@spooky-sync/core 0.0.1-canary.333 → 0.0.1-canary.335

package/AGENTS.md

@@ -27,7 +27,13 @@ Sp00kyClient<S>  ── facade: every method = one saga run, selector or subscri
 
 Local writes are applied optimistically (row + outbox entry in one local
 transaction), rendered through the outbox overlay, and drained to the remote in
-batches. Server membership arrives through one batched edge read (registration,
+FIFO batches. Each statement of a batch commits on its own, but the server stops
+the batch at its first failed statement (`remoteBatch` chains them), so no write
+reaches the server ahead of an earlier one that failed. A batch whose answer is
+lost (it threw a transport error, or its rows were loaded from the store after a
+restart) is in doubt (`OutboxItem.inDoubt`): re-sent, an in-doubt CREATE checks
+the row already on the server and is a no-op when it holds what the CREATE
+writes. Server membership arrives through one batched edge read (registration,
 poll, LIVE dirt) and bodies are fetched once across all queries. Rows are always
 re-materialized from state, never patched in place.
 
@@ -59,7 +65,7 @@ re-materialized from state, never patched in place.
 - **A never-resolved query paints only vouched rows.** Before the server answers (`cold`), the local predicate scan shows a cached body only if some `_00_view` row names it (as a member or subquery child) or a write for it is in flight. A body no view names is an orphan (deleted upstream while nothing watched it): it stays hidden, and the GC deletes it 30 s after boot and then hourly. A `_00_view` row no query has resolved for 14 days is retired by the same sweep, so that query paints cold again.
 - **`database.store` defaults to `'memory'`.** `'indexeddb'` keeps one IndexedDB database per user bucket (`sp00ky-<bucket>`) and needs `@surrealdb/wasm` >= 3.1.0: the 3.0.x engine opened the store but failed every write (`An IndexedDB error occured: idb error`), so each session fell back to memory. 3.1.0 ships the engine as `@surrealdb/wasm-native`; a Vite app lists it in `optimizeDeps.exclude` next to `@surrealdb/wasm`. A store that still cannot open after a drop runs the session in memory (error log `falling back to in-memory`). Under `localEngine: 'sqlite'`, `'indexeddb'` means OPFS.
 - **Boot owns the first identity.** The facade subscribes to auth with `immediate: false`: boot opens the bucket the hint names and `auth.restoreSession` announces the user. `LocalDatabaseService.switchStore` also waits for an in-flight `connect`, and lets statements already past the gate finish before it closes a client: the 3.1 engine streams results from its worker, and a statement whose client closed under it stayed pending until its 30 s deadline with every later local statement queued behind it.
-- **A rejected write is not lost.** Application errors roll the local row back (create/update/delete) and move the mutation to `_00_failed_mutations`; the tray API above lists, retries (as a fresh write) or discards it. Network errors keep the row queued.
+- **A rejected write is not lost.** Application errors roll the local row back (create/update/delete) and move the mutation to `_00_failed_mutations`; the tray API above lists, retries (as a fresh write) or discards it. Network errors keep the row queued, and so does a write SurrealDB refused only because sp00ky's own `_00_` ingest event could not post to the scheduler/SSP (refused, past its TIMEOUT, DNS, 5xx/408/429; `SP00KY_EVENT_POST_FAILED` in `utils/error-classification.ts`).
 
 ## Module map (under `src/`)
 

package/README.md

@@ -49,7 +49,10 @@ back.
 acked (kept in the overlay until membership names them), rejected rows are
 rolled back and moved to `_00_failed_mutations` in the same transaction that
 deletes the pending row, a transport cut leaves the tail queued behind a
-backoff. The tray is exposed as `failedMutationCount`,
+backoff. A push whose answer never came (timeout, dropped socket, a session
+that died mid-push) may have committed, so its rows are in doubt: re-sent, an
+in-doubt CREATE that finds a matching row of its own on the server is a no-op
+instead of an "already exists" rollback. The tray is exposed as `failedMutationCount`,
 `subscribeToFailedMutations`, `listFailedMutations`, `retryFailedMutation`
 and `discardFailedMutation`.
 

package/dist/index.d.ts

@@ -1055,6 +1055,17 @@ type OutEvent = {
  * behind `status: 'fetching'`, `notified` says whether subscribers received
  * at least one materialization this registration.
  *
+ * `answered` says subscribers have been handed the rows of a known membership
+ * (the server's, or the durable one of an earlier session) at least once:
+ * a materialization ran past `cold`, with no body of a server set still to
+ * download, and the membership it drew was still the one in state when it
+ * committed. Only a re-seed (a new entry, a bucket switch) clears it, so a
+ * reconnect or a lost view does not send a painted query back to loading.
+ * It is what the bindings' `isAuthoritative()` mirrors (see `isAnswered`):
+ * a `cached` seed or a freshly applied server set alone is not enough,
+ * because `records` is still empty (or stale) until `materialize` paints, and
+ * "known and empty" read in that beat made apps create rows that existed.
+ *
  * `backgroundDepth` is the part of `fetchDepth` that re-verifies rows the
  * query already shows: a registration of a query that is not `cold`. It still
  * holds `status: 'fetching'` (results are not yet confirmed), but it is not
@@ -1068,6 +1079,7 @@ interface QueryLifecycle {
   readonly fetchDepth: number;
   readonly backgroundDepth: number;
   readonly notified: boolean;
+  readonly answered: boolean;
 }
 //#endregion
 //#region src/kernel/effects.d.ts
@@ -1327,6 +1339,14 @@ interface OutboxItem {
   readonly status: OutboxStatus;
   readonly ackedAt: number | null;
   readonly attempts: number;
+  /**
+   * A request carrying this row may have committed without the answer
+   * reaching this client: it threw a transport error, or the row was loaded
+   * from the store, so a session that died mid-push may have sent it. Its
+   * CREATE then accepts the row already on the server when that row holds
+   * what it would write (see `remoteBatch`). Absent means false.
+   */
+  readonly inDoubt?: boolean;
 }
 type TabRole = 'solo' | 'leader' | 'follower';
 /** A debounced update accumulating locally until its flush writes the outbox row. */

package/dist/index.js

@@ -546,8 +546,32 @@ const NETWORK_ERROR_PATTERNS = [
 	"specify a namespace",
 	"specify a database"
 ];
+/**
+* A write SurrealDB refused because sp00ky's OWN ingest post failed: every
+* synced table's `_00_<table>_mutation` / `_00_<table>_delete` event posts to
+* the scheduler or SSP inside the write's transaction (`sp00ky.rs::ingest_post`),
+* so a scheduler that is down, slow past the event TIMEOUT, or answering 5xx
+* aborts the write. That is an outage, not the mutation's fault, and it clears
+* on its own; classified `application` it was rolled back and discarded, so
+* every write queued during a scheduler restart or a cold SSP was lost.
+*
+* Wording on SurrealDB 3.1.5 and 3.3.4 (the event name may be nested inside an
+* app event that wrote to a synced table):
+*   "Error while processing event _00_item_mutation: There was an error
+*    processing a remote HTTP request: error sending request for url (...)"
+*    (refused connection or TIMEOUT), "...: 503 Service Unavailable" (5xx),
+*   "Error while processing event _00_item_mutation: failed to lookup address
+*    information: ..." (DNS).
+*
+* Only `_00_` events count: an app's own event posting to its own endpoint
+* stays `application`, as does a 4xx from `/ingest` other than 408/429 (a
+* malformed or oversized payload, a secret mismatch), which no retry fixes and
+* which would otherwise hold the outbox's serial lane forever.
+*/
+const SP00KY_EVENT_POST_FAILED = /error while processing event _00_[^:\s]*: (?:there was an error processing a remote http request: (?:error sending request|5\d\d\b|408\b|429\b)|failed to lookup address information)/;
 function classifySyncError(error) {
 	const message = error instanceof Error ? error.message.toLowerCase() : String(error).toLowerCase();
+	if (SP00KY_EVENT_POST_FAILED.test(message)) return "network";
 	for (const pattern of NETWORK_ERROR_PATTERNS) if (message.includes(pattern)) return "network";
 	return "application";
 }
@@ -1382,6 +1406,11 @@ function hydrateRowData(row, columns) {
 		return row;
 	}
 }
+/**
+* A row read back from the store at boot, bucket switch or leader takeover.
+* The session that queued it may have sent it and died before the answer (a
+* closed tab, a killed app, a lost leader), so its outcome is in doubt.
+*/
 const toOutboxItem = (row) => ({
 	id: row.id,
 	type: row.mutationType,
@@ -1389,7 +1418,8 @@ const toOutboxItem = (row) => ({
 	table: row.tableName,
 	status: "pending",
 	ackedAt: null,
-	attempts: 0
+	attempts: 0,
+	inDoubt: true
 });
 /** The `_00_pending_writes` id for a minted mutation id (same suffix). */
 const pendingWriteId = (mutationId) => `${PENDING_WRITES_TABLE}:${mutationId.includes(":") ? mutationId.slice(mutationId.indexOf(":") + 1) : mutationId}`;
@@ -1526,28 +1556,86 @@ function planDeferredOutboxRowTx(input) {
 	};
 }
 /**
-* Many outbox rows as ONE multi-statement request. Statement i answers row i.
-* Each statement is its own transaction on the server, as before.
+* What a statement of a `remoteBatch` throws instead of running, because an
+* earlier statement in the same request failed.
 */
-function remoteBatch(rows) {
+const BATCH_SKIPPED = "sp00ky: not run, an earlier statement in this batch failed";
+/** A CRDT edit-log row (`<table>__crdt_log`): written once under a fresh id, never changed. */
+const isLogTable = (table) => table.endsWith("__crdt_log");
+/**
+* Which fields of the row already on the server must equal the payload of the
+* CREATE at `i` for that row to count as this CREATE's own earlier commit, or
+* `null` when the CREATE must not tolerate an existing row at all.
+*
+* Only a CREATE whose outcome is in doubt tolerates one: elsewhere "already
+* exists" means someone else holds the id, a rejection as before. The check
+* is every payload field except those a later in-doubt row of the same
+* record, which may have committed in the same lost round, could have changed
+* since; those rows run again after it and set them anyway. A later in-doubt
+* DELETE or CREATE of the record may have replaced the row, so then existence
+* is all that is checked. Rows that are not in doubt never ran.
+*
+* A CRDT log row's id is fresh and the row immutable, so its existence is
+* proof enough, in doubt or not.
+*/
+function matchFields(rows, i, inDoubt) {
+	const row = rows[i];
+	if (isLogTable(row.tableName)) return [];
+	if (!inDoubt.has(row.id)) return null;
+	const changed = /* @__PURE__ */ new Set();
+	for (const later of rows.slice(i + 1)) {
+		if (later.recordId !== row.recordId || !inDoubt.has(later.id)) continue;
+		if (later.mutationType !== "update") return [];
+		for (const key of Object.keys(later.data ?? {})) changed.add(key);
+	}
+	return Object.keys(row.data ?? {}).filter((key) => !changed.has(key));
+}
+function remoteStatement(rows, i, vars, inDoubt) {
+	const row = rows[i];
+	vars[`id${i}`] = parseRecordIdString(row.recordId);
+	switch (row.mutationType) {
+		case "create": {
+			const data = row.data ?? {};
+			const create = `CREATE ONLY $id${i} SET ${Object.keys(data).map((key) => {
+				vars[`d${i}_${key}`] = data[key];
+				return `${key} = $d${i}_${key}`;
+			}).join(", ")}`;
+			const match = matchFields(rows, i, inDoubt);
+			if (!match) return create;
+			return `LET $was${i} = (SELECT * FROM ONLY $id${i}); IF ${[`($was${i} = NONE)`, ...match.map((key) => `($was${i}.${key} != $d${i}_${key})`)].join(" OR ")} { ${create} }`;
+		}
+		case "update":
+			vars[`data${i}`] = row.data ?? {};
+			return `UPDATE $id${i} MERGE $data${i}`;
+		case "delete": return `DELETE $id${i}`;
+	}
+}
+/**
+* Many outbox rows as ONE multi-statement request. Statement i answers row i
+* and is its own transaction on the server, as before, but the statements are
+* chained: statement i binds `$ok<i>` only when it commits, and statement i+1
+* throws `BATCH_SKIPPED` without touching anything unless `$ok<i>` is bound
+* (a LET lives for one request only). So the server stops at the first
+* failure: everything before it is committed, nothing after it ran.
+*
+* Without the chain, statements after a failed one ran anyway. A retryable
+* failure at i left the rows after i queued although they had committed; the
+* re-sent CREATE then read "already exists", was taken for a rejection and
+* rolled back locally while the server kept the row. Acking them instead
+* would have let a later write land before an earlier one it may depend on.
+*
+* The chain cannot help when the answer itself is lost: the request may have
+* committed any prefix of the batch. Rows named in `inDoubt` (mutation ids)
+* are such rows. An UPDATE MERGE or a DELETE is safe to run twice, a CREATE
+* is not, so an in-doubt CREATE checks the row already there first (see
+* `matchFields`) and is a no-op when it is its own: the batch goes on in
+* order, with no "already exists" to cut it.
+*/
+function remoteBatch(rows, inDoubt = /* @__PURE__ */ new Set()) {
 	const vars = {};
 	return {
-		sql: rows.map((row, i) => {
-			const rid = parseRecordIdString(row.recordId);
-			vars[`id${i}`] = rid;
-			switch (row.mutationType) {
-				case "create": {
-					const data = row.data ?? {};
-					return `CREATE ONLY $id${i} SET ${Object.keys(data).map((key) => {
-						vars[`d${i}_${key}`] = data[key];
-						return `${key} = $d${i}_${key}`;
-					}).join(", ")}`;
-				}
-				case "update":
-					vars[`data${i}`] = row.data ?? {};
-					return `UPDATE $id${i} MERGE $data${i}`;
-				case "delete": return `DELETE $id${i}`;
-			}
+		sql: rows.map((_, i) => {
+			return `LET $ok${i} = { ${i === 0 ? "" : `IF !$ok${i - 1} { THROW "${BATCH_SKIPPED}" }; `}${remoteStatement(rows, i, vars, inDoubt)}; true }`;
 		}).join(";\n"),
 		vars
 	};
@@ -2198,8 +2286,8 @@ function trimHistory(history, cap) {
 
 //#endregion
 //#region src/modules/devtools/index.ts
-const CORE_VERSION = "0.0.1-canary.333";
-const WASM_VERSION = "0.0.1-canary.333";
+const CORE_VERSION = "0.0.1-canary.335";
+const WASM_VERSION = "0.0.1-canary.335";
 const SURREAL_VERSION = "3.1.0";
 var DevToolsService = class DevToolsService {
 	version = CORE_VERSION;
@@ -2338,7 +2426,7 @@ var DevToolsService = class DevToolsService {
 				remoteIds: remoteArray.slice(0, DevToolsService.STATE_IDS_CAP).map(([id]) => id),
 				idsTruncated: localArray.length > DevToolsService.STATE_IDS_CAP || remoteArray.length > DevToolsService.STATE_IDS_CAP,
 				membershipKnown: q.config.membershipKnown === true,
-				authoritative: q.config.membershipKnown === true,
+				authoritative: q.answered === true,
 				viewLost: q.viewLost === true,
 				serverState: q.serverState ?? null,
 				timings: this.dataManager.phaseTimings(q)
@@ -2931,7 +3019,8 @@ function seedLifecycle(resolvedBefore) {
 		remote: "unregistered",
 		fetchDepth: 0,
 		backgroundDepth: 0,
-		notified: false
+		notified: false,
+		answered: false
 	};
 }
 /** Total on every (lifecycle, event) pair the sagas can produce; throws on the rest. */
@@ -2980,17 +3069,27 @@ function transition(l, ev) {
 				backgroundDepth
 			};
 		}
-		case "notified": return l.notified ? l : {
-			...l,
-			notified: true
-		};
+		case "notified": {
+			const answered = l.answered || ev.answered === true && l.phase !== "cold";
+			return l.notified && answered === l.answered ? l : {
+				...l,
+				notified: true,
+				answered
+			};
+		}
 		case "bucket-switch": return {
 			...seedLifecycle(ev.resolvedBefore),
 			fetchDepth: 0
 		};
 	}
 }
+/** Membership is known (server set or durable seed); its rows may not be painted yet. */
 const isAuthoritative = (l) => l.phase !== "cold";
+/**
+* Subscribers hold the rows of a known membership: what the authority channel
+* (`subscribeQueryAuthority`, the bindings' `isAuthoritative()`) reports.
+*/
+const isAnswered = (l) => l.answered;
 const hasServerMembership = (l) => l.phase === "live" || l.phase === "view-lost";
 const deriveStatus = (l) => l.fetchDepth > 0 ? "fetching" : "idle";
 /** A fetch cycle the user is waiting on: rows to download, or a first registration. */
@@ -3208,7 +3307,12 @@ const setSubqueryRemoteArray = (hash, subqueryRemoteArray) => (s) => {
 	if (!entry || entry.lifecycle.phase === "cold") return next;
 	return withView(next, entry.def.viewKey, vouchedIds(entry.remoteArray, subqueryRemoteArray));
 };
-const setRecords = (hash, records, changed, materializeMs) => (s) => {
+/**
+* Commit a materialization. `answered`: it drew a known membership with no
+* body still to download, and that membership is still current (see
+* `QueryLifecycle`).
+*/
+const setRecords = (hash, records, changed, materializeMs, answered = false) => (s) => {
 	const next = withEntry(s, hash, (e) => {
 		const prev = e.telemetry.phaseSamples.localFetch ?? [];
 		const telemetry = {
@@ -3227,7 +3331,10 @@ const setRecords = (hash, records, changed, materializeMs) => (s) => {
 			...e,
 			records: changed ? records : e.records,
 			telemetry,
-			lifecycle: transition(e.lifecycle, { type: "notified" })
+			lifecycle: transition(e.lifecycle, {
+				type: "notified",
+				answered
+			})
 		};
 	});
 	return next === s ? s : {
@@ -3439,6 +3546,18 @@ const outboxBumpAttempts = (id) => (s) => {
 		outbox
 	};
 };
+/** Mark items whose last push may have committed although no answer came back. */
+const outboxMarkInDoubt = (ids) => (s) => {
+	const marked = new Set(ids);
+	if (!s.outbox.some((i) => marked.has(i.id) && !i.inDoubt)) return s;
+	return {
+		...s,
+		outbox: s.outbox.map((i) => marked.has(i.id) && !i.inDoubt ? {
+			...i,
+			inDoubt: true
+		} : i)
+	};
+};
 /** Drop acked items older than `graceMs` (membership never named them). */
 const outboxPruneAcked = (now, graceMs) => (s) => {
 	const stale = s.outbox.filter((i) => i.status === "acked" && i.ackedAt !== null && now - i.ackedAt >= graceMs);
@@ -3484,7 +3603,13 @@ const setIdentity = (patch) => (s) => ({
 	...s,
 	...patch
 });
-/** Re-home a query after a bucket switch: new store, same hash, fresh sync state. */
+/**
+* Re-home a query after a bucket switch: new store, same hash, fresh sync state.
+* `records` is kept: it is what subscribers were last handed, and the next
+* render diffs against it. Blanking it here (without telling anyone) let a
+* new store that renders `[]` read as unchanged, so the previous principal's
+* rows stayed on screen under an authority flip that vouched for them.
+*/
 const rebindQuery = (hash, next) => (s) => {
 	const rebound = withEntry(s, hash, (e) => ({
 		...e,
@@ -3496,7 +3621,6 @@ const rebindQuery = (hash, next) => (s) => {
 		remoteArray: next.remoteArray,
 		localArray: next.localArray,
 		subqueryRemoteArray: [],
-		records: [],
 		serverState: null,
 		lastHeartbeatAt: null,
 		lastPolledAt: null,
@@ -3729,6 +3853,7 @@ function toQueryState(e) {
 		viewLost: l.phase === "view-lost",
 		serverState: e.serverState,
 		syncNotified: l.notified,
+		answered: l.answered,
 		ttlTimer: null,
 		ttlDurationMs: e.def.ttlMs,
 		lastHeartbeatAt: e.lastHeartbeatAt ?? void 0,
@@ -4820,14 +4945,8 @@ function* applyMembership(hash, remoteArray, meta, verifiedRemoval) {
 		});
 		return outcome;
 	}
-	const wasAuthoritative = isAuthoritative(entry.lifecycle);
 	yield fx.state.update(commitMembership(hash, remoteArray, meta?.present ?? true));
 	yield* forgetDeparted(hash, departedIds(entry.remoteArray, remoteArray));
-	if (!wasAuthoritative) yield fx.emit({
-		type: "query:authority",
-		hash,
-		known: true
-	});
 	const now = yield fx.now();
 	try {
 		yield fx.local.upsert(VIEW_TABLE, viewRecordId(entry.def.viewKey), viewRow(remoteArray, entry.subqueryRemoteArray, true, now), "replace");
@@ -5790,6 +5909,8 @@ const ERR = (r) => r && r.status === "ERR" ? r.error : null;
 * A CRDT edit-log row (`<table>__crdt_log`) is written once and never changes,
 * so a CREATE retried after its first attempt committed (and only the answer
 * was lost) finds it already there: that is a success, not a rejection.
+* `remoteBatch` already makes such a CREATE a no-op on the server; this covers
+* a row the user may create but not read back, where that check cannot see it.
 */
 const isRepeatedLogCreate = (row, err) => row.mutationType === "create" && row.tableName.endsWith("__crdt_log") && /already exists/i.test(err);
 /**
@@ -5797,6 +5918,17 @@ const isRepeatedLogCreate = (row, err) => row.mutationType === "create" && row.t
 * per request, per-statement outcome. Accepted rows are acked (they stay in
 * the overlay until membership names them), rejected rows are rolled back,
 * a transport failure leaves the unsent tail queued behind a backoff timer.
+* The server stops a batch at its first failed statement (`remoteBatch`), so
+* the rows after a rejection are sent again at once, and a re-sent row behind
+* a retryable failure never ran before, so it cannot read "already exists".
+*
+* A request that throws a transport error (the push timeout, a dropped
+* socket) may still have committed on the server, and so may one sent by a
+* session that died before its answer. Those rows are marked in doubt
+* (`OutboxItem.inDoubt`, every row loaded from the store is), and their
+* re-sent CREATE accepts the row already on the server when it holds what the
+* CREATE would write, instead of failing "already exists" and rolling back a
+* write the server kept.
 */
 function* drain(env) {
 	for (;;) {
@@ -5818,7 +5950,7 @@ function* drain(env) {
 			else yield fx.state.update(outboxRemove(item.id));
 		}
 		if (rows.length === 0) continue;
-		const req = remoteBatch(rows);
+		const req = remoteBatch(rows, new Set(batch.filter((i) => i.inDoubt).map((i) => i.id)));
 		let results;
 		try {
 			const raw = yield fx.remote.query(req.sql, req.vars, env.pushTimeoutMs);
@@ -5837,7 +5969,7 @@ function* drain(env) {
 				continue;
 			}
 			const attempts = batch.find((i) => i.id === rows[0].id).attempts;
-			yield fx.state.update(outboxBumpAttempts(rows[0].id));
+			yield fx.state.update(compose(outboxMarkInDoubt(rows.map((row) => row.id)), outboxBumpAttempts(rows[0].id)));
 			yield fx.dispatch({
 				type: "SyncOutcome",
 				ok: false,
@@ -5852,6 +5984,7 @@ function* drain(env) {
 			const row = rows[i];
 			const r = results[i];
 			if (!r) {
+				yield fx.state.update(outboxMarkInDoubt(rows.slice(i).map((unanswered) => unanswered.id)));
 				cutAt = i;
 				break;
 			}
@@ -5889,6 +6022,7 @@ function* drain(env) {
 				});
 				continue;
 			}
+			if (err.includes(BATCH_SKIPPED)) break;
 			if (classifySyncError(new Error(err)) === "network") {
 				cutAt = i;
 				break;
@@ -6671,14 +6805,18 @@ const NONE = /* @__PURE__ */ new Set();
 * only writer of `records`. Runs on the `mat:<hash>` dedupe lane whenever the
 * query is dirty. Before the server has answered (`cold`) only bodies some
 * durable view vouches for paint (see `paintsCold`).
+*
+* Also the only place a query becomes answered (see `QueryLifecycle`): the
+* authority flip is emitted here, after the rows it vouches for.
 */
 function* materialize(hash) {
-	const [entry, ov, known] = yield fx.state.read((s) => {
+	const [entry, ov, known, complete] = yield fx.state.read((s) => {
 		const e = s.queries.get(hash);
 		return [
 			e,
 			overlay(s),
-			e?.lifecycle.phase === "cold" ? vouched(s) : NONE
+			e?.lifecycle.phase === "cold" ? vouched(s) : NONE,
+			needed(s, hash).length === 0
 		];
 	});
 	if (!entry) return;
@@ -6718,12 +6856,18 @@ function* materialize(hash) {
 	if (!current) return;
 	const t1 = yield fx.now();
 	const changed = !rowsEqual(rows, current.records);
-	yield fx.state.update(compose(setRecords(hash, rows, changed, t1 - t0), changed ? stampUpdated(hash, t1) : (s) => s));
+	const answered = complete && entry.lifecycle.phase !== "cold" && current.lifecycle.phase !== "cold" && current.remoteArray === entry.remoteArray;
+	yield fx.state.update(compose(setRecords(hash, rows, changed, t1 - t0, answered), changed ? stampUpdated(hash, t1) : (s) => s));
 	if (changed) yield fx.emit({
 		type: "query:records",
 		hash,
 		records: rows
 	});
+	if (answered && !isAnswered(current.lifecycle)) yield fx.emit({
+		type: "query:authority",
+		hash,
+		known: true
+	});
 }
 /**
 * A view update from the in-browser SSP: the query's local id-set moved.
@@ -7206,10 +7350,10 @@ function* rebindQueries() {
 			remoteArray: view?.ids ?? [],
 			localArray
 		}));
-		if (isAuthoritative(entry.lifecycle) !== isAuthoritative(lifecycle)) yield fx.emit({
+		if (isAnswered(entry.lifecycle)) yield fx.emit({
 			type: "query:authority",
 			hash: entry.def.hash,
-			known: isAuthoritative(lifecycle)
+			known: false
 		});
 	}
 }
@@ -7688,7 +7832,7 @@ var Runtime = class {
 		this.authoritySubs.set(hash, set);
 		if (options.immediate) {
 			const entry = this.stateValue.queries.get(hash);
-			if (entry) this.safely(() => cb(isAuthoritative(entry.lifecycle)));
+			if (entry) this.safely(() => cb(isAnswered(entry.lifecycle)));
 		}
 		return () => {
 			set.delete(cb);
@@ -15745,7 +15889,7 @@ function createTabsCoordinator(config, s, host) {
 	return new TabsCoordinator({
 		tabId: s.tabId,
 		fingerprint: computeTabsFingerprint({
-			coreVersion: "0.0.1-canary.333",
+			coreVersion: "0.0.1-canary.335",
 			schemaHash: hash53(config.schemaSurql),
 			endpoint: config.database.endpoint ?? "",
 			namespace: config.database.namespace,

package/dist/types.d.ts

@@ -2069,6 +2069,12 @@ interface QueryState {
    * always emits at least once even when its records are unchanged — otherwise
    * an empty re-registered window would never notify and stay "loading". */
   syncNotified?: boolean;
+  /**
+   * Subscribers hold the rows of a known membership (see `QueryLifecycle`'s
+   * `answered`): what the authority channel and the bindings'
+   * `isAuthoritative()` report. Ephemeral.
+   */
+  answered?: boolean;
   /** Timer for TTL expiration. */
   ttlTimer: NodeJS.Timeout | null;
   /** TTL duration in milliseconds. */
@@ -2147,9 +2153,12 @@ interface QueryTimings {
 type QueryUpdateCallback = (records: Record<string, any>[]) => void;
 type QueryStatusCallback = (status: QueryStatus) => void;
 /**
- * Observer for a query's authority flips: `true` once server membership is
- * known for it (registration, poll, durable seed), `false` when it is reset
- * (bucket switch). What the bindings' `isAuthoritative()` mirrors.
+ * Observer for a query's authority flips: `true` once subscribers hold the
+ * rendered rows of a known membership (a server answer whose bodies are
+ * local, or the durable membership of an earlier session), delivered after
+ * the rows that vouch for it; `false` when it is reset (bucket switch). Knowing the set is
+ * not enough: a `cached` re-seed or a just-applied server set has no rows
+ * painted yet. What the bindings' `isAuthoritative()` mirrors.
  */
 type QueryAuthorityCallback = (known: boolean) => void;
 type MutationCallback = (mutations: MutationEvent[]) => void;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@spooky-sync/core",
-  "version": "0.0.1-canary.333",
+  "version": "0.0.1-canary.335",
   "type": "module",
   "sideEffects": false,
   "main": "./dist/index.js",
@@ -75,8 +75,8 @@
     }
   },
   "dependencies": {
-    "@spooky-sync/query-builder": "0.0.1-canary.333",
-    "@spooky-sync/ssp-wasm": "0.0.1-canary.333",
+    "@spooky-sync/query-builder": "0.0.1-canary.335",
+    "@spooky-sync/ssp-wasm": "0.0.1-canary.335",
     "@sqlite.org/sqlite-wasm": "3.53.0-build1",
     "@surrealdb/wasm": "^3.1.0",
     "@surrealdb/wasm-native": "^3.3.4",

package/skills/sp00ky-core/SKILL.md

@@ -129,7 +129,12 @@ Use `debounced` option for frequent updates (e.g., live typing):
 
 A push the server rejects (permission, validation) is rolled back locally
 (create, update and delete) and moved to the `_00_failed_mutations` tray in the
-same local transaction. Network errors never do this; they retry. Inspect and
+same local transaction. Network errors never do this; they retry, and so does a
+write the server refused only because sp00ky's own ingest post to the scheduler
+failed (down, past its timeout, or answering 5xx). A create whose push answer
+was lost (timeout, dropped socket, a tab or app closed mid-push) is not rolled
+back when its retry finds the row it wrote already on the server; a row there
+with other content is still "already exists". Inspect and
 act on the tray with `db.failedMutationCount`, `db.subscribeToFailedMutations(cb)`,
 `db.listFailedMutations()`, `db.retryFailedMutation(id)` (a fresh optimistic
 write) and `db.discardFailedMutation(id)`.

package/src/boot/bucket-switch.saga.test.ts

@@ -158,9 +158,9 @@ describe('dropImpersonatedBucket', () => {
 });
 
 describe('rebindQueries', () => {
-  it('re-seeds from the new store, rebuilds the local view (tolerating failures), emits authority flips', async () => {
+  it('re-seeds from the new store, rebuilds the local view (tolerating failures), withdraws authority it held', async () => {
     const s = R.compose(
-      R.putQuery(buildEntry({ def: { hash: 'a' }, lifecycle: { phase: 'live' } })),
+      R.putQuery(buildEntry({ def: { hash: 'a' }, lifecycle: { phase: 'live', answered: true }, records: [{ id: 't:9' }] })),
       R.putQuery(buildEntry({ def: { hash: 'b' }, lifecycle: { phase: 'cold' } }))
     )({ ...buildState(), sessionId: 's' });
     const out = await runPure(rebindQueries(), {
@@ -177,11 +177,13 @@ describe('rebindQueries', () => {
       },
     });
     expect(out.state.queries.get('a')!.lifecycle.phase).toBe('cold');
-    expect(out.state.queries.get('b')!.lifecycle.phase).toBe('cached');
-    expect(out.emitted.filter((e) => e.type === 'query:authority')).toEqual([
-      { type: 'query:authority', hash: 'a', known: false },
-      { type: 'query:authority', hash: 'b', known: true },
-    ]);
+    expect(out.state.queries.get('b')!.lifecycle).toMatchObject({ phase: 'cached', answered: false });
+    // `b` found a durable view, but its rows are not painted until the
+    // render: announcing "known" here is what let an app read the empty
+    // `records` of a re-seed as "the user has none" and create a duplicate.
+    expect(out.emitted.filter((e) => e.type === 'query:authority')).toEqual([{ type: 'query:authority', hash: 'a', known: false }]);
+    expect(out.state.queries.get('a')!.records).toEqual([{ id: 't:9' }]);
+    expect([...out.state.dirty].sort()).toEqual(['a', 'b']);
     expect(out.emitted.some((e) => e.type === 'log')).toBe(true);
   });
 });

package/src/boot/bucket-switch.saga.ts

@@ -3,7 +3,7 @@ import type { Saga } from '../kernel/saga';
 import type { RegisterResult } from '../kernel/effects';
 import { fx } from '../kernel/effects';
 import type { ClientState, QueryEntry } from '../state/client-state';
-import { seedLifecycle, isAuthoritative } from '../state/lifecycle';
+import { seedLifecycle, isAnswered } from '../state/lifecycle';
 import * as R from '../state/reducers';
 import { ANON_USER_ID, bucketIdForUser } from '../modules/ref-tables';
 import type { SagaEnv } from '../query/env';
@@ -126,8 +126,11 @@ export function* rebindQueries(): Saga<void> {
     }
     const lifecycle = seedLifecycle(isResolvedBefore(view));
     yield fx.state.update(R.rebindQuery(entry.def.hash, { id: new RecordId('_00_query', hash), lifecycle, remoteArray: view?.ids ?? [], localArray }));
-    if (isAuthoritative(entry.lifecycle) !== isAuthoritative(lifecycle)) {
-      yield fx.emit({ type: 'query:authority', hash: entry.def.hash, known: isAuthoritative(lifecycle) });
+    // A re-seed is never answered, not even from a durable view: subscribers
+    // still hold the previous store's rows until `materialize` paints the new
+    // store's, and only that render flips authority back on.
+    if (isAnswered(entry.lifecycle)) {
+      yield fx.emit({ type: 'query:authority', hash: entry.def.hash, known: false });
     }
   }
 }