@minnowdb/core 0.3.0 → 0.4.0

package/dist/transactions/index.js

@@ -1,4 +1,7 @@
-import { GarbageCollectionJobConflictError, LeaseConflictError, SnapshotManifestMissingError, TransactionRecordConflictError, WriteConflictError, } from "../storage/index.js";
+import { dateIsoString, dateMilliseconds } from "../date-value.js";
+import { assertTransactionArtifactBatchLimits, assertTransactionArtifactJournalLimits, GarbageCollectionJobConflictError, LeaseConflictError, LeaseExpiredError, MAX_LEVEL_ZERO_SEGMENTS, MAX_MANIFEST_BLOCK_PRESENCE_IDS, MAX_LEASE_TTL_MS, MAX_TRANSACTION_STAGE_BLOCKS, MAX_TRANSACTION_STAGE_BYTES, MAX_TRANSACTION_STAGE_SEGMENTS, MAX_TRANSACTION_COMMIT_DELTA_BYTES, MAX_TRANSACTION_COMMIT_DELTA_ENTRIES, transactionCommitDeltaRetainedBytes, SnapshotManifestMissingError, TransactionRecordConflictError, WriteConflictError, } from "../storage/types.js";
+export const DEFAULT_TRANSACTION_TTL_MS = 30_000;
+export { MAX_LEASE_TTL_MS };
 export class TransactionClosedError extends Error {
     transactionId;
     name = "TransactionClosedError";
@@ -10,30 +13,30 @@ export class TransactionClosedError extends Error {
 export class Snapshot {
     store;
     version;
-    #blockIds;
-    constructor(store, version, blockIds) {
+    constructor(store, version) {
         this.store = store;
         this.version = version;
-        this.#blockIds = new Set(blockIds);
     }
-    listBlockIds() {
-        return [...this.#blockIds].sort();
+    async hasBlock(id) {
+        return (await this.store.hasManifestBlocks(this.version, [id]))[0] === true;
     }
-    hasBlock(id) {
-        return this.#blockIds.has(id);
+    async hasBlocks(ids) {
+        const present = [];
+        for (let start = 0; start < ids.length; start += MAX_MANIFEST_BLOCK_PRESENCE_IDS) {
+            present.push(...(await this.store.hasManifestBlocks(this.version, ids.slice(start, start + MAX_MANIFEST_BLOCK_PRESENCE_IDS))));
+        }
+        return present;
     }
     async getBlock(id) {
-        if (!this.#blockIds.has(id))
-            return undefined;
-        return this.store.getBlock(id);
+        return this.store.readManifestBlock(this.version, id);
     }
 }
 export class LeasedSnapshot extends Snapshot {
     now;
     #record;
     #released = false;
-    constructor(store, version, blockIds, record, now) {
-        super(store, version, blockIds);
+    constructor(store, version, record, now) {
+        super(store, version);
         this.now = now;
         this.#record = structuredClone(record);
         this.#store = store;
@@ -51,9 +54,14 @@ export class LeasedSnapshot extends Snapshot {
     }
     async renew(ttlMs) {
         this.#assertOpen();
-        validateTtl(ttlMs);
-        const expiresAt = new Date(this.now().getTime() + ttlMs).toISOString();
-        this.#record = await this.#store.renewLease(this.#record.id, this.#record.revision, expiresAt);
+        const now = this.now();
+        const expiresAt = expiryAfter(now, ttlMs);
+        this.#record = await this.#store.renewLease({
+            id: this.#record.id,
+            expectedRevision: this.#record.revision,
+            expiresAtCutoff: dateIsoString(now),
+            expiresAt,
+        });
         return new Date(this.#record.expiresAt);
     }
     /**
@@ -63,24 +71,27 @@ export class LeasedSnapshot extends Snapshot {
      * (`SnapshotManifestMissingError`, `LeaseConflictError`) leave this snapshot open and pass
      * through.
      */
-    async moveTo(version, ttlMs, knownBlockIds) {
+    async moveTo(version, ttlMs) {
         this.#assertOpen();
-        validateTtl(ttlMs);
         const move = this.#store.moveLease?.bind(this.#store);
         if (move === undefined)
             return undefined;
-        const target = knownBlockIds === undefined
-            ? await loadSnapshot(this.#store, version)
-            : new Snapshot(this.#store, version, knownBlockIds);
-        const expiresAt = new Date(this.now().getTime() + ttlMs).toISOString();
-        const record = await move(this.#record.id, this.#record.revision, version, expiresAt);
+        const now = this.now();
+        const expiresAt = expiryAfter(now, ttlMs);
+        const record = await move({
+            id: this.#record.id,
+            expectedRevision: this.#record.revision,
+            manifestVersion: version,
+            expiresAtCutoff: dateIsoString(now),
+            expiresAt,
+        });
         this.#released = true;
-        return new LeasedSnapshot(this.#store, version, target.listBlockIds(), record, this.now);
+        return new LeasedSnapshot(this.#store, version, record, this.now);
     }
     async release() {
         if (this.#released)
             return;
-        await this.#store.removeLease(this.#record.id);
+        await this.#store.removeLease({ id: this.#record.id, ownerId: this.#record.ownerId });
         this.#released = true;
     }
     /** Closes this snapshot without touching the store — for a lease the store no longer holds. */
@@ -95,12 +106,27 @@ export class LeasedSnapshot extends Snapshot {
 export class DatabaseTransaction {
     store;
     now;
+    ttlMs;
     #record;
     #uniqueKeyChanges = [];
-    #ftsChanges = [];
-    #supersededBlockIds = new Set();
+    #ftsChanges = new Map();
+    #commitDeltaBytes = 0;
+    #commitDeltaEntries = 0;
+    #compactionJobId = null;
+    #compactionSourceBlockIds = new Set();
     #changedTableIds = new Set();
+    #levelZeroSegmentLimits = new Map();
     #logicallyUnchanged = false;
+    /**
+     * One storage-sized artifact batch may stay process-local until commit. This lets the common
+     * one-statement transaction use the store's atomic writeTransaction operation instead of
+     * staging a durable journal and committing it in a second adapter transaction. A second batch
+     * flushes this one first, so retained bytes remain bounded by the storage batch limits.
+     */
+    #deferredBlocks = [];
+    #deferredSegments = [];
+    /** Segment metadata retained for local post-commit catalog-cache advancement. */
+    #knownSegments = new Map();
     /**
      * Whether the record exists in the store. A deferred transaction (`beginDeferred`) starts
      * without one: it is written on the first two-step staging call, or folded into the
@@ -108,11 +134,33 @@ export class DatabaseTransaction {
      * touches nothing.
      */
     #persisted;
-    constructor(store, record, now, options = {}) {
+    /** Durable pin for a deferred transaction that has no transaction record yet. */
+    #snapshotLease;
+    /** Serializes revisioned operations against the one lease record. */
+    #snapshotLeaseOperation = Promise.resolve();
+    #snapshotRenewal;
+    #heartbeatTimer;
+    #renewal;
+    #initialCatalogProbe;
+    constructor(store, record, now, ttlMs, createWeakRef, options = {}) {
         this.store = store;
         this.now = now;
+        this.ttlMs = ttlMs;
         this.#record = structuredClone(record);
         this.#persisted = options.persisted ?? true;
+        this.#initialCatalogProbe = options.initialCatalogProbe;
+        this.#snapshotLease = options.snapshotLease;
+        const reference = createWeakRef(this);
+        const timer = setInterval(() => {
+            const transaction = reference.deref();
+            if (transaction === undefined) {
+                clearInterval(timer);
+                return;
+            }
+            void transaction.#renewOwnership(true).catch(() => undefined);
+        }, Math.max(1, Math.floor(ttlMs / 3)));
+        timer.unref?.();
+        this.#heartbeatTimer = timer;
     }
     get id() {
         return this.#record.id;
@@ -124,13 +172,43 @@ export class DatabaseTransaction {
         return this.#record.snapshotVersion;
     }
     get pendingBlockIds() {
-        return [...this.#record.pendingBlockIds];
+        return [...this.#record.pendingBlockIds, ...this.#deferredBlocks.map((block) => block.id)];
     }
     get pendingSegmentIds() {
-        return [...this.#record.pendingSegmentIds];
+        return [
+            ...this.#record.pendingSegmentIds,
+            ...this.#deferredSegments.map((segment) => segment.id),
+        ];
+    }
+    /** Process-local segments retained for a bounded single-shot commit. */
+    get deferredSegments() {
+        return structuredClone(this.#deferredSegments);
+    }
+    get pendingTableNextRowId() {
+        return this.#record.pendingTableNextRowId;
+    }
+    get initialCatalogProbe() {
+        return this.#initialCatalogProbe === undefined ? undefined : { ...this.#initialCatalogProbe };
+    }
+    /** Exact local commit contribution; undefined until this transaction commits. */
+    get committedCatalogContribution() {
+        if (this.#record.status !== "committed")
+            return undefined;
+        return {
+            transaction: structuredClone(this.#record),
+            segments: structuredClone([...this.#knownSegments.values()]),
+            ...(this.#initialCatalogProbe === undefined
+                ? {}
+                : { initialCatalogProbe: { ...this.#initialCatalogProbe } }),
+        };
+    }
+    get compactionSourceBlockIds() {
+        return [...this.#compactionSourceBlockIds].sort();
     }
-    get supersededBlockIds() {
-        return [...this.#supersededBlockIds].sort();
+    /** Extends durable ownership; scope owners call this while user code is legitimately waiting. */
+    async renew() {
+        this.#assertActive();
+        await this.#renewOwnership(true);
     }
     /**
      * Counts every registration this transaction carries: staged blocks and segments, unique-key
@@ -140,26 +218,70 @@ export class DatabaseTransaction {
      * since there is no statement-level rollback inside a transaction.
      */
     get stagedWorkCount() {
-        return (this.#record.pendingBlockIds.length +
-            this.#record.pendingSegmentIds.length +
+        return (this.pendingBlockIds.length +
+            this.pendingSegmentIds.length +
             this.#uniqueKeyChanges.length +
-            this.#ftsChanges.length +
-            this.#supersededBlockIds.size);
+            this.#ftsChanges.size +
+            this.#compactionSourceBlockIds.size);
     }
     /** Captures all publish-relevant state; row-id/autoincrement reservations deliberately burn. */
     checkpoint() {
         this.#assertActive();
         return {
             transactionId: this.id,
-            pendingBlockIds: [...this.#record.pendingBlockIds],
-            pendingSegmentIds: [...this.#record.pendingSegmentIds],
+            pendingBlockIds: this.pendingBlockIds,
+            pendingSegmentIds: this.pendingSegmentIds,
             uniqueKeyChanges: structuredClone(this.#uniqueKeyChanges),
-            ftsChanges: structuredClone(this.#ftsChanges),
-            supersededBlockIds: [...this.#supersededBlockIds],
+            ftsChanges: structuredClone(this.#materializedFtsChanges()),
+            compactionJobId: this.#compactionJobId,
+            compactionSourceBlockIds: [...this.#compactionSourceBlockIds],
+            levelZeroSegmentLimits: [...this.#levelZeroSegmentLimits].map(([tableId, limit]) => ({
+                tableId,
+                limit,
+            })),
             changedTableIds: [...this.#changedTableIds],
             logicallyUnchanged: this.#logicallyUnchanged,
         };
     }
+    /** Conservative retained-size estimate used to refuse savepoint clones before allocating. */
+    checkpointRetainedBytes() {
+        this.#assertActive();
+        let bytes = 256;
+        const addString = (value) => {
+            bytes = checkpointByteSum(bytes, 16 + value.length * 2);
+        };
+        addString(this.id);
+        for (const id of this.pendingBlockIds)
+            addString(id);
+        for (const id of this.pendingSegmentIds)
+            addString(id);
+        for (const change of this.#uniqueKeyChanges) {
+            addString(change.tableId);
+            for (const token of change.keyTokens)
+                addString(token);
+            bytes = checkpointByteSum(bytes, 32);
+        }
+        for (const change of this.#materializedFtsChanges()) {
+            addString(change.tableId);
+            for (const column of change.columns) {
+                addString(column.columnId);
+                bytes = checkpointByteSum(bytes, 48);
+                for (const posting of column.postings) {
+                    addString(posting.term);
+                    bytes = checkpointByteSum(bytes, posting.rowIds.length * 8 + posting.tf.length * 8 + 32);
+                }
+            }
+        }
+        if (this.#compactionJobId !== null)
+            addString(this.#compactionJobId);
+        for (const id of this.#compactionSourceBlockIds)
+            addString(id);
+        for (const [tableId] of this.#levelZeroSegmentLimits)
+            addString(tableId);
+        for (const id of this.#changedTableIds)
+            addString(id);
+        return bytes;
+    }
     /** Rewinds staged artifacts and every in-memory commit delta to one earlier checkpoint. */
     async rollbackTo(checkpoint) {
         this.#assertActive();
@@ -168,45 +290,113 @@ export class DatabaseTransaction {
         }
         const blockPrefix = checkpoint.pendingBlockIds;
         const segmentPrefix = checkpoint.pendingSegmentIds;
-        if (blockPrefix.some((id, index) => this.#record.pendingBlockIds[index] !== id) ||
-            segmentPrefix.some((id, index) => this.#record.pendingSegmentIds[index] !== id) ||
-            blockPrefix.length > this.#record.pendingBlockIds.length ||
-            segmentPrefix.length > this.#record.pendingSegmentIds.length) {
+        const retainedBlocks = new Set(blockPrefix);
+        const retainedSegments = new Set(segmentPrefix);
+        const currentBlockIds = this.pendingBlockIds;
+        const currentSegmentIds = this.pendingSegmentIds;
+        if (blockPrefix.some((id) => !currentBlockIds.includes(id)) ||
+            segmentPrefix.some((id) => !currentSegmentIds.includes(id))) {
             throw new TypeError("A transaction checkpoint is no longer reachable");
         }
-        const removedBlockIds = this.#record.pendingBlockIds.slice(blockPrefix.length);
-        const removedSegmentIds = this.#record.pendingSegmentIds.slice(segmentPrefix.length);
+        const removedBlockIds = currentBlockIds.filter((id) => !retainedBlocks.has(id));
+        const removedSegmentIds = currentSegmentIds.filter((id) => !retainedSegments.has(id));
         if (this.#persisted && (removedBlockIds.length > 0 || removedSegmentIds.length > 0)) {
-            // The journal forgets first, so a crash can at worst leave unreachable immutable garbage;
-            // it can never publish an artifact the savepoint rolled back. Normal completion removes
-            // those artifacts immediately below.
-            this.#record = await this.store.updateTransaction(this.id, this.#record.revision, {
+            await this.#renewOwnership();
+            this.#record = await this.store.rollbackTransactionArtifacts({
+                transactionId: this.id,
+                expectedRevision: this.#record.revision,
                 pendingBlockIds: blockPrefix,
                 pendingSegmentIds: segmentPrefix,
-                updatedAt: this.now().toISOString(),
+                removeBlockIds: removedBlockIds,
+                removeSegmentIds: removedSegmentIds,
+                updatedAt: dateIsoString(this.now()),
             });
         }
-        this.#uniqueKeyChanges.splice(0, this.#uniqueKeyChanges.length, ...structuredClone(checkpoint.uniqueKeyChanges));
-        this.#ftsChanges.splice(0, this.#ftsChanges.length, ...structuredClone(checkpoint.ftsChanges));
-        this.#supersededBlockIds.clear();
-        for (const id of checkpoint.supersededBlockIds)
-            this.#supersededBlockIds.add(id);
+        else if (!this.#persisted) {
+            for (let index = this.#deferredBlocks.length - 1; index >= 0; index -= 1) {
+                if (!retainedBlocks.has(this.#deferredBlocks[index]?.id ?? "")) {
+                    this.#deferredBlocks.splice(index, 1);
+                }
+            }
+            for (let index = this.#deferredSegments.length - 1; index >= 0; index -= 1) {
+                if (!retainedSegments.has(this.#deferredSegments[index]?.id ?? "")) {
+                    this.#deferredSegments.splice(index, 1);
+                }
+            }
+        }
+        for (const id of removedSegmentIds)
+            this.#knownSegments.delete(id);
+        this.#uniqueKeyChanges.splice(0);
+        this.#ftsChanges.clear();
+        this.#commitDeltaBytes = 0;
+        this.#commitDeltaEntries = 0;
+        for (const changes of checkpoint.uniqueKeyChanges)
+            this.setUniqueKeyChanges(changes);
+        for (const changes of checkpoint.ftsChanges)
+            this.setFtsChanges(changes);
+        this.#compactionJobId = checkpoint.compactionJobId;
+        this.#compactionSourceBlockIds.clear();
+        for (const id of checkpoint.compactionSourceBlockIds)
+            this.#compactionSourceBlockIds.add(id);
+        this.#levelZeroSegmentLimits.clear();
+        for (const { tableId, limit } of checkpoint.levelZeroSegmentLimits) {
+            this.#levelZeroSegmentLimits.set(tableId, limit);
+        }
         this.#changedTableIds.clear();
         for (const id of checkpoint.changedTableIds)
             this.#changedTableIds.add(id);
         this.#logicallyUnchanged = checkpoint.logicallyUnchanged;
-        await Promise.all(removedSegmentIds.map((id) => this.store.removeSegment(id)));
-        await Promise.all(removedBlockIds.map((id) => this.store.removeBlock(id)));
     }
     async snapshot() {
         return loadSnapshot(this.store, this.#record.snapshotVersion);
     }
     async getBlock(id) {
         this.#assertActive();
+        const deferred = this.#deferredBlocks.find((block) => block.id === id);
+        if (deferred !== undefined)
+            return new Uint8Array(deferred.bytes);
         if (this.#record.pendingBlockIds.includes(id))
             return this.store.getBlock(id);
         return (await this.snapshot()).getBlock(id);
     }
+    #assertProspectiveArtifactJournal(blocks, segments) {
+        const blockIds = new Set(this.pendingBlockIds);
+        const segmentIds = new Set(this.pendingSegmentIds);
+        for (const block of blocks) {
+            if (block.id.length === 0)
+                throw new TypeError("Block ID cannot be empty");
+            if (blockIds.has(block.id))
+                throw new Error(`Block already exists: ${block.id}`);
+            blockIds.add(block.id);
+        }
+        for (const segment of segments) {
+            if (segment.id.length === 0)
+                throw new TypeError("Segment ID cannot be empty");
+            if (segmentIds.has(segment.id))
+                throw new Error(`Segment already exists: ${segment.id}`);
+            segmentIds.add(segment.id);
+        }
+        assertTransactionArtifactJournalLimits([...blockIds], [...segmentIds]);
+    }
+    async #stageArtifactBatch(blocks, segments) {
+        if (blocks.length === 0 && segments.length === 0)
+            return;
+        assertTransactionArtifactBatchLimits(blocks, segments);
+        await this.#ensurePersisted();
+        await this.#renewOwnership();
+        try {
+            this.#record = await this.store.stageTransactionArtifacts({
+                transactionId: this.id,
+                expectedRevision: this.#record.revision,
+                blocks,
+                segments,
+                updatedAt: dateIsoString(this.now()),
+            });
+        }
+        catch (error) {
+            await this.#recoverStagedAcknowledgement(error, blocks, segments);
+        }
+    }
     async stageBlock(id, bytes) {
         return this.stageBlocks([{ id, bytes }]);
     }
@@ -214,12 +404,7 @@ export class DatabaseTransaction {
         this.#assertActive();
         if (blocks.length === 0)
             return;
-        await this.#ensurePersisted();
-        await this.store.addBlocks(blocks);
-        this.#record = await this.store.updateTransaction(this.id, this.#record.revision, {
-            pendingBlockIds: [...this.#record.pendingBlockIds, ...blocks.map((block) => block.id)],
-            updatedAt: this.now().toISOString(),
-        });
+        await this.stageArtifacts(blocks, []);
     }
     /**
      * Stages blocks and segments in one journal step. When the store implements the atomic
@@ -234,31 +419,38 @@ export class DatabaseTransaction {
                 throw new Error(`Segment ${segment.id} belongs to another transaction`);
             }
         }
-        // The journal stores pendingSegmentIds deduped and sorted, so staging position is the
-        // only record of operation order within this transaction. Stamp it on the segments:
-        // reads use it to fold same-commit segments in the order they were staged.
-        const ordinalBase = this.#record.pendingSegmentIds.length;
+        // The journal is an append-only ordered sequence. Stamp the same position on each segment:
+        // reads and recovery use the redundant pair to reject reordering or ambiguous same-commit
+        // folds before publication.
+        const ordinalBase = this.pendingSegmentIds.length;
         const ordered = segments.map((segment, index) => ({
             ...segment,
-            commitOrdinal: segment.commitOrdinal ?? ordinalBase + index,
+            commitOrdinal: ordinalBase + index,
         }));
-        const batched = this.store.stageTransactionArtifacts?.bind(this.store);
-        if (batched === undefined) {
-            await this.stageBlocks(blocks);
+        this.#assertProspectiveArtifactJournal(blocks, ordered);
+        this.#registerLevelZeroSegments(ordered);
+        if (blocks.length === 0 && ordered.length === 0)
+            return;
+        const batches = transactionArtifactBatches(blocks, ordered);
+        if (!this.#persisted &&
+            this.#deferredBlocks.length === 0 &&
+            this.#deferredSegments.length === 0 &&
+            batches.length === 1) {
+            assertTransactionArtifactBatchLimits(blocks, ordered);
+            this.#deferredBlocks.push(...blocks.map((block) => ({ id: block.id, bytes: new Uint8Array(block.bytes) })));
+            this.#deferredSegments.push(...structuredClone(ordered));
+            for (const segment of ordered)
+                this.#knownSegments.set(segment.id, structuredClone(segment));
             for (const segment of ordered)
-                await this.stageSegment(segment);
+                this.#changedTableIds.add(segment.tableId);
             return;
         }
-        if (blocks.length === 0 && ordered.length === 0)
-            return;
-        await this.#ensurePersisted();
-        this.#record = await batched({
-            transactionId: this.id,
-            expectedRevision: this.#record.revision,
-            blocks,
-            segments: ordered,
-            updatedAt: this.now().toISOString(),
-        });
+        await this.#persistDeferredArtifacts();
+        for (const batch of batches) {
+            await this.#stageArtifactBatch(batch.blocks, batch.segments);
+        }
+        for (const segment of ordered)
+            this.#knownSegments.set(segment.id, structuredClone(segment));
         for (const segment of ordered)
             this.#changedTableIds.add(segment.tableId);
     }
@@ -280,62 +472,88 @@ export class DatabaseTransaction {
         }
         const pendingBlockIds = new Set(this.#record.pendingBlockIds);
         const pendingSegmentIds = new Set(this.#record.pendingSegmentIds);
+        await this.#assertRetainedArtifactsUnchanged(blocks.filter((block) => pendingBlockIds.has(block.id)), segments.filter((segment) => pendingSegmentIds.has(segment.id)));
+        const unstagedBlocks = blocks.filter((block) => !pendingBlockIds.has(block.id));
+        const unstagedSegments = segments.filter((segment) => !pendingSegmentIds.has(segment.id));
         if (blocks.length + segments.length > 0 &&
-            blocks.every((block) => pendingBlockIds.has(block.id)) &&
-            segments.every((segment) => pendingSegmentIds.has(segment.id))) {
+            unstagedBlocks.length === 0 &&
+            unstagedSegments.length === 0) {
             return this.commit();
         }
+        this.#assertProspectiveArtifactJournal(unstagedBlocks, unstagedSegments);
         const single = this.store.writeTransaction?.bind(this.store);
-        if (single === undefined) {
-            await this.stageArtifacts(blocks, segments);
+        const batches = transactionArtifactBatches(unstagedBlocks, unstagedSegments);
+        if (single === undefined || batches.length !== 1) {
+            await this.stageArtifacts(unstagedBlocks, unstagedSegments);
             return this.commit();
         }
+        await this.#renewOwnership();
         const ordinalBase = this.#record.pendingSegmentIds.length;
-        const ordered = segments.map((segment, index) => ({
+        const ordered = unstagedSegments.map((segment, index) => ({
             ...segment,
-            commitOrdinal: segment.commitOrdinal ?? ordinalBase + index,
+            commitOrdinal: ordinalBase + index,
         }));
+        assertTransactionArtifactBatchLimits(unstagedBlocks, ordered);
+        this.#registerLevelZeroSegments(ordered);
         const changedTableIds = new Set(this.#changedTableIds);
         for (const segment of ordered)
             changedTableIds.add(segment.tableId);
         const { snapshotVersion: _pinned, ...fresh } = this.#record;
         void _pinned;
-        const committedAt = this.now().toISOString();
+        const committedAt = dateIsoString(this.now());
+        const committedRevision = advanceRevision(this.#record.revision, 2);
+        const compactionJobId = this.#compactionJobId;
+        const ftsChanges = this.#materializedFtsChanges();
+        // Keep the exact staged metadata before issuing the atomic write. A store is allowed to
+        // commit and then lose the acknowledgement; #recoverCommitted turns that into success, so
+        // recording this only after the await would make the caller's local catalog advancement
+        // omit segments that are already durable.
+        for (const segment of ordered)
+            this.#knownSegments.set(segment.id, structuredClone(segment));
+        for (const segment of ordered)
+            this.#changedTableIds.add(segment.tableId);
         try {
             const manifest = await single({
                 transaction: this.#persisted
                     ? { id: this.id, expectedRevision: this.#record.revision }
                     : { record: fresh },
-                blocks,
+                blocks: unstagedBlocks,
                 segments: ordered,
                 expectedManifestVersion: this.#record.snapshotVersion,
                 changedTableIds: this.#logicallyUnchanged ? [] : [...changedTableIds],
-                ...(this.#supersededBlockIds.size === 0
+                ...(this.#compactionSourceBlockIds.size === 0
                     ? {}
-                    : { removedBlockIds: [...this.#supersededBlockIds] }),
+                    : {
+                        compactionJobId: requiredCompactionJobId(compactionJobId),
+                        removedBlockIds: [...this.#compactionSourceBlockIds],
+                    }),
                 ...(this.#uniqueKeyChanges.length === 0
                     ? {}
                     : { uniqueKeyChanges: this.#uniqueKeyChanges }),
-                ...(this.#ftsChanges.length === 0 ? {} : { ftsChanges: this.#ftsChanges }),
+                ...(ftsChanges.length === 0 ? {} : { ftsChanges }),
+                ...(this.#levelZeroSegmentLimits.size === 0
+                    ? {}
+                    : {
+                        levelZeroSegmentLimits: [...this.#levelZeroSegmentLimits].map(([tableId, limit]) => ({
+                            tableId,
+                            limit,
+                        })),
+                    }),
                 committedAt,
             });
-            for (const segment of ordered)
-                this.#changedTableIds.add(segment.tableId);
             this.#record = {
                 ...this.#record,
-                pendingBlockIds: [
-                    ...new Set([...pendingBlockIds, ...blocks.map((block) => block.id)]),
-                ].sort(),
-                pendingSegmentIds: [
-                    ...new Set([...pendingSegmentIds, ...ordered.map((segment) => segment.id)]),
-                ].sort(),
+                pendingBlockIds: [...pendingBlockIds, ...unstagedBlocks.map((block) => block.id)],
+                pendingSegmentIds: [...pendingSegmentIds, ...ordered.map((segment) => segment.id)],
                 status: "committed",
                 committedVersion: manifest.version,
                 // One journal step and one commit, as the two-step shape would have left it.
-                revision: this.#record.revision + 2,
+                revision: committedRevision,
                 updatedAt: committedAt,
             };
             this.#persisted = true;
+            this.#stopHeartbeat();
+            await this.#releaseSnapshotLease().catch(() => undefined);
             return manifest;
         }
         catch (error) {
@@ -351,6 +569,7 @@ export class DatabaseTransaction {
      */
     async stageExistingBlocks(blockIds) {
         this.#assertActive();
+        await this.#persistDeferredArtifacts();
         const pending = new Set(this.#record.pendingBlockIds);
         const additions = [...new Set(blockIds)].filter((id) => !pending.has(id));
         if (additions.length === 0)
@@ -358,15 +577,17 @@ export class DatabaseTransaction {
         if (additions.some((id) => id.length === 0)) {
             throw new TypeError("Block ID cannot be empty");
         }
+        assertTransactionArtifactJournalLimits([...this.#record.pendingBlockIds, ...additions], this.#record.pendingSegmentIds);
         for (const id of additions) {
             if ((await this.store.getBlock(id)) === undefined) {
                 throw new Error(`Cannot stage a missing existing block: ${id}`);
             }
         }
         await this.#ensurePersisted();
+        await this.#renewOwnership();
         this.#record = await this.store.updateTransaction(this.id, this.#record.revision, {
             pendingBlockIds: [...this.#record.pendingBlockIds, ...additions],
-            updatedAt: this.now().toISOString(),
+            updatedAt: dateIsoString(this.now()),
         });
     }
     async stageSegment(record) {
@@ -374,20 +595,12 @@ export class DatabaseTransaction {
         if (record.transactionId !== this.id) {
             throw new Error(`Segment ${record.id} belongs to another transaction`);
         }
-        if (record.commitOrdinal === undefined) {
-            record = { ...record, commitOrdinal: this.#record.pendingSegmentIds.length };
-        }
-        this.#changedTableIds.add(record.tableId);
-        await this.#ensurePersisted();
-        await this.store.addSegment(record);
-        this.#record = await this.store.updateTransaction(this.id, this.#record.revision, {
-            pendingSegmentIds: [...this.#record.pendingSegmentIds, record.id],
-            updatedAt: this.now().toISOString(),
-        });
+        await this.stageArtifacts([], [record]);
     }
     /** Reconciles a persisted segment whose journal update was interrupted. */
     async stageExistingSegment(segmentId) {
         this.#assertActive();
+        await this.#persistDeferredArtifacts();
         if (this.#record.pendingSegmentIds.includes(segmentId))
             return;
         const record = await this.store.getSegment(segmentId);
@@ -396,13 +609,65 @@ export class DatabaseTransaction {
         if (record.transactionId !== this.id) {
             throw new Error(`Segment ${segmentId} belongs to another transaction`);
         }
+        if (record.commitOrdinal !== this.#record.pendingSegmentIds.length) {
+            throw new Error(`Existing segment ${segmentId} is not the next journal ordinal`);
+        }
+        assertTransactionArtifactJournalLimits(this.#record.pendingBlockIds, [
+            ...this.#record.pendingSegmentIds,
+            segmentId,
+        ]);
+        this.#registerLevelZeroSegments([record]);
         this.#changedTableIds.add(record.tableId);
         await this.#ensurePersisted();
+        await this.#renewOwnership();
         this.#record = await this.store.updateTransaction(this.id, this.#record.revision, {
             pendingSegmentIds: [...this.#record.pendingSegmentIds, segmentId],
-            updatedAt: this.now().toISOString(),
+            updatedAt: dateIsoString(this.now()),
         });
     }
+    /** Atomically adopts an exact unpublished output left by an aborted attempt of this job. */
+    async adoptAbortedCompactionSegment(record, abortedOwner) {
+        this.#assertActive();
+        await this.#persistDeferredArtifacts();
+        if (record.transactionId !== this.id) {
+            throw new Error(`Segment ${record.id} belongs to another transaction`);
+        }
+        if (abortedOwner.status !== "aborted") {
+            throw new Error(`Segment ${record.id} owner is not aborted`);
+        }
+        const compactionJobId = requiredCompactionJobId(this.#compactionJobId);
+        this.#assertProspectiveArtifactJournal([], [record]);
+        this.#registerLevelZeroSegments([record]);
+        this.#changedTableIds.add(record.tableId);
+        await this.#ensurePersisted();
+        await this.#renewOwnership();
+        try {
+            this.#record = await this.store.adoptAbortedSegment({
+                segment: record,
+                expectedAbortedTransactionId: abortedOwner.id,
+                expectedAbortedTransactionRevision: abortedOwner.revision,
+                replacementTransactionId: this.id,
+                expectedReplacementTransactionRevision: this.#record.revision,
+                compactionJobId,
+                updatedAt: dateIsoString(this.now()),
+            });
+        }
+        catch (error) {
+            // A lost acknowledgement is safe to reconcile: the exact segment and journal move are one
+            // adapter transaction. Any partial or foreign state fails the strict equality check.
+            const [current, segment] = await Promise.all([
+                this.store.getTransaction(this.id),
+                this.store.getSegment(record.id),
+            ]);
+            if (current?.status !== "active" ||
+                !current.pendingSegmentIds.includes(record.id) ||
+                segment?.transactionId !== this.id ||
+                !sameSegmentArtifacts(segment, record)) {
+                throw error;
+            }
+            this.#record = current;
+        }
+    }
     /**
      * Records that this commit changes a table's logical content without staging a segment for
      * it — dropping the table, for instance, whose only publish is the retirement of its blocks.
@@ -427,14 +692,23 @@ export class DatabaseTransaction {
     /** Appends one operation's key changes; entries commit in operation order. */
     setUniqueKeyChanges(changes) {
         this.#assertActive();
-        this.#uniqueKeyChanges.push({
+        if (changes.keyTokens.length > MAX_TRANSACTION_COMMIT_DELTA_ENTRIES) {
+            throw new RangeError(`Transaction commit deltas exceed ${String(MAX_TRANSACTION_COMMIT_DELTA_ENTRIES)} entries`);
+        }
+        // Walk the caller-owned array before allocating a Set or clone. The aggregate tracker below
+        // charges the deduplicated retained form, while this preflight prevents one hostile call from
+        // creating a database-sized temporary allocation first.
+        transactionCommitDeltaRetainedBytes([changes], []);
+        const normalized = {
             tableId: changes.tableId,
             // Deduplicated, not sorted: membership is all a store reads from these, and sorting fifty
             // thousand tokens cost a bulk delete a fifth of its time.
             keyTokens: [...new Set(changes.keyTokens)],
             requireAbsent: changes.requireAbsent,
             ...(changes.remove === undefined ? {} : { remove: changes.remove }),
-        });
+        };
+        this.#reserveCommitDelta([normalized], []);
+        this.#uniqueKeyChanges.push(normalized);
     }
     /**
      * Attaches one batch's full-text deltas; applied atomically with the publish. A second
@@ -444,82 +718,196 @@ export class DatabaseTransaction {
      */
     setFtsChanges(changes) {
         this.#assertActive();
-        const existing = this.#ftsChanges.find((entry) => entry.tableId === changes.tableId);
-        if (existing === undefined) {
-            this.#ftsChanges.push(changes);
-            return;
+        const existingColumns = this.#ftsChanges.get(changes.tableId);
+        const tokenTotals = new Map();
+        for (const column of changes.columns) {
+            const prior = tokenTotals.get(column.columnId) ?? existingColumns?.get(column.columnId)?.totalTokens ?? 0;
+            tokenTotals.set(column.columnId, safeWholeNumberSum([prior, column.totalTokens], "Full-text transaction token count"));
+        }
+        this.#reserveCommitDelta([], [changes]);
+        let columns = this.#ftsChanges.get(changes.tableId);
+        if (columns === undefined) {
+            columns = new Map();
+            this.#ftsChanges.set(changes.tableId, columns);
         }
-        const merged = new Map(existing.columns.map((column) => [column.columnId, column]));
         for (const column of changes.columns) {
-            const present = merged.get(column.columnId);
+            const present = columns.get(column.columnId);
             if (present === undefined) {
-                merged.set(column.columnId, column);
+                columns.set(column.columnId, {
+                    postings: new Map(column.postings.map((posting) => [
+                        posting.term,
+                        {
+                            term: posting.term,
+                            rowIds: [...posting.rowIds],
+                            tf: [...posting.tf],
+                        },
+                    ])),
+                    totalTokens: column.totalTokens,
+                });
                 continue;
             }
-            const byTerm = new Map(present.postings.map((posting) => [posting.term, posting]));
             for (const posting of column.postings) {
-                const held = byTerm.get(posting.term);
+                const held = present.postings.get(posting.term);
                 if (held === undefined) {
-                    byTerm.set(posting.term, posting);
-                }
-                else {
-                    byTerm.set(posting.term, {
+                    present.postings.set(posting.term, {
                         term: posting.term,
-                        rowIds: [...held.rowIds, ...posting.rowIds],
-                        tf: [...held.tf, ...posting.tf],
+                        rowIds: [...posting.rowIds],
+                        tf: [...posting.tf],
                     });
                 }
+                else {
+                    for (const rowId of posting.rowIds)
+                        held.rowIds.push(rowId);
+                    for (const tf of posting.tf)
+                        held.tf.push(tf);
+                }
             }
-            merged.set(column.columnId, {
-                columnId: column.columnId,
-                postings: [...byTerm.values()].sort((left, right) => left.term < right.term ? -1 : left.term > right.term ? 1 : 0),
-                totalTokens: present.totalTokens + column.totalTokens,
-            });
+            present.totalTokens = tokenTotals.get(column.columnId) ?? present.totalTokens;
         }
-        this.#ftsChanges[this.#ftsChanges.indexOf(existing)] = {
-            tableId: changes.tableId,
-            columns: [...merged.values()],
-        };
     }
-    supersedeBlocks(blockIds) {
+    #materializedFtsChanges() {
+        return [...this.#ftsChanges].map(([tableId, columns]) => ({
+            tableId,
+            columns: [...columns].map(([columnId, change]) => ({
+                columnId,
+                postings: [...change.postings.values()].sort((left, right) => left.term < right.term ? -1 : left.term > right.term ? 1 : 0),
+                totalTokens: change.totalTokens,
+            })),
+        }));
+    }
+    #reserveCommitDelta(uniqueKeyChanges, ftsChanges) {
+        const added = transactionCommitDeltaRetainedBytes(uniqueKeyChanges, ftsChanges);
+        const bytes = this.#commitDeltaBytes + added.bytes;
+        const entries = this.#commitDeltaEntries + added.entries;
+        if (!Number.isSafeInteger(bytes) || bytes > MAX_TRANSACTION_COMMIT_DELTA_BYTES) {
+            throw new RangeError(`Transaction commit deltas exceed ${String(MAX_TRANSACTION_COMMIT_DELTA_BYTES)} retained bytes`);
+        }
+        if (!Number.isSafeInteger(entries) || entries > MAX_TRANSACTION_COMMIT_DELTA_ENTRIES) {
+            throw new RangeError(`Transaction commit deltas exceed ${String(MAX_TRANSACTION_COMMIT_DELTA_ENTRIES)} entries`);
+        }
+        this.#commitDeltaBytes = bytes;
+        this.#commitDeltaEntries = entries;
+    }
+    /**
+     * Binds a physical retirement to one persisted compaction job. Stores revalidate the job,
+     * source segments, current manifest, and aliases atomically with publication; this in-memory
+     * declaration is intent, never authority to hide arbitrary blocks.
+     */
+    setCompactionIntent(compactionJobId, sourceBlockIds) {
         this.#assertActive();
-        for (const id of blockIds) {
+        if (compactionJobId.length === 0)
+            throw new TypeError("Compaction job ID cannot be empty");
+        if (sourceBlockIds.length === 0) {
+            throw new TypeError("A compaction retirement must name at least one source block");
+        }
+        const next = new Set(sourceBlockIds);
+        if (next.size !== sourceBlockIds.length) {
+            throw new TypeError("Compaction source block IDs must be unique");
+        }
+        if (this.#compactionJobId !== null) {
+            if (this.#compactionJobId !== compactionJobId ||
+                next.size !== this.#compactionSourceBlockIds.size ||
+                [...next].some((id) => !this.#compactionSourceBlockIds.has(id))) {
+                throw new Error("A transaction cannot change its compaction retirement intent");
+            }
+            return;
+        }
+        for (const id of next) {
             if (id.length === 0)
-                throw new TypeError("Superseded block ID cannot be empty");
+                throw new TypeError("Compaction source block ID cannot be empty");
             if (this.#record.pendingBlockIds.includes(id)) {
-                throw new Error(`A transaction cannot supersede its own pending block: ${id}`);
+                throw new Error(`A compaction cannot retire its own pending block: ${id}`);
+            }
+        }
+        this.#compactionJobId = compactionJobId;
+        for (const id of next)
+            this.#compactionSourceBlockIds.add(id);
+    }
+    /** Adds an adapter-enforced post-commit level-zero ceiling for one table. */
+    limitLevelZeroSegments(tableId, limit) {
+        this.#assertActive();
+        if (tableId.length === 0)
+            throw new TypeError("Table ID cannot be empty");
+        if (!Number.isSafeInteger(limit) || limit <= 0) {
+            throw new RangeError("Level-zero segment limit must be a positive safe integer");
+        }
+        const existing = this.#levelZeroSegmentLimits.get(tableId);
+        this.#levelZeroSegmentLimits.set(tableId, existing === undefined ? limit : Math.min(existing, limit));
+    }
+    #registerLevelZeroSegments(segments) {
+        for (const segment of segments) {
+            if (segment.level !== 0)
+                continue;
+            const existing = this.#levelZeroSegmentLimits.get(segment.tableId);
+            if (existing === undefined) {
+                this.#levelZeroSegmentLimits.set(segment.tableId, MAX_LEVEL_ZERO_SEGMENTS);
             }
-            this.#supersededBlockIds.add(id);
         }
     }
     async commit() {
         this.#assertActive();
+        if (this.#deferredBlocks.length > 0 || this.#deferredSegments.length > 0) {
+            if (this.store.writeTransaction === undefined) {
+                await this.#persistDeferredArtifacts();
+            }
+            else {
+                const blocks = this.#deferredBlocks.splice(0);
+                const segments = this.#deferredSegments.splice(0);
+                try {
+                    return await this.stageArtifactsAndCommit(blocks, segments);
+                }
+                catch (error) {
+                    // A single-shot refusal mutates nothing. Keep the exact immutable artifacts available
+                    // for the caller's ordinary rebase-and-retry path.
+                    this.#deferredBlocks.push(...blocks);
+                    this.#deferredSegments.push(...segments);
+                    throw error;
+                }
+            }
+        }
         await this.#ensurePersisted();
+        await this.#renewOwnership();
         // The store derives the published manifest from its stored base plus this delta, so the
         // commit neither loads nor rebuilds the full block list.
-        const committedAt = this.now().toISOString();
+        const committedAt = dateIsoString(this.now());
+        const committedRevision = advanceRevision(this.#record.revision, 1);
+        const compactionJobId = this.#compactionJobId;
+        const ftsChanges = this.#materializedFtsChanges();
         try {
             const manifest = await this.store.commitTransaction({
                 transactionId: this.id,
                 expectedTransactionRevision: this.#record.revision,
                 expectedManifestVersion: this.#record.snapshotVersion,
                 changedTableIds: this.#logicallyUnchanged ? [] : [...this.#changedTableIds],
-                ...(this.#supersededBlockIds.size === 0
+                ...(this.#compactionSourceBlockIds.size === 0
                     ? {}
-                    : { removedBlockIds: [...this.#supersededBlockIds] }),
+                    : {
+                        compactionJobId: requiredCompactionJobId(compactionJobId),
+                        removedBlockIds: [...this.#compactionSourceBlockIds],
+                    }),
                 ...(this.#uniqueKeyChanges.length === 0
                     ? {}
                     : { uniqueKeyChanges: this.#uniqueKeyChanges }),
-                ...(this.#ftsChanges.length === 0 ? {} : { ftsChanges: this.#ftsChanges }),
+                ...(ftsChanges.length === 0 ? {} : { ftsChanges }),
+                ...(this.#levelZeroSegmentLimits.size === 0
+                    ? {}
+                    : {
+                        levelZeroSegmentLimits: [...this.#levelZeroSegmentLimits].map(([tableId, limit]) => ({
+                            tableId,
+                            limit,
+                        })),
+                    }),
                 committedAt,
             });
             this.#record = {
                 ...this.#record,
                 status: "committed",
                 committedVersion: manifest.version,
-                revision: this.#record.revision + 1,
+                revision: committedRevision,
                 updatedAt: committedAt,
             };
+            this.#stopHeartbeat();
+            await this.#releaseSnapshotLease().catch(() => undefined);
             return manifest;
         }
         catch (error) {
@@ -529,22 +917,25 @@ export class DatabaseTransaction {
     async rebase() {
         this.#assertActive();
         for (;;) {
-            const current = await this.store.getCurrentManifest();
+            const currentVersion = await this.store.getCurrentManifestVersion();
             if (!this.#persisted) {
-                // Nothing is in the store yet, so the pin moves locally; it lands with the record.
+                // Nothing is in the store yet, so move the temporary durable pin before changing the
+                // local snapshot. The old version remains protected until the replacement is admitted.
+                await this.#moveSnapshotLease(currentVersion);
                 this.#record = {
                     ...this.#record,
-                    snapshotVersion: current?.version ?? null,
-                    updatedAt: this.now().toISOString(),
+                    snapshotVersion: currentVersion,
+                    updatedAt: dateIsoString(this.now()),
                 };
-                return new Snapshot(this.store, current?.version ?? null, current?.blockIds ?? []);
+                return new Snapshot(this.store, currentVersion);
             }
             try {
+                await this.#renewOwnership();
                 this.#record = await this.store.updateTransaction(this.id, this.#record.revision, {
-                    snapshotVersion: current?.version ?? null,
-                    updatedAt: this.now().toISOString(),
+                    snapshotVersion: currentVersion,
+                    updatedAt: dateIsoString(this.now()),
                 });
-                return new Snapshot(this.store, current?.version ?? null, current?.blockIds ?? []);
+                return new Snapshot(this.store, currentVersion);
             }
             catch (error) {
                 if (error instanceof SnapshotManifestMissingError) {
@@ -558,13 +949,21 @@ export class DatabaseTransaction {
         this.#assertActive();
         if (!this.#persisted) {
             // Never written, so there is nothing to mark: the transaction simply ends here.
-            this.#record = { ...this.#record, status: "aborted", updatedAt: this.now().toISOString() };
+            this.#deferredBlocks.length = 0;
+            this.#deferredSegments.length = 0;
+            this.#knownSegments.clear();
+            this.#record = { ...this.#record, status: "aborted", updatedAt: dateIsoString(this.now()) };
+            this.#stopHeartbeat();
+            await this.#releaseSnapshotLease().catch(() => undefined);
             return;
         }
+        await this.#renewOwnership();
         this.#record = await this.store.updateTransaction(this.id, this.#record.revision, {
             status: "aborted",
-            updatedAt: this.now().toISOString(),
+            updatedAt: dateIsoString(this.now()),
         });
+        this.#stopHeartbeat();
+        await this.#releaseSnapshotLease().catch(() => undefined);
     }
     #assertActive() {
         if (this.#record.status !== "active")
@@ -578,6 +977,11 @@ export class DatabaseTransaction {
     async #ensurePersisted() {
         if (this.#persisted)
             return;
+        this.#record = {
+            ...this.#record,
+            expiresAt: this.#nextExpiry(),
+            updatedAt: dateIsoString(this.now()),
+        };
         try {
             await this.store.createTransaction(this.#record);
         }
@@ -588,6 +992,19 @@ export class DatabaseTransaction {
             throw error;
         }
         this.#persisted = true;
+        // The transaction record now owns the same durable pin and renews on this heartbeat. Keep
+        // only one record rooted; a failed cleanup remains bounded by the lease expiry.
+        void this.#releaseSnapshotLease().catch(() => undefined);
+    }
+    /** Flushes the bounded process-local batch before a second durable staging operation. */
+    async #persistDeferredArtifacts() {
+        if (this.#deferredBlocks.length === 0 && this.#deferredSegments.length === 0)
+            return;
+        const blocks = [...this.#deferredBlocks];
+        const segments = [...this.#deferredSegments];
+        await this.#stageArtifactBatch(blocks, segments);
+        this.#deferredBlocks.length = 0;
+        this.#deferredSegments.length = 0;
     }
     /** A commit whose acknowledgement was lost still committed: answer from the persisted record. */
     async #recoverCommitted(error) {
@@ -597,85 +1014,292 @@ export class DatabaseTransaction {
             if (manifest !== undefined) {
                 this.#record = persisted;
                 this.#persisted = true;
+                this.#stopHeartbeat();
+                await this.#releaseSnapshotLease().catch(() => undefined);
                 return manifest;
             }
         }
         throw error;
     }
+    async #renewOwnership(force = false) {
+        await this.#renewSnapshotLease(force);
+        if (!this.#persisted || this.#record.status !== "active")
+            return;
+        const now = dateMilliseconds(this.now());
+        if (!force && Date.parse(this.#record.expiresAt) - now > this.ttlMs / 3)
+            return;
+        const expiresAt = expiryAfter(new Date(now), this.ttlMs);
+        const renewal = this.#renewal ??
+            this.store
+                .renewTransaction({
+                transactionId: this.id,
+                ownerId: this.#record.ownerId,
+                expiresAtCutoff: dateIsoString(new Date(now)),
+                expiresAt,
+            })
+                .then((owned) => ({ owned, expiresAt }));
+        this.#renewal = renewal;
+        let result;
+        try {
+            result = await renewal;
+        }
+        finally {
+            if (this.#renewal === renewal)
+                this.#renewal = undefined;
+        }
+        if (result.owned) {
+            this.#record = { ...this.#record, expiresAt: result.expiresAt };
+            return;
+        }
+        const persisted = await this.store.getTransaction(this.id);
+        if (persisted !== undefined)
+            this.#record = persisted;
+        this.#stopHeartbeat();
+        await this.#releaseSnapshotLease().catch(() => undefined);
+        throw new TransactionClosedError(this.id);
+    }
+    async #renewSnapshotLease(force) {
+        const lease = this.#snapshotLease;
+        if (lease === undefined || this.#record.status !== "active")
+            return;
+        if (!force &&
+            dateMilliseconds(lease.expiresAt) - dateMilliseconds(this.now()) > this.ttlMs / 3) {
+            return;
+        }
+        const renewal = this.#snapshotRenewal ??
+            this.#serializeSnapshotLeaseOperation(async () => {
+                const current = this.#snapshotLease;
+                if (current === undefined || this.#record.status !== "active")
+                    return;
+                if (!force &&
+                    dateMilliseconds(current.expiresAt) - dateMilliseconds(this.now()) > this.ttlMs / 3) {
+                    return;
+                }
+                await current.renew(this.ttlMs);
+            });
+        this.#snapshotRenewal = renewal;
+        try {
+            await renewal;
+        }
+        finally {
+            if (this.#snapshotRenewal === renewal)
+                this.#snapshotRenewal = undefined;
+        }
+    }
+    async #moveSnapshotLease(version) {
+        await this.#serializeSnapshotLeaseOperation(async () => {
+            const current = this.#snapshotLease;
+            if (current === undefined || current.version === version)
+                return;
+            const moved = await current.moveTo(version, this.ttlMs);
+            if (moved !== undefined) {
+                if (this.#snapshotLease === current) {
+                    this.#snapshotLease = moved;
+                }
+                else {
+                    // A terminal path detached the old lease while the adapter move was in flight. Do not
+                    // resurrect it in memory; retire the moved durable record as part of this operation.
+                    await moved.release().catch(() => undefined);
+                }
+                return;
+            }
+            // Custom stores may omit atomic moveLease. Admit a replacement before releasing the old
+            // pin, so there is never a reclamation window between versions.
+            const createdAt = dateIsoString(this.now());
+            const record = {
+                id: crypto.randomUUID(),
+                kind: "reader",
+                manifestVersion: version,
+                ownerId: this.#record.ownerId,
+                createdAt,
+                expiresAt: expiryAfter(new Date(createdAt), this.ttlMs),
+                revision: 0,
+            };
+            await this.store.createLease(record);
+            const replacement = new LeasedSnapshot(this.store, version, record, this.now);
+            if (this.#snapshotLease === current) {
+                this.#snapshotLease = replacement;
+            }
+            else {
+                await replacement.release().catch(() => undefined);
+            }
+            await current.release().catch(() => undefined);
+        });
+    }
+    async #releaseSnapshotLease() {
+        const lease = this.#snapshotLease;
+        if (lease === undefined)
+            return;
+        // Detach before the adapter call. Once a transaction record is persisted it is the durable
+        // owner; a slow lease removal must not let the next ownership check renew the retiring pin
+        // concurrently and turn a healthy handoff into a LeaseConflictError.
+        this.#snapshotLease = undefined;
+        await this.#serializeSnapshotLeaseOperation(() => lease.release());
+    }
+    /**
+     * Lease revisions are compare-and-swap tokens, so renew, move, and release must observe one
+     * another's returned record before issuing the next adapter operation. Keep the tail fulfilled
+     * after a refusal: the caller still receives its error, while a terminal cleanup can proceed.
+     */
+    #serializeSnapshotLeaseOperation(operation) {
+        const run = this.#snapshotLeaseOperation.then(operation);
+        this.#snapshotLeaseOperation = run.then(() => undefined, () => undefined);
+        return run;
+    }
+    #nextExpiry() {
+        return expiryAfter(this.now(), this.ttlMs);
+    }
+    #stopHeartbeat() {
+        if (this.#heartbeatTimer !== undefined)
+            clearInterval(this.#heartbeatTimer);
+        this.#heartbeatTimer = undefined;
+    }
+    /**
+     * An adapter can durably stage the artifacts and lose the acknowledgement afterwards. Refresh
+     * the local revision only when the persisted journal is exactly the one this call would have
+     * produced, so the caller's abort/rollback can clean it up without masking the original error.
+     */
+    async #recoverStagedAcknowledgement(error, blocks, segments) {
+        try {
+            const persisted = await this.store.getTransaction(this.id);
+            const expectedBlocks = [...this.#record.pendingBlockIds, ...blocks.map((block) => block.id)];
+            const expectedSegments = [
+                ...this.#record.pendingSegmentIds,
+                ...segments.map((segment) => segment.id),
+            ];
+            if (persisted?.status === "active" &&
+                persisted.revision === advanceRevision(this.#record.revision, 1) &&
+                sameStrings(persisted.pendingBlockIds, expectedBlocks) &&
+                sameStrings(persisted.pendingSegmentIds, expectedSegments)) {
+                const [storedBlocks, storedSegments] = await Promise.all([
+                    Promise.all(blocks.map((block) => this.store.getBlock(block.id))),
+                    Promise.all(segments.map((segment) => this.store.getSegment(segment.id))),
+                ]);
+                if (blocks.every((block, index) => sameBytes(block.bytes, storedBlocks[index])) &&
+                    segments.every((segment, index) => {
+                        const stored = storedSegments[index];
+                        return stored !== undefined && sameSegmentArtifacts(segment, stored);
+                    })) {
+                    this.#record = persisted;
+                    this.#persisted = true;
+                }
+            }
+        }
+        catch {
+            // Preserve the operation error. A failed diagnostic read cannot prove a different outcome.
+        }
+        throw error;
+    }
+    async #assertRetainedArtifactsUnchanged(blocks, segments) {
+        for (const block of blocks) {
+            if (!sameBytes(block.bytes, await this.store.getBlock(block.id))) {
+                throw new Error(`Retried block differs from the staged artifact: ${block.id}`);
+            }
+        }
+        for (const segment of segments) {
+            const stored = await this.store.getSegment(segment.id);
+            if (stored === undefined ||
+                !sameSegmentArtifacts(stored, { ...segment, commitOrdinal: stored.commitOrdinal })) {
+                throw new Error(`Retried segment differs from the staged artifact: ${segment.id}`);
+            }
+        }
+    }
+}
+function sameStrings(left, right) {
+    return left.length === right.length && left.every((value, index) => value === right[index]);
+}
+function sameBytes(left, right) {
+    return (left.byteLength === right?.byteLength && left.every((byte, index) => byte === right[index]));
 }
 export class TransactionManager {
     store;
     #now;
     #createId;
+    #transactionTtlMs;
+    #leaseCleanupCursor = null;
+    #createWeakRef;
     constructor(store, options = {}) {
         this.store = store;
         this.#now = options.now ?? (() => new Date());
         this.#createId = options.createId ?? (() => crypto.randomUUID());
+        this.#transactionTtlMs = options.transactionTtlMs ?? DEFAULT_TRANSACTION_TTL_MS;
+        validateTtl(this.#transactionTtlMs);
+        this.#createWeakRef = options.createWeakRef ?? ((transaction) => new WeakRef(transaction));
     }
     async begin() {
         return (await this.beginWithReservation()).transaction;
     }
-    /**
-     * Begins a transaction without a storage write: the record is pinned at the current manifest
-     * version (one read) and written only when something is staged through the two-step methods
-     * — or never, when the whole write goes through `stageArtifactsAndCommit` on a store with
-     * the single-shot `writeTransaction`, or the transaction aborts untouched. For writes whose
-     * artifacts need no prior reservation; `beginWithReservation` is the shape for the rest.
-     */
-    async beginDeferred() {
-        const currentVersion = await this.store.getCurrentManifestVersion();
-        const timestamp = this.#now().toISOString();
-        return new DatabaseTransaction(this.store, {
-            id: this.#createId(),
-            snapshotVersion: currentVersion,
-            pendingBlockIds: [],
-            pendingSegmentIds: [],
-            status: "active",
-            revision: 0,
-            startedAt: timestamp,
-            updatedAt: timestamp,
-            committedVersion: null,
-        }, this.#now, { persisted: false });
+    /** Atomically reserves an invisible catalog table for a create-and-populate transaction. */
+    async beginWithPendingTable(record, expectedCatalogEpoch) {
+        const id = this.#createId();
+        const ownerId = `${id}/owner`;
+        const timestamp = dateIsoString(this.#now());
+        let begun;
+        for (;;) {
+            try {
+                begun = await this.store.beginTransaction({
+                    record: {
+                        id,
+                        ownerId,
+                        expiresAt: this.#transactionExpiry(),
+                        pendingBlockIds: [],
+                        pendingSegmentIds: [],
+                        status: "active",
+                        revision: 0,
+                        startedAt: timestamp,
+                        updatedAt: timestamp,
+                        committedVersion: null,
+                    },
+                    pendingTable: { record, nextRowId: 1n, expectedCatalogEpoch },
+                });
+                break;
+            }
+            catch (error) {
+                // Atomic begin writes nothing when its current-manifest pin loses a pruning race.
+                if (error instanceof SnapshotManifestMissingError)
+                    continue;
+                throw error;
+            }
+        }
+        return new DatabaseTransaction(this.store, begun.record, this.#now, this.#transactionTtlMs, this.#createWeakRef);
     }
     /**
-     * Begins a transaction at the current manifest version and optionally reserves row ids and
-     * auto-increment values in the same step. Stores implementing the atomic `beginTransaction`
-     * pay one storage round trip instead of the version-read/create/reserve sequence; the
-     * read-then-create fallback retries when the version it read is pruned before the record lands.
+     * Begins without a transaction record. By default a renewable reader lease durably pins the
+     * probed manifest until the first two-step stage hands ownership to a transaction record. The
+     * record and lease are both omitted only for internal, uninterrupted single-shot writes that
+     * opt out and publish through `writeTransaction`. For writes whose artifacts need no prior
+     * reservation; `beginWithReservation` is the shape for the rest.
      */
-    async beginWithReservation(reserveRowIds, reserveAutoIncrement) {
-        const id = this.#createId();
-        const batched = this.store.beginTransaction?.bind(this.store);
-        if (batched !== undefined) {
-            const timestamp = this.#now().toISOString();
-            const begun = await batched({
-                record: {
-                    id,
-                    pendingBlockIds: [],
-                    pendingSegmentIds: [],
-                    status: "active",
-                    revision: 0,
-                    startedAt: timestamp,
-                    updatedAt: timestamp,
-                    committedVersion: null,
-                },
-                ...(reserveRowIds === undefined ? {} : { reserveRowIds }),
-                ...(reserveAutoIncrement === undefined ? {} : { reserveAutoIncrement }),
-            });
-            return {
-                transaction: new DatabaseTransaction(this.store, begun.record, this.#now),
-                ...(begun.rowIds === undefined ? {} : { rowIds: begun.rowIds }),
-                ...(begun.autoIncrementValues === undefined
-                    ? {}
-                    : { autoIncrementValues: begun.autoIncrementValues }),
-            };
-        }
+    async beginDeferred(options = {}) {
+        const durableSnapshot = options.durableSnapshot ?? true;
         for (;;) {
-            const currentVersion = await this.store.getCurrentManifestVersion();
-            const timestamp = this.#now().toISOString();
-            const record = {
+            const probe = await this.store.getCatalogProbe();
+            const timestamp = dateIsoString(this.#now());
+            const id = this.#createId();
+            const ownerId = `${id}/owner`;
+            let snapshotLease;
+            if (durableSnapshot) {
+                try {
+                    snapshotLease = await this.openLeasedSnapshot({
+                        id: `${id}/snapshot`,
+                        ownerId,
+                        ttlMs: this.#transactionTtlMs,
+                        version: probe.manifestVersion,
+                    });
+                }
+                catch (error) {
+                    // The version was current at the probe but collection won before the durable pin.
+                    if (error instanceof SnapshotManifestMissingError)
+                        continue;
+                    throw error;
+                }
+            }
+            return new DatabaseTransaction(this.store, {
                 id,
-                snapshotVersion: currentVersion,
+                ownerId,
+                expiresAt: this.#transactionExpiry(),
+                snapshotVersion: probe.manifestVersion,
+                schemaEpochGuard: probe.schemaEpoch,
                 pendingBlockIds: [],
                 pendingSegmentIds: [],
                 status: "active",
@@ -683,29 +1307,58 @@ export class TransactionManager {
                 startedAt: timestamp,
                 updatedAt: timestamp,
                 committedVersion: null,
-            };
+            }, this.#now, this.#transactionTtlMs, this.#createWeakRef, {
+                persisted: false,
+                initialCatalogProbe: probe,
+                ...(snapshotLease === undefined ? {} : { snapshotLease }),
+            });
+        }
+    }
+    /**
+     * Begins a transaction at the current manifest version and optionally reserves row ids and
+     * auto-increment values in the same step. Stores implementing the atomic `beginTransaction`
+     * pay one storage round trip instead of the version-read/create/reserve sequence; the
+     * read-then-create fallback retries when the version it read is pruned before the record lands.
+     */
+    async beginWithReservation(reserveRowIds, reserveAutoIncrement) {
+        const id = this.#createId();
+        const ownerId = `${id}/owner`;
+        const timestamp = dateIsoString(this.#now());
+        let begun;
+        for (;;) {
             try {
-                await this.store.createTransaction(record);
-                const transaction = new DatabaseTransaction(this.store, record, this.#now);
-                const autoIncrementValues = reserveAutoIncrement === undefined
-                    ? undefined
-                    : await this.store.reserveAutoIncrement(reserveAutoIncrement.tableId, reserveAutoIncrement.columnId, reserveAutoIncrement.count, reserveAutoIncrement.atLeast);
-                const rowIds = reserveRowIds === undefined
-                    ? undefined
-                    : await this.store.reserveRowIds(reserveRowIds.tableId, reserveRowIds.count);
-                return {
-                    transaction,
-                    ...(rowIds === undefined ? {} : { rowIds }),
-                    ...(autoIncrementValues === undefined ? {} : { autoIncrementValues }),
-                };
+                begun = await this.store.beginTransaction({
+                    record: {
+                        id,
+                        ownerId,
+                        expiresAt: this.#transactionExpiry(),
+                        pendingBlockIds: [],
+                        pendingSegmentIds: [],
+                        status: "active",
+                        revision: 0,
+                        startedAt: timestamp,
+                        updatedAt: timestamp,
+                        committedVersion: null,
+                    },
+                    ...(reserveRowIds === undefined ? {} : { reserveRowIds }),
+                    ...(reserveAutoIncrement === undefined ? {} : { reserveAutoIncrement }),
+                });
+                break;
             }
             catch (error) {
-                if (error instanceof SnapshotManifestMissingError) {
+                // The store's atomic begin aborted in full, including any counter reservation.
+                if (error instanceof SnapshotManifestMissingError)
                     continue;
-                }
                 throw error;
             }
         }
+        return {
+            transaction: new DatabaseTransaction(this.store, begun.record, this.#now, this.#transactionTtlMs, this.#createWeakRef),
+            ...(begun.rowIds === undefined ? {} : { rowIds: begun.rowIds }),
+            ...(begun.autoIncrementValues === undefined
+                ? {}
+                : { autoIncrementValues: begun.autoIncrementValues }),
+        };
     }
     async resume(transactionId) {
         const record = await this.store.getTransaction(transactionId);
@@ -713,17 +1366,27 @@ export class TransactionManager {
             throw new Error(`Transaction not found: ${transactionId}`);
         if (record.status !== "active")
             throw new TransactionClosedError(transactionId);
-        return new DatabaseTransaction(this.store, record, this.#now);
+        const transaction = new DatabaseTransaction(this.store, record, this.#now, this.#transactionTtlMs, this.#createWeakRef);
+        for (const segmentId of record.pendingSegmentIds) {
+            const segment = await this.store.getSegment(segmentId);
+            if (segment?.level === 0) {
+                transaction.limitLevelZeroSegments(segment.tableId, MAX_LEVEL_ZERO_SEGMENTS);
+            }
+        }
+        await transaction.renew();
+        return transaction;
+    }
+    #transactionExpiry() {
+        return expiryAfter(this.#now(), this.#transactionTtlMs);
     }
     async openSnapshot(version) {
         if (version === null)
-            return new Snapshot(this.store, null, []);
+            return new Snapshot(this.store, null);
         if (version !== undefined)
             return loadSnapshot(this.store, version);
-        const current = await this.store.getCurrentManifest();
-        return new Snapshot(this.store, current?.version ?? null, current?.blockIds ?? []);
+        return new Snapshot(this.store, await this.store.getCurrentManifestVersion());
     }
-    async openLeasedSnapshot(options, knownBlockIds) {
+    async openLeasedSnapshot(options) {
         validateTtl(options.ttlMs);
         if (options.ownerId.trim().length === 0)
             throw new TypeError("Lease owner cannot be empty");
@@ -732,20 +1395,22 @@ export class TransactionManager {
         }
         const id = options.id ?? this.#createId();
         for (;;) {
-            const snapshot = knownBlockIds === undefined
-                ? await this.openSnapshot(options.version)
-                : new Snapshot(this.store, options.version ?? null, knownBlockIds);
+            const snapshot = new Snapshot(this.store, options.version === undefined
+                ? await this.store.getCurrentManifestVersion()
+                : options.version);
+            const createdAt = dateIsoString(this.#now());
             const record = {
                 id,
                 kind: options.kind ?? "reader",
                 manifestVersion: snapshot.version,
                 ownerId: options.ownerId,
-                expiresAt: new Date(this.#now().getTime() + options.ttlMs).toISOString(),
+                createdAt,
+                expiresAt: expiryAfter(new Date(createdAt), options.ttlMs),
                 revision: 0,
             };
             try {
                 await this.store.createLease(record);
-                return new LeasedSnapshot(this.store, snapshot.version, snapshot.listBlockIds(), record, this.#now);
+                return new LeasedSnapshot(this.store, snapshot.version, record, this.#now);
             }
             catch (error) {
                 if (options.version === undefined && error instanceof SnapshotManifestMissingError) {
@@ -763,36 +1428,38 @@ export class TransactionManager {
      * given snapshot is closed on return either way; a missing target manifest throws
      * `SnapshotManifestMissingError` and leaves it open.
      */
-    async moveLeasedSnapshot(snapshot, options, knownBlockIds) {
+    async moveLeasedSnapshot(snapshot, options) {
         validateTtl(options.ttlMs);
         try {
-            const moved = await snapshot.moveTo(options.version, options.ttlMs, knownBlockIds);
+            const moved = await snapshot.moveTo(options.version, options.ttlMs);
             if (moved !== undefined)
                 return moved;
         }
         catch (error) {
-            if (!(error instanceof LeaseConflictError))
+            if (!(error instanceof LeaseConflictError) && !(error instanceof LeaseExpiredError)) {
                 throw error;
+            }
             // Not ours to move any more — swept after expiring, most likely. A fresh lease takes its
             // place; whatever record remains is left to expire rather than deleted from under anyone.
-            const replacement = await this.openLeasedSnapshot(options, knownBlockIds);
+            const replacement = await this.openLeasedSnapshot(options);
             snapshot.discard();
             return replacement;
         }
-        const replacement = await this.openLeasedSnapshot(options, knownBlockIds);
+        const replacement = await this.openLeasedSnapshot(options);
         await snapshot.release();
         return replacement;
     }
     async removeExpiredLeases(at = this.#now()) {
-        const timestamp = at.getTime();
+        const timestamp = dateMilliseconds(at);
         if (!Number.isFinite(timestamp))
             throw new TypeError("Lease cutoff must be a valid date");
         const removed = [];
-        for (const lease of await this.store.listLeases()) {
-            if (Date.parse(lease.expiresAt) > timestamp)
-                continue;
+        const cutoff = dateIsoString(at);
+        const page = await this.store.listExpiredLeasePage(cutoff, this.#leaseCleanupCursor, 64);
+        this.#leaseCleanupCursor = page.nextCursor;
+        for (const lease of page.records) {
             try {
-                if (await this.store.removeLeaseIfExpired(lease.id, lease.revision, at.toISOString())) {
+                if (await this.store.removeLeaseIfExpired(lease.id, lease.revision, cutoff)) {
                     removed.push(lease.id);
                 }
             }
@@ -802,10 +1469,10 @@ export class TransactionManager {
                 throw error;
             }
         }
-        return removed.sort();
+        return removed;
     }
     async recover(options) {
-        const staleBefore = options.staleBefore.getTime();
+        const staleBefore = dateMilliseconds(options.staleBefore);
         if (!Number.isFinite(staleBefore))
             throw new TypeError("Recovery cutoff must be a valid date");
         const abortedTransactionIds = [];
@@ -816,16 +1483,22 @@ export class TransactionManager {
         do {
             const page = await this.store.listTransactionPage(transactionCursor, 64);
             for (const record of page.records) {
-                if (record.status !== "active" || Date.parse(record.updatedAt) >= staleBefore)
+                if (record.status !== "active" || Date.parse(record.expiresAt) > staleBefore)
                     continue;
                 try {
-                    await this.store.updateTransaction(record.id, record.revision, {
-                        status: "aborted",
-                        updatedAt: this.#now().toISOString(),
+                    const aborted = await this.store.abortTransactionIfExpired({
+                        transactionId: record.id,
+                        expectedOwnerId: record.ownerId,
+                        expiresAtCutoff: dateIsoString(options.staleBefore),
+                        updatedAt: dateIsoString(this.#now()),
                     });
+                    if (aborted === undefined) {
+                        skippedTransactionIds.push(record.id);
+                        continue;
+                    }
                     abortedTransactionIds.push(record.id);
-                    record.pendingBlockIds.forEach((id) => candidates.add(id));
-                    record.pendingSegmentIds.forEach((id) => segmentCandidates.add(id));
+                    aborted.pendingBlockIds.forEach((id) => candidates.add(id));
+                    aborted.pendingSegmentIds.forEach((id) => segmentCandidates.add(id));
                 }
                 catch (error) {
                     if (error instanceof TransactionRecordConflictError) {
@@ -846,7 +1519,7 @@ export class TransactionManager {
             retainedSegmentIds.push(...[...segmentCandidates].sort());
         }
         else if (candidates.size > 0 || segmentCandidates.size > 0) {
-            const timestamp = this.#now().toISOString();
+            const timestamp = dateIsoString(this.#now());
             const baseId = `recovery/${timestamp}/${this.#createId()}`;
             let suffix = 0;
             let job;
@@ -879,7 +1552,7 @@ export class TransactionManager {
                         jobId: job.id,
                         expectedRevision: job.revision,
                         maxItems: 128,
-                        updatedAt: this.#now().toISOString(),
+                        updatedAt: dateIsoString(this.#now()),
                     });
                     removedBlockIds.push(...step.reclaimedBlockIds);
                     retainedBlockIds.push(...step.retainedBlockIds);
@@ -908,17 +1581,126 @@ export class TransactionManager {
     }
 }
 function validateTtl(ttlMs) {
-    if (!Number.isFinite(ttlMs) || ttlMs <= 0) {
-        throw new RangeError("Lease lifetime must be a positive number of milliseconds");
+    if (!Number.isFinite(ttlMs) || ttlMs <= 0 || ttlMs > MAX_LEASE_TTL_MS) {
+        throw new RangeError(`Lease lifetime must be a positive number no greater than ${String(MAX_LEASE_TTL_MS)} milliseconds`);
+    }
+}
+function expiryAfter(now, ttlMs) {
+    validateTtl(ttlMs);
+    const expiresAt = dateMilliseconds(now) + ttlMs;
+    if (!Number.isSafeInteger(expiresAt) || expiresAt > 8_640_000_000_000_000) {
+        throw new RangeError("Lease expiry is outside the supported Date range");
+    }
+    return dateIsoString(new Date(expiresAt));
+}
+function advanceRevision(revision, amount) {
+    if (!Number.isSafeInteger(revision) ||
+        revision < 0 ||
+        revision > Number.MAX_SAFE_INTEGER - amount) {
+        throw new RangeError("Transaction revision is outside the safe integer range");
+    }
+    return revision + amount;
+}
+function checkpointByteSum(total, addition) {
+    const next = total + addition;
+    if (!Number.isSafeInteger(next)) {
+        throw new RangeError("Transaction checkpoint size exceeds the safe integer range");
+    }
+    return next;
+}
+function safeWholeNumberSum(values, label) {
+    const total = values.reduce((sum, value) => sum + value, 0);
+    if (!Number.isSafeInteger(total) || total < 0) {
+        throw new RangeError(`${label} exceeds the safe integer range`);
+    }
+    return total;
+}
+function requiredCompactionJobId(id) {
+    if (id === null)
+        throw new Error("Compaction source blocks require a compaction job");
+    return id;
+}
+function sameSegmentArtifacts(left, right) {
+    const leftColumns = Object.keys(left.columnBlockIds).sort();
+    const rightColumns = Object.keys(right.columnBlockIds).sort();
+    const leftSpans = left.rowIdSpans;
+    const rightSpans = right.rowIdSpans;
+    return (left.id === right.id &&
+        left.tableId === right.tableId &&
+        left.rowCount === right.rowCount &&
+        left.rowIdStart === right.rowIdStart &&
+        left.rowIdEndExclusive === right.rowIdEndExclusive &&
+        left.kind === right.kind &&
+        left.keyColumnId === right.keyColumnId &&
+        left.level === right.level &&
+        left.logicalOrder === right.logicalOrder &&
+        left.commitOrdinal === right.commitOrdinal &&
+        left.partitionOrdinal === right.partitionOrdinal &&
+        left.createdAt === right.createdAt &&
+        leftColumns.length === rightColumns.length &&
+        leftColumns.every((columnId, index) => {
+            if (columnId !== rightColumns[index])
+                return false;
+            const leftIds = left.columnBlockIds[columnId] ?? [];
+            const rightIds = right.columnBlockIds[columnId] ?? [];
+            return (leftIds.length === rightIds.length && leftIds.every((id, item) => id === rightIds[item]));
+        }) &&
+        leftSpans.length === rightSpans.length &&
+        leftSpans.every((span, index) => {
+            const other = rightSpans[index];
+            return (span.rowStart === other?.rowStart &&
+                span.rowCount === other.rowCount &&
+                span.rowIdStart === other.rowIdStart);
+        }));
+}
+function transactionBlockBatches(blocks) {
+    const batches = [];
+    let batch = [];
+    let batchBytes = 0;
+    for (const block of blocks) {
+        assertTransactionArtifactBatchLimits([block], []);
+        if (batch.length === MAX_TRANSACTION_STAGE_BLOCKS ||
+            batchBytes + block.bytes.byteLength > MAX_TRANSACTION_STAGE_BYTES) {
+            batches.push(batch);
+            batch = [];
+            batchBytes = 0;
+        }
+        batch.push(block);
+        batchBytes += block.bytes.byteLength;
+    }
+    if (batch.length > 0)
+        batches.push(batch);
+    return batches;
+}
+function transactionArtifactBatches(blocks, segments) {
+    let blockBytes = 0;
+    for (const block of blocks) {
+        assertTransactionArtifactBatchLimits([block], []);
+        blockBytes += block.bytes.byteLength;
+    }
+    if (blocks.length <= MAX_TRANSACTION_STAGE_BLOCKS &&
+        segments.length <= MAX_TRANSACTION_STAGE_SEGMENTS &&
+        blockBytes <= MAX_TRANSACTION_STAGE_BYTES) {
+        return [{ blocks, segments }];
+    }
+    const batches = transactionBlockBatches(blocks).map((batch) => ({
+        blocks: batch,
+        segments: [],
+    }));
+    for (let start = 0; start < segments.length; start += MAX_TRANSACTION_STAGE_SEGMENTS) {
+        batches.push({
+            blocks: [],
+            segments: segments.slice(start, start + MAX_TRANSACTION_STAGE_SEGMENTS),
+        });
     }
+    return batches;
 }
 async function loadSnapshot(store, version) {
     if (version === null)
-        return new Snapshot(store, null, []);
+        return new Snapshot(store, null);
     const manifest = await store.getManifest(version);
     if (manifest === undefined || manifest.prunedAt !== undefined) {
         throw new SnapshotManifestMissingError(version);
     }
-    return new Snapshot(store, manifest.version, manifest.blockIds);
+    return new Snapshot(store, manifest.version);
 }
-//# sourceMappingURL=index.js.map