fix!: keep authorized snapshot live queries subscribed

[patrickleet]

Why

A row-filtered @live query should keep updating without revealing activity from rows the viewer cannot read. Previously the server correctly withheld partition-wide resume cursors, but reported supported: false; the client treated that as unavailable live delivery, closed the stream, and performed one HTTP refresh. Later authorized changes no longer reached the UI.

What changes

Live delivery now distinguishes authorized replacement snapshots from resumable projection streams:

{ "mode": "snapshot", "reset": true, "cursors": [] }

{ "mode": "resumable", "reset": false, "cursors": [{ "projection": "items", "position": "7", "token": "opaque" }] }

Applications keep writing ordinary queries:

query MyItems @load @live {
  items { item_id title }
}

Read permissions still decide which rows are visible. Snapshot delivery carries no comparable index vector or projection observations, cannot confirm optimistic commands, and never uses partition-wide resume tokens. Visible updates and removals continue through the subscription; denied-row changes produce no activity frame.

The replica preserves SSR hydration without an extra first fetch, fences older overlapping HTTP responses and disposed/auth-invalidated subscriptions, and restarts a snapshot stream after an explicitly newer HTTP refresh. Existing resumable replay and cross-operation causal fences remain intact. The gateway does not use cursorless frames as shared replay-handoff evidence.

Breaking v5 protocol change

live.mode replaces live.supported. Upgrade server and client runtime together. Old/unknown modes fail closed; no compatibility branch or application polling workaround.

Validation

• JavaScript suite: 374 passed, including original SSR/rehydration assertions plus snapshot-mode coverage.
• TypeScript and generated-artifact type checks: passed.
• Rust protocol unit tests: 22 passed.
• SQLite query-protocol integration: 17 passed, including visible update/removal, denied-row update/deletion, and fresh reconnect.
• Gateway-enabled query protocol: 24 passed, 3 pre-existing opt-in tests not run locally; edge delivery: 8 passed.
• CI will run the broader backend, gateway, and end-to-end matrix.

No user-facing UI copy is added. README and protocol documentation explain the new wire contract.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: c5505fc6-1952-4916-886d-8d11e4d113af

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}