@ultimat3/realtime 24.0.0 → 25.1.0

package/src/live-fanout.ts

@@ -3,7 +3,7 @@
 // registry owns the lanes and the entry table while this owns what happens inside one of them —
 // and because one file runs one job. The lane itself is never taken here: the caller is holding it.
 
-import type { Clock } from '@ultimat3/core';
+import { type Clock, isWriteDigest } from '@ultimat3/core';
 import type { ChangeEvent } from './changefeed';
 import { advance, type LiveCursor, makeCursor, type ResumeSource } from './cursor';
 import type { Row, RowPatch } from './json';
@@ -12,6 +12,7 @@ import { applyToWindow, bridgeChange, type Projection, projectionOf } from './ma
 import { type QueryEntry, refillWindowInLane } from './query-window';
 import { type Subscriber, type SubscriberGate, windowIndex } from './subscriber-gate';
 import { type Frame, PROTOCOL_VERSION } from './sync-protocol';
+import { FRAME_LIMITS } from './wire-version';
 
 export interface FanoutDeps {
   readonly gate: SubscriberGate;
@@ -47,6 +48,12 @@ export async function fanoutChange(
     return { sent: 0, stale: 0 };
   }
   if (change.op === 'truncate') return await truncated(deps, entry, change);
+  // Screened, not trusted: a frame carrying anything but a digest is refused WHOLE by the decoder,
+  // so a malformed label would cost every subscriber this change rather than one page its echo.
+  const write = isWriteDigest(change.write) ? change.write : null;
+  const writes = write === null ? [] : [write];
+  // What a re-snapshot out of rows that hold this change may name: the write, by the row it made.
+  const named = namedBy(entry, change, write);
   const reread = entry.stale;
   if (reread) {
     await refillWindowInLane(entry);
@@ -62,7 +69,7 @@ export async function fanoutChange(
     // there is nothing to patch. Returning before the loop below was the defect: the guard after
     // this refused the change as stale and every desynced subscriber went without the change AND
     // without its snapshot — a run console frozen on its first event after one `updateWhere`.
-    if (change.lsn <= entry.lsn) return { sent: await resnapshotAll(deps, entry), stale: 0 };
+    if (change.lsn <= entry.lsn) return { sent: await resnapshotAll(deps, entry, named), stale: 0 };
   }
   // The consume-side twin of the replicator's own duplicate guard, which had none. `entry.lsn =
   // change.lsn` was unconditional, so a change the window already holds — a redelivery, or one
@@ -70,7 +77,8 @@ export async function fanoutChange(
   // to it and asked them to fold state they had already folded over newer rows.
   if (entry.lsn !== '' && change.lsn <= entry.lsn) return { sent: 0, stale: 1 };
   const bridged = bridgeChange(entry.shape, entry.matcher, change, entry.rows);
-  // Matching nothing ends the fanout, but never before a re-read's marks are answered.
+  // Matching nothing ends the fanout, but never before a re-read's marks are answered. Named
+  // nothing: that read began before this change, so it is not truth that holds its write.
   if (!bridged) return { sent: reread ? await resnapshotAll(deps, entry) : 0, stale: 0 };
   // Keyed ONCE, here, before the retained window stores them: a resume replays the same key.
   const result = { ...bridged, patches: keyPatches(entry, change, bridged.patches) };
@@ -84,8 +92,10 @@ export async function fanoutChange(
   const guessed = result.refill || partial;
   if (guessed) entry.stale = true;
   // The retained window holds the pre-policy patch; resume re-filters it per subscriber. A partial
-  // row is never retained: replayed, it is the same missing column on a resuming client.
-  if (!partial) for (const patch of result.patches) deps.source.append(entry.qid, patch);
+  // row is never retained: replayed, it is the same missing column on a resuming client. Each
+  // retained patch keeps the write that made it, so a delta resume can name it too.
+  if (!partial)
+    for (const patch of result.patches) deps.source.append(entry.qid, retain(patch, write));
   // And the ring says so now, not at the re-read: a resume in between got a delta lacking it.
   else deps.source.floorAt?.(entry.qid, change.lsn, { exclusive: true });
 
@@ -109,7 +119,8 @@ export async function fanoutChange(
     // healthy socket. A marked subscriber is re-snapshotted out of the shared window instead, at
     // the cost of one frame and no DB read, and only then is the mark cleared.
     if (subscription.socket.desynced.has(subscription.sid)) {
-      if (await resnapshot(deps, entry, subscription)) sent += 1;
+      // Out of the window this change was just folded into, so it holds the change's write.
+      if (await resnapshot(deps, entry, subscription, named)) sent += 1;
       continue;
     }
     const who: Subscriber = { sid: subscription.sid, actor: subscription.socket.actor };
@@ -131,13 +142,7 @@ export async function fanoutChange(
       continue;
     }
     if (allowed.length === 0) continue;
-    const frame: Frame = {
-      type: 'patch',
-      v: PROTOCOL_VERSION,
-      sid: subscription.sid,
-      patches: allowed,
-      lsn: change.lsn,
-    };
+    const frame = patchFrame(subscription.sid, allowed, change.lsn, writes);
     if (subscription.socket.send(frame)) {
       subscription.cursor = advance(subscription.cursor, allowed, change.lsn, change.at);
       sent += 1;
@@ -185,7 +190,7 @@ async function truncated(
   entry: QueryEntry,
   change: ChangeEvent,
 ): Promise<FanoutResult> {
-  if (!entry.shape.entities.includes(change.entity)) return { sent: 0, stale: 0 };
+  if (!entry.shape.entities.includes(change.table)) return { sent: 0, stale: 0 };
   await refillWindowInLane(entry);
   if (change.lsn > entry.lsn) entry.lsn = change.lsn;
   deps.source.floorAt?.(entry.qid, entry.lsn, { exclusive: true });
@@ -196,11 +201,15 @@ async function truncated(
 }
 
 /** Each marked subscriber, re-snapshotted out of the window just read. Frames that left. */
-async function resnapshotAll(deps: FanoutDeps, entry: QueryEntry): Promise<number> {
+async function resnapshotAll(
+  deps: FanoutDeps,
+  entry: QueryEntry,
+  named: readonly NamedWrite[] = [],
+): Promise<number> {
   let sent = 0;
   for (const subscription of entry.subscribers.values()) {
     if (!subscription.socket.desynced.has(subscription.sid)) continue;
-    if (await resnapshot(deps, entry, subscription)) sent += 1;
+    if (await resnapshot(deps, entry, subscription, named)) sent += 1;
   }
   return sent;
 }
@@ -231,6 +240,7 @@ async function resnapshot(
   deps: FanoutDeps,
   entry: QueryEntry,
   subscription: LiveSubscription,
+  named: readonly NamedWrite[],
 ): Promise<boolean> {
   const who: Subscriber = { sid: subscription.sid, actor: subscription.socket.actor };
   let rows: readonly Row[];
@@ -242,31 +252,58 @@ async function resnapshot(
     return false;
   }
   const cursor = makeCursor(entry.qid, entry.lsn, rows, deps.clock.now().getTime());
-  if (!subscription.socket.send(snapshotFrame(entry, subscription.sid, rows, cursor))) return false;
+  const frame = snapshotFrame(entry, subscription.sid, rows, cursor, named);
+  if (!subscription.socket.send(frame)) return false;
   subscription.cursor = cursor;
   subscription.socket.clearDesynced(subscription.sid);
   return true;
 }
 
+/** A write this truth may hold, and the RECORD key of the row it made — what it is shown by. */
+export interface NamedWrite {
+  readonly write: string;
+  readonly key: string;
+}
+
 /**
- * The one place a snapshot frame is built, so the identity scope and the record keys cannot be
- * told to one caller only. `keys` rides only when some key differs from its row's `id` — an entity
- * keyed by `id` sends the frame it always sent.
+ * The one place a snapshot frame is built, so the identity scope, the record keys and the writes
+ * cannot be told to one caller only. `keys` rides only when some key differs from its row's `id`
+ * — an entity keyed by `id` sends the frame it always sent. A write in `named` is sent only when
+ * the row it made is among `rows`, which are already filtered for THIS subscriber: a write behind
+ * a row it may not see is another actor's, never named to it.
  */
 export function snapshotFrame(
   entry: QueryEntry,
   sid: string,
   rows: readonly Row[],
   cursor: LiveCursor,
+  named: readonly NamedWrite[] = [],
 ): Frame {
-  const base = { type: 'snapshot', v: PROTOCOL_VERSION, sid, rows, cursor } as const;
-  const scoped = entry.rowEntity === null ? base : { ...base, entity: entry.rowEntity };
   const keyOf = entry.rowKey;
-  if (keyOf === null) return scoped;
-  const keys = rows.map((row) => keyOf(row));
+  const keys = rows.map((row) => (keyOf === null ? row.id : keyOf(row)));
+  const shown = new Set(keys);
+  const writes = new Set<string>();
+  for (const { write, key } of named) if (shown.has(key)) writes.add(write);
+  const base = { type: 'snapshot', v: PROTOCOL_VERSION, sid, rows, cursor } as const;
+  // Capped where the decoder caps it: a frame over the ceiling is refused whole, and a write left
+  // unnamed only settles on its own HTTP answer.
+  const listed = [...writes].slice(0, FRAME_LIMITS.patches);
+  const withWrites = listed.length === 0 ? base : { ...base, writes: listed };
+  const scoped = entry.rowEntity === null ? withWrites : { ...withWrites, entity: entry.rowEntity };
   return keys.every((key, index) => key === rows[index]?.id) ? scoped : { ...scoped, keys };
 }
 
+/** The change's write, by the record key of the row it made; nothing for an unkeyed change. */
+function namedBy(
+  entry: QueryEntry,
+  change: ChangeEvent,
+  write: string | null,
+): readonly NamedWrite[] {
+  const whole = change.after ?? change.before;
+  if (write === null || whole === null) return [];
+  return [{ write, key: entry.rowKey === null ? whole.id : entry.rowKey(whole) }];
+}
+
 /**
  * A patch's record key, from the change's WHOLE row — an update patch carries only the changed
  * columns, and a key needs every primary-key column. Only stamped where it differs from `id`.
@@ -282,3 +319,23 @@ function keyPatches(
   const key = keyOf(whole);
   return patches.map((patch) => (key === patch.id ? patch : { ...patch, key }));
 }
+
+/** The patch the ring retains: the pre-policy patch plus the write that made its change. */
+function retain(patch: RowPatch, write: string | null): RowPatch {
+  return write === null ? patch : { ...patch, write };
+}
+
+/**
+ * The one place a patch frame is built, so a live fanout and a delta resume cannot spell it two
+ * ways. `writes` rides only when some keyed write made a patch here: an unkeyed change sends the
+ * frame it always sent.
+ */
+export function patchFrame(
+  sid: string,
+  patches: readonly RowPatch[],
+  lsn: string,
+  writes: readonly string[],
+): Frame {
+  const base = { type: 'patch', v: PROTOCOL_VERSION, sid, patches, lsn } as const;
+  return writes.length === 0 ? base : { ...base, writes };
+}

package/src/live-query-options.ts

@@ -12,6 +12,12 @@ export interface LiveQueryRegistryOptions extends SubscriberGateOptions {
   readonly clock?: Clock;
   readonly maxPerSocket?: number;
   readonly maxPerTenant?: number;
+  /**
+   * Live subscriptions one actor — or one anonymous client address — may hold on this node across
+   * all its sockets. Defaults to `DEFAULT_MAX_PER_ACTOR` (1,000); the boot passes the app's
+   * `realtime.maxSubscriptionsPerActor`.
+   */
+  readonly maxPerActor?: number;
   readonly tenantOf?: (actor: Actor | null) => string | null;
   /**
    * Distinct `(query, input)` pairs this node will hold at once. A `qid` derives from

package/src/live-query.ts

@@ -6,20 +6,22 @@
 // policy is never sent to that actor — it arrives as a `delete` if they hold it, and is dropped
 // otherwise.
 
-import { type Clock, finiteOption, systemClock, uuid } from '@ultimat3/core';
+import { type Clock, finiteOption, systemClock, uuidV7 } from '@ultimat3/core';
 import { queryHash } from '@ultimat3/query';
 import type { ChangeEvent } from './changefeed';
 import { type LiveCursor, makeCursor } from './cursor';
-import { isPolicyDenial, LiveQueryUnknownError, SubscriptionLimitError } from './errors';
+import { LiveQueryUnknownError, SubscriptionLimitError } from './errors';
 import type { JsonValue } from './json';
 import type { LiveQueryDefinition, LiveSubscription, SnapshotResult } from './live-contract';
-import { type FanoutDeps, fanoutChange, snapshotFrame } from './live-fanout';
+import { deliverChange } from './live-deliver';
+import { type FanoutDeps, snapshotFrame } from './live-fanout';
 import { floorAfterRead } from './live-floor';
 import { DEFAULT_MAX_ENTRIES, type LiveQueryRegistryOptions } from './live-query-options';
-import { refuseSubscription } from './live-refusal';
+import { reauthorizeSocket } from './live-reauth';
 import { resumeOnto } from './live-resume';
+import { type Charge, type SubscribeArgs, spendOnce } from './live-spend';
 import { liveTenantOf, windowId } from './live-tenant';
-import { createEntry, fillWindow, type QueryEntry } from './query-window';
+import { fillWindow, type QueryEntry, queryEntry } from './query-window';
 import type { SyncSocket } from './socket';
 import { type Subscriber, SubscriberGate } from './subscriber-gate';
 import { SubscriptionBook, subscriptionKey } from './subscription-book';
@@ -43,7 +45,7 @@ export class LiveQueryRegistry {
    * This node's mark for a window read before it held any position: unique to the process, and
    * `!` sorts below every hex digit, so every real change is above it.
    */
-  readonly #origin = `!${uuid()}`;
+  readonly #origin = `!${uuidV7()}`;
   #staleChanges = 0;
 
   constructor(options: LiveQueryRegistryOptions) {
@@ -85,9 +87,9 @@ export class LiveQueryRegistry {
    * ever ask for a re-snapshot. The repair lands on the next change to each query — which is the
    * event that proves the query is moving at all.
    *
-   * `entity` narrows it to the windows that read that entity: a filtered write
-   * (`updateWhere`/`deleteWhere`) names its entity but no row, and staling every window on the node
-   * for it re-read every live query in the process on each bulk write to any table.
+   * `entity` — the RELATION, as on `ChangeEvent.table` — narrows it to the windows that read it:
+   * a filtered write (`updateWhere`/`deleteWhere`) names its table but no row, and staling every
+   * window on the node for it re-read every live query in the process on each bulk write.
    */
   invalidate(entity?: string): number {
     let marked = 0;
@@ -124,19 +126,21 @@ export class LiveQueryRegistry {
    * Subscribe or resume. Returns the frame this subscriber needs: a `snapshot` on a cold start or a
    * blown reconnect budget, a `patch` when the cursor is inside the retained window.
    */
-  async subscribe(args: {
-    socket: SyncSocket;
-    name: string;
-    input: JsonValue;
-    sid?: string;
-    cursor?: LiveCursor | null;
-  }): Promise<{ subscription: LiveSubscription; frame: Frame }> {
+  subscribe(args: SubscribeArgs): Promise<{ subscription: LiveSubscription; frame: Frame }> {
+    return this.#subscribe(args, { due: true });
+  }
+
+  /** `charge.due` false: a re-seat, whose subscription was paid for when it was first made. */
+  async #subscribe(
+    args: SubscribeArgs,
+    charge: Charge,
+  ): Promise<{ subscription: LiveSubscription; frame: Frame }> {
     const definition = this.#definitions.get(args.name);
     // A name this node never registered, and not a protocol skew: the frame parsed, the version
     // matched, and one string in it names nothing. Reporting it as `X_PROTOCOL_VERSION` handed the
     // client "x build && redeploy the client" for a typo no rebuild changes.
     if (!definition) throw new LiveQueryUnknownError({ name: args.name });
-    const sid = args.sid ?? uuid();
+    const sid = args.sid ?? uuidV7();
     // Everything this subscribe can be refused for, decided in one synchronous step BEFORE the
     // first await — the caps and the sid both. Read at the top and acted on three awaits later,
     // they were bypassed by the ordinary case: one WebSocket write carrying N subscribe frames,
@@ -148,7 +152,7 @@ export class LiveQueryRegistry {
         // re-decides only what is ATTACHED. So a subscription seated for an actor the socket no
         // longer carries is taken back and served again under the one it does.
         const actor = args.socket.actor;
-        const served = await this.#subscribeReserved(definition, sid, args);
+        const served = await this.#subscribeReserved(definition, sid, args, charge);
         if (args.socket.actor === actor) return served;
         this.unsubscribe(args.socket.id, sid);
       }
@@ -168,19 +172,22 @@ export class LiveQueryRegistry {
       input: JsonValue;
       cursor?: LiveCursor | null;
     },
+    charge: Charge,
   ): Promise<{ subscription: LiveSubscription; frame: Frame }> {
     await definition.authorize?.({ actor: args.socket.actor, input: args.input });
-    // After this subscriber's own decision, never before it: resolving a shape for a caller who
-    // may not subscribe is work an unauthorized client gets to schedule.
-    await definition.prepare?.(args.input);
-
     // The window is the subscriber's TENANT's: two orgs on one `(query, input)` are two entries,
     // two reads and two retained rings, so no shared row ever stands between them and a policy.
     const tenant = liveTenantOf(args.socket.actor);
     const qid = windowId(queryHash(args.name, args.input), tenant);
+    // After this subscriber's own decision, never before it: resolving a shape for a caller who
+    // may not subscribe is work an unauthorized client gets to schedule.
+    await definition.prepare?.(args.input);
+
     const entry = this.#entryFor(qid, definition, args.input, tenant);
     try {
-      return await this.#serve(entry, sid, args);
+      // Charged where a read happens, never from the cursor's say-so (`live-spend.ts`).
+      const pay = () => spendOnce(definition, args.socket, charge, this.#clock);
+      return await this.#serve(entry, sid, args, pay);
     } catch (error) {
       // The entry was born above, before anything could fill it. Everything below can throw — the
       // snapshot, the resume, the window's own read deadline — and `unsubscribe` is the only other
@@ -200,6 +207,7 @@ export class LiveQueryRegistry {
       input: JsonValue;
       cursor?: LiveCursor | null;
     },
+    pay: () => Promise<void>,
   ): Promise<{ subscription: LiveSubscription; frame: Frame }> {
     const qid = entry.qid;
     const now = this.#clock.now().getTime();
@@ -219,7 +227,11 @@ export class LiveQueryRegistry {
           budget: this.#options.budget,
           clock: this.#clock,
           gate: this.#gate,
-          read: () => this.#read(entry, who),
+          read: async () => {
+            await pay();
+            return await this.#read(entry, who);
+          },
+          beforeFill: pay,
         },
         entry,
         who,
@@ -230,6 +242,7 @@ export class LiveQueryRegistry {
       return { subscription, frame: resumed.frame };
     }
 
+    await pay();
     const fresh = await this.#read(entry, { sid, actor: args.socket.actor });
     const cursor = makeCursor(qid, fresh.lsn, fresh.rows, now);
     const subscription = this.#attachUnlessGone(entry, args.socket, sid, cursor);
@@ -278,106 +291,34 @@ export class LiveQueryRegistry {
     for (const subscription of this.#book.ofSocket(socketId)) {
       this.unsubscribe(socketId, subscription.sid);
     }
+    // Held or not: a socket re-authed while holding nothing is remembered by nothing else.
+    this.#book.forgetSocket(socketId);
   }
 
-  /**
-   * Actor changed mid-connection (login, logout, role change): re-run subscribe-time authz and drop
-   * what is no longer allowed. Survivors are marked desynced so the next flush re-snapshots them
-   * under the new actor's row policy. Returns the sids that were dropped — a denial and nothing
-   * else, so a caller may tell the client "you may no longer see this" and be right.
-   *
-   * A survivor whose actor now belongs to ANOTHER tenant cannot stay where it is: its window is the
-   * old org's. It is re-seated — dropped, subscribed again under the new tenant, and sent that
-   * window's snapshot under the same sid — or, when that cannot complete, refused on the socket
-   * under the sid (`refuseSubscription`), never kept on the old org's window.
-   */
-  async reauthorize(socket: SyncSocket): Promise<readonly string[]> {
-    const dropped: string[] = [];
-    // The actor changed, so what tenant this socket's subscriptions count against may have too.
-    // Told here rather than derived per lookup: the per-tenant cap is an index now, and an index
-    // nobody updates is a count that drifts from the book for the rest of the process.
-    this.#book.retenant(socket);
-    for (const subscription of this.#book.ofSocket(socket.id)) {
-      let failed: { readonly error: unknown } | undefined;
-      try {
-        await subscription.definition.authorize?.({
-          actor: socket.actor,
-          input: subscription.input,
-        });
-      } catch (error) {
-        if (isPolicyDenial(error)) {
-          this.unsubscribe(socket.id, subscription.sid);
-          // Said under the sid, as a refused subscribe is: unsaid, the client kept the rows on
-          // screen in state `live` for a subscription this node no longer serves.
-          refuseSubscription(socket, subscription.sid, error);
-          dropped.push(subscription.sid);
-          continue;
-        }
-        // Not a decision — the gate never reached one. Destroying the subscription would report a
-        // database timeout as a revoked grant, and a client does not resubscribe to a denial. It
-        // survives, desynced: nothing is delivered from the window built under the old actor, and
-        // the row gate still decides every row under the new one, from the same policy `authorize`
-        // consults. The failure is counted and reported rather than silently absorbed.
-        this.#gate.failedAuthorize(
-          subscription.qid,
-          { sid: subscription.sid, actor: socket.actor },
-          error,
-        );
-        failed = { error };
-      }
-      if (await this.#reseat(socket, subscription, failed)) continue;
-      socket.markDesynced(subscription.sid);
-    }
-    return dropped;
+  /** Sockets the spanning caps still remember a key for. A leak is this number not falling. */
+  get trackedSockets(): number {
+    return this.#book.trackedSockets;
   }
 
-  /**
-   * Move one subscription onto its actor's CURRENT tenant's window. `false` when it is already
-   * there. A re-seat that cannot complete leaves the subscription dropped — never attached to the
-   * window of an org its actor has left — and REFUSED on the socket under its sid, the frame a
-   * refused subscribe gets, so the client's window renders `failed` instead of going quiet.
-   *
-   * `failed` is the `authorize` this pass already saw fail: it is not asked again — the store that
-   * just timed out is the one `subscribe` would ask — and it is not counted twice.
-   */
-  async #reseat(
-    socket: SyncSocket,
-    subscription: LiveSubscription,
-    failed: { readonly error: unknown } | undefined,
-  ): Promise<boolean> {
-    const { sid, input, definition } = subscription;
-    const wanted = windowId(queryHash(definition.name, input), liveTenantOf(socket.actor));
-    if (wanted === subscription.qid) return false;
-    this.unsubscribe(socket.id, sid);
-    if (failed !== undefined) {
-      refuseSubscription(socket, sid, failed.error);
-      return true;
-    }
-    try {
-      const { frame } = await this.subscribe({ socket, name: definition.name, input, sid });
-      if (!socket.send(frame)) socket.markDesynced(sid);
-    } catch (error) {
-      this.#gate.failedAuthorize(wanted, { sid, actor: socket.actor }, error);
-      refuseSubscription(socket, sid, error);
-    }
-    return true;
+  /** Live subscriptions one principal (`actor:<id>` / `address:<ip>`) holds on this node. */
+  actorCount(principal: string): number {
+    return this.#book.actorCount(principal);
+  }
+
+  /** Actor changed mid-connection — re-decided per subscription; `live-reauth.ts` owns how. */
+  reauthorize(socket: SyncSocket): Promise<readonly string[]> {
+    return reauthorizeSocket(
+      {
+        book: this.#book,
+        gate: this.#gate,
+        unsubscribe: (socketId, sid) => this.unsubscribe(socketId, sid),
+        // A re-seat is the subscription it already was, so it is never charged again.
+        resubscribe: (args) => this.#subscribe(args, { due: false }),
+      },
+      socket,
+    );
   }
 
-  /**
-   * Fan one change out. Matched once per query id, authorized once per subscriber. Returns the
-   * number of frames sent — the metric the reconnect benchmark watches.
-   *
-   * Each entry's turn is taken in that entry's lane. Nothing upstream orders this: `sync` fires
-   * `void registry.deliver(change)` straight off the bus subscription, so two changes arriving back
-   * to back would otherwise interleave inside one query id — lsn 2 delivered before lsn 1, the
-   * subscriber's cursor rewound to 1, and every gate deciding against whichever window won.
-   *
-   * Every lane is *entered* before any of them is awaited, and nothing inside a fanout takes a
-   * second lane, so holding all of them at once cannot be a cycle. That is what makes the ordering
-   * claim true: two deliveries queue onto each query id in call order, serialized per query id and
-   * never per node — awaiting one entry before entering the next made one slow policy pass the
-   * whole node's pace, and let a lane that threw skip every entry behind it with nobody desynced.
-   */
   /**
    * The newest change position this registry has been handed. What a node's snapshot may claim
    * (`liveQueryDefinition`'s `lsn`): a read begun after it holds at least that change, and every
@@ -387,34 +328,12 @@ export class LiveQueryRegistry {
     return this.#lastLsn;
   }
 
+  /** Fan one change out, every query id in its own lane — `live-deliver.ts` owns why. */
   async deliver(change: ChangeEvent): Promise<number> {
     if (change.lsn > this.#lastLsn) this.#lastLsn = change.lsn;
-    const lanes = [...this.#entries.values()].map(async (entry) => {
-      try {
-        const result = await entry.lock.run(() => fanoutChange(this.#fanout, entry, change));
-        this.#staleChanges += result.stale;
-        return result.sent;
-      } catch (error) {
-        // The window advanced under a fanout that did not finish, so every subscriber of this one
-        // query id now holds a cursor below the change and no later flush would correct them:
-        // desynced here, re-snapshotted on the next one. Silent divergence is the whole reason
-        // `markDesynced` exists, and skipping this is how a failure became one.
-        for (const subscription of entry.subscribers.values()) {
-          subscription.socket.markDesynced(subscription.sid);
-        }
-        throw error;
-      }
+    return await deliverChange(this.#entries.values(), this.#fanout, change, (stale) => {
+      this.#staleChanges += stale;
     });
-    // `allSettled`, so one lane's rejection neither cancels the others nor goes unhandled. The
-    // first failure still reaches the caller — `sync` logs it — but it costs one query id.
-    let sent = 0;
-    let failure: { readonly error: unknown } | null = null;
-    for (const lane of await Promise.allSettled(lanes)) {
-      if (lane.status === 'fulfilled') sent += lane.value;
-      else failure ??= { error: lane.reason };
-    }
-    if (failure !== null) throw failure.error;
-    return sent;
   }
 
   #attachUnlessGone(
@@ -438,6 +357,9 @@ export class LiveQueryRegistry {
     sid: string,
     cursor: LiveCursor,
   ): LiveSubscription {
+    // Before anything is written: a re-auth during the read may have moved this socket to a
+    // principal that never had room for it.
+    this.#book.assertAttachable(socket, sid);
     const subscription: LiveSubscription = {
       sid,
       qid: entry.qid,
@@ -474,7 +396,7 @@ export class LiveQueryRegistry {
         knob: 'maxEntries',
       });
     }
-    const created = createEntry(qid, definition, input, definition.matcher(input), {
+    const created = queryEntry(qid, definition, input, definition.matcher(input), {
       readDeadlineMs: this.#options.readDeadlineMs,
       schedule: this.#options.schedule,
       tenant,