@minnowdb/core 0.3.0 → 0.4.0

package/dist/storage/types.js

@@ -1,3 +1,5 @@
+import { dateIsoString, dateMilliseconds } from "../date-value.js";
+import { assertWellFormedString, MAX_BLOCK_ROW_COUNT, MAX_STORED_BLOCK_BYTE_LENGTH, } from "../block-format/index.js";
 export const storeNames = [
     "catalog",
     "manifests",
@@ -9,20 +11,23 @@ export const storeNames = [
     "temp",
     "gc",
 ];
-/** Every this-many commits the store writes a full checkpoint instead of a delta. */
-export const MANIFEST_CHECKPOINT_INTERVAL = 32;
-/** Applies one stored record to a running block set (checkpoint replaces, delta mutates). */
-export function applyManifestRecord(blockIds, record) {
-    if (record.blockIds !== undefined) {
-        blockIds.clear();
-        for (const id of record.blockIds)
-            blockIds.add(id);
-        return;
+export const MAX_MANIFEST_CHANGED_TABLE_IDS = 1_024;
+export function canonicalManifestChangedTableIds(ids) {
+    if (ids.length > MAX_MANIFEST_CHANGED_TABLE_IDS) {
+        throw new RangeError(`Manifest changed-table IDs cannot exceed ${String(MAX_MANIFEST_CHANGED_TABLE_IDS)}`);
+    }
+    const canonical = [...new Set(ids.map((id) => validateStorageId(id, "Changed table ID")))].sort();
+    if (canonical.length > MAX_MANIFEST_CHANGED_TABLE_IDS) {
+        throw new RangeError(`Manifest changed-table IDs cannot exceed ${String(MAX_MANIFEST_CHANGED_TABLE_IDS)}`);
+    }
+    return canonical;
+}
+export function validateCanonicalManifestChangedTableIds(ids) {
+    const canonical = canonicalManifestChangedTableIds(ids);
+    if (canonical.length !== ids.length || canonical.some((id, index) => id !== ids[index])) {
+        throw new TypeError("Manifest changed-table IDs must be unique and lexically sorted");
     }
-    for (const id of record.removedBlockIds ?? [])
-        blockIds.delete(id);
-    for (const id of record.addedBlockIds ?? [])
-        blockIds.add(id);
+    return canonical;
 }
 export const simpleDataTypes = ["boolean", "number", "string", "datetime"];
 /** Validates the logical metadata shared by SQL DDL, the schema DSL, and restored catalogs. */
@@ -48,6 +53,17 @@ export function validateSqlDomain(domain, context) {
     }
     return structuredClone(domain);
 }
+export const MAX_TABLE_COLUMNS = 1_024;
+export const MAX_ENUM_VALUES = 4_096;
+export const MAX_SECONDARY_INDEXES = 1_024;
+export const MAX_TABLE_TRIGGERS = 256;
+export const MAX_TRIGGER_STATEMENTS = 256;
+const VALID_TRIGGER_EVENTS = ["insert", "update", "delete"];
+const VALID_TRIGGER_TIMINGS = ["before", "after"];
+const VALID_TRIGGER_BINDING_SOURCES = ["new", "old"];
+export const MAX_TABLE_CONSTRAINTS = 1_024;
+export const MAX_TABLE_RECORD_CHARACTERS = 1_048_576;
+export const MAX_TABLE_RECORD_ENTRIES = 65_536;
 /**
  * The single authority on which enum declarations are legal, shared by the schema DSL's
  * `column.enum()` and the engine's `createTable`: at least one value, every value a non-empty
@@ -57,6 +73,9 @@ export function validateEnumValues(values, context) {
     if (values.length === 0) {
         throw new TypeError(`An enum needs at least one value: ${context}`);
     }
+    if (values.length > MAX_ENUM_VALUES) {
+        throw new RangeError(`An enum cannot exceed ${String(MAX_ENUM_VALUES)} values: ${context}`);
+    }
     const seen = new Set();
     for (const value of values) {
         if (typeof value !== "string" || value.length === 0) {
@@ -75,9 +94,21 @@ export function validateEnumValues(values, context) {
  * metadata cannot enter through a less common persistence path.
  */
 export function validateTableColumns(columns) {
-    if (columns.length === 0)
+    const runtimeColumns = columns;
+    if (!Array.isArray(runtimeColumns) || columns.length === 0) {
         throw new TypeError("A table needs at least one column");
-    for (const column of columns) {
+    }
+    if (columns.length > MAX_TABLE_COLUMNS) {
+        throw new RangeError(`A table cannot exceed ${String(MAX_TABLE_COLUMNS)} columns`);
+    }
+    const runtimeEntries = runtimeColumns;
+    for (const entry of runtimeEntries) {
+        if (!hasValidColumnPrimitives(entry)) {
+            throw new TypeError("Table columns have invalid primitive metadata");
+        }
+        const column = entry;
+        validateStorageId(column.id, "Column ID");
+        validateCatalogName(column.name, "Column name");
         const integer = column.integer;
         if (integer !== undefined && (integer !== true || column.type !== "number")) {
             throw new TypeError(`Integer domain requires a number column: ${column.name}`);
@@ -93,6 +124,37 @@ export function validateTableColumns(columns) {
         if (column.enumValues !== undefined && column.sqlDomain !== undefined) {
             throw new TypeError(`A column cannot have both enum restrictions and a SQL domain: ${column.name}`);
         }
+        if (column.enumValues !== undefined) {
+            if (column.type !== "string") {
+                throw new TypeError(`Enum restrictions require a string column: ${column.name}`);
+            }
+            validateEnumValues(column.enumValues, column.name);
+        }
+        if (column.defaultValue !== undefined) {
+            validateColumnDefault({
+                name: column.name,
+                type: column.type,
+                nullable: column.nullable,
+                isUniqueKey: true,
+                ...(column.integer === undefined ? {} : { integer: column.integer }),
+                ...(column.sqlDomain === undefined ? {} : { sqlDomain: column.sqlDomain }),
+                ...(column.enumValues === undefined ? {} : { enumValues: column.enumValues }),
+            }, column.defaultValue);
+        }
+        if (column.backfill !== undefined) {
+            const value = column.backfill;
+            const validType = column.type === "datetime"
+                ? value instanceof Date && Number.isFinite(dateMilliseconds(value))
+                : typeof value === column.type;
+            if (!validType ||
+                (typeof value === "number" && !Number.isFinite(value)) ||
+                (column.integer === true && !Number.isSafeInteger(value)) ||
+                (column.enumValues !== undefined &&
+                    typeof value === "string" &&
+                    !column.enumValues.includes(value))) {
+                throw new TypeError(`Invalid backfill value: ${column.name}`);
+            }
+        }
     }
     const ids = new Set(columns.map(({ id }) => id));
     const names = new Set(columns.map(({ name }) => name));
@@ -100,6 +162,18 @@ export function validateTableColumns(columns) {
         throw new TypeError("Table columns must have unique IDs and names");
     }
 }
+function hasValidColumnPrimitives(value) {
+    if (value === null || typeof value !== "object")
+        return false;
+    const column = value;
+    return (typeof column.id === "string" &&
+        column.id.length > 0 &&
+        typeof column.name === "string" &&
+        column.name.length > 0 &&
+        simpleDataTypes.some((type) => type === column.type) &&
+        typeof column.nullable === "boolean" &&
+        (column.hidden === undefined || column.hidden === true));
+}
 /**
  * The single authority on which default declarations are legal, shared by the schema DSL's
  * `table()` and the engine's `createTable` so the two entry points (and the wire path between
@@ -127,7 +201,7 @@ export function validateColumnDefault(column, defaultValue) {
             const value = defaultValue.value;
             const numericDomain = column.sqlDomain?.kind === "numeric";
             const correctType = column.type === "datetime"
-                ? value instanceof Date && Number.isFinite(value.getTime())
+                ? value instanceof Date && Number.isFinite(dateMilliseconds(value))
                 : numericDomain
                     ? typeof value === "number" || typeof value === "string"
                     : typeof value === column.type;
@@ -157,8 +231,220 @@ export function validateColumnDefault(column, defaultValue) {
             throw new TypeError(`Unknown default kind: ${String(defaultValue.kind)}`);
     }
 }
+/**
+ * Whether a secondary-index replacement changes the contract a staged writer must honor.
+ * Physical posting-build state is deliberately excluded: postings are only a reverified pruning
+ * accelerator. Index identity, key shape, and UNIQUE enforcement are structural.
+ */
+export function secondaryIndexWriteContractChanged(previous, next) {
+    const previousEntries = Object.entries(previous ?? {}).sort(([left], [right]) => left.localeCompare(right));
+    const nextEntries = Object.entries(next ?? {}).sort(([left], [right]) => left.localeCompare(right));
+    if (previousEntries.length !== nextEntries.length)
+        return true;
+    return previousEntries.some(([id, left], position) => {
+        const rightEntry = nextEntries[position];
+        if (rightEntry?.[0] !== id)
+            return true;
+        const right = rightEntry[1];
+        return (left.name !== right.name ||
+            left.columnId !== right.columnId ||
+            left.columnIds.length !== right.columnIds.length ||
+            left.columnIds.some((columnId, index) => columnId !== right.columnIds[index]) ||
+            left.directions.length !== right.directions.length ||
+            left.directions.some((direction, index) => direction !== right.directions[index]) ||
+            left.unique !== right.unique ||
+            left.uniqueEnforced !== right.uniqueEnforced ||
+            left.storageColumnId !== right.storageColumnId ||
+            left.locator !== right.locator);
+    });
+}
+const catalogRecordTextEncoder = new TextEncoder();
+function durableRecordRetainedBytes(record, label) {
+    // Keep this byte accounting identical to the canonical record-wire JSON codec without
+    // importing the toolkit codec back into this leaf contract module. Segment records always
+    // contain bigint row envelopes, so plain JSON.stringify is not sufficient.
+    let json;
+    try {
+        json = JSON.stringify(record);
+    }
+    catch {
+        json = JSON.stringify(record, (_key, entry) => {
+            if (typeof entry !== "bigint")
+                return entry;
+            if (entry < 0n || entry > MAX_ROW_ID_EXCLUSIVE_END) {
+                throw new RangeError("Record bigint exceeds the unsigned 64-bit persisted range");
+            }
+            return { $n: entry.toString() };
+        });
+    }
+    if (typeof json !== "string")
+        throw new TypeError(`${label} is not JSON-serializable`);
+    return catalogRecordTextEncoder.encode(json).byteLength;
+}
+/** Exact UTF-8 bytes used when the canonical record-wire JSON codec persists a table record. */
+export function catalogRecordRetainedBytes(record) {
+    return durableRecordRetainedBytes(record, "Table record");
+}
+export function manifestRecordRetainedBytes(record) {
+    return durableRecordRetainedBytes(record, "Manifest record");
+}
+/**
+ * Admission charge for one manifest summary, including the exact canonical tombstone bytes that
+ * later reclamation may add. Reserving them up front prevents quota deadlock at the byte ceiling.
+ */
+export function manifestRecordRetainedReservationBytes(record) {
+    return manifestRecordRetainedBytes(record.prunedAt === undefined ? { ...record, prunedAt: "1970-01-01T00:00:00.000Z" } : record);
+}
+export function segmentRecordRetainedBytes(record) {
+    return durableRecordRetainedBytes(record, "Segment record");
+}
+/** Hard catalog cardinality/text bounds shared by engine, adapters, checkpoints, and snapshots. */
+export function validateTableRecordBounds(record) {
+    validateStorageId(record.id, "Table ID");
+    validateCatalogName(record.name, "Table name");
+    if (typeof record.managed !== "boolean")
+        throw new TypeError("Table managed flag is required");
+    if (!Number.isSafeInteger(record.revision) || record.revision < 0) {
+        throw new RangeError("Table revision must be a non-negative safe integer");
+    }
+    if (record.view !== undefined && typeof record.view.managed !== "boolean") {
+        throw new TypeError("View managed flag is required");
+    }
+    if ((record.primaryKeyColumnIds?.length ?? 0) > MAX_TABLE_COLUMNS) {
+        throw new RangeError("A primary key names too many columns");
+    }
+    if (Object.keys(record.ftsColumns ?? {}).length > MAX_TABLE_COLUMNS) {
+        throw new RangeError("A table has too many full-text columns");
+    }
+    if (Object.keys(record.secondaryIndexes ?? {}).length > MAX_SECONDARY_INDEXES) {
+        throw new RangeError(`A table cannot exceed ${String(MAX_SECONDARY_INDEXES)} secondary indexes`);
+    }
+    if ((record.triggers?.length ?? 0) > MAX_TABLE_TRIGGERS) {
+        throw new RangeError(`A table cannot exceed ${String(MAX_TABLE_TRIGGERS)} triggers`);
+    }
+    const triggerIds = new Set();
+    const triggerNames = new Set();
+    const columnNames = new Set(record.columns.map((column) => column.name));
+    for (const trigger of record.triggers ?? []) {
+        validateStorageId(trigger.id, "Trigger ID");
+        validateCatalogName(trigger.name, "Trigger name");
+        if (!VALID_TRIGGER_EVENTS.includes(trigger.event)) {
+            throw new TypeError(`Trigger event is invalid: ${trigger.name}`);
+        }
+        if (!VALID_TRIGGER_TIMINGS.includes(trigger.timing)) {
+            throw new TypeError(`Trigger timing is invalid: ${trigger.name}`);
+        }
+        if (triggerIds.has(trigger.id)) {
+            throw new TypeError(`Trigger ID already exists: ${trigger.id}`);
+        }
+        if (triggerNames.has(trigger.name)) {
+            throw new TypeError(`Trigger already exists: ${trigger.name}`);
+        }
+        triggerIds.add(trigger.id);
+        triggerNames.add(trigger.name);
+        if (typeof trigger.createdAt !== "string") {
+            throw new TypeError(`Trigger creation timestamp is invalid: ${trigger.name}`);
+        }
+        const triggerCreatedAt = Date.parse(trigger.createdAt);
+        if (!Number.isFinite(triggerCreatedAt) ||
+            dateIsoString(new Date(triggerCreatedAt)) !== trigger.createdAt) {
+            throw new TypeError(`Trigger creation timestamp is invalid: ${trigger.name}`);
+        }
+        if (!Array.isArray(trigger.statements) || trigger.statements.length === 0) {
+            throw new TypeError(`A trigger needs at least one statement: ${trigger.name}`);
+        }
+        if (trigger.statements.length > MAX_TRIGGER_STATEMENTS) {
+            throw new RangeError(`A trigger cannot exceed ${String(MAX_TRIGGER_STATEMENTS)} statements: ${trigger.name}`);
+        }
+        for (const statement of trigger.statements) {
+            if (typeof statement.sql !== "string" || statement.sql.length === 0) {
+                throw new TypeError(`Trigger statement SQL is invalid: ${trigger.name}`);
+            }
+            if (!Array.isArray(statement.bindings)) {
+                throw new TypeError(`Trigger statement bindings are invalid: ${trigger.name}`);
+            }
+            for (const binding of statement.bindings) {
+                if (!VALID_TRIGGER_BINDING_SOURCES.includes(binding.source)) {
+                    throw new TypeError(`Trigger binding source is invalid: ${trigger.name}`);
+                }
+                validateCatalogName(binding.column, "Trigger binding column");
+                if (!columnNames.has(binding.column)) {
+                    throw new TypeError(`Trigger binding names an unknown column: ${binding.column}`);
+                }
+                if ((trigger.event === "insert" && binding.source === "old") ||
+                    (trigger.event === "delete" && binding.source === "new")) {
+                    throw new TypeError(`Trigger binding source is unavailable for ${trigger.event}`);
+                }
+            }
+        }
+    }
+    const namedConstraints = [
+        ...(record.foreignKeys ?? []).map((constraint) => constraint.name),
+        ...(record.checks ?? []).map((constraint) => constraint.name),
+        ...Object.values(record.secondaryIndexes ?? {})
+            .filter((index) => index.unique === true)
+            .map((index) => index.name),
+    ];
+    if (namedConstraints.length > MAX_TABLE_CONSTRAINTS) {
+        throw new RangeError(`A table cannot exceed ${String(MAX_TABLE_CONSTRAINTS)} named constraints`);
+    }
+    const constraintNames = new Set();
+    for (const constraintName of namedConstraints) {
+        validateCatalogName(constraintName, "Constraint name");
+        if (constraintNames.has(constraintName)) {
+            throw new TypeError(`Constraint already exists: ${constraintName}`);
+        }
+        constraintNames.add(constraintName);
+    }
+    if ((record.enumType?.values.length ?? 0) > MAX_ENUM_VALUES) {
+        throw new RangeError("A catalog enum has too many values");
+    }
+    const stack = [record];
+    const seen = new WeakSet();
+    let characters = 0;
+    let entries = 0;
+    while (stack.length > 0) {
+        const value = stack.pop();
+        if (typeof value === "string") {
+            assertWellFormedString(value, "Table record string");
+            characters += value.length;
+        }
+        else if (Array.isArray(value)) {
+            if (seen.has(value))
+                throw new TypeError("A table record cannot contain cycles or aliases");
+            seen.add(value);
+            entries += value.length;
+            for (const item of value)
+                stack.push(item);
+        }
+        else if (value instanceof Date) {
+            if (!Number.isFinite(dateMilliseconds(value))) {
+                throw new TypeError("A table record date is invalid");
+            }
+        }
+        else if (value !== null && typeof value === "object") {
+            if (seen.has(value))
+                throw new TypeError("A table record cannot contain cycles or aliases");
+            seen.add(value);
+            const fields = Object.entries(value);
+            entries += fields.length;
+            for (const [key, item] of fields) {
+                assertWellFormedString(key, "Table record field name");
+                characters += key.length;
+                stack.push(item);
+            }
+        }
+        if (!Number.isSafeInteger(entries) || entries > MAX_TABLE_RECORD_ENTRIES) {
+            throw new RangeError(`A table record cannot exceed ${String(MAX_TABLE_RECORD_ENTRIES)} aggregate entries`);
+        }
+        if (!Number.isSafeInteger(characters) || characters > MAX_TABLE_RECORD_CHARACTERS) {
+            throw new RangeError(`A table record cannot exceed ${String(MAX_TABLE_RECORD_CHARACTERS)} modeled characters`);
+        }
+    }
+}
 /** Validates the durable identities and ownership rules of one table's secondary indexes. */
 export function validateSecondaryIndexes(record) {
+    validateTableRecordBounds(record);
     const columnIds = new Set(record.columns.map((column) => column.id));
     const names = new Set();
     const storageIds = new Set(Object.keys(record.ftsColumns ?? {}));
@@ -166,22 +452,21 @@ export function validateSecondaryIndexes(record) {
         if (indexId.length === 0 || index.name.length === 0 || index.storageColumnId.length === 0) {
             throw new TypeError("Secondary-index IDs and names must be non-empty");
         }
-        const indexedColumnIds = index.columnIds ?? [index.columnId];
+        validateStorageId(indexId, "Secondary-index ID");
+        validateCatalogName(index.name, "Secondary-index name");
+        validateStorageId(index.storageColumnId, "Secondary-index storage ID");
+        const indexedColumnIds = index.columnIds;
         if (indexedColumnIds.length === 0 ||
             indexedColumnIds[0] !== index.columnId ||
             new Set(indexedColumnIds).size !== indexedColumnIds.length ||
             indexedColumnIds.some((columnId) => !columnIds.has(columnId))) {
             throw new TypeError(`Secondary index ${index.name} references an unknown column`);
         }
-        const directions = index.directions ?? indexedColumnIds.map(() => "asc");
+        const directions = index.directions;
         const termEncoding = index.termEncoding;
         if (directions.length !== indexedColumnIds.length ||
             directions.some((direction) => direction !== "asc" && direction !== "desc") ||
-            (termEncoding !== undefined && termEncoding !== "tuple-v1") ||
-            (termEncoding !== "tuple-v1" &&
-                (indexedColumnIds.length > 1 ||
-                    directions.some((direction) => direction !== "asc") ||
-                    index.unique === true))) {
+            termEncoding !== "tuple-v1") {
             throw new TypeError(`Secondary index ${index.name} has invalid key metadata`);
         }
         if (index.uniqueEnforced === true && index.unique !== true) {
@@ -208,13 +493,13 @@ export function validateSecondaryIndexes(record) {
         }
     }
 }
-/** Ordered catalog column IDs for legacy and current secondary-index records. */
+/** Ordered catalog column IDs for one canonical secondary-index record. */
 export function secondaryIndexColumnIds(index) {
-    return index.columnIds ?? [index.columnId];
+    return index.columnIds;
 }
-/** Declared directions for legacy and current secondary-index records. */
+/** Declared directions for one canonical secondary-index record. */
 export function secondaryIndexDirections(index) {
-    return index.directions ?? secondaryIndexColumnIds(index).map(() => "asc");
+    return index.directions;
 }
 /** Unique-membership namespace owned by one physical secondary index. */
 export function secondaryUniqueKeyNamespace(tableId, indexId) {
@@ -232,6 +517,94 @@ export class TableRecordConflictError extends Error {
         this.actualRevision = actualRevision;
     }
 }
+/** A catalog drop lost a race with durable work that still owns records for the table. */
+export class TableInUseError extends Error {
+    tableId;
+    ownerKind;
+    ownerId;
+    name = "TableInUseError";
+    constructor(tableId, ownerKind, ownerId) {
+        super(`Cannot remove table ${tableId} while ${ownerKind} ${ownerId} is active`);
+        this.tableId = tableId;
+        this.ownerKind = ownerKind;
+        this.ownerId = ownerId;
+    }
+}
+/** Refuses a commit that would cross the persisted level-zero fragmentation safety ceiling. */
+export class CompactionBacklogError extends Error {
+    tableName;
+    levelZeroSegments;
+    limit;
+    name = "CompactionBacklogError";
+    constructor(tableName, levelZeroSegments, limit) {
+        super(`Table ${tableName} has ${String(levelZeroSegments)} level-zero segments; compactTable() must reduce it below the ${String(limit)}-segment safety limit before more writes`);
+        this.tableName = tableName;
+        this.levelZeroSegments = levelZeroSegments;
+        this.limit = limit;
+    }
+}
+/** Absolute visible level-zero ceiling; every commit that adds L0 must enforce this or lower. */
+export const MAX_LEVEL_ZERO_SEGMENTS = 4_096;
+/** Largest persisted row ID/posting value; the wire format is canonical unsigned 64-bit. */
+export const MAX_ROW_ID = (1n << 64n) - 1n;
+/** One past `MAX_ROW_ID`, allowed only for exclusive range/counter ends. */
+export const MAX_ROW_ID_EXCLUSIVE_END = 1n << 64n;
+/** Auto-increment values are exposed as exact JavaScript numbers and therefore stop here. */
+export const MAX_AUTO_INCREMENT_VALUE = BigInt(Number.MAX_SAFE_INTEGER);
+export const MAX_AUTO_INCREMENT_EXCLUSIVE_END = MAX_AUTO_INCREMENT_VALUE + 1n;
+/** A live owner renews; an abandoned durable pin expires within one hour. */
+export const MAX_LEASE_TTL_MS = 60 * 60 * 1_000;
+/** Durable resource ceilings; adapters sweep expired owners before atomically refusing creation. */
+export const MAX_ACTIVE_LEASES = 4_096;
+export const MAX_ACTIVE_TEMP_OWNERS = 1_024;
+export const MAX_TEMP_RUNS_PER_OWNER = 1_024;
+export const MAX_TEMP_PAGES_PER_OWNER = 16_384;
+export const MAX_TEMP_RUNS_TOTAL = 65_536;
+export const MAX_TEMP_PAGES_TOTAL = 262_144;
+export const MAX_TEMP_BYTES_PER_OWNER = 512 * 1024 * 1024;
+export const MAX_TEMP_BYTES_TOTAL = 1024 * 1024 * 1024;
+export const MAX_ACTIVE_COMPACTION_JOBS = 1_024;
+export const MAX_ACTIVE_GARBAGE_COLLECTION_JOBS = 1;
+export const MAX_ACTIVE_UNIQUE_KEY_BUILDS = 1_024;
+export const MAX_ACTIVE_FTS_BASE_BUILDS = 128;
+export const MAX_ACTIVE_SECONDARY_INDEX_BUILDS = 128;
+export const MAX_ACCELERATOR_BUILD_STAGED_BYTES_TOTAL = 1024 * 1024 * 1024;
+export const MAX_ACCELERATOR_BUILD_STAGED_ENTRIES_TOTAL = 16_777_216;
+export const MAX_ACTIVE_TRANSACTIONS = 4_096;
+export const MAX_GLOBAL_STAGED_ARTIFACT_BYTES = 512 * 1024 * 1024;
+export const MAX_GLOBAL_STAGED_BLOCKS = 65_536;
+export const MAX_GLOBAL_STAGED_SEGMENTS = 65_536;
+/** Catalog enumeration remains bounded even for cold public inspection APIs. */
+export const MAX_CATALOG_RECORDS = 4_096;
+/** Total canonical UTF-8 record-wire bytes retained by the durable catalog. */
+export const MAX_CATALOG_RETAINED_BYTES = 64 * 1024 * 1024;
+export const MAX_MANIFEST_RECORDS = 65_536;
+export const MAX_MANIFEST_RETAINED_BYTES = 64 * 1024 * 1024;
+export const MAX_SEGMENT_RECORDS = 1_048_576;
+export const MAX_SEGMENT_RETAINED_BYTES = 512 * 1024 * 1024;
+/** Durable diagnostic/provenance tails are pruned before admitting more terminal records. */
+export const MAX_TERMINAL_TRANSACTION_RECORDS = 65_536;
+export const MAX_TERMINAL_COMPACTION_JOB_RECORDS = 4_096;
+export const MAX_COMPLETED_GARBAGE_COLLECTION_JOB_RECORDS = 1_024;
+/** An old renewable pin may not force unbounded history retention while writes continue. */
+export const MAX_PINNED_MANIFEST_VERSION_LAG = 4_096;
+export const MAX_PINNED_RETIRED_BLOCKS = 65_536;
+export const MAX_PINNED_RETIRED_BYTES = 512 * 1024 * 1024;
+/** Total obsolete physical history is refused before it can consume an origin indefinitely. */
+export const MAX_RETIRED_HISTORY_BYTES = 1024 * 1024 * 1024;
+/** A durable resource family reached its fixed corruption/growth safety ceiling. */
+export class StorageResourceLimitError extends Error {
+    resource;
+    count;
+    limit;
+    name = "StorageResourceLimitError";
+    constructor(resource, count, limit) {
+        super(`Storage resource ${resource} would reach ${String(count)}; the fixed safety limit is ${String(limit)}`);
+        this.resource = resource;
+        this.count = count;
+        this.limit = limit;
+    }
+}
 export const compactionJobStates = [
     "planned",
     "running",
@@ -242,6 +615,240 @@ export const compactionJobStates = [
 ];
 export const compactionRewritePlanKinds = ["copy-v1", "rechunk-v1", "merge-v1"];
 export const compactionOutputCompressions = ["raw", "gzip"];
+/** Every segment ID owned by a compaction job, including merge partition outputs. */
+export function compactionOutputSegmentIds(job) {
+    const outputSegmentId = job.outputSegmentId;
+    if (outputSegmentId === null)
+        return [];
+    const partitionCount = (job.rewritePlan.kind === "merge-v1" || job.rewritePlan.kind === "rechunk-v1") &&
+        job.rewritePlan.partitions !== undefined
+        ? job.rewritePlan.partitions.length
+        : 1;
+    return Array.from({ length: partitionCount }, (_, index) => index === 0 ? outputSegmentId : `${outputSegmentId}/${String(index)}`);
+}
+/**
+ * Proves that a compaction transaction stages exactly the immutable job output. This is kept in
+ * the storage contract (rather than only in the engine) so adapters reject forged, reordered, or
+ * partially journaled output before publication and while loading durable state.
+ */
+export function assertCompactionOutputProvenance(job, table, transaction, sourceSegments, outputSegments, options = {}) {
+    if (job.transactionId !== transaction.id) {
+        throw new Error(`Compaction job ${job.id} belongs to another transaction`);
+    }
+    const expectedSegmentIds = compactionOutputSegmentIds(job);
+    const stagedExpectedSegmentIds = options.allowOutputPrefix
+        ? expectedSegmentIds.slice(0, transaction.pendingSegmentIds.length)
+        : expectedSegmentIds;
+    assertExactOrderedIds(transaction.pendingSegmentIds, stagedExpectedSegmentIds, `Compaction job ${job.id} segment journal`);
+    assertExactOrderedIds(outputSegments.map((segment) => segment.id), stagedExpectedSegmentIds, `Compaction job ${job.id} output segments`);
+    assertExactOrderedIds(sourceSegments.map((segment) => segment.id), job.sourceSegmentIds, `Compaction job ${job.id} source segments`);
+    const plan = job.rewritePlan;
+    if (plan.kind === "copy-v1") {
+        const expectedOutputBlockIds = sourceSegments.flatMap((segment, segmentIndex) => table.columns.flatMap((column, columnIndex) => (segment.columnBlockIds[column.id] ?? []).map((_blockId, part) => copyCompactionOutputBlockId(job.id, segmentIndex, columnIndex, part))));
+        assertExactOrderedIds(job.outputBlockIds, expectedOutputBlockIds, `Compaction job ${job.id} output block plan`);
+    }
+    else {
+        if (table.columns.length !== plan.columns.length ||
+            table.columns.some((column, index) => {
+                const planned = plan.columns.at(index);
+                if (planned?.columnId !== column.id)
+                    return true;
+                return planned.type !== column.type;
+            })) {
+            throw new Error(`Compaction job ${job.id} table schema differs from its rewrite plan`);
+        }
+        if (plan.kind === "merge-v1" && plan.keyColumnId !== table.uniqueKeyColumnId) {
+            throw new Error(`Compaction job ${job.id} table key differs from its rewrite plan`);
+        }
+        const expectedOutputBlockIds = plan.outputs.flatMap((_output, outputIndex) => plan.columns.map((_column, columnIndex) => physicalCompactionOutputBlockId(job.id, outputIndex, columnIndex)));
+        assertExactOrderedIds(job.outputBlockIds, expectedOutputBlockIds, `Compaction job ${job.id} output block plan`);
+    }
+    assertExactOrderedIds(transaction.pendingBlockIds, job.outputBlockIds, `Compaction job ${job.id} block journal`);
+    const expectedSegments = expectedCompactionOutputSegments(job, table, sourceSegments);
+    for (const [index, actual] of outputSegments.entries()) {
+        const expected = expectedSegments[index];
+        if (expected === undefined) {
+            throw new Error(`Compaction job ${job.id} stages an unexpected output segment`);
+        }
+        assertCompactionSegmentFields(actual, expected, job.id);
+    }
+}
+function expectedCompactionOutputSegments(job, table, sourceSegments) {
+    const outputSegmentId = job.outputSegmentId;
+    if (outputSegmentId === null)
+        return [];
+    const plan = job.rewritePlan;
+    const common = {
+        tableId: table.id,
+        transactionId: job.transactionId ?? "",
+        ...(table.uniqueKeyColumnId === undefined ? {} : { keyColumnId: table.uniqueKeyColumnId }),
+        level: job.targetLevel,
+        ...(job.outputPartitionOrdinal === undefined
+            ? {}
+            : { partitionOrdinal: job.outputPartitionOrdinal }),
+    };
+    if (plan.kind === "copy-v1") {
+        const first = sourceSegments[0];
+        const last = sourceSegments[sourceSegments.length - 1];
+        if (first === undefined || last === undefined) {
+            throw new Error(`Compaction job ${job.id} has no source rows`);
+        }
+        return [
+            {
+                id: outputSegmentId,
+                ...common,
+                rowCount: safeSum(sourceSegments.map((segment) => segment.rowCount), "Copy compaction output rows"),
+                rowIdStart: first.rowIdStart,
+                rowIdEndExclusive: last.rowIdEndExclusive,
+                columnBlockIds: Object.fromEntries(table.columns.map((column, columnIndex) => [
+                    column.id,
+                    sourceSegments.flatMap((segment, segmentIndex) => (segment.columnBlockIds[column.id] ?? []).map((_blockId, part) => copyCompactionOutputBlockId(job.id, segmentIndex, columnIndex, part))),
+                ])),
+                kind: "insert",
+                logicalOrder: Math.min(...sourceSegments.map((segment) => segment.logicalOrder)),
+                commitOrdinal: 0,
+                rowIdSpans: [],
+            },
+        ];
+    }
+    const partitions = plan.partitions ?? [
+        { rowStart: 0, rowCount: plan.totalRows, logicalOrder: plan.logicalOrder },
+    ];
+    return partitions.map((partition, index) => {
+        const rowIdSpans = plan.kind === "merge-v1"
+            ? sliceCompactionRowIdSpans(plan.rowIdSpans, partition.rowStart, partition.rowCount)
+            : [];
+        const envelope = plan.kind === "merge-v1"
+            ? compactionRowIdSpanEnvelope(rowIdSpans)
+            : {
+                start: plan.rowIdStart + BigInt(partition.rowStart),
+                endExclusive: plan.rowIdStart + BigInt(partition.rowStart + partition.rowCount),
+            };
+        return {
+            id: index === 0 ? outputSegmentId : `${outputSegmentId}/${String(index)}`,
+            ...common,
+            rowCount: partition.rowCount,
+            rowIdStart: envelope.start,
+            rowIdEndExclusive: envelope.endExclusive,
+            columnBlockIds: Object.fromEntries(plan.columns.map((column, columnIndex) => [
+                column.columnId,
+                plan.outputs.flatMap((output, outputIndex) => output.rowStart >= partition.rowStart &&
+                    output.rowStart + output.rowCount <= partition.rowStart + partition.rowCount
+                    ? [physicalCompactionOutputBlockId(job.id, outputIndex, columnIndex)]
+                    : []),
+            ])),
+            kind: plan.kind === "merge-v1" ? "base" : "insert",
+            logicalOrder: partition.logicalOrder,
+            commitOrdinal: index,
+            rowIdSpans,
+        };
+    });
+}
+function assertCompactionSegmentFields(actual, expected, jobId) {
+    for (const field of [
+        "id",
+        "tableId",
+        "transactionId",
+        "rowCount",
+        "rowIdStart",
+        "rowIdEndExclusive",
+        "kind",
+        "keyColumnId",
+        "level",
+        "logicalOrder",
+        "commitOrdinal",
+        "partitionOrdinal",
+    ]) {
+        if (actual[field] !== expected[field]) {
+            throw new Error(`Compaction job ${jobId} output ${actual.id} has invalid ${field}`);
+        }
+    }
+    const expectedColumnIds = Object.keys(expected.columnBlockIds);
+    assertExactOrderedIds(Object.keys(actual.columnBlockIds).sort(), [...expectedColumnIds].sort(), `Compaction job ${jobId} output ${actual.id} columns`);
+    for (const columnId of expectedColumnIds) {
+        assertExactOrderedIds(actual.columnBlockIds[columnId] ?? [], expected.columnBlockIds[columnId] ?? [], `Compaction job ${jobId} output ${actual.id} column ${columnId}`);
+    }
+    if (actual.rowIdSpans.length !== expected.rowIdSpans.length ||
+        actual.rowIdSpans.some((span, index) => {
+            const planned = expected.rowIdSpans[index];
+            return (planned?.rowStart !== span.rowStart ||
+                planned.rowCount !== span.rowCount ||
+                planned.rowIdStart !== span.rowIdStart);
+        })) {
+        throw new Error(`Compaction job ${jobId} output ${actual.id} has invalid row-ID spans`);
+    }
+}
+function assertExactOrderedIds(actual, expected, label) {
+    if (actual.length !== expected.length ||
+        actual.some((value, index) => value !== expected[index])) {
+        throw new Error(`${label} is not the canonical ordered sequence`);
+    }
+}
+function physicalCompactionOutputBlockId(jobId, outputIndex, columnIndex) {
+    return [
+        jobId,
+        "rewrite",
+        "window",
+        String(outputIndex).padStart(8, "0"),
+        "column",
+        String(columnIndex).padStart(8, "0"),
+    ].join("/");
+}
+function copyCompactionOutputBlockId(jobId, segmentIndex, columnIndex, part) {
+    return [
+        jobId,
+        "output",
+        "segment",
+        String(segmentIndex).padStart(6, "0"),
+        "column",
+        String(columnIndex).padStart(6, "0"),
+        "part",
+        String(part).padStart(6, "0"),
+    ].join("/");
+}
+function sliceCompactionRowIdSpans(spans, rowStart, rowCount) {
+    const result = [];
+    const rowEnd = rowStart + rowCount;
+    for (const span of spans) {
+        const spanEnd = span.rowStart + span.rowCount;
+        if (spanEnd <= rowStart || span.rowStart >= rowEnd)
+            continue;
+        const start = Math.max(span.rowStart, rowStart);
+        const end = Math.min(spanEnd, rowEnd);
+        const next = {
+            rowStart: start - rowStart,
+            rowCount: end - start,
+            rowIdStart: span.rowIdStart + BigInt(start - span.rowStart),
+        };
+        const previous = result[result.length - 1];
+        if (previous !== undefined &&
+            previous.rowStart + previous.rowCount === next.rowStart &&
+            previous.rowIdStart + BigInt(previous.rowCount) === next.rowIdStart) {
+            result[result.length - 1] = {
+                ...previous,
+                rowCount: previous.rowCount + next.rowCount,
+            };
+        }
+        else {
+            result.push(next);
+        }
+    }
+    return result;
+}
+function compactionRowIdSpanEnvelope(spans) {
+    if (spans.length === 0)
+        return { start: 0n, endExclusive: 0n };
+    let start = spans[0]?.rowIdStart ?? 0n;
+    let endExclusive = start + BigInt(spans[0]?.rowCount ?? 0);
+    for (const span of spans.slice(1)) {
+        if (span.rowIdStart < start)
+            start = span.rowIdStart;
+        const spanEnd = span.rowIdStart + BigInt(span.rowCount);
+        if (spanEnd > endExclusive)
+            endExclusive = spanEnd;
+    }
+    return { start, endExclusive };
+}
 export class CompactionJobConflictError extends Error {
     jobId;
     expectedRevision;
@@ -255,6 +862,15 @@ export class CompactionJobConflictError extends Error {
     }
 }
 export const garbageCollectionJobStates = ["planned", "running", "completed"];
+/** Absolute per-call bound for durable maintenance candidate arrays and storage transactions. */
+export const MAX_MAINTENANCE_BATCH_ITEMS = 1_024;
+export function boundedMaintenanceBatchItems(value, label) {
+    const normalized = positiveWholeNumber(value, label);
+    if (normalized > MAX_MAINTENANCE_BATCH_ITEMS) {
+        throw new RangeError(`${label} cannot exceed ${String(MAX_MAINTENANCE_BATCH_ITEMS)} items`);
+    }
+    return normalized;
+}
 export class GarbageCollectionJobConflictError extends Error {
     jobId;
     expectedRevision;
@@ -287,6 +903,362 @@ export class LeaseConflictError extends Error {
         this.actualRevision = actualRevision;
     }
 }
+/** A renewal/move cutoff reached the persisted expiry; expiry is irrevocable. */
+export class LeaseExpiredError extends Error {
+    leaseId;
+    expiresAt;
+    expiresAtCutoff;
+    name = "LeaseExpiredError";
+    constructor(leaseId, expiresAt, expiresAtCutoff) {
+        super(`Lease ${leaseId} expired at ${expiresAt}`);
+        this.leaseId = leaseId;
+        this.expiresAt = expiresAt;
+        this.expiresAtCutoff = expiresAtCutoff;
+    }
+}
+/** Refuses a lease release from a different durable owner. */
+export class LeaseOwnerConflictError extends Error {
+    leaseId;
+    expectedOwnerId;
+    actualOwnerId;
+    name = "LeaseOwnerConflictError";
+    constructor(leaseId, expectedOwnerId, actualOwnerId) {
+        super(`Lease ${leaseId} belongs to ${actualOwnerId}, not release owner ${expectedOwnerId}`);
+        this.leaseId = leaseId;
+        this.expectedOwnerId = expectedOwnerId;
+        this.actualOwnerId = actualOwnerId;
+    }
+}
+/** Maximum immutable payloads accepted by one atomic staging/WAL operation. */
+export const MAX_TRANSACTION_STAGE_BLOCKS = 64;
+/** Maximum segment records accepted by one atomic staging/WAL operation. */
+export const MAX_TRANSACTION_STAGE_SEGMENTS = 64;
+/**
+ * Maximum block bytes accepted by one atomic staging/WAL operation. The limit still admits one
+ * maximum-size physical block; callers split collections of smaller blocks into bounded calls.
+ */
+export const MAX_TRANSACTION_STAGE_BYTES = MAX_STORED_BLOCK_BYTE_LENGTH;
+/** Durable journal ceilings prevent a forgotten or hostile transaction growing without bound. */
+export const MAX_TRANSACTION_PENDING_BLOCKS = 4_096;
+export const MAX_TRANSACTION_PENDING_SEGMENTS = 4_096;
+/** Storage-boundary preflight shared by staging and single-shot write implementations. */
+export function assertTransactionArtifactBatchLimits(blocks, segments) {
+    if (blocks.length > MAX_TRANSACTION_STAGE_BLOCKS) {
+        throw new RangeError(`Transaction artifact batch exceeds ${String(MAX_TRANSACTION_STAGE_BLOCKS)} blocks`);
+    }
+    if (segments.length > MAX_TRANSACTION_STAGE_SEGMENTS) {
+        throw new RangeError(`Transaction artifact batch exceeds ${String(MAX_TRANSACTION_STAGE_SEGMENTS)} segments`);
+    }
+    let byteLength = 0;
+    for (const block of blocks) {
+        if (!(block.bytes instanceof Uint8Array)) {
+            throw new TypeError("Transaction block bytes must be a Uint8Array");
+        }
+        byteLength += block.bytes.byteLength;
+        if (!Number.isSafeInteger(byteLength) || byteLength > MAX_TRANSACTION_STAGE_BYTES) {
+            throw new RangeError(`Transaction artifact batch exceeds ${String(MAX_TRANSACTION_STAGE_BYTES)} block bytes`);
+        }
+    }
+}
+/** Preflight for the complete persisted journal after a bounded staging operation. */
+export function assertTransactionArtifactJournalLimits(pendingBlockIds, pendingSegmentIds) {
+    if (pendingBlockIds.length > MAX_TRANSACTION_PENDING_BLOCKS) {
+        throw new RangeError(`Transaction journal exceeds ${String(MAX_TRANSACTION_PENDING_BLOCKS)} pending blocks`);
+    }
+    if (pendingSegmentIds.length > MAX_TRANSACTION_PENDING_SEGMENTS) {
+        throw new RangeError(`Transaction journal exceeds ${String(MAX_TRANSACTION_PENDING_SEGMENTS)} pending segments`);
+    }
+}
+/** A snapshot session is renewable but can never pin storage for more than one hour unattended. */
+export const MAX_SNAPSHOT_SESSION_TTL_MS = 60 * 60 * 1_000;
+/** Snapshot v1 is an ordered bounded record stream; no database-sized collection is in header. */
+export const SNAPSHOT_FRAME_KINDS = [
+    "catalog-page",
+    "segment-page",
+    "transaction-page",
+    "unique-page",
+    "posting-page",
+    "block",
+];
+export const MAX_SNAPSHOT_FRAME_ITEMS = 1_024;
+export const MAX_SNAPSHOT_METADATA_FRAME_BYTES = 4 * 1024 * 1024;
+export const MAX_SNAPSHOT_FRAME_BATCH_ITEMS = 64;
+export const MAX_SNAPSHOT_METADATA_BATCH_BYTES = 16 * 1024 * 1024;
+/** One block frame is permitted; metadata frames still use MAX_SNAPSHOT_METADATA_BATCH_BYTES. */
+export const MAX_SNAPSHOT_FRAME_BATCH_BYTES = MAX_STORED_BLOCK_BYTE_LENGTH + 8 * 1024;
+/**
+ * Framed restore builds accelerator generations in a disposable core before one atomic publish.
+ * These aggregate ceilings keep that validation heap bounded until generations become a native
+ * chunk-backed structure rather than one materialized in-memory collection.
+ */
+export const MAX_SNAPSHOT_IMPORT_ACCELERATOR_RETAINED_BYTES = MAX_ACCELERATOR_BUILD_STAGED_BYTES_TOTAL;
+export const MAX_SNAPSHOT_IMPORT_ACCELERATOR_RETAINED_ENTRIES = MAX_ACCELERATOR_BUILD_STAGED_ENTRIES_TOTAL;
+/** Modeled heap retained by one framed accelerator chunk during atomic snapshot validation. */
+export function snapshotAcceleratorItemRetainedUsage(item) {
+    if (item.kind === "unique-chunk") {
+        return {
+            bytes: uniqueKeyBuildChunkRetainedBytes(item.keyTokens),
+            entries: item.keyTokens.length,
+        };
+    }
+    let bytes = 0;
+    let entries = 0;
+    for (const posting of item.postings) {
+        bytes = safeSum([bytes, 32 + posting.term.length * 2], "Snapshot posting retained bytes");
+        entries = safeSum([entries, posting.rowIds.length], "Snapshot posting retained entries");
+        // Bigint row IDs, term-frequency numbers, and the two array slots all remain live until the
+        // generation is validated and promoted. The fixed model is intentionally conservative.
+        bytes = safeSum([bytes, posting.rowIds.length * 48], "Snapshot posting retained bytes");
+    }
+    return { bytes, entries };
+}
+/** Shared arithmetic boundary used by streaming adapters and allocation-free cap tests. */
+export function assertSnapshotImportAcceleratorUsage(bytes, entries) {
+    if (!Number.isSafeInteger(bytes) || bytes < 0) {
+        throw new RangeError("Snapshot accelerator retained bytes are invalid");
+    }
+    if (!Number.isSafeInteger(entries) || entries < 0) {
+        throw new RangeError("Snapshot accelerator retained entries are invalid");
+    }
+    if (bytes > MAX_SNAPSHOT_IMPORT_ACCELERATOR_RETAINED_BYTES) {
+        throw new StorageResourceLimitError("snapshot accelerator byte", bytes, MAX_SNAPSHOT_IMPORT_ACCELERATOR_RETAINED_BYTES);
+    }
+    if (entries > MAX_SNAPSHOT_IMPORT_ACCELERATOR_RETAINED_ENTRIES) {
+        throw new StorageResourceLimitError("snapshot accelerator entry", entries, MAX_SNAPSHOT_IMPORT_ACCELERATOR_RETAINED_ENTRIES);
+    }
+}
+export class SnapshotImportConflictError extends Error {
+    identity;
+    ownerId;
+    name = "SnapshotImportConflictError";
+    constructor(identity, ownerId, message) {
+        super(`Snapshot import ${identity} owned by ${ownerId}: ${message}`);
+        this.identity = identity;
+        this.ownerId = ownerId;
+    }
+}
+/**
+ * Persisted bytes belong to a recognized storage family, but not to the version this reader
+ * supports. This is deliberately distinct from corruption: callers must not infer that repair,
+ * recreation, or deletion is safe merely because versions differ.
+ */
+export class StorageFormatVersionError extends Error {
+    backend;
+    location;
+    actualVersion;
+    supportedVersion;
+    relation;
+    name = "StorageFormatVersionError";
+    constructor(backend, location, actualVersion, supportedVersion, relation) {
+        const actual = actualVersion === null ? "an unknown version" : `version ${String(actualVersion)}`;
+        super(`${backend} storage format at ${location} uses ${actual}, which is ${relation} than ` +
+            `the supported version ${String(supportedVersion)}`);
+        this.backend = backend;
+        this.location = location;
+        this.actualVersion = actualVersion;
+        this.supportedVersion = supportedVersion;
+        this.relation = relation;
+    }
+}
+/** A native IndexedDB schema upgrade is waiting for another connection to close. */
+export class IndexedDbSchemaUpgradeBlockedError extends Error {
+    databaseName;
+    oldVersion;
+    requestedVersion;
+    name = "IndexedDbSchemaUpgradeBlockedError";
+    constructor(databaseName, oldVersion, requestedVersion) {
+        super(`IndexedDB schema upgrade for ${databaseName} from version ${String(oldVersion)} to ` +
+            `${String(requestedVersion)} is blocked by another open connection; close older tabs and retry`);
+        this.databaseName = databaseName;
+        this.oldVersion = oldVersion;
+        this.requestedVersion = requestedVersion;
+    }
+}
+/** Persisted metadata or payload failed an adapter's fail-closed integrity checks. */
+export class StorageCorruptionError extends Error {
+    backend;
+    location;
+    name = "StorageCorruptionError";
+    constructor(backend, location, message) {
+        super(`${backend} storage corruption at ${location}: ${message}`);
+        this.backend = backend;
+        this.location = location;
+    }
+}
+/**
+ * A remote OPFS leader may have committed a mutation whose acknowledgement was lost.
+ * Reconcile stable identities or revisions before retrying the named operation.
+ */
+export class OpfsUncertainOutcomeError extends Error {
+    method;
+    name = "OpfsUncertainOutcomeError";
+    constructor(method) {
+        super(`The OPFS leader changed before ${method} was acknowledged; the mutation may have committed`);
+        this.method = method;
+    }
+}
+/** Bounded calls used to seed an arbitrarily large UNIQUE namespace without heap materialization. */
+export const MAX_UNIQUE_KEY_BUILD_TOKENS_PER_CHUNK = 4_096;
+export const MAX_UNIQUE_KEY_BUILD_CHUNK_BYTES = 4 * 1024 * 1024;
+export const MAX_UNIQUE_KEY_BUILD_TTL_MS = 60 * 60 * 1_000;
+export const MAX_UNIQUE_KEY_BUILD_STAGED_BYTES = 512 * 1024 * 1024;
+export const MAX_UNIQUE_KEY_BUILD_STAGED_BYTES_TOTAL = 1024 * 1024 * 1024;
+/** Validates one staged seed call before an adapter opens a transaction or WAL frame. */
+export function uniqueKeyBuildChunkRetainedBytes(keyTokens) {
+    if (keyTokens.length === 0 || keyTokens.length > MAX_UNIQUE_KEY_BUILD_TOKENS_PER_CHUNK) {
+        throw new RangeError(`A UNIQUE build chunk must contain 1-${String(MAX_UNIQUE_KEY_BUILD_TOKENS_PER_CHUNK)} tokens`);
+    }
+    const seen = new Set();
+    let bytes = 0;
+    for (const token of keyTokens) {
+        if (typeof token !== "string" ||
+            token.length === 0 ||
+            token.length > MAX_FTS_POSTING_TERM_CHARACTERS) {
+            throw new TypeError("A UNIQUE build token has invalid length");
+        }
+        assertWellFormedString(token, "UNIQUE build token");
+        if (seen.has(token))
+            throw new UniqueKeyConflictError("UNIQUE build", token);
+        seen.add(token);
+        bytes = safeSum([bytes, 16 + token.length * 2], "UNIQUE build chunk bytes");
+        if (bytes > MAX_UNIQUE_KEY_BUILD_CHUNK_BYTES) {
+            throw new RangeError(`A UNIQUE build chunk cannot exceed ${String(MAX_UNIQUE_KEY_BUILD_CHUNK_BYTES)} retained bytes`);
+        }
+    }
+    return bytes;
+}
+export class UniqueKeyBuildConflictError extends Error {
+    buildId;
+    reason;
+    name = "UniqueKeyBuildConflictError";
+    constructor(buildId, reason) {
+        super(`UNIQUE build ${buildId} cannot continue: ${reason}`);
+        this.buildId = buildId;
+        this.reason = reason;
+    }
+}
+export const MAX_POSTING_BUILD_TTL_MS = 60 * 60 * 1_000;
+export class PostingBuildConflictError extends Error {
+    buildId;
+    ownerId;
+    reason;
+    name = "PostingBuildConflictError";
+    constructor(buildId, ownerId, reason) {
+        super(`Posting build ${buildId} owned by ${ownerId}: ${reason}`);
+        this.buildId = buildId;
+        this.ownerId = ownerId;
+        this.reason = reason;
+    }
+}
+/** In-memory and atomic-publish bounds for one transaction's accelerator/key deltas. */
+export const MAX_TRANSACTION_COMMIT_DELTA_BYTES = 64 * 1024 * 1024;
+export const MAX_TRANSACTION_COMMIT_DELTA_ENTRIES = 1_048_576;
+export function transactionCommitDeltaRetainedBytes(uniqueKeyChanges, ftsChanges) {
+    let bytes = 0;
+    let entries = 0;
+    const add = (amount) => {
+        bytes += amount;
+        if (!Number.isSafeInteger(bytes) || bytes > MAX_TRANSACTION_COMMIT_DELTA_BYTES) {
+            throw new RangeError(`Transaction commit deltas exceed ${String(MAX_TRANSACTION_COMMIT_DELTA_BYTES)} retained bytes`);
+        }
+    };
+    const addEntry = () => {
+        entries += 1;
+        if (entries > MAX_TRANSACTION_COMMIT_DELTA_ENTRIES) {
+            throw new RangeError(`Transaction commit deltas exceed ${String(MAX_TRANSACTION_COMMIT_DELTA_ENTRIES)} entries`);
+        }
+    };
+    for (const change of uniqueKeyChanges) {
+        add(48 + change.tableId.length * 2);
+        for (const token of change.keyTokens) {
+            addEntry();
+            add(16 + token.length * 2);
+        }
+    }
+    for (const change of ftsChanges) {
+        add(32 + change.tableId.length * 2);
+        for (const column of change.columns) {
+            add(48 + column.columnId.length * 2);
+            for (const posting of column.postings) {
+                addEntry();
+                add(32 + posting.term.length * 2);
+                if (posting.rowIds.length !== posting.tf.length) {
+                    throw new TypeError("Full-text posting row and frequency counts differ");
+                }
+                entries += posting.rowIds.length;
+                if (entries > MAX_TRANSACTION_COMMIT_DELTA_ENTRIES) {
+                    throw new RangeError(`Transaction commit deltas exceed ${String(MAX_TRANSACTION_COMMIT_DELTA_ENTRIES)} entries`);
+                }
+                add(posting.rowIds.length * 16);
+            }
+        }
+    }
+    return { bytes, entries };
+}
+/** Aggregate row-id ceiling for one postings candidate read. Overflow falls back to a scan. */
+export const MAX_FTS_CANDIDATE_ROW_IDS = 65_536;
+/** Query-term cardinality shared by the parser and every postings adapter boundary. */
+export const MAX_FTS_QUERY_TERMS = 32;
+/** Retained metadata/value ceiling for one ordered postings read. Overflow falls back to a scan. */
+export const MAX_FTS_ORDERED_READ_BYTES = 64 * 1024 * 1024;
+/** Hard public mutation bounds for one streamed postings-build chunk. */
+export const MAX_FTS_POSTINGS_PER_CHUNK = 65_536;
+export const MAX_FTS_POSTING_ROW_IDS_PER_CHUNK = 1_048_576;
+export const MAX_FTS_POSTING_TERM_CHARACTERS = 65_536;
+/** Indexed string values are bounded; non-indexed block strings retain the physical block cap. */
+export const MAX_INDEXED_STRING_CHARACTERS = 16_384;
+/** Maximum normalized tokens retained from one indexed document. */
+export const MAX_FTS_TOKENS_PER_DOCUMENT = 4_096;
+/** Bounded catalog/TOC cardinality. Oversized accelerators invalidate and queries scan. */
+export const MAX_FTS_BASE_CHUNKS = 4_096;
+export const MAX_FTS_DELTA_CHUNKS = 128;
+/** Strict, bounded runtime validation shared by every adapter before any postings read. */
+export function validateFtsPostingQueries(value, label = "Full-text query terms") {
+    if (!Array.isArray(value))
+        throw new TypeError(`${label} must be an array`);
+    if (value.length > MAX_FTS_QUERY_TERMS) {
+        throw new RangeError(`${label} cannot exceed ${String(MAX_FTS_QUERY_TERMS)} items`);
+    }
+    for (const queryValue of value) {
+        if (typeof queryValue !== "object" || queryValue === null || Array.isArray(queryValue)) {
+            throw new TypeError("Full-text posting query must be an object");
+        }
+        const query = queryValue;
+        const keys = Object.keys(query);
+        if ("term" in query) {
+            if (keys.length !== 2 ||
+                keys.some((key) => key !== "term" && key !== "prefix") ||
+                typeof query.term !== "string" ||
+                query.term.length === 0 ||
+                query.term.length > MAX_FTS_POSTING_TERM_CHARACTERS ||
+                typeof query.prefix !== "boolean") {
+                throw new TypeError("Full-text exact/prefix query is invalid");
+            }
+            assertWellFormedString(query.term, "Full-text query term");
+            continue;
+        }
+        if (keys.some((key) => key !== "lower" &&
+            key !== "lowerInclusive" &&
+            key !== "upper" &&
+            key !== "upperInclusive") ||
+            (query.lower !== undefined &&
+                (typeof query.lower !== "string" ||
+                    query.lower.length > MAX_FTS_POSTING_TERM_CHARACTERS)) ||
+            (query.upper !== undefined &&
+                (typeof query.upper !== "string" ||
+                    query.upper.length > MAX_FTS_POSTING_TERM_CHARACTERS)) ||
+            (query.lowerInclusive !== undefined && typeof query.lowerInclusive !== "boolean") ||
+            (query.upperInclusive !== undefined && typeof query.upperInclusive !== "boolean")) {
+            throw new TypeError("Full-text range query is invalid");
+        }
+        if (typeof query.lower === "string") {
+            assertWellFormedString(query.lower, "Full-text query lower bound");
+        }
+        if (typeof query.upper === "string") {
+            assertWellFormedString(query.upper, "Full-text query upper bound");
+        }
+    }
+}
 /** Whether a stored term belongs to one exact, prefix, or range lookup. */
 export function ftsPostingQueryMatches(term, query) {
     if ("term" in query)
@@ -306,8 +1278,13 @@ export function ftsPostingQueryMatches(term, query) {
  * term-match rule (exact, or prefix as a term range) and the sorted-unique row-id shape must
  * never drift between backends — pruning would silently differ per store.
  */
-export function collectFtsCandidates(chunkLists, terms) {
+export function collectFtsCandidates(chunkLists, terms, maxRowIds = MAX_FTS_CANDIDATE_ROW_IDS) {
+    validateFtsPostingQueries(terms);
+    if (!Number.isSafeInteger(maxRowIds) || maxRowIds < 1 || maxRowIds > MAX_FTS_CANDIDATE_ROW_IDS) {
+        throw new RangeError(`Full-text candidate limit must be between 1 and ${String(MAX_FTS_CANDIDATE_ROW_IDS)}`);
+    }
     const sets = terms.map(() => new Set());
+    let retainedRowIds = 0;
     for (const postings of chunkLists) {
         for (const posting of postings) {
             for (let index = 0; index < terms.length; index += 1) {
@@ -318,21 +1295,49 @@ export function collectFtsCandidates(chunkLists, terms) {
                 if (!matches)
                     continue;
                 const set = sets[index];
-                if (set !== undefined)
-                    for (const rowId of posting.rowIds)
+                if (set !== undefined) {
+                    for (const rowId of posting.rowIds) {
+                        if (set.has(rowId))
+                            continue;
+                        if (retainedRowIds === maxRowIds) {
+                            return { rowIdsByTerm: terms.map(() => []), overflow: true };
+                        }
                         set.add(rowId);
+                        retainedRowIds += 1;
+                    }
+                }
             }
         }
     }
     return {
         rowIdsByTerm: sets.map((set) => [...set].sort((left, right) => (left < right ? -1 : left > right ? 1 : 0))),
+        overflow: false,
     };
 }
+/** Validates the fixed memory ceilings accepted by one ordered postings read. */
+export function validateFtsOrderedReadLimits(maxRowIds = MAX_FTS_CANDIDATE_ROW_IDS, maxRetainedBytes = MAX_FTS_ORDERED_READ_BYTES) {
+    if (!Number.isSafeInteger(maxRowIds) || maxRowIds < 1 || maxRowIds > MAX_FTS_CANDIDATE_ROW_IDS) {
+        throw new RangeError(`Ordered postings row limit must be between 1 and ${String(MAX_FTS_CANDIDATE_ROW_IDS)}`);
+    }
+    if (!Number.isSafeInteger(maxRetainedBytes) ||
+        maxRetainedBytes < 1 ||
+        maxRetainedBytes > MAX_FTS_ORDERED_READ_BYTES) {
+        throw new RangeError(`Ordered postings byte limit must be between 1 and ${String(MAX_FTS_ORDERED_READ_BYTES)}`);
+    }
+}
 /**
  * K-way merges sorted base/delta chunks into canonical term order. Only one term's row map and
  * one cursor per chunk stay live beyond the returned postings, avoiding a second index-sized map.
  */
 export function collectFtsPostings(chunkLists) {
+    return mergeFtsPostings(chunkLists, Number.POSITIVE_INFINITY, Number.POSITIVE_INFINITY).postings;
+}
+/** Bounded ordered merge; overflow deliberately returns no partial authoritative answer. */
+export function collectFtsPostingsBounded(chunkLists, maxRowIds = MAX_FTS_CANDIDATE_ROW_IDS, maxRetainedBytes = MAX_FTS_ORDERED_READ_BYTES) {
+    validateFtsOrderedReadLimits(maxRowIds, maxRetainedBytes);
+    return mergeFtsPostings(chunkLists, maxRowIds, maxRetainedBytes);
+}
+function mergeFtsPostings(chunkLists, maxRowIds, maxRetainedBytes) {
     const heap = [];
     const before = (left, right) => {
         const leftTerm = left.postings[left.position]?.term ?? "";
@@ -391,6 +1396,8 @@ export function collectFtsPostings(chunkLists) {
         ordinal += 1;
     }
     const output = [];
+    let retainedRowIds = 0;
+    let retainedBytes = 0;
     while (heap.length > 0) {
         const term = heap[0]?.postings[heap[0].position]?.term;
         if (term === undefined)
@@ -404,20 +1411,33 @@ export function collectFtsPostings(chunkLists) {
             if (posting === undefined)
                 continue;
             posting.rowIds.forEach((rowId, index) => {
-                rows.set(rowId, Math.max(rows.get(rowId) ?? 0, posting.tf[index] ?? 1));
+                const existing = rows.get(rowId);
+                if (existing === undefined) {
+                    rows.set(rowId, posting.tf[index] ?? 1);
+                }
+                else {
+                    rows.set(rowId, Math.max(existing, posting.tf[index] ?? 1));
+                }
             });
             cursor.position += 1;
             if (cursor.position < cursor.postings.length)
                 push(cursor);
         }
+        const nextRetainedRowIds = retainedRowIds + rows.size;
+        const nextRetainedBytes = retainedBytes + 64 + term.length * 2 + rows.size * 32;
+        if (nextRetainedRowIds > maxRowIds || nextRetainedBytes > maxRetainedBytes) {
+            return { postings: [], overflow: true };
+        }
         const ordered = [...rows].sort(([left], [right]) => (left < right ? -1 : left > right ? 1 : 0));
         output.push({
             term,
             rowIds: ordered.map(([rowId]) => rowId),
             tf: ordered.map(([, frequency]) => frequency),
         });
+        retainedRowIds = nextRetainedRowIds;
+        retainedBytes = nextRetainedBytes;
     }
-    return output;
+    return { postings: output, overflow: false };
 }
 /**
  * Shared stale-writer policy for both stores' commit steps: a commit that adds segments to a
@@ -442,7 +1462,11 @@ export function invalidateUncoveredFtsColumns(record, coveredColumnIds) {
     }
     if (!invalidated)
         return undefined;
-    return { ...record, ftsColumns: next, revision: (record.revision ?? 0) + 1 };
+    return {
+        ...record,
+        ftsColumns: next,
+        revision: safeSum([record.revision, 1], "Table revision"),
+    };
 }
 /**
  * Scalar-index half of the stale-writer rule. A writer that staged table data from catalog
@@ -468,7 +1492,11 @@ export function invalidateUncoveredSecondaryIndexes(record, coveredStorageColumn
     }
     if (!invalidated)
         return undefined;
-    return { ...record, secondaryIndexes: next, revision: (record.revision ?? 0) + 1 };
+    return {
+        ...record,
+        secondaryIndexes: next,
+        revision: safeSum([record.revision, 1], "Table revision"),
+    };
 }
 /** Physical posting IDs a current catalog record authorizes a commit to write. */
 export function activePostingStorageColumnIds(record) {
@@ -508,6 +1536,17 @@ export class WriteConflictError extends Error {
         this.actualVersion = actualVersion;
     }
 }
+/** Staged write artifacts were prepared against a structurally different catalog. */
+export class SchemaConflictError extends Error {
+    expectedEpoch;
+    actualEpoch;
+    name = "SchemaConflictError";
+    constructor(expectedEpoch, actualEpoch) {
+        super(`Schema changed while the write was staged: expected epoch ${String(expectedEpoch)}, found ${String(actualEpoch)}`);
+        this.expectedEpoch = expectedEpoch;
+        this.actualEpoch = actualEpoch;
+    }
+}
 export class TransactionRecordConflictError extends Error {
     transactionId;
     expectedRevision;
@@ -520,6 +1559,37 @@ export class TransactionRecordConflictError extends Error {
         this.actualRevision = actualRevision;
     }
 }
+/** Hard storage-boundary limits for one scratch-page write. */
+export const MAX_TEMP_RUN_PAGES_PER_BATCH = 64;
+export const MAX_TEMP_RUN_PAGE_BYTES = MAX_STORED_BLOCK_BYTE_LENGTH;
+export const MAX_TEMP_RUN_BATCH_BYTES = MAX_STORED_BLOCK_BYTE_LENGTH;
+/**
+ * Refuses an oversized scratch write before an adapter starts a transaction or appends a WAL
+ * record. Query execution splits pages and batches to these limits, so the limits bound atomic
+ * storage work without limiting the total size of a spill.
+ */
+export function assertTempRunPageBatchLimits(pages) {
+    if (pages.length > MAX_TEMP_RUN_PAGES_PER_BATCH) {
+        throw new RangeError(`Temp run page batch exceeds ${String(MAX_TEMP_RUN_PAGES_PER_BATCH)} pages`);
+    }
+    let totalBytes = 0;
+    for (const page of pages) {
+        if (!(page.bytes instanceof Uint8Array)) {
+            throw new TypeError("Temp run page bytes must be a Uint8Array");
+        }
+        if (page.bytes.byteLength > MAX_TEMP_RUN_PAGE_BYTES) {
+            throw new RangeError(`Temp run page exceeds ${String(MAX_TEMP_RUN_PAGE_BYTES)} bytes`);
+        }
+        totalBytes += page.bytes.byteLength;
+        if (!Number.isSafeInteger(totalBytes)) {
+            throw new RangeError("Temp run page batch bytes exceed the safe integer range");
+        }
+        if (totalBytes > MAX_TEMP_RUN_BATCH_BYTES) {
+            throw new RangeError(`Temp run page batch exceeds ${String(MAX_TEMP_RUN_BATCH_BYTES)} bytes`);
+        }
+    }
+}
+export const MAX_TEMP_OWNER_TTL_MS = 60 * 60 * 1_000;
 export class TempOwnerConflictError extends Error {
     ownerId;
     expectedRevision;
@@ -532,37 +1602,122 @@ export class TempOwnerConflictError extends Error {
         this.actualRevision = actualRevision;
     }
 }
+/**
+ * Bulk payload storage: immutable, opaque byte blobs keyed by structured ids.
+ *
+ * Blocks are written only through transaction staging, which creates their durable provenance
+ * in the same atomic step and rejects duplicate ids without a partial write. Ids contain `/` separators
+ * (`table/<uuid>/segment/<uuid>/part/000001`) and sort lexically; treat them as opaque keys.
+ * Reads MUST return bytes the caller may mutate freely (a fresh copy or freshly deserialized
+ * buffer), and writes MUST NOT alias the caller's buffer — the engine may reuse it.
+ *
+ * Published blocks are retired by superseding them in a commit; only the store's atomic
+ * lease-aware collection step can physically delete payloads once no reader can reach them.
+ */
+/** Maximum manifest-membership ids accepted by one storage call. */
+export const MAX_MANIFEST_BLOCK_PRESENCE_IDS = 1_024;
+/** Maximum UTF-16 code units in any opaque storage identity. */
+export const MAX_STORAGE_ID_CHARACTERS = 1_024;
+/** Maximum UTF-16 code units in a persisted catalog name. */
+export const MAX_CATALOG_NAME_CHARACTERS = 1_024;
+/** Public adapter database-name bound; names commonly become substrate keys or path segments. */
+export const MAX_STORAGE_DATABASE_NAME_CHARACTERS = 256;
+/** Maximum positional items accepted by one public bulk-read operation. */
+export const MAX_STORAGE_BULK_READ_ITEMS = 1_024;
+/** Maximum aggregate payload bytes returned by one getBlocks call. */
+export const MAX_BLOCK_READ_BATCH_BYTES = MAX_STORED_BLOCK_BYTE_LENGTH;
+export class BlockReadBatchTooLargeError extends RangeError {
+    requestedBytes;
+    limitBytes;
+    name = "BlockReadBatchTooLargeError";
+    constructor(requestedBytes, limitBytes = MAX_BLOCK_READ_BATCH_BYTES) {
+        super(`Block read batch requires ${String(requestedBytes)} bytes; limit is ${String(limitBytes)}`);
+        this.requestedBytes = requestedBytes;
+        this.limitBytes = limitBytes;
+    }
+}
+export function assertStorageBulkReadItems(items, label) {
+    if (items.length > MAX_STORAGE_BULK_READ_ITEMS) {
+        throw new RangeError(`${label} cannot exceed ${String(MAX_STORAGE_BULK_READ_ITEMS)} items`);
+    }
+}
+export function validateStorageId(value, label = "Storage ID") {
+    if (typeof value !== "string" || value.length === 0) {
+        throw new TypeError(`${label} cannot be empty`);
+    }
+    if (value.length > MAX_STORAGE_ID_CHARACTERS) {
+        throw new TypeError(`${label} exceeds ${String(MAX_STORAGE_ID_CHARACTERS)} characters`);
+    }
+    assertWellFormedString(value, label);
+    return value;
+}
+export function validateCatalogName(value, label = "Catalog name") {
+    if (typeof value !== "string" || value.trim().length === 0) {
+        throw new TypeError(`${label} cannot be empty`);
+    }
+    if (value.length > MAX_CATALOG_NAME_CHARACTERS) {
+        throw new TypeError(`${label} exceeds ${String(MAX_CATALOG_NAME_CHARACTERS)} characters`);
+    }
+    assertWellFormedString(value, label);
+    return value;
+}
+export function validateStorageDatabaseName(value) {
+    if (typeof value !== "string" || value.trim().length === 0) {
+        throw new TypeError("Storage database name cannot be empty");
+    }
+    if (value.length > MAX_STORAGE_DATABASE_NAME_CHARACTERS) {
+        throw new TypeError(`Storage database name exceeds ${String(MAX_STORAGE_DATABASE_NAME_CHARACTERS)} characters`);
+    }
+    assertWellFormedString(value, "Storage database name");
+    return value;
+}
 export function createManifest(input) {
     return {
-        version: input.expectedVersion === null ? 0 : input.expectedVersion + 1,
+        version: input.expectedVersion === null ? 0 : safeSum([input.expectedVersion, 1], "Manifest version"),
         previousVersion: input.expectedVersion,
-        blockIds: [...new Set(input.blockIds)].sort(),
-        createdAt: input.createdAt ?? new Date().toISOString(),
-        ...(input.changedTableIds === undefined ? {} : { changedTableIds: [...input.changedTableIds] }),
+        liveBlockCount: nonNegativeWholeNumber(input.liveBlockCount, "Manifest live block count"),
+        liveBlockBytes: nonNegativeWholeNumber(input.liveBlockBytes, "Manifest live block bytes"),
+        createdAt: input.createdAt ?? dateIsoString(new Date()),
+        changedTableIds: canonicalManifestChangedTableIds(input.changedTableIds),
     };
 }
-/**
- * Normalizes the additive L2 partition metadata while preserving legacy segment records verbatim.
- */
+/** Strictly clones the one canonical v1 segment shape. */
 export function normalizeSegmentRecord(record) {
-    if (record.partitionOrdinal === undefined)
+    switch (record.kind) {
+        case "insert":
+        case "upsert":
+        case "update":
+        case "delete":
+        case "base":
+            break;
+        default:
+            throw new TypeError("Segment kind is invalid");
+    }
+    const level = nonNegativeWholeNumber(record.level, "Segment level");
+    if (level > 2)
+        throw new RangeError("Segment level must be between zero and two");
+    nonNegativeFiniteNumber(record.logicalOrder, "Segment logical order");
+    nonNegativeWholeNumber(record.commitOrdinal, "Segment commit ordinal");
+    if (!Array.isArray(record.rowIdSpans)) {
+        throw new TypeError("Segment row ID spans must be an array");
+    }
+    if (record.partitionOrdinal === undefined) {
+        if (level === 2)
+            throw new TypeError("A level-two segment requires a partition ordinal");
         return structuredClone(record);
+    }
     const partitionOrdinal = nonNegativeWholeNumber(record.partitionOrdinal, "Segment partition ordinal");
     if (record.level !== 2) {
         throw new TypeError("A partitioned segment must have explicit level two");
     }
-    const kind = record.kind ?? "insert";
+    const kind = record.kind;
     if (kind !== "insert" && kind !== "base") {
         throw new TypeError("A partitioned segment must be an insert or a merged base");
     }
-    if (record.logicalOrder === undefined) {
-        throw new TypeError("A partitioned segment requires an explicit logical order");
-    }
-    nonNegativeFiniteNumber(record.logicalOrder, "Segment logical order");
     const rowCount = positiveWholeNumber(record.rowCount, "Segment row count");
     if (kind === "insert") {
         // Append-row-range partition: one contiguous positive row-ID interval, no spans.
-        if (record.rowIdSpans !== undefined) {
+        if (record.rowIdSpans.length !== 0) {
             throw new TypeError("A partitioned segment cannot contain row ID spans");
         }
         if (typeof record.rowIdStart !== "bigint" || record.rowIdStart <= 0n) {
@@ -576,7 +1731,7 @@ export function normalizeSegmentRecord(record) {
     }
     // Keyed multi-range partition: a merged full-row base whose live rows keep their original
     // ids, described by positive, sorted, non-overlapping spans that sum to the row count.
-    if (record.rowIdSpans === undefined || record.rowIdSpans.length === 0) {
+    if (record.rowIdSpans.length === 0) {
         throw new TypeError("A merged partitioned segment requires row ID spans");
     }
     let spanRows = 0;
@@ -600,20 +1755,34 @@ export function normalizeSegmentRecord(record) {
     return structuredClone({ ...record, partitionOrdinal });
 }
 export function updateTransactionRecord(record, update) {
-    return {
+    const updated = {
         ...record,
         ...(update.snapshotVersion === undefined ? {} : { snapshotVersion: update.snapshotVersion }),
         ...(update.pendingBlockIds === undefined
             ? {}
-            : { pendingBlockIds: [...new Set(update.pendingBlockIds)].sort() }),
+            : {
+                pendingBlockIds: orderedUniqueIds(update.pendingBlockIds, "Transaction pending block ID"),
+            }),
         ...(update.pendingSegmentIds === undefined
             ? {}
-            : { pendingSegmentIds: [...new Set(update.pendingSegmentIds)].sort() }),
+            : {
+                pendingSegmentIds: orderedUniqueIds(update.pendingSegmentIds, "Transaction pending segment ID"),
+            }),
         ...(update.status === undefined ? {} : { status: update.status }),
         ...(update.committedVersion === undefined ? {} : { committedVersion: update.committedVersion }),
+        ...(update.pendingTableNextRowId === undefined
+            ? {}
+            : { pendingTableNextRowId: update.pendingTableNextRowId }),
         updatedAt: update.updatedAt,
-        revision: record.revision + 1,
+        revision: safeSum([record.revision, 1], "Transaction revision"),
     };
+    if (updated.status !== "active") {
+        delete updated.pendingTable;
+        delete updated.pendingTableNextRowId;
+        delete updated.catalogEpochGuard;
+        delete updated.schemaEpochGuard;
+    }
+    return updated;
 }
 export function createGarbageCollectionJobRecord(input) {
     const candidateManifestVersions = uniqueWholeNumbers(input.candidateManifestVersions, "Garbage collection candidate manifest version");
@@ -621,12 +1790,16 @@ export function createGarbageCollectionJobRecord(input) {
     const candidateBlockIds = uniqueIds(input.candidateBlockIds, "Garbage collection candidate block ID", true);
     const candidateTransactionIds = uniqueIds(input.candidateTransactionIds ?? [], "Garbage collection candidate transaction ID", true);
     const createdAt = validTimestamp(input.createdAt, "Garbage collection creation timestamp");
-    const complete = candidateManifestVersions.length === 0 &&
+    const discovery = input.discovery === undefined
+        ? undefined
+        : normalizeGarbageCollectionDiscovery(input.discovery);
+    const complete = (discovery === undefined || discovery.phase === "complete") &&
+        candidateManifestVersions.length === 0 &&
         candidateSegmentIds.length === 0 &&
         candidateBlockIds.length === 0 &&
         candidateTransactionIds.length === 0;
     return {
-        id: nonEmptyString(input.id, "Garbage collection job ID"),
+        id: validateStorageId(input.id, "Garbage collection job ID"),
         candidateManifestVersions,
         candidateSegmentIds,
         candidateBlockIds,
@@ -651,20 +1824,169 @@ export function createGarbageCollectionJobRecord(input) {
         leaseCutoff: validTimestamp(input.leaseCutoff, "Garbage collection lease cutoff"),
         createdAt,
         updatedAt: createdAt,
+        ...(discovery === undefined ? {} : { discovery }),
+    };
+}
+export function normalizeGarbageCollectionDiscovery(discovery) {
+    const runtime = discovery;
+    if (typeof runtime !== "object" || runtime === null) {
+        throw new TypeError("Garbage collection discovery must be an object");
+    }
+    const phase = runtime.phase;
+    if (phase !== "manifests" &&
+        phase !== "manifest-blocks" &&
+        phase !== "segments" &&
+        phase !== "transactions" &&
+        phase !== "compactions" &&
+        phase !== "complete") {
+        throw new TypeError(`Invalid garbage collection discovery phase: ${String(phase)}`);
+    }
+    const stringCursor = (value, name) => value === null ? null : validateStorageId(value, name);
+    const currentManifestVersion = discovery.currentManifestVersion === null
+        ? null
+        : nonNegativeWholeNumber(discovery.currentManifestVersion, "Garbage collection discovery manifest version");
+    const manifestCursor = discovery.manifestCursor === null
+        ? null
+        : nonNegativeWholeNumber(discovery.manifestCursor, "Garbage collection manifest discovery cursor");
+    if (!Number.isSafeInteger(discovery.retainAboveVersion)) {
+        throw new RangeError("Garbage collection retained version floor must be a safe integer");
+    }
+    if (!Number.isSafeInteger(discovery.retainAfter)) {
+        throw new RangeError("Garbage collection retained timestamp floor must be a safe integer");
+    }
+    const resumePhase = runtime.resumePhase;
+    if (resumePhase !== undefined &&
+        resumePhase !== null &&
+        resumePhase !== "manifests" &&
+        resumePhase !== "manifest-blocks" &&
+        resumePhase !== "segments" &&
+        resumePhase !== "transactions" &&
+        resumePhase !== "compactions") {
+        throw new TypeError("Invalid garbage collection resume phase");
+    }
+    const postManifestPhase = runtime.postManifestPhase;
+    if (postManifestPhase !== undefined &&
+        postManifestPhase !== null &&
+        postManifestPhase !== "manifest-blocks" &&
+        postManifestPhase !== "segments" &&
+        postManifestPhase !== "transactions" &&
+        postManifestPhase !== "compactions") {
+        throw new TypeError("Invalid garbage collection post-manifest phase");
+    }
+    const artifactCursor = runtime.artifactCursor;
+    let normalizedArtifactCursor;
+    if (artifactCursor !== undefined && artifactCursor !== null) {
+        if (typeof artifactCursor !== "object") {
+            throw new TypeError("Garbage collection artifact cursor must be an object");
+        }
+        const rawArtifactCursor = artifactCursor;
+        if (rawArtifactCursor.family !== "manifest" &&
+            rawArtifactCursor.family !== "transaction" &&
+            rawArtifactCursor.family !== "compaction") {
+            throw new TypeError(`Invalid garbage collection artifact cursor family: ${String(rawArtifactCursor.family)}`);
+        }
+        normalizedArtifactCursor = {
+            family: rawArtifactCursor.family,
+            recordId: validateStorageId(rawArtifactCursor.recordId, "Garbage collection artifact cursor record ID"),
+            blockId: rawArtifactCursor.blockId === null
+                ? null
+                : validateStorageId(rawArtifactCursor.blockId, "Garbage collection artifact cursor block ID"),
+            blockIndex: nonNegativeWholeNumber(rawArtifactCursor.blockIndex, "Garbage collection artifact block cursor"),
+            segmentIndex: nonNegativeWholeNumber(rawArtifactCursor.segmentIndex, "Garbage collection artifact segment cursor"),
+        };
+    }
+    else {
+        normalizedArtifactCursor = artifactCursor;
+    }
+    return {
+        phase,
+        currentManifestVersion,
+        retainAboveVersion: discovery.retainAboveVersion,
+        retainAfter: discovery.retainAfter,
+        maxPlanningItems: boundedMaintenanceBatchItems(discovery.maxPlanningItems, "Garbage collection planning item limit"),
+        manifestCursor,
+        segmentCursor: stringCursor(discovery.segmentCursor, "Garbage collection segment discovery cursor"),
+        transactionCursor: stringCursor(discovery.transactionCursor, "Garbage collection transaction discovery cursor"),
+        compactionCursor: stringCursor(discovery.compactionCursor, "Garbage collection compaction discovery cursor"),
+        visitedRecords: nonNegativeWholeNumber(discovery.visitedRecords, "Garbage collection discovery visited records"),
+        ...(resumePhase === undefined ? {} : { resumePhase }),
+        ...(postManifestPhase === undefined ? {} : { postManifestPhase }),
+        ...(normalizedArtifactCursor === undefined ? {} : { artifactCursor: normalizedArtifactCursor }),
+    };
+}
+export function updateGarbageCollectionPlanningRecord(record, input) {
+    const current = normalizeGarbageCollectionJobRecord(record);
+    if (current.id !== input.jobId || current.revision !== input.expectedRevision) {
+        throw new GarbageCollectionJobConflictError(input.jobId, input.expectedRevision, current.id === input.jobId ? current.revision : null);
+    }
+    if (current.state !== "planned" || current.discovery?.phase === "complete") {
+        throw new TypeError("Only a discovering planned garbage collection job can be updated");
+    }
+    const appendIds = (existing, additions, label) => {
+        const normalized = uniqueIds(additions ?? [], label, true);
+        const seen = new Set(existing);
+        for (const id of normalized) {
+            if (seen.has(id))
+                throw new TypeError(`${label} is already planned: ${id}`);
+            seen.add(id);
+        }
+        return [...existing, ...normalized];
+    };
+    const candidateManifestVersions = [...current.candidateManifestVersions];
+    const manifestSet = new Set(candidateManifestVersions);
+    for (const version of uniqueWholeNumbers(input.candidateManifestVersions ?? [], "Garbage collection candidate manifest version")) {
+        if (manifestSet.has(version)) {
+            throw new TypeError(`Garbage collection manifest is already planned: ${String(version)}`);
+        }
+        manifestSet.add(version);
+        candidateManifestVersions.push(version);
+    }
+    candidateManifestVersions.sort((left, right) => left - right);
+    const candidateSegmentIds = appendIds(current.candidateSegmentIds, input.candidateSegmentIds, "Garbage collection candidate segment ID");
+    const candidateBlockIds = appendIds(current.candidateBlockIds, input.candidateBlockIds, "Garbage collection candidate block ID");
+    const candidateTransactionIds = appendIds(current.candidateTransactionIds, input.candidateTransactionIds, "Garbage collection candidate transaction ID");
+    const discovery = normalizeGarbageCollectionDiscovery(input.discovery);
+    const fixedDiscovery = current.discovery;
+    if (discovery.currentManifestVersion !== fixedDiscovery?.currentManifestVersion ||
+        discovery.retainAboveVersion !== fixedDiscovery.retainAboveVersion ||
+        discovery.retainAfter !== fixedDiscovery.retainAfter ||
+        discovery.maxPlanningItems !== fixedDiscovery.maxPlanningItems) {
+        throw new TypeError("Garbage collection discovery snapshot, retention boundary, and item limit are immutable");
+    }
+    if (candidateManifestVersions.length +
+        candidateSegmentIds.length +
+        candidateBlockIds.length +
+        candidateTransactionIds.length >
+        discovery.maxPlanningItems) {
+        throw new RangeError("Garbage collection planning candidates exceed the persisted limit");
+    }
+    const updated = {
+        ...current,
+        candidateManifestVersions,
+        candidateSegmentIds,
+        candidateBlockIds,
+        candidateTransactionIds,
+        discovery,
+        state: "planned",
+        revision: safeSum([current.revision, 1], "Garbage collection job revision"),
+        updatedAt: validTimestamp(input.updatedAt, "Garbage collection update timestamp"),
     };
+    if (garbageCollectionJobComplete(updated))
+        updated.state = "completed";
+    return normalizeGarbageCollectionJobRecord(updated);
 }
 export function normalizeGarbageCollectionJobRecord(record) {
-    const legacy = record;
     const candidateManifestVersions = uniqueWholeNumbers(record.candidateManifestVersions, "Garbage collection candidate manifest version");
     const candidateSegmentIds = uniqueIds(record.candidateSegmentIds, "Garbage collection candidate segment ID", true);
     const candidateBlockIds = uniqueIds(record.candidateBlockIds, "Garbage collection candidate block ID", true);
-    // These fields were added after durable jobs shipped. Missing values are the empty fourth
-    // phase, which lets an old planned/running job resume after an upgrade without migration.
-    const candidateTransactionIds = uniqueIds(legacy.candidateTransactionIds ?? [], "Garbage collection candidate transaction ID", true);
+    const candidateTransactionIds = uniqueIds(record.candidateTransactionIds, "Garbage collection candidate transaction ID", true);
     const cursor = normalizeGarbageCollectionCursor(record.cursor);
+    const discovery = record.discovery === undefined
+        ? undefined
+        : normalizeGarbageCollectionDiscovery(record.discovery);
     const normalized = {
         ...record,
-        id: nonEmptyString(record.id, "Garbage collection job ID"),
+        id: validateStorageId(record.id, "Garbage collection job ID"),
         candidateManifestVersions,
         candidateSegmentIds,
         candidateBlockIds,
@@ -681,15 +2003,24 @@ export function normalizeGarbageCollectionJobRecord(record) {
         retainedBlockCount: nonNegativeWholeNumber(record.retainedBlockCount, "Garbage collection retained block count"),
         missingBlockCount: nonNegativeWholeNumber(record.missingBlockCount, "Garbage collection missing block count"),
         reclaimedBlockBytes: nonNegativeWholeNumber(record.reclaimedBlockBytes, "Garbage collection reclaimed block bytes"),
-        reclaimedTransactionCount: nonNegativeWholeNumber(legacy.reclaimedTransactionCount ?? 0, "Garbage collection reclaimed transaction count"),
-        retainedTransactionCount: nonNegativeWholeNumber(legacy.retainedTransactionCount ?? 0, "Garbage collection retained transaction count"),
-        missingTransactionCount: nonNegativeWholeNumber(legacy.missingTransactionCount ?? 0, "Garbage collection missing transaction count"),
+        reclaimedTransactionCount: nonNegativeWholeNumber(record.reclaimedTransactionCount, "Garbage collection reclaimed transaction count"),
+        retainedTransactionCount: nonNegativeWholeNumber(record.retainedTransactionCount, "Garbage collection retained transaction count"),
+        missingTransactionCount: nonNegativeWholeNumber(record.missingTransactionCount, "Garbage collection missing transaction count"),
         state: garbageCollectionJobState(record.state),
         revision: nonNegativeWholeNumber(record.revision, "Garbage collection job revision"),
         leaseCutoff: validTimestamp(record.leaseCutoff, "Garbage collection lease cutoff"),
         createdAt: validTimestamp(record.createdAt, "Garbage collection creation timestamp"),
         updatedAt: validTimestamp(record.updatedAt, "Garbage collection update timestamp"),
+        ...(discovery === undefined ? {} : { discovery }),
     };
+    if (discovery !== undefined &&
+        candidateManifestVersions.length +
+            candidateSegmentIds.length +
+            candidateBlockIds.length +
+            candidateTransactionIds.length >
+            discovery.maxPlanningItems) {
+        throw new RangeError("Garbage collection planning candidates exceed the persisted limit");
+    }
     if (safeSum([
         normalized.prunedManifestCount,
         normalized.alreadyPrunedManifestCount,
@@ -732,6 +2063,9 @@ export function normalizeGarbageCollectionJobRecord(record) {
 }
 export function advanceGarbageCollectionJobRecord(record, accounting) {
     const current = normalizeGarbageCollectionJobRecord(record);
+    if (current.discovery !== undefined && current.discovery.phase !== "complete") {
+        throw new TypeError("Garbage collection discovery must complete before reclamation starts");
+    }
     if (current.state === "completed")
         return current;
     const increments = {
@@ -805,7 +2139,7 @@ export function advanceGarbageCollectionJobRecord(record, accounting) {
         retainedTransactionCount: safeSum([current.retainedTransactionCount, increments.retainedTransactionCount], "Garbage collection retained transaction count"),
         missingTransactionCount: safeSum([current.missingTransactionCount, increments.missingTransactionCount], "Garbage collection missing transaction count"),
         state: "running",
-        revision: current.revision + 1,
+        revision: safeSum([current.revision, 1], "Garbage collection revision"),
         updatedAt: validTimestamp(accounting.updatedAt, "Garbage collection update timestamp"),
     };
     if (garbageCollectionJobComplete(updated))
@@ -821,22 +2155,14 @@ export function normalizeCompactionJobRecord(record) {
     const logicalBytes = nonNegativeWholeNumber(record.logicalBytes, "Compaction logical bytes");
     const sourceStoredBytes = nonNegativeWholeNumber(record.sourceStoredBytes, "Compaction source stored bytes");
     const outputStoredBytes = nonNegativeWholeNumber(record.outputStoredBytes, "Compaction output stored bytes");
-    const hasLevel0SourceStoredBytes = record.level0SourceStoredBytes !== undefined;
-    const hasAnchorSourceStoredBytes = record.anchorSourceStoredBytes !== undefined;
-    if (hasLevel0SourceStoredBytes !== hasAnchorSourceStoredBytes) {
-        throw new TypeError("Compaction source-level byte accounting requires both stored byte fields");
-    }
-    const sourceLevelStoredBytes = hasLevel0SourceStoredBytes
-        ? {
-            level0SourceStoredBytes: positiveWholeNumber(record.level0SourceStoredBytes, "Compaction level-zero source stored bytes"),
-            anchorSourceStoredBytes: nonNegativeWholeNumber(record.anchorSourceStoredBytes, "Compaction anchor source stored bytes"),
-        }
-        : undefined;
-    if (sourceLevelStoredBytes !== undefined &&
-        safeSum([
-            sourceLevelStoredBytes.level0SourceStoredBytes,
-            sourceLevelStoredBytes.anchorSourceStoredBytes,
-        ], "Compaction source-level stored bytes") !== sourceStoredBytes) {
+    const sourceLevelStoredBytes = {
+        level0SourceStoredBytes: nonNegativeWholeNumber(record.level0SourceStoredBytes, "Compaction level-zero source stored bytes"),
+        anchorSourceStoredBytes: nonNegativeWholeNumber(record.anchorSourceStoredBytes, "Compaction anchor source stored bytes"),
+    };
+    if (safeSum([
+        sourceLevelStoredBytes.level0SourceStoredBytes,
+        sourceLevelStoredBytes.anchorSourceStoredBytes,
+    ], "Compaction source-level stored bytes") !== sourceStoredBytes) {
         throw new TypeError("Compaction source-level stored bytes must equal source stored bytes");
     }
     const level2PolicyValues = [
@@ -863,13 +2189,10 @@ export function normalizeCompactionJobRecord(record) {
         // Append-row-range promotions consume pure level-zero prefixes; keyed merge promotions may
         // also fold a retained level-one anchor, whose bytes never count toward the L0 ceiling.
         if (rewritePlan.kind === "rechunk-v1" &&
-            (sourceLevelStoredBytes?.level0SourceStoredBytes !== sourceStoredBytes ||
+            (sourceLevelStoredBytes.level0SourceStoredBytes !== sourceStoredBytes ||
                 sourceLevelStoredBytes.anchorSourceStoredBytes !== 0)) {
             throw new TypeError("Append-row-range L2 compaction requires only level-zero source bytes");
         }
-        if (rewritePlan.kind === "merge-v1" && sourceLevelStoredBytes === undefined) {
-            throw new TypeError("Keyed L2 compaction requires source-level byte accounting");
-        }
         const outputPartitionOrdinal = nonNegativeWholeNumber(record.outputPartitionOrdinal, "Compaction output partition ordinal");
         const maxWriteAmplification = positiveFiniteNumber(record.maxWriteAmplification, "Compaction maximum write amplification");
         const maximumOutputStoredBytes = positiveWholeNumber(record.maximumOutputStoredBytes, "Compaction maximum output stored bytes");
@@ -899,8 +2222,8 @@ export function normalizeCompactionJobRecord(record) {
     }
     const normalized = {
         ...record,
-        id: nonEmptyString(record.id, "Compaction job ID"),
-        tableId: nonEmptyString(record.tableId, "Compaction job table ID"),
+        id: validateStorageId(record.id, "Compaction job ID"),
+        tableId: validateStorageId(record.tableId, "Compaction job table ID"),
         sourceManifestVersion: nonNegativeWholeNumber(record.sourceManifestVersion, "Compaction source manifest version"),
         sourceSegmentIds: rewritePlan.kind === "copy-v1"
             ? uniqueIds(record.sourceSegmentIds, "Compaction source segment ID", false)
@@ -918,12 +2241,12 @@ export function normalizeCompactionJobRecord(record) {
         logicalBytes,
         rewritePlan,
         outputCursor: normalizeCompactionOutputCursor(record.outputCursor, rewritePlan),
-        memoryBudgetBytes: nonNegativeWholeNumber(record.memoryBudgetBytes ?? 0, "Compaction memory budget"),
-        minimumMemoryBytes: nonNegativeWholeNumber(record.minimumMemoryBytes ?? 0, "Compaction minimum memory"),
-        ...(sourceLevelStoredBytes ?? {}),
+        memoryBudgetBytes: nonNegativeWholeNumber(record.memoryBudgetBytes, "Compaction memory budget"),
+        minimumMemoryBytes: nonNegativeWholeNumber(record.minimumMemoryBytes, "Compaction minimum memory"),
+        ...sourceLevelStoredBytes,
         ...(level2Policy ?? {}),
-        peakWorkingBytes: nonNegativeWholeNumber(record.peakWorkingBytes ?? 0, "Compaction peak working bytes"),
-        outputLogicalBytes: nonNegativeWholeNumber(record.outputLogicalBytes ?? (rewritePlan.kind === "copy-v1" ? logicalBytes : 0), "Compaction output logical bytes"),
+        peakWorkingBytes: nonNegativeWholeNumber(record.peakWorkingBytes, "Compaction peak working bytes"),
+        outputLogicalBytes: nonNegativeWholeNumber(record.outputLogicalBytes, "Compaction output logical bytes"),
         targetLevel: nonNegativeWholeNumber(record.targetLevel, "Compaction target level"),
         state: compactionJobState(record.state),
         transactionId: nullableId(record.transactionId, "Compaction transaction ID"),
@@ -974,7 +2297,7 @@ export function updateCompactionJobRecord(record, update) {
             }
         }
     }
-    const mirrorCopyLogicalBytes = current.rewritePlan?.kind === "copy-v1" &&
+    const mirrorCopyLogicalBytes = current.rewritePlan.kind === "copy-v1" &&
         update.logicalBytes !== undefined &&
         update.outputLogicalBytes === undefined;
     const updated = {
@@ -1001,7 +2324,7 @@ export function updateCompactionJobRecord(record, update) {
         ...(update.outputSegmentId === undefined ? {} : { outputSegmentId: update.outputSegmentId }),
         ...(update.publishedVersion === undefined ? {} : { publishedVersion: update.publishedVersion }),
         updatedAt: update.updatedAt,
-        revision: current.revision + 1,
+        revision: safeSum([current.revision, 1], "Compaction revision"),
     };
     if (update.error === null)
         delete updated.error;
@@ -1013,7 +2336,7 @@ export function updateCompactionJobRecord(record, update) {
     return normalized;
 }
 function validateCompactionJobState(record) {
-    const plan = record.rewritePlan ?? { kind: "copy-v1" };
+    const plan = record.rewritePlan;
     if (plan.kind === "merge-v1") {
         if (plan.totalRows === 0 && record.outputSegmentId !== null) {
             throw new TypeError("An empty merge compaction cannot have an output segment");
@@ -1026,7 +2349,7 @@ function validateCompactionJobState(record) {
         throw new TypeError("A cancelled compaction cannot contain an error");
     }
     if (record.state === "planned") {
-        const isCopy = record.rewritePlan?.kind === "copy-v1";
+        const isCopy = record.rewritePlan.kind === "copy-v1";
         const hasProgress = record.cursor.sourceSegmentIndex !== 0 ||
             record.cursor.sourceBlockIndex !== 0 ||
             record.outputBlockIds.length !== 0 ||
@@ -1056,7 +2379,7 @@ function validateCompactionJobState(record) {
         }
         if (isOutputDrivenCompactionPlan(record.rewritePlan) &&
             expectedCompactionOutputCount(record) > 0 &&
-            (record.peakWorkingBytes ?? 0) < (record.minimumMemoryBytes ?? 0)) {
+            record.peakWorkingBytes < record.minimumMemoryBytes) {
             throw new TypeError(`${record.state} compaction requires complete memory accounting`);
         }
     }
@@ -1070,11 +2393,11 @@ function validateCompactionJobState(record) {
     }
 }
 function validateCompactionRewrite(record) {
-    const plan = record.rewritePlan ?? { kind: "copy-v1" };
-    const outputLogicalBytes = record.outputLogicalBytes ?? 0;
-    const memoryBudgetBytes = record.memoryBudgetBytes ?? 0;
-    const minimumMemoryBytes = record.minimumMemoryBytes ?? 0;
-    const peakWorkingBytes = record.peakWorkingBytes ?? 0;
+    const plan = record.rewritePlan;
+    const outputLogicalBytes = record.outputLogicalBytes;
+    const memoryBudgetBytes = record.memoryBudgetBytes;
+    const minimumMemoryBytes = record.minimumMemoryBytes;
+    const peakWorkingBytes = record.peakWorkingBytes;
     if (plan.kind === "copy-v1") {
         if (record.outputCursor !== null) {
             throw new TypeError("A copy compaction cannot have an output cursor");
@@ -1139,7 +2462,7 @@ function validateCompactionRewrite(record) {
         }
     }
     const cursor = record.outputCursor;
-    if (cursor === null || cursor === undefined) {
+    if (cursor === null) {
         throw new TypeError("An output-driven compaction requires an output cursor");
     }
     const completedOutputs = safeSum([
@@ -1162,8 +2485,8 @@ function validateCompactionJobProgress(previous, next) {
         ["source stored bytes", previous.sourceStoredBytes, next.sourceStoredBytes],
         ["output stored bytes", previous.outputStoredBytes, next.outputStoredBytes],
         ["logical bytes", previous.logicalBytes, next.logicalBytes],
-        ["output logical bytes", previous.outputLogicalBytes ?? 0, next.outputLogicalBytes ?? 0],
-        ["peak working bytes", previous.peakWorkingBytes ?? 0, next.peakWorkingBytes ?? 0],
+        ["output logical bytes", previous.outputLogicalBytes, next.outputLogicalBytes],
+        ["peak working bytes", previous.peakWorkingBytes, next.peakWorkingBytes],
     ]) {
         if (nextValue < previousValue) {
             throw new RangeError(`Compaction ${label} cannot decrease`);
@@ -1199,7 +2522,7 @@ function validateCompactionJobProgress(previous, next) {
     }
 }
 function isInitialOutputCursor(record) {
-    const plan = record.rewritePlan ?? { kind: "copy-v1" };
+    const plan = record.rewritePlan;
     if (plan.kind === "copy-v1")
         return record.outputCursor === null;
     const cursor = record.outputCursor;
@@ -1207,7 +2530,7 @@ function isInitialOutputCursor(record) {
     return (cursor?.outputIndex === 0 && cursor.columnIndex === 0 && cursor.rowStart === initialRowStart);
 }
 function hasCompletedCompactionCursor(record) {
-    const plan = record.rewritePlan ?? { kind: "copy-v1" };
+    const plan = record.rewritePlan;
     if (plan.kind === "copy-v1") {
         return record.cursor.sourceSegmentIndex === record.sourceSegmentIds.length;
     }
@@ -1217,7 +2540,7 @@ function hasCompletedCompactionCursor(record) {
         cursor.rowStart === plan.totalRows);
 }
 function expectedCompactionOutputCount(record) {
-    const plan = record.rewritePlan ?? { kind: "copy-v1" };
+    const plan = record.rewritePlan;
     return plan.kind === "copy-v1"
         ? record.sourceBlockIds.length
         : safeProduct(plan.outputs.length, plan.columns.length, "Rechunk output block count");
@@ -1225,7 +2548,7 @@ function expectedCompactionOutputCount(record) {
 function compactionOutputOrdinal(record) {
     const plan = record.rewritePlan;
     const cursor = record.outputCursor;
-    if (!isOutputDrivenCompactionPlan(plan) || cursor === null || cursor === undefined)
+    if (!isOutputDrivenCompactionPlan(plan) || cursor === null)
         return 0;
     return safeSum([
         safeProduct(cursor.outputIndex, plan.columns.length, "Rechunk output cursor"),
@@ -1233,7 +2556,7 @@ function compactionOutputOrdinal(record) {
     ], "Rechunk output cursor");
 }
 function isOutputDrivenCompactionPlan(plan) {
-    return plan?.kind === "rechunk-v1" || plan?.kind === "merge-v1";
+    return plan.kind === "rechunk-v1" || plan.kind === "merge-v1";
 }
 function validateCompactionJobTransition(previous, next) {
     const allowed = {
@@ -1258,8 +2581,6 @@ function normalizeCompactionJobCursor(value) {
     };
 }
 function normalizeCompactionRewritePlan(value) {
-    if (value === undefined)
-        return { kind: "copy-v1" };
     if (typeof value !== "object" || value === null) {
         throw new TypeError("Compaction rewrite plan must be an object");
     }
@@ -1296,7 +2617,7 @@ function normalizeCompactionRewritePlan(value) {
         }
         return {
             rowStart: nonNegativeWholeNumber(Reflect.get(output, "rowStart"), `Rechunk output window ${String(index)} row start`),
-            rowCount: positiveUint32(Reflect.get(output, "rowCount"), `Rechunk output window ${String(index)} row count`),
+            rowCount: blockRowCount(Reflect.get(output, "rowCount"), `Rechunk output window ${String(index)} row count`),
         };
     });
     validateContiguousRows(outputs, totalRows, "Rechunk output windows");
@@ -1330,9 +2651,9 @@ function normalizeRechunkSourceColumn(value, totalRows, columnIndex) {
             throw new TypeError(`Rechunk source block ${String(columnIndex)}:${String(blockIndex)} must be an object`);
         }
         return {
-            blockId: nonEmptyString(Reflect.get(block, "blockId"), `Rechunk source block ${String(columnIndex)}:${String(blockIndex)} ID`),
+            blockId: validateStorageId(Reflect.get(block, "blockId"), `Rechunk source block ${String(columnIndex)}:${String(blockIndex)} ID`),
             rowStart: nonNegativeWholeNumber(Reflect.get(block, "rowStart"), `Rechunk source block ${String(columnIndex)}:${String(blockIndex)} row start`),
-            rowCount: positiveUint32(Reflect.get(block, "rowCount"), `Rechunk source block ${String(columnIndex)}:${String(blockIndex)} row count`),
+            rowCount: blockRowCount(Reflect.get(block, "rowCount"), `Rechunk source block ${String(columnIndex)}:${String(blockIndex)} row count`),
             storedBytes: positiveWholeNumber(Reflect.get(block, "storedBytes"), `Rechunk source block ${String(columnIndex)}:${String(blockIndex)} stored bytes`),
             encodedBytes: nonNegativeWholeNumber(Reflect.get(block, "encodedBytes"), `Rechunk source block ${String(columnIndex)}:${String(blockIndex)} encoded bytes`),
             checksum: uint32(Reflect.get(block, "checksum"), `Rechunk source block ${String(columnIndex)}:${String(blockIndex)} checksum`),
@@ -1340,7 +2661,7 @@ function normalizeRechunkSourceColumn(value, totalRows, columnIndex) {
     });
     validateContiguousRows(sourceBlocks, totalRows, `Rechunk source column ${String(columnIndex)} blocks`);
     return {
-        columnId: nonEmptyString(Reflect.get(value, "columnId"), `Rechunk source column ${String(columnIndex)} ID`),
+        columnId: validateStorageId(Reflect.get(value, "columnId"), `Rechunk source column ${String(columnIndex)} ID`),
         type: simpleDataType(Reflect.get(value, "type")),
         sourceBlocks,
     };
@@ -1350,7 +2671,7 @@ function normalizeMergeCompactionRewritePlan(value) {
     const rowIdStart = nonNegativeBigInt(Reflect.get(value, "rowIdStart"), "Merge row ID start");
     const rowIdEndExclusive = nonNegativeBigInt(Reflect.get(value, "rowIdEndExclusive"), "Merge row ID end");
     const rowIdSpans = normalizeRowIdSpans(Reflect.get(value, "rowIdSpans"), totalRows, rowIdStart, rowIdEndExclusive, "Merge output row ID spans");
-    const keyColumnId = nonEmptyString(Reflect.get(value, "keyColumnId"), "Merge key column ID");
+    const keyColumnId = validateStorageId(Reflect.get(value, "keyColumnId"), "Merge key column ID");
     const sourceSegmentsValue = Reflect.get(value, "sourceSegments");
     if (!Array.isArray(sourceSegmentsValue) || sourceSegmentsValue.length === 0) {
         throw new TypeError("A merge plan requires at least one source segment");
@@ -1409,7 +2730,7 @@ function normalizeMergeCompactionRewritePlan(value) {
         }
         return {
             rowStart: nonNegativeWholeNumber(Reflect.get(output, "rowStart"), `Merge output window ${String(index)} row start`),
-            rowCount: positiveUint32(Reflect.get(output, "rowCount"), `Merge output window ${String(index)} row count`),
+            rowCount: blockRowCount(Reflect.get(output, "rowCount"), `Merge output window ${String(index)} row count`),
         };
     });
     validateContiguousRows(outputs, totalRows, "Merge output windows");
@@ -1516,8 +2837,8 @@ function normalizeMergeSourceSegment(value, segmentIndex) {
         throw new TypeError(`${label} cannot contain duplicate source columns`);
     }
     return {
-        segmentId: nonEmptyString(Reflect.get(value, "segmentId"), `${label} ID`),
-        transactionId: nonEmptyString(Reflect.get(value, "transactionId"), `${label} transaction ID`),
+        segmentId: validateStorageId(Reflect.get(value, "segmentId"), `${label} ID`),
+        transactionId: validateStorageId(Reflect.get(value, "transactionId"), `${label} transaction ID`),
         committedVersion: nonNegativeWholeNumber(Reflect.get(value, "committedVersion"), `${label} committed version`),
         kind,
         keyColumnId: nullableId(Reflect.get(value, "keyColumnId"), `${label} key column ID`),
@@ -1544,9 +2865,9 @@ function normalizeMergeSourceColumn(value, segmentRowCount, segmentIndex, column
             throw new TypeError(`${label} block ${String(blockIndex)} must be an object`);
         }
         return {
-            blockId: nonEmptyString(Reflect.get(block, "blockId"), `${label} block ID`),
+            blockId: validateStorageId(Reflect.get(block, "blockId"), `${label} block ID`),
             rowStart: nonNegativeWholeNumber(Reflect.get(block, "rowStart"), `${label} block row start`),
-            rowCount: positiveUint32(Reflect.get(block, "rowCount"), `${label} block row count`),
+            rowCount: blockRowCount(Reflect.get(block, "rowCount"), `${label} block row count`),
             storedBytes: positiveWholeNumber(Reflect.get(block, "storedBytes"), `${label} block stored bytes`),
             encodedBytes: nonNegativeWholeNumber(Reflect.get(block, "encodedBytes"), `${label} block encoded bytes`),
             checksum: uint32(Reflect.get(block, "checksum"), `${label} block checksum`),
@@ -1554,7 +2875,7 @@ function normalizeMergeSourceColumn(value, segmentRowCount, segmentIndex, column
     });
     validateContiguousRows(sourceBlocks, segmentRowCount, `${label} blocks`);
     return {
-        columnId: nonEmptyString(Reflect.get(value, "columnId"), `${label} ID`),
+        columnId: validateStorageId(Reflect.get(value, "columnId"), `${label} ID`),
         type: simpleDataType(Reflect.get(value, "type")),
         sourceBlocks,
     };
@@ -1564,7 +2885,7 @@ function normalizeMergeOutputColumn(value, totalRows, sourceBlocks, columnIndex)
     if (typeof value !== "object" || value === null) {
         throw new TypeError(`${label} must be an object`);
     }
-    const columnId = nonEmptyString(Reflect.get(value, "columnId"), `${label} ID`);
+    const columnId = validateStorageId(Reflect.get(value, "columnId"), `${label} ID`);
     const type = simpleDataType(Reflect.get(value, "type"));
     const rangesValue = Reflect.get(value, "sourceRanges");
     if (!Array.isArray(rangesValue))
@@ -1575,9 +2896,9 @@ function normalizeMergeOutputColumn(value, totalRows, sourceBlocks, columnIndex)
         }
         const normalized = {
             outputRowStart: nonNegativeWholeNumber(Reflect.get(range, "outputRowStart"), `${label} source range output row start`),
-            sourceBlockId: nonEmptyString(Reflect.get(range, "sourceBlockId"), `${label} source range block ID`),
+            sourceBlockId: validateStorageId(Reflect.get(range, "sourceBlockId"), `${label} source range block ID`),
             sourceRowStart: nonNegativeWholeNumber(Reflect.get(range, "sourceRowStart"), `${label} source range block row start`),
-            rowCount: positiveUint32(Reflect.get(range, "rowCount"), `${label} source range row count`),
+            rowCount: blockRowCount(Reflect.get(range, "rowCount"), `${label} source range row count`),
         };
         const source = sourceBlocks.get(normalized.sourceBlockId);
         if (source === undefined)
@@ -1703,16 +3024,13 @@ function compareMergeSourceSegments(left, right) {
 }
 function normalizeCompactionOutputCursor(value, plan) {
     if (plan.kind === "copy-v1") {
-        if (value !== undefined && value !== null) {
+        if (value !== null) {
             throw new TypeError("A copy compaction cannot have an output cursor");
         }
         return null;
     }
     if (value === undefined) {
-        if (plan.kind === "merge-v1") {
-            throw new TypeError("A merge compaction requires an explicit output cursor");
-        }
-        return { outputIndex: 0, columnIndex: 0, rowStart: plan.outputs[0]?.rowStart ?? 0 };
+        throw new TypeError("An output-driven compaction requires an explicit output cursor");
     }
     if (typeof value !== "object" || value === null) {
         throw new TypeError("Rechunk output cursor must be an object");
@@ -1793,11 +3111,12 @@ function normalizeGarbageCollectionCursor(value) {
         manifestIndex: nonNegativeWholeNumber(Reflect.get(value, "manifestIndex"), "Garbage collection manifest cursor"),
         segmentIndex: nonNegativeWholeNumber(Reflect.get(value, "segmentIndex"), "Garbage collection segment cursor"),
         blockIndex: nonNegativeWholeNumber(Reflect.get(value, "blockIndex"), "Garbage collection block cursor"),
-        transactionIndex: nonNegativeWholeNumber(Reflect.get(value, "transactionIndex") ?? 0, "Garbage collection transaction cursor"),
+        transactionIndex: nonNegativeWholeNumber(Reflect.get(value, "transactionIndex"), "Garbage collection transaction cursor"),
     };
 }
 function garbageCollectionJobComplete(record) {
-    return (record.cursor.manifestIndex === record.candidateManifestVersions.length &&
+    return ((record.discovery === undefined || record.discovery.phase === "complete") &&
+        record.cursor.manifestIndex === record.candidateManifestVersions.length &&
         record.cursor.segmentIndex === record.candidateSegmentIds.length &&
         record.cursor.blockIndex === record.candidateBlockIds.length &&
         record.cursor.transactionIndex === record.candidateTransactionIds.length);
@@ -1805,13 +3124,13 @@ function garbageCollectionJobComplete(record) {
 function uniqueIds(ids, label, sort) {
     if (!Array.isArray(ids))
         throw new TypeError(`${label}s must be an array`);
-    const unique = [...new Set(ids.map((id) => nonEmptyString(id, label)))];
+    const unique = [...new Set(ids.map((id) => validateStorageId(id, label)))];
     return sort ? unique.sort() : unique;
 }
 function orderedUniqueIds(ids, label) {
     if (!Array.isArray(ids))
         throw new TypeError(`${label}s must be an array`);
-    const normalized = ids.map((id) => nonEmptyString(id, label));
+    const normalized = ids.map((id) => validateStorageId(id, label));
     if (new Set(normalized).size !== normalized.length) {
         throw new TypeError(`${label}s cannot contain duplicates`);
     }
@@ -1823,7 +3142,7 @@ function uniqueWholeNumbers(values, label) {
     return [...new Set(values.map((value) => nonNegativeWholeNumber(value, label)))].sort((left, right) => left - right);
 }
 function nullableId(id, label) {
-    return id === null ? null : nonEmptyString(id, label);
+    return id === null ? null : validateStorageId(id, label);
 }
 function nonEmptyString(value, label) {
     if (typeof value !== "string" || value.length === 0) {
@@ -1833,8 +3152,16 @@ function nonEmptyString(value, label) {
 }
 function validTimestamp(value, label) {
     const timestamp = nonEmptyString(value, label);
-    if (!Number.isFinite(Date.parse(timestamp)))
-        throw new TypeError(`${label} must be valid`);
+    // Storage timestamps are internal coordination metadata, not SQL date values. Keeping the
+    // canonical v1 form fixed at 24 UTF-8 bytes makes byte reservations exact (notably the
+    // manifest-pruning tombstone) and avoids engine-dependent Date.parse spellings.
+    if (!/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/u.test(timestamp)) {
+        throw new TypeError(`${label} must be canonical UTC ISO-8601`);
+    }
+    const milliseconds = Date.parse(timestamp);
+    if (!Number.isFinite(milliseconds) || dateIsoString(new Date(milliseconds)) !== timestamp) {
+        throw new TypeError(`${label} must be canonical UTC ISO-8601`);
+    }
     return timestamp;
 }
 function nonNegativeWholeNumber(value, label) {
@@ -1879,6 +3206,13 @@ function positiveUint32(value, label) {
         throw new RangeError(`${label} must be positive`);
     return normalized;
 }
+function blockRowCount(value, label) {
+    const normalized = positiveUint32(value, label);
+    if (normalized > MAX_BLOCK_ROW_COUNT) {
+        throw new RangeError(`${label} exceeds the block format row limit`);
+    }
+    return normalized;
+}
 function safeSum(values, label) {
     let total = 0;
     for (const value of values) {
@@ -1918,4 +3252,3 @@ export function floorWholeNumberProduct(left, right, label) {
     }
     return Number(product);
 }
-//# sourceMappingURL=types.js.map