@syncular/server 0.20.1 → 0.21.1

package/dist/context.d.ts

@@ -61,6 +61,8 @@ export interface ServerLimits {
     readonly maxOperationsPerRequest: number;
     /** Inline rows segments up to this size (§5.7 SHOULD: 256 KiB). */
     readonly inlineSegmentMaxBytes: number;
+    /** §6.11 declared-reference cascade cap per commit (reference default). */
+    readonly maxCascadeOperationsPerCommit: number;
 }
 export declare const DEFAULT_LIMITS: ServerLimits;
 /** Receives applied commits for realtime fanout (§8.2). */

package/dist/context.js

@@ -14,6 +14,7 @@ export const RESOLVER_OUTAGE = Symbol.for('syncular.resolver_outage');
 export const DEFAULT_LIMITS = {
     maxOperationsPerRequest: 500,
     inlineSegmentMaxBytes: 256 * 1024,
+    maxCascadeOperationsPerCommit: 1_000,
 };
 export function clockOf(ctx) {
     return ctx.clock ?? Date.now;

package/dist/d1-storage.js

@@ -138,6 +138,21 @@ class D1Transaction {
             .first();
         return record === null ? undefined : toStoredRow(record);
     }
+    async getTombstoneSeq(table, rowId) {
+        this.#assertOpen();
+        // Persisted read, no #pending overlay: a delete buffered by this commit
+        // records its tombstone at appendCommit, matching the SQLite/Postgres
+        // adapters where the tombstone insert also runs at commit append.
+        const record = await this.#db
+            .prepare('SELECT commit_seq FROM sync_tombstones WHERE partition=? AND tbl=? AND row_id=?')
+            .bind(this.#partition, table, rowId)
+            .first();
+        return record?.commit_seq;
+    }
+    async clearTombstone(table, rowId) {
+        this.#assertOpen();
+        this.#buffer_('DELETE FROM sync_tombstones WHERE partition=? AND tbl=? AND row_id=?', [this.#partition, table, rowId]);
+    }
     async getPushResult(clientId, clientCommitId) {
         this.#assertOpen();
         // D1 reads run in autocommit; the push layer's duplicate re-check happens
@@ -405,6 +420,12 @@ class D1Transaction {
                 JSON.stringify(change.scopes),
                 change.payload ?? null,
             ]);
+            if (change.op === 'delete') {
+                // §5 delete precedence: every applied delete leaves a tombstone,
+                // pruned with the commit log (§4.6).
+                this.#buffer_(`INSERT INTO sync_tombstones(partition, tbl, row_id, commit_seq) VALUES (?,?,?,?)
+           ON CONFLICT(partition, tbl, row_id) DO UPDATE SET commit_seq=excluded.commit_seq`, [p, change.table, change.rowId, commitSeq]);
+            }
             for (const [variable, value] of Object.entries(change.scopes)) {
                 this.#buffer_('INSERT OR IGNORE INTO sync_change_scopes(partition, tbl, var, value, commit_seq) VALUES (?,?,?,?,?)', [p, change.table, variable, value, commitSeq]);
             }
@@ -1024,7 +1045,12 @@ export class D1ServerStorage {
             this.#db
                 .prepare(`SELECT horizon_seq, (SELECT count(*) FROM sync_commits WHERE partition=? AND commit_seq<=${horizon}) AS removed_commits FROM sync_partitions WHERE partition=?`)
                 .bind(partition, partition, partition),
-            ...['sync_commits', 'sync_changes', 'sync_change_scopes'].map((table) => this.#db
+            ...[
+                'sync_commits',
+                'sync_changes',
+                'sync_change_scopes',
+                'sync_tombstones',
+            ].map((table) => this.#db
                 .prepare(`DELETE FROM ${table} WHERE partition=? AND commit_seq<=${horizon} AND ${epochGuard}`)
                 .bind(partition, partition, partition, query.logEpoch)),
         ]);

package/dist/errors.js

@@ -111,6 +111,22 @@ export const ERROR_CATALOG = {
         recommendedAction: 'forceResync',
         httpStatus: 404,
     },
+    // §5 delete precedence: an unversioned upsert lost to a delete inside the
+    // tombstone horizon. The client drops the operation on rebuild.
+    'sync.row_deleted': {
+        category: 'not-found',
+        retryable: false,
+        recommendedAction: 'fixRequest',
+        httpStatus: 404,
+    },
+    // §6.11 declared references: absent parent, RESTRICT delete with live
+    // children, or the cascade cap. A push operation-result error only.
+    'sync.reference_violation': {
+        category: 'invalid-request',
+        retryable: false,
+        recommendedAction: 'fixRequest',
+        httpStatus: 400,
+    },
     'sync.version_conflict': {
         category: 'conflict',
         retryable: false,
@@ -191,12 +207,6 @@ export const ERROR_CATALOG = {
         recommendedAction: 'upgradeClient',
         httpStatus: 400,
     },
-    'sync.client_wire_unsupported': {
-        category: 'schema-mismatch',
-        retryable: false,
-        recommendedAction: 'upgradeClient',
-        httpStatus: 400,
-    },
     'sync.websocket_connection_limit': {
         category: 'rate-limited',
         retryable: true,

package/dist/frame-bytes.js

@@ -9,13 +9,11 @@
  * bytes; the reference codec remains the single source of wire bytes.
  */
 import { encodeMessage, PROTOCOL_WIRE_VERSION, } from '@syncular/core';
-const stubHeader = (wireVersion) => wireVersion >= 2
-    ? {
-        type: 'RESP_HEADER',
-        logEpoch: 'frame-probe',
-        resetRequired: false,
-    }
-    : { type: 'RESP_HEADER' };
+const stubHeader = () => ({
+    type: 'RESP_HEADER',
+    logEpoch: 'frame-probe',
+    resetRequired: false,
+});
 const STUB_SUB_START = {
     type: 'SUB_START',
     id: '',
@@ -26,32 +24,32 @@ const STUB_SUB_START = {
 };
 const STUB_SUB_END = { type: 'SUB_END', nextCursor: 0 };
 const probe = encodeMessage({
-    wireVersion: 1,
+    wireVersion: PROTOCOL_WIRE_VERSION,
     msgKind: 'response',
-    frames: [stubHeader(1)],
+    frames: [stubHeader()],
 });
 /** The 8-byte SSP2 response envelope header (§1.2). */
 export function responseEnvelopeHeader(wireVersion) {
     const encoded = encodeMessage({
         wireVersion,
         msgKind: 'response',
-        frames: [stubHeader(wireVersion)],
+        frames: [stubHeader()],
     });
     return encoded.slice(0, 8);
 }
 /** The terminating END frame (§1.2 rule 1). */
 export const END_FRAME_BYTES = probe.slice(probe.length - 5);
-function wrapperFor(frame, wireVersion) {
+function wrapperFor(frame) {
     switch (frame.type) {
         case 'RESP_HEADER':
             return { frames: [frame], index: 0 };
         case 'LEASE':
             // §7.3.2: LEASE rides immediately after RESP_HEADER.
-            return { frames: [stubHeader(wireVersion), frame], index: 1 };
+            return { frames: [stubHeader(), frame], index: 1 };
         case 'PUSH_RESULT':
         case 'ERROR':
         case 'UNKNOWN':
-            return { frames: [stubHeader(wireVersion), frame], index: 1 };
+            return { frames: [stubHeader(), frame], index: 1 };
         case 'PUSH_RESULT_DETAILS': {
             const result = {
                 type: 'PUSH_RESULT',
@@ -65,23 +63,23 @@ function wrapperFor(frame, wireVersion) {
                     retryable: false,
                 })),
             };
-            return { frames: [stubHeader(wireVersion), result, frame], index: 2 };
+            return { frames: [stubHeader(), result, frame], index: 2 };
         }
         case 'SUB_START':
             return {
-                frames: [stubHeader(wireVersion), frame, STUB_SUB_END],
+                frames: [stubHeader(), frame, STUB_SUB_END],
                 index: 1,
             };
         case 'SUB_END':
             return {
-                frames: [stubHeader(wireVersion), STUB_SUB_START, frame],
+                frames: [stubHeader(), STUB_SUB_START, frame],
                 index: 2,
             };
         case 'COMMIT':
         case 'SEGMENT_REF':
         case 'SEGMENT_INLINE':
             return {
-                frames: [stubHeader(wireVersion), STUB_SUB_START, frame, STUB_SUB_END],
+                frames: [stubHeader(), STUB_SUB_START, frame, STUB_SUB_END],
                 index: 2,
             };
     }
@@ -91,7 +89,7 @@ function wrapperFor(frame, wireVersion) {
  * reference codec.
  */
 export function encodeResponseFrame(frame, wireVersion = PROTOCOL_WIRE_VERSION) {
-    const { frames, index } = wrapperFor(frame, wireVersion);
+    const { frames, index } = wrapperFor(frame);
     const encoded = encodeMessage({
         wireVersion,
         msgKind: 'response',

package/dist/handler.js

@@ -112,9 +112,6 @@ async function planRequest(request, ctx, schema, registry) {
         else if (frame.type === 'SUBSCRIPTION')
             subFrames.push(frame);
     }
-    if (request.wireVersion === 1 && registry.epochRequired) {
-        throw syncError('sync.client_wire_unsupported', 'this partition requires a client that validates log epochs (§2.1)');
-    }
     if (request.wireVersion >= 2 &&
         header.logEpoch === undefined &&
         pushes.length > 0) {

package/dist/operations.js

@@ -1,5 +1,5 @@
 import { validateAuthoritativeRelationPlan, } from './authoritative-query.js';
-import { decodeRow, decodeRemoteOperationRequest, encodeRow, encodeRemoteOperationResponse, } from '@syncular/core';
+import { decodeRow, decodeRemoteOperationRequest, encodeRemoteOperationResponse, encodeSparseRow, } from '@syncular/core';
 import { REMOTE_COMMAND_CLIENT_ID_PREFIX, RESOLVER_OUTAGE, touchAuthenticatedPartition, } from './context.js';
 import { SyncError, syncError } from './errors.js';
 import { processPushOperationsWithTrace } from './push.js';
@@ -270,7 +270,7 @@ function commandOperations(mutations, schema) {
             table: table.name,
             rowId,
             op: 'upsert',
-            payload: encodeRow(table.columns, values),
+            payload: encodeSparseRow(table.columns, table.primaryKeyIndex, values),
         };
     });
 }

package/dist/postgres-storage.d.ts

@@ -24,7 +24,7 @@ import type { AuthoritativeQueryRequest, AuthoritativeQueryResult, ClientCursorI
  *     set, §5.9.5) as an index range, never a scan. `postgres-explain
  *     .test.ts` asserts an `Index` node here too.
  */
-export declare const POSTGRES_DDL = "\nCREATE TABLE IF NOT EXISTS sync_partitions(\n  partition TEXT PRIMARY KEY,\n  max_commit_seq BIGINT NOT NULL DEFAULT 0,\n  horizon_seq BIGINT NOT NULL DEFAULT 0\n);\nCREATE TABLE IF NOT EXISTS sync_partition_registry(\n  partition TEXT PRIMARY KEY,\n  log_epoch TEXT NOT NULL,\n  epoch_required BOOLEAN NOT NULL DEFAULT FALSE,\n  last_authenticated_at_ms BIGINT NOT NULL\n);\nCREATE TABLE IF NOT EXISTS sync_row_scopes(\n  partition TEXT NOT NULL, tbl TEXT NOT NULL,\n  var TEXT NOT NULL, value TEXT NOT NULL, row_id TEXT NOT NULL,\n  PRIMARY KEY(partition, tbl, var, value, row_id)\n);\nCREATE TABLE IF NOT EXISTS sync_commits(\n  partition TEXT NOT NULL, commit_seq BIGINT NOT NULL,\n  client_id TEXT NOT NULL, client_commit_id TEXT NOT NULL,\n  actor_id TEXT NOT NULL, created_at_ms BIGINT NOT NULL,\n  PRIMARY KEY(partition, commit_seq)\n);\nCREATE INDEX IF NOT EXISTS sync_commits_by_time\n  ON sync_commits(partition, created_at_ms);\nCREATE TABLE IF NOT EXISTS sync_changes(\n  partition TEXT NOT NULL, commit_seq BIGINT NOT NULL, idx INTEGER NOT NULL,\n  tbl TEXT NOT NULL, row_id TEXT NOT NULL, op SMALLINT NOT NULL,\n  row_version BIGINT, scopes JSONB NOT NULL, payload BYTEA,\n  PRIMARY KEY(partition, commit_seq, idx)\n);\nCREATE INDEX IF NOT EXISTS sync_changes_by_table\n  ON sync_changes(partition, commit_seq, tbl, idx);\nCREATE TABLE IF NOT EXISTS sync_change_scopes(\n  partition TEXT NOT NULL, tbl TEXT NOT NULL,\n  var TEXT NOT NULL, value TEXT NOT NULL, commit_seq BIGINT NOT NULL,\n  PRIMARY KEY(partition, tbl, var, value, commit_seq)\n);\nCREATE TABLE IF NOT EXISTS sync_push_results(\n  partition TEXT NOT NULL, client_id TEXT NOT NULL,\n  client_commit_id TEXT NOT NULL, result JSONB NOT NULL,\n  PRIMARY KEY(partition, client_id, client_commit_id)\n);\nCREATE TABLE IF NOT EXISTS sync_reactions(\n  partition TEXT NOT NULL, idempotency_key TEXT NOT NULL,\n  type TEXT NOT NULL, version INTEGER NOT NULL, payload JSONB NOT NULL,\n  source_client_id TEXT NOT NULL, source_client_commit_id TEXT NOT NULL,\n  source_commit_seq BIGINT NOT NULL, created_at_ms BIGINT NOT NULL,\n  available_at_ms BIGINT NOT NULL, status TEXT NOT NULL,\n  attempts INTEGER NOT NULL, max_attempts INTEGER NOT NULL,\n  lease_owner TEXT, lease_expires_at_ms BIGINT, completed_at_ms BIGINT,\n  last_failure JSONB,\n  PRIMARY KEY(partition, idempotency_key),\n  CHECK(status IN ('pending', 'leased', 'completed', 'dead-letter'))\n);\nCREATE INDEX IF NOT EXISTS sync_reactions_due\n  ON sync_reactions(partition, status, available_at_ms, created_at_ms, idempotency_key);\nCREATE INDEX IF NOT EXISTS sync_reactions_lease\n  ON sync_reactions(partition, status, lease_expires_at_ms);\nCREATE INDEX IF NOT EXISTS sync_reactions_completed\n  ON sync_reactions(partition, status, completed_at_ms, idempotency_key);\nCREATE INDEX IF NOT EXISTS sync_reactions_dead_letter\n  ON sync_reactions(partition, status, available_at_ms, idempotency_key);\nCREATE TABLE IF NOT EXISTS sync_clients(\n  partition TEXT NOT NULL, client_id TEXT NOT NULL, actor_id TEXT NOT NULL,\n  wire_version INTEGER NOT NULL DEFAULT 1,\n  cursor BIGINT NOT NULL, subscriptions JSONB NOT NULL,\n  updated_at_ms BIGINT NOT NULL,\n  PRIMARY KEY(partition, client_id)\n);\nALTER TABLE sync_clients\n  ADD COLUMN IF NOT EXISTS wire_version INTEGER NOT NULL DEFAULT 1;\nCREATE TABLE IF NOT EXISTS sync_blob_refs(\n  partition TEXT NOT NULL, tbl TEXT NOT NULL, row_id TEXT NOT NULL,\n  blob_id TEXT NOT NULL,\n  PRIMARY KEY(partition, tbl, row_id, blob_id)\n);\nCREATE INDEX IF NOT EXISTS sync_blob_refs_by_blob\n  ON sync_blob_refs(partition, blob_id);\n";
+export declare const POSTGRES_DDL = "\nCREATE TABLE IF NOT EXISTS sync_partitions(\n  partition TEXT PRIMARY KEY,\n  max_commit_seq BIGINT NOT NULL DEFAULT 0,\n  horizon_seq BIGINT NOT NULL DEFAULT 0\n);\nCREATE TABLE IF NOT EXISTS sync_partition_registry(\n  partition TEXT PRIMARY KEY,\n  log_epoch TEXT NOT NULL,\n  epoch_required BOOLEAN NOT NULL DEFAULT FALSE,\n  last_authenticated_at_ms BIGINT NOT NULL\n);\nCREATE TABLE IF NOT EXISTS sync_row_scopes(\n  partition TEXT NOT NULL, tbl TEXT NOT NULL,\n  var TEXT NOT NULL, value TEXT NOT NULL, row_id TEXT NOT NULL,\n  PRIMARY KEY(partition, tbl, var, value, row_id)\n);\nCREATE TABLE IF NOT EXISTS sync_commits(\n  partition TEXT NOT NULL, commit_seq BIGINT NOT NULL,\n  client_id TEXT NOT NULL, client_commit_id TEXT NOT NULL,\n  actor_id TEXT NOT NULL, created_at_ms BIGINT NOT NULL,\n  PRIMARY KEY(partition, commit_seq)\n);\nCREATE INDEX IF NOT EXISTS sync_commits_by_time\n  ON sync_commits(partition, created_at_ms);\nCREATE TABLE IF NOT EXISTS sync_changes(\n  partition TEXT NOT NULL, commit_seq BIGINT NOT NULL, idx INTEGER NOT NULL,\n  tbl TEXT NOT NULL, row_id TEXT NOT NULL, op SMALLINT NOT NULL,\n  row_version BIGINT, scopes JSONB NOT NULL, payload BYTEA,\n  PRIMARY KEY(partition, commit_seq, idx)\n);\nCREATE INDEX IF NOT EXISTS sync_changes_by_table\n  ON sync_changes(partition, commit_seq, tbl, idx);\nCREATE TABLE IF NOT EXISTS sync_change_scopes(\n  partition TEXT NOT NULL, tbl TEXT NOT NULL,\n  var TEXT NOT NULL, value TEXT NOT NULL, commit_seq BIGINT NOT NULL,\n  PRIMARY KEY(partition, tbl, var, value, commit_seq)\n);\nCREATE TABLE IF NOT EXISTS sync_push_results(\n  partition TEXT NOT NULL, client_id TEXT NOT NULL,\n  client_commit_id TEXT NOT NULL, result JSONB NOT NULL,\n  PRIMARY KEY(partition, client_id, client_commit_id)\n);\nCREATE TABLE IF NOT EXISTS sync_reactions(\n  partition TEXT NOT NULL, idempotency_key TEXT NOT NULL,\n  type TEXT NOT NULL, version INTEGER NOT NULL, payload JSONB NOT NULL,\n  source_client_id TEXT NOT NULL, source_client_commit_id TEXT NOT NULL,\n  source_commit_seq BIGINT NOT NULL, created_at_ms BIGINT NOT NULL,\n  available_at_ms BIGINT NOT NULL, status TEXT NOT NULL,\n  attempts INTEGER NOT NULL, max_attempts INTEGER NOT NULL,\n  lease_owner TEXT, lease_expires_at_ms BIGINT, completed_at_ms BIGINT,\n  last_failure JSONB,\n  PRIMARY KEY(partition, idempotency_key),\n  CHECK(status IN ('pending', 'leased', 'completed', 'dead-letter'))\n);\nCREATE INDEX IF NOT EXISTS sync_reactions_due\n  ON sync_reactions(partition, status, available_at_ms, created_at_ms, idempotency_key);\nCREATE INDEX IF NOT EXISTS sync_reactions_lease\n  ON sync_reactions(partition, status, lease_expires_at_ms);\nCREATE INDEX IF NOT EXISTS sync_reactions_completed\n  ON sync_reactions(partition, status, completed_at_ms, idempotency_key);\nCREATE INDEX IF NOT EXISTS sync_reactions_dead_letter\n  ON sync_reactions(partition, status, available_at_ms, idempotency_key);\nCREATE TABLE IF NOT EXISTS sync_clients(\n  partition TEXT NOT NULL, client_id TEXT NOT NULL, actor_id TEXT NOT NULL,\n  wire_version INTEGER NOT NULL DEFAULT 1,\n  cursor BIGINT NOT NULL, subscriptions JSONB NOT NULL,\n  updated_at_ms BIGINT NOT NULL,\n  PRIMARY KEY(partition, client_id)\n);\nALTER TABLE sync_clients\n  ADD COLUMN IF NOT EXISTS wire_version INTEGER NOT NULL DEFAULT 1;\nCREATE TABLE IF NOT EXISTS sync_blob_refs(\n  partition TEXT NOT NULL, tbl TEXT NOT NULL, row_id TEXT NOT NULL,\n  blob_id TEXT NOT NULL,\n  PRIMARY KEY(partition, tbl, row_id, blob_id)\n);\nCREATE INDEX IF NOT EXISTS sync_blob_refs_by_blob\n  ON sync_blob_refs(partition, blob_id);\nCREATE TABLE IF NOT EXISTS sync_tombstones(\n  partition TEXT NOT NULL, tbl TEXT NOT NULL, row_id TEXT NOT NULL,\n  commit_seq BIGINT NOT NULL,\n  PRIMARY KEY(partition, tbl, row_id)\n);\n";
 export declare class PostgresServerStorage implements ServerStorage {
     #private;
     constructor(exec: PgExecutor);

package/dist/postgres-storage.js

@@ -108,6 +108,11 @@ CREATE TABLE IF NOT EXISTS sync_blob_refs(
 );
 CREATE INDEX IF NOT EXISTS sync_blob_refs_by_blob
   ON sync_blob_refs(partition, blob_id);
+CREATE TABLE IF NOT EXISTS sync_tombstones(
+  partition TEXT NOT NULL, tbl TEXT NOT NULL, row_id TEXT NOT NULL,
+  commit_seq BIGINT NOT NULL,
+  PRIMARY KEY(partition, tbl, row_id)
+);
 `;
 async function lockPartitionOn(client, partition) {
     const locked = await client.query('SELECT max_commit_seq FROM sync_partitions WHERE partition=$1 FOR UPDATE', [partition]);
@@ -174,6 +179,7 @@ function serializePushResult(result) {
                     message: record.message,
                     serverVersion: record.serverVersion,
                     serverRow: toBase64(record.serverRow),
+                    conflictColumns: toBase64(record.conflictColumns),
                 };
             }
             if (record.status === 'error') {
@@ -201,6 +207,7 @@ function deserializePushResult(value) {
                 message: record.message ?? '',
                 serverVersion: record.serverVersion ?? 0,
                 serverRow: fromBase64(record.serverRow ?? ''),
+                conflictColumns: fromBase64(record.conflictColumns ?? ''),
             };
         }
         if (record.status === 'error') {
@@ -242,6 +249,9 @@ function toStoredRow(record) {
         serverVersion: asNumber(record.server_version),
         scopes: asJson(record.scopes),
         payload: asBytes(record.payload),
+        ...(record.column_versions === null || record.column_versions === undefined
+            ? {}
+            : { columnVersions: asBytes(record.column_versions) }),
     };
 }
 function toStoredChange(record) {
@@ -343,6 +353,16 @@ class PostgresTransaction {
         this.#assertOpen();
         return getRowOn(this.#client, this.#resolveTable(table), this.#partition, rowId);
     }
+    async getTombstoneSeq(table, rowId) {
+        this.#assertOpen();
+        const { rows } = await this.#client.query('SELECT commit_seq FROM sync_tombstones WHERE partition=$1 AND tbl=$2 AND row_id=$3', [this.#partition, table, rowId]);
+        const seq = rows[0]?.commit_seq;
+        return seq === null || seq === undefined ? undefined : asNumber(seq);
+    }
+    async clearTombstone(table, rowId) {
+        this.#assertOpen();
+        await this.#client.query('DELETE FROM sync_tombstones WHERE partition=$1 AND tbl=$2 AND row_id=$3', [this.#partition, table, rowId]);
+    }
     getPushResult(clientId, clientCommitId) {
         this.#assertOpen();
         // Runs on this transaction's pinned client: the push layer's duplicate
@@ -465,15 +485,23 @@ class PostgresTransaction {
                 continue;
             // Bind serialized scopes as text before parsing JSONB. Drivers that
             // encode JSONB parameters would otherwise store this string as a scalar.
+            // One statement per change: scopes AND the §5 delete tombstone ride the
+            // same writable-CTE chain.
             await q.query(`WITH inserted AS (
            INSERT INTO sync_changes(partition, commit_seq, idx, tbl, row_id, op, row_version, scopes, payload)
            VALUES ($1,$2,$3,$4,$5,$6,$7,$8::text::jsonb,$9)
-           RETURNING partition, tbl, commit_seq, scopes
+           RETURNING partition, tbl, row_id, op, commit_seq, scopes
+         ),
+         scoped AS (
+           INSERT INTO sync_change_scopes(partition, tbl, var, value, commit_seq)
+           SELECT inserted.partition, inserted.tbl, scope.key, scope.value, inserted.commit_seq
+           FROM inserted CROSS JOIN LATERAL jsonb_each_text(inserted.scopes) AS scope
+           ON CONFLICT DO NOTHING
          )
-         INSERT INTO sync_change_scopes(partition, tbl, var, value, commit_seq)
-         SELECT inserted.partition, inserted.tbl, scope.key, scope.value, inserted.commit_seq
-         FROM inserted CROSS JOIN LATERAL jsonb_each_text(inserted.scopes) AS scope
-         ON CONFLICT DO NOTHING`, [
+         INSERT INTO sync_tombstones(partition, tbl, row_id, commit_seq)
+         SELECT partition, tbl, row_id, commit_seq FROM inserted WHERE op = 2
+         ON CONFLICT (partition, tbl, row_id)
+         DO UPDATE SET commit_seq = excluded.commit_seq`, [
                 p,
                 commitSeq,
                 idx,
@@ -792,6 +820,8 @@ export class PostgresServerStorage {
             const removed = await client.query('DELETE FROM sync_commits WHERE partition=$1 AND commit_seq<=$2', [partition, horizonSeq]);
             await client.query('DELETE FROM sync_changes WHERE partition=$1 AND commit_seq<=$2', [partition, horizonSeq]);
             await client.query('DELETE FROM sync_change_scopes WHERE partition=$1 AND commit_seq<=$2', [partition, horizonSeq]);
+            // §4.6: tombstones prune in the same pass as the commit log.
+            await client.query('DELETE FROM sync_tombstones WHERE partition=$1 AND commit_seq<=$2', [partition, horizonSeq]);
             return {
                 previousHorizonSeq,
                 horizonSeq,