@ultimat3/realtime 3.0.0 → 4.0.0

package/CLAUDE.md

@@ -214,6 +214,22 @@ Tier 3 package. Channels, live queries, local-first sync. One protocol for all t
   threw skipped the close and the pump await, leaking the socket and telling a supervisor the
   teardown was over before it had begun. Every step runs whatever the step before it did, and the
   first failure is rethrown only once the connection is closed and the pump has ended.
+- **`REPLICA IDENTITY FULL` is asked about at preflight, warned about, and counted — never thrown**
+  (added 2026-08-19). `pg-replication.ts`'s `#deliver` hands a `delete` its `message.before`,
+  and under any identity but FULL that tuple is the KEY COLUMNS ALONE — which `toRow` accepts,
+  because it only requires a text `id`. So `bridgeChange` decided "did this row leave the result
+  set" from a one-column row, `visible` read `undefined` for every column the identity did not
+  carry, and nothing anywhere recorded that it had happened: no emit, no check, and
+  `X_LIVE_REPLICA_IDENTITY` existed in neither the source nor the manifest. The check is a fourth
+  `connection.query` in `preflight`, and it **must** stay ahead of
+  `pg_create_logical_replication_slot` — changing the identity after a slot exists does not reach
+  what that slot decodes. It WARNS (`logger.warn(code, { cause, fix, tables })`, the message being
+  the code alone) because a throw would stop every app on the default identity from booting, which
+  is a worse outcome than the partial rows. `ReplicationStreamStats.partialBefore` is the runtime
+  half, read off `PgRelation.replicaIdentity` and never off the tuple: a DEFAULT-identity table
+  whose non-key columns happen to be NULL sends the bytes a FULL one does, so counting absent keys
+  would undercount exactly the rows a policy is most likely to misjudge. A hard refusal in the
+  `x verify` step is the follow-up and lives in `@ultimat3/cli`.
 - A change lsn is `<16 hex commit position><8 hex row position in that transaction>`. Never order by
   either half alone: the commit lsn repeats within a transaction, and per-record WAL positions are
   not monotonic across transactions. Never make it depend on wall time, the entity list or a process
@@ -311,6 +327,33 @@ Tier 3 package. Channels, live queries, local-first sync. One protocol for all t
   double presence membership, double fanout — until the tab closed. `#socket` is nulled before the
   close so the corpse's `onClose` takes its early return, and `onMessage` carries the same identity
   guard `onClose` already had.
+- **The grant is recorded BEFORE `server.upgrade`, and released on the path that never opens.**
+  Bun runs `websocket.open` SYNCHRONOUSLY inside `server.upgrade` and does not return until it has
+  (bun 1.3.14), and `open` is where `sync-node` reads the `GrantBook` for the socket's actor.
+  Recorded on the line after the upgrade — which it was — every authenticated socket on a real node
+  carried `actor: null`: `ChannelHub.#authorize` denied every topic with `X_TOPIC_FORBIDDEN`,
+  `authorize`/`visible` decided about nobody, `maxPerTenant` never applied and `hello.actorId` was
+  null. It did not self-repair, because `GrantBook.expired()` skips a grant with no `expiresAt` —
+  the shape `authenticate: async () => ({ actor })` produces. `onUngranted` is what makes the
+  correct order safe (only a `close` callback deletes a grant, and an upgrade that never took gets
+  no callback); it is REQUIRED on `UpgradeDeps`, so a second host of `handleUpgrade` cannot forget
+  it. The harness is half the rule: `sync-node-auth.test.ts`'s `upgradeTarget()` returned `true`
+  without ever calling `open`, so the bug was invisible to every test here — it now opens the socket
+  inside `upgrade()`, the way Bun does.
+- **Every `socket.send` on the node reads its answer, and what a `false` costs is decided per
+  frame.** A subscribe reply is REPAIRABLE and was the silent one: `registry.subscribe` has already
+  seated the subscription and cleared its desync mark, so a dropped snapshot left the server
+  believing a client holding no rows was in sync, and every later change reached it as a patch
+  folded onto nothing — on a healthy socket, forever. It is marked desynced, exactly as
+  `live-fanout` marks a lost patch. A `rebase`/`ack` has nothing to mark (the node keeps no
+  per-mutation state) and a client only returns an `inflight` mutation to its queue when the
+  connection dies, so an undeliverable settlement **closes the socket**: the reconnect requeues and
+  replays it under the same idempotency key, and acking a rebase that never left is the
+  rebase-before-ack order defeated one frame later. A presence roster has no repair at all — the
+  membership is already on the shared set and the client's next heartbeat re-rosters — so it is
+  logged (`sync.presence_roster_dropped`). The drain's `reconnect` frame is the socket's slot in the
+  spread and nothing re-sends it, so `drain()` returns `DrainedSocket[]` with `notified` per socket
+  and logs `sync.drain_frames_dropped`.
 - **A socket's actor comes from `createSyncNode({ authenticate })` and from nowhere else.** The node
   imports no authenticator — the app supplies one, exactly as it supplies `onMutate` — and it runs
   on the upgrade *before* `server.upgrade`, so a refused credential never costs a websocket.
@@ -418,20 +461,33 @@ Tier 3 package. Channels, live queries, local-first sync. One protocol for all t
   channel's lsn is the publishing hub's own per-node counter, so a client cannot tell a gap from a
   message that came via another node. Declared in `socket.ts`, not core's `runtime-metrics.ts`:
   that file is the series every process emits, this one exists only where channels do.
-- **`qidOf` is `stableDigest` (SHA-256, 16 hex) and never `fnv1a`.** The qid is a *sharing* key —
-  a hit hands back the existing entry and the seated window, carrying the first subscriber's input
-  and rows — and input is client-chosen, so 32 bits is a collision found offline in seconds and one
-  client served out of another's window. `fnv1a` stays the cursor's result-set digest, where a
-  collision costs a missed re-sort.
-- **`canonicalJson` is injective over the values it accepts, and `JSON.stringify` is not.**
-  `JSON.stringify` answers `"null"` for `NaN` and `±Infinity` and `"0"` for `-0`, so four distinct
-  inputs hashed to one qid — and a qid *hit* hands the joiner the first subscriber's compiled
-  source, matcher and seated window. Bare `NaN` / `Infinity` / `-Infinity` / `-0` tokens are emitted
-  instead; they are not valid JSON, which is correct, because this output is hashed and never
-  parsed. Exposure is narrower than it looks and the tests say so rather than overclaiming: `NaN`
-  and `±Infinity` have no JSON spelling and so cannot arrive on a `subscribe` frame — they reach
-  `qidOf` only from a caller building `input` in JS. **`-0` is wire-reachable**: `JSON.parse('{"a":-0}')`
-  answers `-0`.
+- **A qid is `@ultimat3/query`'s `queryHash(name, input)`, and this package derives none of its
+  own — `As of 2026-08`.** `qidOf` was the same two lines over a local copy of the canonical form
+  (`stableDigest(canonicalJson(input))`), and `canonicalJson`/`stableDigest` were this package's
+  third copy of what `@ultimat3/action` and `@ultimat3/query` also each held. They had already
+  diverged: `{ a: undefined, b: 1 }` gave `feed:eb8ed3ccb5023093` from `queryHash` and
+  `feed:c0bf82ad036cb0a5` from `qidOf`, because query's walk drops an `undefined`-valued key and
+  this one rendered `"a":null`. The two are COMPARED in one flow — `@ultimat3/query`'s `planResume`
+  decides refetch-vs-resume by comparing a cursor's `queryHash` against the query's, while
+  `liveQueryDefinition` keys the shared window by the qid — so keeping both correct was never the
+  option; the first time either moved, every resume decision and every window lookup were keyed
+  differently. `realtime -> query` is the one declared sideways edge and this package already
+  imports it. **`fnv1a` stays here**, and only it: its job is the cursor's result-set digest, where
+  a collision costs a missed re-sort and never one client served out of another's window.
+  `live-contract.test.ts` is the pin — it reads `registry.subscriberCount(queryHash(name, input))`
+  through a real subscribe, so a local derivation fails it. Cost of the move: none observable on the
+  server. Every qid a node computes comes from a DECODED frame, and `JSON.parse` produces no
+  `undefined`, no `Date`, no `Map` and no `Set` — the four values the two forms disagree about — so
+  no live subscription re-keyed and nothing re-snapshotted.
+- **The canonical form is injective over the values it accepts, and `JSON.stringify` is not** —
+  the reason that survives the move, now `@ultimat3/core`'s to enforce. `JSON.stringify` answers
+  `"null"` for `NaN` and `±Infinity` and `"0"` for `-0`, so four distinct inputs hashed to one qid
+  — and a qid *hit* hands the joiner the first subscriber's compiled source, matcher and seated
+  window. Bare `NaN` / `Infinity` / `-Infinity` / `-0` tokens are emitted instead; they are not
+  valid JSON, which is correct, because that output is hashed and never parsed. Exposure is
+  narrower than it looks and the tests say so rather than overclaiming: `NaN` and `±Infinity` have
+  no JSON spelling and so cannot arrive on a `subscribe` frame — they reach the hash only from a
+  caller building `input` in JS. **`-0` is wire-reachable**: `JSON.parse('{"a":-0}')` answers `-0`.
 - **Refusing new sockets and draining the ones you have are two shutdown phases.** `stopAccepting()`
   is the `accept` phase: `ready = false`, `/readyz` 503, a late upgrade shed with `retry-after-ms`,
   and every socket untouched — a draining node still owes its clients their patches, and `stop()` is
@@ -472,7 +528,7 @@ Tier 3 package. Channels, live queries, local-first sync. One protocol for all t
   every client on open and read by nobody — the node replied `resume: []` and decided resume per
   subscription from the `subscribe` frame — so every reconnect shipped each cursor twice, up to 512
   ids each, in the restart storm this package is measured on. Wiring it was the wrong half of the
-  choice: a cursor's `qid` is `` `${name}:${stableDigest(input)}` ``, so a node reading a resume list
+  choice: a cursor's `qid` is `` `${name}:${fingerprint(input)}` ``, so a node reading a resume list
   recovers the query **name** — it is the plaintext prefix — but never the `input`, which is the half
   every decision needs. Without it `definition.authorize({ actor, input })` cannot run and no entry
   can be built; the qid names a window but not a decision, and the retained window holds pre-policy
@@ -492,9 +548,11 @@ Tier 3 package. Channels, live queries, local-first sync. One protocol for all t
   socket it opens against the *new* node. Two silent windows and the client closes with `4000` and
   arms the reconnect. It is one
   self-re-arming tick on the injected `Scheduler`, not an interval: a client is either beating on a
-  live socket or backing off toward a new one, never both. The 15s is restated from
-  `realtime.heartbeatMs` rather than read — that is server config and this is browser code — and
-  `realtime.heartbeatMs` is read by nothing today.
+  live socket or backing off toward a new one, never both. The 15s is the client's OWN number:
+  `realtime.heartbeatMs` was a `RealtimeConfig` key read by nothing and it is **deleted**
+  (2026-08-19). The server half of the beat stays derived — `PresenceRegistry.heartbeatMs` is
+  `max(1000, floor(ttlMs / 3))`, the same rule `idleSweepPeriodMs` follows, because a second knob
+  is a second number that can disagree with the one it is a fraction of.
 - **Every question a hot path asks is indexed, never scanned.** `SubscriptionBook` keeps
   `#bySocket` and a per-tenant count beside `#bySid`, and `SocketRegistry` keeps `#byTopic` beside
   the socket table. Both replaced a walk of the whole node that ran once per socket or once per
@@ -587,6 +645,7 @@ Tier 3 package. Channels, live queries, local-first sync. One protocol for all t
 | `live-query.ts` / `live-definition.ts` / `changefeed.ts` / `changefeed-env.ts` / `replicator.ts` / `pg-advisory-lock.ts` / `fanout.ts` / `transport-env.ts` / `matcher-bridge.ts` | tier 2 |
 | `pg-bytes.ts` / `pg-wire.ts` / `pg-auth.ts` / `pg-connection.ts` / `pg-socket.ts` | the Postgres v3 client: bytes, frames, SASL, session, socket |
 | `pgoutput.ts` / `pg-entity-row.ts` / `pg-replication.ts` | WAL decode → `ChangeEvent`, and the lsn that orders it |
+| `pg-preflight.ts` | the four questions asked before `START_REPLICATION` — `wal_level`, the publication, every entity's replica identity, the slot — plus `assertIdentifier`, the charset all four interpolate through |
 | `nats-client.ts` | the bus port: publish/subscribe/request/requestMany/close/version/connected, and `parseNatsUrl` — the library takes `host:port` plus credentials and never reads a URL's userinfo |
 | `nats-lib-client.ts` | the `nats` adapter — **the only file in the repo that imports `nats`** |
 | `nats-jetstream.ts` / `nats-kv.ts` / `nats-transport.ts` | the JetStream KV bucket, presence over it, and the production `Transport` — all three written against the port |
@@ -618,8 +677,8 @@ Tier 3 package. Channels, live queries, local-first sync. One protocol for all t
 | `client-contract.ts` | the client's injected shapes — `ClientSocket`, `LiveClientOptions`, `LiveHandle` — declared apart from the class that consumes them |
 | `policy-gate.ts` | the only authz seam |
 | `subscriber-gate.ts` | the per-subscriber pass of a definition's row policy, and its two counters — `rowsDenied` and `gateFailures`. Evaluates no policy of its own |
-| `live-contract.ts` | what a live query IS: `qidOf`, `LiveQueryDefinition`, `SnapshotResult`, `LiveSubscription`. Four modules need the shape and none of them needs the registry that runs it |
-| `json.ts` | the wire's value types, `canonicalJson`, and the two hashes — `stableDigest` (sharing keys) and `fnv1a` (drift). Tested in `json.test.ts`, beside the declarations: a `qidOf` test proves the qid, not the primitive under it |
+| `live-contract.ts` | what a live query IS: `LiveQueryDefinition`, `SnapshotResult`, `LiveSubscription`. Four modules need the shape and none of them needs the registry that runs it. The **id** is not here and not anywhere in this package — it is `@ultimat3/query`'s `queryHash` |
+| `json.ts` | the wire's value types and `fnv1a` (drift), the one hash still owned here. The canonical form and the sharing-key hash are `@ultimat3/core`'s (`canonicalJson`, `fingerprint`) — `json.test.ts` pins that `fnv1a` is never mistakable for one |
 | `live-definition.ts` | the only bridge from a declared `query({ live: true })` to a registrable definition — and `policy-gate.ts`'s only caller |
 | `matcher-bridge.ts` | the only `@ultimat3/query` matcher seam |
 

package/README.md

@@ -265,15 +265,17 @@ new LiveClient({ signal, connect, buildId, heartbeatMs: 15_000 }); // 0 disables
 
 | Property | Behaviour |
 |---|---|
-| Default | `DEFAULT_HEARTBEAT_MS`, 15s. The same number as the server's `realtime.heartbeatMs`, restated rather than read: that is server config and this is browser code |
+| Default | `DEFAULT_HEARTBEAT_MS`, 15s. The client's own number and the only one: `realtime.heartbeatMs` in `app.config.ts` was deleted 2026-08-19 because nothing read it |
 | One beat | a `hello` — which carries no cursors at all; `HelloFrame` has no resume list, so a beat and an opening frame are byte-identical — plus one subscribe frame per topic held |
 | Why the topics | on the node, repeating the subscribe frame **is** the presence heartbeat; presence has no frame of its own in either direction |
 | Not a deploy check | `update-available` answers a skew between the build id recorded at the upgrade and the node's own, and neither can change on an open socket — so every `hello` on one socket answers the same forever. A client hears about a deploy on the socket it opens against the **new** node |
 | Silence | nothing received for **two** intervals ⇒ close `4000` (a private-use code, so it is distinguishable in a log) and arm the reconnect. Judged from the last frame of any kind, since the point is that bytes still cross |
 | Not an interval | one armed tick, re-armed by itself, on the same injected `Scheduler` the reconnect uses — a client is either beating on a live socket or backing off toward a new one, never both |
 
-`realtime.heartbeatMs` in `app.config.ts` is **read by nothing** `As of 2026-08`; this option is the
-only knob that changes behaviour.
+`realtime.heartbeatMs` in `app.config.ts` is **gone** `As of 2026-08-19` — it was read by nothing,
+and an app that still sets it fails `x verify`'s typecheck step with TS2353 (`'heartbeatMs' does not
+exist in type 'Input<RealtimeConfig>'`). Delete the line; this option is the only knob that changes
+behaviour, and the node's presence beat is derived from its TTL rather than configured.
 
 ### A `send` that returned is not an acknowledgement
 
@@ -351,12 +353,18 @@ wire twice by a reconnect that raced an ack.
   `mutate` is one lane per socket; `subscribe` is one lane per sid, or per topic name; `hello` and
   the server-authored kinds are unlaned. A lane exists only while work is queued on it, because a
   lane keyed by a client-chosen sid that outlived its work is an unbounded map one socket can grow.
-- **`qid` is `<name>:<first 16 hex of SHA-256(canonicalJson(input))>`** — 64 bits `As of 2026-08`,
-  where it was a 32-bit FNV-1a. It is a *sharing* key: a hit is answered with the existing entry and
-  the seated window, both holding the first subscriber's input and rows, and input is client-chosen,
-  so a collision is one client served out of another's window. A rolling deploy across that change
-  costs one bounded snapshot per subscription — a cursor minted under the old format names a ring
-  entry the new node never held, so the resume falls back correctly rather than silently.
+- **`qid` is `@ultimat3/query`'s `queryHash(name, input)`** — `<name>:<first 16 hex of
+  SHA-256(canonicalJson(input))>`, 64 bits `As of 2026-08` where it was a 32-bit FNV-1a. It is a
+  *sharing* key: a hit is answered with the existing entry and the seated window, both holding the
+  first subscriber's input and rows, and input is client-chosen, so a collision is one client served
+  out of another's window. This package derives none of its own — `qidOf` was a second spelling of
+  `queryHash` while `@ultimat3/query`'s `planResume` compares a cursor's `queryHash` against the
+  query's, so the two had to be one function or every resume decision and every window lookup would
+  be keyed differently the first time either moved. A rolling deploy across the *hash* change costs
+  one bounded snapshot per subscription — a cursor minted under the old format names a ring entry
+  the new node never held, so the resume falls back correctly rather than silently; the `qidOf`
+  removal itself costs nothing, because every qid a node computes comes from a decoded frame and
+  `JSON.parse` produces none of the values the two spellings disagreed about.
 - **A topic guard that *fails* keeps the topic.** On the re-auth pass, only a denial
   (`X_TOPIC_FORBIDDEN`, or a policy denial) unsubscribes; anything else increments `hub.guardFailures`
   and logs `channel.guard_failed`. `catch { unsubscribe }` reported a store that timed out as a
@@ -410,10 +418,16 @@ wire twice by a reconnect that raced an ack.
   `undefined` and answer as if the row had said so. A patch whose row the shared window does not
   hold is withheld — the window *is* the result set — and a subscriber holding that row gets the
   one `delete` that says so. It counts as neither a denial nor a gate failure: nothing decided.
+- **A `delete` is withheld too, and `holds` is the whole decision** (`As of 2026-08`). It carries no
+  row, so there is nothing to put in front of the rule — and it was forwarded unconditionally, so
+  every subscriber learned the id and the instant of every *other* tenant's row as it was deleted,
+  on a query whose `visible` rule had never let them see one. A subscriber that holds the row is
+  told it is gone; one that does not gets nothing, counted as `rowsDenied`.
 - **`PgLogicalReplicationFeed` decodes `pgoutput` off a real slot** — its own Postgres v3 client
   (SCRAM-SHA-256, in-band TLS, CopyBoth), no driver dependency. It preflights `wal_level`, the
-  publication and the slot, creates the slot when there is none, and confirms the slot as it goes so
-  the WAL does not grow without bound. `InMemoryChangeFeed` + `InProcessTransport` remain the
+  publication, every entity's replica identity and the slot — in that order, because the identity
+  check is worthless once the slot exists — creates the slot when there is none, and confirms the
+  slot as it goes so the WAL does not grow without bound. `InMemoryChangeFeed` + `InProcessTransport` remain the
   defaults for `x dev` and every test.
 - **`selectChangeFeed(env, { entities })` decides which feed a boot installs** — same law
   `selectMailDriver` follows: an unset variable means the embedded default. It returns `{ feed,
@@ -456,8 +470,18 @@ wire twice by a reconnect that raced an ack.
   *transactions* in commit order, so per-record WAL positions are not monotonic across them. The
   pair sorts in delivery order and is byte-identical on replay, which is what turns at-least-once
   redelivery into a drop instead of a duplicate.
-- **A live query needs `REPLICA IDENTITY FULL`.** Deciding whether a row *left* a result set needs
-  the old values; with the default identity a delete replicates only the key columns.
+- **A live query needs `REPLICA IDENTITY FULL`, and the replicator now says so** (`As of
+  2026-08-19`). Deciding whether a row *left* a result set needs the old values; with the default
+  identity a delete replicates only the key columns, and `toRow` accepts that tuple because it only
+  requires a text `id`. `preflight` asks `pg_class.relreplident` for every entity in the list — the
+  fourth question it asks, and **before** `pg_create_logical_replication_slot`, since changing the
+  identity after a slot exists does not reach the rows that slot will decode. It is a **coded
+  warning**, `X_LIVE_REPLICA_IDENTITY`, whose `fix:` is the `ALTER TABLE <t> REPLICA IDENTITY FULL;`
+  per named table — not a throw, because every app on the default identity would otherwise stop
+  booting, which is worse than the partial rows. `ReplicationStreamStats.partialBefore` is the
+  running half: one per change delivered off a relation that is not FULL, so the decisions it
+  actually cost are countable rather than silent. A hard refusal at `x verify` time is the
+  follow-up.
 - Tier 3's OPFS SQLite store is browser-only and throws until the browser entry ships; `MemoryLocalStore`
   implements the full journal/rollback/replay semantics today. It holds membership and the journal;
   the row values are the client's one `IdentityMap`, which is what a browser store has to inherit
@@ -472,8 +496,8 @@ wire twice by a reconnect that raced an ack.
 `X_PROTOCOL_VERSION` · `X_CURSOR_STALE` ·
 `X_REBASE_CONFLICT` · `X_TRANSPORT_UNAVAILABLE` · `X_TRANSPORT_PROTOCOL` ·
 `X_REPLICATION_FAILED` · `X_REPLICATION_PROTOCOL` · `X_REPLICATOR_SLOT_HELD` ·
-`X_LIVE_CLIENT_MISSING` · `X_LIVE_QUERY_UNKNOWN` · `X_SOCKET_UNAUTHENTICATED` ·
-`X_SOCKET_AUTH_UNAVAILABLE` · `X_NOT_IMPLEMENTED`
+`X_LIVE_CLIENT_MISSING` · `X_LIVE_QUERY_UNKNOWN` · `X_LIVE_REPLICA_IDENTITY` ·
+`X_SOCKET_UNAUTHENTICATED` · `X_SOCKET_AUTH_UNAVAILABLE` · `X_NOT_IMPLEMENTED`
 
 Topics deny by default: a topic with no matching guard is forbidden. An authz hole is not a config
 option someone forgot to set.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ultimat3/realtime",
-  "version": "3.0.0",
+  "version": "4.0.0",
   "description": "Three-tier realtime: channels, live queries, local-first sync — one protocol, one mutator shape",
   "license": "MIT",
   "type": "module",
@@ -32,8 +32,8 @@
     "test": "bun test"
   },
   "dependencies": {
-    "@ultimat3/core": "3.0.0",
-    "@ultimat3/query": "3.0.0",
+    "@ultimat3/core": "4.0.0",
+    "@ultimat3/query": "4.0.0",
     "nats": "2.29.3"
   }
 }

package/src/changefeed.ts

@@ -126,14 +126,26 @@ export class InMemoryChangeFeed implements ChangeFeed {
   async #deliver(event: ChangeEvent): Promise<void> {
     const handler = this.#handler;
     if (!handler) return;
-    this.#tail = this.#tail.then(async () => {
+    const result = this.#tail.then(async () => {
       await handler(event);
       this.#lastLsn = event.lsn;
     });
-    await this.#tail;
+    // The lane chains on a SETTLED shadow, never on `result` — `window-lock.ts` solves the same
+    // problem the same way. Chained on the live tail, one rejected link poisoned every link behind
+    // it: later changes rejected with the FIRST error, the handler was never called again and
+    // `lastLsn()` froze. Reachable on any single-node deployment, because `createReplicator`'s
+    // `onChange` awaits `transport.publish(...)` and a closed `InProcessTransport` refuses — one
+    // transient publish failure ended change delivery for the life of the process. The rejection
+    // still reaches the caller that pushed THAT event, and only it; `stop()` awaits the shadow, so
+    // a teardown reports the teardown rather than re-raising a failure already handed over.
+    this.#tail = result.then(ignore, ignore);
+    await result;
   }
 }
 
+/** Settles the shadow lane whichever way the delivery went. Nothing observes the value. */
+const ignore = (): void => undefined;
+
 export interface PgLogicalReplicationOptions {
   /** Connection string for a role with REPLICATION: `postgres://user:pass@host:5432/db`. */
   readonly url: string;

package/src/client-contract.ts

@@ -72,8 +72,9 @@ export interface LiveClientOptions<T extends TableMap = TableMap> {
   readonly scheduler?: Scheduler;
   /**
    * How often a live socket re-announces itself, in ms. `0` disables it. Defaults to
-   * `DEFAULT_HEARTBEAT_MS` — the same 15s as the server's `realtime.heartbeatMs`, which browser
-   * code cannot read, so it is an option here rather than a value shipped down the wire.
+   * `DEFAULT_HEARTBEAT_MS`, 15s. The one knob for the beat: `realtime.heartbeatMs` in
+   * `app.config.ts` was deleted 2026-08-19 because nothing read it, so this is not a restatement
+   * of a server value — browser code could never have reached one.
    */
   readonly heartbeatMs?: number;
   /** Where a dial failure inside the reconnect timer is reported. Defaults to `reportToConsole`. */

package/src/client-heartbeat.ts

@@ -5,9 +5,10 @@
 import type { Scheduler } from './thundering-herd';
 
 /**
- * The same 15s as `realtime.heartbeatMs` in `@ultimat3/core`'s config, restated rather than read:
- * that value is server configuration and this is browser code, so the client cannot reach it. The
- * two are kept equal on purpose — a node's presence TTL is sized against this interval.
+ * The client's own number, and `As of 2026-08-19` the only one. It used to be described as a
+ * restatement of `realtime.heartbeatMs` in `@ultimat3/core`'s config — that key was read by
+ * nothing and is deleted, so there is no second value to keep this equal to. The server side of
+ * the beat is DERIVED, never configured: `PresenceRegistry.heartbeatMs` is `ttlMs / 3`.
  */
 export const DEFAULT_HEARTBEAT_MS = 15_000;
 

package/src/cursor.ts

@@ -3,9 +3,9 @@
 // and the budget exists to make the expensive answer (a snapshot) the *chosen* one, not the
 // accidental one. See README "Reconnect is the hard part".
 
-import { type Clock, systemClock } from '@ultimat3/core';
+import { type Clock, canonicalJson, systemClock } from '@ultimat3/core';
 import { CursorStaleError } from './errors';
-import { canonicalJson, fnv1a, type Row, type RowPatch } from './json';
+import { fnv1a, type Row, type RowPatch } from './json';
 
 /** Ids are bounded so a cursor stays small enough to ship on every `subscribe` frame. */
 export const CURSOR_ID_LIMIT = 512;

package/src/errors.ts

@@ -20,6 +20,7 @@ export const REALTIME_OWNED_ERROR_CODES = [
   'X_LIVE_CLIENT_MISSING',
   'X_LIVE_ROW_UNIDENTIFIED',
   'X_LIVE_QUERY_UNKNOWN',
+  'X_LIVE_REPLICA_IDENTITY',
   'X_QUERY_NOT_SUBSCRIBABLE',
   'X_SOCKET_UNAUTHENTICATED',
   'X_SOCKET_AUTH_UNAVAILABLE',
@@ -113,6 +114,7 @@ export const REALTIME_ERROR_TITLES: Readonly<Record<RealtimeOwnedErrorCode, stri
   X_LIVE_CLIENT_MISSING: 'a realtime hook ran with no LiveClient registered',
   X_LIVE_ROW_UNIDENTIFIED: 'a live query returned a row with no id',
   X_LIVE_QUERY_UNKNOWN: 'no live query is registered under the name a subscribe frame asked for',
+  X_LIVE_REPLICA_IDENTITY: 'a replicated table sends a key-only row on delete',
   X_QUERY_NOT_SUBSCRIBABLE: 'a hook was bound to a query that is not declared live',
   X_SOCKET_UNAUTHENTICATED: 'the sync upgrade carried no credential this app accepts',
   X_SOCKET_AUTH_UNAVAILABLE: 'the sync node could not decide who a connecting socket is',
@@ -327,6 +329,34 @@ export class ReplicatorSlotHeldError extends RealtimeError {
   }
 }
 
+/**
+ * A table in the entity list replicates with a replica identity other than FULL, so its `delete`
+ * (and any key-changing `update`) carries the KEY COLUMNS ONLY. `toRow` accepts that tuple —
+ * it only requires a text `id` — so the live matcher decides "did this row leave the result set"
+ * from a one-column row, and a row policy written against `!row.private` reads `undefined`.
+ *
+ * **Raised at preflight and LOGGED, never thrown.** Every app running today on the default
+ * identity would stop booting, and the replicator refusing to start is a worse outcome than the
+ * partial rows it is warning about. The runtime half is `ReplicationStreamStats.partialBefore`,
+ * which counts the changes this actually affects. Refusing it at `x verify` time is the follow-up.
+ *
+ * The tables are named because the fix is per table, and they are the entity list's own names —
+ * every one has already passed `assertIdentifier`, so the `fix:` is SQL that can be pasted.
+ */
+export class ReplicaIdentityError extends RealtimeError {
+  constructor(args: { tables: readonly string[] }) {
+    super({
+      code: 'X_LIVE_REPLICA_IDENTITY',
+      cause:
+        `${args.tables.join(', ')} replicate with a replica identity other than FULL, so a ` +
+        'delete carries the key columns only and a live query decides visibility from a partial row',
+      fix:
+        `${args.tables.map((table) => `ALTER TABLE ${table} REPLICA IDENTITY FULL;`).join(' ')}` +
+        ' -- rows already written to the WAL keep the identity they were written with',
+    });
+  }
+}
+
 /**
  * A hook was called before the app entry registered its client. Never a transient fault: the
  * registration is a single call in the entry, so the fix is the call itself rather than a retry.

package/src/index.ts

@@ -90,6 +90,7 @@ export {
   RealtimeError,
   type RealtimeErrorCode,
   RebaseConflictError,
+  ReplicaIdentityError,
   ReplicationFailedError,
   ReplicationProtocolError,
   ReplicatorSlotHeldError,
@@ -136,7 +137,6 @@ export {
 } from './identity-map';
 // ---- shared value domain ---------------------------------------------------------------------
 export {
-  canonicalJson,
   changedColumns,
   fnv1a,
   isJsonObject,
@@ -147,11 +147,10 @@ export {
   type RowOp,
   type RowPatch,
 } from './json';
-export {
-  type LiveQueryDefinition,
-  type LiveSubscription,
-  qidOf,
-  type SnapshotResult,
+export type {
+  LiveQueryDefinition,
+  LiveSubscription,
+  SnapshotResult,
 } from './live-contract';
 export { type LiveDefinitionOptions, liveQueryDefinition } from './live-definition';
 export {
@@ -377,6 +376,7 @@ export {
   type AcceptBudgetOptions,
   type BackoffPolicy,
   backoffDelay,
+  type DrainedSocket,
   type DrainPlanEntry,
   type DrainPlanOptions,
   defaultBackoff,

package/src/json.ts

@@ -1,5 +1,11 @@
-// The JSON value domain shared by the wire, the matcher, and the local store.
-// Kept dependency-free so every other module in this package can import it without a cycle.
+// The JSON value domain shared by the wire, the matcher, and the local store, plus `fnv1a` — the
+// one hash this package still owns.
+//
+// `canonicalJson` and `stableDigest` USED to live here and are `@ultimat3/core`'s now: they were a
+// third copy of one injective canonical form and one sharing-key hash, beside `@ultimat3/action`'s
+// and `@ultimat3/query`'s, and the copies had already diverged. `fnv1a` stays because its job is
+// genuinely different — it is a cursor's result-set digest, where a collision costs a missed
+// re-sort and never one client served out of another's window.
 
 export type JsonValue =
   | string
@@ -49,52 +55,6 @@ export function changedColumns(before: JsonObject | null, after: JsonObject): Js
   return out;
 }
 
-/**
- * Key-sorted JSON so a query id derived from input is stable across property order — and
- * INJECTIVE, because that id decides who shares a window.
- *
- * `qidOf` is `stableDigest(canonicalJson(input))` and a qid HIT hands the joiner the existing
- * entry: the first subscriber's compiled source, its matcher and its seated rows. Two inputs that
- * canonicalise to one string are therefore two clients served out of one window. `JSON.stringify`
- * is not injective over numbers — `NaN` and `±Infinity` are both `"null"`, which also collides
- * with JSON `null` itself, and `-0` is `"0"` — so the number branch is spelled out here.
- *
- * `-0` is the one of those a client can put on the wire (`JSON.parse('{"a":-0}')` answers `-0`);
- * the non-finite three have no JSON spelling and arrive only from a caller building `input` in JS,
- * such as `useLive(feed, () => ({ limit: Number.parseInt(raw) }))` on an unparseable `raw`.
- * The tokens are bare, never quoted: this output is only ever hashed, and the `string` branch
- * always quotes, so an unquoted word cannot collide with the text that spells it.
- *
- * The twin of `@ultimat3/query`'s and `@ultimat3/action`'s rules in their own `stable.ts`. All
- * three are tier 3, so no two of them can import each other; the shared home is `@ultimat3/core`
- * if one is ever made.
- */
-export function canonicalJson(value: JsonValue): string {
-  if (typeof value === 'number') return canonicalNumber(value);
-  if (value === null || typeof value !== 'object') return JSON.stringify(value) ?? 'null';
-  if (Array.isArray(value)) return `[${value.map(canonicalJson).join(',')}]`;
-  const keys = Object.keys(value).sort();
-  const parts = keys.map((key) => `${JSON.stringify(key)}:${canonicalJson(value[key] ?? null)}`);
-  return `{${parts.join(',')}}`;
-}
-
-/** Ordinary numbers are `String(n)`, byte-identical to what this emitted before. */
-function canonicalNumber(value: number): string {
-  if (Number.isNaN(value)) return 'NaN';
-  if (!Number.isFinite(value)) return value > 0 ? 'Infinity' : '-Infinity';
-  return Object.is(value, -0) ? '-0' : String(value);
-}
-
-/**
- * SHA-256, first 16 hex characters. For the hashes that are also SHARING keys — a `qid` decides
- * which subscribers are served from one window, and it is derived from input a client chooses, so
- * the 32 bits `fnv1a` answers are a collision anyone can find offline in seconds. Same primitive
- * and same width `@ultimat3/entity`'s `planScope` already chose for a cursor's scope.
- */
-export function stableDigest(text: string): string {
-  return new Bun.CryptoHasher('sha256').update(text).digest('hex').slice(0, 16);
-}
-
 /** FNV-1a, 32-bit, hex. Not cryptographic — it identifies and detects drift, it does not protect. */
 export function fnv1a(text: string): string {
   let hash = 0x811c9dc5;

package/src/live-contract.ts

@@ -1,27 +1,20 @@
-// What a live query IS: the id one is keyed by, the contract a definition satisfies, and the
-// subscription one socket holds. Split from `live-query.ts` because four modules need the shape
-// and none of them needs the registry that runs it — and because one file runs one job.
+// What a live query IS: the contract a definition satisfies and the subscription one socket holds.
+// Split from `live-query.ts` because four modules need the shape and none of them needs the
+// registry that runs it — and because one file runs one job.
+//
+// The id is NOT here, and no longer anywhere in this package: a `qid` is `@ultimat3/query`'s
+// `queryHash(name, input)`, imported across the declared `realtime -> query` edge. `qidOf` was the
+// same two lines over this package's own copy of the canonical form, and the two had already
+// diverged on an `undefined`-valued key — while `planResume` compares a cursor's `queryHash` and
+// `liveQueryDefinition` keys the shared window by the qid, so a divergence is every resume
+// decision and every window lookup keyed differently.
 
 import type { Actor } from '@ultimat3/core';
 import type { LiveCursor } from './cursor';
-import { canonicalJson, type JsonValue, type Row, stableDigest } from './json';
+import type { JsonValue, Row } from './json';
 import type { IncrementalMatcher } from './matcher-bridge';
 import type { SyncSocket } from './socket';
 
-/**
- * `qid` = hash(query name, input). Fanout subjects and change windows are keyed by it.
- *
- * The hash is a **sharing** key, which is why it is `stableDigest` and not `fnv1a`: `#entryFor`
- * answers a hit with the EXISTING entry and `liveQueryDefinition` answers with the seated
- * `SharedWindow`, both carrying the first subscriber's input, compiled source and rows. Input is
- * client-chosen, so a second input colliding with the first passes `authorize` against its own
- * arguments and is then served out of somebody else's window — and 32 bits is a collision found
- * offline in seconds.
- */
-export function qidOf(name: string, input: JsonValue): string {
-  return `${name}:${stableDigest(canonicalJson(input))}`;
-}
-
 export interface SnapshotResult<R extends Row = Row> {
   readonly rows: readonly R[];
   readonly lsn: string;

package/src/live-definition.ts

@@ -9,10 +9,10 @@
 // every time. Collapsing the second onto the first is privilege escalation with a cache hit rate.
 
 import type { Ctx } from '@ultimat3/core';
-import { type AnyQuery, queryName } from '@ultimat3/query';
+import { type AnyQuery, queryHash, queryName } from '@ultimat3/query';
 import { LiveRowUnidentifiedError } from './errors';
 import { isRow, type JsonValue, type Row } from './json';
-import { type LiveQueryDefinition, qidOf, type SnapshotResult } from './live-contract';
+import type { LiveQueryDefinition, SnapshotResult } from './live-contract';
 import { type IncrementalMatcher, matcherFor } from './matcher-bridge';
 import { authorizeWithPolicy, visibleWithPolicy } from './policy-gate';
 
@@ -73,7 +73,7 @@ export function liveQueryDefinition(
   const windows = new Map<string, SharedWindow>();
 
   const resolve = async (input: JsonValue): Promise<SharedWindow> => {
-    const qid = qidOf(name, input);
+    const qid = queryHash(name, input);
     const seated = windows.get(qid);
     if (seated !== undefined) return seated;
     const live = await target.live(input, {
@@ -113,10 +113,10 @@ export function liveQueryDefinition(
       const window = await resolve(input);
       return { rows: await window.read(), lsn: options.lsn?.() ?? '' };
     },
-    matcher: (input) => windows.get(qidOf(name, input))?.matcher ?? UNRESOLVED,
+    matcher: (input) => windows.get(queryHash(name, input))?.matcher ?? UNRESOLVED,
     // Read off the same resolved window as the matcher, so the scope the client keys rows under and
     // the entity the matcher patches them from can never be two different names.
-    rowEntity: (input) => windows.get(qidOf(name, input))?.rowEntity ?? null,
+    rowEntity: (input) => windows.get(queryHash(name, input))?.rowEntity ?? null,
     // The two per-subscriber gates, both through the package's one authz seam. Neither result is
     // memoised anywhere: `authorize` runs on every subscribe, `visible` on every row of every
     // delivery, and there is no key here an actor could share with another actor.

package/src/live-query.ts

@@ -7,6 +7,7 @@
 // otherwise.
 
 import { type Actor, type Clock, systemClock, uuid } from '@ultimat3/core';
+import { queryHash } from '@ultimat3/query';
 import type { ChangeEvent } from './changefeed';
 import {
   type LiveCursor,
@@ -17,12 +18,7 @@ import {
 } from './cursor';
 import { isPolicyDenial, LiveQueryUnknownError, SubscriptionLimitError } from './errors';
 import type { JsonValue } from './json';
-import {
-  type LiveQueryDefinition,
-  type LiveSubscription,
-  qidOf,
-  type SnapshotResult,
-} from './live-contract';
+import type { LiveQueryDefinition, LiveSubscription, SnapshotResult } from './live-contract';
 import { type FanoutDeps, fanoutChange, snapshotFrame } from './live-fanout';
 import { createEntry, fillWindow, type QueryEntry } from './query-window';
 import type { SyncSocket } from './socket';
@@ -176,7 +172,7 @@ export class LiveQueryRegistry {
     // may not subscribe is work an unauthorized client gets to schedule.
     await definition.prepare?.(args.input);
 
-    const qid = qidOf(args.name, args.input);
+    const qid = queryHash(args.name, args.input);
     const entry = this.#entryFor(qid, definition, args.input);
     const now = this.#clock.now().getTime();
 

package/src/pg-preflight.ts

@@ -0,0 +1,117 @@
+// Single responsibility: the four questions asked of a database BEFORE `START_REPLICATION`, and
+// the identifier charset every one of them interpolates through. Three refuse the boot with the
+// exact statement that fixes them; the fourth warns, because refusing it would stop every app on
+// the default replica identity from starting.
+
+import { logger } from '@ultimat3/core';
+import { ReplicaIdentityError, ReplicationFailedError } from './errors';
+import type { PgConnection } from './pg-connection';
+
+/** Identifiers reach a simple query unparameterised, so the charset is the injection boundary. */
+const IDENTIFIER = /^[a-z_][a-z0-9_]*$/;
+
+/**
+ * The one gate between a caller-supplied name and a simple query. Exported because
+ * `PgReplicationStream` checks its slot, publication and entity names in its CONSTRUCTOR — a
+ * mistyped `REPLICATION_SLOT` is a boot-time fact, and finding it at the first WAL read means a
+ * replicator that reported itself started and then never delivered a change.
+ */
+export const assertIdentifier = (kind: string, value: string): string => {
+  if (IDENTIFIER.test(value)) return value;
+  throw new ReplicationFailedError({
+    stage: 'preflight',
+    detail: `${kind} "${value}" is not a lower-case postgres identifier`,
+    fix: `rename the ${kind} to match [a-z_][a-z0-9_]* — it is interpolated into a replication command`,
+  });
+};
+
+/**
+ * The four things that are always misconfigured. Three produce an unreadable server message if
+ * left to the server, so each gets its own `fix:` line; the fourth is `warnPartialIdentity` and
+ * only warns. `slot` and `publication` are interpolated into simple queries, so the `IDENTIFIER`
+ * charset is the injection boundary; re-asserted here rather than trusted, so the guarantee
+ * travels with the function instead of living only in `start()`.
+ */
+export async function preflight(
+  connection: PgConnection,
+  slot: string,
+  publication: string,
+  entities: ReadonlySet<string>,
+): Promise<void> {
+  assertIdentifier('slot', slot);
+  assertIdentifier('publication', publication);
+  const [walLevel] = await connection.query('SHOW wal_level');
+  if (walLevel?.[0] !== 'logical') {
+    throw new ReplicationFailedError({
+      stage: 'preflight',
+      detail: `wal_level is "${walLevel?.[0] ?? 'unknown'}", so the server writes no logical WAL`,
+      fix: "ALTER SYSTEM SET wal_level = 'logical'; -- then restart postgres",
+    });
+  }
+  const publications = await connection.query(
+    `SELECT 1 FROM pg_publication WHERE pubname = '${publication}'`,
+  );
+  if (publications.length === 0) {
+    throw new ReplicationFailedError({
+      stage: 'preflight',
+      detail: `no publication named "${publication}" exists`,
+      fix: `CREATE PUBLICATION ${publication} FOR ALL TABLES;`,
+    });
+  }
+  await warnPartialIdentity(connection, entities);
+  const [existing] = await connection.query(
+    `SELECT plugin FROM pg_replication_slots WHERE slot_name = '${slot}'`,
+  );
+  if (existing === undefined) {
+    // Plain SQL rather than CREATE_REPLICATION_SLOT: the replication command exports a snapshot
+    // that pins xmin for the session, and its option syntax changed in postgres 15.
+    await connection.query(`SELECT pg_create_logical_replication_slot('${slot}', 'pgoutput')`);
+    return;
+  }
+  if (existing[0] !== 'pgoutput') {
+    throw new ReplicationFailedError({
+      stage: 'preflight',
+      detail: `slot "${slot}" decodes with "${existing[0] ?? 'unknown'}", not pgoutput`,
+      fix: `SELECT pg_drop_replication_slot('${slot}'); -- then start the replicator again`,
+    });
+  }
+}
+
+/**
+ * The fourth preflight question, and the one that does NOT refuse. A live query decides whether a
+ * row left its result set from `change.before`, and under any replica identity but FULL that tuple
+ * is the key columns alone — which `toRow` accepts, since it only requires a text `id`.
+ *
+ * It runs BEFORE `pg_create_logical_replication_slot`: a slot decodes with the identity the
+ * catalog held when the rows were written, so asking after the slot exists answers about a stream
+ * nobody is reading yet. It WARNS rather than throws because every app on the default identity
+ * would otherwise stop booting, and a replicator that will not start is worse than the partial
+ * rows it is complaining about — `ReplicationStreamStats.partialBefore` is the running half.
+ *
+ * Entity names are the ones the constructor already put through `assertIdentifier`, which is what
+ * makes both the interpolation and the `fix:` safe; a name postgres answers with that is not in
+ * that set is dropped rather than rendered.
+ */
+async function warnPartialIdentity(
+  connection: PgConnection,
+  entities: ReadonlySet<string>,
+): Promise<void> {
+  if (entities.size === 0) return;
+  const names = [...entities].map((name) => `'${name}'`).join(', ');
+  const rows = await connection.query(
+    `SELECT relname FROM pg_class WHERE relkind = 'r' AND relreplident <> 'f' ` +
+      `AND relname IN (${names})`,
+  );
+  const tables = [
+    ...new Set(
+      rows
+        .map((row) => row[0])
+        .filter((name): name is string => typeof name === 'string' && entities.has(name)),
+    ),
+  ].sort();
+  if (tables.length === 0) return;
+  const warning = new ReplicaIdentityError({ tables });
+  // FIELDS, never interpolation, and the message is the CODE alone — the same rule
+  // `@ultimat3/http`'s error-map stage follows, so a log index can be alerted on by code.
+  logger.warn(warning.code, { cause: warning.cause, fix: warning.fix, tables });
+}

package/src/pg-replication.ts

@@ -1,21 +1,19 @@
 // Single responsibility: turn a Postgres logical-replication slot into ordered `ChangeEvent`s —
-// preflight the three things that are always misconfigured, START_REPLICATION, decode pgoutput,
-// and keep the slot confirmed. The connection, the framing and the pgoutput decode live next door;
-// what is decided here is *ordering*, because the lsn is the only authority the pipeline has.
+// START_REPLICATION, decode pgoutput, and keep the slot confirmed. The preflight, the connection,
+// the framing and the pgoutput decode live next door; what is decided here is *ordering*, because
+// the lsn is the only authority the pipeline has.
 
 import { type Clock, logger, systemClock } from '@ultimat3/core';
 import type { ChangeEvent, ChangeOp, PgLogicalReplicationOptions } from './changefeed';
-import { ReplicationFailedError, ReplicationProtocolError } from './errors';
+import { ReplicationProtocolError } from './errors';
 import { isRow, type JsonObject, type Row } from './json';
 import { ByteReader, ByteWriter, epochMsToPgTimestamp, printLsn } from './pg-bytes';
 import { PgConnection } from './pg-connection';
 import { entityRow } from './pg-entity-row';
+import { assertIdentifier, preflight } from './pg-preflight';
 import { bunPgStream, parsePgUrl } from './pg-socket';
 import { PgOutputDecoder, type PgOutputMessage, type PgRelation } from './pgoutput';
 
-/** Identifiers reach a simple query unparameterised, so the charset is the injection boundary. */
-const IDENTIFIER = /^[a-z_][a-z0-9_]*$/;
-
 const DEFAULT_STATUS_INTERVAL_MS = 10_000;
 
 /** `r` — the standby status update, the only frontend message a walsender listens for. */
@@ -27,6 +25,14 @@ export interface ReplicationStreamStats {
   readonly skipped: number;
   /** Rows replayed from before the resume position, dropped so `onChange` sees each one once. */
   readonly replayed: number;
+  /**
+   * Changes delivered from a relation whose replica identity is not FULL — so the `before` row is
+   * the key columns alone (or absent), and the live matcher's "did this row leave the result set"
+   * is decided on a partial row. `X_LIVE_REPLICA_IDENTITY` warns about the CONFIGURATION once at
+   * preflight; this counts the decisions it actually cost, which is the half a running node can
+   * be alerted on. Inserts never count: there is no `before` to be partial.
+   */
+  readonly partialBefore: number;
   /**
    * Why the pump stopped, or `null` while it is live. The read loop cannot throw into a caller —
    * nothing awaits it — so this is the one place `/readyz` and a test can see that it died at all.
@@ -58,15 +64,6 @@ export const changeLsn = (commitLsn: bigint, sequence: number): string =>
 /** The commit position inside a change lsn — where a resume asks the server to restart. */
 export const commitPositionOf = (lsn: string): bigint => BigInt(`0x${lsn.slice(0, 16) || '0'}`);
 
-const assertIdentifier = (kind: string, value: string): string => {
-  if (IDENTIFIER.test(value)) return value;
-  throw new ReplicationFailedError({
-    stage: 'preflight',
-    detail: `${kind} "${value}" is not a lower-case postgres identifier`,
-    fix: `rename the ${kind} to match [a-z_][a-z0-9_]* — it is interpolated into a replication command`,
-  });
-};
-
 export interface ReplicationStreamHandlers {
   readonly from?: string | undefined;
   onChange(event: ChangeEvent): void | Promise<void>;
@@ -94,6 +91,7 @@ export class PgReplicationStream {
   #delivered = 0;
   #skipped = 0;
   #replayed = 0;
+  #partialBefore = 0;
   #failure: string | null = null;
 
   constructor(options: PgLogicalReplicationOptions) {
@@ -116,6 +114,7 @@ export class PgReplicationStream {
       delivered: this.#delivered,
       skipped: this.#skipped,
       replayed: this.#replayed,
+      partialBefore: this.#partialBefore,
       failure: this.#failure,
     };
   }
@@ -147,7 +146,7 @@ export class PgReplicationStream {
     });
     this.#connection = connection;
     try {
-      await preflight(connection, slot, publication);
+      await preflight(connection, slot, publication, this.#entities);
       const from = handlers.from;
       this.#confirmed = from === undefined ? 0n : commitPositionOf(from);
       await connection.startCopyBoth(
@@ -339,6 +338,10 @@ export class PgReplicationStream {
       this.#replayed += 1;
       return;
     }
+    // Read off the Relation message rather than off the tuple: a DEFAULT-identity table whose
+    // non-key columns happen to be NULL sends the same bytes a FULL one does, so counting missing
+    // keys would undercount exactly the rows a policy is most likely to misjudge.
+    if (op !== 'insert' && relation.replicaIdentity !== 'f') this.#partialBefore += 1;
     const before = toRow(relation, oldTuple);
     const after = toRow(relation, newTuple);
     const event: ChangeEvent = {
@@ -380,55 +383,6 @@ export class PgReplicationStream {
   }
 }
 
-/**
- * The three misconfigurations that produce an unreadable server message if left to the server.
- * `slot` and `publication` are interpolated into simple queries, so the `IDENTIFIER` charset is the
- * injection boundary; re-asserted here rather than trusted, so the guarantee travels with the
- * function instead of living only in `start()`.
- */
-async function preflight(
-  connection: PgConnection,
-  slot: string,
-  publication: string,
-): Promise<void> {
-  assertIdentifier('slot', slot);
-  assertIdentifier('publication', publication);
-  const [walLevel] = await connection.query('SHOW wal_level');
-  if (walLevel?.[0] !== 'logical') {
-    throw new ReplicationFailedError({
-      stage: 'preflight',
-      detail: `wal_level is "${walLevel?.[0] ?? 'unknown'}", so the server writes no logical WAL`,
-      fix: "ALTER SYSTEM SET wal_level = 'logical'; -- then restart postgres",
-    });
-  }
-  const publications = await connection.query(
-    `SELECT 1 FROM pg_publication WHERE pubname = '${publication}'`,
-  );
-  if (publications.length === 0) {
-    throw new ReplicationFailedError({
-      stage: 'preflight',
-      detail: `no publication named "${publication}" exists`,
-      fix: `CREATE PUBLICATION ${publication} FOR ALL TABLES;`,
-    });
-  }
-  const [existing] = await connection.query(
-    `SELECT plugin FROM pg_replication_slots WHERE slot_name = '${slot}'`,
-  );
-  if (existing === undefined) {
-    // Plain SQL rather than CREATE_REPLICATION_SLOT: the replication command exports a snapshot
-    // that pins xmin for the session, and its option syntax changed in postgres 15.
-    await connection.query(`SELECT pg_create_logical_replication_slot('${slot}', 'pgoutput')`);
-    return;
-  }
-  if (existing[0] !== 'pgoutput') {
-    throw new ReplicationFailedError({
-      stage: 'preflight',
-      detail: `slot "${slot}" decodes with "${existing[0] ?? 'unknown'}", not pgoutput`,
-      fix: `SELECT pg_drop_replication_slot('${slot}'); -- then start the replicator again`,
-    });
-  }
-}
-
 /** A physical tuple becomes the row the matcher's predicates are written against, or nothing. */
 function toRow(relation: PgRelation, physical: JsonObject | null): Row | null {
   if (physical === null) return null;

package/src/rebase.ts

@@ -9,7 +9,7 @@
 import { RebaseConflictError } from './errors';
 import type { Row } from './json';
 import type { LocalStore, LocalTx, TableMap } from './local-store';
-import { type ConflictStrategyName, type Frame, PROTOCOL_VERSION } from './sync-protocol';
+import { type ConflictStrategyName, PROTOCOL_VERSION, type RebaseFrame } from './sync-protocol';
 
 export interface MergeArgs {
   /** Local row as the user last saw it, before any rollback. */
@@ -246,7 +246,12 @@ function numberAt(row: Row | null | undefined, field: string): number | null {
   return typeof value === 'number' ? value : null;
 }
 
-export function rebaseFrame(ack: ServerAck, strategy: ConflictStrategy): Frame {
+/**
+ * `RebaseFrame`, not `Frame`: this builds exactly one member of the union and declaring the whole
+ * union threw that away, so every caller had to re-narrow a frame it had just constructed before it
+ * could read `strategy` or `row` back off it.
+ */
+export function rebaseFrame(ack: ServerAck, strategy: ConflictStrategy): RebaseFrame {
   return {
     type: 'rebase',
     v: PROTOCOL_VERSION,

package/src/subscriber-gate.ts

@@ -129,7 +129,24 @@ export class SubscriberGate {
     patch: RowPatch,
     holds: boolean,
   ): Promise<RowPatch | null> {
-    if (patch.op === 'delete' || patch.row === null) return patch;
+    // A delete carries no row, so there is nothing to put in front of the rule — `holds` IS the
+    // decision, the same one the two branches below take for a row a rule has just refused.
+    // Returned unconditionally it was a leak with no upper bound: the shared window is pre-policy,
+    // so every subscriber learned the id and the instant of every OTHER tenant's row as it was
+    // deleted, on a query whose `visible` rule had never let them see one of them.
+    //
+    // `holds` comes from `subscription.cursor.ids`, truncated at `CURSOR_ID_LIMIT` — so on a window
+    // wider than 512 rows a legitimate delete past position 512 is dropped and that row stays on
+    // screen until the subscriber re-snapshots. That is the trade the denied-update branch below
+    // already makes, and it is the right way round: a stale row is a bug, a row id leaked to
+    // another tenant is a breach.
+    if (patch.op === 'delete' || patch.row === null) {
+      if (holds) return patch;
+      // Counted, or a withheld delete is invisible in exactly the way `onRowDenied` exists to
+      // stop — and the rate of it is how an operator sees a window shared across tenants at all.
+      this.#denied(target.qid, who, patch.id);
+      return null;
+    }
     const full = target.rows.find((row) => row.id === patch.id);
     // No whole row means no decision to take. An update patch carries the changed columns only, so
     // a rule reading `row.ownerId` on one reads `undefined` and answers as if the row had said so —

package/src/sync-frames.ts

@@ -2,6 +2,7 @@
 // inbound surface the `sync` node exposes. Every dependency is injected, so the router is
 // exercisable without a socket, a bus or a server.
 
+import { logger } from '@ultimat3/core';
 import type { ChannelHub } from './channel';
 import { topic as makeTopic } from './channel';
 import { FrameRateLimitError } from './errors';
@@ -9,7 +10,7 @@ import { FrameLanes, laneKeyOf } from './frame-lanes';
 import type { JsonValue, Row } from './json';
 import type { LiveQueryRegistry } from './live-query';
 import { type PresenceRegistry, presenceFrame } from './presence';
-import type { SyncSocket } from './socket';
+import { CLOSE, type SyncSocket } from './socket';
 import { type Frame, PROTOCOL_VERSION, toWireError } from './sync-protocol';
 
 /** Server-authoritative mutation execution. Injected: `sync` never owns business logic. */
@@ -104,7 +105,14 @@ export function createFrameRouter(options: FrameRouterOptions): FrameRouter {
           // Repeating the frame is therefore also the heartbeat — `join` re-`put`s the member.
           if (presence) {
             const roster = await presence.join(name, { id: socket.id, actorId: socket.actorId });
-            socket.send(presenceFrame(name, 'sync', roster.members, roster.total));
+            // The answer is read even though nothing here can repair it. A roster has no cursor and
+            // no re-send path of its own: the client renders an empty room until it repeats this
+            // very frame as its heartbeat, which re-joins and re-rosters. Membership on the shared
+            // set is already correct, so the drop costs one client one heartbeat of blank room —
+            // and the log is the only trace it leaves anywhere.
+            if (!socket.send(presenceFrame(name, 'sync', roster.members, roster.total))) {
+              logger.warn('sync.presence_roster_dropped', { topic: name, socketId: socket.id });
+            }
           }
           return;
         }
@@ -121,12 +129,19 @@ export function createFrameRouter(options: FrameRouterOptions): FrameRouter {
           sid: frame.sid,
           cursor: frame.target.cursor,
         });
-        socket.send(reply);
+        // `subscribe` has already seated the subscription and cleared its desync mark, so a reply
+        // the socket refuses leaves the server believing a client that holds no rows is in sync:
+        // the next change reaches it as a PATCH folded onto nothing, forever, on a socket that has
+        // since drained. Marked instead, which is the state it is actually in — the next delivery
+        // re-snapshots it out of the shared window, exactly as `live-fanout` does for a lost patch.
+        if (!socket.send(reply)) socket.markDesynced(frame.sid);
         return;
       }
       case 'mutate': {
         if (!options.onMutate) {
-          socket.send({
+          // A failure receipt is still a receipt: dropped, the client's mutation stays `inflight`
+          // and is neither rolled back nor retried, so this one reads the answer too.
+          const sent = socket.send({
             type: 'ack',
             v: PROTOCOL_VERSION,
             ref: frame.key,
@@ -137,6 +152,7 @@ export function createFrameRouter(options: FrameRouterOptions): FrameRouter {
               fix: 'pass onMutate to createSyncNode({ onMutate })',
             }),
           });
+          if (!sent) undeliverable(socket, frame.key, 'ack');
           return;
         }
         const result = await options.onMutate({
@@ -153,7 +169,7 @@ export function createFrameRouter(options: FrameRouterOptions): FrameRouter {
         // and no sequence to decide which later optimistic writes to replay over server truth.
         // These are two frames on one socket, so the order is the only coordination there is.
         if (result.entity !== undefined) {
-          socket.send({
+          const sent = socket.send({
             type: 'rebase',
             v: PROTOCOL_VERSION,
             key: frame.key,
@@ -161,14 +177,22 @@ export function createFrameRouter(options: FrameRouterOptions): FrameRouter {
             strategy: 'server-wins',
             row: result.row ?? null,
           });
+          // The ack retires the client's rebase-log entry, so acking a rebase that never left is
+          // the divergence the ordering above exists to prevent — one frame later instead of one
+          // frame earlier. Nothing is acked; the mutation stays unsettled and is replayed.
+          if (!sent) return undeliverable(socket, frame.key, 'rebase');
+        }
+        if (
+          !socket.send({
+            type: 'ack',
+            v: PROTOCOL_VERSION,
+            ref: frame.key,
+            lsn: result.lsn ?? null,
+            error: null,
+          })
+        ) {
+          undeliverable(socket, frame.key, 'ack');
         }
-        socket.send({
-          type: 'ack',
-          v: PROTOCOL_VERSION,
-          ref: frame.key,
-          lsn: result.lsn ?? null,
-          error: null,
-        });
         return;
       }
       // Server-authored frames are never received from a client.
@@ -183,3 +207,16 @@ export function createFrameRouter(options: FrameRouterOptions): FrameRouter {
     }
   }
 }
+
+/**
+ * A settlement the socket refused. There is nothing on the node to mark — the mutation is applied
+ * and the server keeps no per-mutation state — and a client only returns an `inflight` mutation to
+ * its queue when the connection dies (`requeueInflight`), so a receipt dropped on a socket that
+ * stays up is a write the client neither retires nor retries, with the server believing it settled.
+ * Closing IS the repair: the queue hands the mutation back and the reconnect replays it under the
+ * same idempotency key.
+ */
+function undeliverable(socket: SyncSocket, key: string, kind: 'rebase' | 'ack'): void {
+  logger.warn('sync.settlement_dropped', { socketId: socket.id, key, kind });
+  socket.close(CLOSE.overloaded, 'settlement undeliverable');
+}

package/src/sync-node.ts

@@ -23,7 +23,13 @@ import { GrantBook, type SyncAuthenticator, sweepGrants } from './sync-auth';
 import { ackRefOf, createFrameRouter, type MutationHandler } from './sync-frames';
 import { decode, type Frame, PROTOCOL_VERSION, toWireError } from './sync-protocol';
 import { handleUpgrade, type UpgradeTarget, type WsData } from './sync-upgrade';
-import { AcceptBudget, drainPlan, type Rng, reconnectFrame } from './thundering-herd';
+import {
+  AcceptBudget,
+  type DrainedSocket,
+  drainPlan,
+  type Rng,
+  reconnectFrame,
+} from './thundering-herd';
 
 /** Declared with the upgrade that builds it — this file only ever reads one. */
 export type { UpgradeTarget, WsData } from './sync-upgrade';
@@ -133,7 +139,7 @@ export interface SyncNode {
     close(ws: SyncWs): void;
   };
   /** Sends every client a distinct reconnect delay, then closes. Returns the plan for tests/logs. */
-  drain(options?: { graceMs?: number }): Promise<readonly { socketId: string; afterMs: number }[]>;
+  drain(options?: { graceMs?: number }): Promise<readonly DrainedSocket[]>;
 }
 
 export function createSyncNode(options: SyncNodeOptions): SyncNode {
@@ -247,8 +253,12 @@ export function createSyncNode(options: SyncNodeOptions): SyncNode {
       onRevoked: (socketId) => {
         const socket = sockets.get(socketId);
         if (!socket) return;
-        teardown(socket);
-        socket.close(CLOSE.policy, 'grant expired');
+        // Through `evict`, which closes BEFORE it releases. The other order was a close that never
+        // happened: `teardown` reaches `sockets.remove`, which closes the socket itself with
+        // `1001 connection closed`, and `SyncSocket.close` returns once `#closed` — so a revoked
+        // grant reached the client as a normal shutdown, which it retries against this node with
+        // the same dead credential, instead of the `1008` that tells it to re-dial with a new one.
+        evict(socket, CLOSE.policy, 'grant expired');
       },
       onRefreshFailed: (socketId, error) => {
         // Not a denial: the grant is kept and retried next pass. Reported because a socket nobody
@@ -353,6 +363,9 @@ export function createSyncNode(options: SyncNodeOptions): SyncNode {
           newSocketId: () => uuid(),
           authenticate: options.authenticate,
           onGranted: (socketId, grant) => grants.set(socketId, grant),
+          // The other half of recording the grant before the upgrade: an upgrade that never took
+          // gets no `close` callback, so this is the only thing that can free its entry.
+          onUngranted: (socketId) => grants.delete(socketId),
         },
         request,
         server,
@@ -440,15 +453,24 @@ export function createSyncNode(options: SyncNodeOptions): SyncNode {
       },
     },
 
-    async drain(drainOptions = {}): Promise<readonly { socketId: string; afterMs: number }[]> {
+    async drain(drainOptions = {}): Promise<readonly DrainedSocket[]> {
       ready = false;
       const ids = [...sockets.all()].map((socket) => socket.id);
-      const plan = drainPlan(ids, {
+      const spread = drainPlan(ids, {
         spreadMs: options.drainSpreadMs ?? 30_000,
         ...(options.rng ? { rng: options.rng } : {}),
       });
-      for (const entry of plan) {
-        sockets.get(entry.socketId)?.send(reconnectFrame(entry.afterMs, 'drain'));
+      // The answer is read, not assumed: this frame IS the socket's slot, so a client that never
+      // received one reconnects on its own backoff — the herd the spread exists to break, minus
+      // that client. Nothing repairs it, so what the drop owes is a count.
+      const plan: DrainedSocket[] = spread.map((entry) => ({
+        ...entry,
+        notified:
+          sockets.get(entry.socketId)?.send(reconnectFrame(entry.afterMs, 'drain')) === true,
+      }));
+      const notified = plan.reduce((total, entry) => total + (entry.notified ? 1 : 0), 0);
+      if (notified < plan.length) {
+        logger.warn('sync.drain_frames_dropped', { sockets: plan.length, notified });
       }
       const graceMs = drainOptions.graceMs ?? 5_000;
       if (graceMs > 0) await new Promise((resolve) => setTimeout(resolve, graceMs));

package/src/sync-protocol.ts

@@ -72,7 +72,7 @@ export type SubscribeTarget =
  * The opening frame, and the heartbeat's. It carries **no cursors**: resume is decided per
  * subscription by `subscribe`, whose target already carries the cursor and whose `(name, input)`
  * is what the node needs to authorize the read and reach the retained window at all. A cursor's
- * `qid` is `qidOf(name, input)` — a digest, not an input — so a resume list here could never be
+ * `qid` is `queryHash(name, input)` — a digest, not an input — so a resume list here could never be
  * more than a second, unauthorized restatement of that decision, and it cost every reconnect a
  * duplicate copy of up to `CURSOR_ID_LIMIT` ids per subscription during the exact restart storm
  * `thundering-herd.ts` exists to bound. Removing it needs no `PROTOCOL_VERSION` bump: `decode`
@@ -375,7 +375,7 @@ function list(obj: JsonObject, key: string, max: number, label = key): JsonValue
 
 /**
  * A client-supplied value, walked ITERATIVELY to its limits. Iteratively because the thing being
- * refused is a stack overflow: `qidOf` -> `canonicalJson` recurses over exactly this value, so a
+ * refused is a stack overflow: `queryHash` -> `canonicalJson` recurses over exactly this value, so a
  * depth check that recursed would be the same crash one frame earlier.
  */
 function bounded(value: JsonValue, label: string): JsonValue {

package/src/sync-upgrade.ts

@@ -37,8 +37,22 @@ export interface UpgradeDeps {
   socketCount(): number;
   newSocketId(): string;
   readonly authenticate?: SyncAuthenticator | undefined;
-  /** Recorded only after the upgrade took: a grant for a socket that never opened is never closed. */
+  /**
+   * Recorded BEFORE `server.upgrade`, because Bun runs `websocket.open` synchronously inside it
+   * (measured on bun 1.3.14) and `open` is where the node reads this grant to build the socket's
+   * actor. Recorded after, every authenticated socket carried `actor: null` — the topic guard,
+   * `authorize`, `visible` and the per-tenant cap all deciding about nobody — and it never
+   * repaired, because the re-auth sweep only visits grants with an `expiresAt`.
+   */
   onGranted(socketId: string, grant: SyncGrant): void;
+  /**
+   * The grant given back on the one path that will never open a socket. Recording first is only
+   * safe because this exists: nothing but a `close` callback deletes a grant, and there is no
+   * callback for an upgrade that never took. Required, not optional — a host that reserves and
+   * cannot release is a leak the type refuses rather than a rule a reviewer has to remember. The
+   * same "reserve, then release" shape `channel.ts` uses for a topic slot.
+   */
+  onUngranted(socketId: string): void;
 }
 
 /**
@@ -97,10 +111,14 @@ export async function handleUpgrade(
     socketId: deps.newSocketId(),
     clientBuildId: url.searchParams.get('build') ?? deps.buildId,
   };
+  // Before the upgrade, never after: `server.upgrade` runs `websocket.open` synchronously and does
+  // not return until it has, so a grant recorded on the next line is one the socket was already
+  // built without.
+  if (grant) deps.onGranted(data.socketId, grant);
   if (!server.upgrade(request, { data })) {
+    deps.onUngranted(data.socketId);
     return new Response('expected websocket', { status: 426 });
   }
-  if (grant) deps.onGranted(data.socketId, grant);
   return undefined;
 }
 

package/src/thundering-herd.ts

@@ -72,6 +72,16 @@ export interface DrainPlanEntry {
   readonly afterMs: number;
 }
 
+/**
+ * A plan entry and what became of it — what `SyncNode.drain` returns. `notified: false` means
+ * backpressure dropped that socket's `reconnect` frame: the frame is what carries the slot, nothing
+ * re-sends it, so that client reconnects on its own backoff and the count is the only place a log
+ * can say how much of the spread actually shipped.
+ */
+export interface DrainedSocket extends DrainPlanEntry {
+  readonly notified: boolean;
+}
+
 export interface DrainPlanOptions {
   /** Window across which reconnects are spread. Must exceed the node's own drain grace period. */
   readonly spreadMs?: number;