@harperfast/harper 5.2.13 → 5.3.0-beta.1

package/dist/resources/Table.js

@@ -41,7 +41,10 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.EVICTED = exports.INVALIDATED = void 0;
+exports.EVICTED = exports.INVALIDATED = exports.UPDATE_ATTRIBUTES_LOCK_SLOW_WAIT = exports.UPDATE_ATTRIBUTES_LOCK_TIMEOUT = void 0;
+exports.acquireUpdateAttributesLock = acquireUpdateAttributesLock;
+exports.releaseUpdateAttributesLock = releaseUpdateAttributesLock;
+exports.withUpdateAttributesLock = withUpdateAttributesLock;
 exports.ignoreAlreadyDropped = ignoreAlreadyDropped;
 exports.freezeRecord = freezeRecord;
 exports.frozenRecordView = frozenRecordView;
@@ -50,6 +53,7 @@ exports.coerceType = coerceType;
 const hdbTerms_ts_1 = require("../utility/hdbTerms.js");
 const node_vm_1 = require("node:vm");
 const node_crypto_1 = require("node:crypto");
+const node_perf_hooks_1 = require("node:perf_hooks");
 const commonUtility_ts_1 = require("../utility/lmdb/commonUtility.js");
 const nodeIdMapping_ts_1 = require("./nodeIdMapping.js");
 const lodash_1 = __importDefault(require("lodash"));
@@ -58,12 +62,15 @@ const lmdbProcessRows_js_1 = __importDefault(require("../dataLayer/harperBridge/
 const Resource_ts_1 = require("./Resource.js");
 const when_ts_1 = require("../utility/when.js");
 const DatabaseTransaction_ts_1 = require("./DatabaseTransaction.js");
+const recordLock_ts_1 = require("./recordLock.js");
+const nodeName_ts_1 = require("../server/nodeName.js");
 const envMngr = __importStar(require("../utility/environment/environmentManager.js"));
 const transactionBroadcast_ts_1 = require("./transactionBroadcast.js");
 const hdbError_ts_1 = require("../utility/errors/hdbError.js");
 const signalling = __importStar(require("../utility/signalling.js"));
 const itc_js_1 = require("../server/threads/itc.js");
 const databases_ts_1 = require("./databases.js");
+const replicatedApplyFailure_ts_1 = require("./replicatedApplyFailure.js");
 const search_ts_1 = require("./search.js");
 const logger_ts_1 = require("../utility/logging/logger.js");
 const staticResourceDispatch_ts_1 = require("./staticResourceDispatch.js");
@@ -72,6 +79,8 @@ const transaction_ts_1 = require("./transaction.js");
 const ordered_binary_1 = require("ordered-binary");
 const manageThreads_js_1 = require("../server/threads/manageThreads.js");
 const auditStore_ts_1 = require("./auditStore.js");
+const derivedIndexRegistry_ts_1 = require("./derivedIndexRegistry.js");
+const recordLockCoordinator_ts_1 = require("./recordLockCoordinator.js");
 const embedHook_ts_1 = require("./models/embedHook.js");
 const common_utils_ts_1 = require("../utility/common_utils.js");
 const RecordEncoder_ts_1 = require("./RecordEncoder.js");
@@ -92,8 +101,14 @@ const { sortBy } = lodash_1.default;
 const { validateAttribute } = lmdbProcessRows_js_1.default;
 const NULL_WITH_TIMESTAMP = new Uint8Array(9);
 NULL_WITH_TIMESTAMP[8] = 0xc0; // null
+const sourceWriteTypes = new Set(['put', 'patch', 'delete', 'publish', 'message', 'invalidate', 'relocate']);
+const isSourceWriteType = (type) => sourceWriteTypes.has(type);
+const SOURCE_APPLY_POSITION = Symbol('sourceApplyPosition');
 const UNCACHEABLE_TIMESTAMP = Infinity; // we use this when dynamic content is accessed that we can't safely cache, and this prevents earlier timestamps from change the "last" modification
+const MAX_DATE_TIMESTAMP = 8.64e15;
 const RECORD_PRUNING_INTERVAL = 60000; // one minute
+const MAX_CONCURRENT_HISTORY_REMOVALS = 10;
+const MAX_CONCURRENT_LMDB_HISTORY_REMOVALS = 1000;
 // RocksDB-only: number of eviction/tombstone removals coalesced into a single transaction commit.
 // Each evict otherwise pays a full transaction commit, so batching amortizes that cost. LMDB already
 // coalesces async writes per event turn (eventTurnBatching), so it keeps the per-record path.
@@ -102,6 +117,20 @@ const EVICTION_BATCH_SIZE = 100;
 // letting an unbounded number of open transactions (and their snapshots) accumulate.
 const MAX_INFLIGHT_EVICTION_BATCHES = 4;
 const CACHEABLE_STATUS_CODES = new Set([200, 203, 204, 206, 300, 301, 308, 404, 405, 410, 414, 501]);
+// Guardrails for `Prefer: count=exact`: once the requested page has been collected, counting the rest
+// of the match set is bounded by BOTH a row cap and a wall-clock budget, so a paginated read can't turn
+// into an unbounded scan. Exceeding either reports an unknown total (Content-Range `.../*`) rather than
+// truncating the page. These bound the count tail, not the page itself; a genuinely expensive query
+// (large filtered full-scan, in-memory sort) should still be gated by config before broad exposure.
+const MAX_EXACT_COUNT_SCAN = 1_000_000;
+const MAX_EXACT_COUNT_MS = 1_000;
+// Largest page a `Prefer: count=` request will materialize. A request whose limit exceeds this (or is
+// not a finite, non-negative integer, e.g. `limit(Infinity)`/`limit(foo)`) falls through to the normal
+// streaming path with no count, so a count request can't be coerced into buffering an unbounded page.
+const MAX_COUNT_PAGE = 10_000;
+// How often the exact-count drain yields to the macrotask queue (must be a power of two for the bit-mask
+// check). Keeps a large scan from monopolizing the event loop without adding a yield per row.
+const COUNT_YIELD_INTERVAL = 2_048;
 // Smallest forward sample `getRecordCount` will extrapolate a record rate from; below it the scan runs
 // to completion and reports an exact count.
 const MIN_ESTIMATOR_SAMPLE = 1_000;
@@ -119,6 +148,58 @@ function usableCount(estimate) {
 envMngr.initSync();
 const LMDB_PREFETCH_WRITES = envMngr.get(hdbTerms_ts_1.CONFIG_PARAMS.STORAGE_PREFETCHWRITES);
 const LOCK_TIMEOUT = 10000;
+// This bounds schema-lock acquisition; LOCK_TIMEOUT bounds in-flight record writes during a drop.
+exports.UPDATE_ATTRIBUTES_LOCK_TIMEOUT = 10000;
+const UPDATE_ATTRIBUTES_LOCK = 'update-attributes';
+// Contention is otherwise only visible once it becomes a timeout (harper#2251).
+exports.UPDATE_ATTRIBUTES_LOCK_SLOW_WAIT = 1000;
+// raw ASCII bytes are ordered-binary's encoding of the string, so this addresses the same native
+// lock as string-keyed tryLock/unlock calls
+const updateAttributesLockKey = Buffer.from(UPDATE_ATTRIBUTES_LOCK);
+const lockWait = new Int32Array(new SharedArrayBuffer(4));
+/** The wait blocks the event loop, so the locked section must stay synchronous. */
+function acquireUpdateAttributesLock(rootStore, scopeDescription, timeout = exports.UPDATE_ATTRIBUTES_LOCK_TIMEOUT) {
+    if (rootStore.tryLock(updateAttributesLockKey))
+        return;
+    const startTime = node_perf_hooks_1.performance.now();
+    let waitTime = 1;
+    while (!rootStore.tryLock(updateAttributesLockKey)) {
+        const elapsed = node_perf_hooks_1.performance.now() - startTime;
+        if (elapsed >= timeout) {
+            throw new hdbError_ts_1.UpdateAttributesLockTimeoutError(`Timed out after ${Math.round(elapsed)}ms waiting for the exclusive '${UPDATE_ATTRIBUTES_LOCK}' lock on ${scopeDescription}; the lock holder did not release it before the deadline, so this schema/attribute update cannot proceed`);
+        }
+        if (elapsed >= 2) {
+            Atomics.wait(lockWait, 0, 0, Math.min(waitTime, timeout - elapsed));
+            if (waitTime < 16)
+                waitTime *= 2;
+        }
+    }
+    const waited = node_perf_hooks_1.performance.now() - startTime;
+    // The caller cannot register its release until we return, so a throw here would leak the lock
+    // with no `finally` able to reach it.
+    if (waited >= exports.UPDATE_ATTRIBUTES_LOCK_SLOW_WAIT)
+        try {
+            logger_ts_1.logger.warn?.(`Acquired the exclusive '${UPDATE_ATTRIBUTES_LOCK}' lock on ${scopeDescription} after waiting ${Math.round(waited)}ms; this worker's event loop was blocked for that wait, and a holder that runs past ${exports.UPDATE_ATTRIBUTES_LOCK_TIMEOUT}ms fails the update outright`);
+        }
+        catch { }
+}
+function releaseUpdateAttributesLock(rootStore) {
+    rootStore.unlock(updateAttributesLockKey);
+}
+function withUpdateAttributesLock(rootStore, scopeDescription, callback) {
+    acquireUpdateAttributesLock(rootStore, scopeDescription);
+    try {
+        const result = callback();
+        if (typeof result?.then === 'function') {
+            Promise.resolve(result).catch((error) => logger_ts_1.logger.error?.(`Async update-attributes callback rejected after its lock was released (${scopeDescription})`, error));
+            throw new TypeError(`withUpdateAttributesLock callback must be synchronous (${scopeDescription}); asynchronous work may continue after the lock is released`);
+        }
+        return result;
+    }
+    finally {
+        releaseUpdateAttributesLock(rootStore);
+    }
+}
 // Tolerate a redundant column family drop. Drops are broadcast to every worker
 // thread and each holds its own handle to the same underlying family, so a
 // concurrent worker may already have dropped it; the storage engine reports
@@ -349,9 +430,49 @@ function detectCyclicEnumerable(start) {
 function chainKeyForId(id) {
     return typeof id === 'string' ? 's' + id : 'k' + (0, DatabaseTransaction_ts_1.writeKeyId)(id);
 }
+/** Normalizes a passed `context` argument as `transactional()` does; undefined means fall back to ambient. */
+function contextArgument(context) {
+    if (!context || (0, DatabaseTransaction_ts_1.isReleasedTransaction)(context))
+        return undefined;
+    const resolved = context.getContext?.() || context;
+    return resolved instanceof DatabaseTransaction_ts_1.DatabaseTransaction ? { transaction: resolved } : resolved;
+}
+/** The cluster round never ran for a node-scoped handle, so no peer ever deferred to it. */
+function scopeViolation(handle, resolved, databaseName) {
+    if (resolved.scope !== 'cluster' || handle.clusterTsR !== undefined)
+        return undefined;
+    // The same predicate lock() fails closed on, not the transport alone: a coalesced caller re-checks
+    // this after its wait, and a transport unregistered during that wait leaves the database still
+    // clustered while the lookup answers undefined. Only the implicit Phase 0 case falls through.
+    if (!resolved.scopeRequested && !(0, recordLockCoordinator_ts_1.isClusterLockRequired)(databaseName) && !(0, recordLockCoordinator_ts_1.getClusterLockTransport)(databaseName))
+        return undefined;
+    return new hdbError_ts_1.ClientError('This transaction already holds a node-scoped lock on this record, so a cluster-scoped lock cannot be taken on top of it', 409);
+}
+/** Distinguishes bare lock options from a record target (id, URL, {id:...}). */
+function isPlainOptions(value) {
+    return (typeof value === 'object' &&
+        value !== null &&
+        !Array.isArray(value) &&
+        !(value instanceof URLSearchParams) &&
+        value.id === undefined);
+}
+// Lets a transport push a received control entry straight to the right coordinator without
+// importing Table (which would be a cycle through databases.ts).
+(0, recordLockCoordinator_ts_1.setLockCoordinatorResolver)((database, tableName) => databases_ts_1.databases[database]?.[tableName]?.lockCoordinator, (database, tableName) => databases_ts_1.databases[database]?.[tableName]?.admittingCoordinator, (database, tableName) => {
+    const Table = databases_ts_1.databases[database]?.[tableName];
+    if (typeof Table?.writeLockControlEntry !== 'function')
+        return undefined;
+    return (entry) => Table.writeLockControlEntry(entry);
+});
 function makeTable(options) {
-    const { primaryKey, indices, tableId, tableName, primaryStore, databasePath, databaseName, auditStore, schemaDefined, dbisDB: dbisDb, sealed, splitSegments, replicate, description, hidden, cacheControl, } = options;
+    var _a;
+    const { primaryKey, indices, tableId, tableName, primaryStore, databasePath, databaseName, auditStore, schemaDefined, dbisDB: dbisDb, sealed, splitSegments, replicate, description, hidden, cacheControl, isBranch, } = options;
     let { expirationMS: expirationMs, evictionMS: evictionMs, audit, trackDeletes } = options;
+    // Set when the TTL exists only on this thread: either application code configured it at runtime, or
+    // an isolated application's schema was declared here. Hydrating persisted metadata does not set it:
+    // dedicated workers open unrelated shared tables too, whose scan remains owned by the pool.
+    let ttlConfiguredByApplication = false;
+    let ttlFromLoad = false; // true only around the creation-time call below
     evictionMs ??= 0;
     // Eviction without explicit expiration means expiration:0. Apply at construction so
     // describe_all sees it on every worker, not just ones that ran setTTLExpiration.
@@ -363,7 +484,11 @@ function makeTable(options) {
     if (!properties)
         properties = (0, jsonSchemaTypes_ts_1.projectAttributesToProperties)(attributes);
     const updateRecord = (0, RecordEncoder_ts_1.recordUpdater)(primaryStore, tableId, auditStore);
+    // Created on first cluster-scoped lock() or first arriving control entry, and only while a
+    // transport is registered for this database.
+    let lockCoordinator;
     let warnedNullSourcePut = false; // latched: one warn per table per worker (see _writeUpdate)
+    let warnedFutureSourceVersion = false; // likewise (see getFromSource)
     let sourceLoad; // if a source has a load function (replicator), record it here
     let hasSourceGet;
     let primaryKeyAttribute;
@@ -397,6 +522,10 @@ function makeTable(options) {
     let cleanupPriority = 0;
     let lastCleanupInterval;
     let cleanupTimer;
+    let recordExpirationInterval;
+    // a reclamation pass awaits a scheduled cleanup, which only settles from its timer
+    const pendingCleanupResolvers = new Set();
+    let disposed = false;
     // true once a table-level expiration/eviction/scanInterval has armed the periodic cleanup scan at setup
     let expirationScanScheduled = false;
     // set on the first expiring write so the unscheduled-expiration warning is evaluated at most once per table
@@ -445,10 +574,11 @@ function makeTable(options) {
     const MAX_PREFETCH_BUNDLE = 6;
     if (audit)
         addDeleteRemoval();
-    (0, storageReclamation_ts_1.onStorageReclamation)(primaryStore.path, (priority) => {
+    const reclamationHandler = (priority) => {
         if (hasSourceGet)
             return scheduleCleanup(priority);
-    });
+    };
+    (0, storageReclamation_ts_1.onStorageReclamation)(primaryStore.path, reclamationHandler);
     class Updatable extends tracked_ts_1.GenericTrackedObject {
         getUpdatedTime() {
             return RecordEncoder_ts_1.entryMap.get(this.getRecord())?.version;
@@ -547,12 +677,104 @@ function makeTable(options) {
             },
         });
     }
+    function resolveAuditHead(id, version, nodeId, refs) {
+        if (!refs?.length)
+            return { txnLogKey: version, nodeId };
+        const visited = new Set();
+        function findHead(candidateRefs) {
+            if (!candidateRefs)
+                return;
+            const pending = candidateRefs.slice().reverse();
+            while (pending.length > 0) {
+                const ref = pending.pop();
+                const identity = `${ref.nodeId ?? 0}:${ref.version}`;
+                if (visited.has(identity))
+                    continue;
+                visited.add(identity);
+                const entry = auditStore.getSync(ref.version, tableId, id, ref.nodeId);
+                if (!entry)
+                    continue;
+                if (entry.version === version && (nodeId == null || (entry.nodeId ?? 0) === nodeId))
+                    return { txnLogKey: ref.version, nodeId: ref.nodeId };
+                const previousRefs = entry.previousAdditionalAuditRefs;
+                if (previousRefs) {
+                    for (let index = previousRefs.length - 1; index >= 0; index--)
+                        pending.push(previousRefs[index]);
+                }
+            }
+        }
+        const referencedHead = findHead(refs);
+        if (referencedHead)
+            return referencedHead;
+        if (version != null) {
+            const directHead = auditStore.getSync(version, tableId, id, nodeId);
+            if (directHead?.version === version && (nodeId == null || (directHead.nodeId ?? 0) === nodeId))
+                return { txnLogKey: version, nodeId };
+        }
+        return { txnLogKey: version, nodeId };
+    }
+    // Canonical-source applies (sourceApply), replay and replication notifications are never shed;
+    // dropping one would advance the source cursor past a write that never landed.
+    function assertDerivedIndexAdmission(options, transaction) {
+        if (options?.isNotification || transaction?.sourceApply || transaction?.isReplay)
+            return;
+        const reason = (0, derivedIndexRegistry_ts_1.derivedIndexWriteRejection)(auditStore, tableId);
+        if (reason)
+            throw new hdbError_ts_1.DerivedIndexLagError(reason);
+    }
+    function stageDerivedIndexEviction(transaction, id, version) {
+        if (!(0, derivedIndexRegistry_ts_1.hasDerivedIndexRegistration)(auditStore, tableId))
+            return;
+        const nodeId = (0, nodeIdMapping_ts_1.getThisNodeId)(auditStore) ?? 0;
+        auditStore.put(null, {
+            type: 'evict',
+            tableId,
+            recordId: id,
+            version,
+            nodeId,
+            extendedType: auditStore_ts_1.LOCAL_ONLY,
+        }, { transaction, nodeId });
+    }
     class TableResource extends Resource_ts_1.Resource {
         #record; // the stored/frozen record from the database and stored in the cache (should not be modified directly)
         #changes; // the changes to the record that have been made (should not be modified directly)
         #version; // version of the record
         #entry; // the entry from the database
         #savingOperation; // operation for the record is currently being saved
+        #lockHandle; // the record lock acquired by lock() — scoped or hold
+        #lockWritable; // set by #reloadLocked to let save() stage lock-writable updates
+        #writeGeneration;
+        [tracked_ts_1.ASSERT_TRACKED_WRITABLE](generation = this.#writeGeneration) {
+            if (!generation)
+                return;
+            if (generation.internalWrites > 0)
+                return;
+            if (generation !== this.#writeGeneration || generation.closed)
+                throw new hdbError_ts_1.ClientError('Can not modify an update instance after it has been saved; call update() again', 409);
+        }
+        [tracked_ts_1.GET_TRACKED_WRITE_GENERATION]() {
+            return (this.#writeGeneration ??= { closed: false, internalWrites: 0 });
+        }
+        /**
+         * Shared guard: if this instance is lock-writable but the handle is gone (expired or
+         * released), throw 409 before staging any write. Covers update/invalidate/relocate/delete
+         * in addition to the save() path. Every lock-writable instance carries its own handle in
+         * #lockHandle (scoped and hold alike), so we never need to search the registry here.
+         */
+        #assertLiveHandle(id, allowClosed = false) {
+            if (!allowClosed && this.#writeGeneration?.closed && (0, DatabaseTransaction_ts_1.writeKeyId)(id) === (0, DatabaseTransaction_ts_1.writeKeyId)(this.getId()))
+                this[tracked_ts_1.ASSERT_TRACKED_WRITABLE]();
+            if (!this.#lockWritable)
+                return;
+            const handle = this.#lockHandle;
+            // Off-key writes through the same resource instance are ordinary; only guard the
+            // exact key the lock was acquired for.
+            if (handle.keyId !== (0, DatabaseTransaction_ts_1.writeKeyId)(id))
+                return;
+            if (handle.isExpired()) {
+                throw (0, recordLock_ts_1.lockNotHeldError)(handle);
+            }
+        }
         // #section: static-config
         static name = tableName; // for display/debugging purposes
         static primaryStore = primaryStore;
@@ -561,6 +783,7 @@ function makeTable(options) {
         static tableName = tableName;
         static tableId = tableId;
         static indices = indices;
+        static derivedIndexRuntime;
         static audit = audit;
         static databasePath = databasePath;
         static databaseName = databaseName;
@@ -646,10 +869,62 @@ function makeTable(options) {
             (async () => {
                 let userRoleUpdate = false;
                 let lastSequenceId;
+                let pendingApplyFailures;
+                const reportDroppedWrite = (event, context, error) => {
+                    const position = event === context ? context[SOURCE_APPLY_POSITION] : (event.timestamp ?? context[SOURCE_APPLY_POSITION]);
+                    const notification = (0, replicatedApplyFailure_ts_1.notifyReplicatedApplyFailure)(databaseName, {
+                        nodeId: event.nodeId ?? context.nodeId,
+                        table: event.table ?? context.table,
+                        localTime: event.localTime ?? context.localTime,
+                    }, position, error, tableName);
+                    pendingApplyFailures = pendingApplyFailures
+                        ? Promise.all([pendingApplyFailures, notification]).then(noop)
+                        : notification;
+                    return notification;
+                };
+                /** Cluster lock coordination entries (harper#483 Phase 1) describe no record. */
+                const applyLockControlEvent = (event, context) => {
+                    const entry = (0, recordLockCoordinator_ts_1.decodeLockControlPayload)(event.type, event.value);
+                    if (!entry) {
+                        logger_ts_1.logger.warn?.('discarding a malformed record lock control entry from', event.nodeId, event.type);
+                        return reportDroppedWrite(event, context, new Error('Malformed record lock control entry'));
+                    }
+                    const target = event.table ? databases_ts_1.databases[databaseName]?.[event.table] : _a;
+                    try {
+                        // The audit header's nodeId is the origin, translated on receive and preserved across
+                        // relays. The payload's own names are peer-supplied and prove nothing. Rebuild the id
+                        // map on a miss rather than waiting out the negative-cache window: a dropped release
+                        // leaves the key's home holding its grant until the delegation's own deadline, and
+                        // control entries are far too rare to drive the store.
+                        //
+                        // Inside the guard, not before it: that rebuild reads the audit store, and a throw
+                        // there would escape this sink and stall the apply loop for every later entry — the §8
+                        // rule that a receive boundary settles its callers and keeps admission closed.
+                        const author = (0, nodeIdMapping_ts_1.getNodeNameForId)(auditStore, event.nodeId, true);
+                        if (!author) {
+                            logger_ts_1.logger.warn?.('discarding a record lock control entry whose origin node could not be resolved');
+                            return reportDroppedWrite(event, context, new Error('Record lock control origin could not be resolved'));
+                        }
+                        // The coordinator getter fails closed on an unusable node identity. That is right for
+                        // an acquire and wrong here: rejecting out of this sink stalls the apply loop for
+                        // every later entry rather than dropping one.
+                        // `admittingCoordinator`, because `lockCoordinator` answers undefined while a transport
+                        // is momentarily unregistered — and this sink runs off the replication stream, not off
+                        // that transport. Dropping a peer's clean-handoff release there leaves the home holding
+                        // its grant for the delegation's whole deadline.
+                        target?.admittingCoordinator?.applyEntry(entry, author, event.timestamp);
+                    }
+                    catch (error) {
+                        logger_ts_1.logger.warn?.('dropping a record lock control entry: the coordinator is unavailable', error);
+                        return reportDroppedWrite(event, context, error);
+                    }
+                };
                 // perform the write of an individual write event
                 const writeUpdate = async (event, context) => {
+                    if ((0, auditStore_ts_1.isLockControlType)(event.type))
+                        return applyLockControlEvent(event, context);
                     const value = event.value;
-                    const Table = event.table ? databases_ts_1.databases[databaseName][event.table] : TableResource;
+                    const Table = event.table ? databases_ts_1.databases[databaseName][event.table] : _a;
                     if (databaseName === hdbTerms_ts_1.SYSTEM_SCHEMA_NAME &&
                         (event.table === hdbTerms_ts_1.SYSTEM_TABLE_NAMES.ROLE_TABLE_NAME || event.table === hdbTerms_ts_1.SYSTEM_TABLE_NAMES.USER_TABLE_NAME)) {
                         userRoleUpdate = true;
@@ -666,6 +941,9 @@ function makeTable(options) {
                         ensureLoaded: false,
                         nodeId: event.nodeId,
                         viaNodeId: event.viaNodeId,
+                        // the origin's record version, stored as-is so every replica holds the version the
+                        // origin holds; the transaction's own timestamp stays the origin's log key
+                        version: event.version,
                         // use per-event expiresAt: batched txn context only holds the first event's expiration
                         expiresAt: event.expiresAt,
                         // bulk base-copy snapshot frame: apply current-state directly, without an audit/transaction-log
@@ -675,6 +953,15 @@ function makeTable(options) {
                         async: true,
                     };
                     const id = event.id;
+                    if (!isSourceWriteType(event.type)) {
+                        logger_ts_1.logger.error?.('Unknown operation', event.type, event.id);
+                        const notification = reportDroppedWrite(event, context, new Error('Unknown source operation'));
+                        if (event.finished)
+                            await event.finished;
+                        return notification;
+                    }
+                    if (Table && event.type === 'put' && value == null && !shouldRevalidateEvents)
+                        await reportDroppedWrite(event, context, new Error('Source-applied put has no record content'));
                     const resource = await Table.getResource(id, context, options);
                     if (event.finished)
                         await event.finished;
@@ -696,15 +983,18 @@ function makeTable(options) {
                             return resource._writeInvalidate(id, value, options);
                         case 'relocate':
                             return resource._writeRelocate(id, options);
-                        default:
-                            logger_ts_1.logger.error?.('Unknown operation', event.type, event.id);
                     }
                 };
                 /** Keeps the writes to any one key in arrival order; see DESIGN.md (harper#2211). */
                 const stageWrite = (event, context) => {
+                    // A grant must not queue behind whatever the key it names is doing.
+                    if ((0, auditStore_ts_1.isLockControlType)(event.type) ||
+                        !isSourceWriteType(event.type) ||
+                        (event.type === 'put' && event.value == null && !shouldRevalidateEvents))
+                        return writeUpdate(event, context);
                     let chainKey;
                     try {
-                        const Table = event.table ? databases_ts_1.databases[databaseName][event.table] : TableResource;
+                        const Table = event.table ? databases_ts_1.databases[databaseName][event.table] : _a;
                         const id = event.id ?? (event.value ? event.value[Table?.primaryKey] : undefined);
                         if (id != null && typeof id !== 'symbol')
                             chainKey = `${event.table ?? tableName} ${chainKeyForId(id)}`;
@@ -745,14 +1035,18 @@ function makeTable(options) {
                         omitCurrent: true,
                     };
                     const subscribeOnThisThread = source.subscribeOnThisThread
-                        ? source.subscribeOnThisThread((0, manageThreads_js_1.getWorkerIndex)(), subscriptionOptions)
-                        : (0, manageThreads_js_1.getWorkerIndex)() === 0;
+                        ? source.subscribeOnThisThread((0, manageThreads_js_1.applicationWorkerIndex)(), subscriptionOptions)
+                        : (0, manageThreads_js_1.runsApplicationCodeSingletons)(); // set up by the defining application's code, so it runs where that code does
                     const subscription = hasSubscribe && subscribeOnThisThread && (await source.subscribe?.(subscriptionOptions));
                     if (subscription) {
                         let txnInProgress;
                         // we listen for events by iterating through the async iterator provided by the subscription
                         for await (const event of subscription) {
+                            let failureEvent = event;
+                            let failurePosition;
+                            let applied = false;
                             try {
+                                failurePosition = event?.timestamp;
                                 if (!event || typeof event !== 'object') {
                                     logger_ts_1.logger.error?.('Bad subscription event', event);
                                     continue;
@@ -760,6 +1054,7 @@ function makeTable(options) {
                                 const firstWrite = event.type === 'transaction' ? event.writes[0] : event;
                                 if (!firstWrite) {
                                     logger_ts_1.logger.error?.('Bad subscription event', event);
+                                    await (0, replicatedApplyFailure_ts_1.notifyReplicatedApplyFailure)(databaseName, event, failurePosition, new Error('Subscription transaction has no writes'), tableName);
                                     continue;
                                 }
                                 event.source = source;
@@ -768,11 +1063,16 @@ function makeTable(options) {
                                 // there is no re-subscribe / sequence-id-resume path to recover it. Mark the context so the
                                 // commit retries such conflicts without a cap (see DatabaseTransaction commit).
                                 event.sourceApply = true;
+                                event[SOURCE_APPLY_POSITION] = failurePosition;
                                 if (event.type === 'end_txn') {
                                     // Capture the in-progress transaction in a stable local: the loop variable is reset
                                     // once this transaction completes (below), but the seq-id closure and the commit await
                                     // still need to reference it afterward.
                                     const committingTxn = txnInProgress;
+                                    if (committingTxn) {
+                                        failureEvent = committingTxn;
+                                        failurePosition = committingTxn[SOURCE_APPLY_POSITION];
+                                    }
                                     committingTxn?.resolve();
                                     let updateRecordedSequenceId;
                                     if (event.localTime && lastSequenceId !== event.localTime) {
@@ -855,6 +1155,7 @@ function makeTable(options) {
                                     let committed;
                                     try {
                                         committed = committingTxn ? await committingTxn.committed : undefined;
+                                        applied = true;
                                         if (event.onCommit) {
                                             // the onCommit callback can be async and carry associated work (e.g. blob
                                             // transfer); wait for it too before recording the sequence id. Pass the commit
@@ -891,6 +1192,7 @@ function makeTable(options) {
                                             // than rethrow) so the current beginTxn still starts a fresh transaction with
                                             // correct boundaries instead of having its writes applied as standalone ones.
                                             logger_ts_1.logger.error?.('source-applied transaction commit failed during apply', error);
+                                            await (0, replicatedApplyFailure_ts_1.notifyReplicatedApplyFailure)(databaseName, txnInProgress, txnInProgress[SOURCE_APPLY_POSITION], error, tableName);
                                         }
                                         finally {
                                             // Clear it regardless of outcome so a rejected commit isn't re-awaited on the
@@ -904,7 +1206,9 @@ function makeTable(options) {
                                         continue;
                                     }
                                 }
-                                // use the version as the transaction timestamp
+                                // A source that reports no log position of its own (no `timestamp`) has only one clock,
+                                // so its record version doubles as the apply transaction's timestamp. A replication
+                                // receiver always sets `timestamp` from the origin's log key and never reaches this.
                                 if (!event.timestamp && event.version)
                                     event.timestamp = event.version;
                                 const commitResolution = (0, transaction_ts_1.transaction)(event, () => {
@@ -978,6 +1282,7 @@ function makeTable(options) {
                                         // standalone write: backpressure on the commit before pulling the next event,
                                         // and pass the commit resolution through to the callback.
                                         const committed = commitResolution ? await commitResolution : undefined;
+                                        applied = true;
                                         await event.onCommit(committed);
                                     }
                                 }
@@ -988,6 +1293,15 @@ function makeTable(options) {
                             }
                             catch (error) {
                                 logger_ts_1.logger.error?.('error in subscription handler', error);
+                                if (!applied)
+                                    await (0, replicatedApplyFailure_ts_1.notifyReplicatedApplyFailure)(databaseName, failureEvent, failurePosition, error, tableName);
+                            }
+                            finally {
+                                while (pendingApplyFailures) {
+                                    const notification = pendingApplyFailures;
+                                    pendingApplyFailures = undefined;
+                                    await notification;
+                                }
                             }
                         }
                     }
@@ -1005,7 +1319,7 @@ function makeTable(options) {
         /** Indicates if the events should be revalidated when they are received. By default we do this if the get
          * method is overriden */
         static get shouldRevalidateEvents() {
-            return this.prototype.get !== TableResource.prototype.get;
+            return this.prototype.get !== _a.prototype.get;
         }
         /**
          * Gets a resource instance, as defined by the Resource class, adding the table-specific handling
@@ -1041,7 +1355,7 @@ function makeTable(options) {
                 }
                 return loadLocalRecord(id, request, { transaction: readTxn, ensureLoaded: resourceOptions?.ensureLoaded }, sync, (entry) => {
                     if (entry) {
-                        TableResource._updateResource(this, entry);
+                        _a._updateResource(this, entry);
                     }
                     else
                         this.#record = null;
@@ -1059,7 +1373,7 @@ function makeTable(options) {
                         if (loadingFromSource) {
                             txn?.disregardReadTxn(); // this could take some time, so don't keep the transaction open if possible
                             return (0, when_ts_1.when)(loadingFromSource, (entry) => {
-                                TableResource._updateResource(this, entry);
+                                _a._updateResource(this, entry);
                                 return this;
                             });
                         }
@@ -1251,15 +1565,24 @@ function makeTable(options) {
          * This also informs the scheduling for record eviction.
          * @param opts Time in seconds until records expire, or an options object with `expiration`, `eviction`,
          * and `scanInterval` (all in seconds, all optional). Number form preserves any previously configured
-         * eviction/scanInterval; object form replaces all three.
+         * eviction/scanInterval; object form replaces all three. An internal schema ownership-only call with
+         * none of those values preserves the settings already loaded from the catalog.
          */
         static setTTLExpiration(opts) {
             if (opts == null || (typeof opts !== 'number' && typeof opts !== 'object'))
                 throw new Error('Invalid expiration value type');
+            const declaredHere = typeof opts === 'object' && opts.fromSchema;
+            const isolatedApplicationOwner = declaredHere && opts.isolatedApplicationOwner;
+            const preserveLoadedConfiguration = declaredHere && opts.expiration === undefined && opts.eviction === undefined && opts.scanInterval === undefined;
+            if (((!ttlFromLoad && !declaredHere) || isolatedApplicationOwner) && !ttlConfiguredByApplication) {
+                ttlConfiguredByApplication = true;
+                // the scan owner may have changed with this: re-evaluate even if the interval did not
+                lastCleanupInterval = undefined;
+            }
             if (typeof opts === 'number') {
                 expirationMs = opts * 1000;
             }
-            else {
+            else if (!preserveLoadedConfiguration) {
                 // `??` so an explicit 0 is treated as the user's chosen value, not as "missing"
                 expirationMs = (opts.expiration ?? 0) * 1000;
                 evictionMs = (opts.eviction ?? 0) * 1000;
@@ -1267,10 +1590,19 @@ function makeTable(options) {
             }
             if (expirationMs < 0)
                 throw new Error('Expiration can not be negative');
-            // default to one quarter of the total expiration+eviction window
-            cleanupInterval = cleanupInterval || (expirationMs + evictionMs) / 4;
-            expirationScanScheduled = true;
-            scheduleCleanup();
+            if (!preserveLoadedConfiguration) {
+                // default to one quarter of the total expiration+eviction window
+                cleanupInterval = cleanupInterval || (expirationMs + evictionMs) / 4;
+                expirationScanScheduled = true;
+            }
+            // Re-evaluate an existing table-level scan after an ownership-only declaration, but do not
+            // create the default daily cleanup timer for a table that has only an @expiresAt field.
+            if (!preserveLoadedConfiguration || expirationScanScheduled || evictionMs)
+                scheduleCleanup();
+            // @expiresAt has its own interval rather than the cleanup timer above. Arm it whenever a live
+            // declaration introduces the attribute, including after this application already claimed TTL.
+            if (expiresAtProperty && !recordExpirationInterval)
+                runRecordExpirationEviction();
         }
         static getResidencyRecord(id) {
             // getSync (not get): callers consume the result synchronously (e.g. residency.includes(...) in a
@@ -1279,7 +1611,7 @@ function makeTable(options) {
             return dbisDb.getSync([Symbol.for('residency_by_id'), id]);
         }
         static setResidency(getResidency) {
-            TableResource.getResidency =
+            _a.getResidency =
                 getResidency &&
                     ((record, context) => {
                         try {
@@ -1292,7 +1624,7 @@ function makeTable(options) {
                     });
         }
         static setResidencyById(getResidencyById) {
-            TableResource.getResidencyById =
+            _a.getResidencyById =
                 getResidencyById &&
                     ((id) => {
                         try {
@@ -1305,8 +1637,8 @@ function makeTable(options) {
                     });
         }
         static getResidency(record, context) {
-            if (TableResource.getResidencyById) {
-                return TableResource.getResidencyById(record[primaryKey]);
+            if (_a.getResidencyById) {
+                return _a.getResidencyById(record[primaryKey]);
             }
             let count = replicateToCount;
             if (context.replicateTo != undefined) {
@@ -1348,7 +1680,7 @@ function makeTable(options) {
                 return; // already enabled
             audit = true;
             addDeleteRemoval();
-            TableResource.audit = true;
+            _a.audit = true;
         }
         /**
          * Coerce the id as a string to the correct type for the primary key
@@ -1360,7 +1692,57 @@ function makeTable(options) {
                 return null;
             return coerceType(id, primaryKeyAttribute);
         }
+        /**
+         * A branch's Table classes deliberately carry the BASE's logical database name so an
+         * application's schema and code resolve unchanged (harper#643). That makes every schema
+         * mutation resolve against the global catalog — a `dropTable()` through a branch would delete
+         * the live base table. Reads and writes are per-branch and unaffected; DDL is refused until a
+         * branch owns a schema identity of its own.
+         */
+        static assertSchemaMutable(operation) {
+            if (!isBranch)
+                return;
+            const error = new Error(`Cannot ${operation} through a branched database: '${tableName}' resolves to the schema of base ` +
+                `database '${databaseName}', so the change would apply to the base rather than the branch`);
+            error.statusCode = 400;
+            throw error;
+        }
         static async dropTable() {
+            _a.assertSchemaMutable('drop a table');
+            const rootStore = primaryStore.rootStore;
+            if (databaseName === databasePath &&
+                rootStore instanceof rocksdb_js_1.RocksDatabase &&
+                dbisDb.put !== dbisDb.putSync)
+                throw new Error(`Cannot drop ${databaseName}.${_a.tableName}: the catalog store's put is asynchronous, so the drop tombstone cannot be made durable before the column families are dropped`);
+            // Release post-commit derived-index delivery before any destructive work: the runner's
+            // backend must have quiesced before its stores and native file are destroyed, and a
+            // same-name recreate must not race an owner still applying to the old generation.
+            const derivedIndexRuntime = _a.derivedIndexRuntime;
+            const restoreDerivedIndexesAfterFailedDrop = () => {
+                try {
+                    _a.derivedIndexRuntime = derivedIndexRuntime?.restoreAfterFailedDrop?.();
+                }
+                catch (restoreError) {
+                    _a.derivedIndexRuntime = undefined;
+                    logger_ts_1.logger.error?.(`Could not restore derived indexes after failed drop of ${databaseName}.${_a.tableName}`, restoreError);
+                }
+            };
+            try {
+                await derivedIndexRuntime?.close(true);
+            }
+            catch (error) {
+                restoreDerivedIndexesAfterFailedDrop();
+                throw error;
+            }
+            const abortStaleDrop = () => {
+                derivedIndexRuntime?.completeDrop?.(false);
+                _a.derivedIndexRuntime = undefined;
+                _a.cleanup();
+                if (databases_ts_1.databases[databaseName]?.[tableName] === _a)
+                    delete databases_ts_1.databases[databaseName][tableName];
+            };
+            let dropIdentityConfirmed = databaseName !== databasePath;
+            let primaryCatalogKey = _a.tableName + '/';
             if (databaseName === databasePath) {
                 // Persist a drop tombstone on the primary catalog entry BEFORE any
                 // destructive work. If the process dies or a column family drop fails
@@ -1368,9 +1750,21 @@ function makeTable(options) {
                 // the next startup (or a same-name create) completes the drop via
                 // completeInterruptedDrop in databases.ts instead of resurrecting
                 // the table.
-                const primaryCatalogKey = TableResource.tableName + '/';
-                const primaryMeta = dbisDb.getSync(primaryCatalogKey);
-                if (primaryMeta && !primaryMeta.dropping) {
+                let tombstoneWrite;
+                const writeTombstone = () => {
+                    let primaryMeta = dbisDb.getSync(primaryCatalogKey);
+                    if (!primaryMeta && primaryKey) {
+                        const legacyPrimaryKey = `${_a.tableName}/${primaryKey}`;
+                        const legacyPrimaryMeta = dbisDb.getSync(legacyPrimaryKey);
+                        if (legacyPrimaryMeta?.isPrimaryKey) {
+                            primaryCatalogKey = legacyPrimaryKey;
+                            primaryMeta = legacyPrimaryMeta;
+                        }
+                    }
+                    if (!primaryMeta || (primaryMeta.tableId != null && primaryMeta.tableId !== tableId))
+                        return false;
+                    if (primaryMeta.dropping)
+                        return true;
                     primaryMeta.dropping = true;
                     // Stamps this drop's identity so the interrupted-drop retry budget in
                     // databases.ts can be scoped to THIS drop rather than the table name: a
@@ -1380,14 +1774,33 @@ function makeTable(options) {
                     // the budget by generation instead makes the new drop's tombstone carry
                     // its own fresh key regardless of what any worker last observed.
                     primaryMeta.dropGeneration = (0, node_crypto_1.randomUUID)();
-                    // put is rebound to putSync on RocksDB stores; on LMDB it returns
-                    // a promise, so await it to make the tombstone durable before the
-                    // destructive work below
-                    const tombstoneWrite = dbisDb.put(primaryCatalogKey, primaryMeta);
-                    if (tombstoneWrite?.then)
-                        await tombstoneWrite;
+                    tombstoneWrite = dbisDb.put(primaryCatalogKey, primaryMeta);
+                    return true;
+                };
+                try {
+                    if (rootStore instanceof rocksdb_js_1.RocksDatabase) {
+                        // withUpdateAttributesLock's locked section cannot be held across an await, so a durable
+                        // tombstone depends on put being rebound to putSync for RocksDB primary stores.
+                        dropIdentityConfirmed = withUpdateAttributesLock(rootStore, `drop table '${databaseName}.${_a.tableName}'`, writeTombstone);
+                    }
+                    else {
+                        rootStore.transactionSync(() => {
+                            dropIdentityConfirmed = writeTombstone();
+                        });
+                        if (typeof tombstoneWrite?.then === 'function')
+                            await tombstoneWrite;
+                    }
                 }
+                catch (error) {
+                    restoreDerivedIndexesAfterFailedDrop();
+                    throw error;
+                }
+            }
+            if (!dropIdentityConfirmed) {
+                abortStaleDrop();
+                return;
             }
+            _a.derivedIndexRuntime = undefined;
             // A get() against a sourcedFrom table resolves to its caller before the resolved
             // record's cache write has committed (see getFromSource) - the write lands "in the
             // background" for latency reasons. Flip this BEFORE removing the table from the
@@ -1400,7 +1813,8 @@ function makeTable(options) {
             // family drops below. If a drop fails past this point the table stays
             // invisible, and the tombstone guarantees the drop completes on the
             // next startup (or on a same-name create).
-            delete databases_ts_1.databases[databaseName][tableName];
+            if (databases_ts_1.databases[databaseName]?.[tableName] === _a)
+                delete databases_ts_1.databases[databaseName][tableName];
             // The above stops new source-fill writes from starting, but a write from a get()
             // that already returned to its caller may still be in flight. Dropping the column
             // families out from under that write is a genuine invariant violation, not just a
@@ -1431,14 +1845,21 @@ function makeTable(options) {
                 ]);
                 clearTimeout(timer);
                 if (result === timedOut) {
+                    derivedIndexRuntime?.completeDrop?.();
                     throw new Error(`dropTable() timed out after ${LOCK_TIMEOUT}ms waiting for ${pending.length} in-flight source-populated cache write(s) on ${tableName} to settle; refusing to drop the column families out from under a write that may still be staged. The drop tombstone is durable, so this will be retried on the next load.`);
                 }
             }
-            for (const entry of primaryStore.getRange({ versions: true, snapshot: false, lazy: true })) {
-                if (entry.metadataFlags & auditStore_ts_1.HAS_BLOBS && entry.value) {
-                    (0, blob_ts_1.deleteBlobsInObject)(entry.value);
+            try {
+                for (const entry of primaryStore.getRange({ versions: true, snapshot: false, lazy: true })) {
+                    if (entry.metadataFlags & auditStore_ts_1.HAS_BLOBS && entry.value) {
+                        (0, blob_ts_1.deleteBlobsInObject)(entry.value);
+                    }
                 }
             }
+            catch (error) {
+                derivedIndexRuntime?.completeDrop?.();
+                throw error;
+            }
             if (databaseName === databasePath) {
                 // part of a database.
                 // Drop the column families, then remove the catalog metadata - never
@@ -1455,66 +1876,94 @@ function makeTable(options) {
                 // same-name create completes the interrupted drop and writes fresh
                 // catalog rows, and clobbering those would orphan the new table.
                 const removeTombstonedCatalog = () => {
-                    const currentPrimary = dbisDb.getSync(TableResource.tableName + '/');
-                    if (!currentPrimary?.dropping)
+                    const currentPrimary = dbisDb.getSync(primaryCatalogKey);
+                    if (!currentPrimary?.dropping || (currentPrimary.tableId != null && currentPrimary.tableId !== tableId))
                         return false;
                     for (const attribute of attributes) {
-                        dbisDb.remove(TableResource.tableName + '/' + attribute.name);
+                        dbisDb.remove(_a.tableName + '/' + attribute.name);
                     }
-                    dbisDb.remove(TableResource.tableName + '/');
+                    dbisDb.remove(primaryCatalogKey);
                     return true;
                 };
-                const rootStore = primaryStore.rootStore;
                 if (rootStore instanceof rocksdb_js_1.RocksDatabase) {
                     // Serialize the drops + catalog removal against a concurrent
                     // same-name create (and completeInterruptedDrop) under the database's
                     // 'update-attributes' exclusive lock - the same lock the create path
-                    // holds. It is a synchronous spin lock that blocks the event loop, so
+                    // holds. It is a synchronous lock wait that blocks the event loop, so
                     // the locked section MUST stay synchronous: drop with dropSync (as
                     // completeInterruptedDrop does), never an awaited drop(), or a
-                    // concurrent create's spin would deadlock waiting on a drop that the
-                    // blocked event loop can never resolve.
-                    while (!rootStore.tryLock('update-attributes')) { }
-                    let removed = false;
+                    // concurrent create's wait would be stuck on a drop that the blocked
+                    // event loop can never resolve, burning its full deadline before failing.
+                    let removed;
                     try {
-                        for (const attribute of attributes) {
-                            const index = indices[attribute.name];
-                            if (index)
-                                try {
-                                    index.dropSync();
-                                }
-                                catch (error) {
-                                    ignoreAlreadyDropped(error);
-                                }
-                        }
-                        try {
-                            primaryStore.dropSync();
-                        }
-                        catch (error) {
-                            ignoreAlreadyDropped(error);
-                        }
-                        removed = removeTombstonedCatalog();
+                        removed = withUpdateAttributesLock(rootStore, `table '${databaseName}.${tableName}'`, () => {
+                            const currentPrimary = dbisDb.getSync(primaryCatalogKey);
+                            if (!currentPrimary?.dropping || (currentPrimary.tableId != null && currentPrimary.tableId !== tableId))
+                                return false;
+                            for (const attribute of attributes) {
+                                const index = indices[attribute.name];
+                                if (index)
+                                    try {
+                                        index.customIndex?.resetDerivedStorage?.();
+                                        index.dropSync();
+                                    }
+                                    catch (error) {
+                                        ignoreAlreadyDropped(error);
+                                    }
+                            }
+                            try {
+                                primaryStore.dropSync();
+                            }
+                            catch (error) {
+                                ignoreAlreadyDropped(error);
+                            }
+                            return removeTombstonedCatalog();
+                        });
+                        if (removed)
+                            await dbisDb.committed;
                     }
-                    finally {
-                        rootStore.unlock('update-attributes');
+                    catch (error) {
+                        derivedIndexRuntime?.completeDrop?.();
+                        throw error;
+                    }
+                    if (!removed) {
+                        abortStaleDrop();
+                        return;
                     }
-                    if (removed)
-                        await dbisDb.committed;
                 }
                 else {
                     // LMDB: no shared column-family double-drop, and its engine lock is
                     // transactional rather than this spin lock, so keep the awaited drop
                     // plus the same tombstone-guarded catalog removal.
-                    const drops = [];
-                    for (const attribute of attributes) {
-                        const index = indices[attribute.name];
-                        if (index)
-                            drops.push(index.drop().catch(ignoreAlreadyDropped));
+                    let removed;
+                    try {
+                        const currentPrimary = dbisDb.getSync(primaryCatalogKey);
+                        if (!currentPrimary?.dropping || (currentPrimary.tableId != null && currentPrimary.tableId !== tableId)) {
+                            abortStaleDrop();
+                            return;
+                        }
+                        const drops = [];
+                        for (const attribute of attributes) {
+                            const index = indices[attribute.name];
+                            if (index) {
+                                index.customIndex?.resetDerivedStorage?.();
+                                drops.push(index.drop().catch(ignoreAlreadyDropped));
+                            }
+                        }
+                        drops.push(primaryStore.drop().catch(ignoreAlreadyDropped));
+                        await Promise.all(drops);
+                        removed = removeTombstonedCatalog();
+                        if (removed)
+                            await dbisDb.committed;
+                    }
+                    catch (error) {
+                        derivedIndexRuntime?.completeDrop?.();
+                        throw error;
+                    }
+                    if (!removed) {
+                        abortStaleDrop();
+                        throw new Error(`Could not complete drop of ${databaseName}.${tableName}: a replacement table became current while the LMDB stores were being dropped`);
                     }
-                    drops.push(primaryStore.drop().catch(ignoreAlreadyDropped));
-                    await Promise.all(drops);
-                    if (removeTombstonedCatalog())
-                        await dbisDb.committed;
                 }
             }
             else {
@@ -1522,11 +1971,18 @@ function makeTable(options) {
                 // assigns `primaryStore.auditStore` — openAuditStore() assigns `rootStore.auditStore`, and
                 // this is the reference makeTable() was handed. Awaited so a pass suspended mid-removal has
                 // released the primary DBI before it is closed and unlinked.
-                await auditStore?.stopAuditCleanup?.();
-                (0, storageReclamation_ts_1.removeStorageReclamation)(primaryStore.path);
-                await primaryStore.close();
-                node_fs_1.default.unlinkSync(primaryStore.path);
+                try {
+                    await auditStore?.stopAuditCleanup?.();
+                    (0, storageReclamation_ts_1.removeStorageReclamation)(primaryStore.path);
+                    await primaryStore.close();
+                    node_fs_1.default.unlinkSync(primaryStore.path);
+                }
+                catch (error) {
+                    derivedIndexRuntime?.completeDrop?.();
+                    throw error;
+                }
             }
+            derivedIndexRuntime?.completeDrop?.();
             signalling.signalSchemaChange(new itc_js_1.SchemaEventMsg(process.pid, hdbTerms_ts_1.OPERATIONS_ENUM.DROP_TABLE, databaseName, tableName));
         }
         // #section: read-path
@@ -1554,7 +2010,7 @@ function makeTable(options) {
                     estimatedRecordRange: undefined,
                 };
                 if (this.getContext()?.includeExpensiveRecordCountEstimates) {
-                    return TableResource.getRecordCount().then((recordCount) => {
+                    return _a.getRecordCount().then((recordCount) => {
                         description.recordCount = recordCount.recordCount;
                         description.estimatedRecordRange = recordCount.estimatedRange;
                         return description;
@@ -1779,12 +2235,18 @@ function makeTable(options) {
             else {
                 id = requestTargetToId(target);
             }
+            if (this.#writeGeneration?.closed) {
+                this.#changes = undefined;
+                this.#writeGeneration = undefined;
+            }
+            this.#assertLiveHandle(id, true);
             const context = this.getContext();
             const envTxn = txnForContext(context);
             if (!envTxn)
                 throw new Error('Can not update a table resource outside of a transaction');
             // record in the list of updating records so it can be written to the database when we commit
-            if (updates === false) {
+            // `false` is the patch-cancel sentinel, not a record root — but only incrementally.
+            if (updates === false && !fullUpdate) {
                 // TODO: Remove from transaction
                 return this;
             }
@@ -1832,22 +2294,98 @@ function makeTable(options) {
                     });
                 }
             }
-            return (0, when_ts_1.when)(this._writeUpdate(id, this.#changes, fullUpdate), () => this);
+            // Keep absent changes distinguishable from an explicit empty patch: framework-created
+            // post/publish updates do not necessarily mutate or save the instance.
+            // A supplied root must reach validation as itself, not as the staged changes (harper#1298).
+            const recordRoot = updates === undefined ? this.#changes : updates;
+            return (0, when_ts_1.when)(this._writeUpdate(id, recordRoot, fullUpdate), () => this);
         }
         /**
          * Save any changes into this instance to the current transaction
          */
         save() {
+            const operation = this.#savingOperation;
+            if (!this.#lockWritable &&
+                this.#writeGeneration?.closed &&
+                (!operation || operation.writeGeneration === this.#writeGeneration))
+                return;
+            this.#assertLiveHandle(operation?.key ?? this.getId()); // a write through a released or expired lock never lands
+            if ((!operation || operation.dropped) && this.#lockWritable && this.#lockHandle?.hold) {
+                // A held lock's record stages its update here rather than at lock() time: it is often
+                // written after the acquiring transaction has already completed, which would have
+                // dropped an update staged then. Nothing set means nothing to stage — a held-but-untouched
+                // id stays untouched. Scoped locks do not take this branch: #reloadLocked stages their
+                // TransactionWrite at lock() time (exactly like update()), so #savingOperation is always
+                // set for a live scoped lock and the ordinary path below applies.
+                // Verify the hold is still alive: if #lockWritable is set but the handle expired or was
+                // released between lock acquisition and this save(), throw 409 rather than silently
+                // committing stale data. Every lock-writable instance carries its own handle.
+                const saveHandle = this.#lockHandle;
+                if (saveHandle.isExpired()) {
+                    throw (0, recordLock_ts_1.lockNotHeldError)(saveHandle);
+                }
+                const changes = this.#changes;
+                if (changes && Object.keys(changes).length > 0) {
+                    this.#savingOperation = null;
+                    return (0, when_ts_1.when)(this._writeUpdate(this.getId(), changes, false), () => {
+                        const op = this.#savingOperation;
+                        if (op?.dropped) {
+                            this.#changes = undefined;
+                            return;
+                        }
+                        // Clear #savingOperation so the next sequential save() enters the lock-writable
+                        // path and creates a fresh write (otherwise a non-null #savingOperation makes
+                        // save() take the #saveOperation branch with an already-committed write, which
+                        // is a no-op, silently dropping the new change).
+                        // op.innerCommit is the real native-transaction commit Promise set on the
+                        // immediateCommit path in DatabaseTransaction.save(); await it to ensure
+                        // durability before resolving to the caller.
+                        if (op?.saved) {
+                            this.#savingOperation = null;
+                            return op?.innerCommit;
+                        }
+                        // op.saved = false means addWrite deferred the save; #saveOperation commits it
+                        // synchronously but ImmediateTransaction.save() returns undefined while the
+                        // inner rocksdb commit is still pending — return innerCommit so the caller
+                        // actually waits for durability.
+                        return (0, when_ts_1.when)(this.save(), () => op?.innerCommit);
+                    });
+                }
+                // No changes: nothing to stage. A dropped operation (detached at a scoped→hold
+                // upgrade — see detachScopedUpgradeWrite) must not fall through to the ordinary
+                // #saveOperation path below with its now-detached reference.
+                if (!operation || operation.dropped) {
+                    this.#savingOperation = null;
+                    return;
+                }
+            }
             if (this.#savingOperation) {
+                const operation = this.#savingOperation;
+                this.#savingOperation = null;
+                // A write that lands via a nested immediateCommit (e.g. a second sequential save() on
+                // the same ImmediateTransaction context, once the first has already closed it) sets
+                // operation.innerCommit to the real native-commit promise, but the commit() sweep loop
+                // that triggers it discards its own return value — #saveOperation()'s result can
+                // resolve before that native commit actually settles. Chain on innerCommit (as the
+                // lock-writable hold branch above already does) so callers awaiting save() see the
+                // write durably land, not just the outer (possibly premature) resolution.
+                let result;
                 try {
-                    return this.#saveOperation(this.#savingOperation);
+                    result = this.#saveOperation(operation);
                 }
-                finally {
-                    this.#savingOperation = null;
+                catch (error) {
+                    if (!operation.saved)
+                        this.#savingOperation = operation;
+                    throw error;
                 }
+                const innerCommit = operation.innerCommit;
+                return innerCommit ? (0, when_ts_1.when)(innerCommit, () => result) : result;
             }
         }
         #saveOperation(operation) {
+            // LMDB validates staged writes at transaction commit, so bind a lazy update to the
+            // generation selected by save() before another update can replace its changes.
+            operation.captureChanges?.();
             const transaction = txnForContext(this.getContext());
             const holder = operation.stagedIn;
             // never-drop-on-conflict lives on the transaction and would not travel with the write, so an
@@ -1865,13 +2403,26 @@ function makeTable(options) {
                 // merge and index diff would be relative to a record that may never land.
                 operation.priorWrite = undefined;
                 operation.deferSave = false;
-                return (0, when_ts_1.when)(transaction.addWrite(operation), () => operation.promise ?? operation.result);
+                const result = (0, when_ts_1.when)(transaction.addWrite(operation), () => operation.promise ?? operation.result);
+                this.#closeWriteChain(operation);
+                return result;
             }
             const owner = holder ?? transaction;
-            if (owner.save)
-                return owner.save(operation) || operation.promise || operation.result;
+            if (owner.save) {
+                const result = owner.save(operation) || operation.promise || operation.result;
+                this.#closeWriteChain(operation);
+                return result;
+            }
+        }
+        #closeWriteChain(operation) {
+            const owner = operation.stagedIn;
+            for (let write = operation; write && !write.instanceClosed; write = write.priorWrite) {
+                if (write === operation || owner?.ownedWrites?.has(write))
+                    (0, DatabaseTransaction_ts_1.closeWriteInstance)(write);
+            }
         }
         addTo(property, value) {
+            this[tracked_ts_1.ASSERT_TRACKED_WRITABLE]();
             if (typeof value === 'number' || typeof value === 'bigint') {
                 if (this.#savingOperation?.fullUpdate)
                     this.set(property, (+this.getProperty(property) || 0) + value);
@@ -1923,17 +2474,23 @@ function makeTable(options) {
             });
         }
         _writeInvalidate(id, partialRecord, options) {
+            this.#assertLiveHandle(id);
             const context = this.getContext();
             checkValidId(id);
             const transaction = txnForContext(this.getContext());
+            assertDerivedIndexAdmission(options, transaction);
             const write = {
                 key: id,
                 store: primaryStore,
                 invalidated: true,
                 entry: this.#entry,
+                recordVersion: options?.version,
+                lockHandle: this.#lockHandle && this.#lockHandle.keyId === (0, DatabaseTransaction_ts_1.writeKeyId)(id) ? this.#lockHandle : undefined,
+                reloadCommitBase: true,
                 commit: (txnTime, existingEntry, _retry, transaction) => {
+                    const txnLogKey = isRocksDB && options?.version != null ? (transaction?.getTimestamp?.() ?? txnTime) : txnTime;
                     write.skipped = false; // reset on each retry; cleanup happens after commit if still true
-                    if (precedesExistingVersion(txnTime, existingEntry, options?.nodeId) <= 0) {
+                    if (precedesExistingVersion(txnTime, existingEntry, options?.nodeId) < 0) {
                         write.skipped = true;
                         return;
                     }
@@ -1954,7 +2511,13 @@ function makeTable(options) {
                         viaNodeId: options?.viaNodeId,
                         transaction,
                         tableToTrack: tableName,
+                        recordVersion: txnTime,
+                        additionalAuditRefs: isRocksDB && audit && txnLogKey !== txnTime
+                            ? [{ version: txnLogKey, nodeId: options?.nodeId }]
+                            : undefined,
                     }, 'invalidate');
+                    if (write.trackRecordVersion)
+                        write.recordVersionApplied = true;
                     // TODO: recordDeletion?
                 },
             };
@@ -1962,21 +2525,27 @@ function makeTable(options) {
             transaction.addWrite(write);
         }
         _writeRelocate(id, options) {
+            this.#assertLiveHandle(id);
             const context = this.getContext();
             checkValidId(id);
             const transaction = txnForContext(this.getContext());
-            transaction.addWrite({
+            assertDerivedIndexAdmission(options, transaction);
+            const write = {
                 key: id,
                 store: primaryStore,
                 invalidated: true,
                 entry: this.#entry,
+                recordVersion: options?.version,
+                lockHandle: this.#lockHandle && this.#lockHandle.keyId === (0, DatabaseTransaction_ts_1.writeKeyId)(id) ? this.#lockHandle : undefined,
+                reloadCommitBase: true,
                 before: this.constructor.source?.relocate && !context?.source
                     ? this.constructor.source.relocate.bind(this.constructor.source, id, undefined, context)
                     : undefined,
                 commit: (txnTime, existingEntry, _retry, transaction) => {
-                    if (precedesExistingVersion(txnTime, existingEntry, options?.nodeId) <= 0)
+                    const txnLogKey = isRocksDB && options?.version != null ? (transaction?.getTimestamp?.() ?? txnTime) : txnTime;
+                    if (precedesExistingVersion(txnTime, existingEntry, options?.nodeId) < 0)
                         return;
-                    const residency = TableResource.getResidencyRecord(options.residencyId);
+                    const residency = _a.getResidencyRecord(options.residencyId);
                     let metadata = 0;
                     let newRecord = null;
                     const existingRecord = existingEntry?.value;
@@ -2000,9 +2569,16 @@ function makeTable(options) {
                         viaNodeId: options?.viaNodeId,
                         expiresAt: options.expiresAt,
                         transaction,
+                        recordVersion: txnTime,
+                        additionalAuditRefs: isRocksDB && audit && txnLogKey !== txnTime
+                            ? [{ version: txnLogKey, nodeId: options?.nodeId }]
+                            : undefined,
                     }, 'relocate', false, null);
+                    if (write.trackRecordVersion)
+                        write.recordVersionApplied = true;
                 },
-            });
+            };
+            transaction.addWrite(write);
         }
         /**
          * Record the relocation of an entry (when a record is moved to a different node), return true if it is now located locally
@@ -2055,9 +2631,8 @@ function makeTable(options) {
                     if (primaryStore.hasLock(id, entry.version))
                         return;
                 }
-                // evictions never go in the audit log, so we can not record a deletion entry for the eviction
-                // as there is no corresponding audit entry and it would never get cleaned up. So we must simply
-                // removed the entry entirely, but first cleanup indices
+                // Eviction is not a canonical delete. Indexed caching tables add a local-only control entry so
+                // their derived indexes can remove the resident projection without exposing a delete event.
                 let lmdbCompletion;
                 if (primaryStore.ifVersion) {
                     // lmdb: the index cleanup and the record removal are both version-guarded optimistic writes.
@@ -2071,6 +2646,7 @@ function makeTable(options) {
                 }
                 else {
                     updateIndices(id, existingRecord, null, options);
+                    stageDerivedIndexEviction(transaction, id, existingVersion);
                     (0, RecordEncoder_ts_1.removeEntry)(primaryStore, entry ?? primaryStore.getEntry(id), options);
                 }
                 committed = true;
@@ -2121,10 +2697,368 @@ function makeTable(options) {
             }
         }
         /**
-         * This is intended to acquire a lock on a record from the whole cluster.
+         * Static entry point: `Table.lock(id, options?, context?)` — creates an instance in the given,
+         * ambient, or a fresh context and delegates to the instance lock(). This shadows Resource.static
+         * lock so that both callers share the same transaction link (required for cross-instance upgrade
+         * detection).  lock() is an in-process API with no authorization hook of its own; it is not
+         * protocol-dispatched, so no allowUpdate/allowCreate check runs on acquisition.
+         *
+         * Dropping the trailing `context` leaks the key: the bare `{}` fallback is an
+         * ImmediateTransaction, which releases no record locks.
+         */
+        static async lock(target, options, context) {
+            if (!isRocksDB)
+                throw new hdbError_ts_1.ClientError('Record locks are not supported on LMDB', 501);
+            if (options === undefined && isPlainOptions(target)) {
+                options = target;
+                target = undefined;
+            }
+            const id = target != null ? requestTargetToId(target) : null;
+            const resolvedContext = contextArgument(context) ?? transaction_ts_1.contextStorage.getStore() ?? {};
+            const resource = new _a(id, resolvedContext);
+            return resource.lock(target, options);
+        }
+        /**
+         * Acquire an exclusive lock on this record (or on `target`'s) and return it ready for updates
+         * (harper#483, Phase 0: exclusive across every worker thread of this node). The lock is held
+         * in process memory only — no durable writes. Phase 0 contract: lock() is mutually exclusive
+         * with other lock() calls on the same key; plain writes (put/patch/delete/create) are never
+         * gated or blocked. The generation expires after `lease` if it is never released.
+         *
+         * Transaction-scoped (default): write through the returned record (or the table's static verbs
+         * in the same transaction), and the commit or abort releases it. `{ hold: true }`: the lock
+         * outlives the transaction; write through the returned record and release with `unlock()`, or
+         * let the lease expire.
+         */
+        // async so option/id validation rejects rather than throwing past a caller's `.catch()`; the
+        // body still runs to completion synchronously, which is what keeps concurrent lock() calls
+        // on one key coalescing instead of racing to tryLock.
+        async lock(target, options) {
+            if (!isRocksDB)
+                throw new hdbError_ts_1.ClientError('Record locks are not supported on LMDB', 501);
+            if (options === undefined && isPlainOptions(target)) {
+                options = target;
+                target = undefined;
+            }
+            const id = target != null ? requestTargetToId(target) : this.getId();
+            checkValidId(id);
+            this.#assertLiveHandle(id);
+            const resolved = (0, recordLock_ts_1.resolveLockOptions)(options);
+            const context = this.getContext();
+            const link = txnForContext(context);
+            const keyId = (0, DatabaseTransaction_ts_1.writeKeyId)(id);
+            // Before the re-entrant paths, not after: a transaction that already holds this key
+            // node-scoped would otherwise be handed that handle back for an explicit cluster request,
+            // while the same request on a fresh key fails closed.
+            if (resolved.scope === 'cluster' &&
+                (resolved.scopeRequested || (0, recordLockCoordinator_ts_1.isClusterLockRequired)(databaseName)) &&
+                !(0, recordLockCoordinator_ts_1.getClusterLockTransport)(databaseName))
+                return Promise.reject(new hdbError_ts_1.LockUnavailableError(`Cluster-scoped record locks are not available on ${databaseName}: no record lock transport is registered`));
+            const held = this.#lockHandle;
+            if (held && !held.isExpired() && held.keyId === keyId) {
+                // Re-entrant: upgrade to hold if requested, then preserve staged changes.
+                const violation = scopeViolation(held, resolved, databaseName);
+                if (violation)
+                    return Promise.reject(violation);
+                if (resolved.hold && !held.hold) {
+                    held.upgradeToHold(resolved.lease);
+                    // The scoped phase eagerly staged a TransactionWrite (see #reloadLocked); hold
+                    // staging is deferred and explicit-save-only, so an unsaved scoped write left
+                    // dangling here would otherwise auto-commit at the transaction sweep and clobber
+                    // whatever the hold write lands. detachScopedUpgradeWrite marks it .dropped so a
+                    // later save() on this instance falls through to the hold branch instead of the
+                    // dead #savingOperation reference.
+                    detachScopedUpgradeWrite(link, keyId, held);
+                }
+                return Promise.resolve(this.#reloadLocked(id, undefined, true));
+            }
+            const scoped = link.recordLockFor(primaryStore, keyId);
+            if (scoped && !scoped.isExpired()) {
+                const violation = scopeViolation(scoped, resolved, databaseName);
+                if (violation)
+                    return Promise.reject(violation);
+                if (resolved.hold && !scoped.hold) {
+                    // Upgrade scoped → hold: flip the existing handle object to hold mode so every
+                    // instance that already references this handle stays valid.  Retiring and creating a
+                    // new handle would invalidate those other references (their save() would then throw
+                    // 409 against a released handle).  The native key stays locked throughout.
+                    scoped.upgradeToHold(resolved.lease);
+                    detachScopedUpgradeWrite(link, keyId, scoped);
+                    return Promise.resolve(this.#reloadLocked(id, scoped, true));
+                }
+                // Already held with the same type: re-entrant return. Preserve any staged changes.
+                return Promise.resolve(this.#reloadLocked(id, scoped, true));
+            }
+            // Cluster scope needs a registered transport. An EXPLICIT { scope: 'cluster' } without one is
+            // a caller asking for a guarantee this node cannot make, so it fails closed rather than
+            // silently returning the node-local lock; the default keeps Phase 0 behavior, which is what
+            // a build with no replication has anyway.
+            // The getter fails closed on an unusable node identity, and lock() answers with a promise.
+            let coordinator;
+            try {
+                coordinator = resolved.scope === 'node' ? undefined : _a.lockCoordinator;
+            }
+            catch (error) {
+                return Promise.reject(error);
+            }
+            const key = (0, recordLock_ts_1.lockAttemptKey)(tableId, id);
+            // Coalesce concurrent lock() calls for the same key inside one link so they don't
+            // self-block: Promise.all([T.lock(id), T.lock(id)]) would otherwise have both calls
+            // reach tryLock before either registers, making the second park against the first.
+            const pending = link.pendingLockFor(primaryStore, keyId);
+            if (pending) {
+                // Wait for the in-flight acquisition, then take the re-entrant path as if
+                // recordLockFor had found it.  If the first attempt timed out, re-enter so
+                // the second caller gets its own timeout.
+                // The follower waits on the leader's acquisition, but only for its own timeout.
+                let followerTimer;
+                const followerTimedOut = Symbol('follower timeout');
+                // Why the leader failed, so the follower can report that instead of inventing contention
+                // when its own budget runs out. A leader 503 means the guarantee could not be established
+                // at all; retrying is still right (the condition may clear) but 423 at the end is not.
+                let leaderFailure;
+                const followerStart = Date.now();
+                const followerDeadline = new Promise((_, reject) => {
+                    followerTimer = setTimeout(() => reject(followerTimedOut), resolved.timeout).unref();
+                });
+                // Try again on this caller's own terms with the budget it has left.
+                const retryOnRemainingBudget = () => {
+                    // The enclosing transaction ended while we were parked. A retry re-resolves the
+                    // context, which no longer points at this link, so the handle it acquired would be
+                    // registered on a fresh transaction that no commit or abort ever releases — the
+                    // same abandonment the leader's own post-acquisition guard below rejects.
+                    if (link.open === DatabaseTransaction_ts_1.TRANSACTION_STATE.CLOSED && !link.saveCommits)
+                        throw new hdbError_ts_1.ServerError('Transaction was closed while waiting for a record lock', 500);
+                    const remaining = resolved.timeout - (Date.now() - followerStart);
+                    if (remaining <= 0)
+                        throw leaderFailure ?? new hdbError_ts_1.ClientError(`Record is locked and was not released in time`, 423);
+                    // Carry the scope only if the caller named it: spreading the resolved options would turn
+                    // a defaulted 'cluster' into an explicit one, which is fail-closed when no transport is
+                    // registered.
+                    return this.lock(target, {
+                        lease: resolved.lease,
+                        timeout: remaining,
+                        hold: resolved.hold,
+                        scope: resolved.scopeRequested ? resolved.scope : undefined,
+                    });
+                };
+                return Promise.race([pending, followerDeadline]).then(() => {
+                    clearTimeout(followerTimer);
+                    const acquired = link.recordLockFor(primaryStore, keyId);
+                    if (acquired && !acquired.isExpired()) {
+                        const violation = scopeViolation(acquired, resolved, databaseName);
+                        if (violation)
+                            throw violation;
+                        if (resolved.hold && !acquired.hold) {
+                            detachScopedUpgradeWrite(link, keyId, acquired);
+                            acquired.upgradeToHold(resolved.lease);
+                        }
+                        return this.#reloadLocked(id, acquired, true);
+                    }
+                    return retryOnRemainingBudget();
+                }, (error) => {
+                    clearTimeout(followerTimer);
+                    // A follower that simply ran out of its own wait was waiting on another caller in this
+                    // process, which is the contention 423 describes. But if the LEADER failed for a reason
+                    // that is not contention, that reason is the true one — keep it and report it if the
+                    // retries below also run out, rather than ending on a 423 for a key nobody held.
+                    if (error === followerTimedOut)
+                        throw new hdbError_ts_1.ClientError(`Record is locked and was not released in time`, 423);
+                    if (error instanceof hdbError_ts_1.LockUnavailableError)
+                        leaderFailure = error;
+                    return retryOnRemainingBudget();
+                });
+            }
+            const pendingPromise = (0, recordLock_ts_1.acquireRecordKey)(link, primaryStore, key, keyId, resolved.timeout, resolved.lease, resolved.hold);
+            const clusterStart = node_perf_hooks_1.performance.now();
+            // What a follower waits on must span the cluster round and registration, not just the native
+            // acquire. Waking it at the native hand-off leaves it in a window where the key is held but no
+            // handle is registered, so it retries and parks on the leader's own lock for its full timeout
+            // — inside a transaction that cannot finish until it gives up.
+            const acquisition = pendingPromise.then(async (handle) => {
+                const closedWhileWaiting = () => link.open === DatabaseTransaction_ts_1.TRANSACTION_STATE.CLOSED && !link.saveCommits;
+                if (closedWhileWaiting()) {
+                    // The transaction was aborted while this call waited; nothing would ever release the handle.
+                    handle.release();
+                    throw new hdbError_ts_1.ServerError('Transaction was closed while waiting for a record lock', 500);
+                }
+                // Anything that fails from here must give the native key back, or it becomes a lock this
+                // caller does not know it owns.
+                // Re-resolved, not the snapshot taken before `acquireRecordKey`: that wait can run the
+                // caller's whole timeout, long enough for harper-pro to register the transport on this
+                // worker. Using the snapshot would take the native key alone and hand back a node-scoped
+                // handle while a peer that already had the transport is granted the same key.
+                try {
+                    if (resolved.scope !== 'node')
+                        coordinator = _a.lockCoordinator ?? coordinator;
+                }
+                catch (error) {
+                    // The getter fails closed on an unusable node identity, and that has to reach the caller
+                    // the same way it does before the wait. Swallowing it let an implicit cluster lock fall
+                    // through to node-local authority — the one outcome failing closed exists to prevent —
+                    // because `coordinator` is still whatever it was, including undefined.
+                    handle.release();
+                    throw error;
+                }
+                if (coordinator) {
+                    try {
+                        // Not a 423 when the budget is gone, and not a skip either: the native wait can consume
+                        // the whole timeout, and `acquire` with no wait left still admits from a live delegation
+                        // or a local grant without sending anything. Only if it cannot does the caller learn the
+                        // guarantee was unavailable — which is not the same as the key being held.
+                        const remaining = Math.max(0, resolved.timeout - (node_perf_hooks_1.performance.now() - clusterStart));
+                        const round = await coordinator.acquire(id, resolved.lease, remaining);
+                        // Resolved through the getter rather than captured, so a transport swap between
+                        // acquisition and release reaches the coordinator that now owns the delegation.
+                        if (!handle.joinClusterRound(round.tsR, resolved.lease, round.mintedMono, () => _a.admittingCoordinator?.release(id, round.admissionId))) {
+                            // The round completed inside its lease but the lease elapsed before the handle
+                            // could take it. The coordinator still holds it, and only this call knows the
+                            // hold was never handed out.
+                            // The getter, not the captured coordinator: after a transport swap the captured one no
+                            // longer owns this admission, so releasing through it would be a silent no-op.
+                            // `.then`, not `Promise.resolve(release())`: the call can throw synchronously, and that
+                            // throw would escape the catch and replace the 423 below with an internal error.
+                            Promise.resolve()
+                                .then(() => _a.admittingCoordinator?.release(id, round.admissionId))
+                                .catch(noop);
+                            // 503, not 423: the home granted this key to US and the lease elapsed before the handle
+                            // could take it, so nobody ever held it. The coordinator classifies the same thing the
+                            // same way — see its `timeout` denial.
+                            throw new hdbError_ts_1.LockUnavailableError(`A cluster record lock on ${databaseName}.${tableName} was granted after its lease had elapsed`);
+                        }
+                        // A recall must be able to fence a write this handle staged and then unlocked, so
+                        // the coordinator needs a way to revoke it — see LockCoordinator.registerAdmission.
+                        // The getter again: a swap during the acquisition moved this admission to the
+                        // successor, and registering on the predecessor would revoke a handle that is fine.
+                        _a.admittingCoordinator?.registerAdmission(round.admissionId, () => handle.revokeLease());
+                    }
+                    catch (error) {
+                        handle.release();
+                        throw error;
+                    }
+                    if (closedWhileWaiting()) {
+                        handle.release();
+                        throw new hdbError_ts_1.ServerError('Transaction was closed while waiting for a record lock', 500);
+                    }
+                }
+                link.registerRecordLock(handle);
+                if (link.saveCommits && context?.timestamp)
+                    handle.noteCandidateFloor(context.timestamp);
+                if (link.open === DatabaseTransaction_ts_1.TRANSACTION_STATE.OPEN && !link.saveCommits) {
+                    // Explicit transaction() (not ImmediateTransaction): pin the clock to
+                    // acquiredAt when no writes have been staged yet.  When writes already
+                    // exist, leave the clock alone (ordering is best-effort; write held records
+                    // in their own transaction for the guarantee).  ImmediateTransaction is
+                    // excluded (saveCommits=true) — its clock is never pinned in lock();
+                    // each save() stamps from the handle's committed version floor instead.
+                    if (link.writes.length === 0 && !link.timestamp) {
+                        link.timestamp = handle.acquiredAt;
+                    }
+                    if (!resolved.hold && link.transaction) {
+                        // Scoped lock: the read snapshot may predate the lock; drop it so the
+                        // scope reads what it locked.  Hold locks use acquiredAt directly and
+                        // do not update the read snapshot.
+                        // The timestamp guard matches DatabaseTransaction's own setTimestamp calls: a
+                        // deferred update() write leaves the clock at 0, which rocksdb-js rejects.
+                        if (link.writes.length === 0 && link.readTxnsUsed <= 1) {
+                            link.releaseReadTxn();
+                            link.snapshotFree = true;
+                        }
+                        else if (link.timestamp)
+                            link.transaction.setTimestamp(link.timestamp);
+                    }
+                }
+                // ImmediateTransaction: no clock pinning in lock(); save() stamps each write
+                // from the committed handle floor for both scoped and hold handles.
+                return handle;
+            });
+            link.registerPendingLock(primaryStore, keyId, acquisition);
+            return acquisition.then((handle) => {
+                link.unregisterPendingLock(primaryStore, keyId);
+                return this.#reloadLocked(id, handle);
+            }, (error) => {
+                link.unregisterPendingLock(primaryStore, keyId);
+                throw error;
+            });
+        }
+        #reloadLocked(id, holdHandle, preserveChanges = false) {
+            // For freshness, read the committed entry (snapshot-free) so a hold lock sees concurrent
+            // committed writes rather than a stale snapshot.  A write earlier in THIS explicit
+            // transaction has not landed in that committed entry yet (harper#1968: Harper defers an
+            // explicit transaction's writes until the writing call actually runs them), so pull the
+            // current value the same way a chained write picks up its basis (priorStagedWrite): the
+            // record comes from the prior staged write, the rest of the entry (version, audit chain,
+            // blob metadata) stays the pre-transaction one.
+            const link = txnForContext(this.getContext());
+            let entryForReload = primaryStore.getEntry(id);
+            if (link.open === DatabaseTransaction_ts_1.TRANSACTION_STATE.OPEN) {
+                const keyId = (0, DatabaseTransaction_ts_1.writeKeyId)(id);
+                const tailWrite = link.writesByKey?.get(primaryStore)?.get(keyId);
+                const priorStaged = tailWrite && (tailWrite.stagedEntry !== undefined ? tailWrite : (0, DatabaseTransaction_ts_1.priorStagedWrite)(tailWrite));
+                if (priorStaged?.stagedEntry !== undefined) {
+                    entryForReload = entryForReload
+                        ? { ...entryForReload, value: priorStaged.stagedEntry.value }
+                        : { value: priorStaged.stagedEntry.value };
+                    if (entryForReload.value && typeof entryForReload.value === 'object') {
+                        // Register the merged entry in entryMap so getUpdatedTime() works.
+                        RecordEncoder_ts_1.entryMap.set(entryForReload.value, entryForReload);
+                    }
+                }
+            }
+            if ((0, DatabaseTransaction_ts_1.writeKeyId)(id) !== (0, DatabaseTransaction_ts_1.writeKeyId)(this.getId())) {
+                // lock(target) where target differs from this record: return a separate instance.
+                const fresh = new this.constructor(id, this.getContext());
+                _a._updateResource(fresh, entryForReload);
+                if (holdHandle != null) {
+                    fresh.#lockHandle = holdHandle;
+                    // Do not clear this.#lockHandle: the original instance keeps its own lock on its
+                    // own id; the fresh instance owns the lock on the target id independently.
+                }
+                fresh.#lockWritable = true;
+                // Scoped (not hold) stages exactly like update(): create the TransactionWrite now so
+                // save() is the ordinary #savingOperation path.  Hold keeps deferred staging (the
+                // acquiring transaction may commit before the holder ever writes).
+                if (!fresh.#lockHandle.hold)
+                    fresh._writeUpdate(id, fresh.#changes, false);
+                return fresh;
+            }
+            // Store the handle for both scoped and hold locks; undefined (re-entrant hold fast-path)
+            // must not clear a handle already set.
+            if (holdHandle != null)
+                this.#lockHandle = holdHandle;
+            _a._updateResource(this, entryForReload);
+            // Preserve staged changes when upgrading the same instance from scoped to hold so that
+            // set() calls made under the scoped lock survive the reload.
+            if (!preserveChanges)
+                this.#changes = undefined;
+            this.#lockWritable = true;
+            // Scoped (not hold): stage now, same as update() would.  Skip if a write from an earlier
+            // lock() cycle on this instance is still pending (re-entrant call before its save()).
+            if (!this.#lockHandle.hold && !this.#savingOperation)
+                this._writeUpdate(id, this.#changes, false);
+            return this;
+        }
+        /**
+         * Release the lock this instance holds. Resolves true when this call cleared the native key lock.
+         * Works for both held (`{ hold: true }`) and transaction-scoped locks. After unlock() the
+         * instance is no longer lock-writable; writes through it require a fresh lock.
          */
-        lock() {
-            throw new Error('Not yet implemented');
+        unlock() {
+            // Always clear the local lock-writable state so subsequent writes on this instance are
+            // ungated, regardless of whether the handle was already released.
+            const handle = this.#lockHandle;
+            this.#lockHandle = undefined;
+            this.#lockWritable = false;
+            if (!handle || handle.released)
+                return Promise.resolve(false);
+            const link = txnForContext(this.getContext());
+            // A scoped lock staged its write at lock() time; released before commit, that write must not
+            // run into the released-handle guard at the sweep.
+            if (this.#savingOperation && !this.#savingOperation.saved && this.#savingOperation.lockHandle === handle)
+                this.#savingOperation = null;
+            detachScopedUpgradeWrite(link, (0, DatabaseTransaction_ts_1.writeKeyId)(this.getId()), handle);
+            link.unregisterRecordLock(handle);
+            return Promise.resolve(handle.release());
         }
         static operation(operation, context) {
             operation.table ||= tableName;
@@ -2240,8 +3174,11 @@ function makeTable(options) {
         // a notification that a write has already occurred in the canonical data source, we need to update our
         // local copy
         _writeUpdate(id, recordUpdate, fullUpdate, options) {
+            this.#assertLiveHandle(id);
             const context = this.getContext();
             const transaction = txnForContext(context);
+            const replaying = transaction.isReplay === true;
+            assertDerivedIndexAdmission(options, transaction);
             checkValidId(id);
             if (fullUpdate && recordUpdate == null && options?.isNotification) {
                 // A source/replication-applied put must carry the record; these applies skip record
@@ -2256,6 +3193,16 @@ function makeTable(options) {
                 }
                 return;
             }
+            let captureChanges;
+            if (recordUpdate === undefined) {
+                let captured = false;
+                captureChanges = () => {
+                    if (!captured) {
+                        captured = true;
+                        recordUpdate = this.#changes;
+                    }
+                };
+            }
             const entry = this.#entry ?? primaryStore.getEntry(id, { transaction: transaction.getReadTxn() });
             const writeToSource = () => {
                 if (!this.constructor.source || context?.source)
@@ -2277,16 +3224,31 @@ function makeTable(options) {
                     }
                 }
             };
+            const receiverId = this.getId();
+            const closesReceiver = !this.isCollection &&
+                !isSearchTarget(receiverId) &&
+                (id === receiverId || (0, DatabaseTransaction_ts_1.writeKeyId)(id) === (0, DatabaseTransaction_ts_1.writeKeyId)(receiverId));
             const write = {
                 key: id,
                 store: primaryStore,
                 entry,
                 nodeName: context?.nodeName,
                 fullUpdate,
+                chainsStagedState: true,
+                // copy-apply rows keep their pre-read base: one read per row, healed by the post-copy replay
+                reloadCommitBase: options?.isCopyApply !== true,
                 deferSave: true,
+                // the origin's record version on an applied write; absent for a locally-originated one
+                recordVersion: options?.version,
+                // Include the lock handle (if any) so the expired-handle guard in
+                // DatabaseTransaction.save() can throw 409 when the lease has lapsed.
+                // Only attach the hold handle when it covers exactly this key; off-key writes
+                // are ordinary and must not carry an unrelated hold's handle.
+                lockHandle: this.#lockHandle && this.#lockHandle.keyId === (0, DatabaseTransaction_ts_1.writeKeyId)(id) ? this.#lockHandle : undefined,
+                writeGeneration: !this.#lockWritable && closesReceiver ? this[tracked_ts_1.GET_TRACKED_WRITE_GENERATION]() : undefined,
+                captureChanges,
                 validate: (txnTime, committedBy = transaction) => {
-                    if (!recordUpdate)
-                        recordUpdate = this.#changes;
+                    write.captureChanges?.();
                     if (fullUpdate || (recordUpdate && (0, tracked_ts_1.hasChanges)(this.#changes === recordUpdate ? this : recordUpdate))) {
                         if (!context?.source) {
                             committedBy.checkOverloaded();
@@ -2336,10 +3298,13 @@ function makeTable(options) {
                                             : txnTime;
                             }
                             if (createdTimeProperty) {
-                                if (entry?.value) {
+                                // the reloaded commit base, not the pre-read one: a full PUT racing a create
+                                // would otherwise stamp a fresh created time over the real one
+                                const base = write.entry;
+                                if (base?.value) {
                                     if (fullUpdate || recordUpdate[createdTimeProperty.name]) {
                                         // make sure to retain original created time
-                                        recordUpdate[createdTimeProperty.name] = entry?.value[createdTimeProperty.name];
+                                        recordUpdate[createdTimeProperty.name] = base.value[createdTimeProperty.name];
                                     }
                                 }
                                 else {
@@ -2408,6 +3373,7 @@ function makeTable(options) {
                     this.#savingOperation = null;
                     write.stagedIn = undefined; // nothing may pin this write's transaction past its commit
                     let omitLocalRecord = false;
+                    const txnLogKey = isRocksDB && options?.version != null ? (transaction?.getTimestamp?.() ?? txnTime) : txnTime;
                     // we use optimistic locking to only commit if the existing record state still holds true.
                     // this is superior to using an async transaction since it doesn't require JS execution
                     //  during the write transaction.
@@ -2468,8 +3434,8 @@ function makeTable(options) {
                             // best-effort keyed lookup in the capped block below — see #1148. precedesExistingVersion(...)
                             // === 0 is the identity tie: same version AND same node (the local node is id 0, so an undefined
                             // options?.nodeId resolves to the same 0 the ref stored).
-                            if (existingEntry.additionalAuditRefs?.some((ref) => ref.version === txnTime &&
-                                precedesExistingVersion(txnTime, { version: txnTime, localTime: txnTime, key: id, nodeId: ref.nodeId }, options?.nodeId) === 0)) {
+                            if (existingEntry.additionalAuditRefs?.some((ref) => ref.version === txnLogKey &&
+                                precedesExistingVersion(txnTime, { version: txnTime, localTime: txnLogKey, key: id, nodeId: ref.nodeId }, options?.nodeId) === 0)) {
                                 write.skipped = true;
                                 return; // out-of-order write already folded into this record
                             }
@@ -2497,10 +3463,10 @@ function makeTable(options) {
                                 if (!oldestRetainedAuditTimeResolved) {
                                     oldestRetainedAuditTimeResolved = true;
                                     // getRange yields ascending by audit-log key, so the first entry is the oldest retained.
-                                    // Mirror replicationConnection's retention check and the cleanup key basis (localTime ??
-                                    // version). Fall back to the nominal time-based purge floor when the log is empty/unavailable.
+                                    // Mirror replicationConnection's retention check and the cleanup key basis (`txnLogKey`).
+                                    // Fall back to the nominal time-based purge floor when the log is empty/unavailable.
                                     for (const entry of auditStore.getRange({ start: 1, log: options?.nodeId })) {
-                                        oldestRetainedAuditTime = entry.localTime ?? entry.version;
+                                        oldestRetainedAuditTime = entry.txnLogKey;
                                         break;
                                     }
                                     oldestRetainedAuditTime ??= Date.now() - auditStore_ts_1.auditRetention;
@@ -2513,43 +3479,67 @@ function makeTable(options) {
                             // depth-cap block. This is the same keyed lookup that block performs, hoisted ahead of the walk.
                             // It is what catches transitive/proxied re-deliveries: they arrive buried below the record head
                             // (so replication's head-tie fast-skip can't see them) yet are exact duplicates. Keyed by nodeId,
-                            // so it is correct across multiple source nodes. RocksDB-only: LMDB audit entries are keyed by
-                            // local audit time, not version, so this version-keyed lookup doesn't apply there (LMDB keeps the
-                            // exact unbounded walk). A miss (the keyed lookup can lag a back-to-back re-delivery — #1137)
+                            // so it is correct across multiple source nodes. The lookup key is this write's LOG key, not its
+                            // record version — a replication apply commits under the origin's log key while storing the
+                            // origin's version, and only the log key addresses the entry (harper#2412).
+                            // RocksDB-only: LMDB audit entries are keyed by local audit time, so this lookup doesn't apply
+                            // there (LMDB keeps the exact unbounded walk). A miss (the keyed lookup can lag a back-to-back re-delivery — #1137)
                             // simply falls through to the walk, so this never changes correctness; the additionalAuditRefs
                             // check above remains the read-your-writes guard. Never when this write staged in a prior
                             // failed attempt: that attempt already appended this write's own audit entry, so the lookup
                             // would find it and skip the write as "already applied" when the record was never committed.
                             // A recommit of the same transaction survived that skip only because the old write batch
                             // still carried the put; a fresh-transaction replay (ERR_TRY_AGAIN) would drop the write.
-                            if (isRocksDB && !stagedOwnAuditEntry && dedupVersionCouldBeRetained(txnTime)) {
-                                const priorAudit = auditStore.get(txnTime, tableId, id, options?.nodeId);
+                            if (isRocksDB && !replaying && !stagedOwnAuditEntry && dedupVersionCouldBeRetained(txnLogKey)) {
+                                const priorAudit = auditStore.get(txnLogKey, tableId, id, options?.nodeId);
                                 if (priorAudit &&
-                                    priorAudit.version === txnTime &&
-                                    precedesExistingVersion(txnTime, { version: txnTime, localTime: txnTime, key: id, nodeId: priorAudit.nodeId }, options?.nodeId) === 0) {
+                                    priorAudit.txnLogKey === txnLogKey &&
+                                    precedesExistingVersion(txnTime, { version: txnTime, localTime: txnLogKey, key: id, nodeId: priorAudit.nodeId }, options?.nodeId) === 0) {
                                     write.skipped = true;
                                     return; // duplicate already applied; avoid the resequencing walk
                                 }
                             }
                             // incremental CRDT updates are only available with audit logging on
-                            let localTime = existingEntry.localTime;
+                            const initialAuditHead = isRocksDB
+                                ? resolveAuditHead(id, existingEntry.version, existingEntry.nodeId, existingEntry.additionalAuditRefs)
+                                : { txnLogKey: existingEntry.localTime, nodeId: existingEntry.nodeId };
+                            let localTime = initialAuditHead.txnLogKey;
                             let auditedVersion = existingEntry.version;
                             logger_ts_1.logger.debug?.('Applying CRDT update to record with id: ', id, 'txn time', new Date(txnTime), 'applying later update from:', new Date(auditedVersion), 'local recorded time', new Date(localTime));
-                            let nodeId = existingEntry.nodeId;
+                            let nodeId = initialAuditHead.nodeId;
                             const succeedingUpdates = []; // record the "future" updates, as we need to apply the updates in reverse order
                             const auditRefsToVisit = existingEntry.additionalAuditRefs
                                 ? existingEntry.additionalAuditRefs.map((ref) => ({ localTime: ref.version, nodeId: ref.nodeId }))
                                 : [];
-                            // Collect any existing audit refs that should be preserved (those older than current transaction)
+                            // Out-of-order merges retain every existing branch head; per-origin log keys are not globally ordered.
                             if (existingEntry.additionalAuditRefs) {
                                 for (const ref of existingEntry.additionalAuditRefs) {
-                                    if (ref.version <= txnTime) {
-                                        additionalAuditRefs.push(ref);
-                                    }
+                                    additionalAuditRefs.push(ref);
                                 }
                             }
                             let addedAuditRef = false;
                             let nextRef;
+                            const visitedAuditRefs = new Set();
+                            const queuePreviousAuditRefs = (auditRecord) => {
+                                const previousRefs = auditRecord.previousAdditionalAuditRefs;
+                                if (previousRefs) {
+                                    for (const ref of previousRefs) {
+                                        auditRefsToVisit.push({ localTime: ref.version, nodeId: ref.nodeId });
+                                        logger_ts_1.logger.debug?.('Adding audit ref from audit record to visit queue', {
+                                            version: ref.version,
+                                            nodeId: ref.nodeId,
+                                        });
+                                    }
+                                }
+                            };
+                            const advanceToPreviousAudit = (auditRecord) => {
+                                const previousRefs = auditRecord.previousAdditionalAuditRefs;
+                                const previousHead = isRocksDB && previousRefs?.length
+                                    ? resolveAuditHead(id, auditRecord.previousVersion, auditRecord.previousNodeId, previousRefs)
+                                    : { txnLogKey: auditRecord.previousVersion, nodeId: auditRecord.previousNodeId };
+                                localTime = previousHead.txnLogKey;
+                                nodeId = previousHead.nodeId;
+                            };
                             let walkSteps = 0;
                             let auditWalkCapped = false;
                             // Early-out residual: as we walk the chain newest-first, fold each succeeding patch into a
@@ -2568,17 +3558,21 @@ function makeTable(options) {
                             // appended this write's own audit entry, so the lookup would match it while the record was
                             // never committed (see the up-front keyed dedup above).
                             const isReDeliveredDuplicate = () => {
-                                if (stagedOwnAuditEntry)
+                                if (replaying || stagedOwnAuditEntry)
                                     return false;
-                                if (!dedupVersionCouldBeRetained(txnTime))
-                                    return false; // pre-retention version — skip the end-of-log scan (best-effort; see above)
-                                const duplicate = auditStore.get(txnTime, tableId, id, options?.nodeId);
+                                if (!dedupVersionCouldBeRetained(txnLogKey))
+                                    return false; // pre-retention log key — skip the end-of-log scan (best-effort; see above)
+                                const duplicate = auditStore.get(txnLogKey, tableId, id, options?.nodeId);
                                 return (duplicate &&
-                                    duplicate.version === txnTime &&
-                                    precedesExistingVersion(txnTime, { version: txnTime, localTime: txnTime, key: id, nodeId: duplicate.nodeId }, options?.nodeId) === 0);
+                                    duplicate.txnLogKey === txnLogKey &&
+                                    precedesExistingVersion(txnTime, { version: txnTime, localTime: txnLogKey, key: id, nodeId: duplicate.nodeId }, options?.nodeId) === 0);
                             };
                             do {
                                 while (localTime > txnTime || (auditedVersion >= txnTime && localTime > 0)) {
+                                    const auditIdentity = `${nodeId ?? 0}:${localTime}`;
+                                    if (visitedAuditRefs.has(auditIdentity))
+                                        break;
+                                    visitedAuditRefs.add(auditIdentity);
                                     // Bound the walk only for RocksDB, where the OOM was observed (issue #1114): each step
                                     // is a transaction-log range scan + msgpackr decode, and the per-node logs can be huge.
                                     // LMDB audit entries are keyed by local audit time (not version), so the duplicate
@@ -2590,19 +3584,39 @@ function makeTable(options) {
                                     const auditRecord = auditStore.get(localTime, tableId, id, nodeId);
                                     if (!auditRecord)
                                         break;
+                                    queuePreviousAuditRefs(auditRecord);
+                                    if (isRocksDB &&
+                                        !replaying &&
+                                        !stagedOwnAuditEntry &&
+                                        localTime === txnLogKey &&
+                                        precedesExistingVersion(txnTime, { version: txnTime, localTime: txnLogKey, key: id, nodeId: auditRecord.nodeId }, options?.nodeId) === 0) {
+                                        write.skipped = true;
+                                        return;
+                                    }
                                     auditedVersion = auditRecord.version;
                                     if (auditedVersion >= txnTime) {
                                         if (auditedVersion === txnTime) {
                                             precedesExisting = precedesExistingVersion(txnTime, { version: auditedVersion, localTime: localTime, key: id, nodeId: auditRecord.nodeId }, options?.nodeId);
                                             if (precedesExisting === 0) {
-                                                logger_ts_1.logger.debug?.('The transaction time is equal to the existing version, treating as duplicate', id);
-                                                write.skipped = true;
-                                                return; // treat a tie as a duplicate and drop it
+                                                if (isRocksDB && localTime !== txnLogKey) {
+                                                    // Same origin and record version, but a distinct write. Its per-origin log key
+                                                    // orders the otherwise non-unique record clock without comparing keys across origins.
+                                                    precedesExisting = txnLogKey > localTime ? 1 : -1;
+                                                }
+                                                else if (replaying || stagedOwnAuditEntry) {
+                                                    // The log entry being replayed (or staged by this write's failed attempt) is
+                                                    // the write itself, not proof that its primary-store mutation committed.
+                                                    precedesExisting = 1;
+                                                }
+                                                else {
+                                                    logger_ts_1.logger.debug?.('The transaction time and log key match the existing write, treating as duplicate', id);
+                                                    write.skipped = true;
+                                                    return;
+                                                }
                                             }
                                             if (precedesExisting > 0) {
                                                 // if the existing version is older, we can skip this update
-                                                localTime = auditRecord.previousVersion;
-                                                nodeId = auditRecord.previousNodeId;
+                                                advanceToPreviousAudit(auditRecord);
                                                 continue;
                                             }
                                         }
@@ -2637,23 +3651,16 @@ function makeTable(options) {
                                     }
                                     if (!addedAuditRef && isRocksDB) {
                                         addedAuditRef = true;
-                                        // Add a reference to this older audit record if we had out-of-order writes
-                                        additionalAuditRefs.push({ version: txnTime, nodeId: options?.nodeId });
+                                        // Add a reference to this older audit record if we had out-of-order writes. The stored
+                                        // value is a LOG key, not a record version: every consumer follows it straight into
+                                        // `auditStore.get` (see the `auditRefsToVisit` mapping above and below), and on an
+                                        // applied write those two clocks differ.
+                                        additionalAuditRefs.push({ version: txnLogKey, nodeId: options?.nodeId });
                                         logger_ts_1.logger.debug?.('Adding additional audit ref for out-of-order write', {
-                                            version: txnTime,
+                                            txnLogKey,
                                             nodeId: options?.nodeId,
                                         });
                                     }
-                                    // Collect any additional audit refs from this audit record to traverse other branches
-                                    if (auditRecord.previousAdditionalAuditRefs) {
-                                        for (const ref of auditRecord.previousAdditionalAuditRefs) {
-                                            auditRefsToVisit.push({ localTime: ref.version, nodeId: ref.nodeId });
-                                            logger_ts_1.logger.debug?.('Adding audit ref from audit record to visit queue', {
-                                                version: ref.version,
-                                                nodeId: ref.nodeId,
-                                            });
-                                        }
-                                    }
                                     // Every field of this write is overwritten by newer writes, and there is no alternate
                                     // audit branch left to scan, so it is fully superseded — the same outcome as walking to
                                     // the end and taking the `writeCommit(false)` escape below, reached without paying the rest
@@ -2671,8 +3678,7 @@ function makeTable(options) {
                                         }
                                         return writeCommit(false);
                                     }
-                                    localTime = auditRecord.previousVersion;
-                                    nodeId = auditRecord.previousNodeId;
+                                    advanceToPreviousAudit(auditRecord);
                                 }
                                 // Check if we need to scan additional audit refs from this record
                                 if (auditWalkCapped)
@@ -2766,15 +3772,15 @@ function makeTable(options) {
                     if (recordToStore && recordToStore.getRecord)
                         throw new Error('Can not assign a record to a record, check for circular references');
                     if (residencyId == undefined) {
-                        if (entry?.residencyId)
-                            context.previousResidency = TableResource.getResidencyRecord(entry.residencyId);
-                        const residency = residencyFromFunction(TableResource.getResidency(recordToStore, context));
+                        if (existingEntry?.residencyId)
+                            context.previousResidency = _a.getResidencyRecord(existingEntry.residencyId);
+                        const residency = residencyFromFunction(_a.getResidency(recordToStore, context));
                         if (residency) {
                             if (!residency.includes(server.hostname)) {
                                 // if we aren't in the residency list, specify that our local record should be omitted or be partial
                                 auditRecordToStore ??= recordToStore;
                                 omitLocalRecord = true;
-                                if (TableResource.getResidencyById) {
+                                if (_a.getResidencyById) {
                                     // complete omission of the record that doesn't belong here
                                     recordToStore = undefined;
                                 }
@@ -2844,7 +3850,17 @@ function makeTable(options) {
                         }
                     })());
                     updateIndices(id, existingRecord, recordToStore, transaction && { transaction });
+                    // Preserve an addressable audit head when the record and log clocks diverge.
+                    if (isRocksDB && audit && !isCopyApply && txnLogKey !== txnTime) {
+                        const headIndex = additionalAuditRefs.findIndex((ref) => ref.version === txnLogKey && (ref.nodeId ?? 0) === (options?.nodeId ?? 0));
+                        if (headIndex > 0)
+                            additionalAuditRefs.unshift(additionalAuditRefs.splice(headIndex, 1)[0]);
+                        else if (headIndex < 0)
+                            additionalAuditRefs.unshift({ version: txnLogKey, nodeId: options?.nodeId });
+                    }
                     writeCommit(true);
+                    if (write.trackRecordVersion)
+                        write.recordVersionApplied = true;
                     if (expiresAt >= 0) {
                         scheduleCleanup(); // arm for replicated writes too, not just local-context writes
                         // A runtime per-record expiresAt on a table with no table-level expiration/eviction, no expiresAt
@@ -2871,6 +3887,8 @@ function makeTable(options) {
                             user: context?.user,
                             residencyId,
                             expiresAt,
+                            recordVersion: txnTime,
+                            recordNodeId: precedesExisting < 0 ? existingEntry?.nodeId : options?.nodeId,
                             nodeId: options?.nodeId,
                             viaNodeId: options?.viaNodeId,
                             originatingOperation: context?.originatingOperation,
@@ -2908,7 +3926,7 @@ function makeTable(options) {
             // calls the backend, and a tracked-instance mutation (update(id,{}); row.source=…;
             // save()) that sets the source via accessors after update() won't re-embed. A
             // resource-layer re-embed is the proper fix; tracked as a follow-up.
-            const embedBefore = (0, embedHook_ts_1.buildEmbedBefore)(recordUpdate, context, options, TableResource.embedAttributes, TableResource.userEmbedders);
+            const embedBefore = (0, embedHook_ts_1.buildEmbedBefore)(recordUpdate, context, options, _a.embedAttributes, _a.userEmbedders);
             const proceed = () => {
                 // On a source/replication apply (`isNotification`), the record's already-saved blobs were
                 // received out-of-band for THIS write, so track them for skip/abort cleanup (harper-pro#406).
@@ -2964,8 +3982,10 @@ function makeTable(options) {
             return Boolean(this.#record);
         }
         _writeDelete(id, options) {
+            this.#assertLiveHandle(id);
             const context = this.getContext();
             const transaction = txnForContext(context);
+            assertDerivedIndexAdmission(options, transaction);
             checkValidId(id);
             const entry = this.#entry ?? primaryStore.getEntry(id, { transaction: transaction.getReadTxn() });
             const write = {
@@ -2973,7 +3993,10 @@ function makeTable(options) {
                 store: primaryStore,
                 entry,
                 chainsStagedState: true,
+                reloadCommitBase: true,
                 nodeName: context?.nodeName,
+                recordVersion: options?.version,
+                lockHandle: this.#lockHandle && this.#lockHandle.keyId === (0, DatabaseTransaction_ts_1.writeKeyId)(id) ? this.#lockHandle : undefined,
                 before: this.constructor.source?.delete && !context?.source
                     ? this.constructor.source.delete.bind(this.constructor.source, id, undefined, context)
                     : undefined,
@@ -2985,10 +4008,11 @@ function makeTable(options) {
                     const priorStagedOp = (0, DatabaseTransaction_ts_1.priorStagedWrite)(write);
                     const priorStaged = priorStagedOp?.stagedEntry;
                     const existingRecord = priorStaged ? priorStaged.value : existingEntry?.value;
+                    const txnLogKey = isRocksDB && options?.version != null ? (transaction?.getTimestamp?.() ?? txnTime) : txnTime;
                     if (retry) {
                         if (context && existingEntry?.version > (context.lastModified || 0))
                             context.lastModified = existingEntry.version;
-                        TableResource._updateResource(this, existingEntry);
+                        _a._updateResource(this, existingEntry);
                     }
                     // a strictly newer record exists locally, so this delete loses. An earlier write in this
                     // transaction can never trip this guard — it shares this transaction's timestamp and
@@ -3006,6 +4030,10 @@ function makeTable(options) {
                             viaNodeId: options?.viaNodeId,
                             transaction,
                             tableToTrack: tableName,
+                            recordVersion: txnTime,
+                            additionalAuditRefs: isRocksDB && audit && txnLogKey !== txnTime
+                                ? [{ version: txnLogKey, nodeId: options?.nodeId }]
+                                : undefined,
                         }, 'delete');
                         if (!audit || isRocksDB)
                             scheduleCleanup();
@@ -3015,6 +4043,8 @@ function makeTable(options) {
                         (0, RecordEncoder_ts_1.removeEntry)(primaryStore, existingEntry, isRocksDB && transaction ? { transaction } : undefined);
                     }
                     write.stagedEntry = { value: undefined }; // the key holds no record for the rest of this transaction
+                    if (write.trackRecordVersion)
+                        write.recordVersionApplied = true;
                     // the removal supersedes the nearest record an earlier write in this transaction stored
                     // (older ones were already marked by their staged successors), so its saved blobs are
                     // cleaned up post-commit unless its audit entry references them
@@ -3274,7 +4304,7 @@ function makeTable(options) {
                 // Note, that we do allow users to disable condition re-ordering, in case they have knowledge of a preferred
                 // order for their query.
                 if (conditions.length > 1 && operator !== 'or')
-                    return sortBy(conditions, (0, search_ts_1.estimateCondition)(TableResource));
+                    return sortBy(conditions, (0, search_ts_1.estimateCondition)(_a));
                 else
                     return conditions;
             }
@@ -3321,8 +4351,13 @@ function makeTable(options) {
                         else if (conditions.length === 0 && !target.allowFullScan)
                             throw (0, hdbError_ts_1.handleHDBError)(new Error(), `${Array.isArray(attribute_name) ? attribute_name.join('.') : attribute_name} is not indexed and not combined with any other conditions`, 404);
                     }
-                    if (orderAlignedCondition)
+                    if (orderAlignedCondition) {
                         orderAlignedCondition.descending = Boolean(sort.descending);
+                        if (orderAlignedCondition.maxIndexLagMilliseconds === undefined)
+                            orderAlignedCondition.maxIndexLagMilliseconds = sort.maxIndexLagMilliseconds;
+                        if (orderAlignedCondition.waitForIndexMilliseconds === undefined)
+                            orderAlignedCondition.waitForIndexMilliseconds = sort.waitForIndexMilliseconds;
+                    }
                 }
             }
             conditions = orderConditions(conditions, operator);
@@ -3351,6 +4386,10 @@ function makeTable(options) {
                 }
             }
             const select = target.select;
+            // Whether the caller supplied real filter conditions — read from the raw request, NOT the
+            // planner-augmented `conditions` (which by now may carry a synthetic `sort` pseudo-condition and
+            // injected full-scan condition). Used to pick the count-estimate source below.
+            const hasUserConditions = Array.isArray(target.conditions) && target.conditions.length > 0;
             if (conditions.length === 0) {
                 conditions = [{ attribute: primaryKey, comparator: 'greater_than', value: true }];
             }
@@ -3387,35 +4426,156 @@ function makeTable(options) {
             const recordAccess = boundRowFilter || typeof target.vectorFilter === 'function'
                 ? { rowFilter: boundRowFilter, vectorFilter: target.vectorFilter }
                 : undefined;
-            const entries = (0, search_ts_1.executeConditions)(conditions, operator, TableResource, readTxn, target, context, (results, filters) => transformToEntries(results, select, context, readTxn, filters), filtered, recordAccess);
-            const ensure_loaded = target.ensureLoaded !== false;
-            // The guards inside executeConditions evaluate the
-            // LOCAL record, but on a caching table transformEntryForSelect may then revalidate an
-            // expired/invalidated row from source and return a DIFFERENT record. The explicit row filter
-            // must hold on the record actually returned, so it is re-checked
-            // there, after materialization (the earlier evaluation stays as a prune that also bounds HNSW
-            // traversal). vectorFilter and condition filters intentionally keep the local-record
-            // semantics all query filters have on caching tables.
-            //
-            // A row that is past its TTL but not yet swept by the background eviction
-            // scan is still physically present. A write that is about to overwrite it
-            // anyway (e.g. the SQL engine locating UPDATE/DELETE targets) needs to see
-            // it as a match — the same leniency a direct by-id put/patch already gets,
-            // since those never run the ensureLoaded-gated freshness check this transform
-            // otherwise applies unconditionally to every read.
-            const includeExpired = target.includeExpired === true;
-            const transformToRecord = TableResource.transformEntryForSelect(select, context, readTxn, filtered, ensure_loaded, true, boundRowFilter, includeExpired, postOrdering);
-            let results = TableResource.transformToOrderedSelect(entries, select, postOrdering, context, readTxn, transformToRecord);
-            // apply any offset/limit after all the sorting and filtering
-            if (target.offset || target.limit !== undefined)
-                results = results.slice(target.offset, target.limit !== undefined ? (target.offset || 0) + target.limit : undefined);
-            results.onDone = () => {
-                results.onDone = null; // ensure that it isn't called twice
+            try {
+                const entries = (0, search_ts_1.executeConditions)(conditions, operator, _a, readTxn, target, context, (results, filters) => transformToEntries(results, select, context, readTxn, filters), filtered, recordAccess);
+                const ensure_loaded = target.ensureLoaded !== false;
+                // The guards inside executeConditions evaluate the
+                // LOCAL record, but on a caching table transformEntryForSelect may then revalidate an
+                // expired/invalidated row from source and return a DIFFERENT record. The explicit row filter
+                // must hold on the record actually returned, so it is re-checked
+                // there, after materialization (the earlier evaluation stays as a prune that also bounds HNSW
+                // traversal). vectorFilter and condition filters intentionally keep the local-record
+                // semantics all query filters have on caching tables.
+                //
+                // A row that is past its TTL but not yet swept by the background eviction
+                // scan is still physically present. A write that is about to overwrite it
+                // anyway (e.g. the SQL engine locating UPDATE/DELETE targets) needs to see
+                // it as a match — the same leniency a direct by-id put/patch already gets,
+                // since those never run the ensureLoaded-gated freshness check this transform
+                // otherwise applies unconditionally to every read.
+                const includeExpired = target.includeExpired === true;
+                const transformToRecord = _a.transformEntryForSelect(select, context, readTxn, filtered, ensure_loaded, true, boundRowFilter, includeExpired, postOrdering);
+                let results = _a.transformToOrderedSelect(entries, select, postOrdering, context, readTxn, transformToRecord);
+                const offset = target.offset || 0;
+                const end = target.limit !== undefined ? offset + target.limit : undefined;
+                // `Prefer: count=` (REST pagination): materialize the requested page and attach a total record
+                // count so the HTTP layer can emit a Content-Range. `exact` drains the full matched set once,
+                // windowing the page in the same pass; `estimated` returns just the page plus a cheap planner/
+                // table estimate. Opt-in only — the default streaming path below is untouched.
+                //
+                // Requires a bounded page AND window. Counting is a pagination feature; both the limit and the
+                // offset must be finite, non-negative integers, the limit no larger than MAX_COUNT_PAGE, and the
+                // window (offset + limit) no larger than MAX_EXACT_COUNT_SCAN. Anything else — a missing/
+                // oversized/non-finite/negative limit or offset (a bare collection GET, limit(Infinity),
+                // limit(foo), limit(-5,10)) or a deep-page window past the scan budget — falls through to the
+                // normal streaming path with no count. This bounds the offset too: without it a huge offset would
+                // postpone the exact guardrail (which only engages past the page) until that offset was scanned.
+                const pageLimit = target.limit;
+                if (target.count &&
+                    Number.isInteger(pageLimit) &&
+                    pageLimit >= 0 &&
+                    pageLimit <= MAX_COUNT_PAGE &&
+                    Number.isInteger(offset) &&
+                    offset >= 0 &&
+                    offset + pageLimit <= MAX_EXACT_COUNT_SCAN) {
+                    const wantExact = target.count === 'exact';
+                    const pageEnd = offset + pageLimit;
+                    const countStart = node_perf_hooks_1.performance.now();
+                    // A custom-index (vector/HNSW) traversal returns a bounded, approximate candidate set whose size is
+                    // chosen from `minResults` (offset + limit), so `scanned` over it tracks the requested page size, not
+                    // the true match count — the same query at limit(5) vs limit(200) would otherwise advertise two
+                    // different `count=exact` totals. Any query whose execution touches a custom index is affected: a
+                    // custom-index sort (its aligned pseudo-condition lands in `conditions`), a custom-index threshold
+                    // filter (an HNSW `lt`/`le` is the same minResults-widened traversal as a sort), or an opaque vector
+                    // filter. Report the total as unavailable for those rather than advertising it as count=exact
+                    // (mirroring how the estimated branch below bails to null for an opaque row/vector filter). A vector
+                    // sort applied as in-memory post-ordering leaves no custom-index condition here and stays exact.
+                    const touchesCustomIndex = (conds) => conds.some((c) => {
+                        if (!c)
+                            return false;
+                        if (c.conditions)
+                            return touchesCustomIndex(c.conditions);
+                        const attr = Array.isArray(c.attribute) ? c.attribute[0] : (c.attribute ?? c[0]);
+                        return typeof attr === 'string' && Boolean(indices[attr]?.customIndex);
+                    });
+                    const approximateResultSet = typeof target.vectorFilter === 'function' || touchesCustomIndex(conditions);
+                    return (async () => {
+                        const page = [];
+                        let scanned = 0;
+                        let exact = true;
+                        try {
+                            for await (const record of results) {
+                                if (scanned >= offset && scanned < pageEnd)
+                                    page.push(record);
+                                scanned++;
+                                // A store whose async iterator settles synchronously (the common indexed-scan case) would
+                                // otherwise let this drain spin as one uninterrupted microtask run, blocking the event loop
+                                // for the whole count. Yield to the macrotask queue periodically so concurrent requests and
+                                // I/O still make progress during a large exact scan.
+                                if ((scanned & (COUNT_YIELD_INTERVAL - 1)) === 0)
+                                    await new Promise((resolve) => setImmediate(resolve));
+                                // The page window [offset, pageEnd) is always collected in full first — the guardrail
+                                // only ever abandons the running TOTAL, never truncates the page body.
+                                if (scanned >= pageEnd) {
+                                    // `estimated` needs nothing past the page; an approximate (vector) exact total is going to
+                                    // be reported unavailable anyway, so don't drain its tail for a number we won't publish.
+                                    if (!wantExact || approximateResultSet)
+                                        break;
+                                    // `exact` keeps counting the tail, bounded by a row cap AND a time budget so a
+                                    // large match set can't turn a bounded page fetch into an unbounded scan.
+                                    if (scanned > MAX_EXACT_COUNT_SCAN || node_perf_hooks_1.performance.now() - countStart > MAX_EXACT_COUNT_MS) {
+                                        exact = false;
+                                        break;
+                                    }
+                                }
+                            }
+                        }
+                        finally {
+                            // We own the iteration here (no results.onDone consumer), so release the read
+                            // transaction unconditionally — including when the drain throws — or the snapshot leaks.
+                            txn.doneReadTxn();
+                        }
+                        let total;
+                        if (wantExact) {
+                            // `scanned` is only an authoritative total when the iteration was exhaustive and deterministic;
+                            // an approximate (vector/HNSW) result set is neither, so report the total as unavailable.
+                            total = exact && !approximateResultSet ? scanned : null;
+                        }
+                        else if (boundRowFilter || typeof target.vectorFilter === 'function') {
+                            // An opaque row/vector filter shapes the result but isn't reflected in the index/condition
+                            // estimate; guessing would both mislead and disclose cardinality the filter hides.
+                            total = null;
+                        }
+                        else if (!hasUserConditions) {
+                            total = (0, search_ts_1.estimatedEntryCount)(primaryStore);
+                        }
+                        else {
+                            // Estimate from the real conditions only — drop the planner's synthetic `sort`
+                            // pseudo-condition, which otherwise contributes a bogus (entryCount/2) cardinality.
+                            const est = (0, search_ts_1.estimateCondition)(_a)({
+                                conditions: conditions.filter((c) => c.comparator !== 'sort'),
+                                operator: operator ? String(operator).toLowerCase() : 'and',
+                            });
+                            total = isFinite(est) ? Math.round(est) : null;
+                        }
+                        // For an estimate, never report a total below the last row actually returned — keeps the
+                        // Content-Range valid (start-end/total) when an estimate undershoots a non-empty page.
+                        // Exact totals are authoritative (and an empty page past the end must not be clamped up).
+                        if (!wantExact && total != null && page.length > 0 && total < offset + page.length) {
+                            total = offset + page.length;
+                        }
+                        page.recordCount = total;
+                        page.recordCountExact = wantExact && exact && !approximateResultSet;
+                        page.selectApplied = true;
+                        page.getColumns = getColumns;
+                        return page;
+                    })();
+                }
+                // apply any offset/limit after all the sorting and filtering
+                if (target.offset || target.limit !== undefined)
+                    results = results.slice(offset, end);
+                results.onDone = () => {
+                    results.onDone = null; // ensure that it isn't called twice
+                    txn.doneReadTxn();
+                };
+                results.selectApplied = true;
+                results.getColumns = getColumns;
+                return results;
+            }
+            catch (error) {
                 txn.doneReadTxn();
-            };
-            results.selectApplied = true;
-            results.getColumns = getColumns;
-            return results;
+                throw error;
+            }
         }
         /**
          * This is responsible for ordering and select()ing the attributes/properties from returned entries
@@ -3431,10 +4591,18 @@ function makeTable(options) {
             if (sort) {
                 // there might be some situations where we don't need to transform to entries for sorting, not sure
                 entries = transformToEntries(entries, select, context, readTxn, null);
-                let ordered;
+                // Sort keys are resolved as entries are collected, so comparison never dereferences a record: a
+                // cached entry holds its record only weakly, and a re-read per comparison is what this avoids.
+                const clauses = [];
+                for (let order = sort; order; order = order.next)
+                    clauses.push(order);
+                const clauseCount = clauses.length;
                 // if we are doing post-ordering, we need to get records first, then sort them
                 results.iterate = function (options) {
-                    let sortedArrayIterator;
+                    let ordered;
+                    let orderedKeys;
+                    let sortedPositions;
+                    let sortedIndex;
                     const dbIterator = options?.async && entries[Symbol.asyncIterator]
                         ? entries[Symbol.asyncIterator]()
                         : entries[Symbol.iterator]();
@@ -3443,26 +4611,34 @@ function makeTable(options) {
                     let enqueuedEntryForNextGroup;
                     let lastGroupingValue;
                     let firstEntry = true;
-                    function createComparator(order) {
-                        const nextComparator = order.next && createComparator(order.next);
-                        const descending = order.descending;
-                        return (entryA, entryB) => {
-                            const a = getAttributeValue(entryA, order.attribute, context, order);
-                            const b = getAttributeValue(entryB, order.attribute, context, order);
-                            const diff = descending
-                                ? (0, ordered_binary_1.compareKeys)(convertToComparableKeys(b), convertToComparableKeys(a))
-                                : (0, ordered_binary_1.compareKeys)(convertToComparableKeys(a), convertToComparableKeys(b));
-                            if (diff === 0)
-                                return nextComparator?.(entryA, entryB) || 0;
-                            return diff;
-                        };
+                    function collect(entry) {
+                        ordered.push(entry);
+                        for (let i = 0; i < clauseCount; i++) {
+                            const clause = clauses[i];
+                            orderedKeys[i].push(convertToComparableKeys(getAttributeValue(entry, clause.attribute, context, clause)));
+                        }
+                    }
+                    function comparePositions(positionA, positionB) {
+                        for (let i = 0; i < clauseCount; i++) {
+                            const keys = orderedKeys[i];
+                            const diff = clauses[i].descending
+                                ? (0, ordered_binary_1.compareKeys)(keys[positionB], keys[positionA])
+                                : (0, ordered_binary_1.compareKeys)(keys[positionA], keys[positionB]);
+                            if (diff !== 0)
+                                return diff;
+                        }
+                        return 0;
+                    }
+                    function nextSorted() {
+                        if (sortedIndex < sortedPositions.length)
+                            return { done: false, value: ordered[sortedPositions[sortedIndex++]] };
+                        return { done: true, value: undefined };
                     }
-                    const comparator = createComparator(sort);
                     return {
                         async next() {
                             let iteration;
-                            if (sortedArrayIterator) {
-                                iteration = sortedArrayIterator.next();
+                            if (sortedPositions) {
+                                iteration = nextSorted();
                                 if (iteration.done) {
                                     if (dbDone) {
                                         if (results.onDone)
@@ -3476,8 +4652,11 @@ function makeTable(options) {
                                     };
                             }
                             ordered = [];
+                            orderedKeys = [];
+                            for (let i = 0; i < clauseCount; i++)
+                                orderedKeys.push([]);
                             if (enqueuedEntryForNextGroup)
-                                ordered.push(enqueuedEntryForNextGroup);
+                                collect(enqueuedEntryForNextGroup);
                             // need to load all the entries into ordered
                             do {
                                 iteration = await dbIterator.next();
@@ -3509,17 +4688,18 @@ function makeTable(options) {
                                             break;
                                         }
                                     }
-                                    // we store the value we will sort on, for fast sorting, and the entry so the records can be GC'ed if necessary
-                                    // before the sorting is completed
-                                    ordered.push(entry);
+                                    collect(entry);
                                 }
                             } while (true);
                             if (sort.isGrouped) {
                                 // TODO: Return grouped results
                             }
-                            ordered.sort(comparator);
-                            sortedArrayIterator = ordered[Symbol.iterator]();
-                            iteration = sortedArrayIterator.next();
+                            sortedPositions = [];
+                            for (let i = 0; i < ordered.length; i++)
+                                sortedPositions.push(i);
+                            sortedPositions.sort(comparePositions);
+                            sortedIndex = 0;
+                            iteration = nextSorted();
                             if (!iteration.done)
                                 return {
                                     value: await transformToRecord.call(this, iteration.value),
@@ -3723,12 +4903,12 @@ function makeTable(options) {
                                 if (resolver.directReturn)
                                     return callback(value, attribute_name);
                                 if (value && typeof value === 'object') {
-                                    const targetTable = resolver.definition?.tableClass || TableResource;
+                                    const targetTable = resolver.definition?.tableClass || _a;
                                     if (!transformCache)
                                         transformCache = {};
                                     // Use the target table's own read transaction; each table's readTxn is
                                     // scoped to its RocksDB column family and cannot read another table's store.
-                                    const targetReadTxn = targetTable === TableResource ? readTxn : targetTable._readTxnForContext(context);
+                                    const targetReadTxn = targetTable === _a ? readTxn : targetTable._readTxnForContext(context);
                                     const transform = transformCache[attribute_name] ||
                                         (transformCache[attribute_name] = targetTable.transformEntryForSelect(
                                         // if it is a simple string, there is no select for the next level,
@@ -3781,7 +4961,7 @@ function makeTable(options) {
                         else {
                             value = record[attribute_name];
                             if (value && typeof value === 'object' && attribute_name !== attribute) {
-                                const subTransform = TableResource.transformEntryForSelect(attribute.select || attribute, context, readTxn, null);
+                                const subTransform = _a.transformEntryForSelect(attribute.select || attribute, context, readTxn, null);
                                 // Plain JSON nested values: arrays project per-element so that
                                 // `select: [{ name: 'addresses', select: ['city'] }]` returns
                                 // `addresses: [{ city }, { city }]` rather than a single object.
@@ -3860,6 +5040,10 @@ function makeTable(options) {
             if (!auditStore)
                 throw new Error('Can not subscribe to a table without an audit log');
             if (!audit) {
+                // Turning auditing on is a schema write, and a branch's Table classes carry the base's
+                // logical name: without this a subscribe through a branched application would enable
+                // auditing on the live base table for every other consumer, with no DDL call involved.
+                _a.assertSchemaMutable('enable auditing for a subscription');
                 (0, databases_ts_1.table)({ table: tableName, database: databaseName, schemaDefined, attributes, audit: true });
             }
             const getFullRecord = !request.rawEvents;
@@ -3915,11 +5099,14 @@ function makeTable(options) {
                     return evaluateFilter(rowFilter, event.value, 'rowFilter');
                 }
                 : null;
-            const subscription = (0, transactionBroadcast_ts_1.addSubscription)(TableResource, thisId, function (id, auditRecord, localTime, beginTxn) {
+            const subscription = (0, transactionBroadcast_ts_1.addSubscription)(_a, thisId, function (id, auditRecord, txnLogKey, beginTxn) {
                 if (dropDuringReplay)
                     return;
                 try {
                     let type = auditRecord.type;
+                    // Ahead of the rawEvents branch, which forwards every type verbatim.
+                    if ((0, auditStore_ts_1.isLockControlType)(type))
+                        return;
                     let value;
                     if (type === 'message' || request.rawEvents) {
                         // we only send the full message, this are individual messages that can be sent out of order
@@ -3942,8 +5129,7 @@ function makeTable(options) {
                         // been written, so are fresh in memory.
                         const entry = primaryStore.getEntry(id);
                         if (entry) {
-                            // staleness is a record-version comparison; auditRecord.version is the log key on RocksDB
-                            if (entry.version !== (auditRecord.recordVersion ?? auditRecord.version))
+                            if (entry.version !== auditRecord.version)
                                 return; // out of order event, with old update, don't send anything
                             value = entry.value;
                             type = entry.metadataFlags & exports.INVALIDATED ? 'invalidate' : value ? 'put' : 'delete';
@@ -3954,7 +5140,7 @@ function makeTable(options) {
                     }
                     const event = {
                         id,
-                        localTime,
+                        localTime: txnLogKey,
                         value,
                         version: auditRecord.version,
                         type,
@@ -4019,14 +5205,16 @@ function makeTable(options) {
                                     if (!isActive())
                                         return;
                                 }
-                                if (auditRecord.tableId !== tableId)
+                                if (auditRecord.tableId !== tableId || auditRecord.type === 'evict')
+                                    continue;
+                                if ((0, auditStore_ts_1.isLockControlType)(auditRecord.type))
                                     continue;
                                 const id = auditRecord.recordId;
                                 if (thisId == null || isDescendantId(thisId, id)) {
-                                    const value = auditRecord.getValue(primaryStore, getFullRecord, auditRecord.localTime);
+                                    const value = auditRecord.getValue(primaryStore, getFullRecord, auditRecord.txnLogKey);
                                     if (!send({
                                         id,
-                                        localTime: auditRecord.localTime,
+                                        localTime: auditRecord.txnLogKey,
                                         value,
                                         version: auditRecord.version,
                                         type: auditRecord.type,
@@ -4039,7 +5227,7 @@ function makeTable(options) {
                                             return;
                                     }
                                 }
-                                subscription.startTime = auditRecord.localTime ?? auditRecord.version; // update so we don't double send
+                                subscription.startTime = auditRecord.txnLogKey; // update so we don't double send
                             }
                         }
                         finally {
@@ -4059,7 +5247,9 @@ function makeTable(options) {
                                     return;
                             }
                             try {
-                                if (auditRecord.tableId !== tableId)
+                                if (auditRecord.tableId !== tableId || auditRecord.type === 'evict')
+                                    continue;
+                                if ((0, auditStore_ts_1.isLockControlType)(auditRecord.type))
                                     continue;
                                 const id = auditRecord.recordId;
                                 if (thisId == null || isDescendantId(thisId, id)) {
@@ -4073,10 +5263,10 @@ function makeTable(options) {
                                         logger_ts_1.logger.warn?.(`previousCount backfill on ${tableName} stopped after inspecting ${MAX_PREVIOUS_COUNT_SCAN} in-scope audit records without collecting ${request.previousCount} accepted event(s); returning ${history.length} instead`);
                                         break;
                                     }
-                                    const value = auditRecord.getValue(primaryStore, getFullRecord, auditRecord.localTime);
+                                    const value = auditRecord.getValue(primaryStore, getFullRecord, auditRecord.txnLogKey);
                                     const historyEntry = {
                                         id,
-                                        localTime: auditRecord.localTime,
+                                        localTime: auditRecord.txnLogKey,
                                         value,
                                         version: auditRecord.version,
                                         type: auditRecord.type,
@@ -4093,7 +5283,7 @@ function makeTable(options) {
                                 }
                             }
                             catch (error) {
-                                logger_ts_1.logger.error?.('Error getting history entry', auditRecord.localTime, error);
+                                logger_ts_1.logger.error?.('Error getting history entry', auditRecord.txnLogKey, error);
                             }
                         }
                         for (let i = history.length; i > 0;) {
@@ -4181,6 +5371,12 @@ function makeTable(options) {
                         logger_ts_1.logger.trace?.('re-retrieved record', localTime, this.#entry?.localTime);
                         localTime = entry?.localTime;
                     }
+                    let nodeId = entry?.nodeId;
+                    if (isRocksDB && entry) {
+                        const head = resolveAuditHead(thisId, entry.version, nodeId, entry.additionalAuditRefs);
+                        localTime = head.txnLogKey;
+                        nodeId = head.nodeId;
+                    }
                     logger_ts_1.logger.trace?.('Subscription from', startTime, 'from', thisId, localTime);
                     if (startTime < localTime) {
                         // start time specified, get the audit history for this record. Set startTime up
@@ -4191,7 +5387,6 @@ function makeTable(options) {
                         const history = [];
                         let inspected = 0;
                         let nextTime = localTime;
-                        let nodeId = entry?.nodeId;
                         do {
                             if (++recordsSinceYield >= REPLAY_YIELD_INTERVAL) {
                                 recordsSinceYield = 0;
@@ -4222,8 +5417,11 @@ function makeTable(options) {
                                     else if (!isActive())
                                         return;
                                 }
-                                nextTime = auditRecord.previousVersion;
-                                nodeId = auditRecord.previousNodeId;
+                                const previousHead = isRocksDB
+                                    ? resolveAuditHead(thisId, auditRecord.previousVersion, auditRecord.previousNodeId, auditRecord.previousAdditionalAuditRefs)
+                                    : { txnLogKey: auditRecord.previousVersion, nodeId: auditRecord.previousNodeId };
+                                nextTime = previousHead.txnLogKey;
+                                nodeId = previousHead.nodeId;
                             }
                             else
                                 break;
@@ -4418,6 +5616,7 @@ function makeTable(options) {
                 store: primaryStore,
                 entry: this.#entry,
                 nodeName: context?.nodeName,
+                recordVersion: options?.version,
                 validate: () => {
                     if (!context?.source) {
                         transaction.checkOverloaded();
@@ -4482,6 +5681,108 @@ function makeTable(options) {
                 });
             });
         }
+        /**
+         * Write one cluster record-lock control entry (harper#483 Phase 1). Not local-only: replicating
+         * it IS the send.
+         *
+         * `recordId` must stay null. An entry carrying the locked key would share
+         * `(version, tableId, recordId, nodeId)` with the holder's own first write, which is stamped at
+         * exactly `ts_R`, and `RocksTransactionLogStore.getSync` answers with the FIRST entry at a
+         * timestamp and key — so `_writeUpdate`'s keyed dedup would find this one and drop that write.
+         * The payload goes in as bytes rather than through `recordUpdater`, which would run it through
+         * schema projection and the table's shared structure dictionary.
+         */
+        static writeLockControlEntry(entry) {
+            const encodedRecord = (0, recordLockCoordinator_ts_1.encodeLockControlPayload)(entry);
+            const nodeId = (0, nodeIdMapping_ts_1.getThisNodeId)(auditStore) ?? 0;
+            let position;
+            // No entry pins its clock, the request included. `ts_R` is minted before the write, so pinning
+            // to it can land the entry behind a peer's replication cursor if any write to this table
+            // commits in between — the same hazard that rules it out for grants and releases, which are
+            // written later still. The protocol reads `ts_R` from the payload, so the entry's own log key
+            // never has to equal it.
+            const context = {};
+            return Promise.resolve((0, transaction_ts_1.transaction)(context, (txn) => {
+                const tableTxn = txnForContext({ transaction: txn });
+                tableTxn.addWrite({
+                    key: null,
+                    store: primaryStore,
+                    skipReplicationConfirmation: true,
+                    commit: (txnTime, _existingEntry, _retry, nativeTransaction) => {
+                        position = txnTime;
+                        return auditStore[isRocksDB ? 'putSync' : 'put'](null, {
+                            version: txnTime,
+                            tableId,
+                            recordId: null,
+                            nodeId,
+                            type: entry.type,
+                            encodedRecord,
+                            extendedType: 0,
+                            // Zero, not the table's count: these bytes were packed by the private control `Packr`
+                            // and carry none of the table's structures. `RocksTransactionLogStore` raises the
+                            // per-(log, table) structure watermark from this field and flags the entry that does
+                            // it, so claiming the table's version would let a release take `HAS_STRUCTURE_UPDATE`
+                            // and leave the next real write at that version unflagged — a receiver that learns
+                            // structures only from flagged entries then decodes later records against a stale set
+                            // (harper#1348's class). A payload with no table structures cannot advance them.
+                            structureVersion: 0,
+                        }, { instructedWrite: true, transaction: nativeTransaction, nodeId, viaNodeId: nodeId });
+                    },
+                });
+            })).then(() => position);
+        }
+        /**
+         * The coordinator that holds this node's admissions, transport or not. Releasing and registering
+         * go here rather than through `lockCoordinator`, which answers undefined while a transport is
+         * momentarily unregistered — and a release dropped on that answer leaves the key's home holding
+         * its grant until the delegation's own deadline.
+         */
+        static get admittingCoordinator() {
+            return lockCoordinator;
+        }
+        /**
+         * This table's cluster lock coordinator, created on first use and only while a transport is
+         * registered for the database. Nothing is allocated on the Phase 0 path.
+         */
+        static get lockCoordinator() {
+            const transport = (0, recordLockCoordinator_ts_1.getClusterLockTransport)(databaseName);
+            if (!transport) {
+                // Deliberately NOT closed. harper-pro unregisters without a standalone claim during a
+                // reconnect, and closing here would drop this node's record of the delegations it has
+                // issued as a home — so the next registration would start empty and could grant a key
+                // whose delegate is still admitting. The coordinator keeps ticking, its grants expire on
+                // their own deadlines, and `isClusterLockRequired` is what fails an acquire closed in the
+                // meantime. A genuine standalone claim clears the requirement and the coordinator with it.
+                if (!(0, recordLockCoordinator_ts_1.isClusterLockRequired)(databaseName)) {
+                    lockCoordinator?.close();
+                    lockCoordinator = undefined;
+                }
+                return undefined;
+            }
+            if (lockCoordinator?.transport !== transport) {
+                // The transport object changed, but this node's delegations and the handles they admitted
+                // did not. The successor adopts that live authority in its constructor; the predecessor
+                // is closed afterwards so nothing is dropped in between. See LockCoordinatorOptions.adopt.
+                const predecessor = lockCoordinator;
+                lockCoordinator = new recordLockCoordinator_ts_1.LockCoordinator({
+                    database: databaseName,
+                    table: tableName,
+                    nodeId: (0, nodeName_ts_1.getThisNodeName)(),
+                    transport,
+                    adopt: predecessor,
+                    // Writing to the local transaction log IS the send, so a transport that only computes
+                    // the participant set gets core's writer.
+                    writeControl: transport.writeControl
+                        ? (entry) => transport.writeControl(tableName, entry)
+                        : (entry) => _a.writeLockControlEntry(entry),
+                    keyIdOf: DatabaseTransaction_ts_1.writeKeyId,
+                    nextTimestamp: () => primaryStore.getMonotonicTimestamp(),
+                    grantableAfterMono: transport.grantableAfterMono,
+                });
+                predecessor?.close();
+            }
+            return lockCoordinator;
+        }
         // #section: validation
         validate(record, patch) {
             // Accumulate structured per-field issues so the 400 carries `{ path, code,
@@ -4631,6 +5932,7 @@ function makeTable(options) {
             return this.#version;
         }
         static async addAttributes(attributesToAdd) {
+            _a.assertSchemaMutable('add attributes');
             const new_attributes = attributes.slice(0);
             for (const attribute of attributesToAdd) {
                 if (!attribute.name)
@@ -4646,9 +5948,10 @@ function makeTable(options) {
                 schemaDefined,
                 attributes: new_attributes,
             });
-            return TableResource.indexingOperation;
+            return _a.indexingOperation;
         }
         static async removeAttributes(names) {
+            _a.assertSchemaMutable('remove attributes');
             const new_attributes = attributes.filter((attribute) => !names.includes(attribute.name));
             (0, databases_ts_1.table)({
                 table: tableName,
@@ -4656,7 +5959,7 @@ function makeTable(options) {
                 schemaDefined,
                 attributes: new_attributes,
             });
-            return TableResource.indexingOperation;
+            return _a.indexingOperation;
         }
         /**
          * Get the size of the table in bytes (based on amount of pages stored in the database)
@@ -4669,6 +5972,10 @@ function makeTable(options) {
             const stats = primaryStore.getStats();
             return (stats.treeBranchPageCount + stats.treeLeafPageCount + stats.overflowPages) * stats.pageSize;
         }
+        /** Sizes of this table's durable record-structure dictionaries. */
+        static getStructureCounts() {
+            return primaryStore.encoder?.getStructureCounts?.();
+        }
         static getAuditSize() {
             const stats = auditStore?.getStats();
             return (stats &&
@@ -4687,7 +5994,7 @@ function makeTable(options) {
             // iterate through the metadata entries to exclude their count and exclude the deletion counts
             const exactCount = options?.exactCount;
             const TIME_LIMIT = options?.timeLimit ?? 1000 / 2; // one second time limit, enforced by seeing if we are halfway through at 500ms
-            const start = performance.now();
+            const start = node_perf_hooks_1.performance.now();
             let entryCount = 0;
             let remainderPhysical = 0;
             let estimator;
@@ -4711,7 +6018,7 @@ function makeTable(options) {
                 // a table too small to reach the floor is small enough to finish exactly
                 if (exactCount || entriesScanned < MIN_ESTIMATOR_SAMPLE)
                     continue;
-                const now = performance.now();
+                const now = node_perf_hooks_1.performance.now();
                 if (now <= nextCheckAt)
                     continue;
                 nextCheckAt = now + TIME_LIMIT;
@@ -4877,6 +6184,7 @@ function makeTable(options) {
             // Refresh on every call: schema reload mutates `attributes` in place, so the
             // class-construction snapshot would otherwise go stale.
             this.embedAttributes = this.attributes.filter((a) => a?.embed);
+            expiresAtProperty = this.attributes.find((attribute) => attribute.expiresAt);
             // Drop registry entries for attributes that are no longer `@embed`, so a dropped
             // directive doesn't leave a stale embedder or block a default refresh on re-add.
             const embedNames = new Set(this.embedAttributes.map((a) => a.name));
@@ -4925,7 +6233,7 @@ function makeTable(options) {
                 const computed = attribute.computed;
                 // Register the default embedder unless an author override is set. Sits outside
                 // the resolver chain below so `@embed` fields still flow through auto-HNSW indexing.
-                if (attribute.embed && !TableResource.userSetEmbedders.has(attribute.name)) {
+                if (attribute.embed && !_a.userSetEmbedders.has(attribute.name)) {
                     this.userEmbedders[attribute.name] = (0, embedHook_ts_1.createDefaultEmbedder)(attribute.embed);
                 }
                 if (relationship) {
@@ -4943,7 +6251,7 @@ function makeTable(options) {
                                 const id = object[relationship.from ? relationship.from : primaryKey];
                                 const relatedTable = attribute.elements.definition.tableClass;
                                 if (returnEntry) {
-                                    return (0, search_ts_1.searchByIndex)({ attribute: relationship.to, value: id }, txnForContext(context).getReadTxn(), false, relatedTable, false).map((entry) => {
+                                    return (0, search_ts_1.searchByIndex)({ attribute: relationship.to, value: id }, txnForContext(context).getReadTxn(), false, relatedTable, { allowFullScan: false }).map((entry) => {
                                         if (entry && entry.key !== undefined)
                                             return entry;
                                         return relatedTable.primaryStore.getEntry(entry, {
@@ -4991,7 +6299,7 @@ function makeTable(options) {
                                     const options = { transaction: txnForContext(context).getReadTxn() };
                                     const results = normalizedIds.map((id) => {
                                         const value = store[method](id, options);
-                                        if (TableResource.loadAsInstance === false)
+                                        if (_a.loadAsInstance === false)
                                             freezeRecord(returnEntry ? value?.value : value);
                                         return value;
                                     });
@@ -5000,7 +6308,7 @@ function makeTable(options) {
                                 const value = definition.tableClass.primaryStore[returnEntry ? 'getEntry' : 'getSync'](ids, {
                                     transaction: txnForContext(context).getReadTxn(),
                                 });
-                                if (TableResource.loadAsInstance === false)
+                                if (_a.loadAsInstance === false)
                                     freezeRecord(returnEntry ? value?.value : value);
                                 return value;
                             };
@@ -5155,30 +6463,99 @@ function makeTable(options) {
             this.userSetEmbedders.add(attribute_name);
         }
         static async deleteHistory(endTime = 0, cleanupDeletedRecords = false) {
-            let completion;
+            const maxConcurrentRemovals = isRocksDB ? MAX_CONCURRENT_HISTORY_REMOVALS : MAX_CONCURRENT_LMDB_HISTORY_REMOVALS;
+            const inFlightRemovals = new Set();
+            const removalSlotWaiters = [];
+            let removalsAttempted = 0;
+            let removalsSucceeded = 0;
+            let firstRemovalError;
+            function startRemoval(remove, errorMessage, onSuccess) {
+                removalsAttempted++;
+                const removal = new Promise((resolve) => resolve(remove()))
+                    .then(() => {
+                    removalsSucceeded++;
+                    onSuccess?.();
+                }, (error) => {
+                    // capture before logging: a throwing logger must not cost us the error we may rethrow
+                    if (firstRemovalError === undefined)
+                        firstRemovalError = error;
+                    harper_logger_ts_1.default.warn(errorMessage, error);
+                })
+                    .catch(() => undefined)
+                    .finally(() => {
+                    inFlightRemovals.delete(removal);
+                    removalSlotWaiters.shift()?.();
+                });
+                inFlightRemovals.add(removal);
+            }
+            function queueRemoval(remove, errorMessage, onSuccess) {
+                if (inFlightRemovals.size >= maxConcurrentRemovals) {
+                    return new Promise((resolve) => {
+                        removalSlotWaiters.push(resolve);
+                    }).then(() => startRemoval(remove, errorMessage, onSuccess));
+                }
+                startRemoval(remove, errorMessage, onSuccess);
+            }
+            const drainRemovals = () => Promise.all(inFlightRemovals);
             let entriesDeleted = 0;
-            for (const auditRecord of auditStore.getRange({
-                start: 0,
-                end: endTime,
-            })) {
-                await rest(); // yield to other async operations
-                if (auditRecord.tableId !== tableId)
-                    continue;
-                completion = (0, auditStore_ts_1.removeAuditEntry)(auditStore, auditRecord);
-                entriesDeleted++;
+            // LMDB only: RocksTransactionLogStore.remove() is a no-op, so a RocksDB deleteHistory removes
+            // nothing and must not claim it did.
+            // A bound above everything reachable must not be recorded as the floor: the floor only rises
+            // and a store with a record is never re-stamped, so it would never come down, for every table in
+            // this database. `boundedAuditPruneEnd` clamps the cutoff to just above the newest key in the
+            // log, and the scan below uses that same value as its range end, so the prune cannot remove an
+            // entry the floor does not cover.
+            let pruneEnd = endTime;
+            if (!isRocksDB) {
+                pruneEnd = (0, auditStore_ts_1.boundedAuditPruneEnd)(auditStore, endTime);
+                (0, auditStore_ts_1.raiseAuditFloor)(auditStore, pruneEnd);
+            }
+            try {
+                for (const auditRecord of auditStore.getRange({
+                    // must not be zero: 0 encodes to all zero bytes and so overlaps the symbol keys, as in
+                    // getHistory below
+                    start: 1,
+                    end: pruneEnd,
+                })) {
+                    await rest(); // yield to other async operations
+                    if (auditRecord.tableId !== tableId)
+                        continue;
+                    const backpressure = queueRemoval(() => (0, auditStore_ts_1.removeAuditEntry)(auditStore, auditRecord), 'Error removing audit entry during deleteHistory', () => {
+                        entriesDeleted++;
+                    });
+                    if (backpressure)
+                        await backpressure;
+                }
+            }
+            finally {
+                await drainRemovals();
             }
             if (cleanupDeletedRecords) {
                 // this is separate procedure we can do if the records are not being cleaned up by the audit log. This shouldn't
                 // ever happen, but if there are cleanup failures for some reason, we can run this to clean up the records
-                for (const entry of primaryStore.getRange({ start: 0, versions: true })) {
-                    const { value, localTime } = entry;
-                    await rest(); // yield to other async operations
-                    if (value === null && localTime < endTime) {
-                        completion = (0, RecordEncoder_ts_1.removeEntry)(primaryStore, entry);
+                try {
+                    for (const entry of primaryStore.getRange({ start: 0, versions: true })) {
+                        const { key, value, localTime, version } = entry;
+                        await rest(); // yield to other async operations
+                        const auditTime = isRocksDB && version != null
+                            ? resolveAuditHead(key, version, entry.nodeId, entry.additionalAuditRefs).txnLogKey
+                            : localTime;
+                        if (value === null && version != null && auditTime < pruneEnd) {
+                            const backpressure = queueRemoval(() => primaryStore.remove(key, version), 'Error removing deleted record during deleteHistory');
+                            if (backpressure)
+                                await backpressure;
+                        }
                     }
                 }
+                finally {
+                    await drainRemovals();
+                }
+            }
+            if (removalsAttempted > 0 && removalsSucceeded === 0) {
+                // zero progress must not report the same success as "nothing was eligible" (see DESIGN.md);
+                // partial failures stay best-effort, logged and excluded from the returned count
+                throw firstRemovalError ?? new Error('Every removal attempted during deleteHistory failed');
             }
-            await completion;
             return entriesDeleted;
         }
         static async *getHistory(startTime = 0, endTime = Infinity) {
@@ -5187,14 +6564,15 @@ function makeTable(options) {
                 end: endTime,
             })) {
                 await rest(); // yield to other async operations
-                if (auditRecord.tableId !== tableId)
+                if (auditRecord.tableId !== tableId || auditRecord.type === 'evict' || (0, auditStore_ts_1.isLockControlType)(auditRecord.type))
                     continue;
                 yield {
                     id: auditRecord.recordId,
-                    localTime: auditRecord.version,
+                    // Compatibility-facing LMDB history has always reported/grouped by record version.
+                    localTime: isRocksDB ? auditRecord.txnLogKey : auditRecord.version,
                     version: auditRecord.version,
                     type: auditRecord.type,
-                    value: auditRecord.getValue(primaryStore, true, auditRecord.version),
+                    value: auditRecord.getValue(primaryStore, true, auditRecord.txnLogKey),
                     user: auditRecord.user,
                     operation: auditRecord.originatingOperation,
                 };
@@ -5207,7 +6585,9 @@ function makeTable(options) {
             const entry = primaryStore.getEntry(id);
             if (!entry)
                 return history;
-            let nextVersion = entry.localTime;
+            let nextVersion = isRocksDB
+                ? resolveAuditHead(id, entry.version, entry.nodeId, entry.additionalAuditRefs).txnLogKey
+                : entry.localTime;
             if (!nextVersion)
                 throw new Error('The entry does not have a local audit time');
             const count = 0;
@@ -5218,20 +6598,26 @@ function makeTable(options) {
                 let highestPreviousVersion = 0;
                 const start = nextVersion - auditWindow;
                 for (const auditRecord of auditStore.getRange({ start, end: nextVersion + 0.001 })) {
-                    if (auditRecord.tableId === tableId && (0, ordered_binary_1.compareKeys)(auditRecord.recordId, id) === 0) {
+                    if (auditRecord.tableId === tableId &&
+                        auditRecord.type !== 'evict' &&
+                        !(0, auditStore_ts_1.isLockControlType)(auditRecord.type) &&
+                        (0, ordered_binary_1.compareKeys)(auditRecord.recordId, id) === 0) {
                         history.splice(insertionPoint, 0, {
                             id: auditRecord.recordId,
-                            localTime: auditRecord.version,
+                            localTime: isRocksDB ? auditRecord.txnLogKey : auditRecord.version,
                             version: auditRecord.version,
                             type: auditRecord.type,
-                            // reconstruct each entry's record image as of its own version, not the audit
+                            // reconstruct each entry's record image as of its own log position, not the audit
                             // window boundary (nextVersion), matching getHistory (issue #1330)
-                            value: auditRecord.getValue(primaryStore, true, auditRecord.version),
+                            value: auditRecord.getValue(primaryStore, true, auditRecord.txnLogKey),
                             user: auditRecord.user,
                             operation: auditRecord.originatingOperation,
                         });
-                        if (auditRecord.previousVersion > highestPreviousVersion && auditRecord.previousVersion < start) {
-                            highestPreviousVersion = auditRecord.previousVersion;
+                        const previousVersion = isRocksDB
+                            ? resolveAuditHead(id, auditRecord.previousVersion, auditRecord.previousNodeId, auditRecord.previousAdditionalAuditRefs).txnLogKey
+                            : auditRecord.previousVersion;
+                        if (previousVersion > highestPreviousVersion && previousVersion < start) {
+                            highestPreviousVersion = previousVersion;
                         }
                     }
                 }
@@ -5246,17 +6632,26 @@ function makeTable(options) {
             const promises = [primaryStore.clear()];
             for (const key in indices) {
                 const index = indices[key];
+                index.customIndex?.resetDerivedStorage?.();
                 promises.push(index.clearAsync ? index.clearAsync() : index.clear());
             }
             return Promise.all(promises);
         }
+        /** Release everything makeTable() registered process-wide; the class must not be used afterwards. */
         static cleanup() {
+            disposed = true;
+            void _a.derivedIndexRuntime?.close();
+            clearTimeout(cleanupTimer);
+            settlePendingCleanup();
+            clearInterval(recordExpirationInterval);
             deleteCallbackHandle?.remove();
+            (0, storageReclamation_ts_1.removeStorageReclamationHandler)(primaryStore.path, reclamationHandler);
         }
         static _readTxnForContext(context) {
             return txnForContext(context).getReadTxn();
         }
     }
+    _a = TableResource;
     const throttledCallToSource = (0, throttle_ts_1.throttle)(async (source, id, sourceContext, existingEntry) => {
         // call the data source if it exists and will fulfill our request for data
         if (source && source.get && (!source.get.reliesOnPrototype || source.prototype.get)) {
@@ -5270,11 +6665,24 @@ function makeTable(options) {
     }, () => {
         throw new hdbError_ts_1.ServerError('Service unavailable, exceeded request queue limit for resolving cache record', 503);
     });
-    TableResource.updatedAttributes(); // on creation, update accessors as well
-    if (expirationMs)
-        TableResource.setTTLExpiration(expirationMs / 1000);
-    if (expiresAtProperty)
-        runRecordExpirationEviction();
+    try {
+        TableResource.updatedAttributes(); // on creation, update accessors as well
+        if (expirationMs) {
+            ttlFromLoad = true;
+            try {
+                TableResource.setTTLExpiration(expirationMs / 1000);
+            }
+            finally {
+                ttlFromLoad = false;
+            }
+        }
+        if (expiresAtProperty && !recordExpirationInterval)
+            runRecordExpirationEviction();
+    }
+    catch (error) {
+        TableResource.cleanup();
+        throw error;
+    }
     return TableResource;
     function updateIndices(id, existingRecord, record, options) {
         let hasChanges;
@@ -5701,6 +7109,22 @@ function makeTable(options) {
             return transaction;
         }
     }
+    /**
+     * Detach an unsaved TransactionWrite that a scoped lock() eagerly staged (see #reloadLocked)
+     * once its handle upgrades to hold: hold staging is deferred and explicit-save-only, so a
+     * dangling scoped write would otherwise auto-commit at the transaction sweep and clobber
+     * whatever the hold write lands. Marking it .dropped lets a later save() on the instance that
+     * owns it (checked via #savingOperation === this write) fall through to the hold branch
+     * instead of resolving a detached, dead reference.
+     */
+    function detachScopedUpgradeWrite(link, keyId, handle) {
+        for (const write of link.writes) {
+            if (write && !write.saved && write.lockHandle === handle && (0, DatabaseTransaction_ts_1.writeKeyId)(write.key) === keyId) {
+                write.dropped = true;
+                link.detachWrite(write);
+            }
+        }
+    }
     function getAttributeValue(entry, attribute_name, context, sort) {
         if (!entry) {
             return;
@@ -5818,6 +7242,10 @@ function makeTable(options) {
     async function getFromSource(source, id, existingEntry, context, target) {
         const metadataFlags = existingEntry?.metadataFlags;
         const existingVersion = existingEntry?.version;
+        const existingRecord = existingEntry?.value;
+        const inheritedTimestamp = context?.timestamp || context?.transaction?.timestamp;
+        const sourceTimestamp = inheritedTimestamp ||
+            (isRocksDB ? primaryStore.getMonotonicTimestamp() : (0, commonUtility_ts_1.getNextMonotonicTime)());
         let whenResolved, timer;
         // We start by locking the record so that there is only one resolution happening at once;
         // if there is already a resolution in process, we want to use the results of that resolution
@@ -5852,10 +7280,8 @@ function makeTable(options) {
         }
         // lock acquired — this request will actually load from source
         setLoadedFromSource(target, true);
-        const existingRecord = existingEntry?.value;
         // it is important to remember that this is _NOT_ part of the current transaction; nothing is changing
-        // with the canonical data, we are simply fulfilling our local copy of the canonical data, but still don't
-        // want a timestamp later than the current transaction
+        // with the canonical data, we are simply fulfilling our local copy of the canonical data.
         // we create a new context for the source, we want to determine the timestamp and don't want to
         // attribute this to the current user
         const sourceContext = {
@@ -5890,15 +7316,36 @@ function makeTable(options) {
             // belt to that suspenders, at the cost of a bounded wait on a merely slow source
             // before the drain's fail-closed timeout below.
             const commitPromise = (0, transaction_ts_1.transaction)(sourceContext, async (_txn) => {
-                const start = performance.now();
-                let updatedRecord;
+                const start = node_perf_hooks_1.performance.now();
+                let updatedRecord, assignCreatedTime, sourceVersion;
                 let hasChanges, invalidated;
                 try {
                     updatedRecord = await throttledCallToSource(source, id, sourceContext, existingEntry);
                     invalidated = metadataFlags & exports.INVALIDATED;
-                    let version = sourceContext.lastModified || (invalidated && existingVersion);
-                    hasChanges = invalidated || version > existingVersion || !existingRecord;
-                    const resolveDuration = performance.now() - start;
+                    const reportedVersion = sourceContext.lastModified;
+                    const validReportedVersion = typeof reportedVersion === 'number' &&
+                        Number.isFinite(reportedVersion) &&
+                        reportedVersion > 0 &&
+                        reportedVersion <= MAX_DATE_TIMESTAMP;
+                    if (validReportedVersion) {
+                        // A record version is also this node's ordering token (precedesExistingVersion), so a
+                        // source-reported version ahead of local time would make every subsequent local write look
+                        // out-of-order and be discarded until wall-clock caught up — freezing the row. Honor what
+                        // the source reports, but never beyond now.
+                        const versionCeiling = Math.max(sourceTimestamp, Date.now());
+                        sourceVersion = Math.min(reportedVersion, versionCeiling);
+                        if (sourceVersion !== reportedVersion) {
+                            logger_ts_1.logger.trace?.(`Capping future source version for ${tableName} id ${id}: ${reportedVersion} -> ${sourceVersion}`);
+                            if (!warnedFutureSourceVersion) {
+                                warnedFutureSourceVersion = true;
+                                logger_ts_1.logger.warn?.(`The source for ${tableName} reported a lastModified ahead of local time (${new Date(reportedVersion).toISOString()}) for id ${id}; capping cached record versions at local time`);
+                            }
+                        }
+                    }
+                    else
+                        sourceVersion = sourceTimestamp;
+                    hasChanges = invalidated || (validReportedVersion && reportedVersion > existingVersion) || !existingRecord;
+                    const resolveDuration = node_perf_hooks_1.performance.now() - start;
                     (0, write_ts_1.recordAction)(resolveDuration, 'cache-resolution', tableName, null, 'success');
                     if (responseHeaders)
                         (0, Headers_ts_1.appendHeader)(responseHeaders, 'Server-Timing', `cache-resolve;dur=${resolveDuration.toFixed(2)}`, true);
@@ -5913,7 +7360,7 @@ function makeTable(options) {
                             if (status === 304) {
                                 // revalidation of our current cached record
                                 updatedRecord = existingRecord;
-                                version = existingVersion;
+                                sourceVersion = existingVersion;
                             }
                             else if (!CACHEABLE_STATUS_CODES.has(status)) {
                                 // non-cacheable status - propagate to client without caching
@@ -5991,10 +7438,14 @@ function makeTable(options) {
                         if (primaryKey && updatedRecord[primaryKey] !== id)
                             updatedRecord[primaryKey] = id;
                     }
+                    assignCreatedTime = createdTimeProperty && updatedRecord?.[createdTimeProperty.name] == null;
                     resolved = true;
+                    const resolvedVersion = isRocksDB && updatedRecord && existingVersion != null
+                        ? Math.max(sourceVersion, existingVersion)
+                        : sourceVersion;
                     const resolvedEntry = {
                         key: id,
-                        version,
+                        version: resolvedVersion,
                         value: updatedRecord,
                         expiresAt: sourceContext.expiresAt,
                         metadataFlags: 0,
@@ -6043,7 +7494,7 @@ function makeTable(options) {
                     catch (settlingError) {
                         reject(error ?? settlingError);
                     }
-                    const resolveDuration = performance.now() - start;
+                    const resolveDuration = node_perf_hooks_1.performance.now() - start;
                     (0, write_ts_1.recordAction)(resolveDuration, 'cache-resolution', tableName, null, 'fail');
                     if (responseHeaders)
                         (0, Headers_ts_1.appendHeader)(responseHeaders, 'Server-Timing', `cache-resolve;dur=${resolveDuration.toFixed(2)}`, true);
@@ -6062,16 +7513,28 @@ function makeTable(options) {
                 const sourceWrite = {
                     key: id,
                     store: primaryStore,
-                    entry: existingEntry,
+                    entry: undefined,
                     nodeName: 'source',
-                    commit: (txnTime, existingEntry, _retry, transaction) => {
+                    commit: (_txnTime, existingEntry, _retry, transaction) => {
                         sourceWrite.skipped = false; // reset on each retry; cleanup happens after commit if still true
-                        if (existingEntry?.version !== existingVersion) {
-                            // don't do anything if the version has changed
+                        const racedVersion = existingEntry?.version;
+                        // A first fill may replace a record that raced it only when its candidate version strictly
+                        // orders after that record. The comparison has to be replica-independent, so a tie leaves the
+                        // raced record in place: precedesExistingVersion() would break the tie with *this* node's
+                        // name, and a fill from a shared source has no node identity of its own, so two replicas
+                        // resolving the same tie could keep different values at the same version.
+                        const replacesRacedRecord = racedVersion == null || sourceVersion > racedVersion;
+                        if (racedVersion !== existingVersion &&
+                            // Revalidations retain exact-CAS semantics; first fills use deterministic ordering.
+                            (existingVersion != null || !updatedRecord || !replacesRacedRecord)) {
+                            logger_ts_1.logger.trace?.(`Discarding resolved record from source with id: ${id}, source version: ${sourceVersion}, current version: ${racedVersion}`);
                             sourceWrite.skipped = true;
                             return;
                         }
-                        updateIndices(id, existingRecord, updatedRecord, transaction && { transaction });
+                        const currentRecord = existingEntry?.value;
+                        const recordVersion = isRocksDB && racedVersion != null ? Math.max(sourceVersion, racedVersion) : sourceVersion;
+                        const txnLogKey = isRocksDB ? transaction?.getTimestamp?.() : recordVersion;
+                        updateIndices(id, currentRecord, updatedRecord, transaction && { transaction });
                         if (updatedRecord) {
                             if (existingEntry) {
                                 context.previousResidency = TableResource.getResidencyRecord(existingEntry.residencyId);
@@ -6082,23 +7545,23 @@ function makeTable(options) {
                             if (updatedTimeProperty) {
                                 updatedRecord[updatedTimeProperty.name] =
                                     updatedTimeProperty.type === 'Date'
-                                        ? new Date(txnTime)
+                                        ? new Date(recordVersion)
                                         : updatedTimeProperty.type === 'String'
-                                            ? new Date(txnTime).toISOString()
-                                            : txnTime;
+                                            ? new Date(recordVersion).toISOString()
+                                            : recordVersion;
                             }
-                            if (createdTimeProperty && updatedRecord[createdTimeProperty.name] == null) {
-                                const existingCreatedTime = existingEntry?.value?.[createdTimeProperty.name];
+                            if (assignCreatedTime) {
+                                const existingCreatedTime = currentRecord?.[createdTimeProperty.name];
                                 if (existingCreatedTime != null) {
                                     updatedRecord[createdTimeProperty.name] = existingCreatedTime;
                                 }
                                 else {
                                     updatedRecord[createdTimeProperty.name] =
                                         createdTimeProperty.type === 'Date'
-                                            ? new Date(txnTime)
+                                            ? new Date(recordVersion)
                                             : createdTimeProperty.type === 'String'
-                                                ? new Date(txnTime).toISOString()
-                                                : txnTime;
+                                                ? new Date(recordVersion).toISOString()
+                                                : recordVersion;
                                 }
                             }
                             const residency = residencyFromFunction(TableResource.getResidency(updatedRecord, context));
@@ -6131,23 +7594,33 @@ function makeTable(options) {
                                 }
                                 residencyId = getResidencyId(residency);
                             }
-                            logger_ts_1.logger.trace?.(`Writing resolved record from source with id: ${id}, timestamp: ${new Date(txnTime).toISOString()}`);
+                            logger_ts_1.logger.trace?.(`Writing resolved record from source with id: ${id}, timestamp: ${new Date(recordVersion).toISOString()}`);
                             // TODO: We are doing a double check for ifVersion that should probably be cleaned out
-                            updateRecord(id, updatedRecord, existingEntry, txnTime, omitLocalRecord ? exports.INVALIDATED : 0, (audit && (hasChanges || omitLocalRecord)) || null, {
+                            const writeAudit = (audit && (hasChanges || omitLocalRecord)) || null;
+                            updateRecord(id, updatedRecord, existingEntry, recordVersion, omitLocalRecord ? exports.INVALIDATED : 0, writeAudit, {
                                 user: sourceContext?.user,
                                 expiresAt: sourceContext.expiresAt,
                                 residencyId,
                                 transaction,
                                 tableToTrack: tableName,
+                                additionalAuditRefs: writeAudit && txnLogKey !== recordVersion ? [{ version: txnLogKey, nodeId: 0 }] : undefined,
                             }, 'put', Boolean(invalidated), auditRecord);
                             // arm the eviction scanner, mirroring the .put() path
                             if (sourceContext.expiresAt)
                                 scheduleCleanup();
                         }
                         else if (existingEntry) {
-                            logger_ts_1.logger.trace?.(`Deleting resolved record from source with id: ${id}, timestamp: ${new Date(txnTime).toISOString()}`);
+                            logger_ts_1.logger.trace?.(`Deleting resolved record from source with id: ${id}, timestamp: ${new Date(recordVersion).toISOString()}`);
                             if (audit || trackDeletes) {
-                                updateRecord(id, null, existingEntry, txnTime, 0, (audit && hasChanges) || null, { user: sourceContext?.user, transaction, tableToTrack: tableName }, 'delete', Boolean(invalidated));
+                                updateRecord(id, null, existingEntry, recordVersion, 0, (audit && hasChanges) || null, {
+                                    user: sourceContext?.user,
+                                    transaction,
+                                    tableToTrack: tableName,
+                                    recordVersion,
+                                    additionalAuditRefs: audit && hasChanges && txnLogKey !== recordVersion
+                                        ? [{ version: txnLogKey, nodeId: 0 }]
+                                        : undefined,
+                                }, 'delete', Boolean(invalidated));
                             }
                             else {
                                 (0, RecordEncoder_ts_1.removeEntry)(primaryStore, existingEntry, existingVersion);
@@ -6230,6 +7703,7 @@ function makeTable(options) {
                     if (hasSourceGet && primaryStore.hasLock(item.key, entry.version))
                         continue; // resolution in progress
                     updateIndices(item.key, entry.value, null, options);
+                    stageDerivedIndexEviction(transaction, item.key, entry.version);
                 }
                 (0, RecordEncoder_ts_1.removeEntry)(primaryStore, entry, options);
                 staged++;
@@ -6307,7 +7781,15 @@ function makeTable(options) {
             },
         };
     }
+    function settlePendingCleanup() {
+        for (const resolve of pendingCleanupResolvers)
+            resolve();
+        pendingCleanupResolvers.clear();
+    }
     function scheduleCleanup(priority) {
+        // a reclamation run may still hold this class's handler after cleanup(); a promise here would never settle
+        if (disposed)
+            return;
         let runImmediately = false;
         if (priority) {
             // run immediately if there is a big increase in priority
@@ -6319,13 +7801,23 @@ function makeTable(options) {
         if (cleanupInterval === lastCleanupInterval && !runImmediately)
             return;
         lastCleanupInterval = cleanupInterval;
-        if ((0, manageThreads_js_1.getWorkerIndex)() === (0, manageThreads_js_1.getWorkerCount)() - 1) {
+        if ((0, manageThreads_js_1.ownsStoreMaintenance)(primaryStore.path) || (ttlConfiguredByApplication && (0, manageThreads_js_1.isDedicatedWorker)())) {
             // run on the last thread so we aren't overloading lower-numbered threads
             if (cleanupTimer)
                 clearTimeout(cleanupTimer);
-            if (!cleanupInterval)
+            if (!cleanupInterval) {
+                // no replacement pass is being scheduled, so nothing is left to settle a superseded one
+                settlePendingCleanup();
                 return;
+            }
+            // This pass adopts the awaiters of the pass whose timer it just cleared: they settle when
+            // this pass's scan completes, so a reclamation run is never told the storage was reclaimed
+            // before any scan ran. It has to run now, though — that run blocks its whole path on the
+            // promise, and the replacement's own slot can be a full interval out.
+            if (pendingCleanupResolvers.size > 0)
+                runImmediately = true;
             return new Promise((resolve) => {
+                pendingCleanupResolvers.add(resolve);
                 const startOfYear = new Date();
                 startOfYear.setMonth(0);
                 startOfYear.setDate(1);
@@ -6338,6 +7830,8 @@ function makeTable(options) {
                     ? Date.now()
                     : Math.ceil((Date.now() - startOfYear.getTime()) / nextInterval) * nextInterval + startOfYear.getTime();
                 const startNextTimer = (nextScheduled) => {
+                    if (disposed)
+                        return;
                     logger_ts_1.logger.trace?.(`Scheduled next cleanup scan at ${new Date(nextScheduled)}`);
                     // noinspection JSVoidFunctionReturnValueUsed
                     cleanupTimer = setTimeout(() => (lastEvictionCompletion = lastEvictionCompletion.then(async () => {
@@ -6346,8 +7840,11 @@ function makeTable(options) {
                         const rootStore = primaryStore.rootStore;
                         if (rootStore.status !== 'open') {
                             clearTimeout(cleanupTimer);
+                            settlePendingCleanup();
                             return;
                         }
+                        // snapshot: an awaiter that arrives during this scan belongs to the pass that supersedes it
+                        const settling = [...pendingCleanupResolvers];
                         const MAX_CLEANUP_CONCURRENCY = 50;
                         const outstandingCleanupOperations = new Array(MAX_CLEANUP_CONCURRENCY);
                         let cleanupIndex = 0;
@@ -6427,7 +7924,10 @@ function makeTable(options) {
                         catch (error) {
                             logger_ts_1.logger.warn?.(`Error in cleanup scan for ${tableName}:`, error);
                         }
-                        resolve(undefined);
+                        for (const settle of settling) {
+                            pendingCleanupResolvers.delete(settle);
+                            settle();
+                        }
                         cleanupPriority = 0; // reset the priority
                     })), Math.min(nextScheduled - Date.now(), hdbTerms_ts_1.MAX_SET_TIMEOUT_MS) // make sure it can fit in 32-bit signed number
                     ).unref(); // don't let this prevent closing the thread
@@ -6438,17 +7938,19 @@ function makeTable(options) {
     }
     function addDeleteRemoval() {
         deleteCallbackHandle = auditStore?.addDeleteRemovalCallback(tableId, primaryStore, (id, version) => {
-            primaryStore.remove(id, version);
+            return primaryStore.remove(id, version);
         });
     }
     function runRecordExpirationEviction() {
         // Periodically evict expired records, searching for records who expiresAt timestamp is before now
-        if ((0, manageThreads_js_1.getWorkerIndex)() === 0) {
+        if ((0, manageThreads_js_1.ownsStoreExpiration)(primaryStore.path) || (ttlConfiguredByApplication && (0, manageThreads_js_1.isDedicatedWorker)())) {
             // we want to run the pruning of expired records on only one thread so we don't have conflicts in evicting
-            setInterval(async () => {
+            recordExpirationInterval = setInterval(async () => {
                 // go through each database and table and then search for expired entries
                 // find any entries that are set to expire before now
-                if (runningRecordExpiration)
+                // updatedAttributes() clears expiresAtProperty when a live redeclaration drops the directive,
+                // and there is nothing left for this interval to scan by
+                if (disposed || runningRecordExpiration || !expiresAtProperty)
                     return;
                 runningRecordExpiration = true;
                 try {