@ultimat3/realtime 23.0.0 → 25.0.0

package/src/live-query.ts

@@ -6,54 +6,28 @@
 // policy is never sent to that actor — it arrives as a `delete` if they hold it, and is dropped
 // otherwise.
 
-import { type Actor, type Clock, finiteOption, systemClock, uuid } from '@ultimat3/core';
+import { type Clock, finiteOption, systemClock, uuidV7 } from '@ultimat3/core';
 import { queryHash } from '@ultimat3/query';
 import type { ChangeEvent } from './changefeed';
-import { type LiveCursor, makeCursor, type ReconnectBudget, type ResumeSource } from './cursor';
-import { isPolicyDenial, LiveQueryUnknownError, SubscriptionLimitError } from './errors';
+import { type LiveCursor, makeCursor } from './cursor';
+import { LiveQueryUnknownError, SubscriptionLimitError } from './errors';
 import type { JsonValue } from './json';
 import type { LiveQueryDefinition, LiveSubscription, SnapshotResult } from './live-contract';
-import { type FanoutDeps, fanoutChange, snapshotFrame } from './live-fanout';
-import { refuseSubscription } from './live-refusal';
+import { deliverChange } from './live-deliver';
+import { type FanoutDeps, snapshotFrame } from './live-fanout';
+import { floorAfterRead } from './live-floor';
+import { DEFAULT_MAX_ENTRIES, type LiveQueryRegistryOptions } from './live-query-options';
+import { reauthorizeSocket } from './live-reauth';
 import { resumeOnto } from './live-resume';
+import { type Charge, type SubscribeArgs, spendOnce } from './live-spend';
 import { liveTenantOf, windowId } from './live-tenant';
-import { createEntry, fillWindow, type QueryEntry } from './query-window';
+import { fillWindow, type QueryEntry, queryEntry } from './query-window';
 import type { SyncSocket } from './socket';
-import { type Subscriber, SubscriberGate, type SubscriberGateOptions } from './subscriber-gate';
+import { type Subscriber, SubscriberGate } from './subscriber-gate';
 import { SubscriptionBook, subscriptionKey } from './subscription-book';
 import type { Frame } from './sync-protocol';
-import type { Scheduler } from './thundering-herd';
 
-export interface LiveQueryRegistryOptions extends SubscriberGateOptions {
-  readonly source: ResumeSource;
-  readonly budget?: ReconnectBudget;
-  readonly clock?: Clock;
-  readonly maxPerSocket?: number;
-  readonly maxPerTenant?: number;
-  readonly tenantOf?: (actor: Actor | null) => string | null;
-  /**
-   * Distinct `(query, input)` pairs this node will hold at once. A `qid` derives from
-   * client-chosen input, so without a ceiling one socket mints entries — a matcher, a row window,
-   * a `WindowLock` and a fanout target each — until the process dies.
-   */
-  readonly maxEntries?: number;
-  /**
-   * How long one entry's SHARED snapshot read may hold its slot. Defaults to
-   * `DEFAULT_READ_DEADLINE_MS`. Without it a `definition.snapshot` that never settles pinned the
-   * slot for the life of the process and every later cold subscriber joined a promise nothing
-   * would resolve — one wedged read taking every future subscriber of that query id with it.
-   */
-  readonly readDeadlineMs?: number;
-  /** Injected so that deadline is provable without waiting for one. Production uses `setTimeout`. */
-  readonly schedule?: Scheduler;
-}
-
-/**
- * Live `(query, input)` pairs one node holds. Reached, the next NEW pair is refused with
- * `X_SUBSCRIPTION_LIMIT`; subscribing to a pair that already exists keeps working, because the
- * cost this bounds is the entry, not the subscriber.
- */
-export const DEFAULT_MAX_ENTRIES = 10_000;
+export { DEFAULT_MAX_ENTRIES, type LiveQueryRegistryOptions } from './live-query-options';
 
 export class LiveQueryRegistry {
   readonly #definitions = new Map<string, LiveQueryDefinition>();
@@ -67,6 +41,11 @@ export class LiveQueryRegistry {
   /** What one lane needs, and nothing this class holds beyond it. */
   readonly #fanout: FanoutDeps;
   #lastLsn = '';
+  /**
+   * This node's mark for a window read before it held any position: unique to the process, and
+   * `!` sorts below every hex digit, so every real change is above it.
+   */
+  readonly #origin = `!${uuidV7()}`;
   #staleChanges = 0;
 
   constructor(options: LiveQueryRegistryOptions) {
@@ -108,9 +87,9 @@ export class LiveQueryRegistry {
    * ever ask for a re-snapshot. The repair lands on the next change to each query — which is the
    * event that proves the query is moving at all.
    *
-   * `entity` narrows it to the windows that read that entity: a filtered write
-   * (`updateWhere`/`deleteWhere`) names its entity but no row, and staling every window on the node
-   * for it re-read every live query in the process on each bulk write to any table.
+   * `entity` — the RELATION, as on `ChangeEvent.table` — narrows it to the windows that read it:
+   * a filtered write (`updateWhere`/`deleteWhere`) names its table but no row, and staling every
+   * window on the node for it re-read every live query in the process on each bulk write.
    */
   invalidate(entity?: string): number {
     let marked = 0;
@@ -147,26 +126,36 @@ export class LiveQueryRegistry {
    * Subscribe or resume. Returns the frame this subscriber needs: a `snapshot` on a cold start or a
    * blown reconnect budget, a `patch` when the cursor is inside the retained window.
    */
-  async subscribe(args: {
-    socket: SyncSocket;
-    name: string;
-    input: JsonValue;
-    sid?: string;
-    cursor?: LiveCursor | null;
-  }): Promise<{ subscription: LiveSubscription; frame: Frame }> {
+  subscribe(args: SubscribeArgs): Promise<{ subscription: LiveSubscription; frame: Frame }> {
+    return this.#subscribe(args, { due: true });
+  }
+
+  /** `charge.due` false: a re-seat, whose subscription was paid for when it was first made. */
+  async #subscribe(
+    args: SubscribeArgs,
+    charge: Charge,
+  ): Promise<{ subscription: LiveSubscription; frame: Frame }> {
     const definition = this.#definitions.get(args.name);
     // A name this node never registered, and not a protocol skew: the frame parsed, the version
     // matched, and one string in it names nothing. Reporting it as `X_PROTOCOL_VERSION` handed the
     // client "x build && redeploy the client" for a typo no rebuild changes.
     if (!definition) throw new LiveQueryUnknownError({ name: args.name });
-    const sid = args.sid ?? uuid();
+    const sid = args.sid ?? uuidV7();
     // Everything this subscribe can be refused for, decided in one synchronous step BEFORE the
     // first await — the caps and the sid both. Read at the top and acted on three awaits later,
     // they were bypassed by the ordinary case: one WebSocket write carrying N subscribe frames,
     // dispatched concurrently, N of them reading a count nothing had grown yet.
     const slot = this.#book.reserve(args.socket, sid);
     try {
-      return await this.#subscribeReserved(definition, sid, args);
+      for (;;) {
+        // `authorize`, the read and the row pass all await, and a re-auth that lands under them
+        // re-decides only what is ATTACHED. So a subscription seated for an actor the socket no
+        // longer carries is taken back and served again under the one it does.
+        const actor = args.socket.actor;
+        const served = await this.#subscribeReserved(definition, sid, args, charge);
+        if (args.socket.actor === actor) return served;
+        this.unsubscribe(args.socket.id, sid);
+      }
     } finally {
       // After the attach on every path, so the slot is only ever given back to a count that has
       // already grown — or, on a failure, to one that never will.
@@ -183,19 +172,22 @@ export class LiveQueryRegistry {
       input: JsonValue;
       cursor?: LiveCursor | null;
     },
+    charge: Charge,
   ): Promise<{ subscription: LiveSubscription; frame: Frame }> {
     await definition.authorize?.({ actor: args.socket.actor, input: args.input });
-    // After this subscriber's own decision, never before it: resolving a shape for a caller who
-    // may not subscribe is work an unauthorized client gets to schedule.
-    await definition.prepare?.(args.input);
-
     // The window is the subscriber's TENANT's: two orgs on one `(query, input)` are two entries,
     // two reads and two retained rings, so no shared row ever stands between them and a policy.
     const tenant = liveTenantOf(args.socket.actor);
     const qid = windowId(queryHash(args.name, args.input), tenant);
+    // After this subscriber's own decision, never before it: resolving a shape for a caller who
+    // may not subscribe is work an unauthorized client gets to schedule.
+    await definition.prepare?.(args.input);
+
     const entry = this.#entryFor(qid, definition, args.input, tenant);
     try {
-      return await this.#serve(entry, sid, args);
+      // Charged where a read happens, never from the cursor's say-so (`live-spend.ts`).
+      const pay = () => spendOnce(definition, args.socket, charge, this.#clock);
+      return await this.#serve(entry, sid, args, pay);
     } catch (error) {
       // The entry was born above, before anything could fill it. Everything below can throw — the
       // snapshot, the resume, the window's own read deadline — and `unsubscribe` is the only other
@@ -215,6 +207,7 @@ export class LiveQueryRegistry {
       input: JsonValue;
       cursor?: LiveCursor | null;
     },
+    pay: () => Promise<void>,
   ): Promise<{ subscription: LiveSubscription; frame: Frame }> {
     const qid = entry.qid;
     const now = this.#clock.now().getTime();
@@ -223,7 +216,10 @@ export class LiveQueryRegistry {
     // replays. One that names another window — the same browser, signed in to another org, or a
     // forged frame — is not a position in this one: it is a cold start, never a replay of a ring
     // this subscriber's window does not own.
-    if (args.cursor && args.cursor.qid === qid) {
+    //
+    // Nor is ANY cursor a position in a window known to have missed a change: the ring still
+    // answers a delta for it, and that delta is the hole. A stale entry serves cold starts only.
+    if (args.cursor && args.cursor.qid === qid && !entry.stale) {
       const who = { sid, actor: args.socket.actor };
       const resumed = await resumeOnto(
         {
@@ -231,7 +227,11 @@ export class LiveQueryRegistry {
           budget: this.#options.budget,
           clock: this.#clock,
           gate: this.#gate,
-          read: () => this.#read(entry, who),
+          read: async () => {
+            await pay();
+            return await this.#read(entry, who);
+          },
+          beforeFill: pay,
         },
         entry,
         who,
@@ -242,6 +242,7 @@ export class LiveQueryRegistry {
       return { subscription, frame: resumed.frame };
     }
 
+    await pay();
     const fresh = await this.#read(entry, { sid, actor: args.socket.actor });
     const cursor = makeCursor(qid, fresh.lsn, fresh.rows, now);
     const subscription = this.#attachUnlessGone(entry, args.socket, sid, cursor);
@@ -290,103 +291,34 @@ export class LiveQueryRegistry {
     for (const subscription of this.#book.ofSocket(socketId)) {
       this.unsubscribe(socketId, subscription.sid);
     }
+    // Held or not: a socket re-authed while holding nothing is remembered by nothing else.
+    this.#book.forgetSocket(socketId);
   }
 
-  /**
-   * Actor changed mid-connection (login, logout, role change): re-run subscribe-time authz and drop
-   * what is no longer allowed. Survivors are marked desynced so the next flush re-snapshots them
-   * under the new actor's row policy. Returns the sids that were dropped — a denial and nothing
-   * else, so a caller may tell the client "you may no longer see this" and be right.
-   *
-   * A survivor whose actor now belongs to ANOTHER tenant cannot stay where it is: its window is the
-   * old org's. It is re-seated — dropped, subscribed again under the new tenant, and sent that
-   * window's snapshot under the same sid — or, when that cannot complete, refused on the socket
-   * under the sid (`refuseSubscription`), never kept on the old org's window.
-   */
-  async reauthorize(socket: SyncSocket): Promise<readonly string[]> {
-    const dropped: string[] = [];
-    // The actor changed, so what tenant this socket's subscriptions count against may have too.
-    // Told here rather than derived per lookup: the per-tenant cap is an index now, and an index
-    // nobody updates is a count that drifts from the book for the rest of the process.
-    this.#book.retenant(socket);
-    for (const subscription of this.#book.ofSocket(socket.id)) {
-      let failed: { readonly error: unknown } | undefined;
-      try {
-        await subscription.definition.authorize?.({
-          actor: socket.actor,
-          input: subscription.input,
-        });
-      } catch (error) {
-        if (isPolicyDenial(error)) {
-          this.unsubscribe(socket.id, subscription.sid);
-          dropped.push(subscription.sid);
-          continue;
-        }
-        // Not a decision — the gate never reached one. Destroying the subscription would report a
-        // database timeout as a revoked grant, and a client does not resubscribe to a denial. It
-        // survives, desynced: nothing is delivered from the window built under the old actor, and
-        // the row gate still decides every row under the new one, from the same policy `authorize`
-        // consults. The failure is counted and reported rather than silently absorbed.
-        this.#gate.failedAuthorize(
-          subscription.qid,
-          { sid: subscription.sid, actor: socket.actor },
-          error,
-        );
-        failed = { error };
-      }
-      if (await this.#reseat(socket, subscription, failed)) continue;
-      socket.markDesynced(subscription.sid);
-    }
-    return dropped;
+  /** Sockets the spanning caps still remember a key for. A leak is this number not falling. */
+  get trackedSockets(): number {
+    return this.#book.trackedSockets;
   }
 
-  /**
-   * Move one subscription onto its actor's CURRENT tenant's window. `false` when it is already
-   * there. A re-seat that cannot complete leaves the subscription dropped — never attached to the
-   * window of an org its actor has left — and REFUSED on the socket under its sid, the frame a
-   * refused subscribe gets, so the client's window renders `failed` instead of going quiet.
-   *
-   * `failed` is the `authorize` this pass already saw fail: it is not asked again — the store that
-   * just timed out is the one `subscribe` would ask — and it is not counted twice.
-   */
-  async #reseat(
-    socket: SyncSocket,
-    subscription: LiveSubscription,
-    failed: { readonly error: unknown } | undefined,
-  ): Promise<boolean> {
-    const { sid, input, definition } = subscription;
-    const wanted = windowId(queryHash(definition.name, input), liveTenantOf(socket.actor));
-    if (wanted === subscription.qid) return false;
-    this.unsubscribe(socket.id, sid);
-    if (failed !== undefined) {
-      refuseSubscription(socket, sid, failed.error);
-      return true;
-    }
-    try {
-      const { frame } = await this.subscribe({ socket, name: definition.name, input, sid });
-      if (!socket.send(frame)) socket.markDesynced(sid);
-    } catch (error) {
-      this.#gate.failedAuthorize(wanted, { sid, actor: socket.actor }, error);
-      refuseSubscription(socket, sid, error);
-    }
-    return true;
+  /** Live subscriptions one principal (`actor:<id>` / `address:<ip>`) holds on this node. */
+  actorCount(principal: string): number {
+    return this.#book.actorCount(principal);
+  }
+
+  /** Actor changed mid-connection — re-decided per subscription; `live-reauth.ts` owns how. */
+  reauthorize(socket: SyncSocket): Promise<readonly string[]> {
+    return reauthorizeSocket(
+      {
+        book: this.#book,
+        gate: this.#gate,
+        unsubscribe: (socketId, sid) => this.unsubscribe(socketId, sid),
+        // A re-seat is the subscription it already was, so it is never charged again.
+        resubscribe: (args) => this.#subscribe(args, { due: false }),
+      },
+      socket,
+    );
   }
 
-  /**
-   * Fan one change out. Matched once per query id, authorized once per subscriber. Returns the
-   * number of frames sent — the metric the reconnect benchmark watches.
-   *
-   * Each entry's turn is taken in that entry's lane. Nothing upstream orders this: `sync` fires
-   * `void registry.deliver(change)` straight off the bus subscription, so two changes arriving back
-   * to back would otherwise interleave inside one query id — lsn 2 delivered before lsn 1, the
-   * subscriber's cursor rewound to 1, and every gate deciding against whichever window won.
-   *
-   * Every lane is *entered* before any of them is awaited, and nothing inside a fanout takes a
-   * second lane, so holding all of them at once cannot be a cycle. That is what makes the ordering
-   * claim true: two deliveries queue onto each query id in call order, serialized per query id and
-   * never per node — awaiting one entry before entering the next made one slow policy pass the
-   * whole node's pace, and let a lane that threw skip every entry behind it with nobody desynced.
-   */
   /**
    * The newest change position this registry has been handed. What a node's snapshot may claim
    * (`liveQueryDefinition`'s `lsn`): a read begun after it holds at least that change, and every
@@ -396,34 +328,12 @@ export class LiveQueryRegistry {
     return this.#lastLsn;
   }
 
+  /** Fan one change out, every query id in its own lane — `live-deliver.ts` owns why. */
   async deliver(change: ChangeEvent): Promise<number> {
     if (change.lsn > this.#lastLsn) this.#lastLsn = change.lsn;
-    const lanes = [...this.#entries.values()].map(async (entry) => {
-      try {
-        const result = await entry.lock.run(() => fanoutChange(this.#fanout, entry, change));
-        this.#staleChanges += result.stale;
-        return result.sent;
-      } catch (error) {
-        // The window advanced under a fanout that did not finish, so every subscriber of this one
-        // query id now holds a cursor below the change and no later flush would correct them:
-        // desynced here, re-snapshotted on the next one. Silent divergence is the whole reason
-        // `markDesynced` exists, and skipping this is how a failure became one.
-        for (const subscription of entry.subscribers.values()) {
-          subscription.socket.markDesynced(subscription.sid);
-        }
-        throw error;
-      }
+    return await deliverChange(this.#entries.values(), this.#fanout, change, (stale) => {
+      this.#staleChanges += stale;
     });
-    // `allSettled`, so one lane's rejection neither cancels the others nor goes unhandled. The
-    // first failure still reaches the caller — `sync` logs it — but it costs one query id.
-    let sent = 0;
-    let failure: { readonly error: unknown } | null = null;
-    for (const lane of await Promise.allSettled(lanes)) {
-      if (lane.status === 'fulfilled') sent += lane.value;
-      else failure ??= { error: lane.reason };
-    }
-    if (failure !== null) throw failure.error;
-    return sent;
   }
 
   #attachUnlessGone(
@@ -433,6 +343,10 @@ export class LiveQueryRegistry {
     cursor: LiveCursor,
   ): LiveSubscription {
     const subscription = this.#attach(entry, socket, sid, cursor);
+    // The policy pass ran outside the lane, so a change may have been folded into the window
+    // between the rows this subscriber was served and this attach: it is in neither their frame
+    // nor their patch stream. Marked, so the next delivery re-snapshots them out of the window.
+    if (entry.lsn !== cursor.lsn) socket.markDesynced(sid);
     if (socket.closed) this.unsubscribe(socket.id, sid);
     return subscription;
   }
@@ -443,6 +357,9 @@ export class LiveQueryRegistry {
     sid: string,
     cursor: LiveCursor,
   ): LiveSubscription {
+    // Before anything is written: a re-auth during the read may have moved this socket to a
+    // principal that never had room for it.
+    this.#book.assertAttachable(socket, sid);
     const subscription: LiveSubscription = {
       sid,
       qid: entry.qid,
@@ -479,7 +396,7 @@ export class LiveQueryRegistry {
         knob: 'maxEntries',
       });
     }
-    const created = createEntry(qid, definition, input, definition.matcher(input), {
+    const created = queryEntry(qid, definition, input, definition.matcher(input), {
       readDeadlineMs: this.#options.readDeadlineMs,
       schedule: this.#options.schedule,
       tenant,
@@ -495,6 +412,10 @@ export class LiveQueryRegistry {
    */
   async #read(entry: QueryEntry, who: Subscriber): Promise<SnapshotResult> {
     const window = await fillWindow(entry);
-    return { rows: await this.#gate.filterRows(entry, who, window.rows), lsn: window.lsn };
+    const lsn = floorAfterRead(this.#options.source, entry, window, {
+      lastLsn: this.#lastLsn,
+      origin: this.#origin,
+    });
+    return { rows: await this.#gate.filterRows(entry, who, window.rows), lsn };
   }
 }

package/src/live-reauth.ts

@@ -0,0 +1,127 @@
+// A socket whose actor changed mid-connection: every subscription it holds re-decided under the
+// new actor, re-seated onto the new tenant's window, and — new principal's cap first — refused
+// rather than carried past a ceiling. Split from `live-query.ts` at its size ceiling: the registry
+// owns the entry table, this owns what a re-authorization does to one socket's subscriptions.
+
+import { queryHash } from '@ultimat3/query';
+import { isPolicyDenial } from './errors';
+import type { LiveSubscription } from './live-contract';
+import { refuseSubscription } from './live-refusal';
+import type { SubscribeArgs } from './live-spend';
+import { liveTenantOf, windowId } from './live-tenant';
+import type { SyncSocket } from './socket';
+import type { SubscriberGate } from './subscriber-gate';
+import type { SubscriptionBook } from './subscription-book';
+import type { Frame } from './sync-protocol';
+
+/** What a re-authorization reaches on the registry, and nothing else. */
+export interface ReauthDeps {
+  readonly book: SubscriptionBook;
+  readonly gate: SubscriberGate;
+  unsubscribe(socketId: string, sid: string): void;
+  /** Subscribe again under the same sid, uncharged — a re-seat is not a new subscription. */
+  resubscribe(args: SubscribeArgs): Promise<{ readonly frame: Frame }>;
+}
+
+/**
+ * Actor changed mid-connection (login, logout, role change): re-run subscribe-time authz and drop
+ * what is no longer allowed. Survivors are marked desynced so the next flush re-snapshots them
+ * under the new actor's row policy. Returns the sids that were dropped — a denial and nothing
+ * else, so a caller may tell the client "you may no longer see this" and be right.
+ *
+ * A survivor whose actor now belongs to ANOTHER tenant cannot stay where it is: its window is the
+ * old org's. It is re-seated — dropped, subscribed again under the new tenant, and sent that
+ * window's snapshot under the same sid — or, when that cannot complete, refused on the socket
+ * under the sid (`refuseSubscription`), never kept on the old org's window.
+ */
+export async function reauthorizeSocket(
+  deps: ReauthDeps,
+  socket: SyncSocket,
+): Promise<readonly string[]> {
+  const dropped: string[] = [];
+  // The actor changed, so what tenant this socket's subscriptions count against may have too.
+  // Told here rather than derived per lookup: the per-tenant cap is an index now, and an index
+  // nobody updates is a count that drifts from the book for the rest of the process.
+  refuseOverflow(deps, socket);
+  deps.book.retenant(socket);
+  for (const subscription of deps.book.ofSocket(socket.id)) {
+    let failed: { readonly error: unknown } | undefined;
+    try {
+      await subscription.definition.authorize?.({
+        actor: socket.actor,
+        input: subscription.input,
+      });
+    } catch (error) {
+      if (isPolicyDenial(error)) {
+        deps.unsubscribe(socket.id, subscription.sid);
+        // Said under the sid, as a refused subscribe is: unsaid, the client kept the rows on
+        // screen in state `live` for a subscription this node no longer serves.
+        refuseSubscription(socket, subscription.sid, error);
+        dropped.push(subscription.sid);
+        continue;
+      }
+      // Not a decision — the gate never reached one. Destroying the subscription would report a
+      // database timeout as a revoked grant, and a client does not resubscribe to a denial. It
+      // survives, desynced: nothing is delivered from the window built under the old actor, and
+      // the row gate still decides every row under the new one, from the same policy `authorize`
+      // consults. The failure is counted and reported rather than silently absorbed.
+      deps.gate.failedAuthorize(
+        subscription.qid,
+        { sid: subscription.sid, actor: socket.actor },
+        error,
+      );
+      failed = { error };
+    }
+    if (await reseat(deps, socket, subscription, failed)) continue;
+    socket.markDesynced(subscription.sid);
+  }
+  return dropped;
+}
+
+/**
+ * Move one subscription onto its actor's CURRENT tenant's window. `false` when it is already
+ * there. A re-seat that cannot complete leaves the subscription dropped — never attached to the
+ * window of an org its actor has left — and REFUSED on the socket under its sid, the frame a
+ * refused subscribe gets, so the client's window renders `failed` instead of going quiet.
+ *
+ * `failed` is the `authorize` this pass already saw fail: it is not asked again — the store that
+ * just timed out is the one `subscribe` would ask — and it is not counted twice.
+ */
+async function reseat(
+  deps: ReauthDeps,
+  socket: SyncSocket,
+  subscription: LiveSubscription,
+  failed: { readonly error: unknown } | undefined,
+): Promise<boolean> {
+  const { sid, input, definition } = subscription;
+  const wanted = windowId(queryHash(definition.name, input), liveTenantOf(socket.actor));
+  if (wanted === subscription.qid) return false;
+  deps.unsubscribe(socket.id, sid);
+  if (failed !== undefined) {
+    refuseSubscription(socket, sid, failed.error);
+    return true;
+  }
+  try {
+    const { frame } = await deps.resubscribe({ socket, name: definition.name, input, sid });
+    if (!socket.send(frame)) socket.markDesynced(sid);
+  } catch (error) {
+    deps.gate.failedAuthorize(wanted, { sid, actor: socket.actor }, error);
+    refuseSubscription(socket, sid, error);
+  }
+  return true;
+}
+
+/**
+ * The subscriptions the socket's NEW tenant or actor has no room for, refused under their sids
+ * before the move — so the move never carries a key past its cap, and filling an address then
+ * signing in cannot be repeated to stack one actor past it. The newest go first: the client's
+ * oldest windows are the ones it has been rendering longest. Not a denial, so not in `dropped`.
+ */
+function refuseOverflow(deps: ReauthDeps, socket: SyncSocket): void {
+  const overflow = deps.book.overflowOnRekey(socket);
+  if (overflow === null) return;
+  for (const subscription of deps.book.ofSocket(socket.id).slice(-overflow.excess)) {
+    deps.unsubscribe(socket.id, subscription.sid);
+    refuseSubscription(socket, subscription.sid, overflow.error);
+  }
+}

package/src/live-replicator.ts

@@ -7,7 +7,7 @@
 // WHAT IS REAL HERE, and it is everything downstream of the decoder: the matcher, the shared window,
 // the per-subscriber `visible` gate, the cursor, the frames. This substitutes for the WAL DECODER
 // and for nothing else — `@ultimat3/entity`'s `setRowObserver` reports what a repository wrote, in
-// this process, and the events are shaped exactly as `PgLogicalReplicationFeed` shapes them.
+// this process, and the events are shaped exactly as `PostgresChangeFeed` shapes them.
 //
 // WHAT IS NOT: a write another process made is invisible, because nothing here reads a log. That is
 // the honest bound, and it is why `selectChangeFeed` never picks it — the boot that installs it
@@ -27,6 +27,7 @@ import type { RowBulkChange, RowChange, RowObserver } from '@ultimat3/entity';
 import type { ChangeEvent, ChangeOp } from './changefeed';
 import type { Row } from './json';
 import type { LiveQueryRegistry } from './live-query';
+import { isPublishedTable } from './record-publisher';
 
 /** What a caller does with a change nobody could deliver. */
 export interface LiveReplicatorOptions {
@@ -35,8 +36,13 @@ export interface LiveReplicatorOptions {
    * The node's declared channels, fed the same `ChangeEvent` — what a real node's change
    * subscription does beside `registry.deliver` (`sync-node.ts`). Without it a channel's `records`
    * frames never carried a write made under `x dev`, and every other tab stayed on the old row.
+   * `invalidate` is the other half, called beside `registry.invalidate` as the node pairs them: a
+   * bulk write reaches no `records` frame, so the topics carrying its table must re-read instead.
    */
-  readonly channels?: { deliverChange(change: ChangeEvent): unknown };
+  readonly channels?: {
+    deliverChange(change: ChangeEvent): unknown;
+    invalidate(entity?: string): unknown;
+  };
   /** Tenant column, hoisted out of the row so fanout filters without parsing it. */
   readonly tenantColumn?: string;
   readonly onError?: (error: unknown) => void;
@@ -80,10 +86,19 @@ export async function startLiveReplicator(options: LiveReplicatorOptions): Promi
   let position = 0;
   let delivered = 0;
   // One promise chain, because ORDERING is the guarantee the whole pipeline is built on — the same
-  // reason `InMemoryChangeFeed` serializes its deliveries rather than firing them concurrently.
+  // reason `MemoryChangeFeed` serializes its deliveries rather than firing them concurrently.
   let tail: Promise<void> = Promise.resolve();
   let stopped = false;
 
+  /**
+   * The RELATION an entity's rows live in — what `ChangeEvent.table` carries on every producer:
+   * the WAL decoder reads it off the Relation message, a channel matches `projection.table`, and a
+   * live shape is `from('<table>', …)`. The row observer reports the entity's declared NAME, which
+   * is the table only until an entity adopts one (`entity('ledger', { table: 'gl_entries' })`);
+   * passed through, such an entity reached no channel, no window and no bulk re-read here.
+   */
+  const tableOf = (name: string): string => entity.getEntity(name)?.tableName ?? name;
+
   const enqueue = (work: () => Promise<void>): void => {
     tail = tail.then(work).catch((error: unknown) => {
       // Never rethrown into the chain: one failed fanout must not silence every change behind it,
@@ -100,7 +115,7 @@ export async function startLiveReplicator(options: LiveReplicatorOptions): Promi
       const row = change.after ?? change.before;
       const orgId = typeof row?.[tenant] === 'string' ? (row[tenant] as string) : null;
       const event: ChangeEvent = {
-        entity: change.entity,
+        table: tableOf(change.entity),
         // A repository's three row ops are three of the feed's four; a truncate never comes this way.
         op: change.op satisfies ChangeOp,
         before: asRow(change.before),
@@ -113,12 +128,14 @@ export async function startLiveReplicator(options: LiveReplicatorOptions): Promi
         at,
         // The keyed write it belongs to, read off the request scope — what the WAL decoder reads
         // off the transaction's opening message — so a channel frame names it here as it would there.
-        ...(change.write === undefined ? {} : { write: change.write }),
+        write: change.write ?? null,
       };
       enqueue(async () => {
         // Channels first, as the node does: a live query's fanout that throws must not also cost
-        // every declared channel the change.
-        options.channels?.deliverChange(event);
+        // every declared channel the change. Not an entity a `recordPublisher` claims: the app's
+        // own publish is its one channel delivery, as in production with no replicator, and both
+        // was every insert twice (#682). Asked per change, so a publisher built later counts.
+        if (!isPublishedTable(event.table)) options.channels?.deliverChange(event);
         delivered += await registry.deliver(event);
       });
     },
@@ -132,7 +149,10 @@ export async function startLiveReplicator(options: LiveReplicatorOptions): Promi
      */
     onBulk(change: RowBulkChange): void {
       if (stopped) return;
-      registry.invalidate(change.entity);
+      const table = tableOf(change.entity);
+      registry.invalidate(table);
+      // Channels too, or a tab seated on one held the pre-update rows with nothing to re-read.
+      options.channels?.invalidate(table);
     },
   };