@harperfast/harper 5.3.0-alpha.1 → 5.3.0-beta.1

package/resources/replayLogs.ts

@@ -165,6 +165,11 @@ export function replayLogs(rootStore: RocksDatabase, tables: any, electedReplaye
 					noProgressRun++;
 					continue;
 				}
+				if (type === 'evict') {
+					noProgressRun = 0;
+					lastProgressTime = performance.now();
+					continue;
+				}
 				const Table = tableById.get(tableId);
 				if (!Table) {
 					// Entry for a table this node no longer has (dropped/foreign). Not an

package/resources/replicatedApplyFailure.ts

@@ -0,0 +1,77 @@
+import { onRemovedDB } from './databases.ts';
+import { logger } from '../utility/logging/logger.ts';
+import { contextStorage } from './transaction.ts';
+
+export interface ReplicatedApplyFailure {
+	readonly database: string;
+	readonly table?: string;
+	readonly nodeId: number;
+	readonly position: number;
+	readonly localTime?: number;
+	readonly error: unknown;
+}
+
+export type ReplicatedApplyFailureListener = (failure: ReplicatedApplyFailure) => void | Promise<void>;
+
+const listenersByDatabase = new Map<string, Set<ReplicatedApplyFailureListener>>();
+let watchingDatabaseRemoval = false;
+
+export function registerReplicatedApplyFailureListener(
+	database: string,
+	listener: ReplicatedApplyFailureListener
+): void {
+	if (!watchingDatabaseRemoval) {
+		onRemovedDB((database) => listenersByDatabase.delete(database));
+		watchingDatabaseRemoval = true;
+	}
+	let listeners = listenersByDatabase.get(database);
+	if (!listeners) listenersByDatabase.set(database, (listeners = new Set()));
+	listeners.add(listener);
+}
+
+export function unregisterReplicatedApplyFailureListener(
+	database: string,
+	listener: ReplicatedApplyFailureListener
+): void {
+	const listeners = listenersByDatabase.get(database);
+	listeners?.delete(listener);
+	if (listeners?.size === 0) listenersByDatabase.delete(database);
+}
+
+export async function notifyReplicatedApplyFailure(
+	database: string,
+	event: { table?: string; nodeId?: number; localTime?: number },
+	position: number | undefined,
+	error: unknown,
+	table?: string
+): Promise<void> {
+	if (listenersByDatabase.size === 0) return;
+	try {
+		if (typeof event?.nodeId !== 'number' || typeof position !== 'number') return;
+		const listeners = listenersByDatabase.get(database);
+		if (!listeners) return;
+		const failure: ReplicatedApplyFailure = Object.freeze({
+			database,
+			table: event.table ?? table,
+			nodeId: event.nodeId,
+			position,
+			localTime: event.localTime,
+			error,
+		});
+		for (const listener of [...listeners]) {
+			try {
+				await contextStorage.exit(() => listener(failure));
+			} catch (error) {
+				logListenerFailure(database, error);
+			}
+		}
+	} catch (error) {
+		logListenerFailure(database, error);
+	}
+}
+
+function logListenerFailure(database: string, error: unknown): void {
+	try {
+		logger.error?.('replicated apply failure listener failed', database, error);
+	} catch {}
+}

package/resources/scheduler/scheduler.ts

@@ -1,5 +1,5 @@
 import { isAbsolute, join } from 'node:path';
-import { getWorkerIndex } from '../../server/threads/manageThreads.js';
+import { isApplicationPrimaryWorker } from '../../server/threads/manageThreads.js';
 import { ClientError } from '../../utility/errors/hdbError.ts';
 import { convertToMS } from '../../utility/common_utils.ts';
 import harperLogger from '../../utility/logging/harper_logger.ts';
@@ -94,12 +94,12 @@ export async function handleApplication(scope): Promise<void> {
 	}
 
 	// Activation gates: one worker owns scheduling for the whole node
-	// (getWorkerIndex() === 0 is correct in every threading mode, including
+	// (the application's primary worker is correct in every threading mode, including
 	// threads:0 where the main thread acts as worker 0), and a deploy
 	// pre-flight validation scope must never touch the live engine — it can
 	// share a running component's identity, so registering from it would
-	// displace the real component's jobs (review finding).
-	if (getWorkerIndex() !== 0) {
+	// displace the real component's jobs.
+	if (!isApplicationPrimaryWorker(scope.applicationScope?.name)) {
 		schedulerLogger.debug?.('Scheduler config validated; activation skipped on non-primary worker');
 		return;
 	}

package/resources/search.ts

@@ -6,9 +6,10 @@ import { INVALIDATED, EVICTED, freezeRecord } from './Table.ts';
 import type { DirectCondition, Id } from './ResourceInterface.ts';
 import { RequestTarget } from './RequestTarget.ts';
 import { lastMetadata } from './RecordEncoder.ts';
-import { writeKeyId } from './DatabaseTransaction.ts';
+import { writeKeyId, getReadTransactionGuard } from './DatabaseTransaction.ts';
 import { recordAction } from './analytics/write';
 import { RocksDatabase } from '@harperfast/rocksdb-js';
+import { appendHeader } from '../server/serverHelpers/Headers.ts';
 
 // these are ratios/percentages of overall table size
 const OPEN_RANGE_ESTIMATE = 0.3;
@@ -141,16 +142,13 @@ export function executeConditions(
 				filtered
 				// recordAccess intentionally omitted: guards run once, at the top level (see above).
 			);
-		return searchByIndex(
-			condition,
-			txn,
-			condition.descending || request.reverse === true,
-			table,
-			request.allowFullScan,
+		return searchByIndex(condition, txn, condition.descending || request.reverse === true, table, {
+			allowFullScan: request.allowFullScan,
 			filtered,
 			context,
-			request.limit !== undefined ? (request.offset || 0) + request.limit : undefined
-		);
+			minResults:
+				request.limit === 0 ? 0 : request.limit !== undefined ? (request.offset || 0) + request.limit : undefined,
+		});
 	}
 	function mapConditionsToFilters(conditions, intersection, estimatedIncomingCount) {
 		return conditions
@@ -269,27 +267,35 @@ function distinctRecords(entries: any): AsyncIterable<Id> {
 }
 
 /**
- * Search for records or keys, based on the search condition, using an index if available
+ * Search for records or keys, based on the search condition, using an index if available. The four
+ * leading parameters are required at every call site; everything optional is named, so a new
+ * capability can be added without shifting positions at callers that don't use it.
  * @param searchCondition
  * @param transaction
  * @param reverse
  * @param Table
- * @param allowFullScan
- * @param filtered
+ * @param options
  */
 export function searchByIndex(
 	searchCondition: DirectCondition,
 	transaction: any,
 	reverse: boolean,
 	Table: any,
-	allowFullScan?: boolean,
-	filtered?: any,
-	context?: any,
-	// How many rows the query will ultimately consume (offset + limit), when it is bounded. An
-	// approximate index returns a fixed-size candidate list, so without this a query asking for more
-	// rows than that list holds silently gets a short result set. Only custom indexes read it.
-	minResults?: number
+	options: {
+		allowFullScan?: boolean;
+		filtered?: any;
+		context?: any;
+		// How many rows the query will ultimately consume (offset + limit), when it is bounded. An
+		// approximate index returns a fixed-size candidate list, so without this a query asking for more
+		// rows than that list holds silently gets a short result set. Only custom indexes read it.
+		minResults?: number;
+	} = {}
 ): AsyncIterable<Id | { key: Id; value: any }> {
+	// A stale positional caller passes `allowFullScan` here. Type checking only covers .ts callers, so
+	// fail loud rather than silently reading every option as undefined.
+	if (typeof options !== 'object' || options === null)
+		throw new TypeError('searchByIndex: the 5th argument is an options object (#2165), not a positional value');
+	const { allowFullScan, filtered, context, minResults } = options;
 	let attribute_name = searchCondition[0] ?? searchCondition.attribute;
 	let value = searchCondition[1] ?? searchCondition.value;
 	const comparator = searchCondition.comparator;
@@ -323,8 +329,7 @@ export function searchByIndex(
 				transaction,
 				reverse,
 				relatedTable,
-				allowFullScan,
-				joined
+				{ allowFullScan, filtered: joined }
 			);
 			if (attribute.relationship.to) {
 				// this is one-to-many or many-to-many, so we need to track the filtering of related entries that match
@@ -341,8 +346,7 @@ export function searchByIndex(
 						transaction,
 						reverse,
 						Table,
-						allowFullScan,
-						joined
+						{ allowFullScan, filtered: joined }
 					);
 				};
 				if (attribute.elements) {
@@ -550,26 +554,117 @@ export function searchByIndex(
 			// exploring until it has enough MATCHING results, rather than post-filtering an under-filled
 			// candidate set. Only indexes that opt in (filteredSearch) receive it; others post-filter as before.
 			const recordFilter = index.customIndex.filteredSearch ? searchCondition.recordFilter : undefined;
-			const loaded = index.customIndex.search(searchCondition, context, recordFilter, minResults).map((entry) => {
-				// if the custom index returns an entry with metadata, merge it with the loaded entry
-				if (typeof entry === 'object' && entry) {
-					const { key, ...otherProps } = entry;
-					if (key == null) return SKIP; // primaryKey missing from HNSW node — skip rather than crash
-					const loadedEntry = Table.primaryStore.getEntry(key, {
-						transaction: context && Table._readTxnForContext(context),
-					});
-					if (!loadedEntry) return SKIP; // record was deleted/expired or not yet visible
-					freezeRecord(loadedEntry?.value);
-					recordRead(loadedEntry);
-					return { ...otherProps, ...loadedEntry };
-				}
-				return entry;
+			const waiting = index.customIndex.filePrimary && searchCondition.waitForIndexMilliseconds > 0;
+			const start = waiting ? Promise.withResolvers<void>() : undefined;
+			const controller = waiting ? new AbortController() : undefined;
+			const checkActive = waiting ? getReadTransactionGuard(transaction) : undefined;
+			const signal = waiting
+				? context.signal
+					? AbortSignal.any([context.signal, controller.signal])
+					: controller.signal
+				: undefined;
+			const searchContext = waiting
+				? Object.create(context, {
+						signal: { value: signal },
+						indexSearchStart: { value: start.promise.then(() => checkActive?.()) },
+					})
+				: context;
+			const searched = index.customIndex.search(searchCondition, searchContext, {
+				filter:
+					waiting && recordFilter
+						? (id) => {
+								if (signal.aborted) return false;
+								checkActive?.();
+								return recordFilter(id);
+							}
+						: recordFilter,
+				minResults,
 			});
-			if (index.customIndex.rescoreResults) {
-				const rescored = index.customIndex.rescoreResults(loaded, searchCondition, comparator, attribute_name);
-				if (rescored != null) return rescored as any;
+			const coverage = (searched as any).indexCoverage;
+			if (!waiting && coverage && context?.responseHeaders) {
+				appendHeader(
+					context.responseHeaders,
+					'Harper-Index-Coverage',
+					`${coverage.state}; lag=${coverage.lagUpperBoundMilliseconds}; tolerance=${coverage.maxLagMilliseconds}`,
+					true
+				);
+				appendHeader(context.responseHeaders, 'Access-Control-Expose-Headers', 'Harper-Index-Coverage', true);
+			}
+			const processEntries = (entries: any[]) => {
+				const loaded = entries
+					.map((entry) => {
+						// if the custom index returns an entry with metadata, merge it with the loaded entry
+						if (typeof entry === 'object' && entry) {
+							const { key, ...otherProps } = entry;
+							if (key == null) return SKIP; // primaryKey missing from HNSW node — skip rather than crash
+							const loadedEntry = Table.primaryStore.getEntry(key, {
+								transaction: waiting ? transaction : context && Table._readTxnForContext(context),
+							});
+							if (!loadedEntry) return SKIP; // record was deleted/expired or not yet visible
+							freezeRecord(loadedEntry?.value);
+							recordRead(loadedEntry);
+							return { ...otherProps, ...loadedEntry };
+						}
+						return entry;
+					})
+					.filter((entry) => entry !== SKIP);
+				if (index.customIndex.rescoreResults) {
+					const rescored = index.customIndex.rescoreResults(loaded, searchCondition, comparator, attribute_name);
+					if (rescored != null) return rescored as any;
+				}
+				return loaded;
+			};
+			if (typeof (searched as any)?.then === 'function') {
+				let settled = false;
+				const pending = waiting
+					? (searched as Promise<any[]>)
+							.then((entries) => {
+								if (controller.signal.aborted) return [];
+								if (signal.aborted) throw signal.reason ?? new Error('Index search aborted', { cause: signal.reason });
+								checkActive?.();
+								return processEntries(entries);
+							})
+							.finally(() => {
+								settled = true;
+							})
+					: (searched as Promise<any[]>).then(processEntries);
+				// A consumer may abandon this lazy iterable without calling next().
+				pending.catch(() => {});
+				const results: any = new ExtendedIterable();
+				results.iterate = (options?: { async?: boolean }) => {
+					if (!options?.async) {
+						throw new Error(
+							'This index resolves search results asynchronously; the results must be consumed with async iteration'
+						);
+					}
+					// Overlapping next() calls share one cursor and cannot duplicate its first entry.
+					const iteratorPromise = pending.then((entries) => entries[Symbol.iterator]());
+					iteratorPromise.catch(() => {});
+					let closed = false;
+					return {
+						next() {
+							if (closed) return Promise.resolve({ done: true, value: undefined });
+							start?.resolve();
+							return iteratorPromise.then((inner) => {
+								if (closed) return { done: true, value: undefined };
+								checkActive?.();
+								return inner.next();
+							});
+						},
+						return(value?: any) {
+							closed = true;
+							if (!settled) controller?.abort();
+							iteratorPromise.then(
+								(inner) => (inner as any).return?.(value),
+								() => {}
+							);
+							return Promise.resolve({ done: true, value });
+						},
+					};
+				};
+				return results;
 			}
-			return loaded;
+			return processEntries(searched);
 		}
 		const scanned = index.getRange(rangeOptions).map(
 			filter
@@ -1103,7 +1198,7 @@ export function filterByType(searchCondition, Table, context, filtered, isPrimar
 		canUseIndex =
 			canUseIndex && // is it a comparator that makes sense to use index
 			!isPrimaryKey && // no need to use index for primary keys, since we will be iterating over the primary keys
-			Table?.indices[attribute] && // is there an index for this attribute
+			!!(Table && usableIndex(Table, attribute)) && // is there a usable (complete) index for this attribute
 			estimatedIncomingCount > 3; // do we have a valid estimate of multiple incoming records (that is worth using an index for)
 		if (canUseIndex) {
 			if (searchCondition.estimated_count == undefined) estimateCondition(Table)(searchCondition);
@@ -1169,7 +1264,7 @@ export function filterByType(searchCondition, Table, context, filtered, isPrimar
 function estimateRangeCondition(table, condition, searchType, fraction) {
 	const attributeName = condition[0] ?? condition.attribute;
 	const isPrimaryKey = attributeName === table.primaryKey;
-	const store = isPrimaryKey ? table.primaryStore : table.indices[attributeName];
+	const store = isPrimaryKey ? table.primaryStore : usableIndex(table, attributeName);
 	// LMDB-backed and custom index stores do not implement estimateCount
 	if (typeof store?.estimateCount !== 'function') return undefined;
 	let value = condition[1] ?? condition.value;
@@ -1245,6 +1340,28 @@ function estimateRangeCondition(table, condition, searchType, fraction) {
 	return Math.max(1, Math.round(confidence * count + (1 - confidence) * heuristic));
 }
 
+/** The index a condition can be driven by; searchByIndex refuses a rebuilding one, so it reads as absent. */
+function usableIndex(table, attributeName): any {
+	const index = attributeName == null ? undefined : table.indices[attributeName];
+	return index?.isIndexing ? undefined : index;
+}
+
+/**
+ * True when an index this attribute would have to be driven by is still being built, following a
+ * relationship path to the local join index and on to the related table's leaf index.
+ */
+function drivesRebuildingIndex(table, attributeName, relationshipOffset = 0): boolean {
+	if (!Array.isArray(attributeName))
+		return attributeName != null && attributeName !== table.primaryKey && !!table.indices[attributeName]?.isIndexing;
+	if (relationshipOffset >= attributeName.length - 1)
+		return drivesRebuildingIndex(table, attributeName[relationshipOffset]);
+	const attribute = findAttribute(table.attributes, attributeName[relationshipOffset]);
+	if (!attribute) return false;
+	if (table.indices[attribute.relationship?.from]?.isIndexing) return true;
+	const relatedTable = attribute.definition?.tableClass || attribute.elements?.definition?.tableClass;
+	return !!relatedTable && drivesRebuildingIndex(relatedTable, attributeName, relationshipOffset + 1);
+}
+
 export function estimateCondition(table) {
 	function estimateConditionForTable(condition) {
 		if (condition.estimated_count === undefined) {
@@ -1274,7 +1391,10 @@ export function estimateCondition(table) {
 			// skip if it is cached
 			let searchType = condition.comparator || condition.search_type;
 			searchType = ALTERNATE_COMPARATOR_NAMES[searchType] || searchType;
-			if (condition.negated) {
+			// before comparator dispatch: several branches fall back to a finite table-fraction heuristic
+			if (drivesRebuildingIndex(table, condition[0] ?? condition.attribute)) {
+				condition.estimated_count = Infinity;
+			} else if (condition.negated) {
 				// a negated condition always executes as a full scan (searchByIndex forces
 				// needFullScan), so follow the filter-only convention used by contains/ends_with:
 				// estimate Infinity so its positive-range estimate can never win the driving-condition
@@ -1307,12 +1427,12 @@ export function estimateCondition(table) {
 					}
 				} else {
 					// we only attempt to estimate count on equals operator because that's really all that LMDB supports (some other key-value stores like libmdbx could be considered if we need to do estimated counts of ranges at some point)
-					const index = table.indices[attribute_name];
+					const index = usableIndex(table, attribute_name);
 					condition.estimated_count = index ? index.getValuesCount(condition[1] ?? condition.value) : Infinity;
 				}
 			} else if (searchType === 'contains' || searchType === 'ends_with' || searchType === 'ne') {
 				const attribute_name = condition[0] ?? condition.attribute;
-				const index = table.indices[attribute_name];
+				const index = usableIndex(table, attribute_name);
 				if (condition.value === null && searchType === 'ne') {
 					condition.estimated_count = Math.max(
 						estimatedEntryCount(table.primaryStore) - (index ? index.getValuesCount(null) : 0),
@@ -1321,7 +1441,7 @@ export function estimateCondition(table) {
 				} else condition.estimated_count = Infinity;
 			} else if (searchType === 'in') {
 				const attribute_name = condition[0] ?? condition.attribute;
-				const index = table.indices[attribute_name];
+				const index = usableIndex(table, attribute_name);
 				if (Array.isArray(condition.value) && index) {
 					// Sum of per-value matches (over-counts duplicates but is a fine ceiling)
 					let estimate = 0;
@@ -1342,7 +1462,7 @@ export function estimateCondition(table) {
 					BETWEEN_ESTIMATE * estimatedEntryCount(table.primaryStore) + 1;
 			else if (searchType === 'sort') {
 				const attribute_name = condition[0] ?? condition.attribute;
-				const index = table.indices[attribute_name];
+				const index = usableIndex(table, attribute_name);
 				if (index?.customIndex?.estimateCountAsSort)
 					// allow custom index to define its own estimation of counts
 					condition.estimated_count = index.customIndex.estimateCountAsSort(condition);
@@ -1350,7 +1470,7 @@ export function estimateCondition(table) {
 			} else {
 				// for the search types that use the broadest range, try do them last
 				const attribute_name = condition[0] ?? condition.attribute;
-				const index = table.indices[attribute_name];
+				const index = usableIndex(table, attribute_name);
 				if (index?.customIndex?.estimateCount)
 					// allow custom index to define its own estimation of counts
 					condition.estimated_count = index.customIndex.estimateCount(condition.value);

package/resources/tracked.ts

@@ -3,7 +3,15 @@ import * as crdtOperations from './crdt.ts';
 import { Blob } from './blob.ts';
 import * as harperLogger from '../utility/logging/harper_logger.ts';
 
+export const ASSERT_TRACKED_WRITABLE = Symbol('assert-tracked-writable');
+export const GET_TRACKED_WRITE_GENERATION = Symbol('get-tracked-write-generation');
+
+function assertWritable(target, generation?) {
+	target[ASSERT_TRACKED_WRITABLE]?.(generation);
+}
+
 function getChanges(target) {
+	assertWritable(target);
 	let changes = target.getChanges();
 	if (!changes) {
 		changes = Object.create(null);
@@ -49,6 +57,7 @@ export function assignTrackedAccessors(Target, typeDef, useFullPropertyProxy = f
 					// still load), this is a user assignment to a resolved attribute, and a read-only resolver
 					// (a scalar @computed has no attribute.set) has nowhere to put it (harper#2359).
 					if (!attribute.set) throw new ClientError(`${name} is a computed attribute and can not be assigned`);
+					assertWritable(this);
 					return attribute.set(this, related);
 				},
 				configurable: true,
@@ -188,7 +197,7 @@ export function assignTrackedAccessors(Target, typeDef, useFullPropertyProxy = f
 					}
 					const sourceValue = this.getRecord()?.[name];
 					if (sourceValue && typeof sourceValue === 'object') {
-						const updatedValue = trackObject(sourceValue, attribute);
+						const updatedValue = trackObject(sourceValue, attribute, this);
 						if (updatedValue) {
 							if (!changes) {
 								this._setChanges((changes = Object.create(null)));
@@ -288,7 +297,7 @@ function getProxiedProperty(target, name, receiver) {
 		}
 		const sourceValue = receiver.getRecord?.()?.[name];
 		if (sourceValue && typeof sourceValue === 'object') {
-			const updatedValue = trackObject(sourceValue);
+			const updatedValue = trackObject(sourceValue, undefined, receiver);
 			if (updatedValue) {
 				if (!changes) {
 					changes = Object.create(null);
@@ -303,6 +312,7 @@ function getProxiedProperty(target, name, receiver) {
 }
 function setProxiedProperty(target: any, name: string | symbol, value, receiver) {
 	if (typeof name === 'string') {
+		assertWritable(receiver);
 		let changes = receiver.getChanges?.();
 		if (!changes) {
 			changes = {};
@@ -315,7 +325,7 @@ function setProxiedProperty(target: any, name: string | symbol, value, receiver)
 	return true;
 }
 
-function trackObject(sourceObject: any, typeDef?: any) {
+function trackObject(sourceObject: any, typeDef?: any, writableOwner?: any) {
 	// lazily instantiate in case of recursive structures
 	let TrackedObject;
 	switch (sourceObject.constructor) {
@@ -326,18 +336,41 @@ function trackObject(sourceObject: any, typeDef?: any) {
 					typeDef.TrackedObject = TrackedObject = class extends GenericTrackedObject {};
 					assignTrackedAccessors(TrackedObject, typeDef);
 				}
-				return new TrackedObject(sourceObject);
+				return new TrackedObject(sourceObject, writableOwner);
 			} else {
-				return new GenericTrackedObject(sourceObject);
+				return new GenericTrackedObject(sourceObject, writableOwner);
 			}
 		case Array:
-			const trackedArray = new TrackedArray(sourceObject.length, sourceObject);
+			const trackedArray = new TrackedArray(sourceObject.length, sourceObject, writableOwner);
 			for (let i = 0, l = sourceObject.length; i < l; i++) {
 				let element = sourceObject[i];
-				if (element && typeof element === 'object') element = trackObject(element, typeDef?.elements);
+				if (element && typeof element === 'object') element = trackObject(element, typeDef?.elements, trackedArray);
 				trackedArray[i] = element;
 			}
-			return trackedArray;
+			if (!writableOwner) return trackedArray;
+			return new Proxy(trackedArray, {
+				set(target, name, value) {
+					if (typeof name === 'string') {
+						assertWritable(target);
+						target[HAS_ARRAY_CHANGES] = true;
+					}
+					return Reflect.set(target, name, value, target);
+				},
+				defineProperty(target, name, descriptor) {
+					if (typeof name === 'string') {
+						assertWritable(target);
+						target[HAS_ARRAY_CHANGES] = true;
+					}
+					return Reflect.defineProperty(target, name, descriptor);
+				},
+				deleteProperty(target, name) {
+					if (typeof name === 'string') {
+						assertWritable(target);
+						target[HAS_ARRAY_CHANGES] = true;
+					}
+					return Reflect.deleteProperty(target, name);
+				},
+			});
 		// any other objects (like Date) are left unchanged
 		default:
 			return sourceObject;
@@ -346,10 +379,20 @@ function trackObject(sourceObject: any, typeDef?: any) {
 export class GenericTrackedObject<T extends object = any> {
 	#record: T;
 	#changes: Partial<T>;
-	constructor(sourceObject?: GenericTrackedObject<T> | T) {
+	#writableOwner: any;
+	#writableGeneration: any;
+	constructor(sourceObject?: GenericTrackedObject<T> | T, writableOwner?: any) {
 		if ((sourceObject as GenericTrackedObject<T>)?.getRecord)
 			throw new Error('Can not track an already tracked object, check for circular references');
 		this.#record = sourceObject as any;
+		this.#writableOwner = writableOwner;
+		this.#writableGeneration = writableOwner?.[GET_TRACKED_WRITE_GENERATION]?.();
+	}
+	[ASSERT_TRACKED_WRITABLE]() {
+		this.#writableOwner?.[ASSERT_TRACKED_WRITABLE]?.(this.#writableGeneration);
+	}
+	[GET_TRACKED_WRITE_GENERATION]() {
+		return this.#writableGeneration;
 	}
 	getRecord(): T {
 		return this.#record;
@@ -404,18 +447,13 @@ export function updateAndFreeze(target, changes = target.getChanges?.()) {
 	let mergedUpdatedObject: any;
 	if (!target) return changes;
 	if (target.getRecord && target.constructor === Array && !Object.isFrozen(target)) {
-		// a tracked array, by default we can freeze the tracked array itself
-		mergedUpdatedObject = target;
+		if (!hasChanges(target)) return (target as any).getRecord();
+		// Materialize a plain array so the stored value retains neither the mutation proxy nor its owner.
+		mergedUpdatedObject = new Array(target.length);
 		for (let i = 0, l = target.length; i < l; i++) {
 			let value = target[i];
 			if (value && typeof value === 'object') {
-				const newValue = updateAndFreeze(value);
-				if (newValue !== value && mergedUpdatedObject === target) {
-					// if we need to make any changes to the user's array, we make a copy so we don't modify
-					// an array that the user may be using with transient properties
-					mergedUpdatedObject = target.slice(0);
-				}
-				value = newValue;
+				value = updateAndFreeze(value);
 			}
 			mergedUpdatedObject[i] = value;
 		}
@@ -493,15 +531,28 @@ export function hasChanges(target) {
 }
 
 const HAS_ARRAY_CHANGES = Symbol.for('has-array-changes');
+const TRACKED_ARRAY_RECORD = Symbol('tracked-array-record');
+const TRACKED_WRITABLE_OWNER = Symbol('tracked-writable-owner');
+const TRACKED_WRITABLE_GENERATION = Symbol('tracked-writable-generation');
 class TrackedArray extends Array {
-	#record: any;
+	[TRACKED_ARRAY_RECORD]: any;
+	[TRACKED_WRITABLE_OWNER]: any;
+	[TRACKED_WRITABLE_GENERATION]: any;
 	[HAS_ARRAY_CHANGES]: boolean;
-	constructor(length, record) {
+	constructor(length, record, writableOwner) {
 		super(length);
-		this.#record = record;
+		this[TRACKED_ARRAY_RECORD] = record;
+		this[TRACKED_WRITABLE_OWNER] = writableOwner;
+		this[TRACKED_WRITABLE_GENERATION] = writableOwner?.[GET_TRACKED_WRITE_GENERATION]?.();
+	}
+	[ASSERT_TRACKED_WRITABLE]() {
+		this[TRACKED_WRITABLE_OWNER]?.[ASSERT_TRACKED_WRITABLE]?.(this[TRACKED_WRITABLE_GENERATION]);
+	}
+	[GET_TRACKED_WRITE_GENERATION]() {
+		return this[TRACKED_WRITABLE_GENERATION];
 	}
 	getRecord() {
-		return this.#record;
+		return this[TRACKED_ARRAY_RECORD];
 	}
 	splice(...args) {
 		this[HAS_ARRAY_CHANGES] = true;

package/security/jsLoader.ts

@@ -32,6 +32,7 @@ import {
 } from 'node:fs';
 import { EventEmitter } from 'node:events';
 import { whenComponentsLoaded } from '../server/threads/threadServer.js';
+import { thisThreadOwnsApplication } from '../server/threads/isolatedApplications.ts';
 
 type Lockdown = 'none' | 'freeze' | 'ses' | 'freeze-after-load';
 const APPLICATIONS_LOCKDOWN: Lockdown = env.get(CONFIG_PARAMS.APPLICATIONS_LOCKDOWN);
@@ -893,13 +894,14 @@ function scopedDatabaseBindings(scope: ApplicationScope): { databases: any; tabl
 }
 
 /**
- * `defineTable` for a branched application registers through that application's table factory, so
- * a branched name lands in its branch; an unbranched application gets `defineTable` itself.
+ * `defineTable` for a branched or isolated application registers through that application's table
+ * factory, so a branched name lands in its branch and an isolated schema is tagged with its owner.
  */
 function scopedDefineTable(scope: ApplicationScope): typeof defineTable {
 	const branches = scope.branches;
-	if (!branches?.size) return defineTable;
-	const declareTable = scopedTableFactory(branches);
+	const isolatedApplicationOwner = thisThreadOwnsApplication(scope.name);
+	if (!branches?.size && !isolatedApplicationOwner) return defineTable;
+	const declareTable = scopedTableFactory(branches, isolatedApplicationOwner);
 	return function (name: string, shape: any, options?: any) {
 		return defineTableUsing(declareTable, name, shape, options);
 	} as typeof defineTable;