@quereus/quereus 4.4.0 → 4.5.0

package/dist/src/runtime/emit/dml-executor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dml-executor.d.ts","sourceRoot":"","sources":["../../../../src/runtime/emit/dml-executor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0CAA0C,CAAC;AAChF,OAAO,KAAK,EAAE,WAAW,EAA+C,MAAM,aAAa,CAAC;AAO5F,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAI9D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAuPzD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,8BAA8B,CAAC,WAAW,EAAE,WAAW,GAAG,IAAI,CAQ7E;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,eAAe,EAAE,GAAG,EAAE,eAAe,GAAG,WAAW,CA64BxF"}
+{"version":3,"file":"dml-executor.d.ts","sourceRoot":"","sources":["../../../../src/runtime/emit/dml-executor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0CAA0C,CAAC;AAChF,OAAO,KAAK,EAAE,WAAW,EAA+C,MAAM,aAAa,CAAC;AAO5F,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAI9D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAoRzD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,8BAA8B,CAAC,WAAW,EAAE,WAAW,GAAG,IAAI,CAQ7E;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,eAAe,EAAE,GAAG,EAAE,eAAe,GAAG,WAAW,CAy+BxF"}

package/dist/src/runtime/emit/dml-executor.js

@@ -9,9 +9,11 @@ import { buildInsertStatement, buildUpdateStatement, buildDeleteStatement } from
 import { isMaintainedTable } from '../../schema/derivation.js';
 import { hasNativeEventSupport } from '../../util/event-support.js';
 import { sqlValueIdentical, compareSqlValuesFast, BINARY_COLLATION } from '../../util/comparison.js';
+import { uniqueEnforcementComparators } from '../../schema/unique-enforcement.js';
 import { validateAndParse } from '../../types/validation.js';
 import { withAsyncRowContext } from '../context-helpers.js';
-import { executeForeignKeyActionsAndLens, assertTransitiveRestrictsForParentMutation } from '../foreign-key-actions.js';
+import { executeForeignKeyActionsAndLens, assertTransitiveRestrictsForParentMutation, createParentRestrictBatch, accumulateParentRestrictKeys, flushParentRestrictBatch } from '../foreign-key-actions.js';
+import { getBatchableRestrictFks } from '../../planner/building/foreign-key-builder.js';
 import { poisonResidualDeltaAccumulations } from '../../core/database-materialized-views-apply.js';
 /**
  * Module-scope counter producing unique statement-savepoint names across
@@ -22,36 +24,22 @@ import { poisonResidualDeltaAccumulations } from '../../core/database-materializ
 let stmtSavepointCounter = 0;
 /**
  * True when a proposed value equals the stored existing value at one conflict-target
- * column the way the targeted constraint ENFORCES: the column's affinity is applied to
- * the proposed value (which reaches the executor pre-affinity-coercion, while
- * `existing` is the already-coerced stored value), then the two are compared under the
- * column's precomputed enforcement collation.
+ * column the way the targeted constraint ENFORCES: through the column's precomputed
+ * comparator (declared-type `compare` for a semantic-ordering column, else the
+ * enforcement collation). Both sides are already in declared (stored) form —
+ * `existing` is a stored row and the proposed row was converted by the INSERT
+ * emitter's static-type pass — so no per-row conversion happens here.
  *
- * `targetPos` indexes the clause's per-target metadata arrays (which are aligned with
- * `conflictTargetIndices`). When that metadata is absent — a defensively-old plan — it
- * degrades to BINARY with no coercion, i.e. exactly the byte-identity semantics of
- * `sqlValueIdentical`, preserving its numeric-storage-class tolerance via
- * {@link compareSqlValuesFast}. A coercion failure likewise falls back to the raw
- * proposed value (it then compares unequal and the caller aborts, as before).
+ * `targetPos` indexes the clause's per-target comparator array (aligned with
+ * `conflictTargetIndices`). When absent — a defensively-old plan — it degrades to
+ * BINARY, i.e. the byte-identity semantics of `sqlValueIdentical`, preserving its
+ * numeric-storage-class tolerance via {@link compareSqlValuesFast}.
  */
 function conflictTargetValuesMatch(existing, proposed, clause, targetPos) {
-    const type = clause.conflictTargetTypes?.[targetPos];
-    const collationFn = clause.conflictTargetCollationFns?.[targetPos] ?? BINARY_COLLATION;
-    // NOTE: re-coerces the proposed value per conflicting row via validateAndParse; only
-    // reached on the (cold) UNIQUE-violation-with-upsert-clause path, so it is off the
-    // happy-path insert. If a workload ever hammers ON CONFLICT on a wide composite target,
-    // precompute per-target coercion closures at emit instead of dispatching on type here.
-    let coercedProposed = proposed;
-    if (type) {
-        try {
-            coercedProposed = validateAndParse(proposed, type);
-        }
-        catch {
-            // Coercion failed — compare the raw proposed value (aborts, as pre-fix).
-            coercedProposed = proposed;
-        }
-    }
-    return compareSqlValuesFast(existing, coercedProposed, collationFn) === 0;
+    const compare = clause.conflictTargetComparators?.[targetPos];
+    if (compare)
+        return compare(existing, proposed) === 0;
+    return compareSqlValuesFast(existing, proposed, BINARY_COLLATION) === 0;
 }
 /**
  * Returns true when the table's owning *module* natively emits data events.
@@ -120,6 +108,44 @@ async function resolveDmlSourceRows(ctx, vtab, tableSchema, rows) {
         throw e;
     }
 }
+/**
+ * The row the substrate actually STORED for this write, which is what every
+ * post-write consumer must see. The executor's own writes are converted by the
+ * emitters up front (and passed with `preCoerced`), so for the standard
+ * backends `result.row` and the row we handed in now usually agree — but a
+ * module remains free to normalize further (or to ignore `preCoerced` and
+ * convert on its own), and `result.row` is its word on what landed.
+ *
+ * Falls back to the raw row when the substrate's row is the wrong width — a
+ * minimal test/sample module that echoes its input in a different shape. The
+ * absent case is only reached defensively: every caller has already
+ * short-circuited on a missing `result.row`, which the module contract
+ * reserves for "nothing was written" (see `VirtualTable.update`).
+ */
+function storedRowOrRaw(resultRow, rawRow, columnCount) {
+    return resultRow && resultRow.length === columnCount ? resultRow : rawRow;
+}
+/**
+ * Rebuild the flat OLD/NEW row with its NEW section (indices n..2n-1) replaced by
+ * the substrate's stored row, so `RETURNING new.<col>` reports the same value and
+ * `typeof` as a subsequent `select`. Returns `flatRow` untouched when the stored
+ * row IS the raw NEW section (the fallback above), avoiding a per-row copy.
+ *
+ * NOTE: on a coercing substrate this allocates one array per written row (the
+ * DML executor previously yielded `flatRow` verbatim). It is one copy against a
+ * per-row `vtab.update()` await, so it does not register today; if bulk-INSERT
+ * throughput ever shows this as hot, have the substrates report which columns
+ * coercion actually changed and patch only those in place.
+ */
+function withStoredNewSection(flatRow, storedRow, rawNewRow, columnCount) {
+    if (storedRow === rawNewRow)
+        return flatRow;
+    const out = flatRow.slice();
+    for (let i = 0; i < columnCount; i++) {
+        out[columnCount + i] = storedRow[i];
+    }
+    return out;
+}
 /**
  * Emit an automatic data change event for modules without native event support.
  */
@@ -247,20 +273,29 @@ export function emitDmlExecutor(plan, ctx) {
             };
             // Resolve the per-target-column enforcement collation NAMES to functions once
             // here (recording the collation dependency so a redefined collation re-emits),
-            // and carry the per-column logical types for affinity coercion. Consumed by
-            // matchUpsertClause so a collation-equal / affinity-coerced conflict on the
-            // targeted constraint routes to DO UPDATE / DO NOTHING instead of aborting.
+            // then build the per-column comparators through the shared UNIQUE-enforcement
+            // rule. Consumed by matchUpsertClause so a conflict the targeted constraint
+            // considers a duplicate — collation-equal, or semantically equal under a
+            // semantic-ordering declared type — routes to DO UPDATE / DO NOTHING instead
+            // of aborting.
             if (clause.conflictTargetIndices && clause.conflictTargetCollations) {
-                runtime.conflictTargetCollationFns = clause.conflictTargetCollations.map(name => ctx.resolveCollation(name ?? 'BINARY'));
-                runtime.conflictTargetTypes = clause.conflictTargetTypes;
+                const collationFns = clause.conflictTargetCollations.map(name => ctx.resolveCollation(name ?? 'BINARY'));
+                runtime.conflictTargetComparators = uniqueEnforcementComparators(tableSchema.columns, clause.conflictTargetIndices, collationFns);
             }
             if (clause.action === 'update' && clause.assignments) {
                 runtime.assignmentIndices = new Map();
+                runtime.assignmentCoercions = new Map();
                 for (const [colIndex, valueNode] of clause.assignments) {
                     const evaluatorIndex = upsertEvaluatorInstructions.length;
                     const instruction = emitCallFromPlan(valueNode, ctx);
                     upsertEvaluatorInstructions.push(instruction);
                     runtime.assignmentIndices.set(colIndex, evaluatorIndex);
+                    // Same static-type rule as emitUpdate: convert only when the
+                    // assignment expression's type is not the column's declared type.
+                    const column = tableSchema.columns[colIndex];
+                    if (valueNode.getType().logicalType !== column.logicalType) {
+                        runtime.assignmentCoercions.set(colIndex, column);
+                    }
                 }
             }
             if (clause.whereCondition) {
@@ -293,17 +328,13 @@ export function emitDmlExecutor(plan, ctx) {
                 // No conflict target specified - matches any unique constraint
                 return clause;
             }
-            // Match when the proposed values equal the existing row at the clause's
-            // conflict-target columns — i.e. the conflict is on those columns —
-            // compared the way the constraint ENFORCES: the column's affinity is
-            // applied to the (pre-affinity-coercion) proposed value, then it is compared
-            // under the constraint's enforcement collation. This routes a collation-equal
-            // (NOCASE case-variant, RTRIM trailing-space) or affinity-coerced (`'1'` vs a
-            // stored INTEGER `1`) conflict on the targeted constraint to the DO UPDATE /
-            // DO NOTHING arm rather than aborting with a UNIQUE error. The per-column
-            // collation functions + logical types are precomputed at emit; a BINARY,
-            // byte-identical key still compares 0 (well-formed seeds re-present
-            // byte-identical literals, so seed idempotency is unaffected).
+            // The conflict is on this clause's target columns when the proposed row
+            // equals the existing one there, compared the way the constraint ENFORCES
+            // (see {@link conflictTargetValuesMatch}): an affinity-coerced, a
+            // collation-equal or a semantically-equal conflict all route to the DO
+            // UPDATE / DO NOTHING arm rather than aborting with a UNIQUE error, while
+            // a BINARY byte-identical key still compares 0 (so seed idempotency, which
+            // re-presents identical literals, is unaffected).
             //
             // NOTE: one residual corner remains out of scope — multi-constraint
             // coincidence. If an insert violates the targeted constraint AND another
@@ -344,22 +375,31 @@ export function emitDmlExecutor(plan, ctx) {
             // Evaluate assignment expressions with proper contexts
             for (const [colIndex, evaluatorIndex] of clause.assignmentIndices) {
                 const evaluator = upsertEvaluators[evaluatorIndex];
-                const value = await withAsyncRowContext(rctx, clause.existingRowDescriptor, () => existingRow, async () => {
+                let value = await withAsyncRowContext(rctx, clause.existingRowDescriptor, () => existingRow, async () => {
                     return await withAsyncRowContext(rctx, clause.newRowDescriptor, () => proposedRow, async () => {
                         return await evaluator(rctx);
                     });
                 });
+                // Convert to the declared column type when the assignment's static
+                // type requires it (see assignmentCoercions) — `existingRow` is a
+                // stored row, so the composed updatedRow is then fully declared-form.
+                const coerceColumn = clause.assignmentCoercions?.get(colIndex);
+                if (coerceColumn) {
+                    value = validateAndParse(value, coerceColumn.logicalType, coerceColumn.name);
+                }
                 updatedRow[colIndex] = value;
             }
         }
         // Extract the primary key from existing row
         const keyValues = pkColumnIndicesInSchema.map(idx => existingRow[idx]);
-        // Perform the UPDATE operation
+        // Perform the UPDATE operation. `preCoerced`: the row is composed of
+        // stored cells plus assignments already converted above.
         const updateArgs = {
             operation: 'update',
             values: updatedRow,
             oldKeyValues: keyValues,
             onConflict: ConflictResolution.ABORT,
+            preCoerced: true,
             mutationStatement: vtab.wantStatements ?
                 buildUpdateStatement(tableSchema, updatedRow, keyValues, contextRow) : undefined
         };
@@ -370,9 +410,12 @@ export function emitDmlExecutor(plan, ctx) {
         if (!updateResult.row) {
             return undefined;
         }
-        // Build a flat row for RETURNING (OLD = existing, NEW = updated)
-        const flatRow = [...existingRow, ...updatedRow];
-        return { updatedRow, flatRow };
+        // Report the row the substrate STORED, not the one we composed — see
+        // storedRowOrRaw. `existingRow` is already a stored (coerced) row.
+        const storedRow = storedRowOrRaw(updateResult.row, updatedRow, tableSchema.columns.length);
+        // Build a flat row for RETURNING (OLD = existing, NEW = stored)
+        const flatRow = [...existingRow, ...storedRow];
+        return { updatedRow: storedRow, flatRow };
     }
     /**
      * Translate a generic ConstraintError into the right OR-clause subclass
@@ -427,7 +470,12 @@ export function emitDmlExecutor(plan, ctx) {
     // non-snapshot-isolated UPDATE/DELETE has drained its source up front to
     // separate the read phase from the write phase. `for await ... of`
     // consumes either — the savepoint/FAIL-mode logic below is unchanged.
-    rows, isFailMode, processRow, deferredRebuilds, residualBatch, backingConnCache) {
+    rows, isFailMode, processRow, deferredRebuilds, residualBatch, backingConnCache, 
+    // Set only when the statement uses batched parent-side RESTRICT
+    // enforcement (see getBatchableRestrictFks): flushes the accumulated
+    // key batch at the end-of-statement boundary. The gate excludes FAIL,
+    // so a non-null flush always runs under the statement savepoint.
+    flushFkBatch) {
         let failSavepointCounter = 0;
         // For non-FAIL modes wrap the whole statement so a mid-statement failure
         // unwinds partial writes from earlier rows. FAIL keeps prior rows, so it
@@ -493,7 +541,15 @@ export function emitDmlExecutor(plan, ctx) {
                         yield rowToYield;
                     }
                 }
-                // End-of-statement boundary: drain the deferred maintenance (residual key
+                // End-of-statement boundary. First the batched parent-side RESTRICT
+                // probe (fail fast — skip wasted MV work on a violation), then the
+                // deferred maintenance; both BEFORE the statement savepoint releases
+                // so a failure rolls the whole statement back. Inside the try, so an
+                // error routes to the rollback branch below.
+                if (flushFkBatch) {
+                    await flushFkBatch();
+                }
+                // Drain the deferred maintenance (residual key
                 // batch + full-rebuild set) NOW — after every source row has been applied
                 // (so each recompute/rebuild reads all this statement's writes) and BEFORE
                 // the statement savepoint releases (so a failed flush rolls the whole
@@ -612,6 +668,10 @@ export function emitDmlExecutor(plan, ctx) {
             // can fall back to per-constraint defaultConflict directives. The memory
             // module treats undefined as ABORT when no constraint default is set.
             onConflict: plan.onConflict,
+            // The emitters converted the NEW section to declared types up front
+            // (emitInsert / constraint-check DEFAULT substitution), so the storage
+            // layer must not convert again — JSON conversion is not repeatable.
+            preCoerced: true,
             mutationStatement
         };
         const result = await vtab.update(args);
@@ -648,35 +708,41 @@ export function emitDmlExecutor(plan, ctx) {
         if (!result.row) {
             return undefined;
         }
+        // Everything downstream of the write — change tracking, row-time MV
+        // maintenance, auto-events, and the row RETURNING projects — must see the
+        // row the substrate STORED, not the raw input we handed it. See
+        // storedRowOrRaw.
+        const numCols = tableSchema.columns.length;
+        const storedRow = storedRowOrRaw(result.row, newRow, numCols);
         // Internal REPLACE evictions (rows at OTHER PKs removed to resolve a non-PK
         // UNIQUE conflict) run the full delete pipeline here, before the new row's
         // own bookkeeping — evict-then-write, matching the substrate journal order.
         await processEvictions(ctx, needsAutoEvents, tableKey, result.evictedRows, backingConnCache, deferredRebuilds, residualBatch);
         const replacedRow = result.replacedRow;
         if (replacedRow) {
-            const newKeyValues = pkColumnIndicesInSchema.map(idx => newRow[idx]);
-            ctx.db._recordUpdate(tableKey, replacedRow, newRow, pkColumnIndicesInSchema);
-            await maintainRowTimeStructures(ctx, tableKey, { op: 'update', oldRow: replacedRow, newRow }, backingConnCache, deferredRebuilds, residualBatch);
+            const newKeyValues = pkColumnIndicesInSchema.map(idx => storedRow[idx]);
+            ctx.db._recordUpdate(tableKey, replacedRow, storedRow, pkColumnIndicesInSchema);
+            await maintainRowTimeStructures(ctx, tableKey, { op: 'update', oldRow: replacedRow, newRow: storedRow }, backingConnCache, deferredRebuilds, residualBatch);
             await executeForeignKeyActionsAndLens(ctx.db, tableSchema, 'delete', replacedRow, undefined, plan.lensRouted);
             if (needsAutoEvents) {
                 const changedColumns = [];
-                for (let i = 0; i < tableSchema.columns.length; i++) {
-                    if (!sqlValueIdentical(replacedRow[i], newRow[i])) {
+                for (let i = 0; i < numCols; i++) {
+                    if (!sqlValueIdentical(replacedRow[i], storedRow[i])) {
                         changedColumns.push(tableSchema.columns[i].name);
                     }
                 }
-                emitAutoDataEvent(ctx, tableSchema, 'update', newKeyValues, [...replacedRow], [...newRow], changedColumns);
+                emitAutoDataEvent(ctx, tableSchema, 'update', newKeyValues, [...replacedRow], [...storedRow], changedColumns);
             }
         }
         else {
-            const pkValues = pkColumnIndicesInSchema.map(idx => newRow[idx]);
-            ctx.db._recordInsert(tableKey, newRow, pkColumnIndicesInSchema);
-            await maintainRowTimeStructures(ctx, tableKey, { op: 'insert', newRow }, backingConnCache, deferredRebuilds, residualBatch);
+            const pkValues = pkColumnIndicesInSchema.map(idx => storedRow[idx]);
+            ctx.db._recordInsert(tableKey, storedRow, pkColumnIndicesInSchema);
+            await maintainRowTimeStructures(ctx, tableKey, { op: 'insert', newRow: storedRow }, backingConnCache, deferredRebuilds, residualBatch);
             if (needsAutoEvents) {
-                emitAutoDataEvent(ctx, tableSchema, 'insert', pkValues, undefined, [...newRow]);
+                emitAutoDataEvent(ctx, tableSchema, 'insert', pkValues, undefined, [...storedRow]);
             }
         }
-        return flatRow;
+        return withStoredNewSection(flatRow, storedRow, newRow, numCols);
     }
     /**
      * Drive the full delete pipeline for every internal REPLACE eviction reported
@@ -731,6 +797,14 @@ export function emitDmlExecutor(plan, ctx) {
         const deferredRebuilds = new Set();
         const residualBatch = new Map();
         const isFailMode = plan.onConflict === ConflictResolution.FAIL;
+        // Batched parent-side RESTRICT enforcement (per-execution state, never on
+        // the emit closure — a re-run prepared statement must start empty). When
+        // the gate admits the statement, the per-row transitive pre-walk is
+        // replaced by key accumulation + one chunked probe per FK at the
+        // end-of-statement boundary. The plan side made the same gate decision
+        // and skipped the per-row NOT EXISTS checks.
+        const batchableFks = getBatchableRestrictFks(ctx.db.schemaManager, tableSchema, 'update', plan.onConflict, plan.lensRouted);
+        const fkRestrictBatch = batchableFks ? createParentRestrictBatch(batchableFks) : undefined;
         // Physical Halloween avoidance: unless the target module guarantees per-scan
         // snapshot isolation, fully drain the source match set (closing the scan
         // cursor) BEFORE applying any write — otherwise the first UPDATE invalidates
@@ -740,7 +814,7 @@ export function emitDmlExecutor(plan, ctx) {
         // the accepted cost of correctness (such a module cannot safely stream-update
         // anyway); memory tables set scanSnapshotIsolation and keep streaming.
         const sourceRows = await resolveDmlSourceRows(ctx, vtab, tableSchema, rows);
-        yield* runWithStatementSavepoints(ctx, vtab, sourceRows, isFailMode, (flatRow) => processUpdateRow(ctx, vtab, needsAutoEvents, flatRow, contextRow, backingConnCache, deferredRebuilds, residualBatch), deferredRebuilds, residualBatch, backingConnCache);
+        yield* runWithStatementSavepoints(ctx, vtab, sourceRows, isFailMode, (flatRow) => processUpdateRow(ctx, vtab, needsAutoEvents, flatRow, contextRow, backingConnCache, deferredRebuilds, residualBatch, fkRestrictBatch), deferredRebuilds, residualBatch, backingConnCache, fkRestrictBatch ? () => flushParentRestrictBatch(ctx.db, tableSchema, 'update', fkRestrictBatch) : undefined);
     }
     /**
      * Performs a single row's UPDATE side-effects (RESTRICT pre-check +
@@ -750,7 +824,7 @@ export function emitDmlExecutor(plan, ctx) {
      * cannot recover from; the caller (runWithStatementSavepoints) translates it
      * for FAIL/ROLLBACK modes.
      */
-    async function processUpdateRow(ctx, vtab, needsAutoEvents, flatRow, contextRow, backingConnCache, deferredRebuilds, residualBatch) {
+    async function processUpdateRow(ctx, vtab, needsAutoEvents, flatRow, contextRow, backingConnCache, deferredRebuilds, residualBatch, fkRestrictBatch) {
         const oldRow = extractOldRowFromFlat(flatRow, tableSchema.columns.length);
         const newRow = extractNewRowFromFlat(flatRow, tableSchema.columns.length);
         const tableKey = `${tableSchema.schemaName}.${tableSchema.name}`;
@@ -766,14 +840,23 @@ export function emitDmlExecutor(plan, ctx) {
         if (vtab.wantStatements) {
             mutationStatement = buildUpdateStatement(tableSchema, newRow, keyValues, contextRow);
         }
-        // Defense-in-depth RESTRICT enforcement: the plan-time `NOT EXISTS`
-        // check is the primary path, but some vtab modules evaluate the
-        // embedded subquery differently from a plain row scan. Pre-walk
-        // the transitive cascade closure so RESTRICTs at any depth fire
-        // BEFORE vtab.update — needed for rowid-mode backends (lamina)
-        // where post-mutation OLD-value scans dereference through the
-        // just-mutated parent and find zero rows.
-        await assertTransitiveRestrictsForParentMutation(ctx.db, tableSchema, 'update', oldRow, newRow, plan.lensRouted);
+        // Parent-side RESTRICT enforcement. Batched statements accumulate the
+        // OLD referenced keys (probed once per FK at the end-of-statement
+        // boundary — same pre-vtab observation point per row, so a row the vtab
+        // later reports not-found contributes identically to the per-row path).
+        // Otherwise: defense-in-depth per-row pre-walk — the plan-time
+        // `NOT EXISTS` check is the primary path, but some vtab modules evaluate
+        // the embedded subquery differently from a plain row scan. Pre-walk the
+        // transitive cascade closure so RESTRICTs at any depth fire BEFORE
+        // vtab.update — needed for rowid-mode backends (lamina) where
+        // post-mutation OLD-value scans dereference through the just-mutated
+        // parent and find zero rows.
+        if (fkRestrictBatch) {
+            accumulateParentRestrictKeys(fkRestrictBatch, 'update', oldRow, newRow);
+        }
+        else {
+            await assertTransitiveRestrictsForParentMutation(ctx.db, tableSchema, 'update', oldRow, newRow, plan.lensRouted);
+        }
         const args = {
             operation: 'update',
             values: newRow,
@@ -782,6 +865,10 @@ export function emitDmlExecutor(plan, ctx) {
             // can fall back to per-constraint defaultConflict directives. The memory
             // module treats undefined as ABORT when no constraint default is set.
             onConflict: plan.onConflict,
+            // emitUpdate converted the NEW section to declared types (assigned
+            // columns by static type, unassigned columns are stored values) — the
+            // storage layer must not convert again.
+            preCoerced: true,
             mutationStatement
         };
         const result = await vtab.update(args);
@@ -793,6 +880,11 @@ export function emitDmlExecutor(plan, ctx) {
         if (!result.row) {
             return undefined;
         }
+        // Post-write bookkeeping and the RETURNING row must see the row the
+        // substrate STORED, not the raw input — see storedRowOrRaw. `oldRow` came
+        // from the source scan, so it is already a stored (coerced) row.
+        const numCols = tableSchema.columns.length;
+        const storedRow = storedRowOrRaw(result.row, newRow, numCols);
         // If the UPDATE moved this row onto an occupied PK under REPLACE,
         // the vtab returns the displaced row. Surface its deletion BEFORE
         // the move bookkeeping so change tracking, FK cascade, and auto-events
@@ -817,24 +909,24 @@ export function emitDmlExecutor(plan, ctx) {
         await processEvictions(ctx, needsAutoEvents, tableKey, result.evictedRows, backingConnCache, deferredRebuilds, residualBatch);
         // Track change (UPDATE): pass full rows so the change capture can
         // project the columns any active subscription cares about.
-        ctx.db._recordUpdate(tableKey, oldRow, newRow, pkColumnIndicesInSchema);
-        await maintainRowTimeStructures(ctx, tableKey, { op: 'update', oldRow, newRow }, backingConnCache, deferredRebuilds, residualBatch);
+        ctx.db._recordUpdate(tableKey, oldRow, storedRow, pkColumnIndicesInSchema);
+        await maintainRowTimeStructures(ctx, tableKey, { op: 'update', oldRow, newRow: storedRow }, backingConnCache, deferredRebuilds, residualBatch);
         // Execute FK cascading actions (CASCADE, SET NULL, SET DEFAULT)
-        await executeForeignKeyActionsAndLens(ctx.db, tableSchema, 'update', oldRow, newRow, plan.lensRouted);
+        await executeForeignKeyActionsAndLens(ctx.db, tableSchema, 'update', oldRow, storedRow, plan.lensRouted);
         // Emit auto event for modules without native event support
         if (needsAutoEvents) {
             // Compute changed columns
             const changedColumns = [];
-            for (let i = 0; i < tableSchema.columns.length; i++) {
+            for (let i = 0; i < numCols; i++) {
                 const oldVal = oldRow[i];
-                const newVal = newRow[i];
+                const newVal = storedRow[i];
                 if (!sqlValueIdentical(oldVal, newVal)) {
                     changedColumns.push(tableSchema.columns[i].name);
                 }
             }
-            emitAutoDataEvent(ctx, tableSchema, 'update', keyValues, [...oldRow], [...newRow], changedColumns);
+            emitAutoDataEvent(ctx, tableSchema, 'update', keyValues, [...oldRow], [...storedRow], changedColumns);
         }
-        return flatRow;
+        return withStoredNewSection(flatRow, storedRow, newRow, numCols);
     }
     // DELETE ----------------------------------------------------
     async function* runDelete(ctx, rows, ...contextEvaluators) {
@@ -849,12 +941,17 @@ export function emitDmlExecutor(plan, ctx) {
         const deferredRebuilds = new Set();
         const residualBatch = new Map();
         const isFailMode = plan.onConflict === ConflictResolution.FAIL;
+        // Batched parent-side RESTRICT enforcement — see the matching note in
+        // runUpdate (per-execution state; one chunked probe per FK at the
+        // end-of-statement boundary when the gate admits the statement).
+        const batchableFks = getBatchableRestrictFks(ctx.db.schemaManager, tableSchema, 'delete', plan.onConflict, plan.lensRouted);
+        const fkRestrictBatch = batchableFks ? createParentRestrictBatch(batchableFks) : undefined;
         // Physical Halloween avoidance — see the matching note in runUpdate. Unless
         // the target module guarantees per-scan snapshot isolation, drain the source
         // match set (closing the scan cursor) before applying any DELETE, so the
         // first delete cannot invalidate the cursor path the scan is still walking.
         const sourceRows = await resolveDmlSourceRows(ctx, vtab, tableSchema, rows);
-        yield* runWithStatementSavepoints(ctx, vtab, sourceRows, isFailMode, (flatRow) => processDeleteRow(ctx, vtab, needsAutoEvents, flatRow, contextRow, backingConnCache, deferredRebuilds, residualBatch), deferredRebuilds, residualBatch, backingConnCache);
+        yield* runWithStatementSavepoints(ctx, vtab, sourceRows, isFailMode, (flatRow) => processDeleteRow(ctx, vtab, needsAutoEvents, flatRow, contextRow, backingConnCache, deferredRebuilds, residualBatch, fkRestrictBatch), deferredRebuilds, residualBatch, backingConnCache, fkRestrictBatch ? () => flushParentRestrictBatch(ctx.db, tableSchema, 'delete', fkRestrictBatch) : undefined);
     }
     /**
      * Performs a single row's DELETE side-effects (RESTRICT pre-check +
@@ -864,7 +961,7 @@ export function emitDmlExecutor(plan, ctx) {
      * (runWithStatementSavepoints) translates constraint violations for
      * FAIL/ROLLBACK modes.
      */
-    async function processDeleteRow(ctx, vtab, needsAutoEvents, flatRow, contextRow, backingConnCache, deferredRebuilds, residualBatch) {
+    async function processDeleteRow(ctx, vtab, needsAutoEvents, flatRow, contextRow, backingConnCache, deferredRebuilds, residualBatch, fkRestrictBatch) {
         const oldRow = extractOldRowFromFlat(flatRow, tableSchema.columns.length);
         const tableKey = `${tableSchema.schemaName}.${tableSchema.name}`;
         const keyValues = pkColumnIndicesInSchema.map(pkColIdx => {
@@ -878,14 +975,21 @@ export function emitDmlExecutor(plan, ctx) {
         if (vtab.wantStatements) {
             mutationStatement = buildDeleteStatement(tableSchema, keyValues, contextRow);
         }
-        // Defense-in-depth RESTRICT enforcement — see comment on the UPDATE
-        // path above.
-        await assertTransitiveRestrictsForParentMutation(ctx.db, tableSchema, 'delete', oldRow, undefined, plan.lensRouted);
+        // Parent-side RESTRICT enforcement: batched key accumulation, or the
+        // per-row defense-in-depth pre-walk — see comment on the UPDATE path above.
+        if (fkRestrictBatch) {
+            accumulateParentRestrictKeys(fkRestrictBatch, 'delete', oldRow);
+        }
+        else {
+            await assertTransitiveRestrictsForParentMutation(ctx.db, tableSchema, 'delete', oldRow, undefined, plan.lensRouted);
+        }
         const args = {
             operation: 'delete',
             values: undefined,
             oldKeyValues: keyValues,
             onConflict: plan.onConflict ?? ConflictResolution.ABORT,
+            // The key cells come from the scanned OLD row — already stored form.
+            preCoerced: true,
             mutationStatement
         };
         const result = await vtab.update(args);