@jarenjs/db 0.56.0 → 0.67.0

package/src/store.js

@@ -20,27 +20,41 @@
  * never a silent one. `@jarenjs/validate` is never imported here.
  */
 
+import { resolveRuntime } from '@jarenjs/core/runtime';
 import { applyJSONPatch } from '@jarenjs/json/patch';
 import { parseJSONPointer } from '@jarenjs/json/pointer';
 
-import { DbCompileError, DbRuntimeError, isDuplicateKeyError } from './errors.js';
+import { DbCompileError, DbRuntimeError, wrapDriverError, isDriverError, classifyDriverError } from './errors.js';
 import { chain, toPromise, isThenable, attempt } from './driver.js';
 import { planCollection, planEntity, planJoinTable, verifyShape } from './ddl.js';
 import { translatePatch } from './patch-sql.js';
 import { createQueryEngine, createQueryState, createEntityQueryEngine, createLoadEngine } from './query.js';
-import { normalizeProfile } from './profile.js';
-import { normalizeEntities, explainMapping } from './model.js';
+import { admitCursor, admitSyncCursor, createCursor, drainPage, utf8Length } from './cursor.js';
+import { refuseUnsupportedPragmaKeys, resolvePragmaRequests, configurePragmas } from './pragmas.js';
+import { createMaintenance } from './maintenance.js';
+import { createBackup } from './backup.js';
+import { normalizeProfile, assertProfileRoots } from './profile.js';
+import { normalizeEntities, explainMapping, joinTableRoots } from './model.js';
 import { entityCore } from './entity.js';
 import { createTracker, membershipKeys } from './tracker.js';
 import { createCaptureEngine, DEFAULT_RETENTION } from './capture.js';
+import { createReplicationEngine } from './replication.js';
+import { REPLICATION_DEFAULTS } from './replication-format.js';
+import { createLogicalRows } from './logical-rows.js';
+import { shapeHash } from './migrate.js';
 import { createLiveRegistry, classifyLiveQuery, LIVE_DEFAULTS } from './live.js';
+import { classifyEntityLive } from './live-join.js';
 import { normalizeEventTime } from './live-time.js';
 import { createJobEngine } from './jobs.js';
+import { introspectModel } from './introspect.js';
 import { collectEntityRoots, entityRoot } from './plan.js';
 import {
   DERIVE_KINDS, PHYSICAL_KINDS, PRECISION_MIN, PRECISION_MAX, DIMS_MIN, DIMS_MAX,
   derivedValue, memberAt, storedMemberForm, registerDeriveFunctions,
 } from './derive.js';
+import {
+  normalizeExpression, canonicalExpression, expressionMembers, registerExpressionFunctions,
+} from './expression.js';
 
 /** The model format version this store implements. */
 export const MODEL_VERSION = '0.1';
@@ -194,9 +208,13 @@ function normalizeDerive(index, paths, docPath) {
  * Normalize and check a model document. Every failure is `JD0005` with
  * a `docPath` into the model.
  * @param {any} model
+ * @param {Record<string, any>} [expressions] - the host's declared
+ *   index-expression functions, by name: a model that names one is
+ *   resolved against them here, so an unknown, wrong-arity or
+ *   non-deterministic function is `JD0004` before any DDL
  * @returns {Map<string, any>} collection name -> normalized collection
  */
-export function normalizeModel(model) {
+export function normalizeModel(model, expressions = undefined) {
   if (model === null || typeof model !== 'object' || Array.isArray(model))
     throw modelError('JD0005', 'the model document must be an object', '');
   if (model.$model !== MODEL_VERSION) {
@@ -285,6 +303,38 @@ export function normalizeModel(model) {
           `duplicate index name '${index.name}'`, `${indexDocPath}/name`);
       }
       indexNames.add(index.name);
+      // an EXPRESSION index names what it computes, not which member it
+      // reads, so it is mutually exclusive with both of the other two
+      // ways an index is declared: an index cannot be over a member AND
+      // over a function of one, and a derived spatial column is already
+      // an expression this format spells for you
+      if (index.expression !== undefined) {
+        if (index.path !== undefined) {
+          throw modelError('JD0004',
+            'an index declares a path OR an expression: an expression names the members it '
+            + 'reads itself', `${indexDocPath}/path`);
+        }
+        if (index.derive !== undefined) {
+          throw modelError('JD0004',
+            'a derived index IS an expression this format spells; declare one or the other',
+            `${indexDocPath}/derive`);
+        }
+        const expression = normalizeExpression(index.expression,
+          `${indexDocPath}/expression`, expressions);
+        indexes.push({
+          name: index.name,
+          paths: expressionMembers(expression),
+          expression,
+          canonical: canonicalExpression(expression),
+          unique: index.unique === true,
+          derive: null,
+          precision: undefined,
+          physical: undefined,
+          dims: undefined,
+          docPath: indexDocPath,
+        });
+        continue;
+      }
       const paths = Array.isArray(index.path) ? index.path : [index.path];
       if (paths.length === 0
         || paths.some((p) => typeof p !== 'string' || p === '')) {
@@ -379,24 +429,48 @@ function requireKey(key, collection, docPath) {
  * @returns {DbRuntimeError}
  */
 function wrapWriteError(error, plan, collection, docPath, key) {
-  // an error that already carries a code (a closed store, a refused
-  // document) is the error; only the driver's own failures are wrapped
-  if (typeof error?.code === 'string' && error.code.startsWith('JD')) return error;
-  if (isDuplicateKeyError(error, plan.table, plan.keyColumn)) {
-    return new DbRuntimeError('JD2001',
-      `a document already exists under key '${String(key)}'`,
-      { docPath, collection, key, cause: error });
-  }
-  return new DbRuntimeError('JD2005',
-    `the database rejected the operation: ${error?.message ?? String(error)}`,
-    key === undefined
-      ? { docPath, collection, cause: error }
-      : { docPath, collection, key, cause: error });
+  // one classifier for every path: a coded error (a closed store, a
+  // refused document) passes through it untouched
+  return wrapDriverError(error, {
+    docPath, collection, ...(key === undefined ? undefined : { key }),
+    unique: { table: plan.table, column: plan.keyColumn },
+    duplicateReason: `a document already exists under key '${String(key)}'`,
+  });
+}
+
+/**
+ * Run `fn` inside an IMMEDIATE transaction on an otherwise idle
+ * connection — the open path's shape work. A deferred transaction (a
+ * bare savepoint) takes its write lock only when the first write
+ * arrives, and a concurrent commit between the probe and the CREATE
+ * turns that upgrade into the one SQLITE_BUSY the busy handler cannot
+ * retry; taking the write lock first makes the wait an ordinary busy
+ * wait the timeout covers. Exactly the bracket the migration runner
+ * uses; the driver's savepoint machinery is not involved, because at
+ * open nothing else holds the connection.
+ * @param {any} connection
+ * @param {() => any} fn - value-or-promise
+ * @returns {any} value-or-promise
+ */
+function immediately(connection, fn) {
+  const dialect = connection.dialect;
+  const commit = (value) => chain(connection.exec(dialect.tx.commit), () => value);
+  const rollback = (error) => chain(connection.exec(dialect.tx.rollback), () => { throw error; });
+  return chain(connection.exec(dialect.tx.beginImmediate), () => {
+    let out;
+    try {
+      out = fn();
+    }
+    catch (error) {
+      return rollback(error);
+    }
+    return isThenable(out) ? out.then(commit, rollback) : commit(out);
+  });
 }
 
 /**
  * Create or verify every collection's physical shape, inside one
- * transaction.
+ * immediate transaction.
  * @param {any} connection
  * @param {Map<string, any>} collections
  * @param {Map<string, any>} plans
@@ -405,7 +479,9 @@ function wrapWriteError(error, plan, collection, docPath, key) {
 function ensureShape(connection, collections, plans, readOnly) {
   const dialect = connection.dialect;
   const names = [...collections.keys()];
-  return connection.transaction(() => {
+  // a read-only store creates nothing, and cannot take a write lock
+  const bracket = readOnly ? (fn) => fn() : (fn) => immediately(connection, fn);
+  return bracket(() => {
     const step = (i) => {
       if (i >= names.length) return null;
       const name = names[i];
@@ -421,7 +497,7 @@ function ensureShape(connection, collections, plans, readOnly) {
             }
             const run = (j) => (j >= plan.createSql.length
               ? null
-              : chain(connection.exec(plan.createSql[j]), () => run(j + 1)));
+              : chain(connection.exec(dialect.ddl.idempotent(plan.createSql[j])), () => run(j + 1)));
             return chain(run(0), () => step(i + 1));
           }
           return chain(verifyShape(connection, plan, name, collection.docPath),
@@ -447,7 +523,8 @@ function ensureEntityShape(connection, entityPlans, entities, readOnly) {
   if (entityPlans.size === 0) return null;
   const dialect = connection.dialect;
   const names = [...entityPlans.keys()];
-  return connection.transaction(() => {
+  const bracket = readOnly ? (fn) => fn() : (fn) => immediately(connection, fn);
+  return bracket(() => {
     const step = (i) => {
       if (i >= names.length) return null;
       const name = names[i];
@@ -463,7 +540,7 @@ function ensureEntityShape(connection, entityPlans, entities, readOnly) {
             }
             const run = (j) => (j >= plan.createSql.length
               ? null
-              : chain(connection.exec(plan.createSql[j]), () => run(j + 1)));
+              : chain(connection.exec(dialect.ddl.idempotent(plan.createSql[j])), () => run(j + 1)));
             return chain(run(0), () => step(i + 1));
           }
           return chain(verifyShape(connection, plan, name, docPath), () =>
@@ -510,10 +587,11 @@ function ensureEntityShape(connection, entityPlans, entities, readOnly) {
  * @param {any} plan
  * @param {((doc: any) => any) | null} validate
  * @param {any} queryState - the store-wide statement cache and UDF set
- * @param {{ profile: any }} storeProfileRef - the store-level profile
+ * @param {{ profile: any, roots: readonly string[] }} storeProfileRef - the
+ *   store-level profile and every root a member allow-list may name
  * @returns {any}
  */
-function collectionCore(connection, collection, plan, validate, queryState, storeProfileRef) {
+function collectionCore(connection, collection, plan, validate, queryState, storeProfileRef, runtime) {
   const dialect = connection.dialect;
   // the STORED branch (a driver that cannot index a registered
   // function): the derived columns are ordinary ones, so every write
@@ -562,7 +640,7 @@ function collectionCore(connection, collection, plan, validate, queryState, stor
   const stats = { patchTranslated: 0, patchFallback: 0 };
   const engine = createQueryEngine({
     connection, state: queryState, collection, physicalPlan: plan,
-    profile: storeProfileRef.profile,
+    profile: storeProfileRef.profile, roots: storeProfileRef.roots,
   });
 
   const checkValid = (doc) => {
@@ -585,7 +663,7 @@ function collectionCore(connection, collection, plan, validate, queryState, stor
     }
     if (explicitKey !== undefined)
       return requireKey(explicitKey, collection.name, collection.docPath);
-    if (collection.identity === 'uuid') return crypto.randomUUID();
+    if (collection.identity === 'uuid') return runtime.uuid();
     return null; // integer: the database allocates
   };
 
@@ -606,9 +684,12 @@ function collectionCore(connection, collection, plan, validate, queryState, stor
     explain: (document, options) => engine.explain(document, options),
     get(key) {
       requireKey(key, collection.name, collection.docPath);
-      return chain(prepared('get', dialect.dml.get(shape)), (statement) =>
+      // a point read meets the same failures a statement of the query
+      // engine does (a corrupt page, a locked file): classified, never raw
+      return attempt(() => chain(prepared('get', dialect.dml.get(shape)), (statement) =>
         chain(statement.get([key]),
-          (row) => (row === undefined ? undefined : JSON.parse(row.doc))));
+          (row) => (row === undefined ? undefined : JSON.parse(row.doc)))),
+      (error) => wrapDriverError(error, { docPath: collection.docPath, collection: collection.name, key }));
     },
     insert(doc) {
       checkValid(doc);
@@ -726,20 +807,6 @@ function asyncCollection(core, live) {
   });
 }
 
-/**
- * Resolve the store's operator seam (Ring 2) to a single
- * `{ functions, extensions }` or `null`. Accepts `options.operators` (a
- * registry from `@jarenjs/json/jslt`'s `createJsltRegistry()`) and/or
- * raw `options.functions` / `options.extensions`. A registered operator
- * becomes engine vocabulary the query planner recognises and the
- * residual evaluates — it runs correctly in JavaScript over the fetched
- * rows, and is never pushed to SQL in this ring (that is Ring 3). Bad
- * input is API misuse (a synchronous `TypeError`), consistent with the
- * driver check. When no registry is threaded the return is `null`, and
- * the whole query engine is byte-identical to before.
- * @param {any} options
- * @returns {{ functions: any, extensions: any } | null}
- */
 /**
  * The schema a WRITE validates against. A store-allocated key (`default:
  * "auto"`) is absent from the document the injected hook sees — the
@@ -760,6 +827,50 @@ function writeSchemaOf(entity) {
   return out;
 }
 
+/**
+ * Resolve the store's operator seam (Ring 2) to a single
+ * `{ functions, extensions }` or `null`. Accepts `options.operators` (a
+ * registry from `@jarenjs/json/jslt`'s `createJsltRegistry()`) and/or
+ * raw `options.functions` / `options.extensions`. A registered operator
+ * becomes engine vocabulary the query planner recognises and the
+ * residual evaluates — it runs correctly in JavaScript over the fetched
+ * rows, and is never pushed to SQL in this ring (that is Ring 3). Bad
+ * input is API misuse (a synchronous `TypeError`), consistent with the
+ * driver check. When no registry is threaded the return is `null`, and
+ * the whole query engine is byte-identical to before.
+ * @param {any} options
+ * @returns {{ functions: any, extensions: any } | null}
+ */
+/**
+ * The declaration rules a registry aggregate must satisfy to be lowered
+ * to a SQL aggregate, checked once at open: `kind: 'agg'`, ONE leading
+ * sequence operand (the fold's input) and nothing else, and a scalar
+ * result. The arity rule is not fussiness — a SQL aggregate's `result`
+ * step sees only what the row steps accumulated, so a second operand
+ * simply does not reach a fold over zero rows, and an aggregate that
+ * answered a different value for an empty input than the engine does
+ * would be worse than one that stays where it is. A pack that marks
+ * something else `pushable: 'aggregate'` is a host configuration
+ * error, loud here rather than a silent non-promotion.
+ * @param {string} name
+ * @param {any} meta - the registry's `forSql()` entry
+ * @returns {{ fn: Function }}
+ */
+function aggregateSpec(name, meta) {
+  const kinds = (Array.isArray(meta.signature) ? meta.signature : [])
+    .map((token) => (typeof token === 'string' && token.startsWith('seq') ? 'seq' : 'scalar'));
+  const wellFormed = meta.kind === 'agg'
+    && kinds.length === 1 && kinds[0] === 'seq'
+    && meta.signature[0] === 'seq<number>'
+    && meta.result === 'number'
+    && typeof meta.fn === 'function';
+  if (!wellFormed) {
+    throw new TypeError(`openStore: operator '${name}' declares pushable: 'aggregate', which `
+      + "needs kind: 'agg' with exactly one operand, 'seq<number>', and result: 'number'");
+  }
+  return { fn: meta.fn };
+}
+
 function resolveOperators(options) {
   const registry = options.operators;
   const hasRegistry = registry !== undefined && registry !== null;
@@ -772,6 +883,11 @@ function resolveOperators(options) {
   // UDFs where the driver supports them. Raw (registry-free) extensions
   // are never pushed — only a registry declares pushability.
   const pushableScalar = new Set();
+  // the SQL-pushable AGGREGATE subset (Ring 3): a registry `agg` entry
+  // marked `pushable: 'aggregate'`, which promises a fold over the
+  // multiset alone — a SQL aggregate visits rows in an order nothing
+  // specifies — and a finite-or-empty scalar result
+  const pushableAggregate = new Map();
   if (hasRegistry) {
     if (typeof registry.toOptions !== 'function') {
       throw new TypeError('openStore: operators must be a registry '
@@ -785,12 +901,13 @@ function resolveOperators(options) {
     if (typeof registry.forSql === 'function') {
       for (const [name, meta] of Object.entries(registry.forSql())) {
         if (meta.pushable === 'scalar') pushableScalar.add(name);
+        else if (meta.pushable === 'aggregate') pushableAggregate.set(name, aggregateSpec(name, meta));
       }
     }
   }
   if (options.functions !== undefined) functions = { ...functions, ...options.functions };
   if (options.extensions !== undefined) extensions = { ...extensions, ...options.extensions };
-  return Object.freeze({ functions, extensions, pushableScalar });
+  return Object.freeze({ functions, extensions, pushableScalar, pushableAggregate });
 }
 
 /**
@@ -798,8 +915,12 @@ function resolveOperators(options) {
  * @param {any} model - A `jaren-model` document (the 0.1 subset)
  * @param {{ driver: any, path?: string, compileSchema?: Function,
  *   busyTimeout?: number, queueTimeout?: number, journalMode?: string,
+ *   synchronous?: string, walAutocheckpoint?: number,
+ *   journalSizeLimit?: number, cacheSize?: number, mmapSize?: number,
+ *   tempStore?: string,
  *   statementCacheBound?: number, profile?: any, operators?: any,
  *   functions?: any, extensions?: any, zoneProvider?: any,
+ *   runtime?: Partial<import('@jarenjs/core/runtime').Runtime>,
  *   readOnly?: boolean }} options
  *   `zoneProvider` is D7's injected clock: a named zone in a temporal
  *   spec (`{ "every": "P1M", "zone": "Europe/Amsterdam" }`) is host code
@@ -807,6 +928,20 @@ function resolveOperators(options) {
  *   such a document (`JQ0003`) rather than answering it in UTC. It
  *   reaches every residual compilation, which is where the calendar
  *   ladder actually walks.
+ *   The connection pragmas — `busyTimeout`, `journalMode`, `synchronous`,
+ *   `walAutocheckpoint`, `journalSizeLimit`, `cacheSize`, `mmapSize`,
+ *   `tempStore` — are a closed, validated set (`pragmas.js`): an option
+ *   naming any other pragma is refused `JD0006`, one the driver or the
+ *   store kind cannot apply `JD0007`, and every value is read back after
+ *   the open sequence and reported on `capabilities.pragmas` — a value
+ *   the engine did not take is `JD0008`, never a silent divergence.
+ *   `runtime` is the host's runtime record (`@jarenjs/core/runtime`):
+ *   the clock the capture log and the job queue stamp, the identifier
+ *   a `uuid` identity and a `default: 'uuid'` allocate, the job queue's
+ *   backoff jitter, and the zone provider — each read only where the
+ *   store has no explicit option for it (`zoneProvider`, `jobs.now`,
+ *   `jobs.random` win), and handed on to the job engine so a consumer
+ *   configures it once.
  * @returns {Promise<any>}
  */
 export function openStore(model, options) {
@@ -817,6 +952,10 @@ export function openStore(model, options) {
   if (options.compileSchema !== undefined && typeof options.compileSchema !== 'function')
     throw new TypeError('openStore: compileSchema must be a function when present');
   const operators = resolveOperators(options);
+  const runtime = resolveRuntime(options.runtime);
+  // the explicit option wins over the record's member, and an explicit
+  // `null` is a deliberate "none" rather than a fall-through
+  const zoneProvider = options.zoneProvider !== undefined ? options.zoneProvider : runtime.zoneProvider;
 
   // API misuse (above) throws; a defective MODEL rejects, per the
   // asynchronous contract
@@ -824,9 +963,12 @@ export function openStore(model, options) {
   let entities;
   let mapping;
   try {
-    collections = normalizeModel(model);
+    collections = normalizeModel(model, options.expressions);
     entities = normalizeEntities(model);
     mapping = entities.size > 0 ? explainMapping(model) : null;
+    if (options.replication !== undefined && [...collections.keys(), ...entities.keys()]
+      .some((name) => name.toLowerCase().startsWith('_jaren_replica')))
+      throw new DbCompileError('JD0060', 'replication reserves table names beginning with _jaren_replica');
     if (collections.size === 0 && entities.size === 0) {
       throw modelError('JD0005',
         'the model must declare at least one collection or entity', '');
@@ -836,17 +978,53 @@ export function openStore(model, options) {
     return Promise.reject(error);
   }
   const path = options.path ?? ':memory:';
-  const busyTimeout = options.busyTimeout ?? 5000;
-  const journalMode = options.journalMode ?? 'wal';
   const memory = path === ':memory:' || path === '';
   const readOnly = options.readOnly === true;
+  // the connection pragmas are a closed, validated set: a pragma outside
+  // it is JD0006, one this store kind cannot take is JD0007, and a bad
+  // value is API misuse — all settled before the driver opens, so a
+  // refused configuration never acquires a handle
+  let pragmaRequests;
+  try {
+    refuseUnsupportedPragmaKeys(options);
+    pragmaRequests = resolvePragmaRequests(options, { memory, readOnly });
+  }
+  catch (error) {
+    return Promise.reject(error);
+  }
+  const busyTimeout = /** @type {number} */ (pragmaRequests.get('busyTimeout')?.value);
   const storeProfile = options.profile === undefined
     ? null
     : normalizeProfile(options.profile);
+  // every root a profile's member allow-list may name — the model's own
+  // collections and entities — so a policy that names something the
+  // model does not declare is refused rather than applied to nothing
+  const declaredRoots = Object.freeze([...collections.keys(), ...entities.keys()]);
+  try {
+    assertProfileRoots(storeProfile, declaredRoots);
+  }
+  catch (error) {
+    return Promise.reject(error);
+  }
+
+  /** A driver failure at or after `driver.open` as the open's own
+   * refusal: `JD0002`, with the classifier's `class`/`retryable` and the
+   * driver's error as `cause`.
+   * @param {any} failure */
+  const openFailure = (failure) => {
+    const classified = classifyDriverError(failure);
+    const wrapped = new DbCompileError('JD0002',
+      `the store could not be opened (${classified.reason}): ${failure?.message ?? String(failure)}`,
+      undefined, failure);
+    wrapped.class = classified.class;
+    wrapped.retryable = classified.retryable;
+    return wrapped;
+  };
 
   return toPromise(chain(
-    options.driver.open(path,
+    attempt(() => options.driver.open(path,
       { timeout: busyTimeout, readOnly, queueTimeout: options.queueTimeout }),
+    (failure) => (isDriverError(failure) ? openFailure(failure) : failure)),
     (opened) => {
       /**
        * The transaction SCOPE that currently owns the driver connection,
@@ -857,12 +1035,68 @@ export function openStore(model, options) {
        */
       let scope = null;
 
+      /**
+       * The IDENTITY of the scope that is current right now, or `null`.
+       * One fresh identity per `withScope` invocation: it is what every
+       * transaction view is pinned to (§5.1's exact-scope rule), and the
+       * comparison `currentScope === identity` is the whole lifetime
+       * check — a view whose identity is not current has either settled
+       * or been crossed by an inner scope, and refuses `JD2070` before
+       * reading tracker state or issuing a statement. It must never fall
+       * through to the root and never follow a newer scope.
+       * @type {any}
+       */
+      let currentScope = null;
+
+      /**
+       * What the OPEN transaction owes its in-memory callers once the
+       * database has agreed, in registration order, or `null` when no
+       * transaction is open. One list, owned by the outermost scope: a
+       * nested savepoint remembers only where it started, so rolling it
+       * back takes back exactly what it registered and releasing it hands
+       * those effects to the scope that outlives it.
+       *
+       * It exists because an in-memory claim about what the database
+       * holds may not become true before the database does — the unit of
+       * work's snapshots are such a claim, and a savepoint release is not
+       * a commit.
+       * @type {{ commit: () => void, rollback: () => void }[] | null}
+       */
+      let settlements = null;
+
+      /**
+       * The unit of work the OPEN scope writes through, and the store's
+       * own. A nested savepoint inherits whatever is in force — it is the
+       * same unit of work one level down — while a transaction asked for
+       * `unitOfWork: 'own'` gets a fresh one for its callback's lifetime.
+       * Both are set once the model's cores exist.
+       * @type {any}
+       */
+      let work = null;
+      /** @type {any} */
+      let rootWork = null;
+
+      /**
+       * Run what the open transaction owes on its COMMIT, in registration
+       * order, and empty the list. Idempotent, and safe to re-enter: each
+       * effect is taken off the list before it runs.
+       */
+      const flushSettlements = () => {
+        if (settlements === null) return;
+        for (const effect of settlements.splice(0)) effect.commit?.();
+      };
+
       /**
        * What the cores talk to: the owning transaction's scope while one
-       * is open, the driver connection otherwise. One indirection here
-       * instead of a parallel set of handles per transaction — and it is
-       * why a write inside a transaction callback runs immediately as the
-       * owner rather than waiting for a commit it is part of.
+       * is open, the driver connection otherwise. One indirection, so a
+       * core issues its statements wherever the caller that reached it is
+       * — and it is why work inside a transaction callback runs
+       * immediately as the owner rather than waiting for a commit it is
+       * part of.
+       *
+       * It is NOT what separates a store-level caller from the
+       * transaction: that is the gate below, which the store's own
+       * handles take and a scope-bound handle does not.
        */
       const connection = Object.freeze({
         get synchronous() { return opened.synchronous; },
@@ -871,51 +1105,113 @@ export function openStore(model, options) {
         /** @param {string} sql */
         exec: (sql) => (scope ?? opened).exec(sql),
         /** @param {string} sql */
-        prepare: (sql) => (scope ?? opened).prepare(sql),
+        prepare: (sql, metadata) => (scope ?? opened).prepare(sql, metadata),
         /** Internal transaction users (jobs, checkpoints, migrations)
          * nest when a transaction is open and take the gate when not. */
         transaction: (fn) => withScope((scope ?? opened).transaction, fn),
+        /**
+         * Register what settling the OPEN transaction owes an in-memory
+         * caller: `commit` when it commits, `rollback` when it rolls back,
+         * either half optional. With nothing open the statements are
+         * already durable, so `commit` runs at once and the rollback is
+         * discarded. The effects are bookkeeping — they run after the last
+         * statement of their scope and must issue none.
+         * @param {{ commit?: () => void, rollback?: () => void }} effects
+         */
+        onSettle: (effects) => {
+          if (settlements === null) effects.commit?.();
+          else settlements.push(effects);
+        },
         registerFunction: opened.registerFunction === null ? null
           : (/** @type {string} */ name, /** @type {any} */ o, /** @type {Function} */ fn) =>
             opened.registerFunction(name, o, fn),
+        registerAggregate: opened.registerAggregate === null ? null
+          : (/** @type {string} */ name, /** @type {any} */ spec) =>
+            opened.registerAggregate(name, spec),
         session: opened.session === null ? null
           : (/** @type {any} */ table) => opened.session(table),
+        // the online-backup primitives, when the binding has them
+        backup: opened.backup ?? null,
         close: () => opened.close(),
       });
 
       /**
        * Run `fn` as a transaction opened by `open`, with `scope` bound to
-       * it for the callback's whole lifetime and restored afterwards.
+       * it for the callback's whole lifetime and restored afterwards. The
+       * scope also settles what was registered against it: commits in
+       * registration order when it keeps, rollbacks in reverse when it
+       * does not, and only its own when it is an inner savepoint.
+       *
+       * `fn` receives the driver scope and this invocation's fresh
+       * IDENTITY. A user-facing caller builds the transaction view from
+       * the pair; internal nesting (a save's own transaction, a capture
+       * scope, a membership attach) ignores both and runs through the
+       * dynamic connection, which after the view's `JD2070` check is
+       * exactly its own scope.
        * @param {(inner: (s: any) => any) => any} open - the driver's
        *   `transaction`, gated (top level) or nesting (inner)
-       * @param {(store: any) => any} fn
+       * @param {(inner: any, identity: any) => any} fn
+       * @param {any} [ownWork] - a unit of work for this scope alone;
+       *   without one the scope writes through whatever is already in
+       *   force, which is what makes an inner savepoint part of the same
+       *   unit of work as the transaction around it
        */
-      function withScope(open, fn) {
+      function withScope(open, fn, ownWork) {
         return open((inner) => {
           const outer = scope;
+          const outerWork = work;
+          const outerIdentity = currentScope;
+          const outermost = settlements === null;
+          if (outermost) settlements = [];
+          const list = /** @type {any[]} */ (settlements);
+          // where this scope's own effects begin: a rollback takes back
+          // from here, and everything before it belongs to a scope that
+          // is still open
+          const mark = list.length;
+          const identity = {};
           scope = inner;
-          const restore = () => { scope = outer; };
+          currentScope = identity;
+          if (ownWork !== undefined) work = ownWork;
+          const kept = () => {
+            if (outermost) flushSettlements();
+          };
+          const undone = () => {
+            const mine = list.splice(mark);
+            for (let i = mine.length - 1; i >= 0; i--) mine[i].rollback?.();
+          };
+          const restore = (settled) => {
+            if (settled) kept();
+            else undone();
+            scope = outer;
+            work = outerWork;
+            currentScope = outerIdentity;
+            if (outermost) settlements = null;
+          };
           let out;
           try {
-            out = fn(scopedStore());
+            out = fn(inner, identity);
           }
           catch (error) {
-            restore();
+            restore(false);
             throw error;
           }
           if (!isThenable(out)) {
-            restore();
+            restore(true);
             return out;
           }
           return out.then(
-            (value) => { restore(); return value; },
-            (error) => { restore(); throw error; });
+            (value) => { restore(true); return value; },
+            (error) => { restore(false); throw error; });
         });
       }
 
-      /** Set once the store object exists; the transaction callback's
-       * argument, whose `transaction` NESTS instead of queueing. */
-      let scopedStore = () => undefined;
+      /** Set once the store object exists: builds the transaction
+       * callback's argument for ONE exact scope — a fresh view per
+       * `withScope` invocation, pinned to its identity, whose
+       * `transaction` NESTS instead of queueing. Assigned before any
+       * user-facing transaction can run, so no placeholder is needed.
+       * @type {(driverScope: any, identity: any) => any} */
+      let scopedStore;
 
       /**
        * A TOP-LEVEL store transaction. It takes the connection's gate
@@ -924,8 +1220,75 @@ export function openStore(model, options) {
        * — a rollback then undoes the translated patch together with the
        * rows it describes.
        * @param {(store: any) => any} fn
+       * @param {AbortSignal} [signal]
+       * @param {any} [ownWork]
+       */
+      // a driver failure of the transaction itself — a `BEGIN IMMEDIATE`
+      // that outwaits the busy timeout — is classified like a statement's
+      // (`wrapDriverError` passes a callback's own error through untouched)
+      const beginTransaction = (inner, signal, mode) =>
+        attempt(() => opened.transaction(inner, signal, mode),
+          (error) => wrapDriverError(error, { docPath: '/transaction' }));
+      let topLevelTransaction = (fn, signal, ownWork, mode) =>
+        withScope((inner) => beginTransaction(inner, signal, mode),
+          (inner, identity) => fn(scopedStore(inner, identity)), ownWork);
+
+      /**
+       * How a store-level call behaves when another caller's transaction
+       * owns the connection: `'wait'` queues behind it under the
+       * connection's `queueTimeout`, `'strict'` refuses at once. A host
+       * that would rather see the contention than pay for it asks for
+       * strict; the default keeps a contended call correct instead of
+       * fast.
+       */
+      const strictTransactions = options.transactions === 'strict';
+      if (options.transactions !== undefined && options.transactions !== 'wait'
+        && options.transactions !== 'strict') {
+        return Promise.reject(new TypeError(
+          "openStore: transactions must be 'wait' or 'strict'"));
+      }
+
+      /** The refusal a contended store-level call gets when it cannot
+       * wait. It names the scope-bound spelling, because a caller that
+       * meant to be inside the transaction has one and a caller that did
+       * not has to wait for the commit either way. */
+      const contended = (why) => new DbCompileError('JD0012',
+        `a transaction owns this store's connection and ${why}. Work that belongs `
+        + 'INSIDE the transaction goes through the store the callback received '
+        + '(tx.collection / tx.entity / tx.saveChanges); work that does not belongs '
+        + 'after it commits.');
+
+      /**
+       * Run one STORE-LEVEL call: a caller that is not inside whatever
+       * transaction is open. It holds the connection for its own extent,
+       * so its statements can never fall inside a stranger's transaction
+       * and share a rollback it knows nothing about — the defect that
+       * made "one store per concurrent writer" the only safe advice.
+       *
+       * Root jobs and worker control I/O take exactly this gate too:
+       * an unrelated enqueue, claim, renewal or settlement waits for the
+       * open transaction instead of joining its fate, and a `signal`
+       * (a worker winding down) abandons a call still in the queue.
+       * @param {() => any} fn
+       * @param {string} [what] - what is waiting, for the timeout message
+       * @param {AbortSignal} [signal]
        */
-      let topLevelTransaction = (fn) => withScope(opened.transaction, fn);
+      const gated = (fn, what, signal) => {
+        if (strictTransactions && opened.mustQueue)
+          throw contended("{ transactions: 'strict' } refuses to queue behind it");
+        return withScope((inner) => opened.exclusively(inner, what, signal), fn);
+      };
+
+      /** The synchronous surface's gate. It cannot wait — waiting hands
+       * a Promise back under a value's type — so a contended call is a
+       * refusal whatever the mode. */
+      const gatedSync = (fn) => {
+        if (opened.mustQueue) {
+          throw contended('the synchronous surface answers values, so it cannot '
+            + 'wait for the commit');
+        }
+        return withScope(opened.exclusively, fn);
+      };
 
       // ————— the rejection boundary around an ACQUIRED connection —————
       // Initialization continues for a long way past `driver.open`:
@@ -943,7 +1306,11 @@ export function openStore(model, options) {
        * @param {any} error
        * @returns {Promise<never>}
        */
-      const failClosed = (error) => {
+      const failClosed = (failure) => {
+        // a driver failure inside the open sequence (a locked or corrupt
+        // file, an unopenable path) is the open's refusal, classed; a
+        // coded refusal or API misuse is itself
+        const error = isDriverError(failure) ? openFailure(failure) : failure;
         if (closed) return Promise.reject(error);
         closed = true;
         /** @param {any} closeError */
@@ -967,8 +1334,9 @@ export function openStore(model, options) {
       // property of the driver that created the file, so a database
       // built under one and opened under the other legitimately reports
       // drift — that is a migration, not an open.
-      const derivedMapping = connection.capabilities.deterministicIndexableFunctions === true
-        ? 'virtual' : 'stored';
+      const registersFunctions =
+        connection.capabilities.deterministicIndexableFunctions === true;
+      const derivedMapping = registersFunctions ? 'virtual' : 'stored';
       // the SECOND physical branch, and the same posture: a build
       // without the R*Tree module maps `physical: 'rtree'` back onto
       // the B-tree over the four columns and SAYS so through
@@ -988,7 +1356,8 @@ export function openStore(model, options) {
       try {
         for (const [name, collection] of collections)
           plans.set(name, planCollection(name, collection, dialect,
-            { derived: derivedMapping, rtree: rtreeCapable }));
+            { derived: derivedMapping, rtree: rtreeCapable,
+              expressions: options.expressions, registered: registersFunctions }));
         if (mapping !== null) {
           for (const name of Object.keys(mapping.entities))
             entityPlans.set(name, planEntity(name, mapping.entities[name], mapping, dialect));
@@ -1009,17 +1378,34 @@ export function openStore(model, options) {
       const needsDeriveFunctions = derivedMapping === 'virtual'
         && [...plans.values()].some((plan) => plan.generated.some(
           (column) => column.derive !== undefined && column.stored !== true));
+      // A table whose column expression calls a declared function cannot
+      // be SELECTed from — let alone written to — by a connection that
+      // has not registered it, so the registration precedes every
+      // statement over it. Only where this connection COMPUTES the
+      // expression: where the engine calls its own immutable function
+      // there is nothing to register.
+      const expressionNames = registersFunctions
+        ? [...new Set([...plans.values()].flatMap((plan) =>
+          plan.expressions.flatMap((entry) => entry.functions)))].sort()
+        : [];
 
-      const pragmas = chain(
-        memory
-          ? null
-          : chain(connection.exec(dialect.pragma.busyTimeout(busyTimeout)),
-            // a journal-mode change writes; a read-only store keeps
-            // whatever mode the file already has
-            () => (readOnly ? null : connection.exec(dialect.pragma.journalMode(journalMode)))),
-        // referential integrity is real only when the pragma is ON —
-        // it defaults off, so set it AND verify it per connection
-        () => chain(connection.exec(dialect.pragma.foreignKeys(true)), () =>
+      /** The effective connection pragmas, read back after the open
+       * sequence applied them — what the capability report carries.
+       * @type {any} */
+      let effectivePragmas = null;
+      // the closed configuration set, applied in table order and then
+      // read back in full (JD0007 for a pragma this binding cannot
+      // apply, JD0008 for one the engine did not take); then referential
+      // integrity, which is real only when the pragma is ON — it
+      // defaults off, so it is set AND verified per connection. Built
+      // inside `opening` so a synchronous refusal reaches `failClosed`
+      const pragmas = () => chain(configurePragmas(connection, pragmaRequests), (effective) => {
+        effectivePragmas = effective;
+        // an engine that always enforces referential integrity has no
+        // switch to set and nothing to read back; SQLite's defaults OFF,
+        // so there it is set AND verified per connection
+        if (dialect.capabilities.foreignKeysAlwaysOn === true) return null;
+        return chain(connection.exec(dialect.pragma.foreignKeys(true)), () =>
           chain(connection.prepare(dialect.introspect.foreignKeysOn()), (statement) =>
             chain(statement.get([]), (row) => {
               if (Number(row?.enabled) !== 1) {
@@ -1027,9 +1413,12 @@ export function openStore(model, options) {
                   'this connection cannot enforce foreign keys (PRAGMA foreign_keys stayed off)');
               }
               return null;
-            }))));
+            })));
+      });
 
-      const opening = () => chain(pragmas, () =>
+      const opening = () => chain(pragmas(), () =>
+        chain(registerExpressionFunctions(connection, expressionNames,
+          options.expressions ?? {}), () =>
         chain(needsDeriveFunctions ? registerDeriveFunctions(connection) : null, () =>
         chain(ensureShape(connection, collections, plans, readOnly), () =>
         chain(ensureEntityShape(connection, entityPlans, entities, readOnly), () => {
@@ -1051,20 +1440,33 @@ export function openStore(model, options) {
                 throw new TypeError('openStore: compileSchema must return a validation function');
               core = captureCollection(name, collectionCore(connection, collection,
                 plans.get(name), validate, queryState,
-                { profile: storeProfile }));
+                { profile: storeProfile, roots: declaredRoots }, runtime));
               cores.set(name, core);
             }
             return core;
           };
 
           // ————— change capture (LIVE-FORMAT §§1–6) —————
-          const captureRequested = options.capture === true
+          const captureOption = options.capture ?? (options.replication === undefined ? undefined : true);
+          const captureRequested = captureOption === true
             ? {}
-            : (options.capture === undefined || options.capture === false
-              ? null : options.capture);
+            : (captureOption === undefined || captureOption === false
+              ? null : captureOption);
+          if (options.replication !== undefined && (captureRequested === null || readOnly))
+            throw new TypeError('replication requires a writable store with capture enabled');
           let captureMode = 'none';
           if (captureRequested !== null) {
             const wanted = captureRequested.mode ?? 'auto';
+            // the ledger and its journal are SQLite spellings; a
+            // connection that says it has no change capture is refused
+            // by name rather than at the first statement over a table
+            // this store would never have created there
+            if (connection.capabilities.changeCapture !== true) {
+              throw new DbCompileError('JD0051',
+                'change capture is unavailable on this driver: it declares no change '
+                + 'ledger, so neither a changeset journal nor a live query can be built '
+                + 'on it');
+            }
             const hasSessions = connection.capabilities.sessions === true
               && typeof connection.session === 'function';
             if (wanted === 'session' && !hasSessions) {
@@ -1077,6 +1479,9 @@ export function openStore(model, options) {
               ? (hasSessions ? 'session' : 'journal')
               : wanted;
           }
+          if (options.replication !== undefined && captureMode === 'journal'
+            && Object.values(mapping?.entities ?? {}).some((entity) => entity.foreignKeys.some((fk) => fk.onDelete !== 'restrict')))
+            throw new DbCompileError('JD0051', 'journal replication cannot capture cascading or set-null child relations; use session capture');
           const captureShapes = new Map();
           if (captureMode !== 'none') {
             for (const [collectionName, plan] of plans) {
@@ -1127,18 +1532,45 @@ export function openStore(model, options) {
               });
             }
           }
+          // every first-open object — the change log and its state row
+          // here, the job tables below — is created or verified under
+          // the same immediate bracket as the collections' shape, so two
+          // processes opening one fresh file cannot race the seed row or
+          // a column upgrade; a read-only store creates nothing and takes
+          // no lock
+          const firstOpen = readOnly ? (fn) => fn() : (fn) => immediately(connection, fn);
+          let replicationEngine = null;
           const capture = captureMode === 'none' ? null : createCaptureEngine({
             connection,
+            bracket: firstOpen,
             shapes: captureShapes,
             mode: captureMode,
             log: captureRequested.log === true
               || (captureRequested.log !== undefined && captureRequested.log !== false),
             retention: captureRequested.log?.retention ?? DEFAULT_RETENTION,
+            now: runtime.now,
+            beforeCommit: (patch, context) => replicationEngine?.commit(patch, context),
           });
-          const guard = capture === null ? (fn) => fn() : capture.wrap;
+          // the capture scope around a write runs statements of its own
+          // (a session's changeset read, the journal's old-row read, the
+          // log's allocation); a driver failure there is classified as
+          // the write's would be
+          const guard = capture === null
+            ? (fn) => fn()
+            : (fn) => attempt(() => capture.wrap(fn),
+              (error) => wrapDriverError(error, { docPath: '/capture' }));
           if (capture !== null) {
-            topLevelTransaction = (fn) => withScope(opened.transaction,
-              (tx) => capture.nest(() => fn(tx)));
+            // capture changes how records are TRANSLATED, never queue
+            // cancellation or tracker ownership: the replacement has the
+            // ordinary function's exact signature and forwards `signal`
+            // and `ownWork`, with `capture.nest` inside the opened scope.
+            // The view is built from the scope capture's wrap opens —
+            // the INNERMOST one, the exact scope the callback runs in.
+            topLevelTransaction = (fn, signal, ownWork, mode) =>
+              withScope((inner) => beginTransaction(inner, signal, mode),
+                () => capture.nest((innerScope, identity) =>
+                  fn(scopedStore(innerScope, identity))),
+                ownWork);
           }
           // the live registry rides the capture stream; its dispatcher
           // registers FIRST so maintenance sees every record before any
@@ -1146,6 +1578,7 @@ export function openStore(model, options) {
           const liveRegistry = capture === null ? null : createLiveRegistry({
             maxQueries: options.live?.maxQueries ?? LIVE_DEFAULTS.maxQueries,
             maxMaintained: options.live?.maxMaintained ?? LIVE_DEFAULTS.maxMaintained,
+            maxBytes: options.live?.maxBytes ?? LIVE_DEFAULTS.maxBytes,
           });
           if (capture !== null) {
             capture.observe((record) => /** @type {any} */ (liveRegistry).deliver(record));
@@ -1153,11 +1586,24 @@ export function openStore(model, options) {
           // the durable job queue (JOBS-FORMAT), opt-in per store
           const jobsRequested = options.jobs === true
             || (options.jobs !== undefined && options.jobs !== false);
+          if (jobsRequested && connection.capabilities.jobs !== true) {
+            throw new DbCompileError('JD0003',
+              'the durable job queue is unavailable on this driver: it declares no job '
+              + 'queue, and the queue writes its own SQLite statements');
+          }
           const jobsEngine = !jobsRequested ? null : createJobEngine({
             connection,
+            bracket: firstOpen,
+            // the WORKER's control-plane I/O (claims, renewals, its
+            // checkpoint stores, its settlements) is root-owned and takes
+            // the store gate, so it can never join an open application
+            // transaction; `tx.jobs` bypasses this by running as the
+            // exact scope, which is the transactional-outbox spelling
+            gate: (fn, what, signal) => gated(fn, what, signal),
             now: typeof options.jobs === 'object' ? options.jobs.now : undefined,
             random: typeof options.jobs === 'object' ? options.jobs.random : undefined,
             defaults: typeof options.jobs === 'object' ? options.jobs : undefined,
+            runtime,
           });
           /** Register a collection live query (LIVE-FORMAT §7). */
           const refuseAsyncLive = () => {
@@ -1175,7 +1621,7 @@ export function openStore(model, options) {
             const classification = liveOptions?.mode === 'rerun'
               ? { strategy: 'rerun', reason: 'rerun was requested' }
               : classifyLiveQuery(document, core.queryShape, keyed, eventTime);
-            return /** @type {any} */ (liveRegistry).register({
+            return closeOnRollback(/** @type {any} */ (liveRegistry).register({
               name: core.model.name,
               tables: new Set([core.model.name]),
               document,
@@ -1184,10 +1630,21 @@ export function openStore(model, options) {
               classification,
               execute: (doc, executeOptions) => core.execute(doc, executeOptions),
               readRow: (token) => core.get(token),
+              rowPosition: (token) => createLogicalRows({ connection, shapes: captureShapes, capture,
+                collectionCore: coreFor, entityCore: entityCoreFor }).position(core.model.name, token),
               keyOf: (doc) => String(extractKey(doc, core.model.keySegments,
                 core.model.key, core.model.name, core.model.docPath)),
-            });
+            }));
           };
+          /** A live query registered INSIDE a transaction initialized from
+           * that transaction's rows; if the transaction rolls back, those
+           * rows never existed and the query is closed with them rather
+           * than left maintaining a result nothing committed. Registered
+           * at the root, the scope settles at once and nothing is owed. */
+          const closeOnRollback = (registered) => chain(registered, (live) => {
+            connection.onSettle({ rollback: () => live.close() });
+            return live;
+          });
           /** Strip relation members before journal diffs — sessions
            * never see them (they are not stored), so the two modes
            * stay identical. */
@@ -1217,13 +1674,24 @@ export function openStore(model, options) {
                 const sql = `SELECT ${columns.map(dialect.quoteIdentifier).join(', ')} `
                   + `FROM ${dialect.quoteIdentifier(joinName)} `
                   + `WHERE ${dialect.quoteIdentifier(own.column)} = ${dialect.parameterRef(1, 'v')}`;
-                return chain(connection.prepare(sql), (statement) =>
-                  chain(statement.all([keyParts[0]]), (rows) => {
+                const boundedRows = () => {
+                  const { maxOperations = REPLICATION_DEFAULTS.maxOperations, maxBytes = REPLICATION_DEFAULTS.maxBytes } = options.replication;
+                  const cursor = createCursor({ streaming: 'row', barrier: null,
+                    open: () => chain(connection.prepare(`${sql} LIMIT ?`), (statement) => statement.iterate([keyParts[0], maxOperations + 1])),
+                    items: (row) => [row] });
+                  return chain(drainPage(cursor, { limit: maxOperations, maxBytes,
+                    sizeOf: (row) => utf8Length(JSON.stringify(row)), continuationOf: () => null }), (page) => {
+                    if (page.hasMore) throw new DbRuntimeError('JD2106', 'membership cascade exceeds replication capacity');
+                    return page.items;
+                  });
+                };
+                return chain(options.replication === undefined
+                  ? chain(connection.prepare(sql), (statement) => statement.all([keyParts[0]])) : boundedRows(), (rows) => {
                     for (const row of rows) {
                       capture.record(joinName, columns.map((column) => row[column]), undefined, null);
                     }
                     return nextJoin(i + 1);
-                  }));
+                  });
               };
               return nextJoin(0);
             };
@@ -1310,11 +1778,42 @@ export function openStore(model, options) {
             };
           };
 
+          // the maintenance operations over this connection; the store
+          // gates each call below, exactly as a root write is gated
+          const maintenance = createMaintenance({ connection, readOnly, now: runtime.now });
+          // the online backup over the same connection: its checkpoint
+          // boundary takes the gate, its copy runs off it
+          const backup = createBackup({
+            connection, readOnly, gated, checkpoint: maintenance.checkpoint, random: runtime.random,
+            now: runtime.now,
+          });
+
           const capabilities = Object.freeze({
             ...connection.capabilities,
+            // per-operation availability: the binding's declaration, and
+            // for the two that write the store's read-only flag — `false`
+            // exactly where a call is refused (`JD2077`)
+            maintenance: Object.freeze({ ...maintenance.capabilities, backup: backup.capability }),
+            // where a cancellation takes effect, per lifecycle — the
+            // granularity the driver actually has. `midStatement` is a
+            // filled slot, not an absent one: no shipped SQLite binding
+            // exposes an interrupt, and a driver that grows one flips
+            // exactly this member
+            cancellation: Object.freeze({
+              query: 'row', queue: true, migration: 'step', maintenance: 'statement',
+              backup: 'page', midStatement: false,
+            }),
             validated: options.compileSchema !== undefined,
-            busyTimeoutMs: memory ? null : busyTimeout,
-            journalMode: memory || readOnly ? null : journalMode,
+            // the effective connection configuration, read back after the
+            // open sequence applied it: every pragma of the closed set by
+            // option name, `null` where the binding declares the pragma
+            // absent or the engine answers nothing (a memory database's
+            // `mmapSize`)
+            pragmas: effectivePragmas,
+            // the two long-published members, sourced from that same
+            // read-back — never from the request
+            busyTimeoutMs: effectivePragmas.busyTimeout,
+            journalMode: effectivePragmas.journalMode,
             readOnly,
             profiled: storeProfile !== null,
             // the registered operator vocabulary (Ring 2): the names a
@@ -1333,7 +1832,7 @@ export function openStore(model, options) {
             // ZONE will compile at all here. Without one the document is
             // refused (`JQ0003`) rather than answered in UTC, and a
             // consumer that wants to know before it asks reads this
-            zoneProvider: options.zoneProvider !== undefined && options.zoneProvider !== null,
+            zoneProvider: zoneProvider !== undefined && zoneProvider !== null,
             capture: captureMode,
             captureLog: captureMode !== 'none'
               && (captureRequested.log === true
@@ -1346,9 +1845,10 @@ export function openStore(model, options) {
           });
 
           const queryState = createQueryState(options.statementCacheBound, operators,
-            options.zoneProvider);
+            zoneProvider, runtime.now);
           const entityEngine = entities.size > 0
-            ? createEntityQueryEngine({ connection, entities, mapping, state: queryState })
+            ? createEntityQueryEngine({ connection, entities, mapping, state: queryState,
+              profile: storeProfile, roots: declaredRoots })
             : null;
           /** @type {Map<string, any>} */
           const loadEngines = new Map();
@@ -1361,7 +1861,8 @@ export function openStore(model, options) {
                   { docPath: '/entities', collection: name });
               }
               engine = createLoadEngine(
-                { connection, entities, mapping, state: queryState }, name);
+                { connection, entities, mapping, state: queryState, coreFor: entityCoreFor,
+                  profile: storeProfile, roots: declaredRoots }, name);
               loadEngines.set(name, engine);
             }
             return engine;
@@ -1383,30 +1884,46 @@ export function openStore(model, options) {
               if (validate !== null && typeof validate !== 'function')
                 throw new TypeError('openStore: compileSchema must return a validation function');
               core = captureEntity(name, entityCore(connection, entity,
-                mapping.entities[name], validate));
+                mapping.entities[name], validate, runtime));
               entityCores.set(name, core);
             }
             return core;
           };
 
-          const tracker = entities.size > 0
-            ? createTracker({
-              connection, entities, mapping, coreFor: entityCoreFor,
-              captureRecord: capture === null || capture.mode !== 'journal'
-                ? undefined
-                : (table, keyParts, before, after) => capture.record(table, keyParts,
-                  before === undefined ? undefined : stripRelations(table, before),
-                  stripRelations(table, after)),
-              captureJoinDelete: captureJoinDelete ?? undefined,
-            })
-            : null;
-          /** @type {Map<string, any>} */
-          const trackedOps = new Map();
-          // the unit-of-work surface (§11): reads register frozen
-          // snapshots; add/put/remove are LOCAL bookkeeping (no
-          // database round trip, deliberately synchronous on both
-          // surfaces); asNoTracking() reads retain nothing
-          const trackedOpsFor = (name) => {
+          /**
+           * ONE unit of work and the tracked operations that write through
+           * it. The store has one; a transaction may be given its own, so
+           * two concurrent handlers hold two records for the same entity
+           * key and neither can see the other's pending state — which is
+           * what makes one store safe for a handler per request.
+           *
+           * The cores, engines and plans below it are shared: what a
+           * second unit of work costs is its own map of records, not a
+           * second copy of the model.
+           */
+          const createUnitOfWork = () => {
+            const tracker = entities.size > 0
+              ? createTracker({
+                connection, entities, mapping, coreFor: entityCoreFor,
+                captureRecord: capture === null || capture.mode !== 'journal'
+                  ? undefined
+                  : (table, keyParts, before, after) => capture.record(table, keyParts,
+                    before === undefined ? undefined : stripRelations(table, before),
+                    stripRelations(table, after)),
+                captureJoinDelete: captureJoinDelete ?? undefined,
+              })
+              : null;
+            /** @type {Map<string, any>} */
+            const trackedOps = new Map();
+            /** @type {Map<string, any>} */
+            const entityHandles = new Map();
+            /** @type {Map<string, any>} */
+            const syncEntityHandles = new Map();
+            // the unit-of-work surface (§11): reads register frozen
+            // snapshots; add/put/remove are LOCAL bookkeeping (no
+            // database round trip, deliberately synchronous on both
+            // surfaces); asNoTracking() reads retain nothing
+            const trackedOpsFor = (name) => {
             let ops = trackedOps.get(name);
             if (ops !== undefined) return ops;
             const core = entityCoreFor(name);
@@ -1491,9 +2008,24 @@ export function openStore(model, options) {
                 tracker.discard(name, key);
                 return done;
               }),
-              load: (spec) => chain(loads.load(spec),
+              load: (spec, loadOptions) => chain(loads.load(spec, loadOptions),
                 (docs) => tracker.registerGraph(loads.treeFor(spec), docs)),
-              explainLoad: (spec) => loads.explainLoad(spec),
+              // the graph cursor registers nothing unless asked: a
+              // snapshot per yielded root is a tracker that grows with the
+              // result, so it is the caller's decision (`tracking: true`)
+              syncLoadCursor: (spec, cursorOptions) => loads.syncLoadCursor(spec, cursorOptions,
+                cursorOptions?.tracking === true
+                  ? (tree, doc) => tracker.registerGraph(tree, [doc])[0] : undefined),
+              syncPage: (spec, pageOptions) => loads.syncPage(spec, pageOptions,
+                pageOptions?.tracking === true
+                  ? (tree, doc) => tracker.registerGraph(tree, [doc])[0] : undefined),
+              loadCursor: (spec, cursorOptions) => loads.loadCursor(spec, cursorOptions,
+                cursorOptions?.tracking === true
+                  ? (tree, doc) => tracker.registerGraph(tree, [doc])[0] : undefined),
+              page: (spec, pageOptions) => loads.page(spec, pageOptions,
+                pageOptions?.tracking === true
+                  ? (tree, doc) => tracker.registerGraph(tree, [doc])[0] : undefined),
+              explainLoad: (spec, loadOptions) => loads.explainLoad(spec, loadOptions),
               add: (doc) => tracker.add(name, doc),
               put: (next) => tracker.put(name, next),
               remove: (keyOrDoc) => tracker.remove(name, keyOrDoc),
@@ -1504,49 +2036,35 @@ export function openStore(model, options) {
               unlink: (own, member, target) => tracker.unlink(name, own, member, target),
               noTracking: {
                 get: (key) => core.get(key),
-                load: (spec) => loads.load(spec),
+                load: (spec, loadOptions) => loads.load(spec, loadOptions),
               },
             };
             trackedOps.set(name, ops);
             return ops;
-          };
+            };
 
-          /** @type {Map<string, any>} */
-          const asyncHandles = new Map();
-          /** @type {Map<string, any>} */
-          const asyncEntityHandles = new Map();
-          const store = {
-            capabilities,
-            stats: () => ({
-              statementCache: { ...queryState.counters },
-              udfRegistrations: queryState.registered.size,
-              tracker: tracker === null ? null : tracker.counts(),
-              liveQueries: liveRegistry === null ? 0 : liveRegistry.count(),
-            }),
-            dialect,
-            collection(name) {
-              let handle = asyncHandles.get(name);
-              if (handle === undefined) {
-                handle = asyncCollection(coreFor(name),
-                  liveRegistry === null ? null : registerCollectionLive);
-                asyncHandles.set(name, handle);
-              }
-              return handle;
-            },
-            entity(name) {
-              let handle = asyncEntityHandles.get(name);
+            /**
+             * An entity handle over THIS unit of work, bound to whatever
+             * scope is open when it runs — the tracked surface, its
+             * untracked twin, and the provider members.
+             * @param {string} name
+             */
+            const entityFor = (name) => {
+              let handle = entityHandles.get(name);
               if (handle === undefined) {
                 const ops = trackedOpsFor(name);
                 const untracked = Object.freeze({
                   get: lift((key) => ops.noTracking.get(key)),
-                  load: lift((spec) => ops.noTracking.load(spec)),
+                  load: lift((spec, loadOptions) => ops.noTracking.load(spec, loadOptions)),
                 });
                 handle = Object.freeze({
                   create: lift((doc) => ops.create(doc)),
                   get: lift((key) => ops.get(key)),
                   update: lift((key, changes) => ops.update(key, changes)),
                   delete: lift((key) => ops.delete(key)),
-                  load: lift((spec) => ops.load(spec)),
+                  load: lift((spec, loadOptions) => ops.load(spec, loadOptions)),
+                  loadCursor: (spec, cursorOptions) => ops.loadCursor(spec, cursorOptions),
+                  page: lift((spec, pageOptions) => ops.page(spec, pageOptions)),
                   explainLoad: ops.explainLoad,
                   add: ops.add,
                   put: ops.put,
@@ -1564,67 +2082,303 @@ export function openStore(model, options) {
                   // `relations` this entity's own relation table (§10.1).
                   // `execute` stays value-or-promise (D2), as a collection's
                   execute: (document, queryOptions) => entityEngine.execute(document, queryOptions),
+                  // the item cursor over the same document: one row per
+                  // pull, the statement released on break. It registers
+                  // NO snapshot by default — a cursor that tracked every
+                  // row it yielded would be an unbounded tracker — and
+                  // `tracking: true` opts in per call, documented as
+                  // unbounded in the result size
+                  cursor: (document, queryOptions) => entityEngine.query(document, queryOptions,
+                    queryOptions?.tracking === true
+                      ? (entity, doc) => tracker.register(entity, doc) : undefined),
                   explain: lift((document, queryOptions) => entityEngine.explain(document, queryOptions)),
                   root: entityRoot(name),
                   scope: entityEngine,
                   relations: entityEngine.relations[name],
                 });
-                asyncEntityHandles.set(name, handle);
+                entityHandles.set(name, handle);
+              }
+              return handle;
+            };
+
+            /** The same set, answering values. */
+            const syncEntityFor = (name) => {
+              let handle = syncEntityHandles.get(name);
+              if (handle === undefined) {
+                const ops = trackedOpsFor(name);
+                const untracked = Object.freeze({
+                  get: (key) => ops.noTracking.get(key),
+                  load: (spec, loadOptions) => ops.noTracking.load(spec, loadOptions),
+                });
+                handle = Object.freeze({
+                  create: (doc) => ops.create(doc),
+                  get: (key) => ops.get(key),
+                  update: (key, changes) => ops.update(key, changes),
+                  delete: (key) => ops.delete(key),
+                  load: (spec, loadOptions) => ops.load(spec, loadOptions),
+                  loadCursor: (spec, cursorOptions) => ops.syncLoadCursor(spec, cursorOptions),
+                  page: (spec, pageOptions) => ops.syncPage(spec, pageOptions),
+                  cursor: (document, queryOptions) => entityEngine.syncQuery(document, queryOptions,
+                    queryOptions?.tracking === true
+                      ? (entity, doc) => tracker.register(entity, doc) : undefined),
+                  explainLoad: ops.explainLoad,
+                  add: ops.add,
+                  put: ops.put,
+                  remove: ops.remove,
+                  discard: ops.discard,
+                  link: ops.link,
+                  unlink: ops.unlink,
+                  asNoTracking: () => untracked,
+                  // the same provider members as the asynchronous handle,
+                  // answering values; one handle per name, so two chains
+                  // over one set share one source identity
+                  execute: (document, queryOptions) => entityEngine.execute(document, queryOptions),
+                  explain: (document, queryOptions) => entityEngine.explain(document, queryOptions),
+                  root: entityRoot(name),
+                  scope: entityEngine,
+                  relations: entityEngine.relations[name],
+                });
+                syncEntityHandles.set(name, handle);
+              }
+              return handle;
+            };
+
+            return Object.freeze({ tracker, entityFor, syncEntityFor });
+          };
+
+          // the store's own unit of work: what a store-level handle and a
+          // transaction that did not ask for its own both write through
+          rootWork = createUnitOfWork();
+          work = rootWork;
+
+          /** @type {Map<string, any>} */
+          const asyncHandles = new Map();
+
+          /**
+           * A collection handle BOUND to whatever scope is open when it
+           * runs. It is what a transaction callback gets, and what the
+           * store-level handle wraps in the gate. Collections carry no
+           * unit of work, so one handle per name serves every scope.
+           * @param {string} name
+           */
+          function boundCollection(name) {
+            let handle = asyncHandles.get(name);
+            if (handle === undefined) {
+              handle = asyncCollection(coreFor(name),
+                liveRegistry === null ? null : registerCollectionLive);
+              asyncHandles.set(name, handle);
+            }
+            return handle;
+          }
+
+          /** The engine's own commit counter, read wherever the caller
+           * is: the store wraps it in the gate, a transaction view in
+           * its scope check. An engine that keeps no such counter — one
+           * where "another connection has written since you last looked"
+           * is not a question a single number answers — refuses by name
+           * rather than by a TypeError on a statement it cannot spell. */
+          const readDataVersion = () => {
+            if (typeof dialect.introspect.dataVersion !== 'function') {
+              throw new DbRuntimeError('JD2077',
+                'this store has no data version: the dialect keeps no commit counter, so '
+                + 'there is no single number that changes when another connection writes');
+            }
+            return chain(connection.prepare(dialect.introspect.dataVersion()),
+              (statement) => chain(statement.get([]), (row) => Number(row.v)));
+          };
+
+          /** Register an entity-root live query (LIVE-FORMAT §7) — the
+           * store's `live` and a transaction view's share one body. */
+          const registerEntityLive = (document, liveOptions) => {
+            if (liveRegistry === null) {
+              throw new DbCompileError('JD0050',
+                'live queries require change capture — open the store with { capture: true }');
+            }
+            refuseAsyncLive();
+            if (liveOptions?.eventTime !== undefined) {
+              throw new DbCompileError('JD0053',
+                'live eventTime maintains a collection view — an entity document re-runs, '
+                + 'so a watermark would describe nothing (LIVE-FORMAT §13)');
+            }
+            const roots = collectEntityRoots(document, new Map([...entities, ...joinTableRoots(entities, mapping).entities]));
+            if (roots.size === 0) {
+              throw new TypeError(
+                'store.live takes an entity-root document — for a collection, '
+                + 'use store.collection(name).live');
+            }
+            const logicalRows = createLogicalRows({ connection, shapes: captureShapes, capture,
+              collectionCore: coreFor, entityCore: entityCoreFor });
+            return closeOnRollback(liveRegistry.register({
+              name: [...roots].join('+'),
+              tables: roots,
+              document,
+              externals: liveOptions?.externals ?? {},
+              demanded: liveOptions?.mode,
+              classification: liveOptions?.mode === 'rerun' ? {
+                strategy: 'rerun',
+                reason: 're-run mode was explicitly requested',
+              } : classifyEntityLive(document, entities, mapping, operators),
+              execute: (doc, executeOptions) => entityEngine.execute(doc, executeOptions),
+              readDependency: logicalRows.read,
+              dependencyPosition: logicalRows.position,
+              readRow: null,
+              keyOf: null,
+            }));
+          };
+
+          /**
+           * Every member of a bound handle that issues a statement,
+           * wrapped in the store-level gate. The rest — local unit-of-work
+           * bookkeeping, cached stats, the provider's identity members —
+           * touches no connection and is passed through as it is.
+           *
+           * `valued` names the members that answer value-or-promise
+           * rather than always a promise: the provider contract keeps a
+           * chain over a synchronous driver synchronous, so those must
+           * not be lifted (D2). They still answer a promise while another
+           * caller's transaction holds the connection — which is what
+           * waiting for a commit means.
+           * @param {any} handle
+           * @param {string[]} names - members that answer a promise
+           * @param {string[]} [valued] - members that answer value-or-promise
+           */
+          const gatedMembers = (handle, names, valued = []) => {
+            const out = { ...handle };
+            for (const member of names) {
+              if (typeof handle[member] !== 'function') continue;
+              out[member] = (/** @type {any[]} */ ...args) =>
+                lift(() => gated(() => handle[member](...args)))();
+            }
+            for (const member of valued) {
+              if (typeof handle[member] !== 'function') continue;
+              out[member] = (/** @type {any[]} */ ...args) =>
+                gated(() => handle[member](...args));
+            }
+            return Object.freeze(out);
+          };
+
+          /** @type {Map<string, any>} */
+          const gatedCollections = new Map();
+          /** @type {Map<string, any>} */
+          const gatedEntities = new Map();
+
+          const store = {
+            capabilities,
+            // the ROOT's bookkeeping, always: an open own-unit
+            // transaction changes what its own view reports, never this
+            stats: () => ({
+              statementCache: { ...queryState.counters },
+              udfRegistrations: queryState.registered.size,
+              tracker: rootWork.tracker === null ? null : rootWork.tracker.counts(),
+              liveQueries: liveRegistry === null ? 0 : liveRegistry.count(),
+            }),
+            dialect,
+            // A STORE-LEVEL handle. It reaches the driver connection, never
+            // a transaction it is not part of: a caller here is unrelated
+            // to whatever is open, so its statements wait for the commit
+            // instead of joining a rollback it knows nothing about. Inside
+            // a transaction callback, use the store the callback received.
+            collection(name) {
+              let handle = gatedCollections.get(name);
+              if (handle === undefined) {
+                const inner = boundCollection(name);
+                // `query` borrows the gate PER PULL rather than for the
+                // cursor's life: holding it for the caller's whole loop
+                // would block every transaction for as long as a consumer
+                // reads slowly, while an ungated pull could read a row a
+                // stranger's transaction has not committed. Construction
+                // (preflight, compilation) touches no connection.
+                handle = Object.freeze({
+                  ...gatedMembers(inner,
+                    ['get', 'insert', 'put', 'patch', 'delete', 'explain', 'live'],
+                    ['execute']),
+                  query: (document, queryOptions) => admitCursor(inner.query(document, queryOptions),
+                    gated, queryOptions?.signal, 'a root collection cursor pull'),
+                });
+                gatedCollections.set(name, handle);
+              }
+              return handle;
+            },
+            entity(name) {
+              let handle = gatedEntities.get(name);
+              if (handle === undefined) {
+                // ALWAYS the root unit of work: a store-level handle
+                // constructed while an own-unit transaction happens to be
+                // open must not capture that transaction's tracker
+                const inner = rootWork.entityFor(name);
+                // `cursor` and `loadCursor` borrow the gate per pull, as a
+                // collection's `query` does: admitted one item at a time,
+                // never held across the caller's loop
+                handle = gatedMembers(inner,
+                  ['create', 'get', 'update', 'delete', 'load', 'page', 'explain'],
+                  ['execute']);
+                const untracked = gatedMembers(inner.asNoTracking(), ['get', 'load']);
+                handle = Object.freeze({
+                  ...handle,
+                  cursor: (document, queryOptions) => admitCursor(inner.cursor(document, queryOptions),
+                    gated, queryOptions?.signal, 'a root entity cursor pull'),
+                  loadCursor: (spec, cursorOptions) => admitCursor(inner.loadCursor(spec, cursorOptions),
+                    gated, cursorOptions?.signal, 'a root graph cursor pull'),
+                  asNoTracking: () => untracked,
+                });
+                gatedEntities.set(name, handle);
               }
               return handle;
             },
             saveChanges: entities.size === 0 ? undefined
-              : lift(() => guard(() => tracker.saveChanges())),
+              : lift(() => gated(() => guard(() => rootWork.tracker.saveChanges()))),
             // entity DOCUMENTS query the multi-entity root at the store;
             // `roots` names the entity arrays this provider serves, so a
             // chain asked to iterate the store itself can refuse by name
             execute: entityEngine === null ? undefined
-              : (document, queryOptions) => entityEngine.execute(document, queryOptions),
+              : (document, queryOptions) =>
+                gated(() => entityEngine.execute(document, queryOptions)),
             explain: entityEngine === null ? undefined
-              : lift((document, queryOptions) => entityEngine.explain(document, queryOptions)),
+              : lift((document, queryOptions) =>
+                gated(() => entityEngine.explain(document, queryOptions))),
             roots: entityEngine === null ? undefined : Object.freeze([...entities.keys()]),
             relations: entityEngine === null ? undefined : entityEngine.relations,
             // entity live queries re-run on invalidation — declared,
-            // not attempted (LIVE-FORMAT §7)
+            // not attempted (LIVE-FORMAT §7). Registration takes the
+            // store gate through its INITIAL query, like a collection's
+            // `live`: the registration is local, the first result is a
+            // statement, and a statement here must not read a row a
+            // stranger's transaction has not committed. The live handle
+            // then runs on committed writes alone.
             live: entityEngine === null ? undefined
-              : lift((document, liveOptions) => {
-                if (liveRegistry === null) {
-                  throw new DbCompileError('JD0050',
-                    'live queries require change capture — open the store with { capture: true }');
-                }
-                refuseAsyncLive();
-                if (liveOptions?.eventTime !== undefined) {
-                  throw new DbCompileError('JD0053',
-                    'live eventTime maintains a collection view — an entity document re-runs, '
-                    + 'so a watermark would describe nothing (LIVE-FORMAT §13)');
-                }
-                const roots = collectEntityRoots(document, entities);
-                if (roots.size === 0) {
-                  throw new TypeError(
-                    'store.live takes an entity-root document — for a collection, '
-                    + 'use store.collection(name).live');
-                }
-                return liveRegistry.register({
-                  name: [...roots].join('+'),
-                  tables: roots,
-                  document,
-                  externals: liveOptions?.externals ?? {},
-                  demanded: liveOptions?.mode,
-                  classification: {
-                    strategy: 'rerun',
-                    reason: 'entity queries re-run in this version',
-                  },
-                  execute: (doc, executeOptions) => entityEngine.execute(doc, executeOptions),
-                  readRow: null,
-                  keyOf: null,
-                });
-              }),
+              : lift((document, liveOptions) =>
+                gated(() => registerEntityLive(document, liveOptions), 'a root live registration')),
             // A TOP-LEVEL transaction: it takes the connection's gate, so
             // it never shares a savepoint stack with another one. To nest,
             // use the store the callback RECEIVES — the outer store cannot
             // tell an inner transaction from an unrelated caller, and an
-            // unrelated caller must wait for the commit.
-            transaction: lift((fn) => topLevelTransaction(fn)),
+            // unrelated caller must wait for the commit. A `signal` gives
+            // up the QUEUE, never a transaction already running.
+            //
+            // `unitOfWork: 'own'` gives the callback a tracker of its own,
+            // so two concurrent handlers hold two records for one entity
+            // key and neither sees the other's pending state. It is opt-in
+            // because the shared default is what lets a caller add() a
+            // document outside the transaction and save it inside.
+            // `mode: 'immediate'` takes the write lock up front (`BEGIN
+            // IMMEDIATE`): a body that reads before it writes never meets
+            // the read→write upgrade busy the handler cannot retry. The
+            // default stays the deferred savepoint; nesting is a savepoint
+            // under either.
+            transaction: lift((fn, transactionOptions) => {
+              const wanted = transactionOptions?.unitOfWork;
+              if (wanted !== undefined && wanted !== 'own' && wanted !== 'shared') {
+                throw new TypeError(
+                  "store.transaction: unitOfWork must be 'shared' or 'own'");
+              }
+              const mode = transactionOptions?.mode;
+              if (mode !== undefined && mode !== 'deferred' && mode !== 'immediate') {
+                throw new TypeError(
+                  "store.transaction: mode must be 'deferred' or 'immediate'");
+              }
+              return topLevelTransaction(fn, transactionOptions?.signal,
+                wanted === 'own' ? createUnitOfWork() : undefined, mode);
+            }),
             observe: (fn) => {
               if (capture === null) {
                 throw new TypeError(
@@ -1633,19 +2387,79 @@ export function openStore(model, options) {
               return capture.observe(fn);
             },
             changesSince: capture === null ? undefined
-              : lift((after) => capture.changesSince(after)),
-            dataVersion: lift(() => chain(
-              connection.prepare(dialect.introspect.dataVersion()),
-              (statement) => chain(statement.get([]), (row) => Number(row.v)))),
+              : lift((after) => gated(() => capture.changesSince(after))),
+            // the bounded reader (LIVE-FORMAT §5): watermarks, and pages
+            // that report a retention gap instead of a misleading suffix
+            changes: capture === null || !capture.logged ? undefined : Object.freeze({
+              bounds: lift(() => gated(() => capture.bounds())),
+              page: lift((pageOptions) => gated(() => capture.page(pageOptions))),
+            }),
+            dataVersion: lift(() => gated(() => readDataVersion())),
+            // Database → model, read-only: what this database's shape
+            // says the model is, beside a report of everything it
+            // cannot say. It holds the store gate for its extent, like
+            // every other read, and it issues no DDL and no DML — the
+            // derived model is an ANSWER, and applying it is the
+            // migration planner's job and the operator's decision
+            introspect: lift((introspectOptions) =>
+              gated(() => introspectModel(connection, introspectOptions))),
+            // the maintenance surface: each operation holds the store
+            // gate for its own extent, so a checkpoint can never
+            // interleave an in-flight write; none takes a transaction
+            checkpoint: lift((maintenanceOptions) =>
+              gated(() => maintenance.checkpoint(maintenanceOptions), 'a checkpoint')),
+            integrityCheck: lift((maintenanceOptions) =>
+              gated(() => maintenance.integrityCheck(maintenanceOptions), 'an integrity check')),
+            foreignKeyCheck: lift((maintenanceOptions) =>
+              gated(() => maintenance.foreignKeyCheck(maintenanceOptions), 'a foreign-key check')),
+            optimize: lift((maintenanceOptions) =>
+              gated(() => maintenance.optimize(maintenanceOptions), 'an optimize')),
+            // the online backup: NOT held under the gate for its whole
+            // extent — writers proceed while the copy runs — only its
+            // checkpoint boundary is
+            backupTo: lift((targetPath, backupOptions) => backup.backupTo(targetPath, backupOptions)),
+            // The ROOT jobs surface: every finite call takes the store
+            // gate, exactly as a root collection write does, so an
+            // unrelated enqueue, claim, checkpoint or settlement can
+            // never join an open application transaction's fate. The
+            // transactional-outbox spelling is the explicit `tx.jobs` a
+            // transaction callback receives.
             jobs: jobsEngine === null ? undefined : Object.freeze({
-              enqueue: lift(jobsEngine.enqueue),
-              get: lift(jobsEngine.get),
-              counts: lift(jobsEngine.counts),
-              claim: lift(jobsEngine.claim),
-              complete: lift(jobsEngine.complete),
-              fail: lift(jobsEngine.fail),
-              checkpointsFor: jobsEngine.checkpointsFor,
+              enqueue: lift((...args) => gated(() => jobsEngine.enqueue(...args), 'a root job enqueue')),
+              get: lift((...args) => gated(() => jobsEngine.get(...args), 'a root job read')),
+              counts: lift(() => gated(() => jobsEngine.counts(), 'a root job read')),
+              claim: lift((...args) => gated(() => jobsEngine.claim(...args), 'a root job claim')),
+              renew: lift((...args) => gated(() => jobsEngine.renew(...args), 'a root lease renewal')),
+              complete: lift((...args) => gated(() => jobsEngine.complete(...args), 'a root job settlement')),
+              fail: lift((...args) => gated(() => jobsEngine.fail(...args), 'a root job settlement')),
+              // a checkpoint store keeps its creator's ROOT ownership:
+              // its later calls take the gate too, never a scope. They
+              // stay value-or-promise like the engine's own — the gate
+              // answers a value when nothing is contended
+              checkpointsFor: (job) => {
+                const inner = jobsEngine.checkpointsFor(job);
+                return Object.freeze({
+                  load: (runId) => gated(() => inner.load(runId), 'a root checkpoint read'),
+                  save: (runId, nodeId, value) =>
+                    gated(() => inner.save(runId, nodeId, value), 'a root checkpoint save'),
+                  complete: (runId, result) =>
+                    gated(() => inner.complete(runId, result), 'a root checkpoint settlement'),
+                });
+              },
               createWorker: jobsEngine.createWorker,
+              // administration (JOBS-FORMAT §10): mechanism, never schedule.
+              // `page` borrows the gate per pull like every root cursor;
+              // `cancel` settles under the gate and then waits OUTSIDE it
+              // for a local attempt to wind up — the handler's own
+              // settlement calls take the gate, so waiting inside it
+              // would wait for itself
+              page: (pageOptions) => admitCursor(jobsEngine.page(pageOptions),
+                gated, pageOptions?.signal, 'a root job page pull'),
+              cancel: lift((id, cancelOptions) => chain(
+                gated(() => jobsEngine.cancel(id, cancelOptions), 'a root job cancellation'),
+                (outcome) => chain(jobsEngine.settledLocally(id), () => outcome))),
+              requeue: lift((...args) => gated(() => jobsEngine.requeue(...args), 'a root job requeue')),
+              sweep: lift((...args) => gated(() => jobsEngine.sweep(...args), 'a root job sweep')),
             }),
             /**
              * Close the store. Job workers are asked to stop and given a
@@ -1675,55 +2489,514 @@ export function openStore(model, options) {
             }),
           };
 
-          // The transaction callback's argument. It is the store, with one
-          // difference that matters: its `transaction` NESTS through the
-          // owning savepoint instead of queueing behind it. Everything
-          // else already reaches the open transaction, because the cores
-          // read the active scope.
-          /** @type {any} */
-          let txStore = null;
-          /** Nest through the savepoint that owns the connection now. The
-           * capture scope goes INSIDE the savepoint, so a rollback undoes
-           * the translated patch with the rows it describes. */
-          const nested = (/** @type {any} */ fn) => withScope(scope.transaction,
-            (tx) => (capture === null ? fn(tx) : capture.nest(() => fn(tx))));
+          /**
+           * The `JD2070` lifetime check every stateful member of a
+           * transaction view runs FIRST — before reading or mutating
+           * tracker state, and before any statement. A view is pinned to
+           * the exact scope that created it: an identity that is not
+           * current has either settled (the handle escaped its callback)
+           * or been crossed by an inner scope (an outer handle used while
+           * an async inner savepoint is open). It never falls through to
+           * the root and never follows a newer scope.
+           * @param {any} identity
+           */
+          const requireScope = (identity) => {
+            if (currentScope === identity) return;
+            throw new DbRuntimeError('JD2070',
+              'this transaction handle is pinned to a scope that is not current: '
+              + 'its transaction settled, or an inner transaction is open. Use the '
+              + 'store the LIVE transaction callback received (tx.collection / '
+              + 'tx.entity / tx.saveChanges / tx.jobs) — a handle never outlives '
+              + 'or crosses its own scope.');
+          };
+
+          /**
+           * Every stateful member of a scope-view handle, checked against
+           * the exact scope before it runs. `lifted` members answer a
+           * promise (the check rejects); `direct` members answer values
+           * or value-or-promise (the check throws) — the unit-of-work
+           * bookkeeping and the D2 provider members among them.
+           * @param {any} identity
+           * @param {any} handle
+           * @param {string[]} lifted
+           * @param {string[]} [direct]
+           */
+          const scopedMembers = (identity, handle, lifted, direct = []) => {
+            const out = { ...handle };
+            for (const member of lifted) {
+              if (typeof handle[member] !== 'function') continue;
+              out[member] = (/** @type {any[]} */ ...args) =>
+                lift(() => {
+                  requireScope(identity);
+                  return handle[member](...args);
+                })();
+            }
+            for (const member of direct) {
+              if (typeof handle[member] !== 'function') continue;
+              out[member] = (/** @type {any[]} */ ...args) => {
+                requireScope(identity);
+                return handle[member](...args);
+              };
+            }
+            return out;
+          };
+
+          /** A cursor pinned to one exact scope: it opens under the
+           * scope check, and `next()` re-checks the scope on every pull,
+           * so iteration can neither begin nor continue once that exact
+           * scope settled. The classification (`streaming`, `barrier`)
+           * is the inner cursor's own. */
+          const scopedCursor = (identity, open) => {
+            requireScope(identity);
+            const cursor = open();
+            const step = (/** @type {string} */ member) => () => {
+              try {
+                requireScope(identity);
+              }
+              catch (error) {
+                return Promise.reject(error);
+              }
+              return cursor[member]();
+            };
+            /** @type {any} */
+            const wrapped = {
+              streaming: cursor.streaming,
+              barrier: cursor.barrier,
+              next: step('next'),
+              return: step('return'),
+              [Symbol.asyncIterator]: () => wrapped,
+            };
+            return Object.freeze(wrapped);
+          };
+
+          /** A collection handle pinned to one exact scope, its lazy
+           * cursor included. */
+          const scopedCollection = (identity, name) => {
+            const inner = boundCollection(name);
+            const out = scopedMembers(identity, inner,
+              ['get', 'insert', 'put', 'patch', 'delete', 'explain', 'live'],
+              ['execute']);
+            out.query = (/** @type {any} */ document, /** @type {any} */ queryOptions) =>
+              scopedCursor(identity, () => inner.query(document, queryOptions));
+            return Object.freeze(out);
+          };
+
+          /** An entity handle over `unit`, pinned to one exact scope —
+           * the statement members and the local tracker bookkeeping both
+           * carry the identity (`add()` on a settled handle is `JD2070`,
+           * not a document smuggled into a later scope's unit of work). */
+          const scopedEntity = (identity, unit, name) => {
+            const inner = unit.entityFor(name);
+            const untracked = Object.freeze(
+              scopedMembers(identity, inner.asNoTracking(), ['get', 'load']));
+            return Object.freeze({
+              ...scopedMembers(identity, inner,
+                ['create', 'get', 'update', 'delete', 'load', 'page', 'explain'],
+                ['execute', 'add', 'put', 'remove', 'discard', 'link', 'unlink']),
+              cursor: (/** @type {any} */ document, /** @type {any} */ queryOptions) =>
+                scopedCursor(identity, () => inner.cursor(document, queryOptions)),
+              loadCursor: (/** @type {any} */ spec, /** @type {any} */ cursorOptions) =>
+                scopedCursor(identity, () => inner.loadCursor(spec, cursorOptions)),
+              asNoTracking: () => untracked,
+            });
+          };
+
+          /** The synchronous twin, answering values. */
+          const scopedSyncEntity = (identity, unit, name) => {
+            const inner = unit.syncEntityFor(name);
+            const untracked = Object.freeze(
+              scopedMembers(identity, inner.asNoTracking(), [], ['get', 'load']));
+            return Object.freeze({
+              ...scopedMembers(identity, inner, [],
+                ['create', 'get', 'update', 'delete', 'load', 'page', 'execute', 'explain',
+                  'add', 'put', 'remove', 'discard', 'link', 'unlink']),
+              cursor: (document, options) => {
+                requireScope(identity);
+                return admitSyncCursor(inner.cursor(document, options), (fn) => { requireScope(identity); return fn(); });
+              },
+              loadCursor: (spec, options) => {
+                requireScope(identity);
+                return admitSyncCursor(inner.loadCursor(spec, options), (fn) => { requireScope(identity); return fn(); });
+              },
+              asNoTracking: () => untracked,
+            });
+          };
+
+          /** Shared synchronous collection handles over the cores; set
+           * with `store.sync` when the driver is synchronous. The gated
+           * store-level surface and each scope view wrap the same ones.
+           * @type {((name: string) => any) | undefined} */
+          let syncCollectionFor;
+
           /** The overriding member on a view of the FROZEN store: plain
            * assignment cannot shadow a non-writable inherited property. */
           const override = (/** @type {any} */ value) =>
             ({ value, writable: false, enumerable: true, configurable: false });
-          scopedStore = () => {
-            if (txStore === null) {
-              const members = { transaction: override(nested) };
-              if (store.sync !== undefined) {
-                members.sync = override(Object.create(store.sync,
-                  { transaction: override(nested) }));
+
+          // The transaction callback's argument, and the ONLY handle that
+          // is inside the transaction: ONE view per exact scope, pinned to
+          // its identity. Its `collection`, `entity`, `sync`, unit of work
+          // and `jobs` run as the owner instead of waiting for a commit
+          // they are part of; its `transaction` NESTS through the owning
+          // savepoint; its `savepoints` move the manual checkpoint stack.
+          // The store's own handles are, by construction, somebody else —
+          // and a view used outside its exact live scope is `JD2070`.
+          scopedStore = (driverScope, identity) => {
+            /** The unit of work in force for THIS scope, captured once:
+             * the view's tracker surface never follows a later scope. */
+            const myWork = work;
+            /** @type {Map<string, any>} */
+            const myCollections = new Map();
+            /** @type {Map<string, any>} */
+            const myEntities = new Map();
+            const collectionFor = (/** @type {string} */ name) => {
+              let handle = myCollections.get(name);
+              if (handle === undefined) {
+                handle = scopedCollection(identity, name);
+                myCollections.set(name, handle);
+              }
+              return handle;
+            };
+            const entityFor = (/** @type {string} */ name) => {
+              let handle = myEntities.get(name);
+              if (handle === undefined) {
+                handle = scopedEntity(identity, myWork, name);
+                myEntities.set(name, handle);
+              }
+              return handle;
+            };
+
+            /** Nest through THIS scope's savepoint. The capture scope
+             * goes INSIDE the savepoint, so a rollback undoes the
+             * translated patch with the rows it describes. */
+            const nested = (/** @type {any} */ fn) => {
+              requireScope(identity);
+              return withScope(driverScope.transaction,
+                (inner, innerIdentity) => (capture === null
+                  ? fn(scopedStore(inner, innerIdentity))
+                  : capture.nest(() => fn(scopedStore(inner, innerIdentity)))));
+            };
+
+            // ————— named savepoints (MODEL-FORMAT §5.2) —————
+            // One per-exact-scope map from the caller's LABEL to an
+            // opaque driver checkpoint plus the settlement-list mark and,
+            // in journal capture mode, the capture mark. The label is a
+            // map key and diagnostic only — the driver generates the
+            // `jaren_sp_*` identifier structured nesting already uses, so
+            // a label can never become SQL, and both savepoint kinds
+            // share one engine stack. The scope's settlement (commit or
+            // rollback) invalidates whatever names were left active,
+            // because the view itself is then `JD2070`.
+            /** @type {Map<string, any>} */
+            const checkpoints = new Map();
+            const requireLabel = (/** @type {any} */ label, /** @type {string} */ verb) => {
+              if (typeof label === 'string' && label !== '') return;
+              throw new DbRuntimeError('JD2071',
+                `savepoints.${verb}: a savepoint label must be a non-empty string — `
+                + 'it is a map key and diagnostic for this exact transaction, never SQL');
+            };
+            const resolveLabel = (/** @type {string} */ label, /** @type {string} */ verb) => {
+              requireLabel(label, verb);
+              const entry = checkpoints.get(label);
+              if (entry !== undefined) return entry;
+              throw new DbRuntimeError('JD2071',
+                `savepoints.${verb}: no active savepoint '${label}' in this exact `
+                + 'transaction — it was never created here, or a rollback past it or a '
+                + 'release already invalidated it');
+            };
+            const savepointCreate = (/** @type {string} */ label) => {
+              requireScope(identity);
+              requireLabel(label, 'create');
+              if (checkpoints.has(label)) {
+                throw new DbRuntimeError('JD2071',
+                  `savepoints.create: the label '${label}' is already active in this `
+                  + 'transaction — release it, or roll back to it, before creating it again');
               }
-              txStore = Object.freeze(Object.create(store, members));
+              // SAVEPOINT first; the entry is recorded only after success,
+              // so a refused statement leaves label map and marks untouched
+              return chain(driverScope.savepoint(), (checkpoint) => {
+                checkpoints.set(label, {
+                  checkpoint,
+                  settleMark: settlements === null ? 0 : settlements.length,
+                  captureMark: capture === null ? null : capture.mark(),
+                });
+                return undefined;
+              });
+            };
+            const savepointRollbackTo = (/** @type {string} */ label) => {
+              requireScope(identity);
+              const entry = resolveLabel(label, 'rollbackTo');
+              // ROLLBACK TO first; only after database success do the
+              // in-memory effects follow. The target stays active with
+              // the same now-current marks, so repeated rollback is
+              // defined; entries created after it are gone from the
+              // engine stack and invalidated here.
+              return chain(driverScope.rollbackTo(entry.checkpoint), () => {
+                if (settlements !== null) {
+                  const withdrawn = settlements.splice(entry.settleMark);
+                  for (let i = withdrawn.length - 1; i >= 0; i--) withdrawn[i].rollback?.();
+                }
+                if (capture !== null) capture.truncate(entry.captureMark);
+                let seen = false;
+                for (const key of [...checkpoints.keys()]) {
+                  if (seen) checkpoints.delete(key);
+                  if (key === label) seen = true;
+                }
+                return undefined;
+              });
+            };
+            const savepointRelease = (/** @type {string} */ label) => {
+              requireScope(identity);
+              const entry = resolveLabel(label, 'release');
+              // RELEASE removes the target and every later entry WITHOUT
+              // running rollback effects: those rows remain part of the
+              // owning transaction, so their tracker withdrawals stay
+              // registered until outer settlement — the engine semantics,
+              // exactly (both SQLite and PostgreSQL discard the target
+              // and the savepoints nested after it, keeping their rows)
+              return chain(driverScope.release(entry.checkpoint), () => {
+                let seen = false;
+                for (const key of [...checkpoints.keys()]) {
+                  if (key === label) seen = true;
+                  if (seen) checkpoints.delete(key);
+                }
+                return undefined;
+              });
+            };
+
+            const members = {
+              transaction: override((/** @type {any} */ fn) => lift(() => nested(fn))()),
+              collection: override(collectionFor),
+              entity: override(entityFor),
+              // THIS scope's bookkeeping, whatever scope is current later
+              stats: override(() => ({
+                statementCache: { ...queryState.counters },
+                udfRegistrations: queryState.registered.size,
+                tracker: myWork.tracker === null ? null : myWork.tracker.counts(),
+                liveQueries: liveRegistry === null ? 0 : liveRegistry.count(),
+              })),
+              dataVersion: override(lift(() => {
+                requireScope(identity);
+                return readDataVersion();
+              })),
+              savepoints: override(Object.freeze({
+                create: lift(savepointCreate),
+                rollbackTo: lift(savepointRollbackTo),
+                release: lift(savepointRelease),
+              })),
+              // a transaction view does not own the store lifetime: the
+              // member is ABSENT rather than a second way to close the
+              // raw connection under its own savepoint
+              close: override(undefined),
+              replication: override(undefined),
+              // nor does it run maintenance: a checkpoint inside an open
+              // transaction is a no-op the engine answers quietly, and
+              // the other three are store-level operations — ABSENT here
+              checkpoint: override(undefined),
+              integrityCheck: override(undefined),
+              foreignKeyCheck: override(undefined),
+              optimize: override(undefined),
+              backupTo: override(undefined),
+            };
+            if (entities.size > 0) {
+              members.saveChanges = override(lift(() => {
+                requireScope(identity);
+                return guard(() => myWork.tracker.saveChanges());
+              }));
             }
-            return txStore;
+            if (entityEngine !== null) {
+              members.execute = override(
+                (/** @type {any} */ document, /** @type {any} */ queryOptions) => {
+                  requireScope(identity);
+                  return entityEngine.execute(document, queryOptions);
+                });
+              members.explain = override(lift(
+                (/** @type {any} */ document, /** @type {any} */ queryOptions) => {
+                  requireScope(identity);
+                  return entityEngine.explain(document, queryOptions);
+                }));
+              members.live = override(lift(
+                (/** @type {any} */ document, /** @type {any} */ liveOptions) => {
+                  requireScope(identity);
+                  return registerEntityLive(document, liveOptions);
+                }));
+            }
+            if (capture !== null) {
+              members.changesSince = override(lift((/** @type {any} */ after) => {
+                requireScope(identity);
+                return capture.changesSince(after);
+              }));
+              if (capture.logged) members.changes = override(Object.freeze({
+                bounds: lift(() => {
+                  requireScope(identity);
+                  return capture.bounds();
+                }),
+                page: lift((/** @type {any} */ pageOptions) => {
+                  requireScope(identity);
+                  return capture.page(pageOptions);
+                }),
+              }));
+            }
+            if (jobsEngine !== null) {
+              // the transactional-outbox spelling: these run as the exact
+              // scope, so an enqueue or settlement here co-commits with
+              // the domain transaction — and a retained handle is JD2070
+              members.jobs = override(Object.freeze({
+                enqueue: lift((/** @type {any[]} */ ...args) => {
+                  requireScope(identity);
+                  return jobsEngine.enqueue(...args);
+                }),
+                get: lift((/** @type {any[]} */ ...args) => {
+                  requireScope(identity);
+                  return jobsEngine.get(...args);
+                }),
+                counts: lift(() => {
+                  requireScope(identity);
+                  return jobsEngine.counts();
+                }),
+                claim: lift((/** @type {any[]} */ ...args) => {
+                  requireScope(identity);
+                  return jobsEngine.claim(...args);
+                }),
+                renew: lift((/** @type {any[]} */ ...args) => {
+                  requireScope(identity);
+                  return jobsEngine.renew(...args);
+                }),
+                complete: lift((/** @type {any[]} */ ...args) => {
+                  requireScope(identity);
+                  return jobsEngine.complete(...args);
+                }),
+                fail: lift((/** @type {any[]} */ ...args) => {
+                  requireScope(identity);
+                  return jobsEngine.fail(...args);
+                }),
+                // a checkpoint store keeps its creator's SCOPE ownership:
+                // its later calls cannot switch scopes, and outlive none
+                checkpointsFor: (/** @type {any} */ job) => {
+                  const inner = jobsEngine.checkpointsFor(job);
+                  return Object.freeze({
+                    load: lift((/** @type {any} */ runId) => {
+                      requireScope(identity);
+                      return inner.load(runId);
+                    }),
+                    save: lift((/** @type {any} */ runId, /** @type {any} */ nodeId,
+                      /** @type {any} */ value) => {
+                      requireScope(identity);
+                      return inner.save(runId, nodeId, value);
+                    }),
+                    complete: lift((/** @type {any} */ runId, /** @type {any} */ result) => {
+                      requireScope(identity);
+                      return inner.complete(runId, result);
+                    }),
+                  });
+                },
+                // a worker is a ROOT-owned long-lived component wherever
+                // it is created: its future loop takes the store gate and
+                // never binds to the transaction that constructed it
+                createWorker: jobsEngine.createWorker,
+              }));
+            }
+            if (connection.synchronous && syncCollectionFor !== undefined) {
+              /** @type {Map<string, any>} */
+              const mySyncCollections = new Map();
+              /** @type {Map<string, any>} */
+              const mySyncEntities = new Map();
+              const forSync = /** @type {(name: string) => any} */ (syncCollectionFor);
+              members.sync = override(Object.freeze({
+                collection: (/** @type {string} */ name) => {
+                  let handle = mySyncCollections.get(name);
+                  if (handle === undefined) {
+                    handle = Object.freeze(scopedMembers(identity, forSync(name), [],
+                      ['get', 'insert', 'put', 'patch', 'delete', 'execute', 'explain']));
+                    mySyncCollections.set(name, handle);
+                  }
+                  return handle;
+                },
+                entity: (/** @type {string} */ name) => {
+                  let handle = mySyncEntities.get(name);
+                  if (handle === undefined) {
+                    handle = scopedSyncEntity(identity, myWork, name);
+                    mySyncEntities.set(name, handle);
+                  }
+                  return handle;
+                },
+                transaction: nested,
+                savepoints: Object.freeze({
+                  create: savepointCreate,
+                  rollbackTo: savepointRollbackTo,
+                  release: savepointRelease,
+                }),
+                saveChanges: entities.size === 0 ? undefined
+                  : () => {
+                    requireScope(identity);
+                    return guard(() => myWork.tracker.saveChanges());
+                  },
+                execute: entityEngine === null ? undefined
+                  : (/** @type {any} */ document, /** @type {any} */ queryOptions) => {
+                    requireScope(identity);
+                    return entityEngine.execute(document, queryOptions);
+                  },
+                explain: entityEngine === null ? undefined
+                  : (/** @type {any} */ document, /** @type {any} */ queryOptions) => {
+                    requireScope(identity);
+                    return entityEngine.explain(document, queryOptions);
+                  },
+                roots: entityEngine === null ? undefined : Object.freeze([...entities.keys()]),
+                relations: entityEngine === null ? undefined : entityEngine.relations,
+              }));
+            }
+            return Object.freeze(Object.create(store, members));
           };
 
           if (connection.synchronous) {
             /** @type {Map<string, any>} */
             const syncHandles = new Map();
+            syncCollectionFor = (name) => {
+              let handle = syncHandles.get(name);
+              if (handle === undefined) {
+                const core = coreFor(name);
+                handle = Object.freeze({
+                  stats: () => core.stats(),
+                  get: (/** @type {any} */ key) => core.get(key),
+                  insert: (/** @type {any} */ doc) => core.insert(doc),
+                  put: (/** @type {any} */ doc, /** @type {any} */ key) => core.put(doc, key),
+                  patch: (/** @type {any} */ key, /** @type {any} */ ops) => core.patch(key, ops),
+                  delete: (/** @type {any} */ key) => core.delete(key),
+                  execute: (/** @type {any} */ document, /** @type {any} */ o) =>
+                    core.execute(document, o),
+                  explain: (/** @type {any} */ document, /** @type {any} */ o) =>
+                    core.explain(document, o),
+                });
+                syncHandles.set(name, handle);
+              }
+              return handle;
+            };
+            const forSync = syncCollectionFor;
+
+            /** Store-level synchronous members, each holding the
+             * connection for its own extent. A contended one refuses
+             * rather than queueing: this surface answers values, and a
+             * queue answers a Promise. */
+            const syncGatedMembers = (handle, names) => {
+              const out = { ...handle };
+              for (const member of names) {
+                if (typeof handle[member] !== 'function') continue;
+                out[member] = (/** @type {any[]} */ ...args) =>
+                  gatedSync(() => handle[member](...args));
+              }
+              return Object.freeze(out);
+            };
             /** @type {Map<string, any>} */
-            const syncEntityHandles = new Map();
+            const gatedSyncCollections = new Map();
+            /** @type {Map<string, any>} */
+            const gatedSyncEntities = new Map();
             store.sync = Object.freeze({
               collection(name) {
-                let handle = syncHandles.get(name);
+                let handle = gatedSyncCollections.get(name);
                 if (handle === undefined) {
-                  const core = coreFor(name);
-                  handle = Object.freeze({
-                    stats: () => core.stats(),
-                    get: (key) => core.get(key),
-                    insert: (doc) => core.insert(doc),
-                    put: (doc, key) => core.put(doc, key),
-                    patch: (key, ops) => core.patch(key, ops),
-                    delete: (key) => core.delete(key),
-                    execute: (document, options) => core.execute(document, options),
-                    explain: (document, options) => core.explain(document, options),
-                  });
-                  syncHandles.set(name, handle);
+                  handle = syncGatedMembers(forSync(name),
+                    ['get', 'insert', 'put', 'patch', 'delete', 'execute', 'explain']);
+                  gatedSyncCollections.set(name, handle);
                 }
                 return handle;
               },
@@ -1740,62 +3013,83 @@ export function openStore(model, options) {
                 return topLevelTransaction(fn);
               },
               entity(name) {
-                let handle = syncEntityHandles.get(name);
+                let handle = gatedSyncEntities.get(name);
                 if (handle === undefined) {
-                  const ops = trackedOpsFor(name);
-                  const untracked = Object.freeze({
-                    get: (key) => ops.noTracking.get(key),
-                    load: (spec) => ops.noTracking.load(spec),
-                  });
+                  // the ROOT unit of work, whatever transaction happens
+                  // to be open when the handle is first constructed
+                  const inner = rootWork.syncEntityFor(name);
+                  const untracked = syncGatedMembers(inner.asNoTracking(), ['get', 'load']);
                   handle = Object.freeze({
-                    create: (doc) => ops.create(doc),
-                    get: (key) => ops.get(key),
-                    update: (key, changes) => ops.update(key, changes),
-                    delete: (key) => ops.delete(key),
-                    load: (spec) => ops.load(spec),
-                    explainLoad: ops.explainLoad,
-                    add: ops.add,
-                    put: ops.put,
-                    remove: ops.remove,
-                    discard: ops.discard,
-                    link: ops.link,
-                    unlink: ops.unlink,
+                    ...syncGatedMembers(inner,
+                      ['create', 'get', 'update', 'delete', 'load', 'page', 'execute', 'explain']),
+                    cursor: (document, options) => gatedSync(() =>
+                      admitSyncCursor(inner.cursor(document, options), gatedSync)),
+                    loadCursor: (spec, options) => gatedSync(() =>
+                      admitSyncCursor(inner.loadCursor(spec, options), gatedSync)),
                     asNoTracking: () => untracked,
-                    // the same provider members as the asynchronous handle,
-                    // answering values; one handle per name, so two chains
-                    // over one set share one source identity
-                    execute: (document, queryOptions) => entityEngine.execute(document, queryOptions),
-                    explain: (document, queryOptions) => entityEngine.explain(document, queryOptions),
-                    root: entityRoot(name),
-                    scope: entityEngine,
-                    relations: entityEngine.relations[name],
                   });
-                  syncEntityHandles.set(name, handle);
+                  gatedSyncEntities.set(name, handle);
                 }
                 return handle;
               },
               saveChanges: entities.size === 0 ? undefined
-                : () => guard(() => tracker.saveChanges()),
+                : () => gatedSync(() => guard(() => rootWork.tracker.saveChanges())),
               execute: entityEngine === null ? undefined
-                : (document, queryOptions) => entityEngine.execute(document, queryOptions),
+                : (document, queryOptions) =>
+                  gatedSync(() => entityEngine.execute(document, queryOptions)),
               explain: entityEngine === null ? undefined
-                : (document, queryOptions) => entityEngine.explain(document, queryOptions),
+                : (document, queryOptions) =>
+                  gatedSync(() => entityEngine.explain(document, queryOptions)),
               roots: entityEngine === null ? undefined : Object.freeze([...entities.keys()]),
               relations: entityEngine === null ? undefined : entityEngine.relations,
             });
           }
           return chain(capture === null ? null : capture.ready,
-            () => chain(jobsEngine === null ? null : jobsEngine.ready,
-              () => Object.freeze(store)));
-        }))));
+            () => chain(jobsEngine === null ? null : jobsEngine.ready, () => {
+          if (options.replication !== undefined) {
+            replicationEngine = createReplicationEngine({ connection, capture,
+              config: options.replication, model: shapeHash(model), now: runtime.now, bracket: firstOpen,
+              rows: createLogicalRows({ connection, shapes: captureShapes, capture,
+                collectionCore: coreFor, entityCore: entityCoreFor, captureJoinDelete }),
+            });
+            store.replication = Object.freeze({
+              frontier: lift(() => gated(() => replicationEngine.frontier())),
+              page: lift((request) => topLevelTransaction(() => replicationEngine.page(request), request?.signal, undefined, 'immediate')),
+              conflicts: lift((request) => gated(() => replicationEngine.conflicts(request), 'replication conflict read', request?.signal)),
+              snapshot: lift((request) => topLevelTransaction(() => replicationEngine.snapshot(request), request?.signal, undefined, 'immediate')),
+              reset: lift((snapshot, request) => replicationEngine.reset(snapshot, request,
+                (fn) => topLevelTransaction(fn, request?.signal, createUnitOfWork(), 'immediate'))),
+              apply: lift((envelope, request) => replicationEngine.apply(envelope, request,
+                (fn) => topLevelTransaction(fn, request?.signal, createUnitOfWork(), 'immediate'))),
+            });
+          }
+          return chain(replicationEngine === null ? null : replicationEngine.ready, () => Object.freeze(store));
+          }));
+        })))));
 
-      let opened_;
-      try {
-        opened_ = opening();
-      }
-      catch (error) {
-        return failClosed(error);
-      }
-      return isThenable(opened_) ? opened_.then((value) => value, failClosed) : opened_;
+      /**
+       * The open sequence, with ONE retry when it fails classed busy: the
+       * race window is another process's shape transaction on a fresh
+       * file, and one retry after it commits is the straggler case the
+       * immediate transaction cannot cover (the journal-mode write itself).
+       * Every step is idempotent, so a second pass re-applies nothing that
+       * matters; a second busy failure propagates classed.
+       * @param {boolean} retry
+       */
+      const attemptOpen = (retry) => {
+        const again = (error) => (retry && isDriverError(error)
+          && classifyDriverError(error).class === 'busy'
+          ? attemptOpen(false)
+          : failClosed(error));
+        let opened_;
+        try {
+          opened_ = opening();
+        }
+        catch (error) {
+          return again(error);
+        }
+        return isThenable(opened_) ? opened_.then((value) => value, again) : opened_;
+      };
+      return attemptOpen(true);
     }));
 }