[pdlug]

Second whole-branch review of #637, the store and query findings: getOrCreate({ partOf }) could silently reparent during a race, an attachment could commit even though getOrCreate rejected, scoped tx.measure receipts omitted cascaded parts, and a complete owned-unit export still truncated silently at 1,000 hops.

One fenced owner for an attachment against an existing row

applyCompositionAttachmentUnderFence re-reads the incumbent under the per-graph write lock, asks decideCompositionIncumbent what that incumbent means, and writes at most one retire and one attach. The only dimension callers differ on is the explicit disposition the write plan carries: nodes.<Kind>.reparent(...) states onIncumbent: "replace", every get-or-create path states "refuse". Before this, the get-or-create partOf postcondition decided from a lock-free read and then called the reparent machinery, whose fenced re-read always replaced, so two callers that each asked for a different whole could both observe "no whole yet" and the second one silently moved the part instead of refusing. The lock-free read survives only as a pre-check that lets an already-satisfied call stay read-only, stated props included (incumbentSatisfiesRequestedAttachment, built on the same props verdict the refusal reads); every verdict and every write comes from the fenced read. resolveCompositionAttachmentRequest is the one resolver every attachment surface reaches. A new two-connection test in the concurrency suite proves the race outcome (one attachment, one refusal) on real overlapping writers rather than an in-process interleaving.

The get-or-create update leg is one write plan, sequenced reads then writes

The existing-row ifExists: "update" and resurrection legs run the attachment inside the same transaction as the property update (executeNodeUpsertUpdate's compositionAttachment). Because that leg runs on a caller's enclosing store.transaction(...) when there is one, with no nested frame to roll back, the frame is ordered so every read the attachment owes precedes the update's first statement: the fenced incumbent decision and the whole's liveness (decideCompositionAttachmentUnderFence, which now carries lock: GraphWriteLock as compile-time evidence like assertCompositionExistencePreserved), then the realizing edge's own preparation (prepareCompositionAttachmentDecision: the part's liveness on the update leg, cardinality, acyclicity, the required-existence rule). attachCompositionCreateEdge is split into that read half and insertPreparedCompositionEdge, and the leg issues only the insert after the update. A refusal from any read leaves nothing written, and a refused property update (a unique conflict, a validation error) never reaches the insert, so ownership and history stay untouched in every case. The resurrection leg skips only the part endpoint read, since its row is a tombstone until the update restores it; the whole is still refused at decide time. assertEndpointRowLive is the one row-liveness predicate both assertLiveEdgeEndpoints and the decide half call. Load-bearing tests cover a conflicting incumbent, a dead whole, and a whole-side cardinality refusal, each caught inside an enclosing transaction with the property left unapplied; each fails with the corresponding read moved back below the update.

Cascaded parts reach every measured receipt

A whole deleted through a tx.measure(...) scope counted as one write in that scope's sub-receipt but contributed nothing to its cascadedParts: cascade refs travel through the node operation context, and a scope was built by wrapping the outer context's collections a second time. A transaction's write surface (collections, identity facade, and the node operation context they bind to) is now built by one parameterized builder, and a measure scope rebuilds it against the whole recorder chain; recordCascadedParts fans out along that chain, so a measured delete populates the scope's receipt and every receipt enclosing it. The scope also overlays the runtime's internal delete port with one built from its own surface, so a delete issued through that port inside a scope is attributed to the scope. Attribution stays structural, by the context the write ran through, never by timing.

The complete owned unit, with no hop ceiling

subgraph({ composition: true }) walked its part closure with a hop-bounded recursive CTE capped at 1,000 levels, so a deeper part chain came back truncated, which is not an export unit. The closure is now buildExhaustiveDirectedReachableCte: UNION over a frontier of exactly (id, kind), the same device that makes the composition-union acyclicity probe exhaustive, so it reaches a fixpoint on any finite graph with no depth ceiling, no path column, and no cycle policy. maxDepth and cyclePolicy continue to bound the edges traversal a caller lists alongside the closure. An engine that cuts the closure statement short (a statement_timeout, a cancelled query) is refused with ConfigurationError (COMPOSITION_UNIT_INDETERMINATE) through the same isStatementCutShortError predicate the probe uses, instead of surfacing an opaque driver error. The hop-bounded directed builder had no other caller and is removed. The ontology and limitations pages state completeness as delivered.

Both surfaces are new in this release, so the incumbent disposition and the exhaustive closure are stated in their changesets as delivered behavior rather than as breaking changes.