@rvoh/dream 2.30.1 → 2.32.0

package/dist/esm/src/decorators/field/sortable/Sortable.js

@@ -1,36 +1,9 @@
 import scopeArray from './helpers/scopeArray.js';
 /**
- * Marks an integer column as a sortable position: Dream keeps the positions of
- * every record in a sort scope contiguous, starting at 1, as records are
- * created, moved, destroyed and undestroyed.
- *
- * ```ts
- * class Post extends ApplicationModel {
- *   @deco.Sortable({ scope: 'user' })
- *   public position: number
- * }
- *
- * await post.update({ position: 2 }) // the records at 2 and above shift up
- * ```
- *
- * A position past the end of the scope is clamped to the end, and a position
- * below 1 — or none at all — lands the record at the end.
- *
- * **A save that changes the sort scope ignores a position given alongside it.**
- * The record lands at the end of the scope it moves into, whatever position the
- * same `update` supplied:
- *
- * ```ts
- * await post.update({ user: otherUser, position: 1 })
- * // post is now the last record in otherUser's scope, not the first
- * ```
- *
- * Move it in two saves to place it: `await post.update({ user: otherUser })`,
- * then `await post.update({ position: 1 })`.
- *
- * Sortable requires a query driver that supports advisory transaction locks —
- * the `PostgresQueryDriver` does — since every position write serializes the
- * writers of its sort scope on one.
+ * The implementation behind `@deco.Sortable`. The decorator's semantics —
+ * position clamping, what a scope-changing save does with a position given
+ * alongside it, and the advisory-lock concurrency protocol — are documented on
+ * `Decorators#Sortable`, which is where a consumer reads them.
  */
 export default function Sortable(opts = {}) {
     return function (_, context) {

package/dist/esm/src/decorators/field/sortable/helpers/cascadeReachesEveryRowInSortScope.js

@@ -0,0 +1,51 @@
+import { SOFT_DELETE_SCOPE_NAME } from '../../../class/SoftDelete.js';
+import sortableScopeColumns from './sortableScopeColumns.js';
+/**
+ * @internal
+ *
+ * Whether a cascade reaching this record through `edge` reaches, and so
+ * destroys, every live row of the sortable field's sort scope. Such a scope is
+ * left with no survivor, so
+ * the compaction a destroy performs would close a vacancy nothing can observe,
+ * and the cascade skips it along with the snapshot read it needs. Every clause
+ * fails closed: a shape not positively recognized here compacts as a direct
+ * destroy does, unlocked, which costs statements and never a lock.
+ *
+ * The edge is the `dependent: 'destroy'` association the cascade destroyed
+ * through, the only kind the caller passes, and the answer is about that edge
+ * alone: another dependent edge of the same owner may reach the rows this one
+ * does not, and this fails closed rather than look for it.
+ *
+ * 1. The edge is a `HasMany`. A `HasOne` reaches one row of a scope that may
+ *    hold others.
+ * 2. The edge is not polymorphic, is not a `through` association, and carries
+ *    no `and`, `andNot`, `andAny`, `selfAnd` or `selfAndNot`. Each of those
+ *    reaches a subset of the rows sharing the foreign key, and the rest can
+ *    stay live: a soft-deleted owner's row remains, so no foreign key forces
+ *    them out, and they keep their positions in a scope the cascade did not
+ *    empty. (A hard destroy under a database foreign key would have refused to
+ *    leave them, and compacting there is the harmless direction to be wrong in.)
+ * 3. The target is not an STI child, whose rows share a sort scope with its
+ *    siblings' rows.
+ * 4. The target declares no default scope other than SoftDelete, since any
+ *    other hides rows from the cascade's own load. A soft-deleted row holds no
+ *    position and so is in no sort scope to begin with.
+ * 5. The edge's foreign key is one of the field's scope columns: every row the
+ *    cascade destroys carries the owner's key, and so does every row of any sort
+ *    scope that includes that column. Further scope members only partition that
+ *    same set.
+ */
+export default function cascadeReachesEveryRowInSortScope(dream, config, edge) {
+    if (edge.type !== 'HasMany')
+        return false;
+    if (edge.polymorphic || edge.through)
+        return false;
+    if (edge.and || edge.andNot || edge.andAny || edge.selfAnd || edge.selfAndNot)
+        return false;
+    const dreamClass = dream.constructor;
+    if (dreamClass['isSTIChild'])
+        return false;
+    if (!dreamClass['scopes'].default.every(scope => scope.method === SOFT_DELETE_SCOPE_NAME))
+        return false;
+    return sortableScopeColumns(dream, config.scope).includes(edge.foreignKey());
+}

package/dist/esm/src/decorators/field/sortable/helpers/performSortableDestroyWork.js

@@ -10,10 +10,13 @@ import afterSortableDestroy from '../hooks/afterSortableDestroy.js';
  * `afterDestroy` hook — never registered as a hook among them — so every
  * after-destroy hook observes the compacted scope regardless of where it was
  * declared, exactly as every after-save hook observes the computed position.
+ *
+ * @param sortableFields - the fields the preparation phase read a snapshot for,
+ *   which on a cascaded destroy excludes every field whose whole sort scope the
+ *   cascade is destroying
  */
-export default async function performSortableDestroyWork(dream, txn) {
+export default async function performSortableDestroyWork(dream, txn, sortableFields) {
     const dreamClass = dream.constructor;
-    const sortableFields = dreamClass['sortableFields'];
     for (const { positionField, scope } of sortableFields) {
         const query = dreamClass.query().removeDefaultScope(STI_SCOPE_NAME).txn(txn);
         await afterSortableDestroy({ dream, positionField, query, scope, txn });

package/dist/esm/src/decorators/field/sortable/helpers/prepareSortableFieldsForDestroy.js

@@ -1,40 +1,54 @@
 import acquireStabilizedSortableScopeLocks from './acquireStabilizedSortableScopeLocks.js';
+import cascadeReachesEveryRowInSortScope from './cascadeReachesEveryRowInSortScope.js';
 import clearCachedSortableValues from './clearCachedSortableValues.js';
-import { cacheSortableSnapshots, clearSortableSnapshot } from './sortableSnapshot.js';
+import { cacheSortableSnapshots, clearSortableSnapshot, readSortableSnapshots } from './sortableSnapshot.js';
 /**
  * @internal
  *
  * The sortable preparation phase of a destroy. Called from `destroyDream` after
  * every user `beforeDestroy` hook has run and before the delete — a phase, not
- * a hook among them — so the operation's whole advisory key set, across every
- * sortable field, is taken in one sorted stabilized acquisition, with one
- * snapshot SELECT covering all fields. Per-field acquisition would take
- * multi-field keys in declaration order, which deadlocks against the paths
- * that acquire sorted.
+ * a hook among them — so the row's real position and scope values are read in
+ * one snapshot SELECT covering every field while the row still exists.
+ * Pre-delete is the only seat for that read: on a hard destroy the row is gone
+ * afterwards, and a soft destroy nulls the position columns in the same UPDATE
+ * as `deletedAt`. The per-field compactions (`performSortableDestroyWork`)
+ * consume the cached snapshots.
  *
- * Pre-delete is the only seat available for the snapshot read: on a hard
- * destroy the row is gone afterwards, and a soft destroy nulls the position
- * columns in the same UPDATE as `deletedAt`. The lock is taken around the read
- * so the snapshot cannot be invalidated between the read and the compaction;
- * it is transaction-scoped, and `destroyDream` opens a transaction that spans
- * the delete and the after-destroy hooks, so one acquisition covers both.
+ * A direct destroy takes the operation's whole advisory key set — every
+ * sortable field — in one sorted stabilized acquisition around that read, so
+ * the snapshot cannot be invalidated before the compaction; per-field
+ * acquisition would take multi-field keys in declaration order and deadlock
+ * against the paths that acquire sorted. The lock is transaction-scoped, and
+ * `destroyDream` opens a transaction spanning the delete and the after-destroy
+ * hooks, so one acquisition covers both.
  *
- * The per-field compactions (`performSortableDestroyWork`) consume the cached
- * snapshots.
- *
- * @returns false when the snapshot read found no row — this destroy has nothing
- *   to vacate, and compacting from the instance's remembered position would
- *   shift a scope some other writer has already closed. The delete's own
- *   affected-row count is the stronger signal (a writer outside the sortable
- *   path can remove the row after this read), so the caller checks both.
+ * A cascaded destroy — one reached through a `dependent: 'destroy'` association,
+ * which passes the edge it arrived by — takes no scope lock: a cascade would
+ * otherwise hold one per distinct sort scope it touches until the root
+ * transaction commits. It reads the same snapshot unlocked and compacts from
+ * it, and skips both for a field whose whole sort scope the cascade is
+ * destroying, since nothing survives there to observe a compaction.
  */
-export default async function prepareSortableFieldsForDestroy(dream, txn) {
-    const sortableFields = dream.constructor['sortableFields'];
+export default async function prepareSortableFieldsForDestroy(dream, txn, cascadeEdge) {
+    const allSortableFields = dream.constructor['sortableFields'];
+    const sortableFields = cascadeEdge
+        ? allSortableFields.filter(config => !cascadeReachesEveryRowInSortScope(dream, config, cascadeEdge))
+        : allSortableFields;
     if (!sortableFields.length)
-        return true;
-    const { rowExists, snapshots } = await acquireStabilizedSortableScopeLocks(dream, txn, sortableFields);
+        return { rowExists: true, sortableFields };
+    // A field the predicate does not exempt is compacted *unlocked* on a cascade,
+    // by design: the predicate decides only what work is skipped, never whether a
+    // lock is taken. Falling back to the lock for such a field would reintroduce
+    // a lock count set by the data — one per distinct surviving scope, held to
+    // the root COMMIT, drawn from the cluster-wide lock table — with no way for
+    // the application to avoid it. The concurrent-writer races the missing lock
+    // exposes are accepted and documented on `@deco.Sortable`, and are what
+    // `withConcurrentWriterRetry` exists for.
+    const { rowExists, snapshots } = cascadeEdge
+        ? await readSortableSnapshots(dream, txn, sortableFields)
+        : await acquireStabilizedSortableScopeLocks(dream, txn, sortableFields);
     cacheSortableSnapshots(dream, snapshots);
-    return rowExists;
+    return { rowExists, sortableFields };
 }
 /**
  * @internal

package/dist/esm/src/decorators/field/sortable/helpers/sortableCascadeEdge.js

@@ -0,0 +1,32 @@
+/**
+ * A symbol-keyed assignment, like the `CASCADE_LOADED` marker in
+ * `destroyAssociatedRecords`: excluded from `Object.keys`, `for...in` and
+ * `JSON.stringify` without a descriptor, and cheap on a wide cascade tree.
+ */
+const SORTABLE_CASCADE_EDGE = Symbol.for('dream:sortableCascadeEdge');
+/**
+ * @internal
+ *
+ * Marks a record a `dependent: 'destroy'` cascade is about to destroy or
+ * undestroy, with the association the cascade reached it through. The record's
+ * own destroy or undestroy consumes the mark and does its sortable work without
+ * the scope lock a direct operation takes.
+ */
+export function markSortableCascadeEdge(dream, association) {
+    ;
+    dream[SORTABLE_CASCADE_EDGE] = association;
+}
+/**
+ * @internal
+ *
+ * The association a cascade reached this record through, or null on a direct
+ * destroy or undestroy. Consuming removes the mark, so a later direct operation
+ * on the same instance cannot inherit a cascade's optimism.
+ */
+export function consumeSortableCascadeEdge(dream) {
+    const association = dream[SORTABLE_CASCADE_EDGE];
+    if (association === undefined)
+        return null;
+    delete dream[SORTABLE_CASCADE_EDGE];
+    return association;
+}

package/dist/esm/src/dream/Query.js

@@ -1914,13 +1914,15 @@ export default class Query {
      *   {@link Query.delete | delete} (a single statement, no hooks or cascade)
      *   are the right tools for bulk removal.
      *
+     * To bypass a default scope, chain `removeDefaultScope` onto the Query
+     * before calling this method; it is Query state, not an option, and it
+     * carries through to the cascade.
+     *
      * @param options - Options for destroying the instance
      * @param options.skipHooks - If true, skips applying model hooks during the destroy operation. Defaults to false
      * @param options.cascade - If false, skips destroying associations marked `dependent: 'destroy'`. Defaults to true
      * @param options.lock - If true, each batch is re-selected with an exclusive row lock inside its own transaction before being destroyed, making the destroy a compare-and-set. Defaults to false
      * @param options.batchSize - The number of records to process per batch. Must be a positive integer. Defaults to 10 when `lock` is true, and to 1000 otherwise
-     * @param options.bypassAllDefaultScopes - If true, bypasses user-removable default scopes when cascade destroying; an STI child's reserved discriminator remains enforced, including when associations are loaded. Defaults to false
-     * @param options.defaultScopesToBypass - An array of default scope names to bypass when cascade destroying. Defaults to an empty array
      * @returns The number of records that were removed
      * @throws InvalidBatchSize if `batchSize` is not a positive integer
      * @throws BatchingIncompatibleWithLimitOrOffset if the query carries a `limit` or `offset`
@@ -2034,11 +2036,12 @@ export default class Query {
      *   transaction ends, so every batch's scope keys are still held when the
      *   next one preflights. That accumulation is bounded — the preflight counts
      *   the keys the transaction already holds along with the ones the batch
-     *   would add, and refuses with `SortableBatchRequiresTooManyScopeLocks`
-     *   rather than letting a long run over a high-cardinality sort scope exhaust
-     *   `max_locks_per_transaction` for the whole cluster — so a run long enough
-     *   raises instead of completing. Letting Dream open a transaction per batch
-     *   releases the keys as it goes and gives each batch the whole budget.
+     *   would add, and raises rather than letting a long run over a
+     *   high-cardinality sort scope exhaust `max_locks_per_transaction` for the
+     *   whole cluster — so a run long enough raises instead of completing. That
+     *   refusal is a sizing failure to fix, not a condition to catch: letting
+     *   Dream open a transaction per batch releases the keys as it goes and gives
+     *   each batch the whole budget, and a smaller `batchSize` takes fewer.
      * - the preflight covers **the claimed rows' own scopes only**. A
      *   `dependent: 'destroy'` cascade under `destroy({ lock: true })` destroys
      *   child records of other tables, and a sortable child takes its own table's
@@ -2116,8 +2119,18 @@ export default class Query {
     }
     /**
      * Destroys all records matching the Query,
-     * ignoring the SoftDelete decorator and
-     * permanently removing records from the database.
+     * permanently removing each matched record from
+     * the database instead of soft deleting it.
+     *
+     * The SoftDelete decorator is bypassed when
+     * deleting each matched record, not when
+     * matching: the Query selects under its default
+     * scopes, `dream:SoftDelete` among them, so on a
+     * SoftDelete model it matches only records that
+     * have not already been soft deleted. Reaching
+     * soft deleted records takes
+     * `removeDefaultScope('dream:SoftDelete')` on
+     * the Query.
      *
      * Calls model hooks and applies cascade destroy
      * to associations with `dependent: 'destroy'`,
@@ -2132,17 +2145,26 @@ export default class Query {
      * // 12
      * ```
      *
+     * ```ts
+     * await User.removeDefaultScope('dream:SoftDelete')
+     *   .where({ email: ops.ilike('%burpcollaborator%') })
+     *   .reallyDestroy()
+     * // 12
+     * ```
+     *
      * A `limit` or `offset` on the Query is incompatible with `reallyDestroy`,
      * exactly as it is with {@link Query.destroy}: a limit- or offset-carrying
      * Query throws at runtime.
      *
+     * To bypass a default scope, chain `removeDefaultScope` onto the Query
+     * before calling this method; it is Query state, not an option, and it
+     * carries through to the cascade.
+     *
      * @param options - Options for destroying the instance
      * @param options.skipHooks - If true, skips applying model hooks during the destroy operation. Defaults to false
      * @param options.cascade - If false, skips destroying associations marked `dependent: 'destroy'`. Defaults to true
      * @param options.lock - If true, each batch is re-selected with an exclusive row lock inside its own transaction before being destroyed, making the destroy a compare-and-set. See {@link Query.destroy} for the full semantics. Defaults to false
      * @param options.batchSize - The number of records to process per batch. Must be a positive integer. Defaults to 10 when `lock` is true, and to 1000 otherwise
-     * @param options.bypassAllDefaultScopes - If true, bypasses user-removable default scopes when cascade destroying; an STI child's reserved discriminator remains enforced, including when associations are loaded. Defaults to false
-     * @param options.defaultScopesToBypass - An array of default scope names to bypass when cascade destroying. Defaults to an empty array
      * @returns The number of records that were removed
      * @throws InvalidBatchSize if `batchSize` is not a positive integer
      * @throws BatchingIncompatibleWithLimitOrOffset if the query carries a `limit` or `offset`
@@ -2168,11 +2190,13 @@ export default class Query {
      * re-applied to every window — so a limit- or offset-carrying Query throws
      * at runtime.
      *
+     * To bypass a default scope, chain `removeDefaultScope` onto the Query
+     * before calling this method; it is Query state, not an option, and it
+     * carries through to the cascade. The SoftDelete scope is always bypassed.
+     *
      * @param options - Options for undestroying the instance
      * @param options.skipHooks - If true, skips applying model hooks during the undestroy operation. Defaults to false
      * @param options.cascade - If false, skips undestroying associations marked `dependent: 'destroy'`. Defaults to true
-     * @param options.bypassAllDefaultScopes - If true, bypasses user-removable default scopes when cascade undestroying; an STI child's reserved discriminator remains enforced, including when associations are loaded. Defaults to false
-     * @param options.defaultScopesToBypass - An array of default scope names to bypass when cascade undestroying (soft delete is always bypassed). Defaults to an empty array
      * @returns The number of records that were removed
      * @throws BatchingIncompatibleWithLimitOrOffset if the query carries a `limit` or `offset`
      */

package/dist/esm/src/dream/QueryDriver/Base.js

@@ -214,6 +214,32 @@ export default class QueryDriverBase {
      * than silently racing on position values.
      */
     static supportsAdvisoryTransactionLocks = false;
+    /**
+     * @internal
+     *
+     * Whether `error` is the database refusing a write for violating a unique
+     * constraint. `withConcurrentWriterRetry` asks this of an error raised at
+     * COMMIT, which is where a `DEFERRABLE INITIALLY DEFERRED` constraint — the
+     * one `DreamMigrationHelpers.addDeferrableUniqueConstraint` declares — reports
+     * a collision. A driver that does not recognize one reports false, and nothing
+     * is retried.
+     */
+    // eslint-disable-next-line @typescript-eslint/no-unused-vars
+    static isUniqueConstraintViolation(error) {
+        return false;
+    }
+    /**
+     * @internal
+     *
+     * Whether `error` is the database aborting a transaction to break a deadlock
+     * with another. `withConcurrentWriterRetry` reruns a transaction of Dream's
+     * own that was aborted this way. A driver that does not recognize one reports
+     * false, and nothing is retried.
+     */
+    // eslint-disable-next-line @typescript-eslint/no-unused-vars
+    static isDeadlock(error) {
+        return false;
+    }
     /**
      * @internal
      *

package/dist/esm/src/dream/QueryDriver/Kysely.js

@@ -7,7 +7,7 @@
 // eslint-disable-next-line @typescript-eslint/ban-ts-comment
 // @ts-ignore
 import pg from 'pg';
-import { PostgresDialect, sql, } from 'kysely';
+import { NoResultError, PostgresDialect, sql, } from 'kysely';
 import pluralize from 'pluralize-esm';
 import { CliFileWriter } from '../../cli/CliFileWriter.js';
 import DreamCLI from '../../cli/index.js';
@@ -30,6 +30,7 @@ import MissingThroughAssociationSource from '../../errors/associations/MissingTh
 import CannotNegateSimilarityClause from '../../errors/CannotNegateSimilarityClause.js';
 import CannotNamespaceAssociationFilterToAnotherTable from '../../errors/CannotNamespaceAssociationFilterToAnotherTable.js';
 import CannotPassUndefinedAsAValueToAWhereClause from '../../errors/CannotPassUndefinedAsAValueToAWhereClause.js';
+import CannotSaveMissingDream from '../../errors/CannotSaveMissingDream.js';
 import ArrayEqualityRequiresArrayColumn from '../../errors/ops/ArrayEqualityRequiresArrayColumn.js';
 import RowLockIncompatibleWithDistinct from '../../errors/RowLockIncompatibleWithDistinct.js';
 import RowLockIncompatibleWithJoinLoad from '../../errors/RowLockIncompatibleWithJoinLoad.js';
@@ -806,6 +807,8 @@ export default class KyselyQueryDriver extends QueryDriverBase {
             }
         }
         catch (error) {
+            if (dream.isPersisted && error instanceof NoResultError)
+                throw new CannotSaveMissingDream(dream);
             switch (pgErrorType(error)) {
                 case COLUMN_OVERFLOW:
                     throw new ColumnOverflow(error instanceof Error ? error : new Error('database column overflow'));

package/dist/esm/src/dream/QueryDriver/Postgres.js

@@ -10,7 +10,7 @@ import pg from 'pg';
 import { sql } from 'kysely';
 import DreamCLI from '../../cli/index.js';
 import { isPrimitiveDataType } from '../../db/dataTypes.js';
-import { LOCK_NOT_AVAILABLE, pgErrorType } from '../../db/errors.js';
+import { DEADLOCK_DETECTED, LOCK_NOT_AVAILABLE, pgErrorType, UNIQUE_VIOLATION } from '../../db/errors.js';
 import DreamApp from '../../dream-app/index.js';
 import SortableScopeLockWaitTimedOut from '../../errors/SortableScopeLockWaitTimedOut.js';
 import camelize from '../../helpers/camelize.js';
@@ -222,6 +222,12 @@ export default class PostgresQueryDriver extends KyselyQueryDriver {
         return kyselyQuery.forUpdate(tableAlias);
     }
     static supportsAdvisoryTransactionLocks = true;
+    static isUniqueConstraintViolation(error) {
+        return pgErrorType(error) === UNIQUE_VIOLATION;
+    }
+    static isDeadlock(error) {
+        return pgErrorType(error) === DEADLOCK_DETECTED;
+    }
     /**
      * @internal
      *

package/dist/esm/src/dream/internal/destroyAssociatedRecords.js

@@ -1,3 +1,4 @@
+import { markSortableCascadeEdge, } from '../../decorators/field/sortable/helpers/sortableCascadeEdge.js';
 import loadDependentDestroyTree from './loadDependentDestroyTree.js';
 /**
  * @internal
@@ -51,6 +52,7 @@ export default async function destroyAssociatedRecords(dream, txn, options) {
     // each association in the loop below would trigger its own reload.
     let dreamWithAssociations = dream;
     let alreadyLoadedTree = false;
+    const associationMetadataMap = dreamClass['associationMetadataMap']();
     for (const associationName of dreamClass['dependentDestroyAssociationNames']()) {
         if (!alreadyLoadedTree && !cascadeLoaded(dreamWithAssociations, associationName)) {
             dreamWithAssociations = await loadDependentDestroyTree(dreamWithAssociations, txn, {
@@ -62,8 +64,13 @@ export default async function destroyAssociatedRecords(dream, txn, options) {
         }
         const loaded = dreamWithAssociations[associationName];
         const records = Array.isArray(loaded) ? loaded : loaded ? [loaded] : [];
+        const association = associationMetadataMap[associationName];
         for (const record of records) {
             markCascadeLoaded(record);
+            // a cascaded destroy does its sortable work without the scope lock, and
+            // which edge reached the record decides what it compacts
+            if (association)
+                markSortableCascadeEdge(record, association);
             if (reallyDestroy) {
                 await record.txn(txn).reallyDestroy(options);
             }

package/dist/esm/src/dream/internal/destroyDream.js

@@ -1,14 +1,18 @@
 import performSortableDestroyWork from '../../decorators/field/sortable/helpers/performSortableDestroyWork.js';
 import prepareSortableFieldsForDestroy, { clearSortableFieldsForDestroy, } from '../../decorators/field/sortable/helpers/prepareSortableFieldsForDestroy.js';
+import { consumeSortableCascadeEdge } from '../../decorators/field/sortable/helpers/sortableCascadeEdge.js';
 import DreamApp from '../../dream-app/index.js';
 import destroyAssociatedRecords from './destroyAssociatedRecords.js';
 import runHooksFor from './runHooksFor.js';
+import withConcurrentWriterRetry from './withConcurrentWriterRetry.js';
 /**
  * @internal
  *
  * Destroys the Dream and any `dependent: 'destroy'` associations
  * within a transaction. If a transaction is passed, it will be used.
- * Otherwise, a new transaction will be created automatically.
+ * Otherwise, a new transaction will be created automatically, and the
+ * whole destroy is run again if that transaction is undone by a concurrent
+ * writer (see `withConcurrentWriterRetry`).
  * If any of the nested associations fails to destroy, then this
  * record will also fail to destroy. If skipHooks is true, model hooks
  * will be bypassed.
@@ -19,7 +23,7 @@ export default async function destroyDream(dream, txn = null, options) {
     }
     else {
         const dreamClass = dream.constructor;
-        return await dreamClass.transaction(async (txn) => await destroyDreamWithTransaction(dream, txn, options));
+        return await withConcurrentWriterRetry(dreamClass, async (txn) => await destroyDreamWithTransaction(dream, txn, options));
     }
 }
 /**
@@ -31,6 +35,10 @@ export default async function destroyDream(dream, txn = null, options) {
  */
 async function destroyDreamWithTransaction(dream, txn, options) {
     const { cascade, reallyDestroy, skipHooks } = options;
+    // The association a `dependent: 'destroy'` cascade reached this record
+    // through, or null on a direct destroy. Consumed first, before a hook or the
+    // cascade below can re-enter this function for the same instance.
+    const cascadeEdge = consumeSortableCascadeEdge(dream);
     if (!skipHooks)
         await runHooksFor('beforeDestroy', dream, true, null, txn);
     // `preventDeletion` is fail-closed: a veto returns before the
@@ -51,19 +59,22 @@ async function destroyDreamWithTransaction(dream, txn, options) {
         await destroyAssociatedRecords(dream, txn, options);
     }
     // Sortable preparation runs as a phase after every user beforeDestroy hook,
-    // never as a hook among them: the destroy's whole advisory key set — every
-    // sortable field — is acquired in one sorted pass, and the row's real
-    // position and scope values are read in one snapshot SELECT while the row
-    // still exists. It sits after the cascade so this destroy does not hold the
-    // scope lock across every descendant's destroy — true of the destroy itself,
-    // not of the transaction it runs in: under `Query#destroy({ lock: true })`
-    // the batch's whole key set is already held, taken before any row was
-    // claimed. A destroy that skips hooks performs no compaction, and one a
-    // cascaded descendant's hook has vetoed will not delete, so neither needs
-    // locks or a snapshot.
+    // never as a hook among them: the row's real position and scope values are
+    // read in one snapshot SELECT while the row still exists, under the
+    // destroy's whole advisory key set on a direct destroy and under no scope
+    // lock on a cascaded one. It sits after the cascade so a direct destroy does
+    // not hold its scope locks across every descendant's destroy — true of the
+    // destroy itself, not of the transaction it runs in: under
+    // `Query#destroy({ lock: true })` the batch's whole key set is already held,
+    // taken before any row was claimed. A destroy that skips hooks performs no
+    // compaction, and one a cascaded descendant's hook has vetoed will not
+    // delete, so neither needs locks or a snapshot.
     let rowFoundBeforeDelete = true;
+    let compactedSortableFields = [];
     if (!skipHooks && !dream['_preventDeletion']) {
-        rowFoundBeforeDelete = await prepareSortableFieldsForDestroy(dream, txn);
+        const preparation = await prepareSortableFieldsForDestroy(dream, txn, cascadeEdge);
+        rowFoundBeforeDelete = preparation.rowExists;
+        compactedSortableFields = preparation.sortableFields;
     }
     const rowsRemoved = await maybeDestroyDream(dream, txn, reallyDestroy);
     // `preventDeletion` can still arrive after the veto check above has passed:
@@ -95,7 +106,7 @@ async function destroyDreamWithTransaction(dream, txn, options) {
         // among them, so every user afterDestroy hook observes the compacted scope
         // regardless of where it was declared — the destroy-side counterpart of
         // performSortablePositionWork running before the after-save hooks.
-        await performSortableDestroyWork(dream, txn);
+        await performSortableDestroyWork(dream, txn, compactedSortableFields);
         await runHooksFor('afterDestroy', dream, true, null, txn);
         await runHooksFor('afterDestroyCommit', dream, true, null, txn);
     }

package/dist/esm/src/dream/internal/saveDream.js

@@ -3,6 +3,7 @@ import { clearSortableSaveState } from '../../decorators/field/sortable/helpers/
 import performSortablePositionWork from '../../decorators/field/sortable/helpers/performSortablePositionWork.js';
 import prepareSortableFieldsForSave from '../../decorators/field/sortable/helpers/prepareSortableFieldsForSave.js';
 import { cacheSortableSnapshots } from '../../decorators/field/sortable/helpers/sortableSnapshot.js';
+import CannotSaveMissingDream from '../../errors/CannotSaveMissingDream.js';
 import ValidationError from '../../errors/ValidationError.js';
 import sqlAttributes from '../../helpers/sqlAttributes.js';
 import { DateTime } from '../../utils/datetime/DateTime.js';
@@ -114,6 +115,14 @@ async function writeDream(dream, txn, { alreadyPersisted, sortableFieldConfigs,
         dream.createdAt = now;
     if (!dream.dirtyAttributes().updatedAt && dream.columns().has('updatedAt'))
         dream.updatedAt = now;
+    // The scope-lock read above positively found the row gone, so there is
+    // nothing to update. Raised here rather than after the write because the
+    // write below would not reach the database at all on a position-only save,
+    // whose attributes Sortable has already cleared; a save that does carry data
+    // raises the equivalent diagnostic from the driver, which sees the update
+    // match no row.
+    if (alreadyPersisted && !rowFoundBeforeWrite)
+        throw new CannotSaveMissingDream(dream);
     const hasUnsavedData = !!Object.keys(sqlAttributes(dream)).length;
     // BeforeSave/Update actions may clear all the data that we intended to save, leaving us with
     // an invalid update command. The Sortable decorator is an example of this.