@spooky-sync/core 0.0.1-canary.326 → 0.0.1-canary.328

package/dist/index.js

@@ -2188,9 +2188,9 @@ function trimHistory(history, cap) {
 
 //#endregion
 //#region src/modules/devtools/index.ts
-const CORE_VERSION = "0.0.1-canary.326";
-const WASM_VERSION = "0.0.1-canary.326";
-const SURREAL_VERSION = "3.0.3";
+const CORE_VERSION = "0.0.1-canary.328";
+const WASM_VERSION = "0.0.1-canary.328";
+const SURREAL_VERSION = "3.1.0";
 var DevToolsService = class DevToolsService {
 	version = CORE_VERSION;
 	backendInfo = emptyBackendInfo();
@@ -3604,6 +3604,28 @@ function retained(s) {
 	const known = vouched(s);
 	return (id) => id.startsWith("_00_") || known.has(id) || held.has(id);
 }
+/**
+* Ids something live still needs: a mounted query's membership or subquery
+* children, or a local write not yet settled. Unlike `retained`, durable view
+* rows of queries nobody runs right now do not count: a row the server just
+* took out of a live query must stop showing even if an old view named it.
+*/
+function activelyHeld(s) {
+	const held = /* @__PURE__ */ new Set();
+	for (const e of s.queries.values()) {
+		for (const [id] of e.remoteArray) held.add(id);
+		for (const [id] of e.subqueryRemoteArray) held.add(id);
+	}
+	for (const item of s.outbox) held.add(item.recordId);
+	for (const write of s.pendingWrites.values()) held.add(write.recordId);
+	return held;
+}
+/** Ids of `before` that `after` no longer names. */
+function departedIds(before, after) {
+	if (before.length === 0) return [];
+	const kept = new Set(after.map(([id]) => id));
+	return before.filter(([id]) => !kept.has(id)).map(([id]) => id);
+}
 const pendingDeleteIds = (s) => new Set(s.outbox.filter((i) => i.type === "delete").map((i) => i.recordId));
 const hasAckedWrites = (s) => s.outbox.some((i) => i.status === "acked");
 const pendingMutationCount = (s) => s.outbox.filter((i) => i.status === "pending").length;
@@ -4213,6 +4235,343 @@ function suspectHashes(snapshots, heldCounts, edgeCount) {
 	return out;
 }
 
+//#endregion
+//#region src/query/sql.ts
+/** Every SurrealQL statement the query side sends, as pure builders. */
+const VIEW_TABLE = "_00_view";
+const LEGACY_VIEW_TABLE = "_00_window";
+const viewRecordId = (viewKey) => new RecordId$1(VIEW_TABLE, viewKey);
+/**
+* The durable `_00_view` row: the confirmed membership plus the subquery
+* children, which the GC must keep and a cold scan may paint as much as the
+* members.
+*/
+const viewRow = (ids, children, confirmed, now) => ({
+	ids,
+	children,
+	confirmed,
+	updatedAt: now
+});
+/** Every `_00_view` row: the durable view index and the GC read it. */
+const readViewRows = () => `SELECT * FROM ${VIEW_TABLE}`;
+/** Copy every legacy `_00_window` row into `_00_view` once. */
+const readLegacyViewRows = () => `SELECT * FROM ${LEGACY_VIEW_TABLE}`;
+const countViewRows = () => `SELECT count() FROM ${VIEW_TABLE} GROUP ALL`;
+const listRefSelect = (table) => `SELECT out, version FROM $in->${table} WHERE parent IS NONE`;
+const subqueryListRefSelect = (table) => `SELECT out, version FROM $in->${table} WHERE parent IS NOT NONE`;
+const queryRowCountSelect = () => "SELECT VALUE { rowCount: rowCount, state: state } FROM ONLY $in";
+const listRefBatchSelect = (table) => `SELECT in, out, version, parent FROM $ins->${table}`;
+const queryRowCountBatchSelect = () => "SELECT VALUE { id: id, rowCount: rowCount, state: state } FROM $ins";
+/** The single-query read: edges, meta, subquery children in one request. */
+const singleSnapshotSelect = (table) => `${listRefSelect(table)};\n${queryRowCountSelect()};\n${subqueryListRefSelect(table)}`;
+/** The many-query read: all edges + all metas in one request. */
+const batchSnapshotSelect = (table) => `${listRefBatchSelect(table)};\n${queryRowCountBatchSelect()}`;
+/**
+* The session's one LIVE subscription on its `_00_list_ref` table.
+*
+* `inlineBodies` adds `FETCH out`, which resolves the edge's target into the
+* notification so the body arrives with the doorbell.
+*
+* On the anon table it is filtered to this client's own edges. Every
+* signed-out session shares that table, so unfiltered each one received (and
+* the server fetched a body for) every anonymous edge change of every other
+* session, and the client then dropped all but its own. An edge carries the
+* `session::id()` of whichever socket last registered its view, which is a
+* socket of this client but not necessarily the current one: a view stays
+* registered across a reconnect, and a reload keeps its salt and its views,
+* so their older edges still name an earlier socket. `sessionIds` are those
+* earlier sockets. The current one is matched by `session::id()` itself,
+* which SurrealDB evaluates in the subscriber's own session, so the filter
+* holds before the client has learned its new id.
+*
+* The cast is load-bearing: `session::id()` is a uuid, `clientId` a string,
+* and without it nothing matches. Per-user tables need no filter.
+*/
+function listRefLive(table, opts) {
+	const join = opts.inlineBodies ? " FETCH out" : "";
+	if (table !== ANON_LIST_REF_TABLE) return { sql: `LIVE SELECT * FROM ${table}${join}` };
+	return {
+		sql: `LIVE SELECT * FROM ${table} WHERE clientId = <string>session::id() OR clientId IN $sids${join}`,
+		vars: { sids: [...opts.sessionIds] }
+	};
+}
+/** Register + read back edges/meta/children in ONE request. */
+const registerSelect = (table) => `fn::query::register($config);\n${singleSnapshotSelect(table)}`;
+const registerVars = (payload) => ({
+	config: payload,
+	in: payload.id
+});
+/** One heartbeat statement per view id; result index i answers id i. */
+function heartbeatBatch(ids) {
+	const vars = {};
+	return {
+		sql: ids.map((id, i) => {
+			vars[`id${i}`] = id;
+			return `fn::query::heartbeat($id${i})`;
+		}).join(";\n"),
+		vars
+	};
+}
+/** A heartbeat answer whose statement matched no row: the view was reclaimed. */
+const heartbeatRowGone = (result) => Array.isArray(result) && result.length === 0;
+const QUERY_ID = /^_00_query:(?:[0-9a-f]{64}|⟨[0-9a-f]{64}⟩)$/;
+const SESSION_ID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+/**
+* The pagehide release: one bare statement for `beaconSql`, which has no params
+* channel, so ids are inlined. Only shapes the client minted itself get in, a
+* `_00_query:<sha256>` id and a UUID session id, so nothing else is ever
+* interpolated. `null` when there is nothing the server could act on: with no
+* session ids it could not tell this page's entries from anyone else's.
+*/
+function leaveViewsBeacon(ids, sessionIds) {
+	const list = ids.map((id) => String(id)).filter((id) => QUERY_ID.test(id));
+	const sids = sessionIds.filter((sid) => SESSION_ID.test(sid));
+	if (list.length === 0 || sids.length === 0) return null;
+	const sidList = sids.map((sid) => `'${sid}'`).join(", ");
+	return `FOR $id IN [${list.join(", ")}] { LET $_left = fn::query::leave($id, [${sidList}]); };`;
+}
+const bodySelect = () => "SELECT * FROM $ids";
+/** Local transaction that MERGEs many fetched bodies. */
+function upsertBodiesTx(records) {
+	const vars = {};
+	const stmts = records.map((r, i) => {
+		vars[`id${i}`] = r.id;
+		vars[`content${i}`] = r.content;
+		return surql.upsertMerge(`id${i}`, `content${i}`);
+	});
+	return {
+		query: surql.seal(surql.tx(stmts)),
+		vars
+	};
+}
+
+//#endregion
+//#region src/query/lifecycle.saga.ts
+/**
+* One tick for every query in state: evict the ones nobody has watched for a
+* ttl, heartbeat the rest in one request, notice reclaimed rows. Reschedules
+* itself at half the shortest ttl.
+*/
+function* lifecycleTick(env) {
+	const now = yield fx.now();
+	const state = yield fx.state.read((s) => s);
+	for (const hash of evictable(state, now)) yield* evictQuery(hash);
+	const remaining = yield fx.state.read((s) => [...s.queries.values()].filter((e) => e.lifecycle.remote === "registered"));
+	if (remaining.length > 0) {
+		const beat = heartbeatBatch(remaining.map((e) => e.def.id));
+		try {
+			const results = yield fx.remote.query(beat.sql, beat.vars, env.remoteTimeoutMs);
+			let reclaimed = 0;
+			for (let i = 0; i < remaining.length; i++) {
+				const r = results[i];
+				if (r?.status === "OK" && heartbeatRowGone(r.result)) {
+					reclaimed++;
+					yield fx.state.update(applyLifecycle(remaining[i].def.hash, { type: "remote-dropped" }));
+				}
+			}
+			yield fx.state.update(stampHeartbeat(remaining.map((e) => e.def.hash), now));
+			if (reclaimed > 0) {
+				yield fx.emit({
+					type: "log",
+					level: "warn",
+					message: "query rows reclaimed by the server; re-registering",
+					data: { reclaimed }
+				});
+				yield fx.dispatch({ type: "EnsureRegistered" });
+			}
+			yield fx.dispatch({
+				type: "SyncOutcome",
+				ok: true
+			});
+		} catch (error) {
+			yield fx.dispatch({
+				type: "SyncOutcome",
+				ok: false,
+				error
+			});
+		}
+	}
+	const ttl = yield fx.state.read((s) => shortestTtlMs(s));
+	yield fx.timer.set("lifecycle", Math.floor((ttl ?? env.defaultTtlMs) * TTL_HEARTBEAT_FRACTION), { type: "LifecycleTick" });
+}
+/** Free a query's local view and forget it. The server row expires by TTL. */
+function* evictQuery(hash) {
+	if (!(yield fx.state.read((s) => s.queries.has(hash)))) return;
+	try {
+		yield fx.ssp.unregister(hash);
+	} catch (error) {
+		yield fx.emit({
+			type: "log",
+			level: "debug",
+			message: "unregister failed",
+			data: {
+				hash,
+				error
+			}
+		});
+	}
+	yield fx.state.update(removeQuery(hash));
+	yield fx.emit({
+		type: "query:evicted",
+		hash
+	});
+}
+/** Drop acked outbox items membership never named within the grace window. */
+function* ackPrune() {
+	const now = yield fx.now();
+	yield fx.state.update(outboxPruneAcked(now, ACK_GRACE_MS));
+	if (yield fx.state.read((s) => s.outbox.some((i) => i.status === "acked"))) yield fx.timer.set("ack-prune", ACK_GRACE_MS, { type: "AckPrune" });
+}
+/** Every `_00_view` row, parsed. Throws when the read fails. */
+function* readViews() {
+	const res = yield fx.local.query(readViewRows());
+	return parseViewIndex(Array.isArray(res) ? res[0] : void 0);
+}
+const indexOf = (rows) => new Map(rows.map((r) => [r.key, r.ids]));
+/**
+* Load the durable view index (boot, bucket switch). A failed read leaves it
+* empty, which fails closed: cold scans paint nothing until the server answers.
+*/
+function* loadViews() {
+	try {
+		yield fx.state.update(reloadViews(indexOf(yield* readViews())));
+	} catch (error) {
+		yield fx.emit({
+			type: "log",
+			level: "warn",
+			message: "view index read failed",
+			data: { error }
+		});
+	}
+}
+const tableOf$1 = (id) => id.slice(0, id.indexOf(":"));
+/**
+* Orphan collection, `GC_BOOT_DELAY_MS` after boot and then every
+* `GC_INTERVAL_MS`. Re-reads every `_00_view` row into the index, retires the
+* rows no query has resolved for `VIEW_RETENTION_MS`, then deletes the bodies
+* nothing retains (see `retained`) from the store and the circuit, a chunk at
+* a time. Only a leader or solo tab deletes, and a leader relays the deletes
+* so followers drop the rows too; a follower only refreshes its index.
+*/
+function* gcTick() {
+	yield fx.state.wait((s) => s.primed);
+	try {
+		const rows = yield* readViews();
+		const [role, bucket, held] = yield fx.state.read((s) => [
+			s.tabRole,
+			s.bucketId,
+			new Set([...s.queries.values()].map((e) => e.def.viewKey))
+		]);
+		const now = yield fx.now();
+		const expired = role === "follower" ? [] : rows.filter((r) => !held.has(r.key) && now - r.updatedAt >= VIEW_RETENTION_MS);
+		const retired = /* @__PURE__ */ new Set();
+		for (let i = 0; i < expired.length; i += GC_CHUNK) {
+			const chunk = expired.slice(i, i + GC_CHUNK);
+			const settled = yield fx.all(chunk.map((r) => fx.local.delete(VIEW_TABLE, viewRecordId(r.key))));
+			chunk.forEach((r, j) => settled[j].ok && retired.add(r.key));
+		}
+		yield fx.state.update(reloadViews(indexOf(rows.filter((r) => !retired.has(r.key)))));
+		if (role === "follower") return;
+		const removed = yield* collectOrphans(bucket, role === "leader");
+		yield fx.emit({
+			type: "log",
+			level: "info",
+			message: "orphan gc done",
+			data: {
+				removed,
+				retiredViews: retired.size
+			}
+		});
+	} catch (error) {
+		yield fx.emit({
+			type: "log",
+			level: "warn",
+			message: "orphan gc failed",
+			data: { error }
+		});
+	} finally {
+		yield fx.timer.set("gc", GC_INTERVAL_MS, { type: "GcTick" });
+	}
+}
+/**
+* Forget rows the server just took out of `hash` (its membership or its
+* subquery children) when nothing live still holds them: delete the local
+* body and the in-browser circuit's copy, and re-render the query.
+*
+* Primary rows already stop rendering once they leave membership, but
+* subquery children are rendered from the local store (a thread's comments
+* are read back by the relation), so a comment deleted on another device
+* stayed on screen until the hourly GC or a reload. Only a leader or solo tab
+* deletes, and a leader relays it to its followers, as the GC does.
+*/
+function* forgetDeparted(hash, departed) {
+	if (departed.length === 0) return;
+	const [gone, role] = yield fx.state.read((s) => {
+		const held = activelyHeld(s);
+		return [departed.filter((id) => !id.startsWith("_00_") && s.versions.has(id) && !held.has(id)), s.tabRole];
+	});
+	if (gone.length === 0 || role === "follower") return;
+	const settled = yield fx.all(gone.map((id) => fx.local.delete(tableOf$1(id), id)));
+	const done = gone.filter((_, j) => settled[j].ok);
+	if (done.length === 0) return;
+	const records = done.map((id) => ({
+		table: tableOf$1(id),
+		op: "DELETE",
+		id,
+		record: {}
+	}));
+	yield fx.state.update(compose(deleteVersions(done), markDirty([hash])));
+	yield fx.ssp.ingest(records);
+	if (role === "leader") yield fx.emit({
+		type: "tabs:broadcast",
+		message: {
+			type: "ingest",
+			records
+		}
+	});
+}
+/**
+* Delete every body nothing retains, `GC_CHUNK` at a time. Each chunk is
+* re-checked against fresh state (a membership committed meanwhile may name
+* an id again) and the sweep stops if the bucket moved under it.
+*/
+function* collectOrphans(bucket, relay) {
+	const candidates = yield fx.state.read((s) => {
+		const keep = retained(s);
+		return [...s.versions.keys()].filter((id) => !keep(id));
+	});
+	let removed = 0;
+	for (let i = 0; i < candidates.length; i += GC_CHUNK) {
+		const chunk = yield fx.state.read((s) => {
+			if (!s.primed || s.bucketId !== bucket) return null;
+			const keep = retained(s);
+			return candidates.slice(i, i + GC_CHUNK).filter((id) => s.versions.has(id) && !keep(id));
+		});
+		if (chunk === null) break;
+		const settled = yield fx.all(chunk.map((id) => fx.local.delete(tableOf$1(id), id)));
+		const done = chunk.filter((_, j) => settled[j].ok);
+		if (done.length === 0) continue;
+		const records = done.map((id) => ({
+			table: tableOf$1(id),
+			op: "DELETE",
+			id,
+			record: {}
+		}));
+		yield fx.state.update(deleteVersions(done));
+		yield fx.ssp.ingest(records);
+		if (relay) yield fx.emit({
+			type: "tabs:broadcast",
+			message: {
+				type: "ingest",
+				records
+			}
+		});
+		removed += done.length;
+	}
+	if (removed > 0) yield fx.dispatch({ type: "FetchRows" });
+	return removed;
+}
+
 //#endregion
 //#region src/sync/policy.ts
 /** Known edges one poll round trip may carry before the cycle is split. */
@@ -4339,141 +4698,31 @@ function nextHealth(input, ok, error, degradeAfter) {
 	}
 	const consecutiveFailures = input.consecutiveFailures + 1;
 	const kind = classifySyncError(error);
-	const message = error instanceof Error ? error.message : String(error);
-	if (input.health.status !== "degraded" && consecutiveFailures >= degradeAfter) return {
-		...base,
-		consecutiveFailures,
-		health: {
-			...input.health,
-			status: "degraded",
-			consecutiveFailures,
-			kind,
-			error: message
-		},
-		degradedNow: true
-	};
-	return {
-		...base,
-		consecutiveFailures,
-		health: {
-			...input.health,
-			consecutiveFailures,
-			kind,
-			error: message
-		}
-	};
-}
-const selfHealDelayMs = (attempt) => Math.min(SELF_HEAL_MAX_MS, SELF_HEAL_BASE_MS * 2 ** Math.min(attempt, 30));
-
-//#endregion
-//#region src/query/sql.ts
-/** Every SurrealQL statement the query side sends, as pure builders. */
-const VIEW_TABLE = "_00_view";
-const LEGACY_VIEW_TABLE = "_00_window";
-const viewRecordId = (viewKey) => new RecordId$1(VIEW_TABLE, viewKey);
-/**
-* The durable `_00_view` row: the confirmed membership plus the subquery
-* children, which the GC must keep and a cold scan may paint as much as the
-* members.
-*/
-const viewRow = (ids, children, confirmed, now) => ({
-	ids,
-	children,
-	confirmed,
-	updatedAt: now
-});
-/** Every `_00_view` row: the durable view index and the GC read it. */
-const readViewRows = () => `SELECT * FROM ${VIEW_TABLE}`;
-/** Copy every legacy `_00_window` row into `_00_view` once. */
-const readLegacyViewRows = () => `SELECT * FROM ${LEGACY_VIEW_TABLE}`;
-const countViewRows = () => `SELECT count() FROM ${VIEW_TABLE} GROUP ALL`;
-const listRefSelect = (table) => `SELECT out, version FROM $in->${table} WHERE parent IS NONE`;
-const subqueryListRefSelect = (table) => `SELECT out, version FROM $in->${table} WHERE parent IS NOT NONE`;
-const queryRowCountSelect = () => "SELECT VALUE { rowCount: rowCount, state: state } FROM ONLY $in";
-const listRefBatchSelect = (table) => `SELECT in, out, version, parent FROM $ins->${table}`;
-const queryRowCountBatchSelect = () => "SELECT VALUE { id: id, rowCount: rowCount, state: state } FROM $ins";
-/** The single-query read: edges, meta, subquery children in one request. */
-const singleSnapshotSelect = (table) => `${listRefSelect(table)};\n${queryRowCountSelect()};\n${subqueryListRefSelect(table)}`;
-/** The many-query read: all edges + all metas in one request. */
-const batchSnapshotSelect = (table) => `${listRefBatchSelect(table)};\n${queryRowCountBatchSelect()}`;
-/**
-* The session's one LIVE subscription on its `_00_list_ref` table.
-*
-* `inlineBodies` adds `FETCH out`, which resolves the edge's target into the
-* notification so the body arrives with the doorbell.
-*
-* On the anon table it is filtered to this client's own edges. Every
-* signed-out session shares that table, so unfiltered each one received (and
-* the server fetched a body for) every anonymous edge change of every other
-* session, and the client then dropped all but its own. An edge carries the
-* `session::id()` of whichever socket last registered its view, which is a
-* socket of this client but not necessarily the current one: a view stays
-* registered across a reconnect, and a reload keeps its salt and its views,
-* so their older edges still name an earlier socket. `sessionIds` are those
-* earlier sockets. The current one is matched by `session::id()` itself,
-* which SurrealDB evaluates in the subscriber's own session, so the filter
-* holds before the client has learned its new id.
-*
-* The cast is load-bearing: `session::id()` is a uuid, `clientId` a string,
-* and without it nothing matches. Per-user tables need no filter.
-*/
-function listRefLive(table, opts) {
-	const join = opts.inlineBodies ? " FETCH out" : "";
-	if (table !== ANON_LIST_REF_TABLE) return { sql: `LIVE SELECT * FROM ${table}${join}` };
-	return {
-		sql: `LIVE SELECT * FROM ${table} WHERE clientId = <string>session::id() OR clientId IN $sids${join}`,
-		vars: { sids: [...opts.sessionIds] }
-	};
-}
-/** Register + read back edges/meta/children in ONE request. */
-const registerSelect = (table) => `fn::query::register($config);\n${singleSnapshotSelect(table)}`;
-const registerVars = (payload) => ({
-	config: payload,
-	in: payload.id
-});
-/** One heartbeat statement per view id; result index i answers id i. */
-function heartbeatBatch(ids) {
-	const vars = {};
-	return {
-		sql: ids.map((id, i) => {
-			vars[`id${i}`] = id;
-			return `fn::query::heartbeat($id${i})`;
-		}).join(";\n"),
-		vars
+	const message = error instanceof Error ? error.message : String(error);
+	if (input.health.status !== "degraded" && consecutiveFailures >= degradeAfter) return {
+		...base,
+		consecutiveFailures,
+		health: {
+			...input.health,
+			status: "degraded",
+			consecutiveFailures,
+			kind,
+			error: message
+		},
+		degradedNow: true
 	};
-}
-/** A heartbeat answer whose statement matched no row: the view was reclaimed. */
-const heartbeatRowGone = (result) => Array.isArray(result) && result.length === 0;
-const QUERY_ID = /^_00_query:(?:[0-9a-f]{64}|⟨[0-9a-f]{64}⟩)$/;
-const SESSION_ID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
-/**
-* The pagehide release: one bare statement for `beaconSql`, which has no params
-* channel, so ids are inlined. Only shapes the client minted itself get in, a
-* `_00_query:<sha256>` id and a UUID session id, so nothing else is ever
-* interpolated. `null` when there is nothing the server could act on: with no
-* session ids it could not tell this page's entries from anyone else's.
-*/
-function leaveViewsBeacon(ids, sessionIds) {
-	const list = ids.map((id) => String(id)).filter((id) => QUERY_ID.test(id));
-	const sids = sessionIds.filter((sid) => SESSION_ID.test(sid));
-	if (list.length === 0 || sids.length === 0) return null;
-	const sidList = sids.map((sid) => `'${sid}'`).join(", ");
-	return `FOR $id IN [${list.join(", ")}] { LET $_left = fn::query::leave($id, [${sidList}]); };`;
-}
-const bodySelect = () => "SELECT * FROM $ids";
-/** Local transaction that MERGEs many fetched bodies. */
-function upsertBodiesTx(records) {
-	const vars = {};
-	const stmts = records.map((r, i) => {
-		vars[`id${i}`] = r.id;
-		vars[`content${i}`] = r.content;
-		return surql.upsertMerge(`id${i}`, `content${i}`);
-	});
 	return {
-		query: surql.seal(surql.tx(stmts)),
-		vars
+		...base,
+		consecutiveFailures,
+		health: {
+			...input.health,
+			consecutiveFailures,
+			kind,
+			error: message
+		}
 	};
 }
+const selfHealDelayMs = (attempt) => Math.min(SELF_HEAL_MAX_MS, SELF_HEAL_BASE_MS * 2 ** Math.min(attempt, 30));
 
 //#endregion
 //#region src/query/membership.saga.ts
@@ -4530,6 +4779,7 @@ function* applyMembership(hash, remoteArray, meta, verifiedRemoval) {
 	}
 	const wasAuthoritative = isAuthoritative(entry.lifecycle);
 	yield fx.state.update(commitMembership(hash, remoteArray, meta?.present ?? true));
+	yield* forgetDeparted(hash, departedIds(entry.remoteArray, remoteArray));
 	if (!wasAuthoritative) yield fx.emit({
 		type: "query:authority",
 		hash,
@@ -4576,6 +4826,7 @@ function* applySubqueryChildren(hash, children) {
 	const entry = yield fx.state.read((s) => s.queries.get(hash));
 	if (!entry || recordVersionArraysEqual(entry.subqueryRemoteArray, children)) return;
 	yield fx.state.update(setSubqueryRemoteArray(hash, children));
+	yield* forgetDeparted(hash, departedIds(entry.subqueryRemoteArray, children));
 	if (entry.lifecycle.phase !== "cold") try {
 		yield fx.local.upsert(VIEW_TABLE, viewRecordId(entry.def.viewKey), { children }, "merge");
 	} catch (err) {
@@ -4949,196 +5200,6 @@ function* registerRemote(env, hash, retry = false) {
 	}
 }
 
-//#endregion
-//#region src/query/lifecycle.saga.ts
-/**
-* One tick for every query in state: evict the ones nobody has watched for a
-* ttl, heartbeat the rest in one request, notice reclaimed rows. Reschedules
-* itself at half the shortest ttl.
-*/
-function* lifecycleTick(env) {
-	const now = yield fx.now();
-	const state = yield fx.state.read((s) => s);
-	for (const hash of evictable(state, now)) yield* evictQuery(hash);
-	const remaining = yield fx.state.read((s) => [...s.queries.values()].filter((e) => e.lifecycle.remote === "registered"));
-	if (remaining.length > 0) {
-		const beat = heartbeatBatch(remaining.map((e) => e.def.id));
-		try {
-			const results = yield fx.remote.query(beat.sql, beat.vars, env.remoteTimeoutMs);
-			let reclaimed = 0;
-			for (let i = 0; i < remaining.length; i++) {
-				const r = results[i];
-				if (r?.status === "OK" && heartbeatRowGone(r.result)) {
-					reclaimed++;
-					yield fx.state.update(applyLifecycle(remaining[i].def.hash, { type: "remote-dropped" }));
-				}
-			}
-			yield fx.state.update(stampHeartbeat(remaining.map((e) => e.def.hash), now));
-			if (reclaimed > 0) {
-				yield fx.emit({
-					type: "log",
-					level: "warn",
-					message: "query rows reclaimed by the server; re-registering",
-					data: { reclaimed }
-				});
-				yield fx.dispatch({ type: "EnsureRegistered" });
-			}
-			yield fx.dispatch({
-				type: "SyncOutcome",
-				ok: true
-			});
-		} catch (error) {
-			yield fx.dispatch({
-				type: "SyncOutcome",
-				ok: false,
-				error
-			});
-		}
-	}
-	const ttl = yield fx.state.read((s) => shortestTtlMs(s));
-	yield fx.timer.set("lifecycle", Math.floor((ttl ?? env.defaultTtlMs) * TTL_HEARTBEAT_FRACTION), { type: "LifecycleTick" });
-}
-/** Free a query's local view and forget it. The server row expires by TTL. */
-function* evictQuery(hash) {
-	if (!(yield fx.state.read((s) => s.queries.has(hash)))) return;
-	try {
-		yield fx.ssp.unregister(hash);
-	} catch (error) {
-		yield fx.emit({
-			type: "log",
-			level: "debug",
-			message: "unregister failed",
-			data: {
-				hash,
-				error
-			}
-		});
-	}
-	yield fx.state.update(removeQuery(hash));
-	yield fx.emit({
-		type: "query:evicted",
-		hash
-	});
-}
-/** Drop acked outbox items membership never named within the grace window. */
-function* ackPrune() {
-	const now = yield fx.now();
-	yield fx.state.update(outboxPruneAcked(now, ACK_GRACE_MS));
-	if (yield fx.state.read((s) => s.outbox.some((i) => i.status === "acked"))) yield fx.timer.set("ack-prune", ACK_GRACE_MS, { type: "AckPrune" });
-}
-/** Every `_00_view` row, parsed. Throws when the read fails. */
-function* readViews() {
-	const res = yield fx.local.query(readViewRows());
-	return parseViewIndex(Array.isArray(res) ? res[0] : void 0);
-}
-const indexOf = (rows) => new Map(rows.map((r) => [r.key, r.ids]));
-/**
-* Load the durable view index (boot, bucket switch). A failed read leaves it
-* empty, which fails closed: cold scans paint nothing until the server answers.
-*/
-function* loadViews() {
-	try {
-		yield fx.state.update(reloadViews(indexOf(yield* readViews())));
-	} catch (error) {
-		yield fx.emit({
-			type: "log",
-			level: "warn",
-			message: "view index read failed",
-			data: { error }
-		});
-	}
-}
-const tableOf$1 = (id) => id.slice(0, id.indexOf(":"));
-/**
-* Orphan collection, `GC_BOOT_DELAY_MS` after boot and then every
-* `GC_INTERVAL_MS`. Re-reads every `_00_view` row into the index, retires the
-* rows no query has resolved for `VIEW_RETENTION_MS`, then deletes the bodies
-* nothing retains (see `retained`) from the store and the circuit, a chunk at
-* a time. Only a leader or solo tab deletes, and a leader relays the deletes
-* so followers drop the rows too; a follower only refreshes its index.
-*/
-function* gcTick() {
-	yield fx.state.wait((s) => s.primed);
-	try {
-		const rows = yield* readViews();
-		const [role, bucket, held] = yield fx.state.read((s) => [
-			s.tabRole,
-			s.bucketId,
-			new Set([...s.queries.values()].map((e) => e.def.viewKey))
-		]);
-		const now = yield fx.now();
-		const expired = role === "follower" ? [] : rows.filter((r) => !held.has(r.key) && now - r.updatedAt >= VIEW_RETENTION_MS);
-		const retired = /* @__PURE__ */ new Set();
-		for (let i = 0; i < expired.length; i += GC_CHUNK) {
-			const chunk = expired.slice(i, i + GC_CHUNK);
-			const settled = yield fx.all(chunk.map((r) => fx.local.delete(VIEW_TABLE, viewRecordId(r.key))));
-			chunk.forEach((r, j) => settled[j].ok && retired.add(r.key));
-		}
-		yield fx.state.update(reloadViews(indexOf(rows.filter((r) => !retired.has(r.key)))));
-		if (role === "follower") return;
-		const removed = yield* collectOrphans(bucket, role === "leader");
-		yield fx.emit({
-			type: "log",
-			level: "info",
-			message: "orphan gc done",
-			data: {
-				removed,
-				retiredViews: retired.size
-			}
-		});
-	} catch (error) {
-		yield fx.emit({
-			type: "log",
-			level: "warn",
-			message: "orphan gc failed",
-			data: { error }
-		});
-	} finally {
-		yield fx.timer.set("gc", GC_INTERVAL_MS, { type: "GcTick" });
-	}
-}
-/**
-* Delete every body nothing retains, `GC_CHUNK` at a time. Each chunk is
-* re-checked against fresh state (a membership committed meanwhile may name
-* an id again) and the sweep stops if the bucket moved under it.
-*/
-function* collectOrphans(bucket, relay) {
-	const candidates = yield fx.state.read((s) => {
-		const keep = retained(s);
-		return [...s.versions.keys()].filter((id) => !keep(id));
-	});
-	let removed = 0;
-	for (let i = 0; i < candidates.length; i += GC_CHUNK) {
-		const chunk = yield fx.state.read((s) => {
-			if (!s.primed || s.bucketId !== bucket) return null;
-			const keep = retained(s);
-			return candidates.slice(i, i + GC_CHUNK).filter((id) => s.versions.has(id) && !keep(id));
-		});
-		if (chunk === null) break;
-		const settled = yield fx.all(chunk.map((id) => fx.local.delete(tableOf$1(id), id)));
-		const done = chunk.filter((_, j) => settled[j].ok);
-		if (done.length === 0) continue;
-		const records = done.map((id) => ({
-			table: tableOf$1(id),
-			op: "DELETE",
-			id,
-			record: {}
-		}));
-		yield fx.state.update(deleteVersions(done));
-		yield fx.ssp.ingest(records);
-		if (relay) yield fx.emit({
-			type: "tabs:broadcast",
-			message: {
-				type: "ingest",
-				records
-			}
-		});
-		removed += done.length;
-	}
-	if (removed > 0) yield fx.dispatch({ type: "FetchRows" });
-	return removed;
-}
-
 //#endregion
 //#region src/mutation/write.saga.ts
 const debounceKey = (input) => {
@@ -6307,7 +6368,17 @@ function renderIdSetSelect(surql, kw, idsParam) {
 		].filter((n) => n !== null && n > orderByIndex);
 		orderBy = " " + surql.slice(orderByIndex, Math.min(...ends)).trim();
 	}
-	return `${selectClause} FROM $${idsParam}${orderBy}`;
+	return `${selectClause} FROM ${idSetSource(selectClause, idsParam, orderBy !== "")}${orderBy}`;
+}
+/**
+* The FROM source for an id-set read. The in-browser SurrealDB (wasm, 3.x)
+* reads bare record ids without loading them: a field list over them throws
+* ("Specify a database to use") and an ORDER BY is silently ignored, while a
+* plain `SELECT *` works. Those read from `(SELECT * FROM $ids)` instead, the
+* same rows as documents. The SQLite translator accepts both shapes.
+*/
+function idSetSource(selectClause, idsParam, ordered = false) {
+	return !ordered && /^SELECT\s+(VALUE\s+)?\*/i.test(selectClause.trim()) ? `$${idsParam}` : `(SELECT * FROM $${idsParam})`;
 }
 /**
 * Restrict any plan's base rows to an explicit id-set, regardless of offset.
@@ -7777,6 +7848,15 @@ var AbstractDatabaseService = class {
 		if (next) next();
 	}
 	/**
+	* Resolve once every statement issued before this call has settled: take
+	* every slot (FIFO, so earlier statements go first), then hand them back.
+	* Bounded by {@link queryTimeoutMs}, like the statements it waits on.
+	*/
+	async drainStatements() {
+		for (let i = 0; i < this.maxConcurrentQueries; i++) await this.acquireQuerySlot();
+		for (let i = 0; i < this.maxConcurrentQueries; i++) this.releaseQuerySlot();
+	}
+	/**
 	* Hook run right before a statement is sent, inside its slot. The remote
 	* service uses it to hold statements while a connect is in flight, so a
 	* query never runs on a socket that is open but has not had its namespace
@@ -7989,6 +8069,8 @@ var LocalDatabaseService = class extends AbstractDatabaseService {
 	gate = Promise.resolve();
 	/** The incoming client while a switch is in flight (for unload cleanup). */
 	pendingSwitchClient = null;
+	/** The open `connect()` started, until it settles. */
+	opening = null;
 	constructor(config, logger) {
 		const events = createDatabaseEventSystem();
 		super(createBareSurrealClient(), logger, events);
@@ -8036,6 +8118,15 @@ var LocalDatabaseService = class extends AbstractDatabaseService {
 		return super.query(query, vars);
 	}
 	async connect(bucketId = ANON_USER_ID) {
+		const opening = this.openBucket(bucketId);
+		this.opening = opening;
+		try {
+			await opening;
+		} finally {
+			if (this.opening === opening) this.opening = null;
+		}
+	}
+	async openBucket(bucketId) {
 		const { namespace, database } = this.getConfig();
 		const store = this.getConfig().store ?? "memory";
 		this.bucketId = bucketId;
@@ -8058,14 +8149,20 @@ var LocalDatabaseService = class extends AbstractDatabaseService {
 	* async chains can detect they're stale.
 	*
 	* Callers own the drain/rebind choreography (close the gate, quiesce sync +
-	* timers BEFORE calling this; re-provision + rebind AFTER).
+	* timers BEFORE calling this; re-provision + rebind AFTER). Statements that
+	* passed the gate before it closed are let finish before the old client
+	* closes: the engine streams results from its worker, and a client closed
+	* under a statement leaves that statement pending until its deadline, with
+	* every later local statement queued behind it.
 	*/
 	async switchStore(bucketId) {
+		if (this.opening) await this.opening.catch(() => {});
 		if (bucketId === this.bucketId) return;
 		const { namespace, database } = this.getConfig();
 		const store = this.getConfig().store ?? "memory";
 		this.storeEpoch++;
 		if (store === "memory") {
+			await this.drainStatements();
 			try {
 				await this.client.close();
 			} catch {}
@@ -8084,6 +8181,7 @@ var LocalDatabaseService = class extends AbstractDatabaseService {
 		} finally {
 			this.pendingSwitchClient = null;
 		}
+		await this.drainStatements();
 		const old = this.client;
 		this.client = next;
 		this.bucketId = bucketId;
@@ -9130,7 +9228,7 @@ var SurrealCacheEngine = class extends LocalDatabaseService {
 	}
 	async selectByIds(table, ids, opts) {
 		if (ids.length === 0) return [];
-		let sql = `SELECT ${opts?.select && opts.select.length > 0 ? ["id", ...opts.select].join(", ") : "*"} FROM $__ids`;
+		let sql = `SELECT ${opts?.select && opts.select.length > 0 ? ["id", ...opts.select].join(", ") : "*"} FROM (SELECT * FROM $__ids)`;
 		if (opts?.orderBy && opts.orderBy.length > 0) sql += ` ORDER BY ${opts.orderBy.map(([f, d]) => `${f} ${d}`).join(", ")}`;
 		const [rows] = await this.query(`${sql};`, { __ids: ids });
 		const result = rows ?? [];
@@ -9305,12 +9403,12 @@ function translateStatement(stmt, vars) {
 			value
 		};
 	}
-	m = /^SELECT\s+(VALUE\s+)?(.+?)\s+FROM\s+\$(\w+)$/i.exec(head);
+	m = /^SELECT\s+(VALUE\s+)?(.+?)\s+FROM\s+(?:\$(\w+)|\(\s*SELECT\s+\*\s+FROM\s+\$(\w+)\s*\))$/i.exec(head);
 	if (m) {
 		const value = m[1] ? m[2].trim() : void 0;
 		return {
 			kind: "selectByIds",
-			ids: vars[m[3]] ?? [],
+			ids: vars[m[3] ?? m[4]] ?? [],
 			select: projFields(m[2], !!m[1]),
 			value,
 			limit,
@@ -11784,9 +11882,10 @@ var AuthService = class {
 	/**
 	* Subscribe to auth state changes.
 	* callback is called immediately with current value and whenever validation status changes.
+	* `immediate: false` skips that first call: only changes are reported.
 	*/
-	subscribe(cb) {
-		cb(this.announcedUserId());
+	subscribe(cb, opts = {}) {
+		if (opts.immediate !== false) cb(this.announcedUserId());
 		const id = this.events.subscribe(AuthEventTypes.AuthStateChanged, (event) => {
 			cb(event.payload);
 		});
@@ -12483,14 +12582,17 @@ const MAX_WAIT_MS = 2e3;
 const PERSIST_DEBOUNCE_MS = 400;
 const PRESENCE_THROTTLE_MS = 250;
 const CLAIM_RETRY_MS = 5e3;
-/** How long an open of a field with nothing local waits for the server's
-*  first answer before handing out the (still empty) document. */
-const FIRST_ANSWER_TIMEOUT_MS = 4e3;
+/** Longest an open or close waits on the server (the first answer for a
+*  field with nothing local, the last edits going out) before going on
+*  without it. Offline it does not wait at all. */
+const SERVER_WAIT_MS = 4e3;
 /** Pause after a fold is noticed before checking the published document. */
 const VERIFY_DELAY_MS = 1e3;
 var CrdtManager = class {
 	sessions = /* @__PURE__ */ new Map();
 	opening = /* @__PURE__ */ new Map();
+	/** Closes still saving their field's local state, by session key. */
+	saving = /* @__PURE__ */ new Map();
 	ports = null;
 	logger;
 	peer = randomPeer();
@@ -12546,7 +12648,7 @@ var CrdtManager = class {
 				session = await inFlight;
 				session.refs++;
 			} else {
-				const pending = this.start(key, table, recordId, field, kind, cursor).finally(() => this.opening.delete(key));
+				const pending = this.start(key, table, recordId, field, kind, cursor, !!draft).finally(() => this.opening.delete(key));
 				this.opening.set(key, pending);
 				session = await pending;
 			}
@@ -12572,7 +12674,8 @@ var CrdtManager = class {
 		this.scheduleFlush(s, 0);
 	}
 	/** Close one open. The last close of a field resolves once its unsent
-	*  edits are in the outbox (or are left for a later session, offline). */
+	*  edits are in the outbox, or once they are saved on the device when the
+	*  server does not answer in time (offline: at once). */
 	close(table, recordId, field) {
 		const s = this.sessions.get(`${table}|${recordId}|${field}`);
 		if (!s || --s.refs > 0) return Promise.resolve();
@@ -12595,10 +12698,11 @@ var CrdtManager = class {
 			cursor: !!col.cursor
 		};
 	}
-	async start(key, table, recordId, field, kind, cursor) {
+	async start(key, table, recordId, field, kind, cursor, fresh = false) {
 		if (!this.ports) throw new Error("CrdtManager: not attached to a client");
 		const doc = new (await (loadLoro())).LoroDoc();
 		doc.setPeerId(this.peer);
+		await this.saving.get(key);
 		const local = await this.readLocal(recordId, field);
 		if (local.snapshot) this.tryImport(doc, local.snapshot, key);
 		const session = {
@@ -12630,7 +12734,7 @@ var CrdtManager = class {
 		session.handle = new CrdtField(table, recordId, field, kind, cursor, doc, { pushPresence: (state) => this.pushPresence(session, state) });
 		this.sessions.set(key, session);
 		this.ensureClaimed();
-		if (!local.snapshot) await this.refetchCanonical(session);
+		if (!local.snapshot && !fresh) await this.serverWait(this.refetchCanonical(session));
 		session.disposers.push(doc.subscribeLocalUpdates(() => {
 			session.local.peers[this.peer] ??= { enqueued: 0 };
 			this.scheduleFlush(session);
@@ -12651,7 +12755,7 @@ var CrdtManager = class {
 			}, (rows) => this.ingestPresence(session, rows));
 			session.disposers.push(presence.stop);
 		}
-		if (!session.handle.hasContent()) await Promise.race([log.settled, delay(FIRST_ANSWER_TIMEOUT_MS)]);
+		if (!session.handle.hasContent() && !fresh) await this.serverWait(log.settled);
 		await session.ingesting;
 		this.scheduleFlush(session, 0);
 		this.logger.debug({
@@ -12672,10 +12776,23 @@ var CrdtManager = class {
 		if (s.verifyTimer) clearTimeout(s.verifyTimer);
 		if (s.presenceSent) this.dropPresence(s);
 		if (flush) {
-			await this.persist(s);
-			await this.flush(s);
+			const saved = this.persist(s);
+			this.saving.set(s.key, saved);
+			await saved;
+			if (this.saving.get(s.key) === saved) this.saving.delete(s.key);
+			await this.serverWait(this.flush(s));
 		}
 	}
+	/**
+	* Wait for server-bound `work`, at most {@link SERVER_WAIT_MS}, and not at
+	* all while disconnected: a remote call made then queues behind the
+	* reconnect for up to the query timeout, and an offline "new thread" form
+	* must not hang on it. The work itself goes on either way.
+	*/
+	serverWait(work) {
+		if (this.remote.getStatus() !== "connected") return Promise.resolve();
+		return Promise.race([work, delay(SERVER_WAIT_MS)]);
+	}
 	async ingest(s, rows) {
 		const loro = await loadLoro();
 		const ids = new Set(rows.map((row) => String(row.id ?? "")));
@@ -15275,7 +15392,7 @@ function createTabsCoordinator(config, s, host) {
 	return new TabsCoordinator({
 		tabId: s.tabId,
 		fingerprint: computeTabsFingerprint({
-			coreVersion: "0.0.1-canary.326",
+			coreVersion: "0.0.1-canary.328",
 			schemaHash: hash53(config.schemaSurql),
 			endpoint: config.database.endpoint ?? "",
 			namespace: config.database.namespace,
@@ -16045,7 +16162,7 @@ var Sp00kyClient = class {
 		s.auth.subscribe((userId) => void this.runtime.dispatch({
 			type: "AuthFlip",
 			userId
-		}));
+		}), { immediate: false });
 		this.impersonationBanner = new ImpersonationBanner(() => s.auth.stopImpersonating(), this.config.impersonationBanner);
 		const banner = this.impersonationBanner;
 		this.disposers.push(s.auth.subscribeImpersonation((info) => banner.update(info)), () => banner.unmount());
@@ -16381,7 +16498,7 @@ var Sp00kyClient = class {
 		return this.services.crdt.createDraft(table, field);
 	}
 	/** Close a `@crdt` field. The last close resolves once its unsent edits
-	*  are queued in the outbox. */
+	*  are queued in the outbox; offline, once they are saved on the device. */
 	closeCrdtField(table, recordId, field) {
 		return this.services.crdt.close(table, recordId, field);
 	}