@spooky-sync/core 0.0.1-canary.333 → 0.0.1-canary.335

package/src/mutation/push.saga.ts

@@ -19,6 +19,7 @@ import {
   planRevert,
   remoteBatch,
   toOutboxItem,
+  BATCH_SKIPPED,
   FAILED_TABLE,
   type PendingMutationRow,
 } from './rows';
@@ -71,6 +72,8 @@ const ERR = (r: StatementResult | undefined): string | null => (r && r.status ==
  * A CRDT edit-log row (`<table>__crdt_log`) is written once and never changes,
  * so a CREATE retried after its first attempt committed (and only the answer
  * was lost) finds it already there: that is a success, not a rejection.
+ * `remoteBatch` already makes such a CREATE a no-op on the server; this covers
+ * a row the user may create but not read back, where that check cannot see it.
  */
 const isRepeatedLogCreate = (row: { mutationType: string; tableName: string }, err: string): boolean =>
   row.mutationType === 'create' && row.tableName.endsWith('__crdt_log') && /already exists/i.test(err);
@@ -80,6 +83,17 @@ const isRepeatedLogCreate = (row: { mutationType: string; tableName: string }, e
  * per request, per-statement outcome. Accepted rows are acked (they stay in
  * the overlay until membership names them), rejected rows are rolled back,
  * a transport failure leaves the unsent tail queued behind a backoff timer.
+ * The server stops a batch at its first failed statement (`remoteBatch`), so
+ * the rows after a rejection are sent again at once, and a re-sent row behind
+ * a retryable failure never ran before, so it cannot read "already exists".
+ *
+ * A request that throws a transport error (the push timeout, a dropped
+ * socket) may still have committed on the server, and so may one sent by a
+ * session that died before its answer. Those rows are marked in doubt
+ * (`OutboxItem.inDoubt`, every row loaded from the store is), and their
+ * re-sent CREATE accepts the row already on the server when it holds what the
+ * CREATE would write, instead of failing "already exists" and rolling back a
+ * write the server kept.
  */
 export function* drain(env: SagaEnv): Saga<void> {
   for (;;) {
@@ -102,12 +116,12 @@ export function* drain(env: SagaEnv): Saga<void> {
     }
     if (rows.length === 0) continue;
 
-    const req = remoteBatch(rows);
+    const req = remoteBatch(rows, new Set(batch.filter((i) => i.inDoubt).map((i) => i.id)));
     let results: StatementResult[];
     try {
       const raw = (yield fx.remote.query(req.sql, req.vars, env.pushTimeoutMs)) as unknown;
-      // A response without statement results is a transport fault: nothing
-      // ran, everything stays queued (handled as `!r` below).
+      // A response without statement results is a transport fault: every
+      // row stays queued, in doubt (handled as `!r` below).
       results = Array.isArray(raw) ? (raw as StatementResult[]) : [];
     } catch (error) {
       if (classifySyncError(error) === 'application') {
@@ -117,8 +131,9 @@ export function* drain(env: SagaEnv): Saga<void> {
         yield fx.dispatch({ type: 'SyncOutcome', ok: false, error });
         continue;
       }
+      // No answer: the server may have committed any prefix of the batch.
       const attempts = batch.find((i) => i.id === rows[0].id)!.attempts;
-      yield fx.state.update(R.outboxBumpAttempts(rows[0].id));
+      yield fx.state.update(R.compose(R.outboxMarkInDoubt(rows.map((row) => row.id)), R.outboxBumpAttempts(rows[0].id)));
       yield fx.dispatch({ type: 'SyncOutcome', ok: false, error });
       yield fx.timer.set('outbox', backoffMs(attempts), { type: 'Drain' });
       return;
@@ -130,7 +145,9 @@ export function* drain(env: SagaEnv): Saga<void> {
       const row = rows[i];
       const r = results[i];
       if (!r) {
-        // Statements after a transport-level cut: they never ran.
+        // Statements after a transport-level cut: no answer says whether
+        // they ran, so they are in doubt.
+        yield fx.state.update(R.outboxMarkInDoubt(rows.slice(i).map((unanswered) => unanswered.id)));
         cutAt = i;
         break;
       }
@@ -147,6 +164,9 @@ export function* drain(env: SagaEnv): Saga<void> {
         yield fx.emit({ type: 'tabs:broadcast', message: { type: 'mutation-settled', mutationId: row.id, recordId: row.recordId, eventType: row.mutationType } });
         continue;
       }
+      // An earlier statement in this batch was rejected (or was a repeated
+      // log row), so this one never ran: the next round sends it again.
+      if (err.includes(BATCH_SKIPPED)) break;
       if (classifySyncError(new Error(err)) === 'network') {
         cutAt = i;
         break;

package/src/mutation/rows.test.ts

@@ -60,6 +60,8 @@ describe('parsePendingRow', () => {
       status: 'pending',
       ackedAt: null,
       attempts: 0,
+      // A row read back from the store may have been sent by a session that died.
+      inDoubt: true,
     });
     expect(rows.loadPendingRows()).toBe('SELECT * FROM _00_pending_mutations ORDER BY id ASC');
     expect(rows.loadFailedRows()).toBe('SELECT * FROM _00_failed_mutations ORDER BY failedAt ASC');
@@ -143,7 +145,14 @@ describe('remoteBatch', () => {
       { id: 'm3', mutationType: 'delete', recordId: 'thing:3', tableName: 'thing', createdAt: 0, v: 2 },
       { id: 'm4', mutationType: 'update', recordId: 'thing:4', tableName: 'thing', createdAt: 0, v: 2 },
     ]);
-    expect(sql).toBe('CREATE ONLY $id0 SET a = $d0_a;\nUPDATE $id1 MERGE $data1;\nDELETE $id2;\nUPDATE $id3 MERGE $data3');
+    // Chained: each statement runs only if the one before it committed.
+    const skip = `IF !$ok0 { THROW "${rows.BATCH_SKIPPED}" }; `;
+    expect(sql.split(';\n')).toEqual([
+      'LET $ok0 = { CREATE ONLY $id0 SET a = $d0_a; true }',
+      `LET $ok1 = { ${skip}UPDATE $id1 MERGE $data1; true }`,
+      `LET $ok2 = { ${skip.replace('$ok0', '$ok1')}DELETE $id2; true }`,
+      `LET $ok3 = { ${skip.replace('$ok0', '$ok2')}UPDATE $id3 MERGE $data3; true }`,
+    ]);
     expect(vars).toEqual({
       id0: rid('thing', '1'),
       d0_a: 1,
@@ -153,7 +162,45 @@ describe('remoteBatch', () => {
       id3: rid('thing', '4'),
       data3: {},
     });
-    expect(rows.remoteBatch([{ id: 'm', mutationType: 'create', recordId: 'thing:9', tableName: 'thing', createdAt: 0, v: 2 }]).sql).toBe('CREATE ONLY $id0 SET ');
+    expect(rows.remoteBatch([{ id: 'm', mutationType: 'create', recordId: 'thing:9', tableName: 'thing', createdAt: 0, v: 2 }]).sql).toBe('LET $ok0 = { CREATE ONLY $id0 SET ; true }');
+  });
+
+  it('an in-doubt CREATE is a no-op when the server row matches every field no later in-doubt row of it may have changed', () => {
+    const row = (id: string, mutationType: rows.PendingMutationRow['mutationType'], recordId: string, data?: Record<string, unknown>): rows.PendingMutationRow => ({
+      id,
+      mutationType,
+      recordId,
+      tableName: recordId.split(':')[0],
+      data,
+      createdAt: 0,
+      v: 2,
+    });
+    const was = (i: number, ...keys: string[]) =>
+      `LET $was${i} = (SELECT * FROM ONLY $id${i}); IF ${[`($was${i} = NONE)`, ...keys.map((k) => `($was${i}.${k} != $d${i}_${k})`)].join(' OR ')} { CREATE ONLY $id${i} SET ${['a', 'b']
+        .map((k) => `${k} = $d${i}_${k}`)
+        .join(', ')} }`;
+    const statement = (sql: string, i: number) => sql.split(';\n')[i].replace(/^LET \$ok\d+ = \{ (IF !\$ok\d+ \{ THROW "[^"]+" \}; )?/, '').replace(/; true \}$/, '');
+    const batch = [
+      row('m1', 'create', 'thing:1', { a: 1, b: 1 }),
+      row('m2', 'update', 'thing:1', { b: 2 }),
+      row('m3', 'create', 'thing:2', { a: 1, b: 1 }),
+      row('m4', 'update', 'thing:2', { a: 2 }), // not in doubt: it never ran
+      row('m5', 'create', 'thing:3', { a: 1, b: 1 }),
+      row('m6', 'delete', 'thing:3'),
+      row('m7', 'create', 'thing:4', { a: 1, b: 1 }),
+      row('m8', 'update', 'thing:9', { a: 2 }), // another record
+      row('m9', 'update', 'thing:1'), // no payload: changes nothing
+    ];
+    const { sql } = rows.remoteBatch(batch, new Set(['m1', 'm2', 'm3', 'm5', 'm6', 'm8', 'm9']));
+    expect(statement(sql, 0)).toBe(was(0, 'a')); // b may be m2's
+    expect(statement(sql, 2)).toBe(was(2, 'a', 'b'));
+    expect(statement(sql, 4)).toBe(was(4)); // m6 may have deleted it and something else re-created it
+    expect(statement(sql, 6)).toBe('CREATE ONLY $id6 SET a = $d6_a, b = $d6_b'); // not in doubt: strict
+    // A CRDT log row's id is fresh and the row immutable: existence is proof, in doubt or not.
+    expect(statement(rows.remoteBatch([row('l', 'create', 'doc__crdt_log:1', { a: 1, b: 1 })]).sql, 0)).toBe(was(0));
+    expect(statement(rows.remoteBatch([row('e', 'create', 'thing:5')], new Set(['e'])).sql, 0)).toBe(
+      'LET $was0 = (SELECT * FROM ONLY $id0); IF ($was0 = NONE) { CREATE ONLY $id0 SET  }'
+    );
   });
 });
 

package/src/mutation/rows.ts

@@ -109,6 +109,11 @@ export function hydrateRowData(row: PendingMutationRow, columns: Record<string,
   }
 }
 
+/**
+ * A row read back from the store at boot, bucket switch or leader takeover.
+ * The session that queued it may have sent it and died before the answer (a
+ * closed tab, a killed app, a lost leader), so its outcome is in doubt.
+ */
 export const toOutboxItem = (row: PendingMutationRow): OutboxItem => ({
   id: row.id,
   type: row.mutationType,
@@ -117,6 +122,7 @@ export const toOutboxItem = (row: PendingMutationRow): OutboxItem => ({
   status: 'pending',
   ackedAt: null,
   attempts: 0,
+  inDoubt: true,
 });
 
 /**
@@ -286,29 +292,95 @@ export interface RemoteBatch {
 }
 
 /**
- * Many outbox rows as ONE multi-statement request. Statement i answers row i.
- * Each statement is its own transaction on the server, as before.
+ * What a statement of a `remoteBatch` throws instead of running, because an
+ * earlier statement in the same request failed.
  */
-export function remoteBatch(rows: ReadonlyArray<PendingMutationRow>): RemoteBatch {
-  const vars: Vars = {};
-  const stmts = rows.map((row, i) => {
-    const rid = parseRecordIdString(row.recordId);
-    vars[`id${i}`] = rid;
-    switch (row.mutationType) {
-      case 'create': {
-        const data = row.data ?? {};
-        const sets = Object.keys(data).map((key) => {
-          vars[`d${i}_${key}`] = data[key];
-          return `${key} = $d${i}_${key}`;
-        });
-        return `CREATE ONLY $id${i} SET ${sets.join(', ')}`;
-      }
-      case 'update':
-        vars[`data${i}`] = row.data ?? {};
-        return `UPDATE $id${i} MERGE $data${i}`;
-      case 'delete':
-        return `DELETE $id${i}`;
+export const BATCH_SKIPPED = 'sp00ky: not run, an earlier statement in this batch failed';
+
+/** A CRDT edit-log row (`<table>__crdt_log`): written once under a fresh id, never changed. */
+const isLogTable = (table: string): boolean => table.endsWith('__crdt_log');
+
+/**
+ * Which fields of the row already on the server must equal the payload of the
+ * CREATE at `i` for that row to count as this CREATE's own earlier commit, or
+ * `null` when the CREATE must not tolerate an existing row at all.
+ *
+ * Only a CREATE whose outcome is in doubt tolerates one: elsewhere "already
+ * exists" means someone else holds the id, a rejection as before. The check
+ * is every payload field except those a later in-doubt row of the same
+ * record, which may have committed in the same lost round, could have changed
+ * since; those rows run again after it and set them anyway. A later in-doubt
+ * DELETE or CREATE of the record may have replaced the row, so then existence
+ * is all that is checked. Rows that are not in doubt never ran.
+ *
+ * A CRDT log row's id is fresh and the row immutable, so its existence is
+ * proof enough, in doubt or not.
+ */
+function matchFields(rows: ReadonlyArray<PendingMutationRow>, i: number, inDoubt: ReadonlySet<string>): string[] | null {
+  const row = rows[i];
+  if (isLogTable(row.tableName)) return [];
+  if (!inDoubt.has(row.id)) return null;
+  const changed = new Set<string>();
+  for (const later of rows.slice(i + 1)) {
+    if (later.recordId !== row.recordId || !inDoubt.has(later.id)) continue;
+    if (later.mutationType !== 'update') return [];
+    for (const key of Object.keys(later.data ?? {})) changed.add(key);
+  }
+  return Object.keys(row.data ?? {}).filter((key) => !changed.has(key));
+}
+
+function remoteStatement(rows: ReadonlyArray<PendingMutationRow>, i: number, vars: Vars, inDoubt: ReadonlySet<string>): string {
+  const row = rows[i];
+  vars[`id${i}`] = parseRecordIdString(row.recordId);
+  switch (row.mutationType) {
+    case 'create': {
+      const data = row.data ?? {};
+      const sets = Object.keys(data).map((key) => {
+        vars[`d${i}_${key}`] = data[key];
+        return `${key} = $d${i}_${key}`;
+      });
+      const create = `CREATE ONLY $id${i} SET ${sets.join(', ')}`;
+      const match = matchFields(rows, i, inDoubt);
+      if (!match) return create;
+      // The CREATE runs unless the row is there and matches; on a mismatch it
+      // fails with SurrealDB's own "already exists", a rejection as before.
+      const differs = [`($was${i} = NONE)`, ...match.map((key) => `($was${i}.${key} != $d${i}_${key})`)];
+      return `LET $was${i} = (SELECT * FROM ONLY $id${i}); IF ${differs.join(' OR ')} { ${create} }`;
     }
+    case 'update':
+      vars[`data${i}`] = row.data ?? {};
+      return `UPDATE $id${i} MERGE $data${i}`;
+    case 'delete':
+      return `DELETE $id${i}`;
+  }
+}
+
+/**
+ * Many outbox rows as ONE multi-statement request. Statement i answers row i
+ * and is its own transaction on the server, as before, but the statements are
+ * chained: statement i binds `$ok<i>` only when it commits, and statement i+1
+ * throws `BATCH_SKIPPED` without touching anything unless `$ok<i>` is bound
+ * (a LET lives for one request only). So the server stops at the first
+ * failure: everything before it is committed, nothing after it ran.
+ *
+ * Without the chain, statements after a failed one ran anyway. A retryable
+ * failure at i left the rows after i queued although they had committed; the
+ * re-sent CREATE then read "already exists", was taken for a rejection and
+ * rolled back locally while the server kept the row. Acking them instead
+ * would have let a later write land before an earlier one it may depend on.
+ *
+ * The chain cannot help when the answer itself is lost: the request may have
+ * committed any prefix of the batch. Rows named in `inDoubt` (mutation ids)
+ * are such rows. An UPDATE MERGE or a DELETE is safe to run twice, a CREATE
+ * is not, so an in-doubt CREATE checks the row already there first (see
+ * `matchFields`) and is a no-op when it is its own: the batch goes on in
+ * order, with no "already exists" to cut it.
+ */
+export function remoteBatch(rows: ReadonlyArray<PendingMutationRow>, inDoubt: ReadonlySet<string> = new Set()): RemoteBatch {
+  const vars: Vars = {};
+  const stmts = rows.map((_, i) => {
+    const guard = i === 0 ? '' : `IF !$ok${i - 1} { THROW "${BATCH_SKIPPED}" }; `;
+    return `LET $ok${i} = { ${guard}${remoteStatement(rows, i, vars, inDoubt)}; true }`;
   });
   return { sql: stmts.join(';\n'), vars };
 }

package/src/query/materialize.saga.test.ts

@@ -97,6 +97,79 @@ describe('materialize', () => {
   });
 });
 
+describe('materialize answers the query', () => {
+  const plan = { table: 'thing' } as any;
+  const byIds = { 'local.select': (e: any) => (e.plan.ids ?? []).map((id: any) => ({ id: `${id.table}:${id.id}` })) };
+  const authority = (out: { emitted: Array<{ type: string }> }) => out.emitted.filter((e) => e.type === 'query:authority');
+
+  it('a cached re-seed: rows first, then authority; the next render flips nothing', async () => {
+    // The bucket-switch window: a durable view was found, `records` is not
+    // painted yet. Authority comes from this render, after the rows.
+    const s = R.markDirty(['a'])(
+      buildState([buildEntry({ def: { hash: 'a', plan }, lifecycle: { phase: 'cached' }, remoteArray: [['thing:1', 1]] })])
+    );
+    const out = await runPure(materialize('a'), { state: s, handlers: byIds });
+    expect(out.state.queries.get('a')!.lifecycle).toMatchObject({ phase: 'cached', notified: true, answered: true });
+    expect(out.emitted).toEqual([
+      { type: 'query:records', hash: 'a', records: [{ id: 'thing:1' }] },
+      { type: 'query:authority', hash: 'a', known: true },
+    ]);
+    const again = await runPure(materialize('a'), { state: R.markDirty(['a'])(out.state), handlers: byIds });
+    expect(again.emitted).toEqual([]);
+  });
+
+  it('a known empty set answers without a rows emission', async () => {
+    const s = buildState([buildEntry({ def: { hash: 'a', plan }, lifecycle: { phase: 'live' }, remoteArray: [] })]);
+    const out = await runPure(materialize('a'), { state: s, handlers: byIds });
+    expect(out.emitted).toEqual([{ type: 'query:authority', hash: 'a', known: true }]);
+  });
+
+  it('a cold render never answers', async () => {
+    const s = buildState([buildEntry({ def: { hash: 'a', plan } })], R.reloadViews(new Map([['v', ['thing:1']]])));
+    const out = await runPure(materialize('a'), { state: s, handlers: { 'local.select': () => [{ id: 'thing:1' }] } });
+    expect(out.state.queries.get('a')!.lifecycle).toMatchObject({ notified: true, answered: false });
+    expect(authority(out)).toEqual([]);
+  });
+
+  it('a server set whose bodies are still downloading is not an answer yet', async () => {
+    const s = buildState(
+      [buildEntry({ def: { hash: 'a', plan }, lifecycle: { phase: 'live' }, remoteArray: [['thing:1', 1], ['thing:2', 1]] })],
+      R.setVersions([['thing:1', 1]])
+    );
+    const out = await runPure(materialize('a'), { state: s, handlers: byIds });
+    expect(out.state.queries.get('a')!.lifecycle.answered).toBe(false);
+    expect(authority(out)).toEqual([]);
+    const landed = await runPure(materialize('a'), { state: R.setVersions([['thing:2', 1]])(out.state), handlers: byIds });
+    expect(landed.state.queries.get('a')!.lifecycle.answered).toBe(true);
+    expect(authority(landed)).toEqual([{ type: 'query:authority', hash: 'a', known: true }]);
+  });
+
+  it('a membership replaced while the read was out does not answer: the next render does', async () => {
+    const s = buildState([buildEntry({ def: { hash: 'a', plan }, lifecycle: { phase: 'cached' }, remoteArray: [['thing:1', 1]] })]);
+    const out = await runPure(materialize('a'), {
+      state: s,
+      handlers: {
+        'local.select': (e: any, ctx) => {
+          ctx.state = R.rebindQuery('a', { id: new RecordId('_00_query', 'b'), lifecycle: { phase: 'cached', remote: 'unregistered', fetchDepth: 0, backgroundDepth: 0, notified: false, answered: false }, remoteArray: [['thing:2', 1]], localArray: [] })(ctx.state);
+          return byIds['local.select'](e);
+        },
+      },
+    });
+    expect(out.state.queries.get('a')!.lifecycle.answered).toBe(false);
+    expect(authority(out)).toEqual([]);
+  });
+
+  it('after a rebind, a new store that renders nothing clears what the old principal painted', async () => {
+    const s = buildState([buildEntry({ def: { hash: 'a', plan }, lifecycle: { phase: 'live', answered: true }, remoteArray: [['thing:1', 1]], records: [{ id: 'thing:1' }] })]);
+    const rebound = R.rebindQuery('a', { id: new RecordId('_00_query', 'b'), lifecycle: { phase: 'cached', remote: 'unregistered', fetchDepth: 0, backgroundDepth: 0, notified: false, answered: false }, remoteArray: [], localArray: [] })(s);
+    const out = await runPure(materialize('a'), { state: rebound, handlers: byIds });
+    expect(out.emitted).toEqual([
+      { type: 'query:records', hash: 'a', records: [] },
+      { type: 'query:authority', hash: 'a', known: true },
+    ]);
+  });
+});
+
 describe('streamUpdate', () => {
   it('takes the local id-set (dirtying the query) and records ingest timings; unknown hashes are ignored', async () => {
     const s = buildState([buildEntry({ def: { hash: 'a' } })]);

package/src/query/materialize.saga.ts

@@ -4,7 +4,8 @@ import type { Saga } from '../kernel/saga';
 import { fx } from '../kernel/effects';
 import type { QueryEntry } from '../state/client-state';
 import * as R from '../state/reducers';
-import { overlay, vouched } from '../state/selectors';
+import { needed, overlay, vouched } from '../state/selectors';
+import { isAnswered } from '../state/lifecycle';
 import type { Overlay } from '../state/selectors';
 import { isWindowed, materializeEffect, rowKey, rowsEqual, rowsFromResult } from './materialize';
 import { buildRenderIds, paintsCold, resolveMembership } from './render-set';
@@ -17,12 +18,15 @@ const NONE: ReadonlySet<string> = new Set();
  * only writer of `records`. Runs on the `mat:<hash>` dedupe lane whenever the
  * query is dirty. Before the server has answered (`cold`) only bodies some
  * durable view vouches for paint (see `paintsCold`).
+ *
+ * Also the only place a query becomes answered (see `QueryLifecycle`): the
+ * authority flip is emitted here, after the rows it vouches for.
  */
 export function* materialize(hash: QueryHash): Saga<void> {
-  const [entry, ov, known] = (yield fx.state.read((s) => {
+  const [entry, ov, known, complete] = (yield fx.state.read((s) => {
     const e = s.queries.get(hash);
-    return [e, overlay(s), e?.lifecycle.phase === 'cold' ? vouched(s) : NONE];
-  })) as [QueryEntry | undefined, Overlay, ReadonlySet<string>];
+    return [e, overlay(s), e?.lifecycle.phase === 'cold' ? vouched(s) : NONE, needed(s, hash).length === 0];
+  })) as [QueryEntry | undefined, Overlay, ReadonlySet<string>, boolean];
   if (!entry) return;
   const t0 = (yield fx.now()) as number;
   const isWindow = isWindowed(entry.def.surql);
@@ -54,10 +58,18 @@ export function* materialize(hash: QueryHash): Saga<void> {
   if (!current) return;
   const t1 = (yield fx.now()) as number;
   const changed = !rowsEqual(rows, current.records);
+  // These rows answer the query when they drew a known membership with no
+  // body of a server set still to download, and that membership is still
+  // the one in state. A server set applied, or a bucket switch, while the
+  // read was out dirtied the query again: the next render answers instead.
+  const answered =
+    complete && entry.lifecycle.phase !== 'cold' && current.lifecycle.phase !== 'cold' && current.remoteArray === entry.remoteArray;
   yield fx.state.update(
-    R.compose(R.setRecords(hash, rows, changed, t1 - t0), changed ? R.stampUpdated(hash, t1) : (s) => s)
+    R.compose(R.setRecords(hash, rows, changed, t1 - t0, answered), changed ? R.stampUpdated(hash, t1) : (s) => s)
   );
   if (changed) yield fx.emit({ type: 'query:records', hash, records: rows });
+  // After the rows: a subscriber told "known" must already hold them.
+  if (answered && !isAnswered(current.lifecycle)) yield fx.emit({ type: 'query:authority', hash, known: true });
 }
 
 /**

package/src/query/membership.saga.test.ts

@@ -72,7 +72,7 @@ describe('applyMembership', () => {
     expect(out.result).toBe('ignored');
     expect(out.state.queries.get('a')!).toMatchObject({ viewLostCount: 0, viewLostRetryAt: null });
   });
-  it('applied: commits, writes the view row, flips authority once, releases acked items, asks for bodies', async () => {
+  it('applied: commits, writes the view row, releases acked items, asks for bodies; authority waits for the render', async () => {
     const s = buildState(
       [buildEntry({ def: { hash: 'a', viewKey: 'vk' }, lifecycle: { phase: 'cold' }, subqueryRemoteArray: [['c:1', 1]] })],
       R.outboxReplace([buildOutboxItem({ id: 'm', recordId: 't:1', status: 'acked', ackedAt: 1 })])
@@ -81,7 +81,10 @@ describe('applyMembership', () => {
     expect(out.result).toBe('applied');
     expect(out.state.queries.get('a')!.lifecycle.phase).toBe('live');
     expect(out.state.outbox).toEqual([]);
-    expect(out.emitted).toEqual([{ type: 'query:authority', hash: 'a', known: true }]);
+    // The set is known, but no row of it is painted: `materialize` flips authority.
+    expect(out.emitted).toEqual([]);
+    expect(out.state.queries.get('a')!.lifecycle.answered).toBe(false);
+    expect(out.state.dirty.has('a')).toBe(true);
     expect(out.log.find((e) => e.kind === 'local.upsert')).toEqual({
       kind: 'local.upsert',
       table: '_00_view',

package/src/query/membership.saga.ts

@@ -10,7 +10,6 @@ import {
   backoffMs,
 } from '../kernel/constants';
 import type { ClientState, QueryEntry } from '../state/client-state';
-import { isAuthoritative } from '../state/lifecycle';
 import * as R from '../state/reducers';
 import { encodeRecordId } from '../utils/index';
 import { departedIds } from '../state/selectors';
@@ -88,10 +87,10 @@ export function* applyMembership(
     yield fx.timer.set(`view-lost:${hash}`, delay, { type: 'RecoverLostView', hash });
     return outcome;
   }
-  const wasAuthoritative = isAuthoritative(entry.lifecycle);
   yield fx.state.update(R.commitMembership(hash, remoteArray, meta?.present ?? true));
   yield* forgetDeparted(hash, departedIds(entry.remoteArray, remoteArray));
-  if (!wasAuthoritative) yield fx.emit({ type: 'query:authority', hash, known: true });
+  // No authority flip here: the set is known but its rows are not painted
+  // yet (bodies may still be on their way). `materialize` flips it once they are.
   const now = (yield fx.now()) as number;
   try {
     yield fx.local.upsert(

package/src/query/register.saga.test.ts

@@ -154,7 +154,8 @@ describe('registerRemote', () => {
     expect(req.sql.startsWith('fn::query::register($config);')).toBe(true);
     expect(req.vars.config).toMatchObject({ surql: entry.def.surql, ttl: '10m' });
     expect(out.dispatched).toEqual([{ type: 'FetchRows' }, { type: 'FetchRows' }, { type: 'SyncOutcome', ok: true }]);
-    expect(out.emitted).toContainEqual({ type: 'query:authority', hash: 'a', known: true });
+    // Authority follows the render of these rows, not the registration.
+    expect(out.emitted.some((ev) => ev.type === 'query:authority')).toBe(false);
   });
   it('a cold registration is foreground; a cached or live one is background', async () => {
     for (const [phase, background] of [['cold', 0], ['cached', 1], ['live', 1]] as const) {

package/src/state/client-state.ts

@@ -79,6 +79,14 @@ export interface OutboxItem {
   readonly status: OutboxStatus;
   readonly ackedAt: number | null;
   readonly attempts: number;
+  /**
+   * A request carrying this row may have committed without the answer
+   * reaching this client: it threw a transport error, or the row was loaded
+   * from the store, so a session that died mid-push may have sent it. Its
+   * CREATE then accepts the row already on the server when that row holds
+   * what it would write (see `remoteBatch`). Absent means false.
+   */
+  readonly inDoubt?: boolean;
 }
 
 export type TabRole = 'solo' | 'leader' | 'follower';

package/src/state/lifecycle.test.ts

@@ -1,6 +1,6 @@
 import { describe, expect, it } from 'vitest';
 import type { LifecycleEvent, QueryLifecycle, QueryPhase } from './lifecycle';
-import { deriveStatus, hasServerMembership, isAuthoritative, isForegroundFetching, LifecycleError, seedLifecycle, transition } from './lifecycle';
+import { deriveStatus, hasServerMembership, isAnswered, isAuthoritative, isForegroundFetching, LifecycleError, seedLifecycle, transition } from './lifecycle';
 
 const at = (phase: QueryPhase, over: Partial<QueryLifecycle> = {}): QueryLifecycle => ({
   phase,
@@ -8,6 +8,7 @@ const at = (phase: QueryPhase, over: Partial<QueryLifecycle> = {}): QueryLifecyc
   fetchDepth: 0,
   backgroundDepth: 0,
   notified: false,
+  answered: false,
   ...over,
 });
 
@@ -33,8 +34,48 @@ describe('transition table (phase axis)', () => {
     expect(transition(at('view-lost'), { type: 'row-missing' }).phase).toBe('view-lost');
   });
   it('bucket-switch reseeds and clears fetch depth', () => {
-    const l = transition(at('live', { fetchDepth: 3, notified: true }), { type: 'bucket-switch', resolvedBefore: true });
-    expect(l).toEqual({ phase: 'cached', remote: 'unregistered', fetchDepth: 0, backgroundDepth: 0, notified: false });
+    const l = transition(at('live', { fetchDepth: 3, notified: true, answered: true }), { type: 'bucket-switch', resolvedBefore: true });
+    expect(l).toEqual({ phase: 'cached', remote: 'unregistered', fetchDepth: 0, backgroundDepth: 0, notified: false, answered: false });
+  });
+});
+
+describe('answered', () => {
+  it('a seed is never answered, not even a cached one: its rows are not painted yet', () => {
+    expect(seedLifecycle(true)).toMatchObject({ phase: 'cached', answered: false });
+    expect(isAnswered(seedLifecycle(true))).toBe(false);
+    expect(isAuthoritative(seedLifecycle(true))).toBe(true);
+  });
+  it('only a render of a known membership answers; a cold render is a guess', () => {
+    expect(transition(at('cold'), { type: 'notified', answered: true }).answered).toBe(false);
+    expect(transition(at('cached'), { type: 'notified' }).answered).toBe(false);
+    expect(transition(at('cached'), { type: 'notified', answered: false })).toMatchObject({ notified: true, answered: false });
+    for (const p of ['cached', 'live', 'view-lost'] as const) {
+      expect(transition(at(p), { type: 'notified', answered: true })).toMatchObject({ notified: true, answered: true });
+    }
+  });
+  it('latched through membership, a reconnect and a lost view; cleared by a re-seed', () => {
+    let l = transition(at('cached'), { type: 'notified', answered: true });
+    l = transition(l, { type: 'membership-applied', present: true });
+    expect(l).toMatchObject({ phase: 'live', answered: true });
+    l = transition(l, { type: 'notified', answered: false });
+    expect(l.answered).toBe(true);
+    l = transition(l, { type: 'remote-dropped' });
+    expect(l).toMatchObject({ notified: false, answered: true });
+    l = transition(l, { type: 'row-missing' });
+    expect(l).toMatchObject({ phase: 'view-lost', answered: true });
+    expect(transition(l, { type: 'bucket-switch', resolvedBefore: true }).answered).toBe(false);
+    expect(transition(l, { type: 'seed', resolvedBefore: true }).answered).toBe(false);
+  });
+  it('a server set applied to a cold query is not an answer until its render', () => {
+    const l = transition(at('cold'), { type: 'membership-applied', present: true });
+    expect(l).toMatchObject({ phase: 'live', answered: false });
+    expect(isAuthoritative(l)).toBe(true);
+    expect(isAnswered(l)).toBe(false);
+  });
+  it('an unchanged notified keeps identity', () => {
+    const l = transition(at('live'), { type: 'notified', answered: true });
+    expect(transition(l, { type: 'notified', answered: true })).toBe(l);
+    expect(transition(l, { type: 'notified' })).toBe(l);
   });
 });
 
@@ -111,6 +152,7 @@ describe('invariants over random event sequences', () => {
     { type: 'fetch-begin', background: true },
     { type: 'fetch-end', background: true },
     { type: 'notified' },
+    { type: 'notified', answered: true },
     { type: 'bucket-switch', resolvedBefore: false },
     { type: 'seed', resolvedBefore: true },
   ];
@@ -135,6 +177,7 @@ describe('invariants over random event sequences', () => {
         expect(l.backgroundDepth).toBeLessThanOrEqual(l.fetchDepth);
         if (ev.type === 'row-missing' && before.phase === 'cold') expect(l.phase).toBe('cold');
         if (l.phase === 'view-lost') expect(before.phase).not.toBe('cold');
+        if (l.answered) expect(l.phase).not.toBe('cold');
       }
     }
   });