orez 0.5.11 → 0.5.13

package/dist/replication/handler.js

@@ -65,55 +65,65 @@ function lsnFloorFromTime() {
     const timeLsn = BigInt(Date.now()) << LSN_TIME_SHIFT;
     return timeLsn > MIN_LSN ? timeLsn : MIN_LSN;
 }
-// current lsn counter. seed from wall time so a restarted browser proxy never
-// emits stream lsns behind zero-cache's persisted initial-sync watermark.
-// use a large stride because zero-cache's initial backfill can reserve
-// watermarks after slot creation while app writes are already queued; the next
-// streamed transaction still has to land beyond that warmup range.
-let currentLsn = lsnFloorFromTime();
-// persistent watermark across handler restarts so new handlers
-// don't replay already-streamed changes
-let lastStreamedWatermark = 0;
-// confirmed-flush feedback from the consumer (standby status updates).
-// the poll loop purges _zero_changes for confirmed batches; until then the
-// table is the durable record so a consumer death mid-store re-streams the
-// transaction instead of silently losing it.
-let pendingConfirmLsn = 0n;
-let processedConfirmLsn = 0n;
-// performance.now() of the last standby status update received from the
-// consumer (0 = never). liveness signal for the stale-unconfirmed reconnect.
-let lastFeedbackAtPerf = 0;
-// ── replication pipeline health gauges ──────────────────────────────────────
-// plain module state read by the supervisor's bankruptcy monitor
-// (isReplicationBankrupt in recovery.ts). deliberately no db access: the
-// monitor must be able to see a wedged pipeline without queueing on the very
-// mutex that is wedged. timestamps are Date.now() ms; 0 = never.
-let lastWriteSignalAt = 0; // a proxy write signaled new changes
-let lastConfirmProgressAt = 0; // consumer durably confirmed (or a fresh slot reset the log)
-let lastStreamActivityAt = 0; // a replication stream started or streamed a batch
-export function getReplicationHealth() {
-    return { lastWriteSignalAt, lastConfirmProgressAt, lastStreamActivityAt };
+const DEFAULT_REPLICATION_INSTANCE = '__orez_default_replication__';
+const replicationStates = new Map();
+function newReplicationState(instanceId, instanceLog) {
+    return {
+        cachedColumnTypeOids: null,
+        cachedColumns: new Map(),
+        cachedExcludedColumns: null,
+        cachedTableKeyColumns: null,
+        currentLsn: lsnFloorFromTime(),
+        instanceId,
+        lastConfirmProgressAt: 0,
+        lastFeedbackAtPerf: 0,
+        lastStreamActivityAt: 0,
+        lastStreamedWatermark: 0,
+        lastWriteSignalAt: 0,
+        log: instanceLog,
+        pendingConfirmLsn: 0n,
+        processedConfirmLsn: 0n,
+        replicationWakeup: null,
+    };
+}
+function replicationState(instanceId) {
+    const key = instanceId ?? DEFAULT_REPLICATION_INSTANCE;
+    let state = replicationStates.get(key);
+    if (!state) {
+        state = newReplicationState(instanceId);
+        replicationStates.set(key, state);
+    }
+    return state;
+}
+export function getReplicationHealth(instanceId) {
+    const state = replicationState(instanceId);
+    return {
+        lastWriteSignalAt: state.lastWriteSignalAt,
+        lastConfirmProgressAt: state.lastConfirmProgressAt,
+        lastStreamActivityAt: state.lastStreamActivityAt,
+    };
 }
 /** record durable consumer progress (confirm purge, fresh slot, or a
  *  completed zero reset — all mean the backlog is not stuck). */
-export function markReplicationProgress() {
-    lastConfirmProgressAt = Date.now();
+export function markReplicationProgress(instanceId) {
+    replicationState(instanceId).lastConfirmProgressAt = Date.now();
 }
 /**
  * note a confirmed-flush LSN from the consumer's standby status update and
  * wake the replication loop so it purges the confirmed batches.
  */
-export function noteConfirmedFlushLsn(lsn) {
+export function noteConfirmedFlushLsn(lsn, instanceId) {
+    const state = replicationState(instanceId);
     // any standby status update — even one that doesn't advance the LSN — is
     // proof the consumer is alive on the wire. the stale-unconfirmed reconnect
     // must not kill a stream whose consumer is still chewing a large backlog
     // (2026-07 CF incident: the 60s reconnect kept beating the consumer's first
     // ack, so a 10k-row backlog re-streamed on every cycle, forever).
-    lastFeedbackAtPerf = performance.now();
-    if (lsn <= pendingConfirmLsn)
+    state.lastFeedbackAtPerf = performance.now();
+    if (lsn <= state.pendingConfirmLsn)
         return;
-    pendingConfirmLsn = lsn;
-    _replicationWakeup?.();
+    state.pendingConfirmLsn = lsn;
+    state.replicationWakeup?.();
 }
 /**
  * incremental parser for client→server traffic on a replication connection.
@@ -157,14 +167,14 @@ export function createReplicationFeedbackParser(onFlushedLsn = noteConfirmedFlus
     };
 }
 // direct wakeup from proxy — bypasses pg_notify for instant replication
-let _replicationWakeup = null;
 /** signal the replication handler that changes may be available.
  *  called by the proxy after executing writes on the postgres instance. */
-export function signalReplicationChange() {
-    lastWriteSignalAt = Date.now();
-    _replicationWakeup?.();
-    const globalWakeup = globalThis.__orez_signal_replication;
-    if (typeof globalWakeup === 'function' && globalWakeup !== _replicationWakeup) {
+export function signalReplicationChange(instanceId) {
+    const state = replicationState(instanceId);
+    state.lastWriteSignalAt = Date.now();
+    state.replicationWakeup?.();
+    const globalWakeup = instanceId === undefined ? globalThis.__orez_signal_replication : undefined;
+    if (typeof globalWakeup === 'function' && globalWakeup !== state.replicationWakeup) {
         globalWakeup();
     }
 }
@@ -172,37 +182,30 @@ export function signalReplicationChange() {
 // zero-cache reconnects the replication stream after initial sync, and if setup
 // takes too long (holding the mutex, blocking proxy queries), zero-cache's
 // queries timeout and it kills the connection.
-let cachedTableKeyColumns = null;
-let cachedExcludedColumns = null;
-let cachedColumnTypeOids = null;
-function unconfirmedReconnectMs() {
-    const raw = process.env.OREZ_REPLICATION_UNCONFIRMED_RECONNECT_MS;
+function unconfirmedReconnectMs(state) {
+    const raw = state.unconfirmedReconnectMs ?? process.env.OREZ_REPLICATION_UNCONFIRMED_RECONNECT_MS;
     if (!raw)
         return DEFAULT_UNCONFIRMED_RECONNECT_MS;
     const parsed = Number(raw);
     return Number.isFinite(parsed) && parsed > 0 ? parsed : DEFAULT_UNCONFIRMED_RECONNECT_MS;
 }
 /** reset module state (for tests) */
-export function resetReplicationState() {
-    currentLsn = lsnFloorFromTime();
-    lastStreamedWatermark = 0;
-    pendingConfirmLsn = 0n;
-    processedConfirmLsn = 0n;
-    lastFeedbackAtPerf = 0;
-    lastWriteSignalAt = 0;
-    lastConfirmProgressAt = 0;
-    lastStreamActivityAt = 0;
-    cachedTableKeyColumns = null;
-    cachedExcludedColumns = null;
-    cachedColumnTypeOids = null;
-    cachedColumns.clear();
+export function resetReplicationState(instanceId, env, instanceLog) {
+    const state = newReplicationState(instanceId, instanceLog);
+    const runtimeEnv = env ?? (instanceId === undefined ? process.env : undefined);
+    state.publications = runtimeEnv?.ZERO_APP_PUBLICATIONS?.trim();
+    state.unconfirmedReconnectMs = runtimeEnv?.OREZ_REPLICATION_UNCONFIRMED_RECONNECT_MS;
+    replicationStates.set(instanceId ?? DEFAULT_REPLICATION_INSTANCE, state);
+}
+export function deleteReplicationState(instanceId) {
+    replicationStates.delete(instanceId);
 }
-function nextLsn() {
+function nextLsn(state) {
     const floor = lsnFloorFromTime();
-    if (currentLsn < floor)
-        currentLsn = floor;
-    currentLsn += LSN_INCREMENT;
-    return currentLsn;
+    if (state.currentLsn < floor)
+        state.currentLsn = floor;
+    state.currentLsn += LSN_INCREMENT;
+    return state.currentLsn;
 }
 function lsnToString(lsn) {
     const high = Number(lsn >> 32n);
@@ -356,17 +359,18 @@ function buildErrorResponse(message) {
  * handle a replication query. returns response bytes or null if not handled.
  * async because slot operations need to write to pglite.
  */
-export async function handleReplicationQuery(query, db) {
+export async function handleReplicationQuery(query, db, instanceId) {
+    const state = replicationState(instanceId);
     const trimmed = query.trim().replace(/;$/, '').trim();
     const upper = trimmed.toUpperCase();
     if (upper === 'IDENTIFY_SYSTEM') {
-        const lsn = lsnToString(currentLsn);
+        const lsn = lsnToString(state.currentLsn);
         return buildSimpleResponse(['systemid', 'timeline', 'xlogpos', 'dbname'], ['1234567890', '1', lsn, 'postgres']);
     }
     if (upper.startsWith('CREATE_REPLICATION_SLOT')) {
         const match = trimmed.match(/CREATE_REPLICATION_SLOT\s+(?:"([^"]+)"|'([^']+)'|(\S+))/i);
         const slotName = match?.[1] || match?.[2] || match?.[3] || 'zero_slot';
-        const lsn = lsnToString(nextLsn());
+        const lsn = lsnToString(nextLsn(state));
         const snapshotName = `00000003-00000001-1`;
         // set watermark to current DB state so replication only delivers changes
         // that happen AFTER this point. this mirrors real postgres behavior where
@@ -375,8 +379,8 @@ export async function handleReplicationQuery(query, db) {
         // on reconnect this is effectively a no-op since the watermark is already
         // at or past the current DB state.
         const currentWm = await getCurrentWatermark(db);
-        if (currentWm > lastStreamedWatermark) {
-            lastStreamedWatermark = currentWm;
+        if (currentWm > state.lastStreamedWatermark) {
+            state.lastStreamedWatermark = currentWm;
         }
         // a new slot means the consumer re-initializes from a fresh snapshot:
         // rows up to the snapshot point are covered by the initial copy, and any
@@ -384,7 +388,7 @@ export async function handleReplicationQuery(query, db) {
         await purgeConsumedChanges(db, currentWm);
         await clearStreamedBatches(db);
         // the log was just cut to the snapshot point — the backlog is not stuck.
-        markReplicationProgress();
+        markReplicationProgress(instanceId);
         // persist slot so pg_replication_slots queries find it
         await db.query(`INSERT INTO _orez._zero_replication_slots (slot_name, restart_lsn, confirmed_flush_lsn)
        VALUES ($1, $2, $2)
@@ -425,9 +429,10 @@ export async function handleReplicationQuery(query, db) {
  * start streaming replication changes to the client.
  * this runs indefinitely until the connection is closed.
  */
-export async function handleStartReplication(query, writer, db, mutex) {
+export async function handleStartReplication(query, writer, db, mutex, instanceId) {
+    const state = replicationState(instanceId);
     log.debug.repl('entering streaming mode');
-    lastStreamActivityAt = Date.now();
+    state.lastStreamActivityAt = Date.now();
     // honor zero-cache's resume LSN. without this, after a page reload the
     // in-memory currentLsn / lastStreamedWatermark are reset to defaults but
     // changeLog persists with prior LSNs — re-streaming from BIGINT 0 makes
@@ -438,9 +443,9 @@ export async function handleStartReplication(query, writer, db, mutex) {
     // lastStreamedWatermark to the current sequence value we skip already-
     // streamed _zero_changes rows.
     const clientStartLsn = extractStartLsn(query);
-    if (clientStartLsn !== null && clientStartLsn > currentLsn) {
-        log.debug.repl(`advancing currentLsn ${lsnToString(currentLsn)} → ${lsnToString(clientStartLsn)} from client START_REPLICATION`);
-        currentLsn = clientStartLsn;
+    if (clientStartLsn !== null && clientStartLsn > state.currentLsn) {
+        log.debug.repl(`advancing currentLsn ${lsnToString(state.currentLsn)} → ${lsnToString(clientStartLsn)} from client START_REPLICATION`);
+        state.currentLsn = clientStartLsn;
     }
     // send CopyBothResponse to enter streaming mode
     const copyBoth = new Uint8Array(1 + 4 + 1 + 2);
@@ -482,12 +487,12 @@ export async function handleStartReplication(query, writer, db, mutex) {
             // feed the bankruptcy monitor's confirm gauge, or a reconnect livelock
             // (stream → no confirm → reconnect → repeat) looks healthy forever.
             if (purged > 0)
-                markReplicationProgress();
+                markReplicationProgress(instanceId);
             await clearStreamedBatches(db);
             const resumeWm = await getStreamResumeWatermark(db);
-            if (resumeWm !== lastStreamedWatermark) {
-                log.debug.repl(`moving lastStreamedWatermark ${lastStreamedWatermark} → ${resumeWm} on reconnect`);
-                lastStreamedWatermark = resumeWm;
+            if (resumeWm !== state.lastStreamedWatermark) {
+                log.debug.repl(`moving lastStreamedWatermark ${state.lastStreamedWatermark} → ${resumeWm} on reconnect`);
+                state.lastStreamedWatermark = resumeWm;
             }
         }
         catch (err) {
@@ -497,18 +502,20 @@ export async function handleStartReplication(query, writer, db, mutex) {
             mutex.release();
         }
     }
-    let lastWatermark = lastStreamedWatermark;
+    let lastWatermark = state.lastStreamedWatermark;
     // use cached setup results on reconnect to avoid holding the mutex
     // for seconds doing trigger installation + schema queries. zero-cache
     // disconnects if its proxy queries are blocked too long by the mutex.
     let tableKeyColumns;
     let excludedColumns;
     let columnTypeOids;
-    if (cachedTableKeyColumns && cachedExcludedColumns && cachedColumnTypeOids) {
+    if (state.cachedTableKeyColumns &&
+        state.cachedExcludedColumns &&
+        state.cachedColumnTypeOids) {
         log.debug.repl('reconnect: using cached setup (skipping mutex)');
-        tableKeyColumns = cachedTableKeyColumns;
-        excludedColumns = cachedExcludedColumns;
-        columnTypeOids = cachedColumnTypeOids;
+        tableKeyColumns = state.cachedTableKeyColumns;
+        excludedColumns = state.cachedExcludedColumns;
+        columnTypeOids = state.cachedColumnTypeOids;
     }
     else {
         tableKeyColumns = new Map();
@@ -526,7 +533,7 @@ export async function handleStartReplication(query, writer, db, mutex) {
             // install change tracking triggers on shard schema tables (e.g. chat_0.clients)
             await installTriggersOnShardTables(db);
             // set up LISTEN + install notify triggers in one batch
-            const pubName = process.env.ZERO_APP_PUBLICATIONS?.trim();
+            const pubName = state.publications;
             let tables;
             if (pubName) {
                 const result = await db.query(`SELECT tablename FROM pg_publication_tables
@@ -647,9 +654,9 @@ export async function handleStartReplication(query, writer, db, mutex) {
                 log.debug.proxy(`excluding unsupported columns: ${[...excludedColumns.entries()].map(([t, c]) => `${t}(${[...c].join(',')})`).join(', ')}`);
             }
             // cache for subsequent reconnects
-            cachedTableKeyColumns = tableKeyColumns;
-            cachedExcludedColumns = excludedColumns;
-            cachedColumnTypeOids = columnTypeOids;
+            state.cachedTableKeyColumns = tableKeyColumns;
+            state.cachedExcludedColumns = excludedColumns;
+            state.cachedColumnTypeOids = columnTypeOids;
         }
         finally {
             mutex.release();
@@ -697,14 +704,14 @@ export async function handleStartReplication(query, writer, db, mutex) {
         });
     };
     const flushConfirmedBatches = async () => {
-        if (pendingConfirmLsn <= processedConfirmLsn)
+        if (state.pendingConfirmLsn <= state.processedConfirmLsn)
             return;
         await mutex.acquire();
-        const target = pendingConfirmLsn;
+        const target = state.pendingConfirmLsn;
         try {
             const purged = await confirmStreamedBatches(db, target);
-            processedConfirmLsn = target;
-            markReplicationProgress();
+            state.processedConfirmLsn = target;
+            markReplicationProgress(instanceId);
             if (newestUnconfirmedLsn > 0n && target >= newestUnconfirmedLsn) {
                 oldestUnconfirmedAt = 0;
                 oldestUnconfirmedLsn = 0n;
@@ -741,8 +748,8 @@ export async function handleStartReplication(query, writer, db, mutex) {
         // discards the batch mappings and restarts the chew from zero — the
         // reconnect livelock that burned $50-65/day of DO rows-written on the
         // 2026-07 CF incident. reconnect is for a dead wire, not a slow consumer.
-        const sinceSignal = performance.now() - Math.max(oldestUnconfirmedAt, lastFeedbackAtPerf);
-        const timeoutMs = unconfirmedReconnectMs();
+        const sinceSignal = performance.now() - Math.max(oldestUnconfirmedAt, state.lastFeedbackAtPerf);
+        const timeoutMs = unconfirmedReconnectMs(state);
         if (sinceSignal < timeoutMs)
             return false;
         log.repl(`unconfirmed streamed batch stale for ${sinceSignal.toFixed(0)}ms with no consumer feedback; closing replication stream for reconnect`);
@@ -751,8 +758,11 @@ export async function handleStartReplication(query, writer, db, mutex) {
         return true;
     };
     // register direct wakeup so the proxy can signal us immediately
-    _replicationWakeup = wakeup;
-    globalThis.__orez_signal_replication = wakeup;
+    state.replicationWakeup = wakeup;
+    // expose on globalThis so external code (e.g. pglite-pool) can signal
+    // without importing from this module (works across separate bundles)
+    if (instanceId === undefined)
+        globalThis.__orez_signal_replication = wakeup;
     // also set up LISTEN as secondary signal
     let unsubscribe = null;
     try {
@@ -793,7 +803,7 @@ export async function handleStartReplication(query, writer, db, mutex) {
                             // as its downstream commits, instead of at its own leisurely
                             // cadence — without this the first ack routinely lost the race
                             // against the stale-unconfirmed reconnect (2026-07 CF incident).
-                            writer.write(encodeKeepalive(currentLsn, nowMicros(), newestUnconfirmedLsn > 0n));
+                            writer.write(encodeKeepalive(state.currentLsn, nowMicros(), newestUnconfirmedLsn > 0n));
                             log.debug.repl(`idle keepalive (lastWatermark=${lastWatermark})`);
                             // re-scan for new shard schemas during idle
                             if (performance.now() - lastShardRescan > shardRescanIntervalMs) {
@@ -925,7 +935,7 @@ export async function handleStartReplication(query, writer, db, mutex) {
                     log.debug.repl(`filter: ${preFilterCount} → ${changes.length} changes`);
                     if (changes.length === 0) {
                         lastWatermark = batchEnd;
-                        lastStreamedWatermark = batchEnd;
+                        state.lastStreamedWatermark = batchEnd;
                         // all changes were filtered out (e.g. shard internal tables).
                         // they never reach the consumer by design, so no confirmation
                         // will ever cover them — purge directly.
@@ -942,14 +952,14 @@ export async function handleStartReplication(query, writer, db, mutex) {
                         queryPending = true;
                         continue;
                     }
-                    await ensureMetadataForChangedTables(db, mutex, changes, tableKeyColumns, excludedColumns, columnTypeOids);
+                    await ensureMetadataForChangedTables(db, mutex, changes, tableKeyColumns, excludedColumns, columnTypeOids, state);
                     // allocate the batch's commit LSN and durably record the
                     // lsn → batch-end mapping BEFORE the rows hit the wire: if the
                     // consumer commits the batch and this process dies before
                     // persisting the mapping, the reconnect reconciliation would
                     // re-stream an already-committed transaction (duplicate apply).
-                    const batchLsn = nextLsn();
-                    const batchEndLsn = nextLsn();
+                    const batchLsn = nextLsn(state);
+                    const batchEndLsn = nextLsn(state);
                     await mutex.acquire();
                     try {
                         await recordStreamedBatch(db, batchLsn, batchEnd);
@@ -958,11 +968,11 @@ export async function handleStartReplication(query, writer, db, mutex) {
                         mutex.release();
                     }
                     log.debug.repl(`streaming ${changes.length} changes to writer`);
-                    await streamChanges(changes, writer, sentRelations, txCounter++, batchLsn, batchEndLsn, tableKeyColumns, excludedColumns, columnTypeOids);
+                    await streamChanges(changes, writer, sentRelations, txCounter++, batchLsn, batchEndLsn, tableKeyColumns, excludedColumns, columnTypeOids, state);
                     markBatchAwaitingConfirmation(batchLsn);
-                    lastStreamActivityAt = Date.now();
+                    state.lastStreamActivityAt = Date.now();
                     lastWatermark = batchEnd;
-                    lastStreamedWatermark = batchEnd;
+                    state.lastStreamedWatermark = batchEnd;
                     log.debug.repl(`streamed ok, watermark=${batchEnd}`);
                     hasStreamedOnce = true;
                     // got changes - continue immediately to check for more
@@ -972,7 +982,7 @@ export async function handleStartReplication(query, writer, db, mutex) {
                 // no changes: send keepalive (reply requested while batches await
                 // confirmation — see the idle-timeout keepalive above)
                 const ts = nowMicros();
-                writer.write(encodeKeepalive(currentLsn, ts, newestUnconfirmedLsn > 0n));
+                writer.write(encodeKeepalive(state.currentLsn, ts, newestUnconfirmedLsn > 0n));
                 log.debug.repl(`idle (lastWatermark=${lastWatermark})`);
                 // next iteration will wait for signal at the top
             }
@@ -996,8 +1006,8 @@ export async function handleStartReplication(query, writer, db, mutex) {
     }
     finally {
         // only clear if still pointing to our wakeup (a new handler may have replaced it)
-        if (_replicationWakeup === wakeup) {
-            _replicationWakeup = null;
+        if (state.replicationWakeup === wakeup) {
+            state.replicationWakeup = null;
         }
         if (unsubscribe) {
             await unsubscribe().catch(() => { });
@@ -1005,7 +1015,7 @@ export async function handleStartReplication(query, writer, db, mutex) {
     }
     log.repl('poll loop exited');
 }
-async function ensureMetadataForChangedTables(db, mutex, changes, tableKeyColumns, excludedColumns, columnTypeOids) {
+async function ensureMetadataForChangedTables(db, mutex, changes, tableKeyColumns, excludedColumns, columnTypeOids, state) {
     const missing = new Map();
     for (const change of changes) {
         if (tableKeyColumns.has(change.table_name) ||
@@ -1074,18 +1084,16 @@ async function ensureMetadataForChangedTables(db, mutex, changes, tableKeyColumn
         }
         log.debug.repl(`refreshed metadata for ${missing.size} late table(s): ${[...missing.keys()].join(',')}`);
         for (const key of missing.keys())
-            cachedColumns.delete(key);
+            state.cachedColumns.delete(key);
     }
     finally {
         mutex.release();
     }
 }
-// cache column info per table to avoid per-change allocation
-const cachedColumns = new Map();
 async function streamChanges(changes, writer, sentRelations, txId, 
 // the batch's commit LSN and commit-end LSN are allocated by the caller so
 // the lsn → batch-end mapping can be durably recorded before streaming.
-lsn, endLsn, tableKeyColumns, excludedColumns, columnTypeOids) {
+lsn, endLsn, tableKeyColumns, excludedColumns, columnTypeOids, state) {
     const ts = nowMicros();
     // collect all encoded messages into a list, then batch-write
     // to minimize syscalls (each writer.write → socket.write is a syscall)
@@ -1120,7 +1128,7 @@ lsn, endLsn, tableKeyColumns, excludedColumns, columnTypeOids) {
         if (!row)
             continue;
         // use cached columns or build and cache them
-        let columns = cachedColumns.get(qualifiedKey);
+        let columns = state.cachedColumns.get(qualifiedKey);
         if (!columns) {
             const keySet = tableKeyColumns.get(qualifiedKey);
             const typeOids = columnTypeOids.get(qualifiedKey);
@@ -1129,7 +1137,7 @@ lsn, endLsn, tableKeyColumns, excludedColumns, columnTypeOids) {
                 typeOid: typeOids?.get(col.name) ?? col.typeOid,
                 isKey: keySet?.has(col.name) ?? false,
             }));
-            cachedColumns.set(qualifiedKey, columns);
+            state.cachedColumns.set(qualifiedKey, columns);
         }
         // send RELATION if not yet sent
         if (!sentRelations.has(qualifiedKey)) {
@@ -1174,9 +1182,32 @@ lsn, endLsn, tableKeyColumns, excludedColumns, columnTypeOids) {
     }
     // hook for arch instrumentation (soot-arch sq-write events)
     const hook = globalThis.__orez_on_repl_commit;
+    const tables = new Set(changes.map((change) => change.table_name));
+    try {
+        state.log?.({
+            changes: changes.length,
+            component: 'replication',
+            event: 'commit',
+            instanceId: state.instanceId,
+            tables: [...tables],
+            txId,
+        });
+    }
+    catch {
+        // diagnostics cannot break replication
+    }
     if (hook) {
-        const tables = new Set(changes.map((c) => c.table_name));
-        hook({ changes: changes.length, tables: [...tables], txId });
+        try {
+            hook({
+                changes: changes.length,
+                instanceId: state.instanceId,
+                tables: [...tables],
+                txId,
+            });
+        }
+        catch {
+            // instrumentation cannot break replication
+        }
     }
 }
 function normalizeShardClientsRow(row) {