERE parent IS NONE')).toBe(true);
           return [ok([out1('1'), out1('2')]), ok({ rowCount: 2, state: 'ready' }), ok([])];
         },
         'local.upsert': () => undefined,
@@ -217,7 +217,7 @@ describe('readMembership', () => {
       handlers: {
         'remote.query': (e: any) => {
           calls.push(e.sql.split('\n')[0]);
-          if (e.sql.includes('IN $ins')) {
+          if (e.sql.includes('$ins->')) {
             return [
               ok([{ in: qid('a'), out: new RecordId('thing', '1'), version: 1 }, { in: qid('a'), out: new RecordId('child', 'x'), version: 1, parent: qid('a') }]),
               ok([{ id: qid('a'), rowCount: 1, state: 'ready' }]),
@@ -228,7 +228,7 @@ describe('readMembership', () => {
         'local.upsert': () => undefined,
       },
     });
-    expect(calls).toEqual(['SELECT in, out, version, parent FROM _00_list_ref WHERE in IN $ins;', 'SELECT out, version FROM _00_list_ref WHERE in = $in AND parent IS NONE;']);
+    expect(calls).toEqual(['SELECT in, out, version, parent FROM $ins->_00_list_ref;', 'SELECT out, version FROM $in->_00_list_ref WHERE parent IS NONE;']);
     expect(out.state.queries.get('a')!.subqueryRemoteArray).toEqual([['child:x', 1]]);
     expect(out.state.queries.get('b')!.remoteArray).toEqual([['thing:2', 1], ['thing:3', 1]]);
     expect(out.result.changed).toBe(true);
@@ -254,7 +254,7 @@ describe('readMembership', () => {
       handlers: {
         'remote.query': (e: any) => {
           n++;
-          if (e.sql.includes('IN $ins')) return [ok([]), ok([])];
+          if (e.sql.includes('$ins->')) return [ok([]), ok([])];
           throw new Error('offline');
         },
       },
@@ -263,7 +263,7 @@ describe('readMembership', () => {
     expect(n).toBe(3);
     const rereadUnusable = await runPure(readMembership(env, ['a', 'b']), {
       state: s,
-      handlers: { 'remote.query': (e: any) => (e.sql.includes('IN $ins') ? [ok([]), ok([])] : [ok('x'), ok(null), ok(null)]) },
+      handlers: { 'remote.query': (e: any) => (e.sql.includes('$ins->') ? [ok([]), ok([])] : [ok('x'), ok(null), ok(null)]) },
     });
     expect(rereadUnusable.result).toEqual({ changed: false, failed: true });
     const single = buildState([buildEntry({ def: { hash: 'a', id: qid('a') }, lifecycle: { phase: 'live' }, remoteArray: [['thing:1', 1]] })]);

package/src/query/register.saga.ts

@@ -161,7 +161,13 @@ export function* registerRemote(env: SagaEnv, hash: QueryHash, retry = false): S
     const table = listRefTable(env, state);
     const results = (yield fx.remote.query(
       sql.registerSelect(table),
-      sql.registerVars({ id: entry.def.id, surql: entry.def.surql, params: { ...entry.def.params }, ttl: entry.def.ttl }),
+      sql.registerVars({
+        id: entry.def.id,
+        surql: entry.def.surql,
+        params: { ...entry.def.params },
+        ttl: entry.def.ttl,
+        ...(state.ownerSecret ? { owner: state.ownerSecret } : {}),
+      }),
       env.remoteTimeoutMs
     )) as StatementResult[];
     const stillThere = (yield fx.state.read((s) => s.queries.has(hash))) as boolean;

package/src/query/sql.test.ts

@@ -17,6 +17,15 @@ describe('query sql builders (golden against the previous builders)', () => {
     expect(sql.listRefBatchSelect('t')).toBe(buildListRefBatchSelect('t'));
     expect(sql.queryRowCountBatchSelect()).toBe(buildQueryRowCountBatchSelect());
   });
+  it('reads edges through the graph, byte-identical to spooky_core sql.dart', () => {
+    expect(sql.listRefSelect('_00_list_ref_user_u1')).toBe(
+      'SELECT out, version FROM $in->_00_list_ref_user_u1 WHERE parent IS NONE'
+    );
+    expect(sql.subqueryListRefSelect('_00_list_ref')).toBe(
+      'SELECT out, version FROM $in->_00_list_ref WHERE parent IS NOT NONE'
+    );
+    expect(sql.listRefBatchSelect('_00_list_ref')).toBe('SELECT in, out, version, parent FROM $ins->_00_list_ref');
+  });
   it('composes the single, batch and register requests', () => {
     expect(sql.singleSnapshotSelect('t').split(';\n')).toEqual([
       sql.listRefSelect('t'),
@@ -30,6 +39,34 @@ describe('query sql builders (golden against the previous builders)', () => {
       config: { id, surql: 's', params: { a: 1 }, ttl: '10m' },
       in: id,
     });
+    // The owner secret rides beside params, never inside them: params name
+    // the computation the SSP shares between views.
+    expect(sql.registerVars({ id, surql: 's', params: { a: 1 }, ttl: '10m', owner: 'k' })).toEqual({
+      config: { id, surql: 's', params: { a: 1 }, ttl: '10m', owner: 'k' },
+      in: id,
+    });
+  });
+  it('the LIVE on a per-user table is unfiltered; FETCH out only when bodies ride inline', () => {
+    expect(sql.listRefLive('_00_list_ref_user_x', { inlineBodies: true, sessionIds: ['s1'] })).toEqual({
+      sql: 'LIVE SELECT * FROM _00_list_ref_user_x FETCH out',
+    });
+    expect(sql.listRefLive('_00_list_ref', { inlineBodies: false, sessionIds: [] })).toEqual({
+      sql: 'LIVE SELECT * FROM _00_list_ref',
+    });
+  });
+  it("the anon LIVE hears only this client's sockets, current one by session::id()", () => {
+    const sids = ['earlier-1', 'earlier-2'];
+    const live = sql.listRefLive('_00_list_ref_anon', { inlineBodies: true, sessionIds: sids });
+    expect(live.sql).toBe(
+      'LIVE SELECT * FROM _00_list_ref_anon WHERE clientId = <string>session::id() OR clientId IN $sids FETCH out'
+    );
+    expect(live.vars).toEqual({ sids });
+    // A copy: the caller's list keeps growing after the LIVE is sent.
+    expect(live.vars!.sids).not.toBe(sids);
+    expect(sql.listRefLive('_00_list_ref_anon', { inlineBodies: false, sessionIds: [] })).toEqual({
+      sql: 'LIVE SELECT * FROM _00_list_ref_anon WHERE clientId = <string>session::id() OR clientId IN $sids',
+      vars: { sids: [] },
+    });
   });
   it('view rows and ids', () => {
     expect(sql.viewRecordId('k')).toEqual(new RecordId('_00_view', 'k'));

package/src/query/sql.ts

@@ -3,6 +3,7 @@ import type { RecordVersionArray } from '../types';
 import type { Vars } from '../kernel/effects';
 import { surql } from '../utils/surql';
 import type { SealedQuery } from '../utils/surql';
+import { ANON_LIST_REF_TABLE } from '../modules/ref-tables';
 
 /** Every SurrealQL statement the query side sends, as pure builders. */
 
@@ -35,13 +36,16 @@ export const readViewRows = (): string => `SELECT * FROM ${VIEW_TABLE}`;
 export const readLegacyViewRows = (): string => `SELECT * FROM ${LEGACY_VIEW_TABLE}`;
 export const countViewRows = (): string => `SELECT count() FROM ${VIEW_TABLE} GROUP ALL`;
 
+// Edges are read through the graph (`$in->table`): the `_00_list_ref*` tables
+// have no index on `in`, so `WHERE in = $in` scanned the whole table, which on
+// the shared `_00_list_ref_anon` is every signed-out visitor's edges.
 export const listRefSelect = (table: string): string =>
-  `SELECT out, version FROM ${table} WHERE in = $in AND parent IS NONE`;
+  `SELECT out, version FROM $in->${table} WHERE parent IS NONE`;
 export const subqueryListRefSelect = (table: string): string =>
-  `SELECT out, version FROM ${table} WHERE in = $in AND parent IS NOT NONE`;
+  `SELECT out, version FROM $in->${table} WHERE parent IS NOT NONE`;
 export const queryRowCountSelect = (): string => 'SELECT VALUE { rowCount: rowCount, state: state } FROM ONLY $in';
 export const listRefBatchSelect = (table: string): string =>
-  `SELECT in, out, version, parent FROM ${table} WHERE in IN $ins`;
+  `SELECT in, out, version, parent FROM $ins->${table}`;
 export const queryRowCountBatchSelect = (): string => 'SELECT VALUE { id: id, rowCount: rowCount, state: state } FROM $ins';
 
 /** The single-query read: edges, meta, subquery children in one request. */
@@ -51,11 +55,52 @@ export const singleSnapshotSelect = (table: string): string =>
 export const batchSnapshotSelect = (table: string): string =>
   `${listRefBatchSelect(table)};\n${queryRowCountBatchSelect()}`;
 
+/**
+ * The session's one LIVE subscription on its `_00_list_ref` table.
+ *
+ * `inlineBodies` adds `FETCH out`, which resolves the edge's target into the
+ * notification so the body arrives with the doorbell.
+ *
+ * On the anon table it is filtered to this client's own edges. Every
+ * signed-out session shares that table, so unfiltered each one received (and
+ * the server fetched a body for) every anonymous edge change of every other
+ * session, and the client then dropped all but its own. An edge carries the
+ * `session::id()` of whichever socket last registered its view, which is a
+ * socket of this client but not necessarily the current one: a view stays
+ * registered across a reconnect, and a reload keeps its salt and its views,
+ * so their older edges still name an earlier socket. `sessionIds` are those
+ * earlier sockets. The current one is matched by `session::id()` itself,
+ * which SurrealDB evaluates in the subscriber's own session, so the filter
+ * holds before the client has learned its new id.
+ *
+ * The cast is load-bearing: `session::id()` is a uuid, `clientId` a string,
+ * and without it nothing matches. Per-user tables need no filter.
+ */
+export function listRefLive(
+  table: string,
+  opts: { inlineBodies: boolean; sessionIds: ReadonlyArray<string> }
+): { sql: string; vars?: Vars } {
+  const join = opts.inlineBodies ? ' FETCH out' : '';
+  if (table !== ANON_LIST_REF_TABLE) return { sql: `LIVE SELECT * FROM ${table}${join}` };
+  return {
+    sql: `LIVE SELECT * FROM ${table} WHERE clientId = <string>session::id() OR clientId IN $sids${join}`,
+    vars: { sids: [...opts.sessionIds] },
+  };
+}
+
 export interface RegisterPayload {
   id: RecordId<string>;
   surql: string;
   params: Record<string, unknown>;
   ttl: string;
+  /**
+   * The registering page's secret. `fn::query::register` forwards only its
+   * hash, and the SSP lets a registration onto an existing anonymous view
+   * only with the hash that view was registered with: every signed-out
+   * visitor is `anon`, and anyone can read an anonymous view's id. Kept out
+   * of `params`, which name the computation the SSP shares between views.
+   */
+  owner?: string;
 }
 
 /** Register + read back edges/meta/children in ONE request. */

package/src/services/database/remote.ts

@@ -38,8 +38,12 @@ export type RemoteConnectionEvent = ConnectionState | 'error';
 const REMOTE_MAX_CONCURRENT_QUERIES = 6;
 
 /**
- * Session ids a page remembers for its pagehide release. Only the sessions of
- * the last ttl matter; this many reconnects inside one ttl is a broken network.
+ * Session ids a page remembers for its pagehide release and its anonymous LIVE
+ * filter. The release only needs the sessions of the last ttl; this many
+ * reconnects inside one ttl is a broken network. The LIVE filter would like
+ * every session that stamped an edge still held, but the SSP restamps an edge
+ * whenever its row changes, so an id that falls off costs at most the LIVE
+ * removal of a row untouched since, which the membership poll still catches.
  */
 const MAX_SESSION_IDS = 16;
 
@@ -82,6 +86,10 @@ export class RemoteDatabaseService extends AbstractDatabaseService {
    * whose own session id matches none of them, so it names these instead. Kept
    * for the page, not the socket: a view registered before a reconnect still
    * carries the old id until its next heartbeat.
+   *
+   * The anonymous LIVE filters on the same ids (see `listRefLive`): its edges
+   * name the socket that registered their view, which may be an earlier one.
+   * A reload hands its ids to the next page with the salt.
    */
   private sessionIdsSeen: string[] = [];
 
@@ -123,6 +131,16 @@ export class RemoteDatabaseService extends AbstractDatabaseService {
     return this.sessionIdsSeen;
   }
 
+  /**
+   * Take on the session ids of the page this one reloaded from. It kept that
+   * page's salt, so the views it re-registers still carry edges stamped by
+   * those sockets. Older than anything this page has seen, so they go first.
+   */
+  adoptSessionIds(ids: ReadonlyArray<string>): void {
+    const earlier = ids.filter((sid) => typeof sid === 'string' && sid !== '' && !this.sessionIdsSeen.includes(sid));
+    this.sessionIdsSeen = [...earlier, ...this.sessionIdsSeen].slice(-MAX_SESSION_IDS);
+  }
+
   /**
    * Ask the socket that just connected for its session id. Straight to the
    * SDK: it needs no namespace or identity, so it need not wait behind an

package/src/state/client-state.ts

@@ -114,6 +114,13 @@ export interface ClientState {
   readonly userId: string | null;
   /** The principal the current session salt was minted for. */
   readonly saltUserId: string | null;
+  /**
+   * This page's secret, sent with every registration (`$config.owner`). An
+   * anonymous view answers only to the secret it was registered with, so it
+   * lives as long as the page's views: a reconnect keeps it, and a reload
+   * that keeps the salt keeps it too.
+   */
+  readonly ownerSecret: string | null;
   /** Latest bucket-switch target; an older switch that wakes up to a newer target skips. */
   readonly pendingBucket: string | null;
   readonly tabId: string;
@@ -167,6 +174,7 @@ export function emptyState(init: { tabId: string }): ClientState {
     sessionId: null,
     userId: null,
     saltUserId: null,
+    ownerSecret: null,
     pendingBucket: null,
     tabId: init.tabId,
     tabRole: 'solo',

package/src/state/reducers.ts

@@ -444,7 +444,10 @@ export const setFailedCount =
 export const setIdentity =
   (
     patch: Partial<
-      Pick<ClientState, 'sessionId' | 'userId' | 'saltUserId' | 'pendingBucket' | 'bucketId' | 'tabRole' | 'localReady' | 'primed'>
+      Pick<
+        ClientState,
+        'sessionId' | 'userId' | 'saltUserId' | 'ownerSecret' | 'pendingBucket' | 'bucketId' | 'tabRole' | 'localReady' | 'primed'
+      >
     >
   ): Reducer =>
   (s) => ({ ...s, ...patch });

package/src/sync/connection.saga.test.ts

@@ -30,11 +30,22 @@ describe('connectionChanged', () => {
     expect(out.state.sync).toMatchObject({ needsResubscribe: false, lastReconnectRefetchAt: 1000 });
     expect(out.dispatched).toEqual([{ type: 'EnsureRegistered', requireAuth: true }, { type: 'LiveStart' }, { type: 'Drain' }]);
     const burst = await runPure(connectionChanged(env, 'connected'), { state: R.patchSync({ needsResubscribe: true })(out.state), now: 5000 });
-    expect(burst.dispatched).toEqual([]);
-    expect(burst.state.sync.needsResubscribe).toBe(false);
+    expect(burst.dispatched).toEqual([{ type: 'LiveStart' }, { type: 'Drain' }]);
+    expect(burst.state.sync).toMatchObject({ needsResubscribe: false, lastReconnectRefetchAt: 1000 });
     const later = await runPure(connectionChanged(env, 'connected'), { state: R.patchSync({ needsResubscribe: true })(out.state), now: 20_000 });
     expect(later.dispatched).toHaveLength(3);
   });
+  it('a reconnect inside the cooldown restarts the LIVE the drop killed, keeping the registrations', async () => {
+    const live = R.patchSync({ liveUuid: 'u', liveTable: 't', lastReconnectRefetchAt: 1000 })(
+      buildState([buildEntry({ def: { hash: 'a' }, lifecycle: { remote: 'registered' } })])
+    );
+    const dropped = await runPure(connectionChanged(env, 'disconnected'), { state: live });
+    expect(dropped.state.sync.liveUuid).toBeNull();
+    const back = await runPure(connectionChanged(env, 'connected'), { state: dropped.state, now: 3000 });
+    expect(back.dispatched).toContainEqual({ type: 'LiveStart' });
+    expect(back.dispatched).not.toContainEqual(expect.objectContaining({ type: 'EnsureRegistered' }));
+    expect(back.state.queries.get('a')!.lifecycle.remote).toBe('registered');
+  });
 });
 
 describe('syncOutcome', () => {

package/src/sync/connection.saga.ts

@@ -11,9 +11,9 @@ import { nextHealth, selfHealDelayMs } from './policy';
 
 /**
  * Transport state changes. A drop invalidates the live query and arms a
- * resubscribe; the next `connected` (outside the burst cooldown) drops every
- * remote registration so `ensureRegistered` rebuilds them behind the
- * `$auth.id` gate, and restarts LIVE.
+ * resubscribe. The next `connected` restarts LIVE and drains the outbox;
+ * outside the burst cooldown it also drops every remote registration so
+ * `ensureRegistered` rebuilds them behind the `$auth.id` gate.
  */
 export function* connectionChanged(env: SagaEnv, connection: ConnectionState): Saga<void> {
   const state = (yield fx.state.read((s) => s)) as ClientState;
@@ -27,18 +27,22 @@ export function* connectionChanged(env: SagaEnv, connection: ConnectionState): S
   const now = (yield fx.now()) as number;
   const last = state.sync.lastReconnectRefetchAt;
   if (last !== null && now - last < RECONNECT_REFETCH_COOLDOWN_MS) {
+    // The cooldown only spares the server a re-registration storm. The views
+    // the last refetch registered are still on the server, but LIVE died with
+    // the socket and nothing else restarts it: skipping it here left the
+    // client on the membership poll until a reconnect outside the window.
     yield fx.state.update(R.patchSync({ needsResubscribe: false }));
-    return;
+  } else {
+    yield fx.state.update(
+      R.compose(
+        R.patchSync({ needsResubscribe: false, lastReconnectRefetchAt: now }),
+        ...[...state.queries.values()]
+          .filter((e) => e.lifecycle.remote !== 'unregistered')
+          .map((e) => R.applyLifecycle(e.def.hash, { type: 'remote-dropped' }))
+      )
+    );
+    yield fx.dispatch({ type: 'EnsureRegistered', requireAuth: true });
   }
-  yield fx.state.update(
-    R.compose(
-      R.patchSync({ needsResubscribe: false, lastReconnectRefetchAt: now }),
-      ...[...state.queries.values()]
-        .filter((e) => e.lifecycle.remote !== 'unregistered')
-        .map((e) => R.applyLifecycle(e.def.hash, { type: 'remote-dropped' }))
-    )
-  );
-  yield fx.dispatch({ type: 'EnsureRegistered', requireAuth: true });
   yield fx.dispatch({ type: 'LiveStart' });
   yield fx.dispatch({ type: 'Drain' });
 }

package/src/sync/policy.test.ts

@@ -384,14 +384,18 @@ describe('resolveListRefPollInterval', () => {
 
 describe('buildListRefSelect', () => {
   it('substitutes the table name', () => {
-    expect(buildListRefSelect('_00_list_ref')).toContain('FROM _00_list_ref ');
+    expect(buildListRefSelect('_00_list_ref')).toContain('->_00_list_ref ');
     expect(buildListRefSelect('_00_list_ref_user_abc')).toContain(
-      'FROM _00_list_ref_user_abc '
+      '->_00_list_ref_user_abc '
     );
   });
 
-  it('filters by the bound query id', () => {
-    expect(buildListRefSelect('_00_list_ref')).toContain('WHERE in = $in');
+  it('traverses from the bound query id instead of scanning the table', () => {
+    // `_00_list_ref*` has no index on `in`: `FROM table WHERE in = $in` is a
+    // full scan, which on the shared anon table is every visitor's edges.
+    const sql = buildListRefSelect('_00_list_ref');
+    expect(sql).toContain('FROM $in->_00_list_ref ');
+    expect(sql).not.toContain('in = $in');
   });
 
   it('excludes subquery rows via parent IS NONE', () => {
@@ -411,14 +415,14 @@ describe('buildListRefSelect', () => {
 
 describe('buildSubqueryListRefSelect', () => {
   it('substitutes the table name', () => {
-    expect(buildSubqueryListRefSelect('_00_list_ref')).toContain('FROM _00_list_ref ');
+    expect(buildSubqueryListRefSelect('_00_list_ref')).toContain('->_00_list_ref ');
     expect(buildSubqueryListRefSelect('_00_list_ref_user_abc')).toContain(
-      'FROM _00_list_ref_user_abc '
+      '->_00_list_ref_user_abc '
     );
   });
 
-  it('filters by the bound query id', () => {
-    expect(buildSubqueryListRefSelect('_00_list_ref')).toContain('WHERE in = $in');
+  it('traverses from the bound query id', () => {
+    expect(buildSubqueryListRefSelect('_00_list_ref')).toContain('FROM $in->_00_list_ref ');
   });
 
   it('selects ONLY subquery child rows via parent IS NOT NONE', () => {
@@ -611,7 +615,7 @@ describe('recordVersionArraysEqual', () => {
 describe('list_ref poll batching', () => {
   it('reads many queries in one statement and their rowCounts keyed by id', () => {
     expect(buildListRefBatchSelect('_00_list_ref_user_abc')).toBe(
-      'SELECT in, out, version, parent FROM _00_list_ref_user_abc WHERE in IN $ins'
+      'SELECT in, out, version, parent FROM $ins->_00_list_ref_user_abc'
     );
     expect(buildQueryRowCountBatchSelect()).toBe(
       'SELECT VALUE { id: id, rowCount: rowCount, state: state } FROM $ins'

package/src/sync/policy.ts

@@ -186,9 +186,18 @@ export const DEFAULT_LIST_REF_POLL_INTERVAL_MS = 500;
  * because the client's `RecordVersionArray` only tracks primary rows;
  * including subquery rows would surface them as spurious "added"
  * diffs every tick.
+ *
+ * Read through the graph (`$in->table`), not `FROM table WHERE in = $in`:
+ * the edge tables have no index on `in`, so the WHERE form is a full table
+ * scan. On a per-user table that is one user's edges; on the shared
+ * `_00_list_ref_anon` it is every signed-out visitor's, on every poll of
+ * every anonymous client. The traversal walks only this view's edge keys
+ * (`GraphEdgeScan` on SurrealDB v3) and the edge table's select permission
+ * still applies to each row it returns. Edges are written with `RELATE`, so
+ * the graph keys always exist.
  */
 export function buildListRefSelect(table: string): string {
-  return `SELECT out, version FROM ${table} WHERE in = $in AND parent IS NONE`;
+  return `SELECT out, version FROM $in->${table} WHERE parent IS NONE`;
 }
 
 /**
@@ -231,7 +240,7 @@ export function buildQueryRowCountSelect(): string {
  * store SEPARATELY from the primary window array.
  */
 export function buildSubqueryListRefSelect(table: string): string {
-  return `SELECT out, version FROM ${table} WHERE in = $in AND parent IS NOT NONE`;
+  return `SELECT out, version FROM $in->${table} WHERE parent IS NOT NONE`;
 }
 
 /**
@@ -239,9 +248,13 @@ export function buildSubqueryListRefSelect(table: string): string {
  * together, split client-side on `parent`. Replaces two selects per query per
  * poll tick, which on a page with 20+ live queries was ~50 serialized round
  * trips per cycle and kept the remote busy full-time.
+ *
+ * Traverses from every id in `$ins` (see {@link buildListRefSelect}); the
+ * result is one flat list of edge rows, and `in` names the query each belongs
+ * to.
  */
 export function buildListRefBatchSelect(table: string): string {
-  return `SELECT in, out, version, parent FROM ${table} WHERE in IN $ins`;
+  return `SELECT in, out, version, parent FROM $ins->${table}`;
 }
 
 /**

package/src/testing/adapters.ts

@@ -78,7 +78,11 @@ export function fakeAdapters(over: {
       clear: (key) => void timers.pending.delete(key),
     },
     clock: { now: () => now },
-    ids: { mutation: () => `_00_pending_mutations:${String(++ids).padStart(13, '0')}_0001_tab`, salt: () => `salt-${++ids}` },
+    ids: {
+      mutation: () => `_00_pending_mutations:${String(++ids).padStart(13, '0')}_0001_tab`,
+      salt: () => `salt-${++ids}`,
+      owner: () => `owner-${++ids}`,
+    },
     hash: sha256Hex,
     services,
   };