harper 5.3.2 → 5.3.4

package/resources/LMDBTransaction.ts

@@ -70,6 +70,7 @@ export class LMDBTransaction extends DatabaseTransaction {
 		this.readTxn = (this.db as any).useReadTransaction();
 
 		this.readTxnsUsed = 1;
+		this.readTxnGeneration++;
 		this.baseReadRefConsumed = false;
 		if ((this.readTxn as any).openTimer) (this.readTxn as any).openTimer = 0;
 		trackedTxns.add(this as any);
@@ -89,8 +90,8 @@ export class LMDBTransaction extends DatabaseTransaction {
 		return this.readTxn;
 	}
 
-	doneReadTxn() {
-		if (!this.readTxn) return;
+	doneReadTxn(generation = this.readTxnGeneration) {
+		if (!this.readTxn || generation !== this.readTxnGeneration) return;
 		if (this.readTxn instanceof RocksTransaction) {
 			// TODO: Implement this for RocksDB
 		} else {
@@ -434,7 +435,7 @@ export class LMDBTransaction extends DatabaseTransaction {
 					this.baseReadRefConsumed = true;
 				}
 			} else {
-				while (this.readTxnsUsed > 0) this.doneReadTxn(); // release the read snapshot when we abort, we assume we don't need it
+				while (this.readTxn && this.readTxnsUsed > 0) this.doneReadTxn(); // release the read snapshot when we abort, we assume we don't need it
 			}
 			this.open = TRANSACTION_STATE.CLOSED;
 			this.drainCompletions();

package/resources/Resource.ts

@@ -1099,7 +1099,7 @@ export function allowedMethods(resource: any) {
  */
 function selectFromObject(object, propertyResolvers, context) {
 	// TODO: eventually we will do aggregate functions here
-	const record = object.getRecord?.();
+	const record = typeof object.getRecord === 'function' ? object.getRecord() : undefined;
 	if (record) {
 		const ownData = object.getChanges?.();
 		return (property) => {
@@ -1109,25 +1109,36 @@ function selectFromObject(object, propertyResolvers, context) {
 			}
 			if (ownData && property in ownData) {
 				return ownData[property];
-			} else if ((resolver = propertyResolvers?.[property])) {
+			} else if (
+				propertyResolvers &&
+				Object.hasOwn(propertyResolvers, property) &&
+				(resolver = propertyResolvers[property])
+			) {
 				return resolver(object, context);
 			} else return record[property];
 		};
 	} else if (propertyResolvers) {
 		return (property) => {
-			const resolver = propertyResolvers[property];
-			return resolver ? resolver(object, context) : object[property];
+			const resolver = Object.hasOwn(propertyResolvers, property) ? propertyResolvers[property] : undefined;
+			if (resolver) return resolver(object, context);
+			const value = object[property];
+			return typeof value === 'function' ? undefined : value;
+		};
+	} else
+		return (property) => {
+			const value = object[property];
+			return typeof value === 'function' ? undefined : value;
 		};
-	} else return (property) => object[property];
 }
 export function transformForSelect(select, resource) {
-	const propertyResolvers = resource.propertyResolvers;
-	const context = resource.getContext?.();
+	const propertyResolvers = resource?.propertyResolvers;
+	const context = resource?.getContext?.();
 	let subTransforms;
 	if (typeof select === 'string')
 		// if select is a single string then return property value
 		return function transform(object) {
-			if (object.then) return object.then(transform);
+			if (object == null || (!resource && typeof object !== 'object')) return object;
+			if (typeof object.then === 'function') return object.then(transform);
 			if (Array.isArray(object)) return object.map(transform);
 			return selectFromObject(object, propertyResolvers, context)(select);
 		};
@@ -1135,7 +1146,8 @@ export function transformForSelect(select, resource) {
 		// if it is an array, return an array
 		if (select.asArray)
 			return function transform(object) {
-				if (object.then) return object.then(transform);
+				if (object == null || (!resource && typeof object !== 'object')) return object;
+				if (typeof object.then === 'function') return object.then(transform);
 				if (Array.isArray(object)) return object.map(transform);
 				const results = [];
 				const getProperty = handleProperty(selectFromObject(object, propertyResolvers, context));
@@ -1145,18 +1157,27 @@ export function transformForSelect(select, resource) {
 				return results;
 			};
 		const forceNulls = select.forceNulls;
+		const selectsPrototype = select.some((property) => (property.name || property) === '__proto__');
 		return function transform(object) {
-			if (object.then) return object.then(transform);
+			if (object == null || (!resource && typeof object !== 'object')) return object;
+			if (typeof object.then === 'function') return object.then(transform);
 			if (Array.isArray(object))
 				return object.map((value) => (value && typeof value === 'object' ? transform(value) : value));
 			// finally the case of returning objects
 			const selectedData = {};
 			const getProperty = handleProperty(selectFromObject(object, propertyResolvers, context));
+			if (selectsPrototype)
+				Object.defineProperty(selectedData, '__proto__', {
+					value: undefined,
+					writable: true,
+					enumerable: true,
+					configurable: true,
+				});
 			let promises;
 			for (const property of select) {
 				let value = getProperty(property);
 				if (value === undefined && forceNulls) value = null;
-				if (value?.then) {
+				if (typeof value?.then === 'function') {
 					if (!promises) promises = [];
 					promises.push(value.then((value) => (selectedData[property.name || property] = value)));
 				} else selectedData[property.name || property] = value;
@@ -1172,14 +1193,18 @@ export function transformForSelect(select, resource) {
 			} else if (typeof property === 'object') {
 				// TODO: Handle aggregate functions
 				if (property.name) {
-					if (!subTransforms) subTransforms = {};
+					const value = getProperty(property.name);
+					if (!value || typeof value !== 'object' || value instanceof Date) return value;
+					if (!subTransforms) subTransforms = Object.create(null);
 					// TODO: Get the resource, cache this transform, and apply above
 					let transform = subTransforms[property.name];
 					if (!transform) {
-						const resource = propertyResolvers[property.name]?.definition?.tableClass;
+						const resource =
+							propertyResolvers && Object.hasOwn(propertyResolvers, property.name)
+								? propertyResolvers[property.name]?.definition?.tableClass
+								: undefined;
 						transform = subTransforms[property.name] = transformForSelect(property.select || property, resource);
 					}
-					const value = getProperty(property.name);
 					return transform(value);
 				} else return getProperty(property);
 			} else return property;

package/resources/RocksTransactionLogStore.ts

@@ -167,6 +167,7 @@ export class RocksTransactionLogStore extends EventEmitter {
 			};
 		}
 		log.addEntry(entryBinary, options.transaction.id);
+		options.transaction.hasStagedLog = true;
 	}
 
 	/** A log holds one origin, which keeps `txnLogKey` unique within it; see resources/DESIGN.md. */

package/resources/Table.ts

@@ -261,6 +261,8 @@ const MAX_CONCURRENT_LMDB_HISTORY_REMOVALS = 1000;
 // Each evict otherwise pays a full transaction commit, so batching amortizes that cost. LMDB already
 // coalesces async writes per event turn (eventTurnBatching), so it keeps the per-record path.
 const EVICTION_BATCH_SIZE = 100;
+const COMMITTED_READ = { uncachedRead: true };
+const UNRESOLVED = Symbol('unresolved');
 // Cap on eviction-batch commits in flight at once, so commit I/O overlaps scan/staging without
 // letting an unbounded number of open transactions (and their snapshots) accumulate.
 const MAX_INFLIGHT_EVICTION_BATCHES = 4;
@@ -3796,10 +3798,23 @@ export function makeTable(options): TableResourceClass {
 					(this.constructor as any).source?.relocate && !(context as any)?.source
 						? (this.constructor as any).source.relocate.bind((this.constructor as any).source, id, undefined, context)
 						: undefined,
-				commit: (txnTime, existingEntry, _retry, transaction: any) => {
+				commit: (txnTime, existingEntry, _retry, transaction: any, committedBy?: DatabaseTransaction) => {
 					const txnLogKey =
 						isRocksDB && options?.version != null ? (transaction?.getTimestamp?.() ?? txnTime) : txnTime;
-					if (precedesExistingVersion(txnTime, existingEntry, options?.nodeId) < 0) return;
+					write.skipped = false;
+					const precedesExisting = precedesExistingVersion(txnTime, existingEntry, options?.nodeId);
+					if (precedesExisting < 0) return;
+					if (
+						// a re-delivered relocate would restamp the committed head, which can be another write of its transaction
+						precedesExisting === 0 &&
+						committedBy?.sourceApply &&
+						isRocksDB &&
+						txnLogKey === txnTime &&
+						isHeadIdentity(identityBase(write, existingEntry, committedBy), txnTime, options?.nodeId)
+					) {
+						write.skipped = true;
+						return;
+					}
 					const residency = TableResource.getResidencyRecord(options.residencyId);
 					let metadata = 0;
 					let newRecord = null;
@@ -4331,7 +4346,9 @@ export function makeTable(options): TableResourceClass {
 			return this;
 		}
 		/**
-		 * Release the lock this instance holds. Resolves true when this call cleared the native key lock.
+		 * Release the lock this instance holds. Resolves true when this call cleared the native key lock;
+		 * false when it was already released, or when a commit of this lock's writes is still in flight
+		 * and the native key is returned once that commit settles.
 		 * Works for both held (`{ hold: true }`) and transaction-scoped locks. After unlock() the
 		 * instance is no longer lock-writable; writes through it require a fresh lock.
 		 */
@@ -4639,16 +4656,20 @@ export function makeTable(options): TableResourceClass {
 					}
 				},
 				before: writeToSource(),
-				commit: (txnTime: number, existingEntry: Entry, retry: boolean, transaction: any) => {
-					// Whether a prior attempt of THIS write appended its own audit entry (sticky, set in
-					// save(); log entries are not part of the aborted rocks transaction, so they survive).
-					// Only such a write can find its own orphaned entry in the dedup lookups below and must
-					// not treat it as "already applied". Per-write on purpose: the transaction-wide retry
-					// flag would also suppress dedup for a genuine re-delivered duplicate co-batched with
-					// the conflicting write (double-applying it) and for fresh writes staged through a
-					// reused transaction whose retries counter is stale. Sticky on purpose: a proxy read
-					// from the last attempt's skipped state launders when a recommit round self-skips
-					// (walk identity tie against its own staged record) before a fresh-transaction replay.
+				commit: (
+					txnTime: number,
+					existingEntry: Entry,
+					retry: boolean,
+					transaction: any,
+					committedBy?: DatabaseTransaction
+				) => {
+					// Whether a prior attempt of THIS write appended its audit entry (sticky, set in
+					// save()). A retry cannot infer that its record mutation committed from an exact log
+					// match alone, so keyed probes stay shielded and walk skips require committed provenance.
+					// Per-write: a transaction-wide retry flag would also suppress dedup for unrelated
+					// deliveries co-batched with the conflict or fresh writes in a reused transaction.
+					// Sticky: a proxy read from the last attempt's skipped state launders when a recommit
+					// round self-skips (walk identity tie against its own staged record) before a replay.
 					const stagedOwnAuditEntry = retry && write.appendedAuditEntry === true;
 					write.skipped = false; // reset on each retry; cleanup happens after commit if still true
 					write.stagedEntry = undefined; // likewise: only set once this round actually stores a record
@@ -4730,6 +4751,22 @@ export function makeTable(options): TableResourceClass {
 						let belowAuditFloor = false;
 						let dedupVersionCouldBeRetained: (version: number) => boolean;
 						if (audit) {
+							let identityRecord: Partial<Entry> | undefined | typeof UNRESOLVED = UNRESOLVED;
+							if (
+								committedBy?.sourceApply &&
+								isRocksDB &&
+								!replaying &&
+								precedesExisting === 0 &&
+								txnLogKey === txnTime &&
+								isHeadIdentity(
+									(identityRecord = identityBase(write, existingEntry, committedBy)),
+									txnTime,
+									options?.nodeId
+								)
+							) {
+								write.skipped = true;
+								return;
+							}
 							// A re-delivered out-of-order write (full-copy audit-replay re-delivers writes) must not have
 							// its commutative ops re-folded. additionalAuditRefs is the record's own list of folded
 							// out-of-order versions, read with read-your-writes consistency, so this skips the duplicate up
@@ -4743,7 +4780,10 @@ export function makeTable(options): TableResourceClass {
 							// === 0 is the identity tie: same version AND same node (the local node is id 0, so an undefined
 							// options?.nodeId resolves to the same 0 the ref stored).
 							if (
-								existingEntry.additionalAuditRefs?.some(
+								(identityRecord === UNRESOLVED
+									? identityBase(write, existingEntry, committedBy)
+									: identityRecord
+								)?.additionalAuditRefs?.some(
 									(ref) =>
 										ref.version === txnLogKey &&
 										precedesExistingVersion(
@@ -4801,11 +4841,7 @@ export function makeTable(options): TableResourceClass {
 							// RocksDB-only: LMDB audit entries are keyed by local audit time, so this lookup doesn't apply
 							// there (LMDB keeps the exact unbounded walk). A miss (the keyed lookup can lag a back-to-back re-delivery — #1137)
 							// simply falls through to the walk, so this never changes correctness; the additionalAuditRefs
-							// check above remains the read-your-writes guard. Never when this write staged in a prior
-							// failed attempt: that attempt already appended this write's own audit entry, so the lookup
-							// would find it and skip the write as "already applied" when the record was never committed.
-							// A recommit of the same transaction survived that skip only because the old write batch
-							// still carried the put; a fresh-transaction replay (ERR_TRY_AGAIN) would drop the write.
+							// check above remains the read-your-writes guard. Not on a same-write retry (see stagedOwnAuditEntry).
 							if (isRocksDB && !replaying && !stagedOwnAuditEntry && dedupVersionCouldBeRetained(txnLogKey)) {
 								const priorAudit = auditStore.get(txnLogKey, tableId, id, options?.nodeId);
 								if (
@@ -4857,10 +4893,21 @@ export function makeTable(options): TableResourceClass {
 							// `previousNodeId` is never encoded, so absent there means the log is unknown and only the
 							// aggregate lookup can resolve a cross-origin predecessor.
 							let nodeId = initialAuditHead.nodeId ?? 0;
+							// A retry can load a base restamped by an earlier saved publish/relocate from this
+							// transaction. Those writes do not set stagedEntry, so priorStaged alone cannot
+							// establish that the base is committed.
+							const retryBaseIsCommitted =
+								!priorStaged && !(stagedOwnAuditEntry && hasSavedSameKeySibling(write, committedBy));
+							let walkOriginKnown = retryBaseIsCommitted;
 							const succeedingUpdates = []; // record the "future" updates, as we need to apply the updates in reverse order
-							const auditRefsToVisit: Array<{ localTime: number; nodeId: number }> = existingEntry.additionalAuditRefs
-								? existingEntry.additionalAuditRefs.map((ref) => ({ localTime: ref.version, nodeId: ref.nodeId }))
-								: [];
+							const auditRefsToVisit: Array<{ localTime: number; nodeId: number; originKnown: boolean }> =
+								existingEntry.additionalAuditRefs
+									? existingEntry.additionalAuditRefs.map((ref) => ({
+											localTime: ref.version,
+											nodeId: ref.nodeId,
+											originKnown: retryBaseIsCommitted,
+										}))
+									: [];
 
 							// Out-of-order merges retain every existing branch head; per-origin log keys are not globally ordered.
 							if (existingEntry.additionalAuditRefs) {
@@ -4869,13 +4916,13 @@ export function makeTable(options): TableResourceClass {
 								}
 							}
 							let addedAuditRef = false;
-							let nextRef: { localTime: number; nodeId: number };
+							let nextRef: { localTime: number; nodeId: number; originKnown: boolean };
 							const visitedAuditRefs = new Set<string>();
-							const queuePreviousAuditRefs = (auditRecord) => {
+							const queuePreviousAuditRefs = (auditRecord, originKnown: boolean) => {
 								const previousRefs = auditRecord.previousAdditionalAuditRefs;
 								if (previousRefs) {
 									for (const ref of previousRefs) {
-										auditRefsToVisit.push({ localTime: ref.version, nodeId: ref.nodeId });
+										auditRefsToVisit.push({ localTime: ref.version, nodeId: ref.nodeId, originKnown });
 										logger.debug?.('Adding audit ref from audit record to visit queue', {
 											version: ref.version,
 											nodeId: ref.nodeId,
@@ -4891,6 +4938,7 @@ export function makeTable(options): TableResourceClass {
 										: { txnLogKey: auditRecord.previousVersion, nodeId: auditRecord.previousNodeId };
 								localTime = previousHead.txnLogKey;
 								nodeId = previousHead.nodeId;
+								walkOriginKnown = walkOriginKnown && previousHead.nodeId != null;
 							};
 							let walkSteps = 0;
 							let auditWalkCapped = false;
@@ -4906,9 +4954,7 @@ export function makeTable(options): TableResourceClass {
 							// A re-delivered write whose exact (version, nodeId) is already in the audit log was already
 							// applied; drop it rather than re-applying it (double-applying commutative ops) or writing a
 							// duplicate audit-only record. Used by the early-out and the depth-cap block below.
-							// Never a duplicate for a write that staged in a prior failed attempt: that attempt already
-							// appended this write's own audit entry, so the lookup would match it while the record was
-							// never committed (see the up-front keyed dedup above).
+							// Not for a same-write retry (see stagedOwnAuditEntry).
 							const isReDeliveredDuplicate = () => {
 								if (replaying || stagedOwnAuditEntry) return false;
 								if (!dedupVersionCouldBeRetained(txnLogKey)) return false; // pre-retention log key — skip the end-of-log scan (best-effort; see above)
@@ -4938,17 +4984,15 @@ export function makeTable(options): TableResourceClass {
 									}
 									const auditRecord = auditStore.get(localTime, tableId, id, nodeId);
 									if (!auditRecord) break;
-									queuePreviousAuditRefs(auditRecord);
+									queuePreviousAuditRefs(auditRecord, walkOriginKnown);
 									if (
 										isRocksDB &&
 										!replaying &&
-										!stagedOwnAuditEntry &&
+										// on a retry only a link from committed state proves the write committed: an
+										// orphaned log entry can match the identity but is never linked from a committed record
+										(!stagedOwnAuditEntry || walkOriginKnown) &&
 										localTime === txnLogKey &&
-										precedesExistingVersion(
-											txnTime,
-											{ version: txnTime, localTime: txnLogKey, key: id, nodeId: auditRecord.nodeId },
-											options?.nodeId
-										) === 0
+										(auditRecord.nodeId ?? 0) === (options?.nodeId ?? getThisNodeId(auditStore))
 									) {
 										write.skipped = true;
 										return;
@@ -4966,9 +5010,8 @@ export function makeTable(options): TableResourceClass {
 													// Same origin and record version, but a distinct write. Its per-origin log key
 													// orders the otherwise non-unique record clock without comparing keys across origins.
 													precedesExisting = txnLogKey > localTime ? 1 : -1;
-												} else if (replaying || stagedOwnAuditEntry) {
-													// The log entry being replayed (or staged by this write's failed attempt) is
-													// the write itself, not proof that its primary-store mutation committed.
+												} else if (replaying || (stagedOwnAuditEntry && !walkOriginKnown)) {
+													// replayed, or reached on a retry without committed provenance: not proof it committed
 													precedesExisting = 1;
 												} else {
 													logger.debug?.(
@@ -5054,6 +5097,7 @@ export function makeTable(options): TableResourceClass {
 								if (nextRef) {
 									localTime = auditedVersion = nextRef.localTime;
 									nodeId = nextRef.nodeId;
+									walkOriginKnown = nextRef.originKnown;
 									logger.debug?.('Following additional audit ref to continue scanning', { localTime, nodeId });
 								}
 							} while (nextRef);
@@ -5947,6 +5991,7 @@ export function makeTable(options): TableResourceClass {
 			// scans), the read transaction reads against the latest committed data without pinning a
 			// consistent snapshot, so the scan doesn't hold a snapshot that blocks compaction.
 			const readTxn = txn.useReadTxn(target.snapshot === false);
+			const readTxnGeneration = txn.readTxnGeneration;
 			// The explicit row filter participates in query execution: it is pushed into HNSW
 			// traversal for vector sorts, applied after conditions otherwise, and checked again after
 			// cache/source materialization below. A policy error aborts the query instead of silently
@@ -6089,7 +6134,7 @@ export function makeTable(options): TableResourceClass {
 						} finally {
 							// We own the iteration here (no results.onDone consumer), so release the read
 							// transaction unconditionally — including when the drain throws — or the snapshot leaks.
-							txn.doneReadTxn();
+							if (readTxn) txn.doneReadTxn(readTxnGeneration);
 						}
 						let total: number | null;
 						if (wantExact) {
@@ -6129,7 +6174,7 @@ export function makeTable(options): TableResourceClass {
 				results.onDone = () => {
 					results.onDone = null; // ensure that it isn't called twice
 					txn.unregisterReadIterator(results);
-					txn.doneReadTxn();
+					if (readTxn) txn.doneReadTxn(readTxnGeneration);
 				};
 				// Recorded ownership: if the request dies before anything consumes these results, the
 				// transaction closes them itself rather than leaving its read snapshot pinned.
@@ -6138,7 +6183,7 @@ export function makeTable(options): TableResourceClass {
 				results.getColumns = getColumns;
 				return results;
 			} catch (error) {
-				txn.doneReadTxn();
+				if (readTxn) txn.doneReadTxn(readTxnGeneration);
 				throw error;
 			}
 		}
@@ -7932,6 +7977,7 @@ export function makeTable(options): TableResourceClass {
 				},
 			};
 			propertyResolvers.$highlights.directReturn = true;
+			primaryKeyAttribute = undefined;
 			for (const attribute of this.attributes) {
 				if (attribute.isPrimaryKey) primaryKeyAttribute = attribute;
 				attribute.resolve = null; // reset this
@@ -9102,6 +9148,39 @@ export function makeTable(options): TableResourceClass {
 		if (!(existingEntry?.metadataFlags & INVALIDATED)) return existingEntry;
 	}
 
+	// The commit base is the committed record unless another write to the key already saved without being
+	// skipped this round: a publish or relocate saves when it is added and restamps the base without staging it.
+	function identityBase(write: any, existingEntry: Entry, transaction: DatabaseTransaction | undefined) {
+		if (hasSavedSameKeySibling(write, transaction)) return committedEntry(write.key);
+		return existingEntry;
+	}
+
+	function hasSavedSameKeySibling(write: any, transaction: DatabaseTransaction | undefined): boolean {
+		for (let other = transaction?.writesByKey?.get(write.store)?.get(write.keyId); other; other = other.priorWrite) {
+			if (
+				other !== write &&
+				other.saved &&
+				!other.skipped &&
+				other.committedOn === write.committedOn &&
+				other.committedRound === write.committedRound
+			)
+				return true;
+		}
+		return false;
+	}
+
+	function committedEntry(id: Id): Entry | undefined {
+		return primaryStore.getEntry(id, COMMITTED_READ);
+	}
+
+	function isHeadIdentity(entry: Partial<Entry> | undefined, version: number, nodeId?: number): boolean {
+		return (
+			entry?.version === version &&
+			(entry.nodeId ?? 0) === (nodeId ?? getThisNodeId(auditStore)) &&
+			!entry.additionalAuditRefs?.length
+		);
+	}
+
 	function precedesExistingVersion(txnTime: number, existingEntry: Partial<Entry>, nodeId?: number): number {
 		if (nodeId === undefined) {
 			nodeId = getThisNodeId(auditStore);

package/resources/analytics/DESIGN.md

@@ -36,3 +36,20 @@ Still open: `findLastAggregationTime` seeds both markers after a restart from th
 analytics record, whose `time` is an end-of-cycle stamp, so a restart mid-drain can skip the rest of
 the backlog; and `storeMetric` discards `table.put()`'s result, so the cursor advances past raw
 records whose aggregate rows failed to commit. Both need a cursor persisted with the rows.
+
+## Aggregation folds each measure over only the samples that carry it (`resources/analytics/write.ts`)
+
+A key's raw samples need not carry the same measures: callback metrics (`recordAction(fn)`) and
+analytics listeners report whatever fields they have, and a raw backlog can come from another
+version. `aggregation()` keeps, per fold target (an action, or one thread's record for `byThread`
+metrics), the count of samples that carried each measure in the cycle-local `measureCounts` map —
+not on the action, which `storeMetric` persists and aggregate listeners receive. A measure's first
+sample seeds it, `max[A-Z]`-named measures fold with `Math.max`, and the rest are a running mean
+weighted by that count. A measure in every sample has a count equal to the target's `count`, so it
+folds exactly as before; keep the running mean, since sum-then-divide rounds differently.
+
+The `byThread` combination sums every thread record's numeric fields into the entry, so a measure
+the key's first sample lacked, or that only some threads carry, is kept. That holds only while a
+thread record carries nothing but measures and its `count`, which the thread count then replaces:
+the fold keeps `total`/`ratio` on non-thread actions only, so a `ratio` on a thread record is
+always a caller's measure.

package/resources/analytics/write.ts

@@ -967,6 +967,8 @@ async function aggregation(fromPeriod, toPeriod = 60000) {
 	const aggregateActions = new Map();
 	const distributions = new Map();
 	const threadsToAverage = [];
+	// A measure's weight is the count of only the samples that carried it, per action or thread record.
+	const measureCounts = new Map<object, Record<string, number>>();
 	let lastTime: number | undefined;
 	let stoppedAtWindowEdge = false;
 	for (const { key, value } of rawAnalyticsTable.primaryStore.getRange({
@@ -992,7 +994,8 @@ async function aggregation(fromPeriod, toPeriod = 60000) {
 			if (type !== undefined) key += '-' + type;
 			let action = aggregateActions.get(key);
 			if (action) {
-				if (action.threads) {
+				const byThread = Boolean(action.byThread);
+				if (byThread) {
 					const actionForThread = action.threads[threadId];
 					if (actionForThread) action = actionForThread;
 					else {
@@ -1001,17 +1004,27 @@ async function aggregation(fromPeriod, toPeriod = 60000) {
 					}
 				}
 				if (!action.count) action.count = 1;
-				const previousCount = action.count;
+				let counts = measureCounts.get(action);
+				if (!counts) {
+					// Until its first fold, a target holds only its first sample.
+					counts = Object.create(null);
+					for (const measureName in action) {
+						if (typeof action[measureName] === 'number') counts[measureName] = action.count;
+					}
+					measureCounts.set(action, counts);
+				}
 				for (const measureName in measures) {
 					const value = measures[measureName];
-					if (typeof value === 'number') {
-						action[measureName] = MAX_MEASURE_NAME.test(measureName)
-							? Math.max(action[measureName], value)
-							: (action[measureName] * previousCount + value * count) / (previousCount + count);
-					}
+					if (typeof value !== 'number') continue;
+					const measureCount = counts[measureName];
+					if (measureCount === undefined) action[measureName] = value;
+					else if (MAX_MEASURE_NAME.test(measureName)) action[measureName] = Math.max(action[measureName], value);
+					else action[measureName] = (action[measureName] * measureCount + value * count) / (measureCount + count);
+					counts[measureName] = (measureCount ?? 0) + count;
 				}
 				action.count += count;
-				if (total >= 0) {
+				// A thread's record is built from measures alone, so it has no total to add to.
+				if (total >= 0 && !byThread) {
 					action.total += total;
 					action.ratio = action.total / action.count;
 				}
@@ -1043,15 +1056,15 @@ async function aggregation(fromPeriod, toPeriod = 60000) {
 		let { path, method, type, metric, count, total, distribution, threads, ...measures } = entry;
 		threads = threads.filter((thread) => thread);
 		for (const measureName in measures) {
-			if (typeof entry[measureName] !== 'number') continue;
-			let total = 0;
-			for (const thread of threads) {
+			if (typeof entry[measureName] === 'number') entry[measureName] = 0;
+		}
+		// A thread can carry measures the entry's first sample lacked.
+		for (const thread of threads) {
+			for (const measureName in thread) {
 				const value = thread[measureName];
-				if (typeof value === 'number') {
-					total += value;
-				}
+				if (typeof value === 'number')
+					entry[measureName] = (typeof entry[measureName] === 'number' ? entry[measureName] : 0) + value;
 			}
-			entry[measureName] = total;
 		}
 		entry.count = threads.length;
 		delete entry.threads;

package/resources/databases.ts

@@ -654,6 +654,21 @@ const DROPPED_ROW_PREFIX = '/dropped/';
 function droppedRowKey(tableName: string): string {
 	return DROPPED_ROW_PREFIX + tableName;
 }
+/**
+ * Whether a catalog row names its table's primary store: one flagged `isPrimaryKey`, or the nameless bare
+ * `<table>/` row of a keyless table, which can lose the flag while its store still holds primary records.
+ */
+export function isPrimaryCatalogRow(key: unknown, value: any): boolean {
+	if (value?.isPrimaryKey) return true;
+	// exactly one slash, at the end: initStores reads `<table>/<attribute>` by splitting on the first slash
+	return (
+		value != null &&
+		value.name == null &&
+		typeof key === 'string' &&
+		key.length > 1 &&
+		key.indexOf('/') === key.length - 1
+	);
+}
 /**
  * Once a name has been dropped, later creates of it take a generation even after the retirement journal is
  * reclaimed. Keep the row untimed and shaped `{ table, tableId }`: later versions read it as an untimed drop
@@ -1325,7 +1340,7 @@ function initStores(
 		definedTables?.add(tableName);
 		let tableDef = tablesToLoad.get(tableName);
 		if (!tableDef) tablesToLoad.set(tableName, (tableDef = { attributes: [] }));
-		if (attribute_name == null || value.isPrimaryKey) tableDef.primary = value;
+		if (isPrimaryCatalogRow(key, value)) tableDef.primary = value;
 		if (value.dropping) tableDef.tombstone = value;
 		if (attribute_name != null) tableDef.attributes.push(value);
 		Object.defineProperty(value, 'key', { value: key, configurable: true });
@@ -1505,7 +1520,8 @@ function initStores(
 				(attributesDbi as any).putSync(NEXT_TABLE_ID, tableId + 1);
 				(attributesDbi as any).putSync(primaryAttribute.key, primaryAttribute);
 			}
-			const dbiInit = createOpenDBIObject(!primaryAttribute.isPrimaryKey, primaryAttribute.isPrimaryKey);
+			// primary by selection, not by its flag (isPrimaryCatalogRow)
+			const dbiInit = createOpenDBIObject(false, true);
 			dbiInit.compression = primaryAttribute.compression;
 			if (dbiInit.compression) {
 				const compressionThreshold =
@@ -3671,6 +3687,25 @@ function declareTable<TableResourceType>(target: TableTarget, tableDefinition: T
 			if (Table.primaryStore.rootStore.status === 'closed') {
 				throw new Error(`Can not use a closed data store from ${tableName} class`);
 			}
+			if (Table.primaryKey == null) {
+				// a keyless table cannot adopt a key without re-keying its records
+				for (const attribute of attributes) {
+					if (!attribute.isPrimaryKey) continue;
+					if (origin === 'cluster')
+						logger.warn(
+							`Ignoring peer redefinition of ${databaseName}.${tableName}.${attribute.name} ` +
+								`(isPrimaryKey: local table has no primary key, peer true)`
+						);
+					else if (schemaDefinedExplicit)
+						logger.error(
+							`Table '${databaseName}.${tableName}' has no primary key, so its declared primary key ` +
+								`'${attribute.name}' is ignored and the table stays keyless. Recreate the table with that ` +
+								`primary key, or migrate its records, to use it.`
+						);
+					delete attribute.isPrimaryKey;
+					if (properties?.[attribute.name]) delete properties[attribute.name].primaryKey;
+				}
+			}
 			// Reject moving the primary key to a different attribute on a table that already has records.
 			// The storage key (Table.primaryKey) is never re-pointed here, so honoring the change would
 			// leave describe reporting the new attribute while every record — old and newly inserted — stays
@@ -5736,7 +5771,8 @@ function completeInterruptedDrop(
 	}>;
 	const bareEntry = catalogRows.find(({ key }) => key === tableName + '/');
 	const primaryEntry =
-		(bareEntry?.value?.isPrimaryKey ? bareEntry : undefined) ?? catalogRows.find(({ value }) => value?.isPrimaryKey);
+		catalogRows.find(({ value }) => value?.isPrimaryKey) ??
+		(bareEntry && isPrimaryCatalogRow(bareEntry.key, bareEntry.value) ? bareEntry : undefined);
 	const tombstoneEntry = bareEntry ?? primaryEntry;
 	if (rootStore instanceof RocksDatabase && !fullTextRetired) {
 		const names = [
@@ -5795,7 +5831,7 @@ function completeInterruptedDrop(
 		// recreate silently inherit the previous table's records.
 		for (const { key, value } of catalogRows) {
 			const objectStorage =
-				value?.isPrimaryKey || (value?.indexed?.type && CUSTOM_INDEXES[value.indexed.type]?.useObjectStore);
+				isPrimaryCatalogRow(key, value) || (value?.indexed?.type && CUSTOM_INDEXES[value.indexed.type]?.useObjectStore);
 			const store = (rootStore as any).openDB(key, createOpenDBIObject(!objectStorage, objectStorage) as any);
 			try {
 				// dropSync (not drop): this function is synchronous, and its callers rely on