@simtlix/simfinity-core 3.12.0 → 3.14.0

package/src/runtime.js

@@ -13,14 +13,16 @@ import SimfinityError from './errors/simfinity.error.js';
 import InternalServerError from './errors/internal-server.error.js';
 import { ForbiddenError } from './auth/errors.js';
 import QLOperator from './const/QLOperator.js';
+import QLQuantifier, { QUANTIFIED_LISTS } from './const/QLQuantifier.js';
+import { aggregateJoinPrefixes, assertSortSyntax, frameUnits, validateQuantifiedGroups } from './query-frames.js';
 import QLValue from './const/QLValue.js';
 import QLSort from './const/QLSort.js';
 import {
-  collectQueryOperators, collectQueryPathEntries, collectQueryPaths, walkQueryPath,
+  collectQueryOperators, collectQueryPathEntries, walkQueryPath,
 } from './query-plan.js';
 import { QUERY_OPERATORS, isQueryOperator, resolveQueryFeatures } from './query-operators.js';
 import {
-  assertEmptinessPath, describeEmptiness, emptinessScopePaths, emptinessScopeTargets, isEmptinessOperator,
+  assertEmptinessPath, describeEmptiness, emptinessScopeTargets, isEmptinessOperator,
 } from './query-emptiness.js';
 import { relationFieldOwners } from './relation-owners.js';
 import { isThenable } from './auth/thenable.js';
@@ -33,6 +35,12 @@ import {
 import {
   fieldMetadataNamesFixed, fieldMetadataTypes, fixFieldMetadataNames, renameFieldMetadataTypes,
 } from './introspection.js';
+import {
+  MAX_RECORD_VERSION, RecordVersion, RecordVersionRef, assertVersionInput, concurrencyDeclared, createVersionFieldConfig,
+  isProtectedType, isVersionField, readStoredVersion, recordVersionFieldMisuse, retainedStoredVersion, unadvancedVersionError,
+  unexpectedDeleteError, versionConflictError, versionConnectionCollision, versionEmbeddedMisuse, versionExhaustedError,
+  versionFieldCollision, versionManagedError,
+} from './record-version.js';
 
 // Resolvers Simfinity generates. Any other resolver on a registered type when its schema is first
 // created is application code, such as a masking resolver, recorded once per type so later
@@ -85,6 +93,33 @@ const forbiddenPath = (message) => new SimfinityError(message, 'FORBIDDEN_FILTER
 // Generated inputs never write a readOnly field, nor a virtual one, which virtual implies.
 const isReadOnlyField = (field) => !!field.extensions?.readOnly || isVirtualField(field);
 
+// Optimistic concurrency (#98). A type is protected once it carries the version field createSchema()
+// injects, which it keeps for good, so code that builds schemas and runs requests asks this instead of
+// reading the live `extensions.concurrency`.
+const isProtected = (gqltype) => isVersionField(gqltype.getFields().version);
+// Whether each registered type was protected when the first createSchema() that contained it returned,
+// for every runtime of this copy of the core code. A failed createSchema() records nothing.
+const protectionStatus = new WeakMap();
+
+const invalidWriteFeatures = (message) => {
+  throw new SimfinityError(`DatabaseAdapter writeFeatures ${message}`, 'INVALID_WRITE_FEATURES', 500);
+};
+
+// Reads an adapter's `writeFeatures` declaration once, into a frozen copy. Undefined or null declares
+// nothing; a plain object may declare `optimisticConcurrency` as a boolean, and its other members are
+// left for later features. Anything else throws INVALID_WRITE_FEATURES (500).
+const resolveWriteFeatures = (writeFeatures) => {
+  if (writeFeatures == null) return Object.freeze({ optimisticConcurrency: false });
+  if (typeof writeFeatures !== 'object' || ![Object.prototype, null].includes(Object.getPrototypeOf(writeFeatures))) {
+    invalidWriteFeatures('must be a plain object');
+  }
+  const { optimisticConcurrency } = writeFeatures;
+  if (optimisticConcurrency !== undefined && typeof optimisticConcurrency !== 'boolean') {
+    invalidWriteFeatures('optimisticConcurrency must be a boolean');
+  }
+  return Object.freeze({ optimisticConcurrency: optimisticConcurrency === true });
+};
+
 // Query scopes restrict reads, so a scope Simfinity cannot run must fail rather than be skipped.
 const SCOPE_OPERATIONS = ['find', 'get_by_id', 'aggregate'];
 const invalidScope = (typeName, detail) => new SimfinityError(
@@ -148,7 +183,7 @@ const assertScopeControlArg = (name, value) => {
 };
 
 // Moves a joined type's scope group below the relation path that entered it.
-const prefixScopeGroup = (group, prefix) => {
+const prefixScopeGroup = (group, prefix, copyQuantifiedGroup) => {
   if (!group || typeof group !== 'object' || Array.isArray(group)) {
     throw new SimfinityError('Expected a scope filter group object', 'INVALID_FILTER_VALUE', 400);
   }
@@ -160,12 +195,15 @@ const prefixScopeGroup = (group, prefix) => {
       value: condition?.value,
     }));
   }
-  if (group.AND != null) prefixed.AND = [].concat(group.AND).map((item) => prefixScopeGroup(item, prefix));
-  if (group.OR != null) prefixed.OR = [].concat(group.OR).map((item) => prefixScopeGroup(item, prefix));
+  if (group.AND != null) prefixed.AND = [].concat(group.AND).map((item) => prefixScopeGroup(item, prefix, copyQuantifiedGroup));
+  if (group.OR != null) prefixed.OR = [].concat(group.OR).map((item) => prefixScopeGroup(item, prefix, copyQuantifiedGroup));
+  for (const key of QUANTIFIED_LISTS) if (group[key] != null) {
+    prefixed[key] = group[key].map((item) => ({ ...copyQuantifiedGroup(item), path: `${prefix}.${item.path}` }));
+  }
   return prefixed;
 };
 
-const prefixScopeArgs = (scopeArgs, prefix, typeName) => {
+const prefixScopeArgs = (scopeArgs, prefix, typeName, copyQuantifiedGroup) => {
   const conditions = [];
   const groups = [];
   for (const [name, value] of Object.entries(scopeArgs)) {
@@ -174,10 +212,12 @@ const prefixScopeArgs = (scopeArgs, prefix, typeName) => {
       assertScopeControlArg(name, value);
       continue;
     }
-    if (name === 'AND') groups.push(...[].concat(value).map((group) => prefixScopeGroup(group, prefix)));
+    if (name === 'AND') groups.push(...[].concat(value).map((group) => prefixScopeGroup(group, prefix, copyQuantifiedGroup)));
     else if (name === 'OR') {
       const branches = [].concat(value);
-      if (branches.length) groups.push({ OR: branches.map((group) => prefixScopeGroup(group, prefix)) });
+      if (branches.length) groups.push({ OR: branches.map((group) => prefixScopeGroup(group, prefix, copyQuantifiedGroup)) });
+    } else if (value.quantifier != null) {
+      groups.push({ [value.quantifier]: [{ path: `${prefix}.${name}`, conditions: (value.terms ?? []).map(({ path, ...term }) => ({ field: path, ...term })) }] });
     } else if (Object.hasOwn(value, 'terms')) {
       if (!Array.isArray(value.terms) || !value.terms.length) {
         throw new SimfinityError(`Scope filter ${typeName}.${name} requires non-empty terms`, 'MISSING_FILTER_PATH', 400);
@@ -280,6 +320,24 @@ const assertFieldMetadataNamesFree = (roots) => {
   if (clash) throw reservedTypeNameError(clash);
 };
 
+// A schema with protected types contains RecordVersion, and RecordVersionRef whenever a generated input
+// reaches a collection of protected items, so an application type with either name, other than the
+// instances this module exports, is rejected there (#98). Like the field metadata names, they are first
+// checked before anything is built, reading input objects by their own name only, and then in the whole
+// schema when it is constructed.
+const versionTypeClash = (roots, options) => [RecordVersion, RecordVersionRef]
+  .map((own) => findSchemaType(roots, own.name, own, options)).find(Boolean) || null;
+// A scalar named RecordVersion with core's own description is almost always core's scalar from a
+// second copy of this package, which protected types cannot work with.
+const reservedVersionTypeNameError = (clash) => new SimfinityError(
+  clash instanceof GraphQLScalarType && clash.name === RecordVersion.name && clash.description === RecordVersion.description
+    ? 'RecordVersion is reserved for optimistic concurrency, and this RecordVersion comes from another copy of '
+      + '@simtlix/simfinity-core: two copies of the package are loaded; import RecordVersion from the facade the '
+      + 'application uses'
+    : `${clash.name} is reserved for optimistic concurrency; rename the application type`,
+  'RESERVED_TYPE_NAME', 500,
+);
+
 const buildSchemaConfig = (query, mutation) => {
   const config = { query };
   if (Object.keys(mutation.getFields()).length > 0) {
@@ -292,12 +350,15 @@ const buildSchemaConfig = (query, mutation) => {
 // those are renamed SimfinityFieldExtensionsType and SimfinityRelationType, with a number appended
 // when the schema also has those names, in every schema the process constructs from then on. A
 // construction that fails puts the previous metadata types back, so only a schema that exists fixes
-// the names.
-const constructSchema = (query, mutation) => {
+// the names. With `reserveVersionTypeNames`, for a schema with protected types, an application type
+// named RecordVersion or RecordVersionRef fails, even one that only an input field reaches.
+const constructSchema = (query, mutation, reserveVersionTypeNames = false) => {
   const config = buildSchemaConfig(query, mutation);
   const roots = Object.values(config);
   const clash = fieldMetadataClash(roots);
   if (clash && fieldMetadataNamesFixed()) throw reservedTypeNameError(clash);
+  const versionClash = reserveVersionTypeNames && versionTypeClash(roots);
+  if (versionClash) throw reservedVersionTypeNameError(versionClash);
   let names = null;
   if (clash) {
     const taken = (name) => findSchemaType(roots, name) !== null;
@@ -431,6 +492,21 @@ const readOwnField = markGenerated((parent, args, context, info) => {
   return typeof property === 'function' ? property.call(parent, args, context, info) : property;
 });
 
+// Puts the version field into a protected type's getFields() map, after the type's own fields, unless
+// the type carries it already: from an earlier schema, another runtime of this core copy that shares
+// the type, or the type it was copied from. The resolver reads only the parent, so it binds the type to
+// no runtime, and a record without a stored version, such as a MongoDB document written before the
+// type was protected, reads as version 1. An invalid stored version is reported under the type being
+// resolved, which a renamed copy shares the resolver with, or under the type it was injected into.
+const injectVersionField = (gqltype) => {
+  if (isProtected(gqltype)) return;
+  const typeName = gqltype.name;
+  gqltype.getFields().version = createVersionFieldConfig(markGenerated((parent, args, context, info) => readStoredVersion(
+    retainedStoredVersion(parent) ?? ownValue(parent, 'version'),
+    { typeName: info?.parentType?.name ?? typeName, id: ownValue(parent, '_id') ?? ownValue(parent, 'id') },
+  )));
+};
+
 const cloneInput = (value, type) => {
   if (value === null || value === undefined || !type) return value;
   if (type instanceof GraphQLNonNull) return cloneInput(value, type.ofType);
@@ -476,9 +552,12 @@ export const createRuntime = (adapter) => {
   // IS_EMPTY and IS_NOT_EMPTY through references and collections (#108 part 2b), and a client's
   // conditions of that kind carry a scope marker from the runtime (see markClientConstructs).
   const {
-    operators: supportedOperators, referenceEmptiness: supportsReferenceEmptiness,
+    operators: supportedOperators, referenceEmptiness: supportsReferenceEmptiness, quantifiers: supportsQuantifiers,
   } = resolveQueryFeatures(adapter.queryFeatures);
   const supportsEveryOperator = QUERY_OPERATORS.every((operator) => supportedOperators.has(operator));
+  // The write features the adapter implements, read once: with optimisticConcurrency, schemas may
+  // contain protected types (#98).
+  const writeFeatures = resolveWriteFeatures(adapter.writeFeatures);
 
   const stateValue = adapter.stateValue || ((state) => state.name);
   const runtimeIdentity = {};
@@ -494,6 +573,9 @@ export const createRuntime = (adapter) => {
   const selfCollectionNameHolders = new Map();
   const qualifiedSelfCollections = new Map();
   const registeredMutations = {};
+  // Models createModel() returned for this runtime, as opposed to models supplied to connect(). A type
+  // with one was built for storage without a version field, even by a createSchema() that failed later.
+  const generatedModels = new WeakSet();
   const registeredQueries = {};
   const registeredViews = {};
   const middlewares = [];
@@ -556,9 +638,9 @@ export const createRuntime = (adapter) => {
     }
   };
 
-  // Object and interface types a schema of this runtime can reach from its registered types and
-  // custom operation results, following the same references as GraphQLSchema.
-  const collectSchemaOutputTypes = () => {
+  // Object and interface types reachable from these roots, following the output references of
+  // GraphQLSchema: fields, interfaces and union members. Input objects cannot hold either.
+  const collectOutputTypes = (roots) => {
     const visited = new Set();
     const outputTypes = [];
     const visit = (type) => {
@@ -574,14 +656,20 @@ export const createRuntime = (adapter) => {
       named.getInterfaces().forEach(visit);
       for (const field of Object.values(named.getFields())) visit(field.type);
     };
+    roots.forEach(visit);
+    return outputTypes;
+  };
+
+  // Object and interface types a schema of this runtime can reach from its registered types and
+  // custom operation results, following the same references as GraphQLSchema.
+  const collectSchemaOutputTypes = () => {
     const registeredTypes = Object.values(typesDict.types).map(({ gqltype }) => gqltype);
     const customOperations = [
       ...Object.values(registeredMutations),
       ...Object.values(registeredQueries),
     ];
     const customOutputTypes = customOperations.map(({ outputModel }) => outputModel);
-    [...registeredTypes, ...customOutputTypes].forEach(visit);
-    return outputTypes;
+    return collectOutputTypes([...registeredTypes, ...customOutputTypes]);
   };
 
   const hasUnresolvedRelation = (gqltype) => Object.values(gqltype.getFields()).some(
@@ -616,6 +704,7 @@ const QLTypeFilterExpression = new GraphQLInputObjectType({
   name: 'QLTypeFilterExpression',
   fields: () => ({
     terms: { type: new GraphQLList(QLTypeFilter) },
+    quantifier: { type: QLQuantifier },
   }),
 });
 
@@ -629,9 +718,25 @@ const QLFilterCondition = new GraphQLInputObjectType({
   }),
 });
 
+const QLQuantifiedGroup = new GraphQLInputObjectType({
+  name: 'QLQuantifiedGroup',
+  fields: () => ({
+    path: { type: new GraphQLNonNull(GraphQLString) },
+    AND: { type: new GraphQLList(QLFilterGroup) },
+    OR: { type: new GraphQLList(QLFilterGroup) },
+    ANY: { type: new GraphQLList(QLQuantifiedGroup) },
+    ALL: { type: new GraphQLList(QLQuantifiedGroup) },
+    NONE: { type: new GraphQLList(QLQuantifiedGroup) },
+    conditions: { type: new GraphQLList(QLFilterCondition) },
+  }),
+});
+
 const QLFilterGroup = new GraphQLInputObjectType({
   name: 'QLFilterGroup',
   fields: () => ({
+    ANY: { type: new GraphQLList(QLQuantifiedGroup) },
+    ALL: { type: new GraphQLList(QLQuantifiedGroup) },
+    NONE: { type: new GraphQLList(QLQuantifiedGroup) },
     AND: { type: new GraphQLList(QLFilterGroup) },
     OR: { type: new GraphQLList(QLFilterGroup) },
     conditions: { type: new GraphQLList(QLFilterCondition) },
@@ -814,8 +919,10 @@ const createOneToManyInputType = (name, inputNamePrefix, itemType, connection,
             + `\`${operation}\` operation in generated inputs, ${omittedOperation[operation]()}`);
         }
       }
-      // Null IDs are skipped, so `deleted` accepts them whatever the collection's item nullability.
-      fields.deleted = { type: new GraphQLList(GraphQLID) };
+      // Null entries are skipped, so `deleted` accepts them whatever the collection's item nullability.
+      // A protected item is deleted at the version the client read, whether or not the parent is
+      // protected (#98).
+      fields.deleted = { type: new GraphQLList(isProtected(itemType) ? RecordVersionRef : GraphQLID) };
       return fields;
     },
   });
@@ -1050,6 +1157,14 @@ const buildInputType = (gqltype, reachable) => {
       description: fieldEntry.description,
     };
   }
+  // The version field is readOnly, so only this adds it, last and required, to a protected type's
+  // update input, which updates, state actions and nested `updated` entries take (#98). Create inputs,
+  // and the `added` items built from them, never get it. An update input that would hold only the
+  // version, with no writable id or other field, is left without fields as before (#161), so the type
+  // has no update mutation, state actions or nested `updated` entries, and keeps its delete mutation.
+  if (isProtected(gqltype) && Object.keys(fieldsArgForUpdate).length > 0) {
+    fieldsArgForUpdate.version = { type: new GraphQLNonNull(RecordVersion), description: argTypes.version.description };
+  }
 
   const inputTypeForAdd = new GraphQLInputObjectType({
     name: `${gqltype.name}Input`,
@@ -1222,8 +1337,9 @@ const materializeModel = async (args, gqltype, linkToParent, operation, session)
   const collectionFields = {};
 
   for (const [fieldEntryName, fieldEntry] of Object.entries(argTypes)) {
-    // A virtual field stores nothing, whatever middleware or saveObject() passes for it.
-    if (isVirtualField(fieldEntry)) continue;
+    // A virtual field stores nothing, whatever middleware or saveObject() passes for it, and Simfinity
+    // writes the version field of a protected type itself (#98).
+    if (isVirtualField(fieldEntry) || isVersionField(fieldEntry)) continue;
     const fieldValue = ownValue(args, fieldEntryName);
     if (fieldEntry.extensions && fieldEntry.extensions.validations
       && fieldEntry.extensions.validations[operation]) {
@@ -1339,10 +1455,58 @@ const iterateOnCollectionFields = async (materializedModel, gqltype, objectId, s
 const readByIdIsInert = (Model) => typeof adapter.readByIdIsInert === 'function'
   && adapter.readByIdIsInert(Model) === true;
 
+// Optimistic concurrency (#98). Every update, state action, delete and nested entry of a protected
+// type first reads its record whole, plain and locked: the pre-read, which also serves the embedded
+// merge, the from-state check and onDelete. Its version is normalized before any hook sees it, so a
+// MongoDB document stored before the type was protected shows 1, as on PostgreSQL.
+const normalizeProtectedVersion = (record, gqltype, id) => {
+  record.version = readStoredVersion(record.version,
+    { typeName: gqltype.name, id: ownValue(record, '_id') ?? ownValue(record, 'id') ?? id });
+  return record.version;
+};
+
+const readProtectedRecord = async (Model, gqltype, id, session) => {
+  const record = await adapter.getById(Model, id, session, { plain: true, lock: true });
+  if (record) normalizeProtectedVersion(record, gqltype, id);
+  return record;
+};
+
+// Whether a stale or exhausted version that the pre-read found is reported at once, before the
+// record's validators, hooks and action run (decision 9): to every caller of a type without a
+// get_by_id scope, and to a caller who can read the record through that scope. The record is read as
+// a by-ID read does, in the operation's session and by its stored key, not the client's spelling of
+// the ID. A scope function that throws counts as hiding the record; errors of the gates and of
+// adapter.find propagate.
+const reportEarlyConflict = async (type, record, context, session) => {
+  if (!getScope(type.gqltype, 'get_by_id')) return true;
+  const key = String(record._id ?? record.id);
+  const args = { id: { operator: 'EQ', value: key } };
+  try {
+    return await findVisibleById(type, args, session, context, key) !== null;
+  } catch (error) {
+    if (failedByIdScopes.has(args)) return false;
+    throw error;
+  }
+};
+
+// Outcome 3 of the pre-read: the stored version is not the expected one, or an update or a state
+// action (`advances`) would take it past MAX_RECORD_VERSION; a delete does not advance it. When the
+// conflict is not reported early, the operation continues exactly as with a matching version, and the
+// conditional write reports it.
+const assertRecordVersion = async (gqltype, id, record, expectedVersion, advances, context, session) => {
+  let error = null;
+  if (record.version !== expectedVersion) error = versionConflictError(gqltype.name, id);
+  else if (advances && expectedVersion === MAX_RECORD_VERSION) error = versionExhaustedError(gqltype.name, id);
+  if (error && await reportEarlyConflict(typesDict.types[gqltype.name], record, context, session)) throw error;
+};
+
 // The record is read for the onDelete hook; adapter.delete casts the ID, deletes and returns the
 // record itself. Without a hook, the read is skipped when it is inert. A nested delete passes the
-// child it has already read as `current`.
-const onDelete = async (Model, controller, id, session, context, current) => {
+// child it has already read as `current`, and a protected delete its pre-read record, null when it is
+// missing, with `precondition`: the type and the version the record must still have. The adapter then
+// deletes it only at that version, and a record it deleted at another one, which an adapter wrapper
+// that drops the options would delete, fails with DATABASE_ERROR and rolls back with the transaction.
+const onDelete = async (Model, controller, id, session, context, current, precondition = null) => {
   const hasHook = !!(controller && controller.onDelete);
   let currentObject = current;
   if (currentObject === undefined && (hasHook || !readByIdIsInert(Model))) {
@@ -1353,7 +1517,13 @@ const onDelete = async (Model, controller, id, session, context, current) => {
     await controller.onDelete(currentObject, session, context);
   }
 
-  return adapter.delete(Model, id, session);
+  if (!precondition) return adapter.delete(Model, id, session);
+  const { gqltype, expectedVersion } = precondition;
+  const deleted = await adapter.delete(Model, id, session, { expectedVersion });
+  if (deleted && readStoredVersion(deleted.version, { typeName: gqltype.name, id }) !== expectedVersion) {
+    throw unexpectedDeleteError(gqltype.name, id);
+  }
+  return deleted;
 };
 
 const getEmbeddedFieldNames = (gqltype) => {
@@ -1428,7 +1598,7 @@ const clearNullEmbeddedMembers = (merged, fieldEntry, patch) => {
 // onUpdating, so that a malformed ID fails before the hook, and before nested collection items, so
 // that the SQL adapter locks the parent row before child writes; otherwise it skips the read only
 // when it is inert. A state action or a nested update has already read and checked the record
-// (`recordChecked`).
+// (`recordChecked`). A protected type never reads here: its pre-read record serves the merge (#98).
 const readsStoredEmbedded = (Model, controller, materializedModel, embeddedFieldNames, recordChecked) => {
   const usesStored = embeddedFieldNames.some((name) => {
     const value = ownValue(materializedModel.modelArgs, name);
@@ -1442,17 +1612,29 @@ const readsStoredEmbedded = (Model, controller, materializedModel, embeddedField
     || !readByIdIsInert(Model);
 };
 
+// Whether an update sets the version field, at the top level or inside an operator such as $set or
+// $unset. The adapter writes the version of a protected type (#98).
+const setsVersion = (update) => [update, ...Object.entries(update)
+  .filter(([key]) => key.startsWith('$')).map(([, value]) => value)]
+  .some((target) => target !== null && typeof target === 'object' && Object.hasOwn(target, 'version'));
+
+// The update of a protected type (#98) takes from its caller the version captured before the
+// pre-read, `expectedVersion`, the immutable observed version, and the pre-read record (null when
+// missing). It merges embedded values from that record and writes only at the expected version,
+// which the adapter advances; onUpdating
+// cannot set the version, and a result that did not advance it fails with DATABASE_ERROR.
 const onUpdateSubject = async (Model, gqltype, controller, args, session, linkToParent, context,
-  recordChecked = false) => {
+  recordChecked = false, { expectedVersion, observedVersion, record } = {}) => {
+  const versioned = isProtected(gqltype);
   const materializedModel = await materializeModel(args, gqltype, linkToParent, 'UPDATE', session);
   const objectId = args.id;
   const argTypes = gqltype.getFields();
   const embeddedFieldNames = getEmbeddedFieldNames(gqltype);
 
   if (embeddedFieldNames.length > 0
-    && readsStoredEmbedded(Model, controller, materializedModel, embeddedFieldNames, recordChecked)) {
+    && (versioned || readsStoredEmbedded(Model, controller, materializedModel, embeddedFieldNames, recordChecked))) {
     const projection = Object.fromEntries(embeddedFieldNames.map((name) => [name, 1]));
-    const currentObject = await adapter.getById(Model, objectId, session, {
+    const currentObject = versioned ? record : await adapter.getById(Model, objectId, session, {
       projection,
       plain: true,
       lock: true,
@@ -1477,7 +1659,8 @@ const onUpdateSubject = async (Model, gqltype, controller, args, session, linkTo
   }
 
   for (const [fieldEntryName, fieldEntry] of Object.entries(argTypes)) {
-    if (args[fieldEntryName] === null && !(fieldEntry.type instanceof GraphQLNonNull) && !isVirtualField(fieldEntry)) {
+    if (args[fieldEntryName] === null && !(fieldEntry.type instanceof GraphQLNonNull) && !isVirtualField(fieldEntry)
+      && !isVersionField(fieldEntry)) {
       materializedModel.modelArgs.$unset = {
         ...materializedModel.modelArgs.$unset,
         [getFieldStorageName(fieldEntryName, fieldEntry)]: '',
@@ -1492,11 +1675,24 @@ const onUpdateSubject = async (Model, gqltype, controller, args, session, linkTo
 
   if (controller && controller.onUpdating) {
     await controller.onUpdating(objectId, update, session, context);
+    if (versioned && setsVersion(update)) throw versionManagedError(gqltype.name, 'onUpdating');
   }
 
   if (linkToParent) linkToParent(update);
-  const result = await adapter.update(Model, objectId, update, session);
+  const result = versioned
+    ? await adapter.update(Model, objectId, update, session, { expectedVersion })
+    : await adapter.update(Model, objectId, update, session);
   if (!result) throw new SimfinityError(`${gqltype.name} ${objectId} is not valid`, 'NOT_VALID_ID', 404);
+  // Diagnose a result that did not advance beyond the pre-read, including a dropped precondition
+  // when the caller sent one revision less. This cannot prove arbitrary wrappers honored the atomic
+  // condition: they must still forward it. The observation is captured before application code runs.
+  if (versioned) {
+    const returnedVersion = readStoredVersion(result.version, { typeName: gqltype.name, id: objectId });
+    if (returnedVersion !== expectedVersion + 1
+      || (observedVersion !== undefined && returnedVersion <= observedVersion)) {
+      throw unadvancedVersionError(gqltype.name, objectId);
+    }
+  }
 
   if (materializedModel.collectionFields) {
     // Children link to, and are owned through, the parent's stored key, as when a new parent is
@@ -1513,18 +1709,27 @@ const onUpdateSubject = async (Model, gqltype, controller, args, session, linkTo
   return result;
 };
 
+// A protected type's version is captured before the action can change `args`, and checked on the
+// plain pre-read record before the from-state check, which reads `state` from that record (#98).
 const onStateChanged = async (Model, gqltype, controller, args, session, actionField, context) => {
-  const storedModel = await adapter.getById(Model, args.id, session, { lock: true });
+  const versioned = isProtected(gqltype);
+  const expectedVersion = versioned ? assertVersionInput(args.version) : undefined;
+  const storedModel = versioned
+    ? await readProtectedRecord(Model, gqltype, args.id, session)
+    : await adapter.getById(Model, args.id, session, { lock: true });
+  const observedVersion = versioned ? storedModel?.version : undefined;
   if (!storedModel) {
     throw new SimfinityError(`${gqltype.name} ${args.id} is not valid`, 'NOT_VALID_ID', 404);
   }
+  if (versioned) await assertRecordVersion(gqltype, args.id, storedModel, expectedVersion, true, context, session);
   if (storedModel.state === stateValue(actionField.from)) {
     if (actionField.action) {
       await actionField.action(args, session);
     }
 
     args.state = stateValue(actionField.to);
-    let result = await onUpdateSubject(Model, gqltype, controller, args, session, null, context, true);
+    let result = await onUpdateSubject(Model, gqltype, controller, args, session, null, context, true,
+      versioned ? { expectedVersion, observedVersion, record: storedModel } : undefined);
     result = adapter.toObject(result);
     result.state = actionField.to.value;
     return result;
@@ -1539,11 +1744,15 @@ const onSaveObject = async (Model, gqltype, controller, args, session, linkToPar
       typesDict.types[gqltype.name].stateMachine.initialState,
     );
   }
+  // A protected record starts at version 1, whatever saveObject() or middleware supplied (#98).
+  const versioned = isProtected(gqltype);
+  if (versioned) materializedModel.modelArgs.version = 1;
 
   const newObject = adapter.newRecord(Model, materializedModel.modelArgs, session);
 
   if (controller && controller.onSaving) {
     await controller.onSaving(newObject, args, session, context);
+    if (versioned && newObject.version !== 1) throw versionManagedError(gqltype.name, 'onSaving');
   }
 
   if (linkToParent) linkToParent(newObject);
@@ -1635,12 +1844,30 @@ const assertCollectionWrites = (gqltype, input) => {
   }
 };
 
+// The capture and the pre-read of a protected top-level update or delete (#98): the version the
+// client sent is checked before anything is read, then against the pre-read record. A missing record
+// is not reported here; the update fails at its write with NOT_VALID_ID and the delete returns null,
+// as for an unprotected type.
+const preReadTopLevel = async (Model, gqltype, { id, version }, advances, context, session) => {
+  const expectedVersion = assertVersionInput(version);
+  const record = await readProtectedRecord(Model, gqltype, id, session);
+  const observedVersion = record?.version;
+  if (record) await assertRecordVersion(gqltype, id, record, expectedVersion, advances, context, session);
+  return { expectedVersion, observedVersion, record };
+};
+
+// A delete passes the ID, or { id, version } for a protected type, which each attempt copies; every
+// other operation passes its input, which attemptInputs copies. Either way, a retry checks the version
+// the request sent.
 const executeOperation = (Model, gqltype, controller, args, operation, actionField,
   session, context, inputType) => {
   const limit = getMaxNestedOperations();
   if (limit !== null && operation !== operations.DELETE) assertNestedOperations(gqltype, args, limit);
   if (operation !== operations.DELETE) assertCollectionWrites(gqltype, args);
-  const nextInput = operation === operations.DELETE ? () => args : attemptInputs(args, inputType);
+  const versioned = isProtected(gqltype);
+  let nextInput = () => args;
+  if (operation !== operations.DELETE) nextInput = attemptInputs(args, inputType);
+  else if (versioned) nextInput = () => ({ ...args });
   return adapter.withTransaction(
     session,
     async (mySession) => {
@@ -1648,10 +1875,17 @@ const executeOperation = (Model, gqltype, controller, args, operation, actionFie
       switch (operation) {
         case operations.SAVE:
           return onSaveObject(Model, gqltype, controller, attemptArgs, mySession, null, context);
-        case operations.UPDATE:
-          return onUpdateSubject(Model, gqltype, controller, attemptArgs, mySession, null, context);
-        case operations.DELETE:
-          return onDelete(Model, controller, attemptArgs, mySession, context);
+        case operations.UPDATE: {
+          const precondition = versioned
+            ? await preReadTopLevel(Model, gqltype, attemptArgs, true, context, mySession) : undefined;
+          return onUpdateSubject(Model, gqltype, controller, attemptArgs, mySession, null, context, false, precondition);
+        }
+        case operations.DELETE: {
+          if (!versioned) return onDelete(Model, controller, attemptArgs, mySession, context);
+          const { expectedVersion, record } = await preReadTopLevel(Model, gqltype, attemptArgs, false, context,
+            mySession);
+          return onDelete(Model, controller, attemptArgs.id, mySession, context, record, { gqltype, expectedVersion });
+        }
         case operations.STATE_CHANGED:
           return onStateChanged(Model, gqltype, controller,
             attemptArgs, mySession, actionField, context);
@@ -1684,14 +1918,28 @@ const executeItemFunction = async (gqltype, collectionField, parentKey, session,
     if (item.$set) delete item.$set[connection.storageFieldName];
   };
 
+  // A protected child is updated or deleted at the version its entry carries (#98). A deleted entry is
+  // { id, version } for item middleware; one that is not an object, such as a string ID, has no version.
+  const versioned = isProtected(collectionGQLType) && operationType !== operations.SAVE;
   for (const element of collectionFieldsList) {
     if (element === null) continue;
-    const args = operationType === operations.DELETE ? { id: element } : { input: element };
+    let args = { input: element };
+    if (operationType === operations.DELETE) {
+      args = versioned ? { id: element?.id, version: element?.version } : { id: element };
+    }
     await executeMiddleware({ type, args, operation: operationType, context });
 
+    // Captured after the item's middleware, before the child is read.
+    let expectedVersion;
+    if (versioned) {
+      expectedVersion = assertVersionInput(operationType === operations.DELETE ? args.version : args.input.version);
+    }
+
     // The ownership check reads the child (the SQL adapter locks its row). onDelete receives this
-    // record, and an update reads the child again only to merge embedded values.
+    // record, and an update reads the child again only to merge embedded values, unless the child is
+    // protected: then this is its pre-read, whose version is checked after ownership.
     let child;
+    let observedVersion;
     if (operationType === operations.UPDATE || operationType === operations.DELETE) {
       const id = operationType === operations.DELETE ? args.id : args.input.id;
       child = await adapter.getById(type.model, id, session, { plain: true, lock: true });
@@ -1701,6 +1949,11 @@ const executeItemFunction = async (gqltype, collectionField, parentKey, session,
       if (String(child[connection.storageFieldName]) !== String(parentKey)) {
         throw new ForbiddenError('Child does not belong to this parent');
       }
+      if (versioned) {
+        observedVersion = normalizeProtectedVersion(child, collectionGQLType, id);
+        await assertRecordVersion(collectionGQLType, id, child, expectedVersion, operationType === operations.UPDATE,
+          context, session);
+      }
     }
 
     switch (operationType) {
@@ -1710,10 +1963,11 @@ const executeItemFunction = async (gqltype, collectionField, parentKey, session,
         break;
       case operations.UPDATE:
         await onUpdateSubject(type.model, collectionGQLType, type.controller,
-          args.input, session, linkToParent, context, true);
+          args.input, session, linkToParent, context, true, versioned ? { expectedVersion, observedVersion, record: child } : undefined);
         break;
       case operations.DELETE:
-        await onDelete(type.model, type.controller, args.id, session, context, child);
+        await onDelete(type.model, type.controller, args.id, session, context, child,
+          versioned ? { gqltype: collectionGQLType, expectedVersion } : null);
     }
   }
 };
@@ -1780,8 +2034,10 @@ const copyFilterGroup = (group) => {
   if (Array.isArray(group.conditions)) copy.conditions = group.conditions.map(copyFilterCondition);
   if (Array.isArray(group.AND)) copy.AND = group.AND.map(copyFilterGroup);
   if (Array.isArray(group.OR)) copy.OR = group.OR.map(copyFilterGroup);
+  for (const key of QUANTIFIED_LISTS) if (Array.isArray(group[key])) copy[key] = group[key].map(copyQuantifiedGroup);
   return copy;
 };
+const copyQuantifiedGroup = (group) => copyFilterGroup(group);
 const copyFieldFilter = (filter) => {
   const copy = copyFilterCondition(filter);
   if (isFilterObject(filter) && Array.isArray(filter.terms)) copy.terms = filter.terms.map(copyFilterCondition);
@@ -1818,12 +2074,19 @@ const copyClientFilters = (args, operation) => {
 // non-queryable field is not rejected; a virtual one still is.
 const inspectClientPaths = (gqltype, args, operation, { checkQueryable = true } = {}) => {
   copyClientFilters(args, operation);
+  assertSortSyntax(args.sort);
   const joinedScopes = new Map();
+  const J = operation === 'aggregate' ? aggregateJoinPrefixes(args.aggregation, { gqltype }) : new Set();
   const entries = collectQueryPathEntries(args, operation, { gqltype, expandMembers: true });
   for (const {
-    segments, group, member, operator,
+    segments, group, member, operator, use, frames, quantifier,
   } of entries) {
-    const joins = !member && !(supportsReferenceEmptiness && isEmptinessOperator(operator));
+    const filter = use === 'filter';
+    const relations = filter && supportsQuantifiers ? pathRelations(gqltype, segments) : [];
+    const cut = relations.find((relation) => relation.collection && !J.has(relation.path));
+    const anchored = cut && relations.some((relation) => relation.collection && J.has(relation.path));
+    const joins = !member && !(supportsReferenceEmptiness && isEmptinessOperator(operator))
+      && !(filter && (frames.length || quantifier || (cut && !anchored)));
     walkQueryPath(gqltype, segments, ({ type, fieldName, field, index }) => {
       const path = segments.slice(0, index + 1).join('.');
       if (isVirtualField(field)) {
@@ -1833,8 +2096,11 @@ const inspectClientPaths = (gqltype, args, operation, { checkQueryable = true }
       if (checkQueryable && (queryable === false || (queryable !== true && hasApplicationResolver(type, fieldName)))) {
         throw forbiddenPath(`Query path ${path} uses the non-queryable field ${type.name}.${fieldName}`);
       }
-      if (!joins) return;
       const relation = field.extensions?.relation;
+      if (use === 'sort' && operation !== 'aggregate' && relation && !relation.embedded && getListShape(field.type)) {
+        throw new SimfinityError(`Sort path ${segments.join('.')} crosses the collection ${type.name}.${fieldName}; a record has no single value there`, 'INVALID_FILTER_PATH', 400);
+      }
+      if (!joins || (cut && index >= cut.index)) return;
       if (!relation || relation.embedded) return;
       const target = typesDict.types[unwrapListAndNonNull(field.type).name];
       if (!getScope(target?.gqltype, 'find')) return;
@@ -1916,31 +2182,43 @@ const assertEmptinessForm = (gqltype, {
   return true;
 };
 
-// Rejects a QLOperator value that the adapter does not declare in queryFeatures, with
-// UNSUPPORTED_QUERY (400), so an adapter never drops or misreads a condition it does not compile,
-// and applies to every IS_EMPTY or IS_NOT_EMPTY condition the order of checks of #108 part 2a,
-// whatever the adapter declares, rule 6 only when it does not declare reference emptiness. Runs on
-// the client's arguments before middleware and on the final arguments before the adapter call,
-// which covers what middleware, scopes and joined scopes added, so that an emptiness condition gets
-// the code that a direct createQueryPlan call gives, whoever wrote it and whatever the caller may
-// read. Operators that QLOperator does not list are left to the adapter, which reports them as before.
-// Returns every condition as `{ entry, shape }`: its collectQueryOperators entry, and the shape of an
-// emptiness condition that the backends read as one, or null.
+// Every runtime gate validates the received language, before rewriting or filling any markers.
+// Legacy adapters keep the detailed 2b diagnostics; quantified adapters use the shared validator's
+// frame-relative checks first. The separate operator inspection includes ignored beside-terms
+// carriers, which do not become predicates but must not use known undeclared capabilities.
+const queryFrameContext = (gqltype, args, operation) => ({
+  gqltype, operation, quantifiers: supportsQuantifiers, referenceEmptiness: supportsReferenceEmptiness,
+  operators: supportedOperators,
+  J: operation === 'aggregate' ? aggregateJoinPrefixes(args.aggregation, { gqltype }) : new Set(),
+  scopeMarkers: 'pending',
+});
+
+const entryType = (gqltype, entry) => {
+  let type = gqltype;
+  const prefix = entry.segments.slice(0, entry.segments.length - entry.relative.length);
+  if (prefix.length) walkQueryPath(gqltype, prefix, ({ field }) => { type = getNamedType(field.type); });
+  return type;
+};
+
 const assertQueryConditions = (gqltype, args, operation) => {
-  const checked = [];
+  if (supportsQuantifiers) validateQuantifiedGroups(args, queryFrameContext(gqltype, args, operation));
+  const conditions = [];
   for (const entry of collectQueryOperators(args, operation)) {
     const { operator, path } = entry;
+    const type = entryType(gqltype, entry);
     let shape = null;
     if (isEmptinessOperator(operator)) {
-      if (assertEmptinessForm(gqltype, entry)) {
-        shape = describeEmptiness(gqltype, entry.segments, {
-          operator, value: entry.value, path, referenceEmptiness: supportsReferenceEmptiness,
+      // The validator owns quantified term forms; old top-frame forms retain their diagnostics.
+      if (entry.frames.length || assertEmptinessForm(gqltype, entry)) {
+        if (entry.relative.length) shape = describeEmptiness(type, entry.relative, {
+          operator, value: entry.value, path: entry.relative.join('.'), referenceEmptiness: supportsReferenceEmptiness,
         });
       }
     } else if (!supportsEveryOperator && isQueryOperator(operator)) assertDeclaredOperator(gqltype, operator, path);
-    checked.push({ entry, shape });
+    conditions.push({ entry, shape, type });
   }
-  return checked;
+  if (!supportsQuantifiers) validateQuantifiedGroups(args, queryFrameContext(gqltype, args, operation));
+  return { conditions, gqltype, args, operation };
 };
 
 // Decision 3 of #108 part 2a: a target find scope with an emptiness condition is not applied below a
@@ -1957,9 +2235,8 @@ const assertQueryConditions = (gqltype, args, operation) => {
 // the prefixed conditions are applied as trusted ones, which read stored data.
 const assertJoinedScopeConditions = (rootType, scopeArgs, groups, prefix, target) => {
   const { gqltype } = target;
-  const entries = collectQueryOperators(scopeArgs, 'find').filter(({ operator }) => isEmptinessOperator(operator));
+  const entries = collectQueryOperators(scopeArgs, 'find').filter(({ operator, frames }) => !frames.length && isEmptinessOperator(operator));
   if (!entries.length) return;
-  assertStoredQueryPaths(gqltype, scopeArgs, 'find');
   let throughList = false;
   walkQueryPath(rootType, prefix.split('.'), ({ field }) => { throughList ||= !!getListShape(field.type); });
   // Rule 6, here or on the target's own endpoint, is the rejection thrown below.
@@ -1987,20 +2264,28 @@ const assertJoinedScopeConditions = (rootType, scopeArgs, groups, prefix, target
     + `use EQ null in the ${gqltype.name} find scope`, 'UNSUPPORTED_QUERY', 400);
 };
 
-// A joined scope must not repeat the rows it restricts: its paths may not cross a collection, nor
-// reach a non-embedded relation inside an embedded list, which is joined once per list item.
-const assertJoinedScopePaths = (groups, prefix, target) => {
+// Declared collection frames preserve cardinality. A legacy adapter, or a prefix through an
+// embedded list, still cannot lift collection scopes; vector reference scopes remain forbidden.
+const assertJoinedScopePaths = (rootType, groups, prefix, target) => {
+  let embeddedPrefix = false;
+  walkQueryPath(rootType, prefix.split('.'), ({ field }) => {
+    embeddedPrefix ||= !!(field.extensions?.relation?.embedded && getListShape(field.type));
+  });
   const depth = prefix.split('.').length;
-  for (const segments of collectQueryPaths({ AND: groups })) {
+  for (const { segments, quantifier } of collectQueryPathEntries({ AND: groups })) {
     let inList = false;
-    walkQueryPath(target.gqltype, segments.slice(depth), ({ type, fieldName, field }) => {
+    walkQueryPath(target.gqltype, segments.slice(depth), ({ type, fieldName, field, index }) => {
       const relation = field.extensions?.relation;
       const list = !!getListShape(field.type);
-      if (relation && !relation.embedded && (list || inList)) {
+      if (relation && !relation.embedded && (inList || (list && (!supportsQuantifiers || embeddedPrefix)))) {
         throw forbiddenPath(`Query path ${prefix} enters ${target.gqltype.name}, whose find scope filters through `
           + `${list ? 'the collection' : 'the relation'} ${type.name}.${fieldName}${list ? '' : ' inside a list'}`);
       }
-      inList ||= list;
+      if (relation && !relation.embedded && quantifier && embeddedPrefix && index === segments.length - depth - 1) {
+        throw forbiddenPath(`Query path ${prefix} enters ${target.gqltype.name}, whose find scope tests `
+          + `the quantified reference ${type.name}.${fieldName} under an embedded-list prefix`);
+      }
+      inList = relation && !relation.embedded ? false : inList || list;
     });
   }
 };
@@ -2014,7 +2299,7 @@ const appendAndGroups = (owner, groups) => {
 
 // The deepest AND/OR group nesting the backends accept; groups listed in args.AND/OR are at depth 0.
 const MAX_FILTER_GROUP_DEPTH = 5;
-const nestedGroups = (group) => [...[].concat(group.AND ?? []), ...[].concat(group.OR ?? [])];
+const nestedGroups = (group) => ['AND', 'OR', ...QUANTIFIED_LISTS].flatMap((key) => [].concat(group[key] ?? []));
 const groupDepth = (group) => Math.max(0, ...nestedGroups(group)
   .filter((item) => item && typeof item === 'object').map((item) => groupDepth(item) + 1));
 
@@ -2041,10 +2326,13 @@ const applyJoinedScopes = async (joinedScopes, params) => {
   }] of joinedScopes) {
     const scopeArgs = {};
     await executeScope({ type: target, args: scopeArgs, operation: 'find', context: params.context });
-    const groups = prefixScopeArgs(scopeArgs, prefix, target.gqltype.name);
+    const kept = scopeFilterArgs(scopeArgs);
+    assertStoredQueryPaths(target.gqltype, kept, 'find');
+    assertQueryConditions(target.gqltype, kept, 'find');
+    const groups = prefixScopeArgs(kept, prefix, target.gqltype.name, copyQuantifiedGroup);
     if (!groups.length) continue;
     if (collection) throw forbiddenPath(`Query path ${prefix} enters the scoped collection ${collection}`);
-    assertJoinedScopePaths(groups, prefix, target);
+    assertJoinedScopePaths(params.type.gqltype, groups, prefix, target);
     assertJoinedScopeConditions(params.type.gqltype, scopeArgs, groups, prefix, target);
     queryGroups ??= collectFilterGroups(params.args);
     const addedDepth = 1 + Math.max(...groups.map(groupDepth));
@@ -2054,60 +2342,93 @@ const applyJoinedScopes = async (joinedScopes, params) => {
   }
 };
 
-// Client scope markers (#108 part 2b). When the adapter compiles reference emptiness, each IS_EMPTY or
-// IS_NOT_EMPTY term or group condition that a client sends and that crosses or ends at a reference or a
-// collection, or reads one as a member, gets `__scope: { id }` on this call's copy, before middleware.
-// After middleware, the query's own scope and joined scopes, the runtime checks that every marker it
-// issued is still there and that no other one is, gates the final arguments, then fills each marker
-// with the raw find scope arguments of every type the construct reads through, `__scope: { id, scopes:
-// { [path]: args | null } }`, which the compilers apply as scoped joins and frames, so that a record
-// those scopes hide reads as missing. Constructs without a marker are trusted and read stored data.
-// Markers live only on the terms and group conditions collectQueryOperators returns; a `__scope`
-// anywhere else, inside a value for one, is never read.
+// Client scope provenance is carried by terms, conditions and explicit frames, never by plain
+// logical groups or values. Only reads of registered scoped targets are marked. Middleware sees
+// ordinal IDs; after detach and final validation, fill adds relative target-scope arguments. The
+// planner/compiler rewrite, not the runtime, splits those keys across implicit collection frames.
 const SCOPE_MARKER = '__scope';
 const DETACHED_ADVICE = 'middleware and scopes must keep the client\'s filter objects: copy them instead of rebuilding '
   + 'them, and append restrictions instead of assigning over them (docs/guide/middleware.md)';
 const detachedClientFilter = (message) => new SimfinityError(`${message}; ${DETACHED_ADVICE}`, 'DETACHED_CLIENT_FILTER', 500);
 const hasScopeMarker = (construct) => construct != null && Object.hasOwn(construct, SCOPE_MARKER);
 
-// Marks the client's constructs that read references or collections, from the gate's conditions on the
-// client's arguments, then applies maxReferenceFrames to the distinct (kind, path) pairs of their
-// scoped joins and frames in these conditions, so every 2a code comes first. Returns the issued
-// markers, as id -> the client's operator and path, or null when the adapter does not compile
-// reference emptiness. Ids are ordinals in the order of the conditions, so identical arguments get
-// identical markers and sibling collection reads keep one batch key. With `issued`, the markers of
-// the call so far, the ids continue on that map, so that a view's `where`, marked after the client's
-// arguments, shares them; the limit still applies to each set of conditions on its own.
-const markClientConstructs = (checked, issued) => {
-  if (!supportsReferenceEmptiness) return null;
-  const markers = issued ?? new Map();
-  const pairs = new Set();
-  for (const { entry, shape } of checked) {
-    const { construct } = entry;
-    if (!shape || !construct || hasScopeMarker(construct)) continue;
-    const { joins, frames } = emptinessScopePaths(shape, entry.segments);
-    if (!joins.length && !frames.length) continue;
-    const id = markers.size;
+// Relation metadata is position-relative when used for fill and absolute for eligibility/recording.
+const pathRelations = (gqltype, segments) => {
+  const found = [];
+  let insideList = false;
+  walkQueryPath(gqltype, segments, ({ type, fieldName, field, index }) => {
+    const relation = field.extensions?.relation;
+    const list = !!getListShape(field.type);
+    if (relation && !relation.embedded) found.push({
+      path: segments.slice(0, index + 1).join('.'), index,
+      typeName: getNamedType(field.type).name, collection: list, insideList, owner: type.name, fieldName,
+    });
+    // A collection enters an element frame; only embedded lists make vector reference joins.
+    if (relation && !relation.embedded && list) insideList = false;
+    else if (!relation || relation.embedded) insideList ||= list;
+  });
+  return found;
+};
+
+// The walker retains scalar-filter terms for capability/auth inspection, but no compiler consumes
+// them. Such positions cannot establish client provenance, including when aliased with a predicate.
+const ignoredScalarTerm = (gqltype, entry) => {
+  if (entry.form !== 'term' || entry.frames.length || typeof entry.field !== 'string') return false;
+  const segments = entry.field.split('.');
+  let scalar = false;
+  walkQueryPath(gqltype, segments, ({ field, index }) => {
+    if (index === segments.length - 1) scalar = !isObjectType(getNamedType(field.type));
+  });
+  return scalar;
+};
+
+const ordinaryFrameCarrier = (gqltype, entry, J) => supportsQuantifiers && entry.construct
+  && !ignoredScalarTerm(gqltype, entry)
+  && entry.form !== 'beside-terms' && (entry.frames.length || pathRelations(gqltype, entry.segments)
+    .some(({ path, collection }) => collection && !J.has(path)));
+
+// Eligibility is per carrier: ordinary legacy reference-only/all-J predicates keep joined scopes.
+// Enclosing explicit frames inherit provenance from marked descendants, independently of unit counts.
+// A view continues issuance on the same map, but checks its own compiled-unit budget (as in 3.12.0).
+const markClientConstructs = (checked, { aggregation, issued = new Map() } = {}) => {
+  const { gqltype, args, operation, conditions } = checked;
+  const clientJ = operation === 'aggregate' ? aggregateJoinPrefixes(aggregation, { gqltype }) : new Set();
+  if (!supportsReferenceEmptiness) return { issued: null, clientJ };
+  const mark = (construct, origin) => {
+    if (!construct || hasScopeMarker(construct)) return;
+    const id = issued.size;
     construct[SCOPE_MARKER] = { id };
-    markers.set(id, { operator: entry.operator, path: entry.path });
-    for (const path of joins) pairs.add(`join ${path}`);
-    for (const path of frames) pairs.add(`frame ${path}`);
+    issued.set(id, origin);
+  };
+  for (const { entry, shape } of conditions) {
+    const { construct } = entry;
+    if (!construct || !(shape || entry.form === 'quantified' || ordinaryFrameCarrier(gqltype, entry, clientJ))) continue;
+    const targets = pathRelations(gqltype, entry.segments).map(({ typeName }) => typeName);
+    if (shape) targets.push(...Object.values(emptinessScopeTargets(shape, entry.relative)));
+    if (!targets.some((name) => getScope(typesDict.types[name]?.gqltype, 'find'))) continue;
+    const origin = { operator: entry.operator ?? entry.quantifier, path: entry.path };
+    mark(construct, origin);
+    const prefix = [];
+    for (const frame of entry.frames) {
+      prefix.push(...frame.path.split('.'));
+      mark(frame.construct, { operator: frame.type, path: prefix.join('.') });
+    }
   }
+  const { count } = frameUnits(args, queryFrameContext(gqltype, args, operation));
   const limit = getQueryMaxReferenceFrames();
-  if (pairs.size > limit) {
-    throw new SimfinityError(`Emptiness conditions through references and collections need ${pairs.size} scoped joins and `
-      + 'frames in one set of conditions (the client\'s arguments of a query field, or a view\'s where), more than the limit '
-      + `of ${limit} (maxReferenceFrames)`, 'FILTER_DEPTH_EXCEEDED', 400);
+  if (count > limit) {
+    throw new SimfinityError(`The client's conditions need ${count} frames and scoped joins in one query field, more than the limit of ${limit} (maxReferenceFrames)`, 'FILTER_DEPTH_EXCEEDED', 400);
   }
-  return markers;
+  return { issued, clientJ };
 };
 
-// The detach check: every marker issued in this call sits, well formed (an object whose only own key
-// is its id), on a term or group condition of the final arguments, possibly on several when middleware
-// copied or duplicated the construct; no other marker sits on one.
-const assertClientMarkers = (args, operation, issued) => {
+// Every issued ID must survive on a valid carrier, with no forged or prefilled marker. Marked
+// descendants may only live inside marked client frames; top-frame collection prefixes keep J.
+const assertClientMarkers = (gqltype, args, operation, issued, clientJ) => {
+  const J = operation === 'aggregate' ? aggregateJoinPrefixes(args.aggregation, { gqltype }) : new Set();
   const found = new Set();
-  for (const { construct, operator, path } of collectQueryOperators(args, operation)) {
+  for (const entry of collectQueryOperators(args, operation)) {
+    const { construct, operator, path } = entry;
     if (!hasScopeMarker(construct)) continue;
     const marker = construct[SCOPE_MARKER];
     const origin = isFilterObject(marker) ? issued.get(marker.id) : undefined;
@@ -2118,6 +2439,17 @@ const assertClientMarkers = (args, operation, issued) => {
     if (!origin) {
       throw detachedClientFilter(`The ${operator} condition on ${path} carries a client scope marker that this query field did not issue`);
     }
+    if (ignoredScalarTerm(gqltype, entry)) {
+      throw detachedClientFilter(`The client's ${origin.operator} condition on ${origin.path} is in ignored scalar filter terms`);
+    }
+    if (entry.frames.some((frame) => !hasScopeMarker(frame.construct))) {
+      throw detachedClientFilter(`The client's ${origin.operator} condition on ${origin.path} is inside a trusted frame`);
+    }
+    if (supportsQuantifiers && !entry.frames.length && entry.form !== 'quantified' && !isEmptinessOperator(operator)) {
+      for (const relation of pathRelations(gqltype, entry.segments)) if (relation.collection && clientJ.has(relation.path) !== J.has(relation.path)) {
+        throw detachedClientFilter(`The client's ${origin.operator} condition on ${origin.path} changed aggregate join prefixes`);
+      }
+    }
     found.add(marker.id);
   }
   for (const [id, origin] of issued) {
@@ -2138,6 +2470,15 @@ const relationOnPath = (gqltype, segments) => {
   return found;
 };
 
+const scopeFilterArgs = (scopeArgs) => {
+  const kept = {};
+  for (const [name, value] of Object.entries(scopeArgs)) {
+    if (!SCOPE_IGNORED_ARGS.has(name)) kept[name] = value;
+    else if (value != null) assertScopeControlArg(name, value);
+  }
+  return kept;
+};
+
 // The find scope arguments of a type that a client's constructs read through, once per call and type
 // (`cache`): its find scope runs with empty arguments, operation 'find' and the request context, as
 // joined scopes do; its sort and pagination are checked for shape and dropped; the rest gets the final
@@ -2150,11 +2491,7 @@ const clientScopeArgs = async (typeName, context, cache) => {
   if (getScope(target?.gqltype, 'find')) {
     const scopeArgs = {};
     await executeScope({ type: target, args: scopeArgs, operation: 'find', context });
-    const kept = {};
-    for (const [name, value] of Object.entries(scopeArgs)) {
-      if (!SCOPE_IGNORED_ARGS.has(name)) kept[name] = value;
-      else if (value != null) assertScopeControlArg(name, value);
-    }
+    const kept = scopeFilterArgs(scopeArgs);
     assertStoredQueryPaths(target.gqltype, kept, 'find');
     assertQueryConditions(target.gqltype, kept, 'find');
     if (Object.values(kept).some((value) => value != null && !(Array.isArray(value) && !value.length))) result = kept;
@@ -2163,19 +2500,15 @@ const clientScopeArgs = async (typeName, context, cache) => {
   return result;
 };
 
-// The fill, on the final arguments the gate passed (`checked`). Each marked object is read at each of
-// its final positions, with its final operator and path:
-// - an emptiness condition that crosses, ends at or has as members references or collections gets a
-//   fresh `__scope: { id, scopes }`, one key per scoped join and frame path, with the union of the
-//   keys of every position when middleware placed the object at several;
-// - an emptiness condition narrowed to the record's own fields loses its marker, and is trusted;
-// - another operator loses it too, unless its path still crosses or ends at a reference or a
-//   collection: no joined scope was recorded for it, so it fails with DETACHED_CLIENT_FILTER.
-// An object that reads references at one position and none at another fails the same way, since one
-// marker cannot serve both. Every check comes before any target scope runs.
+// Preflight every final position before running target scopes: union relative keys, reject target
+// collisions and mixed reads, and retain the compiler's rejection of marked legacy predicates.
+// J collection keys are null; anchor references remain legacy joins. Keyless carriers lose their
+// marker. One per-call type cache serves all remaining keys, separately from joined-scope execution.
 const fillClientScopes = async (gqltype, checked, context, issued) => {
+  const { conditions, args, operation } = checked;
+  const J = operation === 'aggregate' ? aggregateJoinPrefixes(args.aggregation, { gqltype }) : new Set();
   const marked = new Map();
-  for (const item of checked) {
+  for (const item of conditions) {
     const { construct } = item.entry;
     if (!hasScopeMarker(construct)) continue;
     if (!marked.has(construct)) marked.set(construct, []);
@@ -2187,18 +2520,29 @@ const fillClientScopes = async (gqltype, checked, context, issued) => {
     const origin = issued.get(id);
     const targets = {};
     const unread = [];
-    for (const { entry, shape } of positions) {
-      if (!entry.emptiness) {
+    const vectors = [];
+    for (const { entry, shape, type } of positions) {
+      const relations = pathRelations(type, entry.relative);
+      if (!shape && entry.form !== 'quantified' && !ordinaryFrameCarrier(gqltype, entry, J)) {
         const relation = relationOnPath(gqltype, entry.segments);
-        if (relation) {
-          throw detachedClientFilter(`The client's ${origin.operator} condition on ${origin.path} now uses ${entry.operator} on `
-            + `${entry.path}, which reads through ${relation} without its scope`);
+        if (relation) throw detachedClientFilter(`The client's ${origin.operator} condition on ${origin.path} now uses ${entry.operator} on `
+          + `${entry.path}, which reads through ${relation} without its scope`);
+      }
+      const rootShorthand = !entry.frames.length && entry.form !== 'quantified' && !shape;
+      const anchored = rootShorthand && relations.some(({ collection, path }) => collection && J.has(path));
+      const cut = anchored ? relations.find(({ collection, path }) => collection && !J.has(path)) : null;
+      const keys = shape ? emptinessScopeTargets(shape, entry.relative) : Object.fromEntries(relations
+        .filter((relation) => !anchored || relation.collection || (cut && relation.index >= cut.index))
+        .map(({ path, typeName, collection }) => [path, rootShorthand && collection && J.has(path) ? null : typeName]));
+      for (const [key, target] of Object.entries(keys)) {
+        if (Object.hasOwn(targets, key) && targets[key] !== target) {
+          throw detachedClientFilter(`The client's ${origin.operator} condition on ${origin.path} uses ${key} for different scope targets`);
         }
-        unread.push(entry.path);
-      } else {
-        const keys = shape ? emptinessScopeTargets(shape, entry.segments) : {};
-        if (Object.keys(keys).length) Object.assign(targets, keys);
-        else unread.push(entry.path);
+        targets[key] = target;
+      }
+      if (!Object.keys(keys).length) unread.push(entry.path);
+      for (const relation of relations) if (!relation.collection && relation.insideList && Object.hasOwn(keys, relation.path)) {
+        vectors.push({ ...relation, absolute: [...entry.segments.slice(0, -entry.relative.length), ...relation.path.split('.')].join('.') });
       }
     }
     const paths = Object.keys(targets);
@@ -2206,16 +2550,16 @@ const fillClientScopes = async (gqltype, checked, context, issued) => {
       throw detachedClientFilter(`The client's ${origin.operator} condition on ${origin.path} is used where it reads `
         + `references or collections and where it reads none (${unread.join(', ')})`);
     }
-    fills.push({ construct, id, targets: paths.length ? targets : null });
+    fills.push({ construct, id, targets: paths.length ? targets : null, vectors });
   }
   const cache = new Map();
-  for (const { construct, id, targets } of fills) {
-    if (!targets) {
-      delete construct[SCOPE_MARKER];
-      continue;
-    }
+  for (const { construct, id, targets, vectors } of fills) {
+    if (!targets) { delete construct[SCOPE_MARKER]; continue; }
     const scopes = {};
-    for (const [path, typeName] of Object.entries(targets)) scopes[path] = await clientScopeArgs(typeName, context, cache);
+    for (const [path, typeName] of Object.entries(targets)) scopes[path] = typeName === null ? null : await clientScopeArgs(typeName, context, cache);
+    for (const relation of vectors) if (scopes[relation.path] !== null) {
+      throw forbiddenPath(`Query path ${relation.absolute} enters ${relation.typeName}, whose find scope restricts the relation ${relation.owner}.${relation.fieldName} inside a list`);
+    }
     construct[SCOPE_MARKER] = { id, scopes };
   }
 };
@@ -2225,8 +2569,8 @@ const fillClientScopes = async (gqltype, checked, context, issued) => {
 // the adapter compiles reference emptiness. get_by_id builds its own arguments and never runs it.
 // Returns the fill's promise, or null when no marker was issued, so that a call without one reaches
 // the adapter after as many promise jobs as before.
-const settleClientArgs = (gqltype, params, operation, issued) => {
-  if (issued) assertClientMarkers(params.args, operation, issued);
+const settleClientArgs = (gqltype, params, operation, { issued, clientJ }) => {
+  if (issued) assertClientMarkers(gqltype, params.args, operation, issued, clientJ);
   assertStoredQueryPaths(gqltype, params.args, operation);
   const checked = assertQueryConditions(gqltype, params.args, operation);
   return issued?.size ? fillClientScopes(gqltype, checked, params.context, issued) : null;
@@ -2304,6 +2648,29 @@ const loadReference = (type, id, requiredId, context) => {
   });
 };
 
+// The query arguments whose get_by_id scope function threw in findVisibleById. The error propagates
+// as it was thrown; the conflict path (reportEarlyConflict) tells it from errors of the gates and of
+// adapter.find this way. Each caller (resolveById and reportEarlyConflict) allocates fresh args
+// and calls findVisibleById exactly once with that object; never reuse marked args for another read.
+const failedByIdScopes = new WeakSet();
+
+// The record that the type's get_by_id scope shows the caller, or null. `args` holds an `id` EQ
+// condition, to which the scope adds its own; the gates check them as for every read, and adapter.find
+// reads in `session`, pinned to `requiredId`. get_by_id middleware is not run here; resolveById runs it
+// first.
+const findVisibleById = async (type, args, session, context, requiredId) => {
+  try {
+    await executeScope({ type, args, operation: 'get_by_id', context });
+  } catch (error) {
+    failedByIdScopes.add(args);
+    throw error;
+  }
+  assertStoredQueryPaths(type.gqltype, args, 'find');
+  assertQueryConditions(type.gqltype, args, 'find');
+  const results = await adapter.find(type.model, type.gqltype, args, session, { requiredId, context });
+  return results[0] || null;
+};
+
 // `requiredId` marks a generated single-reference read. Middleware still runs per call; then, when the
 // adapter reads by ID in batches, and unless the type has a get_by_id scope or middleware changed the
 // ID, the read joins the request's batch.
@@ -2317,12 +2684,7 @@ const resolveById = async (type, args, context, requiredId) => {
     }
     return adapter.getById(type.model, args.id, null, { requiredId, context });
   }
-  const queryArgs = { id: { operator: 'EQ', value: args.id } };
-  await executeScope({ type, args: queryArgs, operation: 'get_by_id', context });
-  assertStoredQueryPaths(type.gqltype, queryArgs, 'find');
-  assertQueryConditions(type.gqltype, queryArgs, 'find');
-  const results = await adapter.find(type.model, type.gqltype, queryArgs, null, { requiredId, context });
-  return results[0] || null;
+  return findVisibleById(type, { id: { operator: 'EQ', value: args.id } }, null, context, requiredId);
 };
 
 // Batched collection reads. A generated collection field reads its children with one
@@ -2713,10 +3075,13 @@ const buildMutation = (name, includedMutationTypes, includedCustomMutations) =>
               : `mutation that takes no input or an input of its own, since getInputType(${type.gqltype.name}) `
                 + 'has no fields.'));
         }
+        // A protected type is deleted at the version the client read (#98).
+        const deleteArgs = { id: { type: new GraphQLNonNull(GraphQLID) } };
+        if (isProtected(type.gqltype)) deleteArgs.version = { type: new GraphQLNonNull(RecordVersion) };
         rootQueryArgs.fields[`delete${type.simpleEntityEndpointName}`] = {
           type: type.gqltype,
           description: 'delete',
-          args: { id: { type: new GraphQLNonNull(GraphQLID) } },
+          args: deleteArgs,
           extensions: { simfinityMutation: { typeName: type.gqltype.name, operation: operations.DELETE } },
           async resolve(parent, args, context) {
             const params = {
@@ -2727,8 +3092,10 @@ const buildMutation = (name, includedMutationTypes, includedCustomMutations) =>
             };
 
             await executeMiddleware(params);
+            // A protected delete takes the version as middleware left it.
+            const target = isProtected(type.gqltype) ? { id: args.id, version: args.version } : args.id;
             return executeOperation(type.model, type.gqltype, type.controller,
-              args.id, operations.DELETE, null, null, context, null);
+              target, operations.DELETE, null, null, context, null);
           },
         };
       }
@@ -2820,7 +3187,7 @@ const buildMutation = (name, includedMutationTypes, includedCustomMutations) =>
 // without one still reaches the adapter after as many promise jobs as before it was shared.
 const prepareRead = async (type, args, context, operation, { entry, extend } = {}) => {
   const joinedScopes = inspectClientPaths(type.gqltype, args, operation);
-  const issued = markClientConstructs(assertQueryConditions(type.gqltype, args, operation));
+  const issued = markClientConstructs(assertQueryConditions(type.gqltype, args, operation), { aggregation: args.aggregation });
   const params = entry === undefined
     ? { type, args, operation, context }
     : { type, args, operation, entry, context };
@@ -2869,13 +3236,13 @@ const splitViewArgs = (paramNames, args) => {
 
 const invalidWhere = (view, detail) => new SimfinityError(`View ${view.name} where ${detail}`, 'INVALID_VIEW', 500);
 
-// The groups a view's `where` returned are plain objects whose `conditions`, `AND` and `OR`, when set,
+// The groups a view's `where` returned are plain objects whose condition and Boolean/quantified lists, when set,
 // are arrays: of plain objects with a field name, and of groups like these. collectQueryPathEntries
 // skips anything else silently, so this comes before their paths are read. Only the GraphQL input
-// fields are structural keys; condition values stay opaque. A condition never carries a client scope
-// marker key: only the runtime writes one. Active ancestors reject cycles without rejecting reuse.
-const assertViewGroupShapes = (view, groups, ancestors = new Set()) => {
-  const groupFields = QLFilterGroup.getFields();
+// fields are structural keys; condition values stay opaque. Conditions and quantified groups never
+// carry a client scope marker key: only the runtime writes one. Active ancestors reject cycles without rejecting reuse.
+const assertViewGroupShapes = (view, groups, ancestors = new Set(), quantified = false) => {
+  const groupFields = (quantified ? QLQuantifiedGroup : QLFilterGroup).getFields();
   const conditionFields = QLFilterCondition.getFields();
   for (const group of groups) {
     if (!isNonNullPlainObject(group)) throw invalidWhere(view, 'returned a group that is not a plain object');
@@ -2883,7 +3250,11 @@ const assertViewGroupShapes = (view, groups, ancestors = new Set()) => {
     for (const key of Object.keys(group)) {
       if (!Object.hasOwn(groupFields, key)) throw invalidWhere(view, `returned a group with unknown key ${key}`);
     }
+    if (quantified && (typeof group.path !== 'string' || group.path.length === 0)) {
+      throw invalidWhere(view, 'returned a quantified group without a non-empty path');
+    }
     for (const key of Object.keys(groupFields)) {
+      if (key === 'path') continue;
       if (group[key] != null && !Array.isArray(group[key])) throw invalidWhere(view, `returned a group whose ${key} is not an array`);
     }
     for (const condition of group.conditions ?? []) {
@@ -2899,6 +3270,7 @@ const assertViewGroupShapes = (view, groups, ancestors = new Set()) => {
     }
     ancestors.add(group);
     assertViewGroupShapes(view, [...(group.AND ?? []), ...(group.OR ?? [])], ancestors);
+    for (const key of QUANTIFIED_LISTS) assertViewGroupShapes(view, group[key] ?? [], ancestors, true);
     ancestors.delete(group);
   }
 };
@@ -3317,6 +3689,108 @@ const warnUndeclaredVirtualFields = () => {
   }
 };
 
+// The types a model stores: the registered types and the embedded types they reach at any depth,
+// readOnly fields included, as assertPlainConnectionFields visits them.
+const collectStoredTypes = () => {
+  const stored = new Set();
+  const visit = (gqltype) => {
+    if (stored.has(gqltype)) return;
+    stored.add(gqltype);
+    for (const field of Object.values(gqltype.getFields())) {
+      const named = field.extensions?.relation?.embedded && getNamedType(field.type);
+      if (named instanceof GraphQLObjectType) visit(named);
+    }
+  };
+  for (const { gqltype } of Object.values(typesDict.types)) visit(gqltype);
+  return [...stored];
+};
+
+const invalidModel = (message) => new SimfinityError(message, 'INVALID_MODEL', 400);
+
+// Optimistic concurrency (#98), declared per type with `extensions.concurrency`. These checks run in
+// this order, after stored identities are known and before adapter.prepare(), so a rejected schema
+// changes nothing. `applicationTypes` are the roots of the schema's types. Returns the registrations of
+// the protected types and whether the included roots reserve the version names.
+const assertConcurrencyDeclarations = (applicationTypes) => {
+  const registrations = Object.values(typesDict.types);
+  // The shape of every declaration.
+  const protectedTypes = registrations.filter(({ gqltype }) => concurrencyDeclared(gqltype));
+  // Generated inputs, models and stored data follow the protection a type had when the first schema
+  // containing it was created, and an injected field is never removed, so neither can change later.
+  // Inputs or a model that an earlier createSchema() built without the field also fix protection,
+  // even if the call failed afterwards; a model supplied to connect() does not.
+  for (const registration of registrations) {
+    const { gqltype } = registration;
+    const declared = protectedTypes.includes(registration);
+    const builtWithoutField = !isProtected(gqltype)
+      && (!!registration.inputType || generatedModels.has(registration.model));
+    if (declared && protectionStatus.get(gqltype) === false) {
+      throw invalidModel(`${gqltype.name} declares optimistic concurrency after a schema was created without it; `
+        + `declare it before the first createSchema() that contains ${gqltype.name}`);
+    }
+    if (declared && builtWithoutField) {
+      throw invalidModel(`${gqltype.name} declares optimistic concurrency after its inputs or generated model were built without it; `
+        + `declare it before the first createSchema() attempt that builds ${gqltype.name}`);
+    }
+    if (!declared && isProtected(gqltype)) {
+      throw invalidModel(`${gqltype.name} no longer declares optimistic concurrency, but Simfinity already added its `
+        + 'version field; keep extensions.concurrency on a type once it has that field');
+    }
+  }
+  // Another runtime that registers a protected type injects its field when that runtime creates a
+  // schema, which would change a schema already built here, so this schema must register every
+  // protected type it contains, whatever the adapter supports.
+  const reachedTypes = collectOutputTypes(applicationTypes);
+  for (const type of reachedTypes) {
+    if (type instanceof GraphQLObjectType && typesDict.types[type.name]?.gqltype !== type && isProtectedType(type)) {
+      throw invalidModel(`${type.name} declares optimistic concurrency, so a schema that contains it must register it `
+        + 'in this runtime, with connect() or as a relation target');
+    }
+  }
+  // An embedded value's changes belong to the revision of the record that embeds it, wherever a model
+  // stores it.
+  const storedTypes = collectStoredTypes();
+  const storedFields = storedTypes.flatMap((gqltype) => Object.entries(gqltype.getFields())
+    .map(([fieldName, field]) => ({ gqltype, fieldName, field })));
+  for (const { gqltype, fieldName, field } of storedFields) {
+    const named = field.extensions?.relation?.embedded && getNamedType(field.type);
+    if (named instanceof GraphQLObjectType && isProtectedType(named)) {
+      throw invalidModel(versionEmbeddedMisuse(named.name, `${gqltype.name}.${fieldName}`));
+    }
+  }
+  // Only an entity has a record of its own whose version can advance.
+  const nonEntity = protectedTypes.find(({ storedIdentity }) => storedIdentity !== true);
+  if (nonEntity) {
+    throw invalidModel(`${nonEntity.gqltype.name} declares optimistic concurrency, so it must be an entity: register it `
+      + 'with connect() or make it a relation target');
+  }
+  // Nothing else may be stored, or link records, under the version field's name.
+  for (const { gqltype } of protectedTypes) {
+    const collision = versionFieldCollision(gqltype);
+    if (collision) throw invalidModel(collision);
+  }
+  for (const { gqltype, fieldName, field } of storedFields) {
+    const collision = versionConnectionCollision(gqltype, fieldName, field);
+    if (collision) throw invalidModel(collision);
+  }
+  // RecordVersion types managed version fields only, with or without protected types; registered
+  // operations may still use it in their own input and output types.
+  for (const gqltype of storedTypes) {
+    const misuse = recordVersionFieldMisuse(gqltype);
+    if (misuse) throw invalidModel(misuse);
+  }
+  const reserveVersionNames = protectedTypes.some(({ gqltype }) => reachedTypes.includes(gqltype));
+  if (protectedTypes.length && !writeFeatures.optimisticConcurrency) {
+    throw invalidModel(`The database adapter does not support optimistic concurrency, which ${protectedTypes[0].gqltype.name} `
+      + 'declares (extensions.concurrency)');
+  }
+  // A clash that only generated types or the fields of an input object reach is found when the schema
+  // is constructed.
+  const clash = reserveVersionNames && versionTypeClash(applicationTypes, { inputFields: false });
+  if (clash) throw reservedVersionTypeNameError(clash);
+  return { protectedTypes, reserveVersionNames };
+};
+
 const getRegistrations = () => Object.values(typesDict.types);
 
 const includedOperationTypes = (registrations, includedOperations) => Object.entries(registrations)
@@ -3324,7 +3798,8 @@ const includedOperationTypes = (registrations, includedOperations) => Object.ent
   .flatMap(([, { inputModel, outputModel }]) => [inputModel, outputModel].filter(Boolean));
 
 // Application types that a schema with these allowlists contains, whatever else it reaches: the
-// endpoint types of its queries and mutations, and the input and output types of its custom operations.
+// endpoint types of its queries and mutations, the input and output types of its custom operations,
+// and the scalar/enum parameters of included named views.
 const includedApplicationTypes = (includedQueryTypes, includedMutationTypes, includedCustomMutations, includedCustomQueries) => [
   ...Object.values(typesDict.types)
     .filter((type) => type.endpoint
@@ -3333,6 +3808,9 @@ const includedApplicationTypes = (includedQueryTypes, includedMutationTypes, inc
     .map((type) => type.gqltype),
   ...includedOperationTypes(registeredMutations, includedCustomMutations),
   ...includedOperationTypes(registeredQueries, includedCustomQueries),
+  ...Object.values(registeredViews)
+    .filter(({ type }) => !shouldNotBeIncludedInSchema(includedQueryTypes, type))
+    .flatMap(({ params }) => Object.values(params).map(({ type }) => getNamedType(type))),
 ];
 
 const queryNameConflict = (name) => new SimfinityError(
@@ -3374,7 +3852,9 @@ const assertViewsAvailable = (includedQueryTypes, includedCustomQueries) => {
       if (!/^[_A-Za-z][_0-9A-Za-z]*$/.test(paramName) || paramName.startsWith('__')) {
         throw invalidView(`${name} param ${paramName} requires a valid GraphQL name that does not start with __`);
       }
-      if (Object.hasOwn(fields, paramName)) {
+      // A protected type's managed version is injected later in createSchema(), but its name is
+      // already unavailable to view params on the first schema, as on every subsequent schema.
+      if (Object.hasOwn(fields, paramName) || (paramName === 'version' && isProtectedType(type))) {
         throw invalidView(`${name} param ${paramName} has the name of a field of ${type.name}`);
       }
       if (LIST_QUERY_ARGS.includes(paramName)) {
@@ -3428,16 +3908,21 @@ const createSchema = (includedQueryTypes, includedMutationTypes, includedCustomM
   // An application type with the name of a field metadata type that an earlier schema fixed; one that
   // only generated types or the fields of an input object reach is found when the schema is
   // constructed.
-  assertFieldMetadataNamesFree(includedApplicationTypes(includedQueryTypes, includedMutationTypes,
-    includedCustomMutations, includedCustomQueries));
+  const applicationTypes = includedApplicationTypes(includedQueryTypes, includedMutationTypes,
+    includedCustomMutations, includedCustomQueries);
+  assertFieldMetadataNamesFree(applicationTypes);
   const referencedTypes = markReferencedTypesForModelGeneration();
   // Entities, which keep their own stored identity: connect() types and relation targets.
   Object.values(typesDict.types).forEach((typeInfo) => {
     typeInfo.storedIdentity = typeInfo.endpoint === true || referencedTypes.has(typeInfo);
   });
+  const { protectedTypes, reserveVersionNames } = assertConcurrencyDeclarations(applicationTypes);
   if (adapter.prepare) {
     adapter.prepare(getRegistrations(), { createCollection: !preventCollectionCreation });
   }
+  // prepare() describes protected types from their declaration. Models, inputs, resolvers and query
+  // arguments are built from here on, so they all see the field.
+  protectedTypes.forEach(({ gqltype }) => injectVersionField(gqltype));
 
   Object.values(typesDict.types).forEach((typeInfo) => {
     if (typeInfo.gqltype && !typeInfo.model) {
@@ -3448,6 +3933,8 @@ const createSchema = (includedQueryTypes, includedMutationTypes, includedCustomM
       } else if (typeInfo.needsModel) {
         typeInfo.model = adapter.createModel(typeInfo.gqltype, null, { createCollection: false });
       }
+      const { model } = typeInfo;
+      if (model !== null && (typeof model === 'object' || typeof model === 'function')) generatedModels.add(model);
     }
   });
 
@@ -3492,7 +3979,7 @@ const createSchema = (includedQueryTypes, includedMutationTypes, includedCustomM
       includedCustomQueries);
   }
 
-  const schema = constructSchema(query, mutation);
+  const schema = constructSchema(query, mutation, reserveVersionNames);
   // Reserve reachable types whose relation fields still have no resolver, such as an unregistered
   // custom operation result, so another runtime cannot later generate resolvers this schema executes.
   schemaTypes.forEach((type) => {
@@ -3500,6 +3987,10 @@ const createSchema = (includedQueryTypes, includedMutationTypes, includedCustomM
       runtimeBoundTypes.set(type, runtimeIdentity);
     }
   });
+  // The schema exists, so each registered type's protection is fixed from now on.
+  Object.values(typesDict.types).forEach(({ gqltype }) => {
+    if (!protectionStatus.has(gqltype)) protectionStatus.set(gqltype, isProtected(gqltype));
+  });
   return schema;
 };
 
@@ -3721,6 +4212,8 @@ const connect = (model, gqltype, simpleEntityEndpointName,
   };
   assertNotBoundElsewhere(gqltype);
   validateScope(gqltype);
+  // The declaration's shape only; it reads extensions, never the fields (#98).
+  concurrencyDeclared(gqltype);
   if (adapter.validateRegistration) adapter.validateRegistration(registration);
 
   invalidateCollectionInputs(gqltype);
@@ -3751,6 +4244,7 @@ const addNoEndpointType = (gqltype) => {
     gqltype, endpoint: false, model: null, needsModel,
   };
   validateScope(gqltype);
+  concurrencyDeclared(gqltype);
   if (adapter.validateRegistration) adapter.validateRegistration(registration);
 
   invalidateCollectionInputs(gqltype);
@@ -3764,7 +4258,9 @@ const LIST_QUERY_ARGS = ['pagination', 'sort', 'AND', 'OR'];
 
 // `omit` is a collection's back-reference field, which its parent supplies, so it gets no filter.
 // A field named like a generated argument gets no top-level filter either; it is reported once.
-// A virtual field is not part of the query language, so it gets no filter at all.
+// A virtual field is not part of the query language, so it gets no filter at all, and neither does the
+// version field of a protected type (#98): a MongoDB record without a stored version reads as 1, which
+// a filter could not match.
 const createArgsForQuery = (gqltype, omit = null) => {
     const argsObject = {};
     const argTypes = gqltype.getFields();
@@ -3777,7 +4273,7 @@ const createArgsForQuery = (gqltype, omit = null) => {
     }
 
     for (const [fieldEntryName, fieldEntry] of Object.entries(argTypes)) {
-      if (fieldEntryName === omit || isVirtualField(fieldEntry)) continue;
+      if (fieldEntryName === omit || isVirtualField(fieldEntry) || isVersionField(fieldEntry)) continue;
       let filterType = null;
 
       if (fieldEntry.type instanceof GraphQLScalarType