@ultimat3/realtime 9.0.0 → 10.0.0

package/CLAUDE.md

@@ -35,6 +35,15 @@ Tier 3 package. Channels, live queries, local-first sync. One protocol for all t
   **The array alone would have fixed the build** and is not why the split exists: tree-shaking is
   a bundler's discretion, `export * from` or a namespace import defeats it, and "the client entry
   cannot reach the bus" is a contract rather than an optimisation.
+- **Two entries means a specifier naming a third does not resolve, and a `fix:` is pasted.**
+  `local-store.ts`'s `X_NOT_IMPLEMENTED` told the caller to import `createOpfsLocalStore` from
+  `@ultimat3/realtime/browser` — a subpath `exports` has never declared — so the one instruction
+  the refusal carried ended in a module-resolution failure, in the package whose own rules cite
+  axiom 4. Its alternative, `persist: false` on the query, was the same defect twice: `query()`
+  does not accept `persist` either. `fix-specifier.test.ts` is the build error — every
+  `@ultimat3/realtime/<subpath>` written in shipped source must be a key of `exports`, comments
+  included, because a comment naming a subpath that does not exist is the next fix line's source.
+  It cannot see WHICH names a fix promises, so the OPFS one is pinned by name beside it.
 - **`@ultimat3/realtime/server` needs its own `paths` entry in `tsconfig.base.json`**, beside
   `@ultimat3/admin/dev`'s. `@ultimat3/*` maps `realtime/server` to `packages/realtime/server/src`,
   which does not exist, and the root program has no `node_modules/@ultimat3` symlink to fall back
@@ -259,6 +268,21 @@ Tier 3 package. Channels, live queries, local-first sync. One protocol for all t
   whose non-key columns happen to be NULL sends the bytes a FULL one does, so counting absent keys
   would undercount exactly the rows a policy is most likely to misjudge. A hard refusal in the
   `x verify` step is the follow-up and lives in `@ultimat3/cli`.
+- **The replication session pins its own output formats, `As of 2026-08-23`.** Postgres sends every
+  WAL value as TEXT and `pg-values.ts` reads a `timestamptz` by matching postgres' ISO spelling,
+  keeping the raw text when it does not match — deliberately, because a wrong instant is worse than
+  a string. That makes the SERVER's `DateStyle` load-bearing: `SQL`, `German` or `Postgres` sends
+  every timestamp down the fallback, the shared window holds `Date`s while the patch holds text,
+  `compareValues` falls to string comparison, and one edit to one column jumps its row to the top
+  of every `orderBy('createdAt','desc')` feed for every subscriber — the exact defect the decode
+  exists to close, re-opened by a GUC. `pg-connection.ts` therefore sends
+  `options: '-c datestyle=ISO -c intervalstyle=postgres -c extra_float_digits=3'` in the startup
+  packet, byte for byte what postgres' own logical-replication client sends
+  (`libpqwalreceiver.c`) — which is why a walsender accepts it. On **every** session this class
+  opens, not only the replicating one: one session shape is one thing to reason about, and the
+  advisory-lock connection is the same class. A server that refuses one answers `ErrorResponse` at
+  startup, so the replicator fails to boot with the server's own words rather than mis-sorting a
+  feed behind a warning nobody reads. `pg-connection.test.ts` pins the packet.
 - A change lsn is `<16 hex commit position><8 hex row position in that transaction>`. Never order by
   either half alone: the commit lsn repeats within a transaction, and per-record WAL positions are
   not monotonic across transactions. Never make it depend on wall time, the entity list or a process
@@ -716,10 +740,15 @@ Tier 3 package. Channels, live queries, local-first sync. One protocol for all t
 ## Commands
 
 ```
-bun test                                  # from packages/realtime
+bun test packages/realtime/src            # from the REPO ROOT, never from packages/realtime
 bun run typecheck
 ```
 
+**The root is not a preference.** `bunfig.toml`'s preload installs `@ultimat3/testing`'s matchers
+and Bun reads `bunfig.toml` from the cwd, so `bun test` inside this directory loads none and six
+tests fail on a missing matcher — this package's suite reading red for the shell it was run in.
+CI's `package` job spawns `bun test packages/<pkg>` with `cwd` at the root for the same reason.
+
 Changing a frame shape means adding a fixture to `sync-protocol.test.ts` — the round-trip test
 fails if a kind has no fixture — and bumping `PROTOCOL_VERSION` **when the change makes an old
 frame unreadable in either direction**. An *additive optional* field (`snapshot.entity`, 2026-08)

package/README.md

@@ -256,7 +256,7 @@ that outlasts the deploy. The design confronts it with exactly two paths and no
 | **snapshot** | out of window, past `maxLagMs`, or past `reconnectBudget` | one bounded indexed query |
 
 A `LiveCursor` is `lsn` + result-set `digest` + last-seen `ids` + `count`. The digest is
-order-sensitive, so a re-sort is detected; the ids let a delta be re-filtered per subscriber, because
+order-sensitive and server-side (see `cursor.ts#digestOf` for why a client cannot reproduce one); the ids let a delta be re-filtered per subscriber, because
 the retained window stores **pre-policy** patches. `resumeFrom()` picks the path,
 `shouldResnapshot()` explains it, and the budget is a cost model in patch-equivalents
 (`snapshotCost: 250` = "replaying 250 patches costs a snapshot") so the expensive path is *chosen*,
@@ -348,7 +348,9 @@ wire twice by a reconnect that raced an ack.
   would put the write the server refused back on the screen. Idempotent for a key the log does not
   hold, because a denial can arrive twice and tier 2 records nothing to undo.
 - **A delta resume leaves the digest unverified** (`DIGEST_UNVERIFIED`). Only a snapshot re-establishes
-  it. `verifyDigest()` is how a client detects drift and asks for a fresh one.
+  it. The digest is the SERVER's own — nothing on the client reproduces it, and `verifyDigest()`,
+  which claimed otherwise and had no caller, is deleted (2026-08-23). What detects drift on the
+  client is the server's `desynced` mark and the re-snapshot it triggers.
 - **Backpressure drops patch frames.** That is safe *only* because a re-snapshot is cheap: the drop
   is recorded on the socket (`desynced`) and the next delivery re-snapshots rather than diverging.
 - **A dropped CHANNEL frame is not safe, and is not repaired.** A topic has no cursor, no mark and
@@ -504,10 +506,13 @@ wire twice by a reconnect that raced an ack.
   running half: one per change delivered off a relation that is not FULL, so the decisions it
   actually cost are countable rather than silent. A hard refusal at `x verify` time is the
   follow-up.
-- Tier 3's OPFS SQLite store is browser-only and throws until the browser entry ships; `MemoryLocalStore`
-  implements the full journal/rollback/replay semantics today. It holds membership and the journal;
-  the row values are the client's one `IdentityMap`, which is what a browser store has to inherit
-  rather than re-implement.
+- Tier 3's OPFS SQLite store is browser-only, is **not built**, and throws `X_NOT_IMPLEMENTED` on
+  call. `createOpfsLocalStore` is exported from `.` and stays there when it ships — there is no
+  third entry to wait for, and the refusal used to name one (`@ultimat3/realtime/browser`, a
+  subpath `exports` never declared). `MemoryLocalStore`, beside it on `.`, implements the full
+  journal/rollback/replay semantics today and is what the refusal's `fix:` names. It holds
+  membership and the journal; the row values are the client's one `IdentityMap`, which is what a
+  browser store has to inherit rather than re-implement.
 - The identity map is **per client**, in memory, and it is not a query cache: it answers "what is
   row X now", never "have I run this query before". Nothing evicts by time or size — a row lives
   exactly as long as a window or a table holds it.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ultimat3/realtime",
-  "version": "9.0.0",
+  "version": "10.0.0",
   "description": "Three-tier realtime: channels, live queries, local-first sync — one protocol, one mutator shape",
   "license": "MIT",
   "type": "module",
@@ -36,8 +36,8 @@
     "test": "bun test"
   },
   "dependencies": {
-    "@ultimat3/core": "9.0.0",
-    "@ultimat3/query": "9.0.0",
+    "@ultimat3/core": "10.0.0",
+    "@ultimat3/query": "10.0.0",
     "nats": "2.29.3"
   }
 }

package/src/change-buffer.ts

@@ -51,6 +51,12 @@ function patchBytes(patch: RowPatch): number {
 
 export class RingChangeBuffer implements ResumeSource {
   readonly #rings = new Map<string, Ring>();
+  /**
+   * Query hashes whose ring was dropped, so the ring the NEXT change builds knows it does not
+   * carry the history before it. A `Set` of ids and not a `Map` of lsns: what the next ring is
+   * complete from is its own first patch, which only that patch can name.
+   */
+  readonly #forgotten = new Set<string>();
   readonly #capacity: number;
   readonly #maxQueries: number;
   readonly #maxBytesPerQuery: number;
@@ -71,7 +77,17 @@ export class RingChangeBuffer implements ResumeSource {
 
   append(qid: string, patch: RowPatch): void {
     const existing = this.#rings.get(qid);
-    const ring: Ring = existing ?? { patches: [], bytes: 0, evictedThrough: null };
+    // A ring RE-CREATED after a `forget` is complete only from this patch onward: everything before
+    // it went with the ring, and — on the `unsubscribe` path — the entry went too, so the changes
+    // in between were never appended at all. `evictedThrough` at its own first lsn is what makes
+    // `since` refuse a cursor from before that, which it could not do while the field came back
+    // `null` and every earlier cursor read as in-window on a ring that had held none of it.
+    const reborn = this.#forgotten.delete(qid);
+    const ring: Ring = existing ?? {
+      patches: [],
+      bytes: 0,
+      evictedThrough: reborn ? patch.lsn : null,
+    };
     ring.patches.push(patch);
     const cost = patchBytes(patch);
     ring.bytes += cost;
@@ -124,9 +140,29 @@ export class RingChangeBuffer implements ResumeSource {
    */
   forget(qid: string): void {
     const ring = this.#rings.get(qid);
-    if (!ring) return;
-    this.#bytes -= ring.bytes;
-    this.#rings.delete(qid);
+    if (ring !== undefined) {
+      this.#bytes -= ring.bytes;
+      this.#rings.delete(qid);
+    }
+    // The qid is remembered, the patches are not — and unconditionally, because the ring being
+    // absent is not the history being intact. Both callers lose history here and neither could say
+    // so: `LiveQueryRegistry.unsubscribe` drops the ENTRY, so every change until the next
+    // subscriber is never appended at all, and the LRU fires on a query that still has LIVE
+    // subscribers. Either way the next `append` was building a ring that reported itself complete
+    // from the beginning of time, so a client reconnecting inside `maxLagMs` folded a partial patch
+    // list onto a stale window with `shouldResnapshot` answering `in-window` and nothing marked
+    // desynced — permanently divergent on a healthy socket. What the tombstone costs in exchange is
+    // a resume that could have been a delta taking the snapshot path; that is one bounded read, and
+    // it is the direction this package errs in everywhere else.
+    this.#forgotten.add(qid);
+    // Bounded like everything else here: insertion-ordered, so the oldest tombstone goes first.
+    // Losing one costs a resume that could have been a delta; keeping them unbounded costs memory
+    // a client-chosen input mints at will.
+    while (this.#forgotten.size > this.#maxQueries) {
+      const oldest = this.#forgotten.values().next();
+      if (oldest.done === true) break;
+      this.#forgotten.delete(oldest.value);
+    }
   }
 
   get queryCount(): number {

package/src/cursor.ts

@@ -105,17 +105,23 @@ export function makeCursor(
   };
 }
 
-/** FNV-1a over `id:row` pairs in result order — order-sensitive, so a re-sort is detected. */
+/**
+ * FNV-1a over `id:row` pairs in result order — order-sensitive, so a re-sort is detected.
+ *
+ * **Server-side only, and it is not reproducible by a client.** `verifyDigest()` used to sit here
+ * and was DELETED (2026-08-23): it was documented as "how a client detects drift", had no caller
+ * outside its own test, and could not have had one. Three reasons, any one of them fatal.
+ * `canonicalJson` tags a `Date` as `Date(<epoch>)` while the client holds the ISO string
+ * `JSON.stringify` sent it. A delta-resumed cursor carries `DIGEST_UNVERIFIED`, so the check
+ * answered `false` for every cursor a delta produced — which is the only state drift can be
+ * detected in. And `identity-map.ts` MERGES columns across queries on purpose, so a client's row
+ * for one id is legitimately a superset of the row any single snapshot sent: an app with two reads
+ * over one entity would have reported permanent drift.
+ */
 export function digestOf(rows: readonly Row[]): string {
   return fnv1a(rows.map((row) => `${row.id}:${canonicalJson(row)}`).join(';'));
 }
 
-/** Client-side drift check: a mismatch after delta resumes is a request for a fresh snapshot. */
-export function verifyDigest(cursor: LiveCursor, rows: readonly Row[]): boolean {
-  if (cursor.digest === DIGEST_UNVERIFIED) return false;
-  return cursor.digest === digestOf(rows);
-}
-
 export function shouldResnapshot(
   cursor: LiveCursor,
   available: readonly RowPatch[] | null,

package/src/detach.ts

@@ -0,0 +1,27 @@
+// Work nobody is waiting on: a presence leave from a synchronous close, a sweep on a timer, a
+// fanout off the change bus. Split out of `sync-node.ts` at the 500-line ceiling, and it is the
+// natural seam — the function closes over nothing the node holds.
+
+import { logger, renderThrowable, reportError } from '@ultimat3/core';
+
+/**
+ * It reaches the bus or a policy, so it can fail; failing must not take a socket or the process
+ * with it, and must not be silent either, or "the room still shows someone who left" and "that
+ * change reached nobody" have nothing to read. `operation` stays low cardinality so the monitor
+ * can group on it; the topic or entity goes in `at`.
+ *
+ * `renderThrowable` and never `String(error)`: this is the one frame whose whole job is not to
+ * throw, and `String()` on a null-prototype throwable raises inside it — the detach's own `catch`,
+ * with nothing above it to answer. `channel.ts` already imports it for the same reason.
+ */
+export function detach(work: Promise<unknown>, operation: string, at?: string): void {
+  void work.catch((error: unknown) => {
+    logger.error(`${operation} failed`, {
+      ...(at === undefined ? {} : { at }),
+      error: renderThrowable(error),
+    });
+    // Nobody is awaiting this, so the log is the only trace it leaves — and a log is not a signal
+    // anyone is paged on. The bus is this node's dependency, never the client's.
+    reportError(error, { source: 'realtime', scope: { operation } });
+  });
+}

package/src/errors.ts

@@ -128,16 +128,20 @@ registerErrorCodes(
   ),
 );
 
-const DOCS_BASE = 'https://ultimate.dev/errors/';
-
-/** Base for every realtime error: fills `docs` from the code so no call site can forget it. */
+/**
+ * Base for every realtime error. No `docs:` — `UltimateError` fills it from
+ * `describeErrorCode(code).docs`, which is `@ultimat3/core`'s `ERROR_DOCS_URL`: one page for every
+ * code, never one per code, because `wiki/` is the framework's only public documentation surface
+ * and a code lives there in a TABLE ROW, which has no anchor. The
+ * `https://ultimate.dev/errors/<code>` links this class built until 9.x answered 404, host
+ * included, on every error it has ever thrown — including the ones `toWireError` puts on the wire.
+ */
 export class RealtimeError extends UltimateError {
   constructor(opts: { code: RealtimeErrorCode; cause: string; fix: string }) {
     super({
       code: opts.code,
       cause: opts.cause,
       fix: opts.fix,
-      docs: `${DOCS_BASE}${opts.code}`,
     });
   }
 }

package/src/index.ts

@@ -34,7 +34,6 @@ export {
   type ResumeSource,
   resumeFrom,
   shouldResnapshot,
-  verifyDigest,
 } from './cursor';
 // ---- errors: one vocabulary for both halves, because every code reaches the wire ---------------
 export {

package/src/live-query.ts

@@ -10,6 +10,7 @@ import { type Actor, type Clock, systemClock, uuid } from '@ultimat3/core';
 import { queryHash } from '@ultimat3/query';
 import type { ChangeEvent } from './changefeed';
 import {
+  advance,
   type LiveCursor,
   makeCursor,
   type ReconnectBudget,
@@ -199,10 +200,18 @@ export class LiveQueryRegistry {
           resumed.patches,
           new Set(cursor.ids),
         );
-        const subscription = this.#attachUnlessGone(entry, args.socket, sid, resumed.cursor);
+        // Advanced over the FILTERED list, never over `resumed.cursor` — which `resumeFrom` built
+        // by advancing across the retained window, and that window is PRE-POLICY. Seated as it
+        // came back, this subscriber's `cursor.ids` gained the id of every row inserted for every
+        // OTHER actor while it was away; `subscriber-gate` then reads `held.has(patch.id)` off it,
+        // takes the "the subscriber holds this row" branch, and delivers a `delete` frame carrying
+        // another tenant's row id and the instant it went. The leak that branch closes, re-opened
+        // one layer up. `live-fanout.ts` advances over `allowed` for exactly this reason.
+        const seated = advance(cursor, patches, resumed.cursor.lsn, now);
+        const subscription = this.#attachUnlessGone(entry, args.socket, sid, seated);
         return {
           subscription,
-          frame: { type: 'patch', v: PROTOCOL_VERSION, sid, patches, lsn: resumed.cursor.lsn },
+          frame: { type: 'patch', v: PROTOCOL_VERSION, sid, patches, lsn: seated.lsn },
         };
       }
       const subscription = this.#attachUnlessGone(entry, args.socket, sid, resumed.cursor);

package/src/local-store.ts

@@ -222,10 +222,20 @@ export interface OpfsLocalStoreOptions {
  * long write never blocks the main thread. Browser-only, so it must not be reachable from a server
  * bundle — which is why it is a factory that throws rather than a class you can accidentally new
  * on the server.
+ *
+ * The refusal below is the whole of what tier 3's durable half ships today, so its two lines have
+ * to be true of THIS build. Both were false until 2026-08-23: the fix told the caller to import
+ * this factory from a `/browser` subpath, which `package.json`'s `exports` has never declared —
+ * two entries ship, `.` and `./server` — so pasting it ended in a module-resolution failure. Its
+ * alternative was `persist: false` on the query, which `query()` has never accepted either (a
+ * `TS2353` excess property). An instruction that cannot run is axiom 4 failing in the package that
+ * documents it, so the fix now names an export that exists on an entry that exists:
+ * `MemoryLocalStore`, on `.`, declared beside this factory. `fix-specifier.test.ts` is the
+ * mechanical half.
  */
 export function createOpfsLocalStore(options: OpfsLocalStoreOptions): LocalStore {
   throw new NotImplementedError({
-    what: `OPFS SQLite local store (${options.file} v${options.schemaVersion})`,
-    fix: "import { createOpfsLocalStore } from '@ultimat3/realtime/browser' (tier 3, v2); today use MemoryLocalStore or set persist: false on the query",
+    what: `the OPFS SQLite local store for ${options.file} (schema v${options.schemaVersion}), which is realtime tier 3's durable half,`,
+    fix: "replace createOpfsLocalStore(...) with new MemoryLocalStore(), imported from '@ultimat3/realtime' beside it: the same LocalStore contract — journalled writes, ordered rollback, one row value per (entity, id) — held for the tab's lifetime rather than across a reload",
   });
 }

package/src/nats-lib-client.ts

@@ -14,6 +14,7 @@
 // This header said "every failure leaves here as an `UltimateError`" until 2026-08, which a reader
 // took as a guarantee it never was.
 
+import { renderThrowable } from '@ultimat3/core';
 import { connect, Events, headers, Match, type Msg, type MsgHdrs, type NatsConnection } from 'nats';
 import { TransportUnavailableError } from './errors';
 import {
@@ -57,8 +58,13 @@ const unavailable = (target: NatsTarget, reason: string): TransportUnavailableEr
     reason: `${target.host}:${target.port} — ${reason}`,
   });
 
-const describe = (error: unknown): string =>
-  error instanceof Error ? error.message : String(error);
+/**
+ * The caught value as text, for the `reason` that becomes an `X_TRANSPORT_UNAVAILABLE`. Core's
+ * total renderer and never `String(error)`: this text is built inside a `catch` block that has
+ * nothing left to answer with, and `String()` raises on a null-prototype throwable — which a
+ * library that is not this framework's may hand over.
+ */
+const describe = (error: unknown): string => renderThrowable(error);
 
 class LibNatsClient implements NatsClient {
   readonly #connection: NatsConnection;

package/src/nats-transport.ts

@@ -222,7 +222,9 @@ export class NatsTransport implements Transport {
       transport: this.name,
       subject,
       code: isUltimateError(error) ? error.code : undefined,
-      error: error instanceof Error ? error.message : String(error),
+      // `renderThrowable`, never `String(error)`: this is a reporter, and a throwable that fights
+      // being read makes the report the thing that throws.
+      error: renderThrowable(error),
     });
   }
 }

package/src/pg-array.ts

@@ -0,0 +1,141 @@
+// The Postgres array TEXT literal — `{a,b}`, `{"a,b",NULL}`, `{{1,2},{3,4}}` — and the element
+// type behind an array oid. Split from `pg-values.ts` so that file stays the oid switch and this
+// one stays the grammar; the element decoder arrives as a parameter, so neither imports the other.
+//
+// It exists because `@ultimat3/entity`'s repository hands an `arrayOf()` column back as a JS array
+// (the driver parses the literal) while the WAL carries the literal itself. A live row and a
+// repository row have to be the same object, so the literal is parsed here rather than shipped.
+
+/**
+ * `text[]` -> `text`. The wire names only the ARRAY type, so the element type behind it is a
+ * table — and it is a closed one: `arrayOf()` refuses `jsonb`, `bytea`, `money` and a nested array
+ * at declaration, so every array a framework entity can produce has its element listed below.
+ *
+ * The two it refuses are listed anyway (`1001`, `3807`, `199`): an adopted table can hold them,
+ * and decoding an element correctly costs nothing next to leaving the whole literal as text.
+ * An oid with no row — a user-defined enum's array, whose oid is per-database — is left as text
+ * rather than guessed at, which is what `undefined` means to `pg-values.ts`.
+ */
+const ELEMENT_OF = Object.freeze<Record<number, number>>({
+  1000: 16, // bool[]
+  1001: 17, // bytea[]
+  1005: 21, // int2[]
+  1007: 23, // int4[]
+  1009: 25, // text[]
+  1014: 1042, // bpchar[]
+  1015: 1043, // varchar[]
+  1016: 20, // int8[]
+  1021: 700, // float4[]
+  1022: 701, // float8[]
+  1028: 26, // oid[]
+  1115: 1114, // timestamp[]
+  1182: 1082, // date[]
+  1185: 1184, // timestamptz[]
+  1231: 1700, // numeric[]
+  199: 114, // json[]
+  2951: 2950, // uuid[]
+  3807: 3802, // jsonb[]
+});
+
+/** The element type oid behind an array type oid, or `undefined` when this table does not name it. */
+export function arrayElementOid(typeOid: number): number | undefined {
+  return Object.hasOwn(ELEMENT_OF, typeOid) ? ELEMENT_OF[typeOid] : undefined;
+}
+
+/** Where the scan is, so every branch below advances one cursor rather than slicing the text. */
+interface Scan {
+  readonly text: string;
+  at: number;
+}
+
+/**
+ * One array literal -> a nested JS array, or `null` when the text is not one this grammar
+ * describes. `null` is not an error: a dimension prefix (`[0:2]={…}`), a `DateStyle` this decoder
+ * does not read, or a corrupted literal all mean the same thing to the caller — keep the text it
+ * arrived as rather than deliver an array that is missing a member.
+ *
+ * `decode` is the ELEMENT decoder. It never sees a quoted element's quotes or its backslash
+ * escapes: an unquoted `NULL` is the null value and a quoted `"NULL"` is the four-character
+ * string, which is the one distinction the quoting exists to carry.
+ */
+export function parsePgArray<T>(text: string, decode: (raw: string) => T): PgArray<T> | null {
+  const scan: Scan = { text, at: 0 };
+  const parsed = readArray(scan, decode);
+  // Trailing content means the literal was not what this grammar accepted, whatever it parsed.
+  return parsed === null || scan.at !== text.length ? null : parsed;
+}
+
+/** A member is a decoded value, the null member, or — for a multidimensional array — a row of them. */
+export type PgArray<T> = (T | null | PgArray<T>)[];
+
+function readArray<T>(scan: Scan, decode: (raw: string) => T): PgArray<T> | null {
+  if (scan.text[scan.at] !== '{') return null;
+  scan.at += 1;
+  const out: PgArray<T> = [];
+  if (scan.text[scan.at] === '}') {
+    scan.at += 1;
+    return out;
+  }
+  for (;;) {
+    const member = readMember(scan, decode);
+    if (member === FAILED) return null;
+    out.push(member);
+    const next = scan.text[scan.at];
+    scan.at += 1;
+    if (next === '}') return out;
+    if (next !== ',') return null;
+  }
+}
+
+/** A sentinel, because `null` is a legal member and `undefined` would be a second spelling of it. */
+const FAILED = Symbol('pg-array-failed');
+
+function readMember<T>(
+  scan: Scan,
+  decode: (raw: string) => T,
+): T | null | PgArray<T> | typeof FAILED {
+  const head = scan.text[scan.at];
+  if (head === '{') {
+    const nested = readArray(scan, decode);
+    return nested === null ? FAILED : nested;
+  }
+  if (head === '"') {
+    const quoted = readQuoted(scan);
+    return quoted === null ? FAILED : decode(quoted);
+  }
+  const start = scan.at;
+  while (scan.at < scan.text.length) {
+    const char = scan.text[scan.at];
+    if (char === ',' || char === '}') break;
+    // A brace or a quote inside a bare element is a literal this grammar does not describe.
+    if (char === '{' || char === '"') return FAILED;
+    scan.at += 1;
+  }
+  if (scan.at === scan.text.length) return FAILED;
+  const raw = scan.text.slice(start, scan.at);
+  // Unquoted and case-insensitive is the ONLY spelling of the null member; `"NULL"` is a string.
+  return raw.toUpperCase() === 'NULL' ? null : decode(raw);
+}
+
+/** The text between one pair of quotes, with `\\` and `\"` unescaped. `null` if it never closes. */
+function readQuoted(scan: Scan): string | null {
+  scan.at += 1;
+  let out = '';
+  while (scan.at < scan.text.length) {
+    const char = scan.text[scan.at];
+    if (char === '"') {
+      scan.at += 1;
+      return out;
+    }
+    if (char === '\\') {
+      const escaped = scan.text[scan.at + 1];
+      if (escaped === undefined) return null;
+      out += escaped;
+      scan.at += 2;
+      continue;
+    }
+    out += char ?? '';
+    scan.at += 1;
+  }
+  return null;
+}

package/src/pg-connection.ts

@@ -80,8 +80,22 @@ export class PgConnection {
       user: options.user,
       database: options.database,
       application_name: options.applicationName ?? 'ultimate-replicator',
+      // The session's output formats, decided here because the decoder cannot ask. Postgres sends
+      // every WAL value as TEXT and `pg-values.ts` reads a `timestamptz` by matching postgres'
+      // ISO spelling — keeping the raw text when it does not match, on purpose, because a wrong
+      // instant is worse than a string. So `DateStyle = SQL | German | Postgres` on the SERVER
+      // silently re-opens the defect that decode exists to close: the shared window holds `Date`s,
+      // the patch holds text, and one edit to one column jumps its row to the top of every
+      // `orderBy('createdAt','desc')` feed for every subscriber.
+      //
+      // Byte for byte what postgres' OWN logical-replication client sends (`libpqwalreceiver.c`),
+      // which is why a walsender takes it: `intervalstyle` for the values this decoder keeps as
+      // text (a text form still has to be ONE text form), `extra_float_digits` so a float8 round
+      // trips exactly on servers whose default is not already 3. A server that refuses one
+      // answers `ErrorResponse` during startup, so the replicator fails to boot with the server's
+      // own words — never a warning that a feed then goes on mis-sorting behind.
+      options: '-c datestyle=ISO -c intervalstyle=postgres -c extra_float_digits=3',
     };
-    // A walsender rejects most GUCs, so only the two it accepts are sent.
     if (options.replication !== undefined) parameters['replication'] = options.replication;
     // A handshake fails on ordinary conditions — no password, an ErrorResponse, an EOF — and on
     // every one of them the caller gets an exception instead of an object, so nothing is left

package/src/pg-entity-row.ts

@@ -7,7 +7,7 @@
 
 import { describeValue } from '@ultimat3/core';
 import { ReplicationProtocolError } from './errors';
-import type { JsonObject, JsonValue } from './json';
+import type { PhysicalRow, PhysicalValue } from './pg-values';
 
 /** `org_id` -> `orgId`, `published_at` -> `publishedAt`. The inverse of `@ultimat3/entity`'s `snake()`. */
 export function camel(column: string): string {
@@ -24,7 +24,7 @@ interface FoldedMoney {
   readonly property: string;
   /** The physical columns the fold consumed, in declaration order — named together on a collision. */
   readonly columns: readonly string[];
-  readonly value: JsonObject;
+  readonly value: PhysicalRow;
 }
 
 /**
@@ -73,7 +73,7 @@ function moneyMinor(column: string, value: number | string): number {
  * `/^\d+$/` and not `Number(value)`: `Number('')` is 0, and 0 means whole units — the one value
  * an empty column must never decode to. The same guard `parseScale` uses.
  */
-function moneyScale(column: string, value: JsonValue): number {
+function moneyScale(column: string, value: PhysicalValue): number {
   const digits = typeof value === 'string' && /^\d+$/.test(value);
   const scale = typeof value === 'number' ? value : digits ? Number(value) : Number.NaN;
   if (Number.isSafeInteger(scale) && scale >= 0) return scale;
@@ -100,7 +100,7 @@ function moneyScale(column: string, value: JsonValue): number {
  * string that *is* one), and everything else is reported as shape. The scale column is matched by
  * name the same way and carries the same risk, so it renders through here too.
  */
-function shownNumber(value: JsonValue): string {
+function shownNumber(value: PhysicalValue): string {
   if (typeof value === 'number') return `"${value}"`;
   if (typeof value !== 'string') return describeValue(value);
   const numeric = value.trim() !== '' && Number.isFinite(Number(value));
@@ -119,7 +119,7 @@ function shownNumber(value: JsonValue): string {
  * column of its own: the fold consumes it whenever the group folds.
  */
 function foldMoney(
-  physical: Readonly<Record<string, JsonValue>>,
+  physical: Readonly<Record<string, PhysicalValue>>,
   name: string,
 ): FoldedMoney | null {
   const prefix = moneyPrefix(name);
@@ -171,8 +171,8 @@ function claim(taken: Map<string, string>, property: string, column: string): vo
  * property is camelCase, and money is one property over the columns `<p>_minor`/`<p>_currency`
  * and the nullable `<p>_scale`.
  */
-export function entityRow(physical: Readonly<Record<string, JsonValue>>): JsonObject {
-  const row: JsonObject = {};
+export function entityRow(physical: Readonly<Record<string, PhysicalValue>>): PhysicalRow {
+  const row: PhysicalRow = {};
   // Column order in is key order out; a folded money property lands wherever its earliest member
   // (whichever of the three the source happened to emit first) would otherwise have sat.
   const consumed = new Set<string>();

package/src/pg-replication.ts

@@ -3,19 +3,30 @@
 // the framing and the pgoutput decode live next door; what is decided here is *ordering*, because
 // the lsn is the only authority the pipeline has.
 
-import { type Clock, logger, systemClock } from '@ultimat3/core';
+import { type Clock, logger, renderThrowable, systemClock } from '@ultimat3/core';
 import type { ChangeEvent, ChangeOp, PgLogicalReplicationOptions } from './changefeed';
 import { ReplicationProtocolError } from './errors';
-import { isRow, type JsonObject, type Row } from './json';
+import { isRow, type Row } from './json';
 import { ByteReader, ByteWriter, epochMsToPgTimestamp, printLsn } from './pg-bytes';
 import { PgConnection } from './pg-connection';
 import { entityRow } from './pg-entity-row';
 import { assertIdentifier, preflight } from './pg-preflight';
 import { bunPgStream, parsePgUrl } from './pg-socket';
+import type { PhysicalRow } from './pg-values';
 import { PgOutputDecoder, type PgOutputMessage, type PgRelation } from './pgoutput';
 
 const DEFAULT_STATUS_INTERVAL_MS = 10_000;
 
+/**
+ * Consecutive standby-status writes that may fail before the stream is declared dead.
+ *
+ * Three, at the default 10s interval, is 30s — inside postgres' own 60s `wal_sender_timeout`, so
+ * the replicator gives up at roughly the same moment the server would. It is a constant and not an
+ * option because it is a fraction of `statusIntervalMs`, and a second knob is a second number that
+ * can disagree with the one it is a fraction of.
+ */
+const MAX_CONFIRM_FAILURES = 3;
+
 /** `r` — the standby status update, the only frontend message a walsender listens for. */
 const STANDBY_STATUS = 0x72;
 
@@ -33,6 +44,13 @@ export interface ReplicationStreamStats {
    * be alerted on. Inserts never count: there is no `before` to be partial.
    */
   readonly partialBefore: number;
+  /**
+   * Standby-status writes that have failed in a row without one landing in between. It is the half
+   * of a broken stream the delivery count cannot show: the read side goes on delivering while
+   * `confirmed_flush_lsn` stops advancing, so WAL accumulates on the primary with nothing else
+   * reporting it. Reset by the first confirm that lands.
+   */
+  readonly confirmFailures: number;
   /**
    * Why the pump stopped, or `null` while it is live. The read loop cannot throw into a caller —
    * nothing awaits it — so this is the one place `/readyz` and a test can see that it died at all.
@@ -92,6 +110,7 @@ export class PgReplicationStream {
   #skipped = 0;
   #replayed = 0;
   #partialBefore = 0;
+  #confirmFailures = 0;
   #failure: string | null = null;
 
   constructor(options: PgLogicalReplicationOptions) {
@@ -115,6 +134,7 @@ export class PgReplicationStream {
       skipped: this.#skipped,
       replayed: this.#replayed,
       partialBefore: this.#partialBefore,
+      confirmFailures: this.#confirmFailures,
       failure: this.#failure,
     };
   }
@@ -163,8 +183,9 @@ export class PgReplicationStream {
     // A restart that kept the last death in `stats()` reports a live stream as failed, and the
     // supervisor that reads it never sees the replicator come back.
     this.#failure = null;
+    this.#confirmFailures = 0;
     this.#timer = setInterval(() => {
-      void this.#confirm();
+      void this.#confirmOnTimer();
     }, this.#options.statusIntervalMs ?? DEFAULT_STATUS_INTERVAL_MS);
     // A pending timer must not be what keeps `x dev` alive after the app is done with it.
     this.#timer.unref?.();
@@ -276,7 +297,7 @@ export class PgReplicationStream {
         }
       }
     } catch (failure) {
-      await this.#die(failure instanceof Error ? failure.message : String(failure));
+      await this.#die(renderThrowable(failure));
     }
   }
 
@@ -312,8 +333,8 @@ export class PgReplicationStream {
   async #deliver(
     op: ChangeOp,
     relation: PgRelation,
-    oldTuple: JsonObject | null,
-    newTuple: JsonObject | null,
+    oldTuple: PhysicalRow | null,
+    newTuple: PhysicalRow | null,
     handlers: ReplicationStreamHandlers,
   ): Promise<void> {
     const transaction = this.#transaction;
@@ -359,9 +380,47 @@ export class PgReplicationStream {
     this.#delivered += 1;
   }
 
+  /**
+   * The TIMER's confirm, and the one call that may not reject. `void this.#confirm()` handed the
+   * rejection to nobody: `#confirm` awaits `#writing`, which rejects the moment the socket is gone,
+   * and no package in this repo installs an `unhandledRejection` handler, so Bun ends the process —
+   * an uncoded `TypeError` reaching the operator with no code and no `fix:`, and exit code 1 on an
+   * otherwise clean shutdown.
+   *
+   * Worse than the crash was the silence before it: `stats().failure` stayed `null`, so `/readyz`
+   * reported the replicator live while `confirmed_flush_lsn` stopped advancing and WAL piled up on
+   * the primary. A run of failures is now a death, the same way `#drain`'s catch is — the four
+   * things `#die` owns go together or not at all.
+   */
+  async #confirmOnTimer(): Promise<void> {
+    try {
+      await this.#confirm();
+      // Consecutive, not cumulative: one confirm that lands means the walsender is being told
+      // where we are, and a lifetime count would eventually kill a healthy stream.
+      this.#confirmFailures = 0;
+    } catch (failure) {
+      this.#confirmFailures += 1;
+      logger.warn('replication confirm failed', {
+        slot: this.#options.slot,
+        consecutive: this.#confirmFailures,
+        error: renderThrowable(failure),
+      });
+      const consecutive = this.#confirmFailures;
+      if (consecutive >= MAX_CONFIRM_FAILURES) {
+        await this.#die(
+          `${consecutive} standby status updates failed in a row — ` +
+            `the slot is not being confirmed: ${renderThrowable(failure)}`,
+        );
+      }
+    }
+  }
+
   /**
    * Tell the walsender how far we got. Serialized behind one chain because the timer and the read
    * loop both reach it, and two interleaved writes would frame one another's bytes.
+   *
+   * It still RAISES: `stop()` and the keepalive reply both await it and both need the answer. Only
+   * the timer, which awaits nothing, goes through `#confirmOnTimer` above.
    */
   async #confirm(connection: PgConnection | null = this.#connection): Promise<void> {
     if (connection === null || !connection.inCopyBoth) return;
@@ -375,16 +434,21 @@ export class PgReplicationStream {
       .int64(at)
       .uint8(0)
       .finish();
-    this.#writing = this.#writing.then(
-      () => connection.sendCopyData(payload),
-      () => undefined,
-    );
-    await this.#writing;
+    // The chain SERIALIZES writes; it does not decide them. Putting the rejection handler on the
+    // chain itself meant the confirm after a failed one resolved without writing anything —
+    // `.then(send, () => undefined)` runs the second handler and hands back its `undefined`, so
+    // every other standby status update after the first failure was a no-op that reported success.
+    // A run of failures could then never be seen, because the run never got past one.
+    const attempt = this.#writing.then(() => connection.sendCopyData(payload));
+    // What the NEXT caller queues behind is this attempt settled either way; what THIS caller
+    // awaits is the attempt itself, because it is the only one entitled to its outcome.
+    this.#writing = attempt.catch(() => undefined);
+    await attempt;
   }
 }
 
 /** A physical tuple becomes the row the matcher's predicates are written against, or nothing. */
-function toRow(relation: PgRelation, physical: JsonObject | null): Row | null {
+function toRow(relation: PgRelation, physical: PhysicalRow | null): Row | null {
   if (physical === null) return null;
   const row = entityRow(physical);
   // A bigserial id decodes as a number inside `Number.isSafeInteger` range and as text outside it,

package/src/pg-values.ts

@@ -0,0 +1,166 @@
+// One physical Postgres value, off the WAL as text, becomes the value a ROW holds — the same one
+// `@ultimat3/entity`'s repository produces for that column. Lifted out of `pgoutput.ts` so that
+// file stays message framing and this one stays the type catalogue.
+//
+// The rule it enforces is `CLAUDE.md`'s: **a live row must equal a repository row.** The WAL is
+// text and a repository row is not, so `timestamp()` is a `Date` on both sides, `arrayOf()` is a
+// JS array on both sides and `bytes()` is a `Uint8Array` on both sides. Left as postgres' own
+// text, `compareValues(new Date(…), '2026-08-09 12:00:00+00')` fell to `String(left) < String(right)`
+// — `"1786…"` against `"2026-…"` — so one edit to one column moved every row of an
+// `orderBy('createdAt','desc')` feed to the top for every subscriber, and `post.tags.map(…)` threw
+// in the component the first patch reached.
+
+import { renderThrowable } from '@ultimat3/core';
+import { ReplicationProtocolError } from './errors';
+import type { JsonValue } from './json';
+import { arrayElementOid, parsePgArray } from './pg-array';
+
+/**
+ * What a row value can be between the WAL and the wire: JSON, plus the two JS shapes a repository
+ * row already carries. `Date` and `Uint8Array` are not `JsonValue` and are not meant to be — they
+ * are what `JSON.stringify` turns into the string a SNAPSHOT frame carries, which is precisely the
+ * format a patch frame has to converge on.
+ */
+export type PhysicalValue =
+  | JsonValue
+  | Date
+  | Uint8Array
+  | PhysicalValue[]
+  | { [key: string]: PhysicalValue };
+
+export type PhysicalRow = { [key: string]: PhysicalValue };
+
+/**
+ * `2026-08-09 12:00:00.123456+00` -> the ISO-8601 form `new Date` is specified to accept.
+ *
+ * Postgres writes a space between the date and the clock, an offset that may be `+00`, `+0530` or
+ * `+05:30`, and as many fractional digits as the column's precision. `Date` holds milliseconds, so
+ * the fraction is TRUNCATED to three — which is what the driver does on the repository side, so
+ * both readers of one column land on the same instant.
+ */
+const TIMESTAMP =
+  /^(\d{4,6})-(\d{2})-(\d{2})[ T](\d{2}):(\d{2}):(\d{2})(\.\d+)?(Z|[+-]\d{2}(?::?\d{2})?)?$/;
+
+/**
+ * `undefined` for a text this decoder does not describe — `infinity`, a BC date, a non-ISO
+ * `DateStyle` — and the caller keeps the text it arrived as. Silence beats a wrong instant: the
+ * value still crosses, it simply does not claim to be a `Date`.
+ *
+ * The `DateStyle` half is closed at the SESSION and not here: `pg-connection.ts` pins
+ * `datestyle=ISO` in the startup packet, so a server configured `SQL`, `German` or `Postgres`
+ * cannot quietly send this branch every timestamp it decodes. Nothing in this file may depend on
+ * that — a text it cannot read still keeps its text — but a reader wondering why the ISO
+ * assumption is safe should look there rather than rediscover it.
+ *
+ * A `timestamp without time zone` (oid 1114) carries no offset and is read as UTC. This framework's
+ * `timestamp()` is always `timestamptz`, so the only way to reach that branch is an adopted table —
+ * and UTC is the one reading with no ambient zone in it.
+ */
+function toInstant(text: string): Date | undefined {
+  const parts = TIMESTAMP.exec(text);
+  if (parts === null) return undefined;
+  const [, year, month, day, hour, minute, second, fraction, zone] = parts;
+  const millis = fraction === undefined ? '000' : `${fraction.slice(1)}000`.slice(0, 3);
+  const parsed = new Date(
+    `${year}-${month}-${day}T${hour}:${minute}:${second}.${millis}${offsetOf(zone)}`,
+  );
+  return Number.isNaN(parsed.getTime()) ? undefined : parsed;
+}
+
+/** `+05` and `+0530` are offsets postgres writes and `Date` does not read; `±HH:MM` is both. */
+function offsetOf(zone: string | undefined): string {
+  if (zone === undefined || zone === 'Z') return 'Z';
+  if (zone.length === 3) return `${zone}:00`;
+  if (zone.length === 5) return `${zone.slice(0, 3)}:${zone.slice(3)}`;
+  return zone;
+}
+
+const HEX = /^[0-9a-fA-F]*$/;
+
+/**
+ * `\x0102` -> `Uint8Array([1, 2])`, the value `bytes()` parses to on the repository side.
+ *
+ * `undefined` for anything else, including the pre-9.0 `escape` output format: that one is
+ * ambiguous without knowing the server's `bytea_output`, and a wrong byte string is worse than the
+ * text. Nothing this framework creates sets it.
+ */
+function toBytes(text: string): Uint8Array | undefined {
+  if (!text.startsWith('\\x')) return undefined;
+  const hex = text.slice(2);
+  if (hex.length % 2 !== 0 || !HEX.test(hex)) return undefined;
+  const out = new Uint8Array(hex.length / 2);
+  for (let i = 0; i < out.length; i += 1) out[i] = Number.parseInt(hex.slice(i * 2, i * 2 + 2), 16);
+  return out;
+}
+
+/**
+ * Postgres sends every value as text (we never negotiate binary). Decoding depends on the
+ * column's type oid — the wire gives us nothing else to go on, so this switch is the one place
+ * that type catalogue is encoded.
+ */
+export function decodeValue(typeOid: number, text: string): PhysicalValue {
+  switch (typeOid) {
+    case 16: // bool
+      return text === 't';
+
+    case 20: {
+      // int8: only safe as a number if it round-trips exactly; otherwise keep the digits —
+      // a rounded bigint is a worse lie than a string that still parses correctly downstream.
+      const asNumber = Number(text);
+      return Number.isSafeInteger(asNumber) ? asNumber : text;
+    }
+
+    case 21: // int2
+    case 23: // int4
+    case 26: // oid
+      return Number(text);
+
+    case 700: // float4
+    case 701: // float8
+      // JSON has no literal for these three, so the text form survives the round trip instead of
+      // silently becoming a number `JSON.stringify` would otherwise turn into `null`.
+      if (text === 'NaN' || text === 'Infinity' || text === '-Infinity') return text;
+      return Number(text);
+
+    case 1700: // numeric — exactness beats convenience; money is never a float here.
+      return text;
+
+    case 114: // json
+    case 3802: {
+      // jsonb
+      let parsed: unknown;
+      try {
+        parsed = JSON.parse(text);
+      } catch (cause) {
+        throw new ReplicationProtocolError({
+          stage: 'value',
+          detail: `type oid ${typeOid} carried invalid json: ${renderThrowable(cause)}`,
+        });
+      }
+      return parsed as JsonValue;
+    }
+
+    case 1114: // timestamp
+    case 1184: // timestamptz
+      // A `Date`, because `timestamp()` reads back as one through the repository and the two have
+      // to be one value: `JSON.stringify` gives the wire the same ISO string either way.
+      return toInstant(text) ?? text;
+
+    case 1082: // date
+      // Already the value: `date()` parses to `@ultimat3/time`'s `PlainDate`, which IS the
+      // `YYYY-MM-DD` string postgres wrote. Converting it to a `Date` would be the 100x-style
+      // reinterpretation the calendar/instant split exists to prevent.
+      return text;
+
+    case 17: // bytea
+      return toBytes(text) ?? text;
+
+    default: {
+      // An array type's element is the only thing left that changes the answer, and only when this
+      // decoder knows which element type it is — see `pg-array.ts` for what an unknown oid costs.
+      const element = arrayElementOid(typeOid);
+      if (element === undefined) return text; // text, varchar, uuid, enum, and everything else.
+      return parsePgArray(text, (raw) => decodeValue(element, raw)) ?? text;
+    }
+  }
+}

package/src/pgoutput.ts

@@ -1,12 +1,13 @@
-import { renderThrowable } from '@ultimat3/core';
 // Decodes pgoutput logical-replication messages (protocol version 1, Postgres >= 12) into typed
-// PgOutputMessage values, and the postgres text-format values inside each tuple into JsonValue.
-// Pure byte decoding: no sockets, no I/O. A decoder instance owns the per-connection relation
-// cache that later Insert/Update/Delete/Truncate messages reference by oid.
+// PgOutputMessage values. Pure byte decoding: no sockets, no I/O. A decoder instance owns the
+// per-connection relation cache that later Insert/Update/Delete/Truncate messages reference by oid.
+//
+// What a tuple's TEXT means is `pg-values.ts`'s: this file frames messages, that one owns the type
+// catalogue that turns postgres' text into the value a repository row holds.
 
 import { ReplicationProtocolError } from './errors';
-import type { JsonObject, JsonValue } from './json';
 import { ByteReader, pgTimestampToEpochMs } from './pg-bytes';
+import { decodeValue, type PhysicalRow } from './pg-values';
 
 export interface PgColumn {
   /** part of the replica identity key — set by the `flags & 1` bit. */
@@ -40,85 +41,25 @@ export type PgOutputMessage =
       readonly commitAt: number;
     }
   | { readonly kind: 'relation'; readonly relation: PgRelation }
-  | { readonly kind: 'insert'; readonly relation: PgRelation; readonly after: JsonObject }
+  | { readonly kind: 'insert'; readonly relation: PgRelation; readonly after: PhysicalRow }
   | {
       readonly kind: 'update';
       readonly relation: PgRelation;
-      readonly before: JsonObject | null;
-      readonly after: JsonObject;
+      readonly before: PhysicalRow | null;
+      readonly after: PhysicalRow;
     }
-  | { readonly kind: 'delete'; readonly relation: PgRelation; readonly before: JsonObject }
+  | { readonly kind: 'delete'; readonly relation: PgRelation; readonly before: PhysicalRow }
   | { readonly kind: 'truncate'; readonly relations: readonly PgRelation[] }
   /** origin / type / logical message — decoded far enough to be skipped safely. */
   | { readonly kind: 'other'; readonly tag: string };
 
-/**
- * Postgres sends every value as text (we never negotiate binary). Decoding depends on the
- * column's type oid — the wire gives us nothing else to go on, so this switch is the one place
- * that type catalogue is encoded.
- */
-function decodeValue(typeOid: number, text: string): JsonValue {
-  switch (typeOid) {
-    case 16: // bool
-      return text === 't';
-
-    case 20: {
-      // int8: only safe as a number if it round-trips exactly; otherwise keep the digits —
-      // a rounded bigint is a worse lie than a string that still parses correctly downstream.
-      const asNumber = Number(text);
-      return Number.isSafeInteger(asNumber) ? asNumber : text;
-    }
-
-    case 21: // int2
-    case 23: // int4
-    case 26: // oid
-      return Number(text);
-
-    case 700: // float4
-    case 701: // float8
-      // JSON has no literal for these three, so the text form survives the round trip instead of
-      // silently becoming a number `JSON.stringify` would otherwise turn into `null`.
-      if (text === 'NaN' || text === 'Infinity' || text === '-Infinity') return text;
-      return Number(text);
-
-    case 1700: // numeric — exactness beats convenience; money is never a float here.
-      return text;
-
-    case 114: // json
-    case 3802: {
-      // jsonb
-      let parsed: unknown;
-      try {
-        parsed = JSON.parse(text);
-      } catch (cause) {
-        throw new ReplicationProtocolError({
-          stage: 'value',
-          detail: `type oid ${typeOid} carried invalid json: ${renderThrowable(cause)}`,
-        });
-      }
-      return parsed as JsonValue;
-    }
-
-    case 1082: // date
-    case 1114: // timestamp
-    case 1184: // timestamptz
-      return text; // an ISO-ish string; never a `Date` — the row must stay JSON.
-
-    case 17: // bytea — the `\x...` text form, as-is.
-      return text;
-
-    default: // text, varchar, uuid, enum, and everything else not called out above.
-      return text;
-  }
-}
-
 /**
  * Int16 ncolumns + that many columns. Every tuple kind (insert's new row, update/delete's old
  * row, a `'K'` key-only row) shares this decoder: postgres always sends one byte per column,
  * `'u'` standing in for the columns a key-only tuple leaves out — so the column count always
  * matches the relation, and only the per-column byte tells us whether a value is actually there.
  */
-function decodeTupleData(reader: ByteReader, relation: PgRelation): JsonObject {
+function decodeTupleData(reader: ByteReader, relation: PgRelation): PhysicalRow {
   const count = reader.int16();
   if (count !== relation.columns.length) {
     throw new ReplicationProtocolError({
@@ -129,7 +70,9 @@ function decodeTupleData(reader: ByteReader, relation: PgRelation): JsonObject {
     });
   }
 
-  const row: JsonObject = {};
+  // Null-prototype: `column.name` is off the WIRE, so a column literally named `__proto__` set
+  // the prototype of every row this decoder built. `Object.create(null)` has no prototype to set.
+  const row: PhysicalRow = Object.create(null) as PhysicalRow;
   for (const column of relation.columns) {
     const kind = reader.tag();
     if (kind === 'n') {
@@ -256,7 +199,7 @@ export class PgOutputDecoder {
   #decodeUpdate(reader: ByteReader): PgOutputMessage {
     const relation = this.#relationOrThrow(reader.int32());
     let marker = reader.tag();
-    let before: JsonObject | null = null;
+    let before: PhysicalRow | null = null;
     if (marker === 'K' || marker === 'O') {
       before = decodeTupleData(reader, relation);
       marker = reader.tag();

package/src/server.ts

@@ -121,6 +121,9 @@ export {
   type ReplicationStreamStats,
 } from './pg-replication';
 export { bunPgStream, type PgTarget, parsePgUrl, type SslMode } from './pg-socket';
+// The value domain a WAL tuple lands in. Public because it is `PgOutputMessage`'s and
+// `entityRow`'s: a caller naming either type has to be able to name what is inside one.
+export { decodeValue, type PhysicalRow, type PhysicalValue } from './pg-values';
 export type { PgStream } from './pg-wire';
 export {
   type PgColumn,

package/src/socket.ts

@@ -185,7 +185,21 @@ export class SyncSocket {
       }
       return false;
     }
-    this.#ws.send(encode(frame));
+    // `WsLike.send` is declared `: number` for this line and no other: Bun answers `0` for a
+    // message it DROPPED — the socket closed between the buffered-amount check above and this
+    // write — and `-1` under backpressure. Discarded, a dropped frame read as delivered, so
+    // `live-fanout` advanced the subscriber's cursor past a patch that never left and
+    // `sync-frames`' desync mark was never taken: permanently stale on a healthy socket, which is
+    // the exact outcome every other `socket.send` on this node reads its answer to prevent.
+    if (this.#ws.send(encode(frame)) <= 0) {
+      this.droppedFrames += 1;
+      // The same ceiling backpressure takes: a socket the runtime keeps refusing is one to close,
+      // and the two are one failure — the write went nowhere either way.
+      if (this.droppedFrames > this.#maxDroppedFrames) {
+        this.close(CLOSE.overloaded, 'backpressure');
+      }
+      return false;
+    }
     this.sentFrames += 1;
     return true;
   }

package/src/sync-node.ts

@@ -6,6 +6,7 @@
 
 import { type Clock, logger, markReady, reportError, systemClock, uuid } from '@ultimat3/core';
 import type { ChannelHub, Topic } from './channel';
+import { detach } from './detach';
 import { isClientFault } from './errors';
 import type { Transport, TransportSubscription } from './fanout';
 import type { LiveQueryRegistry } from './live-query';
@@ -162,25 +163,6 @@ export function createSyncNode(options: SyncNodeOptions): SyncNode {
   let reauthing: ReturnType<typeof setInterval> | null = null;
   let idling: ReturnType<typeof setInterval> | null = null;
 
-  /**
-   * Work nobody is waiting on — a presence leave from a synchronous close, a sweep on a timer, a
-   * fanout off the change bus. It reaches the bus or a policy, so it can fail; failing must not take
-   * a socket or the process with it, and must not be silent either, or "the room still shows someone
-   * who left" and "that change reached nobody" have nothing to read. `operation` stays low
-   * cardinality so the monitor can group on it; the topic or entity goes in `at`.
-   */
-  const detach = (work: Promise<unknown>, operation: string, at?: string): void => {
-    void work.catch((error: unknown) => {
-      logger.error(`${operation} failed`, {
-        ...(at === undefined ? {} : { at }),
-        error: error instanceof Error ? error.message : String(error),
-      });
-      // Nobody is awaiting this, so the log is the only trace it leaves — and a log is not a
-      // signal anyone is paged on. The bus is this node's dependency, never the client's.
-      reportError(error, { source: 'realtime', scope: { operation } });
-    });
-  };
-
   /**
    * Everything `start()` acquired that is not a socket: the change subscription and the presence
    * sweep. Both `drain()` and `stop()` run it, because a `drain()` is terminal on its own — it