@harperfast/harper 5.2.13 → 5.3.0-beta.1

package/resources/Table.ts

@@ -14,8 +14,9 @@ import {
 import { type Database } from 'lmdb';
 import { Script } from 'node:vm';
 import { randomUUID } from 'node:crypto';
-import { getIndexedValues } from '../utility/lmdb/commonUtility.ts';
-import { getThisNodeId, exportIdMapping } from './nodeIdMapping.ts';
+import { performance } from 'node:perf_hooks';
+import { getIndexedValues, getNextMonotonicTime } from '../utility/lmdb/commonUtility.ts';
+import { getThisNodeId, exportIdMapping, getNodeNameForId } from './nodeIdMapping.ts';
 import lodash from 'lodash';
 import { ExtendedIterable, SKIP } from '@harperfast/extended-iterable';
 import type {
@@ -40,25 +41,42 @@ import {
 	isReleasedTransaction,
 	TRANSACTION_STATE,
 	writeKeyId,
+	closeWriteInstance,
+	type WriteGeneration,
 } from './DatabaseTransaction.ts';
+import {
+	acquireRecordKey,
+	lockAttemptKey,
+	lockNotHeldError,
+	resolveLockOptions,
+	type RecordLockHandle,
+	type RecordLockOptions,
+	type ResolvedRecordLockOptions,
+} from './recordLock.ts';
+import { getThisNodeName } from '../server/nodeName.ts';
 import * as envMngr from '../utility/environment/environmentManager.ts';
 import { addSubscription } from './transactionBroadcast.ts';
 import {
+	DerivedIndexLagError,
 	handleHDBError,
 	ClientError,
 	ServerError,
 	AccessViolation,
 	ValidationError,
+	UpdateAttributesLockTimeoutError,
+	LockUnavailableError,
 	appendErrorContext,
 	type ValidationIssue,
 } from '../utility/errors/hdbError.ts';
 import * as signalling from '../utility/signalling.ts';
 import { SchemaEventMsg, UserEventMsg } from '../server/threads/itc.js';
 import { databases, table } from './databases.ts';
+import { notifyReplicatedApplyFailure } from './replicatedApplyFailure.ts';
 import {
 	searchByIndex,
 	findAttribute,
 	estimateCondition,
+	estimatedEntryCount,
 	flattenKey,
 	COERCIBLE_OPERATORS,
 	executeConditions,
@@ -66,11 +84,44 @@ import {
 } from './search.ts';
 import { logger } from '../utility/logging/logger.ts';
 import { isStaticResourceInstance } from './staticResourceDispatch.ts';
-import { Addition, assignTrackedAccessors, updateAndFreeze, hasChanges, GenericTrackedObject } from './tracked.ts';
+import {
+	Addition,
+	assignTrackedAccessors,
+	updateAndFreeze,
+	hasChanges,
+	GenericTrackedObject,
+	ASSERT_TRACKED_WRITABLE,
+	GET_TRACKED_WRITE_GENERATION,
+} from './tracked.ts';
 import { transaction, contextStorage } from './transaction.ts';
 import { MAXIMUM_KEY, writeKey, compareKeys } from 'ordered-binary';
-import { getWorkerIndex, getWorkerCount } from '../server/threads/manageThreads.js';
-import { HAS_BLOBS, auditRetention, removeAuditEntry } from './auditStore.ts';
+import {
+	getWorkerIndex,
+	applicationWorkerIndex,
+	ownsStoreMaintenance,
+	ownsStoreExpiration,
+	runsApplicationCodeSingletons,
+	isDedicatedWorker,
+} from '../server/threads/manageThreads.js';
+import {
+	HAS_BLOBS,
+	LOCAL_ONLY,
+	auditRetention,
+	removeAuditEntry,
+	raiseAuditFloor,
+	boundedAuditPruneEnd,
+	isLockControlType,
+} from './auditStore.ts';
+import { derivedIndexWriteRejection, hasDerivedIndexRegistration } from './derivedIndexRegistry.ts';
+import {
+	decodeLockControlPayload,
+	encodeLockControlPayload,
+	getClusterLockTransport,
+	isClusterLockRequired,
+	setLockCoordinatorResolver,
+	LockCoordinator,
+	type LockControlEntry,
+} from './recordLockCoordinator.ts';
 import { buildEmbedBefore, createDefaultEmbedder, type EmbedAttribute, type Embedder } from './models/embedHook.ts';
 import { autoCast, autoCastBooleanStrict } from '../utility/common_utils.ts';
 import {
@@ -79,6 +130,7 @@ import {
 	PENDING_LOCAL_TIME,
 	RecordObject,
 	type Entry,
+	type StructureCounts,
 	entryMap,
 	storedFieldsOnly,
 } from './RecordEncoder.ts';
@@ -87,7 +139,12 @@ import { rebuildUpdateBefore } from './crdt.ts';
 import { appendHeader } from '../server/serverHelpers/Headers.ts';
 import fs from 'node:fs';
 import { Blob, deleteBlobsInObject, findBlobsInObject, startPreCommitBlobsForRecord } from './blob.ts';
-import { onStorageReclamation, removeStorageReclamation, getStorageSpaceStats } from '../server/storageReclamation.ts';
+import {
+	onStorageReclamation,
+	removeStorageReclamation,
+	removeStorageReclamationHandler,
+	getStorageSpaceStats,
+} from '../server/storageReclamation.ts';
 import { RequestTarget } from './RequestTarget.ts';
 import harperLogger from '../utility/logging/harper_logger.ts';
 import { throttle } from '../server/throttle.ts';
@@ -130,8 +187,14 @@ type MaybePromise<T> = T | Promise<T>;
 
 const NULL_WITH_TIMESTAMP = new Uint8Array(9);
 NULL_WITH_TIMESTAMP[8] = 0xc0; // null
+const sourceWriteTypes = new Set(['put', 'patch', 'delete', 'publish', 'message', 'invalidate', 'relocate']);
+const isSourceWriteType = (type: string) => sourceWriteTypes.has(type);
+const SOURCE_APPLY_POSITION = Symbol('sourceApplyPosition');
 const UNCACHEABLE_TIMESTAMP = Infinity; // we use this when dynamic content is accessed that we can't safely cache, and this prevents earlier timestamps from change the "last" modification
+const MAX_DATE_TIMESTAMP = 8.64e15;
 const RECORD_PRUNING_INTERVAL = 60000; // one minute
+const MAX_CONCURRENT_HISTORY_REMOVALS = 10;
+const MAX_CONCURRENT_LMDB_HISTORY_REMOVALS = 1000;
 // RocksDB-only: number of eviction/tombstone removals coalesced into a single transaction commit.
 // Each evict otherwise pays a full transaction commit, so batching amortizes that cost. LMDB already
 // coalesces async writes per event turn (eventTurnBatching), so it keeps the per-record path.
@@ -140,6 +203,20 @@ const EVICTION_BATCH_SIZE = 100;
 // letting an unbounded number of open transactions (and their snapshots) accumulate.
 const MAX_INFLIGHT_EVICTION_BATCHES = 4;
 const CACHEABLE_STATUS_CODES = new Set([200, 203, 204, 206, 300, 301, 308, 404, 405, 410, 414, 501]);
+// Guardrails for `Prefer: count=exact`: once the requested page has been collected, counting the rest
+// of the match set is bounded by BOTH a row cap and a wall-clock budget, so a paginated read can't turn
+// into an unbounded scan. Exceeding either reports an unknown total (Content-Range `.../*`) rather than
+// truncating the page. These bound the count tail, not the page itself; a genuinely expensive query
+// (large filtered full-scan, in-memory sort) should still be gated by config before broad exposure.
+const MAX_EXACT_COUNT_SCAN = 1_000_000;
+const MAX_EXACT_COUNT_MS = 1_000;
+// Largest page a `Prefer: count=` request will materialize. A request whose limit exceeds this (or is
+// not a finite, non-negative integer, e.g. `limit(Infinity)`/`limit(foo)`) falls through to the normal
+// streaming path with no count, so a count request can't be coerced into buffering an unbounded page.
+const MAX_COUNT_PAGE = 10_000;
+// How often the exact-count drain yields to the macrotask queue (must be a power of two for the bit-mask
+// check). Keeps a large scan from monopolizing the event loop without adding a yield per row.
+const COUNT_YIELD_INTERVAL = 2_048;
 // Smallest forward sample `getRecordCount` will extrapolate a record rate from; below it the scan runs
 // to completion and reports an exact count.
 const MIN_ESTIMATOR_SAMPLE = 1_000;
@@ -157,6 +234,76 @@ function usableCount(estimate: any): number {
 envMngr.initSync();
 const LMDB_PREFETCH_WRITES = envMngr.get(CONFIG_PARAMS.STORAGE_PREFETCHWRITES);
 const LOCK_TIMEOUT = 10000;
+// This bounds schema-lock acquisition; LOCK_TIMEOUT bounds in-flight record writes during a drop.
+export const UPDATE_ATTRIBUTES_LOCK_TIMEOUT = 10000;
+const UPDATE_ATTRIBUTES_LOCK = 'update-attributes';
+// Contention is otherwise only visible once it becomes a timeout (harper#2251).
+export const UPDATE_ATTRIBUTES_LOCK_SLOW_WAIT = 1000;
+// raw ASCII bytes are ordered-binary's encoding of the string, so this addresses the same native
+// lock as string-keyed tryLock/unlock calls
+const updateAttributesLockKey = Buffer.from(UPDATE_ATTRIBUTES_LOCK);
+const lockWait = new Int32Array(new SharedArrayBuffer(4));
+
+/** The wait blocks the event loop, so the locked section must stay synchronous. */
+export function acquireUpdateAttributesLock(
+	rootStore: RocksDatabase,
+	scopeDescription: string,
+	timeout = UPDATE_ATTRIBUTES_LOCK_TIMEOUT
+) {
+	if (rootStore.tryLock(updateAttributesLockKey)) return;
+	const startTime = performance.now();
+	let waitTime = 1;
+	while (!rootStore.tryLock(updateAttributesLockKey)) {
+		const elapsed = performance.now() - startTime;
+		if (elapsed >= timeout) {
+			throw new UpdateAttributesLockTimeoutError(
+				`Timed out after ${Math.round(elapsed)}ms waiting for the exclusive '${UPDATE_ATTRIBUTES_LOCK}' lock on ${scopeDescription}; the lock holder did not release it before the deadline, so this schema/attribute update cannot proceed`
+			);
+		}
+		if (elapsed >= 2) {
+			Atomics.wait(lockWait, 0, 0, Math.min(waitTime, timeout - elapsed));
+			if (waitTime < 16) waitTime *= 2;
+		}
+	}
+	const waited = performance.now() - startTime;
+	// The caller cannot register its release until we return, so a throw here would leak the lock
+	// with no `finally` able to reach it.
+	if (waited >= UPDATE_ATTRIBUTES_LOCK_SLOW_WAIT)
+		try {
+			logger.warn?.(
+				`Acquired the exclusive '${UPDATE_ATTRIBUTES_LOCK}' lock on ${scopeDescription} after waiting ${Math.round(waited)}ms; this worker's event loop was blocked for that wait, and a holder that runs past ${UPDATE_ATTRIBUTES_LOCK_TIMEOUT}ms fails the update outright`
+			);
+		} catch {}
+}
+
+export function releaseUpdateAttributesLock(rootStore: RocksDatabase) {
+	rootStore.unlock(updateAttributesLockKey);
+}
+
+export function withUpdateAttributesLock<Callback extends () => unknown>(
+	rootStore: RocksDatabase,
+	scopeDescription: string,
+	callback: Callback & (ReturnType<Callback> extends PromiseLike<unknown> ? never : unknown)
+): ReturnType<Callback> {
+	acquireUpdateAttributesLock(rootStore, scopeDescription);
+	try {
+		const result = callback();
+		if (typeof (result as any)?.then === 'function') {
+			Promise.resolve(result).catch((error) =>
+				logger.error?.(
+					`Async update-attributes callback rejected after its lock was released (${scopeDescription})`,
+					error
+				)
+			);
+			throw new TypeError(
+				`withUpdateAttributesLock callback must be synchronous (${scopeDescription}); asynchronous work may continue after the lock is released`
+			);
+		}
+		return result as ReturnType<Callback>;
+	} finally {
+		releaseUpdateAttributesLock(rootStore);
+	}
+}
 // Tolerate a redundant column family drop. Drops are broadcast to every worker
 // thread and each holds its own handle to the same underlying family, so a
 // concurrent worker may already have dropped it; the storage engine reports
@@ -395,6 +542,54 @@ function chainKeyForId(id: any): string {
 	return typeof id === 'string' ? 's' + id : 'k' + writeKeyId(id);
 }
 
+/** Normalizes a passed `context` argument as `transactional()` does; undefined means fall back to ambient. */
+function contextArgument(context: unknown): any {
+	if (!context || isReleasedTransaction(context)) return undefined;
+	const resolved = (context as any).getContext?.() || context;
+	return resolved instanceof DatabaseTransaction ? { transaction: resolved } : resolved;
+}
+
+/** The cluster round never ran for a node-scoped handle, so no peer ever deferred to it. */
+function scopeViolation(
+	handle: RecordLockHandle,
+	resolved: ResolvedRecordLockOptions,
+	databaseName: string
+): ClientError | undefined {
+	if (resolved.scope !== 'cluster' || handle.clusterTsR !== undefined) return undefined;
+	// The same predicate lock() fails closed on, not the transport alone: a coalesced caller re-checks
+	// this after its wait, and a transport unregistered during that wait leaves the database still
+	// clustered while the lookup answers undefined. Only the implicit Phase 0 case falls through.
+	if (!resolved.scopeRequested && !isClusterLockRequired(databaseName) && !getClusterLockTransport(databaseName))
+		return undefined;
+	return new ClientError(
+		'This transaction already holds a node-scoped lock on this record, so a cluster-scoped lock cannot be taken on top of it',
+		409
+	);
+}
+
+/** Distinguishes bare lock options from a record target (id, URL, {id:...}). */
+function isPlainOptions(value: unknown): boolean {
+	return (
+		typeof value === 'object' &&
+		value !== null &&
+		!Array.isArray(value) &&
+		!(value instanceof URLSearchParams) &&
+		(value as any).id === undefined
+	);
+}
+
+// Lets a transport push a received control entry straight to the right coordinator without
+// importing Table (which would be a cycle through databases.ts).
+setLockCoordinatorResolver(
+	(database: string, tableName: string) => (databases as any)[database]?.[tableName]?.lockCoordinator,
+	(database: string, tableName: string) => (databases as any)[database]?.[tableName]?.admittingCoordinator,
+	(database: string, tableName: string) => {
+		const Table = (databases as any)[database]?.[tableName];
+		if (typeof Table?.writeLockControlEntry !== 'function') return undefined;
+		return (entry: LockControlEntry) => Table.writeLockControlEntry(entry);
+	}
+);
+
 export function makeTable(options) {
 	const {
 		primaryKey,
@@ -413,8 +608,14 @@ export function makeTable(options) {
 		description,
 		hidden,
 		cacheControl,
+		isBranch,
 	} = options;
 	let { expirationMS: expirationMs, evictionMS: evictionMs, audit, trackDeletes } = options;
+	// Set when the TTL exists only on this thread: either application code configured it at runtime, or
+	// an isolated application's schema was declared here. Hydrating persisted metadata does not set it:
+	// dedicated workers open unrelated shared tables too, whose scan remains owned by the pool.
+	let ttlConfiguredByApplication = false;
+	let ttlFromLoad = false; // true only around the creation-time call below
 	evictionMs ??= 0;
 	// Eviction without explicit expiration means expiration:0. Apply at construction so
 	// describe_all sees it on every worker, not just ones that ran setTTLExpiration.
@@ -424,7 +625,11 @@ export function makeTable(options) {
 	if (!attributes) attributes = [];
 	if (!properties) properties = projectAttributesToProperties(attributes);
 	const updateRecord = recordUpdater(primaryStore, tableId, auditStore);
+	// Created on first cluster-scoped lock() or first arriving control entry, and only while a
+	// transport is registered for this database.
+	let lockCoordinator: LockCoordinator | undefined;
 	let warnedNullSourcePut = false; // latched: one warn per table per worker (see _writeUpdate)
+	let warnedFutureSourceVersion = false; // likewise (see getFromSource)
 	let sourceLoad: any; // if a source has a load function (replicator), record it here
 	let hasSourceGet: any;
 	let primaryKeyAttribute: Attribute | undefined;
@@ -454,8 +659,12 @@ export function makeTable(options) {
 	let nonPrefetchSequence = 2;
 	let cleanupInterval = 86400000;
 	let cleanupPriority = 0;
-	let lastCleanupInterval: number;
+	let lastCleanupInterval: number | undefined;
 	let cleanupTimer: NodeJS.Timeout;
+	let recordExpirationInterval: NodeJS.Timeout;
+	// a reclamation pass awaits a scheduled cleanup, which only settles from its timer
+	const pendingCleanupResolvers = new Set<() => void>();
+	let disposed = false;
 	// true once a table-level expiration/eviction/scanInterval has armed the periodic cleanup scan at setup
 	let expirationScanScheduled = false;
 	// set on the first expiring write so the unscheduled-expiration warning is evaluated at most once per table
@@ -504,9 +713,10 @@ export function makeTable(options) {
 	const MAX_PREFETCH_SEQUENCE = 10;
 	const MAX_PREFETCH_BUNDLE = 6;
 	if (audit) addDeleteRemoval();
-	onStorageReclamation(primaryStore.path, (priority: number) => {
+	const reclamationHandler = (priority: number) => {
 		if (hasSourceGet) return scheduleCleanup(priority);
-	});
+	};
+	onStorageReclamation(primaryStore.path, reclamationHandler);
 
 	class Updatable extends GenericTrackedObject implements RecordObject {
 		declare set: (property: string, value: any) => void;
@@ -597,13 +807,102 @@ export function makeTable(options) {
 			},
 		});
 	}
+	function resolveAuditHead(
+		id: Id,
+		version: number | undefined,
+		nodeId: number | undefined,
+		refs?: Array<{ version: number; nodeId: number }>
+	) {
+		if (!refs?.length) return { txnLogKey: version, nodeId };
+		const visited = new Set<string>();
+		function findHead(candidateRefs?: Array<{ version: number; nodeId: number }>) {
+			if (!candidateRefs) return;
+			const pending: Array<{ version: number; nodeId: number }> = candidateRefs.slice().reverse();
+			while (pending.length > 0) {
+				const ref = pending.pop()!;
+				const identity = `${ref.nodeId ?? 0}:${ref.version}`;
+				if (visited.has(identity)) continue;
+				visited.add(identity);
+				const entry = auditStore.getSync(ref.version, tableId, id, ref.nodeId);
+				if (!entry) continue;
+				if (entry.version === version && (nodeId == null || (entry.nodeId ?? 0) === nodeId))
+					return { txnLogKey: ref.version, nodeId: ref.nodeId };
+				const previousRefs = entry.previousAdditionalAuditRefs;
+				if (previousRefs) {
+					for (let index = previousRefs.length - 1; index >= 0; index--) pending.push(previousRefs[index]);
+				}
+			}
+		}
+		const referencedHead = findHead(refs);
+		if (referencedHead) return referencedHead;
+		if (version != null) {
+			const directHead = auditStore.getSync(version, tableId, id, nodeId);
+			if (directHead?.version === version && (nodeId == null || (directHead.nodeId ?? 0) === nodeId))
+				return { txnLogKey: version, nodeId };
+		}
+		return { txnLogKey: version, nodeId };
+	}
+	// Canonical-source applies (sourceApply), replay and replication notifications are never shed;
+	// dropping one would advance the source cursor past a write that never landed.
+	function assertDerivedIndexAdmission(options: any, transaction: any) {
+		if (options?.isNotification || transaction?.sourceApply || transaction?.isReplay) return;
+		const reason = derivedIndexWriteRejection(auditStore, tableId);
+		if (reason) throw new DerivedIndexLagError(reason);
+	}
+	function stageDerivedIndexEviction(transaction: RocksTransaction, id: Id, version: number) {
+		if (!hasDerivedIndexRegistration(auditStore, tableId)) return;
+		const nodeId = getThisNodeId(auditStore) ?? 0;
+		auditStore.put(
+			null,
+			{
+				type: 'evict',
+				tableId,
+				recordId: id,
+				version,
+				nodeId,
+				extendedType: LOCAL_ONLY,
+			},
+			{ transaction, nodeId }
+		);
+	}
 	class TableResource<Record extends object = any> extends Resource<Record> {
 		#record: any; // the stored/frozen record from the database and stored in the cache (should not be modified directly)
 		#changes: any; // the changes to the record that have been made (should not be modified directly)
 		#version?: number; // version of the record
 		#entry?: Entry; // the entry from the database
 		#savingOperation?: any; // operation for the record is currently being saved
+		#lockHandle?: RecordLockHandle; // the record lock acquired by lock() — scoped or hold
+		#lockWritable?: boolean; // set by #reloadLocked to let save() stage lock-writable updates
+		#writeGeneration?: WriteGeneration;
 		declare getProperty: (name: string) => any;
+		[ASSERT_TRACKED_WRITABLE](generation = this.#writeGeneration): void {
+			if (!generation) return;
+			if (generation.internalWrites > 0) return;
+			if (generation !== this.#writeGeneration || generation.closed)
+				throw new ClientError('Can not modify an update instance after it has been saved; call update() again', 409);
+		}
+		[GET_TRACKED_WRITE_GENERATION](): WriteGeneration {
+			return (this.#writeGeneration ??= { closed: false, internalWrites: 0 });
+		}
+
+		/**
+		 * Shared guard: if this instance is lock-writable but the handle is gone (expired or
+		 * released), throw 409 before staging any write. Covers update/invalidate/relocate/delete
+		 * in addition to the save() path. Every lock-writable instance carries its own handle in
+		 * #lockHandle (scoped and hold alike), so we never need to search the registry here.
+		 */
+		#assertLiveHandle(id: Id, allowClosed = false): void {
+			if (!allowClosed && this.#writeGeneration?.closed && writeKeyId(id) === writeKeyId(this.getId()))
+				this[ASSERT_TRACKED_WRITABLE]();
+			if (!this.#lockWritable) return;
+			const handle = this.#lockHandle!;
+			// Off-key writes through the same resource instance are ordinary; only guard the
+			// exact key the lock was acquired for.
+			if (handle.keyId !== writeKeyId(id)) return;
+			if (handle.isExpired()) {
+				throw lockNotHeldError(handle);
+			}
+		}
 		// #section: static-config
 		static name = tableName; // for display/debugging purposes
 		static primaryStore = primaryStore;
@@ -612,6 +911,13 @@ export function makeTable(options) {
 		static tableName = tableName;
 		static tableId = tableId;
 		static indices = indices;
+		static derivedIndexRuntime:
+			| {
+					close(dropping?: boolean): Promise<void>;
+					restoreAfterFailedDrop?(): typeof TableResource.derivedIndexRuntime;
+					completeDrop?(dropped?: boolean): void;
+			  }
+			| undefined;
 		static audit = audit;
 		static databasePath = databasePath;
 		static databaseName = databaseName;
@@ -698,8 +1004,65 @@ export function makeTable(options) {
 			(async () => {
 				let userRoleUpdate = false;
 				let lastSequenceId;
+				let pendingApplyFailures: Promise<void> | undefined;
+				const reportDroppedWrite = (event, context, error) => {
+					const position =
+						event === context ? context[SOURCE_APPLY_POSITION] : (event.timestamp ?? context[SOURCE_APPLY_POSITION]);
+					const notification = notifyReplicatedApplyFailure(
+						databaseName,
+						{
+							nodeId: event.nodeId ?? context.nodeId,
+							table: event.table ?? context.table,
+							localTime: event.localTime ?? context.localTime,
+						},
+						position,
+						error,
+						tableName
+					);
+					pendingApplyFailures = pendingApplyFailures
+						? Promise.all([pendingApplyFailures, notification]).then(noop)
+						: notification;
+					return notification;
+				};
+				/** Cluster lock coordination entries (harper#483 Phase 1) describe no record. */
+				const applyLockControlEvent = (event, context) => {
+					const entry = decodeLockControlPayload(event.type, event.value);
+					if (!entry) {
+						logger.warn?.('discarding a malformed record lock control entry from', event.nodeId, event.type);
+						return reportDroppedWrite(event, context, new Error('Malformed record lock control entry'));
+					}
+					const target = event.table ? databases[databaseName]?.[event.table] : TableResource;
+					try {
+						// The audit header's nodeId is the origin, translated on receive and preserved across
+						// relays. The payload's own names are peer-supplied and prove nothing. Rebuild the id
+						// map on a miss rather than waiting out the negative-cache window: a dropped release
+						// leaves the key's home holding its grant until the delegation's own deadline, and
+						// control entries are far too rare to drive the store.
+						//
+						// Inside the guard, not before it: that rebuild reads the audit store, and a throw
+						// there would escape this sink and stall the apply loop for every later entry — the §8
+						// rule that a receive boundary settles its callers and keeps admission closed.
+						const author = getNodeNameForId(auditStore, event.nodeId, true);
+						if (!author) {
+							logger.warn?.('discarding a record lock control entry whose origin node could not be resolved');
+							return reportDroppedWrite(event, context, new Error('Record lock control origin could not be resolved'));
+						}
+						// The coordinator getter fails closed on an unusable node identity. That is right for
+						// an acquire and wrong here: rejecting out of this sink stalls the apply loop for
+						// every later entry rather than dropping one.
+						// `admittingCoordinator`, because `lockCoordinator` answers undefined while a transport
+						// is momentarily unregistered — and this sink runs off the replication stream, not off
+						// that transport. Dropping a peer's clean-handoff release there leaves the home holding
+						// its grant for the delegation's whole deadline.
+						target?.admittingCoordinator?.applyEntry(entry, author, event.timestamp);
+					} catch (error) {
+						logger.warn?.('dropping a record lock control entry: the coordinator is unavailable', error);
+						return reportDroppedWrite(event, context, error);
+					}
+				};
 				// perform the write of an individual write event
 				const writeUpdate = async (event, context) => {
+					if (isLockControlType(event.type)) return applyLockControlEvent(event, context);
 					const value = event.value;
 					const Table = event.table ? databases[databaseName][event.table] : TableResource;
 					if (
@@ -719,6 +1082,9 @@ export function makeTable(options) {
 						ensureLoaded: false,
 						nodeId: event.nodeId,
 						viaNodeId: event.viaNodeId,
+						// the origin's record version, stored as-is so every replica holds the version the
+						// origin holds; the transaction's own timestamp stays the origin's log key
+						version: event.version,
 						// use per-event expiresAt: batched txn context only holds the first event's expiration
 						expiresAt: event.expiresAt,
 						// bulk base-copy snapshot frame: apply current-state directly, without an audit/transaction-log
@@ -728,6 +1094,14 @@ export function makeTable(options) {
 						async: true,
 					};
 					const id = event.id;
+					if (!isSourceWriteType(event.type)) {
+						logger.error?.('Unknown operation', event.type, event.id);
+						const notification = reportDroppedWrite(event, context, new Error('Unknown source operation'));
+						if (event.finished) await event.finished;
+						return notification;
+					}
+					if (Table && event.type === 'put' && value == null && !shouldRevalidateEvents)
+						await reportDroppedWrite(event, context, new Error('Source-applied put has no record content'));
 					const resource: TableResource = await Table.getResource(id, context, options);
 					if (event.finished) await event.finished;
 					switch (event.type) {
@@ -748,13 +1122,18 @@ export function makeTable(options) {
 							return resource._writeInvalidate(id, value, options);
 						case 'relocate':
 							return resource._writeRelocate(id, options);
-						default:
-							logger.error?.('Unknown operation', event.type, event.id);
 					}
 				};
 
 				/** Keeps the writes to any one key in arrival order; see DESIGN.md (harper#2211). */
 				const stageWrite = (event, context) => {
+					// A grant must not queue behind whatever the key it names is doing.
+					if (
+						isLockControlType(event.type) ||
+						!isSourceWriteType(event.type) ||
+						(event.type === 'put' && event.value == null && !shouldRevalidateEvents)
+					)
+						return writeUpdate(event, context);
 					let chainKey: string | undefined;
 					try {
 						const Table = event.table ? databases[databaseName][event.table] : TableResource;
@@ -794,14 +1173,18 @@ export function makeTable(options) {
 						omitCurrent: true,
 					};
 					const subscribeOnThisThread = source.subscribeOnThisThread
-						? source.subscribeOnThisThread(getWorkerIndex(), subscriptionOptions)
-						: getWorkerIndex() === 0;
+						? source.subscribeOnThisThread(applicationWorkerIndex(), subscriptionOptions)
+						: runsApplicationCodeSingletons(); // set up by the defining application's code, so it runs where that code does
 					const subscription = hasSubscribe && subscribeOnThisThread && (await source.subscribe?.(subscriptionOptions));
 					if (subscription) {
 						let txnInProgress;
 						// we listen for events by iterating through the async iterator provided by the subscription
 						for await (const event of subscription) {
+							let failureEvent = event;
+							let failurePosition: number | undefined;
+							let applied = false;
 							try {
+								failurePosition = event?.timestamp;
 								if (!event || typeof event !== 'object') {
 									logger.error?.('Bad subscription event', event);
 									continue;
@@ -809,6 +1192,13 @@ export function makeTable(options) {
 								const firstWrite = event.type === 'transaction' ? event.writes[0] : event;
 								if (!firstWrite) {
 									logger.error?.('Bad subscription event', event);
+									await notifyReplicatedApplyFailure(
+										databaseName,
+										event,
+										failurePosition,
+										new Error('Subscription transaction has no writes'),
+										tableName
+									);
 									continue;
 								}
 								event.source = source;
@@ -817,11 +1207,16 @@ export function makeTable(options) {
 								// there is no re-subscribe / sequence-id-resume path to recover it. Mark the context so the
 								// commit retries such conflicts without a cap (see DatabaseTransaction commit).
 								event.sourceApply = true;
+								event[SOURCE_APPLY_POSITION] = failurePosition;
 								if (event.type === 'end_txn') {
 									// Capture the in-progress transaction in a stable local: the loop variable is reset
 									// once this transaction completes (below), but the seq-id closure and the commit await
 									// still need to reference it afterward.
 									const committingTxn = txnInProgress;
+									if (committingTxn) {
+										failureEvent = committingTxn;
+										failurePosition = committingTxn[SOURCE_APPLY_POSITION];
+									}
 									committingTxn?.resolve();
 									let updateRecordedSequenceId: () => MaybePromise<void>;
 									if (event.localTime && lastSequenceId !== event.localTime) {
@@ -911,6 +1306,7 @@ export function makeTable(options) {
 									let committed;
 									try {
 										committed = committingTxn ? await committingTxn.committed : undefined;
+										applied = true;
 										if (event.onCommit) {
 											// the onCommit callback can be async and carry associated work (e.g. blob
 											// transfer); wait for it too before recording the sequence id. Pass the commit
@@ -944,6 +1340,13 @@ export function makeTable(options) {
 											// than rethrow) so the current beginTxn still starts a fresh transaction with
 											// correct boundaries instead of having its writes applied as standalone ones.
 											logger.error?.('source-applied transaction commit failed during apply', error);
+											await notifyReplicatedApplyFailure(
+												databaseName,
+												txnInProgress,
+												txnInProgress[SOURCE_APPLY_POSITION],
+												error,
+												tableName
+											);
 										} finally {
 											// Clear it regardless of outcome so a rejected commit isn't re-awaited on the
 											// next beginTxn (which would brick the apply loop).
@@ -955,7 +1358,9 @@ export function makeTable(options) {
 										continue;
 									}
 								}
-								// use the version as the transaction timestamp
+								// A source that reports no log position of its own (no `timestamp`) has only one clock,
+								// so its record version doubles as the apply transaction's timestamp. A replication
+								// receiver always sets `timestamp` from the origin's log key and never reaches this.
 								if (!event.timestamp && event.version) event.timestamp = event.version;
 								const commitResolution = transaction(event, () => {
 									if (event.type === 'transaction') {
@@ -1024,6 +1429,7 @@ export function makeTable(options) {
 										// standalone write: backpressure on the commit before pulling the next event,
 										// and pass the commit resolution through to the callback.
 										const committed = commitResolution ? await commitResolution : undefined;
+										applied = true;
 										await event.onCommit(committed);
 									}
 								} else if (commitResolution && !txnInProgress) {
@@ -1032,6 +1438,14 @@ export function makeTable(options) {
 								}
 							} catch (error) {
 								logger.error?.('error in subscription handler', error);
+								if (!applied)
+									await notifyReplicatedApplyFailure(databaseName, failureEvent, failurePosition, error, tableName);
+							} finally {
+								while (pendingApplyFailures) {
+									const notification = pendingApplyFailures;
+									pendingApplyFailures = undefined;
+									await notification;
+								}
 							}
 						}
 					}
@@ -1325,24 +1739,51 @@ export function makeTable(options) {
 		 * This also informs the scheduling for record eviction.
 		 * @param opts Time in seconds until records expire, or an options object with `expiration`, `eviction`,
 		 * and `scanInterval` (all in seconds, all optional). Number form preserves any previously configured
-		 * eviction/scanInterval; object form replaces all three.
+		 * eviction/scanInterval; object form replaces all three. An internal schema ownership-only call with
+		 * none of those values preserves the settings already loaded from the catalog.
 		 */
-		static setTTLExpiration(opts: number | { expiration?: number; eviction?: number; scanInterval?: number }) {
+		static setTTLExpiration(
+			opts:
+				| number
+				| {
+						expiration?: number;
+						eviction?: number;
+						scanInterval?: number;
+						fromSchema?: boolean;
+						isolatedApplicationOwner?: boolean;
+				  }
+		) {
 			if (opts == null || (typeof opts !== 'number' && typeof opts !== 'object'))
 				throw new Error('Invalid expiration value type');
+			const declaredHere = typeof opts === 'object' && opts.fromSchema;
+			const isolatedApplicationOwner = declaredHere && opts.isolatedApplicationOwner;
+			const preserveLoadedConfiguration =
+				declaredHere && opts.expiration === undefined && opts.eviction === undefined && opts.scanInterval === undefined;
+			if (((!ttlFromLoad && !declaredHere) || isolatedApplicationOwner) && !ttlConfiguredByApplication) {
+				ttlConfiguredByApplication = true;
+				// the scan owner may have changed with this: re-evaluate even if the interval did not
+				lastCleanupInterval = undefined;
+			}
 			if (typeof opts === 'number') {
 				expirationMs = opts * 1000;
-			} else {
+			} else if (!preserveLoadedConfiguration) {
 				// `??` so an explicit 0 is treated as the user's chosen value, not as "missing"
 				expirationMs = (opts.expiration ?? 0) * 1000;
 				evictionMs = (opts.eviction ?? 0) * 1000;
 				cleanupInterval = (opts.scanInterval ?? 0) * 1000;
 			}
 			if (expirationMs < 0) throw new Error('Expiration can not be negative');
-			// default to one quarter of the total expiration+eviction window
-			cleanupInterval = cleanupInterval || (expirationMs + evictionMs) / 4;
-			expirationScanScheduled = true;
-			scheduleCleanup();
+			if (!preserveLoadedConfiguration) {
+				// default to one quarter of the total expiration+eviction window
+				cleanupInterval = cleanupInterval || (expirationMs + evictionMs) / 4;
+				expirationScanScheduled = true;
+			}
+			// Re-evaluate an existing table-level scan after an ownership-only declaration, but do not
+			// create the default daily cleanup timer for a table that has only an @expiresAt field.
+			if (!preserveLoadedConfiguration || expirationScanScheduled || evictionMs) scheduleCleanup();
+			// @expiresAt has its own interval rather than the cleanup timer above. Arm it whenever a live
+			// declaration introduces the attribute, including after this application already claimed TTL.
+			if (expiresAtProperty && !recordExpirationInterval) runRecordExpirationEviction();
 		}
 
 		static getResidencyRecord(id: Id) {
@@ -1429,7 +1870,63 @@ export function makeTable(options) {
 			return coerceType(id, primaryKeyAttribute);
 		}
 
+		/**
+		 * A branch's Table classes deliberately carry the BASE's logical database name so an
+		 * application's schema and code resolve unchanged (harper#643). That makes every schema
+		 * mutation resolve against the global catalog — a `dropTable()` through a branch would delete
+		 * the live base table. Reads and writes are per-branch and unaffected; DDL is refused until a
+		 * branch owns a schema identity of its own.
+		 */
+		static assertSchemaMutable(operation: string) {
+			if (!isBranch) return;
+			const error: any = new Error(
+				`Cannot ${operation} through a branched database: '${tableName}' resolves to the schema of base ` +
+					`database '${databaseName}', so the change would apply to the base rather than the branch`
+			);
+			error.statusCode = 400;
+			throw error;
+		}
+
 		static async dropTable() {
+			TableResource.assertSchemaMutable('drop a table');
+			const rootStore = primaryStore.rootStore;
+			if (
+				databaseName === databasePath &&
+				rootStore instanceof RocksDatabase &&
+				(dbisDb as any).put !== (dbisDb as any).putSync
+			)
+				throw new Error(
+					`Cannot drop ${databaseName}.${TableResource.tableName}: the catalog store's put is asynchronous, so the drop tombstone cannot be made durable before the column families are dropped`
+				);
+			// Release post-commit derived-index delivery before any destructive work: the runner's
+			// backend must have quiesced before its stores and native file are destroyed, and a
+			// same-name recreate must not race an owner still applying to the old generation.
+			const derivedIndexRuntime = TableResource.derivedIndexRuntime;
+			const restoreDerivedIndexesAfterFailedDrop = () => {
+				try {
+					TableResource.derivedIndexRuntime = derivedIndexRuntime?.restoreAfterFailedDrop?.();
+				} catch (restoreError) {
+					TableResource.derivedIndexRuntime = undefined;
+					logger.error?.(
+						`Could not restore derived indexes after failed drop of ${databaseName}.${TableResource.tableName}`,
+						restoreError
+					);
+				}
+			};
+			try {
+				await derivedIndexRuntime?.close(true);
+			} catch (error) {
+				restoreDerivedIndexesAfterFailedDrop();
+				throw error;
+			}
+			const abortStaleDrop = () => {
+				derivedIndexRuntime?.completeDrop?.(false);
+				TableResource.derivedIndexRuntime = undefined;
+				TableResource.cleanup();
+				if (databases[databaseName]?.[tableName] === TableResource) delete databases[databaseName][tableName];
+			};
+			let dropIdentityConfirmed = databaseName !== databasePath;
+			let primaryCatalogKey = TableResource.tableName + '/';
 			if (databaseName === databasePath) {
 				// Persist a drop tombstone on the primary catalog entry BEFORE any
 				// destructive work. If the process dies or a column family drop fails
@@ -1437,9 +1934,19 @@ export function makeTable(options) {
 				// the next startup (or a same-name create) completes the drop via
 				// completeInterruptedDrop in databases.ts instead of resurrecting
 				// the table.
-				const primaryCatalogKey = TableResource.tableName + '/';
-				const primaryMeta = (dbisDb as any).getSync(primaryCatalogKey);
-				if (primaryMeta && !primaryMeta.dropping) {
+				let tombstoneWrite: any;
+				const writeTombstone = () => {
+					let primaryMeta = (dbisDb as any).getSync(primaryCatalogKey);
+					if (!primaryMeta && primaryKey) {
+						const legacyPrimaryKey = `${TableResource.tableName}/${primaryKey}`;
+						const legacyPrimaryMeta = (dbisDb as any).getSync(legacyPrimaryKey);
+						if (legacyPrimaryMeta?.isPrimaryKey) {
+							primaryCatalogKey = legacyPrimaryKey;
+							primaryMeta = legacyPrimaryMeta;
+						}
+					}
+					if (!primaryMeta || (primaryMeta.tableId != null && primaryMeta.tableId !== tableId)) return false;
+					if (primaryMeta.dropping) return true;
 					primaryMeta.dropping = true;
 					// Stamps this drop's identity so the interrupted-drop retry budget in
 					// databases.ts can be scoped to THIS drop rather than the table name: a
@@ -1449,13 +1956,34 @@ export function makeTable(options) {
 					// the budget by generation instead makes the new drop's tombstone carry
 					// its own fresh key regardless of what any worker last observed.
 					primaryMeta.dropGeneration = randomUUID();
-					// put is rebound to putSync on RocksDB stores; on LMDB it returns
-					// a promise, so await it to make the tombstone durable before the
-					// destructive work below
-					const tombstoneWrite = (dbisDb as any).put(primaryCatalogKey, primaryMeta);
-					if (tombstoneWrite?.then) await tombstoneWrite;
+					tombstoneWrite = (dbisDb as any).put(primaryCatalogKey, primaryMeta);
+					return true;
+				};
+				try {
+					if (rootStore instanceof RocksDatabase) {
+						// withUpdateAttributesLock's locked section cannot be held across an await, so a durable
+						// tombstone depends on put being rebound to putSync for RocksDB primary stores.
+						dropIdentityConfirmed = withUpdateAttributesLock(
+							rootStore,
+							`drop table '${databaseName}.${TableResource.tableName}'`,
+							writeTombstone
+						);
+					} else {
+						rootStore.transactionSync(() => {
+							dropIdentityConfirmed = writeTombstone();
+						});
+						if (typeof tombstoneWrite?.then === 'function') await tombstoneWrite;
+					}
+				} catch (error) {
+					restoreDerivedIndexesAfterFailedDrop();
+					throw error;
 				}
 			}
+			if (!dropIdentityConfirmed) {
+				abortStaleDrop();
+				return;
+			}
+			TableResource.derivedIndexRuntime = undefined;
 			// A get() against a sourcedFrom table resolves to its caller before the resolved
 			// record's cache write has committed (see getFromSource) - the write lands "in the
 			// background" for latency reasons. Flip this BEFORE removing the table from the
@@ -1468,7 +1996,7 @@ export function makeTable(options) {
 			// family drops below. If a drop fails past this point the table stays
 			// invisible, and the tombstone guarantees the drop completes on the
 			// next startup (or on a same-name create).
-			delete databases[databaseName][tableName];
+			if (databases[databaseName]?.[tableName] === TableResource) delete databases[databaseName][tableName];
 			// The above stops new source-fill writes from starting, but a write from a get()
 			// that already returned to its caller may still be in flight. Dropping the column
 			// families out from under that write is a genuine invariant violation, not just a
@@ -1499,15 +2027,21 @@ export function makeTable(options) {
 				]);
 				clearTimeout(timer);
 				if (result === timedOut) {
+					derivedIndexRuntime?.completeDrop?.();
 					throw new Error(
 						`dropTable() timed out after ${LOCK_TIMEOUT}ms waiting for ${pending.length} in-flight source-populated cache write(s) on ${tableName} to settle; refusing to drop the column families out from under a write that may still be staged. The drop tombstone is durable, so this will be retried on the next load.`
 					);
 				}
 			}
-			for (const entry of primaryStore.getRange({ versions: true, snapshot: false, lazy: true })) {
-				if (entry.metadataFlags & HAS_BLOBS && entry.value) {
-					deleteBlobsInObject(entry.value);
+			try {
+				for (const entry of primaryStore.getRange({ versions: true, snapshot: false, lazy: true })) {
+					if (entry.metadataFlags & HAS_BLOBS && entry.value) {
+						deleteBlobsInObject(entry.value);
+					}
 				}
+			} catch (error) {
+				derivedIndexRuntime?.completeDrop?.();
+				throw error;
 			}
 			if (databaseName === databasePath) {
 				// part of a database.
@@ -1525,69 +2059,106 @@ export function makeTable(options) {
 				// same-name create completes the interrupted drop and writes fresh
 				// catalog rows, and clobbering those would orphan the new table.
 				const removeTombstonedCatalog = () => {
-					const currentPrimary = (dbisDb as any).getSync(TableResource.tableName + '/');
-					if (!currentPrimary?.dropping) return false;
+					const currentPrimary = (dbisDb as any).getSync(primaryCatalogKey);
+					if (!currentPrimary?.dropping || (currentPrimary.tableId != null && currentPrimary.tableId !== tableId))
+						return false;
 					for (const attribute of attributes) {
 						dbisDb.remove(TableResource.tableName + '/' + attribute.name);
 					}
-					dbisDb.remove(TableResource.tableName + '/');
+					dbisDb.remove(primaryCatalogKey);
 					return true;
 				};
-				const rootStore = primaryStore.rootStore;
 				if (rootStore instanceof RocksDatabase) {
 					// Serialize the drops + catalog removal against a concurrent
 					// same-name create (and completeInterruptedDrop) under the database's
 					// 'update-attributes' exclusive lock - the same lock the create path
-					// holds. It is a synchronous spin lock that blocks the event loop, so
+					// holds. It is a synchronous lock wait that blocks the event loop, so
 					// the locked section MUST stay synchronous: drop with dropSync (as
 					// completeInterruptedDrop does), never an awaited drop(), or a
-					// concurrent create's spin would deadlock waiting on a drop that the
-					// blocked event loop can never resolve.
-					while (!rootStore.tryLock('update-attributes')) {}
-					let removed = false;
+					// concurrent create's wait would be stuck on a drop that the blocked
+					// event loop can never resolve, burning its full deadline before failing.
+					let removed: boolean;
 					try {
-						for (const attribute of attributes) {
-							const index = indices[attribute.name];
-							if (index)
-								try {
-									index.dropSync();
-								} catch (error) {
-									ignoreAlreadyDropped(error);
-								}
-						}
-						try {
-							primaryStore.dropSync();
-						} catch (error) {
-							ignoreAlreadyDropped(error);
-						}
-						removed = removeTombstonedCatalog();
-					} finally {
-						rootStore.unlock('update-attributes');
+						removed = withUpdateAttributesLock(rootStore, `table '${databaseName}.${tableName}'`, () => {
+							const currentPrimary = (dbisDb as any).getSync(primaryCatalogKey);
+							if (!currentPrimary?.dropping || (currentPrimary.tableId != null && currentPrimary.tableId !== tableId))
+								return false;
+							for (const attribute of attributes) {
+								const index = indices[attribute.name];
+								if (index)
+									try {
+										index.customIndex?.resetDerivedStorage?.();
+										index.dropSync();
+									} catch (error) {
+										ignoreAlreadyDropped(error);
+									}
+							}
+							try {
+								primaryStore.dropSync();
+							} catch (error) {
+								ignoreAlreadyDropped(error);
+							}
+							return removeTombstonedCatalog();
+						});
+						if (removed) await dbisDb.committed;
+					} catch (error) {
+						derivedIndexRuntime?.completeDrop?.();
+						throw error;
+					}
+					if (!removed) {
+						abortStaleDrop();
+						return;
 					}
-					if (removed) await dbisDb.committed;
 				} else {
 					// LMDB: no shared column-family double-drop, and its engine lock is
 					// transactional rather than this spin lock, so keep the awaited drop
 					// plus the same tombstone-guarded catalog removal.
-					const drops = [];
-					for (const attribute of attributes) {
-						const index = indices[attribute.name];
-						if (index) drops.push(index.drop().catch(ignoreAlreadyDropped));
+					let removed: boolean;
+					try {
+						const currentPrimary = (dbisDb as any).getSync(primaryCatalogKey);
+						if (!currentPrimary?.dropping || (currentPrimary.tableId != null && currentPrimary.tableId !== tableId)) {
+							abortStaleDrop();
+							return;
+						}
+						const drops = [];
+						for (const attribute of attributes) {
+							const index = indices[attribute.name];
+							if (index) {
+								index.customIndex?.resetDerivedStorage?.();
+								drops.push(index.drop().catch(ignoreAlreadyDropped));
+							}
+						}
+						drops.push(primaryStore.drop().catch(ignoreAlreadyDropped));
+						await Promise.all(drops);
+						removed = removeTombstonedCatalog();
+						if (removed) await dbisDb.committed;
+					} catch (error) {
+						derivedIndexRuntime?.completeDrop?.();
+						throw error;
+					}
+					if (!removed) {
+						abortStaleDrop();
+						throw new Error(
+							`Could not complete drop of ${databaseName}.${tableName}: a replacement table became current while the LMDB stores were being dropped`
+						);
 					}
-					drops.push(primaryStore.drop().catch(ignoreAlreadyDropped));
-					await Promise.all(drops);
-					if (removeTombstonedCatalog()) await dbisDb.committed;
 				}
 			} else {
 				// legacy table per database. The store to retire is this table's own audit store: nothing
 				// assigns `primaryStore.auditStore` — openAuditStore() assigns `rootStore.auditStore`, and
 				// this is the reference makeTable() was handed. Awaited so a pass suspended mid-removal has
 				// released the primary DBI before it is closed and unlinked.
-				await auditStore?.stopAuditCleanup?.();
-				removeStorageReclamation(primaryStore.path);
-				await primaryStore.close();
-				fs.unlinkSync(primaryStore.path);
+				try {
+					await auditStore?.stopAuditCleanup?.();
+					removeStorageReclamation(primaryStore.path);
+					await primaryStore.close();
+					fs.unlinkSync(primaryStore.path);
+				} catch (error) {
+					derivedIndexRuntime?.completeDrop?.();
+					throw error;
+				}
 			}
+			derivedIndexRuntime?.completeDrop?.();
 			signalling.signalSchemaChange(
 				new SchemaEventMsg(process.pid, OPERATIONS_ENUM.DROP_TABLE, databaseName, tableName)
 			);
@@ -1848,12 +2419,18 @@ export function makeTable(options) {
 			} else {
 				id = requestTargetToId(target);
 			}
+			if (this.#writeGeneration?.closed) {
+				this.#changes = undefined;
+				this.#writeGeneration = undefined;
+			}
+			this.#assertLiveHandle(id, true);
 
 			const context = this.getContext();
 			const envTxn = txnForContext(context);
 			if (!envTxn) throw new Error('Can not update a table resource outside of a transaction');
 			// record in the list of updating records so it can be written to the database when we commit
-			if (updates === false) {
+			// `false` is the patch-cancel sentinel, not a record root — but only incrementally.
+			if (updates === false && !fullUpdate) {
 				// TODO: Remove from transaction
 				return this;
 			}
@@ -1896,22 +2473,99 @@ export function makeTable(options) {
 					});
 				}
 			}
-			return when(this._writeUpdate(id, this.#changes, fullUpdate), () => this);
+			// Keep absent changes distinguishable from an explicit empty patch: framework-created
+			// post/publish updates do not necessarily mutate or save the instance.
+			// A supplied root must reach validation as itself, not as the staged changes (harper#1298).
+			const recordRoot = updates === undefined ? this.#changes : updates;
+			return when(this._writeUpdate(id, recordRoot, fullUpdate), () => this);
 		}
 
 		/**
 		 * Save any changes into this instance to the current transaction
 		 */
 		save() {
+			const operation = this.#savingOperation;
+			if (
+				!this.#lockWritable &&
+				this.#writeGeneration?.closed &&
+				(!operation || operation.writeGeneration === this.#writeGeneration)
+			)
+				return;
+			this.#assertLiveHandle(operation?.key ?? this.getId()); // a write through a released or expired lock never lands
+			if ((!operation || operation.dropped) && this.#lockWritable && this.#lockHandle?.hold) {
+				// A held lock's record stages its update here rather than at lock() time: it is often
+				// written after the acquiring transaction has already completed, which would have
+				// dropped an update staged then. Nothing set means nothing to stage — a held-but-untouched
+				// id stays untouched. Scoped locks do not take this branch: #reloadLocked stages their
+				// TransactionWrite at lock() time (exactly like update()), so #savingOperation is always
+				// set for a live scoped lock and the ordinary path below applies.
+				// Verify the hold is still alive: if #lockWritable is set but the handle expired or was
+				// released between lock acquisition and this save(), throw 409 rather than silently
+				// committing stale data. Every lock-writable instance carries its own handle.
+				const saveHandle = this.#lockHandle!;
+				if (saveHandle.isExpired()) {
+					throw lockNotHeldError(saveHandle);
+				}
+				const changes = this.#changes;
+				if (changes && Object.keys(changes).length > 0) {
+					this.#savingOperation = null;
+					return when(this._writeUpdate(this.getId(), changes, false), () => {
+						const op = this.#savingOperation;
+						if (op?.dropped) {
+							this.#changes = undefined;
+							return;
+						}
+						// Clear #savingOperation so the next sequential save() enters the lock-writable
+						// path and creates a fresh write (otherwise a non-null #savingOperation makes
+						// save() take the #saveOperation branch with an already-committed write, which
+						// is a no-op, silently dropping the new change).
+						// op.innerCommit is the real native-transaction commit Promise set on the
+						// immediateCommit path in DatabaseTransaction.save(); await it to ensure
+						// durability before resolving to the caller.
+						if (op?.saved) {
+							this.#savingOperation = null;
+							return op?.innerCommit;
+						}
+						// op.saved = false means addWrite deferred the save; #saveOperation commits it
+						// synchronously but ImmediateTransaction.save() returns undefined while the
+						// inner rocksdb commit is still pending — return innerCommit so the caller
+						// actually waits for durability.
+						return when(this.save(), () => op?.innerCommit);
+					});
+				}
+				// No changes: nothing to stage. A dropped operation (detached at a scoped→hold
+				// upgrade — see detachScopedUpgradeWrite) must not fall through to the ordinary
+				// #saveOperation path below with its now-detached reference.
+				if (!operation || operation.dropped) {
+					this.#savingOperation = null;
+					return;
+				}
+			}
 			if (this.#savingOperation) {
+				const operation = this.#savingOperation;
+				this.#savingOperation = null;
+				// A write that lands via a nested immediateCommit (e.g. a second sequential save() on
+				// the same ImmediateTransaction context, once the first has already closed it) sets
+				// operation.innerCommit to the real native-commit promise, but the commit() sweep loop
+				// that triggers it discards its own return value — #saveOperation()'s result can
+				// resolve before that native commit actually settles. Chain on innerCommit (as the
+				// lock-writable hold branch above already does) so callers awaiting save() see the
+				// write durably land, not just the outer (possibly premature) resolution.
+				let result;
 				try {
-					return this.#saveOperation(this.#savingOperation);
-				} finally {
-					this.#savingOperation = null;
+					result = this.#saveOperation(operation);
+				} catch (error) {
+					if (!operation.saved) this.#savingOperation = operation;
+					throw error;
 				}
+				const innerCommit = operation.innerCommit;
+				return innerCommit ? when(innerCommit, () => result) : result;
 			}
 		}
 		#saveOperation(operation: any) {
+			// LMDB validates staged writes at transaction commit, so bind a lazy update to the
+			// generation selected by save() before another update can replace its changes.
+			operation.captureChanges?.();
 			const transaction = txnForContext(this.getContext());
 			const holder = operation.stagedIn;
 			// never-drop-on-conflict lives on the transaction and would not travel with the write, so an
@@ -1931,13 +2585,26 @@ export function makeTable(options) {
 				// merge and index diff would be relative to a record that may never land.
 				operation.priorWrite = undefined;
 				operation.deferSave = false;
-				return when(transaction.addWrite(operation), () => operation.promise ?? operation.result);
+				const result = when(transaction.addWrite(operation), () => operation.promise ?? operation.result);
+				this.#closeWriteChain(operation);
+				return result;
 			}
 			const owner = holder ?? transaction;
-			if (owner.save) return owner.save(operation) || operation.promise || operation.result;
+			if (owner.save) {
+				const result = owner.save(operation) || operation.promise || operation.result;
+				this.#closeWriteChain(operation);
+				return result;
+			}
+		}
+		#closeWriteChain(operation: any) {
+			const owner = operation.stagedIn;
+			for (let write = operation; write && !write.instanceClosed; write = write.priorWrite) {
+				if (write === operation || owner?.ownedWrites?.has(write)) closeWriteInstance(write);
+			}
 		}
 
 		addTo(property: any, value: any) {
+			this[ASSERT_TRACKED_WRITABLE]();
 			if (typeof value === 'number' || typeof value === 'bigint') {
 				if (this.#savingOperation?.fullUpdate)
 					(this as any).set(property, (+this.getProperty(property) || 0) + (value as any));
@@ -1987,17 +2654,24 @@ export function makeTable(options) {
 			});
 		}
 		_writeInvalidate(id: Id, partialRecord?: any, options?: any) {
+			this.#assertLiveHandle(id);
 			const context = this.getContext();
 			checkValidId(id);
 			const transaction = txnForContext(this.getContext());
+			assertDerivedIndexAdmission(options, transaction);
 			const write: any = {
 				key: id,
 				store: primaryStore,
 				invalidated: true,
 				entry: this.#entry,
+				recordVersion: options?.version,
+				lockHandle: this.#lockHandle && this.#lockHandle.keyId === writeKeyId(id) ? this.#lockHandle : undefined,
+				reloadCommitBase: true,
 				commit: (txnTime, existingEntry, _retry, transaction: any) => {
+					const txnLogKey =
+						isRocksDB && options?.version != null ? (transaction?.getTimestamp?.() ?? txnTime) : txnTime;
 					write.skipped = false; // reset on each retry; cleanup happens after commit if still true
-					if (precedesExistingVersion(txnTime, existingEntry, options?.nodeId) <= 0) {
+					if (precedesExistingVersion(txnTime, existingEntry, options?.nodeId) < 0) {
 						write.skipped = true;
 						return;
 					}
@@ -2024,9 +2698,15 @@ export function makeTable(options) {
 							viaNodeId: options?.viaNodeId,
 							transaction,
 							tableToTrack: tableName,
+							recordVersion: txnTime,
+							additionalAuditRefs:
+								isRocksDB && audit && txnLogKey !== txnTime
+									? [{ version: txnLogKey, nodeId: options?.nodeId }]
+									: undefined,
 						},
 						'invalidate'
 					);
+					if (write.trackRecordVersion) write.recordVersionApplied = true;
 					// TODO: recordDeletion?
 				},
 			};
@@ -2034,20 +2714,27 @@ export function makeTable(options) {
 			transaction.addWrite(write);
 		}
 		_writeRelocate(id: Id, options: any) {
+			this.#assertLiveHandle(id);
 			const context = this.getContext();
 			checkValidId(id);
 			const transaction = txnForContext(this.getContext());
-			transaction.addWrite({
+			assertDerivedIndexAdmission(options, transaction);
+			const write: any = {
 				key: id,
 				store: primaryStore,
 				invalidated: true,
 				entry: this.#entry,
+				recordVersion: options?.version,
+				lockHandle: this.#lockHandle && this.#lockHandle.keyId === writeKeyId(id) ? this.#lockHandle : undefined,
+				reloadCommitBase: true,
 				before:
 					(this.constructor as any).source?.relocate && !(context as any)?.source
 						? (this.constructor as any).source.relocate.bind((this.constructor as any).source, id, undefined, context)
 						: undefined,
 				commit: (txnTime, existingEntry, _retry, transaction: any) => {
-					if (precedesExistingVersion(txnTime, existingEntry, options?.nodeId) <= 0) return;
+					const txnLogKey =
+						isRocksDB && options?.version != null ? (transaction?.getTimestamp?.() ?? txnTime) : txnTime;
+					if (precedesExistingVersion(txnTime, existingEntry, options?.nodeId) < 0) return;
 					const residency = TableResource.getResidencyRecord(options.residencyId);
 					let metadata = 0;
 					let newRecord = null;
@@ -2079,13 +2766,20 @@ export function makeTable(options) {
 							viaNodeId: options?.viaNodeId,
 							expiresAt: options.expiresAt,
 							transaction,
+							recordVersion: txnTime,
+							additionalAuditRefs:
+								isRocksDB && audit && txnLogKey !== txnTime
+									? [{ version: txnLogKey, nodeId: options?.nodeId }]
+									: undefined,
 						},
 						'relocate',
 						false,
 						null
 					);
+					if (write.trackRecordVersion) write.recordVersionApplied = true;
 				},
-			});
+			};
+			transaction.addWrite(write);
 		}
 
 		/**
@@ -2141,9 +2835,8 @@ export function makeTable(options) {
 					// if there is a resolution in-progress, abandon the eviction
 					if (primaryStore.hasLock(id, entry.version)) return;
 				}
-				// evictions never go in the audit log, so we can not record a deletion entry for the eviction
-				// as there is no corresponding audit entry and it would never get cleaned up. So we must simply
-				// removed the entry entirely, but first cleanup indices
+				// Eviction is not a canonical delete. Indexed caching tables add a local-only control entry so
+				// their derived indexes can remove the resident projection without exposing a delete event.
 				let lmdbCompletion: MaybePromise<unknown>;
 				if (primaryStore.ifVersion) {
 					// lmdb: the index cleanup and the record removal are both version-guarded optimistic writes.
@@ -2156,6 +2849,7 @@ export function makeTable(options) {
 					lmdbCompletion = Promise.all([indexCleanup, removal]);
 				} else {
 					updateIndices(id, existingRecord, null, options);
+					stageDerivedIndexEviction(transaction as RocksTransaction, id, existingVersion);
 					removeEntry(primaryStore, entry ?? primaryStore.getEntry(id), options);
 				}
 				committed = true;
@@ -2201,10 +2895,380 @@ export function makeTable(options) {
 			}
 		}
 		/**
-		 * This is intended to acquire a lock on a record from the whole cluster.
+		 * Static entry point: `Table.lock(id, options?, context?)` — creates an instance in the given,
+		 * ambient, or a fresh context and delegates to the instance lock(). This shadows Resource.static
+		 * lock so that both callers share the same transaction link (required for cross-instance upgrade
+		 * detection).  lock() is an in-process API with no authorization hook of its own; it is not
+		 * protocol-dispatched, so no allowUpdate/allowCreate check runs on acquisition.
+		 *
+		 * Dropping the trailing `context` leaks the key: the bare `{}` fallback is an
+		 * ImmediateTransaction, which releases no record locks.
 		 */
-		lock() {
-			throw new Error('Not yet implemented');
+		static async lock(
+			target?: RequestTargetOrId | RecordLockOptions,
+			options?: RecordLockOptions,
+			context?: any
+		): Promise<any> {
+			if (!isRocksDB) throw new ClientError('Record locks are not supported on LMDB', 501);
+			if (options === undefined && isPlainOptions(target)) {
+				options = target as RecordLockOptions;
+				target = undefined;
+			}
+			const id = target != null ? requestTargetToId(target as RequestTargetOrId) : null;
+			const resolvedContext: any = contextArgument(context) ?? contextStorage.getStore() ?? {};
+			const resource = new TableResource(id, resolvedContext);
+			return resource.lock(target, options);
+		}
+		/**
+		 * Acquire an exclusive lock on this record (or on `target`'s) and return it ready for updates
+		 * (harper#483, Phase 0: exclusive across every worker thread of this node). The lock is held
+		 * in process memory only — no durable writes. Phase 0 contract: lock() is mutually exclusive
+		 * with other lock() calls on the same key; plain writes (put/patch/delete/create) are never
+		 * gated or blocked. The generation expires after `lease` if it is never released.
+		 *
+		 * Transaction-scoped (default): write through the returned record (or the table's static verbs
+		 * in the same transaction), and the commit or abort releases it. `{ hold: true }`: the lock
+		 * outlives the transaction; write through the returned record and release with `unlock()`, or
+		 * let the lease expire.
+		 */
+		// async so option/id validation rejects rather than throwing past a caller's `.catch()`; the
+		// body still runs to completion synchronously, which is what keeps concurrent lock() calls
+		// on one key coalescing instead of racing to tryLock.
+		async lock(target?: RequestTargetOrId | RecordLockOptions, options?: RecordLockOptions): Promise<any> {
+			if (!isRocksDB) throw new ClientError('Record locks are not supported on LMDB', 501);
+			if (options === undefined && isPlainOptions(target)) {
+				options = target as RecordLockOptions;
+				target = undefined;
+			}
+			const id = target != null ? requestTargetToId(target as RequestTargetOrId) : this.getId();
+			checkValidId(id);
+			this.#assertLiveHandle(id);
+			const resolved = resolveLockOptions(options);
+			const context = this.getContext();
+			const link = txnForContext(context);
+			const keyId = writeKeyId(id);
+			// Before the re-entrant paths, not after: a transaction that already holds this key
+			// node-scoped would otherwise be handed that handle back for an explicit cluster request,
+			// while the same request on a fresh key fails closed.
+			if (
+				resolved.scope === 'cluster' &&
+				(resolved.scopeRequested || isClusterLockRequired(databaseName)) &&
+				!getClusterLockTransport(databaseName)
+			)
+				return Promise.reject(
+					new LockUnavailableError(
+						`Cluster-scoped record locks are not available on ${databaseName}: no record lock transport is registered`
+					)
+				);
+			const held = this.#lockHandle;
+			if (held && !held.isExpired() && held.keyId === keyId) {
+				// Re-entrant: upgrade to hold if requested, then preserve staged changes.
+				const violation = scopeViolation(held, resolved, databaseName);
+				if (violation) return Promise.reject(violation);
+				if (resolved.hold && !held.hold) {
+					held.upgradeToHold(resolved.lease);
+					// The scoped phase eagerly staged a TransactionWrite (see #reloadLocked); hold
+					// staging is deferred and explicit-save-only, so an unsaved scoped write left
+					// dangling here would otherwise auto-commit at the transaction sweep and clobber
+					// whatever the hold write lands. detachScopedUpgradeWrite marks it .dropped so a
+					// later save() on this instance falls through to the hold branch instead of the
+					// dead #savingOperation reference.
+					detachScopedUpgradeWrite(link, keyId, held);
+				}
+				return Promise.resolve(this.#reloadLocked(id, undefined, true));
+			}
+			const scoped = link.recordLockFor(primaryStore, keyId);
+			if (scoped && !scoped.isExpired()) {
+				const violation = scopeViolation(scoped, resolved, databaseName);
+				if (violation) return Promise.reject(violation);
+				if (resolved.hold && !scoped.hold) {
+					// Upgrade scoped → hold: flip the existing handle object to hold mode so every
+					// instance that already references this handle stays valid.  Retiring and creating a
+					// new handle would invalidate those other references (their save() would then throw
+					// 409 against a released handle).  The native key stays locked throughout.
+					scoped.upgradeToHold(resolved.lease);
+					detachScopedUpgradeWrite(link, keyId, scoped);
+					return Promise.resolve(this.#reloadLocked(id, scoped, true));
+				}
+				// Already held with the same type: re-entrant return. Preserve any staged changes.
+				return Promise.resolve(this.#reloadLocked(id, scoped, true));
+			}
+			// Cluster scope needs a registered transport. An EXPLICIT { scope: 'cluster' } without one is
+			// a caller asking for a guarantee this node cannot make, so it fails closed rather than
+			// silently returning the node-local lock; the default keeps Phase 0 behavior, which is what
+			// a build with no replication has anyway.
+			// The getter fails closed on an unusable node identity, and lock() answers with a promise.
+			let coordinator: LockCoordinator | undefined;
+			try {
+				coordinator = resolved.scope === 'node' ? undefined : TableResource.lockCoordinator;
+			} catch (error) {
+				return Promise.reject(error as Error);
+			}
+			const key = lockAttemptKey(tableId, id);
+			// Coalesce concurrent lock() calls for the same key inside one link so they don't
+			// self-block: Promise.all([T.lock(id), T.lock(id)]) would otherwise have both calls
+			// reach tryLock before either registers, making the second park against the first.
+			const pending = link.pendingLockFor(primaryStore, keyId);
+			if (pending) {
+				// Wait for the in-flight acquisition, then take the re-entrant path as if
+				// recordLockFor had found it.  If the first attempt timed out, re-enter so
+				// the second caller gets its own timeout.
+				// The follower waits on the leader's acquisition, but only for its own timeout.
+				let followerTimer: ReturnType<typeof setTimeout> | undefined;
+				const followerTimedOut = Symbol('follower timeout');
+				// Why the leader failed, so the follower can report that instead of inventing contention
+				// when its own budget runs out. A leader 503 means the guarantee could not be established
+				// at all; retrying is still right (the condition may clear) but 423 at the end is not.
+				let leaderFailure: Error | undefined;
+				const followerStart = Date.now();
+				const followerDeadline = new Promise<never>((_, reject) => {
+					followerTimer = setTimeout(() => reject(followerTimedOut), resolved.timeout).unref();
+				});
+				// Try again on this caller's own terms with the budget it has left.
+				const retryOnRemainingBudget = () => {
+					// The enclosing transaction ended while we were parked. A retry re-resolves the
+					// context, which no longer points at this link, so the handle it acquired would be
+					// registered on a fresh transaction that no commit or abort ever releases — the
+					// same abandonment the leader's own post-acquisition guard below rejects.
+					if (link.open === TRANSACTION_STATE.CLOSED && !link.saveCommits)
+						throw new ServerError('Transaction was closed while waiting for a record lock', 500);
+					const remaining = resolved.timeout - (Date.now() - followerStart);
+					if (remaining <= 0)
+						throw leaderFailure ?? new ClientError(`Record is locked and was not released in time`, 423);
+					// Carry the scope only if the caller named it: spreading the resolved options would turn
+					// a defaulted 'cluster' into an explicit one, which is fail-closed when no transport is
+					// registered.
+					return this.lock(target, {
+						lease: resolved.lease,
+						timeout: remaining,
+						hold: resolved.hold,
+						scope: resolved.scopeRequested ? resolved.scope : undefined,
+					}) as Promise<any>;
+				};
+				return Promise.race([pending, followerDeadline]).then(
+					() => {
+						clearTimeout(followerTimer);
+						const acquired = link.recordLockFor(primaryStore, keyId);
+						if (acquired && !acquired.isExpired()) {
+							const violation = scopeViolation(acquired, resolved, databaseName);
+							if (violation) throw violation;
+							if (resolved.hold && !acquired.hold) {
+								detachScopedUpgradeWrite(link, keyId, acquired);
+								acquired.upgradeToHold(resolved.lease);
+							}
+							return this.#reloadLocked(id, acquired, true);
+						}
+						return retryOnRemainingBudget();
+					},
+					(error) => {
+						clearTimeout(followerTimer);
+						// A follower that simply ran out of its own wait was waiting on another caller in this
+						// process, which is the contention 423 describes. But if the LEADER failed for a reason
+						// that is not contention, that reason is the true one — keep it and report it if the
+						// retries below also run out, rather than ending on a 423 for a key nobody held.
+						if (error === followerTimedOut) throw new ClientError(`Record is locked and was not released in time`, 423);
+						if (error instanceof LockUnavailableError) leaderFailure = error;
+						return retryOnRemainingBudget();
+					}
+				);
+			}
+			const pendingPromise = acquireRecordKey(
+				link,
+				primaryStore,
+				key,
+				keyId,
+				resolved.timeout,
+				resolved.lease,
+				resolved.hold
+			);
+			const clusterStart = performance.now();
+			// What a follower waits on must span the cluster round and registration, not just the native
+			// acquire. Waking it at the native hand-off leaves it in a window where the key is held but no
+			// handle is registered, so it retries and parks on the leader's own lock for its full timeout
+			// — inside a transaction that cannot finish until it gives up.
+			const acquisition = pendingPromise.then(async (handle) => {
+				const closedWhileWaiting = () => link.open === TRANSACTION_STATE.CLOSED && !link.saveCommits;
+				if (closedWhileWaiting()) {
+					// The transaction was aborted while this call waited; nothing would ever release the handle.
+					handle.release();
+					throw new ServerError('Transaction was closed while waiting for a record lock', 500);
+				}
+				// Anything that fails from here must give the native key back, or it becomes a lock this
+				// caller does not know it owns.
+				// Re-resolved, not the snapshot taken before `acquireRecordKey`: that wait can run the
+				// caller's whole timeout, long enough for harper-pro to register the transport on this
+				// worker. Using the snapshot would take the native key alone and hand back a node-scoped
+				// handle while a peer that already had the transport is granted the same key.
+				try {
+					if (resolved.scope !== 'node') coordinator = TableResource.lockCoordinator ?? coordinator;
+				} catch (error) {
+					// The getter fails closed on an unusable node identity, and that has to reach the caller
+					// the same way it does before the wait. Swallowing it let an implicit cluster lock fall
+					// through to node-local authority — the one outcome failing closed exists to prevent —
+					// because `coordinator` is still whatever it was, including undefined.
+					handle.release();
+					throw error as Error;
+				}
+				if (coordinator) {
+					try {
+						// Not a 423 when the budget is gone, and not a skip either: the native wait can consume
+						// the whole timeout, and `acquire` with no wait left still admits from a live delegation
+						// or a local grant without sending anything. Only if it cannot does the caller learn the
+						// guarantee was unavailable — which is not the same as the key being held.
+						const remaining = Math.max(0, resolved.timeout - (performance.now() - clusterStart));
+						const round = await coordinator.acquire(id, resolved.lease, remaining);
+						// Resolved through the getter rather than captured, so a transport swap between
+						// acquisition and release reaches the coordinator that now owns the delegation.
+						if (
+							!handle.joinClusterRound(round.tsR, resolved.lease, round.mintedMono, () =>
+								TableResource.admittingCoordinator?.release(id, round.admissionId)
+							)
+						) {
+							// The round completed inside its lease but the lease elapsed before the handle
+							// could take it. The coordinator still holds it, and only this call knows the
+							// hold was never handed out.
+							// The getter, not the captured coordinator: after a transport swap the captured one no
+							// longer owns this admission, so releasing through it would be a silent no-op.
+							// `.then`, not `Promise.resolve(release())`: the call can throw synchronously, and that
+							// throw would escape the catch and replace the 423 below with an internal error.
+							Promise.resolve()
+								.then(() => TableResource.admittingCoordinator?.release(id, round.admissionId))
+								.catch(noop);
+							// 503, not 423: the home granted this key to US and the lease elapsed before the handle
+							// could take it, so nobody ever held it. The coordinator classifies the same thing the
+							// same way — see its `timeout` denial.
+							throw new LockUnavailableError(
+								`A cluster record lock on ${databaseName}.${tableName} was granted after its lease had elapsed`
+							);
+						}
+						// A recall must be able to fence a write this handle staged and then unlocked, so
+						// the coordinator needs a way to revoke it — see LockCoordinator.registerAdmission.
+						// The getter again: a swap during the acquisition moved this admission to the
+						// successor, and registering on the predecessor would revoke a handle that is fine.
+						TableResource.admittingCoordinator?.registerAdmission(round.admissionId, () => handle.revokeLease());
+					} catch (error) {
+						handle.release();
+						throw error;
+					}
+					if (closedWhileWaiting()) {
+						handle.release();
+						throw new ServerError('Transaction was closed while waiting for a record lock', 500);
+					}
+				}
+				link.registerRecordLock(handle);
+				if (link.saveCommits && (context as any)?.timestamp) handle.noteCandidateFloor((context as any).timestamp);
+				if (link.open === TRANSACTION_STATE.OPEN && !link.saveCommits) {
+					// Explicit transaction() (not ImmediateTransaction): pin the clock to
+					// acquiredAt when no writes have been staged yet.  When writes already
+					// exist, leave the clock alone (ordering is best-effort; write held records
+					// in their own transaction for the guarantee).  ImmediateTransaction is
+					// excluded (saveCommits=true) — its clock is never pinned in lock();
+					// each save() stamps from the handle's committed version floor instead.
+					if (link.writes.length === 0 && !link.timestamp) {
+						link.timestamp = handle.acquiredAt;
+					}
+					if (!resolved.hold && link.transaction) {
+						// Scoped lock: the read snapshot may predate the lock; drop it so the
+						// scope reads what it locked.  Hold locks use acquiredAt directly and
+						// do not update the read snapshot.
+						// The timestamp guard matches DatabaseTransaction's own setTimestamp calls: a
+						// deferred update() write leaves the clock at 0, which rocksdb-js rejects.
+						if (link.writes.length === 0 && link.readTxnsUsed <= 1) {
+							link.releaseReadTxn();
+							link.snapshotFree = true;
+						} else if (link.timestamp) link.transaction.setTimestamp(link.timestamp);
+					}
+				}
+				// ImmediateTransaction: no clock pinning in lock(); save() stamps each write
+				// from the committed handle floor for both scoped and hold handles.
+				return handle;
+			});
+			link.registerPendingLock(primaryStore, keyId, acquisition);
+			return acquisition.then(
+				(handle) => {
+					link.unregisterPendingLock(primaryStore, keyId);
+					return this.#reloadLocked(id, handle);
+				},
+				(error) => {
+					link.unregisterPendingLock(primaryStore, keyId);
+					throw error;
+				}
+			);
+		}
+		#reloadLocked(id: Id, holdHandle?: RecordLockHandle | null, preserveChanges = false) {
+			// For freshness, read the committed entry (snapshot-free) so a hold lock sees concurrent
+			// committed writes rather than a stale snapshot.  A write earlier in THIS explicit
+			// transaction has not landed in that committed entry yet (harper#1968: Harper defers an
+			// explicit transaction's writes until the writing call actually runs them), so pull the
+			// current value the same way a chained write picks up its basis (priorStagedWrite): the
+			// record comes from the prior staged write, the rest of the entry (version, audit chain,
+			// blob metadata) stays the pre-transaction one.
+			const link = txnForContext(this.getContext());
+			let entryForReload: any = primaryStore.getEntry(id);
+			if (link.open === TRANSACTION_STATE.OPEN) {
+				const keyId = writeKeyId(id);
+				const tailWrite = link.writesByKey?.get(primaryStore)?.get(keyId);
+				const priorStaged =
+					tailWrite && (tailWrite.stagedEntry !== undefined ? tailWrite : priorStagedWrite(tailWrite));
+				if (priorStaged?.stagedEntry !== undefined) {
+					entryForReload = entryForReload
+						? { ...entryForReload, value: priorStaged.stagedEntry.value }
+						: { value: priorStaged.stagedEntry.value };
+					if (entryForReload.value && typeof entryForReload.value === 'object') {
+						// Register the merged entry in entryMap so getUpdatedTime() works.
+						entryMap.set(entryForReload.value, entryForReload);
+					}
+				}
+			}
+			if (writeKeyId(id) !== writeKeyId(this.getId())) {
+				// lock(target) where target differs from this record: return a separate instance.
+				const fresh = new (this.constructor as any)(id, this.getContext());
+				TableResource._updateResource(fresh, entryForReload);
+				if (holdHandle != null) {
+					fresh.#lockHandle = holdHandle;
+					// Do not clear this.#lockHandle: the original instance keeps its own lock on its
+					// own id; the fresh instance owns the lock on the target id independently.
+				}
+				fresh.#lockWritable = true;
+				// Scoped (not hold) stages exactly like update(): create the TransactionWrite now so
+				// save() is the ordinary #savingOperation path.  Hold keeps deferred staging (the
+				// acquiring transaction may commit before the holder ever writes).
+				if (!fresh.#lockHandle!.hold) fresh._writeUpdate(id, fresh.#changes, false);
+				return fresh;
+			}
+			// Store the handle for both scoped and hold locks; undefined (re-entrant hold fast-path)
+			// must not clear a handle already set.
+			if (holdHandle != null) this.#lockHandle = holdHandle;
+			TableResource._updateResource(this, entryForReload);
+			// Preserve staged changes when upgrading the same instance from scoped to hold so that
+			// set() calls made under the scoped lock survive the reload.
+			if (!preserveChanges) this.#changes = undefined;
+			this.#lockWritable = true;
+			// Scoped (not hold): stage now, same as update() would.  Skip if a write from an earlier
+			// lock() cycle on this instance is still pending (re-entrant call before its save()).
+			if (!this.#lockHandle!.hold && !this.#savingOperation) this._writeUpdate(id, this.#changes, false);
+			return this;
+		}
+		/**
+		 * Release the lock this instance holds. Resolves true when this call cleared the native key lock.
+		 * Works for both held (`{ hold: true }`) and transaction-scoped locks. After unlock() the
+		 * instance is no longer lock-writable; writes through it require a fresh lock.
+		 */
+		unlock(): Promise<boolean> {
+			// Always clear the local lock-writable state so subsequent writes on this instance are
+			// ungated, regardless of whether the handle was already released.
+			const handle = this.#lockHandle;
+			this.#lockHandle = undefined;
+			this.#lockWritable = false;
+			if (!handle || handle.released) return Promise.resolve(false);
+			const link = txnForContext(this.getContext());
+			// A scoped lock staged its write at lock() time; released before commit, that write must not
+			// run into the released-handle guard at the sweep.
+			if (this.#savingOperation && !this.#savingOperation.saved && this.#savingOperation.lockHandle === handle)
+				this.#savingOperation = null;
+			detachScopedUpgradeWrite(link, writeKeyId(this.getId()), handle);
+			link.unregisterRecordLock(handle);
+			return Promise.resolve(handle.release());
 		}
 		static operation(operation, context) {
 			operation.table ||= tableName;
@@ -2330,8 +3394,11 @@ export function makeTable(options) {
 		// a notification that a write has already occurred in the canonical data source, we need to update our
 		// local copy
 		_writeUpdate(id: Id, recordUpdate: any, fullUpdate: boolean, options?: any) {
+			this.#assertLiveHandle(id);
 			const context = this.getContext();
 			const transaction = txnForContext(context);
+			const replaying = transaction.isReplay === true;
+			assertDerivedIndexAdmission(options, transaction);
 			checkValidId(id);
 			if (fullUpdate && recordUpdate == null && options?.isNotification) {
 				// A source/replication-applied put must carry the record; these applies skip record
@@ -2349,6 +3416,16 @@ export function makeTable(options) {
 				}
 				return;
 			}
+			let captureChanges;
+			if (recordUpdate === undefined) {
+				let captured = false;
+				captureChanges = () => {
+					if (!captured) {
+						captured = true;
+						recordUpdate = this.#changes;
+					}
+				};
+			}
 			const entry = this.#entry ?? primaryStore.getEntry(id, { transaction: transaction.getReadTxn() });
 			const writeToSource = () => {
 				if (!(this.constructor as any).source || (context as any)?.source) return;
@@ -2368,15 +3445,32 @@ export function makeTable(options) {
 				}
 			};
 
+			const receiverId = this.getId();
+			const closesReceiver =
+				!this.isCollection &&
+				!isSearchTarget(receiverId) &&
+				(id === receiverId || writeKeyId(id) === writeKeyId(receiverId));
 			const write: any = {
 				key: id,
 				store: primaryStore,
 				entry,
 				nodeName: (context as any)?.nodeName,
 				fullUpdate,
+				chainsStagedState: true,
+				// copy-apply rows keep their pre-read base: one read per row, healed by the post-copy replay
+				reloadCommitBase: options?.isCopyApply !== true,
 				deferSave: true,
+				// the origin's record version on an applied write; absent for a locally-originated one
+				recordVersion: options?.version,
+				// Include the lock handle (if any) so the expired-handle guard in
+				// DatabaseTransaction.save() can throw 409 when the lease has lapsed.
+				// Only attach the hold handle when it covers exactly this key; off-key writes
+				// are ordinary and must not carry an unrelated hold's handle.
+				lockHandle: this.#lockHandle && this.#lockHandle.keyId === writeKeyId(id) ? this.#lockHandle : undefined,
+				writeGeneration: !this.#lockWritable && closesReceiver ? this[GET_TRACKED_WRITE_GENERATION]() : undefined,
+				captureChanges,
 				validate: (txnTime, committedBy = transaction) => {
-					if (!recordUpdate) recordUpdate = this.#changes;
+					write.captureChanges?.();
 					if (fullUpdate || (recordUpdate && hasChanges(this.#changes === recordUpdate ? this : recordUpdate))) {
 						if (!(context as any)?.source) {
 							committedBy.checkOverloaded();
@@ -2427,10 +3521,13 @@ export function makeTable(options) {
 											: txnTime;
 							}
 							if (createdTimeProperty) {
-								if (entry?.value) {
+								// the reloaded commit base, not the pre-read one: a full PUT racing a create
+								// would otherwise stamp a fresh created time over the real one
+								const base = write.entry;
+								if (base?.value) {
 									if (fullUpdate || recordUpdate[createdTimeProperty.name]) {
 										// make sure to retain original created time
-										recordUpdate[createdTimeProperty.name] = entry?.value[createdTimeProperty.name];
+										recordUpdate[createdTimeProperty.name] = base.value[createdTimeProperty.name];
 									}
 								} else {
 									// new entry, set created time
@@ -2497,6 +3594,8 @@ export function makeTable(options) {
 					this.#savingOperation = null;
 					write.stagedIn = undefined; // nothing may pin this write's transaction past its commit
 					let omitLocalRecord = false;
+					const txnLogKey =
+						isRocksDB && options?.version != null ? (transaction?.getTimestamp?.() ?? txnTime) : txnTime;
 					// we use optimistic locking to only commit if the existing record state still holds true.
 					// this is superior to using an async transaction since it doesn't require JS execution
 					//  during the write transaction.
@@ -2559,10 +3658,10 @@ export function makeTable(options) {
 							if (
 								existingEntry.additionalAuditRefs?.some(
 									(ref) =>
-										ref.version === txnTime &&
+										ref.version === txnLogKey &&
 										precedesExistingVersion(
 											txnTime,
-											{ version: txnTime, localTime: txnTime, key: id, nodeId: ref.nodeId },
+											{ version: txnTime, localTime: txnLogKey, key: id, nodeId: ref.nodeId },
 											options?.nodeId
 										) === 0
 								)
@@ -2593,10 +3692,10 @@ export function makeTable(options) {
 								if (!oldestRetainedAuditTimeResolved) {
 									oldestRetainedAuditTimeResolved = true;
 									// getRange yields ascending by audit-log key, so the first entry is the oldest retained.
-									// Mirror replicationConnection's retention check and the cleanup key basis (localTime ??
-									// version). Fall back to the nominal time-based purge floor when the log is empty/unavailable.
+									// Mirror replicationConnection's retention check and the cleanup key basis (`txnLogKey`).
+									// Fall back to the nominal time-based purge floor when the log is empty/unavailable.
 									for (const entry of auditStore.getRange({ start: 1, log: options?.nodeId })) {
-										oldestRetainedAuditTime = entry.localTime ?? entry.version;
+										oldestRetainedAuditTime = entry.txnLogKey;
 										break;
 									}
 									oldestRetainedAuditTime ??= Date.now() - auditRetention;
@@ -2609,23 +3708,25 @@ export function makeTable(options) {
 							// depth-cap block. This is the same keyed lookup that block performs, hoisted ahead of the walk.
 							// It is what catches transitive/proxied re-deliveries: they arrive buried below the record head
 							// (so replication's head-tie fast-skip can't see them) yet are exact duplicates. Keyed by nodeId,
-							// so it is correct across multiple source nodes. RocksDB-only: LMDB audit entries are keyed by
-							// local audit time, not version, so this version-keyed lookup doesn't apply there (LMDB keeps the
-							// exact unbounded walk). A miss (the keyed lookup can lag a back-to-back re-delivery — #1137)
+							// so it is correct across multiple source nodes. The lookup key is this write's LOG key, not its
+							// record version — a replication apply commits under the origin's log key while storing the
+							// origin's version, and only the log key addresses the entry (harper#2412).
+							// RocksDB-only: LMDB audit entries are keyed by local audit time, so this lookup doesn't apply
+							// there (LMDB keeps the exact unbounded walk). A miss (the keyed lookup can lag a back-to-back re-delivery — #1137)
 							// simply falls through to the walk, so this never changes correctness; the additionalAuditRefs
 							// check above remains the read-your-writes guard. Never when this write staged in a prior
 							// failed attempt: that attempt already appended this write's own audit entry, so the lookup
 							// would find it and skip the write as "already applied" when the record was never committed.
 							// A recommit of the same transaction survived that skip only because the old write batch
 							// still carried the put; a fresh-transaction replay (ERR_TRY_AGAIN) would drop the write.
-							if (isRocksDB && !stagedOwnAuditEntry && dedupVersionCouldBeRetained(txnTime)) {
-								const priorAudit = auditStore.get(txnTime, tableId, id, options?.nodeId);
+							if (isRocksDB && !replaying && !stagedOwnAuditEntry && dedupVersionCouldBeRetained(txnLogKey)) {
+								const priorAudit = auditStore.get(txnLogKey, tableId, id, options?.nodeId);
 								if (
 									priorAudit &&
-									priorAudit.version === txnTime &&
+									priorAudit.txnLogKey === txnLogKey &&
 									precedesExistingVersion(
 										txnTime,
-										{ version: txnTime, localTime: txnTime, key: id, nodeId: priorAudit.nodeId },
+										{ version: txnTime, localTime: txnLogKey, key: id, nodeId: priorAudit.nodeId },
 										options?.nodeId
 									) === 0
 								) {
@@ -2634,7 +3735,10 @@ export function makeTable(options) {
 								}
 							}
 							// incremental CRDT updates are only available with audit logging on
-							let localTime = existingEntry.localTime;
+							const initialAuditHead = isRocksDB
+								? resolveAuditHead(id, existingEntry.version, existingEntry.nodeId, existingEntry.additionalAuditRefs)
+								: { txnLogKey: existingEntry.localTime, nodeId: existingEntry.nodeId };
+							let localTime = initialAuditHead.txnLogKey;
 							let auditedVersion = existingEntry.version;
 							logger.debug?.(
 								'Applying CRDT update to record with id: ',
@@ -2647,22 +3751,42 @@ export function makeTable(options) {
 								new Date(localTime)
 							);
 
-							let nodeId = existingEntry.nodeId;
+							let nodeId = initialAuditHead.nodeId;
 							const succeedingUpdates = []; // record the "future" updates, as we need to apply the updates in reverse order
 							const auditRefsToVisit: Array<{ localTime: number; nodeId: number }> = existingEntry.additionalAuditRefs
 								? existingEntry.additionalAuditRefs.map((ref) => ({ localTime: ref.version, nodeId: ref.nodeId }))
 								: [];
 
-							// Collect any existing audit refs that should be preserved (those older than current transaction)
+							// Out-of-order merges retain every existing branch head; per-origin log keys are not globally ordered.
 							if (existingEntry.additionalAuditRefs) {
 								for (const ref of existingEntry.additionalAuditRefs) {
-									if (ref.version <= txnTime) {
-										additionalAuditRefs.push(ref);
-									}
+									additionalAuditRefs.push(ref);
 								}
 							}
 							let addedAuditRef = false;
 							let nextRef: { localTime: number; nodeId: number };
+							const visitedAuditRefs = new Set<string>();
+							const queuePreviousAuditRefs = (auditRecord) => {
+								const previousRefs = auditRecord.previousAdditionalAuditRefs;
+								if (previousRefs) {
+									for (const ref of previousRefs) {
+										auditRefsToVisit.push({ localTime: ref.version, nodeId: ref.nodeId });
+										logger.debug?.('Adding audit ref from audit record to visit queue', {
+											version: ref.version,
+											nodeId: ref.nodeId,
+										});
+									}
+								}
+							};
+							const advanceToPreviousAudit = (auditRecord) => {
+								const previousRefs = auditRecord.previousAdditionalAuditRefs;
+								const previousHead =
+									isRocksDB && previousRefs?.length
+										? resolveAuditHead(id, auditRecord.previousVersion, auditRecord.previousNodeId, previousRefs)
+										: { txnLogKey: auditRecord.previousVersion, nodeId: auditRecord.previousNodeId };
+								localTime = previousHead.txnLogKey;
+								nodeId = previousHead.nodeId;
+							};
 							let walkSteps = 0;
 							let auditWalkCapped = false;
 							// Early-out residual: as we walk the chain newest-first, fold each succeeding patch into a
@@ -2681,21 +3805,24 @@ export function makeTable(options) {
 							// appended this write's own audit entry, so the lookup would match it while the record was
 							// never committed (see the up-front keyed dedup above).
 							const isReDeliveredDuplicate = () => {
-								if (stagedOwnAuditEntry) return false;
-								if (!dedupVersionCouldBeRetained(txnTime)) return false; // pre-retention version — skip the end-of-log scan (best-effort; see above)
-								const duplicate = auditStore.get(txnTime, tableId, id, options?.nodeId);
+								if (replaying || stagedOwnAuditEntry) return false;
+								if (!dedupVersionCouldBeRetained(txnLogKey)) return false; // pre-retention log key — skip the end-of-log scan (best-effort; see above)
+								const duplicate = auditStore.get(txnLogKey, tableId, id, options?.nodeId);
 								return (
 									duplicate &&
-									duplicate.version === txnTime &&
+									duplicate.txnLogKey === txnLogKey &&
 									precedesExistingVersion(
 										txnTime,
-										{ version: txnTime, localTime: txnTime, key: id, nodeId: duplicate.nodeId },
+										{ version: txnTime, localTime: txnLogKey, key: id, nodeId: duplicate.nodeId },
 										options?.nodeId
 									) === 0
 								);
 							};
 							do {
 								while (localTime > txnTime || (auditedVersion >= txnTime && localTime > 0)) {
+									const auditIdentity = `${nodeId ?? 0}:${localTime}`;
+									if (visitedAuditRefs.has(auditIdentity)) break;
+									visitedAuditRefs.add(auditIdentity);
 									// Bound the walk only for RocksDB, where the OOM was observed (issue #1114): each step
 									// is a transaction-log range scan + msgpackr decode, and the per-node logs can be huge.
 									// LMDB audit entries are keyed by local audit time (not version), so the duplicate
@@ -2706,6 +3833,21 @@ export function makeTable(options) {
 									}
 									const auditRecord = auditStore.get(localTime, tableId, id, nodeId);
 									if (!auditRecord) break;
+									queuePreviousAuditRefs(auditRecord);
+									if (
+										isRocksDB &&
+										!replaying &&
+										!stagedOwnAuditEntry &&
+										localTime === txnLogKey &&
+										precedesExistingVersion(
+											txnTime,
+											{ version: txnTime, localTime: txnLogKey, key: id, nodeId: auditRecord.nodeId },
+											options?.nodeId
+										) === 0
+									) {
+										write.skipped = true;
+										return;
+									}
 									auditedVersion = auditRecord.version;
 									if (auditedVersion >= txnTime) {
 										if (auditedVersion === txnTime) {
@@ -2715,17 +3857,26 @@ export function makeTable(options) {
 												options?.nodeId
 											);
 											if (precedesExisting === 0) {
-												logger.debug?.(
-													'The transaction time is equal to the existing version, treating as duplicate',
-													id
-												);
-												write.skipped = true;
-												return; // treat a tie as a duplicate and drop it
+												if (isRocksDB && localTime !== txnLogKey) {
+													// Same origin and record version, but a distinct write. Its per-origin log key
+													// orders the otherwise non-unique record clock without comparing keys across origins.
+													precedesExisting = txnLogKey > localTime ? 1 : -1;
+												} else if (replaying || stagedOwnAuditEntry) {
+													// The log entry being replayed (or staged by this write's failed attempt) is
+													// the write itself, not proof that its primary-store mutation committed.
+													precedesExisting = 1;
+												} else {
+													logger.debug?.(
+														'The transaction time and log key match the existing write, treating as duplicate',
+														id
+													);
+													write.skipped = true;
+													return;
+												}
 											}
 											if (precedesExisting > 0) {
 												// if the existing version is older, we can skip this update
-												localTime = auditRecord.previousVersion;
-												nodeId = auditRecord.previousNodeId;
+												advanceToPreviousAudit(auditRecord);
 												continue;
 											}
 										}
@@ -2762,24 +3913,16 @@ export function makeTable(options) {
 									}
 									if (!addedAuditRef && isRocksDB) {
 										addedAuditRef = true;
-										// Add a reference to this older audit record if we had out-of-order writes
-										additionalAuditRefs.push({ version: txnTime, nodeId: options?.nodeId });
+										// Add a reference to this older audit record if we had out-of-order writes. The stored
+										// value is a LOG key, not a record version: every consumer follows it straight into
+										// `auditStore.get` (see the `auditRefsToVisit` mapping above and below), and on an
+										// applied write those two clocks differ.
+										additionalAuditRefs.push({ version: txnLogKey, nodeId: options?.nodeId });
 										logger.debug?.('Adding additional audit ref for out-of-order write', {
-											version: txnTime,
+											txnLogKey,
 											nodeId: options?.nodeId,
 										});
 									}
-									// Collect any additional audit refs from this audit record to traverse other branches
-									if (auditRecord.previousAdditionalAuditRefs) {
-										for (const ref of auditRecord.previousAdditionalAuditRefs) {
-											auditRefsToVisit.push({ localTime: ref.version, nodeId: ref.nodeId });
-											logger.debug?.('Adding audit ref from audit record to visit queue', {
-												version: ref.version,
-												nodeId: ref.nodeId,
-											});
-										}
-									}
-
 									// Every field of this write is overwritten by newer writes, and there is no alternate
 									// audit branch left to scan, so it is fully superseded — the same outcome as walking to
 									// the end and taking the `writeCommit(false)` escape below, reached without paying the rest
@@ -2798,8 +3941,7 @@ export function makeTable(options) {
 										return writeCommit(false);
 									}
 
-									localTime = auditRecord.previousVersion;
-									nodeId = auditRecord.previousNodeId;
+									advanceToPreviousAudit(auditRecord);
 								}
 								// Check if we need to scan additional audit refs from this record
 								if (auditWalkCapped) break;
@@ -2904,8 +4046,8 @@ export function makeTable(options) {
 					if (recordToStore && recordToStore.getRecord)
 						throw new Error('Can not assign a record to a record, check for circular references');
 					if (residencyId == undefined) {
-						if (entry?.residencyId)
-							(context as any).previousResidency = TableResource.getResidencyRecord(entry.residencyId);
+						if (existingEntry?.residencyId)
+							(context as any).previousResidency = TableResource.getResidencyRecord(existingEntry.residencyId);
 						const residency = residencyFromFunction(TableResource.getResidency(recordToStore, context));
 						if (residency) {
 							if (!residency.includes(server.hostname)) {
@@ -2986,7 +4128,16 @@ export function makeTable(options) {
 					);
 					updateIndices(id, existingRecord, recordToStore, transaction && { transaction });
 
+					// Preserve an addressable audit head when the record and log clocks diverge.
+					if (isRocksDB && audit && !isCopyApply && txnLogKey !== txnTime) {
+						const headIndex = additionalAuditRefs.findIndex(
+							(ref) => ref.version === txnLogKey && (ref.nodeId ?? 0) === (options?.nodeId ?? 0)
+						);
+						if (headIndex > 0) additionalAuditRefs.unshift(additionalAuditRefs.splice(headIndex, 1)[0]);
+						else if (headIndex < 0) additionalAuditRefs.unshift({ version: txnLogKey, nodeId: options?.nodeId });
+					}
 					writeCommit(true);
+					if (write.trackRecordVersion) write.recordVersionApplied = true;
 					if (expiresAt >= 0) {
 						scheduleCleanup(); // arm for replicated writes too, not just local-context writes
 						// A runtime per-record expiresAt on a table with no table-level expiration/eviction, no expiresAt
@@ -3021,6 +4172,8 @@ export function makeTable(options) {
 								user: (context as any)?.user,
 								residencyId,
 								expiresAt,
+								recordVersion: txnTime,
+								recordNodeId: precedesExisting < 0 ? existingEntry?.nodeId : options?.nodeId,
 								nodeId: options?.nodeId,
 								viaNodeId: options?.viaNodeId,
 								originatingOperation: (context as any)?.originatingOperation,
@@ -3131,8 +4284,10 @@ export function makeTable(options) {
 			return Boolean(this.#record);
 		}
 		_writeDelete(id: Id, options?: any) {
+			this.#assertLiveHandle(id);
 			const context = this.getContext();
 			const transaction = txnForContext(context);
+			assertDerivedIndexAdmission(options, transaction);
 			checkValidId(id);
 			const entry = this.#entry ?? primaryStore.getEntry(id, { transaction: transaction.getReadTxn() });
 
@@ -3141,7 +4296,10 @@ export function makeTable(options) {
 				store: primaryStore,
 				entry,
 				chainsStagedState: true,
+				reloadCommitBase: true,
 				nodeName: (context as any)?.nodeName,
+				recordVersion: options?.version,
+				lockHandle: this.#lockHandle && this.#lockHandle.keyId === writeKeyId(id) ? this.#lockHandle : undefined,
 				before:
 					(this.constructor as any).source?.delete && !(context as any)?.source
 						? (this.constructor as any).source.delete.bind((this.constructor as any).source, id, undefined, context)
@@ -3154,6 +4312,8 @@ export function makeTable(options) {
 					const priorStagedOp = priorStagedWrite(write);
 					const priorStaged = priorStagedOp?.stagedEntry;
 					const existingRecord = priorStaged ? priorStaged.value : existingEntry?.value;
+					const txnLogKey =
+						isRocksDB && options?.version != null ? (transaction?.getTimestamp?.() ?? txnTime) : txnTime;
 					if (retry) {
 						if (context && existingEntry?.version > (context.lastModified || 0))
 							context.lastModified = existingEntry.version;
@@ -3182,6 +4342,11 @@ export function makeTable(options) {
 								viaNodeId: options?.viaNodeId,
 								transaction,
 								tableToTrack: tableName,
+								recordVersion: txnTime,
+								additionalAuditRefs:
+									isRocksDB && audit && txnLogKey !== txnTime
+										? [{ version: txnLogKey, nodeId: options?.nodeId }]
+										: undefined,
 							},
 							'delete'
 						);
@@ -3191,6 +4356,7 @@ export function makeTable(options) {
 						removeEntry(primaryStore, existingEntry, isRocksDB && transaction ? { transaction } : undefined);
 					}
 					write.stagedEntry = { value: undefined }; // the key holds no record for the rest of this transaction
+					if (write.trackRecordVersion) write.recordVersionApplied = true;
 					// the removal supersedes the nearest record an earlier write in this transaction stored
 					// (older ones were already marked by their staged successors), so its saved blobs are
 					// cleaned up post-commit unless its audit entry references them
@@ -3504,7 +4670,13 @@ export function makeTable(options) {
 								404
 							);
 					}
-					if (orderAlignedCondition) orderAlignedCondition.descending = Boolean(sort.descending);
+					if (orderAlignedCondition) {
+						orderAlignedCondition.descending = Boolean(sort.descending);
+						if (orderAlignedCondition.maxIndexLagMilliseconds === undefined)
+							orderAlignedCondition.maxIndexLagMilliseconds = sort.maxIndexLagMilliseconds;
+						if (orderAlignedCondition.waitForIndexMilliseconds === undefined)
+							orderAlignedCondition.waitForIndexMilliseconds = sort.waitForIndexMilliseconds;
+					}
 				}
 			}
 			conditions = orderConditions(conditions, operator);
@@ -3531,6 +4703,10 @@ export function makeTable(options) {
 				}
 			}
 			const select = target.select;
+			// Whether the caller supplied real filter conditions — read from the raw request, NOT the
+			// planner-augmented `conditions` (which by now may carry a synthetic `sort` pseudo-condition and
+			// injected full-scan condition). Used to pick the count-estimate source below.
+			const hasUserConditions = Array.isArray(target.conditions) && target.conditions.length > 0;
 			if (conditions.length === 0) {
 				conditions = [{ attribute: primaryKey, comparator: 'greater_than', value: true }];
 			}
@@ -3568,65 +4744,175 @@ export function makeTable(options) {
 				boundRowFilter || typeof target.vectorFilter === 'function'
 					? { rowFilter: boundRowFilter, vectorFilter: target.vectorFilter }
 					: undefined;
-			const entries = executeConditions(
-				conditions,
-				operator,
-				TableResource,
-				readTxn,
-				target,
-				context,
-				(results: any[], filters: Function[]) => transformToEntries(results, select, context, readTxn, filters),
-				filtered,
-				recordAccess
-			);
-			const ensure_loaded = (target as any).ensureLoaded !== false;
-			// The guards inside executeConditions evaluate the
-			// LOCAL record, but on a caching table transformEntryForSelect may then revalidate an
-			// expired/invalidated row from source and return a DIFFERENT record. The explicit row filter
-			// must hold on the record actually returned, so it is re-checked
-			// there, after materialization (the earlier evaluation stays as a prune that also bounds HNSW
-			// traversal). vectorFilter and condition filters intentionally keep the local-record
-			// semantics all query filters have on caching tables.
-			//
-			// A row that is past its TTL but not yet swept by the background eviction
-			// scan is still physically present. A write that is about to overwrite it
-			// anyway (e.g. the SQL engine locating UPDATE/DELETE targets) needs to see
-			// it as a match — the same leniency a direct by-id put/patch already gets,
-			// since those never run the ensureLoaded-gated freshness check this transform
-			// otherwise applies unconditionally to every read.
-			const includeExpired = (target as any).includeExpired === true;
-			const transformToRecord = TableResource.transformEntryForSelect(
-				select,
-				context,
-				readTxn,
-				filtered,
-				ensure_loaded,
-				true,
-				boundRowFilter,
-				includeExpired,
-				postOrdering
-			);
-			let results = TableResource.transformToOrderedSelect(
-				entries,
-				select,
-				postOrdering,
-				context,
-				readTxn,
-				transformToRecord
-			);
-			// apply any offset/limit after all the sorting and filtering
-			if (target.offset || target.limit !== undefined)
-				results = results.slice(
-					target.offset,
-					target.limit !== undefined ? (target.offset || 0) + target.limit : undefined
+			try {
+				const entries = executeConditions(
+					conditions,
+					operator,
+					TableResource,
+					readTxn,
+					target,
+					context,
+					(results: any[], filters: Function[]) => transformToEntries(results, select, context, readTxn, filters),
+					filtered,
+					recordAccess
+				);
+				const ensure_loaded = (target as any).ensureLoaded !== false;
+				// The guards inside executeConditions evaluate the
+				// LOCAL record, but on a caching table transformEntryForSelect may then revalidate an
+				// expired/invalidated row from source and return a DIFFERENT record. The explicit row filter
+				// must hold on the record actually returned, so it is re-checked
+				// there, after materialization (the earlier evaluation stays as a prune that also bounds HNSW
+				// traversal). vectorFilter and condition filters intentionally keep the local-record
+				// semantics all query filters have on caching tables.
+				//
+				// A row that is past its TTL but not yet swept by the background eviction
+				// scan is still physically present. A write that is about to overwrite it
+				// anyway (e.g. the SQL engine locating UPDATE/DELETE targets) needs to see
+				// it as a match — the same leniency a direct by-id put/patch already gets,
+				// since those never run the ensureLoaded-gated freshness check this transform
+				// otherwise applies unconditionally to every read.
+				const includeExpired = (target as any).includeExpired === true;
+				const transformToRecord = TableResource.transformEntryForSelect(
+					select,
+					context,
+					readTxn,
+					filtered,
+					ensure_loaded,
+					true,
+					boundRowFilter,
+					includeExpired,
+					postOrdering
+				);
+				let results = TableResource.transformToOrderedSelect(
+					entries,
+					select,
+					postOrdering,
+					context,
+					readTxn,
+					transformToRecord
 				);
-			results.onDone = () => {
-				results.onDone = null; // ensure that it isn't called twice
+				const offset = target.offset || 0;
+				const end = target.limit !== undefined ? offset + (target.limit as number) : undefined;
+				// `Prefer: count=` (REST pagination): materialize the requested page and attach a total record
+				// count so the HTTP layer can emit a Content-Range. `exact` drains the full matched set once,
+				// windowing the page in the same pass; `estimated` returns just the page plus a cheap planner/
+				// table estimate. Opt-in only — the default streaming path below is untouched.
+				//
+				// Requires a bounded page AND window. Counting is a pagination feature; both the limit and the
+				// offset must be finite, non-negative integers, the limit no larger than MAX_COUNT_PAGE, and the
+				// window (offset + limit) no larger than MAX_EXACT_COUNT_SCAN. Anything else — a missing/
+				// oversized/non-finite/negative limit or offset (a bare collection GET, limit(Infinity),
+				// limit(foo), limit(-5,10)) or a deep-page window past the scan budget — falls through to the
+				// normal streaming path with no count. This bounds the offset too: without it a huge offset would
+				// postpone the exact guardrail (which only engages past the page) until that offset was scanned.
+				const pageLimit = target.limit as number;
+				if (
+					target.count &&
+					Number.isInteger(pageLimit) &&
+					pageLimit >= 0 &&
+					pageLimit <= MAX_COUNT_PAGE &&
+					Number.isInteger(offset) &&
+					offset >= 0 &&
+					offset + pageLimit <= MAX_EXACT_COUNT_SCAN
+				) {
+					const wantExact = target.count === 'exact';
+					const pageEnd = offset + pageLimit;
+					const countStart = performance.now();
+					// A custom-index (vector/HNSW) traversal returns a bounded, approximate candidate set whose size is
+					// chosen from `minResults` (offset + limit), so `scanned` over it tracks the requested page size, not
+					// the true match count — the same query at limit(5) vs limit(200) would otherwise advertise two
+					// different `count=exact` totals. Any query whose execution touches a custom index is affected: a
+					// custom-index sort (its aligned pseudo-condition lands in `conditions`), a custom-index threshold
+					// filter (an HNSW `lt`/`le` is the same minResults-widened traversal as a sort), or an opaque vector
+					// filter. Report the total as unavailable for those rather than advertising it as count=exact
+					// (mirroring how the estimated branch below bails to null for an opaque row/vector filter). A vector
+					// sort applied as in-memory post-ordering leaves no custom-index condition here and stays exact.
+					const touchesCustomIndex = (conds: any[]): boolean =>
+						conds.some((c: any) => {
+							if (!c) return false;
+							if (c.conditions) return touchesCustomIndex(c.conditions);
+							const attr = Array.isArray(c.attribute) ? c.attribute[0] : (c.attribute ?? c[0]);
+							return typeof attr === 'string' && Boolean(indices[attr]?.customIndex);
+						});
+					const approximateResultSet = typeof target.vectorFilter === 'function' || touchesCustomIndex(conditions);
+					return (async () => {
+						const page: any = [];
+						let scanned = 0;
+						let exact = true;
+						try {
+							for await (const record of results) {
+								if (scanned >= offset && scanned < pageEnd) page.push(record);
+								scanned++;
+								// A store whose async iterator settles synchronously (the common indexed-scan case) would
+								// otherwise let this drain spin as one uninterrupted microtask run, blocking the event loop
+								// for the whole count. Yield to the macrotask queue periodically so concurrent requests and
+								// I/O still make progress during a large exact scan.
+								if ((scanned & (COUNT_YIELD_INTERVAL - 1)) === 0) await new Promise((resolve) => setImmediate(resolve));
+								// The page window [offset, pageEnd) is always collected in full first — the guardrail
+								// only ever abandons the running TOTAL, never truncates the page body.
+								if (scanned >= pageEnd) {
+									// `estimated` needs nothing past the page; an approximate (vector) exact total is going to
+									// be reported unavailable anyway, so don't drain its tail for a number we won't publish.
+									if (!wantExact || approximateResultSet) break;
+									// `exact` keeps counting the tail, bounded by a row cap AND a time budget so a
+									// large match set can't turn a bounded page fetch into an unbounded scan.
+									if (scanned > MAX_EXACT_COUNT_SCAN || performance.now() - countStart > MAX_EXACT_COUNT_MS) {
+										exact = false;
+										break;
+									}
+								}
+							}
+						} finally {
+							// We own the iteration here (no results.onDone consumer), so release the read
+							// transaction unconditionally — including when the drain throws — or the snapshot leaks.
+							txn.doneReadTxn();
+						}
+						let total: number | null;
+						if (wantExact) {
+							// `scanned` is only an authoritative total when the iteration was exhaustive and deterministic;
+							// an approximate (vector/HNSW) result set is neither, so report the total as unavailable.
+							total = exact && !approximateResultSet ? scanned : null;
+						} else if (boundRowFilter || typeof target.vectorFilter === 'function') {
+							// An opaque row/vector filter shapes the result but isn't reflected in the index/condition
+							// estimate; guessing would both mislead and disclose cardinality the filter hides.
+							total = null;
+						} else if (!hasUserConditions) {
+							total = estimatedEntryCount(primaryStore);
+						} else {
+							// Estimate from the real conditions only — drop the planner's synthetic `sort`
+							// pseudo-condition, which otherwise contributes a bogus (entryCount/2) cardinality.
+							const est = estimateCondition(TableResource)({
+								conditions: conditions.filter((c: any) => c.comparator !== 'sort'),
+								operator: operator ? String(operator).toLowerCase() : 'and',
+							});
+							total = isFinite(est) ? Math.round(est) : null;
+						}
+						// For an estimate, never report a total below the last row actually returned — keeps the
+						// Content-Range valid (start-end/total) when an estimate undershoots a non-empty page.
+						// Exact totals are authoritative (and an empty page past the end must not be clamped up).
+						if (!wantExact && total != null && page.length > 0 && total < offset + page.length) {
+							total = offset + page.length;
+						}
+						page.recordCount = total;
+						page.recordCountExact = wantExact && exact && !approximateResultSet;
+						page.selectApplied = true;
+						page.getColumns = getColumns;
+						return page;
+					})() as any;
+				}
+				// apply any offset/limit after all the sorting and filtering
+				if (target.offset || target.limit !== undefined) results = results.slice(offset, end);
+				results.onDone = () => {
+					results.onDone = null; // ensure that it isn't called twice
+					txn.doneReadTxn();
+				};
+				results.selectApplied = true;
+				results.getColumns = getColumns;
+				return results;
+			} catch (error) {
 				txn.doneReadTxn();
-			};
-			results.selectApplied = true;
-			results.getColumns = getColumns;
-			return results;
+				throw error;
+			}
 		}
 		/**
 		 * This is responsible for ordering and select()ing the attributes/properties from returned entries
@@ -3649,10 +4935,17 @@ export function makeTable(options) {
 			if (sort) {
 				// there might be some situations where we don't need to transform to entries for sorting, not sure
 				entries = transformToEntries(entries, select, context, readTxn, null);
-				let ordered;
+				// Sort keys are resolved as entries are collected, so comparison never dereferences a record: a
+				// cached entry holds its record only weakly, and a re-read per comparison is what this avoids.
+				const clauses: Sort[] = [];
+				for (let order = sort; order; order = order.next) clauses.push(order);
+				const clauseCount = clauses.length;
 				// if we are doing post-ordering, we need to get records first, then sort them
 				results.iterate = function (options: { async: boolean }) {
-					let sortedArrayIterator: IterableIterator<any>;
+					let ordered: any[];
+					let orderedKeys: any[][];
+					let sortedPositions: number[];
+					let sortedIndex: number;
 					const dbIterator =
 						options?.async && entries[Symbol.asyncIterator]
 							? entries[Symbol.asyncIterator]()
@@ -3662,25 +4955,33 @@ export function makeTable(options) {
 					let enqueuedEntryForNextGroup: any;
 					let lastGroupingValue: any;
 					let firstEntry = true;
-					function createComparator(order: Sort) {
-						const nextComparator = order.next && createComparator(order.next);
-						const descending = order.descending;
-						return (entryA, entryB) => {
-							const a = getAttributeValue(entryA, order.attribute, context, order);
-							const b = getAttributeValue(entryB, order.attribute, context, order);
-							const diff = descending
-								? compareKeys(convertToComparableKeys(b), convertToComparableKeys(a))
-								: compareKeys(convertToComparableKeys(a), convertToComparableKeys(b));
-							if (diff === 0) return nextComparator?.(entryA, entryB) || 0;
-							return diff;
-						};
+					function collect(entry) {
+						ordered.push(entry);
+						for (let i = 0; i < clauseCount; i++) {
+							const clause = clauses[i];
+							orderedKeys[i].push(convertToComparableKeys(getAttributeValue(entry, clause.attribute, context, clause)));
+						}
+					}
+					function comparePositions(positionA: number, positionB: number): number {
+						for (let i = 0; i < clauseCount; i++) {
+							const keys = orderedKeys[i];
+							const diff = clauses[i].descending
+								? compareKeys(keys[positionB], keys[positionA])
+								: compareKeys(keys[positionA], keys[positionB]);
+							if (diff !== 0) return diff;
+						}
+						return 0;
+					}
+					function nextSorted(): IteratorResult<any> {
+						if (sortedIndex < sortedPositions.length)
+							return { done: false, value: ordered[sortedPositions[sortedIndex++]] };
+						return { done: true, value: undefined };
 					}
-					const comparator = createComparator(sort);
 					return {
 						async next() {
 							let iteration: IteratorResult<any>;
-							if (sortedArrayIterator) {
-								iteration = sortedArrayIterator.next();
+							if (sortedPositions) {
+								iteration = nextSorted();
 								if (iteration.done) {
 									if (dbDone) {
 										if (results.onDone) results.onDone();
@@ -3692,7 +4993,9 @@ export function makeTable(options) {
 									};
 							}
 							ordered = [];
-							if (enqueuedEntryForNextGroup) ordered.push(enqueuedEntryForNextGroup);
+							orderedKeys = [];
+							for (let i = 0; i < clauseCount; i++) orderedKeys.push([]);
+							if (enqueuedEntryForNextGroup) collect(enqueuedEntryForNextGroup);
 							// need to load all the entries into ordered
 							do {
 								iteration = await dbIterator.next();
@@ -3723,17 +5026,17 @@ export function makeTable(options) {
 											break;
 										}
 									}
-									// we store the value we will sort on, for fast sorting, and the entry so the records can be GC'ed if necessary
-									// before the sorting is completed
-									ordered.push(entry);
+									collect(entry);
 								}
 							} while (true);
 							if ((sort as any).isGrouped) {
 								// TODO: Return grouped results
 							}
-							ordered.sort(comparator);
-							sortedArrayIterator = ordered[Symbol.iterator]();
-							iteration = sortedArrayIterator.next();
+							sortedPositions = [];
+							for (let i = 0; i < ordered.length; i++) sortedPositions.push(i);
+							sortedPositions.sort(comparePositions);
+							sortedIndex = 0;
+							iteration = nextSorted();
 							if (!iteration.done)
 								return {
 									value: await transformToRecord.call(this, iteration.value),
@@ -4078,6 +5381,10 @@ export function makeTable(options) {
 			}
 			if (!auditStore) throw new Error('Can not subscribe to a table without an audit log');
 			if (!audit) {
+				// Turning auditing on is a schema write, and a branch's Table classes carry the base's
+				// logical name: without this a subscribe through a branched application would enable
+				// auditing on the live base table for every other consumer, with no DDL call involved.
+				TableResource.assertSchemaMutable('enable auditing for a subscription');
 				table({ table: tableName, database: databaseName, schemaDefined, attributes, audit: true });
 			}
 			const getFullRecord = !request.rawEvents;
@@ -4132,10 +5439,12 @@ export function makeTable(options) {
 			const subscription = addSubscription(
 				TableResource,
 				thisId,
-				function (id: Id, auditRecord?: any, localTime?: any, beginTxn?: any) {
+				function (id: Id, auditRecord?: any, txnLogKey?: any, beginTxn?: any) {
 					if (dropDuringReplay) return;
 					try {
 						let type = auditRecord.type;
+						// Ahead of the rawEvents branch, which forwards every type verbatim.
+						if (isLockControlType(type)) return;
 						let value;
 						if (type === 'message' || request.rawEvents) {
 							// we only send the full message, this are individual messages that can be sent out of order
@@ -4155,8 +5464,7 @@ export function makeTable(options) {
 							// been written, so are fresh in memory.
 							const entry: Entry = primaryStore.getEntry(id);
 							if (entry) {
-								// staleness is a record-version comparison; auditRecord.version is the log key on RocksDB
-								if (entry.version !== (auditRecord.recordVersion ?? auditRecord.version)) return; // out of order event, with old update, don't send anything
+								if (entry.version !== auditRecord.version) return; // out of order event, with old update, don't send anything
 								value = entry.value;
 								type = entry.metadataFlags & INVALIDATED ? 'invalidate' : value ? 'put' : 'delete';
 							} else {
@@ -4165,7 +5473,7 @@ export function makeTable(options) {
 						}
 						const event = {
 							id,
-							localTime,
+							localTime: txnLogKey,
 							value,
 							version: auditRecord.version,
 							type,
@@ -4227,14 +5535,15 @@ export function makeTable(options) {
 									await rest();
 									if (!isActive()) return;
 								}
-								if (auditRecord.tableId !== tableId) continue;
+								if (auditRecord.tableId !== tableId || auditRecord.type === 'evict') continue;
+								if (isLockControlType(auditRecord.type)) continue;
 								const id = auditRecord.recordId;
 								if (thisId == null || isDescendantId(thisId, id)) {
-									const value = auditRecord.getValue(primaryStore, getFullRecord, auditRecord.localTime);
+									const value = auditRecord.getValue(primaryStore, getFullRecord, auditRecord.txnLogKey);
 									if (
 										!send({
 											id,
-											localTime: auditRecord.localTime,
+											localTime: auditRecord.txnLogKey,
 											value,
 											version: auditRecord.version,
 											type: auditRecord.type,
@@ -4247,7 +5556,7 @@ export function makeTable(options) {
 										if ((await subscription.waitForDrain()) === false) return;
 									}
 								}
-								subscription!.startTime = auditRecord.localTime ?? auditRecord.version; // update so we don't double send
+								subscription!.startTime = auditRecord.txnLogKey; // update so we don't double send
 							}
 						} finally {
 							// replay is done, we can start sending real-time messages again
@@ -4264,7 +5573,8 @@ export function makeTable(options) {
 								if (!isActive()) return;
 							}
 							try {
-								if (auditRecord.tableId !== tableId) continue;
+								if (auditRecord.tableId !== tableId || auditRecord.type === 'evict') continue;
+								if (isLockControlType(auditRecord.type)) continue;
 								const id = auditRecord.recordId;
 								if (thisId == null || isDescendantId(thisId, id)) {
 									// Bound entries INSPECTED for THIS scope, independent of `count` (entries
@@ -4279,10 +5589,10 @@ export function makeTable(options) {
 										);
 										break;
 									}
-									const value = auditRecord.getValue(primaryStore, getFullRecord, auditRecord.localTime);
+									const value = auditRecord.getValue(primaryStore, getFullRecord, auditRecord.txnLogKey);
 									const historyEntry = {
 										id,
-										localTime: auditRecord.localTime,
+										localTime: auditRecord.txnLogKey,
 										value,
 										version: auditRecord.version,
 										type: auditRecord.type,
@@ -4296,7 +5606,7 @@ export function makeTable(options) {
 									if (--count <= 0) break;
 								}
 							} catch (error) {
-								logger.error?.('Error getting history entry', auditRecord.localTime, error);
+								logger.error?.('Error getting history entry', auditRecord.txnLogKey, error);
 							}
 						}
 						for (let i = history.length; i > 0;) {
@@ -4376,6 +5686,12 @@ export function makeTable(options) {
 						logger.trace?.('re-retrieved record', localTime, this.#entry?.localTime);
 						localTime = entry?.localTime;
 					}
+					let nodeId = entry?.nodeId;
+					if (isRocksDB && entry) {
+						const head = resolveAuditHead(thisId, entry.version, nodeId, entry.additionalAuditRefs);
+						localTime = head.txnLogKey;
+						nodeId = head.nodeId;
+					}
 					logger.trace?.('Subscription from', startTime, 'from', thisId, localTime);
 					if (startTime < localTime) {
 						// start time specified, get the audit history for this record. Set startTime up
@@ -4386,7 +5702,6 @@ export function makeTable(options) {
 						const history = [];
 						let inspected = 0;
 						let nextTime = localTime;
-						let nodeId = entry?.nodeId;
 						do {
 							if (++recordsSinceYield >= REPLAY_YIELD_INTERVAL) {
 								recordsSinceYield = 0;
@@ -4411,8 +5726,16 @@ export function makeTable(options) {
 										if (count) count--;
 									} else if (!isActive()) return;
 								}
-								nextTime = auditRecord.previousVersion;
-								nodeId = auditRecord.previousNodeId;
+								const previousHead = isRocksDB
+									? resolveAuditHead(
+											thisId,
+											auditRecord.previousVersion,
+											auditRecord.previousNodeId,
+											auditRecord.previousAdditionalAuditRefs
+										)
+									: { txnLogKey: auditRecord.previousVersion, nodeId: auditRecord.previousNodeId };
+								nextTime = previousHead.txnLogKey;
+								nodeId = previousHead.nodeId;
 							} else break;
 						} while (nextTime > startTime && count !== 0);
 						for (let i = history.length; i > 0;) {
@@ -4591,6 +5914,7 @@ export function makeTable(options) {
 				store: primaryStore,
 				entry: this.#entry,
 				nodeName: (context as any)?.nodeName,
+				recordVersion: options?.version,
 				validate: () => {
 					if (!(context as any)?.source) {
 						transaction.checkOverloaded();
@@ -4675,6 +5999,115 @@ export function makeTable(options) {
 				});
 			});
 		}
+		/**
+		 * Write one cluster record-lock control entry (harper#483 Phase 1). Not local-only: replicating
+		 * it IS the send.
+		 *
+		 * `recordId` must stay null. An entry carrying the locked key would share
+		 * `(version, tableId, recordId, nodeId)` with the holder's own first write, which is stamped at
+		 * exactly `ts_R`, and `RocksTransactionLogStore.getSync` answers with the FIRST entry at a
+		 * timestamp and key — so `_writeUpdate`'s keyed dedup would find this one and drop that write.
+		 * The payload goes in as bytes rather than through `recordUpdater`, which would run it through
+		 * schema projection and the table's shared structure dictionary.
+		 */
+		static writeLockControlEntry(entry: LockControlEntry): Promise<number | undefined> {
+			const encodedRecord = encodeLockControlPayload(entry);
+			const nodeId = getThisNodeId(auditStore) ?? 0;
+			let position: number;
+			// No entry pins its clock, the request included. `ts_R` is minted before the write, so pinning
+			// to it can land the entry behind a peer's replication cursor if any write to this table
+			// commits in between — the same hazard that rules it out for grants and releases, which are
+			// written later still. The protocol reads `ts_R` from the payload, so the entry's own log key
+			// never has to equal it.
+			const context = {};
+			return Promise.resolve(
+				transaction(context as any, (txn: any) => {
+					const tableTxn = txnForContext({ transaction: txn } as any);
+					tableTxn.addWrite({
+						key: null,
+						store: primaryStore,
+						skipReplicationConfirmation: true,
+						commit: (txnTime: number, _existingEntry: any, _retry: any, nativeTransaction: any) => {
+							position = txnTime;
+							return auditStore[isRocksDB ? 'putSync' : 'put'](
+								null,
+								{
+									version: txnTime,
+									tableId,
+									recordId: null,
+									nodeId,
+									type: entry.type,
+									encodedRecord,
+									extendedType: 0,
+									// Zero, not the table's count: these bytes were packed by the private control `Packr`
+									// and carry none of the table's structures. `RocksTransactionLogStore` raises the
+									// per-(log, table) structure watermark from this field and flags the entry that does
+									// it, so claiming the table's version would let a release take `HAS_STRUCTURE_UPDATE`
+									// and leave the next real write at that version unflagged — a receiver that learns
+									// structures only from flagged entries then decodes later records against a stale set
+									// (harper#1348's class). A payload with no table structures cannot advance them.
+									structureVersion: 0,
+								},
+								{ instructedWrite: true, transaction: nativeTransaction, nodeId, viaNodeId: nodeId }
+							);
+						},
+					});
+				})
+			).then(() => position);
+		}
+		/**
+		 * The coordinator that holds this node's admissions, transport or not. Releasing and registering
+		 * go here rather than through `lockCoordinator`, which answers undefined while a transport is
+		 * momentarily unregistered — and a release dropped on that answer leaves the key's home holding
+		 * its grant until the delegation's own deadline.
+		 */
+		static get admittingCoordinator(): LockCoordinator | undefined {
+			return lockCoordinator;
+		}
+
+		/**
+		 * This table's cluster lock coordinator, created on first use and only while a transport is
+		 * registered for the database. Nothing is allocated on the Phase 0 path.
+		 */
+		static get lockCoordinator(): LockCoordinator | undefined {
+			const transport = getClusterLockTransport(databaseName);
+			if (!transport) {
+				// Deliberately NOT closed. harper-pro unregisters without a standalone claim during a
+				// reconnect, and closing here would drop this node's record of the delegations it has
+				// issued as a home — so the next registration would start empty and could grant a key
+				// whose delegate is still admitting. The coordinator keeps ticking, its grants expire on
+				// their own deadlines, and `isClusterLockRequired` is what fails an acquire closed in the
+				// meantime. A genuine standalone claim clears the requirement and the coordinator with it.
+				if (!isClusterLockRequired(databaseName)) {
+					lockCoordinator?.close();
+					lockCoordinator = undefined;
+				}
+				return undefined;
+			}
+			if (lockCoordinator?.transport !== transport) {
+				// The transport object changed, but this node's delegations and the handles they admitted
+				// did not. The successor adopts that live authority in its constructor; the predecessor
+				// is closed afterwards so nothing is dropped in between. See LockCoordinatorOptions.adopt.
+				const predecessor = lockCoordinator;
+				lockCoordinator = new LockCoordinator({
+					database: databaseName,
+					table: tableName,
+					nodeId: getThisNodeName(),
+					transport,
+					adopt: predecessor,
+					// Writing to the local transaction log IS the send, so a transport that only computes
+					// the participant set gets core's writer.
+					writeControl: transport.writeControl
+						? (entry: LockControlEntry) => transport.writeControl!(tableName, entry)
+						: (entry: LockControlEntry) => TableResource.writeLockControlEntry(entry),
+					keyIdOf: writeKeyId,
+					nextTimestamp: () => (primaryStore as any).getMonotonicTimestamp(),
+					grantableAfterMono: transport.grantableAfterMono,
+				});
+				predecessor?.close();
+			}
+			return lockCoordinator;
+		}
 		// #section: validation
 		validate(record: any, patch?: boolean) {
 			// Accumulate structured per-field issues so the 400 carries `{ path, code,
@@ -4852,6 +6285,7 @@ export function makeTable(options) {
 			return this.#version;
 		}
 		static async addAttributes(attributesToAdd: Attribute[]) {
+			TableResource.assertSchemaMutable('add attributes');
 			const new_attributes = attributes.slice(0);
 			for (const attribute of attributesToAdd) {
 				if (!attribute.name) throw new ClientError('Attribute name is required');
@@ -4869,6 +6303,7 @@ export function makeTable(options) {
 			return (TableResource as any).indexingOperation;
 		}
 		static async removeAttributes(names: string[]) {
+			TableResource.assertSchemaMutable('remove attributes');
 			const new_attributes = attributes.filter((attribute) => !names.includes(attribute.name));
 			table({
 				table: tableName,
@@ -4889,6 +6324,10 @@ export function makeTable(options) {
 			const stats = primaryStore.getStats();
 			return (stats.treeBranchPageCount + stats.treeLeafPageCount + stats.overflowPages) * stats.pageSize;
 		}
+		/** Sizes of this table's durable record-structure dictionaries. */
+		static getStructureCounts(): StructureCounts | undefined {
+			return primaryStore.encoder?.getStructureCounts?.();
+		}
 		static getAuditSize(): number {
 			const stats = auditStore?.getStats();
 			return (
@@ -5091,6 +6530,7 @@ export function makeTable(options) {
 			// Refresh on every call: schema reload mutates `attributes` in place, so the
 			// class-construction snapshot would otherwise go stale.
 			this.embedAttributes = (this.attributes as any[]).filter((a) => a?.embed);
+			expiresAtProperty = this.attributes.find((attribute) => attribute.expiresAt);
 			// Drop registry entries for attributes that are no longer `@embed`, so a dropped
 			// directive doesn't leave a stale embedder or block a default refresh on re-add.
 			const embedNames = new Set(this.embedAttributes.map((a) => a.name));
@@ -5160,7 +6600,7 @@ export function makeTable(options) {
 											txnForContext(context).getReadTxn(),
 											false,
 											relatedTable,
-											false
+											{ allowFullScan: false }
 										) as any
 									).map((entry) => {
 										if (entry && entry.key !== undefined) return entry;
@@ -5367,29 +6807,108 @@ export function makeTable(options) {
 			this.userSetEmbedders.add(attribute_name);
 		}
 		static async deleteHistory(endTime = 0, cleanupDeletedRecords = false): Promise<number> {
-			let completion: Promise<void>;
+			const maxConcurrentRemovals = isRocksDB ? MAX_CONCURRENT_HISTORY_REMOVALS : MAX_CONCURRENT_LMDB_HISTORY_REMOVALS;
+			const inFlightRemovals = new Set<Promise<void>>();
+			const removalSlotWaiters: Array<() => void> = [];
+			let removalsAttempted = 0;
+			let removalsSucceeded = 0;
+			let firstRemovalError: unknown;
+			function startRemoval(remove: () => MaybePromise<void>, errorMessage: string, onSuccess?: () => void): void {
+				removalsAttempted++;
+				const removal = new Promise<void>((resolve) => resolve(remove()))
+					.then(
+						() => {
+							removalsSucceeded++;
+							onSuccess?.();
+						},
+						(error) => {
+							// capture before logging: a throwing logger must not cost us the error we may rethrow
+							if (firstRemovalError === undefined) firstRemovalError = error;
+							harperLogger.warn(errorMessage, error);
+						}
+					)
+					.catch(() => undefined)
+					.finally(() => {
+						inFlightRemovals.delete(removal);
+						removalSlotWaiters.shift()?.();
+					});
+				inFlightRemovals.add(removal);
+			}
+			function queueRemoval(
+				remove: () => MaybePromise<void>,
+				errorMessage: string,
+				onSuccess?: () => void
+			): Promise<void> | undefined {
+				if (inFlightRemovals.size >= maxConcurrentRemovals) {
+					return new Promise<void>((resolve) => {
+						removalSlotWaiters.push(resolve);
+					}).then(() => startRemoval(remove, errorMessage, onSuccess));
+				}
+				startRemoval(remove, errorMessage, onSuccess);
+			}
+			const drainRemovals = () => Promise.all(inFlightRemovals);
 			let entriesDeleted = 0;
-			for (const auditRecord of auditStore.getRange({
-				start: 0,
-				end: endTime,
-			})) {
-				await rest(); // yield to other async operations
-				if (auditRecord.tableId !== tableId) continue;
-				completion = removeAuditEntry(auditStore, auditRecord);
-				entriesDeleted++;
+			// LMDB only: RocksTransactionLogStore.remove() is a no-op, so a RocksDB deleteHistory removes
+			// nothing and must not claim it did.
+			// A bound above everything reachable must not be recorded as the floor: the floor only rises
+			// and a store with a record is never re-stamped, so it would never come down, for every table in
+			// this database. `boundedAuditPruneEnd` clamps the cutoff to just above the newest key in the
+			// log, and the scan below uses that same value as its range end, so the prune cannot remove an
+			// entry the floor does not cover.
+			let pruneEnd = endTime;
+			if (!isRocksDB) {
+				pruneEnd = boundedAuditPruneEnd(auditStore, endTime);
+				raiseAuditFloor(auditStore, pruneEnd);
+			}
+			try {
+				for (const auditRecord of auditStore.getRange({
+					// must not be zero: 0 encodes to all zero bytes and so overlaps the symbol keys, as in
+					// getHistory below
+					start: 1,
+					end: pruneEnd,
+				})) {
+					await rest(); // yield to other async operations
+					if (auditRecord.tableId !== tableId) continue;
+					const backpressure = queueRemoval(
+						() => removeAuditEntry(auditStore, auditRecord),
+						'Error removing audit entry during deleteHistory',
+						() => {
+							entriesDeleted++;
+						}
+					);
+					if (backpressure) await backpressure;
+				}
+			} finally {
+				await drainRemovals();
 			}
 			if (cleanupDeletedRecords) {
 				// this is separate procedure we can do if the records are not being cleaned up by the audit log. This shouldn't
 				// ever happen, but if there are cleanup failures for some reason, we can run this to clean up the records
-				for (const entry of primaryStore.getRange({ start: 0, versions: true })) {
-					const { value, localTime } = entry;
-					await rest(); // yield to other async operations
-					if (value === null && localTime < endTime) {
-						completion = removeEntry(primaryStore, entry);
+				try {
+					for (const entry of primaryStore.getRange({ start: 0, versions: true })) {
+						const { key, value, localTime, version } = entry;
+						await rest(); // yield to other async operations
+						const auditTime =
+							isRocksDB && version != null
+								? resolveAuditHead(key, version, entry.nodeId, entry.additionalAuditRefs).txnLogKey
+								: localTime;
+						if (value === null && version != null && auditTime < pruneEnd) {
+							const backpressure = queueRemoval(
+								() => primaryStore.remove(key, version),
+								'Error removing deleted record during deleteHistory'
+							);
+							if (backpressure) await backpressure;
+						}
 					}
+				} finally {
+					await drainRemovals();
 				}
 			}
-			await completion;
+			if (removalsAttempted > 0 && removalsSucceeded === 0) {
+				// zero progress must not report the same success as "nothing was eligible" (see DESIGN.md);
+				// partial failures stay best-effort, logged and excluded from the returned count
+				throw firstRemovalError ?? new Error('Every removal attempted during deleteHistory failed');
+			}
 			return entriesDeleted;
 		}
 		static async *getHistory(startTime = 0, endTime = Infinity) {
@@ -5398,13 +6917,15 @@ export function makeTable(options) {
 				end: endTime,
 			})) {
 				await rest(); // yield to other async operations
-				if (auditRecord.tableId !== tableId) continue;
+				if (auditRecord.tableId !== tableId || auditRecord.type === 'evict' || isLockControlType(auditRecord.type))
+					continue;
 				yield {
 					id: auditRecord.recordId,
-					localTime: auditRecord.version,
+					// Compatibility-facing LMDB history has always reported/grouped by record version.
+					localTime: isRocksDB ? auditRecord.txnLogKey : auditRecord.version,
 					version: auditRecord.version,
 					type: auditRecord.type,
-					value: auditRecord.getValue(primaryStore, true, auditRecord.version),
+					value: auditRecord.getValue(primaryStore, true, auditRecord.txnLogKey),
 					user: auditRecord.user,
 					operation: auditRecord.originatingOperation,
 				};
@@ -5415,7 +6936,9 @@ export function makeTable(options) {
 			if (id == undefined) throw new Error('An id is required');
 			const entry = primaryStore.getEntry(id);
 			if (!entry) return history;
-			let nextVersion = entry.localTime;
+			let nextVersion = isRocksDB
+				? resolveAuditHead(id, entry.version, entry.nodeId, entry.additionalAuditRefs).txnLogKey
+				: entry.localTime;
 			if (!nextVersion) throw new Error('The entry does not have a local audit time');
 			const count = 0;
 			const auditWindow = 100;
@@ -5425,20 +6948,33 @@ export function makeTable(options) {
 				let highestPreviousVersion = 0;
 				const start = nextVersion - auditWindow;
 				for (const auditRecord of auditStore.getRange({ start, end: nextVersion + 0.001 })) {
-					if (auditRecord.tableId === tableId && compareKeys(auditRecord.recordId, id) === 0) {
+					if (
+						auditRecord.tableId === tableId &&
+						auditRecord.type !== 'evict' &&
+						!isLockControlType(auditRecord.type) &&
+						compareKeys(auditRecord.recordId, id) === 0
+					) {
 						history.splice(insertionPoint, 0, {
 							id: auditRecord.recordId,
-							localTime: auditRecord.version,
+							localTime: isRocksDB ? auditRecord.txnLogKey : auditRecord.version,
 							version: auditRecord.version,
 							type: auditRecord.type,
-							// reconstruct each entry's record image as of its own version, not the audit
+							// reconstruct each entry's record image as of its own log position, not the audit
 							// window boundary (nextVersion), matching getHistory (issue #1330)
-							value: auditRecord.getValue(primaryStore, true, auditRecord.version),
+							value: auditRecord.getValue(primaryStore, true, auditRecord.txnLogKey),
 							user: auditRecord.user,
 							operation: auditRecord.originatingOperation,
 						});
-						if (auditRecord.previousVersion > highestPreviousVersion && auditRecord.previousVersion < start) {
-							highestPreviousVersion = auditRecord.previousVersion;
+						const previousVersion = isRocksDB
+							? resolveAuditHead(
+									id,
+									auditRecord.previousVersion,
+									auditRecord.previousNodeId,
+									auditRecord.previousAdditionalAuditRefs
+								).txnLogKey
+							: auditRecord.previousVersion;
+						if (previousVersion > highestPreviousVersion && previousVersion < start) {
+							highestPreviousVersion = previousVersion;
 						}
 					}
 				}
@@ -5453,12 +6989,20 @@ export function makeTable(options) {
 			const promises = [primaryStore.clear()];
 			for (const key in indices) {
 				const index = indices[key];
+				index.customIndex?.resetDerivedStorage?.();
 				promises.push(index.clearAsync ? index.clearAsync() : index.clear());
 			}
 			return Promise.all(promises);
 		}
+		/** Release everything makeTable() registered process-wide; the class must not be used afterwards. */
 		static cleanup() {
+			disposed = true;
+			void TableResource.derivedIndexRuntime?.close();
+			clearTimeout(cleanupTimer);
+			settlePendingCleanup();
+			clearInterval(recordExpirationInterval);
 			deleteCallbackHandle?.remove();
+			removeStorageReclamationHandler(primaryStore.path, reclamationHandler);
 		}
 		static _readTxnForContext(context) {
 			return txnForContext(context).getReadTxn();
@@ -5480,9 +7024,21 @@ export function makeTable(options) {
 		}
 	);
 
-	TableResource.updatedAttributes(); // on creation, update accessors as well
-	if (expirationMs) TableResource.setTTLExpiration(expirationMs / 1000);
-	if (expiresAtProperty) runRecordExpirationEviction();
+	try {
+		TableResource.updatedAttributes(); // on creation, update accessors as well
+		if (expirationMs) {
+			ttlFromLoad = true;
+			try {
+				TableResource.setTTLExpiration(expirationMs / 1000);
+			} finally {
+				ttlFromLoad = false;
+			}
+		}
+		if (expiresAtProperty && !recordExpirationInterval) runRecordExpirationEviction();
+	} catch (error) {
+		TableResource.cleanup();
+		throw error;
+	}
 	return TableResource;
 	function updateIndices(id: any, existingRecord: any, record: any, options?: any) {
 		let hasChanges;
@@ -5889,6 +7445,22 @@ export function makeTable(options) {
 			return transaction;
 		}
 	}
+	/**
+	 * Detach an unsaved TransactionWrite that a scoped lock() eagerly staged (see #reloadLocked)
+	 * once its handle upgrades to hold: hold staging is deferred and explicit-save-only, so a
+	 * dangling scoped write would otherwise auto-commit at the transaction sweep and clobber
+	 * whatever the hold write lands. Marking it .dropped lets a later save() on the instance that
+	 * owns it (checked via #savingOperation === this write) fall through to the hold branch
+	 * instead of resolving a detached, dead reference.
+	 */
+	function detachScopedUpgradeWrite(link: any, keyId: unknown, handle: RecordLockHandle): void {
+		for (const write of link.writes) {
+			if (write && !write.saved && write.lockHandle === handle && writeKeyId(write.key) === keyId) {
+				write.dropped = true;
+				link.detachWrite(write);
+			}
+		}
+	}
 	function getAttributeValue(entry, attribute_name, context, sort?) {
 		if (!entry) {
 			return;
@@ -6006,6 +7578,11 @@ export function makeTable(options) {
 		const metadataFlags = existingEntry?.metadataFlags;
 
 		const existingVersion = existingEntry?.version;
+		const existingRecord = existingEntry?.value;
+		const inheritedTimestamp = context?.timestamp || context?.transaction?.timestamp;
+		const sourceTimestamp =
+			inheritedTimestamp ||
+			(isRocksDB ? (primaryStore as RocksDatabase).getMonotonicTimestamp() : getNextMonotonicTime());
 		let whenResolved, timer;
 		// We start by locking the record so that there is only one resolution happening at once;
 		// if there is already a resolution in process, we want to use the results of that resolution
@@ -6044,10 +7621,8 @@ export function makeTable(options) {
 		// lock acquired — this request will actually load from source
 		setLoadedFromSource(target, true);
 
-		const existingRecord = existingEntry?.value;
 		// it is important to remember that this is _NOT_ part of the current transaction; nothing is changing
-		// with the canonical data, we are simply fulfilling our local copy of the canonical data, but still don't
-		// want a timestamp later than the current transaction
+		// with the canonical data, we are simply fulfilling our local copy of the canonical data.
 		// we create a new context for the source, we want to determine the timestamp and don't want to
 		// attribute this to the current user
 		const sourceContext = {
@@ -6083,13 +7658,37 @@ export function makeTable(options) {
 			// before the drain's fail-closed timeout below.
 			const commitPromise = transaction(sourceContext, async (_txn) => {
 				const start = performance.now();
-				let updatedRecord;
+				let updatedRecord, assignCreatedTime, sourceVersion;
 				let hasChanges, invalidated;
 				try {
 					updatedRecord = await throttledCallToSource(source, id, sourceContext, existingEntry);
 					invalidated = metadataFlags & INVALIDATED;
-					let version = sourceContext.lastModified || (invalidated && existingVersion);
-					hasChanges = invalidated || version > existingVersion || !existingRecord;
+					const reportedVersion = sourceContext.lastModified;
+					const validReportedVersion =
+						typeof reportedVersion === 'number' &&
+						Number.isFinite(reportedVersion) &&
+						reportedVersion > 0 &&
+						reportedVersion <= MAX_DATE_TIMESTAMP;
+					if (validReportedVersion) {
+						// A record version is also this node's ordering token (precedesExistingVersion), so a
+						// source-reported version ahead of local time would make every subsequent local write look
+						// out-of-order and be discarded until wall-clock caught up — freezing the row. Honor what
+						// the source reports, but never beyond now.
+						const versionCeiling = Math.max(sourceTimestamp, Date.now());
+						sourceVersion = Math.min(reportedVersion, versionCeiling);
+						if (sourceVersion !== reportedVersion) {
+							logger.trace?.(
+								`Capping future source version for ${tableName} id ${id}: ${reportedVersion} -> ${sourceVersion}`
+							);
+							if (!warnedFutureSourceVersion) {
+								warnedFutureSourceVersion = true;
+								logger.warn?.(
+									`The source for ${tableName} reported a lastModified ahead of local time (${new Date(reportedVersion).toISOString()}) for id ${id}; capping cached record versions at local time`
+								);
+							}
+						}
+					} else sourceVersion = sourceTimestamp;
+					hasChanges = invalidated || (validReportedVersion && reportedVersion > existingVersion) || !existingRecord;
 					const resolveDuration = performance.now() - start;
 					recordAction(resolveDuration, 'cache-resolution', tableName, null, 'success');
 					if (responseHeaders)
@@ -6103,7 +7702,7 @@ export function makeTable(options) {
 							if (status === 304) {
 								// revalidation of our current cached record
 								updatedRecord = existingRecord;
-								version = existingVersion;
+								sourceVersion = existingVersion;
 							} else if (!CACHEABLE_STATUS_CODES.has(status)) {
 								// non-cacheable status - propagate to client without caching
 								throw new ServerError(updatedRecord.body || 'Error from source', status);
@@ -6173,10 +7772,15 @@ export function makeTable(options) {
 						updatedRecord = storedFieldsOnly(primaryStore.encoder, updatedRecord);
 						if (primaryKey && updatedRecord[primaryKey] !== id) updatedRecord[primaryKey] = id;
 					}
+					assignCreatedTime = createdTimeProperty && updatedRecord?.[createdTimeProperty.name] == null;
 					resolved = true;
+					const resolvedVersion =
+						isRocksDB && updatedRecord && existingVersion != null
+							? Math.max(sourceVersion, existingVersion)
+							: sourceVersion;
 					const resolvedEntry: Entry = {
 						key: id,
-						version,
+						version: resolvedVersion,
 						value: updatedRecord,
 						expiresAt: sourceContext.expiresAt,
 						metadataFlags: 0,
@@ -6242,16 +7846,33 @@ export function makeTable(options) {
 				const sourceWrite: any = {
 					key: id,
 					store: primaryStore,
-					entry: existingEntry,
+					entry: undefined,
 					nodeName: 'source',
-					commit: (txnTime, existingEntry, _retry, transaction: any) => {
+					commit: (_txnTime, existingEntry, _retry, transaction: any) => {
 						sourceWrite.skipped = false; // reset on each retry; cleanup happens after commit if still true
-						if (existingEntry?.version !== existingVersion) {
-							// don't do anything if the version has changed
+						const racedVersion = existingEntry?.version;
+						// A first fill may replace a record that raced it only when its candidate version strictly
+						// orders after that record. The comparison has to be replica-independent, so a tie leaves the
+						// raced record in place: precedesExistingVersion() would break the tie with *this* node's
+						// name, and a fill from a shared source has no node identity of its own, so two replicas
+						// resolving the same tie could keep different values at the same version.
+						const replacesRacedRecord = racedVersion == null || sourceVersion > racedVersion;
+						if (
+							racedVersion !== existingVersion &&
+							// Revalidations retain exact-CAS semantics; first fills use deterministic ordering.
+							(existingVersion != null || !updatedRecord || !replacesRacedRecord)
+						) {
+							logger.trace?.(
+								`Discarding resolved record from source with id: ${id}, source version: ${sourceVersion}, current version: ${racedVersion}`
+							);
 							sourceWrite.skipped = true;
 							return;
 						}
-						updateIndices(id, existingRecord, updatedRecord, transaction && { transaction });
+						const currentRecord = existingEntry?.value;
+						const recordVersion =
+							isRocksDB && racedVersion != null ? Math.max(sourceVersion, racedVersion) : sourceVersion;
+						const txnLogKey = isRocksDB ? transaction?.getTimestamp?.() : recordVersion;
+						updateIndices(id, currentRecord, updatedRecord, transaction && { transaction });
 						if (updatedRecord) {
 							if (existingEntry) {
 								context.previousResidency = TableResource.getResidencyRecord(existingEntry.residencyId);
@@ -6262,22 +7883,22 @@ export function makeTable(options) {
 							if (updatedTimeProperty) {
 								updatedRecord[updatedTimeProperty.name] =
 									updatedTimeProperty.type === 'Date'
-										? new Date(txnTime)
+										? new Date(recordVersion)
 										: updatedTimeProperty.type === 'String'
-											? new Date(txnTime).toISOString()
-											: txnTime;
+											? new Date(recordVersion).toISOString()
+											: recordVersion;
 							}
-							if (createdTimeProperty && updatedRecord[createdTimeProperty.name] == null) {
-								const existingCreatedTime = existingEntry?.value?.[createdTimeProperty.name];
+							if (assignCreatedTime) {
+								const existingCreatedTime = currentRecord?.[createdTimeProperty.name];
 								if (existingCreatedTime != null) {
 									updatedRecord[createdTimeProperty.name] = existingCreatedTime;
 								} else {
 									updatedRecord[createdTimeProperty.name] =
 										createdTimeProperty.type === 'Date'
-											? new Date(txnTime)
+											? new Date(recordVersion)
 											: createdTimeProperty.type === 'String'
-												? new Date(txnTime).toISOString()
-												: txnTime;
+												? new Date(recordVersion).toISOString()
+												: recordVersion;
 								}
 							}
 							const residency = residencyFromFunction(TableResource.getResidency(updatedRecord, context));
@@ -6309,22 +7930,25 @@ export function makeTable(options) {
 								residencyId = getResidencyId(residency);
 							}
 							logger.trace?.(
-								`Writing resolved record from source with id: ${id}, timestamp: ${new Date(txnTime).toISOString()}`
+								`Writing resolved record from source with id: ${id}, timestamp: ${new Date(recordVersion).toISOString()}`
 							);
 							// TODO: We are doing a double check for ifVersion that should probably be cleaned out
+							const writeAudit = (audit && (hasChanges || omitLocalRecord)) || null;
 							updateRecord(
 								id,
 								updatedRecord,
 								existingEntry,
-								txnTime,
+								recordVersion,
 								omitLocalRecord ? INVALIDATED : 0,
-								(audit && (hasChanges || omitLocalRecord)) || null,
+								writeAudit,
 								{
 									user: (sourceContext as any)?.user,
 									expiresAt: sourceContext.expiresAt,
 									residencyId,
 									transaction,
 									tableToTrack: tableName,
+									additionalAuditRefs:
+										writeAudit && txnLogKey !== recordVersion ? [{ version: txnLogKey, nodeId: 0 }] : undefined,
 								},
 								'put',
 								Boolean(invalidated),
@@ -6334,17 +7958,26 @@ export function makeTable(options) {
 							if (sourceContext.expiresAt) scheduleCleanup();
 						} else if (existingEntry) {
 							logger.trace?.(
-								`Deleting resolved record from source with id: ${id}, timestamp: ${new Date(txnTime).toISOString()}`
+								`Deleting resolved record from source with id: ${id}, timestamp: ${new Date(recordVersion).toISOString()}`
 							);
 							if (audit || trackDeletes) {
 								updateRecord(
 									id,
 									null,
 									existingEntry,
-									txnTime,
+									recordVersion,
 									0,
 									(audit && hasChanges) || null,
-									{ user: (sourceContext as any)?.user, transaction, tableToTrack: tableName },
+									{
+										user: (sourceContext as any)?.user,
+										transaction,
+										tableToTrack: tableName,
+										recordVersion,
+										additionalAuditRefs:
+											audit && hasChanges && txnLogKey !== recordVersion
+												? [{ version: txnLogKey, nodeId: 0 }]
+												: undefined,
+									},
 									'delete',
 									Boolean(invalidated)
 								);
@@ -6433,6 +8066,7 @@ export function makeTable(options) {
 					if (entry.value == null) continue; // already removed
 					if (hasSourceGet && primaryStore.hasLock(item.key, entry.version)) continue; // resolution in progress
 					updateIndices(item.key, entry.value, null, options);
+					stageDerivedIndexEviction(transaction, item.key, entry.version);
 				}
 				removeEntry(primaryStore, entry, options);
 				staged++;
@@ -6507,7 +8141,13 @@ export function makeTable(options) {
 			},
 		};
 	}
+	function settlePendingCleanup() {
+		for (const resolve of pendingCleanupResolvers) resolve();
+		pendingCleanupResolvers.clear();
+	}
 	function scheduleCleanup(priority?: number): Promise<void> | void {
+		// a reclamation run may still hold this class's handler after cleanup(); a promise here would never settle
+		if (disposed) return;
 		let runImmediately = false;
 		if (priority) {
 			// run immediately if there is a big increase in priority
@@ -6517,11 +8157,21 @@ export function makeTable(options) {
 		// Periodically evict expired records and deleted records searching for records who expiresAt timestamp is before now
 		if (cleanupInterval === lastCleanupInterval && !runImmediately) return;
 		lastCleanupInterval = cleanupInterval;
-		if (getWorkerIndex() === getWorkerCount() - 1) {
+		if (ownsStoreMaintenance(primaryStore.path) || (ttlConfiguredByApplication && isDedicatedWorker())) {
 			// run on the last thread so we aren't overloading lower-numbered threads
 			if (cleanupTimer) clearTimeout(cleanupTimer);
-			if (!cleanupInterval) return;
-			return new Promise((resolve) => {
+			if (!cleanupInterval) {
+				// no replacement pass is being scheduled, so nothing is left to settle a superseded one
+				settlePendingCleanup();
+				return;
+			}
+			// This pass adopts the awaiters of the pass whose timer it just cleared: they settle when
+			// this pass's scan completes, so a reclamation run is never told the storage was reclaimed
+			// before any scan ran. It has to run now, though — that run blocks its whole path on the
+			// promise, and the replacement's own slot can be a full interval out.
+			if (pendingCleanupResolvers.size > 0) runImmediately = true;
+			return new Promise<void>((resolve) => {
+				pendingCleanupResolvers.add(resolve);
 				const startOfYear = new Date();
 				startOfYear.setMonth(0);
 				startOfYear.setDate(1);
@@ -6534,6 +8184,7 @@ export function makeTable(options) {
 					? Date.now()
 					: Math.ceil((Date.now() - startOfYear.getTime()) / nextInterval) * nextInterval + startOfYear.getTime();
 				const startNextTimer = (nextScheduled) => {
+					if (disposed) return;
 					logger.trace?.(`Scheduled next cleanup scan at ${new Date(nextScheduled)}`);
 					// noinspection JSVoidFunctionReturnValueUsed
 					cleanupTimer = setTimeout(
@@ -6544,8 +8195,11 @@ export function makeTable(options) {
 								const rootStore = primaryStore.rootStore;
 								if (rootStore.status !== 'open') {
 									clearTimeout(cleanupTimer);
+									settlePendingCleanup();
 									return;
 								}
+								// snapshot: an awaiter that arrives during this scan belongs to the pass that supersedes it
+								const settling = [...pendingCleanupResolvers];
 								const MAX_CLEANUP_CONCURRENCY = 50;
 								const outstandingCleanupOperations = new Array(MAX_CLEANUP_CONCURRENCY);
 								let cleanupIndex = 0;
@@ -6625,7 +8279,10 @@ export function makeTable(options) {
 								} catch (error) {
 									logger.warn?.(`Error in cleanup scan for ${tableName}:`, error);
 								}
-								resolve(undefined);
+								for (const settle of settling) {
+									pendingCleanupResolvers.delete(settle);
+									settle();
+								}
 								cleanupPriority = 0; // reset the priority
 							})),
 						Math.min(nextScheduled - Date.now(), MAX_SET_TIMEOUT_MS) // make sure it can fit in 32-bit signed number
@@ -6637,17 +8294,19 @@ export function makeTable(options) {
 	}
 	function addDeleteRemoval() {
 		deleteCallbackHandle = auditStore?.addDeleteRemovalCallback(tableId, primaryStore, (id: Id, version: number) => {
-			primaryStore.remove(id, version);
+			return primaryStore.remove(id, version);
 		});
 	}
 	function runRecordExpirationEviction() {
 		// Periodically evict expired records, searching for records who expiresAt timestamp is before now
-		if (getWorkerIndex() === 0) {
+		if (ownsStoreExpiration(primaryStore.path) || (ttlConfiguredByApplication && isDedicatedWorker())) {
 			// we want to run the pruning of expired records on only one thread so we don't have conflicts in evicting
-			setInterval(async () => {
+			recordExpirationInterval = setInterval(async () => {
 				// go through each database and table and then search for expired entries
 				// find any entries that are set to expire before now
-				if (runningRecordExpiration) return;
+				// updatedAttributes() clears expiresAtProperty when a live redeclaration drops the directive,
+				// and there is nothing left for this interval to scan by
+				if (disposed || runningRecordExpiration || !expiresAtProperty) return;
 				runningRecordExpiration = true;
 				try {
 					const expiresAtName = expiresAtProperty.name;