@quereus/quereus 4.3.2 → 4.4.1

package/dist/src/runtime/emit/dml-executor.js

@@ -11,7 +11,9 @@ import { hasNativeEventSupport } from '../../util/event-support.js';
 import { sqlValueIdentical, compareSqlValuesFast, BINARY_COLLATION } from '../../util/comparison.js';
 import { validateAndParse } from '../../types/validation.js';
 import { withAsyncRowContext } from '../context-helpers.js';
-import { executeForeignKeyActionsAndLens, assertTransitiveRestrictsForParentMutation } from '../foreign-key-actions.js';
+import { executeForeignKeyActionsAndLens, assertTransitiveRestrictsForParentMutation, createParentRestrictBatch, accumulateParentRestrictKeys, flushParentRestrictBatch } from '../foreign-key-actions.js';
+import { getBatchableRestrictFks } from '../../planner/building/foreign-key-builder.js';
+import { poisonResidualDeltaAccumulations } from '../../core/database-materialized-views-apply.js';
 /**
  * Module-scope counter producing unique statement-savepoint names across
  * concurrent emissions. Names must be unique within the TransactionManager's
@@ -21,36 +23,19 @@ import { executeForeignKeyActionsAndLens, assertTransitiveRestrictsForParentMuta
 let stmtSavepointCounter = 0;
 /**
  * True when a proposed value equals the stored existing value at one conflict-target
- * column the way the targeted constraint ENFORCES: the column's affinity is applied to
- * the proposed value (which reaches the executor pre-affinity-coercion, while
- * `existing` is the already-coerced stored value), then the two are compared under the
- * column's precomputed enforcement collation.
+ * column the way the targeted constraint ENFORCES: compared under the column's
+ * precomputed enforcement collation. Both sides are already in declared (stored)
+ * form — `existing` is a stored row and the proposed row was converted by the
+ * INSERT emitter's static-type pass — so no per-row conversion happens here.
  *
- * `targetPos` indexes the clause's per-target metadata arrays (which are aligned with
- * `conflictTargetIndices`). When that metadata is absent — a defensively-old plan — it
- * degrades to BINARY with no coercion, i.e. exactly the byte-identity semantics of
- * `sqlValueIdentical`, preserving its numeric-storage-class tolerance via
- * {@link compareSqlValuesFast}. A coercion failure likewise falls back to the raw
- * proposed value (it then compares unequal and the caller aborts, as before).
+ * `targetPos` indexes the clause's per-target collation array (aligned with
+ * `conflictTargetIndices`). When absent — a defensively-old plan — it degrades to
+ * BINARY, i.e. the byte-identity semantics of `sqlValueIdentical`, preserving its
+ * numeric-storage-class tolerance via {@link compareSqlValuesFast}.
  */
 function conflictTargetValuesMatch(existing, proposed, clause, targetPos) {
-    const type = clause.conflictTargetTypes?.[targetPos];
     const collationFn = clause.conflictTargetCollationFns?.[targetPos] ?? BINARY_COLLATION;
-    // NOTE: re-coerces the proposed value per conflicting row via validateAndParse; only
-    // reached on the (cold) UNIQUE-violation-with-upsert-clause path, so it is off the
-    // happy-path insert. If a workload ever hammers ON CONFLICT on a wide composite target,
-    // precompute per-target coercion closures at emit instead of dispatching on type here.
-    let coercedProposed = proposed;
-    if (type) {
-        try {
-            coercedProposed = validateAndParse(proposed, type);
-        }
-        catch {
-            // Coercion failed — compare the raw proposed value (aborts, as pre-fix).
-            coercedProposed = proposed;
-        }
-    }
-    return compareSqlValuesFast(existing, coercedProposed, collationFn) === 0;
+    return compareSqlValuesFast(existing, proposed, collationFn) === 0;
 }
 /**
  * Returns true when the table's owning *module* natively emits data events.
@@ -119,6 +104,44 @@ async function resolveDmlSourceRows(ctx, vtab, tableSchema, rows) {
         throw e;
     }
 }
+/**
+ * The row the substrate actually STORED for this write, which is what every
+ * post-write consumer must see. The executor's own writes are converted by the
+ * emitters up front (and passed with `preCoerced`), so for the standard
+ * backends `result.row` and the row we handed in now usually agree — but a
+ * module remains free to normalize further (or to ignore `preCoerced` and
+ * convert on its own), and `result.row` is its word on what landed.
+ *
+ * Falls back to the raw row when the substrate's row is the wrong width — a
+ * minimal test/sample module that echoes its input in a different shape. The
+ * absent case is only reached defensively: every caller has already
+ * short-circuited on a missing `result.row`, which the module contract
+ * reserves for "nothing was written" (see `VirtualTable.update`).
+ */
+function storedRowOrRaw(resultRow, rawRow, columnCount) {
+    return resultRow && resultRow.length === columnCount ? resultRow : rawRow;
+}
+/**
+ * Rebuild the flat OLD/NEW row with its NEW section (indices n..2n-1) replaced by
+ * the substrate's stored row, so `RETURNING new.<col>` reports the same value and
+ * `typeof` as a subsequent `select`. Returns `flatRow` untouched when the stored
+ * row IS the raw NEW section (the fallback above), avoiding a per-row copy.
+ *
+ * NOTE: on a coercing substrate this allocates one array per written row (the
+ * DML executor previously yielded `flatRow` verbatim). It is one copy against a
+ * per-row `vtab.update()` await, so it does not register today; if bulk-INSERT
+ * throughput ever shows this as hot, have the substrates report which columns
+ * coercion actually changed and patch only those in place.
+ */
+function withStoredNewSection(flatRow, storedRow, rawNewRow, columnCount) {
+    if (storedRow === rawNewRow)
+        return flatRow;
+    const out = flatRow.slice();
+    for (let i = 0; i < columnCount; i++) {
+        out[columnCount + i] = storedRow[i];
+    }
+    return out;
+}
 /**
  * Emit an automatic data change event for modules without native event support.
  */
@@ -150,13 +173,20 @@ function emitAutoDataEvent(ctx, tableSchema, type, key, oldRow, newRow, changedC
  *
  * `deferred` is the per-statement deferred-rebuild set the generator owns: a full-rebuild
  * covering MV is marked dirty here (not applied per row) and rebuilt once at the
- * end-of-statement flush ({@link runWithStatementSavepoints}). Bounded-delta arms stay
- * per-row-immediate.
+ * end-of-statement flush ({@link runWithStatementSavepoints}).
+ *
+ * `residualBatch` is the per-statement residual key batch the generator owns: a
+ * residual-arm covering MV (`'residual-recompute'` / `'prefix-delete'` /
+ * `'join-residual'`) accumulates the changed row's affected binding key(s) here (deduped
+ * across the statement) instead of recomputing per row, and each distinct key's residual
+ * runs once at the same end-of-statement flush. Only the `'inverse-projection'` arm stays
+ * per-row-immediate — the covering-UNIQUE enforcement scan reads its backing
+ * mid-statement, and its per-row delta is a cheap pure projection.
  */
-async function maintainRowTimeStructures(ctx, tableKey, change, cache, deferred) {
+async function maintainRowTimeStructures(ctx, tableKey, change, cache, deferred, residualBatch) {
     if (!ctx.db._hasRowTimeCoveringStructures(tableKey))
         return;
-    await ctx.db._maintainRowTimeCoveringStructures(tableKey, change, cache, deferred);
+    await ctx.db._maintainRowTimeCoveringStructures(tableKey, change, cache, deferred, residualBatch);
 }
 /**
  * Evaluate the per-statement mutation-context evaluators once, producing the
@@ -238,21 +268,26 @@ export function emitDmlExecutor(plan, ctx) {
                 existingRowDescriptor: clause.existingRowDescriptor,
             };
             // Resolve the per-target-column enforcement collation NAMES to functions once
-            // here (recording the collation dependency so a redefined collation re-emits),
-            // and carry the per-column logical types for affinity coercion. Consumed by
-            // matchUpsertClause so a collation-equal / affinity-coerced conflict on the
-            // targeted constraint routes to DO UPDATE / DO NOTHING instead of aborting.
+            // here (recording the collation dependency so a redefined collation re-emits).
+            // Consumed by matchUpsertClause so a collation-equal conflict on the targeted
+            // constraint routes to DO UPDATE / DO NOTHING instead of aborting.
             if (clause.conflictTargetIndices && clause.conflictTargetCollations) {
                 runtime.conflictTargetCollationFns = clause.conflictTargetCollations.map(name => ctx.resolveCollation(name ?? 'BINARY'));
-                runtime.conflictTargetTypes = clause.conflictTargetTypes;
             }
             if (clause.action === 'update' && clause.assignments) {
                 runtime.assignmentIndices = new Map();
+                runtime.assignmentCoercions = new Map();
                 for (const [colIndex, valueNode] of clause.assignments) {
                     const evaluatorIndex = upsertEvaluatorInstructions.length;
                     const instruction = emitCallFromPlan(valueNode, ctx);
                     upsertEvaluatorInstructions.push(instruction);
                     runtime.assignmentIndices.set(colIndex, evaluatorIndex);
+                    // Same static-type rule as emitUpdate: convert only when the
+                    // assignment expression's type is not the column's declared type.
+                    const column = tableSchema.columns[colIndex];
+                    if (valueNode.getType().logicalType !== column.logicalType) {
+                        runtime.assignmentCoercions.set(colIndex, column);
+                    }
                 }
             }
             if (clause.whereCondition) {
@@ -287,15 +322,16 @@ export function emitDmlExecutor(plan, ctx) {
             }
             // Match when the proposed values equal the existing row at the clause's
             // conflict-target columns — i.e. the conflict is on those columns —
-            // compared the way the constraint ENFORCES: the column's affinity is
-            // applied to the (pre-affinity-coercion) proposed value, then it is compared
-            // under the constraint's enforcement collation. This routes a collation-equal
-            // (NOCASE case-variant, RTRIM trailing-space) or affinity-coerced (`'1'` vs a
-            // stored INTEGER `1`) conflict on the targeted constraint to the DO UPDATE /
-            // DO NOTHING arm rather than aborting with a UNIQUE error. The per-column
-            // collation functions + logical types are precomputed at emit; a BINARY,
-            // byte-identical key still compares 0 (well-formed seeds re-present
-            // byte-identical literals, so seed idempotency is unaffected).
+            // compared the way the constraint ENFORCES: under the constraint's
+            // enforcement collation. Both rows are already in declared (stored)
+            // form — the INSERT emitter converted the proposed row by static type —
+            // so an affinity-coerced conflict (`'1'` proposed into an INTEGER key
+            // holding `1`) arrives converted, and a collation-equal conflict (NOCASE
+            // case-variant, RTRIM trailing-space) is routed by the collation compare
+            // to the DO UPDATE / DO NOTHING arm rather than aborting with a UNIQUE
+            // error. The per-column collation functions are precomputed at emit; a
+            // BINARY, byte-identical key still compares 0 (well-formed seeds
+            // re-present byte-identical literals, so seed idempotency is unaffected).
             //
             // NOTE: one residual corner remains out of scope — multi-constraint
             // coincidence. If an insert violates the targeted constraint AND another
@@ -336,22 +372,31 @@ export function emitDmlExecutor(plan, ctx) {
             // Evaluate assignment expressions with proper contexts
             for (const [colIndex, evaluatorIndex] of clause.assignmentIndices) {
                 const evaluator = upsertEvaluators[evaluatorIndex];
-                const value = await withAsyncRowContext(rctx, clause.existingRowDescriptor, () => existingRow, async () => {
+                let value = await withAsyncRowContext(rctx, clause.existingRowDescriptor, () => existingRow, async () => {
                     return await withAsyncRowContext(rctx, clause.newRowDescriptor, () => proposedRow, async () => {
                         return await evaluator(rctx);
                     });
                 });
+                // Convert to the declared column type when the assignment's static
+                // type requires it (see assignmentCoercions) — `existingRow` is a
+                // stored row, so the composed updatedRow is then fully declared-form.
+                const coerceColumn = clause.assignmentCoercions?.get(colIndex);
+                if (coerceColumn) {
+                    value = validateAndParse(value, coerceColumn.logicalType, coerceColumn.name);
+                }
                 updatedRow[colIndex] = value;
             }
         }
         // Extract the primary key from existing row
         const keyValues = pkColumnIndicesInSchema.map(idx => existingRow[idx]);
-        // Perform the UPDATE operation
+        // Perform the UPDATE operation. `preCoerced`: the row is composed of
+        // stored cells plus assignments already converted above.
         const updateArgs = {
             operation: 'update',
             values: updatedRow,
             oldKeyValues: keyValues,
             onConflict: ConflictResolution.ABORT,
+            preCoerced: true,
             mutationStatement: vtab.wantStatements ?
                 buildUpdateStatement(tableSchema, updatedRow, keyValues, contextRow) : undefined
         };
@@ -362,9 +407,12 @@ export function emitDmlExecutor(plan, ctx) {
         if (!updateResult.row) {
             return undefined;
         }
-        // Build a flat row for RETURNING (OLD = existing, NEW = updated)
-        const flatRow = [...existingRow, ...updatedRow];
-        return { updatedRow, flatRow };
+        // Report the row the substrate STORED, not the one we composed — see
+        // storedRowOrRaw. `existingRow` is already a stored (coerced) row.
+        const storedRow = storedRowOrRaw(updateResult.row, updatedRow, tableSchema.columns.length);
+        // Build a flat row for RETURNING (OLD = existing, NEW = stored)
+        const flatRow = [...existingRow, ...storedRow];
+        return { updatedRow: storedRow, flatRow };
     }
     /**
      * Translate a generic ConstraintError into the right OR-clause subclass
@@ -419,7 +467,12 @@ export function emitDmlExecutor(plan, ctx) {
     // non-snapshot-isolated UPDATE/DELETE has drained its source up front to
     // separate the read phase from the write phase. `for await ... of`
     // consumes either — the savepoint/FAIL-mode logic below is unchanged.
-    rows, isFailMode, processRow, deferredRebuilds, backingConnCache) {
+    rows, isFailMode, processRow, deferredRebuilds, residualBatch, backingConnCache, 
+    // Set only when the statement uses batched parent-side RESTRICT
+    // enforcement (see getBatchableRestrictFks): flushes the accumulated
+    // key batch at the end-of-statement boundary. The gate excludes FAIL,
+    // so a non-null flush always runs under the statement savepoint.
+    flushFkBatch) {
         let failSavepointCounter = 0;
         // For non-FAIL modes wrap the whole statement so a mid-statement failure
         // unwinds partial writes from earlier rows. FAIL keeps prior rows, so it
@@ -464,6 +517,14 @@ export function emitDmlExecutor(plan, ctx) {
                         if (savepointName) {
                             await ctx.db._rollbackAndReleaseSavepointBroadcast(savepointName);
                             savepointName = undefined;
+                            // The savepoint reverted the failing row's source/backing writes,
+                            // but the residual batch's JS-side DELTA accumulations cannot be
+                            // unwound and may carry the reverted row's contribution. The
+                            // residual KEYS stay valid (a reverted key recomputes from live
+                            // state to a value-identical row, which the host suppresses), so
+                            // drop only the delta fast path — the FAIL-mode flush below then
+                            // routes those entries through the plain residual.
+                            poisonResidualDeltaAccumulations(residualBatch);
                         }
                         // Translate plain constraint violations to FAIL/ROLLBACK error
                         // subclasses so the iterator-level cleanup picks the right
@@ -477,13 +538,22 @@ export function emitDmlExecutor(plan, ctx) {
                         yield rowToYield;
                     }
                 }
-                // End-of-statement boundary: drain the deferred full-rebuild set NOW — after
-                // every source row has been applied (so each rebuild reads all this
-                // statement's writes) and BEFORE the statement savepoint releases (so a
-                // failed rebuild rolls the whole statement back). Inside the try, so a flush
-                // error routes to the rollback branch below. A no-op when nothing deferred.
-                if (deferredRebuilds.size > 0) {
-                    await ctx.db._flushDeferredRebuilds(deferredRebuilds, backingConnCache);
+                // End-of-statement boundary. First the batched parent-side RESTRICT
+                // probe (fail fast — skip wasted MV work on a violation), then the
+                // deferred maintenance; both BEFORE the statement savepoint releases
+                // so a failure rolls the whole statement back. Inside the try, so an
+                // error routes to the rollback branch below.
+                if (flushFkBatch) {
+                    await flushFkBatch();
+                }
+                // Drain the deferred maintenance (residual key
+                // batch + full-rebuild set) NOW — after every source row has been applied
+                // (so each recompute/rebuild reads all this statement's writes) and BEFORE
+                // the statement savepoint releases (so a failed flush rolls the whole
+                // statement back). Inside the try, so a flush error routes to the rollback
+                // branch below. A no-op when nothing deferred.
+                if (deferredRebuilds.size > 0 || residualBatch.size > 0) {
+                    await ctx.db._flushDeferredMaintenance(deferredRebuilds, residualBatch, backingConnCache);
                 }
                 if (stmtSavepointName) {
                     await ctx.db._releaseSavepointBroadcast(stmtSavepointName);
@@ -493,18 +563,20 @@ export function emitDmlExecutor(plan, ctx) {
                 if (stmtSavepointName) {
                     await ctx.db._rollbackAndReleaseSavepointBroadcast(stmtSavepointName);
                 }
-                else if (deferredRebuilds.size > 0) {
+                else if (deferredRebuilds.size > 0 || residualBatch.size > 0) {
                     // OR FAIL keeps the rows that already succeeded (it runs with no
                     // statement-scope savepoint), so a mid-statement abort does NOT unwind
-                    // them. Their deferred full-rebuild MVs must therefore still be flushed
-                    // before the conflict error propagates — otherwise the backing would lag
-                    // the surviving source rows mid-transaction (read(MV) != evaluate(body)).
-                    // The failing row's own per-row savepoint already reverted its writes, so
-                    // the rebuild re-evaluates over exactly the surviving rows. The original
-                    // conflict error is re-thrown after the flush. (A flush failure here is a
-                    // genuine maintenance error and supersedes the conflict error, matching
-                    // "a maintenance error fails the source write".)
-                    await ctx.db._flushDeferredRebuilds(deferredRebuilds, backingConnCache);
+                    // them. Their deferred residual/full-rebuild MVs must therefore still be
+                    // flushed before the conflict error propagates — otherwise the backing
+                    // would lag the surviving source rows mid-transaction
+                    // (read(MV) != evaluate(body)). The failing row's own per-row savepoint
+                    // already reverted its writes, so the flush recomputes over exactly the
+                    // surviving rows (a reverted row's accumulated key is harmless — its
+                    // recompute is value-identical and suppressed). The original conflict
+                    // error is re-thrown after the flush. (A flush failure here is a genuine
+                    // maintenance error and supersedes the conflict error, matching "a
+                    // maintenance error fails the source write".)
+                    await ctx.db._flushDeferredMaintenance(deferredRebuilds, residualBatch, backingConnCache);
                 }
                 throw e;
             }
@@ -528,17 +600,19 @@ export function emitDmlExecutor(plan, ctx) {
         // Per-statement backing-connection cache: resolve each covering MV's backing
         // connection once for the whole statement rather than once per source row.
         const backingConnCache = new Map();
-        // Per-statement deferred full-rebuild set (MV keys): full-rebuild covering MVs
-        // are marked dirty during the row loop and rebuilt once at the end-of-statement
-        // flush in runWithStatementSavepoints.
+        // Per-statement deferred full-rebuild set (MV keys) + residual key batch:
+        // full-rebuild covering MVs are marked dirty and residual-arm covering MVs
+        // accumulate their affected binding keys during the row loop; both drain once
+        // at the end-of-statement flush in runWithStatementSavepoints.
         const deferredRebuilds = new Set();
+        const residualBatch = new Map();
         const isFailMode = plan.onConflict === ConflictResolution.FAIL;
         // Stamp the per-row mutation ordinal so a column `default` referencing
         // `mutation_ordinal()` (a per-row surrogate allocator) resolves to the 1-based
         // position of the row being produced. The defaults are evaluated upstream as
         // each row is *pulled*, so the ordinal is set BEFORE pulling — see
         // `stampMutationOrdinal`.
-        yield* runWithStatementSavepoints(ctx, vtab, stampMutationOrdinal(ctx, rows), isFailMode, (flatRow) => processInsertRow(ctx, vtab, needsAutoEvents, flatRow, contextRow, runtimeUpsertClauses, upsertEvaluators, backingConnCache, deferredRebuilds), deferredRebuilds, backingConnCache);
+        yield* runWithStatementSavepoints(ctx, vtab, stampMutationOrdinal(ctx, rows), isFailMode, (flatRow) => processInsertRow(ctx, vtab, needsAutoEvents, flatRow, contextRow, runtimeUpsertClauses, upsertEvaluators, backingConnCache, deferredRebuilds, residualBatch), deferredRebuilds, residualBatch, backingConnCache);
     }
     /**
      * Wrap the INSERT source so `rctx.mutationOrdinal` holds the 1-based ordinal of the
@@ -576,7 +650,7 @@ export function emitDmlExecutor(plan, ctx) {
      *
      * Throws ConstraintError on violations the executor cannot recover from.
      */
-    async function processInsertRow(ctx, vtab, needsAutoEvents, flatRow, contextRow, runtimeUpsertClauses, upsertEvaluators, backingConnCache, deferredRebuilds) {
+    async function processInsertRow(ctx, vtab, needsAutoEvents, flatRow, contextRow, runtimeUpsertClauses, upsertEvaluators, backingConnCache, deferredRebuilds, residualBatch) {
         const newRow = extractNewRowFromFlat(flatRow, tableSchema.columns.length);
         const tableKey = `${tableSchema.schemaName}.${tableSchema.name}`;
         let mutationStatement;
@@ -591,6 +665,10 @@ export function emitDmlExecutor(plan, ctx) {
             // can fall back to per-constraint defaultConflict directives. The memory
             // module treats undefined as ABORT when no constraint default is set.
             onConflict: plan.onConflict,
+            // The emitters converted the NEW section to declared types up front
+            // (emitInsert / constraint-check DEFAULT substitution), so the storage
+            // layer must not convert again — JSON conversion is not repeatable.
+            preCoerced: true,
             mutationStatement
         };
         const result = await vtab.update(args);
@@ -606,7 +684,7 @@ export function emitDmlExecutor(plan, ctx) {
                         return undefined;
                     const existingKeyValues = pkColumnIndicesInSchema.map(idx => result.existingRow[idx]);
                     ctx.db._recordUpdate(tableKey, result.existingRow, updateResult.updatedRow, pkColumnIndicesInSchema);
-                    await maintainRowTimeStructures(ctx, tableKey, { op: 'update', oldRow: result.existingRow, newRow: updateResult.updatedRow }, backingConnCache, deferredRebuilds);
+                    await maintainRowTimeStructures(ctx, tableKey, { op: 'update', oldRow: result.existingRow, newRow: updateResult.updatedRow }, backingConnCache, deferredRebuilds, residualBatch);
                     await executeForeignKeyActionsAndLens(ctx.db, tableSchema, 'update', result.existingRow, updateResult.updatedRow, plan.lensRouted);
                     if (needsAutoEvents) {
                         const changedColumns = [];
@@ -627,35 +705,41 @@ export function emitDmlExecutor(plan, ctx) {
         if (!result.row) {
             return undefined;
         }
+        // Everything downstream of the write — change tracking, row-time MV
+        // maintenance, auto-events, and the row RETURNING projects — must see the
+        // row the substrate STORED, not the raw input we handed it. See
+        // storedRowOrRaw.
+        const numCols = tableSchema.columns.length;
+        const storedRow = storedRowOrRaw(result.row, newRow, numCols);
         // Internal REPLACE evictions (rows at OTHER PKs removed to resolve a non-PK
         // UNIQUE conflict) run the full delete pipeline here, before the new row's
         // own bookkeeping — evict-then-write, matching the substrate journal order.
-        await processEvictions(ctx, needsAutoEvents, tableKey, result.evictedRows, backingConnCache, deferredRebuilds);
+        await processEvictions(ctx, needsAutoEvents, tableKey, result.evictedRows, backingConnCache, deferredRebuilds, residualBatch);
         const replacedRow = result.replacedRow;
         if (replacedRow) {
-            const newKeyValues = pkColumnIndicesInSchema.map(idx => newRow[idx]);
-            ctx.db._recordUpdate(tableKey, replacedRow, newRow, pkColumnIndicesInSchema);
-            await maintainRowTimeStructures(ctx, tableKey, { op: 'update', oldRow: replacedRow, newRow }, backingConnCache, deferredRebuilds);
+            const newKeyValues = pkColumnIndicesInSchema.map(idx => storedRow[idx]);
+            ctx.db._recordUpdate(tableKey, replacedRow, storedRow, pkColumnIndicesInSchema);
+            await maintainRowTimeStructures(ctx, tableKey, { op: 'update', oldRow: replacedRow, newRow: storedRow }, backingConnCache, deferredRebuilds, residualBatch);
             await executeForeignKeyActionsAndLens(ctx.db, tableSchema, 'delete', replacedRow, undefined, plan.lensRouted);
             if (needsAutoEvents) {
                 const changedColumns = [];
-                for (let i = 0; i < tableSchema.columns.length; i++) {
-                    if (!sqlValueIdentical(replacedRow[i], newRow[i])) {
+                for (let i = 0; i < numCols; i++) {
+                    if (!sqlValueIdentical(replacedRow[i], storedRow[i])) {
                         changedColumns.push(tableSchema.columns[i].name);
                     }
                 }
-                emitAutoDataEvent(ctx, tableSchema, 'update', newKeyValues, [...replacedRow], [...newRow], changedColumns);
+                emitAutoDataEvent(ctx, tableSchema, 'update', newKeyValues, [...replacedRow], [...storedRow], changedColumns);
             }
         }
         else {
-            const pkValues = pkColumnIndicesInSchema.map(idx => newRow[idx]);
-            ctx.db._recordInsert(tableKey, newRow, pkColumnIndicesInSchema);
-            await maintainRowTimeStructures(ctx, tableKey, { op: 'insert', newRow }, backingConnCache, deferredRebuilds);
+            const pkValues = pkColumnIndicesInSchema.map(idx => storedRow[idx]);
+            ctx.db._recordInsert(tableKey, storedRow, pkColumnIndicesInSchema);
+            await maintainRowTimeStructures(ctx, tableKey, { op: 'insert', newRow: storedRow }, backingConnCache, deferredRebuilds, residualBatch);
             if (needsAutoEvents) {
-                emitAutoDataEvent(ctx, tableSchema, 'insert', pkValues, undefined, [...newRow]);
+                emitAutoDataEvent(ctx, tableSchema, 'insert', pkValues, undefined, [...storedRow]);
             }
         }
-        return flatRow;
+        return withStoredNewSection(flatRow, storedRow, newRow, numCols);
     }
     /**
      * Drive the full delete pipeline for every internal REPLACE eviction reported
@@ -671,7 +755,7 @@ export function emitDmlExecutor(plan, ctx) {
      * evict-then-write order (a later same-key backing write must not be undone by
      * an earlier-PK eviction's delete).
      */
-    async function processEvictions(ctx, needsAutoEvents, tableKey, evictedRows, backingConnCache, deferredRebuilds) {
+    async function processEvictions(ctx, needsAutoEvents, tableKey, evictedRows, backingConnCache, deferredRebuilds, residualBatch) {
         if (!evictedRows || evictedRows.length === 0)
             return;
         for (const evicted of evictedRows) {
@@ -690,7 +774,7 @@ export function emitDmlExecutor(plan, ctx) {
             await assertTransitiveRestrictsForParentMutation(ctx.db, tableSchema, 'delete', evicted);
             const evictedKeyValues = pkColumnIndicesInSchema.map(idx => evicted[idx]);
             ctx.db._recordDelete(tableKey, evicted, pkColumnIndicesInSchema);
-            await maintainRowTimeStructures(ctx, tableKey, { op: 'delete', oldRow: evicted }, backingConnCache, deferredRebuilds);
+            await maintainRowTimeStructures(ctx, tableKey, { op: 'delete', oldRow: evicted }, backingConnCache, deferredRebuilds, residualBatch);
             await executeForeignKeyActionsAndLens(ctx.db, tableSchema, 'delete', evicted);
             if (needsAutoEvents) {
                 emitAutoDataEvent(ctx, tableSchema, 'delete', evictedKeyValues, [...evicted]);
@@ -704,10 +788,20 @@ export function emitDmlExecutor(plan, ctx) {
         const vtab = await getVTable(ctx, tableSchema);
         const needsAutoEvents = ctx.db._needsDataEvents() && !moduleHasNativeDataEvents(ctx, tableSchema);
         const contextRow = await evaluateContextRow(ctx, contextEvaluators);
-        // Per-statement backing-connection cache + deferred full-rebuild set (see runInsert).
+        // Per-statement backing-connection cache + deferred full-rebuild set + residual
+        // key batch (see runInsert).
         const backingConnCache = new Map();
         const deferredRebuilds = new Set();
+        const residualBatch = new Map();
         const isFailMode = plan.onConflict === ConflictResolution.FAIL;
+        // Batched parent-side RESTRICT enforcement (per-execution state, never on
+        // the emit closure — a re-run prepared statement must start empty). When
+        // the gate admits the statement, the per-row transitive pre-walk is
+        // replaced by key accumulation + one chunked probe per FK at the
+        // end-of-statement boundary. The plan side made the same gate decision
+        // and skipped the per-row NOT EXISTS checks.
+        const batchableFks = getBatchableRestrictFks(ctx.db.schemaManager, tableSchema, 'update', plan.onConflict, plan.lensRouted);
+        const fkRestrictBatch = batchableFks ? createParentRestrictBatch(batchableFks) : undefined;
         // Physical Halloween avoidance: unless the target module guarantees per-scan
         // snapshot isolation, fully drain the source match set (closing the scan
         // cursor) BEFORE applying any write — otherwise the first UPDATE invalidates
@@ -717,7 +811,7 @@ export function emitDmlExecutor(plan, ctx) {
         // the accepted cost of correctness (such a module cannot safely stream-update
         // anyway); memory tables set scanSnapshotIsolation and keep streaming.
         const sourceRows = await resolveDmlSourceRows(ctx, vtab, tableSchema, rows);
-        yield* runWithStatementSavepoints(ctx, vtab, sourceRows, isFailMode, (flatRow) => processUpdateRow(ctx, vtab, needsAutoEvents, flatRow, contextRow, backingConnCache, deferredRebuilds), deferredRebuilds, backingConnCache);
+        yield* runWithStatementSavepoints(ctx, vtab, sourceRows, isFailMode, (flatRow) => processUpdateRow(ctx, vtab, needsAutoEvents, flatRow, contextRow, backingConnCache, deferredRebuilds, residualBatch, fkRestrictBatch), deferredRebuilds, residualBatch, backingConnCache, fkRestrictBatch ? () => flushParentRestrictBatch(ctx.db, tableSchema, 'update', fkRestrictBatch) : undefined);
     }
     /**
      * Performs a single row's UPDATE side-effects (RESTRICT pre-check +
@@ -727,7 +821,7 @@ export function emitDmlExecutor(plan, ctx) {
      * cannot recover from; the caller (runWithStatementSavepoints) translates it
      * for FAIL/ROLLBACK modes.
      */
-    async function processUpdateRow(ctx, vtab, needsAutoEvents, flatRow, contextRow, backingConnCache, deferredRebuilds) {
+    async function processUpdateRow(ctx, vtab, needsAutoEvents, flatRow, contextRow, backingConnCache, deferredRebuilds, residualBatch, fkRestrictBatch) {
         const oldRow = extractOldRowFromFlat(flatRow, tableSchema.columns.length);
         const newRow = extractNewRowFromFlat(flatRow, tableSchema.columns.length);
         const tableKey = `${tableSchema.schemaName}.${tableSchema.name}`;
@@ -743,14 +837,23 @@ export function emitDmlExecutor(plan, ctx) {
         if (vtab.wantStatements) {
             mutationStatement = buildUpdateStatement(tableSchema, newRow, keyValues, contextRow);
         }
-        // Defense-in-depth RESTRICT enforcement: the plan-time `NOT EXISTS`
-        // check is the primary path, but some vtab modules evaluate the
-        // embedded subquery differently from a plain row scan. Pre-walk
-        // the transitive cascade closure so RESTRICTs at any depth fire
-        // BEFORE vtab.update — needed for rowid-mode backends (lamina)
-        // where post-mutation OLD-value scans dereference through the
-        // just-mutated parent and find zero rows.
-        await assertTransitiveRestrictsForParentMutation(ctx.db, tableSchema, 'update', oldRow, newRow, plan.lensRouted);
+        // Parent-side RESTRICT enforcement. Batched statements accumulate the
+        // OLD referenced keys (probed once per FK at the end-of-statement
+        // boundary — same pre-vtab observation point per row, so a row the vtab
+        // later reports not-found contributes identically to the per-row path).
+        // Otherwise: defense-in-depth per-row pre-walk — the plan-time
+        // `NOT EXISTS` check is the primary path, but some vtab modules evaluate
+        // the embedded subquery differently from a plain row scan. Pre-walk the
+        // transitive cascade closure so RESTRICTs at any depth fire BEFORE
+        // vtab.update — needed for rowid-mode backends (lamina) where
+        // post-mutation OLD-value scans dereference through the just-mutated
+        // parent and find zero rows.
+        if (fkRestrictBatch) {
+            accumulateParentRestrictKeys(fkRestrictBatch, 'update', oldRow, newRow);
+        }
+        else {
+            await assertTransitiveRestrictsForParentMutation(ctx.db, tableSchema, 'update', oldRow, newRow, plan.lensRouted);
+        }
         const args = {
             operation: 'update',
             values: newRow,
@@ -759,6 +862,10 @@ export function emitDmlExecutor(plan, ctx) {
             // can fall back to per-constraint defaultConflict directives. The memory
             // module treats undefined as ABORT when no constraint default is set.
             onConflict: plan.onConflict,
+            // emitUpdate converted the NEW section to declared types (assigned
+            // columns by static type, unassigned columns are stored values) — the
+            // storage layer must not convert again.
+            preCoerced: true,
             mutationStatement
         };
         const result = await vtab.update(args);
@@ -770,6 +877,11 @@ export function emitDmlExecutor(plan, ctx) {
         if (!result.row) {
             return undefined;
         }
+        // Post-write bookkeeping and the RETURNING row must see the row the
+        // substrate STORED, not the raw input — see storedRowOrRaw. `oldRow` came
+        // from the source scan, so it is already a stored (coerced) row.
+        const numCols = tableSchema.columns.length;
+        const storedRow = storedRowOrRaw(result.row, newRow, numCols);
         // If the UPDATE moved this row onto an occupied PK under REPLACE,
         // the vtab returns the displaced row. Surface its deletion BEFORE
         // the move bookkeeping so change tracking, FK cascade, and auto-events
@@ -781,7 +893,7 @@ export function emitDmlExecutor(plan, ctx) {
         if (result.replacedRow) {
             const evictedKeyValues = pkColumnIndicesInSchema.map(idx => result.replacedRow[idx]);
             ctx.db._recordDelete(tableKey, result.replacedRow, pkColumnIndicesInSchema);
-            await maintainRowTimeStructures(ctx, tableKey, { op: 'delete', oldRow: result.replacedRow }, backingConnCache, deferredRebuilds);
+            await maintainRowTimeStructures(ctx, tableKey, { op: 'delete', oldRow: result.replacedRow }, backingConnCache, deferredRebuilds, residualBatch);
             await executeForeignKeyActionsAndLens(ctx.db, tableSchema, 'delete', result.replacedRow, undefined, plan.lensRouted);
             if (needsAutoEvents) {
                 emitAutoDataEvent(ctx, tableSchema, 'delete', evictedKeyValues, [...result.replacedRow]);
@@ -791,27 +903,27 @@ export function emitDmlExecutor(plan, ctx) {
         // UNIQUE conflict for this same update) run the full delete pipeline here,
         // after any same-PK replacedRow handling and before the moved row's own
         // bookkeeping — evict-then-write, matching the substrate journal order.
-        await processEvictions(ctx, needsAutoEvents, tableKey, result.evictedRows, backingConnCache, deferredRebuilds);
+        await processEvictions(ctx, needsAutoEvents, tableKey, result.evictedRows, backingConnCache, deferredRebuilds, residualBatch);
         // Track change (UPDATE): pass full rows so the change capture can
         // project the columns any active subscription cares about.
-        ctx.db._recordUpdate(tableKey, oldRow, newRow, pkColumnIndicesInSchema);
-        await maintainRowTimeStructures(ctx, tableKey, { op: 'update', oldRow, newRow }, backingConnCache, deferredRebuilds);
+        ctx.db._recordUpdate(tableKey, oldRow, storedRow, pkColumnIndicesInSchema);
+        await maintainRowTimeStructures(ctx, tableKey, { op: 'update', oldRow, newRow: storedRow }, backingConnCache, deferredRebuilds, residualBatch);
         // Execute FK cascading actions (CASCADE, SET NULL, SET DEFAULT)
-        await executeForeignKeyActionsAndLens(ctx.db, tableSchema, 'update', oldRow, newRow, plan.lensRouted);
+        await executeForeignKeyActionsAndLens(ctx.db, tableSchema, 'update', oldRow, storedRow, plan.lensRouted);
         // Emit auto event for modules without native event support
         if (needsAutoEvents) {
             // Compute changed columns
             const changedColumns = [];
-            for (let i = 0; i < tableSchema.columns.length; i++) {
+            for (let i = 0; i < numCols; i++) {
                 const oldVal = oldRow[i];
-                const newVal = newRow[i];
+                const newVal = storedRow[i];
                 if (!sqlValueIdentical(oldVal, newVal)) {
                     changedColumns.push(tableSchema.columns[i].name);
                 }
             }
-            emitAutoDataEvent(ctx, tableSchema, 'update', keyValues, [...oldRow], [...newRow], changedColumns);
+            emitAutoDataEvent(ctx, tableSchema, 'update', keyValues, [...oldRow], [...storedRow], changedColumns);
         }
-        return flatRow;
+        return withStoredNewSection(flatRow, storedRow, newRow, numCols);
     }
     // DELETE ----------------------------------------------------
     async function* runDelete(ctx, rows, ...contextEvaluators) {
@@ -820,16 +932,23 @@ export function emitDmlExecutor(plan, ctx) {
         const vtab = await getVTable(ctx, tableSchema);
         const needsAutoEvents = ctx.db._needsDataEvents() && !moduleHasNativeDataEvents(ctx, tableSchema);
         const contextRow = await evaluateContextRow(ctx, contextEvaluators);
-        // Per-statement backing-connection cache + deferred full-rebuild set (see runInsert).
+        // Per-statement backing-connection cache + deferred full-rebuild set + residual
+        // key batch (see runInsert).
         const backingConnCache = new Map();
         const deferredRebuilds = new Set();
+        const residualBatch = new Map();
         const isFailMode = plan.onConflict === ConflictResolution.FAIL;
+        // Batched parent-side RESTRICT enforcement — see the matching note in
+        // runUpdate (per-execution state; one chunked probe per FK at the
+        // end-of-statement boundary when the gate admits the statement).
+        const batchableFks = getBatchableRestrictFks(ctx.db.schemaManager, tableSchema, 'delete', plan.onConflict, plan.lensRouted);
+        const fkRestrictBatch = batchableFks ? createParentRestrictBatch(batchableFks) : undefined;
         // Physical Halloween avoidance — see the matching note in runUpdate. Unless
         // the target module guarantees per-scan snapshot isolation, drain the source
         // match set (closing the scan cursor) before applying any DELETE, so the
         // first delete cannot invalidate the cursor path the scan is still walking.
         const sourceRows = await resolveDmlSourceRows(ctx, vtab, tableSchema, rows);
-        yield* runWithStatementSavepoints(ctx, vtab, sourceRows, isFailMode, (flatRow) => processDeleteRow(ctx, vtab, needsAutoEvents, flatRow, contextRow, backingConnCache, deferredRebuilds), deferredRebuilds, backingConnCache);
+        yield* runWithStatementSavepoints(ctx, vtab, sourceRows, isFailMode, (flatRow) => processDeleteRow(ctx, vtab, needsAutoEvents, flatRow, contextRow, backingConnCache, deferredRebuilds, residualBatch, fkRestrictBatch), deferredRebuilds, residualBatch, backingConnCache, fkRestrictBatch ? () => flushParentRestrictBatch(ctx.db, tableSchema, 'delete', fkRestrictBatch) : undefined);
     }
     /**
      * Performs a single row's DELETE side-effects (RESTRICT pre-check +
@@ -839,7 +958,7 @@ export function emitDmlExecutor(plan, ctx) {
      * (runWithStatementSavepoints) translates constraint violations for
      * FAIL/ROLLBACK modes.
      */
-    async function processDeleteRow(ctx, vtab, needsAutoEvents, flatRow, contextRow, backingConnCache, deferredRebuilds) {
+    async function processDeleteRow(ctx, vtab, needsAutoEvents, flatRow, contextRow, backingConnCache, deferredRebuilds, residualBatch, fkRestrictBatch) {
         const oldRow = extractOldRowFromFlat(flatRow, tableSchema.columns.length);
         const tableKey = `${tableSchema.schemaName}.${tableSchema.name}`;
         const keyValues = pkColumnIndicesInSchema.map(pkColIdx => {
@@ -853,14 +972,21 @@ export function emitDmlExecutor(plan, ctx) {
         if (vtab.wantStatements) {
             mutationStatement = buildDeleteStatement(tableSchema, keyValues, contextRow);
         }
-        // Defense-in-depth RESTRICT enforcement — see comment on the UPDATE
-        // path above.
-        await assertTransitiveRestrictsForParentMutation(ctx.db, tableSchema, 'delete', oldRow, undefined, plan.lensRouted);
+        // Parent-side RESTRICT enforcement: batched key accumulation, or the
+        // per-row defense-in-depth pre-walk — see comment on the UPDATE path above.
+        if (fkRestrictBatch) {
+            accumulateParentRestrictKeys(fkRestrictBatch, 'delete', oldRow);
+        }
+        else {
+            await assertTransitiveRestrictsForParentMutation(ctx.db, tableSchema, 'delete', oldRow, undefined, plan.lensRouted);
+        }
         const args = {
             operation: 'delete',
             values: undefined,
             oldKeyValues: keyValues,
             onConflict: plan.onConflict ?? ConflictResolution.ABORT,
+            // The key cells come from the scanned OLD row — already stored form.
+            preCoerced: true,
             mutationStatement
         };
         const result = await vtab.update(args);
@@ -875,7 +1001,7 @@ export function emitDmlExecutor(plan, ctx) {
         // Track change (DELETE): record OLD row + PK indices so capture
         // can project the columns subscribers care about.
         ctx.db._recordDelete(tableKey, oldRow, pkColumnIndicesInSchema);
-        await maintainRowTimeStructures(ctx, tableKey, { op: 'delete', oldRow }, backingConnCache, deferredRebuilds);
+        await maintainRowTimeStructures(ctx, tableKey, { op: 'delete', oldRow }, backingConnCache, deferredRebuilds, residualBatch);
         // Execute FK cascading actions (CASCADE, SET NULL, SET DEFAULT)
         await executeForeignKeyActionsAndLens(ctx.db, tableSchema, 'delete', oldRow, undefined, plan.lensRouted);
         // Emit auto event for modules without native event support