From caac467124be6835e9992024f25584b2b39e6209 Mon Sep 17 00:00:00 2001
From: Farhan Syah <bizimpulse@gmail.com>
Date: Tue, 21 Jul 2026 04:29:35 +0000
Subject: [PATCH 01/10] fix issues 188 through 193

---
 nodedb-client/src/native/connection/mod.rs    |  46 +-
 .../tests/descriptor_versioning_cross_node.rs | 155 ++++-
 .../tests/single_node_calvin_graph_txn.rs     | 221 ++++++-
 .../src/calvin/types/transaction.rs           |  95 ++-
 nodedb-cluster/src/metadata_group/cache.rs    |   7 +
 nodedb-cluster/src/metadata_group/entry.rs    |  20 +
 nodedb-sql/src/catalog.rs                     |  68 +++
 nodedb-sql/src/planner/catalog_expr_fold.rs   | 223 +++++++
 nodedb-sql/src/planner/catalog_fold.rs        | 411 ++++++++-----
 nodedb-sql/src/planner/catalog_plan_shapes.rs | 120 ++++
 .../src/planner/catalog_plan_validate.rs      | 195 ++++++
 nodedb-sql/src/planner/const_fold.rs          |   3 +
 nodedb-sql/src/planner/mod.rs                 |   3 +
 nodedb-sql/src/planner/select/helpers.rs      |   2 +-
 nodedb-sql/src/planner/select/mod.rs          |   2 +-
 nodedb-sql/src/planner/select/select_stmt.rs  |   6 +-
 .../src/native_harness/frames.rs              |  64 +-
 .../control/catalog_entry/apply/collection.rs |  42 +-
 .../control/catalog_entry/descriptor_stamp.rs | 559 +++++++++++++++---
 .../scheduler/driver/core/commit_redo.rs      |   8 +-
 .../driver/core/commit_resolution_dispatch.rs |  53 ++
 .../scheduler/driver/core/commit_resolve.rs   | 115 ++--
 .../scheduler/driver/core/completion_route.rs |  13 +-
 .../calvin/scheduler/driver/core/dispatch.rs  |  68 ++-
 .../calvin/scheduler/driver/core/mod.rs       |   1 +
 .../calvin/scheduler/driver/core/request.rs   |   3 +-
 .../calvin/scheduler/driver/core/routing.rs   |  84 ++-
 .../driver/core/write_version_record.rs       |   6 +-
 .../cluster/calvin/scheduler/driver/types.rs  |   3 +
 .../cluster/metadata_applier/catalog_ddl.rs   |  21 +-
 .../cluster/metadata_applier/dispatch.rs      |  47 ++
 nodedb/src/control/gateway/version_set.rs     |  10 +-
 nodedb/src/control/metadata_proposer.rs       | 167 +++++-
 nodedb/src/control/planner/calvin/dispatch.rs |  11 +-
 .../calvin/tx_class/dependent_builder.rs      |  19 +-
 .../planner/calvin/tx_class/static_builder.rs |  39 +-
 .../catalog_adapter/sql_catalog_impl.rs       |  34 +-
 .../control/planner/context/query/planning.rs |  42 +-
 .../control/security/catalog/collections.rs   |  38 ++
 .../dispatch_utils/change_events/extract.rs   |  42 +-
 .../dispatch_utils/change_events/mod.rs       |   4 +-
 .../dispatch_utils/change_events/publish.rs   |   2 +-
 .../src/control/server/dispatch_utils/mod.rs  |   5 +-
 .../server/native/dispatch/transaction.rs     |  76 ++-
 .../control/server/pgwire/handler/dispatch.rs |   4 +-
 .../shared/ddl/neutral/graph_ops/stats.rs     |  36 +-
 .../server/shared/ddl/neutral/tenant/drop.rs  |  10 +
 .../server/shared/ddl/neutral/user/drop.rs    |   8 +-
 .../server/shared/ddl/neutral/user/mod.rs     |   1 +
 .../shared/ddl/neutral/user/reassign_owned.rs |  11 +-
 .../shared/ddl/neutral/user/tenant_purge.rs   | 114 ++++
 .../control/server/shared/session/commit.rs   | 197 ++----
 .../server/shared/session/commit_calvin.rs    |  49 +-
 .../server/shared/session/ddl_buffer.rs       | 163 ++++-
 .../server/shared/session/leader_forward.rs   |   4 +-
 .../server/shared/session/lifecycle.rs        |   2 +-
 .../src/control/server/shared/session/mod.rs  |   2 +
 .../server/shared/session/overlay_drop.rs     |  56 ++
 nodedb/src/control/state/fields.rs            |  23 +-
 nodedb/src/control/state/init.rs              |   4 +
 nodedb/src/control/state/init_prod/open.rs    |   4 +
 nodedb/src/data/executor/core_loop/open.rs    |   1 +
 nodedb/src/data/executor/core_loop/state.rs   |   4 +
 .../executor/handlers/aggregate/cache_key.rs  |  72 ++-
 .../data/executor/handlers/aggregate/exec.rs  |   4 +
 .../handlers/aggregate/streaming/over_docs.rs |   2 +
 .../data/executor/handlers/control/calvin.rs  |  18 +-
 .../executor/handlers/graph_edge_write.rs     |  40 +-
 .../src/data/executor/handlers/graph_stats.rs |  11 +-
 .../executor/handlers/transaction/batch.rs    |  18 +-
 .../overlay/graph_staged/txn_overlay.rs       |  20 +
 .../handlers/transaction/resolve/entry.rs     |  19 +-
 .../handlers/transaction/resolve/graph.rs     |  38 +-
 .../executor/handlers/transaction/sub_plan.rs |  98 ++-
 .../handlers/transaction/sub_plan_write.rs    |  31 +-
 .../handlers/transaction/undo/apply.rs        |  52 +-
 .../handlers/transaction/undo/rollback.rs     |  30 +-
 .../handlers/transaction/undo/tests.rs        |  48 ++
 .../data/executor/wal_replay_redo_graph.rs    | 110 +++-
 .../src/engine/graph/edge_store/stats/read.rs |  84 +--
 .../engine/graph/edge_store/stats/table.rs    | 104 +++-
 .../engine/graph/edge_store/temporal/write.rs | 115 +++-
 nodedb/tests/engine_surface_graph_stats.rs    |  39 ++
 .../executor_tests/test_aggregate_aliases.rs  | 201 +++++++
 nodedb/tests/native_gateway_txn_overlay.rs    | 127 ++++
 nodedb/tests/pg_catalog_regclass.rs           | 138 +++++
 nodedb/tests/tenant_drop_owned_objects.rs     | 171 ++++++
 87 files changed, 4520 insertions(+), 916 deletions(-)
 create mode 100644 nodedb-sql/src/planner/catalog_expr_fold.rs
 create mode 100644 nodedb-sql/src/planner/catalog_plan_shapes.rs
 create mode 100644 nodedb-sql/src/planner/catalog_plan_validate.rs
 create mode 100644 nodedb/src/control/cluster/calvin/scheduler/driver/core/commit_resolution_dispatch.rs
 create mode 100644 nodedb/src/control/server/shared/ddl/neutral/user/tenant_purge.rs
 create mode 100644 nodedb/src/control/server/shared/session/overlay_drop.rs
 create mode 100644 nodedb/tests/pg_catalog_regclass.rs
 create mode 100644 nodedb/tests/tenant_drop_owned_objects.rs

diff --git a/nodedb-client/src/native/connection/mod.rs b/nodedb-client/src/native/connection/mod.rs
index e6db85703..d610c3c31 100644
--- a/nodedb-client/src/native/connection/mod.rs
+++ b/nodedb-client/src/native/connection/mod.rs
@@ -374,9 +374,9 @@ impl NativeConnection {
         self.stream.flush().await.map_err(io_err)?;
 
         let mut combined_rows: Vec<Vec<nodedb_types::Value>> = Vec::new();
-        let mut final_resp: Option<NativeResponse> = None;
+        let mut partial_columns: Option<Vec<String>> = None;
 
-        loop {
+        let final_resp = loop {
             let mut len_buf = [0u8; FRAME_HEADER_LEN];
             self.stream.read_exact(&mut len_buf).await.map_err(io_err)?;
             let resp_len = u32::from_be_bytes(len_buf);
@@ -397,29 +397,35 @@ impl NativeConnection {
             })?;
 
             if resp.status == ResponseStatus::Partial {
+                if partial_columns.is_none() {
+                    partial_columns = resp.columns;
+                }
                 if let Some(rows) = resp.rows {
                     combined_rows.extend(rows);
                 }
-                if final_resp.is_none() {
-                    final_resp = Some(NativeResponse { rows: None, ..resp });
-                }
-            } else {
-                if combined_rows.is_empty() {
-                    final_resp = Some(resp);
-                } else {
-                    if let Some(ref rows) = resp.rows {
-                        combined_rows.extend(rows.iter().cloned());
-                    }
-                    let mut merged = final_resp.unwrap_or(resp);
-                    merged.rows = Some(combined_rows);
-                    merged.status = ResponseStatus::Ok;
-                    final_resp = Some(merged);
-                }
-                break;
+                continue;
             }
-        }
 
-        final_resp.ok_or_else(|| NodeDbError::internal("no final response received"))
+            // The terminal frame owns status and all terminal metadata. In
+            // particular, never turn a stream error into success merely
+            // because earlier partial rows were received.
+            if resp.status == ResponseStatus::Error {
+                break resp;
+            }
+            let mut terminal = resp;
+            if let Some(rows) = terminal.rows.take() {
+                combined_rows.extend(rows);
+            }
+            if !combined_rows.is_empty() {
+                terminal.rows = Some(combined_rows);
+            }
+            if terminal.columns.is_none() {
+                terminal.columns = partial_columns;
+            }
+            break terminal;
+        };
+
+        Ok(final_resp)
     }
 }
 
diff --git a/nodedb-cluster-tests/tests/descriptor_versioning_cross_node.rs b/nodedb-cluster-tests/tests/descriptor_versioning_cross_node.rs
index 0389adb8d..7d317db80 100644
--- a/nodedb-cluster-tests/tests/descriptor_versioning_cross_node.rs
+++ b/nodedb-cluster-tests/tests/descriptor_versioning_cross_node.rs
@@ -19,7 +19,7 @@ mod common;
 
 use std::time::Duration;
 
-use common::cluster_harness::{TestCluster, wait_for};
+use common::cluster_harness::{TestCluster, TestClusterNode, wait_for};
 
 const TENANT: u64 = 1;
 
@@ -144,6 +144,49 @@ async fn alter_collection_bumps_version_monotonically() {
     cluster.shutdown().await;
 }
 
+#[tokio::test(flavor = "multi_thread", worker_threads = 6)]
+async fn concurrent_cross_node_updates_allocate_distinct_descriptor_versions() {
+    let cluster = TestCluster::spawn_three().await.expect("3-node cluster");
+    cluster
+        .exec_ddl_on_any_leader("CREATE USER owner_a WITH PASSWORD 'pw' ROLE READWRITE")
+        .await
+        .expect("create owner_a");
+    cluster
+        .exec_ddl_on_any_leader("CREATE USER owner_b WITH PASSWORD 'pw' ROLE READWRITE")
+        .await
+        .expect("create owner_b");
+    cluster
+        .exec_ddl_on_any_leader("CREATE COLLECTION concurrently_owned")
+        .await
+        .expect("create collection");
+
+    let update_a = cluster.nodes[0]
+        .client
+        .simple_query("ALTER COLLECTION concurrently_owned OWNER TO owner_a");
+    let update_b = cluster.nodes[1]
+        .client
+        .simple_query("ALTER COLLECTION concurrently_owned OWNER TO owner_b");
+    let (result_a, result_b) = tokio::join!(update_a, update_b);
+    result_a.expect("node 0 concurrent owner update");
+    result_b.expect("node 1 concurrent owner update");
+
+    wait_for(
+        "both concurrent updates apply as distinct versions on every node",
+        Duration::from_secs(15),
+        Duration::from_millis(50),
+        || {
+            cluster.nodes.iter().all(|node| {
+                node.collection_descriptor(TENANT, "concurrently_owned")
+                    .map(|stamp| stamp.0)
+                    == Some(3)
+            })
+        },
+    )
+    .await;
+
+    cluster.shutdown().await;
+}
+
 #[tokio::test(flavor = "multi_thread", worker_threads = 6)]
 async fn distinct_collections_get_independent_versions() {
     let cluster = TestCluster::spawn_three().await.expect("3-node cluster");
@@ -187,3 +230,113 @@ async fn distinct_collections_get_independent_versions() {
 
     cluster.shutdown().await;
 }
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 6)]
+async fn historical_descriptor_entries_replay_without_regressing_the_latest_version() {
+    let data_dir = tempfile::tempdir().expect("tempdir");
+    let data_path = data_dir.path().to_path_buf();
+    let node = TestClusterNode::spawn_single_node_calvin_on_path(4, data_path.clone())
+        .await
+        .expect("spawn single-node metadata group");
+    wait_for(
+        "single-node sequencer leader elected",
+        Duration::from_secs(10),
+        Duration::from_millis(50),
+        || node.sequencer_leader() == node.node_id,
+    )
+    .await;
+    wait_for(
+        "single-node metadata leader elected",
+        Duration::from_secs(10),
+        Duration::from_millis(50),
+        || node.shared.is_metadata_leader(),
+    )
+    .await;
+
+    node.client
+        .simple_query(
+            "CREATE COLLECTION replay_graph (id TEXT PRIMARY KEY, name TEXT) \
+             WITH (engine='document_strict')",
+        )
+        .await
+        .expect("create graph-bearing collection");
+    wait_for(
+        "collection descriptor reaches version 1",
+        Duration::from_secs(10),
+        Duration::from_millis(50),
+        || {
+            node.collection_descriptor(TENANT, "replay_graph")
+                .map(|v| v.0)
+                == Some(1)
+        },
+    )
+    .await;
+
+    node.client
+        .simple_query(
+            "GRAPH INSERT EDGE IN replay_graph FROM 'a' TO 'b' \
+             TYPE 'knows' PROPERTIES '{}'",
+        )
+        .await
+        .expect("insert edge and mark collection edge-bearing");
+    wait_for(
+        "edge-bearing descriptor reaches version 2",
+        Duration::from_secs(10),
+        Duration::from_millis(50),
+        || {
+            node.collection_descriptor(TENANT, "replay_graph")
+                .map(|v| v.0)
+                == Some(2)
+        },
+    )
+    .await;
+
+    node.graceful_shutdown_wal_only().await;
+    let node = TestClusterNode::spawn_single_node_calvin_on_path(4, data_path)
+        .await
+        .expect("restart against the persisted catalog and full metadata log");
+    wait_for(
+        "single-node sequencer leader re-elected after restart",
+        Duration::from_secs(10),
+        Duration::from_millis(50),
+        || node.sequencer_leader() == node.node_id,
+    )
+    .await;
+    wait_for(
+        "single-node metadata leader re-elected after restart",
+        Duration::from_secs(10),
+        Duration::from_millis(50),
+        || node.shared.is_metadata_leader(),
+    )
+    .await;
+
+    wait_for(
+        "latest collection descriptor remains visible after replay",
+        Duration::from_secs(10),
+        Duration::from_millis(50),
+        || {
+            node.collection_descriptor(TENANT, "replay_graph")
+                .map(|v| v.0)
+                == Some(2)
+        },
+    )
+    .await;
+
+    node.client
+        .simple_query(
+            "CREATE COLLECTION ddl_after_descriptor_replay \
+             (id TEXT PRIMARY KEY) WITH (engine='document_strict')",
+        )
+        .await
+        .expect(
+            "historical metadata replay must advance its watermark so later DDL remains usable",
+        );
+    assert_eq!(
+        node.collection_descriptor(TENANT, "replay_graph")
+            .map(|version| version.0),
+        Some(2),
+        "replaying historical version 1 must not overwrite the persisted latest version 2"
+    );
+
+    node.shutdown().await;
+}
diff --git a/nodedb-cluster-tests/tests/single_node_calvin_graph_txn.rs b/nodedb-cluster-tests/tests/single_node_calvin_graph_txn.rs
index 5272044a0..a56ceff65 100644
--- a/nodedb-cluster-tests/tests/single_node_calvin_graph_txn.rs
+++ b/nodedb-cluster-tests/tests/single_node_calvin_graph_txn.rs
@@ -51,16 +51,30 @@ fn sequencer_leader(node: &TestClusterNode) -> u64 {
 /// between them is genuinely cross-shard. Deterministic: `VShardId::from_key` is
 /// a pure function of the key bytes, and it is how `insert_edge` homes each
 /// endpoint. Same key-picking approach as the sibling `single_node_calvin` suite.
-fn distinct_vshard_node_keys() -> (String, String) {
+fn distinct_core_node_keys(num_cores: u32) -> (String, String) {
     let dst = "sncgtx_hub".to_string();
     let vdst = VShardId::from_key(dst.as_bytes()).as_u32();
     for i in 0u32..4096 {
         let src = format!("sncgtx_src_{i}");
-        if VShardId::from_key(src.as_bytes()).as_u32() != vdst {
+        let vsrc = VShardId::from_key(src.as_bytes()).as_u32();
+        if vsrc != vdst && vsrc % num_cores != vdst % num_cores {
             return (src, dst);
         }
     }
-    panic!("could not find a node key on a distinct vShard from the hub in 4096 tries");
+    panic!("could not find node keys on distinct vShards and cores in 4096 tries");
+}
+
+fn another_source_on_distinct_core(num_cores: u32, first: &str, dst: &str) -> String {
+    let first_core = VShardId::from_key(first.as_bytes()).as_u32() % num_cores;
+    let dst_core = VShardId::from_key(dst.as_bytes()).as_u32() % num_cores;
+    for i in 0u32..4096 {
+        let candidate = format!("sncgtx_other_src_{i}");
+        let core = VShardId::from_key(candidate.as_bytes()).as_u32() % num_cores;
+        if candidate != first && core != first_core && core != dst_core {
+            return candidate;
+        }
+    }
+    panic!("could not find a second source on a distinct core");
 }
 
 /// Run `GRAPH NEIGHBORS OF '<node>' LABEL '<label>' DIRECTION <dir>` and return
@@ -126,7 +140,7 @@ async fn dual_home_edge_stages_both_overlays_and_rollback_tears_down() {
     )
     .await;
 
-    let (src, dst) = distinct_vshard_node_keys();
+    let (src, dst) = distinct_core_node_keys(4);
     let label = "l";
 
     node.client.simple_query("BEGIN").await.expect("BEGIN");
@@ -183,3 +197,202 @@ async fn dual_home_edge_stages_both_overlays_and_rollback_tears_down() {
 
     node.shutdown().await;
 }
+
+/// Calvin publishes one lightweight Control change event per committed
+/// participant-local document write, ordered by each participant's durable LSN.
+/// A rolled-back transaction publishes nothing.
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+async fn calvin_commit_publishes_control_changes_at_participant_lsns() {
+    let node = TestClusterNode::spawn_single_node_calvin(4)
+        .await
+        .expect("spawn standalone single-node-calvin server");
+    wait_for(
+        "single-node sequencer leader elected",
+        Duration::from_secs(10),
+        Duration::from_millis(50),
+        || sequencer_leader(&node) == node.node_id,
+    )
+    .await;
+
+    let first = "sncgtx_cdc_a";
+    let second = (0..4096)
+        .map(|i| format!("sncgtx_cdc_b_{i}"))
+        .find(|candidate| {
+            VShardId::from_collection_in_database(nodedb_types::DatabaseId::DEFAULT, candidate)
+                != VShardId::from_collection_in_database(nodedb_types::DatabaseId::DEFAULT, first)
+        })
+        .expect("collection on a distinct vShard");
+    for collection in [first, second.as_str()] {
+        node.client
+            .simple_query(&format!(
+                "CREATE COLLECTION {collection} (id TEXT PRIMARY KEY, value TEXT)"
+            ))
+            .await
+            .expect("create CDC collection");
+    }
+
+    let mut subscription = node.shared.change_stream.subscribe(None, None);
+    node.client.simple_query("BEGIN").await.expect("BEGIN");
+    node.client
+        .simple_query(&format!(
+            "INSERT INTO {first} (id, value) VALUES ('a', 'one')"
+        ))
+        .await
+        .expect("stage first write");
+    node.client
+        .simple_query(&format!(
+            "INSERT INTO {second} (id, value) VALUES ('b', 'two')"
+        ))
+        .await
+        .expect("stage second write");
+    node.client.simple_query("COMMIT").await.expect("COMMIT");
+
+    let mut collections = std::collections::BTreeSet::new();
+    for _ in 0..2 {
+        let event = tokio::time::timeout(Duration::from_secs(5), subscription.recv_filtered())
+            .await
+            .expect("committed Calvin write must publish a Control event")
+            .expect("change-stream receiver remains open");
+        assert_ne!(
+            event.lsn.as_u64(),
+            0,
+            "CDC event must carry participant LSN"
+        );
+        collections.insert(event.collection);
+    }
+    assert_eq!(
+        collections,
+        std::collections::BTreeSet::from([first.to_string(), second.clone()])
+    );
+    assert!(
+        tokio::time::timeout(Duration::from_millis(500), subscription.recv_filtered())
+            .await
+            .is_err(),
+        "each logical write must publish exactly once"
+    );
+
+    node.client
+        .simple_query("BEGIN")
+        .await
+        .expect("second BEGIN");
+    node.client
+        .simple_query(&format!(
+            "INSERT INTO {first} (id, value) VALUES ('aborted', 'no')"
+        ))
+        .await
+        .expect("stage aborted write");
+    node.client
+        .simple_query("ROLLBACK")
+        .await
+        .expect("ROLLBACK");
+    assert!(
+        tokio::time::timeout(Duration::from_millis(500), subscription.recv_filtered())
+            .await
+            .is_err(),
+        "aborted Calvin write must not publish a Control event"
+    );
+
+    node.shutdown().await;
+}
+
+/// A dual-home edge has two physical endpoint representations but is one
+/// logical edge. Stats must deduplicate those representations rather than
+/// exposing storage topology in user-visible cardinalities.
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+async fn dual_home_edge_counts_once_in_graph_stats() {
+    let node = TestClusterNode::spawn_single_node_calvin(4)
+        .await
+        .expect("spawn standalone single-node-calvin server");
+    wait_for(
+        "single-node sequencer leader elected",
+        Duration::from_secs(10),
+        Duration::from_millis(50),
+        || sequencer_leader(&node) == node.node_id,
+    )
+    .await;
+    wait_for(
+        "single-node metadata leader elected",
+        Duration::from_secs(10),
+        Duration::from_millis(50),
+        || node.shared.is_metadata_leader(),
+    )
+    .await;
+
+    node.client
+        .simple_query(
+            "CREATE COLLECTION sncgtx_stats (id TEXT PRIMARY KEY, name TEXT) \
+             WITH (engine='document_strict')",
+        )
+        .await
+        .expect("create graph stats collection");
+    let (src, dst) = distinct_core_node_keys(4);
+    node.client
+        .simple_query(&format!(
+            "GRAPH INSERT EDGE IN sncgtx_stats FROM '{src}' TO '{dst}' \
+             TYPE 'knows' PROPERTIES '{{}}'"
+        ))
+        .await
+        .expect("insert first dual-home edge");
+    let other_src = another_source_on_distinct_core(4, &src, &dst);
+    node.client
+        .simple_query(&format!(
+            "GRAPH INSERT EDGE IN sncgtx_stats FROM '{other_src}' TO '{dst}' \
+             TYPE 'knows' PROPERTIES '{{}}'"
+        ))
+        .await
+        .expect("insert second edge sharing the destination");
+
+    let messages = node
+        .client
+        .simple_query("SHOW GRAPH STATS 'sncgtx_stats'")
+        .await
+        .expect("show graph stats");
+    let row = messages
+        .iter()
+        .find_map(|message| match message {
+            tokio_postgres::SimpleQueryMessage::Row(row) => Some(row),
+            _ => None,
+        })
+        .expect("graph stats row");
+
+    assert_eq!(row.get("node_count"), Some("3"));
+    assert_eq!(row.get("edge_count"), Some("2"));
+    let labels: serde_json::Value =
+        serde_json::from_str(row.get("labels").expect("labels JSON")).expect("valid labels JSON");
+    assert_eq!(labels[0]["label"], "knows");
+    assert_eq!(labels[0]["count"], 2);
+
+    // Historical stats scan physical edge versions rather than live summary
+    // counters. It must union the two endpoint-home replicas by logical edge
+    // identity instead of reintroducing the same doubled cardinality.
+    let future_ms = std::time::SystemTime::now()
+        .duration_since(std::time::UNIX_EPOCH)
+        .expect("clock after epoch")
+        .as_millis() as i64
+        + 1_000;
+    let historical = node
+        .client
+        .simple_query(&format!(
+            "SHOW GRAPH STATS 'sncgtx_stats' AS OF SYSTEM TIME {future_ms}"
+        ))
+        .await
+        .expect("show historical graph stats");
+    let historical_row = historical
+        .iter()
+        .find_map(|message| match message {
+            tokio_postgres::SimpleQueryMessage::Row(row) => Some(row),
+            _ => None,
+        })
+        .expect("historical graph stats row");
+    assert_eq!(historical_row.get("node_count"), Some("3"));
+    assert_eq!(historical_row.get("edge_count"), Some("2"));
+    let historical_labels: serde_json::Value = serde_json::from_str(
+        historical_row
+            .get("labels")
+            .expect("historical labels JSON"),
+    )
+    .expect("valid historical labels JSON");
+    assert_eq!(historical_labels[0]["count"], 2);
+
+    node.shutdown().await;
+}
diff --git a/nodedb-cluster/src/calvin/types/transaction.rs b/nodedb-cluster/src/calvin/types/transaction.rs
index 05aeaaadd..bb7aef152 100644
--- a/nodedb-cluster/src/calvin/types/transaction.rs
+++ b/nodedb-cluster/src/calvin/types/transaction.rs
@@ -59,6 +59,11 @@ impl ReadWriteSet {
     /// serialized bytes remain deterministic regardless of how `VShardId`
     /// is computed.
     pub fn participating_vshards(&self) -> Vec<VShardId> {
+        self.participating_vshards_in_database(DatabaseId::DEFAULT)
+    }
+
+    /// Derive participants using database-scoped collection homes.
+    pub fn participating_vshards_in_database(&self, database_id: DatabaseId) -> Vec<VShardId> {
         let mut seen = std::collections::HashSet::new();
         let mut result = Vec::new();
         for engine_set in &self.0 {
@@ -74,10 +79,8 @@ impl ReadWriteSet {
                 EngineKeySet::Document { .. }
                 | EngineKeySet::Vector { .. }
                 | EngineKeySet::Kv { .. } => {
-                    let vshard = VShardId::from_collection_in_database(
-                        DatabaseId::DEFAULT,
-                        engine_set.collection(),
-                    );
+                    let vshard =
+                        VShardId::from_collection_in_database(database_id, engine_set.collection());
                     if seen.insert(vshard.as_u32()) {
                         result.push(vshard);
                     }
@@ -129,6 +132,10 @@ pub struct TxClass {
     /// Tenant scope. All keys in `read_set` and `write_set` must belong to
     /// this tenant; cross-tenant transactions are rejected at construction.
     pub tenant_id: TenantId,
+    /// Database scope used for collection homing, execution, WAL, and CDC.
+    #[serde(default)]
+    #[msgpack(default)]
+    pub database_id: DatabaseId,
     /// Optional dependent-read specification.
     ///
     /// When present, this transaction is a dependent-read Calvin txn: the
@@ -189,12 +196,34 @@ impl TxClass {
         tenant_id: TenantId,
         dependent_reads: Option<DependentReadSpec>,
         versioned_reads: VersionedReadSet,
+    ) -> Result<Self, CalvinError> {
+        Self::new_in_database(
+            read_set,
+            write_set,
+            plans,
+            tenant_id,
+            DatabaseId::DEFAULT,
+            dependent_reads,
+            versioned_reads,
+        )
+    }
+
+    /// Construct a validated multi-vshard class in an explicit database.
+    pub fn new_in_database(
+        read_set: ReadWriteSet,
+        write_set: ReadWriteSet,
+        plans: Vec<u8>,
+        tenant_id: TenantId,
+        database_id: DatabaseId,
+        dependent_reads: Option<DependentReadSpec>,
+        versioned_reads: VersionedReadSet,
     ) -> Result<Self, CalvinError> {
         Self::new_checked(
             read_set,
             write_set,
             plans,
             tenant_id,
+            database_id,
             dependent_reads,
             versioned_reads,
             false,
@@ -224,12 +253,34 @@ impl TxClass {
         tenant_id: TenantId,
         dependent_reads: Option<DependentReadSpec>,
         versioned_reads: VersionedReadSet,
+    ) -> Result<Self, CalvinError> {
+        Self::new_single_vshard_in_database(
+            read_set,
+            write_set,
+            plans,
+            tenant_id,
+            DatabaseId::DEFAULT,
+            dependent_reads,
+            versioned_reads,
+        )
+    }
+
+    /// Construct a single-vshard class in an explicit database.
+    pub fn new_single_vshard_in_database(
+        read_set: ReadWriteSet,
+        write_set: ReadWriteSet,
+        plans: Vec<u8>,
+        tenant_id: TenantId,
+        database_id: DatabaseId,
+        dependent_reads: Option<DependentReadSpec>,
+        versioned_reads: VersionedReadSet,
     ) -> Result<Self, CalvinError> {
         Self::new_checked(
             read_set,
             write_set,
             plans,
             tenant_id,
+            database_id,
             dependent_reads,
             versioned_reads,
             true,
@@ -239,11 +290,13 @@ impl TxClass {
     /// Shared construction body. `allow_single_vshard` relaxes the participant
     /// floor from 2 (multi-vshard) to 1 (single-vshard opt-in); an empty write
     /// set and a zero-participant write set are rejected on both paths.
+    #[allow(clippy::too_many_arguments)] // shared validation for both constructor modes
     fn new_checked(
         read_set: ReadWriteSet,
         write_set: ReadWriteSet,
         plans: Vec<u8>,
         tenant_id: TenantId,
+        database_id: DatabaseId,
         dependent_reads: Option<DependentReadSpec>,
         versioned_reads: VersionedReadSet,
         allow_single_vshard: bool,
@@ -251,7 +304,7 @@ impl TxClass {
         if write_set.is_empty() {
             return Err(CalvinError::EmptyWriteSet);
         }
-        let mut participating_vshards = write_set.participating_vshards();
+        let mut participating_vshards = write_set.participating_vshards_in_database(database_id);
         let min_participants = if allow_single_vshard { 1 } else { 2 };
         // The participant FLOOR is computed from the WRITE set ONLY, and BEFORE
         // the read-set union below: a txn that writes a single shard but reads N
@@ -270,7 +323,7 @@ impl TxClass {
         // `new_checked` and `restore_derived` — `participating_vshards` is
         // `#[serde(skip)]` and re-derived on decode, so an encoded and a decoded
         // `TxClass` would disagree on their participant set if the two diverged.
-        for v in read_set.participating_vshards() {
+        for v in read_set.participating_vshards_in_database(database_id) {
             if !participating_vshards
                 .iter()
                 .any(|e| e.as_u32() == v.as_u32())
@@ -299,6 +352,7 @@ impl TxClass {
             write_set,
             plans,
             tenant_id,
+            database_id,
             dependent_reads,
             versioned_reads,
             lock_owner: None,
@@ -341,11 +395,16 @@ impl TxClass {
     /// Call this immediately after deserializing a `TxClass` that came off
     /// the wire or out of the Raft log.
     pub fn restore_derived(&mut self) {
-        let mut vshards = self.write_set.participating_vshards();
+        let mut vshards = self
+            .write_set
+            .participating_vshards_in_database(self.database_id);
         // Union the read set's participating vShards — MUST match `new_checked`'s
         // union exactly so a decoded `TxClass` derives the identical participant
         // set the encoder computed (participants are not serialized).
-        for v in self.read_set.participating_vshards() {
+        for v in self
+            .read_set
+            .participating_vshards_in_database(self.database_id)
+        {
             if !vshards.iter().any(|e| e.as_u32() == v.as_u32()) {
                 vshards.push(v);
             }
@@ -444,6 +503,25 @@ mod tests {
     /// map-encoded with the original fields only. Proves an old serialized
     /// `TxClass` (no `versioned_reads` key) still decodes — the field defaults
     /// to empty — so Raft-logged transactions survive the schema addition.
+    #[test]
+    fn database_scope_survives_msgpack_roundtrip() {
+        let tx = TxClass::new_in_database(
+            ReadWriteSet::new(vec![]),
+            two_home_write_set(),
+            vec![0x01],
+            TenantId::new(1),
+            DatabaseId::new(9),
+            None,
+            VersionedReadSet::default(),
+        )
+        .expect("valid TxClass");
+        let bytes = zerompk::to_msgpack_vec(&tx).expect("encode");
+        let mut decoded: TxClass = zerompk::from_msgpack(&bytes).expect("decode");
+        decoded.restore_derived();
+        assert_eq!(decoded.database_id, DatabaseId::new(9));
+        assert_eq!(decoded.participating_vshards(), tx.participating_vshards());
+    }
+
     #[derive(zerompk::ToMessagePack)]
     #[msgpack(map)]
     struct LegacyTxClass {
@@ -469,6 +547,7 @@ mod tests {
         assert!(decoded.versioned_reads.is_empty());
         assert!(decoded.dependent_reads.is_none());
         assert_eq!(decoded.tenant_id, TenantId::new(3));
+        assert_eq!(decoded.database_id, DatabaseId::DEFAULT);
         assert_eq!(decoded.plans, vec![0x01, 0x02]);
         assert_eq!(decoded.participating_vshards().len(), 2);
     }
diff --git a/nodedb-cluster/src/metadata_group/cache.rs b/nodedb-cluster/src/metadata_group/cache.rs
index 79c1f8ec1..2e811516e 100644
--- a/nodedb-cluster/src/metadata_group/cache.rs
+++ b/nodedb-cluster/src/metadata_group/cache.rs
@@ -131,6 +131,13 @@ impl MetadataCache {
                 }
             }
             MetadataEntry::DescriptorDrainEnd { .. } => {}
+            MetadataEntry::DdlPrepareAcquire { .. } | MetadataEntry::DdlPrepareRelease { .. } => {
+                // Host-side ephemeral coordination state; replay rebuilds it.
+            }
+            MetadataEntry::DdlPrepared { .. } => {
+                // The host-side applier unwraps and fences this entry. The cache
+                // owns no preparation outcome state.
+            }
             MetadataEntry::CaTrustChange { .. } => {
                 // CA trust mutations are host-side only: the production
                 // applier in the nodedb crate writes/deletes
diff --git a/nodedb-cluster/src/metadata_group/entry.rs b/nodedb-cluster/src/metadata_group/entry.rs
index 06940ca30..4c0a10f25 100644
--- a/nodedb-cluster/src/metadata_group/entry.rs
+++ b/nodedb-cluster/src/metadata_group/entry.rs
@@ -77,6 +77,26 @@ pub enum MetadataEntry {
         entries: Vec<MetadataEntry>,
     },
 
+    /// A catalog DDL proposal fenced by the replicated preparation owner.
+    /// Appliers execute `entry` only while `token` is the current owner;
+    /// superseded proposals are deterministic no-ops so they cannot wedge the
+    /// Raft apply watermark.
+    DdlPrepared {
+        token: u64,
+        entry: Box<MetadataEntry>,
+    },
+
+    /// Acquire the replicated global descriptor-preparation lease. The first
+    /// unexpired owner wins; contenders observe the winner after this entry is
+    /// applied and retry after its matching release or expiry.
+    DdlPrepareAcquire {
+        token: u64,
+    },
+    /// Release the descriptor-preparation lease iff `token` still owns it.
+    DdlPrepareRelease {
+        token: u64,
+    },
+
     // ── Topology / routing ─────────────────────────────────────────────
     TopologyChange(TopologyChange),
     RoutingChange(RoutingChange),
diff --git a/nodedb-sql/src/catalog.rs b/nodedb-sql/src/catalog.rs
index 16bd048af..41aa91772 100644
--- a/nodedb-sql/src/catalog.rs
+++ b/nodedb-sql/src/catalog.rs
@@ -8,6 +8,74 @@ use thiserror::Error;
 use crate::types::CollectionInfo;
 use crate::types_array::{ArrayAttrAst, ArrayDimAst};
 
+/// Normalize the PostgreSQL identifier spelling accepted by `regclass` input.
+///
+/// Unquoted identifiers fold to lowercase, quoted identifiers preserve case and
+/// support doubled quote escapes. NodeDB currently exposes user relations in
+/// `public` and catalog relations in `pg_catalog`; those qualifiers resolve to
+/// the same canonical relation name used by the catalog adapters.
+pub fn normalize_regclass_name(input: &str) -> Option<String> {
+    fn parse_part(raw: &str) -> Option<String> {
+        let raw = raw.trim();
+        if raw.is_empty() {
+            return None;
+        }
+        if !raw.starts_with('"') {
+            return (!raw.contains('"')).then(|| raw.to_ascii_lowercase());
+        }
+
+        let mut chars = raw.char_indices().peekable();
+        chars.next();
+        let mut out = String::new();
+        let mut closed_at = None;
+        while let Some((idx, ch)) = chars.next() {
+            if ch != '"' {
+                out.push(ch);
+                continue;
+            }
+            if chars.peek().is_some_and(|(_, next)| *next == '"') {
+                chars.next();
+                out.push('"');
+            } else {
+                closed_at = Some(idx + ch.len_utf8());
+                break;
+            }
+        }
+        let end = closed_at?;
+        raw[end..].trim().is_empty().then_some(out)
+    }
+
+    let mut parts = Vec::new();
+    let mut quoted = false;
+    let mut start = 0;
+    let chars: Vec<(usize, char)> = input.char_indices().collect();
+    let mut i = 0;
+    while i < chars.len() {
+        let (idx, ch) = chars[i];
+        if ch == '"' {
+            if quoted && i + 1 < chars.len() && chars[i + 1].1 == '"' {
+                i += 2;
+                continue;
+            }
+            quoted = !quoted;
+        } else if ch == '.' && !quoted {
+            parts.push(parse_part(&input[start..idx])?);
+            start = idx + 1;
+        }
+        i += 1;
+    }
+    if quoted {
+        return None;
+    }
+    parts.push(parse_part(&input[start..])?);
+
+    match parts.as_slice() {
+        [name] => Some(name.clone()),
+        [schema, name] if schema == "public" || schema == "pg_catalog" => Some(name.clone()),
+        _ => None,
+    }
+}
+
 /// Errors surfaced by `SqlCatalog` implementations.
 ///
 /// Only one variant today — callers pattern-match directly and
diff --git a/nodedb-sql/src/planner/catalog_expr_fold.rs b/nodedb-sql/src/planner/catalog_expr_fold.rs
new file mode 100644
index 000000000..fd9dbfe79
--- /dev/null
+++ b/nodedb-sql/src/planner/catalog_expr_fold.rs
@@ -0,0 +1,223 @@
+// SPDX-License-Identifier: Apache-2.0
+
+//! Recursive catalog-dependent expression validation and folding.
+
+use nodedb_types::DatabaseId;
+
+use crate::catalog::SqlCatalog;
+use crate::functions::registry::FunctionRegistry;
+use crate::types::{SqlExpr, SqlValue};
+
+pub(super) fn eval_catalog_constant(
+    expr: &SqlExpr,
+    catalog: &dyn SqlCatalog,
+    functions: &FunctionRegistry,
+) -> crate::Result<SqlValue> {
+    if let SqlExpr::Cast {
+        expr: inner,
+        to_type,
+    } = expr
+        && to_type.eq_ignore_ascii_case("regclass")
+        && let SqlExpr::Literal(SqlValue::String(name)) = inner.as_ref()
+    {
+        let normalized = crate::catalog::normalize_regclass_name(name)
+            .ok_or_else(|| crate::SqlError::UnknownTable { name: name.clone() })?;
+        catalog
+            .resolve_regclass(DatabaseId::DEFAULT, 0, name)
+            .ok_or_else(|| crate::SqlError::UnknownTable {
+                name: normalized.clone(),
+            })?;
+        return Ok(SqlValue::String(normalized));
+    }
+    Ok(super::select::helpers::eval_constant_expr(expr, functions))
+}
+
+pub(super) fn validate_expr(
+    expr: &SqlExpr,
+    catalog: &dyn SqlCatalog,
+    database_id: DatabaseId,
+    tenant_id: u64,
+) -> crate::Result<()> {
+    match expr {
+        SqlExpr::Cast { expr, to_type }
+            if to_type.eq_ignore_ascii_case("regclass")
+                && matches!(expr.as_ref(), SqlExpr::Literal(SqlValue::String(_))) =>
+        {
+            let SqlExpr::Literal(SqlValue::String(name)) = expr.as_ref() else {
+                unreachable!();
+            };
+            if catalog
+                .resolve_regclass(database_id, tenant_id, name)
+                .is_none()
+            {
+                return Err(crate::SqlError::UnknownTable { name: name.clone() });
+            }
+            Ok(())
+        }
+        SqlExpr::Cast { expr, .. }
+        | SqlExpr::IsNull { expr, .. }
+        | SqlExpr::UnaryOp { expr, .. } => validate_expr(expr, catalog, database_id, tenant_id),
+        SqlExpr::BinaryOp { left, right, .. } => {
+            validate_expr(left, catalog, database_id, tenant_id)?;
+            validate_expr(right, catalog, database_id, tenant_id)
+        }
+        SqlExpr::InList { expr, list, .. } => {
+            validate_expr(expr, catalog, database_id, tenant_id)?;
+            for item in list {
+                validate_expr(item, catalog, database_id, tenant_id)?;
+            }
+            Ok(())
+        }
+        SqlExpr::ArrayLiteral(items) | SqlExpr::Function { args: items, .. } => {
+            for item in items {
+                validate_expr(item, catalog, database_id, tenant_id)?;
+            }
+            Ok(())
+        }
+        SqlExpr::Between {
+            expr, low, high, ..
+        } => {
+            validate_expr(expr, catalog, database_id, tenant_id)?;
+            validate_expr(low, catalog, database_id, tenant_id)?;
+            validate_expr(high, catalog, database_id, tenant_id)
+        }
+        SqlExpr::Like { expr, pattern, .. } => {
+            validate_expr(expr, catalog, database_id, tenant_id)?;
+            validate_expr(pattern, catalog, database_id, tenant_id)
+        }
+        SqlExpr::Case {
+            operand,
+            when_then,
+            else_expr,
+        } => {
+            if let Some(operand) = operand {
+                validate_expr(operand, catalog, database_id, tenant_id)?;
+            }
+            for (when, then) in when_then {
+                validate_expr(when, catalog, database_id, tenant_id)?;
+                validate_expr(then, catalog, database_id, tenant_id)?;
+            }
+            if let Some(expr) = else_expr {
+                validate_expr(expr, catalog, database_id, tenant_id)?;
+            }
+            Ok(())
+        }
+        _ => Ok(()),
+    }
+}
+
+/// Recursively fold catalog-dependent expressions to constants.
+pub(super) fn fold_expr(
+    expr: SqlExpr,
+    catalog: &dyn SqlCatalog,
+    database_id: DatabaseId,
+    tenant_id: u64,
+) -> SqlExpr {
+    match expr {
+        SqlExpr::Cast {
+            expr: inner_expr,
+            to_type,
+        } => {
+            let upper = to_type.to_ascii_uppercase();
+            if upper == "REGCLASS" {
+                if let SqlExpr::Literal(SqlValue::String(ref name)) = *inner_expr
+                    && let Some(oid) = catalog.resolve_regclass(database_id, tenant_id, name)
+                {
+                    return SqlExpr::Literal(SqlValue::Int(oid));
+                }
+            } else if upper == "REGTYPE"
+                && let SqlExpr::Literal(SqlValue::String(ref name)) = *inner_expr
+                && let Some(oid) = catalog.resolve_regtype(name)
+            {
+                return SqlExpr::Literal(SqlValue::Int(oid));
+            }
+            SqlExpr::Cast {
+                expr: Box::new(fold_expr(*inner_expr, catalog, database_id, tenant_id)),
+                to_type,
+            }
+        }
+        SqlExpr::BinaryOp { left, op, right } => SqlExpr::BinaryOp {
+            left: Box::new(fold_expr(*left, catalog, database_id, tenant_id)),
+            op,
+            right: Box::new(fold_expr(*right, catalog, database_id, tenant_id)),
+        },
+        SqlExpr::InList {
+            expr,
+            list,
+            negated,
+        } => SqlExpr::InList {
+            expr: Box::new(fold_expr(*expr, catalog, database_id, tenant_id)),
+            list: list
+                .into_iter()
+                .map(|e| fold_expr(e, catalog, database_id, tenant_id))
+                .collect(),
+            negated,
+        },
+        SqlExpr::IsNull { expr, negated } => SqlExpr::IsNull {
+            expr: Box::new(fold_expr(*expr, catalog, database_id, tenant_id)),
+            negated,
+        },
+        SqlExpr::UnaryOp { op, expr } => SqlExpr::UnaryOp {
+            op,
+            expr: Box::new(fold_expr(*expr, catalog, database_id, tenant_id)),
+        },
+        SqlExpr::ArrayLiteral(elems) => SqlExpr::ArrayLiteral(
+            elems
+                .into_iter()
+                .map(|e| fold_expr(e, catalog, database_id, tenant_id))
+                .collect(),
+        ),
+        SqlExpr::Function {
+            name,
+            args,
+            distinct,
+        } => SqlExpr::Function {
+            name,
+            args: args
+                .into_iter()
+                .map(|arg| fold_expr(arg, catalog, database_id, tenant_id))
+                .collect(),
+            distinct,
+        },
+        SqlExpr::Between {
+            expr,
+            low,
+            high,
+            negated,
+        } => SqlExpr::Between {
+            expr: Box::new(fold_expr(*expr, catalog, database_id, tenant_id)),
+            low: Box::new(fold_expr(*low, catalog, database_id, tenant_id)),
+            high: Box::new(fold_expr(*high, catalog, database_id, tenant_id)),
+            negated,
+        },
+        SqlExpr::Like {
+            expr,
+            pattern,
+            negated,
+            case_insensitive,
+        } => SqlExpr::Like {
+            expr: Box::new(fold_expr(*expr, catalog, database_id, tenant_id)),
+            pattern: Box::new(fold_expr(*pattern, catalog, database_id, tenant_id)),
+            negated,
+            case_insensitive,
+        },
+        SqlExpr::Case {
+            operand,
+            when_then,
+            else_expr,
+        } => SqlExpr::Case {
+            operand: operand.map(|e| Box::new(fold_expr(*e, catalog, database_id, tenant_id))),
+            when_then: when_then
+                .into_iter()
+                .map(|(when, then)| {
+                    (
+                        fold_expr(when, catalog, database_id, tenant_id),
+                        fold_expr(then, catalog, database_id, tenant_id),
+                    )
+                })
+                .collect(),
+            else_expr: else_expr.map(|e| Box::new(fold_expr(*e, catalog, database_id, tenant_id))),
+        },
+        leaf => leaf,
+    }
+}
diff --git a/nodedb-sql/src/planner/catalog_fold.rs b/nodedb-sql/src/planner/catalog_fold.rs
index b7697f27e..fb3de973f 100644
--- a/nodedb-sql/src/planner/catalog_fold.rs
+++ b/nodedb-sql/src/planner/catalog_fold.rs
@@ -12,7 +12,11 @@
 use nodedb_types::DatabaseId;
 
 use crate::catalog::SqlCatalog;
-use crate::types::{Filter, FilterExpr, SqlExpr, SqlPlan, SqlValue};
+use crate::types::{Filter, FilterExpr, MergePlanAction, SqlExpr, SqlPlan};
+
+use super::catalog_expr_fold::fold_expr;
+use super::catalog_plan_shapes::{fold_aggregates, fold_projection, fold_sort_keys, fold_windows};
+use super::catalog_plan_validate::validate_catalog_exprs;
 
 /// Walk every `Filter` in `plan` and fold catalog-dependent cast expressions
 /// to their constant OID equivalents.
@@ -25,8 +29,9 @@ pub fn fold_catalog_exprs_in_plan(
     catalog: &dyn SqlCatalog,
     database_id: DatabaseId,
     tenant_id: u64,
-) -> SqlPlan {
-    walk_plan(plan, catalog, database_id, tenant_id)
+) -> crate::Result<SqlPlan> {
+    validate_catalog_exprs(&plan, catalog, database_id, tenant_id)?;
+    Ok(walk_plan(plan, catalog, database_id, tenant_id))
 }
 
 fn walk_plan(
@@ -41,17 +46,20 @@ fn walk_plan(
             alias,
             engine,
             mut filters,
-            projection,
-            sort_keys,
+            mut projection,
+            mut sort_keys,
             limit,
             offset,
             distinct,
-            window_functions,
+            mut window_functions,
             temporal,
         } => {
             for f in &mut filters {
                 fold_filter(f, catalog, database_id, tenant_id);
             }
+            fold_projection(&mut projection, catalog, database_id, tenant_id);
+            fold_sort_keys(&mut sort_keys, catalog, database_id, tenant_id);
+            fold_windows(&mut window_functions, catalog, database_id, tenant_id);
             SqlPlan::Scan {
                 collection,
                 alias,
@@ -67,6 +75,34 @@ fn walk_plan(
             }
         }
 
+        SqlPlan::Union { inputs, distinct } => SqlPlan::Union {
+            inputs: inputs
+                .into_iter()
+                .map(|input| walk_plan(input, catalog, database_id, tenant_id))
+                .collect(),
+            distinct,
+        },
+
+        SqlPlan::Intersect { left, right, all } => SqlPlan::Intersect {
+            left: Box::new(walk_plan(*left, catalog, database_id, tenant_id)),
+            right: Box::new(walk_plan(*right, catalog, database_id, tenant_id)),
+            all,
+        },
+
+        SqlPlan::Except { left, right, all } => SqlPlan::Except {
+            left: Box::new(walk_plan(*left, catalog, database_id, tenant_id)),
+            right: Box::new(walk_plan(*right, catalog, database_id, tenant_id)),
+            all,
+        },
+
+        SqlPlan::Cte { definitions, outer } => SqlPlan::Cte {
+            definitions: definitions
+                .into_iter()
+                .map(|(name, plan)| (name, walk_plan(plan, catalog, database_id, tenant_id)))
+                .collect(),
+            outer: Box::new(walk_plan(*outer, catalog, database_id, tenant_id)),
+        },
+
         SqlPlan::Join {
             left,
             right,
@@ -74,13 +110,14 @@ fn walk_plan(
             join_type,
             condition,
             limit,
-            projection,
+            mut projection,
             mut filters,
         } => {
             for f in &mut filters {
                 fold_filter(f, catalog, database_id, tenant_id);
             }
             let condition = condition.map(|e| fold_expr(e, catalog, database_id, tenant_id));
+            fold_projection(&mut projection, catalog, database_id, tenant_id);
             SqlPlan::Join {
                 left: Box::new(walk_plan(*left, catalog, database_id, tenant_id)),
                 right: Box::new(walk_plan(*right, catalog, database_id, tenant_id)),
@@ -93,7 +130,226 @@ fn walk_plan(
             }
         }
 
-        // All other plan variants are passed through unchanged.
+        mut plan @ (SqlPlan::PointGet { .. } | SqlPlan::RangeScan { .. }) => {
+            match &mut plan {
+                SqlPlan::PointGet { projection, .. } | SqlPlan::RangeScan { projection, .. } => {
+                    fold_projection(projection, catalog, database_id, tenant_id);
+                }
+                _ => unreachable!(),
+            }
+            plan
+        }
+
+        mut plan @ (SqlPlan::DocumentIndexLookup { .. }
+        | SqlPlan::Update { .. }
+        | SqlPlan::Delete { .. }) => {
+            match &mut plan {
+                SqlPlan::DocumentIndexLookup {
+                    filters,
+                    projection,
+                    sort_keys,
+                    window_functions,
+                    ..
+                } => {
+                    for filter in filters {
+                        fold_filter(filter, catalog, database_id, tenant_id);
+                    }
+                    fold_projection(projection, catalog, database_id, tenant_id);
+                    fold_sort_keys(sort_keys, catalog, database_id, tenant_id);
+                    fold_windows(window_functions, catalog, database_id, tenant_id);
+                }
+                SqlPlan::Delete { filters, .. } => {
+                    for filter in filters {
+                        fold_filter(filter, catalog, database_id, tenant_id);
+                    }
+                }
+                SqlPlan::Update {
+                    assignments,
+                    filters,
+                    ..
+                } => {
+                    for (_, expr) in assignments {
+                        let owned = std::mem::replace(expr, SqlExpr::Wildcard);
+                        *expr = fold_expr(owned, catalog, database_id, tenant_id);
+                    }
+                    for filter in filters {
+                        fold_filter(filter, catalog, database_id, tenant_id);
+                    }
+                }
+                _ => unreachable!(),
+            }
+            plan
+        }
+
+        SqlPlan::UpdateFrom {
+            collection,
+            engine,
+            source,
+            target_join_col,
+            source_join_col,
+            mut assignments,
+            mut target_filters,
+            returning,
+        } => {
+            for (_, expr) in &mut assignments {
+                let owned = std::mem::replace(expr, SqlExpr::Wildcard);
+                *expr = fold_expr(owned, catalog, database_id, tenant_id);
+            }
+            for filter in &mut target_filters {
+                fold_filter(filter, catalog, database_id, tenant_id);
+            }
+            SqlPlan::UpdateFrom {
+                collection,
+                engine,
+                source: Box::new(walk_plan(*source, catalog, database_id, tenant_id)),
+                target_join_col,
+                source_join_col,
+                assignments,
+                target_filters,
+                returning,
+            }
+        }
+
+        SqlPlan::InsertSelect {
+            target,
+            source,
+            limit,
+        } => SqlPlan::InsertSelect {
+            target,
+            source: Box::new(walk_plan(*source, catalog, database_id, tenant_id)),
+            limit,
+        },
+
+        SqlPlan::Aggregate {
+            input,
+            mut group_by,
+            group_by_aliases,
+            output_order,
+            mut aggregates,
+            mut having,
+            limit,
+            grouping_sets,
+            mut sort_keys,
+        } => {
+            for expr in &mut group_by {
+                let owned = std::mem::replace(expr, SqlExpr::Wildcard);
+                *expr = fold_expr(owned, catalog, database_id, tenant_id);
+            }
+            fold_aggregates(&mut aggregates, catalog, database_id, tenant_id);
+            for filter in &mut having {
+                fold_filter(filter, catalog, database_id, tenant_id);
+            }
+            fold_sort_keys(&mut sort_keys, catalog, database_id, tenant_id);
+            SqlPlan::Aggregate {
+                input: Box::new(walk_plan(*input, catalog, database_id, tenant_id)),
+                group_by,
+                group_by_aliases,
+                output_order,
+                aggregates,
+                having,
+                limit,
+                grouping_sets,
+                sort_keys,
+            }
+        }
+
+        SqlPlan::LateralTopK {
+            outer,
+            outer_alias,
+            inner_collection,
+            mut inner_filters,
+            mut inner_order_by,
+            inner_limit,
+            correlation_keys,
+            lateral_alias,
+            mut projection,
+            left_join,
+        } => {
+            for filter in &mut inner_filters {
+                fold_filter(filter, catalog, database_id, tenant_id);
+            }
+            fold_sort_keys(&mut inner_order_by, catalog, database_id, tenant_id);
+            fold_projection(&mut projection, catalog, database_id, tenant_id);
+            SqlPlan::LateralTopK {
+                outer: Box::new(walk_plan(*outer, catalog, database_id, tenant_id)),
+                outer_alias,
+                inner_collection,
+                inner_filters,
+                inner_order_by,
+                inner_limit,
+                correlation_keys,
+                lateral_alias,
+                projection,
+                left_join,
+            }
+        }
+
+        SqlPlan::LateralLoop {
+            outer,
+            outer_alias,
+            inner,
+            correlation_predicates,
+            lateral_alias,
+            mut projection,
+            outer_row_cap,
+            left_join,
+        } => {
+            fold_projection(&mut projection, catalog, database_id, tenant_id);
+            SqlPlan::LateralLoop {
+                outer: Box::new(walk_plan(*outer, catalog, database_id, tenant_id)),
+                outer_alias,
+                inner: Box::new(walk_plan(*inner, catalog, database_id, tenant_id)),
+                correlation_predicates,
+                lateral_alias,
+                projection,
+                outer_row_cap,
+                left_join,
+            }
+        }
+
+        SqlPlan::Merge {
+            target,
+            engine,
+            source,
+            target_join_col,
+            source_join_col,
+            source_alias,
+            mut clauses,
+            returning,
+        } => {
+            for clause in &mut clauses {
+                for filter in &mut clause.extra_predicate {
+                    fold_filter(filter, catalog, database_id, tenant_id);
+                }
+                match &mut clause.action {
+                    MergePlanAction::Update { assignments } => {
+                        for (_, expr) in assignments {
+                            let owned = std::mem::replace(expr, SqlExpr::Wildcard);
+                            *expr = fold_expr(owned, catalog, database_id, tenant_id);
+                        }
+                    }
+                    MergePlanAction::Insert { values, .. } => {
+                        for expr in values {
+                            let owned = std::mem::replace(expr, SqlExpr::Wildcard);
+                            *expr = fold_expr(owned, catalog, database_id, tenant_id);
+                        }
+                    }
+                    MergePlanAction::Delete | MergePlanAction::DoNothing => {}
+                }
+            }
+            SqlPlan::Merge {
+                target,
+                engine,
+                source: Box::new(walk_plan(*source, catalog, database_id, tenant_id)),
+                target_join_col,
+                source_join_col,
+                source_alias,
+                clauses,
+                returning,
+            }
+        }
+
+        // Plan variants without expression-bearing filters pass through unchanged.
         other => other,
     }
 }
@@ -134,142 +390,3 @@ fn fold_filter_expr(
         | FilterExpr::IsNotNull { .. } => {}
     }
 }
-
-/// Recursively fold catalog-dependent expressions to constants.
-fn fold_expr(
-    expr: SqlExpr,
-    catalog: &dyn SqlCatalog,
-    database_id: DatabaseId,
-    tenant_id: u64,
-) -> SqlExpr {
-    match expr {
-        // `'name'::regclass` or `'name'::regtype` → OID literal.
-        // We match on both in a single arm to avoid partial-move issues.
-        SqlExpr::Cast {
-            expr: inner_expr,
-            to_type,
-        } => {
-            let upper = to_type.to_ascii_uppercase();
-            if upper == "REGCLASS" {
-                if let SqlExpr::Literal(SqlValue::String(ref name)) = *inner_expr
-                    && let Some(oid) = catalog.resolve_regclass(database_id, tenant_id, name)
-                {
-                    return SqlExpr::Literal(SqlValue::Int(oid));
-                }
-            } else if upper == "REGTYPE"
-                && let SqlExpr::Literal(SqlValue::String(ref name)) = *inner_expr
-                && let Some(oid) = catalog.resolve_regtype(name)
-            {
-                return SqlExpr::Literal(SqlValue::Int(oid));
-            }
-            // Non-catalog cast: recurse into inner expression.
-            SqlExpr::Cast {
-                expr: Box::new(fold_expr(*inner_expr, catalog, database_id, tenant_id)),
-                to_type,
-            }
-        }
-
-        // Recurse into BinaryOp children.
-        SqlExpr::BinaryOp { left, op, right } => SqlExpr::BinaryOp {
-            left: Box::new(fold_expr(*left, catalog, database_id, tenant_id)),
-            op,
-            right: Box::new(fold_expr(*right, catalog, database_id, tenant_id)),
-        },
-
-        // Recurse into InList.
-        SqlExpr::InList {
-            expr,
-            list,
-            negated,
-        } => SqlExpr::InList {
-            expr: Box::new(fold_expr(*expr, catalog, database_id, tenant_id)),
-            list: list
-                .into_iter()
-                .map(|e| fold_expr(e, catalog, database_id, tenant_id))
-                .collect(),
-            negated,
-        },
-
-        // Recurse into IsNull.
-        SqlExpr::IsNull { expr, negated } => SqlExpr::IsNull {
-            expr: Box::new(fold_expr(*expr, catalog, database_id, tenant_id)),
-            negated,
-        },
-
-        // Recurse into UnaryOp.
-        SqlExpr::UnaryOp { op, expr } => SqlExpr::UnaryOp {
-            op,
-            expr: Box::new(fold_expr(*expr, catalog, database_id, tenant_id)),
-        },
-
-        // Recurse into ArrayLiteral elements.
-        SqlExpr::ArrayLiteral(elems) => SqlExpr::ArrayLiteral(
-            elems
-                .into_iter()
-                .map(|e| fold_expr(e, catalog, database_id, tenant_id))
-                .collect(),
-        ),
-
-        // Recurse into Function args.
-        SqlExpr::Function {
-            name,
-            args,
-            distinct,
-        } => SqlExpr::Function {
-            name,
-            args: args
-                .into_iter()
-                .map(|a| fold_expr(a, catalog, database_id, tenant_id))
-                .collect(),
-            distinct,
-        },
-
-        // Recurse into Between bounds.
-        SqlExpr::Between {
-            expr,
-            low,
-            high,
-            negated,
-        } => SqlExpr::Between {
-            expr: Box::new(fold_expr(*expr, catalog, database_id, tenant_id)),
-            low: Box::new(fold_expr(*low, catalog, database_id, tenant_id)),
-            high: Box::new(fold_expr(*high, catalog, database_id, tenant_id)),
-            negated,
-        },
-
-        // Recurse into Like.
-        SqlExpr::Like {
-            expr,
-            pattern,
-            negated,
-            case_insensitive,
-        } => SqlExpr::Like {
-            expr: Box::new(fold_expr(*expr, catalog, database_id, tenant_id)),
-            pattern: Box::new(fold_expr(*pattern, catalog, database_id, tenant_id)),
-            negated,
-            case_insensitive,
-        },
-
-        // Recurse into Case.
-        SqlExpr::Case {
-            operand,
-            when_then,
-            else_expr,
-        } => SqlExpr::Case {
-            operand: operand.map(|e| Box::new(fold_expr(*e, catalog, database_id, tenant_id))),
-            when_then: when_then
-                .into_iter()
-                .map(|(w, t)| {
-                    (
-                        fold_expr(w, catalog, database_id, tenant_id),
-                        fold_expr(t, catalog, database_id, tenant_id),
-                    )
-                })
-                .collect(),
-            else_expr: else_expr.map(|e| Box::new(fold_expr(*e, catalog, database_id, tenant_id))),
-        },
-
-        // Leaf nodes: Column, Literal, Wildcard, Subquery — pass through.
-        leaf => leaf,
-    }
-}
diff --git a/nodedb-sql/src/planner/catalog_plan_shapes.rs b/nodedb-sql/src/planner/catalog_plan_shapes.rs
new file mode 100644
index 000000000..20e393f3e
--- /dev/null
+++ b/nodedb-sql/src/planner/catalog_plan_shapes.rs
@@ -0,0 +1,120 @@
+// SPDX-License-Identifier: Apache-2.0
+
+//! Catalog folding for reusable projection, ordering, aggregate, and window shapes.
+
+use nodedb_types::DatabaseId;
+
+use crate::catalog::SqlCatalog;
+use crate::types::{AggregateExpr, Projection, SortKey, SqlExpr, WindowSpec};
+
+use super::catalog_expr_fold::{fold_expr, validate_expr};
+
+pub(super) fn validate_projection(
+    projection: &[Projection],
+    catalog: &dyn SqlCatalog,
+    database_id: DatabaseId,
+    tenant_id: u64,
+) -> crate::Result<()> {
+    for item in projection {
+        if let Projection::Computed { expr, .. } = item {
+            validate_expr(expr, catalog, database_id, tenant_id)?;
+        }
+    }
+    Ok(())
+}
+
+pub(super) fn validate_sort_keys(
+    sort_keys: &[SortKey],
+    catalog: &dyn SqlCatalog,
+    database_id: DatabaseId,
+    tenant_id: u64,
+) -> crate::Result<()> {
+    for key in sort_keys {
+        validate_expr(&key.expr, catalog, database_id, tenant_id)?;
+    }
+    Ok(())
+}
+
+pub(super) fn validate_aggregates(
+    aggregates: &[AggregateExpr],
+    catalog: &dyn SqlCatalog,
+    database_id: DatabaseId,
+    tenant_id: u64,
+) -> crate::Result<()> {
+    for aggregate in aggregates {
+        for arg in &aggregate.args {
+            validate_expr(arg, catalog, database_id, tenant_id)?;
+        }
+    }
+    Ok(())
+}
+
+pub(super) fn validate_windows(
+    windows: &[WindowSpec],
+    catalog: &dyn SqlCatalog,
+    database_id: DatabaseId,
+    tenant_id: u64,
+) -> crate::Result<()> {
+    for window in windows {
+        for expr in window.args.iter().chain(&window.partition_by) {
+            validate_expr(expr, catalog, database_id, tenant_id)?;
+        }
+        validate_sort_keys(&window.order_by, catalog, database_id, tenant_id)?;
+    }
+    Ok(())
+}
+
+pub(super) fn fold_projection(
+    projection: &mut [Projection],
+    catalog: &dyn SqlCatalog,
+    database_id: DatabaseId,
+    tenant_id: u64,
+) {
+    for item in projection {
+        if let Projection::Computed { expr, .. } = item {
+            let owned = std::mem::replace(expr, SqlExpr::Wildcard);
+            *expr = fold_expr(owned, catalog, database_id, tenant_id);
+        }
+    }
+}
+
+pub(super) fn fold_sort_keys(
+    sort_keys: &mut [SortKey],
+    catalog: &dyn SqlCatalog,
+    database_id: DatabaseId,
+    tenant_id: u64,
+) {
+    for key in sort_keys {
+        let owned = std::mem::replace(&mut key.expr, SqlExpr::Wildcard);
+        key.expr = fold_expr(owned, catalog, database_id, tenant_id);
+    }
+}
+
+pub(super) fn fold_aggregates(
+    aggregates: &mut [AggregateExpr],
+    catalog: &dyn SqlCatalog,
+    database_id: DatabaseId,
+    tenant_id: u64,
+) {
+    for aggregate in aggregates {
+        for arg in &mut aggregate.args {
+            let owned = std::mem::replace(arg, SqlExpr::Wildcard);
+            *arg = fold_expr(owned, catalog, database_id, tenant_id);
+        }
+    }
+}
+
+pub(super) fn fold_windows(
+    windows: &mut [WindowSpec],
+    catalog: &dyn SqlCatalog,
+    database_id: DatabaseId,
+    tenant_id: u64,
+) {
+    for window in windows {
+        for expr in window.args.iter_mut().chain(&mut window.partition_by) {
+            let owned = std::mem::replace(expr, SqlExpr::Wildcard);
+            *expr = fold_expr(owned, catalog, database_id, tenant_id);
+        }
+        fold_sort_keys(&mut window.order_by, catalog, database_id, tenant_id);
+    }
+}
diff --git a/nodedb-sql/src/planner/catalog_plan_validate.rs b/nodedb-sql/src/planner/catalog_plan_validate.rs
new file mode 100644
index 000000000..c154c8db1
--- /dev/null
+++ b/nodedb-sql/src/planner/catalog_plan_validate.rs
@@ -0,0 +1,195 @@
+// SPDX-License-Identifier: Apache-2.0
+
+//! Catalog-dependent expression validation across nested SQL plan shapes.
+
+use nodedb_types::DatabaseId;
+
+use crate::catalog::SqlCatalog;
+use crate::types::{FilterExpr, MergePlanAction, SqlPlan};
+
+use super::catalog_expr_fold::validate_expr;
+use super::catalog_plan_shapes::{
+    validate_aggregates, validate_projection, validate_sort_keys, validate_windows,
+};
+
+pub(super) fn validate_catalog_exprs(
+    plan: &SqlPlan,
+    catalog: &dyn SqlCatalog,
+    database_id: DatabaseId,
+    tenant_id: u64,
+) -> crate::Result<()> {
+    match plan {
+        SqlPlan::Scan {
+            filters,
+            projection,
+            sort_keys,
+            window_functions,
+            ..
+        }
+        | SqlPlan::DocumentIndexLookup {
+            filters,
+            projection,
+            sort_keys,
+            window_functions,
+            ..
+        } => {
+            validate_filters(filters, catalog, database_id, tenant_id)?;
+            validate_projection(projection, catalog, database_id, tenant_id)?;
+            validate_sort_keys(sort_keys, catalog, database_id, tenant_id)?;
+            validate_windows(window_functions, catalog, database_id, tenant_id)?;
+        }
+        SqlPlan::PointGet { projection, .. } | SqlPlan::RangeScan { projection, .. } => {
+            validate_projection(projection, catalog, database_id, tenant_id)?;
+        }
+        SqlPlan::Update {
+            assignments,
+            filters,
+            ..
+        } => {
+            for (_, expr) in assignments {
+                validate_expr(expr, catalog, database_id, tenant_id)?;
+            }
+            validate_filters(filters, catalog, database_id, tenant_id)?;
+        }
+        SqlPlan::Delete { filters, .. } => {
+            validate_filters(filters, catalog, database_id, tenant_id)?
+        }
+        SqlPlan::UpdateFrom {
+            source,
+            assignments,
+            target_filters,
+            ..
+        } => {
+            validate_catalog_exprs(source, catalog, database_id, tenant_id)?;
+            for (_, expr) in assignments {
+                validate_expr(expr, catalog, database_id, tenant_id)?;
+            }
+            validate_filters(target_filters, catalog, database_id, tenant_id)?;
+        }
+        SqlPlan::InsertSelect { source, .. } => {
+            validate_catalog_exprs(source, catalog, database_id, tenant_id)?
+        }
+        SqlPlan::Aggregate {
+            input,
+            group_by,
+            aggregates,
+            having,
+            sort_keys,
+            ..
+        } => {
+            validate_catalog_exprs(input, catalog, database_id, tenant_id)?;
+            for expr in group_by {
+                validate_expr(expr, catalog, database_id, tenant_id)?;
+            }
+            validate_aggregates(aggregates, catalog, database_id, tenant_id)?;
+            validate_filters(having, catalog, database_id, tenant_id)?;
+            validate_sort_keys(sort_keys, catalog, database_id, tenant_id)?;
+        }
+        SqlPlan::Union { inputs, .. } => {
+            for input in inputs {
+                validate_catalog_exprs(input, catalog, database_id, tenant_id)?;
+            }
+        }
+        SqlPlan::Intersect { left, right, .. } | SqlPlan::Except { left, right, .. } => {
+            validate_catalog_exprs(left, catalog, database_id, tenant_id)?;
+            validate_catalog_exprs(right, catalog, database_id, tenant_id)?;
+        }
+        SqlPlan::Cte { definitions, outer } => {
+            for (_, definition) in definitions {
+                validate_catalog_exprs(definition, catalog, database_id, tenant_id)?;
+            }
+            validate_catalog_exprs(outer, catalog, database_id, tenant_id)?;
+        }
+        SqlPlan::Join {
+            left,
+            right,
+            condition,
+            projection,
+            filters,
+            ..
+        } => {
+            validate_catalog_exprs(left, catalog, database_id, tenant_id)?;
+            validate_catalog_exprs(right, catalog, database_id, tenant_id)?;
+            if let Some(condition) = condition {
+                validate_expr(condition, catalog, database_id, tenant_id)?;
+            }
+            validate_projection(projection, catalog, database_id, tenant_id)?;
+            validate_filters(filters, catalog, database_id, tenant_id)?;
+        }
+        SqlPlan::LateralTopK {
+            outer,
+            inner_filters,
+            inner_order_by,
+            projection,
+            ..
+        } => {
+            validate_catalog_exprs(outer, catalog, database_id, tenant_id)?;
+            validate_filters(inner_filters, catalog, database_id, tenant_id)?;
+            validate_sort_keys(inner_order_by, catalog, database_id, tenant_id)?;
+            validate_projection(projection, catalog, database_id, tenant_id)?;
+        }
+        SqlPlan::LateralLoop {
+            outer,
+            inner,
+            projection,
+            ..
+        } => {
+            validate_catalog_exprs(outer, catalog, database_id, tenant_id)?;
+            validate_catalog_exprs(inner, catalog, database_id, tenant_id)?;
+            validate_projection(projection, catalog, database_id, tenant_id)?;
+        }
+        SqlPlan::Merge {
+            source, clauses, ..
+        } => {
+            validate_catalog_exprs(source, catalog, database_id, tenant_id)?;
+            for clause in clauses {
+                validate_filters(&clause.extra_predicate, catalog, database_id, tenant_id)?;
+                match &clause.action {
+                    MergePlanAction::Update { assignments } => {
+                        for (_, expr) in assignments {
+                            validate_expr(expr, catalog, database_id, tenant_id)?;
+                        }
+                    }
+                    MergePlanAction::Insert { values, .. } => {
+                        for expr in values {
+                            validate_expr(expr, catalog, database_id, tenant_id)?;
+                        }
+                    }
+                    MergePlanAction::Delete | MergePlanAction::DoNothing => {}
+                }
+            }
+        }
+        _ => {}
+    }
+    Ok(())
+}
+
+fn validate_filters(
+    filters: &[crate::types::Filter],
+    catalog: &dyn SqlCatalog,
+    database_id: DatabaseId,
+    tenant_id: u64,
+) -> crate::Result<()> {
+    for filter in filters {
+        validate_filter_expr(&filter.expr, catalog, database_id, tenant_id)?;
+    }
+    Ok(())
+}
+
+fn validate_filter_expr(
+    expr: &FilterExpr,
+    catalog: &dyn SqlCatalog,
+    database_id: DatabaseId,
+    tenant_id: u64,
+) -> crate::Result<()> {
+    match expr {
+        FilterExpr::Expr(expr) => validate_expr(expr, catalog, database_id, tenant_id),
+        FilterExpr::And(children) | FilterExpr::Or(children) => {
+            validate_filters(children, catalog, database_id, tenant_id)
+        }
+        FilterExpr::Not(child) => {
+            validate_filter_expr(&child.expr, catalog, database_id, tenant_id)
+        }
+        _ => Ok(()),
+    }
+}
diff --git a/nodedb-sql/src/planner/const_fold.rs b/nodedb-sql/src/planner/const_fold.rs
index bece61962..689c568dd 100644
--- a/nodedb-sql/src/planner/const_fold.rs
+++ b/nodedb-sql/src/planner/const_fold.rs
@@ -85,6 +85,9 @@ fn fold_cast(inner: SqlValue, to_type: &str) -> Option<SqlValue> {
         .unwrap_or(upper.as_str());
 
     match base {
+        // REGCLASS needs the session catalog. Keep the cast intact for the
+        // contextual catalog-fold pass rather than erasing it to a string.
+        "REGCLASS" => None,
         "NUMERIC" | "DECIMAL" => match inner {
             SqlValue::Decimal(d) => Some(SqlValue::Decimal(d)),
             SqlValue::Int(i) => Some(SqlValue::Decimal(rust_decimal::Decimal::from(i))),
diff --git a/nodedb-sql/src/planner/mod.rs b/nodedb-sql/src/planner/mod.rs
index 8c2dd2180..dceda289f 100644
--- a/nodedb-sql/src/planner/mod.rs
+++ b/nodedb-sql/src/planner/mod.rs
@@ -7,7 +7,10 @@ pub mod array_dml;
 pub mod array_fn;
 pub mod ast_helpers;
 pub mod bitmap_emit;
+pub mod catalog_expr_fold;
 pub mod catalog_fold;
+pub mod catalog_plan_shapes;
+pub mod catalog_plan_validate;
 pub mod const_fold;
 pub mod cte;
 pub mod dml;
diff --git a/nodedb-sql/src/planner/select/helpers.rs b/nodedb-sql/src/planner/select/helpers.rs
index 5f105dcee..000574b11 100644
--- a/nodedb-sql/src/planner/select/helpers.rs
+++ b/nodedb-sql/src/planner/select/helpers.rs
@@ -101,7 +101,7 @@ pub fn extract_func_args(func: &ast::Function) -> Result<Vec<ast::Expr>> {
 /// `const_fold::fold_constant` helper so that zero-arg scalar functions
 /// like `now()` and `current_timestamp` go through the same evaluator
 /// as the runtime expression path.
-pub(super) fn eval_constant_expr(expr: &SqlExpr, functions: &FunctionRegistry) -> SqlValue {
+pub(crate) fn eval_constant_expr(expr: &SqlExpr, functions: &FunctionRegistry) -> SqlValue {
     crate::planner::const_fold::fold_constant(expr, functions).unwrap_or(SqlValue::Null)
 }
 
diff --git a/nodedb-sql/src/planner/select/mod.rs b/nodedb-sql/src/planner/select/mod.rs
index 5233cdcb1..3b008071a 100644
--- a/nodedb-sql/src/planner/select/mod.rs
+++ b/nodedb-sql/src/planner/select/mod.rs
@@ -8,7 +8,7 @@
 
 mod entry;
 mod entry_ann;
-mod helpers;
+pub mod helpers;
 mod order_by;
 mod select_stmt;
 mod where_search;
diff --git a/nodedb-sql/src/planner/select/select_stmt.rs b/nodedb-sql/src/planner/select/select_stmt.rs
index 9f0f83f41..e909c0608 100644
--- a/nodedb-sql/src/planner/select/select_stmt.rs
+++ b/nodedb-sql/src/planner/select/select_stmt.rs
@@ -5,7 +5,7 @@
 use nodedb_types::DatabaseId;
 use sqlparser::ast::{self, Select};
 
-use super::helpers::{convert_projection, convert_where_to_filters, eval_constant_expr};
+use super::helpers::{convert_projection, convert_where_to_filters};
 use super::where_search::try_extract_where_search;
 use crate::error::{Result, SqlError};
 use crate::functions::registry::FunctionRegistry;
@@ -68,7 +68,9 @@ pub(super) fn plan_select(
             match proj {
                 Projection::Computed { expr, alias } => {
                     columns.push(alias.clone());
-                    values.push(eval_constant_expr(expr, functions));
+                    values.push(crate::planner::catalog_expr_fold::eval_catalog_constant(
+                        expr, catalog, functions,
+                    )?);
                 }
                 Projection::Column(name) => {
                     columns.push(name.clone());
diff --git a/nodedb-test-support/src/native_harness/frames.rs b/nodedb-test-support/src/native_harness/frames.rs
index b33d89d41..ac523f018 100644
--- a/nodedb-test-support/src/native_harness/frames.rs
+++ b/nodedb-test-support/src/native_harness/frames.rs
@@ -120,11 +120,65 @@ pub async fn send_request(
     let json_bytes = sonic_rs::to_vec(&req).expect("json encode");
     write_frame(stream, &json_bytes).await;
 
-    let response_payload = tokio::time::timeout(Duration::from_secs(5), read_frame(stream))
-        .await
-        .expect("timeout waiting for response")
-        .expect("response frame");
-    sonic_rs::from_slice(&response_payload).expect("json decode NativeResponse")
+    let deadline = tokio::time::Instant::now() + Duration::from_secs(5);
+    let mut accumulated: Option<NativeResponse> = None;
+    loop {
+        let remaining = deadline.saturating_duration_since(tokio::time::Instant::now());
+        let response_payload = tokio::time::timeout(remaining, read_frame(stream))
+            .await
+            .expect("timeout waiting for response")
+            .expect("response frame");
+        let response: NativeResponse =
+            sonic_rs::from_slice(&response_payload).expect("json decode NativeResponse");
+        if response.seq == seq {
+            if response.status == nodedb_types::protocol::ResponseStatus::Partial {
+                if let Some(aggregate) = accumulated.as_mut() {
+                    if aggregate.columns.is_none() {
+                        aggregate.columns = response.columns;
+                    }
+                    aggregate
+                        .rows
+                        .get_or_insert_default()
+                        .extend(response.rows.unwrap_or_default());
+                    if let Some(rows_affected) = response.rows_affected {
+                        aggregate.rows_affected =
+                            Some(aggregate.rows_affected.unwrap_or(0) + rows_affected);
+                    }
+                    aggregate.watermark_lsn = aggregate.watermark_lsn.max(response.watermark_lsn);
+                } else {
+                    accumulated = Some(response);
+                }
+                continue;
+            }
+            if let Some(mut aggregate) = accumulated {
+                if aggregate.columns.is_none() {
+                    aggregate.columns = response.columns;
+                }
+                aggregate
+                    .rows
+                    .get_or_insert_default()
+                    .extend(response.rows.unwrap_or_default());
+                if let Some(rows_affected) = response.rows_affected {
+                    aggregate.rows_affected =
+                        Some(aggregate.rows_affected.unwrap_or(0) + rows_affected);
+                }
+                aggregate.watermark_lsn = aggregate.watermark_lsn.max(response.watermark_lsn);
+                aggregate.status = response.status;
+                aggregate.error = response.error;
+                aggregate.auth = response.auth;
+                aggregate.warnings.extend(response.warnings);
+                return aggregate;
+            }
+            return response;
+        }
+        assert!(
+            response.seq < seq,
+            "native response sequence advanced past request: expected {seq}, got {}",
+            response.seq
+        );
+        // Fan-out queries can leave additional frames for the preceding request.
+        // Drain those stale frames rather than misattributing one to this request.
+    }
 }
 
 /// Authenticate a fresh native connection with an API key. The JSON Auth
diff --git a/nodedb/src/control/catalog_entry/apply/collection.rs b/nodedb/src/control/catalog_entry/apply/collection.rs
index d41476c7f..08bb559f6 100644
--- a/nodedb/src/control/catalog_entry/apply/collection.rs
+++ b/nodedb/src/control/catalog_entry/apply/collection.rs
@@ -36,37 +36,25 @@ pub fn put(stored: &StoredCollection, catalog: &SystemCatalog) {
 /// the create path mirrors `put`'s body precisely so replay/snapshot
 /// re-application stays idempotent.
 pub fn put_if_absent(stored: &StoredCollection, catalog: &SystemCatalog) {
-    match catalog.get_collection(stored.database_id, stored.tenant_id, &stored.name) {
-        Ok(Some(_)) => {
-            debug!(
-                collection = %stored.name,
-                tenant = stored.tenant_id,
-                "catalog_entry: put_collection_if_absent skipped existing collection"
-            );
-        }
-        Ok(None) => {
-            if let Err(e) = catalog.put_collection(stored.database_id, stored) {
-                warn!(
-                    collection = %stored.name,
-                    tenant = stored.tenant_id,
-                    error = %e,
-                    "catalog_entry: put_collection_if_absent put_collection failed"
-                );
-            }
-            super::owner::put_parent_owner_in_database(
-                object_type::COLLECTION,
-                stored.database_id.as_u64(),
-                stored.tenant_id,
-                &stored.name,
-                &stored.owner,
-                catalog,
-            );
-        }
+    match catalog.put_collection_if_absent(stored.database_id, stored) {
+        Ok(true) => super::owner::put_parent_owner_in_database(
+            object_type::COLLECTION,
+            stored.database_id.as_u64(),
+            stored.tenant_id,
+            &stored.name,
+            &stored.owner,
+            catalog,
+        ),
+        Ok(false) => debug!(
+            collection = %stored.name,
+            tenant = stored.tenant_id,
+            "catalog_entry: put_collection_if_absent skipped existing collection"
+        ),
         Err(e) => warn!(
             collection = %stored.name,
             tenant = stored.tenant_id,
             error = %e,
-            "catalog_entry: put_collection_if_absent get failed"
+            "catalog_entry: atomic put_collection_if_absent failed"
         ),
     }
 }
diff --git a/nodedb/src/control/catalog_entry/descriptor_stamp.rs b/nodedb/src/control/catalog_entry/descriptor_stamp.rs
index 3a1bd89b4..32ed4ed43 100644
--- a/nodedb/src/control/catalog_entry/descriptor_stamp.rs
+++ b/nodedb/src/control/catalog_entry/descriptor_stamp.rs
@@ -49,13 +49,18 @@ use crate::control::security::catalog::SystemCatalog;
 /// function — it is strictly the "pre-stamping compat mode"
 /// sentinel.
 pub fn stamp(entry: CatalogEntry, clock: &HlcClock, catalog: &SystemCatalog) -> CatalogEntry {
-    let hlc = clock.now();
+    let mut hlc = clock.now();
     match entry {
         CatalogEntry::PutCollection(mut stored) => {
             let prior = catalog
                 .get_collection(stored.database_id, stored.tenant_id, &stored.name)
                 .ok()
                 .flatten();
+            if let Some(prior_hlc) = prior.as_ref().map(|c| c.modification_hlc)
+                && prior_hlc >= hlc
+            {
+                hlc = clock.update(prior_hlc);
+            }
             let prior_descriptor = prior.as_ref().map(|c| c.descriptor_version).unwrap_or(0);
             stored.descriptor_version = prior_descriptor.saturating_add(1);
             // Constraint version bumps ONLY when the derived constraint set
@@ -83,25 +88,16 @@ pub fn stamp(entry: CatalogEntry, clock: &HlcClock, catalog: &SystemCatalog) ->
                 .get_collection(stored.database_id, stored.tenant_id, &stored.name)
                 .ok()
                 .flatten();
-            let prior_descriptor = prior.as_ref().map(|c| c.descriptor_version).unwrap_or(0);
-            stored.descriptor_version = prior_descriptor.saturating_add(1);
-            // Constraint version bumps ONLY when the derived constraint set
-            // actually changes, so an unrelated ALTER never advances the
-            // apply-time fence key and never transiently rejects in-flight
-            // CRDT deltas. `Constraint: Eq` + name-sorted translator make the
-            // set comparison exact and order-stable.
-            let prior_constraint_version =
-                prior.as_ref().map(|c| c.constraint_version).unwrap_or(0);
-            let prior_set = prior
-                .as_ref()
-                .map(crate::control::security::catalog::collection_constraints)
-                .unwrap_or_default();
+            // Existing is a semantic no-op. Freeze the exact persisted record
+            // rather than manufacturing an unpersisted next version; this also
+            // makes later full-log replay payload-identical and lets a following
+            // real mutation in the same batch advance from the true prior.
+            if let Some(prior) = prior {
+                return CatalogEntry::PutCollectionIfAbsent(Box::new(prior));
+            }
+            stored.descriptor_version = 1;
             let new_set = crate::control::security::catalog::collection_constraints(&stored);
-            stored.constraint_version = if new_set != prior_set {
-                prior_constraint_version.saturating_add(1)
-            } else {
-                prior_constraint_version
-            };
+            stored.constraint_version = u64::from(!new_set.is_empty());
             stored.modification_hlc = hlc;
             CatalogEntry::PutCollectionIfAbsent(stored)
         }
@@ -218,50 +214,322 @@ pub fn stamp(entry: CatalogEntry, clock: &HlcClock, catalog: &SystemCatalog) ->
     }
 }
 
-/// Validate a carried collection descriptor version (frozen at
-/// propose time and replicated verbatim) against this node's local
-/// prior, before the applier persists it. Enforces that a replayed or
-/// re-delivered entry is idempotent and that a real anomaly halts the
-/// apply watermark loudly instead of diverging silently.
-///
-/// - carried `0`: compat mode / unstamped (unit tests) — skipped.
-/// - carried `== prior`: idempotent re-apply / replay of an
-///   already-applied entry — allowed (the write is the same value).
-/// - carried `== prior + 1`: normal new version — allowed.
-/// - carried `< prior` (regression) or `> prior + 1` (gap): a real
-///   anomaly / corruption — returns a loud typed error.
-///
-/// Only the collection `Put*` variants carry a version derived from a
-/// per-descriptor `prior + 1` counter and are validated here; every
-/// other variant is a no-op. Determinism for all stamped variants is
-/// already guaranteed by verbatim application — this check is the
-/// additional guard against a corrupt or reordered collection entry.
-pub fn validate(entry: &CatalogEntry, catalog: &SystemCatalog) -> Result<(), crate::Error> {
-    let (descriptor, carried, prior) = match entry {
-        CatalogEntry::PutCollection(stored) | CatalogEntry::PutCollectionIfAbsent(stored) => {
-            let prior = catalog
+/// Stamp a transactional DDL batch in statement order. Persisted catalog
+/// state seeds the first mutation of each descriptor; a prior mutation of the
+/// same descriptor in this batch seeds the next one.
+pub fn stamp_batch(
+    entries: Vec<CatalogEntry>,
+    clock: &HlcClock,
+    catalog: &SystemCatalog,
+) -> Vec<CatalogEntry> {
+    let mut stamped_entries = Vec::with_capacity(entries.len());
+    for entry in entries {
+        let mut stamped = stamp(entry, clock, catalog);
+        if let Some(prior) = stamped_entries
+            .iter()
+            .rev()
+            .find(|prior| same_descriptor(prior, &stamped))
+        {
+            stamped = advance_after(prior, stamped);
+        }
+        stamped_entries.push(stamped);
+    }
+    stamped_entries
+}
+
+fn same_descriptor(prior: &CatalogEntry, current: &CatalogEntry) -> bool {
+    match (prior, current) {
+        (
+            CatalogEntry::PutCollection(a) | CatalogEntry::PutCollectionIfAbsent(a),
+            CatalogEntry::PutCollection(b) | CatalogEntry::PutCollectionIfAbsent(b),
+        ) => a.database_id == b.database_id && a.tenant_id == b.tenant_id && a.name == b.name,
+        (CatalogEntry::PutMaterializedView(a), CatalogEntry::PutMaterializedView(b)) => {
+            a.tenant_id == b.tenant_id && a.name == b.name
+        }
+        (CatalogEntry::PutFunction(a), CatalogEntry::PutFunction(b)) => {
+            a.tenant_id == b.tenant_id && a.name == b.name
+        }
+        (CatalogEntry::PutProcedure(a), CatalogEntry::PutProcedure(b)) => {
+            a.tenant_id == b.tenant_id && a.name == b.name
+        }
+        (CatalogEntry::PutTrigger(a), CatalogEntry::PutTrigger(b)) => {
+            a.tenant_id == b.tenant_id && a.name == b.name
+        }
+        (CatalogEntry::PutSequence(a), CatalogEntry::PutSequence(b)) => {
+            a.tenant_id == b.tenant_id && a.name == b.name
+        }
+        (CatalogEntry::PutContinuousAggregate(a), CatalogEntry::PutContinuousAggregate(b)) => {
+            a.database_id == b.database_id && a.tenant_id == b.tenant_id && a.name == b.name
+        }
+        _ => false,
+    }
+}
+
+fn advance_after(prior: &CatalogEntry, current: CatalogEntry) -> CatalogEntry {
+    match (prior, current) {
+        (
+            CatalogEntry::PutCollection(prior) | CatalogEntry::PutCollectionIfAbsent(prior),
+            CatalogEntry::PutCollection(mut current),
+        ) => {
+            advance_collection(prior, &mut current);
+            CatalogEntry::PutCollection(current)
+        }
+        (
+            CatalogEntry::PutCollection(prior) | CatalogEntry::PutCollectionIfAbsent(prior),
+            CatalogEntry::PutCollectionIfAbsent(mut current),
+        ) => {
+            advance_collection(prior, &mut current);
+            CatalogEntry::PutCollectionIfAbsent(current)
+        }
+        (
+            CatalogEntry::PutMaterializedView(prior),
+            CatalogEntry::PutMaterializedView(mut current),
+        ) => {
+            current.descriptor_version = prior.descriptor_version.saturating_add(1);
+            CatalogEntry::PutMaterializedView(current)
+        }
+        (CatalogEntry::PutFunction(prior), CatalogEntry::PutFunction(mut current)) => {
+            current.descriptor_version = prior.descriptor_version.saturating_add(1);
+            CatalogEntry::PutFunction(current)
+        }
+        (CatalogEntry::PutProcedure(prior), CatalogEntry::PutProcedure(mut current)) => {
+            current.descriptor_version = prior.descriptor_version.saturating_add(1);
+            CatalogEntry::PutProcedure(current)
+        }
+        (CatalogEntry::PutTrigger(prior), CatalogEntry::PutTrigger(mut current)) => {
+            current.descriptor_version = prior.descriptor_version.saturating_add(1);
+            CatalogEntry::PutTrigger(current)
+        }
+        (CatalogEntry::PutSequence(prior), CatalogEntry::PutSequence(mut current)) => {
+            current.descriptor_version = prior.descriptor_version.saturating_add(1);
+            CatalogEntry::PutSequence(current)
+        }
+        (
+            CatalogEntry::PutContinuousAggregate(prior),
+            CatalogEntry::PutContinuousAggregate(mut current),
+        ) => {
+            current.descriptor_version = prior.descriptor_version.saturating_add(1);
+            CatalogEntry::PutContinuousAggregate(current)
+        }
+        (_, current) => current,
+    }
+}
+
+fn advance_collection(
+    prior: &crate::control::security::catalog::StoredCollection,
+    current: &mut crate::control::security::catalog::StoredCollection,
+) {
+    current.descriptor_version = prior.descriptor_version.saturating_add(1);
+    let prior_set = crate::control::security::catalog::collection_constraints(prior);
+    let current_set = crate::control::security::catalog::collection_constraints(current);
+    current.constraint_version = if prior_set == current_set {
+        prior.constraint_version
+    } else {
+        prior.constraint_version.saturating_add(1)
+    };
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum ValidationOutcome {
+    Apply,
+    AlreadyApplied,
+}
+
+/// Validate every descriptor-bearing `Put*` entry against the locally
+/// persisted version before applying it. Historical replay is idempotent for
+/// all descriptor families, while equal-version conflicts and forward gaps
+/// remain loud anomalies.
+pub fn validate(
+    entry: &CatalogEntry,
+    catalog: &SystemCatalog,
+) -> Result<ValidationOutcome, crate::Error> {
+    match entry {
+        CatalogEntry::PutCollection(stored) => {
+            let current = catalog
                 .get_collection(stored.database_id, stored.tenant_id, &stored.name)
                 .ok()
-                .flatten()
-                .map(|c| c.descriptor_version)
-                .unwrap_or(0);
-            (stored.name.clone(), stored.descriptor_version, prior)
+                .flatten();
+            validate_one(
+                &stored.name,
+                stored.descriptor_version,
+                stored.as_ref(),
+                current.as_ref(),
+                current.as_ref().map_or(0, |value| value.descriptor_version),
+                stored.modification_hlc,
+                current
+                    .as_ref()
+                    .map_or(nodedb_types::Hlc::ZERO, |value| value.modification_hlc),
+            )
         }
-        _ => return Ok(()),
-    };
+        CatalogEntry::PutCollectionIfAbsent(stored) => {
+            let current = catalog
+                .get_collection(stored.database_id, stored.tenant_id, &stored.name)
+                .ok()
+                .flatten();
+            if current.is_some() {
+                Ok(ValidationOutcome::AlreadyApplied)
+            } else {
+                validate_one(
+                    &stored.name,
+                    stored.descriptor_version,
+                    stored.as_ref(),
+                    None,
+                    0,
+                    stored.modification_hlc,
+                    nodedb_types::Hlc::ZERO,
+                )
+            }
+        }
+        CatalogEntry::PutMaterializedView(stored) => {
+            let current = catalog
+                .get_materialized_view(stored.tenant_id, &stored.name)
+                .ok()
+                .flatten();
+            validate_one(
+                &stored.name,
+                stored.descriptor_version,
+                stored.as_ref(),
+                current.as_ref(),
+                current.as_ref().map_or(0, |value| value.descriptor_version),
+                stored.modification_hlc,
+                current
+                    .as_ref()
+                    .map_or(nodedb_types::Hlc::ZERO, |value| value.modification_hlc),
+            )
+        }
+        CatalogEntry::PutFunction(stored) => {
+            let current = catalog
+                .get_function(stored.tenant_id, &stored.name)
+                .ok()
+                .flatten();
+            validate_one(
+                &stored.name,
+                stored.descriptor_version,
+                stored.as_ref(),
+                current.as_ref(),
+                current.as_ref().map_or(0, |value| value.descriptor_version),
+                stored.modification_hlc,
+                current
+                    .as_ref()
+                    .map_or(nodedb_types::Hlc::ZERO, |value| value.modification_hlc),
+            )
+        }
+        CatalogEntry::PutProcedure(stored) => {
+            let current = catalog
+                .get_procedure(stored.tenant_id, &stored.name)
+                .ok()
+                .flatten();
+            validate_one(
+                &stored.name,
+                stored.descriptor_version,
+                stored.as_ref(),
+                current.as_ref(),
+                current.as_ref().map_or(0, |value| value.descriptor_version),
+                stored.modification_hlc,
+                current
+                    .as_ref()
+                    .map_or(nodedb_types::Hlc::ZERO, |value| value.modification_hlc),
+            )
+        }
+        CatalogEntry::PutTrigger(stored) => {
+            let current = catalog
+                .get_trigger(stored.tenant_id, &stored.name)
+                .ok()
+                .flatten();
+            validate_one(
+                &stored.name,
+                stored.descriptor_version,
+                stored.as_ref(),
+                current.as_ref(),
+                current.as_ref().map_or(0, |value| value.descriptor_version),
+                stored.modification_hlc,
+                current
+                    .as_ref()
+                    .map_or(nodedb_types::Hlc::ZERO, |value| value.modification_hlc),
+            )
+        }
+        CatalogEntry::PutSequence(stored) => {
+            let current = catalog
+                .get_sequence(stored.tenant_id, &stored.name)
+                .ok()
+                .flatten();
+            validate_one(
+                &stored.name,
+                stored.descriptor_version,
+                stored.as_ref(),
+                current.as_ref(),
+                current.as_ref().map_or(0, |value| value.descriptor_version),
+                stored.modification_hlc,
+                current
+                    .as_ref()
+                    .map_or(nodedb_types::Hlc::ZERO, |value| value.modification_hlc),
+            )
+        }
+        CatalogEntry::PutContinuousAggregate(stored) => {
+            let current = catalog
+                .get_continuous_aggregate(stored.database_id, stored.tenant_id, &stored.name)
+                .ok()
+                .flatten();
+            validate_one(
+                &stored.name,
+                stored.descriptor_version,
+                stored.as_ref(),
+                current.as_ref(),
+                current.as_ref().map_or(0, |value| value.descriptor_version),
+                stored.modification_hlc,
+                current
+                    .as_ref()
+                    .map_or(nodedb_types::Hlc::ZERO, |value| value.modification_hlc),
+            )
+        }
+        _ => Ok(ValidationOutcome::Apply),
+    }
+}
 
-    // Sentinel `0` is the pre-stamping / compat-mode marker; downstream
-    // resolvers treat it as `1`. Nothing to validate.
+fn validate_one<T: zerompk::ToMessagePack>(
+    name: &str,
+    carried: u64,
+    incoming: &T,
+    current: Option<&T>,
+    prior: u64,
+    incoming_hlc: nodedb_types::Hlc,
+    current_hlc: nodedb_types::Hlc,
+) -> Result<ValidationOutcome, crate::Error> {
     if carried == 0 {
-        return Ok(());
+        return Ok(ValidationOutcome::Apply);
     }
-
-    if carried == prior || carried == prior.saturating_add(1) {
-        return Ok(());
+    // A recreated descriptor restarts its numeric version namespace. Once a
+    // newer lifecycle is persisted, every older-HLC record is historical even
+    // if its old numeric version is greater than the recreated version.
+    if current.is_some() && incoming_hlc < current_hlc {
+        return Ok(ValidationOutcome::AlreadyApplied);
+    }
+    if carried < prior {
+        return Ok(ValidationOutcome::AlreadyApplied);
+    }
+    if carried == prior {
+        let same_payload = current
+            .map(|persisted| {
+                let incoming = zerompk::to_msgpack_vec(incoming);
+                let persisted = zerompk::to_msgpack_vec(persisted);
+                matches!((incoming, persisted), (Ok(a), Ok(b)) if a == b)
+            })
+            .unwrap_or(false);
+        return if same_payload {
+            Ok(ValidationOutcome::AlreadyApplied)
+        } else {
+            Err(crate::Error::DescriptorVersionAnomaly {
+                descriptor: name.to_string(),
+                carried,
+                prior,
+            })
+        };
+    }
+    if carried == prior.saturating_add(1) {
+        return Ok(ValidationOutcome::Apply);
     }
-
     Err(crate::Error::DescriptorVersionAnomaly {
-        descriptor,
+        descriptor: name.to_string(),
         carried,
         prior,
     })
@@ -270,7 +538,7 @@ pub fn validate(entry: &CatalogEntry, catalog: &SystemCatalog) -> Result<(), cra
 #[cfg(test)]
 mod tests {
     use super::*;
-    use crate::control::security::catalog::StoredCollection;
+    use crate::control::security::catalog::{StoredCollection, StoredSequence};
     use crate::control::security::credential::CredentialStore;
     use nodedb_types::DatabaseId;
     use std::sync::Arc;
@@ -321,6 +589,75 @@ mod tests {
         }
     }
 
+    #[test]
+    fn stamp_batch_advances_repeated_collection_mutations() {
+        let (store, _tmp) = make_catalog();
+        let clock = HlcClock::new();
+        let entries = vec![
+            CatalogEntry::PutCollection(Box::new(StoredCollection::new(1, "orders", "tester"))),
+            CatalogEntry::PutCollection(Box::new(StoredCollection::new(1, "orders", "tester"))),
+        ];
+        let stamped = stamp_batch(entries, &clock, store.catalog());
+        let CatalogEntry::PutCollection(first) = &stamped[0] else {
+            panic!("expected first collection");
+        };
+        let CatalogEntry::PutCollection(second) = &stamped[1] else {
+            panic!("expected second collection");
+        };
+        assert_eq!(first.descriptor_version, 1);
+        assert_eq!(second.descriptor_version, 2);
+    }
+
+    #[test]
+    fn stamp_batch_existing_if_absent_does_not_consume_a_version() {
+        let (store, _tmp) = make_catalog();
+        let clock = HlcClock::new();
+        seed_prior(store.catalog(), "orders", 1);
+        let mut announcement = StoredCollection::new(1, "orders", "remote");
+        announcement.descriptor_version = 0;
+        let update = StoredCollection::new(1, "orders", "updated");
+        let stamped = stamp_batch(
+            vec![
+                CatalogEntry::PutCollectionIfAbsent(Box::new(announcement)),
+                CatalogEntry::PutCollection(Box::new(update)),
+            ],
+            &clock,
+            store.catalog(),
+        );
+        let CatalogEntry::PutCollectionIfAbsent(noop) = &stamped[0] else {
+            panic!("expected create-only entry");
+        };
+        let CatalogEntry::PutCollection(update) = &stamped[1] else {
+            panic!("expected real update");
+        };
+        assert_eq!(noop.descriptor_version, 1);
+        assert_eq!(noop.owner, "tester");
+        assert_eq!(update.descriptor_version, 2);
+    }
+
+    #[test]
+    fn stamp_batch_advances_repeated_sequence_mutations() {
+        let (store, _tmp) = make_catalog();
+        let clock = HlcClock::new();
+        let sequence = StoredSequence::new(1, "invoice_seq".into(), "tester".into());
+        let stamped = stamp_batch(
+            vec![
+                CatalogEntry::PutSequence(Box::new(sequence.clone())),
+                CatalogEntry::PutSequence(Box::new(sequence)),
+            ],
+            &clock,
+            store.catalog(),
+        );
+        let CatalogEntry::PutSequence(first) = &stamped[0] else {
+            panic!("expected first sequence");
+        };
+        let CatalogEntry::PutSequence(second) = &stamped[1] else {
+            panic!("expected second sequence");
+        };
+        assert_eq!(first.descriptor_version, 1);
+        assert_eq!(second.descriptor_version, 2);
+    }
+
     #[test]
     fn stamp_ignores_deletes() {
         let (store, _tmp) = make_catalog();
@@ -354,16 +691,28 @@ mod tests {
         let (store, _tmp) = make_catalog();
         let catalog = store.catalog();
         // No prior record (prior = 0), carried = 1 → prior + 1.
-        assert!(validate(&collection_with_version("orders", 1), catalog).is_ok());
+        assert!(matches!(
+            validate(&collection_with_version("orders", 1), catalog),
+            Ok(ValidationOutcome::Apply)
+        ));
     }
 
     #[test]
     fn validate_allows_idempotent_replay() {
         let (store, _tmp) = make_catalog();
         let catalog = store.catalog();
-        seed_prior(catalog, "orders", 3);
-        // Re-delivery / full-log replay: carried == prior.
-        assert!(validate(&collection_with_version("orders", 3), catalog).is_ok());
+        let entry = collection_with_version("orders", 3);
+        let CatalogEntry::PutCollection(stored) = &entry else {
+            unreachable!();
+        };
+        catalog
+            .put_collection(DatabaseId::DEFAULT, stored)
+            .expect("seed exact prior");
+        // Re-delivery / full-log replay: carried == prior and payload-identical.
+        assert!(matches!(
+            validate(&entry, catalog),
+            Ok(ValidationOutcome::AlreadyApplied)
+        ));
     }
 
     #[test]
@@ -371,7 +720,10 @@ mod tests {
         let (store, _tmp) = make_catalog();
         let catalog = store.catalog();
         seed_prior(catalog, "orders", 3);
-        assert!(validate(&collection_with_version("orders", 4), catalog).is_ok());
+        assert!(matches!(
+            validate(&collection_with_version("orders", 4), catalog),
+            Ok(ValidationOutcome::Apply)
+        ));
     }
 
     #[test]
@@ -380,7 +732,10 @@ mod tests {
         let catalog = store.catalog();
         seed_prior(catalog, "orders", 3);
         // Compat mode / unstamped entry: version 0 is never validated.
-        assert!(validate(&collection_with_version("orders", 0), catalog).is_ok());
+        assert!(matches!(
+            validate(&collection_with_version("orders", 0), catalog),
+            Ok(ValidationOutcome::Apply)
+        ));
     }
 
     #[test]
@@ -402,18 +757,86 @@ mod tests {
     }
 
     #[test]
-    fn validate_rejects_regression() {
+    fn validate_acknowledges_stale_historical_replay() {
         let (store, _tmp) = make_catalog();
         let catalog = store.catalog();
         seed_prior(catalog, "orders", 5);
-        // carried = 2 < prior = 5 → regression anomaly.
-        let err = validate(&collection_with_version("orders", 2), catalog)
-            .expect_err("regression must be rejected");
+        assert!(matches!(
+            validate(&collection_with_version("orders", 2), catalog),
+            Ok(ValidationOutcome::AlreadyApplied)
+        ));
+    }
+
+    #[test]
+    fn validate_treats_older_higher_version_as_prior_incarnation() {
+        let (store, _tmp) = make_catalog();
+        let catalog = store.catalog();
+        let mut current = StoredCollection::new(1, "orders", "new_owner");
+        current.descriptor_version = 1;
+        current.modification_hlc = nodedb_types::Hlc::new(20, 0);
+        catalog
+            .put_collection(DatabaseId::DEFAULT, &current)
+            .expect("seed recreated collection");
+
+        let mut historical = StoredCollection::new(1, "orders", "old_owner");
+        historical.descriptor_version = 5;
+        historical.modification_hlc = nodedb_types::Hlc::new(10, 0);
+        assert!(matches!(
+            validate(&CatalogEntry::PutCollection(Box::new(historical)), catalog),
+            Ok(ValidationOutcome::AlreadyApplied)
+        ));
+    }
+
+    #[test]
+    fn validate_rejects_newer_divergent_equal_version() {
+        let (store, _tmp) = make_catalog();
+        let catalog = store.catalog();
+        let mut current = StoredCollection::new(1, "orders", "first");
+        current.descriptor_version = 2;
+        current.modification_hlc = nodedb_types::Hlc::new(10, 0);
+        catalog
+            .put_collection(DatabaseId::DEFAULT, &current)
+            .expect("seed current collection");
+        let mut conflict = current;
+        conflict.owner = "conflict".into();
+        conflict.modification_hlc = nodedb_types::Hlc::new(11, 0);
+        assert!(matches!(
+            validate(&CatalogEntry::PutCollection(Box::new(conflict)), catalog),
+            Err(crate::Error::DescriptorVersionAnomaly { .. })
+        ));
+    }
+
+    #[test]
+    fn validate_acknowledges_stale_sequence_replay() {
+        let (store, _tmp) = make_catalog();
+        let catalog = store.catalog();
+        let mut persisted = StoredSequence::new(1, "invoice_seq".into(), "tester".into());
+        persisted.descriptor_version = 4;
+        catalog.put_sequence(&persisted).expect("seed sequence");
+
+        let mut historical = persisted.clone();
+        historical.descriptor_version = 2;
+        historical.increment = 5;
+        assert!(matches!(
+            validate(&CatalogEntry::PutSequence(Box::new(historical)), catalog),
+            Ok(ValidationOutcome::AlreadyApplied)
+        ));
+    }
+
+    #[test]
+    fn validate_rejects_divergent_payload_at_same_version() {
+        let (store, _tmp) = make_catalog();
+        let catalog = store.catalog();
+        seed_prior(catalog, "orders", 3);
+        let mut divergent = StoredCollection::new(1, "orders", "different-owner");
+        divergent.descriptor_version = 3;
+        let err = validate(&CatalogEntry::PutCollection(Box::new(divergent)), catalog)
+            .expect_err("same-version divergent payload must be rejected");
         assert!(matches!(
             err,
             crate::Error::DescriptorVersionAnomaly {
-                carried: 2,
-                prior: 5,
+                carried: 3,
+                prior: 3,
                 ..
             }
         ));
diff --git a/nodedb/src/control/cluster/calvin/scheduler/driver/core/commit_redo.rs b/nodedb/src/control/cluster/calvin/scheduler/driver/core/commit_redo.rs
index b75e697d5..d9181f9bb 100644
--- a/nodedb/src/control/cluster/calvin/scheduler/driver/core/commit_redo.rs
+++ b/nodedb/src/control/cluster/calvin/scheduler/driver/core/commit_redo.rs
@@ -16,7 +16,7 @@ use super::scheduler::Scheduler;
 use crate::bridge::envelope::{Response, Status};
 use crate::control::cluster::calvin::scheduler::lock_manager::TxnId;
 use crate::control::cluster::calvin::scheduler::metrics::infra_abort_reason;
-use crate::types::{DatabaseId, VShardId};
+use crate::types::VShardId;
 use crate::wal::{CalvinStamp, RedoRecord};
 use nodedb_physical::physical_plan::PhysicalPlan;
 use nodedb_physical::physical_plan::meta::MetaOp;
@@ -72,6 +72,7 @@ impl Scheduler {
             return;
         };
         let tenant_id = pending.txn.tx_class.tenant_id;
+        let database_id = pending.txn.tx_class.database_id;
 
         let redo_lsn = if redo.ops.is_empty() {
             None
@@ -79,7 +80,7 @@ impl Scheduler {
             match self.shared.wal.append_transaction_redo(
                 tenant_id,
                 VShardId::new(self.vshard_id),
-                DatabaseId::DEFAULT,
+                database_id,
                 &redo,
             ) {
                 Ok(lsn) => Some(lsn),
@@ -139,6 +140,7 @@ impl Scheduler {
             return false;
         };
         let tenant_id = pending.txn.tx_class.tenant_id;
+        let database_id = pending.txn.tx_class.database_id;
         let epoch = txn_id.epoch;
         let position = txn_id.position;
 
@@ -146,7 +148,7 @@ impl Scheduler {
         let plan = PhysicalPlan::Meta(MetaOp::CalvinResolve { epoch, position });
         // A resolve reads the staged overlay only; it writes no WAL record
         // itself, so no committed LSN rides on this envelope.
-        let request = self.build_exempt_request(request_id, tenant_id, plan, None);
+        let request = self.build_exempt_request(request_id, tenant_id, database_id, plan, None);
 
         let resp_rx = self.shared.tracker.register(request_id);
         let dispatch_result = match self.shared.dispatcher.lock() {
diff --git a/nodedb/src/control/cluster/calvin/scheduler/driver/core/commit_resolution_dispatch.rs b/nodedb/src/control/cluster/calvin/scheduler/driver/core/commit_resolution_dispatch.rs
new file mode 100644
index 000000000..42dc11229
--- /dev/null
+++ b/nodedb/src/control/cluster/calvin/scheduler/driver/core/commit_resolution_dispatch.rs
@@ -0,0 +1,53 @@
+// SPDX-License-Identifier: BUSL-1.1
+
+//! Dispatch of staged Calvin flush/drop resolution operations.
+
+use nodedb_physical::physical_plan::PhysicalPlan;
+use nodedb_physical::physical_plan::meta::MetaOp;
+
+use super::scheduler::Scheduler;
+use crate::control::cluster::calvin::scheduler::lock_manager::TxnId;
+
+impl Scheduler {
+    /// Dispatch a flush or drop of a staged transaction's commit-pending buffer.
+    pub(in crate::control::cluster::calvin::scheduler::driver::core) fn dispatch_commit_resolution(
+        &mut self,
+        txn_id: TxnId,
+        committed: bool,
+        wal_lsn: Option<crate::types::Lsn>,
+    ) -> bool {
+        let Some(pending) = self.pending.get(&txn_id) else {
+            return false;
+        };
+        let tenant_id = pending.txn.tx_class.tenant_id;
+        let database_id = pending.txn.tx_class.database_id;
+        let epoch = txn_id.epoch;
+        let position = txn_id.position;
+        let plan = if committed {
+            PhysicalPlan::Meta(MetaOp::CalvinFlush { epoch, position })
+        } else {
+            PhysicalPlan::Meta(MetaOp::CalvinDrop { epoch, position })
+        };
+        let request_id = self.next_request_id();
+        let request = self.build_exempt_request(request_id, tenant_id, database_id, plan, wal_lsn);
+        let resp_rx = self.shared.tracker.register(request_id);
+        let dispatch_result = match self.shared.dispatcher.lock() {
+            Ok(mut dispatcher) => dispatcher.dispatch(request),
+            Err(poisoned) => poisoned.into_inner().dispatch(request),
+        };
+        if let Err(error) = dispatch_result {
+            self.shared.tracker.cancel(&request_id);
+            tracing::error!(
+                vshard_id = self.vshard_id,
+                epoch,
+                position,
+                committed,
+                %error,
+                "calvin: commit resolution dispatch failed"
+            );
+            return false;
+        }
+        self.spawn_response_bridge(txn_id, request_id, resp_rx);
+        true
+    }
+}
diff --git a/nodedb/src/control/cluster/calvin/scheduler/driver/core/commit_resolve.rs b/nodedb/src/control/cluster/calvin/scheduler/driver/core/commit_resolve.rs
index 3d713c572..1f38b9d16 100644
--- a/nodedb/src/control/cluster/calvin/scheduler/driver/core/commit_resolve.rs
+++ b/nodedb/src/control/cluster/calvin/scheduler/driver/core/commit_resolve.rs
@@ -22,8 +22,6 @@ use super::scheduler::Scheduler;
 use crate::bridge::envelope::{Response, Status};
 use crate::control::cluster::calvin::scheduler::lock_manager::TxnId;
 use crate::control::cluster::calvin::scheduler::metrics::infra_abort_reason;
-use nodedb_physical::physical_plan::PhysicalPlan;
-use nodedb_physical::physical_plan::meta::MetaOp;
 
 impl Scheduler {
     /// Cast this participant's local commit vote for a staged transaction, then
@@ -261,9 +259,9 @@ impl Scheduler {
         committed: bool,
         redo_lsn: Option<crate::types::Lsn>,
     ) {
-        if response.status == Status::Ok {
+        let completed = if response.status == Status::Ok {
             if committed {
-                self.commit_apply_tail(txn_id, response, redo_lsn);
+                self.commit_apply_tail(txn_id, response, redo_lsn)
             } else {
                 self.propose_sequencer_entry(
                     SequencerEntry::CompletionAck {
@@ -274,6 +272,7 @@ impl Scheduler {
                     txn_id,
                     "completion ack (dropped)",
                 );
+                true
             }
         } else {
             tracing::warn!(
@@ -286,10 +285,13 @@ impl Scheduler {
             self.metrics.record_executor_error();
             self.metrics
                 .record_infra_abort(infra_abort_reason::IO_ERROR);
-        }
+            false
+        };
 
-        self.metrics.record_completed();
-        self.on_txn_complete(txn_id);
+        if completed {
+            self.metrics.record_completed();
+            self.on_txn_complete(txn_id);
+        }
     }
 
     /// Deposit the applied result, durably mark the apply, record the apply's
@@ -310,7 +312,7 @@ impl Scheduler {
         txn_id: TxnId,
         response: Response,
         redo_lsn: Option<crate::types::Lsn>,
-    ) {
+    ) -> bool {
         // Deposit the FULL applied Response (affected-count + watermark + any
         // RETURNING rows) into the local sidecar BEFORE proposing the replicated
         // CompletionAck. The ack fires the coordinator's completion oneshot on
@@ -395,12 +397,15 @@ impl Scheduler {
                 }
             }
         }
-        match redo_lsn {
+        let applied_lsn = match redo_lsn {
             // The TransactionRedo record already durably marks this apply — the
             // SAME shard-local WAL-LSN space fast-path writes and read
             // watermarks use. Record the apply's per-key write versions at it;
             // no second (CalvinApplied) marker is written.
-            Some(lsn) => self.record_calvin_write_versions(txn_id, lsn),
+            Some(lsn) => {
+                self.record_calvin_write_versions(txn_id, lsn);
+                Some(lsn)
+            }
             None => match self.shared.wal.append_calvin_applied(
                 crate::types::VShardId::new(self.vshard_id),
                 txn_id.epoch,
@@ -410,7 +415,10 @@ impl Scheduler {
                 // apply — the SAME shard-local WAL-LSN space fast-path writes and
                 // read watermarks use. Record the apply's per-key write versions
                 // at it now that it exists (it did not at dispatch time).
-                Ok(applied_lsn) => self.record_calvin_write_versions(txn_id, applied_lsn),
+                Ok(applied_lsn) => {
+                    self.record_calvin_write_versions(txn_id, applied_lsn);
+                    Some(applied_lsn)
+                }
                 Err(e) => {
                     tracing::error!(
                         vshard_id = self.vshard_id,
@@ -419,8 +427,33 @@ impl Scheduler {
                         error = %e,
                         "calvin: failed to write CalvinApplied WAL record"
                     );
+                    None
                 }
             },
+        };
+        let Some(lsn) = applied_lsn else {
+            // The apply cannot be acknowledged without a durable participant
+            // LSN: CDC and write-version consumers would otherwise observe a
+            // successful commit with no authoritative ordering point.
+            return false;
+        };
+        // Control change-stream events are distinct from Data-Plane
+        // WriteEvents. Publish the participant-local logical manifests once,
+        // from the data-group leader, at the authoritative committed LSN.
+        if self.is_group_leader()
+            && let Some(pending) = self.pending.get_mut(&txn_id)
+        {
+            let tenant_id = pending.txn.tx_class.tenant_id;
+            let database_id = pending.txn.tx_class.database_id;
+            for change_set in std::mem::take(&mut pending.change_sets) {
+                crate::control::server::dispatch_utils::publish_change_set_with_lsn(
+                    &self.shared,
+                    tenant_id,
+                    database_id,
+                    change_set,
+                    lsn,
+                );
+            }
         }
         self.propose_sequencer_entry(
             SequencerEntry::CompletionAck {
@@ -431,66 +464,6 @@ impl Scheduler {
             txn_id,
             "completion ack",
         );
-    }
-
-    /// Dispatch a flush (`committed = true`) or drop (`committed = false`) of a
-    /// staged transaction's commit-pending buffer back to its core, registering
-    /// a response bridge so the resolve response re-enters the completion loop.
-    ///
-    /// `wal_lsn` is the just-appended `TransactionRedo` LSN for a flush whose
-    /// resolved redo carried ops (`Some`); `None` for a drop, or a flush whose
-    /// resolved redo was empty (falls back to the `CalvinApplied` marker in
-    /// `commit_apply_tail`).
-    ///
-    /// Returns `false` if the dispatch failed (the caller then completes the txn
-    /// as an infra error). Mirrors the exempt dispatch shape of the
-    /// static/active dispatch and the write-version record op.
-    pub(in crate::control::cluster::calvin::scheduler::driver::core) fn dispatch_commit_resolution(
-        &mut self,
-        txn_id: TxnId,
-        committed: bool,
-        wal_lsn: Option<crate::types::Lsn>,
-    ) -> bool {
-        let Some(pending) = self.pending.get(&txn_id) else {
-            return false;
-        };
-        let tenant_id = pending.txn.tx_class.tenant_id;
-        let epoch = txn_id.epoch;
-        let position = txn_id.position;
-
-        let plan = if committed {
-            PhysicalPlan::Meta(MetaOp::CalvinFlush { epoch, position })
-        } else {
-            PhysicalPlan::Meta(MetaOp::CalvinDrop { epoch, position })
-        };
-
-        let request_id = self.next_request_id();
-        // The redo record (if any) was already WAL-appended by the caller
-        // before this dispatch — see `finish_redo_resolve` — so its LSN
-        // rides on the envelope here rather than being allocated post-apply.
-        let request = self.build_exempt_request(request_id, tenant_id, plan, wal_lsn);
-
-        let resp_rx = self.shared.tracker.register(request_id);
-        let dispatch_result = match self.shared.dispatcher.lock() {
-            Ok(mut d) => d.dispatch(request),
-            Err(poisoned) => poisoned.into_inner().dispatch(request),
-        };
-        if let Err(e) = dispatch_result {
-            self.shared.tracker.cancel(&request_id);
-            tracing::error!(
-                vshard_id = self.vshard_id,
-                epoch,
-                position,
-                committed,
-                error = %e,
-                "calvin: flush/drop dispatch failed"
-            );
-            return false;
-        }
-
-        // The resolve response re-enters the completion loop under the SAME
-        // txn_id, now in `AwaitingResolve`, where `finish_resolved_commit` runs.
-        self.spawn_response_bridge(txn_id, request_id, resp_rx);
         true
     }
 }
diff --git a/nodedb/src/control/cluster/calvin/scheduler/driver/core/completion_route.rs b/nodedb/src/control/cluster/calvin/scheduler/driver/core/completion_route.rs
index 97602f3cb..8bd1b94f5 100644
--- a/nodedb/src/control/cluster/calvin/scheduler/driver/core/completion_route.rs
+++ b/nodedb/src/control/cluster/calvin/scheduler/driver/core/completion_route.rs
@@ -153,7 +153,7 @@ impl Scheduler {
             None => {}
         }
 
-        if response.status == crate::bridge::envelope::Status::Ok {
+        let completed = if response.status == crate::bridge::envelope::Status::Ok {
             // Observe whether the applying participant reported its slice of the
             // transaction's reads as no longer current against the local write
             // versions. Direct-apply (dependent/active) observation only: the
@@ -165,7 +165,7 @@ impl Scheduler {
                     .read_set_validation_failures
                     .fetch_add(1, std::sync::atomic::Ordering::Relaxed);
             }
-            self.commit_apply_tail(txn_id, response, None);
+            self.commit_apply_tail(txn_id, response, None)
         } else {
             tracing::warn!(
                 vshard_id = self.vshard_id,
@@ -177,9 +177,12 @@ impl Scheduler {
             self.metrics.record_infra_abort(
                 crate::control::cluster::calvin::scheduler::metrics::infra_abort_reason::IO_ERROR,
             );
-        }
+            false
+        };
 
-        self.metrics.record_completed();
-        self.on_txn_complete(txn_id);
+        if completed {
+            self.metrics.record_completed();
+            self.on_txn_complete(txn_id);
+        }
     }
 }
diff --git a/nodedb/src/control/cluster/calvin/scheduler/driver/core/dispatch.rs b/nodedb/src/control/cluster/calvin/scheduler/driver/core/dispatch.rs
index 836c66a7a..29f865c70 100644
--- a/nodedb/src/control/cluster/calvin/scheduler/driver/core/dispatch.rs
+++ b/nodedb/src/control/cluster/calvin/scheduler/driver/core/dispatch.rs
@@ -8,7 +8,7 @@ use tracing::error;
 
 use nodedb_cluster::calvin::types::SequencedTxn;
 
-use super::routing::{PlanRouting, plan_vshard};
+use super::routing::PlanRouting;
 use super::scheduler::Scheduler;
 use crate::control::cluster::calvin::scheduler::lock_manager::TxnId;
 use crate::types::{DatabaseId, VShardId};
@@ -30,6 +30,28 @@ use nodedb_physical::physical_plan::meta::MetaOp;
 /// so its rows are still deposited) while ALSO carrying the affected-count of a
 /// plain (non-RETURNING) write — which a RETURNING-only gate dropped, making a
 /// routed plain write report zero rows affected.
+fn participant_change_sets(
+    plans: &[PhysicalPlan],
+    tenant_id: crate::types::TenantId,
+    vshard_id: u32,
+) -> Vec<crate::control::server::dispatch_utils::WriteChangeSet> {
+    plans
+        .iter()
+        .filter(|plan| match plan {
+            // Edge plans are dual-homed; only the source participant publishes
+            // the one logical Control-Plane event.
+            PhysicalPlan::Graph(
+                nodedb_physical::physical_plan::GraphOp::EdgePut { src_id, .. }
+                | nodedb_physical::physical_plan::GraphOp::EdgeDelete { src_id, .. },
+            ) => VShardId::from_key(src_id.as_bytes()).as_u32() == vshard_id,
+            _ => true,
+        })
+        .map(|plan| {
+            crate::control::server::dispatch_utils::extract_write_change_set(plan, tenant_id)
+        })
+        .collect()
+}
+
 pub(crate) fn plans_have_primary_write(plans: &[PhysicalPlan]) -> bool {
     plans.iter().any(|plan| {
         crate::control::planner::calvin::is_write_plan(plan)
@@ -108,12 +130,13 @@ impl Scheduler {
     pub(in crate::control::cluster::calvin::scheduler::driver::core) fn local_calvin_plans(
         &self,
         plans: Vec<PhysicalPlan>,
+        database_id: DatabaseId,
         epoch: u64,
         position: u32,
     ) -> crate::Result<Vec<PhysicalPlan>> {
         let mut local = Vec::new();
         for plan in plans {
-            match plan_vshard(&plan) {
+            match super::routing::plan_vshard_in_database(&plan, database_id) {
                 PlanRouting::Vshards(vshards) => {
                     if vshards.iter().any(|v| v.as_u32() == self.vshard_id) {
                         local.push(plan);
@@ -154,23 +177,6 @@ impl Scheduler {
         Ok(local)
     }
 
-    /// Whether any of this transaction's LSN-versioned reads homes to THIS
-    /// scheduler's vShard — i.e. this node is a READ participant that must
-    /// validate its slice of the read-set even if it holds no local write.
-    ///
-    /// Homing uses the SAME `(DatabaseId::DEFAULT, collection)` function the
-    /// Data Plane's `read_set_still_current` filters with, so the scheduler and
-    /// the apply core agree on exactly which reads this vShard owns.
-    fn homes_any_local_read(
-        &self,
-        versioned_reads: &nodedb_types::calvin::VersionedReadSet,
-    ) -> bool {
-        versioned_reads.iter().any(|entry| {
-            VShardId::from_collection_in_database(DatabaseId::DEFAULT, &entry.collection).as_u32()
-                == self.vshard_id
-        })
-    }
-
     /// Dispatch a static-set ready transaction to the Data Plane executor.
     pub(in crate::control::cluster::calvin::scheduler::driver::core) fn dispatch_txn(
         &mut self,
@@ -196,7 +202,8 @@ impl Scheduler {
                 return;
             }
         };
-        let local = match self.local_calvin_plans(plans, epoch, position) {
+        let local = match self.local_calvin_plans(plans, txn.tx_class.database_id, epoch, position)
+        {
             Ok(p) => p,
             Err(e) => {
                 error!(
@@ -217,7 +224,13 @@ impl Scheduler {
         // still validate its slice of the read-set and cast a real commit/abort
         // vote — or a routing bug (neither writes nor reads home here). Only the
         // latter is an error; the former stages a validate-only task below.
-        if local.is_empty() && !self.homes_any_local_read(&txn.tx_class.versioned_reads) {
+        if local.is_empty()
+            && !super::routing::homes_versioned_read(
+                &txn.tx_class.versioned_reads,
+                txn.tx_class.database_id,
+                self.vshard_id,
+            )
+        {
             let e = crate::Error::Internal {
                 detail: format!(
                     "calvin txn {epoch}/{position} homes no local write plans or reads \
@@ -270,6 +283,7 @@ impl Scheduler {
         let request_id = self.next_request_id();
         let has_primary_write = plans_have_primary_write(&plans);
         let has_returning = plans_have_returning(&plans);
+        let change_sets = participant_change_sets(&plans, tenant_id, self.vshard_id);
         let plan = PhysicalPlan::Meta(MetaOp::CalvinExecuteStatic {
             epoch,
             position,
@@ -286,7 +300,8 @@ impl Scheduler {
         // Calvin allocates the CalvinApplied WAL LSN post-apply (in the
         // scheduler's response handler), so no committed LSN is known at
         // dispatch time to stamp here.
-        let request = self.build_exempt_request(request_id, tenant_id, plan, None);
+        let request =
+            self.build_exempt_request(request_id, tenant_id, txn.tx_class.database_id, plan, None);
 
         let resp_rx = self.shared.tracker.register(request_id);
 
@@ -323,6 +338,7 @@ impl Scheduler {
                 dispatch_time: dispatch_instant,
                 has_primary_write,
                 has_returning,
+                change_sets,
                 // This dispatch STAGED the txn (validate + buffer, no apply);
                 // its response carries the local commit vote that drives the
                 // subsequent flush-or-drop.
@@ -363,7 +379,8 @@ impl Scheduler {
                 return;
             }
         };
-        let plans = match self.local_calvin_plans(plans, epoch, position) {
+        let plans = match self.local_calvin_plans(plans, txn.tx_class.database_id, epoch, position)
+        {
             Ok(p) if !p.is_empty() => p,
             Ok(_) => {
                 // A dependent-read active txn dispatched here always carries a
@@ -405,6 +422,7 @@ impl Scheduler {
         };
         let has_primary_write = plans_have_primary_write(&plans);
         let has_returning = plans_have_returning(&plans);
+        let change_sets = participant_change_sets(&plans, tenant_id, self.vshard_id);
         let plan = PhysicalPlan::Meta(MetaOp::CalvinExecuteActive {
             epoch,
             position,
@@ -418,7 +436,8 @@ impl Scheduler {
         // Calvin allocates the CalvinApplied WAL LSN post-apply (in the
         // scheduler's response handler), so no committed LSN is known at
         // dispatch time to stamp here.
-        let request = self.build_exempt_request(request_id, tenant_id, plan, None);
+        let request =
+            self.build_exempt_request(request_id, tenant_id, txn.tx_class.database_id, plan, None);
 
         let resp_rx = self.shared.tracker.register(request_id);
 
@@ -455,6 +474,7 @@ impl Scheduler {
                 dispatch_time: dispatch_instant,
                 has_primary_write,
                 has_returning,
+                change_sets,
                 // The dependent-read active path now STAGES (leader-verify OLLP
                 // + buffer, no base apply); its response drives the same
                 // resolve → redo → flush as the static path, restoring
diff --git a/nodedb/src/control/cluster/calvin/scheduler/driver/core/mod.rs b/nodedb/src/control/cluster/calvin/scheduler/driver/core/mod.rs
index 9a3eac44c..34b0b82ca 100644
--- a/nodedb/src/control/cluster/calvin/scheduler/driver/core/mod.rs
+++ b/nodedb/src/control/cluster/calvin/scheduler/driver/core/mod.rs
@@ -45,6 +45,7 @@
 
 pub mod catch_up;
 pub mod commit_redo;
+pub mod commit_resolution_dispatch;
 pub mod commit_resolve;
 pub mod completion_route;
 pub mod dispatch;
diff --git a/nodedb/src/control/cluster/calvin/scheduler/driver/core/request.rs b/nodedb/src/control/cluster/calvin/scheduler/driver/core/request.rs
index 57e22d104..7648c3586 100644
--- a/nodedb/src/control/cluster/calvin/scheduler/driver/core/request.rs
+++ b/nodedb/src/control/cluster/calvin/scheduler/driver/core/request.rs
@@ -22,13 +22,14 @@ impl Scheduler {
         &self,
         request_id: RequestId,
         tenant_id: TenantId,
+        database_id: DatabaseId,
         plan: PhysicalPlan,
         wal_lsn: Option<Lsn>,
     ) -> Request {
         Request {
             request_id,
             tenant_id,
-            database_id: DatabaseId::DEFAULT,
+            database_id,
             vshard_id: VShardId::new(self.vshard_id),
             plan,
             // no-determinism: scheduler deadline controls waiting, not ordered state.
diff --git a/nodedb/src/control/cluster/calvin/scheduler/driver/core/routing.rs b/nodedb/src/control/cluster/calvin/scheduler/driver/core/routing.rs
index 9f1c23f95..07fb2ee33 100644
--- a/nodedb/src/control/cluster/calvin/scheduler/driver/core/routing.rs
+++ b/nodedb/src/control/cluster/calvin/scheduler/driver/core/routing.rs
@@ -38,22 +38,41 @@ pub(crate) enum PlanRouting {
     Unroutable(&'static str),
 }
 
+pub(crate) fn homes_versioned_read(
+    reads: &nodedb_types::calvin::VersionedReadSet,
+    database_id: DatabaseId,
+    vshard_id: u32,
+) -> bool {
+    reads.iter().any(|entry| {
+        VShardId::from_collection_in_database(database_id, &entry.collection).as_u32() == vshard_id
+    })
+}
+
+fn collection_vshard_in_database(database_id: DatabaseId, collection: &str) -> VShardId {
+    VShardId::from_collection_in_database(database_id, collection)
+}
+
+#[cfg(test)]
 fn collection_vshard(collection: &str) -> VShardId {
-    VShardId::from_collection_in_database(DatabaseId::DEFAULT, collection)
+    collection_vshard_in_database(DatabaseId::DEFAULT, collection)
 }
 
 /// Returns the routing decision for `plan`. Exhaustive over every
 /// `PhysicalPlan` variant and every op nested inside it — adding a new
 /// variant anywhere in this tree is a compile error, never a silent gap.
 pub(crate) fn plan_vshard(plan: &PhysicalPlan) -> PlanRouting {
+    plan_vshard_in_database(plan, DatabaseId::DEFAULT)
+}
+
+pub(crate) fn plan_vshard_in_database(plan: &PhysicalPlan, database_id: DatabaseId) -> PlanRouting {
     match plan {
-        PhysicalPlan::Document(op) => document_routing(op),
-        PhysicalPlan::Kv(op) => kv_routing(op),
-        PhysicalPlan::Vector(op) => vector_routing(op),
+        PhysicalPlan::Document(op) => document_routing(op, database_id),
+        PhysicalPlan::Kv(op) => kv_routing(op, database_id),
+        PhysicalPlan::Vector(op) => vector_routing(op, database_id),
         PhysicalPlan::Graph(op) => graph_routing(op),
-        PhysicalPlan::Timeseries(op) => timeseries_routing(op),
-        PhysicalPlan::Columnar(op) => columnar_routing(op),
-        PhysicalPlan::Crdt(op) => crdt_routing(op),
+        PhysicalPlan::Timeseries(op) => timeseries_routing(op, database_id),
+        PhysicalPlan::Columnar(op) => columnar_routing(op, database_id),
+        PhysicalPlan::Crdt(op) => crdt_routing(op, database_id),
         PhysicalPlan::Array(op) => array_routing(op),
         // Cluster-fanned-out array ops are handled entirely by the
         // Control-Plane `ArrayCoordinator` and never dispatched to the Data
@@ -68,7 +87,7 @@ pub(crate) fn plan_vshard(plan: &PhysicalPlan) -> PlanRouting {
     }
 }
 
-fn document_routing(op: &DocumentOp) -> PlanRouting {
+fn document_routing(op: &DocumentOp, database_id: DatabaseId) -> PlanRouting {
     match op {
         DocumentOp::PointPut { collection, .. }
         | DocumentOp::PointInsert { collection, .. }
@@ -79,11 +98,14 @@ fn document_routing(op: &DocumentOp) -> PlanRouting {
         | DocumentOp::BulkUpdate { collection, .. }
         | DocumentOp::BulkDelete { collection, .. }
         | DocumentOp::Truncate { collection, .. } => {
-            PlanRouting::Vshards(vec![collection_vshard(collection)])
+            PlanRouting::Vshards(vec![collection_vshard_in_database(database_id, collection)])
         }
         DocumentOp::InsertSelect {
             target_collection, ..
-        } => PlanRouting::Vshards(vec![collection_vshard(target_collection)]),
+        } => PlanRouting::Vshards(vec![collection_vshard_in_database(
+            database_id,
+            target_collection,
+        )]),
         // Both join the target with a DIFFERENT source collection; nothing on
         // the plan enforces the two live on the same vshard.
         DocumentOp::Merge { .. } | DocumentOp::UpdateFromJoin { .. } => PlanRouting::Unroutable(
@@ -102,7 +124,7 @@ fn document_routing(op: &DocumentOp) -> PlanRouting {
     }
 }
 
-fn kv_routing(op: &KvOp) -> PlanRouting {
+fn kv_routing(op: &KvOp, database_id: DatabaseId) -> PlanRouting {
     match op {
         KvOp::Put { collection, .. }
         | KvOp::Insert { collection, .. }
@@ -121,7 +143,7 @@ fn kv_routing(op: &KvOp) -> PlanRouting {
         // Transfer moves value between two KEYS in the SAME collection field,
         // so it stays single-home unlike `TransferItem` below.
         | KvOp::Transfer { collection, .. } => {
-            PlanRouting::Vshards(vec![collection_vshard(collection)])
+            PlanRouting::Vshards(vec![collection_vshard_in_database(database_id, collection)])
         }
         // Source and dest are DIFFERENT collections; no co-location guarantee.
         KvOp::TransferItem { .. } => PlanRouting::Unroutable(
@@ -145,7 +167,7 @@ fn kv_routing(op: &KvOp) -> PlanRouting {
     }
 }
 
-fn vector_routing(op: &VectorOp) -> PlanRouting {
+fn vector_routing(op: &VectorOp, database_id: DatabaseId) -> PlanRouting {
     match op {
         VectorOp::Insert { collection, .. }
         | VectorOp::BatchInsert { collection, .. }
@@ -156,7 +178,7 @@ fn vector_routing(op: &VectorOp) -> PlanRouting {
         | VectorOp::MultiVectorInsert { collection, .. }
         | VectorOp::MultiVectorDelete { collection, .. }
         | VectorOp::DirectUpsert { collection, .. } => {
-            PlanRouting::Vshards(vec![collection_vshard(collection)])
+            PlanRouting::Vshards(vec![collection_vshard_in_database(database_id, collection)])
         }
         VectorOp::Search { .. }
         | VectorOp::MultiSearch { .. }
@@ -227,27 +249,27 @@ fn graph_routing(op: &GraphOp) -> PlanRouting {
     }
 }
 
-fn timeseries_routing(op: &TimeseriesOp) -> PlanRouting {
+fn timeseries_routing(op: &TimeseriesOp, database_id: DatabaseId) -> PlanRouting {
     match op {
         TimeseriesOp::Ingest { collection, .. } => {
-            PlanRouting::Vshards(vec![collection_vshard(collection)])
+            PlanRouting::Vshards(vec![collection_vshard_in_database(database_id, collection)])
         }
         TimeseriesOp::Scan { .. } => PlanRouting::NotAWrite,
     }
 }
 
-fn columnar_routing(op: &ColumnarOp) -> PlanRouting {
+fn columnar_routing(op: &ColumnarOp, database_id: DatabaseId) -> PlanRouting {
     match op {
         ColumnarOp::Insert { collection, .. }
         | ColumnarOp::Update { collection, .. }
         | ColumnarOp::Delete { collection, .. } => {
-            PlanRouting::Vshards(vec![collection_vshard(collection)])
+            PlanRouting::Vshards(vec![collection_vshard_in_database(database_id, collection)])
         }
         ColumnarOp::Scan { .. } | ColumnarOp::MaterializeScan { .. } => PlanRouting::NotAWrite,
     }
 }
 
-fn crdt_routing(op: &CrdtOp) -> PlanRouting {
+fn crdt_routing(op: &CrdtOp, database_id: DatabaseId) -> PlanRouting {
     match op {
         CrdtOp::Apply { collection, .. }
         | CrdtOp::ListInsert { collection, .. }
@@ -259,7 +281,7 @@ fn crdt_routing(op: &CrdtOp) -> PlanRouting {
         | CrdtOp::DropConstraints { collection, .. }
         | CrdtOp::RestoreToVersion { collection, .. }
         | CrdtOp::ImportSnapshot { collection, .. } => {
-            PlanRouting::Vshards(vec![collection_vshard(collection)])
+            PlanRouting::Vshards(vec![collection_vshard_in_database(database_id, collection)])
         }
         CrdtOp::Read { .. }
         | CrdtOp::ReadConstraints { .. }
@@ -471,6 +493,28 @@ mod tests {
         assert_eq!(vshards_of(&plan), vec![want]);
     }
 
+    #[test]
+    fn collection_routing_preserves_database_scope() {
+        let collection = (0..2048)
+            .map(|i| format!("db_scoped_{i}"))
+            .find(|name| {
+                collection_vshard_in_database(DatabaseId::DEFAULT, name)
+                    != collection_vshard_in_database(DatabaseId::new(7), name)
+            })
+            .expect("collection whose home differs by database");
+        let plan = PhysicalPlan::Document(DocumentOp::Truncate {
+            collection: collection.clone(),
+            restart_identity: false,
+        });
+        let expected = collection_vshard_in_database(DatabaseId::new(7), &collection);
+        match plan_vshard_in_database(&plan, DatabaseId::new(7)) {
+            PlanRouting::Vshards(actual) => assert_eq!(actual, vec![expected]),
+            PlanRouting::ControlPlaneOnly | PlanRouting::NotAWrite | PlanRouting::Unroutable(_) => {
+                panic!("document truncate must be database-scoped")
+            }
+        }
+    }
+
     #[test]
     fn columnar_update_and_delete_route_to_collection_vshard() {
         let want = collection_vshard("metrics").as_u32();
diff --git a/nodedb/src/control/cluster/calvin/scheduler/driver/core/write_version_record.rs b/nodedb/src/control/cluster/calvin/scheduler/driver/core/write_version_record.rs
index 2652dd791..497cc8111 100644
--- a/nodedb/src/control/cluster/calvin/scheduler/driver/core/write_version_record.rs
+++ b/nodedb/src/control/cluster/calvin/scheduler/driver/core/write_version_record.rs
@@ -50,6 +50,7 @@ impl Scheduler {
             return;
         };
         let tenant_id = pending.txn.tx_class.tenant_id;
+        let database_id = pending.txn.tx_class.database_id;
         let plans = match super::super::helpers::decode_plans(&pending.txn.tx_class.plans) {
             Ok(p) => p,
             Err(e) => {
@@ -69,7 +70,7 @@ impl Scheduler {
         // without a per-key or collection version, so no gate on plan kind is
         // applied here — gating on a narrower write predicate would silently
         // skip recordable writes (e.g. a CRDT apply) and reopen the version gap.
-        let local = match self.local_calvin_plans(plans, epoch, position) {
+        let local = match self.local_calvin_plans(plans, database_id, epoch, position) {
             Ok(p) => p,
             Err(e) => {
                 tracing::warn!(
@@ -92,7 +93,8 @@ impl Scheduler {
         });
         // The committed write-LSN for this Calvin apply — recorded against
         // every key the plans wrote, in the same WAL-LSN space as fast-path.
-        let request = self.build_exempt_request(request_id, tenant_id, plan, Some(applied_lsn));
+        let request =
+            self.build_exempt_request(request_id, tenant_id, database_id, plan, Some(applied_lsn));
 
         // Register so the response routes to a real receiver (not the
         // unknown-request warning path), then discard it — the recording is
diff --git a/nodedb/src/control/cluster/calvin/scheduler/driver/types.rs b/nodedb/src/control/cluster/calvin/scheduler/driver/types.rs
index 8d0038787..9af0d5bef 100644
--- a/nodedb/src/control/cluster/calvin/scheduler/driver/types.rs
+++ b/nodedb/src/control/cluster/calvin/scheduler/driver/types.rs
@@ -42,6 +42,9 @@ pub(super) struct PendingTxn {
     /// multiple plain-write participants (a multi-collection cross-shard COMMIT)
     /// coalesce without conflict.
     pub has_returning: bool,
+    /// Participant-local Control-Plane change manifests. Consumed once after
+    /// durable COMMIT apply; graph dual-home replicas are excluded at capture.
+    pub change_sets: Vec<crate::control::server::dispatch_utils::WriteChangeSet>,
     /// Commit-resolution state for a static-set Calvin txn.
     ///
     /// `Some(CommitState::Staged)` for a static txn dispatched via the
diff --git a/nodedb/src/control/cluster/metadata_applier/catalog_ddl.rs b/nodedb/src/control/cluster/metadata_applier/catalog_ddl.rs
index 6297d5882..22d148ecd 100644
--- a/nodedb/src/control/cluster/metadata_applier/catalog_ddl.rs
+++ b/nodedb/src/control/cluster/metadata_applier/catalog_ddl.rs
@@ -59,12 +59,21 @@ impl MetadataCommitApplier {
         // value — idempotent by construction, with no per-node drift.
         //
         // Before persisting, validate the carried version against this
-        // node's local prior so a genuine regression or gap surfaces as a
-        // loud typed error (halting the apply watermark for this entry and
-        // forcing Raft re-delivery) rather than silently writing a
-        // divergent value. A version of `0` (compat mode / unit tests) is
-        // skipped by the validator.
-        catalog_entry::descriptor_stamp::validate(&stamped, catalog)?;
+        // node's local prior. Historical entries encountered during a full-log
+        // replay are acknowledged without overwriting newer state or repeating
+        // post-apply side effects. Forward gaps and same-version divergent
+        // payloads remain loud typed errors. A version of `0` (compat mode /
+        // unit tests) is applied without version fencing.
+        if matches!(
+            catalog_entry::descriptor_stamp::validate(&stamped, catalog)?,
+            catalog_entry::descriptor_stamp::ValidationOutcome::AlreadyApplied
+        ) {
+            debug!(
+                kind = stamped.kind(),
+                "catalog_entry: descriptor entry already superseded or applied"
+            );
+            return Ok(());
+        }
 
         debug!(kind = stamped.kind(), "catalog_entry: applying to redb");
         if !catalog_entry::apply::apply_to(&stamped, catalog) {
diff --git a/nodedb/src/control/cluster/metadata_applier/dispatch.rs b/nodedb/src/control/cluster/metadata_applier/dispatch.rs
index c0faddfc9..71dc946d7 100644
--- a/nodedb/src/control/cluster/metadata_applier/dispatch.rs
+++ b/nodedb/src/control/cluster/metadata_applier/dispatch.rs
@@ -33,6 +33,29 @@ impl MetadataCommitApplier {
         entry: &MetadataEntry,
         raft_index: u64,
     ) -> Result<(), crate::Error> {
+        // A prepared DDL is conditionally applied under the replicated owner
+        // token. A superseded proposal is a deterministic no-op: rejecting a
+        // committed stale token would wedge the Raft apply watermark forever.
+        if let MetadataEntry::DdlPrepared { token, entry } = entry {
+            let Some(shared) = self.shared.get().and_then(std::sync::Weak::upgrade) else {
+                return Ok(());
+            };
+            let owns_lease = shared
+                .metadata_ddl_owner
+                .lock()
+                .unwrap_or_else(|poisoned| poisoned.into_inner())
+                .is_some_and(|(current, _)| current == *token);
+            if !owns_lease {
+                debug!(token, raft_index, "skipping superseded prepared DDL");
+                return Ok(());
+            }
+            self.apply_host_side_effects(entry.as_ref(), raft_index)?;
+            shared
+                .metadata_ddl_applied_token
+                .store(*token, std::sync::atomic::Ordering::Release);
+            return Ok(());
+        }
+
         // Atomic batches unpack one level: the sub-entries are
         // applied individually so each gets its own audit record
         // stamped with the same raft_index (they committed at the
@@ -57,6 +80,30 @@ impl MetadataCommitApplier {
             MetadataEntry::DescriptorDrainEnd { descriptor_id } => {
                 return self.apply_drain_end(descriptor_id);
             }
+            MetadataEntry::DdlPrepareAcquire { token } => {
+                if let Some(shared) = self.shared.get().and_then(std::sync::Weak::upgrade) {
+                    let mut owner = shared
+                        .metadata_ddl_owner
+                        .lock()
+                        .unwrap_or_else(|poisoned| poisoned.into_inner());
+                    if owner.is_none() || owner.is_some_and(|(current, _)| current == *token) {
+                        *owner = Some((*token, std::time::Instant::now()));
+                    }
+                }
+                return Ok(());
+            }
+            MetadataEntry::DdlPrepareRelease { token } => {
+                if let Some(shared) = self.shared.get().and_then(std::sync::Weak::upgrade) {
+                    let mut owner = shared
+                        .metadata_ddl_owner
+                        .lock()
+                        .unwrap_or_else(|poisoned| poisoned.into_inner());
+                    if owner.is_some_and(|(current, _)| current == *token) {
+                        *owner = None;
+                    }
+                }
+                return Ok(());
+            }
             MetadataEntry::CaTrustChange {
                 add_ca_cert,
                 remove_ca_fingerprint,
diff --git a/nodedb/src/control/gateway/version_set.rs b/nodedb/src/control/gateway/version_set.rs
index 8d5b75517..7283fc06f 100644
--- a/nodedb/src/control/gateway/version_set.rs
+++ b/nodedb/src/control/gateway/version_set.rs
@@ -408,8 +408,16 @@ pub fn touched_collections(plan: &PhysicalPlan) -> Vec<String> {
         }
 
         // ── Meta ─────────────────────────────────────────────────────────
+        PhysicalPlan::Meta(nodedb_physical::physical_plan::MetaOp::TransactionBatch {
+            plans,
+            ..
+        }) => {
+            for plan in plans {
+                out.extend(touched_collections(plan));
+            }
+        }
         PhysicalPlan::Meta(_) => {
-            // Meta ops target infrastructure, not user collections.
+            // Other Meta ops target infrastructure, not user collections.
         }
 
         // ── Array ────────────────────────────────────────────────────────
diff --git a/nodedb/src/control/metadata_proposer.rs b/nodedb/src/control/metadata_proposer.rs
index 87473c00e..2fbee2809 100644
--- a/nodedb/src/control/metadata_proposer.rs
+++ b/nodedb/src/control/metadata_proposer.rs
@@ -22,8 +22,9 @@
 //!    `Error::Config { detail: "metadata propose: not leader ..." }`.
 //!    Gateway-side redirection will make this transparent.
 
+use std::sync::atomic::Ordering;
 use std::sync::{Arc, Weak};
-use std::time::Duration;
+use std::time::{Duration, Instant, SystemTime, UNIX_EPOCH};
 
 use nodedb_cluster::{METADATA_GROUP_ID, MetadataEntry, WaitOutcome, encode_entry};
 
@@ -49,6 +50,8 @@ pub const DEFAULT_PROPOSE_TIMEOUT: Duration = Duration::from_secs(5);
 /// `propose_catalog_entry_with_drain_timeout` can pass a longer
 /// value if an operator is willing to wait.
 pub const DEFAULT_DRAIN_TIMEOUT: Duration = Duration::from_secs(35);
+const DDL_PREPARE_LEASE: Duration = Duration::from_secs(60);
+const DDL_PREPARE_WAIT: Duration = Duration::from_secs(70);
 
 /// Type-erased handle for proposing to the metadata raft group.
 ///
@@ -120,6 +123,130 @@ impl MetadataRaftHandle for RaftLoopProposerHandle {
     }
 }
 
+fn wall_now_ns() -> u64 {
+    SystemTime::now()
+        .duration_since(UNIX_EPOCH)
+        .unwrap_or_default()
+        .as_nanos()
+        .min(u64::MAX as u128) as u64
+}
+
+fn propose_metadata_and_wait(
+    shared: &SharedState,
+    handle: &dyn MetadataRaftHandle,
+    entry: &MetadataEntry,
+    timeout: Duration,
+) -> Result<u64, Error> {
+    let raw = encode_entry(entry).map_err(|e| Error::Config {
+        detail: format!("metadata entry encode: {e}"),
+    })?;
+    let index = handle.propose(raw)?;
+    let watcher = shared.applied_index_watcher(METADATA_GROUP_ID);
+    let outcome = tokio::task::block_in_place(|| watcher.wait_for(index, timeout));
+    match outcome {
+        WaitOutcome::Reached => Ok(index),
+        WaitOutcome::TimedOut => Err(Error::Config {
+            detail: format!(
+                "metadata propose timed out after {timeout:?} waiting for log index {index} (current: {})",
+                watcher.current()
+            ),
+        }),
+        WaitOutcome::GroupGone => Err(Error::Config {
+            detail: "metadata group no longer hosted on this node".into(),
+        }),
+    }
+}
+
+/// RAII ownership of the metadata-Raft-serialized descriptor preparation lease.
+/// The matching release is itself replicated, so another node cannot stamp from
+/// the same prior catalog version until this guard is dropped and that release
+/// has applied.
+pub(crate) struct DdlPrepareGuard<'a> {
+    shared: &'a SharedState,
+    handle: &'a dyn MetadataRaftHandle,
+    token: u64,
+}
+
+impl DdlPrepareGuard<'_> {
+    pub(crate) fn token(&self) -> u64 {
+        self.token
+    }
+}
+
+impl Drop for DdlPrepareGuard<'_> {
+    fn drop(&mut self) {
+        if let Err(error) = propose_metadata_and_wait(
+            self.shared,
+            self.handle,
+            &MetadataEntry::DdlPrepareRelease { token: self.token },
+            DEFAULT_PROPOSE_TIMEOUT,
+        ) {
+            tracing::error!(token = self.token, %error, "metadata DDL lease release failed");
+        }
+    }
+}
+
+pub(crate) fn acquire_ddl_prepare_lease<'a>(
+    shared: &'a SharedState,
+    handle: &'a dyn MetadataRaftHandle,
+) -> Result<DdlPrepareGuard<'a>, Error> {
+    let sequence = shared
+        .metadata_ddl_token_seq
+        .fetch_add(1, Ordering::Relaxed);
+    let token = shared.node_id.wrapping_mul(0x9e37_79b9_7f4a_7c15)
+        ^ wall_now_ns().rotate_left(17)
+        ^ sequence;
+    let deadline = Instant::now() + DDL_PREPARE_WAIT;
+
+    loop {
+        propose_metadata_and_wait(
+            shared,
+            handle,
+            &MetadataEntry::DdlPrepareAcquire { token },
+            DEFAULT_PROPOSE_TIMEOUT,
+        )?;
+
+        loop {
+            let owner = *shared
+                .metadata_ddl_owner
+                .lock()
+                .map_err(|_| Error::Config {
+                    detail: "metadata DDL owner lock poisoned".into(),
+                })?;
+            match owner {
+                Some((current, _)) if current == token => {
+                    return Ok(DdlPrepareGuard {
+                        shared,
+                        handle,
+                        token,
+                    });
+                }
+                Some((current, acquired_at))
+                    if shared.is_metadata_leader()
+                        && acquired_at.elapsed() >= DDL_PREPARE_LEASE =>
+                {
+                    propose_metadata_and_wait(
+                        shared,
+                        handle,
+                        &MetadataEntry::DdlPrepareRelease { token: current },
+                        DEFAULT_PROPOSE_TIMEOUT,
+                    )?;
+                    break;
+                }
+                None => break,
+                Some(_) if Instant::now() < deadline => {
+                    std::thread::sleep(Duration::from_millis(10));
+                }
+                Some(_) => {
+                    return Err(Error::Config {
+                        detail: "metadata DDL preparation lease timed out".into(),
+                    });
+                }
+            }
+        }
+    }
+}
+
 /// Propose a `CatalogEntry` and block until the local applied-index
 /// watcher confirms the entry has been applied on this node.
 ///
@@ -158,6 +285,20 @@ pub fn propose_catalog_entry_with_timeout(
         }
     }
 
+    // Transactional DDL must remain unstamped until COMMIT: the batch
+    // preparation path stamps entries sequentially so repeated mutations of
+    // one descriptor receive distinct versions.
+    if crate::control::server::shared::session::ddl_buffer::try_buffer(entry.clone()) {
+        return Ok(0);
+    }
+
+    // Serialize preparation through local apply confirmation. Without this,
+    // concurrent proposers can both observe persisted version N and emit N+1.
+    let _local_ddl_guard = shared.metadata_ddl_lock.lock().map_err(|_| Error::Config {
+        detail: "metadata DDL preparation lock poisoned".into(),
+    })?;
+    let distributed_ddl_guard = acquire_ddl_prepare_lease(shared, handle.as_ref())?;
+
     // Drain for Put* variants that carry descriptor_version.
     // Leases acquired at plan time are refcounted and held
     // through execute; when the last in-flight query using a
@@ -210,19 +351,11 @@ pub fn propose_catalog_entry_with_timeout(
 
     let payload = catalog_entry::encode(entry)?;
 
-    // DDL transaction buffer: if a transactional DDL session is
-    // active on this thread (BEGIN ... COMMIT), buffer the payload
-    // instead of proposing immediately. The buffered entries will
-    // be proposed as a single MetadataEntry::Batch at COMMIT time.
-    if crate::control::server::shared::session::ddl_buffer::try_buffer(payload.clone()) {
-        return Ok(0);
-    }
-
     // Attach J.4 audit context when the pgwire statement boundary
     // installed one. Internal callers (descriptor lease grant/release,
     // drain proposer) run outside that scope and emit the plain
     // `CatalogDdl` variant — they have no SQL text to log.
-    let metadata_entry = match crate::control::server::shared::session::audit_context::current() {
+    let catalog_entry = match crate::control::server::shared::session::audit_context::current() {
         Some(ctx) => MetadataEntry::CatalogDdlAudited {
             payload,
             auth_user_id: ctx.auth_user_id,
@@ -231,6 +364,10 @@ pub fn propose_catalog_entry_with_timeout(
         },
         None => MetadataEntry::CatalogDdl { payload },
     };
+    let metadata_entry = MetadataEntry::DdlPrepared {
+        token: distributed_ddl_guard.token(),
+        entry: Box::new(catalog_entry),
+    };
     let raw = encode_entry(&metadata_entry).map_err(|e| Error::Config {
         detail: format!("metadata entry encode: {e}"),
     })?;
@@ -246,7 +383,15 @@ pub fn propose_catalog_entry_with_timeout(
     // in `block_in_place` so tokio reassigns a fresh worker.
     let outcome = tokio::task::block_in_place(|| watcher.wait_for(log_index, timeout));
     match outcome {
-        WaitOutcome::Reached => Ok(log_index),
+        WaitOutcome::Reached
+            if shared.metadata_ddl_applied_token.load(Ordering::Acquire)
+                == distributed_ddl_guard.token() =>
+        {
+            Ok(log_index)
+        }
+        WaitOutcome::Reached => Err(Error::Config {
+            detail: "metadata DDL preparation ownership was superseded before apply".into(),
+        }),
         WaitOutcome::TimedOut => Err(Error::Config {
             detail: format!(
                 "metadata propose timed out after {:?} waiting for log index {} (current: {})",
diff --git a/nodedb/src/control/planner/calvin/dispatch.rs b/nodedb/src/control/planner/calvin/dispatch.rs
index 032eaebef..4c8c93be4 100644
--- a/nodedb/src/control/planner/calvin/dispatch.rs
+++ b/nodedb/src/control/planner/calvin/dispatch.rs
@@ -36,7 +36,7 @@ use crate::control::planner::calvin::tx_class::build_static_tx_class;
 use crate::control::planner::calvin::types::{DispatchClass, DispatchOutcome};
 use crate::control::server::shared::session::TransactionState;
 use crate::control::server::shared::session::read_set::ReadSetEntry;
-use crate::types::{DatabaseId, VShardId};
+use crate::types::VShardId;
 use nodedb_physical::physical_plan::{DocumentOp, PhysicalPlan};
 use nodedb_physical::physical_task::PhysicalTask;
 
@@ -67,15 +67,14 @@ pub fn is_dependent_predicate(plan: &PhysicalPlan) -> bool {
 ///
 /// Each [`ReadSetEntry`] homes to its collection's vShard using the SAME
 /// collection→vShard map `ReadWriteSet::participating_vshards` uses to derive the
-/// `TxClass` read_set's participants (`DatabaseId::DEFAULT`-scoped, matching the
-/// write path's collection homing) — so the classifier's read∪write decision and
-/// the actual Calvin participant set agree. A read with no extractable collection
-/// contributes nothing.
+/// `TxClass` read_set's participants. Each read retains its session database so
+/// classification and the database-scoped transaction class agree. A read with
+/// no extractable collection contributes nothing.
 pub fn read_vshards_of(reads: &[ReadSetEntry]) -> BTreeSet<u32> {
     reads
         .iter()
         .filter(|e| !e.collection.is_empty())
-        .map(|e| VShardId::from_collection_in_database(DatabaseId::DEFAULT, &e.collection).as_u32())
+        .map(|e| VShardId::from_collection_in_database(e.database_id, &e.collection).as_u32())
         .collect()
 }
 
diff --git a/nodedb/src/control/planner/calvin/tx_class/dependent_builder.rs b/nodedb/src/control/planner/calvin/tx_class/dependent_builder.rs
index a6dcd69c5..846a311e2 100644
--- a/nodedb/src/control/planner/calvin/tx_class/dependent_builder.rs
+++ b/nodedb/src/control/planner/calvin/tx_class/dependent_builder.rs
@@ -19,7 +19,7 @@ use crate::types::VShardId;
 use nodedb_cluster::calvin::types::{EngineKeySet, ReadWriteSet, SortedVec, TxClass};
 use nodedb_physical::physical_plan::{GraphOp, PhysicalPlan};
 use nodedb_physical::physical_task::PhysicalTask;
-use nodedb_types::TenantId;
+use nodedb_types::{DatabaseId, TenantId};
 
 use super::shared::{
     collection_name_from_plan, read_set_from, surrogate_from_plan, versioned_reads_from,
@@ -106,6 +106,17 @@ fn build_dependent_tx_class_impl(
 ) -> crate::Result<TxClass> {
     use std::collections::BTreeMap;
 
+    let database_id = tasks
+        .first()
+        .map_or(DatabaseId::DEFAULT, |task| task.database_id);
+    if tasks.iter().any(|task| task.database_id != database_id)
+        || reads.iter().any(|read| read.database_id != database_id)
+    {
+        return Err(Error::BadRequest {
+            detail: "Calvin transaction spans multiple databases".to_owned(),
+        });
+    }
+
     // Accumulate per-collection surrogate sets. The OLLP collection uses the
     // predicted surrogates; all other tasks use static key extraction.
     let mut doc_surrogates: BTreeMap<String, Vec<u32>> = BTreeMap::new();
@@ -208,20 +219,22 @@ fn build_dependent_tx_class_impl(
     let versioned_reads = versioned_reads_from(reads);
 
     let result = if allow_single_vshard {
-        TxClass::new_single_vshard(
+        TxClass::new_single_vshard_in_database(
             read_set,
             write_set,
             plans_bytes,
             tenant_id,
+            database_id,
             None,
             versioned_reads,
         )
     } else {
-        TxClass::new(
+        TxClass::new_in_database(
             read_set,
             write_set,
             plans_bytes,
             tenant_id,
+            database_id,
             None,
             versioned_reads,
         )
diff --git a/nodedb/src/control/planner/calvin/tx_class/static_builder.rs b/nodedb/src/control/planner/calvin/tx_class/static_builder.rs
index 900b64580..be86a61c1 100644
--- a/nodedb/src/control/planner/calvin/tx_class/static_builder.rs
+++ b/nodedb/src/control/planner/calvin/tx_class/static_builder.rs
@@ -10,7 +10,7 @@ use crate::types::VShardId;
 use nodedb_cluster::calvin::types::{EngineKeySet, ReadWriteSet, SortedVec, TxClass};
 use nodedb_physical::physical_plan::{GraphOp, PhysicalPlan};
 use nodedb_physical::physical_task::PhysicalTask;
-use nodedb_types::TenantId;
+use nodedb_types::{DatabaseId, TenantId};
 
 use super::shared::{
     collection_name_from_plan, kv_write_keys, read_set_from, surrogate_from_plan,
@@ -72,6 +72,17 @@ fn build_static_tx_class_impl(
 ) -> crate::Result<TxClass> {
     use std::collections::HashMap;
 
+    let database_id = tasks
+        .first()
+        .map_or(DatabaseId::DEFAULT, |task| task.database_id);
+    if tasks.iter().any(|task| task.database_id != database_id)
+        || reads.iter().any(|read| read.database_id != database_id)
+    {
+        return Err(Error::BadRequest {
+            detail: "Calvin transaction spans multiple databases".to_owned(),
+        });
+    }
+
     // Collect surrogates per collection for non-edge write tasks.
     let mut doc_surrogates: HashMap<String, Vec<u32>> = HashMap::new();
     // Collect edge identity (surrogate pairs) and routing homes
@@ -228,20 +239,22 @@ fn build_static_tx_class_impl(
     let versioned_reads = versioned_reads_from(&owned_reads);
 
     let result = if allow_single_vshard {
-        TxClass::new_single_vshard(
+        TxClass::new_single_vshard_in_database(
             read_set,
             write_set,
             plans_bytes,
             tenant_id,
+            database_id,
             None,
             versioned_reads,
         )
     } else {
-        TxClass::new(
+        TxClass::new_in_database(
             read_set,
             write_set,
             plans_bytes,
             tenant_id,
+            database_id,
             None,
             versioned_reads,
         )
@@ -306,6 +319,26 @@ mod tests {
         }
     }
 
+    #[test]
+    fn single_vshard_builder_preserves_database_scope() {
+        let mut task = point_insert_task("db_scoped", 1);
+        task.database_id = DatabaseId::new(7);
+        let tx = build_single_vshard_tx_class(&[task], TenantId::new(1), &[])
+            .expect("valid single-vshard TxClass");
+        assert_eq!(tx.database_id, DatabaseId::new(7));
+    }
+
+    #[test]
+    fn builder_rejects_cross_database_batches() {
+        let (col_a, col_b) = two_distinct_collections();
+        let first = point_insert_task(&col_a, 1);
+        let mut second = point_insert_task(&col_b, 2);
+        second.database_id = DatabaseId::new(7);
+        let error = build_static_tx_class(&[first, second], TenantId::new(1), &[])
+            .expect_err("cross-database Calvin batch must fail");
+        assert!(error.to_string().contains("multiple databases"));
+    }
+
     #[test]
     fn build_static_populates_read_set_and_unions_read_participants() {
         let (col_a, col_b) = two_distinct_collections();
diff --git a/nodedb/src/control/planner/catalog_adapter/sql_catalog_impl.rs b/nodedb/src/control/planner/catalog_adapter/sql_catalog_impl.rs
index cf3aa939a..5d6d2dbd3 100644
--- a/nodedb/src/control/planner/catalog_adapter/sql_catalog_impl.rs
+++ b/nodedb/src/control/planner/catalog_adapter/sql_catalog_impl.rs
@@ -164,19 +164,45 @@ impl SqlCatalog for OriginCatalog {
         _tenant_id: u64,
         name: &str,
     ) -> Option<i64> {
+        let name = nodedb_sql::catalog::normalize_regclass_name(name)?;
+
         // Check system/catalog relation OIDs first.
         if let Some(&oid) = crate::control::server::pgwire::catalog::oid::SYSTEM_REL_OIDS
             .iter()
-            .find(|(n, _)| *n == name)
-            .map(|(_, o)| o)
+            .find(|(relation, _)| *relation == name)
+            .map(|(_, oid)| oid)
         {
             return Some(oid);
         }
-        // Fall back to the stable hash-derived OID for user collections.
+
+        // A hash-derived OID is stable only after catalog existence has been
+        // established. Fabricating one for an unknown name makes regclass
+        // predicates silently compare against a relation that does not exist.
+        let stored = self
+            .credentials
+            .catalog()
+            .get_collection(self.database_id, self.tenant_id, &name)
+            .ok()
+            .flatten()
+            .filter(|stored| stored.is_active)?;
+
+        // A folded regclass literal is a schema dependency just like a scan of
+        // the relation. Record it so dropping or altering the target invalidates
+        // a cached physical plan that embeds its OID.
+        let descriptor_id = DescriptorId::new(
+            self.tenant_id,
+            DescriptorKind::Collection,
+            stored.name.clone(),
+        );
+        self.recorded_versions
+            .lock()
+            .unwrap_or_else(|p| p.into_inner())
+            .record(descriptor_id, stored.descriptor_version.max(1));
+
         Some(
             crate::control::server::pgwire::catalog::oid::stable_collection_oid(
                 self.tenant_id,
-                name,
+                &name,
             ),
         )
     }
diff --git a/nodedb/src/control/planner/context/query/planning.rs b/nodedb/src/control/planner/context/query/planning.rs
index 74c887e16..2e0d49ba4 100644
--- a/nodedb/src/control/planner/context/query/planning.rs
+++ b/nodedb/src/control/planner/context/query/planning.rs
@@ -86,6 +86,10 @@ impl QueryContext {
                 collection: name,
                 retention_expires_at_ns,
             },
+            nodedb_sql::SqlError::UnknownTable { name } => crate::Error::CollectionNotFound {
+                tenant_id,
+                collection: name,
+            },
             other => crate::Error::PlanError {
                 detail: format!("{other}"),
             },
@@ -103,7 +107,16 @@ impl QueryContext {
                     tenant_id.as_u64(),
                 )
             })
-            .collect();
+            .collect::<nodedb_sql::Result<_>>()
+            .map_err(|error| match error {
+                nodedb_sql::SqlError::UnknownTable { name } => crate::Error::CollectionNotFound {
+                    tenant_id,
+                    collection: name,
+                },
+                other => crate::Error::PlanError {
+                    detail: other.to_string(),
+                },
+            })?;
         let version_set = catalog.take_recorded_versions();
         let ctx = crate::control::planner::sql_plan_convert::ConvertContext {
             retention_registry: self.retention_registry.clone(),
@@ -262,11 +275,17 @@ impl QueryContext {
         // adapter fresh keeps the adapter's state per-plan and
         // allows future extension.
         let catalog = inputs.build_adapter(tenant_id.as_u64(), database_id);
-        let raw_plans = nodedb_sql::plan_sql_with_params(sql, params, &catalog).map_err(|e| {
-            crate::Error::PlanError {
-                detail: format!("{e}"),
-            }
-        })?;
+        let raw_plans = nodedb_sql::plan_sql_with_params(sql, params, &catalog).map_err(
+            |error| match error {
+                nodedb_sql::SqlError::UnknownTable { name } => crate::Error::CollectionNotFound {
+                    tenant_id,
+                    collection: name,
+                },
+                other => crate::Error::PlanError {
+                    detail: other.to_string(),
+                },
+            },
+        )?;
         let plans: Vec<_> = raw_plans
             .into_iter()
             .map(|p| {
@@ -277,7 +296,16 @@ impl QueryContext {
                     tenant_id.as_u64(),
                 )
             })
-            .collect();
+            .collect::<nodedb_sql::Result<_>>()
+            .map_err(|error| match error {
+                nodedb_sql::SqlError::UnknownTable { name } => crate::Error::CollectionNotFound {
+                    tenant_id,
+                    collection: name,
+                },
+                other => crate::Error::PlanError {
+                    detail: other.to_string(),
+                },
+            })?;
         let ctx = crate::control::planner::sql_plan_convert::ConvertContext {
             retention_registry: self.retention_registry.clone(),
             array_catalog: self.array_catalog.clone(),
diff --git a/nodedb/src/control/security/catalog/collections.rs b/nodedb/src/control/security/catalog/collections.rs
index 92d025a2b..6a1686fdf 100644
--- a/nodedb/src/control/security/catalog/collections.rs
+++ b/nodedb/src/control/security/catalog/collections.rs
@@ -46,6 +46,44 @@ impl SystemCatalog {
         write_txn.commit().map_err(|e| catalog_err("commit", e))
     }
 
+    /// Insert a collection only when its catalog key is absent.
+    ///
+    /// The existence check and insert share one redb write transaction, so
+    /// concurrent direct-mode schema announcements cannot overwrite the first
+    /// winner after both observed absence.
+    pub fn put_collection_if_absent(
+        &self,
+        database_id: DatabaseId,
+        coll: &StoredCollection,
+    ) -> crate::Result<bool> {
+        let inner_key = format!("{}:{}", coll.tenant_id, coll.name);
+        let bytes =
+            zerompk::to_msgpack_vec(coll).map_err(|e| catalog_err("serialize collection", e))?;
+        let write_txn = self
+            .db
+            .begin_write()
+            .map_err(|e| catalog_err("write txn", e))?;
+        let inserted = {
+            let mut table = write_txn
+                .open_table(COLLECTIONS)
+                .map_err(|e| catalog_err("open collections", e))?;
+            if table
+                .get((database_id.as_u64(), inner_key.as_str()))
+                .map_err(|e| catalog_err("get collection", e))?
+                .is_some()
+            {
+                false
+            } else {
+                table
+                    .insert((database_id.as_u64(), inner_key.as_str()), bytes.as_slice())
+                    .map_err(|e| catalog_err("insert collection", e))?;
+                true
+            }
+        };
+        write_txn.commit().map_err(|e| catalog_err("commit", e))?;
+        Ok(inserted)
+    }
+
     /// Load all collections for a tenant within a database.
     pub fn load_collections_for_tenant(
         &self,
diff --git a/nodedb/src/control/server/dispatch_utils/change_events/extract.rs b/nodedb/src/control/server/dispatch_utils/change_events/extract.rs
index 60efa4e70..335248399 100644
--- a/nodedb/src/control/server/dispatch_utils/change_events/extract.rs
+++ b/nodedb/src/control/server/dispatch_utils/change_events/extract.rs
@@ -7,7 +7,7 @@ use crate::bridge::envelope::PhysicalPlan;
 use crate::control::change_stream::ChangeOperation;
 use crate::types::TenantId;
 use nodedb_physical::physical_plan::{
-    ArrayOp, ClusterArrayOp, ColumnarOp, CrdtOp, DocumentOp, KvOp, TimeseriesOp, VectorOp,
+    ArrayOp, ClusterArrayOp, ColumnarOp, CrdtOp, DocumentOp, KvOp, MetaOp, TimeseriesOp, VectorOp,
 };
 
 /// Extract write metadata from a physical plan for change event publishing.
@@ -396,8 +396,13 @@ pub(super) fn extract_write_metadata(
         // read-only.
         PhysicalPlan::Query(_) => Vec::new(),
 
-        // Meta: WAL/cancel/snapshot/compact/checkpoint are maintenance ops,
-        // not user-data writes.
+        // A committed transaction batch publishes the same logical row events
+        // its constituent writes would have emitted under autocommit. Overlay
+        // and maintenance Meta operations remain event-free.
+        PhysicalPlan::Meta(MetaOp::TransactionBatch { plans, .. }) => plans
+            .iter()
+            .flat_map(|plan| extract_write_metadata(plan, _tenant_id))
+            .collect(),
         PhysicalPlan::Meta(_) => Vec::new(),
 
         // Cluster-mode array ops: like their single-node `ArrayOp` counterparts
@@ -445,6 +450,37 @@ mod tests {
     // avoid double-publishing implicit-edge writes alongside their
     // underlying `DocumentOp` event.
 
+    #[test]
+    fn transaction_batch_emits_each_subplan_change_event() {
+        let plan = PhysicalPlan::Meta(MetaOp::TransactionBatch {
+            plans: vec![
+                PhysicalPlan::Document(DocumentOp::PointPut {
+                    collection: "users".into(),
+                    document_id: "u1".into(),
+                    value: Vec::new(),
+                    surrogate: Surrogate::new(1),
+                    pk_bytes: Vec::new(),
+                }),
+                PhysicalPlan::Document(DocumentOp::PointDelete {
+                    collection: "users".into(),
+                    document_id: "u2".into(),
+                    surrogate: Surrogate::new(2),
+                    pk_bytes: Vec::new(),
+                    returning: None,
+                }),
+            ],
+            txn_id: None,
+        });
+        let meta = extract_write_metadata(&plan, TenantId::new(1));
+        assert_eq!(
+            meta,
+            vec![
+                ("users".into(), "u1".into(), ChangeOperation::Insert),
+                ("users".into(), "u2".into(), ChangeOperation::Delete),
+            ]
+        );
+    }
+
     #[test]
     fn columnar_insert_emits_change_event() {
         let plan = PhysicalPlan::Columnar(ColumnarOp::Insert {
diff --git a/nodedb/src/control/server/dispatch_utils/change_events/mod.rs b/nodedb/src/control/server/dispatch_utils/change_events/mod.rs
index ece096843..62546be8d 100644
--- a/nodedb/src/control/server/dispatch_utils/change_events/mod.rs
+++ b/nodedb/src/control/server/dispatch_utils/change_events/mod.rs
@@ -7,6 +7,6 @@ mod extract;
 mod publish;
 
 pub(crate) use publish::{
-    extract_write_change_set, publish_change_set, publish_cluster_array_change_events,
-    publish_origin_change_events,
+    WriteChangeSet, extract_write_change_set, publish_change_set, publish_change_set_with_lsn,
+    publish_cluster_array_change_events, publish_origin_change_events,
 };
diff --git a/nodedb/src/control/server/dispatch_utils/change_events/publish.rs b/nodedb/src/control/server/dispatch_utils/change_events/publish.rs
index 62c4f9a8b..e2d232377 100644
--- a/nodedb/src/control/server/dispatch_utils/change_events/publish.rs
+++ b/nodedb/src/control/server/dispatch_utils/change_events/publish.rs
@@ -135,7 +135,7 @@ pub(crate) fn extract_write_change_set(plan: &PhysicalPlan, tenant_id: TenantId)
 /// write plan yields exactly one event; a handful of multi-row /
 /// multi-collection ops yield more than one, and reads / DDL / index
 /// maintenance yield none.
-fn publish_change_set_with_lsn(
+pub(crate) fn publish_change_set_with_lsn(
     shared: &SharedState,
     tenant_id: TenantId,
     database_id: DatabaseId,
diff --git a/nodedb/src/control/server/dispatch_utils/mod.rs b/nodedb/src/control/server/dispatch_utils/mod.rs
index 5ef93a54d..e7cd038ca 100644
--- a/nodedb/src/control/server/dispatch_utils/mod.rs
+++ b/nodedb/src/control/server/dispatch_utils/mod.rs
@@ -8,7 +8,10 @@ mod dispatch;
 mod submit_write;
 mod types;
 
-pub(crate) use change_events::{publish_cluster_array_change_events, publish_origin_change_events};
+pub(crate) use change_events::{
+    WriteChangeSet, extract_write_change_set, publish_change_set_with_lsn,
+    publish_cluster_array_change_events, publish_origin_change_events,
+};
 pub(crate) use collect::{DispatchCollectError, collect_bounded_response};
 pub(crate) use dispatch::{dispatch_autocommit_write, dispatch_write_to_data_plane};
 pub use dispatch::{
diff --git a/nodedb/src/control/server/native/dispatch/transaction.rs b/nodedb/src/control/server/native/dispatch/transaction.rs
index a7c0b17cd..a32fa11e6 100644
--- a/nodedb/src/control/server/native/dispatch/transaction.rs
+++ b/nodedb/src/control/server/native/dispatch/transaction.rs
@@ -15,17 +15,19 @@ use std::pin::Pin;
 use nodedb_types::TraceId;
 use nodedb_types::protocol::NativeResponse;
 
-use crate::bridge::envelope::{ErrorCode, Payload, Response, Status};
-use crate::control::gateway::core::QueryContext as GatewayQueryContext;
+use crate::bridge::envelope::{ErrorCode, Response};
+use crate::control::gateway::RouteDecision;
+use crate::control::server::dispatch_utils::{
+    ChangeFeedOwner, SubmitWrite, WalDurability, WriteOrdering, submit_write,
+};
 use crate::control::server::shared::ddl::sqlstate::error_code_to_sqlstate;
 use crate::control::server::shared::session::{
     AbortReason, CommitOutcome, TxnDataPlane, commit, lifecycle,
 };
 use crate::control::state::SharedState;
-use crate::types::{Lsn, RequestId};
+use crate::types::Lsn;
 use nodedb_physical::physical_task::PhysicalTask;
 
-use super::super::super::dispatch_utils;
 use super::DispatchCtx;
 
 /// Native Data-Plane dispatch seam for the neutral transaction orchestrator.
@@ -47,48 +49,44 @@ impl TxnDataPlane for NativeTxnDp<'_> {
     ) -> Pin<Box<dyn Future<Output = crate::Result<Response>> + Send + 'a>> {
         let state = self.state;
         Box::pin(async move {
-            match state.gateway.get() {
-                Some(gw) => {
-                    let gw_ctx = GatewayQueryContext {
+            let decision = crate::control::server::shared::session::resolve_leader(&task, state);
+            if matches!(decision, RouteDecision::Local) {
+                return submit_write(
+                    state,
+                    SubmitWrite {
                         tenant_id: task.tenant_id,
-                        trace_id: TraceId::generate(),
                         database_id: task.database_id,
+                        vshard_id: task.vshard_id,
+                        plan: task.plan,
+                        trace_id: TraceId::generate(),
+                        event_source: crate::event::EventSource::User,
                         txn_id: task.txn_id,
-                    };
-                    let payloads = gw.execute(&gw_ctx, task.plan).await?;
-                    Ok(Response {
-                        request_id: RequestId::new(0),
-                        status: Status::Ok,
-                        attempt: 0,
-                        partial: false,
-                        payload: Payload::from_vec(payloads.into_iter().next().unwrap_or_default()),
-                        watermark_lsn: Lsn::new(0),
-                        error_code: None,
-                        read_set_valid: None,
-                        read_version_lsn: crate::types::Lsn::ZERO,
-                        write_set: Vec::new(),
-                    })
-                }
-                None => {
-                    dispatch_utils::dispatch_write_to_data_plane(
-                        state,
-                        dispatch_utils::WriteDispatch {
-                            tenant_id: task.tenant_id,
-                            database_id: task.database_id,
-                            vshard_id: task.vshard_id,
-                            plan: task.plan,
-                            trace_id: TraceId::ZERO,
-                            event_source: crate::event::EventSource::User,
-                            txn_id: None,
+                        user_id: None,
+                        durability: WalDurability::CallerSupplied {
                             wal_lsn,
-                            // Batch COMMIT record, not per-task WAL append — see
-                            // `dispatch_task_no_wal`'s equivalent limitation.
                             resolved_now_ms: None,
                         },
-                    )
-                    .await
-                }
+                        ordering: WriteOrdering::Gate,
+                        change_feed: ChangeFeedOwner::Funnel,
+                    },
+                )
+                .await
+                .map(|outcome| outcome.response);
+            }
+
+            if wal_lsn.is_some() {
+                return Err(crate::Error::Internal {
+                    detail: "non-local transaction commit must route through Calvin".into(),
+                });
             }
+            let version_plan = task.plan.clone();
+            crate::control::server::shared::session::forward_to_leader(
+                state,
+                decision,
+                task,
+                &version_plan,
+            )
+            .await
         })
     }
 }
diff --git a/nodedb/src/control/server/pgwire/handler/dispatch.rs b/nodedb/src/control/server/pgwire/handler/dispatch.rs
index 498a6090c..5e790acd3 100644
--- a/nodedb/src/control/server/pgwire/handler/dispatch.rs
+++ b/nodedb/src/control/server/pgwire/handler/dispatch.rs
@@ -398,7 +398,9 @@ impl NodeDbPgHandler {
             attempt: 1,
             partial: false,
             payload: payload.into(),
-            watermark_lsn: Lsn::new(0),
+            // Replicated apply returns the authoritative participant WAL LSN.
+            // CDC ordering must use it rather than a synthetic zero watermark.
+            watermark_lsn: write_version,
             error_code: None,
             read_set_valid: None,
             read_version_lsn: write_version,
diff --git a/nodedb/src/control/server/shared/ddl/neutral/graph_ops/stats.rs b/nodedb/src/control/server/shared/ddl/neutral/graph_ops/stats.rs
index 68dd3211c..6de436d87 100644
--- a/nodedb/src/control/server/shared/ddl/neutral/graph_ops/stats.rs
+++ b/nodedb/src/control/server/shared/ddl/neutral/graph_ops/stats.rs
@@ -86,9 +86,13 @@ pub async fn show_graph_stats(
         )?;
     }
 
+    // Exact logical-edge scans are required even for current-time reads:
+    // source-owned summaries cannot deduplicate a destination shared by edges
+    // from different source vShards, and mixed legacy/current collections may
+    // have no summary row at all. Identity union below is the correctness path.
     let plan = PhysicalPlan::Graph(GraphOp::Stats {
         collection: collection.clone(),
-        as_of,
+        as_of: as_of.or(Some(i64::MAX)),
     });
 
     let resp = broadcast_to_all_cores(state, identity.tenant_id, database_id, plan, TraceId::ZERO)
@@ -157,6 +161,10 @@ fn filter_active_collections(
 /// label counts and re-deriving `distinct_label_count` from the merged set.
 fn aggregate_by_collection(entries: Vec<CollectionStats>) -> Vec<CollectionStats> {
     let mut label_acc: BTreeMap<String, BTreeMap<String, u64>> = BTreeMap::new();
+    let mut historical_edges: BTreeMap<
+        String,
+        std::collections::BTreeSet<(String, String, String)>,
+    > = BTreeMap::new();
     let mut by_name: BTreeMap<String, CollectionStats> = BTreeMap::new();
 
     for e in entries {
@@ -173,14 +181,32 @@ fn aggregate_by_collection(entries: Vec<CollectionStats>) -> Vec<CollectionStats
             let slot = labels.entry(label).or_insert(0);
             *slot = slot.saturating_add(count);
         }
+        historical_edges
+            .entry(e.collection)
+            .or_default()
+            .extend(e.logical_edges);
     }
 
     let mut result: Vec<CollectionStats> = Vec::with_capacity(by_name.len());
     for (collection, mut acc) in by_name {
-        let labels_map = label_acc.remove(&collection).unwrap_or_default();
-        let labels: Vec<(String, u64)> = labels_map.into_iter().collect();
-        acc.distinct_label_count = labels.len() as u64;
-        acc.labels = labels;
+        let exact_edges = historical_edges.remove(&collection).unwrap_or_default();
+        if exact_edges.is_empty() {
+            let labels_map = label_acc.remove(&collection).unwrap_or_default();
+            acc.labels = labels_map.into_iter().collect();
+        } else {
+            let mut nodes = std::collections::BTreeSet::new();
+            let mut labels = BTreeMap::<String, u64>::new();
+            for (src, label, dst) in &exact_edges {
+                nodes.insert(src);
+                nodes.insert(dst);
+                *labels.entry(label.clone()).or_default() += 1;
+            }
+            acc.edge_count = exact_edges.len() as u64;
+            acc.distinct_node_count = nodes.len() as u64;
+            acc.labels = labels.into_iter().collect();
+            acc.logical_edges = exact_edges.into_iter().collect();
+        }
+        acc.distinct_label_count = acc.labels.len() as u64;
         result.push(acc);
     }
     result
diff --git a/nodedb/src/control/server/shared/ddl/neutral/tenant/drop.rs b/nodedb/src/control/server/shared/ddl/neutral/tenant/drop.rs
index 701a75a23..20f7e02f5 100644
--- a/nodedb/src/control/server/shared/ddl/neutral/tenant/drop.rs
+++ b/nodedb/src/control/server/shared/ddl/neutral/tenant/drop.rs
@@ -33,6 +33,16 @@ pub fn drop_tenant(
             "permission denied: only superuser can drop tenants",
         ));
     }
+    // Tenant teardown currently coordinates catalog rows with several
+    // in-memory security stores. It must not enter the generic transactional
+    // DDL buffer, whose rollback only discards metadata entries and cannot undo
+    // those side effects.
+    if crate::control::server::shared::session::ddl_buffer::is_active() {
+        return Err(ddl_err(
+            "0A000",
+            "DROP TENANT is not allowed inside an explicit transaction",
+        ));
+    }
 
     let (if_exists, parts) = strip_if_exists(parts, 2);
 
diff --git a/nodedb/src/control/server/shared/ddl/neutral/user/drop.rs b/nodedb/src/control/server/shared/ddl/neutral/user/drop.rs
index 4b7484ffb..578c279ef 100644
--- a/nodedb/src/control/server/shared/ddl/neutral/user/drop.rs
+++ b/nodedb/src/control/server/shared/ddl/neutral/user/drop.rs
@@ -17,6 +17,7 @@ use crate::control::state::SharedState;
 use super::super::super::result::{DdlError, DdlResult};
 use super::super::auth_support::{require_tenant_admin, status, strip_if_exists};
 use super::reassign_owned::reassign_owned_and_sweep_grants;
+use super::tenant_purge::purge_owned_for_tenant_teardown;
 
 /// DROP USER [IF EXISTS] <name>
 pub fn drop_user(
@@ -105,7 +106,12 @@ fn drop_user_inner(
     // user, BEFORE removing the user row. Fail-closed: any error here
     // aborts the drop, because a partially-reassigned-then-deleted user
     // is exactly the dangling-reference bug this guards against.
-    let admin_name = reassign_owned_and_sweep_grants(state, username, user_tenant)?;
+    let admin_name = if tenant_teardown {
+        purge_owned_for_tenant_teardown(state, username, user_tenant)?;
+        None
+    } else {
+        reassign_owned_and_sweep_grants(state, username, user_tenant)?
+    };
 
     // `DropUser` fully removes the identity record on every node —
     // in-memory cache and redb catalog — so the username is freed
diff --git a/nodedb/src/control/server/shared/ddl/neutral/user/mod.rs b/nodedb/src/control/server/shared/ddl/neutral/user/mod.rs
index c6b7dfed0..859675a95 100644
--- a/nodedb/src/control/server/shared/ddl/neutral/user/mod.rs
+++ b/nodedb/src/control/server/shared/ddl/neutral/user/mod.rs
@@ -7,6 +7,7 @@ mod create;
 mod drop;
 mod iso8601;
 mod reassign_owned;
+mod tenant_purge;
 
 pub use alter::alter_user;
 pub use create::create_user;
diff --git a/nodedb/src/control/server/shared/ddl/neutral/user/reassign_owned.rs b/nodedb/src/control/server/shared/ddl/neutral/user/reassign_owned.rs
index 10c0475a9..58e838807 100644
--- a/nodedb/src/control/server/shared/ddl/neutral/user/reassign_owned.rs
+++ b/nodedb/src/control/server/shared/ddl/neutral/user/reassign_owned.rs
@@ -40,7 +40,8 @@ use super::super::super::result::DdlError;
 /// parent-replicated kinds each own a primary `Stored*` record with an
 /// in-band `owner` field; `Index` is the standalone path (a bare
 /// `StoredOwner` row with no parent record).
-enum OwnerKind {
+#[derive(Clone, Copy, PartialEq, Eq)]
+pub(super) enum OwnerKind {
     Collection,
     Function,
     Procedure,
@@ -58,7 +59,7 @@ impl OwnerKind {
     /// means the writer of that owner row introduced a kind this module
     /// does not yet handle — the caller turns that into a hard error so
     /// the drop fails closed instead of leaking a dangling reference.
-    fn from_object_type(s: &str) -> Option<Self> {
+    pub(super) fn from_object_type(s: &str) -> Option<Self> {
         Some(match s {
             object_type::COLLECTION => Self::Collection,
             object_type::FUNCTION => Self::Function,
@@ -334,7 +335,7 @@ fn reassign_one(
 
 /// Revoke every grant whose grantee is the dropped user, so no
 /// `permission.grantee → user` reference outlives the user row.
-fn sweep_grants(
+pub(super) fn sweep_grants(
     state: &SharedState,
     catalog: &SystemCatalog,
     username: &str,
@@ -397,7 +398,7 @@ fn persist_owner_local_in_database(
     Ok(())
 }
 
-fn propose(state: &SharedState, entry: &CatalogEntry) -> Result<u64, DdlError> {
+pub(super) fn propose(state: &SharedState, entry: &CatalogEntry) -> Result<u64, DdlError> {
     propose_catalog_entry(state, entry).map_err(|e| ddl_err(format!("metadata propose: {e}")))
 }
 
@@ -408,7 +409,7 @@ fn missing(object_type: &str, name: &str) -> DdlError {
     ))
 }
 
-fn ddl_err(message: String) -> DdlError {
+pub(super) fn ddl_err(message: String) -> DdlError {
     DdlError {
         sqlstate: "XX000".to_string(),
         message,
diff --git a/nodedb/src/control/server/shared/ddl/neutral/user/tenant_purge.rs b/nodedb/src/control/server/shared/ddl/neutral/user/tenant_purge.rs
new file mode 100644
index 000000000..7524a80e0
--- /dev/null
+++ b/nodedb/src/control/server/shared/ddl/neutral/user/tenant_purge.rs
@@ -0,0 +1,114 @@
+// SPDX-License-Identifier: BUSL-1.1
+
+//! Terminal tenant-administrator object purge used only by `DROP TENANT`.
+
+use crate::control::catalog_entry::CatalogEntry;
+use crate::control::security::catalog::auth_types::object_type;
+use crate::control::security::catalog::{StoredOwner, SystemCatalog};
+use crate::control::state::SharedState;
+use crate::types::TenantId;
+
+use super::super::super::result::DdlError;
+use super::reassign_owned::{OwnerKind, ddl_err, propose, sweep_grants};
+
+pub(super) fn purge_owned_for_tenant_teardown(
+    state: &SharedState,
+    username: &str,
+    tenant: TenantId,
+) -> Result<(), DdlError> {
+    let catalog = state.credentials.catalog();
+    let mut owned = catalog
+        .owners_for_user(username, tenant.as_u64())
+        .map_err(|e| ddl_err(format!("load owner rows: {e}")))?;
+    owned.sort_by_key(|owner| owner.object_type == object_type::COLLECTION);
+
+    for owner in owned {
+        let kind = OwnerKind::from_object_type(&owner.object_type).ok_or_else(|| {
+            ddl_err(format!(
+                "cannot delete object of unknown owner type '{}' ('{}') during tenant teardown",
+                owner.object_type, owner.object_name
+            ))
+        })?;
+        if kind == OwnerKind::Collection {
+            purge_collection_rls_policies(state, catalog, tenant, &owner.object_name)?;
+        }
+        let entry = teardown_delete_entry(kind, tenant, &owner);
+        let log_index = propose(state, &entry)?;
+        crate::control::catalog_entry::apply::local::apply_locally_if_needed(
+            state, &entry, log_index,
+        );
+        if log_index == 0 {
+            state
+                .permissions
+                .install_replicated_remove_owner_in_database(
+                    &owner.object_type,
+                    owner.database_id,
+                    tenant.as_u64(),
+                    &owner.object_name,
+                );
+        }
+    }
+    sweep_grants(state, catalog, username)
+}
+
+fn purge_collection_rls_policies(
+    state: &SharedState,
+    catalog: &SystemCatalog,
+    tenant: TenantId,
+    collection: &str,
+) -> Result<(), DdlError> {
+    let tenant_id = tenant.as_u64();
+    let policies = catalog
+        .load_all_rls_policies()
+        .map_err(|e| ddl_err(format!("load RLS policies: {e}")))?;
+    for policy in policies
+        .into_iter()
+        .filter(|policy| policy.tenant_id == tenant_id && policy.collection == collection)
+    {
+        let entry = CatalogEntry::DeleteRlsPolicy {
+            tenant_id,
+            collection: collection.to_string(),
+            name: policy.name.clone(),
+        };
+        let log_index = propose(state, &entry)?;
+        crate::control::catalog_entry::apply::local::apply_locally_if_needed(
+            state, &entry, log_index,
+        );
+        if log_index == 0 {
+            state
+                .rls
+                .install_replicated_drop_policy(tenant_id, collection, &policy.name);
+        }
+    }
+    Ok(())
+}
+
+fn teardown_delete_entry(kind: OwnerKind, tenant: TenantId, owner: &StoredOwner) -> CatalogEntry {
+    let tenant_id = tenant.as_u64();
+    let name = owner.object_name.clone();
+    match kind {
+        OwnerKind::Collection => CatalogEntry::PurgeCollection {
+            database_id: owner.database_id,
+            tenant_id,
+            name,
+        },
+        OwnerKind::Function => CatalogEntry::DeleteFunction { tenant_id, name },
+        OwnerKind::Procedure => CatalogEntry::DeleteProcedure { tenant_id, name },
+        OwnerKind::Trigger => CatalogEntry::DeleteTrigger { tenant_id, name },
+        OwnerKind::MaterializedView => CatalogEntry::DeleteMaterializedView { tenant_id, name },
+        OwnerKind::Sequence => CatalogEntry::DeleteSequence { tenant_id, name },
+        OwnerKind::Schedule => CatalogEntry::DeleteSchedule { tenant_id, name },
+        OwnerKind::ChangeStream => CatalogEntry::DeleteChangeStream { tenant_id, name },
+        OwnerKind::ContinuousAggregate => CatalogEntry::DeleteContinuousAggregate {
+            database_id: owner.database_id,
+            tenant_id,
+            name,
+        },
+        OwnerKind::Index => CatalogEntry::DeleteOwner {
+            object_type: owner.object_type.clone(),
+            database_id: owner.database_id,
+            tenant_id,
+            object_name: name,
+        },
+    }
+}
diff --git a/nodedb/src/control/server/shared/session/commit.rs b/nodedb/src/control/server/shared/session/commit.rs
index 8b71ffda1..d18a8bb51 100644
--- a/nodedb/src/control/server/shared/session/commit.rs
+++ b/nodedb/src/control/server/shared/session/commit.rs
@@ -1,33 +1,22 @@
 // SPDX-License-Identifier: BUSL-1.1
 
-//! Protocol-neutral COMMIT orchestrator.
-//!
-//! Drives the full commit sequence off the neutral session state: snapshot
-//! isolation conflict detection (with read-your-own-write exclusion), WAL
-//! transaction batching, single-shard vs Calvin multi-shard dispatch, staging
-//! overlay release, deferred offset flush, GAP_FREE sequence finalization,
-//! buffered DDL propose, and cursor/notify flush. Every Data-Plane dispatch
-//! goes through the injected [`TxnDataPlane`] seam so both pgwire and native
-//! drive this one core; transports only shape the returned [`CommitOutcome`].
+//! Protocol-neutral COMMIT orchestration shared by pgwire and native sessions.
 
 use std::net::SocketAddr;
 
 use crate::bridge::envelope::{PhysicalPlan, Response, Status};
 use crate::control::gateway::RouteDecision;
-use crate::control::gateway::retry::retry_not_leader;
 use crate::control::planner::calvin::{DispatchClass, classify_dispatch, read_vshards_of};
 use crate::control::security::identity::AuthenticatedIdentity;
-use crate::control::server::graph_dispatch::cluster_resolve::gateway_shared;
 use crate::control::server::shared::plan_util::extract_collection;
 use crate::control::state::SharedState;
 use nodedb_cluster::calvin::types::ReleaseReason;
-use nodedb_cluster::{MetadataEntry, encode_entry};
 use nodedb_physical::physical_plan::MetaOp;
 use nodedb_physical::physical_task::{PhysicalTask, PostSetOp};
 
 use super::ddl_buffer;
-use super::leader_forward::{forward_to_leader, resolve_leader};
 use super::outcome::{AbortReason, CommitOutcome, TxnDataPlane};
+use super::overlay_drop::drop_txn_overlay;
 use super::read_set::ReadSetEntry;
 use super::store::SessionStore;
 
@@ -100,17 +89,42 @@ pub async fn run_commit(
                 }
             }
             DispatchClass::SingleShard { vshard: vshard_id } => {
-                if let Some(outcome) =
-                    si_conflict_abort(sessions, addr, state, &read_set, &written_collections)
-                {
-                    super::reservation_release::release_and_rollback(state, sessions, addr).await;
-                    return outcome;
-                }
-                if let Some(reason) =
-                    dispatch_single_shard(state, dp, &buffered, tenant_id, vshard_id).await
-                {
-                    super::reservation_release::release_and_rollback(state, sessions, addr).await;
-                    return CommitOutcome::Aborted { reason };
+                let leader =
+                    crate::control::server::graph_dispatch::cluster_resolve::resolve_for_vshard(
+                        state,
+                        vshard_id.as_u32(),
+                    );
+                if !matches!(leader, RouteDecision::Local) {
+                    // The interactive transaction WAL record belongs to this
+                    // coordinator and cannot be forwarded as a bare remote
+                    // Data-Plane LSN. Route a non-local single-shard commit
+                    // through Calvin's replicated Vote/Verdict barrier instead;
+                    // this gives it the same leader routing, OCC, durability,
+                    // and apply ordering as any multi-participant commit.
+                    if let Some(reason) = super::commit_calvin::run_commit_calvin(
+                        sessions, addr, state, &buffered, tenant_id, &read_set,
+                    )
+                    .await
+                    {
+                        super::reservation_release::release_and_rollback(state, sessions, addr)
+                            .await;
+                        return CommitOutcome::Aborted { reason };
+                    }
+                } else {
+                    if let Some(outcome) =
+                        si_conflict_abort(sessions, addr, state, &read_set, &written_collections)
+                    {
+                        super::reservation_release::release_and_rollback(state, sessions, addr)
+                            .await;
+                        return outcome;
+                    }
+                    if let Some(reason) =
+                        dispatch_single_shard(state, dp, &buffered, tenant_id, vshard_id).await
+                    {
+                        super::reservation_release::release_and_rollback(state, sessions, addr)
+                            .await;
+                        return CommitOutcome::Aborted { reason };
+                    }
                 }
             }
         }
@@ -207,7 +221,7 @@ pub async fn run_commit(
     }
 
     // Flush any buffered DDL entries as a single atomic batch.
-    if let Some(reason) = flush_buffered_ddl(state) {
+    if let Some(reason) = ddl_buffer::flush(state) {
         return CommitOutcome::Aborted { reason };
     }
 
@@ -273,6 +287,14 @@ async fn dispatch_single_shard(
     vshard_id: crate::types::VShardId,
 ) -> Option<AbortReason> {
     let plans: Vec<PhysicalPlan> = buffered.iter().map(|t| t.plan.clone()).collect();
+    let database_id = buffered
+        .first()
+        .map_or(crate::types::DatabaseId::DEFAULT, |task| task.database_id);
+    if buffered.iter().any(|task| task.database_id != database_id) {
+        return Some(AbortReason::Dispatch(crate::Error::BadRequest {
+            detail: "transaction spans multiple databases".to_owned(),
+        }));
+    }
 
     // txn_id is present for any staged commit (buffer_write stamps it).
     let Some(txn_id) = buffered.first().and_then(|t| t.txn_id) else {
@@ -287,7 +309,7 @@ async fn dispatch_single_shard(
     let resolve_task = PhysicalTask {
         tenant_id,
         vshard_id,
-        database_id: crate::types::DatabaseId::DEFAULT,
+        database_id,
         plan: PhysicalPlan::Meta(MetaOp::ResolveTxn {
             txn_id,
             plans: plans.clone(),
@@ -321,12 +343,10 @@ async fn dispatch_single_shard(
     let wal_lsn = if redo.ops.is_empty() {
         None
     } else {
-        match state.wal.append_transaction_redo(
-            tenant_id,
-            vshard_id,
-            crate::types::DatabaseId::DEFAULT,
-            &redo,
-        ) {
+        match state
+            .wal
+            .append_transaction_redo(tenant_id, vshard_id, database_id, &redo)
+        {
             Ok(lsn) => Some(lsn),
             Err(e) => {
                 return Some(AbortReason::Dispatch(crate::Error::Internal {
@@ -338,7 +358,7 @@ async fn dispatch_single_shard(
     let batch_task = PhysicalTask {
         tenant_id,
         vshard_id,
-        database_id: crate::types::DatabaseId::DEFAULT,
+        database_id,
         plan: PhysicalPlan::Meta(MetaOp::TransactionBatch {
             plans,
             // Reuse the resolve-time bitemporal stamps recorded in this
@@ -370,114 +390,3 @@ pub(super) fn classify_batch_dispatch(result: crate::Result<Response>) -> Option
         Ok(_) => None,
     }
 }
-
-/// Flush any DDL buffered during the transaction as a single atomic metadata
-/// Raft batch. Returns `Some(reason)` on encode/propose failure.
-fn flush_buffered_ddl(state: &SharedState) -> Option<AbortReason> {
-    let payloads = ddl_buffer::take()?;
-    if payloads.is_empty() {
-        return None;
-    }
-    // Each buffered entry carries the audit context captured at its own
-    // statement boundary (not COMMIT time). Map to `CatalogDdlAudited` when
-    // present so every sub-DDL gets its own audit record on every replica.
-    let sub_entries: Vec<MetadataEntry> = payloads
-        .into_iter()
-        .map(|e| match e.audit {
-            Some(ctx) => MetadataEntry::CatalogDdlAudited {
-                payload: e.payload,
-                auth_user_id: ctx.auth_user_id,
-                auth_user_name: ctx.auth_user_name,
-                sql_text: ctx.sql_text,
-            },
-            None => MetadataEntry::CatalogDdl { payload: e.payload },
-        })
-        .collect();
-    let batch = MetadataEntry::Batch {
-        entries: sub_entries,
-    };
-    if let Some(handle) = state.metadata_raft.get() {
-        let raw = match encode_entry(&batch) {
-            Ok(raw) => raw,
-            Err(e) => {
-                return Some(AbortReason::DdlPropose(crate::Error::Internal {
-                    detail: format!("DDL batch encode: {e}"),
-                }));
-            }
-        };
-        if let Err(e) = handle.propose(raw) {
-            return Some(AbortReason::DdlPropose(crate::Error::Internal {
-                detail: format!("DDL batch propose: {e}"),
-            }));
-        }
-    }
-    None
-}
-
-/// Release a transaction's staging overlay on a vShard that hosted staged
-/// writes. Dispatched AFTER the durable resolution (COMMIT batch flush /
-/// ROLLBACK) on the vShard's CURRENT leader: when this node leads the vShard (or
-/// single-node) the existing WAL-free local dispatch runs unchanged; otherwise
-/// the `DropTxnOverlay` is forwarded to the remote leader keyed by `txn_id` — the
-/// same node the matching `StageWrite` reached, since stage / read / drop all
-/// resolve to the vShard's leader (see [`super::leader_forward`]).
-///
-/// Returns the dispatch/forward error rather than swallowing it, so the caller
-/// (COMMIT / ROLLBACK) sees a teardown failure and decides how to surface it —
-/// a `LeaderUnknown` resolution fails closed as `Error::NotLeader` inside
-/// [`forward_to_leader`]. The remote arm retries a transient `NotLeader` /
-/// `RetryableLeaderChange` a bounded number of times (see [`retry_not_leader`])
-/// before that error is returned, so a momentary leader election does not
-/// strand the overlay after a single forward attempt.
-pub(super) async fn drop_txn_overlay(
-    state: &SharedState,
-    dp: &impl TxnDataPlane,
-    tenant_id: crate::types::TenantId,
-    vshard_id: crate::types::VShardId,
-    txn_id: crate::types::TxnId,
-) -> crate::Result<()> {
-    // The overlay id travels inside the plan (the Data-Plane handler reads it
-    // from `MetaOp::DropTxnOverlay`); the request `txn_id` stamp additionally
-    // keys the leader's per-transaction overlay when forwarded (inert locally).
-    let drop_plan = PhysicalPlan::Meta(MetaOp::DropTxnOverlay { txn_id });
-    let task = PhysicalTask {
-        tenant_id,
-        vshard_id,
-        database_id: crate::types::DatabaseId::DEFAULT,
-        plan: drop_plan.clone(),
-        post_set_op: PostSetOp::None,
-        txn_id: Some(txn_id),
-    };
-    // Overlay teardown is not a write — no WAL record, no write version.
-    match resolve_leader(&task, state) {
-        RouteDecision::Local => {
-            dp.dispatch_no_wal(task, None).await?;
-            Ok(())
-        }
-        _ => {
-            // A transient leader-election failure at COMMIT/ROLLBACK must not
-            // strand the overlay after a single forward attempt: retry the
-            // remote drop up to `retry_not_leader`'s bounded budget (3
-            // attempts, ~50ms then ~100ms backoff between them), re-resolving
-            // the leader on every
-            // attempt so a routing-table hint refreshed by a prior
-            // `NotLeader` (or a mid-retry leadership handback to this node)
-            // is picked up rather than repeatedly re-forwarding to a now-dead
-            // target.
-            let shared = gateway_shared(state)?;
-            let routing_ref = shared.cluster_routing.as_deref();
-            retry_not_leader(routing_ref, |_attempt| {
-                let task = task.clone();
-                let drop_plan = drop_plan.clone();
-                async move {
-                    match resolve_leader(&task, state) {
-                        RouteDecision::Local => dp.dispatch_no_wal(task, None).await,
-                        remote => forward_to_leader(state, remote, task, &drop_plan).await,
-                    }
-                }
-            })
-            .await
-            .map(|_| ())
-        }
-    }
-}
diff --git a/nodedb/src/control/server/shared/session/commit_calvin.rs b/nodedb/src/control/server/shared/session/commit_calvin.rs
index 254bef8c1..4a2a95d95 100644
--- a/nodedb/src/control/server/shared/session/commit_calvin.rs
+++ b/nodedb/src/control/server/shared/session/commit_calvin.rs
@@ -17,8 +17,8 @@
 use std::net::SocketAddr;
 
 use crate::control::planner::calvin::{
-    CrossShardTxnMode, TxnDispatchPosition, build_single_vshard_tx_class, dispatch_tasks_to_calvin,
-    submit_calvin_routed,
+    CrossShardTxnMode, DispatchClass, TxnDispatchPosition, build_single_vshard_tx_class,
+    classify_dispatch, dispatch_tasks_to_calvin, read_vshards_of, submit_calvin_routed,
 };
 use crate::control::server::shared::session::read_set::ReadSetEntry;
 use crate::control::state::SharedState;
@@ -53,22 +53,35 @@ pub(super) async fn run_commit_calvin(
             if state.sequencer_inbox.get().is_none() {
                 return Some(AbortReason::Dispatch(crate::Error::SequencerUnavailable));
             }
-            // Route the buffered cross-shard batch through the sequencer-group
-            // leader via the routed submit-and-await — the whole batch commits
-            // atomically. This is the COMMIT flush of a buffered explicit block,
-            // NOT a mid-block single statement, so the mid-block cross-shard guard
-            // must not fire (hence `CommitFlush`).
-            match dispatch_tasks_to_calvin(
-                state,
-                buffered,
-                tenant_id,
-                cross_shard_mode,
-                TxnDispatchPosition::CommitFlush,
-                reads,
-                reservation_owner,
-            )
-            .await
-            {
+            // A remote single-vShard commit uses the opt-in single-participant
+            // builder; `dispatch_tasks_to_calvin` intentionally rejects that
+            // shape because its ordinary entry point is multi-shard-only.
+            let result = match classify_dispatch(buffered, &read_vshards_of(reads)) {
+                DispatchClass::SingleShard { .. } => {
+                    let mut tx_class =
+                        match build_single_vshard_tx_class(buffered, tenant_id, reads) {
+                            Ok(tx_class) => tx_class,
+                            Err(e) => return Some(AbortReason::Dispatch(e)),
+                        };
+                    tx_class.set_lock_owner(reservation_owner);
+                    submit_calvin_routed(state, tx_class).await
+                }
+                DispatchClass::MultiShard { .. } => {
+                    // Route the buffered cross-shard batch through the
+                    // sequencer-group leader via one atomic submit-and-await.
+                    dispatch_tasks_to_calvin(
+                        state,
+                        buffered,
+                        tenant_id,
+                        cross_shard_mode,
+                        TxnDispatchPosition::CommitFlush,
+                        reads,
+                        reservation_owner,
+                    )
+                    .await
+                }
+            };
+            match result {
                 Ok(_) => None,
                 Err(crate::Error::CalvinSerializationConflict) => {
                     super::hot_key::record_read_set_aborts(state, reads);
diff --git a/nodedb/src/control/server/shared/session/ddl_buffer.rs b/nodedb/src/control/server/shared/session/ddl_buffer.rs
index e6bde21ef..e4048fd62 100644
--- a/nodedb/src/control/server/shared/session/ddl_buffer.rs
+++ b/nodedb/src/control/server/shared/session/ddl_buffer.rs
@@ -15,9 +15,14 @@
 
 use std::cell::RefCell;
 
+use crate::control::catalog_entry::CatalogEntry;
+use crate::control::state::SharedState;
+use nodedb_cluster::{METADATA_GROUP_ID, MetadataEntry, encode_entry};
+
 use super::audit_context::AuditCtx;
+use super::outcome::AbortReason;
 
-/// One buffered DDL statement: the encoded `CatalogEntry` payload
+/// One buffered DDL statement: the unstamped `CatalogEntry`
 /// plus the optional audit context captured from
 /// [`super::audit_context::current()`] at buffer time. The audit
 /// context is stamped at *statement* time, not at COMMIT time, so
@@ -25,11 +30,11 @@ use super::audit_context::AuditCtx;
 /// produced it (not just the COMMIT).
 #[derive(Debug, Clone)]
 pub struct BufferedDdl {
-    pub payload: Vec<u8>,
+    pub entry: CatalogEntry,
     pub audit: Option<AuditCtx>,
 }
 
-/// Encoded DDL payloads buffered during a transaction.
+/// Unstamped DDL entries buffered during a transaction.
 pub type DdlBuffer = Vec<BufferedDdl>;
 
 thread_local! {
@@ -55,15 +60,15 @@ pub fn activate() {
     });
 }
 
-/// Try to buffer a DDL payload. Returns `true` if the buffer is
-/// active and the payload was pushed. Returns `false` if no buffer
-/// is active (caller should propose normally).
-pub fn try_buffer(payload: Vec<u8>) -> bool {
+/// Try to buffer an unstamped DDL entry. Returns `true` if the buffer is
+/// active and the entry was pushed. Returns `false` if no buffer is active
+/// (caller should prepare and propose normally).
+pub fn try_buffer(entry: CatalogEntry) -> bool {
     ACTIVE_BUFFER.with(|b| {
         let mut guard = b.borrow_mut();
         if let Some(buf) = guard.as_mut() {
             buf.push(BufferedDdl {
-                payload,
+                entry,
                 audit: super::audit_context::current(),
             });
             true
@@ -86,6 +91,123 @@ pub fn discard() {
     });
 }
 
+/// Flush buffered entries as one fenced metadata-Raft batch.
+pub(super) fn flush(state: &SharedState) -> Option<AbortReason> {
+    let buffered = take()?;
+    if buffered.is_empty() {
+        return None;
+    }
+    let handle = state.metadata_raft.get()?;
+    let _local_guard = match state.metadata_ddl_lock.lock() {
+        Ok(guard) => guard,
+        Err(_) => {
+            return Some(AbortReason::DdlPropose(crate::Error::Internal {
+                detail: "metadata DDL preparation lock poisoned".into(),
+            }));
+        }
+    };
+    let distributed_guard = match crate::control::metadata_proposer::acquire_ddl_prepare_lease(
+        state,
+        handle.as_ref(),
+    ) {
+        Ok(guard) => guard,
+        Err(error) => return Some(AbortReason::DdlPropose(error)),
+    };
+
+    for item in &buffered {
+        if let Some((descriptor_id, prior_version)) =
+            crate::control::lease::descriptor_id_and_prior_version(&item.entry, state)
+            && prior_version > 0
+            && let Err(error) = crate::control::lease::drain_for_ddl(
+                state,
+                descriptor_id,
+                prior_version,
+                crate::control::metadata_proposer::DEFAULT_DRAIN_TIMEOUT,
+            )
+        {
+            return Some(AbortReason::DdlPropose(error));
+        }
+    }
+    let audits: Vec<_> = buffered.iter().map(|item| item.audit.clone()).collect();
+    let entries: Vec<_> = buffered.into_iter().map(|item| item.entry).collect();
+    let stamped = if state
+        .cluster_version_view()
+        .can_activate_feature(crate::control::rolling_upgrade::DESCRIPTOR_VERSIONING_VERSION)
+    {
+        crate::control::catalog_entry::descriptor_stamp::stamp_batch(
+            entries,
+            &state.hlc_clock,
+            state.credentials.catalog(),
+        )
+    } else {
+        entries
+    };
+
+    let mut sub_entries = Vec::with_capacity(stamped.len());
+    for (entry, audit) in stamped.into_iter().zip(audits) {
+        let payload = match crate::control::catalog_entry::encode(&entry) {
+            Ok(payload) => payload,
+            Err(error) => return Some(AbortReason::DdlPropose(error)),
+        };
+        sub_entries.push(match audit {
+            Some(ctx) => MetadataEntry::CatalogDdlAudited {
+                payload,
+                auth_user_id: ctx.auth_user_id,
+                auth_user_name: ctx.auth_user_name,
+                sql_text: ctx.sql_text,
+            },
+            None => MetadataEntry::CatalogDdl { payload },
+        });
+    }
+    let prepared = MetadataEntry::DdlPrepared {
+        token: distributed_guard.token(),
+        entry: Box::new(MetadataEntry::Batch {
+            entries: sub_entries,
+        }),
+    };
+    let raw = match encode_entry(&prepared) {
+        Ok(raw) => raw,
+        Err(error) => {
+            return Some(AbortReason::DdlPropose(crate::Error::Internal {
+                detail: format!("DDL batch encode: {error}"),
+            }));
+        }
+    };
+    let log_index = match handle.propose(raw) {
+        Ok(index) => index,
+        Err(error) => {
+            return Some(AbortReason::DdlPropose(crate::Error::Internal {
+                detail: format!("DDL batch propose: {error}"),
+            }));
+        }
+    };
+    let watcher = state.applied_index_watcher(METADATA_GROUP_ID);
+    let outcome = tokio::task::block_in_place(|| {
+        watcher.wait_for(
+            log_index,
+            crate::control::metadata_proposer::DEFAULT_PROPOSE_TIMEOUT,
+        )
+    });
+    if !outcome.is_reached() {
+        return Some(AbortReason::DdlPropose(crate::Error::Internal {
+            detail: format!(
+                "DDL batch propose timed out waiting for log index {log_index} (current: {})",
+                watcher.current()
+            ),
+        }));
+    }
+    if state
+        .metadata_ddl_applied_token
+        .load(std::sync::atomic::Ordering::Acquire)
+        != distributed_guard.token()
+    {
+        return Some(AbortReason::DdlPropose(crate::Error::Internal {
+            detail: "DDL preparation ownership was superseded before apply".into(),
+        }));
+    }
+    None
+}
+
 /// Returns `true` if a DDL buffer is currently active on this thread.
 pub fn is_active() -> bool {
     ACTIVE_BUFFER.with(|b| b.borrow().is_some())
@@ -101,10 +223,17 @@ pub fn buffer_len() -> usize {
 mod tests {
     use super::*;
 
+    fn sample_entry(name: &str) -> CatalogEntry {
+        CatalogEntry::DeleteSequence {
+            tenant_id: 1,
+            name: name.to_string(),
+        }
+    }
+
     #[test]
     fn inactive_buffer_does_not_capture() {
         discard(); // ensure clean state
-        assert!(!try_buffer(vec![1, 2, 3]));
+        assert!(!try_buffer(sample_entry("one")));
         assert!(!is_active());
     }
 
@@ -112,19 +241,25 @@ mod tests {
     fn active_buffer_captures() {
         activate();
         assert!(is_active());
-        assert!(try_buffer(vec![1]));
-        assert!(try_buffer(vec![2]));
+        assert!(try_buffer(sample_entry("one")));
+        assert!(try_buffer(sample_entry("two")));
         let buf = take().unwrap();
         assert_eq!(buf.len(), 2);
-        assert_eq!(buf[0].payload, vec![1]);
-        assert_eq!(buf[1].payload, vec![2]);
+        assert!(matches!(
+            &buf[0].entry,
+            CatalogEntry::DeleteSequence { name, .. } if name == "one"
+        ));
+        assert!(matches!(
+            &buf[1].entry,
+            CatalogEntry::DeleteSequence { name, .. } if name == "two"
+        ));
         assert!(!is_active());
     }
 
     #[test]
     fn discard_clears_buffer() {
         activate();
-        try_buffer(vec![1]);
+        try_buffer(sample_entry("one"));
         discard();
         assert!(!is_active());
         assert!(take().is_none());
diff --git a/nodedb/src/control/server/shared/session/leader_forward.rs b/nodedb/src/control/server/shared/session/leader_forward.rs
index 69103d2e4..d6821e0f7 100644
--- a/nodedb/src/control/server/shared/session/leader_forward.rs
+++ b/nodedb/src/control/server/shared/session/leader_forward.rs
@@ -47,7 +47,7 @@ use nodedb_physical::physical_task::PhysicalTask;
 /// Resolve the current leader for `task`'s target vShard against live Raft
 /// leadership (falling back to the routing-table hint), so a staging choke point
 /// can branch between its existing local dispatch and a remote forward.
-pub(super) fn resolve_leader(task: &PhysicalTask, state: &SharedState) -> RouteDecision {
+pub(crate) fn resolve_leader(task: &PhysicalTask, state: &SharedState) -> RouteDecision {
     resolve_for_vshard(state, task.vshard_id.as_u32())
 }
 
@@ -67,7 +67,7 @@ pub(super) fn resolve_leader(task: &PhysicalTask, state: &SharedState) -> RouteD
 /// write, so the forwarded stage carries the same descriptor versions a normal
 /// remote write would and is not spuriously rejected; a `DropTxnOverlay` touches
 /// no user collection, so its version set is empty.
-pub(super) async fn forward_to_leader(
+pub(crate) async fn forward_to_leader(
     state: &SharedState,
     decision: RouteDecision,
     forward_task: PhysicalTask,
diff --git a/nodedb/src/control/server/shared/session/lifecycle.rs b/nodedb/src/control/server/shared/session/lifecycle.rs
index 78447350f..77f77084f 100644
--- a/nodedb/src/control/server/shared/session/lifecycle.rs
+++ b/nodedb/src/control/server/shared/session/lifecycle.rs
@@ -12,9 +12,9 @@ use std::net::SocketAddr;
 use crate::control::security::identity::AuthenticatedIdentity;
 use crate::control::state::SharedState;
 
-use super::commit::drop_txn_overlay;
 use super::ddl_buffer;
 use super::outcome::TxnDataPlane;
+use super::overlay_drop::drop_txn_overlay;
 use super::store::SessionStore;
 
 /// Run the neutral BEGIN sequence: anchor the snapshot LSN, activate the DDL
diff --git a/nodedb/src/control/server/shared/session/mod.rs b/nodedb/src/control/server/shared/session/mod.rs
index c9943112f..df2707cbb 100644
--- a/nodedb/src/control/server/shared/session/mod.rs
+++ b/nodedb/src/control/server/shared/session/mod.rs
@@ -15,6 +15,7 @@ mod listen;
 mod live;
 mod notice;
 pub mod outcome;
+pub mod overlay_drop;
 mod own_writes;
 mod params;
 pub mod read_consistency;
@@ -34,6 +35,7 @@ pub mod plan_cache;
 pub mod prepared_cache;
 
 pub use self::cross_shard_mode::{CrossShardTxnMode, parse_value as parse_cross_shard_value};
+pub(crate) use self::leader_forward::{forward_to_leader, resolve_leader};
 pub use self::outcome::{AbortReason, CommitOutcome, TxnDataPlane};
 pub use self::params::{
     is_known_pg_runtime_parameter, is_known_settable_runtime_parameter, parse_set_command,
diff --git a/nodedb/src/control/server/shared/session/overlay_drop.rs b/nodedb/src/control/server/shared/session/overlay_drop.rs
new file mode 100644
index 000000000..c72e1de04
--- /dev/null
+++ b/nodedb/src/control/server/shared/session/overlay_drop.rs
@@ -0,0 +1,56 @@
+// SPDX-License-Identifier: BUSL-1.1
+
+//! Transaction staging-overlay teardown on the current vShard leader.
+
+use nodedb_physical::physical_plan::PhysicalPlan;
+use nodedb_physical::physical_plan::meta::MetaOp;
+use nodedb_physical::physical_task::{PhysicalTask, PostSetOp};
+
+use crate::control::gateway::RouteDecision;
+use crate::control::gateway::retry::retry_not_leader;
+use crate::control::state::SharedState;
+
+use super::leader_forward::{forward_to_leader, resolve_leader};
+use super::outcome::TxnDataPlane;
+use crate::control::server::graph_dispatch::cluster_resolve::gateway_shared;
+
+/// Release a transaction's staging overlay on the vShard's current leader.
+pub(super) async fn drop_txn_overlay(
+    state: &SharedState,
+    dp: &impl TxnDataPlane,
+    tenant_id: crate::types::TenantId,
+    vshard_id: crate::types::VShardId,
+    txn_id: crate::types::TxnId,
+) -> crate::Result<()> {
+    let drop_plan = PhysicalPlan::Meta(MetaOp::DropTxnOverlay { txn_id });
+    let task = PhysicalTask {
+        tenant_id,
+        vshard_id,
+        database_id: crate::types::DatabaseId::DEFAULT,
+        plan: drop_plan.clone(),
+        post_set_op: PostSetOp::None,
+        txn_id: Some(txn_id),
+    };
+    match resolve_leader(&task, state) {
+        RouteDecision::Local => {
+            dp.dispatch_no_wal(task, None).await?;
+            Ok(())
+        }
+        _ => {
+            let shared = gateway_shared(state)?;
+            let routing_ref = shared.cluster_routing.as_deref();
+            retry_not_leader(routing_ref, |_attempt| {
+                let task = task.clone();
+                let drop_plan = drop_plan.clone();
+                async move {
+                    match resolve_leader(&task, state) {
+                        RouteDecision::Local => dp.dispatch_no_wal(task, None).await,
+                        remote => forward_to_leader(state, remote, task, &drop_plan).await,
+                    }
+                }
+            })
+            .await
+            .map(|_| ())
+        }
+    }
+}
diff --git a/nodedb/src/control/state/fields.rs b/nodedb/src/control/state/fields.rs
index 7faa1d0ba..5fafc1bbb 100644
--- a/nodedb/src/control/state/fields.rs
+++ b/nodedb/src/control/state/fields.rs
@@ -1,7 +1,5 @@
 // SPDX-License-Identifier: BUSL-1.1
 
-//! SharedState struct definition — all fields for the Control Plane.
-
 use std::sync::atomic::AtomicU64;
 use std::sync::{Arc, Mutex, OnceLock, RwLock};
 
@@ -21,32 +19,20 @@ use crate::control::server::sync::dlq::SyncDlq;
 use crate::control::state::calvin_counters::CalvinCounters;
 use crate::wal::WalManager;
 
-/// Shared state accessible by all Control Plane sessions.
-///
-/// Connects TCP sessions to the Data Plane via Dispatcher/SPSC bridge and to the WAL.
-/// All fields are `Send + Sync` — safe for sharing across Tokio tasks.
 pub struct SharedState {
-    /// Routes requests to Data Plane cores via SPSC.
     pub dispatcher: Mutex<Dispatcher>,
-    /// Tracks in-flight requests and routes responses back to sessions.
     pub tracker: RequestTracker,
-    /// Write-ahead log for durability.
     pub wal: Arc<WalManager>,
     /// Collection-scoped scan quiesce registry for safe `PurgeCollection` reclaim.
     pub quiesce: Arc<crate::bridge::quiesce::CollectionQuiesce>,
-    /// Credential store for user authentication.
     pub credentials: Arc<CredentialStore>,
     /// Audit log — Control Plane only; emitters must be `Send + Sync`.
     pub audit: Arc<Mutex<AuditLog>>,
-    /// API key store.
     pub api_keys: ApiKeyStore,
-    /// Custom role store (inheritance, CRUD).
     pub roles: RoleStore,
-    /// Collection-level permission grants + ownership.
     pub permissions: PermissionStore,
     /// Per-tenant quota enforcement.
     pub tenants: Mutex<TenantIsolation>,
-    /// Row-Level Security policy store for sync delta enforcement.
     pub rls: RlsPolicyStore,
     /// User + IP blacklist store (O(1) lookup, TTL for temp bans).
     pub blacklist: crate::control::security::blacklist::store::BlacklistStore,
@@ -118,6 +104,15 @@ pub struct SharedState {
     >,
     /// Per-Raft-group apply watermark registry for commit-wait and drain paths.
     pub group_watchers: Arc<nodedb_cluster::GroupAppliedWatchers>,
+    /// Serializes this node's attempts to acquire the replicated descriptor
+    /// preparation lease.
+    pub metadata_ddl_lock: Mutex<()>,
+    /// Replicated preparation owner plus local monotonic apply time.
+    pub metadata_ddl_owner: Mutex<Option<(u64, std::time::Instant)>>,
+    /// Most recent fenced DDL token applied while its owner remained current.
+    pub metadata_ddl_applied_token: AtomicU64,
+    /// Per-node uniqueness component for descriptor-preparation lease tokens.
+    pub metadata_ddl_token_seq: AtomicU64,
     /// Handle for proposing to the metadata raft group. Set by `start_raft`; None in single-node mode.
     pub metadata_raft: OnceLock<Arc<dyn crate::control::metadata_proposer::MetadataRaftHandle>>,
     /// Propose tracker for distributed writes. Set by `start_raft`; absent in single-node mode.
diff --git a/nodedb/src/control/state/init.rs b/nodedb/src/control/state/init.rs
index b0a88a024..e678b703c 100644
--- a/nodedb/src/control/state/init.rs
+++ b/nodedb/src/control/state/init.rs
@@ -141,6 +141,10 @@ impl SharedState {
             )
             .0,
             group_watchers: Arc::new(nodedb_cluster::GroupAppliedWatchers::new()),
+            metadata_ddl_lock: std::sync::Mutex::new(()),
+            metadata_ddl_owner: std::sync::Mutex::new(None),
+            metadata_ddl_applied_token: std::sync::atomic::AtomicU64::new(0),
+            metadata_ddl_token_seq: std::sync::atomic::AtomicU64::new(1),
             metadata_raft: std::sync::OnceLock::new(),
             propose_tracker: std::sync::OnceLock::new(),
             raft_proposer: std::sync::OnceLock::new(),
diff --git a/nodedb/src/control/state/init_prod/open.rs b/nodedb/src/control/state/init_prod/open.rs
index 72cd9db1e..1d13a3569 100644
--- a/nodedb/src/control/state/init_prod/open.rs
+++ b/nodedb/src/control/state/init_prod/open.rs
@@ -199,6 +199,10 @@ impl SharedState {
             )
             .0,
             group_watchers: Arc::new(nodedb_cluster::GroupAppliedWatchers::new()),
+            metadata_ddl_lock: std::sync::Mutex::new(()),
+            metadata_ddl_owner: std::sync::Mutex::new(None),
+            metadata_ddl_applied_token: std::sync::atomic::AtomicU64::new(0),
+            metadata_ddl_token_seq: std::sync::atomic::AtomicU64::new(1),
             metadata_raft: std::sync::OnceLock::new(),
             propose_tracker: std::sync::OnceLock::new(),
             raft_proposer: std::sync::OnceLock::new(),
diff --git a/nodedb/src/data/executor/core_loop/open.rs b/nodedb/src/data/executor/core_loop/open.rs
index 59a8386f0..6c0f6f92a 100644
--- a/nodedb/src/data/executor/core_loop/open.rs
+++ b/nodedb/src/data/executor/core_loop/open.rs
@@ -183,6 +183,7 @@ impl CoreLoop {
             calvin_flush_key: None,
             calvin_flush_index_tuples: HashMap::new(),
             active_bitemporal_stamps: HashMap::new(),
+            active_graph_system_from: None,
         })
     }
 }
diff --git a/nodedb/src/data/executor/core_loop/state.rs b/nodedb/src/data/executor/core_loop/state.rs
index 748ad15ec..86ca533cf 100644
--- a/nodedb/src/data/executor/core_loop/state.rs
+++ b/nodedb/src/data/executor/core_loop/state.rs
@@ -490,6 +490,10 @@ pub struct CoreLoop {
     pub(in crate::data::executor) active_bitemporal_stamps:
         HashMap<u32, crate::data::executor::handlers::transaction::overlay::BitemporalStamp>,
 
+    /// Transaction-resolved graph system-time ordinal used for every edge
+    /// mutation in the current live apply/replay scope.
+    pub(in crate::data::executor) active_graph_system_from: Option<i64>,
+
     /// Staged Calvin write plans awaiting the local commit verdict, keyed by
     /// `(epoch, position, vshard)`. `CalvinExecuteStatic` validates a
     /// transaction and inserts its plans here WITHOUT mutating base; the
diff --git a/nodedb/src/data/executor/handlers/aggregate/cache_key.rs b/nodedb/src/data/executor/handlers/aggregate/cache_key.rs
index e6b6ab882..3842fedf6 100644
--- a/nodedb/src/data/executor/handlers/aggregate/cache_key.rs
+++ b/nodedb/src/data/executor/handlers/aggregate/cache_key.rs
@@ -4,23 +4,49 @@
 
 use nodedb_physical::physical_plan::{AggregateSpec, GroupKeySpec};
 
-/// Serialize group-key specs into a deterministic, distinct cache-key fragment.
-/// Each spec contributes `output_name=field` (empty field for a computed key),
-/// so distinct group-key shapes never collide.
+/// Serialize complete group-key specs into a deterministic structural key.
+/// Computed keys must include their expression; `field` is intentionally empty
+/// for those keys and is not sufficient cache identity.
 fn group_specs_key(group_by: &[GroupKeySpec]) -> String {
     group_by
         .iter()
-        .map(|spec| {
+        .map(|spec| match zerompk::to_msgpack_vec(spec) {
+            Ok(bytes) => bytes.iter().map(|byte| format!("{byte:02x}")).collect(),
+            Err(_) => format!("{spec:?}"),
+        })
+        .collect::<Vec<_>>()
+        .join(",")
+}
+
+fn expression_key(expr: &nodedb_query::expr::SqlExpr) -> String {
+    match zerompk::to_msgpack_vec(expr) {
+        Ok(bytes) => bytes.iter().map(|byte| format!("{byte:02x}")).collect(),
+        Err(_) => format!("{expr:?}"),
+    }
+}
+
+fn aggregate_specs_key(aggregates: &[AggregateSpec]) -> String {
+    aggregates
+        .iter()
+        .map(|agg| {
+            let input = agg
+                .expr
+                .as_ref()
+                .map(expression_key)
+                .unwrap_or_else(|| agg.field.clone());
             format!(
-                "{}={}",
-                spec.output_name,
-                spec.field.as_deref().unwrap_or("")
+                "{}({})->{}=>{}",
+                agg.function,
+                input,
+                agg.alias,
+                agg.user_alias.as_deref().unwrap_or(&agg.alias)
             )
         })
         .collect::<Vec<_>>()
         .join(",")
 }
 
+#[allow(clippy::too_many_arguments)] // complete query shape is the cache identity
 pub(super) fn aggregate_cache_key(
     database_id: u64,
     tid: u64,
@@ -29,41 +55,29 @@ pub(super) fn aggregate_cache_key(
     aggregates: &[AggregateSpec],
     sub_group_by: &[String],
     sub_aggregates: &[AggregateSpec],
+    limit: usize,
+    sort_keys: &[(String, bool)],
 ) -> (crate::types::DatabaseId, crate::types::TenantId, String) {
     use std::fmt::Write;
     let mut rest = format!(
         "{collection}\0{}\0{}",
         group_specs_key(group_by),
-        aggregates
-            .iter()
-            .map(|agg| {
-                if agg.expr.is_some() {
-                    format!("{}(expr)->{}", agg.function, agg.alias)
-                } else {
-                    format!("{}({})->{}", agg.function, agg.field, agg.alias)
-                }
-            })
-            .collect::<Vec<_>>()
-            .join(",")
+        aggregate_specs_key(aggregates)
     );
     if !sub_group_by.is_empty() || !sub_aggregates.is_empty() {
         let _ = write!(
             rest,
             "\0sub:{}\0{}",
             sub_group_by.join(","),
-            sub_aggregates
-                .iter()
-                .map(|agg| {
-                    if agg.expr.is_some() {
-                        format!("{}(expr)->{}", agg.function, agg.alias)
-                    } else {
-                        format!("{}({})->{}", agg.function, agg.field, agg.alias)
-                    }
-                })
-                .collect::<Vec<_>>()
-                .join(",")
+            aggregate_specs_key(sub_aggregates)
         );
     }
+    let sort = sort_keys
+        .iter()
+        .map(|(field, ascending)| format!("{field}:{}", u8::from(*ascending)))
+        .collect::<Vec<_>>()
+        .join(",");
+    let _ = write!(rest, "\0limit:{limit}\0sort:{sort}");
     (
         crate::types::DatabaseId::new(database_id),
         crate::types::TenantId::new(tid),
diff --git a/nodedb/src/data/executor/handlers/aggregate/exec.rs b/nodedb/src/data/executor/handlers/aggregate/exec.rs
index 340068b44..4365ef200 100644
--- a/nodedb/src/data/executor/handlers/aggregate/exec.rs
+++ b/nodedb/src/data/executor/handlers/aggregate/exec.rs
@@ -127,6 +127,8 @@ impl CoreLoop {
                 aggregates,
                 sub_group_by,
                 sub_aggregates,
+                limit,
+                sort_keys,
             );
             if let Some(cached) = self.aggregate_cache.get(&cache_key) {
                 debug!(core = self.core_id, %collection, "aggregate cache hit");
@@ -279,6 +281,8 @@ impl CoreLoop {
                                 aggregates,
                                 sub_group_by,
                                 sub_aggregates,
+                                limit,
+                                sort_keys,
                             );
                             if self.aggregate_cache.len() < 256 {
                                 self.aggregate_cache.insert(cache_key, payload.clone());
diff --git a/nodedb/src/data/executor/handlers/aggregate/streaming/over_docs.rs b/nodedb/src/data/executor/handlers/aggregate/streaming/over_docs.rs
index 3a908d517..f520a7bbe 100644
--- a/nodedb/src/data/executor/handlers/aggregate/streaming/over_docs.rs
+++ b/nodedb/src/data/executor/handlers/aggregate/streaming/over_docs.rs
@@ -112,6 +112,8 @@ impl CoreLoop {
                         aggregates,
                         sub_group_by,
                         sub_aggregates,
+                        limit,
+                        sort_keys,
                     );
                     if self.aggregate_cache.len() < 256 {
                         self.aggregate_cache.insert(cache_key, payload.clone());
diff --git a/nodedb/src/data/executor/handlers/control/calvin.rs b/nodedb/src/data/executor/handlers/control/calvin.rs
index 63d60895f..d977eaec8 100644
--- a/nodedb/src/data/executor/handlers/control/calvin.rs
+++ b/nodedb/src/data/executor/handlers/control/calvin.rs
@@ -180,15 +180,14 @@ impl CoreLoop {
         // base install below reuses the exact stamp the redo carries rather than
         // minting a fresh one. Empty when this transaction wrote no bitemporal
         // document rows or resolve never ran.
-        let bitemporal_stamps: Vec<(u32, BitemporalStamp)> =
-            match calvin_synthetic_txn_id(epoch, position, vshard_id) {
-                Ok(synthetic) => self
-                    .txn_overlays
-                    .get(&synthetic)
-                    .map(|overlay| overlay.all_bitemporal_stamps().collect())
-                    .unwrap_or_default(),
-                Err(_) => Vec::new(),
-            };
+        let synthetic_txn_id = calvin_synthetic_txn_id(epoch, position, vshard_id).ok();
+        let bitemporal_stamps: Vec<(u32, BitemporalStamp)> = synthetic_txn_id
+            .and_then(|synthetic| self.txn_overlays.get(&synthetic))
+            .map(|overlay| overlay.all_bitemporal_stamps().collect())
+            .unwrap_or_default();
+        let graph_system_from = synthetic_txn_id
+            .and_then(|synthetic| self.graph_txn_overlays.get(&synthetic))
+            .and_then(|overlay| overlay.resolved_system_from());
         // Drop the synthetic overlay entry staged by
         // `execute_calvin_execute_static` unconditionally, before the apply
         // below: idempotent no-op on a duplicate dispatch.
@@ -224,6 +223,7 @@ impl CoreLoop {
         for (surrogate, stamp) in bitemporal_stamps {
             self.active_bitemporal_stamps.insert(surrogate, stamp);
         }
+        self.active_graph_system_from = graph_system_from;
         // The read-set was already validated at stage time and drives the
         // flush/drop decision; the replay itself carries no read-set to re-check.
         // Scope the flush key so `record_batch_index_write_values` stages this
diff --git a/nodedb/src/data/executor/handlers/graph_edge_write.rs b/nodedb/src/data/executor/handlers/graph_edge_write.rs
index 9411c433b..26a9c0c4b 100644
--- a/nodedb/src/data/executor/handlers/graph_edge_write.rs
+++ b/nodedb/src/data/executor/handlers/graph_edge_write.rs
@@ -10,7 +10,17 @@ use tracing::debug;
 use crate::bridge::envelope::{ErrorCode, Response};
 use crate::data::executor::core_loop::CoreLoop;
 use crate::data::executor::task::ExecutionTask;
-use crate::types::TenantId;
+use crate::types::{TenantId, VShardId};
+
+/// Dual-homed edges are physically present on both endpoint homes. The source
+/// home is the canonical owner of logical graph cardinality, so only that
+/// participant updates persistent stats counters.
+pub(in crate::data::executor) fn owns_logical_edge_stats(
+    task: &ExecutionTask,
+    src_id: &str,
+) -> bool {
+    task.request.vshard_id == VShardId::from_key(src_id.as_bytes())
+}
 
 /// Bundled arguments for [`CoreLoop::execute_edge_put`].
 pub(in crate::data::executor) struct EdgePutParams<'a> {
@@ -60,7 +70,9 @@ impl CoreLoop {
             );
         }
 
-        let ord = self.hlc.next_ordinal();
+        let ord = self
+            .active_graph_system_from
+            .unwrap_or_else(|| self.hlc.next_ordinal());
         // Under a Calvin batch, `epoch_system_ms` is the deterministic epoch
         // timestamp; outside Calvin (every path today — no Calvin edge writes
         // yet) it is None and we fall back to the HLC-derived wall time,
@@ -70,7 +82,7 @@ impl CoreLoop {
             None => nodedb_types::ordinal_to_ms(ord),
         };
         use crate::engine::graph::edge_store::EdgeRef;
-        match self.edge_store.put_edge_versioned(
+        match self.edge_store.put_edge_versioned_with_stats(
             EdgeRef::new(
                 task.request.database_id,
                 TenantId::new(tid),
@@ -83,6 +95,7 @@ impl CoreLoop {
             ord,
             valid_from_ms,
             i64::MAX,
+            owns_logical_edge_stats(task, src_id),
         ) {
             Ok(()) => {
                 let weight = crate::engine::graph::csr::extract_weight_from_properties(properties);
@@ -160,10 +173,12 @@ impl CoreLoop {
                     },
                 );
             }
-            let ord = self.hlc.next_ordinal();
+            let ord = self
+                .active_graph_system_from
+                .unwrap_or_else(|| self.hlc.next_ordinal());
             let valid_from_ms = nodedb_types::ordinal_to_ms(ord);
             use crate::engine::graph::edge_store::EdgeRef;
-            match self.edge_store.put_edge_versioned(
+            match self.edge_store.put_edge_versioned_with_stats(
                 EdgeRef::new(
                     task.request.database_id,
                     TenantId::new(tid),
@@ -176,6 +191,7 @@ impl CoreLoop {
                 ord,
                 valid_from_ms,
                 i64::MAX,
+                owns_logical_edge_stats(task, &edge.src_id),
             ) {
                 Ok(()) => {
                     let partition = self.csr_partition_mut(database_id, tid);
@@ -250,9 +266,11 @@ impl CoreLoop {
         );
         let database_id = task.request.database_id.as_u64();
         for edge in edges {
-            let ord = self.hlc.next_ordinal();
+            let ord = self
+                .active_graph_system_from
+                .unwrap_or_else(|| self.hlc.next_ordinal());
             use crate::engine::graph::edge_store::EdgeRef;
-            let _ = self.edge_store.soft_delete_edge(
+            let _ = self.edge_store.soft_delete_edge_with_stats(
                 EdgeRef::new(
                     task.request.database_id,
                     TenantId::new(tid),
@@ -262,6 +280,7 @@ impl CoreLoop {
                     &edge.dst_id,
                 ),
                 ord,
+                owns_logical_edge_stats(task, &edge.src_id),
             );
             let partition = self.csr_partition_mut(database_id, tid);
             partition.remove_edge_in_collection(
@@ -311,9 +330,11 @@ impl CoreLoop {
     ) -> Response {
         debug!(core = self.core_id, tid, %collection, %src_id, %label, %dst_id, "edge delete");
         let database_id = task.request.database_id.as_u64();
-        let ord = self.hlc.next_ordinal();
+        let ord = self
+            .active_graph_system_from
+            .unwrap_or_else(|| self.hlc.next_ordinal());
         use crate::engine::graph::edge_store::EdgeRef;
-        match self.edge_store.soft_delete_edge(
+        match self.edge_store.soft_delete_edge_with_stats(
             EdgeRef::new(
                 task.request.database_id,
                 TenantId::new(tid),
@@ -323,6 +344,7 @@ impl CoreLoop {
                 dst_id,
             ),
             ord,
+            owns_logical_edge_stats(task, src_id),
         ) {
             Ok(_) => {
                 let partition = self.csr_partition_mut(database_id, tid);
diff --git a/nodedb/src/data/executor/handlers/graph_stats.rs b/nodedb/src/data/executor/handlers/graph_stats.rs
index c32c113b5..481aaa0ea 100644
--- a/nodedb/src/data/executor/handlers/graph_stats.rs
+++ b/nodedb/src/data/executor/handlers/graph_stats.rs
@@ -18,9 +18,16 @@ impl CoreLoop {
         task: &ExecutionTask,
         tid: u64,
         collection: Option<&str>,
-        as_of: Option<i64>,
+        as_of_ms: Option<i64>,
     ) -> Response {
-        debug!(core = self.core_id, tid, ?collection, ?as_of, "graph stats");
+        debug!(
+            core = self.core_id,
+            tid,
+            ?collection,
+            ?as_of_ms,
+            "graph stats"
+        );
+        let as_of = as_of_ms.map(nodedb_types::ms_to_ordinal_upper);
         let database_id = task.request.database_id.as_u64();
         let tenant = TenantId::new(tid);
         let result: Vec<CollectionStats> = match collection {
diff --git a/nodedb/src/data/executor/handlers/transaction/batch.rs b/nodedb/src/data/executor/handlers/transaction/batch.rs
index a8b0b9010..60cbf9d85 100644
--- a/nodedb/src/data/executor/handlers/transaction/batch.rs
+++ b/nodedb/src/data/executor/handlers/transaction/batch.rs
@@ -66,9 +66,14 @@ impl CoreLoop {
         // it is cleared the moment `run_sub_plans` returns (any path).
         if let Some(txn_id) = txn_id {
             self.load_bitemporal_stamps_for_txn(txn_id);
+            self.active_graph_system_from = self
+                .graph_txn_overlays
+                .get(&txn_id)
+                .and_then(|overlay| overlay.resolved_system_from());
         }
         let sub = self.run_sub_plans(task, tid, plans, undo_log, crdt_deltas);
         self.active_bitemporal_stamps.clear();
+        self.active_graph_system_from = None;
         let (last_response, undo_log, crdt_deltas) = match sub {
             Ok(v) => v,
             Err(resp) => return resp,
@@ -152,7 +157,8 @@ impl CoreLoop {
         for (i, plan) in plans.iter().enumerate() {
             let user_roles = &task.request.user_roles;
             let outcome = catch_unwind(AssertUnwindSafe(|| {
-                let r = self.execute_tx_sub_plan(
+                let r = self.execute_tx_sub_plan_from_batch(
+                    task,
                     tid,
                     plan,
                     &mut undo_log,
@@ -193,9 +199,10 @@ impl CoreLoop {
                     // Roll back all previous writes in reverse order.
                     // If rollback itself fails, the shard state is unknown —
                     // return RollbackFailed (never warn-and-continue).
-                    let rollback_error_code = match self.rollback_undo_log(
-                        crate::types::DatabaseId::DEFAULT.as_u64(),
+                    let rollback_error_code = match self.rollback_undo_log_at(
+                        task.request.database_id.as_u64(),
                         tid,
+                        task.request.vshard_id,
                         undo_log,
                     ) {
                         Ok(()) => error_code,
@@ -255,9 +262,10 @@ impl CoreLoop {
                 "BALANCED constraint violated, rolling back {} operations",
                 undo_log.len()
             );
-            let rollback_error_code = match self.rollback_undo_log(
-                crate::types::DatabaseId::DEFAULT.as_u64(),
+            let rollback_error_code = match self.rollback_undo_log_at(
+                task.request.database_id.as_u64(),
                 tid,
+                task.request.vshard_id,
                 undo_log,
             ) {
                 Ok(()) => error_code,
diff --git a/nodedb/src/data/executor/handlers/transaction/overlay/graph_staged/txn_overlay.rs b/nodedb/src/data/executor/handlers/transaction/overlay/graph_staged/txn_overlay.rs
index 74204147f..913942d86 100644
--- a/nodedb/src/data/executor/handlers/transaction/overlay/graph_staged/txn_overlay.rs
+++ b/nodedb/src/data/executor/handlers/transaction/overlay/graph_staged/txn_overlay.rs
@@ -79,6 +79,9 @@ pub struct GraphTxnOverlay {
     /// the transaction alive). `Cell` for the same single-threaded `!Send`
     /// interior-mutability reason.
     last_touch_ord: Cell<i64>,
+    /// Frozen system-time ordinal used by both live transaction apply and WAL
+    /// redo. Separate from lease liveness so refreshes cannot change history.
+    resolved_system_from_ord: Cell<i64>,
 }
 
 impl GraphTxnOverlay {
@@ -97,6 +100,23 @@ impl GraphTxnOverlay {
         self.last_touch_ord.get()
     }
 
+    /// Freeze the graph transaction's system-time ordinal on first resolve.
+    /// Retries return the same value byte-for-byte.
+    pub fn freeze_system_from(&self, candidate: i64) -> i64 {
+        let frozen = self.resolved_system_from_ord.get();
+        if frozen != 0 {
+            frozen
+        } else {
+            self.resolved_system_from_ord.set(candidate);
+            candidate
+        }
+    }
+
+    pub fn resolved_system_from(&self) -> Option<i64> {
+        let value = self.resolved_system_from_ord.get();
+        (value != 0).then_some(value)
+    }
+
     /// Record an edge identity's prior state across BOTH edge sets before a
     /// staged edge mutation overwrites it. Single chokepoint shared by
     /// `stage_edge_put` and `stage_edge_delete` (and the batch forms, which
diff --git a/nodedb/src/data/executor/handlers/transaction/resolve/entry.rs b/nodedb/src/data/executor/handlers/transaction/resolve/entry.rs
index 580f920cd..146c6ada4 100644
--- a/nodedb/src/data/executor/handlers/transaction/resolve/entry.rs
+++ b/nodedb/src/data/executor/handlers/transaction/resolve/entry.rs
@@ -240,6 +240,9 @@ impl CoreLoop {
             }
         }
         if let Some(graph_overlay) = self.graph_txn_overlays.get(&txn_id) {
+            // Freeze temporal identity independently from the overlay's lease
+            // refresh stamp. Resolve retries reuse the exact same ordinal.
+            let graph_system_from = graph_overlay.freeze_system_from(self.hlc.next_ordinal());
             for collection in &graph_collections {
                 let coll_key = (
                     task.request.database_id,
@@ -251,6 +254,7 @@ impl CoreLoop {
                     &coll_key,
                     collection,
                     &edge_surrogates,
+                    graph_system_from,
                     &mut ops,
                 )?;
             }
@@ -1814,8 +1818,8 @@ mod tests {
         assert_eq!(redo.ops.len(), 1, "one staged edge put -> one sub-record");
         assert_eq!(redo.ops[0].record_type, RecordType::Put as u32);
 
-        let (collection, src_id, label, dst_id, properties, src_sur, dst_sur) =
-            zerompk::from_msgpack::<(String, String, String, String, Vec<u8>, u32, u32)>(
+        let (collection, src_id, label, dst_id, properties, src_sur, dst_sur, system_from) =
+            zerompk::from_msgpack::<(String, String, String, String, Vec<u8>, u32, u32, i64)>(
                 &redo.ops[0].payload,
             )
             .expect("decode edge put tuple");
@@ -1826,6 +1830,10 @@ mod tests {
         assert_eq!(properties, vec![9, 9]);
         assert_eq!(src_sur, 10, "src surrogate must come from the plan node");
         assert_eq!(dst_sur, 20, "dst surrogate must come from the plan node");
+        assert!(
+            system_from > 0,
+            "resolve must freeze a real graph system-time ordinal"
+        );
 
         // Replay into a fresh core: the CSR node->surrogate map must be
         // repopulated from the two trailing surrogates.
@@ -1901,13 +1909,14 @@ mod tests {
         assert_eq!(redo.ops.len(), 1);
         assert_eq!(redo.ops[0].record_type, RecordType::Delete as u32);
 
-        let (collection, src_id, label, dst_id) =
-            zerompk::from_msgpack::<(String, String, String, String)>(&redo.ops[0].payload)
-                .expect("decode edge delete tuple");
+        let (collection, src_id, label, dst_id, system_from) =
+            zerompk::from_msgpack::<(String, String, String, String, i64)>(&redo.ops[0].payload)
+                .expect("decode timestamped edge delete tuple");
         assert_eq!(collection, "g");
         assert_eq!(src_id, "a");
         assert_eq!(label, "knows");
         assert_eq!(dst_id, "b");
+        assert!(system_from > 0);
 
         // Seed the edge in a fresh core, then replay the delete removes it.
         let (mut dst_core, _dst_dir) = make_core();
diff --git a/nodedb/src/data/executor/handlers/transaction/resolve/graph.rs b/nodedb/src/data/executor/handlers/transaction/resolve/graph.rs
index cc775dd51..2f99ce97e 100644
--- a/nodedb/src/data/executor/handlers/transaction/resolve/graph.rs
+++ b/nodedb/src/data/executor/handlers/transaction/resolve/graph.rs
@@ -9,7 +9,7 @@
 //! surrogates a redo PUT carries and an autocommit PUT does not:
 //!
 //! * A staged edge put → `RecordType::Put`, `(collection, src_id, label,
-//!   dst_id, properties, src_surrogate, dst_surrogate)`. Replay's
+//!   dst_id, properties, src_surrogate, dst_surrogate, system_from)`. Replay's
 //!   `execute_edge_put` repopulates the CSR node→surrogate map from the two
 //!   trailing surrogates, so they must be present and correct.
 //! * A staged edge tombstone → `RecordType::Delete`, `(collection, src_id,
@@ -87,6 +87,7 @@ pub(super) fn serialize_graph_collection(
     coll_key: &GraphCollKey,
     collection: &str,
     edge_surrogates: &BTreeMap<EdgeIdentityKey, (u32, u32)>,
+    system_from: i64,
     ops: &mut Vec<RedoSubRecord>,
 ) -> crate::Result<()> {
     let mut puts: BTreeMap<(String, String, String), Vec<u8>> = BTreeMap::new();
@@ -126,6 +127,7 @@ pub(super) fn serialize_graph_collection(
             properties,
             src_surrogate,
             dst_surrogate,
+            system_from,
         ))
         .map_err(|e| crate::Error::Serialization {
             format: "msgpack".into(),
@@ -138,12 +140,17 @@ pub(super) fn serialize_graph_collection(
     }
 
     for (src, label, dst) in deletes {
-        let payload =
-            zerompk::to_msgpack_vec(&(collection, src.as_str(), label.as_str(), dst.as_str()))
-                .map_err(|e| crate::Error::Serialization {
-                    format: "msgpack".into(),
-                    detail: format!("graph resolve edge delete: {e}"),
-                })?;
+        let payload = zerompk::to_msgpack_vec(&(
+            collection,
+            src.as_str(),
+            label.as_str(),
+            dst.as_str(),
+            system_from,
+        ))
+        .map_err(|e| crate::Error::Serialization {
+            format: "msgpack".into(),
+            detail: format!("graph resolve edge delete: {e}"),
+        })?;
         ops.push(RedoSubRecord {
             record_type: RecordType::Delete as u32,
             payload,
@@ -312,7 +319,7 @@ mod tests {
     }
 
     #[test]
-    fn edge_put_emits_seven_element_tuple_with_surrogates() {
+    fn edge_put_emits_timestamped_tuple_with_surrogates() {
         let mut overlay = GraphTxnOverlay::new();
         overlay.stage_edge_put(coll_key("g"), "a", "knows", "b", vec![1, 2, 3]);
 
@@ -328,13 +335,13 @@ mod tests {
         );
 
         let mut ops = Vec::new();
-        serialize_graph_collection(&overlay, &coll_key("g"), "g", &surrogates, &mut ops)
+        serialize_graph_collection(&overlay, &coll_key("g"), "g", &surrogates, 123, &mut ops)
             .expect("serialize edge put");
         assert_eq!(ops.len(), 1);
         assert_eq!(ops[0].record_type, RecordType::Put as u32);
 
-        let (collection, src, label, dst, properties, src_sur, dst_sur) =
-            zerompk::from_msgpack::<(String, String, String, String, Vec<u8>, u32, u32)>(
+        let (collection, src, label, dst, properties, src_sur, dst_sur, system_from) =
+            zerompk::from_msgpack::<(String, String, String, String, Vec<u8>, u32, u32, i64)>(
                 &ops[0].payload,
             )
             .expect("decode edge put tuple");
@@ -345,6 +352,7 @@ mod tests {
         assert_eq!(properties, vec![1, 2, 3]);
         assert_eq!(src_sur, 10);
         assert_eq!(dst_sur, 20);
+        assert_eq!(system_from, 123);
     }
 
     #[test]
@@ -355,7 +363,7 @@ mod tests {
         let surrogates = BTreeMap::new();
         let mut ops = Vec::new();
         let result =
-            serialize_graph_collection(&overlay, &coll_key("g"), "g", &surrogates, &mut ops);
+            serialize_graph_collection(&overlay, &coll_key("g"), "g", &surrogates, 123, &mut ops);
         assert!(
             result.is_err(),
             "a staged put with no matching plan-carried surrogates must error, not invent one"
@@ -369,7 +377,7 @@ mod tests {
 
         let surrogates = BTreeMap::new();
         let mut ops = Vec::new();
-        serialize_graph_collection(&overlay, &coll_key("g"), "g", &surrogates, &mut ops)
+        serialize_graph_collection(&overlay, &coll_key("g"), "g", &surrogates, 123, &mut ops)
             .expect("serialize edge delete");
         assert_eq!(ops.len(), 1);
         assert_eq!(ops[0].record_type, RecordType::Delete as u32);
@@ -404,12 +412,12 @@ mod tests {
         }
 
         let mut ops = Vec::new();
-        serialize_graph_collection(&overlay, &coll_key("g"), "g", &surrogates, &mut ops)
+        serialize_graph_collection(&overlay, &coll_key("g"), "g", &surrogates, 123, &mut ops)
             .expect("serialize");
         let srcs: Vec<String> = ops
             .iter()
             .map(|op| {
-                zerompk::from_msgpack::<(String, String, String, String, Vec<u8>, u32, u32)>(
+                zerompk::from_msgpack::<(String, String, String, String, Vec<u8>, u32, u32, i64)>(
                     &op.payload,
                 )
                 .expect("decode")
diff --git a/nodedb/src/data/executor/handlers/transaction/sub_plan.rs b/nodedb/src/data/executor/handlers/transaction/sub_plan.rs
index f465d9f74..9bd3bbcbf 100644
--- a/nodedb/src/data/executor/handlers/transaction/sub_plan.rs
+++ b/nodedb/src/data/executor/handlers/transaction/sub_plan.rs
@@ -28,6 +28,7 @@ impl CoreLoop {
     /// Each helper handles that engine's write sub-ops (pushing an
     /// `UndoEntry`) and routes every other sub-op through the standard
     /// read-only / DDL dispatch path.
+    #[cfg(test)]
     pub(super) fn execute_tx_sub_plan(
         &mut self,
         tid: u64,
@@ -36,21 +37,50 @@ impl CoreLoop {
         crdt_deltas: &mut Vec<(Vec<u8>, u64, String)>,
         user_roles: &[String],
     ) -> Result<Response, ErrorCode> {
-        let dummy_task = Self::build_dummy_task(tid);
+        let task = Self::build_dummy_task(tid);
+        self.execute_tx_sub_plan_with_task(&task, tid, plan, undo_log, crdt_deltas, user_roles)
+    }
 
+    /// Replay a sub-plan with the parent batch's database and vShard identity.
+    /// Calvin executes the same logical batch on each participant, so erasing
+    /// this routing identity makes every replica appear to be vShard zero and
+    /// breaks canonical-owner side effects such as graph statistics.
+    pub(super) fn execute_tx_sub_plan_from_batch(
+        &mut self,
+        parent: &ExecutionTask,
+        tid: u64,
+        plan: &PhysicalPlan,
+        undo_log: &mut Vec<UndoEntry>,
+        crdt_deltas: &mut Vec<(Vec<u8>, u64, String)>,
+        user_roles: &[String],
+    ) -> Result<Response, ErrorCode> {
+        let task =
+            Self::build_dummy_task_at(tid, parent.request.database_id, parent.request.vshard_id);
+        self.execute_tx_sub_plan_with_task(&task, tid, plan, undo_log, crdt_deltas, user_roles)
+    }
+
+    fn execute_tx_sub_plan_with_task(
+        &mut self,
+        dummy_task: &ExecutionTask,
+        tid: u64,
+        plan: &PhysicalPlan,
+        undo_log: &mut Vec<UndoEntry>,
+        crdt_deltas: &mut Vec<(Vec<u8>, u64, String)>,
+        user_roles: &[String],
+    ) -> Result<Response, ErrorCode> {
         match plan {
             PhysicalPlan::Document(op) => {
-                self.exec_tx_document(&dummy_task, tid, plan, op, user_roles, undo_log)
+                self.exec_tx_document(dummy_task, tid, plan, op, user_roles, undo_log)
             }
-            PhysicalPlan::Vector(op) => self.exec_tx_vector(&dummy_task, tid, plan, op, undo_log),
-            PhysicalPlan::Graph(op) => self.exec_tx_graph(&dummy_task, tid, plan, op, undo_log),
-            PhysicalPlan::Crdt(op) => self.exec_tx_crdt(&dummy_task, tid, plan, op, crdt_deltas),
-            PhysicalPlan::Kv(kv_op) => self.execute_tx_kv(&dummy_task, tid, kv_op, undo_log),
+            PhysicalPlan::Vector(op) => self.exec_tx_vector(dummy_task, tid, plan, op, undo_log),
+            PhysicalPlan::Graph(op) => self.exec_tx_graph(dummy_task, tid, plan, op, undo_log),
+            PhysicalPlan::Crdt(op) => self.exec_tx_crdt(dummy_task, tid, plan, op, crdt_deltas),
+            PhysicalPlan::Kv(kv_op) => self.execute_tx_kv(dummy_task, tid, kv_op, undo_log),
             PhysicalPlan::Columnar(op) => {
-                self.exec_tx_columnar(&dummy_task, tid, plan, op, undo_log)
+                self.exec_tx_columnar(dummy_task, tid, plan, op, undo_log)
             }
             PhysicalPlan::Timeseries(op) => {
-                self.exec_tx_timeseries(&dummy_task, tid, plan, op, undo_log)
+                self.exec_tx_timeseries(dummy_task, tid, plan, op, undo_log)
             }
             PhysicalPlan::Spatial(_)
             | PhysicalPlan::Text(_)
@@ -66,12 +96,21 @@ impl CoreLoop {
     /// no-determinism: the deadline is ephemeral, not written to WAL. The
     /// placeholder `plan` (a no-op `Meta::Cancel`) is never executed; it
     /// only carries request metadata for response building.
+    #[cfg(test)]
     pub(super) fn build_dummy_task(tid: u64) -> ExecutionTask {
+        Self::build_dummy_task_at(tid, DatabaseId::DEFAULT, crate::types::VShardId::new(0))
+    }
+
+    fn build_dummy_task_at(
+        tid: u64,
+        database_id: DatabaseId,
+        vshard_id: crate::types::VShardId,
+    ) -> ExecutionTask {
         ExecutionTask::new(crate::bridge::envelope::Request {
             request_id: crate::types::RequestId::new(0),
             tenant_id: TenantId::new(tid),
-            database_id: DatabaseId::DEFAULT,
-            vshard_id: crate::types::VShardId::new(0),
+            database_id,
+            vshard_id,
             plan: PhysicalPlan::Meta(MetaOp::Cancel {
                 target_request_id: crate::types::RequestId::new(0),
             }),
@@ -260,6 +299,45 @@ impl CoreLoop {
                 undo_log,
             ),
 
+            GraphOp::EdgePutBatch { edges } => {
+                let mut response = self.response_ok(dummy_task);
+                for edge in edges {
+                    response = self.exec_tx_edge_put(
+                        dummy_task,
+                        tid,
+                        TxEdgePutParams {
+                            collection: &edge.collection,
+                            src_id: &edge.src_id,
+                            label: &edge.label,
+                            dst_id: &edge.dst_id,
+                            properties: &[],
+                            src_surrogate: edge.src_surrogate,
+                            dst_surrogate: edge.dst_surrogate,
+                        },
+                        undo_log,
+                    )?;
+                }
+                Ok(response)
+            }
+
+            GraphOp::EdgeDeleteBatch { edges } => {
+                let mut response = self.response_ok(dummy_task);
+                for edge in edges {
+                    response = self.exec_tx_edge_delete(
+                        dummy_task,
+                        tid,
+                        TxEdgeDeleteParams {
+                            collection: &edge.collection,
+                            src_id: &edge.src_id,
+                            label: &edge.label,
+                            dst_id: &edge.dst_id,
+                        },
+                        undo_log,
+                    )?;
+                }
+                Ok(response)
+            }
+
             _ => self.exec_tx_passthrough(tid, plan),
         }
     }
diff --git a/nodedb/src/data/executor/handlers/transaction/sub_plan_write.rs b/nodedb/src/data/executor/handlers/transaction/sub_plan_write.rs
index bcf0dc1b4..1ebf2bbe6 100644
--- a/nodedb/src/data/executor/handlers/transaction/sub_plan_write.rs
+++ b/nodedb/src/data/executor/handlers/transaction/sub_plan_write.rs
@@ -168,6 +168,16 @@ impl CoreLoop {
             .ok()
             .flatten();
 
+        // Record compensation before the two-store mutation begins. The edge
+        // store is updated before CSR, so a CSR failure must still leave an
+        // undo entry for the already-written edge version/stat counters.
+        undo_log.push(UndoEntry::PutEdge {
+            collection: collection.to_string(),
+            src_id: src_id.to_string(),
+            label: label.to_string(),
+            dst_id: dst_id.to_string(),
+            old_properties,
+        });
         let resp = self.execute_edge_put(
             dummy_task,
             crate::data::executor::handlers::graph::EdgePutParams {
@@ -186,14 +196,6 @@ impl CoreLoop {
                 detail: "edge put failed".into(),
             }));
         }
-
-        undo_log.push(UndoEntry::PutEdge {
-            collection: collection.to_string(),
-            src_id: src_id.to_string(),
-            label: label.to_string(),
-            dst_id: dst_id.to_string(),
-            old_properties,
-        });
         Ok(resp)
     }
 
@@ -224,13 +226,6 @@ impl CoreLoop {
             .ok()
             .flatten();
 
-        let resp = self.execute_edge_delete(dummy_task, tid, collection, src_id, label, dst_id);
-        if resp.status == Status::Error {
-            return Err(resp.error_code.map(|c| *c).unwrap_or(ErrorCode::Internal {
-                detail: "edge delete failed".into(),
-            }));
-        }
-
         if let Some(props) = old_properties {
             undo_log.push(UndoEntry::DeleteEdge {
                 collection: collection.to_string(),
@@ -240,6 +235,12 @@ impl CoreLoop {
                 old_properties: props,
             });
         }
+        let resp = self.execute_edge_delete(dummy_task, tid, collection, src_id, label, dst_id);
+        if resp.status == Status::Error {
+            return Err(resp.error_code.map(|c| *c).unwrap_or(ErrorCode::Internal {
+                detail: "edge delete failed".into(),
+            }));
+        }
         Ok(resp)
     }
 
diff --git a/nodedb/src/data/executor/handlers/transaction/undo/apply.rs b/nodedb/src/data/executor/handlers/transaction/undo/apply.rs
index ae6bebf9a..773fce41e 100644
--- a/nodedb/src/data/executor/handlers/transaction/undo/apply.rs
+++ b/nodedb/src/data/executor/handlers/transaction/undo/apply.rs
@@ -111,12 +111,24 @@ impl CoreLoop {
 
     // ── Graph ────────────────────────────────────────────────────────────────
 
+    #[cfg(test)]
     pub(super) fn apply_undo_edge(
         &mut self,
         did: u64,
         tid: u64,
         entry_index: usize,
         entry: UndoEntry,
+    ) -> Result<(), (usize, String)> {
+        self.apply_undo_edge_with_stats(did, tid, entry_index, entry, true)
+    }
+
+    pub(super) fn apply_undo_edge_with_stats(
+        &mut self,
+        did: u64,
+        tid: u64,
+        entry_index: usize,
+        entry: UndoEntry,
+        account_stats: bool,
     ) -> Result<(), (usize, String)> {
         use crate::engine::graph::edge_store::EdgeRef;
         let database = nodedb_types::DatabaseId::new(did);
@@ -135,7 +147,14 @@ impl CoreLoop {
                 if let Some(old_props) = old_properties {
                     let valid_from_ms = nodedb_types::ordinal_to_ms(ord);
                     self.edge_store
-                        .put_edge_versioned(edge_ref, &old_props, ord, valid_from_ms, i64::MAX)
+                        .put_edge_versioned_with_stats(
+                            edge_ref,
+                            &old_props,
+                            ord,
+                            valid_from_ms,
+                            i64::MAX,
+                            account_stats,
+                        )
                         .map_err(|e| {
                             let detail = format!(
                                 "edge restore {collection} {src_id}-[{label}]->{dst_id}: {e}"
@@ -147,9 +166,35 @@ impl CoreLoop {
                             );
                             (entry_index, detail)
                         })?;
+                    let weight =
+                        crate::engine::graph::csr::extract_weight_from_properties(&old_props);
+                    let partition = self.csr_partition_mut(did, tid);
+                    partition.remove_edge_in_collection(&src_id, &label, &dst_id, &collection);
+                    let csr_res = if weight != 1.0 {
+                        partition.add_edge_weighted_in_collection(
+                            &src_id,
+                            &label,
+                            &dst_id,
+                            &collection,
+                            weight,
+                        )
+                    } else {
+                        partition.add_edge_in_collection(&src_id, &label, &dst_id, &collection)
+                    };
+                    csr_res.map_err(|e| {
+                        let detail =
+                            format!("CSR restore {collection} {src_id}-[{label}]->{dst_id}: {e}");
+                        error!(
+                            core = self.core_id, entry_index,
+                            error = %detail,
+                            "transaction undo: CSR restore failed after edge_store restore; \
+                             shard state unknown"
+                        );
+                        (entry_index, detail)
+                    })?;
                 } else {
                     self.edge_store
-                        .soft_delete_edge(edge_ref, ord)
+                        .soft_delete_edge_with_stats(edge_ref, ord, account_stats)
                         .map_err(|e| {
                             let detail = format!(
                                 "edge tombstone {collection} {src_id}-[{label}]->{dst_id}: {e}"
@@ -181,12 +226,13 @@ impl CoreLoop {
                 let ord = self.hlc.next_ordinal();
                 let valid_from_ms = nodedb_types::ordinal_to_ms(ord);
                 self.edge_store
-                    .put_edge_versioned(
+                    .put_edge_versioned_with_stats(
                         EdgeRef::new(database, tenant, &collection, &src_id, &label, &dst_id),
                         &old_properties,
                         ord,
                         valid_from_ms,
                         i64::MAX,
+                        account_stats,
                     )
                     .map_err(|e| {
                         let detail = format!(
diff --git a/nodedb/src/data/executor/handlers/transaction/undo/rollback.rs b/nodedb/src/data/executor/handlers/transaction/undo/rollback.rs
index 36f49f070..3fb8c4e57 100644
--- a/nodedb/src/data/executor/handlers/transaction/undo/rollback.rs
+++ b/nodedb/src/data/executor/handlers/transaction/undo/rollback.rs
@@ -20,6 +20,26 @@ impl CoreLoop {
         did: u64,
         tid: u64,
         undo_log: Vec<UndoEntry>,
+    ) -> Result<(), (usize, String)> {
+        self.rollback_undo_log_inner(did, tid, None, undo_log)
+    }
+
+    pub(in crate::data::executor::handlers) fn rollback_undo_log_at(
+        &mut self,
+        did: u64,
+        tid: u64,
+        vshard_id: crate::types::VShardId,
+        undo_log: Vec<UndoEntry>,
+    ) -> Result<(), (usize, String)> {
+        self.rollback_undo_log_inner(did, tid, Some(vshard_id), undo_log)
+    }
+
+    fn rollback_undo_log_inner(
+        &mut self,
+        did: u64,
+        tid: u64,
+        vshard_id: Option<crate::types::VShardId>,
+        undo_log: Vec<UndoEntry>,
     ) -> Result<(), (usize, String)> {
         let total = undo_log.len();
         for (rev_idx, entry) in undo_log.into_iter().rev().enumerate() {
@@ -27,7 +47,7 @@ impl CoreLoop {
             // diagnostics (makes it easier to correlate with the sub-plan that
             // produced this undo entry).
             let original_idx = total.saturating_sub(1 + rev_idx);
-            self.apply_undo_entry(did, tid, original_idx, entry)?;
+            self.apply_undo_entry(did, tid, vshard_id, original_idx, entry)?;
         }
         Ok(())
     }
@@ -39,6 +59,7 @@ impl CoreLoop {
         &mut self,
         did: u64,
         tid: u64,
+        vshard_id: Option<crate::types::VShardId>,
         entry_index: usize,
         entry: UndoEntry,
     ) -> Result<(), (usize, String)> {
@@ -52,8 +73,11 @@ impl CoreLoop {
             UndoEntry::SpatialInsert { .. } | UndoEntry::SpatialDelete { .. } => {
                 self.apply_undo_spatial(entry_index, entry)
             }
-            UndoEntry::PutEdge { .. } | UndoEntry::DeleteEdge { .. } => {
-                self.apply_undo_edge(did, tid, entry_index, entry)
+            UndoEntry::PutEdge { ref src_id, .. } | UndoEntry::DeleteEdge { ref src_id, .. } => {
+                let account_stats = vshard_id.is_none_or(|vshard_id| {
+                    vshard_id == crate::types::VShardId::from_key(src_id.as_bytes())
+                });
+                self.apply_undo_edge_with_stats(did, tid, entry_index, entry, account_stats)
             }
             UndoEntry::KvPut { .. }
             | UndoEntry::KvDelete { .. }
diff --git a/nodedb/src/data/executor/handlers/transaction/undo/tests.rs b/nodedb/src/data/executor/handlers/transaction/undo/tests.rs
index e0e6d4469..e49e84919 100644
--- a/nodedb/src/data/executor/handlers/transaction/undo/tests.rs
+++ b/nodedb/src/data/executor/handlers/transaction/undo/tests.rs
@@ -790,6 +790,54 @@ fn edge_cascade_delete_rollback_restores_csr_and_edge_store() {
     );
 }
 
+#[test]
+fn graph_edge_update_undo_restores_csr_weight() {
+    use crate::engine::graph::edge_store::EdgeRef;
+
+    let dir = tempfile::tempdir().unwrap();
+    let (mut core, _tx, _rx) = make_core_with_dir(dir.path());
+    let tenant = TenantId::new(TID);
+    let old_properties = nodedb_types::json_to_msgpack(&serde_json::json!({ "weight": 2.5 }))
+        .expect("encode old edge properties");
+    let new_properties = nodedb_types::json_to_msgpack(&serde_json::json!({ "weight": 9.0 }))
+        .expect("encode new edge properties");
+    let edge = EdgeRef::new(
+        crate::types::DatabaseId::new(DB),
+        tenant,
+        "c",
+        "alice",
+        "KNOWS",
+        "bob",
+    );
+    core.edge_store
+        .put_edge_versioned(edge, &new_properties, 10, 10, i64::MAX)
+        .expect("seed updated edge");
+    core.csr_partition_mut(DB, TID)
+        .add_edge_weighted_in_collection("alice", "KNOWS", "bob", "c", 9.0)
+        .expect("seed updated CSR edge");
+
+    core.apply_undo_edge(
+        DB,
+        TID,
+        0,
+        UndoEntry::PutEdge {
+            collection: "c".into(),
+            src_id: "alice".into(),
+            label: "KNOWS".into(),
+            dst_id: "bob".into(),
+            old_properties: Some(old_properties),
+        },
+    )
+    .expect("undo edge update");
+
+    assert_eq!(
+        core.csr_partition_mut(DB, TID)
+            .edge_weight("alice", "KNOWS", "bob"),
+        Some(2.5),
+        "rollback must restore the committed CSR traversal weight"
+    );
+}
+
 // ── Column-stats undo ─────────────────────────────────────────────────────────
 
 fn stats_key_str() -> String {
diff --git a/nodedb/src/data/executor/wal_replay_redo_graph.rs b/nodedb/src/data/executor/wal_replay_redo_graph.rs
index bcd484af1..fd0e19899 100644
--- a/nodedb/src/data/executor/wal_replay_redo_graph.rs
+++ b/nodedb/src/data/executor/wal_replay_redo_graph.rs
@@ -12,10 +12,9 @@
 //! (`wal_append_if_write`):
 //!
 //! * PUT — `(collection, src_id, label, dst_id, properties, src_surrogate,
-//!   dst_surrogate)`. The autocommit shape stops at `properties`; the redo shape
-//!   appends the two endpoint surrogates because `execute_edge_put` repopulates
-//!   the CSR node→surrogate map from them (bitmap-gated traversal depends on it),
-//!   and that identity is not otherwise recoverable from the edge alone.
+//!   dst_surrogate, system_from)`. The autocommit shape stops at `properties`;
+//!   the redo shape appends endpoint surrogates and the original temporal
+//!   ordinal. Legacy seven-element transaction redo remains decodable.
 //! * DELETE — `(collection, src_id, label, dst_id)`. Byte-identical to the
 //!   autocommit shape; `execute_edge_delete` needs no surrogate.
 //!
@@ -75,10 +74,50 @@ impl CoreLoop {
             let record_lsn = record.header.lsn;
 
             if is_put {
-                let Ok((collection, src_id, label, dst_id, properties, src_sur, dst_sur)) =
+                let decoded = zerompk::from_msgpack::<(
+                    String,
+                    String,
+                    String,
+                    String,
+                    Vec<u8>,
+                    u32,
+                    u32,
+                    i64,
+                )>(&record.payload)
+                .map(
+                    |(collection, src, label, dst, props, src_sur, dst_sur, system_from)| {
+                        (
+                            collection,
+                            src,
+                            label,
+                            dst,
+                            props,
+                            src_sur,
+                            dst_sur,
+                            Some(system_from),
+                        )
+                    },
+                )
+                .or_else(|_| {
                     zerompk::from_msgpack::<(String, String, String, String, Vec<u8>, u32, u32)>(
                         &record.payload,
                     )
+                    .map(
+                        |(collection, src, label, dst, props, src_sur, dst_sur)| {
+                            (collection, src, label, dst, props, src_sur, dst_sur, None)
+                        },
+                    )
+                });
+                let Ok((
+                    collection,
+                    src_id,
+                    label,
+                    dst_id,
+                    properties,
+                    src_sur,
+                    dst_sur,
+                    system_from,
+                )) = decoded
                 else {
                     continue;
                 };
@@ -93,6 +132,7 @@ impl CoreLoop {
                 let task = Self::replay_graph_task(
                     tenant_id,
                     database_id,
+                    crate::types::VShardId::new(record.header.vshard_id),
                     record_lsn,
                     PhysicalPlan::Graph(GraphOp::EdgePut {
                         collection: collection.clone(),
@@ -104,6 +144,7 @@ impl CoreLoop {
                         dst_surrogate: nodedb_types::Surrogate::new(dst_sur),
                     }),
                 );
+                self.active_graph_system_from = system_from;
                 let response = self.execute_edge_put(
                     &task,
                     EdgePutParams {
@@ -117,6 +158,7 @@ impl CoreLoop {
                         dst_surrogate: nodedb_types::Surrogate::new(dst_sur),
                     },
                 );
+                self.active_graph_system_from = None;
                 if response.status == crate::bridge::envelope::Status::Ok {
                     puts += 1;
                 } else {
@@ -128,9 +170,20 @@ impl CoreLoop {
                     );
                 }
             } else {
-                let Ok((collection, src_id, label, dst_id)) =
-                    zerompk::from_msgpack::<(String, String, String, String)>(&record.payload)
-                else {
+                let decoded =
+                    zerompk::from_msgpack::<(String, String, String, String, i64)>(&record.payload)
+                        .map(|(collection, src, label, dst, system_from)| {
+                            (collection, src, label, dst, Some(system_from))
+                        })
+                        .or_else(|_| {
+                            zerompk::from_msgpack::<(String, String, String, String)>(
+                                &record.payload,
+                            )
+                            .map(|(collection, src, label, dst)| {
+                                (collection, src, label, dst, None)
+                            })
+                        });
+                let Ok((collection, src_id, label, dst_id, system_from)) = decoded else {
                     continue;
                 };
                 if tombstones.is_tombstoned(
@@ -144,6 +197,7 @@ impl CoreLoop {
                 let task = Self::replay_graph_task(
                     tenant_id,
                     database_id,
+                    crate::types::VShardId::new(record.header.vshard_id),
                     record_lsn,
                     PhysicalPlan::Graph(GraphOp::EdgeDelete {
                         collection: collection.clone(),
@@ -154,6 +208,7 @@ impl CoreLoop {
                         dst_surrogate: nodedb_types::Surrogate::ZERO,
                     }),
                 );
+                self.active_graph_system_from = system_from;
                 let response = self.execute_edge_delete(
                     &task,
                     tenant_id,
@@ -162,6 +217,7 @@ impl CoreLoop {
                     &label,
                     &dst_id,
                 );
+                self.active_graph_system_from = None;
                 if response.status == crate::bridge::envelope::Status::Ok {
                     deletes += 1;
                 } else {
@@ -242,10 +298,10 @@ impl CoreLoop {
     fn replay_graph_task(
         tenant_id: u64,
         database_id: DatabaseId,
+        vshard_id: crate::types::VShardId,
         record_lsn: u64,
         plan: PhysicalPlan,
     ) -> ExecutionTask {
-        let vshard_id = crate::types::VShardId::from_collection_in_database(database_id, "");
         let wal_lsn = Some(Lsn::new(record_lsn));
         ExecutionTask {
             request: Request {
@@ -315,9 +371,17 @@ mod tests {
     }
 
     fn edge_put_sub(collection: &str, src: &str, label: &str, dst: &str) -> RedoSubRecord {
-        let payload =
-            zerompk::to_msgpack_vec(&(collection, src, label, dst, b"".as_slice(), 10u32, 20u32))
-                .expect("encode edge put sub-record");
+        let payload = zerompk::to_msgpack_vec(&(
+            collection,
+            src,
+            label,
+            dst,
+            b"".as_slice(),
+            10u32,
+            20u32,
+            nodedb_types::ms_to_ordinal_upper(100),
+        ))
+        .expect("encode edge put sub-record");
         RedoSubRecord {
             record_type: RecordType::Put as u32,
             payload,
@@ -334,7 +398,7 @@ mod tests {
             record_type: RecordType::TransactionRedo as u32,
             lsn: 1,
             tenant_id,
-            vshard_id: 0,
+            vshard_id: crate::types::VShardId::from_key(b"a").as_u32(),
             database_id: 0,
             payload: redo.to_bytes().expect("encode redo record"),
             encryption_key: None,
@@ -367,6 +431,26 @@ mod tests {
             1,
             "graph edge must be restored from redo replay"
         );
+        let stats = h
+            .core
+            .edge_store
+            .collection_stats(0, crate::types::TenantId::new(7), "knows", None)
+            .expect("graph stats after redo");
+        assert_eq!(stats.edge_count, 1, "source-home redo must restore stats");
+        let historical = h
+            .core
+            .edge_store
+            .collection_stats(
+                0,
+                crate::types::TenantId::new(7),
+                "knows",
+                Some(nodedb_types::ms_to_ordinal_upper(100)),
+            )
+            .expect("historical graph stats after redo");
+        assert_eq!(
+            historical.edge_count, 1,
+            "redo must restore the committed temporal version at its original time"
+        );
     }
 
     #[test]
diff --git a/nodedb/src/engine/graph/edge_store/stats/read.rs b/nodedb/src/engine/graph/edge_store/stats/read.rs
index 5a8d26f06..cd608373d 100644
--- a/nodedb/src/engine/graph/edge_store/stats/read.rs
+++ b/nodedb/src/engine/graph/edge_store/stats/read.rs
@@ -5,9 +5,8 @@
 //! ## Complexity
 //!
 //! - `as_of = None` (live snapshot): O(1) summary read + O(distinct_labels) label scan.
-//!   If the summary row is missing (cold-start / schema upgrade), triggers a lazy rebuild
-//!   via a full EDGES prefix scan and atomically writes the result back. Subsequent calls
-//!   are O(1) per the summary row.
+//!   Legacy or missing ownership-aware summaries fall back to a full EDGES prefix scan
+//!   and carry edge identities so the Control Plane can deduplicate dual-home replicas.
 //!
 //! - `as_of = Some(ts)`: falls back to a full EDGES prefix scan for the matching
 //!   collection, materialising counts at the given system-time ordinal. O(edges-in-collection).
@@ -27,9 +26,7 @@ use nodedb_types::TenantId;
 use crate::engine::graph::edge_store::store::{EDGES, EdgeStore, redb_err};
 use crate::engine::graph::edge_store::temporal::keys::{is_sentinel, parse_versioned_edge_key};
 
-use super::table::{
-    CollectionStats, GRAPH_STATS, LabelRow, SummaryRow, label_key, label_prefix, summary_key,
-};
+use super::table::{CollectionStats, GRAPH_STATS, LabelRow, SummaryRow, label_prefix, summary_key};
 
 impl EdgeStore {
     /// Live or historical stats for a single `(tenant, collection)` pair.
@@ -37,9 +34,9 @@ impl EdgeStore {
     /// Returns zeros when no edges exist — not an error.
     ///
     /// When `as_of` is `None` the result is served from the persistent summary
-    /// row (O(1) + O(distinct_labels)). If the summary row is absent, a lazy
-    /// rebuild is triggered via a full prefix scan of EDGES, and the result is
-    /// cached atomically for future calls.
+    /// row (O(1) + O(distinct_labels)). A legacy or absent ownership-aware
+    /// summary falls back to a full prefix scan of EDGES and returns logical
+    /// identities for exact cross-core deduplication.
     ///
     /// When `as_of` is `Some(ordinal)` the function performs a full prefix scan
     /// of EDGES and materialises counts at that system-time ordinal.
@@ -61,8 +58,7 @@ impl EdgeStore {
     ///
     /// With `as_of = None`: scans `GRAPH_STATS` summary rows for the tenant
     /// (O(collections-with-stats)), then does O(distinct_labels) label scan
-    /// per collection. If the summary row for any collection is absent but EDGES
-    /// has entries for it, triggers a lazy rebuild.
+    /// per collection. Legacy or absent summaries fall back to EDGES scans.
     ///
     /// With `as_of = Some(ts)`: scans all EDGES for the tenant once, grouping by
     /// collection and materialising counts at ordinal `ts`. O(total-edges-for-tenant).
@@ -104,6 +100,11 @@ impl EdgeStore {
         if let Some(bytes) = summary_bytes {
             let summary = SummaryRow::decode(bytes.value())?;
             drop(bytes);
+            if summary.ownership_version == 0 {
+                drop(stats_table);
+                drop(read_txn);
+                return self.collection_stats_historical(db, tid, collection, i64::MAX);
+            }
             let labels = read_labels_from_table(&stats_table, db, t, collection)?;
             return Ok(CollectionStats {
                 collection: collection.to_string(),
@@ -111,6 +112,8 @@ impl EdgeStore {
                 distinct_node_count: summary.distinct_node_count,
                 distinct_label_count: summary.distinct_label_count,
                 labels,
+                logical_edges: Vec::new(),
+                exact_scan: false,
             });
         }
         drop(stats_table);
@@ -124,10 +127,11 @@ impl EdgeStore {
             return Ok(CollectionStats::zero(collection.to_string()));
         }
 
-        // Rebuild: scan live EDGES for this collection at current-state.
-        let rebuilt = self.collection_stats_historical(db, tid, collection, i64::MAX)?;
-        self.write_stats_atomically(db, tid, collection, &rebuilt)?;
-        Ok(rebuilt)
+        // A physical-edge scan is exact locally and carries logical identities
+        // for cross-core union. Do not cache it as a summary: this store may be
+        // the destination-home replica, and only request routing can establish
+        // which physical copy owns global cardinality.
+        self.collection_stats_historical(db, tid, collection, i64::MAX)
     }
 
     fn tenant_stats_live(&self, db: u64, tid: TenantId) -> crate::Result<Vec<CollectionStats>> {
@@ -160,7 +164,8 @@ impl EdgeStore {
         drop(read_txn);
 
         if collections.is_empty() {
-            // No summary rows exist — scan EDGES to discover collections and rebuild.
+            // No ownership-aware summary rows exist — scan EDGES and return
+            // logical identities for cross-core deduplication.
             return self.tenant_stats_historical(db, tid, i64::MAX);
         }
 
@@ -279,45 +284,6 @@ impl EdgeStore {
             }
         }
     }
-
-    fn write_stats_atomically(
-        &self,
-        db: u64,
-        tid: TenantId,
-        collection: &str,
-        stats: &CollectionStats,
-    ) -> crate::Result<()> {
-        let t = tid.as_u64();
-        let write_txn = self
-            .db
-            .begin_write()
-            .map_err(|e| redb_err("begin_write (rebuild)", e))?;
-        {
-            let mut st = write_txn
-                .open_table(GRAPH_STATS)
-                .map_err(|e| redb_err("open graph_stats (rebuild)", e))?;
-
-            let summary = SummaryRow {
-                edge_count: stats.edge_count,
-                distinct_node_count: stats.distinct_node_count,
-                distinct_label_count: stats.distinct_label_count,
-            };
-            let skey = summary_key(collection);
-            st.insert((db, t, skey.as_str()), summary.encode()?.as_slice())
-                .map_err(|e| redb_err("insert rebuilt summary", e))?;
-
-            for (label, count) in &stats.labels {
-                let lkey = label_key(collection, label);
-                let lrow = LabelRow { count: *count };
-                st.insert((db, t, lkey.as_str()), lrow.encode()?.as_slice())
-                    .map_err(|e| redb_err("insert rebuilt label", e))?;
-            }
-        }
-        write_txn
-            .commit()
-            .map_err(|e| redb_err("commit rebuild", e))?;
-        Ok(())
-    }
 }
 
 // ── free functions ────────────────────────────────────────────────────────────
@@ -403,12 +369,14 @@ fn materialise_collection_stats(
     let mut edge_count = 0u64;
     let mut label_counts: HashMap<String, u64> = HashMap::new();
     let mut node_refs: HashMap<String, u32> = HashMap::new();
+    let mut logical_edges = Vec::new();
 
     for entry in bases.values() {
         if entry.is_sentinel {
             continue;
         }
         edge_count += 1;
+        logical_edges.push((entry.src.clone(), entry.label.clone(), entry.dst.clone()));
         *label_counts.entry(entry.label.clone()).or_insert(0) += 1;
         *node_refs.entry(entry.src.clone()).or_insert(0) += 1;
         if entry.src != entry.dst {
@@ -427,6 +395,8 @@ fn materialise_collection_stats(
         distinct_node_count,
         distinct_label_count,
         labels,
+        logical_edges,
+        exact_scan: true,
     })
 }
 
@@ -451,12 +421,14 @@ impl CollectionAccum {
         let mut edge_count = 0u64;
         let mut label_counts: HashMap<String, u64> = HashMap::new();
         let mut node_refs: HashMap<String, u32> = HashMap::new();
+        let mut logical_edges = Vec::new();
 
         for entry in self.bases.values() {
             if entry.is_sentinel {
                 continue;
             }
             edge_count += 1;
+            logical_edges.push((entry.src.clone(), entry.label.clone(), entry.dst.clone()));
             *label_counts.entry(entry.label.clone()).or_insert(0) += 1;
             *node_refs.entry(entry.src.clone()).or_insert(0) += 1;
             if entry.src != entry.dst {
@@ -475,6 +447,8 @@ impl CollectionAccum {
             distinct_node_count,
             distinct_label_count,
             labels,
+            logical_edges,
+            exact_scan: true,
         }
     }
 }
diff --git a/nodedb/src/engine/graph/edge_store/stats/table.rs b/nodedb/src/engine/graph/edge_store/stats/table.rs
index 10285b303..f80d315f5 100644
--- a/nodedb/src/engine/graph/edge_store/stats/table.rs
+++ b/nodedb/src/engine/graph/edge_store/stats/table.rs
@@ -25,20 +25,32 @@ pub const GRAPH_STATS: TableDefinition<(u64, u64, &str), &[u8]> =
 
 /// Aggregate counters for a `(tenant, collection)` pair. Written as the
 /// `summary` row kind.
-#[derive(
-    Debug,
-    Clone,
-    PartialEq,
-    Eq,
-    Serialize,
-    Deserialize,
-    zerompk::ToMessagePack,
-    zerompk::FromMessagePack,
-)]
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
 pub struct SummaryRow {
     pub edge_count: u64,
     pub distinct_node_count: u64,
     pub distinct_label_count: u64,
+    /// `1` means counters use source-home logical ownership. Legacy rows decode
+    /// as zero and are served by exact edge-identity scans until rebuilt.
+    #[serde(default)]
+    pub ownership_version: u8,
+}
+
+#[derive(zerompk::ToMessagePack, zerompk::FromMessagePack)]
+#[msgpack(map)]
+struct SummaryRowV1 {
+    edge_count: u64,
+    distinct_node_count: u64,
+    distinct_label_count: u64,
+    #[msgpack(default)]
+    ownership_version: u8,
+}
+
+#[derive(zerompk::ToMessagePack, zerompk::FromMessagePack)]
+struct LegacySummaryRow {
+    edge_count: u64,
+    distinct_node_count: u64,
+    distinct_label_count: u64,
 }
 
 impl SummaryRow {
@@ -47,21 +59,43 @@ impl SummaryRow {
             edge_count: 0,
             distinct_node_count: 0,
             distinct_label_count: 0,
+            ownership_version: 1,
         }
     }
 
     pub fn encode(&self) -> crate::Result<Vec<u8>> {
-        zerompk::to_msgpack_vec(self).map_err(|e| crate::Error::Storage {
+        zerompk::to_msgpack_vec(&SummaryRowV1 {
+            edge_count: self.edge_count,
+            distinct_node_count: self.distinct_node_count,
+            distinct_label_count: self.distinct_label_count,
+            ownership_version: self.ownership_version,
+        })
+        .map_err(|e| crate::Error::Storage {
             engine: "graph".into(),
             detail: format!("encode SummaryRow: {e}"),
         })
     }
 
     pub fn decode(bytes: &[u8]) -> crate::Result<Self> {
-        zerompk::from_msgpack(bytes).map_err(|e| crate::Error::Storage {
-            engine: "graph".into(),
-            detail: format!("decode SummaryRow: {e}"),
-        })
+        if let Ok(row) = zerompk::from_msgpack::<SummaryRowV1>(bytes) {
+            return Ok(Self {
+                edge_count: row.edge_count,
+                distinct_node_count: row.distinct_node_count,
+                distinct_label_count: row.distinct_label_count,
+                ownership_version: row.ownership_version,
+            });
+        }
+        zerompk::from_msgpack::<LegacySummaryRow>(bytes)
+            .map(|row| Self {
+                edge_count: row.edge_count,
+                distinct_node_count: row.distinct_node_count,
+                distinct_label_count: row.distinct_label_count,
+                ownership_version: 0,
+            })
+            .map_err(|e| crate::Error::Storage {
+                engine: "graph".into(),
+                detail: format!("decode SummaryRow: {e}"),
+            })
     }
 }
 
@@ -181,6 +215,19 @@ pub struct CollectionStats {
     pub distinct_label_count: u64,
     /// Per-label edge counts, sorted ascending by label name for determinism.
     pub labels: Vec<(String, u64)>,
+    /// Logical edge identities populated only by exact scans. They let the
+    /// Control Plane union dual-home physical replicas exactly; ownership-aware
+    /// live snapshots use source-owned persistent counters and leave this empty.
+    #[serde(default)]
+    #[msgpack(default)]
+    pub logical_edges: Vec<(String, String, String)>,
+    /// True when this result came from an exact physical-edge scan. A live
+    /// broadcast that observes even one legacy core repeats the broadcast in
+    /// exact mode on every core so legacy and ownership-aware summaries are
+    /// never combined approximately.
+    #[serde(default)]
+    #[msgpack(default)]
+    pub exact_scan: bool,
 }
 
 impl CollectionStats {
@@ -191,6 +238,33 @@ impl CollectionStats {
             distinct_node_count: 0,
             distinct_label_count: 0,
             labels: Vec::new(),
+            logical_edges: Vec::new(),
+            exact_scan: false,
         }
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn summary_decode_marks_legacy_counters_as_unowned() {
+        let bytes = zerompk::to_msgpack_vec(&LegacySummaryRow {
+            edge_count: 2,
+            distinct_node_count: 4,
+            distinct_label_count: 1,
+        })
+        .expect("encode legacy summary");
+        let decoded = SummaryRow::decode(&bytes).expect("decode legacy summary");
+        assert_eq!(decoded.edge_count, 2);
+        assert_eq!(decoded.ownership_version, 0);
+    }
+
+    #[test]
+    fn ownership_aware_summary_round_trips_version() {
+        let summary = SummaryRow::zero();
+        let bytes = summary.encode().expect("encode current summary");
+        assert_eq!(SummaryRow::decode(&bytes).unwrap(), summary);
+    }
+}
diff --git a/nodedb/src/engine/graph/edge_store/temporal/write.rs b/nodedb/src/engine/graph/edge_store/temporal/write.rs
index e04ec843b..1fcf23cc6 100644
--- a/nodedb/src/engine/graph/edge_store/temporal/write.rs
+++ b/nodedb/src/engine/graph/edge_store/temporal/write.rs
@@ -3,11 +3,14 @@
 //! Bitemporal write paths on `EdgeStore`:
 //! `put_edge_versioned`, `soft_delete_edge`, `gdpr_erase_edge`.
 
+use redb::ReadableTable;
+
 use super::keys::{
     EdgeRef, GDPR_ERASURE_SENTINEL, TOMBSTONE_SENTINEL, edge_version_prefix, is_sentinel,
     versioned_edge_key,
 };
 use super::payload::EdgeValuePayload;
+use crate::engine::graph::edge_store::stats::table::{GRAPH_STATS, SummaryRow, summary_key};
 use crate::engine::graph::edge_store::stats::update::{
     EdgeStatsKey, decrement_for_delete, increment_for_insert,
 };
@@ -28,6 +31,29 @@ impl EdgeStore {
         system_from: i64,
         valid_from_ms: i64,
         valid_until_ms: i64,
+    ) -> crate::Result<()> {
+        self.put_edge_versioned_with_stats(
+            edge,
+            properties,
+            system_from,
+            valid_from_ms,
+            valid_until_ms,
+            true,
+        )
+    }
+
+    /// Write a version while allowing a dual-home replica to skip logical
+    /// cardinality accounting. Cross-vShard graph writes persist the same edge
+    /// on both endpoint homes for OUT and IN traversal, but only the source home
+    /// owns the logical edge for global statistics.
+    pub fn put_edge_versioned_with_stats(
+        &self,
+        edge: EdgeRef<'_>,
+        properties: &[u8],
+        system_from: i64,
+        valid_from_ms: i64,
+        valid_until_ms: i64,
+        account_stats: bool,
     ) -> crate::Result<()> {
         let fwd = versioned_edge_key(edge.collection, edge.src, edge.label, edge.dst, system_from)?;
         let rev = versioned_edge_key(edge.collection, edge.dst, edge.label, edge.src, system_from)?;
@@ -57,18 +83,41 @@ impl EdgeStore {
                 .map_err(|e| redb_err("insert reverse", e))?;
             drop(rev_t);
 
-            increment_for_insert(
-                &write_txn,
-                EdgeStatsKey {
-                    db: d,
-                    tid: t,
-                    collection: edge.collection,
-                    label: edge.label,
-                    src: edge.src,
-                    dst: edge.dst,
-                },
-                system_from,
-            )?;
+            if account_stats {
+                increment_for_insert(
+                    &write_txn,
+                    EdgeStatsKey {
+                        db: d,
+                        tid: t,
+                        collection: edge.collection,
+                        label: edge.label,
+                        src: edge.src,
+                        dst: edge.dst,
+                    },
+                    system_from,
+                )?;
+            } else {
+                // Suppress the lazy edge-scan rebuild on a destination-only
+                // replica: absence of a summary means "legacy stats missing",
+                // while an explicit zero summary means "this shard owns no
+                // logical edges for this collection". Preserve an existing
+                // nonzero summary because this core may canonically own other
+                // source-homed edges in the same collection.
+                let key = summary_key(edge.collection);
+                let mut stats = write_txn
+                    .open_table(GRAPH_STATS)
+                    .map_err(|e| redb_err("open graph_stats", e))?;
+                if stats
+                    .get((d, t, key.as_str()))
+                    .map_err(|e| redb_err("read graph summary", e))?
+                    .is_none()
+                {
+                    let zero = SummaryRow::zero().encode()?;
+                    stats
+                        .insert((d, t, key.as_str()), zero.as_slice())
+                        .map_err(|e| redb_err("insert zero graph summary", e))?;
+                }
+            }
         }
         write_txn.commit().map_err(|e| redb_err("commit", e))?;
         Ok(())
@@ -140,13 +189,24 @@ impl EdgeStore {
 
     /// Append a tombstone version at `system_from`.
     pub fn soft_delete_edge(&self, edge: EdgeRef<'_>, system_from: i64) -> crate::Result<()> {
-        self.write_sentinel(edge, system_from, TOMBSTONE_SENTINEL)
+        self.write_sentinel(edge, system_from, TOMBSTONE_SENTINEL, true)
+    }
+
+    /// Append a tombstone without double-decrementing global statistics on the
+    /// destination-home replica of a dual-homed edge.
+    pub fn soft_delete_edge_with_stats(
+        &self,
+        edge: EdgeRef<'_>,
+        system_from: i64,
+        account_stats: bool,
+    ) -> crate::Result<()> {
+        self.write_sentinel(edge, system_from, TOMBSTONE_SENTINEL, account_stats)
     }
 
     /// Append a GDPR-erasure version — distinct from a soft-delete so audits
     /// can distinguish user-visible removal from regulatory erasure.
     pub fn gdpr_erase_edge(&self, edge: EdgeRef<'_>, system_from: i64) -> crate::Result<()> {
-        self.write_sentinel(edge, system_from, GDPR_ERASURE_SENTINEL)
+        self.write_sentinel(edge, system_from, GDPR_ERASURE_SENTINEL, true)
     }
 
     fn write_sentinel(
@@ -154,6 +214,7 @@ impl EdgeStore {
         edge: EdgeRef<'_>,
         system_from: i64,
         sentinel: &[u8],
+        account_stats: bool,
     ) -> crate::Result<()> {
         debug_assert!(
             is_sentinel(sentinel),
@@ -185,18 +246,20 @@ impl EdgeStore {
                 .map_err(|e| redb_err("insert sentinel reverse", e))?;
             drop(rev_t);
 
-            decrement_for_delete(
-                &write_txn,
-                EdgeStatsKey {
-                    db: d,
-                    tid: t,
-                    collection: edge.collection,
-                    label: edge.label,
-                    src: edge.src,
-                    dst: edge.dst,
-                },
-                system_from,
-            )?;
+            if account_stats {
+                decrement_for_delete(
+                    &write_txn,
+                    EdgeStatsKey {
+                        db: d,
+                        tid: t,
+                        collection: edge.collection,
+                        label: edge.label,
+                        src: edge.src,
+                        dst: edge.dst,
+                    },
+                    system_from,
+                )?;
+            }
         }
         write_txn
             .commit()
diff --git a/nodedb/tests/engine_surface_graph_stats.rs b/nodedb/tests/engine_surface_graph_stats.rs
index 948490401..1ba6ce708 100644
--- a/nodedb/tests/engine_surface_graph_stats.rs
+++ b/nodedb/tests/engine_surface_graph_stats.rs
@@ -62,6 +62,45 @@ async fn single_edge_collection_counts() {
     );
 }
 
+#[tokio::test]
+async fn strict_collection_edge_counts_once_at_every_stats_surface() {
+    let srv = TestServer::start_multicores(2).await;
+    srv.exec(
+        "CREATE COLLECTION g_strict_counts (id TEXT PRIMARY KEY, name TEXT) \
+         WITH (engine='document_strict')",
+    )
+    .await
+    .unwrap();
+    srv.exec(
+        "GRAPH INSERT EDGE IN g_strict_counts FROM 'a' TO 'b' \
+         TYPE 'knows' PROPERTIES '{}'",
+    )
+    .await
+    .unwrap();
+
+    let compact = srv
+        .query_rows("SHOW GRAPH STATS 'g_strict_counts'")
+        .await
+        .unwrap();
+    let (nodes, edges, labels, labels_json) =
+        find_row(&compact, "g_strict_counts").expect("compact stats row");
+    assert_eq!(nodes, 2, "each endpoint must be counted once");
+    assert_eq!(edges, 1, "one logical insert must count as one edge");
+    assert_eq!(labels, 1, "one label must be distinct");
+    assert!(
+        labels_json.contains("\"count\":1"),
+        "per-label count must also be one: {labels_json}"
+    );
+
+    let verbose = srv
+        .query_rows("SHOW GRAPH STATS 'g_strict_counts' VERBOSE")
+        .await
+        .unwrap();
+    assert_eq!(verbose.len(), 1, "one label row expected: {verbose:?}");
+    assert_eq!(verbose[0][1], "knows");
+    assert_eq!(verbose[0][2], "1", "verbose label count");
+}
+
 #[tokio::test]
 async fn multi_label_distinct_count() {
     let srv = TestServer::start().await;
diff --git a/nodedb/tests/executor_tests/test_aggregate_aliases.rs b/nodedb/tests/executor_tests/test_aggregate_aliases.rs
index 7e9dc8f71..11ea29a38 100644
--- a/nodedb/tests/executor_tests/test_aggregate_aliases.rs
+++ b/nodedb/tests/executor_tests/test_aggregate_aliases.rs
@@ -95,3 +95,204 @@ fn aggregate_output_uses_user_alias_but_having_reads_canonical_key() {
     assert!(rows[0].get("count(*)").is_none());
     assert!(rows[0].get("avg(score)").is_none());
 }
+
+fn grouped_count_plan(user_alias: &str) -> PhysicalPlan {
+    grouped_count_shape_plan(user_alias, 10, Vec::new())
+}
+
+fn computed_group_count_plan(function: &str) -> PhysicalPlan {
+    PhysicalPlan::Query(QueryOp::Aggregate {
+        collection: "cache_alias_users".into(),
+        input: None,
+        group_by: vec![GroupKeySpec {
+            output_name: "group_0".into(),
+            field: None,
+            expr: Some(nodedb_query::expr::SqlExpr::Function {
+                name: function.into(),
+                args: vec![nodedb_query::expr::SqlExpr::Column("department".into())],
+            }),
+        }],
+        aggregates: vec![AggregateSpec {
+            function: "count".into(),
+            alias: "count(*)".into(),
+            user_alias: Some("row_count".into()),
+            field: "*".into(),
+            expr: None,
+        }],
+        filters: Vec::new(),
+        having: Vec::new(),
+        limit: 10,
+        sub_group_by: Vec::new(),
+        sub_aggregates: Vec::new(),
+        grouping_sets: Vec::new(),
+        sort_keys: Vec::new(),
+    })
+}
+
+fn grouped_count_shape_plan(
+    user_alias: &str,
+    limit: usize,
+    sort_keys: Vec<(String, bool)>,
+) -> PhysicalPlan {
+    PhysicalPlan::Query(QueryOp::Aggregate {
+        collection: "cache_alias_users".into(),
+        input: None,
+        group_by: vec![GroupKeySpec::column("department")],
+        aggregates: vec![AggregateSpec {
+            function: "count".into(),
+            alias: "count(*)".into(),
+            user_alias: Some(user_alias.into()),
+            field: "*".into(),
+            expr: None,
+        }],
+        filters: Vec::new(),
+        having: Vec::new(),
+        limit,
+        sub_group_by: Vec::new(),
+        sub_aggregates: Vec::new(),
+        grouping_sets: Vec::new(),
+        sort_keys,
+    })
+}
+
+#[test]
+fn aggregate_cache_separates_user_facing_output_aliases() {
+    let mut ctx = make_ctx();
+
+    for (idx, id) in ["u1", "u2"].into_iter().enumerate() {
+        let doc = nodedb_types::json_to_msgpack(&serde_json::json!({
+            "id": id,
+            "department": "tools",
+        }))
+        .expect("encode document");
+        send_ok(
+            &mut ctx.core,
+            &mut ctx.tx,
+            &mut ctx.rx,
+            PhysicalPlan::Document(DocumentOp::PointPut {
+                collection: "cache_alias_users".into(),
+                document_id: id.into(),
+                value: doc,
+                surrogate: nodedb_types::Surrogate::new((idx as u32) + 1),
+                pk_bytes: Vec::new(),
+            }),
+        );
+    }
+
+    let first = send_ok(
+        &mut ctx.core,
+        &mut ctx.tx,
+        &mut ctx.rx,
+        grouped_count_plan("first_count"),
+    );
+    let first_rows = payload_value(&first);
+    assert_eq!(first_rows[0]["first_count"].as_u64(), Some(2));
+
+    let second = send_ok(
+        &mut ctx.core,
+        &mut ctx.tx,
+        &mut ctx.rx,
+        grouped_count_plan("second_count"),
+    );
+    let second_rows = payload_value(&second);
+    assert_eq!(
+        second_rows[0]["second_count"].as_u64(),
+        Some(2),
+        "a cache hit must preserve the requesting query's output schema: {second_rows}"
+    );
+    assert!(second_rows[0].get("first_count").is_none());
+    assert!(second_rows[0].get("count(*)").is_none());
+}
+
+#[test]
+fn aggregate_cache_separates_computed_group_expressions() {
+    let mut ctx = make_ctx();
+    for (idx, department) in ["Alpha", "alpha"].into_iter().enumerate() {
+        let id = format!("computed-{idx}");
+        let doc = nodedb_types::json_to_msgpack(&serde_json::json!({
+            "id": id,
+            "department": department,
+        }))
+        .expect("encode document");
+        send_ok(
+            &mut ctx.core,
+            &mut ctx.tx,
+            &mut ctx.rx,
+            PhysicalPlan::Document(DocumentOp::PointPut {
+                collection: "cache_alias_users".into(),
+                document_id: id,
+                value: doc,
+                surrogate: nodedb_types::Surrogate::new((idx as u32) + 1),
+                pk_bytes: Vec::new(),
+            }),
+        );
+    }
+
+    let lower = payload_value(&send_ok(
+        &mut ctx.core,
+        &mut ctx.tx,
+        &mut ctx.rx,
+        computed_group_count_plan("lower"),
+    ));
+    assert_eq!(lower[0]["group_0"], "alpha");
+    assert_eq!(lower[0]["row_count"].as_u64(), Some(2));
+
+    let upper = payload_value(&send_ok(
+        &mut ctx.core,
+        &mut ctx.tx,
+        &mut ctx.rx,
+        computed_group_count_plan("upper"),
+    ));
+    assert_eq!(upper[0]["group_0"], "ALPHA");
+    assert_eq!(upper[0]["row_count"].as_u64(), Some(2));
+}
+
+#[test]
+fn aggregate_cache_separates_limit_and_sort_shape() {
+    let mut ctx = make_ctx();
+    let mut surrogate = 1u32;
+    for (department, count) in [("alpha", 1), ("beta", 2), ("gamma", 3)] {
+        for index in 0..count {
+            let id = format!("{department}-{index}");
+            let doc = nodedb_types::json_to_msgpack(&serde_json::json!({
+                "id": id,
+                "department": department,
+            }))
+            .expect("encode document");
+            send_ok(
+                &mut ctx.core,
+                &mut ctx.tx,
+                &mut ctx.rx,
+                PhysicalPlan::Document(DocumentOp::PointPut {
+                    collection: "cache_alias_users".into(),
+                    document_id: id,
+                    value: doc,
+                    surrogate: nodedb_types::Surrogate::new(surrogate),
+                    pk_bytes: Vec::new(),
+                }),
+            );
+            surrogate += 1;
+        }
+    }
+
+    let ascending = send_ok(
+        &mut ctx.core,
+        &mut ctx.tx,
+        &mut ctx.rx,
+        grouped_count_shape_plan("row_count", 1, vec![("row_count".into(), true)]),
+    );
+    let ascending_rows = payload_value(&ascending);
+    assert_eq!(ascending_rows.as_array().map(Vec::len), Some(1));
+    assert_eq!(ascending_rows[0]["row_count"].as_u64(), Some(1));
+
+    let descending = send_ok(
+        &mut ctx.core,
+        &mut ctx.tx,
+        &mut ctx.rx,
+        grouped_count_shape_plan("row_count", 2, vec![("row_count".into(), false)]),
+    );
+    let descending_rows = payload_value(&descending);
+    assert_eq!(descending_rows.as_array().map(Vec::len), Some(2));
+    assert_eq!(descending_rows[0]["row_count"].as_u64(), Some(3));
+    assert_eq!(descending_rows[1]["row_count"].as_u64(), Some(2));
+}
diff --git a/nodedb/tests/native_gateway_txn_overlay.rs b/nodedb/tests/native_gateway_txn_overlay.rs
index 855ca5159..524476fb9 100644
--- a/nodedb/tests/native_gateway_txn_overlay.rs
+++ b/nodedb/tests/native_gateway_txn_overlay.rs
@@ -213,3 +213,130 @@ async fn native_in_txn_sql_select_reads_own_write() {
         "ROLLBACK must hide the staged write, got: {after_rows:?}"
     );
 }
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+async fn native_commit_makes_strict_row_visible_to_every_read_path() {
+    let server = TestServer::start().await;
+    server
+        .exec(
+            "CREATE COLLECTION native_committed_visibility \
+             (id TEXT PRIMARY KEY, name TEXT) WITH (engine='document_strict')",
+        )
+        .await
+        .expect("create strict collection");
+
+    let mut stream = native_session(&server).await;
+    let begin = send_begin_opcode(&mut stream, 1).await;
+    assert_eq!(begin.status, ResponseStatus::Ok, "BEGIN: {begin:?}");
+
+    let insert = send_sql(
+        &mut stream,
+        2,
+        "INSERT INTO native_committed_visibility (id, name) VALUES ('a1', 'alpha')",
+    )
+    .await;
+    assert_eq!(insert.status, ResponseStatus::Ok, "INSERT: {insert:?}");
+
+    let commit = send_request(&mut stream, 3, OpCode::Commit, TextFields::default()).await;
+    assert_eq!(commit.status, ResponseStatus::Ok, "COMMIT: {commit:?}");
+    assert!(
+        server
+            .shared
+            .surrogate_assigner
+            .lookup(
+                nodedb_types::DatabaseId::DEFAULT,
+                nodedb_types::TenantId::new(1),
+                "native_committed_visibility",
+                b"a1",
+            )
+            .expect("lookup committed PK binding")
+            .is_some(),
+        "planning the transactional insert must publish the stable PK binding"
+    );
+
+    let point_read = send_sql(
+        &mut stream,
+        4,
+        "SELECT id FROM native_committed_visibility WHERE id = 'a1'",
+    )
+    .await;
+    assert_eq!(
+        point_read
+            .rows
+            .as_ref()
+            .and_then(|rows| rows.first())
+            .and_then(|row| row.first()),
+        Some(&Value::String("a1".into())),
+        "PK lookup must agree with the full scan after COMMIT: {point_read:?}"
+    );
+
+    let mut scan_session = native_session(&server).await;
+    let full_scan = send_sql(
+        &mut scan_session,
+        1,
+        "SELECT id FROM native_committed_visibility",
+    )
+    .await;
+    assert_eq!(
+        full_scan
+            .rows
+            .as_ref()
+            .and_then(|rows| rows.first())
+            .and_then(|row| row.first()),
+        Some(&Value::String("a1".into())),
+        "full scan control must see the durable row: {full_scan:?}"
+    );
+    let post_scan_point = send_sql(
+        &mut scan_session,
+        2,
+        "SELECT id FROM native_committed_visibility WHERE id = 'a1'",
+    )
+    .await;
+    assert_eq!(
+        post_scan_point.seq, 2,
+        "the harness must drain any extra scan frames before the next response"
+    );
+    assert_eq!(
+        post_scan_point
+            .rows
+            .as_ref()
+            .and_then(|rows| rows.first())
+            .and_then(|row| row.first()),
+        Some(&Value::String("a1".into())),
+        "same-session point lookup after a fan-out scan must not consume a stale frame"
+    );
+
+    let mut aggregate_session = native_session(&server).await;
+    let filtered_count = send_sql(
+        &mut aggregate_session,
+        1,
+        "SELECT count(*) FROM native_committed_visibility WHERE name = 'alpha'",
+    )
+    .await;
+    assert_eq!(
+        filtered_count
+            .rows
+            .as_ref()
+            .and_then(|rows| rows.first())
+            .and_then(|row| row.first()),
+        Some(&Value::Integer(1)),
+        "filtered aggregate must see the committed row: {filtered_count:?}"
+    );
+
+    let mut fresh = native_session(&server).await;
+    let fresh_point = send_sql(
+        &mut fresh,
+        1,
+        "SELECT id FROM native_committed_visibility WHERE id = 'a1'",
+    )
+    .await;
+    assert_eq!(
+        fresh_point
+            .rows
+            .as_ref()
+            .and_then(|rows| rows.first())
+            .and_then(|row| row.first()),
+        Some(&Value::String("a1".into())),
+        "committed PK visibility must survive connection boundaries: {fresh_point:?}"
+    );
+}
diff --git a/nodedb/tests/pg_catalog_regclass.rs b/nodedb/tests/pg_catalog_regclass.rs
new file mode 100644
index 000000000..4411cbfb1
--- /dev/null
+++ b/nodedb/tests/pg_catalog_regclass.rs
@@ -0,0 +1,138 @@
+// SPDX-License-Identifier: BUSL-1.1
+
+//! PostgreSQL-compatible `regclass` input and output semantics.
+
+mod common;
+
+use common::pgwire_harness::TestServer;
+
+#[tokio::test]
+async fn quoted_relation_name_resolves_like_the_unquoted_form() {
+    let srv = TestServer::start().await;
+    srv.exec(
+        "CREATE COLLECTION quoted_regclass_target \
+         (id BIGINT PRIMARY KEY, name TEXT DEFAULT 'x', qty INT) \
+         WITH (engine='document_strict')",
+    )
+    .await
+    .expect("create collection");
+
+    let mut bare = srv
+        .query_text(
+            "SELECT attname FROM pg_attribute \
+             WHERE attrelid = 'quoted_regclass_target'::regclass",
+        )
+        .await
+        .expect("bare regclass lookup");
+    let mut quoted = srv
+        .query_text(
+            "SELECT attname FROM pg_attribute \
+             WHERE attrelid = '\"quoted_regclass_target\"'::regclass",
+        )
+        .await
+        .expect("quoted regclass lookup");
+    bare.sort();
+    quoted.sort();
+
+    assert_eq!(bare, vec!["id", "name", "qty"]);
+    assert_eq!(
+        quoted, bare,
+        "identifier quotes inside a regclass string must be normalized before lookup"
+    );
+}
+
+#[tokio::test]
+async fn default_schema_qualifier_resolves_the_same_relation() {
+    let srv = TestServer::start().await;
+    srv.exec(
+        "CREATE COLLECTION qualified_regclass_target \
+         (id BIGINT PRIMARY KEY, name TEXT DEFAULT 'x', qty INT) \
+         WITH (engine='document_strict')",
+    )
+    .await
+    .expect("create collection");
+
+    let mut qualified = srv
+        .query_text(
+            "SELECT attname FROM pg_attribute \
+             WHERE attrelid = 'public.\"qualified_regclass_target\"'::regclass",
+        )
+        .await
+        .expect("schema-qualified regclass lookup");
+    qualified.sort();
+
+    assert_eq!(
+        qualified,
+        vec!["id", "name", "qty"],
+        "the default schema qualifier must resolve through the same relation identity"
+    );
+}
+
+#[tokio::test]
+async fn unknown_regclass_cast_reports_undefined_relation() {
+    let srv = TestServer::start().await;
+    srv.expect_error("SELECT 'missing_regclass_target'::regclass", "42P01")
+        .await;
+}
+
+#[tokio::test]
+async fn regclass_validation_covers_update_and_delete_filters() {
+    let srv = TestServer::start().await;
+    srv.exec("CREATE COLLECTION regclass_dml_target (id BIGINT PRIMARY KEY, value TEXT)")
+        .await
+        .expect("create collection");
+    srv.expect_error(
+        "UPDATE regclass_dml_target SET value = 'x' \
+         WHERE 'missing_update_relation'::regclass = 1",
+        "42P01",
+    )
+    .await;
+    srv.expect_error(
+        "DELETE FROM regclass_dml_target \
+         WHERE 'missing_delete_relation'::regclass = 1",
+        "42P01",
+    )
+    .await;
+}
+
+#[tokio::test]
+async fn regclass_validation_covers_projection_and_aggregate_expressions() {
+    let srv = TestServer::start().await;
+    srv.exec("CREATE COLLECTION regclass_expr_target (id BIGINT PRIMARY KEY)")
+        .await
+        .expect("create collection");
+    srv.expect_error(
+        "SELECT 'missing_projection_relation'::regclass FROM regclass_expr_target",
+        "42P01",
+    )
+    .await;
+    srv.expect_error(
+        "SELECT COUNT('missing_aggregate_relation'::regclass) FROM regclass_expr_target",
+        "42P01",
+    )
+    .await;
+}
+
+#[tokio::test]
+async fn direct_regclass_cast_renders_the_relation_name() {
+    let srv = TestServer::start().await;
+    srv.exec("CREATE COLLECTION rendered_regclass_target (id BIGINT PRIMARY KEY)")
+        .await
+        .expect("create collection");
+
+    let bare = srv
+        .query_text("SELECT 'rendered_regclass_target'::regclass")
+        .await
+        .expect("render bare regclass");
+    let quoted = srv
+        .query_text("SELECT '\"rendered_regclass_target\"'::regclass")
+        .await
+        .expect("render quoted regclass");
+
+    assert_eq!(bare, vec!["rendered_regclass_target"]);
+    assert_eq!(quoted, bare);
+    assert!(
+        bare.iter().all(|value| !value.is_empty()),
+        "resolved regclass values must never render as empty cells"
+    );
+}
diff --git a/nodedb/tests/tenant_drop_owned_objects.rs b/nodedb/tests/tenant_drop_owned_objects.rs
new file mode 100644
index 000000000..d9a22eb3a
--- /dev/null
+++ b/nodedb/tests/tenant_drop_owned_objects.rs
@@ -0,0 +1,171 @@
+// SPDX-License-Identifier: BUSL-1.1
+
+//! Tenant teardown must terminate ownership inside the tenant being removed.
+
+mod common;
+
+use common::pgwire_harness::TestServer;
+
+async fn assert_tenant_drop_removes_admin_owned_collection(retained: bool) {
+    let server = TestServer::start().await;
+    let tenant = if retained {
+        "retained_scope"
+    } else {
+        "active_scope"
+    };
+    let user = if retained {
+        "retained_owner"
+    } else {
+        "active_owner"
+    };
+    let collection = if retained {
+        "retained_tenant_notes"
+    } else {
+        "active_tenant_notes"
+    };
+    let admin = format!("{tenant}_admin");
+
+    server
+        .exec(&format!("CREATE TENANT {tenant}"))
+        .await
+        .expect("create tenant");
+    let tenant_id = server
+        .shared
+        .credentials
+        .catalog()
+        .find_tenant_by_name(tenant)
+        .expect("read tenant")
+        .expect("tenant exists")
+        .tenant_id;
+    server
+        .exec(&format!(
+            "CREATE USER {user} PASSWORD 'probe-secret-99' TENANT {tenant}"
+        ))
+        .await
+        .expect("create tenant user");
+    server
+        .exec(&format!("GRANT tenant_admin TO {user}"))
+        .await
+        .expect("grant tenant administration");
+
+    let (client, connection) = server
+        .connect_as(user, "probe-secret-99")
+        .await
+        .expect("connect as tenant owner");
+    client
+        .simple_query(&format!(
+            "CREATE COLLECTION {collection} (id TEXT PRIMARY KEY, body TEXT) \
+             WITH (engine='document_strict')"
+        ))
+        .await
+        .expect("create tenant collection");
+    if !retained {
+        client
+            .simple_query(&format!(
+                "CREATE RLS POLICY tenant_guard ON {collection} FOR READ USING (id = id)"
+            ))
+            .await
+            .expect("create collection-scoped RLS policy");
+    }
+    if retained {
+        client
+            .simple_query(&format!("DROP COLLECTION {collection}"))
+            .await
+            .expect("retain dropped collection tombstone");
+    }
+    drop(client);
+    connection.abort();
+
+    server
+        .exec(&format!("DROP USER {user}"))
+        .await
+        .expect("drop ordinary tenant owner");
+    assert!(
+        server
+            .shared
+            .credentials
+            .catalog()
+            .load_all_owners()
+            .expect("load owners")
+            .iter()
+            .any(|owner| {
+                owner.tenant_id == tenant_id
+                    && owner.object_name == collection
+                    && owner.owner_username == admin
+            }),
+        "the lifecycle administrator must inherit collection ownership before teardown"
+    );
+
+    server
+        .exec(&format!("DROP TENANT {tenant}"))
+        .await
+        .expect("tenant teardown must remove its terminal owner and owned objects");
+
+    assert!(
+        server
+            .shared
+            .credentials
+            .catalog()
+            .find_tenant_by_name(tenant)
+            .expect("read dropped tenant")
+            .is_none()
+    );
+    assert!(server.shared.credentials.get_user(&admin).is_none());
+    assert!(
+        server
+            .shared
+            .credentials
+            .catalog()
+            .load_all_rls_policies()
+            .expect("load RLS policies after tenant drop")
+            .iter()
+            .all(|policy| policy.tenant_id != tenant_id),
+        "tenant teardown must not leave collection policies behind"
+    );
+    assert!(
+        server
+            .shared
+            .credentials
+            .catalog()
+            .load_all_owners()
+            .expect("load owners after tenant drop")
+            .iter()
+            .all(|owner| owner.tenant_id != tenant_id),
+        "tenant teardown must not leave owner rows referencing the removed principal"
+    );
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+async fn drop_tenant_removes_active_objects_owned_by_its_lifecycle_admin() {
+    assert_tenant_drop_removes_admin_owned_collection(false).await;
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+async fn drop_tenant_removes_retained_objects_owned_by_its_lifecycle_admin() {
+    assert_tenant_drop_removes_admin_owned_collection(true).await;
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+async fn drop_tenant_rejects_transactional_buffering_without_side_effects() {
+    let server = TestServer::start().await;
+    server
+        .exec("CREATE TENANT rollback_scope")
+        .await
+        .expect("create tenant");
+    let error = server
+        .exec("BEGIN; DROP TENANT rollback_scope")
+        .await
+        .expect_err("tenant teardown must not enter the generic DDL buffer");
+    assert!(error.contains("0A000"), "unexpected error: {error}");
+    server.exec("ROLLBACK").await.expect("rollback transaction");
+    assert!(
+        server
+            .shared
+            .credentials
+            .catalog()
+            .find_tenant_by_name("rollback_scope")
+            .expect("read tenant")
+            .is_some(),
+        "rejected transactional teardown must leave tenant state untouched"
+    );
+}

From a94e362d4a474f04cdedc7300ab0e0086db256c3 Mon Sep 17 00:00:00 2001
From: Farhan Syah <bizimpulse@gmail.com>
Date: Tue, 21 Jul 2026 15:32:56 +0800
Subject: [PATCH 02/10] fix(graph): record edge undo entries only after durable
 writes, share redo payload structs

Undo entries for edge put/delete were pushed before the edge-store
write completed, so a rejected insert (e.g. to a soft-deleted node) or
a failed store write left a phantom compensation entry that would
soft-delete or re-insert an edge that never existed on rollback.
Compensation is now recorded inside execute_edge_put_with_undo /
execute_edge_delete_with_undo, immediately after the edge-store version
is durable and before the fallible CSR mutation.

Also replace the positional-tuple encoding of edge put/delete redo
payloads with named EdgePutRedo/EdgeDeleteRedo structs (map-encoded via
zerompk 0.6) shared by every encode/decode site, removing the
hand-maintained fallback-tuple decode that could silently drift out of
sync with the encoder.
---
 Cargo.lock                                    |  22 ++--
 Cargo.toml                                    |   2 +-
 nodedb/src/data/executor/core_loop/tests.rs   |  17 +++
 nodedb/src/data/executor/handlers/graph.rs    |   2 +-
 .../executor/handlers/graph_edge_write.rs     | 119 ++++++++++++++++++
 .../handlers/transaction/resolve/entry.rs     |  56 +++++----
 .../handlers/transaction/resolve/graph.rs     |  97 +++++++-------
 .../handlers/transaction/sub_plan_write.rs    |  63 +++-------
 .../handlers/transaction/undo/tests.rs        |  50 ++++++++
 .../data/executor/wal_replay_redo_graph.rs    |  91 +++++---------
 nodedb/src/wal/mod.rs                         |   2 +-
 nodedb/src/wal/redo/mod.rs                    |   2 +-
 nodedb/src/wal/redo/record.rs                 |  67 ++++++++++
 13 files changed, 400 insertions(+), 190 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 95b9d0e65..6b01ae303 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -2165,7 +2165,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
 dependencies = [
  "libc",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -5591,7 +5591,7 @@ dependencies = [
  "once_cell",
  "socket2",
  "tracing",
- "windows-sys 0.52.0",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
@@ -6218,7 +6218,7 @@ dependencies = [
  "errno",
  "libc",
  "linux-raw-sys",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -6286,7 +6286,7 @@ dependencies = [
  "security-framework",
  "security-framework-sys",
  "webpki-root-certs",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -6937,10 +6937,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd"
 dependencies = [
  "fastrand",
- "getrandom 0.3.4",
+ "getrandom 0.4.2",
  "once_cell",
  "rustix",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -8100,7 +8100,7 @@ version = "0.1.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22"
 dependencies = [
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -8597,18 +8597,18 @@ dependencies = [
 
 [[package]]
 name = "zerompk"
-version = "0.5.0"
+version = "0.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6ed7119bccd8297686328e73233a8c839645e742e16c2b8e94a48bda9f118729"
+checksum = "147801aff255b90229e978171d3911c19b07214e9c808e6d2155b90094748dbf"
 dependencies = [
  "zerompk_derive",
 ]
 
 [[package]]
 name = "zerompk_derive"
-version = "0.5.0"
+version = "0.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4cec68b6d21b4d29083199a2b2f42fb23712cfdf3bdb221b86c2485c6b6c4248"
+checksum = "0a314420de412a9e7337bb7fc1ab7797902b1e6cd41cc485d240f60116e4184d"
 dependencies = [
  "proc-macro2",
  "quote",
diff --git a/Cargo.toml b/Cargo.toml
index 284e6a090..c6c1bd143 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -164,7 +164,7 @@ chrono = { version = "0.4", features = ["std"], default-features = false }
 
 # MessagePack
 rmpv = "1"
-zerompk = { version = "0.5", features = ["std", "derive"] }
+zerompk = { version = "0.6", features = ["std", "derive"] }
 
 # Bitmap
 roaring = "0.11"
diff --git a/nodedb/src/data/executor/core_loop/tests.rs b/nodedb/src/data/executor/core_loop/tests.rs
index fdaa1a42d..1c3042765 100644
--- a/nodedb/src/data/executor/core_loop/tests.rs
+++ b/nodedb/src/data/executor/core_loop/tests.rs
@@ -45,6 +45,23 @@ pub fn make_core_with_dir(
     (core, req_tx, resp_rx)
 }
 
+/// A minimal `ExecutionTask` (DEFAULT database/tenant, vShard 0, no WAL LSN)
+/// for handler unit tests that only read `request.database_id`. The carried
+/// plan is inert — edge/point handlers take their parameters directly.
+pub fn make_default_task() -> crate::data::executor::task::ExecutionTask {
+    crate::data::executor::task::ExecutionTask::new(make_request(PhysicalPlan::Document(
+        DocumentOp::PointGet {
+            collection: "x".into(),
+            document_id: "y".into(),
+            surrogate: Surrogate::ZERO,
+            pk_bytes: Vec::new(),
+            rls_filters: Vec::new(),
+            system_time: nodedb_types::SystemTimeScope::Current,
+            valid_at_ms: None,
+        },
+    )))
+}
+
 fn make_request(plan: PhysicalPlan) -> Request {
     Request {
         request_id: RequestId::new(1),
diff --git a/nodedb/src/data/executor/handlers/graph.rs b/nodedb/src/data/executor/handlers/graph.rs
index 6f36a8faf..d349c049e 100644
--- a/nodedb/src/data/executor/handlers/graph.rs
+++ b/nodedb/src/data/executor/handlers/graph.rs
@@ -33,7 +33,7 @@ pub(in crate::data::executor) mod graph_traversal;
 #[path = "graph_txn_merge.rs"]
 pub(in crate::data::executor) mod graph_txn_merge;
 
-pub(in crate::data::executor) use graph_edge_write::EdgePutParams;
+pub(in crate::data::executor) use graph_edge_write::{EdgeDeleteParams, EdgePutParams};
 
 use graph_txn_merge::merge_graph_txn_overlay_neighbors;
 
diff --git a/nodedb/src/data/executor/handlers/graph_edge_write.rs b/nodedb/src/data/executor/handlers/graph_edge_write.rs
index 26a9c0c4b..afe6926f9 100644
--- a/nodedb/src/data/executor/handlers/graph_edge_write.rs
+++ b/nodedb/src/data/executor/handlers/graph_edge_write.rs
@@ -34,11 +34,38 @@ pub(in crate::data::executor) struct EdgePutParams<'a> {
     pub dst_surrogate: nodedb_types::Surrogate,
 }
 
+/// Bundled arguments for [`CoreLoop::execute_edge_delete`].
+pub(in crate::data::executor) struct EdgeDeleteParams<'a> {
+    pub tid: u64,
+    pub collection: &'a str,
+    pub src_id: &'a str,
+    pub label: &'a str,
+    pub dst_id: &'a str,
+}
+
 impl CoreLoop {
     pub(in crate::data::executor) fn execute_edge_put(
         &mut self,
         task: &ExecutionTask,
         params: EdgePutParams<'_>,
+    ) -> Response {
+        self.execute_edge_put_with_undo(task, params, None)
+    }
+
+    /// Edge upsert with optional transactional compensation.
+    ///
+    /// When `undo` is `Some`, the `UndoEntry::PutEdge` is recorded at the one
+    /// correct point: *after* the edge-store version is durably written and
+    /// *before* the fallible CSR mutation. Recording it earlier (before the
+    /// dangling-endpoint validation or the edge-store write) would leave a
+    /// compensation entry for an operation that never touched storage — on
+    /// rollback that entry would soft-delete or re-insert a version that never
+    /// existed, corrupting bitemporal edge history.
+    pub(in crate::data::executor) fn execute_edge_put_with_undo(
+        &mut self,
+        task: &ExecutionTask,
+        params: EdgePutParams<'_>,
+        undo: Option<&mut Vec<crate::data::executor::handlers::transaction::undo::UndoEntry>>,
     ) -> Response {
         let EdgePutParams {
             tid,
@@ -70,6 +97,23 @@ impl CoreLoop {
             );
         }
 
+        // Capture the pre-image only when a compensation record is requested.
+        let old_properties = if undo.is_some() {
+            self.edge_store
+                .get_edge(
+                    database_id,
+                    TenantId::new(tid),
+                    collection,
+                    src_id,
+                    label,
+                    dst_id,
+                )
+                .ok()
+                .flatten()
+        } else {
+            None
+        };
+
         let ord = self
             .active_graph_system_from
             .unwrap_or_else(|| self.hlc.next_ordinal());
@@ -98,6 +142,19 @@ impl CoreLoop {
             owns_logical_edge_stats(task, src_id),
         ) {
             Ok(()) => {
+                // Edge-store version is now durable; the compensation entry is
+                // valid from here on even if the CSR mutation below fails.
+                if let Some(undo) = undo {
+                    undo.push(
+                        crate::data::executor::handlers::transaction::undo::UndoEntry::PutEdge {
+                            collection: collection.to_string(),
+                            src_id: src_id.to_string(),
+                            label: label.to_string(),
+                            dst_id: dst_id.to_string(),
+                            old_properties,
+                        },
+                    );
+                }
                 let weight = crate::engine::graph::csr::extract_weight_from_properties(properties);
                 let partition = self.csr_partition_mut(database_id, tid);
                 let csr_result = if weight != 1.0 {
@@ -328,8 +385,58 @@ impl CoreLoop {
         label: &str,
         dst_id: &str,
     ) -> Response {
+        self.execute_edge_delete_with_undo(
+            task,
+            EdgeDeleteParams {
+                tid,
+                collection,
+                src_id,
+                label,
+                dst_id,
+            },
+            None,
+        )
+    }
+
+    /// Edge delete with optional transactional compensation.
+    ///
+    /// The `UndoEntry::DeleteEdge` is recorded only when a live pre-image
+    /// existed *and* the tombstone was durably written — never speculatively
+    /// before the write. A phantom entry would otherwise re-insert an edge that
+    /// was never deleted when the surrounding transaction rolls back.
+    pub(in crate::data::executor) fn execute_edge_delete_with_undo(
+        &mut self,
+        task: &ExecutionTask,
+        params: EdgeDeleteParams<'_>,
+        undo: Option<&mut Vec<crate::data::executor::handlers::transaction::undo::UndoEntry>>,
+    ) -> Response {
+        let EdgeDeleteParams {
+            tid,
+            collection,
+            src_id,
+            label,
+            dst_id,
+        } = params;
         debug!(core = self.core_id, tid, %collection, %src_id, %label, %dst_id, "edge delete");
         let database_id = task.request.database_id.as_u64();
+
+        // Capture the pre-image only when a compensation record is requested.
+        let old_properties = if undo.is_some() {
+            self.edge_store
+                .get_edge(
+                    database_id,
+                    TenantId::new(tid),
+                    collection,
+                    src_id,
+                    label,
+                    dst_id,
+                )
+                .ok()
+                .flatten()
+        } else {
+            None
+        };
+
         let ord = self
             .active_graph_system_from
             .unwrap_or_else(|| self.hlc.next_ordinal());
@@ -347,6 +454,18 @@ impl CoreLoop {
             owns_logical_edge_stats(task, src_id),
         ) {
             Ok(_) => {
+                // Tombstone is durable; record the compensation for a rollback.
+                if let (Some(undo), Some(props)) = (undo, old_properties) {
+                    undo.push(
+                        crate::data::executor::handlers::transaction::undo::UndoEntry::DeleteEdge {
+                            collection: collection.to_string(),
+                            src_id: src_id.to_string(),
+                            label: label.to_string(),
+                            dst_id: dst_id.to_string(),
+                            old_properties: props,
+                        },
+                    );
+                }
                 let partition = self.csr_partition_mut(database_id, tid);
                 partition.remove_edge_in_collection(src_id, label, dst_id, collection);
                 self.checkpoint_coordinator.mark_dirty("sparse", 1);
diff --git a/nodedb/src/data/executor/handlers/transaction/resolve/entry.rs b/nodedb/src/data/executor/handlers/transaction/resolve/entry.rs
index 146c6ada4..2dc3540a3 100644
--- a/nodedb/src/data/executor/handlers/transaction/resolve/entry.rs
+++ b/nodedb/src/data/executor/handlers/transaction/resolve/entry.rs
@@ -1818,20 +1818,23 @@ mod tests {
         assert_eq!(redo.ops.len(), 1, "one staged edge put -> one sub-record");
         assert_eq!(redo.ops[0].record_type, RecordType::Put as u32);
 
-        let (collection, src_id, label, dst_id, properties, src_sur, dst_sur, system_from) =
-            zerompk::from_msgpack::<(String, String, String, String, Vec<u8>, u32, u32, i64)>(
-                &redo.ops[0].payload,
-            )
-            .expect("decode edge put tuple");
-        assert_eq!(collection, "g");
-        assert_eq!(src_id, "a");
-        assert_eq!(label, "knows");
-        assert_eq!(dst_id, "b");
-        assert_eq!(properties, vec![9, 9]);
-        assert_eq!(src_sur, 10, "src surrogate must come from the plan node");
-        assert_eq!(dst_sur, 20, "dst surrogate must come from the plan node");
+        let decoded = zerompk::from_msgpack::<crate::wal::EdgePutRedo>(&redo.ops[0].payload)
+            .expect("decode edge put redo");
+        assert_eq!(decoded.collection, "g");
+        assert_eq!(decoded.src_id, "a");
+        assert_eq!(decoded.label, "knows");
+        assert_eq!(decoded.dst_id, "b");
+        assert_eq!(decoded.properties, vec![9, 9]);
+        assert_eq!(
+            decoded.src_surrogate, 10,
+            "src surrogate must come from the plan node"
+        );
+        assert_eq!(
+            decoded.dst_surrogate, 20,
+            "dst surrogate must come from the plan node"
+        );
         assert!(
-            system_from > 0,
+            decoded.system_from.is_some_and(|s| s > 0),
             "resolve must freeze a real graph system-time ordinal"
         );
 
@@ -1909,17 +1912,23 @@ mod tests {
         assert_eq!(redo.ops.len(), 1);
         assert_eq!(redo.ops[0].record_type, RecordType::Delete as u32);
 
-        let (collection, src_id, label, dst_id, system_from) =
-            zerompk::from_msgpack::<(String, String, String, String, i64)>(&redo.ops[0].payload)
-                .expect("decode timestamped edge delete tuple");
-        assert_eq!(collection, "g");
-        assert_eq!(src_id, "a");
-        assert_eq!(label, "knows");
-        assert_eq!(dst_id, "b");
-        assert!(system_from > 0);
-
-        // Seed the edge in a fresh core, then replay the delete removes it.
+        let decoded = zerompk::from_msgpack::<crate::wal::EdgeDeleteRedo>(&redo.ops[0].payload)
+            .expect("decode timestamped edge delete redo");
+        assert_eq!(decoded.collection, "g");
+        assert_eq!(decoded.src_id, "a");
+        assert_eq!(decoded.label, "knows");
+        assert_eq!(decoded.dst_id, "b");
+        assert!(decoded.system_from.is_some_and(|s| s > 0));
+
+        // Seed the pre-existing edge in a fresh core at a system-time ordinal
+        // EARLIER than the delete's frozen `system_from`. In production the
+        // edge's own (earlier) put is replayed before the delete, so the
+        // tombstone is the newer version and hides it; freezing the seed here
+        // reproduces that ordering rather than stamping the seed with a fresh
+        // `next_ordinal` that would (incorrectly) post-date the tombstone.
         let (mut dst_core, _dst_dir) = make_core();
+        dst_core.active_graph_system_from =
+            Some(decoded.system_from.expect("delete froze a system_from") - 1);
         dst_core.execute_edge_put(
             &task,
             EdgePutParams {
@@ -1933,6 +1942,7 @@ mod tests {
                 dst_surrogate: Surrogate::new(2),
             },
         );
+        dst_core.active_graph_system_from = None;
         assert_eq!(
             dst_core
                 .edge_store
diff --git a/nodedb/src/data/executor/handlers/transaction/resolve/graph.rs b/nodedb/src/data/executor/handlers/transaction/resolve/graph.rs
index 2f99ce97e..c5eb0f20b 100644
--- a/nodedb/src/data/executor/handlers/transaction/resolve/graph.rs
+++ b/nodedb/src/data/executor/handlers/transaction/resolve/graph.rs
@@ -8,12 +8,16 @@
 //! autocommit graph WAL path produces, extended with the two endpoint
 //! surrogates a redo PUT carries and an autocommit PUT does not:
 //!
-//! * A staged edge put → `RecordType::Put`, `(collection, src_id, label,
-//!   dst_id, properties, src_surrogate, dst_surrogate, system_from)`. Replay's
-//!   `execute_edge_put` repopulates the CSR node→surrogate map from the two
-//!   trailing surrogates, so they must be present and correct.
-//! * A staged edge tombstone → `RecordType::Delete`, `(collection, src_id,
-//!   label, dst_id)`. `execute_edge_delete` needs no surrogate.
+//! * A staged edge put → `RecordType::Put`, payload
+//!   [`crate::wal::EdgePutRedo`]. Replay's `execute_edge_put` repopulates the
+//!   CSR node→surrogate map from the two endpoint surrogates, so they must be
+//!   present and correct.
+//! * A staged edge tombstone → `RecordType::Delete`, payload
+//!   [`crate::wal::EdgeDeleteRedo`]. `execute_edge_delete` needs no surrogate.
+//!
+//! Both payloads are named structs shared by every encode/decode site (a single
+//! definition, not a positional tuple re-declared per site) so the field set is
+//! a compile-time invariant that cannot silently drift in arity.
 //!
 //! ## Where the endpoint surrogates come from
 //!
@@ -119,16 +123,16 @@ pub(super) fn serialize_graph_collection(
                          has no bound endpoint surrogates"
                 ),
             })?;
-        let payload = zerompk::to_msgpack_vec(&(
-            collection,
-            src.as_str(),
-            label.as_str(),
-            dst.as_str(),
-            properties,
+        let payload = zerompk::to_msgpack_vec(&crate::wal::EdgePutRedo {
+            collection: collection.to_string(),
+            src_id: src.clone(),
+            label: label.clone(),
+            dst_id: dst.clone(),
+            properties: properties.clone(),
             src_surrogate,
             dst_surrogate,
-            system_from,
-        ))
+            system_from: Some(system_from),
+        })
         .map_err(|e| crate::Error::Serialization {
             format: "msgpack".into(),
             detail: format!("graph resolve edge put: {e}"),
@@ -140,13 +144,13 @@ pub(super) fn serialize_graph_collection(
     }
 
     for (src, label, dst) in deletes {
-        let payload = zerompk::to_msgpack_vec(&(
-            collection,
-            src.as_str(),
-            label.as_str(),
-            dst.as_str(),
-            system_from,
-        ))
+        let payload = zerompk::to_msgpack_vec(&crate::wal::EdgeDeleteRedo {
+            collection: collection.to_string(),
+            src_id: src.clone(),
+            label: label.clone(),
+            dst_id: dst.clone(),
+            system_from: Some(system_from),
+        })
         .map_err(|e| crate::Error::Serialization {
             format: "msgpack".into(),
             detail: format!("graph resolve edge delete: {e}"),
@@ -340,19 +344,16 @@ mod tests {
         assert_eq!(ops.len(), 1);
         assert_eq!(ops[0].record_type, RecordType::Put as u32);
 
-        let (collection, src, label, dst, properties, src_sur, dst_sur, system_from) =
-            zerompk::from_msgpack::<(String, String, String, String, Vec<u8>, u32, u32, i64)>(
-                &ops[0].payload,
-            )
-            .expect("decode edge put tuple");
-        assert_eq!(collection, "g");
-        assert_eq!(src, "a");
-        assert_eq!(label, "knows");
-        assert_eq!(dst, "b");
-        assert_eq!(properties, vec![1, 2, 3]);
-        assert_eq!(src_sur, 10);
-        assert_eq!(dst_sur, 20);
-        assert_eq!(system_from, 123);
+        let decoded = zerompk::from_msgpack::<crate::wal::EdgePutRedo>(&ops[0].payload)
+            .expect("decode edge put redo");
+        assert_eq!(decoded.collection, "g");
+        assert_eq!(decoded.src_id, "a");
+        assert_eq!(decoded.label, "knows");
+        assert_eq!(decoded.dst_id, "b");
+        assert_eq!(decoded.properties, vec![1, 2, 3]);
+        assert_eq!(decoded.src_surrogate, 10);
+        assert_eq!(decoded.dst_surrogate, 20);
+        assert_eq!(decoded.system_from, Some(123));
     }
 
     #[test]
@@ -371,7 +372,7 @@ mod tests {
     }
 
     #[test]
-    fn edge_delete_emits_four_element_tuple() {
+    fn edge_delete_emits_timestamped_redo() {
         let mut overlay = GraphTxnOverlay::new();
         overlay.stage_edge_delete(coll_key("g"), "a", "knows", "b");
 
@@ -382,13 +383,17 @@ mod tests {
         assert_eq!(ops.len(), 1);
         assert_eq!(ops[0].record_type, RecordType::Delete as u32);
 
-        let (collection, src, label, dst) =
-            zerompk::from_msgpack::<(String, String, String, String)>(&ops[0].payload)
-                .expect("decode edge delete tuple");
-        assert_eq!(collection, "g");
-        assert_eq!(src, "a");
-        assert_eq!(label, "knows");
-        assert_eq!(dst, "b");
+        let decoded = zerompk::from_msgpack::<crate::wal::EdgeDeleteRedo>(&ops[0].payload)
+            .expect("decode edge delete redo");
+        assert_eq!(decoded.collection, "g");
+        assert_eq!(decoded.src_id, "a");
+        assert_eq!(decoded.label, "knows");
+        assert_eq!(decoded.dst_id, "b");
+        assert_eq!(
+            decoded.system_from,
+            Some(123),
+            "delete must carry the frozen system-time ordinal for deterministic replay"
+        );
     }
 
     #[test]
@@ -417,11 +422,9 @@ mod tests {
         let srcs: Vec<String> = ops
             .iter()
             .map(|op| {
-                zerompk::from_msgpack::<(String, String, String, String, Vec<u8>, u32, u32, i64)>(
-                    &op.payload,
-                )
-                .expect("decode")
-                .1
+                zerompk::from_msgpack::<crate::wal::EdgePutRedo>(&op.payload)
+                    .expect("decode")
+                    .src_id
             })
             .collect();
         assert_eq!(srcs, vec!["a", "b", "c"], "src-id ascending order");
diff --git a/nodedb/src/data/executor/handlers/transaction/sub_plan_write.rs b/nodedb/src/data/executor/handlers/transaction/sub_plan_write.rs
index 1ebf2bbe6..a2ade7936 100644
--- a/nodedb/src/data/executor/handlers/transaction/sub_plan_write.rs
+++ b/nodedb/src/data/executor/handlers/transaction/sub_plan_write.rs
@@ -155,30 +155,13 @@ impl CoreLoop {
             dst_surrogate,
         } = params;
 
-        let old_properties = self
-            .edge_store
-            .get_edge(
-                dummy_task.request.database_id.as_u64(),
-                nodedb_types::TenantId::new(tid),
-                collection,
-                src_id,
-                label,
-                dst_id,
-            )
-            .ok()
-            .flatten();
-
-        // Record compensation before the two-store mutation begins. The edge
-        // store is updated before CSR, so a CSR failure must still leave an
-        // undo entry for the already-written edge version/stat counters.
-        undo_log.push(UndoEntry::PutEdge {
-            collection: collection.to_string(),
-            src_id: src_id.to_string(),
-            label: label.to_string(),
-            dst_id: dst_id.to_string(),
-            old_properties,
-        });
-        let resp = self.execute_edge_put(
+        // The compensation entry is recorded inside `execute_edge_put_with_undo`
+        // at the only safe point — after the edge-store version is durably
+        // written and before the fallible CSR mutation. Recording it here, up
+        // front, would leave a phantom undo entry when dangling-endpoint
+        // validation or the edge-store write itself rejects, corrupting
+        // bitemporal history on rollback.
+        let resp = self.execute_edge_put_with_undo(
             dummy_task,
             crate::data::executor::handlers::graph::EdgePutParams {
                 tid,
@@ -190,6 +173,7 @@ impl CoreLoop {
                 src_surrogate,
                 dst_surrogate,
             },
+            Some(undo_log),
         );
         if resp.status == Status::Error {
             return Err(resp.error_code.map(|c| *c).unwrap_or(ErrorCode::Internal {
@@ -213,29 +197,22 @@ impl CoreLoop {
             label,
             dst_id,
         } = params;
-        let old_properties = self
-            .edge_store
-            .get_edge(
-                dummy_task.request.database_id.as_u64(),
-                nodedb_types::TenantId::new(tid),
+
+        // Compensation is recorded inside `execute_edge_delete_with_undo` only
+        // after the tombstone is durably written (and only when a live
+        // pre-image existed), so a rejected/failed delete leaves no phantom
+        // re-insert entry behind.
+        let resp = self.execute_edge_delete_with_undo(
+            dummy_task,
+            crate::data::executor::handlers::graph::EdgeDeleteParams {
+                tid,
                 collection,
                 src_id,
                 label,
                 dst_id,
-            )
-            .ok()
-            .flatten();
-
-        if let Some(props) = old_properties {
-            undo_log.push(UndoEntry::DeleteEdge {
-                collection: collection.to_string(),
-                src_id: src_id.to_string(),
-                label: label.to_string(),
-                dst_id: dst_id.to_string(),
-                old_properties: props,
-            });
-        }
-        let resp = self.execute_edge_delete(dummy_task, tid, collection, src_id, label, dst_id);
+            },
+            Some(undo_log),
+        );
         if resp.status == Status::Error {
             return Err(resp.error_code.map(|c| *c).unwrap_or(ErrorCode::Internal {
                 detail: "edge delete failed".into(),
diff --git a/nodedb/src/data/executor/handlers/transaction/undo/tests.rs b/nodedb/src/data/executor/handlers/transaction/undo/tests.rs
index e49e84919..0c688520a 100644
--- a/nodedb/src/data/executor/handlers/transaction/undo/tests.rs
+++ b/nodedb/src/data/executor/handlers/transaction/undo/tests.rs
@@ -838,6 +838,56 @@ fn graph_edge_update_undo_restores_csr_weight() {
     );
 }
 
+#[test]
+fn tx_edge_put_to_deleted_node_records_no_phantom_undo() {
+    use crate::bridge::envelope::Status;
+    use crate::data::executor::core_loop::tests::make_default_task;
+
+    let dir = tempfile::tempdir().unwrap();
+    let (mut core, _tx, _rx) = make_core_with_dir(dir.path());
+    let tenant = TenantId::new(TID);
+
+    // The destination node is soft-deleted, so the edge insert is rejected by
+    // `execute_edge_put`'s dangling-endpoint validation BEFORE any store write.
+    core.mark_node_deleted(DB, TID, "bob");
+
+    let task = make_default_task();
+    let mut undo_log: Vec<UndoEntry> = Vec::new();
+    let resp = core.execute_edge_put_with_undo(
+        &task,
+        crate::data::executor::handlers::graph::EdgePutParams {
+            tid: TID,
+            collection: "c",
+            src_id: "alice",
+            label: "KNOWS",
+            dst_id: "bob",
+            properties: b"p1",
+            src_surrogate: nodedb_types::Surrogate::ZERO,
+            dst_surrogate: nodedb_types::Surrogate::ZERO,
+        },
+        Some(&mut undo_log),
+    );
+
+    assert_eq!(
+        resp.status,
+        Status::Error,
+        "an edge insert to a deleted node must be rejected"
+    );
+    assert!(
+        undo_log.is_empty(),
+        "a rejected insert must record NO compensation entry; a phantom PutEdge \
+         undo would soft-delete a never-written edge on rollback, corrupting \
+         bitemporal history"
+    );
+    assert!(
+        core.edge_store
+            .get_edge(DB, tenant, "c", "alice", "KNOWS", "bob")
+            .unwrap()
+            .is_none(),
+        "the rejected insert must not have written any edge version"
+    );
+}
+
 // ── Column-stats undo ─────────────────────────────────────────────────────────
 
 fn stats_key_str() -> String {
diff --git a/nodedb/src/data/executor/wal_replay_redo_graph.rs b/nodedb/src/data/executor/wal_replay_redo_graph.rs
index fd0e19899..81bab087c 100644
--- a/nodedb/src/data/executor/wal_replay_redo_graph.rs
+++ b/nodedb/src/data/executor/wal_replay_redo_graph.rs
@@ -74,50 +74,20 @@ impl CoreLoop {
             let record_lsn = record.header.lsn;
 
             if is_put {
-                let decoded = zerompk::from_msgpack::<(
-                    String,
-                    String,
-                    String,
-                    String,
-                    Vec<u8>,
-                    u32,
-                    u32,
-                    i64,
-                )>(&record.payload)
-                .map(
-                    |(collection, src, label, dst, props, src_sur, dst_sur, system_from)| {
-                        (
-                            collection,
-                            src,
-                            label,
-                            dst,
-                            props,
-                            src_sur,
-                            dst_sur,
-                            Some(system_from),
-                        )
-                    },
-                )
-                .or_else(|_| {
-                    zerompk::from_msgpack::<(String, String, String, String, Vec<u8>, u32, u32)>(
-                        &record.payload,
-                    )
-                    .map(
-                        |(collection, src, label, dst, props, src_sur, dst_sur)| {
-                            (collection, src, label, dst, props, src_sur, dst_sur, None)
-                        },
-                    )
-                });
-                let Ok((
+                // One struct decodes both the current record and any legacy
+                // record predating `system_from` (tolerant array decode →
+                // `None`), so there is no hand-maintained fallback tuple to
+                // drift out of sync with the encoder.
+                let Ok(crate::wal::EdgePutRedo {
                     collection,
                     src_id,
                     label,
                     dst_id,
                     properties,
-                    src_sur,
-                    dst_sur,
+                    src_surrogate: src_sur,
+                    dst_surrogate: dst_sur,
                     system_from,
-                )) = decoded
+                }) = zerompk::from_msgpack::<crate::wal::EdgePutRedo>(&record.payload)
                 else {
                     continue;
                 };
@@ -170,20 +140,17 @@ impl CoreLoop {
                     );
                 }
             } else {
-                let decoded =
-                    zerompk::from_msgpack::<(String, String, String, String, i64)>(&record.payload)
-                        .map(|(collection, src, label, dst, system_from)| {
-                            (collection, src, label, dst, Some(system_from))
-                        })
-                        .or_else(|_| {
-                            zerompk::from_msgpack::<(String, String, String, String)>(
-                                &record.payload,
-                            )
-                            .map(|(collection, src, label, dst)| {
-                                (collection, src, label, dst, None)
-                            })
-                        });
-                let Ok((collection, src_id, label, dst_id, system_from)) = decoded else {
+                // One struct decodes both the current record and any legacy
+                // record predating `system_from` (tolerant array decode →
+                // `None`), so there is no hand-maintained fallback tuple.
+                let Ok(crate::wal::EdgeDeleteRedo {
+                    collection,
+                    src_id,
+                    label,
+                    dst_id,
+                    system_from,
+                }) = zerompk::from_msgpack::<crate::wal::EdgeDeleteRedo>(&record.payload)
+                else {
                     continue;
                 };
                 if tombstones.is_tombstoned(
@@ -371,16 +338,16 @@ mod tests {
     }
 
     fn edge_put_sub(collection: &str, src: &str, label: &str, dst: &str) -> RedoSubRecord {
-        let payload = zerompk::to_msgpack_vec(&(
-            collection,
-            src,
-            label,
-            dst,
-            b"".as_slice(),
-            10u32,
-            20u32,
-            nodedb_types::ms_to_ordinal_upper(100),
-        ))
+        let payload = zerompk::to_msgpack_vec(&crate::wal::EdgePutRedo {
+            collection: collection.to_string(),
+            src_id: src.to_string(),
+            label: label.to_string(),
+            dst_id: dst.to_string(),
+            properties: Vec::new(),
+            src_surrogate: 10,
+            dst_surrogate: 20,
+            system_from: Some(nodedb_types::ms_to_ordinal_upper(100)),
+        })
         .expect("encode edge put sub-record");
         RedoSubRecord {
             record_type: RecordType::Put as u32,
diff --git a/nodedb/src/wal/mod.rs b/nodedb/src/wal/mod.rs
index f441c2018..6eda15abe 100644
--- a/nodedb/src/wal/mod.rs
+++ b/nodedb/src/wal/mod.rs
@@ -15,7 +15,7 @@ pub(crate) use crdt_doc_payload::CrdtDocOpWalRecord;
 pub(crate) use crdt_list_payload::CrdtListOpWalRecord;
 pub(crate) use crdt_payload::CrdtDeltaWalPayload;
 pub use manager::WalManager;
-pub use redo::{CalvinStamp, RedoRecord, RedoSubRecord};
+pub use redo::{CalvinStamp, EdgeDeleteRedo, EdgePutRedo, RedoRecord, RedoSubRecord};
 pub use replay::SyncHwmReplayMaps;
 pub use replay::SyncHwmReplayStats;
 pub use replay::replay_surrogate_records;
diff --git a/nodedb/src/wal/redo/mod.rs b/nodedb/src/wal/redo/mod.rs
index e6c1cbbeb..8a1eceaf3 100644
--- a/nodedb/src/wal/redo/mod.rs
+++ b/nodedb/src/wal/redo/mod.rs
@@ -3,4 +3,4 @@
 pub mod record;
 pub mod replay;
 
-pub use record::{CalvinStamp, RedoRecord, RedoSubRecord};
+pub use record::{CalvinStamp, EdgeDeleteRedo, EdgePutRedo, RedoRecord, RedoSubRecord};
diff --git a/nodedb/src/wal/redo/record.rs b/nodedb/src/wal/redo/record.rs
index 6c9ab7845..77f85f61f 100644
--- a/nodedb/src/wal/redo/record.rs
+++ b/nodedb/src/wal/redo/record.rs
@@ -91,6 +91,73 @@ pub struct CalvinStamp {
     pub vshard_id: u32,
 }
 
+/// Redo sub-record payload for a graph edge upsert — the payload bytes of a
+/// [`RecordType::Put`](nodedb_wal::record::RecordType::Put) sub-record inside a
+/// graph `RedoRecord`.
+///
+/// One shared definition for every encode and decode site so the field set is a
+/// compile-time invariant. This replaced a positional tuple that silently
+/// drifted in arity across its ~half-dozen encode/decode sites — appending a
+/// field there produced runtime `ArrayLengthMismatch` (or a silently-skipped
+/// record that lost the write) at whichever site was not updated in lockstep.
+///
+/// Map-encoded (`#[msgpack(map)]`), keying fields by name so the set can grow
+/// additively — the same idiom [`RedoRecord`] uses. `system_from` is
+/// `#[msgpack(default)]`, so a record written before that field existed decodes
+/// it to `None`, preserving legacy records without a separate fallback path.
+#[derive(
+    Debug,
+    Clone,
+    PartialEq,
+    Eq,
+    Serialize,
+    Deserialize,
+    zerompk::ToMessagePack,
+    zerompk::FromMessagePack,
+)]
+#[msgpack(map)]
+pub struct EdgePutRedo {
+    pub collection: String,
+    pub src_id: String,
+    pub label: String,
+    pub dst_id: String,
+    pub properties: Vec<u8>,
+    pub src_surrogate: u32,
+    pub dst_surrogate: u32,
+    /// Frozen bitemporal `system_from` ordinal for deterministic cross-replica
+    /// replay. `None` in legacy records that predate the field.
+    #[serde(default)]
+    #[msgpack(default)]
+    pub system_from: Option<i64>,
+}
+
+/// Redo sub-record payload for a graph edge delete — the payload bytes of a
+/// [`RecordType::Delete`](nodedb_wal::record::RecordType::Delete) sub-record
+/// inside a graph `RedoRecord`. See [`EdgePutRedo`] for why this is a struct
+/// rather than a positional tuple.
+#[derive(
+    Debug,
+    Clone,
+    PartialEq,
+    Eq,
+    Serialize,
+    Deserialize,
+    zerompk::ToMessagePack,
+    zerompk::FromMessagePack,
+)]
+#[msgpack(map)]
+pub struct EdgeDeleteRedo {
+    pub collection: String,
+    pub src_id: String,
+    pub label: String,
+    pub dst_id: String,
+    /// Frozen bitemporal `system_from` ordinal for deterministic cross-replica
+    /// replay. `None` in legacy records that predate the field.
+    #[serde(default)]
+    #[msgpack(default)]
+    pub system_from: Option<i64>,
+}
+
 impl RedoRecord {
     /// Serialize to a zerompk MessagePack payload for WAL append.
     pub fn to_bytes(&self) -> crate::Result<Vec<u8>> {

From 1d1b30d4dc572dbfda779b906c120529e891d20f Mon Sep 17 00:00:00 2001
From: Farhan Syah <bizimpulse@gmail.com>
Date: Tue, 21 Jul 2026 15:33:16 +0800
Subject: [PATCH 03/10] fix(client): discard stale response frames on the
 native connection

A fan-out query for a preceding request could leave stale trailing
frames on the wire after that request's terminal frame was already
returned to its caller. Check the response sequence number against
the request that was sent and drop any frame that doesn't match,
instead of misattributing another request's rows or status as this
request's response.
---
 nodedb-client/src/native/connection/mod.rs | 18 +++++++++++++++++-
 1 file changed, 17 insertions(+), 1 deletion(-)

diff --git a/nodedb-client/src/native/connection/mod.rs b/nodedb-client/src/native/connection/mod.rs
index d610c3c31..05cf17858 100644
--- a/nodedb-client/src/native/connection/mod.rs
+++ b/nodedb-client/src/native/connection/mod.rs
@@ -356,9 +356,10 @@ impl NativeConnection {
         op: OpCode,
         fields: TextFields,
     ) -> NodeDbResult<NativeResponse> {
+        let req_seq = self.next_seq();
         let req = NativeRequest {
             op,
-            seq: self.next_seq(),
+            seq: req_seq,
             fields: RequestFields::Text(fields),
         };
 
@@ -396,6 +397,21 @@ impl NativeConnection {
                 NodeDbError::serialization("msgpack", format!("response decode: {e}"))
             })?;
 
+            if resp.seq != req_seq {
+                // A fan-out query for a preceding request can leave stale
+                // trailing frames on the wire after that request's terminal
+                // frame was already returned to its caller. Discard any
+                // frame that doesn't belong to this request rather than
+                // misattributing it — never surface another request's rows
+                // or status as this request's response.
+                tracing::warn!(
+                    expected_seq = req_seq,
+                    got_seq = resp.seq,
+                    "native connection: discarding stale response frame"
+                );
+                continue;
+            }
+
             if resp.status == ResponseStatus::Partial {
                 if partial_columns.is_none() {
                     partial_columns = resp.columns;

From 17f88d6c4188d26a153c4a2702718ebde311f7ae Mon Sep 17 00:00:00 2001
From: Farhan Syah <bizimpulse@gmail.com>
Date: Tue, 21 Jul 2026 15:33:28 +0800
Subject: [PATCH 04/10] fix(sql): fold and validate catalog exprs for search
 plan variants

VectorSearch, TextSearch, SpatialScan, RecursiveScan, MultiVectorSearch,
SparseSearch, HybridSearch, and HybridSearchTriple plans fell through
catalog_fold's and catalog_plan_validate's wildcard arm, so their
filters and projections never had catalog identifiers resolved or
validated. Add explicit arms that fold/validate each plan's filters and
projection.
---
 nodedb-sql/src/planner/catalog_fold.rs        | 70 +++++++++++++++++++
 .../src/planner/catalog_plan_validate.rs      | 40 +++++++++++
 2 files changed, 110 insertions(+)

diff --git a/nodedb-sql/src/planner/catalog_fold.rs b/nodedb-sql/src/planner/catalog_fold.rs
index fb3de973f..08b93fdce 100644
--- a/nodedb-sql/src/planner/catalog_fold.rs
+++ b/nodedb-sql/src/planner/catalog_fold.rs
@@ -349,6 +349,76 @@ fn walk_plan(
             }
         }
 
+        mut plan @ (SqlPlan::VectorSearch { .. }
+        | SqlPlan::TextSearch { .. }
+        | SqlPlan::SpatialScan { .. }
+        | SqlPlan::RecursiveScan { .. }) => {
+            match &mut plan {
+                SqlPlan::VectorSearch {
+                    filters,
+                    projection,
+                    ..
+                } => {
+                    for filter in filters {
+                        fold_filter(filter, catalog, database_id, tenant_id);
+                    }
+                    fold_projection(projection, catalog, database_id, tenant_id);
+                }
+                SqlPlan::TextSearch {
+                    filters,
+                    projection,
+                    ..
+                } => {
+                    for filter in filters {
+                        fold_filter(filter, catalog, database_id, tenant_id);
+                    }
+                    fold_projection(projection, catalog, database_id, tenant_id);
+                }
+                SqlPlan::SpatialScan {
+                    attribute_filters,
+                    projection,
+                    ..
+                } => {
+                    for filter in attribute_filters {
+                        fold_filter(filter, catalog, database_id, tenant_id);
+                    }
+                    fold_projection(projection, catalog, database_id, tenant_id);
+                }
+                SqlPlan::RecursiveScan {
+                    base_filters,
+                    recursive_filters,
+                    projection,
+                    ..
+                } => {
+                    for filter in base_filters {
+                        fold_filter(filter, catalog, database_id, tenant_id);
+                    }
+                    for filter in recursive_filters {
+                        fold_filter(filter, catalog, database_id, tenant_id);
+                    }
+                    fold_projection(projection, catalog, database_id, tenant_id);
+                }
+                _ => unreachable!(),
+            }
+            plan
+        }
+
+        mut plan @ (SqlPlan::MultiVectorSearch { .. }
+        | SqlPlan::SparseSearch { .. }
+        | SqlPlan::HybridSearch { .. }
+        | SqlPlan::HybridSearchTriple { .. }) => {
+            match &mut plan {
+                SqlPlan::MultiVectorSearch { projection, .. }
+                | SqlPlan::SparseSearch { projection, .. }
+                | SqlPlan::HybridSearch { projection, .. }
+                | SqlPlan::HybridSearchTriple { projection, .. } => {
+                    fold_projection(projection, catalog, database_id, tenant_id);
+                }
+                _ => unreachable!(),
+            }
+            plan
+        }
+
         // Plan variants without expression-bearing filters pass through unchanged.
         other => other,
     }
diff --git a/nodedb-sql/src/planner/catalog_plan_validate.rs b/nodedb-sql/src/planner/catalog_plan_validate.rs
index c154c8db1..be7374e29 100644
--- a/nodedb-sql/src/planner/catalog_plan_validate.rs
+++ b/nodedb-sql/src/planner/catalog_plan_validate.rs
@@ -159,6 +159,46 @@ pub(super) fn validate_catalog_exprs(
                 }
             }
         }
+        SqlPlan::VectorSearch {
+            filters,
+            projection,
+            ..
+        } => {
+            validate_filters(filters, catalog, database_id, tenant_id)?;
+            validate_projection(projection, catalog, database_id, tenant_id)?;
+        }
+        SqlPlan::MultiVectorSearch { projection, .. }
+        | SqlPlan::SparseSearch { projection, .. }
+        | SqlPlan::HybridSearch { projection, .. }
+        | SqlPlan::HybridSearchTriple { projection, .. } => {
+            validate_projection(projection, catalog, database_id, tenant_id)?;
+        }
+        SqlPlan::TextSearch {
+            filters,
+            projection,
+            ..
+        } => {
+            validate_filters(filters, catalog, database_id, tenant_id)?;
+            validate_projection(projection, catalog, database_id, tenant_id)?;
+        }
+        SqlPlan::SpatialScan {
+            attribute_filters,
+            projection,
+            ..
+        } => {
+            validate_filters(attribute_filters, catalog, database_id, tenant_id)?;
+            validate_projection(projection, catalog, database_id, tenant_id)?;
+        }
+        SqlPlan::RecursiveScan {
+            base_filters,
+            recursive_filters,
+            projection,
+            ..
+        } => {
+            validate_filters(base_filters, catalog, database_id, tenant_id)?;
+            validate_filters(recursive_filters, catalog, database_id, tenant_id)?;
+            validate_projection(projection, catalog, database_id, tenant_id)?;
+        }
         _ => {}
     }
     Ok(())

From 39bc571ba061d2ca3d5ac0c5b326ba4649d68f21 Mon Sep 17 00:00:00 2001
From: Farhan Syah <bizimpulse@gmail.com>
Date: Tue, 21 Jul 2026 15:33:46 +0800
Subject: [PATCH 05/10] fix(catalog): don't misclassify HLC-ahead version
 regressions as stale replay

A carried version lower than the persisted prior was always treated as
an already-applied stale replay, even when its HLC clock was strictly
newer than the persisted record's. Only mark it stale when the clock is
not ahead of the persisted one; a regressed version paired with a newer
HLC is a genuine anomaly and must still be rejected.
---
 nodedb/src/control/catalog_entry/descriptor_stamp.rs | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/nodedb/src/control/catalog_entry/descriptor_stamp.rs b/nodedb/src/control/catalog_entry/descriptor_stamp.rs
index 32ed4ed43..30f164890 100644
--- a/nodedb/src/control/catalog_entry/descriptor_stamp.rs
+++ b/nodedb/src/control/catalog_entry/descriptor_stamp.rs
@@ -504,7 +504,12 @@ fn validate_one<T: zerompk::ToMessagePack>(
     if current.is_some() && incoming_hlc < current_hlc {
         return Ok(ValidationOutcome::AlreadyApplied);
     }
-    if carried < prior {
+    // A lower carried version is a stale historical replay only when its clock
+    // is not ahead of the persisted record (older or equal — legacy records
+    // predating HLC stamping share the ZERO clock). A regressed version paired
+    // with a strictly newer HLC is a genuine anomaly (a corrupted or misordered
+    // proposal, a stamping race) and must fall through to be rejected loudly.
+    if carried < prior && incoming_hlc <= current_hlc {
         return Ok(ValidationOutcome::AlreadyApplied);
     }
     if carried == prior {

From c638ae85f1aa83111ebde5160498eb3cae59ba8c Mon Sep 17 00:00:00 2001
From: Farhan Syah <bizimpulse@gmail.com>
Date: Tue, 21 Jul 2026 15:33:57 +0800
Subject: [PATCH 06/10] fix(cluster): force infra-abort completion on failed
 local flush/apply

A failed flush/drop response or executor apply left the transaction
parked with its locks held instead of completing, wedging every txn
queued behind those keys and freezing the vShard's epoch watermark
(which anchors cross-shard BEGIN snapshots) with nothing left to
re-drive the entry. Since the outcome is already globally durable (the
verdict is committed and the resolved redo already WAL-appended), a
local failure is an infrastructure event, not an outcome change:
surface the infra abort and force completion, matching the
forward-progress contract the dispatch-failure path already follows.
---
 .../scheduler/driver/core/commit_resolve.rs   | 24 +++++++++++++++----
 .../scheduler/driver/core/completion_route.rs | 22 ++++++++++++-----
 2 files changed, 35 insertions(+), 11 deletions(-)

diff --git a/nodedb/src/control/cluster/calvin/scheduler/driver/core/commit_resolve.rs b/nodedb/src/control/cluster/calvin/scheduler/driver/core/commit_resolve.rs
index 1f38b9d16..7acd0e9b7 100644
--- a/nodedb/src/control/cluster/calvin/scheduler/driver/core/commit_resolve.rs
+++ b/nodedb/src/control/cluster/calvin/scheduler/driver/core/commit_resolve.rs
@@ -275,22 +275,36 @@ impl Scheduler {
                 true
             }
         } else {
-            tracing::warn!(
+            tracing::error!(
                 vshard_id = self.vshard_id,
                 epoch = txn_id.epoch,
                 position = txn_id.position,
                 committed,
-                "calvin: flush/drop response was not Ok; locks NOT released (shard degraded)"
+                "calvin: flush/drop response was not Ok while applying an already-committed \
+                 verdict; forcing infra-abort completion so locks release and the epoch advances"
             );
-            self.metrics.record_executor_error();
-            self.metrics
-                .record_infra_abort(infra_abort_reason::IO_ERROR);
             false
         };
 
         if completed {
             self.metrics.record_completed();
             self.on_txn_complete(txn_id);
+        } else {
+            // The cross-shard verdict is already globally durable, and a commit's
+            // resolved redo was WAL-appended before this flush — so recovery
+            // re-applies the write. A local flush/apply or WAL-marker failure is
+            // therefore an infrastructure event, NOT an outcome change. It must
+            // never leave the txn parked: holding its locks forever wedges every
+            // txn queued behind those keys and freezes this vShard's epoch
+            // watermark (which anchors cross-shard BEGIN snapshots), and nothing
+            // re-drives a non-`AwaitingVerdict` pending entry. Surface the infra
+            // abort and force completion — the same forward-progress contract the
+            // resolve/drop dispatch-failure path in `resume_on_verdict` follows.
+            self.metrics.record_executor_error();
+            self.metrics
+                .record_infra_abort(infra_abort_reason::IO_ERROR);
+            self.metrics.record_completed();
+            self.on_txn_complete(txn_id);
         }
     }
 
diff --git a/nodedb/src/control/cluster/calvin/scheduler/driver/core/completion_route.rs b/nodedb/src/control/cluster/calvin/scheduler/driver/core/completion_route.rs
index 8bd1b94f5..99ab2d4dc 100644
--- a/nodedb/src/control/cluster/calvin/scheduler/driver/core/completion_route.rs
+++ b/nodedb/src/control/cluster/calvin/scheduler/driver/core/completion_route.rs
@@ -167,15 +167,12 @@ impl Scheduler {
             }
             self.commit_apply_tail(txn_id, response, None)
         } else {
-            tracing::warn!(
+            tracing::error!(
                 vshard_id = self.vshard_id,
                 epoch = txn_id.epoch,
                 position = txn_id.position,
-                "calvin: executor response was not Ok; locks NOT released (shard degraded)"
-            );
-            self.metrics.record_executor_error();
-            self.metrics.record_infra_abort(
-                crate::control::cluster::calvin::scheduler::metrics::infra_abort_reason::IO_ERROR,
+                "calvin: executor response was not Ok; forcing infra-abort completion so locks \
+                 release and the epoch advances"
             );
             false
         };
@@ -183,6 +180,19 @@ impl Scheduler {
         if completed {
             self.metrics.record_completed();
             self.on_txn_complete(txn_id);
+        } else {
+            // A failed direct apply must not leave the txn parked with its locks
+            // held: that wedges every txn queued behind those keys and freezes
+            // this vShard's epoch watermark, and no sweep re-drives the entry.
+            // Surface the infra abort and force completion — the same
+            // forward-progress contract the disconnected-channel path above
+            // follows.
+            self.metrics.record_executor_error();
+            self.metrics.record_infra_abort(
+                crate::control::cluster::calvin::scheduler::metrics::infra_abort_reason::IO_ERROR,
+            );
+            self.metrics.record_completed();
+            self.on_txn_complete(txn_id);
         }
     }
 }

From 34c914334aa06969d5ef031225ad14f0d60b3df0 Mon Sep 17 00:00:00 2001
From: Farhan Syah <bizimpulse@gmail.com>
Date: Tue, 21 Jul 2026 15:34:07 +0800
Subject: [PATCH 07/10] fix(cluster): wait for sequencer leader election before
 failing cross-shard submit

submit_calvin_routed failed immediately when no sequencer-group leader
was elected yet, which could fail a client's very first write during
the brief post-startup election window or a re-election gap. Since a
leader_id of 0 also guarantees nothing has been submitted, poll with a
bounded backoff schedule and re-read the leader before giving up; only
a genuinely leaderless cluster exhausts the schedule and surfaces the
typed error.
---
 nodedb/src/control/planner/calvin/submit.rs | 46 +++++++++++++++------
 1 file changed, 34 insertions(+), 12 deletions(-)

diff --git a/nodedb/src/control/planner/calvin/submit.rs b/nodedb/src/control/planner/calvin/submit.rs
index 779298a37..7e88aed04 100644
--- a/nodedb/src/control/planner/calvin/submit.rs
+++ b/nodedb/src/control/planner/calvin/submit.rs
@@ -178,6 +178,13 @@ pub async fn submit_and_await_calvin_with_timeout(
     }
 }
 
+/// Backoff schedule (milliseconds) for waiting on the sequencer-group leader
+/// election before a cross-shard submit. Covers the brief post-startup window
+/// (a fresh single-node cluster elects in a couple of seconds) and short
+/// re-election gaps. Bounded: once the schedule is exhausted a genuinely
+/// leaderless cluster surfaces a typed error rather than hanging.
+const SEQUENCER_LEADER_WAIT_BACKOFF_MS: &[u64] = &[50, 100, 200, 400, 800, 1000, 1000, 1000];
+
 /// Submit a cross-shard Calvin `tx_class`, routing it to the sequencer-group
 /// leader so it is actually sequenced and acked.
 ///
@@ -189,8 +196,10 @@ pub async fn submit_and_await_calvin_with_timeout(
 ///   topology, then send one `SubmitCalvinTxnRequest` (carrying the
 ///   msgpack-encoded `TxClass`); the leader runs the submit-and-await and
 ///   replies. Map transport / leader errors to a typed `crate::Error`.
-/// - **No leader elected (0 / none)**: return a typed error — never submit
-///   locally, since a non-leader submit is silently discarded.
+/// - **No leader elected (0 / none)**: wait through
+///   [`SEQUENCER_LEADER_WAIT_BACKOFF_MS`] for an election, then return a typed
+///   error — never submit on a non-leader, since that submit is silently
+///   discarded.
 pub async fn submit_calvin_routed(
     state: &SharedState,
     tx_class: TxClass,
@@ -211,17 +220,30 @@ pub async fn submit_calvin_routed(
     let status_fn = state.raft_status_fn.get().ok_or_else(|| Error::Internal {
         detail: "calvin-submit: raft status fn not installed (cluster not started)".to_owned(),
     })?;
-    let leader = status_fn()
-        .into_iter()
-        .find(|g| g.group_id == SEQUENCER_GROUP_ID)
-        .map(|g| g.leader_id)
-        .unwrap_or(0);
 
-    // `0` = no sequencer leader elected yet. We must NOT submit locally: a
-    // non-leader submit is drained and discarded by the local sequencer service,
-    // so the caller would time out at the assignment phase. Surface a typed error
-    // (same divergence-safety contract as the routed-surrogate leader==0 path) so
-    // the caller retries once an election resolves.
+    // `leader_id == 0` means no sequencer leader is elected YET — the brief
+    // window right after startup (the client gateway can open before the
+    // sequencer group finishes its first election) or during a re-election.
+    // Submitting on a non-leader is drained and discarded, so we must not; but
+    // `leader == 0` also guarantees NOTHING has been submitted, so waiting for
+    // the election to resolve and re-reading is safe and idempotent. Poll with
+    // bounded backoff (mirroring the gateway's NotLeader retry) rather than
+    // failing the client's very first write on a freshly-ready node; only a
+    // genuinely leaderless cluster exhausts the schedule and surfaces the error.
+    let mut leader = 0;
+    for (attempt, &backoff_ms) in SEQUENCER_LEADER_WAIT_BACKOFF_MS.iter().enumerate() {
+        leader = status_fn()
+            .into_iter()
+            .find(|g| g.group_id == SEQUENCER_GROUP_ID)
+            .map(|g| g.leader_id)
+            .unwrap_or(0);
+        if leader != 0 {
+            break;
+        }
+        if attempt + 1 < SEQUENCER_LEADER_WAIT_BACKOFF_MS.len() {
+            tokio::time::sleep(std::time::Duration::from_millis(backoff_ms)).await;
+        }
+    }
     if leader == 0 {
         return Err(Error::Internal {
             detail: "calvin-submit: no sequencer leader elected yet; cannot submit cross-shard \

From 3b95bf2b104d4970ed9d550b1384086a3c0e22ff Mon Sep 17 00:00:00 2001
From: Farhan Syah <bizimpulse@gmail.com>
Date: Tue, 21 Jul 2026 15:34:18 +0800
Subject: [PATCH 08/10] fix(ddl): report tenant-teardown purge counts in the
 drop-user audit trail

DROP USER during tenant teardown purged the user's owned objects
outright but recorded the same "no owned objects required reassignment"
audit detail as a user with nothing owned, misreporting a destructive
purge as a no-op. purge_owned_for_tenant_teardown now returns the
purged count, and the audit detail distinguishes reassignment, no
ownership, and teardown purge outcomes.
---
 .../server/shared/ddl/neutral/user/drop.rs    | 42 +++++++++++++++----
 .../shared/ddl/neutral/user/tenant_purge.rs   |  9 +++-
 2 files changed, 42 insertions(+), 9 deletions(-)

diff --git a/nodedb/src/control/server/shared/ddl/neutral/user/drop.rs b/nodedb/src/control/server/shared/ddl/neutral/user/drop.rs
index 578c279ef..116ccdddc 100644
--- a/nodedb/src/control/server/shared/ddl/neutral/user/drop.rs
+++ b/nodedb/src/control/server/shared/ddl/neutral/user/drop.rs
@@ -19,6 +19,16 @@ use super::super::auth_support::{require_tenant_admin, status, strip_if_exists};
 use super::reassign_owned::reassign_owned_and_sweep_grants;
 use super::tenant_purge::purge_owned_for_tenant_teardown;
 
+/// How a dropped user's owned objects were disposed of, for the audit trail.
+enum OwnershipDisposition {
+    /// Objects were reassigned to the named tenant administrator.
+    Reassigned(String),
+    /// The user owned nothing that required reassignment.
+    NoneOwned,
+    /// Tenant teardown purged the given number of owned objects outright.
+    Purged(usize),
+}
+
 /// DROP USER [IF EXISTS] <name>
 pub fn drop_user(
     state: &SharedState,
@@ -106,11 +116,22 @@ fn drop_user_inner(
     // user, BEFORE removing the user row. Fail-closed: any error here
     // aborts the drop, because a partially-reassigned-then-deleted user
     // is exactly the dangling-reference bug this guards against.
-    let admin_name = if tenant_teardown {
-        purge_owned_for_tenant_teardown(state, username, user_tenant)?;
-        None
+    //
+    // During tenant teardown the owned objects are purged outright (the
+    // tenant is going away), so the audit trail must record the destructive
+    // purge — not misreport it as "nothing owned" the way the reassign path's
+    // `None` does.
+    let disposition = if tenant_teardown {
+        OwnershipDisposition::Purged(purge_owned_for_tenant_teardown(
+            state,
+            username,
+            user_tenant,
+        )?)
     } else {
-        reassign_owned_and_sweep_grants(state, username, user_tenant)?
+        match reassign_owned_and_sweep_grants(state, username, user_tenant)? {
+            Some(admin_name) => OwnershipDisposition::Reassigned(admin_name),
+            None => OwnershipDisposition::NoneOwned,
+        }
     };
 
     // `DropUser` fully removes the identity record on every node —
@@ -145,11 +166,18 @@ fn drop_user_inner(
     };
 
     if dropped {
-        let detail = match admin_name {
-            Some(admin_name) => {
+        let detail = match disposition {
+            OwnershipDisposition::Reassigned(admin_name) => {
                 format!("dropped user '{username}' (ownership reassigned to '{admin_name}')")
             }
-            None => format!("dropped user '{username}' (no owned objects required reassignment)"),
+            OwnershipDisposition::NoneOwned => {
+                format!("dropped user '{username}' (no owned objects required reassignment)")
+            }
+            OwnershipDisposition::Purged(purged) => {
+                format!(
+                    "dropped user '{username}' (tenant teardown purged {purged} owned object(s))"
+                )
+            }
         };
         state.audit_record(
             AuditEvent::PrivilegeChange,
diff --git a/nodedb/src/control/server/shared/ddl/neutral/user/tenant_purge.rs b/nodedb/src/control/server/shared/ddl/neutral/user/tenant_purge.rs
index 7524a80e0..2bcb923f3 100644
--- a/nodedb/src/control/server/shared/ddl/neutral/user/tenant_purge.rs
+++ b/nodedb/src/control/server/shared/ddl/neutral/user/tenant_purge.rs
@@ -11,16 +11,20 @@ use crate::types::TenantId;
 use super::super::super::result::DdlError;
 use super::reassign_owned::{OwnerKind, ddl_err, propose, sweep_grants};
 
+/// Purge every object owned by the tenant administrator during `DROP TENANT`,
+/// returning the number of owned objects deleted so the caller can record an
+/// accurate audit trail for the destructive teardown.
 pub(super) fn purge_owned_for_tenant_teardown(
     state: &SharedState,
     username: &str,
     tenant: TenantId,
-) -> Result<(), DdlError> {
+) -> Result<usize, DdlError> {
     let catalog = state.credentials.catalog();
     let mut owned = catalog
         .owners_for_user(username, tenant.as_u64())
         .map_err(|e| ddl_err(format!("load owner rows: {e}")))?;
     owned.sort_by_key(|owner| owner.object_type == object_type::COLLECTION);
+    let purged = owned.len();
 
     for owner in owned {
         let kind = OwnerKind::from_object_type(&owner.object_type).ok_or_else(|| {
@@ -48,7 +52,8 @@ pub(super) fn purge_owned_for_tenant_teardown(
                 );
         }
     }
-    sweep_grants(state, catalog, username)
+    sweep_grants(state, catalog, username)?;
+    Ok(purged)
 }
 
 fn purge_collection_rls_policies(

From 8f0c9a8bea3e287fa5bc6f7993623e2951c758d0 Mon Sep 17 00:00:00 2001
From: Farhan Syah <bizimpulse@gmail.com>
Date: Tue, 21 Jul 2026 15:34:29 +0800
Subject: [PATCH 09/10] fix(session): re-verify local vShard ownership before
 the durable WAL append

run_commit resolves a vShard as Local, but a leadership handoff can
land during the ResolveTxn await that follows. Without a re-check right
before the durable append, the transaction redo could be written to a
WAL this node no longer owns, and the later batch dispatch (which
re-resolves leadership) would then reject the now-non-local commit,
leaving an orphaned durable redo record while the client is told the
commit aborted. Abort before any durable write instead, so the failure
stays side-effect-free and the client's retry can route through
Calvin's replicated barrier.
---
 .../control/server/shared/session/commit.rs   | 20 +++++++++++++++++++
 1 file changed, 20 insertions(+)

diff --git a/nodedb/src/control/server/shared/session/commit.rs b/nodedb/src/control/server/shared/session/commit.rs
index d18a8bb51..6c92f944f 100644
--- a/nodedb/src/control/server/shared/session/commit.rs
+++ b/nodedb/src/control/server/shared/session/commit.rs
@@ -335,6 +335,26 @@ async fn dispatch_single_shard(
         }
     };
 
+    // Re-verify local vShard ownership immediately before the durable WAL
+    // append. `run_commit` resolved this vShard as `Local`, but a leadership
+    // handoff can land during the `ResolveTxn` await above. Without this
+    // re-check the transaction redo would be appended to a WAL this node no
+    // longer owns, and the batch dispatch below (which re-resolves leadership)
+    // would then reject the now-non-local commit — leaving an orphaned durable
+    // redo record behind while the client is told the commit aborted. Aborting
+    // here, BEFORE any durable write, keeps the failure side-effect-free and
+    // retryable: the client's retry re-enters `run_commit`, sees the vShard is
+    // non-local, and routes the commit through Calvin's replicated barrier.
+    if !matches!(
+        crate::control::server::graph_dispatch::cluster_resolve::resolve_for_vshard(
+            state,
+            vshard_id.as_u32(),
+        ),
+        RouteDecision::Local
+    ) {
+        return Some(AbortReason::Serialization);
+    }
+
     // 2. Write-ahead the transaction as ONE replayable `TransactionRedo` record
     //    (each sub-op keeps its real engine `record_type`). `None` when the txn
     //    has no durable writes (all reads / CRDT / text). Its LSN stamps the

From d79eccf19d16e307f8a29f19ee4b1f4020212f85 Mon Sep 17 00:00:00 2001
From: Farhan Syah <bizimpulse@gmail.com>
Date: Tue, 21 Jul 2026 15:34:40 +0800
Subject: [PATCH 10/10] refactor(aggregate): bundle cache key inputs into a
 params struct

Replace aggregate_cache_key's nine positional arguments (and its
too_many_arguments allow) with an AggregateCacheKeyInputs struct,
naming the complete query shape that constitutes the cache identity.
---
 .../executor/handlers/aggregate/cache_key.rs  | 38 ++++++++++++++-----
 .../data/executor/handlers/aggregate/exec.rs  | 14 +++----
 .../handlers/aggregate/streaming/over_docs.rs |  8 ++--
 3 files changed, 39 insertions(+), 21 deletions(-)

diff --git a/nodedb/src/data/executor/handlers/aggregate/cache_key.rs b/nodedb/src/data/executor/handlers/aggregate/cache_key.rs
index 3842fedf6..1842e0036 100644
--- a/nodedb/src/data/executor/handlers/aggregate/cache_key.rs
+++ b/nodedb/src/data/executor/handlers/aggregate/cache_key.rs
@@ -46,19 +46,37 @@ fn aggregate_specs_key(aggregates: &[AggregateSpec]) -> String {
         .join(",")
 }
 
-#[allow(clippy::too_many_arguments)] // complete query shape is the cache identity
+/// Complete query shape that constitutes an aggregate result's cache identity.
+/// Every field participates in the key — two aggregate queries that differ in
+/// any one of them (output aliases, `LIMIT`, `ORDER BY`, sub-aggregation) must
+/// not collide on a shared cache entry.
+pub(super) struct AggregateCacheKeyInputs<'a> {
+    pub database_id: u64,
+    pub tid: u64,
+    pub collection: &'a str,
+    pub group_by: &'a [GroupKeySpec],
+    pub aggregates: &'a [AggregateSpec],
+    pub sub_group_by: &'a [String],
+    pub sub_aggregates: &'a [AggregateSpec],
+    pub limit: usize,
+    pub sort_keys: &'a [(String, bool)],
+}
+
 pub(super) fn aggregate_cache_key(
-    database_id: u64,
-    tid: u64,
-    collection: &str,
-    group_by: &[GroupKeySpec],
-    aggregates: &[AggregateSpec],
-    sub_group_by: &[String],
-    sub_aggregates: &[AggregateSpec],
-    limit: usize,
-    sort_keys: &[(String, bool)],
+    inputs: AggregateCacheKeyInputs<'_>,
 ) -> (crate::types::DatabaseId, crate::types::TenantId, String) {
     use std::fmt::Write;
+    let AggregateCacheKeyInputs {
+        database_id,
+        tid,
+        collection,
+        group_by,
+        aggregates,
+        sub_group_by,
+        sub_aggregates,
+        limit,
+        sort_keys,
+    } = inputs;
     let mut rest = format!(
         "{collection}\0{}\0{}",
         group_specs_key(group_by),
diff --git a/nodedb/src/data/executor/handlers/aggregate/exec.rs b/nodedb/src/data/executor/handlers/aggregate/exec.rs
index 4365ef200..d72b4e53a 100644
--- a/nodedb/src/data/executor/handlers/aggregate/exec.rs
+++ b/nodedb/src/data/executor/handlers/aggregate/exec.rs
@@ -6,7 +6,7 @@
 
 use tracing::debug;
 
-use super::cache_key::{aggregate_cache_key, legacy_aggregate_pairs};
+use super::cache_key::{AggregateCacheKeyInputs, aggregate_cache_key, legacy_aggregate_pairs};
 use super::rows::{apply_user_aliases_to_rows, sort_aggregated_rows};
 use crate::bridge::envelope::{ErrorCode, Response};
 use crate::bridge::scan_filter::ScanFilter;
@@ -119,8 +119,8 @@ impl CoreLoop {
 
         // Fast path: incremental aggregate cache.
         if filters.is_empty() && having.is_empty() {
-            let cache_key = aggregate_cache_key(
-                task.request.database_id.as_u64(),
+            let cache_key = aggregate_cache_key(AggregateCacheKeyInputs {
+                database_id: task.request.database_id.as_u64(),
                 tid,
                 collection,
                 group_by,
@@ -129,7 +129,7 @@ impl CoreLoop {
                 sub_aggregates,
                 limit,
                 sort_keys,
-            );
+            });
             if let Some(cached) = self.aggregate_cache.get(&cache_key) {
                 debug!(core = self.core_id, %collection, "aggregate cache hit");
                 return self.response_with_payload(task, cached.clone());
@@ -273,8 +273,8 @@ impl CoreLoop {
                 ) {
                     Ok(payload) => {
                         if filters.is_empty() && having.is_empty() {
-                            let cache_key = aggregate_cache_key(
-                                task.request.database_id.as_u64(),
+                            let cache_key = aggregate_cache_key(AggregateCacheKeyInputs {
+                                database_id: task.request.database_id.as_u64(),
                                 tid,
                                 collection,
                                 group_by,
@@ -283,7 +283,7 @@ impl CoreLoop {
                                 sub_aggregates,
                                 limit,
                                 sort_keys,
-                            );
+                            });
                             if self.aggregate_cache.len() < 256 {
                                 self.aggregate_cache.insert(cache_key, payload.clone());
                             }
diff --git a/nodedb/src/data/executor/handlers/aggregate/streaming/over_docs.rs b/nodedb/src/data/executor/handlers/aggregate/streaming/over_docs.rs
index f520a7bbe..fed6151cb 100644
--- a/nodedb/src/data/executor/handlers/aggregate/streaming/over_docs.rs
+++ b/nodedb/src/data/executor/handlers/aggregate/streaming/over_docs.rs
@@ -3,7 +3,7 @@
 //! `aggregate_over_docs`: orchestrate accumulate + finalize over an
 //! already-materialized doc set, layering the per-shard result cache on top.
 
-use super::super::cache_key::aggregate_cache_key;
+use super::super::cache_key::{AggregateCacheKeyInputs, aggregate_cache_key};
 use crate::bridge::envelope::{ErrorCode, Response};
 use crate::data::executor::core_loop::CoreLoop;
 use crate::data::executor::task::ExecutionTask;
@@ -104,8 +104,8 @@ impl CoreLoop {
                     && filters.is_empty()
                     && having.is_empty()
                 {
-                    let cache_key = aggregate_cache_key(
-                        task.request.database_id.as_u64(),
+                    let cache_key = aggregate_cache_key(AggregateCacheKeyInputs {
+                        database_id: task.request.database_id.as_u64(),
                         tid,
                         collection,
                         group_by,
@@ -114,7 +114,7 @@ impl CoreLoop {
                         sub_aggregates,
                         limit,
                         sort_keys,
-                    );
+                    });
                     if self.aggregate_cache.len() < 256 {
                         self.aggregate_cache.insert(cache_key, payload.clone());
                     }