@spooky-sync/core 0.0.1-canary.350 → 0.0.1-canary.352

package/dist/index.d.ts

@@ -919,6 +919,9 @@ type RuntimeEvent = {
   type: 'RegisterRemote';
   hash: QueryHash;
   retry?: boolean;
+} | {
+  type: 'ReleaseSuperseded';
+  ids: RecordId$1<string>[];
 } | {
   type: 'SyncOutcome';
   ok: boolean;
@@ -1252,6 +1255,8 @@ interface ServiceCalls {
   /** The platform reports no network at all (a browser's `navigator.onLine === false`). */
   'net.offline': () => boolean;
   'remote.releaseViews': (ids: unknown[]) => void;
+  /** `session::id()` of every socket this page has had, oldest first. */
+  'remote.sessionIds': () => readonly string[];
   'supervisor.start': () => void;
   'tabs.start': (bucketId: string) => Promise<'solo' | 'leader' | 'follower'>;
   'tabs.moveToBucket': (bucketId: string) => Promise<'solo' | 'leader' | 'follower'>;

package/dist/index.js

@@ -2126,7 +2126,7 @@ var FlagsAdminService = class {
 	}
 	/**
 	* Add or remove a user from `$key`'s allowlist for `$variant`, then
-	* re-materialize. Defaults to the signed-in user, so the common case
+	* re-evaluate that one user (nobody else's variant can change). Defaults to the signed-in user, so the common case
 	* ("turn this on for me, for real") needs no user picker.
 	*/
 	async setFlagUserVariant(key, variant, remove, userId) {
@@ -2286,8 +2286,8 @@ function trimHistory(history, cap) {
 
 //#endregion
 //#region src/modules/devtools/index.ts
-const CORE_VERSION = "0.0.1-canary.350";
-const WASM_VERSION = "0.0.1-canary.350";
+const CORE_VERSION = "0.0.1-canary.352";
+const WASM_VERSION = "0.0.1-canary.352";
 const SURREAL_VERSION = "3.1.0";
 var DevToolsService = class DevToolsService {
 	version = CORE_VERSION;
@@ -4480,6 +4480,24 @@ function heartbeatBatch(ids) {
 		vars
 	};
 }
+/**
+* Hand back view ids this page no longer answers to. Per id,
+* `fn::query::unsubscribe` drops this socket's entry and deletes the row when
+* nobody else watches it; `fn::query::leave` then drops the entries of this
+* page's earlier sockets (a reconnect re-registered under a new session id)
+* and pulls the expiry in when none remain. Result index 2i answers the
+* unsubscribe of id i, 2i + 1 its leave.
+*/
+function releaseBatch(ids, sessionIds) {
+	const vars = { sids: [...sessionIds] };
+	return {
+		sql: ids.flatMap((id, i) => {
+			vars[`id${i}`] = id;
+			return [`fn::query::unsubscribe($id${i})`, `fn::query::leave($id${i}, $sids)`];
+		}).join(";\n"),
+		vars
+	};
+}
 /** A heartbeat answer whose statement matched no row: the view was reclaimed. */
 const heartbeatRowGone = (result) => Array.isArray(result) && result.length === 0;
 const QUERY_ID = /^_00_query:(?:[0-9a-f]{64}|⟨[0-9a-f]{64}⟩)$/;
@@ -5281,10 +5299,39 @@ const stmt = (results, i) => results[i];
 */
 const isNotAllowlisted = (error) => /not_allowlisted|\b403\b|forbidden/i.test(String(error?.message ?? error));
 /**
+* The entry no longer names the remote id this registration sent: a salt
+* rotation (`rebindQueries`) re-keyed it while the request was out, and
+* seeded a fresh lifecycle for the new id.
+*/
+const movedOff = (current, sent) => String(current.def.id) !== String(sent.def.id);
+/**
+* Release the id a superseded registration sent and register the new one.
+* The re-key's own `RegisterRemote` for this hash joined the run still in
+* flight (the lane dedupes per hash), so it is armed again on a timer, which
+* fires once this run has left the lane.
+*/
+function* handOff(hash, sent) {
+	yield fx.dispatch({
+		type: "ReleaseSuperseded",
+		ids: [sent.def.id]
+	});
+	yield fx.timer.set(`register:${hash}`, 0, {
+		type: "RegisterRemote",
+		hash
+	});
+}
+/**
 * One remote registration: `fn::query::register` plus the edge/meta/children
 * read in ONE request, then membership application. Concurrent with every
 * other registration; retried on its own backoff; stops when the entry is
 * gone.
+*
+* An answer that lands after the query moved to a new id applies nothing:
+* the membership and the `registered` flag belong to the id it sent, which
+* this page no longer uses, so it releases that id and leaves the new one to
+* the registration the re-key dispatched. Marking the new id registered from
+* the old id's answer meant the new id was never registered, and nothing
+* ever named the old one again.
 */
 function* registerRemote(env, hash, retry = false) {
 	const state = yield fx.state.read((s) => s);
@@ -5293,6 +5340,7 @@ function* registerRemote(env, hash, retry = false) {
 	const { remote } = entry.lifecycle;
 	if (remote === "registered" || remote === "failed" || remote === "registering" && !retry) return;
 	const background = entry.lifecycle.phase !== "cold";
+	let superseded = false;
 	yield fx.state.update(compose(applyLifecycle(hash, { type: "remote-registering" }), applyLifecycle(hash, {
 		type: "fetch-begin",
 		background
@@ -5306,7 +5354,13 @@ function* registerRemote(env, hash, retry = false) {
 			ttl: entry.def.ttl,
 			...state.ownerSecret ? { owner: state.ownerSecret } : {}
 		}), env.remoteTimeoutMs);
-		if (!(yield fx.state.read((s) => s.queries.has(hash)))) return;
+		const answered = yield fx.state.read((s) => s.queries.get(hash));
+		if (!answered) return;
+		superseded = movedOff(answered, entry);
+		if (superseded) {
+			yield* handOff(hash, entry);
+			return;
+		}
 		const register = stmt(results, 0);
 		if (!register || register.status === "ERR") throw new Error(register?.status === "ERR" ? register.error : "register returned nothing");
 		const answer = (r) => r?.status === "OK" ? r.result : FAILED;
@@ -5340,6 +5394,11 @@ function* registerRemote(env, hash, retry = false) {
 	} catch (error) {
 		const current = yield fx.state.read((s) => s.queries.get(hash));
 		if (!current) return;
+		superseded = movedOff(current, entry);
+		if (superseded) {
+			yield* handOff(hash, entry);
+			return;
+		}
 		if (isNotAllowlisted(error)) {
 			yield fx.state.update(applyLifecycle(hash, { type: "remote-failed" }));
 			yield fx.emit({
@@ -5385,12 +5444,39 @@ function* registerRemote(env, hash, retry = false) {
 			retry: true
 		});
 	} finally {
-		if (yield fx.state.read((s) => s.queries.has(hash))) yield fx.state.update(applyLifecycle(hash, {
+		if ((yield fx.state.read((s) => s.queries.has(hash))) && !superseded) yield fx.state.update(applyLifecycle(hash, {
 			type: "fetch-end",
 			background
 		}));
 	}
 }
+/**
+* Hand back remote ids this page registered and no longer uses: a query
+* moved to a new salt (sign-up, sign-in, sign-out, impersonation) while its
+* old id was registered or on its way. Nothing names the old id again, not
+* the heartbeat, not the pagehide beacon, so it used to hold a live view
+* until its TTL ran out, and the SSP fanned every change to a row it held out
+* to it. Best-effort: a row the caller may no longer touch (another
+* principal's) or a failed request is left to the TTL sweep, as before.
+*/
+function* releaseSuperseded(env, ids) {
+	if (ids.length === 0) return;
+	const sessionIds = yield fx.service("remote.sessionIds");
+	const batch = releaseBatch(ids, sessionIds);
+	try {
+		yield fx.remote.query(batch.sql, batch.vars, env.remoteTimeoutMs);
+	} catch (error) {
+		yield fx.emit({
+			type: "log",
+			level: "debug",
+			message: "superseded view release failed; the TTL sweep reclaims it",
+			data: {
+				ids: ids.map(String),
+				error
+			}
+		});
+	}
+}
 
 //#endregion
 //#region src/mutation/write.saga.ts
@@ -7317,9 +7403,21 @@ function* dropImpersonatedBucket(left) {
 		});
 	}
 }
-/** Re-seed every active query from the new store and rebuild its SSP view. */
+/**
+* Re-seed every active query from the new store and rebuild its SSP view.
+*
+* Under a new salt each query gets a new remote id, and the id it leaves
+* goes back to the server: nothing names it again (not the heartbeat, not
+* the pagehide beacon), so it otherwise held a live view for its whole TTL.
+* A sign-up left one such row per query, because the page's queries mount
+* as the sign-up resolves and register under the anonymous salt on a socket
+* that is already signed in. Ids still in flight are released by their
+* registration when it lands (`registerRemote`); releasing them here too
+* covers a request that timed out and landed anyway.
+*/
 function* rebindQueries() {
 	const [entries, sessionId] = yield fx.state.read((s) => [[...s.queries.values()], s.sessionId]);
+	const superseded = [];
 	for (const entry of entries) {
 		let view = null;
 		try {
@@ -7352,8 +7450,10 @@ function* rebindQueries() {
 			});
 		}
 		const lifecycle = seedLifecycle(isResolvedBefore(view));
+		const id = new RecordId$1("_00_query", hash);
+		if (entry.lifecycle.remote !== "unregistered" && String(id) !== String(entry.def.id)) superseded.push(entry.def.id);
 		yield fx.state.update(rebindQuery(entry.def.hash, {
-			id: new RecordId$1("_00_query", hash),
+			id,
 			lifecycle,
 			remoteArray: view?.ids ?? [],
 			localArray
@@ -7364,6 +7464,10 @@ function* rebindQueries() {
 			known: false
 		});
 	}
+	if (superseded.length > 0) yield fx.dispatch({
+		type: "ReleaseSuperseded",
+		ids: superseded
+	});
 }
 
 //#endregion
@@ -7483,6 +7587,10 @@ function route(env, event) {
 			saga: registerRemote(env, event.hash, event.retry),
 			lane: dedupe(`register:${event.hash}`)
 		};
+		case "ReleaseSuperseded": return {
+			saga: releaseSuperseded(env, event.ids),
+			lane: serial("release")
+		};
 		case "RecoverLostView": return {
 			saga: recoverLostView(event.hash),
 			lane: dedupe(`view-lost:${event.hash}`)
@@ -15922,7 +16030,7 @@ function createTabsCoordinator(config, s, host) {
 	return new TabsCoordinator({
 		tabId: s.tabId,
 		fingerprint: computeTabsFingerprint({
-			coreVersion: "0.0.1-canary.350",
+			coreVersion: "0.0.1-canary.352",
 			schemaHash: hash53(config.schemaSurql),
 			endpoint: config.database.endpoint ?? "",
 			namespace: config.database.namespace,
@@ -16086,6 +16194,7 @@ function createAdapters(config, s, host, lateModules) {
 			const sql = leaveViewsBeacon(ids, s.remote.sessionIds());
 			if (sql) s.remote.beaconSql(sql);
 		},
+		"remote.sessionIds": () => s.remote.sessionIds(),
 		"supervisor.start": () => s.connectionSupervisor.start(),
 		"net.offline": () => typeof navigator !== "undefined" && navigator.onLine === false,
 		"tabs.start": (bucketId) => {

package/dist/live.js

@@ -1,4 +1,4 @@
-import { A as singleSnapshotSelect, H as sha256Hex, I as ANON_USER_ID, L as DEFAULT_REF_MODE, O as registerSelect, S as listRefLive, U as queryHashInput, a as metaFromRow, c as mintOwnerSecret, d as withTimeout, f as parseQueryParams, g as bodySelect, k as registerVars, l as parseDuration, n as rowOfEdge, s as encodeRecordId, t as hashOfEdge, u as parseRecordIdString, v as heartbeatBatch, y as heartbeatRowGone, z as listRefTableFor } from "./worker-edges.js";
+import { B as listRefTableFor, L as ANON_USER_ID, O as registerSelect, R as DEFAULT_REF_MODE, S as listRefLive, U as sha256Hex, W as queryHashInput, a as metaFromRow, c as mintOwnerSecret, d as withTimeout, f as parseQueryParams, g as bodySelect, j as singleSnapshotSelect, k as registerVars, l as parseDuration, n as rowOfEdge, s as encodeRecordId, t as hashOfEdge, u as parseRecordIdString, v as heartbeatBatch, y as heartbeatRowGone } from "./worker-edges.js";
 import { n as decodeTokenClaims } from "./worker-impersonation.js";
 import { RecordId, Surreal } from "surrealdb";
 

package/dist/pure.d.ts

@@ -258,6 +258,18 @@ declare function heartbeatBatch(ids: ReadonlyArray<RecordId<string>>): {
   sql: string;
   vars: Vars;
 };
+/**
+ * Hand back view ids this page no longer answers to. Per id,
+ * `fn::query::unsubscribe` drops this socket's entry and deletes the row when
+ * nobody else watches it; `fn::query::leave` then drops the entries of this
+ * page's earlier sockets (a reconnect re-registered under a new session id)
+ * and pulls the expiry in when none remain. Result index 2i answers the
+ * unsubscribe of id i, 2i + 1 its leave.
+ */
+declare function releaseBatch(ids: ReadonlyArray<RecordId<string>>, sessionIds: ReadonlyArray<string>): {
+  sql: string;
+  vars: Vars;
+};
 /** A heartbeat answer whose statement matched no row: the view was reclaimed. */
 declare const heartbeatRowGone: (result: unknown) => boolean;
 /**
@@ -386,4 +398,4 @@ declare function sha256Hex(input: string): Promise<string>;
  */
 declare function queryKey(input: QueryKeyInput, sessionId: string | null): Promise<string>;
 //#endregion
-export { ANON_LIST_REF_TABLE, ANON_USER_ID, type Answer, BridgeSignOutMessage, BridgeTokenMessage, DEFAULT_REF_MODE, FAILED, IMPERSONATION_ACCESS, LEGACY_VIEW_TABLE, type ListRefSnapshot, PUSH_PAYLOAD_VERSION, PushNotification, PushNotificationAction, PushOp, PushPayload, PushPayloadKind, PushUrgency, type QueryKeyInput, type QueryMetaRow, type RefMode, RegisterPayload, type SealOptions, type SealedQuery, type SurqlHelper, type TokenClaims, type TxQuery, VIEW_TABLE, WebPushClientMessage, base64UrlToBytes, batchSnapshotSelect, bodySelect, bucketIdForUser, bytesToBase64Url, countViewRows, decodeTokenClaims, dedupeRecordVersions, encodeRecordId, hashOfEdge, heartbeatBatch, heartbeatRowGone, isPushPayload, leaveViewsBeacon, listRefBatchSelect, listRefLive, listRefSelect, listRefTableFor, metaFromRow, parseDuration, parseQueryParams, parseRecordIdString, queryHashInput, queryKey, queryRowCountBatchSelect, queryRowCountSelect, readLegacyViewRows, readViewRows, registerSelect, registerVars, rowOfEdge, sameBytes, sanitizeUserId, sha256Hex, singleSnapshotSelect, snapshotFromSingle, subqueryListRefSelect, surql, upsertBodiesTx, viewKeyInput, viewRecordId, viewRow };
+export { ANON_LIST_REF_TABLE, ANON_USER_ID, type Answer, BridgeSignOutMessage, BridgeTokenMessage, DEFAULT_REF_MODE, FAILED, IMPERSONATION_ACCESS, LEGACY_VIEW_TABLE, type ListRefSnapshot, PUSH_PAYLOAD_VERSION, PushNotification, PushNotificationAction, PushOp, PushPayload, PushPayloadKind, PushUrgency, type QueryKeyInput, type QueryMetaRow, type RefMode, RegisterPayload, type SealOptions, type SealedQuery, type SurqlHelper, type TokenClaims, type TxQuery, VIEW_TABLE, WebPushClientMessage, base64UrlToBytes, batchSnapshotSelect, bodySelect, bucketIdForUser, bytesToBase64Url, countViewRows, decodeTokenClaims, dedupeRecordVersions, encodeRecordId, hashOfEdge, heartbeatBatch, heartbeatRowGone, isPushPayload, leaveViewsBeacon, listRefBatchSelect, listRefLive, listRefSelect, listRefTableFor, metaFromRow, parseDuration, parseQueryParams, parseRecordIdString, queryHashInput, queryKey, queryRowCountBatchSelect, queryRowCountSelect, readLegacyViewRows, readViewRows, registerSelect, registerVars, releaseBatch, rowOfEdge, sameBytes, sanitizeUserId, sha256Hex, singleSnapshotSelect, snapshotFromSingle, subqueryListRefSelect, surql, upsertBodiesTx, viewKeyInput, viewRecordId, viewRow };

package/dist/pure.js

@@ -1,4 +1,4 @@
-import { A as singleSnapshotSelect, B as sanitizeUserId, C as listRefSelect, D as readViewRows, E as readLegacyViewRows, F as ANON_LIST_REF_TABLE, H as sha256Hex, I as ANON_USER_ID, L as DEFAULT_REF_MODE, M as upsertBodiesTx, N as viewRecordId, O as registerSelect, P as viewRow, R as bucketIdForUser, S as listRefLive, T as queryRowCountSelect, U as queryHashInput, V as surql, W as viewKeyInput, _ as countViewRows, a as metaFromRow, b as leaveViewsBeacon, f as parseQueryParams, g as bodySelect, h as batchSnapshotSelect, i as dedupeRecordVersions, j as subqueryListRefSelect, k as registerVars, l as parseDuration, m as VIEW_TABLE, n as rowOfEdge, o as snapshotFromSingle, p as LEGACY_VIEW_TABLE, r as FAILED, s as encodeRecordId, t as hashOfEdge, u as parseRecordIdString, v as heartbeatBatch, w as queryRowCountBatchSelect, x as listRefBatchSelect, y as heartbeatRowGone, z as listRefTableFor } from "./worker-edges.js";
+import { A as releaseBatch, B as listRefTableFor, C as listRefSelect, D as readViewRows, E as readLegacyViewRows, F as viewRow, G as viewKeyInput, H as surql, I as ANON_LIST_REF_TABLE, L as ANON_USER_ID, M as subqueryListRefSelect, N as upsertBodiesTx, O as registerSelect, P as viewRecordId, R as DEFAULT_REF_MODE, S as listRefLive, T as queryRowCountSelect, U as sha256Hex, V as sanitizeUserId, W as queryHashInput, _ as countViewRows, a as metaFromRow, b as leaveViewsBeacon, f as parseQueryParams, g as bodySelect, h as batchSnapshotSelect, i as dedupeRecordVersions, j as singleSnapshotSelect, k as registerVars, l as parseDuration, m as VIEW_TABLE, n as rowOfEdge, o as snapshotFromSingle, p as LEGACY_VIEW_TABLE, r as FAILED, s as encodeRecordId, t as hashOfEdge, u as parseRecordIdString, v as heartbeatBatch, w as queryRowCountBatchSelect, x as listRefBatchSelect, y as heartbeatRowGone, z as bucketIdForUser } from "./worker-edges.js";
 import { n as decodeTokenClaims, t as IMPERSONATION_ACCESS } from "./worker-impersonation.js";
 import { a as sameBytes, i as isPushPayload, n as base64UrlToBytes, r as bytesToBase64Url, t as PUSH_PAYLOAD_VERSION } from "./worker-types.js";
 
@@ -21,4 +21,4 @@ function queryKey(input, sessionId) {
 }
 
 //#endregion
-export { ANON_LIST_REF_TABLE, ANON_USER_ID, DEFAULT_REF_MODE, FAILED, IMPERSONATION_ACCESS, LEGACY_VIEW_TABLE, PUSH_PAYLOAD_VERSION, VIEW_TABLE, base64UrlToBytes, batchSnapshotSelect, bodySelect, bucketIdForUser, bytesToBase64Url, countViewRows, decodeTokenClaims, dedupeRecordVersions, encodeRecordId, hashOfEdge, heartbeatBatch, heartbeatRowGone, isPushPayload, leaveViewsBeacon, listRefBatchSelect, listRefLive, listRefSelect, listRefTableFor, metaFromRow, parseDuration, parseQueryParams, parseRecordIdString, queryHashInput, queryKey, queryRowCountBatchSelect, queryRowCountSelect, readLegacyViewRows, readViewRows, registerSelect, registerVars, rowOfEdge, sameBytes, sanitizeUserId, sha256Hex, singleSnapshotSelect, snapshotFromSingle, subqueryListRefSelect, surql, upsertBodiesTx, viewKeyInput, viewRecordId, viewRow };
+export { ANON_LIST_REF_TABLE, ANON_USER_ID, DEFAULT_REF_MODE, FAILED, IMPERSONATION_ACCESS, LEGACY_VIEW_TABLE, PUSH_PAYLOAD_VERSION, VIEW_TABLE, base64UrlToBytes, batchSnapshotSelect, bodySelect, bucketIdForUser, bytesToBase64Url, countViewRows, decodeTokenClaims, dedupeRecordVersions, encodeRecordId, hashOfEdge, heartbeatBatch, heartbeatRowGone, isPushPayload, leaveViewsBeacon, listRefBatchSelect, listRefLive, listRefSelect, listRefTableFor, metaFromRow, parseDuration, parseQueryParams, parseRecordIdString, queryHashInput, queryKey, queryRowCountBatchSelect, queryRowCountSelect, readLegacyViewRows, readViewRows, registerSelect, registerVars, releaseBatch, rowOfEdge, sameBytes, sanitizeUserId, sha256Hex, singleSnapshotSelect, snapshotFromSingle, subqueryListRefSelect, surql, upsertBodiesTx, viewKeyInput, viewRecordId, viewRow };

package/dist/worker-edges.js

@@ -239,6 +239,24 @@ function heartbeatBatch(ids) {
 		vars
 	};
 }
+/**
+* Hand back view ids this page no longer answers to. Per id,
+* `fn::query::unsubscribe` drops this socket's entry and deletes the row when
+* nobody else watches it; `fn::query::leave` then drops the entries of this
+* page's earlier sockets (a reconnect re-registered under a new session id)
+* and pulls the expiry in when none remain. Result index 2i answers the
+* unsubscribe of id i, 2i + 1 its leave.
+*/
+function releaseBatch(ids, sessionIds) {
+	const vars = { sids: [...sessionIds] };
+	return {
+		sql: ids.flatMap((id, i) => {
+			vars[`id${i}`] = id;
+			return [`fn::query::unsubscribe($id${i})`, `fn::query::leave($id${i}, $sids)`];
+		}).join(";\n"),
+		vars
+	};
+}
 /** A heartbeat answer whose statement matched no row: the view was reclaimed. */
 const heartbeatRowGone = (result) => Array.isArray(result) && result.length === 0;
 const QUERY_ID = /^_00_query:(?:[0-9a-f]{64}|⟨[0-9a-f]{64}⟩)$/;
@@ -477,4 +495,4 @@ function rowOfEdge(value) {
 }
 
 //#endregion
-export { singleSnapshotSelect as A, sanitizeUserId as B, listRefSelect as C, readViewRows as D, readLegacyViewRows as E, ANON_LIST_REF_TABLE as F, sha256Hex as H, ANON_USER_ID as I, DEFAULT_REF_MODE as L, upsertBodiesTx as M, viewRecordId as N, registerSelect as O, viewRow as P, bucketIdForUser as R, listRefLive as S, queryRowCountSelect as T, queryHashInput as U, surql as V, viewKeyInput as W, countViewRows as _, metaFromRow as a, leaveViewsBeacon as b, mintOwnerSecret as c, withTimeout as d, parseQueryParams as f, bodySelect as g, batchSnapshotSelect as h, dedupeRecordVersions as i, subqueryListRefSelect as j, registerVars as k, parseDuration as l, VIEW_TABLE as m, rowOfEdge as n, snapshotFromSingle as o, LEGACY_VIEW_TABLE as p, FAILED as r, encodeRecordId as s, hashOfEdge as t, parseRecordIdString as u, heartbeatBatch as v, queryRowCountBatchSelect as w, listRefBatchSelect as x, heartbeatRowGone as y, listRefTableFor as z };
+export { releaseBatch as A, listRefTableFor as B, listRefSelect as C, readViewRows as D, readLegacyViewRows as E, viewRow as F, viewKeyInput as G, surql as H, ANON_LIST_REF_TABLE as I, ANON_USER_ID as L, subqueryListRefSelect as M, upsertBodiesTx as N, registerSelect as O, viewRecordId as P, DEFAULT_REF_MODE as R, listRefLive as S, queryRowCountSelect as T, sha256Hex as U, sanitizeUserId as V, queryHashInput as W, countViewRows as _, metaFromRow as a, leaveViewsBeacon as b, mintOwnerSecret as c, withTimeout as d, parseQueryParams as f, bodySelect as g, batchSnapshotSelect as h, dedupeRecordVersions as i, singleSnapshotSelect as j, registerVars as k, parseDuration as l, VIEW_TABLE as m, rowOfEdge as n, snapshotFromSingle as o, LEGACY_VIEW_TABLE as p, FAILED as r, encodeRecordId as s, hashOfEdge as t, parseRecordIdString as u, heartbeatBatch as v, queryRowCountBatchSelect as w, listRefBatchSelect as x, heartbeatRowGone as y, bucketIdForUser as z };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@spooky-sync/core",
-  "version": "0.0.1-canary.350",
+  "version": "0.0.1-canary.352",
   "type": "module",
   "sideEffects": false,
   "main": "./dist/index.js",
@@ -75,8 +75,8 @@
     }
   },
   "dependencies": {
-    "@spooky-sync/query-builder": "0.0.1-canary.350",
-    "@spooky-sync/ssp-wasm": "0.0.1-canary.350",
+    "@spooky-sync/query-builder": "0.0.1-canary.352",
+    "@spooky-sync/ssp-wasm": "0.0.1-canary.352",
     "@sqlite.org/sqlite-wasm": "3.53.0-build1",
     "@surrealdb/wasm": "^3.1.0",
     "@surrealdb/wasm-native": "^3.3.4",

package/src/boot/auth-flip.saga.test.ts

@@ -66,6 +66,45 @@ describe('authFlip', () => {
     expect(id).toBe(await sha256Hex(queryHashInput(def, 'salt-1')));
     expect(id).not.toBe(before);
   });
+  it('a sign-up releases the id each query held under the anonymous salt, so the page owns one remote row per query', async () => {
+    // threads-e2e, canary.350: the list mounted as the sign-up resolved, so
+    // its queries registered under the anonymous salt on a socket already
+    // signed in, then the flip re-keyed them. Every query left a second row
+    // (same surql, same auth_id) that the pagehide beacon never named and
+    // that fanned out every change for its whole TTL.
+    const svc = fakeServices({
+      'auth.sessionAuthId': () => 'user:u1',
+      'auth.access': () => 'account',
+      'local.currentBucketId': () => 'anon',
+      'local.beginSwitch': () => () => undefined,
+      'local.usesSurqlSchema': () => false,
+      'auth.token': () => 'jwt',
+      'auth.currentUser': () => null,
+    });
+    const threads = { surql: 'SELECT * FROM thread', params: {} };
+    const user = { surql: 'SELECT * FROM user WHERE id = $id', params: { id: 'user:u1' } };
+    const anonId = async (def: typeof threads) => new RecordId('_00_query', await sha256Hex(queryHashInput(def, 'anon-salt')));
+    const [threadsId, userId] = [await anonId(threads), await anonId(user)];
+    const state = R.compose(
+      R.putQuery(buildEntry({ def: { hash: 't', ...threads, id: threadsId }, lifecycle: { phase: 'live', remote: 'registered' } })),
+      R.putQuery(buildEntry({ def: { hash: 'u', ...user, id: userId }, lifecycle: { phase: 'cold', remote: 'registering' } })),
+      R.putQuery(buildEntry({ def: { hash: 'n', surql: 'SELECT * FROM comment' }, lifecycle: { phase: 'cold', remote: 'unregistered' } }))
+    )({ ...buildState(), sessionId: 'anon-salt', saltUserId: null, bucketId: 'anon' });
+    const out = await runPure(authFlip(env, 'user:u1'), {
+      state,
+      handlers: {
+        service: svc.handler,
+        'local.getById': () => null,
+        'ssp.register': () => ({ localArray: [], timings: {} }),
+        'local.query': () => [],
+      },
+    });
+    expect(String(out.state.queries.get('t')!.def.id.id)).toBe(await sha256Hex(queryHashInput(threads, 'salt-1')));
+    expect(String(out.state.queries.get('u')!.def.id.id)).toBe(await sha256Hex(queryHashInput(user, 'salt-1')));
+    // Registered and in-flight ids may exist on the server; a never-registered one cannot.
+    expect(out.dispatched.filter((d) => d.type === 'ReleaseSuperseded')).toEqual([{ type: 'ReleaseSuperseded', ids: [threadsId, userId] }]);
+    expect(out.dispatched.map((d) => d.type)).toContain('EnsureRegistered');
+  });
   it('a new principal on the same bucket still re-keys its queries', async () => {
     const svc = fakeServices({
       'auth.sessionAuthId': () => 'user:b',

package/src/boot/bucket-switch.saga.test.ts

@@ -72,7 +72,9 @@ describe('bucketSwitch', () => {
     expect(String(e.def.id.table)).toBe('_00_query');
     // PollTick is load-bearing: the switch cleared the poll timer, and only the
     // tick re-arms it, so a sign-in without it leaves the client on LIVE alone.
-    expect(out.dispatched.map((d) => d.type)).toEqual(['PrimeCircuit', 'AdoptPendingWrites', 'EnsureRegistered', 'LiveStart', 'PollTick', 'Drain']);
+    expect(out.dispatched.map((d) => d.type)).toEqual(['PrimeCircuit', 'ReleaseSuperseded', 'AdoptPendingWrites', 'EnsureRegistered', 'LiveStart', 'PollTick', 'Drain']);
+    // The id the query held under the previous salt goes back to the server.
+    expect(out.dispatched.find((d) => d.type === 'ReleaseSuperseded')).toEqual({ type: 'ReleaseSuperseded', ids: [new RecordId('_00_query', 'a')] });
   });
   it('shared tabs: moves namespaces, falls back to solo on failure; blob clear on sign-out; failures are logged and the gate always reopens', async () => {
     let gateReleased = false;

package/src/boot/bucket-switch.saga.ts

@@ -100,9 +100,21 @@ export function* dropImpersonatedBucket(left: string): Saga<void> {
   }
 }
 
-/** Re-seed every active query from the new store and rebuild its SSP view. */
+/**
+ * Re-seed every active query from the new store and rebuild its SSP view.
+ *
+ * Under a new salt each query gets a new remote id, and the id it leaves
+ * goes back to the server: nothing names it again (not the heartbeat, not
+ * the pagehide beacon), so it otherwise held a live view for its whole TTL.
+ * A sign-up left one such row per query, because the page's queries mount
+ * as the sign-up resolves and register under the anonymous salt on a socket
+ * that is already signed in. Ids still in flight are released by their
+ * registration when it lands (`registerRemote`); releasing them here too
+ * covers a request that timed out and landed anyway.
+ */
 export function* rebindQueries(): Saga<void> {
   const [entries, sessionId] = (yield fx.state.read((s) => [[...s.queries.values()], s.sessionId])) as [QueryEntry[], string | null];
+  const superseded: QueryEntry['def']['id'][] = [];
   for (const entry of entries) {
     let view: ReturnType<typeof parseViewRow> = null;
     try {
@@ -125,7 +137,9 @@ export function* rebindQueries(): Saga<void> {
       yield fx.emit({ type: 'log', level: 'warn', message: 'local view rebuild failed after bucket switch', data: { hash: entry.def.hash, error } });
     }
     const lifecycle = seedLifecycle(isResolvedBefore(view));
-    yield fx.state.update(R.rebindQuery(entry.def.hash, { id: new RecordId('_00_query', hash), lifecycle, remoteArray: view?.ids ?? [], localArray }));
+    const id = new RecordId('_00_query', hash);
+    if (entry.lifecycle.remote !== 'unregistered' && String(id) !== String(entry.def.id)) superseded.push(entry.def.id);
+    yield fx.state.update(R.rebindQuery(entry.def.hash, { id, lifecycle, remoteArray: view?.ids ?? [], localArray }));
     // A re-seed is never answered, not even from a durable view: subscribers
     // still hold the previous store's rows until `materialize` paints the new
     // store's, and only that render flips authority back on.
@@ -133,4 +147,5 @@ export function* rebindQueries(): Saga<void> {
       yield fx.emit({ type: 'query:authority', hash: entry.def.hash, known: false });
     }
   }
+  if (superseded.length > 0) yield fx.dispatch({ type: 'ReleaseSuperseded', ids: superseded });
 }

package/src/client/router.ts

@@ -1,7 +1,7 @@
 import type { RuntimeEvent } from '../kernel/events';
 import type { Lane, Saga } from '../kernel/saga';
 import type { SagaEnv } from '../query/env';
-import { ensureRegistered, registerRemote } from '../query/register.saga';
+import { ensureRegistered, registerRemote, releaseSuperseded } from '../query/register.saga';
 import { readDirtyMembership, readMembership, recoverLostView } from '../query/membership.saga';
 import { fetchRows } from '../query/fetch.saga';
 import { materialize, streamUpdate } from '../query/materialize.saga';
@@ -37,6 +37,8 @@ export function route(env: SagaEnv, event: RuntimeEvent): RouteTarget {
       return { saga: ensureRegistered(env, { requireAuth: event.requireAuth, attempt: event.attempt }), lane: serial('ensure') };
     case 'RegisterRemote':
       return { saga: registerRemote(env, event.hash, event.retry), lane: dedupe(`register:${event.hash}`) };
+    case 'ReleaseSuperseded':
+      return { saga: releaseSuperseded(env, event.ids), lane: serial('release') };
     case 'RecoverLostView':
       return { saga: recoverLostView(event.hash), lane: dedupe(`view-lost:${event.hash}`) };
     case 'ReadDirtyMembership':

package/src/client/runtime.test.ts

@@ -7,6 +7,7 @@ import type { Saga } from '../kernel/saga';
 import * as R from '../state/reducers';
 import { Runtime } from './runtime';
 import { rebindQueries } from '../boot/bucket-switch.saga';
+import { registerLocal } from '../query/register.saga';
 
 const env = defaultEnv({ tables: [] } as any, { materializeDebounceMs: 5 });
 const noop = () => {};
@@ -233,3 +234,66 @@ describe('Runtime state hooks', () => {
     expect(rt.state.dirty.has('q')).toBe(true);
   });
 });
+
+describe('Runtime sign-up', () => {
+  it('the page ends up owning one remote row per query when its registration races the auth flip', async () => {
+    // threads-e2e, canary.350: the list mounts as the sign-up resolves and
+    // registers under the anonymous salt on a socket already signed in; the
+    // flip re-keys it while that request is out. The fake server keeps the
+    // `_00_query` rows the way `fn::query::register` / `unsubscribe` do.
+    const rows = new Set<string>();
+    let land!: () => void;
+    const held = new Promise<void>((r) => (land = r));
+    let first = true;
+    const ok = (result: unknown) => ({ status: 'OK' as const, result });
+    let bucket = 'anon';
+    const { a, rt } = make(
+      {
+        remote: {
+          queryResponses: async (sql: string, vars?: Record<string, any>) => {
+            if (sql.startsWith('fn::query::register($config)')) {
+              rows.add(String(vars!.config.id));
+              if (first) {
+                first = false;
+                await held;
+              }
+              return [ok(null), ok([]), ok({ rowCount: 0, state: 'ready' }), ok([])];
+            }
+            if (sql.includes('fn::query::unsubscribe')) {
+              for (const [k, v] of Object.entries(vars ?? {})) if (k.startsWith('id')) rows.delete(String(v));
+              return [];
+            }
+            return [];
+          },
+        },
+        services: {
+          'auth.sessionAuthId': () => 'user:u1',
+          'auth.access': () => 'account',
+          'local.currentBucketId': () => bucket,
+          'local.beginSwitch': () => () => undefined,
+          'local.switchStore': async (target: string) => void (bucket = target),
+          'local.usesSurqlSchema': () => false,
+          'auth.currentUser': () => null,
+          'remote.sessionIds': () => ['s1'],
+        },
+      },
+      { ...buildState(), sessionId: 'anon-salt', saltUserId: null, bucketId: 'anon', primed: true }
+    );
+    const hash = await rt.run(registerLocal(env, { tableName: 'thread', surql: 'SELECT * FROM thread', params: {}, ttl: '10m' }));
+    await tick();
+    expect(rows.size).toBe(1);
+    const anonId = [...rows][0];
+
+    await rt.dispatch({ type: 'AuthFlip', userId: 'user:u1' });
+    land();
+    for (let i = 0; i < 10; i++) {
+      await tick();
+      a.timers.fire(`register:${hash}`);
+    }
+
+    const entry = rt.state.queries.get(hash)!;
+    expect(String(entry.def.id)).not.toBe(anonId);
+    expect([...rows]).toEqual([String(entry.def.id)]);
+    expect(entry.lifecycle.remote).toBe('registered');
+  });
+});

package/src/client/services.ts

@@ -330,6 +330,7 @@ export function createAdapters<S extends SchemaStructure>(config: Sp00kyConfig<S
       const sql = leaveViewsBeacon(ids, s.remote.sessionIds());
       if (sql) s.remote.beaconSql(sql);
     },
+    'remote.sessionIds': () => s.remote.sessionIds(),
     'supervisor.start': () => s.connectionSupervisor.start(),
     'net.offline': () => typeof navigator !== 'undefined' && navigator.onLine === false,
     'tabs.start': (bucketId) => {

package/src/kernel/effects.ts

@@ -103,6 +103,8 @@ export interface ServiceCalls {
   /** The platform reports no network at all (a browser's `navigator.onLine === false`). */
   'net.offline': () => boolean;
   'remote.releaseViews': (ids: unknown[]) => void;
+  /** `session::id()` of every socket this page has had, oldest first. */
+  'remote.sessionIds': () => readonly string[];
   'supervisor.start': () => void;
   'tabs.start': (bucketId: string) => Promise<'solo' | 'leader' | 'follower'>;
   'tabs.moveToBucket': (bucketId: string) => Promise<'solo' | 'leader' | 'follower'>;

package/src/kernel/events.ts

@@ -1,3 +1,4 @@
+import type { RecordId } from 'surrealdb';
 import type { ConnectionState, EdgeDelta, InlineRow, QueryHash, QueryStatus, SyncHealth } from '../types';
 import type { StreamUpdate } from '../services/stream-processor/index';
 
@@ -9,6 +10,7 @@ import type { StreamUpdate } from '../services/stream-processor/index';
 export type RuntimeEvent =
   | { type: 'EnsureRegistered'; requireAuth?: boolean; attempt?: number }
   | { type: 'RegisterRemote'; hash: QueryHash; retry?: boolean }
+  | { type: 'ReleaseSuperseded'; ids: RecordId<string>[] }
   | { type: 'SyncOutcome'; ok: boolean; error?: unknown }
   | { type: 'AckPrune' }
   | { type: 'ReadDirtyMembership' }

package/src/modules/devtools/flags.ts

@@ -242,7 +242,7 @@ export class FlagsAdminService {
 
   /**
    * Add or remove a user from `$key`'s allowlist for `$variant`, then
-   * re-materialize. Defaults to the signed-in user, so the common case
+   * re-evaluate that one user (nobody else's variant can change). Defaults to the signed-in user, so the common case
    * ("turn this on for me, for real") needs no user picker.
    */
   async setFlagUserVariant(

package/src/query/register.saga.test.ts

@@ -4,7 +4,9 @@ import { runPure, sha256Hex } from '../testing/run-pure';
 import { buildEntry, buildState } from '../testing/build';
 import { defaultEnv } from './env';
 import { queryHashInput } from './hash';
-import { ensureRegistered, isNotAllowlisted, registerLocal, registerRemote } from './register.saga';
+import { ensureRegistered, isNotAllowlisted, registerLocal, registerRemote, releaseSuperseded } from './register.saga';
+import { seedLifecycle } from '../state/lifecycle';
+import { fakeServices } from '../testing/services';
 import * as R from '../state/reducers';
 import { emptyState } from '../state/client-state';
 import type { StatementResult } from '../kernel/effects';
@@ -309,4 +311,59 @@ describe('registerRemote', () => {
     });
     expect(gone.dispatched).toEqual([]);
   });
+  it('a registration that lands after its query moved to a new id releases the id it registered and leaves the new one to register', async () => {
+    // A sign-up: the page registered under the anonymous salt with the socket
+    // already signed in, and the auth flip re-keyed the query while that
+    // request was out. Before the fix the answer marked the NEW id registered,
+    // so it was never registered, and nothing ever released the old one.
+    const moved = new RecordId('_00_query', 'b'.repeat(64));
+    for (const fail of [false, true]) {
+      const out = await runPure(registerRemote(env, 'a'), {
+        state: buildState([entry]),
+        handlers: {
+          'remote.query': (_e, ctx) => {
+            ctx.state = R.rebindQuery('a', { id: moved, lifecycle: seedLifecycle(false), remoteArray: [], localArray: [] })(ctx.state);
+            if (fail) throw new Error('Remote request timed out');
+            return happy();
+          },
+          'local.upsert': () => undefined,
+        },
+      });
+      const e = out.state.queries.get('a')!;
+      expect(e.def.id).toBe(moved);
+      expect(e.lifecycle).toMatchObject({ remote: 'unregistered', fetchDepth: 0, backgroundDepth: 0 });
+      expect(e.remoteArray).toEqual([]);
+      expect(e.registerAttempts).toBe(0);
+      expect(out.dispatched).toEqual([{ type: 'ReleaseSuperseded', ids: [entry.def.id] }]);
+      // The re-key's RegisterRemote joined this run on the per-hash lane: arm it again.
+      expect([...out.timers]).toEqual([['register:a', { ms: 0, event: { type: 'RegisterRemote', hash: 'a' } }]]);
+    }
+  });
+});
+
+describe('releaseSuperseded', () => {
+  it("per id: unsubscribe as this socket, then leave for this page's earlier sockets, in one request; a failure is only logged", async () => {
+    const ids = [new RecordId('_00_query', 'a'.repeat(64)), new RecordId('_00_query', 'b'.repeat(64))];
+    const out = await runPure(releaseSuperseded(env, ids), {
+      handlers: {
+        service: fakeServices({ 'remote.sessionIds': () => ['s1', 's2'] }).handler,
+        'remote.query': () => [okStmt({ released: true }), okStmt({ leaving: false }), okStmt({ released: true }), okStmt({ leaving: false })],
+      },
+    });
+    const req = out.log.find((x) => x.kind === 'remote.query') as any;
+    expect(req.sql).toBe('fn::query::unsubscribe($id0);\nfn::query::leave($id0, $sids);\nfn::query::unsubscribe($id1);\nfn::query::leave($id1, $sids)');
+    expect(req.vars).toEqual({ id0: ids[0], id1: ids[1], sids: ['s1', 's2'] });
+    expect(req.timeoutMs).toBe(env.remoteTimeoutMs);
+    const failing = await runPure(releaseSuperseded(env, ids), {
+      handlers: {
+        service: fakeServices({ 'remote.sessionIds': () => [] }).handler,
+        'remote.query': () => {
+          throw new Error('offline');
+        },
+      },
+    });
+    expect(failing.emitted).toEqual([expect.objectContaining({ type: 'log', level: 'debug' })]);
+    const none = await runPure(releaseSuperseded(env, []), {});
+    expect(none.log).toEqual([]);
+  });
 });

package/src/query/register.saga.ts

@@ -139,11 +139,36 @@ const stmt = (results: StatementResult[], i: number): StatementResult | undefine
 export const isNotAllowlisted = (error: unknown): boolean =>
   /not_allowlisted|\b403\b|forbidden/i.test(String((error as { message?: unknown })?.message ?? error));
 
+/**
+ * The entry no longer names the remote id this registration sent: a salt
+ * rotation (`rebindQueries`) re-keyed it while the request was out, and
+ * seeded a fresh lifecycle for the new id.
+ */
+const movedOff = (current: QueryEntry, sent: QueryEntry): boolean => String(current.def.id) !== String(sent.def.id);
+
+/**
+ * Release the id a superseded registration sent and register the new one.
+ * The re-key's own `RegisterRemote` for this hash joined the run still in
+ * flight (the lane dedupes per hash), so it is armed again on a timer, which
+ * fires once this run has left the lane.
+ */
+function* handOff(hash: QueryHash, sent: QueryEntry): Saga<void> {
+  yield fx.dispatch({ type: 'ReleaseSuperseded', ids: [sent.def.id] });
+  yield fx.timer.set(`register:${hash}`, 0, { type: 'RegisterRemote', hash });
+}
+
 /**
  * One remote registration: `fn::query::register` plus the edge/meta/children
  * read in ONE request, then membership application. Concurrent with every
  * other registration; retried on its own backoff; stops when the entry is
  * gone.
+ *
+ * An answer that lands after the query moved to a new id applies nothing:
+ * the membership and the `registered` flag belong to the id it sent, which
+ * this page no longer uses, so it releases that id and leaves the new one to
+ * the registration the re-key dispatched. Marking the new id registered from
+ * the old id's answer meant the new id was never registered, and nothing
+ * ever named the old one again.
  */
 export function* registerRemote(env: SagaEnv, hash: QueryHash, retry = false): Saga<void> {
   const state = (yield fx.state.read((s) => s)) as ClientState;
@@ -154,6 +179,7 @@ export function* registerRemote(env: SagaEnv, hash: QueryHash, retry = false): S
   // A query that already shows rows (cached or live) only re-verifies them
   // here: the cycle holds `fetching` but is not traffic the user waits on.
   const background = entry.lifecycle.phase !== 'cold';
+  let superseded = false;
   yield fx.state.update(
     R.compose(R.applyLifecycle(hash, { type: 'remote-registering' }), R.applyLifecycle(hash, { type: 'fetch-begin', background }))
   );
@@ -170,8 +196,13 @@ export function* registerRemote(env: SagaEnv, hash: QueryHash, retry = false): S
       }),
       env.remoteTimeoutMs
     )) as StatementResult[];
-    const stillThere = (yield fx.state.read((s) => s.queries.has(hash))) as boolean;
-    if (!stillThere) return;
+    const answered = (yield fx.state.read((s) => s.queries.get(hash))) as QueryEntry | undefined;
+    if (!answered) return;
+    superseded = movedOff(answered, entry);
+    if (superseded) {
+      yield* handOff(hash, entry);
+      return;
+    }
     const register = stmt(results, 0);
     if (!register || register.status === 'ERR') throw new Error(register?.status === 'ERR' ? register.error : 'register returned nothing');
     const answer = (r: StatementResult | undefined): unknown => (r?.status === 'OK' ? r.result : FAILED);
@@ -202,6 +233,12 @@ export function* registerRemote(env: SagaEnv, hash: QueryHash, retry = false): S
   } catch (error) {
     const current = (yield fx.state.read((s) => s.queries.get(hash))) as QueryEntry | undefined;
     if (!current) return;
+    // A request that timed out may still land: release its id all the same.
+    superseded = movedOff(current, entry);
+    if (superseded) {
+      yield* handOff(hash, entry);
+      return;
+    }
     if (isNotAllowlisted(error)) {
       yield fx.state.update(R.applyLifecycle(hash, { type: 'remote-failed' }));
       yield fx.emit({
@@ -229,7 +266,28 @@ export function* registerRemote(env: SagaEnv, hash: QueryHash, retry = false): S
       yield fx.timer.set(`register:${hash}`, backoffMs(attempts), { type: 'RegisterRemote', hash, retry: true });
     }
   } finally {
+    // A re-key seeded a fresh lifecycle: this cycle's begin is not in it.
     const stillThere = (yield fx.state.read((s) => s.queries.has(hash))) as boolean;
-    if (stillThere) yield fx.state.update(R.applyLifecycle(hash, { type: 'fetch-end', background }));
+    if (stillThere && !superseded) yield fx.state.update(R.applyLifecycle(hash, { type: 'fetch-end', background }));
+  }
+}
+
+/**
+ * Hand back remote ids this page registered and no longer uses: a query
+ * moved to a new salt (sign-up, sign-in, sign-out, impersonation) while its
+ * old id was registered or on its way. Nothing names the old id again, not
+ * the heartbeat, not the pagehide beacon, so it used to hold a live view
+ * until its TTL ran out, and the SSP fanned every change to a row it held out
+ * to it. Best-effort: a row the caller may no longer touch (another
+ * principal's) or a failed request is left to the TTL sweep, as before.
+ */
+export function* releaseSuperseded(env: SagaEnv, ids: ReadonlyArray<QueryEntry['def']['id']>): Saga<void> {
+  if (ids.length === 0) return;
+  const sessionIds = (yield fx.service('remote.sessionIds')) as readonly string[];
+  const batch = sql.releaseBatch(ids, sessionIds);
+  try {
+    yield fx.remote.query(batch.sql, batch.vars, env.remoteTimeoutMs);
+  } catch (error) {
+    yield fx.emit({ type: 'log', level: 'debug', message: 'superseded view release failed; the TTL sweep reclaims it', data: { ids: ids.map(String), error } });
   }
 }

package/src/query/sql.ts

@@ -118,6 +118,23 @@ export function heartbeatBatch(ids: ReadonlyArray<RecordId<string>>): { sql: str
   return { sql: stmts.join(';\n'), vars };
 }
 
+/**
+ * Hand back view ids this page no longer answers to. Per id,
+ * `fn::query::unsubscribe` drops this socket's entry and deletes the row when
+ * nobody else watches it; `fn::query::leave` then drops the entries of this
+ * page's earlier sockets (a reconnect re-registered under a new session id)
+ * and pulls the expiry in when none remain. Result index 2i answers the
+ * unsubscribe of id i, 2i + 1 its leave.
+ */
+export function releaseBatch(ids: ReadonlyArray<RecordId<string>>, sessionIds: ReadonlyArray<string>): { sql: string; vars: Vars } {
+  const vars: Vars = { sids: [...sessionIds] };
+  const stmts = ids.flatMap((id, i) => {
+    vars[`id${i}`] = id;
+    return [`fn::query::unsubscribe($id${i})`, `fn::query::leave($id${i}, $sids)`];
+  });
+  return { sql: stmts.join(';\n'), vars };
+}
+
 /** A heartbeat answer whose statement matched no row: the view was reclaimed. */
 export const heartbeatRowGone = (result: unknown): boolean => Array.isArray(result) && result.length === 0;