@voltro/sql-mysql 0.19.0 → 0.20.1

package/CHANGELOG.md

@@ -39,6 +39,230 @@ _Changes staged for the next release accumulate here (rolled up from
 
 ---
 
+## [0.20.1] — 2026-07-30
+
+### Changed
+
+- **@voltro/database, @voltro/runtime, @voltro/plugin-versioning, @voltro/plugin-presence, @voltro/voltro** — Five framework-table indexes were holding GENERIC names in a namespace that is shared with your tables. Index names are unique per SCHEMA on every supported dialect, so `_voltro_row_history.index('byTrace')` reserved `byTrace` for the whole database — and `byTrace` is the first thing anyone reaches for when indexing a `traceId`. A consumer added `traceId` to their own audit table, indexed it the obvious way, and collided with ours; the framework's own error message even suggested renaming the framework's index as the fix.
+
+  Renamed: `_voltro_row_history` `byTrace` → `byRowHistoryTrace`, `bySubject` → `byRowHistorySubject`; `_voltro_api_keys` `byTenant` → `byApiKeyTenant`; `_voltro_presence` `byChannel` → `byPresenceChannel`; `_voltro_connections` `bySubject` → `byConnectionSubject`. These are `_voltro_*` tables, so the rename rides the declarative differ on `voltro db apply` / boot — no codemod. Adopters see a one-time index rebuild.
+
+  A test now enforces the rule that most framework tables already followed: a framework index name must MENTION its own table. Mechanical, so it cannot rot the way a curated list of "generic" names would, and it does not demand the full `_voltro_<table>_<name>` form — which would force renaming ~20 already-safe indexes for no benefit. It also asserts no two framework tables claim the same index name, since installing two such plugins together would fail at migrate time for a reason neither plugin's author could see.
+
+### Fixed
+
+- **@voltro/sql-mysql, @voltro/voltro** — A MariaDB table with a UNIQUE constraint on an UNBOUNDED text column can never be decoded from the binlog. The reader now says so ONCE — with the real cause and a remedy that works — and excludes the table, instead of looping on it forever.
+
+  **The mechanism.** MariaDB backs an unbounded UNIQUE with a **HASH long-unique index**, which adds a hidden `DB_ROW_HASH_n` column to the InnoDB row. That column IS in the binlog row image and is NOT in `information_schema.COLUMNS`, so the reader compares N+1 against N and throws on every write to that table:
+
+  ```text
+  Table app.sessions schema changed between binlog event and metadata fetch:
+    the event has 9 columns, fetched metadata has 8
+  ```
+
+  Nothing is broken; the table is shaped that way, permanently. The previous recovery (skip to the current binlog end) recovered nothing, because the end is exactly where the next failing write appears — a loop a consumer measured at roughly every 9 seconds, re-signalling resync to the whole fleet each pass.
+
+  **The cause we shipped in the previous entry was WRONG, and this retracts it.** It blamed a `DROP COLUMN` that ran as `ALGORITHM=INSTANT` leaving a phantom column, and told people to run `ALTER TABLE … FORCE`. The same consumer measured that: 9 InnoDB columns before the rebuild, 9 after, hidden column still present — the rebuild recreates the index and therefore recreates the hidden column. The repair line sent readers in a circle. They also disproved the version theory, being on the same MariaDB 11.8 we had tested on and failed to reproduce a phantom column with.
+
+  **Now:** affected tables are found at CDC start by a privilege-free probe — the direct evidence in `INNODB_SYS_COLUMNS` needs `PROCESS`, which an app DB user does not have, so the constraint SHAPE is inferred from `information_schema.STATISTICS` + `COLUMNS` instead — reported once as an error naming `text().maxLength(n)` as the remedy and `ALTER TABLE FORCE` as explicitly not one, and EXCLUDED from the reader.
+
+  Excluding is what makes it converge, and that is measured rather than assumed: an excluded table with a hidden hash column produces no reader error at all, while the same table included throws on the first write. Cross-instance change events for such a table are lost until it is bounded; own-node reactivity is unaffected (writes still emit inline).
+
+  Framework `_voltro_*` tables cannot hit this — they are filtered out of the reader's include list before it reaches the replication client, and exclusion demonstrably shields the metadata fetch.
+
+  **Caveat worth reading if you are already affected:** on a table that ALREADY exists, adding `.maxLength(n)` currently changes nothing — the schema differ does not diff text length, so it plans 0 operations and reports "up to date". That is a separate defect, reported in the same round and not yet fixed; until it is, the remedy only applies to newly created tables.
+- **@voltro/cli, @voltro/voltro** — `voltro codegen` no longer writes a silently plugin-less `rpcGroup.generated.ts`, and it now reports what it merged.
+
+  `loadApiConfig` swallows every failure into `null`, and `config?.plugins ?? []` turned that into "this app has no plugins". So an `app.config.ts` that threw while importing produced a generated file with **no plugin error union and no plugin routes** — followed by `voltro codegen: wrote rpcGroup.generated.ts`. The file typechecks, so nothing downstream catches it; the only symptom is a client branching on an error tag that never arrives.
+
+  A consumer with ~140 declarative `guards:` measured that file 2781 lines shorter after a version bump, with the `ScopeError` import and the whole `__voltroPluginErrors` union gone. For the record, since they were careful to separate measurement from conclusion: the generator did NOT drop the feature — the plugin-codegen path is byte-identical between 0.19.0 and 0.20.0, and the published `@voltro/cli@0.20.0` does contain the identifier they grepped for. Their `grep` came back empty because the bundled chunk contained a literal NUL byte, which makes a file binary to most search tools (fixed separately, and it had been hiding files from our own audits too). What was real is the artefact diff, and this is the path that produces it without a word.
+
+  Now: a config that EXISTS but fails to load is a refusal with a non-zero exit and the underlying cause, not a quiet downgrade. An app with no `app.config.ts` at all still generates — absence is legitimate, failure is not. And every run prints `(plugins N, error schemas N, plugin routes N)`, because a count that drops from 7 to 0 has to be visible in the success line or the next occurrence is found the same way: by diffing artefacts during a debugging session.
+
+  `loadApiConfigDiagnosed` is the new seam (`{ config, present, error }`); `loadApiConfig` is unchanged for every existing caller.
+- **@voltro/cli, @voltro/voltro** — `ssr cold-compile` log lines now carry the compile's duration, and `voltro start` emits them at all.
+
+  The lines had a `start` and an `end` and no timing, which looks readable and is not: cold compiles run concurrently up to `VOLTRO_DEV_SSR_COMPILE_CONCURRENCY`, so the pairs INTERLEAVE. Subtracting adjacent timestamps names the wrong module, and above a limit of two they cannot be paired by eye at all — which is what a user reading a pod log actually hit, with three `start` lines before their `end`s:
+
+  ```
+  …:59.704 ssr cold-compile start id=…/layout.tsx
+  …:59.704 ssr cold-compile start id=…/(main)/layout.tsx
+  …:03.447 ssr cold-compile end 3743ms id=…/layout.tsx
+  ```
+
+  The gate had the number for free and threw it away. It is measured INSIDE the concurrency permit, so it is the module's own compile cost rather than the time it spent queued behind the limit — those are different numbers and only one of them is a property of the module. A slow first paint is usually one slow module, and this is the line that names it.
+
+  A failed compile now says `FAILED` instead of `end`. Without that, a 3.7-second line for a module that threw read exactly like a slow but successful compile.
+
+  `voltro start`'s middleware fallback constructed the same gate with NO callbacks, so an on-demand compile there produced no line whatsoever; it is wired now.
+- **@voltro/cli, @voltro/voltro** — `voltro db plans`, `db drift` and `db restore-snapshot` worked on postgres only. On mysql/mariadb (and mssql and sqlite) all three died with:
+
+  ```text
+  fatal  unhandled cli error  (FiberFailure) SqlError: Failed to execute statement
+  ```
+
+  The cause is three `${sql('col')}::text AS ${sql('col')}` casts — POSTGRES syntax, in read paths whose helper is still called `buildPgLayer`. `db apply`, which WRITES the same ledger table, has no cast and worked, which is exactly the split a consumer reported: the commands that read were broken, the one that writes was fine.
+
+  The casts existed to stop a driver handing back a `jsonb` object or a `Date`. Normalising in JS gets the same result and cannot be dialect-specific, since drivers differ in whether a json column arrives parsed and whether a timestamp arrives as a `Date`.
+
+  Worth naming what it cost: `db drift` is the command whose whole job is "alert if live diverged from declared", and the consumer who found this had live divergence at the time. The specific detector and the general one were blind together.
+
+  **And the error now names the failing statement.** Their verdict was the actionable part of the report:
+
+  > *"the error names no statement … the statement text (or even the operation name) > would turn this from a dead end into a bug report. We would have sent you the > failing SQL if the error had contained it."*
+
+  Right twice over — they could not diagnose it, and neither could we from the report; it took reading our own source. `@effect/sql`'s `SqlError` carries the driver error in `cause`, and every supported driver puts the useful part there (mysql2: `code`, `errno`, `sqlState`, `sqlMessage`, usually `sql`; pg: `code`, `detail`, `hint`, `position`). The CLI's fatal reporter printed only the wrapper. It now walks the cause chain and prints the driver message, the codes and the statement — collapsed to one line, and saying `<not attached by the driver>` when there genuinely is none, because that is information too.
+
+  Shape-based rather than `instanceof SqlError`, deliberately: the CLI catches errors that have crossed the serve/start bundle boundary, where two copies of `@effect/sql` make `instanceof` silently false — the failure mode this repo has already paid for elsewhere.
+- **@voltro/cli, @voltro/voltro** — `voltro doctor`'s `plaintext-secret` rule no longer flags metadata ABOUT a credential. An audit row denormalising the public facts of an api key — `apiKeyId`, `apiKeyKeyId`, `apiKeyType`, `apiKeyOwnerId`, `apiKeyName` — had three columns already excluded by the `*Id` suffix, while `apiKeyType` and `apiKeyName` fired. Telling a team to encrypt the LABEL of a credential is how a rule earns being ignored.
+
+  The exclusion now covers final words that cannot BE the credential — `Name`, `Type`, `Kind`, `Label`, `Prefix`, `Suffix`, `Status`, `State`, `Scope(s)`, `Version`, `Count`, `Provider`, `Format`, `Note`/`Description`/`Comment`, plus the existing `Id` and the hash family. Deliberately NOT on the list: `Value`, `Secret`, `Token`, `Key`, `Password` — the words that name the thing itself. A false negative from an over-wide list is silent, so that is the failure mode the list is built against, and a test pins the words that must still fire.
+- **@voltro/database, @voltro/cli, @voltro/voltro** — `voltro doctor` no longer contradicts itself about the `.serverOnly()` wire audit. The same command on the same tree reported:
+
+  ```
+  human: serverOnly: NOT CHECKED | json: {'checked': True, 'leaks': 0}
+  ```
+
+  Two causes, both fixed. `registerRelations` refused a re-registration of the IDENTICAL relation object, so a process that executes a module twice looked like two conflicting declarations — it now mirrors `registerTable`'s `existing === table` tolerance (a DIFFERENT block claiming the same name still throws). And doctor loaded the app three times per run; it now loads once, so every report sees the same outcome instead of the first one succeeding and the next failing.
+
+  The consequence was worse than the noise: the throw aborted the wire audit, so the check that a token cannot reach a client had not run since the reporting app adopted the marker — and a CI gate written exactly as we documented (`fail on serverOnly.checked === false`) reported green on an app where the audit provably had not run. That is the "reads as coverage without being coverage" failure the `serverOnly` field was added to remove, reappearing in the field added to prevent it.
+- **@voltro/sql-mysql, @voltro/voltro** — `insertIgnore` on MariaDB no longer reports a cause it cannot know, and no longer turns a REJECTED write into a silent "conflict". `INSERT IGNORE` downgrades EVERY error to a warning — foreign key, NOT NULL, CHECK, truncation — so the post-check's premise ("the insert was skipped ⇒ a unique constraint fired") does not hold on this dialect. It asserted a second unique index that did not exist; the real cause was an FK (an auto-stamped `createdBy` with no matching `actors` row), and a consumer spent the diagnosis looking for a phantom index.
+
+  The message now reads the real error from `SHOW WARNINGS` on the same connection — BEFORE the existing-row lookup, since that lookup is itself a statement and resets the warning list. A non-duplicate warning is reported as a rejection and throws, because returning there is data loss presented as a normal outcome: the row is not written and the caller is told it already was. A genuine duplicate on an unnamed constraint now names the constraint that fired. Outside a transaction the warning cannot be attributed to our own statement (each statement acquires from the pool independently), so the message says the constraint is unknown rather than guessing — framework mutations are auto-transactional, so the common path has the cause.
+- **@voltro/logger, @voltro/cli, @voltro/database, @voltro/voltro** — `voltro doctor --json` and `voltro capabilities --json` now emit exactly one JSON document on stdout. A `log.warn` from module discovery landed there ahead of it, so:
+
+  ```console
+  $ voltro doctor --json 2>/dev/null | python3 -c 'import json,sys; json.load(sys.stdin)'
+  JSONDecodeError: Extra data: line 2 column 1
+  ```
+
+  Note the `2>/dev/null` in that repro — stderr was already redirected, so there was no shell-side workaround. And it only happened when a warning fired, so a consumer's CI parsed the document correctly until one file out of 368 tripped one. That is the same failure the `serverOnly.checked` field was added to remove — an automat unable to separate the normal case from the special case — one layer out, in the surface added to fix it.
+
+  A command that owns stdout for machine output now calls `claimStdoutForJson()` before doing any work that could log, and every record goes to stderr from then on. The stream decision itself moved into ONE place (`@voltro/logger`'s `stream.ts`, exported as `routeDiagnosticsToStderr`): the Effect surface and the direct surface each carried their own copy of `level === 'error' ? stderr : stdout`, and two copies of one rule is how the rule failed to change.
+
+  **Also fixed, same report:** the warning that started it was itself wrong. A `*.relations.ts` whose `relations(...)` map is EMPTY was reported as *"no relations(...) export found"* — pointing the reader at a missing export that is right there. `isRelationsSpec` rejects an empty map (correctly — there is nothing to register), but the caller could not tell that apart from a module with no export at all. It now says the map is empty and names the export.
+- **@voltro/cli, @voltro/voltro** — The SSR bundle build now externalises a bare specifier it cannot resolve instead of aborting, so an uninstalled OPTIONAL peer no longer makes `voltro build` impossible.
+
+  The SSR step runs with `ssr: { noExternal: true }` — inlining everything is what lets a production web image ship without a framework dependency tree — and that left no escape for a package that cannot be resolved at all. The commonest such package is an optional native peer reached through a library's Node entry:
+
+  ```
+  Rolldown failed to resolve import "canvas"
+    from ".../konva/lib/index-node.js"
+  ```
+
+  `konva`'s `main` is its Node build, which requires the optional native `canvas`; its `browser` field points at one that does not. An app that never renders to a canvas server-side has nothing to install.
+
+  A consumer measured that there was no way out from their side either, and each measurement is worth keeping: the import was ALREADY dynamic (rolldown must still resolve it to form the chunk), `renderMode: 'spa'` does not help (`.framework/app.tsx` imports every page statically for the router, so the module is in the SSR graph whatever the render mode), and an `ssr.external` passthrough in `app.config.ts` is not read. So `voltro build` — and with it the production image — was unavailable for that app.
+
+  The api serve bundle and the web start bundle already did exactly this; that plugin is esbuild's and this step is vite/rolldown, so it is the same probe behind a different interface. Framework packages (`@voltro/*`, `@effect/*`, `effect`) are never externalised, so the "needs nothing from node_modules" property still holds.
+
+  Every externalised specifier is NAMED in the `SSR bundle ready` line. Externalising is right for an uninstalled optional peer and wrong for a genuine missing dependency — it trades a loud build failure for a quiet runtime one — and only the reader can tell which, so it is reported rather than swallowed.
+- **@voltro/sql-mysql, @voltro/sql-sqlite, @voltro/sql-mssql, @voltro/sql-postgres, @voltro/database, @voltro/voltro** — A typed error thrown inside a mutation now reaches the client TYPED, on every dialect. It arrived as an untagged `Die` defect on mysql/mariadb, sqlite and mssql: `transactional()` settled its program with `runPromise`, which rejects with Effect's `FiberFailure` wrapper, and the wrapper copies `message` and a decorated `name` but nothing else — no `_tag`, no payload, no prototype. So the rpc encoder could not match the failure against the mutation descriptor's `error:` union:
+
+  ```
+  └─ ["error"] └─ ["_tag"] └─ is missing
+     Expected never, actual (FiberFailure) NotFoundError: …
+  ```
+
+  Framework mutations are auto-transactional, so this was EVERY typed mutation error in an app. Nothing failed — `defineMutation({ error: … })` compiled, the client's type still said `NotFoundError`, and the `error._tag === 'NotFoundError'` branch was simply never taken at runtime. Actions, which are not auto-transactional, marshalled correctly the whole time, which is what made the transaction the discriminator. A hand-rolled error class lost its fields and its `instanceof` too; only `message` survived, which is why a workaround built on `error.message` looked like it worked and hid this.
+
+  Postgres already had the unwrap, with a comment describing this exact consequence, and the three sibling dialects kept the broken call — so the fix is now one shared `settleTransactionExit` in `@voltro/database` that all four import, plus a parity test that fails if any store's `transactional()` reaches `runtime.runPromise` again. Reported by a consumer on MariaDB who verified it against 0.19.0 too, so it is not a 0.20.0 regression.
+
+### Internal (no consumer-facing effect)
+
+- **@voltro/runtime, @voltro/database, @voltro/protocol, @voltro/cli, @voltro/plugin-billing, @voltro/plugin-mail, @voltro/plugin-sso-saml, @voltro/plugin-storage** — Fourteen source files carried a LITERAL NUL byte — the house idiom for a composite map key, written as the raw character instead of an escape. That makes the file BINARY to every text tool: `grep` skips it entirely and reports nothing, which is indistinguishable from a clean file. It was found because a new guard test scanning for framework index names came back clean on `runtime/src/connectionVault.ts` — 1020 lines that every previous grep-based audit in this repo had also silently skipped, including the one looking for exactly the index name that file declares.
+
+  Replaced with the JavaScript escape for U+0000. Identical runtime value, files are text again. No behaviour change.
+
+---
+
+## [0.20.0] — 2026-07-29
+
+### ⚠ BREAKING
+
+- **@voltro/plugin-versioning, @voltro/database, @voltro/voltro, @voltro/sql-postgres, @voltro/sql-mysql, @voltro/sql-sqlite, @voltro/sql-mssql** — `versioningPlugin({ timing: 'in-transaction' })` produced a WRONG trail, not merely a slow one. Reported and reproduced against MariaDB 11 by a team that wired both plugins and measured before migrating a single call site.
+
+  **It recorded every change twice.** The two timings are alternatives, but the post-commit change tap stayed wired when the in-transaction recorder was registered, so both ran. One `bookmarks.create` → two history rows.
+
+  **And the trail was mis-ordered, which is worse.** Each path numbered independently: one insert plus one update produced versions `0, 0, 1, 2` across four rows. `selectAsOf`, `sortHistory` and `diffVersionRows` all read `version`, so `rowAsOf` returned the wrong snapshot and `diffVersions` found nothing. A duplicate can be deduped; a wrong order cannot be detected from the data.
+
+  The recorder wrote a constant `version: 0` on purpose, with a design note arguing that ordering could come from `changedAt` and that a read per covered write was too expensive. Both halves were wrong: `changedAt` is millisecond-resolution, so two writes to one row inside one transaction tie routinely, and the number is what every reader consults.
+
+  **BREAKING —** a `WriteRecorder` now receives a PORT (`{ append, maxOf }`) rather than a bare `append`. `maxOf` is one aggregate with an equality filter on the connection the write already holds; it is what lets an append-only trail number its own entries. A recorder still cannot UPDATE, DELETE or open a nested transaction, and a throw from either operation still rolls the caller's write back. Apps that merely ENABLE the timing need no change — only a hand-written recorder does, and `tsc` names every site.
+
+  **Cost, stated rather than avoided:** `'in-transaction'` now takes TWO round-trips per recorded write, roughly doubling this timing's published per-write overhead. Both timings number from 1, so switching `timing` no longer shifts version numbers.
+
+### Fixed
+
+- **@voltro/database, @voltro/sql-postgres, @voltro/sql-mysql, @voltro/sql-sqlite, @voltro/sql-mssql** — The correlation bridge did not survive a transaction, and did not survive CDC. Both are fixed, and both were found by measuring against live databases after a consumer isolated the symptom in a scratch app.
+
+  **Every write a framework mutation makes was unattributed.** `transactional()` is entered from the request's async-local scope, but its callback runs from inside the Effect the store builds — and measured against live postgres AND live mariadb, the scope is active at the call site and EMPTY inside the callback. Framework mutations are auto-transactional, so this was every handler write. Same class as the `bindMutation` defect fixed alongside it: a scope covering the construction of an Effect and not its execution. The caller's attribution is now captured at `transactional()` entry and re-established around the callback, in all four dialect stores.
+
+  **And the CDC transports could not carry it at all.** Under `changeStrategy: 'cdc'` — the DEFAULT — the event a subscriber receives is rebuilt from a postgres NOTIFY payload or a mysql binlog row image, neither of which can hold a request context. `registerPendingAttribution` / `claimPendingAttribution` (`@voltro/database`) let the write path hand its identity to the echo, keyed by `(table, op, id)` and claimed once. A write made on ANOTHER replica has nothing pending and stays unattributed, which is the correct answer rather than a gap.
+
+  **Plus one nobody had reported, found on the way:** on postgres under CDC the write path skipped `routeEvent` entirely, and `runWriteRecorders` lives inside it — so `versioningPlugin({ timing: 'in-transaction' })` with the default `CDC=1` recorded NOTHING. The mode whose entire promise is "if the change committed, the entry is there" wrote an empty trail, silently. `routeEvent` now runs in both modes; only the DELIVERY decision is strategy-dependent.
+
+  New live-dialect suites (`cdcAttribution.integration.test.ts` in `sql-postgres` and `sql-mysql`) pin all of it, and were verified red against the previous code.
+- **@voltro/plugin-versioning, @voltro/runtime, @voltro/cli** — `_voltro_row_history.traceId` and `.subjectId` were NULL on every write. Three independent causes, all found from one consumer report whose evidence pinned the diagnosis before we looked: `subjectId` was NULL while `changedBy` on the SAME row carried the acting user — so the identity was known and was not travelling.
+
+  - **The adapter dropped them.** `dataStoreHistoryStore.append` hand-wrote its insert object and listed `changedBy` but not `traceId` / `subjectId`. This is the second time that shape has bitten in this file — the READ side (`rowToVersion`) had drifted identically. A row built by hand in one place and read by hand in another disagree exactly when a field is ADDED, because nothing fails. Both now spread the row. - **An Effect-returning handler was unattributed.** `bindMutation` established the scope around the CALL, which covers an async executor for its whole run — but an Effect-returning one is only CONSTRUCTED there and runs later. It is now forked inside the scope, with interruption and typed failures preserved (both pinned by tests). Verified by measurement, not assumption: an Effect forked inside an ALS scope keeps seeing it across `sleep`, `yieldNow` and a `setTimeout` promise, while the same effect merely constructed inside sees nothing. - **The devtools `/invoke` path never entered the scope at all.** It bypasses the rpc stack by design, and that also bypassed everything `bindMutation` sets up. The audit plugin recorded a traceId (it reads `requestContext.traceId`, which this path does build) while every write underneath carried none — three consumers of one call disagreeing about its trace. It also synthesised `inspect-<8 random chars>`, which no trace consumer can parse; the reporter's framing is the rule worth keeping — *a synthesised id produces a column that looks joinable and is not; NULL at least fails honestly.* It is a real 32-hex id now, and it reaches all three sinks.
+
+  `actingUserId` is imported at the new call site rather than re-derived — one answer to "who is writing", shared with what `audit()` stamps.
+- **@voltro/cli** — Three ways a check reported nothing while checking nothing, all found by a consumer verifying the silence instead of trusting it.
+
+  - **`unexercised-row-filter` never fired on a typed registration.** The match was `/\bsetRowFilter\s*\(/`, which demands the paren directly after the name, so `setRowFilter<Ctx>({…})` — the spelling our own generic signature invites — broke it. The rule was blind for exactly the teams that had wired `load`/`predicate` carefully. It counts CALLS now. - **…and its test-side condition was satisfiable by a COMMENT.** It matched `rowFilter:` in raw text. Comments and string literals are stripped, and the suite must both call `makeTestContext` and bind `rowFilter` in real code. - **The same paren-adjacent shape sat in two shipped codemod gates.** `0.7.0/01` (row filter) and `0.7.0/02` (`invoke`) both gate on a generic export, so a typed call made `voltro update` print nothing at all: the upgrade reads as clean and the behaviour change lands unread. Both now use the shared `callPattern`, which allows type arguments including nested ones.
+
+  Two false-positive fixes in the hand-roll detector, from the same report:
+
+  - **A file that WIRES a plugin is no longer told to adopt it.** The `presence` rule reported `app.config.ts` (which calls `presencePlugin()`) to an app that had just deleted its hand-rolled table. Rules that recommend a package now declare it, and a file referencing that package is skipped. - **Generated files and `.d.ts` are out of the scan.** A recommendation aimed at a file the next boot overwrites is never actionable.
+
+  And one more of the first kind, found while checking why a withdrawn report's probe had stayed silent: `raw-fetch` counted only a BARE `fetch(…)` callee, so `globalThis.fetch(url)` / `self.fetch(url)` in a server file read as clean.
+- **@voltro/cli** — `voltro doctor`'s `serverOnly: NOT CHECKED` line now names the failure, and the field exists in `--json`.
+
+  The refusal to claim a pass was right. What shipped with it was nothing to act on: the `catch` discarded the error entirely, so there was no reason, no failing module, and — because the field was absent from `--json` — no way for CI to assert "still unchecked" rather than reading silence as a pass.
+
+  A consumer's verdict, which is the useful part: *"The message is honest and that is the problem."* They had already verified that every descriptor, `app.config.ts` and the generated rpc group imported cleanly under `tsx` on their own, so the difference had to be in what `loadDiscovered` does BEYOND importing — and none of that was visible from outside. It matters more than its size because `.serverOnly()` is what guards their `sessions.tokenHash` and `apiKeys.keyHash`, markers they added after finding a query whose output schema shipped a hash over the wire.
+
+  `--json` now carries `serverOnly: { checked, reason?, leaks? }`. Gate CI on `checked === false`.
+- **@voltro/plugin-versioning** — A version snapshot no longer copies `.serverOnly()` columns into `_voltro_row_history`. `.encrypted()` columns are KEPT, and that distinction is the whole finding.
+
+  Reported by a team choosing which tables to version: `sessions` holds `.encrypted()` PATs and a `tokenHash`, `apiKeys` holds a `keyHash`, and they could not determine from outside what the snapshot would contain. They excluded both tables — then went and measured it, which corrected their own report:
+
+  ```
+  probeItems.secret     enc:v1:a56iziEV9THLhzmJ:Vk0ux+0bECleTLBJkCa0Rg==:3AtMwP…
+  _voltro_row_history   {"secret":"enc:v1:a56iziEV9THLhzmJ:Vk0ux+0bECleTLBJkCa0Rg==:…"}
+  ```
+
+  **`.encrypted()` lands as ciphertext, byte-identical to the source column**, so versioning such a table widens nothing — the history is exactly as readable as the row it came from. Withholding it would have cost real audit data to prevent an exposure that does not exist.
+
+  **`.serverOnly()` is withheld**, and the reason is not "a second copy under different retention" — that argument is weak on its own, since the hash already sits in the source table. The decisive one: `crud.*` STRIPS `.serverOnly()` columns from every row it returns, and a snapshot would smuggle the same value back past that stripping inside a `json()` blob, where no column-level rule applies.
+
+  Withheld names are listed under `data._omitted`, so a reader can tell "this column was withheld" from "this column did not exist then". Both timings apply the same policy. `.sensitive()` is not involved: it is an export-masking marker for values that are legitimately readable in the app.
+- **@voltro/cli** — A page that RE-EXPORTS its component (`export { default, renderMode } from '../page'`) no longer fails the codegen gate with "exports no default". The check required the literal words `as default`, so the one spelling that lets two routes share a screen without copying it was the one spelling it refused — and it refused in `voltro build`, while dev and tests stayed green because nothing prerenders there. `export { default as Screen }` is still correctly rejected: it renames the default away.
+
+  Two follow-ons from the same shape:
+
+  - The refusal message said the file "ends in `.page.tsx`" and offered "drop the `.page` suffix" as a fix. That is the 0.15.0 convention, replaced by directory routing in 0.17.0 — it named a convention that no longer exists and a fix that could not work. It now names `page.tsx` and both real fixes. - `scanRenderProfile` read a forwarded `renderMode` as absent and fell back to `'static'`, so `staticSafe` and the deploy-target classification could call an app CDN-deployable with an `ssr` route in it. The forward is now followed (relative specifiers, depth-capped); an unresolvable one still falls back rather than failing the scan.
+- **@voltro/database** — `VOLTRO_SOFT_DROP=1` could never converge. The applier renames the object to `<name>__dropped_<ts>` instead of dropping it, which leaves it undeclared — and the differ read that as one more forgotten table, planning the drop again. The re-plan inside `applyPlan` then found an operation still outstanding and aborted with "the DDL for these operations is a no-op — this is a framework bug", which was a wrong diagnosis of a real defect: the DDL had worked. No fingerprint was recorded, so the migration counted as unapplied and every later `db apply` / boot hit the same wall. The only exit was a hard drop of the snapshot — exactly the recoverability the flag is chosen for.
+
+  The planner now treats `<name>__dropped_<YYYYMMDDHHMMSS>` as framework-managed, alongside `_voltro_*` / `cluster_*`. Deliberately not retention-aware: a planner whose output depends on the clock would produce different plans before and after midnight, and `db gc-snapshots` already owns expiry.
+
+  Reported against tables; the same defect existed one level down for soft-dropped COLUMNS, where it was worse — a re-planned `drop-column` carries no `dropped()` marker and so refuses to plan at all. Both are fixed.
+
+  The convergence message itself no longer asserts a cause it cannot know. It said "the DDL for these operations is a no-op", which was flatly wrong here and sent the reporter looking for dead DDL. It now names both causes — no-op DDL, and a planner that cannot see what the DDL did — and says which one an operation naming a just-renamed object usually is.
+
+### Internal (no consumer-facing effect)
+
+- **The `0.20.0/01_write-recorder-port` codemod gains the gate test its two predecessors have.**
+
+  `codemodRegistry.test.ts` asserts that every `*.codemod.ts` on disk is registered and that ids are unique — registration, not behaviour. What it cannot see is the one way a `manual` codemod fails in practice: an `appliesTo` that is too broad, so the note prints for projects that have nothing to do. That is not a cosmetic problem. A note which fires on every app is how readers learn to skip notes, and the next one carries a boot refusal.
+
+  This codemod is the case where the silent direction matters most. The break is a TYPE error, so `tsc` already names every affected site; the note exists only to explain `maxOf`, which the compiler cannot. Apps that merely ENABLE `timing: 'in-transaction'` need to do nothing — `plugin-versioning` ships the recorder and it is already updated — and they are the large majority.
+
+  Four cases, covering both directions: a project registering its own recorder (note prints, and names `{ append }`, `maxOf`, and the `null`-is-not-zero distinction that a hand-written sequence gets wrong), an app that only enables the timing (silent), the identifier in a comment or a string (silent), and the generic call form `registerWriteRecorder<Row>(…)`, which `callPattern` admits and a naive match would miss.
+
+---
+
 ## [0.19.0] — 2026-07-29
 
 ### ⚠ BREAKING

package/dist/index.d.ts

@@ -59,6 +59,18 @@ export declare interface BinlogCdcOptions {
      * per-subscribe re-query already does this on the next change.
      */
     readonly onResync?: () => void;
+    /**
+     * Names of tables whose binlog row image carries MORE columns than
+     * `information_schema.COLUMNS` reports, so the reader can NEVER decode them.
+     *
+     * Supplied by the store from a privilege-free probe (see
+     * `hashLongUniqueTablesQuery`). The reader subtracts them from `includeSchema`,
+     * which is what makes the condition converge: MEASURED against live MariaDB
+     * 11.8, an EXCLUDED table with a hidden hash column produces no error at all,
+     * while the same table included throws
+     * `the event has 3 columns, fetched metadata has 2` on the first write.
+     */
+    readonly undecodableTables?: ReadonlyArray<string>;
     /**
      * Watchdog liveness cadence + stall threshold (ms). The reader tracks its
      * last progress (any binlog event or a fresh attach); when nothing has
@@ -282,6 +294,12 @@ export declare class MysqlStore implements DataStore {
      * re-enter `routeEvent` and emit a change event for the trail's own table.
      */
     private appendInTxn;
+    /**
+     * The other half of the recorder port: ONE aggregate on the caller's
+     * connection, so an append-only trail can number its own entries. Equality
+     * filter only — see `writeRecorder.ts` for why it is this narrow.
+     */
+    private maxInTxn;
     private routeEvent;
     private executeUpsert;
     /**
@@ -294,6 +312,38 @@ export declare class MysqlStore implements DataStore {
      */
     private executeMariadbUpsert;
     private executeInsertIgnore;
+    /**
+     * The warnings MariaDB raised for the statement that just ran on `txn`.
+     *
+     * Only meaningful inside a transaction, and that is why the parameter is not
+     * optional. `SHOW WARNINGS` reports the last statement on the CONNECTION, and
+     * outside a transaction each statement acquires from the pool independently —
+     * so a warning read there could belong to an unrelated statement on another
+     * caller's connection. Reporting that as this insert's cause would be a worse
+     * version of the bug this exists to fix, so `insertIgnore` passes `null` and
+     * says "unknown" rather than reading something it cannot attribute.
+     *
+     * Diagnostic-only: a failure to read warnings must never replace the caller's
+     * real problem with a problem about reading warnings.
+     */
+    /**
+     * Tables among `includeTables` whose binlog row image carries a HIDDEN column,
+     * so the reader could never decode them.
+     *
+     * Privilege-free by construction: the direct evidence lives in
+     * `INNODB_SYS_COLUMNS`, which needs `PROCESS` — a grant an app DB user does not
+     * have (verified: `Access denied; you need … the PROCESS privilege(s)`). This
+     * infers the same thing from the CONSTRAINT shape, which any user can read: a
+     * UNIQUE index with no prefix length over a text/blob column can only be a
+     * MariaDB hash long-unique, and that is what adds the hidden column.
+     *
+     * Diagnostic-only — a probe that fails must never stop CDC from starting. An
+     * undiscovered table still gets caught by the reconnect path's repetition check;
+     * this just moves the diagnosis to boot, where it is one message instead of a
+     * loop.
+     */
+    private findUndecodableCdcTables;
+    private readWarnings;
     private findByConflict;
     query(d: QueryDescriptor): Promise<readonly Readonly<Record<string, unknown>>[]>;
     raw<T extends object = Row>(fragment: RawSqlFragment, _opts?: {

package/dist/index.js

@@ -3,16 +3,16 @@ import { Config as t, Effect as n, Layer as r, ManagedRuntime as i, Option as a,
 import { EventEmitter as c } from "node:events";
 import { createLogger as l } from "@voltro/logger";
 import { SqlClient as u, TransactionConnection as d } from "@effect/sql/SqlClient";
-import { CDC_OFFSETS_TABLE as f, EagerCardinalityError as p, _voltroCdcOffsetsTable as m, attachEagerLoads as h, attributionFields as g, compileEagerJson as _, compilePredicate as v, compileRawFragment as y, compileSelect as b, decodeRowsFromSchema as x, encodeRowForSchema as S, hasEagerLoads as C, isTableReactive as w, qualifyTable as T, raiseChangeListenerCeiling as E, recordsTable as D, requireTable as O, runWriteRecorders as k, stampGeneratedId as A, stampGeneratedIds as j } from "@voltro/database";
+import { CDC_OFFSETS_TABLE as f, EagerCardinalityError as p, _voltroCdcOffsetsTable as m, attachEagerLoads as h, attributionFields as g, attributionKey as _, claimPendingAttribution as v, compileEagerJson as y, compilePredicate as b, compileRawFragment as x, compileSelect as S, currentWriteAttribution as C, decodeRowsFromSchema as w, encodeRowForSchema as T, hasEagerLoads as E, isTableReactive as D, qualifyTable as ee, raiseChangeListenerCeiling as O, recordsTable as te, registerPendingAttribution as ne, requireTable as re, runWithWriteAttribution as k, runWriteRecorders as A, settleTransactionExit as j, stampGeneratedId as M, stampGeneratedIds as N } from "@voltro/database";
 //#region src/sqlLayer.ts
-var M = (n) => e.layerConfig({
+var P = (n) => e.layerConfig({
 	host: t.succeed(n.host),
 	port: t.succeed(n.port),
 	username: t.succeed(n.username),
 	password: t.succeed(o.make(n.password)),
 	database: t.succeed(n.database),
 	...n.maxConnections === void 0 ? {} : { maxConnections: t.succeed(n.maxConnections) }
-}), N = (e) => {
+}), F = (e) => {
 	if (e.url) {
 		let t = new URL(e.url);
 		return {
@@ -32,63 +32,72 @@ var M = (n) => e.layerConfig({
 		database: e.database ?? "app",
 		...e.maxConnections === void 0 ? {} : { maxConnections: e.maxConnections }
 	};
-}, P = (e) => M(N(e)), F = (e, t) => e === null ? !1 : t === null ? !0 : e.filename === t.filename ? e.position > t.position : e.filename > t.filename, I = (e) => e.msSinceProgress < e.stallThresholdMs ? "healthy" : e.primary !== null && !F(e.primary, e.reader) ? "idle-caught-up" : "reconnect", L = (e) => (e instanceof Error ? e.message : String(e ?? "")).includes("schema changed between binlog event and metadata fetch"), R = /* @__PURE__ */ new Set([
+}, I = (e) => P(F(e)), ie = (e, t) => e === null ? !1 : t === null ? !0 : e.filename === t.filename ? e.position > t.position : e.filename > t.filename, ae = (e) => e.msSinceProgress < e.stallThresholdMs ? "healthy" : e.primary !== null && !ie(e.primary, e.reader) ? "idle-caught-up" : "reconnect", L = (e) => (e instanceof Error ? e.message : String(e ?? "")).includes("schema changed between binlog event and metadata fetch"), R = (e) => {
+	let t = e instanceof Error ? e.message : String(e ?? "");
+	return /Table\s+[^\s.]+\.(\S+)\s+schema changed between binlog event and metadata fetch/.exec(t)?.[1] ?? null;
+}, z = "\n  SELECT DISTINCT s.TABLE_NAME AS tableName\n  FROM information_schema.STATISTICS s\n  JOIN information_schema.COLUMNS c\n    ON c.TABLE_SCHEMA = s.TABLE_SCHEMA\n   AND c.TABLE_NAME  = s.TABLE_NAME\n   AND c.COLUMN_NAME = s.COLUMN_NAME\n  WHERE s.TABLE_SCHEMA = DATABASE()\n    AND s.NON_UNIQUE = 0\n    AND s.SUB_PART IS NULL\n    AND c.DATA_TYPE IN ('text','tinytext','mediumtext','longtext','blob','tinyblob','mediumblob','longblob')\n", B = (e) => `cdc: table '${e}' is EXCLUDED from binlog capture — its row image carries a hidden column the reader cannot account for. Cause: a UNIQUE constraint on an UNBOUNDED text column, which MariaDB backs with a HASH long-unique index; that index adds a hidden DB_ROW_HASH_n column to the row, present in the binlog and absent from information_schema.COLUMNS. Remedy: bound the column — text().maxLength(n) — so the constraint becomes an ordinary B-tree index with no hidden column. ALTER TABLE FORCE does NOT help: the rebuild recreates the index and the hidden column. Until then, cross-instance change events for this table are lost; own-node reactivity is unaffected (writes still emit inline).`, V = 5 * 6e4, H = 3, U = (e, t) => {
+	let n = [...e.filter((e) => t - e < V), t];
+	return {
+		verdict: n.length >= H ? "persistent" : "backlog",
+		hits: n
+	};
+}, W = /* @__PURE__ */ new Set([
 	"writerows",
 	"updaterows",
 	"deleterows"
-]), z = /\b(alter|rename|drop|create)\s+(table|column)?/i, B = (e) => new Promise((t) => setTimeout(t, e)), V = async (e) => {
+]), G = /\b(alter|rename|drop|create)\s+(table|column)?/i, K = (e) => new Promise((t) => setTimeout(t, e)), q = async (e) => {
 	let t = l({ scope: `voltro:${e.variant}:cdc` }), n;
 	try {
 		n = (await import("@vlasky/zongji")).default;
 	} catch (t) {
 		throw Error(`changeStrategy='cdc' on ${e.variant} requires the '@vlasky/zongji' optional dependency. Install it (it ships as an optionalDependency of @voltro/sql-mysql) to enable binlog CDC.`, { cause: t });
 	}
-	let r = e.includeTables ? new Set(e.includeTables) : null, i = e.connection.database, a = e.startPosition?.filename ?? null, o = e.startPosition ?? null, s = (t, n) => x([n], t, e.variant)[0], c = null, u = !1, d = 0, f = Date.now(), p = !1, m = null, h = e.stallThresholdMs ?? 25e3, g = e.watchdogIntervalMs ?? 15e3, _ = () => {
-		f = Date.now();
-	}, v = (n) => {
-		_();
-		let l = n.getEventName();
-		if (l === "rotate" && n.binlogName) {
-			a = n.binlogName;
+	let r = new Set(e.undecodableTables ?? []), i = e.includeTables ? new Set(e.includeTables.filter((e) => !r.has(e))) : null, a = e.connection.database, o = e.startPosition?.filename ?? null, s = e.startPosition ?? null, c = (t, n) => w([n], t, e.variant)[0], u = null, d = !1, f = 0, p = Date.now(), m = !1, h = /* @__PURE__ */ new Map(), g = /* @__PURE__ */ new Set(), _ = null, v = e.stallThresholdMs ?? 25e3, y = e.watchdogIntervalMs ?? 15e3, b = () => {
+		p = Date.now();
+	}, x = (n) => {
+		b();
+		let r = n.getEventName();
+		if (r === "rotate" && n.binlogName) {
+			o = n.binlogName;
 			return;
 		}
-		if (l === "query" && n.query && z.test(n.query)) {
-			c && (c.tableMap = {});
+		if (r === "query" && n.query && G.test(n.query)) {
+			u && (u.tableMap = {});
 			return;
 		}
-		if (n.nextPosition && a && (o = {
-			filename: a,
+		if (n.nextPosition && o && (s = {
+			filename: o,
 			position: n.nextPosition
-		}, e.onPosition?.(o)), !R.has(l)) return;
-		let u = n.tableMap[n.tableId];
-		if (!u || u.parentSchema !== i) return;
-		let d = u.tableName;
-		if (!d.startsWith("_voltro_") && !(r && !r.has(d))) try {
-			if (l === "writerows") for (let t of n.rows) e.onChange({
+		}, e.onPosition?.(s)), !W.has(r)) return;
+		let l = n.tableMap[n.tableId];
+		if (!l || l.parentSchema !== a) return;
+		let d = l.tableName;
+		if (!d.startsWith("_voltro_") && !(i && !i.has(d))) try {
+			if (r === "writerows") for (let t of n.rows) e.onChange({
 				table: d,
 				op: "insert",
 				old: null,
-				new: s(d, t)
+				new: c(d, t)
 			});
-			else if (l === "deleterows") for (let t of n.rows) e.onChange({
+			else if (r === "deleterows") for (let t of n.rows) e.onChange({
 				table: d,
 				op: "delete",
-				old: s(d, t),
+				old: c(d, t),
 				new: null
 			});
 			else for (let t of n.rows) e.onChange({
 				table: d,
 				op: "update",
-				old: s(d, t.before),
-				new: s(d, t.after)
+				old: c(d, t.before),
+				new: c(d, t.after)
 			});
 		} catch (n) {
 			t.warn("cdc: failed to map a row event", {
 				table: d,
-				name: l
+				name: r
 			}, n), e.onError?.(n);
 		}
-	}, y = (t) => {
+	}, S = (t) => {
 		let n = {
 			serverId: e.serverId,
 			includeEvents: [
@@ -101,11 +110,11 @@ var M = (n) => e.layerConfig({
 				"query"
 			]
 		};
-		return e.includeTables && e.includeTables.length > 0 && (n.includeSchema = { [i]: [...e.includeTables] }), t ? (n.filename = t.filename, n.position = t.position) : n.startAtEnd = !0, n;
-	}, b = (e) => {
+		return e.includeTables && e.includeTables.length > 0 && (n.includeSchema = { [a]: e.includeTables.filter((e) => !r.has(e)) }), t ? (n.filename = t.filename, n.position = t.position) : n.startAtEnd = !0, n;
+	}, C = (e) => {
 		let t = e;
 		return t?.errno === 1236 || String(t?.code ?? "").includes("ER_MASTER_FATAL_ERROR_READING_BINLOG");
-	}, S = (r) => new Promise((i, a) => {
+	}, T = (r) => new Promise((i, a) => {
 		let o = new n({
 			host: e.connection.host,
 			port: e.connection.port,
@@ -114,10 +123,10 @@ var M = (n) => e.layerConfig({
 			enableKeepAlive: !0,
 			keepAliveInitialDelay: e.keepAliveInitialDelayMs ?? 1e4
 		});
-		c = o;
+		u = o;
 		let s = !1;
-		o.on("binlog", v), o.on("ready", () => {
-			_(), !s && (s = !0, d = 0, t.info("cdc: binlog reader attached", {
+		o.on("binlog", x), o.on("ready", () => {
+			b(), !s && (s = !0, f = 0, t.info("cdc: binlog reader attached", {
 				serverId: e.serverId,
 				from: r ?? "current-end"
 			}), i());
@@ -126,78 +135,82 @@ var M = (n) => e.layerConfig({
 				s = !0, a(e instanceof Error ? e : Error(String(e)));
 				return;
 			}
-			C("binlog reader error", e);
-		}), o.start(y(r));
-	}), C = async (n, r) => {
-		if (!(u || p)) {
-			p = !0, t.warn(`cdc: reconnecting — ${n}`, {}, r instanceof Error ? r : void 0), e.onError?.(r);
+			E("binlog reader error", e);
+		}), o.start(S(r));
+	}), E = async (n, i) => {
+		if (!(d || m)) {
+			m = !0, t.warn(`cdc: reconnecting — ${n}`, {}, i instanceof Error ? i : void 0), e.onError?.(i);
 			try {
-				let n = r;
-				for (; !u;) {
+				let n = i;
+				for (; !d;) {
 					try {
-						c?.stop();
+						u?.stop();
 					} catch {}
-					if (d++, await B(Math.min(3e4, 500 * 2 ** Math.min(d, 6))), u) return;
-					let r = o, i = b(n), s = !i && L(n);
-					(i || s) && (t.warn(s ? "cdc: un-replayable backlog event (schema moved past it) — jumping to current end + self-heal" : "cdc: binlog gap (purged/failover) — jumping to current end + self-heal"), r = e.resolveStartPosition ? await e.resolveStartPosition().catch(() => null) : null, a = r?.filename ?? null, e.onResync?.());
+					if (f++, await K(Math.min(3e4, 500 * 2 ** Math.min(f, 6))), d) return;
+					let i = s, a = C(n), c = !a && L(n), l = !1;
+					if (c) {
+						let e = R(n), i = e ?? "<unknown>", { verdict: a, hits: o } = U(h.get(i) ?? [], Date.now());
+						h.set(i, o), l = a === "persistent", l && !g.has(i) && (g.add(i), e !== null && r.add(e), t.error(B(i)));
+					}
+					(a || c) && (l || t.warn(c ? "cdc: un-replayable backlog event (schema moved past it) — jumping to current end + self-heal" : "cdc: binlog gap (purged/failover) — jumping to current end + self-heal"), i = e.resolveStartPosition ? await e.resolveStartPosition().catch(() => null) : null, o = i?.filename ?? null, l || e.onResync?.());
 					try {
-						await S(r), d = 0, _();
+						await T(i), f = 0, b();
 						return;
 					} catch (e) {
 						n = e;
 					}
 				}
 			} finally {
-				p = !1;
+				m = !1;
 			}
 		}
 	};
 	try {
-		await S(e.startPosition ?? null);
+		await T(e.startPosition ?? null);
 	} catch (n) {
-		if (b(n) && e.startPosition) {
+		if (C(n) && e.startPosition) {
 			t.warn("cdc: persisted offset purged — starting at current end + self-heal");
 			try {
-				c?.stop();
+				u?.stop();
 			} catch {}
 			let n = e.resolveStartPosition ? await e.resolveStartPosition().catch(() => null) : null;
-			a = n?.filename ?? null, e.onResync?.(), await B(500), await S(n);
+			o = n?.filename ?? null, e.onResync?.(), await K(500), await T(n);
 		} else throw n;
 	}
-	let w = async () => {
-		if (u || p || Date.now() - f < h) return;
+	let D = async () => {
+		if (d || m || Date.now() - p < v) return;
 		let n = null;
-		if (e.resolveStartPosition && (n = await e.resolveStartPosition().catch(() => null)), u || p) return;
-		let r = I({
-			msSinceProgress: Date.now() - f,
-			stallThresholdMs: h,
+		if (e.resolveStartPosition && (n = await e.resolveStartPosition().catch(() => null)), d || m) return;
+		let r = ae({
+			msSinceProgress: Date.now() - p,
+			stallThresholdMs: v,
 			primary: n,
-			reader: o
+			reader: s
 		});
 		if (r !== "reconnect") {
-			r === "idle-caught-up" && _();
+			r === "idle-caught-up" && b();
 			return;
 		}
 		t.warn("cdc: watchdog detected a stalled reader — forcing reconnect", {
-			reader: o,
+			reader: s,
 			primary: n,
-			stalledForMs: Date.now() - f
-		}), C("watchdog: stream stalled (no events while primary advanced)", /* @__PURE__ */ Error("cdc watchdog stall"));
+			stalledForMs: Date.now() - p
+		}), E("watchdog: stream stalled (no events while primary advanced)", /* @__PURE__ */ Error("cdc watchdog stall"));
 	};
-	return m = setInterval(() => {
-		w();
-	}, g), m.unref && m.unref(), {
+	return _ = setInterval(() => {
+		D();
+	}, y), _.unref && _.unref(), {
 		stop: async () => {
-			u = !0, m &&= (clearInterval(m), null);
+			d = !0, _ &&= (clearInterval(_), null);
 			try {
-				c?.stop();
+				u?.stop();
 			} catch (e) {
 				t.warn("cdc: error stopping binlog reader", {}, e);
 			}
 		},
-		currentPosition: () => o
+		currentPosition: () => s
 	};
-}, H = /* @__PURE__ */ new Set(["1213", "1205"]), U = (e) => {
+}, oe = /* @__PURE__ */ new Set(["1213", "1205"]), se = (e) => {
 	let t = e;
 	for (let e = 0; e < 5 && typeof t == "object" && t; e++) {
 		let e = t.errno;
@@ -206,31 +219,31 @@ var M = (n) => e.layerConfig({
 		if (typeof n == "string") return n;
 		t = t.cause;
 	}
-}, W = (e) => {
-	let t = U(e);
-	return t !== void 0 && H.has(t);
-}, G = (e) => W(e) ? "retry" : "noRetry", K = (e) => {
+}, J = (e) => {
+	let t = se(e);
+	return t !== void 0 && oe.has(t);
+}, Y = (e) => J(e) ? "retry" : "noRetry", X = (e) => {
 	if (e == null) return "null";
 	let t = typeof e;
 	if (t === "bigint") return `${e}n`;
 	if (t !== "object") return JSON.stringify(e);
 	if (e instanceof Date) return `"${e.toISOString()}"`;
-	if (Array.isArray(e)) return `[${e.map(K).join(",")}]`;
+	if (Array.isArray(e)) return `[${e.map(X).join(",")}]`;
 	let n = e;
-	return `{${Object.keys(n).sort().map((e) => `${JSON.stringify(e)}:${K(n[e])}`).join(",")}}`;
-}, q = (e) => {
-	let t = K(e), n = 2166136261;
+	return `{${Object.keys(n).sort().map((e) => `${JSON.stringify(e)}:${X(n[e])}`).join(",")}}`;
+}, ce = (e) => {
+	let t = X(e), n = 2166136261;
 	for (let e = 0; e < t.length; e++) n ^= t.charCodeAt(e), n = Math.imul(n, 16777619);
 	return (n >>> 0).toString(36);
-}, J = (e, t) => {
+}, le = (e, t) => {
 	let n = setTimeout(e, t);
 	typeof n.unref == "function" && n.unref();
-}, Y = class {
+}, ue = class {
 	variant;
 	ttlMs;
 	schedule;
 	seen = /* @__PURE__ */ new Map();
-	constructor(e, t = 6e4, n = J) {
+	constructor(e, t = 6e4, n = le) {
 		this.variant = e, this.ttlMs = t, this.schedule = n;
 	}
 	key(e) {
@@ -240,11 +253,11 @@ var M = (n) => e.layerConfig({
 		if (n == null) return null;
 		let r = t;
 		try {
-			r = x([t], e.table, this.variant)[0] ?? t;
+			r = w([t], e.table, this.variant)[0] ?? t;
 		} catch {
 			r = t;
 		}
-		return `${e.table} ${e.op} ${String(n)} ${q(r)}`;
+		return `${e.table} ${e.op} ${String(n)} ${ce(r)}`;
 	}
 	admit(e) {
 		let t = this.key(e);
@@ -259,12 +272,19 @@ var M = (n) => e.layerConfig({
 	get pending() {
 		return this.seen.size;
 	}
-}, X = async (e) => {
+}, de = /* @__PURE__ */ new Set([
+	1022,
+	1062,
+	1586
+]), Z = async (e) => {
 	let t = e.variant ?? "mysql", n = l({ scope: `voltro:${t}` }), a = e.changeStrategy ?? "inline", o = a;
 	a === "cdc" && !e.cdcConfig && (n.warn("changeStrategy='cdc' requires cdcConfig (serverId + connection); falling back to 'inline'."), o = "inline");
-	let s = e.tracerLayer ? r.mergeAll(e.sqlLayer, e.tracerLayer) : e.sqlLayer, c = i.make(s), d = new Z(await c.runPromise(u), c, t, o);
+	let s = e.tracerLayer ? r.mergeAll(e.sqlLayer, e.tracerLayer) : e.sqlLayer, c = i.make(s), d = new fe(await c.runPromise(u), c, t, o);
 	return o === "cdc" && e.cdcConfig && await d.startCdcConsumer(e.cdcConfig), d;
-}, Z = class e {
+}, Q = () => {
+	let e = C();
+	return e === void 0 ? (e) => e() : (t) => k(e, t);
+}, fe = class e {
 	sql;
 	runtime;
 	variant;
@@ -280,13 +300,13 @@ var M = (n) => e.layerConfig({
 	cdcStreamName = "default";
 	cdcGate;
 	constructor(e, t, n, r = "inline", i = null, a, o) {
-		this.sql = e, this.runtime = t, this.variant = n, this.changeStrategy = r, this.namespace = i, this.log = l({ scope: `voltro:${n}` }), this.emitter = a ?? new c(), E(this.emitter), this.cdcGate = o ?? new Y(n);
+		this.sql = e, this.runtime = t, this.variant = n, this.changeStrategy = r, this.namespace = i, this.log = l({ scope: `voltro:${n}` }), this.emitter = a ?? new c(), O(this.emitter), this.cdcGate = o ?? new ue(n);
 	}
 	withNamespace(t) {
 		return t === this.namespace ? this : new e(this.sql, this.runtime, this.variant, this.changeStrategy, t, this.emitter, this.cdcGate);
 	}
 	nsT(e) {
-		return T(this.namespace, e);
+		return ee(this.namespace, e);
 	}
 	get dialectId() {
 		return this.variant;
@@ -298,8 +318,8 @@ var M = (n) => e.layerConfig({
 		};
 	}
 	async executeQuery(e, t) {
-		let r = b(e, this.sql, this.namespace), i = t ? n.provideService(r, d, t) : r;
-		return x(await this.runtime.runPromise(i), e.table, this.variant);
+		let r = S(e, this.sql, this.namespace), i = t ? n.provideService(r, d, t) : r;
+		return w(await this.runtime.runPromise(i), e.table, this.variant);
 	}
 	get supportsInsertReturning() {
 		return this.variant === "mariadb";
@@ -311,10 +331,10 @@ var M = (n) => e.layerConfig({
 		return !1;
 	}
 	async executeInsert(e, t, r, i) {
-		t = A(e, t);
+		t = M(e, t);
 		let a = this.sql;
 		if (this.supportsInsertReturning) {
-			let o = a`INSERT INTO ${a(this.nsT(e))} ${a.insert(S(t, e))} RETURNING *`, s = r ? n.provideService(o, d, r) : o, c = (await this.runtime.runPromise(s))[0];
+			let o = a`INSERT INTO ${a(this.nsT(e))} ${a.insert(T(t, e))} RETURNING *`, s = r ? n.provideService(o, d, r) : o, c = (await this.runtime.runPromise(s))[0];
 			if (!c) throw Error(`MysqlStore.insert: no row returned for table '${e}'`);
 			return await this.routeEvent({
 				table: e,
@@ -323,7 +343,7 @@ var M = (n) => e.layerConfig({
 				new: c
 			}, i, r), c;
 		}
-		let o = S(t, e), s = t.id;
+		let o = T(t, e), s = t.id;
 		if (s === void 0) {
 			let t = await this.insertRecoverAutoId(e, o, r);
 			return await this.routeEvent({
@@ -357,7 +377,7 @@ var M = (n) => e.layerConfig({
 		if (e) return this.runtime.runPromise(t(e));
 		this.inflightTxns++;
 		try {
-			let e = n.suspend(() => this.sql.withTransaction(n.flatMap(n.serviceOption(d), (e) => a.isNone(e) ? n.fail(/* @__PURE__ */ Error("MysqlStore.insert: TransactionConnection missing.")) : t(e.value)))), i = s.exponential("10 millis").pipe(s.compose(s.recurs(3)), s.whileInput(W)), o = e.pipe(n.retry(i), n.withSpan("store.insert", { attributes: {
+			let e = n.suspend(() => this.sql.withTransaction(n.flatMap(n.serviceOption(d), (e) => a.isNone(e) ? n.fail(/* @__PURE__ */ Error("MysqlStore.insert: TransactionConnection missing.")) : t(e.value)))), i = s.exponential("10 millis").pipe(s.compose(s.recurs(3)), s.whileInput(J)), o = e.pipe(n.retry(i), n.withSpan("store.insert", { attributes: {
 				"db.system": this.variant,
 				"db.operation": r
 			} }));
@@ -367,8 +387,8 @@ var M = (n) => e.layerConfig({
 		}
 	}
 	async executeInsertMany(e, t, r, i) {
-		if (t = j(e, t), t.length === 0) return [];
-		let a = this.sql, o = t.map((t) => S(t, e));
+		if (t = N(e, t), t.length === 0) return [];
+		let a = this.sql, o = t.map((t) => T(t, e));
 		if (this.supportsInsertReturning) {
 			let t = a`INSERT INTO ${a(this.nsT(e))} ${a.insert(o)} RETURNING *`, s = r ? n.provideService(t, d, r) : t, c = await this.runtime.runPromise(s);
 			for (let t of c) await this.routeEvent({
@@ -427,7 +447,7 @@ var M = (n) => e.layerConfig({
 	async executeUpdate(e, t, r, i, a) {
 		let o = this.sql;
 		if (this.supportsUpdateReturning) {
-			let s = o`UPDATE ${o(this.nsT(e))} SET ${o.update(S(r, e))} WHERE ${o("id")} = ${t} RETURNING *`, c = i ? n.provideService(s, d, i) : s, l = (await this.runtime.runPromise(c))[0];
+			let s = o`UPDATE ${o(this.nsT(e))} SET ${o.update(T(r, e))} WHERE ${o("id")} = ${t} RETURNING *`, c = i ? n.provideService(s, d, i) : s, l = (await this.runtime.runPromise(c))[0];
 			return l ? (await this.routeEvent({
 				table: e,
 				op: "update",
@@ -435,7 +455,7 @@ var M = (n) => e.layerConfig({
 				new: l
 			}, a, i), l) : null;
 		}
-		let s = o`UPDATE ${o(this.nsT(e))} SET ${o.update(S(r, e))} WHERE ${o("id")} = ${t}`, c = i ? n.provideService(s, d, i) : s, l = await this.runtime.runPromise(c);
+		let s = o`UPDATE ${o(this.nsT(e))} SET ${o.update(T(r, e))} WHERE ${o("id")} = ${t}`, c = i ? n.provideService(s, d, i) : s, l = await this.runtime.runPromise(c);
 		if (l && typeof l.affectedRows == "number" && l.affectedRows === 0) return null;
 		let u = o`SELECT * FROM ${o(this.nsT(e))} WHERE ${o("id")} = ${t}`, f = i ? n.provideService(u, d, i) : u, p = (await this.runtime.runPromise(f))[0];
 		return p ? (await this.routeEvent({
@@ -467,21 +487,35 @@ var M = (n) => e.layerConfig({
 		}, i, r), !0;
 	}
 	async appendInTxn(e, t, r) {
-		let i = this.sql, a = i`INSERT INTO ${i(this.nsT(e))} ${i.insert(S(t, e))}`;
+		let i = this.sql, a = i`INSERT INTO ${i(this.nsT(e))} ${i.insert(T(t, e))}`;
 		await this.runtime.runPromise(r ? n.provideService(a, d, r) : a);
 	}
+	async maxInTxn(e, t, r, i) {
+		let a = this.sql, o = Object.entries(r).map(([e, t]) => a`${a(e)} = ${t}`), s = a`SELECT MAX(${a(t)}) AS ${a("m")} FROM ${a(this.nsT(e))} WHERE ${a.and(o)}`, c = (await this.runtime.runPromise(i ? n.provideService(s, d, i) : s))[0]?.m;
+		return c == null ? null : Number(c);
+	}
 	async routeEvent(e, t, n = null) {
 		if (e = {
 			...g(),
 			...e
-		}, D(e.table) && await k((e, t) => this.appendInTxn(e, t, n), {
+		}, te(e.table) && await A({
+			append: (e, t) => this.appendInTxn(e, t, n),
+			maxOf: (e, t, r) => this.maxInTxn(e, t, r, n)
+		}, {
 			table: e.table,
 			op: e.op,
 			next: e.new,
 			prev: e.old,
 			traceId: e.traceId,
 			subjectId: e.subjectId
-		}), t !== null) {
+		}), this.changeStrategy === "cdc") {
+			let t = (e.op === "delete" ? e.old : e.new)?.id;
+			t != null && ne(_(e.table, e.op, t), {
+				...e.traceId === void 0 ? {} : { traceId: e.traceId },
+				...e.subjectId === void 0 ? {} : { subjectId: e.subjectId }
+			});
+		}
+		if (t !== null) {
 			t.push(e);
 			return;
 		}
@@ -507,10 +541,10 @@ var M = (n) => e.layerConfig({
 			}
 			return await this.executeUpdate(e, a.id, o, r, i) ?? a;
 		}
-		return this.executeInsert(e, t, r, i);
+		return Q()(() => this.executeInsert(e, t, r, i));
 	}
 	async executeMariadbUpsert(e, t, r, i, a) {
-		let o = this.sql, s = S(t, e), c = Object.keys(s).filter((e) => s[e] !== void 0), l = r.update === void 0 ? c.filter((e) => e !== "id" && !r.conflictColumns.includes(e)) : r.update, u = l.length > 0 ? o.csv(l.map((e) => o`${o(e)} = VALUES(${o(e)})`)) : o`${o(r.conflictColumns[0])} = VALUES(${o(r.conflictColumns[0])})`, f = o`INSERT INTO ${o(this.nsT(e))} ${o.insert(s)} ON DUPLICATE KEY UPDATE ${u} RETURNING *`, p = i ? n.provideService(f, d, i) : f, m = (await this.runtime.runPromise(p))[0];
+		let o = this.sql, s = T(t, e), c = Object.keys(s).filter((e) => s[e] !== void 0), l = r.update === void 0 ? c.filter((e) => e !== "id" && !r.conflictColumns.includes(e)) : r.update, u = l.length > 0 ? o.csv(l.map((e) => o`${o(e)} = VALUES(${o(e)})`)) : o`${o(r.conflictColumns[0])} = VALUES(${o(r.conflictColumns[0])})`, f = o`INSERT INTO ${o(this.nsT(e))} ${o.insert(s)} ON DUPLICATE KEY UPDATE ${u} RETURNING *`, p = i ? n.provideService(f, d, i) : f, m = (await this.runtime.runPromise(p))[0];
 		if (!m) throw Error(`MysqlStore.upsert: no row returned for table '${e}'`);
 		let h = t.id !== void 0 && t.id === m.id ? "insert" : "update";
 		return await this.routeEvent({
@@ -521,19 +555,43 @@ var M = (n) => e.layerConfig({
 		}, a, i), m;
 	}
 	async executeInsertIgnore(e, t, r, i, a) {
-		if (t = A(e, t), this.variant === "mariadb") {
-			let o = this.sql, s = o`INSERT IGNORE INTO ${o(this.nsT(e))} ${o.insert(S(t, e))} RETURNING *`, c = i ? n.provideService(s, d, i) : s, l = (await this.runtime.runPromise(c))[0];
+		if (t = M(e, t), this.variant === "mariadb") {
+			let o = this.sql, s = o`INSERT IGNORE INTO ${o(this.nsT(e))} ${o.insert(T(t, e))} RETURNING *`, c = i ? n.provideService(s, d, i) : s, l = (await this.runtime.runPromise(c))[0];
 			if (l) return await this.routeEvent({
 				table: e,
 				op: "insert",
 				old: null,
 				new: l
 			}, a, i), l;
-			let u = await this.findByConflict(e, t, r.conflictColumns, i);
-			if (!u) throw Error(`MysqlStore.insertIgnore: the insert was skipped as a conflict, but no existing row matches conflictColumns [${r.conflictColumns.join(", ")}] on '${e}'. A DIFFERENT unique constraint fired — a second unique index, or the primary key when you named something else. insertIgnore models ONE conflict target: name the columns of the constraint that actually collides, or handle the unique violation yourself.`);
-			return u;
+			let u = await this.readWarnings(i), f = u.find((e) => !de.has(e.code));
+			if (f !== void 0) throw Error(`MysqlStore.insertIgnore: the insert into '${e}' was REJECTED, not skipped as a conflict. INSERT IGNORE downgrades every error to a warning, and the warning was: [${f.code}] ${f.message}. Nothing was written and nothing conflicted — fix the cause above.`);
+			let p = await this.findByConflict(e, t, r.conflictColumns, i);
+			if (p) return p;
+			let m = u[0];
+			throw Error(`MysqlStore.insertIgnore: the insert was skipped as a conflict, but no existing row matches conflictColumns [${r.conflictColumns.join(", ")}] on '${e}'. ` + (m === void 0 ? "The warning could not be read on this connection, so the constraint that fired is unknown — it may be a second unique index, or the primary key under another name. " : `The constraint that actually fired: [${m.code}] ${m.message}. `) + "insertIgnore models ONE conflict target: name the columns of the constraint that actually collides, or handle the violation yourself.");
+		}
+		return await this.findByConflict(e, t, r.conflictColumns, i) || Q()(() => this.executeInsert(e, t, i, a));
+	}
+	async findUndecodableCdcTables(e) {
+		if (this.variant !== "mariadb") return [];
+		try {
+			let t = (await this.runtime.runPromise(this.sql.unsafe(z))).map((e) => String(e.tableName ?? e.TABLE_NAME ?? "")).filter((e) => e !== "");
+			return e === void 0 ? t : t.filter((t) => e.includes(t));
+		} catch (e) {
+			return this.log.debug(`cdc: could not probe for undecodable tables — ${e?.message ?? String(e)}`), [];
+		}
+	}
+	async readWarnings(e) {
+		if (e === null) return [];
+		try {
+			let t = this.sql`SHOW WARNINGS`;
+			return (await this.runtime.runPromise(n.provideService(t, d, e))).map((e) => ({
+				code: Number(e.Code ?? e.code ?? 0),
+				message: String(e.Message ?? e.message ?? "")
+			}));
+		} catch {
+			return [];
 		}
-		return await this.findByConflict(e, t, r.conflictColumns, i) || this.executeInsert(e, t, i, a);
 	}
 	async findByConflict(e, t, r, i) {
 		if (r.length === 0) return;
@@ -544,12 +602,12 @@ var M = (n) => e.layerConfig({
 		return this.runWithEager(e, null);
 	}
 	raw(e, t) {
-		let n = y(e, this.sql);
+		let n = x(e, this.sql);
 		return this.runtime.runPromise(n);
 	}
 	async runWithEager(e, t) {
-		if (!C(e)) return this.executeQuery(e, t);
-		let r = this.variant === "mariadb" ? "mariadb" : "mysql", i = this.namespace === null ? _(e, this.sql, r) : null;
+		if (!E(e)) return this.executeQuery(e, t);
+		let r = this.variant === "mariadb" ? "mariadb" : "mysql", i = this.namespace === null ? y(e, this.sql, r) : null;
 		if (i !== null) try {
 			let e = t ? n.provideService(i.fragment, d, t) : i.fragment, r = await this.runtime.runPromise(e);
 			return i.decode(r);
@@ -557,35 +615,35 @@ var M = (n) => e.layerConfig({
 			if (e instanceof p) throw e;
 			this.log.warn(`${this.variant} JSON-agg eager-load failed; falling back to walker`, { err: e });
 		}
-		return h(await this.executeQuery(e, t), e.eager, e.sourceTable ?? O(e.table), (e) => this.executeQuery(e, t));
+		return h(await this.executeQuery(e, t), e.eager, e.sourceTable ?? re(e.table), (e) => this.executeQuery(e, t));
 	}
 	getInternalRunWithEager() {
 		return this.runWithEager.bind(this);
 	}
 	insert(e, t) {
-		return this.executeInsert(e, t, null, null);
+		return Q()(() => this.executeInsert(e, t, null, null));
 	}
 	insertMany(e, t) {
-		return this.executeInsertMany(e, t, null, null);
+		return Q()(() => this.executeInsertMany(e, t, null, null));
 	}
 	patchJson(e, t, n, r) {
-		return this.executePatchJson(e, t, n, r, null, null);
+		return Q()(() => this.executePatchJson(e, t, n, r, null, null));
 	}
 	upsert(e, t, n) {
-		return this.executeUpsert(e, t, n, null, null);
+		return Q()(() => this.executeUpsert(e, t, n, null, null));
 	}
 	insertIgnore(e, t, n) {
-		return this.executeInsertIgnore(e, t, n, null, null);
+		return Q()(() => this.executeInsertIgnore(e, t, n, null, null));
 	}
 	update(e, t, n) {
-		return this.executeUpdate(e, t, n, null, null);
+		return Q()(() => this.executeUpdate(e, t, n, null, null));
 	}
 	delete(e, t) {
-		return this.executeDelete(e, t, null, null);
+		return Q()(() => this.executeDelete(e, t, null, null));
 	}
 	async updateMany(e, t, r) {
 		if (this.supportsUpdateReturning) {
-			let n = this.sql, i = v(r.where, n, this.namespace), a = n`UPDATE ${n(this.nsT(e))} SET ${n.update(S(t, e))} WHERE ${i} RETURNING *`, o = await this.runtime.runPromise(a);
+			let n = this.sql, i = b(r.where, n, this.namespace), a = n`UPDATE ${n(this.nsT(e))} SET ${n.update(T(t, e))} WHERE ${i} RETURNING *`, o = await this.runtime.runPromise(a);
 			for (let t of o) await this.routeEvent({
 				table: e,
 				op: "update",
@@ -594,23 +652,23 @@ var M = (n) => e.layerConfig({
 			}, null, null);
 			return o.length;
 		}
-		let i = this.sql, o = v(r.where, i, this.namespace);
+		let i = this.sql, o = b(r.where, i, this.namespace);
 		this.inflightTxns++;
 		try {
 			let r = n.suspend(() => this.sql.withTransaction(n.flatMap(n.serviceOption(d), (r) => {
 				if (a.isNone(r)) return n.fail(/* @__PURE__ */ Error("MysqlStore.updateMany: TransactionConnection missing."));
-				let s = r.value, c = i`SELECT id FROM ${i(this.nsT(e))} WHERE ${o} FOR UPDATE`, l = i`UPDATE ${i(this.nsT(e))} SET ${i.update(S(t, e))} WHERE ${o}`;
+				let s = r.value, c = i`SELECT id FROM ${i(this.nsT(e))} WHERE ${o} FOR UPDATE`, l = i`UPDATE ${i(this.nsT(e))} SET ${i.update(T(t, e))} WHERE ${o}`;
 				return n.flatMap(n.provideService(c, d, s), (t) => {
 					if (t.length === 0) return n.succeed([]);
 					let r = t.map((e) => e.id), a = i`SELECT * FROM ${i(this.nsT(e))} WHERE ${i("id")} IN ${i.in(r)}`;
 					return n.flatMap(n.provideService(l, d, s), () => n.provideService(a, d, s));
 				});
-			}))), c = s.exponential("10 millis").pipe(s.compose(s.recurs(3)), s.whileInput(W)), l = r.pipe(n.retry(c), n.withSpan("store.updateMany", { attributes: {
+			}))), c = s.exponential("10 millis").pipe(s.compose(s.recurs(3)), s.whileInput(J)), l = r.pipe(n.retry(c), n.withSpan("store.updateMany", { attributes: {
 				"db.system": this.variant,
 				"db.operation": "update"
 			} })), u = await this.runtime.runPromise(l);
 			if (u.length === 0) return 0;
-			let f = x(u, e, this.variant);
+			let f = w(u, e, this.variant);
 			for (let t of f) await this.routeEvent({
 				table: e,
 				op: "update",
@@ -623,9 +681,9 @@ var M = (n) => e.layerConfig({
 		}
 	}
 	async deleteMany(e, t) {
-		let r = this.sql, i = v(t.where, r, this.namespace);
+		let r = this.sql, i = b(t.where, r, this.namespace);
 		if (this.supportsDeleteReturning) {
-			let t = r`DELETE FROM ${r(this.nsT(e))} WHERE ${i} RETURNING *`, n = x(await this.runtime.runPromise(t), e, this.variant);
+			let t = r`DELETE FROM ${r(this.nsT(e))} WHERE ${i} RETURNING *`, n = w(await this.runtime.runPromise(t), e, this.variant);
 			for (let t of n) await this.routeEvent({
 				table: e,
 				op: "delete",
@@ -640,12 +698,12 @@ var M = (n) => e.layerConfig({
 				if (a.isNone(t)) return n.fail(/* @__PURE__ */ Error("MysqlStore.deleteMany: TransactionConnection missing."));
 				let o = t.value, s = r`SELECT * FROM ${r(this.nsT(e))} WHERE ${i} FOR UPDATE`, c = r`DELETE FROM ${r(this.nsT(e))} WHERE ${i}`;
 				return n.flatMap(n.provideService(s, d, o), (e) => e.length === 0 ? n.succeed(e) : n.as(n.provideService(c, d, o), e));
-			}))), o = s.exponential("10 millis").pipe(s.compose(s.recurs(3)), s.whileInput(W)), c = t.pipe(n.retry(o), n.withSpan("store.deleteMany", { attributes: {
+			}))), o = s.exponential("10 millis").pipe(s.compose(s.recurs(3)), s.whileInput(J)), c = t.pipe(n.retry(o), n.withSpan("store.deleteMany", { attributes: {
 				"db.system": this.variant,
 				"db.operation": "delete"
 			} })), l = await this.runtime.runPromise(c);
 			if (l.length === 0) return 0;
-			let u = x(l, e, this.variant);
+			let u = w(l, e, this.variant);
 			for (let t of u) await this.routeEvent({
 				table: e,
 				op: "delete",
@@ -658,17 +716,19 @@ var M = (n) => e.layerConfig({
 		}
 	}
 	emitChange(e) {
-		w(e.table) && (this.changeStrategy === "cdc" && !this.cdcGate.admit(e) || this.emitter.emit("change", e));
+		D(e.table) && (this.changeStrategy === "cdc" && !this.cdcGate.admit(e) || this.emitter.emit("change", e));
 	}
 	async startCdcConsumer(e) {
 		if (this.cdcHandle) return;
 		await this.assertBinlogConfig(), this.cdcReplicaId = e.replicaId;
-		let t = await this.readCdcOffset(e.replicaId) ?? await this.resolveBinlogEnd();
-		this.cdcHandle = await V({
+		let t = await this.readCdcOffset(e.replicaId) ?? await this.resolveBinlogEnd(), n = await this.findUndecodableCdcTables(e.includeTables);
+		for (let e of n) this.log.error(B(e));
+		this.cdcHandle = await q({
 			connection: e.connection,
 			serverId: e.serverId,
 			variant: this.variant,
 			...e.includeTables ? { includeTables: e.includeTables } : {},
+			...n.length > 0 ? { undecodableTables: n } : {},
 			...e.watchdogIntervalMs === void 0 ? {} : { watchdogIntervalMs: e.watchdogIntervalMs },
 			...e.stallThresholdMs === void 0 ? {} : { stallThresholdMs: e.stallThresholdMs },
 			...e.keepAliveInitialDelayMs === void 0 ? {} : { keepAliveInitialDelayMs: e.keepAliveInitialDelayMs },
@@ -780,26 +840,26 @@ var M = (n) => e.layerConfig({
 	}
 	async transactional(e) {
 		this.inflightTxns++;
-		let t = 0, r = n.suspend(() => {
-			let r = ++t;
-			return this.sql.withTransaction(n.flatMap(n.serviceOption(d), (t) => {
-				if (a.isNone(t)) return n.fail(/* @__PURE__ */ Error("MysqlStore.transactional: TransactionConnection missing."));
-				let i = new Q(this, t.value);
+		let t = Q(), r = 0, i = n.suspend(() => {
+			let i = ++r;
+			return this.sql.withTransaction(n.flatMap(n.serviceOption(d), (r) => {
+				if (a.isNone(r)) return n.fail(/* @__PURE__ */ Error("MysqlStore.transactional: TransactionConnection missing."));
+				let o = new pe(this, r.value);
 				return n.tryPromise({
-					try: () => e(i).then((e) => ({
+					try: () => t(() => e(o)).then((e) => ({
 						result: e,
-						view: i,
-						attempt: r
+						view: o,
+						attempt: i
 					})),
 					catch: (e) => e
 				});
 			}));
-		}), i = s.exponential("10 millis").pipe(s.compose(s.recurs(3)), s.whileInput(W)), o = r.pipe(n.retry(i), n.withSpan("store.transactional", { attributes: {
+		}), o = s.exponential("10 millis").pipe(s.compose(s.recurs(3)), s.whileInput(J)), c = i.pipe(n.retry(o), n.withSpan("store.transactional", { attributes: {
 			"db.system": this.variant,
 			"db.operation": "transaction"
 		} }));
 		try {
-			let e = await this.runtime.runPromise(o);
+			let e = j(await this.runtime.runPromiseExit(c));
 			return e.view.commitEvents(), e.result;
 		} finally {
 			this.inflightTxns--;
@@ -814,7 +874,10 @@ var M = (n) => e.layerConfig({
 		return this.changeStrategy === "cdc" ? "fleet" : "local";
 	}
 	injectExternalChange(e) {
-		this.changeStrategy === "cdc" && !this.cdcGate.admit(e) || w(e.table) && this.emitter.emit("change", {
+		if (this.changeStrategy === "cdc" && !this.cdcGate.admit(e) || !D(e.table)) return;
+		let t = (e.op === "delete" ? e.old : e.new)?.id, n = t == null ? void 0 : v(_(e.table, e.op, t));
+		this.emitter.emit("change", {
+			...n,
 			...e,
 			origin: "injected"
 		});
@@ -840,7 +903,7 @@ var M = (n) => e.layerConfig({
 	async ping() {
 		await this.runtime.runPromise(this.sql`SELECT 1`);
 	}
-}, Q = class {
+}, pe = class {
 	parent;
 	txn;
 	events = [];
@@ -912,7 +975,7 @@ var M = (n) => e.layerConfig({
 			this.events.length = 0;
 		}
 	}
-}, $ = (e) => e.__mysqlReplicationFriend ?? null, ee = () => ({
+}, $ = (e) => e.__mysqlReplicationFriend ?? null, me = () => ({
 	async capturePrimaryPosition(e) {
 		let t = $(e);
 		if (t === null) throw Error("mysqlReplicationAdapter: primary is not a MysqlStore (missing __mysqlReplicationFriend).");
@@ -932,24 +995,24 @@ var M = (n) => e.layerConfig({
 	compare(e, t) {
 		return "behind";
 	}
-}), te = {
+}), he = {
 	id: "mysql",
-	makeSqlLayer: (e) => P(e),
-	makeStore: (e) => X({
+	makeSqlLayer: (e) => I(e),
+	makeStore: (e) => Z({
 		...e,
 		variant: "mysql"
 	}),
 	compileContains: (e, t, n) => n`${e} LIKE ${`%${t.replace(/[\\%_]/g, (e) => `\\${e}`)}%`} ESCAPE '\\'`,
-	retryFilter: G
-}, ne = {
+	retryFilter: Y
+}, ge = {
 	id: "mariadb",
-	makeSqlLayer: (e) => P(e),
-	makeStore: (e) => X({
+	makeSqlLayer: (e) => I(e),
+	makeStore: (e) => Z({
 		...e,
 		variant: "mariadb"
 	}),
 	compileContains: (e, t, n) => n`${e} LIKE ${`%${t.replace(/[\\%_]/g, (e) => `\\${e}`)}%`} ESCAPE '\\'`,
-	retryFilter: G
+	retryFilter: Y
 };
 //#endregion
-export { f as CDC_OFFSETS_TABLE, e as MysqlClient, m as _voltroCdcOffsetsTable, N as connectionFromConfig, M as makeMysqlSqlLayer, P as makeMysqlSqlLayerFromConfig, X as makeMysqlStore, ne as mariadbDialect, te as mysqlDialect, ee as mysqlReplicationAdapter, G as mysqlRetryFilter, V as startBinlogCdc };
+export { f as CDC_OFFSETS_TABLE, e as MysqlClient, m as _voltroCdcOffsetsTable, F as connectionFromConfig, P as makeMysqlSqlLayer, I as makeMysqlSqlLayerFromConfig, Z as makeMysqlStore, ge as mariadbDialect, he as mysqlDialect, me as mysqlReplicationAdapter, Y as mysqlRetryFilter, q as startBinlogCdc };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@voltro/sql-mysql",
-  "version": "0.19.0",
+  "version": "0.20.1",
   "description": "MySQL/MariaDB dialect adapter for Voltro's cross-dialect DataStore (mariadb binlog CDC; mysql inline reactivity).",
   "keywords": [
     "voltro",
@@ -34,8 +34,8 @@
   "dependencies": {
     "@effect/sql": "^0.51.1",
     "@effect/sql-mysql2": "^0.52.0",
-    "@voltro/database": "0.19.0",
-    "@voltro/logger": "0.19.0"
+    "@voltro/database": "0.20.1",
+    "@voltro/logger": "0.20.1"
   },
   "optionalDependencies": {
     "@vlasky/zongji": "^0.9.0"