@harperfast/harper 5.3.0 → 5.3.1

package/dist/resources/DatabaseTransaction.js

@@ -49,6 +49,7 @@ exports.replicationConfirmation = replicationConfirmation;
 exports.transactionOpenTooLongError = transactionOpenTooLongError;
 exports.getReadTransactionGuard = getReadTransactionGuard;
 exports.trackReadRange = trackReadRange;
+exports.requestAbortedError = requestAbortedError;
 exports.closeWriteInstance = closeWriteInstance;
 exports.validateWrite = validateWrite;
 exports.getAppliedWriteVersion = getAppliedWriteVersion;
@@ -57,6 +58,7 @@ exports.writeKeyId = writeKeyId;
 exports.shouldSpareCommitPhase = shouldSpareCommitPhase;
 exports.isReleasedTransaction = isReleasedTransaction;
 exports.isJoinableScope = isJoinableScope;
+exports.deferForCommitInFlight = deferForCommitInFlight;
 exports.resetReplayedWritesWarning = resetReplayedWritesWarning;
 exports.setMaxOutstandingTxnDuration = setMaxOutstandingTxnDuration;
 exports.isWriteSupervised = isWriteSupervised;
@@ -79,6 +81,7 @@ const trackedTxns = new Set();
 const readTransactionOwners = new WeakMap();
 // Read options for a rotated generation's native transactions; shared because they never vary.
 const SNAPSHOT_FREE = Object.freeze({ disableSnapshot: true });
+const ONCE = Object.freeze({ once: true });
 // Logical transactions the monitor supervises for their WRITES, kept apart from trackedTxns because the
 // two have different units and different consumers: trackedTxns is per-link, bounds a read snapshot, and
 // is what the read-queue-depth metric counts, while this holds one entry per logical transaction — the
@@ -500,6 +503,10 @@ function trackReadRange(transaction, createRange) {
     };
     return range;
 }
+function requestAbortedError() {
+    // 499 (client closed request) rather than a retryable 503/408: no client is left to retry.
+    return new hdbError_ts_1.ServerError('Transaction was aborted because the client disconnected', 499);
+}
 function closeWriteInstance(operation) {
     if (operation && !operation.instanceClosed) {
         operation.instanceClosed = true;
@@ -552,6 +559,11 @@ function writeKeyId(key) {
         return key;
     return (0, ordered_binary_1.toBufferKey)(key).toString('latin1');
 }
+function clearAttemptState(txn) {
+    txn.poisonedMidCommit = false;
+    txn.postSubmitPoisoned = false;
+    txn.stalledCommitResourcesReleased = false;
+}
 class DatabaseTransaction {
     #context;
     // Whether a resources/transaction.ts scope owns this instance — i.e. a final commit or abort is
@@ -611,6 +623,20 @@ class DatabaseTransaction {
                 txn.commitPhaseTicks = 0;
         }
     }
+    // Depth of commit() attempts on this link that have not reached a native outcome.
+    commitsInFlight = 0;
+    // Per-link submission state. A commit method can still be parked in pre-commit work, where an abort
+    // is safe; once storage work has been submitted, its outcome is unknown and monitor cleanup must not
+    // clear writes or blobs that the eventual commit can reference.
+    nativeCommitSubmitted = false;
+    // Root-only aggregate, retained until every attempt in the multi-store chain settles. An earlier
+    // link can have submitted before a later link parks in pre-commit work, so a per-link check alone
+    // cannot prove that aborting the logical transaction is safe.
+    commitSubmitted = false;
+    // Keeps even a single-link submitted commit visible to the long-transaction monitor after its
+    // native handle has been detached from the read registry.
+    submittedCommitSupervised = false;
+    committingWrites = false;
     rangeReadActive = false;
     renewReadTimeout() {
         // The limit is an IDLE limit. Writes always re-arm it (see addWrite), but reads only do so
@@ -658,6 +684,8 @@ class DatabaseTransaction {
             coordinatedRetry: true,
             disableSnapshot: disableSnapshot || this.snapshotFree,
         }));
+        if (disableSnapshot || this.snapshotFree)
+            this.transaction.snapshotDisabled = true;
         if (this.timestamp) {
             this.transaction.setTimestamp(this.timestamp);
         }
@@ -710,6 +738,8 @@ class DatabaseTransaction {
             if (link.writeSupervised)
                 return;
         }
+        if (root.submittedCommitSupervised)
+            return;
         supervisedWriteRoots.delete(root);
     }
     detachOwnedTransaction() {
@@ -723,6 +753,49 @@ class DatabaseTransaction {
         this.handleOpenedAt = 0;
         return transaction;
     }
+    /**
+     * Record that `iterator` owes a doneReadTxn(). Without the record, a retained handle's only
+     * reclamation path is an onDone() an abandoned request leaves nobody to call.
+     */
+    registerReadIterator(iterator) {
+        // A transaction with no handle of its own (an ImmediateTransaction, which a context reuses for
+        // every search it makes) has nothing to reclaim and is in no monitor's registry, so an entry here
+        // would never be swept — it would just pin every partially-consumed result set on that context.
+        if (!this.transaction && !this.readTxn)
+            return;
+        (this.ownedReadIterators ??= new Set()).add(iterator);
+    }
+    unregisterReadIterator(iterator) {
+        this.ownedReadIterators?.delete(iterator);
+    }
+    /**
+     * Close every read iterator this transaction still owns, returning how many references came back.
+     * Idempotent — each onDone() clears itself — but only safe once nothing can still be consuming them.
+     */
+    closeOwnedReadIterators() {
+        let closed = 0;
+        // The whole multi-store chain: a handler that searched a second database registered that
+        // iterator on the `next` link that owns its handle, not on the head.
+        for (let txn = this; txn; txn = txn.next) {
+            const iterators = txn.ownedReadIterators;
+            if (!iterators?.size)
+                continue;
+            // Snapshot first: onDone() deregisters, mutating the set as we walk it.
+            for (const iterator of [...iterators]) {
+                iterators.delete(iterator);
+                try {
+                    if (iterator.onDone) {
+                        iterator.onDone();
+                        closed++;
+                    }
+                }
+                catch (error) {
+                    harperLogger.warn?.('Failed to close a read iterator owned by an abandoned transaction', error);
+                }
+            }
+        }
+        return closed;
+    }
     useReadTxn(disableSnapshot) {
         const readTxn = this.getReadTxn(disableSnapshot);
         // stackTraces is seeded by the same getReadTxn branch that registers the transaction with
@@ -759,6 +832,17 @@ class DatabaseTransaction {
             this.completeDeferredContextRelease();
         }
     }
+    releaseRetainedWriteIntents() {
+        if (this.writesAbandoned)
+            return;
+        this.writesAbandoned = true;
+        try {
+            this.transaction?.abandonWrites?.();
+        }
+        catch (error) {
+            harperLogger.warn?.('Failed to release write intents on a retained read transaction', error);
+        }
+    }
     /**
      * Force-release the retained native read handle without touching staged writes. Used by the
      * long-transaction monitor for a CLOSED (already-acknowledged) transaction whose iterators have
@@ -1051,8 +1135,11 @@ class DatabaseTransaction {
             completion.then(undefined, (error) => harperLogger.warn?.('A staged transaction completion failed after the transaction was aborted', error));
     }
     addWrite(operation) {
-        if (this.timedOut)
+        if (this.timedOut || this.postSubmitPoisoned)
             throw transactionOpenTooLongError();
+        if (this.disconnected)
+            throw requestAbortedError();
+        this.admitRequestWrite();
         // A write is activity: it re-arms the idle limit on this link even though the reads it
         // performs no longer do (see getReadTxn), so a transaction that keeps writing stays alive
         // and only an idle one holding write intents is reaped.
@@ -1091,6 +1178,20 @@ class DatabaseTransaction {
         return operation;
     }
     save(operation, transaction, reloadEntry = false, options) {
+        if (!transaction && !options) {
+            if (this.timedOut || this.postSubmitPoisoned)
+                throw transactionOpenTooLongError();
+            if (this.disconnected)
+                throw requestAbortedError();
+            // A deferred save is staged by addWrite() but admitted again when it is finally saved.
+            this.admitRequestWrite();
+        }
+        if (!transaction && this.open !== exports.TRANSACTION_STATE.OPEN) {
+            if (this.timedOut || this.postSubmitPoisoned)
+                throw transactionOpenTooLongError();
+            if (this.disconnected)
+                throw requestAbortedError();
+        }
         const lockHandle = operation.lockHandle;
         // Guard: a write staged through an expired or released lock handle must not land.
         // The handle's lease timer already unlocked the native key; another holder may have taken it.
@@ -1195,10 +1296,21 @@ class DatabaseTransaction {
         // against; a snapshot-free transaction (this.snapshotFree, after a mid-scope-commit rotation)
         // has no snapshot for rocksdb-js to validate the Put against, so it only narrows the window to
         // the read-to-put span rather than closing it (open follow-up, tracked in the PR description).
-        // Replays keep their pre-read base — their convergence contract is the replay pass itself.
+        // Replay bypasses the cache: WeakRef targets survive the entire synchronous job, even after eviction.
         const reloadsCommitBase = operation.reloadCommitBase && !operation.saved && !this.isReplay;
-        if (reloadEntry || operation.entry === undefined || reloadsCommitBase) {
-            const uncachedRead = (!!operation.reloadCommitBase && !this.isReplay) || reloadEntry;
+        // An entry read uncached through this same pinned-snapshot handle is already that base, until a retry resets
+        // the snapshot or an earlier staged write to the key changes what a read returns; the resource withholds the
+        // handle once its entry was replaced or evicted, and locked, snapshot-free and replayed writes always reload.
+        const reusesBaseRead = operation.baseReadTxn === transaction &&
+            this.retries === 0 &&
+            !reloadEntry &&
+            !operation.priorWrite &&
+            !operation.lockHandle &&
+            !this.snapshotFree &&
+            !transaction.snapshotDisabled &&
+            !this.isReplay;
+        if (!reusesBaseRead && (reloadEntry || operation.entry === undefined || reloadsCommitBase)) {
+            const uncachedRead = !!operation.reloadCommitBase || reloadEntry || this.isReplay;
             operation.entry = operation.store.getEntry(operation.key, { transaction, uncachedRead });
         }
         if (!operation.saved) {
@@ -1253,11 +1365,44 @@ class DatabaseTransaction {
         }
     }
     /**
-     * Resolves with information on the timestamp and success of the commit
+     * Whether any link of this multi-store chain has a commit attempt that has not reached a native
+     * outcome. Asked of the whole chain, not just this link: the head commits its own writes and then
+     * cascades into `next`, so that cascade is a continuation of one logical commit, not a fresh one.
+     * Walked from here as well when a settling commit has already detached this link from that chain.
+     */
+    isChainCommitting() {
+        let attached = false;
+        const root = this.root ?? this;
+        for (let txn = root; txn; txn = txn.next) {
+            if (txn.commitsInFlight)
+                return true;
+            if (txn === this)
+                attached = true;
+        }
+        if (submittedCommitStillInFlight(root))
+            return true;
+        if (attached)
+            return false;
+        // Only a link a settling commit already detached needs its own walk, and its own attempt is
+        // exactly the one that must not be torn out from under it. The ordinary case — asked of the root,
+        // or of a link still on the chain — is answered by the single walk above.
+        for (let txn = this; txn; txn = txn.next) {
+            if (txn.commitsInFlight)
+                return true;
+        }
+        return false;
+    }
+    /**
+     * A submitted native write is this transaction's point of no destructive return. Only a FRESH
+     * attempt — none already in flight, and no `options.transaction` from an immediate-commit re-entry —
+     * is rejected by the poison flags. Everything that continues an already-submitted attempt (a
+     * RETRY_NOW/ERR_BUSY/ERR_TRY_AGAIN recursion, the extra-writes recursion inside performCommit) must
+     * reach its native outcome instead of abandoning unknown state; a poison that lands before submission
+     * can still abort safely (see abortAndPoison).
+     *
+     * Resolves with information on the timestamp and success of the commit.
      */
     commit(options = {}) {
-        if (this.timedOut)
-            throw transactionOpenTooLongError();
         if (this.monitorCommit && !options.transaction) {
             return this.monitorCommit.then(() => this.commit(options), (error) => {
                 // The failed commit ran its terminal cleanup, but as a non-final commit it kept the context.
@@ -1268,6 +1413,233 @@ class DatabaseTransaction {
                 throw error;
             });
         }
+        if (!(options.transaction && this.commitsInFlight) && !(options.continuation && this.poisonedMidCommit)) {
+            if (this.timedOut || this.postSubmitPoisoned)
+                throw transactionOpenTooLongError();
+            if (this.disconnected)
+                throw requestAbortedError();
+        }
+        this.commitsInFlight = (this.commitsInFlight ?? 0) + 1;
+        // Only a top-level attempt records the intent: a continuation would re-read hasPendingWrites()
+        // after clearWrites() has already emptied it.
+        if (this.commitsInFlight === 1 && !options.continuation && this.hasPendingWrites()) {
+            (this.root ?? this).committingWrites = true;
+        }
+        let resolution;
+        try {
+            resolution = this.performCommit(options);
+        }
+        catch (error) {
+            this.endCommitAttempt();
+            throw error;
+        }
+        if (!resolution?.then) {
+            this.endCommitAttempt();
+            return resolution;
+        }
+        return resolution.then((settled) => {
+            this.endCommitAttempt();
+            return settled;
+        }, (error) => {
+            this.endCommitAttempt();
+            throw error;
+        });
+    }
+    markNativeCommitSubmitted() {
+        this.nativeCommitSubmitted = true;
+        const root = this.root ?? this;
+        root.commitSubmitted = true;
+        if (!root.submittedLink)
+            root.submittedLink = this;
+        else if (root.submittedLink !== this)
+            (root.submittedLinks ??= new Set()).add(this);
+        // LMDB has its own monitor registry and overrides this method to enroll there. Do not put an
+        // LMDB link into the RocksDB monitor as well (stagesWriteOnSave is the engine discriminator).
+        if (this.stagesWriteOnSave) {
+            root.submittedCommitSupervised = true;
+            supervisedWriteRoots.add(root);
+        }
+    }
+    /** Engine hook for a submission that has reached a native outcome. */
+    nativeCommitAttemptEnded() { }
+    /**
+     * True when a commit attempt is parked on this link that can no longer land: it never submitted, and
+     * the link is poisoned, so performCommit()'s post-await poison check throws before it commits. The
+     * monitor's commit-phase grace exists to let real pre-commit work finish; extending it to an attempt
+     * with no outcome left only pins this link's read snapshot for the rest of the grace.
+     */
+    commitAttemptDoomedByPoison() {
+        return !this.nativeCommitSubmitted && !this.poisonedMidCommit && Boolean(this.timedOut || this.disconnected);
+    }
+    /**
+     * Admission for a new write on behalf of a request. A request already cancelled poisons the chain
+     * (releasing whatever it staged) and is refused; otherwise the chain subscribes to the cancellation
+     * for as long as it owns writes, so a disconnect releases its intents at once instead of when its
+     * scope or pre-commit work happens to finish. Reads never subscribe.
+     */
+    admitRequestWrite() {
+        const root = this.root ?? this;
+        const signal = root.requestSignal;
+        if (!signal)
+            return;
+        if (signal.aborted) {
+            this.abortDueToDisconnect();
+            throw requestAbortedError();
+        }
+        if (root.requestAbortListener)
+            return;
+        const listener = () => {
+            root.requestAbortListener = undefined;
+            try {
+                // isCommittingWrites() is not redundant: commit() marks itself CLOSED and clears its staged
+                // writes before the native commit settles, so for that window the chain reads as idle.
+                if ((root.open === exports.TRANSACTION_STATE.OPEN && root.hasPendingWrites()) || root.isCommittingWrites())
+                    root.abortDueToDisconnect();
+            }
+            catch (error) {
+                harperLogger.debug?.('aborting transaction on client disconnect', error);
+            }
+        };
+        root.requestAbortListener = listener;
+        signal.addEventListener('abort', listener, ONCE);
+    }
+    releaseRequestAbortListener() {
+        const listener = this.requestAbortListener;
+        if (!listener)
+            return;
+        this.requestAbortListener = undefined;
+        this.requestSignal.removeEventListener('abort', listener);
+    }
+    /** Protected work has no proven resume path, so the monitor may observe but never poison it. */
+    isProtectedCommit() {
+        const root = this.root ?? this;
+        let attached = false;
+        for (let txn = root; txn; txn = txn.next) {
+            if (txn.sourceApply || txn.isReplay)
+                return true;
+            if (txn === this)
+                attached = true;
+        }
+        return !attached && Boolean(this.sourceApply || this.isReplay);
+    }
+    /**
+     * Reclaim only read resources that are separate from already-submitted writes. Never run this on a
+     * pre-submit link: its native read handle can still carry the write batch the commit needs.
+     */
+    releaseStalledCommitReadResources() {
+        const release = (txn) => {
+            if (!txn.nativeCommitSubmitted || txn.stalledCommitResourcesReleased)
+                return;
+            txn.stalledCommitResourcesReleased = true;
+            if (txn.closeOwnedReadIterators() > 0)
+                harperLogger.warn?.(`Read iterators held a submitted transaction's snapshot after its native commit stalled; releasing it, from table: ${txn.db?.name}`);
+            if (txn.transaction || txn.readTxn)
+                txn.releaseReadTxn();
+        };
+        const root = this.root ?? this;
+        let attached = false;
+        for (let txn = root; txn; txn = txn.next) {
+            release(txn);
+            if (txn === this)
+                attached = true;
+        }
+        if (!attached)
+            release(this);
+    }
+    endCommitAttempt() {
+        this.commitsInFlight--;
+        if (!this.commitsInFlight) {
+            this.nativeCommitSubmitted = false;
+            this.nativeCommitAttemptEnded();
+        }
+        // A link closes its OWN iterators the moment its own attempt settles, without waiting for the
+        // chain: LMDBTransaction's commit detaches `next` before awaiting the child, so a scope abandoned
+        // in that window never captured this link and the chain-wide cleanup below cannot reach it. Safe
+        // here and not earlier because this link's attempt is the one that just reached its outcome.
+        if ((this.root ?? this).scopeAbandoned)
+            this.closeOwnedReadIterators();
+        if (this.isChainCommitting())
+            return;
+        // The window has closed: a commit entered from here on is a fresh one, and the flags that landed
+        // during the finished attempt must reject it like any other poisoned commit.
+        const root = this.root ?? this;
+        root.committingWrites = false;
+        root.commitSubmitted = false;
+        root.submittedCommitSupervised = false;
+        root.deferredPoisonDeadline = undefined;
+        root.unsubmittedCommitDeadline = undefined;
+        root.stalledCommitLogged = false;
+        const submittedLink = root.submittedLink;
+        root.submittedLink = undefined;
+        const submittedLinks = root.submittedLinks;
+        root.submittedLinks = undefined;
+        if (submittedLink)
+            clearAttemptState(submittedLink);
+        if (submittedLinks)
+            for (const txn of submittedLinks)
+                clearAttemptState(txn);
+        let stillWriteSupervised = false;
+        for (let txn = root; txn; txn = txn.next) {
+            clearAttemptState(txn);
+            if (txn.writeSupervised)
+                stillWriteSupervised = true;
+        }
+        if (!stillWriteSupervised)
+            supervisedWriteRoots.delete(root);
+        if (!root.hasPendingWrites())
+            root.releaseRequestAbortListener();
+        if (root.scopeAbandoned) {
+            root.scopeAbandoned = false;
+            // The links captured when the scope was abandoned, not the current `next` chain: a successful
+            // multi-store commit clears `next` before this runs, which would otherwise leave a former
+            // child's iterators owning a snapshot nothing can reach.
+            const abandoned = root.abandonedLinks;
+            root.abandonedLinks = undefined;
+            if (abandoned)
+                for (const link of abandoned)
+                    link.closeOwnedReadIterators();
+            else
+                root.closeOwnedReadIterators();
+        }
+    }
+    /**
+     * The scope that owned this transaction ended while a commit attempt was still in flight, so the
+     * wrapper could not abort it. Surrender scope ownership now, or the attempt's own
+     * rotateAfterMidScopeCommit reopens an instance with no wrapper left to commit or abort it and the
+     * next transaction() on that context joins it and never commits. Iterator cleanup is deferred to
+     * endCommitAttempt(), since closing them mid-attempt can pull the handle the commit is still
+     * staging through.
+     */
+    abandonScope() {
+        const root = this.root ?? this;
+        root.scopeAbandoned = true;
+        const links = [];
+        for (let txn = this; txn; txn = txn.next) {
+            links.push(txn);
+            txn.endScopeOwnership();
+            // Ending ownership alone only stops the attempt's own rotation; until it reaches its native
+            // outcome the instance is still OPEN, and a hung `before` hook makes that window arbitrarily
+            // long. Submitted attempts are monitor-deferred; a pre-submit attempt remains safely abortable.
+            // Not on its own sufficient:
+            // LMDBTransaction's own commit reassigns `open`, so the release below is what actually keeps
+            // the next write on this context off an instance with no wrapper behind it.
+            txn.open = exports.TRANSACTION_STATE.CLOSED;
+        }
+        root.abandonedLinks = links;
+        // By abort()'s own rule, so a poisoned chain stays joined and throws while an ordinary one lets
+        // the next write start fresh.
+        this.releaseContext(!this.timedOut && !this.disconnected);
+    }
+    /**
+     * Whether this chain has a write-bearing commit attempt in flight. `hasPendingWrites()` cannot
+     * answer that: commit() marks itself CLOSED and clears its staged writes well before the native
+     * commit settles, so between those points a write-bearing transaction looks read-only and idle to
+     * anything reading its public state — including transaction.ts's disconnect listener.
+     */
+    isCommittingWrites() {
+        return Boolean((this.root ?? this).committingWrites) && this.isChainCommitting();
+    }
+    performCommit(options = {}) {
         // reused across retries — the native layer resets it in place (fresh snapshot) on IsBusy/TryAgain —
         // but reassigned to a fresh replay transaction when outstanding read iterators retain this.transaction
         let transaction = options.transaction ?? this.transaction;
@@ -1295,447 +1667,455 @@ class DatabaseTransaction {
         if (completions.length > 0) {
             this.setCommitPhase(true);
         }
-        return (0, when_ts_1.when)(completions.length > 0 ? Promise.all(completions) : null, () => {
-            if (completions.length > 0)
-                this.setCommitPhase(false);
-            // The transaction can be aborted underneath us while we are parked in the await above — by the
-            // monitor once the commit phase outlives its grace, or through the multi-store poison chain.
-            // abort() cleared the write set and released the handle, so resuming would commit nothing and
-            // resolve as SUCCESS: the caller is told its write landed when it was dropped, and a write
-            // carrying a blob is left holding an instance whose file was unlinked (issue #2062).
-            if (this.timedOut)
-                throw transactionOpenTooLongError();
-            if (stagedWrites > 0 && this.writes.length === 0 && this.open === exports.TRANSACTION_STATE.CLOSED)
-                throw new hdbError_ts_1.ServerError('Transaction was aborted while its commit was waiting on pre-commit work', 500);
-            if (this.writes.length > this.validated) {
-                // check just in case we got any more transactions while we were waiting, if so just recursively continue to finish the additional writes now
-                return this.commit(options);
-            }
-            // The save loop above can be what opened this transaction's native handle — save() attaches
-            // one when it had none, which is every ImmediateTransaction commit since its getReadTxn
-            // opens none — leaving the local captured before the loop empty while that handle holds
-            // every staged write, for the detach below to drop uncommitted (issue #2288). Only when
-            // the local is empty: a truthy one is what the loop staged into, and the retained-handle
-            // and replay branches below deliberately commit a handle other than this.transaction.
-            if (!transaction)
-                transaction = this.transaction;
-            if (!options.transaction && this.writes.some((write) => write))
-                this.renewChainForNativeCommit();
-            this.open = exports.TRANSACTION_STATE.CLOSED;
-            // RocksTransaction.commit() resolves with RETRY_NOW_VALUE (a number) under
-            // coordinatedRetry, or void on a normal commit/abort.
-            let commitResolution;
-            // Consume this commit's own read reference — exactly once per read handle: retry
-            // recursions, immediate-commit re-entries, and a second top-level commit() (wrapper
-            // commit after an explicit in-handler commit) must not steal a reference owned by an
-            // outstanding iterator (doneReadTxn() would then never release the native handle).
-            if (!this.baseReadRefConsumed) {
-                this.baseReadRefConsumed = true;
-                this.readTxnsUsed--;
-            }
-            if (this.readTxnsUsed > 0) {
-                // Outstanding iterators still stream through this.transaction — their native iterators
-                // live inside it (GetIterator wraps its write batch + snapshot), so committing or
-                // aborting the handle now would invalidate them mid-stream. Leave it open for the
-                // iterators (doneReadTxn() aborts it when the last one finishes) and commit the writes
-                // NOW by replaying them onto a fresh transaction, the same shape as the ERR_TRY_AGAIN
-                // replay below: entries reload through the new transaction and re-resolve against
-                // current state, and conflicts surface through the normal retry ladder. Deferring the
-                // native commit to doneReadTxn() instead (the old LINGERING state) meant anything that
-                // kept the last iterator from finishing cleanly — a hung stream, the long-transaction
-                // monitor's timeout abort — dropped writes the caller had already been told committed.
-                this.writes = this.writes.filter((write) => write); // filter out removed entries
-                if (this.writes.length > 0) {
-                    if (!options.transaction) {
-                        if (!replayedWritesWarned) {
-                            replayedWritesWarned = true;
-                            harperLogger.warn?.(`Committing while read iterators are still open: ${this.writes.length} staged write(s) must be re-staged and committed on a second transaction, doubling their write work` +
-                                (this.startedFrom ? `, from ${this.startedFrom.resourceName}.${this.startedFrom.method}` : '') +
-                                `. Fully consume (or close) iterators before committing to avoid this. Logged once per process.`);
-                        }
-                        // Deliberately NOT marked isRetry and NOT carrying over the original's onCommit:
-                        // audit/txn-log entries batch natively on the transaction they were staged into and
-                        // are only durably written by that transaction's commit attempt (an abort discards
-                        // them — unlike the ERR_TRY_AGAIN replay below, where the original's FAILED commit
-                        // attempt already wrote its log batch). The original handle here never attempts a
-                        // commit, so the replayed stagings must re-append their entries into the replay
-                        // transaction's own batch — which also installs the replay's own commit hook.
-                        const replayTransaction = new rocksdb_js_1.Transaction((this.writes[0].store.store ?? this.db.store), { coordinatedRetry: true });
-                        if (this.timestamp)
-                            replayTransaction.setTimestamp(this.timestamp);
-                        this.retries++; // a replay round: commit handlers re-base on the reloaded entries
-                        try {
-                            for (const operation of this.writes) {
-                                this.save(operation, replayTransaction, true, options);
-                            }
-                        }
-                        catch (error) {
-                            abortNativeTransaction(replayTransaction, 'aborting a replay transaction whose re-save threw');
-                            this.abort();
-                            throw error;
-                        }
-                        transaction = replayTransaction;
-                    }
-                    // with options.transaction set this is a retry round — the save loop above already
-                    // re-staged the writes into it
-                    this.assertDatabaseCommitAllowed(transaction);
-                    commitResolution = transaction.commit();
-                    recordCommitLatency(commitResolution, performance.now());
-                    // Write-queue-depth accounting for this replay commit happens uniformly below, via
-                    // trackOutstandingCommit(commitResolution) — see that function's comment. Omitting
-                    // dedicated accounting here (as a prior version of this replay path did) used to leave
-                    // write-transaction-queue-depth, the one metric that can observe a commit that never
-                    // settles (harper#2001), reading zero for exactly this path.
+        let commitResult;
+        try {
+            commitResult = (0, when_ts_1.when)(completions.length > 0 ? Promise.all(completions) : null, () => {
+                if (completions.length > 0)
+                    this.setCommitPhase(false);
+                // The transaction can be aborted underneath us while we are parked in the await above — by the
+                // monitor once the commit phase outlives its grace, or through the multi-store poison chain.
+                // abort() cleared the write set and released the handle, so resuming would commit nothing and
+                // resolve as SUCCESS: the caller is told its write landed when it was dropped, and a write
+                // carrying a blob is left holding an instance whose file was unlinked (issue #2062).
+                if (!this.poisonedMidCommit) {
+                    if (this.timedOut)
+                        throw transactionOpenTooLongError();
+                    if (this.disconnected)
+                        throw requestAbortedError();
                 }
-                // No commit will ever run on the retained handle — the replay above owns these
-                // writes — so this is the only place its write intents can be released. Left in
-                // place, other writers' coordinated-retry commits park on them until the last
-                // iterator finishes (harper#2001). Reads through the handle, including
-                // read-your-own-writes, keep working. Once only: a coordinated-retry or backoff
-                // round re-enters this branch on the same retained handle. Fenced like the other
-                // post-submit steps here: the replay commit is already in flight, so a throw must
-                // not skip onCommit/the chain-store commit below. Optional: rocksdb-js < 2.7
-                // lacks the method.
-                if (!this.writesAbandoned) {
-                    this.writesAbandoned = true;
-                    try {
-                        this.transaction?.abandonWrites?.();
-                    }
-                    catch (error) {
-                        harperLogger.warn?.('Failed to release write intents on a retained read transaction', error);
-                    }
+                if (stagedWrites > 0 && this.writes.length === 0 && this.open === exports.TRANSACTION_STATE.CLOSED)
+                    throw new hdbError_ts_1.ServerError('Transaction was aborted while its commit was waiting on pre-commit work', 500);
+                if (this.writes.length > this.validated) {
+                    // check just in case we got any more transactions while we were waiting, if so just recursively continue to finish the additional writes now
+                    return this.commit({ ...options, continuation: true });
                 }
-            }
-            else {
-                // no more reads need to be performed, just commit/abort based if there are any writes
-                this.detachOwnedTransaction(); // any further operations operate immediately
-                if (transaction) {
+                // The save loop above can be what opened this transaction's native handle — save() attaches
+                // one when it had none, which is every ImmediateTransaction commit since its getReadTxn
+                // opens none — leaving the local captured before the loop empty while that handle holds
+                // every staged write, for the detach below to drop uncommitted (issue #2288). Only when
+                // the local is empty: a truthy one is what the loop staged into, and the retained-handle
+                // and replay branches below deliberately commit a handle other than this.transaction.
+                if (!transaction)
+                    transaction = this.transaction;
+                if (!options.transaction && this.writes.some((write) => write))
+                    this.renewChainForNativeCommit();
+                this.open = exports.TRANSACTION_STATE.CLOSED;
+                // RocksTransaction.commit() resolves with RETRY_NOW_VALUE (a number) under
+                // coordinatedRetry, or void on a normal commit/abort.
+                let commitResolution;
+                // Consume this commit's own read reference — exactly once per read handle: retry
+                // recursions, immediate-commit re-entries, and a second top-level commit() (wrapper
+                // commit after an explicit in-handler commit) must not steal a reference owned by an
+                // outstanding iterator (doneReadTxn() would then never release the native handle).
+                if (!this.baseReadRefConsumed) {
+                    this.baseReadRefConsumed = true;
+                    this.readTxnsUsed--;
+                }
+                if (this.readTxnsUsed > 0) {
+                    // Outstanding iterators still stream through this.transaction — their native iterators
+                    // live inside it (GetIterator wraps its write batch + snapshot), so committing or
+                    // aborting the handle now would invalidate them mid-stream. Leave it open for the
+                    // iterators (doneReadTxn() aborts it when the last one finishes) and commit the writes
+                    // NOW by replaying them onto a fresh transaction, the same shape as the ERR_TRY_AGAIN
+                    // replay below: entries reload through the new transaction and re-resolve against
+                    // current state, and conflicts surface through the normal retry ladder. Deferring the
+                    // native commit to doneReadTxn() instead (the old LINGERING state) meant anything that
+                    // kept the last iterator from finishing cleanly — a hung stream, the long-transaction
+                    // monitor's timeout abort — dropped writes the caller had already been told committed.
                     this.writes = this.writes.filter((write) => write); // filter out removed entries
                     if (this.writes.length > 0) {
-                        // Commit retries can construct fresh ranges on this live handle after read ownership ends.
-                        readTransactionOwners.delete(transaction);
-                        // Re-fence before submitting: the loop above skips operations already marked saved, so
-                        // save()'s own check cannot see a holder that stalled between staging and commit. The
-                        // retry/replay path re-saves every operation and is fenced there instead. Lease expiry
-                        // only: an unlock() inside the lease leaves the staged write valid, an elapsed lease
-                        // does not, whether or not the caller also unlocked.
-                        for (let i = 0; this.hasLeaseProtectedWrite && i < this.writes.length; i++) {
-                            const lapsed = this.writes[i].lockHandle;
-                            if (!lapsed?.isLeaseExpired())
-                                continue;
-                            try {
-                                transaction.abort();
+                        if (!options.transaction) {
+                            if (!replayedWritesWarned) {
+                                replayedWritesWarned = true;
+                                harperLogger.warn?.(`Committing while read iterators are still open: ${this.writes.length} staged write(s) must be re-staged and committed on a second transaction, doubling their write work` +
+                                    (this.startedFrom ? `, from ${this.startedFrom.resourceName}.${this.startedFrom.method}` : '') +
+                                    `. Fully consume (or close) iterators before committing to avoid this. Logged once per process.`);
                             }
-                            catch { }
-                            // Every other terminal exit from commit() runs the logical cleanup too. Throwing
-                            // straight out would strand the OTHER locks this transaction holds, its staged
-                            // blobs, and the context's back-reference to a CLOSED transaction — and
-                            // transaction()'s onComplete has no rejection path to run it later.
+                            // Deliberately NOT marked isRetry and NOT carrying over the original's onCommit:
+                            // audit/txn-log entries batch natively on the transaction they were staged into and
+                            // are only durably written by that transaction's commit attempt (an abort discards
+                            // them — unlike the ERR_TRY_AGAIN replay below, where the original's FAILED commit
+                            // attempt already wrote its log batch). The original handle here never attempts a
+                            // commit, so the replayed stagings must re-append their entries into the replay
+                            // transaction's own batch — which also installs the replay's own commit hook.
+                            const replayTransaction = new rocksdb_js_1.Transaction((this.writes[0].store.store ?? this.db.store), { coordinatedRetry: true });
+                            if (this.timestamp)
+                                replayTransaction.setTimestamp(this.timestamp);
+                            this.retries++; // a replay round: commit handlers re-base on the reloaded entries
                             try {
-                                this.abort();
+                                for (const operation of this.writes) {
+                                    this.save(operation, replayTransaction, true, options);
+                                }
                             }
                             catch (error) {
-                                harperLogger.debug?.('cleaning up a transaction whose record lock lapsed', error);
+                                abortNativeTransaction(replayTransaction, 'aborting a replay transaction whose re-save threw');
+                                this.abort();
+                                throw error;
                             }
-                            throw (0, recordLock_ts_1.lockNotHeldError)(lapsed);
+                            transaction = replayTransaction;
                         }
-                        // The transaction was created with coordinatedRetry:true (see
-                        // getReadTxn), so commit() can resolve to RETRY_NOW_VALUE. That
-                        // sentinel (a number) is why commitResolution is typed
-                        // Promise<number | void>; it is handled in the resolve callback below.
+                        // with options.transaction set this is a retry round — the save loop above already
+                        // re-staged the writes into it
                         this.assertDatabaseCommitAllowed(transaction);
+                        this.markNativeCommitSubmitted();
                         commitResolution = transaction.commit();
-                        // Record how long this commit stays outstanding (submit → settle) as a distribution
-                        // metric. This is the same clock the overload check uses (trackOutstandingCommit
-                        // stamps each attempt at submit), so a rising p99/p999 is the leading indicator for the
-                        // "Outstanding write transactions have too long of queue" (503) rejection. A transient-
-                        // conflict retry rejects this promise and issues a fresh commit(), which is tracked as
-                        // its own attempt, so recording per attempt matches the overload semantics.
-                        // commitResolution's declared type (Promise<number | void> | void) doesn't narrow to
-                        // Promise<void> here because the widening union defeats flow analysis on the prior
-                        // cast assignment; re-assert it — this branch's commit() result is always a Promise.
                         recordCommitLatency(commitResolution, performance.now());
-                        // Write-queue-depth accounting for this commit happens uniformly below, via
-                        // trackOutstandingCommit(commitResolution) — see that function's comment. A
-                        // transient-conflict retry rejects this promise and issues a fresh commit()
-                        // (re-entering here), which trackOutstandingCommit tracks as its own attempt.
-                    }
-                    else {
-                        try {
-                            commitResolution = transaction.abort();
-                        }
-                        catch {
-                            // The transaction has uncommitted writes that were already cleared from
-                            // this.writes by a concurrent immediate-commit path (e.g. writes made with
-                            // an explicitly-reused closed transaction). Those writes are handled by the
-                            // concurrent commit, so there is nothing left to do here.
-                        }
+                        // Write-queue-depth accounting for this replay commit happens uniformly below, via
+                        // trackOutstandingCommit(commitResolution) — see that function's comment. Omitting
+                        // dedicated accounting here (as a prior version of this replay path did) used to leave
+                        // write-transaction-queue-depth, the one metric that can observe a commit that never
+                        // settles (harper#2001), reading zero for exactly this path.
                     }
+                    // No commit will ever run on the retained handle — the replay above owns these
+                    // writes — so this is the only place its write intents can be released. Left in
+                    // place, other writers' coordinated-retry commits park on them until the last
+                    // iterator finishes (harper#2001). Reads through the handle, including
+                    // read-your-own-writes, keep working. Once only: a coordinated-retry or backoff
+                    // round re-enters this branch on the same retained handle. Fenced like the other
+                    // post-submit steps here: the replay commit is already in flight, so a throw must
+                    // not skip onCommit/the chain-store commit below. Optional: rocksdb-js < 2.7
+                    // lacks the method.
+                    this.releaseRetainedWriteIntents();
                 }
-            }
-            if (commitResolution) {
-                // Read the table off the write itself, not this.db, which is whichever table first
-                // claimed this per-database transaction in txnForContext and so can name the wrong
-                // table when a transaction spans more than one table in the same database.
-                trackOutstandingCommit(commitResolution, this.writes[0]?.store, this.startedFrom, transaction);
-                // Every retry round and every chained store re-enters here and must inherit the chain
-                // root's clock rather than restart it, so only the first submission stamps.
-                const chainRoot = this.root ?? this;
-                if (chainRoot.commitStartedAt == null)
-                    chainRoot.commitStartedAt = performance.now();
-                const completions = [];
-                const commitOutcome = commitResolution.then((commitResult) => {
-                    if (commitResult === RETRY_NOW_VALUE) {
-                        this.retries++;
-                        harperLogger.debug?.('coordinated retry', transaction.id, this.retries);
-                        // Mark this specific native transaction as a retry so RocksTransactionLogStore
-                        // skips re-writing its already-staged txn-log entries (#2).
-                        transaction.isRetry = true;
-                        const pastBudget = this.elapsedPastCommitBudget();
-                        if (pastBudget)
-                            this.abandonCommitAfterDeadline(transaction, pastBudget);
-                        // Mirror the ERR_BUSY cap/warn policy: non-sourceApply transactions abort
-                        // at MAX_RETRIES; sourceApply transactions keep retrying with periodic warn.
-                        if (this.retries > MAX_RETRIES) {
-                            if (!this.sourceApply) {
-                                // giving up: poison and abort the whole linked chain so no link leaks its native
-                                // handle / read snapshot — or any unpublished transaction-log position — until GC.
-                                this.abortChainAfterRetries(transaction);
-                                throw new hdbError_ts_1.ServerError(`After ${MAX_RETRIES} coordinated retries, unable to commit transaction, transaction is in conflict with ongoing writes`);
-                            }
-                            if (this.retries % MAX_RETRIES === 0) {
-                                harperLogger.warn?.(`Source-applied transaction ${transaction.id} still in conflict after ${this.retries} coordinated retries; continuing to retry`);
+                else {
+                    // no more reads need to be performed, just commit/abort based if there are any writes
+                    this.detachOwnedTransaction(); // any further operations operate immediately
+                    if (transaction) {
+                        this.writes = this.writes.filter((write) => write); // filter out removed entries
+                        if (this.writes.length > 0) {
+                            // Commit retries can construct fresh ranges on this live handle after read ownership ends.
+                            readTransactionOwners.delete(transaction);
+                            // Re-fence before submitting: the loop above skips operations already marked saved, so
+                            // save()'s own check cannot see a holder that stalled between staging and commit. The
+                            // retry/replay path re-saves every operation and is fenced there instead. Lease expiry
+                            // only: an unlock() inside the lease leaves the staged write valid, an elapsed lease
+                            // does not, whether or not the caller also unlocked.
+                            for (let i = 0; this.hasLeaseProtectedWrite && i < this.writes.length; i++) {
+                                const lapsed = this.writes[i].lockHandle;
+                                if (!lapsed?.isLeaseExpired())
+                                    continue;
+                                try {
+                                    transaction.abort();
+                                }
+                                catch { }
+                                // Every other terminal exit from commit() runs the logical cleanup too. Throwing
+                                // straight out would strand the OTHER locks this transaction holds, its staged
+                                // blobs, and the context's back-reference to a CLOSED transaction — and
+                                // transaction()'s onComplete has no rejection path to run it later.
+                                try {
+                                    this.abort();
+                                }
+                                catch (error) {
+                                    harperLogger.debug?.('cleaning up a transaction whose record lock lapsed', error);
+                                }
+                                throw (0, recordLock_ts_1.lockNotHeldError)(lapsed);
                             }
+                            // The transaction was created with coordinatedRetry:true (see
+                            // getReadTxn), so commit() can resolve to RETRY_NOW_VALUE. That
+                            // sentinel (a number) is why commitResolution is typed
+                            // Promise<number | void>; it is handled in the resolve callback below.
+                            this.assertDatabaseCommitAllowed(transaction);
+                            this.markNativeCommitSubmitted();
+                            commitResolution = transaction.commit();
+                            // Record how long this commit stays outstanding (submit → settle) as a distribution
+                            // metric. This is the same clock the overload check uses (trackOutstandingCommit
+                            // stamps each attempt at submit), so a rising p99/p999 is the leading indicator for the
+                            // "Outstanding write transactions have too long of queue" (503) rejection. A transient-
+                            // conflict retry rejects this promise and issues a fresh commit(), which is tracked as
+                            // its own attempt, so recording per attempt matches the overload semantics.
+                            // commitResolution's declared type (Promise<number | void> | void) doesn't narrow to
+                            // Promise<void> here because the widening union defeats flow analysis on the prior
+                            // cast assignment; re-assert it — this branch's commit() result is always a Promise.
+                            recordCommitLatency(commitResolution, performance.now());
+                            // Write-queue-depth accounting for this commit happens uniformly below, via
+                            // trackOutstandingCommit(commitResolution) — see that function's comment. A
+                            // transient-conflict retry rejects this promise and issues a fresh commit()
+                            // (re-entering here), which trackOutstandingCommit tracks as its own attempt.
                         }
-                        return this.commit({ ...options, transaction });
-                    }
-                    // onCommit may be async (e.g. RocksTransactionLogStore emits 'aftercommit'). Surface a
-                    // rejection — or a synchronous throw — via logging rather than failing the commit, since
-                    // the write is already durable.
-                    try {
-                        const onCommitResult = transaction.onCommit?.();
-                        if (onCommitResult?.then)
-                            onCommitResult.catch((error) => harperLogger.warn?.('onCommit handler failed after commit', error));
-                    }
-                    catch (error) {
-                        harperLogger.warn?.('onCommit handler failed after commit', error);
-                    }
-                    if (this.next) {
-                        // never forward options.transaction (a retry/replay round's HEAD-store handle) to
-                        // the next store — it must commit its own writes through its own transaction
-                        let nextCommit;
-                        try {
-                            nextCommit = this.next.commit(options.transaction ? { ...options, transaction: undefined } : options);
-                        }
-                        catch (error) {
-                            // This store has landed; its bookkeeping below must run before the failure surfaces.
-                            nextCommit = Promise.reject(error);
-                            nextCommit.catch(() => { }); // still rejects Promise.all, even if bookkeeping throws first
-                        }
-                        completions.push(nextCommit);
-                    }
-                    if (options?.flush) {
-                        completions.push(this.writes[0].store.flushed);
-                    }
-                    if (this.replicatedConfirmation) {
-                        // if we want to wait for replication confirmation, we need to track the transaction times
-                        // and when replication notifications come in, we count the number of confirms until we reach the desired number
-                        const databaseName = this.writes[0].store.rootStore.databaseName;
-                        const lastEntry = this.lastConfirmableEntry();
-                        if (confirmReplication && lastEntry) {
-                            completions.push(confirmReplication(databaseName, lastEntry.version, this.replicatedConfirmation));
+                        else {
+                            try {
+                                commitResolution = transaction.abort();
+                            }
+                            catch {
+                                // The transaction has uncommitted writes that were already cleared from
+                                // this.writes by a concurrent immediate-commit path (e.g. writes made with
+                                // an explicitly-reused closed transaction). Those writes are handled by the
+                                // concurrent commit, so there is nothing left to do here.
+                            }
                         }
                     }
-                    // commit succeeded; clean up files for any writes whose commit-handler took an early-return,
-                    // or whose stored record a later write to the same key replaced without an audit entry
-                    // keeping its blobs reachable (checked against the final committed record, so a blob the
-                    // later write retained survives). Deferred until here so a retry that *would* have
-                    // referenced the blob can flip skipped/superseded back to false first.
-                    for (const write of this.writes) {
-                        if (write?.savedBlobs && (write.skipped || (write.superseded && !write.blobsAuditReferenced)))
-                            (0, blob_ts_1.cleanupUnusedBlobs)(write.savedBlobs, (0, blob_ts_1.collectRetainedFileIds)(write.store.getEntry(write.key)?.value));
-                    }
-                    if (this.recordLocks)
-                        this.noteCommittedLockVersions();
-                    // now reset transactions tracking; this transaction be reused and committed again
-                    this.retries = 0; // reset per-native-transaction retry counter so a reused DatabaseTransaction's next batch starts fresh
-                    this.clearWrites();
-                    this.releaseRecordLocks();
-                    if (options.doneWriting)
-                        this.endScopeOwnership();
-                    this.releaseContext(!!options.doneWriting);
-                    let txnTime = this.timestamp;
-                    this.timestamp = 0; // reset the timestamp as well
-                    return Promise.all(completions).then(() => {
-                        // Only once the chained store's commit has settled, as on the synchronous path: a
-                        // partially failed mid-scope commit must not leave the scope resumable.
-                        this.completeMidScopeCommit(options);
-                        return {
-                            txnTime,
-                        };
-                    }, (error) => {
-                        // As on the synchronous path: a completion that failed (a chained store's commit,
-                        // a replication confirmation) leaves this commit partly landed, so ownership goes
-                        // with it rather than letting a later commit rotate on top.
-                        this.endScopeOwnership();
-                        throw error;
-                    });
-                }, (error) => {
-                    // Coordinated transactions surface conflicts as RETRY_NOW (handled in the
-                    // resolve branch above) and never reach here with ERR_BUSY. But not every
-                    // write transaction is coordinated — a write that reaches save() with no
-                    // prior getReadTxn() (immediate/publish/invalidate writes) is created
-                    // without coordinatedRetry and still rejects with ERR_BUSY on conflict.
-                    // Keep the backoff retry as the fallback for those paths.
-                    //
-                    // ERR_BUSY: optimistic-transaction write conflict. ERR_TRY_AGAIN: RocksDB kTryAgain —
-                    // the transaction's snapshot sequence fell outside the memtable conflict-check window
-                    // (max_write_buffer_size_to_maintain), which happens under bulk-ingest bursts such as a
-                    // migration full-table copy. Both are transient and retryable. Before ERR_TRY_AGAIN was
-                    // retried here, the rejection propagated out of the unawaited onCommit() handler as an
-                    // unhandled rejection and the write was silently dropped — records lost mid-copy (#308).
-                    if (error.code === 'ERR_BUSY' || error.code === 'ERR_TRY_AGAIN') {
-                        // if the transaction failed due to concurrent changes, we need to retry. First record this as an increased risk of contention/retry
-                        // for future transactions
-                        this.retries++;
-                        harperLogger.debug?.('retrying', transaction.id, this.retries);
-                        // ERR_BUSY and ERR_TRY_AGAIN are both retried by recommitting the SAME native
-                        // transaction. ERR_BUSY recovers because the save loop re-writes each key, re-tracking
-                        // it at the current sequence. ERR_TRY_AGAIN — a snapshot stranded outside the memtable
-                        // conflict-check window after a bulk-ingest flush — used to fail forever on recommit
-                        // because the native layer left the stranded snapshot in place; rocksdb-js now resets
-                        // the transaction onto a fresh snapshot on the failed TryAgain commit, exactly as it
-                        // always did for IsBusy, so the re-run's save loop re-resolves against current state and
-                        // converges. Keeping the same transaction means its committedPosition survives the reset
-                        // (WAL write-once, rocksdb-js#668) and its onCommit hook stays attached, so the
-                        // already-staged change-feed entry publishes only when the retry really commits — no
-                        // premature publish, and no fresh-transaction replay that would drop the entry.
-                        // Mark the native transaction as a retry so RocksTransactionLogStore skips re-staging entries.
-                        transaction.isRetry = true;
-                        // Before the backoff gate below: the budget can already be spent on the first
-                        // retry when an earlier store in this chain consumed it.
-                        const pastBudget = this.elapsedPastCommitBudget();
-                        if (pastBudget)
-                            this.abandonCommitAfterDeadline(transaction, pastBudget);
-                        if (this.retries > 2) {
-                            // Transactions applying data from a canonical source of truth (replication peer or
-                            // external caching source) must never drop a write on a transient conflict: there is no
-                            // re-subscribe / sequence-id-resume path, so a dropped write would leave this node
-                            // permanently diverged (harper-pro#348). Such transactions retry without a cap; the source
-                            // apply loop serializes commits (backpressure), so contention clears rather than
-                            // compounding. Request-path transactions keep the MAX_RETRIES cap and surface a loud error.
-                            const neverDropOnConflict = this.sourceApply;
+                }
+                if (commitResolution) {
+                    // Read the table off the write itself, not this.db, which is whichever table first
+                    // claimed this per-database transaction in txnForContext and so can name the wrong
+                    // table when a transaction spans more than one table in the same database.
+                    trackOutstandingCommit(commitResolution, this.writes[0]?.store, this.startedFrom, transaction);
+                    // Every retry round and every chained store re-enters here and must inherit the chain
+                    // root's clock rather than restart it, so only the first submission stamps.
+                    const chainRoot = this.root ?? this;
+                    if (chainRoot.commitStartedAt == null)
+                        chainRoot.commitStartedAt = performance.now();
+                    const completions = [];
+                    const commitOutcome = commitResolution.then((commitResult) => {
+                        if (commitResult === RETRY_NOW_VALUE) {
+                            this.retries++;
+                            harperLogger.debug?.('coordinated retry', transaction.id, this.retries);
+                            // Mark this specific native transaction as a retry so RocksTransactionLogStore
+                            // skips re-writing its already-staged txn-log entries (#2).
+                            transaction.isRetry = true;
+                            const pastBudget = this.elapsedPastCommitBudget();
+                            if (pastBudget)
+                                this.abandonCommitAfterDeadline(transaction, pastBudget);
+                            // Mirror the ERR_BUSY cap/warn policy: non-sourceApply transactions abort
+                            // at MAX_RETRIES; sourceApply transactions keep retrying with periodic warn.
                             if (this.retries > MAX_RETRIES) {
-                                if (!neverDropOnConflict) {
+                                if (!this.sourceApply) {
                                     // giving up: poison and abort the whole linked chain so no link leaks its native
-                                    // handle / read snapshot until GC.
+                                    // handle / read snapshot — or any unpublished transaction-log position — until GC.
                                     this.abortChainAfterRetries(transaction);
-                                    throw new hdbError_ts_1.ServerError(`After ${MAX_RETRIES} retries, unable to commit transaction, transaction is in conflict with ongoing writes`);
+                                    throw new hdbError_ts_1.ServerError(`After ${MAX_RETRIES} coordinated retries, unable to commit transaction, transaction is in conflict with ongoing writes`);
                                 }
-                                // Uncapped retry can otherwise stall silently (debug logging is off in production);
-                                // surface periodic visibility into a stalled source-apply commit.
                                 if (this.retries % MAX_RETRIES === 0) {
-                                    harperLogger.warn?.(`Source-applied transaction ${transaction.id} still in conflict after ${this.retries} retries; continuing to retry`);
+                                    harperLogger.warn?.(`Source-applied transaction ${transaction.id} still in conflict after ${this.retries} coordinated retries; continuing to retry`);
                                 }
                             }
-                            // start delaying, back off to try to space out transactions and avoid excessive conflicts
-                            return (0, promises_1.setTimeout)(Math.min(this.retries * this.retries, MAX_RETRY_DELAY_MS)).then(() => this.commit({ ...options, transaction }));
+                            return this.commit({ ...options, transaction });
                         }
-                        return this.commit({ ...options, transaction }); // try again
-                    }
-                    else {
-                        // terminal (non-conflict) failure: release the native handle so it doesn't leak;
-                        // usually already released by the failed commit itself, abort for the unexpected
-                        // case (same defensive pattern as the retry-exhaustion give-up above)
+                        // onCommit may be async (e.g. RocksTransactionLogStore emits 'aftercommit'). Surface a
+                        // rejection — or a synchronous throw — via logging rather than failing the commit, since
+                        // the write is already durable.
                         try {
-                            transaction.abort();
+                            const onCommitResult = transaction.onCommit?.();
+                            if (onCommitResult?.then)
+                                onCommitResult.catch((error) => harperLogger.warn?.('onCommit handler failed after commit', error));
                         }
-                        catch (abortError) {
-                            harperLogger.debug?.('aborting transaction after failed commit', abortError);
+                        catch (error) {
+                            harperLogger.warn?.('onCommit handler failed after commit', error);
                         }
-                        // A terminal failure is just as final as a success — release the context's
-                        // back-reference here too, or transaction.ts's onComplete() (which has no
-                        // rejection handler of its own) would leave a long-lived context pinning this
-                        // CLOSED wrapper forever.
-                        // A failed commit must never be followed by a resumed segment: this generation is
-                        // finished and its durability is unknown, so ownership goes with it.
-                        this.endScopeOwnership();
-                        this.releaseContext(!!options.doneWriting);
+                        if (this.next) {
+                            // never forward options.transaction (a retry/replay round's HEAD-store handle) to
+                            // the next store — it must commit its own writes through its own transaction
+                            let nextCommit;
+                            try {
+                                nextCommit = this.next.commit({ ...options, transaction: undefined, continuation: true });
+                            }
+                            catch (error) {
+                                // This store has landed; its bookkeeping below must run before the failure surfaces.
+                                nextCommit = Promise.reject(error);
+                                nextCommit.catch(() => { }); // still rejects Promise.all, even if bookkeeping throws first
+                            }
+                            completions.push(nextCommit);
+                        }
+                        if (options?.flush) {
+                            const store = this.writes[0]?.store;
+                            if (store)
+                                completions.push(store.flushed);
+                        }
+                        if (this.replicatedConfirmation) {
+                            // if we want to wait for replication confirmation, we need to track the transaction times
+                            // and when replication notifications come in, we count the number of confirms until we reach the desired number
+                            const databaseName = this.writes[0]?.store.rootStore.databaseName;
+                            const lastEntry = this.lastConfirmableEntry();
+                            if (confirmReplication && databaseName && lastEntry) {
+                                completions.push(confirmReplication(databaseName, lastEntry.version, this.replicatedConfirmation));
+                            }
+                        }
+                        // commit succeeded; clean up files for any writes whose commit-handler took an early-return,
+                        // or whose stored record a later write to the same key replaced without an audit entry
+                        // keeping its blobs reachable (checked against the final committed record, so a blob the
+                        // later write retained survives). Deferred until here so a retry that *would* have
+                        // referenced the blob can flip skipped/superseded back to false first.
+                        for (const write of this.writes) {
+                            if (write?.savedBlobs && (write.skipped || (write.superseded && !write.blobsAuditReferenced)))
+                                (0, blob_ts_1.cleanupUnusedBlobs)(write.savedBlobs, (0, blob_ts_1.collectRetainedFileIds)(write.store.getEntry(write.key)?.value));
+                        }
+                        if (this.recordLocks)
+                            this.noteCommittedLockVersions();
+                        // now reset transactions tracking; this transaction be reused and committed again
+                        this.retries = 0; // reset per-native-transaction retry counter so a reused DatabaseTransaction's next batch starts fresh
+                        this.clearWrites();
                         this.releaseRecordLocks();
-                        this.timestamp = 0;
+                        if (options.doneWriting)
+                            this.endScopeOwnership();
+                        this.releaseContext(!!options.doneWriting);
+                        let txnTime = this.timestamp;
+                        this.timestamp = 0; // reset the timestamp as well
+                        return Promise.all(completions).then(() => {
+                            // Only once the chained store's commit has settled, as on the synchronous path: a
+                            // partially failed mid-scope commit must not leave the scope resumable.
+                            this.completeMidScopeCommit(options);
+                            return {
+                                txnTime,
+                            };
+                        }, (error) => {
+                            // As on the synchronous path: a completion that failed (a chained store's commit,
+                            // a replication confirmation) leaves this commit partly landed, so ownership goes
+                            // with it rather than letting a later commit rotate on top.
+                            this.endScopeOwnership();
+                            throw error;
+                        });
+                    }, (error) => {
+                        // Coordinated transactions surface conflicts as RETRY_NOW (handled in the
+                        // resolve branch above) and never reach here with ERR_BUSY. But not every
+                        // write transaction is coordinated — a write that reaches save() with no
+                        // prior getReadTxn() (immediate/publish/invalidate writes) is created
+                        // without coordinatedRetry and still rejects with ERR_BUSY on conflict.
+                        // Keep the backoff retry as the fallback for those paths.
+                        //
+                        // ERR_BUSY: optimistic-transaction write conflict. ERR_TRY_AGAIN: RocksDB kTryAgain —
+                        // the transaction's snapshot sequence fell outside the memtable conflict-check window
+                        // (max_write_buffer_size_to_maintain), which happens under bulk-ingest bursts such as a
+                        // migration full-table copy. Both are transient and retryable. Before ERR_TRY_AGAIN was
+                        // retried here, the rejection propagated out of the unawaited onCommit() handler as an
+                        // unhandled rejection and the write was silently dropped — records lost mid-copy (#308).
+                        if (error.code === 'ERR_BUSY' || error.code === 'ERR_TRY_AGAIN') {
+                            // if the transaction failed due to concurrent changes, we need to retry. First record this as an increased risk of contention/retry
+                            // for future transactions
+                            this.retries++;
+                            harperLogger.debug?.('retrying', transaction.id, this.retries);
+                            // ERR_BUSY and ERR_TRY_AGAIN are both retried by recommitting the SAME native
+                            // transaction. ERR_BUSY recovers because the save loop re-writes each key, re-tracking
+                            // it at the current sequence. ERR_TRY_AGAIN — a snapshot stranded outside the memtable
+                            // conflict-check window after a bulk-ingest flush — used to fail forever on recommit
+                            // because the native layer left the stranded snapshot in place; rocksdb-js now resets
+                            // the transaction onto a fresh snapshot on the failed TryAgain commit, exactly as it
+                            // always did for IsBusy, so the re-run's save loop re-resolves against current state and
+                            // converges. Keeping the same transaction means its committedPosition survives the reset
+                            // (WAL write-once, rocksdb-js#668) and its onCommit hook stays attached, so the
+                            // already-staged change-feed entry publishes only when the retry really commits — no
+                            // premature publish, and no fresh-transaction replay that would drop the entry.
+                            // Mark the native transaction as a retry so RocksTransactionLogStore skips re-staging entries.
+                            transaction.isRetry = true;
+                            // Before the backoff gate below: the budget can already be spent on the first
+                            // retry when an earlier store in this chain consumed it.
+                            const pastBudget = this.elapsedPastCommitBudget();
+                            if (pastBudget)
+                                this.abandonCommitAfterDeadline(transaction, pastBudget);
+                            if (this.retries > 2) {
+                                // Transactions applying data from a canonical source of truth (replication peer or
+                                // external caching source) must never drop a write on a transient conflict: there is no
+                                // re-subscribe / sequence-id-resume path, so a dropped write would leave this node
+                                // permanently diverged (harper-pro#348). Such transactions retry without a cap; the source
+                                // apply loop serializes commits (backpressure), so contention clears rather than
+                                // compounding. Request-path transactions keep the MAX_RETRIES cap and surface a loud error.
+                                const neverDropOnConflict = this.sourceApply;
+                                if (this.retries > MAX_RETRIES) {
+                                    if (!neverDropOnConflict) {
+                                        // giving up: poison and abort the whole linked chain so no link leaks its native
+                                        // handle / read snapshot until GC.
+                                        this.abortChainAfterRetries(transaction);
+                                        throw new hdbError_ts_1.ServerError(`After ${MAX_RETRIES} retries, unable to commit transaction, transaction is in conflict with ongoing writes`);
+                                    }
+                                    // Uncapped retry can otherwise stall silently (debug logging is off in production);
+                                    // surface periodic visibility into a stalled source-apply commit.
+                                    if (this.retries % MAX_RETRIES === 0) {
+                                        harperLogger.warn?.(`Source-applied transaction ${transaction.id} still in conflict after ${this.retries} retries; continuing to retry`);
+                                    }
+                                }
+                                // start delaying, back off to try to space out transactions and avoid excessive conflicts
+                                return (0, promises_1.setTimeout)(Math.min(this.retries * this.retries, MAX_RETRY_DELAY_MS)).then(() => this.commit({ ...options, transaction }));
+                            }
+                            return this.commit({ ...options, transaction }); // try again
+                        }
+                        else {
+                            // terminal (non-conflict) failure: release the native handle so it doesn't leak;
+                            // usually already released by the failed commit itself, abort for the unexpected
+                            // case (same defensive pattern as the retry-exhaustion give-up above)
+                            try {
+                                transaction.abort();
+                            }
+                            catch (abortError) {
+                                harperLogger.debug?.('aborting transaction after failed commit', abortError);
+                            }
+                            // A terminal failure is just as final as a success — release the context's
+                            // back-reference while handling the native transaction. performCommit's outer
+                            // rejection handler then aborts the wrapper and its linked chain.
+                            // A failed commit must never be followed by a resumed segment: this generation is
+                            // finished and its durability is unknown, so ownership goes with it.
+                            this.endScopeOwnership();
+                            this.releaseContext(!!options.doneWriting);
+                            this.releaseRecordLocks();
+                            this.timestamp = 0;
+                            throw error;
+                        }
+                    });
+                    // `commitOutcome` settles when the LOGICAL commit ends — its success branch awaits the
+                    // chained stores' own commits — so releasing here covers every terminal exit (success,
+                    // retry exhaustion, abandonment, terminal failure) in one place rather than five.
+                    // Released through the RETURNED promise rather than a second subscriber on
+                    // `commitOutcome`: a subscriber would mark a dropped commit rejection as handled and
+                    // silence the unhandled-rejection that surfaces it.
+                    return commitOutcome.then((resolution) => {
+                        chainRoot.commitStartedAt = undefined;
+                        return resolution;
+                    }, (error) => {
+                        chainRoot.commitStartedAt = undefined;
                         throw error;
-                    }
-                });
-                // `commitOutcome` settles when the LOGICAL commit ends — its success branch awaits the
-                // chained stores' own commits — so releasing here covers every terminal exit (success,
-                // retry exhaustion, abandonment, terminal failure) in one place rather than five.
-                // Released through the RETURNED promise rather than a second subscriber on
-                // `commitOutcome`: a subscriber would mark a dropped commit rejection as handled and
-                // silence the unhandled-rejection that surfaces it.
-                return commitOutcome.then((resolution) => {
-                    chainRoot.commitStartedAt = undefined;
-                    return resolution;
-                }, (error) => {
-                    chainRoot.commitStartedAt = undefined;
-                    throw error;
-                });
-            }
-            for (const write of this.writes) {
-                if (write?.savedBlobs && (write.skipped || (write.superseded && !write.blobsAuditReferenced)))
-                    (0, blob_ts_1.cleanupUnusedBlobs)(write.savedBlobs, (0, blob_ts_1.collectRetainedFileIds)(write.store.getEntry(write.key)?.value));
-            }
-            if (this.recordLocks)
-                this.noteCommittedLockVersions();
-            this.clearWrites();
-            this.releaseRecordLocks();
-            if (options.doneWriting)
-                this.endScopeOwnership();
-            this.releaseContext(!!options.doneWriting);
-            const txnResolution = {
-                txnTime: this.timestamp,
-            };
-            this.timestamp = 0; // reset like the async path (~1279) so stale lock stamps don't persist
-            if (this.next) {
-                // now run any other transactions
-                options.timestamp = txnResolution.txnTime;
-                // as above: the next store must not inherit this store's explicit native transaction
-                let nextResolution;
-                try {
-                    nextResolution = this.next?.commit(options.transaction ? { ...options, transaction: undefined } : options);
+                    });
                 }
-                catch (error) {
-                    // A synchronous throw reaches neither rejection handler below, and the head has already
-                    // committed — surrender ownership here too, or the scope stays resumable on top of a
-                    // half-landed multi-store commit.
-                    this.endScopeOwnership();
-                    throw error;
+                for (const write of this.writes) {
+                    if (write?.savedBlobs && (write.skipped || (write.superseded && !write.blobsAuditReferenced)))
+                        (0, blob_ts_1.cleanupUnusedBlobs)(write.savedBlobs, (0, blob_ts_1.collectRetainedFileIds)(write.store.getEntry(write.key)?.value));
                 }
-                if (nextResolution?.then)
-                    return nextResolution?.then((nextResolution) => {
-                        // Only once the chained store's own commit has SETTLED: rotating first would leave the
-                        // scope resumable after a partially failed mid-scope commit.
-                        this.completeMidScopeCommit(options);
-                        return {
-                            txnTime: txnResolution.txnTime,
-                            next: nextResolution,
-                        };
-                    }, (error) => {
-                        // A chained store's commit failed, so this multi-store commit half-landed. Surrender
-                        // ownership as the head's own failure branch does: a handler that catches this and
-                        // commits again must not rotate on top of it, and must not have the failed link
-                        // dropped from the chain before its abort can clean up its blobs.
+                if (this.recordLocks)
+                    this.noteCommittedLockVersions();
+                this.clearWrites();
+                this.releaseRecordLocks();
+                if (options.doneWriting)
+                    this.endScopeOwnership();
+                this.releaseContext(!!options.doneWriting);
+                const txnResolution = {
+                    txnTime: this.timestamp,
+                };
+                this.timestamp = 0; // reset like the async path (~1279) so stale lock stamps don't persist
+                if (this.next) {
+                    // now run any other transactions
+                    options.timestamp = txnResolution.txnTime;
+                    // as above: the next store must not inherit this store's explicit native transaction
+                    let nextResolution;
+                    try {
+                        nextResolution = this.next?.commit({ ...options, transaction: undefined, continuation: true });
+                    }
+                    catch (error) {
+                        // A synchronous throw reaches neither rejection handler below, and the head has already
+                        // committed — surrender ownership here too, or the scope stays resumable on top of a
+                        // half-landed multi-store commit.
                         this.endScopeOwnership();
                         throw error;
-                    });
-                txnResolution.next = nextResolution;
-            }
-            this.completeMidScopeCommit(options);
-            return txnResolution;
-        }, (error) => {
+                    }
+                    if (nextResolution?.then)
+                        return nextResolution?.then((nextResolution) => {
+                            // Only once the chained store's own commit has SETTLED: rotating first would leave the
+                            // scope resumable after a partially failed mid-scope commit.
+                            this.completeMidScopeCommit(options);
+                            return {
+                                txnTime: txnResolution.txnTime,
+                                next: nextResolution,
+                            };
+                        }, (error) => {
+                            // A chained store's commit failed, so this multi-store commit half-landed. Surrender
+                            // ownership as the head's own failure branch does: a handler that catches this and
+                            // commits again must not rotate on top of it, and must not have the failed link
+                            // dropped from the chain before its abort can clean up its blobs.
+                            this.endScopeOwnership();
+                            throw error;
+                        });
+                    txnResolution.next = nextResolution;
+                }
+                this.completeMidScopeCommit(options);
+                return txnResolution;
+            });
+        }
+        catch (error) {
             this.setCommitPhase(false);
-            this.abort();
-            throw error;
-        });
+            this.abortAfterCommitError(error);
+        }
+        if (commitResult?.then)
+            return commitResult.catch((error) => {
+                this.setCommitPhase(false);
+                this.abortAfterCommitError(error);
+            });
+        return commitResult;
     }
     /**
      * A successful commit that is NOT the scope's final one leaves the scope still running and still
@@ -1767,7 +2147,12 @@ class DatabaseTransaction {
     }
     /** See completeMidScopeCommit, which is the only caller and carries the reasoning. */
     rotateAfterMidScopeCommit(options) {
-        if (options.doneWriting || this.timedOut || this.transaction || !this.#scopeOwned)
+        if (options.doneWriting ||
+            this.timedOut ||
+            this.disconnected ||
+            this.postSubmitPoisoned ||
+            this.transaction ||
+            !this.#scopeOwned)
             return;
         this.open = exports.TRANSACTION_STATE.OPEN;
         this.snapshotFree = true;
@@ -1789,40 +2174,74 @@ class DatabaseTransaction {
         }
         throw new hdbError_ts_1.DatabaseClosingError(rootStore?.databaseName ?? rootStore?.path ?? 'unknown', retryable);
     }
-    abort() {
-        while (this.readTxnsUsed > 0)
-            this.doneReadTxn(); // release the read snapshot when we abort, we assume we don't need it
-        // Defensively release any native handle whose reference bookkeeping was already consumed.
-        if (this.transaction)
-            this.releaseReadTxn();
-        this.open = exports.TRANSACTION_STATE.CLOSED;
-        this.timestamp = 0; // a lock stamp pinned for this write set must not leak into the next
-        this.drainCompletions();
+    abortAfterCommitError(error) {
+        try {
+            // Not "always retain": abort(true) keeps the native handle only while read iterators still
+            // own it. resources/transaction.ts's own post-error abort passes the same argument, so the
+            // two layers cannot contradict each other one frame apart.
+            this.abort(true);
+        }
+        catch (abortError) {
+            harperLogger.debug?.('aborting transaction after a failed commit', abortError);
+        }
+        throw error;
+    }
+    abort(retainReadTransaction = false, cascade = true) {
+        const next = cascade ? this.next : undefined;
+        if (cascade && !retainReadTransaction)
+            this.next = null;
         try {
+            const hasOpenReadIterator = retainReadTransaction &&
+                this.transaction &&
+                (this.readTxnsUsed > 1 || (this.baseReadRefConsumed && this.readTxnsUsed > 0));
+            if (hasOpenReadIterator) {
+                this.releaseRetainedWriteIntents();
+                if (!this.baseReadRefConsumed) {
+                    this.doneReadTxn();
+                    this.baseReadRefConsumed = true;
+                }
+            }
+            else {
+                while (this.readTxnsUsed > 0)
+                    this.doneReadTxn(); // release the read snapshot when we abort, we assume we don't need it
+            }
+            // A write-only transaction never took a read reference (getReadTxn was never called), so the
+            // loop above releases nothing even though save() created a native handle. Keep an iterator's
+            // handle alive, but release every other remaining handle through the shared cleanup path.
+            if (this.transaction && !hasOpenReadIterator)
+                this.releaseReadTxn();
+            this.open = exports.TRANSACTION_STATE.CLOSED;
+            this.timestamp = 0; // a lock stamp pinned for this write set must not leak into the next
+            this.drainCompletions();
             for (const write of this.writes) {
                 if (write?.savedBlobs)
                     (0, blob_ts_1.cleanupUnusedBlobs)(write.savedBlobs, (0, blob_ts_1.collectRetainedFileIds)(write.store.getEntry(write.key)?.value));
             }
         }
         finally {
-            this.endScopeOwnership(); // the scope is over; nothing may rotate this instance again
-            this.clearWrites();
-            this.releaseRecordLocks();
-            // A timeout-poisoned abort (abortDueToTimeout()) is the one abort that is NOT "reuse-free":
-            // Resource.ts's dispatcher deliberately keeps joining a `timedOut` transaction (instead of
-            // starting a fresh one) so the rest of the logical operation fails atomically via the
-            // poison check in addWrite()/commit(), rather than silently landing a later write on a
-            // brand-new transaction after an earlier one was rolled back (#1411). Releasing here would
-            // make that check see `undefined?.timedOut` and take the "start fresh" branch instead.
-            this.releaseContext(!this.timedOut);
-            const next = this.next;
-            this.next = null;
-            if (next) {
-                try {
-                    next.abort();
-                }
-                catch (error) {
-                    harperLogger.debug?.('cleaning up a chained transaction during abort', error);
+            try {
+                this.open = exports.TRANSACTION_STATE.CLOSED;
+                this.endScopeOwnership(); // the scope is over; nothing may rotate this instance again
+                this.clearWrites();
+                this.releaseRecordLocks();
+                // A timeout-poisoned abort (abortDueToTimeout()) is the one abort that is NOT "reuse-free":
+                // Resource.ts's dispatcher deliberately keeps joining a `timedOut` transaction (instead of
+                // starting a fresh one) so the rest of the logical operation fails atomically via the
+                // poison check in addWrite()/commit(), rather than silently landing a later write on a
+                // brand-new transaction after an earlier one was rolled back (#1411). Releasing here would
+                // make that check see `undefined?.timedOut` and take the "start fresh" branch instead.
+                this.releaseContext(!this.timedOut && !this.disconnected);
+                if (!this.root)
+                    this.releaseRequestAbortListener();
+            }
+            finally {
+                if (next && !(next.nativeCommitSubmitted && next.commitsInFlight)) {
+                    try {
+                        next.abort(retainReadTransaction);
+                    }
+                    catch (error) {
+                        harperLogger.debug?.('cleaning up a chained transaction during abort', error);
+                    }
                 }
             }
         }
@@ -1933,35 +2352,107 @@ class DatabaseTransaction {
      */
     hasPendingWrites() {
         for (let txn = this; txn; txn = txn.next) {
-            if (txn.writes.some((write) => write))
-                return true;
+            for (let i = 0; i < txn.writes.length; i++) {
+                if (txn.writes[i])
+                    return true;
+            }
         }
         return false;
     }
     /**
-     * Abort and poison this transaction because it exceeded the open-transaction limit. The next write or
-     * commit throws transactionOpenTooLongError so the request fails cleanly and rolls back, rather than the
-     * monitor force-committing a partial write set on the application's behalf (issue #1407). The whole
-     * multi-store `next` chain is poisoned and aborted: writes to a second database live on `next`, so
-     * leaving it un-poisoned would let the head's commit cascade force-commit them (or orphan its resources
-     * until it self-times-out).
+     * Abort and poison this transaction (and its multi-store `next` chain) for `reason`, throwing on any
+     * further addWrite/commit (transactionOpenTooLongError / requestAbortedError) rather than the monitor
+     * force-committing a partial write set on the application's behalf (issue #1407) or a chain link
+     * silently committing on behalf of a request that was supposed to have been cut off (harper#2001).
+     * Poisons every link first, then aborts each — so a throw from one link's abort() can't leave a later
+     * link un-poisoned and eligible for a commit cascade to force-commit it or leak its native handle.
+     *
+     * A link whose native commit was submitted is past the point of no destructive return: poison it for
+     * everything that comes after, but let that attempt reach its outcome rather than racing cleanup
+     * against unknown durability. Accepted consequence: a submitted write can land after the client is gone.
+     *
+     * For a disconnect that point covers the whole chain: its unsubmitted links ride the cascade already
+     * under way, so the logical commit lands whole instead of splitting across stores (#1407). The monitor
+     * aborts them independently instead, because it only gets here for pre-commit work that outlived its grace.
      */
-    abortDueToTimeout() {
-        // Poison every link first, then abort each, so a throw from one link's abort() can't leave later links
-        // in the chain un-poisoned (and thus eligible to be force-committed by a later commit cascade).
-        for (let txn = this; txn; txn = txn.next) {
-            txn.timedOut = true;
-            txn.open = exports.TRANSACTION_STATE.CLOSED;
+    abortAndPoison(reason) {
+        const root = this.root ?? this;
+        const submittedCommit = root.commitSubmitted && this.isChainCommitting();
+        const spareWholeChain = submittedCommit && reason === 'disconnected';
+        const links = new Set();
+        const collect = (start) => {
+            for (let txn = start; txn; txn = txn.next)
+                links.add(txn);
+        };
+        collect(root);
+        collect(this);
+        collect(root.submittedLink);
+        if (root.submittedLinks)
+            for (const txn of root.submittedLinks)
+                collect(txn);
+        for (const txn of links) {
+            txn[reason] = true;
+            if (spareWholeChain || (submittedCommit && txn.nativeCommitSubmitted))
+                txn.poisonedMidCommit = true;
+            else {
+                txn.poisonedMidCommit = false;
+                txn.open = exports.TRANSACTION_STATE.CLOSED;
+            }
         }
-        for (let txn = this; txn; txn = txn.next) {
+        if (spareWholeChain)
+            return;
+        for (const txn of links) {
+            if (submittedCommit && txn.nativeCommitSubmitted)
+                continue;
             try {
-                txn.abort();
+                // An iterator's native cursor is owned by this transaction. Drop the staged writes now, but
+                // leave its handle for doneReadTxn() so the iterator can finish without using a freed handle.
+                // Abort only this link: a later link may already have submitted work whose outcome is unknown.
+                txn.abort(true, false);
             }
             catch (error) {
-                harperLogger.debug?.(`Error aborting timed-out transaction in chain: ${error.message}`);
+                harperLogger.debug?.(`Error aborting ${reason} transaction in chain`, error);
             }
         }
     }
+    /** The long-transaction monitor calls this when a write-bearing transaction stays open too long. */
+    abortDueToTimeout() {
+        this.abortAndPoison('timedOut');
+    }
+    /** A request this chain writes for was cancelled (admitRequestWrite, harper#2001). */
+    abortDueToDisconnect() {
+        this.abortAndPoison('disconnected');
+    }
+    /**
+     * Poison fresh ordinary work after a submitted commit stalls, without aborting any unknown native
+     * outcome. Start at the root so every still-attached link receives the poison; also cover a link an
+     * LMDB commit detached before its child settled.
+     */
+    poisonAfterStalledSubmittedCommit() {
+        const root = this.root ?? this;
+        const links = new Set();
+        const collect = (start) => {
+            for (let txn = start; txn; txn = txn.next)
+                links.add(txn);
+        };
+        collect(root);
+        collect(this);
+        collect(root.submittedLink);
+        if (root.submittedLinks)
+            for (const txn of root.submittedLinks)
+                collect(txn);
+        for (const txn of links) {
+            txn.postSubmitPoisoned = true;
+            // Not on a link an earlier poison already aborted: abort() cleared its write set, so excusing
+            // its continuation from the poison check would let it resume onto nothing and report success.
+            if (!txn.commitAttemptDoomedByPoison())
+                txn.poisonedMidCommit = true;
+            if (txn.nativeCommitSubmitted) {
+                txn.timedOut = true;
+            }
+        }
+        root.timedOut = true;
+    }
     directCommitSync() {
         const transaction = this.transaction;
         if (transaction)
@@ -2020,6 +2511,7 @@ class ImmediateTransaction extends DatabaseTransaction {
             super.save(operation, args[1], true);
         }
         else {
+            this.admitRequestWrite(); // a deferred save reaches here without passing through addWrite()
             this.isCommitting = true;
             // A synchronous throw from commit() (e.g. a 409 from an expired lock handle) would
             // otherwise leave isCommitting latched at true, causing every subsequent save() in this
@@ -2209,6 +2701,94 @@ function reportIfLongLived(txn, thresholdMs, now, reportBudget) {
         reportLongLivedLink(link, thresholdMs, now, reportBudget);
     }
 }
+/** Diagnostic grace after a native submission outlives the ordinary transaction timeout. */
+const MAX_DEFERRED_POISON_TICKS = 2;
+const STALLED_COMMIT_LOG_MIN_INTERVAL_MS = 1000;
+let lastStalledCommitWarningAt = -Infinity;
+let lastStalledCommitErrorAt = -Infinity;
+function submittedCommitStillInFlight(root) {
+    if (root.submittedLink?.nativeCommitSubmitted && root.submittedLink.commitsInFlight)
+        return true;
+    if (root.submittedLinks) {
+        for (const txn of root.submittedLinks) {
+            if (txn.nativeCommitSubmitted && txn.commitsInFlight)
+                return true;
+        }
+    }
+    return false;
+}
+/**
+ * True when this tick must leave `txn` alone because some link has submitted writes whose native
+ * outcome is not known yet. Merely entering commit() is not enough: a wholly pre-submit transaction
+ * remains subject to shouldSpareCommitPhase() and its ordinary bounded grace.
+ */
+function deferForCommitInFlight(txn, url, expiration = txnExpiration) {
+    const root = txn.root ?? txn;
+    if (!txn.isChainCommitting() || !root.commitSubmitted)
+        return false;
+    // A sibling's submitted commit is protected by the links that own it. This one is poisoned and never
+    // submitted, so deferring it only holds its retained snapshot for the diagnostic and commit-phase
+    // graces on behalf of an attempt that is going to throw.
+    if (txn.commitAttemptDoomedByPoison())
+        return false;
+    // performance.now(), not Date.now(): a clock correction must not extend a stalled commit's hold on its
+    // diagnostic grace, nor report a legitimately slow one early.
+    const now = performance.now();
+    const deadline = (root.deferredPoisonDeadline ??= now + MAX_DEFERRED_POISON_TICKS * expiration);
+    let hasUnsubmittedCommit = false;
+    let unsubmittedCommitGraceExpired = false;
+    if (now >= deadline) {
+        // Only reclaim after the commit has genuinely stalled. Submitted writes no longer depend on these
+        // separate snapshots; pre-submit handles can still carry writes needed by the attempt.
+        txn.releaseStalledCommitReadResources();
+        if (!txn.isProtectedCommit()) {
+            if (!root.postSubmitPoisoned)
+                txn.poisonAfterStalledSubmittedCommit();
+            const links = new Set();
+            const collect = (start) => {
+                for (let link = start; link; link = link.next)
+                    links.add(link);
+            };
+            collect(root);
+            collect(txn);
+            collect(root.submittedLink);
+            if (root.submittedLinks)
+                for (const link of root.submittedLinks)
+                    collect(link);
+            for (const link of links) {
+                if (link.committing && !link.nativeCommitSubmitted) {
+                    hasUnsubmittedCommit = true;
+                    break;
+                }
+            }
+            if (hasUnsubmittedCommit) {
+                const unsubmittedDeadline = (root.unsubmittedCommitDeadline ??= now + exports.COMMIT_PHASE_GRACE * expiration);
+                if (now >= unsubmittedDeadline) {
+                    unsubmittedCommitGraceExpired = true;
+                    txn.abortDueToTimeout();
+                }
+            }
+            else
+                root.unsubmittedCommitDeadline = undefined;
+        }
+        if (!txn.nativeCommitSubmitted &&
+            txn.open === exports.TRANSACTION_STATE.CLOSED &&
+            !(txn === root && submittedCommitStillInFlight(root)))
+            return hasUnsubmittedCommit && !unsubmittedCommitGraceExpired;
+        if (!root.stalledCommitLogged && now - lastStalledCommitErrorAt >= STALLED_COMMIT_LOG_MIN_INTERVAL_MS) {
+            lastStalledCommitErrorAt = now;
+            root.stalledCommitLogged = true;
+            harperLogger.error(`A native commit has not settled after exceeding the open-transaction limit by a further ${MAX_DEFERRED_POISON_TICKS * expiration}ms. Its outcome is unknown, so Harper will not abort or delete its writes; fresh ordinary work ` +
+                `on this transaction is rejected until it settles, and the worker may require a restart, from table: ${txn.db?.name + (url ? ' path: ' + url : '')}`);
+        }
+    }
+    else if (now - lastStalledCommitWarningAt >= STALLED_COMMIT_LOG_MIN_INTERVAL_MS) {
+        lastStalledCommitWarningAt = now;
+        harperLogger.warn?.(`Transaction exceeded the open-transaction limit after submitting a native commit; preserving its unknown outcome, from table: ${txn.db?.name + (url ? ' path: ' + url : '')}`);
+    }
+    txn.timeout = Math.max(expiration, txn.timeoutBudget ?? 0);
+    return true;
+}
 function startMonitoringTxns() {
     timer = setInterval(function () {
         monitorTick++;
@@ -2241,6 +2821,15 @@ function startMonitoringTxns() {
                 txn.writeTimeout -= txnExpiration;
             if (txn.timeout <= 0) {
                 const url = txn.getContext()?.url;
+                if (deferForCommitInFlight(txn, url, txnExpiration))
+                    return;
+                if (txn.open === exports.TRANSACTION_STATE.CLOSED &&
+                    !txn.commitAttemptDoomedByPoison() &&
+                    shouldSpareCommitPhase(txn, checkedCommitPhaseChains)) {
+                    harperLogger.warn?.(`Transaction has been in its commit phase past the open-transaction limit, waiting on pre-commit work; letting it complete, from table: ${txn.db?.name + (url ? ' path: ' + url : '')}`);
+                    txn.timeout = Math.max(txnExpiration, txn.timeoutBudget ?? 0);
+                    return;
+                }
                 if (txn.open === exports.TRANSACTION_STATE.CLOSED) {
                     if (!txn.transaction) {
                         // Nothing left to supervise, and this is the registry's only unconditional exit:
@@ -2250,14 +2839,16 @@ function startMonitoringTxns() {
                         txn.dropWriteSupervision();
                         return;
                     }
-                    // The commit was already acknowledged; any staged writes are riding an in-flight
-                    // replay commit (see the outstanding-iterators branch in commit()) and are not the
-                    // monitor's to abort — dropping them here would re-introduce the silent
-                    // write-loss-after-ack this branch structure exists to prevent. Only the read
-                    // snapshot's lifetime is left to enforce: release the retained native handle that
-                    // the overdue iterators are holding open.
-                    harperLogger.warn?.(`Read iterators held a committed transaction's snapshot past the open-transaction limit; releasing it, from table: ${txn.db?.name + (url ? ' path: ' + url : '')}`);
-                    txn.releaseReadTxn();
+                    // Staged writes are not the monitor's to abort here: on the committed path they ride an
+                    // in-flight replay commit (see the outstanding-iterators branch in commit()) and dropping
+                    // them would re-introduce the silent write-loss-after-ack this structure prevents; on the
+                    // poisoned path abort(true) already discarded them. Only the snapshot's lifetime is left.
+                    // Close the owning iterators first so the handle comes back through doneReadTxn() — a
+                    // transaction poisoned outside transaction() has no callback settlement to do it.
+                    const closedIterators = txn.closeOwnedReadIterators();
+                    harperLogger.warn?.(`Read iterators held a ${txn.timedOut || txn.disconnected ? 'poisoned' : 'committed'} transaction's snapshot past the open-transaction limit; ${txn.transaction ? 'releasing it' : `closed ${closedIterators} abandoned iterator(s)`}, from table: ${txn.db?.name + (url ? ' path: ' + url : '')}`);
+                    if (txn.transaction)
+                        txn.releaseReadTxn();
                 }
                 else if (shouldSpareCommitPhase(txn, checkedCommitPhaseChains)) {
                     // Parked in commit()'s pre-commit await — a `before`/`beforeIntermediate` hook, in practice a