pond-ts 0.24.0 → 0.25.0

package/CHANGELOG.md

@@ -7,7 +7,8 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 file covers both packages. Pre-1.0: minor bumps may include new features and
 type-level changes; patch bumps are strictly additive.
 
-[Unreleased]: https://github.com/pjm17971/pond-ts/compare/v0.24.0...HEAD
+[Unreleased]: https://github.com/pjm17971/pond-ts/compare/v0.25.0...HEAD
+[0.25.0]: https://github.com/pjm17971/pond-ts/compare/v0.24.0...v0.25.0
 [0.24.0]: https://github.com/pjm17971/pond-ts/compare/v0.23.0...v0.24.0
 [0.23.0]: https://github.com/pjm17971/pond-ts/compare/v0.22.0...v0.23.0
 [0.22.0]: https://github.com/pjm17971/pond-ts/compare/v0.21.0...v0.22.0
@@ -18,6 +19,52 @@ type-level changes; patch bumps are strictly additive.
 
 ## [Unreleased]
 
+## [0.25.0] — 2026-06-15
+
+### Changed
+
+- **Reducers now treat non-finite numerics (`NaN` / `±Infinity`) as missing —
+  they are skipped — uniformly across every built-in reducer and all four
+  execution paths (`reduce`, the columnar fast path, `aggregate`/bucket, and
+  `rolling`/live).** Previously the paths disagreed on non-finite input: e.g.
+  `min`/`max` returned a position-dependent wrong extreme on the batch/columnar
+  paths but the true extreme on aggregate/rolling; `sum`/`avg` propagated
+  `NaN`. Non-finite can't enter via the row API (intake rejects it) — it only
+  arises inside computed columns (`cumulative` overflow, `diff`/`rate`
+  overflow, `collapse`, trusted construction) — so this only changes results
+  for those degenerate values, and makes every path agree. The three-layer
+  contract: **intake** stays strict (rejects non-finite), **computed writers**
+  stay permissive (pack honest non-finite), **reducers** are robust (skip it).
+  A standing parity-matrix test now pins all paths together. See
+  `docs/notes/reducer-nan-policy.md`. This also resolves the `aggregate('stdev')`
+  divergence class and the `min`/`max` NaN-laundering bug.
+- Internal: `Float64Column` gained an `allFinite` fast-path flag (data-derived
+  at construction, conservative-by-default) so reducers skip the per-element
+  finite check on provably-finite columns — keeping the policy's cost off the
+  hot path (min/max/count stay at their pre-policy speed).
+
+### Fixed
+
+- **`rolling(window, { x: 'stdev' })` is now numerically stable.** It was the
+  last batch stdev path still on the one-pass `Σx²/n − mean²`, which cancels
+  catastrophically on near-equal large values (`[1e10, 1e10+1, …]` → `0`
+  instead of ≈1.118, or a negative variance → `NaN`) and drifts on trending
+  data (cumulative distance, elevation). It now uses Welford's online variance
+  with an order-independent **delete** — deviation-space, so no cancellation,
+  and removal **by value**, which keeps it correct under the live layer's
+  `reorder`-mode eviction (a positional/FIFO remove would have broken it; the
+  documented "stdev is reorder-safe" contract is preserved). Rolling-stdev
+  values shift in the last ULPs (now correct); the path stays O(1) and within
+  run-noise of the old one-pass, and a single-element window now reports exactly
+  `0` at any magnitude. Like any subtractive sliding variance, evicting an
+  outlier far outside the residual spread loses precision — negligible until the
+  evicted point is ~1e7–1e8× the residual stdev, far beyond realistic data.
+- A standing differential-fuzz parity suite now pins every built-in reducer's
+  execution paths (columnar fast path vs `bucket` vs `rolling`, and the FIFO
+  sliding window vs a from-scratch recompute) against silent drift across
+  randomized magnitudes and window sizes — the class of bug behind the stdev
+  and `min`/`max` divergences.
+
 ## [0.24.0] — 2026-06-14
 
 ### Changed

package/dist/batch/aggregate-columns.js

@@ -123,26 +123,34 @@ export function tryAggregateColumnarTimeKeyed(begins, getColumn, buckets, column
                 reduced[p] = plan.reduce(plan.column.sliceByRange(start, scan));
             }
             else if (plan.which === 'first') {
-                // First defined cell in [start, scan); scans past missing cells.
+                // First defined cell in [start, scan); scans past missing cells and
+                // past non-finite numeric cells (reducer non-finite policy,
+                // docs/notes/reducer-nan-policy.md — a NaN/±Inf numeric is "not a
+                // contributor", matching the row path's `defined` filter).
                 let value;
                 for (let i = start; i < scan; i += 1) {
                     const cell = plan.column.read(i);
-                    if (cell !== undefined) {
-                        value = cell;
-                        break;
-                    }
+                    if (cell === undefined)
+                        continue;
+                    if (typeof cell === 'number' && !Number.isFinite(cell))
+                        continue;
+                    value = cell;
+                    break;
                 }
                 reduced[p] = value;
             }
             else {
-                // Last defined cell in [start, scan); scans backward past missing.
+                // Last defined cell in [start, scan); scans backward past missing and
+                // past non-finite numeric cells (see the 'first' branch above).
                 let value;
                 for (let i = scan - 1; i >= start; i -= 1) {
                     const cell = plan.column.read(i);
-                    if (cell !== undefined) {
-                        value = cell;
-                        break;
-                    }
+                    if (cell === undefined)
+                        continue;
+                    if (typeof cell === 'number' && !Number.isFinite(cell))
+                        continue;
+                    value = cell;
+                    break;
                 }
                 reduced[p] = value;
             }

package/dist/batch/time-series.js

@@ -15,7 +15,7 @@ import { Sequence } from '../sequence/sequence.js';
 import { IntervalKeyColumn, TimeKeyColumn, TimeRangeKeyColumn, float64ColumnFromArray, stringColumnFromArray, withColumnsRenamed, withColumnsSelected, withKeyColumn, withRowRange, withRowSelection, } from '../columnar/index.js';
 import { SeriesStore } from '../live/series-store.js';
 import { parseDuration } from '../core/duration.js';
-import { resolveReducer, } from '../reducers/index.js';
+import { resolveReducer, bucketStateFor, rollingStateFor, } from '../reducers/index.js';
 // JSON ↔ typed-row primitives live in `./json.js`. Both `TimeSeries`
 // and `LiveSeries` reach for them; extracted to break the import cycle
 // that would otherwise form (Event needs them, TimeSeries imports
@@ -274,7 +274,11 @@ function bucketOverlapsHalfOpen(bucket, event) {
     return event.begin() < bucket.end() && bucket.begin() < event.end();
 }
 function aggregateValues(operation, values) {
-    const defined = values.filter((value) => value !== undefined);
+    // Non-finite numerics (NaN / ±Inf) are treated as missing — excluded from
+    // both `defined` and `numeric` so every built-in reducer skips them exactly
+    // as it skips a missing cell. See docs/notes/reducer-nan-policy.md.
+    const defined = values.filter((value) => value !== undefined &&
+        (typeof value !== 'number' || Number.isFinite(value)));
     const numeric = defined.filter((value) => typeof value === 'number');
     return resolveReducer(operation).reduce(defined, numeric);
 }
@@ -315,7 +319,9 @@ function applyAggregateReducer(reducer, values) {
 // LivePartitionedSyncRolling) share the same normalisation. See the
 // import below.
 function createAggregateBucketState(operation) {
-    return resolveReducer(operation).bucketState();
+    // Delegates to the shared factory so the non-finite skip policy
+    // (docs/notes/reducer-nan-policy.md) applies uniformly to batch + live.
+    return bucketStateFor(operation);
 }
 /**
  * Resolve the output column kind for an `arrayAggregate` call. Numeric
@@ -336,7 +342,9 @@ function resolveArrayAggregateKind(reducer, explicitKind) {
     return 'string';
 }
 function createRollingReducerState(operation) {
-    return resolveReducer(operation).rollingState();
+    // Delegates to the shared factory so the non-finite skip policy
+    // (docs/notes/reducer-nan-policy.md) applies uniformly to batch + live.
+    return rollingStateFor(operation);
 }
 function duplicateValueColumnNames(schemas) {
     const counts = new Map();

package/dist/batch/validate.js

@@ -416,7 +416,13 @@ export function validateAndNormalizeColumnar(input) {
         let column;
         switch (kind) {
             case 'number':
-                column = new Float64Column(numberBufs[c], length, validity);
+                // Strict intake: `assertCellKind` (kind 'number') already
+                // rejected every non-finite cell with a `ValidationError`
+                // before it reached `numberBufs`, so a surviving column is
+                // provably all-finite → `allFinite: true` (lets reducers skip
+                // the per-element finite guard). See the reducer non-finite
+                // policy + `Float64Column.allFinite`'s safety contract.
+                column = new Float64Column(numberBufs[c], length, validity, true);
                 break;
             case 'boolean':
                 column = new BooleanColumn(booleanBufs[c], length, validity);

package/dist/column.js

@@ -76,33 +76,60 @@ Float64Column.prototype.minMax = function () {
     const n = this.length;
     if (n === 0)
         return undefined;
-    let i = 0;
-    let lo;
-    let hi;
-    if (!v) {
-        lo = values[0];
+    if (this.allFinite) {
+        // Provably finite (the chart axis hot path) → no per-element finite
+        // guard; the seeded comparison is unambiguous without NaN.
+        let i = 0;
+        let lo;
+        let hi;
+        if (!v) {
+            lo = values[0];
+            hi = lo;
+            for (i = 1; i < n; i += 1) {
+                const x = values[i];
+                lo = lo <= x ? lo : x;
+                hi = hi >= x ? hi : x;
+            }
+            return [lo, hi];
+        }
+        while (i < n && !v.isDefined(i))
+            i += 1;
+        if (i >= n)
+            return undefined;
+        lo = values[i];
         hi = lo;
-        for (i = 1; i < n; i += 1) {
+        for (i += 1; i < n; i += 1) {
+            if (!v.isDefined(i))
+                continue;
             const x = values[i];
             lo = lo <= x ? lo : x;
             hi = hi >= x ? hi : x;
         }
         return [lo, hi];
     }
-    while (i < n && !v.isDefined(i))
-        i += 1;
-    if (i >= n)
-        return undefined;
-    lo = values[i];
-    hi = lo;
-    for (i += 1; i < n; i += 1) {
-        if (!v.isDefined(i))
+    // Guarded: skip non-finite (and missing) cells, matching the reducer
+    // `min`/`max` (reducer non-finite policy — docs/notes/reducer-nan-policy.md).
+    // All-non-finite (or empty) → undefined.
+    let lo;
+    let hi;
+    for (let i = 0; i < n; i += 1) {
+        if (v && !v.isDefined(i))
             continue;
         const x = values[i];
-        lo = lo <= x ? lo : x;
-        hi = hi >= x ? hi : x;
+        if (!Number.isFinite(x))
+            continue;
+        if (lo === undefined) {
+            lo = x;
+            hi = x;
+        }
+        else {
+            if (x < lo)
+                lo = x;
+            if (x > hi)
+                hi = x;
+        }
     }
-    return [lo, hi];
+    return lo === undefined ? undefined : [lo, hi];
 };
 Float64Column.prototype.hasMissing = function () {
     if (!this.validity)
@@ -228,6 +255,44 @@ Float64Column.prototype.bin = function (bins, reducer) {
         // underlying buffer.
         const values = this._values;
         const validity = this.validity;
+        if (!this.allFinite) {
+            // Guarded path: skip non-finite values (reducer non-finite policy —
+            // docs/notes/reducer-nan-policy.md), matching `minMax()` / the reducer
+            // min/max. A bin with no finite value (all-missing or all-non-finite)
+            // keeps the NaN empty-bin sentinel.
+            for (let b = 0; b < bins; b += 1) {
+                const start = Math.floor((b * n) / bins);
+                const end = Math.floor(((b + 1) * n) / bins);
+                let loVal;
+                let hiVal;
+                for (let i = start; i < end; i += 1) {
+                    if (validity !== undefined && !validity.isDefined(i))
+                        continue;
+                    const x = values[i];
+                    if (!Number.isFinite(x))
+                        continue;
+                    if (loVal === undefined) {
+                        loVal = x;
+                        hiVal = x;
+                    }
+                    else {
+                        if (x < loVal)
+                            loVal = x;
+                        if (x > hiVal)
+                            hiVal = x;
+                    }
+                }
+                if (loVal === undefined) {
+                    lo[b] = NaN;
+                    hi[b] = NaN;
+                }
+                else {
+                    lo[b] = loVal;
+                    hi[b] = hiVal;
+                }
+            }
+            return { lo, hi };
+        }
         if (validity === undefined) {
             for (let b = 0; b < bins; b += 1) {
                 const start = Math.floor((b * n) / bins);
@@ -568,10 +633,15 @@ ChunkedFloat64Column.prototype.percentile = function (q) {
     return materializeChunkedFloat64(this).percentile(q);
 };
 ChunkedFloat64Column.prototype.count = function () {
-    // Validity-defined-count is available without materializing.
-    if (!this.validity)
-        return this.length;
-    return this.validity.definedCount;
+    // The O(1) defined-count is correct only when the column is provably
+    // finite. Non-finite cells are skipped (reducer non-finite policy —
+    // docs/notes/reducer-nan-policy.md), so when finiteness isn't proven,
+    // delegate to the materialized packed `count()` (which routes through the
+    // count reducer and skips non-finite) — matching packed `Float64Column`.
+    if (this.allFinite) {
+        return this.validity ? this.validity.definedCount : this.length;
+    }
+    return materializeChunkedFloat64(this).count();
 };
 ChunkedFloat64Column.prototype.minMax = function () {
     return materializeChunkedFloat64(this).minMax();

package/dist/columnar/chunked-column.d.ts

@@ -72,6 +72,16 @@ export declare class ChunkedFloat64Column {
     readonly chunks: ReadonlyArray<Float64Column>;
     readonly chunkOffsets: Int32Array;
     readonly validity?: ValidityBitmap;
+    /**
+     * `true` iff **every** chunk is itself `allFinite` — the merged
+     * column is all-finite IFF each input is (an AND). Defaults to
+     * `false` whenever any chunk's flag is `false` (or absent), which is
+     * the safe direction: a chunk that didn't prove finiteness keeps the
+     * whole column on the guarded reducer path. Mirrors
+     * `Float64Column.allFinite`'s safety contract — see it for why a
+     * wrong `true` is unsafe.
+     */
+    readonly allFinite: boolean;
     constructor(chunks: ReadonlyArray<Float64Column>);
     /**
      * Reads cell `i` by binary-searching `chunkOffsets` to find the

package/dist/columnar/chunked-column.js

@@ -192,6 +192,16 @@ export class ChunkedFloat64Column {
     chunks;
     chunkOffsets;
     validity;
+    /**
+     * `true` iff **every** chunk is itself `allFinite` — the merged
+     * column is all-finite IFF each input is (an AND). Defaults to
+     * `false` whenever any chunk's flag is `false` (or absent), which is
+     * the safe direction: a chunk that didn't prove finiteness keeps the
+     * whole column on the guarded reducer path. Mirrors
+     * `Float64Column.allFinite`'s safety contract — see it for why a
+     * wrong `true` is unsafe.
+     */
+    allFinite;
     constructor(chunks) {
         assertChunkKinds(chunks, 'number', 'ChunkedFloat64Column');
         const { length, chunkOffsets, validity } = buildOffsetsAndAggregateValidity(chunks, 'ChunkedFloat64Column');
@@ -202,6 +212,16 @@ export class ChunkedFloat64Column {
         this.chunkOffsets = chunkOffsets;
         if (validity !== undefined)
             this.validity = validity;
+        // AND across chunks: all-finite IFF every chunk is. An empty chunk
+        // list is vacuously all-finite (no non-finite cell exists).
+        let allFinite = true;
+        for (let c = 0; c < chunks.length; c += 1) {
+            if (!chunks[c].allFinite) {
+                allFinite = false;
+                break;
+            }
+        }
+        this.allFinite = allFinite;
     }
     /**
      * Reads cell `i` by binary-searching `chunkOffsets` to find the
@@ -287,10 +307,13 @@ export class ChunkedFloat64Column {
             out[i] = this.chunks[c]._values[local];
             validBits[i >> 3] |= 1 << (i & 7);
         }
+        // A gather only reads existing defined cells (out-of-range / invalid
+        // slots are skipped → marked invalid below), so the result is finite
+        // whenever this chunked column is. Propagate the AND-of-chunks flag.
         if (!hasInvalid) {
-            return new Float64Column(out, indices.length);
+            return new Float64Column(out, indices.length, undefined, this.allFinite);
         }
-        return new Float64Column(out, indices.length, validityFromBits(validBits, indices.length));
+        return new Float64Column(out, indices.length, validityFromBits(validBits, indices.length), this.allFinite);
     }
 }
 /* -------------------------------------------------------------------------- */
@@ -631,7 +654,10 @@ export function materializeChunkedFloat64(chunked) {
         out.set(chunk._values.subarray(0, chunk.length), cursor);
         cursor += chunk.length;
     }
-    return new Float64Column(out, chunked.length, chunked.validity);
+    // Compacting doesn't touch values, so finiteness carries over from
+    // the chunked column (which is the AND of its chunks). This is what
+    // lets a `concatSorted(...).reduce(...)` take the reducer fast path.
+    return new Float64Column(out, chunked.length, chunked.validity, chunked.allFinite);
 }
 /**
  * Compacts a `ChunkedBooleanColumn` into a plain `BooleanColumn`.

package/dist/columnar/column.d.ts

@@ -128,7 +128,25 @@ export declare class Float64Column implements ColumnBase<number, 'number'> {
     readonly storage: "packed";
     readonly length: number;
     readonly validity?: ValidityBitmap;
-    constructor(values: Float64Array, length: number, validity?: ValidityBitmap);
+    /**
+     * **Safety contract.** `true` MUST mean "every *defined* cell is
+     * finite — no `NaN`, no `±Infinity`" (missing cells, tracked by
+     * `validity`, are irrelevant). It is a promise the producer makes
+     * so reducers can skip the per-element `Number.isFinite` guard that
+     * the reducer non-finite policy (docs/notes/reducer-nan-policy.md)
+     * otherwise requires on every numeric `reduceColumn`.
+     *
+     * A wrongly-`true` flag makes `reduceColumn` take the unguarded fast
+     * path and silently include a non-finite cell → wrong result. So the
+     * **default is `false`** (conservative: guarded path, correct-but-
+     * slower) and a producer sets `true` ONLY where finiteness is proven
+     * — either data-derived by inspecting every cell, validated upstream
+     * (strict intake), or propagated from a source column that was
+     * itself `allFinite`. When unsure, leave it `false`: a missed `true`
+     * is slower, never wrong.
+     */
+    readonly allFinite: boolean;
+    constructor(values: Float64Array, length: number, validity?: ValidityBitmap, allFinite?: boolean);
     read(i: number): number | undefined;
     scan(fn: (value: number, i: number) => void, options?: ScanOptions): void;
     sliceByRange(start: number, end: number): Float64Column;

package/dist/columnar/column.js

@@ -41,7 +41,25 @@ export class Float64Column {
      */
     _values;
     validity;
-    constructor(values, length, validity) {
+    /**
+     * **Safety contract.** `true` MUST mean "every *defined* cell is
+     * finite — no `NaN`, no `±Infinity`" (missing cells, tracked by
+     * `validity`, are irrelevant). It is a promise the producer makes
+     * so reducers can skip the per-element `Number.isFinite` guard that
+     * the reducer non-finite policy (docs/notes/reducer-nan-policy.md)
+     * otherwise requires on every numeric `reduceColumn`.
+     *
+     * A wrongly-`true` flag makes `reduceColumn` take the unguarded fast
+     * path and silently include a non-finite cell → wrong result. So the
+     * **default is `false`** (conservative: guarded path, correct-but-
+     * slower) and a producer sets `true` ONLY where finiteness is proven
+     * — either data-derived by inspecting every cell, validated upstream
+     * (strict intake), or propagated from a source column that was
+     * itself `allFinite`. When unsure, leave it `false`: a missed `true`
+     * is slower, never wrong.
+     */
+    allFinite;
+    constructor(values, length, validity, allFinite = false) {
         validateColumnLength(length, 'Float64Column');
         if (length > values.length) {
             throw new RangeError(`Float64Column buffer underflow: length ${length} exceeds values.length ${values.length}`);
@@ -53,6 +71,7 @@ export class Float64Column {
         this.length = length;
         if (validity !== undefined)
             this.validity = validity;
+        this.allFinite = allFinite;
     }
     read(i) {
         if (i < 0 || i >= this.length)
@@ -88,7 +107,8 @@ export class Float64Column {
         }
         const valuesSlice = this._values.subarray(lo, hi);
         const validitySlice = validitySliceByRange(this.validity, lo, hi, this.length);
-        return new Float64Column(valuesSlice, hi - lo, validitySlice);
+        // A contiguous slice of an all-finite column is all-finite.
+        return new Float64Column(valuesSlice, hi - lo, validitySlice, this.allFinite);
     }
     sliceByIndices(indices) {
         const out = new Float64Array(indices.length);
@@ -99,7 +119,10 @@ export class Float64Column {
             out[i] = idx >= 0 && idx < this.length ? this._values[idx] : 0;
         }
         const validity = validityGatherByIndices(this.validity, indices, this.length);
-        return new Float64Column(out, indices.length, validity);
+        // A gathered subset of finite cells is finite. Out-of-range slots
+        // read 0 (finite) and are marked invalid by the validity gather, so
+        // they can't violate the contract either way.
+        return new Float64Column(out, indices.length, validity, this.allFinite);
     }
 }
 /* -------------------------------------------------------------------------- */
@@ -201,15 +224,27 @@ export function float64ColumnFromArray(source) {
     const length = source.length;
     validateColumnLength(length, 'Float64Column');
     const values = new Float64Array(length);
+    // Data-derive `allFinite` in the copy loop: only *defined* cells
+    // count (a missing slot doesn't make the column non-finite). Finite
+    // data → `true` (reducers take the fast path); an overflow / NaN cell
+    // → `false` (guarded path, correct). See the field's safety contract.
+    let allFinite = true;
     for (let i = 0; i < length; i += 1) {
         const v = source[i];
-        values[i] = typeof v === 'number' ? v : 0;
+        if (typeof v === 'number') {
+            values[i] = v;
+            if (!Number.isFinite(v))
+                allFinite = false;
+        }
+        else {
+            values[i] = 0;
+        }
     }
     const validity = validityFromPredicate(length, (i) => {
         const v = source[i];
         return typeof v === 'number';
     });
-    return new Float64Column(values, length, validity);
+    return new Float64Column(values, length, validity, allFinite);
 }
 /**
  * Builds a `BooleanColumn` from an array of `boolean | null | undefined`

package/dist/reducers/avg.js

@@ -8,24 +8,51 @@ export const avg = {
     reduceColumn(col) {
         const values = col._values;
         const validity = col.validity;
+        let s = 0;
+        let n = 0;
+        // Fast path: every defined cell is finite (`Float64Column.allFinite`),
+        // so every defined cell is a valid contributor — plain accumulate, and
+        // the divisor is `definedCount` (or `col.length`). Drops the
+        // per-element finite guard the reducer non-finite policy
+        // (docs/notes/reducer-nan-policy.md) otherwise requires.
+        if (col.allFinite) {
+            if (validity === undefined) {
+                for (let i = 0; i < col.length; i += 1)
+                    s += values[i];
+                return col.length === 0 ? undefined : s / col.length;
+            }
+            const bits = validity.bits;
+            for (let i = 0; i < col.length; i += 1) {
+                if ((bits[i >> 3] & (1 << (i & 7))) !== 0)
+                    s += values[i];
+            }
+            const count = validity.definedCount;
+            return count === 0 ? undefined : s / count;
+        }
+        // Guarded path: divide by the count of *finite* contributors, not
+        // `definedCount` — a non-finite cell is skipped per policy, so it must
+        // not inflate the divisor.
         if (validity === undefined) {
-            if (col.length === 0)
-                return undefined;
-            let s = 0;
-            for (let i = 0; i < col.length; i += 1)
-                s += values[i];
-            return s / col.length;
+            for (let i = 0; i < col.length; i += 1) {
+                const v = values[i];
+                if (Number.isFinite(v)) {
+                    s += v;
+                    n += 1;
+                }
+            }
+            return n === 0 ? undefined : s / n;
         }
-        const definedCount = validity.definedCount;
-        if (definedCount === 0)
-            return undefined;
         const bits = validity.bits;
-        let s = 0;
         for (let i = 0; i < col.length; i += 1) {
-            if ((bits[i >> 3] & (1 << (i & 7))) !== 0)
-                s += values[i];
+            if ((bits[i >> 3] & (1 << (i & 7))) !== 0) {
+                const v = values[i];
+                if (Number.isFinite(v)) {
+                    s += v;
+                    n += 1;
+                }
+            }
         }
-        return s / definedCount;
+        return n === 0 ? undefined : s / n;
     },
     bucketState() {
         let s = 0;

package/dist/reducers/count.js

@@ -24,10 +24,36 @@ export const count = {
         return defined.length;
     },
     reduceColumn(col) {
-        // O(1) when validity is precomputed (it always is on Float64Column —
-        // `validity.definedCount` is cached at construction). Falls back to
-        // `col.length` when no validity bitmap exists (every cell defined).
-        return col.validity === undefined ? col.length : col.validity.definedCount;
+        const values = col._values;
+        const validity = col.validity;
+        // Fast path: every defined cell is finite (`Float64Column.allFinite`),
+        // so "defined" and "defined AND finite" coincide — the O(1) shortcut
+        // is exact again (`definedCount`, or `col.length` when no bitmap).
+        // This is the O(N)→O(1) recovery the non-finite policy cost count
+        // (docs/notes/reducer-nan-policy.md).
+        if (col.allFinite) {
+            return validity === undefined ? col.length : validity.definedCount;
+        }
+        // Guarded path: O(N) scan, NOT the `definedCount` shortcut — the
+        // non-finite policy excludes non-finite cells, and `definedCount`
+        // counts them as present, so a defined-but-NaN cell would over-count.
+        // Walk and count valid AND finite cells.
+        let n = 0;
+        if (validity === undefined) {
+            for (let i = 0; i < col.length; i += 1) {
+                if (Number.isFinite(values[i]))
+                    n += 1;
+            }
+            return n;
+        }
+        const bits = validity.bits;
+        for (let i = 0; i < col.length; i += 1) {
+            if ((bits[i >> 3] & (1 << (i & 7))) !== 0 &&
+                Number.isFinite(values[i])) {
+                n += 1;
+            }
+        }
+        return n;
     },
     bucketState() {
         let n = 0;

package/dist/reducers/index.js

@@ -41,6 +41,38 @@ export function resolveReducer(operation) {
         return topReducer(n);
     throw new TypeError(`unsupported aggregate reducer: ${operation}`);
 }
+/**
+ * Non-finite numerics (`NaN` / `±Infinity`) are treated as **missing** by
+ * every built-in reducer — the reducer non-finite policy
+ * (docs/notes/reducer-nan-policy.md). Row intake keeps user data finite; these
+ * values only arise inside computed columns (e.g. `cumulative` overflow) or
+ * trusted construction, and skipping them keeps every reducer consistent
+ * across all four execution paths. Mapping to `undefined` here lets the
+ * existing skip-missing logic in each incremental state do the work — so the
+ * policy holds for both the batch and live incremental paths without touching
+ * any reducer body. Custom-function reducers are intentionally NOT wrapped:
+ * they receive values as-is (the escape hatch decides its own semantics).
+ */
+function finiteOrMissing(value) {
+    return typeof value === 'number' && !Number.isFinite(value)
+        ? undefined
+        : value;
+}
+/** Wrap a bucket state so non-finite numerics are skipped. {@link finiteOrMissing} */
+function skipNonFiniteBucket(state) {
+    return {
+        add: (value) => state.add(finiteOrMissing(value)),
+        snapshot: () => state.snapshot(),
+    };
+}
+/** Wrap a rolling state so non-finite numerics are skipped. {@link finiteOrMissing} */
+function skipNonFiniteRolling(state) {
+    return {
+        add: (index, value) => state.add(index, finiteOrMissing(value)),
+        remove: (index, value) => state.remove(index, finiteOrMissing(value)),
+        snapshot: () => state.snapshot(),
+    };
+}
 /**
  * Build an `AggregateBucketState` for a reducer that may be either a
  * built-in name (string) or a custom function. Built-ins use their
@@ -52,7 +84,7 @@ export function resolveReducer(operation) {
  */
 export function bucketStateFor(reducer) {
     if (typeof reducer === 'string') {
-        return resolveReducer(reducer).bucketState();
+        return skipNonFiniteBucket(resolveReducer(reducer).bucketState());
     }
     // Custom-function adapter: buffer values, call fn at snapshot time.
     const items = [];
@@ -90,7 +122,7 @@ export function bucketStateFor(reducer) {
  */
 export function rollingStateFor(reducer) {
     if (typeof reducer === 'string') {
-        return resolveReducer(reducer).rollingState();
+        return skipNonFiniteRolling(resolveReducer(reducer).rollingState());
     }
     // Custom-function adapter: Map keyed by event index for O(1) remove.
     const items = new Map();

package/dist/reducers/max.js

@@ -7,20 +7,46 @@ export const max = {
             : numeric.reduce((a, b) => (a >= b ? a : b));
     },
     reduceColumn(col) {
-        // **NaN parity with row API.** Mirror the row-API expression
-        //   numeric.reduce((a, b) => a >= b ? a : b)
-        // exactly. See `min.ts` for the full rationale. Closed Codex
-        // review finding on PR #153.
         const values = col._values;
         const validity = col.validity;
         let hi;
-        if (validity === undefined) {
-            if (col.length === 0)
+        // Fast path: every defined cell is finite (`Float64Column.allFinite`),
+        // so we seed `hi` from the first defined cell and run a plain `v > hi`
+        // compare with NO per-element `Number.isFinite` guard and NO in-loop
+        // `hi === undefined` check (the seed hoists it out). No NaN to mishandle,
+        // also sidesteps the position-dependent `a>=b?a:b` extremum bug the policy
+        // fixed (docs/notes/reducer-nan-policy.md). The pre-policy column loop,
+        // recovered.
+        if (col.allFinite) {
+            const len = col.length;
+            if (len === 0)
                 return undefined;
-            hi = values[0];
-            for (let i = 1; i < col.length; i += 1) {
+            if (validity === undefined) {
+                hi = values[0];
+                for (let i = 1; i < len; i += 1) {
+                    const v = values[i];
+                    if (v > hi)
+                        hi = v;
+                }
+                return hi;
+            }
+            const bits = validity.bits;
+            for (let i = 0; i < len; i += 1) {
+                if ((bits[i >> 3] & (1 << (i & 7))) === 0)
+                    continue;
+                const v = values[i];
+                if (hi === undefined || v > hi)
+                    hi = v;
+            }
+            return hi;
+        }
+        // Guarded path: skip non-finite cells (reducer non-finite policy) —
+        // matches `bucketState`'s `v > hi`.
+        if (validity === undefined) {
+            for (let i = 0; i < col.length; i += 1) {
                 const v = values[i];
-                hi = hi >= v ? hi : v;
+                if (Number.isFinite(v) && (hi === undefined || v > hi))
+                    hi = v;
             }
             return hi;
         }
@@ -29,7 +55,8 @@ export const max = {
             if ((bits[i >> 3] & (1 << (i & 7))) === 0)
                 continue;
             const v = values[i];
-            hi = hi === undefined ? v : hi >= v ? hi : v;
+            if (Number.isFinite(v) && (hi === undefined || v > hi))
+                hi = v;
         }
         return hi;
     },

package/dist/reducers/min.js

@@ -7,33 +7,46 @@ export const min = {
             : numeric.reduce((a, b) => (a <= b ? a : b));
     },
     reduceColumn(col) {
-        // **NaN parity with row API.** The row-API path uses
-        //   numeric.reduce((a, b) => a <= b ? a : b)
-        // which has surprising NaN behavior: on `[1, NaN, 2]` it returns
-        // `2` because the first `1 <= NaN` is false (returning NaN),
-        // then `NaN <= 2` is also false (returning 2). The "natural"
-        // column-side loop `if (v < lo) lo = v` would instead return
-        // `1` (NaN comparisons always false → NaN is skipped). The two
-        // paths diverge on NaN-bearing input.
-        //
-        // We mirror the row-API comparison expression exactly to
-        // preserve the parity claim, even though both paths exhibit
-        // surprising results on NaN (which can only reach a `kind:
-        // 'number'` column via trusted construction — `assertCellKind`
-        // rejects it at public intake). Closed Codex review finding on
-        // PR #153. A principled "filter NaN consistently across both
-        // paths" fix is a separate concern tracked in the followup
-        // issue.
         const values = col._values;
         const validity = col.validity;
         let lo;
-        if (validity === undefined) {
-            if (col.length === 0)
+        // Fast path: every defined cell is finite (`Float64Column.allFinite`),
+        // so we seed `lo` from the first defined cell and run a plain `v < lo`
+        // compare with NO per-element `Number.isFinite` guard and NO in-loop
+        // `lo === undefined` check (the seed hoists it out). There is no NaN to
+        // mishandle, so this also sidesteps the position-dependent `a<=b?a:b`
+        // extremum bug the policy fixed (docs/notes/reducer-nan-policy.md). This
+        // is the pre-policy column loop, recovered.
+        if (col.allFinite) {
+            const len = col.length;
+            if (len === 0)
                 return undefined;
-            lo = values[0];
-            for (let i = 1; i < col.length; i += 1) {
+            if (validity === undefined) {
+                lo = values[0];
+                for (let i = 1; i < len; i += 1) {
+                    const v = values[i];
+                    if (v < lo)
+                        lo = v;
+                }
+                return lo;
+            }
+            const bits = validity.bits;
+            for (let i = 0; i < len; i += 1) {
+                if ((bits[i >> 3] & (1 << (i & 7))) === 0)
+                    continue;
+                const v = values[i];
+                if (lo === undefined || v < lo)
+                    lo = v;
+            }
+            return lo;
+        }
+        // Guarded path: skip non-finite cells (reducer non-finite policy) —
+        // matches `bucketState`'s `v < lo`.
+        if (validity === undefined) {
+            for (let i = 0; i < col.length; i += 1) {
                 const v = values[i];
-                lo = lo <= v ? lo : v;
+                if (Number.isFinite(v) && (lo === undefined || v < lo))
+                    lo = v;
             }
             return lo;
         }
@@ -42,7 +55,8 @@ export const min = {
             if ((bits[i >> 3] & (1 << (i & 7))) === 0)
                 continue;
             const v = values[i];
-            lo = lo === undefined ? v : lo <= v ? lo : v;
+            if (Number.isFinite(v) && (lo === undefined || v < lo))
+                lo = v;
         }
         return lo;
     },

package/dist/reducers/percentile.d.ts

@@ -5,36 +5,20 @@ export declare function parsePercentile(op: string): number | undefined;
 /**
  * Shared `reduceColumn` body for percentile-shaped reducers
  * (`median`, `p50`, `p95`, etc.). Walks the validity bitmap to
- * gather defined cells into a dense `Float64Array`, detecting NaN
- * cells in the same pass; sorts and reads the percentile from
- * the sorted view.
+ * gather defined **and finite** cells into a dense `Float64Array`,
+ * sorts with the typed-array intrinsic, and reads the percentile
+ * from the sorted view.
  *
- * **NaN parity with row API.** Two sort behaviors diverge:
+ * Non-finite cells (`NaN` / `±Infinity`) are excluded by the
+ * reducer non-finite policy (docs/notes/reducer-nan-policy.md) —
+ * uniformly, across every path. With non-finite filtered out
+ * before the sort, `Float64Array.prototype.sort()` (the numeric,
+ * NaN-free intrinsic, ~2× faster than `Array.sort` with a
+ * comparator) produces the same total order as the row path's
+ * `Array.sort((a, b) => a - b)` over the same finite values — so
+ * there is no longer any NaN-ordering seam to special-case.
  *
- * - `Array.prototype.sort((a, b) => a - b)` (row-API path) returns
- *   NaN from the comparator on NaN inputs; V8 treats this as
- *   "equal" and leaves NaN cells in undefined order — the
- *   resulting percentile is whatever cell happens to land at the
- *   computed rank, possibly NaN itself.
- * - `Float64Array.prototype.sort()` (typed-array intrinsic) puts
- *   NaN deterministically at the end of the sorted view — the
- *   percentile rank then reads a non-NaN cell unless the rank
- *   lands in the NaN suffix.
- *
- * The first-pass NaN detection lets us use `Float64Array.sort`'s
- * 2× speedup for the common no-NaN case (full parity with row API
- * because both produce identical sorted orders when no NaN
- * present), and fall back to `Array.sort` with comparator only
- * when NaN is present (preserving bug-for-bug row-API parity on
- * the rare contract-violating input).
- *
- * NaN can only reach a `kind: 'number'` column via trusted
- * construction (`fromEvents`); the public `assertCellKind`
- * rejects it at intake. Closed Codex review finding on PR #153 —
- * earlier L2 fix that filtered NaN was correct in spirit but
- * introduced a *different* divergence from the row API. A
- * principled "filter NaN consistently across both paths" fix is
- * tracked in the followup issue.
+ * Empty (no defined+finite values) → `undefined`.
  */
 export declare function reducePercentileColumn(col: Float64Column, q: number): number | undefined;
 export declare function percentileReducer(q: number): ReducerDef;

package/dist/reducers/percentile.js

@@ -18,51 +18,64 @@ export function parsePercentile(op) {
 /**
  * Shared `reduceColumn` body for percentile-shaped reducers
  * (`median`, `p50`, `p95`, etc.). Walks the validity bitmap to
- * gather defined cells into a dense `Float64Array`, detecting NaN
- * cells in the same pass; sorts and reads the percentile from
- * the sorted view.
+ * gather defined **and finite** cells into a dense `Float64Array`,
+ * sorts with the typed-array intrinsic, and reads the percentile
+ * from the sorted view.
  *
- * **NaN parity with row API.** Two sort behaviors diverge:
+ * Non-finite cells (`NaN` / `±Infinity`) are excluded by the
+ * reducer non-finite policy (docs/notes/reducer-nan-policy.md) —
+ * uniformly, across every path. With non-finite filtered out
+ * before the sort, `Float64Array.prototype.sort()` (the numeric,
+ * NaN-free intrinsic, ~2× faster than `Array.sort` with a
+ * comparator) produces the same total order as the row path's
+ * `Array.sort((a, b) => a - b)` over the same finite values — so
+ * there is no longer any NaN-ordering seam to special-case.
  *
- * - `Array.prototype.sort((a, b) => a - b)` (row-API path) returns
- *   NaN from the comparator on NaN inputs; V8 treats this as
- *   "equal" and leaves NaN cells in undefined order — the
- *   resulting percentile is whatever cell happens to land at the
- *   computed rank, possibly NaN itself.
- * - `Float64Array.prototype.sort()` (typed-array intrinsic) puts
- *   NaN deterministically at the end of the sorted view — the
- *   percentile rank then reads a non-NaN cell unless the rank
- *   lands in the NaN suffix.
- *
- * The first-pass NaN detection lets us use `Float64Array.sort`'s
- * 2× speedup for the common no-NaN case (full parity with row API
- * because both produce identical sorted orders when no NaN
- * present), and fall back to `Array.sort` with comparator only
- * when NaN is present (preserving bug-for-bug row-API parity on
- * the rare contract-violating input).
- *
- * NaN can only reach a `kind: 'number'` column via trusted
- * construction (`fromEvents`); the public `assertCellKind`
- * rejects it at intake. Closed Codex review finding on PR #153 —
- * earlier L2 fix that filtered NaN was correct in spirit but
- * introduced a *different* divergence from the row API. A
- * principled "filter NaN consistently across both paths" fix is
- * tracked in the followup issue.
+ * Empty (no defined+finite values) → `undefined`.
  */
 export function reducePercentileColumn(col, q) {
     const validity = col.validity;
     const values = col._values;
     let dense;
     let denseLength = 0;
-    let hasNaN = false;
-    if (validity === undefined) {
+    // Fast path: every defined cell is finite (`Float64Column.allFinite`),
+    // so we gather defined cells with no per-element `Number.isFinite`
+    // filter (reducer non-finite policy, docs/notes/reducer-nan-policy.md).
+    // The subsequent `Float64Array.sort` is the same NaN-free intrinsic
+    // either way → identical order, identical percentile.
+    if (col.allFinite) {
+        if (validity === undefined) {
+            if (col.length === 0)
+                return undefined;
+            dense = new Float64Array(col.length);
+            for (let i = 0; i < col.length; i += 1) {
+                dense[denseLength] = values[i];
+                denseLength += 1;
+            }
+        }
+        else {
+            const definedCount = validity.definedCount;
+            if (definedCount === 0)
+                return undefined;
+            dense = new Float64Array(definedCount);
+            const bits = validity.bits;
+            for (let i = 0; i < col.length; i += 1) {
+                if ((bits[i >> 3] & (1 << (i & 7))) === 0)
+                    continue;
+                dense[denseLength] = values[i];
+                denseLength += 1;
+            }
+        }
+    }
+    else if (validity === undefined) {
+        // Guarded path: filter non-finite before the sort.
         if (col.length === 0)
             return undefined;
         dense = new Float64Array(col.length);
         for (let i = 0; i < col.length; i += 1) {
             const v = values[i];
-            if (Number.isNaN(v))
-                hasNaN = true;
+            if (!Number.isFinite(v))
+                continue;
             dense[denseLength] = v;
             denseLength += 1;
         }
@@ -77,23 +90,16 @@ export function reducePercentileColumn(col, q) {
             if ((bits[i >> 3] & (1 << (i & 7))) === 0)
                 continue;
             const v = values[i];
-            if (Number.isNaN(v))
-                hasNaN = true;
+            if (!Number.isFinite(v))
+                continue;
             dense[denseLength] = v;
             denseLength += 1;
         }
     }
     if (denseLength === 0)
         return undefined;
-    if (hasNaN) {
-        // Match row-API exactly via `Array.sort` with comparator —
-        // diverges from `Float64Array.sort` on NaN ordering.
-        const arr = Array.from(dense.subarray(0, denseLength));
-        arr.sort((a, b) => a - b);
-        return percentileOfSorted(arr, q);
-    }
-    // No NaN: `Float64Array.sort` is parity-correct (same total
-    // order as `Array.sort` with comparator) and ~2× faster.
+    // Non-finite excluded upstream by policy → `Float64Array.sort` (numeric,
+    // NaN-free) gives the same order as the row path's comparator sort.
     const view = dense.subarray(0, denseLength);
     view.sort();
     const rank = (q / 100) * (denseLength - 1);

package/dist/reducers/stdev.js

@@ -20,9 +20,12 @@
  * agree to floating-point noise — bit-for-bit when they see the values in the
  * same order, which the bucketed paths do.
  *
- * `rollingState` is the exception: its sliding window needs `remove`, which
- * Welford can't do stably (windowed removal drifts), so it keeps the one-pass
- * `sq/n − mean²` (with its clamp). A stable rolling stdev is a deferred item.
+ * `rollingState` adds `remove` for its sliding window via Welford's
+ * **order-independent delete** (the reverse recurrence). It works in the same
+ * deviation space — no `sq/n − mean²` cancellation, no shift drift — and
+ * removes *by value*, so it stays correct under the live layer's reorder-mode
+ * eviction (which removes the sorted-prefix, not the oldest-arrived event).
+ * See its inline note for the mechanics.
  */
 // Welford accumulator: `add` each value, then read `result()` for the
 // population stdev (`undefined` if nothing was added). Shared by `reduce` and
@@ -54,20 +57,55 @@ export const stdev = {
     },
     reduceColumn(col) {
         // Inlined Welford (mirrors `welfordStdev`) over the packed array — a single
-        // pass, skipping gaps via the validity bitmask. One division per element vs
-        // the old two-pass's two divisionless scans, but identical to the other
-        // paths' recurrence so the fast path and row path cannot diverge.
+        // pass, skipping gaps via the validity bitmask and skipping non-finite
+        // cells (reducer non-finite policy, docs/notes/reducer-nan-policy.md). One
+        // division per finite element vs the old two-pass's two divisionless scans,
+        // but identical to the other paths' recurrence so the fast path and row
+        // path cannot diverge. `n` counts only finite contributors, so `n === 0`
+        // (no finite cells) → `undefined`.
         const values = col._values;
         const validity = col.validity;
         let n = 0;
         let mean = 0;
         let m2 = 0;
+        // Fast path: every defined cell is finite (`Float64Column.allFinite`),
+        // so the Welford recurrence runs over every defined cell with no
+        // per-element `Number.isFinite` guard (reducer non-finite policy,
+        // docs/notes/reducer-nan-policy.md). Same recurrence as the guarded
+        // path → identical result.
+        if (col.allFinite) {
+            const len = col.length;
+            if (validity === undefined) {
+                for (let i = 0; i < len; i += 1) {
+                    const v = values[i];
+                    n += 1;
+                    const delta = v - mean;
+                    mean += delta / n;
+                    m2 += delta * (v - mean);
+                }
+            }
+            else {
+                const bits = validity.bits;
+                for (let i = 0; i < len; i += 1) {
+                    if ((bits[i >> 3] & (1 << (i & 7))) === 0)
+                        continue;
+                    const v = values[i];
+                    n += 1;
+                    const delta = v - mean;
+                    mean += delta / n;
+                    m2 += delta * (v - mean);
+                }
+            }
+            return n === 0 ? undefined : Math.sqrt(Math.max(0, m2 / n));
+        }
+        // Guarded path: skip non-finite cells; `n` counts only finite
+        // contributors so `n === 0` (no finite cells) → `undefined`.
         if (validity === undefined) {
             const len = col.length;
-            if (len === 0)
-                return undefined;
             for (let i = 0; i < len; i += 1) {
                 const v = values[i];
+                if (!Number.isFinite(v))
+                    continue;
                 n += 1;
                 const delta = v - mean;
                 mean += delta / n;
@@ -75,21 +113,21 @@ export const stdev = {
             }
         }
         else {
-            if (validity.definedCount === 0)
-                return undefined;
             const bits = validity.bits;
             const len = col.length;
             for (let i = 0; i < len; i += 1) {
                 if ((bits[i >> 3] & (1 << (i & 7))) === 0)
                     continue;
                 const v = values[i];
+                if (!Number.isFinite(v))
+                    continue;
                 n += 1;
                 const delta = v - mean;
                 mean += delta / n;
                 m2 += delta * (v - mean);
             }
         }
-        return Math.sqrt(Math.max(0, m2 / n));
+        return n === 0 ? undefined : Math.sqrt(Math.max(0, m2 / n));
     },
     bucketState() {
         const w = welfordStdev();
@@ -104,32 +142,80 @@ export const stdev = {
         };
     },
     rollingState() {
-        // One-pass `sq/n − mean²` with the `Math.max(0, …)` clamp. Unlike the other
-        // paths this has a `remove` for the sliding window, which Welford can't do
-        // stably — a stable rolling stdev is deferred (see the module note above).
-        let s = 0;
-        let sq = 0;
+        // Sliding-window population stdev: Welford's online variance with an
+        // **order-independent delete**. `add(v)` is the standard recurrence;
+        // `remove(v)` reverses it. Working in deviation space, it fixes the old
+        // one-pass `sq/n − mean²` failure modes — catastrophic cancellation on
+        // near-equal large values (`[1e10, 1e10+1, …]` → 0 or a negative variance →
+        // NaN; the audit-§1.1 case, previously still live on this path) and shift
+        // drift on trending data (cumulative distance, elevation).
+        //
+        // Limitation — **outlier eviction** (shared with the old one-pass, so not a
+        // regression): like any *subtractive* sliding variance, evicting a value far
+        // outside the residual spread cancels — `m2 −= huge` loses the small
+        // remainder, and the error persists in the running accumulator (the clamp
+        // floors it to 0 at the extreme). Negligible until the evicted point is
+        // ~1e7–1e8× the residual stdev (e.g. a ~1e6 spike over a ~0.01-σ baseline) —
+        // far beyond realistic monitoring / activity data, and exactly why the
+        // add-only paths use plain Welford. A FIFO-only two-stack merge avoids it
+        // entirely but can't serve the by-value eviction the live layer needs.
+        //
+        // Removal is **by value, not by position**. That is load-bearing for the
+        // live layer: `LiveReduce` shares this state, and a `reorder`-mode source
+        // with retention evicts the sorted-prefix — which may be a later arrival,
+        // not the oldest — so a positional (FIFO) remove would corrupt the window.
+        // A value-based delete is correct regardless of eviction order (the
+        // documented contract; see live-reduce.ts and live-buffer-as-window.test).
+        // The batch rolling driver removes strictly oldest-first — a special case.
+        //
+        // Non-finite / missing cells arrive as `undefined` (the factory wrapper
+        // applies the non-finite policy); `add`/`remove` both skip them symmetrically
+        // so they never enter `n`.
         let n = 0;
+        let mean = 0;
+        let m2 = 0;
         return {
             add(_i, v) {
-                if (typeof v === 'number') {
-                    s += v;
-                    sq += v * v;
-                    n++;
-                }
+                if (typeof v !== 'number')
+                    return;
+                n += 1;
+                const delta = v - mean;
+                mean += delta / n;
+                m2 += delta * (v - mean);
             },
             remove(_i, v) {
-                if (typeof v === 'number') {
-                    s -= v;
-                    sq -= v * v;
-                    n--;
+                if (typeof v !== 'number')
+                    return;
+                if (n <= 1) {
+                    // Removing the final contributor — reset exactly (no 0/0, no drift).
+                    n = 0;
+                    mean = 0;
+                    m2 = 0;
+                    return;
+                }
+                const meanWith = mean;
+                n -= 1;
+                if (n === 1) {
+                    // A single remaining element has population variance *exactly* 0.
+                    // Setting it directly (rather than via the subtraction below) keeps
+                    // the n→1 result exact at any magnitude — the reverse step alone
+                    // leaves rounding residue at large offsets (e.g. ~0.016 on 1e10).
+                    mean = meanWith * 2 - v; // the one survivor: 2·mean₂ − removed
+                    m2 = 0;
+                    return;
                 }
+                // Deviation-space mean update (mean − (v − mean)/n): avoids the large
+                // `n·mean − v` product, staying precise at large magnitudes.
+                mean = meanWith - (v - meanWith) / n;
+                // Reverse Welford: M2 −= (v − meanNew)·(v − meanOld).
+                m2 -= (v - mean) * (v - meanWith);
+                // Normally absorbs FP round-off; on a gross outlier eviction (see the
+                // limitation note above) the subtraction can cancel below 0 — clamp.
+                if (m2 < 0)
+                    m2 = 0;
             },
             snapshot() {
-                if (n === 0)
-                    return undefined;
-                const mean = s / n;
-                return Math.sqrt(Math.max(0, sq / n - mean * mean));
+                return n === 0 ? undefined : Math.sqrt(Math.max(0, m2 / n));
             },
         };
     },

package/dist/reducers/sum.js

@@ -7,18 +7,42 @@ export const sum = {
         const values = col._values;
         const validity = col.validity;
         let s = 0;
+        // Fast path: the column proved every defined cell is finite
+        // (`Float64Column.allFinite`), so we can drop the per-element
+        // `Number.isFinite` guard the reducer non-finite policy
+        // (docs/notes/reducer-nan-policy.md) otherwise requires — plain
+        // accumulate, identical result.
+        if (col.allFinite) {
+            if (validity === undefined) {
+                for (let i = 0; i < col.length; i += 1)
+                    s += values[i];
+                return s;
+            }
+            const bits = validity.bits;
+            for (let i = 0; i < col.length; i += 1) {
+                if ((bits[i >> 3] & (1 << (i & 7))) !== 0)
+                    s += values[i];
+            }
+            return s;
+        }
+        // Guarded path: finiteness not proven, skip non-finite per policy.
         if (validity === undefined) {
-            // Hot path: every cell defined; no per-row branch.
-            for (let i = 0; i < col.length; i += 1)
-                s += values[i];
+            for (let i = 0; i < col.length; i += 1) {
+                const v = values[i];
+                if (Number.isFinite(v))
+                    s += v;
+            }
             return s;
         }
         // Inline bitmap check rather than method dispatch — same pattern
         // the chart-friction-spike notes flagged for hot draw loops.
         const bits = validity.bits;
         for (let i = 0; i < col.length; i += 1) {
-            if ((bits[i >> 3] & (1 << (i & 7))) !== 0)
-                s += values[i];
+            if ((bits[i >> 3] & (1 << (i & 7))) !== 0) {
+                const v = values[i];
+                if (Number.isFinite(v))
+                    s += v;
+            }
         }
         return s;
     },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pond-ts",
-  "version": "0.24.0",
+  "version": "0.25.0",
   "description": "TypeScript-first time series primitives",
   "license": "MIT",
   "repository": {