@minnowdb/core 0.3.0 → 0.4.1

package/dist/storage/types.d.ts

@@ -1,16 +1,21 @@
-import type { DatabaseSnapshot, SnapshotLoadProgress } from "./snapshot.js";
 export declare const storeNames: readonly ["catalog", "manifests", "segments", "blocks", "transactions", "leases", "statistics", "temp", "gc"];
-/** The manifest fields every commit publishes; `Manifest` adds the resolved block list. */
+export declare const MAX_MANIFEST_CHANGED_TABLE_IDS = 1024;
+export declare function canonicalManifestChangedTableIds(ids: readonly string[]): string[];
+export declare function validateCanonicalManifestChangedTableIds(ids: readonly string[]): string[];
+/**
+ * The bounded manifest record every commit publishes. Block membership is paged separately;
+ * reading this record must never materialize a database-sized ID array.
+ */
 export interface ManifestSummary {
     version: number;
     previousVersion: number | null;
     createdAt: string;
-    /**
-     * Table IDs whose logical content this commit changed; empty means a logical no-change such as
-     * compaction. Absent on manifests written before change tracking, which readers treat as
-     * potentially changing every table.
-     */
-    changedTableIds?: string[];
+    /** Exact live payload membership cardinality at this version. */
+    liveBlockCount: number;
+    /** Exact sum of stored payload bytes in the live membership at this version. */
+    liveBlockBytes: number;
+    /** Table IDs whose logical content changed; empty means compaction or another logical no-op. */
+    changedTableIds: string[];
     /** A pruned descriptor remains readable for commit reconciliation but cannot be pinned. */
     prunedAt?: string;
     /**
@@ -24,34 +29,80 @@ export interface ManifestSummary {
         count: number;
     }>;
 }
-export interface Manifest extends ManifestSummary {
-    blockIds: string[];
-}
+/** Public/cold manifest inspection is bounded metadata only. */
+export type Manifest = ManifestSummary;
 /**
- * The stored manifest shape: a checkpoint carries the complete sorted block list; a delta
- * carries only this commit's added and removed ids plus its distance from the checkpoint below
- * it. Reads resolve a version by walking back to the nearest checkpoint and applying deltas
- * forward, so publishing a commit writes O(changed blocks) instead of rewriting every live
- * block id. Pruning first tombstones records; maintenance later deletes only the obsolete prefix
- * below the checkpoint that the earliest readable version needs.
+ * One payload's bounded manifest-membership interval. The block is visible at version `v` iff
+ * `addedVersion <= v && (removedVersion === null || v < removedVersion)`. `byteLength` and the
+ * payload bytes are immutable while this record exists; `removedVersion`, when present, is
+ * strictly greater than `addedVersion`.
+ *
+ * A retired ID cannot be added again while this provenance record or a transaction/job that
+ * names it is retained. Once every readable/pinned version in the interval and every recovery
+ * root is gone, garbage collection removes payload and provenance together; no immortal ID
+ * tombstone is required.
  */
-export interface StoredManifestRecord extends ManifestSummary {
-    blockIds?: string[];
-    addedBlockIds?: string[];
-    removedBlockIds?: string[];
-    /** Deltas since the checkpoint below; 0 on checkpoints. */
-    deltaDepth?: number;
-}
-/** Every this-many commits the store writes a full checkpoint instead of a delta. */
-export declare const MANIFEST_CHECKPOINT_INTERVAL = 32;
-/** Applies one stored record to a running block set (checkpoint replaces, delta mutates). */
-export declare function applyManifestRecord(blockIds: Set<string>, record: StoredManifestRecord): void;
-export interface PublishManifestInput {
-    changedTableIds?: readonly string[];
+export interface ManifestBlockRecord {
+    readonly blockId: string;
+    readonly byteLength: number;
+    /** CRC-32 of the exact stored payload, computed once before the first durable write. */
+    readonly checksum: number;
+    readonly addedVersion: number;
+    readonly removedVersion: number | null;
+}
+export interface ListManifestBlockPageInput {
+    readonly version: number;
+    readonly afterBlockId: string | null;
+    readonly limit: number;
+}
+export interface ListRetiredManifestBlockPageInput {
+    /** Includes records retired at or before this published version. */
+    readonly removedThroughVersion: number;
+    readonly afterBlockId: string | null;
+    readonly limit: number;
+}
+export interface ManifestBlockPage {
+    readonly records: ReadonlyArray<Pick<ManifestBlockRecord, "blockId" | "byteLength" | "checksum">>;
+    readonly nextCursor: string | null;
+}
+/** Input for adapter-internal manifest construction; not a public store mutation. */
+export interface CreateManifestInput {
+    changedTableIds: readonly string[];
     expectedVersion: number | null;
-    blockIds: readonly string[];
+    liveBlockCount: number;
+    liveBlockBytes: number;
     createdAt?: string;
 }
+/**
+ * The stored manifest is the same bounded summary returned publicly. Exact block membership is
+ * represented once by `ManifestBlockRecord` intervals; checkpoint/delta arrays are deliberately
+ * absent from the v1 layout.
+ */
+export type StoredManifestRecord = ManifestSummary;
+/**
+ * One atomic user-table drop. The store compares both catalog and manifest revisions, derives
+ * every block that the table's segments still contribute to that exact manifest, publishes one
+ * successor without those blocks, and removes all table-owned metadata in the same durable
+ * step. Stored block payloads remain for lease-aware collection.
+ */
+export interface DropTableInput {
+    tableId: string;
+    expectedTableRevision: number;
+    expectedManifestVersion: number | null;
+    /** Catalog epoch of the complete dependency proof used to authorize this drop. */
+    expectedCatalogEpoch: number;
+    committedAt: string;
+}
+/** One atomic column retirement; see `CatalogStore.dropTableColumn`. */
+export interface DropTableColumnInput {
+    tableId: string;
+    columnId: string;
+    expectedTableRevision: number;
+    expectedManifestVersion: number | null;
+    /** Catalog epoch of the complete dependency proof used to authorize this drop. */
+    expectedCatalogEpoch: number;
+    committedAt: string;
+}
 export declare const simpleDataTypes: readonly ["boolean", "number", "string", "datetime"];
 export type SimpleDataType = (typeof simpleDataTypes)[number];
 /** PostgreSQL logical domains layered over the four stable physical block encodings. */
@@ -124,6 +175,14 @@ export interface TableColumnRecord {
     /** Engine-generated row-addressing column; stored and indexed, never exposed as SQL schema. */
     hidden?: true;
 }
+export declare const MAX_TABLE_COLUMNS = 1024;
+export declare const MAX_ENUM_VALUES = 4096;
+export declare const MAX_SECONDARY_INDEXES = 1024;
+export declare const MAX_TABLE_TRIGGERS = 256;
+export declare const MAX_TRIGGER_STATEMENTS = 256;
+export declare const MAX_TABLE_CONSTRAINTS = 1024;
+export declare const MAX_TABLE_RECORD_CHARACTERS = 1048576;
+export declare const MAX_TABLE_RECORD_ENTRIES = 65536;
 /**
  * The single authority on which enum declarations are legal, shared by the schema DSL's
  * `column.enum()` and the engine's `createTable`: at least one value, every value a non-empty
@@ -178,18 +237,18 @@ export type SecondaryIndexDirection = "asc" | "desc";
  */
 export interface SecondaryIndexRecord {
     name: string;
-    /** First indexed column, retained so catalogs written by the single-column release stay valid. */
+    /** First indexed column, repeated for constant-time scalar catalog access. */
     columnId: string;
-    /** Ordered key columns. Missing on legacy records, where `columnId` is the complete key. */
-    columnIds?: string[];
-    /** Declared key direction per column. Missing legacy entries are ascending. */
-    directions?: SecondaryIndexDirection[];
+    /** Ordered key columns. */
+    columnIds: string[];
+    /** Declared key direction per column. */
+    directions: SecondaryIndexDirection[];
     /** SQL UNIQUE: enforced through an atomic, separately namespaced membership set. */
     unique?: true;
     /** The membership set has been seeded and must be enforced, independent of postings state. */
     uniqueEnforced?: true;
-    /** Legacy scalar terms or the prefix-free composite encoding used by newly created indexes. */
-    termEncoding?: "tuple-v1";
+    /** Prefix-free composite encoding used by every v1 secondary index. */
+    termEncoding: "tuple-v1";
     storage: "postings-v1";
     storageColumnId: string;
     locator: "row-id" | "key-hash-v1";
@@ -199,6 +258,12 @@ export interface SecondaryIndexRecord {
     /** Manifest version the base build covers; commit deltas above it merge at read time. */
     buildFromVersion: number;
 }
+/**
+ * Whether a secondary-index replacement changes the contract a staged writer must honor.
+ * Physical posting-build state is deliberately excluded: postings are only a reverified pruning
+ * accelerator. Index identity, key shape, and UNIQUE enforcement are structural.
+ */
+export declare function secondaryIndexWriteContractChanged(previous: Readonly<Record<string, SecondaryIndexRecord>> | null | undefined, next: Readonly<Record<string, SecondaryIndexRecord>> | null | undefined): boolean;
 export interface TableRecord {
     id: string;
     name: string;
@@ -211,16 +276,14 @@ export interface TableRecord {
     ftsColumns?: Record<string, FtsColumnIndexRecord>;
     /** Durable secondary indexes keyed by stable index ID. */
     secondaryIndexes?: Record<string, SecondaryIndexRecord>;
-    /** AFTER triggers on this table, fired by the committing writer inside its transaction. */
+    /** BEFORE/AFTER triggers on this table, fired by the committing writer in its transaction. */
     triggers?: TriggerRecord[];
-    /** FOREIGN KEY constraints. Missing arrays are legacy single-column records. */
+    /** FOREIGN KEY constraints. Column tuples are always explicit, including scalar keys. */
     foreignKeys?: Array<{
         name: string;
-        column: string;
-        columns?: string[];
+        columns: string[];
         parentTable: string;
-        parentColumn: string;
-        parentColumns?: string[];
+        parentColumns: string[];
         onDelete: "restrict" | "cascade" | "set null";
     }>;
     /**
@@ -234,12 +297,10 @@ export interface TableRecord {
     }>;
     /**
      * True when `migrate()` created this table from a schema declaration, which makes the schema
-     * authoritative over it: dropping the declaration may drop the table. A table created with
-     * `CREATE TABLE`, or one written before this field existed, is absent-or-false and no
-     * migration removes it — the same rule views follow, and it matters more here because a
-     * table holds rows.
+     * authoritative over it: dropping the declaration may drop the table. `CREATE TABLE` records
+     * false explicitly.
      */
-    managed?: boolean;
+    managed: boolean;
     /**
      * A view rather than a table: the query text it stands for, and no segments of its own. The
      * `columns` are the query's inferred output schema, so a view answers the same catalog
@@ -248,12 +309,10 @@ export interface TableRecord {
     view?: {
         sql: string;
         /**
-         * True when `migrate()` created this view from a schema declaration, which makes the schema
-         * authoritative over it: dropping the declaration drops the view. A view created with
-         * `CREATE VIEW`, or one written before this field existed, is absent-or-false and no
-         * migration will remove it.
+         * True when `migrate()` created this view from a schema declaration. `CREATE VIEW` records
+         * false explicitly.
          */
-        managed?: boolean;
+        managed: boolean;
     };
     /** Internal catalog object backing CREATE TYPE ... AS ENUM; never exposed as a table. */
     enumType?: {
@@ -267,23 +326,36 @@ export interface TableRecord {
         columnId: string;
     };
     createdAt: string;
-    /** Compare-and-swap revision for catalog evolution; records written before it read as 0. */
-    revision?: number;
+    /** Compare-and-swap revision for catalog evolution. */
+    revision: number;
 }
+/** Exact UTF-8 bytes used when the canonical record-wire JSON codec persists a table record. */
+export declare function catalogRecordRetainedBytes(record: TableRecord): number;
+export declare function manifestRecordRetainedBytes(record: Manifest): number;
+/**
+ * Admission charge for one manifest summary, including the exact canonical tombstone bytes that
+ * later reclamation may add. Reserving them up front prevents quota deadlock at the byte ceiling.
+ */
+export declare function manifestRecordRetainedReservationBytes(record: Manifest): number;
+export declare function segmentRecordRetainedBytes(record: SegmentRecord): number;
+/** Hard catalog cardinality/text bounds shared by engine, adapters, checkpoints, and snapshots. */
+export declare function validateTableRecordBounds(record: TableRecord): void;
 /** Validates the durable identities and ownership rules of one table's secondary indexes. */
 export declare function validateSecondaryIndexes(record: TableRecord): void;
-/** Ordered catalog column IDs for legacy and current secondary-index records. */
+/** Ordered catalog column IDs for one canonical secondary-index record. */
 export declare function secondaryIndexColumnIds(index: SecondaryIndexRecord): readonly string[];
-/** Declared directions for legacy and current secondary-index records. */
+/** Declared directions for one canonical secondary-index record. */
 export declare function secondaryIndexDirections(index: SecondaryIndexRecord): readonly SecondaryIndexDirection[];
 /** Unique-membership namespace owned by one physical secondary index. */
 export declare function secondaryUniqueKeyNamespace(tableId: string, indexId: string): string;
 /**
- * One AFTER trigger: catalog-persisted on its table record so the catalog epoch makes it
+ * One row trigger: catalog-persisted on its table record so the catalog epoch makes it
  * visible to every tab immediately, and executed by the committing writer inside the same
  * transaction as the triggering write — the write and its derivations publish atomically.
  */
 export interface TriggerRecord {
+    /** Immutable durable identity. Names may be reused only after this trigger is gone. */
+    id: string;
     name: string;
     event: "insert" | "update" | "delete";
     /**
@@ -312,7 +384,25 @@ export declare class TableRecordConflictError extends Error {
     readonly name = "TableRecordConflictError";
     constructor(tableId: string, expectedRevision: number, actualRevision: number | null);
 }
+/** A catalog drop lost a race with durable work that still owns records for the table. */
+export declare class TableInUseError extends Error {
+    readonly tableId: string;
+    readonly ownerKind: "transaction" | "compaction job" | "foreign key" | "pending foreign key" | "accelerator build";
+    readonly ownerId: string;
+    readonly name = "TableInUseError";
+    constructor(tableId: string, ownerKind: "transaction" | "compaction job" | "foreign key" | "pending foreign key" | "accelerator build", ownerId: string);
+}
+/** Refuses a commit that would cross the persisted level-zero fragmentation safety ceiling. */
+export declare class CompactionBacklogError extends Error {
+    readonly tableName: string;
+    readonly levelZeroSegments: number;
+    readonly limit: number;
+    readonly name = "CompactionBacklogError";
+    constructor(tableName: string, levelZeroSegments: number, limit: number);
+}
 export type SegmentKind = "insert" | "upsert" | "update" | "delete" | "base";
+/** Absolute visible level-zero ceiling; every commit that adds L0 must enforce this or lower. */
+export declare const MAX_LEVEL_ZERO_SEGMENTS = 4096;
 /** Maps a contiguous segment-row run to its immutable hidden row IDs. */
 export interface RowIdSpan {
     readonly rowStart: number;
@@ -327,20 +417,17 @@ export interface SegmentRecord {
     rowIdStart: bigint;
     rowIdEndExclusive: bigint;
     columnBlockIds: Record<string, string[]>;
-    kind?: SegmentKind;
+    kind: SegmentKind;
     keyColumnId?: string;
-    /** Missing on legacy records, which are interpreted as level zero. */
-    level?: number;
-    /** Missing on legacy records, where commit order supplies the logical order. */
-    logicalOrder?: number;
+    level: number;
+    logicalOrder: number;
     /**
      * Staging position inside the owning transaction. Orders segments of one commit relative
-     * to each other (an in-scope update must fold after the in-scope insert it patches);
-     * missing on legacy records, which never shared a key within one commit.
+     * to each other (an in-scope update must fold after the in-scope insert it patches).
      */
-    commitOrdinal?: number;
-    /** Missing on legacy insert/upsert records, which imply one contiguous row-ID span. */
-    rowIdSpans?: readonly RowIdSpan[];
+    commitOrdinal: number;
+    /** Empty for a contiguous row-ID envelope; merged bases record every retained range. */
+    rowIdSpans: readonly RowIdSpan[];
     /** Monotone policy ordinal for an immutable append-row-range level-two partition. */
     readonly partitionOrdinal?: number;
     createdAt: string;
@@ -349,15 +436,82 @@ export interface RowIdRange {
     start: bigint;
     endExclusive: bigint;
 }
+/** Largest persisted row ID/posting value; the wire format is canonical unsigned 64-bit. */
+export declare const MAX_ROW_ID: bigint;
+/** One past `MAX_ROW_ID`, allowed only for exclusive range/counter ends. */
+export declare const MAX_ROW_ID_EXCLUSIVE_END: bigint;
+/** Auto-increment values are exposed as exact JavaScript numbers and therefore stop here. */
+export declare const MAX_AUTO_INCREMENT_VALUE: bigint;
+export declare const MAX_AUTO_INCREMENT_EXCLUSIVE_END: bigint;
 export type LeaseKind = "reader" | "backup";
+/** A live owner renews; an abandoned durable pin expires within one hour. */
+export declare const MAX_LEASE_TTL_MS: number;
+/** Durable resource ceilings; adapters sweep expired owners before atomically refusing creation. */
+export declare const MAX_ACTIVE_LEASES = 4096;
+export declare const MAX_ACTIVE_TEMP_OWNERS = 1024;
+export declare const MAX_TEMP_RUNS_PER_OWNER = 1024;
+export declare const MAX_TEMP_PAGES_PER_OWNER = 16384;
+export declare const MAX_TEMP_RUNS_TOTAL = 65536;
+export declare const MAX_TEMP_PAGES_TOTAL = 262144;
+export declare const MAX_TEMP_BYTES_PER_OWNER: number;
+export declare const MAX_TEMP_BYTES_TOTAL: number;
+export declare const MAX_ACTIVE_COMPACTION_JOBS = 1024;
+export declare const MAX_ACTIVE_GARBAGE_COLLECTION_JOBS = 1;
+export declare const MAX_ACTIVE_UNIQUE_KEY_BUILDS = 1024;
+export declare const MAX_ACTIVE_FTS_BASE_BUILDS = 128;
+export declare const MAX_ACTIVE_SECONDARY_INDEX_BUILDS = 128;
+export declare const MAX_ACCELERATOR_BUILD_STAGED_BYTES_TOTAL: number;
+export declare const MAX_ACCELERATOR_BUILD_STAGED_ENTRIES_TOTAL = 16777216;
+export declare const MAX_ACTIVE_TRANSACTIONS = 4096;
+export declare const MAX_GLOBAL_STAGED_ARTIFACT_BYTES: number;
+export declare const MAX_GLOBAL_STAGED_BLOCKS = 65536;
+export declare const MAX_GLOBAL_STAGED_SEGMENTS = 65536;
+/** Catalog enumeration remains bounded even for cold public inspection APIs. */
+export declare const MAX_CATALOG_RECORDS = 4096;
+/** Total canonical UTF-8 record-wire bytes retained by the durable catalog. */
+export declare const MAX_CATALOG_RETAINED_BYTES: number;
+export declare const MAX_MANIFEST_RECORDS = 65536;
+export declare const MAX_MANIFEST_RETAINED_BYTES: number;
+export declare const MAX_SEGMENT_RECORDS = 1048576;
+export declare const MAX_SEGMENT_RETAINED_BYTES: number;
+/** Durable diagnostic/provenance tails are pruned before admitting more terminal records. */
+export declare const MAX_TERMINAL_TRANSACTION_RECORDS = 65536;
+export declare const MAX_TERMINAL_COMPACTION_JOB_RECORDS = 4096;
+export declare const MAX_COMPLETED_GARBAGE_COLLECTION_JOB_RECORDS = 1024;
+/** An old renewable pin may not force unbounded history retention while writes continue. */
+export declare const MAX_PINNED_MANIFEST_VERSION_LAG = 4096;
+export declare const MAX_PINNED_RETIRED_BLOCKS = 65536;
+export declare const MAX_PINNED_RETIRED_BYTES: number;
+/** Total obsolete physical history is refused before it can consume an origin indefinitely. */
+export declare const MAX_RETIRED_HISTORY_BYTES: number;
+/** A durable resource family reached its fixed corruption/growth safety ceiling. */
+export declare class StorageResourceLimitError extends Error {
+    readonly resource: "lease" | "temp owner" | "temp run" | "temp page" | "temporary run total" | "temporary page total" | "temp owner byte" | "temporary byte" | "compaction job" | "garbage collection job" | "unique-key build" | "full-text build" | "secondary-index build" | "accelerator build byte" | "accelerator build entry" | "transaction" | "staged artifact byte" | "staged block" | "staged segment" | "catalog record" | "catalog byte" | "manifest record" | "manifest byte" | "segment record" | "segment byte" | "terminal transaction" | "terminal compaction job" | "completed garbage collection job" | "pinned manifest version lag" | "pinned retired block" | "pinned retired byte" | "snapshot accelerator byte" | "snapshot accelerator entry" | "retired history byte";
+    readonly count: number;
+    readonly limit: number;
+    readonly name = "StorageResourceLimitError";
+    constructor(resource: "lease" | "temp owner" | "temp run" | "temp page" | "temporary run total" | "temporary page total" | "temp owner byte" | "temporary byte" | "compaction job" | "garbage collection job" | "unique-key build" | "full-text build" | "secondary-index build" | "accelerator build byte" | "accelerator build entry" | "transaction" | "staged artifact byte" | "staged block" | "staged segment" | "catalog record" | "catalog byte" | "manifest record" | "manifest byte" | "segment record" | "segment byte" | "terminal transaction" | "terminal compaction job" | "completed garbage collection job" | "pinned manifest version lag" | "pinned retired block" | "pinned retired byte" | "snapshot accelerator byte" | "snapshot accelerator entry" | "retired history byte", count: number, limit: number);
+}
 export interface LeaseRecord {
     id: string;
     kind: LeaseKind;
     manifestVersion: number | null;
     ownerId: string;
+    /** Issuance cutoff used to prove the initial expiry is bounded. */
+    createdAt: string;
     expiresAt: string;
     revision: number;
 }
+export interface RenewLeaseInput {
+    id: string;
+    expectedRevision: number;
+    /** A persisted expiry at or before this boundary is irrevocably expired. */
+    expiresAtCutoff: string;
+    expiresAt: string;
+}
+export interface MoveLeaseInput extends RenewLeaseInput {
+    manifestVersion: number | null;
+}
 export declare const compactionJobStates: readonly ["planned", "running", "ready", "published", "cancelled", "aborted"];
 export type CompactionJobState = (typeof compactionJobStates)[number];
 export interface CompactionJobCursor {
@@ -501,19 +655,18 @@ export interface CompactionJobRecord {
     sourceStoredBytes: number;
     outputStoredBytes: number;
     logicalBytes: number;
-    /** Missing on Phase 6A records, which normalize to copy-v1. */
-    readonly rewritePlan?: CompactionRewritePlan;
+    readonly rewritePlan: CompactionRewritePlan;
     /** Null for copy-v1; points at the next output for rechunk-v1. */
-    outputCursor?: CompactionOutputCursor | null;
+    outputCursor: CompactionOutputCursor | null;
     /** Immutable execution budget. Zero for copy-v1 jobs. */
-    readonly memoryBudgetBytes?: number;
+    readonly memoryBudgetBytes: number;
     /** Immutable planner estimate. Zero for copy-v1 jobs. */
-    readonly minimumMemoryBytes?: number;
-    /** Immutable stored bytes from newly promoted level-zero sources. Missing on legacy jobs. */
-    readonly level0SourceStoredBytes?: number;
-    /** Immutable stored bytes from the retained level-one anchor. Missing on legacy jobs. */
-    readonly anchorSourceStoredBytes?: number;
-    /** Output partition assigned by the append-row-range L2 policy. Missing on legacy jobs. */
+    readonly minimumMemoryBytes: number;
+    /** Immutable stored bytes from newly promoted level-zero sources. */
+    readonly level0SourceStoredBytes: number;
+    /** Immutable stored bytes from the retained level-one anchor. */
+    readonly anchorSourceStoredBytes: number;
+    /** Output partition assigned by the append-row-range L2 policy. */
     readonly outputPartitionOrdinal?: number;
     /** Immutable maximum compaction output bytes per newly promoted L0 byte. */
     readonly maxWriteAmplification?: number;
@@ -527,8 +680,8 @@ export interface CompactionJobRecord {
      * write-amplification budget.
      */
     readonly priorAttemptOutputStoredBytes?: number;
-    peakWorkingBytes?: number;
-    outputLogicalBytes?: number;
+    peakWorkingBytes: number;
+    outputLogicalBytes: number;
     targetLevel: number;
     state: CompactionJobState;
     transactionId: string | null;
@@ -556,6 +709,16 @@ export interface CompactionJobRecordUpdate {
     updatedAt: string;
     error?: string | null;
 }
+/** Every segment ID owned by a compaction job, including merge partition outputs. */
+export declare function compactionOutputSegmentIds(job: Pick<CompactionJobRecord, "outputSegmentId" | "rewritePlan">): string[];
+/**
+ * Proves that a compaction transaction stages exactly the immutable job output. This is kept in
+ * the storage contract (rather than only in the engine) so adapters reject forged, reordered, or
+ * partially journaled output before publication and while loading durable state.
+ */
+export declare function assertCompactionOutputProvenance(job: CompactionJobRecord, table: TableRecord, transaction: Pick<TransactionRecord, "id" | "pendingBlockIds" | "pendingSegmentIds">, sourceSegments: readonly SegmentRecord[], outputSegments: readonly SegmentRecord[], options?: {
+    readonly allowOutputPrefix?: boolean;
+}): void;
 export declare class CompactionJobConflictError extends Error {
     readonly jobId: string;
     readonly expectedRevision: number;
@@ -591,6 +754,52 @@ export interface CreateGarbageCollectionJobInput {
     /** Fixed cutoff used to decide which persisted leases protect a manifest for this job. */
     leaseCutoff: string;
     createdAt: string;
+    /** Present while bounded discovery is still paging durable metadata. */
+    discovery?: GarbageCollectionDiscovery;
+}
+export type GarbageCollectionDiscoveryPhase = "manifests" | "manifest-blocks" | "segments" | "transactions" | "compactions" | "complete";
+export interface GarbageCollectionDiscovery {
+    phase: GarbageCollectionDiscoveryPhase;
+    currentManifestVersion: number | null;
+    retainAboveVersion: number;
+    retainAfter: number;
+    maxPlanningItems: number;
+    manifestCursor: number | null;
+    segmentCursor: string | null;
+    transactionCursor: string | null;
+    compactionCursor: string | null;
+    visitedRecords: number;
+    /**
+     * When a bounded candidate array fills, reclamation completes this job and the next job
+     * resumes this discovery phase instead of restarting at the beginning.
+     */
+    resumePhase?: Exclude<GarbageCollectionDiscoveryPhase, "complete"> | null;
+    /** Older continuation resumed only after this job first discovers newly eligible manifests. */
+    postManifestPhase?: Exclude<GarbageCollectionDiscoveryPhase, "complete" | "manifests"> | null;
+    /** Exact within-record provenance offset; every named artifact is examined at most once. */
+    artifactCursor?: GarbageCollectionArtifactCursor | null;
+}
+export interface GarbageCollectionArtifactCursor {
+    family: "manifest" | "transaction" | "compaction";
+    /** Decimal manifest version for `manifest`; durable record ID for the other families. */
+    recordId: string;
+    /** Exact lexical manifest-membership cursor; null for transaction/compaction arrays. */
+    blockId: string | null;
+    blockIndex: number;
+    segmentIndex: number;
+}
+/** Absolute per-call bound for durable maintenance candidate arrays and storage transactions. */
+export declare const MAX_MAINTENANCE_BATCH_ITEMS = 1024;
+export declare function boundedMaintenanceBatchItems(value: number, label: string): number;
+export interface UpdateGarbageCollectionPlanningInput {
+    jobId: string;
+    expectedRevision: number;
+    candidateManifestVersions?: readonly number[];
+    candidateSegmentIds?: readonly string[];
+    candidateBlockIds?: readonly string[];
+    candidateTransactionIds?: readonly string[];
+    discovery: GarbageCollectionDiscovery;
+    updatedAt: string;
 }
 export interface GarbageCollectionJobRecord {
     id: string;
@@ -618,6 +827,8 @@ export interface GarbageCollectionJobRecord {
     leaseCutoff: string;
     createdAt: string;
     updatedAt: string;
+    /** Omitted only for explicitly supplied bounded candidate jobs; no discovery scan is needed. */
+    discovery?: GarbageCollectionDiscovery;
 }
 export interface RunGarbageCollectionStepInput {
     jobId: string;
@@ -686,9 +897,29 @@ export declare class LeaseConflictError extends Error {
     readonly name = "LeaseConflictError";
     constructor(leaseId: string, expectedRevision: number, actualRevision: number | null);
 }
+/** A renewal/move cutoff reached the persisted expiry; expiry is irrevocable. */
+export declare class LeaseExpiredError extends Error {
+    readonly leaseId: string;
+    readonly expiresAt: string;
+    readonly expiresAtCutoff: string;
+    readonly name = "LeaseExpiredError";
+    constructor(leaseId: string, expiresAt: string, expiresAtCutoff: string);
+}
+/** Refuses a lease release from a different durable owner. */
+export declare class LeaseOwnerConflictError extends Error {
+    readonly leaseId: string;
+    readonly expectedOwnerId: string;
+    readonly actualOwnerId: string;
+    readonly name = "LeaseOwnerConflictError";
+    constructor(leaseId: string, expectedOwnerId: string, actualOwnerId: string);
+}
 export type TransactionStatus = "active" | "committed" | "aborted";
 export interface TransactionRecord {
     id: string;
+    /** Stable writer identity; liveness renewals never contend on the data revision. */
+    ownerId: string;
+    /** Durable writer liveness deadline. Expired active records are atomically aborted by GC. */
+    expiresAt: string;
     snapshotVersion: number | null;
     pendingBlockIds: string[];
     pendingSegmentIds: string[];
@@ -697,6 +928,33 @@ export interface TransactionRecord {
     startedAt: string;
     updatedAt: string;
     committedVersion: number | null;
+    /**
+     * Structural catalog epoch captured atomically with the transaction snapshot. Every active
+     * transaction carries this storage-owned guard; commit rejects it if DDL changed the schema
+     * used to prepare the staged artifacts. Terminal records drop the guard.
+     */
+    schemaEpochGuard?: number;
+    /**
+     * Catalog record owned exclusively by this active transaction. It is invisible to catalog
+     * reads until commit; abort/expiry discards the reservation with the transaction.
+     */
+    pendingTable?: TableRecord;
+    /** Next row id for the pending table, advanced atomically as insert artifacts stage. */
+    pendingTableNextRowId?: bigint;
+    /** Catalog epoch captured atomically when the pending table was admitted. */
+    catalogEpochGuard?: number;
+}
+export interface AbortTransactionIfExpiredInput {
+    transactionId: string;
+    expectedOwnerId: string;
+    expiresAtCutoff: string;
+    updatedAt: string;
+}
+export interface RenewTransactionInput {
+    transactionId: string;
+    ownerId: string;
+    expiresAtCutoff: string;
+    expiresAt: string;
 }
 export interface TransactionRecordUpdate {
     snapshotVersion?: number | null;
@@ -705,10 +963,15 @@ export interface TransactionRecordUpdate {
     status?: TransactionStatus;
     updatedAt: string;
     committedVersion?: number | null;
+    /** Storage-owned advancement while staging rows for a pending table. */
+    pendingTableNextRowId?: bigint;
 }
 export interface BeginTransactionInput {
-    /** Record to create; the store stamps `snapshotVersion` with the current manifest version. */
-    record: Omit<TransactionRecord, "snapshotVersion">;
+    /**
+     * Record to create; the store atomically stamps both `snapshotVersion` and
+     * `schemaEpochGuard` from its current state.
+     */
+    record: Omit<TransactionRecord, "snapshotVersion" | "schemaEpochGuard">;
     /** Reserve this many row ids for the table in the same atomic step. */
     reserveRowIds?: {
         tableId: string;
@@ -724,6 +987,15 @@ export interface BeginTransactionInput {
         count: number;
         atLeast?: bigint;
     };
+    /**
+     * Reserves one invisible catalog record and its initial row-id state in the same atomic step.
+     * The expected epoch closes schema/FK races between planning and begin; commit rechecks it.
+     */
+    pendingTable?: {
+        record: TableRecord;
+        nextRowId: bigint;
+        expectedCatalogEpoch: number;
+    };
 }
 export interface BeginTransactionResult {
     record: TransactionRecord;
@@ -737,6 +1009,332 @@ export interface StageTransactionArtifactsInput {
     segments: readonly SegmentRecord[];
     updatedAt: string;
 }
+/** Maximum immutable payloads accepted by one atomic staging/WAL operation. */
+export declare const MAX_TRANSACTION_STAGE_BLOCKS = 64;
+/** Maximum segment records accepted by one atomic staging/WAL operation. */
+export declare const MAX_TRANSACTION_STAGE_SEGMENTS = 64;
+/**
+ * Maximum block bytes accepted by one atomic staging/WAL operation. The limit still admits one
+ * maximum-size physical block; callers split collections of smaller blocks into bounded calls.
+ */
+export declare const MAX_TRANSACTION_STAGE_BYTES: number;
+/** Durable journal ceilings prevent a forgotten or hostile transaction growing without bound. */
+export declare const MAX_TRANSACTION_PENDING_BLOCKS = 4096;
+export declare const MAX_TRANSACTION_PENDING_SEGMENTS = 4096;
+/** Storage-boundary preflight shared by staging and single-shot write implementations. */
+export declare function assertTransactionArtifactBatchLimits(blocks: readonly BlockWrite[], segments: readonly SegmentRecord[]): void;
+/** Preflight for the complete persisted journal after a bounded staging operation. */
+export declare function assertTransactionArtifactJournalLimits(pendingBlockIds: readonly string[], pendingSegmentIds: readonly string[]): void;
+/**
+ * Atomically rewinds one active transaction's artifact journal to an earlier set and removes
+ * exactly the artifacts that are no longer reachable. Journals are canonically sorted, so an
+ * adapter validates the retained and removed lists as a duplicate-free, disjoint, exact
+ * partition of its current journal before changing records or bytes.
+ */
+export interface RollbackTransactionArtifactsInput {
+    transactionId: string;
+    expectedRevision: number;
+    pendingBlockIds: readonly string[];
+    pendingSegmentIds: readonly string[];
+    removeBlockIds: readonly string[];
+    removeSegmentIds: readonly string[];
+    updatedAt: string;
+}
+export type StorageIntegrityMode = "metadata" | "full";
+export interface StorageIntegrityIssue {
+    readonly code: string;
+    readonly location: string;
+    readonly message: string;
+}
+export interface StorageIntegrityReport {
+    readonly mode: StorageIntegrityMode;
+    readonly ok: boolean;
+    readonly checkedRecords: number;
+    readonly checkedBlocks: number;
+    readonly checkedBytes: number;
+    /** Total findings; `issues` itself is bounded by `maxIssues`. */
+    readonly issueCount: number;
+    readonly issues: readonly StorageIntegrityIssue[];
+}
+export interface StorageStats {
+    readonly backend: string;
+    /** Bytes reachable as current database records or payloads. */
+    readonly logicalBytes: number;
+    /** Actual substrate allocation where available; IndexedDB cannot report this per database. */
+    readonly physicalBytes: number | null;
+    readonly liveBlockCount: number;
+    /** Stored payloads outside the current manifest, including staged and retired bytes. */
+    readonly obsoleteBlockCount: number;
+    readonly liveBlockBytes: number;
+    readonly obsoleteBlockBytes: number;
+    readonly temporaryBytes: number;
+    readonly walBytes: number | null;
+    readonly checkpointBytes: number | null;
+    readonly orphanBytes: number | null;
+    readonly manifestCount: number;
+    readonly transactionCount: number;
+    readonly segmentCount: number;
+    readonly maintenance?: {
+        readonly degraded: boolean;
+        readonly consecutiveFailures: number;
+        readonly lastError: string | null;
+        readonly walLimitBytes: number | null;
+        /** Durable garbage awaiting safe physical deletion, when the substrate separates the two. */
+        readonly cleanupDebtBytes: number | null;
+        /** Refusal/backpressure ceiling for cleanup debt, or null when the substrate has no debt. */
+        readonly cleanupLimitBytes: number | null;
+    };
+}
+export interface InterruptedSnapshotImport {
+    readonly identity: string;
+    readonly version: number;
+    readonly createdAt: string;
+    readonly stagedBlockCount: number;
+    readonly stagedBytes: number;
+}
+export interface InterruptedSnapshotImportAbortResult {
+    readonly identity: string;
+    readonly removedBlockCount: number;
+    readonly removedBytes: number;
+}
+/** A snapshot session is renewable but can never pin storage for more than one hour unattended. */
+export declare const MAX_SNAPSHOT_SESSION_TTL_MS: number;
+/** Snapshot v1 is an ordered bounded record stream; no database-sized collection is in header. */
+export declare const SNAPSHOT_FRAME_KINDS: readonly ["catalog-page", "segment-page", "transaction-page", "unique-page", "posting-page", "block"];
+export type SnapshotFrameKind = (typeof SNAPSHOT_FRAME_KINDS)[number];
+export declare const MAX_SNAPSHOT_FRAME_ITEMS = 1024;
+export declare const MAX_SNAPSHOT_METADATA_FRAME_BYTES: number;
+export declare const MAX_SNAPSHOT_FRAME_BATCH_ITEMS = 64;
+export declare const MAX_SNAPSHOT_METADATA_BATCH_BYTES: number;
+/** One block frame is permitted; metadata frames still use MAX_SNAPSHOT_METADATA_BATCH_BYTES. */
+export declare const MAX_SNAPSHOT_FRAME_BATCH_BYTES: number;
+/**
+ * Framed restore builds accelerator generations in a disposable core before one atomic publish.
+ * These aggregate ceilings keep that validation heap bounded until generations become a native
+ * chunk-backed structure rather than one materialized in-memory collection.
+ */
+export declare const MAX_SNAPSHOT_IMPORT_ACCELERATOR_RETAINED_BYTES: number;
+export declare const MAX_SNAPSHOT_IMPORT_ACCELERATOR_RETAINED_ENTRIES = 16777216;
+export interface SnapshotKindSummary {
+    readonly frameCount: number;
+    readonly itemCount: number;
+    readonly storedBytes: number;
+}
+/** One table plus its durable allocation counters; memberships/postings are separate pages. */
+export interface SnapshotCatalogItem {
+    readonly kind: "table";
+    readonly record: TableRecord;
+    readonly nextRowId: bigint;
+    readonly autoIncrement: ReadonlyArray<{
+        readonly columnId: string;
+        readonly next: bigint;
+    }>;
+}
+export interface SnapshotSegmentItem {
+    readonly kind: "segment";
+    readonly record: SegmentRecord;
+}
+export interface SnapshotTransactionItem {
+    readonly kind: "transaction";
+    readonly record: TransactionRecord;
+}
+/** Descriptor precedes this generation's chunks; tokens are globally strict lexical order. */
+export interface SnapshotUniqueGenerationItem {
+    readonly kind: "unique-generation";
+    readonly tableId: string;
+    readonly indexId: string | null;
+    readonly namespaceId: string;
+    readonly generationId: string;
+    readonly chunkCount: number;
+    readonly tokenCount: number;
+}
+export interface SnapshotUniqueChunkItem {
+    readonly kind: "unique-chunk";
+    readonly namespaceId: string;
+    readonly generationId: string;
+    readonly ordinal: number;
+    readonly keyTokens: readonly string[];
+}
+export type SnapshotUniqueItem = SnapshotUniqueGenerationItem | SnapshotUniqueChunkItem;
+/**
+ * Complete canonical postings generation at the captured version. Both full-text and scalar
+ * secondary accelerators use this base format; deltas are merged during bounded export, so a
+ * restore never needs pre-snapshot history.
+ */
+export interface SnapshotPostingGenerationItem {
+    readonly kind: "posting-generation";
+    readonly tableId: string;
+    readonly ownerKind: "fts-column" | "secondary-index";
+    readonly ownerId: string;
+    readonly storageColumnId: string;
+    readonly generationId: string;
+    readonly coversVersion: number;
+    readonly chunkCount: number;
+    /** Exact safe sum of every posting frequency; secondary-index frequencies are always one. */
+    readonly totalTokens: number;
+}
+export interface SnapshotPostingChunkItem {
+    readonly kind: "posting-chunk";
+    readonly storageColumnId: string;
+    readonly generationId: string;
+    readonly ordinal: number;
+    readonly postings: readonly FtsPosting[];
+}
+export type SnapshotPostingItem = SnapshotPostingGenerationItem | SnapshotPostingChunkItem;
+export type SnapshotMetadataItem = SnapshotCatalogItem | SnapshotSegmentItem | SnapshotTransactionItem | SnapshotUniqueItem | SnapshotPostingItem;
+/** Modeled heap retained by one framed accelerator chunk during atomic snapshot validation. */
+export declare function snapshotAcceleratorItemRetainedUsage(item: SnapshotUniqueChunkItem | SnapshotPostingChunkItem): {
+    bytes: number;
+    entries: number;
+};
+/** Shared arithmetic boundary used by streaming adapters and allocation-free cap tests. */
+export declare function assertSnapshotImportAcceleratorUsage(bytes: number, entries: number): void;
+/**
+ * Canonical compressed container header. It remains O(1) with database size: the six entries
+ * below contain counts and byte totals only, never record descriptors, keys, or postings.
+ */
+export interface SnapshotFrameStreamHeader {
+    readonly formatVersion: 1;
+    readonly databaseVersion: number;
+    readonly createdAt: string;
+    readonly kinds: Readonly<Record<SnapshotFrameKind, SnapshotKindSummary>>;
+}
+/**
+ * One exact body frame. Frames are globally contiguous by `sequence` and grouped in
+ * `SNAPSHOT_FRAME_KINDS` order. Within kinds, tables/segments/transactions/blocks order by ID;
+ * UNIQUE generations order by namespace (descriptor, then contiguous chunk ordinals), and
+ * posting generations by storageColumnId using the same descriptor/chunk rule. Metadata
+ * payloads use canonical adapter encoding and contain at
+ * most MAX_SNAPSHOT_FRAME_ITEMS/MAX_SNAPSHOT_METADATA_FRAME_BYTES; a block frame contains one
+ * ID plus one stored block and may use MAX_STORED_BLOCK_BYTE_LENGTH. `checksum` covers the exact
+ * payload. Metadata payloads use the single core-owned snapshot wire codec; adapters must not
+ * substitute substrate encodings. Lost-ack replay must additionally compare the complete
+ * persisted bytes.
+ */
+export interface SnapshotFrame {
+    readonly sequence: number;
+    readonly kind: SnapshotFrameKind;
+    readonly itemCount: number;
+    /** Block ID for a block frame; null for core-wire-encoded metadata pages. */
+    readonly key: string | null;
+    readonly payload: Uint8Array;
+    readonly checksum: number;
+}
+export interface SnapshotFrameFooter {
+    readonly frameCount: number;
+    readonly itemCount: number;
+    readonly storedBytes: number;
+    /** Rolling checksum over every canonical frame header and payload in sequence order. */
+    readonly checksum: number;
+}
+export interface BeginSnapshotFrameExportInput {
+    readonly ownerId: string;
+    readonly createdAt: string;
+    readonly expiresAt: string;
+}
+/**
+ * Export begin atomically captures a frozen catalog/segment/transaction/accelerator generation
+ * into bounded durable pages and records only an exact manifest version/cursor for blocks (it
+ * must not copy block descriptors). It creates the backup lease in the same operation.
+ * Catalog-only writes after begin cannot change the session.
+ */
+export interface SnapshotFrameExportSession {
+    readonly sessionId: string;
+    readonly ownerId: string;
+    readonly expiresAt: string;
+    readonly header: SnapshotFrameStreamHeader;
+}
+export interface ReadSnapshotExportFrameInput {
+    readonly sessionId: string;
+    readonly ownerId: string;
+    readonly sequence: number;
+    readonly expiresAtCutoff: string;
+    readonly expiresAt: string;
+}
+export interface BeginSnapshotFrameImportInput {
+    readonly identity: string;
+    readonly ownerId: string;
+    readonly createdAt: string;
+    readonly expiresAt: string;
+    readonly header: SnapshotFrameStreamHeader;
+}
+export interface SnapshotFrameImportSession {
+    readonly identity: string;
+    readonly ownerId: string;
+    readonly version: number;
+    readonly createdAt: string;
+    readonly expiresAt: string;
+    readonly nextSequence: number;
+    readonly stagedBytes: number;
+}
+export interface RenewSnapshotFrameImportInput {
+    readonly identity: string;
+    readonly ownerId: string;
+    readonly expiresAtCutoff: string;
+    readonly expiresAt: string;
+}
+export interface AppendSnapshotImportFramesInput extends RenewSnapshotFrameImportInput {
+    /** Bounded contiguous frames; replayed sequences compare complete persisted bytes. */
+    readonly frames: readonly SnapshotFrame[];
+}
+export interface FinishSnapshotFrameImportInput {
+    readonly identity: string;
+    readonly ownerId: string;
+    readonly expiresAtCutoff: string;
+    readonly footer: SnapshotFrameFooter;
+}
+export interface CloseSnapshotExportInput {
+    readonly sessionId: string;
+    readonly ownerId: string;
+}
+export interface CancelSnapshotImportInput {
+    readonly identity: string;
+    readonly ownerId: string;
+}
+export declare class SnapshotImportConflictError extends Error {
+    readonly identity: string;
+    readonly ownerId: string;
+    readonly name = "SnapshotImportConflictError";
+    constructor(identity: string, ownerId: string, message: string);
+}
+/**
+ * Persisted bytes belong to a recognized storage family, but not to the version this reader
+ * supports. This is deliberately distinct from corruption: callers must not infer that repair,
+ * recreation, or deletion is safe merely because versions differ.
+ */
+export declare class StorageFormatVersionError extends Error {
+    readonly backend: string;
+    readonly location: string;
+    readonly actualVersion: number | null;
+    readonly supportedVersion: number;
+    readonly relation: "older" | "newer";
+    readonly name = "StorageFormatVersionError";
+    constructor(backend: string, location: string, actualVersion: number | null, supportedVersion: number, relation: "older" | "newer");
+}
+/** A native IndexedDB schema upgrade is waiting for another connection to close. */
+export declare class IndexedDbSchemaUpgradeBlockedError extends Error {
+    readonly databaseName: string;
+    readonly oldVersion: number;
+    readonly requestedVersion: number;
+    readonly name = "IndexedDbSchemaUpgradeBlockedError";
+    constructor(databaseName: string, oldVersion: number, requestedVersion: number);
+}
+/** Persisted metadata or payload failed an adapter's fail-closed integrity checks. */
+export declare class StorageCorruptionError extends Error {
+    readonly backend: string;
+    readonly location: string;
+    readonly name = "StorageCorruptionError";
+    constructor(backend: string, location: string, message: string);
+}
+/**
+ * A remote OPFS leader may have committed a mutation whose acknowledgement was lost.
+ * Reconcile stable identities or revisions before retrying the named operation.
+ */
+export declare class OpfsUncertainOutcomeError extends Error {
+    readonly method: string;
+    readonly name = "OpfsUncertainOutcomeError";
+    constructor(method: string);
+}
 /**
  * The commit input carries only the change: added blocks are the transaction's journaled pending
  * blocks, removals are the superseded ids. The store derives the published manifest from its
@@ -747,7 +1345,22 @@ export interface CommitTransactionInput {
     changedTableIds?: readonly string[];
     expectedTransactionRevision: number;
     expectedManifestVersion: number | null;
+    /**
+     * Required when blocks are retired. The store atomically proves this ready compaction job is
+     * owned by the transaction and that `removedBlockIds` exactly names its still-current,
+     * unaliased source set. Ordinary commits cannot retire visible blocks.
+     */
+    compactionJobId?: string;
     removedBlockIds?: readonly string[];
+    /**
+     * Atomic post-commit fragmentation ceilings. Exactly one entry is mandatory for every table
+     * receiving a pending level-zero segment, no unrelated entry is allowed, and no limit may
+     * exceed `MAX_LEVEL_ZERO_SEGMENTS`.
+     */
+    levelZeroSegmentLimits?: ReadonlyArray<{
+        tableId: string;
+        limit: number;
+    }>;
     /**
      * Per-table unique-key changes, in operation order. Multi-entry commits come from atomic
      * write scopes; entries for the same table apply sequentially, so in-scope conflicts
@@ -770,7 +1383,9 @@ export interface WriteTransactionInput extends Omit<CommitTransactionInput, "tra
      * auto-increment reservation); its journal is extended and its revision compare-and-swapped
      * (`TransactionRecordConflictError`). `{ record }` begins the transaction in the same step —
      * a fresh record (revision 0, empty journal) the store pins at `expectedManifestVersion` —
-     * so a write that needed no reservation costs one round trip in total.
+     * so a write that needed no reservation costs one round trip in total. A fresh record carries
+     * the `schemaEpochGuard` captured with its preparation; the store rejects a stale guard before
+     * persisting any part of the write.
      */
     transaction: {
         id: string;
@@ -787,12 +1402,188 @@ export interface UniqueKeyChanges {
     requireAbsent: boolean;
     remove?: boolean;
 }
+/** Bounded calls used to seed an arbitrarily large UNIQUE namespace without heap materialization. */
+export declare const MAX_UNIQUE_KEY_BUILD_TOKENS_PER_CHUNK = 4096;
+export declare const MAX_UNIQUE_KEY_BUILD_CHUNK_BYTES: number;
+export declare const MAX_UNIQUE_KEY_BUILD_TTL_MS: number;
+export declare const MAX_UNIQUE_KEY_BUILD_STAGED_BYTES: number;
+export declare const MAX_UNIQUE_KEY_BUILD_STAGED_BYTES_TOTAL: number;
+export interface UniqueKeyBuildRecord {
+    buildId: string;
+    tableId: string;
+    indexId: string;
+    namespaceId: string;
+    ownerId: string;
+    state: "active" | "completed";
+    nextOrdinal: number;
+    tokenCount: number;
+    retainedBytes: number;
+    expiresAt: string;
+    createdAt: string;
+    updatedAt: string;
+    completedAt?: string;
+}
+export interface BeginUniqueKeyBuildInput {
+    buildId: string;
+    tableId: string;
+    indexId: string;
+    namespaceId: string;
+    ownerId: string;
+    expiresAt: string;
+    createdAt: string;
+}
+export interface AppendUniqueKeyBuildChunkInput {
+    buildId: string;
+    ownerId: string;
+    expiresAtCutoff: string;
+    ordinal: number;
+    keyTokens: readonly string[];
+    updatedAt: string;
+}
+export interface FinishUniqueKeyBuildInput {
+    buildId: string;
+    ownerId: string;
+    expiresAtCutoff: string;
+    expectedTableRevision: number;
+    expectedManifestVersion: number | null;
+    chunkCount: number;
+    coversVersion: number;
+    completedAt: string;
+}
+export interface RenewUniqueKeyBuildInput {
+    buildId: string;
+    ownerId: string;
+    expiresAtCutoff: string;
+    expiresAt: string;
+    updatedAt: string;
+}
+export interface AbortUniqueKeyBuildInput {
+    buildId: string;
+    ownerId: string;
+    expiresAtCutoff: string;
+}
+/**
+ * A bounded background fold of one already-enforced UNIQUE namespace. Begin freezes the exact
+ * immutable base generation and delta prefix through `throughVersion`; later commits keep
+ * appending canonical `(namespace, token, version)` add/remove records to a separate ordered
+ * tail. Each step resolves at most one bounded lexical token window
+ * into a new immutable generation. Finish swaps the generation and drops only the frozen tail
+ * prefix atomically, so no commit copies database-sized membership and readers always see an
+ * exact base+tail view.
+ */
+export interface UniqueKeyFoldRecord {
+    foldId: string;
+    tableId: string;
+    indexId: string | null;
+    namespaceId: string;
+    ownerId: string;
+    state: "active" | "completed";
+    sourceGenerationId: string | null;
+    outputGenerationId: string;
+    throughVersion: number;
+    afterToken: string | null;
+    nextOrdinal: number;
+    tokenCount: number;
+    retainedBytes: number;
+    createdAt: string;
+    updatedAt: string;
+    expiresAt: string;
+    completedAt?: string;
+}
+export interface BeginUniqueKeyFoldInput {
+    foldId: string;
+    tableId: string;
+    indexId: string | null;
+    namespaceId: string;
+    ownerId: string;
+    outputGenerationId: string;
+    expectedManifestVersion: number;
+    createdAt: string;
+    expiresAt: string;
+}
+export interface RunUniqueKeyFoldStepInput {
+    foldId: string;
+    ownerId: string;
+    expiresAtCutoff: string;
+    expiresAt: string;
+    updatedAt: string;
+    maxTokens: number;
+}
+export interface FinishUniqueKeyFoldInput {
+    foldId: string;
+    ownerId: string;
+    expiresAtCutoff: string;
+    expectedSourceGenerationId: string | null;
+    expectedThroughVersion: number;
+    chunkCount: number;
+    completedAt: string;
+}
+export interface AbortUniqueKeyFoldInput {
+    foldId: string;
+    ownerId: string;
+    expiresAtCutoff: string;
+}
+/** Validates one staged seed call before an adapter opens a transaction or WAL frame. */
+export declare function uniqueKeyBuildChunkRetainedBytes(keyTokens: readonly string[]): number;
+export declare class UniqueKeyBuildConflictError extends Error {
+    readonly buildId: string;
+    readonly reason: string;
+    readonly name = "UniqueKeyBuildConflictError";
+    constructor(buildId: string, reason: string);
+}
 /** One term's postings within a commit delta or base chunk: parallel rowId/tf arrays. */
 export interface FtsPosting {
     term: string;
     rowIds: bigint[];
     tf: number[];
 }
+export declare const MAX_POSTING_BUILD_TTL_MS: number;
+export interface BeginPostingBuildInput {
+    tableId: string;
+    columnId: string;
+    buildId: string;
+    ownerId: string;
+    createdAt: string;
+    expiresAt: string;
+}
+export interface RenewPostingBuildInput {
+    tableId: string;
+    columnId: string;
+    buildId: string;
+    ownerId: string;
+    expiresAtCutoff: string;
+    expiresAt: string;
+    updatedAt: string;
+}
+export interface AppendPostingBuildChunkInput extends RenewPostingBuildInput {
+    ordinal: number;
+    chunk: readonly FtsPosting[];
+}
+export interface FinishPostingBuildInput {
+    tableId: string;
+    columnId: string;
+    buildId: string;
+    ownerId: string;
+    expiresAtCutoff: string;
+    coversVersion: number;
+    chunkCount: number;
+    totalTokens: number;
+    completedAt: string;
+}
+export interface AbortPostingBuildInput {
+    tableId: string;
+    columnId: string;
+    buildId: string;
+    ownerId: string;
+    expiresAtCutoff: string;
+}
+export declare class PostingBuildConflictError extends Error {
+    readonly buildId: string;
+    readonly ownerId: string;
+    readonly reason: string;
+    readonly name = "PostingBuildConflictError";
+    constructor(buildId: string, ownerId: string, reason: string);
+}
 /** One indexed column's contribution from one commit: postings for the commit's new rows. */
 export interface FtsColumnDelta {
     columnId: string;
@@ -811,11 +1602,37 @@ export interface FtsChanges {
     tableId: string;
     columns: readonly FtsColumnDelta[];
 }
+/** In-memory and atomic-publish bounds for one transaction's accelerator/key deltas. */
+export declare const MAX_TRANSACTION_COMMIT_DELTA_BYTES: number;
+export declare const MAX_TRANSACTION_COMMIT_DELTA_ENTRIES = 1048576;
+export declare function transactionCommitDeltaRetainedBytes(uniqueKeyChanges: readonly UniqueKeyChanges[], ftsChanges: readonly FtsChanges[]): {
+    bytes: number;
+    entries: number;
+};
 /** The per-term candidate row IDs a full-text index lookup returns, aligned with the query. */
 export interface FtsCandidates {
     /** Per requested term: ascending unique row IDs whose indexed column contained the term. */
     rowIdsByTerm: bigint[][];
-}
+    /** The bounded read stopped before collecting every matching row; callers must scan. */
+    overflow: boolean;
+}
+/** Aggregate row-id ceiling for one postings candidate read. Overflow falls back to a scan. */
+export declare const MAX_FTS_CANDIDATE_ROW_IDS = 65536;
+/** Query-term cardinality shared by the parser and every postings adapter boundary. */
+export declare const MAX_FTS_QUERY_TERMS = 32;
+/** Retained metadata/value ceiling for one ordered postings read. Overflow falls back to a scan. */
+export declare const MAX_FTS_ORDERED_READ_BYTES: number;
+/** Hard public mutation bounds for one streamed postings-build chunk. */
+export declare const MAX_FTS_POSTINGS_PER_CHUNK = 65536;
+export declare const MAX_FTS_POSTING_ROW_IDS_PER_CHUNK = 1048576;
+export declare const MAX_FTS_POSTING_TERM_CHARACTERS = 65536;
+/** Indexed string values are bounded; non-indexed block strings retain the physical block cap. */
+export declare const MAX_INDEXED_STRING_CHARACTERS = 16384;
+/** Maximum normalized tokens retained from one indexed document. */
+export declare const MAX_FTS_TOKENS_PER_DOCUMENT = 4096;
+/** Bounded catalog/TOC cardinality. Oversized accelerators invalidate and queries scan. */
+export declare const MAX_FTS_BASE_CHUNKS = 4096;
+export declare const MAX_FTS_DELTA_CHUNKS = 128;
 /** One exact/prefix term lookup or a lexicographic term range over a postings index. */
 export type FtsPostingQuery = {
     term: string;
@@ -826,6 +1643,8 @@ export type FtsPostingQuery = {
     upper?: string;
     upperInclusive?: boolean;
 };
+/** Strict, bounded runtime validation shared by every adapter before any postings read. */
+export declare function validateFtsPostingQueries(value: unknown, label?: string): asserts value is readonly FtsPostingQuery[];
 /** Whether a stored term belongs to one exact, prefix, or range lookup. */
 export declare function ftsPostingQueryMatches(term: string, query: FtsPostingQuery): boolean;
 /**
@@ -833,12 +1652,19 @@ export declare function ftsPostingQueryMatches(term: string, query: FtsPostingQu
  * term-match rule (exact, or prefix as a term range) and the sorted-unique row-id shape must
  * never drift between backends — pruning would silently differ per store.
  */
-export declare function collectFtsCandidates(chunkLists: Iterable<readonly FtsPosting[]>, terms: readonly FtsPostingQuery[]): FtsCandidates;
+export declare function collectFtsCandidates(chunkLists: Iterable<readonly FtsPosting[]>, terms: readonly FtsPostingQuery[], maxRowIds?: number): FtsCandidates;
+/** Validates the fixed memory ceilings accepted by one ordered postings read. */
+export declare function validateFtsOrderedReadLimits(maxRowIds?: number, maxRetainedBytes?: number): void;
 /**
  * K-way merges sorted base/delta chunks into canonical term order. Only one term's row map and
  * one cursor per chunk stay live beyond the returned postings, avoiding a second index-sized map.
  */
 export declare function collectFtsPostings(chunkLists: Iterable<readonly FtsPosting[]>): FtsPosting[];
+/** Bounded ordered merge; overflow deliberately returns no partial authoritative answer. */
+export declare function collectFtsPostingsBounded(chunkLists: Iterable<readonly FtsPosting[]>, maxRowIds?: number, maxRetainedBytes?: number): {
+    postings: FtsPosting[];
+    overflow: boolean;
+};
 /**
  * Shared stale-writer policy for both stores' commit steps: a commit that adds segments to a
  * table with active full-text columns but no covering delta flips the uncovered columns to
@@ -873,6 +1699,13 @@ export declare class WriteConflictError extends Error {
     readonly name = "WriteConflictError";
     constructor(expectedVersion: number | null, actualVersion: number | null);
 }
+/** Staged write artifacts were prepared against a structurally different catalog. */
+export declare class SchemaConflictError extends Error {
+    readonly expectedEpoch: number;
+    readonly actualEpoch: number;
+    readonly name = "SchemaConflictError";
+    constructor(expectedEpoch: number, actualEpoch: number);
+}
 export declare class TransactionRecordConflictError extends Error {
     readonly transactionId: string;
     readonly expectedRevision: number;
@@ -890,11 +1723,45 @@ export interface TempRunPage {
     pageIndex: number;
     bytes: Uint8Array;
 }
+/**
+ * Atomically adopts an unpublished compaction output left by an aborted attempt. The adapter
+ * verifies that `segment` exactly matches the stored immutable record apart from its owner,
+ * that the old owner is the expected aborted revision, and that the replacement is the active
+ * transaction linked to `compactionJobId`. It then retags the segment and moves its journal
+ * membership from the old owner to the replacement while advancing both transaction revisions.
+ */
+export interface AdoptAbortedSegmentInput {
+    segment: SegmentRecord;
+    expectedAbortedTransactionId: string;
+    expectedAbortedTransactionRevision: number;
+    replacementTransactionId: string;
+    expectedReplacementTransactionRevision: number;
+    compactionJobId: string;
+    updatedAt: string;
+}
+/** Hard storage-boundary limits for one scratch-page write. */
+export declare const MAX_TEMP_RUN_PAGES_PER_BATCH = 64;
+export declare const MAX_TEMP_RUN_PAGE_BYTES: number;
+export declare const MAX_TEMP_RUN_BATCH_BYTES: number;
+/**
+ * Refuses an oversized scratch write before an adapter starts a transaction or appends a WAL
+ * record. Query execution splits pages and batches to these limits, so the limits bound atomic
+ * storage work without limiting the total size of a spill.
+ */
+export declare function assertTempRunPageBatchLimits(pages: readonly TempRunPage[]): void;
 export interface TempOwnerRecord {
     ownerId: string;
+    createdAt: string;
     expiresAt: string;
     revision: number;
 }
+export declare const MAX_TEMP_OWNER_TTL_MS: number;
+export interface RenewTempOwnerInput {
+    ownerId: string;
+    expectedRevision: number;
+    expiresAtCutoff: string;
+    expiresAt: string;
+}
 export declare class TempOwnerConflictError extends Error {
     readonly ownerId: string;
     readonly expectedRevision: number;
@@ -910,14 +1777,9 @@ export declare class TempOwnerConflictError extends Error {
  */
 export interface QueryCatalogState {
     manifestVersion: number | null;
-    /**
-     * Exact block set of manifestVersion, when resolving it was part of the same atomic read.
-     * Lets the engine pin that already-resolved snapshot instead of reading a large manifest twice.
-     */
-    manifestBlockIds?: string[];
     /** Positional per requested name; undefined where the table does not exist. */
     tables: Array<TableRecord | undefined>;
-    /** Current-manifest segments of the found tables, sorted by id like listSegments. */
+    /** Current-manifest segments of the found tables, sorted by id. */
     segments: SegmentRecord[];
     /** Records for the segments' transaction ids; missing records are omitted. */
     transactions: TransactionRecord[];
@@ -929,41 +1791,106 @@ export interface QueryCatalogState {
     catalogEpoch?: number;
 }
 /**
- * The two change counters a reader needs to know whether anything it may have cached is
- * still current, read together in one atomic storage transaction. `manifestVersion` moves on
+ * The change counters a reader or writer needs, read together in one atomic storage
+ * transaction. `manifestVersion` moves on
  * every data commit. `catalogEpoch` moves on every catalog mutation — table creation, table
  * record updates (schema migration, full-text index stamps), and every manifest publish —
  * so an unchanged epoch proves cached catalog state is byte-identical to a fresh read.
  * Physical garbage collection does not move the epoch: it only deletes records that are
  * already invisible at every leased version, so cached state stays result-equivalent.
+ * `schemaEpoch` is deliberately narrower: it moves only for structural catalog changes, so
+ * writers can reject old-schema artifacts without making concurrent ordinary writes conflict.
  */
 export interface CatalogProbe {
     manifestVersion: number | null;
     catalogEpoch: number;
+    /** Advances only when structural catalog state changes, never for an ordinary data commit. */
+    schemaEpoch: number;
+}
+/** Optional serializable guard for a catalog mutation whose proof read multiple records. */
+export interface CatalogMutationOptions {
+    /** Reject unless the complete catalog is still at this epoch. */
+    expectedCatalogEpoch?: number;
+}
+/** Atomic replacement fields for one catalog record. */
+export interface TableRecordUpdate extends CatalogMutationOptions {
+    columns?: TableColumnRecord[];
+    /** Replaces the full-text index state map; null clears it. */
+    ftsColumns?: Record<string, FtsColumnIndexRecord> | null;
+    /** Replaces the secondary-index state map; null clears it. */
+    secondaryIndexes?: Record<string, SecondaryIndexRecord> | null;
+    /** Additional manifest CAS used when publishing a UNIQUE build from a stable snapshot. */
+    expectedManifestVersion?: {
+        value: number | null;
+    };
+    /** Atomically seeds one secondary UNIQUE membership namespace while activating enforcement. */
+    uniqueKeySeed?: {
+        namespaceId: string;
+        keyTokens: readonly string[];
+    };
+    /** Atomically advances a newly declared auto-increment column's durable counter. */
+    autoIncrementSeed?: {
+        columnId: string;
+        atLeast: bigint;
+    };
+    /** Replaces the trigger list; null clears it. */
+    triggers?: TriggerRecord[] | null;
+    /** Replaces a view definition in place; null converts the record back to a table. */
+    view?: TableRecord["view"] | null;
 }
 /**
  * Bulk payload storage: immutable, opaque byte blobs keyed by structured ids.
  *
- * Blocks are write-once. `addBlock`/`addBlocks` MUST reject an id that already exists, and a
- * batch containing any duplicate MUST write nothing at all. Ids contain `/` separators
+ * Blocks are written only through transaction staging, which creates their durable provenance
+ * in the same atomic step and rejects duplicate ids without a partial write. Ids contain `/` separators
  * (`table/<uuid>/segment/<uuid>/part/000001`) and sort lexically; treat them as opaque keys.
  * Reads MUST return bytes the caller may mutate freely (a fresh copy or freshly deserialized
  * buffer), and writes MUST NOT alias the caller's buffer — the engine may reuse it.
  *
- * Published blocks are retired by superseding them in a commit, never by `removeBlock`; the
- * lease-aware collector deletes the bytes once no reader can be pinned to them.
+ * Published blocks are retired by superseding them in a commit; only the store's atomic
+ * lease-aware collection step can physically delete payloads once no reader can reach them.
  */
+/** Maximum manifest-membership ids accepted by one storage call. */
+export declare const MAX_MANIFEST_BLOCK_PRESENCE_IDS = 1024;
+/** Maximum UTF-16 code units in any opaque storage identity. */
+export declare const MAX_STORAGE_ID_CHARACTERS = 1024;
+/** Maximum UTF-16 code units in a persisted catalog name. */
+export declare const MAX_CATALOG_NAME_CHARACTERS = 1024;
+/** Public adapter database-name bound; names commonly become substrate keys or path segments. */
+export declare const MAX_STORAGE_DATABASE_NAME_CHARACTERS = 256;
+/** Maximum positional items accepted by one public bulk-read operation. */
+export declare const MAX_STORAGE_BULK_READ_ITEMS = 1024;
+/** Maximum aggregate payload bytes returned by one getBlocks call. */
+export declare const MAX_BLOCK_READ_BATCH_BYTES: number;
+export declare class BlockReadBatchTooLargeError extends RangeError {
+    readonly requestedBytes: number;
+    readonly limitBytes: number;
+    readonly name = "BlockReadBatchTooLargeError";
+    constructor(requestedBytes: number, limitBytes?: number);
+}
+export declare function assertStorageBulkReadItems(items: readonly unknown[], label: string): void;
+export declare function validateStorageId(value: unknown, label?: string): string;
+export declare function validateCatalogName(value: unknown, label?: string): string;
+export declare function validateStorageDatabaseName(value: unknown): string;
 export interface BlockPayloadStore {
-    addBlock(id: string, bytes: Uint8Array): Promise<void>;
-    /** All or nothing: an internal or existing duplicate id fails the whole batch unwritten. */
-    addBlocks(blocks: readonly BlockWrite[]): Promise<void>;
     getBlock(id: string): Promise<Uint8Array | undefined>;
     /** Positional per requested id; undefined where a block does not exist. */
     getBlocks(ids: readonly string[]): Promise<Array<Uint8Array | undefined>>;
-    /** Deleting a missing block is not an error. */
-    removeBlock(id: string): Promise<void>;
-    /** Every stored block id, sorted lexically. A cold path — tools and tests, not queries. */
-    listBlockIds(): Promise<string[]>;
+    /**
+     * Reads one block only when it belongs to the exact readable manifest version. The membership
+     * check and payload read are one storage operation: callers must never fetch a block first and
+     * then race a separate manifest check. A missing/pruned manifest or non-member id returns
+     * undefined. A readable member whose payload is missing or unreadable is corruption and MUST
+     * throw StorageCorruptionError. Reader leases keep a selected version from being pruned while
+     * it is in use.
+     */
+    readManifestBlock(version: number | null, id: string): Promise<Uint8Array | undefined>;
+    /**
+     * Positional membership in the exact readable manifest version. Implementations must bound the
+     * input at MAX_MANIFEST_BLOCK_PRESENCE_IDS; callers window larger sets. A missing/pruned
+     * manifest returns false for every id.
+     */
+    hasManifestBlocks(version: number | null, ids: readonly string[]): Promise<boolean[]>;
 }
 /**
  * The table catalog: schema records, the counters that keep writes collision-free, and
@@ -978,48 +1905,40 @@ export interface BlockPayloadStore {
  */
 export interface CatalogStore {
     /** Fails on a duplicate id or name. Advances the catalog epoch. */
-    addTable(record: TableRecord): Promise<void>;
+    addTable(record: TableRecord, options?: CatalogMutationOptions): Promise<void>;
     getTable(id: string): Promise<TableRecord | undefined>;
     getTableByName(name: string): Promise<TableRecord | undefined>;
-    /** Sorted by table name. */
+    /** Sorted by table name; MAX_CATALOG_RECORDS makes this array globally bounded. */
     listTables(): Promise<TableRecord[]>;
     /**
      * Replaces catalog metadata atomically. When `columns` removes a column, the same operation
      * must also discard that column's full-text catalog entry, base chunks, and commit deltas.
      */
-    updateTable(id: string, expectedRevision: number, update: {
-        columns?: TableColumnRecord[];
-        /** Replaces the full-text index state map; null clears it. */
-        ftsColumns?: Record<string, FtsColumnIndexRecord> | null;
-        /** Replaces the secondary-index state map; null clears it. */
-        secondaryIndexes?: Record<string, SecondaryIndexRecord> | null;
-        /** Additional manifest CAS used when publishing a UNIQUE build from a stable snapshot. */
-        expectedManifestVersion?: {
-            value: number | null;
-        };
-        /**
-         * Atomically seeds one secondary UNIQUE membership namespace while publishing the catalog
-         * record that activates enforcement. Duplicate tokens reject the entire operation.
-         */
-        uniqueKeySeed?: {
-            namespaceId: string;
-            keyTokens: readonly string[];
-        };
-        /** Replaces the trigger list; null clears it. */
-        triggers?: TriggerRecord[] | null;
-    }): Promise<TableRecord>;
-    /**
-     * Removes a table's catalog record together with everything else keyed to it: its segments,
-     * its full-text base chunks and commit deltas, its unique-key membership, and its row-id and
-     * autoincrement counters. One step, so a crash cannot leave a segment pointing at a table
-     * that no longer exists. Advances the catalog epoch, and fails with a
-     * `TableRecordConflictError` on a revision mismatch, like `updateTable`.
-     *
-     * The table's blocks are the caller's business: they are retired by superseding them in a
-     * commit, which leaves the bytes for the lease-aware collector rather than deleting data a
-     * pinned reader may still be reading.
+    updateTable(id: string, expectedRevision: number, update: TableRecordUpdate): Promise<TableRecord>;
+    /**
+     * Removes a segment-free catalog object such as a view. Must refuse when any segment names the
+     * record; populated tables use `dropTable`, whose manifest retirement and catalog removal are
+     * inseparable. Advances the catalog epoch and fails with `TableRecordConflictError` on a stale
+     * revision.
      */
-    removeTable(id: string, expectedRevision: number): Promise<void>;
+    removeTable(id: string, expectedRevision: number, options?: CatalogMutationOptions): Promise<void>;
+    /**
+     * Atomically retires all live table blocks, removes the catalog/segments/counters/indexes,
+     * and publishes the successor manifest. A table revision mismatch throws
+     * `TableRecordConflictError`; a manifest mismatch throws `WriteConflictError`; an active
+     * transaction or nonterminal compaction owner throws `TableInUseError`. Any rejection leaves
+     * the catalog, manifest, jobs, transaction journals, segments, counters, indexes, and payloads
+     * unchanged. A success returns the one manifest summary it published.
+     */
+    dropTable(input: DropTableInput): Promise<ManifestSummary>;
+    /**
+     * Atomically removes one safe non-key column from catalog metadata and every table segment,
+     * removes its posting accelerator, and publishes a successor retiring only removed column
+     * blocks that no remaining segment reference owns. CAS/busy errors match `dropTable`; any
+     * rejection changes nothing, payload bytes stay available to pinned historical readers, and
+     * success returns the exactly one published manifest summary.
+     */
+    dropTableColumn(input: DropTableColumnInput): Promise<ManifestSummary>;
     reserveRowIds(tableId: string, count: number): Promise<RowIdRange>;
     /**
      * Atomically reserves `count` auto-increment values for the column, first bumping the
@@ -1028,6 +1947,36 @@ export interface CatalogStore {
     reserveAutoIncrement(tableId: string, columnId: string, count: number, atLeast?: bigint): Promise<RowIdRange>;
     /** Which of the given key tokens already exist for the table, deduplicated and sorted. */
     getExistingUniqueKeys(tableId: string, keyTokens: readonly string[]): Promise<string[]>;
+    /**
+     * Starts or takes over the exact catalog-owned UNIQUE builder. One active session per namespace
+     * and MAX_ACTIVE_UNIQUE_KEY_BUILDS globally are enforced atomically. Repeating the same active
+     * owner/header is idempotent; an expired owner is irrevocably replaced with an empty stage.
+     */
+    beginUniqueKeyBuild(input: BeginUniqueKeyBuildInput): Promise<UniqueKeyBuildRecord>;
+    getUniqueKeyBuild(buildId: string): Promise<UniqueKeyBuildRecord | undefined>;
+    /** Refuses at/past the cutoff, so a dead builder can never be resurrected. */
+    renewUniqueKeyBuild(input: RenewUniqueKeyBuildInput): Promise<UniqueKeyBuildRecord>;
+    /**
+     * Appends the exact next ordinal. Same-ordinal lost-ack replay compares the persisted tokens
+     * byte-for-byte; a changed replay or duplicate within/across chunks refuses without mutation.
+     */
+    appendUniqueKeyBuildChunk(input: AppendUniqueKeyBuildChunkInput): Promise<UniqueKeyBuildRecord>;
+    /**
+     * Atomically verifies the exact building catalog owner, table+manifest CAS, completed chunk
+     * count, and then publishes both the durable membership namespace and ready catalog state.
+     * A same-build completed retry is a no-op; no catalog/membership intermediate state exists.
+     */
+    finishUniqueKeyBuild(input: FinishUniqueKeyBuildInput): Promise<TableRecord>;
+    /** Exact owner may abort; after expiry any caller may reclaim. Returns false when absent. */
+    abortUniqueKeyBuild(input: AbortUniqueKeyBuildInput): Promise<boolean>;
+    /** Starts or takes over a bounded base+tail membership fold; see `UniqueKeyFoldRecord`. */
+    beginUniqueKeyFold?(input: BeginUniqueKeyFoldInput): Promise<UniqueKeyFoldRecord>;
+    getUniqueKeyFold?(foldId: string): Promise<UniqueKeyFoldRecord | undefined>;
+    /** Advances at most `maxTokens` lexical keys and renews the exact live owner. */
+    runUniqueKeyFoldStep?(input: RunUniqueKeyFoldStepInput): Promise<UniqueKeyFoldRecord>;
+    /** Atomically promotes the output generation and removes only the frozen delta prefix. */
+    finishUniqueKeyFold?(input: FinishUniqueKeyFoldInput): Promise<UniqueKeyFoldRecord>;
+    abortUniqueKeyFold?(input: AbortUniqueKeyFoldInput): Promise<boolean>;
 }
 /**
  * Versions and visibility: manifests (the set of live block ids at each version), segments
@@ -1036,12 +1985,14 @@ export interface CatalogStore {
  *
  * This is where the whole consistency story lives. `commitTransaction` is THE atomic step of
  * the database: in one durable, all-or-nothing action it validates the transaction record's
- * revision and active status, compare-and-swaps the current manifest version, publishes the
+ * revision and active status, verifies its structural `schemaEpochGuard`, compare-and-swaps the
+ * current manifest version, publishes the
  * next manifest, finalizes the transaction's segments, applies unique-key changes (failing
  * with `UniqueKeyConflictError` on a `requireAbsent` violation), applies full-text deltas,
  * and flips the transaction record to committed. No intermediate state may ever be
- * observable, including after a crash at any moment. Version conflicts MUST be
- * `WriteConflictError` and revision conflicts `TransactionRecordConflictError` — the exact
+ * observable, including after a crash at any moment. Schema conflicts MUST be
+ * `SchemaConflictError`, version conflicts `WriteConflictError`, and revision conflicts
+ * `TransactionRecordConflictError` — the exact
  * exported classes; the engine's retry and rebase loops match on them, and the worker client
  * rehydrates them by name across the thread boundary.
  */
@@ -1050,21 +2001,30 @@ export interface TransactionStore {
     /** The current version alone, without materializing the manifest's block list. */
     getCurrentManifestVersion(): Promise<number | null>;
     getManifest(version: number): Promise<Manifest | undefined>;
-    listManifests(): Promise<Manifest[]>;
+    /**
+     * Exact ID-ordered membership at one historically published version. Implementations resolve
+     * this from interval provenance without reconstructing or cloning a complete manifest. It must
+     * remain pageable after the summary tombstone is removed so bounded maintenance can drain the
+     * retired payload interval; callers separately use `getManifest`/leases to authorize reads.
+     * A version newer than the current database returns an empty page. `limit` is storage-bounded.
+     */
+    listManifestBlockPage(input: ListManifestBlockPageInput): Promise<ManifestBlockPage>;
+    /**
+     * ID-ordered retired provenance, independent of bounded manifest-summary tombstones. This is
+     * the durable garbage-discovery index: every record whose non-null `removedVersion` is at most
+     * `removedThroughVersion` appears exactly once in a full cursor traversal.
+     */
+    listRetiredManifestBlockPage(input: ListRetiredManifestBlockPageInput): Promise<ManifestBlockPage>;
     listManifestPage(afterVersion: number | null, limit: number): Promise<StoragePage<Manifest, number>>;
     /**
-     * Publishes the next version directly from a full block-id list, compare-and-swapping on
-     * `expectedVersion` (`WriteConflictError` on a mismatch). Every id must exist. The engine
-     * commits through transactions instead; this is the lower-level tool underneath.
+     * Fails on a duplicate id; the record's snapshot version and pending ids must be valid. When
+     * an active record omits `schemaEpochGuard`, the store stamps its current structural epoch in
+     * the same atomic creation step. A supplied stale guard throws `SchemaConflictError`.
      */
-    publishManifest(input: PublishManifestInput): Promise<Manifest>;
-    /** Fails on a duplicate id; the record's snapshot version and pending ids must be valid. */
     createTransaction(record: TransactionRecord): Promise<void>;
     getTransaction(id: string): Promise<TransactionRecord | undefined>;
     /** Positional per requested id; undefined where a record does not exist. */
     getTransactions(ids: readonly string[]): Promise<Array<TransactionRecord | undefined>>;
-    /** Sorted by startedAt, then id. */
-    listTransactions(): Promise<TransactionRecord[]>;
     listTransactionPage(afterId: string | null, limit: number): Promise<StoragePage<TransactionRecord, string>>;
     /**
      * Compare-and-swap on `expectedRevision` (`TransactionRecordConflictError` on a mismatch).
@@ -1072,15 +2032,35 @@ export interface TransactionStore {
      * committed.
      */
     updateTransaction(id: string, expectedRevision: number, update: TransactionRecordUpdate): Promise<TransactionRecord>;
+    /**
+     * Extends a matching active writer's durable deadline without changing its data revision.
+     * Returns false after ownership is lost or the transaction becomes terminal.
+     */
+    renewTransaction(input: RenewTransactionInput): Promise<boolean>;
+    /**
+     * Atomically aborts an active transaction only when both its owner still matches and its
+     * durable deadline is at or before the cutoff. A concurrent renewal wins by returning
+     * undefined; a successful abort preserves artifact provenance and advances the data revision.
+     */
+    abortTransactionIfExpired(input: AbortTransactionIfExpiredInput): Promise<TransactionRecord | undefined>;
     /** Publishes the next version; the summary omits the block list, which commits never need. */
     commitTransaction(input: CommitTransactionInput): Promise<ManifestSummary>;
-    addSegment(record: SegmentRecord): Promise<void>;
     getSegment(id: string): Promise<SegmentRecord | undefined>;
-    /** Sorted by id; `tableId` filters. */
-    listSegments(tableId?: string): Promise<SegmentRecord[]>;
     /** Sorted by id, after the exclusive cursor; bounded for maintenance scans. */
     listSegmentPage(afterId: string | null, limit: number): Promise<StoragePage<SegmentRecord, string>>;
-    removeSegment(id: string): Promise<void>;
+    /** Table-indexed ID page; query/compaction paths never scan unrelated segment history. */
+    listTableSegmentPage(tableId: string, afterId: string | null, limit: number): Promise<StoragePage<SegmentRecord, string>>;
+    /**
+     * Removes an unpublished segment left by the exact aborted owner and unjournals it from that
+     * transaction in the same atomic step. Returns false when the segment is already absent.
+     * Any owner mismatch, non-aborted/missing owner, readable-manifest block reference, active
+     * transaction pending-segment reference, or nonterminal compaction reference rejects without
+     * mutation. A block alias in another journal is safe: this operation deletes segment metadata,
+     * never payload bytes.
+     */
+    removeAbortedSegment(id: string, expectedTransactionId: string): Promise<boolean>;
+    /** See `AdoptAbortedSegmentInput`; returns the updated replacement transaction journal. */
+    adoptAbortedSegment(input: AdoptAbortedSegmentInput): Promise<TransactionRecord>;
 }
 /**
  * Reader pins. A lease is a stored record with an expiry that protects one manifest version
@@ -1090,15 +2070,28 @@ export interface TransactionStore {
  * tabs safe.
  */
 export interface LeaseStore {
-    /** Fails on a duplicate id, or when the pinned version's manifest is unavailable. */
+    /**
+     * Fails on a duplicate id or unavailable manifest. Before enforcing MAX_ACTIVE_LEASES, an
+     * adapter sweeps a bounded expired page; creation and the final count check are atomic.
+     */
     createLease(record: LeaseRecord): Promise<void>;
     getLease(id: string): Promise<LeaseRecord | undefined>;
-    /** Sorted by id. */
+    /** Sorted by id; MAX_ACTIVE_LEASES makes this array globally bounded. */
     listLeases(): Promise<LeaseRecord[]>;
-    renewLease(id: string, expectedRevision: number, expiresAt: string): Promise<LeaseRecord>;
+    /** Bounded expiry/id-ordered page containing only records expired at the fixed cutoff. */
+    listExpiredLeasePage(expiresAtCutoff: string, afterCursor: string | null, limit: number): Promise<StoragePage<LeaseRecord, string>>;
+    renewLease(input: RenewLeaseInput): Promise<LeaseRecord>;
     /** True when removed; false (without removing) when the lease has not yet expired. */
     removeLeaseIfExpired(id: string, expectedRevision: number, expiresAtCutoff: string): Promise<boolean>;
-    removeLease(id: string): Promise<void>;
+    /**
+     * Releases an existing lease only for its durable owner. A concurrent same-owner renewal may
+     * still be removed safely; a different owner throws `LeaseOwnerConflictError` without change.
+     * Returns false when the lease is already absent.
+     */
+    removeLease(input: {
+        id: string;
+        ownerId: string;
+    }): Promise<boolean>;
 }
 /**
  * Background-maintenance bookkeeping: the resumable job records that let compaction and
@@ -1114,9 +2107,16 @@ export interface LeaseStore {
  * needs.
  */
 export interface MaintenanceStore {
+    /**
+     * Atomically enforces one nonterminal job per table and MAX_ACTIVE_COMPACTION_JOBS globally;
+     * terminal history does not count and is pruned separately.
+     */
     createCompactionJob(record: CompactionJobRecord): Promise<void>;
     getCompactionJob(id: string): Promise<CompactionJobRecord | undefined>;
-    /** Sorted by createdAt, then id; `tableId` filters. */
+    /**
+     * Sorted by createdAt, then id; `tableId` filters. The returned array is bounded by the
+     * enforced active and terminal compaction-job record quotas above.
+     */
     listCompactionJobs(tableId?: string): Promise<CompactionJobRecord[]>;
     listCompactionJobPage(afterId: string | null, limit: number): Promise<StoragePage<CompactionJobRecord, string>>;
     updateCompactionJob(id: string, expectedRevision: number, update: CompactionJobRecordUpdate): Promise<CompactionJobRecord>;
@@ -1126,19 +2126,33 @@ export interface MaintenanceStore {
      * cancelled and its active transaction aborted — atomically.
      */
     cancelCompactionJob(id: string, expectedRevision: number, cancelledAt: string): Promise<CompactionJobRecord>;
-    removeCompactionJob(id: string): Promise<void>;
+    /**
+     * Removes only published, cancelled, or aborted diagnostics. Returns false when missing or
+     * when an existing source/output block or segment would lose its last durable provenance/root;
+     * collection can remove that payload first. Nonterminal removal throws without mutation.
+     */
+    removeCompactionJob(id: string): Promise<boolean>;
     /** Validates candidate provenance against persisted records before accepting the job. */
     createGarbageCollectionJob(input: CreateGarbageCollectionJobInput): Promise<GarbageCollectionJobRecord>;
+    /** CAS-appends one bounded discovery page; no payload or catalog data is changed. */
+    updateGarbageCollectionPlanning(input: UpdateGarbageCollectionPlanningInput): Promise<GarbageCollectionJobRecord>;
     getGarbageCollectionJob(id: string): Promise<GarbageCollectionJobRecord | undefined>;
-    /** Sorted by createdAt, then id. */
+    /**
+     * Sorted by createdAt, then id. The returned array is bounded by the enforced active and
+     * completed garbage-collection record quotas above.
+     */
     listGarbageCollectionJobs(): Promise<GarbageCollectionJobRecord[]>;
+    /** Bounded page sorted by id; maintenance paths use this instead of materializing history. */
+    listGarbageCollectionJobPage(afterId: string | null, limit: number): Promise<StoragePage<GarbageCollectionJobRecord, string>>;
     runGarbageCollectionStep(input: RunGarbageCollectionStepInput): Promise<GarbageCollectionStepResult>;
     /**
-     * Deletes obsolete tombstones only after their garbage blocks are gone, while retaining the
-     * checkpoint prefix readable deltas need. A tombstone is the collector's durable discovery
-     * record between bounded passes.
+     * Removes at most `maxItems` obsolete summary tombstones while retaining the checkpoint prefix
+     * readable deltas need. Retired block provenance, not the summary, is durable garbage
+     * discovery; `runGarbageCollectionStep` removes each payload and its provenance atomically, so
+     * deleting a summary cannot strand an undiscoverable block.
      */
-    removePrunedManifestRecords(): Promise<number>;
+    removePrunedManifestRecords(maxItems: number): Promise<number>;
+    /** Removes only a completed diagnostic; planned/running collection is refused. */
     removeGarbageCollectionJob(id: string): Promise<void>;
 }
 /**
@@ -1149,6 +2163,10 @@ export interface MaintenanceStore {
  */
 export interface FtsIndexStore {
     /** Removes every base chunk and commit delta owned by one column. */
+    /**
+     * Removes posting storage only when the current catalog no longer owns it as a ready/building
+     * accelerator (absent or invalid is safe). Refusal leaves catalog and postings unchanged.
+     */
     removeFtsColumn(tableId: string, columnId: string): Promise<void>;
     /**
      * Replaces one column's full-text base chunks (term-range partitioned, term-sorted within
@@ -1171,7 +2189,7 @@ export interface FtsIndexStore {
      * needing snapshot-exact statistics must detect `coversVersion > upToVersion` and fall
      * back (candidates stay a safe superset either way).
      */
-    readFtsCandidates(tableId: string, columnId: string, terms: readonly FtsPostingQuery[], upToVersion: number): Promise<FtsCandidates & {
+    readFtsCandidates(tableId: string, columnId: string, terms: readonly FtsPostingQuery[], upToVersion: number, maxRowIds?: number): Promise<FtsCandidates & {
         deltaChunkCount: number;
         totalTokens: number;
         coversVersion: number;
@@ -1181,8 +2199,10 @@ export interface FtsIndexStore {
      * Canonical term/posting order from the same snapshot-bounded base-plus-delta view. This is a
      * materialized cold path for ordered and covering scans; callers must not retain the result.
      */
-    readFtsPostings(tableId: string, columnId: string, upToVersion: number): Promise<{
+    readFtsPostings(tableId: string, columnId: string, upToVersion: number, maxRowIds?: number, maxRetainedBytes?: number): Promise<{
         postings: FtsPosting[];
+        /** The bounded merge stopped early; callers must scan and may rebuild the accelerator. */
+        overflow: boolean;
         deltaChunkCount: number;
         coversVersion: number;
         hasBase: boolean;
@@ -1195,6 +2215,7 @@ export interface FtsIndexStore {
  * records are real records with the usual compare-and-swap (`TempOwnerConflictError`).
  */
 export interface TempSpillStore {
+    /** Atomically enforces the per-owner run/page ceilings before storing payload bytes. */
     putTempRunPage(page: TempRunPage): Promise<void>;
     /**
      * Optional: writes a batch of pages in one storage round trip. Callers fall back to
@@ -1206,13 +2227,16 @@ export interface TempSpillStore {
     removeTempRun(ownerId: string, runId: string): Promise<void>;
     /** Removes the owner record and every page under the owner. */
     removeTempOwner(ownerId: string): Promise<void>;
+    /** Sweeps a bounded expired page before atomically enforcing MAX_ACTIVE_TEMP_OWNERS. */
     createTempOwner(record: TempOwnerRecord): Promise<void>;
     getTempOwner(ownerId: string): Promise<TempOwnerRecord | undefined>;
-    renewTempOwner(ownerId: string, expectedRevision: number, expiresAt: string): Promise<TempOwnerRecord>;
+    renewTempOwner(input: RenewTempOwnerInput): Promise<TempOwnerRecord>;
     /** Sweeps pages too when it removes; owners found only via orphaned pages count as expired. */
     removeTempOwnerIfExpired(ownerId: string, expiresAtCutoff: string): Promise<boolean>;
     /** Owner ids from records and from orphaned pages alike, deduplicated, sorted, paged. */
     listTempOwnerIdsPage(afterOwnerId: string | null, limit: number): Promise<StoragePage<string, string>>;
+    /** Actual expired candidates only, ordered by expiry then owner id. */
+    listExpiredTempOwnerPage(expiresAtCutoff: string, afterCursor: string | null, limit: number): Promise<StoragePage<string, string>>;
 }
 /**
  * The complete storage contract: a database is `MinnowDatabase` plus one implementation of
@@ -1227,8 +2251,10 @@ export interface TempSpillStore {
  *
  * - **Atomicity.** Every method is all-or-nothing, including after a crash at any moment.
  *   `commitTransaction` and `runGarbageCollectionStep` mutate several record families in one
- *   durable step. A method that resolves has happened; a method that rejects has not
- *   (observably) happened.
+ *   durable step. A local adapter method that resolves has happened; one that rejects has not
+ *   happened. The narrow transport-loss exception is an OPFS follower call that throws
+ *   `OpfsUncertainOutcomeError`: its prior leader may have committed the named mutation before
+ *   losing the reply, so callers must inspect/reopen instead of blindly repeating it.
  * - **Conflicts are typed, by exact class.** Compare-and-swap failures throw the exported
  *   error classes (`WriteConflictError`, `TransactionRecordConflictError`,
  *   `TableRecordConflictError`, `LeaseConflictError`, `CompactionJobConflictError`,
@@ -1242,10 +2268,10 @@ export interface TempSpillStore {
  *   received records and bytes must be copied or serialized before the call resolves.
  * - **Deterministic ordering.** List methods sort as documented on each capability interface;
  *   pagination cursors are stable under concurrent writes.
- * - **Optional means atomic.** The optional methods exist so an adapter that can do something
- *   in one atomic step may say so; callers trust a present method completely and fall back to
- *   the sequential calls when it is absent. Never implement one as the sequential calls in a
- *   trench coat.
+ * - **Optional means atomic.** Optional accelerator methods exist so an adapter that can do
+ *   something in one atomic step may say so; callers trust a present method completely and fall
+ *   back to safe sequential calls when it is absent. Never implement one as sequential calls in
+ *   a trench coat.
  * - **Multiple connections are normal.** Several instances (tabs) may open one database.
  *   Readers must never block writers; competing writers must resolve through the typed
  *   conflicts. How is the adapter's business — storage transactions, a write-ahead log behind
@@ -1265,46 +2291,51 @@ export interface BlockStore extends BlockPayloadStore, CatalogStore, Transaction
      * generation per retry. Required because an index build must never materialize one
      * database-sized storage value as a fallback.
      */
-    beginFtsBaseBuild(tableId: string, columnId: string, buildId: string): Promise<void>;
-    writeFtsBaseBuildChunk(tableId: string, columnId: string, buildId: string, ordinal: number, chunk: FtsPosting[]): Promise<void>;
-    finishFtsBaseBuild(tableId: string, columnId: string, buildId: string, input: {
-        coversVersion: number;
-        chunkCount: number;
-        totalTokens: number;
-    }): Promise<void>;
-    abortFtsBaseBuild(tableId: string, columnId: string, buildId: string): Promise<void>;
+    beginFtsBaseBuild(input: BeginPostingBuildInput): Promise<void>;
+    renewFtsBaseBuild(input: RenewPostingBuildInput): Promise<void>;
+    writeFtsBaseBuildChunk(input: AppendPostingBuildChunkInput): Promise<void>;
+    finishFtsBaseBuild(input: FinishPostingBuildInput): Promise<void>;
+    abortFtsBaseBuild(input: AbortPostingBuildInput): Promise<void>;
     /**
-     * Optional: the current manifest version and catalog epoch in one atomic read. This is the
-     * freshness probe: an unchanged pair proves any cached catalog state is still exactly what
-     * a fresh read would return. Callers that find this absent must not cache catalog state.
+     * The current manifest version, catalog epoch, and structural schema epoch in one atomic read.
+     * An unchanged manifest/catalog pair proves cached query state is current; the schema epoch is
+     * the narrower write-serialization guard and does not move for ordinary commits.
      */
-    getCatalogProbe?(): Promise<CatalogProbe>;
+    getCatalogProbe(): Promise<CatalogProbe>;
     /**
-     * Optional: one atomic catalog read for query preparation. Implementations must return
-     * the named table records plus the segments and transactions reachable from the returned
-     * current manifest version. Historical records may be omitted: explicit version reads use
-     * listSegments/getTransactions instead. Callers fall back to those calls when this is absent.
+     * Optional atomic query-catalog read. The returned tables, segments, transaction owners, and
+     * probe epoch must come from one storage snapshot; engines use the sequential stable-epoch
+     * fallback when an adapter does not provide it.
      */
-    getQueryCatalogState?(tableNames: readonly string[]): Promise<QueryCatalogState>;
+    getQueryCatalogState?(names: readonly string[]): Promise<QueryCatalogState>;
     /**
-     * Optional: reads the current manifest version, creates the transaction record pinned to it,
-     * and optionally reserves row ids, all in one atomic storage transaction — one round trip
-     * instead of three. Callers fall back to the individual calls when this is absent.
+     * Reads the current manifest and schema epoch, creates the transaction record pinned to both,
+     * and optionally reserves row ids or an invisible pending table in one atomic storage
+     * transaction. Required because these reservations cannot be emulated safely by sequential
+     * calls.
      */
-    beginTransaction?(input: BeginTransactionInput): Promise<BeginTransactionResult>;
+    beginTransaction(input: BeginTransactionInput): Promise<BeginTransactionResult>;
     /**
-     * Optional: stages blocks and segments and journals them on the transaction record in one
-     * atomic storage transaction. Must be equivalent to addBlocks + addSegment(s) + one
-     * updateTransaction appending the new ids, with no intermediate state observable after a
-     * crash. Callers fall back to those calls when this is absent.
+     * Required atomic staging boundary: saves blocks and segments and appends their ids to the
+     * active transaction journal in one durable operation. It is equivalent to addBlocks +
+     * addSegment(s) + one updateTransaction only when those changes commit atomically; there is no
+     * sequential fallback because a crash could otherwise strand bytes or publish a dangling id.
+     * A local refusal has no effect; the documented OPFS follower uncertain-outcome error means
+     * the complete operation may have happened and must never be converted to an ordinary error.
      */
-    stageTransactionArtifacts?(input: StageTransactionArtifactsInput): Promise<TransactionRecord>;
+    stageTransactionArtifacts(input: StageTransactionArtifactsInput): Promise<TransactionRecord>;
+    /**
+     * Required atomic savepoint rewind. Compare-and-swaps the journal, validates retained and
+     * removed ids as its exact duplicate-free partition, and removes only the unreachable removed
+     * artifacts in the same durable operation. A refusal leaves both journal and bytes unchanged.
+     */
+    rollbackTransactionArtifacts(input: RollbackTransactionArtifactsInput): Promise<TransactionRecord>;
     /**
      * Optional: the single-shot write — begin (or continue) a transaction, stage its blocks and
      * segments, and commit, all in one atomic storage transaction. Must be exactly equivalent to
      * `stageTransactionArtifacts` followed by `commitTransaction` (preceded by `createTransaction`
      * at `expectedManifestVersion` when the input carries a fresh record): the same validation,
-     * the same typed conflicts (`WriteConflictError`, `TransactionRecordConflictError`,
+     * the same typed conflicts (`SchemaConflictError`, `WriteConflictError`, `TransactionRecordConflictError`,
      * `UniqueKeyConflictError`), the same finalized records afterwards — and nothing at all
      * written when any part refuses, including the fresh record. This is what lets a simple
      * write cost one durable storage commit instead of three; callers fall back to the sequence
@@ -1315,29 +2346,52 @@ export interface BlockStore extends BlockPayloadStore, CatalogStore, Transaction
      * Optional: re-pins a lease to another manifest version and renews it, in one atomic step —
      * `createLease` at the new version plus `removeLease` of the old pin, as one round trip that
      * keeps the record and its id. Compare-and-swap on `expectedRevision` (`LeaseConflictError`);
-     * the target version's manifest must be available (`SnapshotManifestMissingError`), and a
-     * refused move leaves the lease exactly as it was. The engine uses it to carry its shared
+     * the target version's manifest must be available (`SnapshotManifestMissingError`), and a refused
+     * move leaves the lease exactly as it was. An already-expired pin cannot be moved or renewed,
+     * and the new expiry is capped by `MAX_LEASE_TTL_MS`. The engine uses it to carry its shared
      * reader pin forward after each commit; callers fall back to create + remove when absent.
      */
-    moveLease?(id: string, expectedRevision: number, manifestVersion: number | null, expiresAt: string): Promise<LeaseRecord>;
+    moveLease?(input: MoveLeaseInput): Promise<LeaseRecord>;
     /**
-     * Optional: one committed version copied out as a portable snapshot — see
-     * `/docs/storage/snapshots` for what it carries, drops, and guarantees. A store without it
-     * still works; `MinnowDatabase` reports the capability as missing rather than failing.
+     * Native bounded snapshot v1. Built-in adapters implement this complete family together.
+     * Export reads exactly one globally ordered frame at a time from a durable frozen generation;
+     * close releases that generation and its lease. No method returns a database-sized array.
      */
-    exportSnapshot?(): Promise<DatabaseSnapshot>;
+    beginSnapshotFrameExport?(input: BeginSnapshotFrameExportInput): Promise<SnapshotFrameExportSession>;
+    readSnapshotExportFrame?(input: ReadSnapshotExportFrameInput): Promise<SnapshotFrame | undefined>;
+    closeSnapshotFrameExport?(input: CloseSnapshotExportInput): Promise<boolean>;
     /**
-     * Optional: loads a snapshot into this store, which must be empty. Pairs with
-     * `exportSnapshot` — implement both or neither.
+     * Native bounded import. Append atomically accepts only contiguous bounded frames and exact
+     * lost-ack replay bytes. Finish validates header/footer counts, order, checksums, complete
+     * catalog/segment/transaction/index cross-references, and atomically promotes all staged
+     * generations; rejection leaves the current database unchanged.
      */
-    importSnapshot?(snapshot: DatabaseSnapshot, options?: {
-        onProgress?: (progress: SnapshotLoadProgress) => void;
-    }): Promise<void>;
+    beginSnapshotFrameImport?(input: BeginSnapshotFrameImportInput): Promise<SnapshotFrameImportSession>;
+    renewSnapshotFrameImport?(input: RenewSnapshotFrameImportInput): Promise<SnapshotFrameImportSession>;
+    appendSnapshotImportFrames?(input: AppendSnapshotImportFramesInput): Promise<SnapshotFrameImportSession>;
+    finishSnapshotFrameImport?(input: FinishSnapshotFrameImportInput): Promise<void>;
+    cancelSnapshotFrameImport?(input: CancelSnapshotImportInput): Promise<InterruptedSnapshotImportAbortResult>;
+    /** Bounded, fail-closed verification of control records and optionally every live block. */
+    checkIntegrity?(options?: {
+        mode?: StorageIntegrityMode;
+        maxIssues?: number;
+    }): Promise<StorageIntegrityReport>;
+    /** Explicit storage accounting; adapters do not run this on query or write hot paths. */
+    getStorageStats?(): Promise<StorageStats>;
+    /** Returns the durable marker for an unpublished snapshot import, if this adapter has one. */
+    inspectInterruptedImport?(): Promise<InterruptedSnapshotImport | null>;
+    /** Atomically abandons the named unpublished import and removes all staged state. */
+    abortInterruptedImport?(identity: string): Promise<InterruptedSnapshotImportAbortResult>;
     /**
      * Optional: what this database's data occupies in its substrate, in bytes — the number an
      * application shows a user next to the quota, and what the benchmarks report.
      */
     getLogicalStorageBytes?(): Promise<number>;
+    /**
+     * Optional deterministic channel for commit hints between connections to the same durable
+     * database. The engine creates the BroadcastChannel; stores only expose identity.
+     */
+    readonly liveQueryChannelName?: string;
     /**
      * Releases whatever the connection holds (open handles, channels, timers) without flushing
      * or deleting anything. Synchronous; safe to call twice. Data durability must never depend
@@ -1345,17 +2399,16 @@ export interface BlockStore extends BlockPayloadStore, CatalogStore, Transaction
      */
     close(): void;
 }
-export declare function createManifest(input: PublishManifestInput): Manifest;
-/**
- * Normalizes the additive L2 partition metadata while preserving legacy segment records verbatim.
- */
+export declare function createManifest(input: CreateManifestInput): Manifest;
+/** Strictly clones the one canonical v1 segment shape. */
 export declare function normalizeSegmentRecord(record: SegmentRecord): SegmentRecord;
 export declare function updateTransactionRecord(record: TransactionRecord, update: TransactionRecordUpdate): TransactionRecord;
 export declare function createGarbageCollectionJobRecord(input: CreateGarbageCollectionJobInput): GarbageCollectionJobRecord;
+export declare function normalizeGarbageCollectionDiscovery(discovery: GarbageCollectionDiscovery): GarbageCollectionDiscovery;
+export declare function updateGarbageCollectionPlanningRecord(record: GarbageCollectionJobRecord, input: UpdateGarbageCollectionPlanningInput): GarbageCollectionJobRecord;
 export declare function normalizeGarbageCollectionJobRecord(record: GarbageCollectionJobRecord): GarbageCollectionJobRecord;
 export declare function advanceGarbageCollectionJobRecord(record: GarbageCollectionJobRecord, accounting: GarbageCollectionStepAccounting): GarbageCollectionJobRecord;
 export declare function normalizeCompactionJobRecord(record: CompactionJobRecord): CompactionJobRecord;
 export declare function updateCompactionJobRecord(record: CompactionJobRecord, update: CompactionJobRecordUpdate): CompactionJobRecord;
 /** Floors an integer-times-double product without rounding the binary double upward. */
 export declare function floorWholeNumberProduct(left: number, right: number, label: string): number;
-//# sourceMappingURL=types.d.ts.map