diff --git a/Cargo.lock b/Cargo.lock
index 148c6975c..6b01ae303 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -2165,7 +2165,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
 dependencies = [
  "libc",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -5591,7 +5591,7 @@ dependencies = [
  "once_cell",
  "socket2",
  "tracing",
- "windows-sys 0.52.0",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
@@ -6218,7 +6218,7 @@ dependencies = [
  "errno",
  "libc",
  "linux-raw-sys",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -6286,7 +6286,7 @@ dependencies = [
  "security-framework",
  "security-framework-sys",
  "webpki-root-certs",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -6937,10 +6937,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd"
 dependencies = [
  "fastrand",
- "getrandom 0.3.4",
+ "getrandom 0.4.2",
  "once_cell",
  "rustix",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -8100,7 +8100,7 @@ version = "0.1.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22"
 dependencies = [
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -8597,18 +8597,18 @@ dependencies = [
 
 [[package]]
 name = "zerompk"
-version = "0.5.0"
+version = "0.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6ed7119bccd8297686328e73233a8c839645e742e16c2b8e94a48bda9f118729"
+checksum = "147801aff255b90229e978171d3911c19b07214e9c808e6d2155b90094748dbf"
 dependencies = [
  "zerompk_derive",
 ]
 
 [[package]]
 name = "zerompk_derive"
-version = "0.5.0"
+version = "0.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4cec68b6d21b4d29083199a2b2f42fb23712cfdf3bdb221b86c2485c6b6c4248"
+checksum = "0a314420de412a9e7337bb7fc1ab7797902b1e6cd41cc485d240f60116e4184d"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -8709,7 +8709,3 @@ dependencies = [
  "cc",
  "pkg-config",
 ]
-
-[[patch.unused]]
-name = "pagedb"
-version = "0.1.0"
diff --git a/Cargo.toml b/Cargo.toml
index 284e6a090..c6c1bd143 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -164,7 +164,7 @@ chrono = { version = "0.4", features = ["std"], default-features = false }
 
 # MessagePack
 rmpv = "1"
-zerompk = { version = "0.5", features = ["std", "derive"] }
+zerompk = { version = "0.6", features = ["std", "derive"] }
 
 # Bitmap
 roaring = "0.11"
diff --git a/nodedb-client/src/native/connection/mod.rs b/nodedb-client/src/native/connection/mod.rs
index e6db85703..05cf17858 100644
--- a/nodedb-client/src/native/connection/mod.rs
+++ b/nodedb-client/src/native/connection/mod.rs
@@ -356,9 +356,10 @@ impl NativeConnection {
         op: OpCode,
         fields: TextFields,
     ) -> NodeDbResult<NativeResponse> {
+        let req_seq = self.next_seq();
         let req = NativeRequest {
             op,
-            seq: self.next_seq(),
+            seq: req_seq,
             fields: RequestFields::Text(fields),
         };
 
@@ -374,9 +375,9 @@ impl NativeConnection {
         self.stream.flush().await.map_err(io_err)?;
 
         let mut combined_rows: Vec<Vec<nodedb_types::Value>> = Vec::new();
-        let mut final_resp: Option<NativeResponse> = None;
+        let mut partial_columns: Option<Vec<String>> = None;
 
-        loop {
+        let final_resp = loop {
             let mut len_buf = [0u8; FRAME_HEADER_LEN];
             self.stream.read_exact(&mut len_buf).await.map_err(io_err)?;
             let resp_len = u32::from_be_bytes(len_buf);
@@ -396,30 +397,51 @@ impl NativeConnection {
                 NodeDbError::serialization("msgpack", format!("response decode: {e}"))
             })?;
 
+            if resp.seq != req_seq {
+                // A fan-out query for a preceding request can leave stale
+                // trailing frames on the wire after that request's terminal
+                // frame was already returned to its caller. Discard any
+                // frame that doesn't belong to this request rather than
+                // misattributing it — never surface another request's rows
+                // or status as this request's response.
+                tracing::warn!(
+                    expected_seq = req_seq,
+                    got_seq = resp.seq,
+                    "native connection: discarding stale response frame"
+                );
+                continue;
+            }
+
             if resp.status == ResponseStatus::Partial {
+                if partial_columns.is_none() {
+                    partial_columns = resp.columns;
+                }
                 if let Some(rows) = resp.rows {
                     combined_rows.extend(rows);
                 }
-                if final_resp.is_none() {
-                    final_resp = Some(NativeResponse { rows: None, ..resp });
-                }
-            } else {
-                if combined_rows.is_empty() {
-                    final_resp = Some(resp);
-                } else {
-                    if let Some(ref rows) = resp.rows {
-                        combined_rows.extend(rows.iter().cloned());
-                    }
-                    let mut merged = final_resp.unwrap_or(resp);
-                    merged.rows = Some(combined_rows);
-                    merged.status = ResponseStatus::Ok;
-                    final_resp = Some(merged);
-                }
-                break;
+                continue;
             }
-        }
 
-        final_resp.ok_or_else(|| NodeDbError::internal("no final response received"))
+            // The terminal frame owns status and all terminal metadata. In
+            // particular, never turn a stream error into success merely
+            // because earlier partial rows were received.
+            if resp.status == ResponseStatus::Error {
+                break resp;
+            }
+            let mut terminal = resp;
+            if let Some(rows) = terminal.rows.take() {
+                combined_rows.extend(rows);
+            }
+            if !combined_rows.is_empty() {
+                terminal.rows = Some(combined_rows);
+            }
+            if terminal.columns.is_none() {
+                terminal.columns = partial_columns;
+            }
+            break terminal;
+        };
+
+        Ok(final_resp)
     }
 }
 
diff --git a/nodedb-cluster-tests/tests/descriptor_versioning_cross_node.rs b/nodedb-cluster-tests/tests/descriptor_versioning_cross_node.rs
index 0389adb8d..7d317db80 100644
--- a/nodedb-cluster-tests/tests/descriptor_versioning_cross_node.rs
+++ b/nodedb-cluster-tests/tests/descriptor_versioning_cross_node.rs
@@ -19,7 +19,7 @@ mod common;
 
 use std::time::Duration;
 
-use common::cluster_harness::{TestCluster, wait_for};
+use common::cluster_harness::{TestCluster, TestClusterNode, wait_for};
 
 const TENANT: u64 = 1;
 
@@ -144,6 +144,49 @@ async fn alter_collection_bumps_version_monotonically() {
     cluster.shutdown().await;
 }
 
+#[tokio::test(flavor = "multi_thread", worker_threads = 6)]
+async fn concurrent_cross_node_updates_allocate_distinct_descriptor_versions() {
+    let cluster = TestCluster::spawn_three().await.expect("3-node cluster");
+    cluster
+        .exec_ddl_on_any_leader("CREATE USER owner_a WITH PASSWORD 'pw' ROLE READWRITE")
+        .await
+        .expect("create owner_a");
+    cluster
+        .exec_ddl_on_any_leader("CREATE USER owner_b WITH PASSWORD 'pw' ROLE READWRITE")
+        .await
+        .expect("create owner_b");
+    cluster
+        .exec_ddl_on_any_leader("CREATE COLLECTION concurrently_owned")
+        .await
+        .expect("create collection");
+
+    let update_a = cluster.nodes[0]
+        .client
+        .simple_query("ALTER COLLECTION concurrently_owned OWNER TO owner_a");
+    let update_b = cluster.nodes[1]
+        .client
+        .simple_query("ALTER COLLECTION concurrently_owned OWNER TO owner_b");
+    let (result_a, result_b) = tokio::join!(update_a, update_b);
+    result_a.expect("node 0 concurrent owner update");
+    result_b.expect("node 1 concurrent owner update");
+
+    wait_for(
+        "both concurrent updates apply as distinct versions on every node",
+        Duration::from_secs(15),
+        Duration::from_millis(50),
+        || {
+            cluster.nodes.iter().all(|node| {
+                node.collection_descriptor(TENANT, "concurrently_owned")
+                    .map(|stamp| stamp.0)
+                    == Some(3)
+            })
+        },
+    )
+    .await;
+
+    cluster.shutdown().await;
+}
+
 #[tokio::test(flavor = "multi_thread", worker_threads = 6)]
 async fn distinct_collections_get_independent_versions() {
     let cluster = TestCluster::spawn_three().await.expect("3-node cluster");
@@ -187,3 +230,113 @@ async fn distinct_collections_get_independent_versions() {
 
     cluster.shutdown().await;
 }
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 6)]
+async fn historical_descriptor_entries_replay_without_regressing_the_latest_version() {
+    let data_dir = tempfile::tempdir().expect("tempdir");
+    let data_path = data_dir.path().to_path_buf();
+    let node = TestClusterNode::spawn_single_node_calvin_on_path(4, data_path.clone())
+        .await
+        .expect("spawn single-node metadata group");
+    wait_for(
+        "single-node sequencer leader elected",
+        Duration::from_secs(10),
+        Duration::from_millis(50),
+        || node.sequencer_leader() == node.node_id,
+    )
+    .await;
+    wait_for(
+        "single-node metadata leader elected",
+        Duration::from_secs(10),
+        Duration::from_millis(50),
+        || node.shared.is_metadata_leader(),
+    )
+    .await;
+
+    node.client
+        .simple_query(
+            "CREATE COLLECTION replay_graph (id TEXT PRIMARY KEY, name TEXT) \
+             WITH (engine='document_strict')",
+        )
+        .await
+        .expect("create graph-bearing collection");
+    wait_for(
+        "collection descriptor reaches version 1",
+        Duration::from_secs(10),
+        Duration::from_millis(50),
+        || {
+            node.collection_descriptor(TENANT, "replay_graph")
+                .map(|v| v.0)
+                == Some(1)
+        },
+    )
+    .await;
+
+    node.client
+        .simple_query(
+            "GRAPH INSERT EDGE IN replay_graph FROM 'a' TO 'b' \
+             TYPE 'knows' PROPERTIES '{}'",
+        )
+        .await
+        .expect("insert edge and mark collection edge-bearing");
+    wait_for(
+        "edge-bearing descriptor reaches version 2",
+        Duration::from_secs(10),
+        Duration::from_millis(50),
+        || {
+            node.collection_descriptor(TENANT, "replay_graph")
+                .map(|v| v.0)
+                == Some(2)
+        },
+    )
+    .await;
+
+    node.graceful_shutdown_wal_only().await;
+    let node = TestClusterNode::spawn_single_node_calvin_on_path(4, data_path)
+        .await
+        .expect("restart against the persisted catalog and full metadata log");
+    wait_for(
+        "single-node sequencer leader re-elected after restart",
+        Duration::from_secs(10),
+        Duration::from_millis(50),
+        || node.sequencer_leader() == node.node_id,
+    )
+    .await;
+    wait_for(
+        "single-node metadata leader re-elected after restart",
+        Duration::from_secs(10),
+        Duration::from_millis(50),
+        || node.shared.is_metadata_leader(),
+    )
+    .await;
+
+    wait_for(
+        "latest collection descriptor remains visible after replay",
+        Duration::from_secs(10),
+        Duration::from_millis(50),
+        || {
+            node.collection_descriptor(TENANT, "replay_graph")
+                .map(|v| v.0)
+                == Some(2)
+        },
+    )
+    .await;
+
+    node.client
+        .simple_query(
+            "CREATE COLLECTION ddl_after_descriptor_replay \
+             (id TEXT PRIMARY KEY) WITH (engine='document_strict')",
+        )
+        .await
+        .expect(
+            "historical metadata replay must advance its watermark so later DDL remains usable",
+        );
+    assert_eq!(
+        node.collection_descriptor(TENANT, "replay_graph")
+            .map(|version| version.0),
+        Some(2),
+        "replaying historical version 1 must not overwrite the persisted latest version 2"
+    );
+
+    node.shutdown().await;
+}
diff --git a/nodedb-cluster-tests/tests/single_node_calvin_graph_txn.rs b/nodedb-cluster-tests/tests/single_node_calvin_graph_txn.rs
index 5272044a0..a56ceff65 100644
--- a/nodedb-cluster-tests/tests/single_node_calvin_graph_txn.rs
+++ b/nodedb-cluster-tests/tests/single_node_calvin_graph_txn.rs
@@ -51,16 +51,30 @@ fn sequencer_leader(node: &TestClusterNode) -> u64 {
 /// between them is genuinely cross-shard. Deterministic: `VShardId::from_key` is
 /// a pure function of the key bytes, and it is how `insert_edge` homes each
 /// endpoint. Same key-picking approach as the sibling `single_node_calvin` suite.
-fn distinct_vshard_node_keys() -> (String, String) {
+fn distinct_core_node_keys(num_cores: u32) -> (String, String) {
     let dst = "sncgtx_hub".to_string();
     let vdst = VShardId::from_key(dst.as_bytes()).as_u32();
     for i in 0u32..4096 {
         let src = format!("sncgtx_src_{i}");
-        if VShardId::from_key(src.as_bytes()).as_u32() != vdst {
+        let vsrc = VShardId::from_key(src.as_bytes()).as_u32();
+        if vsrc != vdst && vsrc % num_cores != vdst % num_cores {
             return (src, dst);
         }
     }
-    panic!("could not find a node key on a distinct vShard from the hub in 4096 tries");
+    panic!("could not find node keys on distinct vShards and cores in 4096 tries");
+}
+
+fn another_source_on_distinct_core(num_cores: u32, first: &str, dst: &str) -> String {
+    let first_core = VShardId::from_key(first.as_bytes()).as_u32() % num_cores;
+    let dst_core = VShardId::from_key(dst.as_bytes()).as_u32() % num_cores;
+    for i in 0u32..4096 {
+        let candidate = format!("sncgtx_other_src_{i}");
+        let core = VShardId::from_key(candidate.as_bytes()).as_u32() % num_cores;
+        if candidate != first && core != first_core && core != dst_core {
+            return candidate;
+        }
+    }
+    panic!("could not find a second source on a distinct core");
 }
 
 /// Run `GRAPH NEIGHBORS OF '<node>' LABEL '<label>' DIRECTION <dir>` and return
@@ -126,7 +140,7 @@ async fn dual_home_edge_stages_both_overlays_and_rollback_tears_down() {
     )
     .await;
 
-    let (src, dst) = distinct_vshard_node_keys();
+    let (src, dst) = distinct_core_node_keys(4);
     let label = "l";
 
     node.client.simple_query("BEGIN").await.expect("BEGIN");
@@ -183,3 +197,202 @@ async fn dual_home_edge_stages_both_overlays_and_rollback_tears_down() {
 
     node.shutdown().await;
 }
+
+/// Calvin publishes one lightweight Control change event per committed
+/// participant-local document write, ordered by each participant's durable LSN.
+/// A rolled-back transaction publishes nothing.
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+async fn calvin_commit_publishes_control_changes_at_participant_lsns() {
+    let node = TestClusterNode::spawn_single_node_calvin(4)
+        .await
+        .expect("spawn standalone single-node-calvin server");
+    wait_for(
+        "single-node sequencer leader elected",
+        Duration::from_secs(10),
+        Duration::from_millis(50),
+        || sequencer_leader(&node) == node.node_id,
+    )
+    .await;
+
+    let first = "sncgtx_cdc_a";
+    let second = (0..4096)
+        .map(|i| format!("sncgtx_cdc_b_{i}"))
+        .find(|candidate| {
+            VShardId::from_collection_in_database(nodedb_types::DatabaseId::DEFAULT, candidate)
+                != VShardId::from_collection_in_database(nodedb_types::DatabaseId::DEFAULT, first)
+        })
+        .expect("collection on a distinct vShard");
+    for collection in [first, second.as_str()] {
+        node.client
+            .simple_query(&format!(
+                "CREATE COLLECTION {collection} (id TEXT PRIMARY KEY, value TEXT)"
+            ))
+            .await
+            .expect("create CDC collection");
+    }
+
+    let mut subscription = node.shared.change_stream.subscribe(None, None);
+    node.client.simple_query("BEGIN").await.expect("BEGIN");
+    node.client
+        .simple_query(&format!(
+            "INSERT INTO {first} (id, value) VALUES ('a', 'one')"
+        ))
+        .await
+        .expect("stage first write");
+    node.client
+        .simple_query(&format!(
+            "INSERT INTO {second} (id, value) VALUES ('b', 'two')"
+        ))
+        .await
+        .expect("stage second write");
+    node.client.simple_query("COMMIT").await.expect("COMMIT");
+
+    let mut collections = std::collections::BTreeSet::new();
+    for _ in 0..2 {
+        let event = tokio::time::timeout(Duration::from_secs(5), subscription.recv_filtered())
+            .await
+            .expect("committed Calvin write must publish a Control event")
+            .expect("change-stream receiver remains open");
+        assert_ne!(
+            event.lsn.as_u64(),
+            0,
+            "CDC event must carry participant LSN"
+        );
+        collections.insert(event.collection);
+    }
+    assert_eq!(
+        collections,
+        std::collections::BTreeSet::from([first.to_string(), second.clone()])
+    );
+    assert!(
+        tokio::time::timeout(Duration::from_millis(500), subscription.recv_filtered())
+            .await
+            .is_err(),
+        "each logical write must publish exactly once"
+    );
+
+    node.client
+        .simple_query("BEGIN")
+        .await
+        .expect("second BEGIN");
+    node.client
+        .simple_query(&format!(
+            "INSERT INTO {first} (id, value) VALUES ('aborted', 'no')"
+        ))
+        .await
+        .expect("stage aborted write");
+    node.client
+        .simple_query("ROLLBACK")
+        .await
+        .expect("ROLLBACK");
+    assert!(
+        tokio::time::timeout(Duration::from_millis(500), subscription.recv_filtered())
+            .await
+            .is_err(),
+        "aborted Calvin write must not publish a Control event"
+    );
+
+    node.shutdown().await;
+}
+
+/// A dual-home edge has two physical endpoint representations but is one
+/// logical edge. Stats must deduplicate those representations rather than
+/// exposing storage topology in user-visible cardinalities.
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+async fn dual_home_edge_counts_once_in_graph_stats() {
+    let node = TestClusterNode::spawn_single_node_calvin(4)
+        .await
+        .expect("spawn standalone single-node-calvin server");
+    wait_for(
+        "single-node sequencer leader elected",
+        Duration::from_secs(10),
+        Duration::from_millis(50),
+        || sequencer_leader(&node) == node.node_id,
+    )
+    .await;
+    wait_for(
+        "single-node metadata leader elected",
+        Duration::from_secs(10),
+        Duration::from_millis(50),
+        || node.shared.is_metadata_leader(),
+    )
+    .await;
+
+    node.client
+        .simple_query(
+            "CREATE COLLECTION sncgtx_stats (id TEXT PRIMARY KEY, name TEXT) \
+             WITH (engine='document_strict')",
+        )
+        .await
+        .expect("create graph stats collection");
+    let (src, dst) = distinct_core_node_keys(4);
+    node.client
+        .simple_query(&format!(
+            "GRAPH INSERT EDGE IN sncgtx_stats FROM '{src}' TO '{dst}' \
+             TYPE 'knows' PROPERTIES '{{}}'"
+        ))
+        .await
+        .expect("insert first dual-home edge");
+    let other_src = another_source_on_distinct_core(4, &src, &dst);
+    node.client
+        .simple_query(&format!(
+            "GRAPH INSERT EDGE IN sncgtx_stats FROM '{other_src}' TO '{dst}' \
+             TYPE 'knows' PROPERTIES '{{}}'"
+        ))
+        .await
+        .expect("insert second edge sharing the destination");
+
+    let messages = node
+        .client
+        .simple_query("SHOW GRAPH STATS 'sncgtx_stats'")
+        .await
+        .expect("show graph stats");
+    let row = messages
+        .iter()
+        .find_map(|message| match message {
+            tokio_postgres::SimpleQueryMessage::Row(row) => Some(row),
+            _ => None,
+        })
+        .expect("graph stats row");
+
+    assert_eq!(row.get("node_count"), Some("3"));
+    assert_eq!(row.get("edge_count"), Some("2"));
+    let labels: serde_json::Value =
+        serde_json::from_str(row.get("labels").expect("labels JSON")).expect("valid labels JSON");
+    assert_eq!(labels[0]["label"], "knows");
+    assert_eq!(labels[0]["count"], 2);
+
+    // Historical stats scan physical edge versions rather than live summary
+    // counters. It must union the two endpoint-home replicas by logical edge
+    // identity instead of reintroducing the same doubled cardinality.
+    let future_ms = std::time::SystemTime::now()
+        .duration_since(std::time::UNIX_EPOCH)
+        .expect("clock after epoch")
+        .as_millis() as i64
+        + 1_000;
+    let historical = node
+        .client
+        .simple_query(&format!(
+            "SHOW GRAPH STATS 'sncgtx_stats' AS OF SYSTEM TIME {future_ms}"
+        ))
+        .await
+        .expect("show historical graph stats");
+    let historical_row = historical
+        .iter()
+        .find_map(|message| match message {
+            tokio_postgres::SimpleQueryMessage::Row(row) => Some(row),
+            _ => None,
+        })
+        .expect("historical graph stats row");
+    assert_eq!(historical_row.get("node_count"), Some("3"));
+    assert_eq!(historical_row.get("edge_count"), Some("2"));
+    let historical_labels: serde_json::Value = serde_json::from_str(
+        historical_row
+            .get("labels")
+            .expect("historical labels JSON"),
+    )
+    .expect("valid historical labels JSON");
+    assert_eq!(historical_labels[0]["count"], 2);
+
+    node.shutdown().await;
+}
diff --git a/nodedb-cluster/src/calvin/types/transaction.rs b/nodedb-cluster/src/calvin/types/transaction.rs
index 05aeaaadd..bb7aef152 100644
--- a/nodedb-cluster/src/calvin/types/transaction.rs
+++ b/nodedb-cluster/src/calvin/types/transaction.rs
@@ -59,6 +59,11 @@ impl ReadWriteSet {
     /// serialized bytes remain deterministic regardless of how `VShardId`
     /// is computed.
     pub fn participating_vshards(&self) -> Vec<VShardId> {
+        self.participating_vshards_in_database(DatabaseId::DEFAULT)
+    }
+
+    /// Derive participants using database-scoped collection homes.
+    pub fn participating_vshards_in_database(&self, database_id: DatabaseId) -> Vec<VShardId> {
         let mut seen = std::collections::HashSet::new();
         let mut result = Vec::new();
         for engine_set in &self.0 {
@@ -74,10 +79,8 @@ impl ReadWriteSet {
                 EngineKeySet::Document { .. }
                 | EngineKeySet::Vector { .. }
                 | EngineKeySet::Kv { .. } => {
-                    let vshard = VShardId::from_collection_in_database(
-                        DatabaseId::DEFAULT,
-                        engine_set.collection(),
-                    );
+                    let vshard =
+                        VShardId::from_collection_in_database(database_id, engine_set.collection());
                     if seen.insert(vshard.as_u32()) {
                         result.push(vshard);
                     }
@@ -129,6 +132,10 @@ pub struct TxClass {
     /// Tenant scope. All keys in `read_set` and `write_set` must belong to
     /// this tenant; cross-tenant transactions are rejected at construction.
     pub tenant_id: TenantId,
+    /// Database scope used for collection homing, execution, WAL, and CDC.
+    #[serde(default)]
+    #[msgpack(default)]
+    pub database_id: DatabaseId,
     /// Optional dependent-read specification.
     ///
     /// When present, this transaction is a dependent-read Calvin txn: the
@@ -189,12 +196,34 @@ impl TxClass {
         tenant_id: TenantId,
         dependent_reads: Option<DependentReadSpec>,
         versioned_reads: VersionedReadSet,
+    ) -> Result<Self, CalvinError> {
+        Self::new_in_database(
+            read_set,
+            write_set,
+            plans,
+            tenant_id,
+            DatabaseId::DEFAULT,
+            dependent_reads,
+            versioned_reads,
+        )
+    }
+
+    /// Construct a validated multi-vshard class in an explicit database.
+    pub fn new_in_database(
+        read_set: ReadWriteSet,
+        write_set: ReadWriteSet,
+        plans: Vec<u8>,
+        tenant_id: TenantId,
+        database_id: DatabaseId,
+        dependent_reads: Option<DependentReadSpec>,
+        versioned_reads: VersionedReadSet,
     ) -> Result<Self, CalvinError> {
         Self::new_checked(
             read_set,
             write_set,
             plans,
             tenant_id,
+            database_id,
             dependent_reads,
             versioned_reads,
             false,
@@ -224,12 +253,34 @@ impl TxClass {
         tenant_id: TenantId,
         dependent_reads: Option<DependentReadSpec>,
         versioned_reads: VersionedReadSet,
+    ) -> Result<Self, CalvinError> {
+        Self::new_single_vshard_in_database(
+            read_set,
+            write_set,
+            plans,
+            tenant_id,
+            DatabaseId::DEFAULT,
+            dependent_reads,
+            versioned_reads,
+        )
+    }
+
+    /// Construct a single-vshard class in an explicit database.
+    pub fn new_single_vshard_in_database(
+        read_set: ReadWriteSet,
+        write_set: ReadWriteSet,
+        plans: Vec<u8>,
+        tenant_id: TenantId,
+        database_id: DatabaseId,
+        dependent_reads: Option<DependentReadSpec>,
+        versioned_reads: VersionedReadSet,
     ) -> Result<Self, CalvinError> {
         Self::new_checked(
             read_set,
             write_set,
             plans,
             tenant_id,
+            database_id,
             dependent_reads,
             versioned_reads,
             true,
@@ -239,11 +290,13 @@ impl TxClass {
     /// Shared construction body. `allow_single_vshard` relaxes the participant
     /// floor from 2 (multi-vshard) to 1 (single-vshard opt-in); an empty write
     /// set and a zero-participant write set are rejected on both paths.
+    #[allow(clippy::too_many_arguments)] // shared validation for both constructor modes
     fn new_checked(
         read_set: ReadWriteSet,
         write_set: ReadWriteSet,
         plans: Vec<u8>,
         tenant_id: TenantId,
+        database_id: DatabaseId,
         dependent_reads: Option<DependentReadSpec>,
         versioned_reads: VersionedReadSet,
         allow_single_vshard: bool,
@@ -251,7 +304,7 @@ impl TxClass {
         if write_set.is_empty() {
             return Err(CalvinError::EmptyWriteSet);
         }
-        let mut participating_vshards = write_set.participating_vshards();
+        let mut participating_vshards = write_set.participating_vshards_in_database(database_id);
         let min_participants = if allow_single_vshard { 1 } else { 2 };
         // The participant FLOOR is computed from the WRITE set ONLY, and BEFORE
         // the read-set union below: a txn that writes a single shard but reads N
@@ -270,7 +323,7 @@ impl TxClass {
         // `new_checked` and `restore_derived` — `participating_vshards` is
         // `#[serde(skip)]` and re-derived on decode, so an encoded and a decoded
         // `TxClass` would disagree on their participant set if the two diverged.
-        for v in read_set.participating_vshards() {
+        for v in read_set.participating_vshards_in_database(database_id) {
             if !participating_vshards
                 .iter()
                 .any(|e| e.as_u32() == v.as_u32())
@@ -299,6 +352,7 @@ impl TxClass {
             write_set,
             plans,
             tenant_id,
+            database_id,
             dependent_reads,
             versioned_reads,
             lock_owner: None,
@@ -341,11 +395,16 @@ impl TxClass {
     /// Call this immediately after deserializing a `TxClass` that came off
     /// the wire or out of the Raft log.
     pub fn restore_derived(&mut self) {
-        let mut vshards = self.write_set.participating_vshards();
+        let mut vshards = self
+            .write_set
+            .participating_vshards_in_database(self.database_id);
         // Union the read set's participating vShards — MUST match `new_checked`'s
         // union exactly so a decoded `TxClass` derives the identical participant
         // set the encoder computed (participants are not serialized).
-        for v in self.read_set.participating_vshards() {
+        for v in self
+            .read_set
+            .participating_vshards_in_database(self.database_id)
+        {
             if !vshards.iter().any(|e| e.as_u32() == v.as_u32()) {
                 vshards.push(v);
             }
@@ -444,6 +503,25 @@ mod tests {
     /// map-encoded with the original fields only. Proves an old serialized
     /// `TxClass` (no `versioned_reads` key) still decodes — the field defaults
     /// to empty — so Raft-logged transactions survive the schema addition.
+    #[test]
+    fn database_scope_survives_msgpack_roundtrip() {
+        let tx = TxClass::new_in_database(
+            ReadWriteSet::new(vec![]),
+            two_home_write_set(),
+            vec![0x01],
+            TenantId::new(1),
+            DatabaseId::new(9),
+            None,
+            VersionedReadSet::default(),
+        )
+        .expect("valid TxClass");
+        let bytes = zerompk::to_msgpack_vec(&tx).expect("encode");
+        let mut decoded: TxClass = zerompk::from_msgpack(&bytes).expect("decode");
+        decoded.restore_derived();
+        assert_eq!(decoded.database_id, DatabaseId::new(9));
+        assert_eq!(decoded.participating_vshards(), tx.participating_vshards());
+    }
+
     #[derive(zerompk::ToMessagePack)]
     #[msgpack(map)]
     struct LegacyTxClass {
@@ -469,6 +547,7 @@ mod tests {
         assert!(decoded.versioned_reads.is_empty());
         assert!(decoded.dependent_reads.is_none());
         assert_eq!(decoded.tenant_id, TenantId::new(3));
+        assert_eq!(decoded.database_id, DatabaseId::DEFAULT);
         assert_eq!(decoded.plans, vec![0x01, 0x02]);
         assert_eq!(decoded.participating_vshards().len(), 2);
     }
diff --git a/nodedb-cluster/src/metadata_group/cache.rs b/nodedb-cluster/src/metadata_group/cache.rs
index 79c1f8ec1..2e811516e 100644
--- a/nodedb-cluster/src/metadata_group/cache.rs
+++ b/nodedb-cluster/src/metadata_group/cache.rs
@@ -131,6 +131,13 @@ impl MetadataCache {
                 }
             }
             MetadataEntry::DescriptorDrainEnd { .. } => {}
+            MetadataEntry::DdlPrepareAcquire { .. } | MetadataEntry::DdlPrepareRelease { .. } => {
+                // Host-side ephemeral coordination state; replay rebuilds it.
+            }
+            MetadataEntry::DdlPrepared { .. } => {
+                // The host-side applier unwraps and fences this entry. The cache
+                // owns no preparation outcome state.
+            }
             MetadataEntry::CaTrustChange { .. } => {
                 // CA trust mutations are host-side only: the production
                 // applier in the nodedb crate writes/deletes
diff --git a/nodedb-cluster/src/metadata_group/entry.rs b/nodedb-cluster/src/metadata_group/entry.rs
index 06940ca30..4c0a10f25 100644
--- a/nodedb-cluster/src/metadata_group/entry.rs
+++ b/nodedb-cluster/src/metadata_group/entry.rs
@@ -77,6 +77,26 @@ pub enum MetadataEntry {
         entries: Vec<MetadataEntry>,
     },
 
+    /// A catalog DDL proposal fenced by the replicated preparation owner.
+    /// Appliers execute `entry` only while `token` is the current owner;
+    /// superseded proposals are deterministic no-ops so they cannot wedge the
+    /// Raft apply watermark.
+    DdlPrepared {
+        token: u64,
+        entry: Box<MetadataEntry>,
+    },
+
+    /// Acquire the replicated global descriptor-preparation lease. The first
+    /// unexpired owner wins; contenders observe the winner after this entry is
+    /// applied and retry after its matching release or expiry.
+    DdlPrepareAcquire {
+        token: u64,
+    },
+    /// Release the descriptor-preparation lease iff `token` still owns it.
+    DdlPrepareRelease {
+        token: u64,
+    },
+
     // ── Topology / routing ─────────────────────────────────────────────
     TopologyChange(TopologyChange),
     RoutingChange(RoutingChange),
diff --git a/nodedb-sql/src/catalog.rs b/nodedb-sql/src/catalog.rs
index 16bd048af..41aa91772 100644
--- a/nodedb-sql/src/catalog.rs
+++ b/nodedb-sql/src/catalog.rs
@@ -8,6 +8,74 @@ use thiserror::Error;
 use crate::types::CollectionInfo;
 use crate::types_array::{ArrayAttrAst, ArrayDimAst};
 
+/// Normalize the PostgreSQL identifier spelling accepted by `regclass` input.
+///
+/// Unquoted identifiers fold to lowercase, quoted identifiers preserve case and
+/// support doubled quote escapes. NodeDB currently exposes user relations in
+/// `public` and catalog relations in `pg_catalog`; those qualifiers resolve to
+/// the same canonical relation name used by the catalog adapters.
+pub fn normalize_regclass_name(input: &str) -> Option<String> {
+    fn parse_part(raw: &str) -> Option<String> {
+        let raw = raw.trim();
+        if raw.is_empty() {
+            return None;
+        }
+        if !raw.starts_with('"') {
+            return (!raw.contains('"')).then(|| raw.to_ascii_lowercase());
+        }
+
+        let mut chars = raw.char_indices().peekable();
+        chars.next();
+        let mut out = String::new();
+        let mut closed_at = None;
+        while let Some((idx, ch)) = chars.next() {
+            if ch != '"' {
+                out.push(ch);
+                continue;
+            }
+            if chars.peek().is_some_and(|(_, next)| *next == '"') {
+                chars.next();
+                out.push('"');
+            } else {
+                closed_at = Some(idx + ch.len_utf8());
+                break;
+            }
+        }
+        let end = closed_at?;
+        raw[end..].trim().is_empty().then_some(out)
+    }
+
+    let mut parts = Vec::new();
+    let mut quoted = false;
+    let mut start = 0;
+    let chars: Vec<(usize, char)> = input.char_indices().collect();
+    let mut i = 0;
+    while i < chars.len() {
+        let (idx, ch) = chars[i];
+        if ch == '"' {
+            if quoted && i + 1 < chars.len() && chars[i + 1].1 == '"' {
+                i += 2;
+                continue;
+            }
+            quoted = !quoted;
+        } else if ch == '.' && !quoted {
+            parts.push(parse_part(&input[start..idx])?);
+            start = idx + 1;
+        }
+        i += 1;
+    }
+    if quoted {
+        return None;
+    }
+    parts.push(parse_part(&input[start..])?);
+
+    match parts.as_slice() {
+        [name] => Some(name.clone()),
+        [schema, name] if schema == "public" || schema == "pg_catalog" => Some(name.clone()),
+        _ => None,
+    }
+}
+
 /// Errors surfaced by `SqlCatalog` implementations.
 ///
 /// Only one variant today — callers pattern-match directly and
diff --git a/nodedb-sql/src/planner/catalog_expr_fold.rs b/nodedb-sql/src/planner/catalog_expr_fold.rs
new file mode 100644
index 000000000..fd9dbfe79
--- /dev/null
+++ b/nodedb-sql/src/planner/catalog_expr_fold.rs
@@ -0,0 +1,223 @@
+// SPDX-License-Identifier: Apache-2.0
+
+//! Recursive catalog-dependent expression validation and folding.
+
+use nodedb_types::DatabaseId;
+
+use crate::catalog::SqlCatalog;
+use crate::functions::registry::FunctionRegistry;
+use crate::types::{SqlExpr, SqlValue};
+
+pub(super) fn eval_catalog_constant(
+    expr: &SqlExpr,
+    catalog: &dyn SqlCatalog,
+    functions: &FunctionRegistry,
+) -> crate::Result<SqlValue> {
+    if let SqlExpr::Cast {
+        expr: inner,
+        to_type,
+    } = expr
+        && to_type.eq_ignore_ascii_case("regclass")
+        && let SqlExpr::Literal(SqlValue::String(name)) = inner.as_ref()
+    {
+        let normalized = crate::catalog::normalize_regclass_name(name)
+            .ok_or_else(|| crate::SqlError::UnknownTable { name: name.clone() })?;
+        catalog
+            .resolve_regclass(DatabaseId::DEFAULT, 0, name)
+            .ok_or_else(|| crate::SqlError::UnknownTable {
+                name: normalized.clone(),
+            })?;
+        return Ok(SqlValue::String(normalized));
+    }
+    Ok(super::select::helpers::eval_constant_expr(expr, functions))
+}
+
+pub(super) fn validate_expr(
+    expr: &SqlExpr,
+    catalog: &dyn SqlCatalog,
+    database_id: DatabaseId,
+    tenant_id: u64,
+) -> crate::Result<()> {
+    match expr {
+        SqlExpr::Cast { expr, to_type }
+            if to_type.eq_ignore_ascii_case("regclass")
+                && matches!(expr.as_ref(), SqlExpr::Literal(SqlValue::String(_))) =>
+        {
+            let SqlExpr::Literal(SqlValue::String(name)) = expr.as_ref() else {
+                unreachable!();
+            };
+            if catalog
+                .resolve_regclass(database_id, tenant_id, name)
+                .is_none()
+            {
+                return Err(crate::SqlError::UnknownTable { name: name.clone() });
+            }
+            Ok(())
+        }
+        SqlExpr::Cast { expr, .. }
+        | SqlExpr::IsNull { expr, .. }
+        | SqlExpr::UnaryOp { expr, .. } => validate_expr(expr, catalog, database_id, tenant_id),
+        SqlExpr::BinaryOp { left, right, .. } => {
+            validate_expr(left, catalog, database_id, tenant_id)?;
+            validate_expr(right, catalog, database_id, tenant_id)
+        }
+        SqlExpr::InList { expr, list, .. } => {
+            validate_expr(expr, catalog, database_id, tenant_id)?;
+            for item in list {
+                validate_expr(item, catalog, database_id, tenant_id)?;
+            }
+            Ok(())
+        }
+        SqlExpr::ArrayLiteral(items) | SqlExpr::Function { args: items, .. } => {
+            for item in items {
+                validate_expr(item, catalog, database_id, tenant_id)?;
+            }
+            Ok(())
+        }
+        SqlExpr::Between {
+            expr, low, high, ..
+        } => {
+            validate_expr(expr, catalog, database_id, tenant_id)?;
+            validate_expr(low, catalog, database_id, tenant_id)?;
+            validate_expr(high, catalog, database_id, tenant_id)
+        }
+        SqlExpr::Like { expr, pattern, .. } => {
+            validate_expr(expr, catalog, database_id, tenant_id)?;
+            validate_expr(pattern, catalog, database_id, tenant_id)
+        }
+        SqlExpr::Case {
+            operand,
+            when_then,
+            else_expr,
+        } => {
+            if let Some(operand) = operand {
+                validate_expr(operand, catalog, database_id, tenant_id)?;
+            }
+            for (when, then) in when_then {
+                validate_expr(when, catalog, database_id, tenant_id)?;
+                validate_expr(then, catalog, database_id, tenant_id)?;
+            }
+            if let Some(expr) = else_expr {
+                validate_expr(expr, catalog, database_id, tenant_id)?;
+            }
+            Ok(())
+        }
+        _ => Ok(()),
+    }
+}
+
+/// Recursively fold catalog-dependent expressions to constants.
+pub(super) fn fold_expr(
+    expr: SqlExpr,
+    catalog: &dyn SqlCatalog,
+    database_id: DatabaseId,
+    tenant_id: u64,
+) -> SqlExpr {
+    match expr {
+        SqlExpr::Cast {
+            expr: inner_expr,
+            to_type,
+        } => {
+            let upper = to_type.to_ascii_uppercase();
+            if upper == "REGCLASS" {
+                if let SqlExpr::Literal(SqlValue::String(ref name)) = *inner_expr
+                    && let Some(oid) = catalog.resolve_regclass(database_id, tenant_id, name)
+                {
+                    return SqlExpr::Literal(SqlValue::Int(oid));
+                }
+            } else if upper == "REGTYPE"
+                && let SqlExpr::Literal(SqlValue::String(ref name)) = *inner_expr
+                && let Some(oid) = catalog.resolve_regtype(name)
+            {
+                return SqlExpr::Literal(SqlValue::Int(oid));
+            }
+            SqlExpr::Cast {
+                expr: Box::new(fold_expr(*inner_expr, catalog, database_id, tenant_id)),
+                to_type,
+            }
+        }
+        SqlExpr::BinaryOp { left, op, right } => SqlExpr::BinaryOp {
+            left: Box::new(fold_expr(*left, catalog, database_id, tenant_id)),
+            op,
+            right: Box::new(fold_expr(*right, catalog, database_id, tenant_id)),
+        },
+        SqlExpr::InList {
+            expr,
+            list,
+            negated,
+        } => SqlExpr::InList {
+            expr: Box::new(fold_expr(*expr, catalog, database_id, tenant_id)),
+            list: list
+                .into_iter()
+                .map(|e| fold_expr(e, catalog, database_id, tenant_id))
+                .collect(),
+            negated,
+        },
+        SqlExpr::IsNull { expr, negated } => SqlExpr::IsNull {
+            expr: Box::new(fold_expr(*expr, catalog, database_id, tenant_id)),
+            negated,
+        },
+        SqlExpr::UnaryOp { op, expr } => SqlExpr::UnaryOp {
+            op,
+            expr: Box::new(fold_expr(*expr, catalog, database_id, tenant_id)),
+        },
+        SqlExpr::ArrayLiteral(elems) => SqlExpr::ArrayLiteral(
+            elems
+                .into_iter()
+                .map(|e| fold_expr(e, catalog, database_id, tenant_id))
+                .collect(),
+        ),
+        SqlExpr::Function {
+            name,
+            args,
+            distinct,
+        } => SqlExpr::Function {
+            name,
+            args: args
+                .into_iter()
+                .map(|arg| fold_expr(arg, catalog, database_id, tenant_id))
+                .collect(),
+            distinct,
+        },
+        SqlExpr::Between {
+            expr,
+            low,
+            high,
+            negated,
+        } => SqlExpr::Between {
+            expr: Box::new(fold_expr(*expr, catalog, database_id, tenant_id)),
+            low: Box::new(fold_expr(*low, catalog, database_id, tenant_id)),
+            high: Box::new(fold_expr(*high, catalog, database_id, tenant_id)),
+            negated,
+        },
+        SqlExpr::Like {
+            expr,
+            pattern,
+            negated,
+            case_insensitive,
+        } => SqlExpr::Like {
+            expr: Box::new(fold_expr(*expr, catalog, database_id, tenant_id)),
+            pattern: Box::new(fold_expr(*pattern, catalog, database_id, tenant_id)),
+            negated,
+            case_insensitive,
+        },
+        SqlExpr::Case {
+            operand,
+            when_then,
+            else_expr,
+        } => SqlExpr::Case {
+            operand: operand.map(|e| Box::new(fold_expr(*e, catalog, database_id, tenant_id))),
+            when_then: when_then
+                .into_iter()
+                .map(|(when, then)| {
+                    (
+                        fold_expr(when, catalog, database_id, tenant_id),
+                        fold_expr(then, catalog, database_id, tenant_id),
+                    )
+                })
+                .collect(),
+            else_expr: else_expr.map(|e| Box::new(fold_expr(*e, catalog, database_id, tenant_id))),
+        },
+        leaf => leaf,
+    }
+}
diff --git a/nodedb-sql/src/planner/catalog_fold.rs b/nodedb-sql/src/planner/catalog_fold.rs
index b7697f27e..08b93fdce 100644
--- a/nodedb-sql/src/planner/catalog_fold.rs
+++ b/nodedb-sql/src/planner/catalog_fold.rs
@@ -12,7 +12,11 @@
 use nodedb_types::DatabaseId;
 
 use crate::catalog::SqlCatalog;
-use crate::types::{Filter, FilterExpr, SqlExpr, SqlPlan, SqlValue};
+use crate::types::{Filter, FilterExpr, MergePlanAction, SqlExpr, SqlPlan};
+
+use super::catalog_expr_fold::fold_expr;
+use super::catalog_plan_shapes::{fold_aggregates, fold_projection, fold_sort_keys, fold_windows};
+use super::catalog_plan_validate::validate_catalog_exprs;
 
 /// Walk every `Filter` in `plan` and fold catalog-dependent cast expressions
 /// to their constant OID equivalents.
@@ -25,8 +29,9 @@ pub fn fold_catalog_exprs_in_plan(
     catalog: &dyn SqlCatalog,
     database_id: DatabaseId,
     tenant_id: u64,
-) -> SqlPlan {
-    walk_plan(plan, catalog, database_id, tenant_id)
+) -> crate::Result<SqlPlan> {
+    validate_catalog_exprs(&plan, catalog, database_id, tenant_id)?;
+    Ok(walk_plan(plan, catalog, database_id, tenant_id))
 }
 
 fn walk_plan(
@@ -41,17 +46,20 @@ fn walk_plan(
             alias,
             engine,
             mut filters,
-            projection,
-            sort_keys,
+            mut projection,
+            mut sort_keys,
             limit,
             offset,
             distinct,
-            window_functions,
+            mut window_functions,
             temporal,
         } => {
             for f in &mut filters {
                 fold_filter(f, catalog, database_id, tenant_id);
             }
+            fold_projection(&mut projection, catalog, database_id, tenant_id);
+            fold_sort_keys(&mut sort_keys, catalog, database_id, tenant_id);
+            fold_windows(&mut window_functions, catalog, database_id, tenant_id);
             SqlPlan::Scan {
                 collection,
                 alias,
@@ -67,6 +75,34 @@ fn walk_plan(
             }
         }
 
+        SqlPlan::Union { inputs, distinct } => SqlPlan::Union {
+            inputs: inputs
+                .into_iter()
+                .map(|input| walk_plan(input, catalog, database_id, tenant_id))
+                .collect(),
+            distinct,
+        },
+
+        SqlPlan::Intersect { left, right, all } => SqlPlan::Intersect {
+            left: Box::new(walk_plan(*left, catalog, database_id, tenant_id)),
+            right: Box::new(walk_plan(*right, catalog, database_id, tenant_id)),
+            all,
+        },
+
+        SqlPlan::Except { left, right, all } => SqlPlan::Except {
+            left: Box::new(walk_plan(*left, catalog, database_id, tenant_id)),
+            right: Box::new(walk_plan(*right, catalog, database_id, tenant_id)),
+            all,
+        },
+
+        SqlPlan::Cte { definitions, outer } => SqlPlan::Cte {
+            definitions: definitions
+                .into_iter()
+                .map(|(name, plan)| (name, walk_plan(plan, catalog, database_id, tenant_id)))
+                .collect(),
+            outer: Box::new(walk_plan(*outer, catalog, database_id, tenant_id)),
+        },
+
         SqlPlan::Join {
             left,
             right,
@@ -74,13 +110,14 @@ fn walk_plan(
             join_type,
             condition,
             limit,
-            projection,
+            mut projection,
             mut filters,
         } => {
             for f in &mut filters {
                 fold_filter(f, catalog, database_id, tenant_id);
             }
             let condition = condition.map(|e| fold_expr(e, catalog, database_id, tenant_id));
+            fold_projection(&mut projection, catalog, database_id, tenant_id);
             SqlPlan::Join {
                 left: Box::new(walk_plan(*left, catalog, database_id, tenant_id)),
                 right: Box::new(walk_plan(*right, catalog, database_id, tenant_id)),
@@ -93,7 +130,296 @@ fn walk_plan(
             }
         }
 
-        // All other plan variants are passed through unchanged.
+        mut plan @ (SqlPlan::PointGet { .. } | SqlPlan::RangeScan { .. }) => {
+            match &mut plan {
+                SqlPlan::PointGet { projection, .. } | SqlPlan::RangeScan { projection, .. } => {
+                    fold_projection(projection, catalog, database_id, tenant_id);
+                }
+                _ => unreachable!(),
+            }
+            plan
+        }
+
+        mut plan @ (SqlPlan::DocumentIndexLookup { .. }
+        | SqlPlan::Update { .. }
+        | SqlPlan::Delete { .. }) => {
+            match &mut plan {
+                SqlPlan::DocumentIndexLookup {
+                    filters,
+                    projection,
+                    sort_keys,
+                    window_functions,
+                    ..
+                } => {
+                    for filter in filters {
+                        fold_filter(filter, catalog, database_id, tenant_id);
+                    }
+                    fold_projection(projection, catalog, database_id, tenant_id);
+                    fold_sort_keys(sort_keys, catalog, database_id, tenant_id);
+                    fold_windows(window_functions, catalog, database_id, tenant_id);
+                }
+                SqlPlan::Delete { filters, .. } => {
+                    for filter in filters {
+                        fold_filter(filter, catalog, database_id, tenant_id);
+                    }
+                }
+                SqlPlan::Update {
+                    assignments,
+                    filters,
+                    ..
+                } => {
+                    for (_, expr) in assignments {
+                        let owned = std::mem::replace(expr, SqlExpr::Wildcard);
+                        *expr = fold_expr(owned, catalog, database_id, tenant_id);
+                    }
+                    for filter in filters {
+                        fold_filter(filter, catalog, database_id, tenant_id);
+                    }
+                }
+                _ => unreachable!(),
+            }
+            plan
+        }
+
+        SqlPlan::UpdateFrom {
+            collection,
+            engine,
+            source,
+            target_join_col,
+            source_join_col,
+            mut assignments,
+            mut target_filters,
+            returning,
+        } => {
+            for (_, expr) in &mut assignments {
+                let owned = std::mem::replace(expr, SqlExpr::Wildcard);
+                *expr = fold_expr(owned, catalog, database_id, tenant_id);
+            }
+            for filter in &mut target_filters {
+                fold_filter(filter, catalog, database_id, tenant_id);
+            }
+            SqlPlan::UpdateFrom {
+                collection,
+                engine,
+                source: Box::new(walk_plan(*source, catalog, database_id, tenant_id)),
+                target_join_col,
+                source_join_col,
+                assignments,
+                target_filters,
+                returning,
+            }
+        }
+
+        SqlPlan::InsertSelect {
+            target,
+            source,
+            limit,
+        } => SqlPlan::InsertSelect {
+            target,
+            source: Box::new(walk_plan(*source, catalog, database_id, tenant_id)),
+            limit,
+        },
+
+        SqlPlan::Aggregate {
+            input,
+            mut group_by,
+            group_by_aliases,
+            output_order,
+            mut aggregates,
+            mut having,
+            limit,
+            grouping_sets,
+            mut sort_keys,
+        } => {
+            for expr in &mut group_by {
+                let owned = std::mem::replace(expr, SqlExpr::Wildcard);
+                *expr = fold_expr(owned, catalog, database_id, tenant_id);
+            }
+            fold_aggregates(&mut aggregates, catalog, database_id, tenant_id);
+            for filter in &mut having {
+                fold_filter(filter, catalog, database_id, tenant_id);
+            }
+            fold_sort_keys(&mut sort_keys, catalog, database_id, tenant_id);
+            SqlPlan::Aggregate {
+                input: Box::new(walk_plan(*input, catalog, database_id, tenant_id)),
+                group_by,
+                group_by_aliases,
+                output_order,
+                aggregates,
+                having,
+                limit,
+                grouping_sets,
+                sort_keys,
+            }
+        }
+
+        SqlPlan::LateralTopK {
+            outer,
+            outer_alias,
+            inner_collection,
+            mut inner_filters,
+            mut inner_order_by,
+            inner_limit,
+            correlation_keys,
+            lateral_alias,
+            mut projection,
+            left_join,
+        } => {
+            for filter in &mut inner_filters {
+                fold_filter(filter, catalog, database_id, tenant_id);
+            }
+            fold_sort_keys(&mut inner_order_by, catalog, database_id, tenant_id);
+            fold_projection(&mut projection, catalog, database_id, tenant_id);
+            SqlPlan::LateralTopK {
+                outer: Box::new(walk_plan(*outer, catalog, database_id, tenant_id)),
+                outer_alias,
+                inner_collection,
+                inner_filters,
+                inner_order_by,
+                inner_limit,
+                correlation_keys,
+                lateral_alias,
+                projection,
+                left_join,
+            }
+        }
+
+        SqlPlan::LateralLoop {
+            outer,
+            outer_alias,
+            inner,
+            correlation_predicates,
+            lateral_alias,
+            mut projection,
+            outer_row_cap,
+            left_join,
+        } => {
+            fold_projection(&mut projection, catalog, database_id, tenant_id);
+            SqlPlan::LateralLoop {
+                outer: Box::new(walk_plan(*outer, catalog, database_id, tenant_id)),
+                outer_alias,
+                inner: Box::new(walk_plan(*inner, catalog, database_id, tenant_id)),
+                correlation_predicates,
+                lateral_alias,
+                projection,
+                outer_row_cap,
+                left_join,
+            }
+        }
+
+        SqlPlan::Merge {
+            target,
+            engine,
+            source,
+            target_join_col,
+            source_join_col,
+            source_alias,
+            mut clauses,
+            returning,
+        } => {
+            for clause in &mut clauses {
+                for filter in &mut clause.extra_predicate {
+                    fold_filter(filter, catalog, database_id, tenant_id);
+                }
+                match &mut clause.action {
+                    MergePlanAction::Update { assignments } => {
+                        for (_, expr) in assignments {
+                            let owned = std::mem::replace(expr, SqlExpr::Wildcard);
+                            *expr = fold_expr(owned, catalog, database_id, tenant_id);
+                        }
+                    }
+                    MergePlanAction::Insert { values, .. } => {
+                        for expr in values {
+                            let owned = std::mem::replace(expr, SqlExpr::Wildcard);
+                            *expr = fold_expr(owned, catalog, database_id, tenant_id);
+                        }
+                    }
+                    MergePlanAction::Delete | MergePlanAction::DoNothing => {}
+                }
+            }
+            SqlPlan::Merge {
+                target,
+                engine,
+                source: Box::new(walk_plan(*source, catalog, database_id, tenant_id)),
+                target_join_col,
+                source_join_col,
+                source_alias,
+                clauses,
+                returning,
+            }
+        }
+
+        mut plan @ (SqlPlan::VectorSearch { .. }
+        | SqlPlan::TextSearch { .. }
+        | SqlPlan::SpatialScan { .. }
+        | SqlPlan::RecursiveScan { .. }) => {
+            match &mut plan {
+                SqlPlan::VectorSearch {
+                    filters,
+                    projection,
+                    ..
+                } => {
+                    for filter in filters {
+                        fold_filter(filter, catalog, database_id, tenant_id);
+                    }
+                    fold_projection(projection, catalog, database_id, tenant_id);
+                }
+                SqlPlan::TextSearch {
+                    filters,
+                    projection,
+                    ..
+                } => {
+                    for filter in filters {
+                        fold_filter(filter, catalog, database_id, tenant_id);
+                    }
+                    fold_projection(projection, catalog, database_id, tenant_id);
+                }
+                SqlPlan::SpatialScan {
+                    attribute_filters,
+                    projection,
+                    ..
+                } => {
+                    for filter in attribute_filters {
+                        fold_filter(filter, catalog, database_id, tenant_id);
+                    }
+                    fold_projection(projection, catalog, database_id, tenant_id);
+                }
+                SqlPlan::RecursiveScan {
+                    base_filters,
+                    recursive_filters,
+                    projection,
+                    ..
+                } => {
+                    for filter in base_filters {
+                        fold_filter(filter, catalog, database_id, tenant_id);
+                    }
+                    for filter in recursive_filters {
+                        fold_filter(filter, catalog, database_id, tenant_id);
+                    }
+                    fold_projection(projection, catalog, database_id, tenant_id);
+                }
+                _ => unreachable!(),
+            }
+            plan
+        }
+
+        mut plan @ (SqlPlan::MultiVectorSearch { .. }
+        | SqlPlan::SparseSearch { .. }
+        | SqlPlan::HybridSearch { .. }
+        | SqlPlan::HybridSearchTriple { .. }) => {
+            match &mut plan {
+                SqlPlan::MultiVectorSearch { projection, .. }
+                | SqlPlan::SparseSearch { projection, .. }
+                | SqlPlan::HybridSearch { projection, .. }
+                | SqlPlan::HybridSearchTriple { projection, .. } => {
+                    fold_projection(projection, catalog, database_id, tenant_id);
+                }
+                _ => unreachable!(),
+            }
+            plan
+        }
+
+        // Plan variants without expression-bearing filters pass through unchanged.
         other => other,
     }
 }
@@ -134,142 +460,3 @@ fn fold_filter_expr(
         | FilterExpr::IsNotNull { .. } => {}
     }
 }
-
-/// Recursively fold catalog-dependent expressions to constants.
-fn fold_expr(
-    expr: SqlExpr,
-    catalog: &dyn SqlCatalog,
-    database_id: DatabaseId,
-    tenant_id: u64,
-) -> SqlExpr {
-    match expr {
-        // `'name'::regclass` or `'name'::regtype` → OID literal.
-        // We match on both in a single arm to avoid partial-move issues.
-        SqlExpr::Cast {
-            expr: inner_expr,
-            to_type,
-        } => {
-            let upper = to_type.to_ascii_uppercase();
-            if upper == "REGCLASS" {
-                if let SqlExpr::Literal(SqlValue::String(ref name)) = *inner_expr
-                    && let Some(oid) = catalog.resolve_regclass(database_id, tenant_id, name)
-                {
-                    return SqlExpr::Literal(SqlValue::Int(oid));
-                }
-            } else if upper == "REGTYPE"
-                && let SqlExpr::Literal(SqlValue::String(ref name)) = *inner_expr
-                && let Some(oid) = catalog.resolve_regtype(name)
-            {
-                return SqlExpr::Literal(SqlValue::Int(oid));
-            }
-            // Non-catalog cast: recurse into inner expression.
-            SqlExpr::Cast {
-                expr: Box::new(fold_expr(*inner_expr, catalog, database_id, tenant_id)),
-                to_type,
-            }
-        }
-
-        // Recurse into BinaryOp children.
-        SqlExpr::BinaryOp { left, op, right } => SqlExpr::BinaryOp {
-            left: Box::new(fold_expr(*left, catalog, database_id, tenant_id)),
-            op,
-            right: Box::new(fold_expr(*right, catalog, database_id, tenant_id)),
-        },
-
-        // Recurse into InList.
-        SqlExpr::InList {
-            expr,
-            list,
-            negated,
-        } => SqlExpr::InList {
-            expr: Box::new(fold_expr(*expr, catalog, database_id, tenant_id)),
-            list: list
-                .into_iter()
-                .map(|e| fold_expr(e, catalog, database_id, tenant_id))
-                .collect(),
-            negated,
-        },
-
-        // Recurse into IsNull.
-        SqlExpr::IsNull { expr, negated } => SqlExpr::IsNull {
-            expr: Box::new(fold_expr(*expr, catalog, database_id, tenant_id)),
-            negated,
-        },
-
-        // Recurse into UnaryOp.
-        SqlExpr::UnaryOp { op, expr } => SqlExpr::UnaryOp {
-            op,
-            expr: Box::new(fold_expr(*expr, catalog, database_id, tenant_id)),
-        },
-
-        // Recurse into ArrayLiteral elements.
-        SqlExpr::ArrayLiteral(elems) => SqlExpr::ArrayLiteral(
-            elems
-                .into_iter()
-                .map(|e| fold_expr(e, catalog, database_id, tenant_id))
-                .collect(),
-        ),
-
-        // Recurse into Function args.
-        SqlExpr::Function {
-            name,
-            args,
-            distinct,
-        } => SqlExpr::Function {
-            name,
-            args: args
-                .into_iter()
-                .map(|a| fold_expr(a, catalog, database_id, tenant_id))
-                .collect(),
-            distinct,
-        },
-
-        // Recurse into Between bounds.
-        SqlExpr::Between {
-            expr,
-            low,
-            high,
-            negated,
-        } => SqlExpr::Between {
-            expr: Box::new(fold_expr(*expr, catalog, database_id, tenant_id)),
-            low: Box::new(fold_expr(*low, catalog, database_id, tenant_id)),
-            high: Box::new(fold_expr(*high, catalog, database_id, tenant_id)),
-            negated,
-        },
-
-        // Recurse into Like.
-        SqlExpr::Like {
-            expr,
-            pattern,
-            negated,
-            case_insensitive,
-        } => SqlExpr::Like {
-            expr: Box::new(fold_expr(*expr, catalog, database_id, tenant_id)),
-            pattern: Box::new(fold_expr(*pattern, catalog, database_id, tenant_id)),
-            negated,
-            case_insensitive,
-        },
-
-        // Recurse into Case.
-        SqlExpr::Case {
-            operand,
-            when_then,
-            else_expr,
-        } => SqlExpr::Case {
-            operand: operand.map(|e| Box::new(fold_expr(*e, catalog, database_id, tenant_id))),
-            when_then: when_then
-                .into_iter()
-                .map(|(w, t)| {
-                    (
-                        fold_expr(w, catalog, database_id, tenant_id),
-                        fold_expr(t, catalog, database_id, tenant_id),
-                    )
-                })
-                .collect(),
-            else_expr: else_expr.map(|e| Box::new(fold_expr(*e, catalog, database_id, tenant_id))),
-        },
-
-        // Leaf nodes: Column, Literal, Wildcard, Subquery — pass through.
-        leaf => leaf,
-    }
-}
diff --git a/nodedb-sql/src/planner/catalog_plan_shapes.rs b/nodedb-sql/src/planner/catalog_plan_shapes.rs
new file mode 100644
index 000000000..20e393f3e
--- /dev/null
+++ b/nodedb-sql/src/planner/catalog_plan_shapes.rs
@@ -0,0 +1,120 @@
+// SPDX-License-Identifier: Apache-2.0
+
+//! Catalog folding for reusable projection, ordering, aggregate, and window shapes.
+
+use nodedb_types::DatabaseId;
+
+use crate::catalog::SqlCatalog;
+use crate::types::{AggregateExpr, Projection, SortKey, SqlExpr, WindowSpec};
+
+use super::catalog_expr_fold::{fold_expr, validate_expr};
+
+pub(super) fn validate_projection(
+    projection: &[Projection],
+    catalog: &dyn SqlCatalog,
+    database_id: DatabaseId,
+    tenant_id: u64,
+) -> crate::Result<()> {
+    for item in projection {
+        if let Projection::Computed { expr, .. } = item {
+            validate_expr(expr, catalog, database_id, tenant_id)?;
+        }
+    }
+    Ok(())
+}
+
+pub(super) fn validate_sort_keys(
+    sort_keys: &[SortKey],
+    catalog: &dyn SqlCatalog,
+    database_id: DatabaseId,
+    tenant_id: u64,
+) -> crate::Result<()> {
+    for key in sort_keys {
+        validate_expr(&key.expr, catalog, database_id, tenant_id)?;
+    }
+    Ok(())
+}
+
+pub(super) fn validate_aggregates(
+    aggregates: &[AggregateExpr],
+    catalog: &dyn SqlCatalog,
+    database_id: DatabaseId,
+    tenant_id: u64,
+) -> crate::Result<()> {
+    for aggregate in aggregates {
+        for arg in &aggregate.args {
+            validate_expr(arg, catalog, database_id, tenant_id)?;
+        }
+    }
+    Ok(())
+}
+
+pub(super) fn validate_windows(
+    windows: &[WindowSpec],
+    catalog: &dyn SqlCatalog,
+    database_id: DatabaseId,
+    tenant_id: u64,
+) -> crate::Result<()> {
+    for window in windows {
+        for expr in window.args.iter().chain(&window.partition_by) {
+            validate_expr(expr, catalog, database_id, tenant_id)?;
+        }
+        validate_sort_keys(&window.order_by, catalog, database_id, tenant_id)?;
+    }
+    Ok(())
+}
+
+pub(super) fn fold_projection(
+    projection: &mut [Projection],
+    catalog: &dyn SqlCatalog,
+    database_id: DatabaseId,
+    tenant_id: u64,
+) {
+    for item in projection {
+        if let Projection::Computed { expr, .. } = item {
+            let owned = std::mem::replace(expr, SqlExpr::Wildcard);
+            *expr = fold_expr(owned, catalog, database_id, tenant_id);
+        }
+    }
+}
+
+pub(super) fn fold_sort_keys(
+    sort_keys: &mut [SortKey],
+    catalog: &dyn SqlCatalog,
+    database_id: DatabaseId,
+    tenant_id: u64,
+) {
+    for key in sort_keys {
+        let owned = std::mem::replace(&mut key.expr, SqlExpr::Wildcard);
+        key.expr = fold_expr(owned, catalog, database_id, tenant_id);
+    }
+}
+
+pub(super) fn fold_aggregates(
+    aggregates: &mut [AggregateExpr],
+    catalog: &dyn SqlCatalog,
+    database_id: DatabaseId,
+    tenant_id: u64,
+) {
+    for aggregate in aggregates {
+        for arg in &mut aggregate.args {
+            let owned = std::mem::replace(arg, SqlExpr::Wildcard);
+            *arg = fold_expr(owned, catalog, database_id, tenant_id);
+        }
+    }
+}
+
+pub(super) fn fold_windows(
+    windows: &mut [WindowSpec],
+    catalog: &dyn SqlCatalog,
+    database_id: DatabaseId,
+    tenant_id: u64,
+) {
+    for window in windows {
+        for expr in window.args.iter_mut().chain(&mut window.partition_by) {
+            let owned = std::mem::replace(expr, SqlExpr::Wildcard);
+            *expr = fold_expr(owned, catalog, database_id, tenant_id);
+        }
+        fold_sort_keys(&mut window.order_by, catalog, database_id, tenant_id);
+    }
+}
diff --git a/nodedb-sql/src/planner/catalog_plan_validate.rs b/nodedb-sql/src/planner/catalog_plan_validate.rs
new file mode 100644
index 000000000..be7374e29
--- /dev/null
+++ b/nodedb-sql/src/planner/catalog_plan_validate.rs
@@ -0,0 +1,235 @@
+// SPDX-License-Identifier: Apache-2.0
+
+//! Catalog-dependent expression validation across nested SQL plan shapes.
+
+use nodedb_types::DatabaseId;
+
+use crate::catalog::SqlCatalog;
+use crate::types::{FilterExpr, MergePlanAction, SqlPlan};
+
+use super::catalog_expr_fold::validate_expr;
+use super::catalog_plan_shapes::{
+    validate_aggregates, validate_projection, validate_sort_keys, validate_windows,
+};
+
+pub(super) fn validate_catalog_exprs(
+    plan: &SqlPlan,
+    catalog: &dyn SqlCatalog,
+    database_id: DatabaseId,
+    tenant_id: u64,
+) -> crate::Result<()> {
+    match plan {
+        SqlPlan::Scan {
+            filters,
+            projection,
+            sort_keys,
+            window_functions,
+            ..
+        }
+        | SqlPlan::DocumentIndexLookup {
+            filters,
+            projection,
+            sort_keys,
+            window_functions,
+            ..
+        } => {
+            validate_filters(filters, catalog, database_id, tenant_id)?;
+            validate_projection(projection, catalog, database_id, tenant_id)?;
+            validate_sort_keys(sort_keys, catalog, database_id, tenant_id)?;
+            validate_windows(window_functions, catalog, database_id, tenant_id)?;
+        }
+        SqlPlan::PointGet { projection, .. } | SqlPlan::RangeScan { projection, .. } => {
+            validate_projection(projection, catalog, database_id, tenant_id)?;
+        }
+        SqlPlan::Update {
+            assignments,
+            filters,
+            ..
+        } => {
+            for (_, expr) in assignments {
+                validate_expr(expr, catalog, database_id, tenant_id)?;
+            }
+            validate_filters(filters, catalog, database_id, tenant_id)?;
+        }
+        SqlPlan::Delete { filters, .. } => {
+            validate_filters(filters, catalog, database_id, tenant_id)?
+        }
+        SqlPlan::UpdateFrom {
+            source,
+            assignments,
+            target_filters,
+            ..
+        } => {
+            validate_catalog_exprs(source, catalog, database_id, tenant_id)?;
+            for (_, expr) in assignments {
+                validate_expr(expr, catalog, database_id, tenant_id)?;
+            }
+            validate_filters(target_filters, catalog, database_id, tenant_id)?;
+        }
+        SqlPlan::InsertSelect { source, .. } => {
+            validate_catalog_exprs(source, catalog, database_id, tenant_id)?
+        }
+        SqlPlan::Aggregate {
+            input,
+            group_by,
+            aggregates,
+            having,
+            sort_keys,
+            ..
+        } => {
+            validate_catalog_exprs(input, catalog, database_id, tenant_id)?;
+            for expr in group_by {
+                validate_expr(expr, catalog, database_id, tenant_id)?;
+            }
+            validate_aggregates(aggregates, catalog, database_id, tenant_id)?;
+            validate_filters(having, catalog, database_id, tenant_id)?;
+            validate_sort_keys(sort_keys, catalog, database_id, tenant_id)?;
+        }
+        SqlPlan::Union { inputs, .. } => {
+            for input in inputs {
+                validate_catalog_exprs(input, catalog, database_id, tenant_id)?;
+            }
+        }
+        SqlPlan::Intersect { left, right, .. } | SqlPlan::Except { left, right, .. } => {
+            validate_catalog_exprs(left, catalog, database_id, tenant_id)?;
+            validate_catalog_exprs(right, catalog, database_id, tenant_id)?;
+        }
+        SqlPlan::Cte { definitions, outer } => {
+            for (_, definition) in definitions {
+                validate_catalog_exprs(definition, catalog, database_id, tenant_id)?;
+            }
+            validate_catalog_exprs(outer, catalog, database_id, tenant_id)?;
+        }
+        SqlPlan::Join {
+            left,
+            right,
+            condition,
+            projection,
+            filters,
+            ..
+        } => {
+            validate_catalog_exprs(left, catalog, database_id, tenant_id)?;
+            validate_catalog_exprs(right, catalog, database_id, tenant_id)?;
+            if let Some(condition) = condition {
+                validate_expr(condition, catalog, database_id, tenant_id)?;
+            }
+            validate_projection(projection, catalog, database_id, tenant_id)?;
+            validate_filters(filters, catalog, database_id, tenant_id)?;
+        }
+        SqlPlan::LateralTopK {
+            outer,
+            inner_filters,
+            inner_order_by,
+            projection,
+            ..
+        } => {
+            validate_catalog_exprs(outer, catalog, database_id, tenant_id)?;
+            validate_filters(inner_filters, catalog, database_id, tenant_id)?;
+            validate_sort_keys(inner_order_by, catalog, database_id, tenant_id)?;
+            validate_projection(projection, catalog, database_id, tenant_id)?;
+        }
+        SqlPlan::LateralLoop {
+            outer,
+            inner,
+            projection,
+            ..
+        } => {
+            validate_catalog_exprs(outer, catalog, database_id, tenant_id)?;
+            validate_catalog_exprs(inner, catalog, database_id, tenant_id)?;
+            validate_projection(projection, catalog, database_id, tenant_id)?;
+        }
+        SqlPlan::Merge {
+            source, clauses, ..
+        } => {
+            validate_catalog_exprs(source, catalog, database_id, tenant_id)?;
+            for clause in clauses {
+                validate_filters(&clause.extra_predicate, catalog, database_id, tenant_id)?;
+                match &clause.action {
+                    MergePlanAction::Update { assignments } => {
+                        for (_, expr) in assignments {
+                            validate_expr(expr, catalog, database_id, tenant_id)?;
+                        }
+                    }
+                    MergePlanAction::Insert { values, .. } => {
+                        for expr in values {
+                            validate_expr(expr, catalog, database_id, tenant_id)?;
+                        }
+                    }
+                    MergePlanAction::Delete | MergePlanAction::DoNothing => {}
+                }
+            }
+        }
+        SqlPlan::VectorSearch {
+            filters,
+            projection,
+            ..
+        } => {
+            validate_filters(filters, catalog, database_id, tenant_id)?;
+            validate_projection(projection, catalog, database_id, tenant_id)?;
+        }
+        SqlPlan::MultiVectorSearch { projection, .. }
+        | SqlPlan::SparseSearch { projection, .. }
+        | SqlPlan::HybridSearch { projection, .. }
+        | SqlPlan::HybridSearchTriple { projection, .. } => {
+            validate_projection(projection, catalog, database_id, tenant_id)?;
+        }
+        SqlPlan::TextSearch {
+            filters,
+            projection,
+            ..
+        } => {
+            validate_filters(filters, catalog, database_id, tenant_id)?;
+            validate_projection(projection, catalog, database_id, tenant_id)?;
+        }
+        SqlPlan::SpatialScan {
+            attribute_filters,
+            projection,
+            ..
+        } => {
+            validate_filters(attribute_filters, catalog, database_id, tenant_id)?;
+            validate_projection(projection, catalog, database_id, tenant_id)?;
+        }
+        SqlPlan::RecursiveScan {
+            base_filters,
+            recursive_filters,
+            projection,
+            ..
+        } => {
+            validate_filters(base_filters, catalog, database_id, tenant_id)?;
+            validate_filters(recursive_filters, catalog, database_id, tenant_id)?;
+            validate_projection(projection, catalog, database_id, tenant_id)?;
+        }
+        _ => {}
+    }
+    Ok(())
+}
+
+fn validate_filters(
+    filters: &[crate::types::Filter],
+    catalog: &dyn SqlCatalog,
+    database_id: DatabaseId,
+    tenant_id: u64,
+) -> crate::Result<()> {
+    for filter in filters {
+        validate_filter_expr(&filter.expr, catalog, database_id, tenant_id)?;
+    }
+    Ok(())
+}
+
+fn validate_filter_expr(
+    expr: &FilterExpr,
+    catalog: &dyn SqlCatalog,
+    database_id: DatabaseId,
+    tenant_id: u64,
+) -> crate::Result<()> {
+    match expr {
+        FilterExpr::Expr(expr) => validate_expr(expr, catalog, database_id, tenant_id),
+        FilterExpr::And(children) | FilterExpr::Or(children) => {
+            validate_filters(children, catalog, database_id, tenant_id)
+        }
+        FilterExpr::Not(child) => {
+            validate_filter_expr(&child.expr, catalog, database_id, tenant_id)
+        }
+        _ => Ok(()),
+    }
+}
diff --git a/nodedb-sql/src/planner/const_fold.rs b/nodedb-sql/src/planner/const_fold.rs
index bece61962..689c568dd 100644
--- a/nodedb-sql/src/planner/const_fold.rs
+++ b/nodedb-sql/src/planner/const_fold.rs
@@ -85,6 +85,9 @@ fn fold_cast(inner: SqlValue, to_type: &str) -> Option<SqlValue> {
         .unwrap_or(upper.as_str());
 
     match base {
+        // REGCLASS needs the session catalog. Keep the cast intact for the
+        // contextual catalog-fold pass rather than erasing it to a string.
+        "REGCLASS" => None,
         "NUMERIC" | "DECIMAL" => match inner {
             SqlValue::Decimal(d) => Some(SqlValue::Decimal(d)),
             SqlValue::Int(i) => Some(SqlValue::Decimal(rust_decimal::Decimal::from(i))),
diff --git a/nodedb-sql/src/planner/mod.rs b/nodedb-sql/src/planner/mod.rs
index 8c2dd2180..dceda289f 100644
--- a/nodedb-sql/src/planner/mod.rs
+++ b/nodedb-sql/src/planner/mod.rs
@@ -7,7 +7,10 @@ pub mod array_dml;
 pub mod array_fn;
 pub mod ast_helpers;
 pub mod bitmap_emit;
+pub mod catalog_expr_fold;
 pub mod catalog_fold;
+pub mod catalog_plan_shapes;
+pub mod catalog_plan_validate;
 pub mod const_fold;
 pub mod cte;
 pub mod dml;
diff --git a/nodedb-sql/src/planner/select/helpers.rs b/nodedb-sql/src/planner/select/helpers.rs
index 5f105dcee..000574b11 100644
--- a/nodedb-sql/src/planner/select/helpers.rs
+++ b/nodedb-sql/src/planner/select/helpers.rs
@@ -101,7 +101,7 @@ pub fn extract_func_args(func: &ast::Function) -> Result<Vec<ast::Expr>> {
 /// `const_fold::fold_constant` helper so that zero-arg scalar functions
 /// like `now()` and `current_timestamp` go through the same evaluator
 /// as the runtime expression path.
-pub(super) fn eval_constant_expr(expr: &SqlExpr, functions: &FunctionRegistry) -> SqlValue {
+pub(crate) fn eval_constant_expr(expr: &SqlExpr, functions: &FunctionRegistry) -> SqlValue {
     crate::planner::const_fold::fold_constant(expr, functions).unwrap_or(SqlValue::Null)
 }
 
diff --git a/nodedb-sql/src/planner/select/mod.rs b/nodedb-sql/src/planner/select/mod.rs
index 5233cdcb1..3b008071a 100644
--- a/nodedb-sql/src/planner/select/mod.rs
+++ b/nodedb-sql/src/planner/select/mod.rs
@@ -8,7 +8,7 @@
 
 mod entry;
 mod entry_ann;
-mod helpers;
+pub mod helpers;
 mod order_by;
 mod select_stmt;
 mod where_search;
diff --git a/nodedb-sql/src/planner/select/select_stmt.rs b/nodedb-sql/src/planner/select/select_stmt.rs
index 9f0f83f41..e909c0608 100644
--- a/nodedb-sql/src/planner/select/select_stmt.rs
+++ b/nodedb-sql/src/planner/select/select_stmt.rs
@@ -5,7 +5,7 @@
 use nodedb_types::DatabaseId;
 use sqlparser::ast::{self, Select};
 
-use super::helpers::{convert_projection, convert_where_to_filters, eval_constant_expr};
+use super::helpers::{convert_projection, convert_where_to_filters};
 use super::where_search::try_extract_where_search;
 use crate::error::{Result, SqlError};
 use crate::functions::registry::FunctionRegistry;
@@ -68,7 +68,9 @@ pub(super) fn plan_select(
             match proj {
                 Projection::Computed { expr, alias } => {
                     columns.push(alias.clone());
-                    values.push(eval_constant_expr(expr, functions));
+                    values.push(crate::planner::catalog_expr_fold::eval_catalog_constant(
+                        expr, catalog, functions,
+                    )?);
                 }
                 Projection::Column(name) => {
                     columns.push(name.clone());
diff --git a/nodedb-test-support/src/native_harness/frames.rs b/nodedb-test-support/src/native_harness/frames.rs
index b33d89d41..ac523f018 100644
--- a/nodedb-test-support/src/native_harness/frames.rs
+++ b/nodedb-test-support/src/native_harness/frames.rs
@@ -120,11 +120,65 @@ pub async fn send_request(
     let json_bytes = sonic_rs::to_vec(&req).expect("json encode");
     write_frame(stream, &json_bytes).await;
 
-    let response_payload = tokio::time::timeout(Duration::from_secs(5), read_frame(stream))
-        .await
-        .expect("timeout waiting for response")
-        .expect("response frame");
-    sonic_rs::from_slice(&response_payload).expect("json decode NativeResponse")
+    let deadline = tokio::time::Instant::now() + Duration::from_secs(5);
+    let mut accumulated: Option<NativeResponse> = None;
+    loop {
+        let remaining = deadline.saturating_duration_since(tokio::time::Instant::now());
+        let response_payload = tokio::time::timeout(remaining, read_frame(stream))
+            .await
+            .expect("timeout waiting for response")
+            .expect("response frame");
+        let response: NativeResponse =
+            sonic_rs::from_slice(&response_payload).expect("json decode NativeResponse");
+        if response.seq == seq {
+            if response.status == nodedb_types::protocol::ResponseStatus::Partial {
+                if let Some(aggregate) = accumulated.as_mut() {
+                    if aggregate.columns.is_none() {
+                        aggregate.columns = response.columns;
+                    }
+                    aggregate
+                        .rows
+                        .get_or_insert_default()
+                        .extend(response.rows.unwrap_or_default());
+                    if let Some(rows_affected) = response.rows_affected {
+                        aggregate.rows_affected =
+                            Some(aggregate.rows_affected.unwrap_or(0) + rows_affected);
+                    }
+                    aggregate.watermark_lsn = aggregate.watermark_lsn.max(response.watermark_lsn);
+                } else {
+                    accumulated = Some(response);
+                }
+                continue;
+            }
+            if let Some(mut aggregate) = accumulated {
+                if aggregate.columns.is_none() {
+                    aggregate.columns = response.columns;
+                }
+                aggregate
+                    .rows
+                    .get_or_insert_default()
+                    .extend(response.rows.unwrap_or_default());
+                if let Some(rows_affected) = response.rows_affected {
+                    aggregate.rows_affected =
+                        Some(aggregate.rows_affected.unwrap_or(0) + rows_affected);
+                }
+                aggregate.watermark_lsn = aggregate.watermark_lsn.max(response.watermark_lsn);
+                aggregate.status = response.status;
+                aggregate.error = response.error;
+                aggregate.auth = response.auth;
+                aggregate.warnings.extend(response.warnings);
+                return aggregate;
+            }
+            return response;
+        }
+        assert!(
+            response.seq < seq,
+            "native response sequence advanced past request: expected {seq}, got {}",
+            response.seq
+        );
+        // Fan-out queries can leave additional frames for the preceding request.
+        // Drain those stale frames rather than misattributing one to this request.
+    }
 }
 
 /// Authenticate a fresh native connection with an API key. The JSON Auth
diff --git a/nodedb/src/control/catalog_entry/apply/collection.rs b/nodedb/src/control/catalog_entry/apply/collection.rs
index d41476c7f..08bb559f6 100644
--- a/nodedb/src/control/catalog_entry/apply/collection.rs
+++ b/nodedb/src/control/catalog_entry/apply/collection.rs
@@ -36,37 +36,25 @@ pub fn put(stored: &StoredCollection, catalog: &SystemCatalog) {
 /// the create path mirrors `put`'s body precisely so replay/snapshot
 /// re-application stays idempotent.
 pub fn put_if_absent(stored: &StoredCollection, catalog: &SystemCatalog) {
-    match catalog.get_collection(stored.database_id, stored.tenant_id, &stored.name) {
-        Ok(Some(_)) => {
-            debug!(
-                collection = %stored.name,
-                tenant = stored.tenant_id,
-                "catalog_entry: put_collection_if_absent skipped existing collection"
-            );
-        }
-        Ok(None) => {
-            if let Err(e) = catalog.put_collection(stored.database_id, stored) {
-                warn!(
-                    collection = %stored.name,
-                    tenant = stored.tenant_id,
-                    error = %e,
-                    "catalog_entry: put_collection_if_absent put_collection failed"
-                );
-            }
-            super::owner::put_parent_owner_in_database(
-                object_type::COLLECTION,
-                stored.database_id.as_u64(),
-                stored.tenant_id,
-                &stored.name,
-                &stored.owner,
-                catalog,
-            );
-        }
+    match catalog.put_collection_if_absent(stored.database_id, stored) {
+        Ok(true) => super::owner::put_parent_owner_in_database(
+            object_type::COLLECTION,
+            stored.database_id.as_u64(),
+            stored.tenant_id,
+            &stored.name,
+            &stored.owner,
+            catalog,
+        ),
+        Ok(false) => debug!(
+            collection = %stored.name,
+            tenant = stored.tenant_id,
+            "catalog_entry: put_collection_if_absent skipped existing collection"
+        ),
         Err(e) => warn!(
             collection = %stored.name,
             tenant = stored.tenant_id,
             error = %e,
-            "catalog_entry: put_collection_if_absent get failed"
+            "catalog_entry: atomic put_collection_if_absent failed"
         ),
     }
 }
diff --git a/nodedb/src/control/catalog_entry/descriptor_stamp.rs b/nodedb/src/control/catalog_entry/descriptor_stamp.rs
index 3a1bd89b4..30f164890 100644
--- a/nodedb/src/control/catalog_entry/descriptor_stamp.rs
+++ b/nodedb/src/control/catalog_entry/descriptor_stamp.rs
@@ -49,13 +49,18 @@ use crate::control::security::catalog::SystemCatalog;
 /// function — it is strictly the "pre-stamping compat mode"
 /// sentinel.
 pub fn stamp(entry: CatalogEntry, clock: &HlcClock, catalog: &SystemCatalog) -> CatalogEntry {
-    let hlc = clock.now();
+    let mut hlc = clock.now();
     match entry {
         CatalogEntry::PutCollection(mut stored) => {
             let prior = catalog
                 .get_collection(stored.database_id, stored.tenant_id, &stored.name)
                 .ok()
                 .flatten();
+            if let Some(prior_hlc) = prior.as_ref().map(|c| c.modification_hlc)
+                && prior_hlc >= hlc
+            {
+                hlc = clock.update(prior_hlc);
+            }
             let prior_descriptor = prior.as_ref().map(|c| c.descriptor_version).unwrap_or(0);
             stored.descriptor_version = prior_descriptor.saturating_add(1);
             // Constraint version bumps ONLY when the derived constraint set
@@ -83,25 +88,16 @@ pub fn stamp(entry: CatalogEntry, clock: &HlcClock, catalog: &SystemCatalog) ->
                 .get_collection(stored.database_id, stored.tenant_id, &stored.name)
                 .ok()
                 .flatten();
-            let prior_descriptor = prior.as_ref().map(|c| c.descriptor_version).unwrap_or(0);
-            stored.descriptor_version = prior_descriptor.saturating_add(1);
-            // Constraint version bumps ONLY when the derived constraint set
-            // actually changes, so an unrelated ALTER never advances the
-            // apply-time fence key and never transiently rejects in-flight
-            // CRDT deltas. `Constraint: Eq` + name-sorted translator make the
-            // set comparison exact and order-stable.
-            let prior_constraint_version =
-                prior.as_ref().map(|c| c.constraint_version).unwrap_or(0);
-            let prior_set = prior
-                .as_ref()
-                .map(crate::control::security::catalog::collection_constraints)
-                .unwrap_or_default();
+            // Existing is a semantic no-op. Freeze the exact persisted record
+            // rather than manufacturing an unpersisted next version; this also
+            // makes later full-log replay payload-identical and lets a following
+            // real mutation in the same batch advance from the true prior.
+            if let Some(prior) = prior {
+                return CatalogEntry::PutCollectionIfAbsent(Box::new(prior));
+            }
+            stored.descriptor_version = 1;
             let new_set = crate::control::security::catalog::collection_constraints(&stored);
-            stored.constraint_version = if new_set != prior_set {
-                prior_constraint_version.saturating_add(1)
-            } else {
-                prior_constraint_version
-            };
+            stored.constraint_version = u64::from(!new_set.is_empty());
             stored.modification_hlc = hlc;
             CatalogEntry::PutCollectionIfAbsent(stored)
         }
@@ -218,50 +214,327 @@ pub fn stamp(entry: CatalogEntry, clock: &HlcClock, catalog: &SystemCatalog) ->
     }
 }
 
-/// Validate a carried collection descriptor version (frozen at
-/// propose time and replicated verbatim) against this node's local
-/// prior, before the applier persists it. Enforces that a replayed or
-/// re-delivered entry is idempotent and that a real anomaly halts the
-/// apply watermark loudly instead of diverging silently.
-///
-/// - carried `0`: compat mode / unstamped (unit tests) — skipped.
-/// - carried `== prior`: idempotent re-apply / replay of an
-///   already-applied entry — allowed (the write is the same value).
-/// - carried `== prior + 1`: normal new version — allowed.
-/// - carried `< prior` (regression) or `> prior + 1` (gap): a real
-///   anomaly / corruption — returns a loud typed error.
-///
-/// Only the collection `Put*` variants carry a version derived from a
-/// per-descriptor `prior + 1` counter and are validated here; every
-/// other variant is a no-op. Determinism for all stamped variants is
-/// already guaranteed by verbatim application — this check is the
-/// additional guard against a corrupt or reordered collection entry.
-pub fn validate(entry: &CatalogEntry, catalog: &SystemCatalog) -> Result<(), crate::Error> {
-    let (descriptor, carried, prior) = match entry {
-        CatalogEntry::PutCollection(stored) | CatalogEntry::PutCollectionIfAbsent(stored) => {
-            let prior = catalog
+/// Stamp a transactional DDL batch in statement order. Persisted catalog
+/// state seeds the first mutation of each descriptor; a prior mutation of the
+/// same descriptor in this batch seeds the next one.
+pub fn stamp_batch(
+    entries: Vec<CatalogEntry>,
+    clock: &HlcClock,
+    catalog: &SystemCatalog,
+) -> Vec<CatalogEntry> {
+    let mut stamped_entries = Vec::with_capacity(entries.len());
+    for entry in entries {
+        let mut stamped = stamp(entry, clock, catalog);
+        if let Some(prior) = stamped_entries
+            .iter()
+            .rev()
+            .find(|prior| same_descriptor(prior, &stamped))
+        {
+            stamped = advance_after(prior, stamped);
+        }
+        stamped_entries.push(stamped);
+    }
+    stamped_entries
+}
+
+fn same_descriptor(prior: &CatalogEntry, current: &CatalogEntry) -> bool {
+    match (prior, current) {
+        (
+            CatalogEntry::PutCollection(a) | CatalogEntry::PutCollectionIfAbsent(a),
+            CatalogEntry::PutCollection(b) | CatalogEntry::PutCollectionIfAbsent(b),
+        ) => a.database_id == b.database_id && a.tenant_id == b.tenant_id && a.name == b.name,
+        (CatalogEntry::PutMaterializedView(a), CatalogEntry::PutMaterializedView(b)) => {
+            a.tenant_id == b.tenant_id && a.name == b.name
+        }
+        (CatalogEntry::PutFunction(a), CatalogEntry::PutFunction(b)) => {
+            a.tenant_id == b.tenant_id && a.name == b.name
+        }
+        (CatalogEntry::PutProcedure(a), CatalogEntry::PutProcedure(b)) => {
+            a.tenant_id == b.tenant_id && a.name == b.name
+        }
+        (CatalogEntry::PutTrigger(a), CatalogEntry::PutTrigger(b)) => {
+            a.tenant_id == b.tenant_id && a.name == b.name
+        }
+        (CatalogEntry::PutSequence(a), CatalogEntry::PutSequence(b)) => {
+            a.tenant_id == b.tenant_id && a.name == b.name
+        }
+        (CatalogEntry::PutContinuousAggregate(a), CatalogEntry::PutContinuousAggregate(b)) => {
+            a.database_id == b.database_id && a.tenant_id == b.tenant_id && a.name == b.name
+        }
+        _ => false,
+    }
+}
+
+fn advance_after(prior: &CatalogEntry, current: CatalogEntry) -> CatalogEntry {
+    match (prior, current) {
+        (
+            CatalogEntry::PutCollection(prior) | CatalogEntry::PutCollectionIfAbsent(prior),
+            CatalogEntry::PutCollection(mut current),
+        ) => {
+            advance_collection(prior, &mut current);
+            CatalogEntry::PutCollection(current)
+        }
+        (
+            CatalogEntry::PutCollection(prior) | CatalogEntry::PutCollectionIfAbsent(prior),
+            CatalogEntry::PutCollectionIfAbsent(mut current),
+        ) => {
+            advance_collection(prior, &mut current);
+            CatalogEntry::PutCollectionIfAbsent(current)
+        }
+        (
+            CatalogEntry::PutMaterializedView(prior),
+            CatalogEntry::PutMaterializedView(mut current),
+        ) => {
+            current.descriptor_version = prior.descriptor_version.saturating_add(1);
+            CatalogEntry::PutMaterializedView(current)
+        }
+        (CatalogEntry::PutFunction(prior), CatalogEntry::PutFunction(mut current)) => {
+            current.descriptor_version = prior.descriptor_version.saturating_add(1);
+            CatalogEntry::PutFunction(current)
+        }
+        (CatalogEntry::PutProcedure(prior), CatalogEntry::PutProcedure(mut current)) => {
+            current.descriptor_version = prior.descriptor_version.saturating_add(1);
+            CatalogEntry::PutProcedure(current)
+        }
+        (CatalogEntry::PutTrigger(prior), CatalogEntry::PutTrigger(mut current)) => {
+            current.descriptor_version = prior.descriptor_version.saturating_add(1);
+            CatalogEntry::PutTrigger(current)
+        }
+        (CatalogEntry::PutSequence(prior), CatalogEntry::PutSequence(mut current)) => {
+            current.descriptor_version = prior.descriptor_version.saturating_add(1);
+            CatalogEntry::PutSequence(current)
+        }
+        (
+            CatalogEntry::PutContinuousAggregate(prior),
+            CatalogEntry::PutContinuousAggregate(mut current),
+        ) => {
+            current.descriptor_version = prior.descriptor_version.saturating_add(1);
+            CatalogEntry::PutContinuousAggregate(current)
+        }
+        (_, current) => current,
+    }
+}
+
+fn advance_collection(
+    prior: &crate::control::security::catalog::StoredCollection,
+    current: &mut crate::control::security::catalog::StoredCollection,
+) {
+    current.descriptor_version = prior.descriptor_version.saturating_add(1);
+    let prior_set = crate::control::security::catalog::collection_constraints(prior);
+    let current_set = crate::control::security::catalog::collection_constraints(current);
+    current.constraint_version = if prior_set == current_set {
+        prior.constraint_version
+    } else {
+        prior.constraint_version.saturating_add(1)
+    };
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum ValidationOutcome {
+    Apply,
+    AlreadyApplied,
+}
+
+/// Validate every descriptor-bearing `Put*` entry against the locally
+/// persisted version before applying it. Historical replay is idempotent for
+/// all descriptor families, while equal-version conflicts and forward gaps
+/// remain loud anomalies.
+pub fn validate(
+    entry: &CatalogEntry,
+    catalog: &SystemCatalog,
+) -> Result<ValidationOutcome, crate::Error> {
+    match entry {
+        CatalogEntry::PutCollection(stored) => {
+            let current = catalog
                 .get_collection(stored.database_id, stored.tenant_id, &stored.name)
                 .ok()
-                .flatten()
-                .map(|c| c.descriptor_version)
-                .unwrap_or(0);
-            (stored.name.clone(), stored.descriptor_version, prior)
+                .flatten();
+            validate_one(
+                &stored.name,
+                stored.descriptor_version,
+                stored.as_ref(),
+                current.as_ref(),
+                current.as_ref().map_or(0, |value| value.descriptor_version),
+                stored.modification_hlc,
+                current
+                    .as_ref()
+                    .map_or(nodedb_types::Hlc::ZERO, |value| value.modification_hlc),
+            )
         }
-        _ => return Ok(()),
-    };
+        CatalogEntry::PutCollectionIfAbsent(stored) => {
+            let current = catalog
+                .get_collection(stored.database_id, stored.tenant_id, &stored.name)
+                .ok()
+                .flatten();
+            if current.is_some() {
+                Ok(ValidationOutcome::AlreadyApplied)
+            } else {
+                validate_one(
+                    &stored.name,
+                    stored.descriptor_version,
+                    stored.as_ref(),
+                    None,
+                    0,
+                    stored.modification_hlc,
+                    nodedb_types::Hlc::ZERO,
+                )
+            }
+        }
+        CatalogEntry::PutMaterializedView(stored) => {
+            let current = catalog
+                .get_materialized_view(stored.tenant_id, &stored.name)
+                .ok()
+                .flatten();
+            validate_one(
+                &stored.name,
+                stored.descriptor_version,
+                stored.as_ref(),
+                current.as_ref(),
+                current.as_ref().map_or(0, |value| value.descriptor_version),
+                stored.modification_hlc,
+                current
+                    .as_ref()
+                    .map_or(nodedb_types::Hlc::ZERO, |value| value.modification_hlc),
+            )
+        }
+        CatalogEntry::PutFunction(stored) => {
+            let current = catalog
+                .get_function(stored.tenant_id, &stored.name)
+                .ok()
+                .flatten();
+            validate_one(
+                &stored.name,
+                stored.descriptor_version,
+                stored.as_ref(),
+                current.as_ref(),
+                current.as_ref().map_or(0, |value| value.descriptor_version),
+                stored.modification_hlc,
+                current
+                    .as_ref()
+                    .map_or(nodedb_types::Hlc::ZERO, |value| value.modification_hlc),
+            )
+        }
+        CatalogEntry::PutProcedure(stored) => {
+            let current = catalog
+                .get_procedure(stored.tenant_id, &stored.name)
+                .ok()
+                .flatten();
+            validate_one(
+                &stored.name,
+                stored.descriptor_version,
+                stored.as_ref(),
+                current.as_ref(),
+                current.as_ref().map_or(0, |value| value.descriptor_version),
+                stored.modification_hlc,
+                current
+                    .as_ref()
+                    .map_or(nodedb_types::Hlc::ZERO, |value| value.modification_hlc),
+            )
+        }
+        CatalogEntry::PutTrigger(stored) => {
+            let current = catalog
+                .get_trigger(stored.tenant_id, &stored.name)
+                .ok()
+                .flatten();
+            validate_one(
+                &stored.name,
+                stored.descriptor_version,
+                stored.as_ref(),
+                current.as_ref(),
+                current.as_ref().map_or(0, |value| value.descriptor_version),
+                stored.modification_hlc,
+                current
+                    .as_ref()
+                    .map_or(nodedb_types::Hlc::ZERO, |value| value.modification_hlc),
+            )
+        }
+        CatalogEntry::PutSequence(stored) => {
+            let current = catalog
+                .get_sequence(stored.tenant_id, &stored.name)
+                .ok()
+                .flatten();
+            validate_one(
+                &stored.name,
+                stored.descriptor_version,
+                stored.as_ref(),
+                current.as_ref(),
+                current.as_ref().map_or(0, |value| value.descriptor_version),
+                stored.modification_hlc,
+                current
+                    .as_ref()
+                    .map_or(nodedb_types::Hlc::ZERO, |value| value.modification_hlc),
+            )
+        }
+        CatalogEntry::PutContinuousAggregate(stored) => {
+            let current = catalog
+                .get_continuous_aggregate(stored.database_id, stored.tenant_id, &stored.name)
+                .ok()
+                .flatten();
+            validate_one(
+                &stored.name,
+                stored.descriptor_version,
+                stored.as_ref(),
+                current.as_ref(),
+                current.as_ref().map_or(0, |value| value.descriptor_version),
+                stored.modification_hlc,
+                current
+                    .as_ref()
+                    .map_or(nodedb_types::Hlc::ZERO, |value| value.modification_hlc),
+            )
+        }
+        _ => Ok(ValidationOutcome::Apply),
+    }
+}
 
-    // Sentinel `0` is the pre-stamping / compat-mode marker; downstream
-    // resolvers treat it as `1`. Nothing to validate.
+fn validate_one<T: zerompk::ToMessagePack>(
+    name: &str,
+    carried: u64,
+    incoming: &T,
+    current: Option<&T>,
+    prior: u64,
+    incoming_hlc: nodedb_types::Hlc,
+    current_hlc: nodedb_types::Hlc,
+) -> Result<ValidationOutcome, crate::Error> {
     if carried == 0 {
-        return Ok(());
+        return Ok(ValidationOutcome::Apply);
     }
-
-    if carried == prior || carried == prior.saturating_add(1) {
-        return Ok(());
+    // A recreated descriptor restarts its numeric version namespace. Once a
+    // newer lifecycle is persisted, every older-HLC record is historical even
+    // if its old numeric version is greater than the recreated version.
+    if current.is_some() && incoming_hlc < current_hlc {
+        return Ok(ValidationOutcome::AlreadyApplied);
+    }
+    // A lower carried version is a stale historical replay only when its clock
+    // is not ahead of the persisted record (older or equal — legacy records
+    // predating HLC stamping share the ZERO clock). A regressed version paired
+    // with a strictly newer HLC is a genuine anomaly (a corrupted or misordered
+    // proposal, a stamping race) and must fall through to be rejected loudly.
+    if carried < prior && incoming_hlc <= current_hlc {
+        return Ok(ValidationOutcome::AlreadyApplied);
+    }
+    if carried == prior {
+        let same_payload = current
+            .map(|persisted| {
+                let incoming = zerompk::to_msgpack_vec(incoming);
+                let persisted = zerompk::to_msgpack_vec(persisted);
+                matches!((incoming, persisted), (Ok(a), Ok(b)) if a == b)
+            })
+            .unwrap_or(false);
+        return if same_payload {
+            Ok(ValidationOutcome::AlreadyApplied)
+        } else {
+            Err(crate::Error::DescriptorVersionAnomaly {
+                descriptor: name.to_string(),
+                carried,
+                prior,
+            })
+        };
+    }
+    if carried == prior.saturating_add(1) {
+        return Ok(ValidationOutcome::Apply);
     }
-
     Err(crate::Error::DescriptorVersionAnomaly {
-        descriptor,
+        descriptor: name.to_string(),
         carried,
         prior,
     })
@@ -270,7 +543,7 @@ pub fn validate(entry: &CatalogEntry, catalog: &SystemCatalog) -> Result<(), cra
 #[cfg(test)]
 mod tests {
     use super::*;
-    use crate::control::security::catalog::StoredCollection;
+    use crate::control::security::catalog::{StoredCollection, StoredSequence};
     use crate::control::security::credential::CredentialStore;
     use nodedb_types::DatabaseId;
     use std::sync::Arc;
@@ -321,6 +594,75 @@ mod tests {
         }
     }
 
+    #[test]
+    fn stamp_batch_advances_repeated_collection_mutations() {
+        let (store, _tmp) = make_catalog();
+        let clock = HlcClock::new();
+        let entries = vec![
+            CatalogEntry::PutCollection(Box::new(StoredCollection::new(1, "orders", "tester"))),
+            CatalogEntry::PutCollection(Box::new(StoredCollection::new(1, "orders", "tester"))),
+        ];
+        let stamped = stamp_batch(entries, &clock, store.catalog());
+        let CatalogEntry::PutCollection(first) = &stamped[0] else {
+            panic!("expected first collection");
+        };
+        let CatalogEntry::PutCollection(second) = &stamped[1] else {
+            panic!("expected second collection");
+        };
+        assert_eq!(first.descriptor_version, 1);
+        assert_eq!(second.descriptor_version, 2);
+    }
+
+    #[test]
+    fn stamp_batch_existing_if_absent_does_not_consume_a_version() {
+        let (store, _tmp) = make_catalog();
+        let clock = HlcClock::new();
+        seed_prior(store.catalog(), "orders", 1);
+        let mut announcement = StoredCollection::new(1, "orders", "remote");
+        announcement.descriptor_version = 0;
+        let update = StoredCollection::new(1, "orders", "updated");
+        let stamped = stamp_batch(
+            vec![
+                CatalogEntry::PutCollectionIfAbsent(Box::new(announcement)),
+                CatalogEntry::PutCollection(Box::new(update)),
+            ],
+            &clock,
+            store.catalog(),
+        );
+        let CatalogEntry::PutCollectionIfAbsent(noop) = &stamped[0] else {
+            panic!("expected create-only entry");
+        };
+        let CatalogEntry::PutCollection(update) = &stamped[1] else {
+            panic!("expected real update");
+        };
+        assert_eq!(noop.descriptor_version, 1);
+        assert_eq!(noop.owner, "tester");
+        assert_eq!(update.descriptor_version, 2);
+    }
+
+    #[test]
+    fn stamp_batch_advances_repeated_sequence_mutations() {
+        let (store, _tmp) = make_catalog();
+        let clock = HlcClock::new();
+        let sequence = StoredSequence::new(1, "invoice_seq".into(), "tester".into());
+        let stamped = stamp_batch(
+            vec![
+                CatalogEntry::PutSequence(Box::new(sequence.clone())),
+                CatalogEntry::PutSequence(Box::new(sequence)),
+            ],
+            &clock,
+            store.catalog(),
+        );
+        let CatalogEntry::PutSequence(first) = &stamped[0] else {
+            panic!("expected first sequence");
+        };
+        let CatalogEntry::PutSequence(second) = &stamped[1] else {
+            panic!("expected second sequence");
+        };
+        assert_eq!(first.descriptor_version, 1);
+        assert_eq!(second.descriptor_version, 2);
+    }
+
     #[test]
     fn stamp_ignores_deletes() {
         let (store, _tmp) = make_catalog();
@@ -354,16 +696,28 @@ mod tests {
         let (store, _tmp) = make_catalog();
         let catalog = store.catalog();
         // No prior record (prior = 0), carried = 1 → prior + 1.
-        assert!(validate(&collection_with_version("orders", 1), catalog).is_ok());
+        assert!(matches!(
+            validate(&collection_with_version("orders", 1), catalog),
+            Ok(ValidationOutcome::Apply)
+        ));
     }
 
     #[test]
     fn validate_allows_idempotent_replay() {
         let (store, _tmp) = make_catalog();
         let catalog = store.catalog();
-        seed_prior(catalog, "orders", 3);
-        // Re-delivery / full-log replay: carried == prior.
-        assert!(validate(&collection_with_version("orders", 3), catalog).is_ok());
+        let entry = collection_with_version("orders", 3);
+        let CatalogEntry::PutCollection(stored) = &entry else {
+            unreachable!();
+        };
+        catalog
+            .put_collection(DatabaseId::DEFAULT, stored)
+            .expect("seed exact prior");
+        // Re-delivery / full-log replay: carried == prior and payload-identical.
+        assert!(matches!(
+            validate(&entry, catalog),
+            Ok(ValidationOutcome::AlreadyApplied)
+        ));
     }
 
     #[test]
@@ -371,7 +725,10 @@ mod tests {
         let (store, _tmp) = make_catalog();
         let catalog = store.catalog();
         seed_prior(catalog, "orders", 3);
-        assert!(validate(&collection_with_version("orders", 4), catalog).is_ok());
+        assert!(matches!(
+            validate(&collection_with_version("orders", 4), catalog),
+            Ok(ValidationOutcome::Apply)
+        ));
     }
 
     #[test]
@@ -380,7 +737,10 @@ mod tests {
         let catalog = store.catalog();
         seed_prior(catalog, "orders", 3);
         // Compat mode / unstamped entry: version 0 is never validated.
-        assert!(validate(&collection_with_version("orders", 0), catalog).is_ok());
+        assert!(matches!(
+            validate(&collection_with_version("orders", 0), catalog),
+            Ok(ValidationOutcome::Apply)
+        ));
     }
 
     #[test]
@@ -402,18 +762,86 @@ mod tests {
     }
 
     #[test]
-    fn validate_rejects_regression() {
+    fn validate_acknowledges_stale_historical_replay() {
         let (store, _tmp) = make_catalog();
         let catalog = store.catalog();
         seed_prior(catalog, "orders", 5);
-        // carried = 2 < prior = 5 → regression anomaly.
-        let err = validate(&collection_with_version("orders", 2), catalog)
-            .expect_err("regression must be rejected");
+        assert!(matches!(
+            validate(&collection_with_version("orders", 2), catalog),
+            Ok(ValidationOutcome::AlreadyApplied)
+        ));
+    }
+
+    #[test]
+    fn validate_treats_older_higher_version_as_prior_incarnation() {
+        let (store, _tmp) = make_catalog();
+        let catalog = store.catalog();
+        let mut current = StoredCollection::new(1, "orders", "new_owner");
+        current.descriptor_version = 1;
+        current.modification_hlc = nodedb_types::Hlc::new(20, 0);
+        catalog
+            .put_collection(DatabaseId::DEFAULT, &current)
+            .expect("seed recreated collection");
+
+        let mut historical = StoredCollection::new(1, "orders", "old_owner");
+        historical.descriptor_version = 5;
+        historical.modification_hlc = nodedb_types::Hlc::new(10, 0);
+        assert!(matches!(
+            validate(&CatalogEntry::PutCollection(Box::new(historical)), catalog),
+            Ok(ValidationOutcome::AlreadyApplied)
+        ));
+    }
+
+    #[test]
+    fn validate_rejects_newer_divergent_equal_version() {
+        let (store, _tmp) = make_catalog();
+        let catalog = store.catalog();
+        let mut current = StoredCollection::new(1, "orders", "first");
+        current.descriptor_version = 2;
+        current.modification_hlc = nodedb_types::Hlc::new(10, 0);
+        catalog
+            .put_collection(DatabaseId::DEFAULT, &current)
+            .expect("seed current collection");
+        let mut conflict = current;
+        conflict.owner = "conflict".into();
+        conflict.modification_hlc = nodedb_types::Hlc::new(11, 0);
+        assert!(matches!(
+            validate(&CatalogEntry::PutCollection(Box::new(conflict)), catalog),
+            Err(crate::Error::DescriptorVersionAnomaly { .. })
+        ));
+    }
+
+    #[test]
+    fn validate_acknowledges_stale_sequence_replay() {
+        let (store, _tmp) = make_catalog();
+        let catalog = store.catalog();
+        let mut persisted = StoredSequence::new(1, "invoice_seq".into(), "tester".into());
+        persisted.descriptor_version = 4;
+        catalog.put_sequence(&persisted).expect("seed sequence");
+
+        let mut historical = persisted.clone();
+        historical.descriptor_version = 2;
+        historical.increment = 5;
+        assert!(matches!(
+            validate(&CatalogEntry::PutSequence(Box::new(historical)), catalog),
+            Ok(ValidationOutcome::AlreadyApplied)
+        ));
+    }
+
+    #[test]
+    fn validate_rejects_divergent_payload_at_same_version() {
+        let (store, _tmp) = make_catalog();
+        let catalog = store.catalog();
+        seed_prior(catalog, "orders", 3);
+        let mut divergent = StoredCollection::new(1, "orders", "different-owner");
+        divergent.descriptor_version = 3;
+        let err = validate(&CatalogEntry::PutCollection(Box::new(divergent)), catalog)
+            .expect_err("same-version divergent payload must be rejected");
         assert!(matches!(
             err,
             crate::Error::DescriptorVersionAnomaly {
-                carried: 2,
-                prior: 5,
+                carried: 3,
+                prior: 3,
                 ..
             }
         ));
diff --git a/nodedb/src/control/cluster/calvin/scheduler/driver/core/commit_redo.rs b/nodedb/src/control/cluster/calvin/scheduler/driver/core/commit_redo.rs
index b75e697d5..d9181f9bb 100644
--- a/nodedb/src/control/cluster/calvin/scheduler/driver/core/commit_redo.rs
+++ b/nodedb/src/control/cluster/calvin/scheduler/driver/core/commit_redo.rs
@@ -16,7 +16,7 @@ use super::scheduler::Scheduler;
 use crate::bridge::envelope::{Response, Status};
 use crate::control::cluster::calvin::scheduler::lock_manager::TxnId;
 use crate::control::cluster::calvin::scheduler::metrics::infra_abort_reason;
-use crate::types::{DatabaseId, VShardId};
+use crate::types::VShardId;
 use crate::wal::{CalvinStamp, RedoRecord};
 use nodedb_physical::physical_plan::PhysicalPlan;
 use nodedb_physical::physical_plan::meta::MetaOp;
@@ -72,6 +72,7 @@ impl Scheduler {
             return;
         };
         let tenant_id = pending.txn.tx_class.tenant_id;
+        let database_id = pending.txn.tx_class.database_id;
 
         let redo_lsn = if redo.ops.is_empty() {
             None
@@ -79,7 +80,7 @@ impl Scheduler {
             match self.shared.wal.append_transaction_redo(
                 tenant_id,
                 VShardId::new(self.vshard_id),
-                DatabaseId::DEFAULT,
+                database_id,
                 &redo,
             ) {
                 Ok(lsn) => Some(lsn),
@@ -139,6 +140,7 @@ impl Scheduler {
             return false;
         };
         let tenant_id = pending.txn.tx_class.tenant_id;
+        let database_id = pending.txn.tx_class.database_id;
         let epoch = txn_id.epoch;
         let position = txn_id.position;
 
@@ -146,7 +148,7 @@ impl Scheduler {
         let plan = PhysicalPlan::Meta(MetaOp::CalvinResolve { epoch, position });
         // A resolve reads the staged overlay only; it writes no WAL record
         // itself, so no committed LSN rides on this envelope.
-        let request = self.build_exempt_request(request_id, tenant_id, plan, None);
+        let request = self.build_exempt_request(request_id, tenant_id, database_id, plan, None);
 
         let resp_rx = self.shared.tracker.register(request_id);
         let dispatch_result = match self.shared.dispatcher.lock() {
diff --git a/nodedb/src/control/cluster/calvin/scheduler/driver/core/commit_resolution_dispatch.rs b/nodedb/src/control/cluster/calvin/scheduler/driver/core/commit_resolution_dispatch.rs
new file mode 100644
index 000000000..42dc11229
--- /dev/null
+++ b/nodedb/src/control/cluster/calvin/scheduler/driver/core/commit_resolution_dispatch.rs
@@ -0,0 +1,53 @@
+// SPDX-License-Identifier: BUSL-1.1
+
+//! Dispatch of staged Calvin flush/drop resolution operations.
+
+use nodedb_physical::physical_plan::PhysicalPlan;
+use nodedb_physical::physical_plan::meta::MetaOp;
+
+use super::scheduler::Scheduler;
+use crate::control::cluster::calvin::scheduler::lock_manager::TxnId;
+
+impl Scheduler {
+    /// Dispatch a flush or drop of a staged transaction's commit-pending buffer.
+    pub(in crate::control::cluster::calvin::scheduler::driver::core) fn dispatch_commit_resolution(
+        &mut self,
+        txn_id: TxnId,
+        committed: bool,
+        wal_lsn: Option<crate::types::Lsn>,
+    ) -> bool {
+        let Some(pending) = self.pending.get(&txn_id) else {
+            return false;
+        };
+        let tenant_id = pending.txn.tx_class.tenant_id;
+        let database_id = pending.txn.tx_class.database_id;
+        let epoch = txn_id.epoch;
+        let position = txn_id.position;
+        let plan = if committed {
+            PhysicalPlan::Meta(MetaOp::CalvinFlush { epoch, position })
+        } else {
+            PhysicalPlan::Meta(MetaOp::CalvinDrop { epoch, position })
+        };
+        let request_id = self.next_request_id();
+        let request = self.build_exempt_request(request_id, tenant_id, database_id, plan, wal_lsn);
+        let resp_rx = self.shared.tracker.register(request_id);
+        let dispatch_result = match self.shared.dispatcher.lock() {
+            Ok(mut dispatcher) => dispatcher.dispatch(request),
+            Err(poisoned) => poisoned.into_inner().dispatch(request),
+        };
+        if let Err(error) = dispatch_result {
+            self.shared.tracker.cancel(&request_id);
+            tracing::error!(
+                vshard_id = self.vshard_id,
+                epoch,
+                position,
+                committed,
+                %error,
+                "calvin: commit resolution dispatch failed"
+            );
+            return false;
+        }
+        self.spawn_response_bridge(txn_id, request_id, resp_rx);
+        true
+    }
+}
diff --git a/nodedb/src/control/cluster/calvin/scheduler/driver/core/commit_resolve.rs b/nodedb/src/control/cluster/calvin/scheduler/driver/core/commit_resolve.rs
index 3d713c572..7acd0e9b7 100644
--- a/nodedb/src/control/cluster/calvin/scheduler/driver/core/commit_resolve.rs
+++ b/nodedb/src/control/cluster/calvin/scheduler/driver/core/commit_resolve.rs
@@ -22,8 +22,6 @@ use super::scheduler::Scheduler;
 use crate::bridge::envelope::{Response, Status};
 use crate::control::cluster::calvin::scheduler::lock_manager::TxnId;
 use crate::control::cluster::calvin::scheduler::metrics::infra_abort_reason;
-use nodedb_physical::physical_plan::PhysicalPlan;
-use nodedb_physical::physical_plan::meta::MetaOp;
 
 impl Scheduler {
     /// Cast this participant's local commit vote for a staged transaction, then
@@ -261,9 +259,9 @@ impl Scheduler {
         committed: bool,
         redo_lsn: Option<crate::types::Lsn>,
     ) {
-        if response.status == Status::Ok {
+        let completed = if response.status == Status::Ok {
             if committed {
-                self.commit_apply_tail(txn_id, response, redo_lsn);
+                self.commit_apply_tail(txn_id, response, redo_lsn)
             } else {
                 self.propose_sequencer_entry(
                     SequencerEntry::CompletionAck {
@@ -274,22 +272,40 @@ impl Scheduler {
                     txn_id,
                     "completion ack (dropped)",
                 );
+                true
             }
         } else {
-            tracing::warn!(
+            tracing::error!(
                 vshard_id = self.vshard_id,
                 epoch = txn_id.epoch,
                 position = txn_id.position,
                 committed,
-                "calvin: flush/drop response was not Ok; locks NOT released (shard degraded)"
+                "calvin: flush/drop response was not Ok while applying an already-committed \
+                 verdict; forcing infra-abort completion so locks release and the epoch advances"
             );
+            false
+        };
+
+        if completed {
+            self.metrics.record_completed();
+            self.on_txn_complete(txn_id);
+        } else {
+            // The cross-shard verdict is already globally durable, and a commit's
+            // resolved redo was WAL-appended before this flush — so recovery
+            // re-applies the write. A local flush/apply or WAL-marker failure is
+            // therefore an infrastructure event, NOT an outcome change. It must
+            // never leave the txn parked: holding its locks forever wedges every
+            // txn queued behind those keys and freezes this vShard's epoch
+            // watermark (which anchors cross-shard BEGIN snapshots), and nothing
+            // re-drives a non-`AwaitingVerdict` pending entry. Surface the infra
+            // abort and force completion — the same forward-progress contract the
+            // resolve/drop dispatch-failure path in `resume_on_verdict` follows.
             self.metrics.record_executor_error();
             self.metrics
                 .record_infra_abort(infra_abort_reason::IO_ERROR);
+            self.metrics.record_completed();
+            self.on_txn_complete(txn_id);
         }
-
-        self.metrics.record_completed();
-        self.on_txn_complete(txn_id);
     }
 
     /// Deposit the applied result, durably mark the apply, record the apply's
@@ -310,7 +326,7 @@ impl Scheduler {
         txn_id: TxnId,
         response: Response,
         redo_lsn: Option<crate::types::Lsn>,
-    ) {
+    ) -> bool {
         // Deposit the FULL applied Response (affected-count + watermark + any
         // RETURNING rows) into the local sidecar BEFORE proposing the replicated
         // CompletionAck. The ack fires the coordinator's completion oneshot on
@@ -395,12 +411,15 @@ impl Scheduler {
                 }
             }
         }
-        match redo_lsn {
+        let applied_lsn = match redo_lsn {
             // The TransactionRedo record already durably marks this apply — the
             // SAME shard-local WAL-LSN space fast-path writes and read
             // watermarks use. Record the apply's per-key write versions at it;
             // no second (CalvinApplied) marker is written.
-            Some(lsn) => self.record_calvin_write_versions(txn_id, lsn),
+            Some(lsn) => {
+                self.record_calvin_write_versions(txn_id, lsn);
+                Some(lsn)
+            }
             None => match self.shared.wal.append_calvin_applied(
                 crate::types::VShardId::new(self.vshard_id),
                 txn_id.epoch,
@@ -410,7 +429,10 @@ impl Scheduler {
                 // apply — the SAME shard-local WAL-LSN space fast-path writes and
                 // read watermarks use. Record the apply's per-key write versions
                 // at it now that it exists (it did not at dispatch time).
-                Ok(applied_lsn) => self.record_calvin_write_versions(txn_id, applied_lsn),
+                Ok(applied_lsn) => {
+                    self.record_calvin_write_versions(txn_id, applied_lsn);
+                    Some(applied_lsn)
+                }
                 Err(e) => {
                     tracing::error!(
                         vshard_id = self.vshard_id,
@@ -419,8 +441,33 @@ impl Scheduler {
                         error = %e,
                         "calvin: failed to write CalvinApplied WAL record"
                     );
+                    None
                 }
             },
+        };
+        let Some(lsn) = applied_lsn else {
+            // The apply cannot be acknowledged without a durable participant
+            // LSN: CDC and write-version consumers would otherwise observe a
+            // successful commit with no authoritative ordering point.
+            return false;
+        };
+        // Control change-stream events are distinct from Data-Plane
+        // WriteEvents. Publish the participant-local logical manifests once,
+        // from the data-group leader, at the authoritative committed LSN.
+        if self.is_group_leader()
+            && let Some(pending) = self.pending.get_mut(&txn_id)
+        {
+            let tenant_id = pending.txn.tx_class.tenant_id;
+            let database_id = pending.txn.tx_class.database_id;
+            for change_set in std::mem::take(&mut pending.change_sets) {
+                crate::control::server::dispatch_utils::publish_change_set_with_lsn(
+                    &self.shared,
+                    tenant_id,
+                    database_id,
+                    change_set,
+                    lsn,
+                );
+            }
         }
         self.propose_sequencer_entry(
             SequencerEntry::CompletionAck {
@@ -431,66 +478,6 @@ impl Scheduler {
             txn_id,
             "completion ack",
         );
-    }
-
-    /// Dispatch a flush (`committed = true`) or drop (`committed = false`) of a
-    /// staged transaction's commit-pending buffer back to its core, registering
-    /// a response bridge so the resolve response re-enters the completion loop.
-    ///
-    /// `wal_lsn` is the just-appended `TransactionRedo` LSN for a flush whose
-    /// resolved redo carried ops (`Some`); `None` for a drop, or a flush whose
-    /// resolved redo was empty (falls back to the `CalvinApplied` marker in
-    /// `commit_apply_tail`).
-    ///
-    /// Returns `false` if the dispatch failed (the caller then completes the txn
-    /// as an infra error). Mirrors the exempt dispatch shape of the
-    /// static/active dispatch and the write-version record op.
-    pub(in crate::control::cluster::calvin::scheduler::driver::core) fn dispatch_commit_resolution(
-        &mut self,
-        txn_id: TxnId,
-        committed: bool,
-        wal_lsn: Option<crate::types::Lsn>,
-    ) -> bool {
-        let Some(pending) = self.pending.get(&txn_id) else {
-            return false;
-        };
-        let tenant_id = pending.txn.tx_class.tenant_id;
-        let epoch = txn_id.epoch;
-        let position = txn_id.position;
-
-        let plan = if committed {
-            PhysicalPlan::Meta(MetaOp::CalvinFlush { epoch, position })
-        } else {
-            PhysicalPlan::Meta(MetaOp::CalvinDrop { epoch, position })
-        };
-
-        let request_id = self.next_request_id();
-        // The redo record (if any) was already WAL-appended by the caller
-        // before this dispatch — see `finish_redo_resolve` — so its LSN
-        // rides on the envelope here rather than being allocated post-apply.
-        let request = self.build_exempt_request(request_id, tenant_id, plan, wal_lsn);
-
-        let resp_rx = self.shared.tracker.register(request_id);
-        let dispatch_result = match self.shared.dispatcher.lock() {
-            Ok(mut d) => d.dispatch(request),
-            Err(poisoned) => poisoned.into_inner().dispatch(request),
-        };
-        if let Err(e) = dispatch_result {
-            self.shared.tracker.cancel(&request_id);
-            tracing::error!(
-                vshard_id = self.vshard_id,
-                epoch,
-                position,
-                committed,
-                error = %e,
-                "calvin: flush/drop dispatch failed"
-            );
-            return false;
-        }
-
-        // The resolve response re-enters the completion loop under the SAME
-        // txn_id, now in `AwaitingResolve`, where `finish_resolved_commit` runs.
-        self.spawn_response_bridge(txn_id, request_id, resp_rx);
         true
     }
 }
diff --git a/nodedb/src/control/cluster/calvin/scheduler/driver/core/completion_route.rs b/nodedb/src/control/cluster/calvin/scheduler/driver/core/completion_route.rs
index 97602f3cb..99ab2d4dc 100644
--- a/nodedb/src/control/cluster/calvin/scheduler/driver/core/completion_route.rs
+++ b/nodedb/src/control/cluster/calvin/scheduler/driver/core/completion_route.rs
@@ -153,7 +153,7 @@ impl Scheduler {
             None => {}
         }
 
-        if response.status == crate::bridge::envelope::Status::Ok {
+        let completed = if response.status == crate::bridge::envelope::Status::Ok {
             // Observe whether the applying participant reported its slice of the
             // transaction's reads as no longer current against the local write
             // versions. Direct-apply (dependent/active) observation only: the
@@ -165,21 +165,34 @@ impl Scheduler {
                     .read_set_validation_failures
                     .fetch_add(1, std::sync::atomic::Ordering::Relaxed);
             }
-            self.commit_apply_tail(txn_id, response, None);
+            self.commit_apply_tail(txn_id, response, None)
         } else {
-            tracing::warn!(
+            tracing::error!(
                 vshard_id = self.vshard_id,
                 epoch = txn_id.epoch,
                 position = txn_id.position,
-                "calvin: executor response was not Ok; locks NOT released (shard degraded)"
+                "calvin: executor response was not Ok; forcing infra-abort completion so locks \
+                 release and the epoch advances"
             );
+            false
+        };
+
+        if completed {
+            self.metrics.record_completed();
+            self.on_txn_complete(txn_id);
+        } else {
+            // A failed direct apply must not leave the txn parked with its locks
+            // held: that wedges every txn queued behind those keys and freezes
+            // this vShard's epoch watermark, and no sweep re-drives the entry.
+            // Surface the infra abort and force completion — the same
+            // forward-progress contract the disconnected-channel path above
+            // follows.
             self.metrics.record_executor_error();
             self.metrics.record_infra_abort(
                 crate::control::cluster::calvin::scheduler::metrics::infra_abort_reason::IO_ERROR,
             );
+            self.metrics.record_completed();
+            self.on_txn_complete(txn_id);
         }
-
-        self.metrics.record_completed();
-        self.on_txn_complete(txn_id);
     }
 }
diff --git a/nodedb/src/control/cluster/calvin/scheduler/driver/core/dispatch.rs b/nodedb/src/control/cluster/calvin/scheduler/driver/core/dispatch.rs
index 836c66a7a..29f865c70 100644
--- a/nodedb/src/control/cluster/calvin/scheduler/driver/core/dispatch.rs
+++ b/nodedb/src/control/cluster/calvin/scheduler/driver/core/dispatch.rs
@@ -8,7 +8,7 @@ use tracing::error;
 
 use nodedb_cluster::calvin::types::SequencedTxn;
 
-use super::routing::{PlanRouting, plan_vshard};
+use super::routing::PlanRouting;
 use super::scheduler::Scheduler;
 use crate::control::cluster::calvin::scheduler::lock_manager::TxnId;
 use crate::types::{DatabaseId, VShardId};
@@ -30,6 +30,28 @@ use nodedb_physical::physical_plan::meta::MetaOp;
 /// so its rows are still deposited) while ALSO carrying the affected-count of a
 /// plain (non-RETURNING) write — which a RETURNING-only gate dropped, making a
 /// routed plain write report zero rows affected.
+fn participant_change_sets(
+    plans: &[PhysicalPlan],
+    tenant_id: crate::types::TenantId,
+    vshard_id: u32,
+) -> Vec<crate::control::server::dispatch_utils::WriteChangeSet> {
+    plans
+        .iter()
+        .filter(|plan| match plan {
+            // Edge plans are dual-homed; only the source participant publishes
+            // the one logical Control-Plane event.
+            PhysicalPlan::Graph(
+                nodedb_physical::physical_plan::GraphOp::EdgePut { src_id, .. }
+                | nodedb_physical::physical_plan::GraphOp::EdgeDelete { src_id, .. },
+            ) => VShardId::from_key(src_id.as_bytes()).as_u32() == vshard_id,
+            _ => true,
+        })
+        .map(|plan| {
+            crate::control::server::dispatch_utils::extract_write_change_set(plan, tenant_id)
+        })
+        .collect()
+}
+
 pub(crate) fn plans_have_primary_write(plans: &[PhysicalPlan]) -> bool {
     plans.iter().any(|plan| {
         crate::control::planner::calvin::is_write_plan(plan)
@@ -108,12 +130,13 @@ impl Scheduler {
     pub(in crate::control::cluster::calvin::scheduler::driver::core) fn local_calvin_plans(
         &self,
         plans: Vec<PhysicalPlan>,
+        database_id: DatabaseId,
         epoch: u64,
         position: u32,
     ) -> crate::Result<Vec<PhysicalPlan>> {
         let mut local = Vec::new();
         for plan in plans {
-            match plan_vshard(&plan) {
+            match super::routing::plan_vshard_in_database(&plan, database_id) {
                 PlanRouting::Vshards(vshards) => {
                     if vshards.iter().any(|v| v.as_u32() == self.vshard_id) {
                         local.push(plan);
@@ -154,23 +177,6 @@ impl Scheduler {
         Ok(local)
     }
 
-    /// Whether any of this transaction's LSN-versioned reads homes to THIS
-    /// scheduler's vShard — i.e. this node is a READ participant that must
-    /// validate its slice of the read-set even if it holds no local write.
-    ///
-    /// Homing uses the SAME `(DatabaseId::DEFAULT, collection)` function the
-    /// Data Plane's `read_set_still_current` filters with, so the scheduler and
-    /// the apply core agree on exactly which reads this vShard owns.
-    fn homes_any_local_read(
-        &self,
-        versioned_reads: &nodedb_types::calvin::VersionedReadSet,
-    ) -> bool {
-        versioned_reads.iter().any(|entry| {
-            VShardId::from_collection_in_database(DatabaseId::DEFAULT, &entry.collection).as_u32()
-                == self.vshard_id
-        })
-    }
-
     /// Dispatch a static-set ready transaction to the Data Plane executor.
     pub(in crate::control::cluster::calvin::scheduler::driver::core) fn dispatch_txn(
         &mut self,
@@ -196,7 +202,8 @@ impl Scheduler {
                 return;
             }
         };
-        let local = match self.local_calvin_plans(plans, epoch, position) {
+        let local = match self.local_calvin_plans(plans, txn.tx_class.database_id, epoch, position)
+        {
             Ok(p) => p,
             Err(e) => {
                 error!(
@@ -217,7 +224,13 @@ impl Scheduler {
         // still validate its slice of the read-set and cast a real commit/abort
         // vote — or a routing bug (neither writes nor reads home here). Only the
         // latter is an error; the former stages a validate-only task below.
-        if local.is_empty() && !self.homes_any_local_read(&txn.tx_class.versioned_reads) {
+        if local.is_empty()
+            && !super::routing::homes_versioned_read(
+                &txn.tx_class.versioned_reads,
+                txn.tx_class.database_id,
+                self.vshard_id,
+            )
+        {
             let e = crate::Error::Internal {
                 detail: format!(
                     "calvin txn {epoch}/{position} homes no local write plans or reads \
@@ -270,6 +283,7 @@ impl Scheduler {
         let request_id = self.next_request_id();
         let has_primary_write = plans_have_primary_write(&plans);
         let has_returning = plans_have_returning(&plans);
+        let change_sets = participant_change_sets(&plans, tenant_id, self.vshard_id);
         let plan = PhysicalPlan::Meta(MetaOp::CalvinExecuteStatic {
             epoch,
             position,
@@ -286,7 +300,8 @@ impl Scheduler {
         // Calvin allocates the CalvinApplied WAL LSN post-apply (in the
         // scheduler's response handler), so no committed LSN is known at
         // dispatch time to stamp here.
-        let request = self.build_exempt_request(request_id, tenant_id, plan, None);
+        let request =
+            self.build_exempt_request(request_id, tenant_id, txn.tx_class.database_id, plan, None);
 
         let resp_rx = self.shared.tracker.register(request_id);
 
@@ -323,6 +338,7 @@ impl Scheduler {
                 dispatch_time: dispatch_instant,
                 has_primary_write,
                 has_returning,
+                change_sets,
                 // This dispatch STAGED the txn (validate + buffer, no apply);
                 // its response carries the local commit vote that drives the
                 // subsequent flush-or-drop.
@@ -363,7 +379,8 @@ impl Scheduler {
                 return;
             }
         };
-        let plans = match self.local_calvin_plans(plans, epoch, position) {
+        let plans = match self.local_calvin_plans(plans, txn.tx_class.database_id, epoch, position)
+        {
             Ok(p) if !p.is_empty() => p,
             Ok(_) => {
                 // A dependent-read active txn dispatched here always carries a
@@ -405,6 +422,7 @@ impl Scheduler {
         };
         let has_primary_write = plans_have_primary_write(&plans);
         let has_returning = plans_have_returning(&plans);
+        let change_sets = participant_change_sets(&plans, tenant_id, self.vshard_id);
         let plan = PhysicalPlan::Meta(MetaOp::CalvinExecuteActive {
             epoch,
             position,
@@ -418,7 +436,8 @@ impl Scheduler {
         // Calvin allocates the CalvinApplied WAL LSN post-apply (in the
         // scheduler's response handler), so no committed LSN is known at
         // dispatch time to stamp here.
-        let request = self.build_exempt_request(request_id, tenant_id, plan, None);
+        let request =
+            self.build_exempt_request(request_id, tenant_id, txn.tx_class.database_id, plan, None);
 
         let resp_rx = self.shared.tracker.register(request_id);
 
@@ -455,6 +474,7 @@ impl Scheduler {
                 dispatch_time: dispatch_instant,
                 has_primary_write,
                 has_returning,
+                change_sets,
                 // The dependent-read active path now STAGES (leader-verify OLLP
                 // + buffer, no base apply); its response drives the same
                 // resolve → redo → flush as the static path, restoring
diff --git a/nodedb/src/control/cluster/calvin/scheduler/driver/core/mod.rs b/nodedb/src/control/cluster/calvin/scheduler/driver/core/mod.rs
index 9a3eac44c..34b0b82ca 100644
--- a/nodedb/src/control/cluster/calvin/scheduler/driver/core/mod.rs
+++ b/nodedb/src/control/cluster/calvin/scheduler/driver/core/mod.rs
@@ -45,6 +45,7 @@
 
 pub mod catch_up;
 pub mod commit_redo;
+pub mod commit_resolution_dispatch;
 pub mod commit_resolve;
 pub mod completion_route;
 pub mod dispatch;
diff --git a/nodedb/src/control/cluster/calvin/scheduler/driver/core/request.rs b/nodedb/src/control/cluster/calvin/scheduler/driver/core/request.rs
index 57e22d104..7648c3586 100644
--- a/nodedb/src/control/cluster/calvin/scheduler/driver/core/request.rs
+++ b/nodedb/src/control/cluster/calvin/scheduler/driver/core/request.rs
@@ -22,13 +22,14 @@ impl Scheduler {
         &self,
         request_id: RequestId,
         tenant_id: TenantId,
+        database_id: DatabaseId,
         plan: PhysicalPlan,
         wal_lsn: Option<Lsn>,
     ) -> Request {
         Request {
             request_id,
             tenant_id,
-            database_id: DatabaseId::DEFAULT,
+            database_id,
             vshard_id: VShardId::new(self.vshard_id),
             plan,
             // no-determinism: scheduler deadline controls waiting, not ordered state.
diff --git a/nodedb/src/control/cluster/calvin/scheduler/driver/core/routing.rs b/nodedb/src/control/cluster/calvin/scheduler/driver/core/routing.rs
index 9f1c23f95..07fb2ee33 100644
--- a/nodedb/src/control/cluster/calvin/scheduler/driver/core/routing.rs
+++ b/nodedb/src/control/cluster/calvin/scheduler/driver/core/routing.rs
@@ -38,22 +38,41 @@ pub(crate) enum PlanRouting {
     Unroutable(&'static str),
 }
 
+pub(crate) fn homes_versioned_read(
+    reads: &nodedb_types::calvin::VersionedReadSet,
+    database_id: DatabaseId,
+    vshard_id: u32,
+) -> bool {
+    reads.iter().any(|entry| {
+        VShardId::from_collection_in_database(database_id, &entry.collection).as_u32() == vshard_id
+    })
+}
+
+fn collection_vshard_in_database(database_id: DatabaseId, collection: &str) -> VShardId {
+    VShardId::from_collection_in_database(database_id, collection)
+}
+
+#[cfg(test)]
 fn collection_vshard(collection: &str) -> VShardId {
-    VShardId::from_collection_in_database(DatabaseId::DEFAULT, collection)
+    collection_vshard_in_database(DatabaseId::DEFAULT, collection)
 }
 
 /// Returns the routing decision for `plan`. Exhaustive over every
 /// `PhysicalPlan` variant and every op nested inside it — adding a new
 /// variant anywhere in this tree is a compile error, never a silent gap.
 pub(crate) fn plan_vshard(plan: &PhysicalPlan) -> PlanRouting {
+    plan_vshard_in_database(plan, DatabaseId::DEFAULT)
+}
+
+pub(crate) fn plan_vshard_in_database(plan: &PhysicalPlan, database_id: DatabaseId) -> PlanRouting {
     match plan {
-        PhysicalPlan::Document(op) => document_routing(op),
-        PhysicalPlan::Kv(op) => kv_routing(op),
-        PhysicalPlan::Vector(op) => vector_routing(op),
+        PhysicalPlan::Document(op) => document_routing(op, database_id),
+        PhysicalPlan::Kv(op) => kv_routing(op, database_id),
+        PhysicalPlan::Vector(op) => vector_routing(op, database_id),
         PhysicalPlan::Graph(op) => graph_routing(op),
-        PhysicalPlan::Timeseries(op) => timeseries_routing(op),
-        PhysicalPlan::Columnar(op) => columnar_routing(op),
-        PhysicalPlan::Crdt(op) => crdt_routing(op),
+        PhysicalPlan::Timeseries(op) => timeseries_routing(op, database_id),
+        PhysicalPlan::Columnar(op) => columnar_routing(op, database_id),
+        PhysicalPlan::Crdt(op) => crdt_routing(op, database_id),
         PhysicalPlan::Array(op) => array_routing(op),
         // Cluster-fanned-out array ops are handled entirely by the
         // Control-Plane `ArrayCoordinator` and never dispatched to the Data
@@ -68,7 +87,7 @@ pub(crate) fn plan_vshard(plan: &PhysicalPlan) -> PlanRouting {
     }
 }
 
-fn document_routing(op: &DocumentOp) -> PlanRouting {
+fn document_routing(op: &DocumentOp, database_id: DatabaseId) -> PlanRouting {
     match op {
         DocumentOp::PointPut { collection, .. }
         | DocumentOp::PointInsert { collection, .. }
@@ -79,11 +98,14 @@ fn document_routing(op: &DocumentOp) -> PlanRouting {
         | DocumentOp::BulkUpdate { collection, .. }
         | DocumentOp::BulkDelete { collection, .. }
         | DocumentOp::Truncate { collection, .. } => {
-            PlanRouting::Vshards(vec![collection_vshard(collection)])
+            PlanRouting::Vshards(vec![collection_vshard_in_database(database_id, collection)])
         }
         DocumentOp::InsertSelect {
             target_collection, ..
-        } => PlanRouting::Vshards(vec![collection_vshard(target_collection)]),
+        } => PlanRouting::Vshards(vec![collection_vshard_in_database(
+            database_id,
+            target_collection,
+        )]),
         // Both join the target with a DIFFERENT source collection; nothing on
         // the plan enforces the two live on the same vshard.
         DocumentOp::Merge { .. } | DocumentOp::UpdateFromJoin { .. } => PlanRouting::Unroutable(
@@ -102,7 +124,7 @@ fn document_routing(op: &DocumentOp) -> PlanRouting {
     }
 }
 
-fn kv_routing(op: &KvOp) -> PlanRouting {
+fn kv_routing(op: &KvOp, database_id: DatabaseId) -> PlanRouting {
     match op {
         KvOp::Put { collection, .. }
         | KvOp::Insert { collection, .. }
@@ -121,7 +143,7 @@ fn kv_routing(op: &KvOp) -> PlanRouting {
         // Transfer moves value between two KEYS in the SAME collection field,
         // so it stays single-home unlike `TransferItem` below.
         | KvOp::Transfer { collection, .. } => {
-            PlanRouting::Vshards(vec![collection_vshard(collection)])
+            PlanRouting::Vshards(vec![collection_vshard_in_database(database_id, collection)])
         }
         // Source and dest are DIFFERENT collections; no co-location guarantee.
         KvOp::TransferItem { .. } => PlanRouting::Unroutable(
@@ -145,7 +167,7 @@ fn kv_routing(op: &KvOp) -> PlanRouting {
     }
 }
 
-fn vector_routing(op: &VectorOp) -> PlanRouting {
+fn vector_routing(op: &VectorOp, database_id: DatabaseId) -> PlanRouting {
     match op {
         VectorOp::Insert { collection, .. }
         | VectorOp::BatchInsert { collection, .. }
@@ -156,7 +178,7 @@ fn vector_routing(op: &VectorOp) -> PlanRouting {
         | VectorOp::MultiVectorInsert { collection, .. }
         | VectorOp::MultiVectorDelete { collection, .. }
         | VectorOp::DirectUpsert { collection, .. } => {
-            PlanRouting::Vshards(vec![collection_vshard(collection)])
+            PlanRouting::Vshards(vec![collection_vshard_in_database(database_id, collection)])
         }
         VectorOp::Search { .. }
         | VectorOp::MultiSearch { .. }
@@ -227,27 +249,27 @@ fn graph_routing(op: &GraphOp) -> PlanRouting {
     }
 }
 
-fn timeseries_routing(op: &TimeseriesOp) -> PlanRouting {
+fn timeseries_routing(op: &TimeseriesOp, database_id: DatabaseId) -> PlanRouting {
     match op {
         TimeseriesOp::Ingest { collection, .. } => {
-            PlanRouting::Vshards(vec![collection_vshard(collection)])
+            PlanRouting::Vshards(vec![collection_vshard_in_database(database_id, collection)])
         }
         TimeseriesOp::Scan { .. } => PlanRouting::NotAWrite,
     }
 }
 
-fn columnar_routing(op: &ColumnarOp) -> PlanRouting {
+fn columnar_routing(op: &ColumnarOp, database_id: DatabaseId) -> PlanRouting {
     match op {
         ColumnarOp::Insert { collection, .. }
         | ColumnarOp::Update { collection, .. }
         | ColumnarOp::Delete { collection, .. } => {
-            PlanRouting::Vshards(vec![collection_vshard(collection)])
+            PlanRouting::Vshards(vec![collection_vshard_in_database(database_id, collection)])
         }
         ColumnarOp::Scan { .. } | ColumnarOp::MaterializeScan { .. } => PlanRouting::NotAWrite,
     }
 }
 
-fn crdt_routing(op: &CrdtOp) -> PlanRouting {
+fn crdt_routing(op: &CrdtOp, database_id: DatabaseId) -> PlanRouting {
     match op {
         CrdtOp::Apply { collection, .. }
         | CrdtOp::ListInsert { collection, .. }
@@ -259,7 +281,7 @@ fn crdt_routing(op: &CrdtOp) -> PlanRouting {
         | CrdtOp::DropConstraints { collection, .. }
         | CrdtOp::RestoreToVersion { collection, .. }
         | CrdtOp::ImportSnapshot { collection, .. } => {
-            PlanRouting::Vshards(vec![collection_vshard(collection)])
+            PlanRouting::Vshards(vec![collection_vshard_in_database(database_id, collection)])
         }
         CrdtOp::Read { .. }
         | CrdtOp::ReadConstraints { .. }
@@ -471,6 +493,28 @@ mod tests {
         assert_eq!(vshards_of(&plan), vec![want]);
     }
 
+    #[test]
+    fn collection_routing_preserves_database_scope() {
+        let collection = (0..2048)
+            .map(|i| format!("db_scoped_{i}"))
+            .find(|name| {
+                collection_vshard_in_database(DatabaseId::DEFAULT, name)
+                    != collection_vshard_in_database(DatabaseId::new(7), name)
+            })
+            .expect("collection whose home differs by database");
+        let plan = PhysicalPlan::Document(DocumentOp::Truncate {
+            collection: collection.clone(),
+            restart_identity: false,
+        });
+        let expected = collection_vshard_in_database(DatabaseId::new(7), &collection);
+        match plan_vshard_in_database(&plan, DatabaseId::new(7)) {
+            PlanRouting::Vshards(actual) => assert_eq!(actual, vec![expected]),
+            PlanRouting::ControlPlaneOnly | PlanRouting::NotAWrite | PlanRouting::Unroutable(_) => {
+                panic!("document truncate must be database-scoped")
+            }
+        }
+    }
+
     #[test]
     fn columnar_update_and_delete_route_to_collection_vshard() {
         let want = collection_vshard("metrics").as_u32();
diff --git a/nodedb/src/control/cluster/calvin/scheduler/driver/core/write_version_record.rs b/nodedb/src/control/cluster/calvin/scheduler/driver/core/write_version_record.rs
index 2652dd791..497cc8111 100644
--- a/nodedb/src/control/cluster/calvin/scheduler/driver/core/write_version_record.rs
+++ b/nodedb/src/control/cluster/calvin/scheduler/driver/core/write_version_record.rs
@@ -50,6 +50,7 @@ impl Scheduler {
             return;
         };
         let tenant_id = pending.txn.tx_class.tenant_id;
+        let database_id = pending.txn.tx_class.database_id;
         let plans = match super::super::helpers::decode_plans(&pending.txn.tx_class.plans) {
             Ok(p) => p,
             Err(e) => {
@@ -69,7 +70,7 @@ impl Scheduler {
         // without a per-key or collection version, so no gate on plan kind is
         // applied here — gating on a narrower write predicate would silently
         // skip recordable writes (e.g. a CRDT apply) and reopen the version gap.
-        let local = match self.local_calvin_plans(plans, epoch, position) {
+        let local = match self.local_calvin_plans(plans, database_id, epoch, position) {
             Ok(p) => p,
             Err(e) => {
                 tracing::warn!(
@@ -92,7 +93,8 @@ impl Scheduler {
         });
         // The committed write-LSN for this Calvin apply — recorded against
         // every key the plans wrote, in the same WAL-LSN space as fast-path.
-        let request = self.build_exempt_request(request_id, tenant_id, plan, Some(applied_lsn));
+        let request =
+            self.build_exempt_request(request_id, tenant_id, database_id, plan, Some(applied_lsn));
 
         // Register so the response routes to a real receiver (not the
         // unknown-request warning path), then discard it — the recording is
diff --git a/nodedb/src/control/cluster/calvin/scheduler/driver/types.rs b/nodedb/src/control/cluster/calvin/scheduler/driver/types.rs
index 8d0038787..9af0d5bef 100644
--- a/nodedb/src/control/cluster/calvin/scheduler/driver/types.rs
+++ b/nodedb/src/control/cluster/calvin/scheduler/driver/types.rs
@@ -42,6 +42,9 @@ pub(super) struct PendingTxn {
     /// multiple plain-write participants (a multi-collection cross-shard COMMIT)
     /// coalesce without conflict.
     pub has_returning: bool,
+    /// Participant-local Control-Plane change manifests. Consumed once after
+    /// durable COMMIT apply; graph dual-home replicas are excluded at capture.
+    pub change_sets: Vec<crate::control::server::dispatch_utils::WriteChangeSet>,
     /// Commit-resolution state for a static-set Calvin txn.
     ///
     /// `Some(CommitState::Staged)` for a static txn dispatched via the
diff --git a/nodedb/src/control/cluster/metadata_applier/catalog_ddl.rs b/nodedb/src/control/cluster/metadata_applier/catalog_ddl.rs
index 6297d5882..22d148ecd 100644
--- a/nodedb/src/control/cluster/metadata_applier/catalog_ddl.rs
+++ b/nodedb/src/control/cluster/metadata_applier/catalog_ddl.rs
@@ -59,12 +59,21 @@ impl MetadataCommitApplier {
         // value — idempotent by construction, with no per-node drift.
         //
         // Before persisting, validate the carried version against this
-        // node's local prior so a genuine regression or gap surfaces as a
-        // loud typed error (halting the apply watermark for this entry and
-        // forcing Raft re-delivery) rather than silently writing a
-        // divergent value. A version of `0` (compat mode / unit tests) is
-        // skipped by the validator.
-        catalog_entry::descriptor_stamp::validate(&stamped, catalog)?;
+        // node's local prior. Historical entries encountered during a full-log
+        // replay are acknowledged without overwriting newer state or repeating
+        // post-apply side effects. Forward gaps and same-version divergent
+        // payloads remain loud typed errors. A version of `0` (compat mode /
+        // unit tests) is applied without version fencing.
+        if matches!(
+            catalog_entry::descriptor_stamp::validate(&stamped, catalog)?,
+            catalog_entry::descriptor_stamp::ValidationOutcome::AlreadyApplied
+        ) {
+            debug!(
+                kind = stamped.kind(),
+                "catalog_entry: descriptor entry already superseded or applied"
+            );
+            return Ok(());
+        }
 
         debug!(kind = stamped.kind(), "catalog_entry: applying to redb");
         if !catalog_entry::apply::apply_to(&stamped, catalog) {
diff --git a/nodedb/src/control/cluster/metadata_applier/dispatch.rs b/nodedb/src/control/cluster/metadata_applier/dispatch.rs
index c0faddfc9..71dc946d7 100644
--- a/nodedb/src/control/cluster/metadata_applier/dispatch.rs
+++ b/nodedb/src/control/cluster/metadata_applier/dispatch.rs
@@ -33,6 +33,29 @@ impl MetadataCommitApplier {
         entry: &MetadataEntry,
         raft_index: u64,
     ) -> Result<(), crate::Error> {
+        // A prepared DDL is conditionally applied under the replicated owner
+        // token. A superseded proposal is a deterministic no-op: rejecting a
+        // committed stale token would wedge the Raft apply watermark forever.
+        if let MetadataEntry::DdlPrepared { token, entry } = entry {
+            let Some(shared) = self.shared.get().and_then(std::sync::Weak::upgrade) else {
+                return Ok(());
+            };
+            let owns_lease = shared
+                .metadata_ddl_owner
+                .lock()
+                .unwrap_or_else(|poisoned| poisoned.into_inner())
+                .is_some_and(|(current, _)| current == *token);
+            if !owns_lease {
+                debug!(token, raft_index, "skipping superseded prepared DDL");
+                return Ok(());
+            }
+            self.apply_host_side_effects(entry.as_ref(), raft_index)?;
+            shared
+                .metadata_ddl_applied_token
+                .store(*token, std::sync::atomic::Ordering::Release);
+            return Ok(());
+        }
+
         // Atomic batches unpack one level: the sub-entries are
         // applied individually so each gets its own audit record
         // stamped with the same raft_index (they committed at the
@@ -57,6 +80,30 @@ impl MetadataCommitApplier {
             MetadataEntry::DescriptorDrainEnd { descriptor_id } => {
                 return self.apply_drain_end(descriptor_id);
             }
+            MetadataEntry::DdlPrepareAcquire { token } => {
+                if let Some(shared) = self.shared.get().and_then(std::sync::Weak::upgrade) {
+                    let mut owner = shared
+                        .metadata_ddl_owner
+                        .lock()
+                        .unwrap_or_else(|poisoned| poisoned.into_inner());
+                    if owner.is_none() || owner.is_some_and(|(current, _)| current == *token) {
+                        *owner = Some((*token, std::time::Instant::now()));
+                    }
+                }
+                return Ok(());
+            }
+            MetadataEntry::DdlPrepareRelease { token } => {
+                if let Some(shared) = self.shared.get().and_then(std::sync::Weak::upgrade) {
+                    let mut owner = shared
+                        .metadata_ddl_owner
+                        .lock()
+                        .unwrap_or_else(|poisoned| poisoned.into_inner());
+                    if owner.is_some_and(|(current, _)| current == *token) {
+                        *owner = None;
+                    }
+                }
+                return Ok(());
+            }
             MetadataEntry::CaTrustChange {
                 add_ca_cert,
                 remove_ca_fingerprint,
diff --git a/nodedb/src/control/gateway/version_set.rs b/nodedb/src/control/gateway/version_set.rs
index 8d5b75517..7283fc06f 100644
--- a/nodedb/src/control/gateway/version_set.rs
+++ b/nodedb/src/control/gateway/version_set.rs
@@ -408,8 +408,16 @@ pub fn touched_collections(plan: &PhysicalPlan) -> Vec<String> {
         }
 
         // ── Meta ─────────────────────────────────────────────────────────
+        PhysicalPlan::Meta(nodedb_physical::physical_plan::MetaOp::TransactionBatch {
+            plans,
+            ..
+        }) => {
+            for plan in plans {
+                out.extend(touched_collections(plan));
+            }
+        }
         PhysicalPlan::Meta(_) => {
-            // Meta ops target infrastructure, not user collections.
+            // Other Meta ops target infrastructure, not user collections.
         }
 
         // ── Array ────────────────────────────────────────────────────────
diff --git a/nodedb/src/control/metadata_proposer.rs b/nodedb/src/control/metadata_proposer.rs
index 87473c00e..2fbee2809 100644
--- a/nodedb/src/control/metadata_proposer.rs
+++ b/nodedb/src/control/metadata_proposer.rs
@@ -22,8 +22,9 @@
 //!    `Error::Config { detail: "metadata propose: not leader ..." }`.
 //!    Gateway-side redirection will make this transparent.
 
+use std::sync::atomic::Ordering;
 use std::sync::{Arc, Weak};
-use std::time::Duration;
+use std::time::{Duration, Instant, SystemTime, UNIX_EPOCH};
 
 use nodedb_cluster::{METADATA_GROUP_ID, MetadataEntry, WaitOutcome, encode_entry};
 
@@ -49,6 +50,8 @@ pub const DEFAULT_PROPOSE_TIMEOUT: Duration = Duration::from_secs(5);
 /// `propose_catalog_entry_with_drain_timeout` can pass a longer
 /// value if an operator is willing to wait.
 pub const DEFAULT_DRAIN_TIMEOUT: Duration = Duration::from_secs(35);
+const DDL_PREPARE_LEASE: Duration = Duration::from_secs(60);
+const DDL_PREPARE_WAIT: Duration = Duration::from_secs(70);
 
 /// Type-erased handle for proposing to the metadata raft group.
 ///
@@ -120,6 +123,130 @@ impl MetadataRaftHandle for RaftLoopProposerHandle {
     }
 }
 
+fn wall_now_ns() -> u64 {
+    SystemTime::now()
+        .duration_since(UNIX_EPOCH)
+        .unwrap_or_default()
+        .as_nanos()
+        .min(u64::MAX as u128) as u64
+}
+
+fn propose_metadata_and_wait(
+    shared: &SharedState,
+    handle: &dyn MetadataRaftHandle,
+    entry: &MetadataEntry,
+    timeout: Duration,
+) -> Result<u64, Error> {
+    let raw = encode_entry(entry).map_err(|e| Error::Config {
+        detail: format!("metadata entry encode: {e}"),
+    })?;
+    let index = handle.propose(raw)?;
+    let watcher = shared.applied_index_watcher(METADATA_GROUP_ID);
+    let outcome = tokio::task::block_in_place(|| watcher.wait_for(index, timeout));
+    match outcome {
+        WaitOutcome::Reached => Ok(index),
+        WaitOutcome::TimedOut => Err(Error::Config {
+            detail: format!(
+                "metadata propose timed out after {timeout:?} waiting for log index {index} (current: {})",
+                watcher.current()
+            ),
+        }),
+        WaitOutcome::GroupGone => Err(Error::Config {
+            detail: "metadata group no longer hosted on this node".into(),
+        }),
+    }
+}
+
+/// RAII ownership of the metadata-Raft-serialized descriptor preparation lease.
+/// The matching release is itself replicated, so another node cannot stamp from
+/// the same prior catalog version until this guard is dropped and that release
+/// has applied.
+pub(crate) struct DdlPrepareGuard<'a> {
+    shared: &'a SharedState,
+    handle: &'a dyn MetadataRaftHandle,
+    token: u64,
+}
+
+impl DdlPrepareGuard<'_> {
+    pub(crate) fn token(&self) -> u64 {
+        self.token
+    }
+}
+
+impl Drop for DdlPrepareGuard<'_> {
+    fn drop(&mut self) {
+        if let Err(error) = propose_metadata_and_wait(
+            self.shared,
+            self.handle,
+            &MetadataEntry::DdlPrepareRelease { token: self.token },
+            DEFAULT_PROPOSE_TIMEOUT,
+        ) {
+            tracing::error!(token = self.token, %error, "metadata DDL lease release failed");
+        }
+    }
+}
+
+pub(crate) fn acquire_ddl_prepare_lease<'a>(
+    shared: &'a SharedState,
+    handle: &'a dyn MetadataRaftHandle,
+) -> Result<DdlPrepareGuard<'a>, Error> {
+    let sequence = shared
+        .metadata_ddl_token_seq
+        .fetch_add(1, Ordering::Relaxed);
+    let token = shared.node_id.wrapping_mul(0x9e37_79b9_7f4a_7c15)
+        ^ wall_now_ns().rotate_left(17)
+        ^ sequence;
+    let deadline = Instant::now() + DDL_PREPARE_WAIT;
+
+    loop {
+        propose_metadata_and_wait(
+            shared,
+            handle,
+            &MetadataEntry::DdlPrepareAcquire { token },
+            DEFAULT_PROPOSE_TIMEOUT,
+        )?;
+
+        loop {
+            let owner = *shared
+                .metadata_ddl_owner
+                .lock()
+                .map_err(|_| Error::Config {
+                    detail: "metadata DDL owner lock poisoned".into(),
+                })?;
+            match owner {
+                Some((current, _)) if current == token => {
+                    return Ok(DdlPrepareGuard {
+                        shared,
+                        handle,
+                        token,
+                    });
+                }
+                Some((current, acquired_at))
+                    if shared.is_metadata_leader()
+                        && acquired_at.elapsed() >= DDL_PREPARE_LEASE =>
+                {
+                    propose_metadata_and_wait(
+                        shared,
+                        handle,
+                        &MetadataEntry::DdlPrepareRelease { token: current },
+                        DEFAULT_PROPOSE_TIMEOUT,
+                    )?;
+                    break;
+                }
+                None => break,
+                Some(_) if Instant::now() < deadline => {
+                    std::thread::sleep(Duration::from_millis(10));
+                }
+                Some(_) => {
+                    return Err(Error::Config {
+                        detail: "metadata DDL preparation lease timed out".into(),
+                    });
+                }
+            }
+        }
+    }
+}
+
 /// Propose a `CatalogEntry` and block until the local applied-index
 /// watcher confirms the entry has been applied on this node.
 ///
@@ -158,6 +285,20 @@ pub fn propose_catalog_entry_with_timeout(
         }
     }
 
+    // Transactional DDL must remain unstamped until COMMIT: the batch
+    // preparation path stamps entries sequentially so repeated mutations of
+    // one descriptor receive distinct versions.
+    if crate::control::server::shared::session::ddl_buffer::try_buffer(entry.clone()) {
+        return Ok(0);
+    }
+
+    // Serialize preparation through local apply confirmation. Without this,
+    // concurrent proposers can both observe persisted version N and emit N+1.
+    let _local_ddl_guard = shared.metadata_ddl_lock.lock().map_err(|_| Error::Config {
+        detail: "metadata DDL preparation lock poisoned".into(),
+    })?;
+    let distributed_ddl_guard = acquire_ddl_prepare_lease(shared, handle.as_ref())?;
+
     // Drain for Put* variants that carry descriptor_version.
     // Leases acquired at plan time are refcounted and held
     // through execute; when the last in-flight query using a
@@ -210,19 +351,11 @@ pub fn propose_catalog_entry_with_timeout(
 
     let payload = catalog_entry::encode(entry)?;
 
-    // DDL transaction buffer: if a transactional DDL session is
-    // active on this thread (BEGIN ... COMMIT), buffer the payload
-    // instead of proposing immediately. The buffered entries will
-    // be proposed as a single MetadataEntry::Batch at COMMIT time.
-    if crate::control::server::shared::session::ddl_buffer::try_buffer(payload.clone()) {
-        return Ok(0);
-    }
-
     // Attach J.4 audit context when the pgwire statement boundary
     // installed one. Internal callers (descriptor lease grant/release,
     // drain proposer) run outside that scope and emit the plain
     // `CatalogDdl` variant — they have no SQL text to log.
-    let metadata_entry = match crate::control::server::shared::session::audit_context::current() {
+    let catalog_entry = match crate::control::server::shared::session::audit_context::current() {
         Some(ctx) => MetadataEntry::CatalogDdlAudited {
             payload,
             auth_user_id: ctx.auth_user_id,
@@ -231,6 +364,10 @@ pub fn propose_catalog_entry_with_timeout(
         },
         None => MetadataEntry::CatalogDdl { payload },
     };
+    let metadata_entry = MetadataEntry::DdlPrepared {
+        token: distributed_ddl_guard.token(),
+        entry: Box::new(catalog_entry),
+    };
     let raw = encode_entry(&metadata_entry).map_err(|e| Error::Config {
         detail: format!("metadata entry encode: {e}"),
     })?;
@@ -246,7 +383,15 @@ pub fn propose_catalog_entry_with_timeout(
     // in `block_in_place` so tokio reassigns a fresh worker.
     let outcome = tokio::task::block_in_place(|| watcher.wait_for(log_index, timeout));
     match outcome {
-        WaitOutcome::Reached => Ok(log_index),
+        WaitOutcome::Reached
+            if shared.metadata_ddl_applied_token.load(Ordering::Acquire)
+                == distributed_ddl_guard.token() =>
+        {
+            Ok(log_index)
+        }
+        WaitOutcome::Reached => Err(Error::Config {
+            detail: "metadata DDL preparation ownership was superseded before apply".into(),
+        }),
         WaitOutcome::TimedOut => Err(Error::Config {
             detail: format!(
                 "metadata propose timed out after {:?} waiting for log index {} (current: {})",
diff --git a/nodedb/src/control/planner/calvin/dispatch.rs b/nodedb/src/control/planner/calvin/dispatch.rs
index 032eaebef..4c8c93be4 100644
--- a/nodedb/src/control/planner/calvin/dispatch.rs
+++ b/nodedb/src/control/planner/calvin/dispatch.rs
@@ -36,7 +36,7 @@ use crate::control::planner::calvin::tx_class::build_static_tx_class;
 use crate::control::planner::calvin::types::{DispatchClass, DispatchOutcome};
 use crate::control::server::shared::session::TransactionState;
 use crate::control::server::shared::session::read_set::ReadSetEntry;
-use crate::types::{DatabaseId, VShardId};
+use crate::types::VShardId;
 use nodedb_physical::physical_plan::{DocumentOp, PhysicalPlan};
 use nodedb_physical::physical_task::PhysicalTask;
 
@@ -67,15 +67,14 @@ pub fn is_dependent_predicate(plan: &PhysicalPlan) -> bool {
 ///
 /// Each [`ReadSetEntry`] homes to its collection's vShard using the SAME
 /// collection→vShard map `ReadWriteSet::participating_vshards` uses to derive the
-/// `TxClass` read_set's participants (`DatabaseId::DEFAULT`-scoped, matching the
-/// write path's collection homing) — so the classifier's read∪write decision and
-/// the actual Calvin participant set agree. A read with no extractable collection
-/// contributes nothing.
+/// `TxClass` read_set's participants. Each read retains its session database so
+/// classification and the database-scoped transaction class agree. A read with
+/// no extractable collection contributes nothing.
 pub fn read_vshards_of(reads: &[ReadSetEntry]) -> BTreeSet<u32> {
     reads
         .iter()
         .filter(|e| !e.collection.is_empty())
-        .map(|e| VShardId::from_collection_in_database(DatabaseId::DEFAULT, &e.collection).as_u32())
+        .map(|e| VShardId::from_collection_in_database(e.database_id, &e.collection).as_u32())
         .collect()
 }
 
diff --git a/nodedb/src/control/planner/calvin/submit.rs b/nodedb/src/control/planner/calvin/submit.rs
index 779298a37..7e88aed04 100644
--- a/nodedb/src/control/planner/calvin/submit.rs
+++ b/nodedb/src/control/planner/calvin/submit.rs
@@ -178,6 +178,13 @@ pub async fn submit_and_await_calvin_with_timeout(
     }
 }
 
+/// Backoff schedule (milliseconds) for waiting on the sequencer-group leader
+/// election before a cross-shard submit. Covers the brief post-startup window
+/// (a fresh single-node cluster elects in a couple of seconds) and short
+/// re-election gaps. Bounded: once the schedule is exhausted a genuinely
+/// leaderless cluster surfaces a typed error rather than hanging.
+const SEQUENCER_LEADER_WAIT_BACKOFF_MS: &[u64] = &[50, 100, 200, 400, 800, 1000, 1000, 1000];
+
 /// Submit a cross-shard Calvin `tx_class`, routing it to the sequencer-group
 /// leader so it is actually sequenced and acked.
 ///
@@ -189,8 +196,10 @@ pub async fn submit_and_await_calvin_with_timeout(
 ///   topology, then send one `SubmitCalvinTxnRequest` (carrying the
 ///   msgpack-encoded `TxClass`); the leader runs the submit-and-await and
 ///   replies. Map transport / leader errors to a typed `crate::Error`.
-/// - **No leader elected (0 / none)**: return a typed error — never submit
-///   locally, since a non-leader submit is silently discarded.
+/// - **No leader elected (0 / none)**: wait through
+///   [`SEQUENCER_LEADER_WAIT_BACKOFF_MS`] for an election, then return a typed
+///   error — never submit on a non-leader, since that submit is silently
+///   discarded.
 pub async fn submit_calvin_routed(
     state: &SharedState,
     tx_class: TxClass,
@@ -211,17 +220,30 @@ pub async fn submit_calvin_routed(
     let status_fn = state.raft_status_fn.get().ok_or_else(|| Error::Internal {
         detail: "calvin-submit: raft status fn not installed (cluster not started)".to_owned(),
     })?;
-    let leader = status_fn()
-        .into_iter()
-        .find(|g| g.group_id == SEQUENCER_GROUP_ID)
-        .map(|g| g.leader_id)
-        .unwrap_or(0);
 
-    // `0` = no sequencer leader elected yet. We must NOT submit locally: a
-    // non-leader submit is drained and discarded by the local sequencer service,
-    // so the caller would time out at the assignment phase. Surface a typed error
-    // (same divergence-safety contract as the routed-surrogate leader==0 path) so
-    // the caller retries once an election resolves.
+    // `leader_id == 0` means no sequencer leader is elected YET — the brief
+    // window right after startup (the client gateway can open before the
+    // sequencer group finishes its first election) or during a re-election.
+    // Submitting on a non-leader is drained and discarded, so we must not; but
+    // `leader == 0` also guarantees NOTHING has been submitted, so waiting for
+    // the election to resolve and re-reading is safe and idempotent. Poll with
+    // bounded backoff (mirroring the gateway's NotLeader retry) rather than
+    // failing the client's very first write on a freshly-ready node; only a
+    // genuinely leaderless cluster exhausts the schedule and surfaces the error.
+    let mut leader = 0;
+    for (attempt, &backoff_ms) in SEQUENCER_LEADER_WAIT_BACKOFF_MS.iter().enumerate() {
+        leader = status_fn()
+            .into_iter()
+            .find(|g| g.group_id == SEQUENCER_GROUP_ID)
+            .map(|g| g.leader_id)
+            .unwrap_or(0);
+        if leader != 0 {
+            break;
+        }
+        if attempt + 1 < SEQUENCER_LEADER_WAIT_BACKOFF_MS.len() {
+            tokio::time::sleep(std::time::Duration::from_millis(backoff_ms)).await;
+        }
+    }
     if leader == 0 {
         return Err(Error::Internal {
             detail: "calvin-submit: no sequencer leader elected yet; cannot submit cross-shard \
diff --git a/nodedb/src/control/planner/calvin/tx_class/dependent_builder.rs b/nodedb/src/control/planner/calvin/tx_class/dependent_builder.rs
index a6dcd69c5..846a311e2 100644
--- a/nodedb/src/control/planner/calvin/tx_class/dependent_builder.rs
+++ b/nodedb/src/control/planner/calvin/tx_class/dependent_builder.rs
@@ -19,7 +19,7 @@ use crate::types::VShardId;
 use nodedb_cluster::calvin::types::{EngineKeySet, ReadWriteSet, SortedVec, TxClass};
 use nodedb_physical::physical_plan::{GraphOp, PhysicalPlan};
 use nodedb_physical::physical_task::PhysicalTask;
-use nodedb_types::TenantId;
+use nodedb_types::{DatabaseId, TenantId};
 
 use super::shared::{
     collection_name_from_plan, read_set_from, surrogate_from_plan, versioned_reads_from,
@@ -106,6 +106,17 @@ fn build_dependent_tx_class_impl(
 ) -> crate::Result<TxClass> {
     use std::collections::BTreeMap;
 
+    let database_id = tasks
+        .first()
+        .map_or(DatabaseId::DEFAULT, |task| task.database_id);
+    if tasks.iter().any(|task| task.database_id != database_id)
+        || reads.iter().any(|read| read.database_id != database_id)
+    {
+        return Err(Error::BadRequest {
+            detail: "Calvin transaction spans multiple databases".to_owned(),
+        });
+    }
+
     // Accumulate per-collection surrogate sets. The OLLP collection uses the
     // predicted surrogates; all other tasks use static key extraction.
     let mut doc_surrogates: BTreeMap<String, Vec<u32>> = BTreeMap::new();
@@ -208,20 +219,22 @@ fn build_dependent_tx_class_impl(
     let versioned_reads = versioned_reads_from(reads);
 
     let result = if allow_single_vshard {
-        TxClass::new_single_vshard(
+        TxClass::new_single_vshard_in_database(
             read_set,
             write_set,
             plans_bytes,
             tenant_id,
+            database_id,
             None,
             versioned_reads,
         )
     } else {
-        TxClass::new(
+        TxClass::new_in_database(
             read_set,
             write_set,
             plans_bytes,
             tenant_id,
+            database_id,
             None,
             versioned_reads,
         )
diff --git a/nodedb/src/control/planner/calvin/tx_class/static_builder.rs b/nodedb/src/control/planner/calvin/tx_class/static_builder.rs
index 900b64580..be86a61c1 100644
--- a/nodedb/src/control/planner/calvin/tx_class/static_builder.rs
+++ b/nodedb/src/control/planner/calvin/tx_class/static_builder.rs
@@ -10,7 +10,7 @@ use crate::types::VShardId;
 use nodedb_cluster::calvin::types::{EngineKeySet, ReadWriteSet, SortedVec, TxClass};
 use nodedb_physical::physical_plan::{GraphOp, PhysicalPlan};
 use nodedb_physical::physical_task::PhysicalTask;
-use nodedb_types::TenantId;
+use nodedb_types::{DatabaseId, TenantId};
 
 use super::shared::{
     collection_name_from_plan, kv_write_keys, read_set_from, surrogate_from_plan,
@@ -72,6 +72,17 @@ fn build_static_tx_class_impl(
 ) -> crate::Result<TxClass> {
     use std::collections::HashMap;
 
+    let database_id = tasks
+        .first()
+        .map_or(DatabaseId::DEFAULT, |task| task.database_id);
+    if tasks.iter().any(|task| task.database_id != database_id)
+        || reads.iter().any(|read| read.database_id != database_id)
+    {
+        return Err(Error::BadRequest {
+            detail: "Calvin transaction spans multiple databases".to_owned(),
+        });
+    }
+
     // Collect surrogates per collection for non-edge write tasks.
     let mut doc_surrogates: HashMap<String, Vec<u32>> = HashMap::new();
     // Collect edge identity (surrogate pairs) and routing homes
@@ -228,20 +239,22 @@ fn build_static_tx_class_impl(
     let versioned_reads = versioned_reads_from(&owned_reads);
 
     let result = if allow_single_vshard {
-        TxClass::new_single_vshard(
+        TxClass::new_single_vshard_in_database(
             read_set,
             write_set,
             plans_bytes,
             tenant_id,
+            database_id,
             None,
             versioned_reads,
         )
     } else {
-        TxClass::new(
+        TxClass::new_in_database(
             read_set,
             write_set,
             plans_bytes,
             tenant_id,
+            database_id,
             None,
             versioned_reads,
         )
@@ -306,6 +319,26 @@ mod tests {
         }
     }
 
+    #[test]
+    fn single_vshard_builder_preserves_database_scope() {
+        let mut task = point_insert_task("db_scoped", 1);
+        task.database_id = DatabaseId::new(7);
+        let tx = build_single_vshard_tx_class(&[task], TenantId::new(1), &[])
+            .expect("valid single-vshard TxClass");
+        assert_eq!(tx.database_id, DatabaseId::new(7));
+    }
+
+    #[test]
+    fn builder_rejects_cross_database_batches() {
+        let (col_a, col_b) = two_distinct_collections();
+        let first = point_insert_task(&col_a, 1);
+        let mut second = point_insert_task(&col_b, 2);
+        second.database_id = DatabaseId::new(7);
+        let error = build_static_tx_class(&[first, second], TenantId::new(1), &[])
+            .expect_err("cross-database Calvin batch must fail");
+        assert!(error.to_string().contains("multiple databases"));
+    }
+
     #[test]
     fn build_static_populates_read_set_and_unions_read_participants() {
         let (col_a, col_b) = two_distinct_collections();
diff --git a/nodedb/src/control/planner/catalog_adapter/sql_catalog_impl.rs b/nodedb/src/control/planner/catalog_adapter/sql_catalog_impl.rs
index cf3aa939a..5d6d2dbd3 100644
--- a/nodedb/src/control/planner/catalog_adapter/sql_catalog_impl.rs
+++ b/nodedb/src/control/planner/catalog_adapter/sql_catalog_impl.rs
@@ -164,19 +164,45 @@ impl SqlCatalog for OriginCatalog {
         _tenant_id: u64,
         name: &str,
     ) -> Option<i64> {
+        let name = nodedb_sql::catalog::normalize_regclass_name(name)?;
+
         // Check system/catalog relation OIDs first.
         if let Some(&oid) = crate::control::server::pgwire::catalog::oid::SYSTEM_REL_OIDS
             .iter()
-            .find(|(n, _)| *n == name)
-            .map(|(_, o)| o)
+            .find(|(relation, _)| *relation == name)
+            .map(|(_, oid)| oid)
         {
             return Some(oid);
         }
-        // Fall back to the stable hash-derived OID for user collections.
+
+        // A hash-derived OID is stable only after catalog existence has been
+        // established. Fabricating one for an unknown name makes regclass
+        // predicates silently compare against a relation that does not exist.
+        let stored = self
+            .credentials
+            .catalog()
+            .get_collection(self.database_id, self.tenant_id, &name)
+            .ok()
+            .flatten()
+            .filter(|stored| stored.is_active)?;
+
+        // A folded regclass literal is a schema dependency just like a scan of
+        // the relation. Record it so dropping or altering the target invalidates
+        // a cached physical plan that embeds its OID.
+        let descriptor_id = DescriptorId::new(
+            self.tenant_id,
+            DescriptorKind::Collection,
+            stored.name.clone(),
+        );
+        self.recorded_versions
+            .lock()
+            .unwrap_or_else(|p| p.into_inner())
+            .record(descriptor_id, stored.descriptor_version.max(1));
+
         Some(
             crate::control::server::pgwire::catalog::oid::stable_collection_oid(
                 self.tenant_id,
-                name,
+                &name,
             ),
         )
     }
diff --git a/nodedb/src/control/planner/context/query/planning.rs b/nodedb/src/control/planner/context/query/planning.rs
index 74c887e16..2e0d49ba4 100644
--- a/nodedb/src/control/planner/context/query/planning.rs
+++ b/nodedb/src/control/planner/context/query/planning.rs
@@ -86,6 +86,10 @@ impl QueryContext {
                 collection: name,
                 retention_expires_at_ns,
             },
+            nodedb_sql::SqlError::UnknownTable { name } => crate::Error::CollectionNotFound {
+                tenant_id,
+                collection: name,
+            },
             other => crate::Error::PlanError {
                 detail: format!("{other}"),
             },
@@ -103,7 +107,16 @@ impl QueryContext {
                     tenant_id.as_u64(),
                 )
             })
-            .collect();
+            .collect::<nodedb_sql::Result<_>>()
+            .map_err(|error| match error {
+                nodedb_sql::SqlError::UnknownTable { name } => crate::Error::CollectionNotFound {
+                    tenant_id,
+                    collection: name,
+                },
+                other => crate::Error::PlanError {
+                    detail: other.to_string(),
+                },
+            })?;
         let version_set = catalog.take_recorded_versions();
         let ctx = crate::control::planner::sql_plan_convert::ConvertContext {
             retention_registry: self.retention_registry.clone(),
@@ -262,11 +275,17 @@ impl QueryContext {
         // adapter fresh keeps the adapter's state per-plan and
         // allows future extension.
         let catalog = inputs.build_adapter(tenant_id.as_u64(), database_id);
-        let raw_plans = nodedb_sql::plan_sql_with_params(sql, params, &catalog).map_err(|e| {
-            crate::Error::PlanError {
-                detail: format!("{e}"),
-            }
-        })?;
+        let raw_plans = nodedb_sql::plan_sql_with_params(sql, params, &catalog).map_err(
+            |error| match error {
+                nodedb_sql::SqlError::UnknownTable { name } => crate::Error::CollectionNotFound {
+                    tenant_id,
+                    collection: name,
+                },
+                other => crate::Error::PlanError {
+                    detail: other.to_string(),
+                },
+            },
+        )?;
         let plans: Vec<_> = raw_plans
             .into_iter()
             .map(|p| {
@@ -277,7 +296,16 @@ impl QueryContext {
                     tenant_id.as_u64(),
                 )
             })
-            .collect();
+            .collect::<nodedb_sql::Result<_>>()
+            .map_err(|error| match error {
+                nodedb_sql::SqlError::UnknownTable { name } => crate::Error::CollectionNotFound {
+                    tenant_id,
+                    collection: name,
+                },
+                other => crate::Error::PlanError {
+                    detail: other.to_string(),
+                },
+            })?;
         let ctx = crate::control::planner::sql_plan_convert::ConvertContext {
             retention_registry: self.retention_registry.clone(),
             array_catalog: self.array_catalog.clone(),
diff --git a/nodedb/src/control/security/catalog/collections.rs b/nodedb/src/control/security/catalog/collections.rs
index 92d025a2b..6a1686fdf 100644
--- a/nodedb/src/control/security/catalog/collections.rs
+++ b/nodedb/src/control/security/catalog/collections.rs
@@ -46,6 +46,44 @@ impl SystemCatalog {
         write_txn.commit().map_err(|e| catalog_err("commit", e))
     }
 
+    /// Insert a collection only when its catalog key is absent.
+    ///
+    /// The existence check and insert share one redb write transaction, so
+    /// concurrent direct-mode schema announcements cannot overwrite the first
+    /// winner after both observed absence.
+    pub fn put_collection_if_absent(
+        &self,
+        database_id: DatabaseId,
+        coll: &StoredCollection,
+    ) -> crate::Result<bool> {
+        let inner_key = format!("{}:{}", coll.tenant_id, coll.name);
+        let bytes =
+            zerompk::to_msgpack_vec(coll).map_err(|e| catalog_err("serialize collection", e))?;
+        let write_txn = self
+            .db
+            .begin_write()
+            .map_err(|e| catalog_err("write txn", e))?;
+        let inserted = {
+            let mut table = write_txn
+                .open_table(COLLECTIONS)
+                .map_err(|e| catalog_err("open collections", e))?;
+            if table
+                .get((database_id.as_u64(), inner_key.as_str()))
+                .map_err(|e| catalog_err("get collection", e))?
+                .is_some()
+            {
+                false
+            } else {
+                table
+                    .insert((database_id.as_u64(), inner_key.as_str()), bytes.as_slice())
+                    .map_err(|e| catalog_err("insert collection", e))?;
+                true
+            }
+        };
+        write_txn.commit().map_err(|e| catalog_err("commit", e))?;
+        Ok(inserted)
+    }
+
     /// Load all collections for a tenant within a database.
     pub fn load_collections_for_tenant(
         &self,
diff --git a/nodedb/src/control/server/dispatch_utils/change_events/extract.rs b/nodedb/src/control/server/dispatch_utils/change_events/extract.rs
index 60efa4e70..335248399 100644
--- a/nodedb/src/control/server/dispatch_utils/change_events/extract.rs
+++ b/nodedb/src/control/server/dispatch_utils/change_events/extract.rs
@@ -7,7 +7,7 @@ use crate::bridge::envelope::PhysicalPlan;
 use crate::control::change_stream::ChangeOperation;
 use crate::types::TenantId;
 use nodedb_physical::physical_plan::{
-    ArrayOp, ClusterArrayOp, ColumnarOp, CrdtOp, DocumentOp, KvOp, TimeseriesOp, VectorOp,
+    ArrayOp, ClusterArrayOp, ColumnarOp, CrdtOp, DocumentOp, KvOp, MetaOp, TimeseriesOp, VectorOp,
 };
 
 /// Extract write metadata from a physical plan for change event publishing.
@@ -396,8 +396,13 @@ pub(super) fn extract_write_metadata(
         // read-only.
         PhysicalPlan::Query(_) => Vec::new(),
 
-        // Meta: WAL/cancel/snapshot/compact/checkpoint are maintenance ops,
-        // not user-data writes.
+        // A committed transaction batch publishes the same logical row events
+        // its constituent writes would have emitted under autocommit. Overlay
+        // and maintenance Meta operations remain event-free.
+        PhysicalPlan::Meta(MetaOp::TransactionBatch { plans, .. }) => plans
+            .iter()
+            .flat_map(|plan| extract_write_metadata(plan, _tenant_id))
+            .collect(),
         PhysicalPlan::Meta(_) => Vec::new(),
 
         // Cluster-mode array ops: like their single-node `ArrayOp` counterparts
@@ -445,6 +450,37 @@ mod tests {
     // avoid double-publishing implicit-edge writes alongside their
     // underlying `DocumentOp` event.
 
+    #[test]
+    fn transaction_batch_emits_each_subplan_change_event() {
+        let plan = PhysicalPlan::Meta(MetaOp::TransactionBatch {
+            plans: vec![
+                PhysicalPlan::Document(DocumentOp::PointPut {
+                    collection: "users".into(),
+                    document_id: "u1".into(),
+                    value: Vec::new(),
+                    surrogate: Surrogate::new(1),
+                    pk_bytes: Vec::new(),
+                }),
+                PhysicalPlan::Document(DocumentOp::PointDelete {
+                    collection: "users".into(),
+                    document_id: "u2".into(),
+                    surrogate: Surrogate::new(2),
+                    pk_bytes: Vec::new(),
+                    returning: None,
+                }),
+            ],
+            txn_id: None,
+        });
+        let meta = extract_write_metadata(&plan, TenantId::new(1));
+        assert_eq!(
+            meta,
+            vec![
+                ("users".into(), "u1".into(), ChangeOperation::Insert),
+                ("users".into(), "u2".into(), ChangeOperation::Delete),
+            ]
+        );
+    }
+
     #[test]
     fn columnar_insert_emits_change_event() {
         let plan = PhysicalPlan::Columnar(ColumnarOp::Insert {
diff --git a/nodedb/src/control/server/dispatch_utils/change_events/mod.rs b/nodedb/src/control/server/dispatch_utils/change_events/mod.rs
index ece096843..62546be8d 100644
--- a/nodedb/src/control/server/dispatch_utils/change_events/mod.rs
+++ b/nodedb/src/control/server/dispatch_utils/change_events/mod.rs
@@ -7,6 +7,6 @@ mod extract;
 mod publish;
 
 pub(crate) use publish::{
-    extract_write_change_set, publish_change_set, publish_cluster_array_change_events,
-    publish_origin_change_events,
+    WriteChangeSet, extract_write_change_set, publish_change_set, publish_change_set_with_lsn,
+    publish_cluster_array_change_events, publish_origin_change_events,
 };
diff --git a/nodedb/src/control/server/dispatch_utils/change_events/publish.rs b/nodedb/src/control/server/dispatch_utils/change_events/publish.rs
index 62c4f9a8b..e2d232377 100644
--- a/nodedb/src/control/server/dispatch_utils/change_events/publish.rs
+++ b/nodedb/src/control/server/dispatch_utils/change_events/publish.rs
@@ -135,7 +135,7 @@ pub(crate) fn extract_write_change_set(plan: &PhysicalPlan, tenant_id: TenantId)
 /// write plan yields exactly one event; a handful of multi-row /
 /// multi-collection ops yield more than one, and reads / DDL / index
 /// maintenance yield none.
-fn publish_change_set_with_lsn(
+pub(crate) fn publish_change_set_with_lsn(
     shared: &SharedState,
     tenant_id: TenantId,
     database_id: DatabaseId,
diff --git a/nodedb/src/control/server/dispatch_utils/mod.rs b/nodedb/src/control/server/dispatch_utils/mod.rs
index 5ef93a54d..e7cd038ca 100644
--- a/nodedb/src/control/server/dispatch_utils/mod.rs
+++ b/nodedb/src/control/server/dispatch_utils/mod.rs
@@ -8,7 +8,10 @@ mod dispatch;
 mod submit_write;
 mod types;
 
-pub(crate) use change_events::{publish_cluster_array_change_events, publish_origin_change_events};
+pub(crate) use change_events::{
+    WriteChangeSet, extract_write_change_set, publish_change_set_with_lsn,
+    publish_cluster_array_change_events, publish_origin_change_events,
+};
 pub(crate) use collect::{DispatchCollectError, collect_bounded_response};
 pub(crate) use dispatch::{dispatch_autocommit_write, dispatch_write_to_data_plane};
 pub use dispatch::{
diff --git a/nodedb/src/control/server/pgwire/handler/dispatch.rs b/nodedb/src/control/server/pgwire/handler/dispatch.rs
index 498a6090c..5e790acd3 100644
--- a/nodedb/src/control/server/pgwire/handler/dispatch.rs
+++ b/nodedb/src/control/server/pgwire/handler/dispatch.rs
@@ -398,7 +398,9 @@ impl NodeDbPgHandler {
             attempt: 1,
             partial: false,
             payload: payload.into(),
-            watermark_lsn: Lsn::new(0),
+            // Replicated apply returns the authoritative participant WAL LSN.
+            // CDC ordering must use it rather than a synthetic zero watermark.
+            watermark_lsn: write_version,
             error_code: None,
             read_set_valid: None,
             read_version_lsn: write_version,
diff --git a/nodedb/src/control/server/shared/ddl/neutral/graph_ops/stats.rs b/nodedb/src/control/server/shared/ddl/neutral/graph_ops/stats.rs
index 68dd3211c..6de436d87 100644
--- a/nodedb/src/control/server/shared/ddl/neutral/graph_ops/stats.rs
+++ b/nodedb/src/control/server/shared/ddl/neutral/graph_ops/stats.rs
@@ -86,9 +86,13 @@ pub async fn show_graph_stats(
         )?;
     }
 
+    // Exact logical-edge scans are required even for current-time reads:
+    // source-owned summaries cannot deduplicate a destination shared by edges
+    // from different source vShards, and mixed legacy/current collections may
+    // have no summary row at all. Identity union below is the correctness path.
     let plan = PhysicalPlan::Graph(GraphOp::Stats {
         collection: collection.clone(),
-        as_of,
+        as_of: as_of.or(Some(i64::MAX)),
     });
 
     let resp = broadcast_to_all_cores(state, identity.tenant_id, database_id, plan, TraceId::ZERO)
@@ -157,6 +161,10 @@ fn filter_active_collections(
 /// label counts and re-deriving `distinct_label_count` from the merged set.
 fn aggregate_by_collection(entries: Vec<CollectionStats>) -> Vec<CollectionStats> {
     let mut label_acc: BTreeMap<String, BTreeMap<String, u64>> = BTreeMap::new();
+    let mut historical_edges: BTreeMap<
+        String,
+        std::collections::BTreeSet<(String, String, String)>,
+    > = BTreeMap::new();
     let mut by_name: BTreeMap<String, CollectionStats> = BTreeMap::new();
 
     for e in entries {
@@ -173,14 +181,32 @@ fn aggregate_by_collection(entries: Vec<CollectionStats>) -> Vec<CollectionStats
             let slot = labels.entry(label).or_insert(0);
             *slot = slot.saturating_add(count);
         }
+        historical_edges
+            .entry(e.collection)
+            .or_default()
+            .extend(e.logical_edges);
     }
 
     let mut result: Vec<CollectionStats> = Vec::with_capacity(by_name.len());
     for (collection, mut acc) in by_name {
-        let labels_map = label_acc.remove(&collection).unwrap_or_default();
-        let labels: Vec<(String, u64)> = labels_map.into_iter().collect();
-        acc.distinct_label_count = labels.len() as u64;
-        acc.labels = labels;
+        let exact_edges = historical_edges.remove(&collection).unwrap_or_default();
+        if exact_edges.is_empty() {
+            let labels_map = label_acc.remove(&collection).unwrap_or_default();
+            acc.labels = labels_map.into_iter().collect();
+        } else {
+            let mut nodes = std::collections::BTreeSet::new();
+            let mut labels = BTreeMap::<String, u64>::new();
+            for (src, label, dst) in &exact_edges {
+                nodes.insert(src);
+                nodes.insert(dst);
+                *labels.entry(label.clone()).or_default() += 1;
+            }
+            acc.edge_count = exact_edges.len() as u64;
+            acc.distinct_node_count = nodes.len() as u64;
+            acc.labels = labels.into_iter().collect();
+            acc.logical_edges = exact_edges.into_iter().collect();
+        }
+        acc.distinct_label_count = acc.labels.len() as u64;
         result.push(acc);
     }
     result
diff --git a/nodedb/src/control/server/shared/ddl/neutral/tenant/drop.rs b/nodedb/src/control/server/shared/ddl/neutral/tenant/drop.rs
index 701a75a23..20f7e02f5 100644
--- a/nodedb/src/control/server/shared/ddl/neutral/tenant/drop.rs
+++ b/nodedb/src/control/server/shared/ddl/neutral/tenant/drop.rs
@@ -33,6 +33,16 @@ pub fn drop_tenant(
             "permission denied: only superuser can drop tenants",
         ));
     }
+    // Tenant teardown currently coordinates catalog rows with several
+    // in-memory security stores. It must not enter the generic transactional
+    // DDL buffer, whose rollback only discards metadata entries and cannot undo
+    // those side effects.
+    if crate::control::server::shared::session::ddl_buffer::is_active() {
+        return Err(ddl_err(
+            "0A000",
+            "DROP TENANT is not allowed inside an explicit transaction",
+        ));
+    }
 
     let (if_exists, parts) = strip_if_exists(parts, 2);
 
diff --git a/nodedb/src/control/server/shared/ddl/neutral/user/drop.rs b/nodedb/src/control/server/shared/ddl/neutral/user/drop.rs
index 4b7484ffb..116ccdddc 100644
--- a/nodedb/src/control/server/shared/ddl/neutral/user/drop.rs
+++ b/nodedb/src/control/server/shared/ddl/neutral/user/drop.rs
@@ -17,6 +17,17 @@ use crate::control::state::SharedState;
 use super::super::super::result::{DdlError, DdlResult};
 use super::super::auth_support::{require_tenant_admin, status, strip_if_exists};
 use super::reassign_owned::reassign_owned_and_sweep_grants;
+use super::tenant_purge::purge_owned_for_tenant_teardown;
+
+/// How a dropped user's owned objects were disposed of, for the audit trail.
+enum OwnershipDisposition {
+    /// Objects were reassigned to the named tenant administrator.
+    Reassigned(String),
+    /// The user owned nothing that required reassignment.
+    NoneOwned,
+    /// Tenant teardown purged the given number of owned objects outright.
+    Purged(usize),
+}
 
 /// DROP USER [IF EXISTS] <name>
 pub fn drop_user(
@@ -105,7 +116,23 @@ fn drop_user_inner(
     // user, BEFORE removing the user row. Fail-closed: any error here
     // aborts the drop, because a partially-reassigned-then-deleted user
     // is exactly the dangling-reference bug this guards against.
-    let admin_name = reassign_owned_and_sweep_grants(state, username, user_tenant)?;
+    //
+    // During tenant teardown the owned objects are purged outright (the
+    // tenant is going away), so the audit trail must record the destructive
+    // purge — not misreport it as "nothing owned" the way the reassign path's
+    // `None` does.
+    let disposition = if tenant_teardown {
+        OwnershipDisposition::Purged(purge_owned_for_tenant_teardown(
+            state,
+            username,
+            user_tenant,
+        )?)
+    } else {
+        match reassign_owned_and_sweep_grants(state, username, user_tenant)? {
+            Some(admin_name) => OwnershipDisposition::Reassigned(admin_name),
+            None => OwnershipDisposition::NoneOwned,
+        }
+    };
 
     // `DropUser` fully removes the identity record on every node —
     // in-memory cache and redb catalog — so the username is freed
@@ -139,11 +166,18 @@ fn drop_user_inner(
     };
 
     if dropped {
-        let detail = match admin_name {
-            Some(admin_name) => {
+        let detail = match disposition {
+            OwnershipDisposition::Reassigned(admin_name) => {
                 format!("dropped user '{username}' (ownership reassigned to '{admin_name}')")
             }
-            None => format!("dropped user '{username}' (no owned objects required reassignment)"),
+            OwnershipDisposition::NoneOwned => {
+                format!("dropped user '{username}' (no owned objects required reassignment)")
+            }
+            OwnershipDisposition::Purged(purged) => {
+                format!(
+                    "dropped user '{username}' (tenant teardown purged {purged} owned object(s))"
+                )
+            }
         };
         state.audit_record(
             AuditEvent::PrivilegeChange,
diff --git a/nodedb/src/control/server/shared/ddl/neutral/user/mod.rs b/nodedb/src/control/server/shared/ddl/neutral/user/mod.rs
index c6b7dfed0..859675a95 100644
--- a/nodedb/src/control/server/shared/ddl/neutral/user/mod.rs
+++ b/nodedb/src/control/server/shared/ddl/neutral/user/mod.rs
@@ -7,6 +7,7 @@ mod create;
 mod drop;
 mod iso8601;
 mod reassign_owned;
+mod tenant_purge;
 
 pub use alter::alter_user;
 pub use create::create_user;
diff --git a/nodedb/src/control/server/shared/ddl/neutral/user/reassign_owned.rs b/nodedb/src/control/server/shared/ddl/neutral/user/reassign_owned.rs
index 10c0475a9..58e838807 100644
--- a/nodedb/src/control/server/shared/ddl/neutral/user/reassign_owned.rs
+++ b/nodedb/src/control/server/shared/ddl/neutral/user/reassign_owned.rs
@@ -40,7 +40,8 @@ use super::super::super::result::DdlError;
 /// parent-replicated kinds each own a primary `Stored*` record with an
 /// in-band `owner` field; `Index` is the standalone path (a bare
 /// `StoredOwner` row with no parent record).
-enum OwnerKind {
+#[derive(Clone, Copy, PartialEq, Eq)]
+pub(super) enum OwnerKind {
     Collection,
     Function,
     Procedure,
@@ -58,7 +59,7 @@ impl OwnerKind {
     /// means the writer of that owner row introduced a kind this module
     /// does not yet handle — the caller turns that into a hard error so
     /// the drop fails closed instead of leaking a dangling reference.
-    fn from_object_type(s: &str) -> Option<Self> {
+    pub(super) fn from_object_type(s: &str) -> Option<Self> {
         Some(match s {
             object_type::COLLECTION => Self::Collection,
             object_type::FUNCTION => Self::Function,
@@ -334,7 +335,7 @@ fn reassign_one(
 
 /// Revoke every grant whose grantee is the dropped user, so no
 /// `permission.grantee → user` reference outlives the user row.
-fn sweep_grants(
+pub(super) fn sweep_grants(
     state: &SharedState,
     catalog: &SystemCatalog,
     username: &str,
@@ -397,7 +398,7 @@ fn persist_owner_local_in_database(
     Ok(())
 }
 
-fn propose(state: &SharedState, entry: &CatalogEntry) -> Result<u64, DdlError> {
+pub(super) fn propose(state: &SharedState, entry: &CatalogEntry) -> Result<u64, DdlError> {
     propose_catalog_entry(state, entry).map_err(|e| ddl_err(format!("metadata propose: {e}")))
 }
 
@@ -408,7 +409,7 @@ fn missing(object_type: &str, name: &str) -> DdlError {
     ))
 }
 
-fn ddl_err(message: String) -> DdlError {
+pub(super) fn ddl_err(message: String) -> DdlError {
     DdlError {
         sqlstate: "XX000".to_string(),
         message,
diff --git a/nodedb/src/control/server/shared/ddl/neutral/user/tenant_purge.rs b/nodedb/src/control/server/shared/ddl/neutral/user/tenant_purge.rs
new file mode 100644
index 000000000..2bcb923f3
--- /dev/null
+++ b/nodedb/src/control/server/shared/ddl/neutral/user/tenant_purge.rs
@@ -0,0 +1,119 @@
+// SPDX-License-Identifier: BUSL-1.1
+
+//! Terminal tenant-administrator object purge used only by `DROP TENANT`.
+
+use crate::control::catalog_entry::CatalogEntry;
+use crate::control::security::catalog::auth_types::object_type;
+use crate::control::security::catalog::{StoredOwner, SystemCatalog};
+use crate::control::state::SharedState;
+use crate::types::TenantId;
+
+use super::super::super::result::DdlError;
+use super::reassign_owned::{OwnerKind, ddl_err, propose, sweep_grants};
+
+/// Purge every object owned by the tenant administrator during `DROP TENANT`,
+/// returning the number of owned objects deleted so the caller can record an
+/// accurate audit trail for the destructive teardown.
+pub(super) fn purge_owned_for_tenant_teardown(
+    state: &SharedState,
+    username: &str,
+    tenant: TenantId,
+) -> Result<usize, DdlError> {
+    let catalog = state.credentials.catalog();
+    let mut owned = catalog
+        .owners_for_user(username, tenant.as_u64())
+        .map_err(|e| ddl_err(format!("load owner rows: {e}")))?;
+    owned.sort_by_key(|owner| owner.object_type == object_type::COLLECTION);
+    let purged = owned.len();
+
+    for owner in owned {
+        let kind = OwnerKind::from_object_type(&owner.object_type).ok_or_else(|| {
+            ddl_err(format!(
+                "cannot delete object of unknown owner type '{}' ('{}') during tenant teardown",
+                owner.object_type, owner.object_name
+            ))
+        })?;
+        if kind == OwnerKind::Collection {
+            purge_collection_rls_policies(state, catalog, tenant, &owner.object_name)?;
+        }
+        let entry = teardown_delete_entry(kind, tenant, &owner);
+        let log_index = propose(state, &entry)?;
+        crate::control::catalog_entry::apply::local::apply_locally_if_needed(
+            state, &entry, log_index,
+        );
+        if log_index == 0 {
+            state
+                .permissions
+                .install_replicated_remove_owner_in_database(
+                    &owner.object_type,
+                    owner.database_id,
+                    tenant.as_u64(),
+                    &owner.object_name,
+                );
+        }
+    }
+    sweep_grants(state, catalog, username)?;
+    Ok(purged)
+}
+
+fn purge_collection_rls_policies(
+    state: &SharedState,
+    catalog: &SystemCatalog,
+    tenant: TenantId,
+    collection: &str,
+) -> Result<(), DdlError> {
+    let tenant_id = tenant.as_u64();
+    let policies = catalog
+        .load_all_rls_policies()
+        .map_err(|e| ddl_err(format!("load RLS policies: {e}")))?;
+    for policy in policies
+        .into_iter()
+        .filter(|policy| policy.tenant_id == tenant_id && policy.collection == collection)
+    {
+        let entry = CatalogEntry::DeleteRlsPolicy {
+            tenant_id,
+            collection: collection.to_string(),
+            name: policy.name.clone(),
+        };
+        let log_index = propose(state, &entry)?;
+        crate::control::catalog_entry::apply::local::apply_locally_if_needed(
+            state, &entry, log_index,
+        );
+        if log_index == 0 {
+            state
+                .rls
+                .install_replicated_drop_policy(tenant_id, collection, &policy.name);
+        }
+    }
+    Ok(())
+}
+
+fn teardown_delete_entry(kind: OwnerKind, tenant: TenantId, owner: &StoredOwner) -> CatalogEntry {
+    let tenant_id = tenant.as_u64();
+    let name = owner.object_name.clone();
+    match kind {
+        OwnerKind::Collection => CatalogEntry::PurgeCollection {
+            database_id: owner.database_id,
+            tenant_id,
+            name,
+        },
+        OwnerKind::Function => CatalogEntry::DeleteFunction { tenant_id, name },
+        OwnerKind::Procedure => CatalogEntry::DeleteProcedure { tenant_id, name },
+        OwnerKind::Trigger => CatalogEntry::DeleteTrigger { tenant_id, name },
+        OwnerKind::MaterializedView => CatalogEntry::DeleteMaterializedView { tenant_id, name },
+        OwnerKind::Sequence => CatalogEntry::DeleteSequence { tenant_id, name },
+        OwnerKind::Schedule => CatalogEntry::DeleteSchedule { tenant_id, name },
+        OwnerKind::ChangeStream => CatalogEntry::DeleteChangeStream { tenant_id, name },
+        OwnerKind::ContinuousAggregate => CatalogEntry::DeleteContinuousAggregate {
+            database_id: owner.database_id,
+            tenant_id,
+            name,
+        },
+        OwnerKind::Index => CatalogEntry::DeleteOwner {
+            object_type: owner.object_type.clone(),
+            database_id: owner.database_id,
+            tenant_id,
+            object_name: name,
+        },
+    }
+}
diff --git a/nodedb/src/control/server/shared/session/commit.rs b/nodedb/src/control/server/shared/session/commit.rs
index 8b71ffda1..6c92f944f 100644
--- a/nodedb/src/control/server/shared/session/commit.rs
+++ b/nodedb/src/control/server/shared/session/commit.rs
@@ -1,33 +1,22 @@
 // SPDX-License-Identifier: BUSL-1.1
 
-//! Protocol-neutral COMMIT orchestrator.
-//!
-//! Drives the full commit sequence off the neutral session state: snapshot
-//! isolation conflict detection (with read-your-own-write exclusion), WAL
-//! transaction batching, single-shard vs Calvin multi-shard dispatch, staging
-//! overlay release, deferred offset flush, GAP_FREE sequence finalization,
-//! buffered DDL propose, and cursor/notify flush. Every Data-Plane dispatch
-//! goes through the injected [`TxnDataPlane`] seam so both pgwire and native
-//! drive this one core; transports only shape the returned [`CommitOutcome`].
+//! Protocol-neutral COMMIT orchestration shared by pgwire and native sessions.
 
 use std::net::SocketAddr;
 
 use crate::bridge::envelope::{PhysicalPlan, Response, Status};
 use crate::control::gateway::RouteDecision;
-use crate::control::gateway::retry::retry_not_leader;
 use crate::control::planner::calvin::{DispatchClass, classify_dispatch, read_vshards_of};
 use crate::control::security::identity::AuthenticatedIdentity;
-use crate::control::server::graph_dispatch::cluster_resolve::gateway_shared;
 use crate::control::server::shared::plan_util::extract_collection;
 use crate::control::state::SharedState;
 use nodedb_cluster::calvin::types::ReleaseReason;
-use nodedb_cluster::{MetadataEntry, encode_entry};
 use nodedb_physical::physical_plan::MetaOp;
 use nodedb_physical::physical_task::{PhysicalTask, PostSetOp};
 
 use super::ddl_buffer;
-use super::leader_forward::{forward_to_leader, resolve_leader};
 use super::outcome::{AbortReason, CommitOutcome, TxnDataPlane};
+use super::overlay_drop::drop_txn_overlay;
 use super::read_set::ReadSetEntry;
 use super::store::SessionStore;
 
@@ -100,17 +89,42 @@ pub async fn run_commit(
                 }
             }
             DispatchClass::SingleShard { vshard: vshard_id } => {
-                if let Some(outcome) =
-                    si_conflict_abort(sessions, addr, state, &read_set, &written_collections)
-                {
-                    super::reservation_release::release_and_rollback(state, sessions, addr).await;
-                    return outcome;
-                }
-                if let Some(reason) =
-                    dispatch_single_shard(state, dp, &buffered, tenant_id, vshard_id).await
-                {
-                    super::reservation_release::release_and_rollback(state, sessions, addr).await;
-                    return CommitOutcome::Aborted { reason };
+                let leader =
+                    crate::control::server::graph_dispatch::cluster_resolve::resolve_for_vshard(
+                        state,
+                        vshard_id.as_u32(),
+                    );
+                if !matches!(leader, RouteDecision::Local) {
+                    // The interactive transaction WAL record belongs to this
+                    // coordinator and cannot be forwarded as a bare remote
+                    // Data-Plane LSN. Route a non-local single-shard commit
+                    // through Calvin's replicated Vote/Verdict barrier instead;
+                    // this gives it the same leader routing, OCC, durability,
+                    // and apply ordering as any multi-participant commit.
+                    if let Some(reason) = super::commit_calvin::run_commit_calvin(
+                        sessions, addr, state, &buffered, tenant_id, &read_set,
+                    )
+                    .await
+                    {
+                        super::reservation_release::release_and_rollback(state, sessions, addr)
+                            .await;
+                        return CommitOutcome::Aborted { reason };
+                    }
+                } else {
+                    if let Some(outcome) =
+                        si_conflict_abort(sessions, addr, state, &read_set, &written_collections)
+                    {
+                        super::reservation_release::release_and_rollback(state, sessions, addr)
+                            .await;
+                        return outcome;
+                    }
+                    if let Some(reason) =
+                        dispatch_single_shard(state, dp, &buffered, tenant_id, vshard_id).await
+                    {
+                        super::reservation_release::release_and_rollback(state, sessions, addr)
+                            .await;
+                        return CommitOutcome::Aborted { reason };
+                    }
                 }
             }
         }
@@ -207,7 +221,7 @@ pub async fn run_commit(
     }
 
     // Flush any buffered DDL entries as a single atomic batch.
-    if let Some(reason) = flush_buffered_ddl(state) {
+    if let Some(reason) = ddl_buffer::flush(state) {
         return CommitOutcome::Aborted { reason };
     }
 
@@ -273,6 +287,14 @@ async fn dispatch_single_shard(
     vshard_id: crate::types::VShardId,
 ) -> Option<AbortReason> {
     let plans: Vec<PhysicalPlan> = buffered.iter().map(|t| t.plan.clone()).collect();
+    let database_id = buffered
+        .first()
+        .map_or(crate::types::DatabaseId::DEFAULT, |task| task.database_id);
+    if buffered.iter().any(|task| task.database_id != database_id) {
+        return Some(AbortReason::Dispatch(crate::Error::BadRequest {
+            detail: "transaction spans multiple databases".to_owned(),
+        }));
+    }
 
     // txn_id is present for any staged commit (buffer_write stamps it).
     let Some(txn_id) = buffered.first().and_then(|t| t.txn_id) else {
@@ -287,7 +309,7 @@ async fn dispatch_single_shard(
     let resolve_task = PhysicalTask {
         tenant_id,
         vshard_id,
-        database_id: crate::types::DatabaseId::DEFAULT,
+        database_id,
         plan: PhysicalPlan::Meta(MetaOp::ResolveTxn {
             txn_id,
             plans: plans.clone(),
@@ -313,6 +335,26 @@ async fn dispatch_single_shard(
         }
     };
 
+    // Re-verify local vShard ownership immediately before the durable WAL
+    // append. `run_commit` resolved this vShard as `Local`, but a leadership
+    // handoff can land during the `ResolveTxn` await above. Without this
+    // re-check the transaction redo would be appended to a WAL this node no
+    // longer owns, and the batch dispatch below (which re-resolves leadership)
+    // would then reject the now-non-local commit — leaving an orphaned durable
+    // redo record behind while the client is told the commit aborted. Aborting
+    // here, BEFORE any durable write, keeps the failure side-effect-free and
+    // retryable: the client's retry re-enters `run_commit`, sees the vShard is
+    // non-local, and routes the commit through Calvin's replicated barrier.
+    if !matches!(
+        crate::control::server::graph_dispatch::cluster_resolve::resolve_for_vshard(
+            state,
+            vshard_id.as_u32(),
+        ),
+        RouteDecision::Local
+    ) {
+        return Some(AbortReason::Serialization);
+    }
+
     // 2. Write-ahead the transaction as ONE replayable `TransactionRedo` record
     //    (each sub-op keeps its real engine `record_type`). `None` when the txn
     //    has no durable writes (all reads / CRDT / text). Its LSN stamps the
@@ -321,12 +363,10 @@ async fn dispatch_single_shard(
     let wal_lsn = if redo.ops.is_empty() {
         None
     } else {
-        match state.wal.append_transaction_redo(
-            tenant_id,
-            vshard_id,
-            crate::types::DatabaseId::DEFAULT,
-            &redo,
-        ) {
+        match state
+            .wal
+            .append_transaction_redo(tenant_id, vshard_id, database_id, &redo)
+        {
             Ok(lsn) => Some(lsn),
             Err(e) => {
                 return Some(AbortReason::Dispatch(crate::Error::Internal {
@@ -338,7 +378,7 @@ async fn dispatch_single_shard(
     let batch_task = PhysicalTask {
         tenant_id,
         vshard_id,
-        database_id: crate::types::DatabaseId::DEFAULT,
+        database_id,
         plan: PhysicalPlan::Meta(MetaOp::TransactionBatch {
             plans,
             // Reuse the resolve-time bitemporal stamps recorded in this
@@ -370,114 +410,3 @@ pub(super) fn classify_batch_dispatch(result: crate::Result<Response>) -> Option
         Ok(_) => None,
     }
 }
-
-/// Flush any DDL buffered during the transaction as a single atomic metadata
-/// Raft batch. Returns `Some(reason)` on encode/propose failure.
-fn flush_buffered_ddl(state: &SharedState) -> Option<AbortReason> {
-    let payloads = ddl_buffer::take()?;
-    if payloads.is_empty() {
-        return None;
-    }
-    // Each buffered entry carries the audit context captured at its own
-    // statement boundary (not COMMIT time). Map to `CatalogDdlAudited` when
-    // present so every sub-DDL gets its own audit record on every replica.
-    let sub_entries: Vec<MetadataEntry> = payloads
-        .into_iter()
-        .map(|e| match e.audit {
-            Some(ctx) => MetadataEntry::CatalogDdlAudited {
-                payload: e.payload,
-                auth_user_id: ctx.auth_user_id,
-                auth_user_name: ctx.auth_user_name,
-                sql_text: ctx.sql_text,
-            },
-            None => MetadataEntry::CatalogDdl { payload: e.payload },
-        })
-        .collect();
-    let batch = MetadataEntry::Batch {
-        entries: sub_entries,
-    };
-    if let Some(handle) = state.metadata_raft.get() {
-        let raw = match encode_entry(&batch) {
-            Ok(raw) => raw,
-            Err(e) => {
-                return Some(AbortReason::DdlPropose(crate::Error::Internal {
-                    detail: format!("DDL batch encode: {e}"),
-                }));
-            }
-        };
-        if let Err(e) = handle.propose(raw) {
-            return Some(AbortReason::DdlPropose(crate::Error::Internal {
-                detail: format!("DDL batch propose: {e}"),
-            }));
-        }
-    }
-    None
-}
-
-/// Release a transaction's staging overlay on a vShard that hosted staged
-/// writes. Dispatched AFTER the durable resolution (COMMIT batch flush /
-/// ROLLBACK) on the vShard's CURRENT leader: when this node leads the vShard (or
-/// single-node) the existing WAL-free local dispatch runs unchanged; otherwise
-/// the `DropTxnOverlay` is forwarded to the remote leader keyed by `txn_id` — the
-/// same node the matching `StageWrite` reached, since stage / read / drop all
-/// resolve to the vShard's leader (see [`super::leader_forward`]).
-///
-/// Returns the dispatch/forward error rather than swallowing it, so the caller
-/// (COMMIT / ROLLBACK) sees a teardown failure and decides how to surface it —
-/// a `LeaderUnknown` resolution fails closed as `Error::NotLeader` inside
-/// [`forward_to_leader`]. The remote arm retries a transient `NotLeader` /
-/// `RetryableLeaderChange` a bounded number of times (see [`retry_not_leader`])
-/// before that error is returned, so a momentary leader election does not
-/// strand the overlay after a single forward attempt.
-pub(super) async fn drop_txn_overlay(
-    state: &SharedState,
-    dp: &impl TxnDataPlane,
-    tenant_id: crate::types::TenantId,
-    vshard_id: crate::types::VShardId,
-    txn_id: crate::types::TxnId,
-) -> crate::Result<()> {
-    // The overlay id travels inside the plan (the Data-Plane handler reads it
-    // from `MetaOp::DropTxnOverlay`); the request `txn_id` stamp additionally
-    // keys the leader's per-transaction overlay when forwarded (inert locally).
-    let drop_plan = PhysicalPlan::Meta(MetaOp::DropTxnOverlay { txn_id });
-    let task = PhysicalTask {
-        tenant_id,
-        vshard_id,
-        database_id: crate::types::DatabaseId::DEFAULT,
-        plan: drop_plan.clone(),
-        post_set_op: PostSetOp::None,
-        txn_id: Some(txn_id),
-    };
-    // Overlay teardown is not a write — no WAL record, no write version.
-    match resolve_leader(&task, state) {
-        RouteDecision::Local => {
-            dp.dispatch_no_wal(task, None).await?;
-            Ok(())
-        }
-        _ => {
-            // A transient leader-election failure at COMMIT/ROLLBACK must not
-            // strand the overlay after a single forward attempt: retry the
-            // remote drop up to `retry_not_leader`'s bounded budget (3
-            // attempts, ~50ms then ~100ms backoff between them), re-resolving
-            // the leader on every
-            // attempt so a routing-table hint refreshed by a prior
-            // `NotLeader` (or a mid-retry leadership handback to this node)
-            // is picked up rather than repeatedly re-forwarding to a now-dead
-            // target.
-            let shared = gateway_shared(state)?;
-            let routing_ref = shared.cluster_routing.as_deref();
-            retry_not_leader(routing_ref, |_attempt| {
-                let task = task.clone();
-                let drop_plan = drop_plan.clone();
-                async move {
-                    match resolve_leader(&task, state) {
-                        RouteDecision::Local => dp.dispatch_no_wal(task, None).await,
-                        remote => forward_to_leader(state, remote, task, &drop_plan).await,
-                    }
-                }
-            })
-            .await
-            .map(|_| ())
-        }
-    }
-}
diff --git a/nodedb/src/control/server/shared/session/commit_calvin.rs b/nodedb/src/control/server/shared/session/commit_calvin.rs
index 254bef8c1..4a2a95d95 100644
--- a/nodedb/src/control/server/shared/session/commit_calvin.rs
+++ b/nodedb/src/control/server/shared/session/commit_calvin.rs
@@ -17,8 +17,8 @@
 use std::net::SocketAddr;
 
 use crate::control::planner::calvin::{
-    CrossShardTxnMode, TxnDispatchPosition, build_single_vshard_tx_class, dispatch_tasks_to_calvin,
-    submit_calvin_routed,
+    CrossShardTxnMode, DispatchClass, TxnDispatchPosition, build_single_vshard_tx_class,
+    classify_dispatch, dispatch_tasks_to_calvin, read_vshards_of, submit_calvin_routed,
 };
 use crate::control::server::shared::session::read_set::ReadSetEntry;
 use crate::control::state::SharedState;
@@ -53,22 +53,35 @@ pub(super) async fn run_commit_calvin(
             if state.sequencer_inbox.get().is_none() {
                 return Some(AbortReason::Dispatch(crate::Error::SequencerUnavailable));
             }
-            // Route the buffered cross-shard batch through the sequencer-group
-            // leader via the routed submit-and-await — the whole batch commits
-            // atomically. This is the COMMIT flush of a buffered explicit block,
-            // NOT a mid-block single statement, so the mid-block cross-shard guard
-            // must not fire (hence `CommitFlush`).
-            match dispatch_tasks_to_calvin(
-                state,
-                buffered,
-                tenant_id,
-                cross_shard_mode,
-                TxnDispatchPosition::CommitFlush,
-                reads,
-                reservation_owner,
-            )
-            .await
-            {
+            // A remote single-vShard commit uses the opt-in single-participant
+            // builder; `dispatch_tasks_to_calvin` intentionally rejects that
+            // shape because its ordinary entry point is multi-shard-only.
+            let result = match classify_dispatch(buffered, &read_vshards_of(reads)) {
+                DispatchClass::SingleShard { .. } => {
+                    let mut tx_class =
+                        match build_single_vshard_tx_class(buffered, tenant_id, reads) {
+                            Ok(tx_class) => tx_class,
+                            Err(e) => return Some(AbortReason::Dispatch(e)),
+                        };
+                    tx_class.set_lock_owner(reservation_owner);
+                    submit_calvin_routed(state, tx_class).await
+                }
+                DispatchClass::MultiShard { .. } => {
+                    // Route the buffered cross-shard batch through the
+                    // sequencer-group leader via one atomic submit-and-await.
+                    dispatch_tasks_to_calvin(
+                        state,
+                        buffered,
+                        tenant_id,
+                        cross_shard_mode,
+                        TxnDispatchPosition::CommitFlush,
+                        reads,
+                        reservation_owner,
+                    )
+                    .await
+                }
+            };
+            match result {
                 Ok(_) => None,
                 Err(crate::Error::CalvinSerializationConflict) => {
                     super::hot_key::record_read_set_aborts(state, reads);
diff --git a/nodedb/src/control/server/shared/session/ddl_buffer.rs b/nodedb/src/control/server/shared/session/ddl_buffer.rs
index e6bde21ef..e4048fd62 100644
--- a/nodedb/src/control/server/shared/session/ddl_buffer.rs
+++ b/nodedb/src/control/server/shared/session/ddl_buffer.rs
@@ -15,9 +15,14 @@
 
 use std::cell::RefCell;
 
+use crate::control::catalog_entry::CatalogEntry;
+use crate::control::state::SharedState;
+use nodedb_cluster::{METADATA_GROUP_ID, MetadataEntry, encode_entry};
+
 use super::audit_context::AuditCtx;
+use super::outcome::AbortReason;
 
-/// One buffered DDL statement: the encoded `CatalogEntry` payload
+/// One buffered DDL statement: the unstamped `CatalogEntry`
 /// plus the optional audit context captured from
 /// [`super::audit_context::current()`] at buffer time. The audit
 /// context is stamped at *statement* time, not at COMMIT time, so
@@ -25,11 +30,11 @@ use super::audit_context::AuditCtx;
 /// produced it (not just the COMMIT).
 #[derive(Debug, Clone)]
 pub struct BufferedDdl {
-    pub payload: Vec<u8>,
+    pub entry: CatalogEntry,
     pub audit: Option<AuditCtx>,
 }
 
-/// Encoded DDL payloads buffered during a transaction.
+/// Unstamped DDL entries buffered during a transaction.
 pub type DdlBuffer = Vec<BufferedDdl>;
 
 thread_local! {
@@ -55,15 +60,15 @@ pub fn activate() {
     });
 }
 
-/// Try to buffer a DDL payload. Returns `true` if the buffer is
-/// active and the payload was pushed. Returns `false` if no buffer
-/// is active (caller should propose normally).
-pub fn try_buffer(payload: Vec<u8>) -> bool {
+/// Try to buffer an unstamped DDL entry. Returns `true` if the buffer is
+/// active and the entry was pushed. Returns `false` if no buffer is active
+/// (caller should prepare and propose normally).
+pub fn try_buffer(entry: CatalogEntry) -> bool {
     ACTIVE_BUFFER.with(|b| {
         let mut guard = b.borrow_mut();
         if let Some(buf) = guard.as_mut() {
             buf.push(BufferedDdl {
-                payload,
+                entry,
                 audit: super::audit_context::current(),
             });
             true
@@ -86,6 +91,123 @@ pub fn discard() {
     });
 }
 
+/// Flush buffered entries as one fenced metadata-Raft batch.
+pub(super) fn flush(state: &SharedState) -> Option<AbortReason> {
+    let buffered = take()?;
+    if buffered.is_empty() {
+        return None;
+    }
+    let handle = state.metadata_raft.get()?;
+    let _local_guard = match state.metadata_ddl_lock.lock() {
+        Ok(guard) => guard,
+        Err(_) => {
+            return Some(AbortReason::DdlPropose(crate::Error::Internal {
+                detail: "metadata DDL preparation lock poisoned".into(),
+            }));
+        }
+    };
+    let distributed_guard = match crate::control::metadata_proposer::acquire_ddl_prepare_lease(
+        state,
+        handle.as_ref(),
+    ) {
+        Ok(guard) => guard,
+        Err(error) => return Some(AbortReason::DdlPropose(error)),
+    };
+
+    for item in &buffered {
+        if let Some((descriptor_id, prior_version)) =
+            crate::control::lease::descriptor_id_and_prior_version(&item.entry, state)
+            && prior_version > 0
+            && let Err(error) = crate::control::lease::drain_for_ddl(
+                state,
+                descriptor_id,
+                prior_version,
+                crate::control::metadata_proposer::DEFAULT_DRAIN_TIMEOUT,
+            )
+        {
+            return Some(AbortReason::DdlPropose(error));
+        }
+    }
+    let audits: Vec<_> = buffered.iter().map(|item| item.audit.clone()).collect();
+    let entries: Vec<_> = buffered.into_iter().map(|item| item.entry).collect();
+    let stamped = if state
+        .cluster_version_view()
+        .can_activate_feature(crate::control::rolling_upgrade::DESCRIPTOR_VERSIONING_VERSION)
+    {
+        crate::control::catalog_entry::descriptor_stamp::stamp_batch(
+            entries,
+            &state.hlc_clock,
+            state.credentials.catalog(),
+        )
+    } else {
+        entries
+    };
+
+    let mut sub_entries = Vec::with_capacity(stamped.len());
+    for (entry, audit) in stamped.into_iter().zip(audits) {
+        let payload = match crate::control::catalog_entry::encode(&entry) {
+            Ok(payload) => payload,
+            Err(error) => return Some(AbortReason::DdlPropose(error)),
+        };
+        sub_entries.push(match audit {
+            Some(ctx) => MetadataEntry::CatalogDdlAudited {
+                payload,
+                auth_user_id: ctx.auth_user_id,
+                auth_user_name: ctx.auth_user_name,
+                sql_text: ctx.sql_text,
+            },
+            None => MetadataEntry::CatalogDdl { payload },
+        });
+    }
+    let prepared = MetadataEntry::DdlPrepared {
+        token: distributed_guard.token(),
+        entry: Box::new(MetadataEntry::Batch {
+            entries: sub_entries,
+        }),
+    };
+    let raw = match encode_entry(&prepared) {
+        Ok(raw) => raw,
+        Err(error) => {
+            return Some(AbortReason::DdlPropose(crate::Error::Internal {
+                detail: format!("DDL batch encode: {error}"),
+            }));
+        }
+    };
+    let log_index = match handle.propose(raw) {
+        Ok(index) => index,
+        Err(error) => {
+            return Some(AbortReason::DdlPropose(crate::Error::Internal {
+                detail: format!("DDL batch propose: {error}"),
+            }));
+        }
+    };
+    let watcher = state.applied_index_watcher(METADATA_GROUP_ID);
+    let outcome = tokio::task::block_in_place(|| {
+        watcher.wait_for(
+            log_index,
+            crate::control::metadata_proposer::DEFAULT_PROPOSE_TIMEOUT,
+        )
+    });
+    if !outcome.is_reached() {
+        return Some(AbortReason::DdlPropose(crate::Error::Internal {
+            detail: format!(
+                "DDL batch propose timed out waiting for log index {log_index} (current: {})",
+                watcher.current()
+            ),
+        }));
+    }
+    if state
+        .metadata_ddl_applied_token
+        .load(std::sync::atomic::Ordering::Acquire)
+        != distributed_guard.token()
+    {
+        return Some(AbortReason::DdlPropose(crate::Error::Internal {
+            detail: "DDL preparation ownership was superseded before apply".into(),
+        }));
+    }
+    None
+}
+
 /// Returns `true` if a DDL buffer is currently active on this thread.
 pub fn is_active() -> bool {
     ACTIVE_BUFFER.with(|b| b.borrow().is_some())
@@ -101,10 +223,17 @@ pub fn buffer_len() -> usize {
 mod tests {
     use super::*;
 
+    fn sample_entry(name: &str) -> CatalogEntry {
+        CatalogEntry::DeleteSequence {
+            tenant_id: 1,
+            name: name.to_string(),
+        }
+    }
+
     #[test]
     fn inactive_buffer_does_not_capture() {
         discard(); // ensure clean state
-        assert!(!try_buffer(vec![1, 2, 3]));
+        assert!(!try_buffer(sample_entry("one")));
         assert!(!is_active());
     }
 
@@ -112,19 +241,25 @@ mod tests {
     fn active_buffer_captures() {
         activate();
         assert!(is_active());
-        assert!(try_buffer(vec![1]));
-        assert!(try_buffer(vec![2]));
+        assert!(try_buffer(sample_entry("one")));
+        assert!(try_buffer(sample_entry("two")));
         let buf = take().unwrap();
         assert_eq!(buf.len(), 2);
-        assert_eq!(buf[0].payload, vec![1]);
-        assert_eq!(buf[1].payload, vec![2]);
+        assert!(matches!(
+            &buf[0].entry,
+            CatalogEntry::DeleteSequence { name, .. } if name == "one"
+        ));
+        assert!(matches!(
+            &buf[1].entry,
+            CatalogEntry::DeleteSequence { name, .. } if name == "two"
+        ));
         assert!(!is_active());
     }
 
     #[test]
     fn discard_clears_buffer() {
         activate();
-        try_buffer(vec![1]);
+        try_buffer(sample_entry("one"));
         discard();
         assert!(!is_active());
         assert!(take().is_none());
diff --git a/nodedb/src/control/server/shared/session/leader_forward.rs b/nodedb/src/control/server/shared/session/leader_forward.rs
index 69103d2e4..d6821e0f7 100644
--- a/nodedb/src/control/server/shared/session/leader_forward.rs
+++ b/nodedb/src/control/server/shared/session/leader_forward.rs
@@ -47,7 +47,7 @@ use nodedb_physical::physical_task::PhysicalTask;
 /// Resolve the current leader for `task`'s target vShard against live Raft
 /// leadership (falling back to the routing-table hint), so a staging choke point
 /// can branch between its existing local dispatch and a remote forward.
-pub(super) fn resolve_leader(task: &PhysicalTask, state: &SharedState) -> RouteDecision {
+pub(crate) fn resolve_leader(task: &PhysicalTask, state: &SharedState) -> RouteDecision {
     resolve_for_vshard(state, task.vshard_id.as_u32())
 }
 
@@ -67,7 +67,7 @@ pub(super) fn resolve_leader(task: &PhysicalTask, state: &SharedState) -> RouteD
 /// write, so the forwarded stage carries the same descriptor versions a normal
 /// remote write would and is not spuriously rejected; a `DropTxnOverlay` touches
 /// no user collection, so its version set is empty.
-pub(super) async fn forward_to_leader(
+pub(crate) async fn forward_to_leader(
     state: &SharedState,
     decision: RouteDecision,
     forward_task: PhysicalTask,
diff --git a/nodedb/src/control/server/shared/session/lifecycle.rs b/nodedb/src/control/server/shared/session/lifecycle.rs
index 78447350f..77f77084f 100644
--- a/nodedb/src/control/server/shared/session/lifecycle.rs
+++ b/nodedb/src/control/server/shared/session/lifecycle.rs
@@ -12,9 +12,9 @@ use std::net::SocketAddr;
 use crate::control::security::identity::AuthenticatedIdentity;
 use crate::control::state::SharedState;
 
-use super::commit::drop_txn_overlay;
 use super::ddl_buffer;
 use super::outcome::TxnDataPlane;
+use super::overlay_drop::drop_txn_overlay;
 use super::store::SessionStore;
 
 /// Run the neutral BEGIN sequence: anchor the snapshot LSN, activate the DDL
diff --git a/nodedb/src/control/server/shared/session/mod.rs b/nodedb/src/control/server/shared/session/mod.rs
index c9943112f..49f1ca98e 100644
--- a/nodedb/src/control/server/shared/session/mod.rs
+++ b/nodedb/src/control/server/shared/session/mod.rs
@@ -15,6 +15,7 @@ mod listen;
 mod live;
 mod notice;
 pub mod outcome;
+pub mod overlay_drop;
 mod own_writes;
 mod params;
 pub mod read_consistency;
diff --git a/nodedb/src/control/server/shared/session/overlay_drop.rs b/nodedb/src/control/server/shared/session/overlay_drop.rs
new file mode 100644
index 000000000..c72e1de04
--- /dev/null
+++ b/nodedb/src/control/server/shared/session/overlay_drop.rs
@@ -0,0 +1,56 @@
+// SPDX-License-Identifier: BUSL-1.1
+
+//! Transaction staging-overlay teardown on the current vShard leader.
+
+use nodedb_physical::physical_plan::PhysicalPlan;
+use nodedb_physical::physical_plan::meta::MetaOp;
+use nodedb_physical::physical_task::{PhysicalTask, PostSetOp};
+
+use crate::control::gateway::RouteDecision;
+use crate::control::gateway::retry::retry_not_leader;
+use crate::control::state::SharedState;
+
+use super::leader_forward::{forward_to_leader, resolve_leader};
+use super::outcome::TxnDataPlane;
+use crate::control::server::graph_dispatch::cluster_resolve::gateway_shared;
+
+/// Release a transaction's staging overlay on the vShard's current leader.
+pub(super) async fn drop_txn_overlay(
+    state: &SharedState,
+    dp: &impl TxnDataPlane,
+    tenant_id: crate::types::TenantId,
+    vshard_id: crate::types::VShardId,
+    txn_id: crate::types::TxnId,
+) -> crate::Result<()> {
+    let drop_plan = PhysicalPlan::Meta(MetaOp::DropTxnOverlay { txn_id });
+    let task = PhysicalTask {
+        tenant_id,
+        vshard_id,
+        database_id: crate::types::DatabaseId::DEFAULT,
+        plan: drop_plan.clone(),
+        post_set_op: PostSetOp::None,
+        txn_id: Some(txn_id),
+    };
+    match resolve_leader(&task, state) {
+        RouteDecision::Local => {
+            dp.dispatch_no_wal(task, None).await?;
+            Ok(())
+        }
+        _ => {
+            let shared = gateway_shared(state)?;
+            let routing_ref = shared.cluster_routing.as_deref();
+            retry_not_leader(routing_ref, |_attempt| {
+                let task = task.clone();
+                let drop_plan = drop_plan.clone();
+                async move {
+                    match resolve_leader(&task, state) {
+                        RouteDecision::Local => dp.dispatch_no_wal(task, None).await,
+                        remote => forward_to_leader(state, remote, task, &drop_plan).await,
+                    }
+                }
+            })
+            .await
+            .map(|_| ())
+        }
+    }
+}
diff --git a/nodedb/src/control/state/fields.rs b/nodedb/src/control/state/fields.rs
index 7faa1d0ba..5fafc1bbb 100644
--- a/nodedb/src/control/state/fields.rs
+++ b/nodedb/src/control/state/fields.rs
@@ -1,7 +1,5 @@
 // SPDX-License-Identifier: BUSL-1.1
 
-//! SharedState struct definition — all fields for the Control Plane.
-
 use std::sync::atomic::AtomicU64;
 use std::sync::{Arc, Mutex, OnceLock, RwLock};
 
@@ -21,32 +19,20 @@ use crate::control::server::sync::dlq::SyncDlq;
 use crate::control::state::calvin_counters::CalvinCounters;
 use crate::wal::WalManager;
 
-/// Shared state accessible by all Control Plane sessions.
-///
-/// Connects TCP sessions to the Data Plane via Dispatcher/SPSC bridge and to the WAL.
-/// All fields are `Send + Sync` — safe for sharing across Tokio tasks.
 pub struct SharedState {
-    /// Routes requests to Data Plane cores via SPSC.
     pub dispatcher: Mutex<Dispatcher>,
-    /// Tracks in-flight requests and routes responses back to sessions.
     pub tracker: RequestTracker,
-    /// Write-ahead log for durability.
     pub wal: Arc<WalManager>,
     /// Collection-scoped scan quiesce registry for safe `PurgeCollection` reclaim.
     pub quiesce: Arc<crate::bridge::quiesce::CollectionQuiesce>,
-    /// Credential store for user authentication.
     pub credentials: Arc<CredentialStore>,
     /// Audit log — Control Plane only; emitters must be `Send + Sync`.
     pub audit: Arc<Mutex<AuditLog>>,
-    /// API key store.
     pub api_keys: ApiKeyStore,
-    /// Custom role store (inheritance, CRUD).
     pub roles: RoleStore,
-    /// Collection-level permission grants + ownership.
     pub permissions: PermissionStore,
     /// Per-tenant quota enforcement.
     pub tenants: Mutex<TenantIsolation>,
-    /// Row-Level Security policy store for sync delta enforcement.
     pub rls: RlsPolicyStore,
     /// User + IP blacklist store (O(1) lookup, TTL for temp bans).
     pub blacklist: crate::control::security::blacklist::store::BlacklistStore,
@@ -118,6 +104,15 @@ pub struct SharedState {
     >,
     /// Per-Raft-group apply watermark registry for commit-wait and drain paths.
     pub group_watchers: Arc<nodedb_cluster::GroupAppliedWatchers>,
+    /// Serializes this node's attempts to acquire the replicated descriptor
+    /// preparation lease.
+    pub metadata_ddl_lock: Mutex<()>,
+    /// Replicated preparation owner plus local monotonic apply time.
+    pub metadata_ddl_owner: Mutex<Option<(u64, std::time::Instant)>>,
+    /// Most recent fenced DDL token applied while its owner remained current.
+    pub metadata_ddl_applied_token: AtomicU64,
+    /// Per-node uniqueness component for descriptor-preparation lease tokens.
+    pub metadata_ddl_token_seq: AtomicU64,
     /// Handle for proposing to the metadata raft group. Set by `start_raft`; None in single-node mode.
     pub metadata_raft: OnceLock<Arc<dyn crate::control::metadata_proposer::MetadataRaftHandle>>,
     /// Propose tracker for distributed writes. Set by `start_raft`; absent in single-node mode.
diff --git a/nodedb/src/control/state/init.rs b/nodedb/src/control/state/init.rs
index b0a88a024..e678b703c 100644
--- a/nodedb/src/control/state/init.rs
+++ b/nodedb/src/control/state/init.rs
@@ -141,6 +141,10 @@ impl SharedState {
             )
             .0,
             group_watchers: Arc::new(nodedb_cluster::GroupAppliedWatchers::new()),
+            metadata_ddl_lock: std::sync::Mutex::new(()),
+            metadata_ddl_owner: std::sync::Mutex::new(None),
+            metadata_ddl_applied_token: std::sync::atomic::AtomicU64::new(0),
+            metadata_ddl_token_seq: std::sync::atomic::AtomicU64::new(1),
             metadata_raft: std::sync::OnceLock::new(),
             propose_tracker: std::sync::OnceLock::new(),
             raft_proposer: std::sync::OnceLock::new(),
diff --git a/nodedb/src/control/state/init_prod/open.rs b/nodedb/src/control/state/init_prod/open.rs
index 72cd9db1e..1d13a3569 100644
--- a/nodedb/src/control/state/init_prod/open.rs
+++ b/nodedb/src/control/state/init_prod/open.rs
@@ -199,6 +199,10 @@ impl SharedState {
             )
             .0,
             group_watchers: Arc::new(nodedb_cluster::GroupAppliedWatchers::new()),
+            metadata_ddl_lock: std::sync::Mutex::new(()),
+            metadata_ddl_owner: std::sync::Mutex::new(None),
+            metadata_ddl_applied_token: std::sync::atomic::AtomicU64::new(0),
+            metadata_ddl_token_seq: std::sync::atomic::AtomicU64::new(1),
             metadata_raft: std::sync::OnceLock::new(),
             propose_tracker: std::sync::OnceLock::new(),
             raft_proposer: std::sync::OnceLock::new(),
diff --git a/nodedb/src/data/executor/core_loop/open.rs b/nodedb/src/data/executor/core_loop/open.rs
index 59a8386f0..6c0f6f92a 100644
--- a/nodedb/src/data/executor/core_loop/open.rs
+++ b/nodedb/src/data/executor/core_loop/open.rs
@@ -183,6 +183,7 @@ impl CoreLoop {
             calvin_flush_key: None,
             calvin_flush_index_tuples: HashMap::new(),
             active_bitemporal_stamps: HashMap::new(),
+            active_graph_system_from: None,
         })
     }
 }
diff --git a/nodedb/src/data/executor/core_loop/state.rs b/nodedb/src/data/executor/core_loop/state.rs
index 748ad15ec..86ca533cf 100644
--- a/nodedb/src/data/executor/core_loop/state.rs
+++ b/nodedb/src/data/executor/core_loop/state.rs
@@ -490,6 +490,10 @@ pub struct CoreLoop {
     pub(in crate::data::executor) active_bitemporal_stamps:
         HashMap<u32, crate::data::executor::handlers::transaction::overlay::BitemporalStamp>,
 
+    /// Transaction-resolved graph system-time ordinal used for every edge
+    /// mutation in the current live apply/replay scope.
+    pub(in crate::data::executor) active_graph_system_from: Option<i64>,
+
     /// Staged Calvin write plans awaiting the local commit verdict, keyed by
     /// `(epoch, position, vshard)`. `CalvinExecuteStatic` validates a
     /// transaction and inserts its plans here WITHOUT mutating base; the
diff --git a/nodedb/src/data/executor/core_loop/tests.rs b/nodedb/src/data/executor/core_loop/tests.rs
index fdaa1a42d..1c3042765 100644
--- a/nodedb/src/data/executor/core_loop/tests.rs
+++ b/nodedb/src/data/executor/core_loop/tests.rs
@@ -45,6 +45,23 @@ pub fn make_core_with_dir(
     (core, req_tx, resp_rx)
 }
 
+/// A minimal `ExecutionTask` (DEFAULT database/tenant, vShard 0, no WAL LSN)
+/// for handler unit tests that only read `request.database_id`. The carried
+/// plan is inert — edge/point handlers take their parameters directly.
+pub fn make_default_task() -> crate::data::executor::task::ExecutionTask {
+    crate::data::executor::task::ExecutionTask::new(make_request(PhysicalPlan::Document(
+        DocumentOp::PointGet {
+            collection: "x".into(),
+            document_id: "y".into(),
+            surrogate: Surrogate::ZERO,
+            pk_bytes: Vec::new(),
+            rls_filters: Vec::new(),
+            system_time: nodedb_types::SystemTimeScope::Current,
+            valid_at_ms: None,
+        },
+    )))
+}
+
 fn make_request(plan: PhysicalPlan) -> Request {
     Request {
         request_id: RequestId::new(1),
diff --git a/nodedb/src/data/executor/handlers/aggregate/cache_key.rs b/nodedb/src/data/executor/handlers/aggregate/cache_key.rs
index e6b6ab882..1842e0036 100644
--- a/nodedb/src/data/executor/handlers/aggregate/cache_key.rs
+++ b/nodedb/src/data/executor/handlers/aggregate/cache_key.rs
@@ -4,66 +4,98 @@
 
 use nodedb_physical::physical_plan::{AggregateSpec, GroupKeySpec};
 
-/// Serialize group-key specs into a deterministic, distinct cache-key fragment.
-/// Each spec contributes `output_name=field` (empty field for a computed key),
-/// so distinct group-key shapes never collide.
+/// Serialize complete group-key specs into a deterministic structural key.
+/// Computed keys must include their expression; `field` is intentionally empty
+/// for those keys and is not sufficient cache identity.
 fn group_specs_key(group_by: &[GroupKeySpec]) -> String {
     group_by
         .iter()
-        .map(|spec| {
+        .map(|spec| match zerompk::to_msgpack_vec(spec) {
+            Ok(bytes) => bytes.iter().map(|byte| format!("{byte:02x}")).collect(),
+            Err(_) => format!("{spec:?}"),
+        })
+        .collect::<Vec<_>>()
+        .join(",")
+}
+
+fn expression_key(expr: &nodedb_query::expr::SqlExpr) -> String {
+    match zerompk::to_msgpack_vec(expr) {
+        Ok(bytes) => bytes.iter().map(|byte| format!("{byte:02x}")).collect(),
+        Err(_) => format!("{expr:?}"),
+    }
+}
+
+fn aggregate_specs_key(aggregates: &[AggregateSpec]) -> String {
+    aggregates
+        .iter()
+        .map(|agg| {
+            let input = agg
+                .expr
+                .as_ref()
+                .map(expression_key)
+                .unwrap_or_else(|| agg.field.clone());
             format!(
-                "{}={}",
-                spec.output_name,
-                spec.field.as_deref().unwrap_or("")
+                "{}({})->{}=>{}",
+                agg.function,
+                input,
+                agg.alias,
+                agg.user_alias.as_deref().unwrap_or(&agg.alias)
             )
         })
         .collect::<Vec<_>>()
         .join(",")
 }
 
+/// Complete query shape that constitutes an aggregate result's cache identity.
+/// Every field participates in the key — two aggregate queries that differ in
+/// any one of them (output aliases, `LIMIT`, `ORDER BY`, sub-aggregation) must
+/// not collide on a shared cache entry.
+pub(super) struct AggregateCacheKeyInputs<'a> {
+    pub database_id: u64,
+    pub tid: u64,
+    pub collection: &'a str,
+    pub group_by: &'a [GroupKeySpec],
+    pub aggregates: &'a [AggregateSpec],
+    pub sub_group_by: &'a [String],
+    pub sub_aggregates: &'a [AggregateSpec],
+    pub limit: usize,
+    pub sort_keys: &'a [(String, bool)],
+}
+
 pub(super) fn aggregate_cache_key(
-    database_id: u64,
-    tid: u64,
-    collection: &str,
-    group_by: &[GroupKeySpec],
-    aggregates: &[AggregateSpec],
-    sub_group_by: &[String],
-    sub_aggregates: &[AggregateSpec],
+    inputs: AggregateCacheKeyInputs<'_>,
 ) -> (crate::types::DatabaseId, crate::types::TenantId, String) {
     use std::fmt::Write;
+    let AggregateCacheKeyInputs {
+        database_id,
+        tid,
+        collection,
+        group_by,
+        aggregates,
+        sub_group_by,
+        sub_aggregates,
+        limit,
+        sort_keys,
+    } = inputs;
     let mut rest = format!(
         "{collection}\0{}\0{}",
         group_specs_key(group_by),
-        aggregates
-            .iter()
-            .map(|agg| {
-                if agg.expr.is_some() {
-                    format!("{}(expr)->{}", agg.function, agg.alias)
-                } else {
-                    format!("{}({})->{}", agg.function, agg.field, agg.alias)
-                }
-            })
-            .collect::<Vec<_>>()
-            .join(",")
+        aggregate_specs_key(aggregates)
     );
     if !sub_group_by.is_empty() || !sub_aggregates.is_empty() {
         let _ = write!(
             rest,
             "\0sub:{}\0{}",
             sub_group_by.join(","),
-            sub_aggregates
-                .iter()
-                .map(|agg| {
-                    if agg.expr.is_some() {
-                        format!("{}(expr)->{}", agg.function, agg.alias)
-                    } else {
-                        format!("{}({})->{}", agg.function, agg.field, agg.alias)
-                    }
-                })
-                .collect::<Vec<_>>()
-                .join(",")
+            aggregate_specs_key(sub_aggregates)
         );
     }
+    let sort = sort_keys
+        .iter()
+        .map(|(field, ascending)| format!("{field}:{}", u8::from(*ascending)))
+        .collect::<Vec<_>>()
+        .join(",");
+    let _ = write!(rest, "\0limit:{limit}\0sort:{sort}");
     (
         crate::types::DatabaseId::new(database_id),
         crate::types::TenantId::new(tid),
diff --git a/nodedb/src/data/executor/handlers/aggregate/exec.rs b/nodedb/src/data/executor/handlers/aggregate/exec.rs
index 340068b44..d72b4e53a 100644
--- a/nodedb/src/data/executor/handlers/aggregate/exec.rs
+++ b/nodedb/src/data/executor/handlers/aggregate/exec.rs
@@ -6,7 +6,7 @@
 
 use tracing::debug;
 
-use super::cache_key::{aggregate_cache_key, legacy_aggregate_pairs};
+use super::cache_key::{AggregateCacheKeyInputs, aggregate_cache_key, legacy_aggregate_pairs};
 use super::rows::{apply_user_aliases_to_rows, sort_aggregated_rows};
 use crate::bridge::envelope::{ErrorCode, Response};
 use crate::bridge::scan_filter::ScanFilter;
@@ -119,15 +119,17 @@ impl CoreLoop {
 
         // Fast path: incremental aggregate cache.
         if filters.is_empty() && having.is_empty() {
-            let cache_key = aggregate_cache_key(
-                task.request.database_id.as_u64(),
+            let cache_key = aggregate_cache_key(AggregateCacheKeyInputs {
+                database_id: task.request.database_id.as_u64(),
                 tid,
                 collection,
                 group_by,
                 aggregates,
                 sub_group_by,
                 sub_aggregates,
-            );
+                limit,
+                sort_keys,
+            });
             if let Some(cached) = self.aggregate_cache.get(&cache_key) {
                 debug!(core = self.core_id, %collection, "aggregate cache hit");
                 return self.response_with_payload(task, cached.clone());
@@ -271,15 +273,17 @@ impl CoreLoop {
                 ) {
                     Ok(payload) => {
                         if filters.is_empty() && having.is_empty() {
-                            let cache_key = aggregate_cache_key(
-                                task.request.database_id.as_u64(),
+                            let cache_key = aggregate_cache_key(AggregateCacheKeyInputs {
+                                database_id: task.request.database_id.as_u64(),
                                 tid,
                                 collection,
                                 group_by,
                                 aggregates,
                                 sub_group_by,
                                 sub_aggregates,
-                            );
+                                limit,
+                                sort_keys,
+                            });
                             if self.aggregate_cache.len() < 256 {
                                 self.aggregate_cache.insert(cache_key, payload.clone());
                             }
diff --git a/nodedb/src/data/executor/handlers/aggregate/streaming/over_docs.rs b/nodedb/src/data/executor/handlers/aggregate/streaming/over_docs.rs
index 3a908d517..fed6151cb 100644
--- a/nodedb/src/data/executor/handlers/aggregate/streaming/over_docs.rs
+++ b/nodedb/src/data/executor/handlers/aggregate/streaming/over_docs.rs
@@ -3,7 +3,7 @@
 //! `aggregate_over_docs`: orchestrate accumulate + finalize over an
 //! already-materialized doc set, layering the per-shard result cache on top.
 
-use super::super::cache_key::aggregate_cache_key;
+use super::super::cache_key::{AggregateCacheKeyInputs, aggregate_cache_key};
 use crate::bridge::envelope::{ErrorCode, Response};
 use crate::data::executor::core_loop::CoreLoop;
 use crate::data::executor::task::ExecutionTask;
@@ -104,15 +104,17 @@ impl CoreLoop {
                     && filters.is_empty()
                     && having.is_empty()
                 {
-                    let cache_key = aggregate_cache_key(
-                        task.request.database_id.as_u64(),
+                    let cache_key = aggregate_cache_key(AggregateCacheKeyInputs {
+                        database_id: task.request.database_id.as_u64(),
                         tid,
                         collection,
                         group_by,
                         aggregates,
                         sub_group_by,
                         sub_aggregates,
-                    );
+                        limit,
+                        sort_keys,
+                    });
                     if self.aggregate_cache.len() < 256 {
                         self.aggregate_cache.insert(cache_key, payload.clone());
                     }
diff --git a/nodedb/src/data/executor/handlers/control/calvin.rs b/nodedb/src/data/executor/handlers/control/calvin.rs
index 63d60895f..d977eaec8 100644
--- a/nodedb/src/data/executor/handlers/control/calvin.rs
+++ b/nodedb/src/data/executor/handlers/control/calvin.rs
@@ -180,15 +180,14 @@ impl CoreLoop {
         // base install below reuses the exact stamp the redo carries rather than
         // minting a fresh one. Empty when this transaction wrote no bitemporal
         // document rows or resolve never ran.
-        let bitemporal_stamps: Vec<(u32, BitemporalStamp)> =
-            match calvin_synthetic_txn_id(epoch, position, vshard_id) {
-                Ok(synthetic) => self
-                    .txn_overlays
-                    .get(&synthetic)
-                    .map(|overlay| overlay.all_bitemporal_stamps().collect())
-                    .unwrap_or_default(),
-                Err(_) => Vec::new(),
-            };
+        let synthetic_txn_id = calvin_synthetic_txn_id(epoch, position, vshard_id).ok();
+        let bitemporal_stamps: Vec<(u32, BitemporalStamp)> = synthetic_txn_id
+            .and_then(|synthetic| self.txn_overlays.get(&synthetic))
+            .map(|overlay| overlay.all_bitemporal_stamps().collect())
+            .unwrap_or_default();
+        let graph_system_from = synthetic_txn_id
+            .and_then(|synthetic| self.graph_txn_overlays.get(&synthetic))
+            .and_then(|overlay| overlay.resolved_system_from());
         // Drop the synthetic overlay entry staged by
         // `execute_calvin_execute_static` unconditionally, before the apply
         // below: idempotent no-op on a duplicate dispatch.
@@ -224,6 +223,7 @@ impl CoreLoop {
         for (surrogate, stamp) in bitemporal_stamps {
             self.active_bitemporal_stamps.insert(surrogate, stamp);
         }
+        self.active_graph_system_from = graph_system_from;
         // The read-set was already validated at stage time and drives the
         // flush/drop decision; the replay itself carries no read-set to re-check.
         // Scope the flush key so `record_batch_index_write_values` stages this
diff --git a/nodedb/src/data/executor/handlers/graph.rs b/nodedb/src/data/executor/handlers/graph.rs
index 6f36a8faf..d349c049e 100644
--- a/nodedb/src/data/executor/handlers/graph.rs
+++ b/nodedb/src/data/executor/handlers/graph.rs
@@ -33,7 +33,7 @@ pub(in crate::data::executor) mod graph_traversal;
 #[path = "graph_txn_merge.rs"]
 pub(in crate::data::executor) mod graph_txn_merge;
 
-pub(in crate::data::executor) use graph_edge_write::EdgePutParams;
+pub(in crate::data::executor) use graph_edge_write::{EdgeDeleteParams, EdgePutParams};
 
 use graph_txn_merge::merge_graph_txn_overlay_neighbors;
 
diff --git a/nodedb/src/data/executor/handlers/graph_edge_write.rs b/nodedb/src/data/executor/handlers/graph_edge_write.rs
index 9411c433b..afe6926f9 100644
--- a/nodedb/src/data/executor/handlers/graph_edge_write.rs
+++ b/nodedb/src/data/executor/handlers/graph_edge_write.rs
@@ -10,7 +10,17 @@ use tracing::debug;
 use crate::bridge::envelope::{ErrorCode, Response};
 use crate::data::executor::core_loop::CoreLoop;
 use crate::data::executor::task::ExecutionTask;
-use crate::types::TenantId;
+use crate::types::{TenantId, VShardId};
+
+/// Dual-homed edges are physically present on both endpoint homes. The source
+/// home is the canonical owner of logical graph cardinality, so only that
+/// participant updates persistent stats counters.
+pub(in crate::data::executor) fn owns_logical_edge_stats(
+    task: &ExecutionTask,
+    src_id: &str,
+) -> bool {
+    task.request.vshard_id == VShardId::from_key(src_id.as_bytes())
+}
 
 /// Bundled arguments for [`CoreLoop::execute_edge_put`].
 pub(in crate::data::executor) struct EdgePutParams<'a> {
@@ -24,11 +34,38 @@ pub(in crate::data::executor) struct EdgePutParams<'a> {
     pub dst_surrogate: nodedb_types::Surrogate,
 }
 
+/// Bundled arguments for [`CoreLoop::execute_edge_delete`].
+pub(in crate::data::executor) struct EdgeDeleteParams<'a> {
+    pub tid: u64,
+    pub collection: &'a str,
+    pub src_id: &'a str,
+    pub label: &'a str,
+    pub dst_id: &'a str,
+}
+
 impl CoreLoop {
     pub(in crate::data::executor) fn execute_edge_put(
         &mut self,
         task: &ExecutionTask,
         params: EdgePutParams<'_>,
+    ) -> Response {
+        self.execute_edge_put_with_undo(task, params, None)
+    }
+
+    /// Edge upsert with optional transactional compensation.
+    ///
+    /// When `undo` is `Some`, the `UndoEntry::PutEdge` is recorded at the one
+    /// correct point: *after* the edge-store version is durably written and
+    /// *before* the fallible CSR mutation. Recording it earlier (before the
+    /// dangling-endpoint validation or the edge-store write) would leave a
+    /// compensation entry for an operation that never touched storage — on
+    /// rollback that entry would soft-delete or re-insert a version that never
+    /// existed, corrupting bitemporal edge history.
+    pub(in crate::data::executor) fn execute_edge_put_with_undo(
+        &mut self,
+        task: &ExecutionTask,
+        params: EdgePutParams<'_>,
+        undo: Option<&mut Vec<crate::data::executor::handlers::transaction::undo::UndoEntry>>,
     ) -> Response {
         let EdgePutParams {
             tid,
@@ -60,7 +97,26 @@ impl CoreLoop {
             );
         }
 
-        let ord = self.hlc.next_ordinal();
+        // Capture the pre-image only when a compensation record is requested.
+        let old_properties = if undo.is_some() {
+            self.edge_store
+                .get_edge(
+                    database_id,
+                    TenantId::new(tid),
+                    collection,
+                    src_id,
+                    label,
+                    dst_id,
+                )
+                .ok()
+                .flatten()
+        } else {
+            None
+        };
+
+        let ord = self
+            .active_graph_system_from
+            .unwrap_or_else(|| self.hlc.next_ordinal());
         // Under a Calvin batch, `epoch_system_ms` is the deterministic epoch
         // timestamp; outside Calvin (every path today — no Calvin edge writes
         // yet) it is None and we fall back to the HLC-derived wall time,
@@ -70,7 +126,7 @@ impl CoreLoop {
             None => nodedb_types::ordinal_to_ms(ord),
         };
         use crate::engine::graph::edge_store::EdgeRef;
-        match self.edge_store.put_edge_versioned(
+        match self.edge_store.put_edge_versioned_with_stats(
             EdgeRef::new(
                 task.request.database_id,
                 TenantId::new(tid),
@@ -83,8 +139,22 @@ impl CoreLoop {
             ord,
             valid_from_ms,
             i64::MAX,
+            owns_logical_edge_stats(task, src_id),
         ) {
             Ok(()) => {
+                // Edge-store version is now durable; the compensation entry is
+                // valid from here on even if the CSR mutation below fails.
+                if let Some(undo) = undo {
+                    undo.push(
+                        crate::data::executor::handlers::transaction::undo::UndoEntry::PutEdge {
+                            collection: collection.to_string(),
+                            src_id: src_id.to_string(),
+                            label: label.to_string(),
+                            dst_id: dst_id.to_string(),
+                            old_properties,
+                        },
+                    );
+                }
                 let weight = crate::engine::graph::csr::extract_weight_from_properties(properties);
                 let partition = self.csr_partition_mut(database_id, tid);
                 let csr_result = if weight != 1.0 {
@@ -160,10 +230,12 @@ impl CoreLoop {
                     },
                 );
             }
-            let ord = self.hlc.next_ordinal();
+            let ord = self
+                .active_graph_system_from
+                .unwrap_or_else(|| self.hlc.next_ordinal());
             let valid_from_ms = nodedb_types::ordinal_to_ms(ord);
             use crate::engine::graph::edge_store::EdgeRef;
-            match self.edge_store.put_edge_versioned(
+            match self.edge_store.put_edge_versioned_with_stats(
                 EdgeRef::new(
                     task.request.database_id,
                     TenantId::new(tid),
@@ -176,6 +248,7 @@ impl CoreLoop {
                 ord,
                 valid_from_ms,
                 i64::MAX,
+                owns_logical_edge_stats(task, &edge.src_id),
             ) {
                 Ok(()) => {
                     let partition = self.csr_partition_mut(database_id, tid);
@@ -250,9 +323,11 @@ impl CoreLoop {
         );
         let database_id = task.request.database_id.as_u64();
         for edge in edges {
-            let ord = self.hlc.next_ordinal();
+            let ord = self
+                .active_graph_system_from
+                .unwrap_or_else(|| self.hlc.next_ordinal());
             use crate::engine::graph::edge_store::EdgeRef;
-            let _ = self.edge_store.soft_delete_edge(
+            let _ = self.edge_store.soft_delete_edge_with_stats(
                 EdgeRef::new(
                     task.request.database_id,
                     TenantId::new(tid),
@@ -262,6 +337,7 @@ impl CoreLoop {
                     &edge.dst_id,
                 ),
                 ord,
+                owns_logical_edge_stats(task, &edge.src_id),
             );
             let partition = self.csr_partition_mut(database_id, tid);
             partition.remove_edge_in_collection(
@@ -309,11 +385,63 @@ impl CoreLoop {
         label: &str,
         dst_id: &str,
     ) -> Response {
+        self.execute_edge_delete_with_undo(
+            task,
+            EdgeDeleteParams {
+                tid,
+                collection,
+                src_id,
+                label,
+                dst_id,
+            },
+            None,
+        )
+    }
+
+    /// Edge delete with optional transactional compensation.
+    ///
+    /// The `UndoEntry::DeleteEdge` is recorded only when a live pre-image
+    /// existed *and* the tombstone was durably written — never speculatively
+    /// before the write. A phantom entry would otherwise re-insert an edge that
+    /// was never deleted when the surrounding transaction rolls back.
+    pub(in crate::data::executor) fn execute_edge_delete_with_undo(
+        &mut self,
+        task: &ExecutionTask,
+        params: EdgeDeleteParams<'_>,
+        undo: Option<&mut Vec<crate::data::executor::handlers::transaction::undo::UndoEntry>>,
+    ) -> Response {
+        let EdgeDeleteParams {
+            tid,
+            collection,
+            src_id,
+            label,
+            dst_id,
+        } = params;
         debug!(core = self.core_id, tid, %collection, %src_id, %label, %dst_id, "edge delete");
         let database_id = task.request.database_id.as_u64();
-        let ord = self.hlc.next_ordinal();
+
+        // Capture the pre-image only when a compensation record is requested.
+        let old_properties = if undo.is_some() {
+            self.edge_store
+                .get_edge(
+                    database_id,
+                    TenantId::new(tid),
+                    collection,
+                    src_id,
+                    label,
+                    dst_id,
+                )
+                .ok()
+                .flatten()
+        } else {
+            None
+        };
+
+        let ord = self
+            .active_graph_system_from
+            .unwrap_or_else(|| self.hlc.next_ordinal());
         use crate::engine::graph::edge_store::EdgeRef;
-        match self.edge_store.soft_delete_edge(
+        match self.edge_store.soft_delete_edge_with_stats(
             EdgeRef::new(
                 task.request.database_id,
                 TenantId::new(tid),
@@ -323,8 +451,21 @@ impl CoreLoop {
                 dst_id,
             ),
             ord,
+            owns_logical_edge_stats(task, src_id),
         ) {
             Ok(_) => {
+                // Tombstone is durable; record the compensation for a rollback.
+                if let (Some(undo), Some(props)) = (undo, old_properties) {
+                    undo.push(
+                        crate::data::executor::handlers::transaction::undo::UndoEntry::DeleteEdge {
+                            collection: collection.to_string(),
+                            src_id: src_id.to_string(),
+                            label: label.to_string(),
+                            dst_id: dst_id.to_string(),
+                            old_properties: props,
+                        },
+                    );
+                }
                 let partition = self.csr_partition_mut(database_id, tid);
                 partition.remove_edge_in_collection(src_id, label, dst_id, collection);
                 self.checkpoint_coordinator.mark_dirty("sparse", 1);
diff --git a/nodedb/src/data/executor/handlers/graph_stats.rs b/nodedb/src/data/executor/handlers/graph_stats.rs
index c32c113b5..481aaa0ea 100644
--- a/nodedb/src/data/executor/handlers/graph_stats.rs
+++ b/nodedb/src/data/executor/handlers/graph_stats.rs
@@ -18,9 +18,16 @@ impl CoreLoop {
         task: &ExecutionTask,
         tid: u64,
         collection: Option<&str>,
-        as_of: Option<i64>,
+        as_of_ms: Option<i64>,
     ) -> Response {
-        debug!(core = self.core_id, tid, ?collection, ?as_of, "graph stats");
+        debug!(
+            core = self.core_id,
+            tid,
+            ?collection,
+            ?as_of_ms,
+            "graph stats"
+        );
+        let as_of = as_of_ms.map(nodedb_types::ms_to_ordinal_upper);
         let database_id = task.request.database_id.as_u64();
         let tenant = TenantId::new(tid);
         let result: Vec<CollectionStats> = match collection {
diff --git a/nodedb/src/data/executor/handlers/transaction/batch.rs b/nodedb/src/data/executor/handlers/transaction/batch.rs
index a8b0b9010..60cbf9d85 100644
--- a/nodedb/src/data/executor/handlers/transaction/batch.rs
+++ b/nodedb/src/data/executor/handlers/transaction/batch.rs
@@ -66,9 +66,14 @@ impl CoreLoop {
         // it is cleared the moment `run_sub_plans` returns (any path).
         if let Some(txn_id) = txn_id {
             self.load_bitemporal_stamps_for_txn(txn_id);
+            self.active_graph_system_from = self
+                .graph_txn_overlays
+                .get(&txn_id)
+                .and_then(|overlay| overlay.resolved_system_from());
         }
         let sub = self.run_sub_plans(task, tid, plans, undo_log, crdt_deltas);
         self.active_bitemporal_stamps.clear();
+        self.active_graph_system_from = None;
         let (last_response, undo_log, crdt_deltas) = match sub {
             Ok(v) => v,
             Err(resp) => return resp,
@@ -152,7 +157,8 @@ impl CoreLoop {
         for (i, plan) in plans.iter().enumerate() {
             let user_roles = &task.request.user_roles;
             let outcome = catch_unwind(AssertUnwindSafe(|| {
-                let r = self.execute_tx_sub_plan(
+                let r = self.execute_tx_sub_plan_from_batch(
+                    task,
                     tid,
                     plan,
                     &mut undo_log,
@@ -193,9 +199,10 @@ impl CoreLoop {
                     // Roll back all previous writes in reverse order.
                     // If rollback itself fails, the shard state is unknown —
                     // return RollbackFailed (never warn-and-continue).
-                    let rollback_error_code = match self.rollback_undo_log(
-                        crate::types::DatabaseId::DEFAULT.as_u64(),
+                    let rollback_error_code = match self.rollback_undo_log_at(
+                        task.request.database_id.as_u64(),
                         tid,
+                        task.request.vshard_id,
                         undo_log,
                     ) {
                         Ok(()) => error_code,
@@ -255,9 +262,10 @@ impl CoreLoop {
                 "BALANCED constraint violated, rolling back {} operations",
                 undo_log.len()
             );
-            let rollback_error_code = match self.rollback_undo_log(
-                crate::types::DatabaseId::DEFAULT.as_u64(),
+            let rollback_error_code = match self.rollback_undo_log_at(
+                task.request.database_id.as_u64(),
                 tid,
+                task.request.vshard_id,
                 undo_log,
             ) {
                 Ok(()) => error_code,
diff --git a/nodedb/src/data/executor/handlers/transaction/overlay/graph_staged/txn_overlay.rs b/nodedb/src/data/executor/handlers/transaction/overlay/graph_staged/txn_overlay.rs
index 74204147f..913942d86 100644
--- a/nodedb/src/data/executor/handlers/transaction/overlay/graph_staged/txn_overlay.rs
+++ b/nodedb/src/data/executor/handlers/transaction/overlay/graph_staged/txn_overlay.rs
@@ -79,6 +79,9 @@ pub struct GraphTxnOverlay {
     /// the transaction alive). `Cell` for the same single-threaded `!Send`
     /// interior-mutability reason.
     last_touch_ord: Cell<i64>,
+    /// Frozen system-time ordinal used by both live transaction apply and WAL
+    /// redo. Separate from lease liveness so refreshes cannot change history.
+    resolved_system_from_ord: Cell<i64>,
 }
 
 impl GraphTxnOverlay {
@@ -97,6 +100,23 @@ impl GraphTxnOverlay {
         self.last_touch_ord.get()
     }
 
+    /// Freeze the graph transaction's system-time ordinal on first resolve.
+    /// Retries return the same value byte-for-byte.
+    pub fn freeze_system_from(&self, candidate: i64) -> i64 {
+        let frozen = self.resolved_system_from_ord.get();
+        if frozen != 0 {
+            frozen
+        } else {
+            self.resolved_system_from_ord.set(candidate);
+            candidate
+        }
+    }
+
+    pub fn resolved_system_from(&self) -> Option<i64> {
+        let value = self.resolved_system_from_ord.get();
+        (value != 0).then_some(value)
+    }
+
     /// Record an edge identity's prior state across BOTH edge sets before a
     /// staged edge mutation overwrites it. Single chokepoint shared by
     /// `stage_edge_put` and `stage_edge_delete` (and the batch forms, which
diff --git a/nodedb/src/data/executor/handlers/transaction/resolve/entry.rs b/nodedb/src/data/executor/handlers/transaction/resolve/entry.rs
index 580f920cd..2dc3540a3 100644
--- a/nodedb/src/data/executor/handlers/transaction/resolve/entry.rs
+++ b/nodedb/src/data/executor/handlers/transaction/resolve/entry.rs
@@ -240,6 +240,9 @@ impl CoreLoop {
             }
         }
         if let Some(graph_overlay) = self.graph_txn_overlays.get(&txn_id) {
+            // Freeze temporal identity independently from the overlay's lease
+            // refresh stamp. Resolve retries reuse the exact same ordinal.
+            let graph_system_from = graph_overlay.freeze_system_from(self.hlc.next_ordinal());
             for collection in &graph_collections {
                 let coll_key = (
                     task.request.database_id,
@@ -251,6 +254,7 @@ impl CoreLoop {
                     &coll_key,
                     collection,
                     &edge_surrogates,
+                    graph_system_from,
                     &mut ops,
                 )?;
             }
@@ -1814,18 +1818,25 @@ mod tests {
         assert_eq!(redo.ops.len(), 1, "one staged edge put -> one sub-record");
         assert_eq!(redo.ops[0].record_type, RecordType::Put as u32);
 
-        let (collection, src_id, label, dst_id, properties, src_sur, dst_sur) =
-            zerompk::from_msgpack::<(String, String, String, String, Vec<u8>, u32, u32)>(
-                &redo.ops[0].payload,
-            )
-            .expect("decode edge put tuple");
-        assert_eq!(collection, "g");
-        assert_eq!(src_id, "a");
-        assert_eq!(label, "knows");
-        assert_eq!(dst_id, "b");
-        assert_eq!(properties, vec![9, 9]);
-        assert_eq!(src_sur, 10, "src surrogate must come from the plan node");
-        assert_eq!(dst_sur, 20, "dst surrogate must come from the plan node");
+        let decoded = zerompk::from_msgpack::<crate::wal::EdgePutRedo>(&redo.ops[0].payload)
+            .expect("decode edge put redo");
+        assert_eq!(decoded.collection, "g");
+        assert_eq!(decoded.src_id, "a");
+        assert_eq!(decoded.label, "knows");
+        assert_eq!(decoded.dst_id, "b");
+        assert_eq!(decoded.properties, vec![9, 9]);
+        assert_eq!(
+            decoded.src_surrogate, 10,
+            "src surrogate must come from the plan node"
+        );
+        assert_eq!(
+            decoded.dst_surrogate, 20,
+            "dst surrogate must come from the plan node"
+        );
+        assert!(
+            decoded.system_from.is_some_and(|s| s > 0),
+            "resolve must freeze a real graph system-time ordinal"
+        );
 
         // Replay into a fresh core: the CSR node->surrogate map must be
         // repopulated from the two trailing surrogates.
@@ -1901,16 +1912,23 @@ mod tests {
         assert_eq!(redo.ops.len(), 1);
         assert_eq!(redo.ops[0].record_type, RecordType::Delete as u32);
 
-        let (collection, src_id, label, dst_id) =
-            zerompk::from_msgpack::<(String, String, String, String)>(&redo.ops[0].payload)
-                .expect("decode edge delete tuple");
-        assert_eq!(collection, "g");
-        assert_eq!(src_id, "a");
-        assert_eq!(label, "knows");
-        assert_eq!(dst_id, "b");
-
-        // Seed the edge in a fresh core, then replay the delete removes it.
+        let decoded = zerompk::from_msgpack::<crate::wal::EdgeDeleteRedo>(&redo.ops[0].payload)
+            .expect("decode timestamped edge delete redo");
+        assert_eq!(decoded.collection, "g");
+        assert_eq!(decoded.src_id, "a");
+        assert_eq!(decoded.label, "knows");
+        assert_eq!(decoded.dst_id, "b");
+        assert!(decoded.system_from.is_some_and(|s| s > 0));
+
+        // Seed the pre-existing edge in a fresh core at a system-time ordinal
+        // EARLIER than the delete's frozen `system_from`. In production the
+        // edge's own (earlier) put is replayed before the delete, so the
+        // tombstone is the newer version and hides it; freezing the seed here
+        // reproduces that ordering rather than stamping the seed with a fresh
+        // `next_ordinal` that would (incorrectly) post-date the tombstone.
         let (mut dst_core, _dst_dir) = make_core();
+        dst_core.active_graph_system_from =
+            Some(decoded.system_from.expect("delete froze a system_from") - 1);
         dst_core.execute_edge_put(
             &task,
             EdgePutParams {
@@ -1924,6 +1942,7 @@ mod tests {
                 dst_surrogate: Surrogate::new(2),
             },
         );
+        dst_core.active_graph_system_from = None;
         assert_eq!(
             dst_core
                 .edge_store
diff --git a/nodedb/src/data/executor/handlers/transaction/resolve/graph.rs b/nodedb/src/data/executor/handlers/transaction/resolve/graph.rs
index cc775dd51..c5eb0f20b 100644
--- a/nodedb/src/data/executor/handlers/transaction/resolve/graph.rs
+++ b/nodedb/src/data/executor/handlers/transaction/resolve/graph.rs
@@ -8,12 +8,16 @@
 //! autocommit graph WAL path produces, extended with the two endpoint
 //! surrogates a redo PUT carries and an autocommit PUT does not:
 //!
-//! * A staged edge put → `RecordType::Put`, `(collection, src_id, label,
-//!   dst_id, properties, src_surrogate, dst_surrogate)`. Replay's
-//!   `execute_edge_put` repopulates the CSR node→surrogate map from the two
-//!   trailing surrogates, so they must be present and correct.
-//! * A staged edge tombstone → `RecordType::Delete`, `(collection, src_id,
-//!   label, dst_id)`. `execute_edge_delete` needs no surrogate.
+//! * A staged edge put → `RecordType::Put`, payload
+//!   [`crate::wal::EdgePutRedo`]. Replay's `execute_edge_put` repopulates the
+//!   CSR node→surrogate map from the two endpoint surrogates, so they must be
+//!   present and correct.
+//! * A staged edge tombstone → `RecordType::Delete`, payload
+//!   [`crate::wal::EdgeDeleteRedo`]. `execute_edge_delete` needs no surrogate.
+//!
+//! Both payloads are named structs shared by every encode/decode site (a single
+//! definition, not a positional tuple re-declared per site) so the field set is
+//! a compile-time invariant that cannot silently drift in arity.
 //!
 //! ## Where the endpoint surrogates come from
 //!
@@ -87,6 +91,7 @@ pub(super) fn serialize_graph_collection(
     coll_key: &GraphCollKey,
     collection: &str,
     edge_surrogates: &BTreeMap<EdgeIdentityKey, (u32, u32)>,
+    system_from: i64,
     ops: &mut Vec<RedoSubRecord>,
 ) -> crate::Result<()> {
     let mut puts: BTreeMap<(String, String, String), Vec<u8>> = BTreeMap::new();
@@ -118,15 +123,16 @@ pub(super) fn serialize_graph_collection(
                          has no bound endpoint surrogates"
                 ),
             })?;
-        let payload = zerompk::to_msgpack_vec(&(
-            collection,
-            src.as_str(),
-            label.as_str(),
-            dst.as_str(),
-            properties,
+        let payload = zerompk::to_msgpack_vec(&crate::wal::EdgePutRedo {
+            collection: collection.to_string(),
+            src_id: src.clone(),
+            label: label.clone(),
+            dst_id: dst.clone(),
+            properties: properties.clone(),
             src_surrogate,
             dst_surrogate,
-        ))
+            system_from: Some(system_from),
+        })
         .map_err(|e| crate::Error::Serialization {
             format: "msgpack".into(),
             detail: format!("graph resolve edge put: {e}"),
@@ -138,12 +144,17 @@ pub(super) fn serialize_graph_collection(
     }
 
     for (src, label, dst) in deletes {
-        let payload =
-            zerompk::to_msgpack_vec(&(collection, src.as_str(), label.as_str(), dst.as_str()))
-                .map_err(|e| crate::Error::Serialization {
-                    format: "msgpack".into(),
-                    detail: format!("graph resolve edge delete: {e}"),
-                })?;
+        let payload = zerompk::to_msgpack_vec(&crate::wal::EdgeDeleteRedo {
+            collection: collection.to_string(),
+            src_id: src.clone(),
+            label: label.clone(),
+            dst_id: dst.clone(),
+            system_from: Some(system_from),
+        })
+        .map_err(|e| crate::Error::Serialization {
+            format: "msgpack".into(),
+            detail: format!("graph resolve edge delete: {e}"),
+        })?;
         ops.push(RedoSubRecord {
             record_type: RecordType::Delete as u32,
             payload,
@@ -312,7 +323,7 @@ mod tests {
     }
 
     #[test]
-    fn edge_put_emits_seven_element_tuple_with_surrogates() {
+    fn edge_put_emits_timestamped_tuple_with_surrogates() {
         let mut overlay = GraphTxnOverlay::new();
         overlay.stage_edge_put(coll_key("g"), "a", "knows", "b", vec![1, 2, 3]);
 
@@ -328,23 +339,21 @@ mod tests {
         );
 
         let mut ops = Vec::new();
-        serialize_graph_collection(&overlay, &coll_key("g"), "g", &surrogates, &mut ops)
+        serialize_graph_collection(&overlay, &coll_key("g"), "g", &surrogates, 123, &mut ops)
             .expect("serialize edge put");
         assert_eq!(ops.len(), 1);
         assert_eq!(ops[0].record_type, RecordType::Put as u32);
 
-        let (collection, src, label, dst, properties, src_sur, dst_sur) =
-            zerompk::from_msgpack::<(String, String, String, String, Vec<u8>, u32, u32)>(
-                &ops[0].payload,
-            )
-            .expect("decode edge put tuple");
-        assert_eq!(collection, "g");
-        assert_eq!(src, "a");
-        assert_eq!(label, "knows");
-        assert_eq!(dst, "b");
-        assert_eq!(properties, vec![1, 2, 3]);
-        assert_eq!(src_sur, 10);
-        assert_eq!(dst_sur, 20);
+        let decoded = zerompk::from_msgpack::<crate::wal::EdgePutRedo>(&ops[0].payload)
+            .expect("decode edge put redo");
+        assert_eq!(decoded.collection, "g");
+        assert_eq!(decoded.src_id, "a");
+        assert_eq!(decoded.label, "knows");
+        assert_eq!(decoded.dst_id, "b");
+        assert_eq!(decoded.properties, vec![1, 2, 3]);
+        assert_eq!(decoded.src_surrogate, 10);
+        assert_eq!(decoded.dst_surrogate, 20);
+        assert_eq!(decoded.system_from, Some(123));
     }
 
     #[test]
@@ -355,7 +364,7 @@ mod tests {
         let surrogates = BTreeMap::new();
         let mut ops = Vec::new();
         let result =
-            serialize_graph_collection(&overlay, &coll_key("g"), "g", &surrogates, &mut ops);
+            serialize_graph_collection(&overlay, &coll_key("g"), "g", &surrogates, 123, &mut ops);
         assert!(
             result.is_err(),
             "a staged put with no matching plan-carried surrogates must error, not invent one"
@@ -363,24 +372,28 @@ mod tests {
     }
 
     #[test]
-    fn edge_delete_emits_four_element_tuple() {
+    fn edge_delete_emits_timestamped_redo() {
         let mut overlay = GraphTxnOverlay::new();
         overlay.stage_edge_delete(coll_key("g"), "a", "knows", "b");
 
         let surrogates = BTreeMap::new();
         let mut ops = Vec::new();
-        serialize_graph_collection(&overlay, &coll_key("g"), "g", &surrogates, &mut ops)
+        serialize_graph_collection(&overlay, &coll_key("g"), "g", &surrogates, 123, &mut ops)
             .expect("serialize edge delete");
         assert_eq!(ops.len(), 1);
         assert_eq!(ops[0].record_type, RecordType::Delete as u32);
 
-        let (collection, src, label, dst) =
-            zerompk::from_msgpack::<(String, String, String, String)>(&ops[0].payload)
-                .expect("decode edge delete tuple");
-        assert_eq!(collection, "g");
-        assert_eq!(src, "a");
-        assert_eq!(label, "knows");
-        assert_eq!(dst, "b");
+        let decoded = zerompk::from_msgpack::<crate::wal::EdgeDeleteRedo>(&ops[0].payload)
+            .expect("decode edge delete redo");
+        assert_eq!(decoded.collection, "g");
+        assert_eq!(decoded.src_id, "a");
+        assert_eq!(decoded.label, "knows");
+        assert_eq!(decoded.dst_id, "b");
+        assert_eq!(
+            decoded.system_from,
+            Some(123),
+            "delete must carry the frozen system-time ordinal for deterministic replay"
+        );
     }
 
     #[test]
@@ -404,16 +417,14 @@ mod tests {
         }
 
         let mut ops = Vec::new();
-        serialize_graph_collection(&overlay, &coll_key("g"), "g", &surrogates, &mut ops)
+        serialize_graph_collection(&overlay, &coll_key("g"), "g", &surrogates, 123, &mut ops)
             .expect("serialize");
         let srcs: Vec<String> = ops
             .iter()
             .map(|op| {
-                zerompk::from_msgpack::<(String, String, String, String, Vec<u8>, u32, u32)>(
-                    &op.payload,
-                )
-                .expect("decode")
-                .1
+                zerompk::from_msgpack::<crate::wal::EdgePutRedo>(&op.payload)
+                    .expect("decode")
+                    .src_id
             })
             .collect();
         assert_eq!(srcs, vec!["a", "b", "c"], "src-id ascending order");
diff --git a/nodedb/src/data/executor/handlers/transaction/sub_plan.rs b/nodedb/src/data/executor/handlers/transaction/sub_plan.rs
index f465d9f74..9bd3bbcbf 100644
--- a/nodedb/src/data/executor/handlers/transaction/sub_plan.rs
+++ b/nodedb/src/data/executor/handlers/transaction/sub_plan.rs
@@ -28,6 +28,7 @@ impl CoreLoop {
     /// Each helper handles that engine's write sub-ops (pushing an
     /// `UndoEntry`) and routes every other sub-op through the standard
     /// read-only / DDL dispatch path.
+    #[cfg(test)]
     pub(super) fn execute_tx_sub_plan(
         &mut self,
         tid: u64,
@@ -36,21 +37,50 @@ impl CoreLoop {
         crdt_deltas: &mut Vec<(Vec<u8>, u64, String)>,
         user_roles: &[String],
     ) -> Result<Response, ErrorCode> {
-        let dummy_task = Self::build_dummy_task(tid);
+        let task = Self::build_dummy_task(tid);
+        self.execute_tx_sub_plan_with_task(&task, tid, plan, undo_log, crdt_deltas, user_roles)
+    }
 
+    /// Replay a sub-plan with the parent batch's database and vShard identity.
+    /// Calvin executes the same logical batch on each participant, so erasing
+    /// this routing identity makes every replica appear to be vShard zero and
+    /// breaks canonical-owner side effects such as graph statistics.
+    pub(super) fn execute_tx_sub_plan_from_batch(
+        &mut self,
+        parent: &ExecutionTask,
+        tid: u64,
+        plan: &PhysicalPlan,
+        undo_log: &mut Vec<UndoEntry>,
+        crdt_deltas: &mut Vec<(Vec<u8>, u64, String)>,
+        user_roles: &[String],
+    ) -> Result<Response, ErrorCode> {
+        let task =
+            Self::build_dummy_task_at(tid, parent.request.database_id, parent.request.vshard_id);
+        self.execute_tx_sub_plan_with_task(&task, tid, plan, undo_log, crdt_deltas, user_roles)
+    }
+
+    fn execute_tx_sub_plan_with_task(
+        &mut self,
+        dummy_task: &ExecutionTask,
+        tid: u64,
+        plan: &PhysicalPlan,
+        undo_log: &mut Vec<UndoEntry>,
+        crdt_deltas: &mut Vec<(Vec<u8>, u64, String)>,
+        user_roles: &[String],
+    ) -> Result<Response, ErrorCode> {
         match plan {
             PhysicalPlan::Document(op) => {
-                self.exec_tx_document(&dummy_task, tid, plan, op, user_roles, undo_log)
+                self.exec_tx_document(dummy_task, tid, plan, op, user_roles, undo_log)
             }
-            PhysicalPlan::Vector(op) => self.exec_tx_vector(&dummy_task, tid, plan, op, undo_log),
-            PhysicalPlan::Graph(op) => self.exec_tx_graph(&dummy_task, tid, plan, op, undo_log),
-            PhysicalPlan::Crdt(op) => self.exec_tx_crdt(&dummy_task, tid, plan, op, crdt_deltas),
-            PhysicalPlan::Kv(kv_op) => self.execute_tx_kv(&dummy_task, tid, kv_op, undo_log),
+            PhysicalPlan::Vector(op) => self.exec_tx_vector(dummy_task, tid, plan, op, undo_log),
+            PhysicalPlan::Graph(op) => self.exec_tx_graph(dummy_task, tid, plan, op, undo_log),
+            PhysicalPlan::Crdt(op) => self.exec_tx_crdt(dummy_task, tid, plan, op, crdt_deltas),
+            PhysicalPlan::Kv(kv_op) => self.execute_tx_kv(dummy_task, tid, kv_op, undo_log),
             PhysicalPlan::Columnar(op) => {
-                self.exec_tx_columnar(&dummy_task, tid, plan, op, undo_log)
+                self.exec_tx_columnar(dummy_task, tid, plan, op, undo_log)
             }
             PhysicalPlan::Timeseries(op) => {
-                self.exec_tx_timeseries(&dummy_task, tid, plan, op, undo_log)
+                self.exec_tx_timeseries(dummy_task, tid, plan, op, undo_log)
             }
             PhysicalPlan::Spatial(_)
             | PhysicalPlan::Text(_)
@@ -66,12 +96,21 @@ impl CoreLoop {
     /// no-determinism: the deadline is ephemeral, not written to WAL. The
     /// placeholder `plan` (a no-op `Meta::Cancel`) is never executed; it
     /// only carries request metadata for response building.
+    #[cfg(test)]
     pub(super) fn build_dummy_task(tid: u64) -> ExecutionTask {
+        Self::build_dummy_task_at(tid, DatabaseId::DEFAULT, crate::types::VShardId::new(0))
+    }
+
+    fn build_dummy_task_at(
+        tid: u64,
+        database_id: DatabaseId,
+        vshard_id: crate::types::VShardId,
+    ) -> ExecutionTask {
         ExecutionTask::new(crate::bridge::envelope::Request {
             request_id: crate::types::RequestId::new(0),
             tenant_id: TenantId::new(tid),
-            database_id: DatabaseId::DEFAULT,
-            vshard_id: crate::types::VShardId::new(0),
+            database_id,
+            vshard_id,
             plan: PhysicalPlan::Meta(MetaOp::Cancel {
                 target_request_id: crate::types::RequestId::new(0),
             }),
@@ -260,6 +299,45 @@ impl CoreLoop {
                 undo_log,
             ),
 
+            GraphOp::EdgePutBatch { edges } => {
+                let mut response = self.response_ok(dummy_task);
+                for edge in edges {
+                    response = self.exec_tx_edge_put(
+                        dummy_task,
+                        tid,
+                        TxEdgePutParams {
+                            collection: &edge.collection,
+                            src_id: &edge.src_id,
+                            label: &edge.label,
+                            dst_id: &edge.dst_id,
+                            properties: &[],
+                            src_surrogate: edge.src_surrogate,
+                            dst_surrogate: edge.dst_surrogate,
+                        },
+                        undo_log,
+                    )?;
+                }
+                Ok(response)
+            }
+
+            GraphOp::EdgeDeleteBatch { edges } => {
+                let mut response = self.response_ok(dummy_task);
+                for edge in edges {
+                    response = self.exec_tx_edge_delete(
+                        dummy_task,
+                        tid,
+                        TxEdgeDeleteParams {
+                            collection: &edge.collection,
+                            src_id: &edge.src_id,
+                            label: &edge.label,
+                            dst_id: &edge.dst_id,
+                        },
+                        undo_log,
+                    )?;
+                }
+                Ok(response)
+            }
+
             _ => self.exec_tx_passthrough(tid, plan),
         }
     }
diff --git a/nodedb/src/data/executor/handlers/transaction/sub_plan_write.rs b/nodedb/src/data/executor/handlers/transaction/sub_plan_write.rs
index bcf0dc1b4..a2ade7936 100644
--- a/nodedb/src/data/executor/handlers/transaction/sub_plan_write.rs
+++ b/nodedb/src/data/executor/handlers/transaction/sub_plan_write.rs
@@ -155,20 +155,13 @@ impl CoreLoop {
             dst_surrogate,
         } = params;
 
-        let old_properties = self
-            .edge_store
-            .get_edge(
-                dummy_task.request.database_id.as_u64(),
-                nodedb_types::TenantId::new(tid),
-                collection,
-                src_id,
-                label,
-                dst_id,
-            )
-            .ok()
-            .flatten();
-
-        let resp = self.execute_edge_put(
+        // The compensation entry is recorded inside `execute_edge_put_with_undo`
+        // at the only safe point — after the edge-store version is durably
+        // written and before the fallible CSR mutation. Recording it here, up
+        // front, would leave a phantom undo entry when dangling-endpoint
+        // validation or the edge-store write itself rejects, corrupting
+        // bitemporal history on rollback.
+        let resp = self.execute_edge_put_with_undo(
             dummy_task,
             crate::data::executor::handlers::graph::EdgePutParams {
                 tid,
@@ -180,20 +173,13 @@ impl CoreLoop {
                 src_surrogate,
                 dst_surrogate,
             },
+            Some(undo_log),
         );
         if resp.status == Status::Error {
             return Err(resp.error_code.map(|c| *c).unwrap_or(ErrorCode::Internal {
                 detail: "edge put failed".into(),
             }));
         }
-
-        undo_log.push(UndoEntry::PutEdge {
-            collection: collection.to_string(),
-            src_id: src_id.to_string(),
-            label: label.to_string(),
-            dst_id: dst_id.to_string(),
-            old_properties,
-        });
         Ok(resp)
     }
 
@@ -211,35 +197,27 @@ impl CoreLoop {
             label,
             dst_id,
         } = params;
-        let old_properties = self
-            .edge_store
-            .get_edge(
-                dummy_task.request.database_id.as_u64(),
-                nodedb_types::TenantId::new(tid),
+
+        // Compensation is recorded inside `execute_edge_delete_with_undo` only
+        // after the tombstone is durably written (and only when a live
+        // pre-image existed), so a rejected/failed delete leaves no phantom
+        // re-insert entry behind.
+        let resp = self.execute_edge_delete_with_undo(
+            dummy_task,
+            crate::data::executor::handlers::graph::EdgeDeleteParams {
+                tid,
                 collection,
                 src_id,
                 label,
                 dst_id,
-            )
-            .ok()
-            .flatten();
-
-        let resp = self.execute_edge_delete(dummy_task, tid, collection, src_id, label, dst_id);
+            },
+            Some(undo_log),
+        );
         if resp.status == Status::Error {
             return Err(resp.error_code.map(|c| *c).unwrap_or(ErrorCode::Internal {
                 detail: "edge delete failed".into(),
             }));
         }
-
-        if let Some(props) = old_properties {
-            undo_log.push(UndoEntry::DeleteEdge {
-                collection: collection.to_string(),
-                src_id: src_id.to_string(),
-                label: label.to_string(),
-                dst_id: dst_id.to_string(),
-                old_properties: props,
-            });
-        }
         Ok(resp)
     }
 
diff --git a/nodedb/src/data/executor/handlers/transaction/undo/apply.rs b/nodedb/src/data/executor/handlers/transaction/undo/apply.rs
index ae6bebf9a..773fce41e 100644
--- a/nodedb/src/data/executor/handlers/transaction/undo/apply.rs
+++ b/nodedb/src/data/executor/handlers/transaction/undo/apply.rs
@@ -111,12 +111,24 @@ impl CoreLoop {
 
     // ── Graph ────────────────────────────────────────────────────────────────
 
+    #[cfg(test)]
     pub(super) fn apply_undo_edge(
         &mut self,
         did: u64,
         tid: u64,
         entry_index: usize,
         entry: UndoEntry,
+    ) -> Result<(), (usize, String)> {
+        self.apply_undo_edge_with_stats(did, tid, entry_index, entry, true)
+    }
+
+    pub(super) fn apply_undo_edge_with_stats(
+        &mut self,
+        did: u64,
+        tid: u64,
+        entry_index: usize,
+        entry: UndoEntry,
+        account_stats: bool,
     ) -> Result<(), (usize, String)> {
         use crate::engine::graph::edge_store::EdgeRef;
         let database = nodedb_types::DatabaseId::new(did);
@@ -135,7 +147,14 @@ impl CoreLoop {
                 if let Some(old_props) = old_properties {
                     let valid_from_ms = nodedb_types::ordinal_to_ms(ord);
                     self.edge_store
-                        .put_edge_versioned(edge_ref, &old_props, ord, valid_from_ms, i64::MAX)
+                        .put_edge_versioned_with_stats(
+                            edge_ref,
+                            &old_props,
+                            ord,
+                            valid_from_ms,
+                            i64::MAX,
+                            account_stats,
+                        )
                         .map_err(|e| {
                             let detail = format!(
                                 "edge restore {collection} {src_id}-[{label}]->{dst_id}: {e}"
@@ -147,9 +166,35 @@ impl CoreLoop {
                             );
                             (entry_index, detail)
                         })?;
+                    let weight =
+                        crate::engine::graph::csr::extract_weight_from_properties(&old_props);
+                    let partition = self.csr_partition_mut(did, tid);
+                    partition.remove_edge_in_collection(&src_id, &label, &dst_id, &collection);
+                    let csr_res = if weight != 1.0 {
+                        partition.add_edge_weighted_in_collection(
+                            &src_id,
+                            &label,
+                            &dst_id,
+                            &collection,
+                            weight,
+                        )
+                    } else {
+                        partition.add_edge_in_collection(&src_id, &label, &dst_id, &collection)
+                    };
+                    csr_res.map_err(|e| {
+                        let detail =
+                            format!("CSR restore {collection} {src_id}-[{label}]->{dst_id}: {e}");
+                        error!(
+                            core = self.core_id, entry_index,
+                            error = %detail,
+                            "transaction undo: CSR restore failed after edge_store restore; \
+                             shard state unknown"
+                        );
+                        (entry_index, detail)
+                    })?;
                 } else {
                     self.edge_store
-                        .soft_delete_edge(edge_ref, ord)
+                        .soft_delete_edge_with_stats(edge_ref, ord, account_stats)
                         .map_err(|e| {
                             let detail = format!(
                                 "edge tombstone {collection} {src_id}-[{label}]->{dst_id}: {e}"
@@ -181,12 +226,13 @@ impl CoreLoop {
                 let ord = self.hlc.next_ordinal();
                 let valid_from_ms = nodedb_types::ordinal_to_ms(ord);
                 self.edge_store
-                    .put_edge_versioned(
+                    .put_edge_versioned_with_stats(
                         EdgeRef::new(database, tenant, &collection, &src_id, &label, &dst_id),
                         &old_properties,
                         ord,
                         valid_from_ms,
                         i64::MAX,
+                        account_stats,
                     )
                     .map_err(|e| {
                         let detail = format!(
diff --git a/nodedb/src/data/executor/handlers/transaction/undo/rollback.rs b/nodedb/src/data/executor/handlers/transaction/undo/rollback.rs
index 36f49f070..3fb8c4e57 100644
--- a/nodedb/src/data/executor/handlers/transaction/undo/rollback.rs
+++ b/nodedb/src/data/executor/handlers/transaction/undo/rollback.rs
@@ -20,6 +20,26 @@ impl CoreLoop {
         did: u64,
         tid: u64,
         undo_log: Vec<UndoEntry>,
+    ) -> Result<(), (usize, String)> {
+        self.rollback_undo_log_inner(did, tid, None, undo_log)
+    }
+
+    pub(in crate::data::executor::handlers) fn rollback_undo_log_at(
+        &mut self,
+        did: u64,
+        tid: u64,
+        vshard_id: crate::types::VShardId,
+        undo_log: Vec<UndoEntry>,
+    ) -> Result<(), (usize, String)> {
+        self.rollback_undo_log_inner(did, tid, Some(vshard_id), undo_log)
+    }
+
+    fn rollback_undo_log_inner(
+        &mut self,
+        did: u64,
+        tid: u64,
+        vshard_id: Option<crate::types::VShardId>,
+        undo_log: Vec<UndoEntry>,
     ) -> Result<(), (usize, String)> {
         let total = undo_log.len();
         for (rev_idx, entry) in undo_log.into_iter().rev().enumerate() {
@@ -27,7 +47,7 @@ impl CoreLoop {
             // diagnostics (makes it easier to correlate with the sub-plan that
             // produced this undo entry).
             let original_idx = total.saturating_sub(1 + rev_idx);
-            self.apply_undo_entry(did, tid, original_idx, entry)?;
+            self.apply_undo_entry(did, tid, vshard_id, original_idx, entry)?;
         }
         Ok(())
     }
@@ -39,6 +59,7 @@ impl CoreLoop {
         &mut self,
         did: u64,
         tid: u64,
+        vshard_id: Option<crate::types::VShardId>,
         entry_index: usize,
         entry: UndoEntry,
     ) -> Result<(), (usize, String)> {
@@ -52,8 +73,11 @@ impl CoreLoop {
             UndoEntry::SpatialInsert { .. } | UndoEntry::SpatialDelete { .. } => {
                 self.apply_undo_spatial(entry_index, entry)
             }
-            UndoEntry::PutEdge { .. } | UndoEntry::DeleteEdge { .. } => {
-                self.apply_undo_edge(did, tid, entry_index, entry)
+            UndoEntry::PutEdge { ref src_id, .. } | UndoEntry::DeleteEdge { ref src_id, .. } => {
+                let account_stats = vshard_id.is_none_or(|vshard_id| {
+                    vshard_id == crate::types::VShardId::from_key(src_id.as_bytes())
+                });
+                self.apply_undo_edge_with_stats(did, tid, entry_index, entry, account_stats)
             }
             UndoEntry::KvPut { .. }
             | UndoEntry::KvDelete { .. }
diff --git a/nodedb/src/data/executor/handlers/transaction/undo/tests.rs b/nodedb/src/data/executor/handlers/transaction/undo/tests.rs
index e0e6d4469..0c688520a 100644
--- a/nodedb/src/data/executor/handlers/transaction/undo/tests.rs
+++ b/nodedb/src/data/executor/handlers/transaction/undo/tests.rs
@@ -790,6 +790,104 @@ fn edge_cascade_delete_rollback_restores_csr_and_edge_store() {
     );
 }
 
+#[test]
+fn graph_edge_update_undo_restores_csr_weight() {
+    use crate::engine::graph::edge_store::EdgeRef;
+
+    let dir = tempfile::tempdir().unwrap();
+    let (mut core, _tx, _rx) = make_core_with_dir(dir.path());
+    let tenant = TenantId::new(TID);
+    let old_properties = nodedb_types::json_to_msgpack(&serde_json::json!({ "weight": 2.5 }))
+        .expect("encode old edge properties");
+    let new_properties = nodedb_types::json_to_msgpack(&serde_json::json!({ "weight": 9.0 }))
+        .expect("encode new edge properties");
+    let edge = EdgeRef::new(
+        crate::types::DatabaseId::new(DB),
+        tenant,
+        "c",
+        "alice",
+        "KNOWS",
+        "bob",
+    );
+    core.edge_store
+        .put_edge_versioned(edge, &new_properties, 10, 10, i64::MAX)
+        .expect("seed updated edge");
+    core.csr_partition_mut(DB, TID)
+        .add_edge_weighted_in_collection("alice", "KNOWS", "bob", "c", 9.0)
+        .expect("seed updated CSR edge");
+
+    core.apply_undo_edge(
+        DB,
+        TID,
+        0,
+        UndoEntry::PutEdge {
+            collection: "c".into(),
+            src_id: "alice".into(),
+            label: "KNOWS".into(),
+            dst_id: "bob".into(),
+            old_properties: Some(old_properties),
+        },
+    )
+    .expect("undo edge update");
+
+    assert_eq!(
+        core.csr_partition_mut(DB, TID)
+            .edge_weight("alice", "KNOWS", "bob"),
+        Some(2.5),
+        "rollback must restore the committed CSR traversal weight"
+    );
+}
+
+#[test]
+fn tx_edge_put_to_deleted_node_records_no_phantom_undo() {
+    use crate::bridge::envelope::Status;
+    use crate::data::executor::core_loop::tests::make_default_task;
+
+    let dir = tempfile::tempdir().unwrap();
+    let (mut core, _tx, _rx) = make_core_with_dir(dir.path());
+    let tenant = TenantId::new(TID);
+
+    // The destination node is soft-deleted, so the edge insert is rejected by
+    // `execute_edge_put`'s dangling-endpoint validation BEFORE any store write.
+    core.mark_node_deleted(DB, TID, "bob");
+
+    let task = make_default_task();
+    let mut undo_log: Vec<UndoEntry> = Vec::new();
+    let resp = core.execute_edge_put_with_undo(
+        &task,
+        crate::data::executor::handlers::graph::EdgePutParams {
+            tid: TID,
+            collection: "c",
+            src_id: "alice",
+            label: "KNOWS",
+            dst_id: "bob",
+            properties: b"p1",
+            src_surrogate: nodedb_types::Surrogate::ZERO,
+            dst_surrogate: nodedb_types::Surrogate::ZERO,
+        },
+        Some(&mut undo_log),
+    );
+
+    assert_eq!(
+        resp.status,
+        Status::Error,
+        "an edge insert to a deleted node must be rejected"
+    );
+    assert!(
+        undo_log.is_empty(),
+        "a rejected insert must record NO compensation entry; a phantom PutEdge \
+         undo would soft-delete a never-written edge on rollback, corrupting \
+         bitemporal history"
+    );
+    assert!(
+        core.edge_store
+            .get_edge(DB, tenant, "c", "alice", "KNOWS", "bob")
+            .unwrap()
+            .is_none(),
+        "the rejected insert must not have written any edge version"
+    );
+}
+
 // ── Column-stats undo ─────────────────────────────────────────────────────────
 
 fn stats_key_str() -> String {
diff --git a/nodedb/src/data/executor/wal_replay_redo_graph.rs b/nodedb/src/data/executor/wal_replay_redo_graph.rs
index bcd484af1..81bab087c 100644
--- a/nodedb/src/data/executor/wal_replay_redo_graph.rs
+++ b/nodedb/src/data/executor/wal_replay_redo_graph.rs
@@ -12,10 +12,9 @@
 //! (`wal_append_if_write`):
 //!
 //! * PUT — `(collection, src_id, label, dst_id, properties, src_surrogate,
-//!   dst_surrogate)`. The autocommit shape stops at `properties`; the redo shape
-//!   appends the two endpoint surrogates because `execute_edge_put` repopulates
-//!   the CSR node→surrogate map from them (bitmap-gated traversal depends on it),
-//!   and that identity is not otherwise recoverable from the edge alone.
+//!   dst_surrogate, system_from)`. The autocommit shape stops at `properties`;
+//!   the redo shape appends endpoint surrogates and the original temporal
+//!   ordinal. Legacy seven-element transaction redo remains decodable.
 //! * DELETE — `(collection, src_id, label, dst_id)`. Byte-identical to the
 //!   autocommit shape; `execute_edge_delete` needs no surrogate.
 //!
@@ -75,10 +74,20 @@ impl CoreLoop {
             let record_lsn = record.header.lsn;
 
             if is_put {
-                let Ok((collection, src_id, label, dst_id, properties, src_sur, dst_sur)) =
-                    zerompk::from_msgpack::<(String, String, String, String, Vec<u8>, u32, u32)>(
-                        &record.payload,
-                    )
+                // One struct decodes both the current record and any legacy
+                // record predating `system_from` (tolerant array decode →
+                // `None`), so there is no hand-maintained fallback tuple to
+                // drift out of sync with the encoder.
+                let Ok(crate::wal::EdgePutRedo {
+                    collection,
+                    src_id,
+                    label,
+                    dst_id,
+                    properties,
+                    src_surrogate: src_sur,
+                    dst_surrogate: dst_sur,
+                    system_from,
+                }) = zerompk::from_msgpack::<crate::wal::EdgePutRedo>(&record.payload)
                 else {
                     continue;
                 };
@@ -93,6 +102,7 @@ impl CoreLoop {
                 let task = Self::replay_graph_task(
                     tenant_id,
                     database_id,
+                    crate::types::VShardId::new(record.header.vshard_id),
                     record_lsn,
                     PhysicalPlan::Graph(GraphOp::EdgePut {
                         collection: collection.clone(),
@@ -104,6 +114,7 @@ impl CoreLoop {
                         dst_surrogate: nodedb_types::Surrogate::new(dst_sur),
                     }),
                 );
+                self.active_graph_system_from = system_from;
                 let response = self.execute_edge_put(
                     &task,
                     EdgePutParams {
@@ -117,6 +128,7 @@ impl CoreLoop {
                         dst_surrogate: nodedb_types::Surrogate::new(dst_sur),
                     },
                 );
+                self.active_graph_system_from = None;
                 if response.status == crate::bridge::envelope::Status::Ok {
                     puts += 1;
                 } else {
@@ -128,8 +140,16 @@ impl CoreLoop {
                     );
                 }
             } else {
-                let Ok((collection, src_id, label, dst_id)) =
-                    zerompk::from_msgpack::<(String, String, String, String)>(&record.payload)
+                // One struct decodes both the current record and any legacy
+                // record predating `system_from` (tolerant array decode →
+                // `None`), so there is no hand-maintained fallback tuple.
+                let Ok(crate::wal::EdgeDeleteRedo {
+                    collection,
+                    src_id,
+                    label,
+                    dst_id,
+                    system_from,
+                }) = zerompk::from_msgpack::<crate::wal::EdgeDeleteRedo>(&record.payload)
                 else {
                     continue;
                 };
@@ -144,6 +164,7 @@ impl CoreLoop {
                 let task = Self::replay_graph_task(
                     tenant_id,
                     database_id,
+                    crate::types::VShardId::new(record.header.vshard_id),
                     record_lsn,
                     PhysicalPlan::Graph(GraphOp::EdgeDelete {
                         collection: collection.clone(),
@@ -154,6 +175,7 @@ impl CoreLoop {
                         dst_surrogate: nodedb_types::Surrogate::ZERO,
                     }),
                 );
+                self.active_graph_system_from = system_from;
                 let response = self.execute_edge_delete(
                     &task,
                     tenant_id,
@@ -162,6 +184,7 @@ impl CoreLoop {
                     &label,
                     &dst_id,
                 );
+                self.active_graph_system_from = None;
                 if response.status == crate::bridge::envelope::Status::Ok {
                     deletes += 1;
                 } else {
@@ -242,10 +265,10 @@ impl CoreLoop {
     fn replay_graph_task(
         tenant_id: u64,
         database_id: DatabaseId,
+        vshard_id: crate::types::VShardId,
         record_lsn: u64,
         plan: PhysicalPlan,
     ) -> ExecutionTask {
-        let vshard_id = crate::types::VShardId::from_collection_in_database(database_id, "");
         let wal_lsn = Some(Lsn::new(record_lsn));
         ExecutionTask {
             request: Request {
@@ -315,9 +338,17 @@ mod tests {
     }
 
     fn edge_put_sub(collection: &str, src: &str, label: &str, dst: &str) -> RedoSubRecord {
-        let payload =
-            zerompk::to_msgpack_vec(&(collection, src, label, dst, b"".as_slice(), 10u32, 20u32))
-                .expect("encode edge put sub-record");
+        let payload = zerompk::to_msgpack_vec(&crate::wal::EdgePutRedo {
+            collection: collection.to_string(),
+            src_id: src.to_string(),
+            label: label.to_string(),
+            dst_id: dst.to_string(),
+            properties: Vec::new(),
+            src_surrogate: 10,
+            dst_surrogate: 20,
+            system_from: Some(nodedb_types::ms_to_ordinal_upper(100)),
+        })
+        .expect("encode edge put sub-record");
         RedoSubRecord {
             record_type: RecordType::Put as u32,
             payload,
@@ -334,7 +365,7 @@ mod tests {
             record_type: RecordType::TransactionRedo as u32,
             lsn: 1,
             tenant_id,
-            vshard_id: 0,
+            vshard_id: crate::types::VShardId::from_key(b"a").as_u32(),
             database_id: 0,
             payload: redo.to_bytes().expect("encode redo record"),
             encryption_key: None,
@@ -367,6 +398,26 @@ mod tests {
             1,
             "graph edge must be restored from redo replay"
         );
+        let stats = h
+            .core
+            .edge_store
+            .collection_stats(0, crate::types::TenantId::new(7), "knows", None)
+            .expect("graph stats after redo");
+        assert_eq!(stats.edge_count, 1, "source-home redo must restore stats");
+        let historical = h
+            .core
+            .edge_store
+            .collection_stats(
+                0,
+                crate::types::TenantId::new(7),
+                "knows",
+                Some(nodedb_types::ms_to_ordinal_upper(100)),
+            )
+            .expect("historical graph stats after redo");
+        assert_eq!(
+            historical.edge_count, 1,
+            "redo must restore the committed temporal version at its original time"
+        );
     }
 
     #[test]
diff --git a/nodedb/src/engine/graph/edge_store/stats/read.rs b/nodedb/src/engine/graph/edge_store/stats/read.rs
index 5a8d26f06..cd608373d 100644
--- a/nodedb/src/engine/graph/edge_store/stats/read.rs
+++ b/nodedb/src/engine/graph/edge_store/stats/read.rs
@@ -5,9 +5,8 @@
 //! ## Complexity
 //!
 //! - `as_of = None` (live snapshot): O(1) summary read + O(distinct_labels) label scan.
-//!   If the summary row is missing (cold-start / schema upgrade), triggers a lazy rebuild
-//!   via a full EDGES prefix scan and atomically writes the result back. Subsequent calls
-//!   are O(1) per the summary row.
+//!   Legacy or missing ownership-aware summaries fall back to a full EDGES prefix scan
+//!   and carry edge identities so the Control Plane can deduplicate dual-home replicas.
 //!
 //! - `as_of = Some(ts)`: falls back to a full EDGES prefix scan for the matching
 //!   collection, materialising counts at the given system-time ordinal. O(edges-in-collection).
@@ -27,9 +26,7 @@ use nodedb_types::TenantId;
 use crate::engine::graph::edge_store::store::{EDGES, EdgeStore, redb_err};
 use crate::engine::graph::edge_store::temporal::keys::{is_sentinel, parse_versioned_edge_key};
 
-use super::table::{
-    CollectionStats, GRAPH_STATS, LabelRow, SummaryRow, label_key, label_prefix, summary_key,
-};
+use super::table::{CollectionStats, GRAPH_STATS, LabelRow, SummaryRow, label_prefix, summary_key};
 
 impl EdgeStore {
     /// Live or historical stats for a single `(tenant, collection)` pair.
@@ -37,9 +34,9 @@ impl EdgeStore {
     /// Returns zeros when no edges exist — not an error.
     ///
     /// When `as_of` is `None` the result is served from the persistent summary
-    /// row (O(1) + O(distinct_labels)). If the summary row is absent, a lazy
-    /// rebuild is triggered via a full prefix scan of EDGES, and the result is
-    /// cached atomically for future calls.
+    /// row (O(1) + O(distinct_labels)). A legacy or absent ownership-aware
+    /// summary falls back to a full prefix scan of EDGES and returns logical
+    /// identities for exact cross-core deduplication.
     ///
     /// When `as_of` is `Some(ordinal)` the function performs a full prefix scan
     /// of EDGES and materialises counts at that system-time ordinal.
@@ -61,8 +58,7 @@ impl EdgeStore {
     ///
     /// With `as_of = None`: scans `GRAPH_STATS` summary rows for the tenant
     /// (O(collections-with-stats)), then does O(distinct_labels) label scan
-    /// per collection. If the summary row for any collection is absent but EDGES
-    /// has entries for it, triggers a lazy rebuild.
+    /// per collection. Legacy or absent summaries fall back to EDGES scans.
     ///
     /// With `as_of = Some(ts)`: scans all EDGES for the tenant once, grouping by
     /// collection and materialising counts at ordinal `ts`. O(total-edges-for-tenant).
@@ -104,6 +100,11 @@ impl EdgeStore {
         if let Some(bytes) = summary_bytes {
             let summary = SummaryRow::decode(bytes.value())?;
             drop(bytes);
+            if summary.ownership_version == 0 {
+                drop(stats_table);
+                drop(read_txn);
+                return self.collection_stats_historical(db, tid, collection, i64::MAX);
+            }
             let labels = read_labels_from_table(&stats_table, db, t, collection)?;
             return Ok(CollectionStats {
                 collection: collection.to_string(),
@@ -111,6 +112,8 @@ impl EdgeStore {
                 distinct_node_count: summary.distinct_node_count,
                 distinct_label_count: summary.distinct_label_count,
                 labels,
+                logical_edges: Vec::new(),
+                exact_scan: false,
             });
         }
         drop(stats_table);
@@ -124,10 +127,11 @@ impl EdgeStore {
             return Ok(CollectionStats::zero(collection.to_string()));
         }
 
-        // Rebuild: scan live EDGES for this collection at current-state.
-        let rebuilt = self.collection_stats_historical(db, tid, collection, i64::MAX)?;
-        self.write_stats_atomically(db, tid, collection, &rebuilt)?;
-        Ok(rebuilt)
+        // A physical-edge scan is exact locally and carries logical identities
+        // for cross-core union. Do not cache it as a summary: this store may be
+        // the destination-home replica, and only request routing can establish
+        // which physical copy owns global cardinality.
+        self.collection_stats_historical(db, tid, collection, i64::MAX)
     }
 
     fn tenant_stats_live(&self, db: u64, tid: TenantId) -> crate::Result<Vec<CollectionStats>> {
@@ -160,7 +164,8 @@ impl EdgeStore {
         drop(read_txn);
 
         if collections.is_empty() {
-            // No summary rows exist — scan EDGES to discover collections and rebuild.
+            // No ownership-aware summary rows exist — scan EDGES and return
+            // logical identities for cross-core deduplication.
             return self.tenant_stats_historical(db, tid, i64::MAX);
         }
 
@@ -279,45 +284,6 @@ impl EdgeStore {
             }
         }
     }
-
-    fn write_stats_atomically(
-        &self,
-        db: u64,
-        tid: TenantId,
-        collection: &str,
-        stats: &CollectionStats,
-    ) -> crate::Result<()> {
-        let t = tid.as_u64();
-        let write_txn = self
-            .db
-            .begin_write()
-            .map_err(|e| redb_err("begin_write (rebuild)", e))?;
-        {
-            let mut st = write_txn
-                .open_table(GRAPH_STATS)
-                .map_err(|e| redb_err("open graph_stats (rebuild)", e))?;
-
-            let summary = SummaryRow {
-                edge_count: stats.edge_count,
-                distinct_node_count: stats.distinct_node_count,
-                distinct_label_count: stats.distinct_label_count,
-            };
-            let skey = summary_key(collection);
-            st.insert((db, t, skey.as_str()), summary.encode()?.as_slice())
-                .map_err(|e| redb_err("insert rebuilt summary", e))?;
-
-            for (label, count) in &stats.labels {
-                let lkey = label_key(collection, label);
-                let lrow = LabelRow { count: *count };
-                st.insert((db, t, lkey.as_str()), lrow.encode()?.as_slice())
-                    .map_err(|e| redb_err("insert rebuilt label", e))?;
-            }
-        }
-        write_txn
-            .commit()
-            .map_err(|e| redb_err("commit rebuild", e))?;
-        Ok(())
-    }
 }
 
 // ── free functions ────────────────────────────────────────────────────────────
@@ -403,12 +369,14 @@ fn materialise_collection_stats(
     let mut edge_count = 0u64;
     let mut label_counts: HashMap<String, u64> = HashMap::new();
     let mut node_refs: HashMap<String, u32> = HashMap::new();
+    let mut logical_edges = Vec::new();
 
     for entry in bases.values() {
         if entry.is_sentinel {
             continue;
         }
         edge_count += 1;
+        logical_edges.push((entry.src.clone(), entry.label.clone(), entry.dst.clone()));
         *label_counts.entry(entry.label.clone()).or_insert(0) += 1;
         *node_refs.entry(entry.src.clone()).or_insert(0) += 1;
         if entry.src != entry.dst {
@@ -427,6 +395,8 @@ fn materialise_collection_stats(
         distinct_node_count,
         distinct_label_count,
         labels,
+        logical_edges,
+        exact_scan: true,
     })
 }
 
@@ -451,12 +421,14 @@ impl CollectionAccum {
         let mut edge_count = 0u64;
         let mut label_counts: HashMap<String, u64> = HashMap::new();
         let mut node_refs: HashMap<String, u32> = HashMap::new();
+        let mut logical_edges = Vec::new();
 
         for entry in self.bases.values() {
             if entry.is_sentinel {
                 continue;
             }
             edge_count += 1;
+            logical_edges.push((entry.src.clone(), entry.label.clone(), entry.dst.clone()));
             *label_counts.entry(entry.label.clone()).or_insert(0) += 1;
             *node_refs.entry(entry.src.clone()).or_insert(0) += 1;
             if entry.src != entry.dst {
@@ -475,6 +447,8 @@ impl CollectionAccum {
             distinct_node_count,
             distinct_label_count,
             labels,
+            logical_edges,
+            exact_scan: true,
         }
     }
 }
diff --git a/nodedb/src/engine/graph/edge_store/stats/table.rs b/nodedb/src/engine/graph/edge_store/stats/table.rs
index 10285b303..f80d315f5 100644
--- a/nodedb/src/engine/graph/edge_store/stats/table.rs
+++ b/nodedb/src/engine/graph/edge_store/stats/table.rs
@@ -25,20 +25,32 @@ pub const GRAPH_STATS: TableDefinition<(u64, u64, &str), &[u8]> =
 
 /// Aggregate counters for a `(tenant, collection)` pair. Written as the
 /// `summary` row kind.
-#[derive(
-    Debug,
-    Clone,
-    PartialEq,
-    Eq,
-    Serialize,
-    Deserialize,
-    zerompk::ToMessagePack,
-    zerompk::FromMessagePack,
-)]
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
 pub struct SummaryRow {
     pub edge_count: u64,
     pub distinct_node_count: u64,
     pub distinct_label_count: u64,
+    /// `1` means counters use source-home logical ownership. Legacy rows decode
+    /// as zero and are served by exact edge-identity scans until rebuilt.
+    #[serde(default)]
+    pub ownership_version: u8,
+}
+
+#[derive(zerompk::ToMessagePack, zerompk::FromMessagePack)]
+#[msgpack(map)]
+struct SummaryRowV1 {
+    edge_count: u64,
+    distinct_node_count: u64,
+    distinct_label_count: u64,
+    #[msgpack(default)]
+    ownership_version: u8,
+}
+
+#[derive(zerompk::ToMessagePack, zerompk::FromMessagePack)]
+struct LegacySummaryRow {
+    edge_count: u64,
+    distinct_node_count: u64,
+    distinct_label_count: u64,
 }
 
 impl SummaryRow {
@@ -47,21 +59,43 @@ impl SummaryRow {
             edge_count: 0,
             distinct_node_count: 0,
             distinct_label_count: 0,
+            ownership_version: 1,
         }
     }
 
     pub fn encode(&self) -> crate::Result<Vec<u8>> {
-        zerompk::to_msgpack_vec(self).map_err(|e| crate::Error::Storage {
+        zerompk::to_msgpack_vec(&SummaryRowV1 {
+            edge_count: self.edge_count,
+            distinct_node_count: self.distinct_node_count,
+            distinct_label_count: self.distinct_label_count,
+            ownership_version: self.ownership_version,
+        })
+        .map_err(|e| crate::Error::Storage {
             engine: "graph".into(),
             detail: format!("encode SummaryRow: {e}"),
         })
     }
 
     pub fn decode(bytes: &[u8]) -> crate::Result<Self> {
-        zerompk::from_msgpack(bytes).map_err(|e| crate::Error::Storage {
-            engine: "graph".into(),
-            detail: format!("decode SummaryRow: {e}"),
-        })
+        if let Ok(row) = zerompk::from_msgpack::<SummaryRowV1>(bytes) {
+            return Ok(Self {
+                edge_count: row.edge_count,
+                distinct_node_count: row.distinct_node_count,
+                distinct_label_count: row.distinct_label_count,
+                ownership_version: row.ownership_version,
+            });
+        }
+        zerompk::from_msgpack::<LegacySummaryRow>(bytes)
+            .map(|row| Self {
+                edge_count: row.edge_count,
+                distinct_node_count: row.distinct_node_count,
+                distinct_label_count: row.distinct_label_count,
+                ownership_version: 0,
+            })
+            .map_err(|e| crate::Error::Storage {
+                engine: "graph".into(),
+                detail: format!("decode SummaryRow: {e}"),
+            })
     }
 }
 
@@ -181,6 +215,19 @@ pub struct CollectionStats {
     pub distinct_label_count: u64,
     /// Per-label edge counts, sorted ascending by label name for determinism.
     pub labels: Vec<(String, u64)>,
+    /// Logical edge identities populated only by exact scans. They let the
+    /// Control Plane union dual-home physical replicas exactly; ownership-aware
+    /// live snapshots use source-owned persistent counters and leave this empty.
+    #[serde(default)]
+    #[msgpack(default)]
+    pub logical_edges: Vec<(String, String, String)>,
+    /// True when this result came from an exact physical-edge scan. A live
+    /// broadcast that observes even one legacy core repeats the broadcast in
+    /// exact mode on every core so legacy and ownership-aware summaries are
+    /// never combined approximately.
+    #[serde(default)]
+    #[msgpack(default)]
+    pub exact_scan: bool,
 }
 
 impl CollectionStats {
@@ -191,6 +238,33 @@ impl CollectionStats {
             distinct_node_count: 0,
             distinct_label_count: 0,
             labels: Vec::new(),
+            logical_edges: Vec::new(),
+            exact_scan: false,
         }
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn summary_decode_marks_legacy_counters_as_unowned() {
+        let bytes = zerompk::to_msgpack_vec(&LegacySummaryRow {
+            edge_count: 2,
+            distinct_node_count: 4,
+            distinct_label_count: 1,
+        })
+        .expect("encode legacy summary");
+        let decoded = SummaryRow::decode(&bytes).expect("decode legacy summary");
+        assert_eq!(decoded.edge_count, 2);
+        assert_eq!(decoded.ownership_version, 0);
+    }
+
+    #[test]
+    fn ownership_aware_summary_round_trips_version() {
+        let summary = SummaryRow::zero();
+        let bytes = summary.encode().expect("encode current summary");
+        assert_eq!(SummaryRow::decode(&bytes).unwrap(), summary);
+    }
+}
diff --git a/nodedb/src/engine/graph/edge_store/temporal/write.rs b/nodedb/src/engine/graph/edge_store/temporal/write.rs
index e04ec843b..1fcf23cc6 100644
--- a/nodedb/src/engine/graph/edge_store/temporal/write.rs
+++ b/nodedb/src/engine/graph/edge_store/temporal/write.rs
@@ -3,11 +3,14 @@
 //! Bitemporal write paths on `EdgeStore`:
 //! `put_edge_versioned`, `soft_delete_edge`, `gdpr_erase_edge`.
 
+use redb::ReadableTable;
+
 use super::keys::{
     EdgeRef, GDPR_ERASURE_SENTINEL, TOMBSTONE_SENTINEL, edge_version_prefix, is_sentinel,
     versioned_edge_key,
 };
 use super::payload::EdgeValuePayload;
+use crate::engine::graph::edge_store::stats::table::{GRAPH_STATS, SummaryRow, summary_key};
 use crate::engine::graph::edge_store::stats::update::{
     EdgeStatsKey, decrement_for_delete, increment_for_insert,
 };
@@ -28,6 +31,29 @@ impl EdgeStore {
         system_from: i64,
         valid_from_ms: i64,
         valid_until_ms: i64,
+    ) -> crate::Result<()> {
+        self.put_edge_versioned_with_stats(
+            edge,
+            properties,
+            system_from,
+            valid_from_ms,
+            valid_until_ms,
+            true,
+        )
+    }
+
+    /// Write a version while allowing a dual-home replica to skip logical
+    /// cardinality accounting. Cross-vShard graph writes persist the same edge
+    /// on both endpoint homes for OUT and IN traversal, but only the source home
+    /// owns the logical edge for global statistics.
+    pub fn put_edge_versioned_with_stats(
+        &self,
+        edge: EdgeRef<'_>,
+        properties: &[u8],
+        system_from: i64,
+        valid_from_ms: i64,
+        valid_until_ms: i64,
+        account_stats: bool,
     ) -> crate::Result<()> {
         let fwd = versioned_edge_key(edge.collection, edge.src, edge.label, edge.dst, system_from)?;
         let rev = versioned_edge_key(edge.collection, edge.dst, edge.label, edge.src, system_from)?;
@@ -57,18 +83,41 @@ impl EdgeStore {
                 .map_err(|e| redb_err("insert reverse", e))?;
             drop(rev_t);
 
-            increment_for_insert(
-                &write_txn,
-                EdgeStatsKey {
-                    db: d,
-                    tid: t,
-                    collection: edge.collection,
-                    label: edge.label,
-                    src: edge.src,
-                    dst: edge.dst,
-                },
-                system_from,
-            )?;
+            if account_stats {
+                increment_for_insert(
+                    &write_txn,
+                    EdgeStatsKey {
+                        db: d,
+                        tid: t,
+                        collection: edge.collection,
+                        label: edge.label,
+                        src: edge.src,
+                        dst: edge.dst,
+                    },
+                    system_from,
+                )?;
+            } else {
+                // Suppress the lazy edge-scan rebuild on a destination-only
+                // replica: absence of a summary means "legacy stats missing",
+                // while an explicit zero summary means "this shard owns no
+                // logical edges for this collection". Preserve an existing
+                // nonzero summary because this core may canonically own other
+                // source-homed edges in the same collection.
+                let key = summary_key(edge.collection);
+                let mut stats = write_txn
+                    .open_table(GRAPH_STATS)
+                    .map_err(|e| redb_err("open graph_stats", e))?;
+                if stats
+                    .get((d, t, key.as_str()))
+                    .map_err(|e| redb_err("read graph summary", e))?
+                    .is_none()
+                {
+                    let zero = SummaryRow::zero().encode()?;
+                    stats
+                        .insert((d, t, key.as_str()), zero.as_slice())
+                        .map_err(|e| redb_err("insert zero graph summary", e))?;
+                }
+            }
         }
         write_txn.commit().map_err(|e| redb_err("commit", e))?;
         Ok(())
@@ -140,13 +189,24 @@ impl EdgeStore {
 
     /// Append a tombstone version at `system_from`.
     pub fn soft_delete_edge(&self, edge: EdgeRef<'_>, system_from: i64) -> crate::Result<()> {
-        self.write_sentinel(edge, system_from, TOMBSTONE_SENTINEL)
+        self.write_sentinel(edge, system_from, TOMBSTONE_SENTINEL, true)
+    }
+
+    /// Append a tombstone without double-decrementing global statistics on the
+    /// destination-home replica of a dual-homed edge.
+    pub fn soft_delete_edge_with_stats(
+        &self,
+        edge: EdgeRef<'_>,
+        system_from: i64,
+        account_stats: bool,
+    ) -> crate::Result<()> {
+        self.write_sentinel(edge, system_from, TOMBSTONE_SENTINEL, account_stats)
     }
 
     /// Append a GDPR-erasure version — distinct from a soft-delete so audits
     /// can distinguish user-visible removal from regulatory erasure.
     pub fn gdpr_erase_edge(&self, edge: EdgeRef<'_>, system_from: i64) -> crate::Result<()> {
-        self.write_sentinel(edge, system_from, GDPR_ERASURE_SENTINEL)
+        self.write_sentinel(edge, system_from, GDPR_ERASURE_SENTINEL, true)
     }
 
     fn write_sentinel(
@@ -154,6 +214,7 @@ impl EdgeStore {
         edge: EdgeRef<'_>,
         system_from: i64,
         sentinel: &[u8],
+        account_stats: bool,
     ) -> crate::Result<()> {
         debug_assert!(
             is_sentinel(sentinel),
@@ -185,18 +246,20 @@ impl EdgeStore {
                 .map_err(|e| redb_err("insert sentinel reverse", e))?;
             drop(rev_t);
 
-            decrement_for_delete(
-                &write_txn,
-                EdgeStatsKey {
-                    db: d,
-                    tid: t,
-                    collection: edge.collection,
-                    label: edge.label,
-                    src: edge.src,
-                    dst: edge.dst,
-                },
-                system_from,
-            )?;
+            if account_stats {
+                decrement_for_delete(
+                    &write_txn,
+                    EdgeStatsKey {
+                        db: d,
+                        tid: t,
+                        collection: edge.collection,
+                        label: edge.label,
+                        src: edge.src,
+                        dst: edge.dst,
+                    },
+                    system_from,
+                )?;
+            }
         }
         write_txn
             .commit()
diff --git a/nodedb/src/wal/mod.rs b/nodedb/src/wal/mod.rs
index f441c2018..6eda15abe 100644
--- a/nodedb/src/wal/mod.rs
+++ b/nodedb/src/wal/mod.rs
@@ -15,7 +15,7 @@ pub(crate) use crdt_doc_payload::CrdtDocOpWalRecord;
 pub(crate) use crdt_list_payload::CrdtListOpWalRecord;
 pub(crate) use crdt_payload::CrdtDeltaWalPayload;
 pub use manager::WalManager;
-pub use redo::{CalvinStamp, RedoRecord, RedoSubRecord};
+pub use redo::{CalvinStamp, EdgeDeleteRedo, EdgePutRedo, RedoRecord, RedoSubRecord};
 pub use replay::SyncHwmReplayMaps;
 pub use replay::SyncHwmReplayStats;
 pub use replay::replay_surrogate_records;
diff --git a/nodedb/src/wal/redo/mod.rs b/nodedb/src/wal/redo/mod.rs
index e6c1cbbeb..8a1eceaf3 100644
--- a/nodedb/src/wal/redo/mod.rs
+++ b/nodedb/src/wal/redo/mod.rs
@@ -3,4 +3,4 @@
 pub mod record;
 pub mod replay;
 
-pub use record::{CalvinStamp, RedoRecord, RedoSubRecord};
+pub use record::{CalvinStamp, EdgeDeleteRedo, EdgePutRedo, RedoRecord, RedoSubRecord};
diff --git a/nodedb/src/wal/redo/record.rs b/nodedb/src/wal/redo/record.rs
index 6c9ab7845..77f85f61f 100644
--- a/nodedb/src/wal/redo/record.rs
+++ b/nodedb/src/wal/redo/record.rs
@@ -91,6 +91,73 @@ pub struct CalvinStamp {
     pub vshard_id: u32,
 }
 
+/// Redo sub-record payload for a graph edge upsert — the payload bytes of a
+/// [`RecordType::Put`](nodedb_wal::record::RecordType::Put) sub-record inside a
+/// graph `RedoRecord`.
+///
+/// One shared definition for every encode and decode site so the field set is a
+/// compile-time invariant. This replaced a positional tuple that silently
+/// drifted in arity across its ~half-dozen encode/decode sites — appending a
+/// field there produced runtime `ArrayLengthMismatch` (or a silently-skipped
+/// record that lost the write) at whichever site was not updated in lockstep.
+///
+/// Map-encoded (`#[msgpack(map)]`), keying fields by name so the set can grow
+/// additively — the same idiom [`RedoRecord`] uses. `system_from` is
+/// `#[msgpack(default)]`, so a record written before that field existed decodes
+/// it to `None`, preserving legacy records without a separate fallback path.
+#[derive(
+    Debug,
+    Clone,
+    PartialEq,
+    Eq,
+    Serialize,
+    Deserialize,
+    zerompk::ToMessagePack,
+    zerompk::FromMessagePack,
+)]
+#[msgpack(map)]
+pub struct EdgePutRedo {
+    pub collection: String,
+    pub src_id: String,
+    pub label: String,
+    pub dst_id: String,
+    pub properties: Vec<u8>,
+    pub src_surrogate: u32,
+    pub dst_surrogate: u32,
+    /// Frozen bitemporal `system_from` ordinal for deterministic cross-replica
+    /// replay. `None` in legacy records that predate the field.
+    #[serde(default)]
+    #[msgpack(default)]
+    pub system_from: Option<i64>,
+}
+
+/// Redo sub-record payload for a graph edge delete — the payload bytes of a
+/// [`RecordType::Delete`](nodedb_wal::record::RecordType::Delete) sub-record
+/// inside a graph `RedoRecord`. See [`EdgePutRedo`] for why this is a struct
+/// rather than a positional tuple.
+#[derive(
+    Debug,
+    Clone,
+    PartialEq,
+    Eq,
+    Serialize,
+    Deserialize,
+    zerompk::ToMessagePack,
+    zerompk::FromMessagePack,
+)]
+#[msgpack(map)]
+pub struct EdgeDeleteRedo {
+    pub collection: String,
+    pub src_id: String,
+    pub label: String,
+    pub dst_id: String,
+    /// Frozen bitemporal `system_from` ordinal for deterministic cross-replica
+    /// replay. `None` in legacy records that predate the field.
+    #[serde(default)]
+    #[msgpack(default)]
+    pub system_from: Option<i64>,
+}
+
 impl RedoRecord {
     /// Serialize to a zerompk MessagePack payload for WAL append.
     pub fn to_bytes(&self) -> crate::Result<Vec<u8>> {
diff --git a/nodedb/tests/engine_surface_graph_stats.rs b/nodedb/tests/engine_surface_graph_stats.rs
index 948490401..1ba6ce708 100644
--- a/nodedb/tests/engine_surface_graph_stats.rs
+++ b/nodedb/tests/engine_surface_graph_stats.rs
@@ -62,6 +62,45 @@ async fn single_edge_collection_counts() {
     );
 }
 
+#[tokio::test]
+async fn strict_collection_edge_counts_once_at_every_stats_surface() {
+    let srv = TestServer::start_multicores(2).await;
+    srv.exec(
+        "CREATE COLLECTION g_strict_counts (id TEXT PRIMARY KEY, name TEXT) \
+         WITH (engine='document_strict')",
+    )
+    .await
+    .unwrap();
+    srv.exec(
+        "GRAPH INSERT EDGE IN g_strict_counts FROM 'a' TO 'b' \
+         TYPE 'knows' PROPERTIES '{}'",
+    )
+    .await
+    .unwrap();
+
+    let compact = srv
+        .query_rows("SHOW GRAPH STATS 'g_strict_counts'")
+        .await
+        .unwrap();
+    let (nodes, edges, labels, labels_json) =
+        find_row(&compact, "g_strict_counts").expect("compact stats row");
+    assert_eq!(nodes, 2, "each endpoint must be counted once");
+    assert_eq!(edges, 1, "one logical insert must count as one edge");
+    assert_eq!(labels, 1, "one label must be distinct");
+    assert!(
+        labels_json.contains("\"count\":1"),
+        "per-label count must also be one: {labels_json}"
+    );
+
+    let verbose = srv
+        .query_rows("SHOW GRAPH STATS 'g_strict_counts' VERBOSE")
+        .await
+        .unwrap();
+    assert_eq!(verbose.len(), 1, "one label row expected: {verbose:?}");
+    assert_eq!(verbose[0][1], "knows");
+    assert_eq!(verbose[0][2], "1", "verbose label count");
+}
+
 #[tokio::test]
 async fn multi_label_distinct_count() {
     let srv = TestServer::start().await;
diff --git a/nodedb/tests/executor_tests/test_aggregate_aliases.rs b/nodedb/tests/executor_tests/test_aggregate_aliases.rs
index 7e9dc8f71..11ea29a38 100644
--- a/nodedb/tests/executor_tests/test_aggregate_aliases.rs
+++ b/nodedb/tests/executor_tests/test_aggregate_aliases.rs
@@ -95,3 +95,204 @@ fn aggregate_output_uses_user_alias_but_having_reads_canonical_key() {
     assert!(rows[0].get("count(*)").is_none());
     assert!(rows[0].get("avg(score)").is_none());
 }
+
+fn grouped_count_plan(user_alias: &str) -> PhysicalPlan {
+    grouped_count_shape_plan(user_alias, 10, Vec::new())
+}
+
+fn computed_group_count_plan(function: &str) -> PhysicalPlan {
+    PhysicalPlan::Query(QueryOp::Aggregate {
+        collection: "cache_alias_users".into(),
+        input: None,
+        group_by: vec![GroupKeySpec {
+            output_name: "group_0".into(),
+            field: None,
+            expr: Some(nodedb_query::expr::SqlExpr::Function {
+                name: function.into(),
+                args: vec![nodedb_query::expr::SqlExpr::Column("department".into())],
+            }),
+        }],
+        aggregates: vec![AggregateSpec {
+            function: "count".into(),
+            alias: "count(*)".into(),
+            user_alias: Some("row_count".into()),
+            field: "*".into(),
+            expr: None,
+        }],
+        filters: Vec::new(),
+        having: Vec::new(),
+        limit: 10,
+        sub_group_by: Vec::new(),
+        sub_aggregates: Vec::new(),
+        grouping_sets: Vec::new(),
+        sort_keys: Vec::new(),
+    })
+}
+
+fn grouped_count_shape_plan(
+    user_alias: &str,
+    limit: usize,
+    sort_keys: Vec<(String, bool)>,
+) -> PhysicalPlan {
+    PhysicalPlan::Query(QueryOp::Aggregate {
+        collection: "cache_alias_users".into(),
+        input: None,
+        group_by: vec![GroupKeySpec::column("department")],
+        aggregates: vec![AggregateSpec {
+            function: "count".into(),
+            alias: "count(*)".into(),
+            user_alias: Some(user_alias.into()),
+            field: "*".into(),
+            expr: None,
+        }],
+        filters: Vec::new(),
+        having: Vec::new(),
+        limit,
+        sub_group_by: Vec::new(),
+        sub_aggregates: Vec::new(),
+        grouping_sets: Vec::new(),
+        sort_keys,
+    })
+}
+
+#[test]
+fn aggregate_cache_separates_user_facing_output_aliases() {
+    let mut ctx = make_ctx();
+
+    for (idx, id) in ["u1", "u2"].into_iter().enumerate() {
+        let doc = nodedb_types::json_to_msgpack(&serde_json::json!({
+            "id": id,
+            "department": "tools",
+        }))
+        .expect("encode document");
+        send_ok(
+            &mut ctx.core,
+            &mut ctx.tx,
+            &mut ctx.rx,
+            PhysicalPlan::Document(DocumentOp::PointPut {
+                collection: "cache_alias_users".into(),
+                document_id: id.into(),
+                value: doc,
+                surrogate: nodedb_types::Surrogate::new((idx as u32) + 1),
+                pk_bytes: Vec::new(),
+            }),
+        );
+    }
+
+    let first = send_ok(
+        &mut ctx.core,
+        &mut ctx.tx,
+        &mut ctx.rx,
+        grouped_count_plan("first_count"),
+    );
+    let first_rows = payload_value(&first);
+    assert_eq!(first_rows[0]["first_count"].as_u64(), Some(2));
+
+    let second = send_ok(
+        &mut ctx.core,
+        &mut ctx.tx,
+        &mut ctx.rx,
+        grouped_count_plan("second_count"),
+    );
+    let second_rows = payload_value(&second);
+    assert_eq!(
+        second_rows[0]["second_count"].as_u64(),
+        Some(2),
+        "a cache hit must preserve the requesting query's output schema: {second_rows}"
+    );
+    assert!(second_rows[0].get("first_count").is_none());
+    assert!(second_rows[0].get("count(*)").is_none());
+}
+
+#[test]
+fn aggregate_cache_separates_computed_group_expressions() {
+    let mut ctx = make_ctx();
+    for (idx, department) in ["Alpha", "alpha"].into_iter().enumerate() {
+        let id = format!("computed-{idx}");
+        let doc = nodedb_types::json_to_msgpack(&serde_json::json!({
+            "id": id,
+            "department": department,
+        }))
+        .expect("encode document");
+        send_ok(
+            &mut ctx.core,
+            &mut ctx.tx,
+            &mut ctx.rx,
+            PhysicalPlan::Document(DocumentOp::PointPut {
+                collection: "cache_alias_users".into(),
+                document_id: id,
+                value: doc,
+                surrogate: nodedb_types::Surrogate::new((idx as u32) + 1),
+                pk_bytes: Vec::new(),
+            }),
+        );
+    }
+
+    let lower = payload_value(&send_ok(
+        &mut ctx.core,
+        &mut ctx.tx,
+        &mut ctx.rx,
+        computed_group_count_plan("lower"),
+    ));
+    assert_eq!(lower[0]["group_0"], "alpha");
+    assert_eq!(lower[0]["row_count"].as_u64(), Some(2));
+
+    let upper = payload_value(&send_ok(
+        &mut ctx.core,
+        &mut ctx.tx,
+        &mut ctx.rx,
+        computed_group_count_plan("upper"),
+    ));
+    assert_eq!(upper[0]["group_0"], "ALPHA");
+    assert_eq!(upper[0]["row_count"].as_u64(), Some(2));
+}
+
+#[test]
+fn aggregate_cache_separates_limit_and_sort_shape() {
+    let mut ctx = make_ctx();
+    let mut surrogate = 1u32;
+    for (department, count) in [("alpha", 1), ("beta", 2), ("gamma", 3)] {
+        for index in 0..count {
+            let id = format!("{department}-{index}");
+            let doc = nodedb_types::json_to_msgpack(&serde_json::json!({
+                "id": id,
+                "department": department,
+            }))
+            .expect("encode document");
+            send_ok(
+                &mut ctx.core,
+                &mut ctx.tx,
+                &mut ctx.rx,
+                PhysicalPlan::Document(DocumentOp::PointPut {
+                    collection: "cache_alias_users".into(),
+                    document_id: id,
+                    value: doc,
+                    surrogate: nodedb_types::Surrogate::new(surrogate),
+                    pk_bytes: Vec::new(),
+                }),
+            );
+            surrogate += 1;
+        }
+    }
+
+    let ascending = send_ok(
+        &mut ctx.core,
+        &mut ctx.tx,
+        &mut ctx.rx,
+        grouped_count_shape_plan("row_count", 1, vec![("row_count".into(), true)]),
+    );
+    let ascending_rows = payload_value(&ascending);
+    assert_eq!(ascending_rows.as_array().map(Vec::len), Some(1));
+    assert_eq!(ascending_rows[0]["row_count"].as_u64(), Some(1));
+
+    let descending = send_ok(
+        &mut ctx.core,
+        &mut ctx.tx,
+        &mut ctx.rx,
+        grouped_count_shape_plan("row_count", 2, vec![("row_count".into(), false)]),
+    );
+    let descending_rows = payload_value(&descending);
+    assert_eq!(descending_rows.as_array().map(Vec::len), Some(2));
+    assert_eq!(descending_rows[0]["row_count"].as_u64(), Some(3));
+    assert_eq!(descending_rows[1]["row_count"].as_u64(), Some(2));
+}
diff --git a/nodedb/tests/native_gateway_txn_overlay.rs b/nodedb/tests/native_gateway_txn_overlay.rs
index 855ca5159..524476fb9 100644
--- a/nodedb/tests/native_gateway_txn_overlay.rs
+++ b/nodedb/tests/native_gateway_txn_overlay.rs
@@ -213,3 +213,130 @@ async fn native_in_txn_sql_select_reads_own_write() {
         "ROLLBACK must hide the staged write, got: {after_rows:?}"
     );
 }
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+async fn native_commit_makes_strict_row_visible_to_every_read_path() {
+    let server = TestServer::start().await;
+    server
+        .exec(
+            "CREATE COLLECTION native_committed_visibility \
+             (id TEXT PRIMARY KEY, name TEXT) WITH (engine='document_strict')",
+        )
+        .await
+        .expect("create strict collection");
+
+    let mut stream = native_session(&server).await;
+    let begin = send_begin_opcode(&mut stream, 1).await;
+    assert_eq!(begin.status, ResponseStatus::Ok, "BEGIN: {begin:?}");
+
+    let insert = send_sql(
+        &mut stream,
+        2,
+        "INSERT INTO native_committed_visibility (id, name) VALUES ('a1', 'alpha')",
+    )
+    .await;
+    assert_eq!(insert.status, ResponseStatus::Ok, "INSERT: {insert:?}");
+
+    let commit = send_request(&mut stream, 3, OpCode::Commit, TextFields::default()).await;
+    assert_eq!(commit.status, ResponseStatus::Ok, "COMMIT: {commit:?}");
+    assert!(
+        server
+            .shared
+            .surrogate_assigner
+            .lookup(
+                nodedb_types::DatabaseId::DEFAULT,
+                nodedb_types::TenantId::new(1),
+                "native_committed_visibility",
+                b"a1",
+            )
+            .expect("lookup committed PK binding")
+            .is_some(),
+        "planning the transactional insert must publish the stable PK binding"
+    );
+
+    let point_read = send_sql(
+        &mut stream,
+        4,
+        "SELECT id FROM native_committed_visibility WHERE id = 'a1'",
+    )
+    .await;
+    assert_eq!(
+        point_read
+            .rows
+            .as_ref()
+            .and_then(|rows| rows.first())
+            .and_then(|row| row.first()),
+        Some(&Value::String("a1".into())),
+        "PK lookup must agree with the full scan after COMMIT: {point_read:?}"
+    );
+
+    let mut scan_session = native_session(&server).await;
+    let full_scan = send_sql(
+        &mut scan_session,
+        1,
+        "SELECT id FROM native_committed_visibility",
+    )
+    .await;
+    assert_eq!(
+        full_scan
+            .rows
+            .as_ref()
+            .and_then(|rows| rows.first())
+            .and_then(|row| row.first()),
+        Some(&Value::String("a1".into())),
+        "full scan control must see the durable row: {full_scan:?}"
+    );
+    let post_scan_point = send_sql(
+        &mut scan_session,
+        2,
+        "SELECT id FROM native_committed_visibility WHERE id = 'a1'",
+    )
+    .await;
+    assert_eq!(
+        post_scan_point.seq, 2,
+        "the harness must drain any extra scan frames before the next response"
+    );
+    assert_eq!(
+        post_scan_point
+            .rows
+            .as_ref()
+            .and_then(|rows| rows.first())
+            .and_then(|row| row.first()),
+        Some(&Value::String("a1".into())),
+        "same-session point lookup after a fan-out scan must not consume a stale frame"
+    );
+
+    let mut aggregate_session = native_session(&server).await;
+    let filtered_count = send_sql(
+        &mut aggregate_session,
+        1,
+        "SELECT count(*) FROM native_committed_visibility WHERE name = 'alpha'",
+    )
+    .await;
+    assert_eq!(
+        filtered_count
+            .rows
+            .as_ref()
+            .and_then(|rows| rows.first())
+            .and_then(|row| row.first()),
+        Some(&Value::Integer(1)),
+        "filtered aggregate must see the committed row: {filtered_count:?}"
+    );
+
+    let mut fresh = native_session(&server).await;
+    let fresh_point = send_sql(
+        &mut fresh,
+        1,
+        "SELECT id FROM native_committed_visibility WHERE id = 'a1'",
+    )
+    .await;
+    assert_eq!(
+        fresh_point
+            .rows
+            .as_ref()
+            .and_then(|rows| rows.first())
+            .and_then(|row| row.first()),
+        Some(&Value::String("a1".into())),
+        "committed PK visibility must survive connection boundaries: {fresh_point:?}"
+    );
+}
diff --git a/nodedb/tests/pg_catalog_regclass.rs b/nodedb/tests/pg_catalog_regclass.rs
new file mode 100644
index 000000000..4411cbfb1
--- /dev/null
+++ b/nodedb/tests/pg_catalog_regclass.rs
@@ -0,0 +1,138 @@
+// SPDX-License-Identifier: BUSL-1.1
+
+//! PostgreSQL-compatible `regclass` input and output semantics.
+
+mod common;
+
+use common::pgwire_harness::TestServer;
+
+#[tokio::test]
+async fn quoted_relation_name_resolves_like_the_unquoted_form() {
+    let srv = TestServer::start().await;
+    srv.exec(
+        "CREATE COLLECTION quoted_regclass_target \
+         (id BIGINT PRIMARY KEY, name TEXT DEFAULT 'x', qty INT) \
+         WITH (engine='document_strict')",
+    )
+    .await
+    .expect("create collection");
+
+    let mut bare = srv
+        .query_text(
+            "SELECT attname FROM pg_attribute \
+             WHERE attrelid = 'quoted_regclass_target'::regclass",
+        )
+        .await
+        .expect("bare regclass lookup");
+    let mut quoted = srv
+        .query_text(
+            "SELECT attname FROM pg_attribute \
+             WHERE attrelid = '\"quoted_regclass_target\"'::regclass",
+        )
+        .await
+        .expect("quoted regclass lookup");
+    bare.sort();
+    quoted.sort();
+
+    assert_eq!(bare, vec!["id", "name", "qty"]);
+    assert_eq!(
+        quoted, bare,
+        "identifier quotes inside a regclass string must be normalized before lookup"
+    );
+}
+
+#[tokio::test]
+async fn default_schema_qualifier_resolves_the_same_relation() {
+    let srv = TestServer::start().await;
+    srv.exec(
+        "CREATE COLLECTION qualified_regclass_target \
+         (id BIGINT PRIMARY KEY, name TEXT DEFAULT 'x', qty INT) \
+         WITH (engine='document_strict')",
+    )
+    .await
+    .expect("create collection");
+
+    let mut qualified = srv
+        .query_text(
+            "SELECT attname FROM pg_attribute \
+             WHERE attrelid = 'public.\"qualified_regclass_target\"'::regclass",
+        )
+        .await
+        .expect("schema-qualified regclass lookup");
+    qualified.sort();
+
+    assert_eq!(
+        qualified,
+        vec!["id", "name", "qty"],
+        "the default schema qualifier must resolve through the same relation identity"
+    );
+}
+
+#[tokio::test]
+async fn unknown_regclass_cast_reports_undefined_relation() {
+    let srv = TestServer::start().await;
+    srv.expect_error("SELECT 'missing_regclass_target'::regclass", "42P01")
+        .await;
+}
+
+#[tokio::test]
+async fn regclass_validation_covers_update_and_delete_filters() {
+    let srv = TestServer::start().await;
+    srv.exec("CREATE COLLECTION regclass_dml_target (id BIGINT PRIMARY KEY, value TEXT)")
+        .await
+        .expect("create collection");
+    srv.expect_error(
+        "UPDATE regclass_dml_target SET value = 'x' \
+         WHERE 'missing_update_relation'::regclass = 1",
+        "42P01",
+    )
+    .await;
+    srv.expect_error(
+        "DELETE FROM regclass_dml_target \
+         WHERE 'missing_delete_relation'::regclass = 1",
+        "42P01",
+    )
+    .await;
+}
+
+#[tokio::test]
+async fn regclass_validation_covers_projection_and_aggregate_expressions() {
+    let srv = TestServer::start().await;
+    srv.exec("CREATE COLLECTION regclass_expr_target (id BIGINT PRIMARY KEY)")
+        .await
+        .expect("create collection");
+    srv.expect_error(
+        "SELECT 'missing_projection_relation'::regclass FROM regclass_expr_target",
+        "42P01",
+    )
+    .await;
+    srv.expect_error(
+        "SELECT COUNT('missing_aggregate_relation'::regclass) FROM regclass_expr_target",
+        "42P01",
+    )
+    .await;
+}
+
+#[tokio::test]
+async fn direct_regclass_cast_renders_the_relation_name() {
+    let srv = TestServer::start().await;
+    srv.exec("CREATE COLLECTION rendered_regclass_target (id BIGINT PRIMARY KEY)")
+        .await
+        .expect("create collection");
+
+    let bare = srv
+        .query_text("SELECT 'rendered_regclass_target'::regclass")
+        .await
+        .expect("render bare regclass");
+    let quoted = srv
+        .query_text("SELECT '\"rendered_regclass_target\"'::regclass")
+        .await
+        .expect("render quoted regclass");
+
+    assert_eq!(bare, vec!["rendered_regclass_target"]);
+    assert_eq!(quoted, bare);
+    assert!(
+        bare.iter().all(|value| !value.is_empty()),
+        "resolved regclass values must never render as empty cells"
+    );
+}
diff --git a/nodedb/tests/tenant_drop_owned_objects.rs b/nodedb/tests/tenant_drop_owned_objects.rs
new file mode 100644
index 000000000..d9a22eb3a
--- /dev/null
+++ b/nodedb/tests/tenant_drop_owned_objects.rs
@@ -0,0 +1,171 @@
+// SPDX-License-Identifier: BUSL-1.1
+
+//! Tenant teardown must terminate ownership inside the tenant being removed.
+
+mod common;
+
+use common::pgwire_harness::TestServer;
+
+async fn assert_tenant_drop_removes_admin_owned_collection(retained: bool) {
+    let server = TestServer::start().await;
+    let tenant = if retained {
+        "retained_scope"
+    } else {
+        "active_scope"
+    };
+    let user = if retained {
+        "retained_owner"
+    } else {
+        "active_owner"
+    };
+    let collection = if retained {
+        "retained_tenant_notes"
+    } else {
+        "active_tenant_notes"
+    };
+    let admin = format!("{tenant}_admin");
+
+    server
+        .exec(&format!("CREATE TENANT {tenant}"))
+        .await
+        .expect("create tenant");
+    let tenant_id = server
+        .shared
+        .credentials
+        .catalog()
+        .find_tenant_by_name(tenant)
+        .expect("read tenant")
+        .expect("tenant exists")
+        .tenant_id;
+    server
+        .exec(&format!(
+            "CREATE USER {user} PASSWORD 'probe-secret-99' TENANT {tenant}"
+        ))
+        .await
+        .expect("create tenant user");
+    server
+        .exec(&format!("GRANT tenant_admin TO {user}"))
+        .await
+        .expect("grant tenant administration");
+
+    let (client, connection) = server
+        .connect_as(user, "probe-secret-99")
+        .await
+        .expect("connect as tenant owner");
+    client
+        .simple_query(&format!(
+            "CREATE COLLECTION {collection} (id TEXT PRIMARY KEY, body TEXT) \
+             WITH (engine='document_strict')"
+        ))
+        .await
+        .expect("create tenant collection");
+    if !retained {
+        client
+            .simple_query(&format!(
+                "CREATE RLS POLICY tenant_guard ON {collection} FOR READ USING (id = id)"
+            ))
+            .await
+            .expect("create collection-scoped RLS policy");
+    }
+    if retained {
+        client
+            .simple_query(&format!("DROP COLLECTION {collection}"))
+            .await
+            .expect("retain dropped collection tombstone");
+    }
+    drop(client);
+    connection.abort();
+
+    server
+        .exec(&format!("DROP USER {user}"))
+        .await
+        .expect("drop ordinary tenant owner");
+    assert!(
+        server
+            .shared
+            .credentials
+            .catalog()
+            .load_all_owners()
+            .expect("load owners")
+            .iter()
+            .any(|owner| {
+                owner.tenant_id == tenant_id
+                    && owner.object_name == collection
+                    && owner.owner_username == admin
+            }),
+        "the lifecycle administrator must inherit collection ownership before teardown"
+    );
+
+    server
+        .exec(&format!("DROP TENANT {tenant}"))
+        .await
+        .expect("tenant teardown must remove its terminal owner and owned objects");
+
+    assert!(
+        server
+            .shared
+            .credentials
+            .catalog()
+            .find_tenant_by_name(tenant)
+            .expect("read dropped tenant")
+            .is_none()
+    );
+    assert!(server.shared.credentials.get_user(&admin).is_none());
+    assert!(
+        server
+            .shared
+            .credentials
+            .catalog()
+            .load_all_rls_policies()
+            .expect("load RLS policies after tenant drop")
+            .iter()
+            .all(|policy| policy.tenant_id != tenant_id),
+        "tenant teardown must not leave collection policies behind"
+    );
+    assert!(
+        server
+            .shared
+            .credentials
+            .catalog()
+            .load_all_owners()
+            .expect("load owners after tenant drop")
+            .iter()
+            .all(|owner| owner.tenant_id != tenant_id),
+        "tenant teardown must not leave owner rows referencing the removed principal"
+    );
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+async fn drop_tenant_removes_active_objects_owned_by_its_lifecycle_admin() {
+    assert_tenant_drop_removes_admin_owned_collection(false).await;
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+async fn drop_tenant_removes_retained_objects_owned_by_its_lifecycle_admin() {
+    assert_tenant_drop_removes_admin_owned_collection(true).await;
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+async fn drop_tenant_rejects_transactional_buffering_without_side_effects() {
+    let server = TestServer::start().await;
+    server
+        .exec("CREATE TENANT rollback_scope")
+        .await
+        .expect("create tenant");
+    let error = server
+        .exec("BEGIN; DROP TENANT rollback_scope")
+        .await
+        .expect_err("tenant teardown must not enter the generic DDL buffer");
+    assert!(error.contains("0A000"), "unexpected error: {error}");
+    server.exec("ROLLBACK").await.expect("rollback transaction");
+    assert!(
+        server
+            .shared
+            .credentials
+            .catalog()
+            .find_tenant_by_name("rollback_scope")
+            .expect("read tenant")
+            .is_some(),
+        "rejected transactional teardown must leave tenant state untouched"
+    );
+}