@spooky-sync/core 0.0.1-canary.333 → 0.0.1-canary.334

package/dist/index.d.ts

@@ -1055,6 +1055,17 @@ type OutEvent = {
  * behind `status: 'fetching'`, `notified` says whether subscribers received
  * at least one materialization this registration.
  *
+ * `answered` says subscribers have been handed the rows of a known membership
+ * (the server's, or the durable one of an earlier session) at least once:
+ * a materialization ran past `cold`, with no body of a server set still to
+ * download, and the membership it drew was still the one in state when it
+ * committed. Only a re-seed (a new entry, a bucket switch) clears it, so a
+ * reconnect or a lost view does not send a painted query back to loading.
+ * It is what the bindings' `isAuthoritative()` mirrors (see `isAnswered`):
+ * a `cached` seed or a freshly applied server set alone is not enough,
+ * because `records` is still empty (or stale) until `materialize` paints, and
+ * "known and empty" read in that beat made apps create rows that existed.
+ *
  * `backgroundDepth` is the part of `fetchDepth` that re-verifies rows the
  * query already shows: a registration of a query that is not `cold`. It still
  * holds `status: 'fetching'` (results are not yet confirmed), but it is not
@@ -1068,6 +1079,7 @@ interface QueryLifecycle {
   readonly fetchDepth: number;
   readonly backgroundDepth: number;
   readonly notified: boolean;
+  readonly answered: boolean;
 }
 //#endregion
 //#region src/kernel/effects.d.ts

package/dist/index.js

@@ -2198,8 +2198,8 @@ function trimHistory(history, cap) {
 
 //#endregion
 //#region src/modules/devtools/index.ts
-const CORE_VERSION = "0.0.1-canary.333";
-const WASM_VERSION = "0.0.1-canary.333";
+const CORE_VERSION = "0.0.1-canary.334";
+const WASM_VERSION = "0.0.1-canary.334";
 const SURREAL_VERSION = "3.1.0";
 var DevToolsService = class DevToolsService {
 	version = CORE_VERSION;
@@ -2338,7 +2338,7 @@ var DevToolsService = class DevToolsService {
 				remoteIds: remoteArray.slice(0, DevToolsService.STATE_IDS_CAP).map(([id]) => id),
 				idsTruncated: localArray.length > DevToolsService.STATE_IDS_CAP || remoteArray.length > DevToolsService.STATE_IDS_CAP,
 				membershipKnown: q.config.membershipKnown === true,
-				authoritative: q.config.membershipKnown === true,
+				authoritative: q.answered === true,
 				viewLost: q.viewLost === true,
 				serverState: q.serverState ?? null,
 				timings: this.dataManager.phaseTimings(q)
@@ -2931,7 +2931,8 @@ function seedLifecycle(resolvedBefore) {
 		remote: "unregistered",
 		fetchDepth: 0,
 		backgroundDepth: 0,
-		notified: false
+		notified: false,
+		answered: false
 	};
 }
 /** Total on every (lifecycle, event) pair the sagas can produce; throws on the rest. */
@@ -2980,17 +2981,27 @@ function transition(l, ev) {
 				backgroundDepth
 			};
 		}
-		case "notified": return l.notified ? l : {
-			...l,
-			notified: true
-		};
+		case "notified": {
+			const answered = l.answered || ev.answered === true && l.phase !== "cold";
+			return l.notified && answered === l.answered ? l : {
+				...l,
+				notified: true,
+				answered
+			};
+		}
 		case "bucket-switch": return {
 			...seedLifecycle(ev.resolvedBefore),
 			fetchDepth: 0
 		};
 	}
 }
+/** Membership is known (server set or durable seed); its rows may not be painted yet. */
 const isAuthoritative = (l) => l.phase !== "cold";
+/**
+* Subscribers hold the rows of a known membership: what the authority channel
+* (`subscribeQueryAuthority`, the bindings' `isAuthoritative()`) reports.
+*/
+const isAnswered = (l) => l.answered;
 const hasServerMembership = (l) => l.phase === "live" || l.phase === "view-lost";
 const deriveStatus = (l) => l.fetchDepth > 0 ? "fetching" : "idle";
 /** A fetch cycle the user is waiting on: rows to download, or a first registration. */
@@ -3208,7 +3219,12 @@ const setSubqueryRemoteArray = (hash, subqueryRemoteArray) => (s) => {
 	if (!entry || entry.lifecycle.phase === "cold") return next;
 	return withView(next, entry.def.viewKey, vouchedIds(entry.remoteArray, subqueryRemoteArray));
 };
-const setRecords = (hash, records, changed, materializeMs) => (s) => {
+/**
+* Commit a materialization. `answered`: it drew a known membership with no
+* body still to download, and that membership is still current (see
+* `QueryLifecycle`).
+*/
+const setRecords = (hash, records, changed, materializeMs, answered = false) => (s) => {
 	const next = withEntry(s, hash, (e) => {
 		const prev = e.telemetry.phaseSamples.localFetch ?? [];
 		const telemetry = {
@@ -3227,7 +3243,10 @@ const setRecords = (hash, records, changed, materializeMs) => (s) => {
 			...e,
 			records: changed ? records : e.records,
 			telemetry,
-			lifecycle: transition(e.lifecycle, { type: "notified" })
+			lifecycle: transition(e.lifecycle, {
+				type: "notified",
+				answered
+			})
 		};
 	});
 	return next === s ? s : {
@@ -3484,7 +3503,13 @@ const setIdentity = (patch) => (s) => ({
 	...s,
 	...patch
 });
-/** Re-home a query after a bucket switch: new store, same hash, fresh sync state. */
+/**
+* Re-home a query after a bucket switch: new store, same hash, fresh sync state.
+* `records` is kept: it is what subscribers were last handed, and the next
+* render diffs against it. Blanking it here (without telling anyone) let a
+* new store that renders `[]` read as unchanged, so the previous principal's
+* rows stayed on screen under an authority flip that vouched for them.
+*/
 const rebindQuery = (hash, next) => (s) => {
 	const rebound = withEntry(s, hash, (e) => ({
 		...e,
@@ -3496,7 +3521,6 @@ const rebindQuery = (hash, next) => (s) => {
 		remoteArray: next.remoteArray,
 		localArray: next.localArray,
 		subqueryRemoteArray: [],
-		records: [],
 		serverState: null,
 		lastHeartbeatAt: null,
 		lastPolledAt: null,
@@ -3729,6 +3753,7 @@ function toQueryState(e) {
 		viewLost: l.phase === "view-lost",
 		serverState: e.serverState,
 		syncNotified: l.notified,
+		answered: l.answered,
 		ttlTimer: null,
 		ttlDurationMs: e.def.ttlMs,
 		lastHeartbeatAt: e.lastHeartbeatAt ?? void 0,
@@ -4820,14 +4845,8 @@ function* applyMembership(hash, remoteArray, meta, verifiedRemoval) {
 		});
 		return outcome;
 	}
-	const wasAuthoritative = isAuthoritative(entry.lifecycle);
 	yield fx.state.update(commitMembership(hash, remoteArray, meta?.present ?? true));
 	yield* forgetDeparted(hash, departedIds(entry.remoteArray, remoteArray));
-	if (!wasAuthoritative) yield fx.emit({
-		type: "query:authority",
-		hash,
-		known: true
-	});
 	const now = yield fx.now();
 	try {
 		yield fx.local.upsert(VIEW_TABLE, viewRecordId(entry.def.viewKey), viewRow(remoteArray, entry.subqueryRemoteArray, true, now), "replace");
@@ -6671,14 +6690,18 @@ const NONE = /* @__PURE__ */ new Set();
 * only writer of `records`. Runs on the `mat:<hash>` dedupe lane whenever the
 * query is dirty. Before the server has answered (`cold`) only bodies some
 * durable view vouches for paint (see `paintsCold`).
+*
+* Also the only place a query becomes answered (see `QueryLifecycle`): the
+* authority flip is emitted here, after the rows it vouches for.
 */
 function* materialize(hash) {
-	const [entry, ov, known] = yield fx.state.read((s) => {
+	const [entry, ov, known, complete] = yield fx.state.read((s) => {
 		const e = s.queries.get(hash);
 		return [
 			e,
 			overlay(s),
-			e?.lifecycle.phase === "cold" ? vouched(s) : NONE
+			e?.lifecycle.phase === "cold" ? vouched(s) : NONE,
+			needed(s, hash).length === 0
 		];
 	});
 	if (!entry) return;
@@ -6718,12 +6741,18 @@ function* materialize(hash) {
 	if (!current) return;
 	const t1 = yield fx.now();
 	const changed = !rowsEqual(rows, current.records);
-	yield fx.state.update(compose(setRecords(hash, rows, changed, t1 - t0), changed ? stampUpdated(hash, t1) : (s) => s));
+	const answered = complete && entry.lifecycle.phase !== "cold" && current.lifecycle.phase !== "cold" && current.remoteArray === entry.remoteArray;
+	yield fx.state.update(compose(setRecords(hash, rows, changed, t1 - t0, answered), changed ? stampUpdated(hash, t1) : (s) => s));
 	if (changed) yield fx.emit({
 		type: "query:records",
 		hash,
 		records: rows
 	});
+	if (answered && !isAnswered(current.lifecycle)) yield fx.emit({
+		type: "query:authority",
+		hash,
+		known: true
+	});
 }
 /**
 * A view update from the in-browser SSP: the query's local id-set moved.
@@ -7206,10 +7235,10 @@ function* rebindQueries() {
 			remoteArray: view?.ids ?? [],
 			localArray
 		}));
-		if (isAuthoritative(entry.lifecycle) !== isAuthoritative(lifecycle)) yield fx.emit({
+		if (isAnswered(entry.lifecycle)) yield fx.emit({
 			type: "query:authority",
 			hash: entry.def.hash,
-			known: isAuthoritative(lifecycle)
+			known: false
 		});
 	}
 }
@@ -7688,7 +7717,7 @@ var Runtime = class {
 		this.authoritySubs.set(hash, set);
 		if (options.immediate) {
 			const entry = this.stateValue.queries.get(hash);
-			if (entry) this.safely(() => cb(isAuthoritative(entry.lifecycle)));
+			if (entry) this.safely(() => cb(isAnswered(entry.lifecycle)));
 		}
 		return () => {
 			set.delete(cb);
@@ -15745,7 +15774,7 @@ function createTabsCoordinator(config, s, host) {
 	return new TabsCoordinator({
 		tabId: s.tabId,
 		fingerprint: computeTabsFingerprint({
-			coreVersion: "0.0.1-canary.333",
+			coreVersion: "0.0.1-canary.334",
 			schemaHash: hash53(config.schemaSurql),
 			endpoint: config.database.endpoint ?? "",
 			namespace: config.database.namespace,

package/dist/types.d.ts

@@ -2069,6 +2069,12 @@ interface QueryState {
    * always emits at least once even when its records are unchanged — otherwise
    * an empty re-registered window would never notify and stay "loading". */
   syncNotified?: boolean;
+  /**
+   * Subscribers hold the rows of a known membership (see `QueryLifecycle`'s
+   * `answered`): what the authority channel and the bindings'
+   * `isAuthoritative()` report. Ephemeral.
+   */
+  answered?: boolean;
   /** Timer for TTL expiration. */
   ttlTimer: NodeJS.Timeout | null;
   /** TTL duration in milliseconds. */
@@ -2147,9 +2153,12 @@ interface QueryTimings {
 type QueryUpdateCallback = (records: Record<string, any>[]) => void;
 type QueryStatusCallback = (status: QueryStatus) => void;
 /**
- * Observer for a query's authority flips: `true` once server membership is
- * known for it (registration, poll, durable seed), `false` when it is reset
- * (bucket switch). What the bindings' `isAuthoritative()` mirrors.
+ * Observer for a query's authority flips: `true` once subscribers hold the
+ * rendered rows of a known membership (a server answer whose bodies are
+ * local, or the durable membership of an earlier session), delivered after
+ * the rows that vouch for it; `false` when it is reset (bucket switch). Knowing the set is
+ * not enough: a `cached` re-seed or a just-applied server set has no rows
+ * painted yet. What the bindings' `isAuthoritative()` mirrors.
  */
 type QueryAuthorityCallback = (known: boolean) => void;
 type MutationCallback = (mutations: MutationEvent[]) => void;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@spooky-sync/core",
-  "version": "0.0.1-canary.333",
+  "version": "0.0.1-canary.334",
   "type": "module",
   "sideEffects": false,
   "main": "./dist/index.js",
@@ -75,8 +75,8 @@
     }
   },
   "dependencies": {
-    "@spooky-sync/query-builder": "0.0.1-canary.333",
-    "@spooky-sync/ssp-wasm": "0.0.1-canary.333",
+    "@spooky-sync/query-builder": "0.0.1-canary.334",
+    "@spooky-sync/ssp-wasm": "0.0.1-canary.334",
     "@sqlite.org/sqlite-wasm": "3.53.0-build1",
     "@surrealdb/wasm": "^3.1.0",
     "@surrealdb/wasm-native": "^3.3.4",

package/src/boot/bucket-switch.saga.test.ts

@@ -158,9 +158,9 @@ describe('dropImpersonatedBucket', () => {
 });
 
 describe('rebindQueries', () => {
-  it('re-seeds from the new store, rebuilds the local view (tolerating failures), emits authority flips', async () => {
+  it('re-seeds from the new store, rebuilds the local view (tolerating failures), withdraws authority it held', async () => {
     const s = R.compose(
-      R.putQuery(buildEntry({ def: { hash: 'a' }, lifecycle: { phase: 'live' } })),
+      R.putQuery(buildEntry({ def: { hash: 'a' }, lifecycle: { phase: 'live', answered: true }, records: [{ id: 't:9' }] })),
       R.putQuery(buildEntry({ def: { hash: 'b' }, lifecycle: { phase: 'cold' } }))
     )({ ...buildState(), sessionId: 's' });
     const out = await runPure(rebindQueries(), {
@@ -177,11 +177,13 @@ describe('rebindQueries', () => {
       },
     });
     expect(out.state.queries.get('a')!.lifecycle.phase).toBe('cold');
-    expect(out.state.queries.get('b')!.lifecycle.phase).toBe('cached');
-    expect(out.emitted.filter((e) => e.type === 'query:authority')).toEqual([
-      { type: 'query:authority', hash: 'a', known: false },
-      { type: 'query:authority', hash: 'b', known: true },
-    ]);
+    expect(out.state.queries.get('b')!.lifecycle).toMatchObject({ phase: 'cached', answered: false });
+    // `b` found a durable view, but its rows are not painted until the
+    // render: announcing "known" here is what let an app read the empty
+    // `records` of a re-seed as "the user has none" and create a duplicate.
+    expect(out.emitted.filter((e) => e.type === 'query:authority')).toEqual([{ type: 'query:authority', hash: 'a', known: false }]);
+    expect(out.state.queries.get('a')!.records).toEqual([{ id: 't:9' }]);
+    expect([...out.state.dirty].sort()).toEqual(['a', 'b']);
     expect(out.emitted.some((e) => e.type === 'log')).toBe(true);
   });
 });

package/src/boot/bucket-switch.saga.ts

@@ -3,7 +3,7 @@ import type { Saga } from '../kernel/saga';
 import type { RegisterResult } from '../kernel/effects';
 import { fx } from '../kernel/effects';
 import type { ClientState, QueryEntry } from '../state/client-state';
-import { seedLifecycle, isAuthoritative } from '../state/lifecycle';
+import { seedLifecycle, isAnswered } from '../state/lifecycle';
 import * as R from '../state/reducers';
 import { ANON_USER_ID, bucketIdForUser } from '../modules/ref-tables';
 import type { SagaEnv } from '../query/env';
@@ -126,8 +126,11 @@ export function* rebindQueries(): Saga<void> {
     }
     const lifecycle = seedLifecycle(isResolvedBefore(view));
     yield fx.state.update(R.rebindQuery(entry.def.hash, { id: new RecordId('_00_query', hash), lifecycle, remoteArray: view?.ids ?? [], localArray }));
-    if (isAuthoritative(entry.lifecycle) !== isAuthoritative(lifecycle)) {
-      yield fx.emit({ type: 'query:authority', hash: entry.def.hash, known: isAuthoritative(lifecycle) });
+    // A re-seed is never answered, not even from a durable view: subscribers
+    // still hold the previous store's rows until `materialize` paints the new
+    // store's, and only that render flips authority back on.
+    if (isAnswered(entry.lifecycle)) {
+      yield fx.emit({ type: 'query:authority', hash: entry.def.hash, known: false });
     }
   }
 }

package/src/client/runtime.test.ts

@@ -6,6 +6,7 @@ import { fx } from '../kernel/effects';
 import type { Saga } from '../kernel/saga';
 import * as R from '../state/reducers';
 import { Runtime } from './runtime';
+import { rebindQueries } from '../boot/bucket-switch.saga';
 
 const env = defaultEnv({ tables: [] } as any, { materializeDebounceMs: 5 });
 const noop = () => {};
@@ -88,6 +89,45 @@ describe('Runtime state hooks', () => {
     expect(seen).toEqual([[{ id: 'thing:1' }]]);
     expect(rt.state.dirty.has('q')).toBe(false);
   });
+  it('the bucket-switch window: a re-seeded query never reads "known and idle" before its rows are painted', async () => {
+    // A sign-in: the query was registered in the anon bucket (cold, nothing
+    // painted), then the switch re-seeds it from the user's durable view.
+    // Before the fix the re-seed announced authority with `records` still
+    // empty, so a binding's `isSettled() && !row` held for a beat and the app
+    // created a row the user already had.
+    const { a, rt } = make(
+      {
+        local: {
+          getById: async () => ({ ids: [['thing:1', 1]], confirmed: true }),
+          select: async (plan: any) => (plan.ids ?? []).map((id: any) => ({ id: `${id.table}:${id.id}` })),
+        },
+      },
+      { ...buildState([buildEntry({ def: { hash: 'q', plan: { table: 'thing' } as any } })]), sessionId: 's' }
+    );
+    // What a binding derives `isSettled()` and `data()` from.
+    let known = false;
+    let idle = false;
+    let rows: unknown[] = [];
+    const verdicts: string[] = [];
+    const look = () => {
+      if (known && idle) verdicts.push(rows.length > 0 ? 'settled with rows' : 'settled empty');
+    };
+    rt.subscribe('q', (r) => ((rows = r), look()), { immediate: true });
+    rt.subscribeAuthority('q', (k) => ((known = k), look()), { immediate: true });
+    rt.subscribeStatus('q', (st) => ((idle = st === 'idle'), look()), { immediate: true });
+
+    await rt.run(rebindQueries());
+    expect(rt.state.queries.get('q')!.lifecycle).toMatchObject({ phase: 'cached', fetchDepth: 0, answered: false });
+    expect(idle).toBe(true);
+    expect(known).toBe(false);
+
+    a.timers.fire('mat:q');
+    await tick();
+    await tick();
+    expect(rows).toEqual([{ id: 'thing:1' }]);
+    expect(known).toBe(true);
+    expect(verdicts).toEqual(['settled with rows']);
+  });
   it('status and authority subscriptions fire on transitions, immediate delivers the current value', async () => {
     const { rt } = make({}, buildState([buildEntry({ def: { hash: 'q' } })]));
     const statuses: string[] = [];

package/src/client/runtime.ts

@@ -7,7 +7,7 @@ import type { Lane, Saga } from '../kernel/saga';
 import { runSaga } from '../kernel/saga';
 import type { ClientState } from '../state/client-state';
 import { emptyState } from '../state/client-state';
-import { isAuthoritative } from '../state/lifecycle';
+import { isAnswered } from '../state/lifecycle';
 import * as R from '../state/reducers';
 import { fetchingQueryCount, pendingMutationCount, queryStatus } from '../state/selectors';
 import type { SagaEnv } from '../query/env';
@@ -274,7 +274,7 @@ export class Runtime {
     this.authoritySubs.set(hash, set);
     if (options.immediate) {
       const entry = this.stateValue.queries.get(hash);
-      if (entry) this.safely(() => cb(isAuthoritative(entry.lifecycle)));
+      if (entry) this.safely(() => cb(isAnswered(entry.lifecycle)));
     }
     return () => {
       set.delete(cb);

package/src/modules/devtools/index.ts

@@ -318,7 +318,9 @@ export class DevToolsService implements StreamUpdateReceiver {
         // the panel: is the server's set known, has a non-empty one been seen
         // this session, how many empty reads were ignored.
         membershipKnown: q.config.membershipKnown === true,
-        authoritative: q.config.membershipKnown === true,
+        // What the bindings' `isAuthoritative()` reads: the known set's rows
+        // are painted, not just the set read.
+        authoritative: q.answered === true,
         viewLost: q.viewLost === true,
         serverState: q.serverState ?? null,
         // Detailed per-phase processing-time breakdown (SSP sub-phases, local/

package/src/query/materialize.saga.test.ts

@@ -97,6 +97,79 @@ describe('materialize', () => {
   });
 });
 
+describe('materialize answers the query', () => {
+  const plan = { table: 'thing' } as any;
+  const byIds = { 'local.select': (e: any) => (e.plan.ids ?? []).map((id: any) => ({ id: `${id.table}:${id.id}` })) };
+  const authority = (out: { emitted: Array<{ type: string }> }) => out.emitted.filter((e) => e.type === 'query:authority');
+
+  it('a cached re-seed: rows first, then authority; the next render flips nothing', async () => {
+    // The bucket-switch window: a durable view was found, `records` is not
+    // painted yet. Authority comes from this render, after the rows.
+    const s = R.markDirty(['a'])(
+      buildState([buildEntry({ def: { hash: 'a', plan }, lifecycle: { phase: 'cached' }, remoteArray: [['thing:1', 1]] })])
+    );
+    const out = await runPure(materialize('a'), { state: s, handlers: byIds });
+    expect(out.state.queries.get('a')!.lifecycle).toMatchObject({ phase: 'cached', notified: true, answered: true });
+    expect(out.emitted).toEqual([
+      { type: 'query:records', hash: 'a', records: [{ id: 'thing:1' }] },
+      { type: 'query:authority', hash: 'a', known: true },
+    ]);
+    const again = await runPure(materialize('a'), { state: R.markDirty(['a'])(out.state), handlers: byIds });
+    expect(again.emitted).toEqual([]);
+  });
+
+  it('a known empty set answers without a rows emission', async () => {
+    const s = buildState([buildEntry({ def: { hash: 'a', plan }, lifecycle: { phase: 'live' }, remoteArray: [] })]);
+    const out = await runPure(materialize('a'), { state: s, handlers: byIds });
+    expect(out.emitted).toEqual([{ type: 'query:authority', hash: 'a', known: true }]);
+  });
+
+  it('a cold render never answers', async () => {
+    const s = buildState([buildEntry({ def: { hash: 'a', plan } })], R.reloadViews(new Map([['v', ['thing:1']]])));
+    const out = await runPure(materialize('a'), { state: s, handlers: { 'local.select': () => [{ id: 'thing:1' }] } });
+    expect(out.state.queries.get('a')!.lifecycle).toMatchObject({ notified: true, answered: false });
+    expect(authority(out)).toEqual([]);
+  });
+
+  it('a server set whose bodies are still downloading is not an answer yet', async () => {
+    const s = buildState(
+      [buildEntry({ def: { hash: 'a', plan }, lifecycle: { phase: 'live' }, remoteArray: [['thing:1', 1], ['thing:2', 1]] })],
+      R.setVersions([['thing:1', 1]])
+    );
+    const out = await runPure(materialize('a'), { state: s, handlers: byIds });
+    expect(out.state.queries.get('a')!.lifecycle.answered).toBe(false);
+    expect(authority(out)).toEqual([]);
+    const landed = await runPure(materialize('a'), { state: R.setVersions([['thing:2', 1]])(out.state), handlers: byIds });
+    expect(landed.state.queries.get('a')!.lifecycle.answered).toBe(true);
+    expect(authority(landed)).toEqual([{ type: 'query:authority', hash: 'a', known: true }]);
+  });
+
+  it('a membership replaced while the read was out does not answer: the next render does', async () => {
+    const s = buildState([buildEntry({ def: { hash: 'a', plan }, lifecycle: { phase: 'cached' }, remoteArray: [['thing:1', 1]] })]);
+    const out = await runPure(materialize('a'), {
+      state: s,
+      handlers: {
+        'local.select': (e: any, ctx) => {
+          ctx.state = R.rebindQuery('a', { id: new RecordId('_00_query', 'b'), lifecycle: { phase: 'cached', remote: 'unregistered', fetchDepth: 0, backgroundDepth: 0, notified: false, answered: false }, remoteArray: [['thing:2', 1]], localArray: [] })(ctx.state);
+          return byIds['local.select'](e);
+        },
+      },
+    });
+    expect(out.state.queries.get('a')!.lifecycle.answered).toBe(false);
+    expect(authority(out)).toEqual([]);
+  });
+
+  it('after a rebind, a new store that renders nothing clears what the old principal painted', async () => {
+    const s = buildState([buildEntry({ def: { hash: 'a', plan }, lifecycle: { phase: 'live', answered: true }, remoteArray: [['thing:1', 1]], records: [{ id: 'thing:1' }] })]);
+    const rebound = R.rebindQuery('a', { id: new RecordId('_00_query', 'b'), lifecycle: { phase: 'cached', remote: 'unregistered', fetchDepth: 0, backgroundDepth: 0, notified: false, answered: false }, remoteArray: [], localArray: [] })(s);
+    const out = await runPure(materialize('a'), { state: rebound, handlers: byIds });
+    expect(out.emitted).toEqual([
+      { type: 'query:records', hash: 'a', records: [] },
+      { type: 'query:authority', hash: 'a', known: true },
+    ]);
+  });
+});
+
 describe('streamUpdate', () => {
   it('takes the local id-set (dirtying the query) and records ingest timings; unknown hashes are ignored', async () => {
     const s = buildState([buildEntry({ def: { hash: 'a' } })]);

package/src/query/materialize.saga.ts

@@ -4,7 +4,8 @@ import type { Saga } from '../kernel/saga';
 import { fx } from '../kernel/effects';
 import type { QueryEntry } from '../state/client-state';
 import * as R from '../state/reducers';
-import { overlay, vouched } from '../state/selectors';
+import { needed, overlay, vouched } from '../state/selectors';
+import { isAnswered } from '../state/lifecycle';
 import type { Overlay } from '../state/selectors';
 import { isWindowed, materializeEffect, rowKey, rowsEqual, rowsFromResult } from './materialize';
 import { buildRenderIds, paintsCold, resolveMembership } from './render-set';
@@ -17,12 +18,15 @@ const NONE: ReadonlySet<string> = new Set();
  * only writer of `records`. Runs on the `mat:<hash>` dedupe lane whenever the
  * query is dirty. Before the server has answered (`cold`) only bodies some
  * durable view vouches for paint (see `paintsCold`).
+ *
+ * Also the only place a query becomes answered (see `QueryLifecycle`): the
+ * authority flip is emitted here, after the rows it vouches for.
  */
 export function* materialize(hash: QueryHash): Saga<void> {
-  const [entry, ov, known] = (yield fx.state.read((s) => {
+  const [entry, ov, known, complete] = (yield fx.state.read((s) => {
     const e = s.queries.get(hash);
-    return [e, overlay(s), e?.lifecycle.phase === 'cold' ? vouched(s) : NONE];
-  })) as [QueryEntry | undefined, Overlay, ReadonlySet<string>];
+    return [e, overlay(s), e?.lifecycle.phase === 'cold' ? vouched(s) : NONE, needed(s, hash).length === 0];
+  })) as [QueryEntry | undefined, Overlay, ReadonlySet<string>, boolean];
   if (!entry) return;
   const t0 = (yield fx.now()) as number;
   const isWindow = isWindowed(entry.def.surql);
@@ -54,10 +58,18 @@ export function* materialize(hash: QueryHash): Saga<void> {
   if (!current) return;
   const t1 = (yield fx.now()) as number;
   const changed = !rowsEqual(rows, current.records);
+  // These rows answer the query when they drew a known membership with no
+  // body of a server set still to download, and that membership is still
+  // the one in state. A server set applied, or a bucket switch, while the
+  // read was out dirtied the query again: the next render answers instead.
+  const answered =
+    complete && entry.lifecycle.phase !== 'cold' && current.lifecycle.phase !== 'cold' && current.remoteArray === entry.remoteArray;
   yield fx.state.update(
-    R.compose(R.setRecords(hash, rows, changed, t1 - t0), changed ? R.stampUpdated(hash, t1) : (s) => s)
+    R.compose(R.setRecords(hash, rows, changed, t1 - t0, answered), changed ? R.stampUpdated(hash, t1) : (s) => s)
   );
   if (changed) yield fx.emit({ type: 'query:records', hash, records: rows });
+  // After the rows: a subscriber told "known" must already hold them.
+  if (answered && !isAnswered(current.lifecycle)) yield fx.emit({ type: 'query:authority', hash, known: true });
 }
 
 /**

package/src/query/membership.saga.test.ts

@@ -72,7 +72,7 @@ describe('applyMembership', () => {
     expect(out.result).toBe('ignored');
     expect(out.state.queries.get('a')!).toMatchObject({ viewLostCount: 0, viewLostRetryAt: null });
   });
-  it('applied: commits, writes the view row, flips authority once, releases acked items, asks for bodies', async () => {
+  it('applied: commits, writes the view row, releases acked items, asks for bodies; authority waits for the render', async () => {
     const s = buildState(
       [buildEntry({ def: { hash: 'a', viewKey: 'vk' }, lifecycle: { phase: 'cold' }, subqueryRemoteArray: [['c:1', 1]] })],
       R.outboxReplace([buildOutboxItem({ id: 'm', recordId: 't:1', status: 'acked', ackedAt: 1 })])
@@ -81,7 +81,10 @@ describe('applyMembership', () => {
     expect(out.result).toBe('applied');
     expect(out.state.queries.get('a')!.lifecycle.phase).toBe('live');
     expect(out.state.outbox).toEqual([]);
-    expect(out.emitted).toEqual([{ type: 'query:authority', hash: 'a', known: true }]);
+    // The set is known, but no row of it is painted: `materialize` flips authority.
+    expect(out.emitted).toEqual([]);
+    expect(out.state.queries.get('a')!.lifecycle.answered).toBe(false);
+    expect(out.state.dirty.has('a')).toBe(true);
     expect(out.log.find((e) => e.kind === 'local.upsert')).toEqual({
       kind: 'local.upsert',
       table: '_00_view',

package/src/query/membership.saga.ts

@@ -10,7 +10,6 @@ import {
   backoffMs,
 } from '../kernel/constants';
 import type { ClientState, QueryEntry } from '../state/client-state';
-import { isAuthoritative } from '../state/lifecycle';
 import * as R from '../state/reducers';
 import { encodeRecordId } from '../utils/index';
 import { departedIds } from '../state/selectors';
@@ -88,10 +87,10 @@ export function* applyMembership(
     yield fx.timer.set(`view-lost:${hash}`, delay, { type: 'RecoverLostView', hash });
     return outcome;
   }
-  const wasAuthoritative = isAuthoritative(entry.lifecycle);
   yield fx.state.update(R.commitMembership(hash, remoteArray, meta?.present ?? true));
   yield* forgetDeparted(hash, departedIds(entry.remoteArray, remoteArray));
-  if (!wasAuthoritative) yield fx.emit({ type: 'query:authority', hash, known: true });
+  // No authority flip here: the set is known but its rows are not painted
+  // yet (bodies may still be on their way). `materialize` flips it once they are.
   const now = (yield fx.now()) as number;
   try {
     yield fx.local.upsert(

package/src/query/register.saga.test.ts

@@ -154,7 +154,8 @@ describe('registerRemote', () => {
     expect(req.sql.startsWith('fn::query::register($config);')).toBe(true);
     expect(req.vars.config).toMatchObject({ surql: entry.def.surql, ttl: '10m' });
     expect(out.dispatched).toEqual([{ type: 'FetchRows' }, { type: 'FetchRows' }, { type: 'SyncOutcome', ok: true }]);
-    expect(out.emitted).toContainEqual({ type: 'query:authority', hash: 'a', known: true });
+    // Authority follows the render of these rows, not the registration.
+    expect(out.emitted.some((ev) => ev.type === 'query:authority')).toBe(false);
   });
   it('a cold registration is foreground; a cached or live one is background', async () => {
     for (const [phase, background] of [['cold', 0], ['cached', 1], ['live', 1]] as const) {

package/src/state/lifecycle.test.ts

@@ -1,6 +1,6 @@
 import { describe, expect, it } from 'vitest';
 import type { LifecycleEvent, QueryLifecycle, QueryPhase } from './lifecycle';
-import { deriveStatus, hasServerMembership, isAuthoritative, isForegroundFetching, LifecycleError, seedLifecycle, transition } from './lifecycle';
+import { deriveStatus, hasServerMembership, isAnswered, isAuthoritative, isForegroundFetching, LifecycleError, seedLifecycle, transition } from './lifecycle';
 
 const at = (phase: QueryPhase, over: Partial<QueryLifecycle> = {}): QueryLifecycle => ({
   phase,
@@ -8,6 +8,7 @@ const at = (phase: QueryPhase, over: Partial<QueryLifecycle> = {}): QueryLifecyc
   fetchDepth: 0,
   backgroundDepth: 0,
   notified: false,
+  answered: false,
   ...over,
 });
 
@@ -33,8 +34,48 @@ describe('transition table (phase axis)', () => {
     expect(transition(at('view-lost'), { type: 'row-missing' }).phase).toBe('view-lost');
   });
   it('bucket-switch reseeds and clears fetch depth', () => {
-    const l = transition(at('live', { fetchDepth: 3, notified: true }), { type: 'bucket-switch', resolvedBefore: true });
-    expect(l).toEqual({ phase: 'cached', remote: 'unregistered', fetchDepth: 0, backgroundDepth: 0, notified: false });
+    const l = transition(at('live', { fetchDepth: 3, notified: true, answered: true }), { type: 'bucket-switch', resolvedBefore: true });
+    expect(l).toEqual({ phase: 'cached', remote: 'unregistered', fetchDepth: 0, backgroundDepth: 0, notified: false, answered: false });
+  });
+});
+
+describe('answered', () => {
+  it('a seed is never answered, not even a cached one: its rows are not painted yet', () => {
+    expect(seedLifecycle(true)).toMatchObject({ phase: 'cached', answered: false });
+    expect(isAnswered(seedLifecycle(true))).toBe(false);
+    expect(isAuthoritative(seedLifecycle(true))).toBe(true);
+  });
+  it('only a render of a known membership answers; a cold render is a guess', () => {
+    expect(transition(at('cold'), { type: 'notified', answered: true }).answered).toBe(false);
+    expect(transition(at('cached'), { type: 'notified' }).answered).toBe(false);
+    expect(transition(at('cached'), { type: 'notified', answered: false })).toMatchObject({ notified: true, answered: false });
+    for (const p of ['cached', 'live', 'view-lost'] as const) {
+      expect(transition(at(p), { type: 'notified', answered: true })).toMatchObject({ notified: true, answered: true });
+    }
+  });
+  it('latched through membership, a reconnect and a lost view; cleared by a re-seed', () => {
+    let l = transition(at('cached'), { type: 'notified', answered: true });
+    l = transition(l, { type: 'membership-applied', present: true });
+    expect(l).toMatchObject({ phase: 'live', answered: true });
+    l = transition(l, { type: 'notified', answered: false });
+    expect(l.answered).toBe(true);
+    l = transition(l, { type: 'remote-dropped' });
+    expect(l).toMatchObject({ notified: false, answered: true });
+    l = transition(l, { type: 'row-missing' });
+    expect(l).toMatchObject({ phase: 'view-lost', answered: true });
+    expect(transition(l, { type: 'bucket-switch', resolvedBefore: true }).answered).toBe(false);
+    expect(transition(l, { type: 'seed', resolvedBefore: true }).answered).toBe(false);
+  });
+  it('a server set applied to a cold query is not an answer until its render', () => {
+    const l = transition(at('cold'), { type: 'membership-applied', present: true });
+    expect(l).toMatchObject({ phase: 'live', answered: false });
+    expect(isAuthoritative(l)).toBe(true);
+    expect(isAnswered(l)).toBe(false);
+  });
+  it('an unchanged notified keeps identity', () => {
+    const l = transition(at('live'), { type: 'notified', answered: true });
+    expect(transition(l, { type: 'notified', answered: true })).toBe(l);
+    expect(transition(l, { type: 'notified' })).toBe(l);
   });
 });
 
@@ -111,6 +152,7 @@ describe('invariants over random event sequences', () => {
     { type: 'fetch-begin', background: true },
     { type: 'fetch-end', background: true },
     { type: 'notified' },
+    { type: 'notified', answered: true },
     { type: 'bucket-switch', resolvedBefore: false },
     { type: 'seed', resolvedBefore: true },
   ];
@@ -135,6 +177,7 @@ describe('invariants over random event sequences', () => {
         expect(l.backgroundDepth).toBeLessThanOrEqual(l.fetchDepth);
         if (ev.type === 'row-missing' && before.phase === 'cold') expect(l.phase).toBe('cold');
         if (l.phase === 'view-lost') expect(before.phase).not.toBe('cold');
+        if (l.answered) expect(l.phase).not.toBe('cold');
       }
     }
   });

package/src/state/lifecycle.ts

@@ -15,6 +15,17 @@ import type { QueryStatus } from '../types';
  * behind `status: 'fetching'`, `notified` says whether subscribers received
  * at least one materialization this registration.
  *
+ * `answered` says subscribers have been handed the rows of a known membership
+ * (the server's, or the durable one of an earlier session) at least once:
+ * a materialization ran past `cold`, with no body of a server set still to
+ * download, and the membership it drew was still the one in state when it
+ * committed. Only a re-seed (a new entry, a bucket switch) clears it, so a
+ * reconnect or a lost view does not send a painted query back to loading.
+ * It is what the bindings' `isAuthoritative()` mirrors (see `isAnswered`):
+ * a `cached` seed or a freshly applied server set alone is not enough,
+ * because `records` is still empty (or stale) until `materialize` paints, and
+ * "known and empty" read in that beat made apps create rows that existed.
+ *
  * `backgroundDepth` is the part of `fetchDepth` that re-verifies rows the
  * query already shows: a registration of a query that is not `cold`. It still
  * holds `status: 'fetching'` (results are not yet confirmed), but it is not
@@ -29,6 +40,7 @@ export interface QueryLifecycle {
   readonly fetchDepth: number;
   readonly backgroundDepth: number;
   readonly notified: boolean;
+  readonly answered: boolean;
 }
 
 export type LifecycleEvent =
@@ -41,7 +53,7 @@ export type LifecycleEvent =
   | { type: 'remote-dropped' }
   | { type: 'fetch-begin'; background?: boolean }
   | { type: 'fetch-end'; background?: boolean }
-  | { type: 'notified' }
+  | { type: 'notified'; answered?: boolean }
   | { type: 'bucket-switch'; resolvedBefore: boolean };
 
 export class LifecycleError extends Error {
@@ -52,7 +64,14 @@ export class LifecycleError extends Error {
 }
 
 export function seedLifecycle(resolvedBefore: boolean): QueryLifecycle {
-  return { phase: resolvedBefore ? 'cached' : 'cold', remote: 'unregistered', fetchDepth: 0, backgroundDepth: 0, notified: false };
+  return {
+    phase: resolvedBefore ? 'cached' : 'cold',
+    remote: 'unregistered',
+    fetchDepth: 0,
+    backgroundDepth: 0,
+    notified: false,
+    answered: false,
+  };
 }
 
 /** Total on every (lifecycle, event) pair the sagas can produce; throws on the rest. */
@@ -84,14 +103,23 @@ export function transition(l: QueryLifecycle, ev: LifecycleEvent): QueryLifecycl
       const backgroundDepth = Math.min(fetchDepth, l.backgroundDepth - (ev.background && l.backgroundDepth > 0 ? 1 : 0));
       return { ...l, fetchDepth, backgroundDepth };
     }
-    case 'notified':
-      return l.notified ? l : { ...l, notified: true };
+    case 'notified': {
+      // A cold render is a guess from the local store, never an answer.
+      const answered = l.answered || (ev.answered === true && l.phase !== 'cold');
+      return l.notified && answered === l.answered ? l : { ...l, notified: true, answered };
+    }
     case 'bucket-switch':
       return { ...seedLifecycle(ev.resolvedBefore), fetchDepth: 0 };
   }
 }
 
+/** Membership is known (server set or durable seed); its rows may not be painted yet. */
 export const isAuthoritative = (l: QueryLifecycle): boolean => l.phase !== 'cold';
+/**
+ * Subscribers hold the rows of a known membership: what the authority channel
+ * (`subscribeQueryAuthority`, the bindings' `isAuthoritative()`) reports.
+ */
+export const isAnswered = (l: QueryLifecycle): boolean => l.answered;
 export const hasServerMembership = (l: QueryLifecycle): boolean =>
   l.phase === 'live' || l.phase === 'view-lost';
 export const deriveStatus = (l: QueryLifecycle): QueryStatus => (l.fetchDepth > 0 ? 'fetching' : 'idle');

package/src/state/reducers.test.ts

@@ -79,6 +79,14 @@ describe('query reducers', () => {
     expect(s2.queries.get('a')!.telemetry.phaseSamples.localFetch).toEqual([12]);
   });
 
+  it('setRecords answers a query only when told to, and never a cold one', () => {
+    const cold = buildState([e('a')]);
+    expect(R.setRecords('a', [], false, null, true)(cold).queries.get('a')!.lifecycle.answered).toBe(false);
+    const cached = buildState([e('a', { lifecycle: { phase: 'cached' } })]);
+    expect(R.setRecords('a', [], false, null)(cached).queries.get('a')!.lifecycle).toMatchObject({ notified: true, answered: false });
+    expect(R.setRecords('a', [], false, null, true)(cached).queries.get('a')!.lifecycle).toMatchObject({ notified: true, answered: true });
+  });
+
   it('sample windows are capped', () => {
     let s = buildState([e('a')]);
     for (let i = 0; i < 105; i++) s = R.recordPhase('a', 'localFetch', i)(s);
@@ -249,12 +257,14 @@ describe('bucket switch reducers', () => {
       R.outboxReplace([buildOutboxItem()])
     );
     const id = { table: '_00_query', id: 'new' } as any;
-    const s1 = R.rebindQuery('a', { id, lifecycle: { phase: 'cached', remote: 'unregistered', fetchDepth: 0, backgroundDepth: 0, notified: false }, remoteArray: [['t:2', 1]], localArray: [] })({ ...s0, dirty: new Set() });
+    const s1 = R.rebindQuery('a', { id, lifecycle: { phase: 'cached', remote: 'unregistered', fetchDepth: 0, backgroundDepth: 0, notified: false, answered: false }, remoteArray: [['t:2', 1]], localArray: [] })({ ...s0, dirty: new Set() });
     const en = s1.queries.get('a')!;
     expect(en.def.id).toBe(id);
     expect(en.lifecycle.phase).toBe('cached');
     expect(en.remoteArray).toEqual([['t:2', 1]]);
-    expect(en.records).toEqual([]);
+    // What subscribers still hold: the next render diffs against it, so a new
+    // store that renders `[]` is a change they hear about.
+    expect(en.records).toEqual([{ id: 't:1' }]);
     expect(en.serverState).toBeNull();
     expect(en.registerAttempts).toBe(0);
     expect(s1.dirty.has('a')).toBe(true);

package/src/state/reducers.ts

@@ -153,8 +153,13 @@ export const setSubqueryRemoteArray =
     return withView(next, entry.def.viewKey, vouchedIds(entry.remoteArray, subqueryRemoteArray));
   };
 
+/**
+ * Commit a materialization. `answered`: it drew a known membership with no
+ * body still to download, and that membership is still current (see
+ * `QueryLifecycle`).
+ */
 export const setRecords =
-  (hash: QueryHash, records: ReadonlyArray<Row>, changed: boolean, materializeMs: number | null): Reducer =>
+  (hash: QueryHash, records: ReadonlyArray<Row>, changed: boolean, materializeMs: number | null, answered = false): Reducer =>
   (s) => {
     const next = withEntry(s, hash, (e) => {
       const prev = e.telemetry.phaseSamples.localFetch ?? [];
@@ -171,7 +176,7 @@ export const setRecords =
         ...e,
         records: changed ? records : e.records,
         telemetry,
-        lifecycle: transition(e.lifecycle, { type: 'notified' }),
+        lifecycle: transition(e.lifecycle, { type: 'notified', answered }),
       };
     });
     return next === s ? s : { ...next, dirty: withoutAll(next.dirty, [hash]) };
@@ -454,7 +459,13 @@ export const setIdentity =
   ): Reducer =>
   (s) => ({ ...s, ...patch });
 
-/** Re-home a query after a bucket switch: new store, same hash, fresh sync state. */
+/**
+ * Re-home a query after a bucket switch: new store, same hash, fresh sync state.
+ * `records` is kept: it is what subscribers were last handed, and the next
+ * render diffs against it. Blanking it here (without telling anyone) let a
+ * new store that renders `[]` read as unchanged, so the previous principal's
+ * rows stayed on screen under an authority flip that vouched for them.
+ */
 export const rebindQuery =
   (
     hash: QueryHash,
@@ -468,7 +479,6 @@ export const rebindQuery =
       remoteArray: next.remoteArray,
       localArray: next.localArray,
       subqueryRemoteArray: [],
-      records: [],
       serverState: null,
       lastHeartbeatAt: null,
       lastPolledAt: null,

package/src/state/selectors.ts

@@ -217,6 +217,7 @@ export function toQueryState(e: QueryEntry): QueryState {
     viewLost: l.phase === 'view-lost',
     serverState: e.serverState,
     syncNotified: l.notified,
+    answered: l.answered,
     ttlTimer: null,
     ttlDurationMs: e.def.ttlMs,
     lastHeartbeatAt: e.lastHeartbeatAt ?? undefined,

package/src/types.ts

@@ -706,6 +706,12 @@ export interface QueryState {
    * always emits at least once even when its records are unchanged — otherwise
    * an empty re-registered window would never notify and stay "loading". */
   syncNotified?: boolean;
+  /**
+   * Subscribers hold the rows of a known membership (see `QueryLifecycle`'s
+   * `answered`): what the authority channel and the bindings'
+   * `isAuthoritative()` report. Ephemeral.
+   */
+  answered?: boolean;
   /** Timer for TTL expiration. */
   ttlTimer: NodeJS.Timeout | null;
   /** TTL duration in milliseconds. */
@@ -798,9 +804,12 @@ export interface QueryTimings {
 export type QueryUpdateCallback = (records: Record<string, any>[]) => void;
 export type QueryStatusCallback = (status: QueryStatus) => void;
 /**
- * Observer for a query's authority flips: `true` once server membership is
- * known for it (registration, poll, durable seed), `false` when it is reset
- * (bucket switch). What the bindings' `isAuthoritative()` mirrors.
+ * Observer for a query's authority flips: `true` once subscribers hold the
+ * rendered rows of a known membership (a server answer whose bodies are
+ * local, or the durable membership of an earlier session), delivered after
+ * the rows that vouch for it; `false` when it is reset (bucket switch). Knowing the set is
+ * not enough: a `cached` re-seed or a just-applied server set has no rows
+ * painted yet. What the bindings' `isAuthoritative()` mirrors.
  */
 export type QueryAuthorityCallback = (known: boolean) => void;
 export type MutationCallback = (mutations: MutationEvent[]) => void;