@quereus/quereus 3.3.0 → 4.0.0

package/dist/src/vtab/memory/layer/manager.js

@@ -1,12 +1,16 @@
-import { buildColumnIndexMap, columnDefToSchema } from '../../../schema/table.js';
+import { buildColumnIndexMap, columnDefToSchema, resolvePkDefaultConflict, resolveNamedConstraintClass, validateCollationForType } from '../../../schema/table.js';
+import { BTree } from 'inheritree';
 import { StatusCode } from '../../../common/types.js';
 import { BaseLayer } from './base.js';
 import { TransactionLayer } from './transaction.js';
 import { MemoryTableConnection } from './connection.js';
+import { MemoryVirtualTableConnection } from '../connection.js';
 import { Latches } from '../../../util/latches.js';
 import { QuereusError } from '../../../common/errors.js';
 import { ConflictResolution } from '../../../common/constants.js';
-import { compareSqlValues } from '../../../util/comparison.js';
+import { buildUniqueConstraintSchema, buildForeignKeyConstraintSchema, buildCheckConstraintSchema, validateForeignKeyOverExistingRows, maintainedTableUniqueViolationError } from '../../../schema/constraint-builder.js';
+import { uniqueEnforcementCollations } from '../../../schema/unique-enforcement.js';
+import { compareSqlValues, rowsValueIdentical, normalizeCollationName } from '../../../util/comparison.js';
 import { scanLayer as scanLayerImpl } from './scan-layer.js';
 import { createPrimaryKeyFunctions, buildPrimaryKeyFromValues } from '../utils/primary-key.js';
 import { createMemoryTableLoggers } from '../utils/logging.js';
@@ -28,6 +32,15 @@ export class MemoryTableManager {
     isReadOnly;
     tableSchema;
     primaryKeyFunctions;
+    /**
+     * Implicit covering structures: constraint identity → the auto-index that
+     * realizes it. The physical structure is the synchronously-maintained
+     * secondary BTree; this association lets `findIndexForConstraint` and
+     * introspection speak the materialized-view vocabulary (an `origin`) for the
+     * implicit structure, the same way an explicit covering MV is described.
+     * Keyed by constraint name when present, else by the auto-index name.
+     */
+    implicitCoveringStructures = new Map();
     /** Optional event emitter for mutation and schema hooks */
     eventEmitter;
     constructor(db, _moduleName, schemaName, tableName, initialSchema, readOnly = false, eventEmitter) {
@@ -38,7 +51,17 @@ export class MemoryTableManager {
         this.tableSchema = initialSchema;
         this.isReadOnly = readOnly;
         this.eventEmitter = eventEmitter;
-        this.ensureUniqueConstraintIndexes();
+        // Phase D (docs/lens.md § Departures — Auto-index for unique/PK): the legacy
+        // eager auto-index for UNIQUE constraints is a *physical*-schema behavior. A
+        // logical schema's UNIQUE contributes only a key/FD to the optimizer and an
+        // enforced boundary constraint — it creates NO structure; any covering index
+        // is an explicit basis-layer materialized view. Logical tables are never
+        // module-backed (a MemoryTableManager is never constructed for one), so this
+        // path is already unreachable for them — we gate explicitly regardless, so the
+        // separation is enforced at the source rather than relying on that invariant.
+        if (!this.isLogicalSchema()) {
+            this.ensureUniqueConstraintIndexes();
+        }
         this.initializePrimaryKeyFunctions();
         this.baseLayer = new BaseLayer(this.tableSchema);
         this._currentCommittedLayer = this.baseLayer;
@@ -46,10 +69,27 @@ export class MemoryTableManager {
     initializePrimaryKeyFunctions() {
         this.primaryKeyFunctions = createPrimaryKeyFunctions(this.tableSchema);
     }
+    /**
+     * One-bit guard on `Schema.kind` (docs/lens.md § Departures): true when this
+     * table belongs to a logical schema. Prefers the table's own `isLogical` flag
+     * and falls back to the owning schema's `kind`, so the gate holds even if a
+     * logical TableSchema were ever (incorrectly) handed to a memory manager.
+     */
+    isLogicalSchema() {
+        if (this.tableSchema.isLogical === true)
+            return true;
+        return this.db.schemaManager.getSchema(this.schemaName)?.kind === 'logical';
+    }
     /**
      * Auto-creates secondary indexes for UNIQUE constraints that don't already
      * have a matching index. This mirrors standard SQL behavior where UNIQUE
      * constraints imply an index for efficient enforcement.
+     *
+     * Alongside each such index, records an *implicit covering structure*
+     * descriptor in {@link implicitCoveringStructures} (the materialized-view
+     * vocabulary) so the implicit BTree and a future explicit covering MV share
+     * one schema shape. The physical structure is unchanged — observation-
+     * equivalent, zero behavioral difference.
      */
     ensureUniqueConstraintIndexes() {
         const uniqueConstraints = this.tableSchema.uniqueConstraints;
@@ -59,18 +99,34 @@ export class MemoryTableManager {
         const newIndexes = [...existingIndexes];
         let added = false;
         for (const uc of uniqueConstraints) {
-            const hasMatchingIndex = existingIndexes.some(idx => idx.columns.length === uc.columns.length &&
-                idx.columns.every((col, i) => col.index === uc.columns[i]));
-            if (!hasMatchingIndex) {
+            // Reuse an existing same-column-set index ONLY when its per-column
+            // collations are equivalent to the declared column collations — otherwise
+            // it would enforce this non-derived UC under the index's collation rather
+            // than the declared one. A collation-mismatched index falls through to a
+            // distinct `_uc_*` covering index and coexists as its own constraint.
+            const matchingIndex = existingIndexes.find(idx => idx.columns.length === uc.columns.length &&
+                idx.columns.every((col, i) => col.index === uc.columns[i]) &&
+                this.indexCollationsMatchDeclared(idx, uc));
+            let indexName;
+            if (matchingIndex) {
+                indexName = matchingIndex.name;
+            }
+            else {
                 const colNames = uc.columns.map(i => this.tableSchema.columns[i]?.name ?? String(i));
-                const indexName = uc.name ?? `_uc_${colNames.join('_')}`;
+                indexName = uc.name ?? `_uc_${colNames.join('_')}`;
                 newIndexes.push({
                     name: indexName,
-                    columns: uc.columns.map(colIdx => ({ index: colIdx })),
+                    // Carry each column's declared collation so the auto-index — and the
+                    // `checkUniqueViaIndex` path it backs — enforces UNIQUE under the column's
+                    // collation (e.g. NOCASE) rather than defaulting to BINARY.
+                    columns: uc.columns.map(colIdx => ({ index: colIdx, collation: this.tableSchema.columns[colIdx]?.collation })),
                     predicate: uc.predicate,
                 });
                 added = true;
             }
+            // Reframe the (auto or pre-existing) secondary index as the implicit
+            // covering structure realizing this constraint.
+            this.implicitCoveringStructures.set(uc.name ?? indexName, { indexName, origin: 'implicit-from-unique-constraint' });
         }
         if (added) {
             this.tableSchema = {
@@ -79,6 +135,48 @@ export class MemoryTableManager {
             };
         }
     }
+    /**
+     * Returns the implicit covering structure realizing the given UNIQUE
+     * constraint, or undefined when none was synthesized. Part of the unified
+     * covering-structure surface the lens layer and introspection consume — the
+     * physical structure is the synchronously-maintained secondary BTree named
+     * {@link ImplicitCoveringStructure.indexName}.
+     */
+    getImplicitCoveringStructure(uc) {
+        const indexName = uc.name ?? this.implicitIndexNameFor(uc);
+        return this.implicitCoveringStructures.get(indexName);
+    }
+    /** Conventional auto-index name for an unnamed UNIQUE constraint (mirrors {@link ensureUniqueConstraintIndexes}). */
+    implicitIndexNameFor(uc) {
+        const colNames = uc.columns.map(i => this.tableSchema.columns[i]?.name ?? String(i));
+        return `_uc_${colNames.join('_')}`;
+    }
+    /**
+     * True when a same-column-set index's per-column collations are
+     * collation-equivalent to the constraint's DECLARED column collations.
+     *
+     * Gates REUSE of an existing same-column-set index as a non-derived UNIQUE's
+     * realizing structure. A non-derived (table-level / column) UNIQUE enforces
+     * under the declared column collation, so reusing a finer/coarser-collated
+     * same-column-set index (e.g. a BINARY `create unique index` over a NOCASE
+     * column) would silently enforce under the index's collation instead. When
+     * this returns false the caller builds the distinct `_uc_*` covering index and
+     * lets the user index coexist as an independent constraint (matches SQLite,
+     * where both indexes enforce).
+     *
+     * Positions align because the column SET already matched
+     * (`idx.columns[i]` ↔ `uc.columns[i]`). A plain index column with no explicit
+     * COLLATE has `collation === undefined` and falls back to the declared
+     * collation, so the common case stays reuse-safe.
+     */
+    indexCollationsMatchDeclared(idx, uc) {
+        const columns = this.tableSchema.columns;
+        return uc.columns.every((colIdx, i) => {
+            const declared = normalizeCollationName(columns[colIdx]?.collation ?? 'BINARY');
+            const indexColl = normalizeCollationName(idx.columns[i]?.collation ?? columns[colIdx]?.collation ?? 'BINARY');
+            return indexColl === declared;
+        });
+    }
     /**
      * Get the event emitter if one was provided.
      */
@@ -545,12 +643,16 @@ export class MemoryTableManager {
                 existingRow: existingRow
             };
         }
-        // Check UNIQUE constraints against secondary indexes
-        const ucResult = this.checkUniqueConstraints(targetLayer, schema, newRowData, primaryKey, onConflict);
+        // Check UNIQUE constraints against secondary indexes. Secondary-UNIQUE
+        // REPLACE evictions (rows at OTHER PKs) accumulate in `evicted` and are
+        // surfaced via `evictedRows` so the DML executor runs the full delete
+        // pipeline (change-tracking, row-time MV maintenance, FK cascade, events).
+        const evicted = [];
+        const ucResult = await this.checkUniqueConstraints(targetLayer, schema, newRowData, primaryKey, onConflict, evicted);
         if (ucResult)
             return ucResult;
         targetLayer.recordUpsert(primaryKey, newRowData, null);
-        return { status: 'ok', row: newRowData };
+        return { status: 'ok', row: newRowData, evictedRows: evicted.length > 0 ? evicted : undefined };
     }
     async performUpdate(targetLayer, values, oldKeyValues, onConflict) {
         if (!values || !oldKeyValues) {
@@ -583,17 +685,20 @@ export class MemoryTableManager {
             return this.performUpdateWithPrimaryKeyChange(targetLayer, schema, targetPrimaryKey, newPrimaryKey, oldRowData, newRowData, onConflict);
         }
         else {
-            // Check UNIQUE constraints if any constrained columns changed
+            // Check UNIQUE constraints if any constrained columns changed. A
+            // secondary-UNIQUE REPLACE evicts the conflicting row(s) at other PKs;
+            // surface them via `evictedRows` for the executor's delete pipeline.
+            const evicted = [];
             if (this.uniqueColumnsChanged(schema, oldRowData, newRowData)) {
-                const ucResult = this.checkUniqueConstraints(targetLayer, schema, newRowData, targetPrimaryKey, onConflict);
+                const ucResult = await this.checkUniqueConstraints(targetLayer, schema, newRowData, targetPrimaryKey, onConflict, evicted);
                 if (ucResult)
                     return ucResult;
             }
             targetLayer.recordUpsert(targetPrimaryKey, newRowData, oldRowData);
-            return { status: 'ok', row: newRowData };
+            return { status: 'ok', row: newRowData, evictedRows: evicted.length > 0 ? evicted : undefined };
         }
     }
-    performUpdateWithPrimaryKeyChange(targetLayer, schema, oldPrimaryKey, newPrimaryKey, oldRowData, newRowData, onConflict) {
+    async performUpdateWithPrimaryKeyChange(targetLayer, schema, oldPrimaryKey, newPrimaryKey, oldRowData, newRowData, onConflict) {
         const existingRowAtNewKey = this.lookupEffectiveRow(newPrimaryKey, targetLayer);
         if (existingRowAtNewKey !== null) {
             const pkAction = onConflict ?? resolvePkDefaultConflict(schema) ?? ConflictResolution.ABORT;
@@ -615,16 +720,19 @@ export class MemoryTableManager {
                 existingRow: existingRowAtNewKey
             };
         }
-        // Delete old row first, then check UNIQUE constraints at the new position
+        // Delete old row first, then check UNIQUE constraints at the new position.
+        // A secondary-UNIQUE REPLACE at the new position evicts conflicting row(s)
+        // at other PKs; surface them via `evictedRows` for the executor pipeline.
         targetLayer.recordDelete(oldPrimaryKey, oldRowData);
-        const ucResult = this.checkUniqueConstraints(targetLayer, schema, newRowData, newPrimaryKey, onConflict);
+        const evicted = [];
+        const ucResult = await this.checkUniqueConstraints(targetLayer, schema, newRowData, newPrimaryKey, onConflict, evicted);
         if (ucResult) {
             // Rollback the delete if constraint check fails
             targetLayer.recordUpsert(oldPrimaryKey, oldRowData, null);
             return ucResult;
         }
         targetLayer.recordUpsert(newPrimaryKey, newRowData, null);
-        return { status: 'ok', row: newRowData };
+        return { status: 'ok', row: newRowData, evictedRows: evicted.length > 0 ? evicted : undefined };
     }
     async performDelete(targetLayer, oldKeyValues) {
         if (!oldKeyValues) {
@@ -653,8 +761,13 @@ export class MemoryTableManager {
                     return true;
             }
             if (uc.predicate) {
-                const idx = this.findIndexForConstraint(this._currentCommittedLayer, uc);
-                const referenced = idx?.predicate?.referencedColumns;
+                const covering = this.findIndexForConstraint(this._currentCommittedLayer, uc);
+                // For an index the compiled predicate is already on hand; for an MV-covered
+                // (or uncovered) constraint, compile the partial predicate ad hoc to learn
+                // which columns can transition the row across the predicate's scope.
+                const referenced = covering?.kind === 'memory-index'
+                    ? covering.index.predicate?.referencedColumns
+                    : compilePredicate(uc.predicate, schema.columns).referencedColumns;
                 if (referenced) {
                     for (const colIdx of referenced) {
                         if (compareSqlValues(oldRow[colIdx], newRow[colIdx]) !== 0)
@@ -668,78 +781,251 @@ export class MemoryTableManager {
     /**
      * Checks all UNIQUE constraints for a new/updated row. Returns an UpdateResult
      * if a violation is found (or IGNORE suppresses the insert), or null if all pass.
-     * For REPLACE conflicts, the conflicting rows are deleted from the layer.
+     * For REPLACE conflicts, the conflicting rows are deleted from the layer and
+     * pushed onto `evicted` so the DML executor can run the full delete pipeline
+     * (change-tracking, row-time MV maintenance, FK cascade, auto-events) for each.
      */
-    checkUniqueConstraints(targetLayer, schema, newRowData, newPrimaryKey, onConflict) {
+    async checkUniqueConstraints(targetLayer, schema, newRowData, newPrimaryKey, onConflict, evicted) {
         if (!schema.uniqueConstraints)
             return null;
         for (const uc of schema.uniqueConstraints) {
-            const result = this.checkSingleUniqueConstraint(targetLayer, schema, uc, newRowData, newPrimaryKey, onConflict);
+            const result = await this.checkSingleUniqueConstraint(targetLayer, schema, uc, newRowData, newPrimaryKey, onConflict, evicted);
             if (result)
                 return result;
         }
         return null;
     }
-    checkSingleUniqueConstraint(targetLayer, schema, uc, newRowData, newPrimaryKey, onConflict) {
+    async checkSingleUniqueConstraint(targetLayer, schema, uc, newRowData, newPrimaryKey, onConflict, evicted, allowMvCovering = true) {
         // SQL semantics: UNIQUE allows multiple NULLs — skip if any constrained column is NULL
         if (uc.columns.some(colIdx => newRowData[colIdx] === null))
             return null;
-        // Find the matching secondary index for this constraint
-        const index = this.findIndexForConstraint(targetLayer, uc);
-        // Partial UNIQUE: a row whose predicate is not unambiguously TRUE is
-        // outside the index's scope and contributes nothing to uniqueness.
-        if (index?.predicate && !index.rowMatchesPredicate(newRowData)) {
+        // Find the covering structure enforcing this constraint.
+        const covering = this.findIndexForConstraint(targetLayer, uc, allowMvCovering);
+        // Partial UNIQUE: a row whose predicate is not unambiguously TRUE is outside
+        // the structure's scope and contributes nothing to uniqueness. The source-side
+        // skip must short-circuit identically regardless of which structure covers the
+        // constraint — for the MV path the partial scope is governed by the (aligned)
+        // `uc.predicate` (the prover proves the MV's WHERE equivalent to it).
+        if (covering?.kind === 'memory-index'
+            && covering.index.predicate
+            && !covering.index.rowMatchesPredicate(newRowData)) {
+            return null;
+        }
+        if (covering?.kind === 'materialized-view'
+            && uc.predicate
+            && compilePredicate(uc.predicate, schema.columns).evaluate(newRowData) !== true) {
             return null;
         }
         // Resolve effective action: statement OR > constraint default > ABORT.
         const effective = onConflict ?? uc.defaultConflict ?? ConflictResolution.ABORT;
-        if (index) {
-            return this.checkUniqueViaIndex(targetLayer, schema, uc, index, newRowData, newPrimaryKey, effective);
+        if (covering) {
+            switch (covering.kind) {
+                case 'memory-index':
+                    return this.checkUniqueViaIndex(targetLayer, schema, uc, covering.index, newRowData, newPrimaryKey, effective, evicted);
+                case 'materialized-view':
+                    return this.checkUniqueViaMaterializedView(targetLayer, schema, uc, covering.view, newRowData, newPrimaryKey, effective, evicted);
+                default: {
+                    const exhaustive = covering;
+                    throw new QuereusError(`Unknown covering structure: ${JSON.stringify(exhaustive)}`, StatusCode.INTERNAL);
+                }
+            }
         }
         // Fallback: scan primary tree
-        return this.checkUniqueByScanning(targetLayer, schema, uc, newRowData, newPrimaryKey, effective);
+        return this.checkUniqueByScanning(targetLayer, schema, uc, newRowData, newPrimaryKey, effective, evicted);
     }
-    findIndexForConstraint(targetLayer, uc) {
+    /**
+     * Resolves the {@link CoveringStructure} enforcing a UNIQUE constraint. Prefers
+     * a linked, non-stale row-time covering MV when one is present (the live
+     * enforcement path in v1; the sole structure once the auto-index is
+     * retired — see {@link CoveringStructure}), falling back to the auto-built
+     * `memory-index`. The row-time resolution is a synchronous map lookup with an
+     * O(1) negative fast path, so a non-covered table stays on the index path at
+     * effectively no cost.
+     *
+     * `allowMvCovering = false` skips the MV preference: the maintenance-write
+     * enforcement path ({@link enforceSecondaryUniqueOnMaintenance}) checks rows
+     * THIS table's batch just wrote, and a covering MV over this table is
+     * cascade-maintained only after the batch returns — it lags the batch and
+     * would miss a same-batch colliding pair. The synchronously-maintained
+     * auto-index is exact.
+     */
+    findIndexForConstraint(targetLayer, uc, allowMvCovering = true) {
+        if (allowMvCovering) {
+            const mv = this.db._findRowTimeCoveringStructure(this.schemaName, this._tableName, uc);
+            if (mv)
+                return { kind: 'materialized-view', view: mv };
+        }
         const schema = targetLayer.getSchema();
         if (!schema.indexes)
             return undefined;
+        // Resolve the constraint's OWN realizing structure BY NAME — never the
+        // column-set scan below, which returns the FIRST same-column-set index and
+        // (when several differently-collated indexes cover one column-set) would
+        // enforce a UC under the wrong index's collation, generating candidates from
+        // that index's wrongly-keyed BTree:
+        //  - index-derived UNIQUE (`CREATE UNIQUE INDEX`) → its own index name via
+        //    `uc.derivedFromIndex` (matches store/isolation's by-name resolution
+        //    through `uniqueEnforcementCollations`).
+        //  - non-derived UNIQUE (table-level / column) → its own `_uc_*` covering
+        //    index via `implicitCoveringStructures`. The realization guard only
+        //    reuses a collation-equivalent same-column-set index, so a pre-existing
+        //    finer index (e.g. BINARY over a NOCASE column) no longer collapses onto
+        //    the constraint; resolving by name is robust to `schema.indexes` order
+        //    (the finer index may be listed earlier, having been created first).
+        // Both fall through to the column-set scan only when the name does not
+        // resolve (defensive).
+        if (uc.derivedFromIndex) {
+            const index = targetLayer.getSecondaryIndex?.(uc.derivedFromIndex);
+            if (index)
+                return { kind: 'memory-index', index };
+        }
+        else {
+            const own = this.getImplicitCoveringStructure(uc);
+            if (own) {
+                const index = targetLayer.getSecondaryIndex?.(own.indexName);
+                if (index)
+                    return { kind: 'memory-index', index };
+            }
+        }
+        // Defensive fallback: match the auto-built `_uc_*` covering index by
+        // column-set when the by-name resolution above did not land.
         for (const idx of schema.indexes) {
             if (idx.columns.length === uc.columns.length &&
                 idx.columns.every((col, i) => col.index === uc.columns[i])) {
-                return targetLayer.getSecondaryIndex?.(idx.name);
+                const index = targetLayer.getSecondaryIndex?.(idx.name);
+                return index ? { kind: 'memory-index', index } : undefined;
             }
         }
         return undefined;
     }
-    checkUniqueViaIndex(targetLayer, schema, uc, index, newRowData, newPrimaryKey, onConflict) {
+    checkUniqueViaIndex(targetLayer, schema, uc, index, newRowData, newPrimaryKey, onConflict, evicted) {
         const indexKey = index.keyFromRow(newRowData);
         const existingPKs = index.getPrimaryKeys(indexKey);
         for (const existingPK of existingPKs) {
             if (this.comparePrimaryKeys(newPrimaryKey, existingPK) === 0)
                 continue;
-            // Found a different row with the same unique key values
+            // Validate the candidate against the live effective row before acting —
+            // the same stale-candidate discipline as checkUniqueViaMaterializedView.
+            // An index entry's PK can still lag the effective row set *within* a
+            // statement (a candidate row deleted/updated internally, or a prior
+            // REPLACE eviction whose index removal lands later in the batch), so a
+            // candidate whose row is gone, no longer carries the colliding values,
+            // or left a partial index's scope is skipped rather than raised as a
+            // false conflict (or, worse, REPLACE-evicting an innocent row). The
+            // entry now tracks PKs by value (removeEntry drops composite PKs
+            // correctly, so it no longer accumulates stale-by-reference members);
+            // this live re-check remains as defense-in-depth for that genuine
+            // intra-statement lag.
+            // Compare under the INDEX's per-column collation (positionally aligned
+            // with uc.columns — findIndexForConstraint requires it): the index is
+            // the enforcing structure, and an explicit `create unique index …
+            // (col collate nocase)` may declare a coarser collation than the
+            // column — re-checking under the column's collation would skip the
+            // case-variant candidates the index legitimately unifies.
+            // This is the authoritative LIVE-index source for the per-column
+            // enforcement collation. The shared `uniqueEnforcementCollations(schema,
+            // uc)` helper (which store/isolation import, and checkUniqueViaMaterializedView
+            // uses) resolves the SAME per-column value, but BY NAME via
+            // `uc.derivedFromIndex`. `findIndexForConstraint` now ALSO resolves an
+            // index-derived UC by that name (the column-set scan is only the
+            // non-derived fallback), so the live `index` handle here IS the UC's own
+            // index and `index.specColumns[i]?.collation` is the correct per-column
+            // collation even when several same-column-set indexes exist with
+            // differing collations. The `(schema, uc)` helper signature still has no
+            // MemoryIndex handle, so this site keeps the live-handle read — but the
+            // two resolutions now agree on the multi-index shape too. The agreement is
+            // pinned by test/unique-enforcement-collation.spec.ts (a real divergence
+            // is a finding, not a reason to widen the helper).
+            const conflictingRow = this.lookupEffectiveRow(existingPK, targetLayer);
+            if (!conflictingRow)
+                continue;
+            if (!uc.columns.every((col, i) => compareSqlValues(newRowData[col], conflictingRow[col], index.specColumns[i]?.collation ?? schema.columns[col].collation) === 0))
+                continue;
+            if (index.predicate && !index.rowMatchesPredicate(conflictingRow))
+                continue;
+            // Found a different live row with the same unique key values
             if (onConflict === ConflictResolution.IGNORE) {
                 return { status: 'ok', row: undefined };
             }
             if (onConflict === ConflictResolution.REPLACE) {
-                const conflictingRow = this.lookupEffectiveRow(existingPK, targetLayer);
-                if (conflictingRow) {
-                    targetLayer.recordDelete(existingPK, conflictingRow);
-                }
-                return null; // Conflict resolved, continue with insert
+                targetLayer.recordDelete(existingPK, conflictingRow);
+                // Report the eviction so the executor runs its delete pipeline.
+                evicted.push(conflictingRow);
+                continue; // conflict resolved, keep scanning for further duplicates
             }
             const colNames = uc.columns.map(i => schema.columns[i].name).join(', ');
-            const existingRow = this.lookupEffectiveRow(existingPK, targetLayer);
             return {
                 status: 'constraint',
                 constraint: 'unique',
                 message: `UNIQUE constraint failed: ${this._tableName} (${colNames})`,
-                existingRow: existingRow ?? undefined
+                existingRow: conflictingRow
             };
         }
         return null;
     }
-    checkUniqueByScanning(targetLayer, schema, uc, newRowData, newPrimaryKey, onConflict) {
+    /**
+     * Enforce a UNIQUE constraint through its linked `row-time` covering MV's backing
+     * table (mirrors {@link checkUniqueViaIndex}, but the candidates come from the MV
+     * rather than a secondary BTree). The backing scan yields candidate conflicting
+     * source PKs; each is *validated against the live source row* before acting, since
+     * a backing entry can lag a source row deleted/updated internally within the same
+     * statement (e.g. the PK-changing-UPDATE delete below, or a prior REPLACE eviction)
+     * — the row-time hook only fires for DML-executor row writes, not these internal
+     * mutations. A candidate whose source row is gone or no longer matches the UC is
+     * stale and skipped, so a false conflict is never raised.
+     *
+     * On a REPLACE eviction the conflicting **source** row is deleted directly on the
+     * transaction layer and pushed onto `evicted`; the DML executor then runs the full
+     * delete pipeline for it (change-tracking, FK cascade, auto-events, and the
+     * row-time covering-structure maintenance that removes the evicted row's backing
+     * entry — so a later same-UC row in the statement never sees a phantom). The
+     * executor processes the eviction before the writing row's own bookkeeping, so the
+     * backing delete still lands within this statement.
+     */
+    async checkUniqueViaMaterializedView(targetLayer, schema, uc, mv, newRowData, newPrimaryKey, onConflict, evicted) {
+        const newSourcePk = Array.isArray(newPrimaryKey) ? newPrimaryKey : [newPrimaryKey];
+        const conflicts = await this.db._lookupCoveringConflicts(mv, uc, newRowData, newSourcePk);
+        // Re-validate under each column's enforcement collation — the index's per-column
+        // COLLATE for an index-derived UNIQUE, else the declared column collation
+        // (uniqueEnforcementCollations) — mirroring checkUniqueViaIndex, the store's
+        // findUniqueConflictViaCoveringMv, and the isolation overlay, so all modules agree.
+        // The candidate generation (_lookupCoveringConflicts) narrows under the SOURCE
+        // column's DECLARED collation, so for a FINER index (e.g. BINARY over a NOCASE
+        // column) it returns a superset this filters down correctly; a finer/incomparable
+        // index-derived UNIQUE whose declared candidate set could be a subset is declined
+        // upstream by findRowTimeCoveringStructure's collation gate, so only BINARY-floor
+        // or equal-collation MVs ever reach here.
+        const collations = uniqueEnforcementCollations(schema, uc);
+        for (const conflict of conflicts) {
+            const existingPK = buildPrimaryKeyFromValues(conflict.pk, schema.primaryKeyDefinition);
+            if (this.comparePrimaryKeys(newPrimaryKey, existingPK) === 0)
+                continue;
+            // Validate against the live source row: skip stale backing candidates.
+            const conflictingRow = this.lookupEffectiveRow(existingPK, targetLayer);
+            if (!conflictingRow)
+                continue;
+            if (!uc.columns.every((col, i) => compareSqlValues(newRowData[col], conflictingRow[col], collations[i]) === 0))
+                continue;
+            if (onConflict === ConflictResolution.IGNORE) {
+                return { status: 'ok', row: undefined };
+            }
+            if (onConflict === ConflictResolution.REPLACE) {
+                targetLayer.recordDelete(existingPK, conflictingRow);
+                // Report the eviction; the executor maintains the covering backing.
+                evicted.push(conflictingRow);
+                continue; // conflict resolved, keep scanning for further duplicates
+            }
+            const colNames = uc.columns.map(i => schema.columns[i].name).join(', ');
+            return {
+                status: 'constraint',
+                constraint: 'unique',
+                message: `UNIQUE constraint failed: ${this._tableName} (${colNames})`,
+                existingRow: conflictingRow
+            };
+        }
+        return null;
+    }
+    checkUniqueByScanning(targetLayer, schema, uc, newRowData, newPrimaryKey, onConflict, evicted) {
         const primaryTree = targetLayer.getModificationTree('primary');
         if (!primaryTree)
             return null;
@@ -755,7 +1041,7 @@ export class MemoryTableManager {
                 continue;
             if (predicate && predicate.evaluate(existingRow) !== true)
                 continue;
-            const allMatch = uc.columns.every(colIdx => compareSqlValues(newRowData[colIdx], existingRow[colIdx]) === 0);
+            const allMatch = uc.columns.every(colIdx => compareSqlValues(newRowData[colIdx], existingRow[colIdx], schema.columns[colIdx].collation) === 0);
             if (!allMatch)
                 continue;
             if (onConflict === ConflictResolution.IGNORE) {
@@ -763,6 +1049,8 @@ export class MemoryTableManager {
             }
             if (onConflict === ConflictResolution.REPLACE) {
                 targetLayer.recordDelete(existingPK, existingRow);
+                // Report the eviction so the executor runs its delete pipeline.
+                evicted.push(existingRow);
                 return null;
             }
             const colNames = uc.columns.map(i => schema.columns[i].name).join(', ');
@@ -810,8 +1098,271 @@ export class MemoryTableManager {
         }
         this.baseLayer.primaryTree.insert(row);
     }
+    /**
+     * Atomically replaces the entire committed contents with `rows` by building a
+     * fresh {@link BaseLayer} and swapping it in under the SchemaChange latch.
+     * Used to (re)materialize a materialized view: callers run the view body to
+     * completion and hand the result rows here. Concurrent readers do NOT block:
+     * each scan reads a base-layer snapshot captured at start-of-call, so an
+     * in-flight scan keeps the pre-swap base while a fresh scan sees the new base
+     * — never a partial state. The swap itself is a single synchronous assignment
+     * performed under the SchemaChange latch (which serializes swaps with `alter
+     * table` and other refreshes, not with readers).
+     *
+     * Throws on a duplicate primary key among `rows` (the caller rolls back).
+     * Callers may pass `onDuplicateKey` to substitute a purpose-built diagnostic
+     * for the duplicate-PK case (e.g. the materialized-view "must be a set"
+     * message); when omitted, the generic backing-table message is thrown. The
+     * factory only controls the wording — duplicate detection still uses the
+     * btree's collation/desc/composite-correct key comparison.
+     */
+    async replaceBaseLayer(rows, onDuplicateKey) {
+        if (this.isReadOnly) {
+            throw new QuereusError(`Table '${this._tableName}' is read-only`, StatusCode.READONLY);
+        }
+        const lockKey = `MemoryTable.SchemaChange:${this.schemaName}.${this._tableName}`;
+        const release = await Latches.acquire(lockKey);
+        try {
+            // Drain any in-flight transaction layers down to the base so the swap
+            // below isn't shadowed by a committed transaction layer ahead of base.
+            await this.ensureSchemaChangeSafety();
+            const oldBase = this.baseLayer;
+            const newBase = new BaseLayer(this.tableSchema);
+            for (const row of rows) {
+                const key = this.primaryKeyFunctions.extractFromRow(row);
+                const path = newBase.primaryTree.find(key);
+                if (path.on) {
+                    throw onDuplicateKey
+                        ? onDuplicateKey()
+                        : new QuereusError(`UNIQUE constraint failed: ${this._tableName} PK.`, StatusCode.CONSTRAINT);
+                }
+                newBase.primaryTree.insert(row);
+            }
+            newBase.rebuildAllSecondaryIndexes();
+            this.baseLayer = newBase;
+            this._currentCommittedLayer = newBase;
+            // Re-point any connection still reading the old base at the new base so
+            // the next statement observes refreshed contents.
+            for (const conn of this.connections.values()) {
+                if (conn.readLayer === oldBase) {
+                    conn.readLayer = newBase;
+                }
+            }
+        }
+        finally {
+            release();
+        }
+    }
+    /**
+     * Privileged **transactional** maintenance write: apply an ordered
+     * {@link MaintenanceOp} batch to a given connection's *pending*
+     * {@link TransactionLayer} (creating it lazily, exactly as a user write would).
+     * The row-time materialized-view maintenance path uses it so a covering
+     * structure's backing table is kept consistent synchronously with each source
+     * row-write — within the same transaction, visible to later reads on this
+     * connection (reads-own-writes), and committed/rolled-back in lockstep with the
+     * source write by the Database's coordinated commit.
+     *
+     * It deliberately bypasses {@link validateMutationPermissions} (which throws
+     * READONLY for MV backing tables) and reuses {@link TransactionLayer.recordUpsert} /
+     * {@link TransactionLayer.recordDelete} so secondary-index and change-tracking
+     * bookkeeping stay correct. No latch is taken: the pending layer is private to
+     * `connection`, only this synchronous path writes it, and the tree mutations are
+     * synchronous — so a multi-row statement's later rows observe earlier rows'
+     * pending writes with no interleaving.
+     *
+     * Declared secondary UNIQUE constraints ARE enforced — post-batch, against the
+     * final effective contents, throwing the maintained-table-attributed
+     * CONSTRAINT error ({@link enforceSecondaryUniqueOnMaintenance}). CHECK / FK
+     * stay engine-validated (see `vtab/backing-host.ts` § Constraint validation).
+     *
+     * Returns the **effective** changes it applied (one {@link BackingRowChange} per
+     * backing row it mutated): a `delete-key` that found a row → `delete`; an `upsert` →
+     * `update` when it replaced an existing row, else `insert`; a `delete-by-prefix` →
+     * one `delete` per matched row; a `replace-all` → the minimal keyed diff between the
+     * new and old contents (insert/update/delete, identical rows skipped). A
+     * `delete-key`/`delete-by-prefix` that matches nothing, an `upsert` whose row is
+     * **value-identical** to the effective existing row (`rowsValueIdentical` — written
+     * nothing, reported nothing; the normative skip in `vtab/backing-host.ts`), or a
+     * `replace-all` whose new contents equal the old — produces nothing. The MV-over-MV
+     * cascade feeds these onward to MVs reading this backing table (see
+     * `database-materialized-views.ts` § cascade).
+     *
+     * Async only because `delete-by-prefix` / `replace-all` reuse the async layer scan to
+     * enumerate the affected (prefix / whole-table) slice; the point ops stay synchronous
+     * within the same pass, so a multi-row statement's later rows still observe earlier
+     * rows' pending writes with no interleaving (no await separates a single op's lookup
+     * from its record).
+     */
+    async applyMaintenanceToLayer(connection, ops) {
+        const changes = [];
+        if (ops.length === 0)
+            return changes;
+        this.ensureTransactionLayer(connection);
+        const layer = connection.pendingTransactionLayer;
+        for (const op of ops) {
+            switch (op.kind) {
+                case 'delete-key': {
+                    const existing = this.lookupEffectiveRow(op.key, layer);
+                    if (existing) {
+                        layer.recordDelete(op.key, existing);
+                        changes.push({ op: 'delete', oldRow: existing });
+                    }
+                    break;
+                }
+                case 'upsert': {
+                    const key = this.primaryKeyFunctions.extractFromRow(op.row);
+                    const existing = this.lookupEffectiveRow(key, layer);
+                    if (existing && rowsValueIdentical(existing, op.row)) {
+                        // Value-identical against the EFFECTIVE row (pending over committed):
+                        // nothing changes, so write nothing and report nothing — the
+                        // skip-identical upsert contract (vtab/backing-host.ts), the point-op
+                        // analogue of the replace-all diff's identical-row skip. Both skips are
+                        // byte-faithful (`rowsValueIdentical`, BINARY per column): a collation-equal
+                        // / byte-different row (a case-only rewrite under NOCASE) is a real change
+                        // that must re-key the stored bytes — collation governs key identity only.
+                        break;
+                    }
+                    layer.recordUpsert(key, op.row, existing);
+                    changes.push(existing
+                        ? { op: 'update', oldRow: existing, newRow: op.row }
+                        : { op: 'insert', newRow: op.row });
+                    break;
+                }
+                case 'delete-by-prefix': {
+                    // Range-scan the primary tree over the half-open interval whose leading
+                    // PK columns equal `keyPrefix` (the btree orders by the composite PK,
+                    // base-PK columns leading, so the slice is contiguous; `scanLayer`'s
+                    // `equalityPrefix` seeks to it and early-terminates on prefix mismatch).
+                    // Collect the matched rows first, THEN `recordDelete` each — the same
+                    // per-row bookkeeping (secondary indexes, change tracking) the point
+                    // `delete-key` arm uses, over a prefix range instead of a point.
+                    // Collect-then-delete avoids mutating the tree mid-iteration.
+                    const scanPlan = { indexName: 'primary', descending: false, equalityPrefix: op.keyPrefix };
+                    const matched = [];
+                    for await (const row of scanLayerImpl(layer, scanPlan)) {
+                        matched.push({ key: this.primaryKeyFunctions.extractFromRow(row), row });
+                    }
+                    for (const { key, row } of matched) {
+                        layer.recordDelete(key, row);
+                        changes.push({ op: 'delete', oldRow: row });
+                    }
+                    break;
+                }
+                case 'replace-all': {
+                    // Wholesale transactional replacement, realized as the minimal keyed diff
+                    // (by backing PK) against the layer's current effective rows. Snapshot the
+                    // old rows FIRST — the same whole-table effective iteration the
+                    // `delete-by-prefix` arm scopes to a prefix — into a PK-keyed btree, so the
+                    // diff is computed against a stable before-image regardless of the upserts
+                    // applied below. Collation governs KEY identity only: keys are compared with
+                    // the table's PK comparator (honoring PK-column collation), so a new row whose
+                    // key only differs by collation (e.g. 'apple' vs a stored 'APPLE' under a NOCASE
+                    // PK) matches its old row and resolves to an `update` — never a spurious insert +
+                    // delete that would leak secondary-index bookkeeping. VALUE fidelity of a paired
+                    // row is byte-faithful (`rowsValueIdentical`, below) — one discipline, not two.
+                    const oldByKey = new BTree(e => e.key, this.comparePrimaryKeys);
+                    for await (const row of scanLayerImpl(layer, { indexName: 'primary', descending: false })) {
+                        oldByKey.insert({ key: this.primaryKeyFunctions.extractFromRow(row), row });
+                    }
+                    // New-row keys (same PK comparator) for the delete pass's membership test.
+                    const newKeys = new BTree(k => k, this.comparePrimaryKeys);
+                    // Insert/update/skip-identical pass, in new-row order.
+                    for (const newRow of op.rows) {
+                        const key = this.primaryKeyFunctions.extractFromRow(newRow);
+                        newKeys.insert(key);
+                        const existing = oldByKey.get(key);
+                        if (!existing) {
+                            layer.recordUpsert(key, newRow, null);
+                            changes.push({ op: 'insert', newRow });
+                        }
+                        else if (!rowsValueIdentical(existing.row, newRow)) {
+                            layer.recordUpsert(key, newRow, existing.row);
+                            changes.push({ op: 'update', oldRow: existing.row, newRow });
+                        }
+                        // else: byte-identical at this key — a true no-op, no emitted change.
+                        // The skip is byte-faithful (`rowsValueIdentical`): a collation-equal /
+                        // byte-different paired row (a case-only rewrite under a NOCASE PK) is an
+                        // `update` that re-keys the stored bytes, matching the point-op upsert skip
+                        // and the byte-exact maintenance-equivalence oracle.
+                    }
+                    // Delete pass: every old key absent from the new set, ascending PK order.
+                    // `oldByKey` is a private snapshot, not mutated here, so iterating it while
+                    // `recordDelete` mutates the layer's tree is safe.
+                    for (const path of oldByKey.ascending(oldByKey.first())) {
+                        const entry = oldByKey.at(path);
+                        if (newKeys.get(entry.key) !== undefined)
+                            continue;
+                        layer.recordDelete(entry.key, entry.row);
+                        changes.push({ op: 'delete', oldRow: entry.row });
+                    }
+                    break;
+                }
+                default: {
+                    // A new MaintenanceOp must extend this switch; never-assignment makes
+                    // that a compile error rather than a silent no-op.
+                    const exhaustiveCheck = op;
+                    throw new QuereusError(`Unknown maintenance op: ${JSON.stringify(exhaustiveCheck)}`, StatusCode.INTERNAL);
+                }
+            }
+        }
+        await this.enforceSecondaryUniqueOnMaintenance(layer, changes);
+        return changes;
+    }
+    /**
+     * Declared secondary-UNIQUE enforcement for maintenance writes — the
+     * collision-shaped half of the derived-row constraint contract (CHECK / FK
+     * are per-row properties and validate engine-side; see
+     * docs/materialized-views.md § Derived-row constraint validation). The
+     * privileged surface bypasses the DML constraint pipeline, so without this
+     * the batch above would store two derived rows colliding on a declared
+     * UNIQUE silently.
+     *
+     * Runs POST-batch over the effective changes, never per-op: a `replace-all`
+     * diff applies its upserts before its deletes, so an in-flight per-op check
+     * would false-positive against a row the same batch is about to delete
+     * (e.g. the derived set moved a unique value from one primary key to
+     * another). After the batch the layer holds exactly the final contents, so
+     * checking each WRITTEN image against it is exact — and complete: every
+     * pre-existing row entered through DML / ADD CONSTRAINT / earlier validated
+     * maintenance, so any colliding pair includes at least one written image.
+     * A value-identical upsert the batch skipped emitted no change and cannot
+     * introduce a collision (the table's contents did not change at that key).
+     *
+     * Reuses {@link checkSingleUniqueConstraint} (same-PK exclusion, NULL-pass,
+     * partial-predicate scope, per-column collation, auto-index fast path) with
+     * two maintenance-specific postures: the conflict action is forced to ABORT
+     * (a derivation write carries no user OR clause, and a declared
+     * `on conflict replace`/`ignore` default must not silently evict or drop
+     * derived rows — the eviction would diverge the table from its derivation),
+     * and the covering-MV route is bypassed (see
+     * {@link findIndexForConstraint}'s `allowMvCovering`).
+     *
+     * Zero overhead when the table declares no secondary UNIQUE (every MV-sugar
+     * backing, and most maintained tables): one empty-array check.
+     */
+    async enforceSecondaryUniqueOnMaintenance(layer, changes) {
+        const schema = layer.getSchema();
+        const ucs = schema.uniqueConstraints;
+        if (!ucs || ucs.length === 0 || changes.length === 0)
+            return;
+        // ABORT means the IGNORE/REPLACE arms never fire, so nothing ever lands here.
+        const noEvict = [];
+        for (const change of changes) {
+            if (change.op === 'delete')
+                continue;
+            const newPrimaryKey = this.primaryKeyFromRow(change.newRow);
+            for (const uc of ucs) {
+                const result = await this.checkSingleUniqueConstraint(layer, schema, uc, change.newRow, newPrimaryKey, ConflictResolution.ABORT, noEvict, /*allowMvCovering*/ false);
+                if (result) {
+                    const colNames = uc.columns.map(i => schema.columns[i]?.name ?? String(i));
+                    throw maintainedTableUniqueViolationError(this.schemaName, this._tableName, uc.name ?? `_uc_${colNames.join('_')}`, colNames, uc.columns.map(i => change.newRow[i]));
+                }
+            }
+        }
+    }
     // --- Schema Operations (simplified with inherited BTrees) ---
-    async addColumn(columnDefAst) {
+    async addColumn(columnDefAst, backfillEvaluator) {
         if (this.isReadOnly)
             throw new QuereusError(`Table '${this._tableName}' is read-only`, StatusCode.READONLY);
         const lockKey = `MemoryTable.SchemaChange:${this.schemaName}.${this._tableName}`;
@@ -822,7 +1373,11 @@ export class MemoryTableManager {
             // Get default nullability setting from database options
             const defaultNullability = this.db.options.getStringOption('default_column_nullability');
             const defaultNotNull = defaultNullability === 'not_null';
-            const newColumnSchema = columnDefToSchema(columnDefAst, defaultNotNull);
+            // Honor the session `default_collation` for an ADD COLUMN that omits an explicit
+            // COLLATE, matching the CREATE path (and the differ's resolved-COLLATE emission) so
+            // an ADD-COLUMN-ed text column gets the same collation a CREATE-d one would.
+            // resolveDefaultCollation falls non-text types back to BINARY automatically.
+            const newColumnSchema = columnDefToSchema(columnDefAst, defaultNotNull, this.db.options.getStringOption('default_collation'));
             if (this.tableSchema.columns.some(c => c.name.toLowerCase() === newColumnSchema.name.toLowerCase())) {
                 throw new QuereusError(`Duplicate column name: ${newColumnSchema.name}`, StatusCode.ERROR);
             }
@@ -836,13 +1391,19 @@ export class MemoryTableManager {
                     defaultIsLiteral = true;
                 }
                 else {
-                    logger.warn('Add Column', this._tableName, 'Default for new col is expr; existing rows get NULL.', { columnName: newColumnSchema.name });
+                    // A non-literal expression default (e.g. `new.<col>`) is written as NULL
+                    // here; the engine backfills these rows per-row immediately after.
+                    logger.debugLog(`[Add Column] '${newColumnSchema.name}' default is a non-literal expression; existing rows are backfilled by the engine.`);
                 }
             }
-            // Check for NOT NULL constraint (could be explicit or from default behavior)
-            // Allow NOT NULL without DEFAULT if table is empty (SQLite-compatible)
+            // Check for NOT NULL constraint (could be explicit or from default behavior).
+            // Allow NOT NULL without DEFAULT if the table is empty (SQLite-compatible).
+            // A non-literal *expression* default (e.g. `new.<col>`) is backfilled per-row by
+            // the engine right after this returns, which then enforces NOT NULL on the
+            // backfilled values — so don't reject it here as "without a DEFAULT".
             const tableHasRows = this.baseLayer.primaryTree.at(this.baseLayer.primaryTree.first()) !== undefined;
-            if (newColumnSchema.notNull && defaultValue === null && !defaultIsLiteral && tableHasRows) {
+            const hasDefaultExpr = !!(defaultConstraint && defaultConstraint.expr);
+            if (newColumnSchema.notNull && defaultValue === null && !defaultIsLiteral && !hasDefaultExpr && tableHasRows) {
                 throw new QuereusError(`Cannot add NOT NULL column '${newColumnSchema.name}' to non-empty table `
                     + `'${this.schemaName}.${this._tableName}' without a DEFAULT value`, StatusCode.CONSTRAINT);
             }
@@ -853,7 +1414,10 @@ export class MemoryTableManager {
                 columnIndexMap: buildColumnIndexMap(updatedColumnsSchema),
             });
             this.baseLayer.updateSchema(finalNewTableSchema);
-            await this.baseLayer.addColumnToBase(newColumnSchema, defaultValue);
+            // A non-foldable DEFAULT (e.g. `new.<col>`) backfills each existing row from
+            // its own value via the engine-supplied evaluator; a literal/NULL default
+            // uses the single folded `defaultValue` for every row.
+            await this.baseLayer.addColumnToBase(newColumnSchema, defaultValue, backfillEvaluator);
             this.tableSchema = finalNewTableSchema;
             this.initializePrimaryKeyFunctions();
             // Emit schema change event
@@ -897,11 +1461,36 @@ export class MemoryTableManager {
                 ...def, index: def.index > colIndex ? def.index - 1 : def.index
             }));
             const updatedPrimaryKeyNames = updatedPkDefinition.map(def => updatedColumnsSchema[def.index]?.name).filter(Boolean);
-            const updatedIndexes = (this.tableSchema.indexes || []).map(idx => ({
+            // Prune any UNIQUE constraint over the dropped column. A UNIQUE that includes the
+            // dropped column is removed outright (a UNIQUE missing one of its columns is a
+            // different, stronger constraint, not a silently-narrowed one); the auto-built
+            // covering index it backed is torn down with it (see the index exclusion below).
+            // Remaining constraints have their column indices shifted to track the removed slot.
+            // Without this, dropping a uniquely-constrained column (including the ADD COLUMN +
+            // inline-UNIQUE revert path) would strand a constraint whose column index dangles
+            // past the end of the column array.
+            const oldUniqueConstraints = this.tableSchema.uniqueConstraints ?? [];
+            const droppedUcKeys = oldUniqueConstraints
+                .filter(uc => uc.columns.includes(colIndex))
+                .map(uc => uc.name ?? this.implicitIndexNameFor(uc));
+            const remainingUniqueConstraints = oldUniqueConstraints
+                .filter(uc => !uc.columns.includes(colIndex))
+                .map(uc => ({ ...uc, columns: Object.freeze(uc.columns.map(i => i > colIndex ? i - 1 : i)) }));
+            // Drop the implicit covering index of each removed constraint outright (matched by
+            // the same `uc.name ?? '_uc_<cols>'` convention DROP CONSTRAINT uses, so a user
+            // index that merely shares columns is left untouched), then shift/prune the rest
+            // over the removed slot. A *single*-column covering index collapses to empty and is
+            // filtered by the trailing `length > 0` regardless; the explicit name exclusion is
+            // what tears down a *multi*-column covering index, which would otherwise survive
+            // orphaned — narrowed to its surviving columns — in `index_info` and on every write.
+            const droppedCoveringIndexNames = new Set(droppedUcKeys.map(k => k.toLowerCase()));
+            const updatedIndexes = (this.tableSchema.indexes || [])
+                .filter(idx => !droppedCoveringIndexNames.has(idx.name.toLowerCase()))
+                .map(idx => ({
                 ...idx,
                 columns: idx.columns
-                    .map(ic => ({ ...ic, index: ic.index > colIndex ? ic.index - 1 : ic.index }))
                     .filter(ic => ic.index !== colIndex)
+                    .map(ic => ({ ...ic, index: ic.index > colIndex ? ic.index - 1 : ic.index }))
             })).filter(idx => idx.columns.length > 0);
             const finalNewTableSchema = Object.freeze({
                 ...this.tableSchema,
@@ -909,11 +1498,18 @@ export class MemoryTableManager {
                 columnIndexMap: buildColumnIndexMap(updatedColumnsSchema),
                 primaryKeyDefinition: Object.freeze(updatedPkDefinition),
                 primaryKey: Object.freeze(updatedPrimaryKeyNames),
-                indexes: Object.freeze(updatedIndexes)
+                indexes: Object.freeze(updatedIndexes),
+                uniqueConstraints: remainingUniqueConstraints.length > 0
+                    ? Object.freeze(remainingUniqueConstraints)
+                    : undefined,
             });
             this.baseLayer.updateSchema(finalNewTableSchema);
             await this.baseLayer.dropColumnFromBase(colIndex);
             this.tableSchema = finalNewTableSchema;
+            // The covering-structure records for the dropped constraints are now stale —
+            // clear them (keys computed against the pre-drop column names above).
+            for (const key of droppedUcKeys)
+                this.implicitCoveringStructures.delete(key);
             this.initializePrimaryKeyFunctions();
             // Emit schema change event
             this.eventEmitter?.emitSchemaChange?.({
@@ -1015,7 +1611,28 @@ export class MemoryTableManager {
             }
             const oldCol = this.tableSchema.columns[colIndex];
             let newCol = oldCol;
-            if (change.setNotNull !== undefined) {
+            // A collation change re-keys any PK / UNIQUE / index that orders by this
+            // column, so it needs the structure re-sort + uniqueness re-validation below.
+            let collationChanged = false;
+            if (change.setCollation !== undefined) {
+                const normalized = validateCollationForType(change.setCollation, oldCol.logicalType, change.columnName);
+                const nameMatches = normalized === (oldCol.collation || 'BINARY');
+                if (nameMatches && oldCol.collationExplicit) {
+                    return; // already explicit in the desired collation — nothing to do
+                }
+                // SET COLLATE is a user declaration with the same standing as a
+                // CREATE-time COLLATE clause, so mark the collation explicit (rank 2 in
+                // the comparison lattice) regardless of the column's creation history —
+                // including SET COLLATE binary. When only the name matches but the column
+                // was not yet explicit (a defaulted collation, or one inherited from
+                // session default_collation), flip the flag as a METADATA-ONLY change:
+                // the collation bytes are unchanged, so keep collationChanged false and
+                // skip the physical re-sort / re-key / UNIQUE re-validation below. A
+                // different name takes the full path AND sets the flag.
+                newCol = { ...oldCol, collation: normalized, collationExplicit: true };
+                collationChanged = !nameMatches;
+            }
+            else if (change.setNotNull !== undefined) {
                 if (change.setNotNull === true && !oldCol.notNull) {
                     // Tightening: scan for NULLs. If DEFAULT present, backfill first.
                     const defaultExpr = oldCol.defaultValue;
@@ -1092,12 +1709,36 @@ export class MemoryTableManager {
                 throw new QuereusError('ALTER COLUMN requires an attribute to change', StatusCode.INTERNAL);
             }
             const updatedCols = this.tableSchema.columns.map((c, i) => i === colIndex ? newCol : c);
+            // Propagate a collation change into every PK-definition entry and index
+            // column that orders by this column, so their comparators re-key under it.
+            const updatedPkDef = collationChanged
+                ? this.tableSchema.primaryKeyDefinition.map(def => def.index === colIndex ? { ...def, collation: newCol.collation } : def)
+                : this.tableSchema.primaryKeyDefinition;
+            const updatedIndexes = (collationChanged && this.tableSchema.indexes)
+                ? this.tableSchema.indexes.map(idx => ({
+                    ...idx,
+                    columns: idx.columns.map(ic => ic.index === colIndex ? { ...ic, collation: newCol.collation } : ic),
+                }))
+                : this.tableSchema.indexes;
             const finalNewTableSchema = Object.freeze({
                 ...this.tableSchema,
                 columns: Object.freeze(updatedCols),
                 columnIndexMap: buildColumnIndexMap(updatedCols),
+                primaryKeyDefinition: Object.freeze(updatedPkDef),
+                indexes: updatedIndexes ? Object.freeze(updatedIndexes) : updatedIndexes,
             });
             this.baseLayer.updateSchema(finalNewTableSchema);
+            // A collation change re-sorts structures that order by the column and
+            // re-validates uniqueness under the new collation. Rebuild the secondary
+            // indexes FIRST (strict — a UNIQUE collision throws CONSTRAINT) and the
+            // primary tree LAST (also strict — a PK collision throws), so a throw at
+            // either step leaves the live primary tree intact for the catch's rollback.
+            if (collationChanged) {
+                this.baseLayer.rebuildAllSecondaryIndexesStrict();
+                if (updatedPkDef.some(def => def.index === colIndex)) {
+                    this.baseLayer.rebuildPrimaryTreeStrict();
+                }
+            }
             this.tableSchema = finalNewTableSchema;
             this.initializePrimaryKeyFunctions();
             this.eventEmitter?.emitSchemaChange?.({
@@ -1110,7 +1751,12 @@ export class MemoryTableManager {
             logger.operation('Alter Column', this._tableName, { columnName: change.columnName });
         }
         catch (e) {
+            // Restore the prior schema, then rebuild secondary indexes (non-strict) so
+            // a partially-cleared strict rebuild can't strand the index map in an
+            // inconsistent state. The primary tree is only swapped on full success, so
+            // it is already the original here.
             this.baseLayer.updateSchema(originalManagerSchema);
+            this.baseLayer.rebuildAllSecondaryIndexes();
             this.tableSchema = originalManagerSchema;
             this.initializePrimaryKeyFunctions();
             logger.error('Alter Column', this._tableName, e);
@@ -1232,6 +1878,315 @@ export class MemoryTableManager {
             release();
         }
     }
+    /**
+     * Drops a named table-level constraint (CHECK / UNIQUE / FOREIGN KEY). Schema-
+     * only — constraints don't change row shape — except that dropping a UNIQUE
+     * also tears down the implicit covering index (the auto-built secondary BTree
+     * named `uc.name ?? '_uc_<cols>'`) so introspection / the declarative differ
+     * don't observe an orphaned index. The class is resolved here (NOTFOUND /
+     * ambiguous), so the engine can route through `module.alterTable` uniformly.
+     */
+    async dropConstraint(constraintName) {
+        if (this.isReadOnly)
+            throw new QuereusError(`Table '${this._tableName}' is read-only`, StatusCode.READONLY);
+        const lockKey = `MemoryTable.SchemaChange:${this.schemaName}.${this._tableName}`;
+        const release = await Latches.acquire(lockKey);
+        const originalManagerSchema = this.tableSchema;
+        try {
+            await this.ensureSchemaChangeSafety();
+            const cls = resolveNamedConstraintClass(this.tableSchema, constraintName);
+            const lower = constraintName.toLowerCase();
+            let newSchema;
+            let droppedIndexName;
+            if (cls === 'check') {
+                newSchema = Object.freeze({
+                    ...this.tableSchema,
+                    checkConstraints: Object.freeze(this.tableSchema.checkConstraints.filter(c => c.name?.toLowerCase() !== lower)),
+                });
+            }
+            else if (cls === 'foreignKey') {
+                const remaining = (this.tableSchema.foreignKeys ?? []).filter(c => c.name?.toLowerCase() !== lower);
+                newSchema = Object.freeze({
+                    ...this.tableSchema,
+                    foreignKeys: remaining.length > 0 ? Object.freeze(remaining) : undefined,
+                });
+            }
+            else {
+                // UNIQUE — drop the constraint and its implicit covering index.
+                const uc = this.tableSchema.uniqueConstraints.find(c => c.name?.toLowerCase() === lower);
+                const idxName = uc.name ?? this.implicitIndexNameFor(uc);
+                const idxLower = idxName.toLowerCase();
+                const existingIndexes = this.tableSchema.indexes ?? [];
+                const keptIndexes = existingIndexes.filter(i => i.name.toLowerCase() !== idxLower);
+                if (keptIndexes.length !== existingIndexes.length)
+                    droppedIndexName = idxName;
+                const remainingUcs = this.tableSchema.uniqueConstraints.filter(c => c.name?.toLowerCase() !== lower);
+                newSchema = Object.freeze({
+                    ...this.tableSchema,
+                    uniqueConstraints: remainingUcs.length > 0 ? Object.freeze(remainingUcs) : undefined,
+                    indexes: Object.freeze(keptIndexes),
+                });
+                this.implicitCoveringStructures.delete(uc.name ?? idxName);
+            }
+            this.baseLayer.updateSchema(newSchema);
+            if (droppedIndexName)
+                await this.baseLayer.dropIndexFromBase(droppedIndexName);
+            this.tableSchema = newSchema;
+            this.initializePrimaryKeyFunctions();
+            this.eventEmitter?.emitSchemaChange?.({
+                type: 'alter',
+                objectType: 'table',
+                schemaName: this.schemaName,
+                objectName: this._tableName,
+            });
+            logger.operation('Drop Constraint', this._tableName, { constraintName });
+        }
+        catch (e) {
+            this.baseLayer.updateSchema(originalManagerSchema);
+            this.tableSchema = originalManagerSchema;
+            this.initializePrimaryKeyFunctions();
+            logger.error('Drop Constraint', this._tableName, e);
+            throw e;
+        }
+        finally {
+            release();
+        }
+    }
+    /**
+     * Renames a named table-level constraint. Schema-only, with one caveat: a
+     * UNIQUE whose implicit covering index is named after the constraint has that
+     * index renamed in lock-step (so the index stays recognized as the
+     * constraint's covering structure rather than surfacing as an orphan).
+     */
+    async renameConstraint(oldName, newName) {
+        if (this.isReadOnly)
+            throw new QuereusError(`Table '${this._tableName}' is read-only`, StatusCode.READONLY);
+        const lockKey = `MemoryTable.SchemaChange:${this.schemaName}.${this._tableName}`;
+        const release = await Latches.acquire(lockKey);
+        const originalManagerSchema = this.tableSchema;
+        try {
+            await this.ensureSchemaChangeSafety();
+            const cls = resolveNamedConstraintClass(this.tableSchema, oldName);
+            const oldLower = oldName.toLowerCase();
+            let newSchema;
+            let renamedIndex = false;
+            if (cls === 'check') {
+                newSchema = Object.freeze({
+                    ...this.tableSchema,
+                    checkConstraints: Object.freeze(this.tableSchema.checkConstraints.map(c => (c.name?.toLowerCase() === oldLower ? { ...c, name: newName } : c))),
+                });
+            }
+            else if (cls === 'foreignKey') {
+                newSchema = Object.freeze({
+                    ...this.tableSchema,
+                    foreignKeys: Object.freeze(this.tableSchema.foreignKeys.map(c => (c.name?.toLowerCase() === oldLower ? { ...c, name: newName } : c))),
+                });
+            }
+            else {
+                // UNIQUE — rename the constraint and, when present, its implicit covering index.
+                const uc = this.tableSchema.uniqueConstraints.find(c => c.name?.toLowerCase() === oldLower);
+                const oldIdxName = uc.name ?? this.implicitIndexNameFor(uc);
+                const oldIdxLower = oldIdxName.toLowerCase();
+                const newUcs = this.tableSchema.uniqueConstraints.map(c => (c.name?.toLowerCase() === oldLower ? { ...c, name: newName } : c));
+                let indexes = this.tableSchema.indexes ?? [];
+                if (indexes.some(i => i.name.toLowerCase() === oldIdxLower)) {
+                    indexes = indexes.map(i => (i.name.toLowerCase() === oldIdxLower ? { ...i, name: newName } : i));
+                    renamedIndex = true;
+                }
+                newSchema = Object.freeze({
+                    ...this.tableSchema,
+                    uniqueConstraints: Object.freeze(newUcs),
+                    indexes: Object.freeze(indexes),
+                });
+                const rec = this.implicitCoveringStructures.get(uc.name ?? oldIdxName);
+                if (rec) {
+                    this.implicitCoveringStructures.delete(uc.name ?? oldIdxName);
+                    this.implicitCoveringStructures.set(newName, { ...rec, indexName: renamedIndex ? newName : rec.indexName });
+                }
+            }
+            this.baseLayer.updateSchema(newSchema);
+            // A renamed covering index lives under a new key — rebuild secondary indexes
+            // from the post-rename schema so the base layer's index map matches.
+            if (renamedIndex)
+                this.baseLayer.rebuildAllSecondaryIndexes();
+            this.tableSchema = newSchema;
+            this.initializePrimaryKeyFunctions();
+            this.eventEmitter?.emitSchemaChange?.({
+                type: 'alter',
+                objectType: 'table',
+                schemaName: this.schemaName,
+                objectName: this._tableName,
+            });
+            logger.operation('Rename Constraint', this._tableName, { oldName, newName });
+        }
+        catch (e) {
+            this.baseLayer.updateSchema(originalManagerSchema);
+            this.tableSchema = originalManagerSchema;
+            this.initializePrimaryKeyFunctions();
+            logger.error('Rename Constraint', this._tableName, e);
+            throw e;
+        }
+        finally {
+            release();
+        }
+    }
+    /**
+     * Adds a table-level UNIQUE or FOREIGN KEY constraint to an existing table,
+     * re-validating the current rows against it and failing atomically with
+     * `CONSTRAINT` (no schema mutation) when the data violates it. Mirrors the
+     * latch + `ensureSchemaChangeSafety()` + snapshot/restore scaffolding of
+     * {@link createIndex} / {@link dropConstraint}.
+     *
+     * - UNIQUE builds (or reuses) the implicit covering secondary index; the build
+     *   raises `CONSTRAINT` on the first duplicate among in-scope rows (partial
+     *   predicate + per-column collation honored, NULLs distinct).
+     * - FOREIGN KEY appends the constraint and runs the pragma-gated existing-row
+     *   validation (engine-side enforcement needs no physical structure).
+     * - CHECK appends the constraint (no physical structure, no existing-row scan —
+     *   matching the engine's prior in-emitter behavior); it routes here, rather than
+     *   being applied catalog-only, so the module-cached schema stays in lock-step
+     *   with the catalog and a later `DROP/RENAME CONSTRAINT` resolves it. (The engine
+     *   keeps an engine-side fallback in `runtime/emit/add-constraint.ts` only for
+     *   modules that omit `alterTable` — which cannot DROP/RENAME a constraint anyway.)
+     */
+    async addConstraint(constraint) {
+        if (this.isReadOnly)
+            throw new QuereusError(`Table '${this._tableName}' is read-only`, StatusCode.READONLY);
+        const lockKey = `MemoryTable.SchemaChange:${this.schemaName}.${this._tableName}`;
+        const release = await Latches.acquire(lockKey);
+        const originalManagerSchema = this.tableSchema;
+        try {
+            await this.ensureSchemaChangeSafety();
+            if (constraint.type === 'unique') {
+                await this.addUniqueConstraint(constraint);
+            }
+            else if (constraint.type === 'foreignKey') {
+                await this.addForeignKeyConstraint(constraint);
+            }
+            else if (constraint.type === 'check') {
+                this.addCheckConstraint(constraint);
+            }
+            else {
+                throw new QuereusError(`MemoryTable ADD CONSTRAINT does not support constraint type '${constraint.type}'`, StatusCode.UNSUPPORTED);
+            }
+            this.eventEmitter?.emitSchemaChange?.({
+                type: 'alter',
+                objectType: 'table',
+                schemaName: this.schemaName,
+                objectName: this._tableName,
+            });
+            logger.operation('Add Constraint', this._tableName, { type: constraint.type, name: constraint.name });
+        }
+        catch (e) {
+            // Restore the prior schema and rebuild secondary indexes (non-strict) so a
+            // half-built covering index can't strand the base layer's index map.
+            this.baseLayer.updateSchema(originalManagerSchema);
+            this.baseLayer.rebuildAllSecondaryIndexes();
+            this.tableSchema = originalManagerSchema;
+            this.initializePrimaryKeyFunctions();
+            logger.error('Add Constraint', this._tableName, e);
+            throw e;
+        }
+        finally {
+            release();
+        }
+    }
+    /**
+     * CHECK arm of {@link addConstraint}. Schema-only: a CHECK has no covering
+     * structure and (matching the engine's prior in-emitter behavior) no existing-row
+     * validation, so this just appends the constraint to the cached schema. Enforcement
+     * is engine-side at INSERT/UPDATE plan time. Runs under the same latch / rollback
+     * scaffolding as the other arms (via {@link addConstraint}).
+     */
+    addCheckConstraint(constraint) {
+        const check = buildCheckConstraintSchema(constraint, this.tableSchema.checkConstraints.length);
+        const newSchema = Object.freeze({
+            ...this.tableSchema,
+            checkConstraints: Object.freeze([...this.tableSchema.checkConstraints, check]),
+        });
+        this.baseLayer.updateSchema(newSchema);
+        this.tableSchema = newSchema;
+    }
+    /**
+     * UNIQUE arm of {@link addConstraint}. Builds the covering secondary index the
+     * same way {@link ensureUniqueConstraintIndexes} does (validating existing rows
+     * via `addIndexToBase` → `populateNewIndex`), unless an existing *unique* index
+     * already covers the exact columns — in which case the data is already
+     * validated and we only register the covering structure.
+     */
+    async addUniqueConstraint(constraint) {
+        const uc = buildUniqueConstraintSchema(constraint, this.tableSchema.columnIndexMap);
+        const columns = this.tableSchema.columns;
+        const existingIndexes = this.tableSchema.indexes ?? [];
+        const appendedUcs = Object.freeze([...(this.tableSchema.uniqueConstraints ?? []), uc]);
+        // Reuse: an existing UNIQUE index over the exact columns already guarantees
+        // uniqueness, so skip the rebuild. A non-unique index gives no such guarantee
+        // — fall through to build-and-validate. The reused index must ALSO be
+        // collation-equivalent to the declared column collations: a finer/coarser
+        // same-column-set index (e.g. a BINARY `create unique index` over a NOCASE
+        // column) enforces under ITS collation, not the declared one, so reusing it
+        // would under-enforce this non-derived UNIQUE. A collation mismatch falls
+        // through to build the distinct `_uc_*` covering index; the user index keeps
+        // enforcing its own (stricter) uniqueness independently (matches SQLite).
+        const matchingUniqueIndex = existingIndexes.find(idx => idx.unique &&
+            idx.columns.length === uc.columns.length &&
+            idx.columns.every((col, i) => col.index === uc.columns[i]) &&
+            this.indexCollationsMatchDeclared(idx, uc));
+        if (matchingUniqueIndex) {
+            const newSchema = Object.freeze({
+                ...this.tableSchema,
+                uniqueConstraints: appendedUcs,
+            });
+            this.baseLayer.updateSchema(newSchema);
+            this.tableSchema = newSchema;
+            this.initializePrimaryKeyFunctions();
+            this.implicitCoveringStructures.set(uc.name ?? matchingUniqueIndex.name, { indexName: matchingUniqueIndex.name, origin: 'implicit-from-unique-constraint' });
+            return;
+        }
+        const colNames = uc.columns.map(i => columns[i]?.name ?? String(i));
+        const indexName = uc.name ?? `_uc_${colNames.join('_')}`;
+        const indexSchema = {
+            name: indexName,
+            // Carry per-column collation so enforcement honors e.g. NOCASE (mirrors
+            // ensureUniqueConstraintIndexes). The covering index is NOT flagged unique
+            // — insert-time enforcement routes through `uniqueConstraints`.
+            columns: uc.columns.map(colIdx => ({ index: colIdx, collation: columns[colIdx]?.collation })),
+            predicate: uc.predicate,
+        };
+        const newSchema = Object.freeze({
+            ...this.tableSchema,
+            uniqueConstraints: appendedUcs,
+            indexes: Object.freeze([...existingIndexes, indexSchema]),
+        });
+        // Swap the schema FIRST so `addIndexToBase` → `indexEnforcesUnique` sees the
+        // new constraint and rejects duplicates, then populate (throws CONSTRAINT on
+        // the first in-scope duplicate). A throw rolls back via the catch in addConstraint.
+        this.baseLayer.updateSchema(newSchema);
+        await this.baseLayer.addIndexToBase(indexSchema);
+        this.tableSchema = newSchema;
+        this.initializePrimaryKeyFunctions();
+        this.implicitCoveringStructures.set(uc.name ?? indexName, { indexName, origin: 'implicit-from-unique-constraint' });
+    }
+    /**
+     * FOREIGN KEY arm of {@link addConstraint}. Validates existing child rows
+     * against the new FK (pragma-gated; throws CONSTRAINT on an orphan), then
+     * appends it to the cached schema. No physical structure — FK enforcement is
+     * engine-side (synthesized EXISTS checks at plan time).
+     */
+    async addForeignKeyConstraint(constraint) {
+        const fk = buildForeignKeyConstraintSchema(constraint, this.tableSchema.columnIndexMap, this._tableName, this.schemaName);
+        const newSchema = Object.freeze({
+            ...this.tableSchema,
+            foreignKeys: Object.freeze([...(this.tableSchema.foreignKeys ?? []), fk]),
+        });
+        // Validate BEFORE swapping the cached schema — a throw leaves the table
+        // unmodified. The scan only reads (no schema-change latch), so holding our
+        // own latch here is safe; ensureSchemaChangeSafety already drained to base.
+        await validateForeignKeyOverExistingRows(this.db, newSchema, fk);
+        this.baseLayer.updateSchema(newSchema);
+        this.tableSchema = newSchema;
+        this.initializePrimaryKeyFunctions();
+    }
     async destroy() {
         const lockKey = `MemoryTable.Destroy:${this.schemaName}.${this._tableName}`;
         const release = await Latches.acquire(lockKey);
@@ -1267,8 +2222,41 @@ export class MemoryTableManager {
                 connection.readLayer = this.baseLayer;
             }
         }
+        // The manager's `connections` map covers only connections still attached to this
+        // manager. A connection can be DETACHED from the map (removed by disconnect after an
+        // autocommit collapse) while remaining REGISTERED in the Database connection registry —
+        // `MemoryTable.ensureConnection` reuses exactly such a connection for a later scan. The
+        // loop above misses it, so after an in-transaction schema change (e.g. ALTER TABLE ADD
+        // COLUMN, now permitted inside an explicit transaction) it keeps reading a stale
+        // pre-change layer carrying the OLD column shape — the materialized-view-source-stale-read
+        // bug. A detached connection always has `pendingTransactionLayer === null` (disconnect
+        // defers while a pending layer is uncommitted), so this never discards in-flight writes.
+        this.repointRegisteredConnections();
         logger.debugLog(`Schema change safety check passed for ${this._tableName}. Current committed layer is base.`);
     }
+    /**
+     * Re-point every Database-registered {@link MemoryTableConnection} backed by this
+     * manager (including ones detached from {@link connections}) at the current base layer,
+     * when it carries no uncommitted pending layer. Companion to the `connections`-map sweep
+     * in {@link ensureSchemaChangeSafety}: it closes the gap for a connection that lives in
+     * the Database registry but not in the manager's map.
+     */
+    repointRegisteredConnections() {
+        const qualifiedName = `${this.schemaName}.${this._tableName}`;
+        for (const c of this.db.getConnectionsForTable(qualifiedName)) {
+            if (!(c instanceof MemoryVirtualTableConnection))
+                continue;
+            const mc = c.getMemoryConnection();
+            if (mc.tableManager !== this)
+                continue;
+            if (mc.pendingTransactionLayer !== null)
+                continue;
+            if (mc.readLayer === this.baseLayer)
+                continue;
+            logger.debugLog(`[Schema Safety] Re-pointing registered connection ${mc.connectionId} to base layer`);
+            mc.readLayer = this.baseLayer;
+        }
+    }
     /** Consolidates all transaction data into the base layer for schema changes */
     async consolidateToBaseLayer() {
         const lockKey = `MemoryTable.Consolidate:${this.schemaName}.${this._tableName}`;
@@ -1310,45 +2298,16 @@ export class MemoryTableManager {
             allRows.push(primaryTree.at(path));
         }
         logger.debugLog(`[Consolidate] Collected ${allRows.length} rows from transaction layer. Row widths: ${allRows.map(r => r.length).join(',')}`);
-        // Count base layer rows before
-        let baseCount = 0;
-        for (const _path of this.baseLayer.primaryTree.ascending(this.baseLayer.primaryTree.first())) {
-            baseCount++;
-        }
-        logger.debugLog(`[Consolidate] Base layer had ${baseCount} rows before copy`);
-        // Now insert collected rows into the base layer
-        for (const row of allRows) {
-            this.baseLayer.primaryTree.insert(row);
-        }
-        // Count base layer rows after
-        let baseCountAfter = 0;
-        for (const _path of this.baseLayer.primaryTree.ascending(this.baseLayer.primaryTree.first())) {
-            baseCountAfter++;
-        }
-        logger.debugLog(`[Consolidate] Base layer has ${baseCountAfter} rows after copy`);
-        // Also need to rebuild secondary indexes in the base layer
-        await this.baseLayer.rebuildAllSecondaryIndexes();
+        // Replace (do not union into) the base primary tree: `allRows` is the layer's
+        // merged view with deletes already applied, so any row deleted in the
+        // transaction layer must be physically removed from the base — otherwise a
+        // later base-direct scan (e.g. a UNIQUE index build) resurrects it. This also
+        // rebuilds the base secondary indexes from the new tree.
+        this.baseLayer.rebuildPrimaryTreeFromRows(allRows);
     }
     /** Scans a layer according to the given plan, yielding matching rows. */
     async *scanLayer(layer, plan) {
         yield* scanLayerImpl(layer, plan);
     }
 }
-/**
- * Resolves the per-constraint default conflict action for PK conflicts.
- * Prefers the table-level `PRIMARY KEY (...) ON CONFLICT <action>` clause
- * (the constraint's own declaration) over any column-level `defaultConflict`
- * declared on a PK column (which primarily targets that column's own
- * constraints and only acts as a fallback for PK conflicts).
- */
-function resolvePkDefaultConflict(schema) {
-    if (schema.primaryKeyDefaultConflict !== undefined)
-        return schema.primaryKeyDefaultConflict;
-    for (const def of schema.primaryKeyDefinition) {
-        const col = schema.columns[def.index];
-        if (col && col.defaultConflict !== undefined)
-            return col.defaultConflict;
-    }
-    return undefined;
-}
 //# sourceMappingURL=manager.js.map