@spooky-sync/core 0.0.1-canary.65 → 0.0.1-canary.67

package/src/modules/crdt/index.ts

@@ -1,5 +1,5 @@
 import type { SchemaStructure } from '@spooky-sync/query-builder';
-import type { RemoteDatabaseService } from '../../services/database/index';
+import type { LocalDatabaseService, RemoteDatabaseService } from '../../services/database/index';
 import type { Logger } from '../../services/logger/index';
 import type { Uuid } from 'surrealdb';
 import { CrdtField } from './crdt-field';
@@ -10,22 +10,52 @@ export { CrdtField, cursorColorFromName, CURSOR_COLORS } from './crdt-field';
 /**
  * CrdtManager manages active CrdtField instances and their sync channels.
  *
- * Each open record gets a LIVE SELECT on _00_crdt that delivers remote
- * changes in real time.
+ * Collaborative state lives in two dedicated tables (defined in
+ * `apps/cli/src/meta_tables_remote.surql`):
+ *   - `_00_crdt`   { record_id, field, state } — one row per (record, field)
+ *   - `_00_cursor` { record_id, session_id, field, state } — one row per
+ *                    (record, session, field)
+ *
+ * Splitting them off the parent row is what makes offline edits mergeable:
+ * each (record, field) gets its own row, so concurrent offline writes don't
+ * collide on the parent's last-write-wins semantics.
+ *
+ * Cross-browser delivery still rides the parent table's existing LIVE feed
+ * to avoid SurrealDB v3 LIVE bugs around dereference-based permission rules
+ * (issues 3602, 4026). On every meta UPSERT the writer also bumps the
+ * parent's `_00_rv` (a no-op assignment); that fires the parent's LIVE
+ * feed, and the receiver pulls the matching `_00_crdt` / `_00_cursor` rows
+ * via subquery. Permission inheritance happens server-side via
+ * `record_id.id != NONE` (SELECT) and `fn::can_update_record` (UPDATE).
  */
 export class CrdtManager {
   private fields = new Map<string, CrdtField>();
-  private liveQueries = new Map<string, { uuid: Uuid; table: string }>();
+  // One LIVE subscription per parent table (e.g. "thread" → uuid).
+  private liveByTable = new Map<string, Uuid>();
+  // Coalesces concurrent first-time subscribes for the same table.
+  private pendingLive = new Map<string, Promise<void>>();
   private logger: Logger;
+  // SurrealDB session id, used as the per-session key inside `_00_cursor`.
+  private sessionId: string = '';
 
   constructor(
     private schema: SchemaStructure,
+    private local: LocalDatabaseService,
     private remote: RemoteDatabaseService,
-    logger: Logger
+    logger: Logger,
+    private debounceMs: number = 500,
   ) {
     this.logger = logger.child({ service: 'CrdtManager' });
   }
 
+  /** Set the session id that scopes this client's cursor entries. Must be
+   *  called before `open()` for cursors to be pushed under a stable key.
+   *  Passed in from `sp00ky.ts` at boot (it already fetches `session::id()`
+   *  for the data-module salt). */
+  setSessionId(sessionId: string): void {
+    this.sessionId = sessionId;
+  }
+
   /**
    * Open a CRDT field for collaborative editing.
    *
@@ -42,6 +72,7 @@ export class CrdtManager {
     fallbackText?: string,
   ): Promise<CrdtField> {
     this.assertCrdtField(table, field);
+    const cursorsEnabled = this.fieldHasCursor(table, field);
     const key = this.makeKey(table, recordId, field);
     let crdtField = this.fields.get(key);
 
@@ -49,25 +80,29 @@ export class CrdtManager {
       return crdtField;
     }
 
-    // Load saved CRDT state from remote _00_crdt table
-    let initialCrdtState: string | undefined;
+    // Read the snapshot directly off the parent row. `@crdt`-only fields
+    // hold the base64 snapshot inline; `@crdt @cursor` fields hold a
+    // `{ state, cursors }` object so we drill into `.state`. The query
+    // always selects the local row — sync-down already populated it
+    // (the snapshot is a column on the parent, not a sidecar table) so
+    // there is no separate fetch on the happy path.
+    let initialCrdtState: Uint8Array | undefined;
     try {
-      const [result] = await this.remote.query<[string[]]>(
-        'SELECT VALUE state FROM _00_crdt WHERE record_id = $rid AND field = $field LIMIT 1',
-        { rid: parseRecordIdString(recordId), field }
+      const [result] = await this.local.query<[unknown]>(
+        `SELECT VALUE ${field} FROM ONLY $id`,
+        { id: parseRecordIdString(recordId) },
       );
-      if (result && result.length > 0 && result[0]) {
-        initialCrdtState = result[0];
-      }
+      const snapshot = this.extractSnapshot(result, cursorsEnabled);
+      if (snapshot) initialCrdtState = snapshot;
     } catch (e) {
-      this.logger.debug(
-        { error: e, Category: 'sp00ky-client::CrdtManager::open' },
-        'No existing CRDT state found'
+      this.logger.info(
+        { error: String(e), recordId, field, Category: 'sp00ky-client::CrdtManager::open' },
+        'No existing CRDT state found in local cache (continuing with empty doc)'
       );
     }
 
-    crdtField = new CrdtField(field, initialCrdtState, this.logger);
-    crdtField.startSync(this.remote, recordId);
+    crdtField = new CrdtField(field, cursorsEnabled, initialCrdtState, this.logger);
+    crdtField.startSync(this.local, this.remote, recordId, this.sessionId, this.debounceMs);
     this.fields.set(key, crdtField);
 
     this.logger.info(
@@ -75,7 +110,18 @@ export class CrdtManager {
       'CrdtField opened'
     );
 
-    await this.ensureLiveSelect(table, recordId);
+    // Fire-and-forget: the LIVE subscription receives *future* updates;
+    // the initial snapshot is already in hand. `ensureTableSubscription`
+    // coalesces concurrent calls via `pendingLive`, so this is safe.
+    void this.ensureTableSubscription(table);
+
+    // Local was empty — a fresh device, a memory-backed local DB after
+    // reload, or a record that hasn't been sync'd locally yet. Pull the
+    // parent row from remote and dispatch its CRDT field; otherwise the
+    // editor sits empty until the parent's LIVE feed happens to fire.
+    if (!initialCrdtState) {
+      void this.fetchAndDispatchRow(table, recordId);
+    }
 
     return crdtField;
   }
@@ -88,12 +134,11 @@ export class CrdtManager {
       this.fields.delete(key);
     }
 
-    const prefix = `${table}:${recordId}:`;
-    const hasOtherFields = Array.from(this.fields.keys()).some(
-      (k) => k !== key && k.startsWith(prefix)
-    );
-    if (!hasOtherFields) {
-      this.killLiveSelect(recordId);
+    // If no fields on this table remain open, tear down the table-wide LIVE.
+    const tablePrefix = `${table}:`;
+    const stillOpen = Array.from(this.fields.keys()).some((k) => k.startsWith(tablePrefix));
+    if (!stillOpen) {
+      this.killTableSubscription(table);
     }
 
     this.logger.debug(
@@ -107,69 +152,158 @@ export class CrdtManager {
       field.stopSync();
     }
     this.fields.clear();
-    for (const recordId of this.liveQueries.keys()) {
-      this.killLiveSelect(recordId);
+    for (const table of Array.from(this.liveByTable.keys())) {
+      this.killTableSubscription(table);
     }
   }
 
-  private async ensureLiveSelect(table: string, recordId: string): Promise<void> {
-    if (this.liveQueries.has(recordId)) return;
+  /** Ensure a single `LIVE SELECT * FROM <table>` is running, shared across
+   *  every open CrdtField on `table`. */
+  private async ensureTableSubscription(table: string): Promise<void> {
+    if (this.liveByTable.has(table)) return;
 
-    try {
-      const [uuid] = await this.remote.query<[Uuid]>(
-        `LIVE SELECT * FROM _00_crdt WHERE record_id = $rid`,
-        { rid: parseRecordIdString(recordId) },
-      );
+    const pending = this.pendingLive.get(table);
+    if (pending) return pending;
+
+    const start = (async () => {
+      try {
+        const [uuid] = await this.remote.query<[Uuid]>(
+          `LIVE SELECT * FROM ${table}`,
+        );
 
-      this.liveQueries.set(recordId, { uuid, table });
+        const subscription = await this.remote.getClient().liveOf(uuid);
+        subscription.subscribe((message) => {
+          if (message.action === 'KILLED') return;
+          if (message.action !== 'CREATE' && message.action !== 'UPDATE') return;
+          this.dispatchRow(table, message.value as Record<string, unknown>);
+        });
 
-      const subscription = await this.remote.getClient().liveOf(uuid);
-      subscription.subscribe((message) => {
-        if (message.action === 'KILLED') return;
+        this.liveByTable.set(table, uuid);
+        this.logger.info(
+          { table, Category: 'sp00ky-client::CrdtManager::ensureTableSubscription' },
+          'LIVE SELECT started'
+        );
+      } catch (e) {
+        this.logger.warn(
+          { error: e, table, Category: 'sp00ky-client::CrdtManager::ensureTableSubscription' },
+          'Failed to start LIVE SELECT'
+        );
+      }
+    })();
+
+    this.pendingLive.set(table, start);
+    try {
+      await start;
+    } finally {
+      this.pendingLive.delete(table);
+    }
+  }
 
-        if (message.action === 'CREATE' || message.action === 'UPDATE') {
-          const fieldName = message.value.field as string;
-          const state = message.value.state as string;
+  /** Apply a parent-row payload from a non-LIVE source (e.g. the
+   *  list_ref-driven sync engine, when the cross-user LIVE on the
+   *  parent table is filtered out by the SurrealDB cross-session
+   *  permission gap). Same semantics as the internal `dispatchRow`. */
+  applyRow(table: string, row: Record<string, unknown>): void {
+    this.dispatchRow(table, row);
+  }
 
-          if (!fieldName || !state) return;
+  /** Dispatch a parent-row LIVE event to every open CrdtField on that
+   *  record. Each open field reads its slice of the row directly — the
+   *  CRDT snapshot is a column on the parent now, so there is no
+   *  follow-up subquery. */
+  private dispatchRow(table: string, row: Record<string, unknown>): void {
+    const id = row.id != null ? String(row.id) : '';
+    if (!id) return;
 
-          // Route cursor updates to the corresponding CrdtField
-          if (fieldName.startsWith('_cursor_')) {
-            const actualField = fieldName.slice('_cursor_'.length);
-            const key = this.makeKey(table, recordId, actualField);
-            const crdtField = this.fields.get(key);
-            if (crdtField) {
-              crdtField.importRemoteCursor(state);
-            }
-            return;
-          }
+    const rowKeyPrefix = `${table}:${id}:`;
+    for (const [key, crdtField] of this.fields) {
+      if (!key.startsWith(rowKeyPrefix)) continue;
+      const fieldName = key.slice(rowKeyPrefix.length);
+      const cursorsEnabled = this.fieldHasCursor(table, fieldName);
+      const slice = row[fieldName];
+      const snapshot = this.extractSnapshot(slice, cursorsEnabled);
+      if (snapshot) crdtField.importRemote(snapshot);
 
-          // Route document updates
-          const key = this.makeKey(table, recordId, fieldName);
-          const crdtField = this.fields.get(key);
-          if (crdtField) {
-            crdtField.importRemote(state);
+      if (cursorsEnabled && slice && typeof slice === 'object') {
+        const cursors = (slice as { cursors?: unknown }).cursors;
+        if (cursors && typeof cursors === 'object') {
+          for (const [sid, blob] of Object.entries(cursors as Record<string, unknown>)) {
+            if (sid === this.sessionId) continue;
+            if (typeof blob === 'string' && blob.length > 0) {
+              crdtField.importRemoteCursor(blob);
+            }
           }
         }
-      });
+      }
+    }
+  }
 
-      this.logger.info(
-        { recordId, Category: 'sp00ky-client::CrdtManager::ensureLiveSelect' },
-        'LIVE SELECT on _00_crdt started'
+  /** One-shot remote fetch for a row whose CRDT field hasn't synced
+   *  locally yet (fresh device, memory-backed local DB after reload, …).
+   *  Used by `open()` when the local read came up empty. Subsequent
+   *  cross-browser updates ride `dispatchRow` via the parent LIVE feed. */
+  private async fetchAndDispatchRow(table: string, id: string): Promise<void> {
+    try {
+      const recordId = parseRecordIdString(id);
+      const [row] = await this.remote.query<[Record<string, unknown> | null]>(
+        `SELECT * FROM ONLY $id`,
+        { id: recordId },
       );
+      if (!row || typeof row !== 'object') return;
+      this.dispatchRow(table, row as Record<string, unknown>);
     } catch (e) {
       this.logger.warn(
-        { error: e, recordId, Category: 'sp00ky-client::CrdtManager::ensureLiveSelect' },
-        'Failed to start LIVE SELECT on _00_crdt'
+        { error: e, table, id, Category: 'sp00ky-client::CrdtManager::fetchAndDispatchRow' },
+        'Failed to fetch parent row for CRDT hydration'
       );
     }
   }
 
-  private killLiveSelect(recordId: string): void {
-    const entry = this.liveQueries.get(recordId);
-    if (entry) {
-      this.remote.query('KILL $uuid', { uuid: entry.uuid }).catch(() => {});
-      this.liveQueries.delete(recordId);
+  /** Schema lookup: does `<table>.<field>` carry a `@cursor` annotation?
+   *  Determines the on-disk shape (plain snapshot vs. `{ state, cursors }`). */
+  private fieldHasCursor(table: string, field: string): boolean {
+    const tableSchema = this.schema.tables.find((t) => t.name === table);
+    return !!tableSchema?.columns[field]?.cursor;
+  }
+
+  /** Pull the LoroDoc snapshot bytes out of a row slice. For `@crdt`-only
+   *  the slice IS the snapshot (Uint8Array); for `@crdt @cursor` it's
+   *  `{ state, cursors }` where `state` carries the snapshot bytes. */
+  private extractSnapshot(value: unknown, cursorsEnabled: boolean): Uint8Array | undefined {
+    const asBytes = (v: unknown): Uint8Array | undefined => {
+      if (v instanceof Uint8Array) return v.length > 0 ? v : undefined;
+      // SurrealDB ferries bytes through several shapes depending on
+      // transport and on whether the field is a top-level `bytes` column
+      // or bytes nested inside a FLEXIBLE object. Round-tripping bytes
+      // through `option<object> FLEXIBLE` (the `@crdt @cursor` shape) in
+      // particular comes back as a plain `number[]` from the local WASM
+      // DB and as `Uint8Array` from the remote WS engine. Normalize all
+      // recognized variants here so the receiving CrdtField doesn't care.
+      if (v instanceof ArrayBuffer) return new Uint8Array(v);
+      if (ArrayBuffer.isView(v)) {
+        const view = v as ArrayBufferView;
+        return new Uint8Array(view.buffer, view.byteOffset, view.byteLength);
+      }
+      if (Array.isArray(v) && v.length > 0 && v.every((n) => typeof n === 'number')) {
+        return Uint8Array.from(v as number[]);
+      }
+      return undefined;
+    };
+
+    if (cursorsEnabled) {
+      if (value && typeof value === 'object' && !(value instanceof Uint8Array)) {
+        return asBytes((value as { state?: unknown }).state);
+      }
+      return undefined;
+    }
+    return asBytes(value);
+  }
+
+  private killTableSubscription(table: string): void {
+    const uuid = this.liveByTable.get(table);
+    if (uuid) {
+      this.remote.query('KILL $uuid', { uuid }).catch(() => {});
+      this.liveByTable.delete(table);
     }
   }
 
@@ -183,6 +317,11 @@ export class CrdtManager {
    * of silently producing a non-CRDT writer.
    */
   private assertCrdtField(table: string, field: string): void {
+    if (!/^[a-zA-Z_][a-zA-Z0-9_]*$/.test(field)) {
+      throw new Error(
+        `openCrdtField: refusing unsafe field identifier '${field}' — must match [a-zA-Z_][a-zA-Z0-9_]*`
+      );
+    }
     const tableSchema = this.schema.tables.find((t) => t.name === table);
     if (!tableSchema) {
       throw new Error(

package/src/modules/data/index.ts

@@ -21,6 +21,7 @@ import type {
   QueryConfigRecord,
   UpdateOptions,
   RunOptions} from '../../types';
+import { MATERIALIZATION_SAMPLE_WINDOW } from '../../types';
 import {
   parseRecordIdString,
   extractIdPart,
@@ -48,6 +49,17 @@ export class DataModule<S extends SchemaStructure> {
   private mutationCallbacks: Set<MutationCallback> = new Set();
   private debounceTimers: Map<QueryHash, NodeJS.Timeout> = new Map();
   private logger: Logger;
+  // Salt for query-id hashing. Set from SurrealDB's session::id() so two
+  // browser sessions registering the same logical query (same surql + params)
+  // don't collide on the same `_00_query` row — each session gets its own.
+  // Empty string until init(sessionId) is called.
+  private sessionId: string = '';
+  // Authenticated user record id (e.g. `"user:abc"`). Updated by
+  // `setCurrentUserId` from the auth subscription. null when
+  // unauthenticated. Consulted by `Sp00kySync.listRefTable()` so the
+  // poll and LIVE subscription target the same per-user
+  // `_00_list_ref_user_<id>` table the sync engine writes to.
+  private currentUserId: string | null = null;
 
   constructor(
     private cache: CacheModule,
@@ -59,8 +71,38 @@ export class DataModule<S extends SchemaStructure> {
     this.logger = logger.child({ service: 'DataModule' });
   }
 
-  async init(): Promise<void> {
-    this.logger.info({ Category: 'sp00ky-client::DataModule::init' }, 'DataModule initialized');
+  async init(sessionId: string): Promise<void> {
+    this.sessionId = sessionId;
+    this.logger.info(
+      { sessionId, Category: 'sp00ky-client::DataModule::init' },
+      'DataModule initialized'
+    );
+  }
+
+  /**
+   * Update the session salt used in query-id hashing. Call this when the
+   * SurrealDB session changes (sign-in, sign-out, reconnect). Subsequently
+   * registered queries will get fresh, session-scoped IDs.
+   */
+  setSessionId(sessionId: string): void {
+    this.sessionId = sessionId;
+  }
+
+  /**
+   * Update the authenticated user record id. Pass `null` on sign-out.
+   * Read by `Sp00kySync.listRefTable()` so the LIVE subscription and
+   * the poll route to the same per-user `_00_list_ref_user_<id>` the
+   * SSP writes to.
+   */
+  setCurrentUserId(userId: string | null): void {
+    this.currentUserId = userId;
+  }
+
+  /** Read-only view of the authenticated user id used for per-user
+   * `_00_list_ref` routing. Other modules consult this so they pick the
+   * same table name DataModule does. */
+  getCurrentUserId(): string | null {
+    return this.currentUserId;
   }
 
   // ==================== QUERY MANAGEMENT ====================
@@ -80,6 +122,8 @@ export class DataModule<S extends SchemaStructure> {
       'Query Initialization: started'
     );
 
+    // `_00_query` stays the single shared registration table in both
+    // ref-modes; the per-user split happens only on `_00_list_ref`.
     const recordId = new RecordId('_00_query', hash);
 
     if (this.activeQueries.has(hash)) {
@@ -189,7 +233,7 @@ export class DataModule<S extends SchemaStructure> {
   }
 
   private async processStreamUpdate(update: StreamUpdate): Promise<void> {
-    const { queryHash, localArray } = update;
+    const { queryHash, localArray, materializationTimeMs } = update;
     const queryState = this.activeQueries.get(queryHash);
     if (!queryState) {
       this.logger.warn(
@@ -199,6 +243,18 @@ export class DataModule<S extends SchemaStructure> {
       return;
     }
 
+    // Update the rolling materialization-sample window before the work that
+    // could throw, so the percentiles still move when the downstream local
+    // query fails (the materialization step itself ran).
+    if (typeof materializationTimeMs === 'number') {
+      queryState.materializationSamples.push(materializationTimeMs);
+      if (queryState.materializationSamples.length > MATERIALIZATION_SAMPLE_WINDOW) {
+        queryState.materializationSamples.shift();
+      }
+      queryState.lastIngestLatencyMs = materializationTimeMs;
+    }
+    const percentiles = this.computeMaterializationPercentiles(queryState.materializationSamples);
+
     try {
       // Fetch updated records
       const [records] = await this.local.query<[Record<string, any>[]]>(
@@ -209,16 +265,44 @@ export class DataModule<S extends SchemaStructure> {
       // Update state
       const newRecords = records || [];
       queryState.config.localArray = localArray;
-      await this.local.query(surql.seal(surql.updateSet('id', ['localArray'])), {
-        id: queryState.config.id,
-        localArray,
-      });
 
-      // Skip notification if records haven't changed
       const prevJson = JSON.stringify(queryState.records);
       const newJson = JSON.stringify(newRecords);
       queryState.records = newRecords;
-      if (prevJson === newJson) {
+      const recordsChanged = prevJson !== newJson;
+
+      // updateCount counts user-visible updates (matches the prior semantic),
+      // while the materialization sample/percentiles already moved above for
+      // every observed engine step.
+      if (recordsChanged) {
+        queryState.updateCount++;
+      }
+
+      await this.local.query(
+        surql.seal(
+          surql.updateSet('id', [
+            'localArray',
+            'rowCount',
+            'updateCount',
+            'lastIngestLatency',
+            'materializationP55',
+            'materializationP90',
+            'materializationP99',
+          ])
+        ),
+        {
+          id: queryState.config.id,
+          localArray,
+          rowCount: localArray.length,
+          updateCount: queryState.updateCount,
+          lastIngestLatency: queryState.lastIngestLatencyMs,
+          materializationP55: percentiles.p55,
+          materializationP90: percentiles.p90,
+          materializationP99: percentiles.p99,
+        }
+      );
+
+      if (!recordsChanged) {
         this.logger.debug(
           { queryHash, Category: 'sp00ky-client::DataModule::onStreamUpdate' },
           'Query records unchanged, skipping notification'
@@ -226,8 +310,6 @@ export class DataModule<S extends SchemaStructure> {
         return;
       }
 
-      queryState.updateCount++;
-
       // Notify subscribers
       const subscribers = this.subscriptions.get(queryHash);
       if (subscribers) {
@@ -245,11 +327,50 @@ export class DataModule<S extends SchemaStructure> {
         'Query updated from stream'
       );
     } catch (err) {
+      queryState.errorCount++;
       this.logger.error(
         { err, queryHash, Category: 'sp00ky-client::DataModule::onStreamUpdate' },
         'Failed to fetch records for stream update'
       );
+      // Best-effort persist of the bumped errorCount; swallow secondary
+      // failures to avoid masking the original error in logs.
+      try {
+        await this.local.query(surql.seal(surql.updateSet('id', ['errorCount'])), {
+          id: queryState.config.id,
+          errorCount: queryState.errorCount,
+        });
+      } catch (persistErr) {
+        this.logger.warn(
+          {
+            err: persistErr,
+            queryHash,
+            Category: 'sp00ky-client::DataModule::onStreamUpdate',
+          },
+          'Failed to persist incremented errorCount'
+        );
+      }
+    }
+  }
+
+  /**
+   * Compute p55/p90/p99 from a rolling window of materialization samples.
+   * Returns nulls for any percentile that has no samples yet so SurrealDB
+   * `option<float>` columns stay NONE rather than 0 before the first ingest.
+   */
+  private computeMaterializationPercentiles(samples: number[]): {
+    p55: number | null;
+    p90: number | null;
+    p99: number | null;
+  } {
+    if (samples.length === 0) {
+      return { p55: null, p90: null, p99: null };
     }
+    const sorted = [...samples].sort((a, b) => a - b);
+    const pick = (q: number) => {
+      const idx = Math.min(sorted.length - 1, Math.floor(q * sorted.length));
+      return sorted[idx]!;
+    };
+    return { p55: pick(0.55), p90: pick(0.90), p99: pick(0.99) };
   }
 
   /**
@@ -273,6 +394,10 @@ export class DataModule<S extends SchemaStructure> {
     return Array.from(this.activeQueries.values());
   }
 
+  getActiveQueryHashes(): QueryHash[] {
+    return Array.from(this.activeQueries.keys());
+  }
+
   async updateQueryLocalArray(id: string, localArray: RecordVersionArray): Promise<void> {
     const queryState = this.activeQueries.get(id);
     if (!queryState) {
@@ -709,6 +834,7 @@ export class DataModule<S extends SchemaStructure> {
       tableName,
     });
 
+    const t0 = performance.now();
     const { localArray } = this.cache.registerQuery({
       queryHash: hash,
       surql: surqlString,
@@ -716,12 +842,18 @@ export class DataModule<S extends SchemaStructure> {
       ttl: new Duration(ttl),
       lastActiveAt: new Date(),
     });
+    const registrationTime = performance.now() - t0;
 
     await withRetry(this.logger, () =>
-      this.local.query(surql.seal(surql.updateSet('id', ['localArray'])), {
-        id: recordId,
-        localArray,
-      })
+      this.local.query(
+        surql.seal(surql.updateSet('id', ['localArray', 'registrationTime', 'rowCount'])),
+        {
+          id: recordId,
+          localArray,
+          registrationTime,
+          rowCount: localArray.length,
+        }
+      )
     );
 
     this.activeQueries.set(hash, queryState);
@@ -773,8 +905,12 @@ export class DataModule<S extends SchemaStructure> {
             localArray: [],
             remoteArray: [],
             lastActiveAt: new Date(),
+            createdAt: new Date(),
             ttl,
             tableName,
+            updateCount: 0,
+            rowCount: 0,
+            errorCount: 0,
           },
         })
       );
@@ -798,17 +934,34 @@ export class DataModule<S extends SchemaStructure> {
       );
     }
 
+    // Persisted counters survive a restart even though the rolling
+    // sample window is rebuilt from scratch in memory.
+    const persistedUpdateCount =
+      typeof (configRecord as any)?.updateCount === 'number'
+        ? (configRecord as any).updateCount
+        : 0;
+    const persistedErrorCount =
+      typeof (configRecord as any)?.errorCount === 'number'
+        ? (configRecord as any).errorCount
+        : 0;
+
     return {
       config,
       records,
       ttlTimer: null,
       ttlDurationMs: parseDuration(ttl),
-      updateCount: 0,
+      updateCount: persistedUpdateCount,
+      materializationSamples: [],
+      lastIngestLatencyMs: null,
+      errorCount: persistedErrorCount,
     };
   }
 
   private async calculateHash(data: any): Promise<string> {
-    const content = JSON.stringify(data);
+    // sessionId is part of the hash so the same logical query from two
+    // sessions (e.g. two browser tabs of the same user) lands on different
+    // `_00_query` rows and doesn't fight over a shared one.
+    const content = JSON.stringify({ ...data, sessionId: this.sessionId });
     const msgBuffer = new TextEncoder().encode(content);
     const hashBuffer = await crypto.subtle.digest('SHA-256', msgBuffer);
     const hashArray = Array.from(new Uint8Array(hashBuffer));