@harperfast/harper 5.3.0-alpha.1 → 5.3.0-beta.1

package/resources/Table.ts

@@ -16,7 +16,7 @@ import { Script } from 'node:vm';
 import { randomUUID } from 'node:crypto';
 import { performance } from 'node:perf_hooks';
 import { getIndexedValues, getNextMonotonicTime } from '../utility/lmdb/commonUtility.ts';
-import { getThisNodeId, exportIdMapping } from './nodeIdMapping.ts';
+import { getThisNodeId, exportIdMapping, getNodeNameForId } from './nodeIdMapping.ts';
 import lodash from 'lodash';
 import { ExtendedIterable, SKIP } from '@harperfast/extended-iterable';
 import type {
@@ -41,6 +41,8 @@ import {
 	isReleasedTransaction,
 	TRANSACTION_STATE,
 	writeKeyId,
+	closeWriteInstance,
+	type WriteGeneration,
 } from './DatabaseTransaction.ts';
 import {
 	acquireRecordKey,
@@ -49,21 +51,27 @@ import {
 	resolveLockOptions,
 	type RecordLockHandle,
 	type RecordLockOptions,
+	type ResolvedRecordLockOptions,
 } from './recordLock.ts';
+import { getThisNodeName } from '../server/nodeName.ts';
 import * as envMngr from '../utility/environment/environmentManager.ts';
 import { addSubscription } from './transactionBroadcast.ts';
 import {
+	DerivedIndexLagError,
 	handleHDBError,
 	ClientError,
 	ServerError,
 	AccessViolation,
 	ValidationError,
 	UpdateAttributesLockTimeoutError,
+	LockUnavailableError,
+	appendErrorContext,
 	type ValidationIssue,
 } from '../utility/errors/hdbError.ts';
 import * as signalling from '../utility/signalling.ts';
 import { SchemaEventMsg, UserEventMsg } from '../server/threads/itc.js';
 import { databases, table } from './databases.ts';
+import { notifyReplicatedApplyFailure } from './replicatedApplyFailure.ts';
 import {
 	searchByIndex,
 	findAttribute,
@@ -76,11 +84,44 @@ import {
 } from './search.ts';
 import { logger } from '../utility/logging/logger.ts';
 import { isStaticResourceInstance } from './staticResourceDispatch.ts';
-import { Addition, assignTrackedAccessors, updateAndFreeze, hasChanges, GenericTrackedObject } from './tracked.ts';
+import {
+	Addition,
+	assignTrackedAccessors,
+	updateAndFreeze,
+	hasChanges,
+	GenericTrackedObject,
+	ASSERT_TRACKED_WRITABLE,
+	GET_TRACKED_WRITE_GENERATION,
+} from './tracked.ts';
 import { transaction, contextStorage } from './transaction.ts';
 import { MAXIMUM_KEY, writeKey, compareKeys } from 'ordered-binary';
-import { getWorkerIndex, getWorkerCount } from '../server/threads/manageThreads.js';
-import { HAS_BLOBS, auditRetention, removeAuditEntry } from './auditStore.ts';
+import {
+	getWorkerIndex,
+	applicationWorkerIndex,
+	ownsStoreMaintenance,
+	ownsStoreExpiration,
+	runsApplicationCodeSingletons,
+	isDedicatedWorker,
+} from '../server/threads/manageThreads.js';
+import {
+	HAS_BLOBS,
+	LOCAL_ONLY,
+	auditRetention,
+	removeAuditEntry,
+	raiseAuditFloor,
+	boundedAuditPruneEnd,
+	isLockControlType,
+} from './auditStore.ts';
+import { derivedIndexWriteRejection, hasDerivedIndexRegistration } from './derivedIndexRegistry.ts';
+import {
+	decodeLockControlPayload,
+	encodeLockControlPayload,
+	getClusterLockTransport,
+	isClusterLockRequired,
+	setLockCoordinatorResolver,
+	LockCoordinator,
+	type LockControlEntry,
+} from './recordLockCoordinator.ts';
 import { buildEmbedBefore, createDefaultEmbedder, type EmbedAttribute, type Embedder } from './models/embedHook.ts';
 import { autoCast, autoCastBooleanStrict } from '../utility/common_utils.ts';
 import {
@@ -146,6 +187,9 @@ type MaybePromise<T> = T | Promise<T>;
 
 const NULL_WITH_TIMESTAMP = new Uint8Array(9);
 NULL_WITH_TIMESTAMP[8] = 0xc0; // null
+const sourceWriteTypes = new Set(['put', 'patch', 'delete', 'publish', 'message', 'invalidate', 'relocate']);
+const isSourceWriteType = (type: string) => sourceWriteTypes.has(type);
+const SOURCE_APPLY_POSITION = Symbol('sourceApplyPosition');
 const UNCACHEABLE_TIMESTAMP = Infinity; // we use this when dynamic content is accessed that we can't safely cache, and this prevents earlier timestamps from change the "last" modification
 const MAX_DATE_TIMESTAMP = 8.64e15;
 const RECORD_PRUNING_INTERVAL = 60000; // one minute
@@ -173,6 +217,20 @@ const MAX_COUNT_PAGE = 10_000;
 // How often the exact-count drain yields to the macrotask queue (must be a power of two for the bit-mask
 // check). Keeps a large scan from monopolizing the event loop without adding a yield per row.
 const COUNT_YIELD_INTERVAL = 2_048;
+// Smallest forward sample `getRecordCount` will extrapolate a record rate from; below it the scan runs
+// to completion and reports an exact count.
+const MIN_ESTIMATOR_SAMPLE = 1_000;
+// Budget intervals the forward scan may spend before it must estimate rather than keep scanning.
+const MAX_ESTIMATE_CHECKPOINTS = 20;
+// A store estimate's `count`, or 0 when the store answered with a shape that cannot be trusted --
+// DESIGN.md's invariant for this API family is that such an answer degrades rather than poisons.
+function usableCount(estimate: any): number {
+	const { count, confidence } = estimate ?? {};
+	// `confidence` needs its own finiteness check, not just the range: `null >= 0 && null <= 1` is true
+	if (!Number.isFinite(count) || count < 0 || !Number.isFinite(confidence) || confidence < 0 || confidence > 1)
+		return 0;
+	return count;
+}
 envMngr.initSync();
 const LMDB_PREFETCH_WRITES = envMngr.get(CONFIG_PARAMS.STORAGE_PREFETCHWRITES);
 const LOCK_TIMEOUT = 10000;
@@ -491,6 +549,24 @@ function contextArgument(context: unknown): any {
 	return resolved instanceof DatabaseTransaction ? { transaction: resolved } : resolved;
 }
 
+/** The cluster round never ran for a node-scoped handle, so no peer ever deferred to it. */
+function scopeViolation(
+	handle: RecordLockHandle,
+	resolved: ResolvedRecordLockOptions,
+	databaseName: string
+): ClientError | undefined {
+	if (resolved.scope !== 'cluster' || handle.clusterTsR !== undefined) return undefined;
+	// The same predicate lock() fails closed on, not the transport alone: a coalesced caller re-checks
+	// this after its wait, and a transport unregistered during that wait leaves the database still
+	// clustered while the lookup answers undefined. Only the implicit Phase 0 case falls through.
+	if (!resolved.scopeRequested && !isClusterLockRequired(databaseName) && !getClusterLockTransport(databaseName))
+		return undefined;
+	return new ClientError(
+		'This transaction already holds a node-scoped lock on this record, so a cluster-scoped lock cannot be taken on top of it',
+		409
+	);
+}
+
 /** Distinguishes bare lock options from a record target (id, URL, {id:...}). */
 function isPlainOptions(value: unknown): boolean {
 	return (
@@ -502,6 +578,18 @@ function isPlainOptions(value: unknown): boolean {
 	);
 }
 
+// Lets a transport push a received control entry straight to the right coordinator without
+// importing Table (which would be a cycle through databases.ts).
+setLockCoordinatorResolver(
+	(database: string, tableName: string) => (databases as any)[database]?.[tableName]?.lockCoordinator,
+	(database: string, tableName: string) => (databases as any)[database]?.[tableName]?.admittingCoordinator,
+	(database: string, tableName: string) => {
+		const Table = (databases as any)[database]?.[tableName];
+		if (typeof Table?.writeLockControlEntry !== 'function') return undefined;
+		return (entry: LockControlEntry) => Table.writeLockControlEntry(entry);
+	}
+);
+
 export function makeTable(options) {
 	const {
 		primaryKey,
@@ -523,6 +611,11 @@ export function makeTable(options) {
 		isBranch,
 	} = options;
 	let { expirationMS: expirationMs, evictionMS: evictionMs, audit, trackDeletes } = options;
+	// Set when the TTL exists only on this thread: either application code configured it at runtime, or
+	// an isolated application's schema was declared here. Hydrating persisted metadata does not set it:
+	// dedicated workers open unrelated shared tables too, whose scan remains owned by the pool.
+	let ttlConfiguredByApplication = false;
+	let ttlFromLoad = false; // true only around the creation-time call below
 	evictionMs ??= 0;
 	// Eviction without explicit expiration means expiration:0. Apply at construction so
 	// describe_all sees it on every worker, not just ones that ran setTTLExpiration.
@@ -532,6 +625,9 @@ export function makeTable(options) {
 	if (!attributes) attributes = [];
 	if (!properties) properties = projectAttributesToProperties(attributes);
 	const updateRecord = recordUpdater(primaryStore, tableId, auditStore);
+	// Created on first cluster-scoped lock() or first arriving control entry, and only while a
+	// transport is registered for this database.
+	let lockCoordinator: LockCoordinator | undefined;
 	let warnedNullSourcePut = false; // latched: one warn per table per worker (see _writeUpdate)
 	let warnedFutureSourceVersion = false; // likewise (see getFromSource)
 	let sourceLoad: any; // if a source has a load function (replicator), record it here
@@ -563,7 +659,7 @@ export function makeTable(options) {
 	let nonPrefetchSequence = 2;
 	let cleanupInterval = 86400000;
 	let cleanupPriority = 0;
-	let lastCleanupInterval: number;
+	let lastCleanupInterval: number | undefined;
 	let cleanupTimer: NodeJS.Timeout;
 	let recordExpirationInterval: NodeJS.Timeout;
 	// a reclamation pass awaits a scheduled cleanup, which only settles from its timer
@@ -746,6 +842,29 @@ export function makeTable(options) {
 		}
 		return { txnLogKey: version, nodeId };
 	}
+	// Canonical-source applies (sourceApply), replay and replication notifications are never shed;
+	// dropping one would advance the source cursor past a write that never landed.
+	function assertDerivedIndexAdmission(options: any, transaction: any) {
+		if (options?.isNotification || transaction?.sourceApply || transaction?.isReplay) return;
+		const reason = derivedIndexWriteRejection(auditStore, tableId);
+		if (reason) throw new DerivedIndexLagError(reason);
+	}
+	function stageDerivedIndexEviction(transaction: RocksTransaction, id: Id, version: number) {
+		if (!hasDerivedIndexRegistration(auditStore, tableId)) return;
+		const nodeId = getThisNodeId(auditStore) ?? 0;
+		auditStore.put(
+			null,
+			{
+				type: 'evict',
+				tableId,
+				recordId: id,
+				version,
+				nodeId,
+				extendedType: LOCAL_ONLY,
+			},
+			{ transaction, nodeId }
+		);
+	}
 	class TableResource<Record extends object = any> extends Resource<Record> {
 		#record: any; // the stored/frozen record from the database and stored in the cache (should not be modified directly)
 		#changes: any; // the changes to the record that have been made (should not be modified directly)
@@ -754,7 +873,17 @@ export function makeTable(options) {
 		#savingOperation?: any; // operation for the record is currently being saved
 		#lockHandle?: RecordLockHandle; // the record lock acquired by lock() — scoped or hold
 		#lockWritable?: boolean; // set by #reloadLocked to let save() stage lock-writable updates
+		#writeGeneration?: WriteGeneration;
 		declare getProperty: (name: string) => any;
+		[ASSERT_TRACKED_WRITABLE](generation = this.#writeGeneration): void {
+			if (!generation) return;
+			if (generation.internalWrites > 0) return;
+			if (generation !== this.#writeGeneration || generation.closed)
+				throw new ClientError('Can not modify an update instance after it has been saved; call update() again', 409);
+		}
+		[GET_TRACKED_WRITE_GENERATION](): WriteGeneration {
+			return (this.#writeGeneration ??= { closed: false, internalWrites: 0 });
+		}
 
 		/**
 		 * Shared guard: if this instance is lock-writable but the handle is gone (expired or
@@ -762,13 +891,15 @@ export function makeTable(options) {
 		 * in addition to the save() path. Every lock-writable instance carries its own handle in
 		 * #lockHandle (scoped and hold alike), so we never need to search the registry here.
 		 */
-		#assertLiveHandle(id: Id): void {
+		#assertLiveHandle(id: Id, allowClosed = false): void {
+			if (!allowClosed && this.#writeGeneration?.closed && writeKeyId(id) === writeKeyId(this.getId()))
+				this[ASSERT_TRACKED_WRITABLE]();
 			if (!this.#lockWritable) return;
 			const handle = this.#lockHandle!;
 			// Off-key writes through the same resource instance are ordinary; only guard the
 			// exact key the lock was acquired for.
 			if (handle.keyId !== writeKeyId(id)) return;
-			if (handle.expired || handle.released) {
+			if (handle.isExpired()) {
 				throw lockNotHeldError(handle);
 			}
 		}
@@ -780,6 +911,13 @@ export function makeTable(options) {
 		static tableName = tableName;
 		static tableId = tableId;
 		static indices = indices;
+		static derivedIndexRuntime:
+			| {
+					close(dropping?: boolean): Promise<void>;
+					restoreAfterFailedDrop?(): typeof TableResource.derivedIndexRuntime;
+					completeDrop?(dropped?: boolean): void;
+			  }
+			| undefined;
 		static audit = audit;
 		static databasePath = databasePath;
 		static databaseName = databaseName;
@@ -866,8 +1004,65 @@ export function makeTable(options) {
 			(async () => {
 				let userRoleUpdate = false;
 				let lastSequenceId;
+				let pendingApplyFailures: Promise<void> | undefined;
+				const reportDroppedWrite = (event, context, error) => {
+					const position =
+						event === context ? context[SOURCE_APPLY_POSITION] : (event.timestamp ?? context[SOURCE_APPLY_POSITION]);
+					const notification = notifyReplicatedApplyFailure(
+						databaseName,
+						{
+							nodeId: event.nodeId ?? context.nodeId,
+							table: event.table ?? context.table,
+							localTime: event.localTime ?? context.localTime,
+						},
+						position,
+						error,
+						tableName
+					);
+					pendingApplyFailures = pendingApplyFailures
+						? Promise.all([pendingApplyFailures, notification]).then(noop)
+						: notification;
+					return notification;
+				};
+				/** Cluster lock coordination entries (harper#483 Phase 1) describe no record. */
+				const applyLockControlEvent = (event, context) => {
+					const entry = decodeLockControlPayload(event.type, event.value);
+					if (!entry) {
+						logger.warn?.('discarding a malformed record lock control entry from', event.nodeId, event.type);
+						return reportDroppedWrite(event, context, new Error('Malformed record lock control entry'));
+					}
+					const target = event.table ? databases[databaseName]?.[event.table] : TableResource;
+					try {
+						// The audit header's nodeId is the origin, translated on receive and preserved across
+						// relays. The payload's own names are peer-supplied and prove nothing. Rebuild the id
+						// map on a miss rather than waiting out the negative-cache window: a dropped release
+						// leaves the key's home holding its grant until the delegation's own deadline, and
+						// control entries are far too rare to drive the store.
+						//
+						// Inside the guard, not before it: that rebuild reads the audit store, and a throw
+						// there would escape this sink and stall the apply loop for every later entry — the §8
+						// rule that a receive boundary settles its callers and keeps admission closed.
+						const author = getNodeNameForId(auditStore, event.nodeId, true);
+						if (!author) {
+							logger.warn?.('discarding a record lock control entry whose origin node could not be resolved');
+							return reportDroppedWrite(event, context, new Error('Record lock control origin could not be resolved'));
+						}
+						// The coordinator getter fails closed on an unusable node identity. That is right for
+						// an acquire and wrong here: rejecting out of this sink stalls the apply loop for
+						// every later entry rather than dropping one.
+						// `admittingCoordinator`, because `lockCoordinator` answers undefined while a transport
+						// is momentarily unregistered — and this sink runs off the replication stream, not off
+						// that transport. Dropping a peer's clean-handoff release there leaves the home holding
+						// its grant for the delegation's whole deadline.
+						target?.admittingCoordinator?.applyEntry(entry, author, event.timestamp);
+					} catch (error) {
+						logger.warn?.('dropping a record lock control entry: the coordinator is unavailable', error);
+						return reportDroppedWrite(event, context, error);
+					}
+				};
 				// perform the write of an individual write event
 				const writeUpdate = async (event, context) => {
+					if (isLockControlType(event.type)) return applyLockControlEvent(event, context);
 					const value = event.value;
 					const Table = event.table ? databases[databaseName][event.table] : TableResource;
 					if (
@@ -899,6 +1094,14 @@ export function makeTable(options) {
 						async: true,
 					};
 					const id = event.id;
+					if (!isSourceWriteType(event.type)) {
+						logger.error?.('Unknown operation', event.type, event.id);
+						const notification = reportDroppedWrite(event, context, new Error('Unknown source operation'));
+						if (event.finished) await event.finished;
+						return notification;
+					}
+					if (Table && event.type === 'put' && value == null && !shouldRevalidateEvents)
+						await reportDroppedWrite(event, context, new Error('Source-applied put has no record content'));
 					const resource: TableResource = await Table.getResource(id, context, options);
 					if (event.finished) await event.finished;
 					switch (event.type) {
@@ -919,13 +1122,18 @@ export function makeTable(options) {
 							return resource._writeInvalidate(id, value, options);
 						case 'relocate':
 							return resource._writeRelocate(id, options);
-						default:
-							logger.error?.('Unknown operation', event.type, event.id);
 					}
 				};
 
 				/** Keeps the writes to any one key in arrival order; see DESIGN.md (harper#2211). */
 				const stageWrite = (event, context) => {
+					// A grant must not queue behind whatever the key it names is doing.
+					if (
+						isLockControlType(event.type) ||
+						!isSourceWriteType(event.type) ||
+						(event.type === 'put' && event.value == null && !shouldRevalidateEvents)
+					)
+						return writeUpdate(event, context);
 					let chainKey: string | undefined;
 					try {
 						const Table = event.table ? databases[databaseName][event.table] : TableResource;
@@ -965,14 +1173,18 @@ export function makeTable(options) {
 						omitCurrent: true,
 					};
 					const subscribeOnThisThread = source.subscribeOnThisThread
-						? source.subscribeOnThisThread(getWorkerIndex(), subscriptionOptions)
-						: getWorkerIndex() === 0;
+						? source.subscribeOnThisThread(applicationWorkerIndex(), subscriptionOptions)
+						: runsApplicationCodeSingletons(); // set up by the defining application's code, so it runs where that code does
 					const subscription = hasSubscribe && subscribeOnThisThread && (await source.subscribe?.(subscriptionOptions));
 					if (subscription) {
 						let txnInProgress;
 						// we listen for events by iterating through the async iterator provided by the subscription
 						for await (const event of subscription) {
+							let failureEvent = event;
+							let failurePosition: number | undefined;
+							let applied = false;
 							try {
+								failurePosition = event?.timestamp;
 								if (!event || typeof event !== 'object') {
 									logger.error?.('Bad subscription event', event);
 									continue;
@@ -980,6 +1192,13 @@ export function makeTable(options) {
 								const firstWrite = event.type === 'transaction' ? event.writes[0] : event;
 								if (!firstWrite) {
 									logger.error?.('Bad subscription event', event);
+									await notifyReplicatedApplyFailure(
+										databaseName,
+										event,
+										failurePosition,
+										new Error('Subscription transaction has no writes'),
+										tableName
+									);
 									continue;
 								}
 								event.source = source;
@@ -988,11 +1207,16 @@ export function makeTable(options) {
 								// there is no re-subscribe / sequence-id-resume path to recover it. Mark the context so the
 								// commit retries such conflicts without a cap (see DatabaseTransaction commit).
 								event.sourceApply = true;
+								event[SOURCE_APPLY_POSITION] = failurePosition;
 								if (event.type === 'end_txn') {
 									// Capture the in-progress transaction in a stable local: the loop variable is reset
 									// once this transaction completes (below), but the seq-id closure and the commit await
 									// still need to reference it afterward.
 									const committingTxn = txnInProgress;
+									if (committingTxn) {
+										failureEvent = committingTxn;
+										failurePosition = committingTxn[SOURCE_APPLY_POSITION];
+									}
 									committingTxn?.resolve();
 									let updateRecordedSequenceId: () => MaybePromise<void>;
 									if (event.localTime && lastSequenceId !== event.localTime) {
@@ -1082,6 +1306,7 @@ export function makeTable(options) {
 									let committed;
 									try {
 										committed = committingTxn ? await committingTxn.committed : undefined;
+										applied = true;
 										if (event.onCommit) {
 											// the onCommit callback can be async and carry associated work (e.g. blob
 											// transfer); wait for it too before recording the sequence id. Pass the commit
@@ -1115,6 +1340,13 @@ export function makeTable(options) {
 											// than rethrow) so the current beginTxn still starts a fresh transaction with
 											// correct boundaries instead of having its writes applied as standalone ones.
 											logger.error?.('source-applied transaction commit failed during apply', error);
+											await notifyReplicatedApplyFailure(
+												databaseName,
+												txnInProgress,
+												txnInProgress[SOURCE_APPLY_POSITION],
+												error,
+												tableName
+											);
 										} finally {
 											// Clear it regardless of outcome so a rejected commit isn't re-awaited on the
 											// next beginTxn (which would brick the apply loop).
@@ -1197,6 +1429,7 @@ export function makeTable(options) {
 										// standalone write: backpressure on the commit before pulling the next event,
 										// and pass the commit resolution through to the callback.
 										const committed = commitResolution ? await commitResolution : undefined;
+										applied = true;
 										await event.onCommit(committed);
 									}
 								} else if (commitResolution && !txnInProgress) {
@@ -1205,6 +1438,14 @@ export function makeTable(options) {
 								}
 							} catch (error) {
 								logger.error?.('error in subscription handler', error);
+								if (!applied)
+									await notifyReplicatedApplyFailure(databaseName, failureEvent, failurePosition, error, tableName);
+							} finally {
+								while (pendingApplyFailures) {
+									const notification = pendingApplyFailures;
+									pendingApplyFailures = undefined;
+									await notification;
+								}
 							}
 						}
 					}
@@ -1498,24 +1739,51 @@ export function makeTable(options) {
 		 * This also informs the scheduling for record eviction.
 		 * @param opts Time in seconds until records expire, or an options object with `expiration`, `eviction`,
 		 * and `scanInterval` (all in seconds, all optional). Number form preserves any previously configured
-		 * eviction/scanInterval; object form replaces all three.
+		 * eviction/scanInterval; object form replaces all three. An internal schema ownership-only call with
+		 * none of those values preserves the settings already loaded from the catalog.
 		 */
-		static setTTLExpiration(opts: number | { expiration?: number; eviction?: number; scanInterval?: number }) {
+		static setTTLExpiration(
+			opts:
+				| number
+				| {
+						expiration?: number;
+						eviction?: number;
+						scanInterval?: number;
+						fromSchema?: boolean;
+						isolatedApplicationOwner?: boolean;
+				  }
+		) {
 			if (opts == null || (typeof opts !== 'number' && typeof opts !== 'object'))
 				throw new Error('Invalid expiration value type');
+			const declaredHere = typeof opts === 'object' && opts.fromSchema;
+			const isolatedApplicationOwner = declaredHere && opts.isolatedApplicationOwner;
+			const preserveLoadedConfiguration =
+				declaredHere && opts.expiration === undefined && opts.eviction === undefined && opts.scanInterval === undefined;
+			if (((!ttlFromLoad && !declaredHere) || isolatedApplicationOwner) && !ttlConfiguredByApplication) {
+				ttlConfiguredByApplication = true;
+				// the scan owner may have changed with this: re-evaluate even if the interval did not
+				lastCleanupInterval = undefined;
+			}
 			if (typeof opts === 'number') {
 				expirationMs = opts * 1000;
-			} else {
+			} else if (!preserveLoadedConfiguration) {
 				// `??` so an explicit 0 is treated as the user's chosen value, not as "missing"
 				expirationMs = (opts.expiration ?? 0) * 1000;
 				evictionMs = (opts.eviction ?? 0) * 1000;
 				cleanupInterval = (opts.scanInterval ?? 0) * 1000;
 			}
 			if (expirationMs < 0) throw new Error('Expiration can not be negative');
-			// default to one quarter of the total expiration+eviction window
-			cleanupInterval = cleanupInterval || (expirationMs + evictionMs) / 4;
-			expirationScanScheduled = true;
-			scheduleCleanup();
+			if (!preserveLoadedConfiguration) {
+				// default to one quarter of the total expiration+eviction window
+				cleanupInterval = cleanupInterval || (expirationMs + evictionMs) / 4;
+				expirationScanScheduled = true;
+			}
+			// Re-evaluate an existing table-level scan after an ownership-only declaration, but do not
+			// create the default daily cleanup timer for a table that has only an @expiresAt field.
+			if (!preserveLoadedConfiguration || expirationScanScheduled || evictionMs) scheduleCleanup();
+			// @expiresAt has its own interval rather than the cleanup timer above. Arm it whenever a live
+			// declaration introduces the attribute, including after this application already claimed TTL.
+			if (expiresAtProperty && !recordExpirationInterval) runRecordExpirationEviction();
 		}
 
 		static getResidencyRecord(id: Id) {
@@ -1622,6 +1890,43 @@ export function makeTable(options) {
 		static async dropTable() {
 			TableResource.assertSchemaMutable('drop a table');
 			const rootStore = primaryStore.rootStore;
+			if (
+				databaseName === databasePath &&
+				rootStore instanceof RocksDatabase &&
+				(dbisDb as any).put !== (dbisDb as any).putSync
+			)
+				throw new Error(
+					`Cannot drop ${databaseName}.${TableResource.tableName}: the catalog store's put is asynchronous, so the drop tombstone cannot be made durable before the column families are dropped`
+				);
+			// Release post-commit derived-index delivery before any destructive work: the runner's
+			// backend must have quiesced before its stores and native file are destroyed, and a
+			// same-name recreate must not race an owner still applying to the old generation.
+			const derivedIndexRuntime = TableResource.derivedIndexRuntime;
+			const restoreDerivedIndexesAfterFailedDrop = () => {
+				try {
+					TableResource.derivedIndexRuntime = derivedIndexRuntime?.restoreAfterFailedDrop?.();
+				} catch (restoreError) {
+					TableResource.derivedIndexRuntime = undefined;
+					logger.error?.(
+						`Could not restore derived indexes after failed drop of ${databaseName}.${TableResource.tableName}`,
+						restoreError
+					);
+				}
+			};
+			try {
+				await derivedIndexRuntime?.close(true);
+			} catch (error) {
+				restoreDerivedIndexesAfterFailedDrop();
+				throw error;
+			}
+			const abortStaleDrop = () => {
+				derivedIndexRuntime?.completeDrop?.(false);
+				TableResource.derivedIndexRuntime = undefined;
+				TableResource.cleanup();
+				if (databases[databaseName]?.[tableName] === TableResource) delete databases[databaseName][tableName];
+			};
+			let dropIdentityConfirmed = databaseName !== databasePath;
+			let primaryCatalogKey = TableResource.tableName + '/';
 			if (databaseName === databasePath) {
 				// Persist a drop tombstone on the primary catalog entry BEFORE any
 				// destructive work. If the process dies or a column family drop fails
@@ -1629,10 +1934,19 @@ export function makeTable(options) {
 				// the next startup (or a same-name create) completes the drop via
 				// completeInterruptedDrop in databases.ts instead of resurrecting
 				// the table.
-				const primaryCatalogKey = TableResource.tableName + '/';
+				let tombstoneWrite: any;
 				const writeTombstone = () => {
-					const primaryMeta = (dbisDb as any).getSync(primaryCatalogKey);
-					if (!primaryMeta || primaryMeta.dropping) return;
+					let primaryMeta = (dbisDb as any).getSync(primaryCatalogKey);
+					if (!primaryMeta && primaryKey) {
+						const legacyPrimaryKey = `${TableResource.tableName}/${primaryKey}`;
+						const legacyPrimaryMeta = (dbisDb as any).getSync(legacyPrimaryKey);
+						if (legacyPrimaryMeta?.isPrimaryKey) {
+							primaryCatalogKey = legacyPrimaryKey;
+							primaryMeta = legacyPrimaryMeta;
+						}
+					}
+					if (!primaryMeta || (primaryMeta.tableId != null && primaryMeta.tableId !== tableId)) return false;
+					if (primaryMeta.dropping) return true;
 					primaryMeta.dropping = true;
 					// Stamps this drop's identity so the interrupted-drop retry budget in
 					// databases.ts can be scoped to THIS drop rather than the table name: a
@@ -1642,30 +1956,34 @@ export function makeTable(options) {
 					// the budget by generation instead makes the new drop's tombstone carry
 					// its own fresh key regardless of what any worker last observed.
 					primaryMeta.dropGeneration = randomUUID();
-					return (dbisDb as any).put(primaryCatalogKey, primaryMeta);
+					tombstoneWrite = (dbisDb as any).put(primaryCatalogKey, primaryMeta);
+					return true;
 				};
-				if (rootStore instanceof RocksDatabase) {
-					// withUpdateAttributesLock's locked section cannot be held across an await, so a durable
-					// tombstone depends on put being rebound to putSync for RocksDB primary stores (see
-					// createOpenDBIObject). Check that BEFORE writing anything: a tombstone left behind by a
-					// refused drop would delete the table on the next load.
-					if ((dbisDb as any).put !== (dbisDb as any).putSync)
-						throw new Error(
-							`Cannot drop ${databaseName}.${TableResource.tableName}: the catalog store's put is asynchronous, so the drop tombstone cannot be made durable before the column families are dropped`
+				try {
+					if (rootStore instanceof RocksDatabase) {
+						// withUpdateAttributesLock's locked section cannot be held across an await, so a durable
+						// tombstone depends on put being rebound to putSync for RocksDB primary stores.
+						dropIdentityConfirmed = withUpdateAttributesLock(
+							rootStore,
+							`drop table '${databaseName}.${TableResource.tableName}'`,
+							writeTombstone
 						);
-					withUpdateAttributesLock(
-						rootStore,
-						`drop table '${databaseName}.${TableResource.tableName}'`,
-						writeTombstone
-					);
-				} else {
-					let tombstoneWrite;
-					rootStore.transactionSync(() => {
-						tombstoneWrite = writeTombstone();
-					});
-					if (typeof tombstoneWrite?.then === 'function') await tombstoneWrite;
+					} else {
+						rootStore.transactionSync(() => {
+							dropIdentityConfirmed = writeTombstone();
+						});
+						if (typeof tombstoneWrite?.then === 'function') await tombstoneWrite;
+					}
+				} catch (error) {
+					restoreDerivedIndexesAfterFailedDrop();
+					throw error;
 				}
 			}
+			if (!dropIdentityConfirmed) {
+				abortStaleDrop();
+				return;
+			}
+			TableResource.derivedIndexRuntime = undefined;
 			// A get() against a sourcedFrom table resolves to its caller before the resolved
 			// record's cache write has committed (see getFromSource) - the write lands "in the
 			// background" for latency reasons. Flip this BEFORE removing the table from the
@@ -1678,7 +1996,7 @@ export function makeTable(options) {
 			// family drops below. If a drop fails past this point the table stays
 			// invisible, and the tombstone guarantees the drop completes on the
 			// next startup (or on a same-name create).
-			delete databases[databaseName][tableName];
+			if (databases[databaseName]?.[tableName] === TableResource) delete databases[databaseName][tableName];
 			// The above stops new source-fill writes from starting, but a write from a get()
 			// that already returned to its caller may still be in flight. Dropping the column
 			// families out from under that write is a genuine invariant violation, not just a
@@ -1709,15 +2027,21 @@ export function makeTable(options) {
 				]);
 				clearTimeout(timer);
 				if (result === timedOut) {
+					derivedIndexRuntime?.completeDrop?.();
 					throw new Error(
 						`dropTable() timed out after ${LOCK_TIMEOUT}ms waiting for ${pending.length} in-flight source-populated cache write(s) on ${tableName} to settle; refusing to drop the column families out from under a write that may still be staged. The drop tombstone is durable, so this will be retried on the next load.`
 					);
 				}
 			}
-			for (const entry of primaryStore.getRange({ versions: true, snapshot: false, lazy: true })) {
-				if (entry.metadataFlags & HAS_BLOBS && entry.value) {
-					deleteBlobsInObject(entry.value);
+			try {
+				for (const entry of primaryStore.getRange({ versions: true, snapshot: false, lazy: true })) {
+					if (entry.metadataFlags & HAS_BLOBS && entry.value) {
+						deleteBlobsInObject(entry.value);
+					}
 				}
+			} catch (error) {
+				derivedIndexRuntime?.completeDrop?.();
+				throw error;
 			}
 			if (databaseName === databasePath) {
 				// part of a database.
@@ -1735,12 +2059,13 @@ export function makeTable(options) {
 				// same-name create completes the interrupted drop and writes fresh
 				// catalog rows, and clobbering those would orphan the new table.
 				const removeTombstonedCatalog = () => {
-					const currentPrimary = (dbisDb as any).getSync(TableResource.tableName + '/');
-					if (!currentPrimary?.dropping) return false;
+					const currentPrimary = (dbisDb as any).getSync(primaryCatalogKey);
+					if (!currentPrimary?.dropping || (currentPrimary.tableId != null && currentPrimary.tableId !== tableId))
+						return false;
 					for (const attribute of attributes) {
 						dbisDb.remove(TableResource.tableName + '/' + attribute.name);
 					}
-					dbisDb.remove(TableResource.tableName + '/');
+					dbisDb.remove(primaryCatalogKey);
 					return true;
 				};
 				if (rootStore instanceof RocksDatabase) {
@@ -1752,47 +2077,88 @@ export function makeTable(options) {
 					// completeInterruptedDrop does), never an awaited drop(), or a
 					// concurrent create's wait would be stuck on a drop that the blocked
 					// event loop can never resolve, burning its full deadline before failing.
-					const removed = withUpdateAttributesLock(rootStore, `table '${databaseName}.${tableName}'`, () => {
-						for (const attribute of attributes) {
-							const index = indices[attribute.name];
-							if (index)
-								try {
-									index.dropSync();
-								} catch (error) {
-									ignoreAlreadyDropped(error);
-								}
-						}
-						try {
-							primaryStore.dropSync();
-						} catch (error) {
-							ignoreAlreadyDropped(error);
-						}
-						return removeTombstonedCatalog();
-					});
-					if (removed) await dbisDb.committed;
+					let removed: boolean;
+					try {
+						removed = withUpdateAttributesLock(rootStore, `table '${databaseName}.${tableName}'`, () => {
+							const currentPrimary = (dbisDb as any).getSync(primaryCatalogKey);
+							if (!currentPrimary?.dropping || (currentPrimary.tableId != null && currentPrimary.tableId !== tableId))
+								return false;
+							for (const attribute of attributes) {
+								const index = indices[attribute.name];
+								if (index)
+									try {
+										index.customIndex?.resetDerivedStorage?.();
+										index.dropSync();
+									} catch (error) {
+										ignoreAlreadyDropped(error);
+									}
+							}
+							try {
+								primaryStore.dropSync();
+							} catch (error) {
+								ignoreAlreadyDropped(error);
+							}
+							return removeTombstonedCatalog();
+						});
+						if (removed) await dbisDb.committed;
+					} catch (error) {
+						derivedIndexRuntime?.completeDrop?.();
+						throw error;
+					}
+					if (!removed) {
+						abortStaleDrop();
+						return;
+					}
 				} else {
 					// LMDB: no shared column-family double-drop, and its engine lock is
 					// transactional rather than this spin lock, so keep the awaited drop
 					// plus the same tombstone-guarded catalog removal.
-					const drops = [];
-					for (const attribute of attributes) {
-						const index = indices[attribute.name];
-						if (index) drops.push(index.drop().catch(ignoreAlreadyDropped));
+					let removed: boolean;
+					try {
+						const currentPrimary = (dbisDb as any).getSync(primaryCatalogKey);
+						if (!currentPrimary?.dropping || (currentPrimary.tableId != null && currentPrimary.tableId !== tableId)) {
+							abortStaleDrop();
+							return;
+						}
+						const drops = [];
+						for (const attribute of attributes) {
+							const index = indices[attribute.name];
+							if (index) {
+								index.customIndex?.resetDerivedStorage?.();
+								drops.push(index.drop().catch(ignoreAlreadyDropped));
+							}
+						}
+						drops.push(primaryStore.drop().catch(ignoreAlreadyDropped));
+						await Promise.all(drops);
+						removed = removeTombstonedCatalog();
+						if (removed) await dbisDb.committed;
+					} catch (error) {
+						derivedIndexRuntime?.completeDrop?.();
+						throw error;
+					}
+					if (!removed) {
+						abortStaleDrop();
+						throw new Error(
+							`Could not complete drop of ${databaseName}.${tableName}: a replacement table became current while the LMDB stores were being dropped`
+						);
 					}
-					drops.push(primaryStore.drop().catch(ignoreAlreadyDropped));
-					await Promise.all(drops);
-					if (removeTombstonedCatalog()) await dbisDb.committed;
 				}
 			} else {
 				// legacy table per database. The store to retire is this table's own audit store: nothing
 				// assigns `primaryStore.auditStore` — openAuditStore() assigns `rootStore.auditStore`, and
 				// this is the reference makeTable() was handed. Awaited so a pass suspended mid-removal has
 				// released the primary DBI before it is closed and unlinked.
-				await auditStore?.stopAuditCleanup?.();
-				removeStorageReclamation(primaryStore.path);
-				await primaryStore.close();
-				fs.unlinkSync(primaryStore.path);
+				try {
+					await auditStore?.stopAuditCleanup?.();
+					removeStorageReclamation(primaryStore.path);
+					await primaryStore.close();
+					fs.unlinkSync(primaryStore.path);
+				} catch (error) {
+					derivedIndexRuntime?.completeDrop?.();
+					throw error;
+				}
 			}
+			derivedIndexRuntime?.completeDrop?.();
 			signalling.signalSchemaChange(
 				new SchemaEventMsg(process.pid, OPERATIONS_ENUM.DROP_TABLE, databaseName, tableName)
 			);
@@ -1815,8 +2181,7 @@ export function makeTable(options) {
 					records: './', // an href to the records themselves
 					name: tableName,
 					database: databaseName,
-					auditSize:
-						auditStore instanceof RocksDatabase ? auditStore.getKeysCount() : auditStore?.getStats().entryCount,
+					auditSize: auditStore?.getStats().entryCount,
 					attributes,
 					recordCount: undefined,
 					estimatedRecordRange: undefined,
@@ -2054,12 +2419,18 @@ export function makeTable(options) {
 			} else {
 				id = requestTargetToId(target);
 			}
+			if (this.#writeGeneration?.closed) {
+				this.#changes = undefined;
+				this.#writeGeneration = undefined;
+			}
+			this.#assertLiveHandle(id, true);
 
 			const context = this.getContext();
 			const envTxn = txnForContext(context);
 			if (!envTxn) throw new Error('Can not update a table resource outside of a transaction');
 			// record in the list of updating records so it can be written to the database when we commit
-			if (updates === false) {
+			// `false` is the patch-cancel sentinel, not a record root — but only incrementally.
+			if (updates === false && !fullUpdate) {
 				// TODO: Remove from transaction
 				return this;
 			}
@@ -2102,15 +2473,25 @@ export function makeTable(options) {
 					});
 				}
 			}
-			return when(this._writeUpdate(id, this.#changes, fullUpdate), () => this);
+			// Keep absent changes distinguishable from an explicit empty patch: framework-created
+			// post/publish updates do not necessarily mutate or save the instance.
+			// A supplied root must reach validation as itself, not as the staged changes (harper#1298).
+			const recordRoot = updates === undefined ? this.#changes : updates;
+			return when(this._writeUpdate(id, recordRoot, fullUpdate), () => this);
 		}
 
 		/**
 		 * Save any changes into this instance to the current transaction
 		 */
 		save() {
-			this.#assertLiveHandle(this.getId()); // a write through a released or expired lock never lands
 			const operation = this.#savingOperation;
+			if (
+				!this.#lockWritable &&
+				this.#writeGeneration?.closed &&
+				(!operation || operation.writeGeneration === this.#writeGeneration)
+			)
+				return;
+			this.#assertLiveHandle(operation?.key ?? this.getId()); // a write through a released or expired lock never lands
 			if ((!operation || operation.dropped) && this.#lockWritable && this.#lockHandle?.hold) {
 				// A held lock's record stages its update here rather than at lock() time: it is often
 				// written after the acquiring transaction has already completed, which would have
@@ -2122,7 +2503,7 @@ export function makeTable(options) {
 				// released between lock acquisition and this save(), throw 409 rather than silently
 				// committing stale data. Every lock-writable instance carries its own handle.
 				const saveHandle = this.#lockHandle!;
-				if (saveHandle.expired || saveHandle.released) {
+				if (saveHandle.isExpired()) {
 					throw lockNotHeldError(saveHandle);
 				}
 				const changes = this.#changes;
@@ -2170,12 +2551,21 @@ export function makeTable(options) {
 				// resolve before that native commit actually settles. Chain on innerCommit (as the
 				// lock-writable hold branch above already does) so callers awaiting save() see the
 				// write durably land, not just the outer (possibly premature) resolution.
-				const result = this.#saveOperation(operation);
+				let result;
+				try {
+					result = this.#saveOperation(operation);
+				} catch (error) {
+					if (!operation.saved) this.#savingOperation = operation;
+					throw error;
+				}
 				const innerCommit = operation.innerCommit;
 				return innerCommit ? when(innerCommit, () => result) : result;
 			}
 		}
 		#saveOperation(operation: any) {
+			// LMDB validates staged writes at transaction commit, so bind a lazy update to the
+			// generation selected by save() before another update can replace its changes.
+			operation.captureChanges?.();
 			const transaction = txnForContext(this.getContext());
 			const holder = operation.stagedIn;
 			// never-drop-on-conflict lives on the transaction and would not travel with the write, so an
@@ -2195,13 +2585,26 @@ export function makeTable(options) {
 				// merge and index diff would be relative to a record that may never land.
 				operation.priorWrite = undefined;
 				operation.deferSave = false;
-				return when(transaction.addWrite(operation), () => operation.promise ?? operation.result);
+				const result = when(transaction.addWrite(operation), () => operation.promise ?? operation.result);
+				this.#closeWriteChain(operation);
+				return result;
 			}
 			const owner = holder ?? transaction;
-			if (owner.save) return owner.save(operation) || operation.promise || operation.result;
+			if (owner.save) {
+				const result = owner.save(operation) || operation.promise || operation.result;
+				this.#closeWriteChain(operation);
+				return result;
+			}
+		}
+		#closeWriteChain(operation: any) {
+			const owner = operation.stagedIn;
+			for (let write = operation; write && !write.instanceClosed; write = write.priorWrite) {
+				if (write === operation || owner?.ownedWrites?.has(write)) closeWriteInstance(write);
+			}
 		}
 
 		addTo(property: any, value: any) {
+			this[ASSERT_TRACKED_WRITABLE]();
 			if (typeof value === 'number' || typeof value === 'bigint') {
 				if (this.#savingOperation?.fullUpdate)
 					(this as any).set(property, (+this.getProperty(property) || 0) + (value as any));
@@ -2255,6 +2658,7 @@ export function makeTable(options) {
 			const context = this.getContext();
 			checkValidId(id);
 			const transaction = txnForContext(this.getContext());
+			assertDerivedIndexAdmission(options, transaction);
 			const write: any = {
 				key: id,
 				store: primaryStore,
@@ -2262,6 +2666,7 @@ export function makeTable(options) {
 				entry: this.#entry,
 				recordVersion: options?.version,
 				lockHandle: this.#lockHandle && this.#lockHandle.keyId === writeKeyId(id) ? this.#lockHandle : undefined,
+				reloadCommitBase: true,
 				commit: (txnTime, existingEntry, _retry, transaction: any) => {
 					const txnLogKey =
 						isRocksDB && options?.version != null ? (transaction?.getTimestamp?.() ?? txnTime) : txnTime;
@@ -2313,6 +2718,7 @@ export function makeTable(options) {
 			const context = this.getContext();
 			checkValidId(id);
 			const transaction = txnForContext(this.getContext());
+			assertDerivedIndexAdmission(options, transaction);
 			const write: any = {
 				key: id,
 				store: primaryStore,
@@ -2320,6 +2726,7 @@ export function makeTable(options) {
 				entry: this.#entry,
 				recordVersion: options?.version,
 				lockHandle: this.#lockHandle && this.#lockHandle.keyId === writeKeyId(id) ? this.#lockHandle : undefined,
+				reloadCommitBase: true,
 				before:
 					(this.constructor as any).source?.relocate && !(context as any)?.source
 						? (this.constructor as any).source.relocate.bind((this.constructor as any).source, id, undefined, context)
@@ -2428,9 +2835,8 @@ export function makeTable(options) {
 					// if there is a resolution in-progress, abandon the eviction
 					if (primaryStore.hasLock(id, entry.version)) return;
 				}
-				// evictions never go in the audit log, so we can not record a deletion entry for the eviction
-				// as there is no corresponding audit entry and it would never get cleaned up. So we must simply
-				// removed the entry entirely, but first cleanup indices
+				// Eviction is not a canonical delete. Indexed caching tables add a local-only control entry so
+				// their derived indexes can remove the resident projection without exposing a delete event.
 				let lmdbCompletion: MaybePromise<unknown>;
 				if (primaryStore.ifVersion) {
 					// lmdb: the index cleanup and the record removal are both version-guarded optimistic writes.
@@ -2443,6 +2849,7 @@ export function makeTable(options) {
 					lmdbCompletion = Promise.all([indexCleanup, removal]);
 				} else {
 					updateIndices(id, existingRecord, null, options);
+					stageDerivedIndexEviction(transaction as RocksTransaction, id, existingVersion);
 					removeEntry(primaryStore, entry ?? primaryStore.getEntry(id), options);
 				}
 				committed = true;
@@ -2535,13 +2942,29 @@ export function makeTable(options) {
 			}
 			const id = target != null ? requestTargetToId(target as RequestTargetOrId) : this.getId();
 			checkValidId(id);
+			this.#assertLiveHandle(id);
 			const resolved = resolveLockOptions(options);
 			const context = this.getContext();
 			const link = txnForContext(context);
 			const keyId = writeKeyId(id);
+			// Before the re-entrant paths, not after: a transaction that already holds this key
+			// node-scoped would otherwise be handed that handle back for an explicit cluster request,
+			// while the same request on a fresh key fails closed.
+			if (
+				resolved.scope === 'cluster' &&
+				(resolved.scopeRequested || isClusterLockRequired(databaseName)) &&
+				!getClusterLockTransport(databaseName)
+			)
+				return Promise.reject(
+					new LockUnavailableError(
+						`Cluster-scoped record locks are not available on ${databaseName}: no record lock transport is registered`
+					)
+				);
 			const held = this.#lockHandle;
-			if (held && !held.released && !held.expired && held.keyId === keyId) {
+			if (held && !held.isExpired() && held.keyId === keyId) {
 				// Re-entrant: upgrade to hold if requested, then preserve staged changes.
+				const violation = scopeViolation(held, resolved, databaseName);
+				if (violation) return Promise.reject(violation);
 				if (resolved.hold && !held.hold) {
 					held.upgradeToHold(resolved.lease);
 					// The scoped phase eagerly staged a TransactionWrite (see #reloadLocked); hold
@@ -2555,7 +2978,9 @@ export function makeTable(options) {
 				return Promise.resolve(this.#reloadLocked(id, undefined, true));
 			}
 			const scoped = link.recordLockFor(primaryStore, keyId);
-			if (scoped && !scoped.released && !scoped.expired) {
+			if (scoped && !scoped.isExpired()) {
+				const violation = scopeViolation(scoped, resolved, databaseName);
+				if (violation) return Promise.reject(violation);
 				if (resolved.hold && !scoped.hold) {
 					// Upgrade scoped → hold: flip the existing handle object to hold mode so every
 					// instance that already references this handle stays valid.  Retiring and creating a
@@ -2568,6 +2993,17 @@ export function makeTable(options) {
 				// Already held with the same type: re-entrant return. Preserve any staged changes.
 				return Promise.resolve(this.#reloadLocked(id, scoped, true));
 			}
+			// Cluster scope needs a registered transport. An EXPLICIT { scope: 'cluster' } without one is
+			// a caller asking for a guarantee this node cannot make, so it fails closed rather than
+			// silently returning the node-local lock; the default keeps Phase 0 behavior, which is what
+			// a build with no replication has anyway.
+			// The getter fails closed on an unusable node identity, and lock() answers with a promise.
+			let coordinator: LockCoordinator | undefined;
+			try {
+				coordinator = resolved.scope === 'node' ? undefined : TableResource.lockCoordinator;
+			} catch (error) {
+				return Promise.reject(error as Error);
+			}
 			const key = lockAttemptKey(tableId, id);
 			// Coalesce concurrent lock() calls for the same key inside one link so they don't
 			// self-block: Promise.all([T.lock(id), T.lock(id)]) would otherwise have both calls
@@ -2580,6 +3016,10 @@ export function makeTable(options) {
 				// The follower waits on the leader's acquisition, but only for its own timeout.
 				let followerTimer: ReturnType<typeof setTimeout> | undefined;
 				const followerTimedOut = Symbol('follower timeout');
+				// Why the leader failed, so the follower can report that instead of inventing contention
+				// when its own budget runs out. A leader 503 means the guarantee could not be established
+				// at all; retrying is still right (the condition may clear) but 423 at the end is not.
+				let leaderFailure: Error | undefined;
 				const followerStart = Date.now();
 				const followerDeadline = new Promise<never>((_, reject) => {
 					followerTimer = setTimeout(() => reject(followerTimedOut), resolved.timeout).unref();
@@ -2593,14 +3033,25 @@ export function makeTable(options) {
 					if (link.open === TRANSACTION_STATE.CLOSED && !link.saveCommits)
 						throw new ServerError('Transaction was closed while waiting for a record lock', 500);
 					const remaining = resolved.timeout - (Date.now() - followerStart);
-					if (remaining <= 0) throw new ClientError(`Record is locked and was not released in time`, 423);
-					return this.lock(target, { ...resolved, timeout: remaining }) as Promise<any>;
+					if (remaining <= 0)
+						throw leaderFailure ?? new ClientError(`Record is locked and was not released in time`, 423);
+					// Carry the scope only if the caller named it: spreading the resolved options would turn
+					// a defaulted 'cluster' into an explicit one, which is fail-closed when no transport is
+					// registered.
+					return this.lock(target, {
+						lease: resolved.lease,
+						timeout: remaining,
+						hold: resolved.hold,
+						scope: resolved.scopeRequested ? resolved.scope : undefined,
+					}) as Promise<any>;
 				};
 				return Promise.race([pending, followerDeadline]).then(
 					() => {
 						clearTimeout(followerTimer);
 						const acquired = link.recordLockFor(primaryStore, keyId);
-						if (acquired && !acquired.released && !acquired.expired) {
+						if (acquired && !acquired.isExpired()) {
+							const violation = scopeViolation(acquired, resolved, databaseName);
+							if (violation) throw violation;
 							if (resolved.hold && !acquired.hold) {
 								detachScopedUpgradeWrite(link, keyId, acquired);
 								acquired.upgradeToHold(resolved.lease);
@@ -2611,7 +3062,12 @@ export function makeTable(options) {
 					},
 					(error) => {
 						clearTimeout(followerTimer);
+						// A follower that simply ran out of its own wait was waiting on another caller in this
+						// process, which is the contention 423 describes. But if the LEADER failed for a reason
+						// that is not contention, that reason is the true one — keep it and report it if the
+						// retries below also run out, rather than ending on a 423 for a key nobody held.
 						if (error === followerTimedOut) throw new ClientError(`Record is locked and was not released in time`, 423);
+						if (error instanceof LockUnavailableError) leaderFailure = error;
 						return retryOnRemainingBudget();
 					}
 				);
@@ -2625,46 +3081,117 @@ export function makeTable(options) {
 				resolved.lease,
 				resolved.hold
 			);
-			link.registerPendingLock(primaryStore, keyId, pendingPromise);
-			return pendingPromise.then(
-				(handle) => {
-					link.unregisterPendingLock(primaryStore, keyId);
-					if (link.open === TRANSACTION_STATE.CLOSED && !link.saveCommits) {
-						// The transaction was aborted while this call waited; nothing would ever release the handle.
+			const clusterStart = performance.now();
+			// What a follower waits on must span the cluster round and registration, not just the native
+			// acquire. Waking it at the native hand-off leaves it in a window where the key is held but no
+			// handle is registered, so it retries and parks on the leader's own lock for its full timeout
+			// — inside a transaction that cannot finish until it gives up.
+			const acquisition = pendingPromise.then(async (handle) => {
+				const closedWhileWaiting = () => link.open === TRANSACTION_STATE.CLOSED && !link.saveCommits;
+				if (closedWhileWaiting()) {
+					// The transaction was aborted while this call waited; nothing would ever release the handle.
+					handle.release();
+					throw new ServerError('Transaction was closed while waiting for a record lock', 500);
+				}
+				// Anything that fails from here must give the native key back, or it becomes a lock this
+				// caller does not know it owns.
+				// Re-resolved, not the snapshot taken before `acquireRecordKey`: that wait can run the
+				// caller's whole timeout, long enough for harper-pro to register the transport on this
+				// worker. Using the snapshot would take the native key alone and hand back a node-scoped
+				// handle while a peer that already had the transport is granted the same key.
+				try {
+					if (resolved.scope !== 'node') coordinator = TableResource.lockCoordinator ?? coordinator;
+				} catch (error) {
+					// The getter fails closed on an unusable node identity, and that has to reach the caller
+					// the same way it does before the wait. Swallowing it let an implicit cluster lock fall
+					// through to node-local authority — the one outcome failing closed exists to prevent —
+					// because `coordinator` is still whatever it was, including undefined.
+					handle.release();
+					throw error as Error;
+				}
+				if (coordinator) {
+					try {
+						// Not a 423 when the budget is gone, and not a skip either: the native wait can consume
+						// the whole timeout, and `acquire` with no wait left still admits from a live delegation
+						// or a local grant without sending anything. Only if it cannot does the caller learn the
+						// guarantee was unavailable — which is not the same as the key being held.
+						const remaining = Math.max(0, resolved.timeout - (performance.now() - clusterStart));
+						const round = await coordinator.acquire(id, resolved.lease, remaining);
+						// Resolved through the getter rather than captured, so a transport swap between
+						// acquisition and release reaches the coordinator that now owns the delegation.
+						if (
+							!handle.joinClusterRound(round.tsR, resolved.lease, round.mintedMono, () =>
+								TableResource.admittingCoordinator?.release(id, round.admissionId)
+							)
+						) {
+							// The round completed inside its lease but the lease elapsed before the handle
+							// could take it. The coordinator still holds it, and only this call knows the
+							// hold was never handed out.
+							// The getter, not the captured coordinator: after a transport swap the captured one no
+							// longer owns this admission, so releasing through it would be a silent no-op.
+							// `.then`, not `Promise.resolve(release())`: the call can throw synchronously, and that
+							// throw would escape the catch and replace the 423 below with an internal error.
+							Promise.resolve()
+								.then(() => TableResource.admittingCoordinator?.release(id, round.admissionId))
+								.catch(noop);
+							// 503, not 423: the home granted this key to US and the lease elapsed before the handle
+							// could take it, so nobody ever held it. The coordinator classifies the same thing the
+							// same way — see its `timeout` denial.
+							throw new LockUnavailableError(
+								`A cluster record lock on ${databaseName}.${tableName} was granted after its lease had elapsed`
+							);
+						}
+						// A recall must be able to fence a write this handle staged and then unlocked, so
+						// the coordinator needs a way to revoke it — see LockCoordinator.registerAdmission.
+						// The getter again: a swap during the acquisition moved this admission to the
+						// successor, and registering on the predecessor would revoke a handle that is fine.
+						TableResource.admittingCoordinator?.registerAdmission(round.admissionId, () => handle.revokeLease());
+					} catch (error) {
+						handle.release();
+						throw error;
+					}
+					if (closedWhileWaiting()) {
 						handle.release();
 						throw new ServerError('Transaction was closed while waiting for a record lock', 500);
 					}
-					link.registerRecordLock(handle);
-					if (link.saveCommits && (context as any)?.timestamp) handle.noteCandidateFloor((context as any).timestamp);
-					if (link.open === TRANSACTION_STATE.OPEN && !link.saveCommits) {
-						// Explicit transaction() (not ImmediateTransaction): pin the clock to
-						// acquiredAt when no writes have been staged yet.  When writes already
-						// exist, leave the clock alone (ordering is best-effort; write held records
-						// in their own transaction for the guarantee).  ImmediateTransaction is
-						// excluded (saveCommits=true) — its clock is never pinned in lock();
-						// each save() stamps from the handle's committed version floor instead.
-						if (link.writes.length === 0 && !link.timestamp) {
-							link.timestamp = handle.acquiredAt;
-						}
-						if (!resolved.hold && link.transaction) {
-							// Scoped lock: the read snapshot may predate the lock; drop it so the
-							// scope reads what it locked.  Hold locks use acquiredAt directly and
-							// do not update the read snapshot.
-							// The timestamp guard matches DatabaseTransaction's own setTimestamp calls: a
-							// deferred update() write leaves the clock at 0, which rocksdb-js rejects.
-							if (link.writes.length === 0 && link.readTxnsUsed <= 1) {
-								link.releaseReadTxn();
-								link.snapshotFree = true;
-							} else if (link.timestamp) link.transaction.setTimestamp(link.timestamp);
-						}
+				}
+				link.registerRecordLock(handle);
+				if (link.saveCommits && (context as any)?.timestamp) handle.noteCandidateFloor((context as any).timestamp);
+				if (link.open === TRANSACTION_STATE.OPEN && !link.saveCommits) {
+					// Explicit transaction() (not ImmediateTransaction): pin the clock to
+					// acquiredAt when no writes have been staged yet.  When writes already
+					// exist, leave the clock alone (ordering is best-effort; write held records
+					// in their own transaction for the guarantee).  ImmediateTransaction is
+					// excluded (saveCommits=true) — its clock is never pinned in lock();
+					// each save() stamps from the handle's committed version floor instead.
+					if (link.writes.length === 0 && !link.timestamp) {
+						link.timestamp = handle.acquiredAt;
 					}
-					// ImmediateTransaction: no clock pinning in lock(); save() stamps each write
-					// from the committed handle floor for both scoped and hold handles.
+					if (!resolved.hold && link.transaction) {
+						// Scoped lock: the read snapshot may predate the lock; drop it so the
+						// scope reads what it locked.  Hold locks use acquiredAt directly and
+						// do not update the read snapshot.
+						// The timestamp guard matches DatabaseTransaction's own setTimestamp calls: a
+						// deferred update() write leaves the clock at 0, which rocksdb-js rejects.
+						if (link.writes.length === 0 && link.readTxnsUsed <= 1) {
+							link.releaseReadTxn();
+							link.snapshotFree = true;
+						} else if (link.timestamp) link.transaction.setTimestamp(link.timestamp);
+					}
+				}
+				// ImmediateTransaction: no clock pinning in lock(); save() stamps each write
+				// from the committed handle floor for both scoped and hold handles.
+				return handle;
+			});
+			link.registerPendingLock(primaryStore, keyId, acquisition);
+			return acquisition.then(
+				(handle) => {
+					link.unregisterPendingLock(primaryStore, keyId);
 					return this.#reloadLocked(id, handle);
 				},
-				(err) => {
+				(error) => {
 					link.unregisterPendingLock(primaryStore, keyId);
-					throw err;
+					throw error;
 				}
 			);
 		}
@@ -2871,6 +3398,7 @@ export function makeTable(options) {
 			const context = this.getContext();
 			const transaction = txnForContext(context);
 			const replaying = transaction.isReplay === true;
+			assertDerivedIndexAdmission(options, transaction);
 			checkValidId(id);
 			if (fullUpdate && recordUpdate == null && options?.isNotification) {
 				// A source/replication-applied put must carry the record; these applies skip record
@@ -2888,6 +3416,16 @@ export function makeTable(options) {
 				}
 				return;
 			}
+			let captureChanges;
+			if (recordUpdate === undefined) {
+				let captured = false;
+				captureChanges = () => {
+					if (!captured) {
+						captured = true;
+						recordUpdate = this.#changes;
+					}
+				};
+			}
 			const entry = this.#entry ?? primaryStore.getEntry(id, { transaction: transaction.getReadTxn() });
 			const writeToSource = () => {
 				if (!(this.constructor as any).source || (context as any)?.source) return;
@@ -2907,12 +3445,20 @@ export function makeTable(options) {
 				}
 			};
 
+			const receiverId = this.getId();
+			const closesReceiver =
+				!this.isCollection &&
+				!isSearchTarget(receiverId) &&
+				(id === receiverId || writeKeyId(id) === writeKeyId(receiverId));
 			const write: any = {
 				key: id,
 				store: primaryStore,
 				entry,
 				nodeName: (context as any)?.nodeName,
 				fullUpdate,
+				chainsStagedState: true,
+				// copy-apply rows keep their pre-read base: one read per row, healed by the post-copy replay
+				reloadCommitBase: options?.isCopyApply !== true,
 				deferSave: true,
 				// the origin's record version on an applied write; absent for a locally-originated one
 				recordVersion: options?.version,
@@ -2921,8 +3467,10 @@ export function makeTable(options) {
 				// Only attach the hold handle when it covers exactly this key; off-key writes
 				// are ordinary and must not carry an unrelated hold's handle.
 				lockHandle: this.#lockHandle && this.#lockHandle.keyId === writeKeyId(id) ? this.#lockHandle : undefined,
+				writeGeneration: !this.#lockWritable && closesReceiver ? this[GET_TRACKED_WRITE_GENERATION]() : undefined,
+				captureChanges,
 				validate: (txnTime, committedBy = transaction) => {
-					if (!recordUpdate) recordUpdate = this.#changes;
+					write.captureChanges?.();
 					if (fullUpdate || (recordUpdate && hasChanges(this.#changes === recordUpdate ? this : recordUpdate))) {
 						if (!(context as any)?.source) {
 							committedBy.checkOverloaded();
@@ -2973,10 +3521,13 @@ export function makeTable(options) {
 											: txnTime;
 							}
 							if (createdTimeProperty) {
-								if (entry?.value) {
+								// the reloaded commit base, not the pre-read one: a full PUT racing a create
+								// would otherwise stamp a fresh created time over the real one
+								const base = write.entry;
+								if (base?.value) {
 									if (fullUpdate || recordUpdate[createdTimeProperty.name]) {
 										// make sure to retain original created time
-										recordUpdate[createdTimeProperty.name] = entry?.value[createdTimeProperty.name];
+										recordUpdate[createdTimeProperty.name] = base.value[createdTimeProperty.name];
 									}
 								} else {
 									// new entry, set created time
@@ -3495,8 +4046,8 @@ export function makeTable(options) {
 					if (recordToStore && recordToStore.getRecord)
 						throw new Error('Can not assign a record to a record, check for circular references');
 					if (residencyId == undefined) {
-						if (entry?.residencyId)
-							(context as any).previousResidency = TableResource.getResidencyRecord(entry.residencyId);
+						if (existingEntry?.residencyId)
+							(context as any).previousResidency = TableResource.getResidencyRecord(existingEntry.residencyId);
 						const residency = residencyFromFunction(TableResource.getResidency(recordToStore, context));
 						if (residency) {
 							if (!residency.includes(server.hostname)) {
@@ -3736,6 +4287,7 @@ export function makeTable(options) {
 			this.#assertLiveHandle(id);
 			const context = this.getContext();
 			const transaction = txnForContext(context);
+			assertDerivedIndexAdmission(options, transaction);
 			checkValidId(id);
 			const entry = this.#entry ?? primaryStore.getEntry(id, { transaction: transaction.getReadTxn() });
 
@@ -3744,6 +4296,7 @@ export function makeTable(options) {
 				store: primaryStore,
 				entry,
 				chainsStagedState: true,
+				reloadCommitBase: true,
 				nodeName: (context as any)?.nodeName,
 				recordVersion: options?.version,
 				lockHandle: this.#lockHandle && this.#lockHandle.keyId === writeKeyId(id) ? this.#lockHandle : undefined,
@@ -3967,6 +4520,7 @@ export function makeTable(options) {
 			// objects. Entries are small and shallow; the clone is cheap next to the query.
 			conditions = cloneConditions(conditions);
 			let orderAlignedCondition;
+			let syntheticOrderCondition;
 			const filtered = {};
 
 			function prepareConditions(conditions: any[], operator: string) {
@@ -4105,7 +4659,7 @@ export function makeTable(options) {
 							// if it is indexed, we add a pseudo-condition to align with the natural sort order of the index.
 							// the primary key has no secondary index, but the primary store is itself keyed in
 							// primary-key order, so scanning it is already aligned with the sort
-							orderAlignedCondition = { ...sort, comparator: 'sort' };
+							orderAlignedCondition = syntheticOrderCondition = { ...sort, comparator: 'sort' };
 							conditions.push(orderAlignedCondition);
 						} else if (conditions.length === 0 && !target.allowFullScan)
 							throw handleHDBError(
@@ -4116,7 +4670,13 @@ export function makeTable(options) {
 								404
 							);
 					}
-					if (orderAlignedCondition) orderAlignedCondition.descending = Boolean(sort.descending);
+					if (orderAlignedCondition) {
+						orderAlignedCondition.descending = Boolean(sort.descending);
+						if (orderAlignedCondition.maxIndexLagMilliseconds === undefined)
+							orderAlignedCondition.maxIndexLagMilliseconds = sort.maxIndexLagMilliseconds;
+						if (orderAlignedCondition.waitForIndexMilliseconds === undefined)
+							orderAlignedCondition.waitForIndexMilliseconds = sort.waitForIndexMilliseconds;
+					}
 				}
 			}
 			conditions = orderConditions(conditions, operator);
@@ -4135,8 +4695,10 @@ export function makeTable(options) {
 						};
 					}
 				} else {
-					// if we had to add an aligned condition that isn't first, we remove it and do ordering later
-					if (orderAlignedCondition) conditions.splice(conditions.indexOf(orderAlignedCondition), 1);
+					// if we had to add an aligned condition that isn't first, we remove it and do ordering later —
+					// only the one we added; a caller's own condition on the sort attribute is still a filter
+					const syntheticIndex = syntheticOrderCondition ? conditions.indexOf(syntheticOrderCondition) : -1;
+					if (syntheticIndex >= 0) conditions.splice(syntheticIndex, 1);
 					postOrdering = sort;
 				}
 			}
@@ -4182,170 +4744,175 @@ export function makeTable(options) {
 				boundRowFilter || typeof target.vectorFilter === 'function'
 					? { rowFilter: boundRowFilter, vectorFilter: target.vectorFilter }
 					: undefined;
-			const entries = executeConditions(
-				conditions,
-				operator,
-				TableResource,
-				readTxn,
-				target,
-				context,
-				(results: any[], filters: Function[]) => transformToEntries(results, select, context, readTxn, filters),
-				filtered,
-				recordAccess
-			);
-			const ensure_loaded = (target as any).ensureLoaded !== false;
-			// The guards inside executeConditions evaluate the
-			// LOCAL record, but on a caching table transformEntryForSelect may then revalidate an
-			// expired/invalidated row from source and return a DIFFERENT record. The explicit row filter
-			// must hold on the record actually returned, so it is re-checked
-			// there, after materialization (the earlier evaluation stays as a prune that also bounds HNSW
-			// traversal). vectorFilter and condition filters intentionally keep the local-record
-			// semantics all query filters have on caching tables.
-			//
-			// A row that is past its TTL but not yet swept by the background eviction
-			// scan is still physically present. A write that is about to overwrite it
-			// anyway (e.g. the SQL engine locating UPDATE/DELETE targets) needs to see
-			// it as a match — the same leniency a direct by-id put/patch already gets,
-			// since those never run the ensureLoaded-gated freshness check this transform
-			// otherwise applies unconditionally to every read.
-			const includeExpired = (target as any).includeExpired === true;
-			const transformToRecord = TableResource.transformEntryForSelect(
-				select,
-				context,
-				readTxn,
-				filtered,
-				ensure_loaded,
-				true,
-				boundRowFilter,
-				includeExpired,
-				postOrdering
-			);
-			let results = TableResource.transformToOrderedSelect(
-				entries,
-				select,
-				postOrdering,
-				context,
-				readTxn,
-				transformToRecord
-			);
-			const offset = target.offset || 0;
-			const end = target.limit !== undefined ? offset + (target.limit as number) : undefined;
-			// `Prefer: count=` (REST pagination): materialize the requested page and attach a total record
-			// count so the HTTP layer can emit a Content-Range. `exact` drains the full matched set once,
-			// windowing the page in the same pass; `estimated` returns just the page plus a cheap planner/
-			// table estimate. Opt-in only — the default streaming path below is untouched.
-			//
-			// Requires a bounded page AND window. Counting is a pagination feature; both the limit and the
-			// offset must be finite, non-negative integers, the limit no larger than MAX_COUNT_PAGE, and the
-			// window (offset + limit) no larger than MAX_EXACT_COUNT_SCAN. Anything else — a missing/
-			// oversized/non-finite/negative limit or offset (a bare collection GET, limit(Infinity),
-			// limit(foo), limit(-5,10)) or a deep-page window past the scan budget — falls through to the
-			// normal streaming path with no count. This bounds the offset too: without it a huge offset would
-			// postpone the exact guardrail (which only engages past the page) until that offset was scanned.
-			const pageLimit = target.limit as number;
-			if (
-				target.count &&
-				Number.isInteger(pageLimit) &&
-				pageLimit >= 0 &&
-				pageLimit <= MAX_COUNT_PAGE &&
-				Number.isInteger(offset) &&
-				offset >= 0 &&
-				offset + pageLimit <= MAX_EXACT_COUNT_SCAN
-			) {
-				const wantExact = target.count === 'exact';
-				const pageEnd = offset + pageLimit;
-				const countStart = performance.now();
-				// A custom-index (vector/HNSW) traversal returns a bounded, approximate candidate set whose size is
-				// chosen from `minResults` (offset + limit), so `scanned` over it tracks the requested page size, not
-				// the true match count — the same query at limit(5) vs limit(200) would otherwise advertise two
-				// different `count=exact` totals. Any query whose execution touches a custom index is affected: a
-				// custom-index sort (its aligned pseudo-condition lands in `conditions`), a custom-index threshold
-				// filter (an HNSW `lt`/`le` is the same minResults-widened traversal as a sort), or an opaque vector
-				// filter. Report the total as unavailable for those rather than advertising it as count=exact
-				// (mirroring how the estimated branch below bails to null for an opaque row/vector filter). A vector
-				// sort applied as in-memory post-ordering leaves no custom-index condition here and stays exact.
-				const touchesCustomIndex = (conds: any[]): boolean =>
-					conds.some((c: any) => {
-						if (!c) return false;
-						if (c.conditions) return touchesCustomIndex(c.conditions);
-						const attr = Array.isArray(c.attribute) ? c.attribute[0] : (c.attribute ?? c[0]);
-						return typeof attr === 'string' && Boolean(indices[attr]?.customIndex);
-					});
-				const approximateResultSet = typeof target.vectorFilter === 'function' || touchesCustomIndex(conditions);
-				return (async () => {
-					const page: any = [];
-					let scanned = 0;
-					let exact = true;
-					try {
-						for await (const record of results) {
-							if (scanned >= offset && scanned < pageEnd) page.push(record);
-							scanned++;
-							// A store whose async iterator settles synchronously (the common indexed-scan case) would
-							// otherwise let this drain spin as one uninterrupted microtask run, blocking the event loop
-							// for the whole count. Yield to the macrotask queue periodically so concurrent requests and
-							// I/O still make progress during a large exact scan.
-							if ((scanned & (COUNT_YIELD_INTERVAL - 1)) === 0) await new Promise((resolve) => setImmediate(resolve));
-							// The page window [offset, pageEnd) is always collected in full first — the guardrail
-							// only ever abandons the running TOTAL, never truncates the page body.
-							if (scanned >= pageEnd) {
-								// `estimated` needs nothing past the page; an approximate (vector) exact total is going to
-								// be reported unavailable anyway, so don't drain its tail for a number we won't publish.
-								if (!wantExact || approximateResultSet) break;
-								// `exact` keeps counting the tail, bounded by a row cap AND a time budget so a
-								// large match set can't turn a bounded page fetch into an unbounded scan.
-								if (scanned > MAX_EXACT_COUNT_SCAN || performance.now() - countStart > MAX_EXACT_COUNT_MS) {
-									exact = false;
-									break;
+			try {
+				const entries = executeConditions(
+					conditions,
+					operator,
+					TableResource,
+					readTxn,
+					target,
+					context,
+					(results: any[], filters: Function[]) => transformToEntries(results, select, context, readTxn, filters),
+					filtered,
+					recordAccess
+				);
+				const ensure_loaded = (target as any).ensureLoaded !== false;
+				// The guards inside executeConditions evaluate the
+				// LOCAL record, but on a caching table transformEntryForSelect may then revalidate an
+				// expired/invalidated row from source and return a DIFFERENT record. The explicit row filter
+				// must hold on the record actually returned, so it is re-checked
+				// there, after materialization (the earlier evaluation stays as a prune that also bounds HNSW
+				// traversal). vectorFilter and condition filters intentionally keep the local-record
+				// semantics all query filters have on caching tables.
+				//
+				// A row that is past its TTL but not yet swept by the background eviction
+				// scan is still physically present. A write that is about to overwrite it
+				// anyway (e.g. the SQL engine locating UPDATE/DELETE targets) needs to see
+				// it as a match — the same leniency a direct by-id put/patch already gets,
+				// since those never run the ensureLoaded-gated freshness check this transform
+				// otherwise applies unconditionally to every read.
+				const includeExpired = (target as any).includeExpired === true;
+				const transformToRecord = TableResource.transformEntryForSelect(
+					select,
+					context,
+					readTxn,
+					filtered,
+					ensure_loaded,
+					true,
+					boundRowFilter,
+					includeExpired,
+					postOrdering
+				);
+				let results = TableResource.transformToOrderedSelect(
+					entries,
+					select,
+					postOrdering,
+					context,
+					readTxn,
+					transformToRecord
+				);
+				const offset = target.offset || 0;
+				const end = target.limit !== undefined ? offset + (target.limit as number) : undefined;
+				// `Prefer: count=` (REST pagination): materialize the requested page and attach a total record
+				// count so the HTTP layer can emit a Content-Range. `exact` drains the full matched set once,
+				// windowing the page in the same pass; `estimated` returns just the page plus a cheap planner/
+				// table estimate. Opt-in only — the default streaming path below is untouched.
+				//
+				// Requires a bounded page AND window. Counting is a pagination feature; both the limit and the
+				// offset must be finite, non-negative integers, the limit no larger than MAX_COUNT_PAGE, and the
+				// window (offset + limit) no larger than MAX_EXACT_COUNT_SCAN. Anything else — a missing/
+				// oversized/non-finite/negative limit or offset (a bare collection GET, limit(Infinity),
+				// limit(foo), limit(-5,10)) or a deep-page window past the scan budget — falls through to the
+				// normal streaming path with no count. This bounds the offset too: without it a huge offset would
+				// postpone the exact guardrail (which only engages past the page) until that offset was scanned.
+				const pageLimit = target.limit as number;
+				if (
+					target.count &&
+					Number.isInteger(pageLimit) &&
+					pageLimit >= 0 &&
+					pageLimit <= MAX_COUNT_PAGE &&
+					Number.isInteger(offset) &&
+					offset >= 0 &&
+					offset + pageLimit <= MAX_EXACT_COUNT_SCAN
+				) {
+					const wantExact = target.count === 'exact';
+					const pageEnd = offset + pageLimit;
+					const countStart = performance.now();
+					// A custom-index (vector/HNSW) traversal returns a bounded, approximate candidate set whose size is
+					// chosen from `minResults` (offset + limit), so `scanned` over it tracks the requested page size, not
+					// the true match count — the same query at limit(5) vs limit(200) would otherwise advertise two
+					// different `count=exact` totals. Any query whose execution touches a custom index is affected: a
+					// custom-index sort (its aligned pseudo-condition lands in `conditions`), a custom-index threshold
+					// filter (an HNSW `lt`/`le` is the same minResults-widened traversal as a sort), or an opaque vector
+					// filter. Report the total as unavailable for those rather than advertising it as count=exact
+					// (mirroring how the estimated branch below bails to null for an opaque row/vector filter). A vector
+					// sort applied as in-memory post-ordering leaves no custom-index condition here and stays exact.
+					const touchesCustomIndex = (conds: any[]): boolean =>
+						conds.some((c: any) => {
+							if (!c) return false;
+							if (c.conditions) return touchesCustomIndex(c.conditions);
+							const attr = Array.isArray(c.attribute) ? c.attribute[0] : (c.attribute ?? c[0]);
+							return typeof attr === 'string' && Boolean(indices[attr]?.customIndex);
+						});
+					const approximateResultSet = typeof target.vectorFilter === 'function' || touchesCustomIndex(conditions);
+					return (async () => {
+						const page: any = [];
+						let scanned = 0;
+						let exact = true;
+						try {
+							for await (const record of results) {
+								if (scanned >= offset && scanned < pageEnd) page.push(record);
+								scanned++;
+								// A store whose async iterator settles synchronously (the common indexed-scan case) would
+								// otherwise let this drain spin as one uninterrupted microtask run, blocking the event loop
+								// for the whole count. Yield to the macrotask queue periodically so concurrent requests and
+								// I/O still make progress during a large exact scan.
+								if ((scanned & (COUNT_YIELD_INTERVAL - 1)) === 0) await new Promise((resolve) => setImmediate(resolve));
+								// The page window [offset, pageEnd) is always collected in full first — the guardrail
+								// only ever abandons the running TOTAL, never truncates the page body.
+								if (scanned >= pageEnd) {
+									// `estimated` needs nothing past the page; an approximate (vector) exact total is going to
+									// be reported unavailable anyway, so don't drain its tail for a number we won't publish.
+									if (!wantExact || approximateResultSet) break;
+									// `exact` keeps counting the tail, bounded by a row cap AND a time budget so a
+									// large match set can't turn a bounded page fetch into an unbounded scan.
+									if (scanned > MAX_EXACT_COUNT_SCAN || performance.now() - countStart > MAX_EXACT_COUNT_MS) {
+										exact = false;
+										break;
+									}
 								}
 							}
+						} finally {
+							// We own the iteration here (no results.onDone consumer), so release the read
+							// transaction unconditionally — including when the drain throws — or the snapshot leaks.
+							txn.doneReadTxn();
 						}
-					} finally {
-						// We own the iteration here (no results.onDone consumer), so release the read
-						// transaction unconditionally — including when the drain throws — or the snapshot leaks.
-						txn.doneReadTxn();
-					}
-					let total: number | null;
-					if (wantExact) {
-						// `scanned` is only an authoritative total when the iteration was exhaustive and deterministic;
-						// an approximate (vector/HNSW) result set is neither, so report the total as unavailable.
-						total = exact && !approximateResultSet ? scanned : null;
-					} else if (boundRowFilter || typeof target.vectorFilter === 'function') {
-						// An opaque row/vector filter shapes the result but isn't reflected in the index/condition
-						// estimate; guessing would both mislead and disclose cardinality the filter hides.
-						total = null;
-					} else if (!hasUserConditions) {
-						total = estimatedEntryCount(primaryStore);
-					} else {
-						// Estimate from the real conditions only — drop the planner's synthetic `sort`
-						// pseudo-condition, which otherwise contributes a bogus (entryCount/2) cardinality.
-						const est = estimateCondition(TableResource)({
-							conditions: conditions.filter((c: any) => c.comparator !== 'sort'),
-							operator: operator ? String(operator).toLowerCase() : 'and',
-						});
-						total = isFinite(est) ? Math.round(est) : null;
-					}
-					// For an estimate, never report a total below the last row actually returned — keeps the
-					// Content-Range valid (start-end/total) when an estimate undershoots a non-empty page.
-					// Exact totals are authoritative (and an empty page past the end must not be clamped up).
-					if (!wantExact && total != null && page.length > 0 && total < offset + page.length) {
-						total = offset + page.length;
-					}
-					page.recordCount = total;
-					page.recordCountExact = wantExact && exact && !approximateResultSet;
-					page.selectApplied = true;
-					page.getColumns = getColumns;
-					return page;
-				})() as any;
-			}
-			// apply any offset/limit after all the sorting and filtering
-			if (target.offset || target.limit !== undefined) results = results.slice(offset, end);
-			results.onDone = () => {
-				results.onDone = null; // ensure that it isn't called twice
+						let total: number | null;
+						if (wantExact) {
+							// `scanned` is only an authoritative total when the iteration was exhaustive and deterministic;
+							// an approximate (vector/HNSW) result set is neither, so report the total as unavailable.
+							total = exact && !approximateResultSet ? scanned : null;
+						} else if (boundRowFilter || typeof target.vectorFilter === 'function') {
+							// An opaque row/vector filter shapes the result but isn't reflected in the index/condition
+							// estimate; guessing would both mislead and disclose cardinality the filter hides.
+							total = null;
+						} else if (!hasUserConditions) {
+							total = estimatedEntryCount(primaryStore);
+						} else {
+							// Estimate from the real conditions only — drop the planner's synthetic `sort`
+							// pseudo-condition, which otherwise contributes a bogus (entryCount/2) cardinality.
+							const est = estimateCondition(TableResource)({
+								conditions: conditions.filter((c: any) => c.comparator !== 'sort'),
+								operator: operator ? String(operator).toLowerCase() : 'and',
+							});
+							total = isFinite(est) ? Math.round(est) : null;
+						}
+						// For an estimate, never report a total below the last row actually returned — keeps the
+						// Content-Range valid (start-end/total) when an estimate undershoots a non-empty page.
+						// Exact totals are authoritative (and an empty page past the end must not be clamped up).
+						if (!wantExact && total != null && page.length > 0 && total < offset + page.length) {
+							total = offset + page.length;
+						}
+						page.recordCount = total;
+						page.recordCountExact = wantExact && exact && !approximateResultSet;
+						page.selectApplied = true;
+						page.getColumns = getColumns;
+						return page;
+					})() as any;
+				}
+				// apply any offset/limit after all the sorting and filtering
+				if (target.offset || target.limit !== undefined) results = results.slice(offset, end);
+				results.onDone = () => {
+					results.onDone = null; // ensure that it isn't called twice
+					txn.doneReadTxn();
+				};
+				results.selectApplied = true;
+				results.getColumns = getColumns;
+				return results;
+			} catch (error) {
 				txn.doneReadTxn();
-			};
-			results.selectApplied = true;
-			results.getColumns = getColumns;
-			return results;
+				throw error;
+			}
 		}
 		/**
 		 * This is responsible for ordering and select()ing the attributes/properties from returned entries
@@ -4368,10 +4935,17 @@ export function makeTable(options) {
 			if (sort) {
 				// there might be some situations where we don't need to transform to entries for sorting, not sure
 				entries = transformToEntries(entries, select, context, readTxn, null);
-				let ordered;
+				// Sort keys are resolved as entries are collected, so comparison never dereferences a record: a
+				// cached entry holds its record only weakly, and a re-read per comparison is what this avoids.
+				const clauses: Sort[] = [];
+				for (let order = sort; order; order = order.next) clauses.push(order);
+				const clauseCount = clauses.length;
 				// if we are doing post-ordering, we need to get records first, then sort them
 				results.iterate = function (options: { async: boolean }) {
-					let sortedArrayIterator: IterableIterator<any>;
+					let ordered: any[];
+					let orderedKeys: any[][];
+					let sortedPositions: number[];
+					let sortedIndex: number;
 					const dbIterator =
 						options?.async && entries[Symbol.asyncIterator]
 							? entries[Symbol.asyncIterator]()
@@ -4381,25 +4955,33 @@ export function makeTable(options) {
 					let enqueuedEntryForNextGroup: any;
 					let lastGroupingValue: any;
 					let firstEntry = true;
-					function createComparator(order: Sort) {
-						const nextComparator = order.next && createComparator(order.next);
-						const descending = order.descending;
-						return (entryA, entryB) => {
-							const a = getAttributeValue(entryA, order.attribute, context, order);
-							const b = getAttributeValue(entryB, order.attribute, context, order);
-							const diff = descending
-								? compareKeys(convertToComparableKeys(b), convertToComparableKeys(a))
-								: compareKeys(convertToComparableKeys(a), convertToComparableKeys(b));
-							if (diff === 0) return nextComparator?.(entryA, entryB) || 0;
-							return diff;
-						};
+					function collect(entry) {
+						ordered.push(entry);
+						for (let i = 0; i < clauseCount; i++) {
+							const clause = clauses[i];
+							orderedKeys[i].push(convertToComparableKeys(getAttributeValue(entry, clause.attribute, context, clause)));
+						}
+					}
+					function comparePositions(positionA: number, positionB: number): number {
+						for (let i = 0; i < clauseCount; i++) {
+							const keys = orderedKeys[i];
+							const diff = clauses[i].descending
+								? compareKeys(keys[positionB], keys[positionA])
+								: compareKeys(keys[positionA], keys[positionB]);
+							if (diff !== 0) return diff;
+						}
+						return 0;
+					}
+					function nextSorted(): IteratorResult<any> {
+						if (sortedIndex < sortedPositions.length)
+							return { done: false, value: ordered[sortedPositions[sortedIndex++]] };
+						return { done: true, value: undefined };
 					}
-					const comparator = createComparator(sort);
 					return {
 						async next() {
 							let iteration: IteratorResult<any>;
-							if (sortedArrayIterator) {
-								iteration = sortedArrayIterator.next();
+							if (sortedPositions) {
+								iteration = nextSorted();
 								if (iteration.done) {
 									if (dbDone) {
 										if (results.onDone) results.onDone();
@@ -4411,7 +4993,9 @@ export function makeTable(options) {
 									};
 							}
 							ordered = [];
-							if (enqueuedEntryForNextGroup) ordered.push(enqueuedEntryForNextGroup);
+							orderedKeys = [];
+							for (let i = 0; i < clauseCount; i++) orderedKeys.push([]);
+							if (enqueuedEntryForNextGroup) collect(enqueuedEntryForNextGroup);
 							// need to load all the entries into ordered
 							do {
 								iteration = await dbIterator.next();
@@ -4442,17 +5026,17 @@ export function makeTable(options) {
 											break;
 										}
 									}
-									// we store the value we will sort on, for fast sorting, and the entry so the records can be GC'ed if necessary
-									// before the sorting is completed
-									ordered.push(entry);
+									collect(entry);
 								}
 							} while (true);
 							if ((sort as any).isGrouped) {
 								// TODO: Return grouped results
 							}
-							ordered.sort(comparator);
-							sortedArrayIterator = ordered[Symbol.iterator]();
-							iteration = sortedArrayIterator.next();
+							sortedPositions = [];
+							for (let i = 0; i < ordered.length; i++) sortedPositions.push(i);
+							sortedPositions.sort(comparePositions);
+							sortedIndex = 0;
+							iteration = nextSorted();
 							if (!iteration.done)
 								return {
 									value: await transformToRecord.call(this, iteration.value),
@@ -4859,6 +5443,8 @@ export function makeTable(options) {
 					if (dropDuringReplay) return;
 					try {
 						let type = auditRecord.type;
+						// Ahead of the rawEvents branch, which forwards every type verbatim.
+						if (isLockControlType(type)) return;
 						let value;
 						if (type === 'message' || request.rawEvents) {
 							// we only send the full message, this are individual messages that can be sent out of order
@@ -4949,7 +5535,8 @@ export function makeTable(options) {
 									await rest();
 									if (!isActive()) return;
 								}
-								if (auditRecord.tableId !== tableId) continue;
+								if (auditRecord.tableId !== tableId || auditRecord.type === 'evict') continue;
+								if (isLockControlType(auditRecord.type)) continue;
 								const id = auditRecord.recordId;
 								if (thisId == null || isDescendantId(thisId, id)) {
 									const value = auditRecord.getValue(primaryStore, getFullRecord, auditRecord.txnLogKey);
@@ -4986,7 +5573,8 @@ export function makeTable(options) {
 								if (!isActive()) return;
 							}
 							try {
-								if (auditRecord.tableId !== tableId) continue;
+								if (auditRecord.tableId !== tableId || auditRecord.type === 'evict') continue;
+								if (isLockControlType(auditRecord.type)) continue;
 								const id = auditRecord.recordId;
 								if (thisId == null || isDescendantId(thisId, id)) {
 									// Bound entries INSPECTED for THIS scope, independent of `count` (entries
@@ -5411,6 +5999,115 @@ export function makeTable(options) {
 				});
 			});
 		}
+		/**
+		 * Write one cluster record-lock control entry (harper#483 Phase 1). Not local-only: replicating
+		 * it IS the send.
+		 *
+		 * `recordId` must stay null. An entry carrying the locked key would share
+		 * `(version, tableId, recordId, nodeId)` with the holder's own first write, which is stamped at
+		 * exactly `ts_R`, and `RocksTransactionLogStore.getSync` answers with the FIRST entry at a
+		 * timestamp and key — so `_writeUpdate`'s keyed dedup would find this one and drop that write.
+		 * The payload goes in as bytes rather than through `recordUpdater`, which would run it through
+		 * schema projection and the table's shared structure dictionary.
+		 */
+		static writeLockControlEntry(entry: LockControlEntry): Promise<number | undefined> {
+			const encodedRecord = encodeLockControlPayload(entry);
+			const nodeId = getThisNodeId(auditStore) ?? 0;
+			let position: number;
+			// No entry pins its clock, the request included. `ts_R` is minted before the write, so pinning
+			// to it can land the entry behind a peer's replication cursor if any write to this table
+			// commits in between — the same hazard that rules it out for grants and releases, which are
+			// written later still. The protocol reads `ts_R` from the payload, so the entry's own log key
+			// never has to equal it.
+			const context = {};
+			return Promise.resolve(
+				transaction(context as any, (txn: any) => {
+					const tableTxn = txnForContext({ transaction: txn } as any);
+					tableTxn.addWrite({
+						key: null,
+						store: primaryStore,
+						skipReplicationConfirmation: true,
+						commit: (txnTime: number, _existingEntry: any, _retry: any, nativeTransaction: any) => {
+							position = txnTime;
+							return auditStore[isRocksDB ? 'putSync' : 'put'](
+								null,
+								{
+									version: txnTime,
+									tableId,
+									recordId: null,
+									nodeId,
+									type: entry.type,
+									encodedRecord,
+									extendedType: 0,
+									// Zero, not the table's count: these bytes were packed by the private control `Packr`
+									// and carry none of the table's structures. `RocksTransactionLogStore` raises the
+									// per-(log, table) structure watermark from this field and flags the entry that does
+									// it, so claiming the table's version would let a release take `HAS_STRUCTURE_UPDATE`
+									// and leave the next real write at that version unflagged — a receiver that learns
+									// structures only from flagged entries then decodes later records against a stale set
+									// (harper#1348's class). A payload with no table structures cannot advance them.
+									structureVersion: 0,
+								},
+								{ instructedWrite: true, transaction: nativeTransaction, nodeId, viaNodeId: nodeId }
+							);
+						},
+					});
+				})
+			).then(() => position);
+		}
+		/**
+		 * The coordinator that holds this node's admissions, transport or not. Releasing and registering
+		 * go here rather than through `lockCoordinator`, which answers undefined while a transport is
+		 * momentarily unregistered — and a release dropped on that answer leaves the key's home holding
+		 * its grant until the delegation's own deadline.
+		 */
+		static get admittingCoordinator(): LockCoordinator | undefined {
+			return lockCoordinator;
+		}
+
+		/**
+		 * This table's cluster lock coordinator, created on first use and only while a transport is
+		 * registered for the database. Nothing is allocated on the Phase 0 path.
+		 */
+		static get lockCoordinator(): LockCoordinator | undefined {
+			const transport = getClusterLockTransport(databaseName);
+			if (!transport) {
+				// Deliberately NOT closed. harper-pro unregisters without a standalone claim during a
+				// reconnect, and closing here would drop this node's record of the delegations it has
+				// issued as a home — so the next registration would start empty and could grant a key
+				// whose delegate is still admitting. The coordinator keeps ticking, its grants expire on
+				// their own deadlines, and `isClusterLockRequired` is what fails an acquire closed in the
+				// meantime. A genuine standalone claim clears the requirement and the coordinator with it.
+				if (!isClusterLockRequired(databaseName)) {
+					lockCoordinator?.close();
+					lockCoordinator = undefined;
+				}
+				return undefined;
+			}
+			if (lockCoordinator?.transport !== transport) {
+				// The transport object changed, but this node's delegations and the handles they admitted
+				// did not. The successor adopts that live authority in its constructor; the predecessor
+				// is closed afterwards so nothing is dropped in between. See LockCoordinatorOptions.adopt.
+				const predecessor = lockCoordinator;
+				lockCoordinator = new LockCoordinator({
+					database: databaseName,
+					table: tableName,
+					nodeId: getThisNodeName(),
+					transport,
+					adopt: predecessor,
+					// Writing to the local transaction log IS the send, so a transport that only computes
+					// the participant set gets core's writer.
+					writeControl: transport.writeControl
+						? (entry: LockControlEntry) => transport.writeControl!(tableName, entry)
+						: (entry: LockControlEntry) => TableResource.writeLockControlEntry(entry),
+					keyIdOf: writeKeyId,
+					nextTimestamp: () => (primaryStore as any).getMonotonicTimestamp(),
+					grantableAfterMono: transport.grantableAfterMono,
+				});
+				predecessor?.close();
+			}
+			return lockCoordinator;
+		}
 		// #section: validation
 		validate(record: any, patch?: boolean) {
 			// Accumulate structured per-field issues so the 400 carries `{ path, code,
@@ -5652,82 +6349,174 @@ export function makeTable(options) {
 			const exactCount = options?.exactCount;
 			const TIME_LIMIT = options?.timeLimit ?? 1000 / 2; // one second time limit, enforced by seeing if we are halfway through at 500ms
 			const start = performance.now();
-			// `entryCount` (the exact key count) is only needed once the scan blows the time budget --
-			// to decide whether to estimate and as the extrapolation base. On RocksDB it is a full
-			// key-only scan, so we defer it: tables that finish within budget (the common case) and
-			// `exact_count` requests never pay for it. `halfway`/`entryCount` stay 0 until first computed.
 			let entryCount = 0;
-			let halfway = 0;
-			let counted = false;
-			let completeForExact = false;
+			let remainderPhysical = 0;
+			let estimator;
+			// feature-detected per DESIGN.md's invariant for this API family; LMDB stores do not implement it
+			const canEstimate =
+				typeof primaryStore.createCountEstimator === 'function' && typeof primaryStore.estimateCount === 'function';
+			let estimatorFailed = false;
+			let warnedNoBase = false;
+			let checkpoints = 0;
+			let checkpointedEntries = 0;
 			let recordCount = 0;
 			let entriesScanned = 0;
+			let lastKey;
 			let limit: number;
-			for (const { value } of primaryStore.getRange({ start: true, lazy: true, snapshot: false })) {
+			let nextCheckAt = start + TIME_LIMIT;
+			for (const { key, value } of primaryStore.getRange({ start: true, lazy: true, snapshot: false })) {
 				if (value != null) recordCount++;
 				entriesScanned++;
+				lastKey = key;
 				await rest();
-				if (!exactCount && !completeForExact && performance.now() - start > TIME_LIMIT) {
-					if (!counted) {
-						counted = true;
-						entryCount = isRocksDB
-							? primaryStore.getKeysCount({ start: undefined })
-							: primaryStore.getStats().entryCount;
-						halfway = Math.floor(entryCount / 2);
+				// a table too small to reach the floor is small enough to finish exactly
+				if (exactCount || entriesScanned < MIN_ESTIMATOR_SAMPLE) continue;
+				const now = performance.now();
+				if (now <= nextCheckAt) continue;
+				nextCheckAt = now + TIME_LIMIT;
+				checkpoints++;
+				if (canEstimate && !estimatorFailed) {
+					try {
+						estimator ??= primaryStore.createCountEstimator({ start: true });
+						estimator.advance(lastKey, entriesScanned - checkpointedEntries);
+						checkpointedEntries = entriesScanned;
+						entryCount = usableCount(estimator.estimate());
+					} catch (error) {
+						// a store closing concurrently -- drop_table can, while this scan is parked in a yield
+						logger.debug?.('Count estimator unavailable, falling back to an exact scan', error);
+						estimatorFailed = true;
+						estimator = undefined;
+						entryCount = 0;
 					}
-					if (entriesScanned < halfway) {
-						// it is taking too long, so we will just take this sample and a sample from the end to estimate
-						limit = entriesScanned;
-						break;
+				} else if (!canEstimate) {
+					// `canEstimate` false is not the same as "LMDB": a RocksDB store whose native module predates
+					// the estimator API lands here too, and `RocksDatabase.getStats()` carries no `entryCount`.
+					try {
+						const stats = primaryStore.getStats?.();
+						entryCount = Number.isFinite(stats?.entryCount) && stats.entryCount > 0 ? stats.entryCount : 0;
+					} catch {
+						entryCount = 0;
 					}
-					// Past the halfway point already: finishing the scan for an exact count is cheaper
-					// than estimating. Set the flag so we stop re-evaluating the budget on each remaining iteration.
-					completeForExact = true;
+				}
+				if (!entryCount && canEstimate && !estimatorFailed) {
+					// Range estimates are block-granular and can report 0 for a store whose entries are still
+					// in the memtable. Without a base the escape cannot fire at all, so fall back to the
+					// whole-store property rather than silently walking the table.
+					try {
+						const wholeStore = primaryStore.getEstimatedKeyCount();
+						entryCount = Number.isFinite(wholeStore) && wholeStore > 0 ? wholeStore : 0;
+					} catch {
+						entryCount = 0;
+					}
+					if (!entryCount && !warnedNoBase) {
+						warnedNoBase = true;
+						logger.debug?.(`No usable key-count estimate for ${tableName}; counting records by full scan`);
+					}
+				}
+				// Zero is "no usable base": degrade to the exact scan. The checkpoint ceiling is what stops a
+				// base that keeps undershooting from holding the halfway test false forever and walking the
+				// whole table; the reverse sample is bounded by `limit` in turn.
+				if (
+					entryCount > 0 &&
+					(checkpoints >= MAX_ESTIMATE_CHECKPOINTS || entriesScanned < Math.floor(entryCount / 2))
+				) {
+					if (canEstimate) {
+						try {
+							const remaining = primaryStore.estimateCount({ start: lastKey, exclusiveStart: true });
+							// widened by its own reported untrustworthiness: block-granular, so it can land below
+							// the live count it is meant to bound
+							const remainingCount = usableCount(remaining);
+							remainderPhysical = remainingCount > 0 ? remainingCount * (2 - remaining.confidence) : 0;
+						} catch {
+							remainderPhysical = 0;
+						}
+						// A zero or unusable remainder is valid -- entries still in the memtable read as none
+						// through range statistics -- but it would leave `baseMax` resting on the sampled ends
+						// alone. The whole-store property is a separate, non-range source, so fall back to it.
+						if (!remainderPhysical) {
+							try {
+								const wholeStore = primaryStore.getEstimatedKeyCount();
+								if (Number.isFinite(wholeStore)) remainderPhysical = Math.max(wholeStore - entriesScanned, 0);
+							} catch {
+								remainderPhysical = 0;
+							}
+						}
+					}
+					limit = entriesScanned;
+					break;
 				}
 			}
 			if (limit) {
 				// in this case we are going to make an estimate of the table count using the first thousand
 				// entries and last thousand entries
 				const firstRecordCount = recordCount;
+				const firstKey = lastKey;
 				recordCount = 0;
 				// Bound the reverse scan explicitly. The getRange `limit` option is honored by lmdb-js but
 				// ignored by rocksdb-js; without this break the scan reads the whole table, so `recordRate`
 				// blows up to ~entryCount/(2*limit) and the estimate scales with entryCount^2 -- the source
 				// of the wildly inflated `record_count` (e.g. 20,000,000 for ~105k rows) on large RocksDB
-				// tables. The early-exit above guarantees limit < entryCount/2, so the two samples stay disjoint.
+				// tables.
 				let reverseScanned = 0;
-				for (const { value } of primaryStore.getRange({
+				// Sized independently of the forward scan. `entriesScanned` is whatever the forward pass
+				// covered before it escaped, and the checkpoint ceiling lets that run twenty budget
+				// intervals when the base keeps undershooting; matching it here would read that same count
+				// again and double the wall clock of the call this path exists to bound.
+				const reverseLimit = Math.min(limit, MIN_ESTIMATOR_SAMPLE);
+				// Disjointness is enforced against the forward scan's own last key rather than inferred from
+				// the base, which is an estimate that can overshoot by more than 2x.
+				let sampledWholeTable = false;
+				for (const { key, value } of primaryStore.getRange({
 					start: '\uffff',
 					reverse: true,
 					lazy: true,
-					limit,
+					limit: reverseLimit,
 					snapshot: false,
 				})) {
+					if (compareKeys(key, firstKey) <= 0) {
+						sampledWholeTable = true;
+						break;
+					}
 					if (value != null) recordCount++;
 					reverseScanned++;
 					await rest();
-					if (reverseScanned >= limit) break;
+					if (reverseScanned >= reverseLimit) break;
 				}
+				// the samples met, so between them they covered every entry
+				if (sampledWholeTable) return { recordCount: recordCount + firstRecordCount };
 				// Use the actual entries sampled, not limit*2: the reverse scan can yield fewer than `limit`
 				// (concurrent deletions under snapshot:false, or an overestimated entryCount), and counting
 				// those un-scanned slots would inflate the denominator and underestimate the rate.
-				const sampleSize = limit + reverseScanned;
-				const recordRate = (recordCount + firstRecordCount) / sampleSize;
-				const variance =
-					Math.pow((recordCount - firstRecordCount + 1) / limit / 2, 2) + // variance between samples
-					(recordRate * (1 - recordRate)) / sampleSize;
-				const sd = Math.max(Math.sqrt(variance) * entryCount, 1);
-				const estimatedRecordCount = Math.round(recordRate * entryCount);
-				// TODO: This uses a normal/Wald interval, but a binomial confidence interval is probably better calculated using
-				// Wilson score interval or Agresti-Coull interval (I think the latter is a little easier to calculate/implement).
-				const lowerCiLimit = Math.max(estimatedRecordCount - 1.96 * sd, recordCount + firstRecordCount);
-				const upperCiLimit = Math.min(estimatedRecordCount + 1.96 * sd, entryCount);
-				let significantUnit = Math.pow(10, Math.round(Math.log10(sd)));
-				if (significantUnit > estimatedRecordCount) significantUnit = significantUnit / 10;
-				recordCount = Math.round(estimatedRecordCount / significantUnit) * significantUnit;
+				const sampledRecords = recordCount + firstRecordCount;
+				const recordRate = sampledRecords / (limit + reverseScanned);
+				// Endpoints for the extrapolation base, spanning both ways an estimated base can be wrong:
+				// every remaining entry superseded (only what was sampled is live) through every remaining
+				// entry live (the uncalibrated physical count). Churn concentrated outside the sampled ends
+				// calibrates to nothing, so an interval derived from the estimator's confidence would sit
+				// narrowly around the wrong number. Both endpoints are themselves estimates on RocksDB, so
+				// this is a widened heuristic interval, not a guaranteed bound on the live count.
+				const baseMin = entriesScanned + reverseScanned;
+				const baseMax = Math.max(entriesScanned + remainderPhysical, entryCount, baseMin);
+				const estimatedRecordCount = Math.round(recordRate * Math.max(entryCount, baseMin));
+				// The samples counted these directly, and the entries between them can only add; everything
+				// outside the samples could be live. A statistical interval inside those endpoints would be
+				// narrowest exactly where the ends are least representative of the middle -- sampled ends
+				// that are all deletion entries give a rate of 0, collapsing an upper end to ~0 with live
+				// rows in between -- so the endpoints are the evidence itself.
+				const lower = sampledRecords;
+				const upper = Math.round(baseMax);
+				// Report only the precision the interval supports, but never so coarse a unit that the
+				// estimate rounds away: `baseMax` is physical and can exceed a calibrated estimate by
+				// orders of magnitude, which a single division cannot walk back.
+				let significantUnit = Math.pow(10, Math.round(Math.log10(Math.max((upper - lower) / 2, 1))));
+				while (significantUnit > estimatedRecordCount && significantUnit > 1) significantUnit /= 10;
+				recordCount = Math.min(
+					Math.max(Math.round(estimatedRecordCount / significantUnit) * significantUnit, lower),
+					upper
+				);
 				return {
 					recordCount,
-					estimatedRange: [Math.round(lowerCiLimit), Math.round(upperCiLimit)],
+					estimatedRange: [lower, upper],
 				};
 			}
 			return {
@@ -5741,6 +6530,7 @@ export function makeTable(options) {
 			// Refresh on every call: schema reload mutates `attributes` in place, so the
 			// class-construction snapshot would otherwise go stale.
 			this.embedAttributes = (this.attributes as any[]).filter((a) => a?.embed);
+			expiresAtProperty = this.attributes.find((attribute) => attribute.expiresAt);
 			// Drop registry entries for attributes that are no longer `@embed`, so a dropped
 			// directive doesn't leave a stale embedder or block a default refresh on re-add.
 			const embedNames = new Set(this.embedAttributes.map((a) => a.name));
@@ -5810,7 +6600,7 @@ export function makeTable(options) {
 											txnForContext(context).getReadTxn(),
 											false,
 											relatedTable,
-											false
+											{ allowFullScan: false }
 										) as any
 									).map((entry) => {
 										if (entry && entry.key !== undefined) return entry;
@@ -6058,10 +6848,24 @@ export function makeTable(options) {
 			}
 			const drainRemovals = () => Promise.all(inFlightRemovals);
 			let entriesDeleted = 0;
+			// LMDB only: RocksTransactionLogStore.remove() is a no-op, so a RocksDB deleteHistory removes
+			// nothing and must not claim it did.
+			// A bound above everything reachable must not be recorded as the floor: the floor only rises
+			// and a store with a record is never re-stamped, so it would never come down, for every table in
+			// this database. `boundedAuditPruneEnd` clamps the cutoff to just above the newest key in the
+			// log, and the scan below uses that same value as its range end, so the prune cannot remove an
+			// entry the floor does not cover.
+			let pruneEnd = endTime;
+			if (!isRocksDB) {
+				pruneEnd = boundedAuditPruneEnd(auditStore, endTime);
+				raiseAuditFloor(auditStore, pruneEnd);
+			}
 			try {
 				for (const auditRecord of auditStore.getRange({
-					start: 1, // must not be zero; see getHistory below for why
-					end: endTime,
+					// must not be zero: 0 encodes to all zero bytes and so overlaps the symbol keys, as in
+					// getHistory below
+					start: 1,
+					end: pruneEnd,
 				})) {
 					await rest(); // yield to other async operations
 					if (auditRecord.tableId !== tableId) continue;
@@ -6088,7 +6892,7 @@ export function makeTable(options) {
 							isRocksDB && version != null
 								? resolveAuditHead(key, version, entry.nodeId, entry.additionalAuditRefs).txnLogKey
 								: localTime;
-						if (value === null && version != null && auditTime < endTime) {
+						if (value === null && version != null && auditTime < pruneEnd) {
 							const backpressure = queueRemoval(
 								() => primaryStore.remove(key, version),
 								'Error removing deleted record during deleteHistory'
@@ -6113,7 +6917,8 @@ export function makeTable(options) {
 				end: endTime,
 			})) {
 				await rest(); // yield to other async operations
-				if (auditRecord.tableId !== tableId) continue;
+				if (auditRecord.tableId !== tableId || auditRecord.type === 'evict' || isLockControlType(auditRecord.type))
+					continue;
 				yield {
 					id: auditRecord.recordId,
 					// Compatibility-facing LMDB history has always reported/grouped by record version.
@@ -6143,7 +6948,12 @@ export function makeTable(options) {
 				let highestPreviousVersion = 0;
 				const start = nextVersion - auditWindow;
 				for (const auditRecord of auditStore.getRange({ start, end: nextVersion + 0.001 })) {
-					if (auditRecord.tableId === tableId && compareKeys(auditRecord.recordId, id) === 0) {
+					if (
+						auditRecord.tableId === tableId &&
+						auditRecord.type !== 'evict' &&
+						!isLockControlType(auditRecord.type) &&
+						compareKeys(auditRecord.recordId, id) === 0
+					) {
 						history.splice(insertionPoint, 0, {
 							id: auditRecord.recordId,
 							localTime: isRocksDB ? auditRecord.txnLogKey : auditRecord.version,
@@ -6179,6 +6989,7 @@ export function makeTable(options) {
 			const promises = [primaryStore.clear()];
 			for (const key in indices) {
 				const index = indices[key];
+				index.customIndex?.resetDerivedStorage?.();
 				promises.push(index.clearAsync ? index.clearAsync() : index.clear());
 			}
 			return Promise.all(promises);
@@ -6186,6 +6997,7 @@ export function makeTable(options) {
 		/** Release everything makeTable() registered process-wide; the class must not be used afterwards. */
 		static cleanup() {
 			disposed = true;
+			void TableResource.derivedIndexRuntime?.close();
 			clearTimeout(cleanupTimer);
 			settlePendingCleanup();
 			clearInterval(recordExpirationInterval);
@@ -6214,8 +7026,15 @@ export function makeTable(options) {
 
 	try {
 		TableResource.updatedAttributes(); // on creation, update accessors as well
-		if (expirationMs) TableResource.setTTLExpiration(expirationMs / 1000);
-		if (expiresAtProperty) runRecordExpirationEviction();
+		if (expirationMs) {
+			ttlFromLoad = true;
+			try {
+				TableResource.setTTLExpiration(expirationMs / 1000);
+			} finally {
+				ttlFromLoad = false;
+			}
+		}
+		if (expiresAtProperty && !recordExpirationInterval) runRecordExpirationEviction();
 	} catch (error) {
 		TableResource.cleanup();
 		throw error;
@@ -6980,25 +7799,34 @@ export function makeTable(options) {
 					}
 					resolve(resolvedEntry);
 				} catch (error) {
-					error.message += ` while resolving record ${id} for ${tableName}`;
-					if (
-						existingRecord &&
-						(((error.code === 'ECONNRESET' || error.code === 'ECONNREFUSED' || error.code === 'EAI_AGAIN') &&
-							!context?.mustRevalidate) ||
-							(context?.staleIfError &&
-								(error.statusCode === 500 ||
-									error.statusCode === 502 ||
-									error.statusCode === 503 ||
-									error.statusCode === 504)))
-					) {
-						// these are conditions under which we can use stale data after an error
-						resolve({
-							key: id,
-							version: existingVersion,
-							value: existingRecord,
-						} as any);
-						logger.trace?.(error.message, '(returned stale record)');
-					} else reject(error);
+					// A source may reject with anything at all, so deciding how to settle is itself
+					// fallible: `message` is not assignable on every error (a DOMException from
+					// AbortSignal.timeout), and a nullish rejection makes the reads below throw.
+					// Leaving this promise unsettled hangs the caller forever, so every path here
+					// has to end in resolve() or reject().
+					try {
+						appendErrorContext(error, ` while resolving record ${id} for ${tableName}`);
+						if (
+							existingRecord &&
+							(((error.code === 'ECONNRESET' || error.code === 'ECONNREFUSED' || error.code === 'EAI_AGAIN') &&
+								!context?.mustRevalidate) ||
+								(context?.staleIfError &&
+									(error.statusCode === 500 ||
+										error.statusCode === 502 ||
+										error.statusCode === 503 ||
+										error.statusCode === 504)))
+						) {
+							// these are conditions under which we can use stale data after an error
+							resolve({
+								key: id,
+								version: existingVersion,
+								value: existingRecord,
+							} as any);
+							logger.trace?.((error as Error)?.message, '(returned stale record)');
+						} else reject(error);
+					} catch (settlingError) {
+						reject(error ?? settlingError);
+					}
 					const resolveDuration = performance.now() - start;
 					recordAction(resolveDuration, 'cache-resolution', tableName, null, 'fail');
 					if (responseHeaders)
@@ -7238,6 +8066,7 @@ export function makeTable(options) {
 					if (entry.value == null) continue; // already removed
 					if (hasSourceGet && primaryStore.hasLock(item.key, entry.version)) continue; // resolution in progress
 					updateIndices(item.key, entry.value, null, options);
+					stageDerivedIndexEviction(transaction, item.key, entry.version);
 				}
 				removeEntry(primaryStore, entry, options);
 				staged++;
@@ -7328,7 +8157,7 @@ export function makeTable(options) {
 		// Periodically evict expired records and deleted records searching for records who expiresAt timestamp is before now
 		if (cleanupInterval === lastCleanupInterval && !runImmediately) return;
 		lastCleanupInterval = cleanupInterval;
-		if (getWorkerIndex() === getWorkerCount() - 1) {
+		if (ownsStoreMaintenance(primaryStore.path) || (ttlConfiguredByApplication && isDedicatedWorker())) {
 			// run on the last thread so we aren't overloading lower-numbered threads
 			if (cleanupTimer) clearTimeout(cleanupTimer);
 			if (!cleanupInterval) {
@@ -7470,12 +8299,14 @@ export function makeTable(options) {
 	}
 	function runRecordExpirationEviction() {
 		// Periodically evict expired records, searching for records who expiresAt timestamp is before now
-		if (getWorkerIndex() === 0) {
+		if (ownsStoreExpiration(primaryStore.path) || (ttlConfiguredByApplication && isDedicatedWorker())) {
 			// we want to run the pruning of expired records on only one thread so we don't have conflicts in evicting
 			recordExpirationInterval = setInterval(async () => {
 				// go through each database and table and then search for expired entries
 				// find any entries that are set to expire before now
-				if (disposed || runningRecordExpiration) return;
+				// updatedAttributes() clears expiresAtProperty when a live redeclaration drops the directive,
+				// and there is nothing left for this interval to scan by
+				if (disposed || runningRecordExpiration || !expiresAtProperty) return;
 				runningRecordExpiration = true;
 				try {
 					const expiresAtName = expiresAtProperty.name;